@claudexor/schema 1.0.0 → 2.0.0

package/dist/control.js

@@ -1,34 +1,22 @@
 import { z } from "zod";
 import { AccessProfile, AuthPreference, ContentHash, ExternalContextPolicy, Id, ModeKind, NonBlankString, OutputReadyState, ProviderFamily, } from "./primitives.js";
-import { Portfolio } from "./budget.js";
+import { PaidBudget, PaidFallback, QualityTierSet, RoutingGoal } from "./budget.js";
+export { ControlQuotaResponse } from "./quota.js";
+import { AuthSourceReadiness } from "./auth.js";
 import { AdapterStatus, ConformanceCheck, EffortHint, HarnessManifest, HarnessModel, InteractionQuestion, } from "./harness.js";
 import { ThreadState, ThreadTurnKind, WorkspaceMode } from "./thread.js";
 import { OrchestrateAutonomy } from "./orchestrate.js";
-import { AttachmentInput } from "./attachment.js";
-import { ProtectedPathApproval } from "./task.js";
-/** Project context depth. The "deep" tier never shipped a distinct behavior
- * (v0.15 triage): auto is the only mode; off exists solely on projections of
- * no-project runs. */
-export const RunScopeContext = z.enum(["auto"]).describe("Project context depth; auto is the only mode.");
-export const RunScope = z
-    .discriminatedUnion("kind", [
-    z
-        .object({
-        kind: z.literal("project"),
-        root: z.string().describe("Absolute path of the project root."),
-        context: RunScopeContext.default("auto"),
-    })
-        .strict()
-        .describe("Run anchored to a project."),
-    z.object({ kind: z.literal("none") }).strict().describe("Run with no project (pure ask)."),
-])
-    .describe("What the run operates on: a project (with root) or nothing.");
+import { ResourceAttachmentRef } from "./attachment.js";
+import { RequestRequirementResolution } from "./request-requirements.js";
+import { ProtectedPathApproval, TestCommandInvocation } from "./task.js";
+import { RunScope } from "./control-run-scope.js";
+import { makeControlRunRetrySchemas } from "./control-run-retry.js";
 export const RunExecution = z
     .object({
     isolation: z
         .enum(["envelope", "live"])
         .default("envelope")
-        .describe("Run isolation: envelope (isolated worktree under .claudexor/workspaces, the default) or live (the project tree itself)."),
+        .describe("Run isolation: envelope (isolated worktree in the external per-project runtime namespace, the default) or live (the project tree itself)."),
 })
     .strict()
     .describe("Execution isolation settings for a run.");
@@ -47,18 +35,20 @@ export const ControlReviewerPanelEntry = z
 export const ControlRunStartRequest = z
     .object({
     prompt: z.string().default("").describe("The user's prompt for the run."),
-    /** Inbound files/images for this turn; the daemon resolves each to a scoped
-     *  on-disk Attachment before the run spec is built. */
+    /** Immutable daemon resource ids; upload/finalize happens before enqueue. */
     attachments: z
-        .array(AttachmentInput)
+        .array(ResourceAttachmentRef)
         .optional()
-        .describe("Inbound files/images for this turn; the daemon resolves each to a scoped on-disk attachment before the run spec is built."),
+        .describe("Immutable daemon resource ids returned by upload finalize; paths and inline bytes are not accepted."),
     mode: ModeKind.default("agent"),
     scope: RunScope.default({ kind: "none" }),
     execution: RunExecution.default({ isolation: "envelope" }),
-    harnesses: z.array(NonBlankString).optional().describe("Eligible harness pool for the run; omitted = engine auto-pools."),
+    harnesses: z
+        .array(NonBlankString)
+        .optional()
+        .describe("Eligible harness pool for the run; omitted = engine auto-pools."),
     primaryHarness: NonBlankString.optional().describe("Primary harness the run should prefer."),
-    portfolio: Portfolio.optional(),
+    routingGoal: RoutingGoal.optional(),
     /** Scalar model convenience: expands to the RESOLVED PRIMARY harness only
      * (never the pool). With a multi-harness pool and no primary it is
      * rejected — use `models` instead (INV-103). */
@@ -79,10 +69,24 @@ export const ControlRunStartRequest = z
         .record(ProviderFamily, EffortHint)
         .optional()
         .describe("Per-provider-family reviewer effort overrides (legacy; reviewerPanel wins when present)."),
-    n: z.number().int().positive().optional().describe("Race width: number of best-of-N candidates."),
-    attempts: z.number().int().positive().nullable().optional().describe("Cap on convergence attempts; null = engine default."),
+    n: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("Race width: number of best-of-N candidates."),
+    attempts: z
+        .number()
+        .int()
+        .positive()
+        .nullable()
+        .optional()
+        .describe("Cap on convergence attempts; null = engine default."),
     /** agent flag: iterate until the convergence predicate is clean (no fixed cap). */
-    untilClean: z.boolean().optional().describe("Agent flag: iterate until the convergence predicate is clean (no fixed cap)."),
+    untilClean: z
+        .boolean()
+        .optional()
+        .describe("Agent flag: iterate until the convergence predicate is clean (no fixed cap)."),
     /** audit flag: bounded read-only research swarm (the old `explore`). */
     swarm: z.boolean().optional().describe("Audit flag: bounded read-only research swarm."),
     /** agent flag: create-from-scratch intent (the old `create` mode). */
@@ -94,18 +98,20 @@ export const ControlRunStartRequest = z
         .enum(["auto", "always", "never"])
         .optional()
         .describe("Best-of-N synthesis policy: auto only synthesizes an extra candidate when n>=3 and candidates genuinely complement; always/never force it."),
-    maxUsd: z.number().nonnegative().nullable().optional().describe("USD cap for the run; null = no cap."),
+    paidBudget: PaidBudget.optional().describe("Explicit incremental-cash budget for the run."),
     /** Requested access profile. Effective access is derived by the engine and never client-supplied. */
     access: AccessProfile.optional().describe("Requested access profile; effective access is derived by the engine and never client-supplied."),
     web: ExternalContextPolicy.optional().describe("Web policy for the run (alias of externalContextPolicy; must match when both set)."),
     externalContextPolicy: ExternalContextPolicy.optional().describe("External web/context policy for the run."),
-    /** Opt this run into the agent-driven browser (Playwright MCP). Honored only
-     *  for browser-capable harnesses when web policy is not `off`. */
+    /** Opt this run into the agent-driven browser (Playwright MCP). */
     browser: z
         .boolean()
         .optional()
-        .describe("Opt this run into the agent-driven browser; honored only for browser-capable harnesses when web policy is not off."),
-    tests: z.array(NonBlankString).optional().describe("Test commands to run as deterministic gates."),
+        .describe("Request the agent-driven browser; preflight records per-lane effectiveness and refuses when no selected lane can receive it."),
+    tests: z
+        .array(TestCommandInvocation)
+        .optional()
+        .describe("Typed-argv commands to run as deterministic gates."),
     /** Typed per-run approval for changing auto-protected gate/test paths. This
      * does not bypass built-in critical/security path human gates. */
     protectedPathApprovals: z
@@ -123,6 +129,7 @@ export const ControlRunStartRequest = z
      * lineage; POST /threads/:id/turns is the public turn surface. */
     turnId: Id.optional().describe("Internal daemon handoff only; rejected (400) when supplied by a client on POST /runs — use POST /threads/:id/turns instead."),
