@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/chunk-ICDZGUX2.js

@@ -1,186 +0,0 @@
-import {
-  ConnectionKind,
-  SessionTenancyVisibility
-} from "./chunk-566IFOVP.js";
-
-// src/connection-authority.ts
-import { z } from "zod";
-var ConnectionAuthoritySelectionSource = z.enum(["explicit_workspace", "sender"]);
-var ConnectionUseSelectionSource = z.string().min(1).max(128).regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);
-var AcceptedConnectionWork = z.discriminatedUnion("kind", [
-  z.object({
-    kind: z.literal("turn"),
-    turnId: z.string().uuid()
-  }).strict(),
-  z.object({
-    kind: z.literal("scheduled_task"),
-    taskId: z.string().uuid(),
-    taskAuthorityRevision: z.number().int().positive(),
-    runId: z.string().uuid()
-  }).strict()
-]);
-var ConnectionUseAuthoritySnapshot = z.object({
-  organizationId: z.string().uuid(),
-  originWorkspaceId: z.string().uuid(),
-  targetWorkspaceId: z.string().uuid(),
-  targetSessionId: z.string().uuid(),
-  targetSessionVisibility: SessionTenancyVisibility,
-  targetSessionAuthorityEpoch: z.number().int().positive(),
-  acceptedWork: AcceptedConnectionWork,
-  connectionId: z.string().uuid(),
-  connectionGeneration: z.number().int().positive(),
-  connectionStatus: z.literal("active"),
-  providerDomain: z.string().min(1).max(2048),
-  connectionKind: ConnectionKind,
-  scope: z.enum(["workspace", "user"]),
-  ownerSubjectId: z.string().min(1).max(512).nullable(),
-  ownerOrganizationMembershipId: z.string().uuid().nullable(),
-  ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),
-  authoritySource: ConnectionAuthoritySelectionSource,
-  selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),
-  userDelegation: z.null()
-}).strict().superRefine((value, context) => {
-  const ownedBySubject = value.scope !== "workspace";
-  const delegated = value.scope === "user";
-  if (ownedBySubject !== (value.ownerSubjectId !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["ownerSubjectId"],
-      message: "personal connections retain an owner subject"
-    });
-  }
-  if (delegated !== (value.ownerOrganizationMembershipId !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["ownerOrganizationMembershipId"],
-      message: "only user connections retain an owner membership"
-    });
-  }
-  if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["ownerMembershipAuthorizationRevision"],
-      message: "only user connections retain an owner membership revision"
-    });
-  }
-  if (delegated && value.authoritySource !== "sender") {
-    context.addIssue({
-      code: "custom",
-      path: ["authoritySource"],
-      message: "user connections require authenticated sender provenance"
-    });
-  }
-  if (!delegated && value.authoritySource === "sender") {
-    context.addIssue({
-      code: "custom",
-      path: ["authoritySource"],
-      message: "workspace connections cannot claim sender provenance"
-    });
-  }
-  if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {
-    context.addIssue({
-      code: "custom",
-      path: ["originWorkspaceId"],
-      message: "workspace connections must be owned by the target workspace"
-    });
-  }
-});
-var ConnectionUseDenialReason = z.enum([
-  "tenant_mismatch",
-  "workspace_access_inactive",
-  "session_inactive",
-  "session_identity_changed",
-  "session_visibility_changed",
-  "session_authority_epoch_changed",
-  "accepted_attempt_authority_required",
-  "accepted_snapshot_digest_changed",
-  "connection_missing",
-  "connection_identity_changed",
-  "connection_generation_changed",
-  "connection_status_inactive",
-  "connection_owner_changed",
-  "owner_membership_inactive",
-  "authority_missing",
-  "authority_identity_changed",
-  "authority_generation_changed",
-  "authority_status_inactive",
-  "grant_missing",
-  "grant_identity_changed",
-  "grant_generation_changed",
-  "grant_status_inactive",
-  "grant_expired",
-  "grant_already_consumed"
-]);
-var ConnectionUseAttributionFields = z.object({
-  organizationId: z.string().uuid(),
-  workspaceId: z.string().uuid(),
-  sessionId: z.string().uuid(),
-  connectionId: z.string().uuid(),
-  connectionGeneration: z.number().int().positive(),
-  scope: z.enum(["workspace", "user", "legacy_user"]),
-  ownerSubjectId: z.string().min(1).max(512).nullable(),
-  authorityId: z.string().uuid().nullable(),
-  grantId: z.string().uuid().nullable()
-}).strict();
-function refineConnectionUseAttribution(value, context) {
-  const personal = value.scope !== "workspace";
-  for (const field of ["ownerSubjectId"]) {
-    if (personal !== (value[field] !== null)) {
-      context.addIssue({
-        code: "custom",
-        path: [field],
-        message: personal ? `personal attribution requires ${field}` : `workspace attribution cannot carry ${field}`
-      });
-    }
-  }
-  const owned = value.scope === "user";
-  for (const field of ["authorityId"]) {
-    if (owned !== (value[field] !== null)) {
-      context.addIssue({
-        code: "custom",
-        path: [field],
-        message: owned ? `personal attribution requires ${field}` : `non-personal attribution cannot carry ${field}`
-      });
-    }
-  }
-  if (!owned && value.grantId !== null) {
-    context.addIssue({
-      code: "custom",
-      path: ["grantId"],
-      message: "only historical personal attribution can carry a grant"
-    });
-  }
-}
-var ConnectionUseAttribution = ConnectionUseAttributionFields.extend({
-  scope: z.enum(["workspace", "user"]),
-  grantId: z.null()
-}).superRefine(refineConnectionUseAttribution);
-var ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({
-  outcome: z.enum(["authorized", "denied"]),
-  denialReason: ConnectionUseDenialReason.nullable(),
-  occurredAt: z.string().datetime({ offset: true })
-}).superRefine((value, context) => {
-  refineConnectionUseAttribution(value, context);
-  if (value.outcome === "denied" !== (value.denialReason !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["denialReason"],
-      message: "only denied connection use carries a denial reason"
-    });
-  }
-});
-var ConnectionUseAuthorizationResult = z.discriminatedUnion("status", [
-  z.object({ status: z.literal("authorized"), attribution: ConnectionUseAttribution }).strict(),
-  z.object({ status: z.literal("denied"), reason: ConnectionUseDenialReason }).strict()
-]);
-
-export {
-  ConnectionAuthoritySelectionSource,
-  ConnectionUseSelectionSource,
-  ConnectionUseAuthoritySnapshot,
-  ConnectionUseDenialReason,
-  ConnectionUseAttribution,
-  ConnectionUseAuditFact,
-  ConnectionUseAuthorizationResult
-};
-//# sourceMappingURL=chunk-ICDZGUX2.js.map

package/dist/chunk-ICDZGUX2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/connection-authority.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { ConnectionKind, SessionTenancyVisibility } from \"./index\";\n\nexport const ConnectionAuthoritySelectionSource = z.enum([\"explicit_workspace\", \"sender\"]);\nexport type ConnectionAuthoritySelectionSource = z.infer<typeof ConnectionAuthoritySelectionSource>;\n\nexport const ConnectionUseSelectionSource = z\n  .string()\n  .min(1)\n  .max(128)\n  .regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);\nexport type ConnectionUseSelectionSource = z.infer<typeof ConnectionUseSelectionSource>;\n\nconst AcceptedConnectionWork = z.discriminatedUnion(\"kind\", [\n  z\n    .object({\n      kind: z.literal(\"turn\"),\n      turnId: z.string().uuid(),\n    })\n    .strict(),\n  z\n    .object({\n      kind: z.literal(\"scheduled_task\"),\n      taskId: z.string().uuid(),\n      taskAuthorityRevision: z.number().int().positive(),\n      runId: z.string().uuid(),\n    })\n    .strict(),\n]);\n\n/**\n * Internal, credential-free authority frozen when work is accepted. Personal\n * owner identity is retained only for live authorization and usage/audit\n * attribution; it is never part of the public delegation envelope.\n */\nexport const ConnectionUseAuthoritySnapshot = z\n  .object({\n    organizationId: z.string().uuid(),\n    originWorkspaceId: z.string().uuid(),\n    targetWorkspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive(),\n    acceptedWork: AcceptedConnectionWork,\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    connectionStatus: z.literal(\"active\"),\n    providerDomain: z.string().min(1).max(2048),\n    connectionKind: ConnectionKind,\n    scope: z.enum([\"workspace\", \"user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    ownerOrganizationMembershipId: z.string().uuid().nullable(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),\n    authoritySource: ConnectionAuthoritySelectionSource,\n    selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),\n    userDelegation: z.null(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    const ownedBySubject = value.scope !== \"workspace\";\n    const delegated = value.scope === \"user\";\n    if (ownedBySubject !== (value.ownerSubjectId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerSubjectId\"],\n        message: \"personal connections retain an owner subject\",\n      });\n    }\n    if (delegated !== (value.ownerOrganizationMembershipId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerOrganizationMembershipId\"],\n        message: \"only user connections retain an owner membership\",\n      });\n    }\n    if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerMembershipAuthorizationRevision\"],\n        message: \"only user connections retain an owner membership revision\",\n      });\n    }\n    if (delegated && value.authoritySource !