@aliyunrds/ctxdb 1.0.9-beta.1 → 1.0.10-beta.0

package/dist/chunk-2U7G6UXE.js

@@ -1,1205 +0,0 @@
-#!/usr/bin/env node
-import {
-  DISTRIBUTION_MANIFEST
-} from "./chunk-5ITT5GSP.js";
-
-// src/lib/credentials.ts
-import { selectDataApiCredential } from "@aliyunrds/ctxdb-shared";
-function apiKeyCredential(apiKey) {
-  return { type: "api-key", value: apiKey };
-}
-var resolveDataApiCredential = selectDataApiCredential;
-function isDataApiReady(cfg, env = process.env) {
-  return Boolean(cfg.baseUrl && resolveDataApiCredential(cfg, env));
-}
-
-// src/lib/logger.ts
-import { appendFileSync, mkdirSync } from "fs";
-import { homedir } from "os";
-import { dirname, join } from "path";
-function logPath() {
-  return join(homedir(), ".ctxdb", "logs", "ctxdb.log");
-}
-var _enabled = null;
-function setDebug(enabled) {
-  _enabled = enabled;
-}
-function isDebug() {
-  return _enabled === true;
-}
-function debug(tag, msg, data) {
-  if (_enabled !== true) return;
-  const now = /* @__PURE__ */ new Date();
-  const pad = (n) => String(n).padStart(2, "0");
-  const ms = String(now.getMilliseconds()).padStart(3, "0");
-  const tz = -now.getTimezoneOffset();
-  const tzSign = tz >= 0 ? "+" : "-";
-  const tzH = pad(Math.floor(Math.abs(tz) / 60));
-  const tzM = pad(Math.abs(tz) % 60);
-  const ts = `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}T${pad(now.getHours())}:${pad(now.getMinutes())}:${pad(now.getSeconds())}.${ms}${tzSign}${tzH}:${tzM}`;
-  let line = `${ts} [${tag}] ${msg}`;
-  if (data !== void 0) {
-    const s = typeof data === "string" ? data : JSON.stringify(data, null, 2);
-    line += `
-${s}`;
-  }
-  line += "\n";
-  const p = logPath();
-  try {
-    mkdirSync(dirname(p), { recursive: true });
-    appendFileSync(p, line, "utf-8");
-  } catch {
-  }
-}
-
-// src/lib/package-version.ts
-import { readFileSync } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
-import { fileURLToPath } from "url";
-var PACKAGE_NAMES = /* @__PURE__ */ new Set([
-  "@aliyunrds/ctxdb",
-  "@ali/ctxdb-internal"
-]);
-function findPackageIdentity() {
-  let dir = dirname2(fileURLToPath(import.meta.url));
-  for (let i = 0; i < 5; i++) {
-    try {
-      const pkg = JSON.parse(readFileSync(join2(dir, "package.json"), "utf-8"));
-      if (PACKAGE_NAMES.has(pkg.name) && typeof pkg.version === "string") {
-        return { name: pkg.name, version: pkg.version };
-      }
-    } catch {
-    }
-    dir = dirname2(dir);
-  }
-  return { name: "@aliyunrds/ctxdb", version: "0.0.0" };
-}
-var PACKAGE_IDENTITY = findPackageIdentity();
-var PACKAGE_NAME = PACKAGE_IDENTITY.name;
-var PACKAGE_VERSION = PACKAGE_IDENTITY.version;
-
-// src/lib/http-client.ts
-import { createRequestAuthorizationProvider } from "@aliyunrds/ctxdb-shared";
-import "@aliyunrds/ctxdb-shared";
-var DEFAULT_TIMEOUT_MS = 3e4;
-var CtxdbError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "CtxdbError";
-  }
-};
-var AuthError = class extends CtxdbError {
-  status = 401;
-  errorCode;
-  errorMessage;
-  data;
-  responseBody;
-  constructor(message = "Unauthorized (HTTP 401) \u2014 check Data API credential", fields = {}) {
-    super(message);
-    this.name = "AuthError";
-    this.errorCode = fields.errorCode;
-    this.errorMessage = fields.errorMessage;
-    this.data = fields.data;
-    this.responseBody = fields.responseBody;
-  }
-};
-var NotFoundError = class extends CtxdbError {
-  status = 404;
-  path;
-  errorCode;
-  errorMessage;
-  data;
-  responseBody;
-  constructor(path, fields = {}) {
-    super(`Not found: ${path}`);
-    this.name = "NotFoundError";
-    this.path = path;
-    this.errorCode = fields.errorCode;
-    this.errorMessage = fields.errorMessage;
-    this.data = fields.data;
-    this.responseBody = fields.responseBody;
-  }
-};
-var APIError = class extends CtxdbError {
-  status = 400;
-  path;
-  detail;
-  errorCode;
-  errorMessage;
-  data;
-  responseBody;
-  constructor(path, detail, fields = {}) {
-    super(`API error at ${path}: ${detail}`);
-    this.name = "APIError";
-    this.path = path;
-    this.detail = detail;
-    this.errorCode = fields.errorCode;
-    this.errorMessage = fields.errorMessage;
-    this.data = fields.data;
-    this.responseBody = fields.responseBody;
-  }
-};
-var CtxdbHttpError = class extends CtxdbError {
-  status;
-  detail;
-  errorCode;
-  errorMessage;
-  data;
-  responseBody;
-  constructor(status, detail, fields = {}) {
-    super(`HTTP ${status}: ${detail}`);
-    this.name = "CtxdbHttpError";
-    this.status = status;
-    this.detail = detail;
-    this.errorCode = fields.errorCode;
-    this.errorMessage = fields.errorMessage;
-    this.data = fields.data;
-    this.responseBody = fields.responseBody;
-  }
-};
-var HttpClient = class {
-  baseUrl;
-  credential;
-  apiKey;
-  timeoutMs;
-  userAgent;
-  extraHeaders;
-  fetchImpl;
-  authorizationProvider;
-  constructor(opts) {
-    const credential = opts.credential ?? (opts.apiKey ? apiKeyCredential(opts.apiKey) : null);
-    if (!credential && !opts.authorizationProvider) {
-      throw new CtxdbError("DATA API credential is required");
-    }
-    this.baseUrl = opts.baseUrl.replace(/\/+$/, "");
-    this.credential = credential;
-    this.apiKey = opts.apiKey ?? "";
-    this.authorizationProvider = opts.authorizationProvider ?? createRequestAuthorizationProvider(credential, this.baseUrl);
-    this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    this.userAgent = opts.userAgent ?? `ctxdb-cli/${PACKAGE_VERSION}`;
-    this.extraHeaders = { ...opts.extraHeaders ?? {} };
-    const f = opts.fetchImpl ?? globalThis.fetch.bind(globalThis);
-    this.fetchImpl = f;
-  }
-  async buildHeaders(authorization, contentType, requestHeaders = {}) {
-    const h = {
