@appforge-ci/core 0.1.1

package/dist/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,cAAc,0DAAwD,CAAC;AAEpF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAwBjC;;;sEAGkE;;IAElE,6EAA6E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO7E,CAAC;AAEH,iDAAiD;AACjD,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAf/B;;;0EAGkE;;QAElE,6EAA6E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAe7E,CAAC;AAgCH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;EAKvB,CAAC;AAEH,eAAO,MAAM,WAAW;;;IAGtB;;;uEAGmE;;IAEnE;;yCAEqC;;;;;;;;;;;;EAErC,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;EAE5B,CAAC;AAEH;;;;;;;;;;;;uEAYuE;AACvE,eAAO,MAAM,iBAAiB;;;;;;;;;EAG5B,CAAC;AAEH;;;4CAG4C;AAC5C,eAAO,MAAM,iBAAiB;;;;;;EAE5B,CAAC;AAEH;;;;;;;;;;;;;;;4CAe4C;AAC5C,eAAO,MAAM,6BAA6B;;;;;;EAExC,CAAC;AAEH;;;;;wDAKwD;AACxD,eAAO,MAAM,oBAAoB;;;;;;;;;EAG/B,CAAC;AAEH;;;;;gEAKgE;AAChE,eAAO,MAAM,oBAAoB;;;;;;EAE/B,CAAC;AAEH;;;4BAG4B;AAC5B,eAAO,MAAM,mBAAmB;;;;;;;;;EAG9B,CAAC;AAuCH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;EAK1B,CAAC;AAKH,eAAO,MAAM,eAAe;;;;;;;;;;;;EAI1B,CAAC;AAQH,eAAO,MAAM,eAAe;;;;;;;;;EAU1B,CAAC;AA0EH,eAAO,MAAM,kBAAkB;;;;;;;;;EAiB7B,CAAC;AAiBH,eAAO,MAAM,kBAAkB,0EAA2E,CAAC;AAE3G,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAQlE,eAAO,MAAM,oBAAoB;;;;;;;;;EAe/B,CAAC;AAeH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;EAS7B,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;EAEtB,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;EAE/B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyB5B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;IA4B/B,iDAAiD;;IAEjD;;2EAEuE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEvE,CAAC;AAgBH,eAAO,MAAM,eAAe;;;;;;;;;EAG1B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4B9B,CAAC;AASH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKlC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;;EAEpC,CAAC;AAOH,eAAO,MAAM,6BAA6B;;;;;;EAExC,CAAC;AAEH;;;;;oBAKoB;AACpB,eAAO,MAAM,2BAA2B;;;;;;EAEtC,CAAC;AAEH;;;;;;oDAMoD;AACpD,eAAO,MAAM,qBAAqB;;;;;;EAEhC,CAAC"}

package/dist/schemas.js

@@ -0,0 +1,538 @@
+import { z } from "zod";
+export const platformSchema = z.enum(["ios", "android", "flutter", "react-native"]);
+export const appforgeWorkflowSchema = z.object({
+    name: z.string().optional(),
+    environment: z
+        .object({
+        node: z.string().optional(),
+        flutter: z.string().optional(),
+        xcode: z.string().optional(),
+        vars: z.record(z.string()).optional(),
+    })
+        .optional(),
+    triggers: z
+        .object({
+        push: z.object({ branch: z.array(z.string()) }).optional(),
+    })
+        .optional(),
+    scripts: z
+        .array(z.object({
+        name: z.string().optional(),
+        script: z.string().min(1),
+    }))
+        .min(1),
+    artifacts: z.array(z.string()).optional(),
+    /** Opt-in post-build smoke test (#9 v1 — installs the built .apk or
+     *  zipped Simulator .app, launches it, screenshots it) — see
+     *  packages/agent/src/lib/android-smoke-test.ts and ios-smoke-test.ts.
+     *  Off by default; never changes existing workflows' behavior. */
+    smokeTest: z.boolean().optional(),
+    /** Opt-in OTA (over-the-air) code-push update publishing. Off by default. */
+    ota: z
+        .object({
+        channel: z.string().default("production"),
+        mandatory: z.boolean().default(false),
+    })
+        .optional(),
+});
+/** Validates a parsed appforge.yaml document. */
+export const appforgeConfigSchema = z.object({
+    platform: platformSchema,
+    workflows: z.record(appforgeWorkflowSchema).refine((w) => Object.keys(w).length > 0, {
+        message: "at least one workflow is required",
+    }),
+});
+// `.trim().toLowerCase()` before `.email()` — security-relevant, not just
+// tidiness. `apps/api/src/lib/middleware.ts`'s `isPlatformAdminEmail`
+// already lowercases the email it's checking against
+// `PLATFORM_ADMIN_EMAILS` (also stored lowercased), but nothing upstream
+// of it — this schema, `createUser`/`getUserByEmail` (packages/db/src/
+// users.ts), or the `User.email` column itself (`TEXT NOT NULL UNIQUE`,
+// SQLite's default case-sensitive BINARY collation) — ever normalized
+// case before this fix. That let a case-variant of a real platform
+// admin's email (`Admin@Company.com` vs. the allowlisted
+// `admin@company.com`) register as a *genuinely distinct* `User` row
+// (the case-sensitive UNIQUE index doesn't dedupe them) that still
+// passed `isPlatformAdminEmail`'s own lowercased check — full
+// `requirePlatformAdmin` access (fleet enroll/drain/reboot/cancel-build/
+// remote-control, every route in `apps/admin-api`) to anyone who knew an
+// admin's email address, which `docs/self-hosting.md` tells operators to
+// configure and which is often no secret at all. Normalizing here closes
+// it for every future signup/login unconditionally; see
+// `migrations/0026_lowercase_user_email.sql` for backfilling any
+// already-mixed-case row.
