@hawkeyexl/manni 4.3.0 → 4.4.0

package/dist/chunk-Q35YIDBV.js

@@ -0,0 +1,1202 @@
+#!/usr/bin/env node
+import {
+  programName
+} from "./chunk-OWBRDNRZ.js";
+import {
+  errorMessage
+} from "./chunk-G3T47CFV.js";
+
+// src/shared/warn.ts
+var said = /* @__PURE__ */ new Set();
+function warn(message) {
+  if (said.has(message)) return;
+  said.add(message);
+  process.stderr.write(`${programName()}: ${message}
+`);
+}
+function notice(message) {
+  process.stderr.write(`${programName()}: ${message}
+`);
+}
+var noticed = /* @__PURE__ */ new Set();
+function noticeOnce(message) {
+  if (noticed.has(message)) return;
+  noticed.add(message);
+  notice(message);
+}
+
+// src/shared/providers.ts
+import { resolve } from "node:path";
+import {
+  DEFAULT_MODELS,
+  DEFAULT_OPENAI_BASE_URL,
+  InferenceError,
+  resolveProviderIdentityAsync
+} from "@hawkeyexl/inference";
+var DEFAULT_PROVIDER = "auto";
+var PROVIDERS = /* @__PURE__ */ new Set([
+  ...Object.keys(DEFAULT_MODELS),
+  DEFAULT_PROVIDER
+]);
+var NAMEABLE_PROVIDERS = Object.keys(DEFAULT_MODELS).filter(
+  (name) => name !== "mock"
+);
+function assertKnownProvider(name, toError) {
+  if (PROVIDERS.has(name)) return;
+  throw toError(
+    `Unknown provider "${name}". Available: ${[...NAMEABLE_PROVIDERS, DEFAULT_PROVIDER].join(", ")}.`
+  );
+}
+function assertModelHasProvider(name, model, configKey, toError) {
+  if (name !== DEFAULT_PROVIDER || model == null) return;
+  throw toError(
+    `Model "${model}" was given without a provider: a model name does not say which provider owns it. Set --provider or ${configKey} to one of ${NAMEABLE_PROVIDERS.join(", ")}, or drop the model to take the detected provider's default.`
+  );
+}
+var PROVIDERS_KEY = "providers";
+var CONNECTION_KEYS = {
+  anthropic: ["apiKeyEnv"],
+  openai: ["baseUrl", "apiKeyEnv"],
+  "claude-cli": ["command"],
+  "llama-cpp": ["modelsDir", "thoughtTokens"]
+};
+var CONNECTION_NAMES = Object.keys(CONNECTION_KEYS);
+var TOP_LEVEL_KEYS = ["provider", "model", ...CONNECTION_NAMES];
+function isMapping(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function rejectUnknown(raw, allowed, label, source, toError) {
+  for (const key of Object.keys(raw)) {
+    if (!allowed.includes(key)) {
+      throw toError(
+        `${source}: "${label}" has unknown key "${key}". Supported keys: ${allowed.join(", ")}.`
+      );
+    }
+  }
+}
+function parseProviders(value, source, dir, toError) {
+  if (value == null) return {};
+  if (!isMapping(value)) {
+    throw toError(`${source}: "${PROVIDERS_KEY}" must be a mapping.`);
+  }
+  rejectUnknown(value, TOP_LEVEL_KEYS, PROVIDERS_KEY, source, toError);
+  const string = (raw, key, label) => {
+    const v = raw[key];
+    if (v === void 0) return void 0;
+    if (typeof v !== "string") {
+      throw toError(`${source}: "${label}" must be a string.`);
+    }
+    return v;
+  };
+  const parsed = {};
+  const provider = string(value, "provider", `${PROVIDERS_KEY}.provider`);
+  if (provider !== void 0) {
+    assertKnownProvider(provider, (message) => toError(`${source}: ${message}`));
+    parsed.provider = provider;
+  }
+  const model = string(value, "model", `${PROVIDERS_KEY}.model`);
+  if (model !== void 0) {
+    if (provider === void 0 || provider === DEFAULT_PROVIDER) {
+      throw toError(
+        `${source}: "${PROVIDERS_KEY}.model" was given without a provider: a model name does not say which provider owns it. Set ${PROVIDERS_KEY}.provider to one of ${NAMEABLE_PROVIDERS.join(", ")}, or drop the model to take the detected provider's default.`
+      );
+    }
+    parsed.model = model;
+  }
+  for (const name of CONNECTION_NAMES) {
+    const section = value[name];
+    if (section == null) continue;
+    const label = `${PROVIDERS_KEY}.${name}`;
+    if (!isMapping(section)) {
+      throw toError(`${source}: "${label}" must be a mapping.`);
+    }
+    rejectUnknown(section, CONNECTION_KEYS[name], label, source, toError);
+    const field = (key) => string(section, key, `${label}.${key}`);
+    switch (name) {
+      case "anthropic": {
+        const apiKeyEnv = field("apiKeyEnv");
+        parsed.anthropic = apiKeyEnv === void 0 ? {} : { apiKeyEnv };
+        break;
+      }
+      case "openai": {
+        const baseUrl = field("baseUrl");
+        const apiKeyEnv = field("apiKeyEnv");
+        parsed.openai = {
+          ...baseUrl !== void 0 ? { baseUrl } : {},
+          ...apiKeyEnv !== void 0 ? { apiKeyEnv } : {}
+        };
+        break;
+      }
+      case "claude-cli": {
+        const command = field("command");
+        parsed["claude-cli"] = command === void 0 ? {} : { command };
+        break;
+      }
+      case "llama-cpp": {
+        const modelsDir = field("modelsDir");
+        const thoughtTokens = section["thoughtTokens"];
+        if (thoughtTokens !== void 0 && (typeof thoughtTokens !== "number" || !Number.isInteger(thoughtTokens) || thoughtTokens < 0)) {
+          throw toError(
+            `${source}: "${label}.thoughtTokens" must be a whole number of 0 or more, got ${JSON.stringify(thoughtTokens)}.`
+          );
+        }
+        parsed["llama-cpp"] = {
+          ...modelsDir !== void 0 ? { modelsDir: resolve(dir, modelsDir) } : {},
+          ...thoughtTokens !== void 0 ? { thoughtTokens } : {}
+        };
+        break;
+      }
