@opengeni/sdk 3.1.0 → 3.1.2

package/dist/accounts.d.ts

@@ -1,4 +1,4 @@
-import { type BeginManagedAuthLoginTransactionRequest as BeginManagedAuthLoginTransactionRequestType, type BootstrapManagedAuthSessionSetRequest as BootstrapManagedAuthSessionSetRequestType, type CancelManagedAuthLoginTransactionRequest as CancelManagedAuthLoginTransactionRequestType, type CompleteManagedAuthEmailPasswordTransactionRequest as CompleteManagedAuthEmailPasswordTransactionRequestType, type CompleteManagedAuthLoginTransactionResponse as CompleteManagedAuthLoginTransactionResponseType, type LogoutManagedAuthLoginSlotRequest as LogoutManagedAuthLoginSlotRequestType, type LogoutManagedAuthSessionSetRequest as LogoutManagedAuthSessionSetRequestType, type ManagedAuthDeepLinkResolution as ManagedAuthDeepLinkResolutionType, type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType, type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType, type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType, type ResolveManagedAuthDeepLinkRequest as ResolveManagedAuthDeepLinkRequestType, type SelectManagedAuthLoginSlotRequest as SelectManagedAuthLoginSlotRequestType } from "@opengeni/contracts/managed-auth-session-sets";
+import { type BeginManagedAuthLoginTransactionRequest as BeginManagedAuthLoginTransactionRequestType, type BootstrapManagedAuthSessionSetRequest as BootstrapManagedAuthSessionSetRequestType, type CancelManagedAuthLoginTransactionRequest as CancelManagedAuthLoginTransactionRequestType, type CompleteManagedAuthEmailPasswordTransactionRequest as CompleteManagedAuthEmailPasswordTransactionRequestType, type CompleteManagedAuthLoginTransactionResponse as CompleteManagedAuthLoginTransactionResponseType, type LogoutManagedAuthLoginSlotRequest as LogoutManagedAuthLoginSlotRequestType, type LogoutManagedAuthSessionSetRequest as LogoutManagedAuthSessionSetRequestType, type ManagedAuthDeepLinkResolution as ManagedAuthDeepLinkResolutionType, type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType, type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType, type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType, type ResolveManagedAuthDeepLinkRequest as ResolveManagedAuthDeepLinkRequestType, type SelectManagedAuthLoginSlotRequest as SelectManagedAuthLoginSlotRequestType, type StartManagedAuthSocialTransactionRequest as StartManagedAuthSocialTransactionRequestType, type StartManagedAuthSocialTransactionResponse as StartManagedAuthSocialTransactionResponseType } from "@opengeni/contracts/managed-auth-session-sets";
 export type BrowserAccountsFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
 export type BrowserAccountsClientOptions = {
     baseUrl: string;
@@ -10,6 +10,7 @@ export interface BrowserAccountsClientLike {
     bootstrapSessionSet(request: BootstrapManagedAuthSessionSetRequestType): Promise<ManagedAuthSessionSetProjectionType>;
     beginLoginTransaction(request: BeginManagedAuthLoginTransactionRequestType): Promise<ManagedAuthLoginTransactionType>;
     completeEmailPasswordTransaction(request: CompleteManagedAuthEmailPasswordTransactionRequestType): Promise<CompleteManagedAuthLoginTransactionResponseType>;
+    startSocialTransaction?(request: StartManagedAuthSocialTransactionRequestType): Promise<StartManagedAuthSocialTransactionResponseType>;
     cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType): Promise<ManagedAuthSessionSetProjectionType>;
     selectLoginSlot(request: SelectManagedAuthLoginSlotRequestType): Promise<ManagedAuthSessionSetProjectionType>;
     logoutLoginSlot(request: LogoutManagedAuthLoginSlotRequestType): Promise<ManagedAuthSessionSetProjectionType>;
@@ -72,6 +73,9 @@ export declare class BrowserAccountsClient implements BrowserAccountsClientLike
         };
         returnIntent: string | null;
     }>;
+    startSocialTransaction(request: StartManagedAuthSocialTransactionRequestType): Promise<{
+        url: string;
+    }>;
     cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType): Promise<{
         mode: "broker" | "dual" | "legacy";
         generation: string;

package/dist/accounts.js

@@ -15,7 +15,9 @@ import {
   ManagedAuthSessionSetProjection,
   ManagedAuthSessionSetErrorCode,
   ResolveManagedAuthDeepLinkRequest,
-  SelectManagedAuthLoginSlotRequest
+  SelectManagedAuthLoginSlotRequest,
+  StartManagedAuthSocialTransactionRequest,
+  StartManagedAuthSocialTransactionResponse
 } from "@opengeni/contracts/managed-auth-session-sets";
 var BrowserAccountsApiError = class extends Error {
   constructor(status, code, options) {
@@ -105,6 +107,16 @@ var BrowserAccountsClient = class {
     }
     return response;
   }
+  async startSocialTransaction(request) {
+    return StartManagedAuthSocialTransactionResponse.parse(
+      await this.#mutation(
+        "POST",
+        "/v1/auth/session-set/transactions/social",
+        StartManagedAuthSocialTransactionRequest,
+        request
+      )
+    );
+  }
   async cancelLoginTransaction(request) {
     return this.#projectionResponse(
       "DELETE",

