@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/client-error-report.js

@@ -6,17 +6,172 @@ var CLIENT_ERROR_KINDS = [
   "window_error",
   "chunk_load"
 ];
-var CLIENT_ERROR_REPORT_MAX_BYTES = 512;
+var CLIENT_ERROR_DETAIL_MAX_BYTES = {
+  name: 128,
+  message: 1024,
+  stack: 4096,
+  componentStack: 4096
+};
+var CLIENT_ERROR_DETAIL_FIELDS = Object.keys(
+  CLIENT_ERROR_DETAIL_MAX_BYTES
+);
+var CLIENT_ERROR_REPORT_MAX_BYTES = 20 * 1024;
 var ROUTE_SEGMENT = String.raw`(?:[a-z]+(?:-[a-z]+)*|\$[A-Za-z][A-Za-z0-9]{0,31})`;
 var CLIENT_ERROR_ROUTE_PATTERN = new RegExp(
   String.raw`^(?=.{1,160}$)(?:unknown|/|(?:/${ROUTE_SEGMENT}){1,12})$`
 );
 var CLIENT_ERROR_REVISION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;
+var REDACTED = "[redacted]";
+var TRUNCATED = "\u2026[truncated]";
+var ERROR_DECODER_URL = /^https?:\/\/(?:react\.dev\/errors\/|reactjs\.org\/docs\/error-decoder)/i;
+var LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/g;
+var CONTROL_CHARACTERS = /[\u0000-\u0008\u000B-\u001F\u007F]/g;
+var URL_WITH_QUERY = /\bhttps?:\/\/[^\s?#"'<>()`]*[?#][^\s"'<>()`]*/gi;
+var LINE_AND_COLUMN_SUFFIX = /(?::\d+){1,2}$/;
+var AUTHORIZATION_VALUE = /\b(Bearer|Basic|Token)\s+(?=[A-Za-z._~+/=-]*[0-9])[A-Za-z0-9._~+/=-]{8,}/gi;
+var JWT = /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}(?:\.[A-Za-z0-9_-]*)?/g;
+var KNOWN_TOKEN = /\b(?:sk-(?:proj-|ant-)?|sk_(?:live|test)_|rk_(?:live|test)_|gh[pousr]_|github_pat_|glpat-|npm_|xox[abposr]-|ops_|AKIA|ASIA|AIza)[A-Za-z0-9_-]{12,}/g;
+var SECRET_ASSIGNMENT = /\b((?:access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|token|client[_-]?secret|secret|password|passwd|api[_-]?key|apikey|authorization|cookie|private[_-]?key)["']?\s*[:=]\s*["']?)[^\s"'&,;}[…][^\s"'&,;}]*/gi;
+var OPAQUE_RUN = /[A-Za-z0-9+=_-]{32,}/g;
+function isOpaqueCredential(run) {
+  return /[0-9]/.test(run) && /[A-Za-z]/.test(run) && run.split(/[-_]/).some((stretch) => stretch.length >= 24);
+}
+function scrubClientErrorText(text) {
+  return text.replace(LONE_SURROGATE, "\uFFFD").replace(/\r\n?/g, "\n").replace(CONTROL_CHARACTERS, " ").replace(URL_WITH_QUERY, (url) => {
+    if (ERROR_DECODER_URL.test(url)) return url;
+    const cut = url.search(/[?#]/);
+    const suffix = url.slice(cut).match(LINE_AND_COLUMN_SUFFIX)?.[0] ?? "";
+    return url.slice(0, cut) + suffix;
+  }).replace(AUTHORIZATION_VALUE, `$1 ${REDACTED}`).replace(JWT, REDACTED).replace(KNOWN_TOKEN, REDACTED).replace(SECRET_ASSIGNMENT, `$1${REDACTED}`).replace(OPAQUE_RUN, (run) => isOpaqueCredential(run) ? REDACTED : run);
+}
+function utf8ByteLength(text) {
+  return new TextEncoder().encode(text).byteLength;
+}
+function boundClientErrorText(text, maxBytes) {
+  if (utf8ByteLength(text) <= maxBytes) return text;
+  const budget = maxBytes - utf8ByteLength(TRUNCATED);
+  let bytes = 0;
+  let end = 0;
+  for (const character of text) {
+    const size = utf8ByteLength(character);
+    if (bytes + size > budget) break;
+    bytes += size;
+    end += character.length;
+  }
+  return text.slice(0, end) + TRUNCATED;
+}
+function isProjectedClientErrorText(text, field) {
+  return text.length > 0 && utf8ByteLength(text) <= CLIENT_ERROR_DETAIL_MAX_BYTES[field] && scrubClientErrorText(text) === text;
+}
+function projectClientErrorDetail(raw) {
+  if (!raw) return void 0;
+  const detail = {};
+  for (const field of CLIENT_ERROR_DETAIL_FIELDS) {
+    const value = raw[field];
+    if (typeof value !== "string") continue;
+    const projected = boundClientErrorText(
+      scrubClientErrorText(value).trim(),
+      CLIENT_ERROR_DETAIL_MAX_BYTES[field]
+    );
+    if (projected) detail[field] = projected;
+  }
+  return Object.keys(detail).length > 0 ? detail : void 0;
+}
+var CLIENT_SIGNALS = [
+  "request_failure",
+  "stream",
+  "web_vital",
+  "desktop_bridge_missing"
+];
+var CLIENT_REQUEST_ACTIONS = [
+  "create_session",
+  "send_message",
+  "steer_message",
+  "composer_submit",
+  "retry_turn",
+  "connect_integration",
+  "connect_model",
+  "checkout_start"
+];
+var CLIENT_REQUEST_FAILURE_REASONS = ["network", "timeout", "offline"];
+var CLIENT_STREAMS = ["session", "workspace"];
+var CLIENT_STREAM_EVENTS = [
+  "reconnect",
+  "reconnect_exhausted",
+  "long_disconnect"
+];
+var CLIENT_WEB_VITAL_METRICS = ["lcp", "inp", "cls", "ttfb"];
+var CLIENT_WEB_VITAL_MAX_VALUE = {
+  lcp: 600,
+  inp: 600,
+  cls: 100,
+  ttfb: 600
+};
+var CLIENT_PAGES = [
+  "sessions",
+  "priority",
+  "plugins",
+  "capabilities",
+  "documents",
+  "state",
+  "memory",
+  "schedules",
+  "automations",
+  "bot-templates",
+  "artifacts",
+  "settings",
+  "organization",
+  "insights",
+  "machines",
+  "computer-use",
+  "files",
+  "agents",
+  "secrets",
+  "rigs",
+  "playground",
+  "read-only-chats",
+  "inbox",
+  "sites",
+  "meetings",
+  "home",
+  "session-link",
+  "identity-link",
+  "checkout-return",
+  "integration-return",
+  "teams-connect",
+  "device",
+  "connect-agent",
+  "native-sign-in",
+  "reset-password",
+  "setup-account",
+  "account-auth",
+  "site-auth",
+  "personal-security",
+  "other"
+];
+var CLIENT_DESKTOP_PLATFORMS = ["macos", "windows", "linux"];
+var CLIENT_DESKTOP_APP_VERSION_PATTERN = /^\d{1,4}\.\d{1,4}\.\d{1,6}(?:-[0-9A-Za-z.]{1,24})?$/;
 export {
+  CLIENT_DESKTOP_APP_VERSION_PATTERN,
+  CLIENT_DESKTOP_PLATFORMS,
   CLIENT_ERRORS_PATH,
+  CLIENT_ERROR_DETAIL_FIELDS,
+  CLIENT_ERROR_DETAIL_MAX_BYTES,
   CLIENT_ERROR_KINDS,
   CLIENT_ERROR_REPORT_MAX_BYTES,
   CLIENT_ERROR_REVISION_PATTERN,
-  CLIENT_ERROR_ROUTE_PATTERN
+  CLIENT_ERROR_ROUTE_PATTERN,
+  CLIENT_PAGES,
+  CLIENT_REQUEST_ACTIONS,
+  CLIENT_REQUEST_FAILURE_REASONS,
+  CLIENT_SIGNALS,
+  CLIENT_STREAMS,
+  CLIENT_STREAM_EVENTS,
+  CLIENT_WEB_VITAL_MAX_VALUE,
+  CLIENT_WEB_VITAL_METRICS,
+  boundClientErrorText,
+  isProjectedClientErrorText,
+  projectClientErrorDetail,
+  scrubClientErrorText
 };
 //# sourceMappingURL=client-error-report.js.map