     parentRunId: Id.optional().describe("Run this turn follows up on."),
+    retryOf: Id.optional().describe("Server-owned Exact Retry lineage; direct POST /runs rejects it."),
     /** When set, this turn implements an approved plan: the engine prefixes the
      * parent plan run's final/plan.md into the prompt (mode is forced to agent). */
     planRunId: Id.optional().describe("Internal daemon handoff only; rejected (400) on POST /runs. When set, the turn implements an approved plan from that run."),
@@ -151,127 +158,10 @@ export const ControlRunStartRequest = z
 })
     .strict()
     .describe("Request body for POST /runs: prompt, mode, scope, routing, strategy flags, budget, policies, and spec/thread linkage.");
-/** Harness ids that have a managed setup flow (shared by the async setup-jobs path). */
-export const ControlHarnessSetupHarness = z
-    .enum(["codex", "claude", "cursor", "opencode", "raw"])
-    .describe("Harness ids that have a managed setup flow.");
-export const ControlSetupJobAction = z
-    .enum(["install", "login", "doctor", "store_key"])
-    .describe("Setup action to perform: install the vendor CLI, log in, run the doctor, or store an API key.");
-export const ControlSetupJobState = z
-    .enum(["queued", "running", "waiting_for_input", "succeeded", "failed", "cancelled", "not_supported"])
-    .describe("Lifecycle state of a setup job, including waiting_for_input (needs user confirmation/input) and not_supported.");
-export const ControlSetupJobCreateRequest = z
-    .object({
-    harness: ControlHarnessSetupHarness,
-    action: ControlSetupJobAction,
-})
-    .strict()
-    .describe("Request body to create a harness setup job.");
-export const ControlSetupJob = z
-    .object({
-    jobId: Id.describe("Setup job id."),
-    harness: ControlHarnessSetupHarness,
-    action: ControlSetupJobAction,
-    state: ControlSetupJobState,
-    command: z.string().nullable().default(null).describe("Shell command the job runs, when applicable."),
-    guideUrl: z.string().url().nullable().default(null).describe("Vendor guide URL for manual steps, when applicable."),
-    logPath: z.string().nullable().default(null).describe("On-disk log path for the job's output."),
-    message: z.string().describe("Human-readable status message."),
-    riskFlags: z.array(z.string()).default([]).describe("Risk flags for the action (e.g. network_download, shell_pipe), surfaced before confirmation."),
-    requiresConfirmation: z.boolean().default(false).describe("Whether the job waits for explicit user confirmation before running."),
-    createdAt: z.string().describe("When the job was created."),
-    startedAt: z.string().nullable().default(null).describe("When the job started running."),
-    firstOutputAt: z.string().nullable().default(null).describe("When the job produced its first output."),
-    lastOutputAt: z.string().nullable().default(null).describe("When the job last produced output."),
-    finishedAt: z.string().nullable().default(null).describe("When the job finished."),
-    retryCount: z.number().int().nonnegative().default(0).describe("How many times the job was retried."),
-})
-    .strict()
-    .describe("One managed harness setup job (install/login/doctor/store_key) with its lifecycle timestamps.");
-export const ControlSetupJobEvent = z
-    .object({
-    jobId: Id.describe("Setup job the event belongs to."),
-    seq: z.number().int().nonnegative().describe("Monotonic event sequence within the job."),
-    time: z.string().describe("Event timestamp."),
-    /** Only "status" is ever produced (v0.15 triage: the log/end kinds had no
-     * producer; SSE stream end is a transport frame, not a payload kind). */
-    kind: z.enum(["status"]).describe("Event kind; only status is ever produced."),
-    state: ControlSetupJobState.optional(),
-    message: z.string().describe("Human-readable status message."),
-})
-    .strict()
-    .describe("Status event on a setup job's event stream.");
-export const ControlSetupJobListResponse = z
-    .object({
-    jobs: z.array(ControlSetupJob).describe("All known setup jobs."),
-})
-    .describe("Response for listing setup jobs.");
-export const ControlSetupJobConfirmRequest = z
-    .object({
-    confirmed: z.boolean().default(true).describe("Whether the user confirmed the pending action."),
-})
-    .strict()
-    .describe("Request body confirming a setup job that waits for user confirmation.");
-export const ControlSpecQuestionsRequest = z
-    .object({
-    prompt: z.string().describe("The user's request the interview is clarifying."),
-    scope: z
-        .object({
-        kind: z.literal("project"),
-        root: z.string().describe("Absolute path of the project root."),
-        context: RunScopeContext.default("auto"),
-    })
-        .strict()
-        .describe("Project the spec is about."),
-    harnesses: z.array(NonBlankString).optional().describe("Harnesses eligible to generate the questions."),
-    /** Already-answered decisions from prior tiers; carried so each round goes
-     *  DEEPER instead of re-asking (multi-tier adaptive interview). */
-    priorDecisions: z
-        .array(z.object({
-        question: z.string().describe("Question asked in a prior tier."),
-        answer: z.string().describe("The user's answer."),
-    }))
-        .optional()
-        .describe("Already-answered decisions from prior tiers, carried so each round goes deeper instead of re-asking."),
-})
-    .strict()
-    .describe("Request body to generate the next tier of spec interview questions.");
-export const ControlSpecFreezeRequest = z
-    .object({
-    prompt: z.string().describe("The user's request the spec captures."),
-    scope: z
-        .object({
-        kind: z.literal("project"),
-        root: z.string().describe("Absolute path of the project root."),
-        context: RunScopeContext.default("auto"),
-    })
-        .strict()
-        .describe("Project the spec is about."),
-    planDir: z.string().optional().describe("Directory to write the frozen spec artifacts into."),
-    plan: z.string().optional().describe("Plan text to fold into the spec."),
-    answers: z.array(z.unknown()).optional().describe("Interview answers for the current tier."),
-    /** Accumulated prior-tier interview decisions. Folded into the frozen
-     *  SpecPack's decided_tradeoffs so a MULTI-TIER spec carries every tier, not
-     *  just the last (mirror of ControlSpecQuestionsRequest.priorDecisions). */
-    priorDecisions: z
-        .array(z.object({
-        question: z.string().describe("Question asked in a prior tier."),
-        answer: z.string().describe("The user's answer."),
-    }))
-        .optional()
-        .describe("Accumulated prior-tier interview decisions, folded into the frozen SpecPack's decided tradeoffs."),
-})
-    .strict()
-    .describe("Request body to freeze a SpecPack from the interview.");
-export const ControlRunStartInfo = z
-    .object({
-    jobId: z.string().optional().describe("Daemon job id backing the run."),
-    runId: z.string().describe("Run id."),
-    taskId: z.string().optional().describe("Task id, when already allocated."),
-    runDir: z.string().describe("On-disk run artifact directory."),
-})
-    .describe("Response for a successfully enqueued run.");
+const RunRetrySchemas = makeControlRunRetrySchemas(ControlRunStartRequest);
+export const ControlRunStartInfo = RunRetrySchemas.startInfo;
+export const ControlRunRetryResponse = RunRetrySchemas.response;
+export const ControlRunAgainDraft = RunRetrySchemas.draft;
 export const ControlRunState = z
     .enum([
     "queued",
@@ -283,12 +173,14 @@ export const ControlRunState = z
     "review_not_run",
