@opengeni/contracts 0.44.1 → 1.0.0

package/dist/client-error-report.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Wire grammar of the content-free web client error beacon
+ * (`POST /v1/client-errors`).
+ *
+ * A report is only a closed error kind, the matched route PATTERN (never a
+ * concrete URL), and the bundle revision. The web client that projects a
+ * report, the API route that admits it, and the public structured-log
+ * projection that prints it all validate against these exact values, so the
+ * browser can only send what the API accepts and logs.
+ *
+ * The same route also admits the closed operational signals below (requests
+ * that never reached the server, live-stream health, and web vitals). They
+ * follow the same rules: closed values only, a route pattern or page label,
+ * never a URL, message, identifier, or user content.
+ */
+export declare const CLIENT_ERRORS_PATH = "/v1/client-errors";
+export declare const CLIENT_ERROR_KINDS: readonly ["route_error", "unhandled_rejection", "window_error", "chunk_load"];
+export type ClientErrorKind = (typeof CLIENT_ERROR_KINDS)[number];
+/** Largest accepted report body. A valid report is well under 256 bytes. */
+export declare const CLIENT_ERROR_REPORT_MAX_BYTES = 512;
+/**
+ * A route pattern of at most 160 characters that is `/`, `unknown`, or up to
+ * twelve `/`-separated segments that are each either a lowercase literal
+ * (`variable-sets`) or a `$param` placeholder. The grammar excludes digits in
+ * literals, so a concrete id cannot pass as one.
+ */
+export declare const CLIENT_ERROR_ROUTE_PATTERN: RegExp;
+/** The bundle revision token (a commit SHA, `dev`, or `unknown`). */
+export declare const CLIENT_ERROR_REVISION_PATTERN: RegExp;
+export type ClientErrorReport = {
+    kind: ClientErrorKind;
+    route: string;
+    revision: string;
+};
+/**
+ * Content-free operational signals that share the error beacon route. A
+ * signal report carries a `signal` discriminator and only closed values; a
+ * report without `signal` is a {@link ClientErrorReport}. Older API servers
+ * reject signal reports as invalid, so the extension is backward compatible in
+ * both directions.
+ */
+export declare const CLIENT_SIGNALS: readonly ["request_failure", "stream", "web_vital"];
+export type ClientSignal = (typeof CLIENT_SIGNALS)[number];
+/**
+ * Key product mutations whose failure before any HTTP response is counted.
+ * `send_message` includes sends the server queues behind an active turn.
+ */
+export declare const CLIENT_REQUEST_ACTIONS: readonly ["create_session", "send_message", "steer_message", "composer_submit", "retry_turn", "connect_integration", "connect_model", "checkout_start"];
+export type ClientRequestAction = (typeof CLIENT_REQUEST_ACTIONS)[number];
+/**
+ * Why a request never produced an HTTP response: the browser reported no
+ * connectivity (`offline`), the client's own deadline expired (`timeout`), or
+ * the transport failed (`network`). Cancellations the user or the app
+ * initiated are never reported.
+ */
+export declare const CLIENT_REQUEST_FAILURE_REASONS: readonly ["network", "timeout", "offline"];
+export type ClientRequestFailureReason = (typeof CLIENT_REQUEST_FAILURE_REASONS)[number];
+/** Browser live streams: one session's event stream, or the workspace live stream. */
+export declare const CLIENT_STREAMS: readonly ["session", "workspace"];
+export type ClientStream = (typeof CLIENT_STREAMS)[number];
+/**
+ * Live stream health: a live stream dropped and started reconnecting
+ * (`reconnect`), stopped reconnecting (`reconnect_exhausted`), or stayed
+ * disconnected for longer than the long-disconnect threshold while the tab
+ * was visible (`long_disconnect`).
+ */
+export declare const CLIENT_STREAM_EVENTS: readonly ["reconnect", "reconnect_exhausted", "long_disconnect"];
+export type ClientStreamEvent = (typeof CLIENT_STREAM_EVENTS)[number];
+/** Core Web Vitals plus time to first byte, measured once per document. */
+export declare const CLIENT_WEB_VITAL_METRICS: readonly ["lcp", "inp", "cls", "ttfb"];
+export type ClientWebVitalMetric = (typeof CLIENT_WEB_VITAL_METRICS)[number];
+/**
+ * Largest accepted value: seconds for the timing metrics, the unitless layout
+ * shift score for `cls`.
