@claudexor/schema 3.1.2 → 3.3.7-rc.0

package/dist/credential-profile-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-profile-snapshot.d.ts","sourceRoot":"","sources":["../src/credential-profile-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAM3B;+EAC+E;AAC/E,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmBnD,CAAC;AACJ,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAC7D,OAAO,yCAAyC,CACjD,CAAC;AAEF;;+EAE+E;AAC/E,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAEqC,CAAC;AACzF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC"}

package/dist/credential-profile-snapshot.js

@@ -0,0 +1,28 @@
+import { z } from "zod/v3";
+import { ControlCredentialProfilesResponse } from "./credential-profile.js";
+import { GitCapability } from "./git-capability.js";
+import { ControlQuotaResponse } from "./quota.js";
+import { HarnessStatusDto } from "./readiness.js";
+/** Opt-in atomic Accounts snapshot (`GET /credential-profiles?snapshot=true`).
+ * The legacy response stays byte/shape compatible for older strict clients. */
+export const ControlCredentialProfilesSnapshotResponse = ControlCredentialProfilesResponse.extend({
+    harnesses: z
+        .array(HarnessStatusDto)
+        .describe("Fresh harness readiness used for the account next-up projection."),
+    git: GitCapability.describe("Git readiness from the same Accounts refresh cycle."),
+    quota: ControlQuotaResponse.describe("Fresh quota response used to compute next-up in this exact Accounts snapshot epoch."),
+    quotaEventCursor: z
+        .string()
+        .min(1)
+        .max(4096)
+        .describe("Opaque global-journal cursor fencing the returned quota response; pass it verbatim as Last-Event-ID only for the dedicated quota event observer, never the general stream."),
+})
+    .strict()
+    .describe("Atomic Accounts snapshot: profiles, next-up authority, fresh harness readiness, Git capability, and quota from one server-authored epoch.");
+/** Operation-catalog response contract for the query-shaped endpoint. The
+ * actual route selects exactly one member from the validated `snapshot` query;
+ * this union keeps discovery/docs honest without changing the legacy shape. */
+export const ControlCredentialProfilesQueryResponse = z
+    .union([ControlCredentialProfilesResponse, ControlCredentialProfilesSnapshotResponse])
+    .describe("Legacy credential-profile listing or the opt-in atomic Accounts snapshot.");
+//# sourceMappingURL=credential-profile-snapshot.js.map

package/dist/credential-profile-snapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-profile-snapshot.js","sourceRoot":"","sources":["../src/credential-profile-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,iCAAiC,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD;+EAC+E;AAC/E,MAAM,CAAC,MAAM,yCAAyC,GAAG,iCAAiC,CAAC,MAAM,CAAC;IAChG,SAAS,EAAE,CAAC;SACT,KAAK,CAAC,gBAAgB,CAAC;SACvB,QAAQ,CAAC,kEAAkE,CAAC;IAC/E,GAAG,EAAE,aAAa,CAAC,QAAQ,CAAC,qDAAqD,CAAC;IAClF,KAAK,EAAE,oBAAoB,CAAC,QAAQ,CAClC,qFAAqF,CACtF;IACD,gBAAgB,EAAE,CAAC;SAChB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,IAAI,CAAC;SACT,QAAQ,CACP,4KAA4K,CAC7K;CACJ,CAAC;KACC,MAAM,EAAE;KACR,QAAQ,CACP,2IAA2I,CAC5I,CAAC;AAKJ;;+EAE+E;AAC/E,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,KAAK,CAAC,CAAC,iCAAiC,EAAE,yCAAyC,CAAC,CAAC;KACrF,QAAQ,CAAC,2EAA2E,CAAC,CAAC"}

package/dist/credential-profile.d.ts

@@ -1,4 +1,4 @@
-import { z } from "zod";
+import { z } from "zod/v3";
 /**
  * The credential transport a profile isolates (INV-135). `config_dir_login` is
  * a vendor-owned login living in a Claudexor-scoped config dir (claude
@@ -71,20 +71,30 @@ export declare const CredentialProfileStatus: z.ZodObject<{
     harness_id: z.ZodString;
     availability: z.ZodEnum<["available", "unavailable", "unknown"]>;
     verification: z.ZodEnum<["passed", "failed", "not_run"]>;
+    /** WHAT the `verification` verdict is worth. `local_store` means only that
+     * this profile's own credential material is present and well-formed where
+     * it should be — it cannot tell a live token from a revoked one.
