@claudexor/schema 3.4.1 → 3.5.0

package/dist/setup-login.d.ts

@@ -0,0 +1,446 @@
+/**
+ * The internal, file-backed protocol between claudexord and the DETACHED
+ * native-login runner: the sealed manifest the runner executes, the transient
+ * device-code/URL disclosure it publishes, its observable state, the permit
+ * that authorizes the spawn, and its durable result. Split out of setup.ts so
+ * the control-plane setup DTOs and the runner wire contract each stay one
+ * readable file.
+ */
+import { z } from "zod/v3";
+/** Internal, file-backed protocol between claudexord and the detached native-login runner. */
+export declare const SetupLoginProtocolVersion: z.ZodLiteral<2>;
+export declare const SetupLoginManifest: z.ZodEffects<z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    jobId: z.ZodString;
+    executionId: z.ZodString;
+    harness: z.ZodEnum<["codex", "claude", "cursor", "agy"]>;
+    jobDir: z.ZodString;
+    binary: z.ZodString;
+    args: z.ZodArray<z.ZodString, "many">;
+    cwd: z.ZodString;
+    /** Scoped config dir for an INV-135 profile login (claude CLAUDE_CONFIG_DIR /
+     * codex CODEX_HOME). OPTIONAL, not defaulted: absent on default-store jobs so
+     * pre-existing manifests keep their sealed digest across a daemon upgrade. */
+    profileConfigDir: z.ZodOptional<z.ZodString>;
+    /** How the runner performs the login: "terminal" (codex browser_redirect
+     * fallback only), "device_code" (codex app-server), "url_disclosure"
+     * (daemon-hosted, URL captured into the sidecar — cursor), or
+     * "url_disclosure_with_input" (same + one-shot stdin input — claude).
+     * OPTIONAL/undefaulted so pre-upgrade manifests keep their digest. */
+    loginMode: z.ZodOptional<z.ZodEnum<["terminal", "device_code", "url_disclosure", "url_disclosure_with_input"]>>;
+    /** Which app-server auth flow the device_code runner requests. Present only
+     * with loginMode "device_code". */
+    appServerFlow: z.ZodOptional<z.ZodEnum<["chatgptDeviceCode", "chatgpt"]>>;
+    /** Sidecar the runner writes its transient disclosure to; read by the
+     * daemon for the snapshot overlay, never journaled. device_code manifests
+     * REQUIRE it; terminal manifests MAY carry it (the runner then captures the
+     * vendor login's OAuth URL into it as an `oauth_url` disclosure). Optional
+     * so pre-upgrade sealed manifests keep their digest. */
+    deviceCodePath: z.ZodOptional<z.ZodString>;
+    /** One-shot input sidecar (url_disclosure_with_input only): transient,
+     * never journaled, delivered to the vendor CLI's stdin by the runner. */
+    inputPath: z.ZodOptional<z.ZodString>;
+    /** Whether the vendor reads its pasted code only from a REAL terminal
+     * (agy answers a plain pipe with "authentication required"); the runner
+     * then interposes a tty. Absent = a pipe, as every prior manifest. */
+    ptyStdin: z.ZodOptional<z.ZodBoolean>;
+    statePath: z.ZodString;
+    resultPath: z.ZodString;
+    permitPath: z.ZodString;
+    permitDeadlineAt: z.ZodString;
+    permitWaitMs: z.ZodOptional<z.ZodNumber>;
+    executable: z.ZodObject<{
+        realpath: z.ZodString;
+        sha256: z.ZodString;
+        size: z.ZodNumber;
+        mode: z.ZodNumber;
+        device: z.ZodString;
+        inode: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        realpath: string;
+        sha256: string;
+        size: number;
+        mode: number;
+        device: string;
+        inode: string;
+    }, {
+        realpath: string;
+        sha256: string;
+        size: number;
+        mode: number;
+        device: string;
+        inode: string;
+    }>;
+    commandDigest: z.ZodString;
+    manifestDigest: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    version: 2;
+    jobId: string;
+    executionId: string;
+    harness: "agy" | "claude" | "codex" | "cursor";
+    jobDir: string;
+    binary: string;
