@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/knowledge-entries.d.ts

@@ -747,6 +747,7 @@ export declare const KnowledgeEntryListRequest: z.ZodObject<{
         requirement: "requirement";
         source: "source";
     }>>;
+    createdSince: z.ZodOptional<z.ZodString>;
     view: z.ZodDefault<z.ZodEnum<{
         archived: "archived";
         needs_review: "needs_review";
@@ -759,6 +760,40 @@ export declare const KnowledgeEntryListRequest: z.ZodObject<{
     limit: z.ZodDefault<z.ZodNumber>;
 }, z.core.$strict>;
 export type KnowledgeEntryListRequest = z.input<typeof KnowledgeEntryListRequest>;
+/** MCP discovery stays small; validation is identical to the HTTP UUID/date fields. */
+export declare const KnowledgeSearchToolRequest: z.ZodObject<{
+    query: z.ZodOptional<z.ZodString>;
+    mode: z.ZodDefault<z.ZodEnum<{
+        hybrid: "hybrid";
+        keyword: "keyword";
+        vector: "vector";
+    }>>;
+    scope: z.ZodOptional<z.ZodEnum<{
+        organization: "organization";
+        personal: "personal";
+        workspace: "workspace";
+    }>>;
+    rootOnly: z.ZodOptional<z.ZodBoolean>;
+    includeEvidence: z.ZodOptional<z.ZodBoolean>;
+    kind: z.ZodOptional<z.ZodEnum<{
+        decision: "decision";
+        fact: "fact";
+        group: "group";
+        incident: "incident";
+        note: "note";
+        requirement: "requirement";
+        source: "source";
+    }>>;
+    cursor: z.ZodOptional<z.ZodString>;
+    groupId: z.ZodOptional<z.ZodString>;
+    fileId: z.ZodOptional<z.ZodString>;
+    createdSince: z.ZodOptional<z.ZodString>;
+    view: z.ZodDefault<z.ZodEnum<{
+        needs_review: "needs_review";
+        published: "published";
+    }>>;
+    limit: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
 /** Lists never transfer whole source texts or evidence quotations. */
 export declare const KnowledgeEntrySummary: z.ZodObject<{
     id: z.ZodUUID;
@@ -783,6 +818,7 @@ export declare const KnowledgeEntrySummary: z.ZodObject<{
         source_unavailable: "source_unavailable";
     }>>;
     score: z.ZodOptional<z.ZodNumber>;
+    lastChangedAt: z.ZodOptional<z.ZodString>;
     excerpts: z.ZodDefault<z.ZodArray<z.ZodObject<{
         field: z.ZodEnum<{
             content: "content";
@@ -860,6 +896,7 @@ export declare const KnowledgeEntryListResponse: z.ZodObject<{
             source_unavailable: "source_unavailable";
         }>>;
         score: z.ZodOptional<z.ZodNumber>;
+        lastChangedAt: z.ZodOptional<z.ZodString>;
         excerpts: z.ZodDefault<z.ZodArray<z.ZodObject<{
             field: z.ZodEnum<{
                 content: "content";
@@ -920,6 +957,7 @@ export declare const KnowledgeEntryListResponse: z.ZodObject<{
     }>>;
     fallbackReason: z.ZodOptional<z.ZodEnum<{
         awaiting_funding: "awaiting_funding";
+        credits_disabled: "credits_disabled";
         provider_unavailable: "provider_unavailable";
         query_limit: "query_limit";
         quota: "quota";

package/dist/knowledge-preparation.d.ts

@@ -78,6 +78,7 @@ export declare const KnowledgeSavePreparationResponse: z.ZodObject<{
                     source_unavailable: "source_unavailable";
                 }>>;
                 score: z.ZodOptional<z.ZodNumber>;
+                lastChangedAt: z.ZodOptional<z.ZodString>;
                 excerpts: z.ZodDefault<z.ZodArray<z.ZodObject<{
                     field: z.ZodEnum<{
                         content: "content";
@@ -138,6 +139,7 @@ export declare const KnowledgeSavePreparationResponse: z.ZodObject<{
