@claudexor/orchestrator 3.1.2 → 3.2.1

package/dist/credential-profiles.d.ts

@@ -1,4 +1,6 @@
-import type { CredentialProfile, HarnessEvent, HarnessRunSpec, QuotaSnapshot } from "@claudexor/schema";
+import type { AuthPreference, AuthSourceReadiness, CredentialProfile, CredentialProfileStatus, HarnessEvent, QuotaSnapshot } from "@claudexor/schema";
+import { type ProfilePolicy } from "./credential-profile-rotation.js";
+export { nextEligibleProfile, planReactiveRotation, preflightCredentialProfile, preflightDefaultSubject, profileHeadroomBreach, rotateSpecOnTypedLimit, rotationRetryEligible, staticRotationCandidates, type ProfilePolicy, } from "./credential-profile-rotation.js";
 /**
  * The ONE resolve owner for credential profiles (INV-135): explicit id →
  * durable registry entry for exactly this harness. Unknown, disabled, or
@@ -10,58 +12,45 @@ export declare function selectedProfileAvailability(input: {
     registry: readonly CredentialProfile[];
     profileId?: string | null;
     harnessId: string;
-    probe?: (profile: CredentialProfile) => Promise<{
-        availability: string;
-        verification: string;
-        detail?: string | null;
-    }>;
+    probe?: (profile: CredentialProfile) => Promise<CredentialProfileStatus>;
 }): Promise<string | null>;
-export interface ProfilePolicy {
-    limit_action: "fail" | "ask" | "rotate";
-    rotation_eligible: string[];
-    headroom_threshold: number;
-}
-/** Typed quota evidence for a profile over its headroom bound (provenance). */
-export interface HeadroomBreach {
-    constraint_id: string;
-    used_ratio: number;
-    threshold: number;
-    resets_at: string | null;
-}
-/**
- * Proactive headroom check (W5.4 `profile_headroom_preflight`): the SELECTED
- * profile's freshest snapshot windows against the policy threshold. Unknown
- * usage is NOT a breach — rotation never triggers on missing data.
- */
-export declare function profileHeadroomBreach(snapshots: readonly QuotaSnapshot[], harnessId: string, profileId: string | null, threshold: number): HeadroomBreach | null;
-/**
- * The next rotation target after `currentProfileId` (W5.4): policy order wins
- * (`rotation_eligible`), else every enabled profile of the harness in registry
- * order. The current profile and disabled/unknown ids never come back; a
- * profile already over the headroom bound is skipped (rotating INTO a spent
- * subscription is not a failover). Cross-subscription rotation of one vendor
- * is allowed by owner decision — but rotation NEVER crosses credential kinds
- * (release wave round-16 BLOCK): a subscription→API-key swap silently changes
- * the payment model mid-attempt, and the attempt's first-wins auth-route
- * receipt (decided once before spawn) would misvalue metered usage as
- * subscription entitlement, bypassing a finite cash cap.
- */
-export declare function nextEligibleProfile(registry: readonly CredentialProfile[], harnessId: string, policy: ProfilePolicy, current: Pick<CredentialProfile, "profile_id" | "credential_kind"> | null, snapshots: readonly QuotaSnapshot[], excluded?: ReadonlySet<string>): CredentialProfile | null;
+/** One readiness predicate shared by run admission and accounts projection. */
+export declare function profileStatusAdmits(profile: Pick<CredentialProfile, "credential_kind">, result: {
+    availability: string;
+    verification: string;
+}): boolean;
+/** One fail-closed profile doctor wrapper shared by Accounts and runtime
+ * selection. Probe failures are readiness facts, never selector exceptions. */
+export declare function probeCredentialProfileStatus(profile: CredentialProfile, probe?: (profile: CredentialProfile) => Promise<CredentialProfileStatus>): Promise<CredentialProfileStatus>;
+/** Same precedence used by run admission: the first explicit route wins;
+ * `auto` means fall through rather than shadow a more general setting. */
+export declare function effectiveAuthPreference(...values: Array<AuthPreference | null | undefined>): AuthPreference;
+/** Fresh effective route for the unprofiled/default subject in Accounts. The
+ * gateway status proves aggregate intent readiness; the schema auth estimator
+ * then chooses the exact usable source under the same configured preference as
+ * run admission. Returning the route (not merely a bool) keeps next_up labels
+ * truthful when a native-capable harness falls back to an API key. */
+export declare function defaultCredentialRoute(status: {
+    status: "ok" | "degraded" | "unavailable";
+    routableIntents: readonly unknown[];
+    authSources: readonly AuthSourceReadiness[];
+}, requested: AuthPreference): "local_session" | "api_key" | null;
 /** The informational identity an UNPINNED run of a harness would route to next
  * (INV-135 `next_up`) — the same routing owner that admits and rotates runs,
  * exposed for the accounts projection so no surface re-derives it. Never gates
  * routing: explicit control is a per-run `--profile` / per-thread pin.
