@claudexor/schema 3.5.0 → 3.8.0

package/generated/ControlSettingsSnapshot.schema.json

@@ -342,12 +342,13 @@
               "profileLimitAction": {
                 "type": "string",
                 "enum": [
+                  "auto",
                   "fail",
                   "ask",
                   "rotate"
                 ],
-                "default": "fail",
-                "description": "Profile-selection limit action: fail (stop), ask (record), rotate (auto-switch to the next eligible account)."
+                "default": "auto",
+                "description": "Profile-selection limit action: auto (kind-aware default — rotate for subscription subjects, fail for metered), fail (stop), ask (record), rotate (auto-switch to the next eligible account)."
               }
             },
             "additionalProperties": false,

package/generated/ControlSettingsUpdateRequest.schema.json

@@ -266,11 +266,12 @@
               "profileLimitAction": {
                 "type": "string",
                 "enum": [
+                  "auto",
                   "fail",
                   "ask",
                   "rotate"
                 ],
-                "description": "New profile-selection limit action (fail | ask | rotate)."
+                "description": "New profile-selection limit action (auto | fail | ask | rotate)."
               }
             },
             "additionalProperties": false,

package/generated/ControlSetupJob.schema.json

@@ -811,7 +811,11 @@
               "enum": [
                 "permit_timeout",
                 "spawn_failed",
-                "device_auth_unsupported"
+                "device_auth_unsupported",
+                "terminal_transport_unavailable",
+                "terminal_transport_unsupported",
+                "terminal_transport_probe_failed",
+                "terminal_transport_failed"
               ]
             },
             "finishedAt": {

package/generated/ControlSetupJobCreateRequest.schema.json

@@ -26,7 +26,7 @@
         "profileId": {
           "type": "string",
           "minLength": 1,
-          "description": "Registered config_dir_login profile to log in; absent = the default session."
+          "description": "Registered config_dir_login binding to log in under its exact scoped environment; absent = the default session."
         },
         "loginFlow": {
           "type": "string",

package/generated/ControlSetupJobEvent.schema.json

@@ -866,7 +866,11 @@
                       "enum": [
                         "permit_timeout",
                         "spawn_failed",
-                        "device_auth_unsupported"
+                        "device_auth_unsupported",
+                        "terminal_transport_unavailable",
+                        "terminal_transport_unsupported",
+                        "terminal_transport_probe_failed",
+                        "terminal_transport_failed"
                       ]
                     },
                     "finishedAt": {

package/generated/ControlSetupJobListResponse.schema.json

@@ -816,7 +816,11 @@
                     "enum": [
                       "permit_timeout",
                       "spawn_failed",
-                      "device_auth_unsupported"
+                      "device_auth_unsupported",
+                      "terminal_transport_unavailable",
+                      "terminal_transport_unsupported",
+                      "terminal_transport_probe_failed",
+                      "terminal_transport_failed"
                     ]
                   },
                   "finishedAt": {

package/generated/ControlSetupJobSnapshot.schema.json

@@ -816,7 +816,11 @@
                       "enum": [
                         "permit_timeout",
                         "spawn_failed",
-                        "device_auth_unsupported"
+                        "device_auth_unsupported",
+                        "terminal_transport_unavailable",
+                        "terminal_transport_unsupported",
+                        "terminal_transport_probe_failed",
+                        "terminal_transport_failed"
                       ]
                     },
                     "finishedAt": {

package/generated/CredentialProfile.schema.json

@@ -26,7 +26,7 @@
             "oauth_token",
             "api_key"
           ],
-          "description": "Credential transport a profile isolates: a scoped vendor config-dir login, a stored OAuth token, or a stored API key."
+          "description": "Binding kind for a profile: Claudexor-owned scoped vendor state, a managed OAuth secret, or a managed API-key secret; a vendor OS-user credential may remain outside that state."
         },
         "isolation_locator": {
           "type": [
@@ -34,7 +34,7 @@
             "null"
           ],
           "default": null,
-          "description": "Canonical absolute config-dir path for config_dir_login profiles; null for secret-ref kinds."
+          "description": "Canonical absolute path to Claudexor-owned scoped vendor state for config_dir_login bindings; null for secret-ref kinds."
         },
         "secret_ref": {
           "type": [
@@ -71,7 +71,7 @@
         "credential_kind"
       ],
       "additionalProperties": false,
-      "description": "Durable non-secret registry entry for one credential identity of one harness; secret material lives in the vendor dir or the secret store, never here."
+      "description": "Durable non-secret named binding for one harness; credential material may live in Claudexor-owned scoped state, a managed secret store, or a platform-declared vendor/OS-user store, never in this row."
     }
   },
   "$schema": "http://json-schema.org/draft-07/schema#"

