@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/chunk-DGG6IBBK.js

@@ -0,0 +1,150 @@
+import {
+  EVENT_TRIGGERS_PER_AUTOMATION_MAX,
+  EVENT_TRIGGER_CONDITIONS_MAX,
+  EVENT_TRIGGER_TYPES_MAX,
+  EventCondition,
+  EventSourceKind,
+  EventTypeName,
+  MAX_EVENT_RUNS_PER_HOUR,
+  WebhookEventAdapter
+} from "./chunk-PI5VIKJY.js";
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
+// src/automation-templates.ts
+import { z } from "zod";
+var AUTOMATION_TEMPLATE_NAME_MAX_LENGTH = 120;
+var AUTOMATION_TEMPLATE_DESCRIPTION_MAX_LENGTH = 500;
+var AUTOMATION_TEMPLATE_INSTRUCTIONS_MAX_LENGTH = 2e4;
+var AUTOMATION_TEMPLATES_PER_WORKSPACE_MAX = 200;
+var Uuid = /* @__PURE__ */ defineSchema(() => z.string().uuid());
+var AutomationTemplateSchedule = /* @__PURE__ */ defineSchema(
+  () => z.discriminatedUnion("type", [
+    z.object({
+      type: z.literal("calendar"),
+      hour: z.number().int().min(0).max(23),
+      minute: z.number().int().min(0).max(59),
+      /** Omitted: every day. */
+      daysOfWeek: z.array(
+        z.enum(["SUNDAY", "MONDAY", "TUESDAY", "WEDNESDAY", "THURSDAY", "FRIDAY", "SATURDAY"])
+      ).min(1).max(7).optional()
+    }).strict(),
+    z.object({
+      type: z.literal("interval"),
+      everySeconds: z.number().int().min(60).max(366 * 86400)
+    }).strict()
+  ])
+);
+var AutomationTemplateEventSource = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    kind: EventSourceKind,
+    /** For a webhook: how it verifies and reads deliveries. */
+    adapter: WebhookEventAdapter.optional(),
+    /** For an MCP source: the server, as configured for the workspace. */
+    mcpServerId: z.string().min(1).max(256).optional(),
+    sourceId: Uuid.optional()
+  }).strict().superRefine((source, context) => {
+    if (source.kind === "webhook" !== (source.adapter !== void 0)) {
+      context.addIssue({
+        code: "custom",
+        path: ["adapter"],
+        message: "A webhook source names its adapter, and only a webhook source does"
+      });
+    }
+    if (source.kind === "mcp" !== (source.mcpServerId !== void 0)) {
+      context.addIssue({
+        code: "custom",
+        path: ["mcpServerId"],
+        message: "An MCP source names its server, and only an MCP source does"
+      });
+    }
+  })
+);
+var AutomationTemplateTrigger = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    source: AutomationTemplateEventSource,
+    eventTypes: z.array(EventTypeName).min(1).max(EVENT_TRIGGER_TYPES_MAX),
+    conditions: z.array(EventCondition).max(EVENT_TRIGGER_CONDITIONS_MAX).default([]),
+    /** Also fire on events made by Opengeni's own bots. */
+    includeOwnEvents: z.boolean().default(false),
+    /** MCP subscription arguments. */
+    arguments: z.record(z.string(), z.unknown()).optional()
+  }).strict()
+);
+var TemplateName = /* @__PURE__ */ defineSchema(
+  () => z.string().trim().min(1).max(AUTOMATION_TEMPLATE_NAME_MAX_LENGTH)
+);
+var TemplateDescription = /* @__PURE__ */ defineSchema(
+  () => z.string().trim().max(AUTOMATION_TEMPLATE_DESCRIPTION_MAX_LENGTH)
+);
+var TemplateInstructions = /* @__PURE__ */ defineSchema(
+  () => z.string().trim().min(1).max(AUTOMATION_TEMPLATE_INSTRUCTIONS_MAX_LENGTH)
+);
+var TemplateTriggers = /* @__PURE__ */ defineSchema(
+  () => z.array(AutomationTemplateTrigger).max(EVENT_TRIGGERS_PER_AUTOMATION_MAX)
+);
+var TemplateMaxRunsPerHour = /* @__PURE__ */ defineSchema(
+  () => z.number().int().min(1).max(MAX_EVENT_RUNS_PER_HOUR).nullable()
+);
+var WorkspaceAutomationTemplate = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    id: Uuid,
+    workspaceId: Uuid,
+    name: z.string(),
+    description: z.string(),
+    instructions: z.string(),
+    /** Null: it runs only on its events or with Run now. */
+    schedule: AutomationTemplateSchedule.nullable(),
+    triggers: TemplateTriggers,
+    maxRunsPerHour: TemplateMaxRunsPerHour,
+    /** Who saved it; null when a workspace-level caller did. */
+    createdBySubjectId: z.string().nullable(),
+    /** `manage`: the reader may rename, change or delete it. */
+    viewerAccess: z.enum(["manage", "use"]),
+    createdAt: z.string(),
+    updatedAt: z.string()
+  })
+);
+var CreateAutomationTemplateRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    name: TemplateName,
+    description: TemplateDescription.default(""),
+    instructions: TemplateInstructions,
+    schedule: AutomationTemplateSchedule.nullable().default(null),
+    triggers: TemplateTriggers.default([]),
+    maxRunsPerHour: TemplateMaxRunsPerHour.default(null)
+  }).strict()
+);
+var UpdateAutomationTemplateRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    name: TemplateName.optional(),
+    description: TemplateDescription.optional(),
+    instructions: TemplateInstructions.optional(),
+    schedule: AutomationTemplateSchedule.nullable().optional(),
+    triggers: TemplateTriggers.optional(),
+    maxRunsPerHour: TemplateMaxRunsPerHour.optional()
+  }).strict()
+);
+var ListAutomationTemplatesResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({ templates: z.array(WorkspaceAutomationTemplate) })
+);
+var AutomationTemplateResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({ template: WorkspaceAutomationTemplate })
+);
+
+export {
+  AUTOMATION_TEMPLATE_NAME_MAX_LENGTH,
+  AUTOMATION_TEMPLATE_DESCRIPTION_MAX_LENGTH,
+  AUTOMATION_TEMPLATE_INSTRUCTIONS_MAX_LENGTH,
+  AUTOMATION_TEMPLATES_PER_WORKSPACE_MAX,
+  AutomationTemplateSchedule,
+  AutomationTemplateEventSource,
+  AutomationTemplateTrigger,
+  WorkspaceAutomationTemplate,
+  CreateAutomationTemplateRequest,
+  UpdateAutomationTemplateRequest,
+  ListAutomationTemplatesResponse,
+  AutomationTemplateResponse
+};
+//# sourceMappingURL=chunk-DGG6IBBK.js.map

package/dist/chunk-DGG6IBBK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/automation-templates.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { defineSchema } from \"./define-schema\";\nimport {\n  EVENT_TRIGGER_CONDITIONS_MAX,\n  EVENT_TRIGGER_TYPES_MAX,\n  EVENT_TRIGGERS_PER_AUTOMATION_MAX,\n  EventCondition,\n  EventSourceKind,\n  EventTypeName,\n  MAX_EVENT_RUNS_PER_HOUR,\n  WebhookEventAdapter,\n} from \"./event-triggers\";\n\n/**\n * Automation templates: where a new automation starts. A template holds what\n * an automation does and when, but never where its runs go, who owns it or\n * which accounts it uses: those come from wherever it is used. Its schedule\n * has no time zone (the person's own applies) and its triggers name a kind\n * of source rather than a source, since sources differ per person.\n *\n * Built-in and host templates live in the client. A workspace keeps the\n * templates its people save from their automations.\n *\n * This module must not import `./index`.