             }>>;
             fallbackReason: z.ZodOptional<z.ZodEnum<{
                 awaiting_funding: "awaiting_funding";
+                credits_disabled: "credits_disabled";
                 provider_unavailable: "provider_unavailable";
                 query_limit: "query_limit";
                 quota: "quota";
@@ -167,6 +169,7 @@ export declare const KnowledgeSavePreparationResponse: z.ZodObject<{
                     source_unavailable: "source_unavailable";
                 }>>;
                 score: z.ZodOptional<z.ZodNumber>;
+                lastChangedAt: z.ZodOptional<z.ZodString>;
                 excerpts: z.ZodDefault<z.ZodArray<z.ZodObject<{
                     field: z.ZodEnum<{
                         content: "content";
@@ -227,6 +230,7 @@ export declare const KnowledgeSavePreparationResponse: z.ZodObject<{
             }>>;
             fallbackReason: z.ZodOptional<z.ZodEnum<{
                 awaiting_funding: "awaiting_funding";
+                credits_disabled: "credits_disabled";
                 provider_unavailable: "provider_unavailable";
                 query_limit: "query_limit";
                 quota: "quota";

package/dist/learning-refusal.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Browser/React Native-safe learning-refusal fact. Deliberately free of the
+ * zod runtime so synchronous timeline projection can read it.
+ *
+ * A durable learning write (a Skill, workspace instruction, or Knowledge
+ * change) that authority or policy refused carries this fact under `_meta`.
+ * MCP `_meta` never reaches the model: it survives only into the
+ * `agent.toolCall.output` event projection, where the timeline tells the
+ * person their change was not saved, whatever the agent then says.
+ */
+export declare const LEARNING_REFUSAL_META_KEY: "opengeni/learningRefusal";
+export declare const LEARNING_REFUSAL_DESTINATIONS: readonly ["skill", "instruction", "knowledge"];
+/** Where the refused change would have been saved. */
+export type LearningRefusalDestination = (typeof LEARNING_REFUSAL_DESTINATIONS)[number];
+/**
+ * Why it was refused, in terms a person can act on. An agent saves to the
+ * destination it explicitly chooses, so only a genuine refusal is reported:
+ * - `learning_off`: Agent learning for this destination is Off, in this
+ *   chat's or the workspace's settings.
+ * - `site_agent`: historical receipts from the retired Site-specific policy.
+ * - `not_permitted`: any other definite authority or policy refusal.
+ */
+export declare const LEARNING_REFUSAL_REASONS: readonly ["learning_off", "site_agent", "not_permitted"];
+export type LearningRefusalReason = (typeof LEARNING_REFUSAL_REASONS)[number];
+/** Codes and ids only: never the refused text, a Skill's name, or a server message. */
+export type LearningRefusal = {
+    destination: LearningRefusalDestination;
+    reason: LearningRefusalReason;
+    /** The existing Skill the change targeted, when there was one. */
+    skillId?: string;
+};
+/**
+ * The tool result with the refusal fact added to its `_meta`; nothing else
+ * changes. Only the exact closed shape is attached.
+ */
+export declare function withLearningRefusalMeta<T extends object>(result: T, refusal: LearningRefusal): T;
+/**
+ * The learning-refusal fact on a tool result or its event projection, when
+ * present and valid. Stored events outlive their writer: a reader ignores
+ * fields a newer writer added, and reads an unknown newer reason as the
+ * generic refusal rather than dropping the fact.
