@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/managed-auth-session-sets.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/managed-auth-session-sets.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const MANAGED_AUTH_SESSION_SET_MAX_SLOTS = 8 as const;\nexport const MANAGED_AUTH_TRANSACTION_TTL_SECONDS = 600 as const;\nexport const MANAGED_AUTH_RETURN_INTENT_MAX_BYTES = 2_048 as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER = \"x-opengeni-api-contract\" as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION =\n  \"2026-08-personal-only-organization-setup-v1\" as const;\n\nexport const ManagedAuthSessionSetMode = z.enum([\"legacy\", \"dual\", \"broker\"]);\nexport type ManagedAuthSessionSetMode = z.infer<typeof ManagedAuthSessionSetMode>;\n\nexport const ManagedAuthLoginSlotState = z.enum([\"active\", \"reauth_required\"]);\nexport type ManagedAuthLoginSlotState = z.infer<typeof ManagedAuthLoginSlotState>;\n\nexport const ManagedAuthVerifiedClaim = z.object({\n  kind: z.literal(\"email\"),\n  value: z.string().email().max(320),\n});\nexport type ManagedAuthVerifiedClaim = z.infer<typeof ManagedAuthVerifiedClaim>;\n\n/** Secret-free, browser-safe summary. Provider session ids and tokens never enter this shape. */\nexport const ManagedAuthLoginSlot = z.object({\n  id: z.string().uuid(),\n  displayName: z.string().min(1).max(256),\n  verifiedClaim: ManagedAuthVerifiedClaim,\n  state: ManagedAuthLoginSlotState,\n});\nexport type ManagedAuthLoginSlot = z.infer<typeof ManagedAuthLoginSlot>;\n\nexport const ManagedAuthSessionSetState = z.enum([\"ready\", \"actor_change_required\"]);\nexport type ManagedAuthSessionSetState = z.infer<typeof ManagedAuthSessionSetState>;\n\nexport const ManagedAuthSessionSetProjection = z.object({\n  mode: ManagedAuthSessionSetMode,\n  generation: z.string().regex(/^[1-9][0-9]*$/),\n  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n  csrfToken: z.string().min(32).max(512),\n  selectedSlotId: z.string().uuid().nullable(),\n  state: ManagedAuthSessionSetState,\n  slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS),\n});\nexport type ManagedAuthSessionSetProjection = z.infer<typeof ManagedAuthSessionSetProjection>;\n\nexport const ManagedAuthOperationIdentity = z.object({\n  operationId: z.string().uuid(),\n  expectedGeneration: z.string().regex(/^[1-9][0-9]*$/),\n});\nexport type ManagedAuthOperationIdentity = z.infer<typeof ManagedAuthOperationIdentity>;\n\nexport const BootstrapManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type BootstrapManagedAuthSessionSetRequest = z.infer<\n  typeof BootstrapManagedAuthSessionSetRequest\n>;\n\nexport const ManagedAuthReturnIntent = z\n  .string()\n  .min(1)\n  .superRefine((value, context) => {\n    if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {\n      context.addIssue({ code: \"custom\", message: \"return intent exceeds its UTF-8 byte limit\" });\n    }\n    if (\n      !value.startsWith(\"/\") ||\n      value.startsWith(\"//\") ||\n      value.includes(\"?\") ||\n      value.includes(\"#\") ||\n      /[\\u0000-\\u001f\\u007f\\\\]/.test(value)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent must be a safe same-origin path\",\n      });\n      return;\n    }\n    try {\n      const parsed = new URL(value, \"https://opengeni.invalid\");\n      const uuid = \"[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\";\n      const supportedPath = new RegExp(\n        `^/(?:sessions/${uuid}|workspaces/${uuid}(?:/sessions(?:/${uuid})?)?)$`,\n        \"i\",\n      );\n      if (\n        parsed.origin !== \"https://opengeni.invalid\" ||\n        parsed.username ||\n        parsed.password ||\n        parsed.search ||\n        parsed.hash ||\n        !supportedPath.test(value) ||\n        parsed.pathname !== value\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"return intent contains unsafe authority data\",\n        });\n      }\n    } catch {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent is not a valid same-origin path\",\n      });\n    }\n  });\n\nexport const BeginManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({\n  kind: z.enum([\"add\", \"reauth\"]),\n  slotId: z.string().uuid().optional(),\n  returnIntent: ManagedAuthReturnIntent.optional(),\n}).superRefine((value, context) => {\n  if ((value.kind === \"reauth\") !== Boolean(value.slotId)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"slotId\"],\n      message: \"reauth requires exactly one slot id and add forbids one\",\n    });\n  }\n});\nexport type BeginManagedAuthLoginTransactionRequest = z.infer<\n  typeof BeginManagedAuthLoginTransactionRequest\n>;\n\nexport const ManagedAuthLoginTransaction = z.object({\n  id: z.string().uuid(),\n  kind: z.enum([\"add\", \"reauth\"]),\n  expiresAt: z.string().datetime(),\n  returnIntentId: z.string().uuid().nullable(),\n});\nexport type ManagedAuthLoginTransaction = z.infer<typeof ManagedAuthLoginTransaction>;\n\nexport const ManagedAuthSocialProvider = z.enum([\"google\", \"github\"]);\nexport type ManagedAuthSocialProvider = z.infer<typeof ManagedAuthSocialProvider>;\n\n/**\n * Mirrors `SignupAttribution` from `./signup-attribution` (a contract test pins\n * them together). Declared here, not imported, so the browser session-set\n * client does not pull the attribution module into a new shared web chunk.\n */\nconst SocialStartAttributionValue = z\n  .string()\n  .trim()\n  .min(1)\n  .max(100)\n  .regex(/^[A-Za-z0-9._~+-]+$/);\nconst SocialStartAttribution = z\n  .object({\n    utmSource: SocialStartAttributionValue.optional(),\n    utmMedium: SocialStartAttributionValue.optional(),\n    utmCampaign: SocialStartAttributionValue.optional(),\n    utmContent: SocialStartAttributionValue.optional(),\n    ref: SocialStartAttributionValue.optional(),\n  })\n  .strict();\n\nexport const StartManagedAuthSocialTransactionRequest = ManagedAuthOperationIdentity.extend({\n  transactionId: z.string().uuid(),\n  provider: ManagedAuthSocialProvider,\n  /**\n   * Optional untrusted first-touch campaign tokens, used only by the\n   * content-free sign-up acquisition counter when this start creates a new\n   * account. Invalid attribution is dropped rather than failing the sign-in.