@claudexor/core 3.6.0 → 3.8.1

package/dist/adapter.d.ts

@@ -1,4 +1,4 @@
-import type { AccountIdentity, AuthPreference, AuthSourceKind, ConformanceReport, CredentialProfile, CredentialProfileStatus, HarnessEvent, HarnessManifest, HarnessModel, HarnessRunSpec, InteractionAnswerSet, InteractionRequest } from "@claudexor/schema";
+import type { AccountIdentity, AuthPreference, AuthSourceKind, ConformanceReport, CredentialProfile, CredentialProfileStatus, HarnessCapabilityProfile, HarnessEvent, HarnessManifest, HarnessModel, HarnessRunSpec, InteractionAnswerSet, InteractionRequest } from "@claudexor/schema";
 /** Accounts-only doctor receipt. Identity never widens generic HarnessStatus. */
 export interface HarnessAccountDoctorReceipt {
     report: ConformanceReport;
@@ -22,6 +22,12 @@ export interface DoctorSpec {
     /** Cancels active vendor probes. This runtime-only value is never part of a cache key. */
     abortSignal?: AbortSignal;
 }
+/** Model-inventory query bound to the credential identity that would run.
+ * Kept separate from DoctorSpec so profile identity never enters the shared
+ * doctor cache contract. */
+export interface HarnessModelSpec extends DoctorSpec {
+    credentialProfile?: CredentialProfile | null;
+}
 /**
  * The contract every harness adapter implements. Adapters translate a native
  * harness's I/O into typed Claudexor events — they never contain orchestration
@@ -29,6 +35,14 @@ export interface DoctorSpec {
  */
 export interface HarnessAdapter {
     readonly id: string;
+    /**
+     * Static capability declaration available without spawning the vendor CLI.
+     * Policy/admission consumers use this exact object before any live probe;
+     * discover() may only overlay runtime facts such as the preferred auth
+     * source. Keeping the declaration on the adapter prevents a profile-policy
+     * conflict from spending a vendor call merely to learn that it must refuse.
+     */
+    readonly capabilityProfile?: HarnessCapabilityProfile;
     /** Detect installation/version/auth and declare capabilities. */
     discover(): Promise<HarnessManifest>;
     /** Probe capabilities and report which intents this adapter may play. */
@@ -49,7 +63,7 @@ export interface HarnessAdapter {
      * native-CLI adapters that cannot enumerate simply omit it. Must fail soft
      * (return [] on network/auth error) — never throw into a picker/consumer.
      */
-    models?(spec?: DoctorSpec): Promise<HarnessModel[]>;
+    models?(spec?: HarnessModelSpec): Promise<HarnessModel[]>;
     /** Optional cancellation. */
     cancel?(sessionId: string): Promise<void>;
     /**

package/dist/adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAE3B,iFAAiF;AACjF,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;CAClC;AAED,4EAA4E;AAC5E,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,uBAAuB,CAAC;IAChC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD,uFAAuF;IACvF,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,4GAA4G;IAC5G,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,0FAA0F;IAC1F,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,iEAAiE;IACjE,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErC,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAErD;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAE3E,+CAA+C;IAC/C,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAEvD,2EAA2E;IAC3E,MAAM,CAAC,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAE3D;;;;;OAKG;IACH,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAEpD,6BAA6B;IAC7B,MAAM,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1C;;;;;OAKG;IACH,sBAAsB,CAAC,CACrB,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEpC;;;OAGG;IACH,sBAAsB,CAAC,CACrB,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,6BAA6B,CAAC,CAAC;CAC3C;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACvE;kFAC8E;IAC9E,YAAY,CAAC,IAAI,MAAM,CAAC;IACxB;gFAC4E;IAC5E,iBAAiB,CAAC,IAAI,MAAM,CAAC;CAC9B;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,cAAc,GAAG,kBAAkB,GAAG,SAAS,CAK/F"}
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,cAAc,EACd,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAE3B,iFAAiF;AACjF,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,iBAAiB,CAAC;IAC1B,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;CAClC;AAED,4EAA4E;AAC5E,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,uBAAuB,CAAC;IAChC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD,uFAAuF;IACvF,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,4GAA4G;IAC5G,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,uFAAuF;IACvF,UAAU,CAAC,EAAE,cAAc,CAAC;IAC5B,0FAA0F;IAC1F,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED;;4BAE4B;AAC5B,MAAM,WAAW,gBAAiB,SAAQ,UAAU;IAClD,iBAAiB,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IAEtD,iEAAiE;IACjE,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErC,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAErD;;;;OAIG;IACH,iBAAiB,CAAC,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAE3E,+CAA+C;IAC/C,GAAG,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAEvD,2EAA2E;IAC3E,MAAM,CAAC,CAAC,IAAI,EAAE,cAAc,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAE3D;;;;;OAKG;IACH,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAE1D,6BAA6B;IAC7B,MAAM,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1C;;;;;OAKG;IACH,sBAAsB,CAAC,CACrB,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEpC;;;OAGG;IACH,sBAAsB,CAAC,CACrB,OAAO,EAAE,iBAAiB,EAC1B,WAAW,CAAC,EAAE,WAAW,GACxB,OAAO,CAAC,6BAA6B,CAAC,CAAC;CAC3C;AAED,4DAA4D;AAC5D,MAAM,MAAM,eAAe,GAAG,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;IACvE;kFAC8E;IAC9E,YAAY,CAAC,IAAI,MAAM,CAAC;IACxB;gFAC4E;IAC5E,iBAAiB,CAAC,IAAI,MAAM,CAAC;CAC9B;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,cAAc,GAAG,kBAAkB,GAAG,SAAS,CAK/F"}

package/dist/adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AA8HA,MAAM,UAAU,0BAA0B,CAAC,IAAoB;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,oBAAoB,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,SAAS,GAAG,OAAsC,CAAC;IACzD,OAAO,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAE,OAA8B,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/F,CAAC"}
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AA+IA,MAAM,UAAU,0BAA0B,CAAC,IAAoB;IAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,oBAAoB,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,SAAS,GAAG,OAAsC,CAAC;IACzD,OAAO,OAAO,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAE,OAA8B,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/F,CAAC"}

package/dist/auth-capability-verifier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-capability-verifier.d.ts","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAgBA,OAAO,EAML,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,WAAW,EAChB,KAAK,mBAAmB,IAAI,uBAAuB,EACnD,KAAK,cAAc,EACnB,KAAK,eAAe,EAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAMpE,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,WAAW,CAAC;IACvB,aAAa,EAAE,eAAe,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,yBAAyB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,qBAAa,sBAAsB;IAM/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YACmB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,cAAc,GAAG,SAAS,EACpE,IAAI,GAAE,0BAA+B,EAOtC;IAED,MAAM,CAAC,YAAY,CACjB,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,0BAA+B,GACpC,sBAAsB,CAExB;IAED,UAAU,CACR,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,WAAW,EACtB,aAAa,EAAE,eAAe,EAC9B,cAAc,EAAE,cAAc,GAC7B,uBAAuB,CAczB;IAED,OAAO,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CAiB5E;IAEK,MAAM,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA6P3F;IAED,gFAAgF;IAChF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAgB/B;IAED,OAAO,CAAC,aAAa;CAYtB"}
+{"version":3,"file":"auth-capability-verifier.d.ts","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAgBA,OAAO,EAML,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,qBAAqB,IAAI,yBAAyB,EACvD,KAAK,WAAW,EAChB,KAAK,mBAAmB,IAAI,uBAAuB,EACnD,KAAK,cAAc,EACnB,KAAK,eAAe,EAErB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAMpE,MAAM,WAAW,gCAAgC;IAC/C,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,WAAW,CAAC;IACvB,aAAa,EAAE,eAAe,CAAC;IAC/B,cAAc,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,yBAAyB,CAAC;CACpC;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,yBAAyB,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,qBAAa,sBAAsB;IAM/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YACmB,OAAO,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,cAAc,GAAG,SAAS,EACpE,IAAI,GAAE,0BAA+B,EAOtC;IAED,MAAM,CAAC,YAAY,CACjB,QAAQ,EAAE,eAAe,EACzB,IAAI,GAAE,0BAA+B,GACpC,sBAAsB,CAExB;IAED,UAAU,CACR,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,WAAW,EACtB,aAAa,EAAE,eAAe,EAC9B,cAAc,EAAE,cAAc,GAC7B,uBAAuB,CAczB;IAED,OAAO,CAAC,OAAO,EAAE,gCAAgC,GAAG,yBAAyB,CAiB5E;IAEK,MAAM,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA4P3F;IAED,gFAAgF;IAChF,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAgB/B;IAED,OAAO,CAAC,aAAa;CAYtB"}

