@claudexor/orchestrator 3.1.2 → 3.2.0

package/dist/credential-profile-rotation.d.ts

@@ -0,0 +1,145 @@
+import type { CredentialProfile, HarnessRunSpec, QuotaSnapshot } from "@claudexor/schema";
+export interface ProfilePolicy {
+    limit_action: "fail" | "ask" | "rotate";
+    rotation_eligible: string[];
+    headroom_threshold: number;
+}
+/** Typed quota evidence for a profile over its headroom bound (provenance). */
+export interface HeadroomBreach {
+    constraint_id: string;
+    used_ratio: number;
+    threshold: number;
+    resets_at: string | null;
+}
+/**
+ * Static rotation candidates, before any credential-backed readiness probe.
+ * One owner applies policy order, enabled/harness scope, current identity,
+ * already-tried exclusions, and the payment-kind fence. Callers then probe
+ * only identities that could actually be selected.
+ */
+export declare function staticRotationCandidates(args: {
+    registry: readonly CredentialProfile[];
+    harnessId: string;
+    policy: ProfilePolicy;
+    current: Pick<CredentialProfile, "profile_id" | "credential_kind"> | null;
+    excluded?: ReadonlySet<string>;
+}): CredentialProfile[];
+/**
+ * Proactive headroom check (W5.4 `profile_headroom_preflight`): the SELECTED
+ * profile's freshest snapshot windows against the policy threshold. Unknown
+ * usage is NOT a breach — rotation never triggers on missing data.
+ */
+export declare function profileHeadroomBreach(snapshots: readonly QuotaSnapshot[], harnessId: string, profileId: string | null, threshold: number): HeadroomBreach | null;
+/**
+ * The next rotation target after `currentProfileId` (W5.4): policy order wins
+ * (`rotation_eligible`), else every enabled profile of the harness in registry
+ * order. The current profile and disabled/unknown ids never come back; a
+ * profile already over the headroom bound is skipped (rotating INTO a spent
+ * subscription is not a failover). Cross-subscription rotation of one vendor
+ * is allowed by owner decision — but rotation NEVER crosses credential kinds
+ * (release wave round-16 BLOCK): a subscription→API-key swap silently changes
+ * the payment model mid-attempt, and the attempt's first-wins auth-route
+ * receipt (decided once before spawn) would misvalue metered usage as
+ * subscription entitlement, bypassing a finite cash cap.
+ */
+export declare function nextEligibleProfile(registry: readonly CredentialProfile[], harnessId: string, policy: ProfilePolicy, current: Pick<CredentialProfile, "profile_id" | "credential_kind"> | null, snapshots: readonly QuotaSnapshot[], readyProfileIds: ReadonlySet<string>, excluded?: ReadonlySet<string>): CredentialProfile | null;
+/**
+ * `rotation_retry_eligible` (sol #30): a failover retry is allowed ONLY when
+ * the attempt saw a TYPED vendor limit AND produced no deliverable and no
+ * workspace mutation — a partially-acted attempt never silently reruns.
+ */
+export declare function rotationRetryEligible(input: {
+    sawTypedLimit: boolean;
+    deliverableEmpty: boolean;
+}): boolean;
+type EmitFn = (type: "route.profile.headroom_exceeded" | "route.profile.rotated" | "route.profile.rotation_exhausted", payload: Record<string, unknown>) => void;
+/**
+ * `profile_headroom_preflight` (W5.4): BEFORE spawn, the selected profile's
+ * freshest quota windows are checked against the policy threshold. A breach
+ * is always a typed event; `rotate` swaps to the next eligible profile with
+ * provenance, `ask`/`fail` proceed on the selected profile — the runtime
+ * `vendor_limit_rejected` evidence stays the terminating truth.
+ */
+export declare function preflightCredentialProfile(args: {
+    profile: CredentialProfile;
+    harnessId: string;
+    policy: ProfilePolicy;
+    registry: readonly CredentialProfile[];
+    snapshots: readonly QuotaSnapshot[];
+    readyProfileIds: ReadonlySet<string>;
+    emit: EmitFn;
+}): CredentialProfile;
+/**
+ * Default-subject start selection (INV-135, owner scope "auto-balance"): when
+ * NO profile is pinned, the policy is `rotate`, and the DEFAULT store's own
+ * fresh quota window is at/over the headroom bound, pick the first eligible
+ * SUBSCRIPTION profile instead of spawning into a near-certain vendor limit.
