Add managed auth region controls

[tnsardesai]

Summary

• add browser_region to managed auth create, update, and login actions
• add region to secure managed auth login and reauth flows
• return the effective region in sanitized managed auth state

Validation

• bunx tsc --noEmit
• bun test (454 passing)
• bun run check:managed-auth-app

---

Note

Low Risk
Documentation-only change in the provided diff; it describes additive region configuration and does not alter auth or credential handling.

Overview
This PR documents where managed-auth browsers run: callers can set region on open_auth_login (and secure login/reauth) or browser_region on manage_auth_connections create, update, and login.

Create/update set the connection’s default region; login/reauth can override for that flow only. Omit on create to default to us-east; omit on update or login to keep or inherit the connection default. The README adds this alongside the existing session-recording and browser-telemetry notes.

^{Reviewed by Cursor Bugbot for commit 5ebf88d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
mcp	Ready	Preview	Sep 15, 2026 7:58pm UTC

[masnwilliams]

implementation looks good. the region forwarding is direct, the defaulting behavior is explicit, and the create/update/login paths are covered by tests.

non-blocking: the region literals and local SDK compatibility type are now duplicated across a few files. once the SDK dependency is updated to expose managed-auth browser regions, it would be worth deriving these from one shared contract and removing the cast. that can be handled separately and should not block this change.