package/dist/auth-capability-verifier.js

@@ -134,7 +134,6 @@ export class AuthCapabilityVerifier {
                     browser: null,
                     // The auth smoke is not a delegated run and gets no boundary; stated
                     // rather than defaulted, so a new spec site cannot omit it silently.
-                    confinement: null,
                     extra_mcp_servers: [],
                     stream_deltas: false,
                     extra: request.abortSignal ? { abortSignal: request.abortSignal } : {},

package/dist/auth-capability-verifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-capability-verifier.js","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,cAAc,IAAI,oBAAoB,GAQvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AA0BrC;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IAMd,OAAO;IALT,GAAG,CAAa;IAChB,SAAS,CAAe;IACxB,WAAW,CAAS;IAErC,YACmB,OAAmD,EACpE,IAAI,GAA+B,EAAE;uBADpB,OAAO;QAGxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,UAAU,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,GAAG,OAAO,CACxB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,QAAyB,EACzB,IAAI,GAA+B,EAAE;QAErC,OAAO,IAAI,sBAAsB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,UAAU,CACR,OAAe,EACf,SAAsB,EACtB,aAA8B,EAC9B,cAA8B;QAE9B,OAAO,mBAAmB,CAAC,KAAK,CAAC;YAC/B,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,OAAO;YACP,SAAS;YACT,aAAa;YACb,cAAc;YACd,YAAY,EAAE,uBAAuB;YACrC,gBAAgB,EAAE,SAAS;YAC3B,wBAAwB,EAAE,SAAS;YACnC,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,OAAyC;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAChC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,cAAc,CACvB,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,OAAO;YACL,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC;gBACnC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe;gBACf,aAAa,EAAE,uBAAuB,CAAC,UAAU,EAAE,eAAe,CAAC;gBACnE,UAAU;aACX,CAAC;SACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA0C;QACrD,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ,CAAC;YAC5C,OAAO,CAAC,aAAa,KAAK,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxC,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,SAAS,GAA2B,IAAI,CAAC;QAC7C,IAAI,eAAe,GAA0B,IAAI,CAAC;QAClD,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,qBAAqB,GAAG,CAAC,CAAC;QAC9B,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,IAAI,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;QACtD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,eAAe,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACtD,IAAI,mBAAmB,GAAG,eAAe,CAAC;QAC1C,IAAI,kBAAkB,GAAG,eAAe,CAAC;QACzC,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,OAAmC,CAAC;QAExC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa,GAAG,IAAI,CAAC;gBACrB,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa;gBAAE,cAAc,GAAG,IAAI,CAAC;YACtD,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACjD,uBAAuB,GAAG,IAAI,CAAC;gBAC/B,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,uBAAuB,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5F,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACpD,mBAAmB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC;oBACtC,UAAU,EAAE,cAAc,OAAO,CAAC,SAAS,EAAE;oBAC7C,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,kBAAkB,QAAQ,wCAAwC;oBAC1E,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,UAAU;oBAClB,uBAAuB,EAAE,KAAK;oBAC9B,sBAAsB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC3D,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,IAAI;oBACjB,SAAS,EAAE,CAAC;oBACZ,eAAe,EAAE,UAAU,CAAC,SAAS;oBACrC,qEAAqE;oBACrE,gEAAgE;oBAChE,kBAAkB,EAAE,IAAI;oBACxB,iBAAiB,EAAE,IAAI;oBACvB,eAAe,EAAE,OAAO;oBACxB,eAAe,EAAE,aAAa;oBAC9B,GAAG,EAAE,EAAE;oBACP,WAAW,EAAE,EAAE;oBACf,OAAO,EAAE,IAAI;oBACb,qEAAqE;oBACrE,qEAAqE;oBACrE,WAAW,EAAE,IAAI;oBACjB,iBAAiB,EAAE,EAAE;oBACrB,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;iBAC9C,CAAC,CAAC;gBAC5B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACtC,UAAU,CAAC,MAAM,CACf,IAAI,CAAC,SAAS,CAAC;wBACb,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,KAAK,CAAC,UAAU;wBACzB,KAAK,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;wBACrC,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;wBACvC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK;wBAC/B,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;qBACjE,CAAC,CACH,CAAC;oBACF,IAAI,YAAY;wBAAE,oBAAoB,IAAI,CAAC,CAAC;oBAC5C,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;wBACzC,qBAAqB,IAAI,CAAC,CAAC;wBAC3B,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;wBACvC,SAAS;oBACX,CAAC;oBACD,IAAI,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;wBAAE,iBAAiB,GAAG,IAAI,CAAC;oBAC9E,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;wBACnB,KAAK,SAAS;4BACZ,aAAa,IAAI,CAAC,CAAC;4BACnB,IAAI,aAAa,KAAK,CAAC,IAAI,YAAY;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BAClE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;4BAC9B,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gCAC3B,IAAI,SAAS,IAAI,SAAS,KAAK,KAAK,CAAC,gBAAgB;oCAAE,aAAa,GAAG,IAAI,CAAC;gCAC5E,SAAS,KAAK,KAAK,CAAC,gBAAgB,CAAC;gCACrC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;4BAC7D,CAAC;4BACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gCAC5B,IAAI,eAAe,IAAI,eAAe,KAAK,KAAK,CAAC,iBAAiB;oCAChE,cAAc,GAAG,IAAI,CAAC;gCACxB,eAAe,KAAK,KAAK,CAAC,iBAAiB,CAAC;gCAC5C,QAAQ,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;4BAC/D,CAAC;4BACD,MAAM;wBACR,KAAK,SAAS,EAAE,CAAC;4BACf,+DAA+D;4BAC/D,8DAA8D;4BAC9D,gDAAgD;4BAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;4BAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gCACzB,IAAI,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;oCACtD,kBAAkB,GAAG,IAAI,CAAC;oCAC1B,MAAM;gCACR,CAAC;gCACD,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC;4BAChC,CAAC;4BACD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;4BACtB,MAAM;wBACR,CAAC;wBACD,KAAK,OAAO;4BACV,WAAW,IAAI,CAAC,CAAC;4BACjB,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;4BAC5B,MAAM;wBACR,KAAK,uBAAuB;4BAC1B,iBAAiB,IAAI,CAAC,CAAC;4BACvB,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;4BAC7C,MAAM;wBACR,KAAK,WAAW,CAAC;wBACjB,KAAK,aAAa,CAAC;wBACnB,KAAK,aAAa;4BAChB,oBAAoB,IAAI,CAAC,CAAC;4BAC1B,QAAQ,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;4BAC/C,MAAM;wBACR,KAAK,WAAW;4BACd,eAAe,IAAI,CAAC,CAAC;4BACrB,YAAY,GAAG,IAAI,CAAC;4BACpB,IAAI,eAAe,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BACrE,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;4BACrC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;4BAChC,MAAM;wBACR;4BACE,MAAM;oBACV,CAAC;gBACH,CAAC;gBACD,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;gBACpD,aAAa,GAAG,CAAC,SAAS,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YAClE,CAAC;oBAAS,CAAC;gBACT,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACH,kBAAkB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;oBACpD,CAAC;oBAAC,MAAM,CAAC;wBACP,kBAAkB,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,kBAAkB,CAAC;QAClE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,QAAQ,CAAC,GAAG,CAAC,mBAAmB,cAAc,EAAE,CAAC,CAAC;QAClD,QAAQ,CAAC,GAAG,CAAC,iBAAiB,YAAY,EAAE,CAAC,CAAC;QAC9C,IAAI,eAA6D,CAAC;QAClE,IAAI,eAAe;YAAE,eAAe,GAAG,kBAAkB,CAAC;aACrD,IAAI,uBAAuB;YAAE,eAAe,GAAG,2BAA2B,CAAC;aAC3E,IAAI,cAAc;YAAE,eAAe,GAAG,qBAAqB,CAAC;aAC5D,IAAI,SAAS;YAAE,eAAe,GAAG,WAAW,CAAC;aAC7C,IAAI,aAAa;YAAE,eAAe,GAAG,eAAe,CAAC;aACrD,IAAI,aAAa,KAAK,CAAC,IAAI,SAAS,KAAK,IAAI;YAAE,eAAe,GAAG,eAAe,CAAC;aACjF,IAAI,aAAa,IAAI,SAAS,KAAK,UAAU,CAAC,aAAa;YAC9D,eAAe,GAAG,gBAAgB,CAAC;aAChC,IAAI,eAAe,KAAK,IAAI;YAAE,eAAe,GAAG,gBAAgB,CAAC;aACjE,IAAI,cAAc,IAAI,eAAe,KAAK,UAAU,CAAC,cAAc;YACtE,eAAe,GAAG,iBAAiB,CAAC;aACjC,IACH,iBAAiB;YACjB,aAAa,KAAK,CAAC;YACnB,eAAe,GAAG,CAAC;YACnB,oBAAoB,GAAG,CAAC;YAExB,eAAe,GAAG,oBAAoB,CAAC;aACpC,IACH,WAAW,GAAG,CAAC;YACf,oBAAoB,GAAG,CAAC;YACxB,iBAAiB,GAAG,CAAC;YACrB,qBAAqB,GAAG,CAAC;YAEzB,eAAe,GAAG,eAAe,CAAC;aAC/B,IAAI,eAAe,KAAK,CAAC;YAAE,eAAe,GAAG,oBAAoB,CAAC;aAClE,IAAI,mBAAmB,KAAK,kBAAkB;YAAE,eAAe,GAAG,iBAAiB,CAAC;aACpF,IAAI,gBAAgB,IAAI,QAAQ,KAAK,QAAQ;YAAE,eAAe,GAAG,mBAAmB,CAAC;;YACrF,eAAe,GAAG,uBAAuB,CAAC;QAE/C,MAAM,MAAM,GAAG,eAAe,KAAK,uBAAuB,CAAC;QAC3D,OAAO,qBAAqB,CAAC,KAAK,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,SAAS;YACT,eAAe;YACf,eAAe;YACf,YAAY,EACV,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACzF,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC1C,gBAAgB,EAAE,SAAS;YAC3B,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACrC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc;YACd,YAAY;YACZ,mBAAmB;YACnB,kBAAkB;YAClB,MAAM,EAAE;gBACN,aAAa;gBACb,eAAe;gBACf,WAAW;gBACX,oBAAoB;gBACpB,iBAAiB;gBACjB,qBAAqB;gBACrB,oBAAoB;gBACpB,OAAO,EAAE,SAAS;aACnB;YACD,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,OAAO,CAAC,SAAiB;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IACE,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;YAC3B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAC5B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,aAAa,CAAC,SAAiB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChF,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,OAAO,gCAAgC,MAAM,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAAmC,EACnC,eAAuB;IAEvB,OAAO,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,2BAA2B;QACtC,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,UAAU;QAClB,qBAAqB,EAAE,KAAK;QAC5B,QAAQ,EAAE,CAAC;QACX,cAAc,EAAE,OAAO;QACvB,cAAc,EAAE,aAAa;QAC7B,eAAe;KAChB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACvC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE;gBAC7B,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACb,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE;wBACrB,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,OAAO,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7E,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC9B,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;iBAC3D,IAAI,IAAI,CAAC,MAAM,EAAE;gBAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAmC;IACjE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;YACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}
+{"version":3,"file":"auth-capability-verifier.js","sourceRoot":"","sources":["../src/auth-capability-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,SAAS,EACT,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,MAAM,EACN,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,cAAc,IAAI,oBAAoB,GAQvC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,UAAU,GAAG,iBAAiB,CAAC;AA0BrC;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IAMd,OAAO;IALT,GAAG,CAAa;IAChB,SAAS,CAAe;IACxB,WAAW,CAAS;IAErC,YACmB,OAAmD,EACpE,IAAI,GAA+B,EAAE;uBADpB,OAAO;QAGxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,UAAU,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,WAAW,GAAG,OAAO,CACxB,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,uBAAuB,CAAC,CAC1E,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,YAAY,CACjB,QAAyB,EACzB,IAAI,GAA+B,EAAE;QAErC,OAAO,IAAI,sBAAsB,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACpE,CAAC;IAED,UAAU,CACR,OAAe,EACf,SAAsB,EACtB,aAA8B,EAC9B,cAA8B;QAE9B,OAAO,mBAAmB,CAAC,KAAK,CAAC;YAC/B,aAAa,EAAE,CAAC;YAChB,eAAe,EAAE,CAAC;YAClB,OAAO;YACP,SAAS;YACT,aAAa;YACb,cAAc;YACd,YAAY,EAAE,uBAAuB;YACrC,gBAAgB,EAAE,SAAS;YAC3B,wBAAwB,EAAE,SAAS;YACnC,eAAe,EAAE,IAAI;YACrB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,OAAyC;QAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC/F,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAChC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,cAAc,CACvB,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAChE,OAAO;YACL,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC;gBACnC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,eAAe;gBACf,aAAa,EAAE,uBAAuB,CAAC,UAAU,EAAE,eAAe,CAAC;gBACnE,UAAU;aACX,CAAC;SACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAA0C;QACrD,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,eAAe,GACnB,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ,CAAC;YAC5C,OAAO,CAAC,aAAa,KAAK,uBAAuB,CAAC,UAAU,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;QACzF,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxC,qEAAqE;QACrE,wEAAwE;QACxE,sEAAsE;QACtE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACpC,IAAI,cAAc,GAAG,CAAC,CAAC;QACvB,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,SAAS,GAA2B,IAAI,CAAC;QAC7C,IAAI,eAAe,GAA0B,IAAI,CAAC;QAClD,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,aAAa,GAAG,CAAC,CAAC;QACtB,IAAI,eAAe,GAAG,CAAC,CAAC;QACxB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,CAAC,CAAC;QAC1B,IAAI,qBAAqB,GAAG,CAAC,CAAC;QAC9B,IAAI,oBAAoB,GAAG,CAAC,CAAC;QAC7B,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,uBAAuB,GAAG,KAAK,CAAC;QACpC,IAAI,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;QACtD,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,MAAM,eAAe,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACtD,IAAI,mBAAmB,GAAG,eAAe,CAAC;QAC1C,IAAI,kBAAkB,GAAG,eAAe,CAAC;QACzC,IAAI,WAAW,GAAkB,IAAI,CAAC;QACtC,IAAI,OAAmC,CAAC;QAExC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,aAAa,GAAG,IAAI,CAAC;gBACrB,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACvC,CAAC;YACD,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa;gBAAE,cAAc,GAAG,IAAI,CAAC;YACtD,IAAI,OAAO,IAAI,OAAO,CAAC,EAAE,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBACjD,uBAAuB,GAAG,IAAI,CAAC;gBAC/B,QAAQ,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,IAAI,CAAC,uBAAuB,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5F,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACpD,mBAAmB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;gBACnD,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC;oBACtC,UAAU,EAAE,cAAc,OAAO,CAAC,SAAS,EAAE;oBAC7C,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,kBAAkB,QAAQ,wCAAwC;oBAC1E,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,UAAU;oBAClB,uBAAuB,EAAE,KAAK;oBAC9B,sBAAsB,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC3D,UAAU,EAAE,IAAI;oBAChB,WAAW,EAAE,IAAI;oBACjB,SAAS,EAAE,CAAC;oBACZ,eAAe,EAAE,UAAU,CAAC,SAAS;oBACrC,qEAAqE;oBACrE,gEAAgE;oBAChE,kBAAkB,EAAE,IAAI;oBACxB,iBAAiB,EAAE,IAAI;oBACvB,eAAe,EAAE,OAAO;oBACxB,eAAe,EAAE,aAAa;oBAC9B,GAAG,EAAE,EAAE;oBACP,WAAW,EAAE,EAAE;oBACf,OAAO,EAAE,IAAI;oBACb,qEAAqE;oBACrE,qEAAqE;oBACrE,iBAAiB,EAAE,EAAE;oBACrB,aAAa,EAAE,KAAK;oBACpB,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE;iBAC9C,CAAC,CAAC;gBAC5B,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC1C,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACtC,UAAU,CAAC,MAAM,CACf,IAAI,CAAC,SAAS,CAAC;wBACb,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,KAAK,CAAC,UAAU;wBACzB,KAAK,EAAE,KAAK,CAAC,gBAAgB,IAAI,IAAI;wBACrC,MAAM,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;wBACvC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,KAAK;wBAC/B,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;qBACjE,CAAC,CACH,CAAC;oBACF,IAAI,YAAY;wBAAE,oBAAoB,IAAI,CAAC,CAAC;oBAC5C,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;wBACzC,qBAAqB,IAAI,CAAC,CAAC;wBAC3B,QAAQ,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;wBACvC,SAAS;oBACX,CAAC;oBACD,IAAI,aAAa,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;wBAAE,iBAAiB,GAAG,IAAI,CAAC;oBAC9E,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;wBACnB,KAAK,SAAS;4BACZ,aAAa,IAAI,CAAC,CAAC;4BACnB,IAAI,aAAa,KAAK,CAAC,IAAI,YAAY;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BAClE,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;4BAC9B,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;gCAC3B,IAAI,SAAS,IAAI,SAAS,KAAK,KAAK,CAAC,gBAAgB;oCAAE,aAAa,GAAG,IAAI,CAAC;gCAC5E,SAAS,KAAK,KAAK,CAAC,gBAAgB,CAAC;gCACrC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;4BAC7D,CAAC;4BACD,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gCAC5B,IAAI,eAAe,IAAI,eAAe,KAAK,KAAK,CAAC,iBAAiB;oCAChE,cAAc,GAAG,IAAI,CAAC;gCACxB,eAAe,KAAK,KAAK,CAAC,iBAAiB,CAAC;gCAC5C,QAAQ,CAAC,GAAG,CAAC,qBAAqB,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC;4BAC/D,CAAC;4BACD,MAAM;wBACR,KAAK,SAAS,EAAE,CAAC;4BACf,+DAA+D;4BAC/D,8DAA8D;4BAC9D,gDAAgD;4BAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;4BAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gCACzB,IAAI,cAAc,GAAG,IAAI,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;oCACtD,kBAAkB,GAAG,IAAI,CAAC;oCAC1B,MAAM;gCACR,CAAC;gCACD,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC;4BAChC,CAAC;4BACD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;4BACtB,MAAM;wBACR,CAAC;wBACD,KAAK,OAAO;4BACV,WAAW,IAAI,CAAC,CAAC;4BACjB,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;4BAC5B,MAAM;wBACR,KAAK,uBAAuB;4BAC1B,iBAAiB,IAAI,CAAC,CAAC;4BACvB,QAAQ,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;4BAC7C,MAAM;wBACR,KAAK,WAAW,CAAC;wBACjB,KAAK,aAAa,CAAC;wBACnB,KAAK,aAAa;4BAChB,oBAAoB,IAAI,CAAC,CAAC;4BAC1B,QAAQ,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;4BAC/C,MAAM;wBACR,KAAK,WAAW;4BACd,eAAe,IAAI,CAAC,CAAC;4BACrB,YAAY,GAAG,IAAI,CAAC;4BACpB,IAAI,eAAe,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO;gCAAE,iBAAiB,GAAG,IAAI,CAAC;4BACrE,SAAS,KAAK,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;4BACrC,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;4BAChC,MAAM;wBACR;4BACE,MAAM;oBACV,CAAC;gBACH,CAAC;gBACD,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,OAAO,KAAK,IAAI,CAAC;gBACpD,aAAa,GAAG,CAAC,SAAS,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;YAClE,CAAC;oBAAS,CAAC;gBACT,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACH,kBAAkB,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;oBACpD,CAAC;oBAAC,MAAM,CAAC;wBACP,kBAAkB,GAAG,MAAM,CAAC,+BAA+B,CAAC,CAAC;oBAC/D,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,gBAAgB,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,kBAAkB,CAAC;QAClE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9C,QAAQ,CAAC,GAAG,CAAC,mBAAmB,cAAc,EAAE,CAAC,CAAC;QAClD,QAAQ,CAAC,GAAG,CAAC,iBAAiB,YAAY,EAAE,CAAC,CAAC;QAC9C,IAAI,eAA6D,CAAC;QAClE,IAAI,eAAe;YAAE,eAAe,GAAG,kBAAkB,CAAC;aACrD,IAAI,uBAAuB;YAAE,eAAe,GAAG,2BAA2B,CAAC;aAC3E,IAAI,cAAc;YAAE,eAAe,GAAG,qBAAqB,CAAC;aAC5D,IAAI,SAAS;YAAE,eAAe,GAAG,WAAW,CAAC;aAC7C,IAAI,aAAa;YAAE,eAAe,GAAG,eAAe,CAAC;aACrD,IAAI,aAAa,KAAK,CAAC,IAAI,SAAS,KAAK,IAAI;YAAE,eAAe,GAAG,eAAe,CAAC;aACjF,IAAI,aAAa,IAAI,SAAS,KAAK,UAAU,CAAC,aAAa;YAC9D,eAAe,GAAG,gBAAgB,CAAC;aAChC,IAAI,eAAe,KAAK,IAAI;YAAE,eAAe,GAAG,gBAAgB,CAAC;aACjE,IAAI,cAAc,IAAI,eAAe,KAAK,UAAU,CAAC,cAAc;YACtE,eAAe,GAAG,iBAAiB,CAAC;aACjC,IACH,iBAAiB;YACjB,aAAa,KAAK,CAAC;YACnB,eAAe,GAAG,CAAC;YACnB,oBAAoB,GAAG,CAAC;YAExB,eAAe,GAAG,oBAAoB,CAAC;aACpC,IACH,WAAW,GAAG,CAAC;YACf,oBAAoB,GAAG,CAAC;YACxB,iBAAiB,GAAG,CAAC;YACrB,qBAAqB,GAAG,CAAC;YAEzB,eAAe,GAAG,eAAe,CAAC;aAC/B,IAAI,eAAe,KAAK,CAAC;YAAE,eAAe,GAAG,oBAAoB,CAAC;aAClE,IAAI,mBAAmB,KAAK,kBAAkB;YAAE,eAAe,GAAG,iBAAiB,CAAC;aACpF,IAAI,gBAAgB,IAAI,QAAQ,KAAK,QAAQ;YAAE,eAAe,GAAG,mBAAmB,CAAC;;YACrF,eAAe,GAAG,uBAAuB,CAAC;QAE/C,MAAM,MAAM,GAAG,eAAe,KAAK,uBAAuB,CAAC;QAC3D,OAAO,qBAAqB,CAAC,KAAK,CAAC;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;YAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,SAAS;YACT,eAAe;YACf,eAAe;YACf,YAAY,EACV,SAAS,IAAI,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;YACzF,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;YAC1C,gBAAgB,EAAE,SAAS;YAC3B,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YACrC,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc;YACd,YAAY;YACZ,mBAAmB;YACnB,kBAAkB;YAClB,MAAM,EAAE;gBACN,aAAa;gBACb,eAAe;gBACf,WAAW;gBACX,oBAAoB;gBACpB,iBAAiB;gBACjB,qBAAqB;gBACrB,oBAAoB;gBACpB,OAAO,EAAE,SAAS;aACnB;YACD,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,gFAAgF;IAChF,OAAO,CAAC,SAAiB;QACvB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;YAAE,OAAO;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7B,IACE,IAAI,CAAC,cAAc,EAAE;YACrB,CAAC,IAAI,CAAC,WAAW,EAAE;YACnB,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;YAC3B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAC5B,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,aAAa,CAAC,SAAiB;QACrC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACvF,+BAA+B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAChF,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,SAAS,YAAY,CAAC,SAAiB;IACrC,OAAO,gCAAgC,MAAM,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClG,CAAC;AAED,SAAS,uBAAuB,CAC9B,UAAmC,EACnC,eAAuB;IAEvB,OAAO,MAAM,CACX,IAAI,CAAC,SAAS,CAAC;QACb,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,SAAS,EAAE,2BAA2B;QACtC,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,UAAU;QAClB,qBAAqB,EAAE,KAAK;QAC5B,QAAQ,EAAE,CAAC;QACX,cAAc,EAAE,OAAO;QACvB,cAAc,EAAE,aAAa;QAC7B,eAAe;KAChB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACvC,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACjD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE;gBAC7B,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE;oBACb,CAAC,CAAC,MAAM;oBACR,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE;wBACrB,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,OAAO,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7E,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC;iBAC9B,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;iBAC3D,IAAI,IAAI,CAAC,MAAM,EAAE;gBAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,CAAC;IACX,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAmC;IACjE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,KAAK,CAAC;gBAAE,MAAM;YACvB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC"}

