@danypops/pi-packed 0.5.2 → 0.6.0

package/src/catalog.ts

@@ -1,64 +0,0 @@
-/**
- * catalog.ts — the sync pipeline (apt update / pkg update analog).
- * Paginates the upstream registry into the local SQLite mirror and records
- * sync metadata (the Release/repomd checksum role) in sync_meta.
- */
-import type { Pkg, Registry } from "./ports.ts";
-import { PI_PACKAGE_KEYWORD } from "./constants.ts";
-import { openDb, replaceAll, getSyncMeta, dbPath } from "./db.ts";
-import { createLogger } from "./log.ts";
-
-const log = createLogger("catalog");
-import type { SyncMeta } from "./db.ts";
-
-export interface CatalogStatus {
-	stale: boolean;
-	meta?: SyncMeta;
-}
-
-export function catalogStatus(dir: string, ttlMs: number): CatalogStatus {
-	const db = openDb(dbPath(dir));
-	try {
-		const meta = getSyncMeta(db);
-		if (!meta) return { stale: true };
-		return { stale: Date.now() - Date.parse(meta.fetchedAt) > ttlMs, meta };
-	} finally {
-		db.close();
-	}
-}
-
-/** Full mirror sync: upstream pages → atomic SQLite replace. */
-export async function syncCatalog(reg: Registry, dir: string, query: string = PI_PACKAGE_KEYWORD): Promise<number> {
-	const t0 = Date.now();
-	log.info("mirror sync started", { query });
-	const packages = await reg.searchAll(query);
-	const db = openDb(dbPath(dir));
-	try {
-		replaceAll(db, packages, "npm:" + query);
-		log.info("mirror sync complete", { packages: packages.length, ms: Date.now() - t0 });
-		return packages.length;
-	} finally {
-		db.close();
-	}
-}
-
-export function startCatalogSync(
-	reg: Registry,
-	dir: string,
-	ttlMs: number,
-	onError?: (e: unknown) => void,
-): () => void {
-	async function sync(): Promise<void> {
-		try {
-			if (catalogStatus(dir, ttlMs).stale) {
-				const n = await syncCatalog(reg, dir);
-				log.info("scheduled sync complete", { packages: n });
-			}
-		} catch (e) {
-			onError?.(e);
-		}
-	}
-	void sync();
-	const timer = setInterval(() => void sync(), ttlMs);
-	return () => clearInterval(timer);
-}

package/src/cli.ts

@@ -1,374 +0,0 @@
-#!/usr/bin/env bun
-/**
- * cli.ts — second driving adapter (humans drive the same hexagon ports).
- * cliRun is pure: ({code, out}) in, no I/O — the entry point prints.
- * Command table follows the go-tool/Cobra convention; flags may appear
- * anywhere (agents put them anywhere).
- */
-import { buildSearchQuery, clampLimit } from "./ports.ts";
-import type { Installer, Registry } from "./ports.ts";
-import { npmPackageName, readInstalledPackages } from "./installed.ts";
-import { checkUpdates } from "./watcher.ts";
-import { syncCatalog } from "./catalog.ts";
-import { openDb, searchLocal, catalogList, getSyncMeta, latestVersion, dbPath } from "./db.ts";
-import { NAME_RE, defaultPiBin } from "./install.ts";
-import {
-	assertPackagePermission,
-	type MutationApproval,
-	type PackageOperation,
-	type SecuritySettingsPort,
-} from "./security.ts";
-
-function defaultPiBinForUnit(): string | undefined {
-	const b = defaultPiBin();
-	return b === "pi" ? undefined : b; // bare name needs no pin
-}
-import {
-	SEARCH_DEFAULT_LIMIT, SEARCH_MAX_LIMIT, NPM_REGISTRY_BASE, SEARCH_PAGE_SIZE, MIRROR_PAGE_DELAY_MS,
-} from "./constants.ts";
-import { VERSION } from "./version.ts";
-
-const SOURCE_RE = /^(npm:[A-Za-z0-9@._/-]+|git:[A-Za-z0-9@:._/-]+|https:\/\/[A-Za-z0-9@:._/?=&%~-]+)$/;
-
-const USAGE = `packed — package service for the Pi agent
-
-usage:
-  packed search <query> [--offline] [--json]   search npm (or the local mirror with --offline)
-  packed info <name> [--json]                  package details
-  packed updates [--json]                      updates per the local mirror
