@claudexor/schema 3.5.0 → 3.8.0

package/generated/ControlCredentialProfilesSnapshotResponse.schema.json

@@ -34,7 +34,7 @@
                       "oauth_token",
                       "api_key"
                     ],
-                    "description": "Credential transport a profile isolates: a scoped vendor config-dir login, a stored OAuth token, or a stored API key."
+                    "description": "Binding kind for a profile: Claudexor-owned scoped vendor state, a managed OAuth secret, or a managed API-key secret; a vendor OS-user credential may remain outside that state."
                   },
                   "isolation_locator": {
                     "type": [
@@ -42,7 +42,7 @@
                       "null"
                     ],
                     "default": null,
-                    "description": "Canonical absolute config-dir path for config_dir_login profiles; null for secret-ref kinds."
+                    "description": "Canonical absolute path to Claudexor-owned scoped vendor state for config_dir_login bindings; null for secret-ref kinds."
                   },
                   "secret_ref": {
                     "type": [
@@ -79,7 +79,7 @@
                   "credential_kind"
                 ],
                 "additionalProperties": false,
-                "description": "Durable non-secret registry entry for one credential identity of one harness; secret material lives in the vendor dir or the secret store, never here."
+                "description": "Durable non-secret named binding for one harness; credential material may live in Claudexor-owned scoped state, a managed secret store, or a platform-declared vendor/OS-user store, never in this row."
               },
               "status": {
                 "type": "object",
@@ -115,7 +115,7 @@
                       "vendor"
                     ],
                     "default": "local_store",
-                    "description": "How the verification verdict was reached: local_store = the profile's credential material is present locally (says nothing about the token being live); vendor = the vendor answered a request made with this profile's own credential."
+                    "description": "How the verification verdict was reached: local_store = the binding's required local state or managed secret is present (says nothing about a token being live); vendor = the vendor answered under the exact binding environment and effective platform credential policy."
                   },
                   "detail": {
                     "type": "string",
@@ -282,7 +282,83 @@
             "description": "Per-harness accounts authority: native CLI-login state + the informational next-up identity."
           },
           "default": [],
-          "description": "Per-harness accounts authority (INV-135): the native CLI-login pseudo-row state and the server-computed Active identity, so no surface re-derives the accounts symmetry."
+          "description": "Per-harness accounts authority (INV-135): the native CLI-login pseudo-row state and the server-computed Active identity, so no surface re-derives the accounts symmetry. A unified-model engine emits [] here (the key must stay present for legacy strict clients) and carries routing facts in accountPools instead."
+        },
+        "accountPools": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "harness_id": {
+                "type": "string",
+                "minLength": 1,
+                "description": "Harness family this pool verdict belongs to."
+              },
+              "next_up": {
+                "anyOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "kind": {
+                        "type": "string",
+                        "const": "profile"
+                      },
+                      "profileId": {
+                        "$ref": "#/definitions/ControlCredentialProfilesSnapshotResponse/properties/profiles/items/properties/status/properties/profile_id"
+                      }
+                    },
+                    "required": [
+                      "kind",
+                      "profileId"
+                    ],
+                    "additionalProperties": false,
+                    "description": "An enabled account row is who an unpinned run routes to next."
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "kind": {
+                        "type": "string",
+                        "const": "api_key_route"
+                      }
+                    },
+                    "required": [
+                      "kind"
+                    ],
+                    "additionalProperties": false,
+                    "description": "The account pool is empty or exhausted; the unpinned route is the policy-governed API key (INV-061) — a route, never an account row."
+                  },
+                  {
+                    "type": "object",
+                    "properties": {
+                      "kind": {
+                        "type": "string",
+                        "const": "none"
+                      },
+                      "reason": {
+                        "type": "string"
+                      }
+                    },
+                    "required": [
+                      "kind",
+                      "reason"
+                    ],
+                    "additionalProperties": false,
+                    "description": "An unpinned run has nothing routable, with a human reason."
+                  }
+                ],
+                "description": "Server-computed pool routing verdict for one harness's unpinned runs (unified account model)."
+              }
+            },
+            "required": [
+              "harness_id",
+              "next_up"
+            ],
+            "additionalProperties": false,
+            "description": "Per-harness pool authority (unified account model): who an unpinned run routes to next."
+          },
+          "default": [],
+          "description": "Additive per-harness pool authority of the unified account model: routing facts (next_up incl. the api_key_route kind) live here so legacy strict next_up decoders never see unknown kinds. Old clients ignore this key."
         },
         "harnesses": {
           "type": "array",
@@ -417,6 +493,20 @@
                                       },
                                       "default": [],
                                       "description": "Relocation levers that can move this transport into a scoped environment."
+                                    },
+                                    "platforms": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string",
+                                        "enum": [
+                                          "darwin",
+                                          "linux",
+                                          "win32"
+                                        ],
+                                        "description": "Host platform used to resolve credential and managed-login policy."
+                                      },
+                                      "minItems": 1,
+                                      "description": "Host platforms on which this physical credential transport applies; absent means every supported platform for backward compatibility."
                                     }
                                   },
                                   "required": [
@@ -428,6 +518,90 @@
                                 },
                                 "default": [],
