@agent-deck/shared 2.3.1 → 2.3.2

package/dist/constants/client-scope.d.ts

@@ -33,6 +33,16 @@ export declare const AGENT_DECK_RECOVERED_SESSION_HEADER = "x-agent-deck-recover
 export declare const AGENT_DECK_BRIDGE_LIVENESS_HEADER = "x-agent-deck-bridge-liveness";
 /** Header value advertising the v1 bridge-owned `ping` heartbeat contract. */
 export declare const AGENT_DECK_BRIDGE_LIVENESS_V1 = "1";
+/**
+ * Pinned playbook version for one run's MCP session (NOT-537).
+ *
+ * Value shape is `<playbookId>=<versionId>`. Adopt-once per MCP session like
+ * the correlation id: the first valid value sticks, later changes are
+ * ignored, and invalid values are dropped. The pin changes only what
+ * `get_playbook` and the playbook summaries show for that one playbook id;
+ * it never selects a deck, grants access, or participates in authorization.
+ */
+export declare const AGENT_DECK_PLAYBOOK_PIN_HEADER = "x-agent-deck-playbook-pin";
 /**
  * Host-side session id for status-line self-match (NOT-513). The bridge sends
  * the id its host assigned the session (Claude Code: `CLAUDE_CODE_SESSION_ID`

package/dist/constants/client-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-scope.d.ts","sourceRoot":"","sources":["../../src/constants/client-scope.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D,mEAAmE;AACnE,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAE/C,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAEpE,sCAAsC;AACtC,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,mCAAmC,CAAC;AAEpF;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,iCAAiC,CAAC;AAEhF,8EAA8E;AAC9E,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,iCAAiC,CAAC"}
+{"version":3,"file":"client-scope.d.ts","sourceRoot":"","sources":["../../src/constants/client-scope.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,wBAAwB,CAAC;AAE9D,mEAAmE;AACnE,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAE/C,uEAAuE;AACvE,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAEpE,sCAAsC;AACtC,eAAO,MAAM,yBAAyB,yBAAyB,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,gCAAgC,CAAC;AAE3E;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,mCAAmC,CAAC;AAEpF;;;;;;;GAOG;AACH,eAAO,MAAM,iCAAiC,iCAAiC,CAAC;AAEhF,8EAA8E;AAC9E,eAAO,MAAM,6BAA6B,MAAM,CAAC;AAEjD;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,8BAA8B,CAAC;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,iCAAiC,iCAAiC,CAAC"}

package/dist/constants/client-scope.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AGENT_DECK_HOST_SESSION_ID_HEADER = exports.AGENT_DECK_BRIDGE_LIVENESS_V1 = exports.AGENT_DECK_BRIDGE_LIVENESS_HEADER = exports.AGENT_DECK_RECOVERED_SESSION_HEADER = exports.AGENT_DECK_CORRELATION_HEADER = exports.AGENT_DECK_DECK_ID_HEADER = exports.AGENT_DECK_WORKSPACE_HEADER = exports.AGENT_DECK_AGENT_CLIENT = exports.AGENT_DECK_DASHBOARD_CLIENT = exports.AGENT_DECK_CLIENT_HEADER = void 0;
+exports.AGENT_DECK_HOST_SESSION_ID_HEADER = exports.AGENT_DECK_PLAYBOOK_PIN_HEADER = exports.AGENT_DECK_BRIDGE_LIVENESS_V1 = exports.AGENT_DECK_BRIDGE_LIVENESS_HEADER = exports.AGENT_DECK_RECOVERED_SESSION_HEADER = exports.AGENT_DECK_CORRELATION_HEADER = exports.AGENT_DECK_DECK_ID_HEADER = exports.AGENT_DECK_WORKSPACE_HEADER = exports.AGENT_DECK_AGENT_CLIENT = exports.AGENT_DECK_DASHBOARD_CLIENT = exports.AGENT_DECK_CLIENT_HEADER = void 0;
 /** HTTP header distinguishing dashboard (human UI) from agent API clients. */
 exports.AGENT_DECK_CLIENT_HEADER = 'x-agent-deck-client';
 /** Value sent by the Agent Deck dashboard for vault management. */
@@ -36,6 +36,16 @@ exports.AGENT_DECK_RECOVERED_SESSION_HEADER = 'x-agent-deck-recovered-session';
 exports.AGENT_DECK_BRIDGE_LIVENESS_HEADER = 'x-agent-deck-bridge-liveness';
 /** Header value advertising the v1 bridge-owned `ping` heartbeat contract. */
 exports.AGENT_DECK_BRIDGE_LIVENESS_V1 = '1';
+/**
+ * Pinned playbook version for one run's MCP session (NOT-537).
+ *
+ * Value shape is `<playbookId>=<versionId>`. Adopt-once per MCP session like
+ * the correlation id: the first valid value sticks, later changes are
+ * ignored, and invalid values are dropped. The pin changes only what
+ * `get_playbook` and the playbook summaries show for that one playbook id;
+ * it never selects a deck, grants access, or participates in authorization.
+ */
+exports.AGENT_DECK_PLAYBOOK_PIN_HEADER = 'x-agent-deck-playbook-pin';
 /**
  * Host-side session id for status-line self-match (NOT-513). The bridge sends
  * the id its host assigned the session (Claude Code: `CLAUDE_CODE_SESSION_ID`

