@opengeni/contracts 2.5.0-canary.2 → 2.7.0

package/dist/managed-auth-session-sets.js

@@ -0,0 +1,166 @@
+// src/managed-auth-session-sets.ts
+import { z } from "zod";
+var MANAGED_AUTH_SESSION_SET_MAX_SLOTS = 8;
+var MANAGED_AUTH_TRANSACTION_TTL_SECONDS = 600;
+var MANAGED_AUTH_RETURN_INTENT_MAX_BYTES = 2048;
+var MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER = "x-opengeni-api-contract";
+var MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION = "2026-08-personal-only-organization-setup-v1";
+var ManagedAuthSessionSetMode = z.enum(["legacy", "dual", "broker"]);
+var ManagedAuthLoginSlotState = z.enum(["active", "reauth_required"]);
+var ManagedAuthVerifiedClaim = z.object({
+  kind: z.literal("email"),
+  value: z.string().email().max(320)
+});
+var ManagedAuthLoginSlot = z.object({
+  id: z.string().uuid(),
+  displayName: z.string().min(1).max(256),
+  verifiedClaim: ManagedAuthVerifiedClaim,
+  state: ManagedAuthLoginSlotState
+});
+var ManagedAuthSessionSetState = z.enum(["ready", "actor_change_required"]);
+var ManagedAuthSessionSetProjection = z.object({
+  mode: ManagedAuthSessionSetMode,
+  generation: z.string().regex(/^[1-9][0-9]*$/),
+  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),
+  csrfToken: z.string().min(32).max(512),
+  selectedSlotId: z.string().uuid().nullable(),
+  state: ManagedAuthSessionSetState,
+  slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS)
+});
+var ManagedAuthOperationIdentity = z.object({
+  operationId: z.string().uuid(),
+  expectedGeneration: z.string().regex(/^[1-9][0-9]*$/)
+});
+var BootstrapManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;
+var ManagedAuthReturnIntent = z.string().min(1).superRefine((value, context) => {
+  if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {
+    context.addIssue({ code: "custom", message: "return intent exceeds its UTF-8 byte limit" });
+  }
+  if (!value.startsWith("/") || value.startsWith("//") || value.includes("?") || value.includes("#") || /[\u0000-\u001f\u007f\\]/.test(value)) {
+    context.addIssue({
+      code: "custom",
+      message: "return intent must be a safe same-origin path"
+    });
+    return;
+  }
+  try {
+    const parsed = new URL(value, "https://opengeni.invalid");
+    const uuid = "[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}";
+    const supportedPath = new RegExp(
+      `^/(?:sessions/${uuid}|workspaces/${uuid}(?:/sessions(?:/${uuid})?)?)$`,
+      "i"
+    );
+    if (parsed.origin !== "https://opengeni.invalid" || parsed.username || parsed.password || parsed.search || parsed.hash || !supportedPath.test(value) || parsed.pathname !== value) {
+      context.addIssue({
+        code: "custom",
+        message: "return intent contains unsafe authority data"
+      });
+    }
+  } catch {
+    context.addIssue({
+      code: "custom",
+      message: "return intent is not a valid same-origin path"
+    });
+  }
+});
+var BeginManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({
+  kind: z.enum(["add", "reauth"]),
+  slotId: z.string().uuid().optional(),
+  returnIntent: ManagedAuthReturnIntent.optional()
+}).superRefine((value, context) => {
+  if (value.kind === "reauth" !== Boolean(value.slotId)) {
+    context.addIssue({
+      code: "custom",
+      path: ["slotId"],
+      message: "reauth requires exactly one slot id and add forbids one"
+    });
+  }
+});
+var ManagedAuthLoginTransaction = z.object({
+  id: z.string().uuid(),
+  kind: z.enum(["add", "reauth"]),
+  expiresAt: z.string().datetime(),
+  returnIntentId: z.string().uuid().nullable()
+});
+var CompleteManagedAuthEmailPasswordTransactionRequest = ManagedAuthOperationIdentity.extend({
+  transactionId: z.string().uuid(),
+  email: z.string().email().max(320),
+  password: z.string().min(1).max(1024)
+});
+var CompleteManagedAuthLoginTransactionResponse = z.object({
+  projection: ManagedAuthSessionSetProjection,
+  returnIntent: ManagedAuthReturnIntent.nullable()
+});
+var CancelManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({
+  transactionId: z.string().uuid()
+});
+var SelectManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({
