synorch 0.2.0 → 0.4.0-beta.0

package/dist/harness/context/skills.js

@@ -0,0 +1,109 @@
+const CATALOG_DESCRIPTION_LIMIT = 120;
+const COMBINING_DOT_ABOVE = String.fromCharCode(0x0307);
+/** The first sentence of a catalog description, capped: enough to choose a skill, not to apply it. */
+export function catalogSummary(description) {
+    const flat = description.replace(/\s+/g, " ").trim();
+    const sentence = /^(.+?[.!?])(?:\s|$)/.exec(flat)?.[1] ?? flat;
+    return sentence.length <= CATALOG_DESCRIPTION_LIMIT ? sentence : `${sentence.slice(0, CATALOG_DESCRIPTION_LIMIT - 1).trimEnd()}…`;
+}
+export function renderCatalog(entries, inContext = new Set()) {
+    return [
+        "Skill catalog (call load_skill with a name; never read_file a SKILL.md):",
+        ...entries.map((entry) => `- ${entry.name}: ${inContext.has(entry.name) ? "(in context below)" : catalogSummary(entry.description)}`),
+    ].join("\n");
+}
+/**
+ * Locale-safe folding for trigger matching: Turkish dotted/dotless I (`İ`, `I`, `ı`) all fold to
+ * `i` before lowercasing, so `İMPLEMENTATION`, `implementatıon` and `Implementation` match the same
+ * phrase and `"İ".toLowerCase()` never leaves a stray combining dot behind.
+ */
+export function foldForMatch(text) {
+    return text.normalize("NFC").replace(/[İIı]/g, "i").toLowerCase().replaceAll(COMBINING_DOT_ABOVE, "");
+}
+function containsPhrase(haystack, phrase) {
+    const needle = foldForMatch(phrase.trim());
+    return needle.length > 0 && haystack.includes(needle);
+}
+export function triggeredSkills(entries, text) {
+    const haystack = foldForMatch(text);
+    return entries.filter((entry) => containsPhrase(haystack, entry.name) || entry.triggers.some((trigger) => containsPhrase(haystack, trigger)));
+}
+const REGISTRY_SCOPES = 512;
+export function skillScopeKey(scope) {
+    return [scope.runId, scope.taskId ?? "-", scope.attemptId ?? "-", scope.role].join("|");
+}
+export function createSkillContextRegistry() {
+    const scopes = new Map();
+    const entry = (scope) => {
+        const key = skillScopeKey(scope);
+        let found = scopes.get(key);
+        if (found === undefined) {
+            found = { injected: new Set(), loaded: new Set() };
+            scopes.set(key, found);
+            if (scopes.size > REGISTRY_SCOPES)
+                scopes.delete(scopes.keys().next().value);
+        }
+        return found;
+    };
+    return {
+        sync(scope, injected, loaded) {
+            const found = entry(scope);
+            found.injected = new Set(injected);
+            found.loaded = new Set(loaded);
+        },
+        noteLoaded(scope, name) {
+            entry(scope).loaded.add(name);
+        },
+        state(scope, name) {
+            const found = scopes.get(skillScopeKey(scope));
+            if (found?.injected.has(name) === true)
+                return "injected";
+            if (found?.loaded.has(name) === true)
+                return "loaded";
+            return undefined;
+        },
+    };
+}
+const SKILL_TEXT_LIMIT = 60 * 1024;
+const NOT_LOADED_AGAIN = "it was not loaded again";
+/** True for a `load_skill` result that carried no skill content (the skill was already in context). */
+export function isDuplicateSkillLoad(resultText) {
+    return resultText.includes(NOT_LOADED_AGAIN);
+}
+function ok(text, truncated = false) {
+    return { status: "ok", text, truncated, redactions: 0 };
+}
+/**
+ * The `load_skill` control callback (ADR-20, AC-d5). It serves a catalog skill allowed for the
+ * caller's role once per conversation: a skill the ContextBuilder already injected (or the role's
+ * primary skill) answers "already in your context" and a skill loaded earlier answers "already
+ * loaded", both without repeating the content. It never widens a task's read scope to `.ai/**`.
+ */
+export function createSkillLoadCallback(deps) {
+    const registry = deps.registry ?? createSkillContextRegistry();
+    const limit = deps.maxChars ?? SKILL_TEXT_LIMIT;
+    return async (input, context) => {
+        const name = input.name.trim();
+        const scope = { runId: context.runId, taskId: context.taskId, attemptId: context.attemptId, role: context.role };
+        const primary = (await deps.skills.primary?.(context.role)) ?? [];
+        const state = registry.state(scope, name) ?? (primary.includes(name) ? "injected" : undefined);
+        if (state === "injected")
+            return ok(`Skill ${name} is already in your context (system instructions); use that copy, ${NOT_LOADED_AGAIN}.`);
+        if (state === "loaded")
+            return ok(`Skill ${name} was already loaded earlier in this conversation; use that result, ${NOT_LOADED_AGAIN}.`);
+        const text = await deps.skills.load(name, context.role);
+        if (text === undefined) {
+            const available = (await deps.skills.list(context.role)).map((entry) => entry.name);
+            return {
+                status: "error",
+                text: "",
+                truncated: false,
+                redactions: 0,
+                error: { code: "invalid_arguments", message: `skill ${name} is not in the ${context.role} catalog; available: ${available.join(", ") || "none"}`.slice(0, 2000) },
+            };
+        }
+        registry.noteLoaded(scope, name);
+        return ok(text.slice(0, limit), text.length > limit);
+    };
+}
+//# sourceMappingURL=skills.js.map

