@opengeni/sdk 2.5.0-canary.2 → 3.1.0

package/README.md

@@ -37,6 +37,60 @@ for await (const event of client.streamEvents(workspaceId, session.id)) {
 }
 ```
 
+Browser consoles that do not need operator-only surfaces can import
+`OpenGeniBrowserClient` from `@opengeni/sdk/browser`. Document authority migration
+and Default-collection backfill methods stay available on the backward-compatible
+root and `@opengeni/sdk/core` clients, or through the focused
+`@opengeni/sdk/document-authority` entry:
+
+```ts
+import { OpenGeniDocumentAuthorityClient } from "@opengeni/sdk/document-authority";
+
+const operatorClient = new OpenGeniDocumentAuthorityClient({
+  baseUrl: "https://api.example.com",
+  apiKey: process.env.OPENGENI_API_KEY!,
+});
+```
+
+## Related-work discovery
+
+`listAgentTopology` returns a bounded hierarchy page plus provider-neutral
+`relatedWork` evidence. A text query searches durable semantic titles, active
+goals, and typed work claims; it never searches the opening prompt. An exact
+subject filter looks up one canonical typed identity:
+
+```ts
+const page = await client.listAgentTopology(workspaceId, {
+  query: "permission scoped discovery",
+  statuses: ["running", "requires_action"],
+  activeOnly: true,
+  recentHours: 72,
+  claimLimit: 4,
+});
+
+for (const session of page.sessions) {
+  if (!session.relatedWork.possibleOverlap) continue;
+  console.log(session.title, session.relatedWork.match, session.relatedWork.claims);
+}
+
+const exact = await client.listAgentTopology(workspaceId, {
+  subject: {
+    namespace: "github",
+    type: "pull_request",
+    canonicalKey: "acme/app#42",
+  },
+});
+```
+
+The evidence is always advisory: `advisoryOnly` and `noAdditionalAccess` are
+literal `true` fields, and receiving a row does not authorize detail, message,
+or control operations. Preserve `nextCursor` with the exact same filters;
+relevance cursors are filter- and activity-snapshot-bound. A topology response
+may carry `humanAdvisoriesEnabled: false`, which lets a human-facing client hide
+the advisory UI without changing stored evidence or API authority. See
+[`docs/work-discovery.md`](../../docs/work-discovery.md) for ranking, bounds,
+claim lifecycle, and rollout semantics.
+
 ## Session visibility and forks
 
 For organizations with session-tenancy activation, a canonical managed-cookie

package/dist/accounts.d.ts

@@ -0,0 +1,149 @@
+import { type BeginManagedAuthLoginTransactionRequest as BeginManagedAuthLoginTransactionRequestType, type BootstrapManagedAuthSessionSetRequest as BootstrapManagedAuthSessionSetRequestType, type CancelManagedAuthLoginTransactionRequest as CancelManagedAuthLoginTransactionRequestType, type CompleteManagedAuthEmailPasswordTransactionRequest as CompleteManagedAuthEmailPasswordTransactionRequestType, type CompleteManagedAuthLoginTransactionResponse as CompleteManagedAuthLoginTransactionResponseType, type LogoutManagedAuthLoginSlotRequest as LogoutManagedAuthLoginSlotRequestType, type LogoutManagedAuthSessionSetRequest as LogoutManagedAuthSessionSetRequestType, type ManagedAuthDeepLinkResolution as ManagedAuthDeepLinkResolutionType, type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType, type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType, type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType, type ResolveManagedAuthDeepLinkRequest as ResolveManagedAuthDeepLinkRequestType, type SelectManagedAuthLoginSlotRequest as SelectManagedAuthLoginSlotRequestType } from "@opengeni/contracts/managed-auth-session-sets";
+export type BrowserAccountsFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export type BrowserAccountsClientOptions = {
+    baseUrl: string;
+    fetch?: BrowserAccountsFetch;
+};
+export interface BrowserAccountsClientLike {
+    getSessionSet(): Promise<ManagedAuthSessionSetProjectionType>;
+    reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType>;
+    bootstrapSessionSet(request: BootstrapManagedAuthSessionSetRequestType): Promise<ManagedAuthSessionSetProjectionType>;
+    beginLoginTransaction(request: BeginManagedAuthLoginTransactionRequestType): Promise<ManagedAuthLoginTransactionType>;
+    completeEmailPasswordTransaction(request: CompleteManagedAuthEmailPasswordTransactionRequestType): Promise<CompleteManagedAuthLoginTransactionResponseType>;
+    cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType): Promise<ManagedAuthSessionSetProjectionType>;
+    selectLoginSlot(request: SelectManagedAuthLoginSlotRequestType): Promise<ManagedAuthSessionSetProjectionType>;
+    logoutLoginSlot(request: LogoutManagedAuthLoginSlotRequestType): Promise<ManagedAuthSessionSetProjectionType>;
+    logoutSessionSet(request: LogoutManagedAuthSessionSetRequestType): Promise<ManagedAuthLogoutAllReceiptType>;
+    resolveDeepLink(request: ResolveManagedAuthDeepLinkRequestType): Promise<ManagedAuthDeepLinkResolutionType>;
+}
+export declare class BrowserAccountsApiError extends Error {
+    readonly status: number;
+    readonly code: string;
+    readonly name = "BrowserAccountsApiError";
+    constructor(status: number, code: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare class BrowserAccountsClient implements BrowserAccountsClientLike {
+    #private;
+    constructor(options: BrowserAccountsClientOptions);
+    getSessionSet(): Promise<ManagedAuthSessionSetProjectionType>;
+    reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType>;
+    bootstrapSessionSet(request: BootstrapManagedAuthSessionSetRequestType): Promise<{
+        mode: "broker" | "dual" | "legacy";
+        generation: string;
+        actorEpoch: string;
+        csrfToken: string;
+        selectedSlotId: string | null;
+        state: "actor_change_required" | "ready";
+        slots: {
+            id: string;
+            displayName: string;
+            verifiedClaim: {
