@claudexor/orchestrator 3.1.1 → 3.2.0

package/dist/credential-profile-rotation.js

@@ -0,0 +1,315 @@
+import { HarnessRunSpec as HarnessRunSpecSchema } from "@claudexor/schema";
+/**
+ * Static rotation candidates, before any credential-backed readiness probe.
+ * One owner applies policy order, enabled/harness scope, current identity,
+ * already-tried exclusions, and the payment-kind fence. Callers then probe
+ * only identities that could actually be selected.
+ */
+export function staticRotationCandidates(args) {
+    const pool = args.registry.filter((profile) => profile.harness_id === args.harnessId && profile.enabled);
+    const ordered = args.policy.rotation_eligible.length > 0
+        ? args.policy.rotation_eligible
+            .map((id) => pool.find((profile) => profile.profile_id === id))
+            .filter((profile) => profile !== undefined)
+        : pool;
+    const excluded = args.excluded ?? new Set();
+    return ordered.filter((candidate) => {
+        if (candidate.profile_id === args.current?.profile_id)
+            return false;
+        if (excluded.has(candidate.profile_id))
+            return false;
+        if (args.current !== null && candidate.credential_kind !== args.current.credential_kind) {
+            return false;
+        }
+        // The default subject is vendor-native subscription state; it never probes
+        // or rotates into a metered API-key identity.
+        if (args.current === null && candidate.credential_kind === "api_key")
+            return false;
+        return true;
+    });
+}
+/**
+ * Proactive headroom check (W5.4 `profile_headroom_preflight`): the SELECTED
+ * profile's freshest snapshot windows against the policy threshold. Unknown
+ * usage is NOT a breach — rotation never triggers on missing data.
+ */
+export function profileHeadroomBreach(snapshots, harnessId, profileId, threshold) {
+    for (const snapshot of snapshots) {
+        // FRESH evidence only (release wave tier1 #3): a stale or unknown reading
+        // must never breach headroom, rotate a profile away, or fail selection.
+        if (snapshot.freshness !== "fresh")
+            continue;
+        if (snapshot.subject.harness !== harnessId)
+            continue;
+        if ((snapshot.subject.subject_id ?? null) !== profileId)
+            continue;
+        for (const constraint of snapshot.constraints) {
+            if (constraint.used_ratio !== null && constraint.used_ratio >= threshold) {
+                return {
+                    constraint_id: constraint.id,
+                    used_ratio: constraint.used_ratio,
+                    threshold,
+                    resets_at: constraint.resets_at,
+                };
+            }
+        }
+    }
+    return null;
+}
+/**
+ * The next rotation target after `currentProfileId` (W5.4): policy order wins
+ * (`rotation_eligible`), else every enabled profile of the harness in registry
+ * order. The current profile and disabled/unknown ids never come back; a
+ * profile already over the headroom bound is skipped (rotating INTO a spent
+ * subscription is not a failover). Cross-subscription rotation of one vendor
+ * is allowed by owner decision — but rotation NEVER crosses credential kinds
+ * (release wave round-16 BLOCK): a subscription→API-key swap silently changes
+ * the payment model mid-attempt, and the attempt's first-wins auth-route
+ * receipt (decided once before spawn) would misvalue metered usage as
+ * subscription entitlement, bypassing a finite cash cap.
+ */
+export function nextEligibleProfile(registry, harnessId, policy, current, snapshots, readyProfileIds, excluded = new Set()) {
+    for (const candidate of staticRotationCandidates({
+        registry,
+        harnessId,
+        policy,
+        current,
+        excluded,
+    })) {
+        if (!readyProfileIds.has(candidate.profile_id))
+            continue;
+        if (profileHeadroomBreach(snapshots, harnessId, candidate.profile_id, policy.headroom_threshold))
+            continue;
+        return candidate;
+    }
+    return null;
+}
+/**
+ * `rotation_retry_eligible` (sol #30): a failover retry is allowed ONLY when
+ * the attempt saw a TYPED vendor limit AND produced no deliverable and no
+ * workspace mutation — a partially-acted attempt never silently reruns.