+     * `vendor` means the vendor itself answered a request made with THIS
+     * profile's credential. A router that needs "configured AND healthy" must
+     * read this alongside `verification`; `passed` + `local_store` promises
+     * strictly less than it sounds. */
+    verification_source: z.ZodDefault<z.ZodEnum<["local_store", "vendor"]>>;
     detail: z.ZodOptional<z.ZodString>;
     last_verified_at: z.ZodDefault<z.ZodNullable<z.ZodString>>;
 }, "strict", z.ZodTypeAny, {
-    availability: "unknown" | "available" | "unavailable";
-    verification: "passed" | "failed" | "not_run";
     profile_id: string;
     harness_id: string;
-    last_verified_at: string | null;
+    availability: "available" | "unavailable" | "unknown";
+    verification: "failed" | "not_run" | "passed";
+    verification_source: "local_store" | "vendor";
     detail?: string | undefined;
+    last_verified_at: string | null;
 }, {
-    availability: "unknown" | "available" | "unavailable";
-    verification: "passed" | "failed" | "not_run";
     profile_id: string;
     harness_id: string;
+    availability: "available" | "unavailable" | "unknown";
+    verification: "failed" | "not_run" | "passed";
+    verification_source?: "local_store" | "vendor" | undefined;
     detail?: string | undefined;
     last_verified_at?: string | null | undefined;
 }>;
@@ -103,11 +113,11 @@ export declare const AccountIdentity: z.ZodObject<{
     email: z.ZodOptional<z.ZodString>;
     plan: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
-    plan?: string | undefined;
     email?: string | undefined;
-}, {
     plan?: string | undefined;
+}, {
     email?: string | undefined;
+    plan?: string | undefined;
 }>;
 export type AccountIdentity = z.infer<typeof AccountIdentity>;
 /**
@@ -115,8 +125,8 @@ export type AccountIdentity = z.infer<typeof AccountIdentity>;
  * purely informational, never user-set. Server-computed by the routing owner
  * from enabled profiles + native readiness + quota so no surface re-derives it:
  * `profile` names the enabled credential profile a quota-rotation would land on;
- * `native` is the CLI login (the default subject of an unpinned run); `none`
- * means an unpinned run has nothing routable (the CLI login is disabled and no
+ * `native` is the existing unprofiled/default subject (normally the CLI login,
+ * or the configured key for an API-only harness); `none` means an unpinned run has nothing routable (the default is disabled and no
  * account is pinned) with a human reason. Explicit control stays a per-run
  * `--profile` pin or a per-thread pin — this field never gates routing.
  */
@@ -131,10 +141,13 @@ export declare const ControlNextUpIdentity: z.ZodDiscriminatedUnion<"kind", [z.Z
     profileId: string;
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"native">;
+    route: z.ZodOptional<z.ZodEnum<["local_session", "api_key"]>>;
 }, "strict", z.ZodTypeAny, {
     kind: "native";
+    route?: "api_key" | "local_session" | undefined;
 }, {
     kind: "native";
+    route?: "api_key" | "local_session" | undefined;
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"none">;
     reason: z.ZodString;
@@ -162,11 +175,11 @@ export declare const ControlHarnessAccounts: z.ZodObject<{
         email: z.ZodOptional<z.ZodString>;
         plan: z.ZodOptional<z.ZodString>;
     }, "strict", z.ZodTypeAny, {
-        plan?: string | undefined;
         email?: string | undefined;
-    }, {
         plan?: string | undefined;
+    }, {
         email?: string | undefined;
+        plan?: string | undefined;
     }>>>;
     next_up: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
         kind: z.ZodLiteral<"profile">;
@@ -179,10 +192,13 @@ export declare const ControlHarnessAccounts: z.ZodObject<{
         profileId: string;
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"native">;
+        route: z.ZodOptional<z.ZodEnum<["local_session", "api_key"]>>;
     }, "strict", z.ZodTypeAny, {
         kind: "native";
+        route?: "api_key" | "local_session" | undefined;
     }, {
         kind: "native";
+        route?: "api_key" | "local_session" | undefined;
     }>, z.ZodObject<{
         kind: z.ZodLiteral<"none">;
         reason: z.ZodString;
@@ -198,14 +214,15 @@ export declare const ControlHarnessAccounts: z.ZodObject<{
