@claudexor/schema 3.2.1 → 3.3.7

package/dist/credential-profile.d.ts

@@ -1,10 +1,10 @@
 import { z } from "zod/v3";
 /**
  * The credential transport a profile isolates (INV-135). `config_dir_login` is
- * a vendor-owned login living in a Claudexor-scoped config dir (claude
- * CLAUDE_CONFIG_DIR / codex CODEX_HOME); `oauth_token` and `api_key` are
- * secret-store references. The default vendor dirs (~/.claude, native codex
- * home) are NEVER a profile's isolation locator — profiles are additive.
+ * a vendor-owned login living in a Claudexor-scoped config dir or HOME
+ * (Claude CLAUDE_CONFIG_DIR / Codex CODEX_HOME / Cursor file-store HOME);
+ * `oauth_token` and `api_key` are secret-store references. Default vendor
+ * stores are NEVER a profile's isolation locator — profiles are additive.
  */
 export declare const CredentialKind: z.ZodEnum<["config_dir_login", "oauth_token", "api_key"]>;
 export type CredentialKind = z.infer<typeof CredentialKind>;
@@ -71,6 +71,14 @@ export declare const CredentialProfileStatus: z.ZodObject<{
     harness_id: z.ZodString;
     availability: z.ZodEnum<["available", "unavailable", "unknown"]>;
     verification: z.ZodEnum<["passed", "failed", "not_run"]>;
+    /** WHAT the `verification` verdict is worth. `local_store` means only that
+     * this profile's own credential material is present and well-formed where
+     * it should be — it cannot tell a live token from a revoked one.
+     * `vendor` means the vendor itself answered a request made with THIS
+     * profile's credential. A router that needs "configured AND healthy" must
+     * read this alongside `verification`; `passed` + `local_store` promises
+     * strictly less than it sounds. */
+    verification_source: z.ZodDefault<z.ZodEnum<["local_store", "vendor"]>>;
     detail: z.ZodOptional<z.ZodString>;
     last_verified_at: z.ZodDefault<z.ZodNullable<z.ZodString>>;
 }, "strict", z.ZodTypeAny, {
@@ -78,6 +86,7 @@ export declare const CredentialProfileStatus: z.ZodObject<{
     harness_id: string;
     availability: "available" | "unavailable" | "unknown";
     verification: "failed" | "not_run" | "passed";
+    verification_source: "local_store" | "vendor";
     detail?: string | undefined;
     last_verified_at: string | null;
 }, {
@@ -85,6 +94,7 @@ export declare const CredentialProfileStatus: z.ZodObject<{
     harness_id: string;
     availability: "available" | "unavailable" | "unknown";
     verification: "failed" | "not_run" | "passed";
+    verification_source?: "local_store" | "vendor" | undefined;
     detail?: string | undefined;
     last_verified_at?: string | null | undefined;
 }>;
@@ -292,6 +302,14 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             harness_id: z.ZodString;
             availability: z.ZodEnum<["available", "unavailable", "unknown"]>;
             verification: z.ZodEnum<["passed", "failed", "not_run"]>;
+            /** WHAT the `verification` verdict is worth. `local_store` means only that
+             * this profile's own credential material is present and well-formed where
+             * it should be — it cannot tell a live token from a revoked one.
+             * `vendor` means the vendor itself answered a request made with THIS
+             * profile's credential. A router that needs "configured AND healthy" must
+             * read this alongside `verification`; `passed` + `local_store` promises
+             * strictly less than it sounds. */
+            verification_source: z.ZodDefault<z.ZodEnum<["local_store", "vendor"]>>;
             detail: z.ZodOptional<z.ZodString>;
             last_verified_at: z.ZodDefault<z.ZodNullable<z.ZodString>>;
         }, "strict", z.ZodTypeAny, {
@@ -299,6 +317,7 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             harness_id: string;
             availability: "available" | "unavailable" | "unknown";
             verification: "failed" | "not_run" | "passed";
+            verification_source: "local_store" | "vendor";
             detail?: string | undefined;
             last_verified_at: string | null;
         }, {
@@ -306,6 +325,7 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             harness_id: string;
             availability: "available" | "unavailable" | "unknown";
             verification: "failed" | "not_run" | "passed";
+            verification_source?: "local_store" | "vendor" | undefined;
             detail?: string | undefined;
             last_verified_at?: string | null | undefined;
         }>;
@@ -335,6 +355,7 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             harness_id: string;
             availability: "available" | "unavailable" | "unknown";
             verification: "failed" | "not_run" | "passed";
+            verification_source: "local_store" | "vendor";
             detail?: string | undefined;
             last_verified_at: string | null;
         };
@@ -358,6 +379,7 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             harness_id: string;
             availability: "available" | "unavailable" | "unknown";
             verification: "failed" | "not_run" | "passed";
+            verification_source?: "local_store" | "vendor" | undefined;
             detail?: string | undefined;
             last_verified_at?: string | null | undefined;
         };
@@ -462,6 +484,7 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             harness_id: string;
             availability: "available" | "unavailable" | "unknown";
             verification: "failed" | "not_run" | "passed";
+            verification_source: "local_store" | "vendor";
             detail?: string | undefined;
             last_verified_at: string | null;
         };
@@ -506,6 +529,7 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             harness_id: string;
             availability: "available" | "unavailable" | "unknown";
             verification: "failed" | "not_run" | "passed";
+            verification_source?: "local_store" | "vendor" | undefined;
             detail?: string | undefined;
             last_verified_at?: string | null | undefined;
         };
@@ -600,6 +624,14 @@ export declare const ControlCredentialProfileUpdateResponse: z.ZodObject<{
         harness_id: z.ZodString;
         availability: z.ZodEnum<["available", "unavailable", "unknown"]>;
         verification: z.ZodEnum<["passed", "failed", "not_run"]>;
+        /** WHAT the `verification` verdict is worth. `local_store` means only that
+         * this profile's own credential material is present and well-formed where
+         * it should be — it cannot tell a live token from a revoked one.
+         * `vendor` means the vendor itself answered a request made with THIS
+         * profile's credential. A router that needs "configured AND healthy" must
+         * read this alongside `verification`; `passed` + `local_store` promises
+         * strictly less than it sounds. */
+        verification_source: z.ZodDefault<z.ZodEnum<["local_store", "vendor"]>>;
         detail: z.ZodOptional<z.ZodString>;
         last_verified_at: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
@@ -607,6 +639,7 @@ export declare const ControlCredentialProfileUpdateResponse: z.ZodObject<{
         harness_id: string;
         availability: "available" | "unavailable" | "unknown";
         verification: "failed" | "not_run" | "passed";
+        verification_source: "local_store" | "vendor";
         detail?: string | undefined;
         last_verified_at: string | null;
     }, {
@@ -614,6 +647,7 @@ export declare const ControlCredentialProfileUpdateResponse: z.ZodObject<{
         harness_id: string;
         availability: "available" | "unavailable" | "unknown";
         verification: "failed" | "not_run" | "passed";
+        verification_source?: "local_store" | "vendor" | undefined;
         detail?: string | undefined;
         last_verified_at?: string | null | undefined;
     }>;
@@ -633,6 +667,7 @@ export declare const ControlCredentialProfileUpdateResponse: z.ZodObject<{
         harness_id: string;
         availability: "available" | "unavailable" | "unknown";
         verification: "failed" | "not_run" | "passed";
+        verification_source: "local_store" | "vendor";
         detail?: string | undefined;
         last_verified_at: string | null;
     };
@@ -652,12 +687,13 @@ export declare const ControlCredentialProfileUpdateResponse: z.ZodObject<{
         harness_id: string;
         availability: "available" | "unavailable" | "unknown";
         verification: "failed" | "not_run" | "passed";
+        verification_source?: "local_store" | "vendor" | undefined;
         detail?: string | undefined;
         last_verified_at?: string | null | undefined;
     };
 }>;
 export type ControlCredentialProfileUpdateResponse = z.infer<typeof ControlCredentialProfileUpdateResponse>;
-/** Register a config-dir login profile (claude/codex) from a UI surface —
+/** Register a config-dir login profile (claude/codex/cursor) from a UI surface —
  * the same ONE locked registration owner `claudexor profiles add` uses. */
 export declare const ControlCredentialProfileCreateRequest: z.ZodObject<{
     harnessId: z.ZodString;
@@ -808,6 +844,14 @@ export declare const ControlCredentialProfileCreateResponse: z.ZodObject<{
         harness_id: z.ZodString;
         availability: z.ZodEnum<["available", "unavailable", "unknown"]>;
         verification: z.ZodEnum<["passed", "failed", "not_run"]>;
+        /** WHAT the `verification` verdict is worth. `local_store` means only that
+         * this profile's own credential material is present and well-formed where
+         * it should be — it cannot tell a live token from a revoked one.
+         * `vendor` means the vendor itself answered a request made with THIS
+         * profile's credential. A router that needs "configured AND healthy" must
+         * read this alongside `verification`; `passed` + `local_store` promises
+         * strictly less than it sounds. */
+        verification_source: z.ZodDefault<z.ZodEnum<["local_store", "vendor"]>>;
         detail: z.ZodOptional<z.ZodString>;
         last_verified_at: z.ZodDefault<z.ZodNullable<z.ZodString>>;
     }, "strict", z.ZodTypeAny, {
@@ -815,6 +859,7 @@ export declare const ControlCredentialProfileCreateResponse: z.ZodObject<{
         harness_id: string;
         availability: "available" | "unavailable" | "unknown";
         verification: "failed" | "not_run" | "passed";
+        verification_source: "local_store" | "vendor";
         detail?: string | undefined;
         last_verified_at: string | null;
     }, {
@@ -822,6 +867,7 @@ export declare const ControlCredentialProfileCreateResponse: z.ZodObject<{
         harness_id: string;
         availability: "available" | "unavailable" | "unknown";
         verification: "failed" | "not_run" | "passed";
+        verification_source?: "local_store" | "vendor" | undefined;
         detail?: string | undefined;
         last_verified_at?: string | null | undefined;
     }>;
@@ -841,6 +887,7 @@ export declare const ControlCredentialProfileCreateResponse: z.ZodObject<{
         harness_id: string;
         availability: "available" | "unavailable" | "unknown";
         verification: "failed" | "not_run" | "passed";
+        verification_source: "local_store" | "vendor";
         detail?: string | undefined;
         last_verified_at: string | null;
     };
@@ -860,6 +907,7 @@ export declare const ControlCredentialProfileCreateResponse: z.ZodObject<{
         harness_id: string;
         availability: "available" | "unavailable" | "unknown";
         verification: "failed" | "not_run" | "passed";
+        verification_source?: "local_store" | "vendor" | undefined;
         detail?: string | undefined;
         last_verified_at?: string | null | undefined;
     };

