@aragon-agent/cli 0.6.12 → 0.6.14

package/dist/config/cli-commands.js

@@ -13,6 +13,7 @@ import process from 'node:process';
 import { getConfigBackupPath, getConfigPath, getHomeRoot, getLogsDir, getPromptHistoryPath, getUiStatePath, isHomeOverridden, } from './app-paths.js';
 import { getHomeMigrationBreadcrumbPath } from './migrate-home.js';
 import { loadPersistedConfig, updatePersistedConfig } from './store.js';
+import { normalizeModelProfiles, validateModelProfiles } from './model-profiles.js';
 import { clampFastConfig, clampRetryConfig, clampCompactionConfig, parseThresholdInput, clampUpdateConfig, coercePositiveInt, maskSecret, DEFAULT_FAST_CONFIG, DEFAULT_RETRY_CONFIG, DEFAULT_TEAM_CONFIG, DEFAULT_COMPACTION_CONFIG, DEFAULT_UPDATE_CONFIG, } from './schema.js';
 import { clampLogLevel } from '../logging/levels.js';
 /** Config keys under `log.` that `aragon config set` accepts. */
@@ -386,12 +387,23 @@ export function warnIfRedactionDisabled(key, value) {
 // get / list
 // ---------------------------------------------------------------------------
 /** Every secret is masked wherever it is printed, `--json` included (R-12). */
-function maskConfig(config) {
+export function maskConfig(config) {
     const apiKeys = {};
     for (const [provider, key] of Object.entries(config.apiKeys)) {
         apiKeys[provider] = maskSecret(key);
     }
-    return { ...config, apiKeys };
+    const masked = { ...config, apiKeys };
+    if (config.modelProfiles !== undefined) {
+        if (validateModelProfiles(config.modelProfiles).length)
+            masked.modelProfiles = { invalid: true };
+        else {
+            const profiles = normalizeModelProfiles(config.modelProfiles);
+            masked.modelProfiles = { ...profiles, entries: profiles.entries.map((entry) => ({
+                    ...entry, apiKey: entry.apiKey ? 'Configured' : 'Missing',
+                })) };
+        }
+    }
+    return masked;
 }
 /**
  * The human-readable label for a value whose raw form would mislead, or
@@ -503,8 +515,8 @@ export async function runConfigEdit() {
         JSON.parse(readFileSync(file, 'utf-8'));
         process.stdout.write(`${file} saved.\n`);
     }
-    catch (err) {
-        process.stderr.write(`${file} is not valid JSON (${err instanceof Error ? err.message : String(err)}).\n` +
+    catch {
+        process.stderr.write(`${file} is not valid JSON.\n` +
             `The previous version is still at ${backup}.\n`);
         process.exitCode = 1;
     }

package/dist/config/load.d.ts

@@ -6,6 +6,7 @@
  * legitimately long single tool run can never be watchdog-killed.
  */
 import { type CliConfig } from './schema.js';
+import type { ModelRole } from './model-profiles.js';
 export interface CliFlags {
     provider?: string;
     model?: string;
@@ -240,9 +241,11 @@ export interface CliFlags {
  * Resolve the effective config by merging all layers, then derive the runtime
  * (non-persisted) fields and enforce the timeout invariant.
  */
-export declare function loadConfig(flags?: CliFlags): CliConfig;
+export declare function loadConfig(flags?: CliFlags, options?: {
+    interactive?: boolean;
+}): CliConfig;
 /**
  * Build the `getApiKey(providerId)` resolver the core `Agent` consumes.
  * The one-shot `--api-key` override wins, but only for the active provider.
  */
-export declare function makeGetApiKey(config: CliConfig): (providerId: string) => string | undefined;
+export declare function makeGetApiKey(config: CliConfig, role?: ModelRole): (providerId: string) => string | undefined;