     native_credentials_enabled: boolean;
     native_login_detected: boolean;
     identity: {
-        plan?: string | undefined;
         email?: string | undefined;
+        plan?: string | undefined;
     } | null;
     next_up: {
         kind: "profile";
         profileId: string;
     } | {
         kind: "native";
+        route?: "api_key" | "local_session" | undefined;
     } | {
         kind: "none";
         reason: string;
@@ -214,19 +231,20 @@ export declare const ControlHarnessAccounts: z.ZodObject<{
     harness_id: string;
     native_credentials_enabled: boolean;
     native_login_detected: boolean;
+    identity?: {
+        email?: string | undefined;
+        plan?: string | undefined;
+    } | null | undefined;
     next_up: {
         kind: "profile";
         profileId: string;
     } | {
         kind: "native";
+        route?: "api_key" | "local_session" | undefined;
     } | {
         kind: "none";
         reason: string;
     };
-    identity?: {
-        plan?: string | undefined;
-        email?: string | undefined;
-    } | null | undefined;
 }>;
 export type ControlHarnessAccounts = z.infer<typeof ControlHarnessAccounts>;
 /** Control response: every registered profile with its doctor projection, plus
@@ -284,20 +302,30 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             harness_id: z.ZodString;
             availability: z.ZodEnum<["available", "unavailable", "unknown"]>;
             verification: z.ZodEnum<["passed", "failed", "not_run"]>;
+            /** WHAT the `verification` verdict is worth. `local_store` means only that
+             * this profile's own credential material is present and well-formed where
+             * it should be — it cannot tell a live token from a revoked one.
+             * `vendor` means the vendor itself answered a request made with THIS
+             * profile's credential. A router that needs "configured AND healthy" must
+             * read this alongside `verification`; `passed` + `local_store` promises
+             * strictly less than it sounds. */
+            verification_source: z.ZodDefault<z.ZodEnum<["local_store", "vendor"]>>;
             detail: z.ZodOptional<z.ZodString>;
             last_verified_at: z.ZodDefault<z.ZodNullable<z.ZodString>>;
         }, "strict", z.ZodTypeAny, {
-            availability: "unknown" | "available" | "unavailable";
-            verification: "passed" | "failed" | "not_run";
             profile_id: string;
             harness_id: string;
-            last_verified_at: string | null;
+            availability: "available" | "unavailable" | "unknown";
+            verification: "failed" | "not_run" | "passed";
+            verification_source: "local_store" | "vendor";
             detail?: string | undefined;
+            last_verified_at: string | null;
         }, {
-            availability: "unknown" | "available" | "unavailable";
-            verification: "passed" | "failed" | "not_run";
             profile_id: string;
             harness_id: string;
+            availability: "available" | "unavailable" | "unknown";
+            verification: "failed" | "not_run" | "passed";
+            verification_source?: "local_store" | "vendor" | undefined;
             detail?: string | undefined;
             last_verified_at?: string | null | undefined;
         }>;
@@ -305,21 +333,13 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             email: z.ZodOptional<z.ZodString>;
             plan: z.ZodOptional<z.ZodString>;
         }, "strict", z.ZodTypeAny, {
-            plan?: string | undefined;
             email?: string | undefined;
-        }, {
             plan?: string | undefined;
+        }, {
             email?: string | undefined;
+            plan?: string | undefined;
         }>>>;
     }, "strict", z.ZodTypeAny, {
-        status: {
-            availability: "unknown" | "available" | "unavailable";
-            verification: "passed" | "failed" | "not_run";
-            profile_id: string;
-            harness_id: string;
-            last_verified_at: string | null;
-            detail?: string | undefined;
-        };
         profile: {
             profile_id: string;
             harness_id: string;
@@ -330,19 +350,20 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             enabled: boolean;
