@opengeni/sdk 3.1.0 → 3.3.2-canary.0

package/README.md

@@ -5,13 +5,18 @@ session lifecycle, and the streaming core — SSE event streaming with automatic
 reconnect, resume-by-sequence, gap backfill, and duplicate suppression — plus
 helpers for proxying the stream through your own API.
 
+For the complete product boundary—organization API keys, organization
+workspaces, Personal-workspace exclusion, tenant mapping, and external Skill
+ownership—start with the canonical
+[product integration guide](../../docs/product-integration.md).
+
 Zero runtime dependencies. Needs only WHATWG `fetch` and streams, so it runs in
 Node 18+, Bun, Deno, browsers, and edge runtimes.
 
-Browser clients may call the public API from any origin with an API key or
-other bearer credential. Browser cookies are accepted cross-origin only from
-operator-configured trusted origins; arbitrary embedding origins never receive
-credentialed CORS responses.
+Browser clients may call the public API from any origin with an explicitly safe
+bearer design, but an organization API key belongs on the product server.
+Browser cookies are accepted cross-origin only from operator-configured trusted
+origins; arbitrary embedding origins never receive credentialed CORS responses.
 
 ## Quick start
 
@@ -37,6 +42,53 @@ for await (const event of client.streamEvents(workspaceId, session.id)) {
 }
 ```
 
+## Organization-backed product setup
+
+A multi-tenant product should hold one organization API key on its backend and
+idempotently map each product tenant to an OpenGeni organization workspace. The
+wire kind for an organization workspace is `"shared"`; Personal workspaces are
+excluded.
+
+```ts
+const client = new OpenGeniClient({
+  baseUrl: process.env.OPENGENI_API_BASE_URL!,
+  apiKey: process.env.OPENGENI_ORGANIZATION_API_KEY!,
+});
+
+const organizationId = process.env.OPENGENI_ORGANIZATION_ID!;
+const { workspace, created } = await client.ensureWorkspace({
+  accountId: organizationId,
+  externalSource: "acme-product",
+  externalId: tenant.id,
+  name: tenant.displayName,
+});
+
+if (workspace.kind !== "shared") {
+  throw new Error("Product integrations require an organization workspace");
+}
+```
+
+The response is `{ workspace, created }`. Replays return the original nested
+workspace with `created: false`. For an organization key, `getAccessContext()`
+does not enumerate every workspace grant; call `listWorkspaces()` for the
+complete organization-workspace inventory.
+
+Organization key administration uses `listOrganizationApiKeys`,
+`createOrganizationApiKey`, and `deleteOrganizationApiKey`. The key token from a
+create response is shown once and must be stored in the backend's secret
+manager.
+
+The external backend also owns its Skill catalog. Load the selected definitions
+and pass them inline in `CreateSessionRequest.skills` for each product-created
+session. There is no organization-wide Skill registry or Skill inheritance in
+this integration contract. See the canonical guide for the complete route map,
+security boundary, and delivery checklist.
+
+For session lists, `deriveSessionDisplayTitle(session)` returns the durable
+agent/user title when available. While the automatic title is still pending, it
+shows a short, sensitive-safe preview of the opening prompt and automatically
+yields to the later `session.title_set` value.
+
 Browser consoles that do not need operator-only surfaces can import
 `OpenGeniBrowserClient` from `@opengeni/sdk/browser`. Document authority migration
 and Default-collection backfill methods stay available on the backward-compatible
@@ -695,7 +747,7 @@ Every public endpoint group has typed methods:
 
 | Group | Methods |
 | --- | --- |
-| Access + workspaces | `getAccessContext`, `listWorkspaces`, `createWorkspace`, `getWorkspace`, `updateWorkspace` |
+| Access + workspaces | `getAccessContext`, `listWorkspaces`, `createWorkspace`, `ensureWorkspace`, `getWorkspace`, `updateWorkspace` |
 | Sessions + events | `createSession`, `listSessions`, `listSessionPage`, `listAgentTopology`, `getSession`, `getSessionLineage`, `updateSession`, `listEvents`, `sendEvent`, `sendMessage`, `steerMessage`, `pauseSession`, `resumeSession`, `cancelSession`, `sendApprovalDecision`, `streamEvents`, `openEventStream` |
 | Machines (bring-your-own-compute) | `listMachines`, `machineMetricsSeries`, `swapActiveSandbox`, `mintEnrollToken`, `lookupDeviceEnrollment`, `approveDeviceEnrollment`, `denyDeviceEnrollment` |
 | Turn queue | `getQueue`, `moveQueueItem`, `editQueueItem`, `steerQueueItem`, `deleteQueueItem` |
@@ -710,7 +762,7 @@ Every public endpoint group has typed methods:
 | API Integrations | `listIntegrationDefinitions`, `listApiIntegrations`, `previewApiIntegration`, `startApiIntegrationOAuth`, `installApiIntegration`, `previewApiIntegrationUninstall`, `uninstallApiIntegration`, `listIntegrationFacets`, `configureIntegrationFacet`, `pauseIntegrationFacet`, `resumeIntegrationFacet`, `removeIntegrationFacet`, `browseGoogleDriveFacetSource`, `saveGoogleDriveFacetSource` |
 | Remote Skills | `previewSkillImport`, `installSkill`, `previewSkillUninstall`, `uninstallSkill` |
 | GitHub | `getGitHubApp`, `githubConnectUrl`, `listGitHubRepositories`, `syncGitHubRepositories`, `createGitHubAppManifest` |
-| API keys | `listApiKeys`, `createApiKey`, `deleteApiKey` |
+| API keys | Workspace: `listApiKeys`, `createApiKey`, `deleteApiKey`; organization: `listOrganizationApiKeys`, `createOrganizationApiKey`, `deleteOrganizationApiKey` |
 | Billing | `getBilling`, `getBillingUsage`, `getBillingEntitlements`, `createBillingCheckout`, `createBillingPortalSession` |
 
 `listIntegrationDefinitions` returns safe Integration Definition metadata without any
@@ -751,8 +803,8 @@ readers. Official server builds expose `serverVersion` on `/healthz` and
 
 ## Proxy through your own API
 
-Keep your OpenGeni API key on your server and re-emit the stream to your own
-browser clients. The re-emitted wire format is identical to OpenGeni's SSE
+Keep your organization API key on your server and re-emit the stream to your
+own browser clients. The re-emitted wire format is identical to OpenGeni's SSE
 stream, so the browser side can consume it with this same SDK (or a plain
 `EventSource`), including resume via `?after=` / `Last-Event-ID`:
 

package/dist/accounts.d.ts

@@ -1,4 +1,4 @@
-import { type BeginManagedAuthLoginTransactionRequest as BeginManagedAuthLoginTransactionRequestType, type BootstrapManagedAuthSessionSetRequest as BootstrapManagedAuthSessionSetRequestType, type CancelManagedAuthLoginTransactionRequest as CancelManagedAuthLoginTransactionRequestType, type CompleteManagedAuthEmailPasswordTransactionRequest as CompleteManagedAuthEmailPasswordTransactionRequestType, type CompleteManagedAuthLoginTransactionResponse as CompleteManagedAuthLoginTransactionResponseType, type LogoutManagedAuthLoginSlotRequest as LogoutManagedAuthLoginSlotRequestType, type LogoutManagedAuthSessionSetRequest as LogoutManagedAuthSessionSetRequestType, type ManagedAuthDeepLinkResolution as ManagedAuthDeepLinkResolutionType, type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType, type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType, type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType, type ResolveManagedAuthDeepLinkRequest as ResolveManagedAuthDeepLinkRequestType, type SelectManagedAuthLoginSlotRequest as SelectManagedAuthLoginSlotRequestType } from "@opengeni/contracts/managed-auth-session-sets";