package/dist/constants/client-scope.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-scope.js","sourceRoot":"","sources":["../../src/constants/client-scope.ts"],"names":[],"mappings":";;;AAAA,8EAA8E;AACjE,QAAA,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D,mEAAmE;AACtD,QAAA,2BAA2B,GAAG,WAAW,CAAC;AAEvD,+EAA+E;AAClE,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAE/C,uEAAuE;AAC1D,QAAA,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE,sCAAsC;AACzB,QAAA,yBAAyB,GAAG,sBAAsB,CAAC;AAEhE;;;;;;GAMG;AACU,QAAA,6BAA6B,GAAG,6BAA6B,CAAC;AAE3E;;;;GAIG;AACU,QAAA,mCAAmC,GAAG,gCAAgC,CAAC;AAEpF;;;;;;;GAOG;AACU,QAAA,iCAAiC,GAAG,8BAA8B,CAAC;AAEhF,8EAA8E;AACjE,QAAA,6BAA6B,GAAG,GAAG,CAAC;AAEjD;;;;;;GAMG;AACU,QAAA,iCAAiC,GAAG,8BAA8B,CAAC"}
+{"version":3,"file":"client-scope.js","sourceRoot":"","sources":["../../src/constants/client-scope.ts"],"names":[],"mappings":";;;AAAA,8EAA8E;AACjE,QAAA,wBAAwB,GAAG,qBAAqB,CAAC;AAE9D,mEAAmE;AACtD,QAAA,2BAA2B,GAAG,WAAW,CAAC;AAEvD,+EAA+E;AAClE,QAAA,uBAAuB,GAAG,OAAO,CAAC;AAE/C,uEAAuE;AAC1D,QAAA,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE,sCAAsC;AACzB,QAAA,yBAAyB,GAAG,sBAAsB,CAAC;AAEhE;;;;;;GAMG;AACU,QAAA,6BAA6B,GAAG,6BAA6B,CAAC;AAE3E;;;;GAIG;AACU,QAAA,mCAAmC,GAAG,gCAAgC,CAAC;AAEpF;;;;;;;GAOG;AACU,QAAA,iCAAiC,GAAG,8BAA8B,CAAC;AAEhF,8EAA8E;AACjE,QAAA,6BAA6B,GAAG,GAAG,CAAC;AAEjD;;;;;;;;GAQG;AACU,QAAA,8BAA8B,GAAG,2BAA2B,CAAC;AAE1E;;;;;;GAMG;AACU,QAAA,iCAAiC,GAAG,8BAA8B,CAAC"}

