@farmslot/recipe-cli 0.11.4 → 0.12.0

package/dist/harness/context.js

@@ -8,14 +8,22 @@
 // and funding flags) are never part of the context: they stay explicit.
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
+import { createRequire } from 'node:module';
 import os from 'node:os';
 import path from 'node:path';
-import { findSlotByRepo, resolveSlotPoolDir } from '@farmslot/protocol/node/slot-by-repo';
-import { adapterPlugin, declaredAdapters } from './adapter-plugins.js';
-import { adapterForPlatform, adapterPortEnv, detectAdapterMatch, harnessAdapters, isPlatformTarget, } from './adapters.js';
+import { pathToFileURL } from 'node:url';
+import { portableRepoIdentity } from '@farmslot/agent-runtime';
+import { DEFAULT_TASK_DIR, validateProjectRecipeConfig, } from '@farmslot/protocol';
+import { findSlotByRepo, resolveSlotPoolDir, SlotByRepoError, } from '@farmslot/protocol/node/slot-by-repo';
+import { resolveRecipeLibrarySources } from '@farmslot/recipe-runner';
+import { adapterPlugin, declaredAdapters, libraryName, } from './adapter-plugins.js';
+import { adapterForPlatform, adapterPortEnv, checkoutRemote, detectAdapterMatch, harnessAdapters, isPlatformTarget, } from './adapters.js';
 import { optionValues } from './command-contract.js';
-import { validateRelativeRecipePath } from './host.js';
-import { DEFAULT_RECIPE_RUNTIME_DIR, recipeRuntimeDir } from './paths.js';
+import { ProjectBindingError, } from './context-state.js';
+import { inputSourceSnapshot, providerSourceSnapshot } from './execution-provenance.js';
+import { configureHarnessHost, validateRelativeRecipePath, } from './host.js';
+import { gitLibraryProvenance } from './library-provenance.js';
+import { DEFAULT_RECIPE_RUNTIME_DIR, isPathWithin as within, recipeOutputRoots, recipeRuntimeDir, } from './paths.js';
 /**
  * Resolve the invocation's context. Throws AdapterAmbiguousError when detection
  * is reached and more than one adapter matches the target.
@@ -38,13 +46,15 @@ export async function resolveHarnessContext(options) {
     // slot and detection read the Git top level.
     const root = targetFlag ? target.value : (gitTopLevel(target.value) ?? target.value);
     const runtimeDir = optionValues(options.tokens, '--runtime-dir').at(-1);
-    const binding = readBinding(root, runtimeDir);
+    const binding = readBinding(options.runtimeTarget ?? root, runtimeDir);
     const runtime = binding.runtime;
     const pool = options.slotPoolDir
         ? { dir: options.slotPoolDir, source: 'option' }
         : resolveSlotPoolDir();
     const pooled = pool
-        ? await poolSlot(root, pool.dir, pool.source === 'farmslot-node' ? 'slot-config (~/farmslot-node/pool)' : 'slot-config')
+        ? await poolSlot(root, pool.dir, pool.source === 'farmslot-node' ? 'slot-config (~/farmslot-node/pool)' : 'slot-config', options.slotSelection === 'identity'
+            ? undefined
+            : optionValues(options.tokens, '--slot').at(-1), options.strictSlot ?? true, options.slotSelection)
         : 'no-pool-dir';
     const pooledSlot = typeof pooled === 'object' ? pooled : undefined;
     // The pool's slot keeps the owned runtime context's ports beside its own
@@ -58,7 +68,12 @@ export async function resolveHarnessContext(options) {
             ? // An explicit --runtime-dir scratch runtime names its own slot:
                 // identity and ports describe that runtime, the pool's ports filling
                 // only what it lacks. The default context keeps the pool's identity.
-                { ...owned, ports: { ...pooledSlot.slot.ports, ...owned.ports } }
+                {
+                    ...owned,
+                    poolFile: pooledSlot.slot.poolFile,
+                    poolSlot: pooledSlot.slot.value,
+                    ports: { ...pooledSlot.slot.ports, ...owned.ports },
+                }
             : {
                 ...pooledSlot.slot,
                 ports: { ...pooledSlot.slot.ports, ...runtimePorts(runtime) },
@@ -83,6 +98,7 @@ export async function resolveHarnessContext(options) {
         target,
         ...(slot ? { slot } : {}),
         ...(binding.ignored ? { ignoredBinding: binding.ignored } : {}),
+        ...(binding.path ? { runtimeConfigPath: binding.path } : {}),
     };
 }
 // Each generic port option, and the slot ports that fill it, in order.
