@opengeni/contracts 3.1.0-canary.2 → 3.1.2

package/dist/managed-auth-session-sets.js

@@ -1,3 +1,7 @@
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
 // src/managed-auth-session-sets.ts
 import { z } from "zod";
 var MANAGED_AUTH_SESSION_SET_MAX_SLOTS = 8;
@@ -5,144 +9,206 @@ var MANAGED_AUTH_TRANSACTION_TTL_SECONDS = 600;
 var MANAGED_AUTH_RETURN_INTENT_MAX_BYTES = 2048;
 var MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER = "x-opengeni-api-contract";
 var MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION = "2026-08-personal-only-organization-setup-v1";
-var ManagedAuthSessionSetMode = z.enum(["legacy", "dual", "broker"]);
-var ManagedAuthLoginSlotState = z.enum(["active", "reauth_required"]);
-var ManagedAuthVerifiedClaim = z.object({
-  kind: z.literal("email"),
-  value: z.string().email().max(320)
-});
-var ManagedAuthLoginSlot = z.object({
-  id: z.string().uuid(),
-  displayName: z.string().min(1).max(256),
-  verifiedClaim: ManagedAuthVerifiedClaim,
-  state: ManagedAuthLoginSlotState
-});
-var ManagedAuthSessionSetState = z.enum(["ready", "actor_change_required"]);
-var ManagedAuthSessionSetProjection = z.object({
-  mode: ManagedAuthSessionSetMode,
-  generation: z.string().regex(/^[1-9][0-9]*$/),
-  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),
-  csrfToken: z.string().min(32).max(512),
-  selectedSlotId: z.string().uuid().nullable(),
-  state: ManagedAuthSessionSetState,
-  slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS)
-});
-var ManagedAuthOperationIdentity = z.object({
-  operationId: z.string().uuid(),
-  expectedGeneration: z.string().regex(/^[1-9][0-9]*$/)
-});
+var ManagedAuthSessionSetMode = /* @__PURE__ */ defineSchema(
+  () => z.enum(["legacy", "dual", "broker"])
+);
+var ManagedAuthLoginSlotState = /* @__PURE__ */ defineSchema(
+  () => z.enum(["active", "reauth_required"])
+);
+var ManagedAuthVerifiedClaim = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    kind: z.literal("email"),
+    value: z.string().email().max(320)
+  })
+);
+var ManagedAuthLoginSlot = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    id: z.string().uuid(),
+    displayName: z.string().min(1).max(256),
+    verifiedClaim: ManagedAuthVerifiedClaim,
+    state: ManagedAuthLoginSlotState
+  })
+);
+var ManagedAuthSessionSetState = /* @__PURE__ */ defineSchema(
+  () => z.enum(["ready", "actor_change_required"])
+);
+var ManagedAuthSessionSetProjection = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    mode: ManagedAuthSessionSetMode,
+    generation: z.string().regex(/^[1-9][0-9]*$/),
+    actorEpoch: z.string().regex(/^[1-9][0-9]*$/),
+    csrfToken: z.string().min(32).max(512),
+    selectedSlotId: z.string().uuid().nullable(),
+    state: ManagedAuthSessionSetState,
+    slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS)
+  })
+);
+var ManagedAuthOperationIdentity = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    operationId: z.string().uuid(),
+    expectedGeneration: z.string().regex(/^[1-9][0-9]*$/)
+  })
+);
 var BootstrapManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;
-var ManagedAuthReturnIntent = z.string().min(1).superRefine((value, context) => {
-  if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {
-    context.addIssue({ code: "custom", message: "return intent exceeds its UTF-8 byte limit" });
-  }
-  if (!value.startsWith("/") || value.startsWith("//") || value.includes("?") || value.includes("#") || /[\u0000-\u001f\u007f\\]/.test(value)) {
-    context.addIssue({
-      code: "custom",
-      message: "return intent must be a safe same-origin path"
-    });
-    return;
-  }
-  try {
-    const parsed = new URL(value, "https://opengeni.invalid");
-    const uuid = "[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}";
-    const supportedPath = new RegExp(
-      `^/(?:sessions/${uuid}|workspaces/${uuid}(?:/sessions(?:/${uuid})?)?)$`,
-      "i"
-    );
-    if (parsed.origin !== "https://opengeni.invalid" || parsed.username || parsed.password || parsed.search || parsed.hash || !supportedPath.test(value) || parsed.pathname !== value) {
+var ManagedAuthReturnIntent = /* @__PURE__ */ defineSchema(
+  () => z.string().min(1).superRefine((value, context) => {
+    if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {
+      context.addIssue({ code: "custom", message: "return intent exceeds its UTF-8 byte limit" });
+    }
+    if (!value.startsWith("/") || value.startsWith("//") || value.includes("?") || value.includes("#") || /[\u0000-\u001f\u007f\\]/.test(value)) {
+      context.addIssue({
+        code: "custom",
+        message: "return intent must be a safe same-origin path"
+      });
+      return;
+    }
+    try {
+      const parsed = new URL(value, "https://opengeni.invalid");
+      const uuid = "[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}";
+      const supportedPath = new RegExp(
+        `^/(?:sessions/${uuid}|workspaces/${uuid}(?:/sessions(?:/${uuid})?)?)$`,
+        "i"
+      );
+      if (parsed.origin !== "https://opengeni.invalid" || parsed.username || parsed.password || parsed.search || parsed.hash || !supportedPath.test(value) || parsed.pathname !== value) {
+        context.addIssue({
+          code: "custom",
+          message: "return intent contains unsafe authority data"
+        });
+      }
+    } catch {
+      context.addIssue({
+        code: "custom",
+        message: "return intent is not a valid same-origin path"
+      });
+    }
+  })
+);
+var BeginManagedAuthLoginTransactionRequest = /* @__PURE__ */ defineSchema(
+  () => ManagedAuthOperationIdentity.extend({
+    kind: z.enum(["add", "reauth"]),
+    slotId: z.string().uuid().optional(),
+    returnIntent: ManagedAuthReturnIntent.optional()
+  }).superRefine((value, context) => {
+    if (value.kind === "reauth" !== Boolean(value.slotId)) {
       context.addIssue({
         code: "custom",
-        message: "return intent contains unsafe authority data"
+        path: ["slotId"],
+        message: "reauth requires exactly one slot id and add forbids one"
       });
     }
-  } catch {
-    context.addIssue({
-      code: "custom",
-      message: "return intent is not a valid same-origin path"
-    });
-  }
-});
-var BeginManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({
-  kind: z.enum(["add", "reauth"]),
-  slotId: z.string().uuid().optional(),