package/dist/client-error-report.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/client-error-report.ts"],"sourcesContent":["/**\n * Wire grammar of the content-free web client error beacon\n * (`POST /v1/client-errors`).\n *\n * A report is only a closed error kind, the matched route PATTERN (never a\n * concrete URL), and the bundle revision. The web client that projects a\n * report, the API route that admits it, and the public structured-log\n * projection that prints it all validate against these exact values, so the\n * browser can only send what the API accepts and logs.\n */\nexport const CLIENT_ERRORS_PATH = \"/v1/client-errors\";\n\nexport const CLIENT_ERROR_KINDS = [\n  \"route_error\",\n  \"unhandled_rejection\",\n  \"window_error\",\n  \"chunk_load\",\n] as const;\nexport type ClientErrorKind = (typeof CLIENT_ERROR_KINDS)[number];\n\n/** Largest accepted report body. A valid report is well under 256 bytes. */\nexport const CLIENT_ERROR_REPORT_MAX_BYTES = 512;\n\nconst ROUTE_SEGMENT = String.raw`(?:[a-z]+(?:-[a-z]+)*|\\$[A-Za-z][A-Za-z0-9]{0,31})`;\n\n/**\n * A route pattern of at most 160 characters that is `/`, `unknown`, or up to\n * twelve `/`-separated segments that are each either a lowercase literal\n * (`variable-sets`) or a `$param` placeholder. The grammar excludes digits in\n * literals, so a concrete id cannot pass as one.\n */\nexport const CLIENT_ERROR_ROUTE_PATTERN = new RegExp(\n  String.raw`^(?=.{1,160}$)(?:unknown|/|(?:/${ROUTE_SEGMENT}){1,12})$`,\n);\n\n/** The bundle revision token (a commit SHA, `dev`, or `unknown`). */\nexport const CLIENT_ERROR_REVISION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;\n\nexport type ClientErrorReport = { kind: ClientErrorKind; route: string; revision: string };\n"],"mappings":";AAUO,IAAM,qBAAqB;AAE3B,IAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIO,IAAM,gCAAgC;AAE7C,IAAM,gBAAgB,OAAO;AAQtB,IAAM,6BAA6B,IAAI;AAAA,EAC5C,OAAO,qCAAqC,aAAa;AAC3D;AAGO,IAAM,gCAAgC;","names":[]}
+{"version":3,"sources":["../src/client-error-report.ts"],"sourcesContent":["/**\n * Wire grammar of the web client error beacon (`POST /v1/client-errors`).\n *\n * A report is a closed error kind, the matched route PATTERN (never a concrete\n * URL), the bundle revision, and optional error diagnostics: the error's name,\n * message and stack, plus React's component stack for a render failure. The\n * diagnostics are error text, not analytics. They can occasionally contain a\n * fragment of user content (an error message that quotes a value), so they are\n * scrubbed of obvious credentials and query strings by\n * {@link scrubClientErrorText} and bounded per field by\n * {@link CLIENT_ERROR_DETAIL_MAX_BYTES} in the browser, and the API re-applies\n * the same projection to whatever it receives. The web client that projects a\n * report, the API route that admits it, and the public structured-log\n * projection that prints it all validate against these exact rules, so the\n * browser can only send what the API accepts and logs.\n *\n * The same route also admits the closed operational signals below (requests\n * that never reached the server, live-stream health, and web vitals). They\n * follow the same rules: closed values only, a route pattern or page label,\n * never a URL, message, identifier, or user content.\n */\nexport const CLIENT_ERRORS_PATH = \"/v1/client-errors\";\n\nexport const CLIENT_ERROR_KINDS = [\n  \"route_error\",\n  \"unhandled_rejection\",\n  \"window_error\",\n  \"chunk_load\",\n] as const;\nexport type ClientErrorKind = (typeof CLIENT_ERROR_KINDS)[number];\n\n/**\n * Largest UTF-8 byte length of each error diagnostic field. A longer value is\n * cut at the end, so a stack keeps its innermost frames.\n */\nexport const CLIENT_ERROR_DETAIL_MAX_BYTES = {\n  name: 128,\n  message: 1024,\n  stack: 4096,\n  componentStack: 4096,\n} as const;\nexport type ClientErrorDetailField = keyof typeof CLIENT_ERROR_DETAIL_MAX_BYTES;\nexport const CLIENT_ERROR_DETAIL_FIELDS = Object.keys(\n  CLIENT_ERROR_DETAIL_MAX_BYTES,\n) as ClientErrorDetailField[];\n\n/**\n * Largest accepted report body. The detail fields total 9,344 bytes; JSON\n * escaping at most doubles that, which leaves room for the closed fields.\n */\nexport const CLIENT_ERROR_REPORT_MAX_BYTES = 20 * 1024;\n\nconst ROUTE_SEGMENT = String.raw`(?:[a-z]+(?:-[a-z]+)*|\\$[A-Za-z][A-Za-z0-9]{0,31})`;\n\n/**\n * A route pattern of at most 160 characters that is `/`, `unknown`, or up to\n * twelve `/`-separated segments that are each either a lowercase literal\n * (`rigs`) or a `$param` placeholder. The grammar excludes digits in\n * literals, so a concrete id cannot pass as one.\n */\nexport const CLIENT_ERROR_ROUTE_PATTERN = new RegExp(\n  String.raw`^(?=.{1,160}$)(?:unknown|/|(?:/${ROUTE_SEGMENT}){1,12})$`,\n);\n\n/** The bundle revision token (a commit SHA, `dev`, or `unknown`). */\nexport const CLIENT_ERROR_REVISION_PATTERN = /^[A-Za-z0-9._-]{1,64}$/;\n\n/** Error diagnostics. Every field is optional and already scrubbed and bounded. */\nexport type ClientErrorDetail = Partial<Record<ClientErrorDetailField, string>>;\n\nexport type ClientErrorReport = {\n  kind: ClientErrorKind;\n  route: string;\n  revision: string;\n  error?: ClientErrorDetail;\n};\n\nconst REDACTED = \"[redacted]\";\nconst TRUNCATED = \"…[truncated]\";\n\n// Hosts whose error URLs carry the error's arguments in the query string, and\n// nothing else (React's production error decoder links).\nconst ERROR_DECODER_URL = /^https?:\\/\\/(?:react\\.dev\\/errors\\/|reactjs\\.org\\/docs\\/error-decoder)/i;\n\nconst LONE_SURROGATE = /[\\uD800-\\uDBFF](?![\\uDC00-\\uDFFF])|(?<![\\uD800-\\uDBFF])[\\uDC00-\\uDFFF]/g;\n// Every control character except tab and newline.\n// oxlint-disable-next-line no-control-regex\nconst CONTROL_CHARACTERS = /[\\u0000-\\u0008\\u000B-\\u001F\\u007F]/g;\nconst URL_WITH_QUERY = /\\bhttps?:\\/\\/[^\\s?#\"'<>()`]*[?#][^\\s\"'<>()`]*/gi;\nconst LINE_AND_COLUMN_SUFFIX = /(?::\\d+){1,2}$/;\n// A credential, not prose such as \"Basic authentication\": it contains a digit.\nconst AUTHORIZATION_VALUE =\n  /\\b(Bearer|Basic|Token)\\s+(?=[A-Za-z._~+/=-]*[0-9])[A-Za-z0-9._~+/=-]{8,}/gi;\nconst JWT = /\\beyJ[A-Za-z0-9_-]{5,}\\.[A-Za-z0-9_-]{5,}(?:\\.[A-Za-z0-9_-]*)?/g;\nconst KNOWN_TOKEN =\n  /\\b(?:sk-(?:proj-|ant-)?|sk_(?:live|test)_|rk_(?:live|test)_|gh[pousr]_|github_pat_|glpat-|npm_|xox[abposr]-|ops_|AKIA|ASIA|AIza)[A-Za-z0-9_-]{12,}/g;\n// The value never starts with `[` or `…`, so an already redacted value and a\n// truncation marker are left alone and the scrubber stays idempotent.\nconst SECRET_ASSIGNMENT =\n  /\\b((?:access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|token|client[_-]?secret|secret|password|passwd|api[_-]?key|apikey|authorization|cookie|private[_-]?key)[\"']?\\s*[:=]\\s*[\"']?)[^\\s\"'&,;}[…][^\\s\"'&,;}]*/gi;\nconst OPAQUE_RUN = /[A-Za-z0-9+=_-]{32,}/g;\n\n/**\n * A long run that looks like a credential rather than a word, chunk name,\n * path or UUID: it mixes letters and digits and has an unbroken stretch of at\n * least 24 characters between `-`/`_` separators. Content-hashed asset names\n * (`artifact-page-chrome-DkF3x9aB`) and UUIDs have no stretch that long.