instar 1.3.538 → 1.3.539

package/dist/core/CredentialAuditEmit.d.ts

@@ -0,0 +1,82 @@
+/**
+ * CredentialAuditEmit — the SINGLE secret-scrub chokepoint for live credential re-pointing
+ * (spec §2.9, build-plan §7).
+ *
+ * Every `logs/credential-swaps.jsonl` audit write, every `/credentials/*` HTTP response body,
+ * and every attention-item this feature constructs routes through ONE `scrub(record)` funnel.
+ * The invariant the spec names — "no field of any persisted, audited, notified, or HTTP-served
+ * surface of this feature may contain token material" — is enforced STRUCTURALLY here, not by
+ * "remember to scrub at each of N callsites".
+ *
+ * ── Why a single chokepoint (spec §2.9, round-3) ──
+ * Node's `JSON.parse` error is position-only and does not echo bytes, so the real leak vector is
+ * developer-authored interpolation: a `${raw}`-bearing log line, a `security`/keychain stderr, a
+ * fetch error string that carries a token FRAGMENT inside a free-text `reason`/`error`/`message`.
+ * A FORBIDDEN_CREDENTIAL_FIELDS field-name scan does not catch a token hiding in free text. So
+ * this funnel deep-walks EVERY string in a record and runs each through `redactToken`-backed
+ * scrubbing before the record reaches any persisted/served/notified surface.
+ *
+ * ── The redaction (reuses CredentialProvider.redactToken — NOT re-authored) ──
+ * `redactToken(t)` → `[TOKEN:abc1****]`. We apply it to any token-shaped run: the `sk-ant-…`
+ * family (access/oauth/refresh tokens), and any long high-entropy base64url-ish run that could
+ * be a bearer/secret. Account ids, slot paths, emails-by-id, and ordinary prose pass through
+ * unchanged — the feature references accounts BY ID only, so a healthy record loses nothing.
+ *
+ * This module performs NO IO and NO credential access. It is a pure, deterministic, machine-local
+ * transform (Phase C: redaction is local-deterministic, no peer dependency).
+ */
+/**
+ * Scrub token material out of a single string. Reuses `redactToken` (the project's one redactor)
+ * on every token-shaped run. Idempotent: a `[TOKEN:…]` marker contains no token-shaped run that
+ * survives a second pass.
+ */
+export declare function scrubString(s: string): string;
+/**
+ * Deep-scrub an arbitrary JSON-able value: walks objects/arrays and scrubs every string leaf.
+ * Object KEYS are passed through unchanged (a key is a field name, never token material — and the
+ * §2.9 field-name scan covers forbidden keys separately). Non-string/number/bool/null leaves
+ * (functions, symbols) are dropped to a string form so nothing un-serializable rides along.
+ *
+ * THE chokepoint: `CredentialAuditEmit.scrub(record)` calls this. Every audit write, every
+ * `/credentials/*` response body, and every attention-item field passes through here.
+ */
+export declare function scrub<T>(record: T): T;
+/**
+ * The audit-emit handle the host wires into the swap executor + the routes. ONE instance per
+ * process; every emit path (jsonl, response, attention) calls the corresponding method, and each
+ * method scrubs BEFORE the value reaches its surface. Constructing the handle with an injected
+ * `writeLine` (the jsonl sink) and `emitAttention` keeps it IO-free + unit-testable.
+ */
+export interface CredentialAuditEmitDeps {
+    /** Append one already-stringified JSON line to `logs/credential-swaps.jsonl`. */
+    writeLine?: (line: string) => void;
+    /** Deliver one attention item (typically telegram.createAttentionItem). */
+    emitAttention?: (item: CredentialAttentionItem) => void | Promise<void>;
+    now?: () => string;
+}
+export interface CredentialAttentionItem {
+    id: string;
+    title: string;
+    summary: string;
+    description?: string;
+    category: string;
+    priority: 'URGENT' | 'HIGH' | 'NORMAL' | 'LOW';
+    sourceContext?: string;
+}
+export declare class CredentialAuditEmit {
+    private readonly writeLine?;
+    private readonly emitAttentionFn?;
+    private readonly now;
+    constructor(deps?: CredentialAuditEmitDeps);
+    /** Surface 1 — the jsonl audit write. Scrubs the record, stamps it, appends one line. */
+    audit(record: Record<string, unknown>): void;
+    /**
+     * Surface 2 — the `/credentials/*` HTTP response body. Returns the SCRUBBED body the route
+     * sends. The route MUST send `emit.response(body)`, never a raw body — this is the wiring the
+     * §2.9 chokepoint test asserts.
+     */
+    response<T>(body: T): T;
+    /** Surface 3 — the attention item. Scrubs every field, then delivers (best-effort). */
+    attention(item: CredentialAttentionItem): Promise<void>;
+}
+//# sourceMappingURL=CredentialAuditEmit.d.ts.map

