@tickernelz/paperclip-pro-shared 2026.925.0

package/dist/announcements.test.js

@@ -0,0 +1,53 @@
+import { describe, expect, it } from "vitest";
+import { announcementManifestSchema, announcementSchema, isAnnouncementEligible } from "./announcements.js";
+const announcement = { id: "new-projects", eyebrow: "New", title: "Projects", description: "Organize your work.", primaryAction: { kind: "route", label: "Open", path: "/projects" } };
+describe("announcement contract", () => {
+    it("supports an empty feed and a plain-text card", () => {
+        expect(announcementManifestSchema.parse({ schemaVersion: 1, announcement: null }).announcement).toBeNull();
+        expect(announcementSchema.parse(announcement).id).toBe("new-projects");
+        expect(announcementSchema.parse({ ...announcement, title: "<script>alert(1)</script>" }).title).toContain("<script>");
+    });
+    it.each(["/api/companies", "//evil.test", "/projects/../auth", "/company/settings?danger=yes", "/unknown", "javascript:alert(1)"])("rejects unsupported route %s", (path) => {
+        expect(announcementSchema.safeParse({ ...announcement, primaryAction: { kind: "route", label: "Open", path } }).success).toBe(false);
+    });
+    it.each(["not a URL", "http://example.com", "javascript:alert(1)", "https://user:password@example.com"])("rejects unsafe external URL %s", (url) => {
+        expect(announcementSchema.safeParse({ ...announcement, primaryAction: { kind: "external", label: "Open", url } }).success).toBe(false);
+    });
+    it.each(["../secret.png", "https://example.com/a.png", "/assets/a.png", `assets/${"0".repeat(64)}.svg`])("rejects unsafe image path %s", (path) => {
+        expect(announcementSchema.safeParse({ ...announcement, image: { path, alt: "" } }).success).toBe(false);
+    });
+    it("requires a content-addressed HTML animation and a static fallback", () => {
+        const image = { path: `assets/${"0".repeat(64)}.png`, alt: "Poster" };
+        const animation = { path: `assets/${"1".repeat(64)}.html`, alt: "Animated team" };
+        expect(announcementSchema.safeParse({ ...announcement, image, animation }).success).toBe(true);
+        expect(announcementSchema.safeParse({ ...announcement, animation }).success).toBe(false);
+        for (const path of ["https://evil.test/a.html", "../a.html", "assets/a.html", `assets/${"1".repeat(64)}.js`]) {
+            expect(announcementSchema.safeParse({ ...announcement, image, animation: { ...animation, path } }).success).toBe(false);
+        }
+    });
+    it("rejects unknown schema versions and oversized copy", () => {
+        expect(announcementManifestSchema.safeParse({ schemaVersion: 2, announcement }).success).toBe(false);
+        expect(announcementSchema.safeParse({ ...announcement, description: "a".repeat(401) }).success).toBe(false);
+    });
+    it("rejects unknown fields throughout the remotely authored manifest", () => {
+        const image = { path: `assets/${"0".repeat(64)}.png`, alt: "Preview" };
+        const external = { kind: "external", label: "Learn more", url: "https://paperclip.ing" };
+        for (const value of [
+            { schemaVersion: 1, announcement, extra: true },
+            { schemaVersion: 1, announcement: { ...announcement, secondaryLinks: external } },
+            { schemaVersion: 1, announcement: { ...announcement, image: { ...image, title: "Typo" } } },
+            { schemaVersion: 1, announcement: { ...announcement, primaryAction: { ...announcement.primaryAction, extra: true } } },
+            { schemaVersion: 1, announcement: { ...announcement, secondaryLink: { ...external, extra: true } } },
+        ])
+            expect(announcementManifestSchema.safeParse(value).success).toBe(false);
+    });
+    it("checks expiration and minimum versions numerically, including prereleases", () => {
+        const item = announcementSchema.parse({ ...announcement, expiresAt: "2027-01-01T00:00:00Z", minimumPaperclipVersion: "2026.913.0" });
+        for (const version of ["2026.912.0", "2026.913.0-canary.1", "unknown"])
+            expect(isAnnouncementEligible(item, version, 0)).toBe(false);
+        for (const version of ["2026.913.0", "2026.913.0+1.git.abc", "2026.1001.0"])
+            expect(isAnnouncementEligible(item, version, 0)).toBe(true);
+        expect(isAnnouncementEligible(item, "2026.913.0", Date.parse(item.expiresAt))).toBe(false);
+    });
+});
+//# sourceMappingURL=announcements.test.js.map

