@intutic/shared-types 1.9.0 → 1.10.1

package/dist/enums.js

@@ -13,7 +13,7 @@
  * @module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DriftDetectionMode = exports.DriftClassification = exports.BypassEnforcementTier = exports.McpProxyMode = exports.McpProxyFailBehavior = exports.WorkspaceRole = exports.RoutingTier = exports.HookPhase = exports.SopType = exports.SopLifecycleState = exports.PlanLifecycleState = exports.IncidentStatus = exports.ExecutionMode = exports.HarnessType = exports.AnomalyType = exports.ChangeClassification = exports.ComplexityTier = exports.BudgetTier = exports.TokenUtility = exports.EnforcementAction = exports.RiskLevel = void 0;
+exports.AmendmentSource = exports.DriftDetectionMode = exports.DriftClassification = exports.BypassEnforcementTier = exports.McpProxyMode = exports.McpProxyFailBehavior = exports.WorkspaceRole = exports.RoutingTier = exports.HookPhase = exports.SopType = exports.SopLifecycleState = exports.PlanExecutionOutcome = exports.PlanLifecycleState = exports.IncidentStatus = exports.ExecutionMode = exports.HARNESS_HEADLINE_COUNT = exports.HARNESS_COUNT = exports.HarnessType = exports.AnomalyType = exports.ChangeClassification = exports.ComplexityTier = exports.BudgetTier = exports.TokenUtility = exports.EnforcementAction = exports.RiskLevel = void 0;
 // ─── Risk Level ──────────────────────────────────────────────────────
 // HLD §3.5, LLD §3.1 — risk_level enum
 /** Risk severity classification for SOPs, anomalies, and incidents. */
@@ -25,12 +25,44 @@ exports.RiskLevel = {
 };
 // ─── Enforcement Action ──────────────────────────────────────────────
 // HLD §3.3, LLD §3.1 — enforcement_action_type enum
-/** PCAS enforcement action applied to a tool call. */
+/**
+ * PCAS enforcement action applied to a tool call.
+ *
+ * BYPASS..KILL are listed in increasing severity. `REASK` sits between
+ * `HIJACK` and `KILL`: the attempt is refused and the reason handed back to
+ * the agent, which may retry a bounded number of times before the finding
+ * escalates to a block.
+ *
+ * It exists because the proxy's promotion rule
+ * (`packages/proxy/src/plugins/anomaly/mod.rs`) forbids a heuristic from
+ * killing until its false-positive rate has been measured, and five detectors
+ * were doing exactly that. Demoting them to `HIJACK` would have honoured the
+ * rule and lost the enforcement; `REASK` keeps both.
+ *
+ * Mirrors `enforcement_action_type` — see migration 114.
+ *
+ * `OBSERVED` (migration 156) is deliberately OUTSIDE that severity ladder —
+ * it does not mean "PCAS acted with this severity", it means "PCAS took no
+ * action because the request never produced a response to act on". It is
+ * `mapVerdict`'s (`services/control-plane/src/lib/valkeySubscriber.ts`)
+ * target for the proxy's `"upstream_error"` verdict — a provider 5xx or an
+ * unservable-model rejection. Before this value existed, `mapVerdict`'s
+ * fail-closed default mapped every unrecognised verdict to `KILL`, so every
+ * upstream_error trace was recorded as an enforcement block that never
+ * happened: an honest failure record read as PCAS having stopped the
+ * request. `BYPASS` was considered and rejected for the same reason in the
+ * other direction — it means the call went through and completed, which an
+ * upstream_error trace never did. Nothing existing fit, so this is the
+ * smallest addition that lets "PCAS did not enforce anything here, the
+ * provider itself failed" be recorded truthfully.
+ */
 exports.EnforcementAction = {
     BYPASS: 'BYPASS',
     ENHANCE: 'ENHANCE',
     HIJACK: 'HIJACK',
+    REASK: 'REASK',
     KILL: 'KILL',
+    OBSERVED: 'OBSERVED',
 };
 // ─── Token Utility ───────────────────────────────────────────────────
 // HLD §3.6, LLD §3.1 — token_utility_type enum
@@ -81,7 +113,13 @@ var anomaly_taxonomy_1 = require("@intutic/anomaly-taxonomy");
 Object.defineProperty(exports, "AnomalyType", { enumerable: true, get: function () { return anomaly_taxonomy_1.AnomalyType; } });
 // ─── Harness Type ────────────────────────────────────────────────────
 // HLD §3.14, §4.5 — Supported AI agent harness integrations
-// Full matrix: HLD §3.14 Harness Onboarding Matrix (8 harnesses)
+// Full matrix: HLD §3.14 Harness Onboarding Matrix (31 harnesses — 21
+// hook/config-gated (19 base + Muse Code + Grok Build) + LangGraph +
+// Wave 1's 8 SDK-gated Python frameworks + Xirp + Agentic Orchestrator —
+// the two harnesses with no gate/config format of their own because they
+// WRAP other already-gated harnesses rather than running tools themselves;
+// see gateKind.ts's 'delegated' kind and gateRegistry.ts's NO_GATE rows for
+// 'xirp' and 'agentic-orchestrator')
 /** Supported AI agent harness/IDE integrations. */
 exports.HarnessType = {
     CURSOR: 'cursor',
@@ -102,7 +140,303 @@ exports.HarnessType = {
     GOOSE: 'goose',
     OPEN_WEBUI: 'open-webui',
     GITHUB_COPILOT: 'github-copilot',
+    LANGGRAPH: 'langgraph',
+    /** Meta "Muse Code" — binary `muse`, model Muse Spark. Beta since 2026-08-05. */
+    MUSE_CODE: 'muse-code',
+    /** xAI Grok Build (binary `grok`, GA 2026-05, open-sourced 2026-07-15). */
+    GROK: 'grok',
+    /** OpenCode (the open-source terminal coding agent: npm `opencode-ai` 1.x,
+     *  `@opencode/cli` 2.x). Gated by a generated plugin OpenCode loads into
+     *  its own process — `.opencode/plugins/intutic-governance.js`, hook
+     *  `tool.execute.before` (1.x) / `tool execute.before` (2.x), which throws
+     *  to refuse — see `services/sync-daemon/src/harness/openCodeHooks.ts`. */
+    OPENCODE: 'opencode',
+    /** DeepSeek's "dsh" (binary `dsh`, `@deepseek-ai/dsh`). Developer preview
+     *  since 2026-08-13; gated via a Cordis plugin (`@intutic/gate/dsh`), not a
+     *  generated hook file — see gateRegistry.ts's `dsh` row. */
+    DEEPSEEK_HARNESS: 'dsh',
+    /**
+     * Spotify "Xirp" — macOS-only desktop orchestrator, beta since 2026-08-11.
+     * NOT itself an AI agent: it spawns already-installed CLI harnesses
+     * (Claude Code, Codex, Gemini CLI) each inside its own tmux session and
+     * `git worktree`, preserving each wrapped harness's native, unmodified
+     * config (per Xirp's own FAQ). Detected for reporting/reconciliation
+     * purposes only — see `tools/cli/src/harness/xirp.ts` and
+     * `gateRegistry.ts`'s NO_GATE row for why it writes no config of its own.
+     */
+    XIRP: 'xirp',
+    /**
+     * DoorDash's "Agentic Orchestrator" (binary `agentico`, Go, Apache-2.0,
+     * `doordash-oss/agentic-orchestrator` — CONFIRMED real/public: live-verified
+     * by running the actual released binary, not just reading its README).
+     * Desktop app + CLI, cross-platform (macOS AND Linux — unlike Xirp's
+     * macOS-only beta). NOT itself an AI agent: it wraps already-installed CLI
+     * backends — Claude Code, Codex, and OpenCode (CONFIRMED via `agentico
+     * server --help`'s `--providers` flag) — each running a feature in its own
+     * `git worktree` under `~/.agentic-orchestrator/worktrees/` (CONFIRMED via
+     * the project's own README). Detected for reporting/reconciliation
+     * purposes only — see `tools/cli/src/harness/agenticOrchestrator.ts` and
+     * `gateRegistry.ts`'s NO_GATE row for why it writes no config of its own
+     * (`GateKind: 'delegated'`, same as Xirp).
+     *
+     * All three wrapped backends are themselves supported harnesses: Claude
+     * Code and Codex through their hook files, and OpenCode (since TD-397
+     * closed, 2026-09-23) through the plugin `openCodeHooks.ts` generates —
+     * the worktree propagation re-runs every backend's writer per worktree,
+     * so a feature run against any `--providers` value is governed.
