@paperclipai/shared 2026.817.0 → 2026.818.0-beta.1

package/dist/validators/claude-setup-token-session.d.ts

@@ -0,0 +1,244 @@
+import { z } from "zod";
+export declare const setupTokenTransportAdvisorySchema: z.ZodObject<{
+    code: z.ZodLiteral<"insecure_transport">;
+}, "strict", z.ZodTypeAny, {
+    code: "insecure_transport";
+}, {
+    code: "insecure_transport";
+}>;
+export type SetupTokenTransportAdvisory = z.infer<typeof setupTokenTransportAdvisorySchema>;
+export declare const claudeSetupTokenOverwriteSchema: z.ZodObject<{
+    expectedSecretId: z.ZodString;
+    expectedLatestVersion: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    expectedSecretId: string;
+    expectedLatestVersion: number;
+}, {
+    expectedSecretId: string;
+    expectedLatestVersion: number;
+}>;
+export type ClaudeSetupTokenOverwrite = z.infer<typeof claudeSetupTokenOverwriteSchema>;
+export declare const startClaudeSetupTokenSessionRequestSchema: z.ZodObject<{
+    environmentId: z.ZodString;
+    adapterType: z.ZodEnum<["process", "http", "claude_local", "codex_local", "cursor_cloud", "gemini_local", "grok_local", "hermes_gateway", "hermes_local", "opencode_local", "pi_local", "cursor", "openclaw_gateway"]>;
+    overwrite: z.ZodOptional<z.ZodObject<{
+        expectedSecretId: z.ZodString;
+        expectedLatestVersion: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        expectedSecretId: string;
+        expectedLatestVersion: number;
+    }, {
+        expectedSecretId: string;
+        expectedLatestVersion: number;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    adapterType: "process" | "http" | "claude_local" | "codex_local" | "cursor_cloud" | "gemini_local" | "grok_local" | "hermes_gateway" | "hermes_local" | "opencode_local" | "pi_local" | "cursor" | "openclaw_gateway";
+    environmentId: string;
+    overwrite?: {
+        expectedSecretId: string;
+        expectedLatestVersion: number;
+    } | undefined;
+}, {
+    adapterType: "process" | "http" | "claude_local" | "codex_local" | "cursor_cloud" | "gemini_local" | "grok_local" | "hermes_gateway" | "hermes_local" | "opencode_local" | "pi_local" | "cursor" | "openclaw_gateway";
+    environmentId: string;
+    overwrite?: {
+        expectedSecretId: string;
+        expectedLatestVersion: number;
+    } | undefined;
+}>;
+export type StartClaudeSetupTokenSessionRequest = z.infer<typeof startClaudeSetupTokenSessionRequestSchema>;
+export declare const adapterAuthPanelModeSchema: z.ZodEnum<["displayed_code", "submitted_browser_code"]>;
+export type AdapterAuthPanelMode = z.infer<typeof adapterAuthPanelModeSchema>;
+export declare const claudeSetupTokenSessionResponseSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    environmentId: z.ZodString;
+    status: z.ZodEnum<["starting", "waiting_for_user", "authenticated", "failed", "timed_out", "cancelled"]>;
+    expiresAt: z.ZodNullable<z.ZodUnion<[z.ZodDate, z.ZodString]>>;
+    failure: z.ZodNullable<z.ZodObject<{
+        reason: z.ZodString;
+        message: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        message: string | null;
+        reason: string;
+    }, {
+        message: string | null;
+        reason: string;
+    }>>;
+    transportAdvisory: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        code: z.ZodLiteral<"insecure_transport">;
+    }, "strict", z.ZodTypeAny, {
+        code: "insecure_transport";
+    }, {
+        code: "insecure_transport";
+    }>>>;
+}, "strict", z.ZodTypeAny, {
+    failure: {
+        message: string | null;
+        reason: string;
+    } | null;
+    status: "authenticated" | "cancelled" | "failed" | "starting" | "waiting_for_user" | "timed_out";
+    environmentId: string;
+    expiresAt: string | Date | null;
+    sessionId: string;
+    transportAdvisory?: {
+        code: "insecure_transport";
+    } | null | undefined;
+}, {
+    failure: {
+        message: string | null;
+        reason: string;
+    } | null;
+    status: "authenticated" | "cancelled" | "failed" | "starting" | "waiting_for_user" | "timed_out";
+    environmentId: string;
+    expiresAt: string | Date | null;
+    sessionId: string;
+    transportAdvisory?: {
