archal 0.9.20 → 0.10.0

package/dist/vitest/runtime/hosted-session-reaper.cjs

@@ -14,6 +14,7 @@ var CREDENTIALS_MASTER_KEY_ENV_VAR = "ARCHAL_CREDENTIALS_MASTER_KEY";
 var KEYCHAIN_SERVICE = "archal-cli";
 var KEYCHAIN_ACCOUNT = "credentials-master-key";
 var HOSTED_DEFAULT_AUTH_BASE_URL = "https://www.archal.ai";
+var WORKSPACE_API_KEY_PREFIX = "archal_ws_";
 var STRICT_ENDPOINTS_ENV_VAR = "ARCHAL_STRICT_ENDPOINTS";
 var REQUEST_TIMEOUT_MS = 8e3;
 var ENV_TOKEN_FALLBACK_TTL_SECONDS = 24 * 60 * 60;
@@ -23,11 +24,6 @@ function isPlan(value) {
   return value === "free" || value === "pro" || value === "enterprise";
 }
 
-// ../node-auth/src/errors.ts
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-
 // ../node-auth/src/credential-store.ts
 var import_node_child_process = require("child_process");
 var import_node_crypto = require("crypto");
@@ -60,7 +56,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "Cal.com",
     description: "Event types, schedules, availability slots, bookings, calendars, and webhooks.",
     stage: "preview",
-    toolCount: 18,
+    toolCount: 35,
     transport: "both",
     architectureClass: "domain-simulator",
     domainPrimitives: [
@@ -78,7 +74,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "ClickUp",
     description: "Teams, spaces, folders, lists, tasks, comments, tags, time tracking, and checklists.",
     stage: "preview",
-    toolCount: 40,
+    toolCount: 123,
     transport: "both",
     architectureClass: "standard-core",
     domainPrimitives: [],
@@ -91,7 +87,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "Customer.io",
     description: "Messaging automation across campaigns, broadcasts, transactional email, segments, customers, and message delivery.",
     stage: "preview",
-    toolCount: 22,
+    toolCount: 129,
     transport: "rest",
     architectureClass: "standard-core",
     domainPrimitives: [],
@@ -156,7 +152,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "GitLab",
     description: "Projects, branches, commits, issues, merge requests, pipelines, labels, milestones, releases, and webhooks.",
     stage: "preview",
-    toolCount: 46,
+    toolCount: 559,
     transport: "both",
     architectureClass: "domain-simulator",
     domainPrimitives: [
@@ -191,7 +187,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "HubSpot",
     description: "CRM contacts, companies, deals, tickets, and engagements.",
     stage: "preview",
-    toolCount: 41,
+    toolCount: 44,
     transport: "rest",
     architectureClass: "replay-shell",
     domainPrimitives: [
@@ -226,7 +222,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "Linear",
     description: "Issues, projects, teams, cycles, and workflows.",
     stage: "public",
-    toolCount: 50,
+    toolCount: 53,
     transport: "both",
     architectureClass: "domain-simulator",
     domainPrimitives: [
@@ -295,7 +291,7 @@ var GENERATED_CLONE_CATALOG = [
     name: "Sentry",
     description: "Error monitoring across organizations, projects, teams, issues, events, releases, and DSN keys.",
     stage: "preview",
-    toolCount: 25,
+    toolCount: 34,
     transport: "rest",
     architectureClass: "domain-simulator",
     domainPrimitives: [
@@ -397,14 +393,10 @@ var GENERATED_CLONE_CATALOG = [
     name: "Webflow",
     description: "Sites, pages, CMS collections, items, assets, forms, and webhooks.",
     stage: "preview",
-    toolCount: 19,
-    transport: "rest",
-    architectureClass: "replay-shell",
-    domainPrimitives: [
-      "recording replay cursor",
-      "CMS collection/item overlays",
-      "publish lifecycle captures"
-    ],
+    toolCount: 104,
+    transport: "both",
+    architectureClass: "standard-core",
+    domainPrimitives: [],
     behaviorOwner: null,
     opsCoverage: 100
   }
@@ -500,142 +492,11 @@ var STARTABLE_CLONE_CATALOG = CLONE_CATALOG.filter(
   (entry) => STARTABLE_CLONE_ID_SET.has(entry.id)
 );
 