package/dist/core/CredentialAuditEmit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialAuditEmit.d.ts","sourceRoot":"","sources":["../../src/core/CredentialAuditEmit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAkBH;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAS7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAErC;AAgBD;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,iFAAiF;IACjF,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,2EAA2E;IAC3E,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAyB;IACpD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAA0D;IAC3F,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,GAAE,uBAA4B;IAM9C,yFAAyF;IACzF,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAa5C;;;;OAIG;IACH,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC;IAIvB,uFAAuF;IACjF,SAAS,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;CAW9D"}

package/dist/core/CredentialAuditEmit.js

@@ -0,0 +1,132 @@
+/**
+ * CredentialAuditEmit — the SINGLE secret-scrub chokepoint for live credential re-pointing
+ * (spec §2.9, build-plan §7).
+ *
+ * Every `logs/credential-swaps.jsonl` audit write, every `/credentials/*` HTTP response body,
+ * and every attention-item this feature constructs routes through ONE `scrub(record)` funnel.
+ * The invariant the spec names — "no field of any persisted, audited, notified, or HTTP-served
+ * surface of this feature may contain token material" — is enforced STRUCTURALLY here, not by
+ * "remember to scrub at each of N callsites".
+ *
+ * ── Why a single chokepoint (spec §2.9, round-3) ──
+ * Node's `JSON.parse` error is position-only and does not echo bytes, so the real leak vector is
+ * developer-authored interpolation: a `${raw}`-bearing log line, a `security`/keychain stderr, a
+ * fetch error string that carries a token FRAGMENT inside a free-text `reason`/`error`/`message`.
+ * A FORBIDDEN_CREDENTIAL_FIELDS field-name scan does not catch a token hiding in free text. So
+ * this funnel deep-walks EVERY string in a record and runs each through `redactToken`-backed
+ * scrubbing before the record reaches any persisted/served/notified surface.
+ *
+ * ── The redaction (reuses CredentialProvider.redactToken — NOT re-authored) ──
+ * `redactToken(t)` → `[TOKEN:abc1****]`. We apply it to any token-shaped run: the `sk-ant-…`
+ * family (access/oauth/refresh tokens), and any long high-entropy base64url-ish run that could
+ * be a bearer/secret. Account ids, slot paths, emails-by-id, and ordinary prose pass through
+ * unchanged — the feature references accounts BY ID only, so a healthy record loses nothing.
+ *
+ * This module performs NO IO and NO credential access. It is a pure, deterministic, machine-local
+ * transform (Phase C: redaction is local-deterministic, no peer dependency).
+ */
+import { redactToken } from '../monitoring/CredentialProvider.js';
+/**
+ * The `sk-ant-…` token family Anthropic issues (oauth access `sk-ant-oat…`, api-key `sk-ant-api…`,
+ * refresh `sk-ant-ort…`, etc.). Matched first so the canonical leak vector is always redacted.
+ */
+const SK_ANT_RE = /sk-ant-[A-Za-z0-9_-]{8,}/g;
+/**
+ * A long high-entropy token-shaped run (≥32 chars of base64url/hex alphabet) that is NOT a
+ * recognizable non-secret. This catches a bearer/secret that does NOT carry the `sk-ant-` prefix
+ * (a keychain stderr could echo a raw blob). Deliberately conservative on the low end so ordinary
+ * ids / slot hashes / ISO timestamps are never mangled (an 8-hex slot suffix is far under 32).
+ */
+const LONG_TOKEN_RE = /\b[A-Za-z0-9_-]{32,}\b/g;
+/**
+ * Scrub token material out of a single string. Reuses `redactToken` (the project's one redactor)