\n */\n\nexport const AUTOMATION_TEMPLATE_NAME_MAX_LENGTH = 120;\nexport const AUTOMATION_TEMPLATE_DESCRIPTION_MAX_LENGTH = 500;\nexport const AUTOMATION_TEMPLATE_INSTRUCTIONS_MAX_LENGTH = 20_000;\n/** Saved templates a workspace keeps; saving another past this is refused. */\nexport const AUTOMATION_TEMPLATES_PER_WORKSPACE_MAX = 200;\n\nconst Uuid = /* @__PURE__ */ defineSchema(() => z.string().uuid());\n\n/** When it runs, read in the time zone of whoever uses the template. */\nexport const AutomationTemplateSchedule = /* @__PURE__ */ defineSchema(() =>\n  z.discriminatedUnion(\"type\", [\n    z\n      .object({\n        type: z.literal(\"calendar\"),\n        hour: z.number().int().min(0).max(23),\n        minute: z.number().int().min(0).max(59),\n        /** Omitted: every day. */\n        daysOfWeek: z\n          .array(\n            z.enum([\"SUNDAY\", \"MONDAY\", \"TUESDAY\", \"WEDNESDAY\", \"THURSDAY\", \"FRIDAY\", \"SATURDAY\"]),\n          )\n          .min(1)\n          .max(7)\n          .optional(),\n      })\n      .strict(),\n    z\n      .object({\n        type: z.literal(\"interval\"),\n        everySeconds: z\n          .number()\n          .int()\n          .min(60)\n          .max(366 * 86_400),\n      })\n      .strict(),\n  ]),\n);\nexport type AutomationTemplateSchedule = z.infer<typeof AutomationTemplateSchedule>;\n\n/**\n * The kind of source a template trigger listens on: GitHub, a Linear webhook,\n * one MCP server, this workspace. `sourceId` names a source shared with the\n * workspace, used when the person can use it; otherwise their own source of\n * this kind is.\n */\nexport const AutomationTemplateEventSource = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      kind: EventSourceKind,\n      /** For a webhook: how it verifies and reads deliveries. */\n      adapter: WebhookEventAdapter.optional(),\n      /** For an MCP source: the server, as configured for the workspace. */\n      mcpServerId: z.string().min(1).max(256).optional(),\n      sourceId: Uuid.optional(),\n    })\n    .strict()\n    .superRefine((source, context) => {\n      if ((source.kind === \"webhook\") !== (source.adapter !== undefined)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"adapter\"],\n          message: \"A webhook source names its adapter, and only a webhook source does\",\n        });\n      }\n      if ((source.kind === \"mcp\") !== (source.mcpServerId !== undefined)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"mcpServerId\"],\n          message: \"An MCP source names its server, and only an MCP source does\",\n        });\n      }\n    }),\n);\nexport type AutomationTemplateEventSource = z.infer<typeof AutomationTemplateEventSource>;\n\nexport const AutomationTemplateTrigger = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      source: AutomationTemplateEventSource,\n      eventTypes: z.array(EventTypeName).min(1).max(EVENT_TRIGGER_TYPES_MAX),\n      conditions: z.array(EventCondition).max(EVENT_TRIGGER_CONDITIONS_MAX).default([]),\n      /** Also fire on events made by Opengeni's own bots. */\n      includeOwnEvents: z.boolean().default(false),\n      /** MCP subscription arguments. */\n      arguments: z.record(z.string(), z.unknown()).optional(),\n    })\n    .strict(),\n);\nexport type AutomationTemplateTrigger = z.input<typeof AutomationTemplateTrigger>;\n\nconst TemplateName = /* @__PURE__ */ defineSchema(() =>\n  z.string().trim().min(1).max(AUTOMATION_TEMPLATE_NAME_MAX_LENGTH),\n);\nconst TemplateDescription = /* @__PURE__ */ defineSchema(() =>\n  z.string().trim().max(AUTOMATION_TEMPLATE_DESCRIPTION_MAX_LENGTH),\n);\n/** What the agent does on each run. */\nconst TemplateInstructions = /* @__PURE__ */ defineSchema(() =>\n  z.string().trim().min(1).max(AUTOMATION_TEMPLATE_INSTRUCTIONS_MAX_LENGTH),\n);\nconst TemplateTriggers = /* @__PURE__ */ defineSchema(() =>\n  z.array(AutomationTemplateTrigger).max(EVENT_TRIGGERS_PER_AUTOMATION_MAX),\n);\n/** The storm guard for event runs; null takes the default. */\nconst TemplateMaxRunsPerHour = /* @__PURE__ */ defineSchema(() =>\n  z.number().int().min(1).max(MAX_EVENT_RUNS_PER_HOUR).nullable(),\n);\n\n/** A template saved in a workspace. */\nexport const WorkspaceAutomationTemplate = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    id: Uuid,\n    workspaceId: Uuid,\n    name: z.string(),\n    description: z.string(),\n    instructions: z.string(),\n    /** Null: it runs only on its events or with Run now. */\n    schedule: AutomationTemplateSchedule.nullable(),\n    triggers: TemplateTriggers,\n    maxRunsPerHour: TemplateMaxRunsPerHour,\n    /** Who saved it; null when a workspace-level caller did. */\n    createdBySubjectId: z.string().nullable(),\n    /** `manage`: the reader may rename, change or delete it. */\n    viewerAccess: z.enum([\"manage\", \"use\"]),\n    createdAt: z.string(),\n    updatedAt: z.string(),\n  }),\n);\nexport type WorkspaceAutomationTemplate = z.output<typeof WorkspaceAutomationTemplate>;\n\nexport const CreateAutomationTemplateRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      name: TemplateName,\n      description: TemplateDescription.default(\"\"),\n      instructions: TemplateInstructions,\n      schedule: AutomationTemplateSchedule.nullable().default(null),\n      triggers: TemplateTriggers.default([]),\n      maxRunsPerHour: TemplateMaxRunsPerHour.default(null),\n    })\n    .strict(),\n);\nexport type CreateAutomationTemplateRequest = z.input<typeof CreateAutomationTemplateRequest>;\nexport type ParsedCreateAutomationTemplateRequest = z.output<\n  typeof CreateAutomationTemplateRequest\n>;\n\n/** Changes only what it names. */\nexport const UpdateAutomationTemplateRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      name: TemplateName.optional(),\n      description: TemplateDescription.optional(),\n      instructions: TemplateInstructions.optional(),\n      schedule: AutomationTemplateSchedule.nullable().optional(),\n      triggers: TemplateTriggers.optional(),\n      maxRunsPerHour: TemplateMaxRunsPerHour.optional(),\n    })\n    .strict(),\n);\nexport type UpdateAutomationTemplateRequest = z.input<typeof UpdateAutomationTemplateRequest>;\nexport type ParsedUpdateAutomationTemplateRequest = z.output<\n  typeof UpdateAutomationTemplateRequest\n>;\n\nexport const ListAutomationTemplatesResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({ templates: z.array(WorkspaceAutomationTemplate) }),\n);\nexport type ListAutomationTemplatesResponse = z.output<typeof ListAutomationTemplatesResponse>;\n\nexport const AutomationTemplateResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({ template: WorkspaceAutomationTemplate }),\n);\nexport type AutomationTemplateResponse = z.output<typeof