@tickernelz/paperclip-pro-shared 2026.925.0

package/dist/validators/chat-github.js

@@ -0,0 +1,149 @@
+import { z } from "zod";
+import { GITHUB_REVIEW_EVENTS } from "../types/chat-github.js";
+export const githubIdSchema = z.string().regex(/^[1-9][0-9]{0,19}$/);
+export const githubCommitSchema = z
+    .string()
+    .regex(/^[a-f0-9]{40}$/i)
+    .transform((value) => value.toLowerCase());
+const shortList = z.array(z.string().trim().min(1).max(256)).max(100);
+const prompts = z
+    .object({
+    opened: z.string().max(12000),
+    synchronize: z.string().max(12000),
+    reopened: z.string().max(12000),
+    ready_for_review: z.string().max(12000),
+    mention: z.string().max(12000),
+    comment: z.string().max(12000),
+})
+    .strict();
+export const githubReviewPolicySchema = z
+    .object({
+    invocation: z.enum(["mentions_only", "linked_authors", "allowed_authors"]),
+    events: z
+        .array(z.enum(GITHUB_REVIEW_EVENTS))
+        .max(GITHUB_REVIEW_EVENTS.length),
+    reviewDrafts: z.boolean(),
+    reviewBotAuthors: z.boolean(),
+    includeAuthors: shortList,
+    excludeAuthors: shortList,
+    targetBranches: shortList,
+    excludedBranches: shortList,
+    requiredLabels: shortList,
+    excludedLabels: shortList,
+    ignoredPaths: shortList,
+    instructions: z.string().max(24000),
+    prompts,
+    findingCategories: shortList,
+    minimumCommentSeverity: z.enum(["info", "warning", "error"]),
+    publishSummary: z.boolean(),
+    publishInline: z.boolean(),
+    allowApprove: z.boolean(),
+    allowRequestChanges: z.boolean(),
+    ratingThreshold: z.union([
+        z.literal(1),
+        z.literal(2),
+        z.literal(3),
+        z.literal(4),
+        z.literal(5),
+        z.null(),
+    ]),
+})
+    .strict();
+const person = {
+    githubUserId: githubIdSchema,
+    login: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9-]{0,38}(?:\[bot\])?$/),
+    automaticReviews: z.boolean(),
+};
+export const githubAllowedPersonSchema = z.discriminatedUnion("kind", [
+    z
+        .object({ ...person, kind: z.literal("member"), userId: z.string().min(1) })
+        .strict(),
+    z
+        .object({
+        ...person,
+        kind: z.literal("guest"),
+        sponsorUserId: z.string().min(1),
+        permissionProfile: z.literal("restricted"),
+    })
+        .strict(),
+]);
+export const githubChatConfigurationSchema = z
+    .object({
+    version: z.literal(1),
+    toolsEnabled: z.boolean(),
+    responsibleUserId: z.string().min(1),
+    memberAccess: z.enum(["all_linked", "selected"]),
+    people: z.array(githubAllowedPersonSchema).max(500),
+    defaults: githubReviewPolicySchema,
+    repositories: z
+        .record(githubIdSchema, githubReviewPolicySchema.partial())
+        .refine((value) => Object.keys(value).length <= 500),
+})
+    .strict()
+    .superRefine((value, ctx) => {
+    if (new Set(value.people.map((person) => person.githubUserId)).size !==
+        value.people.length)
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["people"],
+            message: "Each GitHub account can be allowed only once.",
+        });
+});
+export const updateGitHubChatConfigurationSchema = z
+    .object({
+    expectedRevision: z.number().int().nonnegative(),
+    configuration: githubChatConfigurationSchema,
+})
+    .strict();
+export const githubReviewAssessmentSchema = z
+    .object({
+    reviewedCommit: githubCommitSchema,
+    score: z.union([
+        z.literal(0),
+        z.literal(1),
+        z.literal(2),
+        z.literal(3),
+        z.literal(4),
+        z.literal(5),
+    ]),
+    complete: z.boolean(),
+    summary: z.string().trim().min(1).max(24000),
+    rationale: z.string().trim().min(1).max(12000),
+    coverage: z
+        .object({
+        reviewedPaths: z.array(z.string().min(1).max(1024)).max(5000),
+        omittedPaths: z.array(z.string().min(1).max(1024)).max(5000),
+        limitations: shortList,
+    })
+        .strict(),
+    findings: z
+        .array(z
+        .object({
+        key: z.string().min(1).max(160),
+        path: z.string().min(1).max(1024),
+        line: z.number().int().positive(),
+        side: z.enum(["LEFT", "RIGHT"]),
+        severity: z.enum(["info", "warning", "error"]),
+        category: z.string().min(1).max(80),
+        body: z.string().trim().min(1).max(12000),
+    })
+        .strict())
+        .max(300),
+})
+    .strict()
+    .superRefine((value, ctx) => {
+    if (value.complete && value.coverage.reviewedPaths.length === 0)
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["coverage"],
+            message: "A complete assessment must identify reviewed files.",
+        });
+    const keys = value.findings.map((f) => `${f.key}:${f.path}:${f.side}:${f.line}`);