+    args: string[];
+    cwd: string;
+    profileConfigDir?: string | undefined;
+    loginMode?: "device_code" | "terminal" | "url_disclosure" | "url_disclosure_with_input" | undefined;
+    appServerFlow?: "chatgpt" | "chatgptDeviceCode" | undefined;
+    deviceCodePath?: string | undefined;
+    inputPath?: string | undefined;
+    ptyStdin?: boolean | undefined;
+    statePath: string;
+    resultPath: string;
+    permitPath: string;
+    permitDeadlineAt: string;
+    permitWaitMs?: number | undefined;
+    executable: {
+        realpath: string;
+        sha256: string;
+        size: number;
+        mode: number;
+        device: string;
+        inode: string;
+    };
+    commandDigest: string;
+    manifestDigest: string;
+}, {
+    version: 2;
+    jobId: string;
+    executionId: string;
+    harness: "agy" | "claude" | "codex" | "cursor";
+    jobDir: string;
+    binary: string;
+    args: string[];
+    cwd: string;
+    profileConfigDir?: string | undefined;
+    loginMode?: "device_code" | "terminal" | "url_disclosure" | "url_disclosure_with_input" | undefined;
+    appServerFlow?: "chatgpt" | "chatgptDeviceCode" | undefined;
+    deviceCodePath?: string | undefined;
+    inputPath?: string | undefined;
+    ptyStdin?: boolean | undefined;
+    statePath: string;
+    resultPath: string;
+    permitPath: string;
+    permitDeadlineAt: string;
+    permitWaitMs?: number | undefined;
+    executable: {
+        realpath: string;
+        sha256: string;
+        size: number;
+        mode: number;
+        device: string;
+        inode: string;
+    };
+    commandDigest: string;
+    manifestDigest: string;
+}>, {
+    version: 2;
+    jobId: string;
+    executionId: string;
+    harness: "agy" | "claude" | "codex" | "cursor";
+    jobDir: string;
+    binary: string;
+    args: string[];
+    cwd: string;
+    profileConfigDir?: string | undefined;
+    loginMode?: "device_code" | "terminal" | "url_disclosure" | "url_disclosure_with_input" | undefined;
+    appServerFlow?: "chatgpt" | "chatgptDeviceCode" | undefined;
+    deviceCodePath?: string | undefined;
+    inputPath?: string | undefined;
+    ptyStdin?: boolean | undefined;
+    statePath: string;
+    resultPath: string;
+    permitPath: string;
+    permitDeadlineAt: string;
+    permitWaitMs?: number | undefined;
+    executable: {
+        realpath: string;
+        sha256: string;
+        size: number;
+        mode: number;
+        device: string;
+        inode: string;
+    };
+    commandDigest: string;
+    manifestDigest: string;
+}, {
+    version: 2;
+    jobId: string;
+    executionId: string;
+    harness: "agy" | "claude" | "codex" | "cursor";
+    jobDir: string;
+    binary: string;
+    args: string[];
+    cwd: string;
+    profileConfigDir?: string | undefined;
+    loginMode?: "device_code" | "terminal" | "url_disclosure" | "url_disclosure_with_input" | undefined;
+    appServerFlow?: "chatgpt" | "chatgptDeviceCode" | undefined;
+    deviceCodePath?: string | undefined;
+    inputPath?: string | undefined;
+    ptyStdin?: boolean | undefined;
+    statePath: string;
+    resultPath: string;
+    permitPath: string;
+    permitDeadlineAt: string;
+    permitWaitMs?: number | undefined;
+    executable: {
+        realpath: string;
+        sha256: string;
+        size: number;
+        mode: number;
+        device: string;
+        inode: string;
+    };
+    commandDigest: string;
+    manifestDigest: string;
+}>;
+export type SetupLoginManifest = z.infer<typeof SetupLoginManifest>;
+/**
+ * TRANSIENT device-code sidecar the device_code runner writes after
+ * `account/login/start` succeeds. Bound to the job + execution like the state
+ * sidecar. The daemon reads it to overlay {@link SetupDeviceCodeDisclosure} on
+ * snapshots/SSE; its `userCode` is NEVER journaled, logged, or copied into the
+ * durable result receipt (INV-062 / D-17).
