@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/personal-github.js

@@ -1,32 +1,66 @@
 import {
   ConnectionMetadata
-} from "./chunk-566IFOVP.js";
+} from "./chunk-L4GUEP7K.js";
+import "./chunk-XB6GQLBH.js";
+import "./chunk-WMGO4HJU.js";
 import "./chunk-4JGHSSB7.js";
-import "./chunk-5IXYF6XN.js";
-import "./chunk-HHZSZYYF.js";
-import "./chunk-NRMCVHAU.js";
-import "./chunk-WYBDERIY.js";
-import "./chunk-P3HLDT77.js";
-import "./chunk-5Q54VCCH.js";
-import "./chunk-EK7NDGFR.js";
+import "./chunk-A3LXWVYU.js";
+import "./chunk-2QKIEAGY.js";
+import "./chunk-RLJUNVAM.js";
+import "./chunk-RWEEUDHD.js";
+import "./chunk-MYHMB6GZ.js";
+import "./chunk-6LAT33BH.js";
+import "./chunk-2ZIHHL72.js";
+import "./chunk-32U6NKQQ.js";
+import "./chunk-JOTHDW4H.js";
+import "./chunk-SHO4YO4B.js";
+import "./chunk-W2QQ5Y6K.js";
+import "./chunk-T3HSWMA5.js";
 import "./chunk-KHHZTBP7.js";
-import "./chunk-O77VSFYZ.js";
 import "./chunk-NVJMJWLL.js";
-import "./chunk-SIOU2K4U.js";
-import "./chunk-YRKRZ6OF.js";
-import "./chunk-YBW5JSA3.js";
-import "./chunk-3SIZGL3O.js";
-import "./chunk-RIY7GYQS.js";
-import "./chunk-JUFK3T4Q.js";
-import "./chunk-GRG7PHWQ.js";
-import "./chunk-YRXAWWCU.js";
-import "./chunk-BCS7WHCK.js";
-import "./chunk-D2HKF2EF.js";
-import "./chunk-MYBZRDTY.js";
+import "./chunk-TOOJIBJC.js";
+import "./chunk-LJH2EYGT.js";
+import "./chunk-ZMPU5BWE.js";
+import "./chunk-H6UJJIUM.js";
+import "./chunk-5RWB6QVL.js";
+import "./chunk-4YDDHSO2.js";
+import "./chunk-UH4K7GP7.js";
+import "./chunk-2WOWEWXV.js";
+import "./chunk-UCUOTRS6.js";
+import "./chunk-PTSROVDG.js";
+import "./chunk-UIZWGPHV.js";
+import "./chunk-VLUKBV6Y.js";
+import "./chunk-BMUTAZX5.js";
+import "./chunk-G4RKARXZ.js";
+import "./chunk-BHCEVVUP.js";
+import "./chunk-DGG6IBBK.js";
+import "./chunk-7EQGGZBY.js";
+import "./chunk-72QC2GTL.js";
+import "./chunk-W3NBPR4E.js";
+import "./chunk-FBCTUMHI.js";
+import "./chunk-S7MSQQL6.js";
+import "./chunk-G2KJTFIC.js";
+import "./chunk-ZYVEJFNU.js";
+import "./chunk-RUQ4I6DO.js";
+import "./chunk-WVCFSOUZ.js";
+import "./chunk-MTJKSIGA.js";
+import {
+  boolean,
+  nonnegativeInteger,
+  optionalUuid,
+  positiveInteger,
+  string,
+  uuid
+} from "./chunk-AQYDZUJV.js";
+import "./chunk-XP5M3IKT.js";
+import "./chunk-WQI7VNN4.js";
+import "./chunk-PUIUXIOL.js";
 import "./chunk-RKX3NQYS.js";
-import "./chunk-Y3KNXVTD.js";
-import "./chunk-TXTQIYCV.js";
-import "./chunk-PX3VCKAU.js";
+import "./chunk-7272KVWZ.js";
+import "./chunk-PI5VIKJY.js";
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
 
 // src/personal-github.ts
 import { z } from "zod";
@@ -40,142 +74,180 @@ var PERSONAL_GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
 var PERSONAL_GITHUB_USER_URL = "https://api.github.com/user";
 var PERSONAL_GITHUB_API_ORIGIN = "https://api.github.com";
 var PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX = 100;
-var PersonalGitHubRepositoryId = z.string().regex(/^[1-9]\d*$/u);
-var PersonalGitHubRepositoryAccess = z.enum(["read", "write"]);
-var PersonalGitHubRepositoryPermissions = z.object({
-  pull: z.boolean(),
-  push: z.boolean(),
-  admin: z.boolean(),
-  maintain: z.boolean(),
-  triage: z.boolean()
-}).strict();
-var PersonalGitHubRepositoryVisibility = z.enum(["public", "private", "internal"]);
-var PersonalGitHubRepositoryFullName = z.string().min(3).max(140).regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9_.-]{1,100}$/u);
+var PersonalGitHubRepositoryId = /* @__PURE__ */ defineSchema(
+  () => string.regex(/^[1-9]\d*$/u)
+);
+var PersonalGitHubRepositoryAccess = /* @__PURE__ */ defineSchema(
+  () => z.enum(["read", "write"])
+);
+var PersonalGitHubRepositoryPermissions = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    pull: boolean,
+    push: boolean,
+    admin: boolean,
+    maintain: boolean,
+    triage: boolean
+  }).strict()
+);
+var PersonalGitHubRepositoryVisibility = /* @__PURE__ */ defineSchema(
+  () => z.enum(["public", "private", "internal"])
+);
+var PersonalGitHubRepositoryFullName = /* @__PURE__ */ defineSchema(
+  () => z.string().min(3).max(140).regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\/[A-Za-z0-9_.-]{1,100}$/u)
+);
 function canonicalPersonalGitHubRepositoryUrl(fullName) {
   return `https://github.com/${fullName}`;
 }
-var PersonalGitHubRepository = z.object({
-  repositoryId: PersonalGitHubRepositoryId,
-  fullName: PersonalGitHubRepositoryFullName,
-  canonicalUrl: z.string().url().max(512),
-  defaultBranch: z.string().min(1).max(255),
-  visibility: PersonalGitHubRepositoryVisibility,
-  private: z.boolean(),
-  archived: z.boolean(),
-  disabled: z.boolean(),
-  permissions: PersonalGitHubRepositoryPermissions
-}).strict().superRefine((repository, context) => {
-  if (repository.canonicalUrl !== canonicalPersonalGitHubRepositoryUrl(repository.fullName)) {
-    context.addIssue({
-      code: "custom",
-      path: ["canonicalUrl"],
-      message: "canonicalUrl must be derived from fullName"
-    });
-  }
-  if (repository.private !== (repository.visibility === "private")) {
-    context.addIssue({
-      code: "custom",
-      path: ["private"],
-      message: "private must agree with visibility"
-    });
-  }
-});
-var PersonalGitHubSelectedRepository = PersonalGitHubRepository.safeExtend({
-  selectedAccess: PersonalGitHubRepositoryAccess,
-  selectionGeneration: z.number().int().positive(),
-  selectedAt: z.string().datetime({ offset: true }),
-  lastVerifiedAt: z.string().datetime({ offset: true })
-}).strict();
-var PersonalGitHubRepositorySelectionState = z.object({
-  connectionAuthorityGeneration: z.number().int().positive(),
-  credentialBindingId: z.string().uuid(),
-  providerPrincipalId: PersonalGitHubRepositoryId,
-  selectionGeneration: z.number().int().nonnegative(),
-  repositories: z.array(PersonalGitHubSelectedRepository).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX)
-}).strict();
-var ListPersonalGitHubRepositoriesQuery = z.object({
-  cursor: z.coerce.number().int().positive().max(1e4).default(1),
-  limit: z.coerce.number().int().min(1).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX).default(50)
-}).strict();
-var PersonalGitHubRepositoryCatalogItem = PersonalGitHubRepository.safeExtend({
-  selectedAccess: PersonalGitHubRepositoryAccess.nullable()
-}).strict();
-var ListPersonalGitHubRepositoriesResponse = z.object({
-  repositories: z.array(PersonalGitHubRepositoryCatalogItem).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),
-  nextCursor: z.number().int().positive().nullable(),
-  selection: PersonalGitHubRepositorySelectionState
-}).strict();
-var PersonalGitHubRepositorySelectionInput = z.object({
-  repositoryId: PersonalGitHubRepositoryId,
-  fullName: PersonalGitHubRepositoryFullName,
-  access: PersonalGitHubRepositoryAccess
-}).strict();
-var ReplacePersonalGitHubRepositorySelectionsRequest = z.object({
-  expectedConnectionAuthorityGeneration: z.number().int().positive(),
-  expectedSelectionGeneration: z.number().int().nonnegative(),
-  idempotencyKey: z.string().trim().min(1).max(200),
-  repositories: z.array(PersonalGitHubRepositorySelectionInput).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX)
-}).strict().superRefine((request, context) => {
-  const repositoryIds = /* @__PURE__ */ new Set();
-  const fullNames = /* @__PURE__ */ new Set();
-  request.repositories.forEach((repository, index) => {
-    const normalizedFullName = repository.fullName.toLowerCase();
-    if (repositoryIds.has(repository.repositoryId)) {
+var PersonalGitHubRepository = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    repositoryId: PersonalGitHubRepositoryId,
+    fullName: PersonalGitHubRepositoryFullName,
+    canonicalUrl: z.string().url().max(512),