\n */\nfunction isOpaqueCredential(run: string): boolean {\n  return (\n    /[0-9]/.test(run) &&\n    /[A-Za-z]/.test(run) &&\n    run.split(/[-_]/).some((stretch) => stretch.length >= 24)\n  );\n}\n\n/**\n * Remove what an error text must never carry while keeping what makes it\n * useful. Query strings and fragments are dropped from http(s) URLs (keeping a\n * stack frame's `:line:column`); authorization values, JWTs, well-known API\n * token formats, the values of `token=`/`password:`-style assignments, and\n * long opaque letter-and-digit runs become `[redacted]`; control characters\n * other than tab and newline become spaces. Messages, file names, route paths,\n * UUIDs and stack frames survive. Applying it twice changes nothing.\n */\nexport function scrubClientErrorText(text: string): string {\n  return text\n    .replace(LONE_SURROGATE, \"\\uFFFD\")\n    .replace(/\\r\\n?/g, \"\\n\")\n    .replace(CONTROL_CHARACTERS, \" \")\n    .replace(URL_WITH_QUERY, (url) => {\n      if (ERROR_DECODER_URL.test(url)) return url;\n      const cut = url.search(/[?#]/);\n      const suffix = url.slice(cut).match(LINE_AND_COLUMN_SUFFIX)?.[0] ?? \"\";\n      return url.slice(0, cut) + suffix;\n    })\n    .replace(AUTHORIZATION_VALUE, `$1 ${REDACTED}`)\n    .replace(JWT, REDACTED)\n    .replace(KNOWN_TOKEN, REDACTED)\n    .replace(SECRET_ASSIGNMENT, `$1${REDACTED}`)\n    .replace(OPAQUE_RUN, (run) => (isOpaqueCredential(run) ? REDACTED : run));\n}\n\nfunction utf8ByteLength(text: string): number {\n  return new TextEncoder().encode(text).byteLength;\n}\n\n/**\n * Cut `text` to at most `maxBytes` UTF-8 bytes on a character boundary, ending\n * with a truncation marker when anything was removed.\n */\nexport function boundClientErrorText(text: string, maxBytes: number): string {\n  if (utf8ByteLength(text) <= maxBytes) return text;\n  const budget = maxBytes - utf8ByteLength(TRUNCATED);\n  let bytes = 0;\n  let end = 0;\n  for (const character of text) {\n    const size = utf8ByteLength(character);\n    if (bytes + size > budget) break;\n    bytes += size;\n    end += character.length;\n  }\n  return text.slice(0, end) + TRUNCATED;\n}\n\n/** Whether `text` is already exactly what the projection would produce for it. */\nexport function isProjectedClientErrorText(text: string, field: ClientErrorDetailField): boolean {\n  return (\n    text.length > 0 &&\n    utf8ByteLength(text) <= CLIENT_ERROR_DETAIL_MAX_BYTES[field] &&\n    scrubClientErrorText(text) === text\n  );\n}\n\n/**\n * Project raw diagnostics into a {@link ClientErrorDetail}: non-string and\n * blank fields are dropped, the rest scrubbed and then bounded. Returns\n * `undefined` when nothing remains. Bounding after scrubbing keeps a cut from\n * splitting a credential into a fragment the scrubber no longer recognizes;\n * the marker cannot form one, so the result is stable under re-projection.\n */\nexport function projectClientErrorDetail(\n  raw: Partial<Record<ClientErrorDetailField, unknown>> | null | undefined,\n): ClientErrorDetail | undefined {\n  if (!raw) return undefined;\n  const detail: ClientErrorDetail = {};\n  for (const field of CLIENT_ERROR_DETAIL_FIELDS) {\n    const value = raw[field];\n    if (typeof value !== \"string\") continue;\n    const projected = boundClientErrorText(\n      scrubClientErrorText(value).trim(),\n      CLIENT_ERROR_DETAIL_MAX_BYTES[field],\n    );\n    if (projected) detail[field] = projected;\n  }\n  return Object.keys(detail).length > 0 ? detail : undefined;\n}\n\n/**\n * Content-free operational signals that share the error beacon route. A\n * signal report carries a `signal` discriminator and only closed values; a\n * report without `signal` is a {@link ClientErrorReport}. Older API servers\n * reject signal reports as invalid, so the extension is backward compatible in\n * both directions.\n */\nexport const CLIENT_SIGNALS = [\n  \"request_failure\",\n  \"stream\",\n  \"web_vital\",\n  \"desktop_bridge_missing\",\n] as const;\nexport type ClientSignal = (typeof CLIENT_SIGNALS)[number];\n\n/**\n * Key product mutations whose failure before any HTTP response is counted.\n * `send_message` includes sends the server queues behind an active turn.\n */\nexport const CLIENT_REQUEST_ACTIONS = [\n  \"create_session\",\n  \"send_message\",\n  \"steer_message\",\n  \"composer_submit\",\n  \"retry_turn\",\n  \"connect_integration\",\n  \"connect_model\",\n  \"checkout_start\",\n] as const;\nexport type ClientRequestAction = (typeof CLIENT_REQUEST_ACTIONS)[number];\n\n/**\n * Why a request never produced an HTTP response: the browser reported no\n * connectivity (`offline`), the client's own deadline expired (`timeout`), or\n * the transport failed (`network`). Cancellations the user or the app\n * initiated are never reported.\n */\nexport const CLIENT_REQUEST_FAILURE_REASONS = [\"network\", \"timeout\", \"offline\"] as const;\nexport type ClientRequestFailureReason = (typeof CLIENT_REQUEST_FAILURE_REASONS)[number];\n\n/** Browser live streams: one session's event stream, or the workspace live stream. */\nexport const CLIENT_STREAMS = [\"session\", \"workspace\"] as const;\nexport type ClientStream = (typeof CLIENT_STREAMS)[number];\n\n/**\n * Live stream health: a live stream dropped and started reconnecting\n * (`reconnect`), stopped reconnecting (`reconnect_exhausted`), or stayed\n * disconnected for longer than the long-disconnect threshold while the tab\n * was visible (`long_disconnect`).\n */\nexport const CLIENT_STREAM_EVENTS = [\n  \"reconnect\",\n  \"reconnect_exhausted\",\n  \"long_disconnect\",\n] as const;\nexport type ClientStreamEvent = (typeof CLIENT_STREAM_EVENTS)[number];\n\n/** Core Web Vitals plus time to first byte, measured once per document. */\nexport const CLIENT_WEB_VITAL_METRICS = [\"lcp\", \"inp\", \"cls\", \"ttfb\"] as const;\nexport type ClientWebVitalMetric = (typeof CLIENT_WEB_VITAL_METRICS)[number];\n\n/**\n * Largest accepted value: seconds for the timing metrics, the unitless layout\n * shift score for `cls`.\n */\nexport const CLIENT_WEB_VITAL_MAX_VALUE: Readonly<Record<ClientWebVitalMetric, number>> = {\n  lcp: 600,\n  inp: 600,\n  cls: 100,\n  ttfb: 600,\n};\n\n/**\n * The closed page labels of the web console's product-journey projection\n * (`journeyPage` in apps/web/src/lib/analytics-journey.ts; a drift test keeps\n * the two identical). Workspace pages are the first path segment after\n * `/workspaces/<id>/`; the rest are exact top-level routes.