+ */
+export declare const SetupLoginDeviceCode: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    jobId: z.ZodString;
+    executionId: z.ZodString;
+    flow: z.ZodEnum<["chatgptDeviceCode", "chatgpt", "oauth_url", "oauth_url_input"]>;
+    verificationUrl: z.ZodString;
+    userCode: z.ZodString;
+    disclosedAt: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    version: 2;
+    jobId: string;
+    executionId: string;
+    flow: "chatgpt" | "chatgptDeviceCode" | "oauth_url" | "oauth_url_input";
+    verificationUrl: string;
+    userCode: string;
+    disclosedAt: string;
+}, {
+    version: 2;
+    jobId: string;
+    executionId: string;
+    flow: "chatgpt" | "chatgptDeviceCode" | "oauth_url" | "oauth_url_input";
+    verificationUrl: string;
+    userCode: string;
+    disclosedAt: string;
+}>;
+export type SetupLoginDeviceCode = z.infer<typeof SetupLoginDeviceCode>;
+export declare const SetupLoginRunnerState: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    jobId: z.ZodString;
+    executionId: z.ZodString;
+    processGroup: z.ZodEffects<z.ZodObject<{
+        schemaVersion: z.ZodLiteral<1>;
+        pgid: z.ZodNumber;
+        leader: z.ZodObject<{
+            status: z.ZodLiteral<"known">;
+            pid: z.ZodNumber;
+            platform: z.ZodEnum<["linux", "darwin", "win32"]>;
+            source: z.ZodEnum<["procfs_stat", "proc_pidinfo", "win32_process_times"]>;
+            startToken: z.ZodString;
+            processGroupId: z.ZodNumber;
+        }, "strict", z.ZodTypeAny, {
+            status: "known";
+            pid: number;
+            platform: "darwin" | "linux" | "win32";
+            source: "proc_pidinfo" | "procfs_stat" | "win32_process_times";
+            startToken: string;
+            processGroupId: number;
+        }, {
+            status: "known";
+            pid: number;
+            platform: "darwin" | "linux" | "win32";
+            source: "proc_pidinfo" | "procfs_stat" | "win32_process_times";
+            startToken: string;
+            processGroupId: number;
+        }>;
+    }, "strict", z.ZodTypeAny, {
+        schemaVersion: 1;
+        pgid: number;
+        leader: {
+            status: "known";
+            pid: number;
+            platform: "darwin" | "linux" | "win32";
+            source: "proc_pidinfo" | "procfs_stat" | "win32_process_times";
+            startToken: string;
+            processGroupId: number;
+        };
+    }, {
+        schemaVersion: 1;
+        pgid: number;
+        leader: {
+            status: "known";
+            pid: number;
+            platform: "darwin" | "linux" | "win32";
+            source: "proc_pidinfo" | "procfs_stat" | "win32_process_times";
+            startToken: string;
+            processGroupId: number;
+        };
+    }>, {
+        schemaVersion: 1;
+        pgid: number;
+        leader: {
+            status: "known";
+            pid: number;
+            platform: "darwin" | "linux" | "win32";
+            source: "proc_pidinfo" | "procfs_stat" | "win32_process_times";
+            startToken: string;
+            processGroupId: number;
+        };
+    }, {
+        schemaVersion: 1;
+        pgid: number;
+        leader: {
+            status: "known";
+            pid: number;
+            platform: "darwin" | "linux" | "win32";
+            source: "proc_pidinfo" | "procfs_stat" | "win32_process_times";
+            startToken: string;
+            processGroupId: number;
+        };
+    }>;
+    stage: z.ZodEnum<["awaiting_permit", "running"]>;
+    observedAt: z.ZodString;
+    commandDigest: z.ZodString;
+    manifestDigest: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    version: 2;