-// ../billing-constants/src/credit-catalog.ts
-var CREDIT_COGS_MARKUP = 3;
-var CREDIT_TARGET_GROSS_MARGIN_PERCENT = Math.round(
-  (1 - 1 / CREDIT_COGS_MARKUP) * 100
-);
-
-// ../billing-constants/src/index.ts
-var PLAN_MONTHLY_TWIN_MINUTE_LIMITS = {
-  free: 500,
-  pro: 5e3,
-  enterprise: null
-};
-var PLAN_CONCURRENT_SESSION_LIMITS = {
-  free: 3,
-  pro: 10,
-  enterprise: 50
-};
-var FREE_WORKSPACE_MEMBER_LIMIT = 2;
-var PRO_PLAN_PRICE_USD = 199;
-function formatMinutesLabel(minutes) {
-  return minutes.toLocaleString("en-US");
-}
-var FREE_MINUTES = PLAN_MONTHLY_TWIN_MINUTE_LIMITS.free;
-var PRO_MINUTES = PLAN_MONTHLY_TWIN_MINUTE_LIMITS.pro;
-if (FREE_MINUTES == null || PRO_MINUTES == null) {
-  throw new Error("PLAN_MONTHLY_TWIN_MINUTE_LIMITS: free and pro must be non-null");
-}
-var PRO_EVALS_PER_SEAT = 500;
-var PRO_SESSION_MINUTES_PER_SEAT = 5e3;
-var PRO_MAX_SEATS = 5;
-var FREE_EVALS_PER_MONTH = 100;
-var PLAN_DISPLAY = {
-  free: {
-    tag: "Free",
-    priceLabel: "$0",
-    periodLabel: "",
-    included: [
-      `${formatMinutesLabel(FREE_MINUTES)} session-minutes / account`,
-      `${FREE_EVALS_PER_MONTH} evals / account`,
-      `1 workspace (${FREE_WORKSPACE_MEMBER_LIMIT} users max)`,
-      `${PLAN_CONCURRENT_SESSION_LIMITS.free} concurrent sessions / workspace`,
-      "All clones included"
-    ]
-  },
-  pro: {
-    tag: "Pro",
-    priceLabel: `$${PRO_PLAN_PRICE_USD}`,
-    periodLabel: "/mo per seat",
-    included: [
-      `${formatMinutesLabel(PRO_SESSION_MINUTES_PER_SEAT)} session-minutes / seat / month`,
-      `${PRO_EVALS_PER_SEAT} evals / seat / month`,
-      "All clones included",
-      `${PLAN_CONCURRENT_SESSION_LIMITS.pro} concurrent sessions / workspace`,
-      `1 workspace, up to ${PRO_MAX_SEATS} seats with pooled usage`
-    ]
-  },
-  enterprise: {
-    tag: "Enterprise",
-    priceLabel: "Contact us",
-    periodLabel: "",
-    included: [
-      "Unlimited session-minutes",
-      "Unlimited seats per workspace",
-      "Unlimited workspaces",
-      `${PLAN_CONCURRENT_SESSION_LIMITS.enterprise} concurrent sessions / workspace`,
-      "SSO / SAML",
-      "SOC 2 (in progress)",
-      "Custom clones & eval support",
-      "Dedicated onboarding & support"
-    ]
-  }
-};
-var PLAN_MAX_SESSION_TTL_SECONDS = {
-  free: 30 * 60,
-  // 30 minutes
-  pro: 60 * 60,
-  // 60 minutes
-  enterprise: 90 * 60
-  // 90 minutes
-};
-var MAX_ABSOLUTE_SESSION_LIFETIME_SECONDS = 4 * 60 * 60;
-var LIFETIME_PERIOD_RESETS_AT = new Date(Date.UTC(9999, 11, 31));
-var ALL_ENTITLED_CLONES = ALL_STARTABLE_CLONE_IDS;
-var SCENARIO_USAGE_WINDOW_DAYS = 7;
-var SCENARIO_USAGE_WINDOW_MS = SCENARIO_USAGE_WINDOW_DAYS * 24 * 60 * 60 * 1e3;
-var SCENARIO_USAGE_WINDOW_SECONDS = SCENARIO_USAGE_WINDOW_DAYS * 24 * 60 * 60;
-var LLM_PRICING_USD_PER_M_TOKENS = {
-  // Google Gemini (verified 2026-05-05, standard tier <=200K input tokens)
-  "gemini-2.5-pro": { input: 1.25, output: 10 },
-  "gemini-2.5-flash": { input: 0.3, output: 2.5 },
-  // OpenAI flagship text models (verified 2026-05-21, standard short-context tier)
-  "gpt-5.5": { input: 5, output: 30 },
-  "gpt-5.5-pro": { input: 30, output: 180 },
-  "gpt-5.4": { input: 2.5, output: 15 },
-  "gpt-5.4-mini": { input: 0.75, output: 4.5 },
-  "gpt-5.4-nano": { input: 0.2, output: 1.25 },
-  "gpt-5.4-pro": { input: 30, output: 180 },
-  "gpt-4o-mini": { input: 0.15, output: 0.6 },
-  "gpt-4o": { input: 2.5, output: 10 },
-  "gpt-4.1-mini": { input: 0.4, output: 1.6 },
-  "gpt-4.1-nano": { input: 0.1, output: 0.4 },