-  returnIntent: ManagedAuthReturnIntent.optional()
-}).superRefine((value, context) => {
-  if (value.kind === "reauth" !== Boolean(value.slotId)) {
-    context.addIssue({
-      code: "custom",
-      path: ["slotId"],
-      message: "reauth requires exactly one slot id and add forbids one"
-    });
-  }
-});
-var ManagedAuthLoginTransaction = z.object({
-  id: z.string().uuid(),
-  kind: z.enum(["add", "reauth"]),
-  expiresAt: z.string().datetime(),
-  returnIntentId: z.string().uuid().nullable()
-});
-var ManagedAuthSocialProvider = z.enum(["google", "github"]);
-var StartManagedAuthSocialTransactionRequest = ManagedAuthOperationIdentity.extend({
-  transactionId: z.string().uuid(),
-  provider: ManagedAuthSocialProvider
-});
-var StartManagedAuthSocialTransactionResponse = z.object({
-  url: z.string().url().max(4096)
-});
-var CompleteManagedAuthEmailPasswordTransactionRequest = ManagedAuthOperationIdentity.extend({
-  transactionId: z.string().uuid(),
-  email: z.string().email().max(320),
-  password: z.string().min(1).max(1024)
-});
-var CompleteManagedAuthLoginTransactionResponse = z.object({
-  projection: ManagedAuthSessionSetProjection,
-  returnIntent: ManagedAuthReturnIntent.nullable()
-});
-var CancelManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({
-  transactionId: z.string().uuid()
-});
-var SelectManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({
-  slotId: z.string().uuid()
-});
-var LogoutManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({
-  slotId: z.string().uuid(),
-  replacementSlotId: z.string().uuid().nullable()
-});
+  })
+);
+var ManagedAuthLoginTransaction = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    id: z.string().uuid(),
+    kind: z.enum(["add", "reauth"]),
+    expiresAt: z.string().datetime(),
+    returnIntentId: z.string().uuid().nullable()
+  })
+);
+var ManagedAuthSocialProvider = /* @__PURE__ */ defineSchema(
+  () => z.enum(["google", "github"])
+);
+var SocialStartAttributionValue = /* @__PURE__ */ defineSchema(
+  () => z.string().trim().min(1).max(100).regex(/^[A-Za-z0-9._~+-]+$/)
+);
+var SocialStartAttribution = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    utmSource: SocialStartAttributionValue.optional(),
+    utmMedium: SocialStartAttributionValue.optional(),
+    utmCampaign: SocialStartAttributionValue.optional(),
+    utmContent: SocialStartAttributionValue.optional(),
+    ref: SocialStartAttributionValue.optional()
+  }).strict()
+);
+var StartManagedAuthSocialTransactionRequest = /* @__PURE__ */ defineSchema(
+  () => ManagedAuthOperationIdentity.extend({
+    transactionId: z.string().uuid(),
+    provider: ManagedAuthSocialProvider,
+    /**
+     * Optional untrusted first-touch campaign tokens, used only by the
+     * content-free sign-up acquisition counter when this start creates a new
+     * account. Invalid attribution is dropped rather than failing the sign-in.
+     */
+    attribution: SocialStartAttribution.optional().catch(void 0)
+  })
+);
+var StartManagedAuthSocialTransactionResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    url: z.string().url().max(4096)
+  })
+);
+var CompleteManagedAuthEmailPasswordTransactionRequest = /* @__PURE__ */ defineSchema(
+  () => ManagedAuthOperationIdentity.extend({
+    transactionId: z.string().uuid(),
+    email: z.string().email().max(320),
+    password: z.string().min(1).max(1024)
+  })
+);
+var CompleteManagedAuthLoginTransactionResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    projection: ManagedAuthSessionSetProjection,
+    returnIntent: ManagedAuthReturnIntent.nullable()
+  })
+);
+var CancelManagedAuthLoginTransactionRequest = /* @__PURE__ */ defineSchema(
+  () => ManagedAuthOperationIdentity.extend({
+    transactionId: z.string().uuid()
+  })
+);
+var SelectManagedAuthLoginSlotRequest = /* @__PURE__ */ defineSchema(
+  () => ManagedAuthOperationIdentity.extend({
+    slotId: z.string().uuid()
+  })
+);
+var LogoutManagedAuthLoginSlotRequest = /* @__PURE__ */ defineSchema(
+  () => ManagedAuthOperationIdentity.extend({
+    slotId: z.string().uuid(),
+    replacementSlotId: z.string().uuid().nullable()
+  })
+);
 var LogoutManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;
-var ManagedAuthLogoutAllReceipt = z.object({
-  generation: z.string().regex(/^[1-9][0-9]*$/),
-  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),
-  state: z.literal("logged_out")
-});
-var ResolveManagedAuthDeepLinkRequest = z.object({
-  path: ManagedAuthReturnIntent
-});
-var ManagedAuthDeepLinkResolution = z.discriminatedUnion("kind", [
-  z.object({ kind: z.literal("current") }),
-  z.object({ kind: z.literal("switch_required"), slot: ManagedAuthLoginSlot }),
-  z.object({ kind: z.literal("unavailable") })
-]);
-var ManagedAuthSessionSetErrorCode = z.enum([
-  "actor_change_required",
-  "actor_mutation_in_flight",
-  "api_contract_changed",
-  "browser_session_set_required",
-  "browser_session_set_unavailable",
-  "generation_conflict",
-  "invalid_browser_session_set_request",
-  "invalid_transaction",
-  "managed_authentication_required",
-  "managed_authentication_unavailable",
-  "operation_outcome_unknown",
-  "operation_reused",
-  "origin_rejected",
-  "login_transaction_rate_limited",
-  "provider_route_blocked",
-  "slot_limit_reached",
-  "slot_already_exists",
-  "slot_unavailable"
-]);
+var ManagedAuthLogoutAllReceipt = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    generation: z.string().regex(/^[1-9][0-9]*$/),
+    actorEpoch: z.string().regex(/^[1-9][0-9]*$/),
+    state: z.literal("logged_out")
+  })
+);
+var ResolveManagedAuthDeepLinkRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    path: ManagedAuthReturnIntent
+  })
+);
+var ManagedAuthDeepLinkResolution = /* @__PURE__ */ defineSchema(
+  () => z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("current") }),
+    z.object({ kind: z.literal("switch_required"), slot: ManagedAuthLoginSlot }),
+    z.object({ kind: z.literal("unavailable") })
+  ])
+);
+var ManagedAuthSessionSetErrorCode = /* @__PURE__ */ defineSchema(
+  () => z.enum([
+    "actor_change_required",
+    "actor_mutation_in_flight",
+    "api_contract_changed",
+    "browser_session_set_required",
+    "browser_session_set_unavailable",
+    "generation_conflict",
+    "invalid_browser_session_set_request",
+    "invalid_transaction",
+    "managed_authentication_required",