+ */
+export declare const CLIENT_WEB_VITAL_MAX_VALUE: Readonly<Record<ClientWebVitalMetric, number>>;
+/**
+ * The closed page labels of the web console's product-journey projection
+ * (`journeyPage` in apps/web/src/lib/analytics-journey.ts; a drift test keeps
+ * the two identical). Workspace pages are the first path segment after
+ * `/workspaces/<id>/`; the rest are exact top-level routes.
+ */
+export declare const CLIENT_PAGES: readonly ["sessions", "priority", "plugins", "capabilities", "documents", "state", "memory", "schedules", "artifacts", "settings", "organization", "insights", "machines", "files", "agents", "variable-sets", "environments", "rigs", "home", "session-link", "identity-link", "checkout-return", "integration-return", "device", "connect-agent", "reset-password", "setup-account", "account-auth", "personal-security", "other"];
+export type ClientPage = (typeof CLIENT_PAGES)[number];
+export type ClientRequestFailureReport = {
+    signal: "request_failure";
+    action: ClientRequestAction;
+    reason: ClientRequestFailureReason;
+    route: string;
+    revision: string;
+};
+export type ClientStreamReport = {
+    signal: "stream";
+    stream: ClientStream;
+    event: ClientStreamEvent;
+    route: string;
+    revision: string;
+};
+export type ClientWebVitalReport = {
+    signal: "web_vital";
+    metric: ClientWebVitalMetric;
+    page: ClientPage;
+    /** Seconds for timing metrics, the unitless score for `cls`. */
+    value: number;
+    revision: string;
+};
+export type ClientSignalReport = ClientRequestFailureReport | ClientStreamReport | ClientWebVitalReport;
+/** Every body the beacon route accepts. */
+export type ClientBeaconReport = ClientErrorReport | ClientSignalReport;

package/dist/client-error-report.js

@@ -0,0 +1,87 @@
+// src/client-error-report.ts
+var CLIENT_ERRORS_PATH = "/v1/client-errors";
+var CLIENT_ERROR_KINDS = [
+  "route_error",
+  "unhandled_rejection",
+  "window_error",
+  "chunk_load"
+];
+var CLIENT_ERROR_REPORT_MAX_BYTES = 512;
+var ROUTE_SEGMENT = String.raw`(?:[a-z]+(?:-[a-z]+)*|\$[A-Za-z][A-Za-z0-9]{0,31})`;
+var CLIENT_ERROR_ROUTE_PATTERN = new RegExp(
+  String.raw`^(?=.{1,160}$)(?:unknown|/|(?:/${ROUTE_SEGMENT}){1,12})$`
+);
+var CLIENT_ERROR_REVISION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
+var CLIENT_SIGNALS = ["request_failure", "stream", "web_vital"];
+var CLIENT_REQUEST_ACTIONS = [
+  "create_session",
+  "send_message",
+  "steer_message",
+  "composer_submit",
+  "retry_turn",
+  "connect_integration",
+  "connect_model",
+  "checkout_start"
+];
+var CLIENT_REQUEST_FAILURE_REASONS = ["network", "timeout", "offline"];
+var CLIENT_STREAMS = ["session", "workspace"];
+var CLIENT_STREAM_EVENTS = [
+  "reconnect",
+  "reconnect_exhausted",
+  "long_disconnect"
+];
+var CLIENT_WEB_VITAL_METRICS = ["lcp", "inp", "cls", "ttfb"];
+var CLIENT_WEB_VITAL_MAX_VALUE = {
+  lcp: 600,
+  inp: 600,
+  cls: 100,
+  ttfb: 600
+};
+var CLIENT_PAGES = [
+  "sessions",
+  "priority",
+  "plugins",
+  "capabilities",
+  "documents",
+  "state",
+  "memory",
+  "schedules",
+  "artifacts",
+  "settings",
+  "organization",
+  "insights",
+  "machines",
+  "files",
+  "agents",
+  "variable-sets",
+  "environments",
+  "rigs",
+  "home",
+  "session-link",
+  "identity-link",
+  "checkout-return",
+  "integration-return",
+  "device",
+  "connect-agent",
+  "reset-password",
+  "setup-account",
+  "account-auth",
+  "personal-security",
+  "other"
+];