+ * Strictly opt-in: `fail`/`ask` keep today's default-user behavior untouched
+ * (the profile engine's fail action governs PINNED profiles only — throwing
+ * here would brick every default user at 90% quota). Unknown or stale usage
+ * never rotates.
+ */
+export declare function preflightDefaultSubject(args: {
+    harnessId: string;
+    policy: ProfilePolicy;
+    registry: readonly CredentialProfile[];
+    snapshots: readonly QuotaSnapshot[];
+    readyProfileIds: ReadonlySet<string>;
+    defaultRoute: "local_session" | "api_key" | null;
+    emit: EmitFn;
+}): CredentialProfile | null;
+/**
+ * Reactive failover plan (`vendor_limit_rejected`, W5.4): rotation fires ONLY
+ * on the typed predicate under a `rotate` policy, marks the current profile
+ * tried (at most once per attempt each), and returns the next target with
+ * provenance already emitted — or null when the attempt must fail as-is.
+ * `currentProfile: null` is the DEFAULT subject: allowed ONLY when the caller
+ * proves the attempt's pre-spawn route was vendor_native (a metered default
+ * hitting a limit is a budget fact, not a subscription to fail over from).
+ */
+export declare function planReactiveRotation(args: {
+    currentProfile: CredentialProfile | null;
+    defaultRouteWasVendorNative?: boolean;
+    harnessId: string;
+    attemptId: string;
+    policy: ProfilePolicy;
+    registry: readonly CredentialProfile[];
+    snapshots: readonly QuotaSnapshot[];
+    readyProfileIds: ReadonlySet<string>;
+    triedProfiles: Set<string>;
+    sawTypedLimit: boolean;
+    deliverableEmpty: boolean;
+    lastLimit: {
+        retryDelayMs: number | null;
+        resetsAt: string | null;
+    } | null;
+    emit: EmitFn;
+}): CredentialProfile | null;
+/**
+ * Shared reactive-failover step for BOTH lanes: given the attempt's typed
+ * evidence, plan a rotation and rebuild the spec on a NEW vendor session
+ * under the next profile — or return null when the attempt must fail as-is.
+ */
+export declare function rotateSpecOnTypedLimit(args: {
+    spec: HarnessRunSpec;
+    harnessId: string;
+    attemptId: string;
+    policy: ProfilePolicy;
+    registry: readonly CredentialProfile[];
+    snapshots: readonly QuotaSnapshot[];
+    readyProfileIds: ReadonlySet<string>;
+    triedProfiles: Set<string>;
+    sawTypedLimit: boolean;
+    deliverableEmpty: boolean;
+    lastLimit: {
+        retryDelayMs: number | null;
+        resetsAt: string | null;
+    } | null;
+    emit: EmitFn;
+    newSessionId: () => string;
+    /** Pre-spawn route estimate for a profile-less spec: default-subject
+     * rotation is allowed ONLY off a vendor_native attempt. */
+    defaultRouteWasVendorNative?: boolean;
+}): HarnessRunSpec | null;
+export {};
+//# sourceMappingURL=credential-profile-rotation.d.ts.map

package/dist/credential-profile-rotation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-profile-rotation.d.ts","sourceRoot":"","sources":["../src/credential-profile-rotation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAG1F,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IACxC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,iBAAiB,CAAC,GAAG,IAAI,CAAC;IAC1E,QAAQ,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChC,GAAG,iBAAiB,EAAE,CAsBtB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,SAAS,EAAE,MAAM,GAChB,cAAc,GAAG,IAAI,CAmBvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,iBAAiB,CAAC,GAAG,IAAI,EACzE,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,iBAAiB,GAAG,IAAI,CAgB1B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAEV;AAED,KAAK,MAAM,GAAG,CACZ,IAAI,EACA,iCAAiC,GACjC,uBAAuB,GACvB,kCAAkC,EACtC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,IAAI,CAAC;AA0DV;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,iBAAiB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,CA4DpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,YAAY,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,GAAG,IAAI,CAsC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,cAAc,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACzC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,GAAG,IAAI,CAuC3B;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B;+DAC2D;IAC3D,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,GAAG,cAAc,GAAG,IAAI,CAuBxB"}

package/dist/credential-profile-rotation.js

@@ -0,0 +1,315 @@
+import { HarnessRunSpec as HarnessRunSpecSchema } from "@claudexor/schema";
+/**
+ * Static rotation candidates, before any credential-backed readiness probe.