+const emailSchema = z.string().trim().toLowerCase().email();
+// `name`/`orgName` had no upper bound at all until this fix — signup is
+// unauthenticated and free (no payment method needed, see #19's free
+// signup credit), so any caller could submit an arbitrarily large string
+// here (megabytes+), which then gets stored in D1, echoed back in every
+// `/orgs`/`/me`-shaped API response, and rendered directly in the
+// dashboard. 255 matches the bound this same fix applies to the
+// equivalent `App`/`Org` name fields below (`createAppSchema`/
+// `updateAppSchema`/`updateOrgSchema`) — plenty for a real display name,
+// nowhere near enough to matter as a storage/response-size abuse vector.
+export const signupSchema = z.object({
+    email: emailSchema,
+    password: z.string().min(10, "password must be at least 10 characters"),
+    name: z.string().min(1).max(255, "must be at most 255 characters").optional(),
+    orgName: z.string().min(1).max(255, "must be at most 255 characters"),
+});
+export const loginSchema = z.object({
+    email: emailSchema,
+    password: z.string().min(1),
+    /** Only required when the account has TOTP 2FA enabled — see
+     *  routes/auth.ts's login handler. Mutually exclusive with
+     *  `recoveryCode` in practice (the handler tries `recoveryCode` first
+     *  when both are somehow present), never both required at once. */
+    totpCode: z.string().optional(),
+    /** Alternate to `totpCode` for a lost authenticator — one of
+     *  `TotpRecoveryCode`'s single-use codes (migrations/
+     *  0008_totp_recovery_codes.sql). */
+    recoveryCode: z.string().optional(),
+});
+export const verifyEmailSchema = z.object({
+    token: z.string().min(1),
+});
+/** `POST /auth/2fa/confirm` requires re-proving the account password —
+ *  the same "a stolen session token alone isn't enough to mutate this"
+ *  reasoning as `disableTotpSchema` below, applied to the opposite
+ *  (enable) side. Without this, a stolen/leaked session token (JWT or
+ *  API token — either satisfies `requireUser`) alone was enough to
+ *  enroll and confirm 2FA with an attacker-controlled secret: `confirm`
+ *  is the call that actually flips `User.totpEnabledAt` and hands back
+ *  the only copy of the recovery codes, and once it's flipped,
+ *  `POST /auth/login` refuses the real account owner (who has neither
+ *  the attacker's authenticator nor their recovery codes) — a
+ *  self-inflicted, unrecoverable lockout worse than the already-guarded
+ *  "stolen token disables 2FA" case, since this codebase has no
+ *  account-recovery flow. See docs/security.md's "2FA (TOTP)" note. */
+export const confirmTotpSchema = z.object({
+    code: z.string().min(6).max(6),
+    password: z.string().min(1),
+});
+/** `POST /auth/2fa/disable` requires re-proving the account password —
+ *  without this, a stolen/leaked session token (JWT or API token) alone
+ *  was enough to turn off 2FA, defeating the point of having it. See
+ *  docs/security.md's "2FA (TOTP)" note. */
+export const disableTotpSchema = z.object({
+    password: z.string().min(1),
+});
+/** `POST /auth/2fa/recovery-codes/regenerate` requires re-proving the
+ *  account password — the one mutating 2FA route in `two-factor.ts`
+ *  that didn't get this treatment when `confirmTotpSchema`/
+ *  `disableTotpSchema` above did. Without it, a stolen/leaked session
+ *  token alone (JWT or API token — either satisfies `requireUser`, and
+ *  an API token "never expires on its own") was enough to silently
+ *  invalidate every one of the real owner's existing recovery codes and
+ *  have the fresh set handed back to the attacker instead — two
+ *  independent harms in one call: it silently destroys the owner's own
+ *  recovery path (this codebase has no account-recovery flow, so a
+ *  lost authenticator plus a now-invalid saved code is an unrecoverable
+ *  lockout, with zero signal anywhere that this happened), and it hands
+ *  the attacker 10 valid recovery codes that let them satisfy the 2FA
+ *  challenge at `POST /auth/login` later, using nothing but the
+ *  password itself — defeating the entire point of 2FA. See
+ *  docs/security.md's "2FA (TOTP)" note. */
+export const regenerateRecoveryCodesSchema = z.object({
+    password: z.string().min(1),
+});
+/** `POST /auth/change-password` — same "re-prove the account password
+ *  before mutating it" reasoning as `disableTotpSchema` above: a stolen
+ *  session token alone must not be enough to rotate the one credential
+ *  every other recovery path (2FA disable, this route itself) treats as
+ *  the account's ultimate fallback. `newPassword` uses the same
+ *  `min(10)` rule `signupSchema` enforces at signup. */
+export const changePasswordSchema = z.object({
+    currentPassword: z.string().min(1),
+    newPassword: z.string().min(10, "password must be at least 10 characters"),
+});
+/** `POST /auth/forgot-password` — deliberately just an email, no
+ *  password: this is the unauthenticated "I forgot it" entry point
+ *  (issue-and-email-a-token side of the pair below), same shape as
+ *  `verifyEmailSchema`'s issuing sibling `resend-verification` (which
+ *  takes no body at all, since it's already `requireUser`-gated; this
+ *  route isn't, so it needs the email to know who to email). */
+export const forgotPasswordSchema = z.object({
+    email: emailSchema,
+});
+/** `POST /auth/reset-password` — redeems the token minted by
+ *  `forgot-password` above. `newPassword` uses the same `min(10)` rule
+ *  `changePasswordSchema`/`signupSchema` enforce everywhere else a
+ *  password is ever set. */
+export const resetPasswordSchema = z.object({
+    token: z.string().min(1),
+    newPassword: z.string().min(10, "password must be at least 10 characters"),
+});
+// `.url()` alone only checks that the string parses via the WHATWG `URL`
+// constructor — it does NOT restrict the scheme. `file:`, `ext:`,