+ */
+export declare function learningRefusalFromToolOutput(output: unknown): LearningRefusal | null;

package/dist/learning-refusal.js

@@ -0,0 +1,49 @@
+// src/learning-refusal.ts
+var LEARNING_REFUSAL_META_KEY = "opengeni/learningRefusal";
+var LEARNING_REFUSAL_DESTINATIONS = ["skill", "instruction", "knowledge"];
+var LEARNING_REFUSAL_REASONS = ["learning_off", "site_agent", "not_permitted"];
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function oneOf(values, value) {
+  return typeof value === "string" && values.includes(value);
+}
+function exactRefusal(value) {
+  const fact = record(value);
+  if (!fact) return null;
+  if (Object.keys(fact).some((key) => !["destination", "reason", "skillId"].includes(key)))
+    return null;
+  if (!oneOf(LEARNING_REFUSAL_DESTINATIONS, fact.destination)) return null;
+  if (!oneOf(LEARNING_REFUSAL_REASONS, fact.reason)) return null;
+  if (fact.skillId !== void 0 && (typeof fact.skillId !== "string" || !UUID.test(fact.skillId)))
+    return null;
+  return {
+    destination: fact.destination,
+    reason: fact.reason,
+    ...fact.skillId !== void 0 ? { skillId: fact.skillId } : {}
+  };
+}
+function withLearningRefusalMeta(result, refusal) {
+  const fact = exactRefusal(refusal);
+  if (!fact) throw new TypeError("Invalid learning refusal");
+  const meta = record(result._meta);
+  return { ...result, _meta: { ...meta, [LEARNING_REFUSAL_META_KEY]: fact } };
+}
+function learningRefusalFromToolOutput(output) {
+  const fact = record(record(record(output)?._meta)?.[LEARNING_REFUSAL_META_KEY]);
+  if (!fact || typeof fact.reason !== "string") return null;
+  return exactRefusal({
+    destination: fact.destination,
+    reason: oneOf(LEARNING_REFUSAL_REASONS, fact.reason) ? fact.reason : "not_permitted",
+    ...fact.skillId !== void 0 ? { skillId: fact.skillId } : {}
+  });
+}
+export {
+  LEARNING_REFUSAL_DESTINATIONS,
+  LEARNING_REFUSAL_META_KEY,
+  LEARNING_REFUSAL_REASONS,
+  learningRefusalFromToolOutput,
+  withLearningRefusalMeta
+};
+//# sourceMappingURL=learning-refusal.js.map

package/dist/learning-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/learning-refusal.ts"],"sourcesContent":["/**\n * Browser/React Native-safe learning-refusal fact. Deliberately free of the\n * zod runtime so synchronous timeline projection can read it.\n *\n * A durable learning write (a Skill, workspace instruction, or Knowledge\n * change) that authority or policy refused carries this fact under `_meta`.\n * MCP `_meta` never reaches the model: it survives only into the\n * `agent.toolCall.output` event projection, where the timeline tells the\n * person their change was not saved, whatever the agent then says.\n */\nexport const LEARNING_REFUSAL_META_KEY = \"opengeni/learningRefusal\" as const;\n\nexport const LEARNING_REFUSAL_DESTINATIONS = [\"skill\", \"instruction\", \"knowledge\"] as const;\n/** Where the refused change would have been saved. */\nexport type LearningRefusalDestination = (typeof LEARNING_REFUSAL_DESTINATIONS)[number];\n\n/**\n * Why it was refused, in terms a person can act on. An agent saves to the\n * destination it explicitly chooses, so only a genuine refusal is reported:\n * - `learning_off`: Agent learning for this destination is Off, in this\n *   chat's or the workspace's settings.\n * - `site_agent`: historical receipts from the retired Site-specific policy.\n * - `not_permitted`: any other definite authority or policy refusal.