package/dist/accounts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/accounts.ts"],"sourcesContent":["import {\n  BeginManagedAuthLoginTransactionRequest,\n  BootstrapManagedAuthSessionSetRequest,\n  CancelManagedAuthLoginTransactionRequest,\n  CompleteManagedAuthEmailPasswordTransactionRequest,\n  CompleteManagedAuthLoginTransactionResponse,\n  LogoutManagedAuthLoginSlotRequest,\n  LogoutManagedAuthSessionSetRequest,\n  MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER,\n  MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,\n  ManagedAuthDeepLinkResolution,\n  ManagedAuthLoginTransaction,\n  ManagedAuthLogoutAllReceipt,\n  ManagedAuthSessionSetProjection,\n  ManagedAuthSessionSetErrorCode,\n  ResolveManagedAuthDeepLinkRequest,\n  SelectManagedAuthLoginSlotRequest,\n  type BeginManagedAuthLoginTransactionRequest as BeginManagedAuthLoginTransactionRequestType,\n  type BootstrapManagedAuthSessionSetRequest as BootstrapManagedAuthSessionSetRequestType,\n  type CancelManagedAuthLoginTransactionRequest as CancelManagedAuthLoginTransactionRequestType,\n  type CompleteManagedAuthEmailPasswordTransactionRequest as CompleteManagedAuthEmailPasswordTransactionRequestType,\n  type CompleteManagedAuthLoginTransactionResponse as CompleteManagedAuthLoginTransactionResponseType,\n  type LogoutManagedAuthLoginSlotRequest as LogoutManagedAuthLoginSlotRequestType,\n  type LogoutManagedAuthSessionSetRequest as LogoutManagedAuthSessionSetRequestType,\n  type ManagedAuthDeepLinkResolution as ManagedAuthDeepLinkResolutionType,\n  type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType,\n  type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType,\n  type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType,\n  type ResolveManagedAuthDeepLinkRequest as ResolveManagedAuthDeepLinkRequestType,\n  type SelectManagedAuthLoginSlotRequest as SelectManagedAuthLoginSlotRequestType,\n} from \"@opengeni/contracts/managed-auth-session-sets\";\nimport type { z } from \"zod\";\n\nexport type BrowserAccountsFetch = (\n  input: string | URL | Request,\n  init?: RequestInit,\n) => Promise<Response>;\n\nexport type BrowserAccountsClientOptions = {\n  baseUrl: string;\n  fetch?: BrowserAccountsFetch;\n};\n\nexport interface BrowserAccountsClientLike {\n  getSessionSet(): Promise<ManagedAuthSessionSetProjectionType>;\n  reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType>;\n  bootstrapSessionSet(\n    request: BootstrapManagedAuthSessionSetRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  beginLoginTransaction(\n    request: BeginManagedAuthLoginTransactionRequestType,\n  ): Promise<ManagedAuthLoginTransactionType>;\n  completeEmailPasswordTransaction(\n    request: CompleteManagedAuthEmailPasswordTransactionRequestType,\n  ): Promise<CompleteManagedAuthLoginTransactionResponseType>;\n  cancelLoginTransaction(\n    request: CancelManagedAuthLoginTransactionRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  selectLoginSlot(\n    request: SelectManagedAuthLoginSlotRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  logoutLoginSlot(\n    request: LogoutManagedAuthLoginSlotRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  logoutSessionSet(\n    request: LogoutManagedAuthSessionSetRequestType,\n  ): Promise<ManagedAuthLogoutAllReceiptType>;\n  resolveDeepLink(\n    request: ResolveManagedAuthDeepLinkRequestType,\n  ): Promise<ManagedAuthDeepLinkResolutionType>;\n}\n\nexport class BrowserAccountsApiError extends Error {\n  readonly name = \"BrowserAccountsApiError\";\n  constructor(\n    readonly status: number,\n    readonly code: string,\n    options?: { cause?: unknown },\n  ) {\n    super(code, options?.cause === undefined ? undefined : { cause: options.cause });\n  }\n}\n\nexport class BrowserAccountsClient implements BrowserAccountsClientLike {\n  readonly #baseUrl: string;\n  readonly #fetch: BrowserAccountsFetch;\n  // CSRF is generation-bound. Exact idempotent replay must retain the\n  // admission envelope even after an authority reread observes a newer clock.\n  readonly #mutationAdmissions = new Map<\n    string,\n    { signature: string; csrfToken: string; actorEpoch: string }\n  >();\n  #projection: ManagedAuthSessionSetProjectionType | null = null;\n  #authorityReadEpoch = 0;\n  #authorityResetPending = false;\n  #authorityReconciliation: Promise<ManagedAuthSessionSetProjectionType> | null = null;\n\n  constructor(options: BrowserAccountsClientOptions) {\n    this.#baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.#fetch = options.fetch ?? ((input, init) => fetch(input, init));\n  }\n\n  async getSessionSet(): Promise<ManagedAuthSessionSetProjectionType> {\n    if (this.#authorityResetPending || this.#authorityReconciliation) {\n      return await this.reconcileSessionSetAuthority();\n    }\n    const readEpoch = this.#authorityReadEpoch;\n    const received = await this.#readSessionSet();\n    if (readEpoch !== this.#authorityReadEpoch) {\n      return this.#authorityReconciliation\n        ? await this.#authorityReconciliation\n        : (this.#projection ?? (await this.getSessionSet()));\n    }\n    return this.#remember(received);\n  }\n\n  async reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType> {\n    if (this.#authorityReconciliation) return await this.#authorityReconciliation;\n    const previous = this.#projection;\n    const readEpoch = ++this.#authorityReadEpoch;\n    // Explicit reconciliation is an authority-invalidation boundary, not an\n    // ordinary monotonic refresh. Old operation admissions must never cross it,\n    // and mutations stay closed until two sequential reads reach a decision.\n    this.#authorityResetPending = true;\n    this.#mutationAdmissions.clear();\n    const reconciliation = this.#reconcileSessionSetAuthority(previous, readEpoch);\n    this.#authorityReconciliation = reconciliation;\n    try {\n      const accepted = await reconciliation;\n      if (readEpoch === this.#authorityReadEpoch) this.#authorityResetPending = false;\n      return accepted;\n    } finally {\n      if (this.#authorityReconciliation === reconciliation) {\n        this.#authorityReconciliation = null;\n      }\n    }\n  }\n\n  async bootstrapSessionSet(request: BootstrapManagedAuthSessionSetRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/bootstrap\",\n      BootstrapManagedAuthSessionSetRequest,\n      request,\n    );\n  }\n\n  async beginLoginTransaction(request: BeginManagedAuthLoginTransactionRequestType) {\n    return ManagedAuthLoginTransaction.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions\",\n        BeginManagedAuthLoginTransactionRequest,\n        request,\n      ),\n    );\n  }\n\n  async completeEmailPasswordTransaction(\n    request: CompleteManagedAuthEmailPasswordTransactionRequestType,\n  ) {\n    const authorityReadEpoch = this.#authorityReadEpoch;\n    const response = CompleteManagedAuthLoginTransactionResponse.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions/email-password\",\n        CompleteManagedAuthEmailPasswordTransactionRequest,\n        request,\n      ),\n    );\n    if (authorityReadEpoch !== this.#authorityReadEpoch) {\n      return { ...response, projection: await this.getSessionSet() };\n    }\n    const remembered = this.#remember(response.projection);\n    if (remembered !== response.projection) {\n      return { ...response, projection: await this.getSessionSet() };\n    }\n    return response;\n  }\n\n  async cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType) {\n    return this.#projectionResponse(\n      \"DELETE\",\n      `/v1/auth/session-set/transactions/${encodeURIComponent(request.transactionId)}`,\n      CancelManagedAuthLoginTransactionRequest,\n      request,\n    );\n  }\n\n  async selectLoginSlot(request: SelectManagedAuthLoginSlotRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/select\",\n      SelectManagedAuthLoginSlotRequest,\n      request,\n    );\n  }\n\n  async logoutLoginSlot(request: LogoutManagedAuthLoginSlotRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/logout-one\",\n      LogoutManagedAuthLoginSlotRequest,\n      request,\n    );\n  }\n\n  async logoutSessionSet(request: LogoutManagedAuthSessionSetRequestType) {\n    const receipt = ManagedAuthLogoutAllReceipt.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/logout-all\",\n        LogoutManagedAuthSessionSetRequest,\n        request,\n      ),\n    );\n    this.#authorityReadEpoch += 1;\n    this.#authorityResetPending = false;\n    this.#projection = null;\n    this.#mutationAdmissions.clear();\n    return receipt;\n  }\n\n  async resolveDeepLink(request: ResolveManagedAuthDeepLinkRequestType) {\n    return ManagedAuthDeepLinkResolution.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/deep-link/resolve\",\n        ResolveManagedAuthDeepLinkRequest,\n        request,\n      ),\n    );\n  }\n\n  async #projectionResponse<S extends z.ZodType>(\n    method: \"POST\" | \"DELETE\",\n    path: string,\n    schema: S,\n    request: z.infer<S>,\n  ): Promise<ManagedAuthSessionSetProjectionType> {\n    const authorityReadEpoch = this.#authorityReadEpoch;\n    const received = ManagedAuthSessionSetProjection.parse(\n      await this.#mutation(method, path, schema, request),\n    );\n    if (authorityReadEpoch !== this.#authorityReadEpoch) return await this.getSessionSet();\n    const remembered = this.#remember(received);\n    // An exact replay may legitimately return its older durable receipt after\n    // another tab has advanced this in-memory client. Reconcile from authority\n    // instead of presenting that receipt as the current actor projection.\n    return remembered === received ? received : await this.getSessionSet();\n  }\n\n  async #mutation<S extends z.ZodType>(\n    method: \"POST\" | \"DELETE\",\n    path: string,\n    schema: S,\n    request: z.infer<S>,\n  ): Promise<unknown> {\n    if (this.#authorityResetPending) {\n      throw new BrowserAccountsApiError(409, \"actor_change_required\");\n    }\n    const body = schema.parse(request);\n    const projection = this.#projection;\n    if (!projection) throw new BrowserAccountsApiError(409, \"session_set_projection_required\");\n    const operationId = mutationOperationId(body);\n    const signature = operationId ? JSON.stringify([method, path, body]) : null;\n    const retained = operationId ? this.#mutationAdmissions.get(operationId) : null;\n    if (retained && retained.signature !== signature) {\n      throw new BrowserAccountsApiError(409, \"operation_reused\");\n    }\n    const admission =\n      retained ??\n      ({\n        signature: signature ?? \"\",\n        csrfToken: projection.csrfToken,\n        actorEpoch: projection.actorEpoch,\n      } as const);\n    if (operationId && !retained) {\n      this.#mutationAdmissions.set(operationId, admission);\n      if (this.#mutationAdmissions.size > 64) {\n        this.#mutationAdmissions.delete(this.#mutationAdmissions.keys().next().value!);\n      }\n    }\n    return await this.#request(method, path, body, {\n      \"x-opengeni-session-csrf\": admission.csrfToken,\n      \"x-opengeni-actor-epoch\": admission.actorEpoch,\n    });\n  }\n\n  async #request(\n    method: \"GET\" | \"POST\" | \"DELETE\",\n    path: string,\n    body?: unknown,\n    headers: Record<string, string> = {},\n  ): Promise<unknown> {\n    let response: Response;\n    try {\n      response = await this.#fetch(`${this.#baseUrl}${path}`, {\n        method,\n        credentials: \"include\",\n        headers: {\n          accept: \"application/json\",\n          [MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER]:\n            MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,\n          ...(body === undefined ? {} : { \"content-type\": \"application/json\" }),\n          ...headers,\n        },\n        ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n      });\n    } catch (cause) {\n      if (method !== \"GET\") {\n        throw new BrowserAccountsApiError(503, \"operation_outcome_unknown\", { cause });\n      }\n      throw cause;\n    }\n    let parsed = true;\n    const value = await response.json().catch(() => {\n      parsed = false;\n      return null;\n    });\n    if (!response.ok) {\n      const code = managedAuthErrorCode(value) ?? `http_${response.status}`;\n      throw new BrowserAccountsApiError(response.status, code);\n    }\n    if (!parsed && method !== \"GET\") {\n      throw new BrowserAccountsApiError(503, \"operation_outcome_unknown\");\n    }\n    return value;\n  }\n\n  async #readSessionSet(): Promise<ManagedAuthSessionSetProjectionType> {\n    return ManagedAuthSessionSetProjection.parse(\n      await this.#request(\"GET\", \"/v1/auth/session-set\"),\n    );\n  }\n\n  async #reconcileSessionSetAuthority(\n    previous: ManagedAuthSessionSetProjectionType | null,\n    readEpoch: number,\n  ): Promise<ManagedAuthSessionSetProjectionType> {\n    const first = await this.#readSessionSet();\n    const second = await this.#readSessionSet();\n    if (readEpoch !== this.#authorityReadEpoch) {\n      return await this.#reconcileSessionSetAuthority(this.#projection, this.#authorityReadEpoch);\n    }\n    if (this.#projection !== previous) return this.#remember(second);\n    if (!previous || compareProjectionClock(second, previous) >= 0) {\n      return this.#remember(second);\n    }\n    if (compareProjectionClock(first, previous) < 0 && compareProjectionClock(second, first) >= 0) {\n      // Same-authority clocks never decrease. Two sequential no-store reads\n      // that both remain below the remembered clock therefore prove that the\n      // HttpOnly authority rotated; the second may already have advanced from\n      // the fresh authority's initial 1/1 projection.\n      this.#projection = second;\n      this.#mutationAdmissions.clear();\n      return second;\n    }\n    return previous;\n  }\n\n  #remember(projection: ManagedAuthSessionSetProjectionType) {\n    const current = this.#projection;\n    if (!current || compareProjectionClock(projection, current) >= 0) {\n      this.#projection = projection;\n      return projection;\n    }\n    return current;\n  }\n}\n\nfunction mutationOperationId(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const operationId = (value as { operationId?: unknown }).operationId;\n  return typeof operationId === \"string\" ? operationId : null;\n}\n\nfunction compareProjectionClock(\n  left: Pick<ManagedAuthSessionSetProjectionType, \"actorEpoch\" | \"generation\">,\n  right: Pick<ManagedAuthSessionSetProjectionType, \"actorEpoch\" | \"generation\">,\n): number {\n  const actorDelta = BigInt(left.actorEpoch) - BigInt(right.actorEpoch);\n  if (actorDelta !== 0n) return actorDelta > 0n ? 1 : -1;\n  const generationDelta = BigInt(left.generation) - BigInt(right.generation);\n  return generationDelta === 0n ? 0 : generationDelta > 0n ? 