@claudexor/schema 3.5.0 → 3.8.0

package/generated/ControlCredentialProfileUpdateResponse.schema.json

@@ -29,7 +29,7 @@
                 "oauth_token",
                 "api_key"
               ],
-              "description": "Credential transport a profile isolates: a scoped vendor config-dir login, a stored OAuth token, or a stored API key."
+              "description": "Binding kind for a profile: Claudexor-owned scoped vendor state, a managed OAuth secret, or a managed API-key secret; a vendor OS-user credential may remain outside that state."
             },
             "isolation_locator": {
               "type": [
@@ -37,7 +37,7 @@
                 "null"
               ],
               "default": null,
-              "description": "Canonical absolute config-dir path for config_dir_login profiles; null for secret-ref kinds."
+              "description": "Canonical absolute path to Claudexor-owned scoped vendor state for config_dir_login bindings; null for secret-ref kinds."
             },
             "secret_ref": {
               "type": [
@@ -74,7 +74,7 @@
             "credential_kind"
           ],
           "additionalProperties": false,
-          "description": "Durable non-secret registry entry for one credential identity of one harness; secret material lives in the vendor dir or the secret store, never here."
+          "description": "Durable non-secret named binding for one harness; credential material may live in Claudexor-owned scoped state, a managed secret store, or a platform-declared vendor/OS-user store, never in this row."
         },
         "status": {
           "type": "object",
@@ -110,7 +110,7 @@
                 "vendor"
               ],
               "default": "local_store",
-              "description": "How the verification verdict was reached: local_store = the profile's credential material is present locally (says nothing about the token being live); vendor = the vendor answered a request made with this profile's own credential."
+              "description": "How the verification verdict was reached: local_store = the binding's required local state or managed secret is present (says nothing about a token being live); vendor = the vendor answered under the exact binding environment and effective platform credential policy."
             },
             "detail": {
               "type": "string",

package/generated/ControlCredentialProfilesQueryResponse.schema.json

@@ -36,7 +36,7 @@
                           "oauth_token",
                           "api_key"
                         ],
-                        "description": "Credential transport a profile isolates: a scoped vendor config-dir login, a stored OAuth token, or a stored API key."
+                        "description": "Binding kind for a profile: Claudexor-owned scoped vendor state, a managed OAuth secret, or a managed API-key secret; a vendor OS-user credential may remain outside that state."
                       },
                       "isolation_locator": {
                         "type": [
@@ -44,7 +44,7 @@
                           "null"
                         ],
                         "default": null,
-                        "description": "Canonical absolute config-dir path for config_dir_login profiles; null for secret-ref kinds."
+                        "description": "Canonical absolute path to Claudexor-owned scoped vendor state for config_dir_login bindings; null for secret-ref kinds."
                       },
                       "secret_ref": {
                         "type": [
@@ -81,7 +81,7 @@
                       "credential_kind"
                     ],
                     "additionalProperties": false,
-                    "description": "Durable non-secret registry entry for one credential identity of one harness; secret material lives in the vendor dir or the secret store, never here."
+                    "description": "Durable non-secret named binding for one harness; credential material may live in Claudexor-owned scoped state, a managed secret store, or a platform-declared vendor/OS-user store, never in this row."
                   },
                   "status": {
                     "type": "object",
@@ -117,7 +117,7 @@
                           "vendor"
                         ],
                         "default": "local_store",
-                        "description": "How the verification verdict was reached: local_store = the profile's credential material is present locally (says nothing about the token being live); vendor = the vendor answered a request made with this profile's own credential."
+                        "description": "How the verification verdict was reached: local_store = the binding's required local state or managed secret is present (says nothing about a token being live); vendor = the vendor answered under the exact binding environment and effective platform credential policy."
                       },
                       "detail": {
                         "type": "string",
@@ -284,7 +284,83 @@
                 "description": "Per-harness accounts authority: native CLI-login state + the informational next-up identity."
               },
               "default": [],
-              "description": "Per-harness accounts authority (INV-135): the native CLI-login pseudo-row state and the server-computed Active identity, so no surface re-derives the accounts symmetry."