\n */\nexport const LEARNING_REFUSAL_REASONS = [\"learning_off\", \"site_agent\", \"not_permitted\"] as const;\nexport type LearningRefusalReason = (typeof LEARNING_REFUSAL_REASONS)[number];\n\n/** Codes and ids only: never the refused text, a Skill's name, or a server message. */\nexport type LearningRefusal = {\n  destination: LearningRefusalDestination;\n  reason: LearningRefusalReason;\n  /** The existing Skill the change targeted, when there was one. */\n  skillId?: string;\n};\n\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/iu;\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\nfunction oneOf<T extends string>(values: readonly T[], value: unknown): value is T {\n  return typeof value === \"string\" && (values as readonly string[]).includes(value);\n}\n\n/** The exact closed fact, or null when the input is not one. */\nfunction exactRefusal(value: unknown): LearningRefusal | null {\n  const fact = record(value);\n  if (!fact) return null;\n  if (Object.keys(fact).some((key) => ![\"destination\", \"reason\", \"skillId\"].includes(key)))\n    return null;\n  if (!oneOf(LEARNING_REFUSAL_DESTINATIONS, fact.destination)) return null;\n  if (!oneOf(LEARNING_REFUSAL_REASONS, fact.reason)) return null;\n  if (fact.skillId !== undefined && (typeof fact.skillId !== \"string\" || !UUID.test(fact.skillId)))\n    return null;\n  return {\n    destination: fact.destination,\n    reason: fact.reason,\n    ...(fact.skillId !== undefined ? { skillId: fact.skillId as string } : {}),\n  };\n}\n\n/**\n * The tool result with the refusal fact added to its `_meta`; nothing else\n * changes. Only the exact closed shape is attached.\n */\nexport function withLearningRefusalMeta<T extends object>(result: T, refusal: LearningRefusal): T {\n  const fact = exactRefusal(refusal);\n  if (!fact) throw new TypeError(\"Invalid learning refusal\");\n  const meta = record((result as { _meta?: unknown })._meta);\n  return { ...result, _meta: { ...meta, [LEARNING_REFUSAL_META_KEY]: fact } } as T;\n}\n\n/**\n * The learning-refusal fact on a tool result or its event projection, when\n * present and valid. Stored events outlive their writer: a reader ignores\n * fields a newer writer added, and reads an unknown newer reason as the\n * generic refusal rather than dropping the fact.\n */\nexport function learningRefusalFromToolOutput(output: unknown): LearningRefusal | null {\n  const fact = record(record(record(output)?._meta)?.[LEARNING_REFUSAL_META_KEY]);\n  if (!fact || typeof fact.reason !== \"string\") return null;\n  return exactRefusal({\n    destination: fact.destination,\n    reason: oneOf(LEARNING_REFUSAL_REASONS, fact.reason) ? fact.reason : \"not_permitted\",\n    ...(fact.skillId !== undefined ? { skillId: fact.skillId } : {}),\n  });\n}\n"],"mappings":";AAUO,IAAM,4BAA4B;AAElC,IAAM,gCAAgC,CAAC,SAAS,eAAe,WAAW;AAY1E,IAAM,2BAA2B,CAAC,gBAAgB,cAAc,eAAe;AAWtF,IAAM,OAAO;AAEb,SAAS,OAAO,OAAgD;AAC9D,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD;AACN;AAEA,SAAS,MAAwB,QAAsB,OAA4B;AACjF,SAAO,OAAO,UAAU,YAAa,OAA6B,SAAS,KAAK;AAClF;AAGA,SAAS,aAAa,OAAwC;AAC5D,QAAM,OAAO,OAAO,KAAK;AACzB,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,OAAO,KAAK,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,eAAe,UAAU,SAAS,EAAE,SAAS,GAAG,CAAC;AACrF,WAAO;AACT,MAAI,CAAC,MAAM,+BAA+B,KAAK,WAAW,EAAG,QAAO;AACpE,MAAI,CAAC,MAAM,0BAA0B,KAAK,MAAM,EAAG,QAAO;AAC1D,MAAI,KAAK,YAAY,WAAc,OAAO,KAAK,YAAY,YAAY,CAAC,KAAK,KAAK,KAAK,OAAO;AAC5F,WAAO;AACT,SAAO;AAAA,IACL,aAAa,KAAK;AAAA,IAClB,QAAQ,KAAK;AAAA,IACb,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAkB,IAAI,CAAC;AAAA,EAC1E;AACF;AAMO,SAAS,wBAA0C,QAAW,SAA6B;AAChG,QAAM,OAAO,aAAa,OAAO;AACjC,MAAI,CAAC,KAAM,OAAM,IAAI,UAAU,0BAA0B;AACzD,QAAM,OAAO,OAAQ,OAA+B,KAAK;AACzD,SAAO,EAAE,GAAG,QAAQ,OAAO,EAAE,GAAG,MAAM,CAAC,yBAAyB,GAAG,KAAK,EAAE;AAC5E;AAQO,SAAS,8BAA8B,QAAyC;AACrF,QAAM,OAAO,OAAO,OAAO,OAAO,MAAM,GAAG,KAAK,IAAI,yBAAyB,CAAC;AAC9E,MAAI,CAAC,QAAQ,OAAO,KAAK,WAAW,SAAU,QAAO;AACrD,SAAO,aAAa;AAAA,IAClB,aAAa,KAAK;AAAA,IAClB,QAAQ,MAAM,0BAA0B,KAAK,MAAM,IAAI,KAAK,SAAS;AAAA,IACrE,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,EAChE,CAAC;AACH;","names":[]}