@@ -293,12 +309,12 @@ function readBinding(root, runtimeDir) {
     const runtime = value;
     const repoRoot = typeof runtime.repoRoot === 'string' ? runtime.repoRoot : undefined;
     return runtimeContextOwned(root, file, runtime)
-        ? { runtime }
+        ? { runtime, path: file }
         : { ignored: { path: file, repoRoot: repoRoot ?? null } };
 }
 /**
  * Whether the runtime context read from `file` belongs to the checkout `root`:
- * its `repoRoot` is `root`'s Git top level (real paths), or, without
+ * its `repoRoot` is the selected target or its Git top level (real paths), or, without
  * `repoRoot`, the file sits inside `root`. Anything else is another
  * checkout's (an inherited RECIPE_RUNTIME_CONTEXT) and describes nothing here.
  */
@@ -306,7 +322,7 @@ export function runtimeContextOwned(root, file, context) {
     // The checkout itself, not one nested in it: a clone under <checkout>/temp
     // has its own top level and inherits nothing.
     return typeof context.repoRoot === 'string'
-        ? samePath(context.repoRoot, gitTopLevel(root) ?? root)
+        ? samePath(context.repoRoot, root) || samePath(context.repoRoot, gitTopLevel(root) ?? root)
         : within(root, file);
 }
 function samePath(left, right) {
@@ -323,19 +339,6 @@ function homeRelative(dir) {
     const home = os.homedir();
     return dir === home || dir.startsWith(`${home}${path.sep}`) ? `~${dir.slice(home.length)}` : dir;
 }
-// Whether `inner` is `outer` or inside it, comparing real paths.
-function within(outer, inner) {
-    try {
-        const relative = path.relative(fs.realpathSync(outer), fs.realpathSync(inner));
-        return !(relative === '..' ||
-            relative.startsWith(`..${path.sep}`) ||
-            path.isAbsolute(relative));
-    }
-    catch {
-        // A path that does not exist owns nothing.
-        return false;
-    }
-}
 const RUNTIME_PORTS = ['watcherPort', 'devServerPort', 'metroPort', 'cdpPort'];
 function runtimeSlot(runtime) {
     if (typeof runtime?.slotId !== 'string' || !runtime.slotId)
@@ -358,7 +361,7 @@ function runtimePorts(runtime) {
 }
 // The slot slot-config maps this checkout to, with its own platform (never the
 // pool's) for the adapter step; 'no-pool-dir' when the directory does not read.
-async function poolSlot(target, poolDir, detail) {
+async function poolSlot(target, poolDir, detail, slotId, strict = true, selection) {
     let real;
     try {
         real = fs.realpathSync(target);
@@ -371,9 +374,13 @@ async function poolSlot(target, poolDir, detail) {
     }
     let match;
     try {
-        match = await findSlotByRepo(poolDir, real);
+        match = await findSlotByRepo(poolDir, real, { strict, ...(slotId ? { slotId } : {}) });
     }
     catch (error) {
+        if (error instanceof SlotByRepoError && selection === 'identity')
+            throw Object.assign(error, {
+                userAction: 'map this checkout to a single pool slot; use --target for a separate checkout',
+            });
         // A pool directory that does not exist is none; one that does not read
         // (EACCES and the like) is a real failure.
         if (missing(error))
@@ -406,4 +413,418 @@ function missing(error) {
     const code = error?.code;
     return code === 'ENOENT' || code === 'ENOTDIR';
 }
+// Authority and the checked source identity cannot be supplied by discovered JSON
+// or changed by a caller editing the report data between resolution and loading.
