@opengeni/sdk 0.57.0 → 1.0.0

package/dist/accounts.d.ts

@@ -0,0 +1,153 @@
+import { type BeginManagedAuthLoginTransactionRequest as BeginManagedAuthLoginTransactionRequestType, type BootstrapManagedAuthSessionSetRequest as BootstrapManagedAuthSessionSetRequestType, type CancelManagedAuthLoginTransactionRequest as CancelManagedAuthLoginTransactionRequestType, type CompleteManagedAuthEmailPasswordTransactionRequest as CompleteManagedAuthEmailPasswordTransactionRequestType, type CompleteManagedAuthLoginTransactionResponse as CompleteManagedAuthLoginTransactionResponseType, type LogoutManagedAuthLoginSlotRequest as LogoutManagedAuthLoginSlotRequestType, type LogoutManagedAuthSessionSetRequest as LogoutManagedAuthSessionSetRequestType, type ManagedAuthDeepLinkResolution as ManagedAuthDeepLinkResolutionType, type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType, type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType, type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType, type ResolveManagedAuthDeepLinkRequest as ResolveManagedAuthDeepLinkRequestType, type SelectManagedAuthLoginSlotRequest as SelectManagedAuthLoginSlotRequestType, type StartManagedAuthSocialTransactionRequest as StartManagedAuthSocialTransactionRequestType, type StartManagedAuthSocialTransactionResponse as StartManagedAuthSocialTransactionResponseType } from "@opengeni/contracts/managed-auth-session-sets";
+export type BrowserAccountsFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export type BrowserAccountsClientOptions = {
+    baseUrl: string;
+    fetch?: BrowserAccountsFetch;
+};
+export interface BrowserAccountsClientLike {
+    getSessionSet(): Promise<ManagedAuthSessionSetProjectionType>;
+    reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType>;
+    bootstrapSessionSet(request: BootstrapManagedAuthSessionSetRequestType): Promise<ManagedAuthSessionSetProjectionType>;
+    beginLoginTransaction(request: BeginManagedAuthLoginTransactionRequestType): Promise<ManagedAuthLoginTransactionType>;
+    completeEmailPasswordTransaction(request: CompleteManagedAuthEmailPasswordTransactionRequestType): Promise<CompleteManagedAuthLoginTransactionResponseType>;
+    startSocialTransaction?(request: StartManagedAuthSocialTransactionRequestType): Promise<StartManagedAuthSocialTransactionResponseType>;
+    cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType): Promise<ManagedAuthSessionSetProjectionType>;
+    selectLoginSlot(request: SelectManagedAuthLoginSlotRequestType): Promise<ManagedAuthSessionSetProjectionType>;
+    logoutLoginSlot(request: LogoutManagedAuthLoginSlotRequestType): Promise<ManagedAuthSessionSetProjectionType>;
+    logoutSessionSet(request: LogoutManagedAuthSessionSetRequestType): Promise<ManagedAuthLogoutAllReceiptType>;
+    resolveDeepLink(request: ResolveManagedAuthDeepLinkRequestType): Promise<ManagedAuthDeepLinkResolutionType>;
+}
+export declare class BrowserAccountsApiError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly name = "BrowserAccountsApiError";
+    constructor(status: number, code: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare class BrowserAccountsClient implements BrowserAccountsClientLike {
+    #private;
+    constructor(options: BrowserAccountsClientOptions);
+    getSessionSet(): Promise<ManagedAuthSessionSetProjectionType>;
+    reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType>;
+    bootstrapSessionSet(request: BootstrapManagedAuthSessionSetRequestType): Promise<{
+        mode: "broker" | "dual" | "legacy";
+        generation: string;
+        actorEpoch: string;
+        csrfToken: string;
+        selectedSlotId: string | null;
+        state: "actor_change_required" | "ready";
+        slots: {
+            id: string;
+            displayName: string;
+            verifiedClaim: {
+                kind: "email";
+                value: string;
+            };
+            state: "active" | "reauth_required";
+        }[];
+    }>;
+    beginLoginTransaction(request: BeginManagedAuthLoginTransactionRequestType): Promise<{
+        id: string;
+        kind: "add" | "reauth";
+        expiresAt: string;
+        returnIntentId: string | null;
+    }>;
+    completeEmailPasswordTransaction(request: CompleteManagedAuthEmailPasswordTransactionRequestType): Promise<{
+        projection: {
+            mode: "broker" | "dual" | "legacy";
+            generation: string;
+            actorEpoch: string;
+            csrfToken: string;
+            selectedSlotId: string | null;
+            state: "actor_change_required" | "ready";
+            slots: {
+                id: string;
+                displayName: string;
+                verifiedClaim: {
+                    kind: "email";
+                    value: string;
+                };
+                state: "active" | "reauth_required";
+            }[];
+        };
+        returnIntent: string | null;
+    }>;
+    startSocialTransaction(request: StartManagedAuthSocialTransactionRequestType): Promise<{
+        url: string;
+    }>;
+    cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType): Promise<{
+        mode: "broker" | "dual" | "legacy";
+        generation: string;
+        actorEpoch: string;
+        csrfToken: string;
+        selectedSlotId: string | null;
+        state: "actor_change_required" | "ready";
+        slots: {
+            id: string;
+            displayName: string;
+            verifiedClaim: {
+                kind: "email";
+                value: string;
+            };
+            state: "active" | "reauth_required";
+        }[];
+    }>;
+    selectLoginSlot(request: SelectManagedAuthLoginSlotRequestType): Promise<{
+        mode: "broker" | "dual" | "legacy";
+        generation: string;
+        actorEpoch: string;
+        csrfToken: string;
+        selectedSlotId: string | null;
+        state: "actor_change_required" | "ready";
+        slots: {
+            id: string;
+            displayName: string;
+            verifiedClaim: {
+                kind: "email";
+                value: string;
+            };
+            state: "active" | "reauth_required";
+        }[];
+    }>;
+    logoutLoginSlot(request: LogoutManagedAuthLoginSlotRequestType): Promise<{
+        mode: "broker" | "dual" | "legacy";
+        generation: string;
+        actorEpoch: string;
+        csrfToken: string;
+        selectedSlotId: string | null;
+        state: "actor_change_required" | "ready";
+        slots: {
+            id: string;
+            displayName: string;
+            verifiedClaim: {
+                kind: "email";
+                value: string;
+            };
+            state: "active" | "reauth_required";
+        }[];
+    }>;
+    logoutSessionSet(request: LogoutManagedAuthSessionSetRequestType): Promise<{
+        generation: string;
+        actorEpoch: string;
+        state: "logged_out";
+    }>;
+    resolveDeepLink(request: ResolveManagedAuthDeepLinkRequestType): Promise<{
+        kind: "current";
+    } | {
+        kind: "switch_required";
+        slot: {
+            id: string;
+            displayName: string;
+            verifiedClaim: {
+                kind: "email";
+                value: string;
+            };
+            state: "active" | "reauth_required";
+        };
+    } | {
+        kind: "unavailable";
+    }>;
+}
+export declare function createBrowserAccountsClient(options: BrowserAccountsClientOptions): BrowserAccountsClient;
+export type { BeginManagedAuthLoginTransactionRequestType as BeginManagedAuthLoginTransactionRequest, BootstrapManagedAuthSessionSetRequestType as BootstrapManagedAuthSessionSetRequest, CancelManagedAuthLoginTransactionRequestType as CancelManagedAuthLoginTransactionRequest, CompleteManagedAuthEmailPasswordTransactionRequestType as CompleteManagedAuthEmailPasswordTransactionRequest, CompleteManagedAuthLoginTransactionResponseType as CompleteManagedAuthLoginTransactionResponse, LogoutManagedAuthLoginSlotRequestType as LogoutManagedAuthLoginSlotRequest, LogoutManagedAuthSessionSetRequestType as LogoutManagedAuthSessionSetRequest, ManagedAuthDeepLinkResolutionType as ManagedAuthDeepLinkResolution, ManagedAuthLoginTransactionType as ManagedAuthLoginTransaction, ManagedAuthLogoutAllReceiptType as ManagedAuthLogoutAllReceipt, ManagedAuthSessionSetProjectionType as ManagedAuthSessionSetProjection, ResolveManagedAuthDeepLinkRequestType as ResolveManagedAuthDeepLinkRequest, SelectManagedAuthLoginSlotRequestType as SelectManagedAuthLoginSlotRequest, };

package/dist/accounts.js

@@ -0,0 +1,307 @@
+// src/accounts.ts
+import {
+  BeginManagedAuthLoginTransactionRequest,
+  BootstrapManagedAuthSessionSetRequest,
+  CancelManagedAuthLoginTransactionRequest,
+  CompleteManagedAuthEmailPasswordTransactionRequest,
+  CompleteManagedAuthLoginTransactionResponse,
+  LogoutManagedAuthLoginSlotRequest,
+  LogoutManagedAuthSessionSetRequest,
+  MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER,
+  MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,
+  ManagedAuthDeepLinkResolution,
+  ManagedAuthLoginTransaction,
+  ManagedAuthLogoutAllReceipt,
+  ManagedAuthSessionSetProjection,
+  ManagedAuthSessionSetErrorCode,
+  ResolveManagedAuthDeepLinkRequest,
+  SelectManagedAuthLoginSlotRequest,
+  StartManagedAuthSocialTransactionRequest,
+  StartManagedAuthSocialTransactionResponse
+} from "@opengeni/contracts/managed-auth-session-sets";
+var BrowserAccountsApiError = class extends Error {
+  constructor(status, code, options) {
+    super(code, options?.cause === void 0 ? void 0 : { cause: options.cause });
+    this.status = status;
+    this.code = code;
+  }
+  name = "BrowserAccountsApiError";
+};
+var BrowserAccountsClient = class {
+  #baseUrl;
+  #fetch;
+  // CSRF is generation-bound. Exact idempotent replay must retain the
+  // admission envelope even after an authority reread observes a newer clock.
