@intutic/shared-types 2.0.0 → 2.2.0

package/dist/api-contracts.d.ts

@@ -25,7 +25,7 @@ export declare const CreateSessionSchema: z.ZodObject<{
     /** Optional SOP to govern the session. */
     activeSopId: z.ZodOptional<z.ZodString>;
     /** Agent harness type. */
-    harnessType: z.ZodEnum<["cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot" | "langgraph" | "muse-code" | "grok" | "opencode" | "dsh" | "xirp" | "agentic-orchestrator" | "langchain" | "crewai" | "autogen" | "ag2" | "google-adk" | "openai-agents" | "pydantic-ai" | "smolagents" | "strands" | "mastra" | "vercel-ai-sdk" | "eve" | "trueforge" | "ai-sdk-harness" | "ai-sdk-workflow" | "agentcore-runtime" | "trueforge-server", ...("cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot" | "langgraph" | "muse-code" | "grok" | "opencode" | "dsh" | "xirp" | "agentic-orchestrator" | "langchain" | "crewai" | "autogen" | "ag2" | "google-adk" | "openai-agents" | "pydantic-ai" | "smolagents" | "strands" | "mastra" | "vercel-ai-sdk" | "eve" | "trueforge" | "ai-sdk-harness" | "ai-sdk-workflow" | "agentcore-runtime" | "trueforge-server")[]]>;
+    harnessType: z.ZodEnum<["cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot" | "langgraph" | "muse-code" | "grok" | "opencode" | "dsh" | "xirp" | "agentic-orchestrator" | "langchain" | "crewai" | "autogen" | "ag2" | "google-adk" | "openai-agents" | "pydantic-ai" | "smolagents" | "strands" | "agent-framework" | "mastra" | "vercel-ai-sdk" | "eve" | "trueforge" | "ai-sdk-harness" | "ai-sdk-workflow" | "agentcore-runtime" | "trueforge-server", ...("cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot" | "langgraph" | "muse-code" | "grok" | "opencode" | "dsh" | "xirp" | "agentic-orchestrator" | "langchain" | "crewai" | "autogen" | "ag2" | "google-adk" | "openai-agents" | "pydantic-ai" | "smolagents" | "strands" | "agent-framework" | "mastra" | "vercel-ai-sdk" | "eve" | "trueforge" | "ai-sdk-harness" | "ai-sdk-workflow" | "agentcore-runtime" | "trueforge-server")[]]>;
     /** Budget tier — defaults to JUNIOR on the server. */
     budgetTier: z.ZodOptional<z.ZodEnum<["JUNIOR" | "SENIOR" | "STAFF" | "PRINCIPAL", ...("JUNIOR" | "SENIOR" | "STAFF" | "PRINCIPAL")[]]>>;
     /** Execution mode — defaults to STANDARD on the server. */
@@ -42,7 +42,7 @@ export declare const CreateSessionSchema: z.ZodObject<{
 }, "strip", z.ZodTypeAny, {
     workspaceId: string;
     userId: string;
-    harnessType: "cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot" | "langgraph" | "muse-code" | "grok" | "opencode" | "dsh" | "xirp" | "agentic-orchestrator" | "langchain" | "crewai" | "autogen" | "ag2" | "google-adk" | "openai-agents" | "pydantic-ai" | "smolagents" | "strands" | "mastra" | "vercel-ai-sdk" | "eve" | "trueforge" | "ai-sdk-harness" | "ai-sdk-workflow" | "agentcore-runtime" | "trueforge-server";
+    harnessType: "cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot" | "langgraph" | "muse-code" | "grok" | "opencode" | "dsh" | "xirp" | "agentic-orchestrator" | "langchain" | "crewai" | "autogen" | "ag2" | "google-adk" | "openai-agents" | "pydantic-ai" | "smolagents" | "strands" | "agent-framework" | "mastra" | "vercel-ai-sdk" | "eve" | "trueforge" | "ai-sdk-harness" | "ai-sdk-workflow" | "agentcore-runtime" | "trueforge-server";
     projectId?: string | undefined;
     activeSopId?: string | undefined;
     budgetTier?: "JUNIOR" | "SENIOR" | "STAFF" | "PRINCIPAL" | undefined;
@@ -51,7 +51,7 @@ export declare const CreateSessionSchema: z.ZodObject<{
 }, {
     workspaceId: string;
     userId: string;
-    harnessType: "cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot" | "langgraph" | "muse-code" | "grok" | "opencode" | "dsh" | "xirp" | "agentic-orchestrator" | "langchain" | "crewai" | "autogen" | "ag2" | "google-adk" | "openai-agents" | "pydantic-ai" | "smolagents" | "strands" | "mastra" | "vercel-ai-sdk" | "eve" | "trueforge" | "ai-sdk-harness" | "ai-sdk-workflow" | "agentcore-runtime" | "trueforge-server";
+    harnessType: "cursor" | "claude-code" | "antigravity" | "n8n" | "codex" | "windsurf" | "aider" | "openhands" | "openclaw" | "hermes" | "pi" | "cline" | "roo-code" | "continue" | "claude-desktop" | "goose" | "open-webui" | "github-copilot" | "langgraph" | "muse-code" | "grok" | "opencode" | "dsh" | "xirp" | "agentic-orchestrator" | "langchain" | "crewai" | "autogen" | "ag2" | "google-adk" | "openai-agents" | "pydantic-ai" | "smolagents" | "strands" | "agent-framework" | "mastra" | "vercel-ai-sdk" | "eve" | "trueforge" | "ai-sdk-harness" | "ai-sdk-workflow" | "agentcore-runtime" | "trueforge-server";
     projectId?: string | undefined;
     activeSopId?: string | undefined;
     budgetTier?: "JUNIOR" | "SENIOR" | "STAFF" | "PRINCIPAL" | undefined;

package/dist/billing.d.ts

@@ -52,25 +52,4 @@ export interface ReconcileResult {
     /** Rows still FAILED after this run */
     stillFailed: number;
 }
-/**
- * Current period metered usage summary for a workspace.
- * Returned by GET /api/v1/billing/usage/current.
- */
-export interface BillingUsageSummary {
-    workspaceId: string;
-    /** Period start (ISO-8601) */
-    periodStart: string;
-    /** Period end (ISO-8601) */
-    periodEnd: string;
-    /** Total tokens consumed in the period */
-    tokensUsed: number;
-    /** Plan-included token volume */
-    tokensIncluded: number;
-    /** Tokens exceeding the included volume (max(0, used - included)) */
-    overageTokens: number;
-    /** Estimated overage charge (USD) */
-    estimatedOverageUsd: number;
-    /** True when budget:hard_block:{wid} Valkey key is set */
-    hardCapActive: boolean;
-}
 //# sourceMappingURL=billing.d.ts.map

package/dist/billing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;AAElE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,gDAAgD;IAChD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,gCAAgC;IAChC,MAAM,EAAE,kBAAkB,CAAA;IAC1B,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAA;CACpB;AAID;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,iCAAiC;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAA;IACrB,qCAAqC;IACrC,mBAAmB,EAAE,MAAM,CAAA;IAC3B,0DAA0D;IAC1D,aAAa,EAAE,OAAO,CAAA;CACvB"}
+{"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;AAElE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,gDAAgD;IAChD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,gCAAgC;IAChC,MAAM,EAAE,kBAAkB,CAAA;IAC1B,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAA;CACpB"}

package/dist/enums.d.ts

@@ -206,6 +206,15 @@ export declare const HarnessType: {
      *  provider (Bedrock, SigV4-signed via boto3) is NOT routable through the
      *  Intutic proxy — see apps/docs/integrations/strands.md. */
     readonly STRANDS: "strands";
+    /** Microsoft Agent Framework (`agent-framework` / `agent-framework-core` on
+     *  PyPI, imported as `agent_framework` — the AutoGen + Semantic Kernel
+     *  successor; a separate framework from AUTOGEN, see TD-375). Detected via
+     *  `agent-framework`/`agent_framework` in Python dependency manifests. Gate:
+     *  `intutic_clawde.gate.adapters.agent_framework`'s
+     *  `IntuticFunctionMiddleware`, a `FunctionMiddleware` that short-circuits
+     *  denied calls without `call_next()` (verified against a real
+     *  agent-framework-core==1.20.0 install). */
+    readonly AGENT_FRAMEWORK: "agent-framework";
     /** Detected via `@mastra/core`/`mastra` in `package.json`. Gate:
      *  `@intutic/gate/mastra`'s `intuticHooks()` — see that module's doc for
      *  the per-call-hooks-override bypass this framework's own design imposes. */
@@ -284,7 +293,7 @@ export declare const HarnessType: {
      * OR the local dev-loop config files the `agentcore` CLI (npm
      * `@aws/agentcore`, CONFIRMED at 0.27.0) and the Python
      * `bedrock-agentcore-starter-toolkit` (CONFIRMED at 0.3.11) write:
-     * `.bedrock_agentcore.yaml`, `agentcore/agentcore.json`, `aws-targets.json`
+     * `.bedrock_agentcore.yaml`, `agentcore/agentcore.json`, `agentcore/aws-targets.json`
      * — all three confirmed by extracting the real published tarballs/wheels
      * and grepping their compiled/source output for the literal filenames.