     "failed",
     "cancelled",
-    "interrupted",
+    "interrupted_unknown",
+    "cost_unverifiable",
+    "exhausted_overshoot",
     "exhausted",
     "not_converged",
     "stuck_no_progress",
 ])
-    .describe("Control-plane run state: queued/running while live; blocked awaiting a human; then a terminal outcome (succeeded, no_op, ungated, review_not_run, failed, cancelled, interrupted, exhausted, not_converged, stuck_no_progress).");
+    .describe("Control-plane run state: queued/running while live, then an honest success, block, failure, interruption, cost, exhaustion, non-convergence, or cancellation terminal.");
 export const ControlQueuedRunInfo = z
     .object({
     jobId: z.string().describe("Daemon job id."),
@@ -314,22 +206,50 @@ export const RunFailure = z
     ])
         .default("unknown")
         .describe("Typed failure category (validation, project, auth, harness, budget, policy, cancelled, internal, unknown)."),
-    harnessId: z.string().nullable().default(null).describe("Harness involved in the failure, when known."),
-    attemptId: z.string().nullable().default(null).describe("Attempt involved in the failure, when known."),
+    harnessId: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Harness involved in the failure, when known."),
+    attemptId: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Attempt involved in the failure, when known."),
     safeMessage: z.string().describe("Redacted human-readable failure message."),
-    rawDetailRef: z.string().nullable().default(null).describe("Artifact path holding the raw (redacted) failure detail."),
-    logRefs: z.array(z.string()).default([]).describe("Log artifact paths relevant to the failure."),
-    eventRefs: z.array(z.string()).default([]).describe("Event references relevant to the failure."),
+    rawDetailRef: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Artifact path holding the raw (redacted) failure detail."),
+    logRefs: z
+        .array(z.string())
+        .default([])
+        .describe("Log artifact paths relevant to the failure."),
+    eventRefs: z
+        .array(z.string())
+        .default([])
+        .describe("Event references relevant to the failure."),
     runDir: z.string().nullable().default(null).describe("Run artifact directory."),
     nextActions: z.array(z.string()).default([]).describe("Suggested operator next actions."),
 })
     .describe("Typed failure record for a run: phase, category, evidence references, and suggested next actions.");
 export const ControlProjectMetadata = z
     .object({
-    kind: z.enum(["project", "none"]).default("none").describe("Whether the run was anchored to a project."),
+    kind: z
+        .enum(["project", "none"])
+        .default("none")
+        .describe("Whether the run was anchored to a project."),
     root: z.string().nullable().default(null).describe("Project root, when anchored."),
-    projectName: z.string().nullable().default(null).describe("Project display name, when anchored."),
-    context: z.enum(["off", "auto"]).default("off").describe("Project context depth used for the run."),
+    projectName: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Project display name, when anchored."),
+    context: z
+        .enum(["off", "auto"])
+        .default("off")
+        .describe("Project context depth used for the run."),
 })
     .describe("Project metadata projected onto a run summary.");
 export const ControlWebEvidence = z
@@ -340,15 +260,34 @@ export const ControlWebEvidence = z
     /** Mode the selected route actually executed (disclosed upgrades, e.g. claude cached->live). */
     effectiveMode: ExternalContextPolicy.default("auto").describe("Policy the selected route actually executed (disclosed upgrades, e.g. cached to live)."),
     attempted: z.boolean().default(false).describe("Whether any web activity was attempted."),
-    satisfied: z.boolean().default(false).describe("Whether the web-evidence requirement was satisfied."),
+    satisfied: z
+        .boolean()
+        .default(false)
+        .describe("Whether the web-evidence requirement was satisfied."),
     status: z
         .enum(["none", "attempted", "satisfied", "failed", "unverified"])
         .default("none")
         .describe("Web-evidence verdict for the run."),
-    tool: z.string().nullable().default(null).describe("Web tool that produced the evidence, when any."),
-    target: z.string().nullable().default(null).describe("Redacted target (query/url) of the web activity, when any."),
-    errorSummary: z.string().nullable().default(null).describe("Redacted error detail when web activity failed."),
-    rawDetailRef: z.string().nullable().default(null).describe("Artifact path holding the raw (redacted) evidence detail."),
+    tool: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Web tool that produced the evidence, when any."),
+    target: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Redacted target (query/url) of the web activity, when any."),
+    errorSummary: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Redacted error detail when web activity failed."),
+    rawDetailRef: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Artifact path holding the raw (redacted) evidence detail."),
     /** False when the run predates telemetry.yaml; surfaces must render "telemetry unavailable". */
     available: z
         .boolean()
@@ -364,7 +303,11 @@ export const ControlWebEvidence = z
 export const ControlRouteInfo = z
     .object({
     requestedModel: z.string().nullable().default(null).describe("Model requested for the run."),
-    observedModel: z.string().nullable().default(null).describe("Model the harness stream actually reported."),
+    observedModel: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Model the harness stream actually reported."),
     harnessId: z.string().nullable().default(null).describe("Harness that ran the final attempt."),
     verified: z
         .boolean()
@@ -408,7 +351,12 @@ export const ControlRunResult = z
         .nullable()
         .default(null)
         .describe("Diff statistics; null unless a patch exists."),
-    blockers: z.number().int().nonnegative().default(0).describe("Count of accepted blocking review findings."),
+    blockers: z
+        .number()
+        .int()
+        .nonnegative()
+        .default(0)
+        .describe("Count of accepted blocking review findings."),
     /** True when the live in-place tree was mutated this turn (regardless of review). */
     adopted: z
         .boolean()
@@ -417,21 +365,19 @@ export const ControlRunResult = z
         .describe("True when the live in-place tree was mutated this turn (regardless of review); null when unknown."),
     /** Honest application state (decoupled from clean-terminal). */
     applyState: RunApplyState.default("not_applied"),
-    /** Tree SHA before this turn mutated the in-place tree (revert restore target). */
     preTurnSha: z
         .string()
         .nullable()
         .default(null)
         .describe("Tree SHA before this turn mutated the in-place tree (revert restore target)."),
-    /** Tree SHA right after this turn's mutation (revert divergence fence: refuse
-     * to revert if the working tree has diverged from this since). */
     postTurnSha: z
         .string()
         .nullable()
         .default(null)
         .describe("Tree SHA right after this turn's mutation; revert refuses if the working tree has diverged from this since."),
+    revertAnchorId: z.string().nullable().default(null).describe("GC-independent revert anchor."),
     /** Revert metadata is available (the turn mutated the live tree in place and
-     * pre/post-turn snapshots were recorded), so a Revert affordance may be offered.
