@agent-deck/shared 1.6.4 → 1.7.0

package/dist/constants/trusted-session.d.ts

@@ -0,0 +1,15 @@
+/** Bearer token presented by the trusted MCP launcher (raw grant secret). */
+export declare const AGENT_DECK_GRANT_AUTH_SCHEME = "Bearer";
+/** Runtime session id returned to MCP layer after grant authentication. */
+export declare const AGENT_DECK_SESSION_HEADER = "x-agent-deck-session-id";
+/** Dashboard session cookie name. */
+export declare const AGENT_DECK_DASHBOARD_COOKIE = "agent_deck_dashboard";
+/** Normal MCP session inactivity lease (PRD C3). */
+export declare const RUNTIME_SESSION_LEASE_MS: number;
+/** Agent-admin inactivity lease (PRD C4). */
+export declare const ADMIN_MODE_LEASE_MS: number;
+/** Admin elevation challenge validity (PRD C4). */
+export declare const ADMIN_CHALLENGE_TTL_MS: number;
+/** Dashboard bootstrap nonce validity. */
+export declare const DASHBOARD_NONCE_TTL_MS: number;
+//# sourceMappingURL=trusted-session.d.ts.map

package/dist/constants/trusted-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-session.d.ts","sourceRoot":"","sources":["../../src/constants/trusted-session.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,eAAO,MAAM,4BAA4B,WAAW,CAAC;AAErD,2EAA2E;AAC3E,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,qCAAqC;AACrC,eAAO,MAAM,2BAA2B,yBAAyB,CAAC;AAElE,oDAAoD;AACpD,eAAO,MAAM,wBAAwB,QAAsB,CAAC;AAE5D,6CAA6C;AAC7C,eAAO,MAAM,mBAAmB,QAAiB,CAAC;AAElD,mDAAmD;AACnD,eAAO,MAAM,sBAAsB,QAAgB,CAAC;AAEpD,0CAA0C;AAC1C,eAAO,MAAM,sBAAsB,QAAgB,CAAC"}

package/dist/constants/trusted-session.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DASHBOARD_NONCE_TTL_MS = exports.ADMIN_CHALLENGE_TTL_MS = exports.ADMIN_MODE_LEASE_MS = exports.RUNTIME_SESSION_LEASE_MS = exports.AGENT_DECK_DASHBOARD_COOKIE = exports.AGENT_DECK_SESSION_HEADER = exports.AGENT_DECK_GRANT_AUTH_SCHEME = void 0;
+/** Bearer token presented by the trusted MCP launcher (raw grant secret). */
+exports.AGENT_DECK_GRANT_AUTH_SCHEME = 'Bearer';
+/** Runtime session id returned to MCP layer after grant authentication. */
+exports.AGENT_DECK_SESSION_HEADER = 'x-agent-deck-session-id';
+/** Dashboard session cookie name. */
+exports.AGENT_DECK_DASHBOARD_COOKIE = 'agent_deck_dashboard';
+/** Normal MCP session inactivity lease (PRD C3). */
+exports.RUNTIME_SESSION_LEASE_MS = 24 * 60 * 60 * 1000;
+/** Agent-admin inactivity lease (PRD C4). */
+exports.ADMIN_MODE_LEASE_MS = 30 * 60 * 1000;
+/** Admin elevation challenge validity (PRD C4). */
+exports.ADMIN_CHALLENGE_TTL_MS = 5 * 60 * 1000;
+/** Dashboard bootstrap nonce validity. */
+exports.DASHBOARD_NONCE_TTL_MS = 2 * 60 * 1000;
+//# sourceMappingURL=trusted-session.js.map

package/dist/constants/trusted-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-session.js","sourceRoot":"","sources":["../../src/constants/trusted-session.ts"],"names":[],"mappings":";;;AAAA,6EAA6E;AAChE,QAAA,4BAA4B,GAAG,QAAQ,CAAC;AAErD,2EAA2E;AAC9D,QAAA,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,qCAAqC;AACxB,QAAA,2BAA2B,GAAG,sBAAsB,CAAC;AAElE,oDAAoD;AACvC,QAAA,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5D,6CAA6C;AAChC,QAAA,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAElD,mDAAmD;AACtC,QAAA,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,0CAA0C;AAC7B,QAAA,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/dist/index.d.ts