-      Authorization: `${authorization.scheme} ${authorization.value}`,
-      "User-Agent": this.userAgent,
-      Connection: "close",
-      ...this.extraHeaders,
-      ...requestHeaders
-    };
-    if (authorization.scheme === "Bearer") {
-      for (const key of Object.keys(h)) if (key.toLowerCase() === "authorization") delete h[key];
-      h.Authorization = `Bearer ${authorization.value}`;
-    }
-    if (contentType) h["Content-Type"] = contentType;
-    return h;
-  }
-  async doRequest(method, path, init = {}) {
-    const effectiveTimeout = init.timeoutMs ?? this.timeoutMs, started = Date.now();
-    let authorization;
-    if (this.authorizationProvider) {
-      authorization = await this.authorizationProvider.resolve({ timeoutMs: effectiveTimeout });
-    } else {
-      const credential = this.credential;
-      if (!credential || credential.type === "oauth-session") throw new CtxdbError("DATA API credential is required");
-      authorization = {
-        scheme: credential.type === "access-token" ? "Bearer" : "Token",
-        value: credential.value,
-        baseUrl: this.baseUrl,
-        expiresAt: null
-      };
-    }
-    const safeText = (value) => {
-      const text = String(value);
-      return text.split(authorization.value).join("[REDACTED]");
-    };
-    let url = `${authorization.baseUrl.replace(/\/+$/, "")}${path}`;
-    if (init.params) {
-      const qs = new URLSearchParams();
-      for (const [k, v] of Object.entries(init.params)) {
-        if (v !== void 0 && v !== null) qs.append(k, String(v));
-      }
-      const s = qs.toString();
-      if (s) url = `${url}?${s}`;
-    }
-    const dbg = isDebug();
-    let t0 = 0;
-    if (dbg) {
-      t0 = Date.now();
-      debug("http", `\u2192 ${method} ${url} (timeout=${effectiveTimeout}ms)`);
-    }
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), Math.max(1, effectiveTimeout - (Date.now() - started)));
-    try {
-      let resp;
-      try {
-        resp = await this.fetchImpl(url, {
-          method,
-          headers: await this.buildHeaders(
-            authorization,
-            init.contentType,
-            init.headers
-          ),
-          body: init.body,
-          signal: controller.signal,
-          ...authorization.scheme === "Bearer" ? { redirect: "error" } : {}
-        });
-      } catch (err) {
-        if (err?.name === "AbortError") {
-          if (dbg) debug("http", `\u2717 ${method} ${path} timeout after ${Date.now() - t0}ms`);
-          throw new CtxdbError(`request timeout after ${effectiveTimeout}ms: ${url}`);
-        }
-        if (dbg) debug("http", `\u2717 ${method} ${path} network error after ${Date.now() - t0}ms: ${safeText(err?.message ?? err)}`);
-        throw new CtxdbError(`network error contacting ${url}: ${safeText(err?.message ?? err)}`);
-      }
-      if (resp.status === 204) {
-        if (dbg) debug("http", `\u2190 ${method} ${path} 204 (${Date.now() - t0}ms)`);
-        return {};
-      }
-      let text;
-      try {
-        const bodyText = await resp.text();
-        text = authorization.scheme === "Bearer" || !resp.ok ? safeText(bodyText) : bodyText;
-      } catch (err) {
-        if (err?.name === "AbortError") {
-          if (dbg) debug("http", `\u2717 ${method} ${path} body-read timeout after ${Date.now() - t0}ms`);
-          throw new CtxdbError(`request timeout after ${effectiveTimeout}ms (body read): ${url}`);
-        }
-        if (dbg) debug("http", `\u2717 ${method} ${path} body-read error after ${Date.now() - t0}ms: ${safeText(err?.message ?? err)}`);
-        throw new CtxdbError(`network error reading body from ${url}: ${safeText(err?.message ?? err)}`);
-      }
-      if (!resp.ok) {
-        const parsedError = parseErrorResponse(text, `HTTP ${resp.status}`);
-        if (dbg) debug("http", `\u2190 ${method} ${path} ${resp.status} (${Date.now() - t0}ms) ${parsedError.detail}`);
-        if (resp.status === 401) {
-          throw new AuthError(void 0, parsedError);
-        }
-        if (resp.status === 404) {
-          throw new NotFoundError(path, parsedError);
-        }
-        if (resp.status === 400) {
-          throw new APIError(path, parsedError.detail, parsedError);
-        }
-        throw new CtxdbHttpError(resp.status, parsedError.detail, parsedError);
-      }
-      if (dbg) debug("http", `\u2190 ${method} ${path} ${resp.status} (${Date.now() - t0}ms) body=${text.length}B`);
-      if (!text) return {};
-      return maybeJson(text);
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-  // ---------- Convenience verbs ----------
-  get(path, params) {
-    return this.doRequest("GET", path, { params });
-  }
-  postJson(path, body, params, options = {}) {
-    return this.doRequest("POST", path, {
-      body: JSON.stringify(body ?? {}),
-      contentType: "application/json",
-      params,
-      timeoutMs: options.timeoutMs,
-      headers: options.headers
-    });
-  }
-  putJson(path, body, params, options = {}) {
-    return this.doRequest("PUT", path, {
-      body: JSON.stringify(body),
-      contentType: "application/json",
-      params,
-      timeoutMs: options.timeoutMs,
-      headers: options.headers
-    });
-  }
-  patchJson(path, body, params, options = {}) {
-    return this.doRequest("PATCH", path, {
-      body: JSON.stringify(body),
-      contentType: "application/json",
-      params,
-      timeoutMs: options.timeoutMs,
-      headers: options.headers
-    });
-  }
-  delete(path, params) {
-    return this.doRequest("DELETE", path, { params });
-  }
-  /**
-   * DELETE with a JSON body. ContextDB batch deletes use the
-   * `DELETE /v1/{resource}/batch` shape with an `{"ids": [...]}` body
-   * (server contract) — the plain `delete()` above only supports query
-   * params.