+  #mutationAdmissions = /* @__PURE__ */ new Map();
+  #projection = null;
+  #authorityReadEpoch = 0;
+  #authorityResetPending = false;
+  #authorityReconciliation = null;
+  constructor(options) {
+    this.#baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.#fetch = options.fetch ?? ((input, init) => fetch(input, init));
+  }
+  async getSessionSet() {
+    if (this.#authorityResetPending || this.#authorityReconciliation) {
+      return await this.reconcileSessionSetAuthority();
+    }
+    const readEpoch = this.#authorityReadEpoch;
+    const received = await this.#readSessionSet();
+    if (readEpoch !== this.#authorityReadEpoch) {
+      return this.#authorityReconciliation ? await this.#authorityReconciliation : this.#projection ?? await this.getSessionSet();
+    }
+    return this.#remember(received);
+  }
+  async reconcileSessionSetAuthority() {
+    if (this.#authorityReconciliation) return await this.#authorityReconciliation;
+    const previous = this.#projection;
+    const readEpoch = ++this.#authorityReadEpoch;
+    this.#authorityResetPending = true;
+    this.#mutationAdmissions.clear();
+    const reconciliation = this.#reconcileSessionSetAuthority(previous, readEpoch);
+    this.#authorityReconciliation = reconciliation;
+    try {
+      const accepted = await reconciliation;
+      if (readEpoch === this.#authorityReadEpoch) this.#authorityResetPending = false;
+      return accepted;
+    } finally {
+      if (this.#authorityReconciliation === reconciliation) {
+        this.#authorityReconciliation = null;
+      }
+    }
+  }
+  async bootstrapSessionSet(request) {
+    return this.#projectionResponse(
+      "POST",
+      "/v1/auth/session-set/bootstrap",
+      BootstrapManagedAuthSessionSetRequest,
+      request
+    );
+  }
+  async beginLoginTransaction(request) {
+    return ManagedAuthLoginTransaction.parse(
+      await this.#mutation(
+        "POST",
+        "/v1/auth/session-set/transactions",
+        BeginManagedAuthLoginTransactionRequest,
+        request
+      )
+    );
+  }
+  async completeEmailPasswordTransaction(request) {
+    const authorityReadEpoch = this.#authorityReadEpoch;
+    const response = CompleteManagedAuthLoginTransactionResponse.parse(
+      await this.#mutation(
+        "POST",
+        "/v1/auth/session-set/transactions/email-password",
+        CompleteManagedAuthEmailPasswordTransactionRequest,
+        request
+      )
+    );
+    if (authorityReadEpoch !== this.#authorityReadEpoch) {
+      return { ...response, projection: await this.getSessionSet() };
+    }
+    const remembered = this.#remember(response.projection);
+    if (remembered !== response.projection) {
+      return { ...response, projection: await this.getSessionSet() };
+    }
+    return response;
+  }
+  async startSocialTransaction(request) {
+    return StartManagedAuthSocialTransactionResponse.parse(
+      await this.#mutation(
+        "POST",
+        "/v1/auth/session-set/transactions/social",
+        StartManagedAuthSocialTransactionRequest,
+        request
+      )
+    );
+  }
+  async cancelLoginTransaction(request) {
+    return this.#projectionResponse(
+      "DELETE",
+      `/v1/auth/session-set/transactions/${encodeURIComponent(request.transactionId)}`,
+      CancelManagedAuthLoginTransactionRequest,
+      request
+    );
+  }
+  async selectLoginSlot(request) {
+    return this.#projectionResponse(
+      "POST",
+      "/v1/auth/session-set/select",
+      SelectManagedAuthLoginSlotRequest,
+      request
+    );
+  }
+  async logoutLoginSlot(request) {
+    return this.#projectionResponse(
+      "POST",
+      "/v1/auth/session-set/logout-one",
+      LogoutManagedAuthLoginSlotRequest,
+      request
+    );
+  }
+  async logoutSessionSet(request) {
+    const receipt = ManagedAuthLogoutAllReceipt.parse(
+      await this.#mutation(
+        "POST",
+        "/v1/auth/session-set/logout-all",
+        LogoutManagedAuthSessionSetRequest,
+        request
+      )
+    );
+    this.#authorityReadEpoch += 1;
+    this.#authorityResetPending = false;
+    this.#projection = null;
+    this.#mutationAdmissions.clear();
+    return receipt;
+  }
+  async resolveDeepLink(request) {
+    return ManagedAuthDeepLinkResolution.parse(
+      await this.#mutation(
+        "POST",
+        "/v1/auth/session-set/deep-link/resolve",
+        ResolveManagedAuthDeepLinkRequest,
+        request
+      )
+    );
+  }
+  async #projectionResponse(method, path, schema, request) {
+    const authorityReadEpoch = this.#authorityReadEpoch;
+    const received = ManagedAuthSessionSetProjection.parse(
+      await this.#mutation(method, path, schema, request)
+    );
+    if (authorityReadEpoch !== this.#authorityReadEpoch) return await this.getSessionSet();
+    const remembered = this.#remember(received);
+    return remembered === received ? received : await this.getSessionSet();
+  }
+  async #mutation(method, path, schema, request) {
+    if (this.#authorityResetPending) {
+      throw new BrowserAccountsApiError(409, "actor_change_required");
+    }
+    const body = schema.parse(request);
+    const projection = this.#projection;
+    if (!projection) throw new BrowserAccountsApiError(409, "session_set_projection_required");
+    const operationId = mutationOperationId(body);
+    const signature = operationId ? JSON.stringify([method, path, body]) : null;
+    const retained = operationId ? this.#mutationAdmissions.get(operationId) : null;
+    if (retained && retained.signature !== signature) {
+      throw new BrowserAccountsApiError(409, "operation_reused");
+    }
+    const admission = retained ?? {
+      signature: signature ?? "",
+      csrfToken: projection.csrfToken,
+      actorEpoch: projection.actorEpoch
+    };
+    if (operationId && !retained) {
+      this.#mutationAdmissions.set(operationId, admission);
+      if (this.#mutationAdmissions.size > 64) {
+        this.#mutationAdmissions.delete(this.#mutationAdmissions.keys().next().value);
+      }
+    }
+    return await this.#request(method, path, body, {
+      "x-opengeni-session-csrf": admission.csrfToken,
+      "x-opengeni-actor-epoch": admission.actorEpoch
+    });
+  }
+  async #request(method, path, body, headers = {}) {
+    let response;
+    try {
+      response = await this.#fetch(`${this.#baseUrl}${path}`, {
+        method,
+        credentials: "include",
+        headers: {
+          accept: "application/json",
