@tickernelz/paperclip-pro-shared 2026.925.0

package/dist/validators/routine.js

@@ -0,0 +1,151 @@
+import { z } from "zod";
+import { ISSUE_PRIORITIES, ROUTINE_ACTIVITY_GATE_POLICIES, ROUTINE_ACTIVITY_GATE_SCOPES, ROUTINE_CATCH_UP_POLICIES, ROUTINE_CONCURRENCY_POLICIES, ROUTINE_STATUSES, ROUTINE_TRIGGER_KINDS, ROUTINE_TRIGGER_SIGNING_MODES, ROUTINE_VARIABLE_TYPES, } from "../constants.js";
+import { ISSUE_EXECUTION_WORKSPACE_PREFERENCES, issueExecutionWorkspaceSettingsSchema, } from "./issue.js";
+import { envConfigSchema } from "./secret.js";
+import { isValidRoutineDateString } from "../routine-variables.js";
+import { objectWithoutDefaults } from "./partial.js";
+const routineVariableValueSchema = z.union([z.string(), z.number().finite(), z.boolean()]);
+export const routineVariableSchema = z.object({
+    name: z.string().trim().regex(/^[A-Za-z][A-Za-z0-9_]*$/),
+    label: z.string().trim().max(120).optional().nullable(),
+    type: z.enum(ROUTINE_VARIABLE_TYPES).optional().default("text"),
+    defaultValue: routineVariableValueSchema.optional().nullable(),
+    required: z.boolean().optional().default(true),
+    options: z.array(z.string().trim().min(1).max(120)).max(50).optional().default([]),
+}).superRefine((value, ctx) => {
+    if (value.type === "select" && value.options.length === 0) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["options"],
+            message: "Select variables require at least one option",
+        });
+    }
+    if (value.type !== "select" && value.options.length > 0) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["options"],
+            message: "Only select variables can define options",
+        });
+    }
+    if (value.type === "select" && value.defaultValue != null) {
+        if (typeof value.defaultValue !== "string" || !value.options.includes(value.defaultValue)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["defaultValue"],
+                message: "Select variable defaults must match one of the allowed options",
+            });
+        }
+    }
+    if (value.type === "date" && value.defaultValue != null) {
+        if (typeof value.defaultValue !== "string" || !isValidRoutineDateString(value.defaultValue)) {
+            ctx.addIssue({
+                code: z.ZodIssueCode.custom,
+                path: ["defaultValue"],
+                message: "Date variable defaults must be valid YYYY-MM-DD calendar dates",
+            });
+        }
+    }
+});
+export const createRoutineSchema = z.object({
+    projectId: z.string().guid().optional().nullable(),
+    folderId: z.string().guid().optional().nullable(),
+    goalId: z.string().guid().optional().nullable(),
+    parentIssueId: z.string().guid().optional().nullable(),
+    title: z.string().trim().min(1).max(200),
+    description: z.string().optional().nullable(),
+    assigneeAgentId: z.string().guid().optional().nullable(),
+    priority: z.enum(ISSUE_PRIORITIES).optional().default("medium"),
+    status: z.enum(ROUTINE_STATUSES).optional().default("active"),
+    concurrencyPolicy: z.enum(ROUTINE_CONCURRENCY_POLICIES).optional().default("coalesce_if_active"),
+    catchUpPolicy: z.enum(ROUTINE_CATCH_UP_POLICIES).optional().default("skip_missed"),
+    activityGatePolicy: z.enum(ROUTINE_ACTIVITY_GATE_POLICIES).optional(),
+    activityGateScope: z.enum(ROUTINE_ACTIVITY_GATE_SCOPES).optional(),
+    variables: z.array(routineVariableSchema).optional().default([]),
+    env: envConfigSchema.optional().nullable(),
+});
+export const updateRoutineSchema = objectWithoutDefaults(createRoutineSchema).partial().extend({
+    baseRevisionId: z.string().guid().optional().nullable(),
+});
+export const routineRevisionSnapshotRoutineV1Schema = z.object({
+    id: z.string().guid(),
+    companyId: z.string().guid(),
+    projectId: z.string().guid().nullable(),
+    folderId: z.string().guid().nullable().optional(),