+                kind: "email";
+                value: string;
+            };
+            state: "active" | "reauth_required";
+        }[];
+    }>;
+    beginLoginTransaction(request: BeginManagedAuthLoginTransactionRequestType): Promise<{
+        id: string;
+        kind: "add" | "reauth";
+        expiresAt: string;
+        returnIntentId: string | null;
+    }>;
+    completeEmailPasswordTransaction(request: CompleteManagedAuthEmailPasswordTransactionRequestType): Promise<{
+        projection: {
+            mode: "broker" | "dual" | "legacy";
+            generation: string;
+            actorEpoch: string;
+            csrfToken: string;
+            selectedSlotId: string | null;
+            state: "actor_change_required" | "ready";
+            slots: {
+                id: string;
+                displayName: string;
+                verifiedClaim: {
+                    kind: "email";
+                    value: string;
+                };
+                state: "active" | "reauth_required";
+            }[];
+        };
+        returnIntent: string | null;
+    }>;
+    cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType): Promise<{
+        mode: "broker" | "dual" | "legacy";
+        generation: string;
+        actorEpoch: string;
+        csrfToken: string;
+        selectedSlotId: string | null;
+        state: "actor_change_required" | "ready";
+        slots: {
+            id: string;
+            displayName: string;
+            verifiedClaim: {
+                kind: "email";
+                value: string;
+            };
+            state: "active" | "reauth_required";
+        }[];
+    }>;
+    selectLoginSlot(request: SelectManagedAuthLoginSlotRequestType): Promise<{
+        mode: "broker" | "dual" | "legacy";
+        generation: string;
+        actorEpoch: string;
+        csrfToken: string;
+        selectedSlotId: string | null;
+        state: "actor_change_required" | "ready";
+        slots: {
+            id: string;
+            displayName: string;
+            verifiedClaim: {
+                kind: "email";
+                value: string;
+            };
+            state: "active" | "reauth_required";
+        }[];
+    }>;
+    logoutLoginSlot(request: LogoutManagedAuthLoginSlotRequestType): Promise<{
+        mode: "broker" | "dual" | "legacy";
+        generation: string;
+        actorEpoch: string;
+        csrfToken: string;
+        selectedSlotId: string | null;
+        state: "actor_change_required" | "ready";
+        slots: {
+            id: string;
+            displayName: string;
+            verifiedClaim: {
+                kind: "email";
+                value: string;
+            };
+            state: "active" | "reauth_required";
+        }[];
+    }>;
+    logoutSessionSet(request: LogoutManagedAuthSessionSetRequestType): Promise<{
+        generation: string;
+        actorEpoch: string;
+        state: "logged_out";
+    }>;
+    resolveDeepLink(request: ResolveManagedAuthDeepLinkRequestType): Promise<{
+        kind: "current";
+    } | {
+        kind: "switch_required";
+        slot: {
+            id: string;
+            displayName: string;
+            verifiedClaim: {
+                kind: "email";
+                value: string;
+            };
+            state: "active" | "reauth_required";
+        };
+    } | {
+        kind: "unavailable";
+    }>;
+}
+export declare function createBrowserAccountsClient(options: BrowserAccountsClientOptions): BrowserAccountsClient;
+export type { BeginManagedAuthLoginTransactionRequestType as BeginManagedAuthLoginTransactionRequest, BootstrapManagedAuthSessionSetRequestType as BootstrapManagedAuthSessionSetRequest, CancelManagedAuthLoginTransactionRequestType as CancelManagedAuthLoginTransactionRequest, CompleteManagedAuthEmailPasswordTransactionRequestType as CompleteManagedAuthEmailPasswordTransactionRequest, CompleteManagedAuthLoginTransactionResponseType as CompleteManagedAuthLoginTransactionResponse, LogoutManagedAuthLoginSlotRequestType as LogoutManagedAuthLoginSlotRequest, LogoutManagedAuthSessionSetRequestType as LogoutManagedAuthSessionSetRequest, ManagedAuthDeepLinkResolutionType as ManagedAuthDeepLinkResolution, ManagedAuthLoginTransactionType as ManagedAuthLoginTransaction, ManagedAuthLogoutAllReceiptType as ManagedAuthLogoutAllReceipt, ManagedAuthSessionSetProjectionType as ManagedAuthSessionSetProjection, ResolveManagedAuthDeepLinkRequestType as ResolveManagedAuthDeepLinkRequest, SelectManagedAuthLoginSlotRequestType as SelectManagedAuthLoginSlotRequest, };

package/dist/accounts.js

@@ -0,0 +1,295 @@
+// src/accounts.ts
+import {
+  BeginManagedAuthLoginTransactionRequest,
+  BootstrapManagedAuthSessionSetRequest,
+  CancelManagedAuthLoginTransactionRequest,
+  CompleteManagedAuthEmailPasswordTransactionRequest,
+  CompleteManagedAuthLoginTransactionResponse,
+  LogoutManagedAuthLoginSlotRequest,
+  LogoutManagedAuthSessionSetRequest,
+  MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER,
+  MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,
+  ManagedAuthDeepLinkResolution,
+  ManagedAuthLoginTransaction,
+  ManagedAuthLogoutAllReceipt,
+  ManagedAuthSessionSetProjection,
+  ManagedAuthSessionSetErrorCode,
+  ResolveManagedAuthDeepLinkRequest,
+  SelectManagedAuthLoginSlotRequest
+} from "@opengeni/contracts/managed-auth-session-sets";
+var BrowserAccountsApiError = class extends Error {
+  constructor(status, code, options) {
+    super(code, options?.cause === void 0 ? void 0 : { cause: options.cause });
+    this.status = status;
+    this.code = code;
+  }
+  name = "BrowserAccountsApiError";
+};
+var BrowserAccountsClient = class {
+  #baseUrl;
+  #fetch;
+  // CSRF is generation-bound. Exact idempotent replay must retain the
+  // admission envelope even after an authority reread observes a newer clock.