package/generated/CredentialProfileStatus.schema.json

@@ -35,7 +35,7 @@
             "vendor"
           ],
           "default": "local_store",
-          "description": "How the verification verdict was reached: local_store = the profile's credential material is present locally (says nothing about the token being live); vendor = the vendor answered a request made with this profile's own credential."
+          "description": "How the verification verdict was reached: local_store = the binding's required local state or managed secret is present (says nothing about a token being live); vendor = the vendor answered under the exact binding environment and effective platform credential policy."
         },
         "detail": {
           "type": "string",

package/generated/GlobalConfig.schema.json

@@ -296,7 +296,7 @@
                   "oauth_token",
                   "api_key"
                 ],
-                "description": "Credential transport a profile isolates: a scoped vendor config-dir login, a stored OAuth token, or a stored API key."
+                "description": "Binding kind for a profile: Claudexor-owned scoped vendor state, a managed OAuth secret, or a managed API-key secret; a vendor OS-user credential may remain outside that state."
               },
               "isolation_locator": {
                 "type": [
@@ -304,7 +304,7 @@
                   "null"
                 ],
                 "default": null,
-                "description": "Canonical absolute config-dir path for config_dir_login profiles; null for secret-ref kinds."
+                "description": "Canonical absolute path to Claudexor-owned scoped vendor state for config_dir_login bindings; null for secret-ref kinds."
               },
               "secret_ref": {
                 "type": [
@@ -341,10 +341,10 @@
               "credential_kind"
             ],
             "additionalProperties": false,
-            "description": "Durable non-secret registry entry for one credential identity of one harness; secret material lives in the vendor dir or the secret store, never here."
+            "description": "Durable non-secret named binding for one harness; credential material may live in Claudexor-owned scoped state, a managed secret store, or a platform-declared vendor/OS-user store, never in this row."
           },
           "default": [],
-          "description": "Durable non-secret credential-profile registry; secret material lives in the vendor dir or the secret store, never in config."
+          "description": "Durable non-secret named-binding registry; credential material may live in Claudexor-owned scoped state, a managed secret store, or a platform-declared vendor/OS-user store, never in config."
         },
         "harnesses": {
           "type": "object",
@@ -413,12 +413,13 @@
                   "limit_action": {
                     "type": "string",
                     "enum": [
+                      "auto",
                       "fail",
                       "ask",
                       "rotate"
                     ],
-                    "default": "fail",
-                    "description": "On a typed vendor limit: fail the attempt, surface a typed ask, or rotate to the next eligible profile."
+                    "default": "auto",
+                    "description": "On a typed vendor limit: auto (kind-aware default — rotate for subscription subjects, fail for metered), fail the attempt, surface a typed ask, or rotate to the next eligible profile."
                   },
                   "rotation_eligible": {
                     "type": "array",

package/generated/HarnessEvent.schema.json

@@ -348,7 +348,8 @@
                 "claude_statusline",
                 "claude_api_retry",
                 "claude_oauth_usage",
-                "agy_command_usage"
+                "agy_command_usage",
+                "cursor_rate_limit"
               ],
               "description": "Machine-readable source of quota evidence, classified by schema-owned traits."
             },