+    jobId: string;
+    executionId: string;
+    processGroup: {
+        schemaVersion: 1;
+        pgid: number;
+        leader: {
+            status: "known";
+            pid: number;
+            platform: "darwin" | "linux" | "win32";
+            source: "proc_pidinfo" | "procfs_stat" | "win32_process_times";
+            startToken: string;
+            processGroupId: number;
+        };
+    };
+    stage: "awaiting_permit" | "running";
+    observedAt: string;
+    commandDigest: string;
+    manifestDigest: string;
+}, {
+    version: 2;
+    jobId: string;
+    executionId: string;
+    processGroup: {
+        schemaVersion: 1;
+        pgid: number;
+        leader: {
+            status: "known";
+            pid: number;
+            platform: "darwin" | "linux" | "win32";
+            source: "proc_pidinfo" | "procfs_stat" | "win32_process_times";
+            startToken: string;
+            processGroupId: number;
+        };
+    };
+    stage: "awaiting_permit" | "running";
+    observedAt: string;
+    commandDigest: string;
+    manifestDigest: string;
+}>;
+export type SetupLoginRunnerState = z.infer<typeof SetupLoginRunnerState>;
+export declare const SetupLoginPermit: z.ZodObject<{
+    version: z.ZodLiteral<2>;
+    jobId: z.ZodString;
+    executionId: z.ZodString;
+    issuedAt: z.ZodString;
+    commandDigest: z.ZodString;
+    manifestDigest: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    version: 2;
+    jobId: string;
+    executionId: string;
+    issuedAt: string;
+    commandDigest: string;
+    manifestDigest: string;
+}, {
+    version: 2;
+    jobId: string;
+    executionId: string;
+    issuedAt: string;
+    commandDigest: string;
+    manifestDigest: string;
+}>;
+export type SetupLoginPermit = z.infer<typeof SetupLoginPermit>;
+export declare const SetupLoginRunnerResult: z.ZodEffects<z.ZodObject<{
+    executionId: z.ZodString;
+    commandDigest: z.ZodString;
+    manifestDigest: z.ZodString;
+    permitIssuedAt: z.ZodNullable<z.ZodString>;
+    commandStarted: z.ZodBoolean;
+    exitCode: z.ZodNullable<z.ZodNumber>;
+    signal: z.ZodNullable<z.ZodString>;
+    errorCode: z.ZodOptional<z.ZodEnum<["permit_timeout", "spawn_failed", "device_auth_unsupported"]>>;
+    finishedAt: z.ZodString;
+    version: z.ZodLiteral<2>;
+    jobId: z.ZodString;
+    /** Bounded, ANSI-stripped tail of the vendor command's captured output —
+     * diagnostic evidence for classifying a failed login (e.g. the device-code
+     * toggle being disabled). RESULT-FILE ONLY: the durable control receipt
+     * deliberately does not carry it (the ≤600-char slice in the failure
+     * message is the only journal/API exposure). Only tee'd flows (codex). */
+    outputTail: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    executionId: string;
+    commandDigest: string;
+    manifestDigest: string;
+    permitIssuedAt: string | null;
+    commandStarted: boolean;
+    exitCode: number | null;
+    signal: string | null;
+    errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+    finishedAt: string;
+    version: 2;
+    jobId: string;
+    outputTail?: string | undefined;
+}, {
+    executionId: string;
+    commandDigest: string;
+    manifestDigest: string;
+    permitIssuedAt: string | null;
+    commandStarted: boolean;
+    exitCode: number | null;
+    signal: string | null;
+    errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+    finishedAt: string;
+    version: 2;
+    jobId: string;
+    outputTail?: string | undefined;
+}>, {
+    executionId: string;
+    commandDigest: string;
+    manifestDigest: string;
+    permitIssuedAt: string | null;