AutomationTemplateResponse>;\n"],"mappings":";;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AA0BX,IAAM,sCAAsC;AAC5C,IAAM,6CAA6C;AACnD,IAAM,8CAA8C;AAEpD,IAAM,yCAAyC;AAEtD,IAAM,OAAuB,6BAAa,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAG1D,IAAM,6BAA6C;AAAA,EAAa,MACrE,EAAE,mBAAmB,QAAQ;AAAA,IAC3B,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,UAAU;AAAA,MAC1B,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,MACpC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA;AAAA,MAEtC,YAAY,EACT;AAAA,QACC,EAAE,KAAK,CAAC,UAAU,UAAU,WAAW,aAAa,YAAY,UAAU,UAAU,CAAC;AAAA,MACvF,EACC,IAAI,CAAC,EACL,IAAI,CAAC,EACL,SAAS;AAAA,IACd,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,UAAU;AAAA,MAC1B,cAAc,EACX,OAAO,EACP,IAAI,EACJ,IAAI,EAAE,EACN,IAAI,MAAM,KAAM;AAAA,IACrB,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH;AASO,IAAM,gCAAgD;AAAA,EAAa,MACxE,EACG,OAAO;AAAA,IACN,MAAM;AAAA;AAAA,IAEN,SAAS,oBAAoB,SAAS;AAAA;AAAA,IAEtC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACjD,UAAU,KAAK,SAAS;AAAA,EAC1B,CAAC,EACA,OAAO,EACP,YAAY,CAAC,QAAQ,YAAY;AAChC,QAAK,OAAO,SAAS,eAAgB,OAAO,YAAY,SAAY;AAClE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,SAAS;AAAA,QAChB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAK,OAAO,SAAS,WAAY,OAAO,gBAAgB,SAAY;AAClE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,aAAa;AAAA,QACpB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACL;AAGO,IAAM,4BAA4C;AAAA,EAAa,MACpE,EACG,OAAO;AAAA,IACN,QAAQ;AAAA,IACR,YAAY,EAAE,MAAM,aAAa,EAAE,IAAI,CAAC,EAAE,IAAI,uBAAuB;AAAA,IACrE,YAAY,EAAE,MAAM,cAAc,EAAE,IAAI,4BAA4B,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,IAEhF,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA;AAAA,IAE3C,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACxD,CAAC,EACA,OAAO;AACZ;AAGA,IAAM,eAA+B;AAAA,EAAa,MAChD,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,mCAAmC;AAClE;AACA,IAAM,sBAAsC;AAAA,EAAa,MACvD,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,0CAA0C;AAClE;AAEA,IAAM,uBAAuC;AAAA,EAAa,MACxD,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,2CAA2C;AAC1E;AACA,IAAM,mBAAmC;AAAA,EAAa,MACpD,EAAE,MAAM,yBAAyB,EAAE,IAAI,iCAAiC;AAC1E;AAEA,IAAM,yBAAyC;AAAA,EAAa,MAC1D,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,uBAAuB,EAAE,SAAS;AAChE;AAGO,IAAM,8BAA8C;AAAA,EAAa,MACtE,EAAE,OAAO;AAAA,IACP,IAAI;AAAA,IACJ,aAAa;AAAA,IACb,MAAM,EAAE,OAAO;AAAA,IACf,aAAa,EAAE,OAAO;AAAA,IACtB,cAAc,EAAE,OAAO;AAAA;AAAA,IAEvB,UAAU,2BAA2B,SAAS;AAAA,IAC9C,UAAU;AAAA,IACV,gBAAgB;AAAA;AAAA,IAEhB,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,IAExC,cAAc,EAAE,KAAK,CAAC,UAAU,KAAK,CAAC;AAAA,IACtC,WAAW,EAAE,OAAO;AAAA,IACpB,WAAW,EAAE,OAAO;AAAA,EACtB,CAAC;AACH;AAGO,IAAM,kCAAkD;AAAA,EAAa,MAC1E,EACG,OAAO;AAAA,IACN,MAAM;AAAA,IACN,aAAa,oBAAoB,QAAQ,EAAE;AAAA,IAC3C,cAAc;AAAA,IACd,UAAU,2BAA2B,SAAS,EAAE,QAAQ,IAAI;AAAA,IAC5D,UAAU,iBAAiB,QAAQ,CAAC,CAAC;AAAA,IACrC,gBAAgB,uBAAuB,QAAQ,IAAI;AAAA,EACrD,CAAC,EACA,OAAO;AACZ;AAOO,IAAM,kCAAkD;AAAA,EAAa,MAC1E,EACG,OAAO;AAAA,IACN,MAAM,aAAa,SAAS;AAAA,IAC5B,aAAa,oBAAoB,SAAS;AAAA,IAC1C,cAAc,qBAAqB,SAAS;AAAA,IAC5C,UAAU,2BAA2B,SAAS,EAAE,SAAS;AAAA,IACzD,UAAU,iBAAiB,SAAS;AAAA,IACpC,gBAAgB,uBAAuB,SAAS;AAAA,EAClD,CAAC,EACA,OAAO;AACZ;AAMO,IAAM,kCAAkD;AAAA,EAAa,MAC1E,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,EAAE,CAAC;AAC9D;AAGO,IAAM,6BAA6C;AAAA,EAAa,MACrE,EAAE,OAAO,EAAE,UAAU,4BAA4B,CAAC;AACpD;","names":[]}

package/dist/{chunk-YBW5JSA3.js → chunk-FBCTUMHI.js}

@@ -1,3 +1,10 @@
+import {
+  string
+} from "./chunk-AQYDZUJV.js";
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
 // src/connector-attachments.ts
 import { z } from "zod";
 var CONNECTOR_ATTACHMENT_TRANSFER_VERSION = 1;
@@ -24,7 +31,7 @@ function utf8Bytes(value) {
   return textEncoder.encode(value).byteLength;
 }
 function boundedString(maxUtf8Bytes) {
-  return z.string().refine((value) => utf8Bytes(value) <= maxUtf8Bytes, {
+  return string.refine((value) => utf8Bytes(value) <= maxUtf8Bytes, {
     message: `must be at most ${maxUtf8Bytes} UTF-8 bytes`
   });
 }
@@ -74,15 +81,17 @@ function privateUrlCredentialValues(value) {
 function publicMetadataContainsCredential(publicValue, credential) {
   return publicValue.includes(credential);
 }
-var ConnectorAttachmentProviderIdentity = z.object({
-  provider: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES).regex(PROVIDER_PATTERN),
-  kind: z.literal("attachment"),
-  value: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES).min(1).refine((value) => !CONTROL_CHARACTER_PATTERN.test(value), {
-    message: "must not contain control characters"
-  }).refine((value) => !isHttpUrl(value) && !containsHttpUrlReference(value), {
-    message: "must be an opaque provider attachment identity, not a URL"
-  })
-}).strict();
+var ConnectorAttachmentProviderIdentity = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    provider: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES).regex(PROVIDER_PATTERN),
+    kind: z.literal("attachment"),
+    value: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES).min(1).refine((value) => !CONTROL_CHARACTER_PATTERN.test(value), {
+      message: "must not contain control characters"
+    }).refine((value) => !isHttpUrl(value) && !containsHttpUrlReference(value), {
+      message: "must be an opaque provider attachment identity, not a URL"
+    })
+  }).strict()
+);
 var ConnectorAttachmentFileName = boundedString(
   CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES
 ).min(1).refine(
@@ -94,79 +103,87 @@ var ConnectorAttachmentMediaType = boundedString(
 ).regex(MEDIA_TYPE_PATTERN).refine((value) => !containsHttpUrlReference(value), {
   message: "must not contain an HTTP URL reference"
 });
-var ConnectorAttachmentSha256 = z.string().regex(SHA256_PATTERN);
-var ConnectorAttachmentPrivateSource = z.object({
-  url: boundedString(CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES).superRefine(
-    (value, context) => {
-      let parsed;
-      try {
-        parsed = new URL(value);
-      } catch {
-        context.addIssue({
-          code: "custom",
-          message: "must be an absolute URL"
-        });
-        return;
-      }
-      if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-        context.addIssue({ code: "custom", message: "must use http or https" });
+var ConnectorAttachmentSha256 = /* @__PURE__ */ defineSchema(
+  () => string.regex(SHA256_PATTERN)
+);
+var ConnectorAttachmentPrivateSource = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    url: boundedString(CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES).superRefine(
+      (value, context) => {
+        let parsed;
+        try {
+          parsed = new URL(value);
+        } catch {
+          context.addIssue({
+            code: "custom",
+            message: "must be an absolute URL"
+          });
+          return;
+        }
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+          context.addIssue({ code: "custom", message: "must use http or https" });
+        }
+        if (parsed.username || parsed.password) {
