@cat-factory/contracts 0.43.0 → 0.43.2

package/dist/personal-subscriptions.d.ts

@@ -1,11 +1,11 @@
 import * as v from 'valibot';
 /**
- * The personal password that gates the second encryption layer (8–256 chars). Restricted
+ * The personal password that gates the second encryption layer (6–256 chars). Restricted
  * to printable ASCII so the same value can ride **raw** in the `X-Personal-Password`
  * request header (see below) when unlocking a run — HTTP header values must be Latin-1, so
  * a non-ASCII password could not be sent without encoding. Never stored server-side.
  */
-export declare const personalPasswordSchema: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 8, undefined>, v.MaxLengthAction<string, 256, undefined>, v.RegexAction<string, "Password must use printable ASCII characters (no tabs/newlines).">]>;
+export declare const personalPasswordSchema: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 6, undefined>, v.MaxLengthAction<string, 256, undefined>, v.RegexAction<string, "Password must use printable ASCII characters (no tabs/newlines).">]>;
 /**
  * HTTP header carrying the personal password to unlock a run's individual-usage
  * credential(s). It is an AMBIENT credential — like the bearer token, the client attaches
@@ -22,7 +22,7 @@ export declare const storePersonalSubscriptionSchema: v.ObjectSchema<{
     /** The raw secret (write-only): the `claude setup-token` OAuth token for `claude`. */
     readonly token: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
     /** Personal password that gates the second encryption layer. Never stored. */
-    readonly password: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 8, undefined>, v.MaxLengthAction<string, 256, undefined>, v.RegexAction<string, "Password must use printable ASCII characters (no tabs/newlines).">]>;
+    readonly password: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 6, undefined>, v.MaxLengthAction<string, 256, undefined>, v.RegexAction<string, "Password must use printable ASCII characters (no tabs/newlines).">]>;
     /**
      * Epoch ms the subscription itself expires (so we can warn well in advance and
      * block runs once lapsed). Optional — omit if the plan has no fixed end date.

package/dist/personal-subscriptions.js

@@ -21,12 +21,12 @@ import { subscriptionVendorSchema } from './vendor-credentials.js';
 // honest threat model + the full safeguards.
 // ---------------------------------------------------------------------------
 /**
- * The personal password that gates the second encryption layer (8–256 chars). Restricted
+ * The personal password that gates the second encryption layer (6–256 chars). Restricted
  * to printable ASCII so the same value can ride **raw** in the `X-Personal-Password`
  * request header (see below) when unlocking a run — HTTP header values must be Latin-1, so
  * a non-ASCII password could not be sent without encoding. Never stored server-side.
  */
-export const personalPasswordSchema = v.pipe(v.string(), v.minLength(8), v.maxLength(256), v.regex(/^[\x20-\x7e]+$/, 'Password must use printable ASCII characters (no tabs/newlines).'));
+export const personalPasswordSchema = v.pipe(v.string(), v.minLength(6), v.maxLength(256), v.regex(/^[\x20-\x7e]+$/, 'Password must use printable ASCII characters (no tabs/newlines).'));
 /**
  * HTTP header carrying the personal password to unlock a run's individual-usage
  * credential(s). It is an AMBIENT credential — like the bearer token, the client attaches

package/dist/routes/personal-subscriptions.d.ts

@@ -48,7 +48,7 @@ export declare const storePersonalSubscriptionContract: {
         readonly vendor: v.PicklistSchema<["claude", "codex", "glm", "kimi", "deepseek"], undefined>;
         readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
         readonly token: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
-        readonly password: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 8, undefined>, v.MaxLengthAction<string, 256, undefined>, v.RegexAction<string, "Password must use printable ASCII characters (no tabs/newlines).">]>;
+        readonly password: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 6, undefined>, v.MaxLengthAction<string, 256, undefined>, v.RegexAction<string, "Password must use printable ASCII characters (no tabs/newlines).">]>;
         readonly expiresAt: v.OptionalSchema<v.NullableSchema<v.NumberSchema<undefined>, undefined>, undefined>;
     }, undefined>;
     readonly responsesByStatusCode: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/contracts",
-  "version": "0.43.0",
+  "version": "0.43.2",
   "description": "Valibot wire contract shared between the Agent Architecture Board frontend and backend.",
   "repository": {
     "type": "git",