package/dist/capabilities.d.ts

@@ -1,3 +1,10 @@
-import type { HarnessCapabilityProfile } from "@claudexor/schema";
-export declare function needsScopedHomeKeychainBridge(profile: HarnessCapabilityProfile): boolean;
+import { type HarnessCapabilityProfile } from "@claudexor/schema";
+export declare function needsScopedHomeKeychainBridge(profile: HarnessCapabilityProfile, platform?: NodeJS.Platform): boolean;
+/**
+ * Whether a harness owns a profile-local keychain rather than borrowing a
+ * host keychain through the Claude-specific HOME bridge. This is deliberately
+ * a separate capability: callers must not infer the private-keychain route
+ * from the bridge containment flag.
+ */
+export declare function needsPrivatePerProfileKeychain(profile: HarnessCapabilityProfile, platform?: NodeJS.Platform): boolean;
 //# sourceMappingURL=capabilities.d.ts.map

package/dist/capabilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAElE,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,wBAAwB,GAAG,OAAO,CAOxF"}
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,mBAAmB,CAAC;AAM3B,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,wBAAwB,EACjC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAST;AAED;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,wBAAwB,EACjC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,OAAO,CAST"}

package/dist/capabilities.js

@@ -1,5 +1,25 @@
-export function needsScopedHomeKeychainBridge(profile) {
+import { credentialTransportsForPlatform, } from "@claudexor/schema";
+function supportedPlatform(platform) {
+    return platform === "darwin" || platform === "linux" || platform === "win32" ? platform : null;
+}
+export function needsScopedHomeKeychainBridge(profile, platform = process.platform) {
+    const hostPlatform = supportedPlatform(platform);
+    if (!hostPlatform)
+        return false;
     return (profile.isolation.supported_containment.includes("scoped_home_keychain_bridge") &&
-        profile.auth.credential_transports.some((t) => t.kind === "os_keychain" && t.relocatable_by.includes("HOME")));
+        credentialTransportsForPlatform(profile.auth, hostPlatform).some((t) => t.kind === "os_keychain" && t.relocatable_by.includes("HOME")));
+}
+/**
+ * Whether a harness owns a profile-local keychain rather than borrowing a
+ * host keychain through the Claude-specific HOME bridge. This is deliberately
+ * a separate capability: callers must not infer the private-keychain route
+ * from the bridge containment flag.
+ */
+export function needsPrivatePerProfileKeychain(profile, platform = process.platform) {
+    const hostPlatform = supportedPlatform(platform);
+    if (!hostPlatform)
+        return false;
+    return (profile.isolation.supported_containment.includes("private_per_profile_keychain") &&
+        credentialTransportsForPlatform(profile.auth, hostPlatform).some((transport) => transport.kind === "os_keychain" && transport.relocatable_by.includes("HOME")));
 }
 //# sourceMappingURL=capabilities.js.map

package/dist/capabilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,6BAA6B,CAAC,OAAiC;IAC7E,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrE,CACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../src/capabilities.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,GAGhC,MAAM,mBAAmB,CAAC;AAE3B,SAAS,iBAAiB,CAAC,QAAyB;IAClD,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,OAAiC,EACjC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,6BAA6B,CAAC;QAC/E,+BAA+B,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,IAAI,CAC9D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,IAAI,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrE,CACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAiC,EACjC,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,MAAM,YAAY,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,CACL,OAAO,CAAC,SAAS,CAAC,qBAAqB,CAAC,QAAQ,CAAC,8BAA8B,CAAC;QAChF,+BAA+B,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,IAAI,CAC9D,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,aAAa,IAAI,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC7F,CACF,CAAC;AACJ,CAAC"}

package/dist/credential-profile-policy.d.ts

@@ -0,0 +1,38 @@
+import { type AuthSourceKind, type CredentialProfile, type CredentialProfileProblemCode, type EffectiveCredentialProfilePolicy, type HarnessPlatform } from "@claudexor/schema";
+import type { HarnessAdapter } from "./adapter.js";
+export interface CredentialProfilePolicyState {
+    readonly harnessId: string;
+    readonly platform: HarnessPlatform | null;
+    readonly policy: EffectiveCredentialProfilePolicy;
+    readonly enabledProfileCount: number;
+    readonly ambiguous: boolean;
+}
+/** Node supports more platform literals than the public harness contract. */
+export declare function harnessPlatform(platform?: NodeJS.Platform): HarnessPlatform | null;
+/**
+ * Resolve static profile policy without running discover() or any vendor
+ * probe. This is the early fail-loud seam: a persisted ambiguity must be
+ * diagnosed before choosing or contacting one of the conflicting rows.
+ */
+export declare function credentialProfilePolicyState(input: {
+    adapter: Pick<HarnessAdapter, "id" | "capabilityProfile"> | undefined;
+    registry: readonly CredentialProfile[];
+    source?: AuthSourceKind;
+    platform?: NodeJS.Platform;
+}): CredentialProfilePolicyState;
+export interface CredentialProfilePolicyProblem extends Error {
+    status: 409;
+    code: CredentialProfileProblemCode;
+    retryable: false;
+    fieldErrors: Record<string, string[]>;
+    requiredActions: string[];
+    context: {
+        harnessId: string;
+        platform: HarnessPlatform | null;
+        maxEnabledProfiles: number;
+        enabledProfileCount: number;
+    };
+}
+/** Exact typed 409 shared by create, enable, setup, and run admission. */
+export declare function credentialProfilePolicyProblem(state: CredentialProfilePolicyState, code: "credential_profile_limit_exceeded" | "credential_profile_ambiguous", field?: "/profileId" | "/enabled"): CredentialProfilePolicyProblem;
+//# sourceMappingURL=credential-profile-policy.d.ts.map

package/dist/credential-profile-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-profile-policy.d.ts","sourceRoot":"","sources":["../src/credential-profile-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,4BAA4B,EACjC,KAAK,gCAAgC,EACrC,KAAK,eAAe,EACrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,gCAAgC,CAAC;IAClD,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAQD,6EAA6E;AAC7E,wBAAgB,eAAe,CAC7B,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,eAAe,GAAG,IAAI,CAExB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,IAAI,GAAG,mBAAmB,CAAC,GAAG,SAAS,CAAC;IACtE,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B,GAAG,4BAA4B,CAuB/B;AAED,MAAM,WAAW,8BAA+B,SAAQ,KAAK;IAC3D,MAAM,EAAE,GAAG,CAAC;IACZ,IAAI,EAAE,4BAA4B,CAAC;IACnC,SAAS,EAAE,KAAK,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtC,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;QACjC,kBAAkB,EAAE,MAAM,CAAC;QAC3B,mBAAmB,EAAE,MAAM,CAAC;KAC7B,CAAC;CACH;AAED,0EAA0E;AAC1E,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,4BAA4B,EACnC,IAAI,EAAE,mCAAmC,GAAG,8BAA8B,EAC1E,KAAK,CAAC,EAAE,YAAY,GAAG,UAAU,GAChC,8BAA8B,CA6BhC"}