+              "description": "Per-harness accounts authority (INV-135): the native CLI-login pseudo-row state and the server-computed Active identity, so no surface re-derives the accounts symmetry. A unified-model engine emits [] here (the key must stay present for legacy strict clients) and carries routing facts in accountPools instead."
+            },
+            "accountPools": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "properties": {
+                  "harness_id": {
+                    "type": "string",
+                    "minLength": 1,
+                    "description": "Harness family this pool verdict belongs to."
+                  },
+                  "next_up": {
+                    "anyOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "kind": {
+                            "type": "string",
+                            "const": "profile"
+                          },
+                          "profileId": {
+                            "$ref": "#/definitions/ControlCredentialProfilesQueryResponse/anyOf/0/properties/profiles/items/properties/status/properties/profile_id"
+                          }
+                        },
+                        "required": [
+                          "kind",
+                          "profileId"
+                        ],
+                        "additionalProperties": false,
+                        "description": "An enabled account row is who an unpinned run routes to next."
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "kind": {
+                            "type": "string",
+                            "const": "api_key_route"
+                          }
+                        },
+                        "required": [
+                          "kind"
+                        ],
+                        "additionalProperties": false,
+                        "description": "The account pool is empty or exhausted; the unpinned route is the policy-governed API key (INV-061) — a route, never an account row."
+                      },
+                      {
+                        "type": "object",
+                        "properties": {
+                          "kind": {
+                            "type": "string",
+                            "const": "none"
+                          },
+                          "reason": {
+                            "type": "string"
+                          }
+                        },
+                        "required": [
+                          "kind",
+                          "reason"
+                        ],
+                        "additionalProperties": false,
+                        "description": "An unpinned run has nothing routable, with a human reason."
+                      }
+                    ],
+                    "description": "Server-computed pool routing verdict for one harness's unpinned runs (unified account model)."
+                  }
+                },
+                "required": [
+                  "harness_id",
+                  "next_up"
+                ],
+                "additionalProperties": false,
+                "description": "Per-harness pool authority (unified account model): who an unpinned run routes to next."
+              },
+              "default": [],
+              "description": "Additive per-harness pool authority of the unified account model: routing facts (next_up incl. the api_key_route kind) live here so legacy strict next_up decoders never see unknown kinds. Old clients ignore this key."
             }
           },
           "required": [
@@ -302,6 +378,9 @@
             "harnessAccounts": {
               "$ref": "#/definitions/ControlCredentialProfilesQueryResponse/anyOf/0/properties/harnessAccounts"
             },
+            "accountPools": {
+              "$ref": "#/definitions/ControlCredentialProfilesQueryResponse/anyOf/0/properties/accountPools"
+            },
             "harnesses": {
               "type": "array",
               "items": {
@@ -435,6 +514,20 @@
                                           },
                                           "default": [],
                                           "description": "Relocation levers that can move this transport into a scoped environment."
+                                        },
+                                        "platforms": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string",
+                                            "enum": [
+                                              "darwin",
+                                              "linux",
+                                              "win32"
+                                            ],
+                                            "description": "Host platform used to resolve credential and managed-login policy."
+                                          },
+                                          "minItems": 1,
+                                          "description": "Host platforms on which this physical credential transport applies; absent means every supported platform for backward compatibility."
                                         }
                                       },
                                       "required": [
@@ -446,6 +539,90 @@
                                     },
                                     "default": [],
                                     "description": "Declared credential transports per auth source."
+                                  },
+                                  "credential_profile_policies": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "object",
+                                      "properties": {
+                                        "source": {
+                                          "$ref": "#/definitions/ControlCredentialProfilesQueryResponse/anyOf/1/properties/harnesses/items/properties/manifest/anyOf/0/properties/capability_profile/properties/auth/properties/supported_sources/items"
+                                        },
+                                        "platforms": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/ControlCredentialProfilesQueryResponse/anyOf/1/properties/harnesses/items/properties/manifest/anyOf/0/properties/capability_profile/properties/auth/properties/credential_transports/items/properties/platforms/items"
+                                          },
+                                          "minItems": 1,
+                                          "description": "Nonempty host-platform set governed by this policy row."