      *

package/dist/enums.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enums.d.ts","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,uEAAuE;AACvE,eAAO,MAAM,SAAS;;;;;CAKZ,CAAA;AAEV,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,CAAA;AAKhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,iBAAiB;;;;;;;CAOpB,CAAA;AAEV,8CAA8C;AAC9C,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAA;AAKxF,0EAA0E;AAC1E,eAAO,MAAM,YAAY;;;CAGf,CAAA;AAEV,yCAAyC;AACzC,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAA;AAKzE,kEAAkE;AAClE,eAAO,MAAM,UAAU;;;;;CAKb,CAAA;AAEV,uCAAuC;AACvC,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,MAAM,OAAO,UAAU,CAAC,CAAA;AAKnE,wDAAwD;AACxD,eAAO,MAAM,cAAc;;;;CAIjB,CAAA;AAEV,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAK/E,qEAAqE;AACrE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAA;AAEV,iDAAiD;AACjD,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAA;AAKjG;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,YAAY,EACV,eAAe,GAChB,MAAM,2BAA2B,CAAA;AAYlC,mDAAmD;AACnD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;IAoBtB,iFAAiF;;IAEjF,2EAA2E;;IAE3E;;;;+EAI2E;;IAE3E;;iEAE6D;;IAE7D;;;;;;;;OAQG;;IAEH;;;;;;;;;;;;;;;;;;;OAmBG;;IAOH;;;;;+DAK2D;;;IAG3D,0EAA0E;;;;IAI1E;;;;;;;;6DAQyD;;IAEzD,mDAAmD;;;IAGnD;;;;;;;iEAO6D;;IAQ7D;;kFAE8E;;IAE9E;;;4EAGwE;;IAExE;;;;;;;uDAOmD;;IAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;;IAQH;;;;;;;;0EAQsE;;IAEtE;;;;;;;;2BAQuB;;IAGvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;;IAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;;CAEK,CAAA;AAEV,wCAAwC;AACxC,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAA;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,QAAkC,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,sBAAsB,QAA4B,CAAA;AAK/D,uDAAuD;AACvD,eAAO,MAAM,aAAa;;;;;CAKhB,CAAA;AAEV,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,MAAM,OAAO,aAAa,CAAC,CAAA;AAK5E,gDAAgD;AAChD,eAAO,MAAM,cAAc;;;;;CAKjB,CAAA;AAEV,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAK/E,kDAAkD;AAClD,eAAO,MAAM,kBAAkB;;;;;;CAMrB,CAAA;AAEV,gDAAgD;AAChD,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAA;AAO3F,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAA;AAEV,kDAAkD;AAClD,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAA;AAMjG,gDAAgD;AAChD,eAAO,MAAM,iBAAiB;;;;;;;;CAQpB,CAAA;AAEV,+CAA+C;AAC/C,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAA;AAKxF,yDAAyD;AACzD,eAAO,MAAM,OAAO;IAClB,wDAAwD;;IAExD,sEAAsE;;CAE9D,CAAA;AAEV,oCAAoC;AACpC,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,CAAA;AAK1D,kDAAkD;AAClD,eAAO,MAAM,SAAS;IACpB,mCAAmC;;IAEnC,kCAAkC;;IAElC,yCAAyC;;IAEzC,mCAAmC;;CAE3B,CAAA;AAEV,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,CAAA;AAKhE,gDAAgD;AAChD,eAAO,MAAM,WAAW;;;;CAId,CAAA;AAEV,wCAAwC;AACxC,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAA;AAKtE,+EAA+E;AAC/E,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAA;AAEV,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,MAAM,OAAO,aAAa,CAAC,CAAA;AAM5E;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB;;;CAGvB,CAAA;AACV,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAA;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;CAGf,CAAA;AACV,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAA;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAA;AACV,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAA;AAKpG,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB;;;;CAItB,CAAA;AACV,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAE9F,oFAAoF;AACpF,eAAO,MAAM,kBAAkB;;;CAGrB,CAAA;AACV,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAA;AAE3F;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;CAIlB,CAAA;AACV,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA"}
+{"version":3,"file":"enums.d.ts","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,uEAAuE;AACvE,eAAO,MAAM,SAAS;;;;;CAKZ,CAAA;AAEV,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,CAAA;AAKhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,iBAAiB;;;;;;;CAOpB,CAAA;AAEV,8CAA8C;AAC9C,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAA;AAKxF,0EAA0E;AAC1E,eAAO,MAAM,YAAY;;;CAGf,CAAA;AAEV,yCAAyC;AACzC,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAA;AAKzE,kEAAkE;AAClE,eAAO,MAAM,UAAU;;;;;CAKb,CAAA;AAEV,uCAAuC;AACvC,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,MAAM,OAAO,UAAU,CAAC,CAAA;AAKnE,wDAAwD;AACxD,eAAO,MAAM,cAAc;;;;CAIjB,CAAA;AAEV,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAK/E,qEAAqE;AACrE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAA;AAEV,iDAAiD;AACjD,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAA;AAKjG;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,YAAY,EACV,eAAe,GAChB,MAAM,2BAA2B,CAAA;AAYlC,mDAAmD;AACnD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;IAoBtB,iFAAiF;;IAEjF,2EAA2E;;IAE3E;;;;+EAI2E;;IAE3E;;iEAE6D;;IAE7D;;;;;;;;OAQG;;IAEH;;;;;;;;;;;;;;;;;;;OAmBG;;IAOH;;;;;+DAK2D;;;IAG3D,0EAA0E;;;;IAI1E;;;;;;;;6DAQyD;;IAEzD,mDAAmD;;;IAGnD;;;;;;;iEAO6D;;IAE7D;;;;;;;iDAO6C;;IAQ7C;;kFAE8E;;IAE9E;;;4EAGwE;;IAExE;;;;;;;uDAOmD;;IAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;;IAQH;;;;;;;;0EAQsE;;IAEtE;;;;;;;;2BAQuB;;IAGvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;;IAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;;CAEK,CAAA;AAEV,wCAAwC;AACxC,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAA;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,QAAkC,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,sBAAsB,QAA4B,CAAA;AAK/D,uDAAuD;AACvD,eAAO,MAAM,aAAa;;;;;CAKhB,CAAA;AAEV,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,MAAM,OAAO,aAAa,CAAC,CAAA;AAK5E,gDAAgD;AAChD,eAAO,MAAM,cAAc;;;;;CAKjB,CAAA;AAEV,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAK/E,kDAAkD;AAClD,eAAO,MAAM,kBAAkB;;;;;;CAMrB,CAAA;AAEV,gDAAgD;AAChD,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAA;AAO3F,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAA;AAEV,kDAAkD;AAClD,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAA;AAMjG,gDAAgD;AAChD,eAAO,MAAM,iBAAiB;;;;;;;;CAQpB,CAAA;AAEV,+CAA+C;AAC/C,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAA;AAKxF,yDAAyD;AACzD,eAAO,MAAM,OAAO;IAClB,wDAAwD;;IAExD,sEAAsE;;CAE9D,CAAA;AAEV,oCAAoC;AACpC,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,CAAA;AAK1D,kDAAkD;AAClD,eAAO,MAAM,SAAS;IACpB,mCAAmC;;IAEnC,kCAAkC;;IAElC,yCAAyC;;IAEzC,mCAAmC;;CAE3B,CAAA;AAEV,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,CAAA;AAKhE,gDAAgD;AAChD,eAAO,MAAM,WAAW;;;;CAId,CAAA;AAEV,wCAAwC;AACxC,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAA;AAKtE,+EAA+E;AAC/E,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAA;AAEV,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,MAAM,OAAO,aAAa,CAAC,CAAA;AAM5E;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB;;;CAGvB,CAAA;AACV,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAA;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;CAGf,CAAA;AACV,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAA;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAA;AACV,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAA;AAKpG,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB;;;;CAItB,CAAA;AACV,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAE9F,oFAAoF;AACpF,eAAO,MAAM,kBAAkB;;;CAGrB,CAAA;AACV,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAA;AAE3F;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;CAIlB,CAAA;AACV,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA"}

package/dist/enums.js

@@ -225,6 +225,15 @@ exports.HarnessType = {
      *  provider (Bedrock, SigV4-signed via boto3) is NOT routable through the
      *  Intutic proxy — see apps/docs/integrations/strands.md. */
     STRANDS: 'strands',
+    /** Microsoft Agent Framework (`agent-framework` / `agent-framework-core` on
+     *  PyPI, imported as `agent_framework` — the AutoGen + Semantic Kernel
+     *  successor; a separate framework from AUTOGEN, see TD-375). Detected via
+     *  `agent-framework`/`agent_framework` in Python dependency manifests. Gate:
+     *  `intutic_clawde.gate.adapters.agent_framework`'s
+     *  `IntuticFunctionMiddleware`, a `FunctionMiddleware` that short-circuits
+     *  denied calls without `call_next()` (verified against a real
+     *  agent-framework-core==1.20.0 install). */
+    AGENT_FRAMEWORK: 'agent-framework',
     // ─── T2: JS/TS SDK-gated frameworks (no on-disk hook/config file) ───────
     // Same family as LANGCHAIN/LANGGRAPH above, but JS/TS-native: the blocking
     // gate ships in @intutic/gate (packages/gate-js), a subpath adapter per
@@ -316,7 +325,7 @@ exports.HarnessType = {
      * OR the local dev-loop config files the `agentcore` CLI (npm
      * `@aws/agentcore`, CONFIRMED at 0.27.0) and the Python
      * `bedrock-agentcore-starter-toolkit` (CONFIRMED at 0.3.11) write:
-     * `.bedrock_agentcore.yaml`, `agentcore/agentcore.json`, `aws-targets.json`
+     * `.bedrock_agentcore.yaml`, `agentcore/agentcore.json`, `agentcore/aws-targets.json`
      * — all three confirmed by extracting the real published tarballs/wheels
      * and grepping their compiled/source output for the literal filenames.
