@opengeni/contracts 3.1.0-canary.2 → 3.1.2

package/dist/client-error-report.d.ts

@@ -0,0 +1,158 @@
+/**
+ * Wire grammar of the web client error beacon (`POST /v1/client-errors`).
+ *
+ * A report is a closed error kind, the matched route PATTERN (never a concrete
+ * URL), the bundle revision, and optional error diagnostics: the error's name,
+ * message and stack, plus React's component stack for a render failure. The
+ * diagnostics are error text, not analytics. They can occasionally contain a
+ * fragment of user content (an error message that quotes a value), so they are
+ * scrubbed of obvious credentials and query strings by
+ * {@link scrubClientErrorText} and bounded per field by
+ * {@link CLIENT_ERROR_DETAIL_MAX_BYTES} in the browser, and the API re-applies
+ * the same projection to whatever it receives. The web client that projects a
+ * report, the API route that admits it, and the public structured-log
+ * projection that prints it all validate against these exact rules, so the
+ * browser can only send what the API accepts and logs.
+ *
+ * The same route also admits the closed operational signals below (requests
+ * that never reached the server, live-stream health, and web vitals). They
+ * follow the same rules: closed values only, a route pattern or page label,
+ * never a URL, message, identifier, or user content.
+ */
+export declare const CLIENT_ERRORS_PATH = "/v1/client-errors";
+export declare const CLIENT_ERROR_KINDS: readonly ["route_error", "unhandled_rejection", "window_error", "chunk_load"];
+export type ClientErrorKind = (typeof CLIENT_ERROR_KINDS)[number];
+/**
+ * Largest UTF-8 byte length of each error diagnostic field. A longer value is
+ * cut at the end, so a stack keeps its innermost frames.
+ */
+export declare const CLIENT_ERROR_DETAIL_MAX_BYTES: {
+    readonly name: 128;
+    readonly message: 1024;
+    readonly stack: 4096;
+    readonly componentStack: 4096;
+};
+export type ClientErrorDetailField = keyof typeof CLIENT_ERROR_DETAIL_MAX_BYTES;
+export declare const CLIENT_ERROR_DETAIL_FIELDS: ClientErrorDetailField[];
+/**
+ * Largest accepted report body. The detail fields total 9,344 bytes; JSON
+ * escaping at most doubles that, which leaves room for the closed fields.
+ */
+export declare const CLIENT_ERROR_REPORT_MAX_BYTES: number;
+/**
+ * A route pattern of at most 160 characters that is `/`, `unknown`, or up to
+ * twelve `/`-separated segments that are each either a lowercase literal
+ * (`variable-sets`) or a `$param` placeholder. The grammar excludes digits in
+ * literals, so a concrete id cannot pass as one.
+ */
+export declare const CLIENT_ERROR_ROUTE_PATTERN: RegExp;
+/** The bundle revision token (a commit SHA, `dev`, or `unknown`). */
+export declare const CLIENT_ERROR_REVISION_PATTERN: RegExp;
+/** Error diagnostics. Every field is optional and already scrubbed and bounded. */
+export type ClientErrorDetail = Partial<Record<ClientErrorDetailField, string>>;
+export type ClientErrorReport = {
+    kind: ClientErrorKind;
+    route: string;
+    revision: string;
+    error?: ClientErrorDetail;
+};
+/**
+ * Remove what an error text must never carry while keeping what makes it
+ * useful. Query strings and fragments are dropped from http(s) URLs (keeping a
+ * stack frame's `:line:column`); authorization values, JWTs, well-known API
+ * token formats, the values of `token=`/`password:`-style assignments, and
+ * long opaque letter-and-digit runs become `[redacted]`; control characters
+ * other than tab and newline become spaces. Messages, file names, route paths,
+ * UUIDs and stack frames survive. Applying it twice changes nothing.
+ */
+export declare function scrubClientErrorText(text: string): string;
+/**
+ * Cut `text` to at most `maxBytes` UTF-8 bytes on a character boundary, ending
+ * with a truncation marker when anything was removed.
+ */
+export declare function boundClientErrorText(text: string, maxBytes: number): string;
+/** Whether `text` is already exactly what the projection would produce for it. */
+export declare function isProjectedClientErrorText(text: string, field: ClientErrorDetailField): boolean;
+/**
+ * Project raw diagnostics into a {@link ClientErrorDetail}: non-string and
+ * blank fields are dropped, the rest scrubbed and then bounded. Returns
+ * `undefined` when nothing remains. Bounding after scrubbing keeps a cut from
+ * splitting a credential into a fragment the scrubber no longer recognizes;
+ * the marker cannot form one, so the result is stable under re-projection.
+ */
+export declare function projectClientErrorDetail(raw: Partial<Record<ClientErrorDetailField, unknown>> | null | undefined): ClientErrorDetail | undefined;
+/**
+ * Content-free operational signals that share the error beacon route. A
+ * signal report carries a `signal` discriminator and only closed values; a
+ * report without `signal` is a {@link ClientErrorReport}. Older API servers
+ * reject signal reports as invalid, so the extension is backward compatible in
+ * both directions.
+ */
+export declare const CLIENT_SIGNALS: readonly ["request_failure", "stream", "web_vital"];
+export type ClientSignal = (typeof CLIENT_SIGNALS)[number];
+/**
+ * Key product mutations whose failure before any HTTP response is counted.
+ * `send_message` includes sends the server queues behind an active turn.
+ */
+export declare const CLIENT_REQUEST_ACTIONS: readonly ["create_session", "send_message", "steer_message", "composer_submit", "retry_turn", "connect_integration", "connect_model", "checkout_start"];
+export type ClientRequestAction = (typeof CLIENT_REQUEST_ACTIONS)[number];
+/**
+ * Why a request never produced an HTTP response: the browser reported no
+ * connectivity (`offline`), the client's own deadline expired (`timeout`), or
+ * the transport failed (`network`). Cancellations the user or the app
+ * initiated are never reported.
+ */
+export declare const CLIENT_REQUEST_FAILURE_REASONS: readonly ["network", "timeout", "offline"];
+export type ClientRequestFailureReason = (typeof CLIENT_REQUEST_FAILURE_REASONS)[number];
+/** Browser live streams: one session's event stream, or the workspace live stream. */
+export declare const CLIENT_STREAMS: readonly ["session", "workspace"];
+export type ClientStream = (typeof CLIENT_STREAMS)[number];
+/**
+ * Live stream health: a live stream dropped and started reconnecting
+ * (`reconnect`), stopped reconnecting (`reconnect_exhausted`), or stayed
+ * disconnected for longer than the long-disconnect threshold while the tab
+ * was visible (`long_disconnect`).
