@opengeni/contracts 0.44.1 → 1.0.0

package/dist/managed-auth-session-sets.d.ts

@@ -0,0 +1,241 @@
+import { z } from "zod";
+export declare const MANAGED_AUTH_SESSION_SET_MAX_SLOTS: 8;
+export declare const MANAGED_AUTH_TRANSACTION_TTL_SECONDS: 600;
+export declare const MANAGED_AUTH_RETURN_INTENT_MAX_BYTES: 2048;
+export declare const MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER: "x-opengeni-api-contract";
+export declare const MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION: "2026-08-personal-only-organization-setup-v1";
+export declare const ManagedAuthSessionSetMode: z.ZodEnum<{
+    broker: "broker";
+    dual: "dual";
+    legacy: "legacy";
+}>;
+export type ManagedAuthSessionSetMode = z.infer<typeof ManagedAuthSessionSetMode>;
+export declare const ManagedAuthLoginSlotState: z.ZodEnum<{
+    active: "active";
+    reauth_required: "reauth_required";
+}>;
+export type ManagedAuthLoginSlotState = z.infer<typeof ManagedAuthLoginSlotState>;
+export declare const ManagedAuthVerifiedClaim: z.ZodObject<{
+    kind: z.ZodLiteral<"email">;
+    value: z.ZodString;
+}, z.core.$strip>;
+export type ManagedAuthVerifiedClaim = z.infer<typeof ManagedAuthVerifiedClaim>;
+/** Secret-free, browser-safe summary. Provider session ids and tokens never enter this shape. */
+export declare const ManagedAuthLoginSlot: z.ZodObject<{
+    id: z.ZodString;
+    displayName: z.ZodString;
+    verifiedClaim: z.ZodObject<{
+        kind: z.ZodLiteral<"email">;
+        value: z.ZodString;
+    }, z.core.$strip>;
+    state: z.ZodEnum<{
+        active: "active";
+        reauth_required: "reauth_required";
+    }>;
+}, z.core.$strip>;
+export type ManagedAuthLoginSlot = z.infer<typeof ManagedAuthLoginSlot>;
+export declare const ManagedAuthSessionSetState: z.ZodEnum<{
+    actor_change_required: "actor_change_required";
+    ready: "ready";
+}>;
+export type ManagedAuthSessionSetState = z.infer<typeof ManagedAuthSessionSetState>;
+export declare const ManagedAuthSessionSetProjection: z.ZodObject<{
+    mode: z.ZodEnum<{
+        broker: "broker";
+        dual: "dual";
+        legacy: "legacy";
+    }>;
+    generation: z.ZodString;
+    actorEpoch: z.ZodString;
+    csrfToken: z.ZodString;
+    selectedSlotId: z.ZodNullable<z.ZodString>;
+    state: z.ZodEnum<{
+        actor_change_required: "actor_change_required";
+        ready: "ready";
+    }>;
+    slots: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        displayName: z.ZodString;
+        verifiedClaim: z.ZodObject<{
+            kind: z.ZodLiteral<"email">;
+            value: z.ZodString;
+        }, z.core.$strip>;
+        state: z.ZodEnum<{
+            active: "active";
+            reauth_required: "reauth_required";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ManagedAuthSessionSetProjection = z.infer<typeof ManagedAuthSessionSetProjection>;
+export declare const ManagedAuthOperationIdentity: z.ZodObject<{
+    operationId: z.ZodString;
+    expectedGeneration: z.ZodString;
+}, z.core.$strip>;
+export type ManagedAuthOperationIdentity = z.infer<typeof ManagedAuthOperationIdentity>;
+export declare const BootstrapManagedAuthSessionSetRequest: z.ZodObject<{
+    operationId: z.ZodString;
+    expectedGeneration: z.ZodString;
+}, z.core.$strip>;
+export type BootstrapManagedAuthSessionSetRequest = z.infer<typeof BootstrapManagedAuthSessionSetRequest>;
+export declare const ManagedAuthReturnIntent: z.ZodString;
+export declare const BeginManagedAuthLoginTransactionRequest: z.ZodObject<{
+    operationId: z.ZodString;
+    expectedGeneration: z.ZodString;
+    kind: z.ZodEnum<{
+        add: "add";
+        reauth: "reauth";
+    }>;
+    slotId: z.ZodOptional<z.ZodString>;
+    returnIntent: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type BeginManagedAuthLoginTransactionRequest = z.infer<typeof BeginManagedAuthLoginTransactionRequest>;
+export declare const ManagedAuthLoginTransaction: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        add: "add";
+        reauth: "reauth";
+    }>;
+    expiresAt: z.ZodString;
+    returnIntentId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ManagedAuthLoginTransaction = z.infer<typeof ManagedAuthLoginTransaction>;
+export declare const ManagedAuthSocialProvider: z.ZodEnum<{
+    github: "github";
+    google: "google";
+}>;
+export type ManagedAuthSocialProvider = z.infer<typeof ManagedAuthSocialProvider>;
+export declare const StartManagedAuthSocialTransactionRequest: z.ZodObject<{
+    operationId: z.ZodString;
+    expectedGeneration: z.ZodString;
+    transactionId: z.ZodString;
+    provider: z.ZodEnum<{
+        github: "github";
+        google: "google";
+    }>;
+    attribution: z.ZodCatch<z.ZodOptional<z.ZodObject<{
+        utmSource: z.ZodOptional<z.ZodString>;
+        utmMedium: z.ZodOptional<z.ZodString>;
+        utmCampaign: z.ZodOptional<z.ZodString>;
+        utmContent: z.ZodOptional<z.ZodString>;
+        ref: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+}, z.core.$strip>;
+export type StartManagedAuthSocialTransactionRequest = z.infer<typeof StartManagedAuthSocialTransactionRequest>;
+export declare const StartManagedAuthSocialTransactionResponse: z.ZodObject<{
+    url: z.ZodString;
+}, z.core.$strip>;