+        code: "insecure_transport";
+    } | null | undefined;
+}>;
+export type ClaudeSetupTokenSessionResponse = z.infer<typeof claudeSetupTokenSessionResponseSchema>;
+export declare const claudeSetupTokenSessionPromptSchema: z.ZodObject<{
+    authorizationUrl: z.ZodString;
+    transportAdvisory: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        code: z.ZodLiteral<"insecure_transport">;
+    }, "strict", z.ZodTypeAny, {
+        code: "insecure_transport";
+    }, {
+        code: "insecure_transport";
+    }>>>;
+}, "strict", z.ZodTypeAny, {
+    authorizationUrl: string;
+    transportAdvisory?: {
+        code: "insecure_transport";
+    } | null | undefined;
+}, {
+    authorizationUrl: string;
+    transportAdvisory?: {
+        code: "insecure_transport";
+    } | null | undefined;
+}>;
+export type ClaudeSetupTokenSessionPrompt = z.infer<typeof claudeSetupTokenSessionPromptSchema>;
+export declare const claudeSetupTokenSessionOwnerResponseSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    environmentId: z.ZodString;
+    status: z.ZodEnum<["starting", "waiting_for_user", "authenticated", "failed", "timed_out", "cancelled"]>;
+    expiresAt: z.ZodNullable<z.ZodUnion<[z.ZodDate, z.ZodString]>>;
+    failure: z.ZodNullable<z.ZodObject<{
+        reason: z.ZodString;
+        message: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        message: string | null;
+        reason: string;
+    }, {
+        message: string | null;
+        reason: string;
+    }>>;
+    transportAdvisory: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        code: z.ZodLiteral<"insecure_transport">;
+    }, "strict", z.ZodTypeAny, {
+        code: "insecure_transport";
+    }, {
+        code: "insecure_transport";
+    }>>>;
+} & {
+    panelMode: z.ZodEnum<["displayed_code", "submitted_browser_code"]>;
+    prompt: z.ZodNullable<z.ZodObject<{
+        authorizationUrl: z.ZodString;
+        transportAdvisory: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            code: z.ZodLiteral<"insecure_transport">;
+        }, "strict", z.ZodTypeAny, {
+            code: "insecure_transport";
+        }, {
+            code: "insecure_transport";
+        }>>>;
+    }, "strict", z.ZodTypeAny, {
+        authorizationUrl: string;
+        transportAdvisory?: {
+            code: "insecure_transport";
+        } | null | undefined;
+    }, {
+        authorizationUrl: string;
+        transportAdvisory?: {
+            code: "insecure_transport";
+        } | null | undefined;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    failure: {
+        message: string | null;
+        reason: string;
+    } | null;
+    prompt: {
+        authorizationUrl: string;
+        transportAdvisory?: {
+            code: "insecure_transport";
+        } | null | undefined;
+    } | null;
+    status: "authenticated" | "cancelled" | "failed" | "starting" | "waiting_for_user" | "timed_out";
+    environmentId: string;
+    expiresAt: string | Date | null;
+    sessionId: string;
+    panelMode: "displayed_code" | "submitted_browser_code";
+    transportAdvisory?: {
+        code: "insecure_transport";
+    } | null | undefined;
+}, {
+    failure: {
+        message: string | null;
+        reason: string;
+    } | null;
+    prompt: {
+        authorizationUrl: string;
+        transportAdvisory?: {
+            code: "insecure_transport";
+        } | null | undefined;
+    } | null;
+    status: "authenticated" | "cancelled" | "failed" | "starting" | "waiting_for_user" | "timed_out";
+    environmentId: string;
+    expiresAt: string | Date | null;
+    sessionId: string;
+    panelMode: "displayed_code" | "submitted_browser_code";
+    transportAdvisory?: {
+        code: "insecure_transport";
+    } | null | undefined;
+}>;
+export type ClaudeSetupTokenSessionOwnerResponse = z.infer<typeof claudeSetupTokenSessionOwnerResponseSchema>;
+export declare const BROWSER_CODE_MAX_LENGTH = 512;
+export declare const BROWSER_CODE_DISALLOWED_CHAR: RegExp;
+/**
+ * Returns true when the browser code obeys the grammar. The code has one or more
+ * characters, no character outside the visible ASCII range, and a length at or
+ * below the bounded maximum.