package/dist/harness/context/skills.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../../src/harness/context/skills.ts"],"names":[],"mappings":"AA6BA,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,mBAAmB,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;AAExD,sGAAsG;AACtG,MAAM,UAAU,cAAc,CAAC,WAAmB;IAChD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC/D,OAAO,QAAQ,CAAC,MAAM,IAAI,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,yBAAyB,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;AACpI,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAA8B,EAAE,YAAiC,IAAI,GAAG,EAAE;IACtG,OAAO;QACL,0EAA0E;QAC1E,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;KACtI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACxG,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,MAAc;IACtD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAA8B,EAAE,IAAY;IAC1E,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAChJ,CAAC;AAuBD,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,IAAI,GAAG,EAAE,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0D,CAAC;IACjF,MAAM,KAAK,GAAG,CAAC,KAAiB,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;YACnD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACvB,IAAI,MAAM,CAAC,IAAI,GAAG,eAAe;gBAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,OAAO;QACL,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM;YAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;YAC3B,KAAK,CAAC,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;YACnC,KAAK,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,UAAU,CAAC,KAAK,EAAE,IAAI;YACpB,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,CAAC,KAAK,EAAE,IAAI;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/C,IAAI,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,UAAU,CAAC;YAC1D,IAAI,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;gBAAE,OAAO,QAAQ,CAAC;YACtD,OAAO,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC;AAYD,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AAEnD,uGAAuG;AACvG,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACrD,OAAO,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,EAAE,CAAC,IAAY,EAAE,SAAS,GAAG,KAAK;IACzC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAA2B;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,0BAA0B,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC;IAChD,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAe,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7H,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC/F,IAAI,KAAK,KAAK,UAAU;YAAE,OAAO,EAAE,CAAC,SAAS,IAAI,qEAAqE,gBAAgB,GAAG,CAAC,CAAC;QAC3I,IAAI,KAAK,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC,SAAS,IAAI,sEAAsE,gBAAgB,GAAG,CAAC,CAAC;QAC1I,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpF,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,EAAE;gBACR,SAAS,EAAE,KAAK;gBAChB,UAAU,EAAE,CAAC;gBACb,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,SAAS,IAAI,kBAAkB,OAAO,CAAC,IAAI,wBAAwB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE;aAClK,CAAC;QACJ,CAAC;QACD,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACjC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC"}

package/dist/harness/context/tokens.d.ts

@@ -0,0 +1,10 @@
+import type { ModelMessage, SystemBlock, ToolDescriptor } from "../contracts/index.ts";
+/**
+ * A provider-neutral token estimate (about four characters per token). It only has to be stable
+ * and conservative enough to budget a context; providers report the real numbers afterwards.
+ */
+export declare function estimateTokens(text: string): number;
+export declare function messageTokens(message: ModelMessage): number;
+export declare function blockTokens(block: Pick<SystemBlock, "text">): number;
+export declare function toolTokens(tools: readonly ToolDescriptor[]): number;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/harness/context/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/harness/context/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvF;;;GAGG;AAEH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAwB3D;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,CAEpE;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,GAAG,MAAM,CAEnE"}

package/dist/harness/context/tokens.js

@@ -0,0 +1,39 @@
+/**
+ * A provider-neutral token estimate (about four characters per token). It only has to be stable
+ * and conservative enough to budget a context; providers report the real numbers afterwards.
+ */
+export function estimateTokens(text) {
+    return text.length === 0 ? 0 : Math.ceil(text.length / 4);
+}
+export function messageTokens(message) {
+    let total = 4;
+    for (const part of message.content) {
+        switch (part.type) {
+            case "text":
+            case "thinking":
+                total += estimateTokens(part.text);
+                break;
+            case "tool_call":
+                total += estimateTokens(part.name) + estimateTokens(JSON.stringify(part.arguments));
+                break;
+            case "tool_result":
+                total += estimateTokens(part.text);
+                break;
+            case "blob":
+                total += 16;
+                break;
+            case "image":
+                // Providers bill an image by pixels (roughly 1-2k tokens for a screenshot); budget conservatively.
+                total += 1600;
+                break;
+        }
+    }
+    return total;
+}
+export function blockTokens(block) {
+    return estimateTokens(block.text) + 4;
+}
+export function toolTokens(tools) {
+    return tools.reduce((sum, tool) => sum + estimateTokens(tool.name + tool.description + JSON.stringify(tool.input_schema)), 0);
+}
+//# sourceMappingURL=tokens.js.map