+export type StartManagedAuthSocialTransactionResponse = z.infer<typeof StartManagedAuthSocialTransactionResponse>;
+export declare const CompleteManagedAuthEmailPasswordTransactionRequest: z.ZodObject<{
+    operationId: z.ZodString;
+    expectedGeneration: z.ZodString;
+    transactionId: z.ZodString;
+    email: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>;
+export type CompleteManagedAuthEmailPasswordTransactionRequest = z.infer<typeof CompleteManagedAuthEmailPasswordTransactionRequest>;
+export declare const CompleteManagedAuthLoginTransactionResponse: z.ZodObject<{
+    projection: z.ZodObject<{
+        mode: z.ZodEnum<{
+            broker: "broker";
+            dual: "dual";
+            legacy: "legacy";
+        }>;
+        generation: z.ZodString;
+        actorEpoch: z.ZodString;
+        csrfToken: z.ZodString;
+        selectedSlotId: z.ZodNullable<z.ZodString>;
+        state: z.ZodEnum<{
+            actor_change_required: "actor_change_required";
+            ready: "ready";
+        }>;
+        slots: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            displayName: z.ZodString;
+            verifiedClaim: z.ZodObject<{
+                kind: z.ZodLiteral<"email">;
+                value: z.ZodString;
+            }, z.core.$strip>;
+            state: z.ZodEnum<{
+                active: "active";
+                reauth_required: "reauth_required";
+            }>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+    returnIntent: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type CompleteManagedAuthLoginTransactionResponse = z.infer<typeof CompleteManagedAuthLoginTransactionResponse>;
+export declare const CancelManagedAuthLoginTransactionRequest: z.ZodObject<{
+    operationId: z.ZodString;
+    expectedGeneration: z.ZodString;
+    transactionId: z.ZodString;
+}, z.core.$strip>;
+export type CancelManagedAuthLoginTransactionRequest = z.infer<typeof CancelManagedAuthLoginTransactionRequest>;
+export declare const SelectManagedAuthLoginSlotRequest: z.ZodObject<{
+    operationId: z.ZodString;
+    expectedGeneration: z.ZodString;
+    slotId: z.ZodString;
+}, z.core.$strip>;
+export type SelectManagedAuthLoginSlotRequest = z.infer<typeof SelectManagedAuthLoginSlotRequest>;
+export declare const LogoutManagedAuthLoginSlotRequest: z.ZodObject<{
+    operationId: z.ZodString;
+    expectedGeneration: z.ZodString;
+    slotId: z.ZodString;
+    replacementSlotId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type LogoutManagedAuthLoginSlotRequest = z.infer<typeof LogoutManagedAuthLoginSlotRequest>;
+export declare const LogoutManagedAuthSessionSetRequest: z.ZodObject<{
+    operationId: z.ZodString;
+    expectedGeneration: z.ZodString;
+}, z.core.$strip>;
+export type LogoutManagedAuthSessionSetRequest = z.infer<typeof LogoutManagedAuthSessionSetRequest>;
+export declare const ManagedAuthLogoutAllReceipt: z.ZodObject<{
+    generation: z.ZodString;
+    actorEpoch: z.ZodString;
+    state: z.ZodLiteral<"logged_out">;
+}, z.core.$strip>;
+export type ManagedAuthLogoutAllReceipt = z.infer<typeof ManagedAuthLogoutAllReceipt>;
+export declare const ResolveManagedAuthDeepLinkRequest: z.ZodObject<{
+    path: z.ZodString;
+}, z.core.$strip>;
+export type ResolveManagedAuthDeepLinkRequest = z.infer<typeof ResolveManagedAuthDeepLinkRequest>;
+export declare const ManagedAuthDeepLinkResolution: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"current">;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"switch_required">;
+    slot: z.ZodObject<{
+        id: z.ZodString;
+        displayName: z.ZodString;
+        verifiedClaim: z.ZodObject<{
+            kind: z.ZodLiteral<"email">;
+            value: z.ZodString;
+        }, z.core.$strip>;
+        state: z.ZodEnum<{
+            active: "active";
+            reauth_required: "reauth_required";
+        }>;
+    }, z.core.$strip>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"unavailable">;
+}, z.core.$strip>], "kind">;
+export type ManagedAuthDeepLinkResolution = z.infer<typeof ManagedAuthDeepLinkResolution>;
+export declare const ManagedAuthSessionSetErrorCode: z.ZodEnum<{
+    actor_change_required: "actor_change_required";
+    actor_mutation_in_flight: "actor_mutation_in_flight";
+    api_contract_changed: "api_contract_changed";
+    browser_session_set_required: "browser_session_set_required";
+    browser_session_set_unavailable: "browser_session_set_unavailable";
+    generation_conflict: "generation_conflict";
+    invalid_browser_session_set_request: "invalid_browser_session_set_request";
+    invalid_transaction: "invalid_transaction";
+    login_transaction_rate_limited: "login_transaction_rate_limited";
+    managed_authentication_required: "managed_authentication_required";
+    managed_authentication_unavailable: "managed_authentication_unavailable";
+    operation_outcome_unknown: "operation_outcome_unknown";
+    operation_reused: "operation_reused";
+    origin_rejected: "origin_rejected";
+    provider_route_blocked: "provider_route_blocked";
+    slot_already_exists: "slot_already_exists";
+    slot_limit_reached: "slot_limit_reached";
+    slot_unavailable: "slot_unavailable";
+}>;
+export type ManagedAuthSessionSetErrorCode = z.infer<typeof ManagedAuthSessionSetErrorCode>;