-   */
-  deleteJson(path, body, params, options = {}) {
-    return this.doRequest("DELETE", path, {
-      body: JSON.stringify(body),
-      contentType: "application/json",
-      params,
-      timeoutMs: options.timeoutMs,
-      headers: options.headers
-    });
-  }
-  /**
-   * POST multipart/form-data using runtime-native FormData.
-   *
-   * `fields` are appended as text values; `files` are appended as Blob
-   * with a filename. We intentionally do NOT pass a `Content-Type`
-   * header — when fetch sees a FormData body it sets the multipart
-   * boundary itself.
-   */
-  postMultipart(path, fields = {}, files = {}, options = {}) {
-    const fd = buildMultipartForm(fields, files);
-    return this.doRequest("POST", path, {
-      body: fd,
-      params: options.params,
-      timeoutMs: options.timeoutMs,
-      headers: options.headers
-    });
-  }
-  /** PUT multipart/form-data with the same runtime-owned boundary as POST. */
-  putMultipart(path, fields = {}, files = {}, options = {}) {
-    const fd = buildMultipartForm(fields, files);
-    return this.doRequest("PUT", path, {
-      body: fd,
-      params: options.params,
-      timeoutMs: options.timeoutMs,
-      headers: options.headers
-    });
-  }
-};
-function buildMultipartForm(fields, files) {
-  const fd = new FormData();
-  for (const [name, value] of Object.entries(fields)) {
-    fd.append(name, value);
-  }
-  for (const [name, part] of Object.entries(files)) {
-    const blob = part.content instanceof Blob ? part.content : new Blob([part.content], { type: part.mimeType });
-    fd.append(name, blob, part.filename);
-  }
-  return fd;
-}
-function maybeJson(text) {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return text;
-  }
-}
-function parseErrorResponse(text, fallback) {
-  if (!text) return { detail: fallback };
-  let parsed;
-  try {
-    parsed = JSON.parse(text);
-  } catch {
-    return { detail: text || fallback, responseBody: text || void 0 };
-  }
-  if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-    const obj = parsed;
-    let detail = "";
-    for (const k of ["errorMessage", "detail", "message", "error"]) {
-      const v = obj[k];
-      if (typeof v === "string" && v) {
-        detail = v;
-        break;
-      }
-    }
-    const rawCode = obj.errorCode;
-    const numericCode = typeof rawCode === "number" ? rawCode : typeof rawCode === "string" && rawCode.trim() !== "" ? Number(rawCode) : void 0;
-    const errorCode = typeof numericCode === "number" && Number.isFinite(numericCode) ? numericCode : void 0;
-    const errorMessage = typeof obj.errorMessage === "string" && obj.errorMessage ? obj.errorMessage : void 0;
-    return {
-      detail: detail || JSON.stringify(parsed),
-      errorCode,
-      errorMessage,
-      data: Object.hasOwn(obj, "data") ? obj.data : void 0,
-      responseBody: parsed
-    };
-  }
-  return { detail: String(parsed), responseBody: parsed };
-}
-
-// src/lib/agents.ts
-import { homedir as homedir2 } from "os";
-import { delimiter, join as join3, sep } from "path";
-import { accessSync, constants, existsSync, statSync } from "fs";
-var SUPPORTED_AGENTS = ["qoder", "qoderwork", "qwenwork", "codex", "claude", "opencode", "hermes", "workbuddy"];
-var SUPPORTED_AGENT_CHOICES = SUPPORTED_AGENTS.join("|");
-var AGENT_CHOICES = [...SUPPORTED_AGENTS, "default"].join("|");
-function isBuiltinAgent(v) {
-  return typeof v === "string" && SUPPORTED_AGENTS.includes(v);
-}
-function isAgentSlug(v) {
-  return v === "default" || isBuiltinAgent(v);
-}
-var isAgent = isAgentSlug;
-function agentHomeDir(agent, home = homedir2()) {
-  switch (agent) {
-    case "qoder":
-      return join3(home, ".qoder");
-    case "qoderwork":
-      return join3(home, ".qoderwork");
-    case "qwenwork":
-      return join3(home, ".qwenwork");
-    case "codex":
-      return join3(home, ".codex");
-    case "claude":
-      return join3(home, ".claude");
-    case "opencode":
-      return join3(home, ".config", "opencode");
-    case "hermes":
-      return join3(home, ".hermes");
-    case "workbuddy":
-      return join3(home, ".workbuddy-ai");
-  }
-}
-var AGENT_VARIANT_HOMES = {
-  qoder: [".qoder-cn"],
-  qoderwork: [".qoderworkcn"],
-  qwenwork: [".qwenworkcn"],
-  workbuddy: [".workbuddy"]
-};
-function agentHomeDirs(agent, home = homedir2()) {
-  const primary = agentHomeDir(agent, home);
-  const variants = (AGENT_VARIANT_HOMES[agent] ?? []).map(
-    (name) => join3(home, name)
-  );
-  return [primary, ...variants];
-}
-function agentPlatformSupport(agent, platform = process.platform) {
-  if (agent === "hermes" && platform === "win32") {
-    return {
-      supported: false,
-      detail: "Hermes integration currently supports macOS/Linux only; Windows Hermes is not yet supported."