+    defaultBranch: z.string().min(1).max(255),
+    visibility: PersonalGitHubRepositoryVisibility,
+    private: boolean,
+    archived: boolean,
+    disabled: boolean,
+    permissions: PersonalGitHubRepositoryPermissions
+  }).strict().superRefine((repository, context) => {
+    if (repository.canonicalUrl !== canonicalPersonalGitHubRepositoryUrl(repository.fullName)) {
       context.addIssue({
         code: "custom",
-        path: ["repositories", index, "repositoryId"],
-        message: "repositoryId must be unique"
+        path: ["canonicalUrl"],
+        message: "canonicalUrl must be derived from fullName"
       });
     }
-    if (fullNames.has(normalizedFullName)) {
+    if (repository.private !== (repository.visibility === "private")) {
       context.addIssue({
         code: "custom",
-        path: ["repositories", index, "fullName"],
-        message: "fullName must be unique"
+        path: ["private"],
+        message: "private must agree with visibility"
       });
     }
-    repositoryIds.add(repository.repositoryId);
-    fullNames.add(normalizedFullName);
-  });
-});
-var VerifyPersonalGitHubRepositorySelectionsRequest = z.object({
-  expectedConnectionAuthorityGeneration: z.number().int().positive(),
-  expectedSelectionGeneration: z.number().int().nonnegative(),
-  idempotencyKey: z.string().trim().min(1).max(200)
-}).strict();
-var PersonalGitHubConnectionMetadata = z.object({
-  credentialRole: z.literal(PERSONAL_GITHUB_CREDENTIAL_ROLE),
-  providerFamily: z.literal(PERSONAL_GITHUB_PROVIDER_FAMILY),
-  providerPrincipalId: z.string().regex(/^\d+$/u),
-  githubUserId: z.string().regex(/^\d+$/u),
-  githubLogin: z.string().min(1).max(100),
-  oauthEnvironment: z.string().min(1).max(128),
-  oauthClientMarker: z.string().regex(/^[a-f0-9]{32}$/u),
-  credentialBindingId: z.string().uuid(),
-  connectedAt: z.string().datetime({ offset: true }),
-  lastVerifiedAt: z.string().datetime({ offset: true }),
-  disconnectedAt: z.string().datetime({ offset: true }).nullable().optional(),
-  refreshTokenExpiresAt: z.string().datetime({ offset: true }).nullable().optional()
-}).passthrough();
-var PersonalGitHubOAuthStartRequest = z.object({
-  /** Existing exact connection generation to re-authorize in place. */
-  connectionId: z.string().uuid().optional(),
-  /** Same-workspace UI path restored after the callback. */
-  returnPath: z.string().min(1).max(2048).optional()
-}).strict();
-var PersonalGitHubOAuthStartResponse = z.object({
-  authorizationUrl: z.string().url(),
-  expiresAt: z.string().datetime({ offset: true })
-}).strict();
-var PersonalGitHubConnectionStatusResponse = z.object({
-  enabled: z.boolean(),
-  connection: ConnectionMetadata.nullable(),
-  reviewUrl: z.string().url().nullable()
-}).strict();
-var PersonalGitHubDisconnectRequest = z.object({
-  expectedVersion: z.number().int().positive(),
-  idempotencyKey: z.string().trim().min(1).max(200)
-}).strict();
+  })
+);
+var PersonalGitHubSelectedRepository = /* @__PURE__ */ defineSchema(
+  () => PersonalGitHubRepository.safeExtend({
+    selectedAccess: PersonalGitHubRepositoryAccess,
+    selectionGeneration: positiveInteger,
+    selectedAt: string.datetime({ offset: true }),
+    lastVerifiedAt: string.datetime({ offset: true })
+  }).strict()
+);
+var PersonalGitHubRepositorySelectionState = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    connectionAuthorityGeneration: positiveInteger,
+    credentialBindingId: uuid,
+    providerPrincipalId: PersonalGitHubRepositoryId,
+    selectionGeneration: nonnegativeInteger,
+    repositories: z.array(PersonalGitHubSelectedRepository).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX)
+  }).strict()
+);
+var ListPersonalGitHubRepositoriesQuery = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    cursor: z.coerce.number().int().positive().max(1e4).default(1),
+    limit: z.coerce.number().int().min(1).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX).default(50)
+  }).strict()
+);
+var PersonalGitHubRepositoryCatalogItem = /* @__PURE__ */ defineSchema(
+  () => PersonalGitHubRepository.safeExtend({
+    selectedAccess: PersonalGitHubRepositoryAccess.nullable()
+  }).strict()
+);
+var ListPersonalGitHubRepositoriesResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    repositories: z.array(PersonalGitHubRepositoryCatalogItem).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),
+    nextCursor: z.number().int().positive().nullable(),
+    selection: PersonalGitHubRepositorySelectionState
+  }).strict()
+);
+var PersonalGitHubRepositorySelectionInput = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    repositoryId: PersonalGitHubRepositoryId,
+    fullName: PersonalGitHubRepositoryFullName,
+    access: PersonalGitHubRepositoryAccess
+  }).strict()
+);
+var ReplacePersonalGitHubRepositorySelectionsRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    expectedConnectionAuthorityGeneration: positiveInteger,
+    expectedSelectionGeneration: nonnegativeInteger,
+    idempotencyKey: string.trim().min(1).max(200),
+    repositories: z.array(PersonalGitHubRepositorySelectionInput).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX)
+  }).strict().superRefine((request, context) => {
+    const repositoryIds = /* @__PURE__ */ new Set();
+    const fullNames = /* @__PURE__ */ new Set();
+    request.repositories.forEach((repository, index) => {
+      const normalizedFullName = repository.fullName.toLowerCase();
+      if (repositoryIds.has(repository.repositoryId)) {
+        context.addIssue({
+          code: "custom",
+          path: ["repositories", index, "repositoryId"],
+          message: "repositoryId must be unique"
+        });
+      }
+      if (fullNames.has(normalizedFullName)) {
+        context.addIssue({
+          code: "custom",
+          path: ["repositories", index, "fullName"],
+          message: "fullName must be unique"
+        });
+      }
+      repositoryIds.add(repository.repositoryId);
+      fullNames.add(normalizedFullName);
+    });
+  })
+);
+var VerifyPersonalGitHubRepositorySelectionsRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    expectedConnectionAuthorityGeneration: positiveInteger,
+    expectedSelectionGeneration: nonnegativeInteger,
+    idempotencyKey: string.trim().min(1).max(200)
+  }).strict()
+);
+var PersonalGitHubConnectionMetadata = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    credentialRole: z.literal(PERSONAL_GITHUB_CREDENTIAL_ROLE),
+    providerFamily: z.literal(PERSONAL_GITHUB_PROVIDER_FAMILY),
+    providerPrincipalId: string.regex(/^\d+$/u),
+    githubUserId: string.regex(/^\d+$/u),
+    githubLogin: z.string().min(1).max(100),
+    oauthEnvironment: z.string().min(1).max(128),
+    oauthClientMarker: string.regex(/^[a-f0-9]{32}$/u),
+    credentialBindingId: uuid,
+    connectedAt: string.datetime({ offset: true }),
+    lastVerifiedAt: string.datetime({ offset: true }),
+    disconnectedAt: string.datetime({ offset: true }).nullable().optional(),
+    refreshTokenExpiresAt: string.datetime({ offset: true }).nullable().optional()
+  }).passthrough()
+);
+var PersonalGitHubOAuthStartRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    /** Existing exact connection generation to re-authorize in place. */
+    connectionId: optionalUuid,
+    /** Same-workspace UI path restored after the callback. */
+    returnPath: z.string().min(1).max(2048).optional()
+  }).strict()
+);
+var PersonalGitHubOAuthStartResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    authorizationUrl: z.string().url(),
+    expiresAt: string.datetime({ offset: true })
+  }).strict()
+);
+var PersonalGitHubConnectionStatusResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    enabled: boolean,