@@ -9,11 +9,13 @@ export * from './schemas/deck-display';
 export * from './schemas/export-bundle';
 export * from './schemas/store';
 export * from './schemas/session-bootstrap';
+export * from './schemas/trusted-session';
 export * from './types/api';
 export { OAuthDiscoveryResult } from './types/oauth';
 export * from './utils';
 export { summarizeCollectionWarnings, getServiceWarnings, getCredentialWarnings, getPlaybookWarnings, primaryCollectionWarning, type CollectionCardWarning, type CollectionWarningKind, } from './utils/collection-warnings';
 export { normalizeLocalMcpManifestInput, parseLocalMcpManifestJson, stripJsonMarkdownFences, } from './utils/local-mcp-manifest';
 export { AGENT_DECK_CLIENT_HEADER, AGENT_DECK_DASHBOARD_CLIENT, AGENT_DECK_AGENT_CLIENT, AGENT_DECK_WORKSPACE_HEADER, AGENT_DECK_DECK_ID_HEADER, } from './constants/client-scope';
+export { AGENT_DECK_GRANT_AUTH_SCHEME, AGENT_DECK_SESSION_HEADER, AGENT_DECK_DASHBOARD_COOKIE, RUNTIME_SESSION_LEASE_MS, ADMIN_MODE_LEASE_MS, ADMIN_CHALLENGE_TTL_MS, DASHBOARD_NONCE_TTL_MS, } from './constants/trusted-session';
 export { MCP_CARD_COLOR, API_KEY_CARD_COLOR, PLAYBOOK_CARD_COLOR, getServiceCardColor } from './constants/card-colors';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAG5C,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAG1C,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,4BAA4B,EAC5B,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getServiceCardColor = exports.PLAYBOOK_CARD_COLOR = exports.API_KEY_CARD_COLOR = exports.MCP_CARD_COLOR = exports.AGENT_DECK_DECK_ID_HEADER = exports.AGENT_DECK_WORKSPACE_HEADER = exports.AGENT_DECK_AGENT_CLIENT = exports.AGENT_DECK_DASHBOARD_CLIENT = exports.AGENT_DECK_CLIENT_HEADER = exports.stripJsonMarkdownFences = exports.parseLocalMcpManifestJson = exports.normalizeLocalMcpManifestInput = exports.primaryCollectionWarning = exports.getPlaybookWarnings = exports.getCredentialWarnings = exports.getServiceWarnings = exports.summarizeCollectionWarnings = void 0;
+exports.getServiceCardColor = exports.PLAYBOOK_CARD_COLOR = exports.API_KEY_CARD_COLOR = exports.MCP_CARD_COLOR = exports.DASHBOARD_NONCE_TTL_MS = exports.ADMIN_CHALLENGE_TTL_MS = exports.ADMIN_MODE_LEASE_MS = exports.RUNTIME_SESSION_LEASE_MS = exports.AGENT_DECK_DASHBOARD_COOKIE = exports.AGENT_DECK_SESSION_HEADER = exports.AGENT_DECK_GRANT_AUTH_SCHEME = exports.AGENT_DECK_DECK_ID_HEADER = exports.AGENT_DECK_WORKSPACE_HEADER = exports.AGENT_DECK_AGENT_CLIENT = exports.AGENT_DECK_DASHBOARD_CLIENT = exports.AGENT_DECK_CLIENT_HEADER = exports.stripJsonMarkdownFences = exports.parseLocalMcpManifestJson = exports.normalizeLocalMcpManifestInput = exports.primaryCollectionWarning = exports.getPlaybookWarnings = exports.getCredentialWarnings = exports.getServiceWarnings = exports.summarizeCollectionWarnings = void 0;
 // Schemas (includes Zod-inferred types)
 __exportStar(require("./schemas/service"), exports);
 __exportStar(require("./schemas/deck"), exports);
@@ -27,6 +27,7 @@ __exportStar(require("./schemas/deck-display"), exports);
 __exportStar(require("./schemas/export-bundle"), exports);
 __exportStar(require("./schemas/store"), exports);
 __exportStar(require("./schemas/session-bootstrap"), exports);
+__exportStar(require("./schemas/trusted-session"), exports);
 // Additional types not covered by schemas
 __exportStar(require("./types/api"), exports);
 // Utils
@@ -48,6 +49,14 @@ Object.defineProperty(exports, "AGENT_DECK_DASHBOARD_CLIENT", { enumerable: true
 Object.defineProperty(exports, "AGENT_DECK_AGENT_CLIENT", { enumerable: true, get: function () { return client_scope_1.AGENT_DECK_AGENT_CLIENT; } });
 Object.defineProperty(exports, "AGENT_DECK_WORKSPACE_HEADER", { enumerable: true, get: function () { return client_scope_1.AGENT_DECK_WORKSPACE_HEADER; } });
 Object.defineProperty(exports, "AGENT_DECK_DECK_ID_HEADER", { enumerable: true, get: function () { return client_scope_1.AGENT_DECK_DECK_ID_HEADER; } });
+var trusted_session_1 = require("./constants/trusted-session");
+Object.defineProperty(exports, "AGENT_DECK_GRANT_AUTH_SCHEME", { enumerable: true, get: function () { return trusted_session_1.AGENT_DECK_GRANT_AUTH_SCHEME; } });
+Object.defineProperty(exports, "AGENT_DECK_SESSION_HEADER", { enumerable: true, get: function () { return trusted_session_1.AGENT_DECK_SESSION_HEADER; } });
+Object.defineProperty(exports, "AGENT_DECK_DASHBOARD_COOKIE", { enumerable: true, get: function () { return trusted_session_1.AGENT_DECK_DASHBOARD_COOKIE; } });
+Object.defineProperty(exports, "RUNTIME_SESSION_LEASE_MS", { enumerable: true, get: function () { return trusted_session_1.RUNTIME_SESSION_LEASE_MS; } });
+Object.defineProperty(exports, "ADMIN_MODE_LEASE_MS", { enumerable: true, get: function () { return trusted_session_1.ADMIN_MODE_LEASE_MS; } });
+Object.defineProperty(exports, "ADMIN_CHALLENGE_TTL_MS", { enumerable: true, get: function () { return trusted_session_1.ADMIN_CHALLENGE_TTL_MS; } });
+Object.defineProperty(exports, "DASHBOARD_NONCE_TTL_MS", { enumerable: true, get: function () { return trusted_session_1.DASHBOARD_NONCE_TTL_MS; } });
 var card_colors_1 = require("./constants/card-colors");
 Object.defineProperty(exports, "MCP_CARD_COLOR", { enumerable: true, get: function () { return card_colors_1.MCP_CARD_COLOR; } });
 Object.defineProperty(exports, "API_KEY_CARD_COLOR", { enumerable: true, get: function () { return card_colors_1.API_KEY_CARD_COLOR; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,wCAAwC;AACxC,oDAAkC;AAClC,iDAA+B;AAC/B,uDAAqC;AACrC,kDAAgC;AAChC,qDAAmC;AACnC,2DAAyC;AACzC,4DAA0C;AAC1C,yDAAuC;AACvC,0DAAwC;AACxC,kDAAgC;AAChC,8DAA4C;AAE5C,0CAA0C;AAC1C,8CAA4B;AAG5B,QAAQ;AACR,0CAAwB;AACxB,mEAQqC;AAPnC,kIAAA,2BAA2B,OAAA;AAC3B,yHAAA,kBAAkB,OAAA;AAClB,4HAAA,qBAAqB,OAAA;AACrB,0HAAA,mBAAmB,OAAA;AACnB,+HAAA,wBAAwB,OAAA;AAI1B,iEAIoC;AAHlC,oIAAA,8BAA8B,OAAA;AAC9B,+HAAA,yBAAyB,OAAA;AACzB,6HAAA,uBAAuB,OAAA;AAGzB,YAAY;AACZ,yDAMkC;AALhC,wHAAA,wBAAwB,OAAA;AACxB,2HAAA,2BAA2B,OAAA;AAC3B,uHAAA,uBAAuB,OAAA;AACvB,2HAAA,2BAA2B,OAAA;AAC3B,yHAAA,yBAAyB,OAAA;AAE3B,uDAAuH;AAA9G,6GAAA,cAAc,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAAE,kHAAA,mBAAmB,OAAA;AAAE,kHAAA,mBAAmB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,wCAAwC;AACxC,oDAAkC;AAClC,iDAA+B;AAC/B,uDAAqC;AACrC,kDAAgC;AAChC,qDAAmC;AACnC,2DAAyC;AACzC,4DAA0C;AAC1C,yDAAuC;AACvC,0DAAwC;AACxC,kDAAgC;AAChC,8DAA4C;AAC5C,4DAA0C;AAE1C,0CAA0C;AAC1C,8CAA4B;AAG5B,QAAQ;AACR,0CAAwB;AACxB,mEAQqC;AAPnC,kIAAA,2BAA2B,OAAA;AAC3B,yHAAA,kBAAkB,OAAA;AAClB,4HAAA,qBAAqB,OAAA;AACrB,0HAAA,mBAAmB,OAAA;AACnB,+HAAA,wBAAwB,OAAA;AAI1B,iEAIoC;AAHlC,oIAAA,8BAA8B,OAAA;AAC9B,+HAAA,yBAAyB,OAAA;AACzB,6HAAA,uBAAuB,OAAA;AAGzB,YAAY;AACZ,yDAMkC;AALhC,wHAAA,wBAAwB,OAAA;AACxB,2HAAA,2BAA2B,OAAA;AAC3B,uHAAA,uBAAuB,OAAA;AACvB,2HAAA,2BAA2B,OAAA;AAC3B,yHAAA,yBAAyB,OAAA;AAE3B,+DAQqC;AAPnC,+HAAA,4BAA4B,OAAA;AAC5B,4HAAA,yBAAyB,OAAA;AACzB,8HAAA,2BAA2B,OAAA;AAC3B,2HAAA,wBAAwB,OAAA;AACxB,sHAAA,mBAAmB,OAAA;AACnB,yHAAA,sBAAsB,OAAA;AACtB,yHAAA,sBAAsB,OAAA;AAExB,uDAAuH;AAA9G,6GAAA,cAAc,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAAE,kHAAA,mBAAmB,OAAA;AAAE,kHAAA,mBAAmB,OAAA"}