-    };
-  }
-  return { supported: true, detail: `${agent} is supported on ${platform}.` };
-}
-function inspectAgentHomes(agent, options = {}) {
-  const exists = options.exists ?? existsSyncAdapter;
-  const candidates = agentHomeDirs(agent, options.home);
-  const existing = candidates.filter(exists);
-  return { exists: existing.length > 0, existing, candidates };
-}
-function existsSyncAdapter(path) {
-  try {
-    return existsSync(path);
-  } catch {
-    return false;
-  }
-}
-var EXECUTABLE_AGENT_NAMES = {
-  opencode: "opencode",
-  hermes: "hermes"
-};
-function isDirectoryAdapter(path) {
-  try {
-    return statSync(path).isDirectory();
-  } catch {
-    return false;
-  }
-}
-function isExecutableAdapter(path, platform) {
-  try {
-    if (!statSync(path).isFile()) return false;
-    if (platform !== "win32") accessSync(path, constants.X_OK);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function envValue(env, name, platform) {
-  if (env[name] !== void 0) return env[name];
-  if (platform !== "win32") return void 0;
-  const entry = Object.entries(env).find(([key]) => key.toLowerCase() === name.toLowerCase());
-  return entry?.[1];
-}
-function resolveAgentExecutable(command, options = {}) {
-  const platform = options.platform ?? process.platform;
-  const env = options.env ?? process.env;
-  const isExecutable = options.isExecutable ?? isExecutableAdapter;
-  const pathValue = envValue(env, "PATH", platform) ?? "";
-  const pathSeparator = platform === "win32" ? ";" : delimiter;
-  const pathEntries = pathValue.split(pathSeparator).map((entry) => entry.trim().replace(/^"(.*)"$/, "$1")).filter(Boolean);
-  const suffixes = platform === "win32" ? (envValue(env, "PATHEXT", platform) ?? ".COM;.EXE;.BAT;.CMD").split(";").map((suffix) => suffix.trim()).filter(Boolean) : [""];
-  for (const directory of pathEntries) {
-    for (const suffix of suffixes) {
-      const candidate = join3(directory, `${command}${suffix}`);
-      if (isExecutable(candidate, platform)) return candidate;
-    }
-  }
-  return void 0;
-}
-function displayHomePath(home, path) {
-  if (path === home) return "~";
-  return path.startsWith(`${home}${sep}`) ? `~${path.slice(home.length)}` : path;
-}
-function detectInstalledAgents(options = {}) {
-  const home = options.home ?? homedir2();
-  const platform = options.platform ?? process.platform;
-  const env = options.env ?? process.env;
-  const isDirectory = options.isDirectory ?? isDirectoryAdapter;
-  const observations = [];
-  for (const agent of SUPPORTED_AGENTS) {
-    const evidence = [];
-    for (const candidate of agentHomeDirs(agent, home)) {
-      if (isDirectory(candidate)) {
-        evidence.push({ kind: "home", value: displayHomePath(home, candidate) });
-      }
-    }
-    const executableName = EXECUTABLE_AGENT_NAMES[agent];
-    if (executableName) {
-      const executable = resolveAgentExecutable(executableName, {
-        platform,
-        env,
-        isExecutable: options.isExecutable
-      });
-      if (executable) {
-        evidence.push({ kind: "executable", value: executableName });
-      }
-    }
-    if (evidence.length === 0) {
-      observations.push({
-        agent,
-        selected: false,
-        reason: "not-detected",
-        evidence
-      });
-      continue;
-    }
-    const support = agentPlatformSupport(agent, platform);
-    if (!support.supported) {
-      observations.push({
-        agent,
-        selected: false,
-        reason: "unsupported-platform",
-        evidence,
-        detail: support.detail
-      });
-      continue;
-    }
-    observations.push({ agent, selected: true, reason: "detected", evidence });
-  }
-  return {
-    selected: observations.filter((item) => item.selected).map((item) => item.agent),
-    observations
-  };
-}
-function agentFromEnv(env = process.env) {
-  return isAgentSlug(env.CTXDB_AGENT) ? env.CTXDB_AGENT : "default";
-}
-function agentFromArgvWithFallback(argv = process.argv.slice(2), env = process.env) {
-  for (let i = 0; i < argv.length; i++) {
-    const tok = argv[i];
-    if (tok === "--agent" && isAgentSlug(argv[i + 1])) {
-      return { agent: argv[i + 1], fellBack: false };
-    }
-    if (tok.startsWith("--agent=")) {
-      const raw = tok.slice("--agent=".length);
-      if (isAgentSlug(raw)) return { agent: raw, fellBack: false };
-    }
-  }
-  return { agent: agentFromEnv(env), fellBack: true };
-}
-
-// src/lib/config.ts
-import { publicAuthenticationFromConfig } from "@aliyunrds/ctxdb-shared";
-import { readFileSync as readFileSync2, existsSync as existsSync3, unlinkSync as unlinkSync2 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname4, join as join4 } from "path";
-
-// src/lib/secure-file.ts
-import {
-  chmodSync,
-  closeSync,
-  copyFileSync,
-  existsSync as existsSync2,
-  fsyncSync,
-  mkdirSync as mkdirSync2,
-  openSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync
-} from "fs";
-import { randomBytes } from "crypto";
-import { dirname as dirname3 } from "path";
-var nodeSecureFileSystem = {
-  exists: existsSync2,
-  mkdir: (path, options) => {
-    mkdirSync2(path, options);
-  },
-  chmod: chmodSync,
-  open: openSync,
-  write: (fd, data) => {
-    writeFileSync(fd, data);
-  },
-  fsync: fsyncSync,
-  close: closeSync,
-  copy: copyFileSync,
-  rename: renameSync,
-  unlink: unlinkSync
-};
-function configBackupPath(target) {
-  return `${target}.bak`;
-}
-function secureAtomicWrite(target, content, options = {}) {
-  const fs = options.fs ?? nodeSecureFileSystem;
-  const platform = options.platform ?? process.platform;
