@legioncodeinc/nectar 0.0.1 → 0.1.0

package/dist/embeddings/cohere-portkey.js

@@ -1,171 +0,0 @@
-/**
- * The Cohere-via-Portkey embeddings transport (PRD-014b — the operator opt-in).
- *
- * Modeled on honeycomb's shipped Cohere-rerank-via-Portkey transport
- * (`honeycomb/src/daemon/runtime/recall/rerank-portkey.ts`): it reuses the SAME
- * `x-portkey-api-key` + `x-portkey-config` auth pair (via
- * {@link buildPortkeyHeaders}) and the SAME gateway host; the ONE difference is
- * the path — `/v1/embeddings` ({@link PORTKEY_EMBEDDINGS_URL}) instead of
- * `/v1/rerank` — and the request/response shape.
- *
- * ── Model + dimension are config, not hardcoded (decision #30) ───────────────
- * The opt-in targets Cohere `embed-v4.0` with `output_dimension: 768` so it
- * produces contract-valid 768-dim vectors instead of guard-discarded 1024-dim
- * ones. Both the model id and the output dimension are config values
- * ({@link CohereEmbeddingsConfig}); recall's 768-dim guard (`guard.ts`) stays as
- * the backstop for whatever the gateway actually returns.
- *
- * ── Fail-soft is the cardinal rule (AC-4 / US-014b.3) ────────────────────────
- * EVERY failure path — Portkey not keyed, a network/transport error, a non-2xx
- * gateway status, or a malformed body — resolves to `null` for the affected
- * texts, NEVER a throw into the caller's hot path. A bounded retry covers 429 +
- * transient 5xx (the same statuses the sibling chat transport retries); the
- * bound is exhausted to nulls rather than thrown.
- *
- * ── The secret-never-logged invariant (US-014b.3) ────────────────────────────
- * The resolved key is placed ONLY in the `x-portkey-api-key` header (via
- * {@link buildPortkeyHeaders}) and is NEVER included in a returned value, a log
- * line, or an error. On any failure the response body is not read into a message
- * (it could echo a credential).
- */
-import { buildPortkeyHeaders, PORTKEY_EMBEDDINGS_URL } from "../portkey/headers.js";
-import { defaultFetch, defaultSleep } from "./http.js";
-/** SIGNED OFF 2026-07-02 (decision #30): the Cohere embed model the opt-in targets. Config-overridable. */
-export const DEFAULT_COHERE_EMBED_MODEL = "embed-v4.0";
-/**
- * SIGNED OFF 2026-07-02 (decision #30): the requested output dimension. 768 keeps
- * the opt-in on the fixed 768-dim contract; the guard discards anything else.
- * Config-overridable. (Cohere's documented Matryoshka set for embed-v4.0 is
- * [256, 512, 1024, 1536]; if the gateway ignores 768 the guard degrades to BM25.
- * See the module report.)
- */
-export const DEFAULT_COHERE_OUTPUT_DIMENSION = 768;
-/** HTTP statuses that trigger a bounded retry (429 rate limit + transient 5xx), matching the chat transport. */
-export const COHERE_RETRYABLE_STATUSES = new Set([429, 500, 502, 503, 504]);
-/** Maximum attempts including the first POST (mirrors `src/portkey/transport.ts`'s `PORTKEY_MAX_ATTEMPTS`). */
-export const DEFAULT_COHERE_MAX_ATTEMPTS = 3;
-/** Backoff between retryable failures in ms (mirrors `src/portkey/transport.ts`'s backoff). */
-export const DEFAULT_COHERE_RETRY_BACKOFF_MS = 250;
-/**
- * Per-attempt request timeout (ms), mirroring `deeplake-transport.ts`'s
- * `DEFAULT_TRANSPORT_TIMEOUT_MS` AbortController pattern: an unresponsive gateway
- * aborts rather than hanging the embed path indefinitely (fail-soft, AC-4).
