@coool/opencode-adaptive 0.0.0-stage → 1.0.1

package/dist/state/receipts/types.js

@@ -0,0 +1,12 @@
+export const RECEIPTS_KEY = "coool.adaptive/receipts";
+export const RECEIPTS_VERSION = 1;
+/** Product bound — not a user knob. The ring keeps the newest receipts. */
+export const MAX_RECEIPTS = 200;
+/**
+ * Every free-text string stored in a receipt is truncated to this bound
+ * before persisting (and re-truncated on read). Boundedness is the
+ * no-secrets invariant: prompts, error bodies, and credentials have no
+ * field to live in and no room to hide in.
+ */
+export const MAX_RECEIPT_TEXT = 128;
+//# sourceMappingURL=types.js.map

package/dist/state/receipts/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/state/receipts/types.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,YAAY,GAAG,yBAAyB,CAAA;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAA;AACjC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,GAAG,CAAA;AAC/B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAA","sourcesContent":["/**\n * Decision receipts (ADP-030): small bounded local records explaining why\n * Adaptive made each decision. Receipts exist for explainability, debugging,\n * tests, and a future outcome-learning policy — never injected into prompts,\n * never leaving the machine. Retention is bounded (oldest evicted).\n */\nimport type { Decision } from \"../../core/scheduler/types.js\"\nimport type { TierName } from \"../../core/tier-policy/types.js\"\nimport type { InterruptReason } from \"../../core/work-unit/interruption.js\"\nimport type { FailureCategory } from \"../../health/classifier/types.js\"\n\nexport const RECEIPTS_KEY = \"coool.adaptive/receipts\"\nexport const RECEIPTS_VERSION = 1\n/** Product bound — not a user knob. The ring keeps the newest receipts. */\nexport const MAX_RECEIPTS = 200\n/**\n * Every free-text string stored in a receipt is truncated to this bound\n * before persisting (and re-truncated on read). Boundedness is the\n * no-secrets invariant: prompts, error bodies, and credentials have no\n * field to live in and no room to hide in.\n */\nexport const MAX_RECEIPT_TEXT = 128\n\nexport interface ReceiptMeta {\n  /** Decision timestamp (adapter clock, ms epoch). */\n  readonly at: number\n  readonly sessionID: string\n  readonly unitID?: string | undefined\n  /** Required tier when routing named one (pins carry no tier). */\n  readonly tier?: TierName | undefined\n}\n\nexport interface ReceiptInput extends ReceiptMeta {\n  /** The decision exactly as the scheduler/mode wrapper produced it. */\n  readonly decision: Decision\n}\n\n/**\n * Unit outcome attached after termination. Structured vocabulary only —\n * never the raw error text (ADP-030: no secrets, bounded records).\n */\nexport type ReceiptOutcome =\n  | { readonly status: \"succeeded\" }\n  | { readonly status: \"failed\"; readonly category: FailureCategory }\n  | { readonly status: \"interrupted\"; readonly reason: InterruptReason }\n\nexport interface Receipt extends ReceiptMeta {\n  /** Monotonic id assigned by the store; continues across restarts. */\n  readonly id: number\n  readonly decision: Decision\n  readonly outcome?: ReceiptOutcome\n}\n\nexport interface ReceiptsPayload {\n  readonly version: typeof RECEIPTS_VERSION\n  readonly receipts: readonly Receipt[]\n}\n\n/** Storage seam — the adapter binds `RECEIPTS_KEY` to `ctx.storage`. */\nexport interface ReceiptsStorage {\n  read(): Promise<unknown>\n  write(payload: ReceiptsPayload): Promise<void>\n}\n"]}

package/dist/state/session-modes/index.d.ts

@@ -0,0 +1,4 @@
+export { parseSessionModesPayload, isValidSessionID } from "./parse.js";
+export { SessionModeStore } from "./store.js";
+export { SESSION_MODES_KEY, SESSION_MODES_VERSION, MAX_SESSION_MODE_RECORDS, MAX_SESSION_ID_LENGTH, } from "./types.js";
+export type { SessionModeRecord, SessionModesPayload, SessionModeSetResult, SessionModesStorage, } from "./types.js";

package/dist/state/session-modes/index.js

@@ -0,0 +1,4 @@
+export { parseSessionModesPayload, isValidSessionID } from "./parse.js";
+export { SessionModeStore } from "./store.js";
+export { SESSION_MODES_KEY, SESSION_MODES_VERSION, MAX_SESSION_MODE_RECORDS, MAX_SESSION_ID_LENGTH, } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/state/session-modes/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/state/session-modes/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAC7C,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,YAAY,CAAA","sourcesContent":["export { parseSessionModesPayload, isValidSessionID } from \"./parse.js\"\nexport { SessionModeStore } from \"./store.js\"\nexport {\n  SESSION_MODES_KEY,\n  SESSION_MODES_VERSION,\n  MAX_SESSION_MODE_RECORDS,\n  MAX_SESSION_ID_LENGTH,\n} from \"./types.js\"\nexport type {\n  SessionModeRecord,\n  SessionModesPayload,\n  SessionModeSetResult,\n  SessionModesStorage,\n} from \"./types.js\"\n"]}