-  const posix = platform !== "win32";
-  const dir = dirname3(target);
-  const backup = configBackupPath(target);
-  const suffix = options.tempSuffix ?? `${process.pid}.${randomBytes(6).toString("hex")}`;
-  const temp = `${target}.${suffix}.tmp`;
-  const hadTarget = fs.exists(target);
-  fs.mkdir(dir, { recursive: true, mode: 448 });
-  if (posix) {
-    fs.chmod(dir, 448);
-    if (hadTarget) fs.chmod(target, 384);
-  }
-  let fd = null;
-  let tempExists = false;
-  try {
-    fd = fs.open(temp, "wx", 384);
-    tempExists = true;
-    fs.write(fd, Buffer.from(content, "utf-8"));
-    fs.fsync(fd);
-    fs.close(fd);
-    fd = null;
-    if (posix) fs.chmod(temp, 384);
-    if (hadTarget && options.backup !== false) {
-      if (platform === "win32") {
-        if (fs.exists(backup)) fs.unlink(backup);
-        fs.rename(target, backup);
-        try {
-          fs.rename(temp, target);
-          tempExists = false;
-        } catch (error) {
-          fs.rename(backup, target);
-          throw error;
-        }
-      } else {
-        fs.copy(target, backup);
-        fs.chmod(backup, 384);
-        fs.rename(temp, target);
-        tempExists = false;
-      }
-    } else {
-      fs.rename(temp, target);
-      tempExists = false;
-    }
-  } finally {
-    if (fd !== null) {
-      try {
-        fs.close(fd);
-      } catch {
-      }
-    }
-    if (tempExists && fs.exists(temp)) {
-      try {
-        fs.unlink(temp);
-      } catch {
-      }
-    }
-  }
-}
-
-// src/lib/secrets.ts
-import { createHmac, randomBytes as randomBytes2 } from "crypto";
-var PROCESS_FINGERPRINT_KEY = randomBytes2(32);
-function maskApiKey(apiKey) {
-  if (!apiKey) return "";
-  const payload = apiKey.startsWith("ctxdb-") ? apiKey.slice("ctxdb-".length) : null;
-  if (payload && payload.length > 12) return `ctxdb-xxxxxx${payload.slice(-6)}`;
-  if (payload !== null) return "x".repeat(apiKey.length);
-  if (apiKey.length <= 12) return "x".repeat(apiKey.length);
-  return `xxxxxx${apiKey.slice(-6)}`;
-}
-function credentialFingerprint(apiKey, processKey = PROCESS_FINGERPRINT_KEY) {
-  if (!apiKey) return "";
-  return createHmac("sha256", processKey).update(apiKey).digest("hex").slice(0, 12);
-}
-
-// src/credentials/local-credential-provider.ts
-import { LocalCredentialProvider, defaultCredentialsPath, readActiveCredentialSync, withAuthorizationLock, internalCandidate } from "@aliyunrds/ctxdb-shared";
-
-// src/lib/config.ts
-import {
-  resolveDebugPolicy,
-  oauthProfile,
-  validateLoginChoice,
-  authSnapshot,
-  assertAuthSnapshot,
-  withAuthConfigLock
-} from "@aliyunrds/ctxdb-shared";
-function defaultConfigPath(env = process.env) {
-  return env.CTXDB_CONFIG_PATH || join4(homedir3(), ".ctxdb", "ctxdb.json");
-}
-var DEFAULT_CONFIG_PATH = join4(homedir3(), ".ctxdb", "ctxdb.json");
-function configDir() {
-  return join4(homedir3(), ".ctxdb");
-}
-var DEFAULT_BASE_URL = "https://api.cn-hangzhou.agentcontext.aliyuncs.com";
-var DEFAULT_USER_ID = "default";
-var DEFAULT_TOP_K = 5;
-var DEFAULT_THRESHOLD = 0.4;
-var DEFAULT_KNOWLEDGE_TOP_K = 6;
-var DEFAULT_KB_CATALOG_INJECTION = "session_start";
-function resolveConfigAgent(options = {}, preloadedRaw) {
-  if (isAgentSlug(options.agent)) return options.agent;
-  return agentFromEnv(options.env);
-}
-function coerceInt(v, fallback) {
-  if (v === null || v === void 0 || v === "") return fallback;
-  const n = typeof v === "number" ? v : Number(v);
-  return Number.isFinite(n) ? Math.trunc(n) : fallback;
-}
-function coerceFloat(v, fallback) {
-  if (v === null || v === void 0 || v === "") return fallback;
-  const n = typeof v === "number" ? v : Number(v);
-  return Number.isFinite(n) ? n : fallback;
-}
-function coerceBool(v, fallback) {
-  if (typeof v === "boolean") return v;
-  if (v === void 0 || v === null) return fallback;
-  return Boolean(v);
-}
-function coerceKbCatalogInjection(v) {
-  if (v === "session_start" || v === "user_prompt_submit" || v === "off") {
-    return v;
-  }
-  return DEFAULT_KB_CATALOG_INJECTION;
-}
-function readRaw(path) {
-  if (!existsSync3(path)) return {};
-  try {
-    const parsed = JSON.parse(readFileSync2(path, "utf-8"));
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      return parsed;
-    }
-  } catch {
-  }
-  return {};
-}
-function asRawObject(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-function explicitAgentRaw(raw, agent) {
-  const agents = asRawObject(raw.agents);
-  return agents ? asRawObject(agents[agent]) : null;
-}
-function explicitString(raw, key) {
-  const value = raw?.[key];
-  return typeof value === "string" && value ? value : null;
-}
-function inspectConfig(options = {}) {
-  const path = options.path ?? defaultConfigPath();
-  const env = options.env ?? process.env;
-  if (!existsSync3(path)) {
-    return {
-      path,
-      state: "missing",
-      profiles: diagnosticProfiles({}, env),
-      unknownProfiles: [],
-      safeMessage: null
-    };
-  }
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync2(path, "utf-8"));
-  } catch {
-    return {
-      path,
-      state: "malformed-json",
-      profiles: diagnosticProfiles({}, env),
-      unknownProfiles: [],
-      safeMessage: "Configuration contains malformed JSON and requires confirmation before repair."
-    };
-  }
-  const raw = asRawObject(parsed);
-  if (!raw || !isV2Schema(raw)) {
-    return {
-      path,
-      state: "unsupported-schema",
-      profiles: diagnosticProfiles({}, env),
-      unknownProfiles: [],
-      safeMessage: "Configuration schema is unsupported and requires confirmation before repair."