+    "managed_authentication_unavailable",
+    "operation_outcome_unknown",
+    "operation_reused",
+    "origin_rejected",
+    "login_transaction_rate_limited",
+    "provider_route_blocked",
+    "slot_limit_reached",
+    "slot_already_exists",
+    "slot_unavailable"
+  ])
+);
 export {
   BeginManagedAuthLoginTransactionRequest,
   BootstrapManagedAuthSessionSetRequest,

package/dist/managed-auth-session-sets.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/managed-auth-session-sets.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const MANAGED_AUTH_SESSION_SET_MAX_SLOTS = 8 as const;\nexport const MANAGED_AUTH_TRANSACTION_TTL_SECONDS = 600 as const;\nexport const MANAGED_AUTH_RETURN_INTENT_MAX_BYTES = 2_048 as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER = \"x-opengeni-api-contract\" as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION =\n  \"2026-08-personal-only-organization-setup-v1\" as const;\n\nexport const ManagedAuthSessionSetMode = z.enum([\"legacy\", \"dual\", \"broker\"]);\nexport type ManagedAuthSessionSetMode = z.infer<typeof ManagedAuthSessionSetMode>;\n\nexport const ManagedAuthLoginSlotState = z.enum([\"active\", \"reauth_required\"]);\nexport type ManagedAuthLoginSlotState = z.infer<typeof ManagedAuthLoginSlotState>;\n\nexport const ManagedAuthVerifiedClaim = z.object({\n  kind: z.literal(\"email\"),\n  value: z.string().email().max(320),\n});\nexport type ManagedAuthVerifiedClaim = z.infer<typeof ManagedAuthVerifiedClaim>;\n\n/** Secret-free, browser-safe summary. Provider session ids and tokens never enter this shape. */\nexport const ManagedAuthLoginSlot = z.object({\n  id: z.string().uuid(),\n  displayName: z.string().min(1).max(256),\n  verifiedClaim: ManagedAuthVerifiedClaim,\n  state: ManagedAuthLoginSlotState,\n});\nexport type ManagedAuthLoginSlot = z.infer<typeof ManagedAuthLoginSlot>;\n\nexport const ManagedAuthSessionSetState = z.enum([\"ready\", \"actor_change_required\"]);\nexport type ManagedAuthSessionSetState = z.infer<typeof ManagedAuthSessionSetState>;\n\nexport const ManagedAuthSessionSetProjection = z.object({\n  mode: ManagedAuthSessionSetMode,\n  generation: z.string().regex(/^[1-9][0-9]*$/),\n  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n  csrfToken: z.string().min(32).max(512),\n  selectedSlotId: z.string().uuid().nullable(),\n  state: ManagedAuthSessionSetState,\n  slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS),\n});\nexport type ManagedAuthSessionSetProjection = z.infer<typeof ManagedAuthSessionSetProjection>;\n\nexport const ManagedAuthOperationIdentity = z.object({\n  operationId: z.string().uuid(),\n  expectedGeneration: z.string().regex(/^[1-9][0-9]*$/),\n});\nexport type ManagedAuthOperationIdentity = z.infer<typeof ManagedAuthOperationIdentity>;\n\nexport const BootstrapManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type BootstrapManagedAuthSessionSetRequest = z.infer<\n  typeof BootstrapManagedAuthSessionSetRequest\n>;\n\nexport const ManagedAuthReturnIntent = z\n  .string()\n  .min(1)\n  .superRefine((value, context) => {\n    if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {\n      context.addIssue({ code: \"custom\", message: \"return intent exceeds its UTF-8 byte limit\" });\n    }\n    if (\n      !value.startsWith(\"/\") ||\n      value.startsWith(\"//\") ||\n      value.includes(\"?\") ||\n      value.includes(\"#\") ||\n      /[\\u0000-\\u001f\\u007f\\\\]/.test(value)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent must be a safe same-origin path\",\n      });\n      return;\n    }\n    try {\n      const parsed = new URL(value, \"https://opengeni.invalid\");\n      const uuid = \"[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\";\n      const supportedPath = new RegExp(\n        `^/(?:sessions/${uuid}|workspaces/${uuid}(?:/sessions(?:/${uuid})?)?)$`,\n        \"i\",\n      );\n      if (\n        parsed.origin !== \"https://opengeni.invalid\" ||\n        parsed.username ||\n        parsed.password ||\n        parsed.search ||\n        parsed.hash ||\n        !supportedPath.test(value) ||\n        parsed.pathname !== value\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"return intent contains unsafe authority data\",\n        });\n      }\n    } catch {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent is not a valid same-origin path\",\n      });\n    }\n  });\n\nexport const BeginManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({\n  kind: z.enum([\"add\", \"reauth\"]),\n  slotId: z.string().uuid().optional(),\n  returnIntent: ManagedAuthReturnIntent.optional(),\n}).superRefine((value, context) => {\n  if ((value.kind === \"reauth\") !== Boolean(value.slotId)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"slotId\"],\n      message: \"reauth requires exactly one slot id and add forbids one\",\n    });\n  }\n});\nexport type BeginManagedAuthLoginTransactionRequest = z.infer<\n  typeof BeginManagedAuthLoginTransactionRequest\n>;\n\nexport const ManagedAuthLoginTransaction = z.object({\n  id: z.string().uuid(),\n  kind: z.enum([\"add\", \"reauth\"]),\n  expiresAt: z.string().datetime(),\n  returnIntentId: z.string().uuid().nullable(),\n});\nexport type ManagedAuthLoginTransaction = z.infer<typeof ManagedAuthLoginTransaction>;\n\nexport const ManagedAuthSocialProvider = z.enum([\"google\", \"github\"]);\nexport type ManagedAuthSocialProvider = z.infer<typeof ManagedAuthSocialProvider>;\n\nexport const StartManagedAuthSocialTransactionRequest = ManagedAuthOperationIdentity.extend({\n  transactionId: z.string().uuid(),\n  provider: ManagedAuthSocialProvider,\n});\nexport type StartManagedAuthSocialTransactionRequest = z.infer<\n  typeof StartManagedAuthSocialTransactionRequest\n>;\n\nexport const StartManagedAuthSocialTransactionResponse = z.object({\n  url: z.string().url().max(4_096),\n});\nexport type StartManagedAuthSocialTransactionResponse = z.infer<\n  typeof StartManagedAuthSocialTransactionResponse\n>;\n\nexport const CompleteManagedAuthEmailPasswordTransactionRequest =\n  ManagedAuthOperationIdentity.extend({\n    transactionId: z.string().uuid(),\n    email: z.string().email().max(320),\n    password: z.string().min(1).max(1_024),\n  });\nexport type CompleteManagedAuthEmailPasswordTransactionRequest = z.infer<\n  typeof CompleteManagedAuthEmailPasswordTransactionRequest\n>;\n\nexport const