+     */
+    AGENTIC_ORCHESTRATOR: 'agentic-orchestrator',
+    // ─── Wave 1: Python-SDK-gated frameworks (no on-disk hook/config file) ───
+    // Same family as LANGGRAPH: the blocking gate ships in intutic-clawde
+    // (intutic_clawde.gate, python-raise contract), evaluated in-process before
+    // the tool body runs. This adapter writes .env.intutic (proxy base-URL vars
+    // only) — see gateRegistry.ts NO_GATE rows and harness/gateKind.ts.
+    /** LangChain — covers BOTH the Python (`langchain`/`langchain-core`) and
+     *  JS/TS (`langchain` npm package) ecosystems for detection purposes, since
+     *  the framework itself ships in both. This env-adapter (`langchain.ts`) is
+     *  Python-only, matching intutic-clawde's `langchain.py` gate adapter; a
+     *  JS/TS tool-call gate for LangChain.js is a `@intutic/gate` TypeScript
+     *  package concern for a different phase, not this one. */
+    LANGCHAIN: 'langchain',
+    CREWAI: 'crewai',
+    /** Detected via any of autogen-agentchat / autogen-core / autogen-ext. */
+    AUTOGEN: 'autogen',
+    AG2: 'ag2',
+    GOOGLE_ADK: 'google-adk',
+    /** OpenAI Agents SDK — covers BOTH the Python (`openai-agents` on PyPI)
+     *  and JS/TS (`@openai/agents` on npm) ecosystems, same dual-ecosystem
+     *  pattern as LANGCHAIN above — but unlike LangChain, BOTH sides have a
+     *  shipped gate: Python via `intutic_clawde.gate.adapters.openai_agents`
+     *  (`intutic_tool_guardrail`), TypeScript via `@intutic/gate/openai`
+     *  (packages/gate-js — tool input guardrails, `wrapAgent()` for
+     *  mcpServers-derived tools, and the tracing-exporter DLP kill-switch).
+     *  Detection (`tools/cli/src/harness/openaiAgents.ts`) matches Python
+     *  manifests AND package.json `@openai/agents*` deps. */
+    OPENAI_AGENTS: 'openai-agents',
+    /** Detected via pydantic-ai / pydantic-ai-slim. */
+    PYDANTIC_AI: 'pydantic-ai',
+    SMOLAGENTS: 'smolagents',
+    /** AWS Strands Agents (`strands-agents` on PyPI — the default framework in
+     *  Bedrock AgentCore's own quickstarts). Detected via `strands-agents` in
+     *  Python dependency manifests. Gate: `intutic_clawde.gate.adapters.strands`'s
+     *  `IntuticHookProvider`, built on Strands' documented
+     *  `BeforeToolCallEvent.cancel_tool` veto (verified against a real
+     *  strands-agents==1.52.0 install). NOTE: the framework's DEFAULT model
+     *  provider (Bedrock, SigV4-signed via boto3) is NOT routable through the
+     *  Intutic proxy — see apps/docs/integrations/strands.md. */
+    STRANDS: 'strands',
+    // ─── T2: JS/TS SDK-gated frameworks (no on-disk hook/config file) ───────
+    // Same family as LANGCHAIN/LANGGRAPH above, but JS/TS-native: the blocking
+    // gate ships in @intutic/gate (packages/gate-js), a subpath adapter per
+    // framework, evaluated in-process before the tool body runs. This
+    // env-adapter writes .env.intutic (proxy base-URL vars only — see
+    // gateRegistry.ts NO_GATE rows) — see also configWriter.ts's HARNESS_FILES.
+    /** Detected via `@mastra/core`/`mastra` in `package.json`. Gate:
+     *  `@intutic/gate/mastra`'s `intuticHooks()` — see that module's doc for
+     *  the per-call-hooks-override bypass this framework's own design imposes. */
+    MASTRA: 'mastra',
+    /** Detected via `ai` (v6+) plus any `@ai-sdk/*` package in `package.json`.
+     *  Gate: `@intutic/gate/vercel`'s `intuticToolApproval()`. Unlike most
+     *  harnesses here, this framework has NO env-var LLM-egress routing — see
+     *  `@intutic/gate/vercel`'s `withIntuticProxy()` and its module doc. */
+    VERCEL_AI_SDK: 'vercel-ai-sdk',
+    /** Vercel's "eve" (npm `eve`, github.com/vercel/eve) — filesystem-first
+     *  durable backend AI agents; an agent is an `agent/` directory eve builds
+     *  by walking the tree. Pre-1.0 PREVIEW (0.39.x). Detected via `eve` in
+     *  `package.json` PLUS the characteristic `agent/` directory (a compound
+     *  check — either alone is too generic; see tools/cli/src/harness/eve.ts).
+     *  Gate: `@intutic/gate/eve`'s `intuticApproval()` on eve's per-tool /
+     *  per-connection `approval` policy surface — see gateRegistry.ts's `eve`
+     *  row and TD-410 for the preview-churn shield. */
+    EVE: 'eve',
+    /**
+     * TrueFoundry's "TrueForge" (github.com/truefoundry/trueforge, MIT,
+     * TS/Node) — an open-source agent-runtime library. Same JS/TS SDK-gated
+     * family as MASTRA/VERCEL_AI_SDK/EVE above, but TrueForge ships in two
+     * structurally different deployment modes with different detection and
+     * different governance surfaces, so it gets two `HarnessType` rows rather
+     * than one (see TRUEFORGE_SERVER's own doc below for why one enum value
+     * can't answer `gateKindForHarness` two ways). THIS row
+     * covers only the EMBEDDED mode: another team's Node process importing
+     * `@truefoundry/trueforge-core` directly and driving its
+     * `SessionHandle`/`TurnHandle` API in-process. Detected via
+     * `@truefoundry/trueforge-core` in `package.json`. Gate:
+     * `@intutic/gate/trueforge`'s `intuticApprovalResponder()` — confirmed
+     * against the real published package (`@truefoundry/trueforge-core@0.1.4`)
+     * that there is NO synchronous in-process approval callback anywhere in
+     * it; the only approval mechanism, embedded or not, is the same
+     * `tool.approval_required` / `user.tool_approval` turn-and-event contract
+     * TrueForge's standalone server exposes over HTTP, so this adapter is
+     * shaped like the AI_SDK_HARNESS/AI_SDK_WORKFLOW "approval responder"
+     * family rather than MASTRA/VERCEL_AI_SDK's single-callback shape — see
+     * that module's doc for the full record.
+     *
+     * TrueForge run as its OWN standalone/hosted server (`npx
+     * @truefoundry/trueforge`, Docker Compose, or the Helm chart) is
+     * deliberately NOT covered by this row — nobody embeds an Intutic gate
+     * into a third-party OSS server process, so that deployment mode needs
+     * governance running in an external Intutic-operated bridge service. See
+     * TRUEFORGE_SERVER below.
+     */
+    TRUEFORGE: 'trueforge',
+    // ─── A3: Vercel platform-agent runtimes (JS/TS SDK-gated, gate-js) ──────
+    // Same family as MASTRA/VERCEL_AI_SDK, but the tool-execution model
+    // differs enough to matter: harness tools run SERVER-SIDE in Vercel
+    // Sandbox microVMs (the laptop proxy never sees sandbox egress), and
+    // workflow tools run inside a DURABLE runtime that retries thrown errors
+    // (refusals must be FatalError-compatible). See each adapter's module doc.
+    /** Vercel `@ai-sdk/harness` (HarnessAgent — sandboxed coding-agent
+     *  harnesses, e.g. `@ai-sdk/harness-claude-code`/`-grok-build`). Detected
+     *  via `@ai-sdk/harness`, any `@ai-sdk/harness-*` adapter, or any
+     *  `@ai-sdk/sandbox-*` provider in `package.json`. Gate:
+     *  `@intutic/gate/harness`'s approval responder — the framework's
+     *  `toolApproval` setting is a STATIC record without callback support, so
+     *  per-call gating routes through the tool-approval flow; built-in sandbox
+     *  tools are governed only by `permissionMode`, which DEFAULTS to
+     *  'allow-all'. See gateRegistry.ts's NO_GATE row and TD-415..417. */
+    AI_SDK_HARNESS: 'ai-sdk-harness',
+    /** Vercel `@ai-sdk/workflow` (WorkflowAgent — durable workflow agents on
+     *  the Workflow DevKit). Detected via `@ai-sdk/workflow` in `package.json`
+     *  (the unscoped `workflow` package alone is deliberately NOT a trigger —
+     *  it is the durable runtime with no agent surface, and the bare name is
+     *  too generic). Gate: `@intutic/gate/workflow`'s `intuticNeedsApproval()`
+     *  on each tool — WorkflowAgent itself has zero approval fields; refusals
+     *  are FatalError-compatible so the durable runtime aborts rather than
+     *  retry-looping a governance denial. See gateRegistry.ts's NO_GATE row
+     *  and TD-418..419. */
+    AI_SDK_WORKFLOW: 'ai-sdk-workflow',
+    // ─── B2: AWS Bedrock AgentCore ───────────────────────────────────────────
+    /**
+     * AWS Bedrock AgentCore **Runtime** (GA 2025-10) — a managed hosting
+     * environment for a customer's OWN agent code (any framework), NOT itself
+     * an agent framework. Detected via the `bedrock-agentcore` SDK (PyPI
+     * `bedrock-agentcore`, CONFIRMED at 1.22.0; npm `bedrock-agentcore`,
+     * CONFIRMED at 0.4.3 — both live-checked via `pip index versions`/`npm
+     * view` and by downloading and inspecting the real packages, not assumed)
+     * OR the local dev-loop config files the `agentcore` CLI (npm
+     * `@aws/agentcore`, CONFIRMED at 0.27.0) and the Python
+     * `bedrock-agentcore-starter-toolkit` (CONFIRMED at 0.3.11) write:
+     * `.bedrock_agentcore.yaml`, `agentcore/agentcore.json`, `aws-targets.json`
+     * — all three confirmed by extracting the real published tarballs/wheels
+     * and grepping their compiled/source output for the literal filenames.