package/dist/credential-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-profile.d.ts","sourceRoot":"","sources":["../src/credential-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAK3B;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,2DAIxB,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6D3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;EAY8D,CAAC;AACnG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;EAoBzB,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuB0D,CAAC;AAC7F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;mFACmF;AACnF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6B3C,CAAC;AACJ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG;;wEAEwE;AACxE,eAAO,MAAM,qCAAqC;;;;;;EAOsB,CAAC;AACzE,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,qCAAqC,CAC7C,CAAC;AAEF;kCACkC;AAClC,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGgC,CAAC;AACpF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC;AAEF;2EAC2E;AAC3E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;EAWQ,CAAC;AAC3D,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,qCAAqC,CAC7C,CAAC;AAEF;;4EAE4E;AAC5E,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaK,CAAC;AACzD,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGgC,CAAC;AACpF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC"}
+{"version":3,"file":"credential-profile.d.ts","sourceRoot":"","sources":["../src/credential-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAK3B;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,2DAIxB,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6D3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;IAMhC;;;;;;uCAMmC;;;;;;;;;;;;;;;;;;;;EAe2D,CAAC;AACnG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;EAoBzB,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuB0D,CAAC;AAC7F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;mFACmF;AACnF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA/H1C;;;;;;+CAMmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsJpC,CAAC;AACJ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG;;wEAEwE;AACxE,eAAO,MAAM,qCAAqC;;;;;;EAOsB,CAAC;AACzE,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,qCAAqC,CAC7C,CAAC;AAEF;kCACkC;AAClC,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAhL/C;;;;;;2CAMmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6K4C,CAAC;AACpF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC;AAEF;2EAC2E;AAC3E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;EAaQ,CAAC;AAC3D,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,qCAAqC,CAC7C,CAAC;AAEF;;4EAE4E;AAC5E,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaK,CAAC;AACzD,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAjO/C;;;;;;2CAMmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8N4C,CAAC;AACpF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC"}