+export {
+  CLIENT_ERRORS_PATH,
+  CLIENT_ERROR_KINDS,
+  CLIENT_ERROR_REPORT_MAX_BYTES,
+  CLIENT_ERROR_REVISION_PATTERN,
+  CLIENT_ERROR_ROUTE_PATTERN,
+  CLIENT_PAGES,
+  CLIENT_REQUEST_ACTIONS,
+  CLIENT_REQUEST_FAILURE_REASONS,
+  CLIENT_SIGNALS,
+  CLIENT_STREAMS,
+  CLIENT_STREAM_EVENTS,
+  CLIENT_WEB_VITAL_MAX_VALUE,
+  CLIENT_WEB_VITAL_METRICS
+};
+//# sourceMappingURL=client-error-report.js.map

package/dist/client-error-report.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client-error-report.ts"],"sourcesContent":["/**\n * Wire grammar of the content-free web client error beacon\n * (`POST /v1/client-errors`).\n *\n * A report is only a closed error kind, the matched route PATTERN (never a\n * concrete URL), and the bundle revision. The web client that projects a\n * report, the API route that admits it, and the public structured-log\n * projection that prints it all validate against these exact values, so the\n * browser can only send what the API accepts and logs.\n *\n * The same route also admits the closed operational signals below (requests\n * that never reached the server, live-stream health, and web vitals). They\n * follow the same rules: closed values only, a route pattern or page label,\n * never a URL, message, identifier, or user content.\n */\nexport const CLIENT_ERRORS_PATH = \"/v1/client-errors\";\n\nexport const CLIENT_ERROR_KINDS = [\n  \"route_error\",\n  \"unhandled_rejection\",\n  \"window_error\",\n  \"chunk_load\",\n] as const;\nexport type ClientErrorKind = (typeof CLIENT_ERROR_KINDS)[number];\n\n/** Largest accepted report body. A valid report is well under 256 bytes. */\nexport const CLIENT_ERROR_REPORT_MAX_BYTES = 512;\n\nconst ROUTE_SEGMENT = String.raw`(?:[a-z]+(?:-[a-z]+)*|\\$[A-Za-z][A-Za-z0-9]{0,31})`;\n\n/**\n * A route pattern of at most 160 characters that is `/`, `unknown`, or up to\n * twelve `/`-separated segments that are each either a lowercase literal\n * (`variable-sets`) or a `$param` placeholder. The grammar excludes digits in\n * literals, so a concrete id cannot pass as one.\n */\nexport const CLIENT_ERROR_ROUTE_PATTERN = new RegExp(\n  String.raw`^(?=.{1,160}$)(?:unknown|/|(?:/${ROUTE_SEGMENT}){1,12})$`,\n);\n\n/** The bundle revision token (a commit SHA, `dev`, or `unknown`). */\nexport const CLIENT_ERROR_REVISION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;\n\nexport type ClientErrorReport = { kind: ClientErrorKind; route: string; revision: string };\n\n/**\n * Content-free operational signals that share the error beacon route. A\n * signal report carries a `signal` discriminator and only closed values; a\n * report without `signal` is a {@link ClientErrorReport}. Older API servers\n * reject signal reports as invalid, so the extension is backward compatible in\n * both directions.\n */\nexport const CLIENT_SIGNALS = [\"request_failure\", \"stream\", \"web_vital\"] as const;\nexport type ClientSignal = (typeof CLIENT_SIGNALS)[number];\n\n/**\n * Key product mutations whose failure before any HTTP response is counted.\n * `send_message` includes sends the server queues behind an active turn.\n */\nexport const CLIENT_REQUEST_ACTIONS = [\n  \"create_session\",\n  \"send_message\",\n  \"steer_message\",\n  \"composer_submit\",\n  \"retry_turn\",\n  \"connect_integration\",\n  \"connect_model\",\n  \"checkout_start\",\n] as const;\nexport type ClientRequestAction = (typeof CLIENT_REQUEST_ACTIONS)[number];\n\n/**\n * Why a request never produced an HTTP response: the browser reported no\n * connectivity (`offline`), the client's own deadline expired (`timeout`), or\n * the transport failed (`network`). Cancellations the user or the app\n * initiated are never reported.