package/dist/config/load.js

@@ -9,13 +9,14 @@ import process from 'node:process';
 import { DEFAULT_CONFIG, IDLE_TIMEOUT_MARGIN_MS, clampAskRounds, clampDensity, clampHumanTimeout, clampCompactionConfig, clampLogConfig, clampFastConfig, clampRetryConfig, clampSkillsConfig, clampTeamConfig, clampTodoConfig, clampBashConfig, clampUpdateConfig, clampTheme, clampThinkingLevel, clampContextWindow, clampMaxTokens, clampMaxRenderInterval, clampScrollResumeMs, clampTranscriptRetain, clampTranscriptWindow, coercePositiveInt, isAutoToken, isSkillsToolPolicyMode, parseThresholdInput, } from './schema.js';
 import { loadDotenv, readEnvConfig, readEnvDisabledSkills } from './env.js';
 import { readConfigFile } from './store.js';
+import { projectModelProfiles, resolveModelProfileState, resolveModelRoleKey } from './model-profile-resolution.js';
 import { getConfigPath } from './app-paths.js';
 import { setHistoryEnabled } from './prompt-history.js';
 import { setEntryRetain } from '../agent/entry-limits.js';
 import { readSubmitCount } from './ui-state.js';
 import { getLogger } from '../logging/logger.js';
 import { registerSecret, registerSecretsFrom } from '../logging/secret-registry.js';
-import { detectCapabilities } from '../ui/capabilities.js';
+import { detectCapabilities, resolveTuiCapabilities } from '../ui/capabilities.js';
 /** Interpret a boolean-ish env value (`1/true/on/yes`) as `true`. */
 function envFlagTrue(value) {
     if (!value)
@@ -435,16 +436,22 @@ function resolveContextWindow(env, file) {
  * Resolve the effective config by merging all layers, then derive the runtime
  * (non-persisted) fields and enforce the timeout invariant.
  */
-export function loadConfig(flags = {}) {
+export function loadConfig(flags = {}, options = {}) {
     const cwd = flags.cwd ? flags.cwd : process.cwd();
     // `.env` must be loaded before reading env overrides.
     loadDotenv(cwd);
     const read = readConfigFile();
-    const file = read.config ?? {};
+    const projection = projectModelProfiles(read.config ?? {});
+    const file = projection.file;
     const env = readEnvConfig();
     if (read.parseError) {
         getLogger().error('config', 'config_parse_failed', { error: read.parseError });
     }
+    if (projection.issues.length) {
+        getLogger().warn('config', 'model_profiles_invalid', {
+            error: 'Invalid model profiles; using custom connections. Repair with aragon config edit.',
+        });
+    }
     const provider = pick(flags.provider, env.partial.provider, file.provider) ?? DEFAULT_CONFIG.provider;
     const model = pick(flags.model, env.partial.model, file.model) ?? DEFAULT_CONFIG.model;
     const baseUrl = pick(flags.baseUrl, env.partial.baseUrl ?? undefined, file.baseUrl ?? undefined);
@@ -512,13 +519,17 @@ export function loadConfig(flags = {}) {
     // registering twice costs a `Set.add`, missing once costs a credential.
     registerSecretsFrom(apiKeys);
     registerSecret(flags.apiKey);
-    const color = flags.color !== undefined ? flags.color : !process.env.NO_COLOR;
+    const caps = options.interactive
+        ? resolveTuiCapabilities(process.env, flags.color)
+        : detectCapabilities(process.env, process.stdout);
+    const color = options.interactive
+        ? caps.colorLevel !== 0
+        : flags.color !== undefined ? flags.color : !process.env.NO_COLOR;
     // `--no-color` implies calmer chrome; env / file may also opt in explicitly.
     const reducedMotion = envFlagTrue(process.env.ARAGON_REDUCED_MOTION) ||
         (file.reducedMotion ?? DEFAULT_CONFIG.reducedMotion) ||
         !color;
     // Detect terminal capabilities once; force monochrome when color is disabled.
-    const caps = detectCapabilities(process.env, process.stdout);
     const colorLevel = color ? caps.colorLevel : 0;
     // No flag and no env var: a privacy switch you set once, not a per-run knob.
     const historyEnabled = file.historyEnabled ?? DEFAULT_CONFIG.historyEnabled;
@@ -543,6 +554,7 @@ export function loadConfig(flags = {}) {
     // it through the same module-singleton channel `setHistoryEnabled` uses.
     setEntryRetain(transcriptRetain);
     const config = {
+        modelProfiles: projection.issues.length ? undefined : file.modelProfiles,
         provider,
         model,
         baseUrl,
@@ -605,6 +617,10 @@ export function loadConfig(flags = {}) {
         unicode: caps.unicode,
         apiKeyOverride: flags.apiKey && flags.apiKey.trim().length > 0 ? flags.apiKey.trim() : undefined,
     };
+    config.modelProfileState = resolveModelProfileState(config, config.modelProfiles, projection.issues.length > 0);
+    if (config.apiKeyOverride && (config.modelProfiles?.mainId || config.modelProfiles?.fastId)) {
+        config.apiKeyOverrideTarget = { provider, baseUrl: baseUrl?.trim() || null };
+    }
     recordResolvedConfig(config);
     return config;
 }
@@ -646,11 +662,6 @@ function recordResolvedConfig(config) {
  * Build the `getApiKey(providerId)` resolver the core `Agent` consumes.
  * The one-shot `--api-key` override wins, but only for the active provider.
  */
-export function makeGetApiKey(config) {
-    return (providerId) => {
-        if (config.apiKeyOverride && providerId === config.provider) {
-            return config.apiKeyOverride;
-        }
-        return config.apiKeys[providerId];
-    };
+export function makeGetApiKey(config, role = 'main') {
+    return (providerId) => resolveModelRoleKey({ config, role, providerId });
 }