package/dist/harness/context/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../src/harness/context/tokens.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACnC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,MAAM,CAAC;YACZ,KAAK,UAAU;gBACb,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnC,MAAM;YACR,KAAK,WAAW;gBACd,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;gBACpF,MAAM;YACR,KAAK,aAAa;gBAChB,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnC,MAAM;YACR,KAAK,MAAM;gBACT,KAAK,IAAI,EAAE,CAAC;gBACZ,MAAM;YACR,KAAK,OAAO;gBACV,mGAAmG;gBACnG,KAAK,IAAI,IAAI,CAAC;gBACd,MAAM;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAgC;IAC1D,OAAO,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAgC;IACzD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAChI,CAAC"}

package/dist/harness/contracts/auth.d.ts

@@ -0,0 +1,214 @@
+import { z } from "zod";
+import { type ProviderId } from "./ids.ts";
+/**
+ * Authentication is split from model access. An `AuthProvider` owns one (provider, method,
+ * profile) identity; a `CredentialStore` persists secrets for the identities Synorch owns. A
+ * `cli-bridge` identity is owned by the user's own installed client (Claude Code, Codex): Synorch
+ * never sees, stores or copies its tokens, so no secret schema exists for it.
+ */
+export declare const AUTH_METHODS: readonly ["oauth-subscription", "cli-bridge", "api-key"];
+export declare const authMethodSchema: z.ZodEnum<{
+    "oauth-subscription": "oauth-subscription";
+    "cli-bridge": "cli-bridge";
+    "api-key": "api-key";
+}>;
+export type AuthMethodKind = (typeof AUTH_METHODS)[number];
+export declare const AUTH_STATES: readonly ["connected", "expired", "login_required", "disconnected", "unknown", "error"];
+/**
+ * Where secrets are kept, reported truthfully: `os-keychain` is a real OS credential store (macOS
+ * Keychain, Secret Service); `os-dpapi` is a file holding only ciphertext encrypted with Windows
+ * DPAPI for the current user; `file-0600` is plain text protected by file mode only.
+ */
+export declare const CREDENTIAL_STORE_BACKENDS: readonly ["os-keychain", "os-dpapi", "file-0600", "memory"];
+export type CredentialStoreBackend = (typeof CREDENTIAL_STORE_BACKENDS)[number];
+export declare const profileNameSchema: z.ZodString;
+export declare const credentialRefSchema: z.ZodObject<{
+    provider_id: z.core.$ZodBranded<z.ZodString, "ProviderId", "out">;
+    method: z.ZodEnum<{
+        "oauth-subscription": "oauth-subscription";
+        "cli-bridge": "cli-bridge";
+        "api-key": "api-key";
+    }>;
+    profile: z.ZodString;
+}, z.core.$strict>;
+export type CredentialRef = z.infer<typeof credentialRefSchema>;
+/** Keychain service name; the account key is `<provider>:<method>:<profile>`. */
+export declare const CREDENTIAL_SERVICE_NAME = "synorch";
+export declare function credentialAccountKey(ref: CredentialRef): string;
+/** What `syn auth status` and `doctor --runtime` show. Never carries a secret. */
+export declare const authStatusSchema: z.ZodObject<{
+    provider_id: z.core.$ZodBranded<z.ZodString, "ProviderId", "out">;
+    method: z.ZodEnum<{
+        "oauth-subscription": "oauth-subscription";
+        "cli-bridge": "cli-bridge";
+        "api-key": "api-key";
+    }>;
+    profile: z.ZodString;
+    state: z.ZodEnum<{
+        error: "error";
+        unknown: "unknown";
+        expired: "expired";
+        connected: "connected";
+        login_required: "login_required";
+        disconnected: "disconnected";
+    }>;
+    account_label: z.ZodOptional<z.ZodString>;
+    plan_label: z.ZodOptional<z.ZodString>;
+    entitlement: z.ZodEnum<{
+        unknown: "unknown";
+        verified: "verified";
+        unverified: "unverified";
+    }>;
+    billing: z.ZodEnum<{
+        unknown: "unknown";
+        subscription: "subscription";
+        metered: "metered";
+    }>;
+    expires_at: z.ZodOptional<z.ZodISODateTime>;
+    store_backend: z.ZodOptional<z.ZodEnum<{
+        "os-keychain": "os-keychain";
+        "os-dpapi": "os-dpapi";
+        "file-0600": "file-0600";
+        memory: "memory";
+    }>>;
+    detail: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type AuthStatus = z.infer<typeof authStatusSchema>;
+/** Stored secret shapes. `cli-bridge` is deliberately absent: its credentials are never ours. */
+export declare const credentialSecretSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    method: z.ZodLiteral<"oauth-subscription">;
+    access_token: z.ZodString;
+    refresh_token: z.ZodString;