                                 "description": "Declared credential transports per auth source."
+                              },
+                              "credential_profile_policies": {
+                                "type": "array",
+                                "items": {
+                                  "type": "object",
+                                  "properties": {
+                                    "source": {
+                                      "$ref": "#/definitions/ControlCredentialProfilesSnapshotResponse/properties/harnesses/items/properties/manifest/anyOf/0/properties/capability_profile/properties/auth/properties/supported_sources/items"
+                                    },
+                                    "platforms": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/ControlCredentialProfilesSnapshotResponse/properties/harnesses/items/properties/manifest/anyOf/0/properties/capability_profile/properties/auth/properties/credential_transports/items/properties/platforms/items"
+                                      },
+                                      "minItems": 1,
+                                      "description": "Nonempty host-platform set governed by this policy row."
+                                    },
+                                    "identity_scope": {
+                                      "type": "string",
+                                      "enum": [
+                                        "profile",
+                                        "os_user"
+                                      ],
+                                      "description": "Identity boundary selected by a credential profile: the named profile itself or the host OS user/login vault."
+                                    },
+                                    "max_enabled_profiles": {
+                                      "anyOf": [
+                                        {
+                                          "type": "integer",
+                                          "exclusiveMinimum": 0
+                                        },
+                                        {
+                                          "type": "null"
+                                        }
+                                      ],
+                                      "description": "Maximum enabled profile bindings on these platforms; null means unbounded."
+                                    },
+                                    "cleanup_owner": {
+                                      "type": "string",
+                                      "enum": [
+                                        "claudexor",
+                                        "vendor"
+                                      ],
+                                      "description": "Who owns cleanup of the credential when its Claudexor profile binding is removed."
+                                    }
+                                  },
+                                  "required": [
+                                    "source",
+                                    "platforms",
+                                    "identity_scope",
+                                    "max_enabled_profiles",
+                                    "cleanup_owner"
+                                  ],
+                                  "additionalProperties": false,
+                                  "description": "Platform-specific identity scope, enabled-profile cardinality, and credential cleanup ownership for one auth source."
+                                },
+                                "description": "Platform-specific profile identity/cardinality/cleanup policy; absent uses the backward-compatible profile-scoped, unbounded, Claudexor-owned defaults."
+                              },
+                              "managed_login": {
+                                "anyOf": [
+                                  {
+                                    "type": "object",
+                                    "properties": {
+                                      "stdin": {
+                                        "type": "string",
+                                        "enum": [
+                                          "none",
+                                          "pipe",
+                                          "terminal"
+                                        ],
+                                        "description": "Input transport the vendor login command requires."
+                                      }
+                                    },
+                                    "required": [
+                                      "stdin"
+                                    ],
+                                    "additionalProperties": false,
+                                    "description": "Managed-login input requirement; command, argv, flow, and time window remain owned by the native-login registry."
+                                  },
+                                  {
+                                    "type": "null"
+                                  }
+                                ],
+                                "description": "Managed subscription-login input requirement; null means this harness defines no managed login, absent is a legacy manifest."
                               }
                             },
                             "additionalProperties": false,
@@ -1037,6 +1211,32 @@
                 ],
                 "description": "Engine-owned Delegate capability for this harness and installed runtime; null on legacy status rows.",
                 "default": null
+              },
+              "setupLogin": {
+                "anyOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "mode": {
+                        "type": "string",
+                        "enum": [
+                          "in_app",
+                          "external_terminal"
+                        ],
+                        "description": "in_app requests the daemon-hosted login flow; external_terminal requests the existing client PTY flow."
+                      }
+                    },
+                    "required": [
+                      "mode"
+                    ],
+                    "additionalProperties": false,
+                    "description": "Effective setup-login flow for this harness on the current host."
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "Effective setup-login flow for this harness on the current host; current producers emit null or an object, while omission identifies a legacy row."
               }
             },
             "required": [
@@ -1226,7 +1426,8 @@
                       "claude_statusline",
                       "claude_api_retry",
                       "claude_oauth_usage",
-                      "agy_command_usage"
+                      "agy_command_usage",
+                      "cursor_rate_limit"
                     ],
                     "description": "Machine-readable source of quota evidence, classified by schema-owned traits."
                   },
@@ -1349,7 +1550,8 @@
                       "platform_unsupported",
                       "refresh_failed",
                       "no_source",
-                      "auth_revoked"
+                      "auth_revoked",
+                      "credential_profile_ambiguous"
                     ],
                     "description": "Why a registered subject has no quota snapshot, in the source's own vocabulary."
                   },