package/dist/credential-profile-policy.js

@@ -0,0 +1,67 @@
+import { credentialProfilePolicyForPlatform, } from "@claudexor/schema";
+const DEFAULT_POLICY = {
+    identity_scope: "profile",
+    max_enabled_profiles: null,
+    cleanup_owner: "claudexor",
+};
+/** Node supports more platform literals than the public harness contract. */
+export function harnessPlatform(platform = process.platform) {
+    return platform === "darwin" || platform === "linux" || platform === "win32" ? platform : null;
+}
+/**
+ * Resolve static profile policy without running discover() or any vendor
+ * probe. This is the early fail-loud seam: a persisted ambiguity must be
+ * diagnosed before choosing or contacting one of the conflicting rows.
+ */
+export function credentialProfilePolicyState(input) {
+    const platform = harnessPlatform(input.platform);
+    const source = input.source ?? "native_session";
+    const policy = platform && input.adapter?.capabilityProfile
+        ? credentialProfilePolicyForPlatform(input.adapter.capabilityProfile.auth, source, platform)
+        : DEFAULT_POLICY;
+    const enabledProfileCount = input.registry.filter((profile) => profile.harness_id === input.adapter?.id &&
+        profile.enabled &&
+        // Static source policy is applied to the native subscription rows. A
+        // separately stored metered key is a different auth source/payment path.
+        profile.credential_kind !== "api_key").length;
+    const maximum = policy.max_enabled_profiles;
+    return {
+        harnessId: input.adapter?.id ?? "unknown",
+        platform,
+        policy,
+        enabledProfileCount,
+        ambiguous: maximum !== null && enabledProfileCount > maximum,
+    };
+}
+/** Exact typed 409 shared by create, enable, setup, and run admission. */
+export function credentialProfilePolicyProblem(state, code, field) {
+    const maximum = state.policy.max_enabled_profiles;
+    if (maximum === null)
+        throw new Error("cannot create a profile-limit problem for an unbounded policy");
+    const ambiguous = code === "credential_profile_ambiguous";
+    const message = ambiguous
+        ? `${state.harnessId} has ${state.enabledProfileCount} enabled profile bindings on ${state.platform ?? "this host"}, but the current policy permits ${maximum}; disable extra profiles before continuing`
+        : `${state.harnessId} permits at most ${maximum} enabled profile binding${maximum === 1 ? "" : "s"} on ${state.platform ?? "this host"}; disable another profile first`;
+    return Object.assign(new Error(message), {
+        status: 409,
+        code,
+        retryable: false,
+        fieldErrors: field
+            ? {
+                [field]: [
+                    ambiguous
+                        ? "The persisted enabled profile set is ambiguous; disable extra profiles first."
+                        : `Enabling this profile would exceed the platform limit of ${maximum}.`,
+                ],
+            }
+            : {},
+        requiredActions: ["disable_extra_profiles"],
+        context: {
+            harnessId: state.harnessId,
+            platform: state.platform,
+            maxEnabledProfiles: maximum,
+            enabledProfileCount: state.enabledProfileCount,
+        },
+    });
+}
+//# sourceMappingURL=credential-profile-policy.js.map

package/dist/credential-profile-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-profile-policy.js","sourceRoot":"","sources":["../src/credential-profile-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kCAAkC,GAMnC,MAAM,mBAAmB,CAAC;AAW3B,MAAM,cAAc,GAAqC;IACvD,cAAc,EAAE,SAAS;IACzB,oBAAoB,EAAE,IAAI;IAC1B,aAAa,EAAE,WAAW;CAC3B,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAC7B,QAAQ,GAAoB,OAAO,CAAC,QAAQ;IAE5C,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,4BAA4B,CAAC,KAK5C;IACC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,gBAAgB,CAAC;IAChD,MAAM,MAAM,GACV,QAAQ,IAAI,KAAK,CAAC,OAAO,EAAE,iBAAiB;QAC1C,CAAC,CAAC,kCAAkC,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC;QAC5F,CAAC,CAAC,cAAc,CAAC;IACrB,MAAM,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAC/C,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE;QACxC,OAAO,CAAC,OAAO;QACf,qEAAqE;QACrE,yEAAyE;QACzE,OAAO,CAAC,eAAe,KAAK,SAAS,CACxC,CAAC,MAAM,CAAC;IACT,MAAM,OAAO,GAAG,MAAM,CAAC,oBAAoB,CAAC;IAC5C,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,SAAS;QACzC,QAAQ;QACR,MAAM;QACN,mBAAmB;QACnB,SAAS,EAAE,OAAO,KAAK,IAAI,IAAI,mBAAmB,GAAG,OAAO;KAC7D,CAAC;AACJ,CAAC;AAgBD,0EAA0E;AAC1E,MAAM,UAAU,8BAA8B,CAC5C,KAAmC,EACnC,IAA0E,EAC1E,KAAiC;IAEjC,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC;IAClD,IAAI,OAAO,KAAK,IAAI;QAClB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,IAAI,KAAK,8BAA8B,CAAC;IAC1D,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,QAAQ,KAAK,CAAC,mBAAmB,gCAAgC,KAAK,CAAC,QAAQ,IAAI,WAAW,oCAAoC,OAAO,4CAA4C;QACzM,CAAC,CAAC,GAAG,KAAK,CAAC,SAAS,oBAAoB,OAAO,2BAA2B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,KAAK,CAAC,QAAQ,IAAI,WAAW,iCAAiC,CAAC;IAC1K,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE;QACvC,MAAM,EAAE,GAAY;QACpB,IAAI;QACJ,SAAS,EAAE,KAAc;QACzB,WAAW,EAAE,KAAK;YAChB,CAAC,CAAC;gBACE,CAAC,KAAK,CAAC,EAAE;oBACP,SAAS;wBACP,CAAC,CAAC,+EAA+E;wBACjF,CAAC,CAAC,4DAA4D,OAAO,GAAG;iBAC3E;aACF;YACH,CAAC,CAAC,EAAE;QACN,eAAe,EAAE,CAAC,wBAAwB,CAAC;QAC3C,OAAO,EAAE;YACP,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,kBAAkB,EAAE,OAAO;YAC3B,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;SAC/C;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/errors.d.ts