+// `ssh:`, and `git:` all parse as valid URLs just as readily as
+// `https:` does. `repoUrl` is stored verbatim (`packages/db/src/
+// apps.ts`) and, once a build is leased, handed straight to a real
+// `git clone` on a shared Mac-mini build slot
+// (`packages/agent/src/lib/builder.ts`'s `runScript`/`simpleGit().clone`)
+// — real `git` honors whatever transport the URL names: `file://`
+// clones a local path on that shared host outright, and `git://`/
+// `ssh://` attempt a real network connection to wherever the URL
+// points — an SSRF vector against any host that Mac mini can otherwise
+// reach (verified directly against a real `git` binary: an
+// unrestricted `git://` clone genuinely attempts a DNS lookup/
+// connection before failing). Git's own `ext::<command>` transport is
+// worse still — it runs an arbitrary shell command as the "clone"
+// itself, real RCE — though verified that a current `git` already
+// refuses it by default; not every Mac mini in the fleet is guaranteed
+// to run a git new enough to have that hardening, so this schema still
+// closes it off rather than depending on git's own version-dependent
+// default. Any signed-up org (no payment method needed — see #19's
+// free signup credit) can set an app's `repoUrl` and trigger a build,
+// so this schema is the actual authorization boundary for what
+// transport ever reaches a real `git clone` on shared, multi-tenant
+// infrastructure (`agents.ts`'s own docblock: "the fleet is a shared
+// pool... not one Mac mini per customer"). This product only ever
+// integrates public GitHub repos over HTTPS (no SSH-deploy-key feature
+// exists anywhere in this codebase), so restricting to exactly `https:`
+// isn't just "safe enough," it's the only scheme any legitimate caller
+// ever needs. See `packages/agent/src/lib/builder.ts`'s own `runScript`
+// git-clone call for the matching defense-in-depth restriction applied
+// at the point of the actual clone, in case a repoUrl ever reaches the
+// agent by some path other than this schema.
+const repoUrlSchema = z
+    .string()
+    .url()
+    .refine((v) => new URL(v).protocol === "https:", "must be an https:// URL — no other transport (file:, ext:, ssh:, git:, ...) is supported");
+export const createAppSchema = z.object({
+    name: z.string().min(1).max(255, "must be at most 255 characters"),
+    platform: platformSchema,
+    repoUrl: repoUrlSchema,
+    defaultBranch: z.string().min(1).default("main"),
+});
+// `platform` is deliberately excluded — see updateApp's own docblock in
+// packages/db/src/apps.ts. Every field optional; the route only applies
+// whichever ones the caller actually sent.
+export const updateAppSchema = z.object({
+    name: z.string().min(1).max(255, "must be at most 255 characters").optional(),
+    repoUrl: repoUrlSchema.optional(),
+    defaultBranch: z.string().min(1).optional(),
+});
+// Deliberately narrower than `OrgRow` (packages/db) — `updateOrg`'s own
+// signature takes `Partial<OrgRow>` and applies whatever keys it's
+// given, so this schema (not that function) is what actually keeps a
+// `PATCH /orgs/:orgId` request from touching `tokenBalance`,
+// `lhvCardToken`, or any other billing-internal column, the same way
+// `updateAppSchema` deliberately excludes `platform`.
+export const updateOrgSchema = z.object({
+    name: z.string().min(1).max(255, "must be at most 255 characters").optional(),
+    // Explicit `null` clears it (disables notifications); omitted leaves
+    // whatever's already set unchanged — same "undefined vs. null" update
+    // convention this schema's own generic `updateOrg` (packages/db)
+    // partial-patch mechanism already relies on elsewhere. `.url()`
+    // deliberately doesn't restrict to https-only: a self-hosted operator
+    // testing against a local catcher (http://localhost:...) is a
+    // legitimate use before pointing this at a real endpoint.
+    buildWebhookUrl: z.string().url().nullable().optional(),
+});
+// Build-secrets v1 (ROADMAP.md, split off from #322) — a secret's `name`
+// is injected verbatim as an env var name into every build for the app
+// it's set on (apps/admin-api's /agents/lease-job route,
+// packages/agent's builder.ts), so it's restricted to the same charset
+// a real shell env var name allows (POSIX: starts with a letter/
+// underscore, then letters/digits/underscores) — anything else could
+// never actually work as `$NAME` in a workflow script, so rejecting it
+// up front is a better failure mode than accepting it and silently
+// never being usable. `value` is otherwise unrestricted content (a
+// keystore password, an API token, anything) except for two things:
+// no embedded newline, and a minimum length of 4.
+//
+// No newline: `packages/agent/src/lib/builder.ts`'s log-redaction fix
+// (the `createLineBuffer` this cycle's own fix added) buffers a build
+// step's raw stdout/stderr to `\n`-terminated lines before ever
+// running `redactSecrets` on them, on the explicit assumption that "a
+// secret's own value doesn't itself contain a newline" — true only if
+// this schema actually enforces it. Without this, a multi-line secret
+// (a PEM signing key, a base64-free P12/keystore export, a raw JSON
+// service-account credential — all realistic values for a mobile-CI
+// signing workflow) that gets echoed by a build step and happens to
+// land split across two stdout chunks at one of its own embedded
+// newlines would leak in full: each half, redacted independently,
+// never matches the whole value, reassembling into the plaintext
+// secret once the log is read back — the exact failure shape this
+// cycle's own log-redaction fixes exist to close, reopened through a
+// different trigger. Base64-encode a multi-line secret before storing
+// it if you need one (decode it back inside the workflow script
+// itself).