+          [MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER]: MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,
+          ...body === void 0 ? {} : { "content-type": "application/json" },
+          ...headers
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) }
+      });
+    } catch (cause) {
+      if (method !== "GET") {
+        throw new BrowserAccountsApiError(503, "operation_outcome_unknown", { cause });
+      }
+      throw cause;
+    }
+    let parsed = true;
+    const value = await response.json().catch(() => {
+      parsed = false;
+      return null;
+    });
+    if (!response.ok) {
+      const code = managedAuthErrorCode(value) ?? `http_${response.status}`;
+      throw new BrowserAccountsApiError(response.status, code);
+    }
+    if (!parsed && method !== "GET") {
+      throw new BrowserAccountsApiError(503, "operation_outcome_unknown");
+    }
+    return value;
+  }
+  async #readSessionSet() {
+    return ManagedAuthSessionSetProjection.parse(
+      await this.#request("GET", "/v1/auth/session-set")
+    );
+  }
+  async #reconcileSessionSetAuthority(previous, readEpoch) {
+    const first = await this.#readSessionSet();
+    const second = await this.#readSessionSet();
+    if (readEpoch !== this.#authorityReadEpoch) {
+      return await this.#reconcileSessionSetAuthority(this.#projection, this.#authorityReadEpoch);
+    }
+    if (this.#projection !== previous) return this.#remember(second);
+    if (!previous || compareProjectionClock(second, previous) >= 0) {
+      return this.#remember(second);
+    }
+    if (compareProjectionClock(first, previous) < 0 && compareProjectionClock(second, first) >= 0) {
+      this.#projection = second;
+      this.#mutationAdmissions.clear();
+      return second;
+    }
+    return previous;
+  }
+  #remember(projection) {
+    const current = this.#projection;
+    if (!current || compareProjectionClock(projection, current) >= 0) {
+      this.#projection = projection;
+      return projection;
+    }
+    return current;
+  }
+};
+function mutationOperationId(value) {
+  if (!value || typeof value !== "object") return null;
+  const operationId = value.operationId;
+  return typeof operationId === "string" ? operationId : null;
+}
+function compareProjectionClock(left, right) {
+  const actorDelta = BigInt(left.actorEpoch) - BigInt(right.actorEpoch);
+  if (actorDelta !== 0n) return actorDelta > 0n ? 1 : -1;
+  const generationDelta = BigInt(left.generation) - BigInt(right.generation);
+  return generationDelta === 0n ? 0 : generationDelta > 0n ? 1 : -1;
+}
+function managedAuthErrorCode(value) {
+  if (!value || typeof value !== "object") return null;
+  const error = value.error;
+  if (error && typeof error === "object") {
+    const details = error.details;
+    if (details && typeof details === "object") {
+      const parsed2 = ManagedAuthSessionSetErrorCode.safeParse(
+        details.managedAuthCode
+      );
+      if (parsed2.success) return parsed2.data;
+    }
+  }
+  const legacy = value.message;
+  const parsed = ManagedAuthSessionSetErrorCode.safeParse(legacy);
+  return parsed.success ? parsed.data : null;
+}
+function createBrowserAccountsClient(options) {
+  return new BrowserAccountsClient(options);
+}
+export {
+  BrowserAccountsApiError,
+  BrowserAccountsClient,
+  createBrowserAccountsClient
+};
+//# sourceMappingURL=accounts.js.map

package/dist/accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/accounts.ts"],"sourcesContent":["import {\n  BeginManagedAuthLoginTransactionRequest,\n  BootstrapManagedAuthSessionSetRequest,\n  CancelManagedAuthLoginTransactionRequest,\n  CompleteManagedAuthEmailPasswordTransactionRequest,\n  CompleteManagedAuthLoginTransactionResponse,\n  LogoutManagedAuthLoginSlotRequest,\n  LogoutManagedAuthSessionSetRequest,\n  MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER,\n  MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,\n  ManagedAuthDeepLinkResolution,\n  ManagedAuthLoginTransaction,\n  ManagedAuthLogoutAllReceipt,\n  ManagedAuthSessionSetProjection,\n  ManagedAuthSessionSetErrorCode,\n  ResolveManagedAuthDeepLinkRequest,\n  SelectManagedAuthLoginSlotRequest,\n  StartManagedAuthSocialTransactionRequest,\n  StartManagedAuthSocialTransactionResponse,\n  type BeginManagedAuthLoginTransactionRequest as BeginManagedAuthLoginTransactionRequestType,\n  type BootstrapManagedAuthSessionSetRequest as BootstrapManagedAuthSessionSetRequestType,\n  type CancelManagedAuthLoginTransactionRequest as CancelManagedAuthLoginTransactionRequestType,\n  type CompleteManagedAuthEmailPasswordTransactionRequest as CompleteManagedAuthEmailPasswordTransactionRequestType,\n  type CompleteManagedAuthLoginTransactionResponse as CompleteManagedAuthLoginTransactionResponseType,\n  type LogoutManagedAuthLoginSlotRequest as LogoutManagedAuthLoginSlotRequestType,\n  type LogoutManagedAuthSessionSetRequest as LogoutManagedAuthSessionSetRequestType,\n  type ManagedAuthDeepLinkResolution as ManagedAuthDeepLinkResolutionType,\n  type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType,\n  type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType,\n  type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType,\n  type ResolveManagedAuthDeepLinkRequest as ResolveManagedAuthDeepLinkRequestType,\n  type SelectManagedAuthLoginSlotRequest as SelectManagedAuthLoginSlotRequestType,\n  type StartManagedAuthSocialTransactionRequest as StartManagedAuthSocialTransactionRequestType,\n  type StartManagedAuthSocialTransactionResponse as StartManagedAuthSocialTransactionResponseType,\n} from \"@opengeni/contracts/managed-auth-session-sets\";\nimport type { z } from \"zod\";\n\nexport type BrowserAccountsFetch = (\n  input: string | URL | Request,\n  init?: RequestInit,\n) => Promise<Response>;\n\nexport type BrowserAccountsClientOptions = {\n  baseUrl: string;\n  fetch?: BrowserAccountsFetch;\n};\n\nexport interface BrowserAccountsClientLike {\n  getSessionSet(): Promise<ManagedAuthSessionSetProjectionType>;\n  reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType>;\n  bootstrapSessionSet(\n    request: BootstrapManagedAuthSessionSetRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  beginLoginTransaction(\n    request: BeginManagedAuthLoginTransactionRequestType,\n  ): Promise<ManagedAuthLoginTransactionType>;\n  completeEmailPasswordTransaction(\n    request: CompleteManagedAuthEmailPasswordTransactionRequestType,\n  ): Promise<CompleteManagedAuthLoginTransactionResponseType>;\n  startSocialTransaction?