+    }
+  }
+  return parsed;
+}
+var LOCAL_PROVIDER = "llama-cpp";
+var LOCAL_FLAG_HELP = "run inference on this machine (llama-cpp); overrides any configured or eval-level provider";
+var LOCAL_COMPATIBLE = /* @__PURE__ */ new Set([LOCAL_PROVIDER, DEFAULT_PROVIDER, "mock"]);
+function assertLocalFlag(flag, toError) {
+  if (flag.local !== true || flag.provider === void 0) return;
+  assertKnownProvider(flag.provider, toError);
+  if (LOCAL_COMPATIBLE.has(flag.provider)) return;
+  throw toError(
+    `--local and --provider ${flag.provider} contradict each other: --local runs inference on this machine with ${LOCAL_PROVIDER}. Drop one of them.`
+  );
+}
+function selectProvider(flag, levels) {
+  if (flag.local === true) return selectLocal(flag, levels);
+  const provider = flag.provider ?? levels.find((level) => level.provider !== void 0)?.provider ?? DEFAULT_PROVIDER;
+  const model = flag.model ?? levels.find(
+    (level) => level.model !== void 0 && (level.provider === void 0 || level.provider === provider)
+  )?.model;
+  return { provider, model };
+}
+function selectLocal(flag, levels) {
+  const provider = flag.provider === "mock" ? "mock" : LOCAL_PROVIDER;
+  const model = flag.model ?? levels.find((level) => level.model !== void 0 && level.provider === provider)?.model;
+  const chosen = flag.provider === void 0 ? levels.find((level) => level.provider !== void 0) : void 0;
+  const replaced = chosen?.provider !== void 0 && chosen.origin !== void 0 && chosen.provider !== provider && chosen.provider !== DEFAULT_PROVIDER ? { provider: chosen.provider, source: chosen.origin } : void 0;
+  return replaced === void 0 ? { provider, model } : { provider, model, replaced };
+}
+function localNotice(selection) {
+  const { replaced } = selection;
+  if (replaced === void 0) return void 0;
+  return `--local: using ${LOCAL_PROVIDER} instead of "${replaced.provider}" from ${replaced.source}.`;
+}
+function providerSpecFor(connections, selection) {
+  const { provider, model } = selection;
+  const local = connections["llama-cpp"] ?? {};
+  const llamaCpp = {
+    thoughtTokens: local.thoughtTokens ?? 0,
+    ...local.modelsDir !== void 0 ? { modelsDirectory: local.modelsDir } : {}
+  };
+  switch (provider) {
+    case "anthropic":
+      return {
+        provider,
+        model,
+        apiKeyEnv: connections.anthropic?.apiKeyEnv ?? "ANTHROPIC_API_KEY"
+      };
+    case "openai":
+      return {
+        provider,
+        model,
+        apiKeyEnv: connections.openai?.apiKeyEnv ?? "OPENAI_API_KEY",
+        baseUrl: connections.openai?.baseUrl ?? DEFAULT_OPENAI_BASE_URL
+      };
+    case "claude-cli":
+      return { provider, model, command: connections["claude-cli"]?.command ?? "claude" };
+    case "llama-cpp":
+      return { provider, model, llamaCpp };
+    case "mock":
+      return { provider, model };
+    case "auto": {
+      const baseUrl = connections.openai?.baseUrl;
+      const command = connections["claude-cli"]?.command;
+      const configuredLocal = local.thoughtTokens !== void 0 || local.modelsDir !== void 0;
+      return {
+        provider,
+        model,
+        ...baseUrl !== void 0 ? { baseUrl } : {},
+        ...command !== void 0 ? { command } : {},
+        ...configuredLocal ? { llamaCpp } : {}
+      };
+    }
+  }
+}
+async function resolveIdentity(spec, toError) {
+  try {
+    return await resolveProviderIdentityAsync(spec);
+  } catch (err) {
+    throw toError(
+      err instanceof InferenceError ? err.message : `Could not resolve provider "${String(spec.provider)}": ${errorMessage(err)}`
+    );
+  }
+}
+
+// src/shared/encryption.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHmac,
+  hkdfSync,
+  randomBytes,
+  timingSafeEqual
+} from "node:crypto";
+import { TextDecoder } from "node:util";
+var ENCRYPTED_VALUE = /^~[A-Za-z0-9_-]{82,}$/;
+function isEncryptedValue(value) {
+  return typeof value === "string" && ENCRYPTED_VALUE.test(value);
+}
+var ENCRYPTION_KEY_SHAPE = /^[A-Za-z0-9_-]{32,}$/;
+function isValidEncryptionKey(value) {
+  return typeof value === "string" && ENCRYPTION_KEY_SHAPE.test(value);
+}
+function generateEncryptionKey() {
+  return randomBytes(32).toString("hex");
+}
+var VERSION = 1;
+var NONCE_BYTES = 12;
+var TAG_BYTES = 16;
+var BLOCK = 32;
+var MIN_BYTES = 1 + NONCE_BYTES + BLOCK + TAG_BYTES;
+var subkeyCache = /* @__PURE__ */ new Map();
+function subkeys(key) {
+  const cached = subkeyCache.get(key);
+  if (cached !== void 0) return cached;
+  const ikm = Buffer.from(key, "utf8");
+  const derive = (info) => Buffer.from(hkdfSync("sha256", ikm, Buffer.alloc(0), info, 32));
+  const made = {
+    encrypt: derive("manni/v1/encrypt"),
+    nonce: derive("manni/v1/nonce"),
+    pin: derive("manni/v1/pin")
+  };
+  subkeyCache.set(key, made);
+  return made;
+}
+function requireKey(key, caller) {
+  if (!isValidEncryptionKey(key)) {
+    throw new Error(
+      `${caller}: the key must be at least 32 hex or base64url characters.`
+    );
+  }
+}
+function pad(data) {
+  const out = Buffer.alloc((Math.floor(data.length / BLOCK) + 1) * BLOCK);
+  data.copy(out);
+  out[data.length] = 128;
+  return out;
+}
+function unpad(padded) {
+  let i = padded.length - 1;
+  while (i >= 0 && padded[i] === 0) i--;
+  if (i < 0 || padded[i] !== 128) return null;