+ */
+export declare const CLIENT_STREAM_EVENTS: readonly ["reconnect", "reconnect_exhausted", "long_disconnect"];
+export type ClientStreamEvent = (typeof CLIENT_STREAM_EVENTS)[number];
+/** Core Web Vitals plus time to first byte, measured once per document. */
+export declare const CLIENT_WEB_VITAL_METRICS: readonly ["lcp", "inp", "cls", "ttfb"];
+export type ClientWebVitalMetric = (typeof CLIENT_WEB_VITAL_METRICS)[number];
+/**
+ * Largest accepted value: seconds for the timing metrics, the unitless layout
+ * shift score for `cls`.
+ */
+export declare const CLIENT_WEB_VITAL_MAX_VALUE: Readonly<Record<ClientWebVitalMetric, number>>;
+/**
+ * The closed page labels of the web console's product-journey projection
+ * (`journeyPage` in apps/web/src/lib/analytics-journey.ts; a drift test keeps
+ * the two identical). Workspace pages are the first path segment after
+ * `/workspaces/<id>/`; the rest are exact top-level routes.
+ */
+export declare const CLIENT_PAGES: readonly ["sessions", "priority", "plugins", "capabilities", "documents", "state", "memory", "schedules", "artifacts", "settings", "organization", "insights", "machines", "files", "agents", "secrets", "variable-sets", "environments", "rigs", "playground", "read-only-chats", "inbox", "home", "session-link", "identity-link", "checkout-return", "integration-return", "device", "connect-agent", "native-sign-in", "reset-password", "setup-account", "account-auth", "site-auth", "personal-security", "other"];
+export type ClientPage = (typeof CLIENT_PAGES)[number];
+export type ClientRequestFailureReport = {
+    signal: "request_failure";
+    action: ClientRequestAction;
+    reason: ClientRequestFailureReason;
+    route: string;
+    revision: string;
+};
+export type ClientStreamReport = {
+    signal: "stream";
+    stream: ClientStream;
+    event: ClientStreamEvent;
+    route: string;
+    revision: string;
+};
+export type ClientWebVitalReport = {
+    signal: "web_vital";
+    metric: ClientWebVitalMetric;
+    page: ClientPage;
+    /** Seconds for timing metrics, the unitless score for `cls`. */
+    value: number;
+    revision: string;
+};
+export type ClientSignalReport = ClientRequestFailureReport | ClientStreamReport | ClientWebVitalReport;
+/** Every body the beacon route accepts. */
+export type ClientBeaconReport = ClientErrorReport | ClientSignalReport;

package/dist/client-error-report.js

@@ -0,0 +1,164 @@
+// src/client-error-report.ts
+var CLIENT_ERRORS_PATH = "/v1/client-errors";
+var CLIENT_ERROR_KINDS = [
+  "route_error",
+  "unhandled_rejection",
+  "window_error",
+  "chunk_load"
+];
+var CLIENT_ERROR_DETAIL_MAX_BYTES = {
+  name: 128,
+  message: 1024,
+  stack: 4096,
+  componentStack: 4096
+};
+var CLIENT_ERROR_DETAIL_FIELDS = Object.keys(
+  CLIENT_ERROR_DETAIL_MAX_BYTES
+);
+var CLIENT_ERROR_REPORT_MAX_BYTES = 20 * 1024;
+var ROUTE_SEGMENT = String.raw`(?:[a-z]+(?:-[a-z]+)*|\$[A-Za-z][A-Za-z0-9]{0,31})`;
+var CLIENT_ERROR_ROUTE_PATTERN = new RegExp(
+  String.raw`^(?=.{1,160}$)(?:unknown|/|(?:/${ROUTE_SEGMENT}){1,12})$`
+);
+var CLIENT_ERROR_REVISION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
+var REDACTED = "[redacted]";
+var TRUNCATED = "\u2026[truncated]";
+var ERROR_DECODER_URL = /^https?:\/\/(?:react\.dev\/errors\/|reactjs\.org\/docs\/error-decoder)/i;
+var LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+var CONTROL_CHARACTERS = /[\u0000-\u0008\u000B-\u001F\u007F]/g;
+var URL_WITH_QUERY = /\bhttps?:\/\/[^\s?#"'<>()`]*[?#][^\s"'<>()`]*/gi;
+var LINE_AND_COLUMN_SUFFIX = /(?::\d+){1,2}$/;
+var AUTHORIZATION_VALUE = /\b(Bearer|Basic|Token)\s+(?=[A-Za-z._~+/=-]*[0-9])[A-Za-z0-9._~+/=-]{8,}/gi;
+var JWT = /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}(?:\.[A-Za-z0-9_-]*)?/g;
+var KNOWN_TOKEN = /\b(?:sk-(?:proj-|ant-)?|sk_(?:live|test)_|rk_(?:live|test)_|gh[pousr]_|github_pat_|glpat-|npm_|xox[abposr]-|ops_|AKIA|ASIA|AIza)[A-Za-z0-9_-]{12,}/g;
+var SECRET_ASSIGNMENT = /\b((?:access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|token|client[_-]?secret|secret|password|passwd|api[_-]?key|apikey|authorization|cookie|private[_-]?key)["']?\s*[:=]\s*["']?)[^\s"'&,;}[…][^\s"'&,;}]*/gi;
+var OPAQUE_RUN = /[A-Za-z0-9+=_-]{32,}/g;
+function isOpaqueCredential(run) {
+  return /[0-9]/.test(run) && /[A-Za-z]/.test(run) && run.split(/[-_]/).some((stretch) => stretch.length >= 24);
+}
+function scrubClientErrorText(text) {
+  return text.replace(LONE_SURROGATE, "\uFFFD").replace(/\r\n?/g, "\n").replace(CONTROL_CHARACTERS, " ").replace(URL_WITH_QUERY, (url) => {
+    if (ERROR_DECODER_URL.test(url)) return url;
+    const cut = url.search(/[?#]/);
+    const suffix = url.slice(cut).match(LINE_AND_COLUMN_SUFFIX)?.[0] ?? "";
+    return url.slice(0, cut) + suffix;
+  }).replace(AUTHORIZATION_VALUE, `$1 ${REDACTED}`).replace(JWT, REDACTED).replace(KNOWN_TOKEN, REDACTED).replace(SECRET_ASSIGNMENT, `$1${REDACTED}`).replace(OPAQUE_RUN, (run) => isOpaqueCredential(run) ? REDACTED : run);
+}
+function utf8ByteLength(text) {
+  return new TextEncoder().encode(text).byteLength;
+}
+function boundClientErrorText(text, maxBytes) {
+  if (utf8ByteLength(text) <= maxBytes) return text;
+  const budget = maxBytes - utf8ByteLength(TRUNCATED);
+  let bytes = 0;
+  let end = 0;
+  for (const character of text) {
+    const size = utf8ByteLength(character);