+ * One owner applies policy order, enabled/harness scope, current identity,
+ * already-tried exclusions, and the payment-kind fence. Callers then probe
+ * only identities that could actually be selected.
+ */
+export function staticRotationCandidates(args) {
+    const pool = args.registry.filter((profile) => profile.harness_id === args.harnessId && profile.enabled);
+    const ordered = args.policy.rotation_eligible.length > 0
+        ? args.policy.rotation_eligible
+            .map((id) => pool.find((profile) => profile.profile_id === id))
+            .filter((profile) => profile !== undefined)
+        : pool;
+    const excluded = args.excluded ?? new Set();
+    return ordered.filter((candidate) => {
+        if (candidate.profile_id === args.current?.profile_id)
+            return false;
+        if (excluded.has(candidate.profile_id))
+            return false;
+        if (args.current !== null && candidate.credential_kind !== args.current.credential_kind) {
+            return false;
+        }
+        // The default subject is vendor-native subscription state; it never probes
+        // or rotates into a metered API-key identity.
+        if (args.current === null && candidate.credential_kind === "api_key")
+            return false;
+        return true;
+    });
+}
+/**
+ * Proactive headroom check (W5.4 `profile_headroom_preflight`): the SELECTED
+ * profile's freshest snapshot windows against the policy threshold. Unknown
+ * usage is NOT a breach — rotation never triggers on missing data.
+ */
+export function profileHeadroomBreach(snapshots, harnessId, profileId, threshold) {
+    for (const snapshot of snapshots) {
+        // FRESH evidence only (release wave tier1 #3): a stale or unknown reading
+        // must never breach headroom, rotate a profile away, or fail selection.
+        if (snapshot.freshness !== "fresh")
+            continue;
+        if (snapshot.subject.harness !== harnessId)
+            continue;
+        if ((snapshot.subject.subject_id ?? null) !== profileId)
+            continue;
+        for (const constraint of snapshot.constraints) {
+            if (constraint.used_ratio !== null && constraint.used_ratio >= threshold) {
+                return {
+                    constraint_id: constraint.id,
+                    used_ratio: constraint.used_ratio,
+                    threshold,
+                    resets_at: constraint.resets_at,
+                };
+            }
+        }
+    }
+    return null;
+}
+/**
+ * The next rotation target after `currentProfileId` (W5.4): policy order wins
+ * (`rotation_eligible`), else every enabled profile of the harness in registry
+ * order. The current profile and disabled/unknown ids never come back; a
+ * profile already over the headroom bound is skipped (rotating INTO a spent
+ * subscription is not a failover). Cross-subscription rotation of one vendor
+ * is allowed by owner decision — but rotation NEVER crosses credential kinds
+ * (release wave round-16 BLOCK): a subscription→API-key swap silently changes
+ * the payment model mid-attempt, and the attempt's first-wins auth-route
+ * receipt (decided once before spawn) would misvalue metered usage as
+ * subscription entitlement, bypassing a finite cash cap.
+ */
+export function nextEligibleProfile(registry, harnessId, policy, current, snapshots, readyProfileIds, excluded = new Set()) {
+    for (const candidate of staticRotationCandidates({
+        registry,
+        harnessId,
+        policy,
+        current,
+        excluded,
+    })) {
+        if (!readyProfileIds.has(candidate.profile_id))
+            continue;
+        if (profileHeadroomBreach(snapshots, harnessId, candidate.profile_id, policy.headroom_threshold))
+            continue;
+        return candidate;
+    }
+    return null;
+}
+/**
+ * `rotation_retry_eligible` (sol #30): a failover retry is allowed ONLY when
+ * the attempt saw a TYPED vendor limit AND produced no deliverable and no
+ * workspace mutation — a partially-acted attempt never silently reruns.