CompleteManagedAuthLoginTransactionResponse = z.object({\n  projection: ManagedAuthSessionSetProjection,\n  returnIntent: ManagedAuthReturnIntent.nullable(),\n});\nexport type CompleteManagedAuthLoginTransactionResponse = z.infer<\n  typeof CompleteManagedAuthLoginTransactionResponse\n>;\n\nexport const CancelManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({\n  transactionId: z.string().uuid(),\n});\nexport type CancelManagedAuthLoginTransactionRequest = z.infer<\n  typeof CancelManagedAuthLoginTransactionRequest\n>;\n\nexport const SelectManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({\n  slotId: z.string().uuid(),\n});\nexport type SelectManagedAuthLoginSlotRequest = z.infer<typeof SelectManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({\n  slotId: z.string().uuid(),\n  replacementSlotId: z.string().uuid().nullable(),\n});\nexport type LogoutManagedAuthLoginSlotRequest = z.infer<typeof LogoutManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type LogoutManagedAuthSessionSetRequest = z.infer<typeof LogoutManagedAuthSessionSetRequest>;\n\nexport const ManagedAuthLogoutAllReceipt = z.object({\n  generation: z.string().regex(/^[1-9][0-9]*$/),\n  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n  state: z.literal(\"logged_out\"),\n});\nexport type ManagedAuthLogoutAllReceipt = z.infer<typeof ManagedAuthLogoutAllReceipt>;\n\nexport const ResolveManagedAuthDeepLinkRequest = z.object({\n  path: ManagedAuthReturnIntent,\n});\nexport type ResolveManagedAuthDeepLinkRequest = z.infer<typeof ResolveManagedAuthDeepLinkRequest>;\n\nexport const ManagedAuthDeepLinkResolution = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"current\") }),\n  z.object({ kind: z.literal(\"switch_required\"), slot: ManagedAuthLoginSlot }),\n  z.object({ kind: z.literal(\"unavailable\") }),\n]);\nexport type ManagedAuthDeepLinkResolution = z.infer<typeof ManagedAuthDeepLinkResolution>;\n\nexport const ManagedAuthSessionSetErrorCode = z.enum([\n  \"actor_change_required\",\n  \"actor_mutation_in_flight\",\n  \"api_contract_changed\",\n  \"browser_session_set_required\",\n  \"browser_session_set_unavailable\",\n  \"generation_conflict\",\n  \"invalid_browser_session_set_request\",\n  \"invalid_transaction\",\n  \"managed_authentication_required\",\n  \"managed_authentication_unavailable\",\n  \"operation_outcome_unknown\",\n  \"operation_reused\",\n  \"origin_rejected\",\n  \"login_transaction_rate_limited\",\n  \"provider_route_blocked\",\n  \"slot_limit_reached\",\n  \"slot_already_exists\",\n  \"slot_unavailable\",\n]);\nexport type ManagedAuthSessionSetErrorCode = z.infer<typeof ManagedAuthSessionSetErrorCode>;\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,qCAAqC;AAC3C,IAAM,uCAAuC;AAC7C,IAAM,uCAAuC;AAC7C,IAAM,+CAA+C;AACrD,IAAM,iDACX;AAEK,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,QAAQ,QAAQ,CAAC;AAGrE,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,iBAAiB,CAAC;AAGtE,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,MAAM,EAAE,QAAQ,OAAO;AAAA,EACvB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AACnC,CAAC;AAIM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe;AAAA,EACf,OAAO;AACT,CAAC;AAGM,IAAM,6BAA6B,EAAE,KAAK,CAAC,SAAS,uBAAuB,CAAC;AAG5E,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM;AAAA,EACN,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,GAAG;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO;AAAA,EACP,OAAO,EAAE,MAAM,oBAAoB,EAAE,IAAI,kCAAkC;AAC7E,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,oBAAoB,EAAE,OAAO,EAAE,MAAM,eAAe;AACtD,CAAC;AAGM,IAAM,wCAAwC;AAK9C,IAAM,0BAA0B,EACpC,OAAO,EACP,IAAI,CAAC,EACL,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,aAAa,sCAAsC;AACrF,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,6CAA6C,CAAC;AAAA,EAC5F;AACA,MACE,CAAC,MAAM,WAAW,GAAG,KACrB,MAAM,WAAW,IAAI,KACrB,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,KAClB,0BAA0B,KAAK,KAAK,GACpC;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,OAAO,0BAA0B;AACxD,UAAM,OAAO;AACb,UAAM,gBAAgB,IAAI;AAAA,MACxB,iBAAiB,IAAI,eAAe,IAAI,mBAAmB,IAAI;AAAA,MAC/D;AAAA,IACF;AACA,QACE,OAAO,WAAW,8BAClB,OAAO,YACP,OAAO,YACP,OAAO,UACP,OAAO,QACP,CAAC,cAAc,KAAK,KAAK,KACzB,OAAO,aAAa,OACpB;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AACN,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAEI,IAAM,0CAA0C,6BAA6B,OAAO;AAAA,EACzF,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,cAAc,wBAAwB,SAAS;AACjD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,MAAK,MAAM,SAAS,aAAc,QAAQ,MAAM,MAAM,GAAG;AACvD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAKM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAG7D,IAAM,2CAA2C,6BAA6B,OAAO;AAAA,EAC1F,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,UAAU;AACZ,CAAC;AAKM,IAAM,4CAA4C,EAAE,OAAO;AAAA,EAChE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAK;AACjC,CAAC;AAKM,IAAM,qDACX,6BAA6B,OAAO;AAAA,EAClC,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACjC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK;AACvC,CAAC;AAKI,IAAM,8CAA8C,EAAE,OAAO;AAAA,EAClE,YAAY;AAAA,EACZ,cAAc,wBAAwB,SAAS;AACjD,CAAC;AAKM,IAAM,2CAA2C,6BAA6B,OAAO;AAAA,EAC1F,eAAe,EAAE,OAAO,EAAE,KAAK;AACjC,CAAC;AAKM,IAAM,oCAAoC,6BAA6B,OAAO;AAAA,EACnF,QAAQ,EAAE,OAAO,EAAE,KAAK;AAC1B,CAAC;AAGM,IAAM,oCAAoC,6BAA6B,OAAO;AAAA,EACnF,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAChD,CAAC;AAGM,IAAM,qCAAqC;AAG3C,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,OAAO,EAAE,QAAQ,YAAY;AAC/B,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,MAAM;AACR,CAAC;AAGM,IAAM,gCAAgC,EAAE,mBAAmB,QAAQ;AAAA,EACxE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;AAAA,EACvC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,iBAAiB,GAAG,MAAM,qBAAqB,CAAC;AAAA,EAC3E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,aAAa,EAAE,CAAC;AAC7C,CAAC;AAGM,IAAM,iCAAiC,EAAE,KAAK;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":[]}