-  "gpt-4.1": { input: 2, output: 8 },
-  // DeepSeek (verified 2026-05-05; legacy names map to v4-flash per vendor)
-  "deepseek-chat": { input: 0.14, output: 0.28 },
-  "deepseek-reasoner": { input: 0.14, output: 0.28 },
-  "deepseek-v4-flash": { input: 0.14, output: 0.28 }
-};
-var LLM_PRICING_FAMILY_RATES = [
-  { match: /^gemini-2\.5-pro/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gemini-2.5-pro"] },
-  { match: /^gemini-2\.5-flash/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gemini-2.5-flash"] },
-  { match: /^gpt-5\.5-pro/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.5-pro"] },
-  { match: /^gpt-5\.5/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.5"] },
-  { match: /^gpt-5\.4-pro/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.4-pro"] },
-  { match: /^gpt-5\.4-mini/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.4-mini"] },
-  { match: /^gpt-5\.4-nano/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.4-nano"] },
-  { match: /^gpt-5\.4/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-5.4"] },
-  { match: /^gpt-4o-mini/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4o-mini"] },
-  { match: /^gpt-4o(?!-mini)/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4o"] },
-  { match: /^gpt-4\.1-mini/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4.1-mini"] },
-  { match: /^gpt-4\.1-nano/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4.1-nano"] },
-  { match: /^gpt-4\.1(?!-mini|-nano)/i, rate: LLM_PRICING_USD_PER_M_TOKENS["gpt-4.1"] },
-  // Anthropic Claude 4.x list prices (verified 2026): Opus $5/$25, Sonnet
-  // $3/$15, Haiku 4.5 $1/$5 per 1M tokens (input/output).
-  { match: /^claude-opus-/i, rate: { input: 5, output: 25 } },
-  { match: /^claude-haiku-/i, rate: { input: 1, output: 5 } },
-  { match: /^claude-sonnet-/i, rate: { input: 3, output: 15 } },
-  { match: /^opus-/i, rate: { input: 5, output: 25 } },
-  { match: /^haiku-/i, rate: { input: 1, output: 5 } },
-  { match: /^sonnet-/i, rate: { input: 3, output: 15 } },
-  { match: /^deepseek-chat/i, rate: LLM_PRICING_USD_PER_M_TOKENS["deepseek-chat"] },
-  { match: /^deepseek-reasoner/i, rate: LLM_PRICING_USD_PER_M_TOKENS["deepseek-reasoner"] },
-  { match: /^deepseek-v4-flash/i, rate: LLM_PRICING_USD_PER_M_TOKENS["deepseek-v4-flash"] }
-];
-
-// ../node-auth/src/clone-entitlements.ts
-var ENTITLED_CLONE_SET = new Set(ALL_ENTITLED_CLONES);
+// ../node-auth/src/credential-store.ts
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+var ENTITLED_CLONE_SET = new Set(ALL_STARTABLE_CLONE_IDS);
 function normalizeEntitledCloneIds(cloneIds) {
   if (!cloneIds) {
     return [];
@@ -652,8 +513,6 @@ function normalizeEntitledCloneIds(cloneIds) {
   }
   return [...normalized];
 }
-
-// ../node-auth/src/credential-store.ts
 var KEYCHAIN_COMMAND_TIMEOUT_MS = 1500;
 var ARCHAL_DIR_NAME = ".archal";
 var TEST_SANDBOX_ID_ENV_VAR = "ARCHAL_TEST_SANDBOX_ID";
@@ -725,7 +584,7 @@ function seedSandboxFromRealHomeOnce(sandboxDir) {
   }
 }
 function getArchalDir() {
-  const explicit = process.env["ARCHAL_HOME"];
+  const explicit = process.env["ARCHAL_HOME"]?.trim();
   if (explicit) {
     return explicit;
   }
@@ -1009,7 +868,66 @@ function readCredentialsFile(options) {
   return readCredentialsFileAtPath(getCredentialsPath(), options);
 }
 function isWorkspaceApiKey(token) {
-  return token.startsWith("archal_ws_") || token.startsWith("archal_") && !token.includes(".");
+  return token.startsWith(WORKSPACE_API_KEY_PREFIX) || token.startsWith("archal_") && !token.includes(".");