+    goalId: z.string().guid().nullable(),
+    parentIssueId: z.string().guid().nullable(),
+    title: z.string().trim().min(1).max(200),
+    description: z.string().nullable(),
+    assigneeAgentId: z.string().guid().nullable(),
+    priority: z.enum(ISSUE_PRIORITIES),
+    status: z.enum(ROUTINE_STATUSES),
+    concurrencyPolicy: z.enum(ROUTINE_CONCURRENCY_POLICIES),
+    catchUpPolicy: z.enum(ROUTINE_CATCH_UP_POLICIES),
+    activityGatePolicy: z.enum(ROUTINE_ACTIVITY_GATE_POLICIES).default("always"),
+    activityGateScope: z.enum(ROUTINE_ACTIVITY_GATE_SCOPES).default("company"),
+    variables: z.array(routineVariableSchema),
+    env: envConfigSchema.nullable().default(null),
+    responsibleUserId: z.string().nullable().default(null),
+}).strict();
+export const routineRevisionSnapshotTriggerV1Schema = z.object({
+    id: z.string().guid(),
+    setupPending: z.boolean().optional(),
+    kind: z.enum(ROUTINE_TRIGGER_KINDS),
+    label: z.string().nullable(),
+    enabled: z.boolean(),
+    cronExpression: z.string().nullable(),
+    timezone: z.string().nullable(),
+    publicId: z.string().nullable(),
+    signingMode: z.enum(ROUTINE_TRIGGER_SIGNING_MODES).nullable(),
+    replayWindowSec: z.number().int().min(30).max(86_400).nullable(),
+}).strict();
+export const routineRevisionSnapshotV1Schema = z.object({
+    version: z.literal(1),
+    routine: routineRevisionSnapshotRoutineV1Schema,
+    triggers: z.array(routineRevisionSnapshotTriggerV1Schema),
+}).strict();
+export const routineRevisionSnapshotSchema = routineRevisionSnapshotV1Schema;
+const baseTriggerSchema = z.object({
+    label: z.string().trim().max(120).optional().nullable(),
+    enabled: z.boolean().optional().default(true),
+});
+export const createRoutineTriggerSchema = z.discriminatedUnion("kind", [
+    baseTriggerSchema.extend({
+        kind: z.literal("schedule"),
+        cronExpression: z.string().trim().min(1),
+        timezone: z.string().trim().min(1).default("UTC"),
+    }),
+    baseTriggerSchema.extend({
+        kind: z.literal("webhook"),
+        setupPending: z.boolean().optional(),
+        signingMode: z.enum(ROUTINE_TRIGGER_SIGNING_MODES).optional().default("bearer"),
+        replayWindowSec: z.number().int().min(30).max(86_400).optional().default(300),
+    }),
+    baseTriggerSchema.extend({
+        kind: z.literal("api"),
+    }),
+]);
+export const updateRoutineTriggerSchema = z.object({
+    setupPending: z.literal(false).optional(),
+    archived: z.boolean().optional(),
+    label: z.string().trim().max(120).optional().nullable(),
+    enabled: z.boolean().optional(),
+    cronExpression: z.string().trim().min(1).optional().nullable(),
+    timezone: z.string().trim().min(1).optional().nullable(),
+    signingMode: z.enum(ROUTINE_TRIGGER_SIGNING_MODES).optional().nullable(),
+    replayWindowSec: z.number().int().min(30).max(86_400).optional().nullable(),
+});
+export const runRoutineSchema = z.object({
+    triggerId: z.string().guid().optional().nullable(),
+    payload: z.record(z.string(), z.unknown()).optional().nullable(),
+    variables: z.record(z.string(), routineVariableValueSchema).optional().nullable(),
+    projectId: z.string().guid().optional().nullable(),
+    projectWorkspaceId: z.string().guid().optional().nullable(),
+    assigneeAgentId: z.string().guid().optional().nullable(),
+    idempotencyKey: z.string().trim().max(255).optional().nullable(),
+    source: z.enum(["manual", "api"]).optional().default("manual"),
+    executionWorkspaceId: z.string().guid().optional().nullable(),
+    executionWorkspacePreference: z.enum(ISSUE_EXECUTION_WORKSPACE_PREFERENCES).optional().nullable(),
+    executionWorkspaceSettings: issueExecutionWorkspaceSettingsSchema.optional().nullable(),
+});
+export const rotateRoutineTriggerSecretSchema = z.object({});
+//# sourceMappingURL=routine.js.map