package/dist/config/model-profile-resolution.d.ts

@@ -0,0 +1,20 @@
+import { type CliConfig, type PersistedConfig } from './schema.js';
+import { type ModelProfilesConfig, type ModelProfilesRuntime, type ModelRole, type ProfileValidationIssue } from './model-profiles.js';
+export interface ProfileProjection {
+    file: Partial<PersistedConfig>;
+    state: ModelProfilesRuntime;
+    issues: ProfileValidationIssue[];
+}
+export interface RoleKeyInput {
+    config: CliConfig;
+    role: ModelRole;
+    providerId: string;
+}
+/** Compare configured endpoint spelling strictly, with null and undefined equivalent. */
+export declare function normalizeProfileBaseUrl(value: string | null | undefined): string | null;
+/** Project a valid library onto a copy without rewriting legacy preferences. */
+export declare function projectModelProfiles(file: Partial<PersistedConfig>): ProfileProjection;
+/** Derive binding status from current connections, including session/model overrides. */
+export declare function resolveModelProfileState(config: CliConfig, profiles?: ModelProfilesConfig | undefined, invalid?: boolean): ModelProfilesRuntime;
+/** Resolve only credentials scoped to the requested role and actual connection target. */
+export declare function resolveModelRoleKey(input: RoleKeyInput): string | undefined;