1 : -1;\n}\n\nfunction managedAuthErrorCode(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const error = (value as { error?: unknown }).error;\n  if (error && typeof error === \"object\") {\n    const details = (error as { details?: unknown }).details;\n    if (details && typeof details === \"object\") {\n      const parsed = ManagedAuthSessionSetErrorCode.safeParse(\n        (details as { managedAuthCode?: unknown }).managedAuthCode,\n      );\n      if (parsed.success) return parsed.data;\n    }\n  }\n  const legacy = (value as { message?: unknown }).message;\n  const parsed = ManagedAuthSessionSetErrorCode.safeParse(legacy);\n  return parsed.success ? parsed.data : null;\n}\n\nexport function createBrowserAccountsClient(\n  options: BrowserAccountsClientOptions,\n): BrowserAccountsClient {\n  return new BrowserAccountsClient(options);\n}\n\nexport type {\n  BeginManagedAuthLoginTransactionRequestType as BeginManagedAuthLoginTransactionRequest,\n  BootstrapManagedAuthSessionSetRequestType as BootstrapManagedAuthSessionSetRequest,\n  CancelManagedAuthLoginTransactionRequestType as CancelManagedAuthLoginTransactionRequest,\n  CompleteManagedAuthEmailPasswordTransactionRequestType as CompleteManagedAuthEmailPasswordTransactionRequest,\n  CompleteManagedAuthLoginTransactionResponseType as CompleteManagedAuthLoginTransactionResponse,\n  LogoutManagedAuthLoginSlotRequestType as LogoutManagedAuthLoginSlotRequest,\n  LogoutManagedAuthSessionSetRequestType as LogoutManagedAuthSessionSetRequest,\n  ManagedAuthDeepLinkResolutionType as ManagedAuthDeepLinkResolution,\n  ManagedAuthLoginTransactionType as ManagedAuthLoginTransaction,\n  ManagedAuthLogoutAllReceiptType as ManagedAuthLogoutAllReceipt,\n  ManagedAuthSessionSetProjectionType as ManagedAuthSessionSetProjection,\n  ResolveManagedAuthDeepLinkRequestType as ResolveManagedAuthDeepLinkRequest,\n  SelectManagedAuthLoginSlotRequestType as SelectManagedAuthLoginSlotRequest,\n};\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAcK;AA0CA,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAEjD,YACW,QACA,MACT,SACA;AACA,UAAM,MAAM,SAAS,UAAU,SAAY,SAAY,EAAE,OAAO,QAAQ,MAAM,CAAC;AAJtE;AACA;AAAA,EAIX;AAAA,EAPS,OAAO;AAQlB;AAEO,IAAM,wBAAN,MAAiE;AAAA,EAC7D;AAAA,EACA;AAAA;AAAA;AAAA,EAGA,sBAAsB,oBAAI,IAGjC;AAAA,EACF,cAA0D;AAAA,EAC1D,sBAAsB;AAAA,EACtB,yBAAyB;AAAA,EACzB,2BAAgF;AAAA,EAEhF,YAAY,SAAuC;AACjD,SAAK,WAAW,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;AAClD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAAO,SAAS,MAAM,OAAO,IAAI;AAAA,EACpE;AAAA,EAEA,MAAM,gBAA8D;AAClE,QAAI,KAAK,0BAA0B,KAAK,0BAA0B;AAChE,aAAO,MAAM,KAAK,6BAA6B;AAAA,IACjD;AACA,UAAM,YAAY,KAAK;AACvB,UAAM,WAAW,MAAM,KAAK,gBAAgB;AAC5C,QAAI,cAAc,KAAK,qBAAqB;AAC1C,aAAO,KAAK,2BACR,MAAM,KAAK,2BACV,KAAK,eAAgB,MAAM,KAAK,cAAc;AAAA,IACrD;AACA,WAAO,KAAK,UAAU,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,+BAA6E;AACjF,QAAI,KAAK,yBAA0B,QAAO,MAAM,KAAK;AACrD,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,EAAE,KAAK;AAIzB,SAAK,yBAAyB;AAC9B,SAAK,oBAAoB,MAAM;AAC/B,UAAM,iBAAiB,KAAK,8BAA8B,UAAU,SAAS;AAC7E,SAAK,2BAA2B;AAChC,QAAI;AACF,YAAM,WAAW,MAAM;AACvB,UAAI,cAAc,KAAK,oBAAqB,MAAK,yBAAyB;AAC1E,aAAO;AAAA,IACT,UAAE;AACA,UAAI,KAAK,6BAA6B,gBAAgB;AACpD,aAAK,2BAA2B;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,SAAoD;AAC5E,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,sBAAsB,SAAsD;AAChF,WAAO,4BAA4B;AAAA,MACjC,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iCACJ,SACA;AACA,UAAM,qBAAqB,KAAK;AAChC,UAAM,WAAW,4CAA4C;AAAA,MAC3D,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,uBAAuB,KAAK,qBAAqB;AACnD,aAAO,EAAE,GAAG,UAAU,YAAY,MAAM,KAAK,cAAc,EAAE;AAAA,IAC/D;AACA,UAAM,aAAa,KAAK,UAAU,SAAS,UAAU;AACrD,QAAI,eAAe,SAAS,YAAY;AACtC,aAAO,EAAE,GAAG,UAAU,YAAY,MAAM,KAAK,cAAc,EAAE;AAAA,IAC/D;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,uBAAuB,SAAuD;AAClF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qCAAqC,mBAAmB,QAAQ,aAAa,CAAC;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,SAAiD;AACtE,UAAM,UAAU,4BAA4B;AAAA,MAC1C,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,SAAK,uBAAuB;AAC5B,SAAK,yBAAyB;AAC9B,SAAK,cAAc;AACnB,SAAK,oBAAoB,MAAM;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,8BAA8B;AAAA,MACnC,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBACJ,QACA,MACA,QACA,SAC8C;AAC9C,UAAM,qBAAqB,KAAK;AAChC,UAAM,WAAW,gCAAgC;AAAA,MAC/C,MAAM,KAAK,UAAU,QAAQ,MAAM,QAAQ,OAAO;AAAA,IACpD;AACA,QAAI,uBAAuB,KAAK,oBAAqB,QAAO,MAAM,KAAK,cAAc;AACrF,UAAM,aAAa,KAAK,UAAU,QAAQ;AAI1C,WAAO,eAAe,WAAW,WAAW,MAAM,KAAK,cAAc;AAAA,EACvE;AAAA,EAEA,MAAM,UACJ,QACA,MACA,QACA,SACkB;AAClB,QAAI,KAAK,wBAAwB;AAC/B,YAAM,IAAI,wBAAwB,KAAK,uBAAuB;AAAA,IAChE;AACA,UAAM,OAAO,OAAO,MAAM,OAAO;AACjC,UAAM,aAAa,KAAK;AACxB,QAAI,CAAC,WAAY,OAAM,IAAI,wBAAwB,KAAK,iCAAiC;AACzF,UAAM,cAAc,oBAAoB,IAAI;AAC5C,UAAM,YAAY,cAAc,KAAK,UAAU,CAAC,QAAQ,MAAM,IAAI,CAAC,IAAI;AACvE,UAAM,WAAW,cAAc,KAAK,oBAAoB,IAAI,WAAW,IAAI;AAC3E,QAAI,YAAY,SAAS,cAAc,WAAW;AAChD,YAAM,IAAI,wBAAwB,KAAK,kBAAkB;AAAA,IAC3D;AACA,UAAM,YACJ,YACC;AAAA,MACC,WAAW,aAAa;AAAA,MACxB,WAAW,WAAW;AAAA,MACtB,YAAY,WAAW;AAAA,IACzB;AACF,QAAI,eAAe,CAAC,UAAU;AAC5B,WAAK,oBAAoB,IAAI,aAAa,SAAS;AACnD,UAAI,KAAK,oBAAoB,OAAO,IAAI;AACtC,aAAK,oBAAoB,OAAO,KAAK,oBAAoB,KAAK,EAAE,KAAK,EAAE,KAAM;AAAA,MAC/E;AAAA,IACF;AACA,WAAO,MAAM,KAAK,SAAS,QAAQ,MAAM,MAAM;AAAA,MAC7C,2BAA2B,UAAU;AAAA,MACrC,0BAA0B,UAAU;AAAA,IACtC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,SACJ,QACA,MACA,MACA,UAAkC,CAAC,GACjB;AAClB,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,IAAI,IAAI;AAAA,QACtD;AAAA,QACA,aAAa;AAAA,QACb,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,CAAC,4CAA4C,GAC3C;AAAA,UACF,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,UACnE,GAAG;AAAA,QACL;AAAA,QACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,MAC7D,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,WAAW,OAAO;AACpB,cAAM,IAAI,wBAAwB,KAAK,6BAA6B,EAAE,MAAM,CAAC;AAAA,MAC/E;AACA,YAAM;AAAA,IACR;AACA,QAAI,SAAS;AACb,UAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM;AAC9C,eAAS;AACT,aAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,OAAO,qBAAqB,KAAK,KAAK,QAAQ,SAAS,MAAM;AACnE,YAAM,IAAI,wBAAwB,SAAS,QAAQ,IAAI;AAAA,IACzD;AACA,QAAI,CAAC,UAAU,WAAW,OAAO;AAC/B,YAAM,IAAI,wBAAwB,KAAK,2BAA2B;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,kBAAgE;AACpE,WAAO,gCAAgC;AAAA,MACrC,MAAM,KAAK,SAAS,OAAO,sBAAsB;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,8BACJ,UACA,WAC8C;AAC9C,UAAM,QAAQ,MAAM,KAAK,gBAAgB;AACzC,UAAM,SAAS,MAAM,KAAK,gBAAgB;AAC1C,QAAI,cAAc,KAAK,qBAAqB;AAC1C,aAAO,MAAM,KAAK,8BAA8B,KAAK,aAAa,KAAK,mBAAmB;AAAA,IAC5F;AACA,QAAI,KAAK,gBAAgB,SAAU,QAAO,KAAK,UAAU,MAAM;AAC/D,QAAI,CAAC,YAAY,uBAAuB,QAAQ,QAAQ,KAAK,GAAG;AAC9D,aAAO,KAAK,UAAU,MAAM;AAAA,IAC9B;AACA,QAAI,uBAAuB,OAAO,QAAQ,IAAI,KAAK,uBAAuB,QAAQ,KAAK,KAAK,GAAG;AAK7F,WAAK,cAAc;AACnB,WAAK,oBAAoB,MAAM;AAC/B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,UAAU,YAAiD;AACzD,UAAM,UAAU,KAAK;AACrB,QAAI,CAAC,WAAW,uBAAuB,YAAY,OAAO,KAAK,GAAG;AAChE,WAAK,cAAc;AACnB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,OAA+B;AAC1D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,cAAe,MAAoC;AACzD,SAAO,OAAO,gBAAgB,WAAW,cAAc;AACzD;AAEA,SAAS,uBACP,MACA,OACQ;AACR,QAAM,aAAa,OAAO,KAAK,UAAU,IAAI,OAAO,MAAM,UAAU;AACpE,MAAI,eAAe,GAAI,QAAO,aAAa,KAAK,IAAI;AACpD,QAAM,kBAAkB,OAAO,KAAK,UAAU,IAAI,OAAO,MAAM,UAAU;AACzE,SAAO,oBAAoB,KAAK,IAAI,kBAAkB,KAAK,IAAI;AACjE;AAEA,SAAS,qBAAqB,OAA+B;AAC3D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAS,MAA8B;AAC7C,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,UAAW,MAAgC;AACjD,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,YAAMA,UAAS,+BAA+B;AAAA,QAC3C,QAA0C;AAAA,MAC7C;AACA,UAAIA,QAAO,QAAS,QAAOA,QAAO;AAAA,IACpC;AAAA,EACF;AACA,QAAM,SAAU,MAAgC;AAChD,QAAM,SAAS,+BAA+B,UAAU,MAAM;AAC9D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEO,SAAS,4BACd,SACuB;AACvB,SAAO,IAAI,sBAAsB,OAAO;AAC1C;","names":["parsed"]}
+{"version":3,"sources":["../src/accounts.ts"],"sourcesContent":["import {\n  BeginManagedAuthLoginTransactionRequest,\n  BootstrapManagedAuthSessionSetRequest,\n  CancelManagedAuthLoginTransactionRequest,\n  CompleteManagedAuthEmailPasswordTransactionRequest,\n  CompleteManagedAuthLoginTransactionResponse,\n  LogoutManagedAuthLoginSlotRequest,\n  LogoutManagedAuthSessionSetRequest,\n  MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER,\n  MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,\n  ManagedAuthDeepLinkResolution,\n  ManagedAuthLoginTransaction,\n  ManagedAuthLogoutAllReceipt,\n  ManagedAuthSessionSetProjection,\n  ManagedAuthSessionSetErrorCode,\n  ResolveManagedAuthDeepLinkRequest,\n  SelectManagedAuthLoginSlotRequest,\n  StartManagedAuthSocialTransactionRequest,\n  StartManagedAuthSocialTransactionResponse,\n  type BeginManagedAuthLoginTransactionRequest as BeginManagedAuthLoginTransactionRequestType,\n  type BootstrapManagedAuthSessionSetRequest as BootstrapManagedAuthSessionSetRequestType,\n  type CancelManagedAuthLoginTransactionRequest as CancelManagedAuthLoginTransactionRequestType,\n  type CompleteManagedAuthEmailPasswordTransactionRequest as CompleteManagedAuthEmailPasswordTransactionRequestType,\n  type CompleteManagedAuthLoginTransactionResponse as CompleteManagedAuthLoginTransactionResponseType,\n  type LogoutManagedAuthLoginSlotRequest as LogoutManagedAuthLoginSlotRequestType,\n  type LogoutManagedAuthSessionSetRequest as LogoutManagedAuthSessionSetRequestType,\n  type ManagedAuthDeepLinkResolution as ManagedAuthDeepLinkResolutionType,\n  type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType,\n  type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType,\n  type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType,\n  type ResolveManagedAuthDeepLinkRequest as ResolveManagedAuthDeepLinkRequestType,\n  type SelectManagedAuthLoginSlotRequest as SelectManagedAuthLoginSlotRequestType,\n  type StartManagedAuthSocialTransactionRequest as StartManagedAuthSocialTransactionRequestType,\n  type StartManagedAuthSocialTransactionResponse as StartManagedAuthSocialTransactionResponseType,\n} from \"@opengeni/contracts/managed-auth-session-sets\";\nimport type { z } from \"zod\";\n\nexport type BrowserAccountsFetch = (\n  input: string | URL | Request,\n  init?: RequestInit,\n) => Promise<Response>;\n\nexport type BrowserAccountsClientOptions = {\n  baseUrl: string;\n  fetch?: BrowserAccountsFetch;\n};\n\nexport interface BrowserAccountsClientLike {\n  getSessionSet(): Promise<ManagedAuthSessionSetProjectionType>;\n  reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType>;\n  bootstrapSessionSet(\n    request: BootstrapManagedAuthSessionSetRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  beginLoginTransaction(\n    request: BeginManagedAuthLoginTransactionRequestType,\n  ): Promise<ManagedAuthLoginTransactionType>;\n  completeEmailPasswordTransaction(\n    request: CompleteManagedAuthEmailPasswordTransactionRequestType,\n  ): Promise<CompleteManagedAuthLoginTransactionResponseType>;\n  startSocialTransaction?(\n    request: StartManagedAuthSocialTransactionRequestType,\n  ): Promise<StartManagedAuthSocialTransactionResponseType>;\n  cancelLoginTransaction(\n    request: CancelManagedAuthLoginTransactionRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  selectLoginSlot(\n    request: SelectManagedAuthLoginSlotRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  logoutLoginSlot(\n    request: LogoutManagedAuthLoginSlotRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  logoutSessionSet(\n    request: LogoutManagedAuthSessionSetRequestType,\n  ): Promise<ManagedAuthLogoutAllReceiptType>;\n  resolveDeepLink(\n    request: ResolveManagedAuthDeepLinkRequestType,\n  ): Promise<ManagedAuthDeepLinkResolutionType>;\n}\n\nexport class BrowserAccountsApiError extends Error {\n  readonly name = \"BrowserAccountsApiError\";\n  constructor(\n    readonly status: number,\n    readonly code: string,\n    options?: { cause?: unknown },\n  ) {\n    super(code, options?.cause === undefined ? undefined : { cause: options.cause });\n  }\n}\n\nexport class BrowserAccountsClient implements BrowserAccountsClientLike {\n  readonly #baseUrl: string;\n  readonly #fetch: BrowserAccountsFetch;\n  // CSRF is generation-bound. Exact idempotent replay must retain the\n  // admission envelope even after an authority reread observes a newer clock.\n  readonly #mutationAdmissions = new Map<\n    string,\n    { signature: string; csrfToken: string; actorEpoch: string }\n  >();\n  #projection: ManagedAuthSessionSetProjectionType | null = null;\n  #authorityReadEpoch = 0;\n  #authorityResetPending = false;\n  #authorityReconciliation: Promise<ManagedAuthSessionSetProjectionType> | null = null;\n\n  constructor(options: BrowserAccountsClientOptions) {\n    this.#baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.#fetch = options.fetch ?? ((input, init) => fetch(input, init));\n  }\n\n  async getSessionSet(): Promise<ManagedAuthSessionSetProjectionType> {\n    if (this.#authorityResetPending || this.#authorityReconciliation) {\n      return await this.reconcileSessionSetAuthority();\n    }\n    const readEpoch = this.#authorityReadEpoch;\n    const received = await this.#readSessionSet();\n    if (readEpoch !== this.#authorityReadEpoch) {\n      return this.#authorityReconciliation\n        ? await this.#authorityReconciliation\n        : (this.#projection ?? (await this.getSessionSet()));\n    }\n    return this.#remember(received);\n  }\n\n  async reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType> {\n    if (this.#authorityReconciliation) return await this.#authorityReconciliation;\n    const previous = this.#projection;\n    const readEpoch = ++this.#authorityReadEpoch;\n    // Explicit reconciliation is an authority-invalidation boundary, not an\n    // ordinary monotonic refresh. Old operation admissions must never cross it,\n    // and mutations stay closed until two sequential reads reach a decision.\n    this.#authorityResetPending = true;\n    this.#mutationAdmissions.clear();\n    const reconciliation = this.#reconcileSessionSetAuthority(previous, readEpoch);\n    this.#authorityReconciliation = reconciliation;\n    try {\n      const accepted = await reconciliation;\n      if (readEpoch === this.#authorityReadEpoch) this.#authorityResetPending = false;\n      return accepted;\n    } finally {\n      if (this.#authorityReconciliation === reconciliation) {\n        this.#authorityReconciliation = null;\n      }\n    }\n  }\n\n  async bootstrapSessionSet(request: BootstrapManagedAuthSessionSetRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/bootstrap\",\n      BootstrapManagedAuthSessionSetRequest,\n      request,\n    );\n  }\n\n  async beginLoginTransaction(request: BeginManagedAuthLoginTransactionRequestType) {\n    return ManagedAuthLoginTransaction.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions\",\n        BeginManagedAuthLoginTransactionRequest,\n        request,\n      ),\n    );\n  }\n\n  async completeEmailPasswordTransaction(\n    request: CompleteManagedAuthEmailPasswordTransactionRequestType,\n  ) {\n    const authorityReadEpoch = this.#authorityReadEpoch;\n    const response = CompleteManagedAuthLoginTransactionResponse.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions/email-password\",\n        CompleteManagedAuthEmailPasswordTransactionRequest,\n        request,\n      ),\n    );\n    if (authorityReadEpoch !== this.#authorityReadEpoch) {\n      return { ...response, projection: await this.getSessionSet() };\n    }\n    const remembered = this.#remember(response.projection);\n    if (remembered !== response.projection) {\n      return { ...response, projection: await this.getSessionSet() };\n    }\n    return response;\n  }\n\n  async startSocialTransaction(request: StartManagedAuthSocialTransactionRequestType) {\n    return StartManagedAuthSocialTransactionResponse.