+    connection: ConnectionMetadata.nullable(),
+    reviewUrl: z.string().url().nullable()
+  }).strict()
+);
+var PersonalGitHubDisconnectRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    expectedVersion: positiveInteger,
+    idempotencyKey: string.trim().min(1).max(200)
+  }).strict()
+);
 function isPersonalGitHubConnection(connection) {
   return connection.providerDomain.toLowerCase() === PERSONAL_GITHUB_PROVIDER_DOMAIN && connection.kind === "oauth2" && PersonalGitHubConnectionMetadata.safeParse(connection.metadata).success;
 }

package/dist/personal-github.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/personal-github.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\n\nexport const PERSONAL_GITHUB_PROVIDER_DOMAIN = \"github.com\" as const;\nexport const PERSONAL_GITHUB_PROVIDER_FAMILY = \"github\" as const;\nexport const PERSONAL_GITHUB_CREDENTIAL_ROLE = \"opengeni_github_personal\" as const;\nexport const PERSONAL_GITHUB_CONNECTION_SURFACE_ID = \"github:personal\" as const;\nexport const PERSONAL_GITHUB_REQUESTED_SCOPES = [\"repo\"] as const;\nexport const PERSONAL_GITHUB_AUTHORIZATION_URL =\n  \"https://github.com/login/oauth/authorize\" as const;\nexport const PERSONAL_GITHUB_TOKEN_URL = \"https://github.com/login/oauth/access_token\" as const;\nexport const PERSONAL_GITHUB_USER_URL = \"https://api.github.com/user\" as const;\nexport const PERSONAL_GITHUB_API_ORIGIN = \"https://api.github.com\" as const;\nexport const PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX = 100 as const;\n\nexport const PersonalGitHubRepositoryId = z.string().regex(/^[1-9]\\d*$/u);\nexport type PersonalGitHubRepositoryId = z.infer<typeof PersonalGitHubRepositoryId>;\n\nexport const PersonalGitHubRepositoryAccess = z.enum([\"read\", \"write\"]);\nexport type PersonalGitHubRepositoryAccess = z.infer<typeof PersonalGitHubRepositoryAccess>;\n\nexport const PersonalGitHubRepositoryPermissions = z\n  .object({\n    pull: z.boolean(),\n    push: z.boolean(),\n    admin: z.boolean(),\n    maintain: z.boolean(),\n    triage: z.boolean(),\n  })\n  .strict();\nexport type PersonalGitHubRepositoryPermissions = z.infer<\n  typeof PersonalGitHubRepositoryPermissions\n>;\n\nexport const PersonalGitHubRepositoryVisibility = z.enum([\"public\", \"private\", \"internal\"]);\nexport type PersonalGitHubRepositoryVisibility = z.infer<typeof PersonalGitHubRepositoryVisibility>;\n\nconst PersonalGitHubRepositoryFullName = z\n  .string()\n  .min(3)\n  .max(140)\n  .regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\\/[A-Za-z0-9_.-]{1,100}$/u);\n\nexport function canonicalPersonalGitHubRepositoryUrl(fullName: string): string {\n  return `https://github.com/${fullName}`;\n}\n\n/** A bounded, credential-free projection verified directly against GitHub. */\nexport const PersonalGitHubRepository = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    canonicalUrl: z.string().url().max(512),\n    defaultBranch: z.string().min(1).max(255),\n    visibility: PersonalGitHubRepositoryVisibility,\n    private: z.boolean(),\n    archived: z.boolean(),\n    disabled: z.boolean(),\n    permissions: PersonalGitHubRepositoryPermissions,\n  })\n  .strict()\n  .superRefine((repository, context) => {\n    if (repository.canonicalUrl !== canonicalPersonalGitHubRepositoryUrl(repository.fullName)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"canonicalUrl\"],\n        message: \"canonicalUrl must be derived from fullName\",\n      });\n    }\n    if (repository.private !== (repository.visibility === \"private\")) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"private\"],\n        message: \"private must agree with visibility\",\n      });\n    }\n  });\nexport type PersonalGitHubRepository = z.infer<typeof PersonalGitHubRepository>;\n\nexport const PersonalGitHubSelectedRepository = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess,\n  selectionGeneration: z.number().int().positive(),\n  selectedAt: z.string().datetime({ offset: true }),\n  lastVerifiedAt: z.string().datetime({ offset: true }),\n}).strict();\nexport type PersonalGitHubSelectedRepository = z.infer<typeof PersonalGitHubSelectedRepository>;\n\nexport const PersonalGitHubRepositorySelectionState = z\n  .object({\n    connectionAuthorityGeneration: z.number().int().positive(),\n    credentialBindingId: z.string().uuid(),\n    providerPrincipalId: PersonalGitHubRepositoryId,\n    selectionGeneration: z.number().int().nonnegative(),\n    repositories: z\n      .array(PersonalGitHubSelectedRepository)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionState = z.infer<\n  typeof PersonalGitHubRepositorySelectionState\n>;\n\nexport const ListPersonalGitHubRepositoriesQuery = z\n  .object({\n    cursor: z.coerce.number().int().positive().max(10_000).default(1),\n    limit: z.coerce.number().int().min(1).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX).default(50),\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesQuery = z.infer<\n  typeof ListPersonalGitHubRepositoriesQuery\n>;\n\nexport const PersonalGitHubRepositoryCatalogItem = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess.nullable(),\n}).strict();\nexport type PersonalGitHubRepositoryCatalogItem = z.infer<\n  typeof PersonalGitHubRepositoryCatalogItem\n>;\n\nexport const ListPersonalGitHubRepositoriesResponse = z\n  .object({\n    repositories: z\n      .array(PersonalGitHubRepositoryCatalogItem)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n    nextCursor: z.number().int().positive().nullable(),\n    selection: PersonalGitHubRepositorySelectionState,\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesResponse = z.infer<\n  typeof ListPersonalGitHubRepositoriesResponse\n>;\n\nexport const PersonalGitHubRepositorySelectionInput = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    access: PersonalGitHubRepositoryAccess,\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionInput = z.infer<\n  typeof PersonalGitHubRepositorySelectionInput\n>;\n\nexport const ReplacePersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n    repositories: z\n      .array(PersonalGitHubRepositorySelectionInput)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict()\n  .superRefine((request, context) => {\n    const repositoryIds = new Set<string>();\n    const fullNames = new Set<string>();\n    request.repositories.forEach((repository, index) => {\n      const normalizedFullName = repository.fullName.toLowerCase();\n      if (repositoryIds.has(repository.repositoryId)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"repositoryId\"],\n          message: \"repositoryId must be unique\",\n        });\n      }\n      if (fullNames.has(normalizedFullName)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"fullName\"],\n          message: \"fullName must be unique\",\n        });\n      }\n      repositoryIds.add(repository.repositoryId);\n      fullNames.add(normalizedFullName);\n    });\n  });\nexport type ReplacePersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof ReplacePersonalGitHubRepositorySelectionsRequest\n>;\n\nexport const VerifyPersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type VerifyPersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof VerifyPersonalGitHubRepositorySelectionsRequest\n>;\n\n/**\n * Owner-visible, credential-free metadata for one dedicated personal GitHub\n * OAuth connection. Repository selections are a separate authority and never\n * live in this credential record.