      *

package/dist/enums.js.map

@@ -1 +1 @@
-{"version":3,"file":"enums.js","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,wEAAwE;AACxE,uCAAuC;AAEvC,uEAAuE;AAC1D,QAAA,SAAS,GAAG;IACvB,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;CACZ,CAAA;AAKV,wEAAwE;AACxE,oDAAoD;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACU,QAAA,iBAAiB,GAAG;IAC/B,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;CACZ,CAAA;AAKV,wEAAwE;AACxE,+CAA+C;AAE/C,0EAA0E;AAC7D,QAAA,YAAY,GAAG;IAC1B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,wEAAwE;AACxE,6CAA6C;AAE7C,kEAAkE;AACrD,QAAA,UAAU,GAAG;IACxB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;CACd,CAAA;AAKV,wEAAwE;AACxE,4CAA4C;AAE5C,wDAAwD;AAC3C,QAAA,cAAc,GAAG;IAC5B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,uEAAuE;AACvE,kDAAkD;AAElD,qEAAqE;AACxD,QAAA,oBAAoB,GAAG;IAClC,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,wEAAwE;AACxE,wEAAwE;AAExE;;;;;;;;;GASG;AACH,8DAAuD;AAA9C,+GAAA,WAAW,OAAA;AAKpB,wEAAwE;AACxE,4DAA4D;AAC5D,sEAAsE;AACtE,qEAAqE;AACrE,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,qCAAqC;AAErC,mDAAmD;AACtC,QAAA,WAAW,GAAG;IACzB,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,IAAI;IACR,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,gBAAgB;IAChC,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,YAAY;IACxB,cAAc,EAAE,gBAAgB;IAChC,SAAS,EAAE,WAAW;IACtB,iFAAiF;IACjF,SAAS,EAAE,WAAW;IACtB,2EAA2E;IAC3E,IAAI,EAAE,MAAM;IACZ;;;;+EAI2E;IAC3E,QAAQ,EAAE,UAAU;IACpB;;iEAE6D;IAC7D,gBAAgB,EAAE,KAAK;IACvB;;;;;;;;OAQG;IACH,IAAI,EAAE,MAAM;IACZ;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oBAAoB,EAAE,sBAAsB;IAC5C,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,4EAA4E;IAC5E,oEAAoE;IACpE;;;;;+DAK2D;IAC3D,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,0EAA0E;IAC1E,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,YAAY;IACxB;;;;;;;;6DAQyD;IACzD,aAAa,EAAE,eAAe;IAC9B,mDAAmD;IACnD,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,YAAY;IACxB;;;;;;;iEAO6D;IAC7D,OAAO,EAAE,SAAS;IAClB,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE;IAClE,kEAAkE;IAClE,4EAA4E;IAC5E;;kFAE8E;IAC9E,MAAM,EAAE,QAAQ;IAChB;;;4EAGwE;IACxE,aAAa,EAAE,eAAe;IAC9B;;;;;;;uDAOmD;IACnD,GAAG,EAAE,KAAK;IACV;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,SAAS,EAAE,WAAW;IACtB,2EAA2E;IAC3E,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E;;;;;;;;0EAQsE;IACtE,cAAc,EAAE,gBAAgB;IAChC;;;;;;;;2BAQuB;IACvB,eAAe,EAAE,iBAAiB;IAClC,4EAA4E;IAC5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,iBAAiB,EAAE,mBAAmB;IACtC,2EAA2E;IAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,gBAAgB,EAAE,kBAAkB;CAC5B,CAAA;AAKV;;;;;;;GAOG;AACU,QAAA,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAW,CAAC,CAAC,MAAM,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACU,QAAA,sBAAsB,GAAG,qBAAa,GAAG,EAAE,CAAC,MAAM,CAAA;AAE/D,wEAAwE;AACxE,mCAAmC;AAEnC,uDAAuD;AAC1C,QAAA,aAAa,GAAG;IAC3B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;CAChB,CAAA;AAKV,wEAAwE;AACxE,uDAAuD;AAEvD,gDAAgD;AACnC,QAAA,cAAc,GAAG;IAC5B,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,cAAc;IAC5B,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,gBAAgB;CACxB,CAAA;AAKV,wEAAwE;AACxE,sDAAsD;AAEtD,kDAAkD;AACrC,QAAA,kBAAkB,GAAG;IAChC,gBAAgB,EAAE,kBAAkB;IACpC,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;CACd,CAAA;AAKV,wEAAwE;AACxE,8DAA8D;AAC9D,qEAAqE;AACrE,oEAAoE;AAEpE,4DAA4D;AAC/C,QAAA,oBAAoB,GAAG;IAClC,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;CACV,CAAA;AAKV,wEAAwE;AACxE,0EAA0E;AAC1E,uDAAuD;AAEvD,gDAAgD;AACnC,QAAA,iBAAiB,GAAG;IAC/B,KAAK,EAAE,OAAO;IACd,cAAc,EAAE,gBAAgB;IAChC,SAAS,EAAE,WAAW;IACtB,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,aAAa;CAClB,CAAA;AAKV,wEAAwE;AACxE,yDAAyD;AAEzD,yDAAyD;AAC5C,QAAA,OAAO,GAAG;IACrB,wDAAwD;IACxD,QAAQ,EAAE,UAAU;IACpB,sEAAsE;IACtE,IAAI,EAAE,MAAM;CACJ,CAAA;AAKV,wEAAwE;AACxE,sDAAsD;AAEtD,kDAAkD;AACrC,QAAA,SAAS,GAAG;IACvB,mCAAmC;IACnC,QAAQ,EAAE,UAAU;IACpB,kCAAkC;IAClC,SAAS,EAAE,WAAW;IACtB,yCAAyC;IACzC,YAAY,EAAE,cAAc;IAC5B,mCAAmC;IACnC,aAAa,EAAE,eAAe;CACtB,CAAA;AAKV,wEAAwE;AACxE,yDAAyD;AAEzD,gDAAgD;AACnC,QAAA,WAAW,GAAG;IACzB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;CACN,CAAA;AAKV,wEAAwE;AACxE,yCAAyC;AAEzC,+EAA+E;AAClE,QAAA,aAAa,GAAG;IAC3B,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,EAAE,EAAE,IAAI;IACR,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,wEAAwE;AACxE,sEAAsE;AACtE,yCAAyC;AAEzC;;;;;;;;;GASG;AACU,QAAA,oBAAoB,GAAG;IAClC,IAAI,EAAI,MAAM;IACd,MAAM,EAAE,QAAQ;CACR,CAAA;AAGV;;;;;;;GAOG;AACU,QAAA,YAAY,GAAG;IAC1B,WAAW,EAAE,aAAa;IAC1B,MAAM,EAAO,QAAQ;CACb,CAAA;AAGV;;;;;;;;GAQG;AACU,QAAA,qBAAqB,GAAG;IACnC,OAAO,EAAK,SAAS;IACrB,SAAS,EAAG,WAAW;IACvB,UAAU,EAAE,YAAY;CAChB,CAAA;AAGV,wEAAwE;AACxE,wCAAwC;AAExC,8DAA8D;AACjD,QAAA,mBAAmB,GAAG;IACjC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,aAAa,EAAG,eAAe;CACvB,CAAA;AAGV,oFAAoF;AACvE,QAAA,kBAAkB,GAAG;IAChC,QAAQ,EAAmB,UAAU;IACrC,yBAAyB,EAAE,2BAA2B;CAC9C,CAAA;AAGV;;;;;;;;;GASG;AACU,QAAA,eAAe,GAAG;IAC7B,eAAe,EAAE,iBAAiB;IAClC,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,aAAa;CAClB,CAAA"}
+{"version":3,"file":"enums.js","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAEH,wEAAwE;AACxE,uCAAuC;AAEvC,uEAAuE;AAC1D,QAAA,SAAS,GAAG;IACvB,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;CACZ,CAAA;AAKV,wEAAwE;AACxE,oDAAoD;AAEpD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACU,QAAA,iBAAiB,GAAG;IAC/B,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;CACZ,CAAA;AAKV,wEAAwE;AACxE,+CAA+C;AAE/C,0EAA0E;AAC7D,QAAA,YAAY,GAAG;IAC1B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,wEAAwE;AACxE,6CAA6C;AAE7C,kEAAkE;AACrD,QAAA,UAAU,GAAG;IACxB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;CACd,CAAA;AAKV,wEAAwE;AACxE,4CAA4C;AAE5C,wDAAwD;AAC3C,QAAA,cAAc,GAAG;IAC5B,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,uEAAuE;AACvE,kDAAkD;AAElD,qEAAqE;AACxD,QAAA,oBAAoB,GAAG;IAClC,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,wEAAwE;AACxE,wEAAwE;AAExE;;;;;;;;;GASG;AACH,8DAAuD;AAA9C,+GAAA,WAAW,OAAA;AAKpB,wEAAwE;AACxE,4DAA4D;AAC5D,sEAAsE;AACtE,qEAAqE;AACrE,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,qCAAqC;AAErC,mDAAmD;AACtC,QAAA,WAAW,GAAG;IACzB,MAAM,EAAE,QAAQ;IAChB,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,KAAK,EAAE,OAAO;IACd,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;IACpB,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,IAAI;IACR,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,gBAAgB;IAChC,KAAK,EAAE,OAAO;IACd,UAAU,EAAE,YAAY;IACxB,cAAc,EAAE,gBAAgB;IAChC,SAAS,EAAE,WAAW;IACtB,iFAAiF;IACjF,SAAS,EAAE,WAAW;IACtB,2EAA2E;IAC3E,IAAI,EAAE,MAAM;IACZ;;;;+EAI2E;IAC3E,QAAQ,EAAE,UAAU;IACpB;;iEAE6D;IAC7D,gBAAgB,EAAE,KAAK;IACvB;;;;;;;;OAQG;IACH,IAAI,EAAE,MAAM;IACZ;;;;;;;;;;;;;;;;;;;OAmBG;IACH,oBAAoB,EAAE,sBAAsB;IAC5C,4EAA4E;IAC5E,sEAAsE;IACtE,4EAA4E;IAC5E,4EAA4E;IAC5E,oEAAoE;IACpE;;;;;+DAK2D;IAC3D,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,0EAA0E;IAC1E,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,YAAY;IACxB;;;;;;;;6DAQyD;IACzD,aAAa,EAAE,eAAe;IAC9B,mDAAmD;IACnD,