- */
-export const DEFAULT_COHERE_REQUEST_TIMEOUT_MS = 15_000;
-/** All-nulls result of length `n` (the fail-soft shape, built in one place). */
-function allNull(n) {
-    return new Array(n).fill(null);
-}
-/**
- * Parse the embeddings response into one vector (or `null`) per input index,
- * defensively. Primary shape is Portkey's OpenAI-compatible
- * `{ data: [{ embedding: number[], index }] }`; a Cohere-native
- * `{ embeddings: number[][] }` or `{ embeddings: { float: number[][] } }` body is
- * tolerated as a fallback. Anything else yields all-nulls. Never throws. The
- * per-vector dimension is NOT checked here — the guard owns that (AC-3).
- */
-export function parseEmbeddingsResponse(raw, count) {
-    let body;
-    try {
-        body = raw.length > 0 ? JSON.parse(raw) : null;
-    }
-    catch {
-        return allNull(count);
-    }
-    if (typeof body !== "object" || body === null)
-        return allNull(count);
-    const out = allNull(count);
-    const asFinite = (v) => Array.isArray(v) && v.every((n) => typeof n === "number" && Number.isFinite(n)) ? v : null;
-    // Primary: OpenAI-compatible `data: [{ embedding, index }]`.
-    const data = body.data;
-    if (Array.isArray(data)) {
-        data.forEach((entry, i) => {
-            if (typeof entry !== "object" || entry === null)
-                return;
-            const e = entry;
-            const idx = typeof e.index === "number" && Number.isInteger(e.index) ? e.index : i;
-            if (idx < 0 || idx >= count)
-                return;
-            out[idx] = asFinite(e.embedding);
-        });
-        return out;
-    }
-    // Fallback: Cohere-native `embeddings: number[][]` or `embeddings: { float: number[][] }`.
-    const embeddings = body.embeddings;
-    const rows = Array.isArray(embeddings)
-        ? embeddings
-        : typeof embeddings === "object" && embeddings !== null && Array.isArray(embeddings.float)
-            ? (embeddings.float)
-            : null;
-    if (rows !== null) {
-        rows.forEach((row, i) => {
-            if (i < count)
-                out[i] = asFinite(row);
-        });
-        return out;
-    }
-    return allNull(count);
-}
-/**
- * Build the Cohere-via-Portkey embeddings {@link EmbedProvider} (PRD-014b). A
- * batch is sent as ONE POST reusing the rerank transport's auth pattern; the body
- * carries the config model id + `output_dimension` (AC-2). Every failure resolves
- * to nulls for the batch (fail-soft, AC-4); the key is never logged or thrown.
- */
-export function createCoherePortkeyProvider(config, deps = {}) {
-    const doFetch = deps.fetch ?? defaultFetch();
-    const sleep = deps.sleep ?? defaultSleep;
-    return {
-        kind: "cohere",
-        async embed(texts) {
-            if (texts.length === 0)
-                return [];
-            // Not keyed -> fail soft to nulls (no POST). A missing key is a misconfiguration, not a crash (AC-4).
-            if (config.apiKey === null || config.configId === null)
-                return allNull(texts.length);
-            const headers = buildPortkeyHeaders(config.apiKey, config.configId);
-            // The embeddings body (decision #30): the config model id + `output_dimension`, both overridable (AC-2).
-            const body = JSON.stringify({
-                model: config.model,
-                input: [...texts],
-                output_dimension: config.outputDimension,
-            });
-            for (let attempt = 1; attempt <= config.maxAttempts; attempt++) {
-                let res;
-                const controller = new AbortController();
-                const timer = setTimeout(() => controller.abort(), config.requestTimeoutMs);
-                try {
-                    res = await doFetch(config.url, { method: "POST", headers, body, signal: controller.signal });
-                }
-                catch {
-                    // Network/transport failure, or our own abort on `requestTimeoutMs` (an unresponsive
-                    // gateway) -> retry within the bound, else fail soft to nulls. Never surface the error
-                    // (it could carry a body/key); only the fail-soft nulls escape.
-                    if (attempt < config.maxAttempts) {
-                        await sleep(config.retryBackoffMs * attempt);
-                        continue;
-                    }
-                    return allNull(texts.length);
-                }
-                finally {
-                    clearTimeout(timer);
-                }
-                if (!res.ok) {
-                    // A non-2xx gateway status: retry the retryable ones within the bound, else fail soft. Never
-                    // read the body into a message (it could echo a credential).