-  packed update <source> [--approve] [--json]  update one configured package through Pi
-  packed mirror [--json]                       sync upstream into the local SQLite index
-  packed installed [--json]                    installed pi packages
-  packed catalog [--json]                      local package index (apt-cache stats)
-  packed install <source> [--approve] [--json] pi install npm:|git:|https://… via daemon
-  packed remove <name> [--approve] [--json]    remove by bare npm name via daemon
-  packed security [always|never] [--approve] [--json] read or set mutation approval policy
-  packed serve                                 run the long-running daemon
-  packed service                               print a systemd user unit
-  packed version                               print version
-`;
-
-export interface CliDeps {
-	reg: Registry;
-	inst: Installer;
-	security: SecuritySettingsPort;
-	stateDir: string;
-	piHome: string;
-	execPath?: string; // bun binary (defaults to process.execPath)
-	cliPath?: string; // this CLI's entry file (for the systemd unit)
-	piBin?: string; // pi binary path to pin into the unit's Environment
-}
-
-export interface CliResult {
-	code: number;
-	out: string;
-}
-
-interface Flags {
-	json: boolean;
-	limit: number;
-	cached: boolean;
-	offline: boolean;
-	approved: boolean;
-}
-
-function parseFlags(rest: string[]): { flags: Flags; pos: string[] } {
-	const flags: Flags = { json: false, limit: SEARCH_DEFAULT_LIMIT, cached: false, offline: false, approved: false };
-	const pos: string[] = [];
-	for (let i = 0; i < rest.length; i++) {
-		const a = rest[i]!;
-		if (a === "--json") flags.json = true;
-		else if (a === "--cached") flags.cached = true;
-		else if (a === "--offline") flags.offline = true;
-		else if (a === "--approve") flags.approved = true;
-		else if (a === "--limit" && i + 1 < rest.length) flags.limit = Number(rest[++i]) || SEARCH_DEFAULT_LIMIT;
-		else if (a.startsWith("--limit=")) flags.limit = Number(a.slice(8)) || SEARCH_DEFAULT_LIMIT;
-		else pos.push(a);
-	}
-	return { flags, pos };
-}
-
-type Command = (rest: string[], d: CliDeps, flags: Flags, pos: string[]) => Promise<CliResult>;
-
-const ok = (out: string): CliResult => ({ code: 0, out });
-const fail = (out: string, code = 1): CliResult => ({ code, out });
-const usageErr = (out: string): CliResult => ({ code: 2, out });
-
-const PACKAGE_COMMAND_OPERATIONS: Record<string, PackageOperation | undefined> = {
-	search: "search",
-	info: "info",
-	installed: "installed",
-	catalog: "catalog",
-	updates: "updates",
-	update: "update",
-	mirror: "mirror",
-	install: "install",
-	remove: "remove",
-};
-
-const commands: Record<string, { usage: string; run: Command }> = {
-	search: {
-		usage: "packed search <query> [--offline] [--limit N] [--json]",
-		async run(_rest, d, flags, pos) {
-			const q = pos[0];
-			if (!q) return usageErr(`usage: ${commands["search"]!.usage}\n`);
-			const limit = clampLimit(flags.limit, SEARCH_DEFAULT_LIMIT, SEARCH_MAX_LIMIT);
-			// --offline: query the SQLite mirror only (apt-cache search analog)
-			if (flags.offline) {
-				const db = openDb(dbPath(d.stateDir));
-				try {
-					const results = searchLocal(db, q, limit);
-					if (flags.json) return ok(JSON.stringify({ query: q, total: results.length, results, offline: true }) + "\n");
-					if (results.length === 0) return ok(`no mirrored packages match "${q}" (run: packed mirror)\n`);
-					let out = `${results.length} mirrored package(s):\n\n`;
-					for (const p of results) out += `  ${p.name}@${p.version}\n    ${p.description ?? ""}\n`;
-					return ok(out);