+import { type BeginManagedAuthLoginTransactionRequest as BeginManagedAuthLoginTransactionRequestType, type BootstrapManagedAuthSessionSetRequest as BootstrapManagedAuthSessionSetRequestType, type CancelManagedAuthLoginTransactionRequest as CancelManagedAuthLoginTransactionRequestType, type CompleteManagedAuthEmailPasswordTransactionRequest as CompleteManagedAuthEmailPasswordTransactionRequestType, type CompleteManagedAuthLoginTransactionResponse as CompleteManagedAuthLoginTransactionResponseType, type LogoutManagedAuthLoginSlotRequest as LogoutManagedAuthLoginSlotRequestType, type LogoutManagedAuthSessionSetRequest as LogoutManagedAuthSessionSetRequestType, type ManagedAuthDeepLinkResolution as ManagedAuthDeepLinkResolutionType, type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType, type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType, type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType, type ResolveManagedAuthDeepLinkRequest as ResolveManagedAuthDeepLinkRequestType, type SelectManagedAuthLoginSlotRequest as SelectManagedAuthLoginSlotRequestType, type StartManagedAuthSocialTransactionRequest as StartManagedAuthSocialTransactionRequestType, type StartManagedAuthSocialTransactionResponse as StartManagedAuthSocialTransactionResponseType } from "@opengeni/contracts/managed-auth-session-sets";
 export type BrowserAccountsFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
 export type BrowserAccountsClientOptions = {
     baseUrl: string;
@@ -10,6 +10,7 @@ export interface BrowserAccountsClientLike {
     bootstrapSessionSet(request: BootstrapManagedAuthSessionSetRequestType): Promise<ManagedAuthSessionSetProjectionType>;
     beginLoginTransaction(request: BeginManagedAuthLoginTransactionRequestType): Promise<ManagedAuthLoginTransactionType>;
     completeEmailPasswordTransaction(request: CompleteManagedAuthEmailPasswordTransactionRequestType): Promise<CompleteManagedAuthLoginTransactionResponseType>;
+    startSocialTransaction?(request: StartManagedAuthSocialTransactionRequestType): Promise<StartManagedAuthSocialTransactionResponseType>;
     cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType): Promise<ManagedAuthSessionSetProjectionType>;
     selectLoginSlot(request: SelectManagedAuthLoginSlotRequestType): Promise<ManagedAuthSessionSetProjectionType>;
     logoutLoginSlot(request: LogoutManagedAuthLoginSlotRequestType): Promise<ManagedAuthSessionSetProjectionType>;
@@ -72,6 +73,9 @@ export declare class BrowserAccountsClient implements BrowserAccountsClientLike
         };
         returnIntent: string | null;
     }>;
+    startSocialTransaction(request: StartManagedAuthSocialTransactionRequestType): Promise<{
+        url: string;
+    }>;
     cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType): Promise<{
         mode: "broker" | "dual" | "legacy";
         generation: string;

package/dist/accounts.js

@@ -15,7 +15,9 @@ import {
   ManagedAuthSessionSetProjection,
   ManagedAuthSessionSetErrorCode,
   ResolveManagedAuthDeepLinkRequest,
-  SelectManagedAuthLoginSlotRequest
+  SelectManagedAuthLoginSlotRequest,
+  StartManagedAuthSocialTransactionRequest,
+  StartManagedAuthSocialTransactionResponse
 } from "@opengeni/contracts/managed-auth-session-sets";
 var BrowserAccountsApiError = class extends Error {
   constructor(status, code, options) {
@@ -105,6 +107,16 @@ var BrowserAccountsClient = class {
     }
     return response;
   }
+  async startSocialTransaction(request) {
+    return StartManagedAuthSocialTransactionResponse.parse(
+      await this.#mutation(
+        "POST",
+        "/v1/auth/session-set/transactions/social",
+        StartManagedAuthSocialTransactionRequest,
+        request
+      )
+    );
+  }
   async cancelLoginTransaction(request) {
     return this.#projectionResponse(
       "DELETE",

package/dist/accounts.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/accounts.ts"],"sourcesContent":["import {\n  BeginManagedAuthLoginTransactionRequest,\n  BootstrapManagedAuthSessionSetRequest,\n  CancelManagedAuthLoginTransactionRequest,\n  CompleteManagedAuthEmailPasswordTransactionRequest,\n  CompleteManagedAuthLoginTransactionResponse,\n  LogoutManagedAuthLoginSlotRequest,\n  LogoutManagedAuthSessionSetRequest,\n  MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER,\n  MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,\n  ManagedAuthDeepLinkResolution,\n  ManagedAuthLoginTransaction,\n  ManagedAuthLogoutAllReceipt,\n  ManagedAuthSessionSetProjection,\n  ManagedAuthSessionSetErrorCode,\n  ResolveManagedAuthDeepLinkRequest,\n  SelectManagedAuthLoginSlotRequest,\n  type BeginManagedAuthLoginTransactionRequest as BeginManagedAuthLoginTransactionRequestType,\n  type BootstrapManagedAuthSessionSetRequest as BootstrapManagedAuthSessionSetRequestType,\n  type CancelManagedAuthLoginTransactionRequest as CancelManagedAuthLoginTransactionRequestType,\n  type CompleteManagedAuthEmailPasswordTransactionRequest as CompleteManagedAuthEmailPasswordTransactionRequestType,\n  type CompleteManagedAuthLoginTransactionResponse as CompleteManagedAuthLoginTransactionResponseType,\n  type LogoutManagedAuthLoginSlotRequest as LogoutManagedAuthLoginSlotRequestType,\n  type LogoutManagedAuthSessionSetRequest as LogoutManagedAuthSessionSetRequestType,\n  type ManagedAuthDeepLinkResolution as ManagedAuthDeepLinkResolutionType,\n  type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType,\n  type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType,\n  type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType,\n  type ResolveManagedAuthDeepLinkRequest as ResolveManagedAuthDeepLinkRequestType,\n  type SelectManagedAuthLoginSlotRequest as SelectManagedAuthLoginSlotRequestType,\n} from \"@opengeni/contracts/managed-auth-session-sets\";\nimport type { z } from \"zod\";\n\nexport type BrowserAccountsFetch = (\n  input: string | URL | Request,\n  init?: RequestInit,\n) => Promise<Response>;\n\nexport type BrowserAccountsClientOptions = {\n  baseUrl: string;\n  fetch?: BrowserAccountsFetch;\n};\n\nexport interface BrowserAccountsClientLike {\n  getSessionSet(): Promise<ManagedAuthSessionSetProjectionType>;\n  reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType>;\n  bootstrapSessionSet(\n    request: BootstrapManagedAuthSessionSetRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  beginLoginTransaction(\n    request: BeginManagedAuthLoginTransactionRequestType,\n  ): Promise<ManagedAuthLoginTransactionType>;\n  completeEmailPasswordTransaction(\n    request: CompleteManagedAuthEmailPasswordTransactionRequestType,\n  ): Promise<CompleteManagedAuthLoginTransactionResponseType>;\n  cancelLoginTransaction(\n    request: CancelManagedAuthLoginTransactionRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  selectLoginSlot(\n    request: SelectManagedAuthLoginSlotRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  logoutLoginSlot(\n    request: LogoutManagedAuthLoginSlotRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  logoutSessionSet(\n    request: LogoutManagedAuthSessionSetRequestType,\n  ): Promise<ManagedAuthLogoutAllReceiptType>;\n  resolveDeepLink(\n    request: ResolveManagedAuthDeepLinkRequestType,\n  ): Promise<ManagedAuthDeepLinkResolutionType>;\n}\n\nexport class BrowserAccountsApiError extends Error {\n  readonly name = \"BrowserAccountsApiError\";\n  constructor(\n    readonly status: number,\n    readonly code: string,\n    options?: { cause?: unknown },\n  ) {\n    super(code, options?.cause === undefined ? undefined : { cause: options.cause });\n  }\n}\n\nexport class BrowserAccountsClient implements BrowserAccountsClientLike {\n  readonly #baseUrl: string;\n  readonly #fetch: BrowserAccountsFetch;\n  // CSRF is generation-bound. Exact idempotent replay must retain the\n  // admission envelope even after an authority reread observes a newer clock.