+    commandStarted: boolean;
+    exitCode: number | null;
+    signal: string | null;
+    errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+    finishedAt: string;
+    version: 2;
+    jobId: string;
+    outputTail?: string | undefined;
+}, {
+    executionId: string;
+    commandDigest: string;
+    manifestDigest: string;
+    permitIssuedAt: string | null;
+    commandStarted: boolean;
+    exitCode: number | null;
+    signal: string | null;
+    errorCode?: "device_auth_unsupported" | "permit_timeout" | "spawn_failed" | undefined;
+    finishedAt: string;
+    version: 2;
+    jobId: string;
+    outputTail?: string | undefined;
+}>;
+export type SetupLoginRunnerResult = z.infer<typeof SetupLoginRunnerResult>;
+//# sourceMappingURL=setup-login.d.ts.map

package/dist/setup-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-login.d.ts","sourceRoot":"","sources":["../src/setup-login.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAe3B,8FAA8F;AAC9F,eAAO,MAAM,yBAAyB,iBAAe,CAAC;AAEtD,eAAO,MAAM,kBAAkB;;;;;;;;;IAU3B;;kFAE8E;;IAE9E;;;;0EAIsE;;IAItE;uCACmC;;IAEnC;;;;4DAIwD;;IAExD;6EACyE;;IAEzE;;0EAEsE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4CtE,CAAC;AACL,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;EAUtB,CAAC;AACZ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWvB,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;EASlB,CAAC;AACZ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;IAK/B;;;;8EAI0E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmB1E,CAAC;AACL,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/setup-login.js

@@ -0,0 +1,161 @@
+/**
+ * The internal, file-backed protocol between claudexord and the DETACHED
+ * native-login runner: the sealed manifest the runner executes, the transient
+ * device-code/URL disclosure it publishes, its observable state, the permit
+ * that authorizes the spawn, and its durable result. Split out of setup.ts so
+ * the control-plane setup DTOs and the runner wire contract each stay one
+ * readable file.
+ */
+import { z } from "zod/v3";
+import { harnessHasDefaultCredentialStore } from "./credential-store.js";
+import * as SetupLoginProtocol from "./setup-login-protocol.js";
+import { ControlHarnessSetupHarness, SetupAppServerLoginFlow, SetupExecutableEvidence, SetupLoginDisclosureFlow, SetupNativeCommandReceipt, SetupNativeCommandReceiptShape, SetupProcessGroupHandle, SetupTimestamp, Sha256Hex, } from "./setup.js";
+/** Internal, file-backed protocol between claudexord and the detached native-login runner. */
+export const SetupLoginProtocolVersion = z.literal(2);
+export const SetupLoginManifest = z
+    .object({
+    version: SetupLoginProtocolVersion,
+    jobId: SetupLoginProtocol.SetupLoginJobId,
+    executionId: SetupLoginProtocol.SetupLoginExecutionId,
+    harness: ControlHarnessSetupHarness,
+    jobDir: SetupLoginProtocol.SetupLoginAbsolutePath,
+    binary: SetupLoginProtocol.SetupLoginAbsolutePath,
+    args: z.array(z.string()),
+    cwd: SetupLoginProtocol.SetupLoginAbsolutePath,
+    /** Scoped config dir for an INV-135 profile login (claude CLAUDE_CONFIG_DIR /
+     * codex CODEX_HOME). OPTIONAL, not defaulted: absent on default-store jobs so
+     * pre-existing manifests keep their sealed digest across a daemon upgrade. */
+    profileConfigDir: SetupLoginProtocol.SetupLoginAbsolutePath.optional(),
+    /** How the runner performs the login: "terminal" (codex browser_redirect
+     * fallback only), "device_code" (codex app-server), "url_disclosure"
+     * (daemon-hosted, URL captured into the sidecar — cursor), or
+     * "url_disclosure_with_input" (same + one-shot stdin input — claude).