+     * an external patch anchor was recorded), so a Revert affordance may be offered.
      * This is NOT a live-safe guarantee: the server re-checks tree divergence at
      * revert time and refuses (fail loud) if the working tree changed since. */
     revertable: z
@@ -448,7 +394,9 @@ export const ControlRunSummary = z
     state: ControlRunState,
     runDir: z.string().optional().describe("On-disk run artifact directory."),
     error: z.string().optional().describe("Error message, when the run failed."),
-    failure: RunFailure.nullable().default(null).describe("Typed failure record; null unless the run failed."),
+    failure: RunFailure.nullable()
+        .default(null)
+        .describe("Typed failure record; null unless the run failed."),
     project: ControlProjectMetadata.default({}),
     mode: ModeKind.optional(),
     /** v0.9 engine strategy on the mode (flags, not modes): race width / repair caps / swarm / create. */
@@ -460,14 +408,23 @@ export const ControlRunSummary = z
     prompt: z.string().optional().describe("The user's prompt for the run."),
     harnesses: z.array(z.string()).optional().describe("Harness pool the run used."),
     primaryHarness: z.string().optional().describe("Primary harness the run preferred."),
-    portfolio: Portfolio.optional(),
+    routingGoal: RoutingGoal.optional(),
     model: z.string().optional().describe("Scalar model requested for the run."),
-    reviewerPanel: z.array(ControlReviewerPanelEntry).optional().describe("Explicit reviewer panel used for the run."),
-    protectedPathApprovals: z.array(ProtectedPathApproval).optional().describe("Per-run protected-path approvals supplied."),
+    reviewerPanel: z
+        .array(ControlReviewerPanelEntry)
+        .optional()
+        .describe("Explicit reviewer panel used for the run."),
+    protectedPathApprovals: z
+        .array(ProtectedPathApproval)
+        .optional()
+        .describe("Per-run protected-path approvals supplied."),
     n: z.number().int().optional().describe("Race width, when the run was a race."),
-    maxUsd: z.number().nullable().optional().describe("USD cap for the run; null = no cap."),
+    paidBudget: PaidBudget.optional().describe("Explicit incremental-cash budget for the run."),
     spendUsd: z.number().nullable().optional().describe("Settled spend in USD; null when unknown."),
-    spendEstimated: z.boolean().optional().describe("True when spend is token-derived rather than natively reported."),
+    spendEstimated: z
+        .boolean()
+        .optional()
+        .describe("True when spend is token-derived rather than natively reported."),
     access: AccessProfile.optional().describe("Access profile of the run: the effective profile when known, else the requested one (prefer requestedAccess/effectiveAccess)."),
     requestedAccess: AccessProfile.optional().describe("Access profile the caller requested."),
     effectiveAccess: AccessProfile.optional().describe("Access profile actually enforced by the engine."),
@@ -475,7 +432,14 @@ export const ControlRunSummary = z
     webRequired: z.boolean().optional().describe("Whether the run required web evidence."),
     webMode: ExternalContextPolicy.optional().describe("Web policy actually executed by the selected route."),
     webEvidence: ControlWebEvidence.default({}),
-    toolPermissionPolicy: z.record(z.string(), z.unknown()).optional().describe("Tool allow/deny policy applied to the run."),
+    requestRequirements: z
+        .array(RequestRequirementResolution)
+        .default([])
+        .describe("Engine-computed requested/effective capability receipts for selected harness lanes."),
+    toolPermissionPolicy: z
+        .record(z.string(), z.unknown())
+        .optional()
+        .describe("Tool allow/deny policy applied to the run."),
     outputReadyState: OutputReadyState.default("pending"),
     /** Non-blocking tool warnings projected from final/telemetry.yaml. */
     toolWarningsTotal: z
@@ -487,10 +451,15 @@ export const ControlRunSummary = z
     /** Honest terminal outcome (what the turn did): patch/answer/plan/report/none. */
     result: ControlRunResult.default({}),
     /** True while at least one interaction.requested has no answered/timeout. */
-    waitingOnUser: z.boolean().default(false).describe("True while at least one interactive question is awaiting the user's answer."),
+    waitingOnUser: z
+        .boolean()
+        .default(false)
+        .describe("True while at least one interactive question is awaiting the user's answer."),
     /** Route evidence from telemetry; null when no telemetry exists (legacy). */
-    route: ControlRouteInfo.nullable().default(null).describe("Route evidence from telemetry; null when no telemetry exists (legacy runs)."),
-    tests: z.array(z.string()).optional().describe("Test commands configured as gates."),
+    route: ControlRouteInfo.nullable()
+        .default(null)
+        .describe("Route evidence from telemetry; null when no telemetry exists (legacy runs)."),
+    tests: z.array(TestCommandInvocation).optional().describe("Typed argv gates."),
     specId: z.string().optional().describe("SpecPack id the run was held to."),
     specHash: ContentHash.optional().describe("Content hash of the SpecPack the run was held to."),
     createdAt: z.string().optional().describe("When the run was created."),
@@ -516,19 +485,41 @@ export const ControlTimelineEvent = z
     attemptId: z.string().nullable().default(null).describe("Attempt involved, when any."),
     title: z.string().describe("Human-readable event title."),
     detail: z.string().nullable().default(null).describe("Human-readable event detail."),
-    severity: z.enum(["info", "warning", "error"]).default("info").describe("Display severity of the event."),
+    severity: z
+        .enum(["info", "warning", "error"])
+        .default("info")
+        .describe("Display severity of the event."),
     toolName: z.string().nullable().default(null).describe("Tool name for tool events."),
     target: z.string().nullable().default(null).describe("Redacted tool target for tool events."),
-    errorSummary: z.string().nullable().default(null).describe("Redacted error detail for error events."),
-    rawRef: z.string().nullable().default(null).describe("Reference to the raw underlying event/artifact."),
+    errorSummary: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Redacted error detail for error events."),
+    rawRef: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Reference to the raw underlying event/artifact."),
 })
     .describe("One projected timeline row of a run for display.");
 export const ControlBudgetSnapshot = z
     .object({
-    maxUsd: z.number().nullable().default(null).describe("USD cap for the run; null = no cap."),
-    spendUsd: z.number().nullable().default(null).describe("Spend so far in USD; null when unknown."),
-    remainingUsd: z.number().nullable().default(null).describe("Remaining budget in USD; null when no cap or unknown spend."),
-    estimated: z.boolean().default(false).describe("True when spend is token-derived rather than natively reported."),
+    paidBudget: PaidBudget.default({ kind: "unlimited" }),
+    spendUsd: z
+        .number()
+        .nullable()
+        .default(null)
+        .describe("Spend so far in USD; null when unknown."),
+    remainingUsd: z
+        .number()
+        .nullable()
+        .default(null)
+        .describe("Remaining budget in USD; null when no cap or unknown spend."),
+    estimated: z
+        .boolean()
+        .default(false)
+        .describe("True when spend is token-derived rather than natively reported."),
     source: z
         .enum(["decision", "events", "settings", "unknown"])
         .default("unknown")
@@ -539,11 +530,19 @@ export const ControlArtifactInfo = z