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,YAAY;IACxB;;;;;;;iEAO6D;IAC7D,OAAO,EAAE,SAAS;IAClB;;;;;;;iDAO6C;IAC7C,eAAe,EAAE,iBAAiB;IAClC,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,kEAAkE;IAClE,kEAAkE;IAClE,4EAA4E;IAC5E;;kFAE8E;IAC9E,MAAM,EAAE,QAAQ;IAChB;;;4EAGwE;IACxE,aAAa,EAAE,eAAe;IAC9B;;;;;;;uDAOmD;IACnD,GAAG,EAAE,KAAK;IACV;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,SAAS,EAAE,WAAW;IACtB,2EAA2E;IAC3E,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,yEAAyE;IACzE,2EAA2E;IAC3E;;;;;;;;0EAQsE;IACtE,cAAc,EAAE,gBAAgB;IAChC;;;;;;;;2BAQuB;IACvB,eAAe,EAAE,iBAAiB;IAClC,4EAA4E;IAC5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;IACH,iBAAiB,EAAE,mBAAmB;IACtC,2EAA2E;IAC3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;IACH,gBAAgB,EAAE,kBAAkB;CAC5B,CAAA;AAKV;;;;;;;GAOG;AACU,QAAA,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAW,CAAC,CAAC,MAAM,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACU,QAAA,sBAAsB,GAAG,qBAAa,GAAG,EAAE,CAAC,MAAM,CAAA;AAE/D,wEAAwE;AACxE,mCAAmC;AAEnC,uDAAuD;AAC1C,QAAA,aAAa,GAAG;IAC3B,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;CAChB,CAAA;AAKV,wEAAwE;AACxE,uDAAuD;AAEvD,gDAAgD;AACnC,QAAA,cAAc,GAAG;IAC5B,IAAI,EAAE,MAAM;IACZ,YAAY,EAAE,cAAc;IAC5B,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,gBAAgB;CACxB,CAAA;AAKV,wEAAwE;AACxE,sDAAsD;AAEtD,kDAAkD;AACrC,QAAA,kBAAkB,GAAG;IAChC,gBAAgB,EAAE,kBAAkB;IACpC,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;CACd,CAAA;AAKV,wEAAwE;AACxE,8DAA8D;AAC9D,qEAAqE;AACrE,oEAAoE;AAEpE,4DAA4D;AAC/C,QAAA,oBAAoB,GAAG;IAClC,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;CACV,CAAA;AAKV,wEAAwE;AACxE,0EAA0E;AAC1E,uDAAuD;AAEvD,gDAAgD;AACnC,QAAA,iBAAiB,GAAG;IAC/B,KAAK,EAAE,OAAO;IACd,cAAc,EAAE,gBAAgB;IAChC,SAAS,EAAE,WAAW;IACtB,YAAY,EAAE,cAAc;IAC5B,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,aAAa;CAClB,CAAA;AAKV,wEAAwE;AACxE,yDAAyD;AAEzD,yDAAyD;AAC5C,QAAA,OAAO,GAAG;IACrB,wDAAwD;IACxD,QAAQ,EAAE,UAAU;IACpB,sEAAsE;IACtE,IAAI,EAAE,MAAM;CACJ,CAAA;AAKV,wEAAwE;AACxE,sDAAsD;AAEtD,kDAAkD;AACrC,QAAA,SAAS,GAAG;IACvB,mCAAmC;IACnC,QAAQ,EAAE,UAAU;IACpB,kCAAkC;IAClC,SAAS,EAAE,WAAW;IACtB,yCAAyC;IACzC,YAAY,EAAE,cAAc;IAC5B,mCAAmC;IACnC,aAAa,EAAE,eAAe;CACtB,CAAA;AAKV,wEAAwE;AACxE,yDAAyD;AAEzD,gDAAgD;AACnC,QAAA,WAAW,GAAG;IACzB,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;CACN,CAAA;AAKV,wEAAwE;AACxE,yCAAyC;AAEzC,+EAA+E;AAClE,QAAA,aAAa,GAAG;IAC3B,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,EAAE,EAAE,IAAI;IACR,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;CACR,CAAA;AAKV,wEAAwE;AACxE,sEAAsE;AACtE,yCAAyC;AAEzC;;;;;;;;;GASG;AACU,QAAA,oBAAoB,GAAG;IAClC,IAAI,EAAI,MAAM;IACd,MAAM,EAAE,QAAQ;CACR,CAAA;AAGV;;;;;;;GAOG;AACU,QAAA,YAAY,GAAG;IAC1B,WAAW,EAAE,aAAa;IAC1B,MAAM,EAAO,QAAQ;CACb,CAAA;AAGV;;;;;;;;GAQG;AACU,QAAA,qBAAqB,GAAG;IACnC,OAAO,EAAK,SAAS;IACrB,SAAS,EAAG,WAAW;IACvB,UAAU,EAAE,YAAY;CAChB,CAAA;AAGV,wEAAwE;AACxE,wCAAwC;AAExC,8DAA8D;AACjD,QAAA,mBAAmB,GAAG;IACjC,cAAc,EAAE,gBAAgB;IAChC,cAAc,EAAE,gBAAgB;IAChC,aAAa,EAAG,eAAe;CACvB,CAAA;AAGV,oFAAoF;AACvE,QAAA,kBAAkB,GAAG;IAChC,QAAQ,EAAmB,UAAU;IACrC,yBAAyB,EAAE,2BAA2B;CAC9C,CAAA;AAGV;;;;;;;;;GASG;AACU,QAAA,eAAe,GAAG;IAC7B,eAAe,EAAE,iBAAiB;IAClC,QAAQ,EAAE,UAAU;IACpB,WAAW,EAAE,aAAa;CAClB,CAAA"}

package/dist/errors.d.ts

@@ -31,6 +31,12 @@ export declare const E_APPROVAL_RATIONALE_REQUIRED: "E_APPROVAL_RATIONALE_REQUIR
 export declare const E_VALIDATION_FAILED: "E_VALIDATION_FAILED";
 /** Stripe/billing checkout disabled or unavailable. */
 export declare const E_CHECKOUT_DISABLED: "CHECKOUT_DISABLED";
+/**
+ * Plans are not sold through checkout on this deployment: Stripe is still in
+ * test mode, so a checkout would sell a plan for a test card. Plans are
+ * bought through sales until Stripe is live.
+ */
+export declare const E_CHECKOUT_UNAVAILABLE: "CHECKOUT_UNAVAILABLE";
 /**
  * Self-serve account provisioning is switched off for this deployment.
  *
@@ -44,6 +50,10 @@ export declare const E_SIGNUP_DISABLED: "SIGNUP_DISABLED";
 export declare const E_ALREADY_ON_TIER: "ALREADY_ON_TIER";
 /** Stripe API error. */
 export declare const E_STRIPE_ERROR: "STRIPE_ERROR";
+/** A plan change the subscription cannot make in place (e.g. a seat plan to usage-based Self-serve). */
+export declare const E_PLAN_CHANGE_UNSUPPORTED: "PLAN_CHANGE_UNSUPPORTED";
+/** The workspace's plan comes from its organization's subscription; it cannot buy one of its own. */
+export declare const E_PLAN_FROM_ORG: "PLAN_FROM_ORG";
 /** Webhook signature validation failed. */
 export declare const E_SIGNATURE_INVALID: "SIGNATURE_INVALID";
 /** Workspace free trial has expired. */
@@ -111,7 +121,7 @@ export declare const E_OVERAGE_HARD_CAP_EXCEEDED: "OVERAGE_HARD_CAP_EXCEEDED";
  * function handle(code: IntuticErrorCode) { ... }
  * ```
  */
-export type IntuticErrorCode = typeof E_NOT_FOUND | typeof E_CACHE_UNAVAILABLE | typeof E_UNAUTHORIZED | typeof E_SCIM_AUTH_FAILED | typeof E_SCIM_DUPLICATE | typeof E_FORBIDDEN | typeof E_BUDGET_EXCEEDED | typeof E_RATE_LIMITED | typeof E_APPEND_ONLY_VIOLATION | typeof E_APPROVAL_RATIONALE_REQUIRED | typeof E_VALIDATION_FAILED | typeof E_CHECKOUT_DISABLED | typeof E_SIGNUP_DISABLED | typeof E_DOMAIN_NOT_VERIFIED | typeof E_ALREADY_ON_TIER | typeof E_STRIPE_ERROR | typeof E_SIGNATURE_INVALID | typeof E_TRIAL_EXPIRED | typeof E_EMAIL_ALREADY_EXISTS | typeof E_OAUTH_FAILED | typeof E_TOKEN_INVALID | typeof E_TOKEN_EXPIRED | typeof E_ALREADY_VERIFIED | typeof E_VALIDATION | typeof E_SSO_DISABLED | typeof E_SSO_NO_MEMBERSHIP | typeof E_OIDC_INVALID_STATE | typeof E_OIDC_TOKEN_EXCHANGE_FAILED | typeof E_OIDC_CLAIMS_MISSING | typeof E_PROVIDER_DISABLED | typeof E_PROVIDER_IN_USE | typeof E_OFFBOARDING_IN_PROGRESS | typeof E_FEATURE_NOT_AVAILABLE | typeof E_SSL_NOT_ENFORCED | typeof E_ATTENUATION_CAP_VIOLATION | typeof E_OVERAGE_HARD_CAP_EXCEEDED;
+export type IntuticErrorCode = typeof E_NOT_FOUND | typeof E_CACHE_UNAVAILABLE | typeof E_UNAUTHORIZED | typeof E_SCIM_AUTH_FAILED | typeof E_SCIM_DUPLICATE | typeof E_FORBIDDEN | typeof E_BUDGET_EXCEEDED | typeof E_RATE_LIMITED | typeof E_APPEND_ONLY_VIOLATION | typeof E_APPROVAL_RATIONALE_REQUIRED | typeof E_VALIDATION_FAILED | typeof E_CHECKOUT_DISABLED | typeof E_CHECKOUT_UNAVAILABLE | typeof E_SIGNUP_DISABLED | typeof E_DOMAIN_NOT_VERIFIED | typeof E_ALREADY_ON_TIER | typeof E_STRIPE_ERROR | typeof E_PLAN_CHANGE_UNSUPPORTED | typeof E_PLAN_FROM_ORG | typeof E_SIGNATURE_INVALID | typeof E_TRIAL_EXPIRED | typeof E_EMAIL_ALREADY_EXISTS | typeof E_OAUTH_FAILED | typeof E_TOKEN_INVALID | typeof E_TOKEN_EXPIRED | typeof E_ALREADY_VERIFIED | typeof E_VALIDATION | typeof E_SSO_DISABLED | typeof E_SSO_NO_MEMBERSHIP | typeof E_OIDC_INVALID_STATE | typeof E_OIDC_TOKEN_EXCHANGE_FAILED | typeof E_OIDC_CLAIMS_MISSING | typeof E_PROVIDER_DISABLED | typeof E_PROVIDER_IN_USE | typeof E_OFFBOARDING_IN_PROGRESS | typeof E_FEATURE_NOT_AVAILABLE | typeof E_SSL_NOT_ENFORCED | typeof E_ATTENUATION_CAP_VIOLATION | typeof E_OVERAGE_HARD_CAP_EXCEEDED;
 /**
  * Structured error class used across all Intutic services.