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions/social\",\n        StartManagedAuthSocialTransactionRequest,\n        request,\n      ),\n    );\n  }\n\n  async cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType) {\n    return this.#projectionResponse(\n      \"DELETE\",\n      `/v1/auth/session-set/transactions/${encodeURIComponent(request.transactionId)}`,\n      CancelManagedAuthLoginTransactionRequest,\n      request,\n    );\n  }\n\n  async selectLoginSlot(request: SelectManagedAuthLoginSlotRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/select\",\n      SelectManagedAuthLoginSlotRequest,\n      request,\n    );\n  }\n\n  async logoutLoginSlot(request: LogoutManagedAuthLoginSlotRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/logout-one\",\n      LogoutManagedAuthLoginSlotRequest,\n      request,\n    );\n  }\n\n  async logoutSessionSet(request: LogoutManagedAuthSessionSetRequestType) {\n    const receipt = ManagedAuthLogoutAllReceipt.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/logout-all\",\n        LogoutManagedAuthSessionSetRequest,\n        request,\n      ),\n    );\n    this.#authorityReadEpoch += 1;\n    this.#authorityResetPending = false;\n    this.#projection = null;\n    this.#mutationAdmissions.clear();\n    return receipt;\n  }\n\n  async resolveDeepLink(request: ResolveManagedAuthDeepLinkRequestType) {\n    return ManagedAuthDeepLinkResolution.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/deep-link/resolve\",\n        ResolveManagedAuthDeepLinkRequest,\n        request,\n      ),\n    );\n  }\n\n  async #projectionResponse<S extends z.ZodType>(\n    method: \"POST\" | \"DELETE\",\n    path: string,\n    schema: S,\n    request: z.infer<S>,\n  ): Promise<ManagedAuthSessionSetProjectionType> {\n    const authorityReadEpoch = this.#authorityReadEpoch;\n    const received = ManagedAuthSessionSetProjection.parse(\n      await this.#mutation(method, path, schema, request),\n    );\n    if (authorityReadEpoch !== this.#authorityReadEpoch) return await this.getSessionSet();\n    const remembered = this.#remember(received);\n    // An exact replay may legitimately return its older durable receipt after\n    // another tab has advanced this in-memory client. Reconcile from authority\n    // instead of presenting that receipt as the current actor projection.\n    return remembered === received ? received : await this.getSessionSet();\n  }\n\n  async #mutation<S extends z.ZodType>(\n    method: \"POST\" | \"DELETE\",\n    path: string,\n    schema: S,\n    request: z.infer<S>,\n  ): Promise<unknown> {\n    if (this.#authorityResetPending) {\n      throw new BrowserAccountsApiError(409, \"actor_change_required\");\n    }\n    const body = schema.parse(request);\n    const projection = this.#projection;\n    if (!projection) throw new BrowserAccountsApiError(409, \"session_set_projection_required\");\n    const operationId = mutationOperationId(body);\n    const signature = operationId ? JSON.stringify([method, path, body]) : null;\n    const retained = operationId ? this.#mutationAdmissions.get(operationId) : null;\n    if (retained && retained.signature !== signature) {\n      throw new BrowserAccountsApiError(409, \"operation_reused\");\n    }\n    const admission =\n      retained ??\n      ({\n        signature: signature ?? \"\",\n        csrfToken: projection.csrfToken,\n        actorEpoch: projection.actorEpoch,\n      } as const);\n    if (operationId && !retained) {\n      this.#mutationAdmissions.set(operationId, admission);\n      if (this.#mutationAdmissions.size > 64) {\n        this.#mutationAdmissions.delete(this.#mutationAdmissions.keys().next().value!);\n      }\n    }\n    return await this.#request(method, path, body, {\n      \"x-opengeni-session-csrf\": admission.csrfToken,\n      \"x-opengeni-actor-epoch\": admission.actorEpoch,\n    });\n  }\n\n  async #request(\n    method: \"GET\" | \"POST\" | \"DELETE\",\n    path: string,\n    body?: unknown,\n    headers: Record<string, string> = {},\n  ): Promise<unknown> {\n    let response: Response;\n    try {\n      response = await this.#fetch(`${this.#baseUrl}${path}`, {\n        method,\n        credentials: \"include\",\n        headers: {\n          accept: \"application/json\",\n          [MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER]:\n            MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,\n          ...(body === undefined ? {} : { \"content-type\": \"application/json\" }),\n          ...headers,\n        },\n        ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n      });\n    } catch (cause) {\n      if (method !== \"GET\") {\n        throw new BrowserAccountsApiError(503, \"operation_outcome_unknown\", { cause });\n      }\n      throw cause;\n    }\n    let parsed = true;\n    const value = await response.json().catch(() => {\n      parsed = false;\n      return null;\n    });\n    if (!response.ok) {\n      const code = managedAuthErrorCode(value) ?? `http_${response.status}`;\n      throw new BrowserAccountsApiError(response.status, code);\n    }\n    if (!parsed && method !== \"GET\") {\n      throw new BrowserAccountsApiError(503, \"operation_outcome_unknown\");\n    }\n    return value;\n  }\n\n  async #readSessionSet(): Promise<ManagedAuthSessionSetProjectionType> {\n    return ManagedAuthSessionSetProjection.parse(\n      await this.#request(\"GET\", \"/v1/auth/session-set\"),\n    );\n  }\n\n  async #reconcileSessionSetAuthority(\n    previous: ManagedAuthSessionSetProjectionType | null,\n    readEpoch: number,\n  ): Promise<ManagedAuthSessionSetProjectionType> {\n    const first = await this.#readSessionSet();\n    const second = await this.#readSessionSet();\n    if (readEpoch !== this.#authorityReadEpoch) {\n      return await this.#reconcileSessionSetAuthority(this.#projection, this.#authorityReadEpoch);\n    }\n    if (this.#projection !== previous) return this.#remember(second);\n    if (!previous || compareProjectionClock(second, previous) >= 0) {\n      return this.#remember(second);\n    }\n    if (compareProjectionClock(first, previous) < 0 && compareProjectionClock(second, first) >= 0) {\n      // Same-authority clocks never decrease. Two sequential no-store reads\n      // that both remain below the remembered clock therefore prove that the\n      // HttpOnly authority rotated; the second may already have advanced from\n      // the fresh authority's initial 1/1 projection.\n      this.#projection = second;\n      this.#mutationAdmissions.clear();\n      return second;\n    }\n    return previous;\n  }\n\n  #remember(projection: ManagedAuthSessionSetProjectionType) {\n    const current = this.#projection;\n    if (!current || compareProjectionClock(projection, current) >= 0) {\n      this.#projection = projection;\n      return projection;\n    }\n    return current;\n  }\n}\n\nfunction mutationOperationId(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const operationId = (value as { operationId?: unknown }).operationId;\n  return typeof operationId === \"string\" ? operationId : null;\n}\n\nfunction compareProjectionClock(\n  left: Pick<ManagedAuthSessionSetProjectionType, \"actorEpoch\" | \"generation\">,\n  right: Pick<ManagedAuthSessionSetProjectionType, \"actorEpoch\" | \"generation\">,\n): number {\n  const actorDelta = BigInt(left.actorEpoch) - BigInt(right.actorEpoch);\n  if (actorDelta !== 0n) return actorDelta > 0n ? 1 : -1;\n  const generationDelta = BigInt(left.generation) - BigInt(right.generation);\n  return generationDelta === 0n ? 0 : generationDelta > 0n ? 1 : -1;\n}\n\nfunction managedAuthErrorCode(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const error = (value as { error?: unknown }).error;\n  if (error && typeof error === \"object\") {\n    const details = (error as { details?: unknown }).details;\n    if (details && typeof details === \"object\") {\n      const parsed = ManagedAuthSessionSetErrorCode.safeParse(\n        (details as { managedAuthCode?: unknown }).managedAuthCode,\n      );\n      if (parsed.success) return parsed.data;\n    }\n  }\n  const legacy = (value as { message?: unknown }).message;\n  const parsed = ManagedAuthSessionSetErrorCode.safeParse(legacy);\n  return parsed.success ? parsed.data : null;\n}\n\nexport function createBrowserAccountsClient(\n  options: BrowserAccountsClientOptions,\n): BrowserAccountsClient {\n  return new BrowserAccountsClient(options);\n}\n\nexport type {\n  BeginManagedAuthLoginTransactionRequestType as BeginManagedAuthLoginTransactionRequest,\n  BootstrapManagedAuthSessionSetRequestType as BootstrapManagedAuthSessionSetRequest,\n  CancelManagedAuthLoginTransactionRequestType as CancelManagedAuthLoginTransactionRequest,\n  CompleteManagedAuthEmailPasswordTransactionRequestType as CompleteManagedAuthEmailPasswordTransactionRequest,\n  CompleteManagedAuthLoginTransactionResponseType as CompleteManagedAuthLoginTransactionResponse,\n  LogoutManagedAuthLoginSlotRequestType as LogoutManagedAuthLoginSlotRequest,\n  LogoutManagedAuthSessionSetRequestType as LogoutManagedAuthSessionSetRequest,\n  ManagedAuthDeepLinkResolutionType as ManagedAuthDeepLinkResolution,\n  ManagedAuthLoginTransactionType as ManagedAuthLoginTransaction,\n  ManagedAuthLogoutAllReceiptType as ManagedAuthLogoutAllReceipt,\n  ManagedAuthSessionSetProjectionType as ManagedAuthSessionSetProjection,\n  ResolveManagedAuthDeepLinkRequestType as ResolveManagedAuthDeepLinkRequest,\n  SelectManagedAuthLoginSlotRequestType as SelectManagedAuthLoginSlotRequest,\n};\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAgBK;AA6CA,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAEjD,YACW,QACA,MACT,SACA;AACA,UAAM,MAAM,SAAS,UAAU,SAAY,SAAY,EAAE,OAAO,QAAQ,MAAM,CAAC;AAJtE;AACA;AAAA,EAIX;AAAA,EAPS,OAAO;AAQlB;AAEO,IAAM,wBAAN,MAAiE;AAAA,EAC7D;AAAA,EACA;AAAA;AAAA;AAAA,EAGA,sBAAsB,oBAAI,IAGjC;AAAA,EACF,cAA0D;AAAA,EAC1D,sBAAsB;AAAA,EACtB,yBAAyB;AAAA,EACzB,2BAAgF;AAAA,EAEhF,YAAY,SAAuC;AACjD,SAAK,WAAW,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;AAClD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAAO,SAAS,MAAM,OAAO,IAAI;AAAA,EACpE;AAAA,EAEA,MAAM,gBAA8D;AAClE,QAAI,KAAK,0BAA0B,KAAK,0BAA0B;AAChE,aAAO,MAAM,KAAK,6BAA6B;AAAA,IACjD;AACA,UAAM,YAAY,KAAK;AACvB,UAAM,WAAW,MAAM,KAAK,gBAAgB;AAC5C,QAAI,cAAc,KAAK,qBAAqB;AAC1C,aAAO,KAAK,2BACR,MAAM,KAAK,2BACV,KAAK,eAAgB,MAAM,KAAK,cAAc;AAAA,IACrD;AACA,WAAO,KAAK,UAAU,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,+BAA6E;AACjF,QAAI,KAAK,yBAA0B,QAAO,MAAM,KAAK;AACrD,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,EAAE,KAAK;AAIzB,SAAK,yBAAyB;AAC9B,SAAK,oBAAoB,MAAM;AAC/B,UAAM,iBAAiB,KAAK,8BAA8B,UAAU,SAAS;AAC7E,SAAK,2BAA2B;AAChC,QAAI;AACF,YAAM,WAAW,MAAM;AACvB,UAAI,cAAc,KAAK,oBAAqB,MAAK,yBAAyB;AAC1E,aAAO;AAAA,IACT,UAAE;AACA,UAAI,KAAK,6BAA6B,gBAAgB;AACpD,aAAK,2BAA2B;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,SAAoD;AAC5E,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,sBAAsB,SAAsD;AAChF,WAAO,4BAA4B;AAAA,MACjC,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iCACJ,SACA;AACA,UAAM,qBAAqB,KAAK;AAChC,UAAM,WAAW,4CAA4C;AAAA,MAC3D,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,uBAAuB,KAAK,qBAAqB;AACnD,aAAO,EAAE,GAAG,UAAU,YAAY,MAAM,KAAK,cAAc,EAAE;AAAA,IAC/D;AACA,UAAM,aAAa,KAAK,UAAU,SAAS,UAAU;AACrD,QAAI,eAAe,SAAS,YAAY;AACtC,aAAO,EAAE,GAAG,UAAU,YAAY,MAAM,KAAK,cAAc,EAAE;AAAA,IAC/D;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,uBAAuB,SAAuD;AAClF,WAAO,0CAA0C;AAAA,MAC/C,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,uBAAuB,SAAuD;AAClF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qCAAqC,mBAAmB,QAAQ,aAAa,CAAC;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,SAAiD;AACtE,UAAM,UAAU,4BAA4B;AAAA,MAC1C,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,SAAK,uBAAuB;AAC5B,SAAK,yBAAyB;AAC9B,SAAK,cAAc;AACnB,SAAK,oBAAoB,MAAM;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,8BAA8B;AAAA,MACnC,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBACJ,QACA,MACA,QACA,SAC8C;AAC9C,UAAM,qBAAqB,KAAK;AAChC,UAAM,WAAW,gCAAgC;AAAA,MAC/C,MAAM,KAAK,UAAU,QAAQ,MAAM,QAAQ,OAAO;AAAA,IACpD;AACA,QAAI,uBAAuB,KAAK,oBAAqB,QAAO,MAAM,KAAK,cAAc;AACrF,UAAM,aAAa,KAAK,UAAU,QAAQ;AAI1C,WAAO,eAAe,WAAW,WAAW,MAAM,KAAK,cAAc;AAAA,EACvE;AAAA,EAEA,MAAM,UACJ,QACA,MACA,QACA,SACkB;AAClB,QAAI,KAAK,wBAAwB;AAC/B,YAAM,IAAI,wBAAwB,KAAK,uBAAuB;AAAA,IAChE;AACA,UAAM,OAAO,OAAO,MAAM,OAAO;AACjC,UAAM,aAAa,KAAK;AACxB,QAAI,CAAC,WAAY,OAAM,IAAI,wBAAwB,KAAK,iCAAiC;AACzF,UAAM,cAAc,oBAAoB,IAAI;AAC5C,UAAM,YAAY,cAAc,KAAK,UAAU,CAAC,QAAQ,MAAM,IAAI,CAAC,IAAI;AACvE,UAAM,WAAW,cAAc,KAAK,oBAAoB,IAAI,WAAW,IAAI;AAC3E,QAAI,YAAY,SAAS,cAAc,WAAW;AAChD,YAAM,IAAI,wBAAwB,KAAK,kBAAkB;AAAA,IAC3D;AACA,UAAM,YACJ,YACC;AAAA,MACC,WAAW,aAAa;AAAA,MACxB,WAAW,WAAW;AAAA,MACtB,YAAY,WAAW;AAAA,IACzB;AACF,QAAI,eAAe,CAAC,UAAU;AAC5B,WAAK,oBAAoB,IAAI,aAAa,SAAS;AACnD,UAAI,KAAK,oBAAoB,OAAO,IAAI;AACtC,aAAK,oBAAoB,OAAO,KAAK,oBAAoB,KAAK,EAAE,KAAK,EAAE,KAAM;AAAA,MAC/E;AAAA,IACF;AACA,WAAO,MAAM,KAAK,SAAS,QAAQ,MAAM,MAAM;AAAA,MAC7C,2BAA2B,UAAU;AAAA,MACrC,0BAA0B,UAAU;AAAA,IACtC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,SACJ,QACA,MACA,MACA,UAAkC,CAAC,GACjB;AAClB,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,IAAI,IAAI;AAAA,QACtD;AAAA,QACA,aAAa;AAAA,QACb,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,CAAC,4CAA4C,GAC3C;AAAA,UACF,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,UACnE,GAAG;AAAA,QACL;AAAA,QACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,MAC7D,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,WAAW,OAAO;AACpB,cAAM,IAAI,wBAAwB,KAAK,6BAA6B,EAAE,MAAM,CAAC;AAAA,MAC/E;AACA,YAAM;AAAA,IACR;AACA,QAAI,SAAS;AACb,UAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM;AAC9C,eAAS;AACT,aAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,OAAO,qBAAqB,KAAK,KAAK,QAAQ,SAAS,MAAM;AACnE,YAAM,IAAI,wBAAwB,SAAS,QAAQ,IAAI;AAAA,IACzD;AACA,QAAI,CAAC,UAAU,WAAW,OAAO;AAC/B,YAAM,IAAI,wBAAwB,KAAK,2BAA2B;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,kBAAgE;AACpE,WAAO,gCAAgC;AAAA,MACrC,MAAM,KAAK,SAAS,OAAO,sBAAsB;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,8BACJ,UACA,WAC8C;AAC9C,UAAM,QAAQ,MAAM,KAAK,gBAAgB;AACzC,UAAM,SAAS,MAAM,KAAK,gBAAgB;AAC1C,QAAI,cAAc,KAAK,qBAAqB;AAC1C,aAAO,MAAM,KAAK,8BAA8B,KAAK,aAAa,KAAK,mBAAmB;AAAA,IAC5F;AACA,QAAI,KAAK,gBAAgB,SAAU,QAAO,KAAK,UAAU,MAAM;AAC/D,QAAI,CAAC,YAAY,uBAAuB,QAAQ,QAAQ,KAAK,GAAG;AAC9D,aAAO,KAAK,UAAU,MAAM;AAAA,IAC9B;AACA,QAAI,uBAAuB,OAAO,QAAQ,IAAI,KAAK,uBAAuB,QAAQ,KAAK,KAAK,GAAG;AAK7F,WAAK,cAAc;AACnB,WAAK,oBAAoB,MAAM;AAC/B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,UAAU,YAAiD;AACzD,UAAM,UAAU,KAAK;AACrB,QAAI,CAAC,WAAW,uBAAuB,YAAY,OAAO,KAAK,GAAG;AAChE,WAAK,cAAc;AACnB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,OAA+B;AAC1D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,cAAe,MAAoC;AACzD,SAAO,OAAO,gBAAgB,WAAW,cAAc;AACzD;AAEA,SAAS,uBACP,MACA,OACQ;AACR,QAAM,aAAa,OAAO,KAAK,UAAU,IAAI,OAAO,MAAM,UAAU;AACpE,MAAI,eAAe,GAAI,QAAO,aAAa,KAAK,IAAI;AACpD,QAAM,kBAAkB,OAAO,KAAK,UAAU,IAAI,OAAO,MAAM,UAAU;AACzE,SAAO,oBAAoB,KAAK,IAAI,kBAAkB,KAAK,IAAI;AACjE;AAEA,SAAS,qBAAqB,OAA+B;AAC3D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAS,MAA8B;AAC7C,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,UAAW,MAAgC;AACjD,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,YAAMA,UAAS,+BAA+B;AAAA,QAC3C,QAA0C;AAAA,MAC7C;AACA,UAAIA,QAAO,QAAS,QAAOA,QAAO;AAAA,IACpC;AAAA,EACF;AACA,QAAM,SAAU,MAAgC;AAChD,QAAM,SAAS,+BAA+B,UAAU,MAAM;AAC9D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEO,SAAS,4BACd,SACuB;AACvB,SAAO,IAAI,sBAAsB,OAAO;AAC1C;","names":["parsed"]}