+ * on every token-shaped run. Idempotent: a `[TOKEN:…]` marker contains no token-shaped run that
+ * survives a second pass.
+ */
+export function scrubString(s) {
+    if (!s)
+        return s;
+    let out = s.replace(SK_ANT_RE, (m) => redactToken(m));
+    out = out.replace(LONG_TOKEN_RE, (m) => {
+        // Never re-redact an already-emitted marker, and never touch the redactor's own output.
+        if (m.startsWith('TOKEN'))
+            return m;
+        return redactToken(m);
+    });
+    return out;
+}
+/**
+ * Deep-scrub an arbitrary JSON-able value: walks objects/arrays and scrubs every string leaf.
+ * Object KEYS are passed through unchanged (a key is a field name, never token material — and the
+ * §2.9 field-name scan covers forbidden keys separately). Non-string/number/bool/null leaves
+ * (functions, symbols) are dropped to a string form so nothing un-serializable rides along.
+ *
+ * THE chokepoint: `CredentialAuditEmit.scrub(record)` calls this. Every audit write, every
+ * `/credentials/*` response body, and every attention-item field passes through here.
+ */
+export function scrub(record) {
+    return deepScrub(record);
+}
+function deepScrub(v) {
+    if (typeof v === 'string')
+        return scrubString(v);
+    if (Array.isArray(v))
+        return v.map((x) => deepScrub(x));
+    if (v && typeof v === 'object') {
+        const out = {};
+        for (const [k, val] of Object.entries(v)) {
+            out[k] = deepScrub(val);
+        }
+        return out;
+    }
+    // number | boolean | null | undefined | bigint pass through unchanged (no token material).
+    return v;
+}
+export class CredentialAuditEmit {
+    writeLine;
+    emitAttentionFn;
+    now;
+    constructor(deps = {}) {
+        this.writeLine = deps.writeLine;
+        this.emitAttentionFn = deps.emitAttention;
+        this.now = deps.now ?? (() => new Date().toISOString());
+    }
+    /** Surface 1 — the jsonl audit write. Scrubs the record, stamps it, appends one line. */
+    audit(record) {
+        if (!this.writeLine)
+            return;
+        const scrubbed = scrub({ at: this.now(), ...record });
+        try {
+            this.writeLine(JSON.stringify(scrubbed) + '\n');
+        }
+        catch {
+            // @silent-fallback-ok — the audit jsonl is observability; a write failure (full disk, fs
+            // hiccup) must never throw into a swap/route. The actual credential operation is the
+            // load-bearing action and is unaffected; the next emit retries. (No token can leak here —
+            // the value was already scrubbed before the failing write.)
+        }
+    }
+    /**
+     * Surface 2 — the `/credentials/*` HTTP response body. Returns the SCRUBBED body the route
+     * sends. The route MUST send `emit.response(body)`, never a raw body — this is the wiring the
+     * §2.9 chokepoint test asserts.
+     */
+    response(body) {
+        return scrub(body);
+    }
+    /** Surface 3 — the attention item. Scrubs every field, then delivers (best-effort). */
+    async attention(item) {
+        if (!this.emitAttentionFn)
+            return;
+        const scrubbed = scrub(item);
+        try {
+            await this.emitAttentionFn(scrubbed);
+        }
+        catch {
+            // @silent-fallback-ok — attention delivery is best-effort; the swap/quarantine safety action
+            // it announces is already durably recorded in the ledger regardless of whether the notice
+            // lands. The item was already scrubbed before this call, so a delivery failure leaks nothing.
+        }
+    }
+}
+//# sourceMappingURL=CredentialAuditEmit.js.map

