@tickernelz/paperclip-pro-shared 2026.925.0

package/dist/telemetry/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/telemetry/state.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,cAAc,CAyBnF"}

package/dist/telemetry/state.js

@@ -0,0 +1,28 @@
+import { randomUUID, randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+export function loadOrCreateState(stateDir, version) {
+    const filePath = path.join(stateDir, "state.json");
+    if (existsSync(filePath)) {
+        try {
+            const raw = readFileSync(filePath, "utf-8");
+            const parsed = JSON.parse(raw);
+            if (parsed.installId && parsed.salt) {
+                return parsed;
+            }
+        }
+        catch {
+            // Corrupted state file — recreate
+        }
+    }
+    const state = {
+        installId: randomUUID(),
+        salt: randomBytes(32).toString("hex"),
+        createdAt: new Date().toISOString(),
+        firstSeenVersion: version,
+    };
+    mkdirSync(stateDir, { recursive: true });
+    writeFileSync(filePath, JSON.stringify(state, null, 2) + "\n", "utf-8");
+    return state;
+}
+//# sourceMappingURL=state.js.map

package/dist/telemetry/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/telemetry/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,OAAe;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAEnD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,CAAC;YACjD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpC,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAmB;QAC5B,SAAS,EAAE,UAAU,EAAE;QACvB,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QACrC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,gBAAgB,EAAE,OAAO;KAC1B,CAAC;IAEF,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/telemetry/types.d.ts

@@ -0,0 +1,62 @@
+import type { EventDimensionsMap, PaperclipEventName } from "./generated/paperclip-telemetry.js";
+export interface TelemetryState {
+    installId: string;
+    salt: string;
+    createdAt: string;
+    firstSeenVersion: string;
+}
+/**
+ * Exponential-backoff-with-jitter parameters for the (future) batched-retry
+ * sender. Shape mirrors the plugin worker crash-recovery backoff
+ * (`server/src/services/plugin-worker-manager.ts`). Consumed by the
+ * batched-retry sender; nothing reads it yet.
+ */
+export interface TelemetryBackoffConfig {
+    baseDelayMs: number;
+    maxDelayMs: number;
+    maxAttempts: number;
+    jitterRatio: number;
+}
+export interface TelemetryConfig {
+    enabled: boolean;
+    endpoint?: string;
+    app?: string;
+    schemaVersion?: string;
+    /**
+     * Optional, additive soft caps + backoff. Defaulted centrally in
+     * `resolveTelemetryConfig`; no wire/envelope change and no consumer today —
+     * the batched-retry sender is the first reader.
+     */
+    maxEventsPerBatch?: number;
+    maxBodyBytes?: number;
+    maxPendingRetryBatches?: number;
+    backoff?: TelemetryBackoffConfig;
+}
+export type TelemetryDimensionValue = string | number | boolean;
+export type TelemetryDimensions = Record<string, TelemetryDimensionValue>;
+/** Per-event object inside the backend envelope */
+export interface TelemetryEvent {
+    name: string;
+    occurredAt: string;
+    dimensions: TelemetryDimensions;
+}
+/** Full payload sent to the backend ingest endpoint */
+export interface TelemetryEventEnvelope {
+    app: string;
+    schemaVersion: string;
+    installId: string;
+    version: string;
+    events: TelemetryEvent[];
+    /**
+     * Deterministic, salt-free content-hash of `{installId, events}` used as the
+     * server idempotency key so a retried batch de-dupes (202 replay) instead of
+     * double-counting. Derived in `client.ts`; the server allow-set already
+     * accepts it. The hash is salt-free so it stays stable across installs and
+     * never leaks the per-install salt.
+     */
+    batchId: string;
+}
+export type RegisteredPluginEventName = never;
+export type TelemetryEventName = PaperclipEventName | RegisteredPluginEventName;
+export type TelemetryEventDimensions<K extends TelemetryEventName> = K extends keyof EventDimensionsMap ? EventDimensionsMap[K] : never;
+//# sourceMappingURL=types.d.ts.map