package/dist/adapters/express.d.ts

@@ -0,0 +1,31 @@
+import type { IncomingMessage, ServerResponse } from "node:http";
+/** Any web-standard handler: `createSessionProxyHandler`, `createChatHandler`, or your own. */
+export type WebHandler = (request: Request) => Promise<Response>;
+/** Express/Connect request: Node's `IncomingMessage` plus what those frameworks add. */
+export type NodeRequestLike = IncomingMessage & {
+    originalUrl?: string | undefined;
+    /** Set when a body parser (for example `express.json()`) already consumed the body. */
+    body?: unknown;
+    protocol?: string | undefined;
+};
+export type NodeMiddleware = (request: NodeRequestLike, response: ServerResponse, next?: (error?: unknown) => void) => void;
+export type NodeMiddlewareOptions = {
+    /** Origin used to build the request URL. Defaults to the Host header over http(s). */
+    origin?: string | undefined;
+};
+/**
+ * Expose a web-standard handler as Express/Connect (or plain `node:http`)
+ * middleware. Mount it with the same path the browser client uses:
+ *
+ * ```ts
+ * app.use("/api/opengeni", toNodeMiddleware(handler));
+ * ```
+ *
+ * The full original URL is forwarded (Express strips the mount path from
+ * `req.url`), bodies stream through unless a body parser already consumed
+ * them, responses (including SSE) are written as they arrive, and a client
+ * disconnect aborts the request signal.
+ */
+export declare function toNodeMiddleware(handler: WebHandler, options?: NodeMiddlewareOptions): NodeMiddleware;
+/** Express/Connect naming alias. */
+export declare const toExpressMiddleware: typeof toNodeMiddleware;

package/dist/adapters/express.js

@@ -0,0 +1,87 @@
+// src/adapters/express.ts
+import { Readable } from "stream";
+function toNodeMiddleware(handler, options = {}) {
+  return (request, response, next) => {
+    void (async () => {
+      const abort = new AbortController();
+      response.once("close", () => {
+        if (!response.writableFinished) abort.abort();
+      });
+      const web = await handler(toWebRequest(request, abort.signal, options));
+      await writeWebResponse(web, response);
+    })().catch((error) => {
+      if (next) next(error);
+      else if (!response.headersSent) {
+        response.statusCode = 500;
+        response.end();
+      } else response.destroy(error instanceof Error ? error : void 0);
+    });
+  };
+}
+var toExpressMiddleware = toNodeMiddleware;
+function toWebRequest(request, signal, options) {
+  const encrypted = request.socket?.encrypted === true;
+  const origin = options.origin?.replace(/\/+$/, "") ?? `${request.protocol ?? (encrypted ? "https" : "http")}://${request.headers.host ?? "localhost"}`;
+  const url = new URL(request.originalUrl ?? request.url ?? "/", origin);
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(request.headers)) {
+    if (value === void 0) continue;
+    if (Array.isArray(value)) for (const item of value) headers.append(name, item);
+    else headers.set(name, value);
+  }
+  const method = request.method ?? "GET";
+  let body;
+  if (method !== "GET" && method !== "HEAD") {
+    if (request.body !== void 0 && (request.readableEnded || request.complete)) {
+      body = typeof request.body === "string" || request.body instanceof Uint8Array ? request.body : JSON.stringify(request.body);
+      headers.delete("content-length");
+    } else {
+      body = Readable.toWeb(request);
+    }
+  }
+  return new Request(url, {
+    method,
+    headers,
+    signal,
+    ...body !== void 0 ? { body, duplex: "half" } : {}
+  });
+}
+async function writeWebResponse(web, response) {
+  response.statusCode = web.status;
+  const cookies = web.headers.getSetCookie?.() ?? [];
+  web.headers.forEach((value, name) => {
+    if (name.toLowerCase() !== "set-cookie") response.setHeader(name, value);
+  });
+  if (cookies.length > 0) response.setHeader("set-cookie", cookies);
+  if (!web.body) {
+    response.end();
+    return;
+  }
+  response.flushHeaders();
+  const reader = web.body.getReader();
+  response.once("close", () => {
+    void reader.cancel().catch(() => void 0);
+  });
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    if (!response.write(value)) {
+      await new Promise((resolve) => {
+        const settle = () => {
+          response.off("drain", settle);
+          response.off("close", settle);
+          resolve();
+        };
+        response.once("drain", settle);
+        response.once("close", settle);
+      });
+    }
+    if (response.destroyed) break;
+  }
+  response.end();
+}
+export {
+  toExpressMiddleware,
+  toNodeMiddleware
+};
+//# sourceMappingURL=express.js.map

