@workos/oagen 0.26.0 → 0.27.0

package/dist/{types-owWZiSwD.d.mts → types-CIAqYpcV.d.mts}

@@ -23,7 +23,7 @@ declare const ALL_LANGUAGE_IDS: readonly LanguageId[];
 //#endregion
 //#region src/compat/ir.d.ts
 /** Language identifier for emitter targets. */
-type LanguageId = 'node' | 'php' | 'python' | 'ruby' | 'go' | 'kotlin' | 'dotnet' | 'elixir' | 'rust';
+type LanguageId = 'node' | 'php' | 'python' | 'ruby' | 'go' | 'kotlin' | 'dotnet' | 'elixir' | 'rust' | 'ios';
 /** A full compatibility snapshot of an SDK's public API surface. */
 interface CompatSnapshot {
   schemaVersion: string;
@@ -64,6 +64,10 @@ interface CompatSymbol {
   typeRef?: CompatTypeRef;
   /** Value for enum member symbols. */
   value?: string | number;
+  /** Whether a callable is a static/type-level method. Absent when the
+   *  extractor does not capture staticness; the classifier only compares
+   *  it when both snapshots define it, so older snapshots never diff. */
+  isStatic?: boolean;
   /** Relative path to the source file where this symbol is defined. */
   sourceFile?: string;
 }
@@ -131,6 +135,10 @@ interface ApiMethod {
   params: ApiParam[];
   returnType: string;
   async: boolean;
+  /** Whether this is a static/type-level method. Absent when the extractor
+   *  does not capture staticness; the differ only compares it when both
+   *  sides define it. */
+  isStatic?: boolean;
 }
 interface ApiParam {
   name: string;
@@ -275,7 +283,7 @@ interface DiffResult {
 //#endregion
 //#region src/compat/config.d.ts
 /** Breaking change categories — changes that break callers. */
-type BreakingChangeCategory = 'symbol_removed' | 'symbol_renamed' | 'parameter_removed' | 'parameter_renamed' | 'parameter_requiredness_increased' | 'parameter_type_narrowed' | 'parameter_position_changed_order_sensitive' | 'constructor_position_changed_order_sensitive' | 'named_arg_name_removed' | 'keyword_name_removed' | 'overload_removed' | 'union_wrapper_migration_without_compat_alias' | 'field_type_changed' | 'return_type_changed' | 'enum_member_value_changed';
+type BreakingChangeCategory = 'symbol_removed' | 'symbol_renamed' | 'parameter_removed' | 'parameter_renamed' | 'parameter_requiredness_increased' | 'parameter_type_narrowed' | 'parameter_position_changed_order_sensitive' | 'constructor_position_changed_order_sensitive' | 'named_arg_name_removed' | 'keyword_name_removed' | 'overload_removed' | 'union_wrapper_migration_without_compat_alias' | 'field_type_changed' | 'return_type_changed' | 'enum_member_value_changed' | 'staticness_changed';
 /** Soft-risk change categories — may affect callers depending on usage. */
 type SoftRiskChangeCategory = 'parameter_added_non_terminal_optional' | 'constructor_reordered_named_friendly' | 'default_value_changed' | 'wrapper_stricter_than_previous_sdk_but_matches_spec' | 'doc_surface_drift';
 /** Additive change categories — safe to ship. */
@@ -802,4 +810,4 @@ interface SuccessResponse {
 }
 //#endregion
 export { AdditiveChangeCategory as $, collectEnumRefs as A, CompatSnapshot as At, ErrorPolicy as B, ALL_LANGUAGE_IDS as Bt, Service as C, MethodOverlay as Ct, UnionType as D, ViolationSeverity as Dt, TypeRef as E, ViolationCategory as Et, validateModelHints as F, CompatTypeRef as Ft, RequestGuardPolicy as G, LogEvent as H, getDefaultPolicy as Ht, walkTypeRef as I, CompatVisibility as It, TelemetryPolicy as J, RetryPolicy as K, AiAgentEnvVar as L, LanguageId as Lt, collectModelRefs as M, CompatStability as Mt, collectRequestBodyModels as N, CompatSymbol as Nt, assertNever as O, CompatParameter as Ot, mapTypeRef as P, CompatSymbolKind as Pt, mergeSdkBehavior as Q, BackoffStrategy as R, ParameterSensitivity as Rt, ServerEntry as S, LanguageHints as St, TypeParam as T, Violation as Tt, LoggingPolicy as U, mergePolicy as Ut, IdempotencyPolicy as V, CompatPolicyHints as Vt, PaginationPolicy as W, UserAgentPolicy as X, TimeoutPolicy as Y, defaultSdkBehavior as Z, Parameter as _, ApiProperty as _t, EnumRef as a, CompatFailLevel as at, PrimitiveType as b, DiffResult as bt, Field as c, defaultSeverityForCategory as ct, MapType as d, ApiClass as dt, BreakingChangeCategory as et, Model as f, ApiEnum as ft, PaginationMeta as g, ApiParam as gt, Operation as h, ApiMethod as ht, Enum as i, CompatConfig as it, collectFieldDependencies as j, CompatSourceKind as jt, assignModelsToServices as k, CompatPassingStyle as kt, HttpMethod as l, severityMeetsThreshold as lt, NullableType as m, ApiInterface as mt, ArrayType as n, CompatChangeCategory as nt, EnumValue as o, CompatProvenance as ot, ModelRef as p, ApiField as pt, SdkBehavior as q, AuthScheme as r, CompatChangeSeverity as rt, ErrorResponse as s, SoftRiskChangeCategory as st, ApiSpec as t, CompatApproval as tt, LiteralType as u, Addition as ut, ParameterGroup as v, ApiSurface as vt, SuccessResponse as w, OverlayLookup as wt, SecurityRequirement as x, Extractor as xt, ParameterGroupVariant as y, ApiTypeAlias as yt, DeepPartial as z, apiSurfaceToSnapshot as zt };
-//# sourceMappingURL=types-owWZiSwD.d.mts.map
+//# sourceMappingURL=types-CIAqYpcV.d.mts.map

