@opengeni/contracts 2.7.0 → 2.9.2

package/dist/index.js

@@ -6,9 +6,11 @@ import {
   AGENT_AUTHORED_DURABLE_TEXT_STYLE,
   AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS,
   AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_TOO_LONG_MESSAGE,
+  AGENT_AUTHORED_INSTRUCTION_POLICY_STYLE,
   AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS,
   AGENT_AUTHORED_PREFERENCE_CONTENT_TOO_LONG_MESSAGE,
   AGENT_AUTHORED_REMEMBER_CONTENT_TOO_LONG_MESSAGE,
+  AGENT_AUTHORED_SKILL_STYLE,
   API_INTEGRATION_OAUTH_CREDENTIAL_ROLE,
   ATLASSIAN_CREDENTIAL_LABEL,
   ATLASSIAN_CREDENTIAL_ROLE,
@@ -19,8 +21,6 @@ import {
   ATTEMPT_TOOL_CATALOG_MAX_ENTRIES,
   ATTEMPT_TOOL_CATALOG_MAX_PATH_SEGMENTS,
   ATTEMPT_TOOL_CATALOG_VERSION,
-  AUTOMATIC_SESSION_TITLE_FALLBACK,
-  AUTOMATIC_SESSION_TITLE_MAX_GRAPHEMES,
   AUTOMATION_EVENT_PAYLOAD_MAX_BYTES,
   AUTOMATION_MAX_MATCHED_TRIGGERS,
   AUTOMATION_SESSION_TEMPLATE_MAX_BYTES,
@@ -297,11 +297,15 @@ import {
   CompanyProfileActivationEvent,
   CompanyProfileActivationType,
   CompanyProfileAgentAttempt,
+  CompanyProfileAgentAutomaticActivationReceipt,
   CompanyProfileAgentConfirmRequest,
   CompanyProfileAgentConfirmationReceipt,
   CompanyProfileAgentHumanInputPrompt,
+  CompanyProfileAgentPolicy,
+  CompanyProfileAgentPolicyMode,
   CompanyProfileAgentProposalReceipt,
   CompanyProfileAgentProposalRequest,
+  CompanyProfileAgentReviewRequiredReceipt,
   CompanyProfileConflictResponse,
   CompanyProfileContent,
   CompanyProfileDiffRequest,
@@ -378,6 +382,7 @@ import {
   CreateKnowledgeDropRequest,
   CreateKnowledgeMemoryRequest,
   CreateNetworkRouteRequest,
+  CreateOrganizationApiKeyRequest,
   CreateOrganizationInvitationRequest,
   CreateOrganizationRequest,
   CreateOrganizationResponse,
@@ -465,6 +470,8 @@ import {
   EnrollmentCredentialsResponse,
   EnrollmentOs,
   EnrollmentSummary,
+  EnsureWorkspaceRequest,
+  EnsureWorkspaceResponse,
   EntitlementDecision,
   EntitlementValue,
   Entitlements,
@@ -756,6 +763,7 @@ import {
   ListSlackUserLinkAccessRequestsResponse,
   ListUserResourceAuthoritiesQuery,
   ListUserResourceAuthoritiesResponse,
+  ListWorkspaceMemberCandidatesResponse,
   ListWorkspaceMembersResponse,
   MAX_NESTED_AGENT_DEPTH,
   MAX_RESOLVED_VARIABLE_SET_ATTACHMENTS,
@@ -1042,6 +1050,7 @@ import {
   RunDocumentDefaultCollectionBackfillRequest,
   SANDBOX_FILE_ARTIFACT_MAX_BYTES,
   SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND,
+  SCHEDULED_OCCURRENCE_TASK_LABEL,
   SCHEDULED_TASK_ACCEPTED_EXECUTION_MAX_BYTES,
   SCHEDULED_TASK_AGENT_CONFIG_MAX_BYTES,
   SCHEDULED_TASK_METADATA_MAX_BYTES,
@@ -1080,7 +1089,6 @@ import {
   SESSION_MCP_SERVERS_MAX,
   SESSION_OPERATION_KEY_MAX_CHARS,
   SESSION_SYSTEM_UPDATE_WAKE_CLASS,
-  SESSION_TITLE_MAX_CHARACTERS,
   SITE_AUTH_MAINTENANCE_CONNECTION_CONTEXT_KEY,
   SITE_AUTH_MAINTENANCE_OPERATION_CONTEXT_KEY,
   SLACK_TASK_POLICY_ID_MAX_CHARS,
@@ -1348,6 +1356,7 @@ import {
   UpdateAutomationTriggerRequest,
   UpdateBrowserIdentityRequest,
   UpdateChannelRequest,
+  UpdateCompanyProfileAgentPolicyRequest,
   UpdateCompanyProfileRequest,
   UpdateConnectionRequest,
   UpdateKnowledgeMemoryRequest,
@@ -1403,6 +1412,8 @@ import {
   UserResourceGrantStatus,
   UserResourceKind,
   UserResourceLifecycleGrantMode,
+  VARIABLE_SET_RESERVED_EXACT_NAMES,
+  VARIABLE_SET_RESERVED_PREFIXES,
   VIRTUAL_WORKSPACE_ROOT,
   VOICE_INPUT_ACCEPTED_MIME_TYPES,
   VOICE_INPUT_MAX_DURATION_SECONDS,
@@ -1560,6 +1571,7 @@ import {
   WorkspaceLearningSourceOverrides,
   WorkspaceLearningSourceRef,
   WorkspaceMember,
+  WorkspaceMemberCandidate,
   WorkspaceMemberRole,
   WorkspaceMemoryPromptMode,
   WorkspaceMemorySearchMode,
@@ -1647,7 +1659,6 @@ import {
   mergeToolRefs,
   metadataWithTurnExecutionPolicyV1,
   networkRoutePlacementCompatibilityIssue,
-  normalizeAutomaticSessionTitle,
   normalizeCompanyProfileStableKey,
   normalizePreferenceRegistryStableKey,
   normalizeRepositorySubpath,
@@ -1709,6 +1720,7 @@ import {
   toolResultSpillFilename,
   toolResultSpillSandboxPath,
   turnExecutionPolicyAuditMetadata,
+  variableSetVariableNameReservation,
   verifyDelegatedAccessToken,
   verifyEnrollToken,
   verifyEnrollmentBearer,
@@ -1720,7 +1732,7 @@ import {
   workspaceLearningPolicyRouterContext,
   workspaceLearningSourceKey,
   workspaceSlackReactionChannelAllowed
-} from "./chunk-ILB4IYNN.js";
+} from "./chunk-AWNGBY5I.js";
 import {
   ConnectorDocumentDestination,
   ConnectorDocumentDestinationAuthority,
@@ -1747,6 +1759,14 @@ import {
   hasOpenGeniSlackBotSearchScopes,
   hasOpenGeniSlackReactionScope
 } from "./chunk-MRWYRAS5.js";
+import {
+  AUTOMATIC_SESSION_TITLE_FALLBACK,
+  AUTOMATIC_SESSION_TITLE_MAX_GRAPHEMES,
+  SESSION_TITLE_MAX_CHARACTERS,
+  boundAutomaticSessionTitle,
+  containsSensitiveAutomaticSessionTitleValue,
+  normalizeAutomaticSessionTitle
+} from "./chunk-4IVHBXRI.js";
 import {
   WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1,
   XaiProviderAccountAuthoritySnapshotV1
@@ -2012,9 +2032,11 @@ export {
   AGENT_AUTHORED_DURABLE_TEXT_STYLE,
   AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS,
   AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_TOO_LONG_MESSAGE,
+  AGENT_AUTHORED_INSTRUCTION_POLICY_STYLE,
   AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS,
   AGENT_AUTHORED_PREFERENCE_CONTENT_TOO_LONG_MESSAGE,
   AGENT_AUTHORED_REMEMBER_CONTENT_TOO_LONG_MESSAGE,
+  AGENT_AUTHORED_SKILL_STYLE,
   API_INTEGRATION_OAUTH_CREDENTIAL_ROLE,
   ATLASSIAN_CREDENTIAL_LABEL,
   ATLASSIAN_CREDENTIAL_ROLE,
@@ -2330,11 +2352,15 @@ export {
   CompanyProfileActivationEvent,
   CompanyProfileActivationType,
   CompanyProfileAgentAttempt,
+  CompanyProfileAgentAutomaticActivationReceipt,
   CompanyProfileAgentConfirmRequest,
   CompanyProfileAgentConfirmationReceipt,
   CompanyProfileAgentHumanInputPrompt,
+  CompanyProfileAgentPolicy,
+  CompanyProfileAgentPolicyMode,
   CompanyProfileAgentProposalReceipt,
   CompanyProfileAgentProposalRequest,
+  CompanyProfileAgentReviewRequiredReceipt,
   CompanyProfileConflictResponse,
   CompanyProfileContent,
   CompanyProfileDiffRequest,
@@ -2425,6 +2451,7 @@ export {
   CreateKnowledgeDropRequest,
   CreateKnowledgeMemoryRequest,
   CreateNetworkRouteRequest,
+  CreateOrganizationApiKeyRequest,
   CreateOrganizationInvitationRequest,
   CreateOrganizationRequest,
   CreateOrganizationResponse,
@@ -2545,6 +2572,8 @@ export {
   EnrollmentCredentialsResponse,
   EnrollmentOs,
   EnrollmentSummary,
+  EnsureWorkspaceRequest,
+  EnsureWorkspaceResponse,
   EntitlementDecision,
   EntitlementValue,
   Entitlements,
@@ -2844,6 +2873,7 @@ export {
   ListSlackUserLinkAccessRequestsResponse,
   ListUserResourceAuthoritiesQuery,
   ListUserResourceAuthoritiesResponse,
+  ListWorkspaceMemberCandidatesResponse,
   ListWorkspaceMembersResponse,
   MAX_COMMITTED_TRANSACTION_BYTES,
   MAX_COMMITTED_TRANSACTION_CAUSAL_REPLICAS,
@@ -3188,6 +3218,7 @@ export {
   RunDocumentDefaultCollectionBackfillRequest,
   SANDBOX_FILE_ARTIFACT_MAX_BYTES,
   SANDBOX_PROVIDER_INSTANCE_ID_FIELDS_BY_BACKEND,
+  SCHEDULED_OCCURRENCE_TASK_LABEL,
   SCHEDULED_TASK_ACCEPTED_EXECUTION_MAX_BYTES,
   SCHEDULED_TASK_AGENT_CONFIG_MAX_BYTES,
   SCHEDULED_TASK_METADATA_MAX_BYTES,
@@ -3513,6 +3544,7 @@ export {
   UpdateAutomationTriggerRequest,
   UpdateBrowserIdentityRequest,
   UpdateChannelRequest,
+  UpdateCompanyProfileAgentPolicyRequest,
   UpdateCompanyProfileRequest,
   UpdateConnectionRequest,
   UpdateKnowledgeMemoryRequest,
@@ -3569,6 +3601,8 @@ export {
   UserResourceGrantStatus,
   UserResourceKind,
   UserResourceLifecycleGrantMode,
+  VARIABLE_SET_RESERVED_EXACT_NAMES,
+  VARIABLE_SET_RESERVED_PREFIXES,
   VIDEO_GENERATION_SCHEMA_VERSION,
   VIRTUAL_WORKSPACE_ROOT,
   VOICE_INPUT_ACCEPTED_MIME_TYPES,
@@ -3745,6 +3779,7 @@ export {
   WorkspaceLearningSourceOverrides,
   WorkspaceLearningSourceRef,
   WorkspaceMember,
+  WorkspaceMemberCandidate,
   WorkspaceMemberRole,
   WorkspaceMemoryPromptMode,
   WorkspaceMemorySearchMode,
@@ -3811,6 +3846,7 @@ export {
   atlassianScopesAllowRead,
   backendForNativeSnapshotProvider,
   bindConnectorDocumentDestination,
+  boundAutomaticSessionTitle,
   boundSessionEvent,
   boundSessionEventPayload,
   boundWorkspaceControlEvent,
@@ -3827,6 +3863,7 @@ export {
   comparePersonalSlackCanonicalConnections,
   connectorDestinationDocumentAuthority,
   connectorDocumentDestinationCollectionId,
+  containsSensitiveAutomaticSessionTitleValue,
   createCodexFleetReplayRecordV1,
   currentEditableArtifactCompatibility,
   decodeCommittedTransactionSummary,
@@ -3963,6 +4000,7 @@ export {
   toolResultSpillSandboxPath,
   turnExecutionPolicyAuditMetadata,
   validateRetainedOutputEvidence,
+  variableSetVariableNameReservation,
   verifyDelegatedAccessToken,
   verifyEnrollToken,
   verifyEnrollmentBearer,