     .object({
     path: z.string().describe("Artifact path relative to the run directory."),
     kind: z.enum(["file", "directory"]).describe("Whether the artifact is a file or a directory."),
-    bytes: z.number().int().nonnegative().optional().describe("Size in bytes; absent for directories."),
+    bytes: z
+        .number()
+        .int()
+        .nonnegative()
+        .optional()
+        .describe("Size in bytes; absent for directories."),
     /** Clean MIME type derived from the extension (e.g. `image/png`, `text/plain`,
      *  `application/pdf`); lets a gallery render text vs image vs pdf. Absent for
      *  directories. */
-    mime: z.string().optional().describe("MIME type derived from the extension; absent for directories."),
+    mime: z
+        .string()
+        .optional()
+        .describe("MIME type derived from the extension; absent for directories."),
 })
     .describe("One artifact in the run's artifact tree.");
 /** A live interaction awaiting the user's answer (snapshot projection). */
@@ -551,12 +550,24 @@ export const ControlPendingInteraction = z
     .object({
     interactionId: Id.describe("Interaction id used to answer."),
     runId: Id.describe("Run the interaction belongs to."),
-    attemptId: z.string().nullable().default(null).describe("Attempt the interaction was raised in, when known."),
+    attemptId: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Attempt the interaction was raised in, when known."),
     harnessId: z.string().nullable().default(null).describe("Harness that raised the interaction."),
-    sourceTool: z.string().nullable().default(null).describe("Native tool that raised the request."),
+    sourceTool: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Native tool that raised the request."),
     questions: z.array(InteractionQuestion).default([]).describe("Questions awaiting answers."),
     requestedAt: z.string().describe("When the interaction was requested."),
-    timeoutAt: z.string().nullable().default(null).describe("When the interaction times out into a benign decline; null = no timeout."),
+    timeoutAt: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("When the interaction times out into a benign decline; null = no timeout."),
 })
     .describe("A live interactive question awaiting the user's answer (snapshot projection).");
 export const ControlInteractionAnswerRequest = z
@@ -565,8 +576,15 @@ export const ControlInteractionAnswerRequest = z
         .array(z
         .object({
         questionId: Id.describe("Id of the question being answered."),
-        selectedLabels: z.array(z.string()).default([]).describe("Labels of the selected options."),
-        freeText: z.string().nullable().default(null).describe("Free-text answer; null when only options were selected."),
+        selectedLabels: z
+            .array(z.string())
+            .default([])
+            .describe("Labels of the selected options."),
+        freeText: z
+            .string()
+            .nullable()
+            .default(null)
+            .describe("Free-text answer; null when only options were selected."),
     })
         .strict())
         .default([])
@@ -618,9 +636,15 @@ export const ControlRunControlResponse = z
     .describe("Response to a run control request.");
 export const ApplyTarget = z
     .discriminatedUnion("kind", [
-    z.object({ kind: z.literal("original_project") }).strict().describe("Apply to the project the run originally came from."),
     z
-        .object({ kind: z.literal("project"), root: z.string().describe("Absolute path of the target project root.") })
+        .object({ kind: z.literal("original_project") })
+        .strict()
+        .describe("Apply to the project the run originally came from."),
+    z
+        .object({
+        kind: z.literal("project"),
+        root: z.string().describe("Absolute path of the target project root."),
+    })
         .strict()
         .describe("Apply to an explicitly named project root."),
 ])
@@ -663,11 +687,17 @@ export const ControlRunDecisionRequest = z
     .object({
     action: RunDecisionAction,
     /** Findings the decision targets (override/accept_risk). */
-    findingIds: z.array(Id).default([]).describe("Findings the decision targets (override/accept_risk)."),
+    findingIds: z
+        .array(Id)
+        .default([])
+        .describe("Findings the decision targets (override/accept_risk)."),
     /** Reviewer feedback to seed a rerun turn. */
     feedback: z.string().optional().describe("Reviewer feedback to seed a rerun turn."),
     /** Risk reasons being explicitly accepted (recorded, never silent). */
-    acceptedRisks: z.array(z.string()).default([]).describe("Risk reasons being explicitly accepted (recorded, never silent)."),
+    acceptedRisks: z
+        .array(z.string())
+        .default([])
+        .describe("Risk reasons being explicitly accepted (recorded, never silent)."),
     /** Apply mode + target for accept_clean_patch. */
     applyMode: z
         .enum(["artifact_only", "apply", "branch", "commit", "pr"])
@@ -693,19 +723,37 @@ export const ControlThread = z
     .object({
     id: Id.describe("Thread id."),
     title: z.string().nullable().default(null).describe("Thread title; null until set."),
-    repoRoot: z.string().nullable().default(null).describe("Project root the thread is anchored to; null for a no-project thread."),
+    repoRoot: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Project root the thread is anchored to; null for a no-project thread."),
     mode: ModeKind.optional().describe("Default mode for new turns."),
     /** How turns touch files (in-place live tree vs isolated worktree). */
     workspaceMode: WorkspaceMode.default("in_place"),
     authPreference: AuthPreference.default("auto"),
-    primaryHarness: z.string().nullable().default(null).describe("Sticky primary harness for the thread; null = engine routing."),
+    primaryHarness: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Sticky primary harness for the thread; null = engine routing."),
     /** Sticky eligible pool for the thread (empty => engine auto-pools). */
-    eligibleHarnesses: z.array(z.string()).default([]).describe("Sticky eligible harness pool; empty = the engine auto-pools."),
+    eligibleHarnesses: z
+        .array(z.string())
+        .default([])
+        .describe("Sticky eligible harness pool; empty = the engine auto-pools."),
     state: ThreadState.default("active"),
+    trashedAt: z.string().nullable().default(null).describe("When the thread entered trash."),
+    purgeAfter: z.string().nullable().default(null).describe("When trash retention expires."),
     runIds: z.array(Id).default([]).describe("Ordered run lineage of the thread."),
-    headRunId: Id.nullable().default(null).describe("Most recent run of the thread; null before the first turn runs."),
+    headRunId: Id.nullable()
+        .default(null)
+        .describe("Most recent run of the thread; null before the first turn runs."),
     /** True when the head turn is blocked on a human decision (needs-me inbox). */
-    needsHuman: z.boolean().default(false).describe("True when the head turn is blocked on a human decision (needs-me inbox)."),
+    needsHuman: z
+        .boolean()
+        .default(false)
+        .describe("True when the head turn is blocked on a human decision (needs-me inbox)."),
     createdAt: z.string().describe("When the thread was created."),
     updatedAt: z.string().describe("When the thread was last updated."),
 })
@@ -715,9 +763,20 @@ export const ControlSession = z
     id: Id.describe("Session id."),
     threadId: Id.describe("Thread the session belongs to."),
     harnessId: Id.describe("Harness the session is bound to."),