package/dist/announcements.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"announcements.test.js","sourceRoot":"","sources":["../src/announcements.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,0BAA0B,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5G,MAAM,YAAY,GAAG,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,qBAAqB,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;AACvL,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,0BAA0B,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3G,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACvE,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,aAAa,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,8BAA8B,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1K,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvI,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,mCAAmC,CAAC,CAAC,CAAC,gCAAgC,EAAE,CAAC,GAAG,EAAE,EAAE;QACjJ,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzI,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,2BAA2B,EAAE,eAAe,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,8BAA8B,EAAE,CAAC,IAAI,EAAE,EAAE;QAChJ,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1G,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACtE,MAAM,SAAS,GAAG,EAAE,IAAI,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;QAClF,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/F,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzF,KAAK,MAAM,IAAI,IAAI,CAAC,0BAA0B,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7G,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1H,CAAC;IACH,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CAAC,0BAA0B,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrG,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,GAAG,YAAY,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9G,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,UAAU,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,uBAAuB,EAAE,CAAC;QACzF,KAAK,MAAM,KAAK,IAAI;YAClB,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE;YAC/C,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE;YACjF,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;YAC3F,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE,aAAa,EAAE,EAAE,GAAG,YAAY,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;YACtH,EAAE,aAAa,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG,YAAY,EAAE,aAAa,EAAE,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;SACrG;YAAE,MAAM,CAAC,0BAA0B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,EAAE,GAAG,YAAY,EAAE,SAAS,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,YAAY,EAAE,CAAC,CAAC;QACrI,KAAK,MAAM,OAAO,IAAI,CAAC,YAAY,EAAE,qBAAqB,EAAE,SAAS,CAAC;YAAE,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrI,KAAK,MAAM,OAAO,IAAI,CAAC,YAAY,EAAE,sBAAsB,EAAE,aAAa,CAAC;YAAE,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzI,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/api.d.ts