+     *
+     * Classified `'delegated'` (see `gateKind.ts`), the SAME kind as XIRP and
+     * AGENTIC_ORCHESTRATOR, for an analogous but distinct reason: Runtime
+     * hosts the customer's chosen framework's code UNCHANGED, so a tool call
+     * made inside it is governed by whichever already-supported framework
+     * adapter that code uses (Strands, LangGraph, CrewAI, ...) — this
+     * adapter's own `writeConfig` is a no-op, same as Xirp/Agentic
+     * Orchestrator's. Unlike those two, Runtime does not SPAWN another
+     * already-installed CLI harness as a subprocess; it hosts a customer's
+     * framework-SDK code as the deployment target, so if that code uses no
+     * framework this registry supports (raw boto3, a hand-rolled tool loop),
+     * coverage is genuinely zero — the same honest gap AGENTIC_ORCHESTRATOR's
+     * OpenCode backend has (TD-397). Deployment-target constraints that are
+     * NOT a gate concern (environment-variable caps, VPC/NAT egress topology,
+     * SigV4 traffic not being proxyable) are documented in
+     * apps/docs/integrations/agentcore.md rather than encoded here.
+     *
+     * AgentCore **Gateway** (the MCP-tool-call interceptor path) deliberately
+     * has NO enum entry here — same precedent QM set (see TD-400): it is a
+     * deployed AWS resource (a Lambda attached to a Gateway), never something
+     * `intutic init`/`intutic connect` finds on a developer's laptop. Its
+     * coverage is the `tools/agentcore-interceptor` Lambda calling
+     * `POST /api/v1/integrations/agentcore/gateway-check` — see TD-430.
+     *
+     * AgentCore **Policy** (Cedar/"Dogwood") has NO third-party HTTP policy
+     * backend at all (confirmed against `GatewayPolicyEngineConfiguration`'s
+     * real API reference: `arn` only ever names an AWS-native
+     * `policy-engine/...` resource) — not integrable by design, not a gap.
+     *
+     * See apps/docs/integrations/agentcore.md and TD-430..432.
+     */
+    AGENTCORE_RUNTIME: 'agentcore-runtime',
+    // ─── B3: TrueForge, standalone/hosted server (bridge-gated) ─────────────
+    /**
+     * TrueFoundry's "TrueForge" (github.com/truefoundry/trueforge, MIT,
+     * TS/Node), run as its OWN standalone/hosted server process — `npx
+     * @truefoundry/trueforge`, its Docker Compose stack, or its Helm chart —
+     * rather than embedded into another team's Node process (see TRUEFORGE
+     * above for that mode). Not detected by `intutic init`'s repo scan: there
+     * is no per-repo `package.json` dependency or config file to find, because
+     * this is an operator-configured DEPLOYMENT, not a library dependency of
+     * whatever repo `intutic init` happens to run against. An operator points
+     * `services/trueforge-bridge` at their running instance instead — see
+     * that service's README and `apps/docs/integrations/trueforge.md`'s
+     * server-mode section.
+     *
+     * Gate: classified `'bridge'` (see `gateKind.ts`), a shape distinct from
+     * every other row in this enum. TrueForge exposes exactly one tool-call
+     * governance surface, embedded or standalone alike (see TRUEFORGE's own
+     * doc for how this was confirmed against the real package): a turn pauses
+     * with a `tool.approval_required` event naming each pending call only as
+     * `{id, source_event_id}`, resolved by starting a NEW turn
+     * (`POST /{session_id}/turns`, `previous_turn_id` chained) carrying a
+     * `user.tool_approval` input item. Nobody embeds an Intutic gate into a
+     * third-party OSS server process, so unlike TRUEFORGE this mode cannot be
+     * `'sdk'` — there is no host process of ours to run in. It also is not
+     * `'hook'` (no on-disk file this deployment reads) or `'delegated'` (it
+     * does not wrap another already-gated harness). The gate instead runs OUT
+     * OF PROCESS, in `services/trueforge-bridge` — an Intutic-operated service
+     * that watches each session's turn/event stream (SSE subscribe, or
+     * `listTurnEventsRoute` polling as a fallback; there is no webhook —
+     * TrueForge never pushes anything to an external system), resolves a
+     * pending call's `source_event_id` back to the real tool name and
+     * arguments via the referenced `model.message` event, evaluates it through
+     * the same `packages/gate-js` machinery every other JS/TS-native row here
+     * uses (`soprules.ts`'s `ruleMatches` plus `POST /api/v1/hook-gate`), and
+     * answers with `{status:'allow'}` or `{status:'deny', reason}`.
+     *
+     * The load-bearing caveat, stated plainly rather than buried: whether a
+     * tool call ever emits `tool.approval_required` in the first place is
+     * controlled by each registered MCP server's own approval-tool-selector
+     * config (`McpServerApprovalToolSelector`: `"@all" | "@write" |
+     * "@destructive" | <tool name>`). A narrow/default selector means some
+     * tool calls never pause and are invisible to the bridge — this is
+     * TrueForge's own design, not something this gate kind can work around.
+     * See `apps/docs/reference/harness-security-matrix.md` row 42 and
+     * `apps/docs/integrations/trueforge.md`'s server-mode section for the full
+     * scoping statement, including how this Hook(A) trust shape — the gate
+     * co-resident in a wholly SEPARATE process reacting to a pull-only event
+     * stream — is weaker than every other Hook(A) mark in this catalog, all
+     * of which run co-resident with or embedded in the harness's own process.
+     */
+    TRUEFORGE_SERVER: 'trueforge-server',
 };
+/**
+ * The real count of `HarnessType` members — one number, exported so no doc
+ * or README prose ever has to state it by hand again (Wave 8,
+ * audit-remediation). `check-harness-counts.js` (`lint:claims`) asserts
+ * every harness-count claim in `apps/docs/**` and `README.md` matches
+ * either this or `HARNESS_HEADLINE_COUNT` below, so this drifting out of
+ * sync with prose is now a lint failure, not a silent staleness.
+ */
+exports.HARNESS_COUNT = Object.keys(exports.HarnessType).length;
+/**
+ * `HARNESS_COUNT` minus the harnesses with a confirmed, currently-open
+ * support gap — the number safe to use in headline/marketing copy
+ * ("works with N coding agents") without overclaiming. Each exclusion must
+ * be a harness with its own `docs/TECH_DEBT.md` entry describing a REAL,
+ * currently-unactionable gap (not a caveat, not a "documented, not a
+ * defect" note). The list is EMPTY since 2026-09-23 and the mechanism is
+ * kept so the next real gap goes here and nowhere else:
+ *
+ * - `agentic-orchestrator` was excluded under TD-397 while its OpenCode
+ *   backend had no gate; OpenCode is a harness of its own now.
+ * - `autogen` was excluded under TD-374 while `InterventionHandler.on_send`
+ *   was blind to `AssistantAgent`'s own tool calls; `IntuticWorkbench`
+ *   (2026-09-22) governs them.
+ *
+ * Deliberately does NOT exclude `mastra` — TD-380 is explicitly marked
+ * "🟢 Documented, not a defect" in TECH_DEBT.md, a caveat about a call-site
+ * hook override, not a coverage gap, so excluding it here would be the
+ * exact overclaim-avoidance discipline applied backwards. Also does NOT
+ * exclude `continue` over its headless-mode limitation (`cn -p` skips
+ * PreToolUse hooks): that is a secondary invocation mode of a harness whose
+ * primary (interactive) path is fully covered, not a reason to undercount
+ * the harness itself.