+{"version":3,"sources":["../src/managed-auth-session-sets.ts"],"sourcesContent":["import { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nexport const MANAGED_AUTH_SESSION_SET_MAX_SLOTS = 8 as const;\nexport const MANAGED_AUTH_TRANSACTION_TTL_SECONDS = 600 as const;\nexport const MANAGED_AUTH_RETURN_INTENT_MAX_BYTES = 2_048 as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER = \"x-opengeni-api-contract\" as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION =\n  \"2026-08-personal-only-organization-setup-v1\" as const;\n\nexport const ManagedAuthSessionSetMode = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"legacy\", \"dual\", \"broker\"]),\n);\nexport type ManagedAuthSessionSetMode = z.infer<typeof ManagedAuthSessionSetMode>;\n\nexport const ManagedAuthLoginSlotState = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"active\", \"reauth_required\"]),\n);\nexport type ManagedAuthLoginSlotState = z.infer<typeof ManagedAuthLoginSlotState>;\n\nexport const ManagedAuthVerifiedClaim = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    kind: z.literal(\"email\"),\n    value: z.string().email().max(320),\n  }),\n);\nexport type ManagedAuthVerifiedClaim = z.infer<typeof ManagedAuthVerifiedClaim>;\n\n/** Secret-free, browser-safe summary. Provider session ids and tokens never enter this shape. */\nexport const ManagedAuthLoginSlot = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    id: z.string().uuid(),\n    displayName: z.string().min(1).max(256),\n    verifiedClaim: ManagedAuthVerifiedClaim,\n    state: ManagedAuthLoginSlotState,\n  }),\n);\nexport type ManagedAuthLoginSlot = z.infer<typeof ManagedAuthLoginSlot>;\n\nexport const ManagedAuthSessionSetState = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"ready\", \"actor_change_required\"]),\n);\nexport type ManagedAuthSessionSetState = z.infer<typeof ManagedAuthSessionSetState>;\n\nexport const ManagedAuthSessionSetProjection = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    mode: ManagedAuthSessionSetMode,\n    generation: z.string().regex(/^[1-9][0-9]*$/),\n    actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n    csrfToken: z.string().min(32).max(512),\n    selectedSlotId: z.string().uuid().nullable(),\n    state: ManagedAuthSessionSetState,\n    slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS),\n  }),\n);\nexport type ManagedAuthSessionSetProjection = z.infer<typeof ManagedAuthSessionSetProjection>;\n\nexport const ManagedAuthOperationIdentity = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    operationId: z.string().uuid(),\n    expectedGeneration: z.string().regex(/^[1-9][0-9]*$/),\n  }),\n);\nexport type ManagedAuthOperationIdentity = z.infer<typeof ManagedAuthOperationIdentity>;\n\nexport const BootstrapManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type BootstrapManagedAuthSessionSetRequest = z.infer<\n  typeof BootstrapManagedAuthSessionSetRequest\n>;\n\nexport const ManagedAuthReturnIntent = /* @__PURE__ */ defineSchema(() =>\n  z\n    .string()\n    .min(1)\n    .superRefine((value, context) => {\n      if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {\n        context.addIssue({ code: \"custom\", message: \"return intent exceeds its UTF-8 byte limit\" });\n      }\n      if (\n        !value.startsWith(\"/\") ||\n        value.startsWith(\"//\") ||\n        value.includes(\"?\") ||\n        value.includes(\"#\") ||\n        /[\\u0000-\\u001f\\u007f\\\\]/.test(value)\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"return intent must be a safe same-origin path\",\n        });\n        return;\n      }\n      try {\n        const parsed = new URL(value, \"https://opengeni.invalid\");\n        const uuid = \"[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\";\n        const supportedPath = new RegExp(\n          `^/(?:sessions/${uuid}|workspaces/${uuid}(?:/sessions(?:/${uuid})?)?)$`,\n          \"i\",\n        );\n        if (\n          parsed.origin !== \"https://opengeni.invalid\" ||\n          parsed.username ||\n          parsed.password ||\n          parsed.search ||\n          parsed.hash ||\n          !supportedPath.test(value) ||\n          parsed.pathname !== value\n        ) {\n          context.addIssue({\n            code: \"custom\",\n            message: \"return intent contains unsafe authority data\",\n          });\n        }\n      } catch {\n        context.addIssue({\n          code: \"custom\",\n          message: \"return intent is not a valid same-origin path\",\n        });\n      }\n    }),\n);\n\nexport const BeginManagedAuthLoginTransactionRequest = /* @__PURE__ */ defineSchema(() =>\n  ManagedAuthOperationIdentity.extend({\n    kind: z.enum([\"add\", \"reauth\"]),\n    slotId: z.string().uuid().optional(),\n    returnIntent: ManagedAuthReturnIntent.optional(),\n  }).superRefine((value, context) => {\n    if ((value.kind === \"reauth\") !== Boolean(value.slotId)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"slotId\"],\n        message: \"reauth requires exactly one slot id and add forbids one\",\n      });\n    }\n  }),\n);\nexport type BeginManagedAuthLoginTransactionRequest = z.infer<\n  typeof BeginManagedAuthLoginTransactionRequest\n>;\n\nexport const ManagedAuthLoginTransaction = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    id: z.string().uuid(),\n    kind: z.enum([\"add\", \"reauth\"]),\n    expiresAt: z.string().datetime(),\n    returnIntentId: z.string().uuid().nullable(),\n  }),\n);\nexport type ManagedAuthLoginTransaction = z.infer<typeof ManagedAuthLoginTransaction>;\n\nexport const ManagedAuthSocialProvider = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"google\", \"github\"]),\n);\nexport type ManagedAuthSocialProvider = z.infer<typeof ManagedAuthSocialProvider>;\n\n/**\n * Mirrors `SignupAttribution` from `./signup-attribution` (a contract test pins\n * them together). Declared here, not imported, so the browser session-set\n * client does not pull the attribution module into a new shared web chunk.\n */\nconst SocialStartAttributionValue = /* @__PURE__ */ defineSchema(() =>\n  z\n    .string()\n    .trim()\n    .min(1)\n    .max(100)\n    .regex(/^[A-Za-z0-9._~+-]+$/),\n);\nconst SocialStartAttribution = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      utmSource: SocialStartAttributionValue.optional(),\n      utmMedium: SocialStartAttributionValue.optional(),\n      utmCampaign: SocialStartAttributionValue.optional(),\n      utmContent: SocialStartAttributionValue.optional(),\n      ref: SocialStartAttributionValue.optional(),\n    })\n    .strict(),\n);\n\nexport const StartManagedAuthSocialTransactionRequest = /* @__PURE__ */ defineSchema(() =>\n  ManagedAuthOperationIdentity.extend({\n    transactionId: z.string().uuid(),\n    provider: ManagedAuthSocialProvider,\n    /**\n     * Optional untrusted first-touch campaign tokens, used only by the\n     * content-free sign-up acquisition counter when this start creates a new\n     * account. Invalid attribution is dropped rather than failing the sign-in.