(\n    request: StartManagedAuthSocialTransactionRequestType,\n  ): Promise<StartManagedAuthSocialTransactionResponseType>;\n  cancelLoginTransaction(\n    request: CancelManagedAuthLoginTransactionRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  selectLoginSlot(\n    request: SelectManagedAuthLoginSlotRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  logoutLoginSlot(\n    request: LogoutManagedAuthLoginSlotRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  logoutSessionSet(\n    request: LogoutManagedAuthSessionSetRequestType,\n  ): Promise<ManagedAuthLogoutAllReceiptType>;\n  resolveDeepLink(\n    request: ResolveManagedAuthDeepLinkRequestType,\n  ): Promise<ManagedAuthDeepLinkResolutionType>;\n}\n\nexport class BrowserAccountsApiError extends Error {\n  readonly name = \"BrowserAccountsApiError\";\n  constructor(\n    readonly status: number,\n    readonly code: string,\n    options?: { cause?: unknown },\n  ) {\n    super(code, options?.cause === undefined ? undefined : { cause: options.cause });\n  }\n}\n\nexport class BrowserAccountsClient implements BrowserAccountsClientLike {\n  readonly #baseUrl: string;\n  readonly #fetch: BrowserAccountsFetch;\n  // CSRF is generation-bound. Exact idempotent replay must retain the\n  // admission envelope even after an authority reread observes a newer clock.\n  readonly #mutationAdmissions = new Map<\n    string,\n    { signature: string; csrfToken: string; actorEpoch: string }\n  >();\n  #projection: ManagedAuthSessionSetProjectionType | null = null;\n  #authorityReadEpoch = 0;\n  #authorityResetPending = false;\n  #authorityReconciliation: Promise<ManagedAuthSessionSetProjectionType> | null = null;\n\n  constructor(options: BrowserAccountsClientOptions) {\n    this.#baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.#fetch = options.fetch ?? ((input, init) => fetch(input, init));\n  }\n\n  async getSessionSet(): Promise<ManagedAuthSessionSetProjectionType> {\n    if (this.#authorityResetPending || this.#authorityReconciliation) {\n      return await this.reconcileSessionSetAuthority();\n    }\n    const readEpoch = this.#authorityReadEpoch;\n    const received = await this.#readSessionSet();\n    if (readEpoch !== this.#authorityReadEpoch) {\n      return this.#authorityReconciliation\n        ? await this.#authorityReconciliation\n        : (this.#projection ?? (await this.getSessionSet()));\n    }\n    return this.#remember(received);\n  }\n\n  async reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType> {\n    if (this.#authorityReconciliation) return await this.#authorityReconciliation;\n    const previous = this.#projection;\n    const readEpoch = ++this.#authorityReadEpoch;\n    // Explicit reconciliation is an authority-invalidation boundary, not an\n    // ordinary monotonic refresh. Old operation admissions must never cross it,\n    // and mutations stay closed until two sequential reads reach a decision.\n    this.#authorityResetPending = true;\n    this.#mutationAdmissions.clear();\n    const reconciliation = this.#reconcileSessionSetAuthority(previous, readEpoch);\n    this.#authorityReconciliation = reconciliation;\n    try {\n      const accepted = await reconciliation;\n      if (readEpoch === this.#authorityReadEpoch) this.#authorityResetPending = false;\n      return accepted;\n    } finally {\n      if (this.#authorityReconciliation === reconciliation) {\n        this.#authorityReconciliation = null;\n      }\n    }\n  }\n\n  async bootstrapSessionSet(request: BootstrapManagedAuthSessionSetRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/bootstrap\",\n      BootstrapManagedAuthSessionSetRequest,\n      request,\n    );\n  }\n\n  async beginLoginTransaction(request: BeginManagedAuthLoginTransactionRequestType) {\n    return ManagedAuthLoginTransaction.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions\",\n        BeginManagedAuthLoginTransactionRequest,\n        request,\n      ),\n    );\n  }\n\n  async completeEmailPasswordTransaction(\n    request: CompleteManagedAuthEmailPasswordTransactionRequestType,\n  ) {\n    const authorityReadEpoch = this.#authorityReadEpoch;\n    const response = CompleteManagedAuthLoginTransactionResponse.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions/email-password\",\n        CompleteManagedAuthEmailPasswordTransactionRequest,\n        request,\n      ),\n    );\n    if (authorityReadEpoch !== this.#authorityReadEpoch) {\n      return { ...response, projection: await this.getSessionSet() };\n    }\n    const remembered = this.#remember(response.projection);\n    if (remembered !== response.projection) {\n      return { ...response, projection: await this.getSessionSet() };\n    }\n    return response;\n  }\n\n  async startSocialTransaction(request: StartManagedAuthSocialTransactionRequestType) {\n    return StartManagedAuthSocialTransactionResponse.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions/social\",\n        StartManagedAuthSocialTransactionRequest,\n        request,\n      ),\n    );\n  }\n\n  async cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType) {\n    return this.#projectionResponse(\n      \"DELETE\",\n      `/v1/auth/session-set/transactions/${encodeURIComponent(request.transactionId)}`,\n      CancelManagedAuthLoginTransactionRequest,\n      request,\n    );\n  }\n\n  async selectLoginSlot(request: SelectManagedAuthLoginSlotRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/select\",\n      SelectManagedAuthLoginSlotRequest,\n      request,\n    );\n  }\n\n  async logoutLoginSlot(request: LogoutManagedAuthLoginSlotRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/logout-one\",\n      LogoutManagedAuthLoginSlotRequest,\n      request,\n    );\n  }\n\n  async logoutSessionSet(request: LogoutManagedAuthSessionSetRequestType) {\n    const receipt = ManagedAuthLogoutAllReceipt.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/logout-all\",\n        LogoutManagedAuthSessionSetRequest,\n        request,\n      ),\n    );\n    this.#authorityReadEpoch += 1;\n    this.#authorityResetPending = false;\n    this.#projection = null;\n    this.#mutationAdmissions.clear();\n    return receipt;\n  }\n\n  async resolveDeepLink(request: ResolveManagedAuthDeepLinkRequestType) {\n    return ManagedAuthDeepLinkResolution.