package/dist/telemetry/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/telemetry/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,oCAAoC,CAAC;AAE5C,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,OAAO,CAAC,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,MAAM,uBAAuB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAChE,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AAE1E,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,mBAAmB,CAAC;CACjC;AAED,uDAAuD;AACvD,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAC9C,MAAM,MAAM,kBAAkB,GAAG,kBAAkB,GAAG,yBAAyB,CAAC;AAEhF,MAAM,MAAM,wBAAwB,CAAC,CAAC,SAAS,kBAAkB,IAC/D,CAAC,SAAS,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC"}

package/dist/telemetry/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/telemetry/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/telemetry/types.ts"],"names":[],"mappings":""}

package/dist/trust-policy.d.ts

@@ -0,0 +1,68 @@
+export declare const TRUST_PRESETS: readonly ["standard", "low_trust_review"];
+export type TrustPreset = (typeof TRUST_PRESETS)[number];
+export declare const DEFAULT_TRUST_PRESET: "standard";
+export declare const LOW_TRUST_REVIEW_PRESET: "low_trust_review";
+export declare const LOW_TRUST_REVIEW_PRESET_VERSION: 1;
+export declare const LOW_TRUST_REVIEW_RAW_OUTPUT_DISPOSITION: "quarantine";
+export declare const LOW_TRUST_TOOL_CLASSES: readonly ["git.read", "github.pr.read", "tests.local"];
+export type LowTrustToolClass = (typeof LOW_TRUST_TOOL_CLASSES)[number] | string;
+export interface LowTrustOutputPromotionTarget {
+    type: "issue";
+    issueId: string;
+}
+export interface LowTrustBoundary {
+    mode: typeof LOW_TRUST_REVIEW_PRESET;
+    companyId?: string;
+    projectIds?: string[];
+    rootIssueId?: string;
+    issueIds?: string[];
+    allowedAgentIds?: string[];
+    allowedSecretBindingIds?: string[];
+    allowedToolClasses?: LowTrustToolClass[];
+    outputPromotionTarget?: LowTrustOutputPromotionTarget;
+}
+export interface LowTrustReviewPresetPolicy {
+    id: typeof LOW_TRUST_REVIEW_PRESET;
+    version: typeof LOW_TRUST_REVIEW_PRESET_VERSION;
+    rawOutputDisposition: typeof LOW_TRUST_REVIEW_RAW_OUTPUT_DISPOSITION;
+}
+export interface AssignmentAuthorizationPolicy extends Record<string, unknown> {
+    mode?: "company_default" | "protected";
+    /** @deprecated Use `protectedAgent.blockAssignment`. */
+    protectedAgentRequiresApproval?: boolean;
+}
+export interface ProtectedAgentAuthorizationPolicy extends Record<string, unknown> {
+    /** Hard-block assignment until a company administrator removes the block. */
+    blockAssignment?: boolean;
+    blockReason?: string;
+    /** @deprecated Legacy hard-block alias. This does not create an approval. */
+    requiresApproval?: boolean;
+    /** @deprecated Legacy metadata retained for compatibility. */
+    approvalReason?: string;
+}
+export interface TrustAuthorizationPolicy extends Record<string, unknown> {
+    trustPreset?: TrustPreset;
+    reviewPreset?: LowTrustReviewPresetPolicy;
+    trustBoundary?: LowTrustBoundary;
+    assignmentPolicy?: AssignmentAuthorizationPolicy;
+    protectedAgent?: ProtectedAgentAuthorizationPolicy;
+}
+export type SourceTrustArtifactKind = "issue" | "comment" | "document" | "work_product";
+export type SourceTrustDisposition = "quarantined" | "promoted";
+export interface SourceTrustPromotionSource {
+    artifactKind: SourceTrustArtifactKind;
+    artifactId: string;
+    issueId?: string | null;
+}
+export interface SourceTrustMetadata {
+    preset: TrustPreset;
+    disposition: SourceTrustDisposition;
+    sourceIssueId?: string | null;
+    sourceRunId?: string | null;
+    sourceAgentId?: string | null;
+    promotedFrom?: SourceTrustPromotionSource | null;
+    promotedByActorType?: "agent" | "user" | "system" | null;
+    promotedByActorId?: string | null;
+    promotedAt?: string | null;
+}
+//# sourceMappingURL=trust-policy.d.ts.map