+    if (bytes + size > budget) break;
+    bytes += size;
+    end += character.length;
+  }
+  return text.slice(0, end) + TRUNCATED;
+}
+function isProjectedClientErrorText(text, field) {
+  return text.length > 0 && utf8ByteLength(text) <= CLIENT_ERROR_DETAIL_MAX_BYTES[field] && scrubClientErrorText(text) === text;
+}
+function projectClientErrorDetail(raw) {
+  if (!raw) return void 0;
+  const detail = {};
+  for (const field of CLIENT_ERROR_DETAIL_FIELDS) {
+    const value = raw[field];
+    if (typeof value !== "string") continue;
+    const projected = boundClientErrorText(
+      scrubClientErrorText(value).trim(),
+      CLIENT_ERROR_DETAIL_MAX_BYTES[field]
+    );
+    if (projected) detail[field] = projected;
+  }
+  return Object.keys(detail).length > 0 ? detail : void 0;
+}
+var CLIENT_SIGNALS = ["request_failure", "stream", "web_vital"];
+var CLIENT_REQUEST_ACTIONS = [
+  "create_session",
+  "send_message",
+  "steer_message",
+  "composer_submit",
+  "retry_turn",
+  "connect_integration",
+  "connect_model",
+  "checkout_start"
+];
+var CLIENT_REQUEST_FAILURE_REASONS = ["network", "timeout", "offline"];
+var CLIENT_STREAMS = ["session", "workspace"];
+var CLIENT_STREAM_EVENTS = [
+  "reconnect",
+  "reconnect_exhausted",
+  "long_disconnect"
+];
+var CLIENT_WEB_VITAL_METRICS = ["lcp", "inp", "cls", "ttfb"];
+var CLIENT_WEB_VITAL_MAX_VALUE = {
+  lcp: 600,
+  inp: 600,
+  cls: 100,
+  ttfb: 600
+};
+var CLIENT_PAGES = [
+  "sessions",
+  "priority",
+  "plugins",
+  "capabilities",
+  "documents",
+  "state",
+  "memory",
+  "schedules",
+  "artifacts",
+  "settings",
+  "organization",
+  "insights",
+  "machines",
+  "files",
+  "agents",
+  "secrets",
+  "variable-sets",
+  "environments",
+  "rigs",
+  "playground",
+  "read-only-chats",
+  "inbox",
+  "home",
+  "session-link",
+  "identity-link",
+  "checkout-return",
+  "integration-return",
+  "device",
+  "connect-agent",
+  "native-sign-in",
+  "reset-password",
+  "setup-account",
+  "account-auth",
+  "site-auth",
+  "personal-security",
+  "other"
+];
+export {
+  CLIENT_ERRORS_PATH,
+  CLIENT_ERROR_DETAIL_FIELDS,
+  CLIENT_ERROR_DETAIL_MAX_BYTES,
+  CLIENT_ERROR_KINDS,
+  CLIENT_ERROR_REPORT_MAX_BYTES,
+  CLIENT_ERROR_REVISION_PATTERN,
+  CLIENT_ERROR_ROUTE_PATTERN,
+  CLIENT_PAGES,
+  CLIENT_REQUEST_ACTIONS,
+  CLIENT_REQUEST_FAILURE_REASONS,
+  CLIENT_SIGNALS,
+  CLIENT_STREAMS,
+  CLIENT_STREAM_EVENTS,
+  CLIENT_WEB_VITAL_MAX_VALUE,
+  CLIENT_WEB_VITAL_METRICS,
+  boundClientErrorText,
+  isProjectedClientErrorText,
+  projectClientErrorDetail,
+  scrubClientErrorText
+};
+//# sourceMappingURL=client-error-report.js.map

package/dist/client-error-report.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client-error-report.ts"],"sourcesContent":["/**\n * Wire grammar of the web client error beacon (`POST /v1/client-errors`).\n *\n * A report is a closed error kind, the matched route PATTERN (never a concrete\n * URL), the bundle revision, and optional error diagnostics: the error's name,\n * message and stack, plus React's component stack for a render failure. The\n * diagnostics are error text, not analytics. They can occasionally contain a\n * fragment of user content (an error message that quotes a value), so they are\n * scrubbed of obvious credentials and query strings by\n * {@link scrubClientErrorText} and bounded per field by\n * {@link CLIENT_ERROR_DETAIL_MAX_BYTES} in the browser, and the API re-applies\n * the same projection to whatever it receives. The web client that projects a\n * report, the API route that admits it, and the public structured-log\n * projection that prints it all validate against these exact rules, so the\n * browser can only send what the API accepts and logs.\n *\n * The same route also admits the closed operational signals below (requests\n * that never reached the server, live-stream health, and web vitals). They\n * follow the same rules: closed values only, a route pattern or page label,\n * never a URL, message, identifier, or user content.\n */\nexport const CLIENT_ERRORS_PATH = \"/v1/client-errors\";\n\nexport const CLIENT_ERROR_KINDS = [\n  \"route_error\",\n  \"unhandled_rejection\",\n  \"window_error\",\n  \"chunk_load\",\n] as const;\nexport type ClientErrorKind = (typeof CLIENT_ERROR_KINDS)[number];\n\n/**\n * Largest UTF-8 byte length of each error diagnostic field. A longer value is\n * cut at the end, so a stack keeps its innermost frames.\n */\nexport const CLIENT_ERROR_DETAIL_MAX_BYTES = {\n  name: 128,\n  message: 1024,\n  stack: 4096,\n  componentStack: 4096,\n} as const;\nexport type ClientErrorDetailField = keyof typeof CLIENT_ERROR_DETAIL_MAX_BYTES;\nexport const CLIENT_ERROR_DETAIL_FIELDS = Object.keys(\n  CLIENT_ERROR_DETAIL_MAX_BYTES,\n) as ClientErrorDetailField[];\n\n/**\n * Largest accepted report body. The detail fields total 9,344 bytes; JSON\n * escaping at most doubles that, which leaves room for the closed fields.\n */\nexport const CLIENT_ERROR_REPORT_MAX_BYTES = 20 * 1024;\n\nconst ROUTE_SEGMENT = String.raw`(?:[a-z]+(?:-[a-z]+)*|\\$[A-Za-z][A-Za-z0-9]{0,31})`;\n\n/**\n * A route pattern of at most 160 characters that is `/`, `unknown`, or up to\n * twelve `/`-separated segments that are each either a lowercase literal\n * (`variable-sets`) or a `$param` placeholder. The grammar excludes digits in\n * literals, so a concrete id cannot pass as one.