package/dist/core/CredentialAuditEmit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialAuditEmit.js","sourceRoot":"","sources":["../../src/core/CredentialAuditEmit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAElE;;;GAGG;AACH,MAAM,SAAS,GAAG,2BAA2B,CAAC;AAE9C;;;;;GAKG;AACH,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAEhD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,CAAS;IACnC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACjB,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE;QACrC,wFAAwF;QACxF,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC;QACpC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,KAAK,CAAI,MAAS;IAChC,OAAO,SAAS,CAAC,MAAM,CAAM,CAAC;AAChC,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,2FAA2F;IAC3F,OAAO,CAAC,CAAC;AACX,CAAC;AA0BD,MAAM,OAAO,mBAAmB;IACb,SAAS,CAA0B;IACnC,eAAe,CAA2D;IAC1E,GAAG,CAAe;IAEnC,YAAY,OAAgC,EAAE;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,aAAa,CAAC;QAC1C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,MAA+B;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,yFAAyF;YACzF,qFAAqF;YACrF,0FAA0F;YAC1F,4DAA4D;QAC9D,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAI,IAAO;QACjB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,SAAS,CAAC,IAA6B;QAC3C,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO;QAClC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,6FAA6F;YAC7F,0FAA0F;YAC1F,8FAA8F;QAChG,CAAC;IACH,CAAC;CACF"}

package/dist/core/CredentialManualLevers.d.ts

@@ -0,0 +1,57 @@
+/**
+ * CredentialManualLevers — the detective-control bookkeeping for the manual swap/set-default
+ * levers (spec §2.4 manual levers + §0.g force budget). Machine-local, in-memory, pure.
+ *
+ * The levers stay agent-callable (single-operator autonomy directive), so the control is
+ * DETECTIVE + structural + non-suppressible, not a PIN gate:
+ *   - per-PAIR cooldown      — a manual swap respects the per-pair cooldown by default; `force:true`
+ *                              overrides it, and the override is FLAGGED in the audit + notification.
+ *   - force budget (§0.g)    — the `force:true` bypass carries its OWN bounded budget:
+ *                              `maxForcedManualSwapsPerWindow`. Exhaustion refuses further FORCED
+ *                              manual swaps until the window rolls — `force` is not the one uncapped
+ *                              bypass left in the spec. A non-forced swap is never blocked by it.
+ *
+ * Every guard here makes "no safe action available" a SURFACED refusal (a named reason returned to
+ * the caller), never a silent drop and never an unbounded retry (§0.g(c)).
+ */
+export interface CredentialManualLeversDeps {
+    /** Per-pair cooldown ms (≥1× poll interval). */
+    pairCooldownMs?: number;
+    /** §0.g force budget: max FORCED manual swaps per window. */
+    maxForcedPerWindow?: number;
+    /** §0.g force budget window length ms. */
+    forcedWindowMs?: number;
+    now?: () => number;
+}
+/** A cooldown/budget verdict — allow, or a named refusal (surfaced, never silent). */
+export type LeverVerdict = {
+    allowed: true;
+    forced: boolean;
+} | {
+    allowed: false;
+    reason: string;
+    code: 'pair-cooldown' | 'force-budget-exhausted';
+};
+export declare class CredentialManualLevers {
+    private readonly pairCooldownMs;
+    private readonly maxForcedPerWindow;
+    private readonly forcedWindowMs;
+    private readonly now;
+    /** pairKey → last actuation epoch ms. */
+    private readonly lastActuation;
+    /** Forced-swap timestamps within the rolling window. */
+    private forcedTimestamps;
+    constructor(deps?: CredentialManualLeversDeps);
+    /**
+     * Evaluate whether a manual swap of (slotA, slotB) may proceed. `force` overrides the per-pair
+     * cooldown BUT is itself bounded by the force budget. Read-only — call `recordSwap` after a
+     * swap actually commits so the cooldown/budget advance only on real actuation.
+     */
+    evaluateSwap(slotA: string, slotB: string, force: boolean): LeverVerdict;
+    /** Record an actually-committed swap: advances the pair cooldown and (if forced) the budget. */
+    recordSwap(slotA: string, slotB: string, forced: boolean): void;
+    /** Forced swaps remaining in the current window (for observability). */
+    forcedBudgetRemaining(): number;
+    private pruneForcedWindow;
+}
+//# sourceMappingURL=CredentialManualLevers.d.ts.map