+          context.addIssue({
+            code: "custom",
+            message: "must not contain URL userinfo"
+          });
+        }
+        if (parsed.hash) {
+          context.addIssue({
+            code: "custom",
+            message: "must not contain a URL fragment"
+          });
+        }
       }
-      if (parsed.username || parsed.password) {
+    ),
+    expiresAt: z.iso.datetime({ offset: true })
+  }).strict()
+);
+var ConnectorAttachmentTransfer = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    providerAttachmentId: ConnectorAttachmentProviderIdentity,
+    fileName: ConnectorAttachmentFileName,
+    mediaType: ConnectorAttachmentMediaType,
+    byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
+    contentSha256: ConnectorAttachmentSha256,
+    source: ConnectorAttachmentPrivateSource
+  }).strict().superRefine((attachment, context) => {
+    const publicValues = [
+      attachment.providerAttachmentId.value,
+      attachment.fileName,
+      attachment.mediaType
+    ];
+    for (const credential of privateUrlCredentialValues(attachment.source.url)) {
+      if (publicValues.some((value) => publicMetadataContainsCredential(value, credential))) {
         context.addIssue({
           code: "custom",
-          message: "must not contain URL userinfo"
+          message: "private source credentials must not appear in public attachment metadata"
         });
+        return;
       }
-      if (parsed.hash) {
+    }
+  })
+);
+var ConnectorAttachmentTransferEnvelope = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    version: z.literal(CONNECTOR_ATTACHMENT_TRANSFER_VERSION),
+    attachments: z.array(ConnectorAttachmentTransfer).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT)
+  }).strict().superRefine((envelope, context) => {
+    const identities = /* @__PURE__ */ new Set();
+    for (const [index, attachment] of envelope.attachments.entries()) {
+      const identity = `${attachment.providerAttachmentId.provider}\0${attachment.providerAttachmentId.value}`;
+      if (identities.has(identity)) {
         context.addIssue({
           code: "custom",
-          message: "must not contain a URL fragment"
+          message: "provider attachment identities must be unique",
+          path: ["attachments", index, "providerAttachmentId"]
         });
       }
+      identities.add(identity);
     }
-  ),
-  expiresAt: z.iso.datetime({ offset: true })
-}).strict();
-var ConnectorAttachmentTransfer = z.object({
-  providerAttachmentId: ConnectorAttachmentProviderIdentity,
-  fileName: ConnectorAttachmentFileName,
-  mediaType: ConnectorAttachmentMediaType,
-  byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
-  contentSha256: ConnectorAttachmentSha256,
-  source: ConnectorAttachmentPrivateSource
-}).strict().superRefine((attachment, context) => {
-  const publicValues = [
-    attachment.providerAttachmentId.value,
-    attachment.fileName,
-    attachment.mediaType
-  ];
-  for (const credential of privateUrlCredentialValues(attachment.source.url)) {
-    if (publicValues.some((value) => publicMetadataContainsCredential(value, credential))) {
-      context.addIssue({
-        code: "custom",
-        message: "private source credentials must not appear in public attachment metadata"
-      });
-      return;
-    }
-  }
-});
-var ConnectorAttachmentTransferEnvelope = z.object({
-  version: z.literal(CONNECTOR_ATTACHMENT_TRANSFER_VERSION),
-  attachments: z.array(ConnectorAttachmentTransfer).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT)
-}).strict().superRefine((envelope, context) => {
-  const identities = /* @__PURE__ */ new Set();
-  for (const [index, attachment] of envelope.attachments.entries()) {
-    const identity = `${attachment.providerAttachmentId.provider}\0${attachment.providerAttachmentId.value}`;
-    if (identities.has(identity)) {
-      context.addIssue({
-        code: "custom",
-        message: "provider attachment identities must be unique",
-        path: ["attachments", index, "providerAttachmentId"]
-      });
-    }
-    identities.add(identity);
-  }
-});
+  })
+);
 var ConnectorAttachmentSandboxPath = boundedString(
   CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES
 ).min(1).refine(
@@ -184,34 +201,38 @@ var ConnectorAttachmentSandboxPath = boundedString(
   },
   { message: "must be a confined connector attachment sandbox path" }
 );
-var ConnectorAttachmentReceipt = z.object({
-  providerAttachmentId: ConnectorAttachmentProviderIdentity,
-  fileName: ConnectorAttachmentFileName,
-  mediaType: ConnectorAttachmentMediaType,
-  byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
-  contentSha256: ConnectorAttachmentSha256,
-  sandboxPath: ConnectorAttachmentSandboxPath
-}).strict().superRefine((receipt, context) => {
-  const segments = receipt.sandboxPath.split("/");
-  if (segments[2] !== receipt.providerAttachmentId.provider) {
-    context.addIssue({
-      code: "custom",
-      message: "sandbox path provider must match the provider attachment identity",
-      path: ["sandboxPath"]
-    });
-  }
-  if (segments[4] !== receipt.fileName) {
-    context.addIssue({
-      code: "custom",
-      message: "sandbox path filename must match the attachment filename",
-      path: ["sandboxPath"]
-    });
-  }
-});
-var ConnectorAttachmentReceiptEnvelope = z.object({
-  version: z.literal(CONNECTOR_ATTACHMENT_RECEIPT_VERSION),
-  attachments: z.array(ConnectorAttachmentReceipt).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT)
-}).strict();
+var ConnectorAttachmentReceipt = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    providerAttachmentId: ConnectorAttachmentProviderIdentity,
+    fileName: ConnectorAttachmentFileName,
+    mediaType: ConnectorAttachmentMediaType,
+    byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
+    contentSha256: ConnectorAttachmentSha256,
+    sandboxPath: ConnectorAttachmentSandboxPath
+  }).strict().superRefine((receipt, context) => {
+    const segments = receipt.sandboxPath.split("/");
+    if (segments[2] !== receipt.providerAttachmentId.provider) {
+      context.addIssue({
+        code: "custom",
+        message: "sandbox path provider must match the provider attachment identity",
+        path: ["sandboxPath"]
+      });
+    }
+    if (segments[4] !== receipt.fileName) {
+      context.addIssue({
+        code: "custom",
+        message: "sandbox path filename must match the attachment filename",
+        path: ["sandboxPath"]
+      });
+    }
+  })
+);
+var ConnectorAttachmentReceiptEnvelope = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    version: z.literal(CONNECTOR_ATTACHMENT_RECEIPT_VERSION),
+    attachments: z.array(ConnectorAttachmentReceipt).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT)
+  }).strict()
+);