+ */
+exports.HARNESS_HEADLINE_COUNT = exports.HARNESS_COUNT - [].length;
 // ─── Execution Mode ──────────────────────────────────────────────────
 // HLD §3.4 — Agent execution modes
 /** Agent execution mode controlling autonomy level. */
@@ -131,6 +465,17 @@ exports.PlanLifecycleState = {
     EXECUTING: 'EXECUTING',
     COMPLETED: 'COMPLETED',
 };
+// ─── Plan Execution Outcome ──────────────────────────────────────────
+// HLD §3.4.1 — result category recorded when a plan is closed
+// (lifecycleState -> COMPLETED). Meaningful only in that state; null
+// otherwise — a REJECTED plan never executed, so it has no outcome.
+/** Result category for a closed (COMPLETED) stored plan. */
+exports.PlanExecutionOutcome = {
+    SUCCESS: 'SUCCESS',
+    FAILED: 'FAILED',
+    PARTIAL: 'PARTIAL',
+    ABORTED: 'ABORTED',
+};
 // ─── SOP Lifecycle State ─────────────────────────────────────────────
 // HLD §3.4, LLD #6 §4.2 — 7-state FSM: DRAFT → PENDING_REVIEW → GENERATED
 //   → HYPOTHESIZED → REFINED → VALIDATED → INVALIDATED
@@ -192,8 +537,10 @@ exports.WorkspaceRole = {
  * - `open`   (default): pass through the tool call + emit a warning event
  * - `closed`: block the tool call with a user-visible error message
  *
- * Note: `closed` only affects harnesses with MCP proxy injection (13/17).
- * For harnesses without proxy (n8n, pi, codex, open-webui), see TD-151.
+ * Note: `closed` only affects harnesses with MCP proxy injection (9/20 —
+ * 10 config paths across 9 harnesses, see sync-daemon mcpAutoWrite.ts).
+ * For harnesses without MCP proxy injection (e.g. n8n, pi, codex,
+ * open-webui), see TD-151.
  */
 exports.McpProxyFailBehavior = {
     OPEN: 'open',
@@ -204,7 +551,8 @@ exports.McpProxyFailBehavior = {
  * - `per-session` (default, Phase 4): new proxy process per MCP connection
  * - `daemon`      (Phase 5): long-lived daemon, per-session shims delegate via Unix socket
  *
- * See TD-153 — daemon requires macOS notarization. Per-session is the only active mode in Phase 4.
+ * See TD-153 — daemon requires macOS notarization. Both modes are active: the
+ * mcp-proxy honours `daemon` by answering policy lookups over the daemon socket.
  */
 exports.McpProxyMode = {
     PER_SESSION: 'per-session',
@@ -237,4 +585,19 @@ exports.DriftDetectionMode = {
     TURBOVEC: 'turbovec',
     COMPLIANCE_SCORE_FALLBACK: 'compliance_score_fallback',
 };
+/**
+ * Migration 163: which of `sop_amendments`' three producers wrote a row.
+ * INCIDENT_MINING (`dreamCycleService.runDreamCycle`, `runId` prefixed
+ * `dcr_`) and METACLAW (`promptEvolutionService.runEvolutionCycle`, `runId`
+ * prefixed `mcr_`, has a matching `metaclaw_runs` row — the only source a
+ * clause diff is meaningful for) are both manually/dashboard-triggered.
+ * HEALTH_CRON (`sopHealthCron.ts`, `runId` NULL) is the only one currently
+ * on a schedule — its output was invisible to every UI before this column
+ * existed, since the sole proposals feed filtered `runId IS NOT NULL`.
+ */
+exports.AmendmentSource = {
+    INCIDENT_MINING: 'INCIDENT_MINING',
+    METACLAW: 'METACLAW',
+    HEALTH_CRON: 'HEALTH_CRON',
+};
 //# sourceMappingURL=enums.js.map

package/dist/enums.js.map

@@ -1 +1 @@
-{"version":3,"file":"enums.js","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,wEAAwE;AACxE,uCAAuC;AAEvC,uEAAuE;AAC1D,QAAA,SAAS,GAAG;IACvB,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;CACZ,CAAA;AAKV,wEAAwE;AACxE,oDAAoD;AAEpD,sDAAsD;AACzC,QAAA,iBAAiB,GAAG;IAC/B,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;CACJ,CAAA;AAKV,wEAAwE;AACxE,+CAA+C;AAE/C,0EAA0E;AAC7D,QAAA,YAAY,GAAG;IAC1B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,wEAAwE;AACxE,6CAA6C;AAE7C,kEAAkE;AACrD,QAAA,UAAU,GAAG;IACxB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;CACd,CAAA;AAKV,wEAAwE;AACxE,4CAA4C;AAE5C,wDAAwD;AAC3C,QAAA,cAAc,GAAG;IAC5B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,uEAAuE;AACvE,kDAAkD;AAElD,qEAAqE;AACxD,QAAA,oBAAoB,GAAG;IAClC,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,wEAAwE;AACxE,wEAAwE;AAExE;;;;;;;;;GASG;AACH,8DAAuD;AAA9C,+GAAA,WAAW,OAAA;AAKpB,wEAAwE;AACxE,4DAA4D;AAC5D,iEAAiE;AAEjE,mDAAmD;AACtC,QAAA,WAAW,GAAG;IACzB,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,IAAI;IACR,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,gBAAgB;IAChC,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,YAAY;IACxB,cAAc,EAAE,gBAAgB;CACxB,CAAA;AAKV,wEAAwE;AACxE,mCAAmC;AAEnC,uDAAuD;AAC1C,QAAA,aAAa,GAAG;IAC3B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;CAChB,CAAA;AAKV,wEAAwE;AACxE,uDAAuD;AAEvD,gDAAgD;AACnC,QAAA,cAAc,GAAG;IAC5B,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,cAAc;IAC5B,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,gBAAgB;CACxB,CAAA;AAKV,wEAAwE;AACxE,sDAAsD;AAEtD,kDAAkD;AACrC,QAAA,kBAAkB,GAAG;IAChC,gBAAgB,EAAE,kBAAkB;IACpC,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;CACd,CAAA;AAKV,wEAAwE;AACxE,0EAA0E;AAC1E,uDAAuD;AAEvD,gDAAgD;AACnC,QAAA,iBAAiB,GAAG;IAC/B,KAAK,EAAE,OAAO;IACd,cAAc,EAAE,gBAAgB;IAChC,SAAS,EAAE,WAAW;IACtB,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,aAAa;CAClB,CAAA;AAKV,wEAAwE;AACxE,yDAAyD;AAEzD,yDAAyD;AAC5C,QAAA,OAAO,GAAG;IACrB,wDAAwD;IACxD,QAAQ,EAAE,UAAU;IACpB,sEAAsE;IACtE,IAAI,EAAE,MAAM;CACJ,CAAA;AAKV,wEAAwE;AACxE,sDAAsD;AAEtD,kDAAkD;AACrC,QAAA,SAAS,GAAG;IACvB,mCAAmC;IACnC,QAAQ,EAAE,UAAU;IACpB,kCAAkC;IAClC,SAAS,EAAE,WAAW;IACtB,yCAAyC;IACzC,YAAY,EAAE,cAAc;IAC5B,mCAAmC;IACnC,aAAa,EAAE,eAAe;CACtB,CAAA;AAKV,wEAAwE;AACxE,yDAAyD;AAEzD,gDAAgD;AACnC,QAAA,WAAW,GAAG;IACzB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;CACN,CAAA;AAKV,wEAAwE;AACxE,yCAAyC;AAEzC,+EAA+E;AAClE,QAAA,aAAa,GAAG;IAC3B,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,EAAE,EAAE,IAAI;IACR,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,wEAAwE;AACxE,sEAAsE;AACtE,yCAAyC;AAEzC;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAG;IAClC,IAAI,EAAI,MAAM;IACd,MAAM,EAAE,QAAQ;CACR,CAAA;AAGV;;;;;;GAMG;AACU,QAAA,YAAY,GAAG;IAC1B,WAAW,EAAE,aAAa;IAC1B,MAAM,EAAO,QAAQ;CACb,CAAA;AAGV;;;;;;;;GAQG;AACU,QAAA,qBAAqB,GAAG;IACnC,OAAO,EAAK,SAAS;IACrB,SAAS,EAAG,WAAW;IACvB,UAAU,EAAE,YAAY;CAChB,CAAA;AAGV,wEAAwE;AACxE,wCAAwC;AAExC,8DAA8D;AACjD,QAAA,mBAAmB,GAAG;IACjC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,aAAa,EAAG,eAAe;CACvB,CAAA;AAGV,oFAAoF;AACvE,QAAA,kBAAkB,GAAG;IAChC,QAAQ,EAAmB,UAAU;IACrC,yBAAyB,EAAE,2BAA2B;CAC9C,CAAA"}