+    id_token: z.ZodOptional<z.ZodString>;
+    expires_at: z.ZodISODateTime;
+    account_id: z.ZodOptional<z.ZodString>;
+    plan_type: z.ZodOptional<z.ZodString>;
+    originator: z.ZodLiteral<"synorch">;
+    obtained_at: z.ZodISODateTime;
+    last_refresh_at: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strict>, z.ZodObject<{
+    method: z.ZodLiteral<"api-key">;
+    api_key: z.ZodString;
+    created_at: z.ZodISODateTime;
+}, z.core.$strict>], "method">;
+export type CredentialSecret = z.infer<typeof credentialSecretSchema>;
+/** File fallback layout: `~/.synorch/credentials.json`, mode 0600, directory 0700. */
+export declare const credentialFileSchema: z.ZodObject<{
+    schema_version: z.ZodLiteral<1>;
+    profiles: z.ZodRecord<z.ZodString, z.ZodObject<{
+        ref: z.ZodObject<{
+            provider_id: z.core.$ZodBranded<z.ZodString, "ProviderId", "out">;
+            method: z.ZodEnum<{
+                "oauth-subscription": "oauth-subscription";
+                "cli-bridge": "cli-bridge";
+                "api-key": "api-key";
+            }>;
+            profile: z.ZodString;
+        }, z.core.$strict>;
+        secret: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            method: z.ZodLiteral<"oauth-subscription">;
+            access_token: z.ZodString;
+            refresh_token: z.ZodString;
+            id_token: z.ZodOptional<z.ZodString>;
+            expires_at: z.ZodISODateTime;
+            account_id: z.ZodOptional<z.ZodString>;
+            plan_type: z.ZodOptional<z.ZodString>;
+            originator: z.ZodLiteral<"synorch">;
+            obtained_at: z.ZodISODateTime;
+            last_refresh_at: z.ZodOptional<z.ZodISODateTime>;
+        }, z.core.$strict>, z.ZodObject<{
+            method: z.ZodLiteral<"api-key">;
+            api_key: z.ZodString;
+            created_at: z.ZodISODateTime;
+        }, z.core.$strict>], "method">;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type CredentialFile = z.infer<typeof credentialFileSchema>;
+/**
+ * Other applications' credential stores. Reading, copying or writing any of them is a hard
+ * non-goal (ADR-05): Synorch performs its own login or drives the official client, never both.
+ */
+export declare const FORBIDDEN_CREDENTIAL_SOURCES: readonly ["~/.claude/.credentials.json", "~/.claude.json", "~/.codex/auth.json", "keychain:Claude Code-credentials"];
+/**
+ * Removed from a bridge child's environment so a subscription bridge never bills an API key, a
+ * cloud account (Bedrock, Vertex) or a redirected endpoint silently (SEC-M2). Every name starting
+ * with a `BRIDGE_STRIPPED_ENV_PREFIXES` entry is removed as well.
+ */
+export declare const BRIDGE_STRIPPED_ENV: readonly ["ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL", "CLAUDE_CODE_OAUTH_TOKEN", "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_VERTEX", "AWS_BEARER_TOKEN_BEDROCK", "OPENAI_API_KEY", "CODEX_API_KEY"];
+/** Name prefixes stripped from a bridge child's environment (`ANTHROPIC_*`, `CLAUDE_CODE_USE_*`). */
+export declare const BRIDGE_STRIPPED_ENV_PREFIXES: readonly ["ANTHROPIC_", "CLAUDE_CODE_USE_"];
+/** True when `name` must not reach a bridge child. Matching is case-insensitive (Windows env names are). */
+export declare function isBridgeStrippedEnvName(name: string): boolean;
+export declare const AUTH_NOTICE_IDS: readonly ["chatgpt-subscription", "claude-bridge-experimental", "api-key-billing", "plaintext-credential-file"];
+export interface AuthNotice {
+    readonly id: (typeof AUTH_NOTICE_IDS)[number];
+    readonly text: string;
+    /** When true the login does not proceed until the user acknowledges it once per profile. */
+    readonly requiresAcknowledgement: boolean;
+}
+export interface DeviceCodePrompt {
+    readonly verificationUri: string;
+    readonly userCode: string;
+    readonly expiresAt: string;
+}
+/** The only channel an auth flow may use to reach the user; the TUI and plain renderers implement it. */
+export interface AuthInteraction {
+    readonly interactive: boolean;
+    openBrowser(url: string): Promise<boolean>;
+    showDeviceCode(prompt: DeviceCodePrompt): void;
+    promptSecret(label: string, signal: AbortSignal): Promise<string>;
+    acknowledge(notice: AuthNotice, signal: AbortSignal): Promise<boolean>;
+    notify(message: string): void;
+}
+/**
+ * A usable credential for one request. The secret stays inside the implementation: it can be
+ * applied to outgoing headers and reported to the redactor, but never serialized.