  *
  * Semantics mirror run-time admission: an unpinned run's default subject is the
- * native/CLI login when it participates in the ladder; enabled profiles route
+ * unprofiled/default credential when it participates in the ladder; enabled profiles route
  * only by explicit pin or, under `rotate`, as the quota-failover target when the
- * native default is already over headroom. A disabled CLI login leaves an
+ * default subject is already over headroom. A disabled default leaves an
  * unpinned run with nothing routable. */
 export type NextUpIdentity = {
     kind: "profile";
     profileId: string;
 } | {
     kind: "native";
+    route: "local_session" | "api_key";
 } | {
     kind: "none";
     reason: string;
@@ -71,76 +60,17 @@ export declare function nextUpIdentity(args: {
     harnessId: string;
     policy: ProfilePolicy;
     snapshots: readonly QuotaSnapshot[];
-    nativeEnabled: boolean;
+    defaultEnabled: boolean;
+    /** Fresh doctor/admission truth for the unprofiled default subject. */
+    defaultReady: boolean;
+    /** Effective source route of that default subject under configured auth preference. */
+    defaultRoute: "local_session" | "api_key" | null;
+    /** Profiles admitted by their fresh profile doctor probe in this snapshot. */
+    readyProfileIds: ReadonlySet<string>;
+    /** Known configured model, null for the native default, or omitted only when
+     * this projection has no model context and must stay conservative. */
+    model?: string | null;
 }): NextUpIdentity;
-/**
- * `rotation_retry_eligible` (sol #30): a failover retry is allowed ONLY when
- * the attempt saw a TYPED vendor limit AND produced no deliverable and no
- * workspace mutation — a partially-acted attempt never silently reruns.
- */
-export declare function rotationRetryEligible(input: {
-    sawTypedLimit: boolean;
-    deliverableEmpty: boolean;
-}): boolean;
-type EmitFn = (type: "route.profile.headroom_exceeded" | "route.profile.rotated" | "route.profile.rotation_exhausted", payload: Record<string, unknown>) => void;
-/**
- * `profile_headroom_preflight` (W5.4): BEFORE spawn, the selected profile's
- * freshest quota windows are checked against the policy threshold. A breach
- * is always a typed event; `rotate` swaps to the next eligible profile with
- * provenance, `ask`/`fail` proceed on the selected profile — the runtime
- * `vendor_limit_rejected` evidence stays the terminating truth.
- */
-export declare function preflightCredentialProfile(args: {
-    profile: CredentialProfile;
-    harnessId: string;
-    policy: ProfilePolicy;
-    registry: readonly CredentialProfile[];
-    snapshots: readonly QuotaSnapshot[];
-    emit: EmitFn;
-}): CredentialProfile;
-/**
- * Default-subject start selection (INV-135, owner scope "auto-balance"): when
- * NO profile is pinned, the policy is `rotate`, and the DEFAULT store's own
- * fresh quota window is at/over the headroom bound, pick the first eligible
- * SUBSCRIPTION profile instead of spawning into a near-certain vendor limit.
- * Strictly opt-in: `fail`/`ask` keep today's default-user behavior untouched
- * (the profile engine's fail action governs PINNED profiles only — throwing
- * here would brick every default user at 90% quota). Unknown or stale usage
- * never rotates.