@@ -24,34 +24,25 @@ export declare class DelegationBeltUnavailableError extends ClaudexorError {
     readonly status = 503;
 }
 /**
- * A run marked `execution.delegated` could not be confined to a scoped harness
- * HOME. Its caller cannot audit a confinement that silently did not happen, so
- * the attempt refuses instead of degrading onto the operator's real home (which
- * holds the daemon control token and the caller's own provider settings).
+ * A run marked `execution.delegated` could not be assigned its scoped harness
+ * HOME. The attempt refuses instead of degrading onto the operator's real home.
  */
 export declare class DelegatedHomeUnavailableError extends ClaudexorError {
     readonly code = "delegated_home_unavailable";
     readonly category: "internal";
 }
-/**
- * A run marked `execution.delegated` could not be given an OS-ENFORCED
- * filesystem boundary — the host does not offer one, or the profile did not
- * take effect when probed. The scoped HOME beside it is a convention that an
- * absolute path defeats, so there is nothing to degrade onto: the attempt
- * refuses. See docs/DELEGATED_CONFINEMENT.md.
- */
-export declare class ConfinementUnavailableError extends ClaudexorError {
-    readonly code = "delegated_confinement_unavailable";
-    readonly category: "config_error";
-}
-/**
- * A terminal MUTATING delegated run whose attempts do not all carry the applied
- * HOME/access/profile/confinement facts. Asking for confinement is not evidence
- * that it happened, so an unauditable mutating terminal is an infrastructure
- * refusal rather than a pass.
- */
+/** A terminal mutating delegated run whose attempts do not all carry complete
+ * applied HOME/access/profile/boundary-disclosure facts. */
 export declare class DelegatedEvidenceIncompleteError extends ClaudexorError {
     readonly code = "delegated_evidence_incomplete";
     readonly category: "internal";
 }
+/** A requested access mode cannot be represented by the selected native adapter. */
+export declare class AccessProfileIncompatibleError extends ClaudexorError {
+    readonly code = "access_profile_incompatible";
+    readonly category: "harness_unavailable";
+    readonly status = 400;
+    readonly retryable = false;
+    readonly requiredActions: string[];
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAED,qBAAa,uBAAwB,SAAQ,cAAc;CAAG;AAC9D,qBAAa,oBAAqB,SAAQ,cAAc;CAAG;AAC3D,qBAAa,cAAe,SAAQ,cAAc;CAAG;AAErD;;;;;GAKG;AACH,qBAAa,8BAA+B,SAAQ,cAAc;IAChE,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,MAAM,OAAO;CACvB;AAED;;;;;GAKG;AACH,qBAAa,6BAA8B,SAAQ,cAAc;IAC/D,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;CACzC;AAED;;;;;;GAMG;AACH,qBAAa,2BAA4B,SAAQ,cAAc;IAC7D,QAAQ,CAAC,IAAI,uCAAuC;IACpD,QAAQ,CAAC,QAAQ,EAAG,cAAc,CAAU;CAC7C;AAED;;;;;GAKG;AACH,qBAAa,gCAAiC,SAAQ,cAAc;IAClE,QAAQ,CAAC,IAAI,mCAAmC;IAChD,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;CACzC"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qBAAa,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAGzD;CACF;AAED,qBAAa,uBAAwB,SAAQ,cAAc;CAAG;AAC9D,qBAAa,oBAAqB,SAAQ,cAAc;CAAG;AAC3D,qBAAa,cAAe,SAAQ,cAAc;CAAG;AAErD;;;;;GAKG;AACH,qBAAa,8BAA+B,SAAQ,cAAc;IAChE,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,MAAM,OAAO;CACvB;AAED;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,cAAc;IAC/D,QAAQ,CAAC,IAAI,gCAAgC;IAC7C,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;CACzC;AAED;4DAC4D;AAC5D,qBAAa,gCAAiC,SAAQ,cAAc;IAClE,QAAQ,CAAC,IAAI,mCAAmC;IAChD,QAAQ,CAAC,QAAQ,EAAG,UAAU,CAAU;CACzC;AAED,oFAAoF;AACpF,qBAAa,8BAA+B,SAAQ,cAAc;IAChE,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,QAAQ,EAAG,qBAAqB,CAAU;IACnD,QAAQ,CAAC,MAAM,OAAO;IACtB,QAAQ,CAAC,SAAS,SAAS;IAC3B,QAAQ,CAAC,eAAe,WAEtB;CACH"}

package/dist/errors.js

@@ -25,34 +25,27 @@ export class DelegationBeltUnavailableError extends ClaudexorError {
     status = 503;
 }
 /**
- * A run marked `execution.delegated` could not be confined to a scoped harness
- * HOME. Its caller cannot audit a confinement that silently did not happen, so
- * the attempt refuses instead of degrading onto the operator's real home (which
- * holds the daemon control token and the caller's own provider settings).
+ * A run marked `execution.delegated` could not be assigned its scoped harness
+ * HOME. The attempt refuses instead of degrading onto the operator's real home.
  */
 export class DelegatedHomeUnavailableError extends ClaudexorError {
     code = "delegated_home_unavailable";
     category = "internal";
 }
-/**
- * A run marked `execution.delegated` could not be given an OS-ENFORCED
- * filesystem boundary — the host does not offer one, or the profile did not
- * take effect when probed. The scoped HOME beside it is a convention that an
- * absolute path defeats, so there is nothing to degrade onto: the attempt
- * refuses. See docs/DELEGATED_CONFINEMENT.md.
- */
-export class ConfinementUnavailableError extends ClaudexorError {
-    code = "delegated_confinement_unavailable";
-    category = "config_error";
-}
-/**
- * A terminal MUTATING delegated run whose attempts do not all carry the applied
- * HOME/access/profile/confinement facts. Asking for confinement is not evidence
- * that it happened, so an unauditable mutating terminal is an infrastructure
- * refusal rather than a pass.
- */
+/** A terminal mutating delegated run whose attempts do not all carry complete
+ * applied HOME/access/profile/boundary-disclosure facts. */
 export class DelegatedEvidenceIncompleteError extends ClaudexorError {
     code = "delegated_evidence_incomplete";
     category = "internal";
 }
+/** A requested access mode cannot be represented by the selected native adapter. */
+export class AccessProfileIncompatibleError extends ClaudexorError {
+    code = "access_profile_incompatible";
+    category = "harness_unavailable";
+    status = 400;
+    retryable = false;
+    requiredActions = [
+        "Choose workspace_write on a compatible harness, or explicitly trust the repository and choose full.",
+    ];
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,cAAc;CAAG;AAC9D,MAAM,OAAO,oBAAqB,SAAQ,cAAc;CAAG;AAC3D,MAAM,OAAO,cAAe,SAAQ,cAAc;CAAG;AAErD;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,cAAc;IACvD,IAAI,GAAG,6BAA6B,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,OAAO,6BAA8B,SAAQ,cAAc;IACtD,IAAI,GAAG,4BAA4B,CAAC;IACpC,QAAQ,GAAG,UAAmB,CAAC;CACzC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,2BAA4B,SAAQ,cAAc;IACpD,IAAI,GAAG,mCAAmC,CAAC;IAC3C,QAAQ,GAAG,cAAuB,CAAC;CAC7C;AAED;;;;;GAKG;AACH,MAAM,OAAO,gCAAiC,SAAQ,cAAc;IACzD,IAAI,GAAG,+BAA+B,CAAC;IACvC,QAAQ,GAAG,UAAmB,CAAC;CACzC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;IACpC,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,cAAc;CAAG;AAC9D,MAAM,OAAO,oBAAqB,SAAQ,cAAc;CAAG;AAC3D,MAAM,OAAO,cAAe,SAAQ,cAAc;CAAG;AAErD;;;;;GAKG;AACH,MAAM,OAAO,8BAA+B,SAAQ,cAAc;IACvD,IAAI,GAAG,6BAA6B,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,OAAO,6BAA8B,SAAQ,cAAc;IACtD,IAAI,GAAG,4BAA4B,CAAC;IACpC,QAAQ,GAAG,UAAmB,CAAC;CACzC;AAED;4DAC4D;AAC5D,MAAM,OAAO,gCAAiC,SAAQ,cAAc;IACzD,IAAI,GAAG,+BAA+B,CAAC;IACvC,QAAQ,GAAG,UAAmB,CAAC;CACzC;AAED,oFAAoF;AACpF,MAAM,OAAO,8BAA+B,SAAQ,cAAc;IACvD,IAAI,GAAG,6BAA6B,CAAC;IACrC,QAAQ,GAAG,qBAA8B,CAAC;IAC1C,MAAM,GAAG,GAAG,CAAC;IACb,SAAS,GAAG,KAAK,CAAC;IAClB,eAAe,GAAG;QACzB,qGAAqG;KACtG,CAAC;CACH"}

package/dist/index.d.ts

@@ -1,6 +1,5 @@
 export * from "./errors.js";
 export * from "./adapter.js";
-export * from "./confinement.js";
 export * from "./attachment-integrity.js";
 export * from "./effort.js";
 export * from "./model.js";
@@ -24,4 +23,5 @@ export * from "./process-identity.js";
 export * from "./process-group.js";
 export * from "./process-tree.js";
 export * from "./isolation-locator.js";
+export * from "./credential-profile-policy.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC"}

package/dist/index.js

@@ -1,6 +1,5 @@
 export * from "./errors.js";
 export * from "./adapter.js";
-export * from "./confinement.js";
 export * from "./attachment-integrity.js";
 export * from "./effort.js";
 export * from "./model.js";
@@ -24,4 +23,5 @@ export * from "./process-identity.js";
 export * from "./process-group.js";
 export * from "./process-tree.js";
 export * from "./isolation-locator.js";
+export * from "./credential-profile-policy.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC;AAC7B,cAAc,2BAA2B,CAAC;AAC1C,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,iBAAiB,CAAC;AAChC,cAAc,uBAAuB,CAAC;AACtC,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,uBAAuB,CAAC;AACtC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,gCAAgC,CAAC"}