\n   */\n  attribution: SocialStartAttribution.optional().catch(undefined),\n});\nexport type StartManagedAuthSocialTransactionRequest = z.infer<\n  typeof StartManagedAuthSocialTransactionRequest\n>;\n\nexport const StartManagedAuthSocialTransactionResponse = z.object({\n  url: z.string().url().max(4_096),\n});\nexport type StartManagedAuthSocialTransactionResponse = z.infer<\n  typeof StartManagedAuthSocialTransactionResponse\n>;\n\nexport const CompleteManagedAuthEmailPasswordTransactionRequest =\n  ManagedAuthOperationIdentity.extend({\n    transactionId: z.string().uuid(),\n    email: z.string().email().max(320),\n    password: z.string().min(1).max(1_024),\n  });\nexport type CompleteManagedAuthEmailPasswordTransactionRequest = z.infer<\n  typeof CompleteManagedAuthEmailPasswordTransactionRequest\n>;\n\nexport const CompleteManagedAuthLoginTransactionResponse = z.object({\n  projection: ManagedAuthSessionSetProjection,\n  returnIntent: ManagedAuthReturnIntent.nullable(),\n});\nexport type CompleteManagedAuthLoginTransactionResponse = z.infer<\n  typeof CompleteManagedAuthLoginTransactionResponse\n>;\n\nexport const CancelManagedAuthLoginTransactionRequest = ManagedAuthOperationIdentity.extend({\n  transactionId: z.string().uuid(),\n});\nexport type CancelManagedAuthLoginTransactionRequest = z.infer<\n  typeof CancelManagedAuthLoginTransactionRequest\n>;\n\nexport const SelectManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({\n  slotId: z.string().uuid(),\n});\nexport type SelectManagedAuthLoginSlotRequest = z.infer<typeof SelectManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthLoginSlotRequest = ManagedAuthOperationIdentity.extend({\n  slotId: z.string().uuid(),\n  replacementSlotId: z.string().uuid().nullable(),\n});\nexport type LogoutManagedAuthLoginSlotRequest = z.infer<typeof LogoutManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type LogoutManagedAuthSessionSetRequest = z.infer<typeof LogoutManagedAuthSessionSetRequest>;\n\nexport const ManagedAuthLogoutAllReceipt = z.object({\n  generation: z.string().regex(/^[1-9][0-9]*$/),\n  actorEpoch: z.string().regex(/^[1-9][0-9]*$/),\n  state: z.literal(\"logged_out\"),\n});\nexport type ManagedAuthLogoutAllReceipt = z.infer<typeof ManagedAuthLogoutAllReceipt>;\n\nexport const ResolveManagedAuthDeepLinkRequest = z.object({\n  path: ManagedAuthReturnIntent,\n});\nexport type ResolveManagedAuthDeepLinkRequest = z.infer<typeof ResolveManagedAuthDeepLinkRequest>;\n\nexport const ManagedAuthDeepLinkResolution = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"current\") }),\n  z.object({ kind: z.literal(\"switch_required\"), slot: ManagedAuthLoginSlot }),\n  z.object({ kind: z.literal(\"unavailable\") }),\n]);\nexport type ManagedAuthDeepLinkResolution = z.infer<typeof ManagedAuthDeepLinkResolution>;\n\nexport const ManagedAuthSessionSetErrorCode = z.enum([\n  \"actor_change_required\",\n  \"actor_mutation_in_flight\",\n  \"api_contract_changed\",\n  \"browser_session_set_required\",\n  \"browser_session_set_unavailable\",\n  \"generation_conflict\",\n  \"invalid_browser_session_set_request\",\n  \"invalid_transaction\",\n  \"managed_authentication_required\",\n  \"managed_authentication_unavailable\",\n  \"operation_outcome_unknown\",\n  \"operation_reused\",\n  \"origin_rejected\",\n  \"login_transaction_rate_limited\",\n  \"provider_route_blocked\",\n  \"slot_limit_reached\",\n  \"slot_already_exists\",\n  \"slot_unavailable\",\n]);\nexport type ManagedAuthSessionSetErrorCode = z.infer<typeof ManagedAuthSessionSetErrorCode>;\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,qCAAqC;AAC3C,IAAM,uCAAuC;AAC7C,IAAM,uCAAuC;AAC7C,IAAM,+CAA+C;AACrD,IAAM,iDACX;AAEK,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,QAAQ,QAAQ,CAAC;AAGrE,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,iBAAiB,CAAC;AAGtE,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,MAAM,EAAE,QAAQ,OAAO;AAAA,EACvB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AACnC,CAAC;AAIM,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe;AAAA,EACf,OAAO;AACT,CAAC;AAGM,IAAM,6BAA6B,EAAE,KAAK,CAAC,SAAS,uBAAuB,CAAC;AAG5E,IAAM,kCAAkC,EAAE,OAAO;AAAA,EACtD,MAAM;AAAA,EACN,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,GAAG;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO;AAAA,EACP,OAAO,EAAE,MAAM,oBAAoB,EAAE,IAAI,kCAAkC;AAC7E,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,oBAAoB,EAAE,OAAO,EAAE,MAAM,eAAe;AACtD,CAAC;AAGM,IAAM,wCAAwC;AAK9C,IAAM,0BAA0B,EACpC,OAAO,EACP,IAAI,CAAC,EACL,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,aAAa,sCAAsC;AACrF,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,6CAA6C,CAAC;AAAA,EAC5F;AACA,MACE,CAAC,MAAM,WAAW,GAAG,KACrB,MAAM,WAAW,IAAI,KACrB,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,KAClB,0BAA0B,KAAK,KAAK,GACpC;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,OAAO,0BAA0B;AACxD,UAAM,OAAO;AACb,UAAM,gBAAgB,IAAI;AAAA,MACxB,iBAAiB,IAAI,eAAe,IAAI,mBAAmB,IAAI;AAAA,MAC/D;AAAA,IACF;AACA,QACE,OAAO,WAAW,8BAClB,OAAO,YACP,OAAO,YACP,OAAO,UACP,OAAO,QACP,CAAC,cAAc,KAAK,KAAK,KACzB,OAAO,aAAa,OACpB;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AACN,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAEI,IAAM,0CAA0C,6BAA6B,OAAO;AAAA,EACzF,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,cAAc,wBAAwB,SAAS;AACjD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,MAAK,MAAM,SAAS,aAAc,QAAQ,MAAM,MAAM,GAAG;AACvD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAKM,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,4BAA4B,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAQpE,IAAM,8BAA8B,EACjC,OAAO,EACP,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,qBAAqB;AAC9B,IAAM,yBAAyB,EAC5B,OAAO;AAAA,EACN,WAAW,4BAA4B,SAAS;AAAA,EAChD,WAAW,4BAA4B,SAAS;AAAA,EAChD,aAAa,4BAA4B,SAAS;AAAA,EAClD,YAAY,4BAA4B,SAAS;AAAA,EACjD,KAAK,4BAA4B,SAAS;AAC5C,CAAC,EACA,OAAO;AAEH,IAAM,2CAA2C,6BAA6B,OAAO;AAAA,EAC1F,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMV,aAAa,uBAAuB,SAAS,EAAE,MAAM,MAAS;AAChE,CAAC;AAKM,IAAM,4CAA4C,EAAE,OAAO;AAAA,EAChE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAK;AACjC,CAAC;AAKM,IAAM,qDACX,6BAA6B,OAAO;AAAA,EAClC,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACjC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK;AACvC,CAAC;AAKI,IAAM,8CAA8C,EAAE,OAAO;AAAA,EAClE,YAAY;AAAA,EACZ,cAAc,wBAAwB,SAAS;AACjD,CAAC;AAKM,IAAM,2CAA2C,6BAA6B,OAAO;AAAA,EAC1F,eAAe,EAAE,OAAO,EAAE,KAAK;AACjC,CAAC;AAKM,IAAM,oCAAoC,6BAA6B,OAAO;AAAA,EACnF,QAAQ,EAAE,OAAO,EAAE,KAAK;AAC1B,CAAC;AAGM,IAAM,oCAAoC,6BAA6B,OAAO;AAAA,EACnF,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAChD,CAAC;AAGM,IAAM,qCAAqC;AAG3C,IAAM,8BAA8B,EAAE,OAAO;AAAA,EAClD,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,YAAY,EAAE,OAAO,EAAE,MAAM,eAAe;AAAA,EAC5C,OAAO,EAAE,QAAQ,YAAY;AAC/B,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,MAAM;AACR,CAAC;AAGM,IAAM,gCAAgC,EAAE,mBAAmB,QAAQ;AAAA,EACxE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;AAAA,EACvC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,iBAAiB,GAAG,MAAM,qBAAqB,CAAC;AAAA,EAC3E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,aAAa,EAAE,CAAC;AAC7C,CAAC;AAGM,IAAM,iCAAiC,EAAE,KAAK;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":[]}
+{"version":3,"sources":["../src/managed-auth-session-sets.ts"],"sourcesContent":["import * as primitives from \"./primitives\";\nimport { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nexport const MANAGED_AUTH_SESSION_SET_MAX_SLOTS = 8 as const;\nexport const MANAGED_AUTH_TRANSACTION_TTL_SECONDS = 600 as const;\nexport const MANAGED_AUTH_RETURN_INTENT_MAX_BYTES = 2_048 as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER = \"x-opengeni-api-contract\" as const;\nexport const MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION =\n  \"2026-08-personal-only-organization-setup-v1\" as const;\n\nexport const ManagedAuthSessionSetMode = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"legacy\", \"dual\", \"broker\"]),\n);\nexport type ManagedAuthSessionSetMode = z.infer<typeof ManagedAuthSessionSetMode>;\n\nexport const ManagedAuthLoginSlotState = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"active\", \"reauth_required\"]),\n);\nexport type ManagedAuthLoginSlotState = z.infer<typeof ManagedAuthLoginSlotState>;\n\nexport const ManagedAuthVerifiedClaim = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    kind: z.literal(\"email\"),\n    value: z.string().email().max(320),\n  }),\n);\nexport type ManagedAuthVerifiedClaim = z.infer<typeof ManagedAuthVerifiedClaim>;\n\n/** Secret-free, browser-safe summary. Provider session ids and tokens never enter this shape. */\nexport const ManagedAuthLoginSlot = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    id: primitives.uuid,\n    displayName: z.string().min(1).max(256),\n    verifiedClaim: ManagedAuthVerifiedClaim,\n    state: ManagedAuthLoginSlotState,\n  }),\n);\nexport type ManagedAuthLoginSlot = z.infer<typeof ManagedAuthLoginSlot>;\n\nexport const ManagedAuthSessionSetState = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"ready\", \"actor_change_required\"]),\n);\nexport type ManagedAuthSessionSetState = z.infer<typeof ManagedAuthSessionSetState>;\n\nexport const ManagedAuthSessionSetProjection = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    mode: ManagedAuthSessionSetMode,\n    generation: primitives.string.regex(/^[1-9][0-9]*$/),\n    actorEpoch: primitives.string.regex(/^[1-9][0-9]*$/),\n    csrfToken: z.string().min(32).max(512),\n    selectedSlotId: primitives.nullableUuid,\n    state: ManagedAuthSessionSetState,\n    slots: z.array(ManagedAuthLoginSlot).max(MANAGED_AUTH_SESSION_SET_MAX_SLOTS),\n  }),\n);\nexport type ManagedAuthSessionSetProjection = z.infer<typeof ManagedAuthSessionSetProjection>;\n\nexport const ManagedAuthOperationIdentity = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    operationId: primitives.uuid,\n    expectedGeneration: primitives.string.regex(/^[1-9][0-9]*$/),\n  }),\n);\nexport type ManagedAuthOperationIdentity = z.infer<typeof ManagedAuthOperationIdentity>;\n\nexport const BootstrapManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type BootstrapManagedAuthSessionSetRequest = z.infer<\n  typeof BootstrapManagedAuthSessionSetRequest\n>;\n\nexport const ManagedAuthReturnIntent = /* @__PURE__ */ defineSchema(() =>\n  primitives.nonEmptyString.superRefine((value, context) => {\n    if (new TextEncoder().encode(value).byteLength > MANAGED_AUTH_RETURN_INTENT_MAX_BYTES) {\n      context.addIssue({ code: \"custom\", message: \"return intent exceeds its UTF-8 byte limit\" });\n    }\n    if (\n      !value.startsWith(\"/\") ||\n      value.startsWith(\"//\") ||\n      value.includes(\"?\") ||\n      value.includes(\"#\") ||\n      /[\\u0000-\\u001f\\u007f\\\\]/.test(value)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent must be a safe same-origin path\",\n      });\n      return;\n    }\n    try {\n      const parsed = new URL(value, \"https://opengeni.invalid\");\n      const uuid = \"[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\";\n      const supportedPath = new RegExp(\n        `^/(?:sessions/${uuid}|workspaces/${uuid}(?:/sessions(?:/${uuid})?)?)$`,\n        \"i\",\n      );\n      if (\n        parsed.origin !== \"https://opengeni.invalid\" ||\n        parsed.username ||\n        parsed.password ||\n        parsed.search ||\n        parsed.hash ||\n        !supportedPath.test(value) ||\n        parsed.pathname !== value\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"return intent contains unsafe authority data\",\n        });\n      }\n    } catch {\n      context.addIssue({\n        code: \"custom\",\n        message: \"return intent is not a valid same-origin path\",\n      });\n    }\n  }),\n);\n\nexport const BeginManagedAuthLoginTransactionRequest = /* @__PURE__ */ defineSchema(() =>\n  ManagedAuthOperationIdentity.extend({\n    kind: z.enum([\"add\", \"reauth\"]),\n    slotId: primitives.optionalUuid,\n    returnIntent: ManagedAuthReturnIntent.optional(),\n  }).superRefine((value, context) => {\n    if ((value.kind === \"reauth\") !== Boolean(value.slotId)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"slotId\"],\n        message: \"reauth requires exactly one slot id and add forbids one\",\n      });\n    }\n  }),\n);\nexport type BeginManagedAuthLoginTransactionRequest = z.infer<\n  typeof BeginManagedAuthLoginTransactionRequest\n>;\n\nexport const ManagedAuthLoginTransaction = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    id: primitives.uuid,\n    kind: z.enum([\"add\", \"reauth\"]),\n    expiresAt: primitives.dateTime,\n    returnIntentId: primitives.nullableUuid,\n  }),\n);\nexport type ManagedAuthLoginTransaction = z.infer<typeof ManagedAuthLoginTransaction>;\n\nexport const ManagedAuthSocialProvider = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"google\", \"github\"]),\n);\nexport type ManagedAuthSocialProvider = z.infer<typeof ManagedAuthSocialProvider>;\n\n/**\n * Mirrors `SignupAttribution` from `./signup-attribution` (a contract test pins\n * them together). Declared here, not imported, so the browser session-set\n * client does not pull the attribution module into a new shared web chunk.\n */\nconst SocialStartAttributionValue = /* @__PURE__ */ defineSchema(() =>\n  primitives.string\n    .trim()\n    .min(1)\n    .max(100)\n    .regex(/^[A-Za-z0-9._~+-]+$/),\n);\nconst SocialStartAttribution = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      utmSource: SocialStartAttributionValue.optional(),\n      utmMedium: SocialStartAttributionValue.optional(),\n      utmCampaign: SocialStartAttributionValue.optional(),\n      utmContent: SocialStartAttributionValue.optional(),\n      ref: SocialStartAttributionValue.optional(),\n    })\n    .strict(),\n);\n\nexport const StartManagedAuthSocialTransactionRequest = /* @__PURE__ */ defineSchema(() =>\n  ManagedAuthOperationIdentity.extend({\n    transactionId: primitives.uuid,\n    provider: ManagedAuthSocialProvider,\n    signupChallengeToken: z.string().max(2048).optional(),\n    /**\n     * Optional untrusted first-touch campaign tokens, used only by the\n     * content-free sign-up acquisition counter when this start creates a new\n     * account. Invalid attribution is dropped rather than failing the sign-in.\n     */\n    attribution: SocialStartAttribution.optional().catch(undefined),\n  }),\n);\nexport type StartManagedAuthSocialTransactionRequest = z.infer<\n  typeof StartManagedAuthSocialTransactionRequest\n>;\n\nexport const StartManagedAuthSocialTransactionResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    url: z.string().url().max(4_096),\n  }),\n);\nexport type StartManagedAuthSocialTransactionResponse = z.infer<\n  typeof StartManagedAuthSocialTransactionResponse\n>;\n\nexport const CompleteManagedAuthEmailPasswordTransactionRequest =\n  /* @__PURE__ */ defineSchema(() =>\n    ManagedAuthOperationIdentity.extend({\n      transactionId: primitives.uuid,\n      email: z.string().email().max(320),\n      password: z.string().min(1).max(1_024),\n    }),\n  );\nexport type CompleteManagedAuthEmailPasswordTransactionRequest = z.infer<\n  typeof CompleteManagedAuthEmailPasswordTransactionRequest\n>;\n\nexport const CompleteManagedAuthLoginTransactionResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    projection: ManagedAuthSessionSetProjection,\n    returnIntent: ManagedAuthReturnIntent.nullable(),\n  }),\n);\nexport type CompleteManagedAuthLoginTransactionResponse = z.infer<\n  typeof CompleteManagedAuthLoginTransactionResponse\n>;\n\nexport