- */
-export declare function preflightDefaultSubject(args: {
-    harnessId: string;
-    policy: ProfilePolicy;
-    registry: readonly CredentialProfile[];
-    snapshots: readonly QuotaSnapshot[];
-    emit: EmitFn;
-}): CredentialProfile | null;
-/**
- * Reactive failover plan (`vendor_limit_rejected`, W5.4): rotation fires ONLY
- * on the typed predicate under a `rotate` policy, marks the current profile
- * tried (at most once per attempt each), and returns the next target with
- * provenance already emitted — or null when the attempt must fail as-is.
- * `currentProfile: null` is the DEFAULT subject: allowed ONLY when the caller
- * proves the attempt's pre-spawn route was vendor_native (a metered default
- * hitting a limit is a budget fact, not a subscription to fail over from).
- */
-export declare function planReactiveRotation(args: {
-    currentProfile: CredentialProfile | null;
-    defaultRouteWasVendorNative?: boolean;
-    harnessId: string;
-    attemptId: string;
-    policy: ProfilePolicy;
-    registry: readonly CredentialProfile[];
-    snapshots: readonly QuotaSnapshot[];
-    triedProfiles: Set<string>;
-    sawTypedLimit: boolean;
-    deliverableEmpty: boolean;
-    lastLimit: {
-        retryDelayMs: number | null;
-        resetsAt: string | null;
-    } | null;
-    emit: EmitFn;
-}): CredentialProfile | null;
 /**
  * INV-135 at the engine boundary: a cached vendor session resumes ONLY under
  * exactly the profile it was recorded with (null-default equality included) —
@@ -159,30 +89,4 @@ export declare function resumeSessionForProfile(cached: {
 export declare function observeNativeSessionEvent(input: {
     onSessionObserved?: (harnessId: string, nativeSessionId: string, observedModel?: string | null, profileId?: string | null) => void;
 } | undefined, harnessId: string, ev: HarnessEvent): void;
-/**
- * Shared reactive-failover step for BOTH lanes: given the attempt's typed
- * evidence, plan a rotation and rebuild the spec on a NEW vendor session
- * under the next profile — or return null when the attempt must fail as-is.
- */
-export declare function rotateSpecOnTypedLimit(args: {
-    spec: HarnessRunSpec;
-    harnessId: string;
-    attemptId: string;
-    policy: ProfilePolicy;
-    registry: readonly CredentialProfile[];
-    snapshots: readonly QuotaSnapshot[];
-    triedProfiles: Set<string>;
-    sawTypedLimit: boolean;
-    deliverableEmpty: boolean;
-    lastLimit: {
-        retryDelayMs: number | null;
-        resetsAt: string | null;
-    } | null;
-    emit: EmitFn;
-    newSessionId: () => string;
-    /** Pre-spawn route estimate for a profile-less spec: default-subject
-     * rotation is allowed ONLY off a vendor_native attempt. */
-    defaultRouteWasVendorNative?: boolean;
-}): HarnessRunSpec | null;
-export {};
 //# sourceMappingURL=credential-profiles.d.ts.map

package/dist/credential-profiles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-profiles.d.ts","sourceRoot":"","sources":["../src/credential-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,iBAAiB,EACjB,YAAY,EACZ,cAAc,EACd,aAAa,EACd,MAAM,mBAAmB,CAAC;AAG3B;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,iBAAiB,CASnB;AAED,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC;QAC9C,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACxB,CAAC,CAAC;CACJ,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBzB;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC;IACxC,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,SAAS,EAAE,MAAM,GAChB,cAAc,GAAG,IAAI,CAmBvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,iBAAiB,CAAC,GAAG,IAAI,EACzE,SAAS,EAAE,SAAS,aAAa,EAAE,EACnC,QAAQ,GAAE,WAAW,CAAC,MAAM,CAAa,GACxC,iBAAiB,GAAG,IAAI,CA2B1B;AAED;;;;;;;;;yCASyC;AACzC,MAAM,MAAM,cAAc,GACxB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjG,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,aAAa,EAAE,OAAO,CAAC;CACxB,GAAG,cAAc,CAmBjB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAEV;AAED,KAAK,MAAM,GAAG,CACZ,IAAI,EACA,iCAAiC,GACjC,uBAAuB,GACvB,kCAAkC,EACtC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,IAAI,CAAC;AAuDV;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE;IAC/C,OAAO,EAAE,iBAAiB,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,CAoDpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,GAAG,IAAI,CAqC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,cAAc,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACzC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,iBAAiB,GAAG,IAAI,CAqC3B;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,SAAS,EACnE,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAChC,MAAM,GAAG,IAAI,CAGf;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EACD;IACE,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,KACtB,IAAI,CAAC;CACX,GACD,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,YAAY,GACf,IAAI,CAeN;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3B,aAAa,EAAE,OAAO,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,SAAS,EAAE;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B;+DAC2D;IAC3D,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC,GAAG,cAAc,GAAG,IAAI,CAsBxB"}