 function parseConnectorAttachmentTransferEnvelope(value, options = {}) {
   const envelope = ConnectorAttachmentTransferEnvelope.parse(value);
   const nowMs = options.nowMs ?? Date.now();
@@ -248,4 +269,4 @@ export {
   ConnectorAttachmentReceiptEnvelope,
   parseConnectorAttachmentTransferEnvelope
 };
-//# sourceMappingURL=chunk-YBW5JSA3.js.map
+//# sourceMappingURL=chunk-FBCTUMHI.js.map

package/dist/chunk-FBCTUMHI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connector-attachments.ts"],"sourcesContent":["import * as primitives from \"./primitives\";\nimport { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nexport const CONNECTOR_ATTACHMENT_TRANSFER_VERSION = 1 as const;\nexport const CONNECTOR_ATTACHMENT_RECEIPT_VERSION = 1 as const;\nexport const CONNECTOR_ATTACHMENT_TRANSFER_META_KEY =\n  \"opengeni/connector-attachment-transfers\" as const;\nexport const CONNECTOR_ATTACHMENT_RECEIPT_META_KEY =\n  \"opengeni/connector-attachment-receipts\" as const;\nexport const CONNECTOR_ATTACHMENT_MAX_COUNT = 16;\n// Must remain byte-for-byte aligned with Channel A's exact workspace importer.\nexport const CONNECTOR_ATTACHMENT_MAX_BYTES = 5_000_000_000;\nexport const CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES = 255;\nexport const CONNECTOR_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES = 256;\nexport const CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES = 128;\nexport const CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES = 512;\nexport const CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES = 8 * 1024;\nexport const CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES = 2 * 1024;\n\nconst PROVIDER_PATTERN = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/u;\nconst SHA256_PATTERN = /^[0-9a-f]{64}$/u;\nconst MEDIA_TYPE_PATTERN =\n  /^[a-z0-9!#$&^_.+-]+\\/[a-z0-9!#$&^_.+-]+(?:\\s*;\\s*[a-z0-9!#$&^_.+-]+=(?:[a-z0-9!#$&^_.+-]+|\"[^\"\\r\\n]*\"))*$/iu;\nconst CONTROL_CHARACTER_PATTERN = /[\\u0000-\\u001f\\u007f]/u;\nconst HTTP_URL_REFERENCE_PATTERN = /(?:https?:)?\\/\\/[^\\s]/iu;\nconst PORTABLE_FILENAME_FORBIDDEN_PATTERN = /[<>:\"|?*]/u;\nconst PORTABLE_FILENAME_RESERVED_PATTERN = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\\.|$)/iu;\nconst textEncoder = new TextEncoder();\n\nfunction utf8Bytes(value: string): number {\n  return textEncoder.encode(value).byteLength;\n}\n\nfunction boundedString(maxUtf8Bytes: number) {\n  return primitives.string.refine((value) => utf8Bytes(value) <= maxUtf8Bytes, {\n    message: `must be at most ${maxUtf8Bytes} UTF-8 bytes`,\n  });\n}\n\nfunction isHttpUrl(value: string): boolean {\n  try {\n    const parsed = new URL(value);\n    return parsed.protocol === \"http:\" || parsed.protocol === \"https:\";\n  } catch {\n    return false;\n  }\n}\n\nfunction containsHttpUrlReference(value: string): boolean {\n  return HTTP_URL_REFERENCE_PATTERN.test(value);\n}\n\nfunction isPrivateUrlCredentialQueryName(value: string): boolean {\n  const normalized = value.toLowerCase().replace(/[^a-z0-9]/gu, \"\");\n  return (\n    normalized === \"sig\" ||\n    normalized === \"auth\" ||\n    normalized.endsWith(\"signature\") ||\n    normalized.endsWith(\"token\") ||\n    normalized.endsWith(\"credential\") ||\n    normalized.endsWith(\"secret\") ||\n    normalized.endsWith(\"password\") ||\n    normalized.endsWith(\"passcode\") ||\n    normalized.endsWith(\"authorization\") ||\n    normalized.endsWith(\"apikey\") ||\n    normalized.endsWith(\"accesskey\") ||\n    normalized.endsWith(\"securitytoken\") ||\n    normalized.endsWith(\"sas\") ||\n    normalized === \"googleaccessid\"\n  );\n}\n\nfunction privateUrlCredentialValues(value: string): string[] {\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return [];\n  }\n  const credentials = new Set<string>();\n  for (const [name, credential] of parsed.searchParams) {\n    if (credential && isPrivateUrlCredentialQueryName(name)) credentials.add(credential);\n  }\n  for (const pair of parsed.search.slice(1).split(\"&\")) {\n    if (!pair) continue;\n    const separator = pair.indexOf(\"=\");\n    const rawName = separator === -1 ? pair : pair.slice(0, separator);\n    const rawCredential = separator === -1 ? \"\" : pair.slice(separator + 1);\n    let decodedName: string;\n    try {\n      decodedName = decodeURIComponent(rawName.replace(/\\+/gu, \" \"));\n    } catch {\n      continue;\n    }\n    if (rawCredential && isPrivateUrlCredentialQueryName(decodedName)) {\n      credentials.add(rawCredential);\n    }\n  }\n  return [...credentials];\n}\n\nfunction publicMetadataContainsCredential(publicValue: string, credential: string): boolean {\n  return publicValue.includes(credential);\n}\n\nexport const ConnectorAttachmentProviderIdentity = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      provider: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES).regex(PROVIDER_PATTERN),\n      kind: z.literal(\"attachment\"),\n      value: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES)\n        .min(1)\n        .refine((value) => !CONTROL_CHARACTER_PATTERN.test(value), {\n          message: \"must not contain control characters\",\n        })\n        .refine((value) => !isHttpUrl(value) && !containsHttpUrlReference(value), {\n          message: \"must be an opaque provider attachment identity, not a URL\",\n        }),\n    })\n    .strict(),\n);\nexport type ConnectorAttachmentProviderIdentity = z.infer<\n  typeof ConnectorAttachmentProviderIdentity\n>;\n\nexport const ConnectorAttachmentFileName = boundedString(\n  CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES,\n)\n  .min(1)\n  .refine(\n    (value) =>\n      value !== \".\" &&\n      value !== \"..\" &&\n      value === value.trim() &&\n      !value.includes(\"/\") &&\n      !value.includes(\"\\\\\") &&\n      !CONTROL_CHARACTER_PATTERN.test(value) &&\n      !PORTABLE_FILENAME_FORBIDDEN_PATTERN.test(value) &&\n      !/[ .]