+    if (new Set(keys).size !== keys.length)
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            path: ["findings"],
+            message: "Duplicate findings are not allowed.",
+        });
+});
+//# sourceMappingURL=chat-github.js.map

package/dist/validators/chat-github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-github.js","sourceRoot":"","sources":["../../src/validators/chat-github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,KAAK,CAAC,iBAAiB,CAAC;KACxB,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;AAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACtE,MAAM,OAAO,GAAG,CAAC;KACd,MAAM,CAAC;IACN,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;IAC/B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;CAC/B,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IAC1E,MAAM,EAAE,CAAC;SACN,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;SACnC,GAAG,CAAC,oBAAoB,CAAC,MAAM,CAAC;IACnC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC7B,cAAc,EAAE,SAAS;IACzB,cAAc,EAAE,SAAS;IACzB,cAAc,EAAE,SAAS;IACzB,gBAAgB,EAAE,SAAS;IAC3B,cAAc,EAAE,SAAS;IACzB,cAAc,EAAE,SAAS;IACzB,YAAY,EAAE,SAAS;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;IACnC,OAAO;IACP,iBAAiB,EAAE,SAAS;IAC5B,sBAAsB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE;IAChC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC;QACvB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,IAAI,EAAE;KACT,CAAC;CACH,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,MAAM,GAAG;IACb,YAAY,EAAE,cAAc;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,6CAA6C,CAAC;IACtE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE;CAC9B,CAAC;AACF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IACpE,CAAC;SACE,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,GAAG,MAAM;QACT,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACxB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC3C,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnD,QAAQ,EAAE,wBAAwB;IAClC,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC,cAAc,EAAE,wBAAwB,CAAC,OAAO,EAAE,CAAC;SAC1D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;CACvD,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IACE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;QAC/D,KAAK,CAAC,MAAM,CAAC,MAAM;QAEnB,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,QAAQ,CAAC;YAChB,OAAO,EAAE,+CAA+C;SACzD,CAAC,CAAC;AACP,CAAC,CAAC,CAAC;AACL,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC;KACjD,MAAM,CAAC;IACN,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAChD,aAAa,EAAE,6BAA6B;CAC7C,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,cAAc,EAAE,kBAAkB;IAClC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC;QACb,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QACZ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACb,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC9C,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAC7D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QAC5D,WAAW,EAAE,SAAS;KACvB,CAAC;SACD,MAAM,EAAE;IACX,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;QACjC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;KAC1C,CAAC;SACD,MAAM,EAAE,CACZ;SACA,GAAG,CAAC,GAAG,CAAC;CACZ,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IAC1B,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAC7D,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,EAAE,CAChD,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM;QACpC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;YAC3B,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,qCAAqC;SAC/C,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/validators/claude-setup-token-session.d.ts

@@ -0,0 +1,160 @@
+import { z } from "zod";
+export declare const setupTokenTransportAdvisorySchema: z.ZodObject<{
+    code: z.ZodLiteral<"insecure_transport">;
+}, z.core.$strict>;
+export type SetupTokenTransportAdvisory = z.infer<typeof setupTokenTransportAdvisorySchema>;
+export declare const claudeSetupTokenOverwriteSchema: z.ZodObject<{
+    expectedSecretId: z.ZodString;
+    expectedLatestVersion: z.ZodNumber;
+}, z.core.$strict>;
+export type ClaudeSetupTokenOverwrite = z.infer<typeof claudeSetupTokenOverwriteSchema>;
+export declare const startClaudeSetupTokenSessionRequestSchema: z.ZodObject<{
+    aiConnection: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodEnum<{
+            anthropic: "anthropic";
+            openai: "openai";
+            openrouter: "openrouter";
+            xai: "xai";
+        }>;
+        method: z.ZodLiteral<"subscription">;
+        name: z.ZodString;
+        ownership: z.ZodEnum<{
+            personal: "personal";
+            shared: "shared";
+        }>;
+        connectionId: z.ZodOptional<z.ZodString>;