const CancelManagedAuthLoginTransactionRequest = /* @__PURE__ */ defineSchema(() =>\n  ManagedAuthOperationIdentity.extend({\n    transactionId: primitives.uuid,\n  }),\n);\nexport type CancelManagedAuthLoginTransactionRequest = z.infer<\n  typeof CancelManagedAuthLoginTransactionRequest\n>;\n\nexport const SelectManagedAuthLoginSlotRequest = /* @__PURE__ */ defineSchema(() =>\n  ManagedAuthOperationIdentity.extend({\n    slotId: primitives.uuid,\n  }),\n);\nexport type SelectManagedAuthLoginSlotRequest = z.infer<typeof SelectManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthLoginSlotRequest = /* @__PURE__ */ defineSchema(() =>\n  ManagedAuthOperationIdentity.extend({\n    slotId: primitives.uuid,\n    replacementSlotId: primitives.nullableUuid,\n  }),\n);\nexport type LogoutManagedAuthLoginSlotRequest = z.infer<typeof LogoutManagedAuthLoginSlotRequest>;\n\nexport const LogoutManagedAuthSessionSetRequest = ManagedAuthOperationIdentity;\nexport type LogoutManagedAuthSessionSetRequest = z.infer<typeof LogoutManagedAuthSessionSetRequest>;\n\nexport const ManagedAuthLogoutAllReceipt = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    generation: primitives.string.regex(/^[1-9][0-9]*$/),\n    actorEpoch: primitives.string.regex(/^[1-9][0-9]*$/),\n    state: z.literal(\"logged_out\"),\n  }),\n);\nexport type ManagedAuthLogoutAllReceipt = z.infer<typeof ManagedAuthLogoutAllReceipt>;\n\nexport const ResolveManagedAuthDeepLinkRequest = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    path: ManagedAuthReturnIntent,\n  }),\n);\nexport type ResolveManagedAuthDeepLinkRequest = z.infer<typeof ResolveManagedAuthDeepLinkRequest>;\n\nexport const ManagedAuthDeepLinkResolution = /* @__PURE__ */ defineSchema(() =>\n  z.discriminatedUnion(\"kind\", [\n    z.object({ kind: z.literal(\"current\") }),\n    z.object({ kind: z.literal(\"switch_required\"), slot: ManagedAuthLoginSlot }),\n    z.object({ kind: z.literal(\"unavailable\") }),\n  ]),\n);\nexport type ManagedAuthDeepLinkResolution = z.infer<typeof ManagedAuthDeepLinkResolution>;\n\nexport const ManagedAuthSessionSetErrorCode = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\n    \"actor_change_required\",\n    \"actor_mutation_in_flight\",\n    \"api_contract_changed\",\n    \"browser_session_set_required\",\n    \"browser_session_set_unavailable\",\n    \"generation_conflict\",\n    \"invalid_browser_session_set_request\",\n    \"invalid_transaction\",\n    \"managed_authentication_required\",\n    \"managed_authentication_unavailable\",\n    \"operation_outcome_unknown\",\n    \"operation_reused\",\n    \"origin_rejected\",\n    \"login_transaction_rate_limited\",\n    \"provider_route_blocked\",\n    \"slot_limit_reached\",\n    \"slot_already_exists\",\n    \"slot_unavailable\",\n  ]),\n);\nexport type ManagedAuthSessionSetErrorCode = z.infer<typeof ManagedAuthSessionSetErrorCode>;\n"],"mappings":";;;;;;;;;;;;;AAEA,SAAS,SAAS;AAEX,IAAM,qCAAqC;AAC3C,IAAM,uCAAuC;AAC7C,IAAM,uCAAuC;AAC7C,IAAM,+CAA+C;AACrD,IAAM,iDACX;AAEK,IAAM,4BAA4C;AAAA,EAAa,MACpE,EAAE,KAAK,CAAC,UAAU,QAAQ,QAAQ,CAAC;AACrC;AAGO,IAAM,4BAA4C;AAAA,EAAa,MACpE,EAAE,KAAK,CAAC,UAAU,iBAAiB,CAAC;AACtC;AAGO,IAAM,2BAA2C;AAAA,EAAa,MACnE,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,OAAO;AAAA,IACvB,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACnC,CAAC;AACH;AAIO,IAAM,uBAAuC;AAAA,EAAa,MAC/D,EAAE,OAAO;AAAA,IACP,IAAe;AAAA,IACf,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACtC,eAAe;AAAA,IACf,OAAO;AAAA,EACT,CAAC;AACH;AAGO,IAAM,6BAA6C;AAAA,EAAa,MACrE,EAAE,KAAK,CAAC,SAAS,uBAAuB,CAAC;AAC3C;AAGO,IAAM,kCAAkD;AAAA,EAAa,MAC1E,EAAE,OAAO;AAAA,IACP,MAAM;AAAA,IACN,YAAuB,OAAO,MAAM,eAAe;AAAA,IACnD,YAAuB,OAAO,MAAM,eAAe;AAAA,IACnD,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,GAAG;AAAA,IACrC,gBAA2B;AAAA,IAC3B,OAAO;AAAA,IACP,OAAO,EAAE,MAAM,oBAAoB,EAAE,IAAI,kCAAkC;AAAA,EAC7E,CAAC;AACH;AAGO,IAAM,+BAA+C;AAAA,EAAa,MACvE,EAAE,OAAO;AAAA,IACP,aAAwB;AAAA,IACxB,oBAA+B,OAAO,MAAM,eAAe;AAAA,EAC7D,CAAC;AACH;AAGO,IAAM,wCAAwC;AAK9C,IAAM,0BAA0C;AAAA,EAAa,MACvD,eAAe,YAAY,CAAC,OAAO,YAAY;AACxD,QAAI,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,aAAa,sCAAsC;AACrF,cAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,6CAA6C,CAAC;AAAA,IAC5F;AACA,QACE,CAAC,MAAM,WAAW,GAAG,KACrB,MAAM,WAAW,IAAI,KACrB,MAAM,SAAS,GAAG,KAClB,MAAM,SAAS,GAAG,KAClB,0BAA0B,KAAK,KAAK,GACpC;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AACD;AAAA,IACF;AACA,QAAI;AACF,YAAM,SAAS,IAAI,IAAI,OAAO,0BAA0B;AACxD,YAAMA,QAAO;AACb,YAAM,gBAAgB,IAAI;AAAA,QACxB,iBAAiBA,KAAI,eAAeA,KAAI,mBAAmBA,KAAI;AAAA,QAC/D;AAAA,MACF;AACA,UACE,OAAO,WAAW,8BAClB,OAAO,YACP,OAAO,YACP,OAAO,UACP,OAAO,QACP,CAAC,cAAc,KAAK,KAAK,KACzB,OAAO,aAAa,OACpB;AACA,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF,QAAQ;AACN,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,IAAM,0CAA0D;AAAA,EAAa,MAClF,6BAA6B,OAAO;AAAA,IAClC,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,IAC9B,QAAmB;AAAA,IACnB,cAAc,wBAAwB,SAAS;AAAA,EACjD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,QAAK,MAAM,SAAS,aAAc,QAAQ,MAAM,MAAM,GAAG;AACvD,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,QAAQ;AAAA,QACf,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAKO,IAAM,8BAA8C;AAAA,EAAa,MACtE,EAAE,OAAO;AAAA,IACP,IAAe;AAAA,IACf,MAAM,EAAE,KAAK,CAAC,OAAO,QAAQ,CAAC;AAAA,IAC9B,WAAsB;AAAA,IACtB,gBAA2B;AAAA,EAC7B,CAAC;AACH;AAGO,IAAM,4BAA4C;AAAA,EAAa,MACpE,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAC7B;AAQA,IAAM,8BAA8C;AAAA,EAAa,MACpD,OACR,KAAK,EACL,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,qBAAqB;AAChC;AACA,IAAM,yBAAyC;AAAA,EAAa,MAC1D,EACG,OAAO;AAAA,IACN,WAAW,4BAA4B,SAAS;AAAA,IAChD,WAAW,4BAA4B,SAAS;AAAA,IAChD,aAAa,4BAA4B,SAAS;AAAA,IAClD,YAAY,4BAA4B,SAAS;AAAA,IACjD,KAAK,4BAA4B,SAAS;AAAA,EAC5C,CAAC,EACA,OAAO;AACZ;AAEO,IAAM,2CAA2D;AAAA,EAAa,MACnF,6BAA6B,OAAO;AAAA,IAClC,eAA0B;AAAA,IAC1B,UAAU;AAAA,IACV,sBAAsB,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAMpD,aAAa,uBAAuB,SAAS,EAAE,MAAM,MAAS;AAAA,EAChE,CAAC;AACH;AAKO,IAAM,4CAA4D;AAAA,EAAa,MACpF,EAAE,OAAO;AAAA,IACP,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAK;AAAA,EACjC,CAAC;AACH;AAKO,IAAM,qDACK;AAAA,EAAa,MAC3B,6BAA6B,OAAO;AAAA,IAClC,eAA0B;AAAA,IAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,IACjC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAK;AAAA,EACvC,CAAC;AACH;AAKK,IAAM,8CAA8D;AAAA,EAAa,MACtF,EAAE,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc,wBAAwB,SAAS;AAAA,EACjD,CAAC;AACH;AAKO,IAAM,2CAA2D;AAAA,EAAa,MACnF,6BAA6B,OAAO;AAAA,IAClC,eAA0B;AAAA,EAC5B,CAAC;AACH;AAKO,IAAM,oCAAoD;AAAA,EAAa,MAC5E,6BAA6B,OAAO;AAAA,IAClC,QAAmB;AAAA,EACrB,CAAC;AACH;AAGO,IAAM,oCAAoD;AAAA,EAAa,MAC5E,6BAA6B,OAAO;AAAA,IAClC,QAAmB;AAAA,IACnB,mBAA8B;AAAA,EAChC,CAAC;AACH;AAGO,IAAM,qCAAqC;AAG3C,IAAM,8BAA8C;AAAA,EAAa,MACtE,EAAE,OAAO;AAAA,IACP,YAAuB,OAAO,MAAM,eAAe;AAAA,IACnD,YAAuB,OAAO,MAAM,eAAe;AAAA,IACnD,OAAO,EAAE,QAAQ,YAAY;AAAA,EAC/B,CAAC;AACH;AAGO,IAAM,oCAAoD;AAAA,EAAa,MAC5E,EAAE,OAAO;AAAA,IACP,MAAM;AAAA,EACR,CAAC;AACH;AAGO,IAAM,gCAAgD;AAAA,EAAa,MACxE,EAAE,mBAAmB,QAAQ;AAAA,IAC3B,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC;AAAA,IACvC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,iBAAiB,GAAG,MAAM,qBAAqB,CAAC;AAAA,IAC3E,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,aAAa,EAAE,CAAC;AAAA,EAC7C,CAAC;AACH;AAGO,IAAM,iCAAiD;AAAA,EAAa,MACzE,EAAE,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;","names":["uuid"]}