package/dist/state/session-modes/parse.d.ts

@@ -0,0 +1,8 @@
+import type { SessionModeRecord } from "./types.js";
+/**
+ * A non-empty bounded session identifier. Unlike the health parser's provider
+ * identifiers (truncated on read), an over-long sessionID is dropped: the id
+ * is a host identity, not a label, and no real session id exceeds the bound.
+ */
+export declare function isValidSessionID(raw: unknown): raw is string;
+export declare function parseSessionModesPayload(raw: unknown): SessionModeRecord[];

package/dist/state/session-modes/parse.js

@@ -0,0 +1,62 @@
+/**
+ * Read-side parsing for persisted session-mode overrides. Total like every
+ * `state/` parser: it accepts `unknown` and returns typed records, dropping
+ * anything invalid — a corrupted file can never take the plugin down
+ * (ADP-031). A partially corrupted payload keeps its good entries.
+ */
+import { OPERATING_MODES } from "../../core/scheduler/types.js";
+import { MAX_SESSION_ID_LENGTH, SESSION_MODES_VERSION } from "./types.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isFiniteNumber(raw) {
+    return typeof raw === "number" && Number.isFinite(raw);
+}
+/**
+ * A non-empty bounded session identifier. Unlike the health parser's provider
+ * identifiers (truncated on read), an over-long sessionID is dropped: the id
+ * is a host identity, not a label, and no real session id exceeds the bound.
+ */
+export function isValidSessionID(raw) {
+    return typeof raw === "string" && raw.length > 0 && raw.length <= MAX_SESSION_ID_LENGTH;
+}
+function parseSessionID(raw) {
+    return isValidSessionID(raw) ? raw : undefined;
+}
+function parseMode(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    return OPERATING_MODES.includes(raw) ? raw : undefined;
+}
+function parseRecord(raw) {
+    if (!isRecord(raw))
+        return undefined;
+    const sessionID = parseSessionID(raw["sessionID"]);
+    const mode = parseMode(raw["mode"]);
+    const updatedAt = raw["updatedAt"];
+    if (sessionID === undefined || mode === undefined || !isFiniteNumber(updatedAt))
+        return undefined;
+    return { sessionID, mode, updatedAt };
+}
+export function parseSessionModesPayload(raw) {
+    if (!isRecord(raw))
+        return [];
+    if (raw["version"] !== SESSION_MODES_VERSION)
+        return [];
+    const list = raw["records"];
+    if (!Array.isArray(list))
+        return [];
+    // A hostile or duplicated payload can carry the same session twice; the
+    // most recently updated record wins so `get` is not order-dependent.
+    const bySession = new Map();
+    for (const entry of list.slice(0, 512)) {
+        const record = parseRecord(entry);
+        if (record === undefined)
+            continue;
+        const kept = bySession.get(record.sessionID);
+        if (kept === undefined || record.updatedAt > kept.updatedAt)
+            bySession.set(record.sessionID, record);
+    }
+    return [...bySession.values()];
+}
+//# sourceMappingURL=parse.js.map

package/dist/state/session-modes/parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parse.js","sourceRoot":"","sources":["../../../src/state/session-modes/parse.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAE/D,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAGzE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAY;IAC3C,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,qBAAqB,CAAA;AACzF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,OAAO,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAChD,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC7C,OAAQ,eAAqC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAC,SAAS,CAAA;AAClG,CAAC;AAED,SAAS,WAAW,CAAC,GAAY;IAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACpC,MAAM,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAA;IAClD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IACnC,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,CAAA;IAClC,IAAI,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAA;IACjG,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AACvC,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAY;IACnD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAC7B,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,qBAAqB;QAAE,OAAO,EAAE,CAAA;IACvD,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,CAAA;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAA;IACtD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QACjC,IAAI,MAAM,KAAK,SAAS;YAAE,SAAQ;QAClC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC5C,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;YACzD,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC3C,CAAC;IACD,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,CAAA;AAChC,CAAC","sourcesContent":["/**\n * Read-side parsing for persisted session-mode overrides. Total like every\n * `state/` parser: it accepts `unknown` and returns typed records, dropping\n * anything invalid — a corrupted file can never take the plugin down\n * (ADP-031). A partially corrupted payload keeps its good entries.\n */\nimport { OPERATING_MODES } from \"../../core/scheduler/types.js\"\nimport type { OperatingMode } from \"../../core/scheduler/types.js\"\nimport { MAX_SESSION_ID_LENGTH, SESSION_MODES_VERSION } from \"./types.js\"\nimport type { SessionModeRecord } from \"./types.js\"\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction isFiniteNumber(raw: unknown): raw is number {\n  return typeof raw === \"number\" && Number.isFinite(raw)\n}\n\n/**\n * A non-empty bounded session identifier. Unlike the health parser's provider\n * identifiers (truncated on read), an over-long sessionID is dropped: the id\n * is a host identity, not a label, and no real session id exceeds the bound.\n */\nexport function isValidSessionID(raw: unknown): raw is string {\n  return typeof raw === \"string\" && raw.length > 0 && raw.length <= MAX_SESSION_ID_LENGTH\n}\n\nfunction parseSessionID(raw: unknown): string | undefined {\n  return isValidSessionID(raw) ? raw : undefined\n}\n\nfunction parseMode(raw: unknown): OperatingMode | undefined {\n  if (typeof raw !== \"string\") return undefined\n  return (OPERATING_MODES as readonly string[]).includes(raw) ? (raw as OperatingMode) : undefined\n}\n\nfunction parseRecord(raw: unknown): SessionModeRecord | undefined {\n  if (!isRecord(raw)) return undefined\n  const sessionID = parseSessionID(raw[\"sessionID\"])\n  const mode = parseMode(raw[\"mode\"])\n  const updatedAt = raw[\"updatedAt\"]\n  if (sessionID === undefined || mode === undefined || !isFiniteNumber(updatedAt)) return undefined\n  return { sessionID, mode, updatedAt }\n}\n\nexport function parseSessionModesPayload(raw: unknown): SessionModeRecord[] {\n  if (!isRecord(raw)) return []\n  if (raw[\"version\"] !== SESSION_MODES_VERSION) return []\n  const list = raw[\"records\"]\n  if (!Array.isArray(list)) return []\n  // A hostile or duplicated payload can carry the same session twice; the\n  // most recently updated record wins so `get` is not order-dependent.\n  const bySession = new Map<string, SessionModeRecord>()\n  for (const entry of list.slice(0, 512)) {\n    const record = parseRecord(entry)\n    if (record === undefined) continue\n    const kept = bySession.get(record.sessionID)\n    if (kept === undefined || record.updatedAt > kept.updatedAt)\n      bySession.set(record.sessionID, record)\n  }\n  return [...bySession.values()]\n}\n"]}

package/dist/state/session-modes/store.d.ts

@@ -0,0 +1,20 @@
+import type { OperatingMode } from "../../core/scheduler/types.js";
+import type { SessionModeRecord, SessionModesStorage } from "./types.js";
+export declare class SessionModeStore {
+    #private;
+    private readonly storage;
+    private readonly clock;
+    constructor(storage: SessionModesStorage, clock: () => number);
+    /** Rebuild from storage (restart behavior). A read failure yields an empty store. */
+    load(): Promise<void>;
+    /** All retained records. */
+    snapshot(): readonly SessionModeRecord[];
+    /** The session's override, or `null` when it follows the global mode. */
+    get(sessionID: string): OperatingMode | null;
+    /**
+     * Set (or with `null`, remove) one session's override. The bound keeps the
+     * most recently updated records — overrides for long-gone sessions matter
+     * less than the ones being actively steered.
+     */
+    set(sessionID: string, mode: OperatingMode | null): Promise<void>;
+}

package/dist/state/session-modes/store.js

@@ -0,0 +1,87 @@
+/**
+ * Bounded per-session operating-mode override store. Keeps the most recently
+ * updated records (bounded, least-recently-updated evicted) and persists on
+ * every change. As everywhere else in `state/`, memory is only advanced after
+ * a successful write, so memory and disk never diverge; write failures
+ * propagate to the caller — the wiring layer's fail-open wrapper decides how
+ * to degrade (ADP-031).
+ */
+import { parseSessionModesPayload, isValidSessionID } from "./parse.js";
+import { MAX_SESSION_ID_LENGTH, MAX_SESSION_MODE_RECORDS, SESSION_MODES_VERSION } from "./types.js";
+import { OPERATING_MODES } from "../../core/scheduler/types.js";
+export class SessionModeStore {
+    storage;
+    clock;
+    #records = [];
+    #queue = Promise.resolve();
+    constructor(storage, clock) {
+        this.storage = storage;
+        this.clock = clock;
+    }
+    /** Rebuild from storage (restart behavior). A read failure yields an empty store. */
+    load() {
+        return this.#serialize(() => this.#load());
+    }
+    async #load() {
+        let raw;
+        try {
+            raw = await this.storage.read();
+        }
+        catch {
+            this.#records = [];
+            return;
+        }
+        this.#records = parseSessionModesPayload(raw);
+    }
+    /** All retained records. */
+    snapshot() {
+        return this.#records;
+    }
+    /** The session's override, or `null` when it follows the global mode. */
+    get(sessionID) {
+        return this.#records.find((record) => record.sessionID === sessionID)?.mode ?? null;
+    }
+    /**
+     * Set (or with `null`, remove) one session's override. The bound keeps the
+     * most recently updated records — overrides for long-gone sessions matter
+     * less than the ones being actively steered.
+     */
+    async set(sessionID, mode) {
+        // Defensive re-validation at the persistence boundary: the RPC handler
+        // validates first and reports named errors; these guards keep malformed
+        // in-process callers from persisting junk.
+        if (!isValidSessionID(sessionID)) {
+            throw new Error(`sessionID must be a non-empty string of at most ${String(MAX_SESSION_ID_LENGTH)} characters`);
+        }
+        if (mode !== null && !OPERATING_MODES.includes(mode)) {
+            throw new Error(`mode must be one of ${OPERATING_MODES.join(", ")} or null`);
+        }
+        return this.#serialize(() => this.#set(sessionID, mode));
+    }
+    async #set(sessionID, mode) {
+        const updatedAt = this.clock();
+        const kept = this.#records.filter((record) => record.sessionID !== sessionID);
+        const next = mode === null
+            ? kept
+            : bound([...kept, { sessionID, mode, updatedAt }], MAX_SESSION_MODE_RECORDS);
+        // Persist BEFORE committing memory: a write failure must leave memory
+        // and disk consistent (the caller decides how to fail open).
+        const payload = { version: SESSION_MODES_VERSION, records: next };
+        await this.storage.write(payload);
+        this.#records = next;
+    }
+    // Reloads share the mutation queue so stale reads cannot overwrite commits.
+    // Recover only the queue tail: the failed operation still rejects its caller.
+    #serialize(operation) {
+        const run = this.#queue.then(operation);
+        this.#queue = run.catch(() => undefined);
+        return run;
+    }
+}
+/** Keep the newest records when over the cap. */
+function bound(records, max) {
+    if (records.length <= max)
+        return records;
+    return [...records].sort((left, right) => right.updatedAt - left.updatedAt).slice(0, max);
+}
+//# sourceMappingURL=store.js.map

package/dist/state/session-modes/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/state/session-modes/store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAGnG,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAE/D,MAAM,OAAO,gBAAgB;IAKR;IACA;IALnB,QAAQ,GAAwB,EAAE,CAAA;IAClC,MAAM,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;IAEzC,YACmB,OAA4B,EAC5B,KAAmB;QADnB,YAAO,GAAP,OAAO,CAAqB;QAC5B,UAAK,GAAL,KAAK,CAAc;IACnC,CAAC;IAEJ,qFAAqF;IACrF,IAAI;QACF,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,GAAY,CAAA;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAA;YAClB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAA;IAC/C,CAAC;IAED,4BAA4B;IAC5B,QAAQ;QACN,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,yEAAyE;IACzE,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,IAAI,IAAI,IAAI,CAAA;IACrF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,IAA0B;QACrD,uEAAuE;QACvE,wEAAwE;QACxE,2CAA2C;QAC3C,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,CAAC,qBAAqB,CAAC,aAAa,CAC9F,CAAA;QACH,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAE,eAAqC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,uBAAuB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAC9E,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;IAC1D,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,SAAiB,EAAE,IAA0B;QACtD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAA;QAC7E,MAAM,IAAI,GACR,IAAI,KAAK,IAAI;YACX,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,wBAAwB,CAAC,CAAA;QAChF,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,OAAO,GAAwB,EAAE,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QACtF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAA;IACtB,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,UAAU,CAAC,SAA8B;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACxC,OAAO,GAAG,CAAA;IACZ,CAAC;CACF;AAED,iDAAiD;AACjD,SAAS,KAAK,CAAC,OAA4B,EAAE,GAAW;IACtD,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,OAAO,CAAA;IACzC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AAC3F,CAAC","sourcesContent":["/**\n * Bounded per-session operating-mode override store. Keeps the most recently\n * updated records (bounded, least-recently-updated evicted) and persists on\n * every change. As everywhere else in `state/`, memory is only advanced after\n * a successful write, so memory and disk never diverge; write failures\n * propagate to the caller — the wiring layer's fail-open wrapper decides how\n * to degrade (ADP-031).\n */\nimport { parseSessionModesPayload, isValidSessionID } from \"./parse.js\"\nimport { MAX_SESSION_ID_LENGTH, MAX_SESSION_MODE_RECORDS, SESSION_MODES_VERSION } from \"./types.js\"\nimport type { OperatingMode } from \"../../core/scheduler/types.js\"\nimport type { SessionModeRecord, SessionModesPayload, SessionModesStorage } from \"./types.js\"\nimport { OPERATING_MODES } from \"../../core/scheduler/types.js\"\n\nexport class SessionModeStore {\n  #records: SessionModeRecord[] = []\n  #queue: Promise<void> = Promise.resolve()\n\n  constructor(\n    private readonly storage: SessionModesStorage,\n    private readonly clock: () => number,\n  ) {}\n\n  /** Rebuild from storage (restart behavior). A read failure yields an empty store. */\n  load(): Promise<void> {\n    return this.#serialize(() => this.#load())\n  }\n\n  async #load(): Promise<void> {\n    let raw: unknown\n    try {\n      raw = await this.storage.read()\n    } catch {\n      this.#records = []\n      return\n    }\n    this.#records = parseSessionModesPayload(raw)\n  }\n\n  /** All retained records. */\n  snapshot(): readonly SessionModeRecord[] {\n    return this.#records\n  }\n\n  /** The session's override, or `null` when it follows the global mode. */\n  get(sessionID: string): OperatingMode | null {\n    return this.#records.find((record) => record.sessionID === sessionID)?.mode ?? null\n  }\n\n  /**\n   * Set (or with `null`, remove) one session's override. The bound keeps the\n   * most recently updated records — overrides for long-gone sessions matter\n   * less than the ones being actively steered.\n   */\n  async set(sessionID: string, mode: OperatingMode | null): Promise<void> {\n    // Defensive re-validation at the persistence boundary: the RPC handler\n    // validates first and reports named errors; these guards keep malformed\n    // in-process callers from persisting junk.\n    if (!isValidSessionID(sessionID)) {\n      throw new Error(\n        `sessionID must be a non-empty string of at most ${String(MAX_SESSION_ID_LENGTH)} characters`,\n      )\n    }\n    if (mode !== null && !(OPERATING_MODES as readonly string[]).includes(mode)) {\n      throw new Error(`mode must be one of ${OPERATING_MODES.join(\", \")} or null`)\n    }\n    return this.#serialize(() => this.#set(sessionID, mode))\n  }\n\n  async #set(sessionID: string, mode: OperatingMode | null): Promise<void> {\n    const updatedAt = this.clock()\n    const kept = this.#records.filter((record) => record.sessionID !== sessionID)\n    const next =\n      mode === null\n        ? kept\n        : bound([...kept, { sessionID, mode, updatedAt }], MAX_SESSION_MODE_RECORDS)\n    // Persist BEFORE committing memory: a write failure must leave memory\n    // and disk consistent (the caller decides how to fail open).\n    const payload: SessionModesPayload = { version: SESSION_MODES_VERSION, records: next }\n    await this.storage.write(payload)\n    this.#records = next\n  }\n\n  // Reloads share the mutation queue so stale reads cannot overwrite commits.\n  // Recover only the queue tail: the failed operation still rejects its caller.\n  #serialize(operation: () => Promise<void>): Promise<void> {\n    const run = this.#queue.then(operation)\n    this.#queue = run.catch(() => undefined)\n    return run\n  }\n}\n\n/** Keep the newest records when over the cap. */\nfunction bound(records: SessionModeRecord[], max: number): SessionModeRecord[] {\n  if (records.length <= max) return records\n  return [...records].sort((left, right) => right.updatedAt - left.updatedAt).slice(0, max)\n}\n"]}

package/dist/state/session-modes/types.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Persisted per-session operating-mode overrides (ADP-054). The operating mode
+ * is otherwise a global setting, but supervision decisions are made per
+ * session — the override lets one session run under a different mode without
+ * touching the global default. Records persist through the storage seam like
+ * every other state: the host's TUI-mode plugin reconciliation can serve RPC
+ * from an instance whose event-pump hooks live on another instance, and a
+ * restart must not silently drop explicit user intent.
+ */
+import type { OperatingMode } from "../../core/scheduler/types.js";
+export declare const SESSION_MODES_KEY = "coool.adaptive/session-modes";
+export declare const SESSION_MODES_VERSION = 1;
+/** Product bound — not a user knob. Keeps the most recently updated records. */
+export declare const MAX_SESSION_MODE_RECORDS = 512;
+/** A session id beyond this bound is not a real host identifier. */
+export declare const MAX_SESSION_ID_LENGTH = 128;
+export interface SessionModeRecord {
+    readonly sessionID: string;
+    readonly mode: OperatingMode;
+    readonly updatedAt: number;
+}
+export interface SessionModesPayload {
+    readonly version: typeof SESSION_MODES_VERSION;
+    readonly records: readonly SessionModeRecord[];
+}
+/**
+ * A successful override write. Mirrors the settings patch-result convention:
+ * validation failures are per-field errors, internal failures throw (the
+ * RPC handler degrades them fail-open).
+ */
+export type SessionModeSetResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly errors: readonly string[];
+};
+/** Storage seam — the adapter binds `SESSION_MODES_KEY` to `ctx.storage`. */
+export interface SessionModesStorage {
+    read(): Promise<unknown>;
+    write(payload: SessionModesPayload): Promise<void>;
+}

package/dist/state/session-modes/types.js

@@ -0,0 +1,7 @@
+export const SESSION_MODES_KEY = "coool.adaptive/session-modes";
+export const SESSION_MODES_VERSION = 1;
+/** Product bound — not a user knob. Keeps the most recently updated records. */
+export const MAX_SESSION_MODE_RECORDS = 512;
+/** A session id beyond this bound is not a real host identifier. */
+export const MAX_SESSION_ID_LENGTH = 128;
+//# sourceMappingURL=types.js.map

