@claudexor/orchestrator 3.1.1 → 3.2.0

package/dist/credential-profiles.js

@@ -1,4 +1,8 @@
-import { HarnessRunSpec as HarnessRunSpecSchema } from "@claudexor/schema";
+import { CredentialProfileStatus as CredentialProfileStatusSchema } from "@claudexor/schema";
+import { redactSecrets } from "@claudexor/util";
+import { estimateEffectiveAuthRoute } from "@claudexor/schema";
+import { nextEligibleProfile, profileHeadroomBreach, } from "./credential-profile-rotation.js";
+export { nextEligibleProfile, planReactiveRotation, preflightCredentialProfile, preflightDefaultSubject, profileHeadroomBreach, rotateSpecOnTypedLimit, rotationRetryEligible, staticRotationCandidates, } from "./credential-profile-rotation.js";
 /**
  * The ONE resolve owner for credential profiles (INV-135): explicit id →
  * durable registry entry for exactly this harness. Unknown, disabled, or
@@ -27,295 +31,98 @@ export async function selectedProfileAvailability(input) {
     }
     if (!input.probe)
         return `harness "${input.harnessId}" has no profile probe`;
-    const result = await input.probe(profile);
-    const verificationAdmits = result.verification === "passed" ||
-        (profile.credential_kind === "api_key" && result.verification === "not_run");
-    return result.availability === "available" && verificationAdmits
+    const result = await probeCredentialProfileStatus(profile, input.probe);
+    return profileStatusAdmits(profile, result)
         ? "available"
         : (result.detail ?? `${result.availability}/${result.verification}`);
 }
-/**
- * Proactive headroom check (W5.4 `profile_headroom_preflight`): the SELECTED
- * profile's freshest snapshot windows against the policy threshold. Unknown
- * usage is NOT a breach — rotation never triggers on missing data.
- */
-export function profileHeadroomBreach(snapshots, harnessId, profileId, threshold) {
-    for (const snapshot of snapshots) {
-        // FRESH evidence only (release wave tier1 #3): a stale or unknown reading
-        // must never breach headroom, rotate a profile away, or fail selection.
-        if (snapshot.freshness !== "fresh")
-            continue;
-        if (snapshot.subject.harness !== harnessId)
-            continue;
-        if ((snapshot.subject.subject_id ?? null) !== profileId)
-            continue;
-        for (const constraint of snapshot.constraints) {
-            if (constraint.used_ratio !== null && constraint.used_ratio >= threshold) {
-                return {
-                    constraint_id: constraint.id,
-                    used_ratio: constraint.used_ratio,
-                    threshold,
-                    resets_at: constraint.resets_at,
-                };
-            }
+/** One readiness predicate shared by run admission and accounts projection. */
+export function profileStatusAdmits(profile, result) {
+    const verificationAdmits = result.verification === "passed" ||
+        (profile.credential_kind === "api_key" && result.verification === "not_run");
+    return result.availability === "available" && verificationAdmits;
+}
+/** One fail-closed profile doctor wrapper shared by Accounts and runtime
+ * selection. Probe failures are readiness facts, never selector exceptions. */
+export async function probeCredentialProfileStatus(profile, probe) {
+    if (!probe) {
+        return {
+            profile_id: profile.profile_id,
+            harness_id: profile.harness_id,
+            availability: "unknown",
+            verification: "not_run",
+            detail: `harness "${profile.harness_id}" has no profile probe`,
+            last_verified_at: null,
+        };
+    }
+    try {
+        const result = CredentialProfileStatusSchema.parse(await probe(profile));
+        if (result.profile_id !== profile.profile_id || result.harness_id !== profile.harness_id) {
+            throw new Error("profile readiness probe returned status for a different profile");
         }
+        return {
+            ...result,
+            ...(result.detail === undefined ? {} : { detail: redactSecrets(result.detail) }),
+        };
     }
-    return null;
-}
-/**
- * The next rotation target after `currentProfileId` (W5.4): policy order wins
- * (`rotation_eligible`), else every enabled profile of the harness in registry
- * order. The current profile and disabled/unknown ids never come back; a
- * profile already over the headroom bound is skipped (rotating INTO a spent
- * subscription is not a failover). Cross-subscription rotation of one vendor
- * is allowed by owner decision — but rotation NEVER crosses credential kinds
- * (release wave round-16 BLOCK): a subscription→API-key swap silently changes
- * the payment model mid-attempt, and the attempt's first-wins auth-route
- * receipt (decided once before spawn) would misvalue metered usage as
- * subscription entitlement, bypassing a finite cash cap.