+const projectProviders = new WeakMap();
+const projectLibraries = new WeakMap();
+const providerOutputRoots = new WeakMap();
+const importedProviderSources = new Map();
+/** Read project metadata and resolve defaults without importing executable code. */
+export async function resolveProjectContext(options) {
+    const cwd = options.cwd ?? process.cwd();
+    const requested = optionValues(options.tokens, '--target').at(-1);
+    const checkoutRoot = gitTopLevel(path.resolve(cwd, requested ?? '.')) ?? path.resolve(cwd, requested ?? '.');
+    if (!fs.existsSync(checkoutRoot)) {
+        throw new ProjectBindingError('TARGET_INCOMPATIBLE', `Checkout ${checkoutRoot} does not exist.`, 'select an existing checkout with --target');
+    }
+    const divider = options.tokens.indexOf('--');
+    const optionEnd = divider < 0 ? options.tokens.length : divider;
+    const contextOptions = {
+        ...options,
+        tokens: [
+            ...options.tokens.slice(0, optionEnd),
+            '--target',
+            checkoutRoot,
+            ...options.tokens.slice(optionEnd),
+        ],
+        adapter: false,
+    };
+    let context = await resolveHarnessContext(contextOptions);
+    let runtime = readBinding(checkoutRoot, optionValues(options.tokens, '--runtime-dir').at(-1)).runtime;
+    const registered = [...(options.projects ?? [])];
+    if (options.projectsDir) {
+        for (const name of fs.readdirSync(options.projectsDir).sort()) {
+            const root = path.join(options.projectsDir, name);
+            const file = path.join(root, 'project.json');
+            if (fs.existsSync(file))
+                registered.push({ root, config: readProject(file) });
+        }
+    }
+    const localFile = path.join(checkoutRoot, 'project.json');
+    const discovered = fs.existsSync(localFile)
+        ? [{ root: checkoutRoot, config: readProject(localFile) }]
+        : [];
+    const entries = [
+        ...registered,
+        ...discovered.filter((entry) => !registered.some((existing) => existing.config.name === entry.config.name)),
+    ];
+    const pool = context.slot?.value && context.slot.poolFile
+        ? JSON.parse(fs.readFileSync(context.slot.poolFile, 'utf8'))
+        : undefined;
+    const poolSlot = context.slot?.value ? (context.slot.poolSlot ?? context.slot.value) : undefined;
+    const slot = pool?.slots?.find((entry) => entry.id === poolSlot);
+    const projectFlag = optionValues(options.tokens, '--project').at(-1);
+    const bindingName = stringField(runtime, 'project');
+    const slotName = slot?.project ?? pool?.project;
+    const named = projectFlag ?? bindingName ?? slotName;
+    const remote = checkoutRemote(checkoutRoot) || undefined;
+    let source = projectFlag
+        ? 'flag'
+        : bindingName
+            ? 'binding'
+            : slotName
+                ? 'slot'
+                : 'detect';
+    let candidates = named
+        ? entries.filter((entry) => entry.config.name === named)
+        : entries.filter((entry) => {
+            if (samePath(entry.root, checkoutRoot))
+                return true;
+            return (remote !== undefined &&
+                repositoryIdentity(remote) === repositoryIdentity(entry.config.repoUrl));
+        });
+    if (!named && candidates.length === 0 && options.defaultProject) {
+        candidates = entries.filter((entry) => entry.config.name === options.defaultProject);
+        source = 'default';
+    }
+    if (candidates.length !== 1) {
+        throw new ProjectBindingError(candidates.length > 1 ? 'PROJECT_AMBIGUOUS' : 'PROJECT_NOT_FOUND', candidates.length > 1
+            ? 'More than one project matches this checkout.'