package/dist/managed-auth-session-sets.js

@@ -0,0 +1,191 @@
+// src/managed-auth-session-sets.ts
+import { z } from "zod";
+var MANAGED_AUTH_SESSION_SET_MAX_SLOTS = 8;
+var MANAGED_AUTH_TRANSACTION_TTL_SECONDS = 600;
+var MANAGED_AUTH_RETURN_INTENT_MAX_BYTES = 2048;
+var MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER = "x-opengeni-api-contract";
+var MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION = "2026-08-personal-only-organization-setup-v1";
+var ManagedAuthSessionSetMode = z.enum(["legacy", "dual", "broker"]);
+var ManagedAuthLoginSlotState = z.enum(["active", "reauth_required"]);
+var ManagedAuthVerifiedClaim = z.object({
+  kind: z.literal("email"),
+  value: z.string().email().max(320)
+});
+var ManagedAuthLoginSlot = z.object({
+  id: z.string().uuid(),
+  displayName: z.string().min(1).max(256),
+  verifiedClaim: ManagedAuthVerifiedClaim,
+  state: ManagedAuthLoginSlotState
+});
+var ManagedAuthSessionSetState = z.enum(["ready", "actor_change_required"]);
+var ManagedAuthSessionSetProjection = z.object({
+  mode: ManagedAuthSessionSetMode,
+  generation: z.string().regex(/^[1-9][0-9]*$/),
+  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),
+  csrfToken: z.string().min(32).max(512),
+  selectedSlotId: z.string().uuid().nullable(),
+  state: ManagedAuthSessionSetState,
+  slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS)
+});
+var ManagedAuthOperationIdentity = z.object({
+  operationId: z.string().uuid(),
+  expectedGeneration: z.string().regex(/^[1-9][0-9]*$/)
+});
+var BootstrapManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;
+var ManagedAuthReturnIntent = z.string().min(1).superRefine((value, context) => {
+  if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {
+    context.addIssue({ code: "custom", message: "return intent exceeds its UTF-8 byte limit" });
+  }
+  if (!value.startsWith("/") || value.startsWith("//") || value.includes("?") || value.includes("#") || /[\u0000-\u001f\u007f\\]/.test(value)) {
+    context.addIssue({
+      code: "custom",
+      message: "return intent must be a safe same-origin path"
+    });
+    return;
+  }
+  try {
+    const parsed = new URL(value, "https://opengeni.invalid");
+    const uuid = "[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}";
+    const supportedPath = new RegExp(
+      `^/(?:sessions/${uuid}|workspaces/${uuid}(?:/sessions(?:/${uuid})?)?)$`,
+      "i"
+    );
+    if (parsed.origin !== "https://opengeni.invalid" || parsed.username || parsed.password || parsed.search || parsed.hash || !supportedPath.test(value) || parsed.pathname !== value) {
+      context.addIssue({
+        code: "custom",
+        message: "return intent contains unsafe authority data"
+      });
+    }
+  } catch {
+    context.addIssue({
+      code: "custom",
+      message: "return intent is not a valid same-origin path"
+    });
+  }
+});
+var BeginManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({
+  kind: z.enum(["add", "reauth"]),
+  slotId: z.string().uuid().optional(),
+  returnIntent: ManagedAuthReturnIntent.optional()
+}).superRefine((value, context) => {
+  if (value.kind === "reauth" !== Boolean(value.slotId)) {
+    context.addIssue({
+      code: "custom",
+      path: ["slotId"],
+      message: "reauth requires exactly one slot id and add forbids one"
+    });
+  }
+});
+var ManagedAuthLoginTransaction = z.object({
+  id: z.string().uuid(),
+  kind: z.enum(["add", "reauth"]),
+  expiresAt: z.string().datetime(),
+  returnIntentId: z.string().uuid().nullable()
+});
+var ManagedAuthSocialProvider = z.enum(["google", "github"]);
+var SocialStartAttributionValue = z.string().trim().min(1).max(100).regex(/^[A-Za-z0-9._~+-]+$/);
+var SocialStartAttribution = z.object({
+  utmSource: SocialStartAttributionValue.optional(),
+  utmMedium: SocialStartAttributionValue.optional(),
+  utmCampaign: SocialStartAttributionValue.optional(),
+  utmContent: SocialStartAttributionValue.optional(),
+  ref: SocialStartAttributionValue.optional()
+}).strict();
+var StartManagedAuthSocialTransactionRequest = ManagedAuthOperationIdentity.extend({
+  transactionId: z.string().uuid(),
+  provider: ManagedAuthSocialProvider,
+  /**
+   * Optional untrusted first-touch campaign tokens, used only by the
+   * content-free sign-up acquisition counter when this start creates a new
+   * account. Invalid attribution is dropped rather than failing the sign-in.
+   */
+  attribution: SocialStartAttribution.optional().catch(void 0)
+});
+var StartManagedAuthSocialTransactionResponse = z.object({
+  url: z.string().url().max(4096)
+});
+var CompleteManagedAuthEmailPasswordTransactionRequest = ManagedAuthOperationIdentity.extend({
+  transactionId: z.string().uuid(),
+  email: z.string().email().max(320),
+  password: z.string().min(1).max(1024)
+});
+var CompleteManagedAuthLoginTransactionResponse = z.object({
+  projection: ManagedAuthSessionSetProjection,
+  returnIntent: ManagedAuthReturnIntent.nullable()
+});
+var CancelManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({
+  transactionId: z.string().uuid()
+});
+var SelectManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({
+  slotId: z.string().uuid()
+});
+var LogoutManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({
+  slotId: z.string().uuid(),
+  replacementSlotId: z.string().uuid().nullable()
+});
+var LogoutManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;
+var ManagedAuthLogoutAllReceipt = z.object({
+  generation: z.string().regex(/^[1-9][0-9]*$/),
+  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),
+  state: z.literal("logged_out")
+});
+var ResolveManagedAuthDeepLinkRequest = z.object({
+  path: ManagedAuthReturnIntent
+});
+var ManagedAuthDeepLinkResolution = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("current") }),
+  z.object({ kind: z.literal("switch_required"), slot: ManagedAuthLoginSlot }),
+  z.object({ kind: z.literal("unavailable") })
+]);
+var ManagedAuthSessionSetErrorCode = z.enum([
+  "actor_change_required",
+  "actor_mutation_in_flight",
+  "api_contract_changed",
+  "browser_session_set_required",
+  "browser_session_set_unavailable",
+  "generation_conflict",
+  "invalid_browser_session_set_request",
+  "invalid_transaction",
+  "managed_authentication_required",
+  "managed_authentication_unavailable",
+  "operation_outcome_unknown",
+  "operation_reused",
+  "origin_rejected",
+  "login_transaction_rate_limited",
+  "provider_route_blocked",
+  "slot_limit_reached",
+  "slot_already_exists",
+  "slot_unavailable"
+]);
+export {
+  BeginManagedAuthLoginTransactionRequest,
+  BootstrapManagedAuthSessionSetRequest,
+  CancelManagedAuthLoginTransactionRequest,
+  CompleteManagedAuthEmailPasswordTransactionRequest,
+  CompleteManagedAuthLoginTransactionResponse,
+  LogoutManagedAuthLoginSlotRequest,
+  LogoutManagedAuthSessionSetRequest,
+  MANAGED_AUTH_RETURN_INTENT_MAX_BYTES,
+  MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER,
+  MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,
+  MANAGED_AUTH_SESSION_SET_MAX_SLOTS,
+  MANAGED_AUTH_TRANSACTION_TTL_SECONDS,
+  ManagedAuthDeepLinkResolution,
+  ManagedAuthLoginSlot,
+  ManagedAuthLoginSlotState,
+  ManagedAuthLoginTransaction,
+  ManagedAuthLogoutAllReceipt,
+  ManagedAuthOperationIdentity,
+  ManagedAuthReturnIntent,
+  ManagedAuthSessionSetErrorCode,
+  ManagedAuthSessionSetMode,
+  ManagedAuthSessionSetProjection,
+  ManagedAuthSessionSetState,
+  ManagedAuthSocialProvider,
+  ManagedAuthVerifiedClaim,
+  ResolveManagedAuthDeepLinkRequest,
+  SelectManagedAuthLoginSlotRequest,
+  StartManagedAuthSocialTransactionRequest,
+  StartManagedAuthSocialTransactionResponse
+};
+//# sourceMappingURL=managed-auth-session-sets.js.map