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/deep-link/resolve\",\n        ResolveManagedAuthDeepLinkRequest,\n        request,\n      ),\n    );\n  }\n\n  async #projectionResponse<S extends z.ZodType>(\n    method: \"POST\" | \"DELETE\",\n    path: string,\n    schema: S,\n    request: z.infer<S>,\n  ): Promise<ManagedAuthSessionSetProjectionType> {\n    const authorityReadEpoch = this.#authorityReadEpoch;\n    const received = ManagedAuthSessionSetProjection.parse(\n      await this.#mutation(method, path, schema, request),\n    );\n    if (authorityReadEpoch !== this.#authorityReadEpoch) return await this.getSessionSet();\n    const remembered = this.#remember(received);\n    // An exact replay may legitimately return its older durable receipt after\n    // another tab has advanced this in-memory client. Reconcile from authority\n    // instead of presenting that receipt as the current actor projection.\n    return remembered === received ? received : await this.getSessionSet();\n  }\n\n  async #mutation<S extends z.ZodType>(\n    method: \"POST\" | \"DELETE\",\n    path: string,\n    schema: S,\n    request: z.infer<S>,\n  ): Promise<unknown> {\n    if (this.#authorityResetPending) {\n      throw new BrowserAccountsApiError(409, \"actor_change_required\");\n    }\n    const body = schema.parse(request);\n    const projection = this.#projection;\n    if (!projection) throw new BrowserAccountsApiError(409, \"session_set_projection_required\");\n    const operationId = mutationOperationId(body);\n    const signature = operationId ? JSON.stringify([method, path, body]) : null;\n    const retained = operationId ? this.#mutationAdmissions.get(operationId) : null;\n    if (retained && retained.signature !== signature) {\n      throw new BrowserAccountsApiError(409, \"operation_reused\");\n    }\n    const admission =\n      retained ??\n      ({\n        signature: signature ?? \"\",\n        csrfToken: projection.csrfToken,\n        actorEpoch: projection.actorEpoch,\n      } as const);\n    if (operationId && !retained) {\n      this.#mutationAdmissions.set(operationId, admission);\n      if (this.#mutationAdmissions.size > 64) {\n        this.#mutationAdmissions.delete(this.#mutationAdmissions.keys().next().value!);\n      }\n    }\n    return await this.#request(method, path, body, {\n      \"x-opengeni-session-csrf\": admission.csrfToken,\n      \"x-opengeni-actor-epoch\": admission.actorEpoch,\n    });\n  }\n\n  async #request(\n    method: \"GET\" | \"POST\" | \"DELETE\",\n    path: string,\n    body?: unknown,\n    headers: Record<string, string> = {},\n  ): Promise<unknown> {\n    let response: Response;\n    try {\n      response = await this.#fetch(`${this.#baseUrl}${path}`, {\n        method,\n        credentials: \"include\",\n        headers: {\n          accept: \"application/json\",\n          [MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER]:\n            MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,\n          ...(body === undefined ? {} : { \"content-type\": \"application/json\" }),\n          ...headers,\n        },\n        ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n      });\n    } catch (cause) {\n      if (method !== \"GET\") {\n        throw new BrowserAccountsApiError(503, \"operation_outcome_unknown\", { cause });\n      }\n      throw cause;\n    }\n    let parsed = true;\n    const value = await response.json().catch(() => {\n      parsed = false;\n      return null;\n    });\n    if (!response.ok) {\n      const code = managedAuthErrorCode(value) ?? `http_${response.status}`;\n      throw new BrowserAccountsApiError(response.status, code);\n    }\n    if (!parsed && method !== \"GET\") {\n      throw new BrowserAccountsApiError(503, \"operation_outcome_unknown\");\n    }\n    return value;\n  }\n\n  async #readSessionSet(): Promise<ManagedAuthSessionSetProjectionType> {\n    return ManagedAuthSessionSetProjection.parse(\n      await this.#request(\"GET\", \"/v1/auth/session-set\"),\n    );\n  }\n\n  async #reconcileSessionSetAuthority(\n    previous: ManagedAuthSessionSetProjectionType | null,\n    readEpoch: number,\n  ): Promise<ManagedAuthSessionSetProjectionType> {\n    const first = await this.#readSessionSet();\n    const second = await this.#readSessionSet();\n    if (readEpoch !== this.#authorityReadEpoch) {\n      return await this.#reconcileSessionSetAuthority(this.#projection, this.#authorityReadEpoch);\n    }\n    if (this.#projection !== previous) return this.#remember(second);\n    if (!previous || compareProjectionClock(second, previous) >= 0) {\n      return this.#remember(second);\n    }\n    if (compareProjectionClock(first, previous) < 0 && compareProjectionClock(second, first) >= 0) {\n      // Same-authority clocks never decrease. Two sequential no-store reads\n      // that both remain below the remembered clock therefore prove that the\n      // HttpOnly authority rotated; the second may already have advanced from\n      // the fresh authority's initial 1/1 projection.\n      this.#projection = second;\n      this.#mutationAdmissions.clear();\n      return second;\n    }\n    return previous;\n  }\n\n  #remember(projection: ManagedAuthSessionSetProjectionType) {\n    const current = this.#projection;\n    if (!current || compareProjectionClock(projection, current) >= 0) {\n      this.#projection = projection;\n      return projection;\n    }\n    return current;\n  }\n}\n\nfunction mutationOperationId(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const operationId = (value as { operationId?: unknown }).operationId;\n  return typeof operationId === \"string\" ? operationId : null;\n}\n\nfunction compareProjectionClock(\n  left: Pick<ManagedAuthSessionSetProjectionType, \"actorEpoch\" | \"generation\">,\n  right: Pick<ManagedAuthSessionSetProjectionType, \"actorEpoch\" | \"generation\">,\n): number {\n  const actorDelta = BigInt(left.actorEpoch) - BigInt(right.actorEpoch);\n  if (actorDelta !== 0n) return actorDelta > 0n ? 1 : -1;\n  const generationDelta = BigInt(left.generation) - BigInt(right.generation);\n  return generationDelta === 0n ? 0 : generationDelta > 0n ? 