== \"sender\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"user connections require authenticated sender provenance\",\n      });\n    }\n    if (!delegated && value.authoritySource === \"sender\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"workspace connections cannot claim sender provenance\",\n      });\n    }\n    if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"originWorkspaceId\"],\n        message: \"workspace connections must be owned by the target workspace\",\n      });\n    }\n  });\nexport type ConnectionUseAuthoritySnapshot = z.infer<typeof ConnectionUseAuthoritySnapshot>;\n\nexport const ConnectionUseDenialReason = z.enum([\n  \"tenant_mismatch\",\n  \"workspace_access_inactive\",\n  \"session_inactive\",\n  \"session_identity_changed\",\n  \"session_visibility_changed\",\n  \"session_authority_epoch_changed\",\n  \"accepted_attempt_authority_required\",\n  \"accepted_snapshot_digest_changed\",\n  \"connection_missing\",\n  \"connection_identity_changed\",\n  \"connection_generation_changed\",\n  \"connection_status_inactive\",\n  \"connection_owner_changed\",\n  \"owner_membership_inactive\",\n  \"authority_missing\",\n  \"authority_identity_changed\",\n  \"authority_generation_changed\",\n  \"authority_status_inactive\",\n  \"grant_missing\",\n  \"grant_identity_changed\",\n  \"grant_generation_changed\",\n  \"grant_status_inactive\",\n  \"grant_expired\",\n  \"grant_already_consumed\",\n]);\nexport type ConnectionUseDenialReason = z.infer<typeof ConnectionUseDenialReason>;\n\nconst ConnectionUseAttributionFields = z\n  .object({\n    organizationId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    sessionId: z.string().uuid(),\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    authorityId: z.string().uuid().nullable(),\n    grantId: z.string().uuid().nullable(),\n  })\n  .strict();\n\nfunction refineConnectionUseAttribution(\n  value: z.infer<typeof ConnectionUseAttributionFields>,\n  context: z.RefinementCtx,\n): void {\n  const personal = value.scope !== \"workspace\";\n  for (const field of [\"ownerSubjectId\"] as const) {\n    if (personal !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: personal\n          ? `personal attribution requires ${field}`\n          : `workspace attribution cannot carry ${field}`,\n      });\n    }\n  }\n  const owned = value.scope === \"user\";\n  for (const field of [\"authorityId\"] as const) {\n    if (owned !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: owned\n          ? `personal attribution requires ${field}`\n          : `non-personal attribution cannot carry ${field}`,\n      });\n    }\n  }\n  if (!owned && value.grantId !== null) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"grantId\"],\n      message: \"only historical personal attribution can carry a grant\",\n    });\n  }\n}\n\n/** Metadata-only attribution emitted after pre-use authorization. */\nexport const ConnectionUseAttribution = ConnectionUseAttributionFields.extend({\n  scope: z.enum([\"workspace\", \"user\"]),\n  grantId: z.null(),\n}).superRefine(refineConnectionUseAttribution);\nexport type ConnectionUseAttribution = z.infer<typeof ConnectionUseAttribution>;\n\nexport const ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({\n  outcome: z.enum([\"authorized\", \"denied\"]),\n  denialReason: ConnectionUseDenialReason.nullable(),\n  occurredAt: z.string().datetime({ offset: true }),\n}).superRefine((value, context) => {\n  refineConnectionUseAttribution(value, context);\n  if ((value.outcome === \"denied\") !== (value.denialReason !== null)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"denialReason\"],\n      message: \"only denied connection use carries a denial reason\",\n    });\n  }\n});\nexport type ConnectionUseAuditFact = z.infer<typeof ConnectionUseAuditFact>;\n\nexport const ConnectionUseAuthorizationResult = z.discriminatedUnion(\"status\", [\n  z.object({ status: z.literal(\"authorized\"), attribution: ConnectionUseAttribution }).strict(),\n  z.object({ status: z.literal(\"denied\"), reason: ConnectionUseDenialReason }).strict(),\n]);\nexport type ConnectionUseAuthorizationResult = z.infer<typeof ConnectionUseAuthorizationResult>;\n"],"mappings":";;;;;;AAAA,SAAS,SAAS;AAGX,IAAM,qCAAqC,EAAE,KAAK,CAAC,sBAAsB,QAAQ,CAAC;AAGlF,IAAM,+BAA+B,EACzC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,uCAAuC;AAGhD,IAAM,yBAAyB,EAAE,mBAAmB,QAAQ;AAAA,EAC1D,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,IAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACjD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO;AACZ,CAAC;AAOM,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvD,cAAc;AAAA,EACd,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,EACpC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC1C,gBAAgB;AAAA,EAChB,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,EACnC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1D,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzF,iBAAiB;AAAA,EACjB,kBAAkB,EAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtE,gBAAgB,EAAE,KAAK;AACzB,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAM,iBAAiB,MAAM,UAAU;AACvC,QAAM,YAAY,MAAM,UAAU;AAClC,MAAI,oBAAoB,MAAM,mBAAmB,OAAO;AACtD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,kCAAkC,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,+BAA+B;AAAA,MACtC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,yCAAyC,OAAO;AACvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,sCAAsC;AAAA,MAC7C,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,aAAa,MAAM,oBAAoB,UAAU;AACnD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,oBAAoB,UAAU;AACpD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,sBAAsB,MAAM,mBAAmB;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,mBAAmB;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,4BAA4B,EAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,iCAAiC,EACpC,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACtC,CAAC,EACA,OAAO;AAEV,SAAS,+BACP,OACA,SACM;AACN,QAAM,WAAW,MAAM,UAAU;AACjC,aAAW,SAAS,CAAC,gBAAgB,GAAY;AAC/C,QAAI,cAAc,MAAM,KAAK,MAAM,OAAO;AACxC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,WACL,iCAAiC,KAAK,KACtC,sCAAsC,KAAK;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,UAAU;AAC9B,aAAW,SAAS,CAAC,aAAa,GAAY;AAC5C,QAAI,WAAW,MAAM,KAAK,MAAM,OAAO;AACrC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,QACL,iCAAiC,KAAK,KACtC,yCAAyC,KAAK;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,CAAC,SAAS,MAAM,YAAY,MAAM;AACpC,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAGO,IAAM,2BAA2B,+BAA+B,OAAO;AAAA,EAC5E,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,EACnC,SAAS,EAAE,KAAK;AAClB,CAAC,EAAE,YAAY,8BAA8B;AAGtC,IAAM,yBAAyB,+BAA+B,OAAO;AAAA,EAC1E,SAAS,EAAE,KAAK,CAAC,cAAc,QAAQ,CAAC;AAAA,EACxC,cAAc,0BAA0B,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,iCAA+B,OAAO,OAAO;AAC7C,MAAK,MAAM,YAAY,cAAe,MAAM,iBAAiB,OAAO;AAClE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGM,IAAM,mCAAmC,EAAE,mBAAmB,UAAU;AAAA,EAC7E,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,YAAY,GAAG,aAAa,yBAAyB,CAAC,EAAE,OAAO;AAAA,EAC5F,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,GAAG,QAAQ,0BAA0B,CAAC,EAAE,OAAO;AACtF,CAAC;","names":[]}

package/dist/chunk-JUFK3T4Q.js

@@ -1,80 +0,0 @@
-// src/canonical-human-identities.ts
-import { z } from "zod";
-var CanonicalHumanIdentityStatus = z.enum([
-  "active",
-  "recovery_required",
-  "disputed",
-  "disabled"
-]);
-var CanonicalHumanLoginBindingStatus = z.enum([
-  "active",
-  "recovery_pending",
-  "stale",
-  "disputed",
-  "revoked"
-]);
-var CanonicalHumanRecoveryState = z.enum([
-  "ready",
-  "recovery_required",
-  "lost_factor",
-  "disputed",
-  "disabled"
-]);
-var CanonicalHumanLoginBinding = z.object({
-  id: z.string().uuid(),
-  providerId: z.string().min(1).max(128),
-  providerAccountId: z.string().min(1).max(1024),
-  status: CanonicalHumanLoginBindingStatus,
-  revision: z.number().int().positive(),
-  verifiedAt: z.string().datetime(),
-  lastVerifiedAt: z.string().datetime(),
-  revokedAt: z.string().datetime().nullable(),
-  createdAt: z.string().datetime(),
-  updatedAt: z.string().datetime()
-});
-var CanonicalHumanIdentityProjection = z.object({
-  activeIdentity: z.object({
-    id: z.string().uuid(),
-    displayName: z.string().min(1).max(256),
-    status: CanonicalHumanIdentityStatus,
-    identityRevision: z.number().int().positive(),
-    authRevision: z.number().int().positive(),
-    activeLoginBindingId: z.string().uuid().nullable(),
-    recoveryState: CanonicalHumanRecoveryState,
-    createdAt: z.string().datetime(),
-    updatedAt: z.string().datetime()
-  }),
-  loginBindings: z.array(CanonicalHumanLoginBinding).max(64)
-});
-var OperationFields = {
-  operationId: z.string().uuid().optional(),
-  expectedIdentityRevision: z.number().int().positive(),
-  reason: z.string().trim().min(1).max(512)
-};
-var LinkCanonicalHumanLoginBindingRequest = z.object({
-  ...OperationFields,
-  providerId: z.string().trim().min(1).max(128),
-  providerAccountId: z.string().trim().min(1).max(1024)
-});
-var CanonicalHumanBindingOperationRequest = z.object({
-  ...OperationFields
-});
-var CanonicalHumanIdentityMutationOutcome = z.enum(["applied", "lost_factor", "disputed"]);
-var CanonicalHumanIdentityMutationResponse = z.object({
-  outcome: CanonicalHumanIdentityMutationOutcome,
-  operationId: z.string().uuid(),
-  identity: CanonicalHumanIdentityProjection
-});
-
-export {
-  CanonicalHumanIdentityStatus,
-  CanonicalHumanLoginBindingStatus,
-  CanonicalHumanRecoveryState,
-  CanonicalHumanLoginBinding,
-  CanonicalHumanIdentityProjection,
-  LinkCanonicalHumanLoginBindingRequest,
-  CanonicalHumanBindingOperationRequest,
-  CanonicalHumanIdentityMutationOutcome,
-  CanonicalHumanIdentityMutationResponse
-};
-//# sourceMappingURL=chunk-JUFK3T4Q.js.map