+ */
+export interface ResolvedCredential {
+    readonly providerId: ProviderId;
+    readonly method: Exclude<AuthMethodKind, "cli-bridge">;
+    readonly profile: string;
+    readonly expiresAt: string | undefined;
+    applyTo(headers: Headers): void;
+    redactionValues(): readonly string[];
+    toJSON(): "[redacted]";
+}
+export interface ResolveOptions {
+    /**
+     * The provider rejected a credential that still looked valid locally (HTTP 401): refresh under the
+     * profile's refresh lock unless another process already rotated it since this process last
+     * issued it. Only `oauth-subscription` providers can refresh; other methods resolve as usual, so
+     * callers retry a rejected request only for that method.
+     */
+    readonly forceRefresh?: boolean;
+}
+export interface AuthProvider {
+    readonly providerId: ProviderId;
+    readonly method: AuthMethodKind;
+    readonly profile: string;
+    readonly notices: readonly AuthNotice[];
+    status(signal: AbortSignal): Promise<AuthStatus>;
+    login(interaction: AuthInteraction, signal: AbortSignal): Promise<AuthStatus>;
+    logout(signal: AbortSignal): Promise<void>;
+    /**
+     * Returns a fresh credential, refreshing under the store's per-profile refresh lock when needed.
+     * Throws `ProviderFailure` with `auth_expired` / `unauthenticated`; never falls back to another
+     * method or profile. A `cli-bridge` provider rejects with `invalid_request`: bridges resolve
+     * their own credentials inside the user's client.
+     */
+    resolve(signal: AbortSignal, options?: ResolveOptions): Promise<ResolvedCredential>;
+}
+export interface CredentialStore {
+    readonly backend: CredentialStoreBackend;
+    get(ref: CredentialRef): Promise<CredentialSecret | undefined>;
+    set(ref: CredentialRef, secret: CredentialSecret): Promise<void>;
+    delete(ref: CredentialRef): Promise<boolean>;
+    list(): Promise<readonly CredentialRef[]>;
+    /**
+     * Runs `refresh` while holding a cross-process lock for this profile. The old secret is kept
+     * until the new one is durably written; a permanent refresh failure moves the profile to
+     * `login_required` instead of deleting it.
+     */
+    withRefreshLock<T>(ref: CredentialRef, refresh: () => Promise<T>, signal: AbortSignal): Promise<T>;
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/harness/contracts/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/harness/contracts/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAE7D;;;;;GAKG;AAEH,eAAO,MAAM,YAAY,0DAA2D,CAAC;AACrF,eAAO,MAAM,gBAAgB;;;;EAAuB,CAAC;AACrD,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,eAAO,MAAM,WAAW,yFAOd,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,6DAA8D,CAAC;AACrG,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF,eAAO,MAAM,iBAAiB,aAGsC,CAAC;AAErE,eAAO,MAAM,mBAAmB;;;;;;;;kBAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,YAAY,CAAC;AAEjD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAE/D;AAED,kFAAkF;AAClF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAY3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAqB1D,iGAAiG;AACjG,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;8BAGjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,sFAAsF;AACtF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAG/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,4BAA4B,sHAK/B,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,6NAUtB,CAAC;AAEX,qGAAqG;AACrG,eAAO,MAAM,4BAA4B,6CAA8C,CAAC;AAExF,4GAA4G;AAC5G,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAG7D;AAED,eAAO,MAAM,eAAe,iHAKlB,CAAC;AAEX,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC;CAC3C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,yGAAyG;AACzG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3C,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC/C,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClE,WAAW,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IAChC,eAAe,IAAI,SAAS,MAAM,EAAE,CAAC;IACrC,MAAM,IAAI,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACjD,KAAK,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9E,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C;;;;;OAKG;IACH,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IAC/D,GAAG,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,MAAM,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,IAAI,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IAC1C;;;;OAIG;IACH,eAAe,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACpG"}