+ */
+export function rotationRetryEligible(input) {
+    return input.sawTypedLimit && input.deliverableEmpty;
+}
+function emitRotationExhausted(args) {
+    const excluded = args.excluded ?? new Set();
+    const candidates = args.registry
+        .filter((profile) => profile.harness_id === args.harnessId && profile.enabled)
+        .map((profile) => {
+        const breach = profileHeadroomBreach(args.snapshots, args.harnessId, profile.profile_id, args.policy.headroom_threshold);
+        const rejected = profile.profile_id === args.current?.profile_id
+            ? "current"
+            : args.policy.rotation_eligible.length > 0 &&
+                !args.policy.rotation_eligible.includes(profile.profile_id)
+                ? "not_in_rotation_policy"
+                : excluded.has(profile.profile_id)
+                    ? "already_tried"
+                    : args.current && profile.credential_kind !== args.current.credential_kind
+                        ? "credential_kind_mismatch"
+                        : args.current === null && profile.credential_kind === "api_key"
+                            ? "credential_kind_mismatch"
+                            : !args.readyProfileIds.has(profile.profile_id)
+                                ? "not_ready"
+                                : breach
+                                    ? "headroom_exceeded"
+                                    : "not_selected";
+        return {
+            profile_id: profile.profile_id,
+            credential_kind: profile.credential_kind,
+            rejected,
+            headroom: breach,
+        };
+    });
+    args.emit("route.profile.rotation_exhausted", {
+        harness_id: args.harnessId,
+        attempt_id: args.attemptId,
+        from_profile_id: args.current?.profile_id ?? null,
+        reason: args.reason,
+        threshold: args.policy.headroom_threshold,
+        candidates,
+    });
+}
+/**
+ * `profile_headroom_preflight` (W5.4): BEFORE spawn, the selected profile's
+ * freshest quota windows are checked against the policy threshold. A breach
+ * is always a typed event; `rotate` swaps to the next eligible profile with
+ * provenance, `ask`/`fail` proceed on the selected profile — the runtime
+ * `vendor_limit_rejected` evidence stays the terminating truth.
+ */
+export function preflightCredentialProfile(args) {
+    const { profile, harnessId, policy, registry, snapshots, readyProfileIds, emit } = args;
+    const breach = profileHeadroomBreach(snapshots, harnessId, profile.profile_id, policy.headroom_threshold);
+    if (!breach)
+        return profile;
+    emit("route.profile.headroom_exceeded", {
+        harness_id: harnessId,
+        profile_id: profile.profile_id,
+        action: policy.limit_action,
+        constraint_id: breach.constraint_id,
+        used_ratio: breach.used_ratio,
+        threshold: breach.threshold,
+        resets_at: breach.resets_at,
+    });
+    if (policy.limit_action === "fail") {
+        // The documented FAIL action fails (release wave tier1 #4): a FRESH breach
+        // under fail refuses before spawn with the evidence, instead of silently
+        // proceeding into a vendor rejection.
+        throw new Error(`credential profile "${profile.profile_id}" (${harnessId}) is over its headroom threshold ` +
+            `(${breach.constraint_id} at ${Math.round(breach.used_ratio * 100)}% >= ${Math.round(breach.threshold * 100)}%; ` +
+            `limit_action=fail${breach.resets_at ? `; resets ${breach.resets_at}` : ""})`);
+    }
+    if (policy.limit_action !== "rotate")
+        return profile;
+    const next = nextEligibleProfile(registry, harnessId, policy, profile, snapshots, readyProfileIds);
+    if (!next) {
+        emitRotationExhausted({
+            current: profile,
+            harnessId,
+            policy,
+            registry,
+            snapshots,
+            readyProfileIds,
+            reason: "profile_headroom_preflight",
+            emit,
+        });
+        return profile;
+    }
+    emit("route.profile.rotated", {
+        harness_id: harnessId,
+        from_profile_id: profile.profile_id,
+        to_profile_id: next.profile_id,
+        reason: "profile_headroom_preflight",
+        constraint_id: breach.constraint_id,
+        used_ratio: breach.used_ratio,
+        resets_at: breach.resets_at,
+    });
+    return next;
+}
+/**
+ * Default-subject start selection (INV-135, owner scope "auto-balance"): when
+ * NO profile is pinned, the policy is `rotate`, and the DEFAULT store's own
+ * fresh quota window is at/over the headroom bound, pick the first eligible
+ * SUBSCRIPTION profile instead of spawning into a near-certain vendor limit.