\n */\nexport const CLIENT_PAGES = [\n  \"sessions\",\n  \"priority\",\n  \"plugins\",\n  \"capabilities\",\n  \"documents\",\n  \"state\",\n  \"memory\",\n  \"schedules\",\n  \"automations\",\n  \"bot-templates\",\n  \"artifacts\",\n  \"settings\",\n  \"organization\",\n  \"insights\",\n  \"machines\",\n  \"computer-use\",\n  \"files\",\n  \"agents\",\n  \"secrets\",\n  \"rigs\",\n  \"playground\",\n  \"read-only-chats\",\n  \"inbox\",\n  \"sites\",\n  \"meetings\",\n  \"home\",\n  \"session-link\",\n  \"identity-link\",\n  \"checkout-return\",\n  \"integration-return\",\n  \"teams-connect\",\n  \"device\",\n  \"connect-agent\",\n  \"native-sign-in\",\n  \"reset-password\",\n  \"setup-account\",\n  \"account-auth\",\n  \"site-auth\",\n  \"personal-security\",\n  \"other\",\n] as const;\nexport type ClientPage = (typeof CLIENT_PAGES)[number];\n\nexport type ClientRequestFailureReport = {\n  signal: \"request_failure\";\n  action: ClientRequestAction;\n  reason: ClientRequestFailureReason;\n  route: string;\n  revision: string;\n};\n\nexport type ClientStreamReport = {\n  signal: \"stream\";\n  stream: ClientStream;\n  event: ClientStreamEvent;\n  route: string;\n  revision: string;\n};\n\nexport type ClientWebVitalReport = {\n  signal: \"web_vital\";\n  metric: ClientWebVitalMetric;\n  page: ClientPage;\n  /** Seconds for timing metrics, the unitless score for `cls`. */\n  value: number;\n  revision: string;\n};\n\n/** Desktop app platforms, as the desktop bridge names them. */\nexport const CLIENT_DESKTOP_PLATFORMS = [\"macos\", \"windows\", \"linux\"] as const;\nexport type ClientDesktopPlatform = (typeof CLIENT_DESKTOP_PLATFORMS)[number];\n\n/** A desktop app version as its user agent writes it (`Opengeni/<version>`). */\nexport const CLIENT_DESKTOP_APP_VERSION_PATTERN =\n  /^\\d{1,4}\\.\\d{1,4}\\.\\d{1,6}(?:-[0-9A-Za-z.]{1,24})?$/;\n\n/**\n * The page runs in the Opengeni desktop app's own window (its user agent says\n * so) but the shell's bridge is missing. Sent at most once per page load.\n */\nexport type ClientDesktopBridgeMissingReport = {\n  signal: \"desktop_bridge_missing\";\n  platform: ClientDesktopPlatform;\n  /** The app version from the user agent, or `unknown`. */\n  appVersion: string;\n  route: string;\n  revision: string;\n};\n\nexport type ClientSignalReport =\n  | ClientRequestFailureReport\n  | ClientStreamReport\n  | ClientWebVitalReport\n  | ClientDesktopBridgeMissingReport;\n\n/** Every body the beacon route accepts. */\nexport type ClientBeaconReport = ClientErrorReport | ClientSignalReport;\n"],"mappings":";AAqBO,IAAM,qBAAqB;AAE3B,IAAM,qBAAqB;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,gCAAgC;AAAA,EAC3C,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,gBAAgB;AAClB;AAEO,IAAM,6BAA6B,OAAO;AAAA,EAC/C;AACF;AAMO,IAAM,gCAAgC,KAAK;AAElD,IAAM,gBAAgB,OAAO;AAQtB,IAAM,6BAA6B,IAAI;AAAA,EAC5C,OAAO,qCAAqC,aAAa;AAC3D;AAGO,IAAM,gCAAgC;AAY7C,IAAM,WAAW;AACjB,IAAM,YAAY;AAIlB,IAAM,oBAAoB;AAE1B,IAAM,iBAAiB;AAGvB,IAAM,qBAAqB;AAC3B,IAAM,iBAAiB;AACvB,IAAM,yBAAyB;AAE/B,IAAM,sBACJ;AACF,IAAM,MAAM;AACZ,IAAM,cACJ;AAGF,IAAM,oBACJ;AACF,IAAM,aAAa;AAQnB,SAAS,mBAAmB,KAAsB;AAChD,SACE,QAAQ,KAAK,GAAG,KAChB,WAAW,KAAK,GAAG,KACnB,IAAI,MAAM,MAAM,EAAE,KAAK,CAAC,YAAY,QAAQ,UAAU,EAAE;AAE5D;AAWO,SAAS,qBAAqB,MAAsB;AACzD,SAAO,KACJ,QAAQ,gBAAgB,QAAQ,EAChC,QAAQ,UAAU,IAAI,EACtB,QAAQ,oBAAoB,GAAG,EAC/B,QAAQ,gBAAgB,CAAC,QAAQ;AAChC,QAAI,kBAAkB,KAAK,GAAG,EAAG,QAAO;AACxC,UAAM,MAAM,IAAI,OAAO,MAAM;AAC7B,UAAM,SAAS,IAAI,MAAM,GAAG,EAAE,MAAM,sBAAsB,IAAI,CAAC,KAAK;AACpE,WAAO,IAAI,MAAM,GAAG,GAAG,IAAI;AAAA,EAC7B,CAAC,EACA,QAAQ,qBAAqB,MAAM,QAAQ,EAAE,EAC7C,QAAQ,KAAK,QAAQ,EACrB,QAAQ,aAAa,QAAQ,EAC7B,QAAQ,mBAAmB,KAAK,QAAQ,EAAE,EAC1C,QAAQ,YAAY,CAAC,QAAS,mBAAmB,GAAG,IAAI,WAAW,GAAI;AAC5E;AAEA,SAAS,eAAe,MAAsB;AAC5C,SAAO,IAAI,YAAY,EAAE,OAAO,IAAI,EAAE;AACxC;AAMO,SAAS,qBAAqB,MAAc,UAA0B;AAC3E,MAAI,eAAe,IAAI,KAAK,SAAU,QAAO;AAC7C,QAAM,SAAS,WAAW,eAAe,SAAS;AAClD,MAAI,QAAQ;AACZ,MAAI,MAAM;AACV,aAAW,aAAa,MAAM;AAC5B,UAAM,OAAO,eAAe,SAAS;AACrC,QAAI,QAAQ,OAAO,OAAQ;AAC3B,aAAS;AACT,WAAO,UAAU;AAAA,EACnB;AACA,SAAO,KAAK,MAAM,GAAG,GAAG,IAAI;AAC9B;AAGO,SAAS,2BAA2B,MAAc,OAAwC;AAC/F,SACE,KAAK,SAAS,KACd,eAAe,IAAI,KAAK,8BAA8B,KAAK,KAC3D,qBAAqB,IAAI,MAAM;AAEnC;AASO,SAAS,yBACd,KAC+B;AAC/B,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAA4B,CAAC;AACnC,aAAW,SAAS,4BAA4B;AAC9C,UAAM,QAAQ,IAAI,KAAK;AACvB,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,YAAY;AAAA,MAChB,qBAAqB,KAAK,EAAE,KAAK;AAAA,MACjC,8BAA8B,KAAK;AAAA,IACrC;AACA,QAAI,UAAW,QAAO,KAAK,IAAI;AAAA,EACjC;AACA,SAAO,OAAO,KAAK,MAAM,EAAE,SAAS,IAAI,SAAS;AACnD;AASO,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,yBAAyB;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,IAAM,iCAAiC,CAAC,WAAW,WAAW,SAAS;AAIvE,IAAM,iBAAiB,CAAC,WAAW,WAAW;AAS9C,IAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AACF;AAIO,IAAM,2BAA2B,CAAC,OAAO,OAAO,OAAO,MAAM;AAO7D,IAAM,6BAA6E;AAAA,EACxF,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,MAAM;AACR;AAQO,IAAM,eAAe;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA6BO,IAAM,2BAA2B,CAAC,SAAS,WAAW,OAAO;AAI7D,IAAM,qCACX;","names":[]}

package/dist/code-search.d.ts

@@ -1,6 +1,6 @@
 /**
  * Directories holding platform credential material that `code_search` never
- * searches or reads, as path segments matched at any depth: OpenGeni's
+ * searches or reads, as path segments matched at any depth: Opengeni's
  * sandbox state (`.opengeni/`: Codemode bearer tokens, Git credential files
  * and bindings), the Azure CLI login cache (`.azure/`, from the sandbox's
  * service-principal login with HOME=/workspace) and a Connected Machine

