@claudexor/schema 3.5.0 → 3.6.0

package/dist/credential-profile.d.ts

@@ -1,10 +1,14 @@
 import { z } from "zod/v3";
 /**
- * The credential transport a profile isolates (INV-135). `config_dir_login` is
- * a vendor-owned login living in a Claudexor-scoped config dir or HOME
- * (Claude CLAUDE_CONFIG_DIR / Codex CODEX_HOME / Cursor file-store HOME);
- * `oauth_token` and `api_key` are secret-store references. Default vendor
- * stores are NEVER a profile's isolation locator — profiles are additive.
+ * The credential transport a profile isolates (INV-135, unified account
+ * model). `config_dir_login` is a vendor-owned login living in a
+ * Claudexor-scoped config dir or HOME (Claude CLAUDE_CONFIG_DIR / Codex
+ * CODEX_HOME / Cursor file-store HOME). The Claudexor-owned LEGACY native
+ * dirs are legal locators — the startup migration registers them as the
+ * `claude-default`/`codex-default` rows without moving bytes; the vendor's
+ * ordinary host stores (~/.claude, ~/.codex) stay outside the owned root and
+ * are never a locator. `oauth_token` and `api_key` are secret-store
+ * references.
  */
 export declare const CredentialKind: z.ZodEnum<["config_dir_login", "oauth_token", "api_key"]>;
 export type CredentialKind = z.infer<typeof CredentialKind>;
@@ -99,6 +103,56 @@ export declare const CredentialProfileStatus: z.ZodObject<{
     last_verified_at?: string | null | undefined;
 }>;
 export type CredentialProfileStatus = z.infer<typeof CredentialProfileStatus>;
+/** Why an observed credential is unusable, in the OBSERVER's typed vocabulary:
+ * `auth_revoked` = the vendor rejected the credential itself (401/403);
+ * `capability_refused` = a typed non-retryable entitlement refusal was observed
+ * on the attempt stream (org-disabled, model-not-entitled — model-scoped when
+ * the attempt carried a model hint); `verification_failed` = the profile's own
+ * doctor probe failed verification. */
+export declare const CredentialUnusableCode: z.ZodEnum<["auth_revoked", "capability_refused", "verification_failed"]>;
+export type CredentialUnusableCode = z.infer<typeof CredentialUnusableCode>;
+/**
+ * ONE typed observation that a credential subject is UNUSABLE — dead as a
+ * credential, not merely quota-spent (A7 differential probe). Deliberately a
+ * bounded, self-expiring OBSERVATION, never durable config: profile readiness
+ * stays the doctor's projection (`CredentialProfileStatus`), and quota-spent
+ * evidence stays the quota registry's cooldown snapshots. The clearing
+ * contract is threefold: `expires_at` self-expiry (bounded TTL), a successful
+ * model response for the same subject, and any credential-generation change
+ * (re-login / profile mutation).
+ */
+export declare const CredentialUnusableObservation: z.ZodObject<{
+    harness_id: z.ZodString;
+    profile_id: z.ZodNullable<z.ZodString>;
+    /** Model the refusal was observed under, when the evidence cannot prove it
+     * is credential-wide (an entitlement refusal may be model-scoped). Null =
+     * the evidence condemns the credential for every model. */
+    model: z.ZodNullable<z.ZodString>;
+    code: z.ZodEnum<["auth_revoked", "capability_refused", "verification_failed"]>;
+    source: z.ZodEnum<["vendor_poller", "attempt_stream", "local_probe"]>;
+    detail: z.ZodNullable<z.ZodString>;
+    observed_at: z.ZodString;
+    expires_at: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    harness_id: string;
+    profile_id: string | null;
+    model: string | null;
+    code: "auth_revoked" | "capability_refused" | "verification_failed";
+    source: "attempt_stream" | "local_probe" | "vendor_poller";
+    detail: string | null;
+    observed_at: string;
+    expires_at: string;
+}, {
+    harness_id: string;
+    profile_id: string | null;
+    model: string | null;
+    code: "auth_revoked" | "capability_refused" | "verification_failed";
+    source: "attempt_stream" | "local_probe" | "vendor_poller";
+    detail: string | null;
+    observed_at: string;
+    expires_at: string;
+}>;
+export type CredentialUnusableObservation = z.infer<typeof CredentialUnusableObservation>;
 /**
  * NON-SECRET account identity projection (INV-067/INV-135): the email and plan
  * label derived DAEMON-SIDE from a sanctioned per-account source. Codex and
@@ -159,6 +213,174 @@ export declare const ControlNextUpIdentity: z.ZodDiscriminatedUnion<"kind", [z.Z
     reason: string;
 }>]>;
 export type ControlNextUpIdentity = z.infer<typeof ControlNextUpIdentity>;
+/**
+ * The account an UNPINNED run of a harness would route to next under the
+ * UNIFIED account model (INV-135): every account is a named registry row, so
+ * the pool verdict is either an enabled row, the policy-governed API-key
+ * ROUTE (INV-061 — a route, never a row), or nothing routable. This union is
+ * carried ONLY by `accountPools` — the legacy `ControlNextUpIdentity` stays
+ * untouched because old strict decoders throw on unknown kinds.