- */
-export function nextEligibleProfile(registry, harnessId, policy, current, snapshots, excluded = new Set()) {
-    const pool = registry.filter((p) => p.harness_id === harnessId && p.enabled);
-    const ordered = policy.rotation_eligible.length > 0
-        ? policy.rotation_eligible
-            .map((id) => pool.find((p) => p.profile_id === id))
-            .filter((p) => p !== undefined)
-        : pool;
-    for (const candidate of ordered) {
-        if (candidate.profile_id === current?.profile_id)
-            continue;
-        if (excluded.has(candidate.profile_id))
-            continue;
-        // Fail-CLOSED kind guard (round-17 hardening of the round-16 BLOCK): the
-        // kind comes from the TYPED current profile in hand — never re-found in
-        // a freshly reloaded pool, where a mid-flight disable/remove of the
-        // current profile would have silently dropped the cross-kind prohibition.
-        if (current !== null && candidate.credential_kind !== current.credential_kind)
-            continue;
-        // `current === null` is the DEFAULT subject (the vendor-native store): the
-        // same round-16 BLOCK applies — rotating the subscription default INTO an
-        // api_key profile would silently change the payment model mid-attempt.
-        if (current === null && candidate.credential_kind === "api_key")
-            continue;
-        if (profileHeadroomBreach(snapshots, harnessId, candidate.profile_id, policy.headroom_threshold))
-            continue;
-        return candidate;
+    catch (error) {
+        return {
+            profile_id: profile.profile_id,
+            harness_id: profile.harness_id,
+            availability: "unknown",
+            verification: "not_run",
+            detail: `profile readiness probe failed: ${redactSecrets(error instanceof Error ? error.message : String(error))}`,
+            last_verified_at: null,
+        };
     }
-    return null;
+}
+/** Same precedence used by run admission: the first explicit route wins;
+ * `auto` means fall through rather than shadow a more general setting. */
+export function effectiveAuthPreference(...values) {
+    return (values.find((value) => value !== undefined && value !== null && value !== "auto") ?? "auto");
+}
+/** Fresh effective route for the unprofiled/default subject in Accounts. The
+ * gateway status proves aggregate intent readiness; the schema auth estimator
+ * then chooses the exact usable source under the same configured preference as
+ * run admission. Returning the route (not merely a bool) keeps next_up labels
+ * truthful when a native-capable harness falls back to an API key. */
+export function defaultCredentialRoute(status, requested) {
+    if (status.status !== "ok" || status.routableIntents.length === 0)
+        return null;
+    return estimateEffectiveAuthRoute(requested, status.authSources);
 }
 export function nextUpIdentity(args) {
-    const { registry, harnessId, policy, snapshots, nativeEnabled } = args;
-    if (!nativeEnabled) {
+    const { registry, harnessId, policy, snapshots, defaultEnabled, defaultReady, defaultRoute, readyProfileIds, } = args;
+    if (!defaultEnabled) {
         return {
             kind: "none",
-            reason: "the CLI login is disabled; pin an account per-run (--profile) or per-thread",
+            reason: "the default credential is disabled; enable it or pin an account per-run (--profile)",
+        };
+    }
+    if (!defaultReady) {
+        return {
+            kind: "none",
+            reason: "the default credential is not ready; refresh Accounts or run `claudexor doctor`",
         };
     }
     // Under `rotate`, a native/default subject already over its headroom bound
     // fails over to the next eligible enabled profile BEFORE spawn — that is who
     // an unpinned run routes to next. `ask`/`fail` proceed on the native default.
-    if (policy.limit_action === "rotate") {
+    if (policy.limit_action === "rotate" && defaultRoute === "local_session") {
         const breach = profileHeadroomBreach(snapshots, harnessId, null, policy.headroom_threshold);
         if (breach) {
-            const next = nextEligibleProfile(registry, harnessId, policy, null, snapshots);
+            const next = nextEligibleProfile(registry, harnessId, policy, null, snapshots, readyProfileIds);
             if (next)
                 return { kind: "profile", profileId: next.profile_id };
         }
     }
-    return { kind: "native" };
-}
-/**
- * `rotation_retry_eligible` (sol #30): a failover retry is allowed ONLY when
- * the attempt saw a TYPED vendor limit AND produced no deliverable and no
- * workspace mutation — a partially-acted attempt never silently reruns.
- */
-export function rotationRetryEligible(input) {
-    return input.sawTypedLimit && input.deliverableEmpty;
-}
-function emitRotationExhausted(args) {
-    const excluded = args.excluded ?? new Set();
-    const candidates = args.registry
-        .filter((profile) => profile.harness_id === args.harnessId && profile.enabled)
-        .map((profile) => {
-        const breach = profileHeadroomBreach(args.snapshots, args.harnessId, profile.profile_id, args.policy.headroom_threshold);
-        const rejected = profile.profile_id === args.current?.profile_id
-            ? "current"
-            : args.policy.rotation_eligible.length > 0 &&
-                !args.policy.rotation_eligible.includes(profile.profile_id)
-                ? "not_in_rotation_policy"
-                : excluded.has(profile.profile_id)
-                    ? "already_tried"
-                    : args.current && profile.credential_kind !== args.current.credential_kind
-                        ? "credential_kind_mismatch"
-                        : args.current === null && profile.credential_kind === "api_key"
-                            ? "credential_kind_mismatch"
-                            : breach
-                                ? "headroom_exceeded"
-                                : "not_selected";
+    if (!defaultRoute) {
         return {
-            profile_id: profile.profile_id,
-            credential_kind: profile.credential_kind,
-            rejected,
-            headroom: breach,
+            kind: "none",
+            reason: "the default credential route is unknown; refresh Accounts or run `claudexor doctor`",
         };
-    });
-    args.emit("route.profile.rotation_exhausted", {
-        harness_id: args.harnessId,
-        attempt_id: args.attemptId,
-        from_profile_id: args.current?.profile_id ?? null,
-        reason: args.reason,
-        threshold: args.policy.headroom_threshold,
-        candidates,
-    });
-}
-/**
- * `profile_headroom_preflight` (W5.4): BEFORE spawn, the selected profile's
- * freshest quota windows are checked against the policy threshold. A breach
- * is always a typed event; `rotate` swaps to the next eligible profile with
- * provenance, `ask`/`fail` proceed on the selected profile — the runtime
- * `vendor_limit_rejected` evidence stays the terminating truth.