package/dist/code-search.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/code-search.ts"],"sourcesContent":["// Resolvers for the optional Jev-backed `code_search` agent tool. A separate\n// subpath keeps them out of browser bundles; only server code decides.\n\n/**\n * Directories holding platform credential material that `code_search` never\n * searches or reads, as path segments matched at any depth: OpenGeni's\n * sandbox state (`.opengeni/`: Codemode bearer tokens, Git credential files\n * and bindings), the Azure CLI login cache (`.azure/`, from the sandbox's\n * service-principal login with HOME=/workspace) and a Connected Machine\n * agent's enrollment credentials (`.config/opengeni/`). The sandbox channel\n * enforces this list; `@opengeni/jev` keeps the same list for its engine, and\n * a worker test pins that the two agree.\n */\nexport const CODE_SEARCH_CREDENTIAL_DIRS: readonly (readonly string[])[] = [\n  [\".opengeni\"],\n  [\".azure\"],\n  [\".config\", \"opengeni\"],\n];\n\n/**\n * The deployment half of the `code_search` decision. `split` gives the tool to\n * a fixed half of sessions (see `codeSearchSessionInExperiment`) so staging can\n * compare sessions with and without it.\n */\nexport type CodeSearchWorkspaceDefault = \"off\" | \"on\" | \"split\";\nexport type CodeSearchDeploymentPolicy = {\n  available: boolean;\n  workspaceDefault: CodeSearchWorkspaceDefault;\n};\n\n/**\n * What a workspace gets: the deployment decides first, so nothing enables the\n * tool where the deployment does not offer it. Otherwise an explicit workspace\n * choice wins, and an absent, null or malformed setting follows the deployment\n * default. Only this field is read, so an invalid sibling setting cannot turn\n * an explicit Off back into the deployment default.\n */\nexport function resolveWorkspaceCodeSearchMode(\n  settings: unknown,\n  deployment: CodeSearchDeploymentPolicy,\n): CodeSearchWorkspaceDefault {\n  if (!deployment.available) return \"off\";\n  const explicit = explicitWorkspaceCodeSearchSetting(settings);\n  if (explicit === true) return \"on\";\n  if (explicit === false) return \"off\";\n  return deployment.workspaceDefault;\n}\n\nfunction explicitWorkspaceCodeSearchSetting(settings: unknown): boolean | undefined {\n  const explicit =\n    typeof settings === \"object\" && settings !== null\n      ? (settings as { codeSearchEnabled?: unknown }).codeSearchEnabled\n      : undefined;\n  return typeof explicit === \"boolean\" ? explicit : undefined;\n}\n\n/**\n * Fixed per-session half for the `split` experiment: 32-bit FNV-1a of the\n * session id, low bit 0 gets the tool. Deterministic and dependency-free, so\n * a root session's arm can be recomputed from its id. Child sessions inherit\n * their parent's decision instead.\n */\nexport function codeSearchSessionInExperiment(sessionId: string): boolean {\n  let hash = 0x811c9dc5;\n  for (let index = 0; index < sessionId.length; index++) {\n    hash ^= sessionId.charCodeAt(index);\n    hash = Math.imul(hash, 0x01000193) >>> 0;\n  }\n  return (hash & 1) === 0;\n}\n\n/**\n * The decision frozen on a new root session when it is created. Later changes\n * to the workspace setting or the deployment mode never turn the tool on for a\n * session that was created without it.\n */\nexport function resolveSessionCodeSearchEnabled(\n  settings: unknown,\n  deployment: CodeSearchDeploymentPolicy,\n  sessionId: string,\n): boolean {\n  const mode = resolveWorkspaceCodeSearchMode(settings, deployment);\n  return mode === \"on\" || (mode === \"split\" && codeSearchSessionInExperiment(sessionId));\n}\n\n/**\n * Whether a turn of this session gets `code_search`. Only a session frozen on\n * at creation can have it. The deployment (mode off or no usable key) and an\n * explicit workspace Off still pause it in running sessions, because they stop\n * repository content going to Jev; undoing that switch-off gives it back to\n * sessions frozen on. Each such change costs every affected session one\n * prompt-cache miss, which is accepted for a deliberate switch. Nothing else\n * changes the tool list of a running session.\n */\nexport function codeSearchEnabledForTurn(\n  frozen: boolean | null | undefined,\n  settings: unknown,\n  deployment: CodeSearchDeploymentPolicy,\n): boolean {\n  return (\n    frozen === true &&\n    deployment.available &&\n    explicitWorkspaceCodeSearchSetting(settings) !== false\n  );\n}\n"],"mappings":";AAaO,IAAM,8BAA8D;AAAA,EACzE,CAAC,WAAW;AAAA,EACZ,CAAC,QAAQ;AAAA,EACT,CAAC,WAAW,UAAU;AACxB;AAoBO,SAAS,+BACd,UACA,YAC4B;AAC5B,MAAI,CAAC,WAAW,UAAW,QAAO;AAClC,QAAM,WAAW,mCAAmC,QAAQ;AAC5D,MAAI,aAAa,KAAM,QAAO;AAC9B,MAAI,aAAa,MAAO,QAAO;AAC/B,SAAO,WAAW;AACpB;AAEA,SAAS,mCAAmC,UAAwC;AAClF,QAAM,WACJ,OAAO,aAAa,YAAY,aAAa,OACxC,SAA6C,oBAC9C;AACN,SAAO,OAAO,aAAa,YAAY,WAAW;AACpD;AAQO,SAAS,8BAA8B,WAA4B;AACxE,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,UAAU,QAAQ,SAAS;AACrD,YAAQ,UAAU,WAAW,KAAK;AAClC,WAAO,KAAK,KAAK,MAAM,QAAU,MAAM;AAAA,EACzC;AACA,UAAQ,OAAO,OAAO;AACxB;AAOO,SAAS,gCACd,UACA,YACA,WACS;AACT,QAAM,OAAO,+BAA+B,UAAU,UAAU;AAChE,SAAO,SAAS,QAAS,SAAS,WAAW,8BAA8B,SAAS;AACtF;AAWO,SAAS,yBACd,QACA,UACA,YACS;AACT,SACE,WAAW,QACX,WAAW,aACX,mCAAmC,QAAQ,MAAM;AAErD;","names":[]}
+{"version":3,"sources":["../src/code-search.ts"],"sourcesContent":["// Resolvers for the optional Jev-backed `code_search` agent tool. A separate\n// subpath keeps them out of browser bundles; only server code decides.\n\n/**\n * Directories holding platform credential material that `code_search` never\n * searches or reads, as path segments matched at any depth: Opengeni's\n * sandbox state (`.opengeni/`: Codemode bearer tokens, Git credential files\n * and bindings), the Azure CLI login cache (`.azure/`, from the sandbox's\n * service-principal login with HOME=/workspace) and a Connected Machine\n * agent's enrollment credentials (`.config/opengeni/`). The sandbox channel\n * enforces this list; `@opengeni/jev` keeps the same list for its engine, and\n * a worker test pins that the two agree.\n */\nexport const CODE_SEARCH_CREDENTIAL_DIRS: readonly (readonly string[])[] = [\n  [\".opengeni\"],\n  [\".azure\"],\n  [\".config\", \"opengeni\"],\n];\n\n/**\n * The deployment half of the `code_search` decision. `split` gives the tool to\n * a fixed half of sessions (see `codeSearchSessionInExperiment`) so staging can\n * compare sessions with and without it.\n */\nexport type CodeSearchWorkspaceDefault = \"off\" | \"on\" | \"split\";\nexport type CodeSearchDeploymentPolicy = {\n  available: boolean;\n  workspaceDefault: CodeSearchWorkspaceDefault;\n};\n\n/**\n * What a workspace gets: the deployment decides first, so nothing enables the\n * tool where the deployment does not offer it. Otherwise an explicit workspace\n * choice wins, and an absent, null or malformed setting follows the deployment\n * default. Only this field is read, so an invalid sibling setting cannot turn\n * an explicit Off back into the deployment default.\n */\nexport function resolveWorkspaceCodeSearchMode(\n  settings: unknown,\n  deployment: CodeSearchDeploymentPolicy,\n): CodeSearchWorkspaceDefault {\n  if (!deployment.available) return \"off\";\n  const explicit = explicitWorkspaceCodeSearchSetting(settings);\n  if (explicit === true) return \"on\";\n  if (explicit === false) return \"off\";\n  return deployment.workspaceDefault;\n}\n\nfunction explicitWorkspaceCodeSearchSetting(settings: unknown): boolean | undefined {\n  const explicit =\n    typeof settings === \"object\" && settings !