+ */
+export declare const ControlPoolNextUp: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+    kind: z.ZodLiteral<"profile">;
+    profileId: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "profile";
+    profileId: string;
+}, {
+    kind: "profile";
+    profileId: string;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"api_key_route">;
+}, "strict", z.ZodTypeAny, {
+    kind: "api_key_route";
+}, {
+    kind: "api_key_route";
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"none">;
+    reason: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    kind: "none";
+    reason: string;
+}, {
+    kind: "none";
+    reason: string;
+}>]>;
+export type ControlPoolNextUp = z.infer<typeof ControlPoolNextUp>;
+/** Per-harness POOL AUTHORITY of the unified account model: routing facts live
+ * here; account facts live on the profile rows. */
+export declare const ControlHarnessAccountPool: z.ZodObject<{
+    harness_id: z.ZodString;
+    next_up: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+        kind: z.ZodLiteral<"profile">;
+        profileId: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "profile";
+        profileId: string;
+    }, {
+        kind: "profile";
+        profileId: string;
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"api_key_route">;
+    }, "strict", z.ZodTypeAny, {
+        kind: "api_key_route";
+    }, {
+        kind: "api_key_route";
+    }>, z.ZodObject<{
+        kind: z.ZodLiteral<"none">;
+        reason: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        kind: "none";
+        reason: string;
+    }, {
+        kind: "none";
+        reason: string;
+    }>]>;
+}, "strict", z.ZodTypeAny, {
+    harness_id: string;
+    next_up: {
+        kind: "profile";
+        profileId: string;
+    } | {
+        kind: "api_key_route";
+    } | {
+        kind: "none";
+        reason: string;
+    };
+}, {
+    harness_id: string;
+    next_up: {
+        kind: "profile";
+        profileId: string;
+    } | {
+        kind: "api_key_route";
+    } | {
+        kind: "none";
+        reason: string;
+    };
+}>;
+export type ControlHarnessAccountPool = z.infer<typeof ControlHarnessAccountPool>;
+/** GET /account-pools — the pool-authority read AND the unified-accounts
+ * feature marker (its catalog presence is absent from 3.5.0 engines). */
+export declare const ControlAccountPoolsResponse: z.ZodObject<{
+    accountPools: z.ZodArray<z.ZodObject<{
+        harness_id: z.ZodString;
+        next_up: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"profile">;
+            profileId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "profile";
+            profileId: string;
+        }, {
+            kind: "profile";
+            profileId: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"api_key_route">;
+        }, "strict", z.ZodTypeAny, {
+            kind: "api_key_route";
+        }, {
+            kind: "api_key_route";
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"none">;
+            reason: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "none";
+            reason: string;
+        }, {
+            kind: "none";
+            reason: string;
+        }>]>;
+    }, "strict", z.ZodTypeAny, {
+        harness_id: string;
+        next_up: {
+            kind: "profile";
+            profileId: string;
+        } | {
+            kind: "api_key_route";
+        } | {
+            kind: "none";
+            reason: string;
+        };
+    }, {
+        harness_id: string;
+        next_up: {
+            kind: "profile";
+            profileId: string;
+        } | {
+            kind: "api_key_route";
+        } | {
+            kind: "none";
+            reason: string;
+        };
+    }>, "many">;
+}, "strict", z.ZodTypeAny, {
+    accountPools: {
+        harness_id: string;
+        next_up: {
+            kind: "profile";
+            profileId: string;
+        } | {
+            kind: "api_key_route";
+        } | {
+            kind: "none";
+            reason: string;
+        };
+    }[];
+}, {
+    accountPools: {
+        harness_id: string;
+        next_up: {
+            kind: "profile";
+            profileId: string;
+        } | {
+            kind: "api_key_route";
+        } | {
+            kind: "none";
+            reason: string;
+        };
+    }[];
+}>;
+export type ControlAccountPoolsResponse = z.infer<typeof ControlAccountPoolsResponse>;
 /**
  * Per-harness ACCOUNTS AUTHORITY projection (INV-135, the accounts symmetry):
  * the native "CLI login" pseudo-row state and the informational `next_up`
@@ -467,6 +689,56 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             reason: string;
         };
     }>, "many">>;
+    accountPools: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        harness_id: z.ZodString;
+        next_up: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
+            kind: z.ZodLiteral<"profile">;
+            profileId: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "profile";
+            profileId: string;
+        }, {
+            kind: "profile";
+            profileId: string;
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"api_key_route">;
+        }, "strict", z.ZodTypeAny, {
+            kind: "api_key_route";
+        }, {
+            kind: "api_key_route";
+        }>, z.ZodObject<{
+            kind: z.ZodLiteral<"none">;
+            reason: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            kind: "none";
+            reason: string;
+        }, {
+            kind: "none";
+            reason: string;
+        }>]>;
+    }, "strict", z.ZodTypeAny, {
+        harness_id: string;
+        next_up: {
+            kind: "profile";
+            profileId: string;
+        } | {
+            kind: "api_key_route";
+        } | {
+            kind: "none";
+            reason: string;
+        };
+    }, {
+        harness_id: string;
+        next_up: {
+            kind: "profile";
+            profileId: string;
+        } | {
+            kind: "api_key_route";
+        } | {
+            kind: "none";
+            reason: string;
+        };
+    }>, "many">>;
 }, "strict", z.ZodTypeAny, {
     profiles: {
         profile: {
@@ -512,6 +784,18 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             reason: string;
         };
     }[];
+    accountPools: {