-    nativeSessionId: z.string().nullable().default(null).describe("The vendor CLI session id; null when none exists."),
-    observedModel: z.string().nullable().default(null).describe("Model last observed on the session's stream."),
-    state: z.enum(["live", "stale", "rebound"]).default("live").describe("Session cache state: live, stale, or rebound."),
+    nativeSessionId: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("The vendor CLI session id; null when none exists."),
+    observedModel: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("Model last observed on the session's stream."),
+    state: z
+        .enum(["live", "stale", "rebound"])
+        .default("live")
+        .describe("Session cache state: live, stale, or rebound."),
 })
     .describe("Control-plane projection of a vendor CLI session bound to a thread.");
 /**
@@ -737,8 +796,15 @@ export const ControlTurnRunCard = z
     result: ControlRunResult.default({}),
     spendUsd: z.number().nullable().optional().describe("Settled spend in USD; null when unknown."),
     outputReadyState: OutputReadyState.default("pending"),
-    waitingOnUser: z.boolean().default(false).describe("True while an interactive question is awaiting the user's answer."),
-    finishedAt: z.string().nullable().default(null).describe("When the run finished; null while live."),
+    waitingOnUser: z
+        .boolean()
+        .default(false)
+        .describe("True while an interactive question is awaiting the user's answer."),
+    finishedAt: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("When the run finished; null while live."),
 })
     .describe("Compact run state embedded on a turn so a chat surface renders the whole conversation from one thread fetch.");
 export const ControlThreadTurn = z
@@ -748,11 +814,15 @@ export const ControlThreadTurn = z
     runId: Id.nullable().default(null).describe("Run backing this turn; null while unbound."),
     parentRunId: Id.nullable().default(null).describe("Run this turn follows up on, when any."),
     /** Set when this turn implements an approved plan from an earlier run. */
-    planRunId: Id.nullable().default(null).describe("Set when this turn implements an approved plan from an earlier run."),
+    planRunId: Id.nullable()
+        .default(null)
+        .describe("Set when this turn implements an approved plan from an earlier run."),
     kind: ThreadTurnKind.default("followup"),
     prompt: z.string().default("").describe("The user's message for this turn."),
     /** Embedded run card (outcome/state) so the chat renders without N+1 fetches. */
-    run: ControlTurnRunCard.nullable().default(null).describe("Embedded run card (outcome/state); null while no run is bound."),
+    run: ControlTurnRunCard.nullable()
+        .default(null)
+        .describe("Embedded run card (outcome/state); null while no run is bound."),
     /** Why this turn has NO run (enqueue/preflight refusal, e.g. the trust
      * gate) — surfaces render it as an inline failure card with the remedy;
      * null once a run binds (retry clears it). `code` is the typed throw's
@@ -762,7 +832,11 @@ export const ControlThreadTurn = z
     enqueueError: z
         .object({
         message: z.string().describe("Human-readable refusal message."),
-        code: z.string().nullable().default(null).describe("Machine-readable refusal code; remedies key on it, never on the message text."),
+        code: z
+            .string()
+            .nullable()
+            .default(null)
+            .describe("Machine-readable refusal code; remedies key on it, never on the message text."),
         retryable: z
             .boolean()
             .default(true)
@@ -784,7 +858,10 @@ export const ControlThreadCreateRequest = z
     authPreference: AuthPreference.optional().describe("Per-thread auth preference override."),
     primaryHarness: NonBlankString.optional().describe("Sticky primary harness for the thread."),
     /** Sticky eligible pool for the thread; turns inherit it when unset. */
-    eligibleHarnesses: z.array(NonBlankString).optional().describe("Sticky eligible harness pool; turns inherit it when unset."),
+    eligibleHarnesses: z
+        .array(NonBlankString)
+        .optional()
+        .describe("Sticky eligible harness pool; turns inherit it when unset."),
 })
     .strict()
     .describe("Request body for POST /threads.");
@@ -793,35 +870,17 @@ export const ControlThreadCreateRequest = z
 export const ControlThreadUpdateRequest = z
     .object({
     title: z.string().optional().describe("New thread title."),
-    state: ThreadState.optional().describe("New thread state (active/closed)."),
-    primaryHarness: NonBlankString.nullable().optional().describe("New sticky primary harness; null clears back to engine routing."),
-    eligibleHarnesses: z.array(NonBlankString).optional().describe("New sticky eligible harness pool."),
+    state: z.enum(["active", "closed"]).optional().describe("New open/archive state."),
+    primaryHarness: NonBlankString.nullable()
+        .optional()
+        .describe("New sticky primary harness; null clears back to engine routing."),
+    eligibleHarnesses: z
+        .array(NonBlankString)
+        .optional()
+        .describe("New sticky eligible harness pool."),
 })
     .strict()
     .describe("Request body for PATCH /threads/:id: rename, archive, or switch sticky routing.");
-/** Apply an isolated thread's accumulated worktree diff to the project. */
-export const ControlThreadApplyRequest = z
-    .object({
-    mode: z
-        .enum(["apply", "branch", "commit", "pr"])
-        .default("apply")
-        .describe("Delivery mode: apply to the tree, or as a branch, commit, or PR."),
-    branch: z.string().optional().describe("Branch name for branch/pr modes."),
-    message: z.string().optional().describe("Commit message for commit/pr modes."),
-})
-    .strict()
-    .describe("Request body applying an isolated thread's accumulated worktree diff to the project.");
-export const ControlThreadApplyResponse = z
-    .object({
-    applied: z.boolean().describe("Whether anything was delivered."),
-    status: z
-        .enum(["applied", "branched", "committed", "pr_opened", "empty", "conflict", "rejected"])
-        .describe("Delivery outcome: applied, branched, committed, pr_opened, empty (no diff), conflict, or rejected."),
-    /** True when the project HEAD moved past the thread base since the thread started. */
-    headMoved: z.boolean().default(false).describe("True when the project HEAD moved past the thread base since the thread started."),
-    detail: z.string().nullable().default(null).describe("Human-readable detail."),
-})
-    .describe("Response to a thread apply.");
 export const ControlThreadListResponse = z
     .object({
     threads: z.array(ControlThread).default([]).describe("All threads."),
@@ -838,20 +897,42 @@ export const HarnessStatusDto = z
     .object({
     id: z.string().describe("Harness id."),
     status: AdapterStatus,
-    manifest: HarnessManifest.nullable().optional().describe("The harness's declared manifest, when available."),
-    enabledIntents: z.array(z.string()).default([]).describe("Intents the gateway will route to this harness."),
+    manifest: HarnessManifest.nullable()
+        .optional()
+        .describe("The harness's declared manifest, when available."),
+    enabledIntents: z
+        .array(z.string())
+        .default([])
+        .describe("Intents the gateway will route to this harness."),
     disabledIntents: z.array(z.string()).default([]).describe("Intents the doctor disabled."),
     checks: z.array(ConformanceCheck).default([]).describe("Doctor probe results."),
-    reasons: z.array(z.string()).default([]).describe("Human-readable reasons for degraded/unavailable status."),
+    reasons: z
+        .array(z.string())