+//
+// Minimum 4 characters: `redactSecrets` (`builder.ts`) itself skips
+// any secret value under 4 characters entirely (`if (value.length < 4)
+// continue`) — a deliberate choice there, since redacting a one/two-
+// character "secret" would blot out ordinary log text on pure
+// coincidence far too often to be worth it, and offers essentially no
+// confidentiality anyway. But nothing tied that skip threshold to
+// what's actually *storable* as a secret until now: with only
+// `.min(1)` here, an org could set e.g. `{ name: "PIN", value: "123"
+// }`, have it injected into every build's environment exactly like any
+// other secret, and have it never redacted from the persisted log if a
+// step ever echoed it — a real, silent path from "operator sets a
+// secret" to "cleartext in a log any org member can read," defeating
+// the same "no route anywhere returns a secret's decrypted value"
+// invariant the newline restriction above protects. Matching the
+// redaction function's own skip threshold here closes that at the one
+// place a short value could ever enter the system.
+// Upper bound on `value`, added alongside the min-length/no-newline
+// checks above: this field had no ceiling at all, unlike every other
+// free-text field this codebase's build-input schemas validate (e.g.
+// `appendLogSchema.chunk`'s own `.max()`, same file). `value` is
+// injected verbatim as an env var value into every build for the app
+// it's set on — `apps/admin-api/src/routes/agents.ts`'s `/agents/
+// lease-job` route decrypts and inlines it into the job response,
+// `packages/agent/src/lib/builder.ts`'s `runBuild` spreads it straight
+// into the spawned build process's env (`spawn(..., { env: {
+// ...process.env, ...vars } })`). A sufficiently large single env var
+// can blow past the real OS `execve`/env-size ceiling (macOS's
+// `ARG_MAX`), which doesn't fail cleanly at set-time — it makes
+// `spawn`'s own `'error'` event fire on *every future build* for that
+// app, which builder.ts classifies as `failureKind: "infra"` (the
+// shell itself never launched) and auto-refunds. That's a genuine,
+// silent, self-inflicted denial of service: one oversized secret,
+// accepted without complaint through the dashboard's plain
+// `<input type="password">`, permanently breaks every subsequent build
+// for the app with an opaque native spawn failure instead of the clear
+// 400 this schema should have given at the moment the secret was
+// actually set. 64 KiB is comfortably larger than any realistic
+// keystore password, API token, PEM signing key, or JSON service-
+// account credential (even base64-inflated) while staying far under
+// any OS env-var ceiling — generous, not a tight fit, same "reject the
+// pathological case, not the normal one" reasoning `appendLogSchema.
+// chunk`'s own `.max()` already documents.
+export const setAppSecretSchema = z.object({
+    // `.max(255)` is defense in depth against one oversized name — same
+    // convention `createAppSchema.name`/`signupSchema.orgName` use — not
+    // the fix for unbounded distinct-secret *count* per app (see
+    // `MAX_APP_SECRETS_PER_APP`, apps/api/src/routes/orgs.ts, and its
+    // route's own count check for that; unlike #574/#577's list routes,
+    // `/agents/lease-job` needs every secret for a build, so bounding the
+    // read side alone wouldn't protect that hot path).
+    name: z
+        .string()
+        .max(255, "must be at most 255 characters")
+        .regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid env var name (letters, digits, underscore; not starting with a digit)"),
+    value: z
+        .string()
+        .min(4, "must be at least 4 characters — a shorter value can never be redacted from build logs (see redactSecrets in packages/agent/src/lib/builder.ts)")
+        .max(64 * 1024, "must be at most 64KB")
+        .refine((v) => !v.includes("\n"), "secret values can't contain a newline — base64-encode a multi-line secret (a PEM key, a keystore export, a JSON credential) before storing it"),
+});
+// Fleet-secrets v1 (issue #392). Unlike `AppSecret`'s free-form env var
+// names, a `FleetSecret` name is drawn from a closed allowlist, because
+// the two have very different blast radii: an `AppSecret` reaches one
+// app's own builds, whereas a `FleetSecret` is handed to the agent
+// daemon on *every* Mac mini enrolled in the org and baked into
+// `apps/device-stream`'s launchd plist. Constraining the set of storable
+// names at the one write boundary (apps/api's
+// `POST /orgs/:orgId/fleet-secrets`) keeps that broadcast channel from
+// quietly becoming a general-purpose "push arbitrary values onto every
+// machine in the fleet" mechanism — which is what it would be if any
+// name were storable. These are exactly the three values
+// `apps/device-stream` reads at startup (see its own index.ts) and the
+// three issue #392 names; adding a fourth is a deliberate one-line
+// change here plus a matching consumer, not something an API caller can
+// do on their own.
+export const FLEET_SECRET_NAMES = ["JWT_SECRET", "JWT_SECRET_PREVIOUS", "INTERNAL_SERVICE_TOKEN"];
+// `value` carries the same min-length/no-newline rules
+// `setAppSecretSchema` documents above. The newline rule matters
+// independently here: a fleet secret is written into an XML plist
+// (`renderDeviceStreamPlist`), where an embedded newline inside a
+// `<string>` would silently produce a value launchd hands the service
+// with a stray line break in it.
+export const setFleetSecretSchema = z.object({
+    name: z.enum(FLEET_SECRET_NAMES),
+    value: z
+        .string()
+        .min(4, "must be at least 4 characters — a shorter value can never be redacted from build logs (see redactSecrets in packages/agent/src/lib/builder.ts)")
+        // Same 64KB ceiling `setAppSecretSchema.value` has (see its own
+        // docblock) — this schema was added later (#392) and reintroduced
+        // the identical unbounded-value gap the earlier fix closed there.