+        harness_id: string;
+        next_up: {
+            kind: "profile";
+            profileId: string;
+        } | {
+            kind: "api_key_route";
+        } | {
+            kind: "none";
+            reason: string;
+        };
+    }[];
 }, {
     profiles: {
         profile: {
@@ -557,6 +841,18 @@ export declare const ControlCredentialProfilesResponse: z.ZodObject<{
             reason: string;
         };
     }[] | undefined;
+    accountPools?: {
+        harness_id: string;
+        next_up: {
+            kind: "profile";
+            profileId: string;
+        } | {
+            kind: "api_key_route";
+        } | {
+            kind: "none";
+            reason: string;
+        };
+    }[] | undefined;
 }>;
 export type ControlCredentialProfilesResponse = z.infer<typeof ControlCredentialProfilesResponse>;
 /** PATCH /credential-profiles/:harness/:id — toggle a profile's `enabled`
@@ -710,8 +1006,12 @@ export declare const ControlCredentialProfileCreateRequest: z.ZodObject<{
 }>;
 export type ControlCredentialProfileCreateRequest = z.infer<typeof ControlCredentialProfileCreateRequest>;
 /** DELETE /credential-profiles/:harness/:id — removes the registry entry and
- * the profile's OWN credential material (its scoped login dir, or its
- * namespaced secret). The default vendor store is untouchable by design. */
+ * the profile's OWN credential material (its scoped login dir or the migrated
+ * row's recorded legacy locator, or its namespaced secret). Success means the
+ * row AND its material are provably gone (D-U4): a partial cleanup failure is
+ * a typed RETRYABLE error that leaves the row registered, never a
+ * `removed: true` with a warning. The vendor's ordinary host stores stay
+ * untouchable by design. */
 export declare const ControlCredentialProfileDeleteResponse: z.ZodObject<{
     profile: z.ZodEffects<z.ZodObject<{
         profile_id: z.ZodString;

package/dist/credential-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-profile.d.ts","sourceRoot":"","sources":["../src/credential-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAK3B;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,2DAIxB,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6D3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;IAMhC;;;;;;uCAMmC;;;;;;;;;;;;;;;;;;;;EAe2D,CAAC;AACnG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;EAoBzB,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuB0D,CAAC;AAC7F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;mFACmF;AACnF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA/H1C;;;;;;+CAMmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsJpC,CAAC;AACJ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG;;wEAEwE;AACxE,eAAO,MAAM,qCAAqC;;;;;;EAOsB,CAAC;AACzE,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,qCAAqC,CAC7C,CAAC;AAEF;kCACkC;AAClC,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAhL/C;;;;;;2CAMmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6K4C,CAAC;AACpF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC;AAEF;2EAC2E;AAC3E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;EAaQ,CAAC;AAC3D,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,qCAAqC,CAC7C,CAAC;AAEF;;4EAE4E;AAC5E,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAaK,CAAC;AACzD,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAjO/C;;;;;;2CAMmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8N4C,CAAC;AACpF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC"}
+{"version":3,"file":"credential-profile.d.ts","sourceRoot":"","sources":["../src/credential-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAK3B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,cAAc,2DAIxB,CAAC;AACJ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6D3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;IAMhC;;;;;;uCAMmC;;;;;;;;;;;;;;;;;;;;EAe2D,CAAC;AACnG,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;uCAKuC;AACvC,eAAO,MAAM,sBAAsB,0EAIhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B;;;IAMtC;;+DAE2D;;;;;;;;;;;;;;;;;;;;;;;;;EAsB5D,CAAC;AACJ,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;;;;;;EAoBzB,CAAC;AACJ,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuB0D,CAAC;AAC7F,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;IAmB3B,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;mDACmD;AACnD,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQnC,CAAC;AACJ,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF;yEACyE;AACzE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAO0C,CAAC;AACnF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBhC,CAAC;AACJ,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E;mFACmF;AACnF,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YA9O1C;;;;;;+CAMmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2QpC,CAAC;AACJ,MAAM,MAAM,iCAAiC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iCAAiC,CAAC,CAAC;AAElG;;wEAEwE;AACxE,eAAO,MAAM,qCAAqC;;;;;;EAOsB,CAAC;AACzE,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,qCAAqC,CAC7C,CAAC;AAEF;kCACkC;AAClC,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QArS/C;;;;;;2CAMmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkS4C,CAAC;AACpF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC;AAEF;2EAC2E;AAC3E,eAAO,MAAM,qCAAqC;;;;;;;;;;;;EAaQ,CAAC;AAC3D,MAAM,MAAM,qCAAqC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,qCAAqC,CAC7C,CAAC;AAEF;;;;;;4BAM4B;AAC5B,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAeK,CAAC;AACzD,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC;AAEF,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA5V/C;;;;;;2CAMmC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyV4C,CAAC;AACpF,MAAM,MAAM,sCAAsC,GAAG,CAAC,CAAC,KAAK,CAC1D,OAAO,sCAAsC,CAC9C,CAAC"}

package/dist/credential-profile.js

@@ -3,11 +3,15 @@ import { namespacedSecretRefBase } from "@claudexor/util";
 import { Id, IsoTimestamp } from "./primitives.js";
 import { AuthAvailability, AuthVerification } from "./auth.js";
 /**
- * The credential transport a profile isolates (INV-135). `config_dir_login` is
- * a vendor-owned login living in a Claudexor-scoped config dir or HOME
- * (Claude CLAUDE_CONFIG_DIR / Codex CODEX_HOME / Cursor file-store HOME);
- * `oauth_token` and `api_key` are secret-store references. Default vendor
- * stores are NEVER a profile's isolation locator — profiles are additive.