+  slotId: z.string().uuid()
+});
+var LogoutManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({
+  slotId: z.string().uuid(),
+  replacementSlotId: z.string().uuid().nullable()
+});
+var LogoutManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;
+var ManagedAuthLogoutAllReceipt = z.object({
+  generation: z.string().regex(/^[1-9][0-9]*$/),
+  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),
+  state: z.literal("logged_out")
+});
+var ResolveManagedAuthDeepLinkRequest = z.object({
+  path: ManagedAuthReturnIntent
+});
+var ManagedAuthDeepLinkResolution = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("current") }),
+  z.object({ kind: z.literal("switch_required"), slot: ManagedAuthLoginSlot }),
+  z.object({ kind: z.literal("unavailable") })
+]);
+var ManagedAuthSessionSetErrorCode = z.enum([
+  "actor_change_required",
+  "actor_mutation_in_flight",
+  "api_contract_changed",
+  "browser_session_set_required",
+  "browser_session_set_unavailable",
+  "generation_conflict",
+  "invalid_browser_session_set_request",
+  "invalid_transaction",
+  "managed_authentication_required",
+  "managed_authentication_unavailable",
+  "operation_outcome_unknown",
+  "operation_reused",
+  "origin_rejected",
+  "login_transaction_rate_limited",
+  "provider_route_blocked",
+  "slot_limit_reached",
+  "slot_already_exists",
+  "slot_unavailable"
+]);
+export {
+  BeginManagedAuthLoginTransactionRequest,
+  BootstrapManagedAuthSessionSetRequest,
+  CancelManagedAuthLoginTransactionRequest,
+  CompleteManagedAuthEmailPasswordTransactionRequest,
+  CompleteManagedAuthLoginTransactionResponse,
+  LogoutManagedAuthLoginSlotRequest,
+  LogoutManagedAuthSessionSetRequest,
+  MANAGED_AUTH_RETURN_INTENT_MAX_BYTES,
+  MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER,
+  MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,
+  MANAGED_AUTH_SESSION_SET_MAX_SLOTS,
+  MANAGED_AUTH_TRANSACTION_TTL_SECONDS,
+  ManagedAuthDeepLinkResolution,
+  ManagedAuthLoginSlot,
+  ManagedAuthLoginSlotState,
+  ManagedAuthLoginTransaction,
+  ManagedAuthLogoutAllReceipt,
+  ManagedAuthOperationIdentity,
+  ManagedAuthReturnIntent,
+  ManagedAuthSessionSetErrorCode,
+  ManagedAuthSessionSetMode,
+  ManagedAuthSessionSetProjection,
+  ManagedAuthSessionSetState,
+  ManagedAuthVerifiedClaim,
+  ResolveManagedAuthDeepLinkRequest,
+  SelectManagedAuthLoginSlotRequest
+};
+//# sourceMappingURL=managed-auth-session-sets.js.map

package/dist/managed-auth-session-sets.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/managed-auth-session-sets.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const MANAGED_AUTH_SESSION_SET_MAX_SLOTS = 8 as const;\nexport const MANAGED_AUTH_TRANSACTION_TTL_SECONDS = 600 as const;\nexport const MANAGED_AUTH_RETURN_INTENT_MAX_BYTES = 2_048 as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER = \"x-opengeni-api-contract\" as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION =\n  \"2026-08-personal-only-organization-setup-v1\" as const;\n\nexport const ManagedAuthSessionSetMode = z.enum([\"legacy\", \"dual\", \"broker\"]);\nexport type ManagedAuthSessionSetMode = z.infer<typeof ManagedAuthSessionSetMode>;\n\nexport const ManagedAuthLoginSlotState = z.enum([\"active\", \"reauth_required\"]);\nexport type ManagedAuthLoginSlotState = z.infer<typeof ManagedAuthLoginSlotState>;\n\nexport const ManagedAuthVerifiedClaim = z.object({\n  kind: z.literal(\"email\"),\n  value: z.string().email().max(320),\n});\nexport type ManagedAuthVerifiedClaim = z.infer<typeof ManagedAuthVerifiedClaim>;\n\n/** Secret-free, browser-safe summary. Provider session ids and tokens never enter this shape. */\nexport const ManagedAuthLoginSlot = z.object({\n  id: z.string().uuid(),\n  displayName: z.string().min(1).max(256),\n  verifiedClaim: ManagedAuthVerifiedClaim,\n  state: ManagedAuthLoginSlotState,\n});\nexport type ManagedAuthLoginSlot = z.infer<typeof ManagedAuthLoginSlot>;\n\nexport const ManagedAuthSessionSetState = z.enum([\"ready\", \"actor_change_required\"]);\nexport type ManagedAuthSessionSetState = z.infer<typeof ManagedAuthSessionSetState>;\n\nexport