+            : `No project binding found${named ? ` for ${named}` : ''}.`, 'select a registered project with --project <name>', candidates.map((entry) => entry.config.name));
+    }
+    const selected = candidates[0];
+    const config = selected.config;
+    const root = fs.realpathSync(selected.root);
+    const recipe = config.recipe;
+    if (!recipe?.provider?.module) {
+        throw new ProjectBindingError('PROVIDER_MISSING', `Project ${config.name} has no recipe provider.`, 'configure recipe.provider in project.json');
+    }
+    const apps = config.apps ?? (recipe.app ? [recipe.app] : []);
+    const appFlag = optionValues(options.tokens, '--app').at(-1);
+    const selectedApp = appFlag ?? stringField(runtime, 'app') ?? slot?.app;
+    const appDirectory = requested ? path.resolve(cwd, requested) : cwd;
+    const detectedApps = apps.filter((entry) => within(path.join(checkoutRoot, entry), appDirectory));
+    if (!selectedApp && detectedApps.length > 1) {
+        throw new ProjectBindingError('APP_AMBIGUOUS', 'More than one declared app contains this directory.', 'select an app with --app <path>', detectedApps);
+    }
+    const app = selectedApp ?? detectedApps[0] ?? recipe.app ?? (apps.length === 1 ? apps[0] : undefined);
+    if ((app && !apps.includes(app)) || (!app && apps.length > 1)) {
+        throw new ProjectBindingError(app ? 'APP_INCOMPATIBLE' : 'APP_AMBIGUOUS', app
+            ? `App ${app} is not declared by project ${config.name}.`
+            : `Project ${config.name} needs an app selection.`, 'select a declared app with --app <path>', apps);
+    }
+    const target = app
+        ? path.join(checkoutRoot, validateRelativeRecipePath('--app', app))
+        : checkoutRoot;
+    if (!fs.existsSync(target) || !within(checkoutRoot, target)) {
+        throw new ProjectBindingError('TARGET_INCOMPATIBLE', `Target ${target} is outside or missing from this checkout.`, 'select an existing checkout and app');
+    }
+    if (target !== checkoutRoot) {
+        context = await resolveHarnessContext({ ...contextOptions, runtimeTarget: target });
+        runtime = readBinding(target, optionValues(options.tokens, '--runtime-dir').at(-1)).runtime;
+        const targetProject = stringField(runtime, 'project');
+        if (targetProject && targetProject !== config.name && !projectFlag) {
+            throw new ProjectBindingError('PROJECT_INCOMPATIBLE', `App runtime names project ${targetProject}, not ${config.name}.`, 'select the intended project explicitly with --project');
+        }
+    }
+    if (remote &&
+        config.repoUrl &&
+        repositoryIdentity(remote) !== repositoryIdentity(config.repoUrl)) {
+        throw new ProjectBindingError('PROJECT_INCOMPATIBLE', `Project ${config.name} does not match checkout origin ${remote}.`, 'select the project registered for this checkout');
+    }
+    const configured = registered.includes(selected);
+    validateProjectRecipeConfig(recipe);
+    const runtimeDir = validateRelativeRecipePath('runtime directory', optionValues(options.tokens, '--runtime-dir').at(-1) ?? recipeRuntimeDir());
+    const artifactDir = validateRelativeRecipePath('artifact directory', optionValues(options.tokens, '--artifacts-dir').at(-1) ?? config.paths.artifactDir);
+    const outputPaths = {
+        checkoutRoot,
+        runtimeDir,
+        artifactDir,
+        farmRuntimeDir: validateRelativeRecipePath('farm runtime directory', config.paths.runtimeDir),
+    };
+    const excludedRoots = recipeOutputRoots(target, outputPaths);
+    const environment = { ...pool?.env, ...(options.load?.env ?? process.env) };
+    const existingSourceRoot = (value, label = value) => {
+        try {
+            return fs.realpathSync(value);
+        }
+        catch (error) {
+            if (!missing(error))
+                throw error;
+            throw new ProjectBindingError('SOURCE_ROOT_MISSING', `Configured source root ${label} does not exist.`, 'configure an existing provider or library path in the selected pool or project');
+        }
+    };
+    const sourceRoot = (ref) => {