+ * The credential transport a profile isolates (INV-135, unified account
+ * model). `config_dir_login` is a vendor-owned login living in a
+ * Claudexor-scoped config dir or HOME (Claude CLAUDE_CONFIG_DIR / Codex
+ * CODEX_HOME / Cursor file-store HOME). The Claudexor-owned LEGACY native
+ * dirs are legal locators — the startup migration registers them as the
+ * `claude-default`/`codex-default` rows without moving bytes; the vendor's
+ * ordinary host stores (~/.claude, ~/.codex) stay outside the owned root and
+ * are never a locator. `oauth_token` and `api_key` are secret-store
+ * references.
  */
 export const CredentialKind = z
     .enum(["config_dir_login", "oauth_token", "api_key"])
@@ -104,6 +108,46 @@ export const CredentialProfileStatus = z
 })
     .strict()
     .describe("Doctor-owned readiness projection for one credential profile; never durable config.");
+/** Why an observed credential is unusable, in the OBSERVER's typed vocabulary:
+ * `auth_revoked` = the vendor rejected the credential itself (401/403);
+ * `capability_refused` = a typed non-retryable entitlement refusal was observed
+ * on the attempt stream (org-disabled, model-not-entitled — model-scoped when
+ * the attempt carried a model hint); `verification_failed` = the profile's own
+ * doctor probe failed verification. */
+export const CredentialUnusableCode = z
+    .enum(["auth_revoked", "capability_refused", "verification_failed"])
+    .describe("Typed reason an observed credential is unusable: vendor rejection, entitlement refusal, or a failed profile verification probe.");
+/**
+ * ONE typed observation that a credential subject is UNUSABLE — dead as a
+ * credential, not merely quota-spent (A7 differential probe). Deliberately a
+ * bounded, self-expiring OBSERVATION, never durable config: profile readiness
+ * stays the doctor's projection (`CredentialProfileStatus`), and quota-spent
+ * evidence stays the quota registry's cooldown snapshots. The clearing
+ * contract is threefold: `expires_at` self-expiry (bounded TTL), a successful
+ * model response for the same subject, and any credential-generation change
+ * (re-login / profile mutation).
+ */
+export const CredentialUnusableObservation = z
+    .object({
+    harness_id: Id.describe("Harness family the observed subject belongs to."),
+    profile_id: Id.nullable().describe("Observed credential profile, or null for the harness's default subject."),
+    /** Model the refusal was observed under, when the evidence cannot prove it
+     * is credential-wide (an entitlement refusal may be model-scoped). Null =
+     * the evidence condemns the credential for every model. */
+    model: z
+        .string()
+        .nullable()
+        .describe("Model hint the refusal was observed under (entitlement refusals may be model-scoped); null = credential-wide."),
+    code: CredentialUnusableCode,
+    source: z
+        .enum(["vendor_poller", "attempt_stream", "local_probe"])
+        .describe("Where the evidence came from: the quota poller's typed absence, a typed refusal on the attempt stream, or the profile's own doctor probe."),
+    detail: z.string().nullable().describe("Redacted human-readable evidence."),
+    observed_at: IsoTimestamp.describe("When the unusable verdict was observed."),
+    expires_at: IsoTimestamp.describe("Self-expiry instant (bounded TTL); after this the observation is ignored."),
+})
+    .strict()
+    .describe("A bounded, self-expiring typed observation that a credential subject is unusable (dead credential, not spent quota); never durable config.");
 /**
  * NON-SECRET account identity projection (INV-067/INV-135): the email and plan
  * label derived DAEMON-SIDE from a sanctioned per-account source. Codex and
@@ -161,6 +205,49 @@ export const ControlNextUpIdentity = z
         .describe("An unpinned run has nothing routable (the default credential is disabled and no account is pinned)."),
 ])
     .describe("Server-computed identity an unpinned run of this harness would route to next.");
+/**
+ * The account an UNPINNED run of a harness would route to next under the
+ * UNIFIED account model (INV-135): every account is a named registry row, so
+ * the pool verdict is either an enabled row, the policy-governed API-key
+ * ROUTE (INV-061 — a route, never a row), or nothing routable. This union is
+ * carried ONLY by `accountPools` — the legacy `ControlNextUpIdentity` stays
+ * untouched because old strict decoders throw on unknown kinds.