\n  readonly #mutationAdmissions = new Map<\n    string,\n    { signature: string; csrfToken: string; actorEpoch: string }\n  >();\n  #projection: ManagedAuthSessionSetProjectionType | null = null;\n  #authorityReadEpoch = 0;\n  #authorityResetPending = false;\n  #authorityReconciliation: Promise<ManagedAuthSessionSetProjectionType> | null = null;\n\n  constructor(options: BrowserAccountsClientOptions) {\n    this.#baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.#fetch = options.fetch ?? ((input, init) => fetch(input, init));\n  }\n\n  async getSessionSet(): Promise<ManagedAuthSessionSetProjectionType> {\n    if (this.#authorityResetPending || this.#authorityReconciliation) {\n      return await this.reconcileSessionSetAuthority();\n    }\n    const readEpoch = this.#authorityReadEpoch;\n    const received = await this.#readSessionSet();\n    if (readEpoch !== this.#authorityReadEpoch) {\n      return this.#authorityReconciliation\n        ? await this.#authorityReconciliation\n        : (this.#projection ?? (await this.getSessionSet()));\n    }\n    return this.#remember(received);\n  }\n\n  async reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType> {\n    if (this.#authorityReconciliation) return await this.#authorityReconciliation;\n    const previous = this.#projection;\n    const readEpoch = ++this.#authorityReadEpoch;\n    // Explicit reconciliation is an authority-invalidation boundary, not an\n    // ordinary monotonic refresh. Old operation admissions must never cross it,\n    // and mutations stay closed until two sequential reads reach a decision.\n    this.#authorityResetPending = true;\n    this.#mutationAdmissions.clear();\n    const reconciliation = this.#reconcileSessionSetAuthority(previous, readEpoch);\n    this.#authorityReconciliation = reconciliation;\n    try {\n      const accepted = await reconciliation;\n      if (readEpoch === this.#authorityReadEpoch) this.#authorityResetPending = false;\n      return accepted;\n    } finally {\n      if (this.#authorityReconciliation === reconciliation) {\n        this.#authorityReconciliation = null;\n      }\n    }\n  }\n\n  async bootstrapSessionSet(request: BootstrapManagedAuthSessionSetRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/bootstrap\",\n      BootstrapManagedAuthSessionSetRequest,\n      request,\n    );\n  }\n\n  async beginLoginTransaction(request: BeginManagedAuthLoginTransactionRequestType) {\n    return ManagedAuthLoginTransaction.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions\",\n        BeginManagedAuthLoginTransactionRequest,\n        request,\n      ),\n    );\n  }\n\n  async completeEmailPasswordTransaction(\n    request: CompleteManagedAuthEmailPasswordTransactionRequestType,\n  ) {\n    const authorityReadEpoch = this.#authorityReadEpoch;\n    const response = CompleteManagedAuthLoginTransactionResponse.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions/email-password\",\n        CompleteManagedAuthEmailPasswordTransactionRequest,\n        request,\n      ),\n    );\n    if (authorityReadEpoch !== this.#authorityReadEpoch) {\n      return { ...response, projection: await this.getSessionSet() };\n    }\n    const remembered = this.#remember(response.projection);\n    if (remembered !== response.projection) {\n      return { ...response, projection: await this.getSessionSet() };\n    }\n    return response;\n  }\n\n  async cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType) {\n    return this.#projectionResponse(\n      \"DELETE\",\n      `/v1/auth/session-set/transactions/${encodeURIComponent(request.transactionId)}`,\n      CancelManagedAuthLoginTransactionRequest,\n      request,\n    );\n  }\n\n  async selectLoginSlot(request: SelectManagedAuthLoginSlotRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/select\",\n      SelectManagedAuthLoginSlotRequest,\n      request,\n    );\n  }\n\n  async logoutLoginSlot(request: LogoutManagedAuthLoginSlotRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/logout-one\",\n      LogoutManagedAuthLoginSlotRequest,\n      request,\n    );\n  }\n\n  async logoutSessionSet(request: LogoutManagedAuthSessionSetRequestType) {\n    const receipt = ManagedAuthLogoutAllReceipt.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/logout-all\",\n        LogoutManagedAuthSessionSetRequest,\n        request,\n      ),\n    );\n    this.#authorityReadEpoch += 1;\n    this.#authorityResetPending = false;\n    this.#projection = null;\n    this.#mutationAdmissions.clear();\n    return receipt;\n  }\n\n  async resolveDeepLink(request: ResolveManagedAuthDeepLinkRequestType) {\n    return ManagedAuthDeepLinkResolution.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/deep-link/resolve\",\n        ResolveManagedAuthDeepLinkRequest,\n        request,\n      ),\n    );\n  }\n\n  async #projectionResponse<S extends z.ZodType>(\n    method: \"POST\" | \"DELETE\",\n    path: string,\n    schema: S,\n    request: z.infer<S>,\n  ): Promise<ManagedAuthSessionSetProjectionType> {\n    const authorityReadEpoch = this.#authorityReadEpoch;\n    const received = ManagedAuthSessionSetProjection.parse(\n      await this.#mutation(method, path, schema, request),\n    );\n    if (authorityReadEpoch !== this.#authorityReadEpoch) return await this.getSessionSet();\n    const remembered = this.#remember(received);\n    // An exact replay may legitimately return its older durable receipt after\n    // another tab has advanced this in-memory client. Reconcile from authority\n    // instead of presenting that receipt as the current actor projection.\n    return remembered === received ? received : await this.getSessionSet();\n  }\n\n  async #mutation<S extends z.ZodType>(\n    method: \"POST\" | \"DELETE\",\n    path: string,\n    schema: S,\n    request: z.infer<S>,\n  ): Promise<unknown> {\n    if (this.#authorityResetPending) {\n      throw new BrowserAccountsApiError(409, \"actor_change_required\");\n    }\n    const body = schema.parse(request);\n    const projection = this.#projection;\n    if (!projection) throw new BrowserAccountsApiError(409, \"session_set_projection_required\");\n    const operationId = mutationOperationId(body);\n    const signature = operationId ? JSON.stringify([method, path, body]) : null;\n    const retained = operationId ? this.#mutationAdmissions.get(operationId) : null;\n    if (retained && retained.signature !== signature) {\n      throw new BrowserAccountsApiError(409, \"operation_reused\");\n    }\n    const admission =\n      retained ??\n      ({\n        signature: signature ?? \"\",\n        csrfToken: projection.csrfToken,\n        actorEpoch: projection.actorEpoch,\n      } as const);\n    if (operationId && !retained) {\n      this.