package/dist/adapters/express.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/adapters/express.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { Readable } from \"node:stream\";\n\n/** Any web-standard handler: `createSessionProxyHandler`, `createChatHandler`, or your own. */\nexport type WebHandler = (request: Request) => Promise<Response>;\n\n/** Express/Connect request: Node's `IncomingMessage` plus what those frameworks add. */\nexport type NodeRequestLike = IncomingMessage & {\n  originalUrl?: string | undefined;\n  /** Set when a body parser (for example `express.json()`) already consumed the body. */\n  body?: unknown;\n  protocol?: string | undefined;\n};\n\nexport type NodeMiddleware = (\n  request: NodeRequestLike,\n  response: ServerResponse,\n  next?: (error?: unknown) => void,\n) => void;\n\nexport type NodeMiddlewareOptions = {\n  /** Origin used to build the request URL. Defaults to the Host header over http(s). */\n  origin?: string | undefined;\n};\n\n/**\n * Expose a web-standard handler as Express/Connect (or plain `node:http`)\n * middleware. Mount it with the same path the browser client uses:\n *\n * ```ts\n * app.use(\"/api/opengeni\", toNodeMiddleware(handler));\n * ```\n *\n * The full original URL is forwarded (Express strips the mount path from\n * `req.url`), bodies stream through unless a body parser already consumed\n * them, responses (including SSE) are written as they arrive, and a client\n * disconnect aborts the request signal.\n */\nexport function toNodeMiddleware(\n  handler: WebHandler,\n  options: NodeMiddlewareOptions = {},\n): NodeMiddleware {\n  return (request, response, next) => {\n    void (async () => {\n      const abort = new AbortController();\n      response.once(\"close\", () => {\n        if (!response.writableFinished) abort.abort();\n      });\n      const web = await handler(toWebRequest(request, abort.signal, options));\n      await writeWebResponse(web, response);\n    })().catch((error: unknown) => {\n      if (next) next(error);\n      else if (!response.headersSent) {\n        response.statusCode = 500;\n        response.end();\n      } else response.destroy(error instanceof Error ? error : undefined);\n    });\n  };\n}\n\n/** Express/Connect naming alias. */\nexport const toExpressMiddleware = toNodeMiddleware;\n\nfunction toWebRequest(\n  request: NodeRequestLike,\n  signal: AbortSignal,\n  options: NodeMiddlewareOptions,\n): Request {\n  const encrypted = (request.socket as { encrypted?: boolean } | undefined)?.encrypted === true;\n  const origin =\n    options.origin?.replace(/\\/+$/, \"\") ??\n    `${request.protocol ?? (encrypted ? \"https\" : \"http\")}://${request.headers.host ?? \"localhost\"}`;\n  const url = new URL(request.originalUrl ?? request.url ?? \"/\", origin);\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(request.headers)) {\n    if (value === undefined) continue;\n    if (Array.isArray(value)) for (const item of value) headers.append(name, item);\n    else headers.set(name, value);\n  }\n  const method = request.method ?? \"GET\";\n  let body: BodyInit | undefined;\n  if (method !== \"GET\" && method !== \"HEAD\") {\n    if (request.body !== undefined && (request.readableEnded || request.complete)) {\n      // A body parser consumed the stream: forward what it parsed.\n      body =\n        typeof request.body === \"string\" || request.body instanceof Uint8Array\n          ? (request.body as string | Uint8Array<ArrayBuffer>)\n          : JSON.stringify(request.body);\n      headers.delete(\"content-length\");\n    } else {\n      body = Readable.toWeb(request) as unknown as ReadableStream<Uint8Array>;\n    }\n  }\n  return new Request(url, {\n    method,\n    headers,\n    signal,\n    ...(body !== undefined ? { body, duplex: \"half\" } : {}),\n  } as RequestInit);\n}\n\nasync function writeWebResponse(web: Response, response: ServerResponse): Promise<void> {\n  response.statusCode = web.status;\n  const cookies = web.headers.getSetCookie?.() ?? [];\n  web.headers.forEach((value, name) => {\n    if (name.toLowerCase() !== \"set-cookie\") response.setHeader(name, value);\n  });\n  if (cookies.length > 0) response.setHeader(\"set-cookie\", cookies);\n  if (!web.body) {\n    response.end();\n    return;\n  }\n  // Send headers now so SSE clients see the stream open before the first event.\n  response.flushHeaders();\n  const reader = web.body.getReader();\n  response.once(\"close\", () => {\n    void reader.cancel().catch(() => undefined);\n  });\n  for (;;) {\n    const { done, value } = await reader.read();\n    if (done) break;\n    if (!response.write(value)) {\n      await new Promise<void>((resolve) => {\n        const settle = () => {\n          response.off(\"drain\", settle);\n          response.off(\"close\", settle);\n          resolve();\n        };\n        response.once(\"drain\", settle);\n        response.once(\"close\", settle);\n      });\n    }\n    if (response.destroyed) break;\n  }\n  response.end();\n}\n"],"mappings":";AACA,SAAS,gBAAgB;AAqClB,SAAS,iBACd,SACA,UAAiC,CAAC,GAClB;AAChB,SAAO,CAAC,SAAS,UAAU,SAAS;AAClC,UAAM,YAAY;AAChB,YAAM,QAAQ,IAAI,gBAAgB;AAClC,eAAS,KAAK,SAAS,MAAM;AAC3B,YAAI,CAAC,SAAS,iBAAkB,OAAM,MAAM;AAAA,MAC9C,CAAC;AACD,YAAM,MAAM,MAAM,QAAQ,aAAa,SAAS,MAAM,QAAQ,OAAO,CAAC;AACtE,YAAM,iBAAiB,KAAK,QAAQ;AAAA,IACtC,GAAG,EAAE,MAAM,CAAC,UAAmB;AAC7B,UAAI,KAAM,MAAK,KAAK;AAAA,eACX,CAAC,SAAS,aAAa;AAC9B,iBAAS,aAAa;AACtB,iBAAS,IAAI;AAAA,MACf,MAAO,UAAS,QAAQ,iBAAiB,QAAQ,QAAQ,MAAS;AAAA,IACpE,CAAC;AAAA,EACH;AACF;AAGO,IAAM,sBAAsB;AAEnC,SAAS,aACP,SACA,QACA,SACS;AACT,QAAM,YAAa,QAAQ,QAAgD,cAAc;AACzF,QAAM,SACJ,QAAQ,QAAQ,QAAQ,QAAQ,EAAE,KAClC,GAAG,QAAQ,aAAa,YAAY,UAAU,OAAO,MAAM,QAAQ,QAAQ,QAAQ,WAAW;AAChG,QAAM,MAAM,IAAI,IAAI,QAAQ,eAAe,QAAQ,OAAO,KAAK,MAAM;AACrE,QAAM,UAAU,IAAI,QAAQ;AAC5B,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,OAAO,GAAG;AAC3D,QAAI,UAAU,OAAW;AACzB,QAAI,MAAM,QAAQ,KAAK,EAAG,YAAW,QAAQ,MAAO,SAAQ,OAAO,MAAM,IAAI;AAAA,QACxE,SAAQ,IAAI,MAAM,KAAK;AAAA,EAC9B;AACA,QAAM,SAAS,QAAQ,UAAU;AACjC,MAAI;AACJ,MAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,QAAI,QAAQ,SAAS,WAAc,QAAQ,iBAAiB,QAAQ,WAAW;AAE7E,aACE,OAAO,QAAQ,SAAS,YAAY,QAAQ,gBAAgB,aACvD,QAAQ,OACT,KAAK,UAAU,QAAQ,IAAI;AACjC,cAAQ,OAAO,gBAAgB;AAAA,IACjC,OAAO;AACL,aAAO,SAAS,MAAM,OAAO;AAAA,IAC/B;AAAA,EACF;AACA,SAAO,IAAI,QAAQ,KAAK;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,SAAS,SAAY,EAAE,MAAM,QAAQ,OAAO,IAAI,CAAC;AAAA,EACvD,CAAgB;AAClB;AAEA,eAAe,iBAAiB,KAAe,UAAyC;AACtF,WAAS,aAAa,IAAI;AAC1B,QAAM,UAAU,IAAI,QAAQ,eAAe,KAAK,CAAC;AACjD,MAAI,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACnC,QAAI,KAAK,YAAY,MAAM,aAAc,UAAS,UAAU,MAAM,KAAK;AAAA,EACzE,CAAC;AACD,MAAI,QAAQ,SAAS,EAAG,UAAS,UAAU,cAAc,OAAO;AAChE,MAAI,CAAC,IAAI,MAAM;AACb,aAAS,IAAI;AACb;AAAA,EACF;AAEA,WAAS,aAAa;AACtB,QAAM,SAAS,IAAI,KAAK,UAAU;AAClC,WAAS,KAAK,SAAS,MAAM;AAC3B,SAAK,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAAA,EAC5C,CAAC;AACD,aAAS;AACP,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,QAAI,CAAC,SAAS,MAAM,KAAK,GAAG;AAC1B,YAAM,IAAI,QAAc,CAAC,YAAY;AACnC,cAAM,SAAS,MAAM;AACnB,mBAAS,IAAI,SAAS,MAAM;AAC5B,mBAAS,IAAI,SAAS,MAAM;AAC5B,kBAAQ;AAAA,QACV;AACA,iBAAS,KAAK,SAAS,MAAM;AAC7B,iBAAS,KAAK,SAAS,MAAM;AAAA,MAC/B,CAAC;AAAA,IACH;AACA,QAAI,SAAS,UAAW;AAAA,EAC1B;AACA,WAAS,IAAI;AACf;","names":[]}

package/dist/adapters/hono.d.ts

@@ -0,0 +1,16 @@
+/** Any web-standard handler: `createSessionProxyHandler`, `createChatHandler`, or your own. */
+export type WebHandler = (request: Request) => Promise<Response>;
+/** The part of Hono's context this adapter uses (no Hono dependency). */
+export type HonoContextLike = {
+    req: {
+        raw: Request;
+    };
+};
+/**
+ * Expose a web-standard handler as a Hono handler:
+ *
+ * ```ts
+ * app.all("/api/opengeni/*", toHonoHandler(handler));
+ * ```
+ */
+export declare function toHonoHandler(handler: WebHandler): (context: HonoContextLike) => Promise<Response>;

package/dist/adapters/hono.js

@@ -0,0 +1,8 @@
+// src/adapters/hono.ts
+function toHonoHandler(handler) {
+  return async (context) => await handler(context.req.raw);
+}
+export {
+  toHonoHandler
+};
+//# sourceMappingURL=hono.js.map

package/dist/adapters/hono.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/adapters/hono.ts"],"sourcesContent":["/** Any web-standard handler: `createSessionProxyHandler`, `createChatHandler`, or your own. */\nexport type WebHandler = (request: Request) => Promise<Response>;\n\n/** The part of Hono's context this adapter uses (no Hono dependency). */\nexport type HonoContextLike = { req: { raw: Request } };\n\n/**\n * Expose a web-standard handler as a Hono handler:\n *\n * ```ts\n * app.all(\"/api/opengeni/*\", toHonoHandler(handler));\n * ```\n */\nexport function toHonoHandler(\n  handler: WebHandler,\n): (context: HonoContextLike) => Promise<Response> {\n  return async (context) => await handler(context.req.raw);\n}\n"],"mappings":";AAaO,SAAS,cACd,SACiD;AACjD,SAAO,OAAO,YAAY,MAAM,QAAQ,QAAQ,IAAI,GAAG;AACzD;","names":[]}

package/dist/adapters/next.d.ts

@@ -0,0 +1,29 @@
+import { createSessionProxyHandler, type SessionProxyHandlerOptions } from "../session-proxy.js";
+/** Any web-standard handler: `createSessionProxyHandler`, `createChatHandler`, or your own. */
+export type WebHandler = (request: Request) => Promise<Response>;
+/** Route handlers for a Next.js App Router catch-all route. */
+export type NextRouteHandlers = {
+    GET: WebHandler;
+    POST: WebHandler;
+    PUT: WebHandler;
+    PATCH: WebHandler;
+    DELETE: WebHandler;
+};
+/**
+ * Expose a web-standard handler as Next.js App Router route handlers.
+ *
+ * ```ts
+ * // app/api/opengeni/[...path]/route.ts
+ * export const dynamic = "force-dynamic";
+ * export const { GET, POST, PUT, PATCH, DELETE } = toNextRouteHandlers(handler);
+ * ```
+ *
+ * Next passes the full request URL (including any `basePath`), so the proxy's
+ * own `/v1/` detection routes it; responses, including SSE, stream as-is.
+ */
+export declare function toNextRouteHandlers(handler: WebHandler): NextRouteHandlers;
+/**
+ * `createSessionProxyHandler` as Next.js App Router route handlers, for
+ * `app/<mount>/[...path]/route.ts`.
+ */
+export declare function createSessionProxyRoute(target: Parameters<typeof createSessionProxyHandler>[0], options: SessionProxyHandlerOptions): NextRouteHandlers;

package/dist/adapters/next.js

@@ -0,0 +1,22 @@
+import {
+  createSessionProxyHandler
+} from "../chunk-6HZGAIUE.js";
+import "../chunk-UM4ZXXJR.js";
+import "../chunk-QGEIL4TR.js";
+import "../chunk-4AHR4KGA.js";
+import "../chunk-KADZ5PGG.js";
+import "../chunk-7EWT3PV6.js";
+
+// src/adapters/next.ts
+function toNextRouteHandlers(handler) {
+  const route = async (request) => await handler(request);
+  return { GET: route, POST: route, PUT: route, PATCH: route, DELETE: route };
+}
+function createSessionProxyRoute(target, options) {
+  return toNextRouteHandlers(createSessionProxyHandler(target, options));
+}
+export {
+  createSessionProxyRoute,
+  toNextRouteHandlers
+};
+//# sourceMappingURL=next.js.map