  *

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,0BAA0B;AAC1B,eAAO,MAAM,WAAW,EAAG,aAAsB,CAAA;AAEjD,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,EAAG,qBAA8B,CAAA;AAGjE,qDAAqD;AACrD,eAAO,MAAM,cAAc,EAAG,gBAAyB,CAAA;AACvD,8DAA8D;AAC9D,eAAO,MAAM,kBAAkB,EAAG,kBAA2B,CAAA;AAC7D,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,EAAG,gBAAyB,CAAA;AAEzD,kDAAkD;AAClD,eAAO,MAAM,WAAW,EAAG,aAAsB,CAAA;AAEjD,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,EAAG,mBAA4B,CAAA;AAE7D,mCAAmC;AACnC,eAAO,MAAM,cAAc,EAAG,gBAAyB,CAAA;AAEvD,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAA;AAEzE,sFAAsF;AACtF,eAAO,MAAM,6BAA6B,EAAG,+BAAwC,CAAA;AAErF,oDAAoD;AACpD,eAAO,MAAM,mBAAmB,EAAG,qBAA8B,CAAA;AAEjE,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAC/D;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,wBAAwB;AACxB,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,wCAAwC;AACxC,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,gCAAgC;AAChC,eAAO,MAAM,sBAAsB,EAAG,sBAA+B,CAAA;AAErE,0BAA0B;AAC1B,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,qCAAqC;AACrC,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,yBAAyB;AACzB,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,EAAG,kBAA2B,CAAA;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAG,qBAA8B,CAAA;AAEnE,iDAAiD;AACjD,eAAO,MAAM,YAAY,EAAG,cAAuB,CAAA;AAInD,4DAA4D;AAC5D,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAA;AAEjE,+CAA+C;AAC/C,eAAO,MAAM,4BAA4B,EAAG,4BAAqC,CAAA;AAEjF,kDAAkD;AAClD,eAAO,MAAM,qBAAqB,EAAG,qBAA8B,CAAA;AAEnE,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,4DAA4D;AAC5D,eAAO,MAAM,yBAAyB,EAAG,yBAAkC,CAAA;AAE3E,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,EAAG,uBAAgC,CAAA;AAEvE;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAG,kBAA2B,CAAA;AAI7D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAG,2BAAoC,CAAA;AAI/E;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAG,2BAAoC,CAAA;AAE/E;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB,OAAO,WAAW,GAClB,OAAO,mBAAmB,GAE1B,OAAO,cAAc,GACrB,OAAO,kBAAkB,GACzB,OAAO,gBAAgB,GACvB,OAAO,WAAW,GAClB,OAAO,iBAAiB,GACxB,OAAO,cAAc,GACrB,OAAO,uBAAuB,GAC9B,OAAO,6BAA6B,GACpC,OAAO,mBAAmB,GAC1B,OAAO,mBAAmB,GAC1B,OAAO,iBAAiB,GACxB,OAAO,qBAAqB,GAC5B,OAAO,iBAAiB,GACxB,OAAO,cAAc,GACrB,OAAO,mBAAmB,GAC1B,OAAO,eAAe,GACtB,OAAO,sBAAsB,GAC7B,OAAO,cAAc,GACrB,OAAO,eAAe,GACtB,OAAO,eAAe,GACtB,OAAO,kBAAkB,GACzB,OAAO,YAAY,GAEnB,OAAO,cAAc,GACrB,OAAO,mBAAmB,GAC1B,OAAO,oBAAoB,GAC3B,OAAO,4BAA4B,GACnC,OAAO,qBAAqB,GAC5B,OAAO,mBAAmB,GAC1B,OAAO,iBAAiB,GACxB,OAAO,yBAAyB,GAChC,OAAO,uBAAuB,GAC9B,OAAO,kBAAkB,GAEzB,OAAO,2BAA2B,GAElC,OAAO,2BAA2B,CAAA;AAItC;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAE/B,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gBAGxC,IAAI,EAAE,gBAAgB,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQpC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,CAQhE"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,0BAA0B;AAC1B,eAAO,MAAM,WAAW,EAAG,aAAsB,CAAA;AAEjD,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,EAAG,qBAA8B,CAAA;AAGjE,qDAAqD;AACrD,eAAO,MAAM,cAAc,EAAG,gBAAyB,CAAA;AACvD,8DAA8D;AAC9D,eAAO,MAAM,kBAAkB,EAAG,kBAA2B,CAAA;AAC7D,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,EAAG,gBAAyB,CAAA;AAEzD,kDAAkD;AAClD,eAAO,MAAM,WAAW,EAAG,aAAsB,CAAA;AAEjD,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,EAAG,mBAA4B,CAAA;AAE7D,mCAAmC;AACnC,eAAO,MAAM,cAAc,EAAG,gBAAyB,CAAA;AAEvD,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAA;AAEzE,sFAAsF;AACtF,eAAO,MAAM,6BAA6B,EAAG,+BAAwC,CAAA;AAErF,oDAAoD;AACpD,eAAO,MAAM,mBAAmB,EAAG,qBAA8B,CAAA;AAEjE,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAG,sBAA+B,CAAA;AACrE;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,wBAAwB;AACxB,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,wGAAwG;AACxG,eAAO,MAAM,yBAAyB,EAAG,yBAAkC,CAAA;AAE3E,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,wCAAwC;AACxC,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,gCAAgC;AAChC,eAAO,MAAM,sBAAsB,EAAG,sBAA+B,CAAA;AAErE,0BAA0B;AAC1B,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,qCAAqC;AACrC,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,yBAAyB;AACzB,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,EAAG,kBAA2B,CAAA;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAG,qBAA8B,CAAA;AAEnE,iDAAiD;AACjD,eAAO,MAAM,YAAY,EAAG,cAAuB,CAAA;AAInD,4DAA4D;AAC5D,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAA;AAEjE,+CAA+C;AAC/C,eAAO,MAAM,4BAA4B,EAAG,4BAAqC,CAAA;AAEjF,kDAAkD;AAClD,eAAO,MAAM,qBAAqB,EAAG,qBAA8B,CAAA;AAEnE,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,4DAA4D;AAC5D,eAAO,MAAM,yBAAyB,EAAG,yBAAkC,CAAA;AAE3E,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,EAAG,uBAAgC,CAAA;AAEvE;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAG,kBAA2B,CAAA;AAI7D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAG,2BAAoC,CAAA;AAI/E;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAG,2BAAoC,CAAA;AAE/E;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB,OAAO,WAAW,GAClB,OAAO,mBAAmB,GAE1B,OAAO,cAAc,GACrB,OAAO,kBAAkB,GACzB,OAAO,gBAAgB,GACvB,OAAO,WAAW,GAClB,OAAO,iBAAiB,GACxB,OAAO,cAAc,GACrB,OAAO,uBAAuB,GAC9B,OAAO,6BAA6B,GACpC,OAAO,mBAAmB,GAC1B,OAAO,mBAAmB,GAC1B,OAAO,sBAAsB,GAC7B,OAAO,iBAAiB,GACxB,OAAO,qBAAqB,GAC5B,OAAO,iBAAiB,GACxB,OAAO,cAAc,GACrB,OAAO,yBAAyB,GAChC,OAAO,eAAe,GACtB,OAAO,mBAAmB,GAC1B,OAAO,eAAe,GACtB,OAAO,sBAAsB,GAC7B,OAAO,cAAc,GACrB,OAAO,eAAe,GACtB,OAAO,eAAe,GACtB,OAAO,kBAAkB,GACzB,OAAO,YAAY,GAEnB,OAAO,cAAc,GACrB,OAAO,mBAAmB,GAC1B,OAAO,oBAAoB,GAC3B,OAAO,4BAA4B,GACnC,OAAO,qBAAqB,GAC5B,OAAO,mBAAmB,GAC1B,OAAO,iBAAiB,GACxB,OAAO,yBAAyB,GAChC,OAAO,uBAAuB,GAC9B,OAAO,kBAAkB,GAEzB,OAAO,2BAA2B,GAElC,OAAO,2BAA2B,CAAA;AAItC;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAE/B,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gBAGxC,IAAI,EAAE,gBAAgB,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQpC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,CAQhE"}

package/dist/errors.js

@@ -9,7 +9,7 @@
  * @module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IntuticError = exports.E_OVERAGE_HARD_CAP_EXCEEDED = exports.E_ATTENUATION_CAP_VIOLATION = exports.E_SSL_NOT_ENFORCED = exports.E_FEATURE_NOT_AVAILABLE = exports.E_OFFBOARDING_IN_PROGRESS = exports.E_PROVIDER_IN_USE = exports.E_PROVIDER_DISABLED = exports.E_OIDC_CLAIMS_MISSING = exports.E_OIDC_TOKEN_EXCHANGE_FAILED = exports.E_OIDC_INVALID_STATE = exports.E_SSO_NO_MEMBERSHIP = exports.E_SSO_DISABLED = exports.E_VALIDATION = exports.E_DOMAIN_NOT_VERIFIED = exports.E_ALREADY_VERIFIED = exports.E_TOKEN_EXPIRED = exports.E_TOKEN_INVALID = exports.E_OAUTH_FAILED = exports.E_EMAIL_ALREADY_EXISTS = exports.E_TRIAL_EXPIRED = exports.E_SIGNATURE_INVALID = exports.E_STRIPE_ERROR = exports.E_ALREADY_ON_TIER = exports.E_SIGNUP_DISABLED = exports.E_CHECKOUT_DISABLED = exports.E_VALIDATION_FAILED = exports.E_APPROVAL_RATIONALE_REQUIRED = exports.E_APPEND_ONLY_VIOLATION = exports.E_RATE_LIMITED = exports.E_BUDGET_EXCEEDED = exports.E_FORBIDDEN = exports.E_SCIM_DUPLICATE = exports.E_SCIM_AUTH_FAILED = exports.E_UNAUTHORIZED = exports.E_CACHE_UNAVAILABLE = exports.E_NOT_FOUND = void 0;
+exports.IntuticError = exports.E_OVERAGE_HARD_CAP_EXCEEDED = exports.E_ATTENUATION_CAP_VIOLATION = exports.E_SSL_NOT_ENFORCED = exports.E_FEATURE_NOT_AVAILABLE = exports.E_OFFBOARDING_IN_PROGRESS = exports.E_PROVIDER_IN_USE = exports.E_PROVIDER_DISABLED = exports.E_OIDC_CLAIMS_MISSING = exports.E_OIDC_TOKEN_EXCHANGE_FAILED = exports.E_OIDC_INVALID_STATE = exports.E_SSO_NO_MEMBERSHIP = exports.E_SSO_DISABLED = exports.E_VALIDATION = exports.E_DOMAIN_NOT_VERIFIED = exports.E_ALREADY_VERIFIED = exports.E_TOKEN_EXPIRED = exports.E_TOKEN_INVALID = exports.E_OAUTH_FAILED = exports.E_EMAIL_ALREADY_EXISTS = exports.E_TRIAL_EXPIRED = exports.E_SIGNATURE_INVALID = exports.E_PLAN_FROM_ORG = exports.E_PLAN_CHANGE_UNSUPPORTED = exports.E_STRIPE_ERROR = exports.E_ALREADY_ON_TIER = exports.E_SIGNUP_DISABLED = exports.E_CHECKOUT_UNAVAILABLE = exports.E_CHECKOUT_DISABLED = exports.E_VALIDATION_FAILED = exports.E_APPROVAL_RATIONALE_REQUIRED = exports.E_APPEND_ONLY_VIOLATION = exports.E_RATE_LIMITED = exports.E_BUDGET_EXCEEDED = exports.E_FORBIDDEN = exports.E_SCIM_DUPLICATE = exports.E_SCIM_AUTH_FAILED = exports.E_UNAUTHORIZED = exports.E_CACHE_UNAVAILABLE = exports.E_NOT_FOUND = void 0;
 exports.isIntuticError = isIntuticError;
 // ─── Error Code Constants ────────────────────────────────────────────
 /** Resource not found. */
@@ -36,6 +36,12 @@ exports.E_APPROVAL_RATIONALE_REQUIRED = 'E_APPROVAL_RATIONALE_REQUIRED';
 exports.E_VALIDATION_FAILED = 'E_VALIDATION_FAILED';
 /** Stripe/billing checkout disabled or unavailable. */
 exports.E_CHECKOUT_DISABLED = 'CHECKOUT_DISABLED';
+/**
+ * Plans are not sold through checkout on this deployment: Stripe is still in
+ * test mode, so a checkout would sell a plan for a test card. Plans are
+ * bought through sales until Stripe is live.
+ */
+exports.E_CHECKOUT_UNAVAILABLE = 'CHECKOUT_UNAVAILABLE';
 /**
  * Self-serve account provisioning is switched off for this deployment.