package/dist/managed-sign-in-methods.d.ts

@@ -3,6 +3,63 @@ export declare const ManagedSignInProvider: z.ZodEnum<{
     github: "github";
     google: "google";
 }>;
+export { accountContactEmail, isPasskeyOnlyAccountEmail, PASSKEY_ONLY_ACCOUNT_EMAIL_DOMAIN, passkeyOnlyAccountEmail, } from "./passkey-only-account.js";
+/** A WebAuthn credential a person registered, without its key material. */
+export declare const ManagedPasskey: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    createdAt: z.ZodString;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    backedUp: z.ZodBoolean;
+}, z.core.$strip>;
+export type ManagedPasskey = z.infer<typeof ManagedPasskey>;
+/**
+ * A browser's WebAuthn response, exactly as `navigator.credentials` produced
+ * it in JSON form. The server verifies it; nothing in it is trusted before.
+ */
+export declare const ManagedPasskeyCredentialResponse: z.ZodObject<{
+    id: z.ZodString;
+    rawId: z.ZodString;
+    type: z.ZodLiteral<"public-key">;
+    response: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    clientExtensionResults: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    authenticatorAttachment: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+/** Options for one WebAuthn ceremony, and the single-use id that answers it. */
+export declare const ManagedPasskeyCeremony: z.ZodObject<{
+    challengeId: z.ZodString;
+    options: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+export type ManagedPasskeyCeremony = z.infer<typeof ManagedPasskeyCeremony>;
+export declare const ManagedPasskeySignInRequest: z.ZodObject<{
+    challengeId: z.ZodString;
+    response: z.ZodObject<{
+        id: z.ZodString;
+        rawId: z.ZodString;
+        type: z.ZodLiteral<"public-key">;
+        response: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        clientExtensionResults: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        authenticatorAttachment: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>;
+}, z.core.$strict>;
+export declare const ManagedPasskeySignUpOptionsRequest: z.ZodObject<{
+    name: z.ZodString;
+    signupChallengeToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const ManagedPasskeySignUpRequest: z.ZodObject<{
+    challengeId: z.ZodString;
+    response: z.ZodObject<{
+        id: z.ZodString;
+        rawId: z.ZodString;
+        type: z.ZodLiteral<"public-key">;
+        response: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        clientExtensionResults: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        authenticatorAttachment: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>;
+}, z.core.$strict>;
+export declare const ManagedPasskeySignInResponse: z.ZodObject<{
+    signedIn: z.ZodBoolean;
+}, z.core.$strip>;
 export declare const ManagedSignInMethods: z.ZodObject<{
     identityId: z.ZodString;
     email: z.ZodString;
@@ -20,6 +77,15 @@ export declare const ManagedSignInMethods: z.ZodObject<{
         canDisconnect: z.ZodBoolean;
         implicitRelinkingSuppressed: z.ZodBoolean;
     }, z.core.$strip>>;
+    passkeys: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        createdAt: z.ZodString;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        backedUp: z.ZodBoolean;
+    }, z.core.$strip>>>;
+    passkeysAvailable: z.ZodDefault<z.ZodBoolean>;
+    canRemovePasskey: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 export type ManagedSignInMethods = z.infer<typeof ManagedSignInMethods>;
 export declare const ManagedSignInMutation: z.ZodObject<{
@@ -43,6 +109,36 @@ export declare const ManagedSignInPasswordMutation: z.ZodObject<{
     newPassword: z.ZodString;
     currentPassword: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
+export declare const ManagedPasskeyRegisterMutation: z.ZodObject<{
+    expectedIdentityId: z.ZodString;
+    operationId: z.ZodString;
+    expectedIdentityRevision: z.ZodNumber;
+    challengeId: z.ZodString;
+    response: z.ZodObject<{
+        id: z.ZodString;
+        rawId: z.ZodString;
+        type: z.ZodLiteral<"public-key">;
+        response: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        clientExtensionResults: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        authenticatorAttachment: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>;
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const ManagedPasskeyRemoveMutation: z.ZodObject<{
+    expectedIdentityId: z.ZodString;
+    operationId: z.ZodString;
+    expectedIdentityRevision: z.ZodNumber;
+    passkeyId: z.ZodString;
+}, z.core.$strict>;
+export declare const ManagedPasskeyMutationResponse: z.ZodObject<{
+    reauthenticationRequired: z.ZodBoolean;
+    notification: z.ZodEnum<{
+        failed: "failed";
+        none: "none";
+        outcome_unknown: "outcome_unknown";
+        sent: "sent";
+    }>;
+}, z.core.$strip>;
 export declare const ManagedSignInMutationResponse: z.ZodObject<{
     reauthenticationRequired: z.ZodLiteral<true>;
     notification: z.ZodEnum<{

package/dist/managed-sign-in-methods.js

@@ -1,46 +1,168 @@
+import {
+  PASSKEY_ONLY_ACCOUNT_EMAIL_DOMAIN,
+  accountContactEmail,
+  isPasskeyOnlyAccountEmail,
+  passkeyOnlyAccountEmail
+} from "./chunk-R6VXJIMB.js";
+import {
+  boolean,
+  positiveInteger,
+  uuid
+} from "./chunk-AQYDZUJV.js";
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
 // src/managed-sign-in-methods.ts
 import { z } from "zod";
-var ManagedSignInProvider = z.enum(["google", "github"]);
-var ManagedSignInMethods = z.object({
-  identityId: z.string().uuid(),
-  email: z.string().email(),
-  emailVerified: z.boolean(),
-  identityRevision: z.number().int().positive(),
-  freshAuthenticationRequired: z.boolean(),
-  methods: z.array(
-    z.object({
-      provider: z.enum(["credential", "google", "github"]),
-      connected: z.boolean(),
-      available: z.boolean(),
-      canDisconnect: z.boolean(),
-      implicitRelinkingSuppressed: z.boolean()
-    })
-  )
-});
-var ManagedSignInMutation = z.object({
-  expectedIdentityId: z.string().uuid(),
-  operationId: z.string().uuid(),
-  expectedIdentityRevision: z.number().int().positive()
-});
-var ManagedSignInProviderMutation = ManagedSignInMutation.extend({
-  provider: ManagedSignInProvider
-}).strict();
-var ManagedSignInPasswordMutation = ManagedSignInMutation.extend({
-  newPassword: z.string().min(8).max(128),
-  currentPassword: z.string().min(1).max(1024).optional()
-}).strict();
-var ManagedSignInMutationResponse = z.object({
-  reauthenticationRequired: z.literal(true),
-  notification: z.enum(["sent", "failed", "outcome_unknown"])
-});
-var ManagedSignInConnectResponse = z.object({ url: z.string().url() });
+var ManagedSignInProvider = /* @__PURE__ */ defineSchema(
+  () => z.enum(["google", "github"])
+);
+var ManagedPasskey = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    id: uuid,
+    name: z.string().min(1).max(80),
+    createdAt: z.string(),
+    lastUsedAt: z.string().nullable(),
+    // Synced passkeys (a password manager or platform keychain) survive the
+    // loss of one device; a single-device key, such as a security key, does not.