package/dist/managed-auth-session-sets.d.ts

@@ -99,6 +99,25 @@ export declare const ManagedAuthLoginTransaction: z.ZodObject<{
     returnIntentId: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export type ManagedAuthLoginTransaction = z.infer<typeof ManagedAuthLoginTransaction>;
+export declare const ManagedAuthSocialProvider: z.ZodEnum<{
+    github: "github";
+    google: "google";
+}>;
+export type ManagedAuthSocialProvider = z.infer<typeof ManagedAuthSocialProvider>;
+export declare const StartManagedAuthSocialTransactionRequest: z.ZodObject<{
+    operationId: z.ZodString;
+    expectedGeneration: z.ZodString;
+    transactionId: z.ZodString;
+    provider: z.ZodEnum<{
+        github: "github";
+        google: "google";
+    }>;
+}, z.core.$strip>;
+export type StartManagedAuthSocialTransactionRequest = z.infer<typeof StartManagedAuthSocialTransactionRequest>;
+export declare const StartManagedAuthSocialTransactionResponse: z.ZodObject<{
+    url: z.ZodString;
+}, z.core.$strip>;
+export type StartManagedAuthSocialTransactionResponse = z.infer<typeof StartManagedAuthSocialTransactionResponse>;
 export declare const CompleteManagedAuthEmailPasswordTransactionRequest: z.ZodObject<{
     operationId: z.ZodString;
     expectedGeneration: z.ZodString;

package/dist/managed-auth-session-sets.js

@@ -82,6 +82,14 @@ var ManagedAuthLoginTransaction = z.object({
   expiresAt: z.string().datetime(),
   returnIntentId: z.string().uuid().nullable()
 });
+var ManagedAuthSocialProvider = z.enum(["google", "github"]);
+var StartManagedAuthSocialTransactionRequest = ManagedAuthOperationIdentity.extend({
+  transactionId: z.string().uuid(),
+  provider: ManagedAuthSocialProvider
+});
+var StartManagedAuthSocialTransactionResponse = z.object({
+  url: z.string().url().max(4096)
+});
 var CompleteManagedAuthEmailPasswordTransactionRequest = ManagedAuthOperationIdentity.extend({
   transactionId: z.string().uuid(),
   email: z.string().email().max(320),
@@ -159,8 +167,11 @@ export {
   ManagedAuthSessionSetMode,
   ManagedAuthSessionSetProjection,
   ManagedAuthSessionSetState,
+  ManagedAuthSocialProvider,
   ManagedAuthVerifiedClaim,
   ResolveManagedAuthDeepLinkRequest,
-  SelectManagedAuthLoginSlotRequest
+  SelectManagedAuthLoginSlotRequest,
+  StartManagedAuthSocialTransactionRequest,
+  StartManagedAuthSocialTransactionResponse
 };
 //# sourceMappingURL=managed-auth-session-sets.js.map