+{"version":3,"file":"enums.js","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,wEAAwE;AACxE,uCAAuC;AAEvC,uEAAuE;AAC1D,QAAA,SAAS,GAAG;IACvB,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;CACZ,CAAA;AAKV,wEAAwE;AACxE,oDAAoD;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACU,QAAA,iBAAiB,GAAG;IAC/B,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;CACZ,CAAA;AAKV,wEAAwE;AACxE,+CAA+C;AAE/C,0EAA0E;AAC7D,QAAA,YAAY,GAAG;IAC1B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,wEAAwE;AACxE,6CAA6C;AAE7C,kEAAkE;AACrD,QAAA,UAAU,GAAG;IACxB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;CACd,CAAA;AAKV,wEAAwE;AACxE,4CAA4C;AAE5C,wDAAwD;AAC3C,QAAA,cAAc,GAAG;IAC5B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,uEAAuE;AACvE,kDAAkD;AAElD,qEAAqE;AACxD,QAAA,oBAAoB,GAAG;IAClC,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,wEAAwE;AACxE,wEAAwE;AAExE;;;;;;;;;GASG;AACH,8DAAuD;AAA9C,+GAAA,WAAW,OAAA;AAKpB,wEAAwE;AACxE,4DAA4D;AAC5D,sEAAsE;AACtE,qEAAqE;AACrE,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,qCAAqC;AAErC,mDAAmD;AACtC,QAAA,WAAW,GAAG;IACzB,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,IAAI;IACR,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,gBAAgB;IAChC,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,YAAY;IACxB,cAAc,EAAE,gBAAgB;IAChC,SAAS,EAAE,WAAW;IACtB,iFAAiF;IACjF,SAAS,EAAE,WAAW;IACtB,2EAA2E;IAC3E,IAAI,EAAE,MAAM;IACZ;;;;+EAI2E;IAC3E,QAAQ,EAAE,UAAU;IACpB;;iEAE6D;IAC7D,gBAAgB,EAAE,KAAK;IACvB;;;;;;;;OAQG;IACH,IAAI,EAAE,MAAM;IACZ;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oBAAoB,EAAE,sBAAsB;IAC5C,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,4EAA4E;IAC5E,oEAAoE;IACpE;;;;;+DAK2D;IAC3D,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,0EAA0E;IAC1E,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,YAAY;IACxB;;;;;;;;6DAQyD;IACzD,aAAa,EAAE,eAAe;IAC9B,mDAAmD;IACnD,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,YAAY;IACxB;;;;;;;iEAO6D;IAC7D,OAAO,EAAE,SAAS;IAClB,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE;IAClE,kEAAkE;IAClE,4EAA4E;IAC5E;;kFAE8E;IAC9E,MAAM,EAAE,QAAQ;IAChB;;;4EAGwE;IACxE,aAAa,EAAE,eAAe;IAC9B;;;;;;;uDAOmD;IACnD,GAAG,EAAE,KAAK;IACV;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,SAAS,EAAE,WAAW;IACtB,2EAA2E;IAC3E,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E;;;;;;;;0EAQsE;IACtE,cAAc,EAAE,gBAAgB;IAChC;;;;;;;;2BAQuB;IACvB,eAAe,EAAE,iBAAiB;IAClC,4EAA4E;IAC5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,iBAAiB,EAAE,mBAAmB;IACtC,2EAA2E;IAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,gBAAgB,EAAE,kBAAkB;CAC5B,CAAA;AAKV;;;;;;;GAOG;AACU,QAAA,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAW,CAAC,CAAC,MAAM,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACU,QAAA,sBAAsB,GAAG,qBAAa,GAAG,EAAE,CAAC,MAAM,CAAA;AAE/D,wEAAwE;AACxE,mCAAmC;AAEnC,uDAAuD;AAC1C,QAAA,aAAa,GAAG;IAC3B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;CAChB,CAAA;AAKV,wEAAwE;AACxE,uDAAuD;AAEvD,gDAAgD;AACnC,QAAA,cAAc,GAAG;IAC5B,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,cAAc;IAC5B,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,gBAAgB;CACxB,CAAA;AAKV,wEAAwE;AACxE,sDAAsD;AAEtD,kDAAkD;AACrC,QAAA,kBAAkB,GAAG;IAChC,gBAAgB,EAAE,kBAAkB;IACpC,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;CACd,CAAA;AAKV,wEAAwE;AACxE,8DAA8D;AAC9D,qEAAqE;AACrE,oEAAoE;AAEpE,4DAA4D;AAC/C,QAAA,oBAAoB,GAAG;IAClC,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;CACV,CAAA;AAKV,wEAAwE;AACxE,0EAA0E;AAC1E,uDAAuD;AAEvD,gDAAgD;AACnC,QAAA,iBAAiB,GAAG;IAC/B,KAAK,EAAE,OAAO;IACd,cAAc,EAAE,gBAAgB;IAChC,SAAS,EAAE,WAAW;IACtB,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,aAAa;CAClB,CAAA;AAKV,wEAAwE;AACxE,yDAAyD;AAEzD,yDAAyD;AAC5C,QAAA,OAAO,GAAG;IACrB,wDAAwD;IACxD,QAAQ,EAAE,UAAU;IACpB,sEAAsE;IACtE,IAAI,EAAE,MAAM;CACJ,CAAA;AAKV,wEAAwE;AACxE,sDAAsD;AAEtD,kDAAkD;AACrC,QAAA,SAAS,GAAG;IACvB,mCAAmC;IACnC,QAAQ,EAAE,UAAU;IACpB,kCAAkC;IAClC,SAAS,EAAE,WAAW;IACtB,yCAAyC;IACzC,YAAY,EAAE,cAAc;IAC5B,mCAAmC;IACnC,aAAa,EAAE,eAAe;CACtB,CAAA;AAKV,wEAAwE;AACxE,yDAAyD;AAEzD,gDAAgD;AACnC,QAAA,WAAW,GAAG;IACzB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;CACN,CAAA;AAKV,wEAAwE;AACxE,yCAAyC;AAEzC,+EAA+E;AAClE,QAAA,aAAa,GAAG;IAC3B,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,EAAE,EAAE,IAAI;IACR,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,wEAAwE;AACxE,sEAAsE;AACtE,yCAAyC;AAEzC;;;;;;;;;GASG;AACU,QAAA,oBAAoB,GAAG;IAClC,IAAI,EAAI,MAAM;IACd,MAAM,EAAE,QAAQ;CACR,CAAA;AAGV;;;;;;;GAOG;AACU,QAAA,YAAY,GAAG;IAC1B,WAAW,EAAE,aAAa;IAC1B,MAAM,EAAO,QAAQ;CACb,CAAA;AAGV;;;;;;;;GAQG;AACU,QAAA,qBAAqB,GAAG;IACnC,OAAO,EAAK,SAAS;IACrB,SAAS,EAAG,WAAW;IACvB,UAAU,EAAE,YAAY;CAChB,CAAA;AAGV,wEAAwE;AACxE,wCAAwC;AAExC,8DAA8D;AACjD,QAAA,mBAAmB,GAAG;IACjC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,aAAa,EAAG,eAAe;CACvB,CAAA;AAGV,oFAAoF;AACvE,QAAA,kBAAkB,GAAG;IAChC,QAAQ,EAAmB,UAAU;IACrC,yBAAyB,EAAE,2BAA2B;CAC9C,CAAA;AAGV;;;;;;;;;GASG;AACU,QAAA,eAAe,GAAG;IAC7B,eAAe,EAAE,iBAAiB;IAClC,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,aAAa;CAClB,CAAA"}

package/dist/errors.d.ts

@@ -13,6 +13,10 @@ export declare const E_NOT_FOUND: "E_NOT_FOUND";
 export declare const E_CACHE_UNAVAILABLE: "E_CACHE_UNAVAILABLE";
 /** Missing or invalid authentication credentials. */
 export declare const E_UNAUTHORIZED: "E_UNAUTHORIZED";
+/** SCIM bearer token missing, unknown, expired or revoked. */
+export declare const E_SCIM_AUTH_FAILED: "SCIM_AUTH_FAILED";
+/** SCIM create for a userName that already exists in the workspace. */
+export declare const E_SCIM_DUPLICATE: "SCIM_DUPLICATE";
 /** Authenticated but insufficient permissions. */
 export declare const E_FORBIDDEN: "E_FORBIDDEN";
 /** Budget limit exceeded — HLD §3.6 FinOps guardrail. */
@@ -54,6 +58,13 @@ export declare const E_TOKEN_INVALID: "TOKEN_INVALID";
 export declare const E_TOKEN_EXPIRED: "TOKEN_EXPIRED";
 /** Resource is already in the target state. */
 export declare const E_ALREADY_VERIFIED: "ALREADY_VERIFIED";
+/**
+ * Org creation was attempted against a domain-verification that isn't in
+ * `verified` status — pending (DNS not seen yet), already consumed by a
+ * prior org, or expired. Distinct from E_TOKEN_INVALID/E_TOKEN_EXPIRED:
+ * the verification row itself may be perfectly valid, just not proven yet.