package/dist/credential-profile.js

@@ -4,10 +4,10 @@ import { Id, IsoTimestamp } from "./primitives.js";
 import { AuthAvailability, AuthVerification } from "./auth.js";
 /**
  * The credential transport a profile isolates (INV-135). `config_dir_login` is
- * a vendor-owned login living in a Claudexor-scoped config dir (claude
- * CLAUDE_CONFIG_DIR / codex CODEX_HOME); `oauth_token` and `api_key` are
- * secret-store references. The default vendor dirs (~/.claude, native codex
- * home) are NEVER a profile's isolation locator — profiles are additive.
+ * a vendor-owned login living in a Claudexor-scoped config dir or HOME
+ * (Claude CLAUDE_CONFIG_DIR / Codex CODEX_HOME / Cursor file-store HOME);
+ * `oauth_token` and `api_key` are secret-store references. Default vendor
+ * stores are NEVER a profile's isolation locator — profiles are additive.
  */
 export const CredentialKind = z
     .enum(["config_dir_login", "oauth_token", "api_key"])
@@ -86,10 +86,21 @@ export const CredentialProfileStatus = z
     harness_id: Id,
     availability: AuthAvailability,
     verification: AuthVerification,
+    /** WHAT the `verification` verdict is worth. `local_store` means only that
+     * this profile's own credential material is present and well-formed where
+     * it should be — it cannot tell a live token from a revoked one.
+     * `vendor` means the vendor itself answered a request made with THIS
+     * profile's credential. A router that needs "configured AND healthy" must
+     * read this alongside `verification`; `passed` + `local_store` promises
+     * strictly less than it sounds. */
+    verification_source: z
+        .enum(["local_store", "vendor"])
+        .default("local_store")
+        .describe("How the verification verdict was reached: local_store = the profile's credential material is present locally (says nothing about the token being live); vendor = the vendor answered a request made with this profile's own credential."),
     detail: z.string().optional().describe("Redacted human-readable probe evidence."),
     last_verified_at: IsoTimestamp.nullable()
         .default(null)
-        .describe("When a probe last verified this profile; null = never verified."),
+        .describe("When the verification verdict was established, by the method named in verification_source; null = never verified."),
 })
     .strict()
     .describe("Doctor-owned readiness projection for one credential profile; never durable config.");
@@ -213,11 +224,11 @@ export const ControlCredentialProfileUpdateResponse = z
     .object({ profile: CredentialProfile, status: CredentialProfileStatus })
     .strict()
     .describe("The updated credential profile with its doctor readiness projection.");
-/** Register a config-dir login profile (claude/codex) from a UI surface —
+/** Register a config-dir login profile (claude/codex/cursor) from a UI surface —
  * the same ONE locked registration owner `claudexor profiles add` uses. */
 export const ControlCredentialProfileCreateRequest = z
     .object({
-    harnessId: Id.describe("Harness family (claude | codex) for the config-dir login profile."),
+    harnessId: Id.describe("Harness family (claude | codex | cursor) for the config-dir login profile."),
     profileId: Id.describe("New profile id (bounded slug, unique per harness)."),
     displayName: z
         .string()