+    backedUp: boolean
+  })
+);
+var ManagedPasskeyCredentialResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    id: z.string().min(1).max(1400),
+    rawId: z.string().min(1).max(1400),
+    type: z.literal("public-key"),
+    response: z.record(z.string(), z.unknown()),
+    clientExtensionResults: z.record(z.string(), z.unknown()).default({}),
+    authenticatorAttachment: z.string().max(32).optional()
+  }).passthrough()
+);
+var ManagedPasskeyCeremony = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    challengeId: z.string().min(16).max(128),
+    options: z.record(z.string(), z.unknown())
+  })
+);
+var ManagedPasskeySignInRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    challengeId: z.string().min(16).max(128),
+    response: ManagedPasskeyCredentialResponse
+  }).strict()
+);
+var ManagedPasskeySignUpOptionsRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    name: z.string().trim().min(1).max(80),
+    signupChallengeToken: z.string().max(2048).optional()
+  }).strict()
+);
+var ManagedPasskeySignUpRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    challengeId: z.string().min(16).max(128),
+    response: ManagedPasskeyCredentialResponse
+  }).strict()
+);
+var ManagedPasskeySignInResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    // True when the response signed this browser in. Passkeys are offered
+    // only in the legacy session-set mode, where that is always the case.
+    signedIn: boolean
+  })
+);
+var ManagedSignInMethods = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    identityId: uuid,
+    email: z.string().email(),
+    emailVerified: boolean,
+    identityRevision: positiveInteger,
+    freshAuthenticationRequired: boolean,
+    methods: z.array(
+      z.object({
+        provider: z.enum(["credential", "google", "github"]),
+        connected: boolean,
+        available: boolean,
+        canDisconnect: boolean,
+        implicitRelinkingSuppressed: boolean
+      })
+    ),
+    // The person's passkeys, oldest first. Absent from servers without
+    // passkey sign-in.
+    passkeys: z.array(ManagedPasskey).default([]),
+    // Whether this deployment lets people add and sign in with passkeys.
+    passkeysAvailable: boolean.default(false),
+    // False while removing any one passkey would leave no usable sign-in method.
+    canRemovePasskey: boolean.default(false)
+  })
+);
+var ManagedSignInMutation = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    expectedIdentityId: uuid,
+    operationId: uuid,
+    expectedIdentityRevision: positiveInteger
+  })
+);
+var ManagedSignInProviderMutation = /* @__PURE__ */ defineSchema(
+  () => ManagedSignInMutation.extend({
+    provider: ManagedSignInProvider
+  }).strict()
+);
+var ManagedSignInPasswordMutation = /* @__PURE__ */ defineSchema(
+  () => ManagedSignInMutation.extend({
+    newPassword: z.string().min(8).max(128),
+    currentPassword: z.string().min(1).max(1024).optional()
+  }).strict()
+);
+var ManagedPasskeyRegisterMutation = /* @__PURE__ */ defineSchema(
+  () => ManagedSignInMutation.extend({
+    challengeId: z.string().min(16).max(128),
+    response: ManagedPasskeyCredentialResponse,
+    name: z.string().trim().min(1).max(80).optional()
+  }).strict()
+);
+var ManagedPasskeyRemoveMutation = /* @__PURE__ */ defineSchema(
+  () => ManagedSignInMutation.extend({
+    passkeyId: uuid
+  }).strict()
+);
+var ManagedPasskeyMutationResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    // True when this change linked passkey sign-in to the account for the
+    // first time: every session ends, as for any new sign-in method.
+    reauthenticationRequired: boolean,
+    notification: z.enum(["sent", "failed", "outcome_unknown", "none"])
+  })
+);
+var ManagedSignInMutationResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    reauthenticationRequired: z.literal(true),
+    notification: z.enum(["sent", "failed", "outcome_unknown"])
+  })
+);
+var ManagedSignInConnectResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({ url: z.string().url() })
+);
 export {
+  ManagedPasskey,
+  ManagedPasskeyCeremony,
+  ManagedPasskeyCredentialResponse,
+  ManagedPasskeyMutationResponse,
+  ManagedPasskeyRegisterMutation,
+  ManagedPasskeyRemoveMutation,
+  ManagedPasskeySignInRequest,
+  ManagedPasskeySignInResponse,
+  ManagedPasskeySignUpOptionsRequest,
+  ManagedPasskeySignUpRequest,
   ManagedSignInConnectResponse,
   ManagedSignInMethods,
   ManagedSignInMutation,
   ManagedSignInMutationResponse,
   ManagedSignInPasswordMutation,
   ManagedSignInProvider,
-  ManagedSignInProviderMutation
+  ManagedSignInProviderMutation,
+  PASSKEY_ONLY_ACCOUNT_EMAIL_DOMAIN,
+  accountContactEmail,
+  isPasskeyOnlyAccountEmail,
+  passkeyOnlyAccountEmail
 };
 //# sourceMappingURL=managed-sign-in-methods.js.map

package/dist/managed-sign-in-methods.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/managed-sign-in-methods.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const ManagedSignInProvider = z.enum([\"google\", \"github\"]);\nexport const ManagedSignInMethods = z.object({\n  identityId: z.string().uuid(),\n  email: z.string().email(),\n  emailVerified: z.boolean(),\n  identityRevision: z.number().int().positive(),\n  freshAuthenticationRequired: z.boolean(),\n  methods: z.array(\n    z.object({\n      provider: z.enum([\"credential\", \"google\", \"github\"]),\n      connected: z.boolean(),\n      available: z.boolean(),\n      canDisconnect: z.boolean(),\n      implicitRelinkingSuppressed: z.boolean(),\n    }),\n  ),\n});\nexport type ManagedSignInMethods = z.infer<typeof ManagedSignInMethods>;\nexport const ManagedSignInMutation = z.object({\n  expectedIdentityId: z.string().uuid(),\n  operationId: z.string().uuid(),\n  expectedIdentityRevision: z.number().int().positive(),\n});\nexport const ManagedSignInProviderMutation = ManagedSignInMutation.extend({\n  provider: ManagedSignInProvider,\n}).strict();\nexport const ManagedSignInPasswordMutation = ManagedSignInMutation.extend({\n  newPassword: z.string().min(8).max(128),\n  currentPassword: z.string().min(1).max(1024).optional(),\n}).strict();\nexport const ManagedSignInMutationResponse = z.object({\n  reauthenticationRequired: z.literal(true),\n  notification: z.enum([\"sent\", \"failed\", \"outcome_unknown\"]),\n});\nexport const ManagedSignInConnectResponse = z.object({ url: z.string().url() });\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,wBAAwB,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AACzD,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,eAAe,EAAE,QAAQ;AAAA,EACzB,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC5C,6BAA6B,EAAE,QAAQ;AAAA,EACvC,SAAS,EAAE;AAAA,IACT,EAAE,OAAO;AAAA,MACP,UAAU,EAAE,KAAK,CAAC,cAAc,UAAU,QAAQ,CAAC;AAAA,MACnD,WAAW,EAAE,QAAQ;AAAA,MACrB,WAAW,EAAE,QAAQ;AAAA,MACrB,eAAe,EAAE,QAAQ;AAAA,MACzB,6BAA6B,EAAE,QAAQ;AAAA,IACzC,CAAC;AAAA,EACH;AACF,CAAC;AAEM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,oBAAoB,EAAE,OAAO,EAAE,KAAK;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACtD,CAAC;AACM,IAAM,gCAAgC,sBAAsB,OAAO;AAAA,EACxE,UAAU;AACZ,CAAC,EAAE,OAAO;AACH,IAAM,gCAAgC,sBAAsB,OAAO;AAAA,EACxE,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AACxD,CAAC,EAAE,OAAO;AACH,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,0BAA0B,EAAE,QAAQ,IAAI;AAAA,EACxC,cAAc,EAAE,KAAK,CAAC,QAAQ,UAAU,iBAAiB,CAAC;AAC5D,CAAC;AACM,IAAM,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;","names":[]}