package/dist/trust-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-policy.d.ts","sourceRoot":"","sources":["../src/trust-policy.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,aAAa,YAAI,UAAU,EAAE,kBAAkB,CAAU,CAAC;AAEvE,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,eAAO,MAAM,oBAAoB,EAAG,UAAmB,CAAC;AACxD,eAAO,MAAM,uBAAuB,EAAG,kBAA2B,CAAC;AACnE,eAAO,MAAM,+BAA+B,EAAG,CAAU,CAAC;AAC1D,eAAO,MAAM,uCAAuC,EAAG,YAAqB,CAAC;AAE7E,eAAO,MAAM,sBAAsB,YACjC,UAAU,EACV,gBAAgB,EAChB,aAAa,CACL,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;AAEjF,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,uBAAuB,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,uBAAuB,CAAC,EAAE,MAAM,EAAE,CAAC;IACnC,kBAAkB,CAAC,EAAE,iBAAiB,EAAE,CAAC;IACzC,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;CACvD;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,OAAO,uBAAuB,CAAC;IACnC,OAAO,EAAE,OAAO,+BAA+B,CAAC;IAChD,oBAAoB,EAAE,OAAO,uCAAuC,CAAC;CACtE;AAED,MAAM,WAAW,6BAA8B,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC5E,IAAI,CAAC,EAAE,iBAAiB,GAAG,WAAW,CAAC;IACvC,wDAAwD;IACxD,8BAA8B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAED,MAAM,WAAW,iCAAkC,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAChF,6EAA6E;IAC7E,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAyB,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACvE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,YAAY,CAAC,EAAE,0BAA0B,CAAC;IAC1C,aAAa,CAAC,EAAE,gBAAgB,CAAC;IACjC,gBAAgB,CAAC,EAAE,6BAA6B,CAAC;IACjD,cAAc,CAAC,EAAE,iCAAiC,CAAC;CACpD;AAED,MAAM,MAAM,uBAAuB,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,cAAc,CAAC;AAExF,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,UAAU,CAAC;AAEhE,MAAM,WAAW,0BAA0B;IACzC,YAAY,EAAE,uBAAuB,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,WAAW,EAAE,sBAAsB,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,YAAY,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACjD,mBAAmB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,IAAI,CAAC;IACzD,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B"}

package/dist/trust-policy.js

@@ -0,0 +1,11 @@
+export const TRUST_PRESETS = ["standard", "low_trust_review"];
+export const DEFAULT_TRUST_PRESET = "standard";
+export const LOW_TRUST_REVIEW_PRESET = "low_trust_review";
+export const LOW_TRUST_REVIEW_PRESET_VERSION = 1;
+export const LOW_TRUST_REVIEW_RAW_OUTPUT_DISPOSITION = "quarantine";
+export const LOW_TRUST_TOOL_CLASSES = [
+    "git.read",
+    "github.pr.read",
+    "tests.local",
+];
+//# sourceMappingURL=trust-policy.js.map

package/dist/trust-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-policy.js","sourceRoot":"","sources":["../src/trust-policy.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,UAAU,EAAE,kBAAkB,CAAU,CAAC;AAIvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAmB,CAAC;AACxD,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAA2B,CAAC;AACnE,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAU,CAAC;AAC1D,MAAM,CAAC,MAAM,uCAAuC,GAAG,YAAqB,CAAC;AAE7E,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU;IACV,gBAAgB;IAChB,aAAa;CACL,CAAC"}