             created_at: string | null;
         };
-        identity: {
-            plan?: string | undefined;
-            email?: string | undefined;
-        } | null;
-    }, {
         status: {
-            availability: "unknown" | "available" | "unavailable";
-            verification: "passed" | "failed" | "not_run";
             profile_id: string;
             harness_id: string;
+            availability: "available" | "unavailable" | "unknown";
+            verification: "failed" | "not_run" | "passed";
+            verification_source: "local_store" | "vendor";
             detail?: string | undefined;
-            last_verified_at?: string | null | undefined;
+            last_verified_at: string | null;
         };
+        identity: {
+            email?: string | undefined;
+            plan?: string | undefined;
+        } | null;
+    }, {
         profile: {
             profile_id: string;
             harness_id: string;
@@ -353,9 +374,18 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             enabled?: boolean | undefined;
             created_at?: string | null | undefined;
         };
+        status: {
+            profile_id: string;
+            harness_id: string;
+            availability: "available" | "unavailable" | "unknown";
+            verification: "failed" | "not_run" | "passed";
+            verification_source?: "local_store" | "vendor" | undefined;
+            detail?: string | undefined;
+            last_verified_at?: string | null | undefined;
+        };
         identity?: {
-            plan?: string | undefined;
             email?: string | undefined;
+            plan?: string | undefined;
         } | null | undefined;
     }>, "many">;
     harnessAccounts: z.ZodDefault<z.ZodArray<z.ZodObject<{
@@ -366,11 +396,11 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             email: z.ZodOptional<z.ZodString>;
             plan: z.ZodOptional<z.ZodString>;
         }, "strict", z.ZodTypeAny, {
-            plan?: string | undefined;
             email?: string | undefined;
-        }, {
             plan?: string | undefined;
+        }, {
             email?: string | undefined;
+            plan?: string | undefined;
         }>>>;
         next_up: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
             kind: z.ZodLiteral<"profile">;
@@ -383,10 +413,13 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             profileId: string;
         }>, z.ZodObject<{
             kind: z.ZodLiteral<"native">;
+            route: z.ZodOptional<z.ZodEnum<["local_session", "api_key"]>>;
         }, "strict", z.ZodTypeAny, {
             kind: "native";
+            route?: "api_key" | "local_session" | undefined;
         }, {
             kind: "native";
+            route?: "api_key" | "local_session" | undefined;
         }>, z.ZodObject<{
             kind: z.ZodLiteral<"none">;
             reason: z.ZodString;
@@ -402,14 +435,15 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
         native_credentials_enabled: boolean;
         native_login_detected: boolean;
         identity: {
-            plan?: string | undefined;
             email?: string | undefined;
+            plan?: string | undefined;
         } | null;
         next_up: {
             kind: "profile";
             profileId: string;
         } | {
             kind: "native";
+            route?: "api_key" | "local_session" | undefined;
         } | {
             kind: "none";
             reason: string;
@@ -418,30 +452,23 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
         harness_id: string;
         native_credentials_enabled: boolean;
         native_login_detected: boolean;
+        identity?: {
+            email?: string | undefined;
+            plan?: string | undefined;
+        } | null | undefined;
         next_up: {
             kind: "profile";
             profileId: string;
         } | {
             kind: "native";
+            route?: "api_key" | "local_session" | undefined;
         } | {
             kind: "none";
             reason: string;
         };
-        identity?: {
-            plan?: string | undefined;
-            email?: string | undefined;
-        } | null | undefined;
     }>, "many">>;
 }, "strict", z.ZodTypeAny, {