+{"version":3,"file":"credential-profiles.d.ts","sourceRoot":"","sources":["../src/credential-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EACZ,aAAa,EACd,MAAM,mBAAmB,CAAC;AAI3B,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,KAAK,aAAa,GACnB,MAAM,kCAAkC,CAAC;AAE1C;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,EACtC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,iBAAiB,CASnB;AAED,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,uBAAuB,CAAC,CAAC;CAC1E,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAazB;AAED,+EAA+E;AAC/E,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,EACnD,MAAM,EAAE;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACrD,OAAO,CAKT;AAED;+EAC+E;AAC/E,wBAAsB,4BAA4B,CAChD,OAAO,EAAE,iBAAiB,EAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,iBAAiB,KAAK,OAAO,CAAC,uBAAuB,CAAC,GACvE,OAAO,CAAC,uBAAuB,CAAC,CAgClC;AAED;0EAC0E;AAC1E,wBAAgB,uBAAuB,CACrC,GAAG,MAAM,EAAE,KAAK,CAAC,cAAc,GAAG,IAAI,GAAG,SAAS,CAAC,GAClD,cAAc,CAIhB;AAED;;;;sEAIsE;AACtE,wBAAgB,sBAAsB,CACpC,MAAM,EAAE;IACN,MAAM,EAAE,IAAI,GAAG,UAAU,GAAG,aAAa,CAAC;IAC1C,eAAe,EAAE,SAAS,OAAO,EAAE,CAAC;IACpC,WAAW,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC7C,EACD,SAAS,EAAE,cAAc,GACxB,eAAe,GAAG,SAAS,GAAG,IAAI,CAGpC;AAED;;;;;;;;;yCASyC;AACzC,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,eAAe,GAAG,SAAS,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAErC,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE,SAAS,aAAa,EAAE,CAAC;IACpC,cAAc,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,YAAY,EAAE,OAAO,CAAC;IACtB,uFAAuF;IACvF,YAAY,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAAC;IACjD,8EAA8E;IAC9E,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC;0EACsE;IACtE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,cAAc,CAwDjB;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,SAAS,EACnE,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAChC,MAAM,GAAG,IAAI,CAGf;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EACD;IACE,iBAAiB,CAAC,EAAE,CAClB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,KACtB,IAAI,CAAC;CACX,GACD,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,EAAE,EAAE,YAAY,GACf,IAAI,CAeN"}

package/dist/credential-profiles.js

@@ -1,4 +1,8 @@
-import { HarnessRunSpec as HarnessRunSpecSchema } from "@claudexor/schema";
+import { CredentialProfileStatus as CredentialProfileStatusSchema } from "@claudexor/schema";
+import { redactSecrets } from "@claudexor/util";
+import { estimateEffectiveAuthRoute } from "@claudexor/schema";
+import { nextEligibleProfile, profileHeadroomBreach, } from "./credential-profile-rotation.js";
+export { nextEligibleProfile, planReactiveRotation, preflightCredentialProfile, preflightDefaultSubject, profileHeadroomBreach, rotateSpecOnTypedLimit, rotationRetryEligible, staticRotationCandidates, } from "./credential-profile-rotation.js";
 /**
  * The ONE resolve owner for credential profiles (INV-135): explicit id →
  * durable registry entry for exactly this harness. Unknown, disabled, or
@@ -27,295 +31,98 @@ export async function selectedProfileAvailability(input) {
     }
     if (!input.probe)
         return `harness "${input.harnessId}" has no profile probe`;
-    const result = await input.probe(profile);
-    const verificationAdmits = result.verification === "passed" ||
-        (profile.credential_kind === "api_key" && result.verification === "not_run");
-    return result.availability === "available" && verificationAdmits
+    const result = await probeCredentialProfileStatus(profile, input.probe);
+    return profileStatusAdmits(profile, result)
         ? "available"
         : (result.detail ?? `${result.availability}/${result.verification}`);
 }
-/**
- * Proactive headroom check (W5.4 `profile_headroom_preflight`): the SELECTED
- * profile's freshest snapshot windows against the policy threshold. Unknown
- * usage is NOT a breach — rotation never triggers on missing data.