#mutationAdmissions.set(operationId, admission);\n      if (this.#mutationAdmissions.size > 64) {\n        this.#mutationAdmissions.delete(this.#mutationAdmissions.keys().next().value!);\n      }\n    }\n    return await this.#request(method, path, body, {\n      \"x-opengeni-session-csrf\": admission.csrfToken,\n      \"x-opengeni-actor-epoch\": admission.actorEpoch,\n    });\n  }\n\n  async #request(\n    method: \"GET\" | \"POST\" | \"DELETE\",\n    path: string,\n    body?: unknown,\n    headers: Record<string, string> = {},\n  ): Promise<unknown> {\n    let response: Response;\n    try {\n      response = await this.#fetch(`${this.#baseUrl}${path}`, {\n        method,\n        credentials: \"include\",\n        headers: {\n          accept: \"application/json\",\n          [MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER]:\n            MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,\n          ...(body === undefined ? {} : { \"content-type\": \"application/json\" }),\n          ...headers,\n        },\n        ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n      });\n    } catch (cause) {\n      if (method !== \"GET\") {\n        throw new BrowserAccountsApiError(503, \"operation_outcome_unknown\", { cause });\n      }\n      throw cause;\n    }\n    let parsed = true;\n    const value = await response.json().catch(() => {\n      parsed = false;\n      return null;\n    });\n    if (!response.ok) {\n      const code = managedAuthErrorCode(value) ?? `http_${response.status}`;\n      throw new BrowserAccountsApiError(response.status, code);\n    }\n    if (!parsed && method !== \"GET\") {\n      throw new BrowserAccountsApiError(503, \"operation_outcome_unknown\");\n    }\n    return value;\n  }\n\n  async #readSessionSet(): Promise<ManagedAuthSessionSetProjectionType> {\n    return ManagedAuthSessionSetProjection.parse(\n      await this.#request(\"GET\", \"/v1/auth/session-set\"),\n    );\n  }\n\n  async #reconcileSessionSetAuthority(\n    previous: ManagedAuthSessionSetProjectionType | null,\n    readEpoch: number,\n  ): Promise<ManagedAuthSessionSetProjectionType> {\n    const first = await this.#readSessionSet();\n    const second = await this.#readSessionSet();\n    if (readEpoch !== this.#authorityReadEpoch) {\n      return await this.#reconcileSessionSetAuthority(this.#projection, this.#authorityReadEpoch);\n    }\n    if (this.#projection !== previous) return this.#remember(second);\n    if (!previous || compareProjectionClock(second, previous) >= 0) {\n      return this.#remember(second);\n    }\n    if (compareProjectionClock(first, previous) < 0 && compareProjectionClock(second, first) >= 0) {\n      // Same-authority clocks never decrease. Two sequential no-store reads\n      // that both remain below the remembered clock therefore prove that the\n      // HttpOnly authority rotated; the second may already have advanced from\n      // the fresh authority's initial 1/1 projection.\n      this.#projection = second;\n      this.#mutationAdmissions.clear();\n      return second;\n    }\n    return previous;\n  }\n\n  #remember(projection: ManagedAuthSessionSetProjectionType) {\n    const current = this.#projection;\n    if (!current || compareProjectionClock(projection, current) >= 0) {\n      this.#projection = projection;\n      return projection;\n    }\n    return current;\n  }\n}\n\nfunction mutationOperationId(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const operationId = (value as { operationId?: unknown }).operationId;\n  return typeof operationId === \"string\" ? operationId : null;\n}\n\nfunction compareProjectionClock(\n  left: Pick<ManagedAuthSessionSetProjectionType, \"actorEpoch\" | \"generation\">,\n  right: Pick<ManagedAuthSessionSetProjectionType, \"actorEpoch\" | \"generation\">,\n): number {\n  const actorDelta = BigInt(left.actorEpoch) - BigInt(right.actorEpoch);\n  if (actorDelta !== 0n) return actorDelta > 0n ? 1 : -1;\n  const generationDelta = BigInt(left.generation) - BigInt(right.generation);\n  return generationDelta === 0n ? 0 : generationDelta > 0n ? 1 : -1;\n}\n\nfunction managedAuthErrorCode(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const error = (value as { error?: unknown }).error;\n  if (error && typeof error === \"object\") {\n    const details = (error as { details?: unknown }).details;\n    if (details && typeof details === \"object\") {\n      const parsed = ManagedAuthSessionSetErrorCode.safeParse(\n        (details as { managedAuthCode?: unknown }).managedAuthCode,\n      );\n      if (parsed.success) return parsed.data;\n    }\n  }\n  const legacy = (value as { message?: unknown }).message;\n  const parsed = ManagedAuthSessionSetErrorCode.safeParse(legacy);\n  return parsed.success ? parsed.data : null;\n}\n\nexport function createBrowserAccountsClient(\n  options: BrowserAccountsClientOptions,\n): BrowserAccountsClient {\n  return new BrowserAccountsClient(options);\n}\n\nexport type {\n  BeginManagedAuthLoginTransactionRequestType as BeginManagedAuthLoginTransactionRequest,\n  BootstrapManagedAuthSessionSetRequestType as BootstrapManagedAuthSessionSetRequest,\n  CancelManagedAuthLoginTransactionRequestType as CancelManagedAuthLoginTransactionRequest,\n  CompleteManagedAuthEmailPasswordTransactionRequestType as CompleteManagedAuthEmailPasswordTransactionRequest,\n  CompleteManagedAuthLoginTransactionResponseType as CompleteManagedAuthLoginTransactionResponse,\n  LogoutManagedAuthLoginSlotRequestType as LogoutManagedAuthLoginSlotRequest,\n  LogoutManagedAuthSessionSetRequestType as LogoutManagedAuthSessionSetRequest,\n  ManagedAuthDeepLinkResolutionType as ManagedAuthDeepLinkResolution,\n  ManagedAuthLoginTransactionType as ManagedAuthLoginTransaction,\n  ManagedAuthLogoutAllReceiptType as ManagedAuthLogoutAllReceipt,\n  ManagedAuthSessionSetProjectionType as ManagedAuthSessionSetProjection,\n  ResolveManagedAuthDeepLinkRequestType as ResolveManagedAuthDeepLinkRequest,\n  SelectManagedAuthLoginSlotRequestType as SelectManagedAuthLoginSlotRequest,\n};\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAcK;AA0CA,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAEjD,YACW,QACA,MACT,SACA;AACA,UAAM,MAAM,SAAS,UAAU,SAAY,SAAY,EAAE,OAAO,QAAQ,MAAM,CAAC;AAJtE;AACA;AAAA,EAIX;AAAA,EAPS,OAAO;AAQlB;AAEO,IAAM,wBAAN,MAAiE;AAAA,EAC7D;AAAA,EACA;AAAA;AAAA;AAAA,EAGA,sBAAsB,oBAAI,IAGjC;AAAA,EACF,cAA0D;AAAA,EAC1D,sBAAsB;AAAA,EACtB,yBAAyB;AAAA,EACzB,2BAAgF;AAAA,EAEhF,YAAY,SAAuC;AACjD,SAAK,WAAW,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;AAClD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAAO,SAAS,MAAM,OAAO,IAAI;AAAA,EACpE;AAAA,EAEA,MAAM,gBAA8D;AAClE,QAAI,KAAK,0BAA0B,KAAK,0BAA0B;AAChE,aAAO,MAAM,KAAK,6BAA6B;AAAA,IACjD;AACA,UAAM,YAAY,KAAK;AACvB,UAAM,WAAW,MAAM,KAAK,gBAAgB;AAC5C,QAAI,cAAc,KAAK,qBAAqB;AAC1C,aAAO,KAAK,2BACR,MAAM,KAAK,2BACV,KAAK,eAAgB,MAAM,KAAK,cAAc;AAAA,IACrD;AACA,WAAO,KAAK,UAAU,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,+BAA6E;AACjF,QAAI,KAAK,yBAA0B,QAAO,MAAM,KAAK;AACrD,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,EAAE,KAAK;AAIzB,SAAK,yBAAyB;AAC9B,SAAK,oBAAoB,MAAM;AAC/B,UAAM,iBAAiB,KAAK,8BAA8B,UAAU,SAAS;AAC7E,SAAK,2BAA2B;AAChC,QAAI;AACF,YAAM,WAAW,MAAM;AACvB,UAAI,cAAc,KAAK,oBAAqB,MAAK,yBAAyB;AAC1E,aAAO;AAAA,IACT,UAAE;AACA,UAAI,KAAK,6BAA6B,gBAAgB;AACpD,aAAK,2BAA2B;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,SAAoD;AAC5E,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,sBAAsB,SAAsD;AAChF,WAAO,4BAA4B;AAAA,MACjC,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iCACJ,SACA;AACA,UAAM,qBAAqB,KAAK;AAChC,UAAM,WAAW,4CAA4C;AAAA,MAC3D,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,uBAAuB,KAAK,qBAAqB;AACnD,aAAO,EAAE,GAAG,UAAU,YAAY,MAAM,KAAK,cAAc,EAAE;AAAA,IAC/D;AACA,UAAM,aAAa,KAAK,UAAU,SAAS,UAAU;AACrD,QAAI,eAAe,SAAS,YAAY;AACtC,aAAO,EAAE,GAAG,UAAU,YAAY,MAAM,KAAK,cAAc,EAAE;AAAA,IAC/D;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,uBAAuB,SAAuD;AAClF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qCAAqC,mBAAmB,QAAQ,aAAa,CAAC;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,SAAiD;AACtE,UAAM,UAAU,4BAA4B;AAAA,MAC1C,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,SAAK,uBAAuB;AAC5B,SAAK,yBAAyB;AAC9B,SAAK,cAAc;AACnB,SAAK,oBAAoB,MAAM;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,8BAA8B;AAAA,MACnC,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBACJ,QACA,MACA,QACA,SAC8C;AAC9C,UAAM,qBAAqB,KAAK;AAChC,UAAM,WAAW,gCAAgC;AAAA,MAC/C,MAAM,KAAK,UAAU,QAAQ,MAAM,QAAQ,OAAO;AAAA,IACpD;AACA,QAAI,uBAAuB,KAAK,oBAAqB,QAAO,MAAM,KAAK,cAAc;AACrF,UAAM,aAAa,KAAK,UAAU,QAAQ;AAI1C,WAAO,eAAe,WAAW,WAAW,MAAM,KAAK,cAAc;AAAA,EACvE;AAAA,EAEA,MAAM,UACJ,QACA,MACA,QACA,SACkB;AAClB,QAAI,KAAK,wBAAwB;AAC/B,YAAM,IAAI,wBAAwB,KAAK,uBAAuB;AAAA,IAChE;AACA,UAAM,OAAO,OAAO,MAAM,OAAO;AACjC,UAAM,aAAa,KAAK;AACxB,QAAI,CAAC,WAAY,OAAM,IAAI,wBAAwB,KAAK,iCAAiC;AACzF,UAAM,cAAc,oBAAoB,IAAI;AAC5C,UAAM,YAAY,cAAc,KAAK,UAAU,CAAC,QAAQ,MAAM,IAAI,CAAC,IAAI;AACvE,UAAM,WAAW,cAAc,KAAK,oBAAoB,IAAI,WAAW,IAAI;AAC3E,QAAI,YAAY,SAAS,cAAc,WAAW;AAChD,YAAM,IAAI,wBAAwB,KAAK,kBAAkB;AAAA,IAC3D;AACA,UAAM,YACJ,YACC;AAAA,MACC,WAAW,aAAa;AAAA,MACxB,WAAW,WAAW;AAAA,MACtB,YAAY,WAAW;AAAA,IACzB;AACF,QAAI,eAAe,CAAC,UAAU;AAC5B,WAAK,oBAAoB,IAAI,aAAa,SAAS;AACnD,UAAI,KAAK,oBAAoB,OAAO,IAAI;AACtC,aAAK,oBAAoB,OAAO,KAAK,oBAAoB,KAAK,EAAE,KAAK,EAAE,KAAM;AAAA,MAC/E;AAAA,IACF;AACA,WAAO,MAAM,KAAK,SAAS,QAAQ,MAAM,MAAM;AAAA,MAC7C,2BAA2B,UAAU;AAAA,MACrC,0BAA0B,UAAU;AAAA,IACtC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,SACJ,QACA,MACA,MACA,UAAkC,CAAC,GACjB;AAClB,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,IAAI,IAAI;AAAA,QACtD;AAAA,QACA,aAAa;AAAA,QACb,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,CAAC,4CAA4C,GAC3C;AAAA,UACF,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,UACnE,GAAG;AAAA,QACL;AAAA,QACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,MAC7D,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,WAAW,OAAO;AACpB,cAAM,IAAI,wBAAwB,KAAK,6BAA6B,EAAE,MAAM,CAAC;AAAA,MAC/E;AACA,YAAM;AAAA,IACR;AACA,QAAI,SAAS;AACb,UAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM;AAC9C,eAAS;AACT,aAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,OAAO,qBAAqB,KAAK,KAAK,QAAQ,SAAS,MAAM;AACnE,YAAM,IAAI,wBAAwB,SAAS,QAAQ,IAAI;AAAA,IACzD;AACA,QAAI,CAAC,UAAU,WAAW,OAAO;AAC/B,YAAM,IAAI,wBAAwB,KAAK,2BAA2B;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,kBAAgE;AACpE,WAAO,gCAAgC;AAAA,MACrC,MAAM,KAAK,SAAS,OAAO,sBAAsB;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,8BACJ,UACA,WAC8C;AAC9C,UAAM,QAAQ,MAAM,KAAK,gBAAgB;AACzC,UAAM,SAAS,MAAM,KAAK,gBAAgB;AAC1C,QAAI,cAAc,KAAK,qBAAqB;AAC1C,aAAO,MAAM,KAAK,8BAA8B,KAAK,aAAa,KAAK,mBAAmB;AAAA,IAC5F;AACA,QAAI,KAAK,gBAAgB,SAAU,QAAO,KAAK,UAAU,MAAM;AAC/D,QAAI,CAAC,YAAY,uBAAuB,QAAQ,QAAQ,KAAK,GAAG;AAC9D,aAAO,KAAK,UAAU,MAAM;AAAA,IAC9B;AACA,QAAI,uBAAuB,OAAO,QAAQ,IAAI,KAAK,uBAAuB,QAAQ,KAAK,KAAK,GAAG;AAK7F,WAAK,cAAc;AACnB,WAAK,oBAAoB,MAAM;AAC/B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,UAAU,YAAiD;AACzD,UAAM,UAAU,KAAK;AACrB,QAAI,CAAC,WAAW,uBAAuB,YAAY,OAAO,KAAK,GAAG;AAChE,WAAK,cAAc;AACnB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,OAA+B;AAC1D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,cAAe,MAAoC;AACzD,SAAO,OAAO,gBAAgB,WAAW,cAAc;AACzD;AAEA,SAAS,uBACP,MACA,OACQ;AACR,QAAM,aAAa,OAAO,KAAK,UAAU,IAAI,OAAO,MAAM,UAAU;AACpE,MAAI,eAAe,GAAI,QAAO,aAAa,KAAK,IAAI;AACpD,QAAM,kBAAkB,OAAO,KAAK,UAAU,IAAI,OAAO,MAAM,UAAU;AACzE,SAAO,oBAAoB,KAAK,IAAI,kBAAkB,KAAK,IAAI;AACjE;AAEA,SAAS,qBAAqB,OAA+B;AAC3D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAS,MAA8B;AAC7C,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,UAAW,MAAgC;AACjD,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,YAAMA,UAAS,+BAA+B;AAAA,QAC3C,QAA0C;AAAA,MAC7C;AACA,UAAIA,QAAO,QAAS,QAAOA,QAAO;AAAA,IACpC;AAAA,EACF;AACA,QAAM,SAAU,MAAgC;AAChD,QAAM,SAAS,+BAA+B,UAAU,MAAM;AAC9D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEO,SAAS,4BACd,SACuB;AACvB,SAAO,IAAI,sBAAsB,OAAO;AAC1C;","names":["parsed"]}
+{"version":3,"sources":["../src/accounts.ts"],"sourcesContent":["import {\n  BeginManagedAuthLoginTransactionRequest,\n  BootstrapManagedAuthSessionSetRequest,\n  CancelManagedAuthLoginTransactionRequest,\n  CompleteManagedAuthEmailPasswordTransactionRequest,\n  CompleteManagedAuthLoginTransactionResponse,\n  LogoutManagedAuthLoginSlotRequest,\n  LogoutManagedAuthSessionSetRequest,\n  MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER,\n  MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,\n  ManagedAuthDeepLinkResolution,\n  ManagedAuthLoginTransaction,\n  ManagedAuthLogoutAllReceipt,\n  ManagedAuthSessionSetProjection,\n  ManagedAuthSessionSetErrorCode,\n  ResolveManagedAuthDeepLinkRequest,\n  SelectManagedAuthLoginSlotRequest,\n  StartManagedAuthSocialTransactionRequest,\n  StartManagedAuthSocialTransactionResponse,\n  type BeginManagedAuthLoginTransactionRequest as BeginManagedAuthLoginTransactionRequestType,\n  type BootstrapManagedAuthSessionSetRequest as BootstrapManagedAuthSessionSetRequestType,\n  type CancelManagedAuthLoginTransactionRequest as CancelManagedAuthLoginTransactionRequestType,\n  type CompleteManagedAuthEmailPasswordTransactionRequest as CompleteManagedAuthEmailPasswordTransactionRequestType,\n  type CompleteManagedAuthLoginTransactionResponse as CompleteManagedAuthLoginTransactionResponseType,\n  type LogoutManagedAuthLoginSlotRequest as LogoutManagedAuthLoginSlotRequestType,\n  type LogoutManagedAuthSessionSetRequest as LogoutManagedAuthSessionSetRequestType,\n  type ManagedAuthDeepLinkResolution as ManagedAuthDeepLinkResolutionType,\n  type ManagedAuthLoginTransaction as ManagedAuthLoginTransactionType,\n  type ManagedAuthLogoutAllReceipt as ManagedAuthLogoutAllReceiptType,\n  type ManagedAuthSessionSetProjection as ManagedAuthSessionSetProjectionType,\n  type ResolveManagedAuthDeepLinkRequest as ResolveManagedAuthDeepLinkRequestType,\n  type SelectManagedAuthLoginSlotRequest as SelectManagedAuthLoginSlotRequestType,\n  type StartManagedAuthSocialTransactionRequest as StartManagedAuthSocialTransactionRequestType,\n  type StartManagedAuthSocialTransactionResponse as StartManagedAuthSocialTransactionResponseType,\n} from \"@opengeni/contracts/managed-auth-session-sets\";\nimport type { z } from \"zod\";\n\nexport type BrowserAccountsFetch = (\n  input: string | URL | Request,\n  init?: RequestInit,\n) => Promise<Response>;\n\nexport type BrowserAccountsClientOptions = {\n  baseUrl: string;\n  fetch?: BrowserAccountsFetch;\n};\n\nexport interface BrowserAccountsClientLike {\n  getSessionSet(): Promise<ManagedAuthSessionSetProjectionType>;\n  reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType>;\n  bootstrapSessionSet(\n    request: BootstrapManagedAuthSessionSetRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  beginLoginTransaction(\n    request: BeginManagedAuthLoginTransactionRequestType,\n  ): Promise<ManagedAuthLoginTransactionType>;\n  completeEmailPasswordTransaction(\n    request: CompleteManagedAuthEmailPasswordTransactionRequestType,\n  ): Promise<CompleteManagedAuthLoginTransactionResponseType>;\n  startSocialTransaction?