- */
-export function preflightCredentialProfile(args) {
-    const { profile, harnessId, policy, registry, snapshots, emit } = args;
-    const breach = profileHeadroomBreach(snapshots, harnessId, profile.profile_id, policy.headroom_threshold);
-    if (!breach)
-        return profile;
-    emit("route.profile.headroom_exceeded", {
-        harness_id: harnessId,
-        profile_id: profile.profile_id,
-        action: policy.limit_action,
-        constraint_id: breach.constraint_id,
-        used_ratio: breach.used_ratio,
-        threshold: breach.threshold,
-        resets_at: breach.resets_at,
-    });
-    if (policy.limit_action === "fail") {
-        // The documented FAIL action fails (release wave tier1 #4): a FRESH breach
-        // under fail refuses before spawn with the evidence, instead of silently
-        // proceeding into a vendor rejection.
-        throw new Error(`credential profile "${profile.profile_id}" (${harnessId}) is over its headroom threshold ` +
-            `(${breach.constraint_id} at ${Math.round(breach.used_ratio * 100)}% >= ${Math.round(breach.threshold * 100)}%; ` +
-            `limit_action=fail${breach.resets_at ? `; resets ${breach.resets_at}` : ""})`);
-    }
-    if (policy.limit_action !== "rotate")
-        return profile;
-    const next = nextEligibleProfile(registry, harnessId, policy, profile, snapshots);
-    if (!next) {
-        emitRotationExhausted({
-            current: profile,
-            harnessId,
-            policy,
-            registry,
-            snapshots,
-            reason: "profile_headroom_preflight",
-            emit,
-        });
-        return profile;
-    }
-    emit("route.profile.rotated", {
-        harness_id: harnessId,
-        from_profile_id: profile.profile_id,
-        to_profile_id: next.profile_id,
-        reason: "profile_headroom_preflight",
-        constraint_id: breach.constraint_id,
-        used_ratio: breach.used_ratio,
-        resets_at: breach.resets_at,
-    });
-    return next;
-}
-/**
- * Default-subject start selection (INV-135, owner scope "auto-balance"): when
- * NO profile is pinned, the policy is `rotate`, and the DEFAULT store's own
- * fresh quota window is at/over the headroom bound, pick the first eligible
- * SUBSCRIPTION profile instead of spawning into a near-certain vendor limit.
- * Strictly opt-in: `fail`/`ask` keep today's default-user behavior untouched
- * (the profile engine's fail action governs PINNED profiles only — throwing
- * here would brick every default user at 90% quota). Unknown or stale usage
- * never rotates.
- */
-export function preflightDefaultSubject(args) {
-    const { harnessId, policy, registry, snapshots, emit } = args;
-    if (policy.limit_action !== "rotate")
-        return null;
-    const breach = profileHeadroomBreach(snapshots, harnessId, null, policy.headroom_threshold);
-    if (!breach)
-        return null;
-    emit("route.profile.headroom_exceeded", {
-        harness_id: harnessId,
-        profile_id: null,
-        action: policy.limit_action,
-        constraint_id: breach.constraint_id,
-        used_ratio: breach.used_ratio,
-        threshold: breach.threshold,
-        resets_at: breach.resets_at,
-    });
-    const next = nextEligibleProfile(registry, harnessId, policy, null, snapshots);
-    if (!next) {
-        emitRotationExhausted({
-            current: null,
-            harnessId,
-            policy,
-            registry,
-            snapshots,
-            reason: "profile_headroom_preflight",
-            emit,
-        });
-        return null;
-    }
-    emit("route.profile.rotated", {
-        harness_id: harnessId,
-        from_profile_id: null,
-        to_profile_id: next.profile_id,
-        reason: "profile_headroom_preflight",
-        constraint_id: breach.constraint_id,
-        used_ratio: breach.used_ratio,
-        resets_at: breach.resets_at,
-    });
-    return next;
-}
-/**
- * Reactive failover plan (`vendor_limit_rejected`, W5.4): rotation fires ONLY
- * on the typed predicate under a `rotate` policy, marks the current profile
- * tried (at most once per attempt each), and returns the next target with
- * provenance already emitted — or null when the attempt must fail as-is.