\n */\nexport const PersonalGitHubConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(PERSONAL_GITHUB_CREDENTIAL_ROLE),\n    providerFamily: z.literal(PERSONAL_GITHUB_PROVIDER_FAMILY),\n    providerPrincipalId: z.string().regex(/^\\d+$/u),\n    githubUserId: z.string().regex(/^\\d+$/u),\n    githubLogin: z.string().min(1).max(100),\n    oauthEnvironment: z.string().min(1).max(128),\n    oauthClientMarker: z.string().regex(/^[a-f0-9]{32}$/u),\n    credentialBindingId: z.string().uuid(),\n    connectedAt: z.string().datetime({ offset: true }),\n    lastVerifiedAt: z.string().datetime({ offset: true }),\n    disconnectedAt: z.string().datetime({ offset: true }).nullable().optional(),\n    refreshTokenExpiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  })\n  .passthrough();\nexport type PersonalGitHubConnectionMetadata = z.infer<typeof PersonalGitHubConnectionMetadata>;\n\nexport const PersonalGitHubOAuthStartRequest = z\n  .object({\n    /** Existing exact connection generation to re-authorize in place. */\n    connectionId: z.string().uuid().optional(),\n    /** Same-workspace UI path restored after the callback. */\n    returnPath: z.string().min(1).max(2048).optional(),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartRequest = z.infer<typeof PersonalGitHubOAuthStartRequest>;\n\nexport const PersonalGitHubOAuthStartResponse = z\n  .object({\n    authorizationUrl: z.string().url(),\n    expiresAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartResponse = z.infer<typeof PersonalGitHubOAuthStartResponse>;\n\nexport const PersonalGitHubConnectionStatusResponse = z\n  .object({\n    enabled: z.boolean(),\n    connection: ConnectionMetadata.nullable(),\n    reviewUrl: z.string().url().nullable(),\n  })\n  .strict();\nexport type PersonalGitHubConnectionStatusResponse = z.infer<\n  typeof PersonalGitHubConnectionStatusResponse\n>;\n\nexport const PersonalGitHubDisconnectRequest = z\n  .object({\n    expectedVersion: z.number().int().positive(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type PersonalGitHubDisconnectRequest = z.infer<typeof PersonalGitHubDisconnectRequest>;\n\nexport function isPersonalGitHubConnection(\n  connection: Pick<z.infer<typeof ConnectionMetadata>, \"providerDomain\" | \"kind\" | \"metadata\">,\n): boolean {\n  return (\n    connection.providerDomain.toLowerCase() === PERSONAL_GITHUB_PROVIDER_DOMAIN &&\n    connection.kind === \"oauth2\" &&\n    PersonalGitHubConnectionMetadata.safeParse(connection.metadata).success\n  );\n}\n\nexport function hasReservedPersonalGitHubMetadata(\n  metadata: Record<string, unknown> | undefined,\n): boolean {\n  return metadata?.credentialRole === PERSONAL_GITHUB_CREDENTIAL_ROLE;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAIX,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,wCAAwC;AAC9C,IAAM,mCAAmC,CAAC,MAAM;AAChD,IAAM,oCACX;AACK,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,OAAO,EAAE,MAAM,aAAa;AAGjE,IAAM,iCAAiC,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAG/D,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,MAAM,EAAE,QAAQ;AAAA,EAChB,MAAM,EAAE,QAAQ;AAAA,EAChB,OAAO,EAAE,QAAQ;AAAA,EACjB,UAAU,EAAE,QAAQ;AAAA,EACpB,QAAQ,EAAE,QAAQ;AACpB,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK,CAAC,UAAU,WAAW,UAAU,CAAC;AAG1F,IAAM,mCAAmC,EACtC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,6DAA6D;AAE/D,SAAS,qCAAqC,UAA0B;AAC7E,SAAO,sBAAsB,QAAQ;AACvC;AAGO,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,YAAY;AAAA,EACZ,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,UAAU,EAAE,QAAQ;AAAA,EACpB,aAAa;AACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,YAAY,YAAY;AACpC,MAAI,WAAW,iBAAiB,qCAAqC,WAAW,QAAQ,GAAG;AACzF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,WAAW,aAAa,WAAW,eAAe,YAAY;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,mCAAmC,yBAAyB,WAAW;AAAA,EAClF,gBAAgB;AAAA,EAChB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACtD,CAAC,EAAE,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,qBAAqB;AAAA,EACrB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClD,cAAc,EACX,MAAM,gCAAgC,EACtC,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,CAAC;AAAA,EAChE,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,sCAAsC,EAAE,QAAQ,EAAE;AAC9F,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,yBAAyB,WAAW;AAAA,EACrF,gBAAgB,+BAA+B,SAAS;AAC1D,CAAC,EAAE,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc,EACX,MAAM,mCAAmC,EACzC,IAAI,sCAAsC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,WAAW;AACb,CAAC,EACA,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,QAAQ;AACV,CAAC,EACA,OAAO;AAKH,IAAM,mDAAmD,EAC7D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChD,cAAc,EACX,MAAM,sCAAsC,EAC5C,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,YAAY;AACjC,QAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAM,YAAY,oBAAI,IAAY;AAClC,UAAQ,aAAa,QAAQ,CAAC,YAAY,UAAU;AAClD,UAAM,qBAAqB,WAAW,SAAS,YAAY;AAC3D,QAAI,cAAc,IAAI,WAAW,YAAY,GAAG;AAC9C,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,cAAc;AAAA,QAC5C,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI,kBAAkB,GAAG;AACrC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,QACxC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,kBAAc,IAAI,WAAW,YAAY;AACzC,cAAU,IAAI,kBAAkB;AAAA,EAClC,CAAC;AACH,CAAC;AAKI,IAAM,kDAAkD,EAC5D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAUH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EAC9C,cAAc,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACrD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACpD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1E,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AACnF,CAAC,EACA,YAAY;AAGR,IAAM,kCAAkC,EAC5C,OAAO;AAAA;AAAA,EAEN,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AACnD,CAAC,EACA,OAAO;AAGH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC,EACA,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ;AAAA,EACnB,YAAY,mBAAmB,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAKH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,SAAS,2BACd,YACS;AACT,SACE,WAAW,eAAe,YAAY,MAAM,mCAC5C,WAAW,SAAS,YACpB,iCAAiC,UAAU,WAAW,QAAQ,EAAE;AAEpE;AAEO,SAAS,kCACd,UACS;AACT,SAAO,UAAU,mBAAmB;AACtC;","names":[]}
+{"version":3,"sources":["../src/personal-github.ts"],"sourcesContent":["import * as primitives from \"./primitives\";\nimport { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\n\nexport const PERSONAL_GITHUB_PROVIDER_DOMAIN = \"github.com\" as const;\nexport const PERSONAL_GITHUB_PROVIDER_FAMILY = \"github\" as const;\nexport const PERSONAL_GITHUB_CREDENTIAL_ROLE = \"opengeni_github_personal\" as const;\nexport const PERSONAL_GITHUB_CONNECTION_SURFACE_ID = \"github:personal\" as const;\nexport const PERSONAL_GITHUB_REQUESTED_SCOPES = [\"repo\"] as const;\nexport const PERSONAL_GITHUB_AUTHORIZATION_URL =\n  \"https://github.com/login/oauth/authorize\" as const;\nexport const PERSONAL_GITHUB_TOKEN_URL = \"https://github.com/login/oauth/access_token\" as const;\nexport const PERSONAL_GITHUB_USER_URL = \"https://api.github.com/user\" as const;\nexport const PERSONAL_GITHUB_API_ORIGIN = \"https://api.github.com\" as const;\nexport const PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX = 100 as const;\n\nexport const PersonalGitHubRepositoryId = /* @__PURE__ */ defineSchema(() =>\n  primitives.string.regex(/^[1-9]\\d*$/u),\n);\nexport type PersonalGitHubRepositoryId = z.infer<typeof PersonalGitHubRepositoryId>;\n\nexport const PersonalGitHubRepositoryAccess = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"read\", \"write\"]),\n);\nexport type PersonalGitHubRepositoryAccess = z.infer<typeof PersonalGitHubRepositoryAccess>;\n\nexport const PersonalGitHubRepositoryPermissions = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      pull: primitives.boolean,\n      push: primitives.boolean,\n      admin: primitives.boolean,\n      maintain: primitives.boolean,\n      triage: primitives.boolean,\n    })\n    .strict(),\n);\nexport type PersonalGitHubRepositoryPermissions = z.infer<\n  typeof PersonalGitHubRepositoryPermissions\n>;\n\nexport const PersonalGitHubRepositoryVisibility = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"public\", \"private\", \"internal\"]),\n);\nexport type PersonalGitHubRepositoryVisibility = z.infer<typeof PersonalGitHubRepositoryVisibility>;\n\nconst PersonalGitHubRepositoryFullName = /* @__PURE__ */ defineSchema(() =>\n  z\n    .string()\n    .min(3)\n    .max(140)\n    .regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\\/[A-Za-z0-9_.