== null\n      ? (settings as { codeSearchEnabled?: unknown }).codeSearchEnabled\n      : undefined;\n  return typeof explicit === \"boolean\" ? explicit : undefined;\n}\n\n/**\n * Fixed per-session half for the `split` experiment: 32-bit FNV-1a of the\n * session id, low bit 0 gets the tool. Deterministic and dependency-free, so\n * a root session's arm can be recomputed from its id. Child sessions inherit\n * their parent's decision instead.\n */\nexport function codeSearchSessionInExperiment(sessionId: string): boolean {\n  let hash = 0x811c9dc5;\n  for (let index = 0; index < sessionId.length; index++) {\n    hash ^= sessionId.charCodeAt(index);\n    hash = Math.imul(hash, 0x01000193) >>> 0;\n  }\n  return (hash & 1) === 0;\n}\n\n/**\n * The decision frozen on a new root session when it is created. Later changes\n * to the workspace setting or the deployment mode never turn the tool on for a\n * session that was created without it.\n */\nexport function resolveSessionCodeSearchEnabled(\n  settings: unknown,\n  deployment: CodeSearchDeploymentPolicy,\n  sessionId: string,\n): boolean {\n  const mode = resolveWorkspaceCodeSearchMode(settings, deployment);\n  return mode === \"on\" || (mode === \"split\" && codeSearchSessionInExperiment(sessionId));\n}\n\n/**\n * Whether a turn of this session gets `code_search`. Only a session frozen on\n * at creation can have it. The deployment (mode off or no usable key) and an\n * explicit workspace Off still pause it in running sessions, because they stop\n * repository content going to Jev; undoing that switch-off gives it back to\n * sessions frozen on. Each such change costs every affected session one\n * prompt-cache miss, which is accepted for a deliberate switch. Nothing else\n * changes the tool list of a running session.\n */\nexport function codeSearchEnabledForTurn(\n  frozen: boolean | null | undefined,\n  settings: unknown,\n  deployment: CodeSearchDeploymentPolicy,\n): boolean {\n  return (\n    frozen === true &&\n    deployment.available &&\n    explicitWorkspaceCodeSearchSetting(settings) !== false\n  );\n}\n"],"mappings":";AAaO,IAAM,8BAA8D;AAAA,EACzE,CAAC,WAAW;AAAA,EACZ,CAAC,QAAQ;AAAA,EACT,CAAC,WAAW,UAAU;AACxB;AAoBO,SAAS,+BACd,UACA,YAC4B;AAC5B,MAAI,CAAC,WAAW,UAAW,QAAO;AAClC,QAAM,WAAW,mCAAmC,QAAQ;AAC5D,MAAI,aAAa,KAAM,QAAO;AAC9B,MAAI,aAAa,MAAO,QAAO;AAC/B,SAAO,WAAW;AACpB;AAEA,SAAS,mCAAmC,UAAwC;AAClF,QAAM,WACJ,OAAO,aAAa,YAAY,aAAa,OACxC,SAA6C,oBAC9C;AACN,SAAO,OAAO,aAAa,YAAY,WAAW;AACpD;AAQO,SAAS,8BAA8B,WAA4B;AACxE,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,UAAU,QAAQ,SAAS;AACrD,YAAQ,UAAU,WAAW,KAAK;AAClC,WAAO,KAAK,KAAK,MAAM,QAAU,MAAM;AAAA,EACzC;AACA,UAAQ,OAAO,OAAO;AACxB;AAOO,SAAS,gCACd,UACA,YACA,WACS;AACT,QAAM,OAAO,+BAA+B,UAAU,UAAU;AAChE,SAAO,SAAS,QAAS,SAAS,WAAW,8BAA8B,SAAS;AACtF;AAWO,SAAS,yBACd,QACA,UACA,YACS;AACT,SACE,WAAW,QACX,WAAW,aACX,mCAAmC,QAAQ,MAAM;AAErD;","names":[]}

package/dist/codex-provider-account-authority.js

@@ -1,17 +1,28 @@
+import {
+  positiveInteger
+} from "./chunk-AQYDZUJV.js";
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
 // src/codex-provider-account-authority.ts
 import { z } from "zod";
-var PositiveSafeInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
-var CodexProviderAccountAuthoritySnapshotV1 = z.discriminatedUnion("scope", [
-  z.object({
-    version: z.literal(1),
-    scope: z.literal("workspace")
-  }).strict(),
-  z.object({
-    version: z.literal(1),
-    scope: z.literal("user"),
-    authorityGeneration: PositiveSafeInteger
-  }).strict()
-]);
+var PositiveSafeInteger = /* @__PURE__ */ defineSchema(
+  () => positiveInteger.max(Number.MAX_SAFE_INTEGER)
+);
+var CodexProviderAccountAuthoritySnapshotV1 = /* @__PURE__ */ defineSchema(
+  () => z.discriminatedUnion("scope", [
+    z.object({
+      version: z.literal(1),
+      scope: z.literal("workspace")
+    }).strict(),
+    z.object({
+      version: z.literal(1),
+      scope: z.literal("user"),
+      authorityGeneration: PositiveSafeInteger
+    }).strict()
+  ])
+);
 var LEGACY_WORKSPACE_CODEX_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {
   version: 1,
   scope: "workspace"

package/dist/codex-provider-account-authority.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/codex-provider-account-authority.ts"],"sourcesContent":["import { z } from \"zod\";\n\nconst PositiveSafeInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);\n\n/**\n * Opaque authority frozen at a Codex provider-account acceptance boundary.\n *\n * The snapshot deliberately carries no organization, membership, credential,\n * provider-account, subject, label, quota, token, or plan identity. A later\n * activation slice may use the user generation only together with separately\n * authorized durable state; this value is never sufficient authority alone.\n */\nexport const CodexProviderAccountAuthoritySnapshotV1 = z.discriminatedUnion(\"scope\", [\n  z\n    .object({\n      version: z.literal(1),\n      scope: z.literal(\"workspace\"),\n    })\n    .strict(),\n  z\n    .object({\n      version: z.literal(1),\n      scope: z.literal(\"user\"),\n      authorityGeneration: PositiveSafeInteger,\n    })\n    .strict(),\n]);\n\nexport type CodexProviderAccountAuthoritySnapshotV1 = z.infer<\n  typeof CodexProviderAccountAuthoritySnapshotV1\n>;\n\n/** Explicit compatibility value for all pre-foundation accepted work. */\nexport const LEGACY_WORKSPACE_CODEX_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {\n  version: 1,\n  scope: \"workspace\",\n} as const satisfies CodexProviderAccountAuthoritySnapshotV1;\n"],"mappings":";AAAA,SAAS,SAAS;AAElB,IAAM,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,OAAO,gBAAgB;AAU5E,IAAM,0CAA0C,EAAE,mBAAmB,SAAS;AAAA,EACnF,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,CAAC;AAAA,IACpB,OAAO,EAAE,QAAQ,WAAW;AAAA,EAC9B,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,CAAC;AAAA,IACpB,OAAO,EAAE,QAAQ,MAAM;AAAA,IACvB,qBAAqB;AAAA,EACvB,CAAC,EACA,OAAO;AACZ,CAAC;AAOM,IAAM,gEAAgE;AAAA,EAC3E,SAAS;AAAA,EACT,OAAO;AACT;","names":[]}