+     * OPTIONAL/undefaulted so pre-upgrade manifests keep their digest. */
+    loginMode: z
+        .enum(["terminal", "device_code", "url_disclosure", "url_disclosure_with_input"])
+        .optional(),
+    /** Which app-server auth flow the device_code runner requests. Present only
+     * with loginMode "device_code". */
+    appServerFlow: SetupAppServerLoginFlow.optional(),
+    /** Sidecar the runner writes its transient disclosure to; read by the
+     * daemon for the snapshot overlay, never journaled. device_code manifests
+     * REQUIRE it; terminal manifests MAY carry it (the runner then captures the
+     * vendor login's OAuth URL into it as an `oauth_url` disclosure). Optional
+     * so pre-upgrade sealed manifests keep their digest. */
+    deviceCodePath: SetupLoginProtocol.SetupLoginAbsolutePath.optional(),
+    /** One-shot input sidecar (url_disclosure_with_input only): transient,
+     * never journaled, delivered to the vendor CLI's stdin by the runner. */
+    inputPath: SetupLoginProtocol.SetupLoginAbsolutePath.optional(),
+    /** Whether the vendor reads its pasted code only from a REAL terminal
+     * (agy answers a plain pipe with "authentication required"); the runner
+     * then interposes a tty. Absent = a pipe, as every prior manifest. */
+    ptyStdin: z.boolean().optional(),
+    statePath: SetupLoginProtocol.SetupLoginAbsolutePath,
+    resultPath: SetupLoginProtocol.SetupLoginAbsolutePath,
+    permitPath: SetupLoginProtocol.SetupLoginAbsolutePath,
+    permitDeadlineAt: SetupTimestamp,
+    permitWaitMs: SetupLoginProtocol.SetupClientPtyPermitWaitMs,
+    executable: SetupExecutableEvidence,
+    commandDigest: Sha256Hex,
+    manifestDigest: Sha256Hex,
+})
+    .strict()
+    .superRefine((value, context) => {
+    const deny = (path, message) => context.addIssue({ code: z.ZodIssueCode.custom, path, message });
+    const deviceCode = value.loginMode === "device_code";
+    const urlDisclosure = value.loginMode === "url_disclosure" || value.loginMode === "url_disclosure_with_input";
+    if (deviceCode && value.harness !== "codex")
+        deny(["loginMode"], "device_code login mode exists only for the codex app-server");
+    if (deviceCode && (!value.appServerFlow || !value.deviceCodePath))
+        deny(["appServerFlow"], "device_code manifests require appServerFlow and deviceCodePath");
+    // deviceCodePath is legal on terminal manifests too (the runner captures
+    // the vendor login's OAuth URL into it); only the app-server flow selector
+    // stays device_code-exclusive.
+    if (!deviceCode && value.appServerFlow)
+        deny(["appServerFlow"], "appServerFlow requires loginMode device_code");
+    if (urlDisclosure && !value.deviceCodePath)
+        deny(["deviceCodePath"], "url_disclosure manifests require the disclosure sidecar path");
+    if ((value.loginMode === "url_disclosure_with_input") !== (value.inputPath !== undefined))
+        deny(["inputPath"], "inputPath rides url_disclosure_with_input manifests, exactly");
+    // A tty exists only to deliver the pasted code; claiming it elsewhere
+    // would wrap a login that never reads stdin.
+    // A harness with no default credential store has nowhere to sign in
+    // EXCEPT a named profile, so a manifest without one is malformed rather
+    // than merely unlucky — the runner would otherwise fail opaquely and the
+    // reason (INV-135 / owner decision Л-4) would never reach the user.
+    if (!harnessHasDefaultCredentialStore(value.harness) && !value.profileConfigDir)
+        deny(["profileConfigDir"], `${value.harness} has no default credential store: its login manifest must target a named profile HOME`);
+    if (value.ptyStdin && value.loginMode !== "url_disclosure_with_input")
+        deny(["ptyStdin"], "ptyStdin exists only for url_disclosure_with_input manifests");
+});
+/**
+ * TRANSIENT device-code sidecar the device_code runner writes after
+ * `account/login/start` succeeds. Bound to the job + execution like the state
+ * sidecar. The daemon reads it to overlay {@link SetupDeviceCodeDisclosure} on
+ * snapshots/SSE; its `userCode` is NEVER journaled, logged, or copied into the
+ * durable result receipt (INV-062 / D-17).