+  if (padded.length !== (Math.floor(i / BLOCK) + 1) * BLOCK) return null;
+  return padded.subarray(0, i);
+}
+function nonceFor(keys, context, padded) {
+  return createHmac("sha256", keys.nonce).update(context).update(Buffer.from([0])).update(padded).digest().subarray(0, NONCE_BYTES);
+}
+function aad(context) {
+  return Buffer.concat([Buffer.from([VERSION]), context]);
+}
+function encryptValue(value, key, context) {
+  requireKey(key, "encryptValue");
+  const json = JSON.stringify(value);
+  if (json === void 0) {
+    throw new TypeError("encryptValue: the value is not JSON.");
+  }
+  const keys = subkeys(key);
+  const ctx = Buffer.from(context, "utf8");
+  const padded = pad(Buffer.from(json, "utf8"));
+  const nonce = nonceFor(keys, ctx, padded);
+  const cipher = createCipheriv("aes-256-gcm", keys.encrypt, nonce, {
+    authTagLength: TAG_BYTES
+  });
+  cipher.setAAD(aad(ctx));
+  const sealed = Buffer.concat([cipher.update(padded), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const bytes = Buffer.concat([Buffer.from([VERSION]), nonce, sealed, tag]);
+  return `~${bytes.toString("base64url")}`;
+}
+var FAILED = { ok: false };
+function decryptValue(token, key, context) {
+  try {
+    return open(token, key, context);
+  } catch {
+    return FAILED;
+  }
+}
+function open(token, key, context) {
+  if (!isEncryptedValue(token) || !isValidEncryptionKey(key)) return FAILED;
+  const body = token.slice(1);
+  const bytes = Buffer.from(body, "base64url");
+  if (bytes.toString("base64url") !== body) return FAILED;
+  if (bytes.length < MIN_BYTES) return FAILED;
+  if ((bytes.length - 1 - NONCE_BYTES - TAG_BYTES) % BLOCK !== 0) return FAILED;
+  if (bytes[0] !== VERSION) return FAILED;
+  const nonce = bytes.subarray(1, 1 + NONCE_BYTES);
+  const sealed = bytes.subarray(1 + NONCE_BYTES, bytes.length - TAG_BYTES);
+  const tag = bytes.subarray(bytes.length - TAG_BYTES);
+  const keys = subkeys(key);
+  const ctx = Buffer.from(context, "utf8");
+  const decipher = createDecipheriv("aes-256-gcm", keys.encrypt, nonce, {
+    authTagLength: TAG_BYTES
+  });
+  decipher.setAAD(aad(ctx));
+  decipher.setAuthTag(tag);
+  const padded = Buffer.concat([decipher.update(sealed), decipher.final()]);
+  if (!timingSafeEqual(nonceFor(keys, ctx, padded), nonce)) return FAILED;
+  const data = unpad(padded);
+  if (data === null) return FAILED;
+  const json = new TextDecoder("utf-8", { fatal: true }).decode(data);
+  const value = JSON.parse(json);
+  return { ok: true, value };
+}
+var KEYED_PIN_PREFIX = "hmac-sha256-";
+function keyedPin(text, key) {
+  requireKey(key, "keyedPin");
+  const mac = createHmac("sha256", subkeys(key).pin).update(text, "utf8").digest("hex");
+  return `${KEYED_PIN_PREFIX}${mac}`;
+}
+
+// src/shared/collections.ts
+import picomatch2 from "picomatch";
+
+// src/shared/globs.ts
+import picomatch from "picomatch";
+var matcherCache = /* @__PURE__ */ new Map();
+function matchesFileGlob(relPath, glob) {
+  const key = JSON.stringify(glob);
+  let m = matcherCache.get(key);
+  if (!m) {
+    m = picomatch(glob, { dot: true });
+    matcherCache.set(key, m);
+  }
+  return m(relPath.replace(/\\/g, "/"));
+}
+
+// src/shared/collections.ts
+import { posix as posix2, win32 } from "node:path";
+
+// src/shared/page-manifest.ts
+import { readFileSync, realpathSync } from "node:fs";
+import { isAbsolute, posix, relative, resolve as resolve2, sep } from "node:path";
+import fg from "fast-glob";
+import { LineCounter, isMap, isNode, isScalar, parseDocument } from "yaml";
+var PAGE_PLACEHOLDER = "{page}";
+function hasPagePlaceholder(file) {
+  return file.includes(PAGE_PLACEHOLDER);
+}
+function slashes(path) {
+  return path.split(sep).join("/").replace(/\\/g, "/");
+}
+function normalizeManifestPattern(file) {
+  const forward = file.replace(/\\/g, "/");
+  return forward.startsWith("./") ? forward.slice(2) : forward;
+}
+function pageManifestPath(file, configDir, pageAbs) {
+  const between = relative(configDir, pageAbs);
+  const pageRel = slashes(between);
+  if (isAbsolute(between) || pageRel === ".." || pageRel.startsWith("../")) {
+    return { outside: true, pageRel };
+  }
+  const ext = posix.extname(pageRel);
+  const page = ext === "" ? pageRel : pageRel.slice(0, -ext.length);
+  const named = normalizeManifestPattern(file).replace(PAGE_PLACEHOLDER, () => page);
+  const abs = resolve2(configDir, named);
+  return { abs, rel: slashes(relative(configDir, abs)) };
+}
+function strayManifestGlob(file) {
+  const normalized = normalizeManifestPattern(file);
+  const at = normalized.indexOf(PAGE_PLACEHOLDER);
+  if (at < 0) return literal(normalized);
+  const prefix = literal(normalized.slice(0, at));
+  const suffix = literal(normalized.slice(at + PAGE_PLACEHOLDER.length));
+  return `${prefix}**/*${suffix}`;
+}
+function literal(text) {
+  return text === "" ? "" : fg.escapePath(text);
+}
+function findPageManifests(file, configDir, isMember2, skip = /* @__PURE__ */ new Set()) {
+  const matched = fg.sync(strayManifestGlob(file), {
+    cwd: configDir,
+    absolute: true,
+    onlyFiles: true,
+    dot: false,
+    ignore: ["**/node_modules/**", "**/.git/**"]
+  }).map((path) => resolve2(path)).sort();
+  const found = [];
+  for (const abs of matched) {
+    if (skip.has(abs)) continue;
+    const entries = ownEntries(abs, file, configDir, isMember2);