- */
-export function profileHeadroomBreach(snapshots, harnessId, profileId, threshold) {
-    for (const snapshot of snapshots) {
-        // FRESH evidence only (release wave tier1 #3): a stale or unknown reading
-        // must never breach headroom, rotate a profile away, or fail selection.
-        if (snapshot.freshness !== "fresh")
-            continue;
-        if (snapshot.subject.harness !== harnessId)
-            continue;
-        if ((snapshot.subject.subject_id ?? null) !== profileId)
-            continue;
-        for (const constraint of snapshot.constraints) {
-            if (constraint.used_ratio !== null && constraint.used_ratio >= threshold) {
-                return {
-                    constraint_id: constraint.id,
-                    used_ratio: constraint.used_ratio,
-                    threshold,
-                    resets_at: constraint.resets_at,
-                };
-            }
+/** One readiness predicate shared by run admission and accounts projection. */
+export function profileStatusAdmits(profile, result) {
+    const verificationAdmits = result.verification === "passed" ||
+        (profile.credential_kind === "api_key" && result.verification === "not_run");
+    return result.availability === "available" && verificationAdmits;
+}
+/** One fail-closed profile doctor wrapper shared by Accounts and runtime
+ * selection. Probe failures are readiness facts, never selector exceptions. */
+export async function probeCredentialProfileStatus(profile, probe) {
+    if (!probe) {
+        return {
+            profile_id: profile.profile_id,
+            harness_id: profile.harness_id,
+            availability: "unknown",
+            verification: "not_run",
+            detail: `harness "${profile.harness_id}" has no profile probe`,
+            last_verified_at: null,
+        };
+    }
+    try {
+        const result = CredentialProfileStatusSchema.parse(await probe(profile));
+        if (result.profile_id !== profile.profile_id || result.harness_id !== profile.harness_id) {
+            throw new Error("profile readiness probe returned status for a different profile");
         }
+        return {
+            ...result,
+            ...(result.detail === undefined ? {} : { detail: redactSecrets(result.detail) }),
+        };
     }
-    return null;
-}
-/**
- * The next rotation target after `currentProfileId` (W5.4): policy order wins
- * (`rotation_eligible`), else every enabled profile of the harness in registry
- * order. The current profile and disabled/unknown ids never come back; a
- * profile already over the headroom bound is skipped (rotating INTO a spent
- * subscription is not a failover). Cross-subscription rotation of one vendor
- * is allowed by owner decision — but rotation NEVER crosses credential kinds
- * (release wave round-16 BLOCK): a subscription→API-key swap silently changes
- * the payment model mid-attempt, and the attempt's first-wins auth-route
- * receipt (decided once before spawn) would misvalue metered usage as
- * subscription entitlement, bypassing a finite cash cap.
- */
-export function nextEligibleProfile(registry, harnessId, policy, current, snapshots, excluded = new Set()) {
-    const pool = registry.filter((p) => p.harness_id === harnessId && p.enabled);
-    const ordered = policy.rotation_eligible.length > 0
-        ? policy.rotation_eligible
-            .map((id) => pool.find((p) => p.profile_id === id))
-            .filter((p) => p !== undefined)
-        : pool;
-    for (const candidate of ordered) {
-        if (candidate.profile_id === current?.profile_id)
-            continue;
-        if (excluded.has(candidate.profile_id))
-            continue;
-        // Fail-CLOSED kind guard (round-17 hardening of the round-16 BLOCK): the
-        // kind comes from the TYPED current profile in hand — never re-found in
-        // a freshly reloaded pool, where a mid-flight disable/remove of the
-        // current profile would have silently dropped the cross-kind prohibition.
-        if (current !== null && candidate.credential_kind !== current.credential_kind)
-            continue;
-        // `current === null` is the DEFAULT subject (the vendor-native store): the
-        // same round-16 BLOCK applies — rotating the subscription default INTO an
-        // api_key profile would silently change the payment model mid-attempt.