  *
@@ -49,6 +55,10 @@ exports.E_SIGNUP_DISABLED = 'SIGNUP_DISABLED';
 exports.E_ALREADY_ON_TIER = 'ALREADY_ON_TIER';
 /** Stripe API error. */
 exports.E_STRIPE_ERROR = 'STRIPE_ERROR';
+/** A plan change the subscription cannot make in place (e.g. a seat plan to usage-based Self-serve). */
+exports.E_PLAN_CHANGE_UNSUPPORTED = 'PLAN_CHANGE_UNSUPPORTED';
+/** The workspace's plan comes from its organization's subscription; it cannot buy one of its own. */
+exports.E_PLAN_FROM_ORG = 'PLAN_FROM_ORG';
 /** Webhook signature validation failed. */
 exports.E_SIGNATURE_INVALID = 'SIGNATURE_INVALID';
 /** Workspace free trial has expired. */

package/dist/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AA6OH,wCAQC;AAnPD,wEAAwE;AAExE,0BAA0B;AACb,QAAA,WAAW,GAAG,aAAsB,CAAA;AAEjD,wDAAwD;AAC3C,QAAA,mBAAmB,GAAG,qBAA8B,CAAA;AAGjE,qDAAqD;AACxC,QAAA,cAAc,GAAG,gBAAyB,CAAA;AACvD,8DAA8D;AACjD,QAAA,kBAAkB,GAAG,kBAA2B,CAAA;AAC7D,uEAAuE;AAC1D,QAAA,gBAAgB,GAAG,gBAAyB,CAAA;AAEzD,kDAAkD;AACrC,QAAA,WAAW,GAAG,aAAsB,CAAA;AAEjD,yDAAyD;AAC5C,QAAA,iBAAiB,GAAG,mBAA4B,CAAA;AAE7D,mCAAmC;AACtB,QAAA,cAAc,GAAG,gBAAyB,CAAA;AAEvD,gFAAgF;AACnE,QAAA,uBAAuB,GAAG,yBAAkC,CAAA;AAEzE,sFAAsF;AACzE,QAAA,6BAA6B,GAAG,+BAAwC,CAAA;AAErF,oDAAoD;AACvC,QAAA,mBAAmB,GAAG,qBAA8B,CAAA;AAEjE,uDAAuD;AAC1C,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAC/D;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,+CAA+C;AAClC,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,wBAAwB;AACX,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,2CAA2C;AAC9B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,wCAAwC;AAC3B,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,gCAAgC;AACnB,QAAA,sBAAsB,GAAG,sBAA+B,CAAA;AAErE,0BAA0B;AACb,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,qCAAqC;AACxB,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,yBAAyB;AACZ,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,+CAA+C;AAClC,QAAA,kBAAkB,GAAG,kBAA2B,CAAA;AAE7D;;;;;GAKG;AACU,QAAA,qBAAqB,GAAG,qBAA8B,CAAA;AAEnE,iDAAiD;AACpC,QAAA,YAAY,GAAG,cAAuB,CAAA;AAEnD,sEAAsE;AAEtE,4DAA4D;AAC/C,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,4CAA4C;AAC/B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,kDAAkD;AACrC,QAAA,oBAAoB,GAAG,oBAA6B,CAAA;AAEjE,+CAA+C;AAClC,QAAA,4BAA4B,GAAG,4BAAqC,CAAA;AAEjF,kDAAkD;AACrC,QAAA,qBAAqB,GAAG,qBAA8B,CAAA;AAEnE,2CAA2C;AAC9B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,4DAA4D;AAC/C,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,4DAA4D;AAC/C,QAAA,yBAAyB,GAAG,yBAAkC,CAAA;AAE3E,yDAAyD;AAC5C,QAAA,uBAAuB,GAAG,uBAAgC,CAAA;AAEvE;;;;;;GAMG;AACU,QAAA,kBAAkB,GAAG,kBAA2B,CAAA;AAE7D,uEAAuE;AAEvE;;;GAGG;AACU,QAAA,2BAA2B,GAAG,2BAAoC,CAAA;AAE/E,uEAAuE;AAEvE;;;GAGG;AACU,QAAA,2BAA2B,GAAG,2BAAoC,CAAA;AAoD/E,wEAAwE;AAExE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,YAAa,SAAQ,KAAK;IACrC,+DAA+D;IACtD,IAAI,CAAkB;IAE/B,wDAAwD;IAC/C,UAAU,CAAQ;IAE3B,mDAAmD;IAC1C,OAAO,CAA0B;IAE1C,YACE,IAAsB,EACtB,UAAkB,EAClB,OAAe,EACf,OAAiC;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF;AAtBD,oCAsBC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,GAAY;IACzC,OAAO,CACL,GAAG,YAAY,KAAK;QACpB,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc;YAC1B,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,cAAc;YACvC,CAAC,iBAAiB,IAAI,GAAG,IAAK,GAAW,CAAC,eAAe,KAAK,IAAI,CAAC;YACnE,CAAC,MAAM,IAAI,GAAG,IAAI,YAAY,IAAI,GAAG,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AA6PH,wCAQC;AAnQD,wEAAwE;AAExE,0BAA0B;AACb,QAAA,WAAW,GAAG,aAAsB,CAAA;AAEjD,wDAAwD;AAC3C,QAAA,mBAAmB,GAAG,qBAA8B,CAAA;AAGjE,qDAAqD;AACxC,QAAA,cAAc,GAAG,gBAAyB,CAAA;AACvD,8DAA8D;AACjD,QAAA,kBAAkB,GAAG,kBAA2B,CAAA;AAC7D,uEAAuE;AAC1D,QAAA,gBAAgB,GAAG,gBAAyB,CAAA;AAEzD,kDAAkD;AACrC,QAAA,WAAW,GAAG,aAAsB,CAAA;AAEjD,yDAAyD;AAC5C,QAAA,iBAAiB,GAAG,mBAA4B,CAAA;AAE7D,mCAAmC;AACtB,QAAA,cAAc,GAAG,gBAAyB,CAAA;AAEvD,gFAAgF;AACnE,QAAA,uBAAuB,GAAG,yBAAkC,CAAA;AAEzE,sFAAsF;AACzE,QAAA,6BAA6B,GAAG,+BAAwC,CAAA;AAErF,oDAAoD;AACvC,QAAA,mBAAmB,GAAG,qBAA8B,CAAA;AAEjE,uDAAuD;AAC1C,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D;;;;GAIG;AACU,QAAA,sBAAsB,GAAG,sBAA+B,CAAA;AACrE;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,+CAA+C;AAClC,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,wBAAwB;AACX,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,wGAAwG;AAC3F,QAAA,yBAAyB,GAAG,yBAAkC,CAAA;AAE3E,qGAAqG;AACxF,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,2CAA2C;AAC9B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,wCAAwC;AAC3B,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,gCAAgC;AACnB,QAAA,sBAAsB,GAAG,sBAA+B,CAAA;AAErE,0BAA0B;AACb,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,qCAAqC;AACxB,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,yBAAyB;AACZ,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,+CAA+C;AAClC,QAAA,kBAAkB,GAAG,kBAA2B,CAAA;AAE7D;;;;;GAKG;AACU,QAAA,qBAAqB,GAAG,qBAA8B,CAAA;AAEnE,iDAAiD;AACpC,QAAA,YAAY,GAAG,cAAuB,CAAA;AAEnD,sEAAsE;AAEtE,4DAA4D;AAC/C,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,4CAA4C;AAC/B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,kDAAkD;AACrC,QAAA,oBAAoB,GAAG,oBAA6B,CAAA;AAEjE,+CAA+C;AAClC,QAAA,4BAA4B,GAAG,4BAAqC,CAAA;AAEjF,kDAAkD;AACrC,QAAA,qBAAqB,GAAG,qBAA8B,CAAA;AAEnE,2CAA2C;AAC9B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,4DAA4D;AAC/C,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,4DAA4D;AAC/C,QAAA,yBAAyB,GAAG,yBAAkC,CAAA;AAE3E,yDAAyD;AAC5C,QAAA,uBAAuB,GAAG,uBAAgC,CAAA;AAEvE;;;;;;GAMG;AACU,QAAA,kBAAkB,GAAG,kBAA2B,CAAA;AAE7D,uEAAuE;AAEvE;;;GAGG;AACU,QAAA,2BAA2B,GAAG,2BAAoC,CAAA;AAE/E,uEAAuE;AAEvE;;;GAGG;AACU,QAAA,2BAA2B,GAAG,2BAAoC,CAAA;AAuD/E,wEAAwE;AAExE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,YAAa,SAAQ,KAAK;IACrC,+DAA+D;IACtD,IAAI,CAAkB;IAE/B,wDAAwD;IAC/C,UAAU,CAAQ;IAE3B,mDAAmD;IAC1C,OAAO,CAA0B;IAE1C,YACE,IAAsB,EACtB,UAAkB,EAClB,OAAe,EACf,OAAiC;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF;AAtBD,oCAsBC;AAED;;GAEG;AACH,SAAgB,cAAc,CAAC,GAAY;IACzC,OAAO,CACL,GAAG,YAAY,KAAK;QACpB,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc;YAC1B,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,cAAc;YACvC,CAAC,iBAAiB,IAAI,GAAG,IAAK,GAAW,CAAC,eAAe,KAAK,IAAI,CAAC;YACnE,CAAC,MAAM,IAAI,GAAG,IAAI,YAAY,IAAI,GAAG,CAAC,CAAC,CAC1C,CAAC;AACJ,CAAC"}

package/dist/governanceCoverage.d.ts

@@ -10,13 +10,13 @@
  *   - `services/control-plane/src/services/harnessGradeSweep.ts`'s
  *     `deriveEnforcementInputs`, run hourly for every workspace, reading
  *     `agents.facets` back out of Postgres.
- *   - `services/sync-daemon/src/syncLoop.ts`'s `runSyncIteration` (step 5b),
+ *   - `services/sync-daemon/src/syncCycle.ts`'s `reportHarnessAgents`,
  *     run every sync cycle, reading the `facets` object `collectAgentReport`
  *     just built in memory for the same cycle's `POST /api/v1/agents/report`
  *     call.
  *
  * Hand-copying this mapping between the two is how it drifted (TD-443):
- * `syncLoop.ts`'s copy read `report.facets.mcp_tools.length > 0` with no
+ * the sync daemon's copy read `report.facets.mcp_tools.length > 0` with no
  * `Array.isArray` guard, while `harnessGradeSweep.ts`'s copy guarded it —
  * the exact two-hand-kept-copies failure `secretPatterns.ts`'s module doc
  * comment describes for credential-value patterns. This module is the fix:

package/dist/governanceCoverage.js

@@ -11,13 +11,13 @@
  *   - `services/control-plane/src/services/harnessGradeSweep.ts`'s
  *     `deriveEnforcementInputs`, run hourly for every workspace, reading
  *     `agents.facets` back out of Postgres.
- *   - `services/sync-daemon/src/syncLoop.ts`'s `runSyncIteration` (step 5b),
+ *   - `services/sync-daemon/src/syncCycle.ts`'s `reportHarnessAgents`,
  *     run every sync cycle, reading the `facets` object `collectAgentReport`
  *     just built in memory for the same cycle's `POST /api/v1/agents/report`
  *     call.