@@ -0,0 +1,69 @@
+export declare const API_PREFIX = "/api";
+export declare const API: {
+    readonly health: "/api/health";
+    readonly companies: "/api/companies";
+    readonly companyFolders: "/api/companies/:companyId/folders";
+    readonly companyFolder: "/api/companies/:companyId/folders/:folderId";
+    readonly companyFolderMove: "/api/companies/:companyId/folders/:folderId/move";
+    readonly companyFolderItemMove: "/api/companies/:companyId/folders/items/move";
+    readonly agents: "/api/agents";
+    readonly projects: "/api/projects";
+    readonly environments: "/api/environments";
+    readonly environmentDeleteBlastRadius: "/api/environments/:id/delete-blast-radius";
+    readonly environmentCustomImageTemplate: "/api/environments/:environmentId/custom-image-template";
+    readonly environmentCustomImageTemplateDisable: "/api/environments/:environmentId/custom-image-template";
+    readonly environmentCustomImageTemplateRollback: "/api/environments/:environmentId/custom-image-template/rollback";
+    readonly environmentCustomImageSetupSessions: "/api/environments/:environmentId/custom-image-setup-sessions";
+    readonly environmentCustomImageSetupSession: "/api/environment-custom-image-setup-sessions/:sessionId";
+    readonly environmentCustomImageSetupSessionTerminalToken: "/api/environment-custom-image-setup-sessions/:sessionId/terminal-session-token";
+    readonly environmentCustomImageSetupSessionTerminalWs: "/api/environment-custom-image-setup-sessions/:sessionId/terminal/ws";
+    readonly environmentCustomImageSetupSessionFinish: "/api/environment-custom-image-setup-sessions/:sessionId/finish";
+    readonly environmentCustomImageSetupSessionCancel: "/api/environment-custom-image-setup-sessions/:sessionId/cancel";
+    readonly issues: "/api/issues";
+    readonly stalledReviewDecision: "/api/issues/:issueId/stalled-review-decision";
+    readonly issueWatchdog: "/api/issues/:issueId/watchdog";
+    readonly issueTreeControl: "/api/issues/:issueId/tree-control";
+    readonly issueTreeHolds: "/api/issues/:issueId/tree-holds";
+    readonly summarySlot: "/api/companies/:companyId/summary-slots/:scopeKind/:slotKey";
+    readonly summarySlotRevisions: "/api/companies/:companyId/summary-slots/:scopeKind/:slotKey/revisions";
+    readonly summarySlotGenerate: "/api/companies/:companyId/summary-slots/:scopeKind/:slotKey/generate";
+    readonly goals: "/api/goals";
+    readonly approvals: "/api/approvals";
+    readonly secrets: "/api/secrets";
+    readonly tools: "/api/companies/:companyId/tools";
+    readonly toolExamples: "/api/companies/:companyId/tools/examples";
+    readonly toolApplications: "/api/companies/:companyId/tools/applications";
+    readonly toolConnections: "/api/companies/:companyId/tools/connections";
+    readonly toolCatalog: "/api/companies/:companyId/tools/catalog";
+    readonly toolProfiles: "/api/companies/:companyId/tools/profiles";
+    readonly toolPolicies: "/api/companies/:companyId/tools/policies";
+    readonly toolAudit: "/api/companies/:companyId/tools/audit";
+    readonly toolRuntimeSlots: "/api/companies/:companyId/tools/runtime-slots";
+    readonly toolRuntimeSlotStop: "/api/companies/:companyId/tools/runtime-slots/:id/stop";
+    readonly toolRuntimeSlotRestart: "/api/companies/:companyId/tools/runtime-slots/:id/restart";
+    readonly toolRuntimeHealth: "/api/companies/:companyId/tools/runtime-health";
+    readonly toolGateway: "/api/tool-gateway";
+    readonly smokeLab: "/api/companies/:companyId/smoke-lab";
+    readonly smokeLabServices: "/api/companies/:companyId/smoke-lab/services";
+    readonly smokeLabInstallFixtures: "/api/companies/:companyId/smoke-lab/install-fixtures";
+    readonly smokeLabRuns: "/api/companies/:companyId/smoke-lab/runs";
+    readonly smokeLabRunSteps: "/api/companies/:companyId/smoke-lab/runs/:runId/steps";
+    readonly userSecretDefinitions: "/api/companies/:companyId/user-secret-definitions";
+    readonly userSecretDefinition: "/api/companies/:companyId/user-secret-definitions/:definitionId";
+    readonly userSecretDefinitionCoverage: "/api/companies/:companyId/user-secret-definitions/:definitionId/coverage";
+    readonly myUserSecrets: "/api/companies/:companyId/me/user-secrets";
+    readonly myUserSecret: "/api/companies/:companyId/me/user-secrets/:secretId";
+    readonly secretProviderConfigs: "/api/secret-provider-configs";
+    readonly secretProviderConfigDiscoveryPreview: "/api/companies/:companyId/secret-provider-configs/discovery/preview";
+    readonly costs: "/api/costs";
+    readonly activity: "/api/activity";
+    readonly dashboard: "/api/dashboard";
+    readonly sidebarBadges: "/api/sidebar-badges";
+    readonly sidebarPreferences: "/api/sidebar-preferences";
+    readonly resourceMemberships: "/api/resource-memberships";
+    readonly invites: "/api/invites";
+    readonly joinRequests: "/api/join-requests";
+    readonly members: "/api/members";
+    readonly admin: "/api/admin";
+};
+//# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,UAAU,SAAS,CAAC;AAEjC,eAAO,MAAM,GAAG;aACd,MAAM;aACN,SAAS;aACT,cAAc;aACd,aAAa;aACb,iBAAiB;aACjB,qBAAqB;aACrB,MAAM;aACN,QAAQ;aACR,YAAY;aACZ,4BAA4B;aAC5B,8BAA8B;aAC9B,qCAAqC;aACrC,sCAAsC;aACtC,mCAAmC;aACnC,kCAAkC;aAClC,+CAA+C;aAC/C,4CAA4C;aAC5C,wCAAwC;aACxC,wCAAwC;aACxC,MAAM;aACN,qBAAqB;aACrB,aAAa;aACb,gBAAgB;aAChB,cAAc;aACd,WAAW;aACX,oBAAoB;aACpB,mBAAmB;aACnB,KAAK;aACL,SAAS;aACT,OAAO;aACP,KAAK;aACL,YAAY;aACZ,gBAAgB;aAChB,eAAe;aACf,WAAW;aACX,YAAY;aACZ,YAAY;aACZ,SAAS;aACT,gBAAgB;aAChB,mBAAmB;aACnB,sBAAsB;aACtB,iBAAiB;aACjB,WAAW;aACX,QAAQ;aACR,gBAAgB;aAChB,uBAAuB;aACvB,YAAY;aACZ,gBAAgB;aAChB,qBAAqB;aACrB,oBAAoB;aACpB,4BAA4B;aAC5B,aAAa;aACb,YAAY;aACZ,qBAAqB;aACrB,oCAAoC;aACpC,KAAK;aACL,QAAQ;aACR,SAAS;aACT,aAAa;aACb,kBAAkB;aAClB,mBAAmB;aACnB,OAAO;aACP,YAAY;aACZ,OAAO;aACP,KAAK;CACG,CAAC"}