package/dist/chunk-JUFK3T4Q.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/canonical-human-identities.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const CanonicalHumanIdentityStatus = z.enum([\n  \"active\",\n  \"recovery_required\",\n  \"disputed\",\n  \"disabled\",\n]);\nexport type CanonicalHumanIdentityStatus = z.infer<typeof CanonicalHumanIdentityStatus>;\n\nexport const CanonicalHumanLoginBindingStatus = z.enum([\n  \"active\",\n  \"recovery_pending\",\n  \"stale\",\n  \"disputed\",\n  \"revoked\",\n]);\nexport type CanonicalHumanLoginBindingStatus = z.infer<typeof CanonicalHumanLoginBindingStatus>;\n\nexport const CanonicalHumanRecoveryState = z.enum([\n  \"ready\",\n  \"recovery_required\",\n  \"lost_factor\",\n  \"disputed\",\n  \"disabled\",\n]);\nexport type CanonicalHumanRecoveryState = z.infer<typeof CanonicalHumanRecoveryState>;\n\nexport const CanonicalHumanLoginBinding = z.object({\n  id: z.string().uuid(),\n  providerId: z.string().min(1).max(128),\n  providerAccountId: z.string().min(1).max(1024),\n  status: CanonicalHumanLoginBindingStatus,\n  revision: z.number().int().positive(),\n  verifiedAt: z.string().datetime(),\n  lastVerifiedAt: z.string().datetime(),\n  revokedAt: z.string().datetime().nullable(),\n  createdAt: z.string().datetime(),\n  updatedAt: z.string().datetime(),\n});\nexport type CanonicalHumanLoginBinding = z.infer<typeof CanonicalHumanLoginBinding>;\n\nexport const CanonicalHumanIdentityProjection = z.object({\n  activeIdentity: z.object({\n    id: z.string().uuid(),\n    displayName: z.string().min(1).max(256),\n    status: CanonicalHumanIdentityStatus,\n    identityRevision: z.number().int().positive(),\n    authRevision: z.number().int().positive(),\n    activeLoginBindingId: z.string().uuid().nullable(),\n    recoveryState: CanonicalHumanRecoveryState,\n    createdAt: z.string().datetime(),\n    updatedAt: z.string().datetime(),\n  }),\n  loginBindings: z.array(CanonicalHumanLoginBinding).max(64),\n});\nexport type CanonicalHumanIdentityProjection = z.infer<typeof CanonicalHumanIdentityProjection>;\n\nconst OperationFields = {\n  operationId: z.string().uuid().optional(),\n  expectedIdentityRevision: z.number().int().positive(),\n  reason: z.string().trim().min(1).max(512),\n} as const;\n\nexport const LinkCanonicalHumanLoginBindingRequest = z.object({\n  ...OperationFields,\n  providerId: z.string().trim().min(1).max(128),\n  providerAccountId: z.string().trim().min(1).max(1024),\n});\nexport type LinkCanonicalHumanLoginBindingRequest = z.infer<\n  typeof LinkCanonicalHumanLoginBindingRequest\n>;\n\nexport const CanonicalHumanBindingOperationRequest = z.object({\n  ...OperationFields,\n});\nexport type CanonicalHumanBindingOperationRequest = z.infer<\n  typeof CanonicalHumanBindingOperationRequest\n>;\n\nexport const CanonicalHumanIdentityMutationOutcome = z.enum([\"applied\", \"lost_factor\", \"disputed\"]);\nexport type CanonicalHumanIdentityMutationOutcome = z.infer<\n  typeof CanonicalHumanIdentityMutationOutcome\n>;\n\nexport const CanonicalHumanIdentityMutationResponse = z.object({\n  outcome: CanonicalHumanIdentityMutationOutcome,\n  operationId: z.string().uuid(),\n  identity: CanonicalHumanIdentityProjection,\n});\nexport type CanonicalHumanIdentityMutationResponse = z.infer<\n  typeof CanonicalHumanIdentityMutationResponse\n>;\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,+BAA+B,EAAE,KAAK;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,mCAAmC,EAAE,KAAK;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,8BAA8B,EAAE,KAAK;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACrC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC7C,QAAQ;AAAA,EACR,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,gBAAgB,EAAE,OAAO;AAAA,IACvB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACtC,QAAQ;AAAA,IACR,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC5C,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACxC,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IACjD,eAAe;AAAA,IACf,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC;AAAA,EACD,eAAe,EAAE,MAAM,0BAA0B,EAAE,IAAI,EAAE;AAC3D,CAAC;AAGD,IAAM,kBAAkB;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAC1C;AAEO,IAAM,wCAAwC,EAAE,OAAO;AAAA,EAC5D,GAAG;AAAA,EACH,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC5C,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AACtD,CAAC;AAKM,IAAM,wCAAwC,EAAE,OAAO;AAAA,EAC5D,GAAG;AACL,CAAC;AAKM,IAAM,wCAAwC,EAAE,KAAK,CAAC,WAAW,eAAe,UAAU,CAAC;AAK3F,IAAM,yCAAyC,EAAE,OAAO;AAAA,EAC7D,SAAS;AAAA,EACT,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,UAAU;AACZ,CAAC;","names":[]}

package/dist/chunk-MYBZRDTY.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/editable-artifact-binary.ts"],"sourcesContent":["const TEXT_ENCODER = new TextEncoder();\nconst TEXT_DECODER = new TextDecoder(\"utf-8\", { fatal: true });\nconst FNV_OFFSET = 0xcbf29ce484222325n;\nconst FNV_PRIME = 0x100000001b3n;\nconst SAFE_INTEGER = BigInt(Number.MAX_SAFE_INTEGER);\nconst STABLE_ID = /^[0-9a-f]{32}$/u;\n\nexport const EDITABLE_ARTIFACT_BINARY_HEADER_BYTES = 24;\nexport const EDITABLE_ARTIFACT_BINARY_CHECKSUM_BYTES = 8;\n\nexport function strictUtf8(value: string, label: string): Uint8Array {\n  if (typeof value !== \"string\") throw new TypeError(`${label} must be a string`);\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index);\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1);\n      if (next < 0xdc00 || next > 0xdfff) {\n        throw new TypeError(`${label} contains an unpaired surrogate`);\n      }\n      index += 1;\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      throw new TypeError(`${label} contains an unpaired surrogate`);\n    }\n  }\n  return TEXT_ENCODER.encode(value);\n}\n\nexport function decodeUtf8(bytes: Uint8Array, label: string): string {\n  try {\n    return TEXT_DECODER.decode(bytes);\n  } catch {\n    throw new TypeError(`${label} is not valid UTF-8`);\n  }\n}\n\nexport function canonicalStableId(value: string, label: string): string {\n  if (!STABLE_ID.test(value)) {\n    throw new TypeError(`${label} must be a lowercase 128-bit hexadecimal id`);\n  }\n  return value;\n}\n\nexport function allocatedStableId(value: string, label: string): string {\n  canonicalStableId(value, label);\n  if (value.slice(0, 16) === \"0000000000000000\" || value.slice(16) === \"0000000000000000\") {\n    throw new TypeError(`${label} must have nonzero namespace and counter`);\n  }\n  return value;\n}\n\nexport function positiveSafeInteger(value: number, label: string): number {\n  if (!Number.isSafeInteger(value) || value <= 0) {\n    throw new TypeError(`${label} must be a positive safe integer`);\n  }\n  return value;\n}\n\nexport function nonnegativeSafeInteger(value: number, label: string): number {\n  if (!Number.isSafeInteger(value) || value < 0) {\n    throw new TypeError(`${label} must be a nonnegative safe integer`);\n  }\n  return value;\n}\n\nexport function boundedU32(value: number, label: string, maximum = 0xffff_ffff): number {\n  if (!Number.isInteger(value) || value < 0 || value > maximum) {\n    throw new RangeError(`${label} is outside its unsigned 32-bit bound`);\n  }\n  return value;\n}\n\nexport function canonicalNumber(value: number, label: string): number {\n  if (!Number.isFinite(value) || Object.is(value, -0)) {\n    throw new TypeError(`${label} must be finite and must not be negative zero`);\n  }\n  return value;\n}\n\nexport function fnv1a64(bytes: Uint8Array): bigint {\n  let hash = FNV_OFFSET;\n  for (const byte of bytes) {\n    hash ^= BigInt(byte);\n    hash = BigInt.asUintN(64, hash * FNV_PRIME);\n  }\n  return hash;\n}\n\nexport function equalBytes(left: Uint8Array, right: Uint8Array): boolean {\n  return left.byteLength === right.byteLength && left.every((byte, index) => byte === right[index]);\n}\n\nexport class ArtifactBinaryWriter {\n  readonly #maximum: number;\n  #bytes: Uint8Array;\n  #view: DataView;\n  #length = 0;\n\n  constructor(maximum: number) {\n    this.#maximum = nonnegativeSafeInteger(maximum, \"binary writer maximum\");\n    this.#bytes = new Uint8Array(Math.min(Math.max(maximum, 32), 1024));\n    this.#view = new DataView(this.#bytes.buffer);\n  }\n\n  get length(): number {\n    return this.#length;\n  }\n\n  view(): Uint8Array {\n    return this.#bytes.subarray(0, this.#length);\n  }\n\n  finish(): Uint8Array {\n    return this.#bytes.slice(0, this.#length);\n  }\n\n  #reserve(additional: number): void {\n    const next = this.#length + additional;\n    if (!Number.isSafeInteger(next) || next > this.#maximum) {\n      throw new RangeError(\"editable artifact binary payload exceeds its byte limit\");\n    }\n    if (next <= this.#bytes.byteLength) return;\n    let capacity = this.#bytes.byteLength;\n    while (capacity < next) capacity = Math.min(this.#maximum, Math.max(next, capacity * 2));\n    const grown = new Uint8Array(capacity);\n    grown.set(this.#bytes.subarray(0, this.#length));\n    this.#bytes = grown;\n    this.#view = new DataView(grown.buffer);\n  }\n\n  bytes(value: Uint8Array): void {\n    this.#reserve(value.byteLength);\n    this.#bytes.set(value, this.#length);\n    this.#length += value.byteLength;\n  }\n\n  u8(value: number): void {\n    boundedU32(value, \"u8\", 0xff);\n    this.#reserve(1);\n    this.#view.setUint8(this.#length, value);\n    this.#length += 1;\n  }\n\n  bool(value: boolean): void {\n    if (typeof value !== \"boolean\") throw new TypeError(\"boolean value is invalid\");\n    this.u8(value ? 1 : 0);\n  }\n\n  u16(value: number): void {\n    boundedU32(value, \"u16\", 0xffff);\n    this.#reserve(2);\n    this.#view.setUint16(this.#length, value, true);\n    this.#length += 2;\n  }\n\n  u32(value: number): void {\n    boundedU32(value, \"u32\");\n    this.#reserve(4);\n    this.#view.setUint32(this.#length, value, true);\n    this.#length += 4;\n  }\n\n  i32(value: number): void {\n    if (!Number.isInteger(value) || value < -0x8000_0000 || value > 0x7fff_ffff) {\n      throw new RangeError(\"i32 value is outside its bound\");\n    }\n    this.#reserve(4);\n    this.#view.setInt32(this.#length, value, true);\n    this.#length += 4;\n  }\n\n  u64(value: bigint | number): void {\n    const encoded =\n      typeof value === \"number\" ? BigInt(nonnegativeSafeInteger(value, \"u64\")) : value;\n    if (encoded < 0n || encoded > 0xffff_ffff_ffff_ffffn)\n      throw new RangeError(\"u64 value is outside its bound\");\n    this.#reserve(8);\n    this.#view.setBigUint64(this.#length, encoded, true);\n    this.#length += 8;\n  }\n\n  i64(value: bigint | number): void {\n    const encoded =\n      typeof value === \"number\"\n        ? BigInt(\n            Number.isSafeInteger(value)\n              ? value\n              : (() => {\n                  throw new TypeError(\"i64 number must be safe\");\n                })(),\n          )\n        : value;\n    if (encoded < -0x8000_0000_0000_0000n || encoded > 0x7fff_ffff_ffff_ffffn) {\n      throw new RangeError(\"i64 value is outside its bound\");\n    }\n    this.