package/dist/schemas/deck-display.d.ts

@@ -20,6 +20,7 @@ export declare const LiveBindingSchema: z.ZodObject<{
     source: z.ZodEnum<["session_override", "env"]>;
     workspaceRoot: z.ZodOptional<z.ZodString>;
     clientName: z.ZodOptional<z.ZodString>;
+    mode: z.ZodOptional<z.ZodEnum<["normal", "agent-admin"]>>;
     cardCounts: z.ZodObject<{
         mcp: z.ZodNumber;
         credentials: z.ZodNumber;
@@ -49,6 +50,7 @@ export declare const LiveBindingSchema: z.ZodObject<{
     lastActivityAt: string;
     workspaceRoot?: string | undefined;
     clientName?: string | undefined;
+    mode?: "normal" | "agent-admin" | undefined;
 }, {
     updatedAt: string;
     deckId: string;
@@ -63,6 +65,7 @@ export declare const LiveBindingSchema: z.ZodObject<{
     lastActivityAt: string;
     workspaceRoot?: string | undefined;
     clientName?: string | undefined;
+    mode?: "normal" | "agent-admin" | undefined;
 }>;
 export declare const DeckDisplaySchema: z.ZodObject<{
     workspaceRoot: z.ZodString;
@@ -165,6 +168,7 @@ export declare const DeckListEntrySchema: z.ZodObject<{
         credentials: number;
         playbooks: number;
     }>;
+    workspaceCount: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     id: string;
     name: string;
@@ -174,6 +178,7 @@ export declare const DeckListEntrySchema: z.ZodObject<{
         credentials: number;
         playbooks: number;
     };
+    workspaceCount?: number | undefined;
 }, {
     id: string;
     name: string;
@@ -183,9 +188,33 @@ export declare const DeckListEntrySchema: z.ZodObject<{
         credentials: number;
         playbooks: number;
     };
+    workspaceCount?: number | undefined;
 }>;
 export type DeckListEntry = z.infer<typeof DeckListEntrySchema>;
 export type LiveBinding = z.infer<typeof LiveBindingSchema>;
+export declare const PendingAdminChallengeSchema: z.ZodObject<{
+    challengeId: z.ZodString;
+    runtimeSessionId: z.ZodString;
+    deckId: z.ZodString;
+    deckName: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodString;
+    approvalPath: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    deckId: string;
+    expiresAt: string;
+    challengeId: string;
+    runtimeSessionId: string;
+    approvalPath: string;
+    deckName?: string | undefined;
+}, {
+    deckId: string;
+    expiresAt: string;
+    challengeId: string;
+    runtimeSessionId: string;
+    approvalPath: string;
+    deckName?: string | undefined;
+}>;
+export type PendingAdminChallenge = z.infer<typeof PendingAdminChallengeSchema>;
 export type DeckDisplay = z.infer<typeof DeckDisplaySchema>;
 export type StatusLinePayload = z.infer<typeof StatusLinePayloadSchema>;
 export declare const DISPLAY_LINE_MAX_LENGTH = 120;