package/dist/harness/contracts/auth.js

@@ -0,0 +1,120 @@
+import { z } from "zod";
+import { timestampSchema } from "./common.js";
+import { providerIdSchema } from "./ids.js";
+/**
+ * Authentication is split from model access. An `AuthProvider` owns one (provider, method,
+ * profile) identity; a `CredentialStore` persists secrets for the identities Synorch owns. A
+ * `cli-bridge` identity is owned by the user's own installed client (Claude Code, Codex): Synorch
+ * never sees, stores or copies its tokens, so no secret schema exists for it.
+ */
+export const AUTH_METHODS = ["oauth-subscription", "cli-bridge", "api-key"];
+export const authMethodSchema = z.enum(AUTH_METHODS);
+export const AUTH_STATES = [
+    "connected",
+    "expired",
+    "login_required",
+    "disconnected",
+    "unknown",
+    "error",
+];
+/**
+ * Where secrets are kept, reported truthfully: `os-keychain` is a real OS credential store (macOS
+ * Keychain, Secret Service); `os-dpapi` is a file holding only ciphertext encrypted with Windows
+ * DPAPI for the current user; `file-0600` is plain text protected by file mode only.
+ */
+export const CREDENTIAL_STORE_BACKENDS = ["os-keychain", "os-dpapi", "file-0600", "memory"];
+export const profileNameSchema = z
+    .string()
+    .max(64)
+    .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/, "profile must be kebab-case");
+export const credentialRefSchema = z.strictObject({
+    provider_id: providerIdSchema,
+    method: authMethodSchema,
+    profile: profileNameSchema,
+});
+/** Keychain service name; the account key is `<provider>:<method>:<profile>`. */
+export const CREDENTIAL_SERVICE_NAME = "synorch";
+export function credentialAccountKey(ref) {
+    return `${ref.provider_id}:${ref.method}:${ref.profile}`;
+}
+/** What `syn auth status` and `doctor --runtime` show. Never carries a secret. */
+export const authStatusSchema = z.strictObject({
+    provider_id: providerIdSchema,
+    method: authMethodSchema,
+    profile: profileNameSchema,
+    state: z.enum(AUTH_STATES),
+    account_label: z.string().max(200).optional(),
+    plan_label: z.string().max(100).optional(),
+    entitlement: z.enum(["verified", "unverified", "unknown"]),
+    billing: z.enum(["subscription", "metered", "unknown"]),
+    expires_at: timestampSchema.optional(),
+    store_backend: z.enum(CREDENTIAL_STORE_BACKENDS).optional(),
+    detail: z.string().max(500).optional(),
+});
+const oauthSubscriptionSecretSchema = z.strictObject({
+    method: z.literal("oauth-subscription"),
+    access_token: z.string().min(1),
+    refresh_token: z.string().min(1),
+    id_token: z.string().min(1).optional(),
+    expires_at: timestampSchema,
+    account_id: z.string().min(1).optional(),
+    plan_type: z.string().min(1).optional(),
+    originator: z.literal("synorch"),
+    obtained_at: timestampSchema,
+    last_refresh_at: timestampSchema.optional(),
+});
+const apiKeySecretSchema = z.strictObject({
+    method: z.literal("api-key"),
+    api_key: z.string().min(1),
+    created_at: timestampSchema,
+});
+/** Stored secret shapes. `cli-bridge` is deliberately absent: its credentials are never ours. */
+export const credentialSecretSchema = z.discriminatedUnion("method", [
+    oauthSubscriptionSecretSchema,
+    apiKeySecretSchema,
+]);
+/** File fallback layout: `~/.synorch/credentials.json`, mode 0600, directory 0700. */
+export const credentialFileSchema = z.strictObject({
+    schema_version: z.literal(1),
+    profiles: z.record(z.string().min(1), z.strictObject({ ref: credentialRefSchema, secret: credentialSecretSchema })),
+});
+/**
+ * Other applications' credential stores. Reading, copying or writing any of them is a hard
+ * non-goal (ADR-05): Synorch performs its own login or drives the official client, never both.
+ */
+export const FORBIDDEN_CREDENTIAL_SOURCES = [
+    "~/.claude/.credentials.json",
+    "~/.claude.json",
+    "~/.codex/auth.json",
+    "keychain:Claude Code-credentials",
+];
+/**
+ * Removed from a bridge child's environment so a subscription bridge never bills an API key, a
+ * cloud account (Bedrock, Vertex) or a redirected endpoint silently (SEC-M2). Every name starting
+ * with a `BRIDGE_STRIPPED_ENV_PREFIXES` entry is removed as well.
+ */
+export const BRIDGE_STRIPPED_ENV = [
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "ANTHROPIC_BASE_URL",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "CLAUDE_CODE_USE_BEDROCK",
+    "CLAUDE_CODE_USE_VERTEX",
+    "AWS_BEARER_TOKEN_BEDROCK",
+    "OPENAI_API_KEY",
+    "CODEX_API_KEY",
+];
+/** Name prefixes stripped from a bridge child's environment (`ANTHROPIC_*`, `CLAUDE_CODE_USE_*`). */
+export const BRIDGE_STRIPPED_ENV_PREFIXES = ["ANTHROPIC_", "CLAUDE_CODE_USE_"];
+/** True when `name` must not reach a bridge child. Matching is case-insensitive (Windows env names are). */
+export function isBridgeStrippedEnvName(name) {
+    const upper = name.toUpperCase();
+    return BRIDGE_STRIPPED_ENV.includes(upper) || BRIDGE_STRIPPED_ENV_PREFIXES.some((prefix) => upper.startsWith(prefix));
+}
+export const AUTH_NOTICE_IDS = [
+    "chatgpt-subscription",
+    "claude-bridge-experimental",
+    "api-key-billing",
+    "plaintext-credential-file",
+];
+//# sourceMappingURL=auth.js.map