+ */
+export declare const E_DOMAIN_NOT_VERIFIED: "DOMAIN_NOT_VERIFIED";
 /** Generic validation failure (legacy alias). */
 export declare const E_VALIDATION: "E_VALIDATION";
 /** SSO is not configured or disabled for this workspace. */
@@ -74,6 +85,14 @@ export declare const E_PROVIDER_IN_USE: "PROVIDER_IN_USE";
 export declare const E_OFFBOARDING_IN_PROGRESS: "OFFBOARDING_IN_PROGRESS";
 /** Feature is not available on the current plan tier. */
 export declare const E_FEATURE_NOT_AVAILABLE: "FEATURE_NOT_AVAILABLE";
+/**
+ * A session has no SSL graph, so there is nothing to audit it against.
+ *
+ * Distinct from "compliant" on purpose. The compliance report used to score an
+ * unseeded session 1.0 — a perfect result for a session that was never enforced —
+ * which made the unenforced sessions rank best in a workspace's audit history.
+ */
+export declare const E_SSL_NOT_ENFORCED: "SSL_NOT_ENFORCED";
 /**
  * Requested child capabilities are not a subset of the parent key's capabilities.
  * HLD §5.6 — DCT Token Attenuation (Patent Family A).
@@ -92,7 +111,7 @@ export declare const E_OVERAGE_HARD_CAP_EXCEEDED: "OVERAGE_HARD_CAP_EXCEEDED";
  * function handle(code: IntuticErrorCode) { ... }
  * ```
  */
-export type IntuticErrorCode = typeof E_NOT_FOUND | typeof E_CACHE_UNAVAILABLE | typeof E_UNAUTHORIZED | typeof E_FORBIDDEN | typeof E_BUDGET_EXCEEDED | typeof E_RATE_LIMITED | typeof E_APPEND_ONLY_VIOLATION | typeof E_APPROVAL_RATIONALE_REQUIRED | typeof E_VALIDATION_FAILED | typeof E_CHECKOUT_DISABLED | typeof E_SIGNUP_DISABLED | typeof E_ALREADY_ON_TIER | typeof E_STRIPE_ERROR | typeof E_SIGNATURE_INVALID | typeof E_TRIAL_EXPIRED | typeof E_EMAIL_ALREADY_EXISTS | typeof E_OAUTH_FAILED | typeof E_TOKEN_INVALID | typeof E_TOKEN_EXPIRED | typeof E_ALREADY_VERIFIED | typeof E_VALIDATION | typeof E_SSO_DISABLED | typeof E_SSO_NO_MEMBERSHIP | typeof E_OIDC_INVALID_STATE | typeof E_OIDC_TOKEN_EXCHANGE_FAILED | typeof E_OIDC_CLAIMS_MISSING | typeof E_PROVIDER_DISABLED | typeof E_PROVIDER_IN_USE | typeof E_OFFBOARDING_IN_PROGRESS | typeof E_FEATURE_NOT_AVAILABLE | typeof E_ATTENUATION_CAP_VIOLATION | typeof E_OVERAGE_HARD_CAP_EXCEEDED;
+export type IntuticErrorCode = typeof E_NOT_FOUND | typeof E_CACHE_UNAVAILABLE | typeof E_UNAUTHORIZED | typeof E_SCIM_AUTH_FAILED | typeof E_SCIM_DUPLICATE | typeof E_FORBIDDEN | typeof E_BUDGET_EXCEEDED | typeof E_RATE_LIMITED | typeof E_APPEND_ONLY_VIOLATION | typeof E_APPROVAL_RATIONALE_REQUIRED | typeof E_VALIDATION_FAILED | typeof E_CHECKOUT_DISABLED | typeof E_SIGNUP_DISABLED | typeof E_DOMAIN_NOT_VERIFIED | typeof E_ALREADY_ON_TIER | typeof E_STRIPE_ERROR | typeof E_SIGNATURE_INVALID | typeof E_TRIAL_EXPIRED | typeof E_EMAIL_ALREADY_EXISTS | typeof E_OAUTH_FAILED | typeof E_TOKEN_INVALID | typeof E_TOKEN_EXPIRED | typeof E_ALREADY_VERIFIED | typeof E_VALIDATION | typeof E_SSO_DISABLED | typeof E_SSO_NO_MEMBERSHIP | typeof E_OIDC_INVALID_STATE | typeof E_OIDC_TOKEN_EXCHANGE_FAILED | typeof E_OIDC_CLAIMS_MISSING | typeof E_PROVIDER_DISABLED | typeof E_PROVIDER_IN_USE | typeof E_OFFBOARDING_IN_PROGRESS | typeof E_FEATURE_NOT_AVAILABLE | typeof E_SSL_NOT_ENFORCED | typeof E_ATTENUATION_CAP_VIOLATION | typeof E_OVERAGE_HARD_CAP_EXCEEDED;
 /**
  * Structured error class used across all Intutic services.
  *

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,0BAA0B;AAC1B,eAAO,MAAM,WAAW,EAAG,aAAsB,CAAA;AAEjD,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,EAAG,qBAA8B,CAAA;AAGjE,qDAAqD;AACrD,eAAO,MAAM,cAAc,EAAG,gBAAyB,CAAA;AAEvD,kDAAkD;AAClD,eAAO,MAAM,WAAW,EAAG,aAAsB,CAAA;AAEjD,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,EAAG,mBAA4B,CAAA;AAE7D,mCAAmC;AACnC,eAAO,MAAM,cAAc,EAAG,gBAAyB,CAAA;AAEvD,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAA;AAEzE,sFAAsF;AACtF,eAAO,MAAM,6BAA6B,EAAG,+BAAwC,CAAA;AAErF,oDAAoD;AACpD,eAAO,MAAM,mBAAmB,EAAG,qBAA8B,CAAA;AAEjE,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAC/D;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,wBAAwB;AACxB,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,wCAAwC;AACxC,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,gCAAgC;AAChC,eAAO,MAAM,sBAAsB,EAAG,sBAA+B,CAAA;AAErE,0BAA0B;AAC1B,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,qCAAqC;AACrC,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,yBAAyB;AACzB,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,EAAG,kBAA2B,CAAA;AAE7D,iDAAiD;AACjD,eAAO,MAAM,YAAY,EAAG,cAAuB,CAAA;AAInD,4DAA4D;AAC5D,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAA;AAEjE,+CAA+C;AAC/C,eAAO,MAAM,4BAA4B,EAAG,4BAAqC,CAAA;AAEjF,kDAAkD;AAClD,eAAO,MAAM,qBAAqB,EAAG,qBAA8B,CAAA;AAEnE,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,4DAA4D;AAC5D,eAAO,MAAM,yBAAyB,EAAG,yBAAkC,CAAA;AAE3E,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,EAAG,uBAAgC,CAAA;AAIvE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAG,2BAAoC,CAAA;AAI/E;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAG,2BAAoC,CAAA;AAE/E;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB,OAAO,WAAW,GAClB,OAAO,mBAAmB,GAE1B,OAAO,cAAc,GACrB,OAAO,WAAW,GAClB,OAAO,iBAAiB,GACxB,OAAO,cAAc,GACrB,OAAO,uBAAuB,GAC9B,OAAO,6BAA6B,GACpC,OAAO,mBAAmB,GAC1B,OAAO,mBAAmB,GAC1B,OAAO,iBAAiB,GACxB,OAAO,iBAAiB,GACxB,OAAO,cAAc,GACrB,OAAO,mBAAmB,GAC1B,OAAO,eAAe,GACtB,OAAO,sBAAsB,GAC7B,OAAO,cAAc,GACrB,OAAO,eAAe,GACtB,OAAO,eAAe,GACtB,OAAO,kBAAkB,GACzB,OAAO,YAAY,GAEnB,OAAO,cAAc,GACrB,OAAO,mBAAmB,GAC1B,OAAO,oBAAoB,GAC3B,OAAO,4BAA4B,GACnC,OAAO,qBAAqB,GAC5B,OAAO,mBAAmB,GAC1B,OAAO,iBAAiB,GACxB,OAAO,yBAAyB,GAChC,OAAO,uBAAuB,GAE9B,OAAO,2BAA2B,GAElC,OAAO,2BAA2B,CAAA;AAItC;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAE/B,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gBAGxC,IAAI,EAAE,gBAAgB,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQpC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,CAQhE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,0BAA0B;AAC1B,eAAO,MAAM,WAAW,EAAG,aAAsB,CAAA;AAEjD,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,EAAG,qBAA8B,CAAA;AAGjE,qDAAqD;AACrD,eAAO,MAAM,cAAc,EAAG,gBAAyB,CAAA;AACvD