+        agentIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        allAgents: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    environmentId: z.ZodString;
+    adapterType: z.ZodEnum<{
+        claude_local: "claude_local";
+        codex_local: "codex_local";
+        cursor: "cursor";
+        cursor_cloud: "cursor_cloud";
+        gemini_local: "gemini_local";
+        grok_local: "grok_local";
+        hermes_gateway: "hermes_gateway";
+        hermes_local: "hermes_local";
+        http: "http";
+        kimi_local: "kimi_local";
+        omp_local: "omp_local";
+        openclaw_gateway: "openclaw_gateway";
+        opencode_local: "opencode_local";
+        paperclip_runner: "paperclip_runner";
+        pi_local: "pi_local";
+        process: "process";
+    }>;
+    overwrite: z.ZodOptional<z.ZodObject<{
+        expectedSecretId: z.ZodString;
+        expectedLatestVersion: z.ZodNumber;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type StartClaudeSetupTokenSessionRequest = z.infer<typeof startClaudeSetupTokenSessionRequestSchema>;
+export declare const adapterAuthPanelModeSchema: z.ZodEnum<{
+    displayed_code: "displayed_code";
+    submitted_browser_code: "submitted_browser_code";
+}>;
+export type AdapterAuthPanelMode = z.infer<typeof adapterAuthPanelModeSchema>;
+export declare const claudeSetupTokenSessionResponseSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    environmentId: z.ZodString;
+    status: z.ZodEnum<{
+        authenticated: "authenticated";
+        cancelled: "cancelled";
+        failed: "failed";
+        starting: "starting";
+        timed_out: "timed_out";
+        waiting_for_user: "waiting_for_user";
+    }>;
+    expiresAt: z.ZodNullable<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>>;
+    failure: z.ZodNullable<z.ZodObject<{
+        reason: z.ZodString;
+        message: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    transportAdvisory: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        code: z.ZodLiteral<"insecure_transport">;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type ClaudeSetupTokenSessionResponse = z.infer<typeof claudeSetupTokenSessionResponseSchema>;
+export declare const claudeSetupTokenSessionPromptSchema: z.ZodObject<{
+    authorizationUrl: z.ZodString;
+    transportAdvisory: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        code: z.ZodLiteral<"insecure_transport">;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type ClaudeSetupTokenSessionPrompt = z.infer<typeof claudeSetupTokenSessionPromptSchema>;
+export declare const claudeSetupTokenSessionOwnerResponseSchema: z.ZodObject<{
+    sessionId: z.ZodString;
+    environmentId: z.ZodString;
+    status: z.ZodEnum<{
+        authenticated: "authenticated";
+        cancelled: "cancelled";
+        failed: "failed";
+        starting: "starting";
+        timed_out: "timed_out";
+        waiting_for_user: "waiting_for_user";
+    }>;
+    expiresAt: z.ZodNullable<z.ZodUnion<readonly [z.ZodDate, z.ZodString]>>;
+    failure: z.ZodNullable<z.ZodObject<{
+        reason: z.ZodString;
+        message: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    transportAdvisory: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        code: z.ZodLiteral<"insecure_transport">;
+    }, z.core.$strict>>>;
+    panelMode: z.ZodEnum<{
+        displayed_code: "displayed_code";
+        submitted_browser_code: "submitted_browser_code";
+    }>;
+    prompt: z.ZodNullable<z.ZodObject<{
+        authorizationUrl: z.ZodString;
+        transportAdvisory: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            code: z.ZodLiteral<"insecure_transport">;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    aiConnection: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodEnum<{
+            anthropic: "anthropic";
+            openai: "openai";
+            openrouter: "openrouter";
+            xai: "xai";
+        }>;
+        method: z.ZodLiteral<"subscription">;
+        name: z.ZodString;
+        ownership: z.ZodEnum<{
+            personal: "personal";
+            shared: "shared";
+        }>;
+        connectionId: z.ZodOptional<z.ZodString>;
+        agentIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        allAgents: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ClaudeSetupTokenSessionOwnerResponse = z.infer<typeof claudeSetupTokenSessionOwnerResponseSchema>;
+export declare const BROWSER_CODE_MAX_LENGTH = 512;
+export declare const BROWSER_CODE_DISALLOWED_CHAR: RegExp;
+/**
+ * Returns true when the browser code obeys the grammar. The code has one or more
+ * characters, no character outside the visible ASCII range, and a length at or
+ * below the bounded maximum.