#reserve(8);\n    this.#view.setBigInt64(this.#length, encoded, true);\n    this.#length += 8;\n  }\n\n  f64(value: number, label = \"number\"): void {\n    canonicalNumber(value, label);\n    this.#reserve(8);\n    this.#view.setFloat64(this.#length, value, true);\n    this.#length += 8;\n  }\n\n  count(value: number, maximum: number, label: string): void {\n    if (!Number.isInteger(value) || value < 0 || value > maximum) {\n      throw new RangeError(`${label} exceeds its collection bound`);\n    }\n    this.u32(value);\n  }\n\n  string(value: string, maximum: number, label: string): void {\n    const bytes = strictUtf8(value, label);\n    if (bytes.byteLength > maximum) throw new RangeError(`${label} exceeds its byte limit`);\n    this.u32(bytes.byteLength);\n    this.bytes(bytes);\n  }\n\n  stableId(value: string, label: string, requireAllocated = false): void {\n    (requireAllocated ? allocatedStableId : canonicalStableId)(value, label);\n    this.u64(BigInt(`0x${value.slice(16)}`));\n    this.u64(BigInt(`0x${value.slice(0, 16)}`));\n  }\n}\n\nexport class ArtifactBinaryReader {\n  readonly #bytes: Uint8Array;\n  readonly #view: DataView;\n  #offset = 0;\n\n  constructor(bytes: Uint8Array) {\n    if (!(bytes instanceof Uint8Array)) throw new TypeError(\"binary input must be a Uint8Array\");\n    this.#bytes = bytes;\n    this.#view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);\n  }\n\n  get remaining(): number {\n    return this.#bytes.byteLength - this.#offset;\n  }\n\n  done(message = \"editable artifact binary payload contains trailing bytes\"): void {\n    if (this.remaining !== 0) throw new TypeError(message);\n  }\n\n  bytes(length: number): Uint8Array {\n    if (!Number.isSafeInteger(length) || length < 0 || length > this.remaining) {\n      throw new TypeError(\"truncated editable artifact binary payload\");\n    }\n    const value = this.#bytes.subarray(this.#offset, this.#offset + length);\n    this.#offset += length;\n    return value;\n  }\n\n  u8(): number {\n    return this.bytes(1)[0]!;\n  }\n\n  bool(label = \"boolean\"): boolean {\n    const value = this.u8();\n    if (value > 1) throw new TypeError(`invalid ${label}`);\n    return value === 1;\n  }\n\n  u16(): number {\n    const offset = this.#offset;\n    this.bytes(2);\n    return this.#view.getUint16(offset, true);\n  }\n\n  u32(): number {\n    const offset = this.#offset;\n    this.bytes(4);\n    return this.#view.getUint32(offset, true);\n  }\n\n  i32(): number {\n    const offset = this.#offset;\n    this.bytes(4);\n    return this.#view.getInt32(offset, true);\n  }\n\n  u64BigInt(): bigint {\n    const offset = this.#offset;\n    this.bytes(8);\n    return this.#view.getBigUint64(offset, true);\n  }\n\n  u64Safe(label: string): number {\n    const value = this.u64BigInt();\n    if (value > SAFE_INTEGER) throw new RangeError(`${label} exceeds the JavaScript-safe bound`);\n    return Number(value);\n  }\n\n  i64BigInt(): bigint {\n    const offset = this.#offset;\n    this.bytes(8);\n    return this.#view.getBigInt64(offset, true);\n  }\n\n  i64Safe(label: string): number {\n    const value = this.i64BigInt();\n    if (value < -SAFE_INTEGER || value > SAFE_INTEGER)\n      throw new RangeError(`${label} exceeds the JavaScript-safe bound`);\n    return Number(value);\n  }\n\n  f64(label: string): number {\n    const offset = this.#offset;\n    this.bytes(8);\n    return canonicalNumber(this.#view.getFloat64(offset, true), label);\n  }\n\n  count(maximum: number, label: string, minimumBytes = 0): number {\n    const value = this.u32();\n    if (value > maximum) throw new RangeError(`${label} exceeds its collection bound`);\n    if (minimumBytes > 0 && value > Math.floor(this.remaining / minimumBytes)) {\n      throw new TypeError(\"truncated editable artifact binary payload\");\n    }\n    return value;\n  }\n\n  string(maximum: number, label: string): string {\n    const length = this.count(maximum, label, 1);\n    return decodeUtf8(this.bytes(length), label);\n  }\n\n  stableId(label: string, requireAllocated = false): string {\n    const counter = this.u64BigInt().toString(16).padStart(16, \"0\");\n    const namespace = this.u64BigInt().toString(16).padStart(16, \"0\");\n    const value = `${namespace}${counter}`;\n    return (requireAllocated ? allocatedStableId : canonicalStableId)(value, label);\n  }\n}\n\nexport function encodeCountedEnvelope(\n  magic: string,\n  version: number,\n  count: number,\n  payload: Uint8Array,\n  maximum: number,\n): Uint8Array {\n  if (strictUtf8(magic, \"envelope magic\").byteLength !== 8)\n    throw new TypeError(\"envelope magic must be eight bytes\");\n  const output = new ArtifactBinaryWriter(maximum);\n  output.bytes(strictUtf8(magic, \"envelope magic\"));\n  output.u16(version);\n  output.u16(0);\n  output.u32(count);\n  output.u64(BigInt(payload.byteLength));\n  output.bytes(payload);\n  output.u64(fnv1a64(output.view()));\n  return output.finish();\n}\n\nexport function decodeCountedEnvelope(\n  bytes: Uint8Array,\n  magic: string,\n  version: number,\n  maximum: number,\n  maxCount: number,\n): { count: number; payload: Uint8Array } {\n  if (!(bytes instanceof Uint8Array)) throw new TypeError(\"envelope bytes must be a Uint8Array\");\n  if (bytes.byteLength > maximum)\n    throw new RangeError(\"editable artifact envelope exceeds its byte limit\");\n  if (\n    bytes.byteLength <\n    EDITABLE_ARTIFACT_BINARY_HEADER_BYTES + EDITABLE_ARTIFACT_BINARY_CHECKSUM_BYTES\n  ) {\n    throw new TypeError(\"truncated editable artifact envelope\");\n  }\n  const reader = new ArtifactBinaryReader(bytes);\n  if (!equalBytes(reader.bytes(8), strictUtf8(magic, \"envelope magic\")))\n    throw new TypeError(\"invalid editable artifact envelope magic\");\n  const actualVersion = reader.u16();\n  if (actualVersion !== version)\n    throw new TypeError(`unsupported editable artifact envelope version: ${actualVersion}`);\n  if (reader.u16() !== 0)\n    throw new TypeError(\"reserved editable artifact envelope flags must be zero\");\n  const count = reader.u32();\n  if (count > maxCount) throw new RangeError(\"editable artifact envelope count exceeds its limit\");\n  const payloadLength = reader.u64Safe(\"editable artifact payload length\");\n  const expected =\n    EDITABLE_ARTIFACT_BINARY_HEADER_BYTES + payloadLength + EDITABLE_ARTIFACT_BINARY_CHECKSUM_BYTES;\n  if (bytes.byteLength < expected) throw new TypeError(\"truncated editable artifact envelope\");\n  if (bytes.byteLength > expected)\n    throw new TypeError(\"editable artifact envelope contains trailing bytes\");\n  const payload = reader.bytes(payloadLength);\n  const checksum = reader.u64BigInt();\n  reader.done();\n  if (checksum !== fnv1a64(bytes.subarray(0, -EDITABLE_ARTIFACT_BINARY_CHECKSUM_BYTES))) {\n    throw new TypeError(\"editable artifact envelope checksum does not match\");\n  }\n  return { count, payload };\n}\n"],"mappings":";AAAA,IAAM,eAAe,IAAI,YAAY;AACrC,IAAM,eAAe,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAC7D,IAAM,aAAa;AACnB,IAAM,YAAY;AAClB,IAAM,eAAe,OAAO,OAAO,gBAAgB;AACnD,IAAM,YAAY;AAEX,IAAM,wCAAwC;AAC9C,IAAM,0CAA0C;AAEhD,SAAS,WAAW,OAAe,OAA2B;AACnE,MAAI,OAAO,UAAU,SAAU,OAAM,IAAI,UAAU,GAAG,KAAK,mBAAmB;AAC9E,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS,GAAG;AACpD,UAAM,OAAO,MAAM,WAAW,KAAK;AACnC,QAAI,QAAQ,SAAU,QAAQ,OAAQ;AACpC,YAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;AACvC,UAAI,OAAO,SAAU,OAAO,OAAQ;AAClC,cAAM,IAAI,UAAU,GAAG,KAAK,iCAAiC;AAAA,MAC/D;AACA,eAAS;AAAA,IACX,WAAW,QAAQ,SAAU,QAAQ,OAAQ;AAC3C,YAAM,IAAI,UAAU,GAAG,KAAK,iCAAiC;AAAA,IAC/D;AAAA,EACF;AACA,SAAO,aAAa,OAAO,KAAK;AAClC;AAEO,SAAS,WAAW,OAAmB,OAAuB;AACnE,MAAI;AACF,WAAO,aAAa,OAAO,KAAK;AAAA,EAClC,QAAQ;AACN,UAAM,IAAI,UAAU,GAAG,KAAK,qBAAqB;AAAA,EACnD;AACF;AAEO,SAAS,kBAAkB,OAAe,OAAuB;AACtE,MAAI,CAAC,UAAU,KAAK,KAAK,GAAG;AAC1B,UAAM,IAAI,UAAU,GAAG,KAAK,6CAA6C;AAAA,EAC3E;AACA,SAAO;AACT;AAEO,SAAS,kBAAkB,OAAe,OAAuB;AACtE,oBAAkB,OAAO,KAAK;AAC9B,MAAI,MAAM,MAAM,GAAG,EAAE,MAAM,sBAAsB,MAAM,MAAM,EAAE,MAAM,oBAAoB;AACvF,UAAM,IAAI,UAAU,GAAG,KAAK,0CAA0C;AAAA,EACxE;AACA,SAAO;AACT;AAEO,SAAS,oBAAoB,OAAe,OAAuB;AACxE,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAAG;AAC9C,UAAM,IAAI,UAAU,GAAG,KAAK,kCAAkC;AAAA,EAChE;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,OAAe,OAAuB;AAC3E,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC7C,UAAM,IAAI,UAAU,GAAG,KAAK,qCAAqC;AAAA,EACnE;AACA,SAAO;AACT;AAEO,SAAS,WAAW,OAAe,OAAe,UAAU,YAAqB;AACtF,MAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,QAAQ,SAAS;AAC5D,UAAM,IAAI,WAAW,GAAG,KAAK,uCAAuC;AAAA,EACtE;AACA,SAAO;AACT;AAEO,SAAS,gBAAgB,OAAe,OAAuB;AACpE,MAAI,CAAC,OAAO,SAAS,KAAK,KAAK,OAAO,GAAG,OAAO,EAAE,GAAG;AACnD,UAAM,IAAI,UAAU,GAAG,KAAK,+CAA+C;AAAA,EAC7E;AACA,SAAO;AACT;AAEO,SAAS,QAAQ,OAA2B;AACjD,MAAI,OAAO;AACX,aAAW,QAAQ,OAAO;AACxB,YAAQ,OAAO,IAAI;AACnB,WAAO,OAAO,QAAQ,IAAI,OAAO,SAAS;AAAA,EAC5C;AACA,SAAO;AACT;AAEO,SAAS,WAAW,MAAkB,OAA4B;AACvE,SAAO,KAAK,eAAe,MAAM,cAAc,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS,MAAM,KAAK,CAAC;AAClG;AAEO,IAAM,uBAAN,MAA2B;AAAA,EACvB;AAAA,EACT;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EAEV,YAAY,SAAiB;AAC3B,SAAK,WAAW,uBAAuB,SAAS,uBAAuB;AACvE,SAAK,SAAS,IAAI,WAAW,KAAK,IAAI,KAAK,IAAI,SAAS,EAAE,GAAG,IAAI,CAAC;AAClE,SAAK,QAAQ,IAAI,SAAS,KAAK,OAAO,MAAM;AAAA,EAC9C;AAAA,EAEA,IAAI,SAAiB;AACnB,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,OAAmB;AACjB,WAAO,KAAK,OAAO,SAAS,GAAG,KAAK,OAAO;AAAA,EAC7C;AAAA,EAEA,SAAqB;AACnB,WAAO,KAAK,OAAO,MAAM,GAAG,KAAK,OAAO;AAAA,EAC1C;AAAA,EAEA,SAAS,YAA0B;AACjC,UAAM,OAAO,KAAK,UAAU;AAC5B,QAAI,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,KAAK,UAAU;AACvD,YAAM,IAAI,WAAW,yDAAyD;AAAA,IAChF;AACA,QAAI,QAAQ,KAAK,OAAO,WAAY;AACpC,QAAI,WAAW,KAAK,OAAO;AAC3B,WAAO,WAAW,KAAM,YAAW,KAAK,IAAI,KAAK,UAAU,KAAK,IAAI,MAAM,WAAW,CAAC,CAAC;AACvF,UAAM,QAAQ,IAAI,WAAW,QAAQ;AACrC,UAAM,IAAI,KAAK,OAAO,SAAS,GAAG,KAAK,OAAO,CAAC;AAC/C,SAAK,SAAS;AACd,SAAK,QAAQ,IAAI,SAAS,MAAM,MAAM;AAAA,EACxC;AAAA,EAEA,MAAM,OAAyB;AAC7B,SAAK,SAAS,MAAM,UAAU;AAC9B,SAAK,OAAO,IAAI,OAAO,KAAK,OAAO;AACnC,SAAK,WAAW,MAAM;AAAA,EACxB;AAAA,EAEA,GAAG,OAAqB;AACtB,eAAW,OAAO,MAAM,GAAI;AAC5B,SAAK,SAAS,CAAC;AACf,SAAK,MAAM,SAAS,KAAK,SAAS,KAAK;AACvC,