     profiles: {
-        status: {
-            availability: "unknown" | "available" | "unavailable";
-            verification: "passed" | "failed" | "not_run";
-            profile_id: string;
-            harness_id: string;
-            last_verified_at: string | null;
-            detail?: string | undefined;
-        };
         profile: {
             profile_id: string;
             harness_id: string;
@@ -452,9 +479,18 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             enabled: boolean;
             created_at: string | null;
         };
+        status: {
+            profile_id: string;
+            harness_id: string;
+            availability: "available" | "unavailable" | "unknown";
+            verification: "failed" | "not_run" | "passed";
+            verification_source: "local_store" | "vendor";
+            detail?: string | undefined;
+            last_verified_at: string | null;
+        };
         identity: {
-            plan?: string | undefined;
             email?: string | undefined;
+            plan?: string | undefined;
         } | null;
     }[];
     harnessAccounts: {
@@ -462,14 +498,15 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
         native_credentials_enabled: boolean;
         native_login_detected: boolean;
         identity: {
-            plan?: string | undefined;
             email?: string | undefined;
+            plan?: string | undefined;
         } | null;
         next_up: {
             kind: "profile";
             profileId: string;
         } | {
             kind: "native";
+            route?: "api_key" | "local_session" | undefined;
         } | {
             kind: "none";
             reason: string;
@@ -477,14 +514,6 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
     }[];
 }, {
     profiles: {
-        status: {
-            availability: "unknown" | "available" | "unavailable";
-            verification: "passed" | "failed" | "not_run";
-            profile_id: string;
-            harness_id: string;
-            detail?: string | undefined;
-            last_verified_at?: string | null | undefined;
-        };
         profile: {
             profile_id: string;
             harness_id: string;
@@ -495,28 +524,38 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             enabled?: boolean | undefined;
             created_at?: string | null | undefined;
         };
+        status: {
+            profile_id: string;
+            harness_id: string;
+            availability: "available" | "unavailable" | "unknown";
+            verification: "failed" | "not_run" | "passed";
+            verification_source?: "local_store" | "vendor" | undefined;
+            detail?: string | undefined;
+            last_verified_at?: string | null | undefined;
+        };
         identity?: {
-            plan?: string | undefined;
             email?: string | undefined;
+            plan?: string | undefined;
         } | null | undefined;
     }[];
     harnessAccounts?: {
         harness_id: string;
         native_credentials_enabled: boolean;
         native_login_detected: boolean;
+        identity?: {
+            email?: string | undefined;
+            plan?: string | undefined;
+        } | null | undefined;
         next_up: {
             kind: "profile";
             profileId: string;
         } | {
             kind: "native";
+            route?: "api_key" | "local_session" | undefined;
         } | {
             kind: "none";
             reason: string;
         };
-        identity?: {
-            plan?: string | undefined;
-            email?: string | undefined;
-        } | null | undefined;
     }[] | undefined;
 }>;
 export type ControlCredentialProfilesResponse = z.infer<typeof ControlCredentialProfilesResponse>;
@@ -585,32 +624,34 @@ export declare const ControlCredentialProfileUpdateResponse: z.ZodObject<{
         harness_id: z.ZodString;
         availability: z.ZodEnum<["available", "unavailable", "unknown"]>;
         verification: z.ZodEnum<["passed", "failed", "not_run"]>;
+        /** WHAT the `verification` verdict is worth. `local_store` means only that
+         * this profile's own credential material is present and well-formed where
+         * it should be — it cannot tell a live token from a revoked one.