-                    if (attempt < config.maxAttempts && COHERE_RETRYABLE_STATUSES.has(res.status)) {
-                        await sleep(config.retryBackoffMs * attempt);
-                        continue;
-                    }
-                    return allNull(texts.length);
-                }
-                // A 2xx: parse defensively. A malformed body fails soft to nulls (the gateway was reachable,
-                // the body was just unusable) rather than throwing.
-                const text = await res.text().catch(() => "");
-                return parseEmbeddingsResponse(text, texts.length);
-            }
-            return allNull(texts.length);
-        },
-    };
-}
-//# sourceMappingURL=cohere-portkey.js.map

package/dist/embeddings/cohere-portkey.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cohere-portkey.js","sourceRoot":"","sources":["../../src/embeddings/cohere-portkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAgC,MAAM,WAAW,CAAC;AAGrF,2GAA2G;AAC3G,MAAM,CAAC,MAAM,0BAA0B,GAAG,YAAqB,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAY,CAAC;AAE5D,gHAAgH;AAChH,MAAM,CAAC,MAAM,yBAAyB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAEjG,+GAA+G;AAC/G,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAU,CAAC;AAEtD,+FAA+F;AAC/F,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAY,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAe,CAAC;AA8BjE,gFAAgF;AAChF,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,IAAI,KAAK,CAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAW,EAAE,KAAa;IAChE,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;IAErE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAmB,EAAE,CAC/C,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAc,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3G,6DAA6D;IAC7D,MAAM,IAAI,GAAI,IAA2B,CAAC,IAAI,CAAC;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;YACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO;YACxD,MAAM,CAAC,GAAG,KAAiD,CAAC;YAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,IAAI,KAAK;gBAAE,OAAO;YACpC,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,2FAA2F;IAC3F,MAAM,UAAU,GAAI,IAAiC,CAAC,UAAU,CAAC;IACjE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QACpC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAE,UAAkC,CAAC,KAAK,CAAC;YACjH,CAAC,CAAC,CAAE,UAAmC,CAAC,KAAK,CAAC;YAC9C,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YACtB,IAAI,CAAC,GAAG,KAAK;gBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAA8B,EAC9B,OAA0B,EAAE;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IAEzC,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,KAAK,CAAC,KAAwB;YAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAClC,sGAAsG;YACtG,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAErF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YACpE,yGAAyG;YACzG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;gBAC1B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;gBACjB,gBAAgB,EAAE,MAAM,CAAC,eAAe;aACzC,CAAC,CAAC;YAEH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;gBAC/D,IAAI,GAAG,CAAC;gBACR,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;gBACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBAC5E,IAAI,CAAC;oBACH,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;gBAChG,CAAC;gBAAC,MAAM,CAAC;oBACP,qFAAqF;oBACrF,uFAAuF;oBACvF,gEAAgE;oBAChE,IAAI,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;wBACjC,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,CAAC;wBAC7C,SAAS;oBACX,CAAC;oBACD,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC/B,CAAC;wBAAS,CAAC;oBACT,YAAY,CAAC,KAAK,CAAC,CAAC;gBACtB,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACZ,6FAA6F;oBAC7F,6DAA6D;oBAC7D,IAAI,OAAO,GAAG,MAAM,CAAC,WAAW,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC9E,MAAM,KAAK,CAAC,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,CAAC;wBAC7C,SAAS;oBACX,CAAC;oBACD,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC/B,CAAC;gBACD,6FAA6F;gBAC7F,oDAAoD;gBACpD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9C,OAAO,uBAAuB,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/hivedoctor-registry.d.ts

@@ -1,111 +0,0 @@
-/**
- * hivenectar's registry entry in hivedoctor's daemon registry (PRD-003c).
- *
- * hivenectar becomes a supervised daemon by appending ONE entry to hivedoctor's
- * registry file (`~/.honeycomb/hivedoctor.daemons.json`, the schema PRD-004a
- * specifies, mirrored read-side in `hivedoctor/src/registry.ts`). That entry
- * carries hivenectar's `healthUrl`, `pidPath`, `probeIntervalMs`, `startupGraceMs`,
- * and restart thresholds. At the next hivedoctor boot, hivedoctor reads the
- * registry and spawns one supervisor instance for hivenectar alongside honeycomb
- * and thehive.