package/dist/api.js

@@ -0,0 +1,69 @@
+export const API_PREFIX = "/api";
+export const API = {
+    health: `${API_PREFIX}/health`,
+    companies: `${API_PREFIX}/companies`,
+    companyFolders: `${API_PREFIX}/companies/:companyId/folders`,
+    companyFolder: `${API_PREFIX}/companies/:companyId/folders/:folderId`,
+    companyFolderMove: `${API_PREFIX}/companies/:companyId/folders/:folderId/move`,
+    companyFolderItemMove: `${API_PREFIX}/companies/:companyId/folders/items/move`,
+    agents: `${API_PREFIX}/agents`,
+    projects: `${API_PREFIX}/projects`,
+    environments: `${API_PREFIX}/environments`,
+    environmentDeleteBlastRadius: `${API_PREFIX}/environments/:id/delete-blast-radius`,
+    environmentCustomImageTemplate: `${API_PREFIX}/environments/:environmentId/custom-image-template`,
+    environmentCustomImageTemplateDisable: `${API_PREFIX}/environments/:environmentId/custom-image-template`,
+    environmentCustomImageTemplateRollback: `${API_PREFIX}/environments/:environmentId/custom-image-template/rollback`,
+    environmentCustomImageSetupSessions: `${API_PREFIX}/environments/:environmentId/custom-image-setup-sessions`,
+    environmentCustomImageSetupSession: `${API_PREFIX}/environment-custom-image-setup-sessions/:sessionId`,
+    environmentCustomImageSetupSessionTerminalToken: `${API_PREFIX}/environment-custom-image-setup-sessions/:sessionId/terminal-session-token`,
+    environmentCustomImageSetupSessionTerminalWs: `${API_PREFIX}/environment-custom-image-setup-sessions/:sessionId/terminal/ws`,
+    environmentCustomImageSetupSessionFinish: `${API_PREFIX}/environment-custom-image-setup-sessions/:sessionId/finish`,
+    environmentCustomImageSetupSessionCancel: `${API_PREFIX}/environment-custom-image-setup-sessions/:sessionId/cancel`,
+    issues: `${API_PREFIX}/issues`,
+    stalledReviewDecision: `${API_PREFIX}/issues/:issueId/stalled-review-decision`,
+    issueWatchdog: `${API_PREFIX}/issues/:issueId/watchdog`,
+    issueTreeControl: `${API_PREFIX}/issues/:issueId/tree-control`,
+    issueTreeHolds: `${API_PREFIX}/issues/:issueId/tree-holds`,
+    summarySlot: `${API_PREFIX}/companies/:companyId/summary-slots/:scopeKind/:slotKey`,
+    summarySlotRevisions: `${API_PREFIX}/companies/:companyId/summary-slots/:scopeKind/:slotKey/revisions`,
+    summarySlotGenerate: `${API_PREFIX}/companies/:companyId/summary-slots/:scopeKind/:slotKey/generate`,
+    goals: `${API_PREFIX}/goals`,
+    approvals: `${API_PREFIX}/approvals`,
+    secrets: `${API_PREFIX}/secrets`,
+    tools: `${API_PREFIX}/companies/:companyId/tools`,
+    toolExamples: `${API_PREFIX}/companies/:companyId/tools/examples`,
+    toolApplications: `${API_PREFIX}/companies/:companyId/tools/applications`,
+    toolConnections: `${API_PREFIX}/companies/:companyId/tools/connections`,
+    toolCatalog: `${API_PREFIX}/companies/:companyId/tools/catalog`,
+    toolProfiles: `${API_PREFIX}/companies/:companyId/tools/profiles`,
+    toolPolicies: `${API_PREFIX}/companies/:companyId/tools/policies`,
+    toolAudit: `${API_PREFIX}/companies/:companyId/tools/audit`,
+    toolRuntimeSlots: `${API_PREFIX}/companies/:companyId/tools/runtime-slots`,
+    toolRuntimeSlotStop: `${API_PREFIX}/companies/:companyId/tools/runtime-slots/:id/stop`,
+    toolRuntimeSlotRestart: `${API_PREFIX}/companies/:companyId/tools/runtime-slots/:id/restart`,
+    toolRuntimeHealth: `${API_PREFIX}/companies/:companyId/tools/runtime-health`,
+    toolGateway: `${API_PREFIX}/tool-gateway`,
+    smokeLab: `${API_PREFIX}/companies/:companyId/smoke-lab`,
+    smokeLabServices: `${API_PREFIX}/companies/:companyId/smoke-lab/services`,