package/dist/types/access.d.ts

@@ -0,0 +1,142 @@
+import type { AgentAdapterType, CompanyStatus, HumanCompanyMembershipRole, InstanceUserRole, InviteJoinType, InviteType, JoinRequestStatus, JoinRequestType, MembershipStatus, PermissionKey, PrincipalType } from "../constants.js";
+export interface CompanyMembership {
+    id: string;
+    companyId: string;
+    principalType: PrincipalType;
+    principalId: string;
+    status: MembershipStatus;
+    membershipRole: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface PrincipalPermissionGrant {
+    id: string;
+    companyId: string;
+    principalType: PrincipalType;
+    principalId: string;
+    permissionKey: PermissionKey;
+    scope: Record<string, unknown> | null;
+    grantedByUserId: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface AccessUserProfile {
+    id: string;
+    email: string | null;
+    name: string | null;
+    image: string | null;
+}
+export interface CompanyMemberRecord extends CompanyMembership {
+    principalType: "user";
+    membershipRole: HumanCompanyMembershipRole | null;
+    user: AccessUserProfile | null;
+    grants: PrincipalPermissionGrant[];
+    removal?: {
+        canArchive: boolean;
+        reason: string | null;
+    };
+}
+export interface CompanyMembersResponse {
+    members: CompanyMemberRecord[];
+    access: {
+        currentUserRole: HumanCompanyMembershipRole | null;
+        canManageMembers: boolean;
+        canInviteUsers: boolean;
+        canApproveJoinRequests: boolean;
+    };
+}
+export interface ArchiveCompanyMemberResponse {
+    member: CompanyMemberRecord;
+    reassignedIssueCount: number;
+}
+export interface Invite {
+    id: string;
+    companyId: string | null;
+    inviteType: InviteType;
+    tokenHash: string;
+    allowedJoinTypes: InviteJoinType;
+    defaultsPayload: Record<string, unknown> | null;
+    expiresAt: Date;
+    invitedByUserId: string | null;
+    revokedAt: Date | null;
+    acceptedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export type InviteState = "active" | "revoked" | "accepted" | "expired";
+export interface CompanyInviteRecord extends Invite {
+    companyName: string | null;
+    humanRole: HumanCompanyMembershipRole | null;
+    inviteMessage: string | null;
+    state: InviteState;
+    invitedByUser: AccessUserProfile | null;
+    relatedJoinRequestId: string | null;
+}
+export interface CompanyInviteListResponse {
+    invites: CompanyInviteRecord[];
+    nextOffset: number | null;
+}
+export interface JoinRequest {
+    id: string;
+    inviteId: string;
+    companyId: string;
+    requestType: JoinRequestType;
+    status: JoinRequestStatus;
+    requestIp: string;
+    requestingUserId: string | null;
+    requestEmailSnapshot: string | null;
+    agentName: string | null;
+    adapterType: AgentAdapterType | null;
+    capabilities: string | null;
+    agentDefaultsPayload: Record<string, unknown> | null;
+    claimSecretExpiresAt: Date | null;
+    claimSecretConsumedAt: Date | null;
+    createdAgentId: string | null;
+    approvedByUserId: string | null;
+    approvedAt: Date | null;
+    rejectedByUserId: string | null;
+    rejectedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface JoinRequestInviteSummary {
+    id: string;
+    inviteType: InviteType;
+    allowedJoinTypes: InviteJoinType;
+    humanRole: HumanCompanyMembershipRole | null;
+    inviteMessage: string | null;
+    createdAt: Date;
+    expiresAt: Date;
+    revokedAt: Date | null;
+    acceptedAt: Date | null;
+    invitedByUser: AccessUserProfile | null;
+}
+export interface JoinRequestRecord extends JoinRequest {
+    requesterUser: AccessUserProfile | null;
+    approvedByUser: AccessUserProfile | null;
+    rejectedByUser: AccessUserProfile | null;
+    invite: JoinRequestInviteSummary | null;
+}
+export interface InstanceUserRoleGrant {
+    id: string;
+    userId: string;
+    role: InstanceUserRole;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export interface AdminUserDirectoryEntry extends AccessUserProfile {
+    isInstanceAdmin: boolean;
+    activeCompanyMembershipCount: number;
+}
+export interface UserCompanyAccessEntry extends CompanyMembership {
+    principalType: "user";
+    companyName: string | null;
+    companyStatus: CompanyStatus | null;
+}
+export interface UserCompanyAccessResponse {
+    user: (AccessUserProfile & {
+        isInstanceAdmin: boolean;
+    }) | null;
+    companyAccess: UserCompanyAccessEntry[];
+}
+//# sourceMappingURL=access.d.ts.map