-]{1,100}$/u),\n);\n\nexport function canonicalPersonalGitHubRepositoryUrl(fullName: string): string {\n  return `https://github.com/${fullName}`;\n}\n\n/** A bounded, credential-free projection verified directly against GitHub. */\nexport const PersonalGitHubRepository = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      repositoryId: PersonalGitHubRepositoryId,\n      fullName: PersonalGitHubRepositoryFullName,\n      canonicalUrl: z.string().url().max(512),\n      defaultBranch: z.string().min(1).max(255),\n      visibility: PersonalGitHubRepositoryVisibility,\n      private: primitives.boolean,\n      archived: primitives.boolean,\n      disabled: primitives.boolean,\n      permissions: PersonalGitHubRepositoryPermissions,\n    })\n    .strict()\n    .superRefine((repository, context) => {\n      if (repository.canonicalUrl !== canonicalPersonalGitHubRepositoryUrl(repository.fullName)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"canonicalUrl\"],\n          message: \"canonicalUrl must be derived from fullName\",\n        });\n      }\n      if (repository.private !== (repository.visibility === \"private\")) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"private\"],\n          message: \"private must agree with visibility\",\n        });\n      }\n    }),\n);\nexport type PersonalGitHubRepository = z.infer<typeof PersonalGitHubRepository>;\n\nexport const PersonalGitHubSelectedRepository = /* @__PURE__ */ defineSchema(() =>\n  PersonalGitHubRepository.safeExtend({\n    selectedAccess: PersonalGitHubRepositoryAccess,\n    selectionGeneration: primitives.positiveInteger,\n    selectedAt: primitives.string.datetime({ offset: true }),\n    lastVerifiedAt: primitives.string.datetime({ offset: true }),\n  }).strict(),\n);\nexport type PersonalGitHubSelectedRepository = z.infer<typeof PersonalGitHubSelectedRepository>;\n\nexport const PersonalGitHubRepositorySelectionState = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      connectionAuthorityGeneration: primitives.positiveInteger,\n      credentialBindingId: primitives.uuid,\n      providerPrincipalId: PersonalGitHubRepositoryId,\n      selectionGeneration: primitives.nonnegativeInteger,\n      repositories: z\n        .array(PersonalGitHubSelectedRepository)\n        .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n    })\n    .strict(),\n);\nexport type PersonalGitHubRepositorySelectionState = z.infer<\n  typeof PersonalGitHubRepositorySelectionState\n>;\n\nexport const ListPersonalGitHubRepositoriesQuery = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      cursor: z.coerce.number().int().positive().max(10_000).default(1),\n      limit: z.coerce.number().int().min(1).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX).default(50),\n    })\n    .strict(),\n);\nexport type ListPersonalGitHubRepositoriesQuery = z.infer<\n  typeof ListPersonalGitHubRepositoriesQuery\n>;\n\nexport const PersonalGitHubRepositoryCatalogItem = /* @__PURE__ */ defineSchema(() =>\n  PersonalGitHubRepository.safeExtend({\n    selectedAccess: PersonalGitHubRepositoryAccess.nullable(),\n  }).strict(),\n);\nexport type PersonalGitHubRepositoryCatalogItem = z.infer<\n  typeof PersonalGitHubRepositoryCatalogItem\n>;\n\nexport const ListPersonalGitHubRepositoriesResponse = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      repositories: z\n        .array(PersonalGitHubRepositoryCatalogItem)\n        .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n      nextCursor: z.number().int().positive().nullable(),\n      selection: PersonalGitHubRepositorySelectionState,\n    })\n    .strict(),\n);\nexport type ListPersonalGitHubRepositoriesResponse = z.infer<\n  typeof ListPersonalGitHubRepositoriesResponse\n>;\n\nexport const PersonalGitHubRepositorySelectionInput = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      repositoryId: PersonalGitHubRepositoryId,\n      fullName: PersonalGitHubRepositoryFullName,\n      access: PersonalGitHubRepositoryAccess,\n    })\n    .strict(),\n);\nexport type PersonalGitHubRepositorySelectionInput = z.infer<\n  typeof PersonalGitHubRepositorySelectionInput\n>;\n\nexport const ReplacePersonalGitHubRepositorySelectionsRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      expectedConnectionAuthorityGeneration: primitives.positiveInteger,\n      expectedSelectionGeneration: primitives.nonnegativeInteger,\n      idempotencyKey: primitives.string.trim().min(1).max(200),\n      repositories: z\n        .array(PersonalGitHubRepositorySelectionInput)\n        .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n    })\n    .strict()\n    .superRefine((request, context) => {\n      const repositoryIds = new Set<string>();\n      const fullNames = new Set<string>();\n      request.repositories.forEach((repository, index) => {\n        const normalizedFullName = repository.fullName.toLowerCase();\n        if (repositoryIds.has(repository.repositoryId)) {\n          context.addIssue({\n            code: \"custom\",\n            path: [\"repositories\", index, \"repositoryId\"],\n            message: \"repositoryId must be unique\",\n          });\n        }\n        if (fullNames.has(normalizedFullName)) {\n          context.addIssue({\n            code: \"custom\",\n            path: [\"repositories\", index, \"fullName\"],\n            message: \"fullName must be unique\",\n          });\n        }\n        repositoryIds.add(repository.repositoryId);\n        fullNames.add(normalizedFullName);\n      });\n    }),\n);\nexport type ReplacePersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof ReplacePersonalGitHubRepositorySelectionsRequest\n>;\n\nexport const VerifyPersonalGitHubRepositorySelectionsRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      expectedConnectionAuthorityGeneration: primitives.positiveInteger,\n      expectedSelectionGeneration: primitives.nonnegativeInteger,\n      idempotencyKey: primitives.string.trim().min(1).max(200),\n    })\n    .strict(),\n);\nexport type VerifyPersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof VerifyPersonalGitHubRepositorySelectionsRequest\n>;\n\n/**\n * Owner-visible, credential-free metadata for one dedicated personal GitHub\n * OAuth connection. Repository selections are a separate authority and never\n * live in this credential record.