package/dist/managed-auth-session-sets.d.ts

@@ -112,6 +112,7 @@ export declare const StartManagedAuthSocialTransactionRequest: z.ZodObject<{
         github: "github";
         google: "google";
     }>;
+    signupChallengeToken: z.ZodOptional<z.ZodString>;
     attribution: z.ZodCatch<z.ZodOptional<z.ZodObject<{
         utmSource: z.ZodOptional<z.ZodString>;
         utmMedium: z.ZodOptional<z.ZodString>;

package/dist/managed-auth-session-sets.js

@@ -1,3 +1,15 @@
+import {
+  dateTime,
+  nonEmptyString,
+  nullableUuid,
+  optionalUuid,
+  string,
+  uuid
+} from "./chunk-AQYDZUJV.js";
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
 // src/managed-auth-session-sets.ts
 import { z } from "zod";
 var MANAGED_AUTH_SESSION_SET_MAX_SLOTS = 8;
@@ -5,158 +17,207 @@ var MANAGED_AUTH_TRANSACTION_TTL_SECONDS = 600;
 var MANAGED_AUTH_RETURN_INTENT_MAX_BYTES = 2048;
 var MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER = "x-opengeni-api-contract";
 var MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION = "2026-08-personal-only-organization-setup-v1";
-var ManagedAuthSessionSetMode = z.enum(["legacy", "dual", "broker"]);
-var ManagedAuthLoginSlotState = z.enum(["active", "reauth_required"]);
-var ManagedAuthVerifiedClaim = z.object({
-  kind: z.literal("email"),
-  value: z.string().email().max(320)
-});
-var ManagedAuthLoginSlot = z.object({
-  id: z.string().uuid(),
-  displayName: z.string().min(1).max(256),
-  verifiedClaim: ManagedAuthVerifiedClaim,
-  state: ManagedAuthLoginSlotState
-});
-var ManagedAuthSessionSetState = z.enum(["ready", "actor_change_required"]);
-var ManagedAuthSessionSetProjection = z.object({
-  mode: ManagedAuthSessionSetMode,
-  generation: z.string().regex(/^[1-9][0-9]*$/),
-  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),
-  csrfToken: z.string().min(32).max(512),
-  selectedSlotId: z.string().uuid().nullable(),
-  state: ManagedAuthSessionSetState,
-  slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS)
-});
-var ManagedAuthOperationIdentity = z.object({
-  operationId: z.string().uuid(),
-  expectedGeneration: z.string().regex(/^[1-9][0-9]*$/)
-});
+var ManagedAuthSessionSetMode = /* @__PURE__ */ defineSchema(
+  () => z.enum(["legacy", "dual", "broker"])
+);
+var ManagedAuthLoginSlotState = /* @__PURE__ */ defineSchema(
+  () => z.enum(["active", "reauth_required"])
+);
+var ManagedAuthVerifiedClaim = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    kind: z.literal("email"),
+    value: z.string().email().max(320)
+  })
+);
+var ManagedAuthLoginSlot = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    id: uuid,
+    displayName: z.string().min(1).max(256),
+    verifiedClaim: ManagedAuthVerifiedClaim,
+    state: ManagedAuthLoginSlotState
+  })
+);
+var ManagedAuthSessionSetState = /* @__PURE__ */ defineSchema(
+  () => z.enum(["ready", "actor_change_required"])
+);
+var ManagedAuthSessionSetProjection = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    mode: ManagedAuthSessionSetMode,
+    generation: string.regex(/^[1-9][0-9]*$/),
+    actorEpoch: string.regex(/^[1-9][0-9]*$/),
+    csrfToken: z.string().min(32).max(512),
+    selectedSlotId: nullableUuid,
+    state: ManagedAuthSessionSetState,