package/dist/index.d.ts

@@ -13,12 +13,13 @@ export * from './schemas/session-bootstrap';
 export * from './schemas/trusted-session';
 export * from './schemas/card-usage';
 export * from './schemas/agent-run';
+export * from './schemas/playbook-pin';
 export * from './types/api';
 export { OAuthDiscoveryResult } from './types/oauth';
 export * from './utils';
 export { summarizeCollectionWarnings, getServiceWarnings, getCredentialWarnings, getPlaybookWarnings, primaryCollectionWarning, type CollectionCardWarning, type CollectionWarningKind, } from './utils/collection-warnings';
 export { normalizeLocalMcpManifestInput, parseLocalMcpManifestJson, stripJsonMarkdownFences, } from './utils/local-mcp-manifest';
-export { AGENT_DECK_CLIENT_HEADER, AGENT_DECK_DASHBOARD_CLIENT, AGENT_DECK_AGENT_CLIENT, AGENT_DECK_WORKSPACE_HEADER, AGENT_DECK_DECK_ID_HEADER, AGENT_DECK_CORRELATION_HEADER, AGENT_DECK_RECOVERED_SESSION_HEADER, AGENT_DECK_BRIDGE_LIVENESS_HEADER, AGENT_DECK_BRIDGE_LIVENESS_V1, AGENT_DECK_HOST_SESSION_ID_HEADER, } from './constants/client-scope';
+export { AGENT_DECK_CLIENT_HEADER, AGENT_DECK_DASHBOARD_CLIENT, AGENT_DECK_AGENT_CLIENT, AGENT_DECK_WORKSPACE_HEADER, AGENT_DECK_DECK_ID_HEADER, AGENT_DECK_CORRELATION_HEADER, AGENT_DECK_RECOVERED_SESSION_HEADER, AGENT_DECK_BRIDGE_LIVENESS_HEADER, AGENT_DECK_BRIDGE_LIVENESS_V1, AGENT_DECK_HOST_SESSION_ID_HEADER, AGENT_DECK_PLAYBOOK_PIN_HEADER, } from './constants/client-scope';
 export { AGENT_DECK_SESSION_HEADER, AGENT_DECK_DASHBOARD_COOKIE, RUNTIME_SESSION_LEASE_MS, ADMIN_MODE_LEASE_MS, ADMIN_CHALLENGE_TTL_MS, DASHBOARD_NONCE_TTL_MS, DASHBOARD_SESSION_LEASE_MS, DASHBOARD_COOKIE_MAX_AGE_MS, } from './constants/trusted-session';
 export { MCP_CARD_COLOR, API_KEY_CARD_COLOR, PLAYBOOK_CARD_COLOR, getServiceCardColor } from './constants/card-colors';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AAGpC,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACnC,iCAAiC,EACjC,6BAA6B,EAC7B,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,0BAA0B,CAAC;AACzC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,iBAAiB,CAAC;AAChC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AAGvC,cAAc,aAAa,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAGrD,cAAc,SAAS,CAAC;AACxB,OAAO,EACL,2BAA2B,EAC3B,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,8BAA8B,EAC9B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EACL,wBAAwB,EACxB,2BAA2B,EAC3B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,EACzB,6BAA6B,EAC7B,mCAAmC,EACnC,iCAAiC,EACjC,6BAA6B,EAC7B,iCAAiC,EACjC,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,GAC5B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getServiceCardColor = exports.PLAYBOOK_CARD_COLOR = exports.API_KEY_CARD_COLOR = exports.MCP_CARD_COLOR = exports.DASHBOARD_COOKIE_MAX_AGE_MS = exports.DASHBOARD_SESSION_LEASE_MS = exports.DASHBOARD_NONCE_TTL_MS = exports.ADMIN_CHALLENGE_TTL_MS = exports.ADMIN_MODE_LEASE_MS = exports.RUNTIME_SESSION_LEASE_MS = exports.AGENT_DECK_DASHBOARD_COOKIE = exports.AGENT_DECK_SESSION_HEADER = exports.AGENT_DECK_HOST_SESSION_ID_HEADER = exports.AGENT_DECK_BRIDGE_LIVENESS_V1 = exports.AGENT_DECK_BRIDGE_LIVENESS_HEADER = exports.AGENT_DECK_RECOVERED_SESSION_HEADER = exports.AGENT_DECK_CORRELATION_HEADER = exports.AGENT_DECK_DECK_ID_HEADER = exports.AGENT_DECK_WORKSPACE_HEADER = exports.AGENT_DECK_AGENT_CLIENT = exports.AGENT_DECK_DASHBOARD_CLIENT = exports.AGENT_DECK_CLIENT_HEADER = exports.stripJsonMarkdownFences = exports.parseLocalMcpManifestJson = exports.normalizeLocalMcpManifestInput = exports.primaryCollectionWarning = exports.getPlaybookWarnings = exports.getCredentialWarnings = exports.getServiceWarnings = exports.summarizeCollectionWarnings = void 0;
+exports.getServiceCardColor = exports.PLAYBOOK_CARD_COLOR = exports.API_KEY_CARD_COLOR = exports.MCP_CARD_COLOR = exports.DASHBOARD_COOKIE_MAX_AGE_MS = exports.DASHBOARD_SESSION_LEASE_MS = exports.DASHBOARD_NONCE_TTL_MS = exports.ADMIN_CHALLENGE_TTL_MS = exports.ADMIN_MODE_LEASE_MS = exports.RUNTIME_SESSION_LEASE_MS = exports.AGENT_DECK_DASHBOARD_COOKIE = exports.AGENT_DECK_SESSION_HEADER = exports.AGENT_DECK_PLAYBOOK_PIN_HEADER = exports.AGENT_DECK_HOST_SESSION_ID_HEADER = exports.AGENT_DECK_BRIDGE_LIVENESS_V1 = exports.AGENT_DECK_BRIDGE_LIVENESS_HEADER = exports.AGENT_DECK_RECOVERED_SESSION_HEADER = exports.AGENT_DECK_CORRELATION_HEADER = exports.AGENT_DECK_DECK_ID_HEADER = exports.AGENT_DECK_WORKSPACE_HEADER = exports.AGENT_DECK_AGENT_CLIENT = exports.AGENT_DECK_DASHBOARD_CLIENT = exports.AGENT_DECK_CLIENT_HEADER = exports.stripJsonMarkdownFences = exports.parseLocalMcpManifestJson = exports.normalizeLocalMcpManifestInput = exports.primaryCollectionWarning = exports.getPlaybookWarnings = exports.getCredentialWarnings = exports.getServiceWarnings = exports.summarizeCollectionWarnings = void 0;
 // Schemas (includes Zod-inferred types)
 __exportStar(require("./schemas/service"), exports);
 __exportStar(require("./schemas/deck"), exports);
@@ -31,6 +31,7 @@ __exportStar(require("./schemas/session-bootstrap"), exports);
 __exportStar(require("./schemas/trusted-session"), exports);
 __exportStar(require("./schemas/card-usage"), exports);
 __exportStar(require("./schemas/agent-run"), exports);
+__exportStar(require("./schemas/playbook-pin"), exports);
 // Additional types not covered by schemas
 __exportStar(require("./types/api"), exports);
 // Utils
@@ -57,6 +58,7 @@ Object.defineProperty(exports, "AGENT_DECK_RECOVERED_SESSION_HEADER", { enumerab
 Object.defineProperty(exports, "AGENT_DECK_BRIDGE_LIVENESS_HEADER", { enumerable: true, get: function () { return client_scope_1.AGENT_DECK_BRIDGE_LIVENESS_HEADER; } });
 Object.defineProperty(exports, "AGENT_DECK_BRIDGE_LIVENESS_V1", { enumerable: true, get: function () { return client_scope_1.AGENT_DECK_BRIDGE_LIVENESS_V1; } });