1 : -1;\n}\n\nfunction managedAuthErrorCode(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const error = (value as { error?: unknown }).error;\n  if (error && typeof error === \"object\") {\n    const details = (error as { details?: unknown }).details;\n    if (details && typeof details === \"object\") {\n      const parsed = ManagedAuthSessionSetErrorCode.safeParse(\n        (details as { managedAuthCode?: unknown }).managedAuthCode,\n      );\n      if (parsed.success) return parsed.data;\n    }\n  }\n  const legacy = (value as { message?: unknown }).message;\n  const parsed = ManagedAuthSessionSetErrorCode.safeParse(legacy);\n  return parsed.success ? parsed.data : null;\n}\n\nexport function createBrowserAccountsClient(\n  options: BrowserAccountsClientOptions,\n): BrowserAccountsClient {\n  return new BrowserAccountsClient(options);\n}\n\nexport type {\n  BeginManagedAuthLoginTransactionRequestType as BeginManagedAuthLoginTransactionRequest,\n  BootstrapManagedAuthSessionSetRequestType as BootstrapManagedAuthSessionSetRequest,\n  CancelManagedAuthLoginTransactionRequestType as CancelManagedAuthLoginTransactionRequest,\n  CompleteManagedAuthEmailPasswordTransactionRequestType as CompleteManagedAuthEmailPasswordTransactionRequest,\n  CompleteManagedAuthLoginTransactionResponseType as CompleteManagedAuthLoginTransactionResponse,\n  LogoutManagedAuthLoginSlotRequestType as LogoutManagedAuthLoginSlotRequest,\n  LogoutManagedAuthSessionSetRequestType as LogoutManagedAuthSessionSetRequest,\n  ManagedAuthDeepLinkResolutionType as ManagedAuthDeepLinkResolution,\n  ManagedAuthLoginTransactionType as ManagedAuthLoginTransaction,\n  ManagedAuthLogoutAllReceiptType as ManagedAuthLogoutAllReceipt,\n  ManagedAuthSessionSetProjectionType as ManagedAuthSessionSetProjection,\n  ResolveManagedAuthDeepLinkRequestType as ResolveManagedAuthDeepLinkRequest,\n  SelectManagedAuthLoginSlotRequestType as SelectManagedAuthLoginSlotRequest,\n};\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAgBK;AA6CA,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAEjD,YACW,QACA,MACT,SACA;AACA,UAAM,MAAM,SAAS,UAAU,SAAY,SAAY,EAAE,OAAO,QAAQ,MAAM,CAAC;AAJtE;AACA;AAAA,EAIX;AAAA,EAPS,OAAO;AAQlB;AAEO,IAAM,wBAAN,MAAiE;AAAA,EAC7D;AAAA,EACA;AAAA;AAAA;AAAA,EAGA,sBAAsB,oBAAI,IAGjC;AAAA,EACF,cAA0D;AAAA,EAC1D,sBAAsB;AAAA,EACtB,yBAAyB;AAAA,EACzB,2BAAgF;AAAA,EAEhF,YAAY,SAAuC;AACjD,SAAK,WAAW,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;AAClD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAAO,SAAS,MAAM,OAAO,IAAI;AAAA,EACpE;AAAA,EAEA,MAAM,gBAA8D;AAClE,QAAI,KAAK,0BAA0B,KAAK,0BAA0B;AAChE,aAAO,MAAM,KAAK,6BAA6B;AAAA,IACjD;AACA,UAAM,YAAY,KAAK;AACvB,UAAM,WAAW,MAAM,KAAK,gBAAgB;AAC5C,QAAI,cAAc,KAAK,qBAAqB;AAC1C,aAAO,KAAK,2BACR,MAAM,KAAK,2BACV,KAAK,eAAgB,MAAM,KAAK,cAAc;AAAA,IACrD;AACA,WAAO,KAAK,UAAU,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,+BAA6E;AACjF,QAAI,KAAK,yBAA0B,QAAO,MAAM,KAAK;AACrD,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,EAAE,KAAK;AAIzB,SAAK,yBAAyB;AAC9B,SAAK,oBAAoB,MAAM;AAC/B,UAAM,iBAAiB,KAAK,8BAA8B,UAAU,SAAS;AAC7E,SAAK,2BAA2B;AAChC,QAAI;AACF,YAAM,WAAW,MAAM;AACvB,UAAI,cAAc,KAAK,oBAAqB,MAAK,yBAAyB;AAC1E,aAAO;AAAA,IACT,UAAE;AACA,UAAI,KAAK,6BAA6B,gBAAgB;AACpD,aAAK,2BAA2B;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,SAAoD;AAC5E,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,sBAAsB,SAAsD;AAChF,WAAO,4BAA4B;AAAA,MACjC,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iCACJ,SACA;AACA,UAAM,qBAAqB,KAAK;AAChC,UAAM,WAAW,4CAA4C;AAAA,MAC3D,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,uBAAuB,KAAK,qBAAqB;AACnD,aAAO,EAAE,GAAG,UAAU,YAAY,MAAM,KAAK,cAAc,EAAE;AAAA,IAC/D;AACA,UAAM,aAAa,KAAK,UAAU,SAAS,UAAU;AACrD,QAAI,eAAe,SAAS,YAAY;AACtC,aAAO,EAAE,GAAG,UAAU,YAAY,MAAM,KAAK,cAAc,EAAE;AAAA,IAC/D;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,uBAAuB,SAAuD;AAClF,WAAO,0CAA0C;AAAA,MAC/C,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,uBAAuB,SAAuD;AAClF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qCAAqC,mBAAmB,QAAQ,aAAa,CAAC;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,SAAiD;AACtE,UAAM,UAAU,4BAA4B;AAAA,MAC1C,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,SAAK,uBAAuB;AAC5B,SAAK,yBAAyB;AAC9B,SAAK,cAAc;AACnB,SAAK,oBAAoB,MAAM;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,8BAA8B;AAAA,MACnC,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBACJ,QACA,MACA,QACA,SAC8C;AAC9C,UAAM,qBAAqB,KAAK;AAChC,UAAM,WAAW,gCAAgC;AAAA,MAC/C,MAAM,KAAK,UAAU,QAAQ,MAAM,QAAQ,OAAO;AAAA,IACpD;AACA,QAAI,uBAAuB,KAAK,oBAAqB,QAAO,MAAM,KAAK,cAAc;AACrF,UAAM,aAAa,KAAK,UAAU,QAAQ;AAI1C,WAAO,eAAe,WAAW,WAAW,MAAM,KAAK,cAAc;AAAA,EACvE;AAAA,EAEA,MAAM,UACJ,QACA,MACA,QACA,SACkB;AAClB,QAAI,KAAK,wBAAwB;AAC/B,YAAM,IAAI,wBAAwB,KAAK,uBAAuB;AAAA,IAChE;AACA,UAAM,OAAO,OAAO,MAAM,OAAO;AACjC,UAAM,aAAa,KAAK;AACxB,QAAI,CAAC,WAAY,OAAM,IAAI,wBAAwB,KAAK,iCAAiC;AACzF,UAAM,cAAc,oBAAoB,IAAI;AAC5C,UAAM,YAAY,cAAc,KAAK,UAAU,CAAC,QAAQ,MAAM,IAAI,CAAC,IAAI;AACvE,UAAM,WAAW,cAAc,KAAK,oBAAoB,IAAI,WAAW,IAAI;AAC3E,QAAI,YAAY,SAAS,cAAc,WAAW;AAChD,YAAM,IAAI,wBAAwB,KAAK,kBAAkB;AAAA,IAC3D;AACA,UAAM,YACJ,YACC;AAAA,MACC,WAAW,aAAa;AAAA,MACxB,WAAW,WAAW;AAAA,MACtB,YAAY,WAAW;AAAA,IACzB;AACF,QAAI,eAAe,CAAC,UAAU;AAC5B,WAAK,oBAAoB,IAAI,aAAa,SAAS;AACnD,UAAI,KAAK,oBAAoB,OAAO,IAAI;AACtC,aAAK,oBAAoB,OAAO,KAAK,oBAAoB,KAAK,EAAE,KAAK,EAAE,KAAM;AAAA,MAC/E;AAAA,IACF;AACA,WAAO,MAAM,KAAK,SAAS,QAAQ,MAAM,MAAM;AAAA,MAC7C,2BAA2B,UAAU;AAAA,MACrC,0BAA0B,UAAU;AAAA,IACtC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,SACJ,QACA,MACA,MACA,UAAkC,CAAC,GACjB;AAClB,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,IAAI,IAAI;AAAA,QACtD;AAAA,QACA,aAAa;AAAA,QACb,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,CAAC,4CAA4C,GAC3C;AAAA,UACF,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,UACnE,GAAG;AAAA,QACL;AAAA,QACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,MAC7D,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,WAAW,OAAO;AACpB,cAAM,IAAI,wBAAwB,KAAK,6BAA6B,EAAE,MAAM,CAAC;AAAA,MAC/E;AACA,YAAM;AAAA,IACR;AACA,QAAI,SAAS;AACb,UAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM;AAC9C,eAAS;AACT,aAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,OAAO,qBAAqB,KAAK,KAAK,QAAQ,SAAS,MAAM;AACnE,YAAM,IAAI,wBAAwB,SAAS,QAAQ,IAAI;AAAA,IACzD;AACA,QAAI,CAAC,UAAU,WAAW,OAAO;AAC/B,YAAM,IAAI,wBAAwB,KAAK,2BAA2B;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,kBAAgE;AACpE,WAAO,gCAAgC;AAAA,MACrC,MAAM,KAAK,SAAS,OAAO,sBAAsB;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,8BACJ,UACA,WAC8C;AAC9C,UAAM,QAAQ,MAAM,KAAK,gBAAgB;AACzC,UAAM,SAAS,MAAM,KAAK,gBAAgB;AAC1C,QAAI,cAAc,KAAK,qBAAqB;AAC1C,aAAO,MAAM,KAAK,8BAA8B,KAAK,aAAa,KAAK,mBAAmB;AAAA,IAC5F;AACA,QAAI,KAAK,gBAAgB,SAAU,QAAO,KAAK,UAAU,MAAM;AAC/D,QAAI,CAAC,YAAY,uBAAuB,QAAQ,QAAQ,KAAK,GAAG;AAC9D,aAAO,KAAK,UAAU,MAAM;AAAA,IAC9B;AACA,QAAI,uBAAuB,OAAO,QAAQ,IAAI,KAAK,uBAAuB,QAAQ,KAAK,KAAK,GAAG;AAK7F,WAAK,cAAc;AACnB,WAAK,oBAAoB,MAAM;AAC/B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,UAAU,YAAiD;AACzD,UAAM,UAAU,KAAK;AACrB,QAAI,CAAC,WAAW,uBAAuB,YAAY,OAAO,KAAK,GAAG;AAChE,WAAK,cAAc;AACnB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,OAA+B;AAC1D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,cAAe,MAAoC;AACzD,SAAO,OAAO,gBAAgB,WAAW,cAAc;AACzD;AAEA,SAAS,uBACP,MACA,OACQ;AACR,QAAM,aAAa,OAAO,KAAK,UAAU,IAAI,OAAO,MAAM,UAAU;AACpE,MAAI,eAAe,GAAI,QAAO,aAAa,KAAK,IAAI;AACpD,QAAM,kBAAkB,OAAO,KAAK,UAAU,IAAI,OAAO,MAAM,UAAU;AACzE,SAAO,oBAAoB,KAAK,IAAI,kBAAkB,KAAK,IAAI;AACjE;AAEA,SAAS,qBAAqB,OAA+B;AAC3D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAS,MAA8B;AAC7C,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,UAAW,MAAgC;AACjD,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,YAAMA,UAAS,+BAA+B;AAAA,QAC3C,QAA0C;AAAA,MAC7C;AACA,UAAIA,QAAO,QAAS,QAAOA,QAAO;AAAA,IACpC;AAAA,EACF;AACA,QAAM,SAAU,MAAgC;AAChD,QAAM,SAAS,+BAA+B,UAAU,MAAM;AAC9D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEO,SAAS,4BACd,SACuB;AACvB,SAAO,IAAI,sBAAsB,OAAO;AAC1C;","names":["parsed"]}

package/dist/adapters/express.d.ts

@@ -0,0 +1,31 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+/** Any web-standard handler: `createSessionProxyHandler`, `createChatHandler`, or your own. */
+export type WebHandler = (request: Request) => Promise<Response>;
+/** Express/Connect request: Node's `IncomingMessage` plus what those frameworks add. */
+export type NodeRequestLike = IncomingMessage & {
+    originalUrl?: string | undefined;
+    /** Set when a body parser (for example `express.json()`) already consumed the body. */
+    body?: unknown;
+    protocol?: string | undefined;
+};
+export type NodeMiddleware = (request: NodeRequestLike, response: ServerResponse, next?: (error?: unknown) => void) => void;
+export type NodeMiddlewareOptions = {
+    /** Origin used to build the request URL. Defaults to the Host header over http(s). */
+    origin?: string | undefined;
+};
+/**
+ * Expose a web-standard handler as Express/Connect (or plain `node:http`)
+ * middleware. Mount it with the same path the browser client uses:
+ *
+ * ```ts
+ * app.use("/api/opengeni", toNodeMiddleware(handler));
+ * ```
+ *
+ * The full original URL is forwarded (Express strips the mount path from
+ * `req.url`), bodies stream through unless a body parser already consumed
+ * them, responses (including SSE) are written as they arrive, and a client
+ * disconnect aborts the request signal.
+ */
+export declare function toNodeMiddleware(handler: WebHandler, options?: NodeMiddlewareOptions): NodeMiddleware;
+/** Express/Connect naming alias. */
+export declare const toExpressMiddleware: typeof toNodeMiddleware;

package/dist/adapters/express.js

@@ -0,0 +1,87 @@
+// src/adapters/express.ts
+import { Readable } from "stream";
+function toNodeMiddleware(handler, options = {}) {
+  return (request, response, next) => {
+    void (async () => {
+      const abort = new AbortController();
+      response.once("close", () => {
+        if (!response.writableFinished) abort.abort();
+      });
+      const web = await handler(toWebRequest(request, abort.signal, options));
+      await writeWebResponse(web, response);
+    })().catch((error) => {
+      if (next) next(error);
+      else if (!response.headersSent) {
+        response.statusCode = 500;
+        response.end();
+      } else response.destroy(error instanceof Error ? error : void 0);
+    });
+  };
+}
+var toExpressMiddleware = toNodeMiddleware;
+function toWebRequest(request, signal, options) {
+  const encrypted = request.socket?.encrypted === true;
+  const origin = options.origin?.replace(/\/+$/, "") ?? `${request.protocol ?? (encrypted ? "https" : "http")}://${request.headers.host ?? "localhost"}`;
+  const url = new URL(request.originalUrl ?? request.url ?? "/", origin);
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(request.headers)) {
+    if (value === void 0) continue;
+    if (Array.isArray(value)) for (const item of value) headers.append(name, item);
+    else headers.set(name, value);
+  }
+  const method = request.method ?? "GET";
+  let body;
+  if (method !== "GET" && method !== "HEAD") {
+    if (request.body !== void 0 && (request.readableEnded || request.complete)) {
+      body = typeof request.body === "string" || request.body instanceof Uint8Array ? request.body : JSON.stringify(request.body);
+      headers.delete("content-length");
+    } else {
+      body = Readable.toWeb(request);
+    }
+  }
+  return new Request(url, {
+    method,
+    headers,
+    signal,
+    ...body !== void 0 ? { body, duplex: "half" } : {}
+  });
+}
+async function writeWebResponse(web, response) {
+  response.statusCode = web.status;
+  const cookies = web.headers.getSetCookie?.() ?? [];
+  web.headers.forEach((value, name) => {
+    if (name.toLowerCase() !== "set-cookie") response.setHeader(name, value);
+  });
+  if (cookies.length > 0) response.setHeader("set-cookie", cookies);
+  if (!web.body) {
+    response.end();
+    return;
+  }
+  response.flushHeaders();
+  const reader = web.body.getReader();
+  response.once("close", () => {
+    void reader.cancel().catch(() => void 0);
+  });
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!response.write(value)) {
+      await new Promise((resolve) => {
+        const settle = () => {
+          response.off("drain", settle);
+          response.off("close", settle);
+          resolve();
+        };
+        response.once("drain", settle);
+        response.once("close", settle);
+      });
+    }
+    if (response.destroyed) break;
+  }
+  response.end();
+}
+export {
+  toExpressMiddleware,
+  toNodeMiddleware
+};
+//# sourceMappingURL=express.js.map