+    if (entries.length > 0) found.push({ abs, entries });
+  }
+  return found;
+}
+function ownEntries(abs, file, configDir, isMember2) {
+  let text;
+  try {
+    text = readFileSync(abs, "utf8");
+  } catch {
+    return [];
+  }
+  const lc = new LineCounter();
+  const doc = parseDocument(text, { lineCounter: lc, uniqueKeys: false });
+  const root = doc.contents;
+  if (doc.errors.length > 0 || !isMap(root)) return [];
+  const entries = [];
+  for (const pair of root.items) {
+    const spelled = isScalar(pair.key) ? String(pair.key.value) : String(pair.key);
+    const pageAbs = resolve2(configDir, spelled);
+    if (!isMember2(slashes(relative(configDir, pageAbs)))) continue;
+    const resolved = pageManifestPath(file, configDir, pageAbs);
+    if ("outside" in resolved || !sameFile(resolved.abs, abs)) continue;
+    const range = isNode(pair.key) ? pair.key.range : void 0;
+    entries.push({
+      spelled,
+      pageAbs,
+      ...range ? { line: lc.linePos(range[0]).line } : {}
+    });
+  }
+  return entries;
+}
+function sameFile(a, b) {
+  if (a === b) return true;
+  try {
+    return realpathSync(a) === realpathSync(b);
+  } catch {
+    return false;
+  }
+}
+
+// src/shared/collections.ts
+var COLLECTION_KEYS = [
+  "name",
+  "paths",
+  "exclude",
+  "url",
+  "externalMetadata"
+];
+var EXTERNAL_METADATA_KEYS = ["file", "keys", "tokenEnv", "join"];
+var PATH_JOIN = "path";
+var SCHEMA_KEY = "$schema";
+var STDIN = "<stdin>";
+function isUrlRef(ref) {
+  return /^https?:\/\//i.test(ref);
+}
+function externalMetadataUrlProblem(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return "is not a valid URL";
+  }
+  if (parsed.username !== "" || parsed.password !== "") {
+    return 'carries a credential in the URL; put the token in an environment variable and name it with "tokenEnv"';
+  }
+  if (parsed.protocol === "https:") return null;
+  if (parsed.protocol === "http:" && isLoopback(parsed.hostname)) return null;
+  if (parsed.protocol === "http:") {
+    return "is plain http://; a bearer token over plaintext is a leak, and a public manifest is served over https too";
+  }
+  return `has the unsupported scheme "${parsed.protocol}"`;
+}
+function isLoopback(host) {
+  return host === "localhost" || host === "127.0.0.1" || host === "[::1]" || host === "::1" || host.startsWith("127.");
+}
+function rejectUnknownKeys(raw, allowed, where, source, toError) {
+  for (const key of Object.keys(raw)) {
+    if (!allowed.includes(key)) {
+      throw toError(
+        `${source}: ${where} has unknown key "${key}". Supported keys: ${allowed.join(", ")}.`
+      );
+    }
+  }
+}
+function isMapping2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function parseCollections(raw, source, toError) {
+  if (!Array.isArray(raw)) {
+    throw toError(`${source}: "collections" must be a list.`);
+  }
+  if (raw.length === 0) {
+    throw toError(
+      `${source}: "collections" must name at least one collection; remove the key if there are none.`
+    );
+  }
+  const taken = /* @__PURE__ */ new Map();
+  return raw.map((entry, i) => {
+    const where = `collections[${i}]`;
+    if (!isMapping2(entry)) {
+      throw toError(`${source}: ${where} must be a mapping.`);
+    }
+    rejectUnknownKeys(entry, COLLECTION_KEYS, where, source, toError);
+    if (!isNonEmptyString(entry.name)) {
+      throw toError(`${source}: ${where}.name must be a non-empty string.`);
+    }
+    const name = entry.name;
+    const folded = name.toLowerCase();
+    if (folded === "docs") {
+      throw toError(
+        `${source}: ${where}.name "${name}" collides with the docs table every query reads. Pick another name, such as "site" or "pages".`
+      );
+    }
+    if (folded === "derived" || folded === "_derived_rows" || folded === "resolved") {
+      throw toError(
+        `${source}: ${where}.name "${name}" collides with the derived table a query builds beside docs (the derived view, its _derived_rows table, and the resolved view over both). Pick another name.`
+      );
+    }
+    if (folded.startsWith("sqlite_")) {
+      throw toError(
+        `${source}: ${where}.name "${name}" starts with "sqlite_", which SQLite reserves for its own objects. Pick another name.`
+      );
+    }
+    const owner = taken.get(folded);
+    if (owner !== void 0) {
+      throw toError(
+        `${source}: ${where}.name "${name}" is already taken by collections[${owner}]; names are compared case-insensitively because they become SQL views.`
+      );
+    }
+    taken.set(folded, i);
+    if (!Array.isArray(entry.paths) || entry.paths.length === 0 || entry.paths.some((p) => !isNonEmptyString(p))) {
+      throw toError(
+        `${source}: ${where}.paths must be a non-empty list of files, directories or globs.`
+      );
+    }
+    const paths = entry.paths;
+    let exclude = [];
+    if (entry.exclude !== void 0) {
+      if (!Array.isArray(entry.exclude) || entry.exclude.some((g) => !isNonEmptyString(g))) {
+        throw toError(`${source}: ${where}.exclude must be a list of globs.`);
+      }
+      exclude = entry.exclude;
+    }
+    let url;
+    if (entry.url !== void 0) {
+      if (typeof entry.url !== "string" || !isHttpUrl(entry.url)) {
+        throw toError(`${source}: ${where}.url must be an http(s) URL.`);
+      }
+      url = entry.url;