+{"version":3,"sources":["../src/codex-provider-account-authority.ts"],"sourcesContent":["import * as primitives from \"./primitives\";\nimport { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nconst PositiveSafeInteger = /* @__PURE__ */ defineSchema(() =>\n  primitives.positiveInteger.max(Number.MAX_SAFE_INTEGER),\n);\n\n/**\n * Opaque authority frozen at a Codex provider-account acceptance boundary.\n *\n * The snapshot deliberately carries no organization, membership, credential,\n * provider-account, subject, label, quota, token, or plan identity. A later\n * activation slice may use the user generation only together with separately\n * authorized durable state; this value is never sufficient authority alone.\n */\nexport const CodexProviderAccountAuthoritySnapshotV1 = /* @__PURE__ */ defineSchema(() =>\n  z.discriminatedUnion(\"scope\", [\n    z\n      .object({\n        version: z.literal(1),\n        scope: z.literal(\"workspace\"),\n      })\n      .strict(),\n    z\n      .object({\n        version: z.literal(1),\n        scope: z.literal(\"user\"),\n        authorityGeneration: PositiveSafeInteger,\n      })\n      .strict(),\n  ]),\n);\n\nexport type CodexProviderAccountAuthoritySnapshotV1 = z.infer<\n  typeof CodexProviderAccountAuthoritySnapshotV1\n>;\n\n/** Explicit compatibility value for all pre-foundation accepted work. */\nexport const LEGACY_WORKSPACE_CODEX_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {\n  version: 1,\n  scope: \"workspace\",\n} as const satisfies CodexProviderAccountAuthoritySnapshotV1;\n"],"mappings":";;;;;;;;AAEA,SAAS,SAAS;AAElB,IAAM,sBAAsC;AAAA,EAAa,MAC5C,gBAAgB,IAAI,OAAO,gBAAgB;AACxD;AAUO,IAAM,0CAA0D;AAAA,EAAa,MAClF,EAAE,mBAAmB,SAAS;AAAA,IAC5B,EACG,OAAO;AAAA,MACN,SAAS,EAAE,QAAQ,CAAC;AAAA,MACpB,OAAO,EAAE,QAAQ,WAAW;AAAA,IAC9B,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,SAAS,EAAE,QAAQ,CAAC;AAAA,MACpB,OAAO,EAAE,QAAQ,MAAM;AAAA,MACvB,qBAAqB;AAAA,IACvB,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH;AAOO,IAAM,gEAAgE;AAAA,EAC3E,SAAS;AAAA,EACT,OAAO;AACT;","names":[]}

package/dist/company-profile.d.ts

@@ -579,6 +579,7 @@ export declare const CompanyProfileAgentHumanInputPrompt: z.ZodObject<{
         id: z.ZodString;
         kind: z.ZodEnum<{
             multi_select: "multi_select";
+            secret: "secret";
             single_select: "single_select";
             text: "text";
         }>;
@@ -598,6 +599,53 @@ export declare const CompanyProfileAgentHumanInputPrompt: z.ZodObject<{
             label: z.ZodString;
             description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>>>;
+        secret: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            item: z.ZodString;
+            field: z.ZodDefault<z.ZodString>;
+            fieldKind: z.ZodDefault<z.ZodEnum<{
+                concealed: "concealed";
+                text: "text";
+                totp: "totp";
+            }>>;
+            itemType: z.ZodDefault<z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                ssh_key: "ssh_key";
+            }>>;
+            username: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                prompt: z.ZodString;
+                value: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            }, z.core.$strict>>>;
+            website: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            looksLike: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            pattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            saveTo: z.ZodDefault<z.ZodEnum<{
+                task: "task";
+                user: "user";
+                workspace: "workspace";
+            }>>;
+            vault: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            allowGenerate: z.ZodDefault<z.ZodBoolean>;
+            generate: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                length: z.ZodDefault<z.ZodNumber>;
+                lowercase: z.ZodDefault<z.ZodBoolean>;
+                uppercase: z.ZodDefault<z.ZodBoolean>;
+                digits: z.ZodDefault<z.ZodBoolean>;
+                symbols: z.ZodDefault<z.ZodBoolean>;
+                symbolSet: z.ZodDefault<z.ZodString>;
+                excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+                requireEachClass: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>>>;
+            autocomplete: z.ZodDefault<z.ZodEnum<{
+                "current-password": "current-password";
+                "new-password": "new-password";
+                off: "off";
+                "one-time-code": "one-time-code";
+            }>>;
+        }, z.core.$strict>>>;
         required: z.ZodDefault<z.ZodBoolean>;
         allowOther: z.ZodDefault<z.ZodBoolean>;
         validation: z.ZodOptional<z.ZodNullable<z.ZodObject<{
@@ -661,6 +709,7 @@ export declare const CompanyProfileAgentReviewRequiredReceipt: z.ZodObject<{
             id: z.ZodString;
             kind: z.ZodEnum<{
                 multi_select: "multi_select";
+                secret: "secret";
                 single_select: "single_select";
                 text: "text";
             }>;
@@ -680,6 +729,53 @@ export declare const CompanyProfileAgentReviewRequiredReceipt: z.ZodObject<{
                 label: z.ZodString;
                 description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             }, z.core.$strip>>>;
+            secret: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                item: z.ZodString;
+                field: z.ZodDefault<z.ZodString>;
+                fieldKind: z.ZodDefault<z.ZodEnum<{
+                    concealed: "concealed";
+                    text: "text";
+                    totp: "totp";
+                }>>;
+                itemType: z.ZodDefault<z.ZodEnum<{
+                    api_key: "api_key";
+                    card: "card";
+                    identity: "identity";
+                    login: "login";
+                    note: "note";
+                    ssh_key: "ssh_key";
+                }>>;
+                username: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                    prompt: z.ZodString;
+                    value: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                }, z.core.$strict>>>;
+                website: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                looksLike: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                pattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                saveTo: z.ZodDefault<z.ZodEnum<{
+                    task: "task";
+                    user: "user";
+                    workspace: "workspace";
+                }>>;