+        if (!configured)
+            throw new ProjectBindingError('SOURCE_UNAUTHORIZED', 'Discovered root references cannot read operator environment or checkout paths.', 'register the project before resolving provider or library root references');
+        const value = ref.env ? environment[ref.env] : path.resolve(checkoutRoot, ref.projectPath);
+        if (!value)
+            throw new ProjectBindingError('SOURCE_ROOT_MISSING', `Missing configured source root ${ref.env ?? ref.projectPath}.`, `set ${ref.env ?? 'the project path'} in the operator environment or selected pool.env`);
+        return existingSourceRoot(value, ref.env ?? ref.projectPath);
+    };
+    const provider = resolveProvider(recipe.provider, root, configured, recipe.provider.root ? sourceRoot(recipe.provider.root) : undefined, excludedRoots);
+    const overrides = await resolveRecipeLibrarySources({
+        cliEntries: optionValues(options.tokens, '--library'),
+        ...(options.load?.env ? { env: options.load.env } : {}),
+    });
+    const libraries = overrides.map((entry) => {
+        const libraryRoot = existingSourceRoot(path.resolve(cwd, entry.root));
+        const identity = inputSourceSnapshot(libraryRoot, excludedRoots);
+        const name = libraryName({ ...entry, root: libraryRoot });
+        return {
+            ...entry,
+            root: libraryRoot,
+            name,
+            identity,
+        };
+    });
+    for (const entry of recipe.libraries ?? []) {
+        const override = libraries.find((library) => library.name === entry.name);
+        if (override) {
+            const original = typeof entry.source === 'string'
+                ? path.resolve(root, entry.source)
+                : entry.source.env
+                    ? `env:${entry.source.env}`
+                    : path.resolve(checkoutRoot, entry.source.projectPath);
+            override.overrides ??= original;
+            override.overriddenSource = {
+                root: original,
+                owner: entry.owner,
+                revision: entry.revision,
+            };
+            continue;
+        }
+        const libraryRoot = typeof entry.source === 'string'
+            ? existingSourceRoot(path.resolve(root, entry.source))
+            : sourceRoot(entry.source);
+        const identity = inputSourceSnapshot(libraryRoot, excludedRoots);
+        if (identity.head && !entry.revision) {
+            throw new ProjectBindingError('SOURCE_REVISION_MISSING', `Library ${entry.name} is a repository source without a pinned revision.`, 'pin the library revision in project.json');
+        }
+        checkRevision(entry.revision, identity.head, `library ${entry.name}`);
+        libraries.push({
+            name: entry.name,
+            root: libraryRoot,
+            owner: entry.owner,
+            revision: entry.revision,
+            identity,
+        });
+    }
+    for (const library of libraries) {
+        library.provenance = {
+            kind: 'library',
+            trust: 'unknown',
+            name: library.name,
+            path: library.root,
+            ...(await gitLibraryProvenance(library.root, library.identity)),
+        };
+    }
+    context.target = {
+        value: target,
+        source: requested ? 'flag' : 'default',
+        detail: requested ? '--target' : 'cwd',
+    };
+    const platform = (value) => {
+        if (value === undefined)
+            return undefined;
+        const mapped = options.slotAdapter?.(value);
+        if (mapped)
+            return mapped;
+        const candidate = adapterForPlatform(value);
+        return candidate && (harnessAdapters().has(candidate) || candidate === recipe.adapter)
+            ? candidate
+            : undefined;
+    };
+    const adapter = flagAdapter(options.tokens, options.positionals) ??
+        sourced(stringField(runtime, 'adapter') ?? platform(stringField(runtime, 'platform')), 'binding', 'runtime-context') ??
+        sourced(platform(slot?.platform), 'slot', 'slot-config') ??
+        (harnessAdapters().list().length ? detectedAdapter(target, []) : undefined) ??