+    slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS)
+  })
+);
+var ManagedAuthOperationIdentity = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    operationId: uuid,
+    expectedGeneration: string.regex(/^[1-9][0-9]*$/)
+  })
+);
 var BootstrapManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;
-var ManagedAuthReturnIntent = z.string().min(1).superRefine((value, context) => {
-  if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {
-    context.addIssue({ code: "custom", message: "return intent exceeds its UTF-8 byte limit" });
-  }
-  if (!value.startsWith("/") || value.startsWith("//") || value.includes("?") || value.includes("#") || /[\u0000-\u001f\u007f\\]/.test(value)) {
-    context.addIssue({
-      code: "custom",
-      message: "return intent must be a safe same-origin path"
-    });
-    return;
-  }
-  try {
-    const parsed = new URL(value, "https://opengeni.invalid");
-    const uuid = "[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}";
-    const supportedPath = new RegExp(
-      `^/(?:sessions/${uuid}|workspaces/${uuid}(?:/sessions(?:/${uuid})?)?)$`,
-      "i"
-    );
-    if (parsed.origin !== "https://opengeni.invalid" || parsed.username || parsed.password || parsed.search || parsed.hash || !supportedPath.test(value) || parsed.pathname !== value) {
+var ManagedAuthReturnIntent = /* @__PURE__ */ defineSchema(
+  () => nonEmptyString.superRefine((value, context) => {
+    if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {
+      context.addIssue({ code: "custom", message: "return intent exceeds its UTF-8 byte limit" });
+    }
+    if (!value.startsWith("/") || value.startsWith("//") || value.includes("?") || value.includes("#") || /[\u0000-\u001f\u007f\\]/.test(value)) {
+      context.addIssue({
+        code: "custom",
+        message: "return intent must be a safe same-origin path"
+      });
+      return;
+    }
+    try {
+      const parsed = new URL(value, "https://opengeni.invalid");
+      const uuid2 = "[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}";
+      const supportedPath = new RegExp(
+        `^/(?:sessions/${uuid2}|workspaces/${uuid2}(?:/sessions(?:/${uuid2})?)?)$`,
+        "i"
+      );
+      if (parsed.origin !== "https://opengeni.invalid" || parsed.username || parsed.password || parsed.search || parsed.hash || !supportedPath.test(value) || parsed.pathname !== value) {
+        context.addIssue({
+          code: "custom",
+          message: "return intent contains unsafe authority data"
+        });
+      }
+    } catch {
+      context.addIssue({
+        code: "custom",
+        message: "return intent is not a valid same-origin path"
+      });
+    }
+  })
+);
+var BeginManagedAuthLoginTransactionRequest = /* @__PURE__ */ defineSchema(
+  () => ManagedAuthOperationIdentity.extend({
+    kind: z.enum(["add", "reauth"]),
+    slotId: optionalUuid,
+    returnIntent: ManagedAuthReturnIntent.optional()
+  }).superRefine((value, context) => {
+    if (value.kind === "reauth" !== Boolean(value.slotId)) {
       context.addIssue({
         code: "custom",
-        message: "return intent contains unsafe authority data"
+        path: ["slotId"],
+        message: "reauth requires exactly one slot id and add forbids one"
       });
     }
-  } catch {
-    context.addIssue({
-      code: "custom",
-      message: "return intent is not a valid same-origin path"
-    });
-  }
-});
-var BeginManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({
-  kind: z.enum(["add", "reauth"]),
-  slotId: z.string().uuid().optional(),
-  returnIntent: ManagedAuthReturnIntent.optional()