+    smokeLabInstallFixtures: `${API_PREFIX}/companies/:companyId/smoke-lab/install-fixtures`,
+    smokeLabRuns: `${API_PREFIX}/companies/:companyId/smoke-lab/runs`,
+    smokeLabRunSteps: `${API_PREFIX}/companies/:companyId/smoke-lab/runs/:runId/steps`,
+    userSecretDefinitions: `${API_PREFIX}/companies/:companyId/user-secret-definitions`,
+    userSecretDefinition: `${API_PREFIX}/companies/:companyId/user-secret-definitions/:definitionId`,
+    userSecretDefinitionCoverage: `${API_PREFIX}/companies/:companyId/user-secret-definitions/:definitionId/coverage`,
+    myUserSecrets: `${API_PREFIX}/companies/:companyId/me/user-secrets`,
+    myUserSecret: `${API_PREFIX}/companies/:companyId/me/user-secrets/:secretId`,
+    secretProviderConfigs: `${API_PREFIX}/secret-provider-configs`,
+    secretProviderConfigDiscoveryPreview: `${API_PREFIX}/companies/:companyId/secret-provider-configs/discovery/preview`,
+    costs: `${API_PREFIX}/costs`,
+    activity: `${API_PREFIX}/activity`,
+    dashboard: `${API_PREFIX}/dashboard`,
+    sidebarBadges: `${API_PREFIX}/sidebar-badges`,
+    sidebarPreferences: `${API_PREFIX}/sidebar-preferences`,
+    resourceMemberships: `${API_PREFIX}/resource-memberships`,
+    invites: `${API_PREFIX}/invites`,
+    joinRequests: `${API_PREFIX}/join-requests`,
+    members: `${API_PREFIX}/members`,
+    admin: `${API_PREFIX}/admin`,
+};
+//# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC;AAEjC,MAAM,CAAC,MAAM,GAAG,GAAG;IACjB,MAAM,EAAE,GAAG,UAAU,SAAS;IAC9B,SAAS,EAAE,GAAG,UAAU,YAAY;IACpC,cAAc,EAAE,GAAG,UAAU,+BAA+B;IAC5D,aAAa,EAAE,GAAG,UAAU,yCAAyC;IACrE,iBAAiB,EAAE,GAAG,UAAU,8CAA8C;IAC9E,qBAAqB,EAAE,GAAG,UAAU,0CAA0C;IAC9E,MAAM,EAAE,GAAG,UAAU,SAAS;IAC9B,QAAQ,EAAE,GAAG,UAAU,WAAW;IAClC,YAAY,EAAE,GAAG,UAAU,eAAe;IAC1C,4BAA4B,EAAE,GAAG,UAAU,uCAAuC;IAClF,8BAA8B,EAAE,GAAG,UAAU,oDAAoD;IACjG,qCAAqC,EAAE,GAAG,UAAU,oDAAoD;IACxG,sCAAsC,EAAE,GAAG,UAAU,6DAA6D;IAClH,mCAAmC,EAAE,GAAG,UAAU,0DAA0D;IAC5G,kCAAkC,EAAE,GAAG,UAAU,qDAAqD;IACtG,+CAA+C,EAAE,GAAG,UAAU,4EAA4E;IAC1I,4CAA4C,EAAE,GAAG,UAAU,iEAAiE;IAC5H,wCAAwC,EAAE,GAAG,UAAU,4DAA4D;IACnH,wCAAwC,EAAE,GAAG,UAAU,4DAA4D;IACnH,MAAM,EAAE,GAAG,UAAU,SAAS;IAC9B,qBAAqB,EAAE,GAAG,UAAU,0CAA0C;IAC9E,aAAa,EAAE,GAAG,UAAU,2BAA2B;IACvD,gBAAgB,EAAE,GAAG,UAAU,+BAA+B;IAC9D,cAAc,EAAE,GAAG,UAAU,6BAA6B;IAC1D,WAAW,EAAE,GAAG,UAAU,yDAAyD;IACnF,oBAAoB,EAAE,GAAG,UAAU,mEAAmE;IACtG,mBAAmB,EAAE,GAAG,UAAU,kEAAkE;IACpG,KAAK,EAAE,GAAG,UAAU,QAAQ;IAC5B,SAAS,EAAE,GAAG,UAAU,YAAY;IACpC,OAAO,EAAE,GAAG,UAAU,UAAU;IAChC,KAAK,EAAE,GAAG,UAAU,6BAA6B;IACjD,YAAY,EAAE,GAAG,UAAU,sCAAsC;IACjE,gBAAgB,EAAE,GAAG,UAAU,0CAA0C;IACzE,eAAe,EAAE,GAAG,UAAU,yCAAyC;IACvE,WAAW,EAAE,GAAG,UAAU,qCAAqC;IAC/D,YAAY,EAAE,GAAG,UAAU,sCAAsC;IACjE,YAAY,EAAE,GAAG,UAAU,sCAAsC;IACjE,SAAS,EAAE,GAAG,UAAU,mCAAmC;IAC3D,gBAAgB,EAAE,GAAG,UAAU,2CAA2C;IAC1E,mBAAmB,EAAE,GAAG,UAAU,oDAAoD;IACtF,sBAAsB,EAAE,GAAG,UAAU,uDAAuD;IAC5F,iBAAiB,EAAE,GAAG,UAAU,4CAA4C;IAC5E,WAAW,EAAE,GAAG,UAAU,eAAe;IACzC,QAAQ,EAAE,GAAG,UAAU,iCAAiC;IACxD,gBAAgB,EAAE,GAAG,UAAU,0CAA0C;IACzE,uBAAuB,EAAE,GAAG,UAAU,kDAAkD;IACxF,YAAY,EAAE,GAAG,UAAU,sCAAsC;IACjE,gBAAgB,EAAE,GAAG,UAAU,mDAAmD;IAClF,qBAAqB,EAAE,GAAG,UAAU,+CAA+C;IACnF,oBAAoB,EAAE,GAAG,UAAU,6DAA6D;IAChG,4BAA4B,EAAE,GAAG,UAAU,sEAAsE;IACjH,aAAa,EAAE,GAAG,UAAU,uCAAuC;IACnE,YAAY,EAAE,GAAG,UAAU,iDAAiD;IAC5E,qBAAqB,EAAE,GAAG,UAAU,0BAA0B;IAC9D,oCAAoC,EAAE,GAAG,UAAU,iEAAiE;IACpH,KAAK,EAAE,GAAG,UAAU,QAAQ;IAC5B,QAAQ,EAAE,GAAG,UAAU,WAAW;IAClC,SAAS,EAAE,GAAG,UAAU,YAAY;IACpC,aAAa,EAAE,GAAG,UAAU,iBAAiB;IAC7C,kBAAkB,EAAE,GAAG,UAAU,sBAAsB;IACvD,mBAAmB,EAAE,GAAG,UAAU,uBAAuB;IACzD,OAAO,EAAE,GAAG,UAAU,UAAU;IAChC,YAAY,EAAE,GAAG,UAAU,gBAAgB;IAC3C,OAAO,EAAE,GAAG,UAAU,UAAU;IAChC,KAAK,EAAE,GAAG,UAAU,QAAQ;CACpB,CAAC"}