 Object.defineProperty(exports, "AGENT_DECK_HOST_SESSION_ID_HEADER", { enumerable: true, get: function () { return client_scope_1.AGENT_DECK_HOST_SESSION_ID_HEADER; } });
+Object.defineProperty(exports, "AGENT_DECK_PLAYBOOK_PIN_HEADER", { enumerable: true, get: function () { return client_scope_1.AGENT_DECK_PLAYBOOK_PIN_HEADER; } });
 var trusted_session_1 = require("./constants/trusted-session");
 Object.defineProperty(exports, "AGENT_DECK_SESSION_HEADER", { enumerable: true, get: function () { return trusted_session_1.AGENT_DECK_SESSION_HEADER; } });
 Object.defineProperty(exports, "AGENT_DECK_DASHBOARD_COOKIE", { enumerable: true, get: function () { return trusted_session_1.AGENT_DECK_DASHBOARD_COOKIE; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,wCAAwC;AACxC,oDAAkC;AAClC,iDAA+B;AAC/B,uDAAqC;AACrC,kDAAgC;AAChC,qDAAmC;AACnC,2DAAyC;AACzC,4DAA0C;AAC1C,gEAA8C;AAC9C,yDAAuC;AACvC,0DAAwC;AACxC,kDAAgC;AAChC,8DAA4C;AAC5C,4DAA0C;AAC1C,uDAAqC;AACrC,sDAAoC;AAEpC,0CAA0C;AAC1C,8CAA4B;AAG5B,QAAQ;AACR,0CAAwB;AACxB,mEAQqC;AAPnC,kIAAA,2BAA2B,OAAA;AAC3B,yHAAA,kBAAkB,OAAA;AAClB,4HAAA,qBAAqB,OAAA;AACrB,0HAAA,mBAAmB,OAAA;AACnB,+HAAA,wBAAwB,OAAA;AAI1B,iEAIoC;AAHlC,oIAAA,8BAA8B,OAAA;AAC9B,+HAAA,yBAAyB,OAAA;AACzB,6HAAA,uBAAuB,OAAA;AAGzB,YAAY;AACZ,yDAWkC;AAVhC,wHAAA,wBAAwB,OAAA;AACxB,2HAAA,2BAA2B,OAAA;AAC3B,uHAAA,uBAAuB,OAAA;AACvB,2HAAA,2BAA2B,OAAA;AAC3B,yHAAA,yBAAyB,OAAA;AACzB,6HAAA,6BAA6B,OAAA;AAC7B,mIAAA,mCAAmC,OAAA;AACnC,iIAAA,iCAAiC,OAAA;AACjC,6HAAA,6BAA6B,OAAA;AAC7B,iIAAA,iCAAiC,OAAA;AAEnC,+DASqC;AARnC,4HAAA,yBAAyB,OAAA;AACzB,8HAAA,2BAA2B,OAAA;AAC3B,2HAAA,wBAAwB,OAAA;AACxB,sHAAA,mBAAmB,OAAA;AACnB,yHAAA,sBAAsB,OAAA;AACtB,yHAAA,sBAAsB,OAAA;AACtB,6HAAA,0BAA0B,OAAA;AAC1B,8HAAA,2BAA2B,OAAA;AAE7B,uDAAuH;AAA9G,6GAAA,cAAc,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAAE,kHAAA,mBAAmB,OAAA;AAAE,kHAAA,mBAAmB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,wCAAwC;AACxC,oDAAkC;AAClC,iDAA+B;AAC/B,uDAAqC;AACrC,kDAAgC;AAChC,qDAAmC;AACnC,2DAAyC;AACzC,4DAA0C;AAC1C,gEAA8C;AAC9C,yDAAuC;AACvC,0DAAwC;AACxC,kDAAgC;AAChC,8DAA4C;AAC5C,4DAA0C;AAC1C,uDAAqC;AACrC,sDAAoC;AACpC,yDAAuC;AAEvC,0CAA0C;AAC1C,8CAA4B;AAG5B,QAAQ;AACR,0CAAwB;AACxB,mEAQqC;AAPnC,kIAAA,2BAA2B,OAAA;AAC3B,yHAAA,kBAAkB,OAAA;AAClB,4HAAA,qBAAqB,OAAA;AACrB,0HAAA,mBAAmB,OAAA;AACnB,+HAAA,wBAAwB,OAAA;AAI1B,iEAIoC;AAHlC,oIAAA,8BAA8B,OAAA;AAC9B,+HAAA,yBAAyB,OAAA;AACzB,6HAAA,uBAAuB,OAAA;AAGzB,YAAY;AACZ,yDAYkC;AAXhC,wHAAA,wBAAwB,OAAA;AACxB,2HAAA,2BAA2B,OAAA;AAC3B,uHAAA,uBAAuB,OAAA;AACvB,2HAAA,2BAA2B,OAAA;AAC3B,yHAAA,yBAAyB,OAAA;AACzB,6HAAA,6BAA6B,OAAA;AAC7B,mIAAA,mCAAmC,OAAA;AACnC,iIAAA,iCAAiC,OAAA;AACjC,6HAAA,6BAA6B,OAAA;AAC7B,iIAAA,iCAAiC,OAAA;AACjC,8HAAA,8BAA8B,OAAA;AAEhC,+DASqC;AARnC,4HAAA,yBAAyB,OAAA;AACzB,8HAAA,2BAA2B,OAAA;AAC3B,2HAAA,wBAAwB,OAAA;AACxB,sHAAA,mBAAmB,OAAA;AACnB,yHAAA,sBAAsB,OAAA;AACtB,yHAAA,sBAAsB,OAAA;AACtB,6HAAA,0BAA0B,OAAA;AAC1B,8HAAA,2BAA2B,OAAA;AAE7B,uDAAuH;AAA9G,6GAAA,cAAc,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAAE,kHAAA,mBAAmB,OAAA;AAAE,kHAAA,mBAAmB,OAAA"}