-				} finally {
-					db.close();
-				}
-			}
-			const { results, total } = await d.reg.search(buildSearchQuery(q), limit);
-			if (flags.json) return ok(JSON.stringify({ query: q, total, results }) + "\n");
-			if (results.length === 0) return ok(`no pi packages found for "${q}"\n`);
-			let out = `${total} package(s) (showing ${results.length}):\n\n`;
-			for (const p of results) out += `  ${p.name}@${p.version}\n    ${p.description ?? ""}\n`;
-			return ok(out);
-		},
-	},
-
-	mirror: {
-		usage: "packed mirror [--json]  (sync the upstream registry into the local SQLite index — the apt update analog)",
-		async run(_rest, d, flags) {
-			const n = await syncCatalog(d.reg, d.stateDir);
-			if (flags.json) return ok(JSON.stringify({ synced: n }) + "\n");
-			return ok(`mirrored ${n} packages into the local index\n`);
-		},
-	},
-
-	info: {
-		usage: "packed info <name> [--json]",
-		async run(_rest, d, flags, pos) {
-			const name = pos[0];
-			if (!name) return usageErr(`usage: ${commands["info"]!.usage}\n`);
-			const info = await d.reg.info(name);
-			if (flags.json) return ok(JSON.stringify(info) + "\n");
-			let out = `${info.name}@${info.version}\n${info.description ?? ""}\n`;
-			if (info.repository) out += `repo: ${info.repository}\n`;
-			if (info.pi) out += `provides: ${Object.keys(info.pi).join(", ")}\n`;
-			return ok(out);
-		},
-	},
-
-	updates: {
-		usage: "packed updates [--json]  (from the local mirror — run `packed mirror` first)",
-		async run(_rest, d, flags) {
-			const db = openDb(dbPath(d.stateDir));
-			let updates;
-			try {
-				updates = checkUpdates((name) => latestVersion(db, name), readInstalledPackages(d.piHome));
-			} finally {
-				db.close();
-			}
-			if (flags.json) {
-				return ok(JSON.stringify({ checkedAt: new Date().toISOString(), updates }) + "\n");
-			}
-			if (updates.length === 0) return ok("all pi packages up to date (per the local mirror)\n");
-			let out = `${updates.length} update(s) available:\n\n`;
-			for (const u of updates) out += `  ${u.name}  ${u.installed} → ${u.latest}\n`;
-			return ok(out + "\nrun: pi update --extensions\n");
-		},
-	},
-
-	installed: {
-		usage: "packed installed [--json]",
-		async run(_rest, d, flags) {
-			const installed = readInstalledPackages(d.piHome);
-			if (flags.json) return ok(JSON.stringify(installed) + "\n");
-			return ok(installed.map((p) => `  ${p.name}@${p.pinned ?? p.installed ?? "?"}\n`).join(""));
-		},
-	},
-
-	catalog: {
-		usage: "packed catalog [--json]",
-		async run(_rest, d, flags) {
-			const db = openDb(dbPath(d.stateDir));
-			try {
-				const meta = getSyncMeta(db);
-				const packages = catalogList(db);
-				if (flags.json) {
-					return ok(JSON.stringify({ fetchedAt: meta?.fetchedAt, sha256: meta?.sha256, packages }) + "\n");
-				}
-				let out = `${packages.length} packages in the local index`;
-				if (meta) out += ` (synced ${meta.fetchedAt}, sha256:${meta.sha256.slice(0, 12)}…)`;
-				out += "\n\n";
-				for (const p of packages.slice(0, 50)) out += `  ${p.name}@${p.version}\n`;
-				return ok(out);
-			} finally {
-				db.close();
-			}
-		},
-	},
-
-	install: {
-		usage: "packed install npm:<pkg>[@ver] | git:<host>/<owner>/<repo>[@ref] | https://… [--json]",
-		async run(_rest, d, flags, pos) {
-			const source = pos[0] ?? "";
-			if (!SOURCE_RE.test(source)) return usageErr(`usage: ${commands["install"]!.usage}\n`);
-			try {
-				const output = await d.inst.install(source, { approved: flags.approved });
-				return flags.json ? ok(`${JSON.stringify({ ok: true, source, output })}\n`) : ok(`${output}\n`);
-			} catch (e) {