package/dist/validators/routine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routine.js","sourceRoot":"","sources":["../../src/validators/routine.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,gBAAgB,EAChB,8BAA8B,EAC9B,4BAA4B,EAC5B,yBAAyB,EACzB,4BAA4B,EAC5B,gBAAgB,EAChB,qBAAqB,EACrB,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,qCAAqC,EACrC,qCAAqC,GACtC,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAErD,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAE3F,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;IACxD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IAC/D,YAAY,EAAE,0BAA0B,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CACnF,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,8CAA8C;SACxD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,0CAA0C;SACpD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAC1D,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1F,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,cAAc,CAAC;gBACtB,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QACxD,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5F,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,CAAC,cAAc,CAAC;gBACtB,OAAO,EAAE,gEAAgE;aAC1E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACtD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC/D,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC7D,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC;IAChG,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC;IAClF,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,QAAQ,EAAE;IACrE,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,EAAE;IAClE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAChE,GAAG,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC;IAC7F,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC7C,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAClC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IAChC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC;IACvD,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC;IAChD,kBAAkB,EAAE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC5E,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1E,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC;IACzC,GAAG,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC7C,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CACvD,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7D,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACpC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE;IAC7D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;CACjE,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,sCAAsC;IAC/C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC;CAC1D,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,6BAA6B,GAAG,+BAA+B,CAAC;AAI7E,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACrE,iBAAiB,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;KAClD,CAAC;IACF,iBAAiB,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACpC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC/E,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;KAC9E,CAAC;IACF,iBAAiB,CAAC,MAAM,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;KACvB,CAAC;CACH,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IACzC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACvD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC5E,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3D,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACxD,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9D,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7D,4BAA4B,EAAE,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACjG,0BAA0B,EAAE,qCAAqC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxF,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC"}

package/dist/validators/routine.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=routine.test.d.ts.map

package/dist/validators/routine.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routine.test.d.ts","sourceRoot":"","sources":["../../src/validators/routine.test.ts"],"names":[],"mappings":""}