package/dist/managed-auth-session-sets.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/managed-auth-session-sets.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const MANAGED_AUTH_SESSION_SET_MAX_SLOTS = 8 as const;\nexport const MANAGED_AUTH_TRANSACTION_TTL_SECONDS = 600 as const;\nexport const MANAGED_AUTH_RETURN_INTENT_MAX_BYTES = 2_048 as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER = \"x-opengeni-api-contract\" as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION =\n  \"2026-08-personal-only-organization-setup-v1\" as const;\n\nexport const ManagedAuthSessionSetMode = z.enum([\"legacy\", \"dual\", \"broker\"]);\nexport type ManagedAuthSessionSetMode = z.infer<typeof ManagedAuthSessionSetMode>;\n\nexport const ManagedAuthLoginSlotState = z.enum([\"active\", \"reauth_required\"]);\nexport type ManagedAuthLoginSlotState = z.infer<typeof ManagedAuthLoginSlotState>;\n\nexport const ManagedAuthVerifiedClaim = z.object({\n  kind: z.literal(\"email\"),\n  value: z.string().email().max(320),\n});\nexport type ManagedAuthVerifiedClaim = z.infer<typeof ManagedAuthVerifiedClaim>;\n\n/** Secret-free, browser-safe summary. Provider session ids and tokens never enter this shape. */\nexport const ManagedAuthLoginSlot = z.object({\n  id: z.string().uuid(),\n  displayName: z.string().min(1).max(256),\n  verifiedClaim: ManagedAuthVerifiedClaim,\n  state: ManagedAuthLoginSlotState,\n});\nexport type ManagedAuthLoginSlot = z.infer<typeof ManagedAuthLoginSlot>;\n\nexport const ManagedAuthSessionSetState = z.enum([\"ready\", \"actor_change_required\"]);\nexport type ManagedAuthSessionSetState = z.infer<typeof ManagedAuthSessionSetState>;\n\nexport const ManagedAuthSessionSetProjection = z.object({\n  mode: ManagedAuthSessionSetMode,\n  generation: z.string().regex(/^[1-9][0-9]*$/),\n  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n  csrfToken: z.string().min(32).max(512),\n  selectedSlotId: z.string().uuid().nullable(),\n  state: ManagedAuthSessionSetState,\n  slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS),\n});\nexport type ManagedAuthSessionSetProjection = z.infer<typeof ManagedAuthSessionSetProjection>;\n\nexport const ManagedAuthOperationIdentity = z.object({\n  operationId: z.string().uuid(),\n  expectedGeneration: z.string().regex(/^[1-9][0-9]*$/),\n});\nexport type ManagedAuthOperationIdentity = z.infer<typeof ManagedAuthOperationIdentity>;\n\nexport const BootstrapManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type BootstrapManagedAuthSessionSetRequest = z.infer<\n  typeof BootstrapManagedAuthSessionSetRequest\n>;\n\nexport const ManagedAuthReturnIntent = z\n  .string()\n  .min(1)\n  .superRefine((value, context) => {\n    if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {\n      context.addIssue({ code: \"custom\", message: \"return intent exceeds its UTF-8 byte limit\" });\n    }\n    if (\n      !value.startsWith(\"/\") ||\n      value.startsWith(\"//\") ||\n      value.includes(\"?\") ||\n      value.includes(\"#\") ||\n      /[\\u0000-\\u001f\\u007f\\\\]/.test(value)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent must be a safe same-origin path\",\n      });\n      return;\n    }\n    try {\n      const parsed = new URL(value, \"https://opengeni.invalid\");\n      const uuid = \"[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\";\n      const supportedPath = new RegExp(\n        `^/(?:sessions/${uuid}|workspaces/${uuid}(?:/sessions(?:/${uuid})?)?)$`,\n        \"i\",\n      );\n      if (\n        parsed.origin !== \"https://opengeni.invalid\" ||\n        parsed.username ||\n        parsed.password ||\n        parsed.search ||\n        parsed.hash ||\n        !supportedPath.test(value) ||\n        parsed.pathname !== value\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"return intent contains unsafe authority data\",\n        });\n      }\n    } catch {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent is not a valid same-origin path\",\n      });\n    }\n  });\n\nexport const BeginManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({\n  kind: z.enum([\"add\", \"reauth\"]),\n  slotId: z.string().uuid().optional(),\n  returnIntent: ManagedAuthReturnIntent.optional(),\n}).superRefine((value, context) => {\n  if ((value.kind === \"reauth\") !== Boolean(value.slotId)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"slotId\"],\n      message: \"reauth requires exactly one slot id and add forbids one\",\n    });\n  }\n});\nexport type BeginManagedAuthLoginTransactionRequest = z.infer<\n  typeof BeginManagedAuthLoginTransactionRequest\n>;\n\nexport const ManagedAuthLoginTransaction = z.object({\n  id: z.string().uuid(),\n  kind: z.enum([\"add\", \"reauth\"]),\n  expiresAt: z.string().datetime(),\n  returnIntentId: z.string().uuid().nullable(),\n});\nexport type ManagedAuthLoginTransaction = z.infer<typeof ManagedAuthLoginTransaction>;\n\nexport const CompleteManagedAuthEmailPasswordTransactionRequest =\n  ManagedAuthOperationIdentity.extend({\n    transactionId: z.string().uuid(),\n    email: z.string().email().max(320),\n    password: z.string().min(1).max(1_024),\n  });\nexport type CompleteManagedAuthEmailPasswordTransactionRequest = z.infer<\n  typeof CompleteManagedAuthEmailPasswordTransactionRequest\n>;\n\nexport const CompleteManagedAuthLoginTransactionResponse = z.object({\n  projection: ManagedAuthSessionSetProjection,\n  returnIntent: ManagedAuthReturnIntent.nullable(),\n});\nexport type CompleteManagedAuthLoginTransactionResponse = z.infer<\n  typeof CompleteManagedAuthLoginTransactionResponse\n>;\n\nexport const CancelManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({\n  transactionId: z.string().uuid(),\n});\nexport type CancelManagedAuthLoginTransactionRequest = z.infer<\n  typeof CancelManagedAuthLoginTransactionRequest\n>;\n\nexport const SelectManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({\n  slotId: z.string().uuid(),\n});\nexport type SelectManagedAuthLoginSlotRequest = z.infer<typeof SelectManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({\n  slotId: z.string().uuid(),\n  replacementSlotId: z.string().uuid().nullable(),\n});\nexport type LogoutManagedAuthLoginSlotRequest = z.infer<typeof LogoutManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type LogoutManagedAuthSessionSetRequest = z.infer<typeof LogoutManagedAuthSessionSetRequest>;\n\nexport const ManagedAuthLogoutAllReceipt = z.object({\n  generation: z.string().regex(/^[1-9][0-9]*$/),\n  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n  state: z.literal(\"logged_out\"),\n});\nexport type ManagedAuthLogoutAllReceipt = z.infer<typeof ManagedAuthLogoutAllReceipt>;\n\nexport const ResolveManagedAuthDeepLinkRequest = z.object({\n  path: ManagedAuthReturnIntent,\n});\nexport type ResolveManagedAuthDeepLinkRequest = z.infer<typeof ResolveManagedAuthDeepLinkRequest>;\n\nexport const ManagedAuthDeepLinkResolution = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"current\") }),\n  z.object({ kind: z.literal(\"switch_required\"), slot: ManagedAuthLoginSlot }),\n  z.object({ kind: z.literal(\"unavailable\") }),\n]);\nexport type ManagedAuthDeepLinkResolution = z.infer<typeof ManagedAuthDeepLinkResolution>;\n\nexport const ManagedAuthSessionSetErrorCode = z.enum([\n  \"actor_change_required\",\n  \"actor_mutation_in_flight\",\n  \"api_contract_changed\",\n  \"browser_session_set_required\",\n  \"browser_session_set_unavailable\",\n  \"generation_conflict\",\n  \"invalid_browser_session_set_request\",\n  \"invalid_transaction\",\n  \"managed_authentication_required\",\n  \"managed_authentication_unavailable\",\n  \"operation_outcome_unknown\",\n  \"operation_reused\",\n  \"origin_rejected\",\n  \"login_transaction_rate_limited\",\n  \"provider_route_blocked\",\n  \"slot_limit_reached\",\n  \"slot_already_exists\",\n  \"slot_unavailable\",\n]);\nexport type ManagedAuthSessionSetErrorCode = z.infer<typeof ManagedAuthSessionSetErrorCode>;\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,qCAAqC;AAC3C,IAAM,uCAAuC;AAC7C,IAAM,uCAAuC;AAC7C,IAAM,+CAA+C;AACrD,IAAM,iDACX;AAEK,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,QAAQ,QAAQ,CAAC;AAGrE,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,iBAAiB,CAAC;AAGtE,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,MAAM,EAAE,QAAQ,OAAO;AAAA,EACvB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AACnC,CAAC;AAIM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe;AAAA,EACf,OAAO;AACT,CAAC;AAGM,IAAM,6BAA6B,EAAE,KAAK,CAAC,SAAS,uBAAuB,CAAC;AAG5E,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM;AAAA,EACN,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,GAAG;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO;AAAA,EACP,OAAO,EAAE,MAAM,oBAAoB,EAAE,IAAI,kCAAkC;AAC7E,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,oBAAoB,EAAE,OAAO,EAAE,MAAM,eAAe;AACtD,CAAC;AAGM,IAAM,wCAAwC;AAK9C,IAAM,0BAA0B,EACpC,OAAO,EACP,IAAI,CAAC,EACL,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,aAAa,sCAAsC;AACrF,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,6CAA6C,CAAC;AAAA,EAC5F;AACA,MACE,CAAC,MAAM,WAAW,GAAG,KACrB,MAAM,WAAW,IAAI,KACrB,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,KAClB,0BAA0B,KAAK,KAAK,GACpC;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,OAAO,0BAA0B;AACxD,UAAM,OAAO;AACb,UAAM,gBAAgB,IAAI;AAAA,MACxB,iBAAiB,IAAI,eAAe,IAAI,mBAAmB,IAAI;AAAA,MAC/D;AAAA,IACF;AACA,QACE,OAAO,WAAW,8BAClB,OAAO,YACP,OAAO,YACP,OAAO,UACP,OAAO,QACP,CAAC,cAAc,KAAK,KAAK,KACzB,OAAO,aAAa,OACpB;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AACN,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAEI,IAAM,0CAA0C,6BAA6B,OAAO;AAAA,EACzF,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,cAAc,wBAAwB,SAAS;AACjD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,MAAK,MAAM,SAAS,aAAc,QAAQ,MAAM,MAAM,GAAG;AACvD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAKM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,qDACX,6BAA6B,OAAO;AAAA,EAClC,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACjC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK;AACvC,CAAC;AAKI,IAAM,8CAA8C,EAAE,OAAO;AAAA,EAClE,YAAY;AAAA,EACZ,cAAc,wBAAwB,SAAS;AACjD,CAAC;AAKM,IAAM,2CAA2C,6BAA6B,OAAO;AAAA,EAC1F,eAAe,EAAE,OAAO,EAAE,KAAK;AACjC,CAAC;AAKM,IAAM,oCAAoC,6BAA6B,OAAO;AAAA,EACnF,QAAQ,EAAE,OAAO,EAAE,KAAK;AAC1B,CAAC;AAGM,IAAM,oCAAoC,6BAA6B,OAAO;AAAA,EACnF,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAChD,CAAC;AAGM,IAAM,qCAAqC;AAG3C,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,OAAO,EAAE,QAAQ,YAAY;AAC/B,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,MAAM;AACR,CAAC;AAGM,IAAM,gCAAgC,EAAE,mBAAmB,QAAQ;AAAA,EACxE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;AAAA,EACvC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,iBAAiB,GAAG,MAAM,qBAAqB,CAAC;AAAA,EAC3E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,aAAa,EAAE,CAAC;AAC7C,CAAC;AAGM,IAAM,iCAAiC,EAAE,KAAK;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":[]}