-        if (current === null && candidate.credential_kind === "api_key")
-            continue;
-        if (profileHeadroomBreach(snapshots, harnessId, candidate.profile_id, policy.headroom_threshold))
-            continue;
-        return candidate;
+    catch (error) {
+        return {
+            profile_id: profile.profile_id,
+            harness_id: profile.harness_id,
+            availability: "unknown",
+            verification: "not_run",
+            detail: `profile readiness probe failed: ${redactSecrets(error instanceof Error ? error.message : String(error))}`,
+            last_verified_at: null,
+        };
     }
-    return null;
+}
+/** Same precedence used by run admission: the first explicit route wins;
+ * `auto` means fall through rather than shadow a more general setting. */
+export function effectiveAuthPreference(...values) {
+    return (values.find((value) => value !== undefined && value !== null && value !== "auto") ?? "auto");
+}
+/** Fresh effective route for the unprofiled/default subject in Accounts. The
+ * gateway status proves aggregate intent readiness; the schema auth estimator
+ * then chooses the exact usable source under the same configured preference as
+ * run admission. Returning the route (not merely a bool) keeps next_up labels
+ * truthful when a native-capable harness falls back to an API key. */
+export function defaultCredentialRoute(status, requested) {
+    if (status.status !== "ok" || status.routableIntents.length === 0)
+        return null;
+    return estimateEffectiveAuthRoute(requested, status.authSources);
 }
 export function nextUpIdentity(args) {
-    const { registry, harnessId, policy, snapshots, nativeEnabled } = args;
-    if (!nativeEnabled) {
+    const { registry, harnessId, policy, snapshots, defaultEnabled, defaultReady, defaultRoute, readyProfileIds, model, } = args;
+    if (!defaultEnabled) {
         return {
             kind: "none",
-            reason: "the CLI login is disabled; pin an account per-run (--profile) or per-thread",
+            reason: "the default credential is disabled; enable it or pin an account per-run (--profile)",
+        };
+    }
+    if (!defaultReady) {
+        return {
+            kind: "none",
+            reason: "the default credential is not ready; refresh Accounts or run `claudexor doctor`",
         };
     }
     // Under `rotate`, a native/default subject already over its headroom bound
     // fails over to the next eligible enabled profile BEFORE spawn — that is who
     // an unpinned run routes to next. `ask`/`fail` proceed on the native default.
-    if (policy.limit_action === "rotate") {
-        const breach = profileHeadroomBreach(snapshots, harnessId, null, policy.headroom_threshold);
+    if (policy.limit_action === "rotate" && defaultRoute === "local_session") {
+        const breach = profileHeadroomBreach(snapshots, harnessId, null, policy.headroom_threshold, model);
         if (breach) {
-            const next = nextEligibleProfile(registry, harnessId, policy, null, snapshots);
+            const next = nextEligibleProfile(registry, harnessId, policy, null, snapshots, readyProfileIds, new Set(), model);
             if (next)
                 return { kind: "profile", profileId: next.profile_id };
         }
     }
-    return { kind: "native" };
-}
-/**
- * `rotation_retry_eligible` (sol #30): a failover retry is allowed ONLY when
- * the attempt saw a TYPED vendor limit AND produced no deliverable and no
- * workspace mutation — a partially-acted attempt never silently reruns.