-				const error = e instanceof Error ? e.message : String(e);
-				return flags.json ? fail(`${JSON.stringify({ ok: false, source, error })}\n`) : fail(`${error}\n`);
-			}
-		},
-	},
-
-	security: {
-		usage: "packed security [always|never] [--json]",
-		async run(_rest, d, flags, pos) {
-			const requested = pos[0];
-			if (requested !== undefined && requested !== "always" && requested !== "never") {
-				return usageErr(`usage: ${commands["security"]!.usage}\n`);
-			}
-			const settings = requested
-				? await d.security.setMutationApproval(requested as MutationApproval, { approved: flags.approved })
-				: await d.security.security();
-			return flags.json
-				? ok(`${JSON.stringify(settings)}\n`)
-				: ok(`package mutation approval: ${settings.mutationApproval}\n`);
-		},
-	},
-
-	update: {
-		usage: "packed update <configured-source> [--approve] [--json]",
-		async run(_rest, d, flags, pos) {
-			const source = pos[0] ?? "";
-			if (!SOURCE_RE.test(source)) return usageErr(`usage: ${commands["update"]!.usage}\n`);
-			try {
-				const outcome = await d.inst.update(source, { approved: flags.approved });
-				if (flags.json) return ok(`${JSON.stringify({ ok: true, source, ...outcome })}\n`);
-				if (outcome.alreadyUpToDate) {
-					const version = outcome.currentVersion ?? outcome.previousVersion;
-					const reason = outcome.pinned
-						? `is pinned to ${version ?? "an exact version"} — pi update intentionally leaves pinned packages unchanged; run \`packed install npm:${npmPackageName(source) ?? source}\` to move off the pin`
-						: `is already up to date${version ? ` at ${version}` : ""}`;
-					return ok(`${source} ${reason}\n`);
-				}
-				const transition =
-					outcome.previousVersion && outcome.currentVersion ? ` (${outcome.previousVersion} → ${outcome.currentVersion})` : "";
-				return ok(`${outcome.output}${transition}\nReload Pi with /reload to activate the updated package.\n`);
-			} catch (error) {
-				const message = error instanceof Error ? error.message : String(error);
-				return flags.json
-					? fail(`${JSON.stringify({ ok: false, source, error: message, reloadRequired: false })}\n`)
-					: fail(`${message}\n`);
-			}
-		},
-	},
-
-	remove: {
-		usage: "packed remove <name> [--approve] [--json]  (bare npm name, e.g. pi-lsp or @scope/pkg)",
-		async run(_rest, d, flags, pos) {
-			const name = pos[0] ?? "";
-			if (!NAME_RE.test(name)) return usageErr(`usage: ${commands["remove"]!.usage}\n`);
-			try {
-				const output = await d.inst.remove(`npm:${name}`, { approved: flags.approved });
-				return flags.json ? ok(`${JSON.stringify({ ok: true, name, output })}\n`) : ok(`${output}\n`);
-			} catch (e) {
-				const error = e instanceof Error ? e.message : String(e);
-				return flags.json ? fail(`${JSON.stringify({ ok: false, name, error })}\n`) : fail(`${error}\n`);
-			}
-		},
-	},
-
-	service: {
-		usage: "packed service  (print a systemd user unit to stdout)",
-		async run(_rest, d) {
-			const execPath = d.execPath ?? process.execPath;
-			const cliPath = d.cliPath ?? new URL("./cli.ts", import.meta.url).pathname;
-			return ok(renderUnit(execPath, cliPath, d.piBin ?? defaultPiBinForUnit()));
-		},
-	},
-
-	version: {
-		usage: "packed version",
-		async run() {
-			return ok(VERSION + "\n");
-		},
-	},
-};
-
-/** systemd user unit. Idle self-exit is disabled — systemd owns the
- * lifecycle (Restart=on-failure takes over). */
-export function renderUnit(execPath: string, cliPath: string, piBin?: string): string {
-	// systemd does not read shell rc files: PI_BIN must be explicit so the
-	// daemon's install/remove execs can find the pi binary.