package/dist/app-definitions/agentmail.json

@@ -0,0 +1,49 @@
+{
+    "schemaVersion": 1,
+    "slug": "agentmail",
+    "name": "AgentMail",
+    "description": "Give agents email inboxes and handle each conversation as a task.",
+    "categories": [
+        "communication"
+    ],
+    "featured": false,
+    "branding": {
+        "logoUrl": "/brands/apps/agentmail.svg"
+    },
+    "urlPatterns": [
+        "https://console.agentmail.to/*"
+    ],
+    "methods": [
+        {
+            "key": "email-agent",
+            "label": "Email with an agent",
+            "purpose": "channel",
+            "provider": "agentmail",
+            "transport": "rest_api",
+            "auth": "api_key",
+            "ownershipModes": [
+                "customer"
+            ],
+            "whenToUse": "Assign an inbox to an agent and manage email conversations in tasks.",
+            "credentialFields": [
+                {
+                    "key": "apiKey",
+                    "label": "AgentMail API key",
+                    "type": "password",
+                    "placeholder": "am_…",
+                    "required": true,
+                    "secret": true
+                }
+            ],
+            "guidanceMd": "Connect an AgentMail API key, then create or select an inbox for your agent. WebSocket receiving works without a public URL.",
+            "consoleLinks": {
+                "keys": "https://console.agentmail.to",
+                "docs": "https://docs.agentmail.to/inboxes"
+            },
+            "riskTier": "S3",
+            "requiredResourceFilters": [
+                "inbox"
+            ]
+        }
+    ]
+}

package/dist/app-definitions/airtable.json

@@ -0,0 +1,41 @@
+{
+    "schemaVersion": 1,
+    "slug": "airtable",
+    "name": "Airtable",
+    "description": "Connect Airtable's provider-hosted MCP server.",
+    "categories": [
+        "data"
+    ],
+    "featured": false,
+    "branding": {
+        "logoUrl": "/brands/apps/airtable.svg"
+    },
+    "urlPatterns": [
+        "https://mcp.airtable.com/*"
+    ],
+    "docsUrl": "https://support.airtable.com/articles/9897799762-using-the-airtable-mcp-server",
+    "redirectConstraints": "https-or-loopback-http",
+    "methods": [
+        {
+            "key": "mcp-oauth",
+            "transport": "mcp_remote",
+            "auth": "oauth",
+            "ownershipModes": [
+                "dcr"
+            ],
+            "whenToUse": "Use browser sign-in for the provider-hosted MCP server.",
+            "defaults": {
+                "serverUrl": "https://mcp.airtable.com/mcp"
+            },
+            "guidanceMd": "Connect Airtable in the browser. An Airtable account; enterprise administrators may need to allowlist the client.",
+            "riskTier": "S3",
+            "label": "Sign in with Airtable",
+            "consoleLinks": {
+                "docs": "https://support.airtable.com/articles/9897799762-using-the-airtable-mcp-server"
+            },
+            "warnings": [
+                "An Airtable account; enterprise administrators may need to allowlist the client."
+            ]
+        }
+    ]
+}