const ManagedAuthSessionSetProjection = z.object({\n  mode: ManagedAuthSessionSetMode,\n  generation: z.string().regex(/^[1-9][0-9]*$/),\n  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n  csrfToken: z.string().min(32).max(512),\n  selectedSlotId: z.string().uuid().nullable(),\n  state: ManagedAuthSessionSetState,\n  slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS),\n});\nexport type ManagedAuthSessionSetProjection = z.infer<typeof ManagedAuthSessionSetProjection>;\n\nexport const ManagedAuthOperationIdentity = z.object({\n  operationId: z.string().uuid(),\n  expectedGeneration: z.string().regex(/^[1-9][0-9]*$/),\n});\nexport type ManagedAuthOperationIdentity = z.infer<typeof ManagedAuthOperationIdentity>;\n\nexport const BootstrapManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type BootstrapManagedAuthSessionSetRequest = z.infer<\n  typeof BootstrapManagedAuthSessionSetRequest\n>;\n\nexport const ManagedAuthReturnIntent = z\n  .string()\n  .min(1)\n  .superRefine((value, context) => {\n    if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {\n      context.addIssue({ code: \"custom\", message: \"return intent exceeds its UTF-8 byte limit\" });\n    }\n    if (\n      !value.startsWith(\"/\") ||\n      value.startsWith(\"//\") ||\n      value.includes(\"?\") ||\n      value.includes(\"#\") ||\n      /[\\u0000-\\u001f\\u007f\\\\]/.test(value)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent must be a safe same-origin path\",\n      });\n      return;\n    }\n    try {\n      const parsed = new URL(value, \"https://opengeni.invalid\");\n      const uuid = \"[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\";\n      const supportedPath = new RegExp(\n        `^/(?:sessions/${uuid}|workspaces/${uuid}(?:/sessions(?:/${uuid})?)?)$`,\n        \"i\",\n      );\n      if (\n        parsed.origin !== \"https://opengeni.invalid\" ||\n        parsed.username ||\n        parsed.password ||\n        parsed.search ||\n        parsed.hash ||\n        !supportedPath.test(value) ||\n        parsed.pathname !== value\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"return intent contains unsafe authority data\",\n        });\n      }\n    } catch {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent is not a valid same-origin path\",\n      });\n    }\n  });\n\nexport const BeginManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({\n  kind: z.enum([\"add\", \"reauth\"]),\n  slotId: z.string().uuid().optional(),\n  returnIntent: ManagedAuthReturnIntent.optional(),\n}).superRefine((value, context) => {\n  if ((value.kind === \"reauth\") !== Boolean(value.slotId)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"slotId\"],\n      message: \"reauth requires exactly one slot id and add forbids one\",\n    });\n  }\n});\nexport type BeginManagedAuthLoginTransactionRequest = z.infer<\n  typeof BeginManagedAuthLoginTransactionRequest\n>;\n\nexport const ManagedAuthLoginTransaction = z.object({\n  id: z.string().uuid(),\n  kind: z.enum([\"add\", \"reauth\"]),\n  expiresAt: z.string().datetime(),\n  returnIntentId: z.string().uuid().nullable(),\n});\nexport type ManagedAuthLoginTransaction = z.infer<typeof ManagedAuthLoginTransaction>;\n\nexport const CompleteManagedAuthEmailPasswordTransactionRequest =\n  ManagedAuthOperationIdentity.extend({\n    transactionId: z.string().uuid(),\n    email: z.string().email().max(320),\n    password: z.string().min(1).max(1_024),\n  });\nexport type CompleteManagedAuthEmailPasswordTransactionRequest = z.infer<\n  typeof CompleteManagedAuthEmailPasswordTransactionRequest\n>;\n\nexport const CompleteManagedAuthLoginTransactionResponse = z.object({\n  projection: ManagedAuthSessionSetProjection,\n  returnIntent: ManagedAuthReturnIntent.nullable(),\n});\nexport type CompleteManagedAuthLoginTransactionResponse = z.infer<\n  typeof CompleteManagedAuthLoginTransactionResponse\n>;\n\nexport const CancelManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({\n  transactionId: z.string().uuid(),\n});\nexport type CancelManagedAuthLoginTransactionRequest = z.infer<\n  typeof CancelManagedAuthLoginTransactionRequest\n>;\n\nexport const SelectManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({\n  slotId: z.string().uuid(),\n});\nexport type SelectManagedAuthLoginSlotRequest = z.infer<typeof SelectManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({\n  slotId: z.string().uuid(),\n  replacementSlotId: z.string().uuid().nullable(),\n});\nexport type LogoutManagedAuthLoginSlotRequest = z.infer<typeof LogoutManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type LogoutManagedAuthSessionSetRequest = z.infer<typeof LogoutManagedAuthSessionSetRequest>;\n\nexport const ManagedAuthLogoutAllReceipt = z.object({\n  generation: z.string().regex(/^[1-9][0-9]*$/),\n  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n  state: z.literal(\"logged_out\"),\n});\nexport type ManagedAuthLogoutAllReceipt = z.infer<typeof ManagedAuthLogoutAllReceipt>;\n\nexport const ResolveManagedAuthDeepLinkRequest = z.object({\n  path: ManagedAuthReturnIntent,\n});\nexport type ResolveManagedAuthDeepLinkRequest = z.infer<typeof ResolveManagedAuthDeepLinkRequest>;\n\nexport const ManagedAuthDeepLinkResolution = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"current\") }),\n  z.object({ kind: z.literal(\"switch_required\"), slot: ManagedAuthLoginSlot }),\n  z.object({ kind: z.literal(\"unavailable\") }),\n]);\nexport type ManagedAuthDeepLinkResolution = z.infer<typeof ManagedAuthDeepLinkResolution>;\n\nexport const ManagedAuthSessionSetErrorCode = z.enum([\n  \"actor_change_required\",\n  \"actor_mutation_in_flight\",\n  \"api_contract_changed\",\n  \"browser_session_set_required\",\n  \"browser_session_set_unavailable\",\n  \"generation_conflict\",\n  \"invalid_browser_session_set_request\",\n  \"invalid_transaction\",\n  \"managed_authentication_required\",\n  \"managed_authentication_unavailable\",\n  \"operation_outcome_unknown\",\n  \"operation_reused\",\n  \"origin_rejected\",\n  \"login_transaction_rate_limited\",\n  \"provider_route_blocked\",\n  \"slot_limit_reached\",\n  \"slot_already_exists\",\n  \"slot_unavailable\",\n]);\nexport type ManagedAuthSessionSetErrorCode = z.infer<typeof ManagedAuthSessionSetErrorCode>;\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,qCAAqC;AAC3C,IAAM,uCAAuC;AAC7C,IAAM,uCAAuC;AAC7C,IAAM,+CAA+C;AACrD,IAAM,iDACX;AAEK,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,QAAQ,QAAQ,CAAC;AAGrE,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,iBAAiB,CAAC;AAGtE,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,MAAM,EAAE,QAAQ,OAAO;AAAA,EACvB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AACnC,CAAC;AAIM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe;AAAA,EACf,OAAO;AACT,CAAC;AAGM,IAAM,6BAA6B,EAAE,KAAK,CAAC,SAAS,uBAAuB,CAAC;AAG5E,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM;AAAA,EACN,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,GAAG;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO;AAAA,EACP,OAAO,EAAE,MAAM,oBAAoB,EAAE,IAAI,kCAAkC;AAC7E,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,oBAAoB,EAAE,OAAO,EAAE,MAAM,eAAe;AACtD,CAAC;AAGM,IAAM,wCAAwC;AAK9C,IAAM,0BAA0B,EACpC,OAAO,EACP,IAAI,CAAC,EACL,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,aAAa,sCAAsC;AACrF,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,6CAA6C,CAAC;AAAA,EAC5F;AACA,MACE,CAAC,MAAM,WAAW,GAAG,KACrB,MAAM,WAAW,IAAI,KACrB,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,KAClB,0BAA0B,KAAK,KAAK,GACpC;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,OAAO,0BAA0B;AACxD,UAAM,OAAO;AACb,UAAM,gBAAgB,IAAI;AAAA,MACxB,iBAAiB,IAAI,eAAe,IAAI,mBAAmB,IAAI;AAAA,MAC/D;AAAA,IACF;AACA,QACE,OAAO,WAAW,8BAClB,OAAO,YACP,OAAO,YACP,OAAO,UACP,OAAO,QACP,CAAC,cAAc,KAAK,KAAK,KACzB,OAAO,aAAa,OACpB;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AACN,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAEI,IAAM,0CAA0C,6BAA6B,OAAO;AAAA,EACzF,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,cAAc,wBAAwB,SAAS;AACjD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,MAAK,MAAM,SAAS,aAAc,QAAQ,MAAM,MAAM,GAAG;AACvD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAKM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,qDACX,6BAA6B,OAAO;AAAA,EAClC,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACjC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK;AACvC,CAAC;AAKI,IAAM,8CAA8C,EAAE,OAAO;AAAA,EAClE,YAAY;AAAA,EACZ,cAAc,wBAAwB,SAAS;AACjD,CAAC;AAKM,IAAM,2CAA2C,6BAA6B,OAAO;AAAA,EAC1F,eAAe,EAAE,OAAO,EAAE,KAAK;AACjC,CAAC;AAKM,IAAM,oCAAoC,6BAA6B,OAAO;AAAA,EACnF,QAAQ,EAAE,OAAO,EAAE,KAAK;AAC1B,CAAC;AAGM,IAAM,oCAAoC,6BAA6B,OAAO;AAAA,EACnF,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAChD,CAAC;AAGM,IAAM,qCAAqC;AAG3C,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,OAAO,EAAE,QAAQ,YAAY;AAC/B,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,MAAM;AACR,CAAC;AAGM,IAAM,gCAAgC,EAAE,mBAAmB,QAAQ;AAAA,EACxE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;AAAA,EACvC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,iBAAiB,GAAG,MAAM,qBAAqB,CAAC;AAAA,EAC3E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,aAAa,EAAE,CAAC;AAC7C,CAAC;AAGM,IAAM,iCAAiC,EAAE,KAAK;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":[]}

package/dist/organization-recovery.d.ts

@@ -0,0 +1,337 @@
+import { z } from "zod";
+export declare const OrganizationRecoveryPolicyState: z.ZodEnum<{
+    active: "active";
+    degraded: "degraded";
+    disabled: "disabled";
+    pending_acceptance: "pending_acceptance";
+    superseded: "superseded";
+}>;
+export type OrganizationRecoveryPolicyState = z.infer<typeof OrganizationRecoveryPolicyState>;
+export declare const OrganizationRecoveryOperationState: z.ZodEnum<{
+    cancelled: "cancelled";
+    collecting: "collecting";
+    cooling: "cooling";
+    executed: "executed";
+    expired: "expired";
+    superseded: "superseded";
+}>;
+export type OrganizationRecoveryOperationState = z.infer<typeof OrganizationRecoveryOperationState>;
+export declare const OrganizationRecoveryUnavailableReason: z.ZodEnum<{
+    degraded: "degraded";
+    disabled: "disabled";
+    identity_unavailable: "identity_unavailable";
+    no_policy: "no_policy";
+    pending_acceptance: "pending_acceptance";
+}>;
+export type OrganizationRecoveryUnavailableReason = z.infer<typeof OrganizationRecoveryUnavailableReason>;
+export declare const OrganizationRecoveryMemberSummary: z.ZodObject<{
+    membershipId: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    email: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type OrganizationRecoveryMemberSummary = z.infer<typeof OrganizationRecoveryMemberSummary>;
+export declare const OrganizationRecoveryCustodian: z.ZodObject<{
+    membershipId: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    email: z.ZodNullable<z.ZodString>;
+    ordinal: z.ZodNumber;
+    enrollmentState: z.ZodEnum<{
+        accepted: "accepted";
+        ineligible: "ineligible";
+        pending_acceptance: "pending_acceptance";
+    }>;
+    acceptedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type OrganizationRecoveryCustodian = z.infer<typeof OrganizationRecoveryCustodian>;
+export declare const OrganizationRecoveryPolicy: z.ZodObject<{
+    id: z.ZodString;
+    organizationId: z.ZodString;
+    revision: z.ZodNumber;
+    state: z.ZodEnum<{
+        active: "active";
+        degraded: "degraded";
+        disabled: "disabled";
+        pending_acceptance: "pending_acceptance";
+        superseded: "superseded";
+    }>;
+    custodians: z.ZodArray<z.ZodObject<{
+        membershipId: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email: z.ZodNullable<z.ZodString>;
+        ordinal: z.ZodNumber;
+        enrollmentState: z.ZodEnum<{
+            accepted: "accepted";
+            ineligible: "ineligible";
+            pending_acceptance: "pending_acceptance";
+        }>;
+        acceptedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export type OrganizationRecoveryPolicy = z.infer<typeof OrganizationRecoveryPolicy>;
+export declare const OrganizationRecoveryApproval: z.ZodObject<{
+    membershipId: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    email: z.ZodNullable<z.ZodString>;
+    approvedAt: z.ZodString;
+}, z.core.$strict>;
+export type OrganizationRecoveryApproval = z.infer<typeof OrganizationRecoveryApproval>;