package/dist/schemas/deck-display.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deck-display.d.ts","sourceRoot":"","sources":["../../src/schemas/deck-display.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,uBAAuB,mDAIlC,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAI/B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW5B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW5B,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;EASlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAK9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;CACvB,GAAG,cAAc,CAOjB;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAOpE;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,MAAM,EAAE,cAAc,EACtB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACxF,MAAM,CAsCR;AAED,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ/G"}
+{"version":3,"file":"deck-display.d.ts","sourceRoot":"","sources":["../../src/schemas/deck-display.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,uBAAuB,mDAIlC,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;EAI/B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAY5B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW5B,CAAC;AAEH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;EASlC,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AACxE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAM9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;EAOtC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC5D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;CACvB,GAAG,cAAc,CAOjB;AAED,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAOpE;AAED,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,MAAM,EAAE,cAAc,EACtB,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACxF,MAAM,CAsCR;AAED,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAEpE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAGzF;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,iBAAiB,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAQ/G"}

package/dist/schemas/deck-display.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DISPLAY_LINE_MAX_LENGTH = exports.DeckListEntrySchema = exports.StatusLinePayloadSchema = exports.DeckDisplaySchema = exports.LiveBindingSchema = exports.DeckCardCountsSchema = exports.DeckDisplaySourceSchema = void 0;
+exports.DISPLAY_LINE_MAX_LENGTH = exports.PendingAdminChallengeSchema = exports.DeckListEntrySchema = exports.StatusLinePayloadSchema = exports.DeckDisplaySchema = exports.LiveBindingSchema = exports.DeckCardCountsSchema = exports.DeckDisplaySourceSchema = void 0;
 exports.countDeckCards = countDeckCards;
 exports.formatDisplayUpdatedSuffix = formatDisplayUpdatedSuffix;
 exports.formatDisplayLine = formatDisplayLine;
@@ -30,6 +30,7 @@ exports.LiveBindingSchema = zod_1.z.object({
     // Absent for header/auto-bound sessions (deck without a known folder).
     workspaceRoot: zod_1.z.string().min(1).optional(),
     clientName: zod_1.z.string().min(1).optional(),
+    mode: zod_1.z.enum(['normal', 'agent-admin']).optional(),
     cardCounts: exports.DeckCardCountsSchema,
     updatedAt: zod_1.z.string().datetime(),
     lastActivityAt: zod_1.z.string().datetime(),
@@ -61,6 +62,15 @@ exports.DeckListEntrySchema = zod_1.z.object({
     name: zod_1.z.string().min(1),
     isActive: zod_1.z.boolean(),
     cardCounts: exports.DeckCardCountsSchema,
+    workspaceCount: zod_1.z.number().int().nonnegative().optional(),
+});
+exports.PendingAdminChallengeSchema = zod_1.z.object({
+    challengeId: zod_1.z.string().min(1),
+    runtimeSessionId: zod_1.z.string().min(1),
+    deckId: zod_1.z.string().uuid(),
+    deckName: zod_1.z.string().min(1).optional(),
+    expiresAt: zod_1.z.string().datetime(),
+    approvalPath: zod_1.z.string().min(1),
 });
 exports.DISPLAY_LINE_MAX_LENGTH = 120;
 function countDeckCards(deck) {