+        .default([])
+        .describe("Human-readable reasons for degraded/unavailable status."),
+    authSources: z
+        .array(AuthSourceReadiness)
+        .default([])
+        .describe("Doctor-backed readiness by authentication source; an empty array means readiness was not reported."),
     /** The user's configured per-harness default model, if any. */
-    configuredModel: z.string().nullable().default(null).describe("The user's configured per-harness default model, if any."),
+    configuredModel: z
+        .string()
+        .nullable()
+        .default(null)
+        .describe("The user's configured per-harness default model, if any."),
     /** Strict truth-source check of `configuredModel`: null when no model
      * is configured; a rejection carries the actionable message so UIs render
      * the same honesty `claudexor doctor` prints. */
     configuredModelCheck: z
         .object({
-        status: z.enum(["ok", "rejected"]).describe("Whether the configured model passes the strict truth-source check."),
-        message: z.string().nullable().default(null).describe("Actionable rejection message, when rejected."),
+        status: z
+            .enum(["ok", "rejected"])
+            .describe("Whether the configured model passes the strict truth-source check."),
+        message: z
+            .string()
+            .nullable()
+            .default(null)
+            .describe("Actionable rejection message, when rejected."),
     })
         .nullable()
         .default(null)
@@ -860,7 +941,10 @@ export const HarnessStatusDto = z
     .describe("Doctor-backed status row for one harness: status, intents, checks, and configured-model validity.");
 export const ControlHarnessListResponse = z
     .object({
-    harnesses: z.array(HarnessStatusDto).default([]).describe("Status rows for all known harnesses."),
+    harnesses: z
+        .array(HarnessStatusDto)
+        .default([])
+        .describe("Status rows for all known harnesses."),
 })
     .describe("Response for GET /harnesses.");
 /**
@@ -873,7 +957,10 @@ export const ControlHarnessListResponse = z
 export const ControlHarnessModelsResponse = z
     .object({
     harnessId: z.string().describe("Harness the models belong to."),
-    models: z.array(HarnessModel).default([]).describe("Enumerable models; empty when the harness has no model truth source."),
+    models: z
+        .array(HarnessModel)
+        .default([])
+        .describe("Enumerable models; empty when the harness has no model truth source."),
     source: z
         .enum(["api", "manifest", "none"])
         .describe("Provenance of the list: api (a live vendor enumeration), manifest (the manifest's known-good hint set), or none (no model truth source; explicit models are refused)."),
@@ -888,8 +975,10 @@ export const ControlHarnessModelsResponse = z
     .describe("Models enumerable for one harness, with honest provenance.");
 export const ControlSettingsSnapshot = z
     .object({
-    sources: z.array(z.string()).default([]).describe("Config file paths that contributed to the snapshot."),
-    defaultPortfolio: Portfolio.default("subscription-first").describe("Budget portfolio used when a run does not specify one."),
+    sources: z
+        .array(z.string())
+        .default([])
+        .describe("Config file paths that contributed to the snapshot."),
     /** How long a run waits for an interactive answer before a benign decline. */
     interactionTimeoutMs: z
         .number()
@@ -899,26 +988,44 @@ export const ControlSettingsSnapshot = z
         .describe("How long a run waits for an interactive answer before a benign decline, in milliseconds."),
     routing: z
         .object({
-        defaultPolicy: z.enum(["auto", "primary"]).default("auto").describe("Default routing policy."),
-        primaryHarness: z.string().nullable().default(null).describe("Global default primary harness; null = engine decides."),
-        eligibleHarnesses: z.array(z.string()).default([]).describe("Harness pool eligible for routing/races; empty = all available."),
+        defaultPolicy: z
+            .enum(["auto", "primary"])
+            .default("auto")
+            .describe("Default routing policy."),
+        primaryHarness: z
+            .string()
+            .nullable()
+            .default(null)
+            .describe("Global default primary harness; null = engine decides."),
+        eligibleHarnesses: z
+            .array(z.string())
+            .default([])
+            .describe("Harness pool eligible for routing/races; empty = all available."),
         envInheritance: z
             .enum(["mirror_native", "clean"])
             .default("mirror_native")
             .describe("How the child harness env is built: mirror_native inherits the shell env; clean spawns from a minimal allowlist."),
         authPreference: AuthPreference.default("auto"),
+        goal: RoutingGoal.default("auto"),
+        paidFallback: PaidFallback.default("when_unavailable"),
+        qualityTiers: QualityTierSet,
     })
         .default({})
         .describe("Global routing settings."),
     budget: z
         .object({
-        maxUsdPerRun: z.number().nullable().default(null).describe("Global USD cap per run; null = no cap."),
+        paidBudgetPerRun: PaidBudget.default({ kind: "unlimited" }),
     })
         .default({})
         .describe("Global budget limits."),
     runtime: z
         .object({
-        reviewerTimeoutMs: z.number().int().positive().default(600_000).describe("Wall-clock timeout for a reviewer run, in milliseconds."),
+        reviewerTimeoutMs: z
+            .number()
+            .int()
+            .positive()
+            .default(600_000)
+            .describe("Wall-clock timeout for a reviewer run, in milliseconds."),
         harnessInactivityTimeoutMs: z
             .number()
             .int()
@@ -927,9 +1034,24 @@ export const ControlSettingsSnapshot = z
             .describe("Inactivity watchdog for harness streams, in milliseconds."),
         transientRetry: z
             .object({
-            maxRetries: z.number().int().nonnegative().default(2).describe("Maximum retries for a transient failure."),
-            initialDelayMs: z.number().int().nonnegative().default(1_000).describe("Initial retry delay in milliseconds."),
-            maxDelayMs: z.number().int().nonnegative().default(10_000).describe("Maximum retry delay in milliseconds."),
+            maxRetries: z
+                .number()
+                .int()
+                .nonnegative()
+                .default(2)
+                .describe("Maximum retries for a transient failure."),
+            initialDelayMs: z
+                .number()
+                .int()
+                .nonnegative()
+                .default(1_000)
+                .describe("Initial retry delay in milliseconds."),
+            maxDelayMs: z
+                .number()
+                .int()
+                .nonnegative()
+                .default(10_000)
+                .describe("Maximum retry delay in milliseconds."),
         })
             .default({})
             .describe("Bounded retry policy for transient failures."),
@@ -939,15 +1061,45 @@ export const ControlSettingsSnapshot = z
     harnesses: z
         .record(z.string(), z
         .object({
-        enabled: z.boolean().default(true).describe("Whether the harness participates in routing."),
-        defaultModel: z.string().nullable().default(null).describe("Per-harness default model; null = the harness's own default."),
-        effort: EffortHint.nullable().default(null).describe("Default reasoning effort; null = harness default."),
-        maxTurns: z.number().int().positive().nullable().default(null).describe("Default max agent turns; null = no limit."),