+ */
+export declare function isValidBrowserCode(code: string): boolean;
+export declare const BROWSER_CODE_PATTERN: RegExp;
+export declare const browserCodeSchema: z.ZodEffects<z.ZodString, string, string>;
+export type BrowserCode = z.infer<typeof browserCodeSchema>;
+export declare const submitBrowserCodeRequestSchema: z.ZodObject<{
+    browserCode: z.ZodEffects<z.ZodString, string, string>;
+}, "strict", z.ZodTypeAny, {
+    browserCode: string;
+}, {
+    browserCode: string;
+}>;
+export type SubmitBrowserCodeRequest = z.infer<typeof submitBrowserCodeRequestSchema>;
+export declare const storedSessionIdSchema: z.ZodString;
+export declare const claudeSetupTokenCompletionResponseSchema: z.ZodObject<{
+    storedSessionId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    storedSessionId: string;
+}, {
+    storedSessionId: string;
+}>;
+export type ClaudeSetupTokenCompletionResponse = z.infer<typeof claudeSetupTokenCompletionResponseSchema>;
+export declare const claudeOAuthTokenStatusResponseSchema: z.ZodObject<{
+    secretId: z.ZodString;
+    latestVersion: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    secretId: string;
+    latestVersion: number;
+}, {
+    secretId: string;
+    latestVersion: number;
+}>;
+export type ClaudeOAuthTokenStatusResponse = z.infer<typeof claudeOAuthTokenStatusResponseSchema>;
+//# sourceMappingURL=claude-setup-token-session.d.ts.map

package/dist/validators/claude-setup-token-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-setup-token-session.d.ts","sourceRoot":"","sources":["../../src/validators/claude-setup-token-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,eAAO,MAAM,iCAAiC;;;;;;EAEnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAQ5F,eAAO,MAAM,+BAA+B;;;;;;;;;EAGjC,CAAC;AACZ,MAAM,MAAM,yBAAyB,GACnC,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAgBlD,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI3C,CAAC;AACZ,MAAM,MAAM,mCAAmC,GAC7C,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAG5D,eAAO,MAAM,0BAA0B,yDAAmC,CAAC;AAC3E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAS9E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOvC,CAAC;AACZ,MAAM,MAAM,+BAA+B,GACzC,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAIxD,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;EAGrC,CAAC;AACZ,MAAM,MAAM,6BAA6B,GACvC,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAItD,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAI1C,CAAC;AACd,MAAM,MAAM,oCAAoC,GAC9C,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAI7D,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAO3C,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMxD;AAQD,eAAO,MAAM,oBAAoB,QAAoB,CAAC;AAMtD,eAAO,MAAM,iBAAiB,2CAO1B,CAAC;AACL,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAG5D,eAAO,MAAM,8BAA8B;;;;;;EAEhC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAClC,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAIjD,eAAO,MAAM,qBAAqB,aAA6B,CAAC;AAKhE,eAAO,MAAM,wCAAwC;;;;;;EAE1C,CAAC;AACZ,MAAM,MAAM,kCAAkC,GAC5C,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAO3D,eAAO,MAAM,oCAAoC;;;;;;;;;EAGtC,CAAC;AACZ,MAAM,MAAM,8BAA8B,GACxC,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}

package/dist/validators/claude-setup-token-session.js

@@ -0,0 +1,128 @@
+import { z } from "zod";
+import { AGENT_ADAPTER_TYPES } from "../constants.js";
+import { ADAPTER_AUTH_PANEL_MODES, SETUP_TOKEN_TRANSPORT_ADVISORY_CODE } from "../types/agent.js";
+import { adapterAuthSessionFailureSchema, adapterAuthSessionStatusSchema, } from "./adapter-auth-session.js";
+const isoDateTime = z.union([z.date(), z.string().datetime()]);
+// The transport advisory schema. A guarded confidential response carries it when
+// the login rides a non-confidential transport. The client shows a disclaimer.
+export const setupTokenTransportAdvisorySchema = z.object({
+    code: z.literal(SETUP_TOKEN_TRANSPORT_ADVISORY_CODE),
+}).strict();
+// The confirmed-overwrite capture for a replacement login. The client reads the
+// stored value metadata from the status route and passes it back when it starts
+// a replacement login. The server maps it to the owner-bound compare-and-set: it
+// rotates the value only when the captured version still matches. The server
+// still derives the owner and the definition; this body carries no owner. A
+// missing capture starts a first-write login instead.