package/dist/schemas/deck-display.js.map

@@ -1 +1 @@
-{"version":3,"file":"deck-display.js","sourceRoot":"","sources":["../../src/schemas/deck-display.ts"],"names":[],"mappings":";;;;;;AAqEA,wCAWC;AAED,gEAOC;AAED,8CA0CC;AAED,wDAEC;AAED,gEAGC;AAED,gEAQC;AAxJD,6BAAwB;AACxB,0DAA6B;AAEhB,QAAA,uBAAuB,GAAG,OAAC,CAAC,IAAI,CAAC;IAC5C,kBAAkB;IAClB,KAAK;IACL,SAAS;CACV,CAAC,CAAC;AAEU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC;AAEU,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACzB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,+BAAuB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;IACpD,uEAAuE;IACvE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,UAAU,EAAE,4BAAoB;IAChC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEU,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE;IACzB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,+BAAuB;IAC/B,UAAU,EAAE,4BAAoB;IAChC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD,eAAe,EAAE,OAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAEU,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,SAAS,EAAE,OAAC;SACT,MAAM,CAAC;QACN,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAKU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE;IACrB,UAAU,EAAE,4BAAoB;CACjC,CAAC,CAAC;AAOU,QAAA,uBAAuB,GAAG,GAAG,CAAC;AAE3C,SAAgB,cAAc,CAAC,IAI9B;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,MAAM;QAChE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC;QAC1C,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CAAC,SAAiB;IAC1D,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,aAAa,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC;AACjJ,CAAC;AAED,SAAgB,iBAAiB,CAC/B,QAAuB,EACvB,MAAsB,EACtB,OAAyF;IAEzF,MAAM,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,aAAa,GAAG,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9F,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,GAAG,MAAM,qBAAqB,aAAa,EAAE,CAAC;QAClE,OAAO,WAAW,CAAC,MAAM,GAAG,+BAAuB;YACjD,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,+BAAuB,CAAC;YAC/C,CAAC,CAAC,WAAW,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,WAAW,GAAG,GAAG,MAAM,yCAAyC,CAAC;QACvE,MAAM,OAAO,GAAG,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,WAAW,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC;QACnF,OAAO,OAAO,CAAC,MAAM,GAAG,+BAAuB;YAC7C,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,+BAAuB,CAAC;YAC3C,CAAC,CAAC,OAAO,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,GAAG,UAAU,MAAM,CAAC,WAAW,WAAW,MAAM,CAAC,SAAS,YAAY,CAAC;IACpG,MAAM,SAAS,GAAG,KAAK,CAAC;IACxB,MAAM,WAAW,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAClF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,YAAY,CAAC;IACxF,MAAM,aAAa,GAAG,+BAAuB,GAAG,WAAW,CAAC;IAE5D,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,aAAa,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC,MAAM,GAAG,+BAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,+BAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,aAAa,EAAE,CAAC;IACnG,OAAO,IAAI,CAAC,MAAM,GAAG,+BAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,+BAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/F,CAAC;AAED,SAAgB,sBAAsB,CAAC,aAAqB;IAC1D,OAAO,mBAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAgB,0BAA0B,CAAC,OAA0B;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,SAAS,IAAI,SAAS,CAAC;AAChC,CAAC;AAED,SAAgB,0BAA0B,CAAC,OAA0B,EAAE,WAAoB;IACzF,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,IAAI,EAAE,CAAC;IACjG,OAAO,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}
+{"version":3,"file":"deck-display.js","sourceRoot":"","sources":["../../src/schemas/deck-display.ts"],"names":[],"mappings":";;;;;;AAiFA,wCAWC;AAED,gEAOC;AAED,8CA0CC;AAED,wDAEC;AAED,gEAGC;AAED,gEAQC;AApKD,6BAAwB;AACxB,0DAA6B;AAEhB,QAAA,uBAAuB,GAAG,OAAC,CAAC,IAAI,CAAC;IAC5C,kBAAkB;IAClB,KAAK;IACL,SAAS;CACV,CAAC,CAAC;AAEU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACnC,CAAC,CAAC;AAEU,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACzB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,+BAAuB,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;IACpD,uEAAuE;IACvE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClD,UAAU,EAAE,4BAAoB;IAChC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEU,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE;IACzB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,+BAAuB;IAC/B,UAAU,EAAE,4BAAoB;IAChC,iBAAiB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrD,eAAe,EAAE,OAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAEU,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1B,SAAS,EAAE,OAAC;SACT,MAAM,CAAC;QACN,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAClC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACnC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAKU,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE;IACrB,UAAU,EAAE,4BAAoB;IAChC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAIU,QAAA,2BAA2B,GAAG,OAAC,CAAC,MAAM,CAAC;IAClD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACzB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAMU,QAAA,uBAAuB,GAAG,GAAG,CAAC;AAE3C,SAAgB,cAAc,CAAC,IAI9B;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;IACrC,OAAO;QACL,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,MAAM;QAChE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC;QAC1C,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,SAAgB,0BAA0B,CAAC,SAAiB;IAC1D,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,aAAa,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC;AACjJ,CAAC;AAED,SAAgB,iBAAiB,CAC/B,QAAuB,EACvB,MAAsB,EACtB,OAAyF;IAEzF,MAAM,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,aAAa,GAAG,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE9F,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,GAAG,MAAM,qBAAqB,aAAa,EAAE,CAAC;QAClE,OAAO,WAAW,CAAC,MAAM,GAAG,+BAAuB;YACjD,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,+BAAuB,CAAC;YAC/C,CAAC,CAAC,WAAW,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,WAAW,GAAG,GAAG,MAAM,yCAAyC,CAAC;QACvE,MAAM,OAAO,GAAG,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,WAAW,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC;QACnF,OAAO,OAAO,CAAC,MAAM,GAAG,+BAAuB;YAC7C,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,+BAAuB,CAAC;YAC3C,CAAC,CAAC,OAAO,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,GAAG,UAAU,MAAM,CAAC,WAAW,WAAW,MAAM,CAAC,SAAS,YAAY,CAAC;IACpG,MAAM,SAAS,GAAG,KAAK,CAAC;IACxB,MAAM,WAAW,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAClF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,YAAY,CAAC;IACxF,MAAM,aAAa,GAAG,+BAAuB,GAAG,WAAW,CAAC;IAE5D,IAAI,IAAI,GAAG,QAAQ,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,aAAa,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC,MAAM,GAAG,+BAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,+BAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/F,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa,EAAE,CAAC;QAChC,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7D,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,SAAS,GAAG,aAAa,EAAE,CAAC;IACnG,OAAO,IAAI,CAAC,MAAM,GAAG,+BAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,+BAAuB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/F,CAAC;AAED,SAAgB,sBAAsB,CAAC,aAAqB;IAC1D,OAAO,mBAAI,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,SAAgB,0BAA0B,CAAC,OAA0B;IACnE,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,SAAS,IAAI,SAAS,CAAC;AAChC,CAAC;AAED,SAAgB,0BAA0B,CAAC,OAA0B,EAAE,WAAoB;IACzF,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,IAAI,EAAE,CAAC;IACjG,OAAO,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC"}

package/dist/schemas/export-bundle.d.ts

@@ -235,13 +235,13 @@ export declare const BundleV1Schema: z.ZodObject<{
         exec?: string | undefined;
         skill?: string | undefined;
     }[];
-    scope: "collection" | "deck";
     format: "agent-deck-bundle";
     version: 1;
     exportedAt: string;
     exportedFrom: {
         agentDeckVersion: string;
     };
+    scope: "collection" | "deck";
     decks: {
         id: string;
         name: string;
@@ -249,13 +249,13 @@ export declare const BundleV1Schema: z.ZodObject<{
         playbookIds: string[];
     }[];
 }, {
-    scope: "collection" | "deck";
     format: "agent-deck-bundle";
     version: 1;
     exportedAt: string;
     exportedFrom: {
         agentDeckVersion: string;
     };
+    scope: "collection" | "deck";
     services?: {
         id: string;
         name: string;

package/dist/schemas/oauth.d.ts

@@ -7,19 +7,19 @@ export declare const OAuthConfigSchema: z.ZodObject<{
     redirectUri: z.ZodString;
     scope: z.ZodString;
 }, "strip", z.ZodTypeAny, {
+    scope: string;
     clientId: string;
     clientSecret: string;
     authorizationUrl: string;
     tokenUrl: string;
     redirectUri: string;
-    scope: string;
 }, {
+    scope: string;
     clientId: string;
     clientSecret: string;
     authorizationUrl: string;
     tokenUrl: string;
     redirectUri: string;
-    scope: string;
 }>;
 export declare const OAuthTokenSchema: z.ZodObject<{
     accessToken: z.ZodString;