+    }
+    let externalMetadata = [];
+    if (entry.externalMetadata !== void 0) {
+      if (!Array.isArray(entry.externalMetadata)) {
+        throw toError(`${source}: ${where}.externalMetadata must be a list.`);
+      }
+      externalMetadata = parseExternalMetadata(
+        entry.externalMetadata,
+        where,
+        source,
+        toError
+      );
+    }
+    return {
+      name,
+      paths,
+      exclude,
+      externalMetadata,
+      ...url === void 0 ? {} : { url }
+    };
+  });
+}
+function isHttpUrl(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return false;
+  }
+  return parsed.protocol === "http:" || parsed.protocol === "https:";
+}
+function parseExternalMetadata(raw, collectionWhere, source, toError) {
+  const owners = /* @__PURE__ */ new Map();
+  const patterns = /* @__PURE__ */ new Map();
+  let keyless;
+  const parsedEntries = raw.map((entry, i) => {
+    const where = `${collectionWhere}.externalMetadata[${i}]`;
+    if (!isMapping2(entry)) {
+      throw toError(`${source}: ${where} must be a mapping.`);
+    }
+    rejectUnknownKeys(entry, EXTERNAL_METADATA_KEYS, where, source, toError);
+    if (!isNonEmptyString(entry.file)) {
+      throw toError(
+        `${source}: ${where}.file must be a non-empty string naming the manifest, relative to the config file.`
+      );
+    }
+    const placeholderProblem = pagePlaceholderProblem(entry.file);
+    if (placeholderProblem !== null) {
+      throw toError(`${source}: ${where}.file ${placeholderProblem}`);
+    }
+    const perPage = hasPagePlaceholder(entry.file);
+    if (perPage && (posix2.isAbsolute(entry.file) || win32.isAbsolute(entry.file))) {
+      throw toError(
+        `${source}: ${where}.file uses ${PAGE_PLACEHOLDER} in an absolute path, so every manifest would sit outside the repository. Make it relative to the config file.`
+      );
+    }
+    if (entry.keys !== void 0 && (!Array.isArray(entry.keys) || entry.keys.length === 0 || entry.keys.some((k) => !isNonEmptyString(k)))) {
+      throw toError(
+        `${source}: ${where}.keys must be a non-empty list of key names.`
+      );
+    }
+    if (entry.keys === void 0) {
+      if (keyless !== void 0) {
+        throw toError(
+          `${source}: ${collectionWhere}.externalMetadata: entries ${String(keyless)} and ${String(i)} both omit keys; at most one manifest may own the external-marked fields`
+        );
+      }
+      keyless = i;
+    }
+    const isUrl = isUrlRef(entry.file);
+    if (isUrl) {
+      const problem = externalMetadataUrlProblem(entry.file);
+      if (problem !== null) {
+        throw toError(`${source}: ${where}.file ${problem}.`);
+      }
+      if (perPage) {
+        throw toError(
+          `${source}: ${where}.file uses ${PAGE_PLACEHOLDER} in a URL. A placeholder names a file this run can write, and a URL is not one.`
+        );
+      }
+    }
+    if (entry.tokenEnv !== void 0) {
+      if (!isNonEmptyString(entry.tokenEnv)) {
+        throw toError(
+          `${source}: ${where}.tokenEnv must be the name of an environment variable.`
+        );
+      }
+      if (!isUrl) {
+        throw toError(
+          `${source}: ${where}.tokenEnv is set, but "file" is a path, so no request is made and the token would go nowhere. Remove it, or make "file" a URL.`
+        );
+      }
+    }
+    const keys = entry.keys === void 0 ? void 0 : entry.keys;
+    if (entry.join !== void 0) {
+      if (!isNonEmptyString(entry.join)) {
+        throw toError(
+          `${source}: ${where}.join must be "path" or the name of a top-level frontmatter field.`
+        );
+      }
+      if (entry.join === SCHEMA_KEY) {
+        throw toError(`${source}: ${where}.join may not be "${SCHEMA_KEY}".`);
+      }
+      if (keys?.includes(entry.join) === true) {
+        throw toError(
+          `${source}: ${where}.join names "${entry.join}", which the same entry owns \u2014 the value that selects an entry cannot come from the entry.`
+        );
+      }
+    }
+    if (perPage && typeof entry.join === "string" && entry.join !== PATH_JOIN) {
+      throw toError(
+        `${source}: ${where}.file uses ${PAGE_PLACEHOLDER}, and join is "${entry.join}". A per-page manifest is found by path, so it cannot be keyed by a field. Remove ${PAGE_PLACEHOLDER}, or remove join.`
+      );
+    }
+    const seen = /* @__PURE__ */ new Set();
+    for (const key of keys ?? []) {
+      if (key === SCHEMA_KEY) {
+        throw toError(
+          `${source}: ${where}.keys may not include "${SCHEMA_KEY}" \u2014 a manifest never chooses the schema a document is judged by; use "overrides".`
+        );
+      }
+      if (seen.has(key)) {
+        throw toError(`${source}: ${where}.keys lists "${key}" twice.`);
+      }
+      seen.add(key);
+      const owner = owners.get(key);
+      if (owner !== void 0) {
+        throw toError(
+          `${source}: ${where}.keys claims "${key}", which externalMetadata[${owner}] already owns \u2014 a key has exactly one manifest in a collection.`
+        );
+      }
+      owners.set(key, i);
+    }
+    if (perPage) {
+      const pattern = normalizeManifestPattern(entry.file);
+      const first = patterns.get(pattern);
+      if (first !== void 0) {
+        throw toError(