-	const piEnv = piBin ? `Environment=PI_BIN=${piBin}\n` : "";
-	return `[Unit]
-Description=pi-packed package service (Pi agent)
-
-[Service]
-Type=simple
-ExecStart=${execPath} ${cliPath} serve
-Restart=on-failure
-RestartSec=2
-Environment=PI_PACKED_IDLE_SECS=0
-${piEnv}NoNewPrivileges=true
-
-[Install]
-WantedBy=default.target
-`;
-}
-
-export async function cliRun(args: string[], d: CliDeps): Promise<CliResult> {
-	const [name, ...rest] = args;
-	if (!name) return usageErr(USAGE);
-	if (name === "help" || name === "--help" || name === "-h") return { code: 0, out: USAGE };
-	const cmd = commands[name];
-	if (!cmd) return usageErr(`unknown command "${name}"\n${USAGE}`);
-	const { flags, pos } = parseFlags(rest);
-	try {
-		const validMutationInput = name === "install" || name === "update"
-			? SOURCE_RE.test(pos[0] ?? "")
-			: name === "remove" ? NAME_RE.test(pos[0] ?? "")
-				: name === "security" ? (pos[0] === undefined || pos[0] === "always" || pos[0] === "never")
-					: true;
-		const operation = name === "security"
-			? (pos[0] === undefined ? "security.read" : "security.write")
-			: PACKAGE_COMMAND_OPERATIONS[name];
-		if (operation && validMutationInput) assertPackagePermission(await d.security.security(), operation, flags.approved);
-		return await cmd.run(rest, d, flags, pos);
-	} catch (e) {
-		return fail(`${name} failed: ${e instanceof Error ? e.message : e}\n`);
-	}
-}
-
-// Entry point (bun src/cli.ts …). `serve` is dispatched before any proxying
-// so the daemon always talks directly to npm.
-if (import.meta.main) {
-	const args = process.argv.slice(2);
-	if (args[0] === "serve") {
-		const { serveMain } = await import("./daemon.ts");
-		serveMain();
-	} else {
-		const { stateDir } = await import("./state.ts");
-		const { defaultPiHome } = await import("./installed.ts");
-		const { DaemonBackedSecurity, DaemonBackedInstaller, resolveRegistry } = await import("./client.ts");
-		const dir = stateDir();
-		// mirror talks to UPSTREAM, not the daemon cache — apt update semantics.
-		const reg =
-			args[0] === "mirror"
-				? new (await import("./registry.ts")).HttpRegistry(NPM_REGISTRY_BASE, SEARCH_PAGE_SIZE, MIRROR_PAGE_DELAY_MS)
-				: await resolveRegistry(dir, NPM_REGISTRY_BASE);
-		const { code, out } = await cliRun(args, {
-			reg,
-			inst: new DaemonBackedInstaller(dir),
-			security: new DaemonBackedSecurity(dir),
-			stateDir: dir,
-			piHome: defaultPiHome(),
-		});
-		process.stdout.write(out);
-		process.exit(code);
-	}
-}

package/src/client.ts

@@ -1,247 +0,0 @@
-/**
- * client.ts — authenticated loopback clients for the supervised package daemon.
- * The CLI may fall back to npm for read-only registry queries; Pi extensions use
- * PackageDaemonClient exclusively so Bun execution and SQLite remain daemon-owned.
