fix(sdk): enforce canonical credential grammar

[purpshell]

Summary

• validate organization keys as exactly pmfa_ plus 72 unpadded base64url characters
• validate project tokens as exactly pmfa_pt_ plus 94 unpadded base64url characters
• reject listener, browser, call-agent, socket-ticket, and simulated-device credentials before transport
• update SDK documentation and all server-client fixtures to use canonical synthetic v1 credentials

Verification

• formatting, ESLint, strict TypeScript, all workspace builds, and core build pass
• 66 test files / 404 tests pass, including zero-fetch malformed and special credential cases and clean packed consumers
• strict coverage: 402 operations, 274 covered, 128 excluded, zero missing, partial, or changed
• package dry-run: 256 files, 119,365 bytes packed, 679,563 bytes unpacked
• production audit: 0 vulnerabilities

Video

Not applicable: this is a credential-validation hardening fix and introduces no user-facing feature workflow.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T11:26:48.931534Z	0bf6fd7	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

Warning

Some tools did not complete. Review the errors below.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

packages/typescript/test/platform.test.ts

ESLint failed to execute (timeout).

packages/typescript/test/presence.test.ts

ESLint skipped: the matched ESLint configuration already failed (timeout).

packages/typescript/test/privacy.test.ts

ESLint skipped: the matched ESLint configuration already failed (timeout).

• 5 others

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cc391e6d0d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[purpshell]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 0bf6fd74e7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".