+ */
+export declare function isValidBrowserCode(code: string): boolean;
+export declare const BROWSER_CODE_PATTERN: RegExp;
+export declare const browserCodeSchema: z.ZodString;
+export type BrowserCode = z.infer<typeof browserCodeSchema>;
+export declare const submitBrowserCodeRequestSchema: z.ZodObject<{
+    browserCode: z.ZodString;
+}, z.core.$strict>;
+export type SubmitBrowserCodeRequest = z.infer<typeof submitBrowserCodeRequestSchema>;
+export declare const storedSessionIdSchema: z.ZodString;
+export declare const claudeSetupTokenCompletionResponseSchema: z.ZodObject<{
+    storedSessionId: z.ZodString;
+}, z.core.$strict>;
+export type ClaudeSetupTokenCompletionResponse = z.infer<typeof claudeSetupTokenCompletionResponseSchema>;
+export declare const claudeOAuthTokenStatusResponseSchema: z.ZodObject<{
+    secretId: z.ZodString;
+    latestVersion: z.ZodNumber;
+}, z.core.$strict>;
+export type ClaudeOAuthTokenStatusResponse = z.infer<typeof claudeOAuthTokenStatusResponseSchema>;
+//# sourceMappingURL=claude-setup-token-session.d.ts.map

package/dist/validators/claude-setup-token-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-setup-token-session.d.ts","sourceRoot":"","sources":["../../src/validators/claude-setup-token-session.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,eAAO,MAAM,iCAAiC;;kBAEnC,CAAC;AACZ,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAQ5F,eAAO,MAAM,+BAA+B;;;kBAGjC,CAAC;AACZ,MAAM,MAAM,yBAAyB,GACnC,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAgBlD,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAK3C,CAAC;AACZ,MAAM,MAAM,mCAAmC,GAC7C,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAG5D,eAAO,MAAM,0BAA0B;;;EAAmC,CAAC;AAC3E,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAS9E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;kBAOvC,CAAC;AACZ,MAAM,MAAM,+BAA+B,GACzC,CAAC,CAAC,KAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;AAIxD,eAAO,MAAM,mCAAmC;;;;;kBAGrC,CAAC;AACZ,MAAM,MAAM,6BAA6B,GACvC,CAAC,CAAC,KAAK,CAAC,OAAO,mCAAmC,CAAC,CAAC;AAItD,eAAO,MAAM,0CAA0C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAK1C,CAAC;AACd,MAAM,MAAM,oCAAoC,GAC9C,CAAC,CAAC,KAAK,CAAC,OAAO,0CAA0C,CAAC,CAAC;AAI7D,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAO3C,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMxD;AAQD,eAAO,MAAM,oBAAoB,QAAoB,CAAC;AAMtD,eAAO,MAAM,iBAAiB,aAO1B,CAAC;AACL,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAG5D,eAAO,MAAM,8BAA8B;;kBAEhC,CAAC;AACZ,MAAM,MAAM,wBAAwB,GAClC,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAIjD,eAAO,MAAM,qBAAqB,aAA6B,CAAC;AAKhE,eAAO,MAAM,wCAAwC;;kBAE1C,CAAC;AACZ,MAAM,MAAM,kCAAkC,GAC5C,CAAC,CAAC,KAAK,CAAC,OAAO,wCAAwC,CAAC,CAAC;AAO3D,eAAO,MAAM,oCAAoC;;;kBAGtC,CAAC;AACZ,MAAM,MAAM,8BAA8B,GACxC,CAAC,CAAC,KAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC"}

package/dist/validators/claude-setup-token-session.js

@@ -0,0 +1,131 @@
+import { aiConnectionLoginIntentSchema } from "../ai-connections.js";
+import { z } from "zod";
+import { AGENT_ADAPTER_TYPES } from "../constants.js";
+import { ADAPTER_AUTH_PANEL_MODES, SETUP_TOKEN_TRANSPORT_ADVISORY_CODE } from "../types/agent.js";
+import { adapterAuthSessionFailureSchema, adapterAuthSessionStatusSchema, } from "./adapter-auth-session.js";
+const isoDateTime = z.union([z.date(), z.string().datetime()]);
+// The transport advisory schema. A guarded confidential response carries it when
+// the login rides a non-confidential transport. The client shows a disclaimer.
+export const setupTokenTransportAdvisorySchema = z.object({
+    code: z.literal(SETUP_TOKEN_TRANSPORT_ADVISORY_CODE),
+}).strict();
+// The confirmed-overwrite capture for a replacement login. The client reads the
+// stored value metadata from the status route and passes it back when it starts
+// a replacement login. The server maps it to the owner-bound compare-and-set: it
+// rotates the value only when the captured version still matches. The server
+// still derives the owner and the definition; this body carries no owner. A
+// missing capture starts a first-write login instead.