package/dist/config/model-profile-resolution.js

@@ -0,0 +1,81 @@
+import { DEFAULT_CONFIG } from './schema.js';
+import { emptyModelProfileState, normalizeModelProfiles, validateModelProfiles } from './model-profiles.js';
+/** Compare configured endpoint spelling strictly, with null and undefined equivalent. */
+export function normalizeProfileBaseUrl(value) {
+    return value?.trim() || null;
+}
+/** Project a valid library onto a copy without rewriting legacy preferences. */
+export function projectModelProfiles(file) {
+    const issues = validateModelProfiles(file.modelProfiles);
+    const state = emptyModelProfileState(issues.length > 0);
+    const projected = { ...file };
+    if (issues.length || !file.modelProfiles)
+        return { file: projected, state, issues };
+    const library = normalizeModelProfiles(file.modelProfiles);
+    projected.modelProfiles = library;
+    for (const role of ['main', 'fast']) {
+        const entry = library.entries.find((profile) => profile.id === library[`${role}Id`]);
+        if (!entry)
+            continue;
+        state[role] = { selectedId: entry.id, appliedId: entry.id,
+            overriddenFields: [], invalid: false };
+        const connection = { provider: entry.provider, model: entry.model, baseUrl: entry.baseUrl };
+        if (role === 'main')
+            Object.assign(projected, connection);
+        else
+            projected.fast = { ...DEFAULT_CONFIG.fast, ...file.fast, ...connection,
+                baseUrl: entry.baseUrl ?? '' };
+    }
+    return { file: projected, state, issues };
+}
+/** Derive binding status from current connections, including session/model overrides. */
+export function resolveModelProfileState(config, profiles = config.modelProfiles, invalid = false) {
+    const issues = validateModelProfiles(profiles);
+    const state = emptyModelProfileState(invalid || issues.length > 0);
+    if (issues.length || !profiles)
+        return state;
+    for (const role of ['main', 'fast']) {
+        const entry = profiles.entries.find((profile) => profile.id === profiles[`${role}Id`]);
+        if (!entry)
+            continue;
+        const connection = role === 'main' ? config : config.fast;
+        const changed = ['provider', 'model', 'baseUrl'].filter((field) => field === 'baseUrl'
+            ? normalizeProfileBaseUrl(connection[field]) !== normalizeProfileBaseUrl(entry[field])
+            : connection[field] !== entry[field]);
+        state[role] = { selectedId: entry.id,
+            appliedId: changed.some((field) => field !== 'model') ? null : entry.id,
+            overriddenFields: changed, invalid: false };
+    }
+    return state;
+}
+/** Resolve only credentials scoped to the requested role and actual connection target. */
+export function resolveModelRoleKey(input) {
+    const { config, role, providerId } = input;
+    const shared = config.apiKeys[providerId] || undefined;
+    const profiles = validateModelProfiles(config.modelProfiles).length
+        ? undefined : config.modelProfiles;
+    const profileMode = profiles && (profiles.mainId !== null || profiles.fastId !== null);
+    if (!profileMode) {
+        const target = config.apiKeyOverrideTarget;
+        if (target) {
+            return role === 'main' && providerId === config.provider
+                && target.provider === config.provider
+                && normalizeProfileBaseUrl(target.baseUrl) === normalizeProfileBaseUrl(config.baseUrl)
+                ? config.apiKeyOverride || shared : shared;
+        }
+        return config.apiKeyOverride && providerId === config.provider
+            ? config.apiKeyOverride : shared;
+    }
+    const actualProvider = role === 'main'
+        ? config.provider : config.fast.provider || config.provider;
+    if (providerId !== actualProvider)
+        return shared;
+    const target = config.apiKeyOverrideTarget;
+    if (role === 'main' && config.apiKeyOverride && target?.provider === config.provider
+        && normalizeProfileBaseUrl(target.baseUrl) === normalizeProfileBaseUrl(config.baseUrl)) {
+        return config.apiKeyOverride;
+    }
+    const state = resolveModelProfileState(config)[role];
+    const entry = profiles.entries.find((profile) => profile.id === state.appliedId);
+    return entry?.apiKey || shared;
+}