+{"version":3,"sources":["../src/managed-sign-in-methods.ts"],"sourcesContent":["import * as primitives from \"./primitives\";\nimport { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nexport const ManagedSignInProvider = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"google\", \"github\"]),\n);\n\nexport {\n  accountContactEmail,\n  isPasskeyOnlyAccountEmail,\n  PASSKEY_ONLY_ACCOUNT_EMAIL_DOMAIN,\n  passkeyOnlyAccountEmail,\n} from \"./passkey-only-account\";\n\n/** A WebAuthn credential a person registered, without its key material. */\nexport const ManagedPasskey = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    id: primitives.uuid,\n    name: z.string().min(1).max(80),\n    createdAt: z.string(),\n    lastUsedAt: z.string().nullable(),\n    // Synced passkeys (a password manager or platform keychain) survive the\n    // loss of one device; a single-device key, such as a security key, does not.\n    backedUp: primitives.boolean,\n  }),\n);\nexport type ManagedPasskey = z.infer<typeof ManagedPasskey>;\n\n/**\n * A browser's WebAuthn response, exactly as `navigator.credentials` produced\n * it in JSON form. The server verifies it; nothing in it is trusted before.\n */\nexport const ManagedPasskeyCredentialResponse = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      id: z.string().min(1).max(1400),\n      rawId: z.string().min(1).max(1400),\n      type: z.literal(\"public-key\"),\n      response: z.record(z.string(), z.unknown()),\n      clientExtensionResults: z.record(z.string(), z.unknown()).default({}),\n      authenticatorAttachment: z.string().max(32).optional(),\n    })\n    .passthrough(),\n);\n\n/** Options for one WebAuthn ceremony, and the single-use id that answers it. */\nexport const ManagedPasskeyCeremony = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    challengeId: z.string().min(16).max(128),\n    options: z.record(z.string(), z.unknown()),\n  }),\n);\nexport type ManagedPasskeyCeremony = z.infer<typeof ManagedPasskeyCeremony>;\n\nexport const ManagedPasskeySignInRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      challengeId: z.string().min(16).max(128),\n      response: ManagedPasskeyCredentialResponse,\n    })\n    .strict(),\n);\nexport const ManagedPasskeySignUpOptionsRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      name: z.string().trim().min(1).max(80),\n      signupChallengeToken: z.string().max(2048).optional(),\n    })\n    .strict(),\n);\nexport const ManagedPasskeySignUpRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      challengeId: z.string().min(16).max(128),\n      response: ManagedPasskeyCredentialResponse,\n    })\n    .strict(),\n);\nexport const ManagedPasskeySignInResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    // True when the response signed this browser in. Passkeys are offered\n    // only in the legacy session-set mode, where that is always the case.\n    signedIn: primitives.boolean,\n  }),\n);\nexport const ManagedSignInMethods = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    identityId: primitives.uuid,\n    email: z.string().email(),\n    emailVerified: primitives.boolean,\n    identityRevision: primitives.positiveInteger,\n    freshAuthenticationRequired: primitives.boolean,\n    methods: z.array(\n      z.object({\n        provider: z.enum([\"credential\", \"google\", \"github\"]),\n        connected: primitives.boolean,\n        available: primitives.boolean,\n        canDisconnect: primitives.boolean,\n        implicitRelinkingSuppressed: primitives.boolean,\n      }),\n    ),\n    // The person's passkeys, oldest first. Absent from servers without\n    // passkey sign-in.\n    passkeys: z.array(ManagedPasskey).default([]),\n    // Whether this deployment lets people add and sign in with passkeys.\n    passkeysAvailable: primitives.boolean.default(false),\n    // False while removing any one passkey would leave no usable sign-in method.\n    canRemovePasskey: primitives.boolean.default(false),\n  }),\n);\nexport type ManagedSignInMethods = z.infer<typeof ManagedSignInMethods>;\nexport const ManagedSignInMutation = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    expectedIdentityId: primitives.uuid,\n    operationId: primitives.uuid,\n    expectedIdentityRevision: primitives.positiveInteger,\n  }),\n);\nexport const ManagedSignInProviderMutation = /* @__PURE__ */ defineSchema(() =>\n  ManagedSignInMutation.extend({\n    provider: ManagedSignInProvider,\n  }).strict(),\n);\nexport const ManagedSignInPasswordMutation = /* @__PURE__ */ defineSchema(() =>\n  ManagedSignInMutation.extend({\n    newPassword: z.string().min(8).max(128),\n    currentPassword: z.string().min(1).max(1024).optional(),\n  }).strict(),\n);\nexport const ManagedPasskeyRegisterMutation = /* @__PURE__ */ defineSchema(() =>\n  ManagedSignInMutation.extend({\n    challengeId: z.string().min(16).max(128),\n    response: ManagedPasskeyCredentialResponse,\n    name: z.string().trim().min(1).max(80).optional(),\n  }).strict(),\n);\nexport const ManagedPasskeyRemoveMutation = /* @__PURE__ */ defineSchema(() =>\n  ManagedSignInMutation.extend({\n    passkeyId: primitives.uuid,\n  }).strict(),\n);\nexport const ManagedPasskeyMutationResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    // True when this change linked passkey sign-in to the account for the\n    // first time: every session ends, as for any new sign-in method.