\n */\nexport const PersonalGitHubConnectionMetadata = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      credentialRole: z.literal(PERSONAL_GITHUB_CREDENTIAL_ROLE),\n      providerFamily: z.literal(PERSONAL_GITHUB_PROVIDER_FAMILY),\n      providerPrincipalId: primitives.string.regex(/^\\d+$/u),\n      githubUserId: primitives.string.regex(/^\\d+$/u),\n      githubLogin: z.string().min(1).max(100),\n      oauthEnvironment: z.string().min(1).max(128),\n      oauthClientMarker: primitives.string.regex(/^[a-f0-9]{32}$/u),\n      credentialBindingId: primitives.uuid,\n      connectedAt: primitives.string.datetime({ offset: true }),\n      lastVerifiedAt: primitives.string.datetime({ offset: true }),\n      disconnectedAt: primitives.string.datetime({ offset: true }).nullable().optional(),\n      refreshTokenExpiresAt: primitives.string.datetime({ offset: true }).nullable().optional(),\n    })\n    .passthrough(),\n);\nexport type PersonalGitHubConnectionMetadata = z.infer<typeof PersonalGitHubConnectionMetadata>;\n\nexport const PersonalGitHubOAuthStartRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      /** Existing exact connection generation to re-authorize in place. */\n      connectionId: primitives.optionalUuid,\n      /** Same-workspace UI path restored after the callback. */\n      returnPath: z.string().min(1).max(2048).optional(),\n    })\n    .strict(),\n);\nexport type PersonalGitHubOAuthStartRequest = z.infer<typeof PersonalGitHubOAuthStartRequest>;\n\nexport const PersonalGitHubOAuthStartResponse = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      authorizationUrl: z.string().url(),\n      expiresAt: primitives.string.datetime({ offset: true }),\n    })\n    .strict(),\n);\nexport type PersonalGitHubOAuthStartResponse = z.infer<typeof PersonalGitHubOAuthStartResponse>;\n\nexport const PersonalGitHubConnectionStatusResponse = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      enabled: primitives.boolean,\n      connection: ConnectionMetadata.nullable(),\n      reviewUrl: z.string().url().nullable(),\n    })\n    .strict(),\n);\nexport type PersonalGitHubConnectionStatusResponse = z.infer<\n  typeof PersonalGitHubConnectionStatusResponse\n>;\n\nexport const PersonalGitHubDisconnectRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      expectedVersion: primitives.positiveInteger,\n      idempotencyKey: primitives.string.trim().min(1).max(200),\n    })\n    .strict(),\n);\nexport type PersonalGitHubDisconnectRequest = z.infer<typeof PersonalGitHubDisconnectRequest>;\n\nexport function isPersonalGitHubConnection(\n  connection: Pick<z.infer<typeof ConnectionMetadata>, \"providerDomain\" | \"kind\" | \"metadata\">,\n): boolean {\n  return (\n    connection.providerDomain.toLowerCase() === PERSONAL_GITHUB_PROVIDER_DOMAIN &&\n    connection.kind === \"oauth2\" &&\n    PersonalGitHubConnectionMetadata.safeParse(connection.metadata).success\n  );\n}\n\nexport function hasReservedPersonalGitHubMetadata(\n  metadata: Record<string, unknown> | undefined,\n): boolean {\n  return metadata?.credentialRole === PERSONAL_GITHUB_CREDENTIAL_ROLE;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,SAAS,SAAS;AAIX,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,wCAAwC;AAC9C,IAAM,mCAAmC,CAAC,MAAM;AAChD,IAAM,oCACX;AACK,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,yCAAyC;AAE/C,IAAM,6BAA6C;AAAA,EAAa,MAC1D,OAAO,MAAM,aAAa;AACvC;AAGO,IAAM,iCAAiD;AAAA,EAAa,MACzE,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAC1B;AAGO,IAAM,sCAAsD;AAAA,EAAa,MAC9E,EACG,OAAO;AAAA,IACN,MAAiB;AAAA,IACjB,MAAiB;AAAA,IACjB,OAAkB;AAAA,IAClB,UAAqB;AAAA,IACrB,QAAmB;AAAA,EACrB,CAAC,EACA,OAAO;AACZ;AAKO,IAAM,qCAAqD;AAAA,EAAa,MAC7E,EAAE,KAAK,CAAC,UAAU,WAAW,UAAU,CAAC;AAC1C;AAGA,IAAM,mCAAmD;AAAA,EAAa,MACpE,EACG,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,6DAA6D;AACxE;AAEO,SAAS,qCAAqC,UAA0B;AAC7E,SAAO,sBAAsB,QAAQ;AACvC;AAGO,IAAM,2BAA2C;AAAA,EAAa,MACnE,EACG,OAAO;AAAA,IACN,cAAc;AAAA,IACd,UAAU;AAAA,IACV,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG;AAAA,IACtC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACxC,YAAY;AAAA,IACZ,SAAoB;AAAA,IACpB,UAAqB;AAAA,IACrB,UAAqB;AAAA,IACrB,aAAa;AAAA,EACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,YAAY,YAAY;AACpC,QAAI,WAAW,iBAAiB,qCAAqC,WAAW,QAAQ,GAAG;AACzF,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,cAAc;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,WAAW,aAAa,WAAW,eAAe,YAAY;AAChE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,SAAS;AAAA,QAChB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACL;AAGO,IAAM,mCAAmD;AAAA,EAAa,MAC3E,yBAAyB,WAAW;AAAA,IAClC,gBAAgB;AAAA,IAChB,qBAAgC;AAAA,IAChC,YAAuB,OAAO,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,IACvD,gBAA2B,OAAO,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC7D,CAAC,EAAE,OAAO;AACZ;AAGO,IAAM,yCAAyD;AAAA,EAAa,MACjF,EACG,OAAO;AAAA,IACN,+BAA0C;AAAA,IAC1C,qBAAgC;AAAA,IAChC,qBAAqB;AAAA,IACrB,qBAAgC;AAAA,IAChC,cAAc,EACX,MAAM,gCAAgC,EACtC,IAAI,sCAAsC;AAAA,EAC/C,CAAC,EACA,OAAO;AACZ;AAKO,IAAM,sCAAsD;AAAA,EAAa,MAC9E,EACG,OAAO;AAAA,IACN,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,CAAC;AAAA,IAChE,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,sCAAsC,EAAE,QAAQ,EAAE;AAAA,EAC9F,CAAC,EACA,OAAO;AACZ;AAKO,IAAM,sCAAsD;AAAA,EAAa,MAC9E,yBAAyB,WAAW;AAAA,IAClC,gBAAgB,+BAA+B,SAAS;AAAA,EAC1D,CAAC,EAAE,OAAO;AACZ;AAKO,IAAM,yCAAyD;AAAA,EAAa,MACjF,EACG,OAAO;AAAA,IACN,cAAc,EACX,MAAM,mCAAmC,EACzC,IAAI,sCAAsC;AAAA,IAC7C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACjD,WAAW;AAAA,EACb,CAAC,EACA,OAAO;AACZ;AAKO,IAAM,yCAAyD;AAAA,EAAa,MACjF,EACG,OAAO;AAAA,IACN,cAAc;AAAA,IACd,UAAU;AAAA,IACV,QAAQ;AAAA,EACV,CAAC,EACA,OAAO;AACZ;AAKO,IAAM,mDAAmE;AAAA,EAAa,MAC3F,EACG,OAAO;AAAA,IACN,uCAAkD;AAAA,IAClD,6BAAwC;AAAA,IACxC,gBAA2B,OAAO,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACvD,cAAc,EACX,MAAM,sCAAsC,EAC5C,IAAI,sCAAsC;AAAA,EAC/C,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,YAAY;AACjC,UAAM,gBAAgB,oBAAI,IAAY;AACtC,UAAM,YAAY,oBAAI,IAAY;AAClC,YAAQ,aAAa,QAAQ,CAAC,YAAY,UAAU;AAClD,YAAM,qBAAqB,WAAW,SAAS,YAAY;AAC3D,UAAI,cAAc,IAAI,WAAW,YAAY,GAAG;AAC9C,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,MAAM,CAAC,gBAAgB,OAAO,cAAc;AAAA,UAC5C,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,UAAI,UAAU,IAAI,kBAAkB,GAAG;AACrC,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,UACxC,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,oBAAc,IAAI,WAAW,YAAY;AACzC,gBAAU,IAAI,kBAAkB;AAAA,IAClC,CAAC;AAAA,EACH,CAAC;AACL;AAKO,IAAM,kDAAkE;AAAA,EAAa,MAC1F,EACG,OAAO;AAAA,IACN,uCAAkD;AAAA,IAClD,6BAAwC;AAAA,IACxC,gBAA2B,OAAO,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzD,CAAC,EACA,OAAO;AACZ;AAUO,IAAM,mCAAmD;AAAA,EAAa,MAC3E,EACG,OAAO;AAAA,IACN,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,IACzD,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,IACzD,qBAAgC,OAAO,MAAM,QAAQ;AAAA,IACrD,cAAyB,OAAO,MAAM,QAAQ;AAAA,IAC9C,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IAC3C,mBAA8B,OAAO,MAAM,iBAAiB;AAAA,IAC5D,qBAAgC;AAAA,IAChC,aAAwB,OAAO,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,IACxD,gBAA2B,OAAO,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,IAC3D,gBAA2B,OAAO,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,IACjF,uBAAkC,OAAO,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1F,CAAC,EACA,YAAY;AACjB;AAGO,IAAM,kCAAkD;AAAA,EAAa,MAC1E,EACG,OAAO;AAAA;AAAA,IAEN,cAAyB;AAAA;AAAA,IAEzB,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACnD,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,mCAAmD;AAAA,EAAa,MAC3E,EACG,OAAO;AAAA,IACN,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,IACjC,WAAsB,OAAO,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACxD,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,yCAAyD;AAAA,EAAa,MACjF,EACG,OAAO;AAAA,IACN,SAAoB;AAAA,IACpB,YAAY,mBAAmB,SAAS;AAAA,IACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvC,CAAC,EACA,OAAO;AACZ;AAKO,IAAM,kCAAkD;AAAA,EAAa,MAC1E,EACG,OAAO;AAAA,IACN,iBAA4B;AAAA,IAC5B,gBAA2B,OAAO,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzD,CAAC,EACA,OAAO;AACZ;AAGO,SAAS,2BACd,YACS;AACT,SACE,WAAW,eAAe,YAAY,MAAM,mCAC5C,WAAW,SAAS,YACpB,iCAAiC,UAAU,WAAW,QAAQ,EAAE;AAEpE;AAEO,SAAS,kCACd,UACS;AACT,SAAO,UAAU,mBAAmB;AACtC;","names":[]}

package/dist/personal-integration-setup.d.ts

@@ -0,0 +1,81 @@
+/** The narrow permission. `connections:write` includes it. */
+export declare const PERSONAL_INTEGRATION_SETUP_PERMISSION: "connections:personal";
+/**
+ * Literal permission-set coverage for ceilings (organization key policies,
+ * delegation limits): the exact permission, or the personal setup permission
+ * through `connections:write`. Grants and policies saved before the narrow
+ * permission existed keep their meaning.