package/dist/config/model-profile-store.d.ts

@@ -0,0 +1,67 @@
+import { type ModelProfilesConfig, type ModelRole, type ProfileValidationIssue } from './model-profiles.js';
+import type { CliConfig, CompactionConfig, FastConfig, LogConfig, PersistedConfig } from './schema.js';
+export interface ModelSettingsPatch extends Partial<Omit<PersistedConfig, 'modelProfiles' | 'fast' | 'compaction' | 'log'>> {
+    fast?: Partial<FastConfig>;
+    compaction?: Partial<CompactionConfig>;
+    log?: Partial<LogConfig>;
+}
+export interface ModelSettingsDraft {
+    profiles?: ModelProfilesConfig;
+    patch: ModelSettingsPatch;
+    activateRoles: ModelRole[];
+    diskRevision: string;
+    liveRevision: number;
+    baseline: PersistedConfig;
+    liveBaseline: CliConfig;
+    readError?: string;
+}
+export interface ModelSettingsSaveResult {
+    ok: boolean;
+    persisted: boolean;
+    status: 'applied' | 'restart_required' | 'rejected' | 'saved_apply_failed';
+    code?: 'invalid' | 'busy' | 'conflict' | 'read_failed' | 'write_failed' | 'profile_key_required' | 'legacy_conversion_unsupported' | 'apply_failed';
+    issues?: ProfileValidationIssue[];
+    restartRequired?: boolean;
+}
+export type ConfigReadError = 'invalid_json' | 'invalid_root' | 'read_failed';
+export interface ModelSettingsDisk {
+    ok: boolean;
+    config: PersistedConfig;
+    parsed: Partial<PersistedConfig> | null;
+    raw: Buffer | null;
+    revision: string;
+    error?: ConfigReadError;
+}
+/** A stable, safe error for adapters; never includes caught exception messages. */
+export declare class ModelProfileConfigError extends Error {
+    readonly code: NonNullable<ModelSettingsSaveResult['code']>;
+    constructor(code: NonNullable<ModelSettingsSaveResult['code']>);
+}
+/** Read and hash exactly the same bytes; a missing file has its own revision sentinel. */
+export declare function readModelSettingsDisk(): ModelSettingsDisk;
+export interface ModelSettingsCommitInput {
+    candidate: PersistedConfig;
+    diskRevision: string;
+}
+export interface ModelSettingsStoreDependencies {
+    read: () => ModelSettingsDisk;
+    write: (candidate: PersistedConfig) => void;
+}
+/** Optimistically commit a prepared candidate using one atomic write; never applies live state. */
+export declare function commitModelSettings(input: ModelSettingsCommitInput, dependencies?: ModelSettingsStoreDependencies): ModelSettingsSaveResult;
+export interface LegacyPatchInput {
+    current: PersistedConfig;
+    patch: ModelSettingsPatch & {
+        modelProfiles?: ModelProfilesConfig;
+    };
+}
+/** Adapt legacy edits without mutating a shared profile or moving its dedicated key. */
+export declare function adaptLegacyConnectionPatch(input: LegacyPatchInput): LegacyPatchInput['patch'];
+/** A detached default endpoint must not acquire a gateway through legacy inheritance. */
+export declare function assertLegacyFastTarget(fast: {
+    provider: string;
+    baseUrl?: string | null;
+}, main: {
+    provider: string;
+    baseUrl?: string | null;
+}): void;