\n */\nexport const CLIENT_ERROR_ROUTE_PATTERN = new RegExp(\n  String.raw`^(?=.{1,160}$)(?:unknown|/|(?:/${ROUTE_SEGMENT}){1,12})$`,\n);\n\n/** The bundle revision token (a commit SHA, `dev`, or `unknown`). */\nexport const CLIENT_ERROR_REVISION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;\n\n/** Error diagnostics. Every field is optional and already scrubbed and bounded. */\nexport type ClientErrorDetail = Partial<Record<ClientErrorDetailField, string>>;\n\nexport type ClientErrorReport = {\n  kind: ClientErrorKind;\n  route: string;\n  revision: string;\n  error?: ClientErrorDetail;\n};\n\nconst REDACTED = \"[redacted]\";\nconst TRUNCATED = \"…[truncated]\";\n\n// Hosts whose error URLs carry the error's arguments in the query string, and\n// nothing else (React's production error decoder links).\nconst ERROR_DECODER_URL = /^https?:\\/\\/(?:react\\.dev\\/errors\\/|reactjs\\.org\\/docs\\/error-decoder)/i;\n\nconst LONE_SURROGATE = /[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|(?<![\\uD800-\\uDBFF])[\\uDC00-\\uDFFF]/g;\n// Every control character except tab and newline.\n// oxlint-disable-next-line no-control-regex\nconst CONTROL_CHARACTERS = /[\\u0000-\\u0008\\u000B-\\u001F\\u007F]/g;\nconst URL_WITH_QUERY = /\\bhttps?:\\/\\/[^\\s?#\"'<>()`]*[?#][^\\s\"'<>()`]*/gi;\nconst LINE_AND_COLUMN_SUFFIX = /(?::\\d+){1,2}$/;\n// A credential, not prose such as \"Basic authentication\": it contains a digit.\nconst AUTHORIZATION_VALUE =\n  /\\b(Bearer|Basic|Token)\\s+(?=[A-Za-z._~+/=-]*[0-9])[A-Za-z0-9._~+/=-]{8,}/gi;\nconst JWT = /\\beyJ[A-Za-z0-9_-]{5,}\\.[A-Za-z0-9_-]{5,}(?:\\.[A-Za-z0-9_-]*)?/g;\nconst KNOWN_TOKEN =\n  /\\b(?:sk-(?:proj-|ant-)?|sk_(?:live|test)_|rk_(?:live|test)_|gh[pousr]_|github_pat_|glpat-|npm_|xox[abposr]-|ops_|AKIA|ASIA|AIza)[A-Za-z0-9_-]{12,}/g;\n// The value never starts with `[` or `…`, so an already redacted value and a\n// truncation marker are left alone and the scrubber stays idempotent.\nconst SECRET_ASSIGNMENT =\n  /\\b((?:access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|token|client[_-]?secret|secret|password|passwd|api[_-]?key|apikey|authorization|cookie|private[_-]?key)[\"']?\\s*[:=]\\s*[\"']?)[^\\s\"'&,;}[…][^\\s\"'&,;}]*/gi;\nconst OPAQUE_RUN = /[A-Za-z0-9+=_-]{32,}/g;\n\n/**\n * A long run that looks like a credential rather than a word, chunk name,\n * path or UUID: it mixes letters and digits and has an unbroken stretch of at\n * least 24 characters between `-`/`_` separators. Content-hashed asset names\n * (`artifact-page-chrome-DkF3x9aB`) and UUIDs have no stretch that long.\n */\nfunction isOpaqueCredential(run: string): boolean {\n  return (\n    /[0-9]/.test(run) &&\n    /[A-Za-z]/.test(run) &&\n    run.split(/[-_]/).some((stretch) => stretch.length >= 24)\n  );\n}\n\n/**\n * Remove what an error text must never carry while keeping what makes it\n * useful. Query strings and fragments are dropped from http(s) URLs (keeping a\n * stack frame's `:line:column`); authorization values, JWTs, well-known API\n * token formats, the values of `token=`/`password:`-style assignments, and\n * long opaque letter-and-digit runs become `[redacted]`; control characters\n * other than tab and newline become spaces. Messages, file names, route paths,\n * UUIDs and stack frames survive. Applying it twice changes nothing.\n */\nexport function scrubClientErrorText(text: string): string {\n  return text\n    .replace(LONE_SURROGATE, \"\\uFFFD\")\n    .replace(/\\r\\n?/g, \"\\n\")\n    .replace(CONTROL_CHARACTERS, \" \")\n    .replace(URL_WITH_QUERY, (url) => {\n      if (ERROR_DECODER_URL.test(url)) return url;\n      const cut = url.search(/[?#]/);\n      const suffix = url.slice(cut).match(LINE_AND_COLUMN_SUFFIX)?.[0] ?? \"\";\n      return url.slice(0, cut) + suffix;\n    })\n    .replace(AUTHORIZATION_VALUE, `$1 ${REDACTED}`)\n    .replace(JWT, REDACTED)\n    .replace(KNOWN_TOKEN, REDACTED)\n    .replace(SECRET_ASSIGNMENT, `$1${REDACTED}`)\n    .replace(OPAQUE_RUN, (run) => (isOpaqueCredential(run) ? REDACTED : run));\n}\n\nfunction utf8ByteLength(text: string): number {\n  return new TextEncoder().encode(text).byteLength;\n}\n\n/**\n * Cut `text` to at most `maxBytes` UTF-8 bytes on a character boundary, ending\n * with a truncation marker when anything was removed.\n */\nexport function boundClientErrorText(text: string, maxBytes: number): string {\n  if (utf8ByteLength(text) <= maxBytes) return text;\n  const budget = maxBytes - utf8ByteLength(TRUNCATED);\n  let bytes = 0;\n  let end = 0;\n  for (const character of text) {\n    const size = utf8ByteLength(character);\n    if (bytes + size > budget) break;\n    bytes += size;\n    end += character.length;\n  }\n  return text.slice(0, end) + TRUNCATED;\n}\n\n/** Whether `text` is already exactly what the projection would produce for it. */\nexport function isProjectedClientErrorText(text: string, field: ClientErrorDetailField): boolean {\n  return (\n    text.length > 0 &&\n    utf8ByteLength(text) <= CLIENT_ERROR_DETAIL_MAX_BYTES[field] &&\n    scrubClientErrorText(text) === text\n  );\n}\n\n/**\n * Project raw diagnostics into a {@link ClientErrorDetail}: non-string and\n * blank fields are dropped, the rest scrubbed and then bounded. Returns\n * `undefined` when nothing remains. Bounding after scrubbing keeps a cut from\n * splitting a credential into a fragment the scrubber no longer recognizes;\n * the marker cannot form one, so the result is stable under re-projection.