+ */
+export declare function permissionSetCovers(permissions: readonly string[], permission: string): boolean;
+/**
+ * Whether a catalog integration may be turned on for personal accounts by
+ * someone holding only the personal setup permission: a reviewed catalog MCP
+ * integration that signs each person in with OAuth. Custom MCP servers,
+ * API-key integrations and unreviewed registry entries never qualify.
+ */
+export declare function isPersonalIntegrationSetupCandidate(item: {
+    kind: string;
+    source: string;
+    authKind?: string | null | undefined;
+    stale?: boolean | undefined;
+    workspaceId?: string | null | undefined;
+    runtime?: {
+        available?: boolean | undefined;
+        catalogTrust?: {
+            state: string;
+        } | undefined;
+    } | undefined;
+}): boolean;
+/**
+ * How this person may set up an integration from a card in their chat, read
+ * from their workspace grant and the integration's catalog entry:
+ *
+ * - `"any"`: they may connect a shared or a personal account (and enable it).
+ * - `"personal"`: only their own account; the card offers no ownership choice
+ *   and enables the integration for personal accounts if it is not on yet.
+ * - `null`: they cannot finish setup here.
+ *
+ * The API enforces the same rules at call time (and an organization can
+ * reserve turning integrations on for admins), so this only decides what to
+ * offer. Clients, embeds and integration cards should all use this one rule.
+ */
+export declare function personalIntegrationSetupAccess(grant: {
+    permissions: readonly string[];
+    permissionMode?: "legacy" | "explicit" | undefined;
+}, item: Parameters<typeof isPersonalIntegrationSetupCandidate>[0] & {
+    enabled?: boolean | undefined;
+    connectionRef?: {
+        subjectScope?: string | undefined;
+    } | null | undefined;
+}): "any" | "personal" | null;
+/**
+ * What an agent's setup card for one capability can offer this person in
+ * their chat, read from their workspace grant and the capability's catalog
+ * entry (`undefined` when the catalog has none):
+ *
+ * - `"card"`: an OAuth MCP integration they can connect from the card;
+ *   `personalOnly` when only their own account is allowed.
+ * - `"integration"`: a deployment's reviewed integration definition they
+ *   connect with their own account.
+ * - `"unavailable"`: they cannot finish this setup from the chat.
+ * - `"default"`: not decided here (other kinds of setup keep their own row).
+ *
+ * The chat card and the agent's setup tool both use this rule, so what the
+ * agent says matches what the card offers.
+ */
+export type InChatCapabilitySetup = {
+    kind: "card";
+    personalOnly: boolean;
+} | {
+    kind: "integration";
+} | {
+    kind: "unavailable";
+} | {
+    kind: "default";
+};
+export declare function inChatCapabilitySetup(grant: {
+    permissions: readonly string[];
+    permissionMode?: "legacy" | "explicit" | undefined;
+}, capabilityId: string, item: (Parameters<typeof personalIntegrationSetupAccess>[1] & {
+    authKind?: string | null | undefined;
+}) | undefined): InChatCapabilitySetup;

package/dist/personal-integration-setup.js

@@ -0,0 +1,42 @@
+import {
+  integrationDefinitionIdFromCapabilityId
+} from "./chunk-RLJUNVAM.js";
+
+// src/personal-integration-setup.ts
+var PERSONAL_INTEGRATION_SETUP_PERMISSION = "connections:personal";
+function permissionSetCovers(permissions, permission) {
+  return permissions.includes(permission) || permission === PERSONAL_INTEGRATION_SETUP_PERMISSION && permissions.includes("connections:write");
+}
+var REVIEWED_SOURCES = /* @__PURE__ */ new Set(["built_in", "configured", "registry"]);
+function isPersonalIntegrationSetupCandidate(item) {
+  return item.kind === "mcp" && item.authKind === "oauth2" && REVIEWED_SOURCES.has(item.source) && !item.stale && !item.workspaceId && item.runtime?.available === true && (item.source !== "registry" || item.runtime.catalogTrust?.state === "trusted");
+}
+function personalIntegrationSetupAccess(grant, item) {
+  const can = (permission) => permissionSetCovers(grant.permissions, permission) || grant.permissionMode !== "explicit" && permission !== "secrets:read" && grant.permissions.includes("workspace:admin");
+  if (!can(PERSONAL_INTEGRATION_SETUP_PERMISSION)) return null;
+  if (can("connections:write") && can("connections:read") && (item.enabled || can("capabilities:manage")))
+    return "any";
+  if (item.enabled) return item.connectionRef?.subjectScope === "subject" ? "personal" : null;
+  return can("capabilities:manage") || isPersonalIntegrationSetupCandidate(item) ? "personal" : null;
+}
+function inChatCapabilitySetup(grant, capabilityId, item) {
+  const can = (permission) => grant.permissions.includes(permission) || grant.permissionMode !== "explicit" && grant.permissions.includes("workspace:admin");
+  if (integrationDefinitionIdFromCapabilityId(capabilityId)) {
+    return can("sessions:control") && (can(PERSONAL_INTEGRATION_SETUP_PERMISSION) || can("connections:write")) ? { kind: "integration" } : { kind: "unavailable" };
+  }
+  if (!item || item.kind !== "mcp" || item.authKind !== "oauth2") return { kind: "default" };
+  if (!can("sessions:control")) return { kind: "unavailable" };
+  const usesSharedAccount = item.enabled === true && item.connectionRef !== null && item.connectionRef !== void 0 && item.connectionRef.subjectScope !== "subject";
+  if (usesSharedAccount)
+    return can("connections:read") ? { kind: "card", personalOnly: false } : { kind: "unavailable" };
+  const access = personalIntegrationSetupAccess(grant, item);
+  return access ? { kind: "card", personalOnly: access === "personal" } : { kind: "unavailable" };
+}
+export {
+  PERSONAL_INTEGRATION_SETUP_PERMISSION,
+  inChatCapabilitySetup,
+  isPersonalIntegrationSetupCandidate,
+  permissionSetCovers,
+  personalIntegrationSetupAccess
+};
+//# sourceMappingURL=personal-integration-setup.js.map

package/dist/personal-integration-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/personal-integration-setup.ts"],"sourcesContent":["/**\n * Personal integration setup: a person connecting their own account to an\n * integration and using it in their own chats, without administering the\n * workspace. One shared definition for the API, the SDK and every client.\n */\nimport { integrationDefinitionIdFromCapabilityId } from \"./integration-capability-id\";\n\n/** The narrow permission. `connections:write` includes it. */\nexport const PERSONAL_INTEGRATION_SETUP_PERMISSION = \"connections:personal\" as const;\n\n/**\n * Literal permission-set coverage for ceilings (organization key policies,\n * delegation limits): the exact permission, or the personal setup permission\n * through `connections:write`. Grants and policies saved before the narrow\n * permission existed keep their meaning.