- */
-export function rotationRetryEligible(input) {
-    return input.sawTypedLimit && input.deliverableEmpty;
-}
-function emitRotationExhausted(args) {
-    const excluded = args.excluded ?? new Set();
-    const candidates = args.registry
-        .filter((profile) => profile.harness_id === args.harnessId && profile.enabled)
-        .map((profile) => {
-        const breach = profileHeadroomBreach(args.snapshots, args.harnessId, profile.profile_id, args.policy.headroom_threshold);
-        const rejected = profile.profile_id === args.current?.profile_id
-            ? "current"
-            : args.policy.rotation_eligible.length > 0 &&
-                !args.policy.rotation_eligible.includes(profile.profile_id)
-                ? "not_in_rotation_policy"
-                : excluded.has(profile.profile_id)
-                    ? "already_tried"
-                    : args.current && profile.credential_kind !== args.current.credential_kind
-                        ? "credential_kind_mismatch"
-                        : args.current === null && profile.credential_kind === "api_key"
-                            ? "credential_kind_mismatch"
-                            : breach
-                                ? "headroom_exceeded"
-                                : "not_selected";
+    if (!defaultRoute) {
         return {
-            profile_id: profile.profile_id,
-            credential_kind: profile.credential_kind,
-            rejected,
-            headroom: breach,
+            kind: "none",
+            reason: "the default credential route is unknown; refresh Accounts or run `claudexor doctor`",
         };
-    });
-    args.emit("route.profile.rotation_exhausted", {
-        harness_id: args.harnessId,
-        attempt_id: args.attemptId,
-        from_profile_id: args.current?.profile_id ?? null,
-        reason: args.reason,
-        threshold: args.policy.headroom_threshold,
-        candidates,
-    });
-}
-/**
- * `profile_headroom_preflight` (W5.4): BEFORE spawn, the selected profile's
- * freshest quota windows are checked against the policy threshold. A breach
- * is always a typed event; `rotate` swaps to the next eligible profile with
- * provenance, `ask`/`fail` proceed on the selected profile — the runtime
- * `vendor_limit_rejected` evidence stays the terminating truth.
- */
-export function preflightCredentialProfile(args) {
-    const { profile, harnessId, policy, registry, snapshots, emit } = args;
-    const breach = profileHeadroomBreach(snapshots, harnessId, profile.profile_id, policy.headroom_threshold);
-    if (!breach)
-        return profile;
-    emit("route.profile.headroom_exceeded", {
-        harness_id: harnessId,
-        profile_id: profile.profile_id,
-        action: policy.limit_action,
-        constraint_id: breach.constraint_id,
-        used_ratio: breach.used_ratio,
-        threshold: breach.threshold,
-        resets_at: breach.resets_at,
-    });
-    if (policy.limit_action === "fail") {
-        // The documented FAIL action fails (release wave tier1 #4): a FRESH breach
-        // under fail refuses before spawn with the evidence, instead of silently
-        // proceeding into a vendor rejection.
-        throw new Error(`credential profile "${profile.profile_id}" (${harnessId}) is over its headroom threshold ` +
-            `(${breach.constraint_id} at ${Math.round(breach.used_ratio * 100)}% >= ${Math.round(breach.threshold * 100)}%; ` +
-            `limit_action=fail${breach.resets_at ? `; resets ${breach.resets_at}` : ""})`);
-    }
-    if (policy.limit_action !== "rotate")
-        return profile;
-    const next = nextEligibleProfile(registry, harnessId, policy, profile, snapshots);
-    if (!next) {
-        emitRotationExhausted({
-            current: profile,
-            harnessId,
-            policy,
-            registry,
-            snapshots,
-            reason: "profile_headroom_preflight",
-            emit,
-        });
-        return profile;
-    }
-    emit("route.profile.rotated", {
-        harness_id: harnessId,
-        from_profile_id: profile.profile_id,
-        to_profile_id: next.profile_id,
-        reason: "profile_headroom_preflight",
-        constraint_id: breach.constraint_id,
-        used_ratio: breach.used_ratio,
-        resets_at: breach.resets_at,
-    });
-    return next;
-}
-/**
- * Default-subject start selection (INV-135, owner scope "auto-balance"): when
- * NO profile is pinned, the policy is `rotate`, and the DEFAULT store's own
- * fresh quota window is at/over the headroom bound, pick the first eligible
- * SUBSCRIPTION profile instead of spawning into a near-certain vendor limit.
- * Strictly opt-in: `fail`/`ask` keep today's default-user behavior untouched
- * (the profile engine's fail action governs PINNED profiles only — throwing
- * here would brick every default user at 90% quota). Unknown or stale usage
- * never rotates.