+}
+var WORKSPACE_API_KEY_EXPIRES_SECONDS = 365 * 24 * 60 * 60;
+function parseEnvToken(token, envName = AUTH_TOKEN_ENV_VAR, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  const trimmed = token.trim();
+  if (!trimmed) {
+    return { status: "invalid", message: `${envName} is empty.` };
+  }
+  if (isWorkspaceApiKey(trimmed)) {
+    return {
+      status: "ok",
+      credentials: {
+        token: trimmed,
+        refreshToken: "",
+        email: "(workspace-api-key)",
+        plan: "pro",
+        selectedCloneIds: [],
+        expiresAt: nowSeconds + WORKSPACE_API_KEY_EXPIRES_SECONDS
+      }
+    };
+  }
+  const claims = decodeJwtPayload(trimmed);
+  if (claims === null) {
+    return {
+      status: "invalid",
+      message: `${envName} must be a JWT with valid plan and exp claims or a workspace API key (archal_ws_...).`
+    };
+  }
+  const email = typeof claims["email"] === "string" ? claims["email"] : `(from ${envName})`;
+  if (!isPlan(claims["plan"])) {
+    return {
+      status: "invalid",
+      message: `${envName} JWT does not contain a valid plan claim.`
+    };
+  }
+  const plan = claims["plan"];
+  if (typeof claims["exp"] !== "number" || !Number.isFinite(claims["exp"])) {
+    return {
+      status: "invalid",
+      message: `${envName} JWT does not contain a valid exp claim.`
+    };
+  }
+  const expiresAt = claims["exp"];
+  if (expiresAt <= nowSeconds) {
+    return {
+      status: "expired",
+      message: `${envName} is expired. Remove it or replace it with a valid token.`
+    };
+  }
+  return {
+    status: "ok",
+    credentials: {
+      token: trimmed,
+      refreshToken: "",
+      email,
+      plan,
+      selectedCloneIds: [],
+      expiresAt
+    }
+  };
 }
 function getStoredCredentials(options) {
   const creds = readCredentialsFile(options);
@@ -1166,8 +1084,59 @@ function getConfiguredAuthBaseUrl(options) {
   }
   return isStrictEndpointModeEnabled() ? null : HOSTED_DEFAULT_AUTH_BASE_URL;
 }
+function readConfiguredUrlFromEnvChain(envVarNames, options) {
+  const uniqueEnvVars = [...new Set(envVarNames)];
+  return readConfiguredUrl(options, ...uniqueEnvVars);
+}
+function getConfiguredAuthValidationBaseUrl(options = {}) {
+  const apiUrlEnvVar = options.apiUrlEnvVar ?? "ARCHAL_API_URL";
+  const authUrlEnvVar = options.authUrlEnvVar ?? "ARCHAL_AUTH_URL";
+  const resolved = readConfiguredUrlFromEnvChain([
+    apiUrlEnvVar,
+    authUrlEnvVar,
+    "ARCHAL_AUTH_URL",
+    "ARCHAL_AUTH_BASE_URL",
+    "ARCHAL_API_URL",
+    "ARCHAL_API_BASE_URL"
+  ], options);
+  if (resolved) {
+    return resolved;
+  }
+  return isStrictEndpointModeEnabled() ? null : HOSTED_DEFAULT_AUTH_BASE_URL;
+}
+
+// ../retry/dist/index.js
+function abortReason(signal) {
+  return signal.reason instanceof Error ? signal.reason : new DOMException("The operation was aborted.", "AbortError");
+}
+function sleep(ms, options) {
+  const signal = options?.signal;
+  if (signal?.aborted) {
+    return Promise.reject(abortReason(signal));
+  }
+  if (ms <= 0) {
+    return Promise.resolve();
+  }
+  if (!signal) {
+    return new Promise((resolve) => {
+      setTimeout(resolve, ms);
+    });
+  }
+  const abortSignal = signal;
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      abortSignal.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    function onAbort() {
+      clearTimeout(timeout);
+      reject(abortReason(abortSignal));
+    }
+    abortSignal.addEventListener("abort", onAbort, { once: true });
+  });
+}
 