+ */
+export function rotationRetryEligible(input) {
+    return input.sawTypedLimit && input.deliverableEmpty;
+}
+function emitRotationExhausted(args) {
+    const excluded = args.excluded ?? new Set();
+    const candidates = args.registry
+        .filter((profile) => profile.harness_id === args.harnessId && profile.enabled)
+        .map((profile) => {
+        const breach = profileHeadroomBreach(args.snapshots, args.harnessId, profile.profile_id, args.policy.headroom_threshold);
+        const rejected = profile.profile_id === args.current?.profile_id
+            ? "current"
+            : args.policy.rotation_eligible.length > 0 &&
+                !args.policy.rotation_eligible.includes(profile.profile_id)
+                ? "not_in_rotation_policy"
+                : excluded.has(profile.profile_id)
+                    ? "already_tried"
+                    : args.current && profile.credential_kind !== args.current.credential_kind
+                        ? "credential_kind_mismatch"
+                        : args.current === null && profile.credential_kind === "api_key"
+                            ? "credential_kind_mismatch"
+                            : !args.readyProfileIds.has(profile.profile_id)
+                                ? "not_ready"
+                                : breach
+                                    ? "headroom_exceeded"
+                                    : "not_selected";
+        return {
+            profile_id: profile.profile_id,
+            credential_kind: profile.credential_kind,
+            rejected,
+            headroom: breach,
+        };
+    });
+    args.emit("route.profile.rotation_exhausted", {
+        harness_id: args.harnessId,
+        attempt_id: args.attemptId,
+        from_profile_id: args.current?.profile_id ?? null,
+        reason: args.reason,
+        threshold: args.policy.headroom_threshold,
+        candidates,
+    });
+}
+/**
+ * `profile_headroom_preflight` (W5.4): BEFORE spawn, the selected profile's
+ * freshest quota windows are checked against the policy threshold. A breach
+ * is always a typed event; `rotate` swaps to the next eligible profile with
+ * provenance, `ask`/`fail` proceed on the selected profile — the runtime
+ * `vendor_limit_rejected` evidence stays the terminating truth.
+ */
+export function preflightCredentialProfile(args) {
+    const { profile, harnessId, policy, registry, snapshots, readyProfileIds, emit } = args;
+    const breach = profileHeadroomBreach(snapshots, harnessId, profile.profile_id, policy.headroom_threshold);
+    if (!breach)
+        return profile;
+    emit("route.profile.headroom_exceeded", {
+        harness_id: harnessId,
+        profile_id: profile.profile_id,
+        action: policy.limit_action,
+        constraint_id: breach.constraint_id,
+        used_ratio: breach.used_ratio,
+        threshold: breach.threshold,
+        resets_at: breach.resets_at,
+    });
+    if (policy.limit_action === "fail") {
+        // The documented FAIL action fails (release wave tier1 #4): a FRESH breach
+        // under fail refuses before spawn with the evidence, instead of silently
+        // proceeding into a vendor rejection.
+        throw new Error(`credential profile "${profile.profile_id}" (${harnessId}) is over its headroom threshold ` +
+            `(${breach.constraint_id} at ${Math.round(breach.used_ratio * 100)}% >= ${Math.round(breach.threshold * 100)}%; ` +
+            `limit_action=fail${breach.resets_at ? `; resets ${breach.resets_at}` : ""})`);
+    }
+    if (policy.limit_action !== "rotate")
+        return profile;
+    const next = nextEligibleProfile(registry, harnessId, policy, profile, snapshots, readyProfileIds);
+    if (!next) {
+        emitRotationExhausted({
+            current: profile,
+            harnessId,
+            policy,
+            registry,
+            snapshots,
+            readyProfileIds,
+            reason: "profile_headroom_preflight",
+            emit,
+        });
+        return profile;
+    }
+    emit("route.profile.rotated", {
+        harness_id: harnessId,
+        from_profile_id: profile.profile_id,
+        to_profile_id: next.profile_id,
+        reason: "profile_headroom_preflight",
+        constraint_id: breach.constraint_id,
+        used_ratio: breach.used_ratio,
+        resets_at: breach.resets_at,
+    });
+    return next;
+}
+/**
+ * Default-subject start selection (INV-135, owner scope "auto-balance"): when
+ * NO profile is pinned, the policy is `rotate`, and the DEFAULT store's own
+ * fresh quota window is at/over the headroom bound, pick the first eligible
+ * SUBSCRIPTION profile instead of spawning into a near-certain vendor limit.