  *
  * Hand-copying this mapping between the two is how it drifted (TD-443):
- * `syncLoop.ts`'s copy read `report.facets.mcp_tools.length > 0` with no
+ * the sync daemon's copy read `report.facets.mcp_tools.length > 0` with no
  * `Array.isArray` guard, while `harnessGradeSweep.ts`'s copy guarded it —
  * the exact two-hand-kept-copies failure `secretPatterns.ts`'s module doc
  * comment describes for credential-value patterns. This module is the fix:

package/dist/guardrailIr.d.ts

@@ -23,13 +23,21 @@
  *   `max_calls`, `forbid_with`). `~>` adjacency is not offered; `->` only.
  * - `wasm_predicate` — the existing closed predicate DSL, verdict 3 (reask)
  *   only. A generated rule can never originate a block.
+ * - the two settings-class kinds (TD-474 item 2): `allowed_models` and
+ *   `egress_allow`, each a list of values for one workspace setting
+ *   (`SETTING_KIND_KEYS`). Neither carries roles — a workspace setting has no
+ *   per-role form — and neither is projected into a rule endpoint: a promoted
+ *   one is written into the setting the proxy already enforces.
  * - `none` — "this passage contains no enforceable rule", so the corpus can
  *   measure over-generation.
  *
  * Deliberately absent: the three allowlist keys (`allow_harnesses`,
  * `plan_steps`, `scope_paths` — intersection-composed, empty-means-unrestricted;
  * a generated allowlist can silently deny everything), raw regexes, raw
- * AssemblyScript, `BLOCK:` titles, DLP patterns, SSL graphs, verdict 1, OR.
+ * AssemblyScript, `BLOCK:` titles, DLP patterns (they live only in the proxy's
+ * own config file; no setting carries them and nothing validates a generated
+ * regex for ReDoS), `egressMode` (posture, never generated), SSL graphs,
+ * verdict 1, OR.
  *
  * Structural impossibilities match the Rust parser's own refusals: a token with
  * whitespace (a shell command) cannot exist, a `forbid_with` taint is an enum,
@@ -108,6 +116,31 @@ declare const WasmPredicateSchema: z.ZodObject<{
     roles?: string[] | undefined;
     predicate?: unknown;
 }>;
+/**
+ * A model id as the proxy compares it: `check_model_allowed` in
+ * `packages/proxy/src/metering.rs` is an exact, case-sensitive string match
+ * against the request's `model`, so the id is kept as written.
+ */
+export declare const MODEL_ID_RE: RegExp;
+export declare const MAX_SETTING_VALUES = 32;
+/** The widest CIDR a generated entry may name: a /8 is a whole private range, anything wider is a catch-all. */
+export declare const MIN_EGRESS_CIDR_PREFIX = 8;
+/**
+ * An egress allow entry in a form `packages/proxy/src/egress_policy.rs`
+ * honours, and narrow enough to mean something:
+ *
+ * - a host, `api.example.com` — the proxy matches it and its subdomains;
+ * - a suffix, `.example.com` — the same match, written as a domain;
+ * - an IPv4 address or CIDR, `10.0.0.0/8` — matched against IP-literal
+ *   CONNECT targets only (the proxy never resolves a name); octets without
+ *   leading zeros, which Rust's parser refuses.
+ *
+ * Refused the way a catch-all hook pattern is refused: `*` (the proxy has no
+ * wildcard, so it would be inert), a bare TLD or single label (`com` would
+ * allow every `.com` host), and a CIDR wider than /8 (`0.0.0.0/0` is
+ * everything). IPv6 is honoured by the proxy but not offered here.
+ */
+export declare function isEgressHostEntry(value: string): boolean;
 export declare const GuardrailIrSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodObject<{
     kind: z.ZodLiteral<"hook_rule">;
     title: z.ZodString;
@@ -234,6 +267,24 @@ export declare const GuardrailIrSchema: z.ZodDiscriminatedUnion<"kind", [z.ZodOb
     verdict: 3;
     roles?: string[] | undefined;
     predicate?: unknown;
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"allowed_models">;
+    models: z.ZodArray<z.ZodString, "many">;
+}, "strict", z.ZodTypeAny, {
+    kind: "allowed_models";
+    models: string[];
+}, {
+    kind: "allowed_models";
+    models: string[];
+}>, z.ZodObject<{
+    kind: z.ZodLiteral<"egress_allow">;
+    hosts: z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">;
+}, "strict", z.ZodTypeAny, {
+    kind: "egress_allow";
+    hosts: string[];
+}, {
+    kind: "egress_allow";
+    hosts: string[];
 }>, z.ZodObject<{
     kind: z.ZodLiteral<"none">;
     reason: z.ZodString;
@@ -250,12 +301,29 @@ export type WasmPredicateIr = z.infer<typeof WasmPredicateSchema>;
 export type FrontMatterIr = Extract<GuardrailIr, {
     kind: 'deny_tools' | 'review_before' | 'requires_before' | 'forbid_after' | 'max_calls' | 'forbid_with';
 }>;
+export type SettingIr = Extract<GuardrailIr, {
+    kind: 'allowed_models' | 'egress_allow';
+}>;
 export type IrKind = GuardrailIr['kind'];
 /** Every kind, in one place, for the lint gate (`check-guardrail-ir-keys.js`). */
-export declare const IR_KINDS: readonly ["hook_rule", "deny_tools", "review_before", "requires_before", "forbid_after", "max_calls", "forbid_with", "wasm_predicate", "none"];
+export declare const IR_KINDS: readonly ["hook_rule", "deny_tools", "review_before", "requires_before", "forbid_after", "max_calls", "forbid_with", "wasm_predicate", "allowed_models", "egress_allow", "none"];
 /** The kinds that render to a SOP front-matter key the Rust proxy reads. */
 export declare const FRONT_MATTER_KINDS: readonly ["deny_tools", "review_before", "requires_before", "forbid_after", "max_calls", "forbid_with"];
 export declare function isFrontMatterIr(ir: GuardrailIr): ir is FrontMatterIr;
+/** The settings-class kinds: each is a list of values for one workspace setting (TD-474 item 2). */
+export declare const SETTING_KINDS: readonly ["allowed_models", "egress_allow"];
+/**
+ * The `WorkspaceSettings` key each settings-class kind writes on promotion.
+ * `check-guardrail-ir-keys.js` asserts each value is declared there.
+ */
+export declare const SETTING_KIND_KEYS: {
+    readonly allowed_models: "allowedModels";
+    readonly egress_allow: "egressAllow";
+};
+export type SettingKey = (typeof SETTING_KIND_KEYS)[keyof typeof SETTING_KIND_KEYS];
+export declare function isSettingIr(ir: GuardrailIr): ir is SettingIr;
+/** A settings-class IR's values, as the setting holds them: sorted, deduplicated; hosts lower-cased (the proxy lower-cases them), model ids kept as written (the proxy compares them exactly). */
+export declare function settingValues(ir: SettingIr): string[];
 export type IrValidation = {
     ok: true;
     ir: GuardrailIr;

package/dist/guardrailIr.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guardrailIr.d.ts","sourceRoot":"","sources":["../src/guardrailIr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,sKAShB,CAAA;AAEV,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;AAExD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,QAAoC,CAAA;AAE9D,eAAO,MAAM,cAAc,IAAI,CAAA;AAC/B,eAAO,MAAM,eAAe,KAAK,CAAA;AACjC,eAAO,MAAM,YAAY,IAAI,CAAA;AAC7B,eAAO,MAAM,iBAAiB,KAAK,CAAA;AACnC,eAAO,MAAM,SAAS,IAAI,CAAA;AAC1B,eAAO,MAAM,eAAe,KAAK,CAAA;AACjC,eAAO,MAAM,mBAAmB,MAAM,CAAA;AACtC,eAAO,MAAM,eAAe,OAAO,CAAA;AAgCnC,QAAA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;EAST,CAAA;AAyCX,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;EASd,CAAA;AAIX,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAU5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAC3D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA;AACvD,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AACjE,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,YAAY,GAAG,eAAe,GAAG,iBAAiB,GAAG,cAAc,GAAG,WAAW,GAAG,aAAa,CAAA;CAAE,CAAC,CAAA;AAC7J,MAAM,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;AAExC,kFAAkF;AAClF,eAAO,MAAM,QAAQ,gJAUX,CAAA;AAEV,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,yGAOrB,CAAA;AAEV,wBAAgB,eAAe,CAAC,EAAE,EAAE,WAAW,GAAG,EAAE,IAAI,aAAa,CAEpE;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAExF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAmBhE;AAMD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,WAAW,GAAG,MAAM,CAmCtD;AASD,qGAAqG;AACrG,wBAAgB,QAAQ,CAAC,EAAE,EAAE,WAAW,GAAG,MAAM,EAAE,CAiBlD"}
+{"version":3,"file":"guardrailIr.d.ts","sourceRoot":"","sources":["../src/guardrailIr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,sKAShB,CAAA;AAEV,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAA;AAExD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,QAAoC,CAAA;AAE9D,eAAO,MAAM,cAAc,IAAI,CAAA;AAC/B,eAAO,MAAM,eAAe,KAAK,CAAA;AACjC,eAAO,MAAM,YAAY,IAAI,CAAA;AAC7B,eAAO,MAAM,iBAAiB,KAAK,CAAA;AACnC,eAAO,MAAM,SAAS,IAAI,CAAA;AAC1B,eAAO,MAAM,eAAe,KAAK,CAAA;AACjC,eAAO,MAAM,mBAAmB,MAAM,CAAA;AACtC,eAAO,MAAM,eAAe,OAAO,CAAA;AAgCnC,QAAA,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;EAST,CAAA;AAyCX,QAAA,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;EASd,CAAA;AAEX;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAyC,CAAA;AACjE,eAAO,MAAM,kBAAkB,KAAK,CAAA;AAMpC,gHAAgH;AAChH,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAmBxD;AAoBD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAY5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAC3D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAA;AACvD,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AACjE,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,YAAY,GAAG,eAAe,GAAG,iBAAiB,GAAG,cAAc,GAAG,WAAW,GAAG,aAAa,CAAA;CAAE,CAAC,CAAA;AAC7J,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,EAAE;IAAE,IAAI,EAAE,gBAAgB,GAAG,cAAc,CAAA;CAAE,CAAC,CAAA;AACzF,MAAM,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;AAExC,kFAAkF;AAClF,eAAO,MAAM,QAAQ,kLAYX,CAAA;AAEV,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,yGAOrB,CAAA;AAEV,wBAAgB,eAAe,CAAC,EAAE,EAAE,WAAW,GAAG,EAAE,IAAI,aAAa,CAEpE;AAED,oGAAoG;AACpG,eAAO,MAAM,aAAa,6CAA8C,CAAA;AAExE;;;GAGG;AACH,eAAO,MAAM,iBAAiB;;;CAA4E,CAAA;AAC1G,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAA;AAEnF,wBAAgB,WAAW,CAAC,EAAE,EAAE,WAAW,GAAG,EAAE,IAAI,SAAS,CAE5D;AAED,kMAAkM;AAClM,wBAAgB,aAAa,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,EAAE,CAErD;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAExF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,CAmBhE;AAMD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,WAAW,GAAG,MAAM,CAyCtD;AASD,qGAAqG;AACrG,wBAAgB,QAAQ,CAAC,EAAE,EAAE,WAAW,GAAG,MAAM,EAAE,CAmBlD"}

package/dist/guardrailIr.js

@@ -24,13 +24,21 @@
  *   `max_calls`, `forbid_with`). `~>` adjacency is not offered; `->` only.