+ */
+export const SetupLoginDeviceCode = z
+    .object({
+    version: SetupLoginProtocolVersion,
+    jobId: SetupLoginProtocol.SetupLoginJobId,
+    executionId: SetupLoginProtocol.SetupLoginExecutionId,
+    flow: SetupLoginDisclosureFlow,
+    verificationUrl: z.string().url(),
+    userCode: z.string(),
+    disclosedAt: SetupTimestamp,
+})
+    .strict();
+export const SetupLoginRunnerState = z
+    .object({
+    version: SetupLoginProtocolVersion,
+    jobId: SetupLoginProtocol.SetupLoginJobId,
+    executionId: SetupLoginProtocol.SetupLoginExecutionId,
+    processGroup: SetupProcessGroupHandle,
+    stage: z.enum(["awaiting_permit", "running"]),
+    observedAt: SetupTimestamp,
+    commandDigest: Sha256Hex,
+    manifestDigest: Sha256Hex,
+})
+    .strict();
+export const SetupLoginPermit = z
+    .object({
+    version: SetupLoginProtocolVersion,
+    jobId: SetupLoginProtocol.SetupLoginJobId,
+    executionId: SetupLoginProtocol.SetupLoginExecutionId,
+    issuedAt: SetupTimestamp,
+    commandDigest: Sha256Hex,
+    manifestDigest: Sha256Hex,
+})
+    .strict();
+export const SetupLoginRunnerResult = z
+    .object({
+    version: SetupLoginProtocolVersion,
+    jobId: SetupLoginProtocol.SetupLoginJobId,
+    ...SetupNativeCommandReceiptShape,
+    /** Bounded, ANSI-stripped tail of the vendor command's captured output —
+     * diagnostic evidence for classifying a failed login (e.g. the device-code
+     * toggle being disabled). RESULT-FILE ONLY: the durable control receipt
+     * deliberately does not carry it (the ≤600-char slice in the failure
+     * message is the only journal/API exposure). Only tee'd flows (codex). */
+    outputTail: z.string().max(4000).optional(),
+})
+    .strict()
+    .superRefine((value, context) => {
+    const parsed = SetupNativeCommandReceipt.safeParse({
+        executionId: value.executionId,
+        commandDigest: value.commandDigest,
+        manifestDigest: value.manifestDigest,
+        permitIssuedAt: value.permitIssuedAt,
+        commandStarted: value.commandStarted,
+        exitCode: value.exitCode,
+        signal: value.signal,
+        ...(value.errorCode ? { errorCode: value.errorCode } : {}),
+        finishedAt: value.finishedAt,
+    });
+    if (!parsed.success) {
+        for (const issue of parsed.error.issues)
+            context.addIssue(issue);
+    }
+});
+//# sourceMappingURL=setup-login.js.map

package/dist/setup-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-login.js","sourceRoot":"","sources":["../src/setup-login.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,gCAAgC,EAAE,MAAM,uBAAuB,CAAC;AACzE,OAAO,KAAK,kBAAkB,MAAM,2BAA2B,CAAC;AAChE,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,uBAAuB,EACvB,cAAc,EACd,SAAS,GACV,MAAM,YAAY,CAAC;AAEpB,8FAA8F;AAC9F,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,OAAO,EAAE,yBAAyB;IAClC,KAAK,EAAE,kBAAkB,CAAC,eAAe;IACzC,WAAW,EAAE,kBAAkB,CAAC,qBAAqB;IACrD,OAAO,EAAE,0BAA0B;IACnC,MAAM,EAAE,kBAAkB,CAAC,sBAAsB;IACjD,MAAM,EAAE,kBAAkB,CAAC,sBAAsB;IACjD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