$/u.test(value) &&\n      !PORTABLE_FILENAME_RESERVED_PATTERN.test(value),\n    { message: \"must be a safe leaf filename\" },\n  );\n\nexport const ConnectorAttachmentMediaType = boundedString(\n  CONNECTOR_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES,\n)\n  .regex(MEDIA_TYPE_PATTERN)\n  .refine((value) => !containsHttpUrlReference(value), {\n    message: \"must not contain an HTTP URL reference\",\n  });\n\nexport const ConnectorAttachmentSha256 = /* @__PURE__ */ defineSchema(() =>\n  primitives.string.regex(SHA256_PATTERN),\n);\n\nexport const ConnectorAttachmentPrivateSource = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      url: boundedString(CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES).superRefine(\n        (value, context) => {\n          let parsed: URL;\n          try {\n            parsed = new URL(value);\n          } catch {\n            context.addIssue({\n              code: \"custom\",\n              message: \"must be an absolute URL\",\n            });\n            return;\n          }\n          if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n            context.addIssue({ code: \"custom\", message: \"must use http or https\" });\n          }\n          if (parsed.username || parsed.password) {\n            context.addIssue({\n              code: \"custom\",\n              message: \"must not contain URL userinfo\",\n            });\n          }\n          if (parsed.hash) {\n            context.addIssue({\n              code: \"custom\",\n              message: \"must not contain a URL fragment\",\n            });\n          }\n        },\n      ),\n      expiresAt: z.iso.datetime({ offset: true }),\n    })\n    .strict(),\n);\nexport type ConnectorAttachmentPrivateSource = z.infer<typeof ConnectorAttachmentPrivateSource>;\n\nexport const ConnectorAttachmentTransfer = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      providerAttachmentId: ConnectorAttachmentProviderIdentity,\n      fileName: ConnectorAttachmentFileName,\n      mediaType: ConnectorAttachmentMediaType,\n      byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),\n      contentSha256: ConnectorAttachmentSha256,\n      source: ConnectorAttachmentPrivateSource,\n    })\n    .strict()\n    .superRefine((attachment, context) => {\n      const publicValues = [\n        attachment.providerAttachmentId.value,\n        attachment.fileName,\n        attachment.mediaType,\n      ];\n      for (const credential of privateUrlCredentialValues(attachment.source.url)) {\n        if (publicValues.some((value) => publicMetadataContainsCredential(value, credential))) {\n          context.addIssue({\n            code: \"custom\",\n            message: \"private source credentials must not appear in public attachment metadata\",\n          });\n          return;\n        }\n      }\n    }),\n);\nexport type ConnectorAttachmentTransfer = z.infer<typeof ConnectorAttachmentTransfer>;\n\nexport const ConnectorAttachmentTransferEnvelope = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      version: z.literal(CONNECTOR_ATTACHMENT_TRANSFER_VERSION),\n      attachments: z.array(ConnectorAttachmentTransfer).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT),\n    })\n    .strict()\n    .superRefine((envelope, context) => {\n      const identities = new Set<string>();\n      for (const [index, attachment] of envelope.attachments.entries()) {\n        const identity = `${attachment.providerAttachmentId.provider}\\0${attachment.providerAttachmentId.value}`;\n        if (identities.has(identity)) {\n          context.addIssue({\n            code: \"custom\",\n            message: \"provider attachment identities must be unique\",\n            path: [\"attachments\", index, \"providerAttachmentId\"],\n          });\n        }\n        identities.add(identity);\n      }\n    }),\n);\nexport type ConnectorAttachmentTransferEnvelope = z.infer<\n  typeof ConnectorAttachmentTransferEnvelope\n>;\n\nexport const ConnectorAttachmentSandboxPath = boundedString(\n  CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES,\n)\n  .min(1)\n  .refine(\n    (value) => {\n      if (\n        value !== value.trim() ||\n        value.startsWith(\"/\") ||\n        /^[A-Za-z]:[\\\\/]/u.test(value) ||\n        value.includes(\"\\\\\") ||\n        CONTROL_CHARACTER_PATTERN.test(value)\n      ) {\n        return false;\n      }\n      const segments = value.split(\"/\");\n      if (\n        segments.length !== 5 ||\n        segments[0] !== \".opengeni\" ||\n        segments[1] !== \"connector-attachments\" ||\n        !PROVIDER_PATTERN.test(segments[2] ?? \"\") ||\n        !/^[0-9a-f]{32}$/u.test(segments[3] ?? \"\") ||\n        !ConnectorAttachmentFileName.safeParse(segments[4]).success\n      ) {\n        return false;\n      }\n      return segments.every(\n        (segment) =>\n          segment.length > 0 &&\n          segment !== \".\" &&\n          segment !== \"..\" &&\n          !PORTABLE_FILENAME_FORBIDDEN_PATTERN.test(segment) &&\n          !/[ .]$/u.test(segment) &&\n          !PORTABLE_FILENAME_RESERVED_PATTERN.test(segment),\n      );\n    },\n    { message: \"must be a confined connector attachment sandbox path\" },\n  );\n\nexport const ConnectorAttachmentReceipt = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      providerAttachmentId: ConnectorAttachmentProviderIdentity,\n      fileName: ConnectorAttachmentFileName,\n      mediaType: ConnectorAttachmentMediaType,\n      byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),\n      contentSha256: ConnectorAttachmentSha256,\n      sandboxPath: ConnectorAttachmentSandboxPath,\n    })\n    .strict()\n    .superRefine((receipt, context) => {\n      const segments = receipt.sandboxPath.split(\"/\");\n      if (segments[2] !== receipt.providerAttachmentId.provider) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"sandbox path provider must match the provider attachment identity\",\n          path: [\"sandboxPath\"],\n        });\n      }\n      if (segments[4] !== receipt.fileName) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"sandbox path filename must match the attachment filename\",\n          path: [\"sandboxPath\"],\n        });\n      }\n    }),\n);\nexport type ConnectorAttachmentReceipt = z.infer<typeof ConnectorAttachmentReceipt>;\n\nexport const ConnectorAttachmentReceiptEnvelope = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      version: z.literal(CONNECTOR_ATTACHMENT_RECEIPT_VERSION),\n      attachments: z.array(ConnectorAttachmentReceipt).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT),\n    })\n    .strict(),\n);\nexport type ConnectorAttachmentReceiptEnvelope = z.infer<typeof ConnectorAttachmentReceiptEnvelope>;\n\nexport function parseConnectorAttachmentTransferEnvelope(\n  value: unknown,\n  options: { nowMs?: number } = {},\n): ConnectorAttachmentTransferEnvelope {\n  const envelope = ConnectorAttachmentTransferEnvelope.parse(value);\n  const nowMs = options.nowMs ?? Date.now();\n  for (const attachment of envelope.attachments) {\n    if (Date.parse(attachment.source.expiresAt) <= nowMs) {\n      throw new Error(\"connector attachment source is expired\");\n    }\n  }\n  return