- *
- * Registration is a FILE EDIT at install time (PRD-003c "Registration mechanics"),
- * never a runtime call: this module does not restart hivedoctor, does not open an
- * HTTP connection, and does not hot-reload anything. It is idempotent - re-running
- * the installer replaces hivenectar's own entry (keyed by `name: "hivenectar"`)
- * rather than appending a duplicate, and every other daemon's entry is preserved
- * byte-for-byte apart from array position.
- *
- * A PRESENT-but-malformed registry file fails loudly (this module never silently
- * clobbers a broken file it cannot safely parse), mirroring hivedoctor's own
- * fail-loud posture for a malformed registry (`hivedoctor/src/registry.ts`).
- * PRD-017a deliberately does NOT change this posture to match hivedoctor's own
- * fail-soft posture for a malformed registry read - the two are intentionally
- * different (this writer refuses to clobber a broken install-time file; a
- * malformed registry read is hivedoctor's own runtime concern, not this one).
- *
- * PRD-017a extends this entry with `telemetryDbPath`: the absolute path to
- * hivenectar's runtime telemetry SQLite database (`telemetry/db.ts`,
- * `~/.honeycomb/telemetry/hivenectar.sqlite` by default), per hivedoctor's
- * `ADR-0002-service-registration-static-registry-plus-runtime-sqlite.md`. It is
- * derived from `config.pidFilePath`'s directory (the same resolved runtime dir
- * `healthUrl`/`pidPath` already come from), so a test-overridden runtime dir
- * (`HIVENECTAR_RUNTIME_DIR` / `resolveConfig({ runtimeDir })`) keeps every
- * per-daemon artifact - pid, lock, and now telemetry DB - colocated, with no
- * separate `~` round-trip needed here (same rationale as `healthUrl`/`pidPath`).
- *
- * Built-ins only: node:fs, node:os, node:path.
- */
-import type { RuntimeConfig } from "./config.js";
-/** The daemon name hivenectar registers itself under. */
-export declare const HIVENECTAR_DAEMON_NAME: "hivenectar";
-/**
- * One registry entry, matching the schema hivedoctor's registry loader parses
- * (PRD-004a / `hivedoctor/src/registry.ts`).
- */
-export interface HivedoctorRegistryEntry {
-    readonly name: string;
-    readonly healthUrl: string;
-    readonly pidPath: string;
-    readonly probeIntervalMs: number;
-    readonly startupGraceMs: number;
-    readonly restartGiveUpThreshold: number;
-    readonly restartCooldownMs: number;
-    /**
-     * The absolute path to hivenectar's runtime telemetry SQLite database
-     * (PRD-017a), so hivedoctor knows where to poll (read-only) for check-in
-     * status, metrics, and logs. Optional in the type only so a pre-PRD-017
-     * entry a test constructs by hand still type-checks; `buildHivenectarRegistryEntry`
-     * always populates it.
-     */
-    readonly telemetryDbPath?: string;
-}
-/** hivedoctor's per-daemon defaults hivenectar's entry resolves to (PRD-003c table). */
-export declare const DEFAULT_PROBE_INTERVAL_MS = 30000;
-export declare const DEFAULT_STARTUP_GRACE_MS = 60000;
-export declare const DEFAULT_RESTART_GIVE_UP_THRESHOLD = 3;
-export declare const DEFAULT_RESTART_COOLDOWN_MS = 5000;
-/** Thrown when a PRESENT registry file cannot be safely parsed/edited. */
-export declare class HivedoctorRegistryError extends Error {
-    constructor(message: string);
-}
-/** The default registry file location, alongside the other `~/.honeycomb` artifacts. */
-export declare function defaultHivedoctorRegistryPath(home?: string): string;
-/**
- * Build hivenectar's registry entry from its resolved {@link RuntimeConfig}
- * (PRD-003c table): `healthUrl`/`pidPath` come from hivenectar's own runtime
- * config (already home-expanded, so no `~` round-trip is needed here); the
- * remaining fields are hivedoctor's per-daemon defaults unless overridden.
- *
- * `telemetryDbPath` (PRD-017a) defaults to `<runtimeDir>/telemetry/hivenectar.sqlite`,
- * where `runtimeDir` is `pidFilePath`'s own directory - the same resolved
- * runtime dir every other per-daemon artifact already lives under, so a
- * test-overridden runtime dir keeps pid/lock/telemetry colocated automatically.