package/generated/ControlHarnessAccountPool.schema.json

@@ -0,0 +1,79 @@
+{
+  "$ref": "#/definitions/ControlHarnessAccountPool",
+  "definitions": {
+    "ControlHarnessAccountPool": {
+      "type": "object",
+      "properties": {
+        "harness_id": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Harness family this pool verdict belongs to."
+        },
+        "next_up": {
+          "anyOf": [
+            {
+              "type": "object",
+              "properties": {
+                "kind": {
+                  "type": "string",
+                  "const": "profile"
+                },
+                "profileId": {
+                  "type": "string",
+                  "minLength": 1,
+                  "description": "Non-empty identifier string."
+                }
+              },
+              "required": [
+                "kind",
+                "profileId"
+              ],
+              "additionalProperties": false,
+              "description": "An enabled account row is who an unpinned run routes to next."
+            },
+            {
+              "type": "object",
+              "properties": {
+                "kind": {
+                  "type": "string",
+                  "const": "api_key_route"
+                }
+              },
+              "required": [
+                "kind"
+              ],
+              "additionalProperties": false,
+              "description": "The account pool is empty or exhausted; the unpinned route is the policy-governed API key (INV-061) — a route, never an account row."
+            },
+            {
+              "type": "object",
+              "properties": {
+                "kind": {
+                  "type": "string",
+                  "const": "none"
+                },
+                "reason": {
+                  "type": "string"
+                }
+              },
+              "required": [
+                "kind",
+                "reason"
+              ],
+              "additionalProperties": false,
+              "description": "An unpinned run has nothing routable, with a human reason."
+            }
+          ],
+          "description": "Server-computed pool routing verdict for one harness's unpinned runs (unified account model)."
+        }
+      },
+      "required": [
+        "harness_id",
+        "next_up"
+      ],
+      "additionalProperties": false,
+      "description": "Per-harness pool authority (unified account model): who an unpinned run routes to next."
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}