,8DAA8D;AAC9D,eAAO,MAAM,kBAAkB,EAAG,kBAA2B,CAAA;AAC7D,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,EAAG,gBAAyB,CAAA;AAEzD,kDAAkD;AAClD,eAAO,MAAM,WAAW,EAAG,aAAsB,CAAA;AAEjD,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,EAAG,mBAA4B,CAAA;AAE7D,mCAAmC;AACnC,eAAO,MAAM,cAAc,EAAG,gBAAyB,CAAA;AAEvD,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAA;AAEzE,sFAAsF;AACtF,eAAO,MAAM,6BAA6B,EAAG,+BAAwC,CAAA;AAErF,oDAAoD;AACpD,eAAO,MAAM,mBAAmB,EAAG,qBAA8B,CAAA;AAEjE,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAC/D;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,wBAAwB;AACxB,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,wCAAwC;AACxC,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,gCAAgC;AAChC,eAAO,MAAM,sBAAsB,EAAG,sBAA+B,CAAA;AAErE,0BAA0B;AAC1B,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,qCAAqC;AACrC,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,yBAAyB;AACzB,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,EAAG,kBAA2B,CAAA;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAG,qBAA8B,CAAA;AAEnE,iDAAiD;AACjD,eAAO,MAAM,YAAY,EAAG,cAAuB,CAAA;AAInD,4DAA4D;AAC5D,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAA;AAEjE,+CAA+C;AAC/C,eAAO,MAAM,4BAA4B,EAAG,4BAAqC,CAAA;AAEjF,kDAAkD;AAClD,eAAO,MAAM,qBAAqB,EAAG,qBAA8B,CAAA;AAEnE,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,4DAA4D;AAC5D,eAAO,MAAM,yBAAyB,EAAG,yBAAkC,CAAA;AAE3E,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,EAAG,uBAAgC,CAAA;AAEvE;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAG,kBAA2B,CAAA;AAI7D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAG,2BAAoC,CAAA;AAI/E;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAG,2BAAoC,CAAA;AAE/E;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB,OAAO,WAAW,GAClB,OAAO,mBAAmB,GAE1B,OAAO,cAAc,GACrB,OAAO,kBAAkB,GACzB,OAAO,gBAAgB,GACvB,OAAO,WAAW,GAClB,OAAO,iBAAiB,GACxB,OAAO,cAAc,GACrB,OAAO,uBAAuB,GAC9B,OAAO,6BAA6B,GACpC,OAAO,mBAAmB,GAC1B,OAAO,mBAAmB,GAC1B,OAAO,iBAAiB,GACxB,OAAO,qBAAqB,GAC5B,OAAO,iBAAiB,GACxB,OAAO,cAAc,GACrB,OAAO,mBAAmB,GAC1B,OAAO,eAAe,GACtB,OAAO,sBAAsB,GAC7B,OAAO,cAAc,GACrB,OAAO,eAAe,GACtB,OAAO,eAAe,GACtB,OAAO,kBAAkB,GACzB,OAAO,YAAY,GAEnB,OAAO,cAAc,GACrB,OAAO,mBAAmB,GAC1B,OAAO,oBAAoB,GAC3B,OAAO,4BAA4B,GACnC,OAAO,qBAAqB,GAC5B,OAAO,mBAAmB,GAC1B,OAAO,iBAAiB,GACxB,OAAO,yBAAyB,GAChC,OAAO,uBAAuB,GAC9B,OAAO,kBAAkB,GAEzB,OAAO,2BAA2B,GAElC,OAAO,2BAA2B,CAAA;AAItC;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAE/B,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gBAGxC,IAAI,EAAE,gBAAgB,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQpC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,CAQhE"}

package/dist/errors.js

@@ -9,7 +9,7 @@
  * @module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IntuticError = exports.E_OVERAGE_HARD_CAP_EXCEEDED = exports.E_ATTENUATION_CAP_VIOLATION = exports.E_FEATURE_NOT_AVAILABLE = exports.E_OFFBOARDING_IN_PROGRESS = exports.E_PROVIDER_IN_USE = exports.E_PROVIDER_DISABLED = exports.E_OIDC_CLAIMS_MISSING = exports.E_OIDC_TOKEN_EXCHANGE_FAILED = exports.E_OIDC_INVALID_STATE = exports.E_SSO_NO_MEMBERSHIP = exports.E_SSO_DISABLED = exports.E_VALIDATION = exports.E_ALREADY_VERIFIED = exports.E_TOKEN_EXPIRED = exports.E_TOKEN_INVALID = exports.E_OAUTH_FAILED = exports.E_EMAIL_ALREADY_EXISTS = exports.E_TRIAL_EXPIRED = exports.E_SIGNATURE_INVALID = exports.E_STRIPE_ERROR = exports.E_ALREADY_ON_TIER = exports.E_SIGNUP_DISABLED = exports.E_CHECKOUT_DISABLED = exports.E_VALIDATION_FAILED = exports.E_APPROVAL_RATIONALE_REQUIRED = exports.E_APPEND_ONLY_VIOLATION = exports.E_RATE_LIMITED = exports.E_BUDGET_EXCEEDED = exports.E_FORBIDDEN = exports.E_UNAUTHORIZED = exports.E_CACHE_UNAVAILABLE = exports.E_NOT_FOUND = void 0;
+exports.IntuticError = exports.E_OVERAGE_HARD_CAP_EXCEEDED = exports.E_ATTENUATION_CAP_VIOLATION = exports.E_SSL_NOT_ENFORCED = exports.E_FEATURE_NOT_AVAILABLE = exports.E_OFFBOARDING_IN_PROGRESS = exports.E_PROVIDER_IN_USE = exports.E_PROVIDER_DISABLED = exports.E_OIDC_CLAIMS_MISSING = exports.E_OIDC_TOKEN_EXCHANGE_FAILED = exports.E_OIDC_INVALID_STATE = exports.E_SSO_NO_MEMBERSHIP = exports.E_SSO_DISABLED = exports.E_VALIDATION = exports.E_DOMAIN_NOT_VERIFIED = exports.E_ALREADY_VERIFIED = exports.E_TOKEN_EXPIRED = exports.E_TOKEN_INVALID = exports.E_OAUTH_FAILED = exports.E_EMAIL_ALREADY_EXISTS = exports.E_TRIAL_EXPIRED = exports.E_SIGNATURE_INVALID = exports.E_STRIPE_ERROR = exports.E_ALREADY_ON_TIER = exports.E_SIGNUP_DISABLED = exports.E_CHECKOUT_DISABLED = exports.E_VALIDATION_FAILED = exports.E_APPROVAL_RATIONALE_REQUIRED = exports.E_APPEND_ONLY_VIOLATION = exports.E_RATE_LIMITED = exports.E_BUDGET_EXCEEDED = exports.E_FORBIDDEN = exports.E_SCIM_DUPLICATE = exports.E_SCIM_AUTH_FAILED = exports.E_UNAUTHORIZED = exports.E_CACHE_UNAVAILABLE = exports.E_NOT_FOUND = void 0;
 exports.isIntuticError = isIntuticError;
 // ─── Error Code Constants ────────────────────────────────────────────
 /** Resource not found. */
@@ -18,6 +18,10 @@ exports.E_NOT_FOUND = 'E_NOT_FOUND';
 exports.E_CACHE_UNAVAILABLE = 'E_CACHE_UNAVAILABLE';
 /** Missing or invalid authentication credentials. */
 exports.E_UNAUTHORIZED = 'E_UNAUTHORIZED';
+/** SCIM bearer token missing, unknown, expired or revoked. */
+exports.E_SCIM_AUTH_FAILED = 'SCIM_AUTH_FAILED';
+/** SCIM create for a userName that already exists in the workspace. */
+exports.E_SCIM_DUPLICATE = 'SCIM_DUPLICATE';
 /** Authenticated but insufficient permissions. */
 exports.E_FORBIDDEN = 'E_FORBIDDEN';
 /** Budget limit exceeded — HLD §3.6 FinOps guardrail. */
@@ -59,6 +63,13 @@ exports.E_TOKEN_INVALID = 'TOKEN_INVALID';
 exports.E_TOKEN_EXPIRED = 'TOKEN_EXPIRED';
 /** Resource is already in the target state. */
 exports.E_ALREADY_VERIFIED = 'ALREADY_VERIFIED';
+/**
+ * Org creation was attempted against a domain-verification that isn't in
+ * `verified` status — pending (DNS not seen yet), already consumed by a
+ * prior org, or expired. Distinct from E_TOKEN_INVALID/E_TOKEN_EXPIRED:
+ * the verification row itself may be perfectly valid, just not proven yet.