\n     */\n    attribution: SocialStartAttribution.optional().catch(undefined),\n  }),\n);\nexport type StartManagedAuthSocialTransactionRequest = z.infer<\n  typeof StartManagedAuthSocialTransactionRequest\n>;\n\nexport const StartManagedAuthSocialTransactionResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    url: z.string().url().max(4_096),\n  }),\n);\nexport type StartManagedAuthSocialTransactionResponse = z.infer<\n  typeof StartManagedAuthSocialTransactionResponse\n>;\n\nexport const CompleteManagedAuthEmailPasswordTransactionRequest =\n  /* @__PURE__ */ defineSchema(() =>\n    ManagedAuthOperationIdentity.extend({\n      transactionId: z.string().uuid(),\n      email: z.string().email().max(320),\n      password: z.string().min(1).max(1_024),\n    }),\n  );\nexport type CompleteManagedAuthEmailPasswordTransactionRequest = z.infer<\n  typeof CompleteManagedAuthEmailPasswordTransactionRequest\n>;\n\nexport const CompleteManagedAuthLoginTransactionResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    projection: ManagedAuthSessionSetProjection,\n    returnIntent: ManagedAuthReturnIntent.nullable(),\n  }),\n);\nexport type CompleteManagedAuthLoginTransactionResponse = z.infer<\n  typeof CompleteManagedAuthLoginTransactionResponse\n>;\n\nexport const CancelManagedAuthLoginTransactionRequest = /* @__PURE__ */ defineSchema(() =>\n  ManagedAuthOperationIdentity.extend({\n    transactionId: z.string().uuid(),\n  }),\n);\nexport type CancelManagedAuthLoginTransactionRequest = z.infer<\n  typeof CancelManagedAuthLoginTransactionRequest\n>;\n\nexport const SelectManagedAuthLoginSlotRequest = /* @__PURE__ */ defineSchema(() =>\n  ManagedAuthOperationIdentity.extend({\n    slotId: z.string().uuid(),\n  }),\n);\nexport type SelectManagedAuthLoginSlotRequest = z.infer<typeof SelectManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthLoginSlotRequest = /* @__PURE__ */ defineSchema(() =>\n  ManagedAuthOperationIdentity.extend({\n    slotId: z.string().uuid(),\n    replacementSlotId: z.string().uuid().nullable(),\n  }),\n);\nexport type LogoutManagedAuthLoginSlotRequest = z.infer<typeof LogoutManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type LogoutManagedAuthSessionSetRequest = z.infer<typeof LogoutManagedAuthSessionSetRequest>;\n\nexport const ManagedAuthLogoutAllReceipt = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    generation: z.string().regex(/^[1-9][0-9]*$/),\n    actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n    state: z.literal(\"logged_out\"),\n  }),\n);\nexport type ManagedAuthLogoutAllReceipt = z.infer<typeof ManagedAuthLogoutAllReceipt>;\n\nexport const ResolveManagedAuthDeepLinkRequest = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    path: ManagedAuthReturnIntent,\n  }),\n);\nexport type ResolveManagedAuthDeepLinkRequest = z.infer<typeof ResolveManagedAuthDeepLinkRequest>;\n\nexport const ManagedAuthDeepLinkResolution = /* @__PURE__ */ defineSchema(() =>\n  z.discriminatedUnion(\"kind\", [\n    z.object({ kind: z.literal(\"current\") }),\n    z.object({ kind: z.literal(\"switch_required\"), slot: ManagedAuthLoginSlot }),\n    z.object({ kind: z.literal(\"unavailable\") }),\n  ]),\n);\nexport type ManagedAuthDeepLinkResolution = z.infer<typeof ManagedAuthDeepLinkResolution>;\n\nexport const ManagedAuthSessionSetErrorCode = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\n    \"actor_change_required\",\n    \"actor_mutation_in_flight\",\n    \"api_contract_changed\",\n    \"browser_session_set_required\",\n    \"browser_session_set_unavailable\",\n    \"generation_conflict\",\n    \"invalid_browser_session_set_request\",\n    \"invalid_transaction\",\n    \"managed_authentication_required\",\n    \"managed_authentication_unavailable\",\n    \"operation_outcome_unknown\",\n    \"operation_reused\",\n    \"origin_rejected\",\n    \"login_transaction_rate_limited\",\n    \"provider_route_blocked\",\n    \"slot_limit_reached\",\n    \"slot_already_exists\",\n    \"slot_unavailable\",\n  ]),\n);\nexport type ManagedAuthSessionSetErrorCode = z.infer<typeof ManagedAuthSessionSetErrorCode>;\n"],"mappings":";;;;;AACA,SAAS,SAAS;AAEX,IAAM,qCAAqC;AAC3C,IAAM,uCAAuC;AAC7C,IAAM,uCAAuC;AAC7C,IAAM,+CAA+C;AACrD,IAAM,iDACX;AAEK,IAAM,4BAA4C;AAAA,EAAa,MACpE,EAAE,KAAK,CAAC,UAAU,QAAQ,QAAQ,CAAC;AACrC;AAGO,IAAM,4BAA4C;AAAA,EAAa,MACpE,EAAE,KAAK,CAAC,UAAU,iBAAiB,CAAC;AACtC;AAGO,IAAM,2BAA2C;AAAA,EAAa,MACnE,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,OAAO;AAAA,IACvB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACnC,CAAC;AACH;AAIO,IAAM,uBAAuC;AAAA,EAAa,MAC/D,EAAE,OAAO;AAAA,IACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACtC,eAAe;AAAA,IACf,OAAO;AAAA,EACT,CAAC;AACH;AAGO,IAAM,6BAA6C;AAAA,EAAa,MACrE,EAAE,KAAK,CAAC,SAAS,uBAAuB,CAAC;AAC3C;AAGO,IAAM,kCAAkD;AAAA,EAAa,MAC1E,EAAE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,IAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,IAC5C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,GAAG;AAAA,IACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IAC3C,OAAO;AAAA,IACP,OAAO,EAAE,MAAM,oBAAoB,EAAE,IAAI,kCAAkC;AAAA,EAC7E,CAAC;AACH;AAGO,IAAM,+BAA+C;AAAA,EAAa,MACvE,EAAE,OAAO;AAAA,IACP,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,IAC7B,oBAAoB,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EACtD,CAAC;AACH;AAGO,IAAM,wCAAwC;AAK9C,IAAM,0BAA0C;AAAA,EAAa,MAClE,EACG,OAAO,EACP,IAAI,CAAC,EACL,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAI,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,aAAa,sCAAsC;AACrF,cAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,6CAA6C,CAAC;AAAA,IAC5F;AACA,QACE,CAAC,MAAM,WAAW,GAAG,KACrB,MAAM,WAAW,IAAI,KACrB,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,KAClB,0BAA0B,KAAK,KAAK,GACpC;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AACD;AAAA,IACF;AACA,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,OAAO,0BAA0B;AACxD,YAAM,OAAO;AACb,YAAM,gBAAgB,IAAI;AAAA,QACxB,iBAAiB,IAAI,eAAe,IAAI,mBAAmB,IAAI;AAAA,QAC/D;AAAA,MACF;AACA,UACE,OAAO,WAAW,8BAClB,OAAO,YACP,OAAO,YACP,OAAO,UACP,OAAO,QACP,CAAC,cAAc,KAAK,KAAK,KACzB,OAAO,aAAa,OACpB;AACA,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF,QAAQ;AACN,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACL;AAEO,IAAM,0CAA0D;AAAA,EAAa,MAClF,6BAA6B,OAAO;AAAA,IAClC,