+        sourced(recipe.adapter ?? options.defaultAdapter, 'default', 'project.json');
+    if (adapter)
+        context.adapter = adapter;
+    context.project = {
+        name: config.name,
+        source,
+        root,
+        configPath: path.join(root, 'project.json'),
+        ...outputPaths,
+        ...(app ? { app } : {}),
+        domain: recipe.domain,
+        template: recipe.template,
+        ...(recipe.manifest ? { manifest: path.resolve(root, recipe.manifest) } : {}),
+        provider,
+        libraries,
+    };
+    projectProviders.set(context, structuredClone(provider));
+    projectLibraries.set(context, structuredClone(libraries));
+    providerOutputRoots.set(context, excludedRoots);
+    return context;
+}
+/** Executable library authority comes from resolution, never mutable report metadata. */
+export function authorizedProjectLibraries(context) {
+    const provider = projectProviders.get(context);
+    return structuredClone((projectLibraries.get(context) ?? []).filter((library) => provider?.authority === 'configured' || library.origin !== undefined));
+}
+/** The shared direct/hosted loader. Source identity is checked before import. */
+export async function loadProjectProvider(context, options = {}) {
+    const provider = projectProviders.get(context);
+    if (!provider || !context.project) {
+        throw new ProjectBindingError('PROVIDER_MISSING', 'No resolved project provider is available.', 'resolve a project binding before loading its provider');
+    }
+    if (provider.authority === 'discovered' &&
+        !options.authorizedProviders?.some((entry) => entry === provider.ref || entry === provider.module)) {
+        throw new ProjectBindingError('PROVIDER_UNAUTHORIZED', `Provider ${provider.ref} was discovered but is not authorized.`, 'install/configure the provider or explicitly authorize its source');
+    }
+    const current = providerSourceSnapshot(provider.root, provider.module, providerOutputRoots.get(context));
+    if (current.head !== provider.identity.head ||
+        current.sourceFingerprint !== provider.identity.sourceFingerprint) {
+        throw new ProjectBindingError('PROVIDER_SOURCE_CHANGED', `Provider ${provider.ref} changed after resolution.`, 'resolve the current provider again');
+    }
+    const importedIdentity = importedProviderSources.get(provider.module);
+    if (importedIdentity !== undefined && importedIdentity !== current.sourceFingerprint) {
+        // ESM dependencies are cached for this process. Refuse to label cached code
+        // with a new source identity after another invocation changes the provider.
+        throw new ProjectBindingError('PROVIDER_SOURCE_CHANGED', `Provider ${provider.ref} changed after it was imported.`, 'restart the host before loading the changed provider');
+    }
+    const module = (await import(pathToFileURL(provider.module).href));
+    importedProviderSources.set(provider.module, current.sourceFingerprint);
+    const createProvider = module[provider.export];
+    if (typeof createProvider !== 'function') {
+        throw new ProjectBindingError('PROVIDER_INVALID', `Provider ${provider.ref} has no ${provider.export} factory.`, 'export createProvider(context) from the configured module');
+    }
+    const providerHost = module.providerHost;
+    const host = providerHost || options.host
+        ? {
+            ...providerHost,
+            ...options.host,
+            name: options.host?.name ?? 'farmslot recipe',
+        }
+        : undefined;
+    if (host)
+        configureHarnessHost(host);
+    const result = (await createProvider({
+        ...context,
+        ...(host ? { host } : {}),
+        command: options.command,
+        options: options.options,
+        libraries: authorizedProjectLibraries(context),
+    }));
+    if (!result?.runtime || typeof result.runtime.id !== 'string') {
+        throw new ProjectBindingError('PROVIDER_INVALID', `Provider ${provider.ref} returned no runtime.`, 'return { runtime } from createProvider');
+    }
+    const selection = context.adapter?.value;
+    if (selection &&
+        selection !== result.runtime.id &&
+        !result.runtime.targets?.includes(selection)) {
+        throw new ProjectBindingError('TARGET_INCOMPATIBLE', `Provider runtime ${result.runtime.id} does not support ${selection}.`, 'select a target supported by the project provider');
+    }
+    const registry = harnessAdapters();
+    if (registry.has(result.runtime.id) && registry.get(result.runtime.id) !== result.runtime) {
+        throw new ProjectBindingError('PROVIDER_AMBIGUOUS', `Runtime ${result.runtime.id} is already registered by another provider.`, 'use one provider for each runtime id');
+    }
+    if (!registry.has(result.runtime.id))
+        registry.register(result.runtime);
+    context.adapter = {
+        value: result.runtime.id,
+        requested: selection ?? result.runtime.id,
+        source: context.adapter?.source ?? 'default',
+        detail: context.adapter?.detail ?? 'project provider',
+    };
+    return result;
+}
+function readProject(file) {
+    const raw = JSON.parse(fs.readFileSync(file, 'utf8'));
+    // project.json uses the existing pack spelling; registered protocol values
+    // already use camelCase. Only the binding's fields need normalization here.