+export const claudeSetupTokenOverwriteSchema = z.object({
+    expectedSecretId: z.string().uuid(),
+    expectedLatestVersion: z.number().int().min(1),
+}).strict();
+// The start request for a company-and-environment Claude login session. The
+// company and the owner user come from the authenticated caller, not from this
+// body. The body names the adapter and the environment of the login. It reuses
+// the adapter login-session request fields; every field has the same meaning.
+//
+// The optional `overwrite` capture turns the login into a confirmed replacement.
+// The client sends it only after a stored token fails the agent test. The server
+// rotates the stored value under the captured version, so a concurrent change
+// fails closed with a stale conflict.
+//
+// `.strict()` rejects an extra field, so an agent id never validates. The scope
+// carries no agent id: a hire flow with no agent still starts one session. The
+// runtime does not support a caller-supplied session length, so the schema
+// exposes no `ttlSeconds` field; a legacy `ttlSeconds` fails the strict parse.
+export const startClaudeSetupTokenSessionRequestSchema = z.object({
+    environmentId: z.string().uuid(),
+    adapterType: z.enum(AGENT_ADAPTER_TYPES),
+    overwrite: claudeSetupTokenOverwriteSchema.optional(),
+}).strict();
+// The panel-mode schema. It accepts only the two known panel modes.
+export const adapterAuthPanelModeSchema = z.enum(ADAPTER_AUTH_PANEL_MODES);
+// The session id is an opaque, cryptographically random string, not a UUID. So
+// the schema accepts a bounded opaque string, not a UUID.
+const sessionIdSchema = z.string().min(1).max(256);
+// The public Claude login-session response schema. `.strict()` rejects an extra
+// field, so a prompt, a token, an account identifier, or a provider lease
+// identifier never validates.
+export const claudeSetupTokenSessionResponseSchema = z.object({
+    sessionId: sessionIdSchema,
+    environmentId: z.string().uuid(),
+    status: adapterAuthSessionStatusSchema,
+    expiresAt: isoDateTime.nullable(),
+    failure: adapterAuthSessionFailureSchema.nullable(),
+    transportAdvisory: setupTokenTransportAdvisorySchema.nullable().optional(),
+}).strict();
+// The one-time Claude login prompt schema. It carries the authorization URL the
+// user opens. It carries no server-displayed code.
+export const claudeSetupTokenSessionPromptSchema = z.object({
+    authorizationUrl: z.string().min(1),
+    transportAdvisory: setupTokenTransportAdvisorySchema.nullable().optional(),
+}).strict();
+// The owner read schema. It adds the panel mode and the one-time prompt to the
+// public response.
+export const claudeSetupTokenSessionOwnerResponseSchema = claudeSetupTokenSessionResponseSchema.extend({
+    panelMode: adapterAuthPanelModeSchema,
+    prompt: claudeSetupTokenSessionPromptSchema.nullable(),
+}).strict();
+// The bounded maximum length of a browser code. The provider code is short. The
+// server rejects an oversized code before it reaches the live login process.
+export const BROWSER_CODE_MAX_LENGTH = 512;
+// The conservative printable grammar for the submitted browser code. It matches
+// one character outside the visible ASCII range (0x21-0x7E). The validator
+// rejects a code that contains a match, so it rejects a space, a carriage
+// return, a line feed, a NUL, and every other control byte. A later
+// characterization test narrows this set to the exact provider format.
+export const BROWSER_CODE_DISALLOWED_CHAR = /[^\x21-\x7E]/;
+/**
+ * Returns true when the browser code obeys the grammar. The code has one or more
+ * characters, no character outside the visible ASCII range, and a length at or
+ * below the bounded maximum.
+ */
+export function isValidBrowserCode(code) {
+    return (code.length >= 1 &&
+        code.length <= BROWSER_CODE_MAX_LENGTH &&
+        !BROWSER_CODE_DISALLOWED_CHAR.test(code));
+}
+// The printable-ASCII allowlist pattern for the published contract. It is an
+// anchored allowlist of the visible ASCII range (0x21-0x7E). The converter reads
+// this `.regex()` from the inner `ZodString` and emits it as the OpenAPI
+// `pattern`. It is NOT the authoritative guard: JavaScript `$` matches before a
+// final line feed, so this pattern accepts a trailing newline. The `.refine()`
+// below is the authoritative guard that rejects a trailing newline.