envelope;\n}\n"],"mappings":";;;;;;;;AAEA,SAAS,SAAS;AAEX,IAAM,wCAAwC;AAC9C,IAAM,uCAAuC;AAC7C,IAAM,yCACX;AACK,IAAM,wCACX;AACK,IAAM,iCAAiC;AAEvC,IAAM,iCAAiC;AACvC,IAAM,+CAA+C;AACrD,IAAM,iDAAiD;AACvD,IAAM,+CAA+C;AACrD,IAAM,kDAAkD;AACxD,IAAM,iDAAiD,IAAI;AAC3D,IAAM,mDAAmD,IAAI;AAEpE,IAAM,mBAAmB;AACzB,IAAM,iBAAiB;AACvB,IAAM,qBACJ;AACF,IAAM,4BAA4B;AAClC,IAAM,6BAA6B;AACnC,IAAM,sCAAsC;AAC5C,IAAM,qCAAqC;AAC3C,IAAM,cAAc,IAAI,YAAY;AAEpC,SAAS,UAAU,OAAuB;AACxC,SAAO,YAAY,OAAO,KAAK,EAAE;AACnC;AAEA,SAAS,cAAc,cAAsB;AAC3C,SAAkB,OAAO,OAAO,CAAC,UAAU,UAAU,KAAK,KAAK,cAAc;AAAA,IAC3E,SAAS,mBAAmB,YAAY;AAAA,EAC1C,CAAC;AACH;AAEA,SAAS,UAAU,OAAwB;AACzC,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,WAAO,OAAO,aAAa,WAAW,OAAO,aAAa;AAAA,EAC5D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,yBAAyB,OAAwB;AACxD,SAAO,2BAA2B,KAAK,KAAK;AAC9C;AAEA,SAAS,gCAAgC,OAAwB;AAC/D,QAAM,aAAa,MAAM,YAAY,EAAE,QAAQ,eAAe,EAAE;AAChE,SACE,eAAe,SACf,eAAe,UACf,WAAW,SAAS,WAAW,KAC/B,WAAW,SAAS,OAAO,KAC3B,WAAW,SAAS,YAAY,KAChC,WAAW,SAAS,QAAQ,KAC5B,WAAW,SAAS,UAAU,KAC9B,WAAW,SAAS,UAAU,KAC9B,WAAW,SAAS,eAAe,KACnC,WAAW,SAAS,QAAQ,KAC5B,WAAW,SAAS,WAAW,KAC/B,WAAW,SAAS,eAAe,KACnC,WAAW,SAAS,KAAK,KACzB,eAAe;AAEnB;AAEA,SAAS,2BAA2B,OAAyB;AAC3D,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,CAAC,MAAM,UAAU,KAAK,OAAO,cAAc;AACpD,QAAI,cAAc,gCAAgC,IAAI,EAAG,aAAY,IAAI,UAAU;AAAA,EACrF;AACA,aAAW,QAAQ,OAAO,OAAO,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG;AACpD,QAAI,CAAC,KAAM;AACX,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,UAAM,UAAU,cAAc,KAAK,OAAO,KAAK,MAAM,GAAG,SAAS;AACjE,UAAM,gBAAgB,cAAc,KAAK,KAAK,KAAK,MAAM,YAAY,CAAC;AACtE,QAAI;AACJ,QAAI;AACF,oBAAc,mBAAmB,QAAQ,QAAQ,QAAQ,GAAG,CAAC;AAAA,IAC/D,QAAQ;AACN;AAAA,IACF;AACA,QAAI,iBAAiB,gCAAgC,WAAW,GAAG;AACjE,kBAAY,IAAI,aAAa;AAAA,IAC/B;AAAA,EACF;AACA,SAAO,CAAC,GAAG,WAAW;AACxB;AAEA,SAAS,iCAAiC,aAAqB,YAA6B;AAC1F,SAAO,YAAY,SAAS,UAAU;AACxC;AAEO,IAAM,sCAAsD;AAAA,EAAa,MAC9E,EACG,OAAO;AAAA,IACN,UAAU,cAAc,4CAA4C,EAAE,MAAM,gBAAgB;AAAA,IAC5F,MAAM,EAAE,QAAQ,YAAY;AAAA,IAC5B,OAAO,cAAc,+CAA+C,EACjE,IAAI,CAAC,EACL,OAAO,CAAC,UAAU,CAAC,0BAA0B,KAAK,KAAK,GAAG;AAAA,MACzD,SAAS;AAAA,IACX,CAAC,EACA,OAAO,CAAC,UAAU,CAAC,UAAU,KAAK,KAAK,CAAC,yBAAyB,KAAK,GAAG;AAAA,MACxE,SAAS;AAAA,IACX,CAAC;AAAA,EACL,CAAC,EACA,OAAO;AACZ;AAKO,IAAM,8BAA8B;AAAA,EACzC;AACF,EACG,IAAI,CAAC,EACL;AAAA,EACC,CAAC,UACC,UAAU,OACV,UAAU,QACV,UAAU,MAAM,KAAK,KACrB,CAAC,MAAM,SAAS,GAAG,KACnB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,0BAA0B,KAAK,KAAK,KACrC,CAAC,oCAAoC,KAAK,KAAK,KAC/C,CAAC,SAAS,KAAK,KAAK,KACpB,CAAC,mCAAmC,KAAK,KAAK;AAAA,EAChD,EAAE,SAAS,+BAA+B;AAC5C;AAEK,IAAM,+BAA+B;AAAA,EAC1C;AACF,EACG,MAAM,kBAAkB,EACxB,OAAO,CAAC,UAAU,CAAC,yBAAyB,KAAK,GAAG;AAAA,EACnD,SAAS;AACX,CAAC;AAEI,IAAM,4BAA4C;AAAA,EAAa,MACzD,OAAO,MAAM,cAAc;AACxC;AAEO,IAAM,mCAAmD;AAAA,EAAa,MAC3E,EACG,OAAO;AAAA,IACN,KAAK,cAAc,8CAA8C,EAAE;AAAA,MACjE,CAAC,OAAO,YAAY;AAClB,YAAI;AACJ,YAAI;AACF,mBAAS,IAAI,IAAI,KAAK;AAAA,QACxB,QAAQ;AACN,kBAAQ,SAAS;AAAA,YACf,MAAM;AAAA,YACN,SAAS;AAAA,UACX,CAAC;AACD;AAAA,QACF;AACA,YAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,kBAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yBAAyB,CAAC;AAAA,QACxE;AACA,YAAI,OAAO,YAAY,OAAO,UAAU;AACtC,kBAAQ,SAAS;AAAA,YACf,MAAM;AAAA,YACN,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AACA,YAAI,OAAO,MAAM;AACf,kBAAQ,SAAS;AAAA,YACf,MAAM;AAAA,YACN,SAAS;AAAA,UACX,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,IACA,WAAW,EAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC5C,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,8BAA8C;AAAA,EAAa,MACtE,EACG,OAAO;AAAA,IACN,sBAAsB;AAAA,IACtB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,8BAA8B;AAAA,IACpE,eAAe;AAAA,IACf,QAAQ;AAAA,EACV,CAAC,EACA,OAAO,EACP,YAAY,CAAC,YAAY,YAAY;AACpC,UAAM,eAAe;AAAA,MACnB,WAAW,qBAAqB;AAAA,MAChC,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AACA,eAAW,cAAc,2BAA2B,WAAW,OAAO,GAAG,GAAG;AAC1E,UAAI,aAAa,KAAK,CAAC,UAAU,iCAAiC,OAAO,UAAU,CAAC,GAAG;AACrF,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,QACX,CAAC;AACD;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACL;AAGO,IAAM,sCAAsD;AAAA,EAAa,MAC9E,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,qCAAqC;AAAA,IACxD,aAAa,EAAE,MAAM,2BAA2B,EAAE,IAAI,CAAC,EAAE,IAAI,8BAA8B;AAAA,EAC7F,CAAC,EACA,OAAO,EACP,YAAY,CAAC,UAAU,YAAY;AAClC,UAAM,aAAa,oBAAI,IAAY;AACnC,eAAW,CAAC,OAAO,UAAU,KAAK,SAAS,YAAY,QAAQ,GAAG;AAChE,YAAM,WAAW,GAAG,WAAW,qBAAqB,QAAQ,KAAK,WAAW,qBAAqB,KAAK;AACtG,UAAI,WAAW,IAAI,QAAQ,GAAG;AAC5B,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,UACT,MAAM,CAAC,eAAe,OAAO,sBAAsB;AAAA,QACrD,CAAC;AAAA,MACH;AACA,iBAAW,IAAI,QAAQ;AAAA,IACzB;AAAA,EACF,CAAC;AACL;AAKO,IAAM,iCAAiC;AAAA,EAC5C;AACF,EACG,IAAI,CAAC,EACL;AAAA,EACC,CAAC,UAAU;AACT,QACE,UAAU,MAAM,KAAK,KACrB,MAAM,WAAW,GAAG,KACpB,mBAAmB,KAAK,KAAK,KAC7B,MAAM,SAAS,IAAI,KACnB,0BAA0B,KAAK,KAAK,GACpC;AACA,aAAO;AAAA,IACT;AACA,UAAM,WAAW,MAAM,MAAM,GAAG;AAChC,QACE,SAAS,WAAW,KACpB,SAAS,CAAC,MAAM,eAChB,SAAS,CAAC,MAAM,2BAChB,CAAC,iBAAiB,KAAK,SAAS,CAAC,KAAK,EAAE,KACxC,CAAC,kBAAkB,KAAK,SAAS,CAAC,KAAK,EAAE,KACzC,CAAC,4BAA4B,UAAU,SAAS,CAAC,CAAC,EAAE,SACpD;AACA,aAAO;AAAA,IACT;AACA,WAAO,SAAS;AAAA,MACd,CAAC,YACC,QAAQ,SAAS,KACjB,YAAY,OACZ,YAAY,QACZ,CAAC,oCAAoC,KAAK,OAAO,KACjD,CAAC,SAAS,KAAK,OAAO,KACtB,CAAC,mCAAmC,KAAK,OAAO;AAAA,IACpD;AAAA,EACF;AAAA,EACA,EAAE,SAAS,uDAAuD;AACpE;AAEK,IAAM,6BAA6C;AAAA,EAAa,MACrE,EACG,OAAO;AAAA,IACN,sBAAsB;AAAA,IACtB,UAAU;AAAA,IACV,WAAW;AAAA,IACX,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,8BAA8B;AAAA,IACpE,eAAe;AAAA,IACf,aAAa;AAAA,EACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,YAAY;AACjC,UAAM,WAAW,QAAQ,YAAY,MAAM,GAAG;AAC9C,QAAI,SAAS,CAAC,MAAM,QAAQ,qBAAqB,UAAU;AACzD,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM,CAAC,aAAa;AAAA,MACtB,CAAC;AAAA,IACH;AACA,QAAI,SAAS,CAAC,MAAM,QAAQ,UAAU;AACpC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM,CAAC,aAAa;AAAA,MACtB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACL;AAGO,IAAM,qCAAqD;AAAA,EAAa,MAC7E,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,oCAAoC;AAAA,IACvD,aAAa,EAAE,MAAM,0BAA0B,EAAE,IAAI,CAAC,EAAE,IAAI,8BAA8B;AAAA,EAC5F,CAAC,EACA,OAAO;AACZ;AAGO,SAAS,yCACd,OACA,UAA8B,CAAC,GACM;AACrC,QAAM,WAAW,oCAAoC,MAAM,KAAK;AAChE,QAAM,QAAQ,QAAQ,SAAS,KAAK,IAAI;AACxC,aAAW,cAAc,SAAS,aAAa;AAC7C,QAAI,KAAK,MAAM,WAAW,OAAO,SAAS,KAAK,OAAO;AACpD,YAAM,IAAI,MAAM,wCAAwC;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-G2KJTFIC.js

@@ -0,0 +1,97 @@
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
+// src/permissions.ts
+import { z } from "zod";
+var Permission = /* @__PURE__ */ defineSchema(
+  () => z.enum([
+    "account:read",
+    "account:admin",
+    "members:manage",
+    "workspace:create",
+    "billing:read",
+    "billing:manage",
+    "workspace:read",
+    "workspace:admin",
+    "sessions:create",
+    "sessions:read",
+    "sessions:control",
+    "stream:view",
+    "stream:control",
+    "stream:acknowledge",
+    "files:upload",
+    "files:read",
+    "files:write",
+    "terminal:attach",
+    "documents:manage",
+    "documents:search",
+    "scheduled_tasks:manage",
+    "scheduled_tasks:run",
+    "github:manage",
+    "github:use",
+    "api_keys:manage",
+    /** Literal organization-key authority to configure workspace usage allowances. */
+    "usage_allowances:manage",
+    "connections:read",
+    "connections:write",
+    /**
+     * Connect, use and remove one's own accounts, turn on a reviewed OAuth
+     * integration for personal accounts, and add it to one's own chats.