package/dist/validators/routine.test.js

@@ -0,0 +1,115 @@
+import { describe, expect, it } from "vitest";
+import { routineRevisionSnapshotV1Schema, routineVariableSchema, updateRoutineSchema, } from "./routine.js";
+const routineId = "11111111-1111-4111-8111-111111111111";
+const companyId = "22222222-2222-4222-8222-222222222222";
+const triggerId = "33333333-3333-4333-8333-333333333333";
+const baseRevisionId = "44444444-4444-4444-8444-444444444444";
+describe("routine validators", () => {
+    it.each(["bearer", "app_webhook", "fireflies_hmac"])("accepts versioned routine revision snapshots with %s trigger metadata", (signingMode) => {
+        const parsed = routineRevisionSnapshotV1Schema.parse({
+            version: 1,
+            routine: {
+                id: routineId,
+                companyId,
+                projectId: null,
+                goalId: null,
+                parentIssueId: null,
+                title: "Daily triage",
+                description: null,
+                assigneeAgentId: null,
+                priority: "medium",
+                status: "active",
+                concurrencyPolicy: "coalesce_if_active",
+                catchUpPolicy: "skip_missed",
+                variables: [],
+            },
+            triggers: [{
+                    id: triggerId,
+                    kind: "webhook",
+                    label: "Inbound",
+                    enabled: true,
+                    cronExpression: null,
+                    timezone: null,
+                    publicId: "routine_webhook_123",
+                    signingMode,
+                    replayWindowSec: 300,
+                }],
+        });
+        expect(parsed.triggers[0]?.publicId).toBe("routine_webhook_123");
+        expect(parsed.routine.activityGatePolicy).toBe("always");
+        expect(parsed.routine.activityGateScope).toBe("company");
+    });
+    it("rejects secret-bearing trigger fields in routine revision snapshots", () => {
+        expect(() => routineRevisionSnapshotV1Schema.parse({
+            version: 1,
+            routine: {
+                id: routineId,
+                companyId,
+                projectId: null,
+                goalId: null,
+                parentIssueId: null,
+                title: "Daily triage",
+                description: null,
+                assigneeAgentId: null,
+                priority: "medium",
+                status: "active",
+                concurrencyPolicy: "coalesce_if_active",
+                catchUpPolicy: "skip_missed",
+                variables: [],
+            },
+            triggers: [{
+                    id: triggerId,
+                    kind: "webhook",
+                    label: "Inbound",
+                    enabled: true,
+                    cronExpression: null,
+                    timezone: null,
+                    publicId: "routine_webhook_123",
+                    signingMode: "bearer",
+                    replayWindowSec: 300,
+                    secretId: "55555555-5555-4555-8555-555555555555",
+                }],
+        })).toThrow();
+    });
+    it("accepts optional base revision ids on routine updates", () => {
+        expect(updateRoutineSchema.parse({
+            title: "Daily triage",
+            baseRevisionId,
+        }).baseRevisionId).toBe(baseRevisionId);
+    });
+    it("validates routine activity gate values", () => {
+        expect(updateRoutineSchema.parse({
+            activityGatePolicy: "require_external_activity",
+            activityGateScope: "project",
+        })).toMatchObject({
+            activityGatePolicy: "require_external_activity",
+            activityGateScope: "project",
+        });
+        expect(() => updateRoutineSchema.parse({ activityGatePolicy: "when_busy" })).toThrow();
+        expect(() => updateRoutineSchema.parse({ activityGateScope: "agent" })).toThrow();
+    });
+    it("accepts date variables with valid YYYY-MM-DD defaults", () => {
+        expect(routineVariableSchema.parse({
+            name: "startDate",
+            type: "date",
+            defaultValue: "2024-02-29",
+        })).toMatchObject({
+            name: "startDate",
+            type: "date",
+            defaultValue: "2024-02-29",
+        });
+    });
+    it("rejects date variables with non-calendar or non-string defaults", () => {
+        expect(() => routineVariableSchema.parse({
+            name: "startDate",
+            type: "date",
+            defaultValue: "2024-02-30",
+        })).toThrow(/YYYY-MM-DD/);
+        expect(() => routineVariableSchema.parse({
+            name: "startDate",
+            type: "date",
+            defaultValue: 20240229,
+        })).toThrow(/YYYY-MM-DD/);
+    });
+});
+//# sourceMappingURL=routine.test.js.map