package/dist/types/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/types/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,gBAAgB,EAChB,aAAa,EACb,0BAA0B,EAC1B,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,aAAa,EACd,MAAM,iBAAiB,CAAC;AAEzB,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,gBAAgB,CAAC;IACzB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,aAAa,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,aAAa,CAAC;IAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAClD,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACnC,OAAO,CAAC,EAAE;QACR,UAAU,EAAE,OAAO,CAAC;QACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,CAAC;CACH;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,MAAM,EAAE;QACN,eAAe,EAAE,0BAA0B,GAAG,IAAI,CAAC;QACnD,gBAAgB,EAAE,OAAO,CAAC;QAC1B,cAAc,EAAE,OAAO,CAAC;QACxB,sBAAsB,EAAE,OAAO,CAAC;KACjC,CAAC;CACH;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,MAAM;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,UAAU,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,cAAc,CAAC;IACjC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChD,SAAS,EAAE,IAAI,CAAC;IAChB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAExE,MAAM,WAAW,mBAAoB,SAAQ,MAAM;IACjD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAC7C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,WAAW,CAAC;IACnB,aAAa,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACxC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC/B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,eAAe,CAAC;IAC7B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACrC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACrD,oBAAoB,EAAE,IAAI,GAAG,IAAI,CAAC;IAClC,qBAAqB,EAAE,IAAI,GAAG,IAAI,CAAC;IACnC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,UAAU,CAAC;IACvB,gBAAgB,EAAE,cAAc,CAAC;IACjC,SAAS,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAC7C,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,aAAa,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACxC,cAAc,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACzC,cAAc,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACzC,MAAM,EAAE,wBAAwB,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,gBAAgB,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,eAAe,EAAE,OAAO,CAAC;IACzB,4BAA4B,EAAE,MAAM,CAAC;CACtC;AAED,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAC/D,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,CAAC,iBAAiB,GAAG;QACzB,eAAe,EAAE,OAAO,CAAC;KAC1B,CAAC,GAAG,IAAI,CAAC;IACV,aAAa,EAAE,sBAAsB,EAAE,CAAC;CACzC"}

package/dist/types/access.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=access.js.map

package/dist/types/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/types/access.ts"],"names":[],"mappings":""}

package/dist/types/activity.d.ts

@@ -0,0 +1,15 @@
+export interface ActivityEvent {
+    id: string;
+    companyId: string;
+    actorType: "agent" | "user" | "system" | "plugin";
+    actorId: string;
+    action: string;
+    entityType: string;
+    entityId: string;
+    agentId: string | null;
+    runId: string | null;
+    responsibleUserId?: string | null;
+    details: Record<string, unknown> | null;
+    createdAt: Date;
+}
+//# sourceMappingURL=activity.d.ts.map

package/dist/types/activity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity.d.ts","sourceRoot":"","sources":["../../src/types/activity.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,IAAI,CAAC;CACjB"}

package/dist/types/activity.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=activity.js.map

package/dist/types/activity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity.js","sourceRoot":"","sources":["../../src/types/activity.ts"],"names":[],"mappings":""}

package/dist/types/adapter-registry.d.ts

@@ -0,0 +1,31 @@
+/**
+ * One declarative agent-harness ("adapter") entry. The same shape is used for
+ * local self-hosting and our operator/cloud: it governs both availability (the
+ * picker) and, when the run is sandboxed on Kubernetes, the runtime wiring.
+ *
+ * Replace semantics: when a registry is supplied it is the COMPLETE declared
+ * set. Adopt (built-in defaults) = no registry at all. Remove = omit the entry.
+ * Add = include a new entry. Override = redefine an existing adapterType.
+ */
+export interface AdapterRegistryEntry {
+    /** The harness, e.g. "opencode_local". */
+    adapterType: string;
+    /** Availability (both local + k8s). Default true. */
+    enabled?: boolean;
+    /** k8s-sandbox-only: container image the Job/Sandbox runs. */
+    runtimeImage?: string;
+    /** k8s-sandbox-only: process-env keys forwarded into the Job (e.g. ANTHROPIC_API_KEY). */
+    envKeys?: string[];
+    /** k8s-sandbox-only: egress FQDN allow-list for the agent pod. */
+    allowFqdns?: string[];
+    /** k8s-sandbox-only: liveness/probe command. */
+    probeCommand?: string[];
+    /**
+     * Non-secret env injected into the Job/Sandbox as the BASE; the process-env
+     * values (the secret API key, via envKeys) override it. Carries e.g.
+     * ANTHROPIC_BASE_URL pointing at the in-cluster Bifrost gateway. NEVER put
+     * secrets here.
+     */
+    defaultEnv?: Record<string, string>;
+}
+//# sourceMappingURL=adapter-registry.d.ts.map