+export const claudeSetupTokenOverwriteSchema = z.object({
+    expectedSecretId: z.string().guid(),
+    expectedLatestVersion: z.number().int().min(1),
+}).strict();
+// The start request for a company-and-environment Claude login session. The
+// company and the owner user come from the authenticated caller, not from this
+// body. The body names the adapter and the environment of the login. It reuses
+// the adapter login-session request fields; every field has the same meaning.
+//
+// The optional `overwrite` capture turns the login into a confirmed replacement.
+// The client sends it only after a stored token fails the agent test. The server
+// rotates the stored value under the captured version, so a concurrent change
+// fails closed with a stale conflict.
+//
+// `.strict()` rejects an extra field, so an agent id never validates. The scope
+// carries no agent id: a hire flow with no agent still starts one session. The
+// runtime does not support a caller-supplied session length, so the schema
+// exposes no `ttlSeconds` field; a legacy `ttlSeconds` fails the strict parse.
+export const startClaudeSetupTokenSessionRequestSchema = z.object({
+    aiConnection: aiConnectionLoginIntentSchema.optional(),
+    environmentId: z.string().guid(),
+    adapterType: z.enum(AGENT_ADAPTER_TYPES),
+    overwrite: claudeSetupTokenOverwriteSchema.optional(),
+}).strict();
+// The panel-mode schema. It accepts only the two known panel modes.
+export const adapterAuthPanelModeSchema = z.enum(ADAPTER_AUTH_PANEL_MODES);
+// The session id is an opaque, cryptographically random string, not a UUID. So
+// the schema accepts a bounded opaque string, not a UUID.
+const sessionIdSchema = z.string().min(1).max(256);
+// The public Claude login-session response schema. `.strict()` rejects an extra
+// field, so a prompt, a token, an account identifier, or a provider lease
+// identifier never validates.
+export const claudeSetupTokenSessionResponseSchema = z.object({
+    sessionId: sessionIdSchema,
+    environmentId: z.string().guid(),
+    status: adapterAuthSessionStatusSchema,
+    expiresAt: isoDateTime.nullable(),
+    failure: adapterAuthSessionFailureSchema.nullable(),
+    transportAdvisory: setupTokenTransportAdvisorySchema.nullable().optional(),
+}).strict();
+// The one-time Claude login prompt schema. It carries the authorization URL the
+// user opens. It carries no server-displayed code.
+export const claudeSetupTokenSessionPromptSchema = z.object({
+    authorizationUrl: z.string().min(1),
+    transportAdvisory: setupTokenTransportAdvisorySchema.nullable().optional(),
+}).strict();
+// The owner read schema. It adds the panel mode and the one-time prompt to the
+// public response.
+export const claudeSetupTokenSessionOwnerResponseSchema = claudeSetupTokenSessionResponseSchema.extend({
+    panelMode: adapterAuthPanelModeSchema,
+    prompt: claudeSetupTokenSessionPromptSchema.nullable(),
+    aiConnection: aiConnectionLoginIntentSchema.optional(),
+}).strict();
+// The bounded maximum length of a browser code. The provider code is short. The
+// server rejects an oversized code before it reaches the live login process.
+export const BROWSER_CODE_MAX_LENGTH = 512;
+// The conservative printable grammar for the submitted browser code. It matches
+// one character outside the visible ASCII range (0x21-0x7E). The validator
+// rejects a code that contains a match, so it rejects a space, a carriage
+// return, a line feed, a NUL, and every other control byte. A later
+// characterization test narrows this set to the exact provider format.
+export const BROWSER_CODE_DISALLOWED_CHAR = /[^\x21-\x7E]/;
+/**
+ * Returns true when the browser code obeys the grammar. The code has one or more
+ * characters, no character outside the visible ASCII range, and a length at or
+ * below the bounded maximum.
+ */
+export function isValidBrowserCode(code) {
+    return (code.length >= 1 &&
+        code.length <= BROWSER_CODE_MAX_LENGTH &&
+        !BROWSER_CODE_DISALLOWED_CHAR.test(code));
+}
+// The printable-ASCII allowlist pattern for the published contract. It is an
+// anchored allowlist of the visible ASCII range (0x21-0x7E). The converter reads
+// this `.regex()` from the inner `ZodString` and emits it as the OpenAPI
+// `pattern`. It is NOT the authoritative guard: JavaScript `$` matches before a
+// final line feed, so this pattern accepts a trailing newline. The `.refine()`
+// below is the authoritative guard that rejects a trailing newline.
+export const BROWSER_CODE_PATTERN = /^[\x21-\x7E]+$/u;
+// The browser-code grammar schema. It rejects an empty code, an oversized code,
+// and a code with a control byte or any other non-printable character. The
+// `.regex()` runs before the `.refine()` so the converter serializes its
+// `pattern`; the `.refine()` stays the authoritative guard.