- */
-export function preflightDefaultSubject(args) {
-    const { harnessId, policy, registry, snapshots, emit } = args;
-    if (policy.limit_action !== "rotate")
-        return null;
-    const breach = profileHeadroomBreach(snapshots, harnessId, null, policy.headroom_threshold);
-    if (!breach)
-        return null;
-    emit("route.profile.headroom_exceeded", {
-        harness_id: harnessId,
-        profile_id: null,
-        action: policy.limit_action,
-        constraint_id: breach.constraint_id,
-        used_ratio: breach.used_ratio,
-        threshold: breach.threshold,
-        resets_at: breach.resets_at,
-    });
-    const next = nextEligibleProfile(registry, harnessId, policy, null, snapshots);
-    if (!next) {
-        emitRotationExhausted({
-            current: null,
-            harnessId,
-            policy,
-            registry,
-            snapshots,
-            reason: "profile_headroom_preflight",
-            emit,
-        });
-        return null;
-    }
-    emit("route.profile.rotated", {
-        harness_id: harnessId,
-        from_profile_id: null,
-        to_profile_id: next.profile_id,
-        reason: "profile_headroom_preflight",
-        constraint_id: breach.constraint_id,
-        used_ratio: breach.used_ratio,
-        resets_at: breach.resets_at,
-    });
-    return next;
-}
-/**
- * Reactive failover plan (`vendor_limit_rejected`, W5.4): rotation fires ONLY
- * on the typed predicate under a `rotate` policy, marks the current profile
- * tried (at most once per attempt each), and returns the next target with
- * provenance already emitted — or null when the attempt must fail as-is.
- * `currentProfile: null` is the DEFAULT subject: allowed ONLY when the caller
- * proves the attempt's pre-spawn route was vendor_native (a metered default
- * hitting a limit is a budget fact, not a subscription to fail over from).
- */
-export function planReactiveRotation(args) {
-    if (!rotationRetryEligible(args))
-        return null;
-    if (args.policy.limit_action !== "rotate")
-        return null;
-    if (args.currentProfile === null && args.defaultRouteWasVendorNative !== true)
-        return null;
-    if (args.currentProfile)
-        args.triedProfiles.add(args.currentProfile.profile_id);
-    const next = nextEligibleProfile(args.registry, args.harnessId, args.policy, args.currentProfile, args.snapshots, args.triedProfiles);
-    if (!next) {
-        emitRotationExhausted({
-            current: args.currentProfile,
-            harnessId: args.harnessId,
-            policy: args.policy,
-            registry: args.registry,
-            snapshots: args.snapshots,
-            excluded: args.triedProfiles,
-            attemptId: args.attemptId,
-            reason: "vendor_limit_rejected",
-            emit: args.emit,
-        });
-        return null;
     }
-    args.emit("route.profile.rotated", {
-        harness_id: args.harnessId,
-        attempt_id: args.attemptId,
-        from_profile_id: args.currentProfile?.profile_id ?? null,
-        to_profile_id: next.profile_id,
-        reason: "vendor_limit_rejected",
-        retry_delay_ms: args.lastLimit?.retryDelayMs ?? null,
-        resets_at: args.lastLimit?.resetsAt ?? null,
-    });
-    return next;
+    return { kind: "native", route: defaultRoute };
 }
 /**
  * INV-135 at the engine boundary: a cached vendor session resumes ONLY under
@@ -346,33 +153,4 @@ export function observeNativeSessionEvent(input, harnessId, ev) {
         }
     }
 }
-/**
- * Shared reactive-failover step for BOTH lanes: given the attempt's typed
- * evidence, plan a rotation and rebuild the spec on a NEW vendor session
- * under the next profile — or return null when the attempt must fail as-is.
- */
-export function rotateSpecOnTypedLimit(args) {
-    const rotation = planReactiveRotation({
-        currentProfile: args.spec.credential_profile ?? null,
-        defaultRouteWasVendorNative: args.defaultRouteWasVendorNative,
-        harnessId: args.harnessId,
-        attemptId: args.attemptId,
-        policy: args.policy,
-        registry: args.registry,
-        snapshots: args.snapshots,
-        triedProfiles: args.triedProfiles,
-        sawTypedLimit: args.sawTypedLimit,
-        deliverableEmpty: args.deliverableEmpty,
-        lastLimit: args.lastLimit,
-        emit: args.emit,
-    });
-    if (!rotation)
-        return null;
-    return HarnessRunSpecSchema.parse({
-        ...args.spec,
-        session_id: args.newSessionId(),
-        credential_profile: rotation,
-        resume_session_id: null,
-    });
-}
 //# sourceMappingURL=credential-profiles.js.map