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,KAAK,OAAsB;AACzB,QAAI,OAAO,UAAU,UAAW,OAAM,IAAI,UAAU,0BAA0B;AAC9E,SAAK,GAAG,QAAQ,IAAI,CAAC;AAAA,EACvB;AAAA,EAEA,IAAI,OAAqB;AACvB,eAAW,OAAO,OAAO,KAAM;AAC/B,SAAK,SAAS,CAAC;AACf,SAAK,MAAM,UAAU,KAAK,SAAS,OAAO,IAAI;AAC9C,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,IAAI,OAAqB;AACvB,eAAW,OAAO,KAAK;AACvB,SAAK,SAAS,CAAC;AACf,SAAK,MAAM,UAAU,KAAK,SAAS,OAAO,IAAI;AAC9C,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,IAAI,OAAqB;AACvB,QAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,eAAgB,QAAQ,YAAa;AAC3E,YAAM,IAAI,WAAW,gCAAgC;AAAA,IACvD;AACA,SAAK,SAAS,CAAC;AACf,SAAK,MAAM,SAAS,KAAK,SAAS,OAAO,IAAI;AAC7C,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,IAAI,OAA8B;AAChC,UAAM,UACJ,OAAO,UAAU,WAAW,OAAO,uBAAuB,OAAO,KAAK,CAAC,IAAI;AAC7E,QAAI,UAAU,MAAM,UAAU;AAC5B,YAAM,IAAI,WAAW,gCAAgC;AACvD,SAAK,SAAS,CAAC;AACf,SAAK,MAAM,aAAa,KAAK,SAAS,SAAS,IAAI;AACnD,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,IAAI,OAA8B;AAChC,UAAM,UACJ,OAAO,UAAU,WACb;AAAA,MACE,OAAO,cAAc,KAAK,IACtB,SACC,MAAM;AACL,cAAM,IAAI,UAAU,yBAAyB;AAAA,MAC/C,GAAG;AAAA,IACT,IACA;AACN,QAAI,UAAU,CAAC,uBAA0B,UAAU,qBAAwB;AACzE,YAAM,IAAI,WAAW,gCAAgC;AAAA,IACvD;AACA,SAAK,SAAS,CAAC;AACf,SAAK,MAAM,YAAY,KAAK,SAAS,SAAS,IAAI;AAClD,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,IAAI,OAAe,QAAQ,UAAgB;AACzC,oBAAgB,OAAO,KAAK;AAC5B,SAAK,SAAS,CAAC;AACf,SAAK,MAAM,WAAW,KAAK,SAAS,OAAO,IAAI;AAC/C,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,MAAM,OAAe,SAAiB,OAAqB;AACzD,QAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,QAAQ,SAAS;AAC5D,YAAM,IAAI,WAAW,GAAG,KAAK,+BAA+B;AAAA,IAC9D;AACA,SAAK,IAAI,KAAK;AAAA,EAChB;AAAA,EAEA,OAAO,OAAe,SAAiB,OAAqB;AAC1D,UAAM,QAAQ,WAAW,OAAO,KAAK;AACrC,QAAI,MAAM,aAAa,QAAS,OAAM,IAAI,WAAW,GAAG,KAAK,yBAAyB;AACtF,SAAK,IAAI,MAAM,UAAU;AACzB,SAAK,MAAM,KAAK;AAAA,EAClB;AAAA,EAEA,SAAS,OAAe,OAAe,mBAAmB,OAAa;AACrE,KAAC,mBAAmB,oBAAoB,mBAAmB,OAAO,KAAK;AACvE,SAAK,IAAI,OAAO,KAAK,MAAM,MAAM,EAAE,CAAC,EAAE,CAAC;AACvC,SAAK,IAAI,OAAO,KAAK,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;AAAA,EAC5C;AACF;AAEO,IAAM,uBAAN,MAA2B;AAAA,EACvB;AAAA,EACA;AAAA,EACT,UAAU;AAAA,EAEV,YAAY,OAAmB;AAC7B,QAAI,EAAE,iBAAiB,YAAa,OAAM,IAAI,UAAU,mCAAmC;AAC3F,SAAK,SAAS;AACd,SAAK,QAAQ,IAAI,SAAS,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;AAAA,EAC5E;AAAA,EAEA,IAAI,YAAoB;AACtB,WAAO,KAAK,OAAO,aAAa,KAAK;AAAA,EACvC;AAAA,EAEA,KAAK,UAAU,4DAAkE;AAC/E,QAAI,KAAK,cAAc,EAAG,OAAM,IAAI,UAAU,OAAO;AAAA,EACvD;AAAA,EAEA,MAAM,QAA4B;AAChC,QAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,KAAK,SAAS,KAAK,WAAW;AAC1E,YAAM,IAAI,UAAU,4CAA4C;AAAA,IAClE;AACA,UAAM,QAAQ,KAAK,OAAO,SAAS,KAAK,SAAS,KAAK,UAAU,MAAM;AACtE,SAAK,WAAW;AAChB,WAAO;AAAA,EACT;AAAA,EAEA,KAAa;AACX,WAAO,KAAK,MAAM,CAAC,EAAE,CAAC;AAAA,EACxB;AAAA,EAEA,KAAK,QAAQ,WAAoB;AAC/B,UAAM,QAAQ,KAAK,GAAG;AACtB,QAAI,QAAQ,EAAG,OAAM,IAAI,UAAU,WAAW,KAAK,EAAE;AACrD,WAAO,UAAU;AAAA,EACnB;AAAA,EAEA,MAAc;AACZ,UAAM,SAAS,KAAK;AACpB,SAAK,MAAM,CAAC;AACZ,WAAO,KAAK,MAAM,UAAU,QAAQ,IAAI;AAAA,EAC1C;AAAA,EAEA,MAAc;AACZ,UAAM,SAAS,KAAK;AACpB,SAAK,MAAM,CAAC;AACZ,WAAO,KAAK,MAAM,UAAU,QAAQ,IAAI;AAAA,EAC1C;AAAA,EAEA,MAAc;AACZ,UAAM,SAAS,KAAK;AACpB,SAAK,MAAM,CAAC;AACZ,WAAO,KAAK,MAAM,SAAS,QAAQ,IAAI;AAAA,EACzC;AAAA,EAEA,YAAoB;AAClB,UAAM,SAAS,KAAK;AACpB,SAAK,MAAM,CAAC;AACZ,WAAO,KAAK,MAAM,aAAa,QAAQ,IAAI;AAAA,EAC7C;AAAA,EAEA,QAAQ,OAAuB;AAC7B,UAAM,QAAQ,KAAK,UAAU;AAC7B,QAAI,QAAQ,aAAc,OAAM,IAAI,WAAW,GAAG,KAAK,oCAAoC;AAC3F,WAAO,OAAO,KAAK;AAAA,EACrB;AAAA,EAEA,YAAoB;AAClB,UAAM,SAAS,KAAK;AACpB,SAAK,MAAM,CAAC;AACZ,WAAO,KAAK,MAAM,YAAY,QAAQ,IAAI;AAAA,EAC5C;AAAA,EAEA,QAAQ,OAAuB;AAC7B,UAAM,QAAQ,KAAK,UAAU;AAC7B,QAAI,QAAQ,CAAC,gBAAgB,QAAQ;AACnC,YAAM,IAAI,WAAW,GAAG,KAAK,oCAAoC;AACnE,WAAO,OAAO,KAAK;AAAA,EACrB;AAAA,EAEA,IAAI,OAAuB;AACzB,UAAM,SAAS,KAAK;AACpB,SAAK,MAAM,CAAC;AACZ,WAAO,gBAAgB,KAAK,MAAM,WAAW,QAAQ,IAAI,GAAG,KAAK;AAAA,EACnE;AAAA,EAEA,MAAM,SAAiB,OAAe,eAAe,GAAW;AAC9D,UAAM,QAAQ,KAAK,IAAI;AACvB,QAAI,QAAQ,QAAS,OAAM,IAAI,WAAW,GAAG,KAAK,+BAA+B;AACjF,QAAI,eAAe,KAAK,QAAQ,KAAK,MAAM,KAAK,YAAY,YAAY,GAAG;AACzE,YAAM,IAAI,UAAU,4CAA4C;AAAA,IAClE;AACA,WAAO;AAAA,EACT;AAAA,EAEA,OAAO,SAAiB,OAAuB;AAC7C,UAAM,SAAS,KAAK,MAAM,SAAS,OAAO,CAAC;AAC3C,WAAO,WAAW,KAAK,MAAM,MAAM,GAAG,KAAK;AAAA,EAC7C;AAAA,EAEA,SAAS,OAAe,mBAAmB,OAAe;AACxD,UAAM,UAAU,KAAK,UAAU,EAAE,SAAS,EAAE,EAAE,SAAS,IAAI,GAAG;AAC9D,UAAM,YAAY,KAAK,UAAU,EAAE,SAAS,EAAE,EAAE,SAAS,IAAI,GAAG;AAChE,UAAM,QAAQ,GAAG,SAAS,GAAG,OAAO;AACpC,YAAQ,mBAAmB,oBAAoB,mBAAmB,OAAO,KAAK;AAAA,EAChF;AACF;AAEO,SAAS,sBACd,OACA,SACA,OACA,SACA,SACY;AACZ,MAAI,WAAW,OAAO,gBAAgB,EAAE,eAAe;AACrD,UAAM,IAAI,UAAU,oCAAoC;AAC1D,QAAM,SAAS,IAAI,qBAAqB,OAAO;AAC/C,SAAO,MAAM,WAAW,OAAO,gBAAgB,CAAC;AAChD,SAAO,IAAI,OAAO;AAClB,SAAO,IAAI,CAAC;AACZ,SAAO,IAAI,KAAK;AAChB,SAAO,IAAI,OAAO,QAAQ,UAAU,CAAC;AACrC,SAAO,MAAM,OAAO;AACpB,SAAO,IAAI,QAAQ,OAAO,KAAK,CAAC,CAAC;AACjC,SAAO,OAAO,OAAO;AACvB;AAEO,SAAS,sBACd,OACA,OACA,SACA,SACA,UACwC;AACxC,MAAI,EAAE,iBAAiB,YAAa,OAAM,IAAI,UAAU,qCAAqC;AAC7F,MAAI,MAAM,aAAa;AACrB,UAAM,IAAI,WAAW,mDAAmD;AAC1E,MACE,MAAM,aACN,wCAAwC,yCACxC;AACA,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AACA,QAAM,SAAS,IAAI,qBAAqB,KAAK;AAC7C,MAAI,CAAC,WAAW,OAAO,MAAM,CAAC,GAAG,WAAW,OAAO,gBAAgB,CAAC;AAClE,UAAM,IAAI,UAAU,0CAA0C;AAChE,QAAM,gBAAgB,OAAO,IAAI;AACjC,MAAI,kBAAkB;AACpB,UAAM,IAAI,UAAU,mDAAmD,aAAa,EAAE;AACxF,MAAI,OAAO,IAAI,MAAM;AACnB,UAAM,IAAI,UAAU,wDAAwD;AAC9E,QAAM,QAAQ,OAAO,IAAI;AACzB,MAAI,QAAQ,SAAU,OAAM,IAAI,WAAW,oDAAoD;AAC/F,QAAM,gBAAgB,OAAO,QAAQ,kCAAkC;AACvE,QAAM,WACJ,wCAAwC,gBAAgB;AAC1D,MAAI,MAAM,aAAa,SAAU,OAAM,IAAI,UAAU,sCAAsC;AAC3F,MAAI,MAAM,aAAa;AACrB,UAAM,IAAI,UAAU,oDAAoD;AAC1E,QAAM,UAAU,OAAO,MAAM,aAAa;AAC1C,QAAM,WAAW,OAAO,UAAU;AAClC,SAAO,KAAK;AACZ,MAAI,aAAa,QAAQ,MAAM,SAAS,GAAG,CAAC,uCAAuC,CAAC,GAAG;AACrF,UAAM,IAAI,UAAU,oDAAoD;AAAA,EAC1E;AACA,SAAO,EAAE,OAAO,QAAQ;AAC1B;","names":[]}

package/dist/chunk-NRMCVHAU.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/editable-artifact-serialized-commit.ts"],"sourcesContent":["import { bytesToHex } from \"@noble/hashes/utils\";\n\nimport {\n  ArtifactBinaryReader,\n  ArtifactBinaryWriter,\n  EDITABLE_ARTIFACT_BINARY_CHECKSUM_BYTES,\n  EDITABLE_ARTIFACT_BINARY_HEADER_BYTES,\n  decodeCountedEnvelope,\n  equalBytes,\n  fnv1a64,\n  strictUtf8,\n} from \"./editable-artifact-binary\";\nimport {\n  DOCUMENT_ARTIFACT_COMMAND_MAX_COMMANDS,\n  DOCUMENT_ARTIFACT_MAX_STRUCTURAL_COUNTER,\n} from \"./document-artifact-commands\";\nimport {\n  EDITABLE_ARTIFACT_INTENT_MAX_BYTES,\n  decodeEditableArtifactMutationIntent,\n  encodeEditableArtifactMutationIntent,\n  hashEditableArtifactMutationIntentBytes,\n  type EditableArtifactMutationIntent,\n} from \"./editable-artifacts\";\nimport { editableArtifactCodecFor } from \"./editable-artifact-codec-registry\";\nimport { EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION } from \"./editable-artifact-versions\";\n\nexport { EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION } from \"./editable-artifact-versions\";\nexport const EDITABLE_ARTIFACT_SERIALIZED_COMMIT_MAX_BYTES = 8 * 1024 * 1024;\nexport const EDITABLE_ARTIFACT_NATIVE_RECEIPT_MAX_BYTES = 512 * 1024;\n\nconst MAGIC = strictUtf8(\"OGAST001\", \"serialized commit magic\");\nconst SHA256_TEXT = /^sha256:[0-9a-f]{64}$/u;\nconst STABLE_ID = /^[0-9a-f]{32}$/u;\nconst DOCUMENT_RECEIPT_MAGIC = \"OGADR001\";\nconst PRESENTATION_RECEIPT_MAGIC = strictUtf8(\"OGAPR001\", \"presentation receipt magic\");\nconst DOCUMENT_RECEIPT_VERSION = 1;\nconst PRESENTATION_RECEIPT_VERSION = 1;\nconst DOCUMENT_CREATED_IDS_PER_COMMAND = 7;\nconst DOCUMENT_ID_BYTES = 17;\nconst PRESENTATION_RECEIPT_BYTES = 32;\nconst MODALITY_TAG = Object.freeze({ document: 1, presentation: 2 } as const);\n\nexport type EditableArtifactSerializedModality = \"document\" | \"presentation\";\n\nexport type EditableArtifactNativeReceiptSummary =\n  | Readonly<{\n      modality: \"document\";\n      revision: number;\n      commandCount: number;\n      createdIdCount: number;\n    }>\n  | Readonly<{\n      modality: \"presentation\";\n      revision: number;\n      commandCount: number;\n    }>;\n\nexport type EditableArtifactSerializedCommitInput = Readonly<{\n  modality: EditableArtifactSerializedModality;\n  transactionId: string;\n  parentHeadSequence: number;\n  resultHeadSequence: number;\n  /** Native model revision before applying this non-empty command batch. */\n  priorNativeRevision: number;\n  priorStateHash: string;\n  stateHash: string;\n  /** Exact canonical OGATX001 bytes accepted by the server. */\n  intentBytes: Uint8Array;\n  /** Exact canonical OGADR001 or OGAPR001 bytes returned by the native kernel. */\n  nativeReceiptBytes: Uint8Array;\n}>;\n\nexport type EditableArtifactSerializedCommitSummary = Readonly<{\n  commitProtocolVersion: typeof EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION;\n  modality: EditableArtifactSerializedModality;\n  transactionId: string;\n  parentHeadSequence: number;\n  resultHeadSequence: number;\n  priorNativeRevision: number;\n  priorStateHash: string;\n  stateHash: string;\n  requestHash: string;\n  /** Canonical client intent nested in this authoritative commit. */\n  intent: EditableArtifactMutationIntent;\n  intentBytes: Uint8Array;\n  nativeReceiptBytes: Uint8Array;\n  nativeReceipt: EditableArtifactNativeReceiptSummary;\n}>;\n\n/**\n * Server-only encoder for one authoritative, strictly serialized commit.\n * Client identity remains solely in the exact nested OGATX envelope.