+ * Strictly opt-in: `fail`/`ask` keep today's default-user behavior untouched
+ * (the profile engine's fail action governs PINNED profiles only — throwing
+ * here would brick every default user at 90% quota). Unknown or stale usage
+ * never rotates.
+ */
+export function preflightDefaultSubject(args) {
+    const { harnessId, policy, registry, snapshots, readyProfileIds, defaultRoute, emit } = args;
+    if (policy.limit_action !== "rotate" || defaultRoute !== "local_session")
+        return null;
+    const breach = profileHeadroomBreach(snapshots, harnessId, null, policy.headroom_threshold);
+    if (!breach)
+        return null;
+    emit("route.profile.headroom_exceeded", {
+        harness_id: harnessId,
+        profile_id: null,
+        action: policy.limit_action,
+        constraint_id: breach.constraint_id,
+        used_ratio: breach.used_ratio,
+        threshold: breach.threshold,
+        resets_at: breach.resets_at,
+    });
+    const next = nextEligibleProfile(registry, harnessId, policy, null, snapshots, readyProfileIds);
+    if (!next) {
+        emitRotationExhausted({
+            current: null,
+            harnessId,
+            policy,
+            registry,
+            snapshots,
+            readyProfileIds,
+            reason: "profile_headroom_preflight",
+            emit,
+        });
+        return null;
+    }
+    emit("route.profile.rotated", {
+        harness_id: harnessId,
+        from_profile_id: null,
+        to_profile_id: next.profile_id,
+        reason: "profile_headroom_preflight",
+        constraint_id: breach.constraint_id,
+        used_ratio: breach.used_ratio,
+        resets_at: breach.resets_at,
+    });
+    return next;
+}
+/**
+ * Reactive failover plan (`vendor_limit_rejected`, W5.4): rotation fires ONLY
+ * on the typed predicate under a `rotate` policy, marks the current profile
+ * tried (at most once per attempt each), and returns the next target with
+ * provenance already emitted — or null when the attempt must fail as-is.
+ * `currentProfile: null` is the DEFAULT subject: allowed ONLY when the caller
+ * proves the attempt's pre-spawn route was vendor_native (a metered default
+ * hitting a limit is a budget fact, not a subscription to fail over from).
+ */
+export function planReactiveRotation(args) {
+    if (!rotationRetryEligible(args))
+        return null;
+    if (args.policy.limit_action !== "rotate")
+        return null;
+    if (args.currentProfile === null && args.defaultRouteWasVendorNative !== true)
+        return null;
+    if (args.currentProfile)
+        args.triedProfiles.add(args.currentProfile.profile_id);
+    const next = nextEligibleProfile(args.registry, args.harnessId, args.policy, args.currentProfile, args.snapshots, args.readyProfileIds, args.triedProfiles);
+    if (!next) {
+        emitRotationExhausted({
+            current: args.currentProfile,
+            harnessId: args.harnessId,
+            policy: args.policy,
+            registry: args.registry,
+            snapshots: args.snapshots,
+            readyProfileIds: args.readyProfileIds,
+            excluded: args.triedProfiles,
+            attemptId: args.attemptId,
+            reason: "vendor_limit_rejected",
+            emit: args.emit,
+        });
+        return null;
+    }
+    args.emit("route.profile.rotated", {
+        harness_id: args.harnessId,
+        attempt_id: args.attemptId,
+        from_profile_id: args.currentProfile?.profile_id ?? null,
+        to_profile_id: next.profile_id,
+        reason: "vendor_limit_rejected",
+        retry_delay_ms: args.lastLimit?.retryDelayMs ?? null,
+        resets_at: args.lastLimit?.resetsAt ?? null,
+    });
+    return next;
+}
+/**
+ * Shared reactive-failover step for BOTH lanes: given the attempt's typed
+ * evidence, plan a rotation and rebuild the spec on a NEW vendor session
+ * under the next profile — or return null when the attempt must fail as-is.