package/dist/managed-auth-session-sets.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/managed-auth-session-sets.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const MANAGED_AUTH_SESSION_SET_MAX_SLOTS = 8 as const;\nexport const MANAGED_AUTH_TRANSACTION_TTL_SECONDS = 600 as const;\nexport const MANAGED_AUTH_RETURN_INTENT_MAX_BYTES = 2_048 as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER = \"x-opengeni-api-contract\" as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION =\n  \"2026-08-personal-only-organization-setup-v1\" as const;\n\nexport const ManagedAuthSessionSetMode = z.enum([\"legacy\", \"dual\", \"broker\"]);\nexport type ManagedAuthSessionSetMode = z.infer<typeof ManagedAuthSessionSetMode>;\n\nexport const ManagedAuthLoginSlotState = z.enum([\"active\", \"reauth_required\"]);\nexport type ManagedAuthLoginSlotState = z.infer<typeof ManagedAuthLoginSlotState>;\n\nexport const ManagedAuthVerifiedClaim = z.object({\n  kind: z.literal(\"email\"),\n  value: z.string().email().max(320),\n});\nexport type ManagedAuthVerifiedClaim = z.infer<typeof ManagedAuthVerifiedClaim>;\n\n/** Secret-free, browser-safe summary. Provider session ids and tokens never enter this shape. */\nexport const ManagedAuthLoginSlot = z.object({\n  id: z.string().uuid(),\n  displayName: z.string().min(1).max(256),\n  verifiedClaim: ManagedAuthVerifiedClaim,\n  state: ManagedAuthLoginSlotState,\n});\nexport type ManagedAuthLoginSlot = z.infer<typeof ManagedAuthLoginSlot>;\n\nexport const ManagedAuthSessionSetState = z.enum([\"ready\", \"actor_change_required\"]);\nexport type ManagedAuthSessionSetState = z.infer<typeof ManagedAuthSessionSetState>;\n\nexport const ManagedAuthSessionSetProjection = z.object({\n  mode: ManagedAuthSessionSetMode,\n  generation: z.string().regex(/^[1-9][0-9]*$/),\n  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n  csrfToken: z.string().min(32).max(512),\n  selectedSlotId: z.string().uuid().nullable(),\n  state: ManagedAuthSessionSetState,\n  slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS),\n});\nexport type ManagedAuthSessionSetProjection = z.infer<typeof ManagedAuthSessionSetProjection>;\n\nexport const ManagedAuthOperationIdentity = z.object({\n  operationId: z.string().uuid(),\n  expectedGeneration: z.string().regex(/^[1-9][0-9]*$/),\n});\nexport type ManagedAuthOperationIdentity = z.infer<typeof ManagedAuthOperationIdentity>;\n\nexport const BootstrapManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type BootstrapManagedAuthSessionSetRequest = z.infer<\n  typeof BootstrapManagedAuthSessionSetRequest\n>;\n\nexport const ManagedAuthReturnIntent = z\n  .string()\n  .min(1)\n  .superRefine((value, context) => {\n    if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {\n      context.addIssue({ code: \"custom\", message: \"return intent exceeds its UTF-8 byte limit\" });\n    }\n    if (\n      !value.startsWith(\"/\") ||\n      value.startsWith(\"//\") ||\n      value.includes(\"?\") ||\n      value.includes(\"#\") ||\n      /[\\u0000-\\u001f\\u007f\\\\]/.test(value)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent must be a safe same-origin path\",\n      });\n      return;\n    }\n    try {\n      const parsed = new URL(value, \"https://opengeni.invalid\");\n      const uuid = \"[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\";\n      const supportedPath = new RegExp(\n        `^/(?:sessions/${uuid}|workspaces/${uuid}(?:/sessions(?:/${uuid})?)?)$`,\n        \"i\",\n      );\n      if (\n        parsed.origin !== \"https://opengeni.invalid\" ||\n        parsed.username ||\n        parsed.password ||\n        parsed.search ||\n        parsed.hash ||\n        !supportedPath.test(value) ||\n        parsed.pathname !== value\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"return intent contains unsafe authority data\",\n        });\n      }\n    } catch {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent is not a valid same-origin path\",\n      });\n    }\n  });\n\nexport const BeginManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({\n  kind: z.enum([\"add\", \"reauth\"]),\n  slotId: z.string().uuid().optional(),\n  returnIntent: ManagedAuthReturnIntent.optional(),\n}).superRefine((value, context) => {\n  if ((value.kind === \"reauth\") !