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,IAC9B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IACnC,cAAc,wBAAwB,SAAS;AAAA,EACjD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,QAAK,MAAM,SAAS,aAAc,QAAQ,MAAM,MAAM,GAAG;AACvD,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,QAAQ;AAAA,QACf,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAKO,IAAM,8BAA8C;AAAA,EAAa,MACtE,EAAE,OAAO;AAAA,IACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,IAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AACH;AAGO,IAAM,4BAA4C;AAAA,EAAa,MACpE,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAC7B;AAQA,IAAM,8BAA8C;AAAA,EAAa,MAC/D,EACG,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,qBAAqB;AAChC;AACA,IAAM,yBAAyC;AAAA,EAAa,MAC1D,EACG,OAAO;AAAA,IACN,WAAW,4BAA4B,SAAS;AAAA,IAChD,WAAW,4BAA4B,SAAS;AAAA,IAChD,aAAa,4BAA4B,SAAS;AAAA,IAClD,YAAY,4BAA4B,SAAS;AAAA,IACjD,KAAK,4BAA4B,SAAS;AAAA,EAC5C,CAAC,EACA,OAAO;AACZ;AAEO,IAAM,2CAA2D;AAAA,EAAa,MACnF,6BAA6B,OAAO;AAAA,IAClC,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,IAC/B,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMV,aAAa,uBAAuB,SAAS,EAAE,MAAM,MAAS;AAAA,EAChE,CAAC;AACH;AAKO,IAAM,4CAA4D;AAAA,EAAa,MACpF,EAAE,OAAO;AAAA,IACP,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAK;AAAA,EACjC,CAAC;AACH;AAKO,IAAM,qDACK;AAAA,EAAa,MAC3B,6BAA6B,OAAO;AAAA,IAClC,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,IAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,IACjC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK;AAAA,EACvC,CAAC;AACH;AAKK,IAAM,8CAA8D;AAAA,EAAa,MACtF,EAAE,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc,wBAAwB,SAAS;AAAA,EACjD,CAAC;AACH;AAKO,IAAM,2CAA2D;AAAA,EAAa,MACnF,6BAA6B,OAAO;AAAA,IAClC,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,CAAC;AACH;AAKO,IAAM,oCAAoD;AAAA,EAAa,MAC5E,6BAA6B,OAAO;AAAA,IAClC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,CAAC;AACH;AAGO,IAAM,oCAAoD;AAAA,EAAa,MAC5E,6BAA6B,OAAO;AAAA,IAClC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAChD,CAAC;AACH;AAGO,IAAM,qCAAqC;AAG3C,IAAM,8BAA8C;AAAA,EAAa,MACtE,EAAE,OAAO;AAAA,IACP,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,IAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,IAC5C,OAAO,EAAE,QAAQ,YAAY;AAAA,EAC/B,CAAC;AACH;AAGO,IAAM,oCAAoD;AAAA,EAAa,MAC5E,EAAE,OAAO;AAAA,IACP,MAAM;AAAA,EACR,CAAC;AACH;AAGO,IAAM,gCAAgD;AAAA,EAAa,MACxE,EAAE,mBAAmB,QAAQ;AAAA,IAC3B,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;AAAA,IACvC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,iBAAiB,GAAG,MAAM,qBAAqB,CAAC;AAAA,IAC3E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,aAAa,EAAE,CAAC;AAAA,EAC7C,CAAC;AACH;AAGO,IAAM,iCAAiD;AAAA,EAAa,MACzE,EAAE,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;","names":[]}

package/dist/managed-sign-in-methods.d.ts

@@ -0,0 +1,56 @@
+import { z } from "zod";
+export declare const ManagedSignInProvider: z.ZodEnum<{
+    github: "github";
+    google: "google";
+}>;
+export declare const ManagedSignInMethods: z.ZodObject<{
+    identityId: z.ZodString;
+    email: z.ZodString;
+    emailVerified: z.ZodBoolean;
+    identityRevision: z.ZodNumber;
+    freshAuthenticationRequired: z.ZodBoolean;
+    methods: z.ZodArray<z.ZodObject<{
+        provider: z.ZodEnum<{
+            credential: "credential";
+            github: "github";
+            google: "google";
+        }>;
+        connected: z.ZodBoolean;
+        available: z.ZodBoolean;
+        canDisconnect: z.ZodBoolean;
+        implicitRelinkingSuppressed: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ManagedSignInMethods = z.infer<typeof ManagedSignInMethods>;
+export declare const ManagedSignInMutation: z.ZodObject<{
+    expectedIdentityId: z.ZodString;
+    operationId: z.ZodString;
+    expectedIdentityRevision: z.ZodNumber;
+}, z.core.$strip>;
+export declare const ManagedSignInProviderMutation: z.ZodObject<{
+    expectedIdentityId: z.ZodString;
+    operationId: z.ZodString;
+    expectedIdentityRevision: z.ZodNumber;
+    provider: z.ZodEnum<{
+        github: "github";
+        google: "google";
+    }>;
+}, z.core.$strict>;
+export declare const ManagedSignInPasswordMutation: z.ZodObject<{
+    expectedIdentityId: z.ZodString;
+    operationId: z.ZodString;
+    expectedIdentityRevision: z.ZodNumber;
+    newPassword: z.ZodString;
+    currentPassword: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const ManagedSignInMutationResponse: z.ZodObject<{
+    reauthenticationRequired: z.ZodLiteral<true>;
+    notification: z.ZodEnum<{
+        failed: "failed";
+        outcome_unknown: "outcome_unknown";
+        sent: "sent";
+    }>;
+}, z.core.$strip>;
+export declare const ManagedSignInConnectResponse: z.ZodObject<{
+    url: z.ZodString;
+}, z.core.$strip>;

package/dist/managed-sign-in-methods.js

@@ -0,0 +1,64 @@
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
+// src/managed-sign-in-methods.ts
+import { z } from "zod";
+var ManagedSignInProvider = /* @__PURE__ */ defineSchema(
+  () => z.enum(["google", "github"])
+);
+var ManagedSignInMethods = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    identityId: z.string().uuid(),
+    email: z.string().email(),
+    emailVerified: z.boolean(),
+    identityRevision: z.number().int().positive(),
+    freshAuthenticationRequired: z.boolean(),
+    methods: z.array(
+      z.object({
+        provider: z.enum(["credential", "google", "github"]),
+        connected: z.boolean(),
+        available: z.boolean(),
+        canDisconnect: z.boolean(),
+        implicitRelinkingSuppressed: z.boolean()
+      })
+    )
+  })
+);
+var ManagedSignInMutation = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    expectedIdentityId: z.string().uuid(),
+    operationId: z.string().uuid(),
+    expectedIdentityRevision: z.number().int().positive()
+  })
+);
+var ManagedSignInProviderMutation = /* @__PURE__ */ defineSchema(
+  () => ManagedSignInMutation.extend({
+    provider: ManagedSignInProvider
+  }).strict()
+);
+var ManagedSignInPasswordMutation = /* @__PURE__ */ defineSchema(
+  () => ManagedSignInMutation.extend({
+    newPassword: z.string().min(8).max(128),
+    currentPassword: z.string().min(1).max(1024).optional()
+  }).strict()
+);
+var ManagedSignInMutationResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    reauthenticationRequired: z.literal(true),
+    notification: z.enum(["sent", "failed", "outcome_unknown"])