package/dist/app-definitions/anthropic.json

@@ -0,0 +1,75 @@
+{
+    "schemaVersion": 1,
+    "slug": "anthropic",
+    "name": "Anthropic",
+    "description": "Use Anthropic APIs with a restricted key.",
+    "categories": [
+        "ai"
+    ],
+    "featured": false,
+    "branding": {
+        "logoUrl": "/brands/apps/anthropic.svg",
+        "darkLogoUrl": "/brands/apps/anthropic-dark.svg"
+    },
+    "urlPatterns": [
+        "https://api.anthropic.com/*"
+    ],
+    "methods": [
+        {
+            "key": "ai-subscription",
+            "label": "Claude subscription",
+            "purpose": "ai",
+            "transport": "runtime_auth",
+            "auth": "oauth",
+            "ai": {
+                "provider": "anthropic",
+                "method": "subscription"
+            },
+            "grantKinds": [
+                "user",
+                "organization"
+            ],
+            "ownershipModes": [
+                "customer"
+            ],
+            "whenToUse": "Authenticate an agent with this account.",
+            "guidanceMd": "Use your personal account or an explicitly shared company account.",
+            "riskTier": "S3"
+        },
+        {
+            "key": "ai-api_key",
+            "label": "Claude API key",
+            "purpose": "ai",
+            "transport": "runtime_auth",
+            "auth": "api_key",
+            "ai": {
+                "provider": "anthropic",
+                "method": "api_key"
+            },
+            "grantKinds": [
+                "user",
+                "organization"
+            ],
+            "ownershipModes": [
+                "customer"
+            ],
+            "whenToUse": "Authenticate an agent with this account.",
+            "guidanceMd": "Use your personal account or an explicitly shared company account.",
+            "riskTier": "S3",
+            "credentialFields": [
+                {
+                    "key": "apiKey",
+                    "label": "API key",
+                    "type": "password",
+                    "required": true,
+                    "placeholder": "Enter API key",
+                    "secret": true
+                }
+            ],
+            "keyPlacement": {
+                "location": "env",
+                "name": "ANTHROPIC_API_KEY"
+            }
+        }
+    ]
+}

package/dist/app-definitions/api-key-generic.json

@@ -0,0 +1,43 @@
+{
+    "schemaVersion": 1,
+    "slug": "api-key-generic",
+    "name": "API key app",
+    "description": "Connect an API using a key from your provider.",
+    "categories": [
+        "other"
+    ],
+    "featured": false,
+    "branding": {
+        "logoUrl": "/brands/apps/api-key-generic.svg"
+    },
+    "urlPatterns": [],
+    "methods": [
+        {
+            "key": "api-key",
+            "transport": "rest_api",
+            "auth": "api_key",
+            "ownershipModes": [
+                "customer"
+            ],
+            "whenToUse": "Use credentials from your provider account.",
+            "defaults": {},
+            "guidanceMd": "Create a restricted API key and paste it here.",
+            "riskTier": "S3",
+            "credentialFields": [
+                {
+                    "key": "apiKey",
+                    "label": "API key",
+                    "type": "password",
+                    "required": true,
+                    "placeholder": "Paste the API key",
+                    "secret": true
+                }
+            ],
+            "keyPlacement": {
+                "location": "header",
+                "name": "Authorization",
+                "prefix": "Bearer "
+            }
+        }
+    ]
+}

package/dist/app-definitions/arcade.json

@@ -0,0 +1,36 @@
+{
+    "schemaVersion": 1,
+    "slug": "arcade",
+    "name": "Arcade",
+    "description": "Use the tools exposed by your Arcade MCP connection.",
+    "categories": [
+        "productivity"
+    ],
+    "featured": true,
+    "branding": {
+        "logoUrl": "/brands/apps/arcade.png"
+    },
+    "urlPatterns": [
+        "https://api.arcade.dev/*"
+    ],
+    "methods": [
+        {
+            "key": "mcp",
+            "transport": "mcp_remote",
+            "auth": "none",
+            "ownershipModes": [
+                "dcr",
+                "customer"
+            ],
+            "whenToUse": "Use the provider-hosted connection for the quickest setup.",
+            "defaults": {},
+            "guidanceMd": "Paste your Arcade MCP URL. Sign in if required, or add a token or headers under Advanced authentication.",
+            "riskTier": "S3",
+            "label": "Connect MCP server",
+            "consoleLinks": {
+                "docs": "https://docs.arcade.dev/en/operate/governance/mcp-gateways"
+            }
+        }
+    ],
+    "docsUrl": "https://docs.arcade.dev/en/operate/governance/mcp-gateways"
+}

package/dist/app-definitions/asana.json

@@ -0,0 +1,42 @@
+{
+    "schemaVersion": 1,
+    "slug": "asana",
+    "name": "Asana",
+    "description": "Connect Asana's provider-hosted MCP server.",
+    "categories": [
+        "productivity"
+    ],
+    "featured": false,
+    "branding": {
+        "logoUrl": "/brands/apps/asana.svg"
+    },
+    "urlPatterns": [
+        "https://mcp.asana.com/*"
+    ],
+    "docsUrl": "https://developers.asana.com/docs/integrating-with-asanas-mcp-server",
+    "redirectConstraints": "https-or-loopback-http",
+    "methods": [
+        {
+            "key": "mcp-own-oauth",
+            "transport": "mcp_remote",
+            "auth": "oauth",
+            "ownershipModes": [
+                "customer"
+            ],
+            "whenToUse": "Register an OAuth app with Asana, then enter its client ID and secret.",
+            "defaults": {
+                "serverUrl": "https://mcp.asana.com/v2/mcp"
+            },
+            "guidanceMd": "Connect Asana in the browser. Create an Asana MCP OAuth app and register Paperclip's callback URI; DCR is not supported.",
+            "riskTier": "S3",
+            "label": "Use your own OAuth app",
+            "consoleLinks": {
+                "register": "https://developers.asana.com/docs/integrating-with-asanas-mcp-server",
+                "docs": "https://developers.asana.com/docs/integrating-with-asanas-mcp-server"
+            },
+            "warnings": [
+                "Create an Asana MCP OAuth app and register Paperclip's callback URI; DCR is not supported."
+            ]
+        }
+    ]
+}