+ */
+export const ControlPoolNextUp = z
+    .discriminatedUnion("kind", [
+    z
+        .object({ kind: z.literal("profile"), profileId: Id })
+        .strict()
+        .describe("An enabled account row is who an unpinned run routes to next."),
+    z
+        .object({ kind: z.literal("api_key_route") })
+        .strict()
+        .describe("The account pool is empty or exhausted; the unpinned route is the policy-governed API key (INV-061) — a route, never an account row."),
+    z
+        .object({ kind: z.literal("none"), reason: z.string() })
+        .strict()
+        .describe("An unpinned run has nothing routable, with a human reason."),
+])
+    .describe("Server-computed pool routing verdict for one harness's unpinned runs (unified account model).");
+/** Per-harness POOL AUTHORITY of the unified account model: routing facts live
+ * here; account facts live on the profile rows. */
+export const ControlHarnessAccountPool = z
+    .object({
+    harness_id: Id.describe("Harness family this pool verdict belongs to."),
+    next_up: ControlPoolNextUp,
+})
+    .strict()
+    .describe("Per-harness pool authority (unified account model): who an unpinned run routes to next.");
+/** GET /account-pools — the pool-authority read AND the unified-accounts
+ * feature marker (its catalog presence is absent from 3.5.0 engines). */
+export const ControlAccountPoolsResponse = z
+    .object({
+    accountPools: z
+        .array(ControlHarnessAccountPool)
+        .describe("Pool routing verdict per harness, computed by the routing owner."),
+})
+    .strict()
+    .describe("Per-harness account-pool authority under the unified account model.");
 /**
  * Per-harness ACCOUNTS AUTHORITY projection (INV-135, the accounts symmetry):
  * the native "CLI login" pseudo-row state and the informational `next_up`
@@ -203,7 +290,11 @@ export const ControlCredentialProfilesResponse = z
     harnessAccounts: z
         .array(ControlHarnessAccounts)
         .default([])
-        .describe("Per-harness accounts authority (INV-135): the native CLI-login pseudo-row state and the server-computed Active identity, so no surface re-derives the accounts symmetry."),
+        .describe("Per-harness accounts authority (INV-135): the native CLI-login pseudo-row state and the server-computed Active identity, so no surface re-derives the accounts symmetry. A unified-model engine emits [] here (the key must stay present for legacy strict clients) and carries routing facts in accountPools instead."),
+    accountPools: z
+        .array(ControlHarnessAccountPool)
+        .default([])
+        .describe("Additive per-harness pool authority of the unified account model: routing facts (next_up incl. the api_key_route kind) live here so legacy strict next_up decoders never see unknown kinds. Old clients ignore this key."),
 })
     .strict()
     .describe("Credential-profile registry listing with per-profile doctor readiness and per-harness accounts authority.");
@@ -239,8 +330,12 @@ export const ControlCredentialProfileCreateRequest = z
     .strict()
     .describe("Request body for POST /credential-profiles.");
 /** DELETE /credential-profiles/:harness/:id — removes the registry entry and
- * the profile's OWN credential material (its scoped login dir, or its
- * namespaced secret). The default vendor store is untouchable by design. */
+ * the profile's OWN credential material (its scoped login dir or the migrated
+ * row's recorded legacy locator, or its namespaced secret). Success means the
+ * row AND its material are provably gone (D-U4): a partial cleanup failure is
+ * a typed RETRYABLE error that leaves the row registered, never a
+ * `removed: true` with a warning. The vendor's ordinary host stores stay
+ * untouchable by design. */
 export const ControlCredentialProfileDeleteResponse = z
     .object({
     profile: CredentialProfile.describe("The removed registry entry."),
@@ -251,7 +346,7 @@ export const ControlCredentialProfileDeleteResponse = z
     cleanupWarning: z
         .string()
         .optional()
-        .describe("Present when the registry entry was removed but cleanup failed (orphan left)."),
+        .describe("DEPRECATED (wire-compat only): a unified-model engine never emits it — partial cleanup is a typed retryable error instead of a removed-with-warning receipt."),
 })
     .strict()
     .describe("Receipt for a credential-profile removal.");

package/dist/credential-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-profile.js","sourceRoot":"","sources":["../src/credential-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE/D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,IAAI,CAAC,CAAC,kBAAkB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;KACpD,QAAQ,CACP,uHAAuH,CACxH,CAAC;AAGJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;IACtF,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC3F,eAAe,EAAE,cAAc;IAC/B,iBAAiB,EAAE,CAAC;SACjB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,8FAA8F,CAC/F;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,oHAAoH,CACrH;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IACpF,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE;SAChC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,wEAAwE,CAAC;CACtF,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,OAAO,CAAC,eAAe,KAAK,kBAAkB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,iBAAiB;YAC5B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,6EAA6E;aACvF,CAAC,CAAC;QACL,IAAI,OAAO,CAAC,UAAU;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAC;IACP,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,OAAO,CAAC,UAAU;