\n */\nexport function encodeEditableArtifactSerializedCommit(\n  input: EditableArtifactSerializedCommitInput,\n): Uint8Array {\n  const normalized = normalizeSerializedCommit(input);\n  const payload = new ArtifactBinaryWriter(\n    EDITABLE_ARTIFACT_SERIALIZED_COMMIT_MAX_BYTES -\n      EDITABLE_ARTIFACT_BINARY_HEADER_BYTES -\n      EDITABLE_ARTIFACT_BINARY_CHECKSUM_BYTES,\n  );\n  payload.stableId(normalized.transactionId, \"serialized transaction id\");\n  payload.u64(normalized.parentHeadSequence);\n  payload.u64(normalized.resultHeadSequence);\n  payload.u64(normalized.priorNativeRevision);\n  payload.bytes(hashBytes(normalized.priorStateHash));\n  payload.bytes(hashBytes(normalized.stateHash));\n  payload.u32(normalized.intentBytes.byteLength);\n  payload.u32(normalized.nativeReceiptBytes.byteLength);\n  payload.bytes(normalized.intentBytes);\n  payload.bytes(normalized.nativeReceiptBytes);\n\n  const payloadBytes = payload.finish();\n  const output = new ArtifactBinaryWriter(EDITABLE_ARTIFACT_SERIALIZED_COMMIT_MAX_BYTES);\n  output.bytes(MAGIC);\n  output.u16(EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION);\n  output.u16(0);\n  output.u32(MODALITY_TAG[normalized.modality]);\n  output.u64(payloadBytes.byteLength);\n  output.bytes(payloadBytes);\n  output.u64(fnv1a64(output.view()));\n  return output.finish();\n}\n\n/** Durable modality must be selected before any nested receipt/command decode. */\nexport function decodeEditableArtifactSerializedCommit(\n  bytes: Uint8Array,\n  durableModality: EditableArtifactSerializedModality,\n): EditableArtifactSerializedCommitSummary {\n  assertUnsharedBytes(bytes, \"serialized commit\");\n  const modality = serializedModality(durableModality);\n  if (bytes.byteLength > EDITABLE_ARTIFACT_SERIALIZED_COMMIT_MAX_BYTES) {\n    throw new RangeError(\"serialized commit exceeds its byte limit\");\n  }\n  if (\n    bytes.byteLength <\n    EDITABLE_ARTIFACT_BINARY_HEADER_BYTES + EDITABLE_ARTIFACT_BINARY_CHECKSUM_BYTES\n  ) {\n    throw new TypeError(\"truncated serialized commit envelope\");\n  }\n  const header = new ArtifactBinaryReader(bytes);\n  if (!equalBytes(header.bytes(8), MAGIC)) {\n    throw new TypeError(\"invalid serialized commit magic\");\n  }\n  if (header.u16() !== EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION) {\n    throw new TypeError(\"unsupported serialized commit version\");\n  }\n  if (header.u16() !== 0) {\n    throw new TypeError(\"reserved serialized commit flags must be zero\");\n  }\n  if (header.u32() !== MODALITY_TAG[modality]) {\n    throw new TypeError(\"serialized commit modality disagrees with durable artifact\");\n  }\n  const payloadLength = header.u64Safe(\"serialized commit payload length\");\n  const expectedLength =\n    EDITABLE_ARTIFACT_BINARY_HEADER_BYTES + payloadLength + EDITABLE_ARTIFACT_BINARY_CHECKSUM_BYTES;\n  if (bytes.byteLength < expectedLength) {\n    throw new TypeError(\"truncated serialized commit payload\");\n  }\n  if (bytes.byteLength > expectedLength) {\n    throw new TypeError(\"serialized commit contains trailing bytes\");\n  }\n  const payloadBytes = header.bytes(payloadLength);\n  const checksum = header.u64BigInt();\n  header.done();\n  if (\n    checksum !==\n    fnv1a64(bytes.subarray(0, bytes.byteLength - EDITABLE_ARTIFACT_BINARY_CHECKSUM_BYTES))\n  ) {\n    throw new TypeError(\"serialized commit checksum does not match\");\n  }\n\n  const payload = new ArtifactBinaryReader(payloadBytes);\n  const transactionId = payload.stableId(\"serialized transaction id\");\n  const parentHeadSequence = payload.u64Safe(\"serialized parent head sequence\");\n  const resultHeadSequence = payload.u64Safe(\"serialized result head sequence\");\n  const priorNativeRevision = payload.u64Safe(\"serialized prior native revision\");\n  const priorStateHash = stateHashText(payload.bytes(32));\n  const stateHash = stateHashText(payload.bytes(32));\n  const intentLength = payload.count(\n    EDITABLE_ARTIFACT_INTENT_MAX_BYTES,\n    \"serialized intent bytes\",\n    1,\n  );\n  const receiptLength = payload.count(\n    EDITABLE_ARTIFACT_NATIVE_RECEIPT_MAX_BYTES,\n    \"serialized native receipt bytes\",\n    1,\n  );\n  if (payload.remaining !== intentLength + receiptLength) {\n    throw new TypeError(\"serialized commit nested byte lengths are inconsistent\");\n  }\n  const intentBytes = payload.bytes(intentLength).slice();\n  const nativeReceiptBytes = payload.bytes(receiptLength).slice();\n  payload.done();\n\n  const normalized = normalizeSerializedCommit({\n    modality,\n    transactionId,\n    parentHeadSequence,\n    resultHeadSequence,\n    priorNativeRevision,\n    priorStateHash,\n    stateHash,\n    intentBytes,\n    nativeReceiptBytes,\n  });\n  const canonical = encodeEditableArtifactSerializedCommit(normalized);\n  if (!equalBytes(bytes, canonical)) {\n    throw new TypeError(\"serialized commit is not canonically encoded\");\n  }\n  return Object.freeze({\n    commitProtocolVersion: EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION,\n    modality,\n    transactionId,\n    parentHeadSequence,\n    resultHeadSequence,\n    priorNativeRevision,\n    priorStateHash,\n    stateHash,\n    requestHash: normalized.requestHash,\n    intent: normalized.intent,\n    intentBytes,\n    nativeReceiptBytes,\n    nativeReceipt: normalized.nativeReceipt,\n  });\n}\n\nexport function assertCanonicalEditableArtifactSerializedCommit(\n  bytes: Uint8Array,\n  durableModality: EditableArtifactSerializedModality,\n): void {\n  decodeEditableArtifactSerializedCommit(bytes, durableModality);\n}\n\ntype NormalizedSerializedCommit = EditableArtifactSerializedCommitInput &\n  Readonly<{\n    requestHash: string;\n    intent: EditableArtifactMutationIntent;\n    nativeReceipt: EditableArtifactNativeReceiptSummary;\n  }>;\n\nfunction normalizeSerializedCommit(\n  input: EditableArtifactSerializedCommitInput,\n): NormalizedSerializedCommit {\n  const modality = serializedModality(input.modality);\n  const transactionId = canonicalStableId(input.transactionId, \"serialized transaction id\");\n  const parentHeadSequence = safeSequence(\n    input.parentHeadSequence,\n    \"serialized parent head sequence\",\n  );\n  const resultHeadSequence = safeSequence(\n    input.resultHeadSequence,\n    \"serialized result head sequence\",\n  );\n  if (resultHeadSequence !== parentHeadSequence + 1) {\n    throw new TypeError(\"serialized commit must advance the durable head exactly once\");\n  }\n  const priorNativeRevision = safeSequence(\n    input.priorNativeRevision,\n    \"serialized prior native revision\",\n  );\n  const priorStateHash = canonicalSha256(input.priorStateHash, \"serialized prior state hash\");\n  const stateHash = canonicalSha256(input.stateHash, \"serialized resulting state hash\");\n  assertUnsharedBytes(input.intentBytes, \"serialized intent\");\n  assertUnsharedBytes(input.nativeReceiptBytes, \"serialized native receipt\");\n  if (\n    input.intentBytes.byteLength < 1 ||\n    input.intentBytes.byteLength > EDITABLE_ARTIFACT_INTENT_MAX_BYTES\n  ) {\n    throw new RangeError(\"serialized intent bytes exceed their limit\");\n  }\n  if (\n    input.nativeReceiptBytes.byteLength < 1 ||\n    input.nativeReceiptBytes.byteLength > EDITABLE_ARTIFACT_NATIVE_RECEIPT_MAX_BYTES\n  ) {\n    throw new RangeError(\"serialized native receipt bytes exceed their limit\");\n  }\n  const intentBytes = input.intentBytes.slice();\n  const decodedIntent = decodeEditableArtifactMutationIntent(intentBytes);\n  if (!equalBytes(intentBytes, encodeEditableArtifactMutationIntent(decodedIntent))) {\n    throw new TypeError(\"nested serialized intent is not canonical OGATX001\");\n  }\n  if (\n    decodedIntent.causalBase.length !== 0 ||\n    decodedIntent.selectiveUndoOperationIds.length !== 0\n  ) {\n    throw new TypeError(\"serialized commits cannot carry CRDT causality or selective undo\");\n  }\n  if (decodedIntent.observedHeadSequence !== parentHeadSequence) {\n    throw new TypeError(\"serialized intent observed head does not match its parent\");\n  }\n  const descriptor = editableArtifactCodecFor({\n    durableModality: modality,\n    modelSchemaVersion: decodedIntent.modelSchemaVersion,\n    commandProtocolVersion: decodedIntent.commandProtocolVersion,\n  });\n  descriptor.command.assertCanonical(decodedIntent.commandBytes);\n  const commandCount = decodedCommandCount(descriptor.command.decode(decodedIntent.commandBytes));\n  if (commandCount < 1) {\n    throw new TypeError(\"serialized commits require a non-empty command batch\");\n  }\n  const nativeReceiptBytes = input.nativeReceiptBytes.slice();\n  const nativeReceipt = decodeNativeReceipt(modality, nativeReceiptBytes, commandCount);\n  if (modality === \"presentation\") {\n    if (nativeReceipt.revision !== priorNativeRevision + 1) {\n      throw new TypeError(\n        \"presentation receipt must advance its prior native revision exactly once\",\n      );\n    }\n    if (stateHash === priorStateHash) {\n      throw new TypeError(\"presentation commit must change its canonical state hash\");\n    }\n  } else if (nativeReceipt.revision === priorNativeRevision) {\n    if (stateHash !== priorStateHash) {\n      throw new TypeError(\"document no-op receipt cannot change the canonical state hash\");\n    }\n  } else {\n    if (nativeReceipt.revision !== priorNativeRevision + 1) {\n      throw new TypeError(\n        \"document receipt must preserve or advance its prior native revision once\",\n      );\n    }\n    if (stateHash === priorStateHash) {\n      throw new TypeError(\"document revision advance must change the canonical state hash\");\n    }\n  }\n  const requestHash = hashEditableArtifactMutationIntentBytes(intentBytes);\n  return Object.freeze({\n    modality,\n    transactionId,\n    parentHeadSequence,\n    resultHeadSequence,\n    priorNativeRevision,\n    priorStateHash,\n    stateHash,\n    intentBytes,\n    nativeReceiptBytes,\n    requestHash,\n    intent: decodedIntent,\n    nativeReceipt,\n  });\n}\n\nfunction decodeNativeReceipt(\n  modality: EditableArtifactSerializedModality,\n  bytes: Uint8Array,\n  expectedCommandCount: number,\n): EditableArtifactNativeReceiptSummary {\n  return modality === \"document\"\n    ? decodeDocumentReceipt(bytes, expectedCommandCount)\n    : decodePresentationReceipt(bytes, expectedCommandCount);\n}\n\nfunction decodeDocumentReceipt(\n  bytes: Uint8Array,\n  expectedCommandCount: number,\n): Extract<EditableArtifactNativeReceiptSummary, { modality: \"document\" }> {\n  const envelope = decodeCountedEnvelope(\n    bytes,\n    DOCUMENT_RECEIPT_MAGIC,\n    DOCUMENT_RECEIPT_VERSION,\n    EDITABLE_ARTIFACT_NATIVE_RECEIPT_MAX_BYTES,\n    DOCUMENT_ARTIFACT_COMMAND_MAX_COMMANDS,\n  );\n  const payload = new ArtifactBinaryReader(envelope.payload);\n  const revision = payload.u64Safe(\"document receipt revision\");\n  const commandCount = payload.u32();\n  if (commandCount !== envelope.count || commandCount !