+{"version":3,"sources":["../src/managed-auth-session-sets.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const MANAGED_AUTH_SESSION_SET_MAX_SLOTS = 8 as const;\nexport const MANAGED_AUTH_TRANSACTION_TTL_SECONDS = 600 as const;\nexport const MANAGED_AUTH_RETURN_INTENT_MAX_BYTES = 2_048 as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER = \"x-opengeni-api-contract\" as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION =\n  \"2026-08-personal-only-organization-setup-v1\" as const;\n\nexport const ManagedAuthSessionSetMode = z.enum([\"legacy\", \"dual\", \"broker\"]);\nexport type ManagedAuthSessionSetMode = z.infer<typeof ManagedAuthSessionSetMode>;\n\nexport const ManagedAuthLoginSlotState = z.enum([\"active\", \"reauth_required\"]);\nexport type ManagedAuthLoginSlotState = z.infer<typeof ManagedAuthLoginSlotState>;\n\nexport const ManagedAuthVerifiedClaim = z.object({\n  kind: z.literal(\"email\"),\n  value: z.string().email().max(320),\n});\nexport type ManagedAuthVerifiedClaim = z.infer<typeof ManagedAuthVerifiedClaim>;\n\n/** Secret-free, browser-safe summary. Provider session ids and tokens never enter this shape. */\nexport const ManagedAuthLoginSlot = z.object({\n  id: z.string().uuid(),\n  displayName: z.string().min(1).max(256),\n  verifiedClaim: ManagedAuthVerifiedClaim,\n  state: ManagedAuthLoginSlotState,\n});\nexport type ManagedAuthLoginSlot = z.infer<typeof ManagedAuthLoginSlot>;\n\nexport const ManagedAuthSessionSetState = z.enum([\"ready\", \"actor_change_required\"]);\nexport type ManagedAuthSessionSetState = z.infer<typeof ManagedAuthSessionSetState>;\n\nexport const ManagedAuthSessionSetProjection = z.object({\n  mode: ManagedAuthSessionSetMode,\n  generation: z.string().regex(/^[1-9][0-9]*$/),\n  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n  csrfToken: z.string().min(32).max(512),\n  selectedSlotId: z.string().uuid().nullable(),\n  state: ManagedAuthSessionSetState,\n  slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS),\n});\nexport type ManagedAuthSessionSetProjection = z.infer<typeof ManagedAuthSessionSetProjection>;\n\nexport const ManagedAuthOperationIdentity = z.object({\n  operationId: z.string().uuid(),\n  expectedGeneration: z.string().regex(/^[1-9][0-9]*$/),\n});\nexport type ManagedAuthOperationIdentity = z.infer<typeof ManagedAuthOperationIdentity>;\n\nexport const BootstrapManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type BootstrapManagedAuthSessionSetRequest = z.infer<\n  typeof BootstrapManagedAuthSessionSetRequest\n>;\n\nexport const ManagedAuthReturnIntent = z\n  .string()\n  .min(1)\n  .superRefine((value, context) => {\n    if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {\n      context.addIssue({ code: \"custom\", message: \"return intent exceeds its UTF-8 byte limit\" });\n    }\n    if (\n      !value.startsWith(\"/\") ||\n      value.startsWith(\"//\") ||\n      value.includes(\"?\") ||\n      value.includes(\"#\") ||\n      /[\\u0000-\\u001f\\u007f\\\\]/.test(value)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent must be a safe same-origin path\",\n      });\n      return;\n    }\n    try {\n      const parsed = new URL(value, \"https://opengeni.invalid\");\n      const uuid = \"[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\";\n      const supportedPath = new RegExp(\n        `^/(?:sessions/${uuid}|workspaces/${uuid}(?:/sessions(?:/${uuid})?)?)$`,\n        \"i\",\n      );\n      if (\n        parsed.origin !== \"https://opengeni.invalid\" ||\n        parsed.username ||\n        parsed.password ||\n        parsed.search ||\n        parsed.hash ||\n        !supportedPath.test(value) ||\n        parsed.pathname !== value\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"return intent contains unsafe authority data\",\n        });\n      }\n    } catch {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent is not a valid same-origin path\",\n      });\n    }\n  });\n\nexport const BeginManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({\n  kind: z.enum([\"add\", \"reauth\"]),\n  slotId: z.string().uuid().optional(),\n  returnIntent: ManagedAuthReturnIntent.optional(),\n}).superRefine((value, context) => {\n  if ((value.kind === \"reauth\") !== Boolean(value.slotId)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"slotId\"],\n      message: \"reauth requires exactly one slot id and add forbids one\",\n    });\n  }\n});\nexport type BeginManagedAuthLoginTransactionRequest = z.infer<\n  typeof BeginManagedAuthLoginTransactionRequest\n>;\n\nexport const ManagedAuthLoginTransaction = z.object({\n  id: z.string().uuid(),\n  kind: z.enum([\"add\", \"reauth\"]),\n  expiresAt: z.string().datetime(),\n  returnIntentId: z.string().uuid().nullable(),\n});\nexport type ManagedAuthLoginTransaction = z.infer<typeof ManagedAuthLoginTransaction>;\n\nexport const ManagedAuthSocialProvider = z.enum([\"google\", \"github\"]);\nexport type ManagedAuthSocialProvider = z.infer<typeof ManagedAuthSocialProvider>;\n\nexport const StartManagedAuthSocialTransactionRequest = ManagedAuthOperationIdentity.extend({\n  transactionId: z.string().uuid(),\n  provider: ManagedAuthSocialProvider,\n});\nexport type StartManagedAuthSocialTransactionRequest = z.infer<\n  typeof StartManagedAuthSocialTransactionRequest\n>;\n\nexport const StartManagedAuthSocialTransactionResponse = z.object({\n  url: z.string().url().max(4_096),\n});\nexport type StartManagedAuthSocialTransactionResponse = z.infer<\n  typeof StartManagedAuthSocialTransactionResponse\n>;\n\nexport const CompleteManagedAuthEmailPasswordTransactionRequest =\n  ManagedAuthOperationIdentity.extend({\n    transactionId: z.string().uuid(),\n    email: z.string().email().max(320),\n    password: z.string().min(1).max(1_024),\n  });\nexport type CompleteManagedAuthEmailPasswordTransactionRequest = z.infer<\n  typeof CompleteManagedAuthEmailPasswordTransactionRequest\n>;\n\nexport const CompleteManagedAuthLoginTransactionResponse = z.object({\n  projection: ManagedAuthSessionSetProjection,\n  returnIntent: ManagedAuthReturnIntent.nullable(),\n});\nexport type CompleteManagedAuthLoginTransactionResponse = z.infer<\n  typeof CompleteManagedAuthLoginTransactionResponse\n>;\n\nexport const CancelManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({\n  transactionId: z.string().uuid(),\n});\nexport type CancelManagedAuthLoginTransactionRequest = z.infer<\n  typeof CancelManagedAuthLoginTransactionRequest\n>;\n\nexport const SelectManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({\n  slotId: z.string().uuid(),\n});\nexport type SelectManagedAuthLoginSlotRequest = z.infer<typeof SelectManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({\n  slotId: z.string().uuid(),\n  replacementSlotId: z.string().uuid().nullable(),\n});\nexport type LogoutManagedAuthLoginSlotRequest = z.infer<typeof LogoutManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type LogoutManagedAuthSessionSetRequest = z.infer<typeof LogoutManagedAuthSessionSetRequest>;\n\nexport const ManagedAuthLogoutAllReceipt = z.object({\n  generation: z.string().regex(/^[1-9][0-9]*$/),\n  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n  state: z.literal(\"logged_out\"),\n});\nexport type ManagedAuthLogoutAllReceipt = z.infer<typeof ManagedAuthLogoutAllReceipt>;\n\nexport const ResolveManagedAuthDeepLinkRequest = z.object({\n  path: ManagedAuthReturnIntent,\n});\nexport type ResolveManagedAuthDeepLinkRequest = z.infer<typeof ResolveManagedAuthDeepLinkRequest>;\n\nexport const ManagedAuthDeepLinkResolution = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"current\") }),\n  z.object({ kind: z.literal(\"switch_required\"), slot: ManagedAuthLoginSlot }),\n  z.object({ kind: z.literal(\"unavailable\") }),\n]);\nexport type ManagedAuthDeepLinkResolution = z.infer<typeof ManagedAuthDeepLinkResolution>;\n\nexport const ManagedAuthSessionSetErrorCode = z.enum([\n  \"actor_change_required\",\n  \"actor_mutation_in_flight\",\n  \"api_contract_changed\",\n  \"browser_session_set_required\",\n  \"browser_session_set_unavailable\",\n  \"generation_conflict\",\n  \"invalid_browser_session_set_request\",\n  \"invalid_transaction\",\n  \"managed_authentication_required\",\n  \"managed_authentication_unavailable\",\n  \"operation_outcome_unknown\",\n  \"operation_reused\",\n  \"origin_rejected\",\n  \"login_transaction_rate_limited\",\n  \"provider_route_blocked\",\n  \"slot_limit_reached\",\n  \"slot_already_exists\",\n  \"slot_unavailable\",\n]);\nexport type ManagedAuthSessionSetErrorCode = z.infer<typeof ManagedAuthSessionSetErrorCode>;\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,qCAAqC;AAC3C,IAAM,uCAAuC;AAC7C,IAAM,uCAAuC;AAC7C,IAAM,+CAA+C;AACrD,IAAM,iDACX;AAEK,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,QAAQ,QAAQ,CAAC;AAGrE,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,iBAAiB,CAAC;AAGtE,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,MAAM,EAAE,QAAQ,OAAO;AAAA,EACvB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AACnC,CAAC;AAIM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe;AAAA,EACf,OAAO;AACT,CAAC;AAGM,IAAM,6BAA6B,EAAE,KAAK,CAAC,SAAS,uBAAuB,CAAC;AAG5E,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM;AAAA,EACN,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,GAAG;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO;AAAA,EACP,OAAO,EAAE,MAAM,oBAAoB,EAAE,IAAI,kCAAkC;AAC7E,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,oBAAoB,EAAE,OAAO,EAAE,MAAM,eAAe;AACtD,CAAC;AAGM,IAAM,wCAAwC;AAK9C,IAAM,0BAA0B,EACpC,OAAO,EACP,IAAI,CAAC,EACL,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,aAAa,sCAAsC;AACrF,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,6CAA6C,CAAC;AAAA,EAC5F;AACA,MACE,CAAC,MAAM,WAAW,GAAG,KACrB,MAAM,WAAW,IAAI,KACrB,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,KAClB,0BAA0B,KAAK,KAAK,GACpC;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,OAAO,0BAA0B;AACxD,UAAM,OAAO;AACb,UAAM,gBAAgB,IAAI;AAAA,MACxB,iBAAiB,IAAI,eAAe,IAAI,mBAAmB,IAAI;AAAA,MAC/D;AAAA,IACF;AACA,QACE,OAAO,WAAW,8BAClB,OAAO,YACP,OAAO,YACP,OAAO,UACP,OAAO,QACP,CAAC,cAAc,KAAK,KAAK,KACzB,OAAO,aAAa,OACpB;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AACN,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAEI,IAAM,0CAA0C,6BAA6B,OAAO;AAAA,EACzF,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,cAAc,wBAAwB,SAAS;AACjD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,MAAK,MAAM,SAAS,aAAc,QAAQ,MAAM,MAAM,GAAG;AACvD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAKM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAG7D,IAAM,2CAA2C,6BAA6B,OAAO;AAAA,EAC1F,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,UAAU;AACZ,CAAC;AAKM,IAAM,4CAA4C,EAAE,OAAO;AAAA,EAChE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAK;AACjC,CAAC;AAKM,IAAM,qDACX,6BAA6B,OAAO;AAAA,EAClC,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACjC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK;AACvC,CAAC;AAKI,IAAM,8CAA8C,EAAE,OAAO;AAAA,EAClE,YAAY;AAAA,EACZ,cAAc,wBAAwB,SAAS;AACjD,CAAC;AAKM,IAAM,2CAA2C,6BAA6B,OAAO;AAAA,EAC1F,eAAe,EAAE,OAAO,EAAE,KAAK;AACjC,CAAC;AAKM,IAAM,oCAAoC,6BAA6B,OAAO;AAAA,EACnF,QAAQ,EAAE,OAAO,EAAE,KAAK;AAC1B,CAAC;AAGM,IAAM,oCAAoC,6BAA6B,OAAO;AAAA,EACnF,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAChD,CAAC;AAGM,IAAM,qCAAqC;AAG3C,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,OAAO,EAAE,QAAQ,YAAY;AAC/B,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,MAAM;AACR,CAAC;AAGM,IAAM,gCAAgC,EAAE,mBAAmB,QAAQ;AAAA,EACxE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;AAAA,EACvC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,iBAAiB,GAAG,MAAM,qBAAqB,CAAC;AAAA,EAC3E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,aAAa,EAAE,CAAC;AAC7C,CAAC;AAGM,IAAM,iCAAiC,EAAE,KAAK;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":[]}