+     * `connections:write` includes it.
+     */
+    "connections:personal",
+    "capabilities:manage",
+    /** @deprecated alias of secrets:write */
+    "environments:manage",
+    /** @deprecated alias of secrets:use */
+    "environments:use",
+    /** @deprecated alias of secrets:list */
+    "variable-sets:list",
+    /** @deprecated alias of secrets:list */
+    "variable-sets:read",
+    /** @deprecated alias of secrets:write */
+    "variable-sets:write",
+    /** @deprecated alias of secrets:write */
+    "variable-sets:manage",
+    /** @deprecated alias of secrets:use */
+    "variable-sets:attach",
+    /** @deprecated alias of secrets:use */
+    "variable-sets:use",
+    "secrets:list",
+    /** Literal plaintext read through a tool or API key (agents lack it by default). */
+    "secrets:read",
+    "secrets:write",
+    /** Use secrets by reference; for humans, also reveal ("use = reveal"). */
+    "secrets:use",
+    "mcp_servers:attach",
+    "codemode:call",
+    "goals:manage",
+    "enrollments:read",
+    "enrollments:manage",
+    "rigs:use",
+    "rigs:manage",
+    "artifacts:read",
+    "artifacts:publish"
+  ])
+);
+var SECRET_PERMISSION_ALIASES = {
+  "variable-sets:list": "secrets:list",
+  "variable-sets:read": "secrets:list",
+  "variable-sets:write": "secrets:write",
+  "variable-sets:manage": "secrets:write",
+  "environments:manage": "secrets:write",
+  "variable-sets:attach": "secrets:use",
+  "variable-sets:use": "secrets:use",
+  "environments:use": "secrets:use"
+};
+function normalizePermission(name) {
+  return Object.hasOwn(SECRET_PERMISSION_ALIASES, name) ? SECRET_PERMISSION_ALIASES[name] : name;
+}
+
+export {
+  Permission,
+  SECRET_PERMISSION_ALIASES,
+  normalizePermission
+};
+//# sourceMappingURL=chunk-G2KJTFIC.js.map

package/dist/chunk-G2KJTFIC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/permissions.ts"],"sourcesContent":["import { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\n/** Canonical public permission vocabulary shared by operational and control-plane contracts. */\nexport const Permission = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\n    \"account:read\",\n    \"account:admin\",\n    \"members:manage\",\n    \"workspace:create\",\n    \"billing:read\",\n    \"billing:manage\",\n    \"workspace:read\",\n    \"workspace:admin\",\n    \"sessions:create\",\n    \"sessions:read\",\n    \"sessions:control\",\n    \"stream:view\",\n    \"stream:control\",\n    \"stream:acknowledge\",\n    \"files:upload\",\n    \"files:read\",\n    \"files:write\",\n    \"terminal:attach\",\n    \"documents:manage\",\n    \"documents:search\",\n    \"scheduled_tasks:manage\",\n    \"scheduled_tasks:run\",\n    \"github:manage\",\n    \"github:use\",\n    \"api_keys:manage\",\n    /** Literal organization-key authority to configure workspace usage allowances. */\n    \"usage_allowances:manage\",\n    \"connections:read\",\n    \"connections:write\",\n    /**\n     * Connect, use and remove one's own accounts, turn on a reviewed OAuth\n     * integration for personal accounts, and add it to one's own chats.\n     * `connections:write` includes it.\n     */\n    \"connections:personal\",\n    \"capabilities:manage\",\n    /** @deprecated alias of secrets:write */\n    \"environments:manage\",\n    /** @deprecated alias of secrets:use */\n    \"environments:use\",\n    /** @deprecated alias of secrets:list */\n    \"variable-sets:list\",\n    /** @deprecated alias of secrets:list */\n    \"variable-sets:read\",\n    /** @deprecated alias of secrets:write */\n    \"variable-sets:write\",\n    /** @deprecated alias of secrets:write */\n    \"variable-sets:manage\",\n    /** @deprecated alias of secrets:use */\n    \"variable-sets:attach\",\n    /** @deprecated alias of secrets:use */\n    \"variable-sets:use\",\n    \"secrets:list\",\n    /** Literal plaintext read through a tool or API key (agents lack it by default). */\n    \"secrets:read\",\n    \"secrets:write\",\n    /** Use secrets by reference; for humans, also reveal (\"use = reveal\"). */\n    \"secrets:use\",\n    \"mcp_servers:attach\",\n    \"codemode:call\",\n    \"goals:manage\",\n    \"enrollments:read\",\n    \"enrollments:manage\",\n    \"rigs:use\",\n    \"rigs:manage\",\n    \"artifacts:read\",\n    \"artifacts:publish\",\n  ]),\n);\nexport type Permission = z.infer<typeof Permission>;\n\n/**\n * Legacy permission names and their secrets equivalents (Q-16). Stored role\n * and API-key permission arrays are aliased at read time, never rewritten.\n */\nexport const SECRET_PERMISSION_ALIASES = {\n  \"variable-sets:list\": \"secrets:list\",\n  \"variable-sets:read\": \"secrets:list\",\n  \"variable-sets:write\": \"secrets:write\",\n  \"variable-sets:manage\": \"secrets:write\",\n  \"environments:manage\": \"secrets:write\",\n  \"variable-sets:attach\": \"secrets:use\",\n  \"variable-sets:use\": \"secrets:use\",\n  \"environments:use\": \"secrets:use\",\n} as const satisfies Readonly<Partial<Record<Permission, Permission>>>;\n\n/** Canonical name for a permission: legacy variable-set names map to `secrets:*`. */\nexport function normalizePermission(name: string): string {\n  return Object.hasOwn(SECRET_PERMISSION_ALIASES, name)\n    ? SECRET_PERMISSION_ALIASES[name as keyof typeof SECRET_PERMISSION_ALIASES]\n    : name;\n}\n"],"mappings":";;;;;AACA,SAAS,SAAS;AAGX,IAAM,aAA6B;AAAA,EAAa,MACrD,EAAE,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA;AAAA,IACA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA;AAAA,IAEA;AAAA,IACA;AAAA;AAAA,IAEA;AAAA,IACA;AAAA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAOO,IAAM,4BAA4B;AAAA,EACvC,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,wBAAwB;AAAA,EACxB,uBAAuB;AAAA,EACvB,wBAAwB;AAAA,EACxB,qBAAqB;AAAA,EACrB,oBAAoB;AACtB;AAGO,SAAS,oBAAoB,MAAsB;AACxD,SAAO,OAAO,OAAO,2BAA2B,IAAI,IAChD,0BAA0B,IAA8C,IACxE;AACN;","names":[]}