+    return {
+        ...raw,
+        repoUrl: raw.repoUrl ?? raw.repo_url ?? '',
+        defaultBranch: raw.defaultBranch ?? raw.default_branch ?? '',
+        paths: {
+            runtimeDir: raw.paths?.runtimeDir || raw.paths?.runtime_dir || '.agent',
+            artifactDir: raw.paths?.artifactDir || raw.paths?.artifact_dir || DEFAULT_TASK_DIR,
+        },
+    };
+}
+function stringField(value, key) {
+    return typeof value?.[key] === 'string' ? value[key] : undefined;
+}
+function repositoryIdentity(value) {
+    const repository = portableRepoIdentity(value);
+    if (!repository)
+        return value;
+    const sshHost = (host) => {
+        const config = execFileSync('ssh', ['-G', '--', host], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 1000,
+        });
+        const resolved = /^hostname (.+)$/mu.exec(config)?.[1];
+        if (!resolved)
+            throw new ProjectBindingError('PROJECT_ORIGIN_INVALID', `Cannot resolve SSH repository host ${host}.`, 'check the operator SSH host configuration');
+        return resolved.toLowerCase();
+    };
+    if (URL.canParse(value)) {
+        const url = new URL(value);
+        if (['https:', 'http:', 'ssh:', 'git:'].includes(url.protocol))
+            return `${url.protocol === 'ssh:' ? sshHost(url.hostname) : url.hostname.toLowerCase()}${url.port ? `:${url.port}` : ''}/${repository}`;
+    }
+    const scp = /^(?:[^/@:]+@)?([^/:]+):(.+)$/u.exec(value);
+    return scp ? `${sshHost(scp[1])}/${repository}` : repository;
+}
+/** The package owning a resolved entry, including entries below nested source/dist directories. */
+export function recipePackageRoot(file) {
+    let root = path.dirname(file);
+    while (!fs.existsSync(path.join(root, 'package.json'))) {
+        const parent = path.dirname(root);
+        if (parent === root)
+            throw new ProjectBindingError('PROVIDER_INVALID', 'Provider package metadata is missing.', 'install a valid provider package');
+        root = parent;
+    }
+    return root;
+}
+function resolveProvider(declaration, root, configured, declaredRoot, excludedRoots = []) {
+    let file;
+    try {
+        file = declaration.package
+            ? createRequire(path.join(declaredRoot ?? root, 'package.json')).resolve(declaration.module)
+            : fs.realpathSync(path.resolve(declaredRoot ?? root, declaration.module));
+    }
+    catch (error) {
+        if (!missing(error) && error.code !== 'MODULE_NOT_FOUND')
+            throw error;
+        throw new ProjectBindingError('PROVIDER_MISSING', `Provider ${declaration.module} is not available.`, 'install the configured provider or correct recipe.provider.module');
+    }
+    const packageRoot = declaration.package
+        ? recipePackageRoot(file)
+        : (declaredRoot ?? (within(root, file) ? root : path.dirname(file)));
+    const metadata = declaration.package
+        ? JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf8'))
+        : undefined;
+    if (metadata && metadata.name !== declaration.package) {
+        throw new ProjectBindingError('PROVIDER_SOURCE_MISMATCH', `Module ${declaration.module} belongs to ${metadata.name}, not ${declaration.package}.`, 'use a module exported by the declared provider package');
+    }
+    const identity = providerSourceSnapshot(packageRoot, file, excludedRoots);
+    checkRevision(declaration.revision, identity.head, 'provider');
+    return {
+        ref: declaration.module,
+        module: fs.realpathSync(file),
+        export: declaration.export ?? 'createProvider',
+        package: declaration.package,
+        version: metadata?.version,
+        root: packageRoot,
+        revision: declaration.revision,
+        identity,
+        authority: configured
+            ? 'configured'
+            : declaration.package && file.includes(`${path.sep}node_modules${path.sep}`)
+                ? 'installed'
+                : 'discovered',
+    };
+}
+function checkRevision(expected, actual, label) {
+    if (expected && expected !== actual) {
+        throw new ProjectBindingError('SOURCE_REVISION_MISMATCH', `Configured ${label} revision ${expected} differs from ${actual ?? 'an unversioned source'}.`, 'use the pinned source revision or update the operator configuration');
+    }
+}
 //# sourceMappingURL=context.js.map