package/dist/credential-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-profile.js","sourceRoot":"","sources":["../src/credential-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,IAAI,CAAC,CAAC,kBAAkB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;KACpD,QAAQ,CACP,uHAAuH,CACxH,CAAC;AAGJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;IACtF,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC3F,eAAe,EAAE,cAAc;IAC/B,iBAAiB,EAAE,CAAC;SACjB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,8FAA8F,CAC/F;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,oHAAoH,CACrH;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IACpF,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE;SAChC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,wEAAwE,CAAC;CACtF,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,OAAO,CAAC,eAAe,KAAK,kBAAkB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,iBAAiB;YAC5B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,6EAA6E;aACvF,CAAC,CAAC;QACL,IAAI,OAAO,CAAC,UAAU;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAC;IACP,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,OAAO,CAAC,UAAU;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG,OAAO,CAAC,eAAe,8BAA8B;aAClE,CAAC,CAAC;QACL,+DAA+D;QAC/D,wEAAwE;QACxE,iEAAiE;aAC5D,IAAI,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI;YAC3D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,eAAe,OAAO,CAAC,UAAU,0IAA0I;aACrL,CAAC,CAAC;QACL,IAAI,OAAO,CAAC,iBAAiB;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG,OAAO,CAAC,eAAe,4CAA4C;aAChF,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC;KACD,QAAQ,CACP,wJAAwJ,CACzJ,CAAC;AAGJ;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,EAAE;IACd,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,gBAAgB;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IACjF,gBAAgB,EAAE,YAAY,CAAC,QAAQ,EAAE;SACtC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,iEAAiE,CAAC;CAC/E,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,qFAAqF,CAAC,CAAC;AAGnG;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F,CAC5F;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,+FAA+F,CAChG;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,yIAAyI,CAC1I,CAAC;AAGJ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,kBAAkB,CAAC,MAAM,EAAE;IAC1B,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;SACrD,MAAM,EAAE;SACR,QAAQ,CAAC,sEAAsE,CAAC;IACnF,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,KAAK,EAAE,CAAC;aACL,IAAI,CAAC,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;aAClC,QAAQ,EAAE;aACV,QAAQ,CAAC,8EAA8E,CAAC;KAC5F,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,CAAC,sEAAsE,CAAC;IACnF,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SACvD,MAAM,EAAE;SACR,QAAQ,CACP,qGAAqG,CACtG;CACJ,CAAC;KACD,QAAQ,CAAC,+EAA+E,CAAC,CAAC;AAG7F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACnE,0BAA0B,EAAE,CAAC;SAC1B,OAAO,EAAE;SACT,QAAQ,CAAC,gFAAgF,CAAC;IAC7F,qBAAqB,EAAE,CAAC;SACrB,OAAO,EAAE;SACT,QAAQ,CACP,yGAAyG,CAC1G;IACH,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE;SACjC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,4IAA4I,CAC7I;IACH,OAAO,EAAE,qBAAqB;CAC/B,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,8FAA8F,CAC/F,CAAC;AAGJ;mFACmF;AACnF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,OAAO,EAAE,iBAAiB;QAC1B,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE;aACjC,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,mIAAmI,CACpI;KACJ,CAAC;SACD,MAAM,EAAE,CACZ;SACA,QAAQ,CACP,0GAA0G,CAC3G;IACH,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,sBAAsB,CAAC;SAC7B,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,0KAA0K,CAC3K;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,2GAA2G,CAC5G,CAAC;AAGJ;;wEAEwE;AACxE,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,CAAC,mEAAmE,CAAC;CACjF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,2DAA2D,CAAC,CAAC;AAKzE;kCACkC;AAClC,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;KACvE,MAAM,EAAE;KACR,QAAQ,CAAC,sEAAsE,CAAC,CAAC;AAKpF;2EAC2E;AAC3E,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,mEAAmE,CAAC;IAC3F,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAC5E,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;CACnF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,6CAA6C,CAAC,CAAC;AAK3D;;4EAE4E;AAC5E,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC;IACN,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAClE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,iBAAiB,EAAE,CAAC;SACjB,IAAI,CAAC,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;SACtD,QAAQ,CAAC,oEAAoE,CAAC;IACjF,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,+EAA+E,CAAC;CAC7F,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,2CAA2C,CAAC,CAAC;AAKzD,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;KACvE,MAAM,EAAE;KACR,QAAQ,CAAC,sEAAsE,CAAC,CAAC"}
+{"version":3,"file":"credential-profile.js","sourceRoot":"","sources":["../src/credential-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,IAAI,CAAC,CAAC,kBAAkB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;KACpD,QAAQ,CACP,uHAAuH,CACxH,CAAC;AAGJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;IACtF,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC3F,eAAe,EAAE,cAAc;IAC/B,iBAAiB,EAAE,CAAC;SACjB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,8FAA8F,CAC/F;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,oHAAoH,CACrH;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IACpF,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE;SAChC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,wEAAwE,CAAC;CACtF,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,OAAO,CAAC,eAAe,KAAK,kBAAkB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,iBAAiB;YAC5B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,6EAA6E;aACvF,CAAC,CAAC;QACL,IAAI,OAAO,CAAC,UAAU;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAC;IACP,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,OAAO,CAAC,UAAU;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG,OAAO,CAAC,eAAe,8BAA8B;aAClE,CAAC,CAAC;QACL,+DAA+D;QAC/D,wEAAwE;QACxE,iEAAiE;aAC5D,IAAI,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI;YAC3D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,eAAe,OAAO,CAAC,UAAU,0IAA0I;aACrL,CAAC,CAAC;QACL,IAAI,OAAO,CAAC,iBAAiB;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG,OAAO,CAAC,eAAe,4CAA4C;aAChF,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC;KACD,QAAQ,CACP,wJAAwJ,CACzJ,CAAC;AAGJ;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,EAAE;IACd,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,gBAAgB;IAC9B;;;;;;uCAMmC;IACnC,mBAAmB,EAAE,CAAC;SACnB,IAAI,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;SAC/B,OAAO,CAAC,aAAa,CAAC;SACtB,QAAQ,CACP,yOAAyO,CAC1O;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IACjF,gBAAgB,EAAE,YAAY,CAAC,QAAQ,EAAE;SACtC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,mHAAmH,CACpH;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,qFAAqF,CAAC,CAAC;AAGnG;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,2FAA2F,CAC5F;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,+FAA+F,CAChG;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,yIAAyI,CAC1I,CAAC;AAGJ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,kBAAkB,CAAC,MAAM,EAAE;IAC1B,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;SACrD,MAAM,EAAE;SACR,QAAQ,CAAC,sEAAsE,CAAC;IACnF,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,KAAK,EAAE,CAAC;aACL,IAAI,CAAC,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;aAClC,QAAQ,EAAE;aACV,QAAQ,CAAC,8EAA8E,CAAC;KAC5F,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,CAAC,sEAAsE,CAAC;IACnF,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SACvD,MAAM,EAAE;SACR,QAAQ,CACP,qGAAqG,CACtG;CACJ,CAAC;KACD,QAAQ,CAAC,+EAA+E,CAAC,CAAC;AAG7F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACnE,0BAA0B,EAAE,CAAC;SAC1B,OAAO,EAAE;SACT,QAAQ,CAAC,gFAAgF,CAAC;IAC7F,qBAAqB,EAAE,CAAC;SACrB,OAAO,EAAE;SACT,QAAQ,CACP,yGAAyG,CAC1G;IACH,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE;SACjC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,4IAA4I,CAC7I;IACH,OAAO,EAAE,qBAAqB;CAC/B,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,8FAA8F,CAC/F,CAAC;AAGJ;mFACmF;AACnF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,OAAO,EAAE,iBAAiB;QAC1B,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE;aACjC,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,mIAAmI,CACpI;KACJ,CAAC;SACD,MAAM,EAAE,CACZ;SACA,QAAQ,CACP,0GAA0G,CAC3G;IACH,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,sBAAsB,CAAC;SAC7B,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,0KAA0K,CAC3K;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,2GAA2G,CAC5G,CAAC;AAGJ;;wEAEwE;AACxE,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,CAAC,mEAAmE,CAAC;CACjF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,2DAA2D,CAAC,CAAC;AAKzE;kCACkC;AAClC,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;KACvE,MAAM,EAAE;KACR,QAAQ,CAAC,sEAAsE,CAAC,CAAC;AAKpF;2EAC2E;AAC3E,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,SAAS,EAAE,EAAE,CAAC,QAAQ,CACpB,4EAA4E,CAC7E;IACD,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAC5E,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;CACnF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,6CAA6C,CAAC,CAAC;AAK3D;;4EAE4E;AAC5E,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC;IACN,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAClE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,iBAAiB,EAAE,CAAC;SACjB,IAAI,CAAC,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;SACtD,QAAQ,CAAC,oEAAoE,CAAC;IACjF,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,+EAA+E,CAAC;CAC7F,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,2CAA2C,CAAC,CAAC;AAKzD,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;KACvE,MAAM,EAAE;KACR,QAAQ,CAAC,sEAAsE,CAAC,CAAC"}