+  })
+);
+var ManagedSignInConnectResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({ url: z.string().url() })
+);
+export {
+  ManagedSignInConnectResponse,
+  ManagedSignInMethods,
+  ManagedSignInMutation,
+  ManagedSignInMutationResponse,
+  ManagedSignInPasswordMutation,
+  ManagedSignInProvider,
+  ManagedSignInProviderMutation
+};
+//# sourceMappingURL=managed-sign-in-methods.js.map

package/dist/managed-sign-in-methods.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/managed-sign-in-methods.ts"],"sourcesContent":["import { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nexport const ManagedSignInProvider = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"google\", \"github\"]),\n);\nexport const ManagedSignInMethods = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    identityId: z.string().uuid(),\n    email: z.string().email(),\n    emailVerified: z.boolean(),\n    identityRevision: z.number().int().positive(),\n    freshAuthenticationRequired: z.boolean(),\n    methods: z.array(\n      z.object({\n        provider: z.enum([\"credential\", \"google\", \"github\"]),\n        connected: z.boolean(),\n        available: z.boolean(),\n        canDisconnect: z.boolean(),\n        implicitRelinkingSuppressed: z.boolean(),\n      }),\n    ),\n  }),\n);\nexport type ManagedSignInMethods = z.infer<typeof ManagedSignInMethods>;\nexport const ManagedSignInMutation = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    expectedIdentityId: z.string().uuid(),\n    operationId: z.string().uuid(),\n    expectedIdentityRevision: z.number().int().positive(),\n  }),\n);\nexport const ManagedSignInProviderMutation = /* @__PURE__ */ defineSchema(() =>\n  ManagedSignInMutation.extend({\n    provider: ManagedSignInProvider,\n  }).strict(),\n);\nexport const ManagedSignInPasswordMutation = /* @__PURE__ */ defineSchema(() =>\n  ManagedSignInMutation.extend({\n    newPassword: z.string().min(8).max(128),\n    currentPassword: z.string().min(1).max(1024).optional(),\n  }).strict(),\n);\nexport const ManagedSignInMutationResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    reauthenticationRequired: z.literal(true),\n    notification: z.enum([\"sent\", \"failed\", \"outcome_unknown\"]),\n  }),\n);\nexport const ManagedSignInConnectResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({ url: z.string().url() }),\n);\n"],"mappings":";;;;;AACA,SAAS,SAAS;AAEX,IAAM,wBAAwC;AAAA,EAAa,MAChE,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAC7B;AACO,IAAM,uBAAuC;AAAA,EAAa,MAC/D,EAAE,OAAO;AAAA,IACP,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,IAC5B,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,IACxB,eAAe,EAAE,QAAQ;AAAA,IACzB,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC5C,6BAA6B,EAAE,QAAQ;AAAA,IACvC,SAAS,EAAE;AAAA,MACT,EAAE,OAAO;AAAA,QACP,UAAU,EAAE,KAAK,CAAC,cAAc,UAAU,QAAQ,CAAC;AAAA,QACnD,WAAW,EAAE,QAAQ;AAAA,QACrB,WAAW,EAAE,QAAQ;AAAA,QACrB,eAAe,EAAE,QAAQ;AAAA,QACzB,6BAA6B,EAAE,QAAQ;AAAA,MACzC,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,IAAM,wBAAwC;AAAA,EAAa,MAChE,EAAE,OAAO;AAAA,IACP,oBAAoB,EAAE,OAAO,EAAE,KAAK;AAAA,IACpC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,IAC7B,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtD,CAAC;AACH;AACO,IAAM,gCAAgD;AAAA,EAAa,MACxE,sBAAsB,OAAO;AAAA,IAC3B,UAAU;AAAA,EACZ,CAAC,EAAE,OAAO;AACZ;AACO,IAAM,gCAAgD;AAAA,EAAa,MACxE,sBAAsB,OAAO;AAAA,IAC3B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACtC,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACxD,CAAC,EAAE,OAAO;AACZ;AACO,IAAM,gCAAgD;AAAA,EAAa,MACxE,EAAE,OAAO;AAAA,IACP,0BAA0B,EAAE,QAAQ,IAAI;AAAA,IACxC,cAAc,EAAE,KAAK,CAAC,QAAQ,UAAU,iBAAiB,CAAC;AAAA,EAC5D,CAAC;AACH;AACO,IAAM,+BAA+C;AAAA,EAAa,MACvE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACpC;","names":[]}

package/dist/mcp-catalog-limits.d.ts

@@ -0,0 +1,2 @@
+/** Shared discovery and explicit permission-selection count allowance. */
+export declare const MCP_MAX_CATALOG_TOOL_ENTRIES = 4096;

package/dist/mcp-oauth.d.ts

@@ -18,7 +18,7 @@ export declare const McpOAuthClientRegistrationRequest: z.ZodObject<{
         refresh_token: "refresh_token";
     }>>>;
     response_types: z.ZodDefault<z.ZodArray<z.ZodLiteral<"code">>>;
-}, z.core.$strict>;
+}, z.core.$strip>;
 export type McpOAuthClientRegistrationRequest = z.infer<typeof McpOAuthClientRegistrationRequest>;
 export declare const McpOAuthClientRegistrationResponse: z.ZodObject<{
     redirect_uris: z.ZodArray<z.ZodString>;
@@ -36,7 +36,7 @@ export declare const McpOAuthClientRegistrationResponse: z.ZodObject<{
     response_types: z.ZodDefault<z.ZodArray<z.ZodLiteral<"code">>>;
     client_id: z.ZodString;
     client_id_issued_at: z.ZodNumber;
-}, z.core.$strict>;
+}, z.core.$strip>;
 export type McpOAuthClientRegistrationResponse = z.infer<typeof McpOAuthClientRegistrationResponse>;
 export declare const McpOAuthTokenResponse: z.ZodObject<{
     access_token: z.ZodString;

package/dist/mcp-structured-content.d.ts

@@ -0,0 +1,25 @@
+import type { AttemptToolResult } from "./tool-catalog.js";
+/**
+ * Remove the backwards-compatibility text copy of an MCP result's
+ * `structuredContent`.
+ *
+ * The MCP specification asks a server that returns `structuredContent` to also
+ * return the same value serialized in a text content block. Printing or sending
+ * both pays for the payload twice, and the text copy pays again for JSON string
+ * escaping inside the result envelope.
+ *
+ * The envelope (`content`, `structuredContent`, `_meta`, `isError`, extension
+ * fields) and its key order are kept. Only a plain `{type: "text", text}` block
+ * whose text parses as JSON to a value equal to `structuredContent` is removed.
+ * Prose, differing JSON, annotated text, images, resources, and every other
+ * block stay. A text block whose JSON carries an integer outside the IEEE-754
+ * safe range also stays, because its digits may be more precise than the
+ * parsed `structuredContent`. Numbers compare by IEEE-754 value.
+ *
+ * Results without a removable block are returned as the same object.
+ *
+ * Callers: the runtime's model-facing MCP projection, and the default
+ * `ogtool call` print. The native Connected Machine client implements the
+ * same rule in `agent/crates/opengeni-agent/src/codemode.rs`; keep them equal.
+ */
+export declare function omitStructuredContentTextDuplicates<T extends AttemptToolResult>(result: T): T;