+  #mutationAdmissions = /* @__PURE__ */ new Map();
+  #projection = null;
+  #authorityReadEpoch = 0;
+  #authorityResetPending = false;
+  #authorityReconciliation = null;
+  constructor(options) {
+    this.#baseUrl = options.baseUrl.replace(/\/+$/, "");
+    this.#fetch = options.fetch ?? ((input, init) => fetch(input, init));
+  }
+  async getSessionSet() {
+    if (this.#authorityResetPending || this.#authorityReconciliation) {
+      return await this.reconcileSessionSetAuthority();
+    }
+    const readEpoch = this.#authorityReadEpoch;
+    const received = await this.#readSessionSet();
+    if (readEpoch !== this.#authorityReadEpoch) {
+      return this.#authorityReconciliation ? await this.#authorityReconciliation : this.#projection ?? await this.getSessionSet();
+    }
+    return this.#remember(received);
+  }
+  async reconcileSessionSetAuthority() {
+    if (this.#authorityReconciliation) return await this.#authorityReconciliation;
+    const previous = this.#projection;
+    const readEpoch = ++this.#authorityReadEpoch;
+    this.#authorityResetPending = true;
+    this.#mutationAdmissions.clear();
+    const reconciliation = this.#reconcileSessionSetAuthority(previous, readEpoch);
+    this.#authorityReconciliation = reconciliation;
+    try {
+      const accepted = await reconciliation;
+      if (readEpoch === this.#authorityReadEpoch) this.#authorityResetPending = false;
+      return accepted;
+    } finally {
+      if (this.#authorityReconciliation === reconciliation) {
+        this.#authorityReconciliation = null;
+      }
+    }
+  }
+  async bootstrapSessionSet(request) {
+    return this.#projectionResponse(
+      "POST",
+      "/v1/auth/session-set/bootstrap",
+      BootstrapManagedAuthSessionSetRequest,
+      request
+    );
+  }
+  async beginLoginTransaction(request) {
+    return ManagedAuthLoginTransaction.parse(
+      await this.#mutation(
+        "POST",
+        "/v1/auth/session-set/transactions",
+        BeginManagedAuthLoginTransactionRequest,
+        request
+      )
+    );
+  }
+  async completeEmailPasswordTransaction(request) {
+    const authorityReadEpoch = this.#authorityReadEpoch;
+    const response = CompleteManagedAuthLoginTransactionResponse.parse(
+      await this.#mutation(
+        "POST",
+        "/v1/auth/session-set/transactions/email-password",
+        CompleteManagedAuthEmailPasswordTransactionRequest,
+        request
+      )
+    );
+    if (authorityReadEpoch !== this.#authorityReadEpoch) {
+      return { ...response, projection: await this.getSessionSet() };
+    }
+    const remembered = this.#remember(response.projection);
+    if (remembered !== response.projection) {
+      return { ...response, projection: await this.getSessionSet() };
+    }
+    return response;
+  }
+  async cancelLoginTransaction(request) {
+    return this.#projectionResponse(
+      "DELETE",
+      `/v1/auth/session-set/transactions/${encodeURIComponent(request.transactionId)}`,
+      CancelManagedAuthLoginTransactionRequest,
+      request
+    );
+  }
+  async selectLoginSlot(request) {
+    return this.#projectionResponse(
+      "POST",
+      "/v1/auth/session-set/select",
+      SelectManagedAuthLoginSlotRequest,
+      request
+    );
+  }
+  async logoutLoginSlot(request) {
+    return this.#projectionResponse(
+      "POST",
+      "/v1/auth/session-set/logout-one",
+      LogoutManagedAuthLoginSlotRequest,
+      request
+    );
+  }
+  async logoutSessionSet(request) {
+    const receipt = ManagedAuthLogoutAllReceipt.parse(
+      await this.#mutation(
+        "POST",
+        "/v1/auth/session-set/logout-all",
+        LogoutManagedAuthSessionSetRequest,
+        request
+      )
+    );
+    this.#authorityReadEpoch += 1;
+    this.#authorityResetPending = false;
+    this.#projection = null;
+    this.#mutationAdmissions.clear();
+    return receipt;
+  }
+  async resolveDeepLink(request) {
+    return ManagedAuthDeepLinkResolution.parse(
+      await this.#mutation(
+        "POST",
+        "/v1/auth/session-set/deep-link/resolve",
+        ResolveManagedAuthDeepLinkRequest,
+        request
+      )
+    );
+  }
+  async #projectionResponse(method, path, schema, request) {
+    const authorityReadEpoch = this.#authorityReadEpoch;
+    const received = ManagedAuthSessionSetProjection.parse(
+      await this.#mutation(method, path, schema, request)
+    );
+    if (authorityReadEpoch !== this.#authorityReadEpoch) return await this.getSessionSet();
+    const remembered = this.#remember(received);
+    return remembered === received ? received : await this.getSessionSet();
+  }
+  async #mutation(method, path, schema, request) {
+    if (this.#authorityResetPending) {
+      throw new BrowserAccountsApiError(409, "actor_change_required");
+    }
+    const body = schema.parse(request);
+    const projection = this.#projection;
+    if (!projection) throw new BrowserAccountsApiError(409, "session_set_projection_required");
+    const operationId = mutationOperationId(body);
+    const signature = operationId ? JSON.stringify([method, path, body]) : null;
+    const retained = operationId ? this.#mutationAdmissions.get(operationId) : null;
+    if (retained && retained.signature !== signature) {
+      throw new BrowserAccountsApiError(409, "operation_reused");
+    }
+    const admission = retained ?? {
+      signature: signature ?? "",
+      csrfToken: projection.csrfToken,
+      actorEpoch: projection.actorEpoch
+    };
+    if (operationId && !retained) {
+      this.#mutationAdmissions.set(operationId, admission);
+      if (this.#mutationAdmissions.size > 64) {
+        this.#mutationAdmissions.delete(this.#mutationAdmissions.keys().next().value);
+      }
+    }
+    return await this.#request(method, path, body, {
+      "x-opengeni-session-csrf": admission.csrfToken,
+      "x-opengeni-actor-epoch": admission.actorEpoch
+    });
+  }
+  async #request(method, path, body, headers = {}) {