package/dist/harness-confinement.d.ts

@@ -0,0 +1,64 @@
+import { z } from "zod/v3";
+/**
+ * An APPLIED filesystem boundary, not a request for one.
+ *
+ * `verified_denied_path` is the path the profile was executed against before
+ * the harness ran: the read was refused on this host, for this attempt. A field
+ * that only said "confined: true" would be the promise this whole mechanism
+ * exists to replace — which is why the two fields are REQUIRED together and a
+ * mechanism name without its proof is not representable in this type.
+ */
+export declare const HarnessConfinement: z.ZodObject<{
+    mechanism: z.ZodString;
+    profile: z.ZodString;
+    profile_digest: z.ZodString;
+    verified_denied_path: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    mechanism: string;
+    profile: string;
+    profile_digest: string;
+    verified_denied_path: string;
+}, {
+    mechanism: string;
+    profile: string;
+    profile_digest: string;
+    verified_denied_path: string;
+}>;
+export type HarnessConfinement = z.infer<typeof HarnessConfinement>;
+/**
+ * The confinement half of an attempt record, as every reader sees it.
+ *
+ * Deliberately NOT a zod object: this is the projection shape shared by the
+ * orchestrator (which writes it) and the control API (which reads the written
+ * artifact back), and the artifact itself is untyped YAML from a possibly older
+ * engine — so the fields arrive as `unknown` and the predicate below is the one
+ * place that decides what they mean.
+ */
+export interface AppliedConfinementRecord {
+    confinement_mechanism?: unknown;
+    confinement_profile_digest?: unknown;
+    confinement_verified_denied_path?: unknown;
+    /** Why NO boundary was applied; present exactly when the boundary is absent. */
+    confinement_unavailable_reason?: unknown;
+}
+/**
+ * Whether an attempt record proves a boundary was actually enforced.
+ *
+ * ONE owner, because the answer is load-bearing in two codebases: a mechanism
+ * named WITHOUT the path it was proven to deny is exactly the bare promise the
+ * applied-fact block exists to replace, so it reads as NO boundary. An external
+ * orchestrator asks this question and nothing else — never the platform, never
+ * the mechanism's name.
+ */
+export declare function confinementBoundaryProven(record: AppliedConfinementRecord | null): boolean;
+export declare const ContainmentKind: z.ZodEnum<["env_or_file_injection", "scoped_home_keychain_bridge", "host_user_context", "process_sandbox", "container"]>;
+export type ContainmentKind = z.infer<typeof ContainmentKind>;
+export declare const IsolationCapabilities: z.ZodDefault<z.ZodObject<{
+    supported_containment: z.ZodDefault<z.ZodArray<z.ZodEnum<["env_or_file_injection", "scoped_home_keychain_bridge", "host_user_context", "process_sandbox", "container"]>, "many">>;
+}, "strip", z.ZodTypeAny, {
+    supported_containment: ("container" | "env_or_file_injection" | "host_user_context" | "process_sandbox" | "scoped_home_keychain_bridge")[];
+}, {
+    supported_containment?: ("container" | "env_or_file_injection" | "host_user_context" | "process_sandbox" | "scoped_home_keychain_bridge")[] | undefined;
+}>>;
+export type IsolationCapabilities = z.infer<typeof IsolationCapabilities>;
+//# sourceMappingURL=harness-confinement.d.ts.map

package/dist/harness-confinement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-confinement.d.ts","sourceRoot":"","sources":["../src/harness-confinement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAG3B;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;EAkBmD,CAAC;AACnF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,gCAAgC,CAAC,EAAE,OAAO,CAAC;IAC3C,gFAAgF;IAChF,8BAA8B,CAAC,EAAE,OAAO,CAAC;CAC1C;AAID;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,GAAG,OAAO,CAO1F;AAED,eAAO,MAAM,eAAe,0HAUzB,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;;;;GAQgC,CAAC;AACnE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/harness-confinement.js