package/dist/types-CIAqYpcV.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-CIAqYpcV.d.mts","names":[],"sources":["../src/compat/policy.ts","../src/compat/ir.ts","../src/compat/types.ts","../src/compat/config.ts","../src/ir/sdk-behavior.ts","../src/ir/types.ts"],"mappings":";;UAWiB,iBAAA;EAYf;EAVA,oBAAA;EAUgB;EARhB,uBAAA;EAkG8B;EAhG9B,gCAAA;EAgGuE;EA9FvE,qCAAA;EA8F+B;EA5F/B,qBAAA;EA4FuE;EA1FvE,gBAAA;AAAA;;iBA0Fc,gBAAA,CAAiB,QAAA,EAAU,UAAA,GAAa,iBAAA;;iBAKxC,WAAA,CAAY,QAAA,EAAU,iBAAA,EAAmB,SAAA,EAAW,OAAA,CAAQ,iBAAA,IAAqB,iBAAA;;cAKpF,gBAAA,WAA2B,UAAA;;;;KChH5B,UAAA;;UAGK,cAAA;EACf,aAAA;EACA,MAAA;IACE,OAAA;IACA,WAAA;EAAA;EAEF,QAAA,EAAU,iBAAA;EACV,OAAA,EAAS,YAAA;AAAA;;KAIC,gBAAA;AD6FZ;AAAA,KClFY,gBAAA;;KAGA,eAAA;;KAGA,gBAAA;;UAQK,YAAA;EACf,EAAA;EACA,IAAA,EAAM,gBAAA;EACN,MAAA;EACA,WAAA;EACA,WAAA;EACA,UAAA,EAAY,gBAAA;EACZ,SAAA,EAAW,eAAA;EACX,UAAA,EAAY,gBAAA;EACZ,WAAA;EACA,UAAA;EACA,KAAA;IACE,MAAA;IACA,IAAA;EAAA;EAEF,UAAA,GAAa,eAAA;EACb,OAAA,GAAU,aAAA;;EAEV,OAAA,GAAU,aAAA;EAzDU;EA2DpB,KAAA;EA3DoB;;AAGtB;EA4DE,QAAA;;EAEA,UAAA;AAAA;;KAIU,kBAAA;;UASK,eAAA;EACf,UAAA;EACA,QAAA;EACA,QAAA;EACA,QAAA;EACA,QAAA;EACA,UAAA;EACA,OAAA,EAAS,kBAAA;EACT,IAAA,EAAM,aAAA;EACN,WAAA,EAAa,oBAAA;AAAA;AA9Df;AAAA,UAkEiB,oBAAA;EACf,KAAA;EACA,UAAA;EACA,YAAA;EACA,IAAA;AAAA;;UAIe,aAAA;EACf,IAAA;EACA,QAAA;EACA,KAAA;EACA,OAAA;AAAA;AAhEF;;;;;;AAAA,iBAiFgB,oBAAA,CAAqB,OAAA,EAAS,UAAA,GAAa,cAAA;;;UCnI1C,UAAA;EACf,QAAA;EACA,aAAA;EACA,WAAA;EACA,OAAA,EAAS,MAAA,SAAe,QAAA;EACxB,UAAA,EAAY,MAAA,SAAe,YAAA;EAC3B,WAAA,EAAa,MAAA,SAAe,YAAA;EAC5B,KAAA,EAAO,MAAA,SAAe,OAAA;EACtB,OAAA,EAAS,MAAA;AAAA;AAAA,UAGM,QAAA;EACf,IAAA;EACA,UAAA;EACA,OAAA,EAAS,MAAA,SAAe,SAAA;EACxB,UAAA,EAAY,MAAA,SAAe,WAAA;EAC3B,iBAAA,EAAmB,QAAA;EFiGoD;;;;EE5FvE,kBAAA;AAAA;AAAA,UAGe,SAAA;EACf,IAAA;EACA,MAAA,EAAQ,QAAA;EACR,UAAA;EACA,KAAA;EF0FkE;;;EEtFlE,QAAA;AAAA;AAAA,UAGe,QAAA;EACf,IAAA;EACA,IAAA;EACA,QAAA;EFgF+F;;EE7E/F,YAAA,GANuB,kBAAA;AAAA;AAAA,UASR,WAAA;EACf,IAAA;EACA,IAAA;EACA,QAAA;AAAA;AAAA,UAGe,YAAA;EACf,IAAA;EACA,UAAA;EACA,MAAA,EAAQ,MAAA,SAAe,QAAA;EACvB,OAAA;ED3CoB;EC6CpB,oBAAA;AAAA;AAAA,UAGe,QAAA;EACf,IAAA;EACA,IAAA;EACA,QAAA;AAAA;AAAA,UAGe,YAAA;EACf,IAAA;EACA,UAAA;EACA,KAAA;AAAA;AAAA,UAGe,OAAA;EACf,IAAA;EACA,UAAA;EACA,OAAA,EAAS,MAAA;AAAA;AAAA,UAGM,aAAA;EDpDW;;AAW5B;;EC8CE,aAAA,CAAc,IAAA;ED9CY;ECiD1B,wBAAA,CAAyB,CAAA,UAAW,CAAA;ED9C1B;ECiDV,cAAA,CAAe,CAAA,UAAW,CAAA;;EAG1B,kBAAA,CAAmB,IAAA;EDpDM;AAG3B;ECqDE,oBAAA,CAAqB,IAAA;;;EAIrB,wBAAA;EDjDe;;ECqDf,qBAAA,CAAsB,UAAA;EDnDhB;ECsDN,oBAAA,CAAqB,SAAA;EDjDV;;;ECsDX,oBAAA,CAAqB,YAAA,UAAsB,SAAA;ED3CjC;;;ECgDV,iBAAA,CAAkB,SAAA;EDhElB;;;;;ECuEA,gBAAA,EAAkB,YAAA,UAAsB,aAAA,UAAuB,gBAAA,EAAkB,UAAA;EDnErE;;;;;EC0EZ,qBAAA,EAAuB,QAAA,EAAU,SAAA,EAAW,SAAA,EAAW,SAAA,EAAW,gBAAA,EAAkB,UAAA;EDtEpF;;;EC2EA,gBAAA;EDtEA;;EC0EA,oBAAA;EDzEU;;;EC8EV,oBAAA;AAAA;AAAA,UAGe,SAAA;EACf,QAAA;EACA,OAAA,CAAQ,OAAA,WAAkB,OAAA,CAAQ,UAAA;EAClC,eAAA,CAAgB,OAAA,WAAkB,OAAA,CADD,cAAA;EAEjC,KAAA,EAAO,aAAA;AAAA;AAAA,UAGQ,aAAA;EACf,SAAA;EACA,UAAA;EACA,MAAA,EAAQ,QAAA;EACR,UAAA;AAAA;AAAA,UAGe,aAAA;ED/DF;ECiEb,iBAAA,EAAmB,GAAA,SAAY,aAAA;EDjEE;ECmEjC,eAAA,EAAiB,GAAA;ED1EjB;EC4EA,eAAA,EAAiB,GAAA;ED1EjB;EC4EA,eAAA,EAAiB,GAAA;ED1EjB;EC4EA,eAAA,EAAiB,GAAA,SAAY,GAAA;ED3EpB;EC6ET,aAAA,EAAe,GAAA;ED5ET;EC8EN,YAAA,EAAc,GAAA;AAAA;AAAA,KAGJ,iBAAA;AAAA,KACA,iBAAA;AAAA,UAEK,SAAA;EACf,QAAA,EAAU,iBAAA;EACV,QAAA,EAAU,iBAAA;EACV,UAAA;EACA,QAAA;EACA,SAAA;EACA,OAAA;AAAA;AAAA,UAGe,QAAA;EACf,UAAA;EACA,UAAA;AAAA;AAAA,UAGe,UAAA;EACf,iBAAA;EACA,oBAAA;EACA,gBAAA;EACA,UAAA,EAAY,SAAA;EACZ,SAAA,EAAW,QAAA;AAAA;;;;KCxLD,sBAAA;;KAmBA,sBAAA;AH8EZ;AAAA,KGtEY,sBAAA;;KAOA,oBAAA,GAAuB