@opengeni/config 0.7.22 → 0.9.1

package/dist/index.d.ts

@@ -88,6 +88,12 @@ declare const SettingsSchema: z.ZodObject<{
     observabilityMetricsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
     observabilityOtlpEndpoint: z.ZodOptional<z.ZodString>;
     observabilityOtlpHeaders: z.ZodDefault<z.ZodString>;
+    analyticsEnabled: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    analyticsConsentRequired: z.ZodDefault<z.ZodPreprocess<z.ZodBoolean>>;
+    analyticsReoClientId: z.ZodOptional<z.ZodString>;
+    analyticsPosthogProjectKey: z.ZodOptional<z.ZodString>;
+    analyticsPosthogHost: z.ZodOptional<z.ZodString>;
+    analyticsGa4MeasurementId: z.ZodOptional<z.ZodString>;
     publicBaseUrl: z.ZodOptional<z.ZodString>;
     webBaseUrl: z.ZodOptional<z.ZodString>;
     agentReleasesBaseUrl: z.ZodDefault<z.ZodString>;
@@ -126,9 +132,11 @@ declare const SettingsSchema: z.ZodObject<{
     integrationsOauthClientsJson: z.ZodDefault<z.ZodString>;
     slackClientId: z.ZodOptional<z.ZodString>;
     slackClientSecret: z.ZodOptional<z.ZodString>;
+    slackSigningSecret: z.ZodOptional<z.ZodString>;
     googleDriveClientId: z.ZodOptional<z.ZodString>;
     googleDriveClientSecret: z.ZodOptional<z.ZodString>;
     maxNestedAgentDepth: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    socialOauthClientsJson: z.ZodDefault<z.ZodString>;
     goalMaxAutoContinuations: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     goalNoProgressLimit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     agentMaxModelCallsPerTurn: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -931,6 +939,13 @@ export declare const SANDBOX_REQUIRED_ENV: Record<z.infer<typeof SandboxBackend>
 /** The required OPENGENI_* env var names for a backend (for the deployment manifest). */
 export declare function requiredSandboxEnvForBackend(backend: z.infer<typeof SandboxBackend>): string[];
 export declare function getSettings(): Settings;
+/**
+ * First-party session tools need a shared HMAC identity even in the unauthenticated
+ * local product mode. A fixed local-only value is no broader than that mode's
+ * existing access boundary, while configured and managed deployments continue to
+ * require an operator-provided secret.
+ */
+export declare function resolveFirstPartyDelegationSecret(settings: Settings): string | undefined;
 /**
  * The Modal sandbox idle timeout (seconds) the provider actually passes as
  * idleTimeoutMs (sandbox-file-persistence). When the operator did not pin
@@ -1233,6 +1248,13 @@ export declare function sandboxWarmRateMicrosPerSecond(settings: Settings, backe
  */
 export declare function parseModelProvidersJson(raw: string): RegistryProvider[];
 export declare function parseIntegrationsOauthClientsJson(raw: string | undefined): Record<string, IntegrationOAuthClientConfig>;
+export declare const SocialOAuthClientConfigSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SocialOAuthClientConfig = z.infer<typeof SocialOAuthClientConfigSchema>;
+declare const SOCIAL_OAUTH_PROVIDER_IDS: readonly ["x", "reddit"];
+export declare function parseSocialOauthClientsJson(raw: string | undefined): Partial<Record<(typeof SOCIAL_OAUTH_PROVIDER_IDS)[number], SocialOAuthClientConfig>>;
 export declare function parseStaticUsageLimitsJson(raw: string): StaticUsageLimitsConfig;
 export declare function parseStaticEntitlementsJson(raw: string): EntitlementsConfig;
 /**

package/dist/index.js

@@ -175,6 +175,12 @@ var SettingsSchema = z.object({
   observabilityMetricsEnabled: EnvBoolean.default(true),
   observabilityOtlpEndpoint: z.string().url().optional(),
   observabilityOtlpHeaders: z.string().default(""),
+  analyticsEnabled: EnvBoolean.default(false),
+  analyticsConsentRequired: EnvBoolean.default(true),
+  analyticsReoClientId: z.string().max(128).regex(/^[A-Za-z0-9_-]+$/u).optional(),
+  analyticsPosthogProjectKey: z.string().min(1).max(256).optional(),
+  analyticsPosthogHost: z.string().url().max(2048).optional(),
+  analyticsGa4MeasurementId: z.string().max(32).regex(/^G-[A-Z0-9]+$/u).optional(),
   publicBaseUrl: z.string().url().optional(),
   // Browser origin when the web app and API use separate origins in local
   // development. Production normally leaves this unset and uses publicBaseUrl.