-}).superRefine((value, context) => {
-  if (value.kind === "reauth" !== Boolean(value.slotId)) {
-    context.addIssue({
-      code: "custom",
-      path: ["slotId"],
-      message: "reauth requires exactly one slot id and add forbids one"
-    });
-  }
-});
-var ManagedAuthLoginTransaction = z.object({
-  id: z.string().uuid(),
-  kind: z.enum(["add", "reauth"]),
-  expiresAt: z.string().datetime(),
-  returnIntentId: z.string().uuid().nullable()
-});
-var ManagedAuthSocialProvider = z.enum(["google", "github"]);
-var SocialStartAttributionValue = z.string().trim().min(1).max(100).regex(/^[A-Za-z0-9._~+-]+$/);
-var SocialStartAttribution = z.object({
-  utmSource: SocialStartAttributionValue.optional(),
-  utmMedium: SocialStartAttributionValue.optional(),
-  utmCampaign: SocialStartAttributionValue.optional(),
-  utmContent: SocialStartAttributionValue.optional(),
-  ref: SocialStartAttributionValue.optional()
-}).strict();
-var StartManagedAuthSocialTransactionRequest = ManagedAuthOperationIdentity.extend({
-  transactionId: z.string().uuid(),
-  provider: ManagedAuthSocialProvider,
-  /**
-   * Optional untrusted first-touch campaign tokens, used only by the
-   * content-free sign-up acquisition counter when this start creates a new
-   * account. Invalid attribution is dropped rather than failing the sign-in.
-   */
-  attribution: SocialStartAttribution.optional().catch(void 0)
-});
-var StartManagedAuthSocialTransactionResponse = z.object({
-  url: z.string().url().max(4096)
-});
-var CompleteManagedAuthEmailPasswordTransactionRequest = ManagedAuthOperationIdentity.extend({
-  transactionId: z.string().uuid(),
-  email: z.string().email().max(320),
-  password: z.string().min(1).max(1024)
-});
-var CompleteManagedAuthLoginTransactionResponse = z.object({
-  projection: ManagedAuthSessionSetProjection,
-  returnIntent: ManagedAuthReturnIntent.nullable()
-});
-var CancelManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({
-  transactionId: z.string().uuid()
-});
-var SelectManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({
-  slotId: z.string().uuid()
-});
-var LogoutManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({
-  slotId: z.string().uuid(),
-  replacementSlotId: z.string().uuid().nullable()
-});
+  })
+);
+var ManagedAuthLoginTransaction = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    id: uuid,
+    kind: z.enum(["add", "reauth"]),
+    expiresAt: dateTime,
+    returnIntentId: nullableUuid
+  })
+);
+var ManagedAuthSocialProvider = /* @__PURE__ */ defineSchema(
+  () => z.enum(["google", "github"])
+);
+var SocialStartAttributionValue = /* @__PURE__ */ defineSchema(
+  () => string.trim().min(1).max(100).regex(/^[A-Za-z0-9._~+-]+$/)
+);
+var SocialStartAttribution = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    utmSource: SocialStartAttributionValue.optional(),
+    utmMedium: SocialStartAttributionValue.optional(),
+    utmCampaign: SocialStartAttributionValue.optional(),
+    utmContent: SocialStartAttributionValue.optional(),
+    ref: SocialStartAttributionValue.optional()
+  }).strict()
+);
+var StartManagedAuthSocialTransactionRequest = /* @__PURE__ */ defineSchema(
+  () => ManagedAuthOperationIdentity.extend({
+    transactionId: uuid,
+    provider: ManagedAuthSocialProvider,
+    signupChallengeToken: z.string().max(2048).optional(),
+    /**
+     * Optional untrusted first-touch campaign tokens, used only by the
+     * content-free sign-up acquisition counter when this start creates a new
+     * account. Invalid attribution is dropped rather than failing the sign-in.