package/dist/core/CredentialManualLevers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialManualLevers.d.ts","sourceRoot":"","sources":["../../src/core/CredentialManualLevers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,MAAM,WAAW,0BAA0B;IACzC,gDAAgD;IAChD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6DAA6D;IAC7D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,sFAAsF;AACtF,MAAM,MAAM,YAAY,GACpB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAClC;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,eAAe,GAAG,wBAAwB,CAAA;CAAE,CAAC;AAOzF,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IAEnC,yCAAyC;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAC3D,wDAAwD;IACxD,OAAO,CAAC,gBAAgB,CAAgB;gBAE5B,IAAI,GAAE,0BAA+B;IAOjD;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,YAAY;IA8BxE,gGAAgG;IAChG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,IAAI;IAS/D,wEAAwE;IACxE,qBAAqB,IAAI,MAAM;IAK/B,OAAO,CAAC,iBAAiB;CAI1B"}

package/dist/core/CredentialManualLevers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialManualLevers.js","sourceRoot":"","sources":["../../src/core/CredentialManualLevers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,6CAA6C;AAC9F,MAAM,6BAA6B,GAAG,EAAE,CAAC,CAAC,iDAAiD;AAC3F,MAAM,wBAAwB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,oBAAoB;AAiBrE,wDAAwD;AACxD,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACnC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,sBAAsB;IAChB,cAAc,CAAS;IACvB,kBAAkB,CAAS;IAC3B,cAAc,CAAS;IACvB,GAAG,CAAe;IAEnC,yCAAyC;IACxB,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3D,wDAAwD;IAChD,gBAAgB,GAAa,EAAE,CAAC;IAExC,YAAY,OAAmC,EAAE;QAC/C,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;QACtE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,IAAI,6BAA6B,CAAC;QACnF,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;QACtE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,KAAc;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,IAAI,KAAK,SAAS,IAAI,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC;QAE1E,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,GAAG,CAAC,GAAG,GAAG,IAAK,CAAC,CAAC;gBACrD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,IAAI,EAAE,eAAe;oBACrB,MAAM,EAAE,wBAAwB,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,2CAA2C;iBACtG,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC1C,CAAC;QAED,oFAAoF;QACpF,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5D,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,wCAAwC,IAAI,CAAC,kBAAkB,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,kEAAkE;aACzL,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAED,gGAAgG;IAChG,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,MAAe;QACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,qBAAqB;QACnB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC7E,CAAC;IAEO,iBAAiB,CAAC,GAAW;QACnC,MAAM,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC;QACzC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;IAC1E,CAAC;CACF"}