(\n    request: StartManagedAuthSocialTransactionRequestType,\n  ): Promise<StartManagedAuthSocialTransactionResponseType>;\n  cancelLoginTransaction(\n    request: CancelManagedAuthLoginTransactionRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  selectLoginSlot(\n    request: SelectManagedAuthLoginSlotRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  logoutLoginSlot(\n    request: LogoutManagedAuthLoginSlotRequestType,\n  ): Promise<ManagedAuthSessionSetProjectionType>;\n  logoutSessionSet(\n    request: LogoutManagedAuthSessionSetRequestType,\n  ): Promise<ManagedAuthLogoutAllReceiptType>;\n  resolveDeepLink(\n    request: ResolveManagedAuthDeepLinkRequestType,\n  ): Promise<ManagedAuthDeepLinkResolutionType>;\n}\n\nexport class BrowserAccountsApiError extends Error {\n  readonly name = \"BrowserAccountsApiError\";\n  constructor(\n    readonly status: number,\n    readonly code: string,\n    options?: { cause?: unknown },\n  ) {\n    super(code, options?.cause === undefined ? undefined : { cause: options.cause });\n  }\n}\n\nexport class BrowserAccountsClient implements BrowserAccountsClientLike {\n  readonly #baseUrl: string;\n  readonly #fetch: BrowserAccountsFetch;\n  // CSRF is generation-bound. Exact idempotent replay must retain the\n  // admission envelope even after an authority reread observes a newer clock.\n  readonly #mutationAdmissions = new Map<\n    string,\n    { signature: string; csrfToken: string; actorEpoch: string }\n  >();\n  #projection: ManagedAuthSessionSetProjectionType | null = null;\n  #authorityReadEpoch = 0;\n  #authorityResetPending = false;\n  #authorityReconciliation: Promise<ManagedAuthSessionSetProjectionType> | null = null;\n\n  constructor(options: BrowserAccountsClientOptions) {\n    this.#baseUrl = options.baseUrl.replace(/\\/+$/, \"\");\n    this.#fetch = options.fetch ?? ((input, init) => fetch(input, init));\n  }\n\n  async getSessionSet(): Promise<ManagedAuthSessionSetProjectionType> {\n    if (this.#authorityResetPending || this.#authorityReconciliation) {\n      return await this.reconcileSessionSetAuthority();\n    }\n    const readEpoch = this.#authorityReadEpoch;\n    const received = await this.#readSessionSet();\n    if (readEpoch !== this.#authorityReadEpoch) {\n      return this.#authorityReconciliation\n        ? await this.#authorityReconciliation\n        : (this.#projection ?? (await this.getSessionSet()));\n    }\n    return this.#remember(received);\n  }\n\n  async reconcileSessionSetAuthority(): Promise<ManagedAuthSessionSetProjectionType> {\n    if (this.#authorityReconciliation) return await this.#authorityReconciliation;\n    const previous = this.#projection;\n    const readEpoch = ++this.#authorityReadEpoch;\n    // Explicit reconciliation is an authority-invalidation boundary, not an\n    // ordinary monotonic refresh. Old operation admissions must never cross it,\n    // and mutations stay closed until two sequential reads reach a decision.\n    this.#authorityResetPending = true;\n    this.#mutationAdmissions.clear();\n    const reconciliation = this.#reconcileSessionSetAuthority(previous, readEpoch);\n    this.#authorityReconciliation = reconciliation;\n    try {\n      const accepted = await reconciliation;\n      if (readEpoch === this.#authorityReadEpoch) this.#authorityResetPending = false;\n      return accepted;\n    } finally {\n      if (this.#authorityReconciliation === reconciliation) {\n        this.#authorityReconciliation = null;\n      }\n    }\n  }\n\n  async bootstrapSessionSet(request: BootstrapManagedAuthSessionSetRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/bootstrap\",\n      BootstrapManagedAuthSessionSetRequest,\n      request,\n    );\n  }\n\n  async beginLoginTransaction(request: BeginManagedAuthLoginTransactionRequestType) {\n    return ManagedAuthLoginTransaction.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions\",\n        BeginManagedAuthLoginTransactionRequest,\n        request,\n      ),\n    );\n  }\n\n  async completeEmailPasswordTransaction(\n    request: CompleteManagedAuthEmailPasswordTransactionRequestType,\n  ) {\n    const authorityReadEpoch = this.#authorityReadEpoch;\n    const response = CompleteManagedAuthLoginTransactionResponse.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions/email-password\",\n        CompleteManagedAuthEmailPasswordTransactionRequest,\n        request,\n      ),\n    );\n    if (authorityReadEpoch !== this.#authorityReadEpoch) {\n      return { ...response, projection: await this.getSessionSet() };\n    }\n    const remembered = this.#remember(response.projection);\n    if (remembered !== response.projection) {\n      return { ...response, projection: await this.getSessionSet() };\n    }\n    return response;\n  }\n\n  async startSocialTransaction(request: StartManagedAuthSocialTransactionRequestType) {\n    return StartManagedAuthSocialTransactionResponse.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/transactions/social\",\n        StartManagedAuthSocialTransactionRequest,\n        request,\n      ),\n    );\n  }\n\n  async cancelLoginTransaction(request: CancelManagedAuthLoginTransactionRequestType) {\n    return this.#projectionResponse(\n      \"DELETE\",\n      `/v1/auth/session-set/transactions/${encodeURIComponent(request.transactionId)}`,\n      CancelManagedAuthLoginTransactionRequest,\n      request,\n    );\n  }\n\n  async selectLoginSlot(request: SelectManagedAuthLoginSlotRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/select\",\n      SelectManagedAuthLoginSlotRequest,\n      request,\n    );\n  }\n\n  async logoutLoginSlot(request: LogoutManagedAuthLoginSlotRequestType) {\n    return this.#projectionResponse(\n      \"POST\",\n      \"/v1/auth/session-set/logout-one\",\n      LogoutManagedAuthLoginSlotRequest,\n      request,\n    );\n  }\n\n  async logoutSessionSet(request: LogoutManagedAuthSessionSetRequestType) {\n    const receipt = ManagedAuthLogoutAllReceipt.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/logout-all\",\n        LogoutManagedAuthSessionSetRequest,\n        request,\n      ),\n    );\n    this.#authorityReadEpoch += 1;\n    this.#authorityResetPending = false;\n    this.#projection = null;\n    this.#mutationAdmissions.clear();\n    return receipt;\n  }\n\n  async resolveDeepLink(request: ResolveManagedAuthDeepLinkRequestType) {\n    return ManagedAuthDeepLinkResolution.parse(\n      await this.#mutation(\n        \"POST\",\n        \"/v1/auth/session-set/deep-link/resolve\",\n        ResolveManagedAuthDeepLinkRequest,\n        request,\n      ),\n    );\n  }\n\n  async #projectionResponse<S extends z.ZodType>(\n    method: \"POST\" | \"DELETE\",\n    path: string,\n    schema: S,\n    request: z.infer<S>,\n  ): Promise<ManagedAuthSessionSetProjectionType> {\n    const authorityReadEpoch = this.#authorityReadEpoch;\n    const received = ManagedAuthSessionSetProjection.parse(\n      await this.#mutation(method, path, schema, request),\n    );\n    if (authorityReadEpoch !== this.#authorityReadEpoch) return await this.getSessionSet();\n    const remembered = this.