package/dist/adapters/next.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/adapters/next.ts"],"sourcesContent":["import { createSessionProxyHandler, type SessionProxyHandlerOptions } from \"../session-proxy\";\n\n/** Any web-standard handler: `createSessionProxyHandler`, `createChatHandler`, or your own. */\nexport type WebHandler = (request: Request) => Promise<Response>;\n\n/** Route handlers for a Next.js App Router catch-all route. */\nexport type NextRouteHandlers = {\n  GET: WebHandler;\n  POST: WebHandler;\n  PUT: WebHandler;\n  PATCH: WebHandler;\n  DELETE: WebHandler;\n};\n\n/**\n * Expose a web-standard handler as Next.js App Router route handlers.\n *\n * ```ts\n * // app/api/opengeni/[...path]/route.ts\n * export const dynamic = \"force-dynamic\";\n * export const { GET, POST, PUT, PATCH, DELETE } = toNextRouteHandlers(handler);\n * ```\n *\n * Next passes the full request URL (including any `basePath`), so the proxy's\n * own `/v1/` detection routes it; responses, including SSE, stream as-is.\n */\nexport function toNextRouteHandlers(handler: WebHandler): NextRouteHandlers {\n  // Next calls route handlers with (request, context); only the request matters.\n  const route: WebHandler = async (request) => await handler(request);\n  return { GET: route, POST: route, PUT: route, PATCH: route, DELETE: route };\n}\n\n/**\n * `createSessionProxyHandler` as Next.js App Router route handlers, for\n * `app/<mount>/[...path]/route.ts`.\n */\nexport function createSessionProxyRoute(\n  target: Parameters<typeof createSessionProxyHandler>[0],\n  options: SessionProxyHandlerOptions,\n): NextRouteHandlers {\n  return toNextRouteHandlers(createSessionProxyHandler(target, options));\n}\n"],"mappings":";;;;;;;;;;AA0BO,SAAS,oBAAoB,SAAwC;AAE1E,QAAM,QAAoB,OAAO,YAAY,MAAM,QAAQ,OAAO;AAClE,SAAO,EAAE,KAAK,OAAO,MAAM,OAAO,KAAK,OAAO,OAAO,OAAO,QAAQ,MAAM;AAC5E;AAMO,SAAS,wBACd,QACA,SACmB;AACnB,SAAO,oBAAoB,0BAA0B,QAAQ,OAAO,CAAC;AACvE;","names":[]}

package/dist/allowance-refusal.d.ts

@@ -0,0 +1,2 @@
+/** Browser-safe allowance presentation without exposing the server core. */
+export { allowanceExhaustedMessage, parseAllowanceExhaustedRefusal, } from "@opengeni/contracts/allowance-refusal";

package/dist/allowance-refusal.js

@@ -0,0 +1,50 @@
+// ../contracts/src/allowance-refusal.ts
+var MESSAGE_MAX_UTF8_BYTES = 1024;
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function resetTimestamp(value) {
+  if (value === null) return true;
+  if (typeof value !== "string" || value.length > 64) return false;
+  const parts = /^(\d{4})-(0[1-9]|1[0-2])-(0[1-9]|[12]\d|3[01])T(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$/.exec(
+    value
+  );
+  if (!parts || !Number.isFinite(Date.parse(value))) return false;
+  const year = Number(parts[1]);
+  const month = Number(parts[2]);
+  const day = Number(parts[3]);
+  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const days = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  return day <= days[month - 1];
+}
+function parseAllowanceExhaustedRefusal(value) {
+  const source = record(value);
+  if (source?.code !== "allowance_exhausted") return null;
+  const fields = record(source.details) ?? source;
+  const scope = fields.scope;
+  const subjectId = scope === "member" ? fields.subjectId : void 0;
+  if (typeof source.message !== "string" || scope !== "workspace" && scope !== "member" || !resetTimestamp(fields.resetsAt) || subjectId !== void 0 && (typeof subjectId !== "string" || subjectId.length === 0 || subjectId.length > 1024 || subjectId.includes("\0"))) {
+    return null;
+  }
+  const normalized = source.message.slice(0, MESSAGE_MAX_UTF8_BYTES * 2).replace(/[\u0000-\u001f\u007f]+/g, " ").trim();
+  const bytes = new TextEncoder().encode(normalized.slice(0, MESSAGE_MAX_UTF8_BYTES * 2));
+  let end = Math.min(bytes.length, MESSAGE_MAX_UTF8_BYTES);
+  while (end > 0 && end < bytes.length && (bytes[end] & 192) === 128) end -= 1;
+  return {
+    code: "allowance_exhausted",
+    scope,
+    resetsAt: fields.resetsAt,
+    ...typeof subjectId === "string" ? { subjectId } : {},
+    message: new TextDecoder().decode(bytes.slice(0, end)).trim()
+  };
+}
+function allowanceExhaustedMessage(refusal) {
+  const remedy = refusal.scope === "workspace" ? "The workspace usage allowance is exhausted. An organization administrator or a full-access organization API key can raise the workspace ceiling or add an allowance grant." : "The member usage allowance is exhausted. A workspace administrator or a full-access organization API key can adjust the member ceiling.";
+  const reset = refusal.resetsAt === null ? "This allowance has no automatic reset." : `It resets at ${new Date(refusal.resetsAt).toISOString().slice(0, 16).replace("T", " ")} UTC.`;
+  return `${remedy} ${reset}`;
+}
+export {
+  allowanceExhaustedMessage,
+  parseAllowanceExhaustedRefusal
+};
+//# sourceMappingURL=allowance-refusal.js.map

package/dist/allowance-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../contracts/src/allowance-refusal.ts"],"sourcesContent":["import type { AllowanceExhaustedRefusal } from \"./usage-allowances\";\n\nconst MESSAGE_MAX_UTF8_BYTES = 1_024;\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\n/** Mirror the canonical offset datetime's calendar/time bounds without loading\n * the schema runtime into synchronous browser/React Native session projection.\n * Contract-parity tests guard this deliberately small, bounded wire leaf.\n */\nfunction resetTimestamp(value: unknown): value is string | null {\n  if (value === null) return true;\n  if (typeof value !== \"string\" || value.length > 64) return false;\n  const parts =\n    /^(\\d{4})-(0[1-9]|1[0-2])-(0[1-9]|[12]\\d|3[01])T(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z|[+-](?:[01]\\d|2[0-3]):[0-5]\\d)$/.exec(\n      value,\n    );\n  if (!parts || !Number.isFinite(Date.parse(value))) return false;\n  const year = Number(parts[1]);\n  const month = Number(parts[2]);\n  const day = Number(parts[3]);\n  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);\n  const days = [31, leapYear ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];\n  return day <= days[month - 1]!;\n}\n\n/** Select only public refusal fields, including from an API error's details.\n * LimitDecision's allowed:false and transport/SQL diagnostics never cross out.\n */\nexport function parseAllowanceExhaustedRefusal(value: unknown): AllowanceExhaustedRefusal | null {\n  const source = record(value);\n  if (source?.code !== \"allowance_exhausted\") return null;\n  const fields = record(source.details) ?? source;\n  const scope = fields.scope;\n  const subjectId = scope === \"member\" ? fields.subjectId : undefined;\n  if (\n    typeof source.message !== \"string\" ||\n    (scope !== \"workspace\" && scope !== \"member\") ||\n    !resetTimestamp(fields.resetsAt) ||\n    (subjectId !== undefined &&\n      (typeof subjectId !== \"string\" ||\n        subjectId.length === 0 ||\n        subjectId.length > 1_024 ||\n        subjectId.includes(\"\\0\")))\n  ) {\n    return null;\n  }\n  const normalized = source.message\n    .slice(0, MESSAGE_MAX_UTF8_BYTES * 2)\n    .replace(/[\\u0000-\\u001f\\u007f]+/g, \" \")\n    .trim();\n  const bytes = new TextEncoder().encode(normalized.slice(0, MESSAGE_MAX_UTF8_BYTES * 2));\n  let end = Math.min(bytes.length, MESSAGE_MAX_UTF8_BYTES);\n  while (end > 0 && end < bytes.length && (bytes[end]! & 0xc0) === 0x80) end -= 1;\n  return {\n    code: \"allowance_exhausted\",\n    scope,\n    resetsAt: fields.resetsAt,\n    ...(typeof subjectId === \"string\" ? { subjectId } : {}),\n    message: new TextDecoder().decode(bytes.slice(0, end)).trim(),\n  };\n}\n\n/** Bounded, fixed remedies: a ceiling is not an exhausted billing source.\n * Never interpolate arbitrary exception prose or a member identifier.\n */\nexport function allowanceExhaustedMessage(refusal: AllowanceExhaustedRefusal): string {\n  const remedy =\n    refusal.scope === \"workspace\"\n      ? \"The workspace usage allowance is exhausted. An organization administrator or a full-access organization API key can raise the workspace ceiling or add an allowance grant.\"\n      : \"The member usage allowance is exhausted. A workspace administrator or a full-access organization API key can adjust the member ceiling.\";\n  const reset =\n    refusal.resetsAt === null\n      ? \"This allowance has no automatic reset.\"\n      : `It resets at ${new Date(refusal.resetsAt).toISOString().slice(0, 16).replace(\"T\", \" \")} UTC.`;\n  return `${remedy} ${reset}`;\n}\n"],"mappings":";AAEA,IAAM,yBAAyB;AAE/B,SAAS,OAAO,OAAgD;AAC9D,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD;AACN;AAMA,SAAS,eAAe,OAAwC;AAC9D,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAI,QAAO;AAC3D,QAAM,QACJ,sIAAsI;AAAA,IACpI;AAAA,EACF;AACF,MAAI,CAAC,SAAS,CAAC,OAAO,SAAS,KAAK,MAAM,KAAK,CAAC,EAAG,QAAO;AAC1D,QAAM,OAAO,OAAO,MAAM,CAAC,CAAC;AAC5B,QAAM,QAAQ,OAAO,MAAM,CAAC,CAAC;AAC7B,QAAM,MAAM,OAAO,MAAM,CAAC,CAAC;AAC3B,QAAM,WAAW,OAAO,MAAM,MAAM,OAAO,QAAQ,KAAK,OAAO,QAAQ;AACvE,QAAM,OAAO,CAAC,IAAI,WAAW,KAAK,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;AAC5E,SAAO,OAAO,KAAK,QAAQ,CAAC;AAC9B;AAKO,SAAS,+BAA+B,OAAkD;AAC/F,QAAM,SAAS,OAAO,KAAK;AAC3B,MAAI,QAAQ,SAAS,sBAAuB,QAAO;AACnD,QAAM,SAAS,OAAO,OAAO,OAAO,KAAK;AACzC,QAAM,QAAQ,OAAO;AACrB,QAAM,YAAY,UAAU,WAAW,OAAO,YAAY;AAC1D,MACE,OAAO,OAAO,YAAY,YACzB,UAAU,eAAe,UAAU,YACpC,CAAC,eAAe,OAAO,QAAQ,KAC9B,cAAc,WACZ,OAAO,cAAc,YACpB,UAAU,WAAW,KACrB,UAAU,SAAS,QACnB,UAAU,SAAS,IAAI,IAC3B;AACA,WAAO;AAAA,EACT;AACA,QAAM,aAAa,OAAO,QACvB,MAAM,GAAG,yBAAyB,CAAC,EACnC,QAAQ,2BAA2B,GAAG,EACtC,KAAK;AACR,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,WAAW,MAAM,GAAG,yBAAyB,CAAC,CAAC;AACtF,MAAI,MAAM,KAAK,IAAI,MAAM,QAAQ,sBAAsB;AACvD,SAAO,MAAM,KAAK,MAAM,MAAM,WAAW,MAAM,GAAG,IAAK,SAAU,IAAM,QAAO;AAC9E,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA,UAAU,OAAO;AAAA,IACjB,GAAI,OAAO,cAAc,WAAW,EAAE,UAAU,IAAI,CAAC;AAAA,IACrD,SAAS,IAAI,YAAY,EAAE,OAAO,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,KAAK;AAAA,EAC9D;AACF;AAKO,SAAS,0BAA0B,SAA4C;AACpF,QAAM,SACJ,QAAQ,UAAU,cACd,+KACA;AACN,QAAM,QACJ,QAAQ,aAAa,OACjB,2CACA,gBAAgB,IAAI,KAAK,QAAQ,QAAQ,EAAE,YAAY,EAAE,MAAM,GAAG,EAAE,EAAE,QAAQ,KAAK,GAAG,CAAC;AAC7F,SAAO,GAAG,MAAM,IAAI,KAAK;AAC3B;","names":[]}

package/dist/app-links.d.ts

@@ -0,0 +1,42 @@
+/** A deployment address as typed: trimmed, https by default, no trailing slash. */
+export declare function normalizeServerUrl(input: string): string | null;
+/** The host a person recognizes, e.g. app.opengeni.ai. */
+export declare function serverLabel(baseUrl: string): string;
+/** The part of a signed-in app account that link routing reads. */
+export interface AppLinkAccount {
+    id: string;
+    /** The deployment's web origin, e.g. https://app.opengeni.ai. */
+    baseUrl: string;
+    /** The workspace last used with this account. */
+    workspaceId: string | null;
+    /** Set when the deployment rejected the credential. */
+    signedOut?: boolean;
+}
+/**
+ * A web link the app can show itself: a conversation or a workspace on some
+ * deployment. Everything else on the web (settings, organization, artifacts)
+ * stays in the browser.
+ */
+export interface AppLink {
+    /** The deployment's origin, normalized like a stored account's baseUrl. */
+    origin: string;
+    /** Absent for the web's workspace-less `/sessions/:id` links. */
+    workspaceId: string | null;
+    /** Absent for a link to the workspace itself. */
+    sessionId: string | null;
+    /** The session moment the link points at (`?at=`). */
+    at: number | null;
+    /** The web address the link came from, for the browser fallback. */
+    webUrl: string;
+}
+/** The web link a raw URL points at, unwrapping the web's "Open in app" handoff. */
+export declare function parseAppLink(raw: string): AppLink | null;
+/**
+ * The signed-in account a link belongs to, or null when the app has none on
+ * that deployment (the browser opens it instead). With several accounts on the
+ * same deployment: the one last used in the link's workspace, else the active
+ * one, else the first.
+ */
+export declare function accountForAppLink<Account extends AppLinkAccount>(link: AppLink, accounts: readonly Account[], activeId: string | null): Account | null;
+/** The web's handoff link that opens a web page in the app. */
+export declare function appHandoffUrl(webUrl: string): string;