,sBAAA,GAAyB,sBAAA,GAAyB,sBAAA;;KAGzE,oBAAA;;KAGA,gBAAA;;KAeA,eAAA;;UAOK,cAAA;EHwCqB;EGtCpC,MAAA;EHsCkE;EGpClE,QAAA,EAAU,oBAAA;EHoCsG;EGlChH,SAAA,GAAY,UAAA;EHkCwB;EGhCpC,KAAA;IACE,SAAA;IACA,MAAA;IACA,OAAA;IACA,OAAA;EAAA;EH4B8G;EGzBhH,mBAAA;EH8BmG;EG5BnG,MAAA;EH4BsC;EG1BtC,KAAA;;EAEA,mBAAA;;EAEA,QAAA;AAAA;;UAQe,YAAA;EFlGK;EEoGpB,MAAA,GAAS,eAAA;EFjGoB;EEmG7B,UAAA;EF5FqB;EE8FrB,OAAA;EFnGA;EEqGA,YAAA;EFnGE;EEqGF,cAAA,GAAiB,OAAA,CAAQ,MAAA,CAAO,UAAA,EAAY,OAAA,CAAQ,iBAAA;EFnG1C;EEqGV,KAAA,GAAQ,cAAA;AAAA;;iBAmCM,0BAAA,CAA2B,QAAA,EAAU,oBAAA,GAAuB,oBAAA;AFnI5E;AAAA,iBE0IgB,sBAAA,CAAuB,QAAA,EAAU,oBAAA,EAAsB,SAAA,EAAW,eAAA;;;;AHxJlF;;;;;;;;UICiB,WAAA;EJWf;EITA,oBAAA;EJSgB;EIPhB,UAAA;EJiG8B;EI/F9B,sBAAA;EJ+FuE;EI7FvE,cAAA;EJ6F+B;EI3F/B,OAAA,EAAS,eAAA;AAAA;;AJgGX;;;;UIxFiB,eAAA;EJwFmD;EItFlE,YAAA;EJsFgH;EIpFhH,UAAA;EJoFoC;EIlFpC,QAAA;EJkFkE;EIhFlE,YAAA;AAAA;;UAMe,WAAA;EJ0EiG;AAKlH;EI5EE,aAAA,EAAe,MAAA;;EAEf,eAAA;EJ0EgD;EIxEhD,eAAA;;EAEA,mBAAA;AAAA;;UAMe,eAAA;EHhDK;EGkDpB,gBAAA;EH/Ce;EGiDf,UAAA;;EAEA,eAAA;AAAA;;UAMe,gBAAA;EHrDb;EGuDF,eAAA;AAAA;;UAMe,iBAAA;EH1DM;EG4DrB,UAAA;EHxDU;EG0DV,mBAAA;AAAA;;UAMe,aAAA;EHrDL;EGuDV,OAAA;;EAEA,MAAA,EAAQ,QAAA;AAAA;AHtDV;AAAA,KG0DY,QAAA;;UAWK,eAAA;EHrEU;AAG3B;;;EGuEE,qBAAA;EHvE0B;EGyE1B,qBAAA;EHjE2B;EGmE3B,YAAA;EHjEM;EGmEN,cAAA,EAAgB,aAAA;AAAA;;UAID,aAAA;EHzDL;EG2DV,MAAA;EHzDuB;EG2DvB,SAAA;AAAA;;UAMe,kBAAA;EHhFf;;EGmFA,UAAA;AAAA;;UAMe,aAAA;EHrFJ;EGuFX,qBAAA;EHtFY;EGwFZ,aAAA;AAAA;;;UAOe,WAAA;EACf,KAAA,EAAO,WAAA;EACP,MAAA,EAAQ,WAAA;EACR,SAAA,EAAW,eAAA;EACX,UAAA,EAAY,gBAAA;EACZ,WAAA,EAAa,iBAAA;EACb,OAAA,EAAS,aAAA;EACT,SAAA,EAAW,eAAA;EACX,YAAA,EAAc,kBAAA;EACd,OAAA,EAAS,aAAA;AAAA;;AHlFX;;;;;AASA;;;;;;;;iBG4FgB,kBAAA,CAAA,GAAsB,WAAA;;KAqF1B,WAAA,oBACE,CAAA,IAAK,CAAA,CAAE,CAAA,wBACf,CAAA,KACA,CAAA,CAAE,CAAA,mBACA,WAAA,CAAY,CAAA,CAAE,CAAA,KACd,CAAA,CAAE,CAAA;;;;;;iBAQM,gBAAA,CAAiB,SAAA,EAAW,WAAA,CAAY,WAAA,IAAe,WAAA;;;AJ5QvE;AAAA,KKRY,UAAA;EACN,IAAA;AAAA;EACA,IAAA;EAAgB,EAAA;EAAmC,IAAA;AAAA;EACnD,IAAA;EAAgB,KAAA,EAAO,MAAA;AAAA;;AL2G7B;AAAA,UKvGiB,WAAA;EACf,GAAA;EACA,WAAA;AAAA;;UAIe,OAAA;EACf,IAAA;EACA,OAAA;EACA,WAAA;EACA,OAAA;EACA,OAAA,GAAU,WAAA;EACV,QAAA,EAAU,OAAA;EACV,MAAA,EAAQ,KAAA;EACR,KAAA,EAAO,IAAA;EACP,IAAA,GAAO,UAAA;EL6FyG;EK3FhH,GAAA,EAAK,WAAA;AAAA;;UAIU,OAAA;EACf,IAAA;EACA,WAAA;EACA,UAAA,EAAY,SAAA;AAAA;;ALyFd;AAAA,UKpFiB,mBAAA;EACf,UAAA;EACA,MAAA;AAAA;AAAA,UAGe,SAAA;EACf,IAAA;EACA,WAAA;EACA,UAAA,EAAY,UAAA;EACZ,IAAA;EACA,UAAA,EAAY,SAAA;EACZ,WAAA,EAAa,SAAA;EACb,YAAA,EAAc,SAAA;EACd,YAAA,GAAe,SAAA;EACf,WAAA,GAAc,OAAA;EACd,mBAAA;EACA,QAAA,EAAU,OAAA;EACV,gBAAA,GAAmB,eAAA;EACnB,MAAA,EAAQ,aAAA;EACR,UAAA,GAAa,cAAA;EACb,oBAAA;EACA,UAAA;EACA,KAAA;EJxCA;EI0CA,QAAA,GAAW,mBAAA;EJ1CU;;AAIvB;;;;;EI8CE,eAAA,GAAkB,cAAA;AAAA;;;;AJhCpB;UIuCiB,cAAA;;EAEf,IAAA;EJzCyB;EI2CzB,QAAA;EJxC0B;EI0C1B,QAAA,EAAU,qBAAA;AAAA;;AJlCZ;;UIwCiB,qBAAA;EJtCT;EIwCN,IAAA;EJnCW;;;;;EIyCX,UAAA,EAAY,SAAA;AAAA;;UAIG,cAAA;EACf,QAAA;EACA,KAAA;EACA,UAAA;EACA,QAAA;EACA,QAAA,EAAU,OAAA;AAAA;AAAA,KAGA,UAAA;AAAA,UAEK,SAAA;EACf,IAAA;EACA,IAAA,EAAM,OAAA;EACN,QAAA;EACA,WAAA;EACA,UAAA;EACA,OAAA;EACA,OAAA;EACA,KAAA;EACA,OAAA;AAAA;;KAIU,OAAA,GAAU,aAAA,GAAgB,SAAA,GAAY,QAAA,GAAW,OAAA,GAAU,SAAA,GAAY,YAAA,GAAe,WAAA,GAAc,OAAA;AAAA,UAE/F,aAAA;EACf,IAAA;EACA,IAAA;EACA,MAAA;AAAA;AAAA,UAGe,SAAA;EACf,IAAA;EACA,KAAA,EAAO,OAAA;AAAA;AAAA,UAGQ,QAAA;EACf,IAAA;EACA,IAAA;AAAA;AAAA,UAGe,OAAA;EACf,IAAA;EACA,IAAA;EACA,MAAA;AAAA;AAAA,UAGe,WAAA;EACf,IAAA;EACA,KAAA;AAAA;AAAA,UAGe,SAAA;EACf,IAAA;EACA,QAAA,EAAU,OAAA;EACV,aAAA;IAAkB,QAAA;IAAkB,OAAA,EAAS,MAAA;EAAA;EJ3D7C;;EI8DA,eAAA;AAAA;AAAA,UAGe,YAAA;EACf,IAAA;EACA,KAAA,EAAO,OAAA;AAAA;AAAA,UAGQ,OAAA;EACf,IAAA;EACA,SAAA,EAAW,OAAA;EACX,OAAA,GAAU,OAAA;AAAA;;AJ7DZ;;;;UIqEiB,SAAA;EACf,IAAA;EJnEA;EIqEA,OAAA,GAAU,OAAA;AAAA;;UAIK,KAAA;EACf,IAAA;EACA,WAAA;EACA,MAAA,EAAQ,KAAA;EJ1DoC;EI4D5C,UAAA,GAAa,SAAA;EJ5D4C;;;;;;EImEzD,aAAA;IACE,QAAA;IACA,OAAA,EAAS,MAAA;EAAA;AAAA;AAAA,UAII,KAAA;EACf,IAAA;EHvM4B;;;;;;;;EGgN5B,UAAA;EACA,IAAA,EAAM,OAAA;EACN,QAAA;EACA,WAAA;EACA,QAAA;EACA,SAAA;EACA,UAAA;EACA,OAAA;EACA,OAAA;AAAA;;UAIe,IAAA;EACf,IAAA;EACA,MAAA,EAAQ,SAAA;EH5NR;EG8NA,OAAA;AAAA;AAAA,UAGe,SAAA;EACf,IAAA;EACA,KAAA;EACA,WAAA;EACA,UAAA;AAAA;;;;;;;;;;;;;;iBAgBc,WAAA,CAAY,CAAA;;;;;AHrO5B;;iBGqPgB,WAAA,CACd,GAAA,EAAK,OAAA,EACL,OAAA;EACE,KAAA,IAAS,GAAA,EAAK,QAAA;EACd,IAAA,IAAQ,GAAA,EAAK,OAAA;EACb,SAAA,IAAa,GAAA,EAAK,aAAA;EAClB,OAAA,IAAW,GAAA,EAAK,WAAA;AAAA;;;;;AHhPpB;;iBGwRgB,UAAA,GAAA,CACd,GAAA,EAAK,OAAA,EACL,MAAA;EACE,SAAA,GAAY,GAAA,EAAK,aAAA,KAAkB,CAAA;EACnC,KAAA,GAAQ,GAAA,EAAK,SAAA,EAAW,WAAA,EAAa,CAAA,KAAM,CAAA;EAC3C,KAAA,GAAQ,GAAA,EAAK,QAAA,KAAa,CAAA;EAC1B,IAAA,GAAO,GAAA,EAAK,OAAA,KAAY,CAAA;EACxB,KAAA,GAAQ,GAAA,EAAK,SAAA,EAAW,cAAA,EAAgB,CAAA,OAAQ,CAAA;EAChD,QAAA,GAAW,GAAA,EAAK,YAAA,EAAc,WAAA,EAAa,CAAA,KAAM,CAAA;EACjD,OAAA,GAAU,GAAA,EAAK,WAAA,KAAgB,CAAA;EAC/B,GAAA,GAAM,GAAA,EAAK,OAAA,EAAS,WAAA,EAAa,CAAA,EAAG,SAAA,GAAY,CAAA,KAAM,CAAA;AAAA,IAEvD,CAAA;;;;iBAmCa,gBAAA,CAAiB,GAAA,EAAK,OAAA;;;;iBAStB,eAAA,CAAgB,GAAA,EAAK,OAAA;AHjUrC;;;;AAAA,iBG2UgB,wBAAA,CAAyB,KAAA,EAAO,KAAA;EAC9C,MAAA,EAAQ,GAAA;EACR,KAAA,EAAO,GAAA;AAAA;;;;;;AHpUT;;;;;;;;;iBGmWgB,sBAAA,CACd,MAAA,EAAQ,KAAA,IACR,QAAA,EAAU,OAAA,IACV,KAAA,GAAQ,MAAA,mBACP,GAAA;;;;;;;iBAuEa,kBAAA,CAAmB,MAAA,EAAQ,KAAA,IAAS,QAAA,EAAU,OAAA,IAAW,KAAA,EAAO,MAAA;;AHlahF;;iBG0bgB,wBAAA,CAAyB,QAAA,EAAU,OAAA,KAAY,GAAA;AAAA,UAc9C,aAAA;EACf,UAAA;EACA,IAAA,GAAO,OAAA;AAAA;;UAIQ,eAAA;EACf,UAAA;EACA,IAAA,EAAM,OAAA;AAAA"}