+ */
+export function rotateSpecOnTypedLimit(args) {
+    const rotation = planReactiveRotation({
+        currentProfile: args.spec.credential_profile ?? null,
+        defaultRouteWasVendorNative: args.defaultRouteWasVendorNative,
+        harnessId: args.harnessId,
+        attemptId: args.attemptId,
+        policy: args.policy,
+        registry: args.registry,
+        snapshots: args.snapshots,
+        readyProfileIds: args.readyProfileIds,
+        triedProfiles: args.triedProfiles,
+        sawTypedLimit: args.sawTypedLimit,
+        deliverableEmpty: args.deliverableEmpty,
+        lastLimit: args.lastLimit,
+        emit: args.emit,
+    });
+    if (!rotation)
+        return null;
+    return HarnessRunSpecSchema.parse({
+        ...args.spec,
+        session_id: args.newSessionId(),
+        credential_profile: rotation,
+        resume_session_id: null,
+    });
+}
+//# sourceMappingURL=credential-profile-rotation.js.map

package/dist/credential-profile-rotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-profile-rotation.js","sourceRoot":"","sources":["../src/credential-profile-rotation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,IAAI,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAgB3E;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAMxC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAC/B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CACtE,CAAC;IACF,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB;aAC1B,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;aAC9D,MAAM,CAAC,CAAC,OAAO,EAAgC,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC;QAC7E,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,GAAG,EAAU,CAAC;IACpD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QAClC,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,CAAC,OAAO,EAAE,UAAU;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,SAAS,CAAC,eAAe,KAAK,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACxF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,SAAS,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAmC,EACnC,SAAiB,EACjB,SAAwB,EACxB,SAAiB;IAEjB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO;YAAE,SAAS;QAC7C,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QACrD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAClE,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;gBACzE,OAAO;oBACL,aAAa,EAAE,UAAU,CAAC,EAAE;oBAC5B,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,SAAS;oBACT,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAsC,EACtC,SAAiB,EACjB,MAAqB,EACrB,OAAyE,EACzE,SAAmC,EACnC,eAAoC,EACpC,QAAQ,GAAwB,IAAI,GAAG,EAAE;IAEzC,KAAK,MAAM,SAAS,IAAI,wBAAwB,CAAC;QAC/C,QAAQ;QACR,SAAS;QACT,MAAM;QACN,OAAO;QACP,QAAQ;KACT,CAAC,EAAE,CAAC;QACH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC;YAAE,SAAS;QACzD,IACE,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,kBAAkB,CAAC;YAE5F,SAAS;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAGrC;IACC,OAAO,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,gBAAgB,CAAC;AACvD,CAAC;AAUD,SAAS,qBAAqB,CAAC,IAW9B;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,GAAG,EAAU,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ;SAC7B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;SAC7E,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,MAAM,MAAM,GAAG,qBAAqB,CAClC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,EACd,OAAO,CAAC,UAAU,EAClB,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAC/B,CAAC;QACF,MAAM,QAAQ,GACZ,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,OAAO,EAAE,UAAU;YAC7C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;gBACtC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC7D,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;oBAChC,CAAC,CAAC,eAAe;oBACjB,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,OAAO,CAAC,eAAe;wBACxE,CAAC,CAAC,0BAA0B;wBAC5B,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;4BAC9D,CAAC,CAAC,0BAA0B;4BAC5B,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;gCAC7C,CAAC,CAAC,WAAW;gCACb,CAAC,CAAC,MAAM;oCACN,CAAC,CAAC,mBAAmB;oCACrB,CAAC,CAAC,cAAc,CAAC;QACjC,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,QAAQ;YACR,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,IAAI,CAAC,IAAI,CAAC,kCAAkC,EAAE;QAC5C,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI;QACjD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;QACzC,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAQ1C;IACC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACxF,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,EACT,SAAS,EACT,OAAO,CAAC,UAAU,EAClB,MAAM,CAAC,kBAAkB,CAC1B,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,CAAC,iCAAiC,EAAE;QACtC,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