+ * Strictly opt-in: `fail`/`ask` keep today's default-user behavior untouched
+ * (the profile engine's fail action governs PINNED profiles only — throwing
+ * here would brick every default user at 90% quota). Unknown or stale usage
+ * never rotates.
+ */
+export function preflightDefaultSubject(args) {
+    const { harnessId, policy, registry, snapshots, readyProfileIds, defaultRoute, emit } = args;
+    if (policy.limit_action !== "rotate" || defaultRoute !== "local_session")
+        return null;
+    const breach = profileHeadroomBreach(snapshots, harnessId, null, policy.headroom_threshold);
+    if (!breach)
+        return null;
+    emit("route.profile.headroom_exceeded", {
+        harness_id: harnessId,
+        profile_id: null,
+        action: policy.limit_action,
+        constraint_id: breach.constraint_id,
+        used_ratio: breach.used_ratio,
+        threshold: breach.threshold,
+        resets_at: breach.resets_at,
+    });
+    const next = nextEligibleProfile(registry, harnessId, policy, null, snapshots, readyProfileIds);
+    if (!next) {
+        emitRotationExhausted({
+            current: null,
+            harnessId,
+            policy,
+            registry,
+            snapshots,
+            readyProfileIds,
+            reason: "profile_headroom_preflight",
+            emit,
+        });
+        return null;
+    }
+    emit("route.profile.rotated", {
+        harness_id: harnessId,
+        from_profile_id: null,
+        to_profile_id: next.profile_id,
+        reason: "profile_headroom_preflight",
+        constraint_id: breach.constraint_id,
+        used_ratio: breach.used_ratio,
+        resets_at: breach.resets_at,
+    });
+    return next;
+}
+/**
+ * Reactive failover plan (`vendor_limit_rejected`, W5.4): rotation fires ONLY
+ * on the typed predicate under a `rotate` policy, marks the current profile
+ * tried (at most once per attempt each), and returns the next target with
+ * provenance already emitted — or null when the attempt must fail as-is.
+ * `currentProfile: null` is the DEFAULT subject: allowed ONLY when the caller
+ * proves the attempt's pre-spawn route was vendor_native (a metered default
+ * hitting a limit is a budget fact, not a subscription to fail over from).
+ */
+export function planReactiveRotation(args) {
+    if (!rotationRetryEligible(args))
+        return null;
+    if (args.policy.limit_action !== "rotate")
+        return null;
+    if (args.currentProfile === null && args.defaultRouteWasVendorNative !== true)
+        return null;
+    if (args.currentProfile)
+        args.triedProfiles.add(args.currentProfile.profile_id);
+    const next = nextEligibleProfile(args.registry, args.harnessId, args.policy, args.currentProfile, args.snapshots, args.readyProfileIds, args.triedProfiles);
+    if (!next) {
+        emitRotationExhausted({
+            current: args.currentProfile,
+            harnessId: args.harnessId,
+            policy: args.policy,
+            registry: args.registry,
+            snapshots: args.snapshots,
+            readyProfileIds: args.readyProfileIds,
+            excluded: args.triedProfiles,
+            attemptId: args.attemptId,
+            reason: "vendor_limit_rejected",
+            emit: args.emit,
+        });
+        return null;
+    }
+    args.emit("route.profile.rotated", {
+        harness_id: args.harnessId,
+        attempt_id: args.attemptId,
+        from_profile_id: args.currentProfile?.profile_id ?? null,
+        to_profile_id: next.profile_id,
+        reason: "vendor_limit_rejected",
+        retry_delay_ms: args.lastLimit?.retryDelayMs ?? null,
+        resets_at: args.lastLimit?.resetsAt ?? null,
+    });
+    return next;
+}
+/**
+ * Shared reactive-failover step for BOTH lanes: given the attempt's typed
+ * evidence, plan a rotation and rebuild the spec on a NEW vendor session
+ * under the next profile — or return null when the attempt must fail as-is.