+export const BROWSER_CODE_PATTERN = /^[\x21-\x7E]+$/u;
+// The browser-code grammar schema. It rejects an empty code, an oversized code,
+// and a code with a control byte or any other non-printable character. The
+// `.regex()` runs before the `.refine()` so the converter serializes its
+// `pattern`; the `.refine()` stays the authoritative guard.
+export const browserCodeSchema = z
+    .string()
+    .min(1, "A browser code is required.")
+    .max(BROWSER_CODE_MAX_LENGTH, "The browser code is too long.")
+    .regex(BROWSER_CODE_PATTERN, "The browser code has an invalid character.")
+    .refine((code) => !BROWSER_CODE_DISALLOWED_CHAR.test(code), {
+    message: "The browser code has an invalid character.",
+});
+// The submit-browser-code request schema. `.strict()` rejects an extra field.
+export const submitBrowserCodeRequestSchema = z.object({
+    browserCode: browserCodeSchema,
+}).strict();
+// The stored-session claim schema. The `storedSessionId` is the opaque durable
+// session id. It is a non-secret claim; it carries no token.
+export const storedSessionIdSchema = z.string().min(1).max(256);
+// The completion response schema. It carries the non-secret `storedSessionId`
+// claim and no token. `.strict()` rejects an extra field, so a token never
+// validates.
+export const claudeSetupTokenCompletionResponseSchema = z.object({
+    storedSessionId: storedSessionIdSchema,
+}).strict();
+// The stored Claude OAuth token status response schema. It carries only the
+// secret id and the latest version of the owner value; it carries no token.
+// `.strict()` rejects an extra field, so a token never validates. The status
+// route returns a fixed 404 for a missing or a foreign value, so a 200 body
+// always describes a present owner value.
+export const claudeOAuthTokenStatusResponseSchema = z.object({
+    secretId: z.string().uuid(),
+    latestVersion: z.number().int().min(1),
+}).strict();
+//# sourceMappingURL=claude-setup-token-session.js.map

package/dist/validators/claude-setup-token-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-setup-token-session.js","sourceRoot":"","sources":["../../src/validators/claude-setup-token-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC;AAClG,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAE/D,iFAAiF;AACjF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC;CACrD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,4EAA4E;AAC5E,sDAAsD;AACtD,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACnC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/C,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,8EAA8E;AAC9E,sCAAsC;AACtC,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACxC,SAAS,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,oEAAoE;AACpE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAG3E,+EAA+E;AAC/E,0DAA0D;AAC1D,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEnD,gFAAgF;AAChF,0EAA0E;AAC1E,8BAA8B;AAC9B,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,eAAe;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAChC,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IACnD,iBAAiB,EAAE,iCAAiC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,gFAAgF;AAChF,mDAAmD;AACnD,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,iBAAiB,EAAE,iCAAiC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,+EAA+E;AAC/E,mBAAmB;AACnB,MAAM,CAAC,MAAM,0CAA0C,GACrD,qCAAqC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,0BAA0B;IACrC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC,MAAM,EAAE,CAAC;AAId,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C,gFAAgF;AAChF,2EAA2E;AAC3E,0EAA0E;AAC1E,oEAAoE;AACpE,uEAAuE;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,cAAc,CAAC;AAE3D;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,CACL,IAAI,CAAC,MAAM,IAAI,CAAC;QAChB,IAAI,CAAC,MAAM,IAAI,uBAAuB;QACtC,