+    let response;
+    try {
+      response = await this.#fetch(`${this.#baseUrl}${path}`, {
+        method,
+        credentials: "include",
+        headers: {
+          accept: "application/json",
+          [MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER]: MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,
+          ...body === void 0 ? {} : { "content-type": "application/json" },
+          ...headers
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) }
+      });
+    } catch (cause) {
+      if (method !== "GET") {
+        throw new BrowserAccountsApiError(503, "operation_outcome_unknown", { cause });
+      }
+      throw cause;
+    }
+    let parsed = true;
+    const value = await response.json().catch(() => {
+      parsed = false;
+      return null;
+    });
+    if (!response.ok) {
+      const code = managedAuthErrorCode(value) ?? `http_${response.status}`;
+      throw new BrowserAccountsApiError(response.status, code);
+    }
+    if (!parsed && method !== "GET") {
+      throw new BrowserAccountsApiError(503, "operation_outcome_unknown");
+    }
+    return value;
+  }
+  async #readSessionSet() {
+    return ManagedAuthSessionSetProjection.parse(
+      await this.#request("GET", "/v1/auth/session-set")
+    );
+  }
+  async #reconcileSessionSetAuthority(previous, readEpoch) {
+    const first = await this.#readSessionSet();
+    const second = await this.#readSessionSet();
+    if (readEpoch !== this.#authorityReadEpoch) {
+      return await this.#reconcileSessionSetAuthority(this.#projection, this.#authorityReadEpoch);
+    }
+    if (this.#projection !== previous) return this.#remember(second);
+    if (!previous || compareProjectionClock(second, previous) >= 0) {
+      return this.#remember(second);
+    }
+    if (compareProjectionClock(first, previous) < 0 && compareProjectionClock(second, first) >= 0) {
+      this.#projection = second;
+      this.#mutationAdmissions.clear();
+      return second;
+    }
+    return previous;
+  }
+  #remember(projection) {
+    const current = this.#projection;
+    if (!current || compareProjectionClock(projection, current) >= 0) {
+      this.#projection = projection;
+      return projection;
+    }
+    return current;
+  }
+};
+function mutationOperationId(value) {
+  if (!value || typeof value !== "object") return null;
+  const operationId = value.operationId;
+  return typeof operationId === "string" ? operationId : null;
+}
+function compareProjectionClock(left, right) {
+  const actorDelta = BigInt(left.actorEpoch) - BigInt(right.actorEpoch);
+  if (actorDelta !== 0n) return actorDelta > 0n ? 1 : -1;
+  const generationDelta = BigInt(left.generation) - BigInt(right.generation);
+  return generationDelta === 0n ? 0 : generationDelta > 0n ? 1 : -1;
+}
+function managedAuthErrorCode(value) {
+  if (!value || typeof value !== "object") return null;
+  const error = value.error;
+  if (error && typeof error === "object") {
+    const details = error.details;
+    if (details && typeof details === "object") {
+      const parsed2 = ManagedAuthSessionSetErrorCode.safeParse(
+        details.managedAuthCode
+      );
+      if (parsed2.success) return parsed2.data;
+    }
+  }
+  const legacy = value.message;
+  const parsed = ManagedAuthSessionSetErrorCode.safeParse(legacy);
+  return parsed.success ? parsed.data : null;
+}
+function createBrowserAccountsClient(options) {
+  return new BrowserAccountsClient(options);
+}
+export {
+  BrowserAccountsApiError,
+  BrowserAccountsClient,
+  createBrowserAccountsClient
+};
+//# sourceMappingURL=accounts.js.map

package/dist/accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/accounts.ts"],"sourcesContent":["import {\n  BeginManagedAuthLoginTransactionRequest,\n  BootstrapManagedAuthSessionSetRequest,\n  CancelManagedAuthLoginTransactionRequest,\n  CompleteManagedAuthEmailPasswordTransactionRequest,\n  CompleteManagedAuthLoginTransactionResponse,\n  LogoutManagedAuthLoginSlotRequest,\n  LogoutManagedAuthSessionSetRequest,\n  MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER,\n  MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,\n  ManagedAuthDeepLinkResolution,\n  ManagedAuthLoginTransaction,\n  ManagedAuthLogoutAllReceipt,\n  ManagedAuthSessionSetProjection,\n  ManagedAuthSessionSetErrorCode,\n  ResolveManagedAuthDeepLinkRequest,\n  SelectManagedAuthLoginSlotRequest,\n  type BeginManagedAuthLoginTransactionRequest as BeginManagedAuthLoginTransactionRequestType,\n  type BootstrapManagedAuthSessionSetRequest as BootstrapManagedAuthSessionSetRequestType,\n  type CancelManagedAuthLoginTransactionRequest as CancelManagedAuthLoginTransactionRequestType,\n  type CompleteManagedAuthEmailPasswordTransactionRequest as CompleteManagedAuthEmailPasswordTransactionRequestType,\n  type CompleteManagedAuthLoginTransactionResponse as CompleteManagedAuthLoginTransactionResponseType,\n  type LogoutManagedAuthLoginSlotRequest as LogoutManagedAuthLoginSlotRequestType,\n  type LogoutManagedAuthSessionSetRequest as LogoutManagedAuthSessionSetRequestType,\n  type ManagedAuthDeepLinkResolution as ManagedAuthDeepLinkResolutionType,\n  type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType,\n  type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType,\n  type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType,\n  type ResolveManagedAuthDeepLinkRequest as ResolveManagedAuthDeepLinkRequestType,\n  type SelectManagedAuthLoginSlotRequest as SelectManagedAuthLoginSlotRequestType,\n} from \"@opengeni/contracts/managed-auth-session-sets\";\nimport type { z } from \"zod\";\n\nexport type BrowserAccountsFetch = (\n  input: string | URL | Request,\n  init?: RequestInit,\n) => Promise<Response>;\n\nexport type BrowserAccountsClientOptions = {\n  baseUrl: string;\n  fetch?: BrowserAccountsFetch;\n};\n\nexport interface BrowserAccountsClientLike {\n  getSessionSet(): Promise<ManagedAuthSessionSetProjectionType>;\n  reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType>;\n  bootstrapSessionSet(\n    request: BootstrapManagedAuthSessionSetRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  beginLoginTransaction(\n    request: BeginManagedAuthLoginTransactionRequestType,\n  ): Promise<ManagedAuthLoginTransactionType>;\n  completeEmailPasswordTransaction(\n    request: CompleteManagedAuthEmailPasswordTransactionRequestType,\n  ): Promise<CompleteManagedAuthLoginTransactionResponseType>;\n  cancelLoginTransaction(\n    request: CancelManagedAuthLoginTransactionRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  selectLoginSlot(\n    request: SelectManagedAuthLoginSlotRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  logoutLoginSlot(\n    request: LogoutManagedAuthLoginSlotRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  logoutSessionSet(\n    request: LogoutManagedAuthSessionSetRequestType,\n  ): Promise<ManagedAuthLogoutAllReceiptType>;\n  resolveDeepLink(\n    request: ResolveManagedAuthDeepLinkRequestType,\n  ): Promise<ManagedAuthDeepLinkResolutionType>;\n}\n\nexport class BrowserAccountsApiError extends Error {\n  readonly name = \"BrowserAccountsApiError\";\n  constructor(\n    readonly status: number,\n    readonly code: string,\n    options?: { cause?: unknown },\n  ) {\n    super(code, options?.cause === undefined ? undefined : { cause: options.cause });\n  }\n}\n\nexport class BrowserAccountsClient implements BrowserAccountsClientLike {\n  readonly #baseUrl: string;\n  readonly #fetch: BrowserAccountsFetch;\n  // CSRF is generation-bound. Exact idempotent replay must retain the\n  // admission envelope even after an authority reread observes a newer clock.\n  readonly #mutationAdmissions = new Map<\n    string,\n    { signature: string; csrfToken: string; actorEpoch: string }\n  >();\n  #projection: ManagedAuthSessionSetProjectionType | null = null;\n  #authorityReadEpoch = 0;\n  #authorityResetPending = false;\n  #authorityReconciliation: Promise<ManagedAuthSessionSetProjectionType> | null = null;\n\n  constructor(options: BrowserAccountsClientOptions) {\n    this.#baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.#fetch = options.fetch ?? ((input, init) => fetch(input, init));\n  }\n\n  async getSessionSet(): Promise<ManagedAuthSessionSetProjectionType> {\n    if (this.#authorityResetPending || this.#authorityReconciliation) {\n      return await this.reconcileSessionSetAuthority();\n    }\n    const readEpoch = this.#authorityReadEpoch;\n    const received = await this.#readSessionSet();\n    if (readEpoch !== this.#authorityReadEpoch) {\n      return this.#authorityReconciliation\n        ? await this.#authorityReconciliation\n        : (this.#projection ?? (await this.getSessionSet()));\n    }\n    return this.#remember(received);\n  }\n\n  async reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType> {\n    if (this.#authorityReconciliation) return await this.#authorityReconciliation;\n    const previous = this.#projection;\n    const readEpoch = ++this.#authorityReadEpoch;\n    // Explicit reconciliation is an authority-invalidation boundary, not an\n    // ordinary monotonic refresh. Old operation admissions must never cross it,\n    // and mutations stay closed until two sequential reads reach a decision.\n    this.#authorityResetPending = true;\n    this.#mutationAdmissions.clear();\n    const reconciliation = this.#reconcileSessionSetAuthority(previous, readEpoch);\n    this.#authorityReconciliation = reconciliation;\n    try {\n      const accepted = await reconciliation;\n      if (readEpoch === this.#authorityReadEpoch) this.#authorityResetPending = false;\n      return accepted;\n    } finally {\n      if (this.#authorityReconciliation === reconciliation) {\n        this.#authorityReconciliation = null;\n      }\n    }\n  }\n\n  async bootstrapSessionSet(request: BootstrapManagedAuthSessionSetRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/bootstrap\",\n      BootstrapManagedAuthSessionSetRequest,\n      request,\n    );\n  }\n\n  async beginLoginTransaction(request: BeginManagedAuthLoginTransactionRequestType) {\n    return ManagedAuthLoginTransaction.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions\",\n        BeginManagedAuthLoginTransactionRequest,\n        request,\n      ),\n    );\n  }\n\n  async completeEmailPasswordTransaction(\n    request: CompleteManagedAuthEmailPasswordTransactionRequestType,\n  ) {\n    const authorityReadEpoch = this.#authorityReadEpoch;\n    const response = CompleteManagedAuthLoginTransactionResponse.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions/email-password\",\n        CompleteManagedAuthEmailPasswordTransactionRequest,\n        request,\n      ),\n    );\n    if (authorityReadEpoch !== this.#authorityReadEpoch) {\n      return { ...response, projection: await this.getSessionSet() };\n    }\n    const remembered = this.#remember(response.projection);\n    if (remembered !== response.projection) {\n      return { ...response, projection: await this.getSessionSet() };\n    }\n    return response;\n  }\n\n  async cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType) {\n    return this.#projectionResponse(\n      \"DELETE\",\n      `/v1/auth/session-set/transactions/${encodeURIComponent(request.transactionId)}`,\n      CancelManagedAuthLoginTransactionRequest,\n      request,\n    );\n  }\n\n  async selectLoginSlot(request: SelectManagedAuthLoginSlotRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/select\",\n      SelectManagedAuthLoginSlotRequest,\n      request,\n    );\n  }\n\n  async logoutLoginSlot(request: LogoutManagedAuthLoginSlotRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/logout-one\",\n      LogoutManagedAuthLoginSlotRequest,\n      request,\n    );\n  }\n\n  async logoutSessionSet(request: LogoutManagedAuthSessionSetRequestType) {\n    const receipt = ManagedAuthLogoutAllReceipt.