package/dist/verify/index.d.mts

@@ -1,5 +1,5 @@
-import { Tt as Violation, Vt as CompatPolicyHints, t as ApiSpec, vt as ApiSurface } from "../types-owWZiSwD.mjs";
-import { t as CompatDiffResult } from "../differ-HVvbbyUV.mjs";
+import { Tt as Violation, Vt as CompatPolicyHints, t as ApiSpec, vt as ApiSurface } from "../types-CIAqYpcV.mjs";
+import { t as CompatDiffResult } from "../differ-BoYl2n6Y.mjs";
 
 //#region src/verify/types.d.ts
 interface VerifyDiagnostics {

package/dist/verify/index.mjs

@@ -1,6 +1,6 @@
 import { m as CommandError } from "../tree-sitter-C6HB4OrC.mjs";
 import { a as MANIFEST_FILENAME, i as generate, n as getEmitter, t as diffSpecs } from "../diff-B9wlNAVX.mjs";
-import { A as getDefaultPolicy, T as apiSurfaceToSnapshot, c as filterSurface, f as specDerivedMethodPaths, i as getExtractor, j as mergePolicy, l as specDerivedEnumValues, n as isPatchableChange, o as diffSnapshots, p as specDerivedNames, r as patchOverlay, t as buildOverlayLookup, u as specDerivedFieldPaths } from "../overlay-DcvsIx5P.mjs";
+import { A as getDefaultPolicy, T as apiSurfaceToSnapshot, c as filterSurface, f as specDerivedMethodPaths, i as getExtractor, j as mergePolicy, l as specDerivedEnumValues, n as isPatchableChange, o as diffSnapshots, p as specDerivedNames, r as patchOverlay, t as buildOverlayLookup, u as specDerivedFieldPaths } from "../overlay-jsSkFJ2g.mjs";
 import * as path$1 from "node:path";
 import { fileURLToPath } from "node:url";
 import { execFileSync } from "node:child_process";

package/docs/agents/emitters.md

@@ -34,6 +34,23 @@ Language-specific extras already exist in some emitters:
 
 IR names use PascalCase. Each emitter is responsible for converting names through its local `naming.ts`.
 
+## Escaping Spec-Controlled Free-Text
+
+Free-text spec fields (schema/field/operation `description`, and `info.title`, which becomes the default namespace) are **attacker-influenceable data**. Interpolating them verbatim into generated source lets a crafted spec break out of the syntactic context and emit arbitrary top-level code — which then runs when the generated files are imported during `oagen generate` → `oagen verify`, and ships to consumers if published.
+
+The core package exports two helpers for this. Apply them at **every** site where spec free-text is interpolated into output:
+
+- `escapeBlockComment(text)` — neutralizes `*/` before it goes inside a `/** ... */` doc comment.
+- `sanitizeIdentifier(text)` — strips characters that would break out of an identifier position (e.g. a class name built from the namespace). Already-valid identifiers pass through unchanged.
+
+Both helpers are **JS/TS-block-comment / JS-identifier specific**. Emitters for other languages must apply language-appropriate escaping instead of, or in addition to, these:
+
+- Python docstrings (`"""`) — escape/neutralize an embedded `"""`.
+- Ruby (`=begin`/`=end`, `#`) and other line-comment styles — a newline in the text can start a new source line; escape newlines or emit one comment marker per line.
+- Kotlin/Java KDoc/Javadoc (`/** */`) — same terminator hazard as `escapeBlockComment`.
+
+When adding a new interpolation site, treat "does this field originate from the spec?" as the trigger for escaping — not "is this field usually a description?".
+
 ## Verifying Backwards Compatibility
 
 When regenerating an SDK for a language that already has a published SDK, verify that the generated output preserves the existing public API surface.