package/dist/validators/routine.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routine.test.js","sourceRoot":"","sources":["../../src/validators/routine.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,+BAA+B,EAC/B,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAE9D,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC,CAAC,uEAAuE,EAAE,CAAC,WAAW,EAAE,EAAE;QAC5I,MAAM,MAAM,GAAG,+BAA+B,CAAC,KAAK,CAAC;YACnD,OAAO,EAAE,CAAC;YACV,OAAO,EAAE;gBACP,EAAE,EAAE,SAAS;gBACb,SAAS;gBACT,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI;gBACZ,aAAa,EAAE,IAAI;gBACnB,KAAK,EAAE,cAAc;gBACrB,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,IAAI;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,QAAQ;gBAChB,iBAAiB,EAAE,oBAAoB;gBACvC,aAAa,EAAE,aAAa;gBAC5B,SAAS,EAAE,EAAE;aACd;YACD,QAAQ,EAAE,CAAC;oBACT,EAAE,EAAE,SAAS;oBACb,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,IAAI;oBACpB,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,qBAAqB;oBAC/B,WAAW;oBACX,eAAe,EAAE,GAAG;iBACrB,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,GAAG,EAAE,CAAC,+BAA+B,CAAC,KAAK,CAAC;YACjD,OAAO,EAAE,CAAC;YACV,OAAO,EAAE;gBACP,EAAE,EAAE,SAAS;gBACb,SAAS;gBACT,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,IAAI;gBACZ,aAAa,EAAE,IAAI;gBACnB,KAAK,EAAE,cAAc;gBACrB,WAAW,EAAE,IAAI;gBACjB,eAAe,EAAE,IAAI;gBACrB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,QAAQ;gBAChB,iBAAiB,EAAE,oBAAoB;gBACvC,aAAa,EAAE,aAAa;gBAC5B,SAAS,EAAE,EAAE;aACd;YACD,QAAQ,EAAE,CAAC;oBACT,EAAE,EAAE,SAAS;oBACb,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,IAAI;oBACb,cAAc,EAAE,IAAI;oBACpB,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,qBAAqB;oBAC/B,WAAW,EAAE,QAAQ;oBACrB,eAAe,EAAE,GAAG;oBACpB,QAAQ,EAAE,sCAAsC;iBACjD,CAAC;SACH,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAC/B,KAAK,EAAE,cAAc;YACrB,cAAc;SACf,CAAC,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC;YAC/B,kBAAkB,EAAE,2BAA2B;YAC/C,iBAAiB,EAAE,SAAS;SAC7B,CAAC,CAAC,CAAC,aAAa,CAAC;YAChB,kBAAkB,EAAE,2BAA2B;YAC/C,iBAAiB,EAAE,SAAS;SAC7B,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACvF,MAAM,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACjC,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,MAAM;YACZ,YAAY,EAAE,YAAY;SAC3B,CAAC,CAAC,CAAC,aAAa,CAAC;YAChB,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,MAAM;YACZ,YAAY,EAAE,YAAY;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACvC,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,MAAM;YACZ,YAAY,EAAE,YAAY;SAC3B,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAE1B,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,CAAC;YACvC,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,MAAM;YACZ,YAAY,EAAE,QAAQ;SACvB,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/validators/runtime-exposure.d.ts

@@ -0,0 +1,100 @@
+import { z } from "zod";
+/**
+ * Validators for the opt-in `tailscale_https` runtime exposure contract.
+ * Strict-by-default: unknown fields are rejected so a malformed or injected
+ * config cannot smuggle an arbitrary target, path, or hostname suffix through
+ * the runtime configuration into the broker (PAP-17050 verdict).
+ */
+export declare const runtimeExposureProviderSchema: z.ZodLiteral<"tailscale_https">;
+export declare const runtimeExposureFailurePolicySchema: z.ZodLiteral<"fail_closed">;
+export declare const runtimeExposureConfigSchema: z.ZodObject<{
+    type: z.ZodLiteral<"tailscale_https">;
+    hostname: z.ZodLiteral<"auto">;
+    publicPort: z.ZodLiteral<"same">;
+    includePaperclipViteHmr: z.ZodBoolean;
+    failurePolicy: z.ZodLiteral<"fail_closed">;