-// ../node-auth/src/request-metadata.ts
+// ../node-auth/src/token-exchange.ts
 function buildAuthRequestHeaders(metadata, includeContentType = false) {
   const headers = {};
   if (includeContentType) {
@@ -1288,37 +1257,6 @@ async function validateAuthWithServerResult(creds, metadata) {
   };
 }
 
-// ../retry/dist/index.js
-function abortReason(signal) {
-  return signal.reason instanceof Error ? signal.reason : new DOMException("The operation was aborted.", "AbortError");
-}
-function sleep(ms, options) {
-  const signal = options?.signal;
-  if (signal?.aborted) {
-    return Promise.reject(abortReason(signal));
-  }
-  if (ms <= 0) {
-    return Promise.resolve();
-  }
-  if (!signal) {
-    return new Promise((resolve) => {
-      setTimeout(resolve, ms);
-    });
-  }
-  const abortSignal = signal;
-  return new Promise((resolve, reject) => {
-    const timeout = setTimeout(() => {
-      abortSignal.removeEventListener("abort", onAbort);
-      resolve();
-    }, ms);
-    function onAbort() {
-      clearTimeout(timeout);
-      reject(abortReason(abortSignal));
-    }
-    abortSignal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-
 // ../node-auth/src/secure-token.ts
 var import_node_crypto2 = require("crypto");
 