+        // Nothing downstream (encryptSecret, the FleetSecret table's plain
+        // TEXT columns) rejects an oversized value either, and this one is
+        // broadcast to every agent in the org (GET /agents/fleet-secrets)
+        // and baked verbatim into a launchd plist <string> — an oversized
+        // value fails silently at rotation time instead of cleanly here.
+        .max(64 * 1024, "must be at most 64KB")
+        .refine((v) => !v.includes("\n"), "secret values can't contain a newline — they're written into a launchd plist <string> as-is"),
+});
+// No ASCII control characters (0x00-0x1F, 0x7F) — covers both the
+// newline-forges-a-fake-log-line case setFleetSecretSchema/
+// setAppSecretSchema's own `.refine` already guards against for a
+// different downstream (a launchd plist <string>), and ANSI escape
+// codes (\x1b), which would corrupt an operator's terminal instead.
+// See issue #614: an org-member-controlled `workflow`/`branch` value
+// is logged raw (packages/agent/src/index.ts's `Leased build ...` line)
+// to a Mac mini fleet shared across every org, before appforge.yaml's
+// own workflow-name validation ever runs.
+const NO_CONTROL_CHARS_RE = /^[^\x00-\x1f\x7f]*$/;
+const noControlChars = (v) => NO_CONTROL_CHARS_RE.test(v);
+const NO_CONTROL_CHARS_MESSAGE = "can't contain control characters (including newlines)";
+export const triggerBuildSchema = z.object({
+    appId: z.string().min(1),
+    workflow: z.string().min(1).max(255, "must be at most 255 characters").refine(noControlChars, NO_CONTROL_CHARS_MESSAGE),
+    branch: z
+        .string()
+        .min(1)
+        .max(255, "must be at most 255 characters")
+        .refine(noControlChars, NO_CONTROL_CHARS_MESSAGE)
+        .optional(),
+});
+export const topUpSchema = z.object({
+    packId: z.string().min(1),
+});
+export const setBillingModeSchema = z.object({
+    mode: z.enum(["prepaid", "postpaid_monthly"]),
+});
+export const agentEnrollSchema = z.object({
+    enrollmentToken: z.string().min(1),
+    name: z.string().min(1),
+    // The Mac's hardware UUID — the stable key the control plane dedupes
+    // enrollment on (see @appforge-ci/db's upsertAgent). Optional/nullable:
+    // absent from agents built before this field existed, and null on a
+    // non-Mac host, where the server falls back to matching on hostname.
+    machineId: z.string().min(1).nullable().optional(),
+    hostname: z.string().min(1),
+    macOsVersion: z.string().min(1),
+    xcodeVersion: z.string().nullable().optional(),
+    flutterVersion: z.string().nullable().optional(),
+    javaVersion: z.string().nullable().optional(),
+    androidSdkVersion: z.string().nullable().optional(),
+    cocoapodsVersion: z.string().nullable().optional(),
+    cpuModel: z.string().min(1),
+    // Optional/nullable for the same reason as machineId above: absent from
+    // an agent binary built before this field existed. A current binary
+    // always sends its own real AGENT_VERSION (packages/agent/src/lib/
+    // version.ts) — see @appforge-ci/core's isAgentVersionCurrent.
+    agentVersion: z.string().min(1).nullable().optional(),
+    // Optional/nullable for the same reason: absent from an agent binary
+    // built before this field existed. See packages/agent/src/lib/
+    // system-info.ts's screenSharingEnabled().
+    screenSharingEnabled: z.boolean().nullable().optional(),
+});
+export const agentHeartbeatSchema = z.object({
+    status: z.enum(["online", "draining", "building"]),
+    cpuUsagePercent: z.number().min(0).max(100),
+    memUsagePercent: z.number().min(0).max(100),
+    diskFreeGb: z.number().min(0),
+    currentBuildId: z.string().nullable().optional(),
+    tailscaleHostname: z.string().nullable().optional(),
+    // Always present (the agent caches its last-detected values and sends
+    // them every tick — see updateAgentHeartbeat's docblock in
+    // @appforge/db for why these are a direct overwrite, not optional).
+    xcodeVersion: z.string().nullable(),
+    flutterVersion: z.string().nullable(),
+    javaVersion: z.string().nullable(),
+    androidSdkVersion: z.string().nullable(),
+    cocoapodsVersion: z.string().nullable(),
+    // Nullable and optional, unlike the toolchain fields just above —
+    // omitted entirely by a not-yet-upgraded agent binary (updateAgentHeartbeat
+    // then COALESCEs, keeping whatever version this row last reported)
+    // rather than always resent, since a real build's own version is a
+    // constant, not a live-detected value that can legitimately disappear.
+    agentVersion: z.string().min(1).nullable().optional(),
+    // Same COALESCE-on-omission reasoning as agentVersion just above.
+    screenSharingEnabled: z.boolean().nullable().optional(),
+    // Concurrent builds (see @appforge-ci/agent's ConcurrentBuildRunner) —
+    // both optional/omittable for the same "not-yet-upgraded agent binary"
+    // reason as agentVersion/screenSharingEnabled just above; once an agent
+    // does send them, apps/admin-api's heartbeat route overwrites directly,
+    // never merges (see migrations/0017_agent_concurrency.sql's docblock).