package/dist/types/adapter-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-registry.d.ts","sourceRoot":"","sources":["../../src/types/adapter-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,0FAA0F;IAC1F,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC"}

package/dist/types/adapter-registry.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=adapter-registry.js.map

package/dist/types/adapter-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-registry.js","sourceRoot":"","sources":["../../src/types/adapter-registry.ts"],"names":[],"mappings":""}

package/dist/types/adapter-skills.d.ts

@@ -0,0 +1,38 @@
+export type AgentSkillSyncMode = "unsupported" | "persistent" | "ephemeral";
+export type AgentSkillAssignmentMode = "add" | "remove" | "replace";
+export type AgentSkillState = "available" | "configured" | "installed" | "missing" | "stale" | "external";
+export type AgentSkillOrigin = "company_managed" | "user_installed" | "external_unknown";
+export interface AgentDesiredSkillEntry {
+    key: string;
+    versionId: string | null;
+}
+export interface AgentSkillEntry {
+    key: string;
+    runtimeName: string | null;
+    versionId?: string | null;
+    currentVersionId?: string | null;
+    desired: boolean;
+    managed: boolean;
+    state: AgentSkillState;
+    origin?: AgentSkillOrigin;
+    originLabel?: string | null;
+    locationLabel?: string | null;
+    readOnly?: boolean;
+    sourcePath?: string | null;
+    targetPath?: string | null;
+    detail?: string | null;
+}
+export interface AgentSkillSnapshot {
+    adapterType: string;
+    supported: boolean;
+    mode: AgentSkillSyncMode;
+    desiredSkills: string[];
+    desiredSkillEntries?: AgentDesiredSkillEntry[];
+    entries: AgentSkillEntry[];
+    warnings: string[];
+}
+export interface AgentSkillSyncRequest {
+    mode: AgentSkillAssignmentMode;
+    desiredSkills: Array<string | AgentDesiredSkillEntry>;
+}
+//# sourceMappingURL=adapter-skills.d.ts.map

package/dist/types/adapter-skills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-skills.d.ts","sourceRoot":"","sources":["../../src/types/adapter-skills.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,kBAAkB,GAAG,aAAa,GAAG,YAAY,GAAG,WAAW,CAAC;AAE5E,MAAM,MAAM,wBAAwB,GAAG,KAAK,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpE,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,YAAY,GACZ,WAAW,GACX,SAAS,GACT,OAAO,GACP,UAAU,CAAC;AAEf,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,gBAAgB,GAChB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,IAAI,EAAE,kBAAkB,CAAC;IACzB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,mBAAmB,CAAC,EAAE,sBAAsB,EAAE,CAAC;IAC/C,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,wBAAwB,CAAC;IAC/B,aAAa,EAAE,KAAK,CAAC,MAAM,GAAG,sBAAsB,CAAC,CAAC;CACvD"}

package/dist/types/adapter-skills.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=adapter-skills.js.map

package/dist/types/adapter-skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter-skills.js","sourceRoot":"","sources":["../../src/types/adapter-skills.ts"],"names":[],"mappings":""}

package/dist/types/agent.adapter-auth-session.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=agent.adapter-auth-session.test.d.ts.map

package/dist/types/agent.adapter-auth-session.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.adapter-auth-session.test.d.ts","sourceRoot":"","sources":["../../src/types/agent.adapter-auth-session.test.ts"],"names":[],"mappings":""}