- */
-export declare function buildHivenectarRegistryEntry(config: Pick<RuntimeConfig, "host" | "port" | "pidFilePath">, overrides?: Partial<Pick<HivedoctorRegistryEntry, "probeIntervalMs" | "startupGraceMs" | "restartGiveUpThreshold" | "restartCooldownMs" | "telemetryDbPath">>): HivedoctorRegistryEntry;
-export interface RegisterWithHivedoctorOptions {
-    /** hivenectar's runtime config (supplies healthUrl + pidPath). */
-    readonly config: Pick<RuntimeConfig, "host" | "port" | "pidFilePath">;
-    /** Override the registry file path (default: {@link defaultHivedoctorRegistryPath}). */
-    readonly registryPath?: string;
-    /** Override the entry's per-daemon fields (default: hivedoctor's built-in defaults). */
-    readonly overrides?: Partial<Pick<HivedoctorRegistryEntry, "probeIntervalMs" | "startupGraceMs" | "restartGiveUpThreshold" | "restartCooldownMs" | "telemetryDbPath">>;
-}
-export interface RegisterWithHivedoctorResult {
-    /** The path the registry file was written to. */
-    readonly registryPath: string;
-    /** The entry that was written for hivenectar. */
-    readonly entry: HivedoctorRegistryEntry;
-    /** True when the registry file did not exist and was created fresh. */
-    readonly created: boolean;
-    /** True when an existing hivenectar entry was replaced (idempotent re-install). */
-    readonly replaced: boolean;
-}
-/**
- * Append (or idempotently replace) hivenectar's entry in hivedoctor's registry
- * file (PRD-003c US-003c.1). Every OTHER daemon's entry is preserved unchanged.
- * Does NOT restart hivedoctor and does NOT touch anything besides this one file -
- * the entry takes effect at hivedoctor's next natural boot (PRD-003c Non-Goals).
- */
-export declare function registerWithHivedoctor(options: RegisterWithHivedoctorOptions): RegisterWithHivedoctorResult;
-//# sourceMappingURL=hivedoctor-registry.d.ts.map

package/dist/hivedoctor-registry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"hivedoctor-registry.d.ts","sourceRoot":"","sources":["../src/hivedoctor-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,yDAAyD;AACzD,eAAO,MAAM,sBAAsB,EAAG,YAAqB,CAAC;AAE5D;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAChD,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAC/C,eAAO,MAAM,iCAAiC,IAAI,CAAC;AACnD,eAAO,MAAM,2BAA2B,OAAQ,CAAC;AAEjD,0EAA0E;AAC1E,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,OAAO,EAAE,MAAM;CAI5B;AAED,wFAAwF;AACxF,wBAAgB,6BAA6B,CAAC,IAAI,GAAE,MAAkB,GAAG,MAAM,CAE9E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC,EAC5D,SAAS,GAAE,OAAO,CAChB,IAAI,CACF,uBAAuB,EACvB,iBAAiB,GAAG,gBAAgB,GAAG,wBAAwB,GAAG,mBAAmB,GAAG,iBAAiB,CAC1G,CACG,GACL,uBAAuB,CAYzB;AA0DD,MAAM,WAAW,6BAA6B;IAC5C,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC,CAAC;IACtE,wFAAwF;IACxF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,wFAAwF;IACxF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAC1B,IAAI,CACF,uBAAuB,EACvB,iBAAiB,GAAG,gBAAgB,GAAG,wBAAwB,GAAG,mBAAmB,GAAG,iBAAiB,CAC1G,CACF,CAAC;CACH;AAED,MAAM,WAAW,4BAA4B;IAC3C,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAC;IACxC,uEAAuE;IACvE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,6BAA6B,GACrC,4BAA4B,CAa9B"}

package/dist/hivedoctor-registry.js

@@ -1,143 +0,0 @@
-/**
- * hivenectar's registry entry in hivedoctor's daemon registry (PRD-003c).
- *
- * hivenectar becomes a supervised daemon by appending ONE entry to hivedoctor's
- * registry file (`~/.honeycomb/hivedoctor.daemons.json`, the schema PRD-004a
- * specifies, mirrored read-side in `hivedoctor/src/registry.ts`). That entry
- * carries hivenectar's `healthUrl`, `pidPath`, `probeIntervalMs`, `startupGraceMs`,
- * and restart thresholds. At the next hivedoctor boot, hivedoctor reads the
- * registry and spawns one supervisor instance for hivenectar alongside honeycomb
- * and thehive.