+    /** How many builds this Mac will run at once. */
+    capacity: z.number().int().min(1).optional(),
+    /** Build ids this agent is running right now — its length is always
+     *  <= capacity. Empty array means idle, distinct from omitting the
+     *  field entirely (an old agent binary that's never heard of this). */
+    activeBuildIds: z.array(z.string()).optional(),
+});
+// `POST /builds/:buildId/logs` (apps/admin-api/src/routes/agents.ts) —
+// one call per flushed line/burst from `packages/agent/src/lib/
+// builder.ts`'s `createLineBuffer`, which itself caps a single
+// *unterminated* line at 1 MiB before flushing it as its own call, and
+// routinely flushes smaller multi-line bursts well under that. `.max()`
+// here is a generous ceiling above that normal range (rejecting outright
+// a single pathological chunk, 400) rather than a tight fit around it —
+// the real cumulative-growth guard is the per-build byte cap
+// `Build.logBytes` enforces route-side (migrations/
+// 0028_build_log_bytes_cap.sql), not this per-chunk bound; this just
+// closes the "one absurdly large chunk in a single call" gap that cap
+// alone wouldn't catch quickly (it only rejects the *next* call once the
+// cumulative total is already over, not the one call that single-
+// handedly blows past it).
+export const appendLogSchema = z.object({
+    chunk: z.string().max(4 * 1024 * 1024, "log chunk too large"),
+    seq: z.number().int().min(0),
+});
+export const completeBuildSchema = z.object({
+    status: z.enum(["succeeded", "failed"]),
+    artifacts: z
+        .array(z.object({
+        fileName: z.string(),
+        sizeBytes: z.number().int().min(0),
+        storageKey: z.string(),
+    }))
+        .default([]),
+    // Present only for builds run with an OTA-enabled workflow (Flutter/React
+    // Native code-push) — see packages/agent/src/lib/builder.ts's otaInfo and
+    // @appforge-ci/agent's ApiClient.completeBuild.
+    ota: z
+        .object({
+        channel: z.string().min(1).optional(),
+        mandatory: z.boolean().optional(),
+        bundleHash: z.string().min(1).optional(),
+    })
+        .optional(),
+    // Only meaningful when status is "failed" — see BuildResult.failureKind's
+    // docblock in packages/agent/src/lib/builder.ts for exactly what "infra"
+    // covers (deliberately narrow) and apps/admin-api/src/routes/agents.ts's
+    // /builds/:buildId/complete for what it drives (an automatic refund).
+    // Absent/undefined on a succeeded build, or on an older agent version
+    // that predates this field.
+    failureKind: z.enum(["user", "infra"]).optional(),
+});
+// `channel` had no upper bound at all — same `.max(255)` convention as
+// `createAppSchema`'s `name`. Defense in depth alongside the pagination
+// fix for `listOtaChannelsForApp`/`GET /apps/:appId/ota/channels`
+// (packages/db/src/ota.ts): this caps how large a single abusive channel
+// string can be, though the actual unbounded-request-cost fix is
+// pagination — this schema has no way to cap how many *distinct*
+// channels an org member creates, only each one's own length.
+export const promoteOtaReleaseSchema = z.object({
+    buildId: z.string().min(1),
+    channel: z.string().min(1).max(255, "must be at most 255 characters").default("production"),
+    mandatory: z.boolean().optional().default(false),
+    rollout: z.number().int().min(0).max(100).optional().default(100),
+});
+export const setActiveOtaReleaseSchema = z.object({
+    releaseId: z.string().min(1).nullable(),
+});
+// Same 0-100 bound as `promoteOtaReleaseSchema`'s own `rollout` field —
+// this is the fix that lets an existing release's rollout be progressed
+// in place (10% -> 50% -> 100%) without minting a new release id, which
+// would otherwise reshuffle `isInStagedRollout`'s per-install bucketing
+// (packages/core/src/ota-rollout.ts) since it hashes on `releaseId`.
+export const updateOtaReleaseRolloutSchema = z.object({
+    rollout: z.number().int().min(0).max(100),
+});
+/** `PATCH /orgs/:orgId/agents/:agentId/remote-control` (apps/admin-api) —
+ *  the only way `Agent.remoteControlEnabled` ever changes (see
+ *  @appforge/db's migrations/0024_agent_remote_control.sql). Deliberately
+ *  not threaded through agentEnrollSchema/agentHeartbeatSchema above:
+ *  this is an operator policy decision, not something the agent
+ *  self-reports. */
+export const setAgentRemoteControlSchema = z.object({
+    enabled: z.boolean(),
+});
+/** `POST /orgs/:orgId/agents/:agentId/vnc-session` (apps/admin-api)'s
+ *  request body — optional and defaults to "view" (via `.optional()`,
+ *  left for the route to interpret as the no-body case), matching every
+ *  existing caller that sends no body at all today. `mode: "control"` is
+ *  a *request*, not a grant: the route decides the actually-issued mode
+ *  server-side from `Agent.remoteControlEnabled` and echoes it back in
+ *  the response — see that route's own docblock. */
+export const startVncSessionSchema = z.object({