package/generated/ControlHarnessListResponse.schema.json

@@ -137,6 +137,20 @@
                                       },
                                       "default": [],
                                       "description": "Relocation levers that can move this transport into a scoped environment."
+                                    },
+                                    "platforms": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string",
+                                        "enum": [
+                                          "darwin",
+                                          "linux",
+                                          "win32"
+                                        ],
+                                        "description": "Host platform used to resolve credential and managed-login policy."
+                                      },
+                                      "minItems": 1,
+                                      "description": "Host platforms on which this physical credential transport applies; absent means every supported platform for backward compatibility."
                                     }
                                   },
                                   "required": [
@@ -148,6 +162,90 @@
                                 },
                                 "default": [],
                                 "description": "Declared credential transports per auth source."
+                              },
+                              "credential_profile_policies": {
+                                "type": "array",
+                                "items": {
+                                  "type": "object",
+                                  "properties": {
+                                    "source": {
+                                      "$ref": "#/definitions/ControlHarnessListResponse/properties/harnesses/items/properties/manifest/anyOf/0/properties/capability_profile/properties/auth/properties/supported_sources/items"
+                                    },
+                                    "platforms": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/ControlHarnessListResponse/properties/harnesses/items/properties/manifest/anyOf/0/properties/capability_profile/properties/auth/properties/credential_transports/items/properties/platforms/items"
+                                      },
+                                      "minItems": 1,
+                                      "description": "Nonempty host-platform set governed by this policy row."
+                                    },
+                                    "identity_scope": {
+                                      "type": "string",
+                                      "enum": [
+                                        "profile",
+                                        "os_user"
+                                      ],
+                                      "description": "Identity boundary selected by a credential profile: the named profile itself or the host OS user/login vault."
+                                    },
+                                    "max_enabled_profiles": {
+                                      "anyOf": [
+                                        {
+                                          "type": "integer",
+                                          "exclusiveMinimum": 0
+                                        },
+                                        {
+                                          "type": "null"
+                                        }
+                                      ],
+                                      "description": "Maximum enabled profile bindings on these platforms; null means unbounded."
+                                    },
+                                    "cleanup_owner": {
+                                      "type": "string",
+                                      "enum": [
+                                        "claudexor",
+                                        "vendor"
+                                      ],
+                                      "description": "Who owns cleanup of the credential when its Claudexor profile binding is removed."
+                                    }
+                                  },
+                                  "required": [
+                                    "source",
+                                    "platforms",
+                                    "identity_scope",
+                                    "max_enabled_profiles",
+                                    "cleanup_owner"
+                                  ],
+                                  "additionalProperties": false,
+                                  "description": "Platform-specific identity scope, enabled-profile cardinality, and credential cleanup ownership for one auth source."
+                                },
+                                "description": "Platform-specific profile identity/cardinality/cleanup policy; absent uses the backward-compatible profile-scoped, unbounded, Claudexor-owned defaults."
+                              },
+                              "managed_login": {
+                                "anyOf": [
+                                  {
+                                    "type": "object",
+                                    "properties": {
+                                      "stdin": {
+                                        "type": "string",
+                                        "enum": [
+                                          "none",
+                                          "pipe",
+                                          "terminal"
+                                        ],
+                                        "description": "Input transport the vendor login command requires."
+                                      }
+                                    },
+                                    "required": [
+                                      "stdin"
+                                    ],
+                                    "additionalProperties": false,
+                                    "description": "Managed-login input requirement; command, argv, flow, and time window remain owned by the native-login registry."
+                                  },
+                                  {
+                                    "type": "null"
+                                  }
+                                ],
+                                "description": "Managed subscription-login input requirement; null means this harness defines no managed login, absent is a legacy manifest."
                               }
                             },
                             "additionalProperties": false,
@@ -767,6 +865,32 @@
                 ],
                 "description": "Engine-owned Delegate capability for this harness and installed runtime; null on legacy status rows.",
                 "default": null
+              },
+              "setupLogin": {
+                "anyOf": [
+                  {
+                    "type": "object",
+                    "properties": {
+                      "mode": {
+                        "type": "string",
+                        "enum": [
+                          "in_app",
+                          "external_terminal"
+                        ],
+                        "description": "in_app requests the daemon-hosted login flow; external_terminal requests the existing client PTY flow."
+                      }
+                    },
+                    "required": [
+                      "mode"
+                    ],
+                    "additionalProperties": false,
+                    "description": "Effective setup-login flow for this harness on the current host."
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "Effective setup-login flow for this harness on the current host; current producers emit null or an object, while omission identifies a legacy row."
               }
             },
             "required": [