+}, z.core.$strict>;
+export declare const runtimeExposureStateSchema: z.ZodEnum<{
+    cleanup_pending: "cleanup_pending";
+    failed: "failed";
+    pending: "pending";
+    ready: "ready";
+    removed: "removed";
+}>;
+export declare const runtimeExposureListenerPurposeSchema: z.ZodEnum<{
+    app: "app";
+    vite_hmr: "vite_hmr";
+}>;
+export declare const runtimeExposureListenerSchema: z.ZodObject<{
+    purpose: z.ZodEnum<{
+        app: "app";
+        vite_hmr: "vite_hmr";
+    }>;
+    publicPort: z.ZodNumber;
+    targetPort: z.ZodNumber;
+}, z.core.$strict>;
+export declare const runtimeExposureStatusSchema: z.ZodObject<{
+    provider: z.ZodLiteral<"tailscale_https">;
+    state: z.ZodEnum<{
+        cleanup_pending: "cleanup_pending";
+        failed: "failed";
+        pending: "pending";
+        ready: "ready";
+        removed: "removed";
+    }>;
+    publicUrl: z.ZodNullable<z.ZodString>;
+    hostname: z.ZodNullable<z.ZodString>;
+    listeners: z.ZodArray<z.ZodObject<{
+        purpose: z.ZodEnum<{
+            app: "app";
+            vite_hmr: "vite_hmr";
+        }>;
+        publicPort: z.ZodNumber;
+        targetPort: z.ZodNumber;
+    }, z.core.$strict>>;
+    brokerRef: z.ZodNullable<z.ZodString>;
+    lastError: z.ZodNullable<z.ZodString>;
+    updatedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type RuntimeExposureConfigInput = z.infer<typeof runtimeExposureConfigSchema>;
+export type RuntimeExposureStatusInput = z.infer<typeof runtimeExposureStatusSchema>;
+/**
+ * Default exposure config used when a project/workspace enables HTTPS exposure
+ * without overriding sub-fields. Fail-closed and HMR-inclusive by default so
+ * dev-mode hot reload works over the exposed HTTPS origin.
+ */
+export declare const DEFAULT_TAILSCALE_HTTPS_EXPOSURE: RuntimeExposureConfigInput;
+/**
+ * Parse an untrusted `expose` block off a workspace runtime service config.
+ * Returns null when exposure is absent; throws (via zod) on a malformed block
+ * so misconfiguration fails closed rather than silently exposing nothing.
+ */
+export declare function parseRuntimeExposureConfig(value: unknown): RuntimeExposureConfigInput | null;
+/**
+ * What an `expose` block says about HTTPS exposure, independent of whether the
+ * runtime is eligible for it.
+ *
+ * `unset` is the common case: legacy templates only declare
+ * `{ type: "url", urlTemplate }` for the backend readiness URL and say nothing
+ * about exposure. Those runtimes are defaulted to `tailscale_https` by the
+ * server start path when they are eligible (PAP-17158), so no project template
+ * or UI caller has to supply an exposure block.
+ */
+export type RuntimeExposureIntent = "enabled" | "disabled" | "unset";
+/**
+ * Read the declared intent off an `expose` block.
+ *
+ * An explicit negative always wins over an explicit positive so a deliberate
+ * opt-out can never be re-enabled by a stale `type` left in the same block.
+ */
+export declare function readRuntimeExposureIntent(value: unknown): RuntimeExposureIntent;
+/**
+ * Resolve the exposure config a service *declared* (as opposed to the one it
+ * inherits by default). Returns null unless the block explicitly opts in.
+ *
+ * Recognized sub-fields fall back to {@link DEFAULT_TAILSCALE_HTTPS_EXPOSURE},
+ * so `{ type: "tailscale_https" }` is a complete declaration; unknown keys still
+ * throw rather than being silently dropped.
+ */
+export declare function resolveDeclaredRuntimeExposureConfig(value: unknown): RuntimeExposureConfigInput | null;
+//# sourceMappingURL=runtime-exposure.d.ts.map