@@ -0,0 +1,64 @@
+import { z } from "zod/v3";
+import { ContentHash } from "./primitives.js";
+/**
+ * An APPLIED filesystem boundary, not a request for one.
+ *
+ * `verified_denied_path` is the path the profile was executed against before
+ * the harness ran: the read was refused on this host, for this attempt. A field
+ * that only said "confined: true" would be the promise this whole mechanism
+ * exists to replace — which is why the two fields are REQUIRED together and a
+ * mechanism name without its proof is not representable in this type.
+ */
+export const HarnessConfinement = z
+    .object({
+    mechanism: z
+        .string()
+        .min(1)
+        .describe("OPAQUE identifier of the OS mechanism that enforced the boundary. A reader must never branch on this value or on the host platform; the only question it may ask is whether a PROVEN boundary exists, which is this field AND verified_denied_path both present."),
+    profile: z
+        .string()
+        .min(1)
+        .describe("The exact policy the process was started under, in the mechanism's own encoding."),
+    profile_digest: ContentHash.describe("Digest of the policy text, for the attempt record."),
+    verified_denied_path: z
+        .string()
+        .min(1)
+        .describe("Path proven unreadable under this policy before the harness was spawned."),
+})
+    .describe("An applied OS-enforced filesystem boundary for one harness process.");
+const nonEmpty = (value) => typeof value === "string" && value.length > 0;
+/**
+ * Whether an attempt record proves a boundary was actually enforced.
+ *
+ * ONE owner, because the answer is load-bearing in two codebases: a mechanism
+ * named WITHOUT the path it was proven to deny is exactly the bare promise the
+ * applied-fact block exists to replace, so it reads as NO boundary. An external
+ * orchestrator asks this question and nothing else — never the platform, never
+ * the mechanism's name.
+ */
+export function confinementBoundaryProven(record) {
+    if (!record)
+        return false;
+    return (nonEmpty(record.confinement_mechanism) &&
+        nonEmpty(record.confinement_profile_digest) &&
+        nonEmpty(record.confinement_verified_denied_path));
+}
+export const ContainmentKind = z
+    .enum([
+    "env_or_file_injection",
+    "scoped_home_keychain_bridge",
+    "host_user_context",
+    "process_sandbox",
+    "container",
+])
+    .describe("Isolation containment level an adapter supports for run environments, from env/file injection through scoped-HOME keychain bridging to process sandboxes and containers.");
+export const IsolationCapabilities = z
+    .object({
+    supported_containment: z
+        .array(ContainmentKind)
+        .default(["env_or_file_injection"])
+        .describe("Containment mechanisms the adapter can run under."),
+})
+    .default({})
+    .describe("Declared isolation containment facts for a harness.");
+//# sourceMappingURL=harness-confinement.js.map

package/dist/harness-confinement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-confinement.js","sourceRoot":"","sources":["../src/harness-confinement.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,kQAAkQ,CACnQ;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,kFAAkF,CAAC;IAC/F,cAAc,EAAE,WAAW,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAC1F,oBAAoB,EAAE,CAAC;SACpB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,0EAA0E,CAAC;CACxF,CAAC;KACD,QAAQ,CAAC,qEAAqE,CAAC,CAAC;AAoBnF,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AAE5F;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAuC;IAC/E,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,CACL,QAAQ,CAAC,MAAM,CAAC,qBAAqB,CAAC;QACtC,QAAQ,CAAC,MAAM,CAAC,0BAA0B,CAAC;QAC3C,QAAQ,CAAC,MAAM,CAAC,gCAAgC,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,IAAI,CAAC;IACJ,uBAAuB;IACvB,6BAA6B;IAC7B,mBAAmB;IACnB,iBAAiB;IACjB,WAAW;CACZ,CAAC;KACD,QAAQ,CACP,0KAA0K,CAC3K,CAAC;AAGJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,qBAAqB,EAAE,CAAC;SACrB,KAAK,CAAC,eAAe,CAAC;SACtB,OAAO,CAAC,CAAC,uBAAuB,CAAC,CAAC;SAClC,QAAQ,CAAC,mDAAmD,CAAC;CACjE,CAAC;KACD,OAAO,CAAC,EAAE,CAAC;KACX,QAAQ,CAAC,qDAAqD,CAAC,CAAC"}

package/dist/harness.d.ts

@@ -259,16 +259,6 @@ export declare const AuthCapabilities: z.ZodDefault<z.ZodObject<{
     }[] | undefined;
 }>>;
 export type AuthCapabilities = z.infer<typeof AuthCapabilities>;
-export declare const ContainmentKind: z.ZodEnum<["env_or_file_injection", "scoped_home_keychain_bridge", "host_user_context", "process_sandbox", "container"]>;
-export type ContainmentKind = z.infer<typeof ContainmentKind>;
-export declare const IsolationCapabilities: z.ZodDefault<z.ZodObject<{
-    supported_containment: z.ZodDefault<z.ZodArray<z.ZodEnum<["env_or_file_injection", "scoped_home_keychain_bridge", "host_user_context", "process_sandbox", "container"]>, "many">>;
-}, "strip", z.ZodTypeAny, {
-    supported_containment: ("container" | "env_or_file_injection" | "host_user_context" | "process_sandbox" | "scoped_home_keychain_bridge")[];
-}, {
-    supported_containment?: ("container" | "env_or_file_injection" | "host_user_context" | "process_sandbox" | "scoped_home_keychain_bridge")[] | undefined;
-}>>;
-export type IsolationCapabilities = z.infer<typeof IsolationCapabilities>;
 export declare const ReadonlyMechanism: z.ZodEnum<["fs_sandbox", "permission_deny", "tool_allowlist", "none"]>;
 export type ReadonlyMechanism = z.infer<typeof ReadonlyMechanism>;
 export declare const AccessControlCapabilities: z.ZodDefault<z.ZodObject<{
@@ -1335,6 +1325,24 @@ export declare const HarnessRunSpec: z.ZodObject<{
         }[];
         evidence_refs: string[];
     }>>>;
+    /** The APPLIED OS boundary this process starts inside; null = none (every
+     * ordinary run). Consumed by the shared CLI run loop, never by adapters. */
+    confinement: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+        mechanism: z.ZodString;
+        profile: z.ZodString;
+        profile_digest: z.ZodString;
+        verified_denied_path: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        mechanism: string;
+        profile: string;
+        profile_digest: string;
+        verified_denied_path: string;
+    }, {
+        mechanism: string;
+        profile: string;
+        profile_digest: string;
+        verified_denied_path: string;
+    }>>>;
     extra: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, "strip", z.ZodTypeAny, {
     session_id: string;
@@ -1418,6 +1426,12 @@ export declare const HarnessRunSpec: z.ZodObject<{
         }[];
         evidence_refs: string[];
     } | null | undefined;
+    confinement: {
+        mechanism: string;
+        profile: string;
+        profile_digest: string;
+        verified_denied_path: string;
+    } | null;
     extra: Record<string, unknown>;
 }, {
     session_id: string;
@@ -1501,6 +1515,12 @@ export declare const HarnessRunSpec: z.ZodObject<{
         }[];
         evidence_refs: string[];
     } | null | undefined;
+    confinement?: {
+        mechanism: string;
+        profile: string;
+        profile_digest: string;
+        verified_denied_path: string;
+    } | null | undefined;
     extra?: Record<string, unknown> | undefined;
 }>;
 export type HarnessRunSpec = z.infer<typeof HarnessRunSpec>;