+ */
+exports.E_DOMAIN_NOT_VERIFIED = 'DOMAIN_NOT_VERIFIED';
 /** Generic validation failure (legacy alias). */
 exports.E_VALIDATION = 'E_VALIDATION';
 // ─── Identity Federation Error Codes (LLD #11) ─────────────────────
@@ -80,6 +91,14 @@ exports.E_PROVIDER_IN_USE = 'PROVIDER_IN_USE';
 exports.E_OFFBOARDING_IN_PROGRESS = 'OFFBOARDING_IN_PROGRESS';
 /** Feature is not available on the current plan tier. */
 exports.E_FEATURE_NOT_AVAILABLE = 'FEATURE_NOT_AVAILABLE';
+/**
+ * A session has no SSL graph, so there is nothing to audit it against.
+ *
+ * Distinct from "compliant" on purpose. The compliance report used to score an
+ * unseeded session 1.0 — a perfect result for a session that was never enforced —
+ * which made the unenforced sessions rank best in a workspace's audit history.
+ */
+exports.E_SSL_NOT_ENFORCED = 'SSL_NOT_ENFORCED';
 // ─── WS4 — Enterprise Identity & Compliance (LLD #19) ───────────────
 /**
  * Requested child capabilities are not a subset of the parent key's capabilities.

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAoNH,wCAQC;AA1ND,wEAAwE;AAExE,0BAA0B;AACb,QAAA,WAAW,GAAG,aAAsB,CAAA;AAEjD,wDAAwD;AAC3C,QAAA,mBAAmB,GAAG,qBAA8B,CAAA;AAGjE,qDAAqD;AACxC,QAAA,cAAc,GAAG,gBAAyB,CAAA;AAEvD,kDAAkD;AACrC,QAAA,WAAW,GAAG,aAAsB,CAAA;AAEjD,yDAAyD;AAC5C,QAAA,iBAAiB,GAAG,mBAA4B,CAAA;AAE7D,mCAAmC;AACtB,QAAA,cAAc,GAAG,gBAAyB,CAAA;AAEvD,gFAAgF;AACnE,QAAA,uBAAuB,GAAG,yBAAkC,CAAA;AAEzE,sFAAsF;AACzE,QAAA,6BAA6B,GAAG,+BAAwC,CAAA;AAErF,oDAAoD;AACvC,QAAA,mBAAmB,GAAG,qBAA8B,CAAA;AAEjE,uDAAuD;AAC1C,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAC/D;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,+CAA+C;AAClC,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,wBAAwB;AACX,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,2CAA2C;AAC9B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,wCAAwC;AAC3B,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,gCAAgC;AACnB,QAAA,sBAAsB,GAAG,sBAA+B,CAAA;AAErE,0BAA0B;AACb,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,qCAAqC;AACxB,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,yBAAyB;AACZ,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,+CAA+C;AAClC,QAAA,kBAAkB,GAAG,kBAA2B,CAAA;AAE7D,iDAAiD;AACpC,QAAA,YAAY,GAAG,cAAuB,CAAA;AAEnD,sEAAsE;AAEtE,4DAA4D;AAC/C,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,4CAA4C;AAC/B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,kDAAkD;AACrC,QAAA,oBAAoB,GAAG,oBAA6B,CAAA;AAEjE,+CAA+C;AAClC,QAAA,4BAA4B,GAAG,4BAAqC,CAAA;AAEjF,kDAAkD;AACrC,QAAA,qBAAqB,GAAG,qBAA8B,CAAA;AAEnE,2CAA2C;AAC9B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,4DAA4D;AAC/C,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,4DAA4D;AAC/C,QAAA,yBAAyB,GAAG,yBAAkC,CAAA;AAE3E,yDAAyD;AAC5C,QAAA,uBAAuB,GAAG,uBAAgC,CAAA;AAEvE,uEAAuE;AAEvE;;;GAGG;AACU,QAAA,2BAA2B,GAAG,2BAAoC,CAAA;AAE/E,uEAAuE;AAEvE;;;GAGG;AACU,QAAA,2BAA2B,GAAG,2BAAoC,CAAA;AAgD/E,wEAAwE;AAExE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,YAAa,SAAQ,KAAK;IACrC,+DAA+D;IACtD,IAAI,CAAkB;IAE/B,wDAAwD;IAC/C,UAAU,CAAQ;IAE3B,mDAAmD;IAC1C,OAAO,CAA0B;IAE1C,YACE,IAAsB,EACtB,UAAkB,EAClB,OAAe,EACf,OAAiC;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF;AAtBD,oCAsBC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,GAAY;IACzC,OAAO,CACL,GAAG,YAAY,KAAK;QACpB,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc;YAC1B,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,cAAc;YACvC,CAAC,iBAAiB,IAAI,GAAG,IAAK,GAAW,CAAC,eAAe,KAAK,IAAI,CAAC;YACnE,CAAC,MAAM,IAAI,GAAG,IAAI,YAAY,IAAI,GAAG,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AA6OH,wCAQC;AAnPD,wEAAwE;AAExE,0BAA0B;AACb,QAAA,WAAW,GAAG,aAAsB,CAAA;AAEjD,wDAAwD;AAC3C,QAAA,mBAAmB,GAAG,qBAA8B,CAAA;AAGjE,qDAAqD;AACxC,QAAA,cAAc,GAAG,gBAAyB,CAAA;AACvD,8DAA8D;AACjD,QAAA,kBAAkB,GAAG,kBAA2B,CAAA;AAC7D,uEAAuE;AAC1D,QAAA,gBAAgB,GAAG,gBAAyB,CAAA;AAEzD,kDAAkD;AACrC,QAAA,WAAW,GAAG,aAAsB,CAAA;AAEjD,yDAAyD;AAC5C,QAAA,iBAAiB,GAAG,mBAA4B,CAAA;AAE7D,mCAAmC;AACtB,QAAA,cAAc,GAAG,gBAAyB,CAAA;AAEvD,gFAAgF;AACnE,QAAA,uBAAuB,GAAG,yBAAkC,CAAA;AAEzE,sFAAsF;AACzE,QAAA,6BAA6B,GAAG,+BAAwC,CAAA;AAErF,oDAAoD;AACvC,QAAA,mBAAmB,GAAG,qBAA8B,CAAA;AAEjE,uDAAuD;AAC1C,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAC/D;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,+CAA+C;AAClC,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,wBAAwB;AACX,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,2CAA2C;AAC9B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,wCAAwC;AAC3B,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,gCAAgC;AACnB,QAAA,sBAAsB,GAAG,sBAA+B,CAAA;AAErE,0BAA0B;AACb,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,qCAAqC;AACxB,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,yBAAyB;AACZ,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,+CAA+C;AAClC,QAAA,kBAAkB,GAAG,kBAA2B,CAAA;AAE7D;;;;;GAKG;AACU,QAAA,qBAAqB,GAAG,qBAA8B,CAAA;AAEnE,iDAAiD;AACpC,QAAA,YAAY,GAAG,cAAuB,CAAA;AAEnD,sEAAsE;AAEtE,4DAA4D;AAC/C,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,4CAA4C;AAC/B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,kDAAkD;AACrC,QAAA,oBAAoB,GAAG,oBAA6B,CAAA;AAEjE,+CAA+C;AAClC,QAAA,4BAA4B,GAAG,4BAAqC,CAAA;AAEjF,kDAAkD;AACrC,QAAA,qBAAqB,GAAG,qBAA8B,CAAA;AAEnE,2CAA2C;AAC9B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,4DAA4D;AAC/C,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,4DAA4D;AAC/C,QAAA,yBAAyB,GAAG,yBAAkC,CAAA;AAE3E,yDAAyD;AAC5C,QAAA,uBAAuB,GAAG,uBAAgC,CAAA;AAEvE;;;;;;GAMG;AACU,QAAA,kBAAkB,GAAG,kBAA2B,CAAA;AAE7D,uEAAuE;AAEvE;;;GAGG;AACU,QAAA,2BAA2B,GAAG,2BAAoC,CAAA;AAE/E,uEAAuE;AAEvE;;;GAGG;AACU,QAAA,2BAA2B,GAAG,2BAAoC,CAAA;AAoD/E,wEAAwE;AAExE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,YAAa,SAAQ,KAAK;IACrC,+DAA+D;IACtD,IAAI,CAAkB;IAE/B,wDAAwD;IAC/C,UAAU,CAAQ;IAE3B,mDAAmD;IAC1C,OAAO,CAA0B;IAE1C,YACE,IAAsB,EACtB,UAAkB,EAClB,OAAe,EACf,OAAiC;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF;AAtBD,oCAsBC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,GAAY;IACzC,OAAO,CACL,GAAG,YAAY,KAAK;QACpB,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc;YAC1B,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,cAAc;YACvC,CAAC,iBAAiB,IAAI,GAAG,IAAK,GAAW,CAAC,eAAe,KAAK,IAAI,CAAC;YACnE,CAAC,MAAM,IAAI,GAAG,IAAI,YAAY,IAAI,GAAG,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC"}