package/examples/reference-emitter/src/generators/client.ts

@@ -1,9 +1,13 @@
 import type { ApiSpec, GeneratedFile, EmitterContext } from '@workos/oagen';
+import { sanitizeIdentifier } from '@workos/oagen';
 import { tsClassName } from '../naming.js';
 
 export function generateClient(spec: ApiSpec, ctx: EmitterContext): GeneratedFile[] {
   const lines: string[] = [];
-  const className = `${ctx.namespacePascal}Client`;
+  // `namespacePascal` defaults to the spec's `info.title` when no explicit
+  // namespace is given — attacker-influenceable free-text flowing into an
+  // identifier position. Sanitize it so it cannot break out of the class name.
+  const className = `${sanitizeIdentifier(ctx.namespacePascal)}Client`;
 
   // Import resources
   for (const service of spec.services) {

package/examples/reference-emitter/src/generators/models.ts

@@ -1,4 +1,5 @@
 import type { Model, GeneratedFile, EmitterContext } from '@workos/oagen';
+import { escapeBlockComment } from '@workos/oagen';
 import { tsTypeName, tsPropertyName } from '../naming.js';
 import { toTsType } from '../type-mapper.js';
 
@@ -9,7 +10,7 @@ export function generateModels(models: Model[], _ctx: EmitterContext): Generated
 
   for (const model of models) {
     if (model.description) {
-      lines.push(`/** ${model.description} */`);
+      lines.push(`/** ${escapeBlockComment(model.description)} */`);
     }
     lines.push(`export interface ${tsTypeName(model.name)} {`);
     for (const field of model.fields) {
@@ -17,7 +18,7 @@ export function generateModels(models: Model[], _ctx: EmitterContext): Generated
       const tsType = toTsType(field.type);
       const optional = field.required ? '' : '?';
       if (field.description) {
-        lines.push(`  /** ${field.description} */`);
+        lines.push(`  /** ${escapeBlockComment(field.description)} */`);
       }
       lines.push(`  ${tsName}${optional}: ${tsType};`);
     }

package/examples/reference-emitter/src/generators/resources.ts

@@ -1,5 +1,5 @@
 import type { Service, GeneratedFile, EmitterContext } from '@workos/oagen';
-import { planOperation } from '@workos/oagen';
+import { planOperation, escapeBlockComment } from '@workos/oagen';
 import { tsClassName, tsMethodName } from '../naming.js';
 import { toTsType } from '../type-mapper.js';
 
@@ -39,7 +39,7 @@ export function generateResources(services: Service[], _ctx: EmitterContext): Ge
       const asyncPrefix = plan.isAsync ? 'async ' : '';
 
       if (op.description) {
-        lines.push(`  /** ${op.description} */`);
+        lines.push(`  /** ${escapeBlockComment(op.description)} */`);
       }
       lines.push(`  ${asyncPrefix}${method}(${paramStr}): Promise<${returnType}> {`);
       lines.push(`    // Production emitters generate real HTTP calls here`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@workos/oagen",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Framework for building OpenAPI SDK emitters",
   "author": "WorkOS",
   "license": "MIT",

package/skills/check-emitter-parity/SKILL.md

@@ -148,6 +148,17 @@ Use `Grep` with patterns like `\.description`, `\.readOnly`, `\.writeOnly`, `\.d
 
 If the emitter source contains comments like `// @oagen-ignore: <field>` or similar documented justifications for skipping a field, mark those fields as "intentionally skipped" rather than "missing." These are acceptable gaps — not every field applies to every language.
 
+### 3d: Free-Text Escaping (security)
+
+Spec free-text fields (`description` on model/field/operation/parameter/enum-value, and `info.title` when it becomes the namespace) are attacker-influenceable. An emitter that interpolates them verbatim into output can be made to emit arbitrary source — a code-execution vector during `oagen generate` → `oagen verify` and in published SDKs.
+
+For every covered free-text field, check that the emitter escapes it at the interpolation site:
+
+- **Doc comments** — the field must be wrapped so a comment terminator cannot break out. The core exports `escapeBlockComment` for JS/TS-style `/** */` comments; it is **specific to languages whose block comments end at `*/`** (JS, TS, Java, C#, Kotlin, Go). Emitters for other comment syntaxes need their own escaping: Python `"""` docstrings, Ruby `#`/`=begin` and other line-comment styles (where an embedded newline starts a new source line), etc.
+- **Identifier positions** — free-text flowing into a class/variable name (notably `info.title` → namespace → client class) must be run through `sanitizeIdentifier` (or an equivalent) so it cannot break out of the declaration.
+
+Report a covered-but-unescaped free-text field as a **HIGH-priority security gap**, distinct from a missing-coverage gap: the field is handled, but unsafely.
+
 ## Step 4: Produce Gap Analysis
 
 Output a structured report grouped by priority tier: