@astralyn/pi 0.84.15 → 0.85.0

package/dist/experimental/plugins/package.js

@@ -0,0 +1,113 @@
+import { createHash } from "node:crypto";
+import { readFile, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, join, resolve } from "node:path";
+import { bundleFacetPackage } from "@earendil-works/chord/bundler";
+import { FACET_BUNDLE_MANIFEST_FILE, readFacetBundleArtifact, } from "@earendil-works/chord/node";
+const PLUGIN_PACKAGE_PROFILE_VERSION = 1;
+const DEFAULT_PLUGIN_FACETS = Object.freeze({ session: "src/session.ts", tui: "src/tui.ts" });
+/** Persist an explicit plugin package selection or restore it for a later server generation. */
+export async function restoreServerPluginPackageProfile(directory, serverId, configuredPackagePaths) {
+    const path = join(directory, `plugin-packages-${serverId}.json`);
+    if (configuredPackagePaths === undefined) {
+        return (await readPluginPackageProfile(path, false)) ?? [];
+    }
+    const packagePaths = normalizePluginPackagePaths(configuredPackagePaths);
+    if (packagePaths.length === 0)
+        await rm(path, { force: true });
+    else
+        await writePluginPackageProfile(path, packagePaths);
+    return packagePaths;
+}
+/** Read the explicit plugin selection stored for one durable Session. */
+export function readSessionPluginPackageProfile(directory, serverId, sessionPath) {
+    return readPluginPackageProfile(sessionPluginProfilePath(directory, serverId, sessionPath), true, sessionPath);
+}
+/** Remove the plugin selection stored for one deleted Session. */
+export async function removeSessionPluginPackageProfile(directory, serverId, sessionPath) {
+    await rm(sessionPluginProfilePath(directory, serverId, sessionPath), { force: true });
+}
+/** Persist the plugin selection for one durable Session. */
+export function writeSessionPluginPackageProfile(directory, serverId, sessionPath, packagePaths) {
+    return writePluginPackageProfile(sessionPluginProfilePath(directory, serverId, sessionPath), normalizePluginPackagePaths(packagePaths), sessionPath);
+}
+/** Create a serialized server-owned builder for one configured plugin package. */
+export function createServerPluginPackage(directory, serverId, packagePath) {
+    const normalizedPackagePath = resolve(packagePath);
+    const outdir = join(directory, "plugin-builds", serverId, pluginBuildDirectoryName(normalizedPackagePath));
+    const manifestPath = join(outdir, FACET_BUNDLE_MANIFEST_FILE);
+    let buildTail = Promise.resolve();
+    return {
+        manifestPath,
+        build() {
+            const operation = buildTail.then(async () => {
+                const result = await bundleFacetPackage({
+                    packagePath: normalizedPackagePath,
+                    outdir,
+                    defaultFacets: DEFAULT_PLUGIN_FACETS,
+                });
+                if (result.manifest.entries.tui === undefined)
+                    return [];
+                return [await readFacetBundleArtifact({ manifestPath: result.manifestPath, entry: "tui" })];
+            });
+            buildTail = operation.then(() => undefined, () => undefined);
+            return operation;
+        },
+    };
+}
+async function readPluginPackageProfile(path, allowEmpty, sessionPath) {
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT")
+            return undefined;
+        throw new Error(`Could not read experimental plugin package profile ${path}`, { cause: error });
+    }
+    if (typeof parsed !== "object" ||
+        parsed === null ||
+        Array.isArray(parsed) ||
+        Object.keys(parsed).some((key) => key !== "version" && key !== "packagePaths" && !(key === "sessionPath" && sessionPath !== undefined)) ||
+        !("version" in parsed) ||
+        parsed.version !== PLUGIN_PACKAGE_PROFILE_VERSION ||
+        (sessionPath === undefined
+            ? "sessionPath" in parsed
+            : !("sessionPath" in parsed) || parsed.sessionPath !== sessionPath) ||
+        !("packagePaths" in parsed) ||
+        !Array.isArray(parsed.packagePaths) ||
+        (!allowEmpty && parsed.packagePaths.length === 0) ||
+        parsed.packagePaths.some((packagePath) => typeof packagePath !== "string" || packagePath.length === 0)) {
+        throw new Error(`Invalid experimental plugin package profile ${path}`);
+    }
+    return normalizePluginPackagePaths(parsed.packagePaths);
+}
+function writePluginPackageProfile(path, packagePaths, sessionPath) {
+    return writeFile(path, `${JSON.stringify({
+        version: PLUGIN_PACKAGE_PROFILE_VERSION,
+        ...(sessionPath === undefined ? {} : { sessionPath }),
+        packagePaths,
+    }, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+}
+export function normalizePluginPackagePaths(packagePaths) {
+    const normalized = packagePaths.map((packagePath) => {
+        if (packagePath.length === 0)
+            throw new Error("Plugin package path must not be empty");
+        return resolve(packagePath);
+    });
+    if (new Set(normalized).size !== normalized.length) {
+        throw new Error("Plugin package paths must be unique");
+    }
+    return Object.freeze(normalized);
+}
+function sessionPluginProfilePath(directory, serverId, sessionPath) {
+    const hash = createHash("sha256").update(sessionPath).digest("hex").slice(0, 24);
+    return join(directory, `session-plugin-packages-${serverId}-${hash}.json`);
+}
+function pluginBuildDirectoryName(packagePath) {
+    const packageDirectory = basename(packagePath) === "package.json" ? dirname(packagePath) : packagePath;
+    const base = basename(packageDirectory).replaceAll(/[^a-zA-Z0-9._-]/gu, "-") || "plugin";
+    const label = base.endsWith("-plugin") ? base : `${base}-plugin`;
+    const hash = createHash("sha256").update(packagePath).digest("hex").slice(0, 12);
+    return `${label}-${hash}`;
+}
+//# sourceMappingURL=package.js.map

package/dist/experimental/plugins/package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package.js","sourceRoot":"","sources":["../../../src/experimental/plugins/package.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EACN,0BAA0B,EAE1B,uBAAuB,GACvB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AACzC,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;AAO9F,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACtD,SAAiB,EACjB,QAAkB,EAClB,sBAA0C;IAE1C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,mBAAmB,QAAQ,OAAO,CAAC,CAAC;IACjE,IAAI,sBAAsB,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,CAAC,MAAM,wBAAwB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,YAAY,GAAG,2BAA2B,CAAC,sBAAsB,CAAC,CAAC;IACzE,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;;QAC1D,MAAM,yBAAyB,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IACzD,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,+BAA+B,CAC9C,SAAiB,EACjB,QAAkB,EAClB,WAAmB;IAEnB,OAAO,wBAAwB,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;AAChH,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACtD,SAAiB,EACjB,QAAkB,EAClB,WAAmB;IAEnB,MAAM,EAAE,CAAC,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gCAAgC,CAC/C,SAAiB,EACjB,QAAkB,EAClB,WAAmB,EACnB,YAA+B;IAE/B,OAAO,yBAAyB,CAC/B,wBAAwB,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,EAC1D,2BAA2B,CAAC,YAAY,CAAC,EACzC,WAAW,CACX,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,yBAAyB,CACxC,SAAiB,EACjB,QAAkB,EAClB,WAAmB;IAEnB,MAAM,qBAAqB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,wBAAwB,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC3G,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC9D,IAAI,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAClC,OAAO;QACN,YAAY;QACZ,KAAK;YACJ,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC3C,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;oBACvC,WAAW,EAAE,qBAAqB;oBAClC,MAAM;oBACN,aAAa,EAAE,qBAAqB;iBACpC,CAAC,CAAC;gBACH,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS;oBAAE,OAAO,EAAE,CAAC;gBACzD,OAAO,CAAC,MAAM,uBAAuB,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7F,CAAC,CAAC,CAAC;YACH,SAAS,GAAG,SAAS,CAAC,IAAI,CACzB,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CACf,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;KACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACtC,IAAY,EACZ,UAAmB,EACnB,WAAoB;IAEpB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IACC,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACrB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CACvB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,cAAc,IAAI,CAAC,CAAC,GAAG,KAAK,aAAa,IAAI,WAAW,KAAK,SAAS,CAAC,CAC7G;QACD,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC;QACtB,MAAM,CAAC,OAAO,KAAK,8BAA8B;QACjD,CAAC,WAAW,KAAK,SAAS;YACzB,CAAC,CAAC,aAAa,IAAI,MAAM;YACzB,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,WAAW,CAAC;QACpE,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC;QAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;QACnC,CAAC,CAAC,UAAU,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,CAAC,EACrG,CAAC;QACF,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,2BAA2B,CAAC,MAAM,CAAC,YAAiC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY,EAAE,YAA+B,EAAE,WAAoB;IACrG,OAAO,SAAS,CACf,IAAI,EACJ,GAAG,IAAI,CAAC,SAAS,CAChB;QACC,OAAO,EAAE,8BAA8B;QACvC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACrD,YAAY;KACZ,EACD,IAAI,EACJ,CAAC,CACD,IAAI,EACL,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CACjC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,YAA+B;IAC1E,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QACnD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACvF,OAAO,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,wBAAwB,CAAC,SAAiB,EAAE,QAAkB,EAAE,WAAmB;IAC3F,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,SAAS,EAAE,2BAA2B,QAAQ,IAAI,IAAI,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,wBAAwB,CAAC,WAAmB;IACpD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,WAAW,CAAC,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IACvG,MAAM,IAAI,GAAG,QAAQ,CAAC,gBAAgB,CAAC,CAAC,UAAU,CAAC,mBAAmB,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC;IACzF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,CAAC;IACjE,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { readFile, rm, writeFile } from \"node:fs/promises\";\nimport { basename, dirname, join, resolve } from \"node:path\";\nimport { bundleFacetPackage } from \"@earendil-works/chord/bundler\";\nimport {\n\tFACET_BUNDLE_MANIFEST_FILE,\n\ttype FacetBundleArtifact,\n\treadFacetBundleArtifact,\n} from \"@earendil-works/chord/node\";\nimport type { ServerId } from \"@earendil-works/pi-protocol\";\n\nconst PLUGIN_PACKAGE_PROFILE_VERSION = 1;\nconst DEFAULT_PLUGIN_FACETS = Object.freeze({ session: \"src/session.ts\", tui: \"src/tui.ts\" });\n\nexport interface ConfiguredServerPluginPackage {\n\treadonly manifestPath: string;\n\tbuild(): Promise<readonly FacetBundleArtifact[]>;\n}\n\n/** Persist an explicit plugin package selection or restore it for a later server generation. */\nexport async function restoreServerPluginPackageProfile(\n\tdirectory: string,\n\tserverId: ServerId,\n\tconfiguredPackagePaths?: readonly string[],\n): Promise<readonly string[]> {\n\tconst path = join(directory, `plugin-packages-${serverId}.json`);\n\tif (configuredPackagePaths === undefined) {\n\t\treturn (await readPluginPackageProfile(path, false)) ?? [];\n\t}\n\tconst packagePaths = normalizePluginPackagePaths(configuredPackagePaths);\n\tif (packagePaths.length === 0) await rm(path, { force: true });\n\telse await writePluginPackageProfile(path, packagePaths);\n\treturn packagePaths;\n}\n\n/** Read the explicit plugin selection stored for one durable Session. */\nexport function readSessionPluginPackageProfile(\n\tdirectory: string,\n\tserverId: ServerId,\n\tsessionPath: string,\n): Promise<readonly string[] | undefined> {\n\treturn readPluginPackageProfile(sessionPluginProfilePath(directory, serverId, sessionPath), true, sessionPath);\n}\n\n/** Remove the plugin selection stored for one deleted Session. */\nexport async function removeSessionPluginPackageProfile(\n\tdirectory: string,\n\tserverId: ServerId,\n\tsessionPath: string,\n): Promise<void> {\n\tawait rm(sessionPluginProfilePath(directory, serverId, sessionPath), { force: true });\n}\n\n/** Persist the plugin selection for one durable Session. */\nexport function writeSessionPluginPackageProfile(\n\tdirectory: string,\n\tserverId: ServerId,\n\tsessionPath: string,\n\tpackagePaths: readonly string[],\n): Promise<void> {\n\treturn writePluginPackageProfile(\n\t\tsessionPluginProfilePath(directory, serverId, sessionPath),\n\t\tnormalizePluginPackagePaths(packagePaths),\n\t\tsessionPath,\n\t);\n}\n\n/** Create a serialized server-owned builder for one configured plugin package. */\nexport function createServerPluginPackage(\n\tdirectory: string,\n\tserverId: ServerId,\n\tpackagePath: string,\n): ConfiguredServerPluginPackage {\n\tconst normalizedPackagePath = resolve(packagePath);\n\tconst outdir = join(directory, \"plugin-builds\", serverId, pluginBuildDirectoryName(normalizedPackagePath));\n\tconst manifestPath = join(outdir, FACET_BUNDLE_MANIFEST_FILE);\n\tlet buildTail = Promise.resolve();\n\treturn {\n\t\tmanifestPath,\n\t\tbuild() {\n\t\t\tconst operation = buildTail.then(async () => {\n\t\t\t\tconst result = await bundleFacetPackage({\n\t\t\t\t\tpackagePath: normalizedPackagePath,\n\t\t\t\t\toutdir,\n\t\t\t\t\tdefaultFacets: DEFAULT_PLUGIN_FACETS,\n\t\t\t\t});\n\t\t\t\tif (result.manifest.entries.tui === undefined) return [];\n\t\t\t\treturn [await readFacetBundleArtifact({ manifestPath: result.manifestPath, entry: \"tui\" })];\n\t\t\t});\n\t\t\tbuildTail = operation.then(\n\t\t\t\t() => undefined,\n\t\t\t\t() => undefined,\n\t\t\t);\n\t\t\treturn operation;\n\t\t},\n\t};\n}\n\nasync function readPluginPackageProfile(\n\tpath: string,\n\tallowEmpty: boolean,\n\tsessionPath?: string,\n): Promise<readonly string[] | undefined> {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(await readFile(path, \"utf8\"));\n\t} catch (error) {\n\t\tif (error instanceof Error && \"code\" in error && error.code === \"ENOENT\") return undefined;\n\t\tthrow new Error(`Could not read experimental plugin package profile ${path}`, { cause: error });\n\t}\n\tif (\n\t\ttypeof parsed !== \"object\" ||\n\t\tparsed === null ||\n\t\tArray.isArray(parsed) ||\n\t\tObject.keys(parsed).some(\n\t\t\t(key) => key !== \"version\" && key !== \"packagePaths\" && !(key === \"sessionPath\" && sessionPath !== undefined),\n\t\t) ||\n\t\t!(\"version\" in parsed) ||\n\t\tparsed.version !== PLUGIN_PACKAGE_PROFILE_VERSION ||\n\t\t(sessionPath === undefined\n\t\t\t? \"sessionPath\" in parsed\n\t\t\t: !(\"sessionPath\" in parsed) || parsed.sessionPath !== sessionPath) ||\n\t\t!(\"packagePaths\" in parsed) ||\n\t\t!Array.isArray(parsed.packagePaths) ||\n\t\t(!allowEmpty && parsed.packagePaths.length === 0) ||\n\t\tparsed.packagePaths.some((packagePath) => typeof packagePath !== \"string\" || packagePath.length === 0)\n\t) {\n\t\tthrow new Error(`Invalid experimental plugin package profile ${path}`);\n\t}\n\treturn normalizePluginPackagePaths(parsed.packagePaths as readonly string[]);\n}\n\nfunction writePluginPackageProfile(path: string, packagePaths: readonly string[], sessionPath?: string): Promise<void> {\n\treturn writeFile(\n\t\tpath,\n\t\t`${JSON.stringify(\n\t\t\t{\n\t\t\t\tversion: PLUGIN_PACKAGE_PROFILE_VERSION,\n\t\t\t\t...(sessionPath === undefined ? {} : { sessionPath }),\n\t\t\t\tpackagePaths,\n\t\t\t},\n\t\t\tnull,\n\t\t\t2,\n\t\t)}\\n`,\n\t\t{ encoding: \"utf8\", mode: 0o600 },\n\t);\n}\n\nexport function normalizePluginPackagePaths(packagePaths: readonly string[]): readonly string[] {\n\tconst normalized = packagePaths.map((packagePath) => {\n\t\tif (packagePath.length === 0) throw new Error(\"Plugin package path must not be empty\");\n\t\treturn resolve(packagePath);\n\t});\n\tif (new Set(normalized).size !== normalized.length) {\n\t\tthrow new Error(\"Plugin package paths must be unique\");\n\t}\n\treturn Object.freeze(normalized);\n}\n\nfunction sessionPluginProfilePath(directory: string, serverId: ServerId, sessionPath: string): string {\n\tconst hash = createHash(\"sha256\").update(sessionPath).digest(\"hex\").slice(0, 24);\n\treturn join(directory, `session-plugin-packages-${serverId}-${hash}.json`);\n}\n\nfunction pluginBuildDirectoryName(packagePath: string): string {\n\tconst packageDirectory = basename(packagePath) === \"package.json\" ? dirname(packagePath) : packagePath;\n\tconst base = basename(packageDirectory).replaceAll(/[^a-zA-Z0-9._-]/gu, \"-\") || \"plugin\";\n\tconst label = base.endsWith(\"-plugin\") ? base : `${base}-plugin`;\n\tconst hash = createHash(\"sha256\").update(packagePath).digest(\"hex\").slice(0, 12);\n\treturn `${label}-${hash}`;\n}\n"]}

package/dist/experimental/process.d.ts

@@ -0,0 +1,20 @@
+import { type ChildProcess } from "node:child_process";
+export declare const INTERNAL_PROCESS_ENV = "__PI_INTERNAL_SPAWN";
+export type InternalProcessRole = "coordinator" | "server" | "session-worker";
+/** Detect a directly executed source or unbundled internal-process module. */
+export declare function isDirectInternalProcessEntry(moduleUrl: string): boolean;
+/** Read and validate an internal process role without consuming it. */
+export declare function getInternalProcessRole(): InternalProcessRole | undefined;
+/** Read, validate, and remove the role so descendants do not inherit it. */
+export declare function consumeInternalProcessRole(): InternalProcessRole | undefined;
+export interface InternalProcessSpawnOptions {
+    readonly entryUrl?: URL;
+    readonly env?: NodeJS.ProcessEnv;
+}
+/** Spawn a detached Pi-owned process consistently across Node and compiled Bun. */
+export declare function spawnInternalProcess(role: InternalProcessRole, args: readonly string[], options?: InternalProcessSpawnOptions): ChildProcess;
+/** Force a spawned internal process to exit and wait until it can no longer take ownership. */
+export declare function terminateInternalProcess(child: ChildProcess): Promise<void>;
+export declare const MAX_CONTROL_LINE_BYTES: number;
+export declare function encodeControlLine(message: unknown): string;
+//# sourceMappingURL=process.d.ts.map

package/dist/experimental/process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/experimental/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAS,MAAM,oBAAoB,CAAC;AAK9D,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAE1D,MAAM,MAAM,mBAAmB,GAAG,aAAa,GAAG,QAAQ,GAAG,gBAAgB,CAAC;AAE9E,8EAA8E;AAC9E,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAOvE;AAED,uEAAuE;AACvE,wBAAgB,sBAAsB,IAAI,mBAAmB,GAAG,SAAS,CAKxE;AAED,4EAA4E;AAC5E,wBAAgB,0BAA0B,IAAI,mBAAmB,GAAG,SAAS,CAI5E;AAED,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACjC;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CACnC,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,GAAE,2BAAgC,GACvC,YAAY,CAyBd;AAED,+FAA+F;AAC/F,wBAAsB,wBAAwB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAQjF;AAkBD,eAAO,MAAM,sBAAsB,QAAoB,CAAC;AAExD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAI1D"}

package/dist/experimental/process.js

@@ -0,0 +1,85 @@
+import { spawn } from "node:child_process";
+import { join, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { getPackageDir, isBunBinary, isBundledNode } from "../config.js";
+export const INTERNAL_PROCESS_ENV = "__PI_INTERNAL_SPAWN";
+/** Detect a directly executed source or unbundled internal-process module. */
+export function isDirectInternalProcessEntry(moduleUrl) {
+    return (!isBunBinary &&
+        !isBundledNode &&
+        process.argv[1] !== undefined &&
+        resolve(process.argv[1]) === fileURLToPath(moduleUrl));
+}
+/** Read and validate an internal process role without consuming it. */
+export function getInternalProcessRole() {
+    const role = process.env[INTERNAL_PROCESS_ENV];
+    if (role === undefined)
+        return undefined;
+    if (role === "coordinator" || role === "server" || role === "session-worker")
+        return role;
+    throw new Error(`Unsupported internal process role: ${role}`);
+}
+/** Read, validate, and remove the role so descendants do not inherit it. */
+export function consumeInternalProcessRole() {
+    const role = getInternalProcessRole();
+    delete process.env[INTERNAL_PROCESS_ENV];
+    return role;
+}
+/** Spawn a detached Pi-owned process consistently across Node and compiled Bun. */
+export function spawnInternalProcess(role, args, options = {}) {
+    if (isBunBinary && options.entryUrl) {
+        throw new Error("A compiled Bun executable cannot launch an external internal-process entrypoint");
+    }
+    const entryUrl = defaultEntryUrl(role, options.entryUrl);
+    const sourceRuntimeArgs = import.meta.url.endsWith(".ts")
+        ? ["--import", fileURLToPath(new URL("source-resolver.ts", import.meta.url))]
+        : [];
+    const child = spawn(process.execPath, isBunBinary ? [...args] : [...sourceRuntimeArgs, fileURLToPath(entryUrl), ...args], {
+        cwd: process.cwd(),
+        detached: true,
+        env: {
+            ...process.env,
+            ...options.env,
+            [INTERNAL_PROCESS_ENV]: role,
+        },
+        stdio: "ignore",
+        windowsHide: true,
+    });
+    child.unref();
+    return child;
+}
+/** Force a spawned internal process to exit and wait until it can no longer take ownership. */
+export async function terminateInternalProcess(child) {
+    if (child.pid === undefined || child.exitCode !== null || child.signalCode !== null)
+        return;
+    const terminated = new Promise((resolve) => {
+        child.once("exit", () => resolve());
+        child.once("error", () => resolve());
+    });
+    child.kill("SIGKILL");
+    await terminated;
+}
+function defaultEntryUrl(role, override) {
+    if (override)
+        return override;
+    if (isBundledNode) {
+        const entry = role === "coordinator" ? "coordinator.js" : "cli.js";
+        return pathToFileURL(join(getPackageDir(), "dist", "bundle", entry));
+    }
+    const javaScript = import.meta.url.endsWith(".js");
+    if (role === "coordinator") {
+        return new URL(javaScript ? "coordinator.js" : "coordinator.ts", import.meta.url);
+    }
+    if (role === "server") {
+        return new URL(javaScript ? "server.js" : "server.ts", import.meta.url);
+    }
+    return new URL(javaScript ? "session-worker.js" : "session-worker.ts", import.meta.url);
+}
+export const MAX_CONTROL_LINE_BYTES = 128 * 1024 * 1024;
+export function encodeControlLine(message) {
+    const line = `${JSON.stringify(message)}\n`;
+    if (Buffer.byteLength(line) > MAX_CONTROL_LINE_BYTES)
+        throw new Error("Internal control message is too large");
+    return line;
+}
+//# sourceMappingURL=process.js.map

package/dist/experimental/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/experimental/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAI1D,8EAA8E;AAC9E,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC7D,OAAO,CACN,CAAC,WAAW;QACZ,CAAC,aAAa;QACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS;QAC7B,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,SAAS,CAAC,CACrD,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,sBAAsB;IACrC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IAC1F,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,0BAA0B;IACzC,MAAM,IAAI,GAAG,sBAAsB,EAAE,CAAC;IACtC,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC;AACb,CAAC;AAOD,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CACnC,IAAyB,EACzB,IAAuB,EACvB,UAAuC,EAAE;IAEzC,IAAI,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzD,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QACxD,CAAC,CAAC,CAAC,UAAU,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC,EAAE,CAAC;IACN,MAAM,KAAK,GAAG,KAAK,CAClB,OAAO,CAAC,QAAQ,EAChB,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,EAAE,aAAa,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,EAClF;QACC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;QAClB,QAAQ,EAAE,IAAI;QACd,GAAG,EAAE;YACJ,GAAG,OAAO,CAAC,GAAG;YACd,GAAG,OAAO,CAAC,GAAG;YACd,CAAC,oBAAoB,CAAC,EAAE,IAAI;SAC5B;QACD,KAAK,EAAE,QAAQ;QACf,WAAW,EAAE,IAAI;KACjB,CACD,CAAC;IACF,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO,KAAK,CAAC;AACd,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,KAAmB;IACjE,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO;IAC5F,MAAM,UAAU,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QAChD,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,MAAM,UAAU,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,IAAyB,EAAE,QAAyB;IAC5E,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,aAAa,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACnE,OAAO,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;QAC5B,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACvB,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAExD,MAAM,UAAU,iBAAiB,CAAC,OAAgB;IACjD,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;IAC5C,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,sBAAsB;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC/G,OAAO,IAAI,CAAC;AACb,CAAC","sourcesContent":["import { type ChildProcess, spawn } from \"node:child_process\";\nimport { join, resolve } from \"node:path\";\nimport { fileURLToPath, pathToFileURL } from \"node:url\";\nimport { getPackageDir, isBunBinary, isBundledNode } from \"../config.ts\";\n\nexport const INTERNAL_PROCESS_ENV = \"__PI_INTERNAL_SPAWN\";\n\nexport type InternalProcessRole = \"coordinator\" | \"server\" | \"session-worker\";\n\n/** Detect a directly executed source or unbundled internal-process module. */\nexport function isDirectInternalProcessEntry(moduleUrl: string): boolean {\n\treturn (\n\t\t!isBunBinary &&\n\t\t!isBundledNode &&\n\t\tprocess.argv[1] !== undefined &&\n\t\tresolve(process.argv[1]) === fileURLToPath(moduleUrl)\n\t);\n}\n\n/** Read and validate an internal process role without consuming it. */\nexport function getInternalProcessRole(): InternalProcessRole | undefined {\n\tconst role = process.env[INTERNAL_PROCESS_ENV];\n\tif (role === undefined) return undefined;\n\tif (role === \"coordinator\" || role === \"server\" || role === \"session-worker\") return role;\n\tthrow new Error(`Unsupported internal process role: ${role}`);\n}\n\n/** Read, validate, and remove the role so descendants do not inherit it. */\nexport function consumeInternalProcessRole(): InternalProcessRole | undefined {\n\tconst role = getInternalProcessRole();\n\tdelete process.env[INTERNAL_PROCESS_ENV];\n\treturn role;\n}\n\nexport interface InternalProcessSpawnOptions {\n\treadonly entryUrl?: URL;\n\treadonly env?: NodeJS.ProcessEnv;\n}\n\n/** Spawn a detached Pi-owned process consistently across Node and compiled Bun. */\nexport function spawnInternalProcess(\n\trole: InternalProcessRole,\n\targs: readonly string[],\n\toptions: InternalProcessSpawnOptions = {},\n): ChildProcess {\n\tif (isBunBinary && options.entryUrl) {\n\t\tthrow new Error(\"A compiled Bun executable cannot launch an external internal-process entrypoint\");\n\t}\n\tconst entryUrl = defaultEntryUrl(role, options.entryUrl);\n\tconst sourceRuntimeArgs = import.meta.url.endsWith(\".ts\")\n\t\t? [\"--import\", fileURLToPath(new URL(\"source-resolver.ts\", import.meta.url))]\n\t\t: [];\n\tconst child = spawn(\n\t\tprocess.execPath,\n\t\tisBunBinary ? [...args] : [...sourceRuntimeArgs, fileURLToPath(entryUrl), ...args],\n\t\t{\n\t\t\tcwd: process.cwd(),\n\t\t\tdetached: true,\n\t\t\tenv: {\n\t\t\t\t...process.env,\n\t\t\t\t...options.env,\n\t\t\t\t[INTERNAL_PROCESS_ENV]: role,\n\t\t\t},\n\t\t\tstdio: \"ignore\",\n\t\t\twindowsHide: true,\n\t\t},\n\t);\n\tchild.unref();\n\treturn child;\n}\n\n/** Force a spawned internal process to exit and wait until it can no longer take ownership. */\nexport async function terminateInternalProcess(child: ChildProcess): Promise<void> {\n\tif (child.pid === undefined || child.exitCode !== null || child.signalCode !== null) return;\n\tconst terminated = new Promise<void>((resolve) => {\n\t\tchild.once(\"exit\", () => resolve());\n\t\tchild.once(\"error\", () => resolve());\n\t});\n\tchild.kill(\"SIGKILL\");\n\tawait terminated;\n}\n\nfunction defaultEntryUrl(role: InternalProcessRole, override: URL | undefined): URL {\n\tif (override) return override;\n\tif (isBundledNode) {\n\t\tconst entry = role === \"coordinator\" ? \"coordinator.js\" : \"cli.js\";\n\t\treturn pathToFileURL(join(getPackageDir(), \"dist\", \"bundle\", entry));\n\t}\n\tconst javaScript = import.meta.url.endsWith(\".js\");\n\tif (role === \"coordinator\") {\n\t\treturn new URL(javaScript ? \"coordinator.js\" : \"coordinator.ts\", import.meta.url);\n\t}\n\tif (role === \"server\") {\n\t\treturn new URL(javaScript ? \"server.js\" : \"server.ts\", import.meta.url);\n\t}\n\treturn new URL(javaScript ? \"session-worker.js\" : \"session-worker.ts\", import.meta.url);\n}\n\nexport const MAX_CONTROL_LINE_BYTES = 128 * 1024 * 1024;\n\nexport function encodeControlLine(message: unknown): string {\n\tconst line = `${JSON.stringify(message)}\\n`;\n\tif (Buffer.byteLength(line) > MAX_CONTROL_LINE_BYTES) throw new Error(\"Internal control message is too large\");\n\treturn line;\n}\n"]}

package/dist/experimental/radius-auth.d.ts

@@ -0,0 +1,17 @@
+import type { AuthInput } from "../cli/experimental/command-options.ts";
+export declare const ENV_RADIUS_GATEWAY = "PI_RADIUS_GATEWAY";
+export interface RadiusRelayAuth {
+    readonly gateway: string;
+    readonly token: string;
+}
+/** Resolve explicit or stored Radius credentials anew for every relay connection attempt. */
+export declare class RadiusRelayAuthResolver {
+    #private;
+    constructor(input?: AuthInput, gateway?: string);
+    get gateway(): string;
+    resolve(options: {
+        readonly required: boolean;
+        readonly signal?: AbortSignal;
+    }): Promise<RadiusRelayAuth | undefined>;
+}
+//# sourceMappingURL=radius-auth.d.ts.map

package/dist/experimental/radius-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"radius-auth.d.ts","sourceRoot":"","sources":["../../src/experimental/radius-auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wCAAwC,CAAC;AAIxE,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAEtD,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACvB;AAED,6FAA6F;AAC7F,qBAAa,uBAAuB;;gBAKvB,KAAK,CAAC,EAAE,SAAS,EAAE,OAAO,SAA4D;IAKlG,IAAI,OAAO,IAAI,MAAM,CAEpB;IAEK,OAAO,CAAC,OAAO,EAAE;QACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;KAC9B,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;CAiCxC"}

package/dist/experimental/radius-auth.js

@@ -0,0 +1,52 @@
+import { readFile } from "node:fs/promises";
+import { DEFAULT_RADIUS_GATEWAY, normalizeRadiusGatewayUrl } from "@earendil-works/pi-ai/providers/radius-config";
+import { getAuthCredential } from "../cli/auth-command.js";
+import { ModelRuntime } from "../core/model-runtime.js";
+import { resolvePath } from "../utils/paths.js";
+export const ENV_RADIUS_GATEWAY = "PI_RADIUS_GATEWAY";
+/** Resolve explicit or stored Radius credentials anew for every relay connection attempt. */
+export class RadiusRelayAuthResolver {
+    #input;
+    #gateway;
+    #modelRuntime;
+    constructor(input, gateway = process.env[ENV_RADIUS_GATEWAY] ?? DEFAULT_RADIUS_GATEWAY) {
+        this.#input = input;
+        this.#gateway = normalizeRadiusGatewayUrl(gateway);
+    }
+    get gateway() {
+        return this.#gateway;
+    }
+    async resolve(options) {
+        options.signal?.throwIfAborted();
+        if (process.env.PI_OFFLINE !== undefined) {
+            if (options.required)
+                throw new Error("Radius relay connections are unavailable in offline mode");
+            return undefined;
+        }
+        const explicit = await this.#explicitToken(options.signal);
+        if (explicit !== undefined)
+            return { gateway: this.#gateway, token: explicit };
+        this.#modelRuntime ??= ModelRuntime.create({ refreshOnCreate: false, allowModelNetwork: false });
+        const runtime = await this.#modelRuntime;
+        options.signal?.throwIfAborted();
+        const token = getAuthCredential(await runtime.getAuth("radius", { minOAuthValidityMs: 5 * 60_000, signal: options.signal }));
+        if (token !== undefined && token.length > 0)
+            return { gateway: this.#gateway, token };
+        if (options.required) {
+            throw new Error("Radius authentication is required; start Pi and run /login radius, then retry");
+        }
+        return undefined;
+    }
+    async #explicitToken(signal) {
+        if (this.#input === undefined)
+            return undefined;
+        const value = this.#input.type === "token"
+            ? this.#input.token
+            : await readFile(resolvePath(this.#input.path), { encoding: "utf8", signal });
+        const token = value.trim();
+        if (token.length === 0)
+            throw new Error("Radius authentication token must not be empty");
+        return token;
+    }
+}
+//# sourceMappingURL=radius-auth.js.map

package/dist/experimental/radius-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"radius-auth.js","sourceRoot":"","sources":["../../src/experimental/radius-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,+CAA+C,CAAC;AAClH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAOtD,6FAA6F;AAC7F,MAAM,OAAO,uBAAuB;IAC1B,MAAM,CAAwB;IAC9B,QAAQ,CAAS;IAC1B,aAAa,CAAoC;IAEjD,YAAY,KAAiB,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,sBAAsB;QACjG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,OAAO;QACV,OAAO,IAAI,CAAC,QAAQ,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAGb;QACA,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,OAAO,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAClG,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QAE/E,IAAI,CAAC,aAAa,KAAK,YAAY,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QACjG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;QACzC,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,iBAAiB,CAC9B,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,kBAAkB,EAAE,CAAC,GAAG,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAC3F,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;QACtF,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,MAA+B;QACnD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAChD,MAAM,KAAK,GACV,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;YAC3B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK;YACnB,CAAC,CAAC,MAAM,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACzF,OAAO,KAAK,CAAC;IACd,CAAC;CACD","sourcesContent":["import { readFile } from \"node:fs/promises\";\nimport { DEFAULT_RADIUS_GATEWAY, normalizeRadiusGatewayUrl } from \"@earendil-works/pi-ai/providers/radius-config\";\nimport { getAuthCredential } from \"../cli/auth-command.ts\";\nimport type { AuthInput } from \"../cli/experimental/command-options.ts\";\nimport { ModelRuntime } from \"../core/model-runtime.ts\";\nimport { resolvePath } from \"../utils/paths.ts\";\n\nexport const ENV_RADIUS_GATEWAY = \"PI_RADIUS_GATEWAY\";\n\nexport interface RadiusRelayAuth {\n\treadonly gateway: string;\n\treadonly token: string;\n}\n\n/** Resolve explicit or stored Radius credentials anew for every relay connection attempt. */\nexport class RadiusRelayAuthResolver {\n\treadonly #input: AuthInput | undefined;\n\treadonly #gateway: string;\n\t#modelRuntime: Promise<ModelRuntime> | undefined;\n\n\tconstructor(input?: AuthInput, gateway = process.env[ENV_RADIUS_GATEWAY] ?? DEFAULT_RADIUS_GATEWAY) {\n\t\tthis.#input = input;\n\t\tthis.#gateway = normalizeRadiusGatewayUrl(gateway);\n\t}\n\n\tget gateway(): string {\n\t\treturn this.#gateway;\n\t}\n\n\tasync resolve(options: {\n\t\treadonly required: boolean;\n\t\treadonly signal?: AbortSignal;\n\t}): Promise<RadiusRelayAuth | undefined> {\n\t\toptions.signal?.throwIfAborted();\n\t\tif (process.env.PI_OFFLINE !== undefined) {\n\t\t\tif (options.required) throw new Error(\"Radius relay connections are unavailable in offline mode\");\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst explicit = await this.#explicitToken(options.signal);\n\t\tif (explicit !== undefined) return { gateway: this.#gateway, token: explicit };\n\n\t\tthis.#modelRuntime ??= ModelRuntime.create({ refreshOnCreate: false, allowModelNetwork: false });\n\t\tconst runtime = await this.#modelRuntime;\n\t\toptions.signal?.throwIfAborted();\n\t\tconst token = getAuthCredential(\n\t\t\tawait runtime.getAuth(\"radius\", { minOAuthValidityMs: 5 * 60_000, signal: options.signal }),\n\t\t);\n\t\tif (token !== undefined && token.length > 0) return { gateway: this.#gateway, token };\n\t\tif (options.required) {\n\t\t\tthrow new Error(\"Radius authentication is required; start Pi and run /login radius, then retry\");\n\t\t}\n\t\treturn undefined;\n\t}\n\n\tasync #explicitToken(signal: AbortSignal | undefined): Promise<string | undefined> {\n\t\tif (this.#input === undefined) return undefined;\n\t\tconst value =\n\t\t\tthis.#input.type === \"token\"\n\t\t\t\t? this.#input.token\n\t\t\t\t: await readFile(resolvePath(this.#input.path), { encoding: \"utf8\", signal });\n\t\tconst token = value.trim();\n\t\tif (token.length === 0) throw new Error(\"Radius authentication token must not be empty\");\n\t\treturn token;\n\t}\n}\n"]}

package/dist/experimental/radius-relay.d.ts

@@ -0,0 +1,90 @@
+import type { ByteTransportFactory, Client } from "@earendil-works/pi-client";
+import { type ServerId } from "@earendil-works/pi-protocol";
+import type { Server } from "@earendil-works/pi-server";
+import type { RadiusRelayAuthResolver } from "./radius-auth.ts";
+export declare const RADIUS_RELAY_HOST_SUBPROTOCOL = "pi-session-relay.host.v1";
+export declare const RADIUS_RELAY_CLIENT_SUBPROTOCOL = "pi-session-relay.client.v1";
+interface RadiusRelayMessageEvent extends Event {
+    readonly data: unknown;
+}
+interface RadiusRelayCloseEvent extends Event {
+    readonly code: number;
+    readonly reason: string;
+}
+interface RadiusRelayErrorEvent extends Event {
+    readonly error?: unknown;
+    readonly message?: string;
+}
+export interface RadiusRelayWebSocket {
+    binaryType: "arraybuffer" | "blob";
+    readonly bufferedAmount: number;
+    readonly protocol: string;
+    readonly readyState: number;
+    readonly OPEN: number;
+    send(data: string | ArrayBuffer): void;
+    close(code?: number, reason?: string): void;
+    addEventListener(type: "open", listener: (event: Event) => void, options?: {
+        once?: boolean;
+    }): void;
+    addEventListener(type: "message", listener: (event: RadiusRelayMessageEvent) => void, options?: {
+        once?: boolean;
+    }): void;
+    addEventListener(type: "close", listener: (event: RadiusRelayCloseEvent) => void, options?: {
+        once?: boolean;
+    }): void;
+    addEventListener(type: "error", listener: (event: RadiusRelayErrorEvent) => void, options?: {
+        once?: boolean;
+    }): void;
+    removeEventListener(type: "open", listener: (event: Event) => void): void;
+    removeEventListener(type: "message", listener: (event: RadiusRelayMessageEvent) => void): void;
+    removeEventListener(type: "close", listener: (event: RadiusRelayCloseEvent) => void): void;
+    removeEventListener(type: "error", listener: (event: RadiusRelayErrorEvent) => void): void;
+}
+export type RadiusRelayWebSocketFactory = (options: {
+    readonly url: string;
+    readonly protocol: string;
+    readonly authorization: string;
+}) => RadiusRelayWebSocket;
+export type RadiusRelayHostStatus = {
+    readonly status: "not_authenticated";
+} | {
+    readonly status: "connecting";
+} | {
+    readonly status: "connected";
+} | {
+    readonly status: "retrying";
+    readonly error: string;
+};
+export interface RadiusRelayHostOptions {
+    readonly serverId: ServerId;
+    readonly server: Pick<Server, "accept">;
+    readonly auth: RadiusRelayAuthResolver;
+    readonly webSocketFactory?: RadiusRelayWebSocketFactory;
+    readonly onStatus?: (status: RadiusRelayHostStatus) => void;
+}
+/** Maintain the experimental server's multiplexed, authenticated Radius host connection. */
+export declare class RadiusRelayHost {
+    #private;
+    constructor(options: RadiusRelayHostOptions);
+    start(): void;
+    close(): Promise<void>;
+}
+export declare function createRadiusClientTransportFactory(options: {
+    readonly serverId: ServerId;
+    readonly auth: RadiusRelayAuthResolver;
+    readonly webSocketFactory?: RadiusRelayWebSocketFactory;
+}): ByteTransportFactory;
+type RadiusReconnectClient = Pick<Client, "attachment" | "connected" | "connectionState" | "disconnect" | "onAttachmentChange" | "onConnectionStateChange" | "reconnect">;
+/** Reconnect one established Radius client and restore its last selected Session. */
+export declare class RadiusClientReconnect {
+    #private;
+    constructor(client: RadiusReconnectClient, reattach: (sessionId: string) => Promise<void>);
+    dispose(): Promise<void>;
+}
+export declare function encodeRelayDataFrame(connectionId: string, payload: Uint8Array): ArrayBuffer;
+export declare function parseRelayDataFrame(frame: ArrayBuffer): {
+    readonly connectionId: string;
+    readonly payload: ArrayBuffer;
+} | undefined;
+export {};
+//# sourceMappingURL=radius-relay.d.ts.map

package/dist/experimental/radius-relay.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"radius-relay.d.ts","sourceRoot":"","sources":["../../src/experimental/radius-relay.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,oBAAoB,EAAyB,MAAM,EAAE,MAAM,2BAA2B,CAAC;AACpH,OAAO,EAA4B,KAAK,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,2BAA2B,CAAC;AAExD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAEhE,eAAO,MAAM,6BAA6B,6BAA6B,CAAC;AACxE,eAAO,MAAM,+BAA+B,+BAA+B,CAAC;AAmB5E,UAAU,uBAAwB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACvB;AAED,UAAU,qBAAsB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,UAAU,qBAAsB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACpC,UAAU,EAAE,aAAa,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IACvC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IACrG,gBAAgB,CACf,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,EAClD,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1B,IAAI,CAAC;IACR,gBAAgB,CACf,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,EAChD,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1B,IAAI,CAAC;IACR,gBAAgB,CACf,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,EAChD,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1B,IAAI,CAAC;IACR,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,IAAI,CAAC;IAC1E,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,IAAI,GAAG,IAAI,CAAC;IAC/F,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,GAAG,IAAI,CAAC;IAC3F,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,GAAG,IAAI,CAAC;CAC3F;AAED,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,EAAE;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAC/B,KAAK,oBAAoB,CAAC;AAc3B,MAAM,MAAM,qBAAqB,GAC9B;IAAE,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAA;CAAE,GACxC;IAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GACjC;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAChC;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,qBAAqB,KAAK,IAAI,CAAC;CAC5D;AAED,4FAA4F;AAC5F,qBAAa,eAAe;;gBAYf,OAAO,EAAE,sBAAsB;IAI3C,KAAK,IAAI,IAAI;IAKP,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CA2L5B;AAED,wBAAgB,kCAAkC,CAAC,OAAO,EAAE;IAC3D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;CACxD,GAAG,oBAAoB,CAYvB;AAED,KAAK,qBAAqB,GAAG,IAAI,CAChC,MAAM,EACJ,YAAY,GACZ,WAAW,GACX,iBAAiB,GACjB,YAAY,GACZ,oBAAoB,GACpB,yBAAyB,GACzB,WAAW,CACb,CAAC;AAEF,qFAAqF;AACrF,qBAAa,qBAAqB;;gBAUrB,MAAM,EAAE,qBAAqB,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC;IAanF,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAmC9B;AA8LD,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,WAAW,CAW3F;AAED,wBAAgB,mBAAmB,CAClC,KAAK,EAAE,WAAW,GAChB;IAAE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAAG,SAAS,CAS9E"}