\n */\nexport const CLIENT_REQUEST_FAILURE_REASONS = [\"network\", \"timeout\", \"offline\"] as const;\nexport type ClientRequestFailureReason = (typeof CLIENT_REQUEST_FAILURE_REASONS)[number];\n\n/** Browser live streams: one session's event stream, or the workspace live stream. */\nexport const CLIENT_STREAMS = [\"session\", \"workspace\"] as const;\nexport type ClientStream = (typeof CLIENT_STREAMS)[number];\n\n/**\n * Live stream health: a live stream dropped and started reconnecting\n * (`reconnect`), stopped reconnecting (`reconnect_exhausted`), or stayed\n * disconnected for longer than the long-disconnect threshold while the tab\n * was visible (`long_disconnect`).\n */\nexport const CLIENT_STREAM_EVENTS = [\n  \"reconnect\",\n  \"reconnect_exhausted\",\n  \"long_disconnect\",\n] as const;\nexport type ClientStreamEvent = (typeof CLIENT_STREAM_EVENTS)[number];\n\n/** Core Web Vitals plus time to first byte, measured once per document. */\nexport const CLIENT_WEB_VITAL_METRICS = [\"lcp\", \"inp\", \"cls\", \"ttfb\"] as const;\nexport type ClientWebVitalMetric = (typeof CLIENT_WEB_VITAL_METRICS)[number];\n\n/**\n * Largest accepted value: seconds for the timing metrics, the unitless layout\n * shift score for `cls`.\n */\nexport const CLIENT_WEB_VITAL_MAX_VALUE: Readonly<Record<ClientWebVitalMetric, number>> = {\n  lcp: 600,\n  inp: 600,\n  cls: 100,\n  ttfb: 600,\n};\n\n/**\n * The closed page labels of the web console's product-journey projection\n * (`journeyPage` in apps/web/src/lib/analytics-journey.ts; a drift test keeps\n * the two identical). Workspace pages are the first path segment after\n * `/workspaces/<id>/`; the rest are exact top-level routes.\n */\nexport const CLIENT_PAGES = [\n  \"sessions\",\n  \"priority\",\n  \"plugins\",\n  \"capabilities\",\n  \"documents\",\n  \"state\",\n  \"memory\",\n  \"schedules\",\n  \"artifacts\",\n  \"settings\",\n  \"organization\",\n  \"insights\",\n  \"machines\",\n  \"files\",\n  \"agents\",\n  \"variable-sets\",\n  \"environments\",\n  \"rigs\",\n  \"home\",\n  \"session-link\",\n  \"identity-link\",\n  \"checkout-return\",\n  \"integration-return\",\n  \"device\",\n  \"connect-agent\",\n  \"reset-password\",\n  \"setup-account\",\n  \"account-auth\",\n  \"personal-security\",\n  \"other\",\n] as const;\nexport type ClientPage = (typeof CLIENT_PAGES)[number];\n\nexport type ClientRequestFailureReport = {\n  signal: \"request_failure\";\n  action: ClientRequestAction;\n  reason: ClientRequestFailureReason;\n  route: string;\n  revision: string;\n};\n\nexport type ClientStreamReport = {\n  signal: \"stream\";\n  stream: ClientStream;\n  event: ClientStreamEvent;\n  route: string;\n  revision: string;\n};\n\nexport type ClientWebVitalReport = {\n  signal: \"web_vital\";\n  metric: ClientWebVitalMetric;\n  page: ClientPage;\n  /** Seconds for timing metrics, the unitless score for `cls`. */\n  value: number;\n  revision: string;\n};\n\nexport type ClientSignalReport =\n  | ClientRequestFailureReport\n  | ClientStreamReport\n  | ClientWebVitalReport;\n\n/** Every body the beacon route accepts. */\nexport type ClientBeaconReport = ClientErrorReport | ClientSignalReport;\n"],"mappings":";AAeO,IAAM,qBAAqB;AAE3B,IAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIO,IAAM,gCAAgC;AAE7C,IAAM,gBAAgB,OAAO;AAQtB,IAAM,6BAA6B,IAAI;AAAA,EAC5C,OAAO,qCAAqC,aAAa;AAC3D;AAGO,IAAM,gCAAgC;AAWtC,IAAM,iBAAiB,CAAC,mBAAmB,UAAU,WAAW;AAOhE,IAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,IAAM,iCAAiC,CAAC,WAAW,WAAW,SAAS;AAIvE,IAAM,iBAAiB,CAAC,WAAW,WAAW;AAS9C,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AACF;AAIO,IAAM,2BAA2B,CAAC,OAAO,OAAO,OAAO,MAAM;AAO7D,IAAM,6BAA6E;AAAA,EACxF,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AACR;AAQO,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;","names":[]}

package/dist/code-search.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Directories holding platform credential material that `code_search` never
+ * searches or reads, as path segments matched at any depth: OpenGeni's
+ * sandbox state (`.opengeni/`: Codemode bearer tokens, Git credential files
+ * and bindings), the Azure CLI login cache (`.azure/`, from the sandbox's
+ * service-principal login with HOME=/workspace) and a Connected Machine
+ * agent's enrollment credentials (`.config/opengeni/`). The sandbox channel
+ * enforces this list; `@opengeni/jev` keeps the same list for its engine, and
+ * a worker test pins that the two agree.
+ */
+export declare const CODE_SEARCH_CREDENTIAL_DIRS: readonly (readonly string[])[];
+/**
+ * The deployment half of the `code_search` decision. `split` gives the tool to
+ * a fixed half of sessions (see `codeSearchSessionInExperiment`) so staging can
+ * compare sessions with and without it.
+ */
+export type CodeSearchWorkspaceDefault = "off" | "on" | "split";
+export type CodeSearchDeploymentPolicy = {
+    available: boolean;
+    workspaceDefault: CodeSearchWorkspaceDefault;
+};
+/**
+ * What a workspace gets: the deployment decides first, so nothing enables the
+ * tool where the deployment does not offer it. Otherwise an explicit workspace
+ * choice wins, and an absent, null or malformed setting follows the deployment
+ * default. Only this field is read, so an invalid sibling setting cannot turn
+ * an explicit Off back into the deployment default.
+ */
+export declare function resolveWorkspaceCodeSearchMode(settings: unknown, deployment: CodeSearchDeploymentPolicy): CodeSearchWorkspaceDefault;
+/**
+ * Fixed per-session half for the `split` experiment: 32-bit FNV-1a of the
+ * session id, low bit 0 gets the tool. Deterministic and dependency-free, so
+ * a root session's arm can be recomputed from its id. Child sessions inherit
+ * their parent's decision instead.
+ */
+export declare function codeSearchSessionInExperiment(sessionId: string): boolean;
+/**
+ * The decision frozen on a new root session when it is created. Later changes
+ * to the workspace setting or the deployment mode never turn the tool on for a
+ * session that was created without it.
+ */
+export declare function resolveSessionCodeSearchEnabled(settings: unknown, deployment: CodeSearchDeploymentPolicy, sessionId: string): boolean;
+/**
+ * Whether a turn of this session gets `code_search`. Only a session frozen on
+ * at creation can have it. The deployment (mode off or no usable key) and an
+ * explicit workspace Off still pause it in running sessions, because they stop
+ * repository content going to Jev; undoing that switch-off gives it back to
+ * sessions frozen on. Each such change costs every affected session one
+ * prompt-cache miss, which is accepted for a deliberate switch. Nothing else
+ * changes the tool list of a running session.