package/generated/HarnessManifest.schema.json

@@ -114,6 +114,20 @@
                         },
                         "default": [],
                         "description": "Relocation levers that can move this transport into a scoped environment."
+                      },
+                      "platforms": {
+                        "type": "array",
+                        "items": {
+                          "type": "string",
+                          "enum": [
+                            "darwin",
+                            "linux",
+                            "win32"
+                          ],
+                          "description": "Host platform used to resolve credential and managed-login policy."
+                        },
+                        "minItems": 1,
+                        "description": "Host platforms on which this physical credential transport applies; absent means every supported platform for backward compatibility."
                       }
                     },
                     "required": [
@@ -125,6 +139,90 @@
                   },
                   "default": [],
                   "description": "Declared credential transports per auth source."
+                },
+                "credential_profile_policies": {
+                  "type": "array",
+                  "items": {
+                    "type": "object",
+                    "properties": {
+                      "source": {
+                        "$ref": "#/definitions/HarnessManifest/properties/capability_profile/properties/auth/properties/supported_sources/items"
+                      },
+                      "platforms": {
+                        "type": "array",
+                        "items": {
+                          "$ref": "#/definitions/HarnessManifest/properties/capability_profile/properties/auth/properties/credential_transports/items/properties/platforms/items"
+                        },
+                        "minItems": 1,
+                        "description": "Nonempty host-platform set governed by this policy row."
+                      },
+                      "identity_scope": {
+                        "type": "string",
+                        "enum": [
+                          "profile",
+                          "os_user"
+                        ],
+                        "description": "Identity boundary selected by a credential profile: the named profile itself or the host OS user/login vault."
+                      },
+                      "max_enabled_profiles": {
+                        "anyOf": [
+                          {
+                            "type": "integer",
+                            "exclusiveMinimum": 0
+                          },
+                          {
+                            "type": "null"
+                          }
+                        ],
+                        "description": "Maximum enabled profile bindings on these platforms; null means unbounded."
+                      },
+                      "cleanup_owner": {
+                        "type": "string",
+                        "enum": [
+                          "claudexor",
+                          "vendor"
+                        ],
+                        "description": "Who owns cleanup of the credential when its Claudexor profile binding is removed."
+                      }
+                    },
+                    "required": [
+                      "source",
+                      "platforms",
+                      "identity_scope",
+                      "max_enabled_profiles",
+                      "cleanup_owner"
+                    ],
+                    "additionalProperties": false,
+                    "description": "Platform-specific identity scope, enabled-profile cardinality, and credential cleanup ownership for one auth source."
+                  },
+                  "description": "Platform-specific profile identity/cardinality/cleanup policy; absent uses the backward-compatible profile-scoped, unbounded, Claudexor-owned defaults."
+                },
+                "managed_login": {
+                  "anyOf": [
+                    {
+                      "type": "object",
+                      "properties": {
+                        "stdin": {
+                          "type": "string",
+                          "enum": [
+                            "none",
+                            "pipe",
+                            "terminal"
+                          ],
+                          "description": "Input transport the vendor login command requires."
+                        }
+                      },
+                      "required": [
+                        "stdin"
+                      ],
+                      "additionalProperties": false,
+                      "description": "Managed-login input requirement; command, argv, flow, and time window remain owned by the native-login registry."
+                    },
+                    {
+                      "type": "null"
+                    }
+                  ],
+                  "description": "Managed subscription-login input requirement; null means this harness defines no managed login, absent is a legacy manifest."
                 }
               },
               "additionalProperties": false,

package/generated/HarnessStatusDto.schema.json

@@ -132,6 +132,20 @@
                                 },
                                 "default": [],
                                 "description": "Relocation levers that can move this transport into a scoped environment."
+                              },
+                              "platforms": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string",
+                                  "enum": [
+                                    "darwin",
+                                    "linux",
+                                    "win32"
+                                  ],
+                                  "description": "Host platform used to resolve credential and managed-login policy."
+                                },
+                                "minItems": 1,
+                                "description": "Host platforms on which this physical credential transport applies; absent means every supported platform for backward compatibility."
                               }
                             },
                             "required": [
@@ -143,6 +157,90 @@
                           },
                           "default": [],
                           "description": "Declared credential transports per auth source."
+                        },
+                        "credential_profile_policies": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "source": {
+                                "$ref": "#/definitions/HarnessStatusDto/properties/manifest/anyOf/0/properties/capability_profile/properties/auth/properties/supported_sources/items"
+                              },
+                              "platforms": {
+                                "type": "array",
+                                "items": {
+                                  "$ref": "#/definitions/HarnessStatusDto/properties/manifest/anyOf/0/properties/capability_profile/properties/auth/properties/credential_transports/items/properties/platforms/items"
+                                },
+                                "minItems": 1,
+                                "description": "Nonempty host-platform set governed by this policy row."
+                              },
+                              "identity_scope": {
+                                "type": "string",
+                                "enum": [
+                                  "profile",
+                                  "os_user"
+                                ],
+                                "description": "Identity boundary selected by a credential profile: the named profile itself or the host OS user/login vault."
+                              },
+                              "max_enabled_profiles": {
+                                "anyOf": [
+                                  {
+                                    "type": "integer",
+                                    "exclusiveMinimum": 0
+                                  },
+                                  {
+                                    "type": "null"
+                                  }
+                                ],
+                                "description": "Maximum enabled profile bindings on these platforms; null means unbounded."
+                              },
+                              "cleanup_owner": {
+                                "type": "string",
+                                "enum": [
+                                  "claudexor",
+                                  "vendor"
+                                ],
+                                "description": "Who owns cleanup of the credential when its Claudexor profile binding is removed."
+                              }
+                            },
+                            "required": [
+                              "source",
+                              "platforms",
+                              "identity_scope",
+                              "max_enabled_profiles",
+                              "cleanup_owner"
+                            ],
+                            "additionalProperties": false,
+                            "description": "Platform-specific identity scope, enabled-profile cardinality, and credential cleanup ownership for one auth source."
+                          },
+                          "description": "Platform-specific profile identity/cardinality/cleanup policy; absent uses the backward-compatible profile-scoped, unbounded, Claudexor-owned defaults."
+                        },
+                        "managed_login": {
+                          "anyOf": [
+                            {
+                              "type": "object",
+                              "properties": {
+                                "stdin": {
+                                  "type": "string",
+                                  "enum": [
+                                    "none",
+                                    "pipe",
+                                    "terminal"
+                                  ],
+                                  "description": "Input transport the vendor login command requires."
+                                }
+                              },
+                              "required": [
+                                "stdin"
+                              ],
+                              "additionalProperties": false,
+                              "description": "Managed-login input requirement; command, argv, flow, and time window remain owned by the native-login registry."
+                            },
+                            {
+                              "type": "null"
+                            }
+                          ],
+                          "description": "Managed subscription-login input requirement; null means this harness defines no managed login, absent is a legacy manifest."
                         }
                       },
                       "additionalProperties": false,
@@ -762,6 +860,32 @@
           ],
           "description": "Engine-owned Delegate capability for this harness and installed runtime; null on legacy status rows.",
           "default": null
+        },
+        "setupLogin": {
+          "anyOf": [
+            {
+              "type": "object",
+              "properties": {
+                "mode": {
+                  "type": "string",
+                  "enum": [
+                    "in_app",
+                    "external_terminal"
+                  ],
+                  "description": "in_app requests the daemon-hosted login flow; external_terminal requests the existing client PTY flow."
+                }
+              },
+              "required": [
+                "mode"
+              ],
+              "additionalProperties": false,
+              "description": "Effective setup-login flow for this harness on the current host."
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Effective setup-login flow for this harness on the current host; current producers emit null or an object, while omission identifies a legacy row."
         }
       },
       "required": [