+export const browserCodeSchema = z
+    .string()
+    .min(1, "A browser code is required.")
+    .max(BROWSER_CODE_MAX_LENGTH, "The browser code is too long.")
+    .regex(BROWSER_CODE_PATTERN, "The browser code has an invalid character.")
+    .refine((code) => !BROWSER_CODE_DISALLOWED_CHAR.test(code), {
+    message: "The browser code has an invalid character.",
+});
+// The submit-browser-code request schema. `.strict()` rejects an extra field.
+export const submitBrowserCodeRequestSchema = z.object({
+    browserCode: browserCodeSchema,
+}).strict();
+// The stored-session claim schema. The `storedSessionId` is the opaque durable
+// session id. It is a non-secret claim; it carries no token.
+export const storedSessionIdSchema = z.string().min(1).max(256);
+// The completion response schema. It carries the non-secret `storedSessionId`
+// claim and no token. `.strict()` rejects an extra field, so a token never
+// validates.
+export const claudeSetupTokenCompletionResponseSchema = z.object({
+    storedSessionId: storedSessionIdSchema,
+}).strict();
+// The stored Claude OAuth token status response schema. It carries only the
+// secret id and the latest version of the owner value; it carries no token.
+// `.strict()` rejects an extra field, so a token never validates. The status
+// route returns a fixed 404 for a missing or a foreign value, so a 200 body
+// always describes a present owner value.
+export const claudeOAuthTokenStatusResponseSchema = z.object({
+    secretId: z.string().guid(),
+    latestVersion: z.number().int().min(1),
+}).strict();
+//# sourceMappingURL=claude-setup-token-session.js.map

package/dist/validators/claude-setup-token-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-setup-token-session.js","sourceRoot":"","sources":["../../src/validators/claude-setup-token-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,mCAAmC,EAAE,MAAM,mBAAmB,CAAC;AAClG,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAE/D,iFAAiF;AACjF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC;CACrD,CAAC,CAAC,MAAM,EAAE,CAAC;AAGZ,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,6EAA6E;AAC7E,4EAA4E;AAC5E,sDAAsD;AACtD,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IACnC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/C,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,8EAA8E;AAC9E,sCAAsC;AACtC,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChE,YAAY,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IACtD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACxC,SAAS,EAAE,+BAA+B,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,oEAAoE;AACpE,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AAG3E,+EAA+E;AAC/E,0DAA0D;AAC1D,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEnD,gFAAgF;AAChF,0EAA0E;AAC1E,8BAA8B;AAC9B,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5D,SAAS,EAAE,eAAe;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAChC,MAAM,EAAE,8BAA8B;IACtC,SAAS,EAAE,WAAW,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,+BAA+B,CAAC,QAAQ,EAAE;IACnD,iBAAiB,EAAE,iCAAiC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,gFAAgF;AAChF,mDAAmD;AACnD,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,iBAAiB,EAAE,iCAAiC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,+EAA+E;AAC/E,mBAAmB;AACnB,MAAM,CAAC,MAAM,0CAA0C,GACrD,qCAAqC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,0BAA0B;IACrC,MAAM,EAAE,mCAAmC,CAAC,QAAQ,EAAE;IACtD,YAAY,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAC,MAAM,EAAE,CAAC;AAId,gFAAgF;AAChF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C,gFAAgF;AAChF,2EAA2E;AAC3E,0EAA0E;AAC1E,oEAAoE;AACpE,uEAAuE;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,cAAc,CAAC;AAE3D;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,CACL,IAAI,CAAC,MAAM,IAAI,CAAC;QAChB,IAAI,CAAC,MAAM,IAAI,uBAAuB;QACtC,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,iFAAiF;AACjF,yEAAyE;AACzE,gFAAgF;AAChF,