+    mode: z.enum(["view", "control"]).optional(),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC;SACX,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACtC,CAAC;SACD,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC3D,CAAC;SACD,QAAQ,EAAE;IACb,OAAO,EAAE,CAAC;SACP,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC1B,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;IACT,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzC;;;sEAGkE;IAClE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,6EAA6E;IAC7E,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC;QACzC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACtC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,iDAAiD;AACjD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,QAAQ,EAAE,cAAc;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE;QACnF,OAAO,EAAE,mCAAmC;KAC7C,CAAC;CACH,CAAC,CAAC;AAEH,0EAA0E;AAC1E,sEAAsE;AACtE,qDAAqD;AACrD,yEAAyE;AACzE,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,yDAAyD;AACzD,qEAAqE;AACrE,mEAAmE;AACnE,8DAA8D;AAC9D,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,wDAAwD;AACxD,iEAAiE;AACjE,0BAA0B;AAC1B,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;AAE5D,wEAAwE;AACxE,qEAAqE;AACrE,yEAAyE;AACzE,wEAAwE;AACxE,kEAAkE;AAClE,gEAAgE;AAChE,+DAA+D;AAC/D,yEAAyE;AACzE,yEAAyE;AACzE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,yCAAyC,CAAC;IACvE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,QAAQ,EAAE;IAC7E,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC;CACtE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,WAAW;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B;;;uEAGmE;IACnE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B;;yCAEqC;IACrC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH;;;;;;;;;;;;uEAYuE;AACvE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH;;;4CAG4C;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;4CAe4C;AAC5C,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH;;;;;wDAKwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,yCAAyC,CAAC;CAC3E,CAAC,CAAC;AAEH;;;;;gEAKgE;AAChE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,WAAW;CACnB,CAAC,CAAC;AAEH;;;4BAG4B;AAC5B,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,yCAAyC,CAAC;CAC3E,CAAC,CAAC;AAEH,yEAAyE;AACzE,kEAAkE;AAClE,gEAAgE;AAChE,iEAAiE;AACjE,mEAAmE;AACnE,8CAA8C;AAC9C,0EAA0E;AAC1E,kEAAkE;AAClE,kEAAkE;AAClE,iEAAiE;AACjE,uEAAuE;AACvE,2DAA2D;AAC3D,+DAA+D;AAC/D,sEAAsE;AACtE,kEAAkE;AAClE,kEAAkE;AAClE,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,mEAAmE;AACnE,sEAAsE;AACtE,+DAA+D;AAC/D,oEAAoE;AACpE,qEAAqE;AACrE,kEAAkE;AAClE,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,6CAA6C;AAC7C,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,EAAE;KACR,GAAG,EAAE;KACL,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,0FAA0F,CAAC,CAAC;AAE/I,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC;IAClE,QAAQ,EAAE,cAAc;IACxB,OAAO,EAAE,aAAa;IACtB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CACjD,CAAC,CAAC;AAEH,wEAAwE;AACxE,wEAAwE;AACxE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,QAAQ,EAAE;IAC7E,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE;IACjC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,wEAAwE;AACxE,mEAAmE;AACnE,qEAAqE;AACrE,6DAA6D;AAC7D,qEAAqE;AACrE,sDAAsD;AACtD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,QAAQ,EAAE;IAC7E,qEAAqE;IACrE,sEAAsE;IACtE,iEAAiE;IACjE,gEAAgE;IAChE,sEAAsE;IACtE,8DAA8D;IAC9D,0DAA0D;IAC1D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,yEAAyE;AACzE,uEAAuE;AACvE,yDAAyD;AACzD,uEAAuE;AACvE,iEAAiE;AACjE,qEAAqE;AACrE,uEAAuE;AACvE,mEAAmE;AACnE,mEAAmE;AACnE,oEAAoE;AACpE,kDAAkD;AAClD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,gEAAgE;AAChE,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,oEAAoE;AACpE,oEAAoE;AACpE,oEAAoE;AACpE,iEAAiE;AACjE,kEAAkE;AAClE,iEAAiE;AACjE,kEAAkE;AAClE,qEAAqE;AACrE,sEAAsE;AACtE,gEAAgE;AAChE,WAAW;AACX,EAAE;AACF,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,8DAA8D;AAC9D,sEAAsE;AACtE,kEAAkE;AAClE,8DAA8D;AAC9D,qEAAqE;AACrE,uEAAuE;AACvE,uEAAuE;AACvE,kEAAkE;AAClE,qEAAqE;AACrE,kEAAkE;AAClE,iEAAiE;AACjE,sEAAsE;AACtE,mDAAmD;AACnD,oEAAoE;AACpE,qEAAqE;AACrE,qEAAqE;AACrE,iEAAiE;AACjE,qEAAqE;AACrE,kEAAkE;AAClE,kEAAkE;AAClE,uEAAuE;AACvE,6DAA6D;AAC7D,sEAAsE;AACtE,+DAA+D;AAC/D,gEAAgE;AAChE,sEAAsE;AACtE,kEAAkE;AAClE,mEAAmE;AACnE,kEAAkE;AAClE,2DAA2D;AAC3D,uEAAuE;AACvE,uEAAuE;AACvE,iEAAiE;AACjE,gEAAgE;AAChE,kEAAkE;AAClE,oEAAoE;AACpE,uEAAuE;AACvE,qEAAqE;AACrE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,oEAAoE;IACpE,qEAAqE;IACrE,6DAA6D;IAC7D,kEAAkE;IAClE,oEAAoE;IACpE,sEAAsE;IACtE,mDAAmD;IACnD,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC;SAC1C,KAAK,CAAC,0BAA0B,EAAE,uFAAuF,CAAC;IAC7H,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,gJAAgJ,CAAC;SACxJ,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,+IAA+I,CAAC;CACrL,CAAC,CAAC;AAEH,wEAAwE;AACxE,wEAAwE;AACxE,sEAAsE;AACtE,mEAAmE;AACnE,gEAAgE;AAChE,yEAAyE;AACzE,8CAA8C;AAC9C,uEAAuE;AACvE,uEAAuE;AACvE,qEAAqE;AACrE,yDAAyD;AACzD,uEAAuE;AACvE,mEAAmE;AACnE,wEAAwE;AACxE,mBAAmB;AACnB,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,YAAY,EAAE,qBAAqB,EAAE,wBAAwB,CAAU,CAAC;AAI3G,uDAAuD;AACvD,iEAAiE;AACjE,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,iCAAiC;AACjC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC;IAChC,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,EAAE,gJAAgJ,CAAC;QACzJ,gEAAgE;QAChE,kEAAkE;QAClE,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;SAChE,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,sBAAsB,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,6FAA6F,CAAC;CACnI,CAAC,CAAC;AAEH,kEAAkE;AAClE,4DAA4D;AAC5D,kEAAkE;AAClE,mEAAmE;AACnE,oEAAoE;AACpE,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,0CAA0C;AAC1C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAClD,MAAM,cAAc,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClE,MAAM,wBAAwB,GAAG,uDAAuD,CAAC;AAEzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAAC;IACvH,MAAM,EAAE,CAAC;SACN,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC;SAC1C,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAAC;SAChD,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,qEAAqE;IACrE,wEAAwE;IACxE,oEAAoE;IACpE,qEAAqE;IACrE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,wEAAwE;IACxE,oEAAoE;IACpE,mEAAmE;IACnE,+DAA+D;IAC/D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,qEAAqE;IACrE,+DAA+D;IAC/D,2CAA2C;IAC3C,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAClD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACnD,sEAAsE;IACtE,2DAA2D;IAC3D,oEAAoE;IACpE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,kEAAkE;IAClE,4EAA4E;IAC5E,mEAAmE;IACnE,mEAAmE;IACnE,uEAAuE;IACvE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,kEAAkE;IAClE,oBAAoB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,uEAAuE;IACvE,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,uEAAuE;IACvE,iDAAiD;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC5C;;2EAEuE;IACvE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH,uEAAuE;AACvE,gEAAgE;AAChE,+DAA+D;AAC/D,uEAAuE;AACvE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,6DAA6D;AAC7D,oDAAoD;AACpD,qEAAqE;AACrE,sEAAsE;AACtE,yEAAyE;AACzE,kEAAkE;AAClE,2BAA2B;AAC3B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,qBAAqB,CAAC;IAC7D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACvC,SAAS,EAAE,CAAC;SACT,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;KACvB,CAAC,CACH;SACA,OAAO,CAAC,EAAE,CAAC;IACd,0EAA0E;IAC1E,0EAA0E;IAC1E,gDAAgD;IAChD,GAAG,EAAE,CAAC;SACH,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACzC,CAAC;SACD,QAAQ,EAAE;IACb,0EAA0E;IAC1E,yEAAyE;IACzE,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,4BAA4B;IAC5B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAEH,uEAAuE;AACvE,wEAAwE;AACxE,kEAAkE;AAClE,yEAAyE;AACzE,iEAAiE;AACjE,iEAAiE;AACjE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;IAC3F,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IAChD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CAClE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAC1C,CAAC,CAAC;AAEH;;;;;oBAKoB;AACpB,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAEH;;;;;;oDAMoD;AACpD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC"}

package/dist/token-packs.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token-packs.test.d.ts.map

package/dist/token-packs.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-packs.test.d.ts","sourceRoot":"","sources":["../src/token-packs.test.ts"],"names":[],"mappings":""}

package/dist/token-packs.test.js

@@ -0,0 +1,34 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { tokenPackDisplay, findTokenPack, TOKEN_PACKS, BUILD_COST_TOKENS } from "./types.js";
+test("tokenPackDisplay: starter pack is the list-price baseline (0% discount)", () => {
+    const starter = TOKEN_PACKS.find((p) => p.id === "starter");
+    const display = tokenPackDisplay(starter);
+    assert.equal(display.priceEur, 10);
+    assert.equal(display.pricePerTokenCents, 1);
+    assert.equal(display.buildsIncluded, Math.floor(starter.tokens / BUILD_COST_TOKENS));
+    assert.equal(display.discountPercent, 0);
+});
+test("tokenPackDisplay: growth/scale/studio discounts match TOKEN_PACKS' own documented rates", () => {
+    // Matches the "// 10% off" / "20% off" / "30% off" comments next to
+    // TOKEN_PACKS' own definition — this confirms existing intent, not new behavior.
+    const expected = { growth: 10, scale: 20, studio: 30 };
+    for (const [id, discountPercent] of Object.entries(expected)) {
+        const pack = TOKEN_PACKS.find((p) => p.id === id);
+        assert.equal(tokenPackDisplay(pack).discountPercent, discountPercent, `${id} pack`);
+    }
+});
+test("tokenPackDisplay: buildsIncluded is tokens / BUILD_COST_TOKENS, floored", () => {
+    for (const pack of TOKEN_PACKS) {
+        assert.equal(tokenPackDisplay(pack).buildsIncluded, Math.floor(pack.tokens / BUILD_COST_TOKENS));
+    }
+});
+test("findTokenPack returns the matching pack for a known id", () => {
+    const pack = findTokenPack("scale");
+    assert.equal(pack?.id, "scale");
+    assert.equal(pack?.tokens, 30_000);
+});
+test("findTokenPack returns undefined for an unknown id", () => {
+    assert.equal(findTokenPack("does-not-exist"), undefined);
+});
+//# sourceMappingURL=token-packs.test.js.map

package/dist/token-packs.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-packs.test.js","sourceRoot":"","sources":["../src/token-packs.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE7F,IAAI,CAAC,yEAAyE,EAAE,GAAG,EAAE;IACnF,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAE,CAAC;IAC7D,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC;IACrF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yFAAyF,EAAE,GAAG,EAAE;IACnG,oEAAoE;IACpE,iFAAiF;IACjF,MAAM,QAAQ,GAA2B,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC/E,KAAK,MAAM,CAAC,EAAE,EAAE,eAAe,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAE,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,eAAe,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACtF,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yEAAyE,EAAE,GAAG,EAAE;IACnF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC;IACnG,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wDAAwD,EAAE,GAAG,EAAE;IAClE,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,mDAAmD,EAAE,GAAG,EAAE;IAC7D,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAC,CAAC;AAC3D,CAAC,CAAC,CAAC"}