,MAAM,CAAC,YAAY;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QACnC,2EAA2E;QAC3E,yEAAyE;QACzE,sCAAsC;QACtC,MAAM,IAAI,KAAK,CACb,uBAAuB,OAAO,CAAC,UAAU,MAAM,SAAS,mCAAmC;YACzF,IAAI,MAAM,CAAC,aAAa,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,KAAK;YACjH,oBAAoB,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACrD,MAAM,IAAI,GAAG,mBAAmB,CAC9B,QAAQ,EACR,SAAS,EACT,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,qBAAqB,CAAC;YACpB,OAAO,EAAE,OAAO;YAChB,SAAS;YACT,MAAM;YACN,QAAQ;YACR,SAAS;YACT,eAAe;YACf,MAAM,EAAE,4BAA4B;YACpC,IAAI;SACL,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,uBAAuB,EAAE;QAC5B,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,OAAO,CAAC,UAAU;QACnC,aAAa,EAAE,IAAI,CAAC,UAAU;QAC9B,MAAM,EAAE,4BAA4B;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAQvC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAC7F,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACtF,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5F,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,iCAAiC,EAAE;QACtC,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,MAAM,CAAC,YAAY;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAChG,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,qBAAqB,CAAC;YACpB,OAAO,EAAE,IAAI;YACb,SAAS;YACT,MAAM;YACN,QAAQ;YACR,SAAS;YACT,eAAe;YACf,MAAM,EAAE,4BAA4B;YACpC,IAAI;SACL,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,uBAAuB,EAAE;QAC5B,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,IAAI,CAAC,UAAU;QAC9B,MAAM,EAAE,4BAA4B;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAcpC;IACC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,2BAA2B,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,IAAI,CAAC,cAAc;QAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,mBAAmB,CAC9B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,aAAa,CACnB,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,qBAAqB,CAAC;YACpB,OAAO,EAAE,IAAI,CAAC,cAAc;YAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,QAAQ,EAAE,IAAI,CAAC,aAAa;YAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,uBAAuB;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE;QACjC,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,eAAe,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,IAAI,IAAI;QACxD,aAAa,EAAE,IAAI,CAAC,UAAU;QAC9B,MAAM,EAAE,uBAAuB;QAC/B,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,IAAI,IAAI;QACpD,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,IAAI;KAC5C,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAiBtC;IACC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI;QACpD,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;QAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,oBAAoB,CAAC,KAAK,CAAC;QAChC,GAAG,IAAI,CAAC,IAAI;QACZ,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE;QAC/B,kBAAkB,EAAE,QAAQ;QAC5B,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC"}

package/dist/credential-profiles.d.ts

@@ -1,4 +1,6 @@
-import type { CredentialProfile, HarnessEvent, HarnessRunSpec, QuotaSnapshot } from "@claudexor/schema";
+import type { AuthPreference, AuthSourceReadiness, CredentialProfile, CredentialProfileStatus, HarnessEvent, QuotaSnapshot } from "@claudexor/schema";
+import { type ProfilePolicy } from "./credential-profile-rotation.js";
+export { nextEligibleProfile, planReactiveRotation, preflightCredentialProfile, preflightDefaultSubject, profileHeadroomBreach, rotateSpecOnTypedLimit, rotationRetryEligible, staticRotationCandidates, type ProfilePolicy, } from "./credential-profile-rotation.js";
 /**
  * The ONE resolve owner for credential profiles (INV-135): explicit id →
  * durable registry entry for exactly this harness. Unknown, disabled, or
@@ -10,58 +12,45 @@ export declare function selectedProfileAvailability(input: {
     registry: readonly CredentialProfile[];
     profileId?: string | null;
     harnessId: string;
-    probe?: (profile: CredentialProfile) => Promise<{
-        availability: string;
-        verification: string;
-        detail?: string | null;
-    }>;
+    probe?: (profile: CredentialProfile) => Promise<CredentialProfileStatus>;
 }): Promise<string | null>;
-export interface ProfilePolicy {
-    limit_action: "fail" | "ask" | "rotate";
-    rotation_eligible: string[];
-    headroom_threshold: number;
-}
-/** Typed quota evidence for a profile over its headroom bound (provenance). */
-export interface HeadroomBreach {
-    constraint_id: string;
-    used_ratio: number;
-    threshold: number;
-    resets_at: string | null;
-}
-/**
- * Proactive headroom check (W5.4 `profile_headroom_preflight`): the SELECTED
- * profile's freshest snapshot windows against the policy threshold. Unknown
- * usage is NOT a breach — rotation never triggers on missing data.