package/dist/config/model-profile-store.js

@@ -0,0 +1,153 @@
+import { createHash } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { getConfigPath } from './app-paths.js';
+import { normalizePersistedConfig, writeConfigFile } from './store.js';
+import { registerProfileSecrets } from '../logging/secret-registry.js';
+import { normalizeModelProfiles, validateModelProfiles } from './model-profiles.js';
+import { normalizeProfileBaseUrl, projectModelProfiles } from './model-profile-resolution.js';
+/** A stable, safe error for adapters; never includes caught exception messages. */
+export class ModelProfileConfigError extends Error {
+    code;
+    constructor(code) {
+        super(code === 'profile_key_required' || code === 'legacy_conversion_unsupported'
+            ? `${code}: Use /settings to edit or copy this profile.`
+            : `${code}: Check the configuration with aragon config edit.`);
+        this.code = code;
+        this.name = 'ModelProfileConfigError';
+    }
+}
+/** Read and hash exactly the same bytes; a missing file has its own revision sentinel. */
+export function readModelSettingsDisk() {
+    let raw;
+    try {
+        raw = readFileSync(getConfigPath());
+    }
+    catch (error) {
+        const missing = error.code === 'ENOENT';
+        return { ok: missing, config: normalizePersistedConfig({}), parsed: null, raw: null,
+            revision: missing ? 'missing' : 'unreadable',
+            ...(missing ? {} : { error: 'read_failed' }) };
+    }
+    const revision = createHash('sha256').update(raw).digest('hex');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw.toString('utf8'));
+    }
+    catch {
+        return failedRead(raw, revision, 'invalid_json');
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return failedRead(raw, revision, 'invalid_root');
+    }
+    registerProfileSecrets(parsed);
+    return { ok: true, raw, revision, parsed: parsed,
+        config: normalizePersistedConfig(parsed) };
+}
+function failedRead(raw, revision, error) {
+    return { ok: false, raw, revision, error, config: normalizePersistedConfig({}), parsed: null };
+}
+/** Optimistically commit a prepared candidate using one atomic write; never applies live state. */
+export function commitModelSettings(input, dependencies = {
+    read: readModelSettingsDisk, write: writeConfigFile,
+}) {
+    const current = dependencies.read();
+    if (!current.ok)
+        return rejected('read_failed');
+    if (current.revision !== input.diskRevision)
+        return rejected('conflict');
+    if (validateModelProfiles(current.config.modelProfiles).length)
+        return rejected('invalid');
+    registerProfileSecrets(input.candidate);
+    const issues = validateModelProfiles(input.candidate.modelProfiles);
+    if (issues.length)
+        return { ...rejected('invalid'), issues };
+    try {
+        dependencies.write(input.candidate);
+    }
+    catch {
+        return rejected('write_failed');
+    }
+    return { ok: true, persisted: true, status: 'applied' };
+}
+function rejected(code) {
+    return { ok: false, persisted: false, status: 'rejected', code };
+}
+function touchesConnection(patch) {
+    return Boolean(patch && ['provider', 'model', 'baseUrl'].some((key) => Object.prototype.hasOwnProperty.call(patch, key)));
+}
+/** Adapt legacy edits without mutating a shared profile or moving its dedicated key. */
+export function adaptLegacyConnectionPatch(input) {
+    const { current, patch } = input;
+    if (Object.prototype.hasOwnProperty.call(patch, 'modelProfiles')) {
+        if (validateModelProfiles(current.modelProfiles).length
+            || validateModelProfiles(patch.modelProfiles).length) {
+            throw new ModelProfileConfigError('invalid');
+        }
+        let result = patch;
+        for (const role of ['main', 'fast']) {
+            if (!patch.modelProfiles?.[`${role}Id`]) {
+                result = adaptUnboundProviders(current, result, role);
+            }
+        }
+        return result;
+    }
+    const roles = ['main', 'fast'].filter((role) => touchesConnection(role === 'main' ? patch : patch.fast));
+    if (!roles.length)
+        return patch;
+    if (!current.modelProfiles)
+        return adaptUnboundProviders(current, patch);
+    if (validateModelProfiles(current.modelProfiles).length) {
+        throw new ModelProfileConfigError('invalid');
+    }
+    const profiles = normalizeModelProfiles(current.modelProfiles);
+    const result = { ...patch, modelProfiles: profiles };
+    for (const role of roles)
+        adaptRole(current, result, role);
+    return result;
+}
+function adaptUnboundProviders(current, patch, role) {
+    const result = { ...patch };
+    if (role !== 'fast' && patch.provider !== undefined && patch.provider !== current.provider
+        && !Object.prototype.hasOwnProperty.call(patch, 'baseUrl'))
+        result.baseUrl = null;
+    if (role !== 'main' && patch.fast?.provider !== undefined
+        && patch.fast.provider !== current.fast.provider
+        && !Object.prototype.hasOwnProperty.call(patch.fast, 'baseUrl')) {
+        result.fast = { ...patch.fast, baseUrl: '' };
+    }
+    return result;
+}
+function adaptRole(current, patch, role) {
+    const profiles = patch.modelProfiles;
+    const entry = profiles.entries.find((profile) => profile.id === profiles[`${role}Id`]);
+    if (!entry) {
+        Object.assign(patch, adaptUnboundProviders(current, patch, role));
+        return;
+    }
+    if (entry.apiKey)
+        throw new ModelProfileConfigError('profile_key_required');
+    const explicit = role === 'main' ? patch : patch.fast;
+    const provider = explicit.provider ?? entry.provider;
+    const changedProvider = provider !== entry.provider;
+    const baseUrl = Object.prototype.hasOwnProperty.call(explicit, 'baseUrl')
+        ? explicit.baseUrl ?? null : changedProvider ? null : entry.baseUrl;
+    const connection = { provider, model: explicit.model ?? entry.model, baseUrl };
+    if (role === 'fast') {
+        const main = projectModelProfiles(current).file;
+        const mainProvider = patch.provider ?? main.provider ?? current.provider;
+        const mainUrl = Object.prototype.hasOwnProperty.call(patch, 'baseUrl')
+            ? patch.baseUrl : main.baseUrl;
+        assertLegacyFastTarget(connection, { provider: mainProvider, baseUrl: mainUrl });
+        patch.fast = { ...connection, ...patch.fast, baseUrl: baseUrl ?? '' };
+    }
+    else
+        Object.assign(patch, connection);
+    profiles[`${role}Id`] = null;
+}
+/** A detached default endpoint must not acquire a gateway through legacy inheritance. */
+export function assertLegacyFastTarget(fast, main) {
+    if (!normalizeProfileBaseUrl(fast.baseUrl) && (fast.provider || main.provider) === main.provider
+        && normalizeProfileBaseUrl(main.baseUrl)) {
+        throw new ModelProfileConfigError('legacy_conversion_unsupported');
+    }
+}