+ */
+export declare function codeSearchEnabledForTurn(frozen: boolean | null | undefined, settings: unknown, deployment: CodeSearchDeploymentPolicy): boolean;

package/dist/code-search.js

@@ -0,0 +1,40 @@
+// src/code-search.ts
+var CODE_SEARCH_CREDENTIAL_DIRS = [
+  [".opengeni"],
+  [".azure"],
+  [".config", "opengeni"]
+];
+function resolveWorkspaceCodeSearchMode(settings, deployment) {
+  if (!deployment.available) return "off";
+  const explicit = explicitWorkspaceCodeSearchSetting(settings);
+  if (explicit === true) return "on";
+  if (explicit === false) return "off";
+  return deployment.workspaceDefault;
+}
+function explicitWorkspaceCodeSearchSetting(settings) {
+  const explicit = typeof settings === "object" && settings !== null ? settings.codeSearchEnabled : void 0;
+  return typeof explicit === "boolean" ? explicit : void 0;
+}
+function codeSearchSessionInExperiment(sessionId) {
+  let hash = 2166136261;
+  for (let index = 0; index < sessionId.length; index++) {
+    hash ^= sessionId.charCodeAt(index);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return (hash & 1) === 0;
+}
+function resolveSessionCodeSearchEnabled(settings, deployment, sessionId) {
+  const mode = resolveWorkspaceCodeSearchMode(settings, deployment);
+  return mode === "on" || mode === "split" && codeSearchSessionInExperiment(sessionId);
+}
+function codeSearchEnabledForTurn(frozen, settings, deployment) {
+  return frozen === true && deployment.available && explicitWorkspaceCodeSearchSetting(settings) !== false;
+}
+export {
+  CODE_SEARCH_CREDENTIAL_DIRS,
+  codeSearchEnabledForTurn,
+  codeSearchSessionInExperiment,
+  resolveSessionCodeSearchEnabled,
+  resolveWorkspaceCodeSearchMode
+};
+//# sourceMappingURL=code-search.js.map

package/dist/code-search.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/code-search.ts"],"sourcesContent":["// Resolvers for the optional Jev-backed `code_search` agent tool. A separate\n// subpath keeps them out of browser bundles; only server code decides.\n\n/**\n * Directories holding platform credential material that `code_search` never\n * searches or reads, as path segments matched at any depth: OpenGeni's\n * sandbox state (`.opengeni/`: Codemode bearer tokens, Git credential files\n * and bindings), the Azure CLI login cache (`.azure/`, from the sandbox's\n * service-principal login with HOME=/workspace) and a Connected Machine\n * agent's enrollment credentials (`.config/opengeni/`). The sandbox channel\n * enforces this list; `@opengeni/jev` keeps the same list for its engine, and\n * a worker test pins that the two agree.\n */\nexport const CODE_SEARCH_CREDENTIAL_DIRS: readonly (readonly string[])[] = [\n  [\".opengeni\"],\n  [\".azure\"],\n  [\".config\", \"opengeni\"],\n];\n\n/**\n * The deployment half of the `code_search` decision. `split` gives the tool to\n * a fixed half of sessions (see `codeSearchSessionInExperiment`) so staging can\n * compare sessions with and without it.\n */\nexport type CodeSearchWorkspaceDefault = \"off\" | \"on\" | \"split\";\nexport type CodeSearchDeploymentPolicy = {\n  available: boolean;\n  workspaceDefault: CodeSearchWorkspaceDefault;\n};\n\n/**\n * What a workspace gets: the deployment decides first, so nothing enables the\n * tool where the deployment does not offer it. Otherwise an explicit workspace\n * choice wins, and an absent, null or malformed setting follows the deployment\n * default. Only this field is read, so an invalid sibling setting cannot turn\n * an explicit Off back into the deployment default.