\n */\nexport function projectClientErrorDetail(\n  raw: Partial<Record<ClientErrorDetailField, unknown>> | null | undefined,\n): ClientErrorDetail | undefined {\n  if (!raw) return undefined;\n  const detail: ClientErrorDetail = {};\n  for (const field of CLIENT_ERROR_DETAIL_FIELDS) {\n    const value = raw[field];\n    if (typeof value !== \"string\") continue;\n    const projected = boundClientErrorText(\n      scrubClientErrorText(value).trim(),\n      CLIENT_ERROR_DETAIL_MAX_BYTES[field],\n    );\n    if (projected) detail[field] = projected;\n  }\n  return Object.keys(detail).length > 0 ? detail : undefined;\n}\n\n/**\n * Content-free operational signals that share the error beacon route. A\n * signal report carries a `signal` discriminator and only closed values; a\n * report without `signal` is a {@link ClientErrorReport}. Older API servers\n * reject signal reports as invalid, so the extension is backward compatible in\n * both directions.\n */\nexport const CLIENT_SIGNALS = [\"request_failure\", \"stream\", \"web_vital\"] as const;\nexport type ClientSignal = (typeof CLIENT_SIGNALS)[number];\n\n/**\n * Key product mutations whose failure before any HTTP response is counted.\n * `send_message` includes sends the server queues behind an active turn.\n */\nexport const CLIENT_REQUEST_ACTIONS = [\n  \"create_session\",\n  \"send_message\",\n  \"steer_message\",\n  \"composer_submit\",\n  \"retry_turn\",\n  \"connect_integration\",\n  \"connect_model\",\n  \"checkout_start\",\n] as const;\nexport type ClientRequestAction = (typeof CLIENT_REQUEST_ACTIONS)[number];\n\n/**\n * Why a request never produced an HTTP response: the browser reported no\n * connectivity (`offline`), the client's own deadline expired (`timeout`), or\n * the transport failed (`network`). Cancellations the user or the app\n * initiated are never reported.\n */\nexport const CLIENT_REQUEST_FAILURE_REASONS = [\"network\", \"timeout\", \"offline\"] as const;\nexport type ClientRequestFailureReason = (typeof CLIENT_REQUEST_FAILURE_REASONS)[number];\n\n/** Browser live streams: one session's event stream, or the workspace live stream. */\nexport const CLIENT_STREAMS = [\"session\", \"workspace\"] as const;\nexport type ClientStream = (typeof CLIENT_STREAMS)[number];\n\n/**\n * Live stream health: a live stream dropped and started reconnecting\n * (`reconnect`), stopped reconnecting (`reconnect_exhausted`), or stayed\n * disconnected for longer than the long-disconnect threshold while the tab\n * was visible (`long_disconnect`).\n */\nexport const CLIENT_STREAM_EVENTS = [\n  \"reconnect\",\n  \"reconnect_exhausted\",\n  \"long_disconnect\",\n] as const;\nexport type ClientStreamEvent = (typeof CLIENT_STREAM_EVENTS)[number];\n\n/** Core Web Vitals plus time to first byte, measured once per document. */\nexport const CLIENT_WEB_VITAL_METRICS = [\"lcp\", \"inp\", \"cls\", \"ttfb\"] as const;\nexport type ClientWebVitalMetric = (typeof CLIENT_WEB_VITAL_METRICS)[number];\n\n/**\n * Largest accepted value: seconds for the timing metrics, the unitless layout\n * shift score for `cls`.\n */\nexport const CLIENT_WEB_VITAL_MAX_VALUE: Readonly<Record<ClientWebVitalMetric, number>> = {\n  lcp: 600,\n  inp: 600,\n  cls: 100,\n  ttfb: 600,\n};\n\n/**\n * The closed page labels of the web console's product-journey projection\n * (`journeyPage` in apps/web/src/lib/analytics-journey.ts; a drift test keeps\n * the two identical). Workspace pages are the first path segment after\n * `/workspaces/<id>/`; the rest are exact top-level routes.\n */\nexport const CLIENT_PAGES = [\n  \"sessions\",\n  \"priority\",\n  \"plugins\",\n  \"capabilities\",\n  \"documents\",\n  \"state\",\n  \"memory\",\n  \"schedules\",\n  \"artifacts\",\n  \"settings\",\n  \"organization\",\n  \"insights\",\n  \"machines\",\n  \"files\",\n  \"agents\",\n  \"secrets\",\n  \"variable-sets\",\n  \"environments\",\n  \"rigs\",\n  \"playground\",\n  \"read-only-chats\",\n  \"inbox\",\n  \"home\",\n  \"session-link\",\n  \"identity-link\",\n  \"checkout-return\",\n  \"integration-return\",\n  \"device\",\n  \"connect-agent\",\n  \"native-sign-in\",\n  \"reset-password\",\n  \"setup-account\",\n  \"account-auth\",\n  \"site-auth\",\n  \"personal-security\",\n  \"other\",\n] as const;\nexport type ClientPage = (typeof CLIENT_PAGES)[number];\n\nexport type ClientRequestFailureReport = {\n  signal: \"request_failure\";\n  action: ClientRequestAction;\n  reason: ClientRequestFailureReason;\n  route: string;\n  revision: string;\n};\n\nexport type ClientStreamReport = {\n  signal: \"stream\";\n  stream: ClientStream;\n  event: ClientStreamEvent;\n  route: string;\n  revision: string;\n};\n\nexport type ClientWebVitalReport = {\n  signal: \"web_vital\";\n  metric: ClientWebVitalMetric;\n  page: ClientPage;\n  /** Seconds for timing metrics, the unitless score for `cls`. */\n  value: number;\n  revision: string;\n};\n\nexport type ClientSignalReport =\n  | ClientRequestFailureReport\n  | ClientStreamReport\n  | ClientWebVitalReport;\n\n/** Every body the beacon route accepts. */\nexport type ClientBeaconReport = ClientErrorReport | ClientSignalReport;\n"],"mappings":";AAqBO,IAAM,qBAAqB;AAE3B,IAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,gCAAgC;AAAA,EAC3C,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,gBAAgB;AAClB;AAEO,IAAM,6BAA6B,OAAO;AAAA,EAC/C;AACF;AAMO,IAAM,gCAAgC,KAAK;AAElD,IAAM,gBAAgB,OAAO;AAQtB,IAAM,6BAA6B,IAAI;AAAA,EAC5C,OAAO,qCAAqC,aAAa;AAC3D;AAGO,IAAM,gCAAgC;AAY7C,IAAM,WAAW;AACjB,IAAM,YAAY;AAIlB,IAAM,oBAAoB;AAE1B,IAAM,iBAAiB;AAGvB,IAAM,qBAAqB;AAC3B,IAAM,iBAAiB;AACvB,IAAM,yBAAyB;AAE/B,IAAM,sBACJ;AACF,IAAM,MAAM;AACZ,IAAM,cACJ;AAGF,IAAM,oBACJ;AACF,IAAM,aAAa;AAQnB,SAAS,mBAAmB,KAAsB;AAChD,SACE,QAAQ,KAAK,GAAG,KAChB,WAAW,KAAK,GAAG,KACnB,IAAI,MAAM,MAAM,EAAE,KAAK,CAAC,YAAY,QAAQ,UAAU,EAAE;AAE5D;AAWO,SAAS,qBAAqB,MAAsB;AACzD,SAAO,KACJ,QAAQ,gBAAgB,QAAQ,EAChC,QAAQ,UAAU,IAAI,EACtB,QAAQ,oBAAoB,GAAG,EAC/B,QAAQ,gBAAgB,CAAC,QAAQ;AAChC,QAAI,kBAAkB,KAAK,GAAG,EAAG,QAAO;AACxC,UAAM,MAAM,IAAI,OAAO,MAAM;AAC7B,UAAM,SAAS,IAAI,MAAM,GAAG,EAAE,MAAM,sBAAsB,IAAI,CAAC,KAAK;AACpE,WAAO,IAAI,MAAM,GAAG,GAAG,IAAI;AAAA,EAC7B,CAAC,EACA,QAAQ,qBAAqB,MAAM,QAAQ,EAAE,EAC7C,QAAQ,KAAK,QAAQ,EACrB,QAAQ,aAAa,QAAQ,EAC7B,QAAQ,mBAAmB,KAAK,QAAQ,EAAE,EAC1C,QAAQ,YAAY,CAAC,QAAS,mBAAmB,GAAG,IAAI,WAAW,GAAI;AAC5E;AAEA,SAAS,eAAe,MAAsB;AAC5C,SAAO,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE;AACxC;AAMO,SAAS,qBAAqB,MAAc,UAA0B;AAC3E,MAAI,eAAe,IAAI,KAAK,SAAU,QAAO;AAC7C,QAAM,SAAS,WAAW,eAAe,SAAS;AAClD,MAAI,QAAQ;AACZ,MAAI,MAAM;AACV,aAAW,aAAa,MAAM;AAC5B,UAAM,OAAO,eAAe,SAAS;AACrC,QAAI,QAAQ,OAAO,OAAQ;AAC3B,aAAS;AACT,WAAO,UAAU;AAAA,EACnB;AACA,SAAO,KAAK,MAAM,GAAG,GAAG,IAAI;AAC9B;AAGO,SAAS,2BAA2B,MAAc,OAAwC;AAC/F,SACE,KAAK,SAAS,KACd,eAAe,IAAI,KAAK,8BAA8B,KAAK,KAC3D,qBAAqB,IAAI,MAAM;AAEnC;AASO,SAAS,yBACd,KAC+B;AAC/B,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAA4B,CAAC;AACnC,aAAW,SAAS,4BAA4B;AAC9C,UAAM,QAAQ,IAAI,KAAK;AACvB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,YAAY;AAAA,MAChB,qBAAqB,KAAK,EAAE,KAAK;AAAA,MACjC,8BAA8B,KAAK;AAAA,IACrC;AACA,QAAI,UAAW,QAAO,KAAK,IAAI;AAAA,EACjC;AACA,SAAO,OAAO,KAAK,MAAM,EAAE,SAAS,IAAI,SAAS;AACnD;AASO,IAAM,iBAAiB,CAAC,mBAAmB,UAAU,WAAW;AAOhE,IAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,IAAM,iCAAiC,CAAC,WAAW,WAAW,SAAS;AAIvE,IAAM,iBAAiB,CAAC,WAAW,WAAW;AAS9C,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AACF;AAIO,IAAM,2BAA2B,CAAC,OAAO,OAAO,OAAO,MAAM;AAO7D,IAAM,6BAA6E;AAAA,EACxF,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AACR;AAQO,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;","names":[]}

package/dist/code-search.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Directories holding platform credential material that `code_search` never
+ * searches or reads, as path segments matched at any depth: Opengeni's
+ * sandbox state (`.opengeni/`: Codemode bearer tokens, Git credential files
+ * and bindings), the Azure CLI login cache (`.azure/`, from the sandbox's
+ * service-principal login with HOME=/workspace) and a Connected Machine
+ * agent's enrollment credentials (`.config/opengeni/`). The sandbox channel
+ * enforces this list; `@opengeni/jev` keeps the same list for its engine, and
+ * a worker test pins that the two agree.
+ */
+export declare const CODE_SEARCH_CREDENTIAL_DIRS: readonly (readonly string[])[];
+/**
+ * The deployment half of the `code_search` decision. `split` gives the tool to
+ * a fixed half of sessions (see `codeSearchSessionInExperiment`) so staging can
+ * compare sessions with and without it.
+ */
+export type CodeSearchWorkspaceDefault = "off" | "on" | "split";
+export type CodeSearchDeploymentPolicy = {
+    available: boolean;
+    workspaceDefault: CodeSearchWorkspaceDefault;
+};
+/**
+ * What a workspace gets: the deployment decides first, so nothing enables the
+ * tool where the deployment does not offer it. Otherwise an explicit workspace
+ * choice wins, and an absent, null or malformed setting follows the deployment
+ * default. Only this field is read, so an invalid sibling setting cannot turn
+ * an explicit Off back into the deployment default.
+ */
+export declare function resolveWorkspaceCodeSearchMode(settings: unknown, deployment: CodeSearchDeploymentPolicy): CodeSearchWorkspaceDefault;
+/**
+ * Fixed per-session half for the `split` experiment: 32-bit FNV-1a of the
+ * session id, low bit 0 gets the tool. Deterministic and dependency-free, so
+ * a root session's arm can be recomputed from its id. Child sessions inherit
+ * their parent's decision instead.
+ */
+export declare function codeSearchSessionInExperiment(sessionId: string): boolean;
+/**
+ * The decision frozen on a new root session when it is created. Later changes
+ * to the workspace setting or the deployment mode never turn the tool on for a
+ * session that was created without it.
+ */
+export declare function resolveSessionCodeSearchEnabled(settings: unknown, deployment: CodeSearchDeploymentPolicy, sessionId: string): boolean;
+/**
+ * Whether a turn of this session gets `code_search`. Only a session frozen on
+ * at creation can have it. The deployment (mode off or no usable key) and an
+ * explicit workspace Off still pause it in running sessions, because they stop
+ * repository content going to Jev; undoing that switch-off gives it back to
+ * sessions frozen on. Each such change costs every affected session one
+ * prompt-cache miss, which is accepted for a deliberate switch. Nothing else
+ * changes the tool list of a running session.