+ */
+export function rotateSpecOnTypedLimit(args) {
+    const rotation = planReactiveRotation({
+        currentProfile: args.spec.credential_profile ?? null,
+        defaultRouteWasVendorNative: args.defaultRouteWasVendorNative,
+        harnessId: args.harnessId,
+        attemptId: args.attemptId,
+        policy: args.policy,
+        registry: args.registry,
+        snapshots: args.snapshots,
+        readyProfileIds: args.readyProfileIds,
+        triedProfiles: args.triedProfiles,
+        sawTypedLimit: args.sawTypedLimit,
+        deliverableEmpty: args.deliverableEmpty,
+        lastLimit: args.lastLimit,
+        emit: args.emit,
+    });
+    if (!rotation)
+        return null;
+    return HarnessRunSpecSchema.parse({
+        ...args.spec,
+        session_id: args.newSessionId(),
+        credential_profile: rotation,
+        resume_session_id: null,
+    });
+}
+//# sourceMappingURL=credential-profile-rotation.js.map

package/dist/credential-profile-rotation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-profile-rotation.js","sourceRoot":"","sources":["../src/credential-profile-rotation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,IAAI,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAgB3E;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAMxC;IACC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAC/B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CACtE,CAAC;IACF,MAAM,OAAO,GACX,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB;aAC1B,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC;aAC9D,MAAM,CAAC,CAAC,OAAO,EAAgC,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC;QAC7E,CAAC,CAAC,IAAI,CAAC;IACX,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,GAAG,EAAU,CAAC;IACpD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QAClC,IAAI,SAAS,CAAC,UAAU,KAAK,IAAI,CAAC,OAAO,EAAE,UAAU;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,SAAS,CAAC,eAAe,KAAK,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YACxF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,SAAS,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAmC,EACnC,SAAiB,EACjB,SAAwB,EACxB,SAAiB;IAEjB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO;YAAE,SAAS;QAC7C,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QACrD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,SAAS;QAClE,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YAC9C,IAAI,UAAU,CAAC,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,IAAI,SAAS,EAAE,CAAC;gBACzE,OAAO;oBACL,aAAa,EAAE,UAAU,CAAC,EAAE;oBAC5B,UAAU,EAAE,UAAU,CAAC,UAAU;oBACjC,SAAS;oBACT,SAAS,EAAE,UAAU,CAAC,SAAS;iBAChC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAsC,EACtC,SAAiB,EACjB,MAAqB,EACrB,OAAyE,EACzE,SAAmC,EACnC,eAAoC,EACpC,QAAQ,GAAwB,IAAI,GAAG,EAAE;IAEzC,KAAK,MAAM,SAAS,IAAI,wBAAwB,CAAC;QAC/C,QAAQ;QACR,SAAS;QACT,MAAM;QACN,OAAO;QACP,QAAQ;KACT,CAAC,EAAE,CAAC;QACH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC;YAAE,SAAS;QACzD,IACE,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC,kBAAkB,CAAC;YAE5F,SAAS;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAGrC;IACC,OAAO,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,gBAAgB,CAAC;AACvD,CAAC;AAUD,SAAS,qBAAqB,CAAC,IAW9B;IACC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,GAAG,EAAU,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ;SAC7B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;SAC7E,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,MAAM,MAAM,GAAG,qBAAqB,CAClC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,SAAS,EACd,OAAO,CAAC,UAAU,EAClB,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAC/B,CAAC;QACF,MAAM,QAAQ,GACZ,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,OAAO,EAAE,UAAU;YAC7C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC;gBACtC,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC;gBAC7D,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;oBAChC,CAAC,CAAC,eAAe;oBACjB,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,OAAO,CAAC,eAAe;wBACxE,CAAC,CAAC,0BAA0B;wBAC5B,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