+         * `vendor` means the vendor itself answered a request made with THIS
+         * profile's credential. A router that needs "configured AND healthy" must
+         * read this alongside `verification`; `passed` + `local_store` promises
+         * strictly less than it sounds. */
+        verification_source: z.ZodDefault<z.ZodEnum<["local_store", "vendor"]>>;
         detail: z.ZodOptional<z.ZodString>;
         last_verified_at: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
-        availability: "unknown" | "available" | "unavailable";
-        verification: "passed" | "failed" | "not_run";
         profile_id: string;
         harness_id: string;
-        last_verified_at: string | null;
+        availability: "available" | "unavailable" | "unknown";
+        verification: "failed" | "not_run" | "passed";
+        verification_source: "local_store" | "vendor";
         detail?: string | undefined;
+        last_verified_at: string | null;
     }, {
-        availability: "unknown" | "available" | "unavailable";
-        verification: "passed" | "failed" | "not_run";
         profile_id: string;
         harness_id: string;
+        availability: "available" | "unavailable" | "unknown";
+        verification: "failed" | "not_run" | "passed";
+        verification_source?: "local_store" | "vendor" | undefined;
         detail?: string | undefined;
         last_verified_at?: string | null | undefined;
     }>;
 }, "strict", z.ZodTypeAny, {
-    status: {
-        availability: "unknown" | "available" | "unavailable";
-        verification: "passed" | "failed" | "not_run";
-        profile_id: string;
-        harness_id: string;
-        last_verified_at: string | null;
-        detail?: string | undefined;
-    };
     profile: {
         profile_id: string;
         harness_id: string;
@@ -621,15 +662,16 @@ export declare const ControlCredentialProfileUpdateResponse: z.ZodObject<{
         enabled: boolean;
         created_at: string | null;
     };
-}, {
     status: {
-        availability: "unknown" | "available" | "unavailable";
-        verification: "passed" | "failed" | "not_run";
         profile_id: string;
         harness_id: string;
+        availability: "available" | "unavailable" | "unknown";
+        verification: "failed" | "not_run" | "passed";
+        verification_source: "local_store" | "vendor";
         detail?: string | undefined;
-        last_verified_at?: string | null | undefined;
+        last_verified_at: string | null;
     };
+}, {
     profile: {
         profile_id: string;
         harness_id: string;
@@ -640,6 +682,15 @@ export declare const ControlCredentialProfileUpdateResponse: z.ZodObject<{
         enabled?: boolean | undefined;
         created_at?: string | null | undefined;
     };
+    status: {
+        profile_id: string;
+        harness_id: string;
+        availability: "available" | "unavailable" | "unknown";
+        verification: "failed" | "not_run" | "passed";
+        verification_source?: "local_store" | "vendor" | undefined;
+        detail?: string | undefined;
+        last_verified_at?: string | null | undefined;
+    };
 }>;
 export type ControlCredentialProfileUpdateResponse = z.infer<typeof ControlCredentialProfileUpdateResponse>;
 /** Register a config-dir login profile (claude/codex) from a UI surface —
@@ -723,7 +774,7 @@ export declare const ControlCredentialProfileDeleteResponse: z.ZodObject<{
         created_at: string | null;
     };
     removed: true;
-    credentialCleanup: "none" | "config_dir_removed" | "secret_deleted";
+    credentialCleanup: "config_dir_removed" | "none" | "secret_deleted";
     cleanupWarning?: string | undefined;
 }, {
     profile: {
@@ -737,7 +788,7 @@ export declare const ControlCredentialProfileDeleteResponse: z.ZodObject<{
         created_at?: string | null | undefined;
     };
     removed: true;
-    credentialCleanup: "none" | "config_dir_removed" | "secret_deleted";
+    credentialCleanup: "config_dir_removed" | "none" | "secret_deleted";
     cleanupWarning?: string | undefined;
 }>;
 export type ControlCredentialProfileDeleteResponse = z.infer<typeof ControlCredentialProfileDeleteResponse>;
@@ -793,32 +844,34 @@ export declare const ControlCredentialProfileCreateResponse: z.ZodObject<{
         harness_id: z.ZodString;
         availability: z.ZodEnum<["available", "unavailable", "unknown"]>;
         verification: z.ZodEnum<["passed", "failed", "not_run"]>;
+        /** WHAT the `verification` verdict is worth. `local_store` means only that
+         * this profile's own credential material is present and well-formed where
+         * it should be — it cannot tell a live token from a revoked one.