- */
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import type { InstalledPkg, Installer, PkgInfo, Registry, SearchPage, UpdateEntry, UpdateOutcome, UpdatesSnapshot } from "./ports.ts";
-import { HttpRegistry } from "./registry.ts";
-import { DAEMON_HOST, PROBE_TIMEOUT_MS, REGISTRY_FETCH_TIMEOUT_MS, PORT_FILE, TOKEN_FILE } from "./constants.ts";
-import type { MutationApproval, SecuritySettings } from "./security.ts";
-
-export type FetchTransport = (request: Request) => Promise<Response>;
-
-export interface PackageDaemonPort {
-	search(query: string, limit: number, offline?: boolean): Promise<{ query: string; total: number; results: SearchPage["results"] }>;
-	info(name: string): Promise<PkgInfo>;
-	installed(): Promise<InstalledPkg[]>;
-	updates(): Promise<UpdateEntry[]>;
-	security(): Promise<SecuritySettings>;
-	setMutationApproval(value: MutationApproval, approved?: boolean): Promise<SecuritySettings>;
-	install(source: string, approved?: boolean): Promise<string>;
-	remove(name: string, approved?: boolean): Promise<string>;
-	update(source: string, approved?: boolean): Promise<UpdateOutcome>;
-}
-
-interface MutationResponse {
-	ok: boolean;
-	output: string;
-}
-
-interface UpdateMutationResponse extends MutationResponse, Partial<Omit<UpdateOutcome, "output">> {}
-
-export class PackageDaemonError extends Error {
-	constructor(
-		message: string,
-		readonly operation: string,
-		readonly status?: number,
-	) {
-		super(message);
-		this.name = "PackageDaemonError";
-	}
-}
-
-export class PackageDaemonClient implements PackageDaemonPort {
-	constructor(
-		private readonly base: string,
-		private readonly token: string,
-		private readonly transport: FetchTransport = fetch,
-	) {}
-
-	private async request<T>(path: string, init: RequestInit = {}): Promise<T> {
-		const headers = new Headers(init.headers);
-		headers.set("authorization", `Bearer ${this.token}`);
-		if (init.body !== undefined) headers.set("content-type", "application/json");
-		const response = await this.transport(new Request(`${this.base}${path}`, {
-			...init,
-			headers,
-			signal: init.signal ?? AbortSignal.timeout(REGISTRY_FETCH_TIMEOUT_MS),
-		}));
-		let body: unknown;
-		try {
-			body = await response.json();
-		} catch {
-			throw new PackageDaemonError(`package daemon returned invalid JSON (HTTP ${response.status})`, path, response.status);
-		}
-		if (!response.ok) {
-			const message = typeof body === "object" && body !== null && typeof (body as { error?: unknown }).error === "string"
-				? (body as { error: string }).error
-				: `package daemon HTTP ${response.status}`;
-			throw new PackageDaemonError(message, path, response.status);
-		}
-		return body as T;
-	}
-
-	async search(query: string, limit: number, offline = false): Promise<{ query: string; total: number; results: SearchPage["results"] }> {
-		const params = new URLSearchParams({ q: query, limit: String(limit) });
-		if (offline) params.set("offline", "1");
-		return this.request(`/search?${params}`);
-	}
-
-	info(name: string): Promise<PkgInfo> {
-		return this.request(`/info?name=${encodeURIComponent(name)}`);
-	}
-
-	installed(): Promise<InstalledPkg[]> {
-		return this.request("/installed");
-	}
-
-	async updates(): Promise<UpdateEntry[]> {
-		return (await this.request<UpdatesSnapshot>("/updates")).updates;
-	}
-
-	security(): Promise<SecuritySettings> {
-		return this.request("/security");
-	}
-
-	setMutationApproval(mutationApproval: MutationApproval, approved = false): Promise<SecuritySettings> {
-		return this.request("/security", { method: "POST", body: JSON.stringify({ mutationApproval, approved }) });
-	}
-
-	async install(source: string, approved = false): Promise<string> {
-		const result = await this.request<MutationResponse>("/install", {
-			method: "POST",
-			body: JSON.stringify({ source, approved }),
-		});
-		if (!result.ok) throw new PackageDaemonError(result.output || `failed to install ${source}`, "install");
-		return result.output;
-	}
-
-	async remove(name: string, approved = false): Promise<string> {
-		const result = await this.request<MutationResponse>("/remove", {
-			method: "POST",
-			body: JSON.stringify({ name, approved }),
-		});
-		if (!result.ok) throw new PackageDaemonError(result.output || `failed to remove ${name}`, "remove");
-		return result.output;
-	}
-
-	async update(source: string, approved = false): Promise<UpdateOutcome> {
-		const result = await this.request<UpdateMutationResponse>("/update", {
-			method: "POST",
-			body: JSON.stringify({ source, approved }),
-		});
-		if (!result.ok) throw new PackageDaemonError(result.output || `failed to update ${source}`, "update");
-		// Older daemons (pre-honest-update) only ever sent {ok, output}; default
-		// to the historical "assume it changed" signal rather than claiming
-		// certainty the response doesn't actually contain.