- *
- * Registration is a FILE EDIT at install time (PRD-003c "Registration mechanics"),
- * never a runtime call: this module does not restart hivedoctor, does not open an
- * HTTP connection, and does not hot-reload anything. It is idempotent - re-running
- * the installer replaces hivenectar's own entry (keyed by `name: "hivenectar"`)
- * rather than appending a duplicate, and every other daemon's entry is preserved
- * byte-for-byte apart from array position.
- *
- * A PRESENT-but-malformed registry file fails loudly (this module never silently
- * clobbers a broken file it cannot safely parse), mirroring hivedoctor's own
- * fail-loud posture for a malformed registry (`hivedoctor/src/registry.ts`).
- * PRD-017a deliberately does NOT change this posture to match hivedoctor's own
- * fail-soft posture for a malformed registry read - the two are intentionally
- * different (this writer refuses to clobber a broken install-time file; a
- * malformed registry read is hivedoctor's own runtime concern, not this one).
- *
- * PRD-017a extends this entry with `telemetryDbPath`: the absolute path to
- * hivenectar's runtime telemetry SQLite database (`telemetry/db.ts`,
- * `~/.honeycomb/telemetry/hivenectar.sqlite` by default), per hivedoctor's
- * `ADR-0002-service-registration-static-registry-plus-runtime-sqlite.md`. It is
- * derived from `config.pidFilePath`'s directory (the same resolved runtime dir
- * `healthUrl`/`pidPath` already come from), so a test-overridden runtime dir
- * (`HIVENECTAR_RUNTIME_DIR` / `resolveConfig({ runtimeDir })`) keeps every
- * per-daemon artifact - pid, lock, and now telemetry DB - colocated, with no
- * separate `~` round-trip needed here (same rationale as `healthUrl`/`pidPath`).
- *
- * Built-ins only: node:fs, node:os, node:path.
- */
-import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { TELEMETRY_DB_FILE_NAME, TELEMETRY_DIR_NAME } from "./telemetry/db.js";
-/** The daemon name hivenectar registers itself under. */
-export const HIVENECTAR_DAEMON_NAME = "hivenectar";
-/** hivedoctor's per-daemon defaults hivenectar's entry resolves to (PRD-003c table). */
-export const DEFAULT_PROBE_INTERVAL_MS = 30_000;
-export const DEFAULT_STARTUP_GRACE_MS = 60_000;
-export const DEFAULT_RESTART_GIVE_UP_THRESHOLD = 3;
-export const DEFAULT_RESTART_COOLDOWN_MS = 5_000;
-/** Thrown when a PRESENT registry file cannot be safely parsed/edited. */
-export class HivedoctorRegistryError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "HivedoctorRegistryError";
-    }
-}
-/** The default registry file location, alongside the other `~/.honeycomb` artifacts. */
-export function defaultHivedoctorRegistryPath(home = homedir()) {
-    return join(home, ".honeycomb", "hivedoctor.daemons.json");
-}
-/**
- * Build hivenectar's registry entry from its resolved {@link RuntimeConfig}
- * (PRD-003c table): `healthUrl`/`pidPath` come from hivenectar's own runtime
- * config (already home-expanded, so no `~` round-trip is needed here); the
- * remaining fields are hivedoctor's per-daemon defaults unless overridden.
- *
- * `telemetryDbPath` (PRD-017a) defaults to `<runtimeDir>/telemetry/hivenectar.sqlite`,
- * where `runtimeDir` is `pidFilePath`'s own directory - the same resolved
- * runtime dir every other per-daemon artifact already lives under, so a
- * test-overridden runtime dir keeps pid/lock/telemetry colocated automatically.