@@ -1377,59 +1315,11 @@ function parsePositiveInteger(rawValue, fallback, minimum = 1) {
   const parsed = Number(normalized);
   return Number.isSafeInteger(parsed) && parsed >= minimum ? parsed : fallback;
 }
-function normalizeApiBaseUrl(value) {
-  if (!value) return null;
-  const normalized = value.trim().replace(/\/+$/, "");
-  if (!normalized) return null;
-  let parsed;
-  try {
-    parsed = new URL(normalized);
-  } catch {
-    throw new Error(`Invalid ARCHAL_API_URL: "${normalized}" is not a valid URL`);
-  }
-  const isLocalhostHttp = parsed.protocol === "http:" && (parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1");
-  if (parsed.protocol !== "https:" && !isLocalhostHttp) {
-    throw new Error(`Hosted API URL must use HTTPS (or localhost HTTP). Received ${normalized}.`);
-  }
-  const pathname = parsed.pathname.replace(/\/+$/, "");
-  parsed.pathname = pathname.endsWith("/api") ? pathname.slice(0, -4) || "/" : pathname || "/";
-  parsed.search = "";
-  parsed.hash = "";
-  return parsed.toString().replace(/\/$/, "");
-}
 
 // ../runtime/src/auth-lease.ts
 var STORED_CREDENTIALS_LOCK_TIMEOUT_MS = 3e4;
 var STORED_CREDENTIALS_STALE_LOCK_MS = STORED_CREDENTIALS_LOCK_TIMEOUT_MS;
 var STORED_CREDENTIALS_LOCK_POLL_INTERVAL_MS = 50;
-var DEFAULT_AUTH_BASE_URL = "https://www.archal.ai";
-var WORKSPACE_API_KEY_EXPIRES_SECONDS = 365 * 24 * 60 * 60;
-function readFirstConfiguredBaseUrl(envVars) {
-  for (const envVar of envVars) {
-    const configured = trimEnv(envVar);
-    if (!configured) {
-      continue;
-    }
-    const normalized = normalizeApiBaseUrl(configured);
-    if (normalized) {
-      return normalized;
-    }
-  }
-  return null;
-}
-function resolveHostedAuthBaseUrl(options) {
-  const authUrlEnvVar = options.authUrlEnvVar ?? "ARCHAL_AUTH_URL";
-  const apiUrlEnvVar = options.apiUrlEnvVar ?? "ARCHAL_API_URL";
-  const envVars = [.../* @__PURE__ */ new Set([
-    apiUrlEnvVar,
-    authUrlEnvVar,
-    "ARCHAL_AUTH_URL",
-    "ARCHAL_AUTH_BASE_URL",
-    "ARCHAL_API_URL",
-    "ARCHAL_API_BASE_URL"
-  ])];
-  return readFirstConfiguredBaseUrl(envVars) ?? DEFAULT_AUTH_BASE_URL;
-}
 function isImplicitTestSandboxFlow() {
   if (trimEnv("ARCHAL_HOME")) {
     return false;
@@ -1446,59 +1336,11 @@ function readExplicitEnvCredentials(envName) {
   if (!token) {
     return { kind: "missing" };
   }
-  const claims = decodeJwtPayload(token);
-  const nowSeconds = Math.floor(Date.now() / 1e3);
-  if (claims === null) {
-    if (isWorkspaceApiKey(token)) {
-      return {
-        kind: "valid",
-        credentials: {
-          token,
-          refreshToken: "",
-          email: "(workspace-api-key)",
-          plan: "pro",
-          selectedCloneIds: [],
-          expiresAt: nowSeconds + WORKSPACE_API_KEY_EXPIRES_SECONDS
-        }
-      };
-    }
-    return {
-      kind: "invalid",
-      message: `${envName} must be a JWT with valid plan and exp claims or a workspace API key (archal_ws_...).`
-    };
-  }
-  const email = typeof claims["email"] === "string" ? claims["email"] : `(from ${envName})`;
-  if (!isPlan(claims["plan"])) {
-    return {
-      kind: "invalid",
-      message: `${envName} JWT does not contain a valid plan claim.`
-    };
+  const parsed = parseEnvToken(token, envName);
+  if (parsed.status !== "ok") {
+    return { kind: "invalid", message: parsed.message };
   }
-  const plan = claims["plan"];
-  if (typeof claims["exp"] !== "number" || !Number.isFinite(claims["exp"])) {
-    return {
-      kind: "invalid",
-      message: `${envName} JWT does not contain a valid exp claim.`
-    };
-  }
-  const expiresAt = claims["exp"];
-  if (expiresAt <= nowSeconds) {
-    return {
-      kind: "invalid",
-      message: `${envName} is expired. Remove it or replace it with a valid token.`
-    };
-  }
-  return {
-    kind: "valid",
-    credentials: {
-      token,
-      refreshToken: "",
-      email,
-      plan,
-      selectedCloneIds: [],
-      expiresAt
-    }
-  };
+  return { kind: "valid", credentials: parsed.credentials };
 }
 function readStoredCredentials(includeExpired = false) {
   prepareStoredCredentialSources();
@@ -1615,7 +1457,15 @@ async function resolveCurrentCredentials(credentials, source, forceValidation, a
 }
 async function createHostedAuthLease(options = {}) {
   const tokenEnvVar = options.tokenEnvVar ?? "ARCHAL_TOKEN";
-  const authBaseUrl = resolveHostedAuthBaseUrl(options);
+  const authBaseUrl = getConfiguredAuthValidationBaseUrl({
+    apiUrlEnvVar: options.apiUrlEnvVar,
+    authUrlEnvVar: options.authUrlEnvVar
+  });
+  if (!authBaseUrl) {
+    throw new Error(
+      "Hosted auth validation requires ARCHAL_AUTH_URL or ARCHAL_API_URL when ARCHAL_STRICT_ENDPOINTS=1."
+    );
+  }
   const resolved = resolveCredentialsWithSource(tokenEnvVar, true);
   if (!resolved) {
     const tokenSources = Array.from(/* @__PURE__ */ new Set([tokenEnvVar, "ARCHAL_TOKEN"])).join(", ");