== expectedCommandCount) {\n    throw new TypeError(\"document receipt command count does not match its intent\");\n  }\n  const maximumCreatedIds = commandCount * DOCUMENT_CREATED_IDS_PER_COMMAND;\n  const createdIdCount = payload.count(\n    maximumCreatedIds,\n    \"document receipt created ids\",\n    DOCUMENT_ID_BYTES,\n  );\n  for (let index = 0; index < createdIdCount; index += 1) {\n    const tag = payload.u8();\n    if (tag < 1 || tag > 8) {\n      throw new TypeError(\"document receipt contains an invalid id kind\");\n    }\n    payload.u64BigInt();\n    const counter = payload.u64BigInt();\n    if (counter === 0n || counter > BigInt(DOCUMENT_ARTIFACT_MAX_STRUCTURAL_COUNTER)) {\n      throw new TypeError(\"document receipt contains an invalid id counter\");\n    }\n  }\n  payload.done(\"document receipt contains trailing bytes\");\n  return Object.freeze({\n    modality: \"document\",\n    revision,\n    commandCount,\n    createdIdCount,\n  });\n}\n\nfunction decodePresentationReceipt(\n  bytes: Uint8Array,\n  expectedCommandCount: number,\n): Extract<EditableArtifactNativeReceiptSummary, { modality: \"presentation\" }> {\n  if (bytes.byteLength !== PRESENTATION_RECEIPT_BYTES) {\n    throw new TypeError(\n      bytes.byteLength < PRESENTATION_RECEIPT_BYTES\n        ? \"truncated presentation receipt\"\n        : \"presentation receipt contains trailing bytes\",\n    );\n  }\n  const reader = new ArtifactBinaryReader(bytes);\n  if (!equalBytes(reader.bytes(8), PRESENTATION_RECEIPT_MAGIC)) {\n    throw new TypeError(\"invalid presentation receipt magic\");\n  }\n  if (reader.u16() !== PRESENTATION_RECEIPT_VERSION) {\n    throw new TypeError(\"unsupported presentation receipt version\");\n  }\n  if (reader.u16() !== 0) {\n    throw new TypeError(\"reserved presentation receipt flags must be zero\");\n  }\n  const revision = reader.u64Safe(\"presentation receipt revision\");\n  const commandCount = reader.u32();\n  if (commandCount !== expectedCommandCount) {\n    throw new TypeError(\"presentation receipt command count does not match its intent\");\n  }\n  const checksum = reader.u64BigInt();\n  reader.done();\n  if (\n    checksum !==\n    fnv1a64(bytes.subarray(0, bytes.byteLength - EDITABLE_ARTIFACT_BINARY_CHECKSUM_BYTES))\n  ) {\n    throw new TypeError(\"presentation receipt checksum does not match\");\n  }\n  return Object.freeze({ modality: \"presentation\", revision, commandCount });\n}\n\nfunction decodedCommandCount(value: unknown): number {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) {\n    throw new TypeError(\"serialized command decoder returned an invalid batch\");\n  }\n  const descriptor = Object.getOwnPropertyDescriptor(value, \"commands\");\n  if (!descriptor || !(\"value\" in descriptor) || !Array.isArray(descriptor.value)) {\n    throw new TypeError(\"serialized command decoder returned an invalid batch\");\n  }\n  return descriptor.value.length;\n}\n\nfunction serializedModality(value: unknown): EditableArtifactSerializedModality {\n  if (value !== \"document\" && value !== \"presentation\") {\n    throw new TypeError(\"serialized commit modality is invalid\");\n  }\n  return value;\n}\n\nfunction canonicalStableId(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !STABLE_ID.test(value) || /^0+$/u.test(value)) {\n    throw new TypeError(`${label} must be a nonzero lowercase 128-bit hexadecimal id`);\n  }\n  return value;\n}\n\nfunction canonicalSha256(value: unknown, label: string): string {\n  if (typeof value !== \"string\" || !SHA256_TEXT.test(value)) {\n    throw new TypeError(`${label} must be canonical sha256 text`);\n  }\n  return value;\n}\n\nfunction safeSequence(value: unknown, label: string): number {\n  if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n    throw new TypeError(`${label} must be a nonnegative safe integer`);\n  }\n  return value;\n}\n\nfunction hashBytes(value: string): Uint8Array {\n  const hex = value.slice(\"sha256:\".length);\n  const bytes = new Uint8Array(32);\n  for (let index = 0; index < bytes.byteLength; index += 1) {\n    bytes[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);\n  }\n  return bytes;\n}\n\nfunction stateHashText(value: Uint8Array): string {\n  return `sha256:${bytesToHex(value)}`;\n}\n\nfunction assertUnsharedBytes(value: unknown, label: string): asserts value is Uint8Array {\n  if (!(value instanceof Uint8Array)) {\n    throw new TypeError(`${label} bytes must be a Uint8Array`);\n  }\n  if (typeof SharedArrayBuffer !== \"undefined\" && value.buffer instanceof SharedArrayBuffer) {\n    throw new TypeError(`${label} bytes must not use shared mutable memory`);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,kBAAkB;AA2BpB,IAAM,gDAAgD,IAAI,OAAO;AACjE,IAAM,6CAA6C,MAAM;AAEhE,IAAM,QAAQ,WAAW,YAAY,yBAAyB;AAC9D,IAAM,cAAc;AACpB,IAAM,YAAY;AAClB,IAAM,yBAAyB;AAC/B,IAAM,6BAA6B,WAAW,YAAY,4BAA4B;AACtF,IAAM,2BAA2B;AACjC,IAAM,+BAA+B;AACrC,IAAM,mCAAmC;AACzC,IAAM,oBAAoB;AAC1B,IAAM,6BAA6B;AACnC,IAAM,eAAe,OAAO,OAAO,EAAE,UAAU,GAAG,cAAc,EAAE,CAAU;AAqDrE,SAAS,uCACd,OACY;AACZ,QAAM,aAAa,0BAA0B,KAAK;AAClD,QAAM,UAAU,IAAI;AAAA,IAClB,gDACE,wCACA;AAAA,EACJ;AACA,UAAQ,SAAS,WAAW,eAAe,2BAA2B;AACtE,UAAQ,IAAI,WAAW,kBAAkB;AACzC,UAAQ,IAAI,WAAW,kBAAkB;AACzC,UAAQ,IAAI,WAAW,mBAAmB;AAC1C,UAAQ,MAAM,UAAU,WAAW,cAAc,CAAC;AAClD,UAAQ,MAAM,UAAU,WAAW,SAAS,CAAC;AAC7C,UAAQ,IAAI,WAAW,YAAY,UAAU;AAC7C,UAAQ,IAAI,WAAW,mBAAmB,UAAU;AACpD,UAAQ,MAAM,WAAW,WAAW;AACpC,UAAQ,MAAM,WAAW,kBAAkB;AAE3C,QAAM,eAAe,QAAQ,OAAO;AACpC,QAAM,SAAS,IAAI,qBAAqB,6CAA6C;AACrF,SAAO,MAAM,KAAK;AAClB,SAAO,IAAI,2CAA2C;AACtD,SAAO,IAAI,CAAC;AACZ,SAAO,IAAI,aAAa,WAAW,QAAQ,CAAC;AAC5C,SAAO,IAAI,aAAa,UAAU;AAClC,SAAO,MAAM,YAAY;AACzB,SAAO,IAAI,QAAQ,OAAO,KAAK,CAAC,CAAC;AACjC,SAAO,OAAO,OAAO;AACvB;AAGO,SAAS,uCACd,OACA,iBACyC;AACzC,sBAAoB,OAAO,mBAAmB;AAC9C,QAAM,WAAW,mBAAmB,eAAe;AACnD,MAAI,MAAM,aAAa,+CAA+C;AACpE,UAAM,IAAI,WAAW,0CAA0C;AAAA,EACjE;AACA,MACE,MAAM,aACN,wCAAwC,yCACxC;AACA,UAAM,IAAI,UAAU,sCAAsC;AAAA,EAC5D;AACA,QAAM,SAAS,IAAI,qBAAqB,KAAK;AAC7C,MAAI,CAAC,WAAW,OAAO,MAAM,CAAC,GAAG,KAAK,GAAG;AACvC,UAAM,IAAI,UAAU,iCAAiC;AAAA,EACvD;AACA,MAAI,OAAO,IAAI,MAAM,6CAA6C;AAChE,UAAM,IAAI,UAAU,uCAAuC;AAAA,EAC7D;AACA,MAAI,OAAO,IAAI,MAAM,GAAG;AACtB,UAAM,IAAI,UAAU,+CAA+C;AAAA,EACrE;AACA,MAAI,OAAO,IAAI,MAAM,aAAa,QAAQ,GAAG;AAC3C,UAAM,IAAI,UAAU,4DAA4D;AAAA,EAClF;AACA,QAAM,gBAAgB,OAAO,QAAQ,kCAAkC;AACvE,QAAM,iBACJ,wCAAwC,gBAAgB;AAC1D,MAAI,MAAM,aAAa,gBAAgB;AACrC,UAAM,IAAI,UAAU,qCAAqC;AAAA,EAC3D;AACA,MAAI,MAAM,aAAa,gBAAgB;AACrC,UAAM,IAAI,UAAU,2CAA2C;AAAA,EACjE;AACA,QAAM,eAAe,OAAO,MAAM,aAAa;AAC/C,QAAM,WAAW,OAAO,UAAU;AAClC,SAAO,KAAK;AACZ,MACE,aACA,QAAQ,MAAM,SAAS,GAAG,MAAM,aAAa,uCAAuC,CAAC,GACrF;AACA,UAAM,IAAI,UAAU,2CAA2C;AAAA,EACjE;AAEA,QAAM,UAAU,IAAI,qBAAqB,YAAY;AACrD,QAAM,gBAAgB,QAAQ,SAAS,2BAA2B;AAClE,QAAM,qBAAqB,QAAQ,QAAQ,iCAAiC;AAC5E,QAAM,qBAAqB,QAAQ,QAAQ,iCAAiC;AAC5E,QAAM,sBAAsB,QAAQ,QAAQ,kCAAkC;AAC9E,QAAM,iBAAiB,cAAc,QAAQ,MAAM,EAAE,CAAC;AACtD,QAAM,YAAY,cAAc,QAAQ,MAAM,EAAE,CAAC;AACjD,QAAM,eAAe,QAAQ;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,gBAAgB,QAAQ;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,cAAc,eAAe,eAAe;AACtD,UAAM,IAAI,UAAU,wDAAwD;AAAA,EAC9E;AACA,QAAM,cAAc,QAAQ,MAAM,YAAY,EAAE,MAAM;AACtD,QAAM,qBAAqB,QAAQ,MAAM,aAAa,EAAE,MAAM;AAC9D,UAAQ,KAAK;AAEb,QAAM,aAAa,0BAA0B;AAAA,IAC3C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,YAAY,uCAAuC,UAAU;AACnE,MAAI,CAAC,WAAW,OAAO,SAAS,GAAG;AACjC,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACA,SAAO,OAAO,OAAO;AAAA,IACnB,uBAAuB;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa,WAAW;AAAA,IACxB,QAAQ,WAAW;AAAA,IACnB;AAAA,IACA;AAAA,IACA,eAAe,WAAW;AAAA,EAC5B,CAAC;AACH;AAEO,SAAS,gDACd,OACA,iBACM;AACN,yCAAuC,OAAO,eAAe;AAC/D;AASA,SAAS,0BACP,OAC4B;AAC5B,QAAM,WAAW,mBAAmB,MAAM,QAAQ;AAClD,QAAM,gBAAgB,kBAAkB,MAAM,eAAe,2BAA2B;AACxF,QAAM,qBAAqB;AAAA,IACzB,MAAM;AAAA,IACN;AAAA,EACF;AACA,QAAM,qBAAqB;AAAA,IACzB,MAAM;AAAA,IACN;AAAA,EACF;AACA,MAAI,uBAAuB,qBAAqB,GAAG;AACjD,UAAM,IAAI,UAAU,8DAA8D;AAAA,EACpF;AACA,QAAM,sBAAsB;AAAA,IAC1B,MAAM;AAAA,IACN;AAAA,EACF;AACA,QAAM,iBAAiB,gBAAgB,MAAM,gBAAgB,6BAA6B;AAC1F,QAAM,YAAY,gBAAgB,MAAM,WAAW,iCAAiC;AACpF,sBAAoB,MAAM,aAAa,mBAAmB;AAC1D,sBAAoB,MAAM,oBAAoB,2BAA2B;AACzE,MACE,MAAM,YAAY,aAAa,KAC/B,MAAM,YAAY,aAAa,oCAC/B;AACA,UAAM,IAAI,WAAW,4CAA4C;AAAA,EACnE;AACA,MACE,MAAM,mBAAmB,aAAa,KACtC,MAAM,mBAAmB,aAAa,4CACtC;AACA,UAAM,IAAI,WAAW,oDAAoD;AAAA,EAC3E;AACA,QAAM,cAAc,MAAM,YAAY,MAAM;AAC5C,QAAM,gBAAgB,qCAAqC,WAAW;AACtE,MAAI,CAAC,WAAW,aAAa,qCAAqC,aAAa,CAAC,GAAG;AACjF,UAAM,IAAI,UAAU,oDAAoD;AAAA,EAC1E;AACA,MACE,cAAc,WAAW,WAAW,KACpC,cAAc,0BAA0B,WAAW,GACnD;AACA,UAAM,IAAI,UAAU,kEAAkE;AAAA,EACxF;AACA,MAAI,cAAc,yBAAyB,oBAAoB;AAC7D,UAAM,IAAI,UAAU,2DAA2D;AAAA,EACjF;AACA,QAAM,aAAa,yBAAyB;AAAA,IAC1C,iBAAiB;AAAA,IACjB,oBAAoB,cAAc;AAAA,IAClC,wBAAwB,cAAc;AAAA,EACxC,CAAC;AACD,aAAW,QAAQ,gBAAgB,cAAc,YAAY;AAC7D,QAAM,eAAe,oBAAoB,WAAW,QAAQ,OAAO,cAAc,YAAY,CAAC;AAC9F,MAAI,eAAe,GAAG;AACpB,UAAM,IAAI,UAAU,sDAAsD;AAAA,EAC5E;AACA,QAAM,qBAAqB,MAAM,mBAAmB,MAAM;AAC1D,QAAM,gBAAgB,oBAAoB,UAAU,oBAAoB,YAAY;AACpF,MAAI,aAAa,gBAAgB;AAC/B,QAAI,cAAc,aAAa,sBAAsB,GAAG;AACtD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,cAAc,gBAAgB;AAChC,YAAM,IAAI,UAAU,0DAA0D;AAAA,IAChF;AAAA,EACF,WAAW,cAAc,aAAa,qBAAqB;AACzD,QAAI,cAAc,gBAAgB;AAChC,YAAM,IAAI,UAAU,+DAA+D;AAAA,IACrF;AAAA,EACF,OAAO;AACL,QAAI,cAAc,aAAa,sBAAsB,GAAG;AACtD,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,QAAI,cAAc,gBAAgB;AAChC,YAAM,IAAI,UAAU,gEAAgE;AAAA,IACtF;AAAA,EACF;AACA,QAAM,cAAc,wCAAwC,WAAW;AACvE,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AACH;AAEA,SAAS,oBACP,UACA,OACA,sBACsC;AACtC,SAAO,aAAa,aAChB,sBAAsB,OAAO,oBAAoB,IACjD,0BAA0B,OAAO,oBAAoB;AAC3D;AAEA,SAAS,sBACP,OACA,sBACyE;AACzE,QAAM,WAAW;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAU,IAAI,qBAAqB,SAAS,OAAO;AACzD,QAAM,WAAW,QAAQ,QAAQ,2BAA2B;AAC5D,QAAM,eAAe,QAAQ,IAAI;AACjC,MAAI,iBAAiB,SAAS,SAAS,iBAAiB,sBAAsB;AAC5E,UAAM,IAAI,UAAU,0DAA0D;AAAA,EAChF;AACA,QAAM,oBAAoB,eAAe;AACzC,QAAM,iBAAiB,QAAQ;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,WAAS,QAAQ,GAAG,QAAQ,gBAAgB,SAAS,GAAG;AACtD,UAAM,MAAM,QAAQ,GAAG;AACvB,QAAI,MAAM,KAAK,MAAM,GAAG;AACtB,YAAM,IAAI,UAAU,8CAA8C;AAAA,IACpE;AACA,YAAQ,UAAU;AAClB,UAAM,UAAU,QAAQ,UAAU;AAClC,QAAI,YAAY,MAAM,UAAU,OAAO,wCAAwC,GAAG;AAChF,YAAM,IAAI,UAAU,iDAAiD;AAAA,IACvE;AAAA,EACF;AACA,UAAQ,KAAK,0CAA0C;AACvD,SAAO,OAAO,OAAO;AAAA,IACnB,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