+                                        },
+                                        "identity_scope": {
+                                          "type": "string",
+                                          "enum": [
+                                            "profile",
+                                            "os_user"
+                                          ],
+                                          "description": "Identity boundary selected by a credential profile: the named profile itself or the host OS user/login vault."
+                                        },
+                                        "max_enabled_profiles": {
+                                          "anyOf": [
+                                            {
+                                              "type": "integer",
+                                              "exclusiveMinimum": 0
+                                            },
+                                            {
+                                              "type": "null"
+                                            }
+                                          ],
+                                          "description": "Maximum enabled profile bindings on these platforms; null means unbounded."
+                                        },
+                                        "cleanup_owner": {
+                                          "type": "string",
+                                          "enum": [
+                                            "claudexor",
+                                            "vendor"
+                                          ],
+                                          "description": "Who owns cleanup of the credential when its Claudexor profile binding is removed."
+                                        }
+                                      },
+                                      "required": [
+                                        "source",
+                                        "platforms",
+                                        "identity_scope",
+                                        "max_enabled_profiles",
+                                        "cleanup_owner"
+                                      ],
+                                      "additionalProperties": false,
+                                      "description": "Platform-specific identity scope, enabled-profile cardinality, and credential cleanup ownership for one auth source."
+                                    },
+                                    "description": "Platform-specific profile identity/cardinality/cleanup policy; absent uses the backward-compatible profile-scoped, unbounded, Claudexor-owned defaults."
+                                  },
+                                  "managed_login": {
+                                    "anyOf": [
+                                      {
+                                        "type": "object",
+                                        "properties": {
+                                          "stdin": {
+                                            "type": "string",
+                                            "enum": [
+                                              "none",
+                                              "pipe",
+                                              "terminal"
+                                            ],
+                                            "description": "Input transport the vendor login command requires."
+                                          }
+                                        },
+                                        "required": [
+                                          "stdin"
+                                        ],
+                                        "additionalProperties": false,
+                                        "description": "Managed-login input requirement; command, argv, flow, and time window remain owned by the native-login registry."
+                                      },
+                                      {
+                                        "type": "null"
+                                      }
+                                    ],
+                                    "description": "Managed subscription-login input requirement; null means this harness defines no managed login, absent is a legacy manifest."
                                   }
                                 },
                                 "additionalProperties": false,
@@ -1055,6 +1232,32 @@
                     ],
                     "description": "Engine-owned Delegate capability for this harness and installed runtime; null on legacy status rows.",
                     "default": null
+                  },
+                  "setupLogin": {
+                    "anyOf": [
+                      {
+                        "type": "object",
+                        "properties": {
+                          "mode": {
+                            "type": "string",
+                            "enum": [
+                              "in_app",
+                              "external_terminal"
+                            ],
+                            "description": "in_app requests the daemon-hosted login flow; external_terminal requests the existing client PTY flow."
+                          }
+                        },
+                        "required": [
+                          "mode"
+                        ],
+                        "additionalProperties": false,
+                        "description": "Effective setup-login flow for this harness on the current host."
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "Effective setup-login flow for this harness on the current host; current producers emit null or an object, while omission identifies a legacy row."
                   }
                 },
                 "required": [
@@ -1244,7 +1447,8 @@
                           "claude_statusline",
                           "claude_api_retry",
                           "claude_oauth_usage",
-                          "agy_command_usage"
+                          "agy_command_usage",
+                          "cursor_rate_limit"
                         ],
                         "description": "Machine-readable source of quota evidence, classified by schema-owned traits."
                       },
@@ -1367,7 +1571,8 @@
                           "platform_unsupported",
                           "refresh_failed",
                           "no_source",
-                          "auth_revoked"
+                          "auth_revoked",
+                          "credential_profile_ambiguous"
                         ],
                         "description": "Why a registered subject has no quota snapshot, in the source's own vocabulary."
