@opengeni/config 0.20.1-canary.2 → 0.21.0-canary.0

package/dist/index.d.ts

@@ -770,6 +770,11 @@ declare const SettingsSchema: z.ZodObject<{
     betterAuthAllowedHosts: z.ZodDefault<z.ZodString>;
     betterAuthCookieDomain: z.ZodOptional<z.ZodString>;
     betterAuthTrustedOrigins: z.ZodDefault<z.ZodString>;
+    managedAuthSessionSetMode: z.ZodDefault<z.ZodEnum<{
+        broker: "broker";
+        dual: "dual";
+        legacy: "legacy";
+    }>>;
     resendApiKey: z.ZodOptional<z.ZodString>;
     emailFrom: z.ZodDefault<z.ZodString>;
     stripeSecretKey: z.ZodOptional<z.ZodString>;

package/dist/index.js

@@ -1050,6 +1050,9 @@ var SettingsSchema = z.object({
   betterAuthAllowedHosts: z.string().default(""),
   betterAuthCookieDomain: z.string().optional(),
   betterAuthTrustedOrigins: z.string().default(""),
+  // Rolling browser login-slot compatibility. Repository/deployment default is
+  // deliberately legacy; changing to broker is an operator-authorized rollout.
+  managedAuthSessionSetMode: z.enum(["legacy", "dual", "broker"]).default("legacy"),
   resendApiKey: z.string().optional(),
   emailFrom: z.string().default("OpenGeni <auth@mail.opengeni.ai>"),
   stripeSecretKey: z.string().optional(),
@@ -2056,6 +2059,7 @@ function getSettings() {
     betterAuthAllowedHosts: optional("OPENGENI_BETTER_AUTH_ALLOWED_HOSTS"),
     betterAuthCookieDomain: optional("OPENGENI_BETTER_AUTH_COOKIE_DOMAIN"),
     betterAuthTrustedOrigins: optional("OPENGENI_BETTER_AUTH_TRUSTED_ORIGINS"),
+    managedAuthSessionSetMode: optional("OPENGENI_MANAGED_AUTH_SESSION_SET_MODE"),
     resendApiKey: optional("OPENGENI_RESEND_API_KEY"),
     emailFrom: optional("OPENGENI_EMAIL_FROM"),
     stripeSecretKey: optional("OPENGENI_STRIPE_SECRET_KEY"),
@@ -3850,6 +3854,11 @@ function validateSettings(settings) {
         "OPENGENI_DELEGATION_SECRET is required when OPENGENI_PRODUCT_ACCESS_MODE=managed"
       );
     }
+    if (settings.managedAuthSessionSetMode !== "legacy" && !["local", "test"].includes(settings.environment) && !settings.publicBaseUrl.startsWith("https://")) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must use https when browser session sets are enabled outside local/test"
+      );
+    }
     if (!["local", "test"].includes(settings.environment) && !settings.resendApiKey) {
       throw new Error("OPENGENI_RESEND_API_KEY is required for managed mode outside local/test");
     }