package/dist/state/session-modes/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/state/session-modes/types.ts"],"names":[],"mappings":"AAWA,MAAM,CAAC,MAAM,iBAAiB,GAAG,8BAA8B,CAAA;AAC/D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAA;AACtC,gFAAgF;AAChF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAC3C,oEAAoE;AACpE,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAA","sourcesContent":["/**\n * Persisted per-session operating-mode overrides (ADP-054). The operating mode\n * is otherwise a global setting, but supervision decisions are made per\n * session — the override lets one session run under a different mode without\n * touching the global default. Records persist through the storage seam like\n * every other state: the host's TUI-mode plugin reconciliation can serve RPC\n * from an instance whose event-pump hooks live on another instance, and a\n * restart must not silently drop explicit user intent.\n */\nimport type { OperatingMode } from \"../../core/scheduler/types.js\"\n\nexport const SESSION_MODES_KEY = \"coool.adaptive/session-modes\"\nexport const SESSION_MODES_VERSION = 1\n/** Product bound — not a user knob. Keeps the most recently updated records. */\nexport const MAX_SESSION_MODE_RECORDS = 512\n/** A session id beyond this bound is not a real host identifier. */\nexport const MAX_SESSION_ID_LENGTH = 128\n\nexport interface SessionModeRecord {\n  readonly sessionID: string\n  readonly mode: OperatingMode\n  readonly updatedAt: number\n}\n\nexport interface SessionModesPayload {\n  readonly version: typeof SESSION_MODES_VERSION\n  readonly records: readonly SessionModeRecord[]\n}\n\n/**\n * A successful override write. Mirrors the settings patch-result convention:\n * validation failures are per-field errors, internal failures throw (the\n * RPC handler degrades them fail-open).\n */\nexport type SessionModeSetResult =\n  { readonly ok: true } | { readonly ok: false; readonly errors: readonly string[] }\n\n/** Storage seam — the adapter binds `SESSION_MODES_KEY` to `ctx.storage`. */\nexport interface SessionModesStorage {\n  read(): Promise<unknown>\n  write(payload: SessionModesPayload): Promise<void>\n}\n"]}

package/dist/state/settings/index.d.ts

@@ -0,0 +1,4 @@
+export { defaultSettings, applyPatch, migrateSettings, parseAgentTiers, parseMode, parsePin, parseTierLists, } from "./parse.js";
+export { SettingsStore } from "./store.js";
+export { MAX_AGENT_TIERS, MAX_TIER_RESOURCES, SETTINGS_KEY, SETTINGS_VERSION } from "./types.js";
+export type { PatchResult, SettingsPatch, SettingsStorage, SettingsV1 } from "./types.js";

package/dist/state/settings/index.js

@@ -0,0 +1,4 @@
+export { defaultSettings, applyPatch, migrateSettings, parseAgentTiers, parseMode, parsePin, parseTierLists, } from "./parse.js";
+export { SettingsStore } from "./store.js";
+export { MAX_AGENT_TIERS, MAX_TIER_RESOURCES, SETTINGS_KEY, SETTINGS_VERSION } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/state/settings/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/state/settings/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,UAAU,EACV,eAAe,EACf,eAAe,EACf,SAAS,EACT,QAAQ,EACR,cAAc,GACf,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA","sourcesContent":["export {\n  defaultSettings,\n  applyPatch,\n  migrateSettings,\n  parseAgentTiers,\n  parseMode,\n  parsePin,\n  parseTierLists,\n} from \"./parse.js\"\nexport { SettingsStore } from \"./store.js\"\nexport { MAX_AGENT_TIERS, MAX_TIER_RESOURCES, SETTINGS_KEY, SETTINGS_VERSION } from \"./types.js\"\nexport type { PatchResult, SettingsPatch, SettingsStorage, SettingsV1 } from \"./types.js\"\n"]}

package/dist/state/settings/parse.d.ts

@@ -0,0 +1,33 @@
+import type { OperatingMode } from "../../core/scheduler/types.js";
+import type { TierName } from "../../core/tier-policy/types.js";
+import type { ModelRef } from "../../core/work-unit/types.js";
+import type { SettingsV1 } from "./types.js";
+export declare function parseMode(raw: unknown): OperatingMode | undefined;
+export declare function parseTierLists(raw: unknown): Readonly<Record<TierName, readonly ModelRef[]>> | undefined;
+export declare function parseModelRef(raw: unknown): ModelRef | undefined;
+export declare function parsePin(raw: unknown): ModelRef | null | undefined;
+export declare function parseAgentTiers(raw: unknown): Readonly<Record<string, TierName>> | undefined;
+/** Settings with nothing configured: OBSERVE, empty tiers, no pin (ADP-029/032). */
+export declare function defaultSettings(): SettingsV1;
+/**
+ * Migration-on-read. `undefined`/absent record → defaults (first install);
+ * versionless (v0 draft) and v1 records are validated field-wise with
+ * defaults for unusable fields; a record written by a NEWER version is
+ * returned as defaults rather than guessed at (and is only re-persisted once
+ * the user changes something, which stamps the current version).
+ */
+export declare function migrateSettings(raw: unknown): SettingsV1;
+/**
+ * Validate a patch against current settings. The patch is WIRE input (unknown
+ * by contract — surfaces send untrusted JSON over RPC; the SettingsPatch type
+ * documents the expected shape, the field parsers enforce it). Invalid fields
+ * collect error strings (at most one per field, five fields); a valid patch
+ * produces a NEW settings object (inputs are never mutated).
+ */
+export declare function applyPatch(current: SettingsV1, patch: unknown): {
+    ok: true;
+    settings: SettingsV1;
+} | {
+    ok: false;
+    errors: string[];
+};