- */
-export declare function profileHeadroomBreach(snapshots: readonly QuotaSnapshot[], harnessId: string, profileId: string | null, threshold: number): HeadroomBreach | null;
-/**
- * The next rotation target after `currentProfileId` (W5.4): policy order wins
- * (`rotation_eligible`), else every enabled profile of the harness in registry
- * order. The current profile and disabled/unknown ids never come back; a
- * profile already over the headroom bound is skipped (rotating INTO a spent
- * subscription is not a failover). Cross-subscription rotation of one vendor
- * is allowed by owner decision — but rotation NEVER crosses credential kinds
- * (release wave round-16 BLOCK): a subscription→API-key swap silently changes
- * the payment model mid-attempt, and the attempt's first-wins auth-route
- * receipt (decided once before spawn) would misvalue metered usage as
- * subscription entitlement, bypassing a finite cash cap.
- */
-export declare function nextEligibleProfile(registry: readonly CredentialProfile[], harnessId: string, policy: ProfilePolicy, current: Pick<CredentialProfile, "profile_id" | "credential_kind"> | null, snapshots: readonly QuotaSnapshot[], excluded?: ReadonlySet<string>): CredentialProfile | null;
+/** One readiness predicate shared by run admission and accounts projection. */
+export declare function profileStatusAdmits(profile: Pick<CredentialProfile, "credential_kind">, result: {
+    availability: string;
+    verification: string;
+}): boolean;
+/** One fail-closed profile doctor wrapper shared by Accounts and runtime
+ * selection. Probe failures are readiness facts, never selector exceptions. */
+export declare function probeCredentialProfileStatus(profile: CredentialProfile, probe?: (profile: CredentialProfile) => Promise<CredentialProfileStatus>): Promise<CredentialProfileStatus>;
+/** Same precedence used by run admission: the first explicit route wins;
+ * `auto` means fall through rather than shadow a more general setting. */
+export declare function effectiveAuthPreference(...values: Array<AuthPreference | null | undefined>): AuthPreference;
+/** Fresh effective route for the unprofiled/default subject in Accounts. The
+ * gateway status proves aggregate intent readiness; the schema auth estimator
+ * then chooses the exact usable source under the same configured preference as
+ * run admission. Returning the route (not merely a bool) keeps next_up labels
+ * truthful when a native-capable harness falls back to an API key. */
+export declare function defaultCredentialRoute(status: {
+    status: "ok" | "degraded" | "unavailable";
+    routableIntents: readonly unknown[];
+    authSources: readonly AuthSourceReadiness[];
+}, requested: AuthPreference): "local_session" | "api_key" | null;
 /** The informational identity an UNPINNED run of a harness would route to next
  * (INV-135 `next_up`) — the same routing owner that admits and rotates runs,
  * exposed for the accounts projection so no surface re-derives it. Never gates
  * routing: explicit control is a per-run `--profile` / per-thread pin.
  *
  * Semantics mirror run-time admission: an unpinned run's default subject is the
- * native/CLI login when it participates in the ladder; enabled profiles route
+ * unprofiled/default credential when it participates in the ladder; enabled profiles route
  * only by explicit pin or, under `rotate`, as the quota-failover target when the
- * native default is already over headroom. A disabled CLI login leaves an
+ * default subject is already over headroom. A disabled default leaves an
  * unpinned run with nothing routable. */
 export type NextUpIdentity = {
     kind: "profile";
     profileId: string;
 } | {
     kind: "native";
+    route: "local_session" | "api_key";
 } | {
     kind: "none";
     reason: string;
@@ -71,76 +60,14 @@ export declare function nextUpIdentity(args: {
     harnessId: string;
     policy: ProfilePolicy;
     snapshots: readonly QuotaSnapshot[];
-    nativeEnabled: boolean;
+    defaultEnabled: boolean;
+    /** Fresh doctor/admission truth for the unprofiled default subject. */
+    defaultReady: boolean;
+    /** Effective source route of that default subject under configured auth preference. */
+    defaultRoute: "local_session" | "api_key" | null;
+    /** Profiles admitted by their fresh profile doctor probe in this snapshot. */
+    readyProfileIds: ReadonlySet<string>;
 }): NextUpIdentity;
-/**
- * `rotation_retry_eligible` (sol #30): a failover retry is allowed ONLY when
- * the attempt saw a TYPED vendor limit AND produced no deliverable and no
- * workspace mutation — a partially-acted attempt never silently reruns.