,GAAG,EAAE,kBAAkB,CAAC,sBAAsB;IAC9C;;kFAE8E;IAC9E,gBAAgB,EAAE,kBAAkB,CAAC,sBAAsB,CAAC,QAAQ,EAAE;IACtE;;;;0EAIsE;IACtE,SAAS,EAAE,CAAC;SACT,IAAI,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,gBAAgB,EAAE,2BAA2B,CAAC,CAAC;SAChF,QAAQ,EAAE;IACb;uCACmC;IACnC,aAAa,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IACjD;;;;4DAIwD;IACxD,cAAc,EAAE,kBAAkB,CAAC,sBAAsB,CAAC,QAAQ,EAAE;IACpE;6EACyE;IACzE,SAAS,EAAE,kBAAkB,CAAC,sBAAsB,CAAC,QAAQ,EAAE;IAC/D;;0EAEsE;IACtE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,kBAAkB,CAAC,sBAAsB;IACpD,UAAU,EAAE,kBAAkB,CAAC,sBAAsB;IACrD,UAAU,EAAE,kBAAkB,CAAC,sBAAsB;IACrD,gBAAgB,EAAE,cAAc;IAChC,YAAY,EAAE,kBAAkB,CAAC,0BAA0B;IAC3D,UAAU,EAAE,uBAAuB;IACnC,aAAa,EAAE,SAAS;IACxB,cAAc,EAAE,SAAS;CAC1B,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,MAAM,IAAI,GAAG,CAAC,IAAc,EAAE,OAAe,EAAE,EAAE,CAC/C,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,KAAK,aAAa,CAAC;IACrD,MAAM,aAAa,GACjB,KAAK,CAAC,SAAS,KAAK,gBAAgB,IAAI,KAAK,CAAC,SAAS,KAAK,2BAA2B,CAAC;IAC1F,IAAI,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO;QACzC,IAAI,CAAC,CAAC,WAAW,CAAC,EAAE,6DAA6D,CAAC,CAAC;IACrF,IAAI,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QAC/D,IAAI,CAAC,CAAC,eAAe,CAAC,EAAE,gEAAgE,CAAC,CAAC;IAC5F,yEAAyE;IACzE,2EAA2E;IAC3E,+BAA+B;IAC/B,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,aAAa;QACpC,IAAI,CAAC,CAAC,eAAe,CAAC,EAAE,8CAA8C,CAAC,CAAC;IAC1E,IAAI,aAAa,IAAI,CAAC,KAAK,CAAC,cAAc;QACxC,IAAI,CAAC,CAAC,gBAAgB,CAAC,EAAE,8DAA8D,CAAC,CAAC;IAC3F,IAAI,CAAC,KAAK,CAAC,SAAS,KAAK,2BAA2B,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;QACvF,IAAI,CAAC,CAAC,WAAW,CAAC,EAAE,8DAA8D,CAAC,CAAC;IACtF,sEAAsE;IACtE,6CAA6C;IAC7C,oEAAoE;IACpE,wEAAwE;IACxE,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB;QAC7E,IAAI,CACF,CAAC,kBAAkB,CAAC,EACpB,GAAG,KAAK,CAAC,OAAO,uFAAuF,CACxG,CAAC;IACJ,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,2BAA2B;QACnE,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,8DAA8D,CAAC,CAAC;AACvF,CAAC,CAAC,CAAC;AAGL;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,OAAO,EAAE,yBAAyB;IAClC,KAAK,EAAE,kBAAkB,CAAC,eAAe;IACzC,WAAW,EAAE,kBAAkB,CAAC,qBAAqB;IACrD,IAAI,EAAE,wBAAwB;IAC9B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,cAAc;CAC5B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,OAAO,EAAE,yBAAyB;IAClC,KAAK,EAAE,kBAAkB,CAAC,eAAe;IACzC,WAAW,EAAE,kBAAkB,CAAC,qBAAqB;IACrD,YAAY,EAAE,uBAAuB;IACrC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;IAC7C,UAAU,EAAE,cAAc;IAC1B,aAAa,EAAE,SAAS;IACxB,cAAc,EAAE,SAAS;CAC1B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,OAAO,EAAE,yBAAyB;IAClC,KAAK,EAAE,kBAAkB,CAAC,eAAe;IACzC,WAAW,EAAE,kBAAkB,CAAC,qBAAqB;IACrD,QAAQ,EAAE,cAAc;IACxB,aAAa,EAAE,SAAS;IACxB,cAAc,EAAE,SAAS;CAC1B,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,OAAO,EAAE,yBAAyB;IAClC,KAAK,EAAE,kBAAkB,CAAC,eAAe;IACzC,GAAG,8BAA8B;IACjC;;;;8EAI0E;IAC1E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IAC9B,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC;QACjD,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;AACH,CAAC,CAAC,CAAC"}