\n */\nexport function permissionSetCovers(permissions: readonly string[], permission: string): boolean {\n  return (\n    permissions.includes(permission) ||\n    (permission === PERSONAL_INTEGRATION_SETUP_PERMISSION &&\n      permissions.includes(\"connections:write\"))\n  );\n}\n\n/** Catalog sources reviewed by Opengeni or the deployment operator, never a workspace's own entries. */\nconst REVIEWED_SOURCES = new Set([\"built_in\", \"configured\", \"registry\"]);\n\n/**\n * Whether a catalog integration may be turned on for personal accounts by\n * someone holding only the personal setup permission: a reviewed catalog MCP\n * integration that signs each person in with OAuth. Custom MCP servers,\n * API-key integrations and unreviewed registry entries never qualify.\n */\nexport function isPersonalIntegrationSetupCandidate(item: {\n  kind: string;\n  source: string;\n  authKind?: string | null | undefined;\n  stale?: boolean | undefined;\n  workspaceId?: string | null | undefined;\n  runtime?:\n    | { available?: boolean | undefined; catalogTrust?: { state: string } | undefined }\n    | undefined;\n}): boolean {\n  return (\n    item.kind === \"mcp\" &&\n    item.authKind === \"oauth2\" &&\n    REVIEWED_SOURCES.has(item.source) &&\n    !item.stale &&\n    !item.workspaceId &&\n    item.runtime?.available === true &&\n    (item.source !== \"registry\" || item.runtime.catalogTrust?.state === \"trusted\")\n  );\n}\n\n/**\n * How this person may set up an integration from a card in their chat, read\n * from their workspace grant and the integration's catalog entry:\n *\n * - `\"any\"`: they may connect a shared or a personal account (and enable it).\n * - `\"personal\"`: only their own account; the card offers no ownership choice\n *   and enables the integration for personal accounts if it is not on yet.\n * - `null`: they cannot finish setup here.\n *\n * The API enforces the same rules at call time (and an organization can\n * reserve turning integrations on for admins), so this only decides what to\n * offer. Clients, embeds and integration cards should all use this one rule.\n */\nexport function personalIntegrationSetupAccess(\n  grant: { permissions: readonly string[]; permissionMode?: \"legacy\" | \"explicit\" | undefined },\n  item: Parameters<typeof isPersonalIntegrationSetupCandidate>[0] & {\n    enabled?: boolean | undefined;\n    connectionRef?: { subjectScope?: string | undefined } | null | undefined;\n  },\n): \"any\" | \"personal\" | null {\n  const can = (permission: string) =>\n    permissionSetCovers(grant.permissions, permission) ||\n    (grant.permissionMode !== \"explicit\" &&\n      permission !== \"secrets:read\" &&\n      grant.permissions.includes(\"workspace:admin\"));\n  if (!can(PERSONAL_INTEGRATION_SETUP_PERMISSION)) return null;\n  if (\n    can(\"connections:write\") &&\n    can(\"connections:read\") &&\n    (item.enabled || can(\"capabilities:manage\"))\n  )\n    return \"any\";\n  // Already on: connecting one's own account changes no installation, but\n  // only an installation that signs each person in can take it.\n  if (item.enabled) return item.connectionRef?.subjectScope === \"subject\" ? \"personal\" : null;\n  return can(\"capabilities:manage\") || isPersonalIntegrationSetupCandidate(item)\n    ? \"personal\"\n    : null;\n}\n\n/**\n * What an agent's setup card for one capability can offer this person in\n * their chat, read from their workspace grant and the capability's catalog\n * entry (`undefined` when the catalog has none):\n *\n * - `\"card\"`: an OAuth MCP integration they can connect from the card;\n *   `personalOnly` when only their own account is allowed.\n * - `\"integration\"`: a deployment's reviewed integration definition they\n *   connect with their own account.\n * - `\"unavailable\"`: they cannot finish this setup from the chat.\n * - `\"default\"`: not decided here (other kinds of setup keep their own row).\n *\n * The chat card and the agent's setup tool both use this rule, so what the\n * agent says matches what the card offers.\n */\nexport type InChatCapabilitySetup =\n  | { kind: \"card\"; personalOnly: boolean }\n  | { kind: \"integration\" }\n  | { kind: \"unavailable\" }\n  | { kind: \"default\" };\n\nexport function inChatCapabilitySetup(\n  grant: { permissions: readonly string[]; permissionMode?: \"legacy\" | \"explicit\" | undefined },\n  capabilityId: string,\n  item:\n    | (Parameters<typeof personalIntegrationSetupAccess>[1] & {\n        authKind?: string | null | undefined;\n      })\n    | undefined,\n): InChatCapabilitySetup {\n  const can = (permission: string) =>\n    grant.permissions.includes(permission) ||\n    (grant.permissionMode !== \"explicit\" && grant.permissions.includes(\"workspace:admin\"));\n  if (integrationDefinitionIdFromCapabilityId(capabilityId)) {\n    // Connecting your own account is the whole step: the integration's tools\n    // are installed for that account only, never for the workspace, so the\n    // personal setup permission (included in connections:write) is enough.\n    return can(\"sessions:control\") &&\n      (can(PERSONAL_INTEGRATION_SETUP_PERMISSION) || can(\"connections:write\"))\n      ? { kind: \"integration\" }\n      : { kind: \"unavailable\" };\n  }\n  if (!item || item.kind !== \"mcp\" || item.authKind !== \"oauth2\") return { kind: \"default\" };\n  if (!can(\"sessions:control\")) return { kind: \"unavailable\" };\n  const usesSharedAccount =\n    item.enabled === true &&\n    item.connectionRef !== null &&\n    item.connectionRef !== undefined &&\n    item.connectionRef.subjectScope !== \"subject\";\n  if (usesSharedAccount)\n    return can(\"connections:read\")\n      ? { kind: \"card\", personalOnly: false }\n      : { kind: \"unavailable\" };\n  const access = personalIntegrationSetupAccess(grant, item);\n  return access ? { kind: \"card\", personalOnly: access === \"personal\" } : { kind: \"unavailable\" };\n}\n"],"mappings":";;;;;AAQO,IAAM,wCAAwC;AAQ9C,SAAS,oBAAoB,aAAgC,YAA6B;AAC/F,SACE,YAAY,SAAS,UAAU,KAC9B,eAAe,yCACd,YAAY,SAAS,mBAAmB;AAE9C;AAGA,IAAM,mBAAmB,oBAAI,IAAI,CAAC,YAAY,cAAc,UAAU,CAAC;AAQhE,SAAS,oCAAoC,MASxC;AACV,SACE,KAAK,SAAS,SACd,KAAK,aAAa,YAClB,iBAAiB,IAAI,KAAK,MAAM,KAChC,CAAC,KAAK,SACN,CAAC,KAAK,eACN,KAAK,SAAS,cAAc,SAC3B,KAAK,WAAW,cAAc,KAAK,QAAQ,cAAc,UAAU;AAExE;AAeO,SAAS,+BACd,OACA,MAI2B;AAC3B,QAAM,MAAM,CAAC,eACX,oBAAoB,MAAM,aAAa,UAAU,KAChD,MAAM,mBAAmB,cACxB,eAAe,kBACf,MAAM,YAAY,SAAS,iBAAiB;AAChD,MAAI,CAAC,IAAI,qCAAqC,EAAG,QAAO;AACxD,MACE,IAAI,mBAAmB,KACvB,IAAI,kBAAkB,MACrB,KAAK,WAAW,IAAI,qBAAqB;AAE1C,WAAO;AAGT,MAAI,KAAK,QAAS,QAAO,KAAK,eAAe,iBAAiB,YAAY,aAAa;AACvF,SAAO,IAAI,qBAAqB,KAAK,oCAAoC,IAAI,IACzE,aACA;AACN;AAuBO,SAAS,sBACd,OACA,cACA,MAKuB;AACvB,QAAM,MAAM,CAAC,eACX,MAAM,YAAY,SAAS,UAAU,KACpC,MAAM,mBAAmB,cAAc,MAAM,YAAY,SAAS,iBAAiB;AACtF,MAAI,wCAAwC,YAAY,GAAG;AAIzD,WAAO,IAAI,kBAAkB,MAC1B,IAAI,qCAAqC,KAAK,IAAI,mBAAmB,KACpE,EAAE,MAAM,cAAc,IACtB,EAAE,MAAM,cAAc;AAAA,EAC5B;AACA,MAAI,CAAC,QAAQ,KAAK,SAAS,SAAS,KAAK,aAAa,SAAU,QAAO,EAAE,MAAM,UAAU;AACzF,MAAI,CAAC,IAAI,kBAAkB,EAAG,QAAO,EAAE,MAAM,cAAc;AAC3D,QAAM,oBACJ,KAAK,YAAY,QACjB,KAAK,kBAAkB,QACvB,KAAK,kBAAkB,UACvB,KAAK,cAAc,iBAAiB;AACtC,MAAI;AACF,WAAO,IAAI,kBAAkB,IACzB,EAAE,MAAM,QAAQ,cAAc,MAAM,IACpC,EAAE,MAAM,cAAc;AAC5B,QAAM,SAAS,+BAA+B,OAAO,IAAI;AACzD,SAAO,SAAS,EAAE,MAAM,QAAQ,cAAc,WAAW,WAAW,IAAI,EAAE,MAAM,cAAc;AAChG;","names":[]}