package/generated/McpRunHandleResult.schema.json

@@ -678,11 +678,12 @@
                         "cost_unverifiable",
                         "delegation_child_drain_timeout",
                         "subscription_window_exhausted",
+                        "credential_pool_exhausted",
                         "delegated_home_unavailable",
                         "delegated_confinement_unavailable",
                         "delegated_evidence_incomplete"
                       ],
-                      "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
+                      "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, an exhausted credential rotation pool whose EARLIEST known member reset is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
                     },
                     {
                       "type": "null"

package/generated/McpRunToolResult.schema.json

@@ -654,11 +654,12 @@
                         "cost_unverifiable",
                         "delegation_child_drain_timeout",
                         "subscription_window_exhausted",
+                        "credential_pool_exhausted",
                         "delegated_home_unavailable",
                         "delegated_confinement_unavailable",
                         "delegated_evidence_incomplete"
                       ],
-                      "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
+                      "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, an exhausted credential rotation pool whose EARLIEST known member reset is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
                     },
                     {
                       "type": "null"

package/generated/RunEvent.schema.json

@@ -51,6 +51,10 @@
             "route.profile.headroom_exceeded",
             "route.profile.rotated",
             "route.profile.rotation_exhausted",
+            "route.profile.credential_unusable",
+            "route.account.pool_selected",
+            "route.account.lane_switch",
+            "route.account.pool_exhausted",
             "route.transient.exhausted",
             "route.fallback.auth_switched",
             "route.primary.diverged",

package/generated/RunFailure.schema.json

@@ -40,11 +40,12 @@
                 "cost_unverifiable",
                 "delegation_child_drain_timeout",
                 "subscription_window_exhausted",
+                "credential_pool_exhausted",
                 "delegated_home_unavailable",
                 "delegated_confinement_unavailable",
                 "delegated_evidence_incomplete"
               ],
-              "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
+              "description": "Machine-readable failure sub-code within a RunFailure category (budget-denial reasons, Delegate child-drain timeout, a spent subscription quota window whose reopen time is RunFailure.resetsAt, an exhausted credential rotation pool whose EARLIEST known member reset is RunFailure.resetsAt, and the delegated-run confinement refusals: missing scoped home, no OS-enforced boundary on this host, incomplete applied evidence)."
             },
             {
               "type": "null"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claudexor/schema",
-  "version": "3.5.0",
+  "version": "3.8.0",
   "license": "MIT",
   "description": "Single source of truth for all Claudexor data shapes (Zod + generated JSON Schema).",
   "type": "module",
@@ -20,7 +20,7 @@
   "dependencies": {
     "zod": "^4.4.3",
     "zod-to-json-schema": "^3.24.1",
-    "@claudexor/util": "3.5.0"
+    "@claudexor/util": "3.8.0"
   },
   "repository": {
     "type": "git",