#remember(received);\n    // An exact replay may legitimately return its older durable receipt after\n    // another tab has advanced this in-memory client. Reconcile from authority\n    // instead of presenting that receipt as the current actor projection.\n    return remembered === received ? received : await this.getSessionSet();\n  }\n\n  async #mutation<S extends z.ZodType>(\n    method: \"POST\" | \"DELETE\",\n    path: string,\n    schema: S,\n    request: z.infer<S>,\n  ): Promise<unknown> {\n    if (this.#authorityResetPending) {\n      throw new BrowserAccountsApiError(409, \"actor_change_required\");\n    }\n    const body = schema.parse(request);\n    const projection = this.#projection;\n    if (!projection) throw new BrowserAccountsApiError(409, \"session_set_projection_required\");\n    const operationId = mutationOperationId(body);\n    const signature = operationId ? JSON.stringify([method, path, body]) : null;\n    const retained = operationId ? this.#mutationAdmissions.get(operationId) : null;\n    if (retained && retained.signature !== signature) {\n      throw new BrowserAccountsApiError(409, \"operation_reused\");\n    }\n    const admission =\n      retained ??\n      ({\n        signature: signature ?? \"\",\n        csrfToken: projection.csrfToken,\n        actorEpoch: projection.actorEpoch,\n      } as const);\n    if (operationId && !retained) {\n      this.#mutationAdmissions.set(operationId, admission);\n      if (this.#mutationAdmissions.size > 64) {\n        this.#mutationAdmissions.delete(this.#mutationAdmissions.keys().next().value!);\n      }\n    }\n    return await this.#request(method, path, body, {\n      \"x-opengeni-session-csrf\": admission.csrfToken,\n      \"x-opengeni-actor-epoch\": admission.actorEpoch,\n    });\n  }\n\n  async #request(\n    method: \"GET\" | \"POST\" | \"DELETE\",\n    path: string,\n    body?: unknown,\n    headers: Record<string, string> = {},\n  ): Promise<unknown> {\n    let response: Response;\n    try {\n      response = await this.#fetch(`${this.#baseUrl}${path}`, {\n        method,\n        credentials: \"include\",\n        headers: {\n          accept: \"application/json\",\n          [MANAGED_AUTH_SESSION_SET_API_CONTRACT_HEADER]:\n            MANAGED_AUTH_SESSION_SET_API_CONTRACT_REVISION,\n          ...(body === undefined ? {} : { \"content-type\": \"application/json\" }),\n          ...headers,\n        },\n        ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n      });\n    } catch (cause) {\n      if (method !== \"GET\") {\n        throw new BrowserAccountsApiError(503, \"operation_outcome_unknown\", { cause });\n      }\n      throw cause;\n    }\n    let parsed = true;\n    const value = await response.json().catch(() => {\n      parsed = false;\n      return null;\n    });\n    if (!response.ok) {\n      const code = managedAuthErrorCode(value) ?? `http_${response.status}`;\n      throw new BrowserAccountsApiError(response.status, code);\n    }\n    if (!parsed && method !== \"GET\") {\n      throw new BrowserAccountsApiError(503, \"operation_outcome_unknown\");\n    }\n    return value;\n  }\n\n  async #readSessionSet(): Promise<ManagedAuthSessionSetProjectionType> {\n    return ManagedAuthSessionSetProjection.parse(\n      await this.#request(\"GET\", \"/v1/auth/session-set\"),\n    );\n  }\n\n  async #reconcileSessionSetAuthority(\n    previous: ManagedAuthSessionSetProjectionType | null,\n    readEpoch: number,\n  ): Promise<ManagedAuthSessionSetProjectionType> {\n    const first = await this.#readSessionSet();\n    const second = await this.#readSessionSet();\n    if (readEpoch !== this.#authorityReadEpoch) {\n      return await this.#reconcileSessionSetAuthority(this.#projection, this.#authorityReadEpoch);\n    }\n    if (this.#projection !== previous) return this.#remember(second);\n    if (!previous || compareProjectionClock(second, previous) >= 0) {\n      return this.#remember(second);\n    }\n    if (compareProjectionClock(first, previous) < 0 && compareProjectionClock(second, first) >= 0) {\n      // Same-authority clocks never decrease. Two sequential no-store reads\n      // that both remain below the remembered clock therefore prove that the\n      // HttpOnly authority rotated; the second may already have advanced from\n      // the fresh authority's initial 1/1 projection.\n      this.#projection = second;\n      this.#mutationAdmissions.clear();\n      return second;\n    }\n    return previous;\n  }\n\n  #remember(projection: ManagedAuthSessionSetProjectionType) {\n    const current = this.#projection;\n    if (!current || compareProjectionClock(projection, current) >= 0) {\n      this.#projection = projection;\n      return projection;\n    }\n    return current;\n  }\n}\n\nfunction mutationOperationId(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const operationId = (value as { operationId?: unknown }).operationId;\n  return typeof operationId === \"string\" ? operationId : null;\n}\n\nfunction compareProjectionClock(\n  left: Pick<ManagedAuthSessionSetProjectionType, \"actorEpoch\" | \"generation\">,\n  right: Pick<ManagedAuthSessionSetProjectionType, \"actorEpoch\" | \"generation\">,\n): number {\n  const actorDelta = BigInt(left.actorEpoch) - BigInt(right.actorEpoch);\n  if (actorDelta !== 0n) return actorDelta > 0n ? 1 : -1;\n  const generationDelta = BigInt(left.generation) - BigInt(right.generation);\n  return generationDelta === 0n ? 0 : generationDelta > 0n ? 1 : -1;\n}\n\nfunction managedAuthErrorCode(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const error = (value as { error?: unknown }).error;\n  if (error && typeof error === \"object\") {\n    const details = (error as { details?: unknown }).details;\n    if (details && typeof details === \"object\") {\n      const parsed = ManagedAuthSessionSetErrorCode.safeParse(\n        (details as { managedAuthCode?: unknown }).managedAuthCode,\n      );\n      if (parsed.success) return parsed.data;\n    }\n  }\n  const legacy = (value as { message?: unknown }).message;\n  const parsed = ManagedAuthSessionSetErrorCode.safeParse(legacy);\n  return parsed.success ? parsed.data : null;\n}\n\nexport function createBrowserAccountsClient(\n  options: BrowserAccountsClientOptions,\n): BrowserAccountsClient {\n  return new BrowserAccountsClient(options);\n}\n\nexport type {\n  BeginManagedAuthLoginTransactionRequestType as BeginManagedAuthLoginTransactionRequest,\n  BootstrapManagedAuthSessionSetRequestType as BootstrapManagedAuthSessionSetRequest,\n  CancelManagedAuthLoginTransactionRequestType as CancelManagedAuthLoginTransactionRequest,\n  CompleteManagedAuthEmailPasswordTransactionRequestType as CompleteManagedAuthEmailPasswordTransactionRequest,\n  CompleteManagedAuthLoginTransactionResponseType as CompleteManagedAuthLoginTransactionResponse,\n  LogoutManagedAuthLoginSlotRequestType as LogoutManagedAuthLoginSlotRequest,\n  LogoutManagedAuthSessionSetRequestType as LogoutManagedAuthSessionSetRequest,\n  ManagedAuthDeepLinkResolutionType as ManagedAuthDeepLinkResolution,\n  ManagedAuthLoginTransactionType as ManagedAuthLoginTransaction,\n  ManagedAuthLogoutAllReceiptType as ManagedAuthLogoutAllReceipt,\n  ManagedAuthSessionSetProjectionType as ManagedAuthSessionSetProjection,\n  ResolveManagedAuthDeepLinkRequestType as ResolveManagedAuthDeepLinkRequest,\n  