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,iFAAiF;AACjF,yEAAyE;AACzE,gFAAgF;AAChF,+EAA+E;AAC/E,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAEtD,gFAAgF;AAChF,2EAA2E;AAC3E,yEAAyE;AACzE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,6BAA6B,CAAC;KACrC,GAAG,CAAC,uBAAuB,EAAE,+BAA+B,CAAC;KAC7D,KAAK,CAAC,oBAAoB,EAAE,4CAA4C,CAAC;KACzE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;IAC1D,OAAO,EAAE,4CAA4C;CACtD,CAAC,CAAC;AAGL,8EAA8E;AAC9E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,WAAW,EAAE,iBAAiB;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,+EAA+E;AAC/E,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEhE,8EAA8E;AAC9E,2EAA2E;AAC3E,aAAa;AACb,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,eAAe,EAAE,qBAAqB;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,0CAA0C;AAC1C,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/dist/validators/claude-setup-token-session.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=claude-setup-token-session.test.d.ts.map

package/dist/validators/claude-setup-token-session.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-setup-token-session.test.d.ts","sourceRoot":"","sources":["../../src/validators/claude-setup-token-session.test.ts"],"names":[],"mappings":""}

package/dist/validators/claude-setup-token-session.test.js

@@ -0,0 +1,107 @@
+import { describe, expect, it } from "vitest";
+import { BROWSER_CODE_MAX_LENGTH, browserCodeSchema, claudeSetupTokenCompletionResponseSchema, claudeSetupTokenSessionOwnerResponseSchema, isValidBrowserCode, startClaudeSetupTokenSessionRequestSchema, submitBrowserCodeRequestSchema, } from "./claude-setup-token-session.js";
+import { createAgentSchema, createAgentHireSchema } from "./agent.js";
+const ENVIRONMENT_ID = "11111111-1111-4111-8111-111111111111";
+describe("claude setup-token session start request", () => {
+    it("accepts a company-and-environment request with no agent id", () => {
+        const parsed = startClaudeSetupTokenSessionRequestSchema.parse({
+            environmentId: ENVIRONMENT_ID,
+            adapterType: "claude_local",
+        });
+        expect(parsed.environmentId).toBe(ENVIRONMENT_ID);
+        expect(parsed.adapterType).toBe("claude_local");
+    });
+    it("rejects a legacy ttlSeconds: the runtime does not support it", () => {
+        const result = startClaudeSetupTokenSessionRequestSchema.safeParse({
+            environmentId: ENVIRONMENT_ID,
+            adapterType: "claude_local",
+            ttlSeconds: 300,
+        });
+        expect(result.success).toBe(false);
+    });
+    it("rejects an agent id: the scope carries no agent id", () => {
+        const result = startClaudeSetupTokenSessionRequestSchema.safeParse({
+            environmentId: ENVIRONMENT_ID,
+            adapterType: "claude_local",
+            agentId: "22222222-2222-4222-8222-222222222222",
+        });
+        expect(result.success).toBe(false);
+    });
+});
+describe("browser-code grammar", () => {
+    it("accepts a conservative printable code", () => {
+        const code = "ac_012-AZ_az.9#state";
+        expect(browserCodeSchema.parse(code)).toBe(code);
+        expect(isValidBrowserCode(code)).toBe(true);
+    });
+    it("rejects a carriage return, a line feed, a NUL, and a control byte", () => {
+        for (const bad of ["ab\rcd", "ab\ncd", "ab\u0000cd", "ab\u0001cd", "ab\u007fcd", "ab cd", "ab\tcd"]) {
+            expect(browserCodeSchema.safeParse(bad).success).toBe(false);
+            expect(isValidBrowserCode(bad)).toBe(false);
+        }
+    });
+    it("rejects a trailing newline that an anchored regex would let pass", () => {
+        // The runtime `.refine()` is the authoritative guard. JavaScript `$`
+        // matches before a final line feed, so an anchored printable-ASCII regex
+        // accepts a trailing newline. The `.refine()` closes that trap.