  * - `wasm_predicate` — the existing closed predicate DSL, verdict 3 (reask)
  *   only. A generated rule can never originate a block.
+ * - the two settings-class kinds (TD-474 item 2): `allowed_models` and
+ *   `egress_allow`, each a list of values for one workspace setting
+ *   (`SETTING_KIND_KEYS`). Neither carries roles — a workspace setting has no
+ *   per-role form — and neither is projected into a rule endpoint: a promoted
+ *   one is written into the setting the proxy already enforces.
  * - `none` — "this passage contains no enforceable rule", so the corpus can
  *   measure over-generation.
  *
  * Deliberately absent: the three allowlist keys (`allow_harnesses`,
  * `plan_steps`, `scope_paths` — intersection-composed, empty-means-unrestricted;
  * a generated allowlist can silently deny everything), raw regexes, raw
- * AssemblyScript, `BLOCK:` titles, DLP patterns, SSL graphs, verdict 1, OR.
+ * AssemblyScript, `BLOCK:` titles, DLP patterns (they live only in the proxy's
+ * own config file; no setting carries them and nothing validates a generated
+ * regex for ReDoS), `egressMode` (posture, never generated), SSL graphs,
+ * verdict 1, OR.
  *
  * Structural impossibilities match the Rust parser's own refusals: a token with
  * whitespace (a shell command) cannot exist, a `forbid_with` taint is an enum,
@@ -39,9 +47,12 @@
  * @module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FRONT_MATTER_KINDS = exports.IR_KINDS = exports.GuardrailIrSchema = exports.MAX_CALLS_LIMIT = exports.MAX_RATIONALE_CHARS = exports.MAX_TITLE_CHARS = exports.MAX_ROLES = exports.MAX_LITERAL_CHARS = exports.MAX_LITERALS = exports.MAX_LIST_TOKENS = exports.MAX_HOOK_TOOLS = exports.TOOL_TOKEN_RE = exports.ACTION_TOKENS = void 0;
+exports.SETTING_KIND_KEYS = exports.SETTING_KINDS = exports.FRONT_MATTER_KINDS = exports.IR_KINDS = exports.GuardrailIrSchema = exports.MIN_EGRESS_CIDR_PREFIX = exports.MAX_SETTING_VALUES = exports.MODEL_ID_RE = exports.MAX_CALLS_LIMIT = exports.MAX_RATIONALE_CHARS = exports.MAX_TITLE_CHARS = exports.MAX_ROLES = exports.MAX_LITERAL_CHARS = exports.MAX_LITERALS = exports.MAX_LIST_TOKENS = exports.MAX_HOOK_TOOLS = exports.TOOL_TOKEN_RE = exports.ACTION_TOKENS = void 0;
 exports.isActionToken = isActionToken;
+exports.isEgressHostEntry = isEgressHostEntry;
 exports.isFrontMatterIr = isFrontMatterIr;
+exports.isSettingIr = isSettingIr;
+exports.settingValues = settingValues;
 exports.validateGuardrailIr = validateGuardrailIr;
 exports.canonicalizeIr = canonicalizeIr;
 exports.irTokens = irTokens;
@@ -161,6 +172,72 @@ const WasmPredicateSchema = zod_1.z
     roles: Roles,
 })
     .strict();
+/**
+ * A model id as the proxy compares it: `check_model_allowed` in
+ * `packages/proxy/src/metering.rs` is an exact, case-sensitive string match
+ * against the request's `model`, so the id is kept as written.
+ */
+exports.MODEL_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/;
+exports.MAX_SETTING_VALUES = 32;
+const ModelId = zod_1.z.string().regex(exports.MODEL_ID_RE, 'a model id is one token: `claude-sonnet-4-5`, `gpt-4o`, `openrouter/meta-llama/llama-3-70b`');
+const HOST_LABEL_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+const IPV4_RE = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})(?:\/(\d{1,2}))?$/;
+/** The widest CIDR a generated entry may name: a /8 is a whole private range, anything wider is a catch-all. */
+exports.MIN_EGRESS_CIDR_PREFIX = 8;
+/**
+ * An egress allow entry in a form `packages/proxy/src/egress_policy.rs`
+ * honours, and narrow enough to mean something:
+ *
+ * - a host, `api.example.com` — the proxy matches it and its subdomains;
+ * - a suffix, `.example.com` — the same match, written as a domain;
+ * - an IPv4 address or CIDR, `10.0.0.0/8` — matched against IP-literal
+ *   CONNECT targets only (the proxy never resolves a name); octets without
+ *   leading zeros, which Rust's parser refuses.
+ *
+ * Refused the way a catch-all hook pattern is refused: `*` (the proxy has no
+ * wildcard, so it would be inert), a bare TLD or single label (`com` would
+ * allow every `.com` host), and a CIDR wider than /8 (`0.0.0.0/0` is
+ * everything). IPv6 is honoured by the proxy but not offered here.
+ */
+function isEgressHostEntry(value) {
+    if (value !== value.trim())
+        return false;
+    const v = value.toLowerCase();
+    const ip = v.match(IPV4_RE);
+    if (ip) {
+        // Rust's `IpAddr::from_str` refuses a leading-zero octet (`010.20.0.0`),
+        // so the proxy would treat it as a host name that never matches.
+        if (ip.slice(1, 5).some((o) => Number(o) > 255 || (o.length > 1 && o.startsWith('0'))))
+            return false;
+        if (ip[5] === undefined)
+            return true;
+        const prefix = Number(ip[5]);
+        return prefix >= exports.MIN_EGRESS_CIDR_PREFIX && prefix <= 32;
+    }
+    const host = v.startsWith('.') ? v.slice(1) : v;
+    if (host.length === 0 || host.length > 253)
+        return false;
+    const labels = host.split('.');
+    if (labels.length < 2)
+        return false;
+    if (!labels.every((l) => HOST_LABEL_RE.test(l)))
+        return false;
+    // A numeric last label is an IP fragment, not a domain.
+    return /[a-z]/.test(labels[labels.length - 1]);
+}
+const HostEntry = zod_1.z
+    .string()
+    .min(1)
+    .max(253)
+    .refine(isEgressHostEntry, {
+    message: 'an egress entry is a host (`api.example.com`), a suffix with at least two labels (`.example.com`) or an IPv4 CIDR no wider than /8 (`10.0.0.0/8`) — never `*`, `0.0.0.0/0` or a bare TLD',
+});
+const AllowedModelsSchema = zod_1.z
+    .object({ kind: zod_1.z.literal('allowed_models'), models: zod_1.z.array(ModelId).min(1).max(exports.MAX_SETTING_VALUES) })
+    .strict();
+const EgressAllowSchema = zod_1.z
+    .object({ kind: zod_1.z.literal('egress_allow'), hosts: zod_1.z.array(HostEntry).min(1).max(exports.MAX_SETTING_VALUES) })
+    .strict();
 const NoneSchema = zod_1.z.object({ kind: zod_1.z.literal('none'), reason: Rationale }).strict();
 exports.GuardrailIrSchema = zod_1.z.discriminatedUnion('kind', [
     HookRuleSchema,
@@ -171,6 +248,8 @@ exports.GuardrailIrSchema = zod_1.z.discriminatedUnion('kind', [
     MaxCallsSchema,
     ForbidWithSchema,
     WasmPredicateSchema,
+    AllowedModelsSchema,
+    EgressAllowSchema,
     NoneSchema,
 ]);
 /** Every kind, in one place, for the lint gate (`check-guardrail-ir-keys.js`). */
@@ -183,6 +262,8 @@ exports.IR_KINDS = [
     'max_calls',
     'forbid_with',
     'wasm_predicate',
+    'allowed_models',
+    'egress_allow',
     'none',
 ];
 /** The kinds that render to a SOP front-matter key the Rust proxy reads. */
@@ -197,6 +278,20 @@ exports.FRONT_MATTER_KINDS = [
 function isFrontMatterIr(ir) {
     return exports.FRONT_MATTER_KINDS.includes(ir.kind);
 }
+/** The settings-class kinds: each is a list of values for one workspace setting (TD-474 item 2). */
+exports.SETTING_KINDS = ['allowed_models', 'egress_allow'];
+/**
+ * The `WorkspaceSettings` key each settings-class kind writes on promotion.
+ * `check-guardrail-ir-keys.js` asserts each value is declared there.
+ */
+exports.SETTING_KIND_KEYS = { allowed_models: 'allowedModels', egress_allow: 'egressAllow' };
+function isSettingIr(ir) {
+    return exports.SETTING_KINDS.includes(ir.kind);
+}
+/** A settings-class IR's values, as the setting holds them: sorted, deduplicated; hosts lower-cased (the proxy lower-cases them), model ids kept as written (the proxy compares them exactly). */
+function settingValues(ir) {
+    return ir.kind === 'allowed_models' ? uniqueSorted(ir.models) : uniqueSorted(ir.hosts.map((h) => h.trim().toLowerCase()));
+}
 /**
  * Parse an untrusted value into the IR, or say why it is not one. Never
  * throws. This — not `GuardrailIrSchema.parse` — is the entry point: the
@@ -238,7 +333,7 @@ function uniqueSorted(values) {
  * matches `Bash` case-sensitively).
  */
 function canonicalizeIr(ir) {
-    const roles = ir.kind === 'none' ? undefined : ir.roles && ir.roles.length ? uniqueSorted(ir.roles.map((r) => r.toLowerCase())) : undefined;
+    const roles = 'roles' in ir && ir.roles && ir.roles.length ? uniqueSorted(ir.roles.map((r) => r.toLowerCase())) : undefined;
     let core;
     switch (ir.kind) {
         case 'hook_rule':
@@ -267,6 +362,12 @@ function canonicalizeIr(ir) {
         case 'wasm_predicate':
             core = { predicate: ir.predicate, verdict: ir.verdict };
             break;
+        case 'allowed_models':
+            core = { models: settingValues(ir) };
+            break;
+        case 'egress_allow':
+            core = { hosts: settingValues(ir) };
+            break;
         case 'none':
             core = {};
             break;
@@ -294,6 +395,8 @@ function irTokens(ir) {
         case 'forbid_with':
             return [ir.token];
         case 'wasm_predicate':
+        case 'allowed_models':
+        case 'egress_allow':
         case 'none':
             return [];
     }