package/dist/schemas/trusted-session.d.ts

@@ -0,0 +1,108 @@
+import { z } from 'zod';
+export declare const AgentSessionModeSchema: z.ZodEnum<["normal", "agent-admin"]>;
+export declare const TrustedSessionErrorCodeSchema: z.ZodEnum<["GRANT_REQUIRED", "SESSION_INVALID", "SESSION_REVOKED", "WORKSPACE_SCOPE_MISMATCH", "RESOURCE_OUT_OF_SCOPE", "ADMIN_REQUIRED", "DASHBOARD_REQUIRED", "ADMIN_CHALLENGE_EXPIRED"]>;
+export declare const WorkspaceGrantStatusSchema: z.ZodEnum<["pending", "active", "revoked"]>;
+export declare const RuntimeSessionSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    mcpSessionId: z.ZodOptional<z.ZodString>;
+    workspaceKey: z.ZodString;
+    workspaceGrantId: z.ZodString;
+    deckId: z.ZodString;
+    mode: z.ZodEnum<["normal", "agent-admin"]>;
+    lastSeenAt: z.ZodString;
+    expiresAt: z.ZodString;
+    adminExpiresAt: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    deckId: string;
+    expiresAt: string;
+    mode: "normal" | "agent-admin";
+    sessionId: string;
+    workspaceKey: string;
+    workspaceGrantId: string;
+    lastSeenAt: string;
+    adminExpiresAt: string | null;
+    mcpSessionId?: string | undefined;
+}, {
+    deckId: string;
+    expiresAt: string;
+    mode: "normal" | "agent-admin";
+    sessionId: string;
+    workspaceKey: string;
+    workspaceGrantId: string;
+    lastSeenAt: string;
+    adminExpiresAt: string | null;
+    mcpSessionId?: string | undefined;
+}>;
+export declare const WorkspaceGrantManifestSchema: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    workspaceKey: z.ZodString;
+    grantId: z.ZodString;
+    secret: z.ZodString;
+    deckId: z.ZodString;
+    deckName: z.ZodOptional<z.ZodString>;
+    mcpUrl: z.ZodOptional<z.ZodString>;
+    store: z.ZodOptional<z.ZodEnum<["file", "keychain"]>>;
+    updatedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    updatedAt: string;
+    deckId: string;
+    version: 2;
+    workspaceKey: string;
+    grantId: string;
+    secret: string;
+    deckName?: string | undefined;
+    mcpUrl?: string | undefined;
+    store?: "file" | "keychain" | undefined;
+}, {
+    updatedAt: string;
+    deckId: string;
+    version: 2;
+    workspaceKey: string;
+    grantId: string;
+    secret: string;
+    deckName?: string | undefined;
+    mcpUrl?: string | undefined;
+    store?: "file" | "keychain" | undefined;
+}>;
+export declare const RedactedSessionBindingSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    workspaceKey: z.ZodString;
+    deckId: z.ZodString;
+    deckName: z.ZodOptional<z.ZodString>;
+    mode: z.ZodEnum<["normal", "agent-admin"]>;
+    expiresAt: z.ZodString;
+    adminExpiresAt: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    display_summary: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    deckId: string;
+    expiresAt: string;
+    mode: "normal" | "agent-admin";
+    sessionId: string;
+    workspaceKey: string;
+    deckName?: string | undefined;
+    adminExpiresAt?: string | null | undefined;
+    display_summary?: string | undefined;
+}, {
+    deckId: string;
+    expiresAt: string;
+    mode: "normal" | "agent-admin";
+    sessionId: string;
+    workspaceKey: string;
+    deckName?: string | undefined;
+    adminExpiresAt?: string | null | undefined;
+    display_summary?: string | undefined;
+}>;
+export type AgentSessionMode = z.infer<typeof AgentSessionModeSchema>;
+export type TrustedSessionErrorCode = z.infer<typeof TrustedSessionErrorCodeSchema>;
+export type WorkspaceGrantStatus = z.infer<typeof WorkspaceGrantStatusSchema>;
+export type RuntimeSession = z.infer<typeof RuntimeSessionSchema>;
+export type WorkspaceGrantManifest = z.infer<typeof WorkspaceGrantManifestSchema>;
+export type RedactedSessionBinding = z.infer<typeof RedactedSessionBindingSchema>;
+export type TrustedSessionErrorBody = {
+    success: false;
+    error: string;
+    error_code: TrustedSessionErrorCode;
+};
+export declare function trustedSessionError(code: TrustedSessionErrorCode, message: string): TrustedSessionErrorBody;
+export declare function httpStatusForTrustedError(code: TrustedSessionErrorCode): number;
+//# sourceMappingURL=trusted-session.d.ts.map

package/dist/schemas/trusted-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-session.d.ts","sourceRoot":"","sources":["../../src/schemas/trusted-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,sBAAsB,sCAAoC,CAAC;AAExE,eAAO,MAAM,6BAA6B,6LASxC,CAAC;AAEH,eAAO,MAAM,0BAA0B,6CAA2C,CAAC;AAEnF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYtB,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAY9B,CAAC;AAEZ,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW9B,CAAC;AAEZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACpF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAC9E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAClF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,MAAM,uBAAuB,GAAG;IACpC,OAAO,EAAE,KAAK,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,uBAAuB,CAAC;CACrC,CAAC;AAEF,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,uBAAuB,EAC7B,OAAO,EAAE,MAAM,GACd,uBAAuB,CAEzB;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,uBAAuB,GAAG,MAAM,CAgB/E"}