package/dist/state/settings/parse.js

@@ -0,0 +1,261 @@
+/**
+ * Bounded shape validation and migration-on-read (ADP-036). Every parser is
+ * total: it accepts `unknown` and either returns a typed value or `undefined`
+ * — the read path always falls back to a default rather than throwing, so a
+ * corrupted record can never take the plugin (or the host) down (ADP-031).
+ *
+ * Plain objects are never indexed with untrusted strings beyond own-property
+ * checks (`Object.hasOwn`) — prototype-chain keys like "toString" must not be
+ * mistaken for data (project-wide audit rule).
+ */
+import { OPERATING_MODES } from "../../core/scheduler/types.js";
+import { normalizeTierList } from "../../core/tier-policy/tier-list.js";
+import { TIERS } from "../../core/tier-policy/types.js";
+import { MAX_AGENT_TIERS, MAX_TIER_RESOURCES, SETTINGS_VERSION } from "./types.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+ * Quoted, bounded rendering of an untrusted patch value inside an error
+ * message (errors travel to surfaces over RPC; JSON.stringify is only ever
+ * called on strings here, so a cyclic object cannot make applyPatch throw).
+ */
+function describePatchValue(value) {
+    if (typeof value === "string") {
+        const quoted = JSON.stringify(value);
+        return quoted.length > 64 ? `${quoted.slice(0, 64)}…` : quoted;
+    }
+    if (value === null)
+        return "null";
+    if (typeof value === "object")
+        return "object";
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    return typeof value;
+}
+export function parseMode(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    return OPERATING_MODES.find((mode) => mode === raw);
+}
+/**
+ * Legacy persisted value: v1 settings written before the `control → active`
+ * rename store `mode: "control"`. Migration-on-read maps it; patches stay
+ * strict (wire input must use the current vocabulary).
+ */
+function parseLegacyMode(raw) {
+    return raw === "control" ? "active" : parseMode(raw);
+}
+export function parseTierLists(raw) {
+    if (!isRecord(raw))
+        return undefined;
+    const tiers = {};
+    for (const tier of TIERS) {
+        tiers[tier] = normalizeTierListValue(raw[tier]);
+    }
+    return tiers;
+}
+/** Shared per-tier normalization (drop invalid, dedupe, cap) for both paths. */
+function normalizeTierListValue(list) {
+    return Array.isArray(list)
+        ? normalizeTierList(list.map(parseModelRef).filter((ref) => ref !== undefined)).slice(0, MAX_TIER_RESOURCES)
+        : [];
+}
+export function parseModelRef(raw) {
+    if (!isRecord(raw))
+        return undefined;
+    const providerID = raw["providerID"];
+    const id = raw["id"];
+    const variant = raw["variant"];
+    if (typeof providerID !== "string" || providerID === "")
+        return undefined;
+    if (typeof id !== "string" || id === "")
+        return undefined;
+    return {
+        providerID,
+        id,
+        ...(typeof variant === "string" && variant !== "" ? { variant } : {}),
+    };
+}
+export function parsePin(raw) {
+    if (raw === null)
+        return null;
+    return parseModelRef(raw);
+}
+export function parseAgentTiers(raw) {
+    if (!isRecord(raw))
+        return undefined;
+    const entries = [];
+    for (const [agent, tier] of Object.entries(raw)) {
+        if (agent === "")
+            continue;
+        const parsed = parseModelessTier(tier);
+        if (parsed === undefined)
+            continue;
+        entries.push([agent, parsed]);
+        if (entries.length === MAX_AGENT_TIERS)
+            break;
+    }
+    // `Object.fromEntries` creates own data properties, so even a "__proto__"
+    // key from JSON input cannot pollute the prototype here.
+    return Object.fromEntries(entries);
+}
+function parseModelessTier(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    return TIERS.find((tier) => tier === raw);
+}
+/**
+ * Patch-path tier-list validation. Unlike the read path (which fills missing
+ * or unusable tiers with `[]`), a patch that names `tiers` REPLACES the whole
+ * map — silently filling an omitted key with `[]` would wipe that tier's
+ * configured resources, so every key must be present and array-typed. List
+ * contents still go through the shared normalization (drop invalid, dedupe,
+ * cap), which is repair of user-typed entries rather than data loss.
+ */
+function parseTierListsPatch(raw) {
+    if (!isRecord(raw))
+        return { ok: false, error: "invalid tiers" };
+    const missing = TIERS.filter((tier) => raw[tier] === undefined);
+    if (missing.length > 0) {
+        const named = missing.map((tier) => JSON.stringify(tier)).join(", ");
+        return { ok: false, error: `invalid tiers: missing ${named}` };
+    }
+    const tiers = {};
+    for (const tier of TIERS) {
+        const list = raw[tier];
+        if (!Array.isArray(list)) {
+            return { ok: false, error: `invalid tiers: ${JSON.stringify(tier)} must be an array` };
+        }
+        tiers[tier] = normalizeTierListValue(list);
+    }
+    return { ok: true, value: tiers };