,SAAS,0BACP,OACA,sBAC6E;AAC7E,MAAI,MAAM,eAAe,4BAA4B;AACnD,UAAM,IAAI;AAAA,MACR,MAAM,aAAa,6BACf,mCACA;AAAA,IACN;AAAA,EACF;AACA,QAAM,SAAS,IAAI,qBAAqB,KAAK;AAC7C,MAAI,CAAC,WAAW,OAAO,MAAM,CAAC,GAAG,0BAA0B,GAAG;AAC5D,UAAM,IAAI,UAAU,oCAAoC;AAAA,EAC1D;AACA,MAAI,OAAO,IAAI,MAAM,8BAA8B;AACjD,UAAM,IAAI,UAAU,0CAA0C;AAAA,EAChE;AACA,MAAI,OAAO,IAAI,MAAM,GAAG;AACtB,UAAM,IAAI,UAAU,kDAAkD;AAAA,EACxE;AACA,QAAM,WAAW,OAAO,QAAQ,+BAA+B;AAC/D,QAAM,eAAe,OAAO,IAAI;AAChC,MAAI,iBAAiB,sBAAsB;AACzC,UAAM,IAAI,UAAU,8DAA8D;AAAA,EACpF;AACA,QAAM,WAAW,OAAO,UAAU;AAClC,SAAO,KAAK;AACZ,MACE,aACA,QAAQ,MAAM,SAAS,GAAG,MAAM,aAAa,uCAAuC,CAAC,GACrF;AACA,UAAM,IAAI,UAAU,8CAA8C;AAAA,EACpE;AACA,SAAO,OAAO,OAAO,EAAE,UAAU,gBAAgB,UAAU,aAAa,CAAC;AAC3E;AAEA,SAAS,oBAAoB,OAAwB;AACnD,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,UAAM,IAAI,UAAU,sDAAsD;AAAA,EAC5E;AACA,QAAM,aAAa,OAAO,yBAAyB,OAAO,UAAU;AACpE,MAAI,CAAC,cAAc,EAAE,WAAW,eAAe,CAAC,MAAM,QAAQ,WAAW,KAAK,GAAG;AAC/E,UAAM,IAAI,UAAU,sDAAsD;AAAA,EAC5E;AACA,SAAO,WAAW,MAAM;AAC1B;AAEA,SAAS,mBAAmB,OAAoD;AAC9E,MAAI,UAAU,cAAc,UAAU,gBAAgB;AACpD,UAAM,IAAI,UAAU,uCAAuC;AAAA,EAC7D;AACA,SAAO;AACT;AAEA,SAAS,kBAAkB,OAAgB,OAAuB;AAChE,MAAI,OAAO,UAAU,YAAY,CAAC,UAAU,KAAK,KAAK,KAAK,QAAQ,KAAK,KAAK,GAAG;AAC9E,UAAM,IAAI,UAAU,GAAG,KAAK,qDAAqD;AAAA,EACnF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAgB,OAAuB;AAC9D,MAAI,OAAO,UAAU,YAAY,CAAC,YAAY,KAAK,KAAK,GAAG;AACzD,UAAM,IAAI,UAAU,GAAG,KAAK,gCAAgC;AAAA,EAC9D;AACA,SAAO;AACT;AAEA,SAAS,aAAa,OAAgB,OAAuB;AAC3D,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,GAAG;AAC1E,UAAM,IAAI,UAAU,GAAG,KAAK,qCAAqC;AAAA,EACnE;AACA,SAAO;AACT;AAEA,SAAS,UAAU,OAA2B;AAC5C,QAAM,MAAM,MAAM,MAAM,UAAU,MAAM;AACxC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,WAAS,QAAQ,GAAG,QAAQ,MAAM,YAAY,SAAS,GAAG;AACxD,UAAM,KAAK,IAAI,OAAO,SAAS,IAAI,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,GAAG,EAAE;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAA2B;AAChD,SAAO,UAAU,WAAW,KAAK,CAAC;AACpC;AAEA,SAAS,oBAAoB,OAAgB,OAA4C;AACvF,MAAI,EAAE,iBAAiB,aAAa;AAClC,UAAM,IAAI,UAAU,GAAG,KAAK,6BAA6B;AAAA,EAC3D;AACA,MAAI,OAAO,sBAAsB,eAAe,MAAM,kBAAkB,mBAAmB;AACzF,UAAM,IAAI,UAAU,GAAG,KAAK,2CAA2C;AAAA,EACzE;AACF;","names":[]}

package/dist/chunk-O77VSFYZ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/workspace-integration-wire.ts"],"sourcesContent":["/**\n * Dependency-free wire constants and the OpenGeni-Signature scheme shared by\n * workspace webhooks and credential providers. Kept free of zod so browser and\n * React Native bundles can verify signatures without the schema runtime.\n */\n\nexport const WORKSPACE_WEBHOOK_EVENT_TYPES = [\n  \"turn.completed\",\n  \"turn.failed\",\n  \"turn.cancelled\",\n  \"session.status.changed\",\n  \"session.requiresAction\",\n  \"session.humanInput.requested\",\n  \"usage.threshold_reached\",\n  \"usage.exhausted\",\n  \"usage.period_reset\",\n] as const;\n\n/**\n * Sent only when an administrator presses \"Send test event\". It is never a\n * subscribable type: every endpoint can receive it, and a receiver that does\n * not care acknowledges it with any 2xx.\n */\nexport const OPENGENI_WEBHOOK_TEST_EVENT_TYPE = \"webhook.test\";\n\n/**\n * The session, turn and attempt ids of a credential-provider test request\n * (`purpose: \"test\"`). A test is not a run, so no real ids exist.\n */\nexport const OPENGENI_TEST_REQUEST_NIL_ID = \"00000000-0000-0000-0000-000000000000\";\n\nexport const OPENGENI_SIGNATURE_HEADER = \"OpenGeni-Signature\";\nexport const OPENGENI_EVENT_ID_HEADER = \"OpenGeni-Event-Id\";\nexport const OPENGENI_DELIVERY_ID_HEADER = \"OpenGeni-Delivery-Id\";\nexport const OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;\n\nconst encoder = new TextEncoder();\n\nasync function hmacSha256Hex(secret: string, message: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, encoder.encode(message)));\n  return Array.from(signature, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction constantTimeEqualHex(left: string, right: string): boolean {\n  if (left.length !== right.length) return false;\n  let difference = 0;\n  for (let index = 0; index < left.length; index += 1) {\n    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);\n  }\n  return difference === 0;\n}\n\n/**\n * `OpenGeni-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, \"<t>.<body>\")>`.\n * The timestamp is signed so a captured request cannot be replayed later.\n */\nexport async function signOpenGeniPayload(\n  secret: string,\n  body: string,\n  timestampSeconds = Math.floor(Date.now() / 1000),\n): Promise<string> {\n  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;\n}\n\nexport type VerifyOpenGeniSignatureInput = {\n  secret: string;\n  /** The exact raw request body, before JSON parsing. */\n  body: string;\n  /** The `OpenGeni-Signature` header value. */\n  signature: string | null | undefined;\n  toleranceSeconds?: number;\n  nowSeconds?: number;\n};\n\nexport async function verifyOpenGeniSignature(\n  input: VerifyOpenGeniSignatureInput,\n): Promise<boolean> {\n  if (!input.signature) return false;\n  let timestamp: number | null = null;\n  const candidates: string[] = [];\n  for (const part of input.signature.split(\",\")) {\n    const [key, value] = part.trim().split(\"=\", 2);\n    if (key === \"t\" && value && /^\\d{1,12}$/.test(value)) timestamp = Number(value);\n    if (key === \"v1\" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);\n  }\n  if (timestamp === null || candidates.length === 0) return false;\n  const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;\n  if (Math.abs(now - timestamp) > tolerance) return false;\n  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);\n  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));\n}\n"],"mappings":";AAMO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,mCAAmC;AAMzC,IAAM,+BAA+B;AAErC,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,8BAA8B;AACpC,IAAM,uCAAuC;AAEpD,IAAM,UAAU,IAAI,YAAY;AAEhC,eAAe,cAAc,QAAgB,SAAkC;AAC7E,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,OAAO,CAAC,CAAC;AAC/F,SAAO,MAAM,KAAK,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACpF;AAEA,SAAS,qBAAqB,MAAc,OAAwB;AAClE,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,kBAAc,KAAK,WAAW,KAAK,IAAI,MAAM,WAAW,KAAK;AAAA,EAC/D;AACA,SAAO,eAAe;AACxB;AAMA,eAAsB,oBACpB,QACA,MACA,mBAAmB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC9B;AACjB,SAAO,KAAK,gBAAgB,OAAO,MAAM,cAAc,QAAQ,GAAG,gBAAgB,IAAI,IAAI,EAAE,CAAC;AAC/F;AAYA,eAAsB,wBACpB,OACkB;AAClB,MAAI,CAAC,MAAM,UAAW,QAAO;AAC7B,MAAI,YAA2B;AAC/B,QAAM,aAAuB,CAAC;AAC9B,aAAW,QAAQ,MAAM,UAAU,MAAM,GAAG,GAAG;AAC7C,UAAM,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,EAAE,MAAM,KAAK,CAAC;AAC7C,QAAI,QAAQ,OAAO,SAAS,aAAa,KAAK,KAAK,EAAG,aAAY,OAAO,KAAK;AAC9E,QAAI,QAAQ,QAAQ,SAAS,iBAAiB,KAAK,KAAK,EAAG,YAAW,KAAK,KAAK;AAAA,EAClF;AACA,MAAI,cAAc,QAAQ,WAAW,WAAW,EAAG,QAAO;AAC1D,QAAM,MAAM,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC5D,QAAM,YAAY,MAAM,oBAAoB;AAC5C,MAAI,KAAK,IAAI,MAAM,SAAS,IAAI,UAAW,QAAO;AAClD,QAAM,WAAW,MAAM,cAAc,MAAM,QAAQ,GAAG,SAAS,IAAI,MAAM,IAAI,EAAE;AAC/E,SAAO,WAAW,KAAK,CAAC,cAAc,qBAAqB,WAAW,QAAQ,CAAC;AACjF;","names":[]}

package/dist/chunk-P3HLDT77.js

@@ -1,59 +0,0 @@
-// src/permissions.ts
-import { z } from "zod";
-var Permission = z.enum([
-  "account:read",
-  "account:admin",
-  "members:manage",
-  "workspace:create",
-  "billing:read",
-  "billing:manage",
-  "workspace:read",
-  "workspace:admin",
-  "sessions:create",
-  "sessions:read",
-  "sessions:control",
-  "stream:view",
-  "stream:control",
-  "stream:acknowledge",
-  "files:upload",
-  "files:read",
-  "files:write",
-  "terminal:attach",
-  "documents:manage",
-  "documents:search",
-  "scheduled_tasks:manage",
-  "scheduled_tasks:run",
-  "github:manage",
-  "github:use",
-  "api_keys:manage",
-  "connections:read",
-  "connections:write",
-  "capabilities:manage",
-  /** @deprecated alias of variable-sets:manage */
-  "environments:manage",
-  /** @deprecated alias of variable-sets:use */
-  "environments:use",
-  "variable-sets:list",
-  "variable-sets:read",
-  "variable-sets:write",
-  "variable-sets:manage",
-  "variable-sets:attach",
-  "variable-sets:use",
-  "secrets:list",
-  "secrets:read",
-  "secrets:write",
-  "mcp_servers:attach",
-  "codemode:call",
-  "goals:manage",
-  "enrollments:read",
-  "enrollments:manage",
-  "rigs:use",
-  "rigs:manage",
-  "artifacts:read",
-  "artifacts:publish"
-]);
-
-export {
-  Permission
-};
-//# sourceMappingURL=chunk-P3HLDT77.js.map

package/dist/chunk-P3HLDT77.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/permissions.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/** Canonical public permission vocabulary shared by operational and control-plane contracts. */\nexport const Permission = z.enum([\n  \"account:read\",\n  \"account:admin\",\n  \"members:manage\",\n  \"workspace:create\",\n  \"billing:read\",\n  \"billing:manage\",\n  \"workspace:read\",\n  \"workspace:admin\",\n  \"sessions:create\",\n  \"sessions:read\",\n  \"sessions:control\",\n  \"stream:view\",\n  \"stream:control\",\n  \"stream:acknowledge\",\n  \"files:upload\",\n  \"files:read\",\n  \"files:write\",\n  \"terminal:attach\",\n  \"documents:manage\",\n  \"documents:search\",\n  \"scheduled_tasks:manage\",\n  \"scheduled_tasks:run\",\n  \"github:manage\",\n  \"github:use\",\n  \"api_keys:manage\",\n  \"connections:read\",\n  \"connections:write\",\n  \"capabilities:manage\",\n  /** @deprecated alias of variable-sets:manage */\n  \"environments:manage\",\n  /** @deprecated alias of variable-sets:use */\n  \"environments:use\",\n  \"variable-sets:list\",\n  \"variable-sets:read\",\n  \"variable-sets:write\",\n  \"variable-sets:manage\",\n  \"variable-sets:attach\",\n  \"variable-sets:use\",\n  \"secrets:list\",\n  \"secrets:read\",\n  \"secrets:write\",\n  \"mcp_servers:attach\",\n  \"codemode:call\",\n  \"goals:manage\",\n  \"enrollments:read\",\n  \"enrollments:manage\",\n  \"rigs:use\",\n  \"rigs:manage\",\n  \"artifacts:read\",\n  \"artifacts:publish\",\n]);\nexport type Permission = z.infer<typeof Permission>;\n"],"mappings":";AAAA,SAAS,SAAS;AAGX,IAAM,aAAa,EAAE,KAAK;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":[]}