package/dist/adapters/express.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/adapters/express.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { Readable } from \"node:stream\";\n\n/** Any web-standard handler: `createSessionProxyHandler`, `createChatHandler`, or your own. */\nexport type WebHandler = (request: Request) => Promise<Response>;\n\n/** Express/Connect request: Node's `IncomingMessage` plus what those frameworks add. */\nexport type NodeRequestLike = IncomingMessage & {\n  originalUrl?: string | undefined;\n  /** Set when a body parser (for example `express.json()`) already consumed the body. */\n  body?: unknown;\n  protocol?: string | undefined;\n};\n\nexport type NodeMiddleware = (\n  request: NodeRequestLike,\n  response: ServerResponse,\n  next?: (error?: unknown) => void,\n) => void;\n\nexport type NodeMiddlewareOptions = {\n  /** Origin used to build the request URL. Defaults to the Host header over http(s). */\n  origin?: string | undefined;\n};\n\n/**\n * Expose a web-standard handler as Express/Connect (or plain `node:http`)\n * middleware. Mount it with the same path the browser client uses:\n *\n * ```ts\n * app.use(\"/api/opengeni\", toNodeMiddleware(handler));\n * ```\n *\n * The full original URL is forwarded (Express strips the mount path from\n * `req.url`), bodies stream through unless a body parser already consumed\n * them, responses (including SSE) are written as they arrive, and a client\n * disconnect aborts the request signal.\n */\nexport function toNodeMiddleware(\n  handler: WebHandler,\n  options: NodeMiddlewareOptions = {},\n): NodeMiddleware {\n  return (request, response, next) => {\n    void (async () => {\n      const abort = new AbortController();\n      response.once(\"close\", () => {\n        if (!response.writableFinished) abort.abort();\n      });\n      const web = await handler(toWebRequest(request, abort.signal, options));\n      await writeWebResponse(web, response);\n    })().catch((error: unknown) => {\n      if (next) next(error);\n      else if (!response.headersSent) {\n        response.statusCode = 500;\n        response.end();\n      } else response.destroy(error instanceof Error ? error : undefined);\n    });\n  };\n}\n\n/** Express/Connect naming alias. */\nexport const toExpressMiddleware = toNodeMiddleware;\n\nfunction toWebRequest(\n  request: NodeRequestLike,\n  signal: AbortSignal,\n  options: NodeMiddlewareOptions,\n): Request {\n  const encrypted = (request.socket as { encrypted?: boolean } | undefined)?.encrypted === true;\n  const origin =\n    options.origin?.replace(/\\/+$/, \"\") ??\n    `${request.protocol ?? (encrypted ? \"https\" : \"http\")}://${request.headers.host ?? \"localhost\"}`;\n  const url = new URL(request.originalUrl ?? request.url ?? \"/\", origin);\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(request.headers)) {\n    if (value === undefined) continue;\n    if (Array.isArray(value)) for (const item of value) headers.append(name, item);\n    else headers.set(name, value);\n  }\n  const method = request.method ?? \"GET\";\n  let body: BodyInit | undefined;\n  if (method !== \"GET\" && method !== \"HEAD\") {\n    if (request.body !== undefined && (request.readableEnded || request.complete)) {\n      // A body parser consumed the stream: forward what it parsed.\n      body =\n        typeof request.body === \"string\" || request.body instanceof Uint8Array\n          ? (request.body as string | Uint8Array<ArrayBuffer>)\n          : JSON.stringify(request.body);\n      headers.delete(\"content-length\");\n    } else {\n      body = Readable.toWeb(request) as unknown as ReadableStream<Uint8Array>;\n    }\n  }\n  return new Request(url, {\n    method,\n    headers,\n    signal,\n    ...(body !== undefined ? { body, duplex: \"half\" } : {}),\n  } as RequestInit);\n}\n\nasync function writeWebResponse(web: Response, response: ServerResponse): Promise<void> {\n  response.statusCode = web.status;\n  const cookies = web.headers.getSetCookie?.() ?? [];\n  web.headers.forEach((value, name) => {\n    if (name.toLowerCase() !== \"set-cookie\") response.setHeader(name, value);\n  });\n  if (cookies.length > 0) response.setHeader(\"set-cookie\", cookies);\n  if (!web.body) {\n    response.end();\n    return;\n  }\n  // Send headers now so SSE clients see the stream open before the first event.\n  response.flushHeaders();\n  const reader = web.body.getReader();\n  response.once(\"close\", () => {\n    void reader.cancel().catch(() => undefined);\n  });\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    if (!response.write(value)) {\n      await new Promise<void>((resolve) => {\n        const settle = () => {\n          response.off(\"drain\", settle);\n          response.off(\"close\", settle);\n          resolve();\n        };\n        response.once(\"drain\", settle);\n        response.once(\"close\", settle);\n      });\n    }\n    if (response.destroyed) break;\n  }\n  response.end();\n}\n"],"mappings":";AACA,SAAS,gBAAgB;AAqClB,SAAS,iBACd,SACA,UAAiC,CAAC,GAClB;AAChB,SAAO,CAAC,SAAS,UAAU,SAAS;AAClC,UAAM,YAAY;AAChB,YAAM,QAAQ,IAAI,gBAAgB;AAClC,eAAS,KAAK,SAAS,MAAM;AAC3B,YAAI,CAAC,SAAS,iBAAkB,OAAM,MAAM;AAAA,MAC9C,CAAC;AACD,YAAM,MAAM,MAAM,QAAQ,aAAa,SAAS,MAAM,QAAQ,OAAO,CAAC;AACtE,YAAM,iBAAiB,KAAK,QAAQ;AAAA,IACtC,GAAG,EAAE,MAAM,CAAC,UAAmB;AAC7B,UAAI,KAAM,MAAK,KAAK;AAAA,eACX,CAAC,SAAS,aAAa;AAC9B,iBAAS,aAAa;AACtB,iBAAS,IAAI;AAAA,MACf,MAAO,UAAS,QAAQ,iBAAiB,QAAQ,QAAQ,MAAS;AAAA,IACpE,CAAC;AAAA,EACH;AACF;AAGO,IAAM,sBAAsB;AAEnC,SAAS,aACP,SACA,QACA,SACS;AACT,QAAM,YAAa,QAAQ,QAAgD,cAAc;AACzF,QAAM,SACJ,QAAQ,QAAQ,QAAQ,QAAQ,EAAE,KAClC,GAAG,QAAQ,aAAa,YAAY,UAAU,OAAO,MAAM,QAAQ,QAAQ,QAAQ,WAAW;AAChG,QAAM,MAAM,IAAI,IAAI,QAAQ,eAAe,QAAQ,OAAO,KAAK,MAAM;AACrE,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC3D,QAAI,UAAU,OAAW;AACzB,QAAI,MAAM,QAAQ,KAAK,EAAG,YAAW,QAAQ,MAAO,SAAQ,OAAO,MAAM,IAAI;AAAA,QACxE,SAAQ,IAAI,MAAM,KAAK;AAAA,EAC9B;AACA,QAAM,SAAS,QAAQ,UAAU;AACjC,MAAI;AACJ,MAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,QAAI,QAAQ,SAAS,WAAc,QAAQ,iBAAiB,QAAQ,WAAW;AAE7E,aACE,OAAO,QAAQ,SAAS,YAAY,QAAQ,gBAAgB,aACvD,QAAQ,OACT,KAAK,UAAU,QAAQ,IAAI;AACjC,cAAQ,OAAO,gBAAgB;AAAA,IACjC,OAAO;AACL,aAAO,SAAS,MAAM,OAAO;AAAA,IAC/B;AAAA,EACF;AACA,SAAO,IAAI,QAAQ,KAAK;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,SAAS,SAAY,EAAE,MAAM,QAAQ,OAAO,IAAI,CAAC;AAAA,EACvD,CAAgB;AAClB;AAEA,eAAe,iBAAiB,KAAe,UAAyC;AACtF,WAAS,aAAa,IAAI;AAC1B,QAAM,UAAU,IAAI,QAAQ,eAAe,KAAK,CAAC;AACjD,MAAI,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACnC,QAAI,KAAK,YAAY,MAAM,aAAc,UAAS,UAAU,MAAM,KAAK;AAAA,EACzE,CAAC;AACD,MAAI,QAAQ,SAAS,EAAG,UAAS,UAAU,cAAc,OAAO;AAChE,MAAI,CAAC,IAAI,MAAM;AACb,aAAS,IAAI;AACb;AAAA,EACF;AAEA,WAAS,aAAa;AACtB,QAAM,SAAS,IAAI,KAAK,UAAU;AAClC,WAAS,KAAK,SAAS,MAAM;AAC3B,SAAK,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EAC5C,CAAC;AACD,aAAS;AACP,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,QAAI,CAAC,SAAS,MAAM,KAAK,GAAG;AAC1B,YAAM,IAAI,QAAc,CAAC,YAAY;AACnC,cAAM,SAAS,MAAM;AACnB,mBAAS,IAAI,SAAS,MAAM;AAC5B,mBAAS,IAAI,SAAS,MAAM;AAC5B,kBAAQ;AAAA,QACV;AACA,iBAAS,KAAK,SAAS,MAAM;AAC7B,iBAAS,KAAK,SAAS,MAAM;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,QAAI,SAAS,UAAW;AAAA,EAC1B;AACA,WAAS,IAAI;AACf;","names":[]}