+ */
+export declare function codeSearchEnabledForTurn(frozen: boolean | null | undefined, settings: unknown, deployment: CodeSearchDeploymentPolicy): boolean;

package/dist/code-search.js

@@ -0,0 +1,40 @@
+// src/code-search.ts
+var CODE_SEARCH_CREDENTIAL_DIRS = [
+  [".opengeni"],
+  [".azure"],
+  [".config", "opengeni"]
+];
+function resolveWorkspaceCodeSearchMode(settings, deployment) {
+  if (!deployment.available) return "off";
+  const explicit = explicitWorkspaceCodeSearchSetting(settings);
+  if (explicit === true) return "on";
+  if (explicit === false) return "off";
+  return deployment.workspaceDefault;
+}
+function explicitWorkspaceCodeSearchSetting(settings) {
+  const explicit = typeof settings === "object" && settings !== null ? settings.codeSearchEnabled : void 0;
+  return typeof explicit === "boolean" ? explicit : void 0;
+}
+function codeSearchSessionInExperiment(sessionId) {
+  let hash = 2166136261;
+  for (let index = 0; index < sessionId.length; index++) {
+    hash ^= sessionId.charCodeAt(index);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return (hash & 1) === 0;
+}
+function resolveSessionCodeSearchEnabled(settings, deployment, sessionId) {
+  const mode = resolveWorkspaceCodeSearchMode(settings, deployment);
+  return mode === "on" || mode === "split" && codeSearchSessionInExperiment(sessionId);
+}
+function codeSearchEnabledForTurn(frozen, settings, deployment) {
+  return frozen === true && deployment.available && explicitWorkspaceCodeSearchSetting(settings) !== false;
+}
+export {
+  CODE_SEARCH_CREDENTIAL_DIRS,
+  codeSearchEnabledForTurn,
+  codeSearchSessionInExperiment,
+  resolveSessionCodeSearchEnabled,
+  resolveWorkspaceCodeSearchMode
+};
+//# sourceMappingURL=code-search.js.map

package/dist/code-search.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/code-search.ts"],"sourcesContent":["// Resolvers for the optional Jev-backed `code_search` agent tool. A separate\n// subpath keeps them out of browser bundles; only server code decides.\n\n/**\n * Directories holding platform credential material that `code_search` never\n * searches or reads, as path segments matched at any depth: Opengeni's\n * sandbox state (`.opengeni/`: Codemode bearer tokens, Git credential files\n * and bindings), the Azure CLI login cache (`.azure/`, from the sandbox's\n * service-principal login with HOME=/workspace) and a Connected Machine\n * agent's enrollment credentials (`.config/opengeni/`). The sandbox channel\n * enforces this list; `@opengeni/jev` keeps the same list for its engine, and\n * a worker test pins that the two agree.\n */\nexport const CODE_SEARCH_CREDENTIAL_DIRS: readonly (readonly string[])[] = [\n  [\".opengeni\"],\n  [\".azure\"],\n  [\".config\", \"opengeni\"],\n];\n\n/**\n * The deployment half of the `code_search` decision. `split` gives the tool to\n * a fixed half of sessions (see `codeSearchSessionInExperiment`) so staging can\n * compare sessions with and without it.\n */\nexport type CodeSearchWorkspaceDefault = \"off\" | \"on\" | \"split\";\nexport type CodeSearchDeploymentPolicy = {\n  available: boolean;\n  workspaceDefault: CodeSearchWorkspaceDefault;\n};\n\n/**\n * What a workspace gets: the deployment decides first, so nothing enables the\n * tool where the deployment does not offer it. Otherwise an explicit workspace\n * choice wins, and an absent, null or malformed setting follows the deployment\n * default. Only this field is read, so an invalid sibling setting cannot turn\n * an explicit Off back into the deployment default.\n */\nexport function resolveWorkspaceCodeSearchMode(\n  settings: unknown,\n  deployment: CodeSearchDeploymentPolicy,\n): CodeSearchWorkspaceDefault {\n  if (!deployment.available) return \"off\";\n  const explicit = explicitWorkspaceCodeSearchSetting(settings);\n  if (explicit === true) return \"on\";\n  if (explicit === false) return \"off\";\n  return deployment.workspaceDefault;\n}\n\nfunction explicitWorkspaceCodeSearchSetting(settings: unknown): boolean | undefined {\n  const explicit =\n    typeof settings === \"object\" && settings !== null\n      ? (settings as { codeSearchEnabled?: unknown }).codeSearchEnabled\n      : undefined;\n  return typeof explicit === \"boolean\" ? explicit : undefined;\n}\n\n/**\n * Fixed per-session half for the `split` experiment: 32-bit FNV-1a of the\n * session id, low bit 0 gets the tool. Deterministic and dependency-free, so\n * a root session's arm can be recomputed from its id. Child sessions inherit\n * their parent's decision instead.\n */\nexport function codeSearchSessionInExperiment(sessionId: string): boolean {\n  let hash = 0x811c9dc5;\n  for (let index = 0; index < sessionId.length; index++) {\n    hash ^= sessionId.charCodeAt(index);\n    hash = Math.imul(hash, 0x01000193) >>> 0;\n  }\n  return (hash & 1) === 0;\n}\n\n/**\n * The decision frozen on a new root session when it is created. Later changes\n * to the workspace setting or the deployment mode never turn the tool on for a\n * session that was created without it.\n */\nexport function resolveSessionCodeSearchEnabled(\n  settings: unknown,\n  deployment: CodeSearchDeploymentPolicy,\n  sessionId: string,\n): boolean {\n  const mode = resolveWorkspaceCodeSearchMode(settings, deployment);\n  return mode === \"on\" || (mode === \"split\" && codeSearchSessionInExperiment(sessionId));\n}\n\n/**\n * Whether a turn of this session gets `code_search`. Only a session frozen on\n * at creation can have it. The deployment (mode off or no usable key) and an\n * explicit workspace Off still pause it in running sessions, because they stop\n * repository content going to Jev; undoing that switch-off gives it back to\n * sessions frozen on. Each such change costs every affected session one\n * prompt-cache miss, which is accepted for a deliberate switch. Nothing else\n * changes the tool list of a running session.\n */\nexport function codeSearchEnabledForTurn(\n  frozen: boolean | null | undefined,\n  settings: unknown,\n  deployment: CodeSearchDeploymentPolicy,\n): boolean {\n  return (\n    frozen === true &&\n    deployment.available &&\n    explicitWorkspaceCodeSearchSetting(settings) !