                       },

package/generated/ControlCredentialProfilesResponse.schema.json

@@ -34,7 +34,7 @@
                       "oauth_token",
                       "api_key"
                     ],
-                    "description": "Credential transport a profile isolates: a scoped vendor config-dir login, a stored OAuth token, or a stored API key."
+                    "description": "Binding kind for a profile: Claudexor-owned scoped vendor state, a managed OAuth secret, or a managed API-key secret; a vendor OS-user credential may remain outside that state."
                   },
                   "isolation_locator": {
                     "type": [
@@ -42,7 +42,7 @@
                       "null"
                     ],
                     "default": null,
-                    "description": "Canonical absolute config-dir path for config_dir_login profiles; null for secret-ref kinds."
+                    "description": "Canonical absolute path to Claudexor-owned scoped vendor state for config_dir_login bindings; null for secret-ref kinds."
                   },
                   "secret_ref": {
                     "type": [
@@ -79,7 +79,7 @@
                   "credential_kind"
                 ],
                 "additionalProperties": false,
-                "description": "Durable non-secret registry entry for one credential identity of one harness; secret material lives in the vendor dir or the secret store, never here."
+                "description": "Durable non-secret named binding for one harness; credential material may live in Claudexor-owned scoped state, a managed secret store, or a platform-declared vendor/OS-user store, never in this row."
               },
               "status": {
                 "type": "object",
@@ -115,7 +115,7 @@
                       "vendor"
                     ],
                     "default": "local_store",
-                    "description": "How the verification verdict was reached: local_store = the profile's credential material is present locally (says nothing about the token being live); vendor = the vendor answered a request made with this profile's own credential."
+                    "description": "How the verification verdict was reached: local_store = the binding's required local state or managed secret is present (says nothing about a token being live); vendor = the vendor answered under the exact binding environment and effective platform credential policy."
                   },
                   "detail": {
                     "type": "string",
@@ -282,7 +282,83 @@
             "description": "Per-harness accounts authority: native CLI-login state + the informational next-up identity."
           },
           "default": [],
-          "description": "Per-harness accounts authority (INV-135): the native CLI-login pseudo-row state and the server-computed Active identity, so no surface re-derives the accounts symmetry."
+          "description": "Per-harness accounts authority (INV-135): the native CLI-login pseudo-row state and the server-computed Active identity, so no surface re-derives the accounts symmetry. A unified-model engine emits [] here (the key must stay present for legacy strict clients) and carries routing facts in accountPools instead."
+        },
+        "accountPools": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "harness_id": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Harness family this pool verdict belongs to."
+              },
+              "next_up": {
+                "anyOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "kind": {
+                        "type": "string",
+                        "const": "profile"
+                      },
+                      "profileId": {
+                        "$ref": "#/definitions/ControlCredentialProfilesResponse/properties/profiles/items/properties/status/properties/profile_id"
+                      }
+                    },
+                    "required": [
+                      "kind",
+                      "profileId"
+                    ],
+                    "additionalProperties": false,
+                    "description": "An enabled account row is who an unpinned run routes to next."
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "kind": {
+                        "type": "string",
+                        "const": "api_key_route"
+                      }
+                    },
+                    "required": [
+                      "kind"
+                    ],
+                    "additionalProperties": false,
+                    "description": "The account pool is empty or exhausted; the unpinned route is the policy-governed API key (INV-061) — a route, never an account row."
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "kind": {
+                        "type": "string",
+                        "const": "none"
+                      },
+                      "reason": {
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "kind",
+                      "reason"
+                    ],
+                    "additionalProperties": false,
+                    "description": "An unpinned run has nothing routable, with a human reason."
+                  }
+                ],
+                "description": "Server-computed pool routing verdict for one harness's unpinned runs (unified account model)."
+              }
+            },
+            "required": [
+              "harness_id",
+              "next_up"
+            ],
+            "additionalProperties": false,
+            "description": "Per-harness pool authority (unified account model): who an unpinned run routes to next."
+          },
+          "default": [],
+          "description": "Additive per-harness pool authority of the unified account model: routing facts (next_up incl. the api_key_route kind) live here so legacy strict next_up decoders never see unknown kinds. Old clients ignore this key."
         }
       },
       "required": [