package/dist/core/CredentialRestoreEnrollment.d.ts

@@ -0,0 +1,76 @@
+/**
+ * CredentialRestoreEnrollment — the teardown lever (spec §2.8, build-plan §7).
+ *
+ * `POST /credentials/restore-enrollment` moves every slot back to its enrollment layout (N
+ * ordinary §2.3 swaps back), then the operator darks the feature — at which point ledger ==
+ * enrollment and raw `configHome` reads are truthful again (the ordered-rollback the spec names).
+ *
+ * This module owns the ONE piece the plain swap executor does not: the per-slot DECISION of
+ * whether a slot's current blob may be EXCHANGED back into a healthy enrollment slot, or must be
+ * PARKED ONE-DIRECTIONALLY (moved out / the slot vacated for operator re-auth, NEVER exchanged in).
+ *
+ * ── Why a quarantine bypass that retains everything else (spec §0.g + §2.8) ──
+ * restore-enrollment is a TEARDOWN, not a balancing move, so it carries a QUARANTINE BYPASS — it
+ * must operate ON quarantined slots (the degraded state rollback exists for), or §2.3 step-1 would
+ * hard-block it exactly when it is needed. Per §0.g a bypass drops ONLY the named guard: it RETAINS
+ *   1. parse                       (an unparseable blob is parked, never exchanged)
+ *   2. refresh-token-present       (a refresh-token-less blob is parked, never exchanged)
+ *   3. IDENTITY-COHERENCE          (access-tenant == refresh-lineage; the §2.7 Frankenstein gap)
+ *
+ * ── The Frankenstein gap (spec §2.8 round-4) ──
+ * "Parses + has a refresh token" is NOT sufficient. A legacy `AccountSwitcher` slip can leave
+ * B's access token grafted onto A's PRESERVED refresh token: the blob parses, carries a refresh
+ * token, and the oracle (on B's still-valid access token) resolves it to B — yet on first refresh
+ * the client exchanges A's refresh token and silently resurrects A (a §0.d violation). So before
+ * any exchange, the blob's access-token identity (oracle) MUST equal its refresh-token lineage's
+ * expected account. A blob that fails coherence — Frankenstein, revoked-grant, access/refresh
+ * tenant mismatch — is parked ONE-DIRECTIONALLY exactly like an unparseable one, NEVER exchanged
+ * into a healthy slot (a teardown that exchanges garbage into a good slot, then post-commit-verify
+ * quarantines THAT slot, would spread corruption during the exact degraded state rollback is for).
+ *
+ * This module is the DECISION (coherence classification + the park plan). It performs NO keychain
+ * writes itself — the route drives the actual exchange through the §2.3 CredentialSwapExecutor and
+ * the actual park through the ledger quarantine + an attention item. Pure + injectable.
+ */
+import type { ClaudeOauth } from './OAuthRefresher.js';
+/** The expected refresh-lineage tenant of a slot's blob, and the oracle's access-token identity. */
+export interface CoherenceProbe {
+    /**
+     * The account the blob's ACCESS token resolves to via the identity oracle, or null when the
+     * oracle could not confirm it (timeout/401/5xx/etc — §2.11 unavailable, never a guess).
+     */
+    accessTenant: string | null;
+    /**
+     * The account the blob's REFRESH-token lineage is EXPECTED to belong to. When the oracle is
+     * reachable this is derived from the recorded provenance; when it is down the spec's named cheap
+     * proxy applies: the ledger's expected tenant for the slot. null = no expectation available.
+     */
+    refreshLineage: string | null;
+}
+export type CoherenceVerdict = {
+    coherent: true;
+    tenant: string;
+} | {
+    coherent: false;
+    reason: string;
+    park: 'one-directional';
+};
+/** A parsed blob to classify (the raw is round-tripped by the caller; we only read fields). */
+export interface RestoreBlob {
+    raw: string;
+    oauth: ClaudeOauth | null;
+}
+/**
+ * Classify a slot's current blob for restore-enrollment. Returns a COHERENT verdict (safe to
+ * EXCHANGE back to its enrollment slot) ONLY when ALL THREE retained preconditions hold:
+ *   parse + refresh-token-present + identity-coherence (accessTenant === refreshLineage).
+ * Any failure → an INCOHERENT verdict with `park: 'one-directional'` and a named reason — the
+ * caller must vacate the slot for operator re-auth and NEVER exchange this blob into a healthy slot.
+ *
+ * The oracle-down cheap proxy is the caller's job: it supplies `refreshLineage` from the ledger's
+ * expected tenant for the slot, and `accessTenant` may be null (oracle unavailable). When BOTH are
+ * known and equal → coherent; when the oracle is down (accessTenant null) we CANNOT certify
+ * coherence → one-directional park (the safe direction: never exchange an unverifiable blob).
+ */
+export declare function classifyRestoreCoherence(blob: RestoreBlob, probe: CoherenceProbe): CoherenceVerdict;
+//# sourceMappingURL=CredentialRestoreEnrollment.d.ts.map