-    };
-  }
-  const agents = asRawObject(raw.agents) ?? {};
-  const known = /* @__PURE__ */ new Set(["default", ...SUPPORTED_AGENTS]);
-  return {
-    path,
-    state: "valid-v2",
-    profiles: diagnosticProfiles(raw, env),
-    unknownProfiles: Object.keys(agents).filter((name) => !known.has(name)),
-    safeMessage: null
-  };
-}
-function diagnosticProfiles(raw, env) {
-  const profiles = ["default", ...SUPPORTED_AGENTS];
-  return profiles.map((agent) => {
-    const explicit = explicitAgentRaw(raw, agent);
-    const inherited = agent === "default" ? null : explicitAgentRaw(raw, "default");
-    const explicitKey = explicitString(explicit, "api_key");
-    const inheritedKey = explicitString(inherited, "api_key");
-    const apiKey = env.CTXDB_API_KEY || explicitKey || inheritedKey;
-    const credentialSource = env.CTXDB_API_KEY ? "environment" : explicitKey ? "profile" : inheritedKey ? "default" : "none";
-    const credentialProfile = credentialSource === "profile" ? agent : credentialSource === "default" ? "default" : null;
-    const explicitBase = explicitString(explicit, "base_url");
-    const inheritedBase = explicitString(inherited, "base_url");
-    const baseUrl = (env.CTXDB_BASE_URL || explicitBase || inheritedBase || DEFAULT_BASE_URL).replace(/\/+$/, "");
-    const baseUrlSource = env.CTXDB_BASE_URL ? "environment" : explicitBase ? "profile" : inheritedBase ? "default" : "built-in";
-    const explicitUser = explicitString(explicit, "user_id");
-    const inheritedUser = explicitString(inherited, "user_id");
-    const userId = env.CTXDB_USER_ID || explicitUser || inheritedUser || DEFAULT_USER_ID;
-    const userIdSource = env.CTXDB_USER_ID ? "environment" : explicitUser ? "profile" : inheritedUser ? "default" : "built-in";
-    return {
-      agent,
-      explicitProfile: explicit !== null,
-      explicitFields: explicit ? Object.keys(explicit).sort() : [],
-      credential: {
-        source: credentialSource,
-        profile: credentialProfile,
-        masked: apiKey ? maskApiKey(apiKey) : null,
-        fingerprint: apiKey ? credentialFingerprint(apiKey) : null
-      },
-      effective: {
-        baseUrl,
-        baseUrlSource,
-        userId,
-        userIdSource,
-        complete: Boolean(apiKey && baseUrl)
-      }
-    };
-  });
-}
-function agentRawFromFile(raw, agent) {
-  const agents = raw.agents;
-  if (agents && typeof agents === "object" && !Array.isArray(agents)) {
-    const candidate = agents[agent];
-    if (candidate && typeof candidate === "object" && !Array.isArray(candidate)) {
-      return candidate;
-    }
-  }
-  return {};
-}
-function isV2Schema(raw) {
-  if (Object.keys(raw).length === 0) return true;
-  return raw.version === 2 && raw.agents !== null && typeof raw.agents === "object" && !Array.isArray(raw.agents);
-}
-function configFromDisk(raw) {
-  const debugConfigured = coerceBool(raw.debug, false);
-  return applyDebugPolicy({
-    apiKey: typeof raw.api_key === "string" && raw.api_key ? raw.api_key : null,
-    baseUrl: typeof raw.base_url === "string" && raw.base_url ? String(raw.base_url).replace(/\/+$/, "") : DEFAULT_BASE_URL,
-    userId: typeof raw.user_id === "string" && raw.user_id ? raw.user_id : DEFAULT_USER_ID,
-    agentId: typeof raw.agent_id === "string" && raw.agent_id ? raw.agent_id : null,
-    appId: typeof raw.app_id === "string" && raw.app_id ? raw.app_id : null,
-    autoCapture: coerceBool(raw.auto_capture, true),
-    autoRecall: coerceBool(raw.auto_recall, true),
-    warmupRecall: coerceBool(raw.warmup_recall, false),
-    recallKnowledge: coerceBool(raw.recall_knowledge, false),
-    topK: coerceInt(raw.top_k, DEFAULT_TOP_K),
-    threshold: coerceFloat(raw.threshold, DEFAULT_THRESHOLD),
-    knowledgeTopK: coerceInt(raw.knowledge_top_k, DEFAULT_KNOWLEDGE_TOP_K),
-    debug: debugConfigured,
-    debugConfigured,
-    debugForced: false,
-    debugReason: null,
-    kbCatalogInjection: coerceKbCatalogInjection(raw.kb_catalog_injection)
-  });
-}
-function applyDebugPolicy(cfg) {
-  const policy = resolveDebugPolicy(cfg.debugConfigured, cfg.baseUrl);
-  cfg.debug = policy.debug;
-  cfg.debugConfigured = policy.debugConfigured;
-  cfg.debugForced = policy.debugForced;
-  cfg.debugReason = policy.debugReason;
-  return cfg;
-}
-function applyEnv(cfg, env) {
-  if (env.CTXDB_API_KEY) cfg.apiKey = env.CTXDB_API_KEY;
-  if (env.CTXDB_BASE_URL) cfg.baseUrl = env.CTXDB_BASE_URL.replace(/\/+$/, "");
-  if (env.CTXDB_USER_ID) cfg.userId = env.CTXDB_USER_ID;
-  if (env.CTXDB_AGENT_ID) cfg.agentId = env.CTXDB_AGENT_ID;
-  if (env.CTXDB_APP_ID) cfg.appId = env.CTXDB_APP_ID;
-  return applyDebugPolicy(cfg);
-}
-function load(options = {}) {
-  const env = options.env ?? process.env;
-  const path = options.path ?? defaultConfigPath(env);
-  const raw = readRaw(path);
-  const agent = resolveConfigAgent({ ...options, path, env }, raw);
-  if (!isV2Schema(raw)) {
-    try {
-      process.stderr.write(
-        `[ctxdb] config schema invalid at ${path}, treating as first-time install
-`
-      );
-    } catch {