+          `${source}: ${where}.file resolves to the same manifest as externalMetadata[${String(first)}].file for every page. Give each entry its own file name.`
+        );
+      }
+      patterns.set(pattern, i);
+    }
+    const parsed = {
+      file: entry.file,
+      ...keys === void 0 ? {} : { keys },
+      ...typeof entry.tokenEnv === "string" ? { tokenEnv: entry.tokenEnv } : {},
+      ...typeof entry.join === "string" ? { join: entry.join } : {}
+    };
+    origins.set(parsed, { source, where });
+    return parsed;
+  });
+  for (const manifest of parsedEntries) {
+    if (manifest.keys === void 0) declaredNever.set(manifest, neverOwnedIn(parsedEntries, manifest));
+  }
+  return parsedEntries;
+}
+function pagePlaceholderProblem(file) {
+  for (const match of file.matchAll(/\{[^{}]*\}/g)) {
+    if (match[0] !== PAGE_PLACEHOLDER) {
+      return `uses "${match[0]}", which is not a placeholder. The only placeholder is ${PAGE_PLACEHOLDER}.`;
+    }
+  }
+  const tokens = file.split(PAGE_PLACEHOLDER);
+  const stray = /[{}]/.exec(tokens.join(""));
+  if (stray !== null) {
+    return `contains "${stray[0]}" outside a ${PAGE_PLACEHOLDER} placeholder. Remove it, or write ${PAGE_PLACEHOLDER}.`;
+  }
+  if (tokens.length > 2) {
+    return `uses ${PAGE_PLACEHOLDER} twice. One manifest names one page.`;
+  }
+  return null;
+}
+var origins = /* @__PURE__ */ new WeakMap();
+function externalMetadataOrigin(entry) {
+  return origins.get(entry);
+}
+function ownsKey(collection, manifest, key, marked) {
+  if (manifest.keys !== void 0) return manifest.keys.includes(key);
+  if (marked === void 0 || !marked.has(key)) return false;
+  return !neverOwned(collection, manifest).has(key);
+}
+function neverOwned(collection, manifest) {
+  return declaredNever.get(manifest) ?? neverOwnedIn(collection.externalMetadata, manifest);
+}
+function neverOwnedIn(manifests, manifest) {
+  const out = /* @__PURE__ */ new Set([SCHEMA_KEY]);
+  if (manifest.join !== void 0 && manifest.join !== PATH_JOIN) out.add(manifest.join);
+  for (const other of manifests) {
+    if (other === manifest) continue;
+    for (const key of other.keys ?? []) out.add(key);
+  }
+  return out;
+}
+var declaredNever = /* @__PURE__ */ new WeakMap();
+function selectCollections(collections, names, source, toError) {
+  if (names === void 0 || names.length === 0) return [...collections];
+  const wanted = new Set(names);
+  for (const name of wanted) {
+    if (!collections.some((c) => c.name === name)) {
+      const configured = collections.length === 0 ? "(none)" : collections.map((c) => c.name).join(", ");
+      const nearMiss = collections.find(
+        (c) => c.name.toLowerCase() === name.toLowerCase()
+      );
+      const hint = nearMiss === void 0 ? "" : ` Names are case-sensitive; did you mean "${nearMiss.name}"?`;
+      throw toError(
+        `no collection named "${name}" in ${source}. Configured: ${configured}.${hint}`
+      );
+    }
+  }
+  return collections.filter((c) => wanted.has(c.name));
+}
+function isMember(collection, relPath) {
+  if (relPath === STDIN) return false;
+  if (relPath.startsWith("../")) return false;
+  return matchesCollectionPaths(collection, relPath);
+}
+function matchesCollectionPaths(collection, relPath) {
+  const matched = collection.paths.some((entry) => {
+    const normalized = normalizeEntry(entry);
+    if (normalized === "") return false;
+    if (isGlob(normalized)) return matchesFileGlob(relPath, normalized);
+    return relPath === normalized || relPath.startsWith(`${normalized}/`);
+  });
+  if (!matched) return false;
+  return !collection.exclude.some((glob) => matchesFileGlob(relPath, glob));
+}
+function normalizeEntry(entry) {
+  const posix3 = entry.replace(/\\/g, "/").replace(/^\.\//, "");
+  return posix3.endsWith("/") ? posix3.slice(0, -1) : posix3;
+}
+function isGlob(entry) {
+  return picomatch2.scan(entry).isGlob;
+}
+
+// src/shared/tools.ts
+import { isAbsolute as isAbsolute2, resolve as resolve3 } from "node:path";
+var TOOL_KEYS = ["vale", "dita-ot"];
+var VALE_KEYS = ["config"];
+var DITA_OT_KEYS = ["home"];
+function isMapping3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function rejectUnknownKeys2(raw, allowed, where, source, toError) {
+  for (const key of Object.keys(raw)) {
+    if (!allowed.includes(key)) {
+      throw toError(
+        `${source}: ${where} has unknown key "${key}". Supported keys: ${allowed.join(", ")}.`
+      );
+    }
+  }
+}
+function parseTools(raw, source, toError) {
+  if (raw === null || raw === void 0) return {};
+  if (!isMapping3(raw)) {
+    throw toError(`${source}: "tools" must be a mapping.`);
+  }
+  rejectUnknownKeys2(raw, TOOL_KEYS, "tools", source, toError);
+  const tools = {};
+  if (Object.hasOwn(raw, "vale")) {
+    tools.vale = parseVale(raw["vale"], source, toError);
+  }
+  if (Object.hasOwn(raw, "dita-ot")) {
+    tools["dita-ot"] = parseDitaOt(raw["dita-ot"], source, toError);
+  }
+  return tools;
+}
+function parseVale(raw, source, toError) {
+  if (!isMapping3(raw)) {
+    throw toError(`${source}: tools.vale must be a mapping.`);
+  }
+  rejectUnknownKeys2(raw, VALE_KEYS, "tools.vale", source, toError);
+  const vale = {};
+  if (Object.hasOwn(raw, "config")) {
+    const config = raw["config"];
+    if (typeof config !== "string" || config.trim() === "") {
+      throw toError(`${source}: tools.vale.config must be a non-empty string.`);