package/dist/types/agent.adapter-auth-session.test.js

@@ -0,0 +1,103 @@
+import { describe, expect, it } from "vitest";
+import { ADAPTER_AUTH_SESSION_INTERNAL_STATUSES, ADAPTER_AUTH_SESSION_STATUSES, } from "./agent.js";
+import { ADAPTER_AUTH_SESSION_ACTIVE_STATUSES, isActiveAdapterAuthSessionStatus, toPublicAdapterAuthSessionStatus, } from "../adapter-auth-session.js";
+import { adapterAuthSessionResponseSchema, startAdapterAuthSessionRequestSchema, } from "../validators/adapter-auth-session.js";
+const sessionId = "11111111-1111-4111-8111-111111111111";
+const environmentId = "22222222-2222-4222-8222-222222222222";
+describe("adapter auth session contract", () => {
+    it("keeps the public status union closed and neutral", () => {
+        expect([...ADAPTER_AUTH_SESSION_STATUSES]).toEqual([
+            "starting",
+            "waiting_for_user",
+            "authenticated",
+            "failed",
+            "timed_out",
+            "cancelled",
+        ]);
+        // The internal states extend the public union with two server-only states.
+        expect([...ADAPTER_AUTH_SESSION_INTERNAL_STATUSES]).toEqual([
+            ...ADAPTER_AUTH_SESSION_STATUSES,
+            "promoting",
+            "cleanup_pending",
+        ]);
+        // No vendor or roadmap word in the public status union.
+        const joined = ADAPTER_AUTH_SESSION_STATUSES.join(" ").toLowerCase();
+        expect(joined).not.toContain("codex");
+        expect(joined).not.toContain("device");
+    });
+    it("accepts a valid public response and rejects an unknown status", () => {
+        const valid = {
+            sessionId,
+            environmentId,
+            status: "waiting_for_user",
+            expiresAt: "2026-08-11T12:00:00.000Z",
+            failure: null,
+        };
+        expect(adapterAuthSessionResponseSchema.parse(valid)).toEqual(valid);
+        expect(() => adapterAuthSessionResponseSchema.parse({ ...valid, status: "unknown" })).toThrow();
+        // The internal states never validate as a public response status.
+        expect(() => adapterAuthSessionResponseSchema.parse({ ...valid, status: "promoting" })).toThrow();
+        expect(() => adapterAuthSessionResponseSchema.parse({ ...valid, status: "cleanup_pending" })).toThrow();
+    });
+    it("rejects a prompt, token, or lease field on the public response", () => {
+        const base = {
+            sessionId,
+            environmentId,
+            status: "waiting_for_user",
+            expiresAt: null,
+            failure: null,
+        };
+        expect(() => adapterAuthSessionResponseSchema.parse({ ...base, prompt: { url: "x", code: "y" } })).toThrow();
+        expect(() => adapterAuthSessionResponseSchema.parse({ ...base, token: "secret" })).toThrow();
+        expect(() => adapterAuthSessionResponseSchema.parse({ ...base, providerLeaseId: "lease-1" })).toThrow();
+        expect(() => adapterAuthSessionResponseSchema.parse({ ...base, accountId: "acct-1" })).toThrow();
+        // Compile-time guard: the public response type carries none of these keys.
+        const _noPrompt = true;
+        const _noToken = true;
+        const _noLease = true;
+        const _noAccount = true;
+        void _noPrompt;
+        void _noToken;
+        void _noLease;
+        void _noAccount;
+    });
+    it("returns the prompt only through the owner read type", () => {
+        const owner = {
+            sessionId,
+            environmentId,
+            status: "waiting_for_user",
+            expiresAt: null,
+            failure: null,
+            prompt: { url: "https://auth.openai.com/codex/device", code: "ABCD-EFGHI" },
+        };
+        expect(owner.prompt?.code).toBe("ABCD-EFGHI");
+    });
+    it("maps the internal promoting state to the public waiting_for_user state", () => {
+        expect(toPublicAdapterAuthSessionStatus("promoting")).toBe("waiting_for_user");
+        expect(toPublicAdapterAuthSessionStatus("starting")).toBe("starting");
+        expect(toPublicAdapterAuthSessionStatus("authenticated")).toBe("authenticated");
+    });
+    it("never projects cleanup_pending to a public status", () => {
+        expect(() => toPublicAdapterAuthSessionStatus("cleanup_pending")).toThrow();
+    });
+    it("treats starting, waiting_for_user, and promoting as the active statuses", () => {
+        expect([...ADAPTER_AUTH_SESSION_ACTIVE_STATUSES]).toEqual([
+            "starting",
+            "waiting_for_user",
+            "promoting",
+        ]);
+        expect(isActiveAdapterAuthSessionStatus("starting")).toBe(true);
+        expect(isActiveAdapterAuthSessionStatus("promoting")).toBe(true);
+        expect(isActiveAdapterAuthSessionStatus("authenticated")).toBe(false);
+        expect(isActiveAdapterAuthSessionStatus("cleanup_pending")).toBe(false);
+    });
+    it("validates a start request and rejects an unknown adapter", () => {
+        const request = startAdapterAuthSessionRequestSchema.parse({
+            environmentId,
+            adapterType: "codex_local",
+        });
+        expect(request.environmentId).toBe(environmentId);
+        expect(() => startAdapterAuthSessionRequestSchema.parse({ environmentId })).toThrow();
+    });
+});
+//# sourceMappingURL=agent.adapter-auth-session.test.js.map