package/dist/harness.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../src/harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAuB3B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,0DAA0D;AAC1D,eAAO,MAAM,aAAa,iEAIvB,CAAC;AACJ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAK1D,eAAO,MAAM,WAAW,gDAE2E,CAAC;AACpG,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,wDAI1B,CAAC;AACJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;IAkB5B,8EAA8E;;;;IAU9E;;;;OAIG;;;IAQH,iEAAiE;;IAKjE,mFAAmF;;IAOnF;;;;OAIG;;IAOH;;;;;OAKG;;IAOH;;;;;;;;;;;OAWG;;IAOH;;;;;;;;;OASG;;IAOH;;;;;OAKG;;IAOH;;;;;;OAMG;;;;;;;;;;;IAOH;;;;;OAKG;;IAQH;;;;;;;;OAQG;;;QAQO;sDAC8C;;;;;;;;;IAaxD;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWJ,CAAC;AACJ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;gFAGgF;AAChF,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS,eAAe,EAAE,EACnC,KAAK,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,GACxC,MAAM,EAAE,CAMV;AAED,eAAO,MAAM,uBAAuB,gGAIjC,CAAC;AACJ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,eAAO,MAAM,oBAAoB,kDAI9B,CAAC;AACJ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAS4D,CAAC;AAC7F,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAe4B,CAAC;AAC1D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,eAAe,0HAUzB,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;;;;GAQgC,CAAC;AACnE,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,eAAO,MAAM,iBAAiB,wEAI3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;;;;GAKqB,CAAC;AAC5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKjC,qFAAqF;;;;;;;;;;;;;;;;;;;;IAErF;;;;;;;OAOG;;IAOH;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAWJ,CAAC;AACJ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;IAerB;wDACoD;;;;;;;;;;;;EASrD,CAAC;AACJ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAvExB,qFAAqF;;;;;;;;;;;;;;;;;;;;QAErF;;;;;;;WAOG;;QAOH;;;;;;;WAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyDH,yFAAyF;;;;;;;QAlXzF,8EAA8E;;;;QAU9E;;;;WAIG;;;QAQH,iEAAiE;;QAKjE,mFAAmF;;QAOnF;;;;WAIG;;QAOH;;;;;WAKG;;QAOH;;;;;;;;;;;WAWG;;QAOH;;;;;;;;;WASG;;QAOH;;;;;WAKG;;QAOH;;;;;;WAMG;;;;;;;;;;;QAOH;;;;;WAKG;;QAQH;;;;;;;;WAQG;;;YAQO;0DAC8C;;;;;;;;;QAaxD;;;;WAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4NJ,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;EAYyC,CAAC;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,aAAa,8CAIvB,CAAC;AACJ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuB3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,eAAe;;;;;;;;;EAkBzB,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,sFAAsF;AACtF,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;EAyBxB,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,gDAAgD;AAChD,eAAO,MAAM,cAAc;;;;IAKvB;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;;IAkCH;;;OAGG;;IAEH;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAMH;;;OAGG;;IAMH;;;;OAIG;;;IAaH;;;;;;OAMG;;;IAWH;;;OAGG;;;;;;;;;;;;;;;;;;;;;;;;;;IAOH;;;;OAIG;;;;;;;;;;;IAIH;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;IAKH;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiBJ,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;EASuC,CAAC;AACtE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,mBAAmB;;;IAI5B,kEAAkE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYL,CAAC;AAClE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;QApB3B,kEAAkE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2BlE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOc,CAAC;AACvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAU+B,CAAC;AAC9D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKmD,CAAC;AACrF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,8EAA8E;AAC9E,eAAO,MAAM,YAAY;;;;;IAwBrB;;;;;OAKG;;IAOH,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAEpE,6CAA6C;;;;;;YAjG7C,kEAAkE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2BlE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA8FhE,gFAAgF;;;;;;;;;;;;;;;;;;IAepF;;6EAEyE;;IAIzE,2EAA2E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAa3E;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAoBH;;;;;OAKG;;;;;;;;;;;;;;;;;IAIH;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;IAsCH;;;;OAIG;;;;;;;;;;;IAmBH;;;;;;;;;OASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0D+E,CAAC;AACvF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}
+{"version":3,"file":"harness.d.ts","sourceRoot":"","sources":["../src/harness.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAwB3B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,0DAA0D;AAC1D,eAAO,MAAM,aAAa,iEAIvB,CAAC;AACJ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAK1D,eAAO,MAAM,WAAW,gDAE2E,CAAC;AACpG,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,wDAI1B,CAAC;AACJ,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB;;;;;;IAkB5B,8EAA8E;;;;IAU9E;;;;OAIG;;;IAQH,iEAAiE;;IAKjE,mFAAmF;;IAOnF;;;;OAIG;;IAOH;;;;;OAKG;;IAOH;;;;;;;;;;;OAWG;;IAOH;;;;;;;;;OASG;;IAOH;;;;;OAKG;;IAOH;;;;;;OAMG;;;;;;;;;;;IAOH;;;;;OAKG;;IAQH;;;;;;;;OAQG;;;QAQO;sDAC8C;;;;;;;;;IAaxD;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAWJ,CAAC;AACJ,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,MAAM,MAAM,eAAe,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;gFAGgF;AAChF,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS,eAAe,EAAE,EACnC,KAAK,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,GACxC,MAAM,EAAE,CAMV;AAED,eAAO,MAAM,uBAAuB,gGAIjC,CAAC;AACJ,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,eAAO,MAAM,oBAAoB,kDAI9B,CAAC;AACJ,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAS4D,CAAC;AAC7F,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAe4B,CAAC;AAC1D,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB,wEAI3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,yBAAyB;;;;;;GAKqB,CAAC;AAC5D,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAKjC,qFAAqF;;;;;;;;;;;;;;;;;;;;IAErF;;;;;;;OAOG;;IAOH;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAWJ,CAAC;AACJ,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,eAAO,MAAM,YAAY;;;;IAerB;wDACoD;;;;;;;;;;;;EASrD,CAAC;AACJ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAvExB,qFAAqF;;;;;;;;;;;;;;;;;;;;QAErF;;;;;;;WAOG;;QAOH;;;;;;;WAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAyDH,yFAAyF;;;;;;;QA1VzF,8EAA8E;;;;QAU9E;;;;WAIG;;;QAQH,iEAAiE;;QAKjE,mFAAmF;;QAOnF;;;;WAIG;;QAOH;;;;;WAKG;;QAOH;;;;;;;;;;;WAWG;;QAOH;;;;;;;;;WASG;;QAOH;;;;;WAKG;;QAOH;;;;;;WAMG;;;;;;;;;;;QAOH;;;;;WAKG;;QAQH;;;;;;;;WAQG;;;YAQO;0DAC8C;;;;;;;;;QAaxD;;;;WAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoMJ,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;EAYyC,CAAC;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,aAAa,8CAIvB,CAAC;AACJ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuB3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,eAAe;;;;;;;;;EAkBzB,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,sFAAsF;AACtF,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;EAyBxB,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,gDAAgD;AAChD,eAAO,MAAM,cAAc;;;;IAKvB;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;;IAkCH;;;OAGG;;IAEH;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAMH;;;OAGG;;IAMH;;;;OAIG;;;IAaH;;;;;;OAMG;;;IAWH;;;OAGG;;;;;;;;;;;;;;;;;;;;;;;;;;IAOH;;;;OAIG;;;;;;;;;;;IAIH;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;IAKH;;;;OAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAUH;gFAC4E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAa7E,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;EASuC,CAAC;AACtE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,mBAAmB;;;IAI5B,kEAAkE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYL,CAAC;AAClE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;QApB3B,kEAAkE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA2BlE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOc,CAAC;AACvF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EAU+B,CAAC;AAC9D,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKmD,CAAC;AACrF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,8EAA8E;AAC9E,eAAO,MAAM,YAAY;;;;;IAwBrB;;;;;OAKG;;IAOH,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAEpE,6CAA6C;;;;;;YAjG7C,kEAAkE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2BlE,oEAAoE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA8FhE,gFAAgF;;;;;;;;;;;;;;;;;;IAepF;;6EAEyE;;IAIzE,2EAA2E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAa3E;;;;;;OAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAoBH;;;;;OAKG;;;;;;;;;;;;;;;;;IAIH;;;;;;;OAOG;;;;;;;;;;;;;;;;;;;;IAsCH;;;;OAIG;;;;;;;;;;;IAmBH;;;;;;;;;OASG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA0D+E,CAAC;AACvF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/harness.js