+        expect(browserCodeSchema.safeParse("abc\n").success).toBe(false);
+        expect(isValidBrowserCode("abc\n")).toBe(false);
+    });
+    it("rejects a single control byte and accepts a printable code", () => {
+        expect(browserCodeSchema.safeParse("abc").success).toBe(true);
+        expect(browserCodeSchema.safeParse("valid-code_123").success).toBe(true);
+    });
+    it("rejects an empty code", () => {
+        expect(browserCodeSchema.safeParse("").success).toBe(false);
+        expect(isValidBrowserCode("")).toBe(false);
+    });
+    it("rejects an oversized code", () => {
+        const oversized = "a".repeat(BROWSER_CODE_MAX_LENGTH + 1);
+        expect(browserCodeSchema.safeParse(oversized).success).toBe(false);
+        expect(isValidBrowserCode(oversized)).toBe(false);
+        const atLimit = "a".repeat(BROWSER_CODE_MAX_LENGTH);
+        expect(browserCodeSchema.parse(atLimit)).toBe(atLimit);
+    });
+    it("wraps the grammar in the submit-browser-code request and rejects an extra field", () => {
+        expect(submitBrowserCodeRequestSchema.parse({ browserCode: "abc123" }).browserCode).toBe("abc123");
+        expect(submitBrowserCodeRequestSchema.safeParse({ browserCode: "a\nb" }).success).toBe(false);
+        expect(submitBrowserCodeRequestSchema.safeParse({ browserCode: "abc", extra: 1 }).success).toBe(false);
+    });
+});
+describe("claude setup-token owner response and completion response", () => {
+    it("accepts an owner response with the submitted-browser-code panel mode and a prompt", () => {
+        const parsed = claudeSetupTokenSessionOwnerResponseSchema.parse({
+            sessionId: "opaque-base64url-session-id",
+            environmentId: ENVIRONMENT_ID,
+            status: "waiting_for_user",
+            expiresAt: null,
+            failure: null,
+            panelMode: "submitted_browser_code",
+            prompt: { authorizationUrl: "https://example.test/authorize" },
+        });
+        expect(parsed.panelMode).toBe("submitted_browser_code");
+        expect(parsed.prompt?.authorizationUrl).toBe("https://example.test/authorize");
+    });
+    it("rejects a token on the completion response: the claim carries no token", () => {
+        expect(claudeSetupTokenCompletionResponseSchema.parse({ storedSessionId: "session-claim" })
+            .storedSessionId).toBe("session-claim");
+        const withToken = claudeSetupTokenCompletionResponseSchema.safeParse({
+            storedSessionId: "session-claim",
+            token: "secret",
+        });
+        expect(withToken.success).toBe(false);
+    });
+});
+describe("agent create and hire carry an optional stored-session claim", () => {
+    const base = { name: "Claude Agent", adapterType: "claude_local" };
+    it("accepts a create request without a stored-session claim", () => {
+        expect(createAgentSchema.parse({ ...base }).storedSessionId).toBeUndefined();
+    });
+    it("accepts a create request with a stored-session claim", () => {
+        expect(createAgentSchema.parse({ ...base, storedSessionId: "session-claim" }).storedSessionId).toBe("session-claim");
+    });
+    it("accepts a hire request with a stored-session claim", () => {
+        expect(createAgentHireSchema.parse({ ...base, storedSessionId: "session-claim" }).storedSessionId).toBe("session-claim");
+    });
+});
+//# sourceMappingURL=claude-setup-token-session.test.js.map

package/dist/validators/claude-setup-token-session.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-setup-token-session.test.js","sourceRoot":"","sources":["../../src/validators/claude-setup-token-session.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,wCAAwC,EACxC,0CAA0C,EAC1C,kBAAkB,EAClB,yCAAyC,EACzC,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAE9D,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,MAAM,GAAG,yCAAyC,CAAC,KAAK,CAAC;YAC7D,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,MAAM,GAAG,yCAAyC,CAAC,SAAS,CAAC;YACjE,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,cAAc;YAC3B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,MAAM,GAAG,yCAAyC,CAAC,SAAS,CAAC;YACjE,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,cAAc;YAC3B,OAAO,EAAE,sCAAsC;SAChD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG,sBAAsB,CAAC;QACpC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpG,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,uBAAuB,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACpD,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CACtF,QAAQ,CACT,CAAC;QACF,MAAM,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9F,MAAM,CACJ,8BAA8B,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CACnF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACzE,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,MAAM,GAAG,0CAA0C,CAAC,KAAK,CAAC;YAC9D,SAAS,EAAE,6BAA6B;YACxC,aAAa,EAAE,cAAc;YAC7B,MAAM,EAAE,kBAAkB;YAC1B,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,wBAAwB;YACnC,MAAM,EAAE,EAAE,gBAAgB,EAAE,gCAAgC,EAAE;SAC/D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CACJ,wCAAwC,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;aACjF,eAAe,CACnB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,wCAAwC,CAAC,SAAS,CAAC;YACnE,eAAe,EAAE,eAAe;YAChC,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8DAA8D,EAAE,GAAG,EAAE;IAC5E,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,cAAuB,EAAE,CAAC;IAE5E,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,aAAa,EAAE,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CACJ,iBAAiB,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,CACvF,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CACJ,qBAAqB,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,CAC3F,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}