package/dist/organization-membership-lifecycle.d.ts

@@ -272,6 +272,7 @@ export declare const OrganizationWorkspaceRoleDefinition: z.ZodObject<{
         "artifacts:read": "artifacts:read";
         "billing:manage": "billing:manage";
         "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
         "codemode:call": "codemode:call";
         "connections:read": "connections:read";
         "connections:write": "connections:write";
@@ -338,6 +339,7 @@ export declare const OrganizationAdministrationOverview: z.ZodObject<{
             "artifacts:read": "artifacts:read";
             "billing:manage": "billing:manage";
             "billing:read": "billing:read";
+            "capabilities:manage": "capabilities:manage";
             "codemode:call": "codemode:call";
             "connections:read": "connections:read";
             "connections:write": "connections:write";
@@ -444,6 +446,7 @@ export declare const PutOrganizationWorkspaceMemberRequest: z.ZodDiscriminatedUn
         "artifacts:read": "artifacts:read";
         "billing:manage": "billing:manage";
         "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
         "codemode:call": "codemode:call";
         "connections:read": "connections:read";
         "connections:write": "connections:write";

package/dist/permissions.d.ts

@@ -8,6 +8,7 @@ export declare const Permission: z.ZodEnum<{
     "artifacts:read": "artifacts:read";
     "billing:manage": "billing:manage";
     "billing:read": "billing:read";
+    "capabilities:manage": "capabilities:manage";
     "codemode:call": "codemode:call";
     "connections:read": "connections:read";
     "connections:write": "connections:write";

package/dist/personal-github.js

@@ -1,8 +1,9 @@
 import {
   ConnectionMetadata
-} from "./chunk-ILB4IYNN.js";
+} from "./chunk-AWNGBY5I.js";
 import "./chunk-WYBDERIY.js";
 import "./chunk-MRWYRAS5.js";
+import "./chunk-4IVHBXRI.js";
 import "./chunk-CM6BMECR.js";
 import "./chunk-JUFK3T4Q.js";
 import "./chunk-YBW5JSA3.js";