package/dist/core/CredentialRestoreEnrollment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialRestoreEnrollment.d.ts","sourceRoot":"","sources":["../../src/core/CredentialRestoreEnrollment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD,oGAAoG;AACpG,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;OAIG;IACH,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEjE,+FAA+F;AAC/F,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAC3B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,GAAG,gBAAgB,CA4BnG"}

package/dist/core/CredentialRestoreEnrollment.js

@@ -0,0 +1,76 @@
+/**
+ * CredentialRestoreEnrollment — the teardown lever (spec §2.8, build-plan §7).
+ *
+ * `POST /credentials/restore-enrollment` moves every slot back to its enrollment layout (N
+ * ordinary §2.3 swaps back), then the operator darks the feature — at which point ledger ==
+ * enrollment and raw `configHome` reads are truthful again (the ordered-rollback the spec names).
+ *
+ * This module owns the ONE piece the plain swap executor does not: the per-slot DECISION of
+ * whether a slot's current blob may be EXCHANGED back into a healthy enrollment slot, or must be
+ * PARKED ONE-DIRECTIONALLY (moved out / the slot vacated for operator re-auth, NEVER exchanged in).
+ *
+ * ── Why a quarantine bypass that retains everything else (spec §0.g + §2.8) ──
+ * restore-enrollment is a TEARDOWN, not a balancing move, so it carries a QUARANTINE BYPASS — it
+ * must operate ON quarantined slots (the degraded state rollback exists for), or §2.3 step-1 would
+ * hard-block it exactly when it is needed. Per §0.g a bypass drops ONLY the named guard: it RETAINS
+ *   1. parse                       (an unparseable blob is parked, never exchanged)
+ *   2. refresh-token-present       (a refresh-token-less blob is parked, never exchanged)
+ *   3. IDENTITY-COHERENCE          (access-tenant == refresh-lineage; the §2.7 Frankenstein gap)
+ *
+ * ── The Frankenstein gap (spec §2.8 round-4) ──
+ * "Parses + has a refresh token" is NOT sufficient. A legacy `AccountSwitcher` slip can leave
+ * B's access token grafted onto A's PRESERVED refresh token: the blob parses, carries a refresh
+ * token, and the oracle (on B's still-valid access token) resolves it to B — yet on first refresh
+ * the client exchanges A's refresh token and silently resurrects A (a §0.d violation). So before
+ * any exchange, the blob's access-token identity (oracle) MUST equal its refresh-token lineage's
+ * expected account. A blob that fails coherence — Frankenstein, revoked-grant, access/refresh
+ * tenant mismatch — is parked ONE-DIRECTIONALLY exactly like an unparseable one, NEVER exchanged
+ * into a healthy slot (a teardown that exchanges garbage into a good slot, then post-commit-verify
+ * quarantines THAT slot, would spread corruption during the exact degraded state rollback is for).
+ *
+ * This module is the DECISION (coherence classification + the park plan). It performs NO keychain
+ * writes itself — the route drives the actual exchange through the §2.3 CredentialSwapExecutor and
+ * the actual park through the ledger quarantine + an attention item. Pure + injectable.
+ */
+/**
+ * Classify a slot's current blob for restore-enrollment. Returns a COHERENT verdict (safe to
+ * EXCHANGE back to its enrollment slot) ONLY when ALL THREE retained preconditions hold:
+ *   parse + refresh-token-present + identity-coherence (accessTenant === refreshLineage).
+ * Any failure → an INCOHERENT verdict with `park: 'one-directional'` and a named reason — the
+ * caller must vacate the slot for operator re-auth and NEVER exchange this blob into a healthy slot.
+ *
+ * The oracle-down cheap proxy is the caller's job: it supplies `refreshLineage` from the ledger's
+ * expected tenant for the slot, and `accessTenant` may be null (oracle unavailable). When BOTH are
+ * known and equal → coherent; when the oracle is down (accessTenant null) we CANNOT certify
+ * coherence → one-directional park (the safe direction: never exchange an unverifiable blob).
+ */
+export function classifyRestoreCoherence(blob, probe) {
+    // 1. Parse — an unparseable/absent oauth is parked one-directionally.
+    if (!blob.oauth || typeof blob.oauth !== 'object') {
+        return { coherent: false, reason: 'blob is unparseable or has no claudeAiOauth — parked for re-auth', park: 'one-directional' };
+    }
+    // 2. Refresh-token-present — a refresh-token-less blob cannot be a healthy lineage.
+    if (typeof blob.oauth.refreshToken !== 'string' || !blob.oauth.refreshToken) {
+        return { coherent: false, reason: 'blob carries no refresh token — parked for re-auth', park: 'one-directional' };
+    }
+    // 3. Identity-coherence — access-tenant MUST equal refresh-lineage (the Frankenstein gap).
+    if (!probe.accessTenant) {
+        // Oracle could not confirm the access-token identity → CANNOT certify coherence. Park (safe
+        // direction): never exchange a blob we cannot identity-verify back into a healthy slot.
+        return { coherent: false, reason: 'access-token identity unavailable (oracle down) — cannot certify coherence, parked', park: 'one-directional' };
+    }
+    if (!probe.refreshLineage) {
+        return { coherent: false, reason: 'no expected refresh-lineage for slot — cannot certify coherence, parked', park: 'one-directional' };
+    }
+    if (probe.accessTenant !== probe.refreshLineage) {
+        // The §2.7 Frankenstein blob: access resolves to one account, refresh lineage belongs to
+        // another. Exchanging it would resurrect the refresh-lineage account on first refresh.
+        return {
+            coherent: false,
+            reason: `identity-incoherent: access-tenant != refresh-lineage — parked one-directionally, never exchanged into a healthy slot`,
+            park: 'one-directional',
+        };
+    }
+    return { coherent: true, tenant: probe.accessTenant };
+}
+//# sourceMappingURL=CredentialRestoreEnrollment.js.map