package/dist/isolation-locator.d.ts

@@ -5,7 +5,7 @@
  * tree — a locator inside a repository or an arbitrary user dir would put
  * credential state where git or other tools can capture it.
  *
- * The confinement root FOLLOWS the v2 root (release wave round-18 #4): under
+ * The owned root FOLLOWS the v2 root (release wave round-18 #4): under
  * an explicit CLAUDEXOR_CONFIG_DIR override that override IS the complete
  * relocatable root — a hermetic/disposable run must accept profiles inside
  * it and reject the host's real ~/.claudexor (host credential state must not

package/dist/isolation-locator.js

@@ -8,7 +8,7 @@ import { claudexorOwnedRoot } from "@claudexor/util";
  * tree — a locator inside a repository or an arbitrary user dir would put
  * credential state where git or other tools can capture it.
  *
- * The confinement root FOLLOWS the v2 root (release wave round-18 #4): under
+ * The owned root FOLLOWS the v2 root (release wave round-18 #4): under
  * an explicit CLAUDEXOR_CONFIG_DIR override that override IS the complete
  * relocatable root — a hermetic/disposable run must accept profiles inside
  * it and reject the host's real ~/.claudexor (host credential state must not
@@ -41,7 +41,7 @@ export function canonicalIsolationLocator(locator, label) {
     if (!isAbsolute(locator))
         throw new Error(`${label} must be absolute: ${locator}`);
     const dir = normalizeThroughExistingAncestor(locator);
-    // Normalize the confinement root the SAME way as the locator (round-19,
+    // Normalize the owned root the SAME way as the locator (round-19,
     // fable checkpoint): a not-yet-created CLAUDEXOR_CONFIG_DIR under a
     // symlinked parent (/var → /private/var on macOS) would otherwise compare
     // unequal to a locator that was resolved through that symlink, and

package/dist/isolation-locator.js.map

@@ -1 +1 @@
-{"version":3,"file":"isolation-locator.js","sourceRoot":"","sources":["../src/isolation-locator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH;;;kCAGkC;AAClC,MAAM,UAAU,gCAAgC,CAAC,IAAY;IAC3D,IAAI,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,SAAS,CAAC;QACR,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,QAAQ;gBAAE,MAAM;YAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjC,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe,EAAE,KAAa;IACtE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IACtD,wEAAwE;IACxE,oEAAoE;IACpE,0EAA0E;IAC1E,mEAAmE;IACnE,wCAAwC;IACxC,MAAM,KAAK,GAAG,gCAAgC,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACrE,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,KAAK,SAAS,GAAG,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"isolation-locator.js","sourceRoot":"","sources":["../src/isolation-locator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD;;;;;;;;;;;;;GAaG;AACH;;;kCAGkC;AAClC,MAAM,UAAU,gCAAgC,CAAC,IAAY;IAC3D,IAAI,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,SAAS,CAAC;QACR,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM;QACR,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,QAAQ;gBAAE,MAAM;YAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjC,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe,EAAE,KAAa;IACtE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sBAAsB,OAAO,EAAE,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IACtD,kEAAkE;IAClE,oEAAoE;IACpE,0EAA0E;IAC1E,mEAAmE;IACnE,wCAAwC;IACxC,MAAM,KAAK,GAAG,gCAAgC,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACrE,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oBAAoB,KAAK,SAAS,GAAG,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,UAAU,CAAC;AACjD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,UAAU,CAAC;AAElD,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,GAAE,gBAA6B,GACpC,UAAU,CAkBZ"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,UAAU,CAAC;AACjD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,0EAA0E;AAC1E,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,UAAU,CAAC;AAElD,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACpC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,GAAE,gBAA6B,GACpC,UAAU,CAoBZ"}

package/dist/model.js

@@ -6,7 +6,9 @@ export function validateModel(requested, known, source = "manifest") {
         return {
             status: "rejected",
             message: `this harness cannot verify models (no ${source === "api" ? "live model inventory" : "manifest known_models"}); ` +
-                `use the harness default (omit the model) or add known_models to the manifest`,
+                (source === "api"
+                    ? "repair the live account/auth route or use the harness default (omit the model)"
+                    : "use the harness default (omit the model) or add known_models to the manifest"),
         };
     }
     if (known.includes(model))

package/dist/model.js.map

@@ -1 +1 @@
-{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAuBA,MAAM,UAAU,aAAa,CAC3B,SAAoC,EACpC,KAAwB,EACxB,MAAM,GAAqB,UAAU;IAErC,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,OAAO,EACL,yCAAyC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,uBAAuB,KAAK;gBACjH,8EAA8E;SACjF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,UAAU,KAAK,6BAA6B,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,2BAA2B,KAAK,KAAK,GAAG,MAAM,GAAG;KACnJ,CAAC;AACJ,CAAC"}
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../src/model.ts"],"names":[],"mappings":"AAuBA,MAAM,UAAU,aAAa,CAC3B,SAAoC,EACpC,KAAwB,EACxB,MAAM,GAAqB,UAAU;IAErC,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,MAAM,EAAE,UAAU;YAClB,OAAO,EACL,yCAAyC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,uBAAuB,KAAK;gBACjH,CAAC,MAAM,KAAK,KAAK;oBACf,CAAC,CAAC,gFAAgF;oBAClF,CAAC,CAAC,8EAA8E,CAAC;SACtF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,OAAO,EAAE,UAAU,KAAK,6BAA6B,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,2BAA2B,KAAK,KAAK,GAAG,MAAM,GAAG;KACnJ,CAAC;AACJ,CAAC"}

package/dist/runloop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runloop.d.ts","sourceRoot":"","sources":["../src/runloop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEtE,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,KAAK,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAkC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,WAAW,GAAG,SAAS,CAOjF;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,cAAc,CAAC;IACrB;;;;OAIG;IACH,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,YAAY,EAAE,GAAG,IAAI,CAAC;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAClC,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC;IAChF,4EAA4E;IAC5E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC;IAClD;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;QACnC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,KAAK,cAAc,CAAC,YAAY,CAAC,CAAC;QACvE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;KAC1C,CAAC;IACF;;iCAE6B;IAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAC;CACjF;AAED,wBAAuB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAAC,YAAY,CAAC,CAuL1F"}
+{"version":3,"file":"runloop.d.ts","sourceRoot":"","sources":["../src/runloop.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,KAAK,EAAE,6BAA6B,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAkC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,WAAW,GAAG,SAAS,CAOjF;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,IAAI,EAAE,cAAc,CAAC;IACrB;;;;OAIG;IACH,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,YAAY,EAAE,GAAG,IAAI,CAAC;IACvE,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAClC,2EAA2E;IAC3E,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC;IAChF,4EAA4E;IAC5E,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC;IAClD;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE;QACR,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;QACnC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,KAAK,cAAc,CAAC,YAAY,CAAC,CAAC;QACvE,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC;KAC1C,CAAC;IACF;;iCAE6B;IAC7B,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,6BAA6B,CAAC,CAAC;CACjF;AAED,wBAAuB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,cAAc,CAAC,YAAY,CAAC,CAkL1F"}

package/dist/runloop.js

@@ -1,4 +1,3 @@
-import { confinedInvocation } from "./confinement.js";
 import { spawnProcess } from "./proc.js";
 /**
  * Shared CLI adapter run loop.
@@ -59,13 +58,8 @@ export async function* runCliHarness(opts) {
     // Box the stdin handle: it is assigned inside the onSpawn callback, which
     // TypeScript's control-flow narrowing cannot see through a plain let.
     const session = { io: null };
-    // The OS boundary is applied HERE, at the one seam every local-CLI adapter
-    // already funnels through, rather than in each adapter's argv builder: an
-    // adapter that forgot to opt in would run a delegated child unconfined while
-    // the run record still said it asked for confinement.
-    const invocation = confinedInvocation(spec.confinement, opts.bin, opts.args);
     try {
-        for await (const ev of spawnProcess(invocation.bin, invocation.args, {
+        for await (const ev of spawnProcess(opts.bin, opts.args, {
             cwd: spec.cwd,
             env: opts.env,
             inheritEnv: spec.env_inheritance,