-    }
-    const cfg2 = configFromDisk({});
-    const managed2 = !DISTRIBUTION_MANIFEST.capabilities.managedCredentials || options.managedCredentials === false ? void 0 : readActiveCredentialSync(
-      options.credentialsPath ?? join4(dirname4(path), "credentials.json")
-    );
-    if (managed2) {
-      cfg2.apiKey = managed2.payload.apiKey;
-      cfg2.baseUrl = managed2.metadata.baseUrl;
-    }
-    applyEnv(cfg2, env);
-    if (managed2) cfg2.authContext = {
-      configPath: path,
-      agent,
-      baseUrl: cfg2.baseUrl,
-      inheritDefaultKey: true,
-      managedCredentials: true,
-      credentialsPath: options.credentialsPath,
-      ...env.CTXDB_BASE_URL ? { baseUrlOverride: env.CTXDB_BASE_URL } : {}
-    };
-    return cfg2;
-  }
-  const explicit = agentRawFromFile(raw, agent);
-  if (DISTRIBUTION_MANIFEST.capabilities.deviceFlow) validateLoginChoice(explicit);
-  const agentRaw = { ...explicit };
-  if (agent !== "default") {
-    const defaultRaw = agentRawFromFile(raw, "default");
-    if (Object.keys(defaultRaw).length > 0) {
-      for (const [k, v] of Object.entries(defaultRaw)) {
-        if (k !== "credential_ref" && k !== "oauth_credential_ref" && k !== "access_credential" && !(k in agentRaw)) {
-          agentRaw[k] = v;
-        }
-      }
-    }
-  }
-  const cfg = configFromDisk(agentRaw);
-  const managed = !DISTRIBUTION_MANIFEST.capabilities.managedCredentials || options.managedCredentials === false ? void 0 : readActiveCredentialSync(
-    options.credentialsPath ?? join4(dirname4(path), "credentials.json")
-  );
-  if (managed) {
-    cfg.apiKey = managed.payload.apiKey;
-    cfg.baseUrl = managed.metadata.baseUrl;
-  }
-  const environmentCredential = !!(env.CTXDB_API_KEY || env.CTXDB_ACCESS_TOKEN?.trim());
-  if (DISTRIBUTION_MANIFEST.capabilities.deviceFlow) {
-    cfg.credentialRef = explicit.credential_ref;
-    const stored = environmentCredential ? void 0 : publicAuthenticationFromConfig({ ...raw, version: 2, agents: raw.agents ?? {} }, path, agent, env.CTXDB_BASE_URL);
-    if (stored) {
-      cfg.baseUrl = stored.baseUrl;
-      cfg.apiKey = stored.apiKey ?? null;
-      cfg.oauthCredential = stored.oauthCredential;
-    } else if (cfg.credentialRef) cfg.apiKey = null;
-    if (environmentCredential && explicit.oauth_credential_ref) cfg.oauthCredential = oauthProfile(explicit.oauth_credential_ref, path, agent, cfg.baseUrl);
-  }
-  const persistedApiKey = cfg.apiKey;
-  applyEnv(cfg, env);
-  if (DISTRIBUTION_MANIFEST.capabilities.deviceFlow) {
-    const authRaw = { ...raw, version: 2, agents: raw.agents ?? {} };
-    if (Object.hasOwn(explicit, "access_credential")) {
-      cfg.accessCredential = explicit.access_credential;
-      if (!env.CTXDB_API_KEY) cfg.apiKey = null;
-    }
-    if (env.CTXDB_API_KEY) {
-      cfg.environmentApiKey = env.CTXDB_API_KEY;
-      cfg.persistedApiKey = cfg.accessCredential !== void 0 || cfg.oauthCredential ? null : persistedApiKey;
-    }
-    cfg.authSnapshot = authSnapshot(authRaw, agent);
-    cfg.authAgent = agent;
-    cfg.authContext = {
-      configPath: path,
-      agent,
-      baseUrl: cfg.baseUrl,
-      inheritDefaultKey: true,
-      ...env.CTXDB_BASE_URL ? { baseUrlOverride: env.CTXDB_BASE_URL } : {}
-    };
-  }
-  if (managed) cfg.authContext = {
-    configPath: path,
-    agent,
-    baseUrl: cfg.baseUrl,
-    inheritDefaultKey: true,
-    managedCredentials: true,
-    credentialsPath: options.credentialsPath,
-    ...env.CTXDB_BASE_URL ? { baseUrlOverride: env.CTXDB_BASE_URL } : {}
-  };
-  return cfg;
-}
-function configToDisk(cfg) {
-  return {
-    ...cfg.credentialRef ? { credential_ref: cfg.credentialRef } : {},
-    ...cfg.accessCredential !== void 0 ? { access_credential: cfg.accessCredential } : cfg.oauthCredential ? { oauth_credential_ref: cfg.oauthCredential.reference } : {},
-    api_key: cfg.credentialRef || cfg.accessCredential !== void 0 || cfg.oauthCredential ? null : cfg.environmentApiKey && cfg.apiKey === cfg.environmentApiKey ? cfg.persistedApiKey ?? null : cfg.apiKey,
-    ...!cfg.credentialRef && cfg.accessCredential === void 0 && !cfg.oauthCredential && !cfg.authContext?.managedCredentials ? { base_url: cfg.baseUrl } : {},
-    user_id: cfg.userId,
-    agent_id: cfg.agentId,
-    app_id: cfg.appId,
-    auto_capture: cfg.autoCapture,
-    auto_recall: cfg.autoRecall,
-    warmup_recall: cfg.warmupRecall,
-    recall_knowledge: cfg.recallKnowledge,
-    top_k: cfg.topK,
-    threshold: cfg.threshold,
-    knowledge_top_k: cfg.knowledgeTopK,
-    debug: cfg.debugConfigured,
-    kb_catalog_injection: cfg.kbCatalogInjection
-  };
-}
-function removeAgent(agent, path, options = {}) {
-  const target = path ?? defaultConfigPath();
-  return withAuthConfigLock(target, () => {
-    if (!existsSync3(target)) {
-      return { removed: false, remainingAgents: [], fileDeleted: false };
-    }
-    const raw = readRaw(target);
-    if (!isV2Schema(raw) || !raw.agents || typeof raw.agents !== "object" || Array.isArray(raw.agents)) {
-      return { removed: false, remainingAgents: [], fileDeleted: false };