+    }
+    vale.config = config;
+  }
+  return vale;
+}
+function parseDitaOt(raw, source, toError) {
+  if (!isMapping3(raw)) {
+    throw toError(`${source}: tools.dita-ot must be a mapping.`);
+  }
+  rejectUnknownKeys2(raw, DITA_OT_KEYS, "tools.dita-ot", source, toError);
+  const ditaOt = {};
+  if (Object.hasOwn(raw, "home")) {
+    const home = raw["home"];
+    if (typeof home !== "string" || home.trim() === "") {
+      throw toError(`${source}: tools.dita-ot.home must be a non-empty string.`);
+    }
+    ditaOt.home = home;
+  }
+  return ditaOt;
+}
+function valeConfigPath(tools, configDir) {
+  const config = tools.vale?.config;
+  if (config === void 0) return void 0;
+  return isAbsolute2(config) ? config : resolve3(configDir, config);
+}
+function ditaOtHome(tools, configDir) {
+  const home = tools["dita-ot"]?.home;
+  if (home === void 0) return void 0;
+  return isAbsolute2(home) ? home : resolve3(configDir, home);
+}
+
+// src/shared/config-file.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { basename, dirname as dirname2, join as join2, relative as relative2, resolve as resolve5 } from "node:path";
+import { parse as parseYaml } from "yaml";
+
+// src/shared/git-root.ts
+import { existsSync } from "node:fs";
+import { dirname, join, resolve as resolve4 } from "node:path";
+function findGitRoot(cwd) {
+  let dir = resolve4(cwd);
+  for (; ; ) {
+    if (existsSync(join(dir, ".git"))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function searchPath(cwd) {
+  const start = resolve4(cwd);
+  const root = findGitRoot(start);
+  if (root === null) return [start];
+  const chain = [];
+  let dir = start;
+  for (; ; ) {
+    chain.push(dir);
+    if (dir === root) return chain;
+    const parent = dirname(dir);
+    if (parent === dir) return chain;
+    dir = parent;
+  }
+}
+
+// src/shared/config-file.ts
+var FAMILY_CONFIG_NAMES = [
+  "manni.config.yaml",
+  "manni.config.yml"
+];
+var ENCRYPTION_KEY_FIELD = "encryptionKey";
+var ENCRYPTION_KEY_PREVIOUS_FIELD = "encryptionKeyPrevious";
+function readDocument(path, source, toError) {
+  let text;
+  try {
+    text = readFileSync2(path, "utf8");
+  } catch {
+    return null;
+  }
+  return { text, doc: parseMapping(text, source, toError) };
+}
+function parseMapping(text, source, toError) {
+  let raw;
+  try {
+    raw = parseYaml(text);
+  } catch (err) {
+    throw toError(`${source}: invalid YAML: ${errorMessage(err)}`);
+  }
+  if (raw == null) return null;
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    throw toError(`${source}: top level must be a mapping.`);
+  }
+  return raw;
+}
+var COLLECTIONS_KEY = "collections";
+var TOOLS_KEY = "tools";
+var FAMILY_KEYS = [
+  COLLECTIONS_KEY,
+  TOOLS_KEY,
+  ENCRYPTION_KEY_FIELD,
+  PROVIDERS_KEY
+];
+function slice(document, opts) {
+  const { doc } = document;
+  if (doc !== null && Object.hasOwn(doc, opts.section)) {
+    return { value: doc[opts.section] ?? null, wrapped: true };
+  }
+  if (doc !== null && FAMILY_KEYS.some((key) => Object.hasOwn(doc, key))) {
+    return { value: null, wrapped: true };
+  }
+  return null;
+}
+function collectionsOf(document, source, toError) {
+  const { doc } = document;
+  if (doc === null || !Object.hasOwn(doc, COLLECTIONS_KEY)) return [];
+  return parseCollections(doc[COLLECTIONS_KEY], source, toError);
+}
+function toolsOf(document, source, toError) {
+  const { doc } = document;
+  if (doc === null || !Object.hasOwn(doc, TOOLS_KEY)) return {};
+  return parseTools(doc[TOOLS_KEY], source, toError);
+}
+function encryptionKeyOf(document, source, toError) {
+  const { doc } = document;
+  if (doc === null) return {};
+  const keys = {};
+  if (Object.hasOwn(doc, ENCRYPTION_KEY_FIELD)) {
+    const value = doc[ENCRYPTION_KEY_FIELD];
+    if (!isValidEncryptionKey(value)) {
+      throw toError(
+        `${source}: "${ENCRYPTION_KEY_FIELD}" must be at least 32 hex or base64url characters. Run \`manni key set\` to generate one.`
+      );
+    }
+    keys.encryptionKey = value;
+  }
+  if (Object.hasOwn(doc, ENCRYPTION_KEY_PREVIOUS_FIELD)) {
+    const value = doc[ENCRYPTION_KEY_PREVIOUS_FIELD];
+    if (!isValidEncryptionKey(value)) {
+      throw toError(
+        `${source}: "${ENCRYPTION_KEY_PREVIOUS_FIELD}" must be at least 32 hex or base64url characters.`
+      );
+    }
+    keys.encryptionKeyPrevious = value;
+  }
+  return keys;
+}
+function providersOf(document, source, dir, toError) {
+  const { doc } = document;
+  if (doc === null || !Object.hasOwn(doc, PROVIDERS_KEY)) return {};
+  return { providers: parseProviders(doc[PROVIDERS_KEY], source, dir, toError) };
+}
+function tolerantKeysOf(document) {
+  const key = document.doc?.[ENCRYPTION_KEY_FIELD];
+  const previous = document.doc?.[ENCRYPTION_KEY_PREVIOUS_FIELD];
+  return {
+    ...isValidEncryptionKey(key) ? { encryptionKey: key } : {},
+    ...isValidEncryptionKey(previous) ? { encryptionKeyPrevious: previous } : {}
+  };
+}
+function relativeSource(cwd, path) {
+  return relative2(cwd, path).replace(/\\/g, "/");
+}
+function findConfigFileSync(cwd, opts) {
+  const start = resolve5(cwd);
+  for (const dir of searchPath(start)) {
+    for (const name of FAMILY_CONFIG_NAMES) {
+      const path = join2(dir, name);
+      const source = relativeSource(start, path);