package/dist/schemas/trusted-session.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedactedSessionBindingSchema = exports.WorkspaceGrantManifestSchema = exports.RuntimeSessionSchema = exports.WorkspaceGrantStatusSchema = exports.TrustedSessionErrorCodeSchema = exports.AgentSessionModeSchema = void 0;
+exports.trustedSessionError = trustedSessionError;
+exports.httpStatusForTrustedError = httpStatusForTrustedError;
+const zod_1 = require("zod");
+exports.AgentSessionModeSchema = zod_1.z.enum(['normal', 'agent-admin']);
+exports.TrustedSessionErrorCodeSchema = zod_1.z.enum([
+    'GRANT_REQUIRED',
+    'SESSION_INVALID',
+    'SESSION_REVOKED',
+    'WORKSPACE_SCOPE_MISMATCH',
+    'RESOURCE_OUT_OF_SCOPE',
+    'ADMIN_REQUIRED',
+    'DASHBOARD_REQUIRED',
+    'ADMIN_CHALLENGE_EXPIRED',
+]);
+exports.WorkspaceGrantStatusSchema = zod_1.z.enum(['pending', 'active', 'revoked']);
+exports.RuntimeSessionSchema = zod_1.z
+    .object({
+    sessionId: zod_1.z.string(),
+    mcpSessionId: zod_1.z.string().optional(),
+    workspaceKey: zod_1.z.string(),
+    workspaceGrantId: zod_1.z.string(),
+    deckId: zod_1.z.string(),
+    mode: exports.AgentSessionModeSchema,
+    lastSeenAt: zod_1.z.string().datetime(),
+    expiresAt: zod_1.z.string().datetime(),
+    adminExpiresAt: zod_1.z.string().datetime().nullable(),
+})
+    .strict();
+exports.WorkspaceGrantManifestSchema = zod_1.z
+    .object({
+    version: zod_1.z.literal(2),
+    workspaceKey: zod_1.z.string(),
+    grantId: zod_1.z.string(),
+    secret: zod_1.z.string().min(32),
+    deckId: zod_1.z.string(),
+    deckName: zod_1.z.string().optional(),
+    mcpUrl: zod_1.z.string().url().optional(),
+    store: zod_1.z.enum(['file', 'keychain']).optional(),
+    updatedAt: zod_1.z.string().datetime(),
+})
+    .strict();
+exports.RedactedSessionBindingSchema = zod_1.z
+    .object({
+    sessionId: zod_1.z.string(),
+    workspaceKey: zod_1.z.string(),
+    deckId: zod_1.z.string(),
+    deckName: zod_1.z.string().optional(),
+    mode: exports.AgentSessionModeSchema,
+    expiresAt: zod_1.z.string().datetime(),
+    adminExpiresAt: zod_1.z.string().datetime().nullable().optional(),
+    display_summary: zod_1.z.string().optional(),
+})
+    .strict();
+function trustedSessionError(code, message) {
+    return { success: false, error: message, error_code: code };
+}
+function httpStatusForTrustedError(code) {
+    switch (code) {
+        case 'GRANT_REQUIRED':
+        case 'SESSION_INVALID':
+        case 'SESSION_REVOKED':
+            return 401;
+        case 'WORKSPACE_SCOPE_MISMATCH':
+        case 'RESOURCE_OUT_OF_SCOPE':
+        case 'ADMIN_REQUIRED':
+        case 'DASHBOARD_REQUIRED':
+            return 403;
+        case 'ADMIN_CHALLENGE_EXPIRED':
+            return 410;
+        default:
+            return 500;
+    }
+}
+//# sourceMappingURL=trusted-session.js.map

package/dist/schemas/trusted-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-session.js","sourceRoot":"","sources":["../../src/schemas/trusted-session.ts"],"names":[],"mappings":";;;AAuEA,kDAKC;AAED,8DAgBC;AA9FD,6BAAwB;AAEX,QAAA,sBAAsB,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AAE3D,QAAA,6BAA6B,GAAG,OAAC,CAAC,IAAI,CAAC;IAClD,gBAAgB;IAChB,iBAAiB;IACjB,iBAAiB;IACjB,0BAA0B;IAC1B,uBAAuB;IACvB,gBAAgB;IAChB,oBAAoB;IACpB,yBAAyB;CAC1B,CAAC,CAAC;AAEU,QAAA,0BAA0B,GAAG,OAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAEtE,QAAA,oBAAoB,GAAG,OAAC;KAClC,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE;IACxB,gBAAgB,EAAE,OAAC,CAAC,MAAM,EAAE;IAC5B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,8BAAsB;IAC5B,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,OAAO,EAAE,OAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE;IACxB,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAEC,QAAA,4BAA4B,GAAG,OAAC;KAC1C,MAAM,CAAC;IACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE;IACxB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,8BAAsB;IAC5B,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC;KACD,MAAM,EAAE,CAAC;AAeZ,SAAgB,mBAAmB,CACjC,IAA6B,EAC7B,OAAe;IAEf,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,SAAgB,yBAAyB,CAAC,IAA6B;IACrE,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,gBAAgB,CAAC;QACtB,KAAK,iBAAiB,CAAC;QACvB,KAAK,iBAAiB;YACpB,OAAO,GAAG,CAAC;QACb,KAAK,0BAA0B,CAAC;QAChC,KAAK,uBAAuB,CAAC;QAC7B,KAAK,gBAAgB,CAAC;QACtB,KAAK,oBAAoB;YACvB,OAAO,GAAG,CAAC;QACb,KAAK,yBAAyB;YAC5B,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/types/api.d.ts

@@ -1,9 +1,10 @@
+import type { TrustedSessionErrorCode } from '../schemas/trusted-session';
 import type { McpErrorCode, ServiceToolErrorDetails } from './service';
 export interface ApiResponse<T = any> {
     success: boolean;
     data?: T;
     error?: string;
-    error_code?: McpErrorCode;
+    error_code?: McpErrorCode | TrustedSessionErrorCode;
     details?: ServiceToolErrorDetails;
     message?: string;
 }

package/dist/types/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/types/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEvE,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,GAAG;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC,CAAE,SAAQ,WAAW,CAAC,CAAC,EAAE,CAAC;IAC5D,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,CAAC;IACR,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;CAC7C;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,eAAe,GAAG,iBAAiB,CAAC;IAChF,IAAI,EAAE,GAAG,CAAC;CACX"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/types/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEvE,MAAM,WAAW,WAAW,CAAC,CAAC,GAAG,GAAG;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,CAAC,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,YAAY,GAAG,uBAAuB,CAAC;IACpD,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB,CAAC,CAAC,CAAE,SAAQ,WAAW,CAAC,CAAC,EAAE,CAAC;IAC5D,UAAU,EAAE;QACV,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB,CAAC,CAAC,GAAG,GAAG;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,CAAC;IACR,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;CAC7C;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,eAAe,GAAG,iBAAiB,CAAC;IAChF,IAAI,EAAE,GAAG,CAAC;CACX"}