- */
-export declare function rotationRetryEligible(input: {
-    sawTypedLimit: boolean;
-    deliverableEmpty: boolean;
-}): boolean;
-type EmitFn = (type: "route.profile.headroom_exceeded" | "route.profile.rotated" | "route.profile.rotation_exhausted", payload: Record<string, unknown>) => void;
-/**
- * `profile_headroom_preflight` (W5.4): BEFORE spawn, the selected profile's
- * freshest quota windows are checked against the policy threshold. A breach
- * is always a typed event; `rotate` swaps to the next eligible profile with
- * provenance, `ask`/`fail` proceed on the selected profile — the runtime
- * `vendor_limit_rejected` evidence stays the terminating truth.
- */
-export declare function preflightCredentialProfile(args: {
-    profile: CredentialProfile;
-    harnessId: string;
-    policy: ProfilePolicy;
-    registry: readonly CredentialProfile[];
-    snapshots: readonly QuotaSnapshot[];
-    emit: EmitFn;
-}): CredentialProfile;
-/**
- * Default-subject start selection (INV-135, owner scope "auto-balance"): when
- * NO profile is pinned, the policy is `rotate`, and the DEFAULT store's own
- * fresh quota window is at/over the headroom bound, pick the first eligible
- * SUBSCRIPTION profile instead of spawning into a near-certain vendor limit.
- * Strictly opt-in: `fail`/`ask` keep today's default-user behavior untouched
- * (the profile engine's fail action governs PINNED profiles only — throwing
- * here would brick every default user at 90% quota). Unknown or stale usage
- * never rotates.
- */
-export declare function preflightDefaultSubject(args: {
-    harnessId: string;
-    policy: ProfilePolicy;
-    registry: readonly CredentialProfile[];
-    snapshots: readonly QuotaSnapshot[];
-    emit: EmitFn;
-}): CredentialProfile | null;
-/**
- * Reactive failover plan (`vendor_limit_rejected`, W5.4): rotation fires ONLY
- * on the typed predicate under a `rotate` policy, marks the current profile
- * tried (at most once per attempt each), and returns the next target with
- * provenance already emitted — or null when the attempt must fail as-is.
- * `currentProfile: null` is the DEFAULT subject: allowed ONLY when the caller
- * proves the attempt's pre-spawn route was vendor_native (a metered default
- * hitting a limit is a budget fact, not a subscription to fail over from).
- */
-export declare function planReactiveRotation(args: {
-    currentProfile: CredentialProfile | null;
-    defaultRouteWasVendorNative?: boolean;
-    harnessId: string;
-    attemptId: string;
-    policy: ProfilePolicy;
-    registry: readonly CredentialProfile[];
-    snapshots: readonly QuotaSnapshot[];
-    triedProfiles: Set<string>;
-    sawTypedLimit: boolean;
-    deliverableEmpty: boolean;
-    lastLimit: {
-        retryDelayMs: number | null;
-        resetsAt: string | null;
-    } | null;
-    emit: EmitFn;
-}): CredentialProfile | null;
 /**
  * INV-135 at the engine boundary: a cached vendor session resumes ONLY under
  * exactly the profile it was recorded with (null-default equality included) —
@@ -159,30 +86,4 @@ export declare function resumeSessionForProfile(cached: {
 export declare function observeNativeSessionEvent(input: {
     onSessionObserved?: (harnessId: string, nativeSessionId: string, observedModel?: string | null, profileId?: string | null) => void;
 } | undefined, harnessId: string, ev: HarnessEvent): void;
-/**
- * Shared reactive-failover step for BOTH lanes: given the attempt's typed
- * evidence, plan a rotation and rebuild the spec on a NEW vendor session
- * under the next profile — or return null when the attempt must fail as-is.