@@ -2,6 +2,7 @@ import { z } from "zod/v3";
 import { AuthSourceKind, AuthSourceReadiness, CredentialRoute } from "./auth.js";
 import { CredentialProfile } from "./credential-profile.js";
 import { ToolRef } from "./tool-ref.js";
+import { HarnessConfinement, IsolationCapabilities } from "./harness-confinement.js";
 import { AccessProfile, AuthPreference, ExternalContextPolicy, Id, Intent, ProviderFamily, } from "./primitives.js";
 import { Attachment, AttachmentInputClass } from "./attachment.js";
 import { ImplementationTransport, RawContextPacket, RawGitPatchEnvelope, RawPatchRefusalCode, } from "./raw.js";
@@ -249,24 +250,6 @@ export const AuthCapabilities = z
 })
     .default({})
     .describe("Declared auth routing facts for a harness.");
-export const ContainmentKind = z
-    .enum([
-    "env_or_file_injection",
-    "scoped_home_keychain_bridge",
-    "host_user_context",
-    "process_sandbox",
-    "container",
-])
-    .describe("Isolation containment level an adapter supports for run environments, from env/file injection through scoped-HOME keychain bridging to process sandboxes and containers.");
-export const IsolationCapabilities = z
-    .object({
-    supported_containment: z
-        .array(ContainmentKind)
-        .default(["env_or_file_injection"])
-        .describe("Containment mechanisms the adapter can run under."),
-})
-    .default({})
-    .describe("Declared isolation containment facts for a harness.");
 export const ReadonlyMechanism = z
     .enum(["fs_sandbox", "permission_deny", "tool_allowlist", "none"])
     .describe("How read-only access is enforced for a harness: a filesystem sandbox, permission denial, a tool allowlist, or none (read-only intent is advisory).");
@@ -573,6 +556,11 @@ export const HarnessRunSpec = z
     raw_context_packet: RawContextPacket.nullable()
         .optional()
         .describe("Hash-bound context packet supplied only to git-patch-envelope producers."),
+    /** The APPLIED OS boundary this process starts inside; null = none (every
+     * ordinary run). Consumed by the shared CLI run loop, never by adapters. */
+    confinement: HarnessConfinement.nullable()
+        .default(null)
+        .describe("OS-enforced filesystem boundary the harness process starts inside; null = none. Applied by the shared CLI run loop, not by adapters."),
     extra: z
         .record(z.string(), z.unknown())
         .default({})