package/generated/ControlHarnessSettingsPatch.schema.json

@@ -112,11 +112,12 @@
         "profileLimitAction": {
           "type": "string",
           "enum": [
+            "auto",
             "fail",
             "ask",
             "rotate"
           ],
-          "description": "New profile-selection limit action (fail | ask | rotate)."
+          "description": "New profile-selection limit action (auto | fail | ask | rotate)."
         }
       },
       "additionalProperties": false,

package/generated/ControlPoolNextUp.schema.json

@@ -0,0 +1,63 @@
+{
+  "$ref": "#/definitions/ControlPoolNextUp",
+  "definitions": {
+    "ControlPoolNextUp": {
+      "anyOf": [
+        {
+          "type": "object",
+          "properties": {
+            "kind": {
+              "type": "string",
+              "const": "profile"
+            },
+            "profileId": {
+              "type": "string",
+              "minLength": 1,
+              "description": "Non-empty identifier string."
+            }
+          },
+          "required": [
+            "kind",
+            "profileId"
+          ],
+          "additionalProperties": false,
+          "description": "An enabled account row is who an unpinned run routes to next."
+        },
+        {
+          "type": "object",
+          "properties": {
+            "kind": {
+              "type": "string",
+              "const": "api_key_route"
+            }
+          },
+          "required": [
+            "kind"
+          ],
+          "additionalProperties": false,
+          "description": "The account pool is empty or exhausted; the unpinned route is the policy-governed API key (INV-061) — a route, never an account row."
+        },
+        {
+          "type": "object",
+          "properties": {
+            "kind": {
+              "type": "string",
+              "const": "none"
+            },
+            "reason": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "kind",
+            "reason"
+          ],
+          "additionalProperties": false,
+          "description": "An unpinned run has nothing routable, with a human reason."
+        }
+      ],
+      "description": "Server-computed pool routing verdict for one harness's unpinned runs (unified account model)."
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}

package/generated/ControlQuotaResponse.schema.json

@@ -141,7 +141,8 @@
                   "claude_statusline",
                   "claude_api_retry",
                   "claude_oauth_usage",
-                  "agy_command_usage"
+                  "agy_command_usage",
+                  "cursor_rate_limit"
                 ],
                 "description": "Machine-readable source of quota evidence, classified by schema-owned traits."
               },
@@ -264,7 +265,8 @@
                   "platform_unsupported",
                   "refresh_failed",
                   "no_source",
-                  "auth_revoked"
+                  "auth_revoked",
+                  "credential_profile_ambiguous"
                 ],
                 "description": "Why a registered subject has no quota snapshot, in the source's own vocabulary."
               },

package/generated/ControlRunDetail.schema.json

@@ -161,11 +161,12 @@
                             "cost_unverifiable",
                             "delegation_child_drain_timeout",
                             "subscription_window_exhausted",
+                            "credential_pool_exhausted",
                             "delegated_home_unavailable",
                             "delegated_confinement_unavailable",
                             "delegated_evidence_incomplete"
                           ],
-                          "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
+                          "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, an exhausted credential rotation pool whose EARLIEST known member reset is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
                         },
                         {
                           "type": "null"

package/generated/ControlRunListResponse.schema.json

@@ -163,11 +163,12 @@
                               "cost_unverifiable",
                               "delegation_child_drain_timeout",
                               "subscription_window_exhausted",
+                              "credential_pool_exhausted",
                               "delegated_home_unavailable",
                               "delegated_confinement_unavailable",
                               "delegated_evidence_incomplete"
                             ],
-                            "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
+                            "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, an exhausted credential rotation pool whose EARLIEST known member reset is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
                           },
                           {
                             "type": "null"

package/generated/ControlRunSummary.schema.json

@@ -158,11 +158,12 @@
                         "cost_unverifiable",
                         "delegation_child_drain_timeout",
                         "subscription_window_exhausted",
+                        "credential_pool_exhausted",
                         "delegated_home_unavailable",
                         "delegated_confinement_unavailable",
                         "delegated_evidence_incomplete"
                       ],
-                      "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
+                      "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, an exhausted credential rotation pool whose EARLIEST known member reset is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
                     },
                     {
                       "type": "null"