+export declare const OrganizationRecoveryOperation: z.ZodObject<{
+    id: z.ZodString;
+    organizationId: z.ZodString;
+    policyId: z.ZodString;
+    policyRevision: z.ZodNumber;
+    revision: z.ZodNumber;
+    state: z.ZodEnum<{
+        cancelled: "cancelled";
+        collecting: "collecting";
+        cooling: "cooling";
+        executed: "executed";
+        expired: "expired";
+        superseded: "superseded";
+    }>;
+    target: z.ZodObject<{
+        membershipId: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    approvals: z.ZodArray<z.ZodObject<{
+        membershipId: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email: z.ZodNullable<z.ZodString>;
+        approvedAt: z.ZodString;
+    }, z.core.$strict>>;
+    approvalCount: z.ZodNumber;
+    quorumAt: z.ZodNullable<z.ZodString>;
+    executableAt: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodString;
+    executedAt: z.ZodNullable<z.ZodString>;
+    cancelledAt: z.ZodNullable<z.ZodString>;
+    notificationJournaled: z.ZodBoolean;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export type OrganizationRecoveryOperation = z.infer<typeof OrganizationRecoveryOperation>;
+export declare const OrganizationRecoveryCapabilities: z.ZodObject<{
+    configure: z.ZodBoolean;
+    accept: z.ZodBoolean;
+    disable: z.ZodBoolean;
+    start: z.ZodBoolean;
+    approve: z.ZodBoolean;
+    cancel: z.ZodBoolean;
+    execute: z.ZodBoolean;
+}, z.core.$strict>;
+export type OrganizationRecoveryCapabilities = z.infer<typeof OrganizationRecoveryCapabilities>;
+export declare const OrganizationRecoveryOverview: z.ZodObject<{
+    organizationId: z.ZodString;
+    availability: z.ZodEnum<{
+        available: "available";
+        recovery_unavailable: "recovery_unavailable";
+    }>;
+    unavailableReason: z.ZodNullable<z.ZodEnum<{
+        degraded: "degraded";
+        disabled: "disabled";
+        identity_unavailable: "identity_unavailable";
+        no_policy: "no_policy";
+        pending_acceptance: "pending_acceptance";
+    }>>;
+    recentReauthenticationAt: z.ZodNullable<z.ZodString>;
+    eligibleMembers: z.ZodArray<z.ZodObject<{
+        membershipId: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    policy: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        organizationId: z.ZodString;
+        revision: z.ZodNumber;
+        state: z.ZodEnum<{
+            active: "active";
+            degraded: "degraded";
+            disabled: "disabled";
+            pending_acceptance: "pending_acceptance";
+            superseded: "superseded";
+        }>;
+        custodians: z.ZodArray<z.ZodObject<{
+            membershipId: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+            email: z.ZodNullable<z.ZodString>;
+            ordinal: z.ZodNumber;
+            enrollmentState: z.ZodEnum<{
+                accepted: "accepted";
+                ineligible: "ineligible";
+                pending_acceptance: "pending_acceptance";
+            }>;
+            acceptedAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>>;
+    operation: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        organizationId: z.ZodString;
+        policyId: z.ZodString;
+        policyRevision: z.ZodNumber;
+        revision: z.ZodNumber;
+        state: z.ZodEnum<{
+            cancelled: "cancelled";
+            collecting: "collecting";
+            cooling: "cooling";
+            executed: "executed";
+            expired: "expired";
+            superseded: "superseded";
+        }>;
+        target: z.ZodObject<{
+            membershipId: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+            email: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>;
+        approvals: z.ZodArray<z.ZodObject<{
+            membershipId: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+            email: z.ZodNullable<z.ZodString>;
+            approvedAt: z.ZodString;
+        }, z.core.$strict>>;
+        approvalCount: z.ZodNumber;
+        quorumAt: z.ZodNullable<z.ZodString>;
+        executableAt: z.ZodNullable<z.ZodString>;
+        expiresAt: z.ZodString;