- * `currentProfile: null` is the DEFAULT subject: allowed ONLY when the caller
- * proves the attempt's pre-spawn route was vendor_native (a metered default
- * hitting a limit is a budget fact, not a subscription to fail over from).
- */
-export function planReactiveRotation(args) {
-    if (!rotationRetryEligible(args))
-        return null;
-    if (args.policy.limit_action !== "rotate")
-        return null;
-    if (args.currentProfile === null && args.defaultRouteWasVendorNative !== true)
-        return null;
-    if (args.currentProfile)
-        args.triedProfiles.add(args.currentProfile.profile_id);
-    const next = nextEligibleProfile(args.registry, args.harnessId, args.policy, args.currentProfile, args.snapshots, args.triedProfiles);
-    if (!next) {
-        emitRotationExhausted({
-            current: args.currentProfile,
-            harnessId: args.harnessId,
-            policy: args.policy,
-            registry: args.registry,
-            snapshots: args.snapshots,
-            excluded: args.triedProfiles,
-            attemptId: args.attemptId,
-            reason: "vendor_limit_rejected",
-            emit: args.emit,
-        });
-        return null;
     }
-    args.emit("route.profile.rotated", {
-        harness_id: args.harnessId,
-        attempt_id: args.attemptId,
-        from_profile_id: args.currentProfile?.profile_id ?? null,
-        to_profile_id: next.profile_id,
-        reason: "vendor_limit_rejected",
-        retry_delay_ms: args.lastLimit?.retryDelayMs ?? null,
-        resets_at: args.lastLimit?.resetsAt ?? null,
-    });
-    return next;
+    return { kind: "native", route: defaultRoute };
 }
 /**
  * INV-135 at the engine boundary: a cached vendor session resumes ONLY under
@@ -346,33 +153,4 @@ export function observeNativeSessionEvent(input, harnessId, ev) {
         }
     }
 }
-/**
- * Shared reactive-failover step for BOTH lanes: given the attempt's typed
- * evidence, plan a rotation and rebuild the spec on a NEW vendor session
- * under the next profile — or return null when the attempt must fail as-is.
- */
-export function rotateSpecOnTypedLimit(args) {
-    const rotation = planReactiveRotation({
-        currentProfile: args.spec.credential_profile ?? null,
-        defaultRouteWasVendorNative: args.defaultRouteWasVendorNative,
-        harnessId: args.harnessId,
-        attemptId: args.attemptId,
-        policy: args.policy,
-        registry: args.registry,
-        snapshots: args.snapshots,
-        triedProfiles: args.triedProfiles,
-        sawTypedLimit: args.sawTypedLimit,
-        deliverableEmpty: args.deliverableEmpty,
-        lastLimit: args.lastLimit,
-        emit: args.emit,
-    });
-    if (!rotation)
-        return null;
-    return HarnessRunSpecSchema.parse({
-        ...args.spec,
-        session_id: args.newSessionId(),
-        credential_profile: rotation,
-        resume_session_id: null,
-    });
-}
 //# sourceMappingURL=credential-profiles.js.map

package/dist/credential-profiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-profiles.js","sourceRoot":"","sources":["../src/credential-profiles.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,IAAI,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAE3E;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAsC,EACtC,MAAc,EACd,SAAiB;IAEjB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;IAC1F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,oCAAoC,SAAS,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,MAAM,SAAS,eAAe,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KASjD;IACC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,YAAY,KAAK,CAAC,SAAS,wBAAwB,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,kBAAkB,GACtB,MAAM,CAAC,YAAY,KAAK,QAAQ;QAChC,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,IAAI,kBAAkB;QAC9D,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;AACzE,CAAC;AAgBD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAmC,EACnC,SAAiB,EACjB,SAAwB,EACxB,SAAiB;IAEjB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO;YAAE,SAAS;QAC7C,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QACrD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAClE,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;gBACzE,OAAO;oBACL,aAAa,EAAE,UAAU,CAAC,EAAE;oBAC5B,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,SAAS;oBACT,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAsC,EACtC,SAAiB,EACjB,MAAqB,EACrB,OAAyE,EACzE,SAAmC,EACnC,WAAgC,IAAI,GAAG,EAAE;IAEzC,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7E,MAAM,OAAO,GACX,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;QACjC,CAAC,CAAC,MAAM,CAAC,iBAAiB;aACrB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;aAClD,MAAM,CAAC,CAAC,CAAC,EAA0B,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;QAC3D,CAAC,CAAC,IAAI,CAAC;IACX,KAAK,MAAM,SAAS,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,SAAS,CAAC,UAAU,KAAK,OAAO,EAAE,UAAU;YAAE,SAAS;QAC3D,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC;YAAE,SAAS;QACjD,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1E,IAAI,OAAO,KAAK,IAAI,IAAI,SAAS,CAAC,eAAe,KAAK,OAAO,CAAC,eAAe;YAAE,SAAS;QACxF,2EAA2E;QAC3E,0EAA0E;QAC1E,uEAAuE;QACvE,IAAI,OAAO,KAAK,IAAI,IAAI,SAAS,CAAC,eAAe,KAAK,SAAS;YAAE,SAAS;QAC1E,IACE,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,kBAAkB,CAAC;YAE5F,SAAS;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAeD,MAAM,UAAU,cAAc,CAAC,IAM9B;IACC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;IACvE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,6EAA6E;SACtF,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC5F,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAC/E,IAAI,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAGrC;IACC,OAAO,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,gBAAgB,CAAC;AACvD,CAAC;AAUD,SAAS,qBAAqB,CAAC,IAU9B;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,GAAG,EAAU,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ;SAC7B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;SAC7E,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,MAAM,MAAM,GAAG,qBAAqB,CAClC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,EACd,OAAO,CAAC,UAAU,EAClB,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAC/B,CAAC;QACF,MAAM,QAAQ,GACZ,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,OAAO,EAAE,UAAU;YAC7C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;gBACtC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC7D,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;oBAChC,CAAC,CAAC,eAAe;oBACjB,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,OAAO,CAAC,eAAe;wBACxE,CAAC,CAAC,0BAA0B;wBAC5B,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;4BAC9D,CAAC,CAAC,0BAA0B;4BAC5B,CAAC,CAAC,MAAM;gCACN,CAAC,CAAC,mBAAmB;gCACrB,CAAC,CAAC,cAAc,CAAC;QAC/B,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,QAAQ;YACR,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,IAAI,CAAC,IAAI,CAAC,kCAAkC,EAAE;QAC5C,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI;QACjD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;QACzC,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAO1C;IACC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACvE,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,EACT,SAAS,EACT,OAAO,CAAC,UAAU,EAClB,MAAM,CAAC,kBAAkB,CAC1B,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,CAAC,iCAAiC,EAAE;QACtC,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,MAAM,CAAC,YAAY;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QACnC,2EAA2E;QAC3E,yEAAyE;QACzE,sCAAsC;QACtC,MAAM,IAAI,KAAK,CACb,uBAAuB,OAAO,CAAC,UAAU,MAAM,SAAS,mCAAmC;YACzF,IAAI,MAAM,CAAC,aAAa,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,KAAK;YACjH,oBAAoB,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACrD,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAClF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,qBAAqB,CAAC;YACpB,OAAO,EAAE,OAAO;YAChB,SAAS;YACT,MAAM;YACN,QAAQ;YACR,SAAS;YACT,MAAM,EAAE,4BAA4B;YACpC,IAAI;SACL,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,uBAAuB,EAAE;QAC5B,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,OAAO,CAAC,UAAU;QACnC,aAAa,EAAE,IAAI,CAAC,UAAU;QAC9B,MAAM,EAAE,4BAA4B;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAC9D,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5F,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,iCAAiC,EAAE;QACtC,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,MAAM,CAAC,YAAY;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/E,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,qBAAqB,CAAC;YACpB,OAAO,EAAE,IAAI;YACb,SAAS;YACT,MAAM;YACN,QAAQ;YACR,SAAS;YACT,MAAM,EAAE,4BAA4B;YACpC,IAAI;SACL,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,uBAAuB,EAAE;QAC5B,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,IAAI,CAAC,UAAU;QAC9B,MAAM,EAAE,4BAA4B;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAapC;IACC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,2BAA2B,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,IAAI,CAAC,cAAc;QAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,mBAAmB,CAC9B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,aAAa,CACnB,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,qBAAqB,CAAC;YACpB,OAAO,EAAE,IAAI,CAAC,cAAc;YAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,aAAa;YAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,uBAAuB;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE;QACjC,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,eAAe,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,IAAI,IAAI;QACxD,aAAa,EAAE,IAAI,CAAC,UAAU;QAC9B,MAAM,EAAE,uBAAuB;QAC/B,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,IAAI,IAAI;QACpD,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,IAAI;KAC5C,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAmE,EACnE,OAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,KASa,EACb,SAAiB,EACjB,EAAgB;IAEhB,IAAI,CAAC,KAAK,EAAE,iBAAiB,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/D,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,KAAK,CAAC,iBAAiB,CACrB,SAAS,EACT,GAAG,EACH,EAAE,CAAC,cAAc,IAAI,IAAI,EACzB,EAAE,CAAC,qBAAqB,IAAI,IAAI,CACjC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAgBtC;IACC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI;QACpD,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;QAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,oBAAoB,CAAC,KAAK,CAAC;QAChC,GAAG,IAAI,CAAC,IAAI;QACZ,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE;QAC/B,kBAAkB,EAAE,QAAQ;QAC5B,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"credential-profiles.js","sourceRoot":"","sources":["../src/credential-profiles.