SelectManagedAuthLoginSlotRequestType as SelectManagedAuthLoginSlotRequest,\n};\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAgBK;AA6CA,IAAM,0BAAN,cAAsC,MAAM;AAAA,EAEjD,YACW,QACA,MACT,SACA;AACA,UAAM,MAAM,SAAS,UAAU,SAAY,SAAY,EAAE,OAAO,QAAQ,MAAM,CAAC;AAJtE;AACA;AAAA,EAIX;AAAA,EAPS,OAAO;AAQlB;AAEO,IAAM,wBAAN,MAAiE;AAAA,EAC7D;AAAA,EACA;AAAA;AAAA;AAAA,EAGA,sBAAsB,oBAAI,IAGjC;AAAA,EACF,cAA0D;AAAA,EAC1D,sBAAsB;AAAA,EACtB,yBAAyB;AAAA,EACzB,2BAAgF;AAAA,EAEhF,YAAY,SAAuC;AACjD,SAAK,WAAW,QAAQ,QAAQ,QAAQ,QAAQ,EAAE;AAClD,SAAK,SAAS,QAAQ,UAAU,CAAC,OAAO,SAAS,MAAM,OAAO,IAAI;AAAA,EACpE;AAAA,EAEA,MAAM,gBAA8D;AAClE,QAAI,KAAK,0BAA0B,KAAK,0BAA0B;AAChE,aAAO,MAAM,KAAK,6BAA6B;AAAA,IACjD;AACA,UAAM,YAAY,KAAK;AACvB,UAAM,WAAW,MAAM,KAAK,gBAAgB;AAC5C,QAAI,cAAc,KAAK,qBAAqB;AAC1C,aAAO,KAAK,2BACR,MAAM,KAAK,2BACV,KAAK,eAAgB,MAAM,KAAK,cAAc;AAAA,IACrD;AACA,WAAO,KAAK,UAAU,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,+BAA6E;AACjF,QAAI,KAAK,yBAA0B,QAAO,MAAM,KAAK;AACrD,UAAM,WAAW,KAAK;AACtB,UAAM,YAAY,EAAE,KAAK;AAIzB,SAAK,yBAAyB;AAC9B,SAAK,oBAAoB,MAAM;AAC/B,UAAM,iBAAiB,KAAK,8BAA8B,UAAU,SAAS;AAC7E,SAAK,2BAA2B;AAChC,QAAI;AACF,YAAM,WAAW,MAAM;AACvB,UAAI,cAAc,KAAK,oBAAqB,MAAK,yBAAyB;AAC1E,aAAO;AAAA,IACT,UAAE;AACA,UAAI,KAAK,6BAA6B,gBAAgB;AACpD,aAAK,2BAA2B;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBAAoB,SAAoD;AAC5E,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,sBAAsB,SAAsD;AAChF,WAAO,4BAA4B;AAAA,MACjC,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iCACJ,SACA;AACA,UAAM,qBAAqB,KAAK;AAChC,UAAM,WAAW,4CAA4C;AAAA,MAC3D,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,uBAAuB,KAAK,qBAAqB;AACnD,aAAO,EAAE,GAAG,UAAU,YAAY,MAAM,KAAK,cAAc,EAAE;AAAA,IAC/D;AACA,UAAM,aAAa,KAAK,UAAU,SAAS,UAAU;AACrD,QAAI,eAAe,SAAS,YAAY;AACtC,aAAO,EAAE,GAAG,UAAU,YAAY,MAAM,KAAK,cAAc,EAAE;AAAA,IAC/D;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,uBAAuB,SAAuD;AAClF,WAAO,0CAA0C;AAAA,MAC/C,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,uBAAuB,SAAuD;AAClF,WAAO,KAAK;AAAA,MACV;AAAA,MACA,qCAAqC,mBAAmB,QAAQ,aAAa,CAAC;AAAA,MAC9E;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,KAAK;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,iBAAiB,SAAiD;AACtE,UAAM,UAAU,4BAA4B;AAAA,MAC1C,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,SAAK,uBAAuB;AAC5B,SAAK,yBAAyB;AAC9B,SAAK,cAAc;AACnB,SAAK,oBAAoB,MAAM;AAC/B,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,gBAAgB,SAAgD;AACpE,WAAO,8BAA8B;AAAA,MACnC,MAAM,KAAK;AAAA,QACT;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,oBACJ,QACA,MACA,QACA,SAC8C;AAC9C,UAAM,qBAAqB,KAAK;AAChC,UAAM,WAAW,gCAAgC;AAAA,MAC/C,MAAM,KAAK,UAAU,QAAQ,MAAM,QAAQ,OAAO;AAAA,IACpD;AACA,QAAI,uBAAuB,KAAK,oBAAqB,QAAO,MAAM,KAAK,cAAc;AACrF,UAAM,aAAa,KAAK,UAAU,QAAQ;AAI1C,WAAO,eAAe,WAAW,WAAW,MAAM,KAAK,cAAc;AAAA,EACvE;AAAA,EAEA,MAAM,UACJ,QACA,MACA,QACA,SACkB;AAClB,QAAI,KAAK,wBAAwB;AAC/B,YAAM,IAAI,wBAAwB,KAAK,uBAAuB;AAAA,IAChE;AACA,UAAM,OAAO,OAAO,MAAM,OAAO;AACjC,UAAM,aAAa,KAAK;AACxB,QAAI,CAAC,WAAY,OAAM,IAAI,wBAAwB,KAAK,iCAAiC;AACzF,UAAM,cAAc,oBAAoB,IAAI;AAC5C,UAAM,YAAY,cAAc,KAAK,UAAU,CAAC,QAAQ,MAAM,IAAI,CAAC,IAAI;AACvE,UAAM,WAAW,cAAc,KAAK,oBAAoB,IAAI,WAAW,IAAI;AAC3E,QAAI,YAAY,SAAS,cAAc,WAAW;AAChD,YAAM,IAAI,wBAAwB,KAAK,kBAAkB;AAAA,IAC3D;AACA,UAAM,YACJ,YACC;AAAA,MACC,WAAW,aAAa;AAAA,MACxB,WAAW,WAAW;AAAA,MACtB,YAAY,WAAW;AAAA,IACzB;AACF,QAAI,eAAe,CAAC,UAAU;AAC5B,WAAK,oBAAoB,IAAI,aAAa,SAAS;AACnD,UAAI,KAAK,oBAAoB,OAAO,IAAI;AACtC,aAAK,oBAAoB,OAAO,KAAK,oBAAoB,KAAK,EAAE,KAAK,EAAE,KAAM;AAAA,MAC/E;AAAA,IACF;AACA,WAAO,MAAM,KAAK,SAAS,QAAQ,MAAM,MAAM;AAAA,MAC7C,2BAA2B,UAAU;AAAA,MACrC,0BAA0B,UAAU;AAAA,IACtC,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,SACJ,QACA,MACA,MACA,UAAkC,CAAC,GACjB;AAClB,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,OAAO,GAAG,KAAK,QAAQ,GAAG,IAAI,IAAI;AAAA,QACtD;AAAA,QACA,aAAa;AAAA,QACb,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,CAAC,4CAA4C,GAC3C;AAAA,UACF,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,UACnE,GAAG;AAAA,QACL;AAAA,QACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,MAC7D,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,WAAW,OAAO;AACpB,cAAM,IAAI,wBAAwB,KAAK,6BAA6B,EAAE,MAAM,CAAC;AAAA,MAC/E;AACA,YAAM;AAAA,IACR;AACA,QAAI,SAAS;AACb,UAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM;AAC9C,eAAS;AACT,aAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,OAAO,qBAAqB,KAAK,KAAK,QAAQ,SAAS,MAAM;AACnE,YAAM,IAAI,wBAAwB,SAAS,QAAQ,IAAI;AAAA,IACzD;AACA,QAAI,CAAC,UAAU,WAAW,OAAO;AAC/B,YAAM,IAAI,wBAAwB,KAAK,2BAA2B;AAAA,IACpE;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,kBAAgE;AACpE,WAAO,gCAAgC;AAAA,MACrC,MAAM,KAAK,SAAS,OAAO,sBAAsB;AAAA,IACnD;AAAA,EACF;AAAA,EAEA,MAAM,8BACJ,UACA,WAC8C;AAC9C,UAAM,QAAQ,MAAM,KAAK,gBAAgB;AACzC,UAAM,SAAS,MAAM,KAAK,gBAAgB;AAC1C,QAAI,cAAc,KAAK,qBAAqB;AAC1C,aAAO,MAAM,KAAK,8BAA8B,KAAK,aAAa,KAAK,mBAAmB;AAAA,IAC5F;AACA,QAAI,KAAK,gBAAgB,SAAU,QAAO,KAAK,UAAU,MAAM;AAC/D,QAAI,CAAC,YAAY,uBAAuB,QAAQ,QAAQ,KAAK,GAAG;AAC9D,aAAO,KAAK,UAAU,MAAM;AAAA,IAC9B;AACA,QAAI,uBAAuB,OAAO,QAAQ,IAAI,KAAK,uBAAuB,QAAQ,KAAK,KAAK,GAAG;AAK7F,WAAK,cAAc;AACnB,WAAK,oBAAoB,MAAM;AAC/B,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,UAAU,YAAiD;AACzD,UAAM,UAAU,KAAK;AACrB,QAAI,CAAC,WAAW,uBAAuB,YAAY,OAAO,KAAK,GAAG;AAChE,WAAK,cAAc;AACnB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,oBAAoB,OAA+B;AAC1D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,cAAe,MAAoC;AACzD,SAAO,OAAO,gBAAgB,WAAW,cAAc;AACzD;AAEA,SAAS,uBACP,MACA,OACQ;AACR,QAAM,aAAa,OAAO,KAAK,UAAU,IAAI,OAAO,MAAM,UAAU;AACpE,MAAI,eAAe,GAAI,QAAO,aAAa,KAAK,IAAI;AACpD,QAAM,kBAAkB,OAAO,KAAK,UAAU,IAAI,OAAO,MAAM,UAAU;AACzE,SAAO,oBAAoB,KAAK,IAAI,kBAAkB,KAAK,IAAI;AACjE;AAEA,SAAS,qBAAqB,OAA+B;AAC3D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAS,MAA8B;AAC7C,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,UAAW,MAAgC;AACjD,QAAI,WAAW,OAAO,YAAY,UAAU;AAC1C,YAAMA,UAAS,+BAA+B;AAAA,QAC3C,QAA0C;AAAA,MAC7C;AACA,UAAIA,QAAO,QAAS,QAAOA,QAAO;AAAA,IACpC;AAAA,EACF;AACA,QAAM,SAAU,MAAgC;AAChD,QAAM,SAAS,+BAA+B,UAAU,MAAM;AAC9D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEO,SAAS,4BACd,SACuB;AACvB,SAAO,IAAI,sBAAsB,OAAO;AAC1C;","names":["parsed"]}

package/dist/artifacts.js

@@ -1,10 +1,10 @@
 import {
   OpenGeniClient
-} from "./chunk-VUQZAB3O.js";
-import "./chunk-TX3EIENU.js";
-import "./chunk-7ZXBPJZP.js";
-import "./chunk-YTAWBDO2.js";
-import "./chunk-GW3EJ2GP.js";
+} from "./chunk-QT3KFVDP.js";
+import "./chunk-YXQX7RQT.js";
+import "./chunk-TRNI7KEO.js";
+import "./chunk-JUS2UYRP.js";
+import "./chunk-KKRO2VCP.js";
 import "./chunk-C4DJPZRU.js";
 export {
   OpenGeniClient

package/dist/browser.js

@@ -3,12 +3,12 @@ import {
 } from "./chunk-VYCTL62C.js";
 import {
   OpenGeniClient
-} from "./chunk-7ZXBPJZP.js";
+} from "./chunk-TRNI7KEO.js";
 import {
   OPENGENI_API_CONTRACT_HEADER,
   OPENGENI_API_CONTRACT_REVISION
-} from "./chunk-YTAWBDO2.js";
-import "./chunk-GW3EJ2GP.js";
+} from "./chunk-JUS2UYRP.js";
+import "./chunk-KKRO2VCP.js";
 import {
   OpenGeniApiContractMismatchError,
   OpenGeniApiError,

package/dist/{chunk-YTAWBDO2.js → chunk-JUS2UYRP.js}

@@ -171,6 +171,7 @@ var KNOWN_PERMISSIONS = [
   "api_keys:manage",
   "connections:read",
   "connections:write",
+  "capabilities:manage",
   "environments:manage",
   "environments:use",
   "variable-sets:list",
@@ -235,4 +236,4 @@ export {
   GENERATED_VIDEO_MAX_BYTES,
   KNOWN_USAGE_EVENT_TYPES
 };
-//# sourceMappingURL=chunk-YTAWBDO2.js.map
+//# sourceMappingURL=chunk-JUS2UYRP.js.map