package/dist/harness/contracts/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/harness/contracts/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAmB,MAAM,UAAU,CAAC;AAE7D;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,oBAAoB,EAAE,YAAY,EAAE,SAAS,CAAU,CAAC;AACrF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;AAGrD,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,WAAW;IACX,SAAS;IACT,gBAAgB;IAChB,cAAc;IACd,SAAS;IACT,OAAO;CACC,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAU,CAAC;AAGrG,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,EAAE;KACR,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,4BAA4B,EAAE,4BAA4B,CAAC,CAAC;AAErE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,YAAY,CAAC;IAChD,WAAW,EAAE,gBAAgB;IAC7B,MAAM,EAAE,gBAAgB;IACxB,OAAO,EAAE,iBAAiB;CAC3B,CAAC,CAAC;AAGH,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAEjD,MAAM,UAAU,oBAAoB,CAAC,GAAkB;IACrD,OAAO,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AAC3D,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC7C,WAAW,EAAE,gBAAgB;IAC7B,MAAM,EAAE,gBAAgB;IACxB,OAAO,EAAE,iBAAiB;IAC1B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC7C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;IAC1D,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACvD,UAAU,EAAE,eAAe,CAAC,QAAQ,EAAE;IACtC,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE;IAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,MAAM,6BAA6B,GAAG,CAAC,CAAC,YAAY,CAAC;IACnD,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;IACvC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACtC,UAAU,EAAE,eAAe;IAC3B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAChC,WAAW,EAAE,eAAe;IAC5B,eAAe,EAAE,eAAe,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,CAAC,CAAC,YAAY,CAAC;IACxC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,UAAU,EAAE,eAAe;CAC5B,CAAC,CAAC;AAEH,iGAAiG;AACjG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACnE,6BAA6B;IAC7B,kBAAkB;CACnB,CAAC,CAAC;AAGH,sFAAsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,YAAY,CAAC;IACjD,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;CACpH,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC1C,6BAA6B;IAC7B,gBAAgB;IAChB,oBAAoB;IACpB,kCAAkC;CAC1B,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,mBAAmB;IACnB,sBAAsB;IACtB,oBAAoB;IACpB,yBAAyB;IACzB,yBAAyB;IACzB,wBAAwB;IACxB,0BAA0B;IAC1B,gBAAgB;IAChB,eAAe;CACP,CAAC;AAEX,qGAAqG;AACrG,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,YAAY,EAAE,kBAAkB,CAAU,CAAC;AAExF,4GAA4G;AAC5G,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAQ,mBAAyC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/I,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,sBAAsB;IACtB,4BAA4B;IAC5B,iBAAiB;IACjB,2BAA2B;CACnB,CAAC"}