@@ -217,11 +223,15 @@ var SettingsSchema = z.object({
   integrationsOauthClientsJson: z.string().default("{}"),
   slackClientId: z.string().optional(),
   slackClientSecret: z.string().optional(),
+  slackSigningSecret: z.string().optional(),
   googleDriveClientId: z.string().optional(),
   googleDriveClientSecret: z.string().optional(),
   // Undefined is meaningful: the migration boundary persists the product
   // default of 3 when no deployment override is supplied.
   maxNestedAgentDepth: z.coerce.number().int().nonnegative().max(MAX_NESTED_AGENT_DEPTH).optional(),
+  // Operator OAuth apps for first-party social connectors, keyed by provider
+  // id ("x", "reddit"): {"x":{"clientId":"...","clientSecret":"..."}}.
+  socialOauthClientsJson: z.string().default("{}"),
   // Session goal guard rails. Goals are designed for runs that legitimately
   // span days, so length is bounded by pathology detection (no-progress
   // streaks, budget exhaustion), never by count. goalMaxAutoContinuations is
@@ -273,6 +283,9 @@ var SettingsSchema = z.object({
   apiPort: z.coerce.number().int().positive().default(8e3),
   workerHttpPort: z.coerce.number().int().positive().default(8001),
   opengeniMcpUrl: z.string().url().optional(),
+  // Origins allowed to send browser cookies cross-origin. Other origins may
+  // call the public API with bearer credentials, but never receive credentialed
+  // CORS responses.
   corsAllowOriginRegex: z.string().default(String.raw`^https?://(localhost|127\.0\.0\.1)(:\d+)?$`),
   openaiProvider: z.enum(["openai", "azure"]).default("openai"),
   openaiApiKey: z.string().optional(),
@@ -870,7 +883,11 @@ function resolveVoiceInputProviderRegistry(settings) {
     }
     if (id === "codex-subscription") {
       if (!settings.codexSubscriptionEnabled) continue;
-      providers.push({ id: "codex-subscription", kind: "codex-subscription", experimental: true });
+      providers.push({
+        id: "codex-subscription",
+        kind: "codex-subscription",
+        experimental: true
+      });
     }
   }
   return providers;
@@ -1210,6 +1227,12 @@ function getSettings() {
     observabilityMetricsEnabled: optional("OPENGENI_OBSERVABILITY_METRICS_ENABLED"),
     observabilityOtlpEndpoint: optional("OPENGENI_OTEL_EXPORTER_OTLP_ENDPOINT") ?? optional("OTEL_EXPORTER_OTLP_ENDPOINT"),
     observabilityOtlpHeaders: optional("OPENGENI_OTEL_EXPORTER_OTLP_HEADERS") ?? optional("OTEL_EXPORTER_OTLP_HEADERS"),
+    analyticsEnabled: optional("OPENGENI_ANALYTICS_ENABLED"),
+    analyticsConsentRequired: optional("OPENGENI_ANALYTICS_CONSENT_REQUIRED"),
+    analyticsReoClientId: optional("OPENGENI_ANALYTICS_REO_CLIENT_ID"),
+    analyticsPosthogProjectKey: optional("OPENGENI_ANALYTICS_POSTHOG_PROJECT_KEY"),
+    analyticsPosthogHost: optional("OPENGENI_ANALYTICS_POSTHOG_HOST"),
+    analyticsGa4MeasurementId: optional("OPENGENI_ANALYTICS_GA4_MEASUREMENT_ID"),
     publicBaseUrl: optional("OPENGENI_PUBLIC_BASE_URL"),
     webBaseUrl: optional("OPENGENI_WEB_BASE_URL"),
     agentReleasesBaseUrl: optional("OPENGENI_AGENT_RELEASES_BASE_URL"),
@@ -1235,9 +1258,11 @@ function getSettings() {