\n */\nexport function resolveWorkspaceCodeSearchMode(\n  settings: unknown,\n  deployment: CodeSearchDeploymentPolicy,\n): CodeSearchWorkspaceDefault {\n  if (!deployment.available) return \"off\";\n  const explicit = explicitWorkspaceCodeSearchSetting(settings);\n  if (explicit === true) return \"on\";\n  if (explicit === false) return \"off\";\n  return deployment.workspaceDefault;\n}\n\nfunction explicitWorkspaceCodeSearchSetting(settings: unknown): boolean | undefined {\n  const explicit =\n    typeof settings === \"object\" && settings !== null\n      ? (settings as { codeSearchEnabled?: unknown }).codeSearchEnabled\n      : undefined;\n  return typeof explicit === \"boolean\" ? explicit : undefined;\n}\n\n/**\n * Fixed per-session half for the `split` experiment: 32-bit FNV-1a of the\n * session id, low bit 0 gets the tool. Deterministic and dependency-free, so\n * a root session's arm can be recomputed from its id. Child sessions inherit\n * their parent's decision instead.\n */\nexport function codeSearchSessionInExperiment(sessionId: string): boolean {\n  let hash = 0x811c9dc5;\n  for (let index = 0; index < sessionId.length; index++) {\n    hash ^= sessionId.charCodeAt(index);\n    hash = Math.imul(hash, 0x01000193) >>> 0;\n  }\n  return (hash & 1) === 0;\n}\n\n/**\n * The decision frozen on a new root session when it is created. Later changes\n * to the workspace setting or the deployment mode never turn the tool on for a\n * session that was created without it.\n */\nexport function resolveSessionCodeSearchEnabled(\n  settings: unknown,\n  deployment: CodeSearchDeploymentPolicy,\n  sessionId: string,\n): boolean {\n  const mode = resolveWorkspaceCodeSearchMode(settings, deployment);\n  return mode === \"on\" || (mode === \"split\" && codeSearchSessionInExperiment(sessionId));\n}\n\n/**\n * Whether a turn of this session gets `code_search`. Only a session frozen on\n * at creation can have it. The deployment (mode off or no usable key) and an\n * explicit workspace Off still pause it in running sessions, because they stop\n * repository content going to Jev; undoing that switch-off gives it back to\n * sessions frozen on. Each such change costs every affected session one\n * prompt-cache miss, which is accepted for a deliberate switch. Nothing else\n * changes the tool list of a running session.\n */\nexport function codeSearchEnabledForTurn(\n  frozen: boolean | null | undefined,\n  settings: unknown,\n  deployment: CodeSearchDeploymentPolicy,\n): boolean {\n  return (\n    frozen === true &&\n    deployment.available &&\n    explicitWorkspaceCodeSearchSetting(settings) !== false\n  );\n}\n"],"mappings":";AAaO,IAAM,8BAA8D;AAAA,EACzE,CAAC,WAAW;AAAA,EACZ,CAAC,QAAQ;AAAA,EACT,CAAC,WAAW,UAAU;AACxB;AAoBO,SAAS,+BACd,UACA,YAC4B;AAC5B,MAAI,CAAC,WAAW,UAAW,QAAO;AAClC,QAAM,WAAW,mCAAmC,QAAQ;AAC5D,MAAI,aAAa,KAAM,QAAO;AAC9B,MAAI,aAAa,MAAO,QAAO;AAC/B,SAAO,WAAW;AACpB;AAEA,SAAS,mCAAmC,UAAwC;AAClF,QAAM,WACJ,OAAO,aAAa,YAAY,aAAa,OACxC,SAA6C,oBAC9C;AACN,SAAO,OAAO,aAAa,YAAY,WAAW;AACpD;AAQO,SAAS,8BAA8B,WAA4B;AACxE,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,UAAU,QAAQ,SAAS;AACrD,YAAQ,UAAU,WAAW,KAAK;AAClC,WAAO,KAAK,KAAK,MAAM,QAAU,MAAM;AAAA,EACzC;AACA,UAAQ,OAAO,OAAO;AACxB;AAOO,SAAS,gCACd,UACA,YACA,WACS;AACT,QAAM,OAAO,+BAA+B,UAAU,UAAU;AAChE,SAAO,SAAS,QAAS,SAAS,WAAW,8BAA8B,SAAS;AACtF;AAWO,SAAS,yBACd,QACA,UACA,YACS;AACT,SACE,WAAW,QACX,WAAW,aACX,mCAAmC,QAAQ,MAAM;AAErD;","names":[]}

package/dist/codex-provider-account-authority.d.ts

@@ -0,0 +1,23 @@
+import { z } from "zod";
+/**
+ * Opaque authority frozen at a Codex provider-account acceptance boundary.