+        executedAt: z.ZodNullable<z.ZodString>;
+        cancelledAt: z.ZodNullable<z.ZodString>;
+        notificationJournaled: z.ZodBoolean;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>>;
+    capabilities: z.ZodObject<{
+        configure: z.ZodBoolean;
+        accept: z.ZodBoolean;
+        disable: z.ZodBoolean;
+        start: z.ZodBoolean;
+        approve: z.ZodBoolean;
+        cancel: z.ZodBoolean;
+        execute: z.ZodBoolean;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type OrganizationRecoveryOverview = z.infer<typeof OrganizationRecoveryOverview>;
+export declare const ConfigureOrganizationRecoveryPolicyRequest: z.ZodObject<{
+    custodianMembershipIds: z.ZodTuple<[z.ZodString, z.ZodString, z.ZodString], null>;
+    expectedPolicyRevision: z.ZodNumber;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type ConfigureOrganizationRecoveryPolicyRequest = z.infer<typeof ConfigureOrganizationRecoveryPolicyRequest>;
+export declare const AcceptOrganizationRecoveryCustodyRequest: z.ZodObject<{
+    expectedPolicyRevision: z.ZodNumber;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type AcceptOrganizationRecoveryCustodyRequest = z.infer<typeof AcceptOrganizationRecoveryCustodyRequest>;
+export declare const DisableOrganizationRecoveryPolicyRequest: z.ZodObject<{
+    expectedPolicyRevision: z.ZodNumber;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type DisableOrganizationRecoveryPolicyRequest = z.infer<typeof DisableOrganizationRecoveryPolicyRequest>;
+export declare const StartOrganizationRecoveryOperationRequest: z.ZodObject<{
+    targetMembershipId: z.ZodString;
+    expectedPolicyRevision: z.ZodNumber;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type StartOrganizationRecoveryOperationRequest = z.infer<typeof StartOrganizationRecoveryOperationRequest>;
+export declare const OrganizationRecoveryOperationCommandRequest: z.ZodObject<{
+    expectedOperationRevision: z.ZodNumber;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type OrganizationRecoveryOperationCommandRequest = z.infer<typeof OrganizationRecoveryOperationCommandRequest>;
+export declare const OrganizationRecoveryMutationResponse: z.ZodObject<{
+    replay: z.ZodBoolean;
+    overview: z.ZodObject<{
+        organizationId: z.ZodString;
+        availability: z.ZodEnum<{
+            available: "available";
+            recovery_unavailable: "recovery_unavailable";
+        }>;
+        unavailableReason: z.ZodNullable<z.ZodEnum<{
+            degraded: "degraded";
+            disabled: "disabled";
+            identity_unavailable: "identity_unavailable";
+            no_policy: "no_policy";
+            pending_acceptance: "pending_acceptance";
+        }>>;
+        recentReauthenticationAt: z.ZodNullable<z.ZodString>;
+        eligibleMembers: z.ZodArray<z.ZodObject<{
+            membershipId: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+            email: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        policy: z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            organizationId: z.ZodString;
+            revision: z.ZodNumber;
+            state: z.ZodEnum<{
+                active: "active";
+                degraded: "degraded";
+                disabled: "disabled";
+                pending_acceptance: "pending_acceptance";
+                superseded: "superseded";
+            }>;
+            custodians: z.ZodArray<z.ZodObject<{
+                membershipId: z.ZodString;
+                name: z.ZodNullable<z.ZodString>;
+                email: z.ZodNullable<z.ZodString>;
+                ordinal: z.ZodNumber;
+                enrollmentState: z.ZodEnum<{
+                    accepted: "accepted";
+                    ineligible: "ineligible";
+                    pending_acceptance: "pending_acceptance";
+                }>;
+                acceptedAt: z.ZodNullable<z.ZodString>;
+            }, z.core.$strict>>;
+            createdAt: z.ZodString;
+            updatedAt: z.ZodString;
+        }, z.core.$strict>>;
+        operation: z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            organizationId: z.ZodString;