     integrationsOauthClientsJson: optional("OPENGENI_INTEGRATIONS_OAUTH_CLIENTS_JSON"),
     slackClientId: optional("OPENGENI_SLACK_CLIENT_ID"),
     slackClientSecret: optional("OPENGENI_SLACK_CLIENT_SECRET"),
+    slackSigningSecret: optional("OPENGENI_SLACK_SIGNING_SECRET"),
     googleDriveClientId: optional("OPENGENI_GOOGLE_DRIVE_CLIENT_ID"),
     googleDriveClientSecret: optional("OPENGENI_GOOGLE_DRIVE_CLIENT_SECRET"),
     maxNestedAgentDepth: optional("OPENGENI_MAX_NESTED_AGENT_DEPTH"),
+    socialOauthClientsJson: optional("OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON"),
     goalMaxAutoContinuations: optional("OPENGENI_GOAL_MAX_AUTO_CONTINUATIONS"),
     goalNoProgressLimit: optional("OPENGENI_GOAL_NO_PROGRESS_LIMIT"),
     agentMaxModelCallsPerTurn: optional("OPENGENI_AGENT_MAX_MODEL_CALLS_PER_TURN"),
@@ -1460,6 +1485,12 @@ function getSettings() {
   validateSettings(settings);
   return settings;
 }
+var LOCAL_FIRST_PARTY_DELEGATION_SECRET = "opengeni-local-first-party-delegation-secret-v1";
+function resolveFirstPartyDelegationSecret(settings) {
+  const explicit = settings.delegationSecret?.trim();
+  if (explicit) return explicit;
+  return settings.productAccessMode === "local" && (settings.environment === "local" || settings.environment === "test") ? LOCAL_FIRST_PARTY_DELEGATION_SECRET : void 0;
+}
 function effectiveModalIdleTimeoutSeconds(settings) {
   return settings.modalIdleTimeoutSeconds ?? settings.modalTimeoutSeconds;
 }
@@ -1913,7 +1944,10 @@ function withCodexCatalogProvider(settings) {
       };
     })
   };
-  return { ...settings, modelProvidersJson: JSON.stringify([...providers, provider]) };
+  return {
+    ...settings,
+    modelProvidersJson: JSON.stringify([...providers, provider])
+  };
 }
 function policyProviderIdForModel(settings, modelId) {
   const canonicalModelId = canonicalizeConfiguredModelId(settings, modelId);
@@ -2048,7 +2082,9 @@ function configuredModels(settings) {
           capabilities,
           ...pricingSchedules[model.id] === void 0 ? {} : { pricing: pricingSchedules[model.id] },
           ...model.contextWindowTokens === void 0 ? {} : { contextWindowTokens: model.contextWindowTokens },
-          ...model.effectiveContextWindowTokens === void 0 ? {} : { effectiveContextWindowTokens: model.effectiveContextWindowTokens },
+          ...model.effectiveContextWindowTokens === void 0 ? {} : {
+            effectiveContextWindowTokens: model.effectiveContextWindowTokens
+          },
           ...model.autoCompactTokenLimit === void 0 ? {} : { autoCompactTokenLimit: model.autoCompactTokenLimit },
           ...model.toolOutputTruncationTokens === void 0 ? {} : { toolOutputTruncationTokens: model.toolOutputTruncationTokens },
           reasoningEffort: capabilities.reasoning.runnable,
@@ -2497,7 +2533,9 @@ function parseMcpServers(raw) {
     return parsed;
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    throw new Error(`OPENGENI_MCP_SERVERS must be a JSON array: ${message}`, { cause: error });
+    throw new Error(`OPENGENI_MCP_SERVERS must be a JSON array: ${message}`, {