package/dist/vitest/runtime/hosted-session-reaper.js

@@ -4,7 +4,7 @@ import {
   createHostedAuthLease,
   parsePositiveInteger,
   runHostedSessionReaper
-} from "../chunk-ARVS45PP.js";
+} from "../chunk-7L4BBB6M.js";
 
 // src/runtime/hosted-session-reaper.ts
 var VITEST_AUTH_LEASE_OPTIONS = {

package/dist/vitest/runtime/setup-files.js

@@ -1,7 +1,7 @@
 import {
   bootstrapArchalVitestRouting
-} from "../chunk-6CBYFCFK.js";
-import "../chunk-ARVS45PP.js";
+} from "../chunk-2PDHTPZC.js";
+import "../chunk-7L4BBB6M.js";
 
 // src/runtime/setup-files.ts
 import { existsSync, rmSync } from "fs";

package/manifest.json

@@ -0,0 +1,9 @@
+{
+  "version": 1,
+  "bundleKind": "archal-package-full",
+  "capabilities": [
+    "hosted-autoloop",
+    "clone-runtime",
+    "clone-free-autoloop"
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "archal",
-  "version": "0.9.20",
+  "version": "0.10.0",
   "description": "Test your agents & integrations against service clones",
   "type": "module",
   "main": "dist/index.cjs",
@@ -13,12 +13,10 @@
       "types": "./dist/index.d.cts",
       "default": "./dist/index.cjs"
     },
-    "./harness": {
-      "types": "./dist/harness.d.cts",
-      "default": "./dist/harness.cjs"
-    },
     "./scenarios": {
       "types": "./dist/scenarios.d.cts",
+      "import": "./dist/scenarios.cjs",
+      "require": "./dist/scenarios.cjs",
       "default": "./dist/scenarios.cjs"
     },
     "./vitest": {
@@ -49,13 +47,21 @@
   "files": [
     "bin",
     "dist",
+    "manifest.json",
     "skills",
     "clone-assets",
     "agents",
     "LICENSE"
   ],
+  "scripts": {
+    "verify:artifacts": "node scripts/assert-artifacts.mjs",
+    "prepack": "node scripts/assert-artifacts.mjs",
+    "prepare": "node scripts/prepare.cjs",
+    "typecheck:raw": "node --check bin/archal.cjs && node --check scripts/assert-artifacts.mjs && node --check scripts/prepare.cjs",
+    "typecheck": "pnpm run typecheck:raw"
+  },
   "peerDependencies": {
-    "vitest": ">=2.1.0"
+    "vitest": ">=2.1.0 <3"
   },
   "peerDependenciesMeta": {
     "vitest": {
@@ -65,11 +71,6 @@
   "dependencies": {
     "@aws-sdk/client-secrets-manager": "^3.1065.0",
     "e2b": "^2.28.2",
-    "picomatch": "^4.0.4"
-  },
-  "scripts": {
-    "verify:artifacts": "node scripts/assert-artifacts.mjs",
-    "typecheck:raw": "node --check bin/archal.cjs && node --check scripts/assert-artifacts.mjs && node --check scripts/prepare.cjs",
-    "typecheck": "pnpm run typecheck:raw"
+    "tsx": "^4.19.0"
   }
-}
+}

package/skills/archal-agent/SKILL.md

@@ -76,7 +76,6 @@ deeper flow.
 
 The Archal copilot is not locked to one model. When autofix reproduces a failure
 and writes a fix, the user can drive that remediation with their own agent —
-`archal preprod` exposes `--remediation-agent auto|codex|claude|cursor` so the
 fix is written by their Claude Code, Cursor, or Codex — or let Archal's managed
 agent do it. Mention this when the user asks who writes the fix or wants to use
 their own coding agent, then route to `autoloop`.