package/dist/validators/runtime-exposure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-exposure.d.ts","sourceRoot":"","sources":["../../src/validators/runtime-exposure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AAEH,eAAO,MAAM,6BAA6B,iCAA+B,CAAC;AAE1E,eAAO,MAAM,kCAAkC,6BAA2B,CAAC;AAE3E,eAAO,MAAM,2BAA2B;;;;;;kBAQ7B,CAAC;AAEZ,eAAO,MAAM,0BAA0B;;;;;;EAMrC,CAAC;AAEH,eAAO,MAAM,oCAAoC;;;EAA8B,CAAC;AAEhF,eAAO,MAAM,6BAA6B;;;;;;;kBAatC,CAAC;AAEL,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;kBAW7B,CAAC;AAEZ,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AACrF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAErF;;;;GAIG;AACH,eAAO,MAAM,gCAAgC,EAAE,0BAM9C,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,OAAO,GACb,0BAA0B,GAAG,IAAI,CAGnC;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,UAAU,GAAG,OAAO,CAAC;AAsBrE;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAQ/E;AAED;;;;;;;GAOG;AACH,wBAAgB,oCAAoC,CAClD,KAAK,EAAE,OAAO,GACb,0BAA0B,GAAG,IAAI,CAenC"}

package/dist/validators/runtime-exposure.js

@@ -0,0 +1,138 @@
+import { z } from "zod";
+/**
+ * Validators for the opt-in `tailscale_https` runtime exposure contract.
+ * Strict-by-default: unknown fields are rejected so a malformed or injected
+ * config cannot smuggle an arbitrary target, path, or hostname suffix through
+ * the runtime configuration into the broker (PAP-17050 verdict).
+ */
+export const runtimeExposureProviderSchema = z.literal("tailscale_https");
+export const runtimeExposureFailurePolicySchema = z.literal("fail_closed");
+export const runtimeExposureConfigSchema = z
+    .object({
+    type: runtimeExposureProviderSchema,
+    hostname: z.literal("auto"),
+    publicPort: z.literal("same"),
+    includePaperclipViteHmr: z.boolean(),
+    failurePolicy: runtimeExposureFailurePolicySchema,
+})
+    .strict();
+export const runtimeExposureStateSchema = z.enum([
+    "pending",
+    "ready",
+    "failed",
+    "cleanup_pending",
+    "removed",
+]);
+export const runtimeExposureListenerPurposeSchema = z.enum(["app", "vite_hmr"]);
+export const runtimeExposureListenerSchema = z
+    .object({
+    purpose: runtimeExposureListenerPurposeSchema,
+    publicPort: z.number().int().positive(),
+    targetPort: z.number().int().positive(),
+})
+    .strict()
+    // Same-number invariant: the public HTTPS port must equal the loopback
+    // target port. The broker enforces this too, but rejecting here keeps
+    // persisted/serialized state honest.
+    .refine((listener) => listener.publicPort === listener.targetPort, {
+    message: "publicPort must equal targetPort (same-number exposure)",
+    path: ["publicPort"],
+});
+export const runtimeExposureStatusSchema = z
+    .object({
+    provider: runtimeExposureProviderSchema,
+    state: runtimeExposureStateSchema,
+    publicUrl: z.string().url().nullable(),
+    hostname: z.string().min(1).nullable(),
+    listeners: z.array(runtimeExposureListenerSchema),
+    brokerRef: z.string().min(1).nullable(),
+    lastError: z.string().nullable(),
+    updatedAt: z.string().nullable(),
+})
+    .strict();
+/**
+ * Default exposure config used when a project/workspace enables HTTPS exposure
+ * without overriding sub-fields. Fail-closed and HMR-inclusive by default so
+ * dev-mode hot reload works over the exposed HTTPS origin.
+ */
+export const DEFAULT_TAILSCALE_HTTPS_EXPOSURE = {
+    type: "tailscale_https",
+    hostname: "auto",
+    publicPort: "same",
+    includePaperclipViteHmr: true,
+    failurePolicy: "fail_closed",
+};
+/**
+ * Parse an untrusted `expose` block off a workspace runtime service config.
+ * Returns null when exposure is absent; throws (via zod) on a malformed block
+ * so misconfiguration fails closed rather than silently exposing nothing.
+ */
+export function parseRuntimeExposureConfig(value) {
+    if (value === undefined || value === null)
+        return null;
+    return runtimeExposureConfigSchema.parse(value);
+}
+/**
+ * Keys of the exposure contract itself. Anything a declared `tailscale_https`
+ * block sets outside this list (and {@link RUNTIME_EXPOSURE_TRANSPORT_KEYS}) is
+ * rejected, so a malformed or injected config still cannot smuggle an arbitrary
+ * target, path, or hostname suffix through to the broker (PAP-17050 verdict).
+ */
+const RUNTIME_EXPOSURE_CONFIG_KEYS = [
+    "type",
+    "hostname",
+    "publicPort",
+    "includePaperclipViteHmr",
+    "failurePolicy",
+];
+/**
+ * Pre-existing `expose` keys that describe the *backend* URL rather than the
+ * exposure, and may legitimately sit next to a `tailscale_https` declaration.
+ */
+const RUNTIME_EXPOSURE_TRANSPORT_KEYS = ["urlTemplate", "tailscaleHttps"];
+/**
+ * Read the declared intent off an `expose` block.
+ *
+ * An explicit negative always wins over an explicit positive so a deliberate
+ * opt-out can never be re-enabled by a stale `type` left in the same block.
+ */
+export function readRuntimeExposureIntent(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return "unset";
+    const expose = value;
+    // Deliberate opt-outs, checked first.
+    if (expose.tailscaleHttps === false)
+        return "disabled";
+    if (expose.type === "none")
+        return "disabled";
+    if (expose.type === "tailscale_https" || expose.tailscaleHttps === true)
+        return "enabled";
+    return "unset";
+}
+/**
+ * Resolve the exposure config a service *declared* (as opposed to the one it
+ * inherits by default). Returns null unless the block explicitly opts in.
+ *
+ * Recognized sub-fields fall back to {@link DEFAULT_TAILSCALE_HTTPS_EXPOSURE},
+ * so `{ type: "tailscale_https" }` is a complete declaration; unknown keys still
+ * throw rather than being silently dropped.
+ */
+export function resolveDeclaredRuntimeExposureConfig(value) {
+    if (readRuntimeExposureIntent(value) !== "enabled")
+        return null;
+    const expose = value;
+    const known = new Set([...RUNTIME_EXPOSURE_CONFIG_KEYS, ...RUNTIME_EXPOSURE_TRANSPORT_KEYS]);
+    const unknownKeys = Object.keys(expose).filter((key) => !known.has(key));
+    if (unknownKeys.length > 0) {
+        throw new Error(`Unsupported expose field(s): ${unknownKeys.sort().join(", ")}`);
+    }
+    const merged = { ...DEFAULT_TAILSCALE_HTTPS_EXPOSURE };
+    for (const key of RUNTIME_EXPOSURE_CONFIG_KEYS) {
+        if (expose[key] !== undefined)
+            merged[key] = expose[key];
+    }
+    // `tailscaleHttps: true` is shorthand for the provider; normalize it away.
+    merged.type = "tailscale_https";
+    return runtimeExposureConfigSchema.parse(merged);
+}
+//# sourceMappingURL=runtime-exposure.js.map