+      const document = readDocument(path, source, opts.toError);
+      if (document === null) continue;
+      const found = slice(document, opts);
+      if (found === null) continue;
+      return {
+        path,
+        dir,
+        source,
+        text: document.text,
+        kind: "manni",
+        collections: collectionsOf(document, source, opts.toError),
+        tools: toolsOf(document, source, opts.toError),
+        ...encryptionKeyOf(document, source, opts.toError),
+        ...providersOf(document, source, dir, opts.toError),
+        ...found
+      };
+    }
+    for (const name of opts.legacyNames) {
+      const path = join2(dir, name);
+      const source = relativeSource(start, path);
+      const document = readDocument(path, source, opts.toError);
+      if (document === null) continue;
+      warn(
+        `"${name}" is a deprecated config file name. Move its keys under \`${opts.section}:\` in "${FAMILY_CONFIG_NAMES[0] ?? "manni.config.yaml"}", and its paths, exclude and sidecars keys to a top-level collections: list, where sidecars becomes externalMetadata.`
+      );
+      return {
+        path,
+        dir,
+        source,
+        text: document.text,
+        value: document.doc,
+        wrapped: false,
+        kind: "legacy",
+        collections: [],
+        tools: {}
+      };
+    }
+  }
+  return null;
+}
+function readConfigFileSync(explicitPath, cwd, opts) {
+  const path = resolve5(cwd, explicitPath);
+  const document = readDocument(path, explicitPath, opts.toError);
+  if (document === null) {
+    throw opts.toError(`Config file not found: "${explicitPath}".`);
+  }
+  const found = slice(document, opts) ?? {
+    value: document.doc,
+    wrapped: false
+  };
+  return {
+    path,
+    dir: dirname2(path),
+    source: explicitPath,
+    text: document.text,
+    kind: "explicit",
+    collections: collectionsOf(document, explicitPath, opts.toError),
+    tools: toolsOf(document, explicitPath, opts.toError),
+    // An unwrapped document carries no family key (else it would be wrapped),
+    // so this only ever reads a family file's key.
+    ...encryptionKeyOf(document, explicitPath, opts.toError),
+    ...providersOf(document, explicitPath, dirname2(path), opts.toError),
+    ...found
+  };
+}
+function findConfigFile(cwd, opts) {
+  return Promise.resolve().then(() => findConfigFileSync(cwd, opts));
+}
+function readConfigFile(explicitPath, cwd, opts) {
+  return Promise.resolve().then(
+    () => readConfigFileSync(explicitPath, cwd, opts)
+  );
+}
+function findFamilyConfigFile(cwd, toError) {
+  return Promise.resolve().then(() => findFamilyConfigFileSync(cwd, toError));
+}
+function findFamilyConfigFileSync(cwd, toError) {
+  const start = resolve5(cwd);
+  for (const dir of searchPath(start)) {
+    for (const name of FAMILY_CONFIG_NAMES) {
+      const path = join2(dir, name);
+      const source = relativeSource(start, path);
+      const document = readDocument(path, source, toError);
+      if (document === null) continue;
+      return {
+        path,
+        dir,
+        source,
+        text: document.text,
+        value: null,
+        wrapped: true,
+        kind: "manni",
+        collections: collectionsOf(document, source, toError),
+        tools: toolsOf(document, source, toError),
+        ...tolerantKeysOf(document)
+      };
+    }
+  }
+  return null;
+}
+function readFamilyConfigFile(explicitPath, cwd, toError) {
+  return Promise.resolve().then(
+    () => readFamilyConfigFileSync(explicitPath, cwd, toError)
+  );
+}
+function readFamilyConfigFileSync(explicitPath, cwd, toError) {
+  const path = resolve5(cwd, explicitPath);
+  const document = readDocument(path, explicitPath, toError);
+  if (document === null) {
+    throw toError(`Config file not found: "${explicitPath}".`);
+  }
+  const { doc } = document;
+  const named = FAMILY_CONFIG_NAMES.includes(basename(path));
+  const family = doc === null || named || FAMILY_KEYS.some((key) => Object.hasOwn(doc, key));
+  return {
+    path,
+    dir: dirname2(path),
+    source: explicitPath,
+    text: document.text,
+    value: family ? null : doc,
+    wrapped: family,
+    kind: "explicit",
+    collections: collectionsOf(document, explicitPath, toError),
+    tools: toolsOf(document, explicitPath, toError),
+    ...tolerantKeysOf(document)
+  };
+}
+
+export {
+  warn,
+  notice,
+  noticeOnce,
+  assertKnownProvider,
+  assertModelHasProvider,
+  PROVIDERS_KEY,
+  parseProviders,
+  LOCAL_FLAG_HELP,
+  assertLocalFlag,
+  selectProvider,
+  localNotice,
+  providerSpecFor,
+  resolveIdentity,
+  isEncryptedValue,
+  isValidEncryptionKey,
+  generateEncryptionKey,
+  encryptValue,
+  decryptValue,
+  KEYED_PIN_PREFIX,
+  keyedPin,
+  matchesFileGlob,
+  PAGE_PLACEHOLDER,
+  hasPagePlaceholder,
+  pageManifestPath,
+  findPageManifests,
+  sameFile,
+  externalMetadataUrlProblem,
+  parseCollections,
+  externalMetadataOrigin,
+  ownsKey,
+  neverOwned,
+  selectCollections,
+  isMember,
+  matchesCollectionPaths,
+  findGitRoot,
+  valeConfigPath,
+  ditaOtHome,
+  FAMILY_CONFIG_NAMES,
+  ENCRYPTION_KEY_FIELD,
+  ENCRYPTION_KEY_PREVIOUS_FIELD,
+  findConfigFileSync,
+  readConfigFileSync,
+  findConfigFile,
+  readConfigFile,
+  findFamilyConfigFile,
+  readFamilyConfigFile
+};
+//# sourceMappingURL=chunk-Q35YIDBV.js.map