package/dist/core/CredentialRestoreEnrollment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialRestoreEnrollment.js","sourceRoot":"","sources":["../../src/core/CredentialRestoreEnrollment.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AA6BH;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAiB,EAAE,KAAqB;IAC/E,sEAAsE;IACtE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,kEAAkE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAClI,CAAC;IACD,oFAAoF;IACpF,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QAC5E,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oDAAoD,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IACpH,CAAC;IACD,2FAA2F;IAC3F,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,4FAA4F;QAC5F,wFAAwF;QACxF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oFAAoF,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IACpJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,yEAAyE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IACzI,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,cAAc,EAAE,CAAC;QAChD,yFAAyF;QACzF,uFAAuF;QACvF,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,uHAAuH;YAC/H,IAAI,EAAE,iBAAiB;SACxB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;AACxD,CAAC"}

package/dist/core/types.d.ts

@@ -2740,6 +2740,13 @@ export interface InstarConfig {
              *  restore-enrollment) refuse with a named reason. Default true (the levers
              *  are still gated by `enabled`/`dryRun` above). */
             manualLeversEnabled?: boolean;
+            /** §0.g force budget: max FORCED (`force:true`) manual swaps per rolling
+             *  window. The `force:true` bypass of the per-pair cooldown carries its OWN
+             *  bounded budget so it is not the one uncapped bypass left in the spec.
+             *  Default 10 (generous under single-operator autonomy). */
+            maxForcedManualSwapsPerWindow?: number;
+            /** §0.g force-budget rolling window length ms. Default 3600000 (1h). */
+            forcedManualSwapWindowMs?: number;
             /** Balancer knobs (Increment B); all clamped at read-time. Present here so
              *  the config shape is stable from Increment A. */
             balancer?: {