package/dist/app-definitions/beehiiv.json

@@ -0,0 +1,41 @@
+{
+    "schemaVersion": 1,
+    "slug": "beehiiv",
+    "name": "beehiiv",
+    "description": "Connect beehiiv's provider-hosted MCP server.",
+    "categories": [
+        "content"
+    ],
+    "featured": false,
+    "branding": {
+        "logoUrl": "/brands/apps/beehiiv.png"
+    },
+    "urlPatterns": [
+        "https://mcp.beehiiv.com/*"
+    ],
+    "docsUrl": "https://www.beehiiv.com/features/mcp/getting-started",
+    "redirectConstraints": "https-or-loopback-http",
+    "methods": [
+        {
+            "key": "mcp-oauth",
+            "transport": "mcp_remote",
+            "auth": "oauth",
+            "ownershipModes": [
+                "dcr"
+            ],
+            "whenToUse": "Use browser sign-in for the provider-hosted MCP server.",
+            "defaults": {
+                "serverUrl": "https://mcp.beehiiv.com/mcp"
+            },
+            "guidanceMd": "Connect beehiiv in the browser. A beehiiv account; the subscription plan controls available write capabilities.",
+            "riskTier": "S3",
+            "label": "Sign in with beehiiv",
+            "consoleLinks": {
+                "docs": "https://www.beehiiv.com/features/mcp/getting-started"
+            },
+            "warnings": [
+                "A beehiiv account; the subscription plan controls available write capabilities."
+            ]
+        }
+    ]
+}

package/dist/app-definitions/bitly.json

@@ -0,0 +1,78 @@
+{
+    "schemaVersion": 1,
+    "slug": "bitly",
+    "name": "Bitly",
+    "description": "Connect Bitly's provider-hosted MCP server.",
+    "categories": [
+        "analytics"
+    ],
+    "featured": false,
+    "branding": {
+        "logoUrl": "/brands/apps/bitly.svg"
+    },
+    "urlPatterns": [
+        "https://api-ssl.bitly.com/*"
+    ],
+    "docsUrl": "https://dev.bitly.com/bitly-mcp/overview/quickstart/",
+    "redirectConstraints": "https-or-loopback-http",
+    "methods": [
+        {
+            "key": "mcp-oauth",
+            "transport": "mcp_remote",
+            "auth": "oauth",
+            "ownershipModes": [
+                "dcr"
+            ],
+            "whenToUse": "Use browser sign-in for the provider-hosted MCP server.",
+            "defaults": {
+                "serverUrl": "https://api-ssl.bitly.com/v4/mcp"
+            },
+            "guidanceMd": "Connect Bitly in the browser. A Bitly account with either browser authorization or an API token.",
+            "riskTier": "S2",
+            "label": "Sign in with Bitly",
+            "consoleLinks": {
+                "docs": "https://dev.bitly.com/bitly-mcp/overview/quickstart/"
+            },
+            "warnings": [
+                "A Bitly account with either browser authorization or an API token."
+            ]
+        },
+        {
+            "key": "mcp-api-key",
+            "transport": "mcp_remote",
+            "auth": "api_key",
+            "ownershipModes": [
+                "customer"
+            ],
+            "whenToUse": "Use a restricted customer-owned key when browser sign-in is not suitable.",
+            "defaults": {
+                "serverUrl": "https://api-ssl.bitly.com/v4/mcp"
+            },
+            "guidanceMd": "Use a customer-created Bitly key. A Bitly account with either browser authorization or an API token.",
+            "riskTier": "S2",
+            "label": "Use an API key",
+            "credentialFields": [
+                {
+                    "key": "authorization",
+                    "label": "Bitly API key",
+                    "type": "password",
+                    "required": true,
+                    "placeholder": "Paste your Bitly API token",
+                    "secret": true
+                }
+            ],
+            "keyPlacement": {
+                "location": "header",
+                "name": "Authorization",
+                "prefix": "Bearer "
+            },
+            "consoleLinks": {
+                "keys": "https://dev.bitly.com/bitly-mcp/overview/quickstart/",
+                "docs": "https://dev.bitly.com/bitly-mcp/overview/quickstart/"
+            },
+            "warnings": [
+                "A Bitly account with either browser authorization or an API token."
+            ]
+        }
+    ]
+}