+ *
+ * The snapshot deliberately carries no organization, membership, credential,
+ * provider-account, subject, label, quota, token, or plan identity. A later
+ * activation slice may use the user generation only together with separately
+ * authorized durable state; this value is never sufficient authority alone.
+ */
+export declare const CodexProviderAccountAuthoritySnapshotV1: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    scope: z.ZodLiteral<"workspace">;
+}, z.core.$strict>, z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    scope: z.ZodLiteral<"user">;
+    authorityGeneration: z.ZodNumber;
+}, z.core.$strict>], "scope">;
+export type CodexProviderAccountAuthoritySnapshotV1 = z.infer<typeof CodexProviderAccountAuthoritySnapshotV1>;
+/** Explicit compatibility value for all pre-foundation accepted work. */
+export declare const LEGACY_WORKSPACE_CODEX_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1: {
+    readonly version: 1;
+    readonly scope: "workspace";
+};

package/dist/codex-provider-account-authority.js

@@ -0,0 +1,23 @@
+// src/codex-provider-account-authority.ts
+import { z } from "zod";
+var PositiveSafeInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+var CodexProviderAccountAuthoritySnapshotV1 = z.discriminatedUnion("scope", [
+  z.object({
+    version: z.literal(1),
+    scope: z.literal("workspace")
+  }).strict(),
+  z.object({
+    version: z.literal(1),
+    scope: z.literal("user"),
+    authorityGeneration: PositiveSafeInteger
+  }).strict()
+]);
+var LEGACY_WORKSPACE_CODEX_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {
+  version: 1,
+  scope: "workspace"
+};
+export {
+  CodexProviderAccountAuthoritySnapshotV1,
+  LEGACY_WORKSPACE_CODEX_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1
+};
+//# sourceMappingURL=codex-provider-account-authority.js.map

package/dist/codex-provider-account-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/codex-provider-account-authority.ts"],"sourcesContent":["import { z } from \"zod\";\n\nconst PositiveSafeInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);\n\n/**\n * Opaque authority frozen at a Codex provider-account acceptance boundary.\n *\n * The snapshot deliberately carries no organization, membership, credential,\n * provider-account, subject, label, quota, token, or plan identity. A later\n * activation slice may use the user generation only together with separately\n * authorized durable state; this value is never sufficient authority alone.\n */\nexport const CodexProviderAccountAuthoritySnapshotV1 = z.discriminatedUnion(\"scope\", [\n  z\n    .object({\n      version: z.literal(1),\n      scope: z.literal(\"workspace\"),\n    })\n    .strict(),\n  z\n    .object({\n      version: z.literal(1),\n      scope: z.literal(\"user\"),\n      authorityGeneration: PositiveSafeInteger,\n    })\n    .strict(),\n]);\n\nexport type CodexProviderAccountAuthoritySnapshotV1 = z.infer<\n  typeof CodexProviderAccountAuthoritySnapshotV1\n>;\n\n/** Explicit compatibility value for all pre-foundation accepted work. */\nexport const LEGACY_WORKSPACE_CODEX_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {\n  version: 1,\n  scope: \"workspace\",\n} as const satisfies CodexProviderAccountAuthoritySnapshotV1;\n"],"mappings":";AAAA,SAAS,SAAS;AAElB,IAAM,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,OAAO,gBAAgB;AAU5E,IAAM,0CAA0C,EAAE,mBAAmB,SAAS;AAAA,EACnF,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,CAAC;AAAA,IACpB,OAAO,EAAE,QAAQ,WAAW;AAAA,EAC9B,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,CAAC;AAAA,IACpB,OAAO,EAAE,QAAQ,MAAM;AAAA,IACvB,qBAAqB;AAAA,EACvB,CAAC,EACA,OAAO;AACZ,CAAC;AAOM,IAAM,gEAAgE;AAAA,EAC3E,SAAS;AAAA,EACT,OAAO;AACT;","names":[]}