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG,OAAO,CAAC,eAAe,8BAA8B;aAClE,CAAC,CAAC;QACL,+DAA+D;QAC/D,wEAAwE;QACxE,iEAAiE;aAC5D,IAAI,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI;YAC3D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,eAAe,OAAO,CAAC,UAAU,0IAA0I;aACrL,CAAC,CAAC;QACL,IAAI,OAAO,CAAC,iBAAiB;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG,OAAO,CAAC,eAAe,4CAA4C;aAChF,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC;KACD,QAAQ,CACP,wJAAwJ,CACzJ,CAAC;AAGJ;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,EAAE;IACd,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,gBAAgB;IAC9B;;;;;;uCAMmC;IACnC,mBAAmB,EAAE,CAAC;SACnB,IAAI,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;SAC/B,OAAO,CAAC,aAAa,CAAC;SACtB,QAAQ,CACP,yOAAyO,CAC1O;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IACjF,gBAAgB,EAAE,YAAY,CAAC,QAAQ,EAAE;SACtC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,mHAAmH,CACpH;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,qFAAqF,CAAC,CAAC;AAGnG;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,4IAA4I,CAC7I;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,+FAA+F,CAChG;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,gNAAgN,CACjN,CAAC;AAGJ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,kBAAkB,CAAC,MAAM,EAAE;IAC1B,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;SACrD,MAAM,EAAE;SACR,QAAQ,CAAC,sEAAsE,CAAC;IACnF,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,KAAK,EAAE,CAAC;aACL,IAAI,CAAC,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;aAClC,QAAQ,EAAE;aACV,QAAQ,CAAC,8EAA8E,CAAC;KAC5F,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,CAAC,sEAAsE,CAAC;IACnF,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SACvD,MAAM,EAAE;SACR,QAAQ,CACP,qGAAqG,CACtG;CACJ,CAAC;KACD,QAAQ,CAAC,+EAA+E,CAAC,CAAC;AAG7F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACnE,0BAA0B,EAAE,CAAC;SAC1B,OAAO,EAAE;SACT,QAAQ,CAAC,gFAAgF,CAAC;IAC7F,qBAAqB,EAAE,CAAC;SACrB,OAAO,EAAE;SACT,QAAQ,CACP,yGAAyG,CAC1G;IACH,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE;SACjC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,wLAAwL,CACzL;IACH,OAAO,EAAE,qBAAqB;CAC/B,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,8FAA8F,CAC/F,CAAC;AAGJ;mFACmF;AACnF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,OAAO,EAAE,iBAAiB;QAC1B,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE;aACjC,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,8KAA8K,CAC/K;KACJ,CAAC;SACD,MAAM,EAAE,CACZ;SACA,QAAQ,CACP,0GAA0G,CAC3G;IACH,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,sBAAsB,CAAC;SAC7B,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,0KAA0K,CAC3K;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,2GAA2G,CAC5G,CAAC;AAGJ;;wEAEwE;AACxE,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,CAAC,mEAAmE,CAAC;CACjF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,2DAA2D,CAAC,CAAC;AAKzE;kCACkC;AAClC,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;KACvE,MAAM,EAAE;KACR,QAAQ,CAAC,sEAAsE,CAAC,CAAC;AAKpF;2EAC2E;AAC3E,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,SAAS,EAAE,EAAE,CAAC,QAAQ,CACpB,4EAA4E,CAC7E;IACD,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAC5E,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;CACnF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,6CAA6C,CAAC,CAAC;AAK3D;;4EAE4E;AAC5E,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC;IACN,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAClE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,iBAAiB,EAAE,CAAC;SACjB,IAAI,CAAC,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;SACtD,QAAQ,CAAC,oEAAoE,CAAC;IACjF,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,+EAA+E,CAAC;CAC7F,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,2CAA2C,CAAC,CAAC;AAKzD,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;KACvE,MAAM,EAAE;KACR,QAAQ,CAAC,sEAAsE,CAAC,CAAC"}
+{"version":3,"file":"credential-profile.js","sourceRoot":"","sources":["../src/credential-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,IAAI,CAAC,CAAC,kBAAkB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;KACpD,QAAQ,CACP,uHAAuH,CACxH,CAAC;AAGJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,6DAA6D,CAAC;IACtF,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IAClE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC3F,eAAe,EAAE,cAAc;IAC/B,iBAAiB,EAAE,CAAC;SACjB,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,8FAA8F,CAC/F;IACH,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,oHAAoH,CACrH;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,uCAAuC,CAAC;IACpF,UAAU,EAAE,YAAY,CAAC,QAAQ,EAAE;SAChC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CAAC,wEAAwE,CAAC;CACtF,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,IAAI,OAAO,CAAC,eAAe,KAAK,kBAAkB,EAAE,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,iBAAiB;YAC5B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,6EAA6E;aACvF,CAAC,CAAC;QACL,IAAI,OAAO,CAAC,UAAU;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,qDAAqD;aAC/D,CAAC,CAAC;IACP,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,OAAO,CAAC,UAAU;YACrB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG,OAAO,CAAC,eAAe,8BAA8B;aAClE,CAAC,CAAC;QACL,+DAA+D;QAC/D,wEAAwE;QACxE,iEAAiE;aAC5D,IAAI,uBAAuB,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI;YAC3D,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,eAAe,OAAO,CAAC,UAAU,0IAA0I;aACrL,CAAC,CAAC;QACL,IAAI,OAAO,CAAC,iBAAiB;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,GAAG,OAAO,CAAC,eAAe,4CAA4C;aAChF,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC;KACD,QAAQ,CACP,wJAAwJ,CACzJ,CAAC;AAGJ;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,EAAE;IACd,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,gBAAgB;IAC9B;;;;;;uCAMmC;IACnC,mBAAmB,EAAE,CAAC;SACnB,IAAI,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;SAC/B,OAAO,CAAC,aAAa,CAAC;SACtB,QAAQ,CACP,yOAAyO,CAC1O;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IACjF,gBAAgB,EAAE,YAAY,CAAC,QAAQ,EAAE;SACtC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,mHAAmH,CACpH;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,qFAAqF,CAAC,CAAC;AAGnG;;;;;uCAKuC;AACvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,IAAI,CAAC,CAAC,cAAc,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,CAAC;KACnE,QAAQ,CACP,iIAAiI,CAClI,CAAC;AAGJ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACN,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC;IAC1E,UAAU,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAChC,yEAAyE,CAC1E;IACD;;+DAE2D;IAC3D,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,+GAA+G,CAChH;IACH,IAAI,EAAE,sBAAsB;IAC5B,MAAM,EAAE,CAAC;SACN,IAAI,CAAC,CAAC,eAAe,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC;SACxD,QAAQ,CACP,2IAA2I,CAC5I;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,mCAAmC,CAAC;IAC3E,WAAW,EAAE,YAAY,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IAC7E,UAAU,EAAE,YAAY,CAAC,QAAQ,CAC/B,2EAA2E,CAC5E;CACF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,4IAA4I,CAC7I,CAAC;AAGJ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,KAAK,EAAE,CAAC;SACL,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,4IAA4I,CAC7I;IACH,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CACP,+FAA+F,CAChG;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,gNAAgN,CACjN,CAAC;AAGJ;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,kBAAkB,CAAC,MAAM,EAAE;IAC1B,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;SACrD,MAAM,EAAE;SACR,QAAQ,CAAC,sEAAsE,CAAC;IACnF,CAAC;SACE,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACzB,KAAK,EAAE,CAAC;aACL,IAAI,CAAC,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;aAClC,QAAQ,EAAE;aACV,QAAQ,CAAC,8EAA8E,CAAC;KAC5F,CAAC;SACD,MAAM,EAAE;SACR,QAAQ,CAAC,sEAAsE,CAAC;IACnF,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SACvD,MAAM,EAAE;SACR,QAAQ,CACP,qGAAqG,CACtG;CACJ,CAAC;KACD,QAAQ,CAAC,+EAA+E,CAAC,CAAC;AAG7F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,kBAAkB,CAAC,MAAM,EAAE;IAC1B,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;SACrD,MAAM,EAAE;SACR,QAAQ,CAAC,+DAA+D,CAAC;IAC5E,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;SAC5C,MAAM,EAAE;SACR,QAAQ,CACP,sIAAsI,CACvI;IACH,CAAC;SACE,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SACvD,MAAM,EAAE;SACR,QAAQ,CAAC,4DAA4D,CAAC;CAC1E,CAAC;KACD,QAAQ,CACP,+FAA+F,CAChG,CAAC;AAGJ;mDACmD;AACnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,8CAA8C,CAAC;IACvE,OAAO,EAAE,iBAAiB;CAC3B,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,yFAAyF,CAC1F,CAAC;AAGJ;yEACyE;AACzE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC;KACzC,MAAM,CAAC;IACN,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,yBAAyB,CAAC;SAChC,QAAQ,CAAC,kEAAkE,CAAC;CAChF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,qEAAqE,CAAC,CAAC;AAGnF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACnE,0BAA0B,EAAE,CAAC;SAC1B,OAAO,EAAE;SACT,QAAQ,CAAC,gFAAgF,CAAC;IAC7F,qBAAqB,EAAE,CAAC;SACrB,OAAO,EAAE;SACT,QAAQ,CACP,yGAAyG,CAC1G;IACH,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE;SACjC,OAAO,CAAC,IAAI,CAAC;SACb,QAAQ,CACP,wLAAwL,CACzL;IACH,OAAO,EAAE,qBAAqB;CAC/B,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,8FAA8F,CAC/F,CAAC;AAGJ;mFACmF;AACnF,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC;SACR,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,OAAO,EAAE,iBAAiB;QAC1B,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE;aACjC,OAAO,CAAC,IAAI,CAAC;aACb,QAAQ,CACP,8KAA8K,CAC/K;KACJ,CAAC;SACD,MAAM,EAAE,CACZ;SACA,QAAQ,CACP,0GAA0G,CAC3G;IACH,eAAe,EAAE,CAAC;SACf,KAAK,CAAC,sBAAsB,CAAC;SAC7B,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,wTAAwT,CACzT;IACH,YAAY,EAAE,CAAC;SACZ,KAAK,CAAC,yBAAyB,CAAC;SAChC,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CACP,0NAA0N,CAC3N;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CACP,2GAA2G,CAC5G,CAAC;AAGJ;;wEAEwE;AACxE,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,OAAO,EAAE,CAAC;SACP,OAAO,EAAE;SACT,QAAQ,CAAC,mEAAmE,CAAC;CACjF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,2DAA2D,CAAC,CAAC;AAKzE;kCACkC;AAClC,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;KACvE,MAAM,EAAE;KACR,QAAQ,CAAC,sEAAsE,CAAC,CAAC;AAKpF;2EAC2E;AAC3E,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC;KACnD,MAAM,CAAC;IACN,SAAS,EAAE,EAAE,CAAC,QAAQ,CACpB,4EAA4E,CAC7E;IACD,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAC5E,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,EAAE;SACV,QAAQ,CAAC,qEAAqE,CAAC;CACnF,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,6CAA6C,CAAC,CAAC;AAK3D;;;;;;4BAM4B;AAC5B,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC;IACN,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,6BAA6B,CAAC;IAClE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACxB,iBAAiB,EAAE,CAAC;SACjB,IAAI,CAAC,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;SACtD,QAAQ,CAAC,oEAAoE,CAAC;IACjF,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CACP,8JAA8J,CAC/J;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,2CAA2C,CAAC,CAAC;AAKzD,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACpD,MAAM,CAAC,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;KACvE,MAAM,EAAE;KACR,QAAQ,CAAC,sEAAsE,CAAC,CAAC"}

package/dist/credential-store.d.ts

@@ -2,12 +2,25 @@
  * Which harnesses have a DEFAULT credential store — a place a vendor login
  * lands when no named account is selected.