-    }
-    const agents = { ...raw.agents };
-    if (!(agent in agents)) {
-      return {
-        removed: false,
-        remainingAgents: Object.keys(agents),
-        fileDeleted: false
-      };
-    }
-    delete agents[agent];
-    const remaining = Object.keys(agents);
-    if (remaining.length === 0 && !options.keepEmptyShell && !Object.keys(asRawObject(raw.logins) ?? {}).length) {
-      try {
-        unlinkSync2(target);
-        return { removed: true, remainingAgents: [], fileDeleted: true };
-      } catch {
-      }
-    }
-    const onDisk = { ...raw, version: 2, agents };
-    delete onDisk.default_agent;
-    secureAtomicWrite(target, JSON.stringify(onDisk, null, 2) + "\n");
-    return { removed: true, remainingAgents: remaining, fileDeleted: false };
-  });
-}
-function save(cfg, path, options = {}) {
-  const target = path ?? defaultConfigPath();
-  const agent = resolveConfigAgent(options);
-  withAuthConfigLock(target, () => {
-    const raw = readRaw(target);
-    const validRaw = isV2Schema(raw) ? raw : {};
-    if (DISTRIBUTION_MANIFEST.capabilities.deviceFlow) {
-      const authRaw = { ...validRaw, version: 2, agents: validRaw.agents ?? {} };
-      if (cfg.authSnapshot && cfg.authAgent === agent) assertAuthSnapshot(authRaw, agent, cfg.authSnapshot);
-    }
-    const existingAgents = validRaw.agents && typeof validRaw.agents === "object" && !Array.isArray(validRaw.agents) ? { ...validRaw.agents } : {};
-    const serialized = configToDisk(cfg);
-    if (options.omitApiKey) delete serialized.api_key;
-    const previous = asRawObject(existingAgents[agent]) ?? {};
-    const next = { ...previous, ...serialized };
-    if (cfg.credentialRef) {
-      delete next.access_credential;
-      delete next.oauth_credential_ref;
-      delete next.api_key;
-    } else if (cfg.accessCredential !== void 0) {
-      delete next.credential_ref;
-      delete next.oauth_credential_ref;
-      delete next.api_key;
-    } else if (cfg.oauthCredential) {
-      delete next.access_credential;
-      next.api_key = null;
-    } else {
-      delete next.access_credential;
-      delete next.oauth_credential_ref;
-    }
-    if (options.omitApiKey) {
-      delete next.api_key;
-      for (const field of ["access_credential", "credential_ref", "oauth_credential_ref"]) {
-        if (Object.hasOwn(previous, field)) next[field] = previous[field];
-      }
-    }
-    if (next.credential_ref || Object.hasOwn(next, "access_credential") || next.oauth_credential_ref || cfg.authContext?.managedCredentials) delete next.base_url;
-    const onDisk = {
-      ...validRaw,
-      version: 2,
-      agents: {
-        ...existingAgents,
-        [agent]: next
-      }
-    };
-    delete onDisk.default_agent;
-    secureAtomicWrite(target, JSON.stringify(onDisk, null, 2) + "\n");
-  });
-}
-function configuredAgents(path) {
-  const target = path ?? defaultConfigPath();
-  const raw = readRaw(target);
-  if (!isV2Schema(raw) || !raw.agents || typeof raw.agents !== "object") return [];
-  return Object.keys(raw.agents).filter(isAgent);
-}
-function hasConfiguredAgent(agent, path) {
-  const raw = readRaw(path ?? defaultConfigPath());
-  if (!isV2Schema(raw) || !raw.agents || typeof raw.agents !== "object" || Array.isArray(raw.agents)) {
-    return false;
-  }
-  const profile = raw.agents[agent];
-  return Boolean(
-    profile && typeof profile === "object" && !Array.isArray(profile)
-  );
-}
-function updateConfiguredDebug(agent, configured, path) {
-  const target = path ?? defaultConfigPath();
-  return withAuthConfigLock(target, () => {
-    const raw = readRaw(target);
-    if (!isV2Schema(raw) || !raw.agents || typeof raw.agents !== "object" || Array.isArray(raw.agents)) {
-      return false;
-    }
-    const agents = { ...raw.agents };
-    const profile = agents[agent];
-    if (!profile || typeof profile !== "object" || Array.isArray(profile)) {
-      return false;
-    }
-    agents[agent] = { ...profile, debug: configured };
-    secureAtomicWrite(
-      target,
-      JSON.stringify({ ...raw, agents }, null, 2) + "\n"
-    );
-    return true;
-  });
-}
-function writeInstalledPkgVersion(version, path) {
-  const target = path ?? defaultConfigPath();
-  const raw = readRaw(target);
-  const updated = { ...raw, installed_pkg_version: version };
-  secureAtomicWrite(target, JSON.stringify(updated, null, 2) + "\n");
-}
-
-export {
-  resolveDataApiCredential,
-  isDataApiReady,
-  setDebug,
-  isDebug,
-  debug,
-  PACKAGE_NAME,
-  PACKAGE_VERSION,
-  CtxdbError,
-  HttpClient,
-  SUPPORTED_AGENTS,
-  SUPPORTED_AGENT_CHOICES,
-  AGENT_CHOICES,
-  isBuiltinAgent,
-  isAgentSlug,
-  agentHomeDir,
-  agentHomeDirs,
-  agentPlatformSupport,
-  inspectAgentHomes,
-  detectInstalledAgents,
-  agentFromEnv,
-  agentFromArgvWithFallback,
-  defaultConfigPath,
-  configDir,
-  DEFAULT_BASE_URL,
-  DEFAULT_USER_ID,
-  inspectConfig,
-  load,
-  removeAgent,
-  save,
-  configuredAgents,
-  hasConfiguredAgent,
-  updateConfiguredDebug,
-  writeInstalledPkgVersion
-};