+}
+/**
+ * Patch-path agent-tier validation. Unlike the read path (which drops invalid
+ * entries as migration-on-read repair), a patch REPLACES the whole map —
+ * silently dropping entries would let a single typo wipe the persisted hints,
+ * so any invalid entry (and an over-cap patch) is rejected with an error that
+ * names the offending field and value.
+ */
+function parseAgentTiersPatch(raw) {
+    if (!isRecord(raw))
+        return { ok: false, error: "invalid agentTiers" };
+    const entries = [];
+    for (const [agent, tier] of Object.entries(raw)) {
+        if (entries.length === MAX_AGENT_TIERS) {
+            return {
+                ok: false,
+                error: `invalid agentTiers: more than ${String(MAX_AGENT_TIERS)} entries`,
+            };
+        }
+        if (agent === "")
+            return { ok: false, error: "invalid agentTiers: empty agent name" };
+        const parsed = parseModelessTier(tier);
+        if (parsed === undefined) {
+            return {
+                ok: false,
+                error: `invalid agentTiers entry ${describePatchValue(agent)}: ${describePatchValue(tier)}`,
+            };
+        }
+        entries.push([agent, parsed]);
+    }
+    // `Object.fromEntries` creates own data properties, so even a "__proto__"
+    // key from JSON input cannot pollute the prototype here.
+    return { ok: true, value: Object.fromEntries(entries) };
+}
+/** Settings with nothing configured: OBSERVE, empty tiers, no pin (ADP-029/032). */
+export function defaultSettings() {
+    return {
+        version: SETTINGS_VERSION,
+        mode: "observe",
+        tiers: { quick: [], standard: [], advanced: [] },
+        pin: null,
+        agentTiers: {},
+        inviteDismissed: false,
+    };
+}
+/**
+ * Migration-on-read. `undefined`/absent record → defaults (first install);
+ * versionless (v0 draft) and v1 records are validated field-wise with
+ * defaults for unusable fields; a record written by a NEWER version is
+ * returned as defaults rather than guessed at (and is only re-persisted once
+ * the user changes something, which stamps the current version).
+ */
+export function migrateSettings(raw) {
+    if (!isRecord(raw))
+        return defaultSettings();
+    const version = raw["version"];
+    if (version !== SETTINGS_VERSION && version !== 0 && version !== undefined) {
+        return defaultSettings();
+    }
+    return fieldsFrom(raw);
+}
+function fieldsFrom(raw) {
+    const mode = parseLegacyMode(raw["mode"]) ?? "observe";
+    const tiers = parseTierLists(raw["tiers"]) ?? defaultSettings().tiers;
+    const pin = parsePin(raw["pin"]) ?? null;
+    const agentTiers = parseAgentTiers(raw["agentTiers"]) ?? {};
+    const inviteDismissed = raw["inviteDismissed"] === true;
+    return { version: SETTINGS_VERSION, mode, tiers, pin, agentTiers, inviteDismissed };
+}
+/**
+ * Validate a patch against current settings. The patch is WIRE input (unknown
+ * by contract — surfaces send untrusted JSON over RPC; the SettingsPatch type
+ * documents the expected shape, the field parsers enforce it). Invalid fields
+ * collect error strings (at most one per field, five fields); a valid patch
+ * produces a NEW settings object (inputs are never mutated).
+ */
+export function applyPatch(current, patch) {
+    if (!isRecord(patch))
+        return { ok: false, errors: ["invalid patch"] };
+    const request = patch;
+    const errors = [];
+    let mode = current.mode;
+    let tiers = current.tiers;
+    let pin = current.pin;
+    let agentTiers = current.agentTiers;
+    let inviteDismissed = current.inviteDismissed;
+    if (request.mode !== undefined) {
+        const parsed = parseMode(request.mode);
+        if (parsed === undefined)
+            errors.push("invalid mode");
+        else
+            mode = parsed;
+    }
+    if (request.tiers !== undefined) {
+        const parsed = parseTierListsPatch(request.tiers);
+        if (parsed.ok)
+            tiers = parsed.value;
+        else
+            errors.push(parsed.error);
+    }
+    // `pin === null` is a meaningful clear and must not read as absence.
+    if (request.pin !== undefined) {
+        const parsed = parsePin(request.pin);
+        if (parsed === undefined)
+            errors.push("invalid pin");
+        else
+            pin = parsed;
+    }
+    if (request.agentTiers !== undefined) {
+        const parsed = parseAgentTiersPatch(request.agentTiers);
+        if (parsed.ok)
+            agentTiers = parsed.value;
+        else
+            errors.push(parsed.error);
+    }
+    if (request.inviteDismissed !== undefined) {
+        if (typeof request.inviteDismissed !== "boolean")
+            errors.push("invalid inviteDismissed");
+        else
+            inviteDismissed = request.inviteDismissed;
+    }
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return {
+        ok: true,
+        settings: { version: SETTINGS_VERSION, mode, tiers, pin, agentTiers, inviteDismissed },
+    };
+}
+//# sourceMappingURL=parse.js.map