package/dist/harness/contracts/choice.d.ts

@@ -0,0 +1,115 @@
+import { z } from "zod";
+/**
+ * K5 choice questions: one shape for every question the harness puts to the user (the `/init`
+ * confirmation, approval cards, `/model`, `/config`, the memory desk, the agent's `ask_user` and
+ * Claude Code's own AskUserQuestion). The interactive renderer shows it as a focused modal; plain
+ * mode prints the numbered equivalent and parses what is typed (`parseTypedChoice`).
+ */
+export interface ChoiceOption {
+    readonly label: string;
+    /** One dim line under the label. */
+    readonly description?: string;
+    /** A short preview block (code, mockup) shown under the highlighted option. */
+    readonly preview?: string;
+    /** Tagged "Recommended"; at most one per question. */
+    readonly recommended?: boolean;
+    /** Shown but not selectable; the text says why. */
+    readonly disabled?: string;
+}
+export interface ChoiceQuestion {
+    readonly question: string;
+    /** A short chip shown before the question (`Auth`, `Format`). */
+    readonly header?: string;
+    /** Pre-rendered lines between the question and the options (the approval card's what, where and why). */
+    readonly context?: readonly string[];
+    /** One dim line under the question (column legend, where a setting is saved). */
+    readonly subtitle?: string;
+    readonly options: readonly ChoiceOption[];
+    /** 1-9 pick an option directly (default true; off for the trust prompt, where a stray digit must not trust). */
+    readonly numberShortcuts?: boolean;
+    /** Space toggles, Enter confirms. */
+    readonly multiSelect?: boolean;
+    /** Multi-select rows checked when the modal opens (for example every changed file in `/commit`). */
+    readonly initialChecked?: readonly number[];
+    /** Appends "Other…", which switches to a free-text answer. Default true. */
+    readonly allowOther?: boolean;
+    /** The row highlighted first (default: the recommended one, else the first). */
+    readonly initialIndex?: number;
+    /** What Esc means, for the hint line (`cancel`, `deny`, `not now`). */
+    readonly escapeLabel?: string;
+    /** `attention` (yellow frame) for questions that block work; `neutral` for pickers. */
+    readonly tone?: "attention" | "neutral";
+}
+/** What the user answered; the renderer resolves undefined on Esc / abort instead. */
+export type ChoiceAnswer = {
+    readonly kind: "selected";
+    readonly indices: readonly number[];
+    readonly labels: readonly string[];
+} | {
+    readonly kind: "other";
+    readonly text: string;
+};
+export declare const OTHER_LABEL = "Other\u2026";
+/** The row the modal highlights first. */
+export declare function initialChoiceIndex(question: ChoiceQuestion): number;
+/** The answer's text: the chosen labels joined with ", ", or the free text. */
+export declare function choiceAnswerText(answer: ChoiceAnswer): string;
+/**
+ * Plain-mode lines for a question: the chip and question, one numbered row per option (with its
+ * description and the recommended tag), "Other" and how to answer.
+ */
+export declare function choiceQuestionLines(question: ChoiceQuestion): string[];
+/**
+ * Reads a typed plain-mode answer: a number (or comma-separated numbers for multi-select) picks
+ * options, a typed label picks that option, anything else is free text (when "Other" is allowed).
+ * Undefined when nothing usable was typed (empty, or text a closed question cannot take).
+ */
+export declare function parseTypedChoice(question: ChoiceQuestion, typed: string): ChoiceAnswer | undefined;
+export declare const askUserOptionSchema: z.ZodObject<{
+    label: z.ZodString;
+    description: z.ZodString;
+    preview: z.ZodOptional<z.ZodString>;
+    recommended: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const askUserQuestionSchema: z.ZodObject<{
+    question: z.ZodString;
+    header: z.ZodString;
+    options: z.ZodArray<z.ZodObject<{
+        label: z.ZodString;
+        description: z.ZodString;
+        preview: z.ZodOptional<z.ZodString>;
+        recommended: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+    multiSelect: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const askUserInputSchema: z.ZodObject<{
+    questions: z.ZodArray<z.ZodObject<{
+        question: z.ZodString;
+        header: z.ZodString;
+        options: z.ZodArray<z.ZodObject<{
+            label: z.ZodString;
+            description: z.ZodString;
+            preview: z.ZodOptional<z.ZodString>;
+            recommended: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strict>>;
+        multiSelect: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type AskUserInput = z.infer<typeof askUserInputSchema>;
+export type AskUserQuestion = z.infer<typeof askUserQuestionSchema>;
+/**
+ * What goes back to the model: per question text, the selected labels (an array) or the user's
+ * own free text (a string).
+ */
+export interface AskUserAnswers {
+    readonly answers: Readonly<Record<string, readonly string[] | string>>;
+}
+export declare function askUserChoiceQuestion(question: AskUserQuestion): ChoiceQuestion;
+export declare function askUserAnswerValue(answer: ChoiceAnswer): readonly string[] | string;
+/** The one transcript line an answered question leaves: `? Auth method → OAuth`. */
+export declare function askUserSummaryLine(question: {
+    readonly question: string;
+    readonly header?: string;
+}, answer: ChoiceAnswer | undefined): string;
+export declare const ASK_USER_HEADLESS_MESSAGE = "no user available in this session (headless, JSONL or piped input); decide yourself using the recommended option (or the safest one) and say which you chose";
+//# sourceMappingURL=choice.d.ts.map