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/logout-all\",\n        LogoutManagedAuthSessionSetRequest,\n        request,\n      ),\n    );\n    this.#authorityReadEpoch += 1;\n    this.#authorityResetPending = false;\n    this.#projection = null;\n    this.#mutationAdmissions.clear();\n    return receipt;\n  }\n\n  async resolveDeepLink(request: ResolveManagedAuthDeepLinkRequestType) {\n    return ManagedAuthDeepLinkResolution.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/deep-link/resolve\",\n        ResolveManagedAuthDeepLinkRequest,\n        request,\n      ),\n    );\n  }\n\n  async #projectionResponse<S extends z.ZodType>(\n    method: \"POST\" | \"DELETE\",\n    path: string,\n    schema: S,\n    request: z.infer<S>,\n  ): Promise<ManagedAuthSessionSetProjectionType> {\n    const authorityReadEpoch = this.#authorityReadEpoch;\n    const received = ManagedAuthSessionSetProjection.parse(\n      await this.#mutation(method, path, schema, request),\n    );\n    if (authorityReadEpoch !== this.#authorityReadEpoch) return await this.getSessionSet();\n    const remembered = this.#remember(received);\n    // An exact replay may legitimately return its older durable receipt after\n    // another tab has advanced this in-memory client. Reconcile from authority\n    // instead of presenting that receipt as the current actor projection.\n    return remembered === received ? received : await this.getSessionSet();\n  }\n\n  async #mutation<S extends z.ZodType>(\n    method: \"POST\" | \"DELETE\",\n    path: string,\n    schema: S,\n    request: z.infer<S>,\n  ): Promise<unknown> {\n    if (this.#authorityResetPending) {\n      throw new BrowserAccountsApiError(409, \"actor_change_required\");\n    }\n    const body = schema.parse(request);\n    const projection = this.#projection;\n    if (!projection) throw new BrowserAccountsApiError(409, \"session_set_projection_required\");\n    const operationId = mutationOperationId(body);\n    const signature = operationId ? JSON.stringify([method, path, body]) : null;\n    const retained = operationId ? this.#mutationAdmissions.get(operationId) : null;\n    if (retained && retained.signature !== signature) {\n      throw new BrowserAccountsApiError(409, \"operation_reused\");\n    }\n    const admission =\n      retained ??\n      ({\n        signature: signature ?? \"\",\n        csrfToken: projection.csrfToken,\n        actorEpoch: projection.actorEpoch,\n      } as const);\n    if (operationId && !retained) {\n      this.#mutationAdmissions.set(operationId, admission);\n      if (this.#mutationAdmissions.size > 64) {\n        this.#mutationAdmissions.delete(this.#mutationAdmissions.keys().next().value!);\n      }\n    }\n    return await this.#request(method, path, body, {\n      \"x-opengeni-session-csrf\": admission.csrfToken,\n      \"x-opengeni-actor-epoch\": admission.actorEpoch,\n    });\n  }\n\n  async #request(\n    method: \"GET\" | \"POST\" | \"DELETE\",\n    path: string,\n    body?: unknown,\n    headers: Record<string, string> = {},\n  ): Promise<unknown> {\n    let response: Response;\n    try {\n      response = await this.#fetch(`${this.#baseUrl}${path}`, {\n        method,\n        credentials: \"include\",\n        headers: {\n          accept: \"application/json\",\n          [MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER]:\n            MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,\n          ...(body === undefined ? {} : { \"content-type\": \"application/json\" }),\n          ...headers,\n        },\n        ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n      });\n    } catch (cause) {\n      if (method !== \"GET\") {\n        throw new BrowserAccountsApiError(503, \"operation_outcome_unknown\", { cause });\n      }\n      throw cause;\n    }\n    let parsed = true;\n    const value = await response.json().catch(() => {\n      parsed = false;\n      return null;\n    });\n    if (!response.ok) {\n      const code = managedAuthErrorCode(value) ?? `http_${response.status}`;\n      throw new BrowserAccountsApiError(response.status, code);\n    }\n    if (!parsed && method !== \"GET\") {\n      throw new BrowserAccountsApiError(503, \"operation_outcome_unknown\");\n    }\n    return value;\n  }\n\n  async #readSessionSet(): Promise<ManagedAuthSessionSetProjectionType> {\n    return ManagedAuthSessionSetProjection.parse(\n      await this.#request(\"GET\", \"/v1/auth/session-set\"),\n    );\n  }\n\n  async #reconcileSessionSetAuthority(\n    previous: ManagedAuthSessionSetProjectionType | null,\n    readEpoch: number,\n  ): Promise<ManagedAuthSessionSetProjectionType> {\n    const first = await this.#readSessionSet();\n    const second = await this.#readSessionSet();\n    if (readEpoch !== this.#authorityReadEpoch) {\n      return await this.#reconcileSessionSetAuthority(this.#projection, this.#authorityReadEpoch);\n    }\n    if (this.#projection !== previous) return this.#remember(second);\n    if (!previous || compareProjectionClock(second, previous) >= 0) {\n      return this.#remember(second);\n    }\n    if (compareProjectionClock(first, previous) < 0 && compareProjectionClock(second, first) >= 0) {\n      // Same-authority clocks never decrease. Two sequential no-store reads\n      // that both remain below the remembered clock therefore prove that the\n      // HttpOnly authority rotated; the second may already have advanced from\n      // the fresh authority's initial 1/1 projection.\n      this.#projection = second;\n      this.#mutationAdmissions.clear();\n      return second;\n    }\n    return previous;\n  }\n\n  #remember(projection: ManagedAuthSessionSetProjectionType) {\n    const current = this.#projection;\n    if (!current || compareProjectionClock(projection, current) >= 0) {\n      this.