- */
-export declare function rotateSpecOnTypedLimit(args: {
-    spec: HarnessRunSpec;
-    harnessId: string;
-    attemptId: string;
-    policy: ProfilePolicy;
-    registry: readonly CredentialProfile[];
-    snapshots: readonly QuotaSnapshot[];
-    triedProfiles: Set<string>;
-    sawTypedLimit: boolean;
-    deliverableEmpty: boolean;
-    lastLimit: {
-        retryDelayMs: number | null;
-        resetsAt: string | null;
-    } | null;
-    emit: EmitFn;
-    newSessionId: () => string;
-    /** Pre-spawn route estimate for a profile-less spec: default-subject
-     * rotation is allowed ONLY off a vendor_native attempt. */
-    defaultRouteWasVendorNative?: boolean;
-}): HarnessRunSpec | null;
-export {};
 //# sourceMappingURL=credential-profiles.d.ts.map

package/dist/credential-profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-profiles.d.ts","sourceRoot":"","sources":["../src/credential-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,aAAa,EACd,MAAM,mBAAmB,CAAC;AAG3B;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,iBAAiB,CASnB;AAED,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC;QAC9C,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,CAAC,CAAC;CACJ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBzB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IACxC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,SAAS,EAAE,MAAM,GAChB,cAAc,GAAG,IAAI,CAmBvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,iBAAiB,CAAC,GAAG,IAAI,EACzE,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,iBAAiB,GAAG,IAAI,CA2B1B;AAED;;;;;;;;;yCASyC;AACzC,MAAM,MAAM,cAAc,GACxB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,aAAa,EAAE,OAAO,CAAC;CACxB,GAAG,cAAc,CAmBjB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAEV;AAED,KAAK,MAAM,GAAG,CACZ,IAAI,EACA,iCAAiC,GACjC,uBAAuB,GACvB,kCAAkC,EACtC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,IAAI,CAAC;AAuDV;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,iBAAiB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,CAoDpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,GAAG,IAAI,CAqC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,cAAc,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACzC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,GAAG,IAAI,CAqC3B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,SAAS,EACnE,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAChC,MAAM,GAAG,IAAI,CAGf;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EACD;IACE,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,KACtB,IAAI,CAAC;CACX,GACD,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,YAAY,GACf,IAAI,CAeN;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B;+DAC2D;IAC3D,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,GAAG,cAAc,GAAG,IAAI,CAsBxB"}
+{"version":3,"file":"credential-profiles.d.ts","sourceRoot":"","sources":["../src/credential-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EACZ,aAAa,EACd,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,KAAK,aAAa,GACnB,MAAM,kCAAkC,CAAC;AAE1C;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,iBAAiB,CASnB;AAED,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC1E,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAazB;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EACnD,MAAM,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACrD,OAAO,CAKT;AAED;+EAC+E;AAC/E,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,iBAAiB,EAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,uBAAuB,CAAC,GACvE,OAAO,CAAC,uBAAuB,CAAC,CAgClC;AAED;0EAC0E;AAC1E,wBAAgB,uBAAuB,CACrC,GAAG,MAAM,EAAE,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,SAAS,CAAC,GAClD,cAAc,CAIhB;AAED;;;;sEAIsE;AACtE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE;IACN,MAAM,EAAE,IAAI,GAAG,UAAU,GAAG,aAAa,CAAC;IAC1C,eAAe,EAAE,SAAS,OAAO,EAAE,CAAC;IACpC,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC7C,EACD,SAAS,EAAE,cAAc,GACxB,eAAe,GAAG,SAAS,GAAG,IAAI,CAGpC;AAED;;;;;;;;;yCASyC;AACzC,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,cAAc,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,YAAY,EAAE,OAAO,CAAC;IACtB,uFAAuF;IACvF,YAAY,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC;IACjD,8EAA8E;IAC9E,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACtC,GAAG,cAAc,CA+CjB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,SAAS,EACnE,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAChC,MAAM,GAAG,IAAI,CAGf;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EACD;IACE,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,KACtB,IAAI,CAAC;CACX,GACD,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,YAAY,GACf,IAAI,CAeN"}