package/dist/types/agent.adapter-auth-session.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.adapter-auth-session.test.js","sourceRoot":"","sources":["../../src/types/agent.adapter-auth-session.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,sCAAsC,EACtC,6BAA6B,GAG9B,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,oCAAoC,EACpC,gCAAgC,EAChC,gCAAgC,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,gCAAgC,EAChC,oCAAoC,GACrC,MAAM,uCAAuC,CAAC;AAM/C,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAE7D,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,CAAC,GAAG,6BAA6B,CAAC,CAAC,CAAC,OAAO,CAAC;YACjD,UAAU;YACV,kBAAkB;YAClB,eAAe;YACf,QAAQ;YACR,WAAW;YACX,WAAW;SACZ,CAAC,CAAC;QACH,2EAA2E;QAC3E,MAAM,CAAC,CAAC,GAAG,sCAAsC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1D,GAAG,6BAA6B;YAChC,WAAW;YACX,iBAAiB;SAClB,CAAC,CAAC;QACH,wDAAwD;QACxD,MAAM,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,KAAK,GAA+B;YACxC,SAAS;YACT,aAAa;YACb,MAAM,EAAE,kBAAkB;YAC1B,SAAS,EAAE,0BAA0B;YACrC,OAAO,EAAE,IAAI;SACd,CAAC;QACF,MAAM,CAAC,gCAAgC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,CAAC,GAAG,EAAE,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAChG,kEAAkE;QAClE,MAAM,CAAC,GAAG,EAAE,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAClG,MAAM,CAAC,GAAG,EAAE,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC1G,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,MAAM,IAAI,GAAG;YACX,SAAS;YACT,aAAa;YACb,MAAM,EAAE,kBAA2B;YACnC,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI;SACd,CAAC;QACF,MAAM,CAAC,GAAG,EAAE,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7G,MAAM,CAAC,GAAG,EAAE,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7F,MAAM,CAAC,GAAG,EAAE,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QACxG,MAAM,CAAC,GAAG,EAAE,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAEjG,2EAA2E;QAC3E,MAAM,SAAS,GAA2D,IAAI,CAAC;QAC/E,MAAM,QAAQ,GAA0D,IAAI,CAAC;QAC7E,MAAM,QAAQ,GAAoE,IAAI,CAAC;QACvF,MAAM,UAAU,GAA8D,IAAI,CAAC;QACnF,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ,CAAC;QACd,KAAK,UAAU,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,KAAK,GAAoC;YAC7C,SAAS;YACT,aAAa;YACb,MAAM,EAAE,kBAAkB;YAC1B,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,EAAE,GAAG,EAAE,sCAAsC,EAAE,IAAI,EAAE,YAAY,EAAE;SAC5E,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,gCAAgC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC/E,MAAM,CAAC,gCAAgC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtE,MAAM,CAAC,gCAAgC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,CAAC,GAAG,EAAE,CAAC,gCAAgC,CAAC,iBAAiB,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CAAC,CAAC,GAAG,oCAAoC,CAAC,CAAC,CAAC,OAAO,CAAC;YACxD,UAAU;YACV,kBAAkB;YAClB,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,CAAC,gCAAgC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,CAAC,gCAAgC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjE,MAAM,CAAC,gCAAgC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtE,MAAM,CAAC,gCAAgC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,OAAO,GAAG,oCAAoC,CAAC,KAAK,CAAC;YACzD,aAAa;YACb,WAAW,EAAE,aAAa;SAC3B,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClD,MAAM,CAAC,GAAG,EAAE,CAAC,oCAAoC,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}