package/dist/schemas/playbook-pin.d.ts

@@ -0,0 +1,23 @@
+/**
+ * One pinned playbook version for a run's MCP session (NOT-537).
+ *
+ * The pin travels as `<playbookId>=<versionId>` — the `--playbook-version`
+ * flag value, the run's pin env var, and the `x-agent-deck-playbook-pin`
+ * launch header all share this shape. One pin per run; it lives only as
+ * long as the run's MCP session.
+ */
+export type PlaybookPin = {
+    playbookId: string;
+    versionId: string;
+};
+/**
+ * Parse a candidate pin, or return null when it is absent or malformed.
+ * Invalid values are dropped — never coerced — so untrusted input cannot
+ * smuggle task content into a session. The playbook id must match
+ * `pb_<slug>` and the version id must be a UUID (the only shape version
+ * snapshots are ever stored with).
+ */
+export declare function normalizePlaybookPin(raw: unknown): PlaybookPin | null;
+/** Canonical `<playbookId>=<versionId>` form for headers and env. */
+export declare function formatPlaybookPin(pin: PlaybookPin): string;
+//# sourceMappingURL=playbook-pin.d.ts.map

package/dist/schemas/playbook-pin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"playbook-pin.d.ts","sourceRoot":"","sources":["../../src/schemas/playbook-pin.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAIF;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAkBrE;AAED,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAE1D"}

package/dist/schemas/playbook-pin.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizePlaybookPin = normalizePlaybookPin;
+exports.formatPlaybookPin = formatPlaybookPin;
+const id_1 = require("../utils/id");
+const PLAYBOOK_ID_RE = /^pb_[a-z0-9_]+$/;
+/**
+ * Parse a candidate pin, or return null when it is absent or malformed.
+ * Invalid values are dropped — never coerced — so untrusted input cannot
+ * smuggle task content into a session. The playbook id must match
+ * `pb_<slug>` and the version id must be a UUID (the only shape version
+ * snapshots are ever stored with).
+ */
+function normalizePlaybookPin(raw) {
+    if (typeof raw !== 'string') {
+        return null;
+    }
+    const value = raw.trim();
+    if (!value) {
+        return null;
+    }
+    const separator = value.indexOf('=');
+    if (separator === -1 || value.indexOf('=', separator + 1) !== -1) {
+        return null;
+    }
+    const playbookId = value.slice(0, separator).trim();
+    const versionId = value.slice(separator + 1).trim();
+    if (!PLAYBOOK_ID_RE.test(playbookId) || !(0, id_1.isValidUUID)(versionId)) {
+        return null;
+    }
+    return { playbookId, versionId };
+}
+/** Canonical `<playbookId>=<versionId>` form for headers and env. */
+function formatPlaybookPin(pin) {
+    return `${pin.playbookId}=${pin.versionId}`;
+}
+//# sourceMappingURL=playbook-pin.js.map

package/dist/schemas/playbook-pin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"playbook-pin.js","sourceRoot":"","sources":["../../src/schemas/playbook-pin.ts"],"names":[],"mappings":";;AAwBA,oDAkBC;AAGD,8CAEC;AA/CD,oCAA0C;AAe1C,MAAM,cAAc,GAAG,iBAAiB,CAAC;AAEzC;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,GAAY;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAA,gBAAW,EAAC,SAAS,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED,qEAAqE;AACrE,SAAgB,iBAAiB,CAAC,GAAgB;IAChD,OAAO,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;AAC9C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-deck/shared",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "Shared types, schemas, and utilities for Agent Deck",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",