+EAA+E;AAC/E,oEAAoE;AACpE,MAAM,CAAC,MAAM,oBAAoB,GAAG,iBAAiB,CAAC;AAEtD,gFAAgF;AAChF,2EAA2E;AAC3E,yEAAyE;AACzE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,EAAE,6BAA6B,CAAC;KACrC,GAAG,CAAC,uBAAuB,EAAE,+BAA+B,CAAC;KAC7D,KAAK,CAAC,oBAAoB,EAAE,4CAA4C,CAAC;KACzE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;IAC1D,OAAO,EAAE,4CAA4C;CACtD,CAAC,CAAC;AAGL,8EAA8E;AAC9E,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,WAAW,EAAE,iBAAiB;CAC/B,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,+EAA+E;AAC/E,6DAA6D;AAC7D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEhE,8EAA8E;AAC9E,2EAA2E;AAC3E,aAAa;AACb,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/D,eAAe,EAAE,qBAAqB;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC;AAIZ,4EAA4E;AAC5E,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,0CAA0C;AAC1C,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvC,CAAC,CAAC,MAAM,EAAE,CAAC"}

package/dist/validators/claude-setup-token-session.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=claude-setup-token-session.test.d.ts.map

package/dist/validators/claude-setup-token-session.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-setup-token-session.test.d.ts","sourceRoot":"","sources":["../../src/validators/claude-setup-token-session.test.ts"],"names":[],"mappings":""}

package/dist/validators/claude-setup-token-session.test.js

@@ -0,0 +1,107 @@
+import { describe, expect, it } from "vitest";
+import { BROWSER_CODE_MAX_LENGTH, browserCodeSchema, claudeSetupTokenCompletionResponseSchema, claudeSetupTokenSessionOwnerResponseSchema, isValidBrowserCode, startClaudeSetupTokenSessionRequestSchema, submitBrowserCodeRequestSchema, } from "./claude-setup-token-session.js";
+import { createAgentSchema, createAgentHireSchema } from "./agent.js";
+const ENVIRONMENT_ID = "11111111-1111-4111-8111-111111111111";
+describe("claude setup-token session start request", () => {
+    it("accepts a company-and-environment request with no agent id", () => {
+        const parsed = startClaudeSetupTokenSessionRequestSchema.parse({
+            environmentId: ENVIRONMENT_ID,
+            adapterType: "claude_local",
+        });
+        expect(parsed.environmentId).toBe(ENVIRONMENT_ID);
+        expect(parsed.adapterType).toBe("claude_local");
+    });
+    it("rejects a legacy ttlSeconds: the runtime does not support it", () => {
+        const result = startClaudeSetupTokenSessionRequestSchema.safeParse({
+            environmentId: ENVIRONMENT_ID,
+            adapterType: "claude_local",
+            ttlSeconds: 300,
+        });
+        expect(result.success).toBe(false);
+    });
+    it("rejects an agent id: the scope carries no agent id", () => {
+        const result = startClaudeSetupTokenSessionRequestSchema.safeParse({
+            environmentId: ENVIRONMENT_ID,
+            adapterType: "claude_local",
+            agentId: "22222222-2222-4222-8222-222222222222",
+        });
+        expect(result.success).toBe(false);
+    });
+});
+describe("browser-code grammar", () => {
+    it("accepts a conservative printable code", () => {
+        const code = "ac_012-AZ_az.9#state";
+        expect(browserCodeSchema.parse(code)).toBe(code);
+        expect(isValidBrowserCode(code)).toBe(true);
+    });
+    it("rejects a carriage return, a line feed, a NUL, and a control byte", () => {
+        for (const bad of ["ab\rcd", "ab\ncd", "ab\u0000cd", "ab\u0001cd", "ab\u007fcd", "ab cd", "ab\tcd"]) {
+            expect(browserCodeSchema.safeParse(bad).success).toBe(false);
+            expect(isValidBrowserCode(bad)).toBe(false);
+        }
+    });
+    it("rejects a trailing newline that an anchored regex would let pass", () => {
+        // The runtime `.refine()` is the authoritative guard. JavaScript `$`
+        // matches before a final line feed, so an anchored printable-ASCII regex
+        // accepts a trailing newline. The `.refine()` closes that trap.