package/dist/app-links.js

@@ -0,0 +1,66 @@
+// src/app-links.ts
+function normalizeServerUrl(input) {
+  const raw = input.trim();
+  if (!raw) return null;
+  const withScheme = /^[a-z][a-z0-9+.-]*:\/\//iu.test(raw) ? raw : `https://${raw}`;
+  const match = /^(https?):\/\/([a-z0-9.-]+(?::\d{1,5})?)(?:[/?#].*)?$/iu.exec(withScheme);
+  return match ? `${match[1].toLowerCase()}://${match[2].toLowerCase()}` : null;
+}
+function serverLabel(baseUrl) {
+  return baseUrl.replace(/^https?:\/\//iu, "");
+}
+var HANDOFF = /^opengeni:\/\/open\/?\?(.*)$/iu;
+var WEB_URL = /^(https?:\/\/[^/?#]+)(\/[^?#]*)?(\?[^#]*)?(#.*)?$/iu;
+var ID = "([A-Za-z0-9][A-Za-z0-9_-]{0,127})";
+var SESSION_PATH = new RegExp(`^/workspaces/${ID}/sessions/${ID}/?$`, "u");
+var WORKSPACE_PATH = new RegExp(`^/workspaces/${ID}(?:/sessions)?/?$`, "u");
+var BARE_SESSION_PATH = new RegExp(`^/sessions/${ID}/?$`, "u");
+function queryParam(query, name) {
+  for (const part of (query ?? "").replace(/^\?/u, "").split("&")) {
+    const [key, value = ""] = part.split("=");
+    if (key !== name) continue;
+    try {
+      return decodeURIComponent(value.replace(/\+/gu, " "));
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function parseAppLink(raw) {
+  const trimmed = raw.trim();
+  const handoff = HANDOFF.exec(trimmed);
+  const webUrl = handoff ? queryParam(handoff[1], "url") : trimmed;
+  if (!webUrl) return null;
+  const match = WEB_URL.exec(webUrl);
+  if (!match) return null;
+  const origin = normalizeServerUrl(match[1]);
+  if (!origin) return null;
+  const path = match[2] ?? "/";
+  const atRaw = queryParam(match[3], "at");
+  const at = atRaw && /^[1-9][0-9]{0,15}$/u.test(atRaw) ? Number(atRaw) : null;
+  const session = SESSION_PATH.exec(path);
+  if (session) return { origin, workspaceId: session[1], sessionId: session[2], at, webUrl };
+  const bare = BARE_SESSION_PATH.exec(path);
+  if (bare) return { origin, workspaceId: null, sessionId: bare[1], at, webUrl };
+  const workspace = WORKSPACE_PATH.exec(path);
+  if (workspace) return { origin, workspaceId: workspace[1], sessionId: null, at: null, webUrl };
+  return null;
+}
+function accountForAppLink(link, accounts, activeId) {
+  const candidates = accounts.filter(
+    (account) => !account.signedOut && normalizeServerUrl(account.baseUrl) === link.origin
+  );
+  return (link.workspaceId ? candidates.find((account) => account.workspaceId === link.workspaceId) : void 0) ?? candidates.find((account) => account.id === activeId) ?? candidates[0] ?? null;
+}
+function appHandoffUrl(webUrl) {
+  return `opengeni://open?url=${encodeURIComponent(webUrl)}`;
+}
+export {
+  accountForAppLink,
+  appHandoffUrl,
+  normalizeServerUrl,
+  parseAppLink,
+  serverLabel
+};
+//# sourceMappingURL=app-links.js.map

package/dist/app-links.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/app-links.ts"],"sourcesContent":["// Opengeni web links that a native app (phone or desktop) can show itself, and\n// the account each belongs to. Pure: no platform modules, so every app shares it.\n\n/** A deployment address as typed: trimmed, https by default, no trailing slash. */\nexport function normalizeServerUrl(input: string): string | null {\n  const raw = input.trim();\n  if (!raw) return null;\n  const withScheme = /^[a-z][a-z0-9+.-]*:\\/\\//iu.test(raw) ? raw : `https://${raw}`;\n  const match = /^(https?):\\/\\/([a-z0-9.-]+(?::\\d{1,5})?)(?:[/?#].*)?$/iu.exec(withScheme);\n  return match ? `${match[1]!.toLowerCase()}://${match[2]!.toLowerCase()}` : null;\n}\n\n/** The host a person recognizes, e.g. app.opengeni.ai. */\nexport function serverLabel(baseUrl: string): string {\n  return baseUrl.replace(/^https?:\\/\\//iu, \"\");\n}\n\n/** The part of a signed-in app account that link routing reads. */\nexport interface AppLinkAccount {\n  id: string;\n  /** The deployment's web origin, e.g. https://app.opengeni.ai. */\n  baseUrl: string;\n  /** The workspace last used with this account. */\n  workspaceId: string | null;\n  /** Set when the deployment rejected the credential. */\n  signedOut?: boolean;\n}\n\n/**\n * A web link the app can show itself: a conversation or a workspace on some\n * deployment. Everything else on the web (settings, organization, artifacts)\n * stays in the browser.\n */\nexport interface AppLink {\n  /** The deployment's origin, normalized like a stored account's baseUrl. */\n  origin: string;\n  /** Absent for the web's workspace-less `/sessions/:id` links. */\n  workspaceId: string | null;\n  /** Absent for a link to the workspace itself. */\n  sessionId: string | null;\n  /** The session moment the link points at (`?at=`). */\n  at: number | null;\n  /** The web address the link came from, for the browser fallback. */\n  webUrl: string;\n}\n\n/** The app's own scheme for links handed over from the web: opengeni://open?url=… */\nconst HANDOFF = /^opengeni:\\/\\/open\\/?\\?(.*)$/iu;\nconst WEB_URL = /^(https?:\\/\\/[^/?#]+)(\\/[^?#]*)?(\\?[^#]*)?(#.*)?$/iu;\nconst ID = \"([A-Za-z0-9][A-Za-z0-9_-]{0,127})\";\nconst SESSION_PATH = new RegExp(`^/workspaces/${ID}/sessions/${ID}/?$`, \"u\");\nconst WORKSPACE_PATH = new RegExp(`^/workspaces/${ID}(?:/sessions)?/?$`, \"u\");\nconst BARE_SESSION_PATH = new RegExp(`^/sessions/${ID}/?$`, \"u\");\n\nfunction queryParam(query: string | undefined, name: string): string | null {\n  for (const part of (query ?? \"\").replace(/^\\?/u, \"\").split(\"&\")) {\n    const [key, value = \"\"] = part.split(\"=\");\n    if (key !== name) continue;\n    try {\n      return decodeURIComponent(value.replace(/\\+/gu, \" \"));\n    } catch {\n      return null;\n    }\n  }\n  return null;\n}\n\n/** The web link a raw URL points at, unwrapping the web's \"Open in app\" handoff. */\nexport function parseAppLink(raw: string): AppLink | null {\n  const trimmed = raw.trim();\n  const handoff = HANDOFF.exec(trimmed);\n  const webUrl = handoff ? queryParam(handoff[1], \"url\") : trimmed;\n  if (!webUrl) return null;\n  const match = WEB_URL.exec(webUrl);\n  if (!match) return null;\n  const origin = normalizeServerUrl(match[1]!);\n  if (!origin) return null;\n  const path = match[2] ?? \"/\";\n  const atRaw = queryParam(match[3], \"at\");\n  const at = atRaw && /^[1-9][0-9]{0,15}$/u.test(atRaw) ? Number(atRaw) : null;\n  const session = SESSION_PATH.exec(path);\n  if (session) return { origin, workspaceId: session[1]!, sessionId: session[2]!, at, webUrl };\n  const bare = BARE_SESSION_PATH.exec(path);\n  if (bare) return { origin, workspaceId: null, sessionId: bare[1]!, at, webUrl };\n  const workspace = WORKSPACE_PATH.exec(path);\n  if (workspace) return { origin, workspaceId: workspace[1]!, sessionId: null, at: null, webUrl };\n  return null;\n}\n\n/**\n * The signed-in account a link belongs to, or null when the app has none on\n * that deployment (the browser opens it instead). With several accounts on the\n * same deployment: the one last used in the link's workspace, else the active\n * one, else the first.\n */\nexport function accountForAppLink<Account extends AppLinkAccount>(\n  link: AppLink,\n  accounts: readonly Account[],\n  activeId: string | null,\n): Account | null {\n  const candidates = accounts.filter(\n    (account) => !account.signedOut && normalizeServerUrl(account.baseUrl) === link.origin,\n  );\n  return (\n    (link.workspaceId\n      ? candidates.find((account) => account.workspaceId === link.workspaceId)\n      : undefined) ??\n    candidates.find((account) => account.id === activeId) ??\n    candidates[0] ??\n    null\n  );\n}\n\n/** The web's handoff link that opens a web page in the app. */\nexport function appHandoffUrl(webUrl: string): string {\n  return `opengeni://open?url=${encodeURIComponent(webUrl)}`;\n}\n"],"mappings":";AAIO,SAAS,mBAAmB,OAA8B;AAC/D,QAAM,MAAM,MAAM,KAAK;AACvB,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,aAAa,4BAA4B,KAAK,GAAG,IAAI,MAAM,WAAW,GAAG;AAC/E,QAAM,QAAQ,0DAA0D,KAAK,UAAU;AACvF,SAAO,QAAQ,GAAG,MAAM,CAAC,EAAG,YAAY,CAAC,MAAM,MAAM,CAAC,EAAG,YAAY,CAAC,KAAK;AAC7E;AAGO,SAAS,YAAY,SAAyB;AACnD,SAAO,QAAQ,QAAQ,kBAAkB,EAAE;AAC7C;AAgCA,IAAM,UAAU;AAChB,IAAM,UAAU;AAChB,IAAM,KAAK;AACX,IAAM,eAAe,IAAI,OAAO,gBAAgB,EAAE,aAAa,EAAE,OAAO,GAAG;AAC3E,IAAM,iBAAiB,IAAI,OAAO,gBAAgB,EAAE,qBAAqB,GAAG;AAC5E,IAAM,oBAAoB,IAAI,OAAO,cAAc,EAAE,OAAO,GAAG;AAE/D,SAAS,WAAW,OAA2B,MAA6B;AAC1E,aAAW,SAAS,SAAS,IAAI,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,GAAG;AAC/D,UAAM,CAAC,KAAK,QAAQ,EAAE,IAAI,KAAK,MAAM,GAAG;AACxC,QAAI,QAAQ,KAAM;AAClB,QAAI;AACF,aAAO,mBAAmB,MAAM,QAAQ,QAAQ,GAAG,CAAC;AAAA,IACtD,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,aAAa,KAA6B;AACxD,QAAM,UAAU,IAAI,KAAK;AACzB,QAAM,UAAU,QAAQ,KAAK,OAAO;AACpC,QAAM,SAAS,UAAU,WAAW,QAAQ,CAAC,GAAG,KAAK,IAAI;AACzD,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,QAAQ,KAAK,MAAM;AACjC,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAS,mBAAmB,MAAM,CAAC,CAAE;AAC3C,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,OAAO,MAAM,CAAC,KAAK;AACzB,QAAM,QAAQ,WAAW,MAAM,CAAC,GAAG,IAAI;AACvC,QAAM,KAAK,SAAS,sBAAsB,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;AACxE,QAAM,UAAU,aAAa,KAAK,IAAI;AACtC,MAAI,QAAS,QAAO,EAAE,QAAQ,aAAa,QAAQ,CAAC,GAAI,WAAW,QAAQ,CAAC,GAAI,IAAI,OAAO;AAC3F,QAAM,OAAO,kBAAkB,KAAK,IAAI;AACxC,MAAI,KAAM,QAAO,EAAE,QAAQ,aAAa,MAAM,WAAW,KAAK,CAAC,GAAI,IAAI,OAAO;AAC9E,QAAM,YAAY,eAAe,KAAK,IAAI;AAC1C,MAAI,UAAW,QAAO,EAAE,QAAQ,aAAa,UAAU,CAAC,GAAI,WAAW,MAAM,IAAI,MAAM,OAAO;AAC9F,SAAO;AACT;AAQO,SAAS,kBACd,MACA,UACA,UACgB;AAChB,QAAM,aAAa,SAAS;AAAA,IAC1B,CAAC,YAAY,CAAC,QAAQ,aAAa,mBAAmB,QAAQ,OAAO,MAAM,KAAK;AAAA,EAClF;AACA,UACG,KAAK,cACF,WAAW,KAAK,CAAC,YAAY,QAAQ,gBAAgB,KAAK,WAAW,IACrE,WACJ,WAAW,KAAK,CAAC,YAAY,QAAQ,OAAO,QAAQ,KACpD,WAAW,CAAC,KACZ;AAEJ;AAGO,SAAS,cAAc,QAAwB;AACpD,SAAO,uBAAuB,mBAAmB,MAAM,CAAC;AAC1D;","names":[]}