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,uBAAuB,IAAI,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,mBAAmB,EACnB,qBAAqB,GAEtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,GAEzB,MAAM,kCAAkC,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAsC,EACtC,MAAc,EACd,SAAiB;IAEjB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC;IAC1F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,oCAAoC,SAAS,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,uBAAuB,MAAM,MAAM,SAAS,eAAe,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,KAKjD;IACC,IAAI,CAAC,KAAK,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,OAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACvF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,YAAY,KAAK,CAAC,SAAS,wBAAwB,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACxE,OAAO,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC;QACzC,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,mBAAmB,CACjC,OAAmD,EACnD,MAAsD;IAEtD,MAAM,kBAAkB,GACtB,MAAM,CAAC,YAAY,KAAK,QAAQ;QAChC,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC;IAC/E,OAAO,MAAM,CAAC,YAAY,KAAK,WAAW,IAAI,kBAAkB,CAAC;AACnE,CAAC;AAED;+EAC+E;AAC/E,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,OAA0B,EAC1B,KAAwE;IAExE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,MAAM,EAAE,YAAY,OAAO,CAAC,UAAU,wBAAwB;YAC9D,gBAAgB,EAAE,IAAI;SACvB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU,EAAE,CAAC;YACzF,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO;YACL,GAAG,MAAM;YACT,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;SACjF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,YAAY,EAAE,SAAS;YACvB,YAAY,EAAE,SAAS;YACvB,MAAM,EAAE,mCAAmC,aAAa,CACtD,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,EAAE;YACH,gBAAgB,EAAE,IAAI;SACvB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,uBAAuB,CACrC,GAAG,MAAgD;IAEnD,OAAO,CACL,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,MAAM,CAAC,IAAI,MAAM,CAC5F,CAAC;AACJ,CAAC;AAED;;;;sEAIsE;AACtE,MAAM,UAAU,sBAAsB,CACpC,MAIC,EACD,SAAyB;IAEzB,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO,0BAA0B,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAiBD,MAAM,UAAU,cAAc,CAAC,IAY9B;IACC,MAAM,EACJ,QAAQ,EACR,SAAS,EACT,MAAM,EACN,SAAS,EACT,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,GAAG,IAAI,CAAC;IACT,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,qFAAqF;SAC9F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,iFAAiF;SAC1F,CAAC;IACJ,CAAC;IACD,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,eAAe,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC5F,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,mBAAmB,CAC9B,QAAQ,EACR,SAAS,EACT,MAAM,EACN,IAAI,EACJ,SAAS,EACT,eAAe,CAChB,CAAC;YACF,IAAI,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,qFAAqF;SAC9F,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAmE,EACnE,OAAiC;IAEjC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AAChG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACvC,KASa,EACb,SAAiB,EACjB,EAAgB;IAEhB,IAAI,CAAC,KAAK,EAAE,iBAAiB,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO;IAC/D,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC9C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,KAAK,CAAC,iBAAiB,CACrB,SAAS,EACT,GAAG,EACH,EAAE,CAAC,cAAc,IAAI,IAAI,EACzB,EAAE,CAAC,qBAAqB,IAAI,IAAI,CACjC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/decisionBudget.d.ts

@@ -0,0 +1,43 @@
+import type { ArtifactStore } from "@claudexor/artifact-store";
+import type { BudgetLedger } from "@claudexor/budget";
+import { type RunOutcomeFacts } from "@claudexor/schema";
+export interface SettledBudgetSnapshot {
+    spendUsd: number | null;
+    valuationUsd: number | null;
+    estimated: boolean;
+    valuationKnowledge: "exact" | "estimated" | "unknown";
+}
+interface BudgetSnapshotSource {
+    spend?: () => number;
+    valuation?: () => number;
+    spendEstimated?: () => boolean;
+    valuationKnowledge?: () => "exact" | "estimated" | "unknown";
+}
+export declare function settledBudgetSnapshot(source: BudgetSnapshotSource): SettledBudgetSnapshot;
+/** Reconcile a Delegate family's post-drain cash/valuation truth without
+ * stripping forward-compatible decision extensions. */
+export declare function reconcileDecisionBudget(context: {
+    store: ArtifactStore;
+    paths: {
+        arbitrationDir: string;
+    };
+}, budget: SettledBudgetSnapshot, terminal?: {
+    facts: RunOutcomeFacts;
+    why: string;
+}): void;
+export declare function decisionBudgetSummary(ledger: BudgetLedger): {
+    readonly spend_usd: number;
+    readonly estimated: boolean;
+    readonly cash_usd: number;
+    readonly valuation_usd: number;
+    readonly valuation_knowledge: "estimated" | "exact" | "unknown";