;4BAC9D,CAAC,CAAC,0BAA0B;4BAC5B,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;gCAC7C,CAAC,CAAC,WAAW;gCACb,CAAC,CAAC,MAAM;oCACN,CAAC,CAAC,mBAAmB;oCACrB,CAAC,CAAC,cAAc,CAAC;QACjC,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,eAAe,EAAE,OAAO,CAAC,eAAe;YACxC,QAAQ;YACR,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,IAAI,CAAC,IAAI,CAAC,kCAAkC,EAAE;QAC5C,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,eAAe,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI;QACjD,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,kBAAkB;QACzC,UAAU;KACX,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAQ1C;IACC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACxF,MAAM,MAAM,GAAG,qBAAqB,CAClC,SAAS,EACT,SAAS,EACT,OAAO,CAAC,UAAU,EAClB,MAAM,CAAC,kBAAkB,CAC1B,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,CAAC,iCAAiC,EAAE;QACtC,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,MAAM,CAAC,YAAY;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QACnC,2EAA2E;QAC3E,yEAAyE;QACzE,sCAAsC;QACtC,MAAM,IAAI,KAAK,CACb,uBAAuB,OAAO,CAAC,UAAU,MAAM,SAAS,mCAAmC;YACzF,IAAI,MAAM,CAAC,aAAa,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,KAAK;YACjH,oBAAoB,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAChF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IACrD,MAAM,IAAI,GAAG,mBAAmB,CAC9B,QAAQ,EACR,SAAS,EACT,MAAM,EACN,OAAO,EACP,SAAS,EACT,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,qBAAqB,CAAC;YACpB,OAAO,EAAE,OAAO;YAChB,SAAS;YACT,MAAM;YACN,QAAQ;YACR,SAAS;YACT,eAAe;YACf,MAAM,EAAE,4BAA4B;YACpC,IAAI;SACL,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,uBAAuB,EAAE;QAC5B,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,OAAO,CAAC,UAAU;QACnC,aAAa,EAAE,IAAI,CAAC,UAAU;QAC9B,MAAM,EAAE,4BAA4B;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAQvC;IACC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAC7F,IAAI,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACtF,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5F,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC,iCAAiC,EAAE;QACtC,UAAU,EAAE,SAAS;QACrB,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,MAAM,CAAC,YAAY;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAChG,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,qBAAqB,CAAC;YACpB,OAAO,EAAE,IAAI;YACb,SAAS;YACT,MAAM;YACN,QAAQ;YACR,SAAS;YACT,eAAe;YACf,MAAM,EAAE,4BAA4B;YACpC,IAAI;SACL,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,uBAAuB,EAAE;QAC5B,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,IAAI;QACrB,aAAa,EAAE,IAAI,CAAC,UAAU;QAC9B,MAAM,EAAE,4BAA4B;QACpC,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAcpC;IACC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,IAAI,CAAC,2BAA2B,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,IAAI,CAAC,cAAc;QAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,mBAAmB,CAC9B,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,aAAa,CACnB,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,qBAAqB,CAAC;YACpB,OAAO,EAAE,IAAI,CAAC,cAAc;YAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,QAAQ,EAAE,IAAI,CAAC,aAAa;YAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,uBAAuB;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE;QACjC,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,UAAU,EAAE,IAAI,CAAC,SAAS;QAC1B,eAAe,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,IAAI,IAAI;QACxD,aAAa,EAAE,IAAI,CAAC,UAAU;QAC9B,MAAM,EAAE,uBAAuB;QAC/B,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,YAAY,IAAI,IAAI;QACpD,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,IAAI,IAAI;KAC5C,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAiBtC;IACC,MAAM,QAAQ,GAAG,oBAAoB,CAAC;QACpC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI;QACpD,2BAA2B,EAAE,IAAI,CAAC,2BAA2B;QAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,IAAI,EAAE,IAAI,CAAC,IAAI;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,OAAO,oBAAoB,CAAC,KAAK,CAAC;QAChC,GAAG,IAAI,CAAC,IAAI;QACZ,UAAU,EAAE,IAAI,CAAC,YAAY,EAAE;QAC/B,kBAAkB,EAAE,QAAQ;QAC5B,iBAAiB,EAAE,IAAI;KACxB,CAAC,CAAC;AACL,CAAC"}