+                vault: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                allowGenerate: z.ZodDefault<z.ZodBoolean>;
+                generate: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                    length: z.ZodDefault<z.ZodNumber>;
+                    lowercase: z.ZodDefault<z.ZodBoolean>;
+                    uppercase: z.ZodDefault<z.ZodBoolean>;
+                    digits: z.ZodDefault<z.ZodBoolean>;
+                    symbols: z.ZodDefault<z.ZodBoolean>;
+                    symbolSet: z.ZodDefault<z.ZodString>;
+                    excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+                    requireEachClass: z.ZodDefault<z.ZodBoolean>;
+                }, z.core.$strict>>>;
+                autocomplete: z.ZodDefault<z.ZodEnum<{
+                    "current-password": "current-password";
+                    "new-password": "new-password";
+                    off: "off";
+                    "one-time-code": "one-time-code";
+                }>>;
+            }, z.core.$strict>>>;
             required: z.ZodDefault<z.ZodBoolean>;
             allowOther: z.ZodDefault<z.ZodBoolean>;
             validation: z.ZodOptional<z.ZodNullable<z.ZodObject<{
@@ -831,6 +927,7 @@ export declare const CompanyProfileAgentProposalReceipt: z.ZodDiscriminatedUnion
             id: z.ZodString;
             kind: z.ZodEnum<{
                 multi_select: "multi_select";
+                secret: "secret";
                 single_select: "single_select";
                 text: "text";
             }>;
@@ -850,6 +947,53 @@ export declare const CompanyProfileAgentProposalReceipt: z.ZodDiscriminatedUnion
                 label: z.ZodString;
                 description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             }, z.core.$strip>>>;
+            secret: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                item: z.ZodString;
+                field: z.ZodDefault<z.ZodString>;
+                fieldKind: z.ZodDefault<z.ZodEnum<{
+                    concealed: "concealed";
+                    text: "text";
+                    totp: "totp";
+                }>>;
+                itemType: z.ZodDefault<z.ZodEnum<{
+                    api_key: "api_key";
+                    card: "card";
+                    identity: "identity";
+                    login: "login";
+                    note: "note";
+                    ssh_key: "ssh_key";
+                }>>;
+                username: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                    prompt: z.ZodString;
+                    value: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                }, z.core.$strict>>>;
+                website: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                looksLike: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                pattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                saveTo: z.ZodDefault<z.ZodEnum<{
+                    task: "task";
+                    user: "user";
+                    workspace: "workspace";
+                }>>;
+                vault: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                allowGenerate: z.ZodDefault<z.ZodBoolean>;
+                generate: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                    length: z.ZodDefault<z.ZodNumber>;
+                    lowercase: z.ZodDefault<z.ZodBoolean>;
+                    uppercase: z.ZodDefault<z.ZodBoolean>;
+                    digits: z.ZodDefault<z.ZodBoolean>;
+                    symbols: z.ZodDefault<z.ZodBoolean>;
+                    symbolSet: z.ZodDefault<z.ZodString>;
+                    excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+                    requireEachClass: z.ZodDefault<z.ZodBoolean>;
+                }, z.core.$strict>>>;
+                autocomplete: z.ZodDefault<z.ZodEnum<{
+                    "current-password": "current-password";
+                    "new-password": "new-password";
+                    off: "off";
+                    "one-time-code": "one-time-code";
+                }>>;
+            }, z.core.$strict>>>;
             required: z.ZodDefault<z.ZodBoolean>;
             allowOther: z.ZodDefault<z.ZodBoolean>;
             validation: z.ZodOptional<z.ZodNullable<z.ZodObject<{

package/dist/connect.d.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+export { PreparedMcpSetup, preparedMcpHeaders } from "./prepared-mcp-setup.js";
 export declare const ConnectOwnership: z.ZodEnum<{
     personal: "personal";
     workspace: "workspace";
@@ -258,6 +259,24 @@ export declare const ConnectAttempt: z.ZodObject<{
         url: z.ZodString;
         baseUrl: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>], "kind">>;
+    mcpSetup: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        endpointUrl: z.ZodString;
+        headers: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            name: z.ZodString;
+            secret: z.ZodString;
+            prefix: z.ZodOptional<z.ZodString>;
+            suffix: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>>;
+        secretFields: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    mcpCapabilityId: z.ZodOptional<z.ZodString>;
     error: z.ZodOptional<z.ZodObject<{
         code: z.ZodString;
         message: z.ZodString;
@@ -315,6 +334,7 @@ export declare const BeginConnectRequest: z.ZodObject<{
         workspace: "workspace";
     }>;
     returnUrl: z.ZodString;
+    finishInPopup: z.ZodOptional<z.ZodLiteral<true>>;
     idempotencyKey: z.ZodString;
     reconnectAccountId: z.ZodOptional<z.ZodString>;
     installationTarget: z.ZodOptional<z.ZodObject<{
@@ -322,4 +342,22 @@ export declare const BeginConnectRequest: z.ZodObject<{
         displayName: z.ZodString;
         expectedInstanceVersion: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>>;
+    mcpSetup: z.ZodOptional<z.ZodObject<{
+        name: z.ZodString;
+        endpointUrl: z.ZodString;
+        headers: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            name: z.ZodString;
+            secret: z.ZodString;
+            prefix: z.ZodOptional<z.ZodString>;
+            suffix: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>>;
+        secretFields: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            label: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
+export type BeginConnectRequest = z.infer<typeof BeginConnectRequest>;