+      cause: error
+    });
   }
 }
 function parseModelPricingJson(raw) {
@@ -2629,6 +2667,46 @@ function parseIntegrationsOauthClientsJson(raw) {
   }
   return out;
 }
+var SocialOAuthClientConfigSchema = z.object({
+  clientId: z.string().min(1),
+  clientSecret: z.string().min(1).optional()
+});
+var SOCIAL_OAUTH_PROVIDER_IDS = ["x", "reddit"];
+function parseSocialOauthClientsJson(raw) {
+  if (!raw?.trim() || raw.trim() === "{}") {
+    return {};
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON must be valid JSON: ${message}`, {
+      cause: error
+    });
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(
+      "OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON must be a JSON object keyed by social provider id"
+    );
+  }
+  const out = {};
+  for (const [key, value] of Object.entries(parsed)) {
+    if (!SOCIAL_OAUTH_PROVIDER_IDS.includes(key)) {
+      throw new Error(
+        `OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON provider ${key} is not supported (expected: ${SOCIAL_OAUTH_PROVIDER_IDS.join(", ")})`
+      );
+    }
+    const result = SocialOAuthClientConfigSchema.safeParse(value);
+    if (!result.success) {
+      throw new Error(
+        `OPENGENI_SOCIAL_OAUTH_CLIENTS_JSON client for ${key} is invalid: ${result.error.message}`
+      );
+    }
+    out[key] = result.data;
+  }
+  return out;
+}
 function parseStaticUsageLimitsJson(raw) {
   if (!raw.trim() || raw.trim() === "{}") {
     return {};
@@ -2809,6 +2887,11 @@ function validateSettings(settings) {
     );
   }
   if (settings.slackClientId) {
+    if (!settings.slackSigningSecret) {
+      throw new Error(
+        "OPENGENI_SLACK_SIGNING_SECRET is required when the OpenGeni Slack app is configured"
+      );
+    }
     if (!settings.publicBaseUrl) {
       throw new Error(
         "OPENGENI_PUBLIC_BASE_URL is required when the OpenGeni Slack app is configured"
@@ -2848,6 +2931,7 @@ function validateSettings(settings) {
     }
   }
   parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
+  parseSocialOauthClientsJson(settings.socialOauthClientsJson);
   if (settings.productAccessMode === "configured" && !["local", "test"].includes(settings.environment) && !settings.delegationSecret && !settings.authRequired) {
     throw new Error(
       "OPENGENI_PRODUCT_ACCESS_MODE=configured requires OPENGENI_DELEGATION_SECRET or OPENGENI_AUTH_REQUIRED=true outside local/test"
@@ -3153,6 +3237,7 @@ export {
   ModelProviderApi,
   RegistryProviderKind,
   SANDBOX_REQUIRED_ENV,
+  SocialOAuthClientConfigSchema,
   applyGitAuthPointerEnvironment,
   assertTurnExecutionPolicyMatchesConfigV1,
   builtinProviderId,
@@ -3185,12 +3270,14 @@ export {
   parseModelPricingJson,
   parseModelProvidersJson,
   parseSandboxWarmRateJson,
+  parseSocialOauthClientsJson,
   parseStaticEntitlementsJson,
   parseStaticUsageLimitsJson,
   policyProviderIdForModel,
   productLabelForModelId,
   requiredSandboxEnvForBackend,
   resolveEnrollmentSigningSecret,
+  resolveFirstPartyDelegationSecret,
   resolveModelProvider,
   resolveNatsCalloutConfig,
   resolveNatsControlPlaneAuth,