#projection = projection;\n      return projection;\n    }\n    return current;\n  }\n}\n\nfunction mutationOperationId(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const operationId = (value as { operationId?: unknown }).operationId;\n  return typeof operationId === \"string\" ? operationId : null;\n}\n\nfunction compareProjectionClock(\n  left: Pick<ManagedAuthSessionSetProjectionType, \"actorEpoch\" | \"generation\">,\n  right: Pick<ManagedAuthSessionSetProjectionType, \"actorEpoch\" | \"generation\">,\n): number {\n  const actorDelta = BigInt(left.actorEpoch) - BigInt(right.actorEpoch);\n  if (actorDelta !== 0n) return actorDelta > 0n ? 1 : -1;\n  const generationDelta = BigInt(left.generation) - BigInt(right.generation);\n  return generationDelta === 0n ? 0 : generationDelta > 0n ? 1 : -1;\n}\n\nfunction managedAuthErrorCode(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const error = (value as { error?: unknown }).error;\n  if (error && typeof error === \"object\") {\n    const details = (error as { details?: unknown }).details;\n    if (details && typeof details === \"object\") {\n      const parsed = ManagedAuthSessionSetErrorCode.safeParse(\n        (details as { managedAuthCode?: unknown }).managedAuthCode,\n      );\n      if (parsed.success) return parsed.data;\n    }\n  }\n  const legacy = (value as { message?: unknown }).message;\n  const parsed = ManagedAuthSessionSetErrorCode.safeParse(legacy);\n  return parsed.success ? parsed.data : null;\n}\n\nexport function createBrowserAccountsClient(\n  options: BrowserAccountsClientOptions,\n): BrowserAccountsClient {\n  return new BrowserAccountsClient(options);\n}\n\nexport type {\n  BeginManagedAuthLoginTransactionRequestType as BeginManagedAuthLoginTransactionRequest,\n  BootstrapManagedAuthSessionSetRequestType as BootstrapManagedAuthSessionSetRequest,\n  CancelManagedAuthLoginTransactionRequestType as CancelManagedAuthLoginTransactionRequest,\n  CompleteManagedAuthEmailPasswordTransactionRequestType as CompleteManagedAuthEmailPasswordTransactionRequest,\n  CompleteManagedAuthLoginTransactionResponseType as CompleteManagedAuthLoginTransactionResponse,\n  LogoutManagedAuthLoginSlotRequestType as LogoutManagedAuthLoginSlotRequest,\n  LogoutManagedAuthSessionSetRequestType as LogoutManagedAuthSessionSetRequest,\n  ManagedAuthDeepLinkResolutionType as ManagedAuthDeepLinkResolution,\n  ManagedAuthLoginTransactionType as ManagedAuthLoginTransaction,\n  ManagedAuthLogoutAllReceiptType as ManagedAuthLogoutAllReceipt,\n  ManagedAuthSessionSetProjectionType as ManagedAuthSessionSetProjection,\n  ResolveManagedAuthDeepLinkRequestType as ResolveManagedAuthDeepLinkRequest,\n  SelectManagedAuthLoginSlotRequestType as SelectManagedAuthLoginSlotRequest,\n};\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAcK;AA0CA,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAEjD,YACW,QACA,MACT,SACA;AACA,UAAM,MAAM,SAAS,UAAU,SAAY,SAAY,EAAE,OAAO,QAAQ,MAAM,CAAC;AAJtE;AACA;AAAA,EAIX;AAAA,EAPS,OAAO;AAQlB;AAEO,IAAM,wBAAN,MAAiE;AAAA,EAC7D;AAAA,EACA;AAAA;AAAA;AAAA,EAGA,sBAAsB,oBAAI,IAGjC;AAAA,EACF,cAA0D;AAAA,EAC1D,sBAAsB;AAAA,EACtB,yBAAyB;AAAA,EACzB,2BAAgF;AAAA,EAEhF,YAAY,SAAuC;AACjD,SAAK,WAAW,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;AAClD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAAO,SAAS,MAAM,OAAO,IAAI;AAAA,EACpE;AAAA,EAEA,MAAM,gBAA8D;AAClE,QAAI,KAAK,0BAA0B,KAAK,0BAA0B;AAChE,aAAO,MAAM,KAAK,6BAA6B;AAAA,IACjD;AACA,UAAM,YAAY,KAAK;AACvB,UAAM,WAAW,MAAM,KAAK,gBAAgB;AAC5C,QAAI,cAAc,KAAK,qBAAqB;AAC1C,aAAO,KAAK,2BACR,MAAM,KAAK,2BACV,KAAK,eAAgB,MAAM,KAAK,cAAc;AAAA,IACrD;AACA,WAAO,KAAK,UAAU,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,+BAA6E;AACjF,QAAI,KAAK,yBAA0B,QAAO,MAAM,KAAK;AACrD,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,EAAE,KAAK;AAIzB,SAAK,yBAAyB;AAC9B,SAAK,oBAAoB,MAAM;AAC/B,UAAM,iBAAiB,KAAK,8BAA8B,UAAU,SAAS;AAC7E,SAAK,2BAA2B;AAChC,QAAI;AACF,YAAM,WAAW,MAAM;AACvB,UAAI,cAAc,KAAK,oBAAqB,MAAK,yBAAyB;AAC1E,aAAO;AAAA,IACT,UAAE;AACA,UAAI,KAAK,6BAA6B,gBAAgB;AACpD,aAAK,2BAA2B;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,SAAoD;AAC5E,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,sBAAsB,SAAsD;AAChF,WAAO,4BAA4B;AAAA,MACjC,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iCACJ,SACA;AACA,UAAM,qBAAqB,KAAK;AAChC,UAAM,WAAW,4CAA4C;AAAA,MAC3D,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,uBAAuB,KAAK,qBAAqB;AACnD,aAAO,EAAE,GAAG,UAAU,YAAY,MAAM,KAAK,cAAc,EAAE;AAAA,IAC/D;AACA,UAAM,aAAa,KAAK,UAAU,SAAS,UAAU;AACrD,QAAI,eAAe,SAAS,YAAY;AACtC,aAAO,EAAE,GAAG,UAAU,YAAY,MAAM,KAAK,cAAc,EAAE;AAAA,IAC/D;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,uBAAuB,SAAuD;AAClF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qCAAqC,mBAAmB,QAAQ,aAAa,CAAC;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,SAAiD;AACtE,UAAM,UAAU,4BAA4B;AAAA,MAC1C,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,SAAK,uBAAuB;AAC5B,SAAK,yBAAyB;AAC9B,SAAK,cAAc;AACnB,SAAK,oBAAoB,MAAM;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,8BAA8B;AAAA,MACnC,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBACJ,QACA,MACA,QACA,SAC8C;AAC9C,UAAM,qBAAqB,KAAK;AAChC,UAAM,WAAW,gCAAgC;AAAA,MAC/C,MAAM,KAAK,UAAU,QAAQ,MAAM,QAAQ,OAAO;AAAA,IACpD;AACA,QAAI,uBAAuB,KAAK,oBAAqB,QAAO,MAAM,KAAK,cAAc;AACrF,UAAM,aAAa,KAAK,UAAU,QAAQ;AAI1C,WAAO,eAAe,WAAW,WAAW,MAAM,KAAK,cAAc;AAAA,EACvE;AAAA,EAEA,MAAM,UACJ,QACA,MACA,QACA,SACkB;AAClB,QAAI,KAAK,wBAAwB;AAC/B,YAAM,IAAI,wBAAwB,KAAK,uBAAuB;AAAA,IAChE;AACA,UAAM,OAAO,OAAO,MAAM,OAAO;AACjC,UAAM,aAAa,KAAK;AACxB,QAAI,CAAC,WAAY,OAAM,IAAI,wBAAwB,KAAK,iCAAiC;AACzF,UAAM,cAAc,oBAAoB,IAAI;AAC5C,UAAM,YAAY,cAAc,KAAK,UAAU,CAAC,QAAQ,MAAM,IAAI,CAAC,IAAI;AACvE,UAAM,WAAW,cAAc,KAAK,oBAAoB,IAAI,WAAW,IAAI;AAC3E,QAAI,YAAY,SAAS,cAAc,WAAW;AAChD,YAAM,IAAI,wBAAwB,KAAK,kBAAkB;AAAA,IAC3D;AACA,UAAM,YACJ,YACC;AAAA,MACC,WAAW,aAAa;AAAA,MACxB,WAAW,WAAW;AAAA,MACtB,YAAY,WAAW;AAAA,IACzB;AACF,QAAI,eAAe,CAAC,UAAU;AAC5B,WAAK,oBAAoB,IAAI,aAAa,SAAS;AACnD,UAAI,KAAK,oBAAoB,OAAO,IAAI;AACtC,aAAK,oBAAoB,OAAO,KAAK,oBAAoB,KAAK,EAAE,KAAK,EAAE,KAAM;AAAA,MAC/E;AAAA,IACF;AACA,WAAO,MAAM,KAAK,SAAS,QAAQ,MAAM,MAAM;AAAA,MAC7C,2BAA2B,UAAU;AAAA,MACrC,0BAA0B,UAAU;AAAA,IACtC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,SACJ,QACA,MACA,MACA,UAAkC,CAAC,GACjB;AAClB,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,IAAI,IAAI;AAAA,QACtD;AAAA,QACA,aAAa;AAAA,QACb,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,CAAC,4CAA4C,GAC3C;AAAA,UACF,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,UACnE,GAAG;AAAA,QACL;AAAA,QACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,MAC7D,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,WAAW,OAAO;AACpB,cAAM,IAAI,wBAAwB,KAAK,6BAA6B,EAAE,MAAM,CAAC;AAAA,MAC/E;AACA,YAAM;AAAA,IACR;AACA,QAAI,SAAS;AACb,UAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM;AAC9C,eAAS;AACT,aAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,OAAO,qBAAqB,KAAK,KAAK,QAAQ,SAAS,MAAM;AACnE,YAAM,IAAI,wBAAwB,SAAS,QAAQ,IAAI;AAAA,IACzD;AACA,QAAI,CAAC,UAAU,WAAW,OAAO;AAC/B,YAAM,IAAI,wBAAwB,KAAK,2BAA2B;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,kBAAgE;AACpE,WAAO,gCAAgC;AAAA,MACrC,MAAM,KAAK,SAAS,OAAO,sBAAsB;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,8BACJ,UACA,WAC8C;AAC9C,UAAM,QAAQ,MAAM,KAAK,gBAAgB;AACzC,UAAM,SAAS,MAAM,KAAK,gBAAgB;AAC1C,QAAI,cAAc,KAAK,qBAAqB;AAC1C,aAAO,MAAM,KAAK,8BAA8B,KAAK,aAAa,KAAK,mBAAmB;AAAA,IAC5F;AACA,QAAI,KAAK,gBAAgB,SAAU,QAAO,KAAK,UAAU,MAAM;AAC/D,QAAI,CAAC,YAAY,uBAAuB,QAAQ,QAAQ,KAAK,GAAG;AAC9D,aAAO,KAAK,UAAU,MAAM;AAAA,IAC9B;AACA,QAAI,uBAAuB,OAAO,QAAQ,IAAI,KAAK,uBAAuB,QAAQ,KAAK,KAAK,GAAG;AAK7F,WAAK,cAAc;AACnB,WAAK,oBAAoB,MAAM;AAC/B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,UAAU,YAAiD;AACzD,UAAM,UAAU,KAAK;AACrB,QAAI,CAAC,WAAW,uBAAuB,YAAY,OAAO,KAAK,GAAG;AAChE,WAAK,cAAc;AACnB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,OAA+B;AAC1D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,cAAe,MAAoC;AACzD,SAAO,OAAO,gBAAgB,WAAW,cAAc;AACzD;AAEA,SAAS,uBACP,MACA,OACQ;AACR,QAAM,aAAa,OAAO,KAAK,UAAU,IAAI,OAAO,MAAM,UAAU;AACpE,MAAI,eAAe,GAAI,QAAO,aAAa,KAAK,IAAI;AACpD,QAAM,kBAAkB,OAAO,KAAK,UAAU,IAAI,OAAO,MAAM,UAAU;AACzE,SAAO,oBAAoB,KAAK,IAAI,kBAAkB,KAAK,IAAI;AACjE;AAEA,SAAS,qBAAqB,OAA+B;AAC3D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAS,MAA8B;AAC7C,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,UAAW,MAAgC;AACjD,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,YAAMA,UAAS,+BAA+B;AAAA,QAC3C,QAA0C;AAAA,MAC7C;AACA,UAAIA,QAAO,QAAS,QAAOA,QAAO;AAAA,IACpC;AAAA,EACF;AACA,QAAM,SAAU,MAAgC;AAChD,QAAM,SAAS,+BAA+B,UAAU,MAAM;AAC9D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEO,SAAS,4BACd,SACuB;AACvB,SAAO,IAAI,sBAAsB,OAAO;AAC1C;","names":["parsed"]}

package/dist/artifact-client.d.ts

@@ -1,8 +1,8 @@
-import { OpenGeniClient as OpenGeniCoreClient } from "./client.js";
+import { OpenGeniDocumentAuthorityClient } from "./document-authority-client.js";
 import type { CreateEditableArtifactMaterializationRequest, CreateEditableArtifactResourceRequest, EditableArtifactListResource, EditableArtifactMaterializationJobResource, EditableArtifactPinnedVersionResource, EditableArtifactResource, ImportEditableArtifactResourceRequest, ListSessionEditableArtifactResourcesOptions, PinEditableArtifactVersionRequest, ReadEditableArtifactMaterializationOptions, ReadEditableArtifactResourceOptions } from "./editable-artifact-resources.js";
 import type { CreateWorkspaceArtifactRequest, PublishWorkspaceArtifactVersionRequest, RollbackWorkspaceArtifactRequest, WorkspaceArtifactContentResponse, WorkspaceArtifactDetailResponse, WorkspaceArtifactListOptions, WorkspaceArtifactListResponse, WorkspaceArtifactMutationResponse } from "./workspace-artifacts.js";
-/** Public SDK client. Artifact operations stay out of the console's eager core graph. */
-export declare class OpenGeniClient extends OpenGeniCoreClient {
+/** Public SDK client. Optional operator and artifact operations stay out of the console core. */
+export declare class OpenGeniClient extends OpenGeniDocumentAuthorityClient {
     createEditableArtifact(workspaceId: string, request: CreateEditableArtifactResourceRequest, options?: Readonly<{
         signal?: AbortSignal | undefined;
     }>): Promise<EditableArtifactResource>;

package/dist/artifacts.js

@@ -1,8 +1,9 @@
 import {
   OpenGeniClient
-} from "./chunk-UP2PIWU2.js";
-import "./chunk-7VERSV47.js";
-import "./chunk-ERPT45NP.js";
+} from "./chunk-VUQZAB3O.js";
+import "./chunk-TX3EIENU.js";
+import "./chunk-7ZXBPJZP.js";
+import "./chunk-YTAWBDO2.js";
 import "./chunk-GW3EJ2GP.js";
 import "./chunk-C4DJPZRU.js";
 export {

package/dist/browser.d.ts

@@ -0,0 +1,6 @@
+/** Browser-console client. Optional SDK surfaces must not enter this eager graph. */
+export { OpenGeniClient as OpenGeniBrowserClient } from "./client.js";
+export type { FetchLike, GetSessionOptions, OpenGeniClientOptions, OpenGeniRequestOptions, SendMessageInput, SteerMessageResult, TranscribeAudioInput, WorkspaceControlEventPage, } from "./client.js";
+export { OpenGeniApiContractMismatchError, OpenGeniApiError, OpenGeniSessionListCursorError, OpenGeniStreamError, isRetryableStreamError, } from "./errors.js";
+export { resolveWorkspaceVoiceInputEnabled } from "./transcription.js";
+export { OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION } from "./types.js";

package/dist/browser.js

@@ -0,0 +1,30 @@
+import {
+  resolveWorkspaceVoiceInputEnabled
+} from "./chunk-VYCTL62C.js";
+import {
+  OpenGeniClient
+} from "./chunk-7ZXBPJZP.js";
+import {
+  OPENGENI_API_CONTRACT_HEADER,
+  OPENGENI_API_CONTRACT_REVISION
+} from "./chunk-YTAWBDO2.js";
+import "./chunk-GW3EJ2GP.js";
+import {
+  OpenGeniApiContractMismatchError,
+  OpenGeniApiError,
+  OpenGeniSessionListCursorError,
+  OpenGeniStreamError,
+  isRetryableStreamError
+} from "./chunk-C4DJPZRU.js";
+export {
+  OPENGENI_API_CONTRACT_HEADER,
+  OPENGENI_API_CONTRACT_REVISION,
+  OpenGeniApiContractMismatchError,
+  OpenGeniApiError,
+  OpenGeniClient as OpenGeniBrowserClient,
+  OpenGeniSessionListCursorError,
+  OpenGeniStreamError,
+  isRetryableStreamError,
+  resolveWorkspaceVoiceInputEnabled
+};
+//# sourceMappingURL=browser.js.map

package/dist/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}