+        expect(browserCodeSchema.safeParse("abc\n").success).toBe(false);
+        expect(isValidBrowserCode("abc\n")).toBe(false);
+    });
+    it("rejects a single control byte and accepts a printable code", () => {
+        expect(browserCodeSchema.safeParse("abc").success).toBe(true);
+        expect(browserCodeSchema.safeParse("valid-code_123").success).toBe(true);
+    });
+    it("rejects an empty code", () => {
+        expect(browserCodeSchema.safeParse("").success).toBe(false);
+        expect(isValidBrowserCode("")).toBe(false);
+    });
+    it("rejects an oversized code", () => {
+        const oversized = "a".repeat(BROWSER_CODE_MAX_LENGTH + 1);
+        expect(browserCodeSchema.safeParse(oversized).success).toBe(false);
+        expect(isValidBrowserCode(oversized)).toBe(false);
+        const atLimit = "a".repeat(BROWSER_CODE_MAX_LENGTH);
+        expect(browserCodeSchema.parse(atLimit)).toBe(atLimit);
+    });
+    it("wraps the grammar in the submit-browser-code request and rejects an extra field", () => {
+        expect(submitBrowserCodeRequestSchema.parse({ browserCode: "abc123" }).browserCode).toBe("abc123");
+        expect(submitBrowserCodeRequestSchema.safeParse({ browserCode: "a\nb" }).success).toBe(false);
+        expect(submitBrowserCodeRequestSchema.safeParse({ browserCode: "abc", extra: 1 }).success).toBe(false);
+    });
+});
+describe("claude setup-token owner response and completion response", () => {
+    it("accepts an owner response with the submitted-browser-code panel mode and a prompt", () => {
+        const parsed = claudeSetupTokenSessionOwnerResponseSchema.parse({
+            sessionId: "opaque-base64url-session-id",
+            environmentId: ENVIRONMENT_ID,
+            status: "waiting_for_user",
+            expiresAt: null,
+            failure: null,
+            panelMode: "submitted_browser_code",
+            prompt: { authorizationUrl: "https://example.test/authorize" },
+        });
+        expect(parsed.panelMode).toBe("submitted_browser_code");
+        expect(parsed.prompt?.authorizationUrl).toBe("https://example.test/authorize");
+    });
+    it("rejects a token on the completion response: the claim carries no token", () => {
+        expect(claudeSetupTokenCompletionResponseSchema.parse({ storedSessionId: "session-claim" })
+            .storedSessionId).toBe("session-claim");
+        const withToken = claudeSetupTokenCompletionResponseSchema.safeParse({
+            storedSessionId: "session-claim",
+            token: "secret",
+        });
+        expect(withToken.success).toBe(false);
+    });
+});
+describe("agent create and hire carry an optional stored-session claim", () => {
+    const base = { name: "Claude Agent", adapterType: "claude_local" };
+    it("accepts a create request without a stored-session claim", () => {
+        expect(createAgentSchema.parse({ ...base }).storedSessionId).toBeUndefined();
+    });
+    it("accepts a create request with a stored-session claim", () => {
+        expect(createAgentSchema.parse({ ...base, storedSessionId: "session-claim" }).storedSessionId).toBe("session-claim");
+    });
+    it("accepts a hire request with a stored-session claim", () => {
+        expect(createAgentHireSchema.parse({ ...base, storedSessionId: "session-claim" }).storedSessionId).toBe("session-claim");
+    });
+});
+//# sourceMappingURL=claude-setup-token-session.test.js.map

package/dist/validators/claude-setup-token-session.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-setup-token-session.test.js","sourceRoot":"","sources":["../../src/validators/claude-setup-token-session.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,wCAAwC,EACxC,0CAA0C,EAC1C,kBAAkB,EAClB,yCAAyC,EACzC,8BAA8B,GAC/B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,cAAc,GAAG,sCAAsC,CAAC;AAE9D,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,MAAM,GAAG,yCAAyC,CAAC,KAAK,CAAC;YAC7D,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,MAAM,GAAG,yCAAyC,CAAC,SAAS,CAAC;YACjE,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,cAAc;YAC3B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,MAAM,GAAG,yCAAyC,CAAC,SAAS,CAAC;YACjE,aAAa,EAAE,cAAc;YAC7B,WAAW,EAAE,cAAc;YAC3B,OAAO,EAAE,sCAAsC;SAChD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,IAAI,GAAG,sBAAsB,CAAC;QACpC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,KAAK,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpG,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,uBAAuB,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnE,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACpD,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,CAAC,8BAA8B,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CACtF,QAAQ,CACT,CAAC;QACF,MAAM,CAAC,8BAA8B,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9F,MAAM,CACJ,8BAA8B,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CACnF,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACzE,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,MAAM,GAAG,0CAA0C,CAAC,KAAK,CAAC;YAC9D,SAAS,EAAE,6BAA6B;YACxC,aAAa,EAAE,cAAc;YAC7B,MAAM,EAAE,kBAAkB;YAC1B,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,wBAAwB;YACnC,MAAM,EAAE,EAAE,gBAAgB,EAAE,gCAAgC,EAAE;SAC/D,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,CACJ,wCAAwC,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;aACjF,eAAe,CACnB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACxB,MAAM,SAAS,GAAG,wCAAwC,CAAC,SAAS,CAAC;YACnE,eAAe,EAAE,eAAe;YAChC,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8DAA8D,EAAE,GAAG,EAAE;IAC5E,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,cAAuB,EAAE,CAAC;IAE5E,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,aAAa,EAAE,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CACJ,iBAAiB,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,CACvF,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,CACJ,qBAAqB,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe,CAC3F,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}