== false\n  );\n}\n"],"mappings":";AAaO,IAAM,8BAA8D;AAAA,EACzE,CAAC,WAAW;AAAA,EACZ,CAAC,QAAQ;AAAA,EACT,CAAC,WAAW,UAAU;AACxB;AAoBO,SAAS,+BACd,UACA,YAC4B;AAC5B,MAAI,CAAC,WAAW,UAAW,QAAO;AAClC,QAAM,WAAW,mCAAmC,QAAQ;AAC5D,MAAI,aAAa,KAAM,QAAO;AAC9B,MAAI,aAAa,MAAO,QAAO;AAC/B,SAAO,WAAW;AACpB;AAEA,SAAS,mCAAmC,UAAwC;AAClF,QAAM,WACJ,OAAO,aAAa,YAAY,aAAa,OACxC,SAA6C,oBAC9C;AACN,SAAO,OAAO,aAAa,YAAY,WAAW;AACpD;AAQO,SAAS,8BAA8B,WAA4B;AACxE,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,UAAU,QAAQ,SAAS;AACrD,YAAQ,UAAU,WAAW,KAAK;AAClC,WAAO,KAAK,KAAK,MAAM,QAAU,MAAM;AAAA,EACzC;AACA,UAAQ,OAAO,OAAO;AACxB;AAOO,SAAS,gCACd,UACA,YACA,WACS;AACT,QAAM,OAAO,+BAA+B,UAAU,UAAU;AAChE,SAAO,SAAS,QAAS,SAAS,WAAW,8BAA8B,SAAS;AACtF;AAWO,SAAS,yBACd,QACA,UACA,YACS;AACT,SACE,WAAW,QACX,WAAW,aACX,mCAAmC,QAAQ,MAAM;AAErD;","names":[]}

package/dist/codex-provider-account-authority.js

@@ -1,17 +1,25 @@
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
 // src/codex-provider-account-authority.ts
 import { z } from "zod";
-var PositiveSafeInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
-var CodexProviderAccountAuthoritySnapshotV1 = z.discriminatedUnion("scope", [
-  z.object({
-    version: z.literal(1),
-    scope: z.literal("workspace")
-  }).strict(),
-  z.object({
-    version: z.literal(1),
-    scope: z.literal("user"),
-    authorityGeneration: PositiveSafeInteger
-  }).strict()
-]);
+var PositiveSafeInteger = /* @__PURE__ */ defineSchema(
+  () => z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+);
+var CodexProviderAccountAuthoritySnapshotV1 = /* @__PURE__ */ defineSchema(
+  () => z.discriminatedUnion("scope", [
+    z.object({
+      version: z.literal(1),
+      scope: z.literal("workspace")
+    }).strict(),
+    z.object({
+      version: z.literal(1),
+      scope: z.literal("user"),
+      authorityGeneration: PositiveSafeInteger
+    }).strict()
+  ])
+);
 var LEGACY_WORKSPACE_CODEX_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {
   version: 1,
   scope: "workspace"

package/dist/codex-provider-account-authority.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/codex-provider-account-authority.ts"],"sourcesContent":["import { z } from \"zod\";\n\nconst PositiveSafeInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);\n\n/**\n * Opaque authority frozen at a Codex provider-account acceptance boundary.\n *\n * The snapshot deliberately carries no organization, membership, credential,\n * provider-account, subject, label, quota, token, or plan identity. A later\n * activation slice may use the user generation only together with separately\n * authorized durable state; this value is never sufficient authority alone.\n */\nexport const CodexProviderAccountAuthoritySnapshotV1 = z.discriminatedUnion(\"scope\", [\n  z\n    .object({\n      version: z.literal(1),\n      scope: z.literal(\"workspace\"),\n    })\n    .strict(),\n  z\n    .object({\n      version: z.literal(1),\n      scope: z.literal(\"user\"),\n      authorityGeneration: PositiveSafeInteger,\n    })\n    .strict(),\n]);\n\nexport type CodexProviderAccountAuthoritySnapshotV1 = z.infer<\n  typeof CodexProviderAccountAuthoritySnapshotV1\n>;\n\n/** Explicit compatibility value for all pre-foundation accepted work. */\nexport const LEGACY_WORKSPACE_CODEX_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {\n  version: 1,\n  scope: \"workspace\",\n} as const satisfies CodexProviderAccountAuthoritySnapshotV1;\n"],"mappings":";AAAA,SAAS,SAAS;AAElB,IAAM,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,OAAO,gBAAgB;AAU5E,IAAM,0CAA0C,EAAE,mBAAmB,SAAS;AAAA,EACnF,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,CAAC;AAAA,IACpB,OAAO,EAAE,QAAQ,WAAW;AAAA,EAC9B,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,CAAC;AAAA,IACpB,OAAO,EAAE,QAAQ,MAAM;AAAA,IACvB,qBAAqB;AAAA,EACvB,CAAC,EACA,OAAO;AACZ,CAAC;AAOM,IAAM,gEAAgE;AAAA,EAC3E,SAAS;AAAA,EACT,OAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/codex-provider-account-authority.ts"],"sourcesContent":["import { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nconst PositiveSafeInteger = /* @__PURE__ */ defineSchema(() =>\n  z.number().int().positive().max(Number.MAX_SAFE_INTEGER),\n);\n\n/**\n * Opaque authority frozen at a Codex provider-account acceptance boundary.\n *\n * The snapshot deliberately carries no organization, membership, credential,\n * provider-account, subject, label, quota, token, or plan identity. A later\n * activation slice may use the user generation only together with separately\n * authorized durable state; this value is never sufficient authority alone.\n */\nexport const CodexProviderAccountAuthoritySnapshotV1 = /* @__PURE__ */ defineSchema(() =>\n  z.discriminatedUnion(\"scope\", [\n    z\n      .object({\n        version: z.literal(1),\n        scope: z.literal(\"workspace\"),\n      })\n      .strict(),\n    z\n      .object({\n        version: z.literal(1),\n        scope: z.literal(\"user\"),\n        authorityGeneration: PositiveSafeInteger,\n      })\n      .strict(),\n  ]),\n);\n\nexport type CodexProviderAccountAuthoritySnapshotV1 = z.infer<\n  typeof CodexProviderAccountAuthoritySnapshotV1\n>;\n\n/** Explicit compatibility value for all pre-foundation accepted work. */\nexport const LEGACY_WORKSPACE_CODEX_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {\n  version: 1,\n  scope: \"workspace\",\n} as const satisfies CodexProviderAccountAuthoritySnapshotV1;\n"],"mappings":";;;;;AACA,SAAS,SAAS;AAElB,IAAM,sBAAsC;AAAA,EAAa,MACvD,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,OAAO,gBAAgB;AACzD;AAUO,IAAM,0CAA0D;AAAA,EAAa,MAClF,EAAE,mBAAmB,SAAS;AAAA,IAC5B,EACG,OAAO;AAAA,MACN,SAAS,EAAE,QAAQ,CAAC;AAAA,MACpB,OAAO,EAAE,QAAQ,WAAW;AAAA,IAC9B,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,SAAS,EAAE,QAAQ,CAAC;AAAA,MACpB,OAAO,EAAE,QAAQ,MAAM;AAAA,MACvB,qBAAqB;AAAA,IACvB,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH;AAOO,IAAM,gEAAgE;AAAA,EAC3E,SAAS;AAAA,EACT,OAAO;AACT;","names":[]}