+         * `vendor` means the vendor itself answered a request made with THIS
+         * profile's credential. A router that needs "configured AND healthy" must
+         * read this alongside `verification`; `passed` + `local_store` promises
+         * strictly less than it sounds. */
+        verification_source: z.ZodDefault<z.ZodEnum<["local_store", "vendor"]>>;
         detail: z.ZodOptional<z.ZodString>;
         last_verified_at: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
-        availability: "unknown" | "available" | "unavailable";
-        verification: "passed" | "failed" | "not_run";
         profile_id: string;
         harness_id: string;
-        last_verified_at: string | null;
+        availability: "available" | "unavailable" | "unknown";
+        verification: "failed" | "not_run" | "passed";
+        verification_source: "local_store" | "vendor";
         detail?: string | undefined;
+        last_verified_at: string | null;
     }, {
-        availability: "unknown" | "available" | "unavailable";
-        verification: "passed" | "failed" | "not_run";
         profile_id: string;
         harness_id: string;
+        availability: "available" | "unavailable" | "unknown";
+        verification: "failed" | "not_run" | "passed";
+        verification_source?: "local_store" | "vendor" | undefined;
         detail?: string | undefined;
         last_verified_at?: string | null | undefined;
     }>;
 }, "strict", z.ZodTypeAny, {
-    status: {
-        availability: "unknown" | "available" | "unavailable";
-        verification: "passed" | "failed" | "not_run";
-        profile_id: string;
-        harness_id: string;
-        last_verified_at: string | null;
-        detail?: string | undefined;
-    };
     profile: {
         profile_id: string;
         harness_id: string;
@@ -829,15 +882,16 @@ export declare const ControlCredentialProfileCreateResponse: z.ZodObject<{
         enabled: boolean;
         created_at: string | null;
     };
-}, {
     status: {
-        availability: "unknown" | "available" | "unavailable";
-        verification: "passed" | "failed" | "not_run";
         profile_id: string;
         harness_id: string;
+        availability: "available" | "unavailable" | "unknown";
+        verification: "failed" | "not_run" | "passed";
+        verification_source: "local_store" | "vendor";
         detail?: string | undefined;
-        last_verified_at?: string | null | undefined;
+        last_verified_at: string | null;
     };
+}, {
     profile: {
         profile_id: string;
         harness_id: string;
@@ -848,6 +902,15 @@ export declare const ControlCredentialProfileCreateResponse: z.ZodObject<{
         enabled?: boolean | undefined;
         created_at?: string | null | undefined;
     };
+    status: {
+        profile_id: string;
+        harness_id: string;
+        availability: "available" | "unavailable" | "unknown";
+        verification: "failed" | "not_run" | "passed";
+        verification_source?: "local_store" | "vendor" | undefined;
+        detail?: string | undefined;
+        last_verified_at?: string | null | undefined;
+    };
 }>;
 export type ControlCredentialProfileCreateResponse = z.infer<typeof ControlCredentialProfileCreateResponse>;
 //# sourceMappingURL=credential-profile.d.ts.map

package/dist/credential-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-profile.d.ts","sourceRoot":"","sources":["../src/credential-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,2DAIxB,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6D3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;EAY8D,CAAC;AACnG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;EAoBzB,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;IAiB0D,CAAC;AAC7F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;mFACmF;AACnF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6B3C,CAAC;AACJ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG;;wEAEwE;AACxE,eAAO,MAAM,qCAAqC;;;;;;EAOsB,CAAC;AACzE,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,qCAAqC,CAC7C,CAAC;AAEF;kCACkC;AAClC,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGgC,CAAC;AACpF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC;AAEF;2EAC2E;AAC3E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;EAWQ,CAAC;AAC3D,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,qCAAqC,CAC7C,CAAC;AAEF;;4EAE4E;AAC5E,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaK,CAAC;AACzD,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGgC,CAAC;AACpF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC"}
+{"version":3,"file":"credential-profile.d.ts","sourceRoot":"","sources":["../src/credential-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAK3B;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,2DAIxB,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6D3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;IAMhC;;;;;;uCAMmC;;;;;;;;;;;;;;;;;;;;EAe2D,CAAC;AACnG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;EAoBzB,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuB0D,CAAC;AAC7F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;mFACmF;AACnF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA/H1C;;;;;;+CAMmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsJpC,CAAC;AACJ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG;;wEAEwE;AACxE,eAAO,MAAM,qCAAqC;;;;;;EAOsB,CAAC;AACzE,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,qCAAqC,CAC7C,CAAC;AAEF;kCACkC;AAClC,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAhL/C;;;;;;2CAMmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6K4C,CAAC;AACpF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC;AAEF;2EAC2E;AAC3E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;EAWQ,CAAC;AAC3D,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,qCAAqC,CAC7C,CAAC;AAEF;;4EAE4E;AAC5E,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaK,CAAC;AACzD,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA/N/C;;;;;;2CAMmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4N4C,CAAC;AACpF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC"}