\n    reauthenticationRequired: primitives.boolean,\n    notification: z.enum([\"sent\", \"failed\", \"outcome_unknown\", \"none\"]),\n  }),\n);\nexport const ManagedSignInMutationResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    reauthenticationRequired: z.literal(true),\n    notification: z.enum([\"sent\", \"failed\", \"outcome_unknown\"]),\n  }),\n);\nexport const ManagedSignInConnectResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({ url: z.string().url() }),\n);\n"],"mappings":";;;;;;;;;;;;;;;;AAEA,SAAS,SAAS;AAEX,IAAM,wBAAwC;AAAA,EAAa,MAChE,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;AAC7B;AAUO,IAAM,iBAAiC;AAAA,EAAa,MACzD,EAAE,OAAO;AAAA,IACP,IAAe;AAAA,IACf,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,IAC9B,WAAW,EAAE,OAAO;AAAA,IACpB,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA;AAAA,IAGhC,UAAqB;AAAA,EACvB,CAAC;AACH;AAOO,IAAM,mCAAmD;AAAA,EAAa,MAC3E,EACG,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,IAC9B,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,IACjC,MAAM,EAAE,QAAQ,YAAY;AAAA,IAC5B,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,IAC1C,wBAAwB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,IACpE,yBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACvD,CAAC,EACA,YAAY;AACjB;AAGO,IAAM,yBAAyC;AAAA,EAAa,MACjE,EAAE,OAAO;AAAA,IACP,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,GAAG;AAAA,IACvC,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,EAC3C,CAAC;AACH;AAGO,IAAM,8BAA8C;AAAA,EAAa,MACtE,EACG,OAAO;AAAA,IACN,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,GAAG;AAAA,IACvC,UAAU;AAAA,EACZ,CAAC,EACA,OAAO;AACZ;AACO,IAAM,qCAAqD;AAAA,EAAa,MAC7E,EACG,OAAO;AAAA,IACN,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,IACrC,sBAAsB,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACtD,CAAC,EACA,OAAO;AACZ;AACO,IAAM,8BAA8C;AAAA,EAAa,MACtE,EACG,OAAO;AAAA,IACN,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,GAAG;AAAA,IACvC,UAAU;AAAA,EACZ,CAAC,EACA,OAAO;AACZ;AACO,IAAM,+BAA+C;AAAA,EAAa,MACvE,EAAE,OAAO;AAAA;AAAA;AAAA,IAGP,UAAqB;AAAA,EACvB,CAAC;AACH;AACO,IAAM,uBAAuC;AAAA,EAAa,MAC/D,EAAE,OAAO;AAAA,IACP,YAAuB;AAAA,IACvB,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,IACxB,eAA0B;AAAA,IAC1B,kBAA6B;AAAA,IAC7B,6BAAwC;AAAA,IACxC,SAAS,EAAE;AAAA,MACT,EAAE,OAAO;AAAA,QACP,UAAU,EAAE,KAAK,CAAC,cAAc,UAAU,QAAQ,CAAC;AAAA,QACnD,WAAsB;AAAA,QACtB,WAAsB;AAAA,QACtB,eAA0B;AAAA,QAC1B,6BAAwC;AAAA,MAC1C,CAAC;AAAA,IACH;AAAA;AAAA;AAAA,IAGA,UAAU,EAAE,MAAM,cAAc,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,IAE5C,mBAA8B,QAAQ,QAAQ,KAAK;AAAA;AAAA,IAEnD,kBAA6B,QAAQ,QAAQ,KAAK;AAAA,EACpD,CAAC;AACH;AAEO,IAAM,wBAAwC;AAAA,EAAa,MAChE,EAAE,OAAO;AAAA,IACP,oBAA+B;AAAA,IAC/B,aAAwB;AAAA,IACxB,0BAAqC;AAAA,EACvC,CAAC;AACH;AACO,IAAM,gCAAgD;AAAA,EAAa,MACxE,sBAAsB,OAAO;AAAA,IAC3B,UAAU;AAAA,EACZ,CAAC,EAAE,OAAO;AACZ;AACO,IAAM,gCAAgD;AAAA,EAAa,MACxE,sBAAsB,OAAO;AAAA,IAC3B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACtC,iBAAiB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACxD,CAAC,EAAE,OAAO;AACZ;AACO,IAAM,iCAAiD;AAAA,EAAa,MACzE,sBAAsB,OAAO;AAAA,IAC3B,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,GAAG;AAAA,IACvC,UAAU;AAAA,IACV,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAClD,CAAC,EAAE,OAAO;AACZ;AACO,IAAM,+BAA+C;AAAA,EAAa,MACvE,sBAAsB,OAAO;AAAA,IAC3B,WAAsB;AAAA,EACxB,CAAC,EAAE,OAAO;AACZ;AACO,IAAM,iCAAiD;AAAA,EAAa,MACzE,EAAE,OAAO;AAAA;AAAA;AAAA,IAGP,0BAAqC;AAAA,IACrC,cAAc,EAAE,KAAK,CAAC,QAAQ,UAAU,mBAAmB,MAAM,CAAC;AAAA,EACpE,CAAC;AACH;AACO,IAAM,gCAAgD;AAAA,EAAa,MACxE,EAAE,OAAO;AAAA,IACP,0BAA0B,EAAE,QAAQ,IAAI;AAAA,IACxC,cAAc,EAAE,KAAK,CAAC,QAAQ,UAAU,iBAAiB,CAAC;AAAA,EAC5D,CAAC;AACH;AACO,IAAM,+BAA+C;AAAA,EAAa,MACvE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACpC;","names":[]}

package/dist/mcp-structured-content.d.ts

@@ -0,0 +1,25 @@
+import type { AttemptToolResult } from "./tool-catalog.js";
+/**
+ * Remove the backwards-compatibility text copy of an MCP result's
+ * `structuredContent`.
+ *
+ * The MCP specification asks a server that returns `structuredContent` to also
+ * return the same value serialized in a text content block. Printing or sending
+ * both pays for the payload twice, and the text copy pays again for JSON string
+ * escaping inside the result envelope.
+ *
+ * The envelope (`content`, `structuredContent`, `_meta`, `isError`, extension
+ * fields) and its key order are kept. Only a plain `{type: "text", text}` block
+ * whose text parses as JSON to a value equal to `structuredContent` is removed.
+ * Prose, differing JSON, annotated text, images, resources, and every other
+ * block stay. A text block whose JSON carries an integer outside the IEEE-754
+ * safe range also stays, because its digits may be more precise than the
+ * parsed `structuredContent`. Numbers compare by IEEE-754 value.
+ *
+ * Results without a removable block are returned as the same object.
+ *
+ * Callers: the runtime's model-facing MCP projection, and the default
+ * `ogtool call` print. The native Connected Machine client implements the
+ * same rule in `agent/crates/opengeni-agent/src/codemode.rs`; keep them equal.
+ */
+export declare function omitStructuredContentTextDuplicates<T extends AttemptToolResult>(result: T): T;

package/dist/message-time-zone.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The IANA time zone a person's client reports when they send a message, so
+ * the model can see the message's local time. Dependency-free so browser
+ * packages can import it without the schema bundle.
+ */
+/** Longest accepted time zone name. Real IANA names are at most about 32 characters. */
+export declare const MESSAGE_TIME_ZONE_MAX_CHARS = 64;
+/**
+ * Turn metadata key for the sender's IANA time zone, frozen when the message is
+ * accepted. Claim renders the message's local time from it exactly once.
+ */
+export declare const MESSAGE_TIME_ZONE_METADATA_KEY: "messageTimeZone";
+/**
+ * IANA names such as `Europe/Oslo`, `America/Argentina/Buenos_Aires`,
+ * `Etc/GMT+5` or `EST5EDT`. Numeric offsets (`+01:00`) are not zone names.
+ */
+export declare const MESSAGE_TIME_ZONE_PATTERN: RegExp;
+/**
+ * The canonical name of a sender's time zone, or undefined when the value is
+ * not an IANA zone name this runtime can resolve, or is just UTC. Accepting
+ * surfaces store the returned name; clients use it to drop invalid values.
+ */
+export declare function normalizeMessageTimeZone(value: unknown): string | undefined;
+/** The sender's time zone frozen in one accepted turn's metadata, when it holds a usable one. */
+export declare function messageTimeZoneFromTurnMetadata(metadata: unknown): string | undefined;
+/** The time zone this runtime's own clock uses, when it is a usable IANA zone. */
+export declare function currentMessageTimeZone(): string | undefined;
+/**
+ * Calendar date and minute of `date` on a wall clock in `timeZone` (seconds
+ * are truncated, as in UTC rendering). Undefined for an unusable zone.
+ */
+export declare function messageTimeZoneWallClock(date: Date, timeZone: string): {
+    year: number;
+    month: number;
+    day: number;
+    hour: number;
+    minute: number;
+} | undefined;

package/dist/message-time-zone.js

@@ -0,0 +1,19 @@
+import {
+  MESSAGE_TIME_ZONE_MAX_CHARS,
+  MESSAGE_TIME_ZONE_METADATA_KEY,
+  MESSAGE_TIME_ZONE_PATTERN,
+  currentMessageTimeZone,
+  messageTimeZoneFromTurnMetadata,
+  messageTimeZoneWallClock,
+  normalizeMessageTimeZone
+} from "./chunk-XB6GQLBH.js";
+export {
+  MESSAGE_TIME_ZONE_MAX_CHARS,
+  MESSAGE_TIME_ZONE_METADATA_KEY,
+  MESSAGE_TIME_ZONE_PATTERN,
+  currentMessageTimeZone,
+  messageTimeZoneFromTurnMetadata,
+  messageTimeZoneWallClock,
+  normalizeMessageTimeZone
+};
+//# sourceMappingURL=message-time-zone.js.map

package/dist/message-time-zone.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}