== Boolean(value.slotId)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"slotId\"],\n      message: \"reauth requires exactly one slot id and add forbids one\",\n    });\n  }\n});\nexport type BeginManagedAuthLoginTransactionRequest = z.infer<\n  typeof BeginManagedAuthLoginTransactionRequest\n>;\n\nexport const ManagedAuthLoginTransaction = z.object({\n  id: z.string().uuid(),\n  kind: z.enum([\"add\", \"reauth\"]),\n  expiresAt: z.string().datetime(),\n  returnIntentId: z.string().uuid().nullable(),\n});\nexport type ManagedAuthLoginTransaction = z.infer<typeof ManagedAuthLoginTransaction>;\n\nexport const ManagedAuthSocialProvider = z.enum([\"google\", \"github\"]);\nexport type ManagedAuthSocialProvider = z.infer<typeof ManagedAuthSocialProvider>;\n\n/**\n * Mirrors `SignupAttribution` from `./signup-attribution` (a contract test pins\n * them together). Declared here, not imported, so the browser session-set\n * client does not pull the attribution module into a new shared web chunk.\n */\nconst SocialStartAttributionValue = z\n  .string()\n  .trim()\n  .min(1)\n  .max(100)\n  .regex(/^[A-Za-z0-9._~+-]+$/);\nconst SocialStartAttribution = z\n  .object({\n    utmSource: SocialStartAttributionValue.optional(),\n    utmMedium: SocialStartAttributionValue.optional(),\n    utmCampaign: SocialStartAttributionValue.optional(),\n    utmContent: SocialStartAttributionValue.optional(),\n    ref: SocialStartAttributionValue.optional(),\n  })\n  .strict();\n\nexport const StartManagedAuthSocialTransactionRequest = ManagedAuthOperationIdentity.extend({\n  transactionId: z.string().uuid(),\n  provider: ManagedAuthSocialProvider,\n  /**\n   * Optional untrusted first-touch campaign tokens, used only by the\n   * content-free sign-up acquisition counter when this start creates a new\n   * account. Invalid attribution is dropped rather than failing the sign-in.\n   */\n  attribution: SocialStartAttribution.optional().catch(undefined),\n});\nexport type StartManagedAuthSocialTransactionRequest = z.infer<\n  typeof StartManagedAuthSocialTransactionRequest\n>;\n\nexport const StartManagedAuthSocialTransactionResponse = z.object({\n  url: z.string().url().max(4_096),\n});\nexport type StartManagedAuthSocialTransactionResponse = z.infer<\n  typeof StartManagedAuthSocialTransactionResponse\n>;\n\nexport const CompleteManagedAuthEmailPasswordTransactionRequest =\n  ManagedAuthOperationIdentity.extend({\n    transactionId: z.string().uuid(),\n    email: z.string().email().max(320),\n    password: z.string().min(1).max(1_024),\n  });\nexport type CompleteManagedAuthEmailPasswordTransactionRequest = z.infer<\n  typeof CompleteManagedAuthEmailPasswordTransactionRequest\n>;\n\nexport const CompleteManagedAuthLoginTransactionResponse = z.object({\n  projection: ManagedAuthSessionSetProjection,\n  returnIntent: ManagedAuthReturnIntent.nullable(),\n});\nexport type CompleteManagedAuthLoginTransactionResponse = z.infer<\n  typeof CompleteManagedAuthLoginTransactionResponse\n>;\n\nexport const CancelManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({\n  transactionId: z.string().uuid(),\n});\nexport type CancelManagedAuthLoginTransactionRequest = z.infer<\n  typeof CancelManagedAuthLoginTransactionRequest\n>;\n\nexport const SelectManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({\n  slotId: z.string().uuid(),\n});\nexport type SelectManagedAuthLoginSlotRequest = z.infer<typeof SelectManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({\n  slotId: z.string().uuid(),\n  replacementSlotId: z.string().uuid().nullable(),\n});\nexport type LogoutManagedAuthLoginSlotRequest = z.infer<typeof LogoutManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type LogoutManagedAuthSessionSetRequest = z.infer<typeof LogoutManagedAuthSessionSetRequest>;\n\nexport const ManagedAuthLogoutAllReceipt = z.object({\n  generation: z.string().regex(/^[1-9][0-9]*$/),\n  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n  state: z.literal(\"logged_out\"),\n});\nexport type ManagedAuthLogoutAllReceipt = z.infer<typeof ManagedAuthLogoutAllReceipt>;\n\nexport const ResolveManagedAuthDeepLinkRequest = z.object({\n  path: ManagedAuthReturnIntent,\n});\nexport type ResolveManagedAuthDeepLinkRequest = z.infer<typeof ResolveManagedAuthDeepLinkRequest>;\n\nexport const ManagedAuthDeepLinkResolution = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"current\") }),\n  z.object({ kind: z.literal(\"switch_required\"), slot: ManagedAuthLoginSlot }),\n  z.object({ kind: z.literal(\"unavailable\") }),\n]);\nexport type ManagedAuthDeepLinkResolution = z.infer<typeof ManagedAuthDeepLinkResolution>;\n\nexport const ManagedAuthSessionSetErrorCode = z.enum([\n  \"actor_change_required\",\n  \"actor_mutation_in_flight\",\n  \"api_contract_changed\",\n  \"browser_session_set_required\",\n  \"browser_session_set_unavailable\",\n  \"generation_conflict\",\n  \"invalid_browser_session_set_request\",\n  \"invalid_transaction\",\n  \"managed_authentication_required\",\n  \"managed_authentication_unavailable\",\n  \"operation_outcome_unknown\",\n  \"operation_reused\",\n  \"origin_rejected\",\n  \"login_transaction_rate_limited\",\n  \"provider_route_blocked\",\n  \"slot_limit_reached\",\n  \"slot_already_exists\",\n  \"slot_unavailable\",\n]);\nexport type ManagedAuthSessionSetErrorCode = z.infer<typeof ManagedAuthSessionSetErrorCode>;\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,qCAAqC;AAC3C,IAAM,uCAAuC;AAC7C,IAAM,uCAAuC;AAC7C,IAAM,+CAA+C;AACrD,IAAM,iDACX;AAEK,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,QAAQ,QAAQ,CAAC;AAGrE,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,iBAAiB,CAAC;AAGtE,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,MAAM,EAAE,QAAQ,OAAO;AAAA,EACvB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AACnC,CAAC;AAIM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe;AAAA,EACf,OAAO;AACT,CAAC;AAGM,IAAM,6BAA6B,EAAE,KAAK,CAAC,SAAS,uBAAuB,CAAC;AAG5E,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM;AAAA,EACN,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,GAAG;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO;AAAA,EACP,OAAO,EAAE,MAAM,oBAAoB,EAAE,IAAI,kCAAkC;AAC7E,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,oBAAoB,EAAE,OAAO,EAAE,MAAM,eAAe;AACtD,CAAC;AAGM,IAAM,wCAAwC;AAK9C,IAAM,0BAA0B,EACpC,OAAO,EACP,IAAI,CAAC,EACL,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,aAAa,sCAAsC;AACrF,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,6CAA6C,CAAC;AAAA,EAC5F;AACA,MACE,CAAC,MAAM,WAAW,GAAG,KACrB,MAAM,WAAW,IAAI,KACrB,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,KAClB,0BAA0B,KAAK,KAAK,GACpC;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,OAAO,0BAA0B;AACxD,UAAM,OAAO;AACb,UAAM,gBAAgB,IAAI;AAAA,MACxB,iBAAiB,IAAI,eAAe,IAAI,mBAAmB,IAAI;AAAA,MAC/D;AAAA,IACF;AACA,QACE,OAAO,WAAW,8BAClB,OAAO,YACP,OAAO,YACP,OAAO,UACP,OAAO,QACP,CAAC,cAAc,KAAK,KAAK,KACzB,OAAO,aAAa,OACpB;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AACN,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAEI,IAAM,0CAA0C,6BAA6B,OAAO;AAAA,EACzF,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,cAAc,wBAAwB,SAAS;AACjD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,MAAK,MAAM,SAAS,aAAc,QAAQ,MAAM,MAAM,GAAG;AACvD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAKM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAQpE,IAAM,8BAA8B,EACjC,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,qBAAqB;AAC9B,IAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,WAAW,4BAA4B,SAAS;AAAA,EAChD,WAAW,4BAA4B,SAAS;AAAA,EAChD,aAAa,4BAA4B,SAAS;AAAA,EAClD,YAAY,4BAA4B,SAAS;AAAA,EACjD,KAAK,4BAA4B,SAAS;AAC5C,CAAC,EACA,OAAO;AAEH,IAAM,2CAA2C,6BAA6B,OAAO;AAAA,EAC1F,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMV,aAAa,uBAAuB,SAAS,EAAE,MAAM,MAAS;AAChE,CAAC;AAKM,IAAM,4CAA4C,EAAE,OAAO;AAAA,EAChE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAK;AACjC,CAAC;AAKM,IAAM,qDACX,6BAA6B,OAAO;AAAA,EAClC,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACjC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK;AACvC,CAAC;AAKI,IAAM,8CAA8C,EAAE,OAAO;AAAA,EAClE,YAAY;AAAA,EACZ,cAAc,wBAAwB,SAAS;AACjD,CAAC;AAKM,IAAM,2CAA2C,6BAA6B,OAAO;AAAA,EAC1F,eAAe,EAAE,OAAO,EAAE,KAAK;AACjC,CAAC;AAKM,IAAM,oCAAoC,6BAA6B,OAAO;AAAA,EACnF,QAAQ,EAAE,OAAO,EAAE,KAAK;AAC1B,CAAC;AAGM,IAAM,oCAAoC,6BAA6B,OAAO;AAAA,EACnF,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAChD,CAAC;AAGM,IAAM,qCAAqC;AAG3C,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,OAAO,EAAE,QAAQ,YAAY;AAC/B,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,MAAM;AACR,CAAC;AAGM,IAAM,gCAAgC,EAAE,mBAAmB,QAAQ;AAAA,EACxE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;AAAA,EACvC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,iBAAiB,GAAG,MAAM,qBAAqB,CAAC;AAAA,EAC3E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,aAAa,EAAE,CAAC;AAC7C,CAAC;AAGM,IAAM,iCAAiC,EAAE,KAAK;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":[]}