-        maxRounds: z.number().int().positive().nullable().default(null).describe("Default max convergence rounds; null = engine default."),
-        maxUsd: z.number().nonnegative().nullable().default(null).describe("Per-harness USD cap; null = no cap."),
-        toolsAllow: z.array(z.string()).default([]).describe("Tool names allowed for this harness."),
-        toolsDeny: z.array(z.string()).default([]).describe("Tool names denied for this harness."),
-        fallbackModel: z.string().nullable().default(null).describe("Model to fall back to on typed fallback signals; null = none."),
+        enabled: z
+            .boolean()
+            .default(true)
+            .describe("Whether the harness participates in routing."),
+        defaultModel: z
+            .string()
+            .nullable()
+            .default(null)
+            .describe("Per-harness default model; null = the harness's own default."),
+        effort: EffortHint.nullable()
+            .default(null)
+            .describe("Default reasoning effort; null = harness default."),
+        maxTurns: z
+            .number()
+            .int()
+            .positive()
+            .nullable()
+            .default(null)
+            .describe("Default max agent turns; null = no limit."),
+        maxRounds: z
+            .number()
+            .int()
+            .positive()
+            .nullable()
+            .default(null)
+            .describe("Default max convergence rounds; null = engine default."),
+        toolsAllow: z
+            .array(z.string())
+            .default([])
+            .describe("Tool names allowed for this harness."),
+        toolsDeny: z
+            .array(z.string())
+            .default([])
+            .describe("Tool names denied for this harness."),
+        fallbackModel: z
+            .string()
+            .nullable()
+            .default(null)
+            .describe("Model to fall back to on typed fallback signals; null = none."),
         web: ExternalContextPolicy.default("auto").describe("Default web policy for this harness."),
         authPreference: AuthPreference.default("auto"),
     })
@@ -963,14 +1115,31 @@ export const ControlSettingsSnapshot = z
 export const ControlHarnessSettingsPatch = z
     .object({
     enabled: z.boolean().optional().describe("Enable/disable the harness for routing."),
-    defaultModel: NonBlankString.nullable().optional().describe("New per-harness default model; null clears it."),
-    effort: EffortHint.nullable().optional().describe("New default reasoning effort; null clears it."),
-    maxTurns: z.number().int().positive().nullable().optional().describe("New max agent turns; null clears the limit."),
-    maxRounds: z.number().int().positive().nullable().optional().describe("New max convergence rounds; null clears it."),
-    maxUsd: z.number().nonnegative().nullable().optional().describe("New per-harness USD cap; null clears it."),
+    defaultModel: NonBlankString.nullable()
+        .optional()
+        .describe("New per-harness default model; null clears it."),
+    effort: EffortHint.nullable()
+        .optional()
+        .describe("New default reasoning effort; null clears it."),
+    maxTurns: z
+        .number()
+        .int()
+        .positive()
+        .nullable()
+        .optional()
+        .describe("New max agent turns; null clears the limit."),
+    maxRounds: z
+        .number()
+        .int()
+        .positive()
+        .nullable()
+        .optional()
+        .describe("New max convergence rounds; null clears it."),
     toolsAllow: z.array(NonBlankString).optional().describe("New tool allowlist."),
     toolsDeny: z.array(NonBlankString).optional().describe("New tool denylist."),
-    fallbackModel: NonBlankString.nullable().optional().describe("New fallback model; null clears it."),
+    fallbackModel: NonBlankString.nullable()
+        .optional()
+        .describe("New fallback model; null clears it."),
     web: ExternalContextPolicy.optional().describe("New default web policy."),
     authPreference: AuthPreference.optional().describe("New auth route preference."),
 })
@@ -978,14 +1147,28 @@ export const ControlHarnessSettingsPatch = z
     .describe("Partial per-harness settings patch; absent fields keep their stored value, and a typoed key 400s (strict).");
 export const ControlSettingsUpdateRequest = z
     .object({
-    defaultPortfolio: Portfolio.optional(),
-    interactionTimeoutMs: z.number().int().positive().optional().describe("New interactive-answer timeout, in milliseconds."),
+    routingGoal: RoutingGoal.optional(),
+    paidFallback: PaidFallback.optional(),
+    qualityTiers: QualityTierSet.optional(),
+    interactionTimeoutMs: z
+        .number()
+        .int()
+        .positive()
+        .optional()
+        .describe("New interactive-answer timeout, in milliseconds."),
     routingPolicy: z.enum(["auto", "primary"]).optional().describe("New default routing policy."),
-    primaryHarness: NonBlankString.nullable().optional().describe("New global primary harness; null clears back to engine routing."),
-    eligibleHarnesses: z.array(NonBlankString).optional().describe("New global eligible harness pool."),
-    envInheritance: z.enum(["mirror_native", "clean"]).optional().describe("New child harness env composition mode."),
-    maxUsdPerRun: z.number().nonnegative().optional().describe("New global USD cap per run (mutually exclusive with clearMaxUsdPerRun)."),
-    clearMaxUsdPerRun: z.boolean().optional().describe("Clear the global USD cap per run (mutually exclusive with maxUsdPerRun)."),
+    primaryHarness: NonBlankString.nullable()
+        .optional()
+        .describe("New global primary harness; null clears back to engine routing."),
+    eligibleHarnesses: z
+        .array(NonBlankString)
+        .optional()
+        .describe("New global eligible harness pool."),
+    envInheritance: z
+        .enum(["mirror_native", "clean"])
+        .optional()
+        .describe("New child harness env composition mode."),
+    paidBudgetPerRun: PaidBudget.optional().describe("New global incremental-cash budget per run."),
     authPreference: AuthPreference.optional().describe("New global auth route preference."),
     harnesses: z
         .record(NonBlankString, ControlHarnessSettingsPatch)
@@ -993,30 +1176,5 @@ export const ControlSettingsUpdateRequest = z
         .describe("Per-harness settings patches keyed by harness id."),
 })
     .strict()
-    .superRefine((value, ctx) => {
-    if (value.maxUsdPerRun !== undefined && value.clearMaxUsdPerRun === true) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            path: ["maxUsdPerRun"],
-            message: "maxUsdPerRun and clearMaxUsdPerRun are mutually exclusive",
-        });
-    }
-})
     .describe("Request body for PATCH /settings; absent fields keep their stored values.");
-/** Secret list row: exactly what the store's list() can honestly produce
- * (the never-populated harnesses/env/description fields were retired in the
- * v0.15 triage). */
-export const SecretMetadata = z
-    .object({
-    name: z.string().describe("Secret name/label."),
-    backend: z.enum(["keychain", "file"]).describe("Where the secret is stored: the OS keychain or a file store."),
-    present: z.boolean().default(true).describe("Whether a value is actually stored."),
-})
-    .describe("Secret list row: name, storage backend, and presence — never the value.");
-export const ControlSecretListResponse = z
-    .object({
-    backend: z.enum(["keychain", "file"]).describe("Active secret store backend."),
-    secrets: z.array(SecretMetadata).default([]).describe("Stored secrets (metadata only, never values)."),
-})
-    .describe("Response for listing stored secrets (metadata only).");
 //# sourceMappingURL=control.js.map