package/dist/validators/runtime-exposure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-exposure.js","sourceRoot":"","sources":["../../src/validators/runtime-exposure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAE1E,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;AAE3E,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,IAAI,EAAE,6BAA6B;IACnC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC3B,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7B,uBAAuB,EAAE,CAAC,CAAC,OAAO,EAAE;IACpC,aAAa,EAAE,kCAAkC;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC;IAC/C,SAAS;IACT,OAAO;IACP,QAAQ;IACR,iBAAiB;IACjB,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC;AAEhF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,OAAO,EAAE,oCAAoC;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE;IACT,uEAAuE;IACvE,sEAAsE;IACtE,qCAAqC;KACpC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU,EAAE;IACjE,OAAO,EAAE,yDAAyD;IAClE,IAAI,EAAE,CAAC,YAAY,CAAC;CACrB,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,QAAQ,EAAE,6BAA6B;IACvC,KAAK,EAAE,0BAA0B;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAA+B;IAC1E,IAAI,EAAE,iBAAiB;IACvB,QAAQ,EAAE,MAAM;IAChB,UAAU,EAAE,MAAM;IAClB,uBAAuB,EAAE,IAAI;IAC7B,aAAa,EAAE,aAAa;CAC7B,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,2BAA2B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAClD,CAAC;AAcD;;;;;GAKG;AACH,MAAM,4BAA4B,GAAG;IACnC,MAAM;IACN,UAAU;IACV,YAAY;IACZ,yBAAyB;IACzB,eAAe;CACP,CAAC;AAEX;;;GAGG;AACH,MAAM,+BAA+B,GAAG,CAAC,aAAa,EAAE,gBAAgB,CAAU,CAAC;AAEnF;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAChF,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,sCAAsC;IACtC,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK;QAAE,OAAO,UAAU,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC;IAC9C,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,IAAI,MAAM,CAAC,cAAc,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC1F,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oCAAoC,CAClD,KAAc;IAEd,IAAI,yBAAyB,CAAC,KAAK,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,4BAA4B,EAAE,GAAG,+BAA+B,CAAC,CAAC,CAAC;IACrG,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACzE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,GAAG,gCAAgC,EAAE,CAAC;IAChF,KAAK,MAAM,GAAG,IAAI,4BAA4B,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC;IACD,2EAA2E;IAC3E,MAAM,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,OAAO,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC"}

package/dist/validators/runtime-exposure.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=runtime-exposure.test.d.ts.map

package/dist/validators/runtime-exposure.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-exposure.test.d.ts","sourceRoot":"","sources":["../../src/validators/runtime-exposure.test.ts"],"names":[],"mappings":""}