package/dist/personal-github.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/personal-github.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\n\nexport const PERSONAL_GITHUB_PROVIDER_DOMAIN = \"github.com\" as const;\nexport const PERSONAL_GITHUB_PROVIDER_FAMILY = \"github\" as const;\nexport const PERSONAL_GITHUB_CREDENTIAL_ROLE = \"opengeni_github_personal\" as const;\nexport const PERSONAL_GITHUB_CONNECTION_SURFACE_ID = \"github:personal\" as const;\nexport const PERSONAL_GITHUB_REQUESTED_SCOPES = [\"repo\"] as const;\nexport const PERSONAL_GITHUB_AUTHORIZATION_URL =\n  \"https://github.com/login/oauth/authorize\" as const;\nexport const PERSONAL_GITHUB_TOKEN_URL = \"https://github.com/login/oauth/access_token\" as const;\nexport const PERSONAL_GITHUB_USER_URL = \"https://api.github.com/user\" as const;\nexport const PERSONAL_GITHUB_API_ORIGIN = \"https://api.github.com\" as const;\nexport const PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX = 100 as const;\n\nexport const PersonalGitHubRepositoryId = z.string().regex(/^[1-9]\\d*$/u);\nexport type PersonalGitHubRepositoryId = z.infer<typeof PersonalGitHubRepositoryId>;\n\nexport const PersonalGitHubRepositoryAccess = z.enum([\"read\", \"write\"]);\nexport type PersonalGitHubRepositoryAccess = z.infer<typeof PersonalGitHubRepositoryAccess>;\n\nexport const PersonalGitHubRepositoryPermissions = z\n  .object({\n    pull: z.boolean(),\n    push: z.boolean(),\n    admin: z.boolean(),\n    maintain: z.boolean(),\n    triage: z.boolean(),\n  })\n  .strict();\nexport type PersonalGitHubRepositoryPermissions = z.infer<\n  typeof PersonalGitHubRepositoryPermissions\n>;\n\nexport const PersonalGitHubRepositoryVisibility = z.enum([\"public\", \"private\", \"internal\"]);\nexport type PersonalGitHubRepositoryVisibility = z.infer<typeof PersonalGitHubRepositoryVisibility>;\n\nconst PersonalGitHubRepositoryFullName = z\n  .string()\n  .min(3)\n  .max(140)\n  .regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\\/[A-Za-z0-9_.-]{1,100}$/u);\n\nexport function canonicalPersonalGitHubRepositoryUrl(fullName: string): string {\n  return `https://github.com/${fullName}`;\n}\n\n/** A bounded, credential-free projection verified directly against GitHub. */\nexport const PersonalGitHubRepository = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    canonicalUrl: z.string().url().max(512),\n    defaultBranch: z.string().min(1).max(255),\n    visibility: PersonalGitHubRepositoryVisibility,\n    private: z.boolean(),\n    archived: z.boolean(),\n    disabled: z.boolean(),\n    permissions: PersonalGitHubRepositoryPermissions,\n  })\n  .strict()\n  .superRefine((repository, context) => {\n    if (repository.canonicalUrl !== canonicalPersonalGitHubRepositoryUrl(repository.fullName)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"canonicalUrl\"],\n        message: \"canonicalUrl must be derived from fullName\",\n      });\n    }\n    if (repository.private !== (repository.visibility === \"private\")) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"private\"],\n        message: \"private must agree with visibility\",\n      });\n    }\n  });\nexport type PersonalGitHubRepository = z.infer<typeof PersonalGitHubRepository>;\n\nexport const PersonalGitHubSelectedRepository = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess,\n  selectionGeneration: z.number().int().positive(),\n  selectedAt: z.string().datetime({ offset: true }),\n  lastVerifiedAt: z.string().datetime({ offset: true }),\n}).strict();\nexport type PersonalGitHubSelectedRepository = z.infer<typeof PersonalGitHubSelectedRepository>;\n\nexport const PersonalGitHubRepositorySelectionState = z\n  .object({\n    connectionAuthorityGeneration: z.number().int().positive(),\n    credentialBindingId: z.string().uuid(),\n    providerPrincipalId: PersonalGitHubRepositoryId,\n    selectionGeneration: z.number().int().nonnegative(),\n    repositories: z\n      .array(PersonalGitHubSelectedRepository)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionState = z.infer<\n  typeof PersonalGitHubRepositorySelectionState\n>;\n\nexport const ListPersonalGitHubRepositoriesQuery = z\n  .object({\n    cursor: z.coerce.number().int().positive().max(10_000).default(1),\n    limit: z.coerce.number().int().min(1).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX).default(50),\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesQuery = z.infer<\n  typeof ListPersonalGitHubRepositoriesQuery\n>;\n\nexport const PersonalGitHubRepositoryCatalogItem = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess.nullable(),\n}).strict();\nexport type PersonalGitHubRepositoryCatalogItem = z.infer<\n  typeof PersonalGitHubRepositoryCatalogItem\n>;\n\nexport const ListPersonalGitHubRepositoriesResponse = z\n  .object({\n    repositories: z\n      .array(PersonalGitHubRepositoryCatalogItem)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n    nextCursor: z.number().int().positive().nullable(),\n    selection: PersonalGitHubRepositorySelectionState,\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesResponse = z.infer<\n  typeof ListPersonalGitHubRepositoriesResponse\n>;\n\nexport const PersonalGitHubRepositorySelectionInput = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    access: PersonalGitHubRepositoryAccess,\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionInput = z.infer<\n  typeof PersonalGitHubRepositorySelectionInput\n>;\n\nexport const ReplacePersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n    repositories: z\n      .array(PersonalGitHubRepositorySelectionInput)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict()\n  .superRefine((request, context) => {\n    const repositoryIds = new Set<string>();\n    const fullNames = new Set<string>();\n    request.repositories.forEach((repository, index) => {\n      const normalizedFullName = repository.fullName.toLowerCase();\n      if (repositoryIds.has(repository.repositoryId)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"repositoryId\"],\n          message: \"repositoryId must be unique\",\n        });\n      }\n      if (fullNames.has(normalizedFullName)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"fullName\"],\n          message: \"fullName must be unique\",\n        });\n      }\n      repositoryIds.add(repository.repositoryId);\n      fullNames.add(normalizedFullName);\n    });\n  });\nexport type ReplacePersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof ReplacePersonalGitHubRepositorySelectionsRequest\n>;\n\nexport const VerifyPersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type VerifyPersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof VerifyPersonalGitHubRepositorySelectionsRequest\n>;\n\n/**\n * Owner-visible, credential-free metadata for one dedicated personal GitHub\n * OAuth connection. Repository selections are a separate authority and never\n * live in this credential record.\n */\nexport const PersonalGitHubConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(PERSONAL_GITHUB_CREDENTIAL_ROLE),\n    providerFamily: z.literal(PERSONAL_GITHUB_PROVIDER_FAMILY),\n    providerPrincipalId: z.string().regex(/^\\d+$/u),\n    githubUserId: z.string().regex(/^\\d+$/u),\n    githubLogin: z.string().min(1).max(100),\n    oauthEnvironment: z.string().min(1).max(128),\n    oauthClientMarker: z.string().regex(/^[a-f0-9]{32}$/u),\n    credentialBindingId: z.string().uuid(),\n    connectedAt: z.string().datetime({ offset: true }),\n    lastVerifiedAt: z.string().datetime({ offset: true }),\n    disconnectedAt: z.string().datetime({ offset: true }).nullable().optional(),\n    refreshTokenExpiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  })\n  .passthrough();\nexport type PersonalGitHubConnectionMetadata = z.infer<typeof PersonalGitHubConnectionMetadata>;\n\nexport const PersonalGitHubOAuthStartRequest = z\n  .object({\n    /** Existing exact connection generation to re-authorize in place. */\n    connectionId: z.string().uuid().optional(),\n    /** Same-workspace UI path restored after the callback. */\n    returnPath: z.string().min(1).max(2048).optional(),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartRequest = z.infer<typeof PersonalGitHubOAuthStartRequest>;\n\nexport const PersonalGitHubOAuthStartResponse = z\n  .object({\n    authorizationUrl: z.string().url(),\n    expiresAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartResponse = z.infer<typeof PersonalGitHubOAuthStartResponse>;\n\nexport const PersonalGitHubConnectionStatusResponse = z\n  .object({\n    enabled: z.boolean(),\n    connection: ConnectionMetadata.nullable(),\n    reviewUrl: z.string().url().nullable(),\n  })\n  .strict();\nexport type PersonalGitHubConnectionStatusResponse = z.infer<\n  typeof PersonalGitHubConnectionStatusResponse\n>;\n\nexport const PersonalGitHubDisconnectRequest = z\n  .object({\n    expectedVersion: z.number().int().positive(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type PersonalGitHubDisconnectRequest = z.infer<typeof PersonalGitHubDisconnectRequest>;\n\nexport function isPersonalGitHubConnection(\n  connection: Pick<z.infer<typeof ConnectionMetadata>, \"providerDomain\" | \"kind\" | \"metadata\">,\n): boolean {\n  return (\n    connection.providerDomain.toLowerCase() === PERSONAL_GITHUB_PROVIDER_DOMAIN &&\n    connection.kind === \"oauth2\" &&\n    PersonalGitHubConnectionMetadata.safeParse(connection.metadata).success\n  );\n}\n\nexport function hasReservedPersonalGitHubMetadata(\n  metadata: Record<string, unknown> | undefined,\n): boolean {\n  return metadata?.credentialRole === PERSONAL_GITHUB_CREDENTIAL_ROLE;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAIX,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,wCAAwC;AAC9C,IAAM,mCAAmC,CAAC,MAAM;AAChD,IAAM,oCACX;AACK,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,OAAO,EAAE,MAAM,aAAa;AAGjE,IAAM,iCAAiC,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAG/D,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,MAAM,EAAE,QAAQ;AAAA,EAChB,MAAM,EAAE,QAAQ;AAAA,EAChB,OAAO,EAAE,QAAQ;AAAA,EACjB,UAAU,EAAE,QAAQ;AAAA,EACpB,QAAQ,EAAE,QAAQ;AACpB,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK,CAAC,UAAU,WAAW,UAAU,CAAC;AAG1F,IAAM,mCAAmC,EACtC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,6DAA6D;AAE/D,SAAS,qCAAqC,UAA0B;AAC7E,SAAO,sBAAsB,QAAQ;AACvC;AAGO,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,YAAY;AAAA,EACZ,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,UAAU,EAAE,QAAQ;AAAA,EACpB,aAAa;AACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,YAAY,YAAY;AACpC,MAAI,WAAW,iBAAiB,qCAAqC,WAAW,QAAQ,GAAG;AACzF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,WAAW,aAAa,WAAW,eAAe,YAAY;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,mCAAmC,yBAAyB,WAAW;AAAA,EAClF,gBAAgB;AAAA,EAChB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACtD,CAAC,EAAE,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,qBAAqB;AAAA,EACrB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClD,cAAc,EACX,MAAM,gCAAgC,EACtC,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,CAAC;AAAA,EAChE,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,sCAAsC,EAAE,QAAQ,EAAE;AAC9F,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,yBAAyB,WAAW;AAAA,EACrF,gBAAgB,+BAA+B,SAAS;AAC1D,CAAC,EAAE,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc,EACX,MAAM,mCAAmC,EACzC,IAAI,sCAAsC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,WAAW;AACb,CAAC,EACA,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,QAAQ;AACV,CAAC,EACA,OAAO;AAKH,IAAM,mDAAmD,EAC7D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChD,cAAc,EACX,MAAM,sCAAsC,EAC5C,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,YAAY;AACjC,QAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAM,YAAY,oBAAI,IAAY;AAClC,UAAQ,aAAa,QAAQ,CAAC,YAAY,UAAU;AAClD,UAAM,qBAAqB,WAAW,SAAS,YAAY;AAC3D,QAAI,cAAc,IAAI,WAAW,YAAY,GAAG;AAC9C,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,cAAc;AAAA,QAC5C,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI,kBAAkB,GAAG;AACrC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,QACxC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,kBAAc,IAAI,WAAW,YAAY;AACzC,cAAU,IAAI,kBAAkB;AAAA,EAClC,CAAC;AACH,CAAC;AAKI,IAAM,kDAAkD,EAC5D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAUH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EAC9C,cAAc,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACrD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACpD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1E,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AACnF,CAAC,EACA,YAAY;AAGR,IAAM,kCAAkC,EAC5C,OAAO;AAAA;AAAA,EAEN,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AACnD,CAAC,EACA,OAAO;AAGH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC,EACA,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ;AAAA,EACnB,YAAY,mBAAmB,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAKH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,SAAS,2BACd,YACS;AACT,SACE,WAAW,eAAe,YAAY,MAAM,mCAC5C,WAAW,SAAS,YACpB,iCAAiC,UAAU,WAAW,QAAQ,EAAE;AAEpE;AAEO,SAAS,kCACd,UACS;AACT,SAAO,UAAU,mBAAmB;AACtC;","names":[]}