package/dist/config/model-profiles.d.ts

@@ -0,0 +1,44 @@
+export type ModelRole = 'main' | 'fast';
+export interface ModelProfile {
+    id: string;
+    name: string;
+    provider: string;
+    model: string;
+    baseUrl: string | null;
+    apiKey: string | null;
+}
+export interface ModelProfilesConfig {
+    version: 1;
+    entries: ModelProfile[];
+    mainId: string | null;
+    fastId: string | null;
+}
+export interface ProfileBindingState {
+    selectedId: string | null;
+    appliedId: string | null;
+    overriddenFields: Array<'provider' | 'model' | 'baseUrl'>;
+    invalid: boolean;
+}
+export interface ModelProfilesRuntime {
+    main: ProfileBindingState;
+    fast: ProfileBindingState;
+}
+export interface ProfileValidationIssue {
+    path: string;
+    code: 'invalid' | 'duplicate_id' | 'missing_reference' | 'unsupported_version';
+    message: string;
+}
+/** Return a fresh empty library without initiating a disk migration. */
+export declare function emptyModelProfiles(): ModelProfilesConfig;
+/** Return independently mutable role state. */
+export declare function emptyModelProfileState(invalid?: boolean): ModelProfilesRuntime;
+/** Validate untrusted input; diagnostics never include supplied values. */
+export declare function validateModelProfiles(value: unknown): ProfileValidationIssue[];
+/** Normalize a valid library into a safe field whitelist; throws a fixed error if invalid. */
+export declare function normalizeModelProfiles(value: unknown): ModelProfilesConfig;
+/** Create an entry with a stable UUID and a frozen default name. */
+export declare function createModelProfile(input: Omit<ModelProfile, 'id'>): ModelProfile;
+/** Duplicate the current draft entry, including its explicitly edited credential. */
+export declare function duplicateModelProfile(entry: ModelProfile): ModelProfile;
+/** Remove an unused entry; binding references must be changed explicitly first. */
+export declare function removeModelProfile(library: ModelProfilesConfig, id: string): ModelProfilesConfig;