-		return {
-			output: result.output,
-			reloadRequired: result.reloadRequired ?? true,
-			alreadyUpToDate: result.alreadyUpToDate ?? false,
-			pinned: result.pinned ?? false,
-			previousVersion: result.previousVersion,
-			currentVersion: result.currentVersion,
-		};
-	}
-}
-
-export class PackageDaemonInstaller implements Installer {
-	constructor(private readonly client: PackageDaemonClient) {}
-
-	install(source: string, options?: { approved?: boolean }): Promise<string> {
-		return this.client.install(source, options?.approved);
-	}
-
-	remove(source: string, options?: { approved?: boolean }): Promise<string> {
-		if (!source.startsWith("npm:") || source.length <= 4) {
-			throw new PackageDaemonError("daemon package removal requires an npm: source", "remove");
-		}
-		return this.client.remove(source.slice(4), options?.approved);
-	}
-
-	update(source: string, options?: { approved?: boolean }): Promise<UpdateOutcome> {
-		return this.client.update(source, options?.approved);
-	}
-}
-
-export class DaemonBackedSecurity {
-	constructor(private readonly stateDirectory: string) {}
-	async security(): Promise<SecuritySettings> {
-		return (await connectPackageDaemon(this.stateDirectory)).security();
-	}
-	async setMutationApproval(value: MutationApproval, options?: { approved?: boolean }): Promise<SecuritySettings> {
-		return (await connectPackageDaemon(this.stateDirectory)).setMutationApproval(value, options?.approved);
-	}
-}
-
-export class DaemonBackedInstaller implements Installer {
-	constructor(private readonly stateDirectory: string) {}
-
-	async install(source: string, options?: { approved?: boolean }): Promise<string> {
-		return (await connectPackageDaemon(this.stateDirectory)).install(source, options?.approved);
-	}
-
-	async remove(source: string, options?: { approved?: boolean }): Promise<string> {
-		return new PackageDaemonInstaller(await connectPackageDaemon(this.stateDirectory)).remove(source, options);
-	}
-
-	async update(source: string, options?: { approved?: boolean }): Promise<UpdateOutcome> {
-		return (await connectPackageDaemon(this.stateDirectory)).update(source, options?.approved);
-	}
-}
-
-export class DaemonRegistry implements Registry {
-	private readonly client: PackageDaemonClient;
-
-	constructor(base: string, token: string, transport: FetchTransport = fetch) {
-		this.client = new PackageDaemonClient(base, token, transport);
-	}
-
-	async search(query: string, limit: number): Promise<SearchPage> {
-		const body = await this.client.search(query, limit);
-		return { results: body.results, total: body.total };
-	}
-
-	async searchPage(query: string, _from: number, size: number): Promise<SearchPage> {
-		return this.search(query, size).catch(() => ({ results: [], total: 0 }));
-	}
-
-	async searchAll(): Promise<never> {
-		throw new Error("searchAll is not supported via the daemon proxy");
-	}
-
-	info(name: string): Promise<PkgInfo> {
-		return this.client.info(name);
-	}
-}
-
-export interface DaemonHandle {
-	base: string;
-	token: string;
-}
-
-export async function probe(dir: string): Promise<DaemonHandle | undefined> {
-	let port: string;
-	let token: string;
-	try {
-		port = readFileSync(join(dir, PORT_FILE), "utf8").trim();
-		token = readFileSync(join(dir, TOKEN_FILE), "utf8").trim();
-	} catch {
-		return undefined;
-	}
-	const base = `http://${DAEMON_HOST}:${port}`;
-	try {
-		const res = await fetch(`${base}/health`, {
-			headers: { authorization: `Bearer ${token}` },
-			signal: AbortSignal.timeout(PROBE_TIMEOUT_MS),
-		});
-		if (res.ok) return { base, token };
-	} catch {
-		/* dead daemon or stale files */
-	}
-	return undefined;
-}
-
-export async function connectPackageDaemon(dir: string): Promise<PackageDaemonClient> {
-	const handle = await probe(dir);
-	if (!handle) throw new Error("pi-packed daemon is unavailable; start packed.service");
-	return new PackageDaemonClient(handle.base, handle.token);
-}
-
-export async function resolveRegistry(dir: string, npmBase: string): Promise<Registry> {
-	const handle = await probe(dir);
-	if (handle) return new DaemonRegistry(handle.base, handle.token);
-	return new HttpRegistry(npmBase);
-}