+     */
+    attribution: SocialStartAttribution.optional().catch(void 0)
+  })
+);
+var StartManagedAuthSocialTransactionResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    url: z.string().url().max(4096)
+  })
+);
+var CompleteManagedAuthEmailPasswordTransactionRequest = /* @__PURE__ */ defineSchema(
+  () => ManagedAuthOperationIdentity.extend({
+    transactionId: uuid,
+    email: z.string().email().max(320),
+    password: z.string().min(1).max(1024)
+  })
+);
+var CompleteManagedAuthLoginTransactionResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    projection: ManagedAuthSessionSetProjection,
+    returnIntent: ManagedAuthReturnIntent.nullable()
+  })
+);
+var CancelManagedAuthLoginTransactionRequest = /* @__PURE__ */ defineSchema(
+  () => ManagedAuthOperationIdentity.extend({
+    transactionId: uuid
+  })
+);
+var SelectManagedAuthLoginSlotRequest = /* @__PURE__ */ defineSchema(
+  () => ManagedAuthOperationIdentity.extend({
+    slotId: uuid
+  })
+);
+var LogoutManagedAuthLoginSlotRequest = /* @__PURE__ */ defineSchema(
+  () => ManagedAuthOperationIdentity.extend({
+    slotId: uuid,
+    replacementSlotId: nullableUuid
+  })
+);
 var LogoutManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;
-var ManagedAuthLogoutAllReceipt = z.object({
-  generation: z.string().regex(/^[1-9][0-9]*$/),
-  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),
-  state: z.literal("logged_out")
-});
-var ResolveManagedAuthDeepLinkRequest = z.object({
-  path: ManagedAuthReturnIntent
-});
-var ManagedAuthDeepLinkResolution = z.discriminatedUnion("kind", [
-  z.object({ kind: z.literal("current") }),
-  z.object({ kind: z.literal("switch_required"), slot: ManagedAuthLoginSlot }),
-  z.object({ kind: z.literal("unavailable") })
-]);
-var ManagedAuthSessionSetErrorCode = z.enum([
-  "actor_change_required",
-  "actor_mutation_in_flight",
-  "api_contract_changed",
-  "browser_session_set_required",
-  "browser_session_set_unavailable",
-  "generation_conflict",
-  "invalid_browser_session_set_request",
-  "invalid_transaction",
-  "managed_authentication_required",
-  "managed_authentication_unavailable",
-  "operation_outcome_unknown",
-  "operation_reused",
-  "origin_rejected",
-  "login_transaction_rate_limited",
-  "provider_route_blocked",
-  "slot_limit_reached",
-  "slot_already_exists",
-  "slot_unavailable"
-]);
+var ManagedAuthLogoutAllReceipt = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    generation: string.regex(/^[1-9][0-9]*$/),
+    actorEpoch: string.regex(/^[1-9][0-9]*$/),
+    state: z.literal("logged_out")
+  })
+);
+var ResolveManagedAuthDeepLinkRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    path: ManagedAuthReturnIntent
+  })
+);
+var ManagedAuthDeepLinkResolution = /* @__PURE__ */ defineSchema(
+  () => z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("current") }),
+    z.object({ kind: z.literal("switch_required"), slot: ManagedAuthLoginSlot }),
+    z.object({ kind: z.literal("unavailable") })
+  ])
+);
+var ManagedAuthSessionSetErrorCode = /* @__PURE__ */ defineSchema(
+  () => z.enum([
+    "actor_change_required",
+    "actor_mutation_in_flight",
+    "api_contract_changed",
+    "browser_session_set_required",
+    "browser_session_set_unavailable",
+    "generation_conflict",
+    "invalid_browser_session_set_request",
+    "invalid_transaction",
+    "managed_authentication_required",
+    "managed_authentication_unavailable",
+    "operation_outcome_unknown",
+    "operation_reused",
+    "origin_rejected",
+    "login_transaction_rate_limited",
+    "provider_route_blocked",
+    "slot_limit_reached",
+    "slot_already_exists",
+    "slot_unavailable"
+  ])
+);
 export {
   BeginManagedAuthLoginTransactionRequest,
   BootstrapManagedAuthSessionSetRequest,