@opengeni/config 0.20.1-canary.2 → 0.22.0

package/dist/index.d.ts

@@ -273,6 +273,8 @@ declare const SettingsSchema: z.ZodObject<{
         variable_set_get_variable: "variable_set_get_variable";
         variable_set_list: "variable_set_list";
         variable_set_set_variable: "variable_set_set_variable";
+        work_claim_release: "work_claim_release";
+        work_claim_upsert: "work_claim_upsert";
         x_accounts_list: "x_accounts_list";
         x_mentions_live: "x_mentions_live";
         x_post_reply: "x_post_reply";
@@ -417,6 +419,8 @@ declare const SettingsSchema: z.ZodObject<{
         variable_set_get_variable: "variable_set_get_variable";
         variable_set_list: "variable_set_list";
         variable_set_set_variable: "variable_set_set_variable";
+        work_claim_release: "work_claim_release";
+        work_claim_upsert: "work_claim_upsert";
         x_accounts_list: "x_accounts_list";
         x_mentions_live: "x_mentions_live";
         x_post_reply: "x_post_reply";
@@ -426,6 +430,10 @@ declare const SettingsSchema: z.ZodObject<{
     }>>>>;
     streamTokenSecret: z.ZodOptional<z.ZodString>;
     streamControlEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    workDiscoveryEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    workClaimMutationsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    workDiscoveryHumanAdvisoriesEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    workDiscoveryAutomaticNudgesEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     ogtoolPackageSpec: z.ZodOptional<z.ZodString>;
     environmentsEncryptionKey: z.ZodOptional<z.ZodString>;
     integrationsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
@@ -770,6 +778,11 @@ declare const SettingsSchema: z.ZodObject<{
     betterAuthAllowedHosts: z.ZodDefault<z.ZodString>;
     betterAuthCookieDomain: z.ZodOptional<z.ZodString>;
     betterAuthTrustedOrigins: z.ZodDefault<z.ZodString>;
+    managedAuthSessionSetMode: z.ZodDefault<z.ZodEnum<{
+        broker: "broker";
+        dual: "dual";
+        legacy: "legacy";
+    }>>;
     resendApiKey: z.ZodOptional<z.ZodString>;
     emailFrom: z.ZodDefault<z.ZodString>;
     stripeSecretKey: z.ZodOptional<z.ZodString>;

package/dist/index.js

@@ -304,6 +304,21 @@ var SettingsSchema = z.object({
   // holder of stream:control gets 403 until this flips. Keeps stream:control a
   // declared-but-inert permission so later hardening is a flag flip.
   streamControlEnabled: EnvBoolean.default(false),
+  // Provider-neutral advisory work discovery rollout. Disabling this keeps
+  // ordinary session listings available while rejecting relevance discovery
+  // and omitting claim evidence from their compact projections.
+  workDiscoveryEnabled: EnvBoolean.default(true),
+  // Exact-attempt claim mutations are independently reversible. Turning this
+  // off removes the first-party mutation tools; durable claims and lifecycle
+  // settlement evidence remain readable.
+  workClaimMutationsEnabled: EnvBoolean.default(true),
+  // Human presentation is a separate rollout stage from the read API. The
+  // topology response carries this decision so clients can hide advisory UI
+  // without inventing authorization or ownership semantics.
+  workDiscoveryHumanAdvisoriesEnabled: EnvBoolean.default(true),
+  // Automatic overlap nudges are deliberately unshipped and default OFF until
+  // an evaluated precision threshold and operator runbook approve them.
+  workDiscoveryAutomaticNudgesEnabled: EnvBoolean.default(false),
   // Optional release-coherent bootstrap hint for custom rigs/connected machines
   // that do not carry the stock-image ogtool binary. Exact stable versions only:
   // the agent must never guess a tag or silently install `latest`.
@@ -1050,6 +1065,9 @@ var SettingsSchema = z.object({
   betterAuthAllowedHosts: z.string().default(""),
   betterAuthCookieDomain: z.string().optional(),
   betterAuthTrustedOrigins: z.string().default(""),
+  // Rolling browser login-slot compatibility. Repository/deployment default is
+  // deliberately legacy; changing to broker is an operator-authorized rollout.
+  managedAuthSessionSetMode: z.enum(["legacy", "dual", "broker"]).default("legacy"),
   resendApiKey: z.string().optional(),
   emailFrom: z.string().default("OpenGeni <auth@mail.opengeni.ai>"),
   stripeSecretKey: z.string().optional(),
@@ -1737,6 +1755,14 @@ function getSettings() {
     allowedFirstPartyMcpTools: optional("OPENGENI_ALLOWED_FIRST_PARTY_MCP_TOOLS"),
     streamTokenSecret: optional("OPENGENI_STREAM_TOKEN_SECRET"),
     streamControlEnabled: optional("OPENGENI_STREAM_CONTROL_ENABLED"),
+    workDiscoveryEnabled: optional("OPENGENI_WORK_DISCOVERY_ENABLED"),
+    workClaimMutationsEnabled: optional("OPENGENI_WORK_CLAIM_MUTATIONS_ENABLED"),
+    workDiscoveryHumanAdvisoriesEnabled: optional(
+      "OPENGENI_WORK_DISCOVERY_HUMAN_ADVISORIES_ENABLED"
+    ),
+    workDiscoveryAutomaticNudgesEnabled: optional(
+      "OPENGENI_WORK_DISCOVERY_AUTOMATIC_NUDGES_ENABLED"
+    ),
     ogtoolPackageSpec: optional("OPENGENI_OGTOOL_PACKAGE_SPEC"),
     environmentsEncryptionKey: optional("OPENGENI_ENVIRONMENTS_ENCRYPTION_KEY"),
     integrationsEnabled: optional("OPENGENI_INTEGRATIONS_ENABLED"),
@@ -2056,6 +2082,7 @@ function getSettings() {
     betterAuthAllowedHosts: optional("OPENGENI_BETTER_AUTH_ALLOWED_HOSTS"),
     betterAuthCookieDomain: optional("OPENGENI_BETTER_AUTH_COOKIE_DOMAIN"),
     betterAuthTrustedOrigins: optional("OPENGENI_BETTER_AUTH_TRUSTED_ORIGINS"),
+    managedAuthSessionSetMode: optional("OPENGENI_MANAGED_AUTH_SESSION_SET_MODE"),
     resendApiKey: optional("OPENGENI_RESEND_API_KEY"),
     emailFrom: optional("OPENGENI_EMAIL_FROM"),
     stripeSecretKey: optional("OPENGENI_STRIPE_SECRET_KEY"),
@@ -3850,6 +3877,11 @@ function validateSettings(settings) {
         "OPENGENI_DELEGATION_SECRET is required when OPENGENI_PRODUCT_ACCESS_MODE=managed"
       );
     }
+    if (settings.managedAuthSessionSetMode !== "legacy" && !["local", "test"].includes(settings.environment) && !settings.publicBaseUrl.startsWith("https://")) {
+      throw new Error(
+        "OPENGENI_PUBLIC_BASE_URL must use https when browser session sets are enabled outside local/test"
+      );
+    }
     if (!["local", "test"].includes(settings.environment) && !settings.resendApiKey) {
       throw new Error("OPENGENI_RESEND_API_KEY is required for managed mode outside local/test");
     }