+{"version":3,"sources":["../src/personal-github.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\n\nexport const PERSONAL_GITHUB_PROVIDER_DOMAIN = \"github.com\" as const;\nexport const PERSONAL_GITHUB_PROVIDER_FAMILY = \"github\" as const;\nexport const PERSONAL_GITHUB_CREDENTIAL_ROLE = \"opengeni_github_personal\" as const;\nexport const PERSONAL_GITHUB_CONNECTION_SURFACE_ID = \"github:personal\" as const;\nexport const PERSONAL_GITHUB_REQUESTED_SCOPES = [\"repo\"] as const;\nexport const PERSONAL_GITHUB_AUTHORIZATION_URL =\n  \"https://github.com/login/oauth/authorize\" as const;\nexport const PERSONAL_GITHUB_TOKEN_URL = \"https://github.com/login/oauth/access_token\" as const;\nexport const PERSONAL_GITHUB_USER_URL = \"https://api.github.com/user\" as const;\nexport const PERSONAL_GITHUB_API_ORIGIN = \"https://api.github.com\" as const;\nexport const PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX = 100 as const;\n\nexport const PersonalGitHubRepositoryId = z.string().regex(/^[1-9]\\d*$/u);\nexport type PersonalGitHubRepositoryId = z.infer<typeof PersonalGitHubRepositoryId>;\n\nexport const PersonalGitHubRepositoryAccess = z.enum([\"read\", \"write\"]);\nexport type PersonalGitHubRepositoryAccess = z.infer<typeof PersonalGitHubRepositoryAccess>;\n\nexport const PersonalGitHubRepositoryPermissions = z\n  .object({\n    pull: z.boolean(),\n    push: z.boolean(),\n    admin: z.boolean(),\n    maintain: z.boolean(),\n    triage: z.boolean(),\n  })\n  .strict();\nexport type PersonalGitHubRepositoryPermissions = z.infer<\n  typeof PersonalGitHubRepositoryPermissions\n>;\n\nexport const PersonalGitHubRepositoryVisibility = z.enum([\"public\", \"private\", \"internal\"]);\nexport type PersonalGitHubRepositoryVisibility = z.infer<typeof PersonalGitHubRepositoryVisibility>;\n\nconst PersonalGitHubRepositoryFullName = z\n  .string()\n  .min(3)\n  .max(140)\n  .regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\\/[A-Za-z0-9_.-]{1,100}$/u);\n\nexport function canonicalPersonalGitHubRepositoryUrl(fullName: string): string {\n  return `https://github.com/${fullName}`;\n}\n\n/** A bounded, credential-free projection verified directly against GitHub. */\nexport const PersonalGitHubRepository = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    canonicalUrl: z.string().url().max(512),\n    defaultBranch: z.string().min(1).max(255),\n    visibility: PersonalGitHubRepositoryVisibility,\n    private: z.boolean(),\n    archived: z.boolean(),\n    disabled: z.boolean(),\n    permissions: PersonalGitHubRepositoryPermissions,\n  })\n  .strict()\n  .superRefine((repository, context) => {\n    if (repository.canonicalUrl !== canonicalPersonalGitHubRepositoryUrl(repository.fullName)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"canonicalUrl\"],\n        message: \"canonicalUrl must be derived from fullName\",\n      });\n    }\n    if (repository.private !== (repository.visibility === \"private\")) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"private\"],\n        message: \"private must agree with visibility\",\n      });\n    }\n  });\nexport type PersonalGitHubRepository = z.infer<typeof PersonalGitHubRepository>;\n\nexport const PersonalGitHubSelectedRepository = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess,\n  selectionGeneration: z.number().int().positive(),\n  selectedAt: z.string().datetime({ offset: true }),\n  lastVerifiedAt: z.string().datetime({ offset: true }),\n}).strict();\nexport type PersonalGitHubSelectedRepository = z.infer<typeof PersonalGitHubSelectedRepository>;\n\nexport const PersonalGitHubRepositorySelectionState = z\n  .object({\n    connectionAuthorityGeneration: z.number().int().positive(),\n    credentialBindingId: z.string().uuid(),\n    providerPrincipalId: PersonalGitHubRepositoryId,\n    selectionGeneration: z.number().int().nonnegative(),\n    repositories: z\n      .array(PersonalGitHubSelectedRepository)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionState = z.infer<\n  typeof PersonalGitHubRepositorySelectionState\n>;\n\nexport const ListPersonalGitHubRepositoriesQuery = z\n  .object({\n    cursor: z.coerce.number().int().positive().max(10_000).default(1),\n    limit: z.coerce.number().int().min(1).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX).default(50),\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesQuery = z.infer<\n  typeof ListPersonalGitHubRepositoriesQuery\n>;\n\nexport const PersonalGitHubRepositoryCatalogItem = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess.nullable(),\n}).strict();\nexport type PersonalGitHubRepositoryCatalogItem = z.infer<\n  typeof PersonalGitHubRepositoryCatalogItem\n>;\n\nexport const ListPersonalGitHubRepositoriesResponse = z\n  .object({\n    repositories: z\n      .array(PersonalGitHubRepositoryCatalogItem)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n    nextCursor: z.number().int().positive().nullable(),\n    selection: PersonalGitHubRepositorySelectionState,\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesResponse = z.infer<\n  typeof ListPersonalGitHubRepositoriesResponse\n>;\n\nexport const PersonalGitHubRepositorySelectionInput = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    access: PersonalGitHubRepositoryAccess,\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionInput = z.infer<\n  typeof PersonalGitHubRepositorySelectionInput\n>;\n\nexport const ReplacePersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n    repositories: z\n      .array(PersonalGitHubRepositorySelectionInput)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict()\n  .superRefine((request, context) => {\n    const repositoryIds = new Set<string>();\n    const fullNames = new Set<string>();\n    request.repositories.forEach((repository, index) => {\n      const normalizedFullName = repository.fullName.toLowerCase();\n      if (repositoryIds.has(repository.repositoryId)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"repositoryId\"],\n          message: \"repositoryId must be unique\",\n        });\n      }\n      if (fullNames.has(normalizedFullName)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"fullName\"],\n          message: \"fullName must be unique\",\n        });\n      }\n      repositoryIds.add(repository.repositoryId);\n      fullNames.add(normalizedFullName);\n    });\n  });\nexport type ReplacePersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof ReplacePersonalGitHubRepositorySelectionsRequest\n>;\n\nexport const VerifyPersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type VerifyPersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof VerifyPersonalGitHubRepositorySelectionsRequest\n>;\n\n/**\n * Owner-visible, credential-free metadata for one dedicated personal GitHub\n * OAuth connection. Repository selections are a separate authority and never\n * live in this credential record.\n */\nexport const PersonalGitHubConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(PERSONAL_GITHUB_CREDENTIAL_ROLE),\n    providerFamily: z.literal(PERSONAL_GITHUB_PROVIDER_FAMILY),\n    providerPrincipalId: z.string().regex(/^\\d+$/u),\n    githubUserId: z.string().regex(/^\\d+$/u),\n    githubLogin: z.string().min(1).max(100),\n    oauthEnvironment: z.string().min(1).max(128),\n    oauthClientMarker: z.string().regex(/^[a-f0-9]{32}$/u),\n    credentialBindingId: z.string().uuid(),\n    connectedAt: z.string().datetime({ offset: true }),\n    lastVerifiedAt: z.string().datetime({ offset: true }),\n    disconnectedAt: z.string().datetime({ offset: true }).nullable().optional(),\n    refreshTokenExpiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  })\n  .passthrough();\nexport type PersonalGitHubConnectionMetadata = z.infer<typeof PersonalGitHubConnectionMetadata>;\n\nexport const PersonalGitHubOAuthStartRequest = z\n  .object({\n    /** Existing exact connection generation to re-authorize in place. */\n    connectionId: z.string().uuid().optional(),\n    /** Same-workspace UI path restored after the callback. */\n    returnPath: z.string().min(1).max(2048).optional(),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartRequest = z.infer<typeof PersonalGitHubOAuthStartRequest>;\n\nexport const PersonalGitHubOAuthStartResponse = z\n  .object({\n    authorizationUrl: z.string().url(),\n    expiresAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartResponse = z.infer<typeof PersonalGitHubOAuthStartResponse>;\n\nexport const PersonalGitHubConnectionStatusResponse = z\n  .object({\n    enabled: z.boolean(),\n    connection: ConnectionMetadata.nullable(),\n    reviewUrl: z.string().url().nullable(),\n  })\n  .strict();\nexport type PersonalGitHubConnectionStatusResponse = z.infer<\n  typeof PersonalGitHubConnectionStatusResponse\n>;\n\nexport const PersonalGitHubDisconnectRequest = z\n  .object({\n    expectedVersion: z.number().int().positive(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type PersonalGitHubDisconnectRequest = z.infer<typeof PersonalGitHubDisconnectRequest>;\n\nexport function isPersonalGitHubConnection(\n  connection: Pick<z.infer<typeof ConnectionMetadata>, \"providerDomain\" | \"kind\" | \"metadata\">,\n): boolean {\n  return (\n    connection.providerDomain.toLowerCase() === PERSONAL_GITHUB_PROVIDER_DOMAIN &&\n    connection.kind === \"oauth2\" &&\n    PersonalGitHubConnectionMetadata.safeParse(connection.metadata).success\n  );\n}\n\nexport function hasReservedPersonalGitHubMetadata(\n  metadata: Record<string, unknown> | undefined,\n): boolean {\n  return metadata?.credentialRole === PERSONAL_GITHUB_CREDENTIAL_ROLE;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAIX,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,wCAAwC;AAC9C,IAAM,mCAAmC,CAAC,MAAM;AAChD,IAAM,oCACX;AACK,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,OAAO,EAAE,MAAM,aAAa;AAGjE,IAAM,iCAAiC,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAG/D,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,MAAM,EAAE,QAAQ;AAAA,EAChB,MAAM,EAAE,QAAQ;AAAA,EAChB,OAAO,EAAE,QAAQ;AAAA,EACjB,UAAU,EAAE,QAAQ;AAAA,EACpB,QAAQ,EAAE,QAAQ;AACpB,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK,CAAC,UAAU,WAAW,UAAU,CAAC;AAG1F,IAAM,mCAAmC,EACtC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,6DAA6D;AAE/D,SAAS,qCAAqC,UAA0B;AAC7E,SAAO,sBAAsB,QAAQ;AACvC;AAGO,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,YAAY;AAAA,EACZ,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,UAAU,EAAE,QAAQ;AAAA,EACpB,aAAa;AACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,YAAY,YAAY;AACpC,MAAI,WAAW,iBAAiB,qCAAqC,WAAW,QAAQ,GAAG;AACzF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,WAAW,aAAa,WAAW,eAAe,YAAY;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,mCAAmC,yBAAyB,WAAW;AAAA,EAClF,gBAAgB;AAAA,EAChB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACtD,CAAC,EAAE,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,qBAAqB;AAAA,EACrB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClD,cAAc,EACX,MAAM,gCAAgC,EACtC,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,CAAC;AAAA,EAChE,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,sCAAsC,EAAE,QAAQ,EAAE;AAC9F,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,yBAAyB,WAAW;AAAA,EACrF,gBAAgB,+BAA+B,SAAS;AAC1D,CAAC,EAAE,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc,EACX,MAAM,mCAAmC,EACzC,IAAI,sCAAsC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,WAAW;AACb,CAAC,EACA,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,QAAQ;AACV,CAAC,EACA,OAAO;AAKH,IAAM,mDAAmD,EAC7D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChD,cAAc,EACX,MAAM,sCAAsC,EAC5C,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,YAAY;AACjC,QAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAM,YAAY,oBAAI,IAAY;AAClC,UAAQ,aAAa,QAAQ,CAAC,YAAY,UAAU;AAClD,UAAM,qBAAqB,WAAW,SAAS,YAAY;AAC3D,QAAI,cAAc,IAAI,WAAW,YAAY,GAAG;AAC9C,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,cAAc;AAAA,QAC5C,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI,kBAAkB,GAAG;AACrC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,QACxC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,kBAAc,IAAI,WAAW,YAAY;AACzC,cAAU,IAAI,kBAAkB;AAAA,EAClC,CAAC;AACH,CAAC;AAKI,IAAM,kDAAkD,EAC5D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAUH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EAC9C,cAAc,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACrD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACpD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1E,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AACnF,CAAC,EACA,YAAY;AAGR,IAAM,kCAAkC,EAC5C,OAAO;AAAA;AAAA,EAEN,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AACnD,CAAC,EACA,OAAO;AAGH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC,EACA,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ;AAAA,EACnB,YAAY,mBAAmB,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAKH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,SAAS,2BACd,YACS;AACT,SACE,WAAW,eAAe,YAAY,MAAM,mCAC5C,WAAW,SAAS,YACpB,iCAAiC,UAAU,WAAW,QAAQ,EAAE;AAEpE;AAEO,SAAS,kCACd,UACS;AACT,SAAO,UAAU,mBAAmB;AACtC;","names":[]}