  *
- * Every harness Claudexor drives does except agy: the Antigravity CLI takes
- * its whole config root from `$HOME` and exposes no config-dir variable, so
- * adopting a default store would mean adopting the operator's real home
- * directory as a credential store (owner decision Л-4). A harness that answers
- * false can only sign in INTO a named account, and every surface offering a
- * default login must refuse rather than pick one for the user.
+ * Under the unified account model this set is the LEGACY-migration surface,
+ * not a routing privilege: claude and codex keep their Claudexor-owned native
+ * dirs (the startup migration registers a detected login there as an ordinary
+ * `<harness>-default` row; bytes never move). Cursor answers FALSE (owner
+ * decision D-U3): the host Keychain login is never read again, so cursor has
+ * no default store — every cursor login lands in an isolated file-store row.
+ * agy answers false too: the Antigravity CLI takes its whole config root from
+ * `$HOME` and exposes no config-dir variable, so adopting a default store
+ * would mean adopting the operator's real home directory as a credential
+ * store (owner decision Л-4). A harness that answers false can only sign in
+ * INTO a named account row.
  */
 export declare function harnessHasDefaultCredentialStore(harness: string): boolean;
+/**
+ * Which harnesses support the `claudexor auth login <harness>` BOOTSTRAP
+ * sugar (unified account model): the login lands in an auto-created
+ * `<harness>-default` row — claude/codex on their Claudexor-owned native dir,
+ * cursor on an isolated file-store dir. The bootstrap row has no routing
+ * privilege; it is an ordinary pool row. agy stays named-only (Л-4).
+ */
+export declare function harnessSupportsBootstrapLogin(harness: string): boolean;
 //# sourceMappingURL=credential-store.d.ts.map

package/dist/credential-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzE"}
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzE;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtE"}

package/dist/credential-store.js

@@ -2,14 +2,29 @@
  * Which harnesses have a DEFAULT credential store — a place a vendor login
  * lands when no named account is selected.
  *
- * Every harness Claudexor drives does except agy: the Antigravity CLI takes
- * its whole config root from `$HOME` and exposes no config-dir variable, so
- * adopting a default store would mean adopting the operator's real home
- * directory as a credential store (owner decision Л-4). A harness that answers
- * false can only sign in INTO a named account, and every surface offering a
- * default login must refuse rather than pick one for the user.
+ * Under the unified account model this set is the LEGACY-migration surface,
+ * not a routing privilege: claude and codex keep their Claudexor-owned native
+ * dirs (the startup migration registers a detected login there as an ordinary
+ * `<harness>-default` row; bytes never move). Cursor answers FALSE (owner
+ * decision D-U3): the host Keychain login is never read again, so cursor has
+ * no default store — every cursor login lands in an isolated file-store row.
+ * agy answers false too: the Antigravity CLI takes its whole config root from
+ * `$HOME` and exposes no config-dir variable, so adopting a default store
+ * would mean adopting the operator's real home directory as a credential
+ * store (owner decision Л-4). A harness that answers false can only sign in
+ * INTO a named account row.
  */
 export function harnessHasDefaultCredentialStore(harness) {
+    return harness !== "agy" && harness !== "cursor";
+}
+/**
+ * Which harnesses support the `claudexor auth login <harness>` BOOTSTRAP
+ * sugar (unified account model): the login lands in an auto-created
+ * `<harness>-default` row — claude/codex on their Claudexor-owned native dir,
+ * cursor on an isolated file-store dir. The bootstrap row has no routing
+ * privilege; it is an ordinary pool row. agy stays named-only (Л-4).
+ */
+export function harnessSupportsBootstrapLogin(harness) {
     return harness !== "agy";
 }
 //# sourceMappingURL=credential-store.js.map

package/dist/credential-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAe;IAC9D,OAAO,OAAO,KAAK,KAAK,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"credential-store.js","sourceRoot":"","sources":["../src/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAe;IAC9D,OAAO,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,QAAQ,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC3D,OAAO,OAAO,KAAK,KAAK,CAAC;AAC3B,CAAC"}