+};
+export declare function arbitrationBudgetOptions(ledger: BudgetLedger): {
+    readonly spendUsd: number;
+    readonly estimatedSpend: boolean;
+    readonly cashUsd: number;
+    readonly valuationUsd: number;
+    readonly valuationKnowledge: "estimated" | "exact" | "unknown";
+};
+export {};
+//# sourceMappingURL=decisionBudget.d.ts.map

package/dist/decisionBudget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisionBudget.d.ts","sourceRoot":"","sources":["../src/decisionBudget.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEzE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,OAAO,CAAC;IACnB,kBAAkB,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;CACvD;AAED,UAAU,oBAAoB;IAC5B,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;IAC/B,kBAAkB,CAAC,EAAE,MAAM,OAAO,GAAG,WAAW,GAAG,SAAS,CAAC;CAC9D;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,GAAG,qBAAqB,CA2BzF;AAED;uDACuD;AACvD,wBAAgB,uBAAuB,CACrC,OAAO,EAAE;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACpE,MAAM,EAAE,qBAAqB,EAC7B,QAAQ,CAAC,EAAE;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GACjD,IAAI,CA6BN;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,YAAY;aAEtD,SAAS;aACT,SAAS;aACT,QAAQ;aACR,aAAa;aACb,mBAAmB;EAEtB;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,YAAY;aAEzD,QAAQ;aACR,cAAc;aACd,OAAO;aACP,YAAY;aACZ,kBAAkB;EAErB"}

package/dist/decisionBudget.js

@@ -0,0 +1,84 @@
+import { join } from "node:path";
+import { DecisionRecord } from "@claudexor/schema";
+export function settledBudgetSnapshot(source) {
+    const read = (value) => {
+        try {
+            const result = value?.();
+            return typeof result === "number" && Number.isFinite(result) ? result : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    let estimated = false;
+    let valuationKnowledge = "unknown";
+    try {
+        estimated = source.spendEstimated?.() === true;
+    }
+    catch {
+        estimated = true;
+    }
+    try {
+        valuationKnowledge = source.valuationKnowledge?.() ?? "unknown";
+    }
+    catch {
+        valuationKnowledge = "unknown";
+    }
+    return {
+        spendUsd: read(source.spend),
+        valuationUsd: read(source.valuation),
+        estimated,
+        valuationKnowledge,
+    };
+}
+/** Reconcile a Delegate family's post-drain cash/valuation truth without
+ * stripping forward-compatible decision extensions. */
+export function reconcileDecisionBudget(context, budget, terminal) {
+    const path = join(context.paths.arbitrationDir, "decision.yaml");
+    const current = context.store.readYaml(path);
+    if (!current || typeof current !== "object" || Array.isArray(current))
+        return;
+    const record = current;
+    const priorBudget = record["budget_summary"] && typeof record["budget_summary"] === "object"
+        ? record["budget_summary"]
+        : {};
+    const reconciled = {
+        ...record,
+        ...(terminal
+            ? {
+                facts: terminal.facts,
+                why_winner: terminal.why,
+                apply_recommendation: "continue",
+            }
+            : {}),
+        budget_summary: {
+            ...priorBudget,
+            spend_usd: budget.spendUsd,
+            cash_usd: budget.spendUsd,
+            valuation_usd: budget.valuationUsd,
+            estimated: budget.estimated,
+            valuation_knowledge: budget.valuationKnowledge,
+        },
+    };
+    DecisionRecord.parse(reconciled);
+    context.store.writeYaml(path, reconciled);
+}
+export function decisionBudgetSummary(ledger) {
+    return {
+        spend_usd: ledger.spend(),
+        estimated: ledger.estimated(),
+        cash_usd: ledger.spend(),
+        valuation_usd: ledger.valuation(),
+        valuation_knowledge: ledger.valuationKnowledge(),
+    };
+}
+export function arbitrationBudgetOptions(ledger) {
+    return {
+        spendUsd: ledger.spend(),
+        estimatedSpend: ledger.estimated(),
+        cashUsd: ledger.spend(),
+        valuationUsd: ledger.valuation(),
+        valuationKnowledge: ledger.valuationKnowledge(),
+    };
+}
+//# sourceMappingURL=decisionBudget.js.map

package/dist/decisionBudget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisionBudget.js","sourceRoot":"","sources":["../src/decisionBudget.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,cAAc,EAAwB,MAAM,mBAAmB,CAAC;AAgBzE,MAAM,UAAU,qBAAqB,CAAC,MAA4B;IAChE,MAAM,IAAI,GAAG,CAAC,KAAiC,EAAiB,EAAE;QAChE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,KAAK,EAAE,EAAE,CAAC;YACzB,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC,CAAC;IACF,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,kBAAkB,GAAsC,SAAS,CAAC;IACtE,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,cAAc,EAAE,EAAE,KAAK,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,IAAI,CAAC;QACH,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,EAAE,EAAE,IAAI,SAAS,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB,GAAG,SAAS,CAAC;IACjC,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QACpC,SAAS;QACT,kBAAkB;KACnB,CAAC;AACJ,CAAC;AAED;uDACuD;AACvD,MAAM,UAAU,uBAAuB,CACrC,OAAoE,EACpE,MAA6B,EAC7B,QAAkD;IAElD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAU,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO;IAC9E,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,WAAW,GACf,MAAM,CAAC,gBAAgB,CAAC,IAAI,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,QAAQ;QACtE,CAAC,CAAE,MAAM,CAAC,gBAAgB,CAA6B;QACvD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,UAAU,GAAG;QACjB,GAAG,MAAM;QACT,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC;gBACE,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,UAAU,EAAE,QAAQ,CAAC,GAAG;gBACxB,oBAAoB,EAAE,UAAU;aACjC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,cAAc,EAAE;YACd,GAAG,WAAW;YACd,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,mBAAmB,EAAE,MAAM,CAAC,kBAAkB;SAC/C;KACF,CAAC;IACF,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAoB;IACxD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,KAAK,EAAE;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;QAC7B,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE;QACxB,aAAa,EAAE,MAAM,CAAC,SAAS,EAAE;QACjC,mBAAmB,EAAE,MAAM,CAAC,kBAAkB,EAAE;KACxC,CAAC;AACb,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAoB;IAC3D,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE;QACxB,cAAc,EAAE,MAAM,CAAC,SAAS,EAAE;QAClC,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE;QACvB,YAAY,EAAE,MAAM,CAAC,SAAS,EAAE;QAChC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE;KACvC,CAAC;AACb,CAAC"}

package/dist/decisionTerminalReconciliation.d.ts

@@ -0,0 +1,18 @@
+import type { ArtifactStore } from "@claudexor/artifact-store";
+import { type RunOutcomeFacts } from "@claudexor/schema";
+/** The terminal guard owns only the terminal truth of an already-valid
+ * decision. Ordinary strategies own their winner, review/check evidence,
+ * budget, and recommendation; an escaped failure/cancel must not rewrite
+ * those fields, but leaving a succeeded decision beside a failed lifecycle
+ * would make Control project contradictory outcome facts. */
+export declare function reconcileDecisionTerminal(context: {
+    store: ArtifactStore;
+    paths: {
+        arbitrationDir: string;
+    };
+}, terminal: {
+    facts: RunOutcomeFacts;
+    why: string;
+    preparedFacts?: RunOutcomeFacts;
+}): RunOutcomeFacts;
+//# sourceMappingURL=decisionTerminalReconciliation.d.ts.map

package/dist/decisionTerminalReconciliation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisionTerminalReconciliation.d.ts","sourceRoot":"","sources":["../src/decisionTerminalReconciliation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAGzE;;;;6DAI6D;AAC7D,wBAAgB,yBAAyB,CACvC,OAAO,EAAE;IAAE,KAAK,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE;QAAE,cAAc,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACpE,QAAQ,EAAE;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,eAAe,CAAA;CAAE,GACjF,eAAe,CAoBjB"}

package/dist/decisionTerminalReconciliation.js

@@ -0,0 +1,26 @@
+import { join } from "node:path";
+import { DecisionRecord } from "@claudexor/schema";
+import { terminalOutcomeFacts } from "./terminalOutcome.js";
+/** The terminal guard owns only the terminal truth of an already-valid
+ * decision. Ordinary strategies own their winner, review/check evidence,
+ * budget, and recommendation; an escaped failure/cancel must not rewrite
+ * those fields, but leaving a succeeded decision beside a failed lifecycle
+ * would make Control project contradictory outcome facts. */
+export function reconcileDecisionTerminal(context, terminal) {
+    const path = join(context.paths.arbitrationDir, "decision.yaml");
+    const current = context.store.readYaml(path);
+    const parsed = DecisionRecord.safeParse(current);
+    if (!parsed.success || !current || typeof current !== "object" || Array.isArray(current)) {
+        return terminal.facts;
+    }
+    const facts = terminalOutcomeFacts(terminal.preparedFacts ?? parsed.data.facts, terminal.facts.lifecycle, terminal.facts.reason);
+    const reconciled = {
+        ...current,
+        facts,
+        why_winner: terminal.why,
+    };
+    DecisionRecord.parse(reconciled);
+    context.store.writeYaml(path, reconciled);
+    return facts;
+}
+//# sourceMappingURL=decisionTerminalReconciliation.js.map

package/dist/decisionTerminalReconciliation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisionTerminalReconciliation.js","sourceRoot":"","sources":["../src/decisionTerminalReconciliation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAwB,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D;;;;6DAI6D;AAC7D,MAAM,UAAU,yBAAyB,CACvC,OAAoE,EACpE,QAAkF;IAElF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAU,IAAI,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACzF,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC;IACD,MAAM,KAAK,GAAG,oBAAoB,CAChC,QAAQ,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAC3C,QAAQ,CAAC,KAAK,CAAC,SAAS,EACxB,QAAQ,CAAC,KAAK,CAAC,MAAM,CACtB,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,GAAI,OAAmC;QACvC,KAAK;QACL,UAAU,EAAE,QAAQ,CAAC,GAAG;KACzB,CAAC;IACF,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC;AACf,CAAC"}