package/dist/managed-sign-in-methods.d.ts

@@ -0,0 +1,56 @@
+import { z } from "zod";
+export declare const ManagedSignInProvider: z.ZodEnum<{
+    github: "github";
+    google: "google";
+}>;
+export declare const ManagedSignInMethods: z.ZodObject<{
+    identityId: z.ZodString;
+    email: z.ZodString;
+    emailVerified: z.ZodBoolean;
+    identityRevision: z.ZodNumber;
+    freshAuthenticationRequired: z.ZodBoolean;
+    methods: z.ZodArray<z.ZodObject<{
+        provider: z.ZodEnum<{
+            credential: "credential";
+            github: "github";
+            google: "google";
+        }>;
+        connected: z.ZodBoolean;
+        available: z.ZodBoolean;
+        canDisconnect: z.ZodBoolean;
+        implicitRelinkingSuppressed: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ManagedSignInMethods = z.infer<typeof ManagedSignInMethods>;
+export declare const ManagedSignInMutation: z.ZodObject<{
+    expectedIdentityId: z.ZodString;
+    operationId: z.ZodString;
+    expectedIdentityRevision: z.ZodNumber;
+}, z.core.$strip>;
+export declare const ManagedSignInProviderMutation: z.ZodObject<{
+    expectedIdentityId: z.ZodString;
+    operationId: z.ZodString;
+    expectedIdentityRevision: z.ZodNumber;
+    provider: z.ZodEnum<{
+        github: "github";
+        google: "google";
+    }>;
+}, z.core.$strict>;
+export declare const ManagedSignInPasswordMutation: z.ZodObject<{
+    expectedIdentityId: z.ZodString;
+    operationId: z.ZodString;
+    expectedIdentityRevision: z.ZodNumber;
+    newPassword: z.ZodString;
+    currentPassword: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const ManagedSignInMutationResponse: z.ZodObject<{
+    reauthenticationRequired: z.ZodLiteral<true>;
+    notification: z.ZodEnum<{
+        failed: "failed";
+        outcome_unknown: "outcome_unknown";
+        sent: "sent";
+    }>;
+}, z.core.$strip>;
+export declare const ManagedSignInConnectResponse: z.ZodObject<{
+    url: z.ZodString;
+}, z.core.$strip>;

package/dist/managed-sign-in-methods.js

@@ -0,0 +1,46 @@
+// src/managed-sign-in-methods.ts
+import { z } from "zod";
+var ManagedSignInProvider = z.enum(["google", "github"]);
+var ManagedSignInMethods = z.object({
+  identityId: z.string().uuid(),
+  email: z.string().email(),
+  emailVerified: z.boolean(),
+  identityRevision: z.number().int().positive(),
+  freshAuthenticationRequired: z.boolean(),
+  methods: z.array(
+    z.object({
+      provider: z.enum(["credential", "google", "github"]),
+      connected: z.boolean(),
+      available: z.boolean(),
+      canDisconnect: z.boolean(),
+      implicitRelinkingSuppressed: z.boolean()
+    })
+  )
+});
+var ManagedSignInMutation = z.object({
+  expectedIdentityId: z.string().uuid(),
+  operationId: z.string().uuid(),
+  expectedIdentityRevision: z.number().int().positive()
+});
+var ManagedSignInProviderMutation = ManagedSignInMutation.extend({
+  provider: ManagedSignInProvider
+}).strict();
+var ManagedSignInPasswordMutation = ManagedSignInMutation.extend({
+  newPassword: z.string().min(8).max(128),
+  currentPassword: z.string().min(1).max(1024).optional()
+}).strict();
+var ManagedSignInMutationResponse = z.object({
+  reauthenticationRequired: z.literal(true),
+  notification: z.enum(["sent", "failed", "outcome_unknown"])
+});
+var ManagedSignInConnectResponse = z.object({ url: z.string().url() });
+export {
+  ManagedSignInConnectResponse,
+  ManagedSignInMethods,
+  ManagedSignInMutation,
+  ManagedSignInMutationResponse,
+  ManagedSignInPasswordMutation,
+  ManagedSignInProvider,
+  ManagedSignInProviderMutation
+};
+//# sourceMappingURL=managed-sign-in-methods.js.map

package/dist/managed-sign-in-methods.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/managed-sign-in-methods.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const ManagedSignInProvider = z.enum([\"google\", \"github\"]);\nexport const ManagedSignInMethods = z.object({\n  identityId: z.string().uuid(),\n  email: z.string().email(),\n  emailVerified: z.boolean(),\n  identityRevision: z.number().int().positive(),\n  freshAuthenticationRequired: z.boolean(),\n  methods: z.array(\n    z.object({\n      provider: z.enum([\"credential\", \"google\", \"github\"]),\n      connected: z.boolean(),\n      available: z.boolean(),\n      canDisconnect: z.boolean(),\n      implicitRelinkingSuppressed: z.boolean(),\n    }),\n  ),\n});\nexport type ManagedSignInMethods = z.infer<typeof ManagedSignInMethods>;\nexport const ManagedSignInMutation = z.object({\n  expectedIdentityId: z.string().uuid(),\n  operationId: z.string().uuid(),\n  expectedIdentityRevision: z.number().int().positive(),\n});\nexport const ManagedSignInProviderMutation = ManagedSignInMutation.extend({\n  provider: ManagedSignInProvider,\n}).strict();\nexport const ManagedSignInPasswordMutation = ManagedSignInMutation.extend({\n  newPassword: z.string().min(8).max(128),\n  currentPassword: z.string().min(1).max(1024).optional(),\n}).strict();\nexport const ManagedSignInMutationResponse = z.object({\n  reauthenticationRequired: z.literal(true),\n  notification: z.enum([\"sent\", \"failed\", \"outcome_unknown\"]),\n});\nexport const ManagedSignInConnectResponse = z.object({ url: z.string().url() });\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,wBAAwB,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AACzD,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,eAAe,EAAE,QAAQ;AAAA,EACzB,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,6BAA6B,EAAE,QAAQ;AAAA,EACvC,SAAS,EAAE;AAAA,IACT,EAAE,OAAO;AAAA,MACP,UAAU,EAAE,KAAK,CAAC,cAAc,UAAU,QAAQ,CAAC;AAAA,MACnD,WAAW,EAAE,QAAQ;AAAA,MACrB,WAAW,EAAE,QAAQ;AAAA,MACrB,eAAe,EAAE,QAAQ;AAAA,MACzB,6BAA6B,EAAE,QAAQ;AAAA,IACzC,CAAC;AAAA,EACH;AACF,CAAC;AAEM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,oBAAoB,EAAE,OAAO,EAAE,KAAK;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACtD,CAAC;AACM,IAAM,gCAAgC,sBAAsB,OAAO;AAAA,EACxE,UAAU;AACZ,CAAC,EAAE,OAAO;AACH,IAAM,gCAAgC,sBAAsB,OAAO;AAAA,EACxE,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AACxD,CAAC,EAAE,OAAO;AACH,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,0BAA0B,EAAE,QAAQ,IAAI;AAAA,EACxC,cAAc,EAAE,KAAK,CAAC,QAAQ,UAAU,iBAAiB,CAAC;AAC5D,CAAC;AACM,IAAM,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;","names":[]}

package/dist/mcp-catalog-limits.d.ts

@@ -0,0 +1,2 @@
+/** Shared discovery and explicit permission-selection count allowance. */
+export declare const MCP_MAX_CATALOG_TOOL_ENTRIES = 4096;

package/dist/mcp-endpoint.d.ts

@@ -0,0 +1,7 @@
+/** Exact endpoint identity: normalize URL syntax, preserve paths and query parameters. */
+export declare function mcpEndpointIdentity(value: string | null | undefined): string | null;
+export declare function pluginMcpUnavailableReason(server: {
+    endpoint: string | null;
+    transport?: string;
+    requiresConfiguration?: boolean;
+}): string | null;

package/dist/mcp-endpoint.js

@@ -0,0 +1,9 @@
+import {
+  mcpEndpointIdentity,
+  pluginMcpUnavailableReason
+} from "./chunk-RKX3NQYS.js";
+export {
+  mcpEndpointIdentity,
+  pluginMcpUnavailableReason
+};
+//# sourceMappingURL=mcp-endpoint.js.map

package/dist/mcp-endpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}