+            policyId: z.ZodString;
+            policyRevision: z.ZodNumber;
+            revision: z.ZodNumber;
+            state: z.ZodEnum<{
+                cancelled: "cancelled";
+                collecting: "collecting";
+                cooling: "cooling";
+                executed: "executed";
+                expired: "expired";
+                superseded: "superseded";
+            }>;
+            target: z.ZodObject<{
+                membershipId: z.ZodString;
+                name: z.ZodNullable<z.ZodString>;
+                email: z.ZodNullable<z.ZodString>;
+            }, z.core.$strict>;
+            approvals: z.ZodArray<z.ZodObject<{
+                membershipId: z.ZodString;
+                name: z.ZodNullable<z.ZodString>;
+                email: z.ZodNullable<z.ZodString>;
+                approvedAt: z.ZodString;
+            }, z.core.$strict>>;
+            approvalCount: z.ZodNumber;
+            quorumAt: z.ZodNullable<z.ZodString>;
+            executableAt: z.ZodNullable<z.ZodString>;
+            expiresAt: z.ZodString;
+            executedAt: z.ZodNullable<z.ZodString>;
+            cancelledAt: z.ZodNullable<z.ZodString>;
+            notificationJournaled: z.ZodBoolean;
+            createdAt: z.ZodString;
+            updatedAt: z.ZodString;
+        }, z.core.$strict>>;
+        capabilities: z.ZodObject<{
+            configure: z.ZodBoolean;
+            accept: z.ZodBoolean;
+            disable: z.ZodBoolean;
+            start: z.ZodBoolean;
+            approve: z.ZodBoolean;
+            cancel: z.ZodBoolean;
+            execute: z.ZodBoolean;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type OrganizationRecoveryMutationResponse = z.infer<typeof OrganizationRecoveryMutationResponse>;

package/dist/organization-recovery.js

@@ -0,0 +1,37 @@
+import {
+  AcceptOrganizationRecoveryCustodyRequest,
+  ConfigureOrganizationRecoveryPolicyRequest,
+  DisableOrganizationRecoveryPolicyRequest,
+  OrganizationRecoveryApproval,
+  OrganizationRecoveryCapabilities,
+  OrganizationRecoveryCustodian,
+  OrganizationRecoveryMemberSummary,
+  OrganizationRecoveryMutationResponse,
+  OrganizationRecoveryOperation,
+  OrganizationRecoveryOperationCommandRequest,
+  OrganizationRecoveryOperationState,
+  OrganizationRecoveryOverview,
+  OrganizationRecoveryPolicy,
+  OrganizationRecoveryPolicyState,
+  OrganizationRecoveryUnavailableReason,
+  StartOrganizationRecoveryOperationRequest
+} from "./chunk-BCS7WHCK.js";
+export {
+  AcceptOrganizationRecoveryCustodyRequest,
+  ConfigureOrganizationRecoveryPolicyRequest,
+  DisableOrganizationRecoveryPolicyRequest,
+  OrganizationRecoveryApproval,
+  OrganizationRecoveryCapabilities,
+  OrganizationRecoveryCustodian,
+  OrganizationRecoveryMemberSummary,
+  OrganizationRecoveryMutationResponse,
+  OrganizationRecoveryOperation,
+  OrganizationRecoveryOperationCommandRequest,
+  OrganizationRecoveryOperationState,
+  OrganizationRecoveryOverview,
+  OrganizationRecoveryPolicy,
+  OrganizationRecoveryPolicyState,
+  OrganizationRecoveryUnavailableReason,
+  StartOrganizationRecoveryOperationRequest
+};
+//# sourceMappingURL=organization-recovery.js.map

package/dist/organization-recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/personal-github.js

@@ -1,23 +1,24 @@
 import {
   ConnectionMetadata
-} from "./chunk-4I7DWNRR.js";
+} from "./chunk-ILB4IYNN.js";
+import "./chunk-WYBDERIY.js";
 import "./chunk-MRWYRAS5.js";
+import "./chunk-CM6BMECR.js";
 import "./chunk-JUFK3T4Q.js";
-import "./chunk-WYBDERIY.js";
+import "./chunk-YBW5JSA3.js";
 import "./chunk-N6GRVXAJ.js";
 import "./chunk-3SIZGL3O.js";
 import "./chunk-NVJMJWLL.js";
+import "./chunk-YRKRZ6OF.js";
 import "./chunk-7RMTKFJW.js";
 import "./chunk-Y3KNXVTD.js";
 import "./chunk-RIY7GYQS.js";
-import "./chunk-YRKRZ6OF.js";
-import "./chunk-CM6BMECR.js";
 import "./chunk-D2HKF2EF.js";
 import "./chunk-MYBZRDTY.js";
 import "./chunk-TXTQIYCV.js";
 import "./chunk-PX3VCKAU.js";
+import "./chunk-BCS7WHCK.js";
 import "./chunk-M5ZGRVIQ.js";
-import "./chunk-YBW5JSA3.js";
 
 // src/personal-github.ts
 import { z } from "zod";