package/dist/session-titles.d.ts

@@ -12,6 +12,15 @@ export declare const AUTOMATIC_SESSION_TITLE_MAX_GRAPHEMES = 80;
  * credential or leave a raw prompt prefix in navigation surfaces.
  */
 export declare const AUTOMATIC_SESSION_TITLE_FALLBACK = "New conversation";
+/**
+ * Whether a bounded automatic-title candidate contains a credential, URL, or
+ * opaque identifier that must stay out of navigation and other display-title
+ * surfaces. Callers handling an unbounded source must bound it before invoking
+ * this helper.
+ */
+export declare function containsSensitiveAutomaticSessionTitleValue(value: string): boolean;
+/** Bound an already-normalized automatic-title candidate without splitting graphemes. */
+export declare function boundAutomaticSessionTitle(value: string): string;
 /**
  * Normalize a model/system-authored title before it reaches durable session
  * metadata. Human renames intentionally do not use this path.

package/dist/session-titles.js

@@ -0,0 +1,17 @@
+import {
+  AUTOMATIC_SESSION_TITLE_FALLBACK,
+  AUTOMATIC_SESSION_TITLE_MAX_GRAPHEMES,
+  SESSION_TITLE_MAX_CHARACTERS,
+  boundAutomaticSessionTitle,
+  containsSensitiveAutomaticSessionTitleValue,
+  normalizeAutomaticSessionTitle
+} from "./chunk-4IVHBXRI.js";
+export {
+  AUTOMATIC_SESSION_TITLE_FALLBACK,
+  AUTOMATIC_SESSION_TITLE_MAX_GRAPHEMES,
+  SESSION_TITLE_MAX_CHARACTERS,
+  boundAutomaticSessionTitle,
+  containsSensitiveAutomaticSessionTitleValue,
+  normalizeAutomaticSessionTitle
+};
+//# sourceMappingURL=session-titles.js.map

package/dist/session-titles.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/contracts",
-  "version": "2.7.0",
+  "version": "2.9.2",
   "description": "Shared zod schemas and wire-contract types for the OpenGeni API.",
   "license": "Apache-2.0",
   "repository": {
@@ -58,6 +58,10 @@
       "types": "./dist/canonical-human-identities.d.ts",
       "import": "./dist/canonical-human-identities.js"
     },
+    "./session-titles": {
+      "types": "./dist/session-titles.d.ts",
+      "import": "./dist/session-titles.js"
+    },
     "./managed-auth-session-sets": {
       "types": "./dist/managed-auth-session-sets.d.ts",
       "import": "./dist/managed-auth-session-sets.js"

package/src/agent-authored-durable-text.ts

@@ -57,8 +57,8 @@ export const AGENT_AUTHORED_PREFERENCE_CONTENT_TOO_LONG_MESSAGE =
   "A Skill is durable Agent Knowledge that agents retrieve on demand, so its length is " +
   "retrieval cost rather than standing prompt cost: only its short title and description are composed into " +
   `every session prompt. Keep it under ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS} characters: state the ` +
-  "preference plainly, no numbered procedure and no examples. Put procedure in a Document or Skill and " +
-  "reference it instead.";
+  "trigger and outcome plainly, include only the necessary procedure, checks, and exceptions, and remove " +
+  "background, repeated guidance, and decorative examples.";
 
 export const AGENT_AUTHORED_COMPANY_PROFILE_TOO_LONG_MESSAGE =
   "Organization identity and mission are mandatory prompt context in every root session across the " +
@@ -84,10 +84,17 @@ export const AGENT_AUTHORED_REMEMBER_CONTENT_TOO_LONG_MESSAGE =
  * preference*. Deliberately not reused for the company profile, which is a
  * descriptive profile rather than an instruction and needs its own wording.
  */
-export const AGENT_AUTHORED_DURABLE_TEXT_STYLE =
-  "Durable text is prompt cost, not a place to be thorough: write one imperative statement in 1-3 sentences, " +
-  "with no numbered steps, no examples, no rationale and no restating of defaults. Prefer several small entries " +
-  "over one long one, and keep procedure in a Document or Skill that the rule references instead of inlining it.";
+export const AGENT_AUTHORED_INSTRUCTION_POLICY_STYLE =
+  "Write the shortest complete imperative rule in 1-3 sentences, with no numbered procedure, examples, " +
+  "rationale, or restated defaults. Split unrelated rules, and move conditional procedure into a Skill.";
+
+export const AGENT_AUTHORED_SKILL_STYLE =
+  "Write one focused Skill with a clear trigger and outcome. Include only the prerequisites, necessary steps, " +
+  "verification, and important failure handling an agent needs to execute it; omit background, repetition, " +
+  "generic advice, and decorative examples. Split unrelated workflows into separate Skills.";
+
+/** @deprecated Use the destination-specific instruction or Skill style. */
+export const AGENT_AUTHORED_DURABLE_TEXT_STYLE = AGENT_AUTHORED_INSTRUCTION_POLICY_STYLE;
 
 /**
  * Actionable over-budget message including the text the caller actually sent,

package/src/company-profile.ts

@@ -296,6 +296,29 @@ export type CompanyProfileMutationResponse = z.infer<typeof CompanyProfileMutati
 export const COMPANY_PROFILE_AGENT_APPROVE_OPTION = "activate" as const;
 export const COMPANY_PROFILE_AGENT_REJECT_OPTION = "skip" as const;
 
+export const CompanyProfileAgentPolicyMode = z.enum(["off", "suggest", "automatic"]);
+export type CompanyProfileAgentPolicyMode = z.infer<typeof CompanyProfileAgentPolicyMode>;
+
+export const CompanyProfileAgentPolicy = z.object({
+  organizationId: z.string().uuid(),
+  mode: CompanyProfileAgentPolicyMode,
+  version: z.number().int().nonnegative(),
+  updatedAt: z.string().datetime({ offset: true }),
+  changed: z.boolean().optional(),
+});
+export type CompanyProfileAgentPolicy = z.infer<typeof CompanyProfileAgentPolicy>;
+
+export const UpdateCompanyProfileAgentPolicyRequest = z
+  .object({
+    mode: CompanyProfileAgentPolicyMode,
+    expectedVersion: z.number().int().nonnegative(),
+    operationId: z.string().uuid(),
+  })
+  .strict();
+export type UpdateCompanyProfileAgentPolicyRequest = z.infer<
+  typeof UpdateCompanyProfileAgentPolicyRequest
+>;
+
 export const CompanyProfileAgentAttempt = z
   .object({
     accountId: z.string().uuid(),
@@ -328,15 +351,37 @@ export type CompanyProfileAgentHumanInputPrompt = z.infer<
   typeof CompanyProfileAgentHumanInputPrompt
 >;
 
-export const CompanyProfileAgentProposalReceipt = z.object({
+export const CompanyProfileAgentReviewRequiredReceipt = z.object({
   status: z.literal("confirmation_required"),
   operationId: z.string().uuid(),
   proposalReceiptId: z.string().uuid(),
   revision: CompanyProfileRevision,
+  policyMode: z.literal("suggest"),
   humanInput: CompanyProfileAgentHumanInputPrompt,
   confirmWith: z.literal("company_profile_confirm"),
   replayed: z.boolean(),
 });
+export type CompanyProfileAgentReviewRequiredReceipt = z.infer<
+  typeof CompanyProfileAgentReviewRequiredReceipt
+>;
+
+export const CompanyProfileAgentAutomaticActivationReceipt = z.object({
+  status: z.literal("activated"),
+  operationId: z.string().uuid(),
+  proposalReceiptId: z.string().uuid(),
+  automaticActivationReceiptId: z.string().uuid(),
+  policyMode: z.literal("automatic"),
+  mutation: CompanyProfileMutationResponse,
+  replayed: z.boolean(),
+});
+export type CompanyProfileAgentAutomaticActivationReceipt = z.infer<
+  typeof CompanyProfileAgentAutomaticActivationReceipt
+>;
+
+export const CompanyProfileAgentProposalReceipt = z.discriminatedUnion("status", [
+  CompanyProfileAgentReviewRequiredReceipt,
+  CompanyProfileAgentAutomaticActivationReceipt,
+]);
 export type CompanyProfileAgentProposalReceipt = z.infer<typeof CompanyProfileAgentProposalReceipt>;
 
 export const CompanyProfileAgentConfirmRequest = z