package/dist/utils/index.d.ts

@@ -9,4 +9,5 @@ export * from './oauth-session';
 export * from './local-mcp-manifest';
 export * from './agent-deck-home';
 export * from './trigger-hygiene';
+export * from './workspace-key';
 //# sourceMappingURL=index.d.ts.map

package/dist/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,MAAM,CAAC;AACrB,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA,cAAc,MAAM,CAAC;AACrB,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,yBAAyB,CAAC;AACxC,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC;AAChC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC"}

package/dist/utils/index.js

@@ -25,4 +25,5 @@ __exportStar(require("./oauth-session"), exports);
 __exportStar(require("./local-mcp-manifest"), exports);
 __exportStar(require("./agent-deck-home"), exports);
 __exportStar(require("./trigger-hygiene"), exports);
+__exportStar(require("./workspace-key"), exports);
 //# sourceMappingURL=index.js.map

package/dist/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uCAAqB;AACrB,+CAA6B;AAC7B,6CAA2B;AAC3B,+CAA6B;AAC7B,6CAA2B;AAC3B,0DAAwC;AACxC,wDAAsC;AACtC,kDAAgC;AAChC,uDAAqC;AACrC,oDAAkC;AAClC,oDAAkC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uCAAqB;AACrB,+CAA6B;AAC7B,6CAA2B;AAC3B,+CAA6B;AAC7B,6CAA2B;AAC3B,0DAAwC;AACxC,wDAAsC;AACtC,kDAAgC;AAChC,uDAAqC;AACrC,oDAAkC;AAClC,oDAAkC;AAClC,kDAAgC"}

package/dist/utils/workspace-key.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Canonical workspace path (PRD C1).
+ * Resolves symlinks when the path exists, normalizes separators, applies NFC,
+ * strips trailing separators, and lowercases Windows drive letters.
+ */
+export declare function canonicalizeWorkspacePath(inputPath: string): string;
+/** Stable digest of canonical path — used before opaque workspaceKey registration. */
+export declare function digestCanonicalWorkspacePath(canonicalPath: string): string;
+export declare function prefixTrustedId(kind: 'wsp' | 'wgr' | 'ses' | 'adm', rawId: string): string;
+//# sourceMappingURL=workspace-key.d.ts.map

package/dist/utils/workspace-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-key.d.ts","sourceRoot":"","sources":["../../src/utils/workspace-key.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CA4BnE;AAED,sFAAsF;AACtF,wBAAgB,4BAA4B,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAE1E;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1F"}

package/dist/utils/workspace-key.js

@@ -0,0 +1,48 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalizeWorkspacePath = canonicalizeWorkspacePath;
+exports.digestCanonicalWorkspacePath = digestCanonicalWorkspacePath;
+exports.prefixTrustedId = prefixTrustedId;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+/**
+ * Canonical workspace path (PRD C1).
+ * Resolves symlinks when the path exists, normalizes separators, applies NFC,
+ * strips trailing separators, and lowercases Windows drive letters.
+ */
+function canonicalizeWorkspacePath(inputPath) {
+    const absolute = node_path_1.default.resolve(inputPath);
+    let resolved = absolute;
+    try {
+        resolved = node_fs_1.default.realpathSync.native(absolute);
+    }
+    catch {
+        resolved = node_path_1.default.normalize(absolute);
+    }
+    if (process.platform === 'win32') {
+        resolved = resolved.replace(/^([A-Za-z]):/, (_match, drive) => `${drive.toLowerCase()}:`);
+        resolved = resolved.replace(/\//g, '\\');
+    }
+    else {
+        resolved = resolved.replace(/\\/g, '/');
+    }
+    resolved = node_path_1.default.normalize(resolved);
+    const isRoot = resolved === '/' ||
+        (process.platform === 'win32' && /^[a-z]:\\?$/i.test(resolved));
+    if (!isRoot && (resolved.endsWith('/') || resolved.endsWith('\\'))) {
+        resolved = resolved.replace(/[\\/]+$/, '');
+    }
+    return resolved.normalize('NFC');
+}
+/** Stable digest of canonical path — used before opaque workspaceKey registration. */
+function digestCanonicalWorkspacePath(canonicalPath) {
+    return (0, node_crypto_1.createHash)('sha256').update(canonicalPath, 'utf8').digest('hex');
+}
+function prefixTrustedId(kind, rawId) {
+    return `${kind}_${rawId.replace(/-/g, '')}`;
+}
+//# sourceMappingURL=workspace-key.js.map

package/dist/utils/workspace-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-key.js","sourceRoot":"","sources":["../../src/utils/workspace-key.ts"],"names":[],"mappings":";;;;;AASA,8DA4BC;AAGD,oEAEC;AAED,0CAEC;AA9CD,6CAAyC;AACzC,sDAAyB;AACzB,0DAA6B;AAE7B;;;;GAIG;AACH,SAAgB,yBAAyB,CAAC,SAAiB;IACzD,MAAM,QAAQ,GAAG,mBAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEzC,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,IAAI,CAAC;QACH,QAAQ,GAAG,iBAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,mBAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,KAAa,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAClG,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAED,QAAQ,GAAG,mBAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAEpC,MAAM,MAAM,GACV,QAAQ,KAAK,GAAG;QAChB,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAElE,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnE,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,sFAAsF;AACtF,SAAgB,4BAA4B,CAAC,aAAqB;IAChE,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,SAAgB,eAAe,CAAC,IAAmC,EAAE,KAAa;IAChF,OAAO,GAAG,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;AAC9C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-deck/shared",
-  "version": "1.6.4",
+  "version": "1.7.0",
   "description": "Shared types, schemas, and utilities for Agent Deck",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",