package/dist/config/model-profiles.js

@@ -0,0 +1,121 @@
+import { randomUUID } from 'node:crypto';
+import { ADAPTER_PROVIDERS } from './schema.js';
+const CONTROL = /[\u0000-\u001f\u007f-\u009f]/;
+/** Return a fresh empty library without initiating a disk migration. */
+export function emptyModelProfiles() {
+    return { version: 1, entries: [], mainId: null, fastId: null };
+}
+/** Return independently mutable role state. */
+export function emptyModelProfileState(invalid = false) {
+    const binding = () => ({ selectedId: null, appliedId: null,
+        overriddenFields: [], invalid });
+    return { main: binding(), fast: binding() };
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function validText(value, max, allowEmpty = false) {
+    return typeof value === 'string' && !CONTROL.test(value)
+        && (allowEmpty || value.trim().length > 0) && [...value.trim()].length <= max;
+}
+function validUrl(value) {
+    if (value === null || (typeof value === 'string' && !value.trim()))
+        return true;
+    if (typeof value !== 'string' || CONTROL.test(value))
+        return false;
+    try {
+        const url = new URL(value.trim());
+        return ['http:', 'https:'].includes(url.protocol) && Boolean(url.hostname)
+            && !url.username && !url.password && !value.includes('?') && !value.includes('#');
+    }
+    catch {
+        return false;
+    }
+}
+function validateEntry(value, index) {
+    const path = `modelProfiles.entries[${index}]`;
+    const invalid = (field, message) => ({
+        path: field ? `${path}.${field}` : path, code: 'invalid', message,
+    });
+    if (!isRecord(value))
+        return [invalid('', 'Profile must be an object.')];
+    const issues = [];
+    if (!validText(value.id, 128))
+        issues.push(invalid('id', 'ID must have 1-128 safe characters.'));
+    if (!validText(value.name, 80, true)) {
+        issues.push(invalid('name', 'Name must have at most 80 safe characters.'));
+    }
+    if (!ADAPTER_PROVIDERS.includes(value.provider)) {
+        issues.push(invalid('provider', 'Select a supported provider.'));
+    }
+    if (!validText(value.model, 256)) {
+        issues.push(invalid('model', 'Model must have 1-256 safe characters.'));
+    }
+    if (!validUrl(value.baseUrl)) {
+        issues.push(invalid('baseUrl', 'Use an HTTP(S) URL without credentials, query or fragment.'));
+    }
+    if (value.apiKey !== null && !validText(value.apiKey, 8192)) {
+        issues.push(invalid('apiKey', 'Enter a nonempty key up to 8192 safe characters.'));
+    }
+    return issues;
+}
+/** Validate untrusted input; diagnostics never include supplied values. */
+export function validateModelProfiles(value) {
+    if (value === undefined)
+        return [];
+    if (!isRecord(value))
+        return [{ path: 'modelProfiles', code: 'invalid',
+                message: 'Model profiles must be an object. Repair with aragon config edit.' }];
+    if (value.version !== 1)
+        return [{ path: 'modelProfiles.version',
+                code: 'unsupported_version', message: 'Unsupported model profiles version.' }];
+    if (!Array.isArray(value.entries) || value.entries.length > 200) {
+        return [{ path: 'modelProfiles.entries', code: 'invalid',
+                message: 'Use an array with at most 200 profiles; remove unused profiles to add more.' }];
+    }
+    const issues = value.entries.flatMap(validateEntry);
+    const ids = new Set();
+    value.entries.forEach((entry, index) => {
+        if (!isRecord(entry) || typeof entry.id !== 'string')
+            return;
+        if (ids.has(entry.id))
+            issues.push({ path: `modelProfiles.entries[${index}].id`,
+                code: 'duplicate_id', message: 'Profile IDs must be unique.' });
+        ids.add(entry.id);
+    });
+    for (const field of ['mainId', 'fastId']) {
+        if (value[field] !== null && (typeof value[field] !== 'string' || !ids.has(value[field]))) {
+            issues.push({ path: `modelProfiles.${field}`, code: 'missing_reference',
+                message: 'Select an existing profile or Current custom.' });
+        }
+    }
+    return issues;
+}
+/** Normalize a valid library into a safe field whitelist; throws a fixed error if invalid. */
+export function normalizeModelProfiles(value) {
+    if (validateModelProfiles(value).length)
+        throw new Error('Invalid model profiles.');
+    if (value === undefined)
+        return emptyModelProfiles();
+    const library = value;
+    return { version: 1, mainId: library.mainId, fastId: library.fastId,
+        entries: library.entries.map((entry) => ({ id: entry.id, name: entry.name.trim()
+                || [...entry.model.trim()].slice(0, 80).join(''), provider: entry.provider,
+            model: entry.model.trim(), baseUrl: entry.baseUrl?.trim() || null,
+            apiKey: entry.apiKey?.trim() || null })) };
+}
+/** Create an entry with a stable UUID and a frozen default name. */
+export function createModelProfile(input) {
+    const entry = { ...input, id: randomUUID() };
+    return normalizeModelProfiles({ ...emptyModelProfiles(), entries: [entry] }).entries[0];
+}
+/** Duplicate the current draft entry, including its explicitly edited credential. */
+export function duplicateModelProfile(entry) {
+    return { ...entry, id: randomUUID(), name: `${[...entry.name].slice(0, 73).join('')} (copy)` };
+}
+/** Remove an unused entry; binding references must be changed explicitly first. */
+export function removeModelProfile(library, id) {
+    if (library.mainId === id || library.fastId === id)
+        throw new Error('Profile is still in use.');
+    return { ...library, entries: library.entries.filter((entry) => entry.id !== id) };
+}