- */
-export function buildHivenectarRegistryEntry(config, overrides = {}) {
-    const runtimeDir = dirname(config.pidFilePath);
-    return {
-        name: HIVENECTAR_DAEMON_NAME,
-        healthUrl: `http://${config.host}:${config.port}/health`,
-        pidPath: config.pidFilePath,
-        probeIntervalMs: overrides.probeIntervalMs ?? DEFAULT_PROBE_INTERVAL_MS,
-        startupGraceMs: overrides.startupGraceMs ?? DEFAULT_STARTUP_GRACE_MS,
-        restartGiveUpThreshold: overrides.restartGiveUpThreshold ?? DEFAULT_RESTART_GIVE_UP_THRESHOLD,
-        restartCooldownMs: overrides.restartCooldownMs ?? DEFAULT_RESTART_COOLDOWN_MS,
-        telemetryDbPath: overrides.telemetryDbPath ?? join(runtimeDir, TELEMETRY_DIR_NAME, TELEMETRY_DB_FILE_NAME),
-    };
-}
-function isRecord(value) {
-    return value !== null && typeof value === "object";
-}
-/**
- * Read the registry file's raw `daemons` array. A PRESENT-but-malformed file
- * (unparseable JSON, not an object, or a `daemons` field that is not an array)
- * throws {@link HivedoctorRegistryError} rather than being silently overwritten -
- * a real misconfiguration must not be clobbered by an installer.
- */
-function readExistingRegistry(registryPath) {
-    let contents;
-    try {
-        contents = readFileSync(registryPath, "utf8");
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return { fileExisted: false, daemons: [] };
-        throw new HivedoctorRegistryError(`could not read the hivedoctor registry at ${registryPath}: ${error instanceof Error ? error.message : "unknown"}`);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(contents);
-    }
-    catch (error) {
-        throw new HivedoctorRegistryError(`the hivedoctor registry at ${registryPath} is not valid JSON: ${error instanceof Error ? error.message : "unknown"}`);
-    }
-    if (!isRecord(parsed)) {
-        throw new HivedoctorRegistryError(`the hivedoctor registry at ${registryPath} must be a JSON object with a "daemons" array`);
-    }
-    const daemons = parsed.daemons;
-    if (daemons === undefined)
-        return { fileExisted: true, daemons: [] };
-    if (!Array.isArray(daemons)) {
-        throw new HivedoctorRegistryError(`the hivedoctor registry at ${registryPath} has a non-array "daemons" field`);
-    }
-    return { fileExisted: true, daemons };
-}
-/** True iff a raw (unvalidated) registry entry names hivenectar. */
-function isHivenectarEntry(raw) {
-    return isRecord(raw) && raw.name === HIVENECTAR_DAEMON_NAME;
-}
-/**
- * Append (or idempotently replace) hivenectar's entry in hivedoctor's registry
- * file (PRD-003c US-003c.1). Every OTHER daemon's entry is preserved unchanged.
- * Does NOT restart hivedoctor and does NOT touch anything besides this one file -
- * the entry takes effect at hivedoctor's next natural boot (PRD-003c Non-Goals).
- */
-export function registerWithHivedoctor(options) {
-    const registryPath = options.registryPath ?? defaultHivedoctorRegistryPath();
-    const entry = buildHivenectarRegistryEntry(options.config, options.overrides);
-    const { fileExisted, daemons: existing } = readExistingRegistry(registryPath);
-    const replaced = existing.some(isHivenectarEntry);
-    const kept = existing.filter((raw) => !isHivenectarEntry(raw));
-    const daemons = [...kept, entry];
-    mkdirSync(dirname(registryPath), { recursive: true });
-    writeFileSync(registryPath, `${JSON.stringify({ daemons }, null, 2)}\n`, "utf8");
-    return { registryPath, entry, created: !fileExisted, replaced };
-}
-//# sourceMappingURL=hivedoctor-registry.js.map

package/dist/hivedoctor-registry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hivedoctor-registry.js","sourceRoot":"","sources":["../src/hivedoctor-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE/E,yDAAyD;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAqB,CAAC;AAwB5D,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAChD,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAC/C,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC;AACnD,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,CAAC;AAEjD,0EAA0E;AAC1E,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,wFAAwF;AACxF,MAAM,UAAU,6BAA6B,CAAC,OAAe,OAAO,EAAE;IACpE,OAAO,IAAI,CAAC,IAAI,EAAE,YAAY,EAAE,yBAAyB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAA4D,EAC5D,YAKI,EAAE;IAEN,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,sBAAsB;QAC5B,SAAS,EAAE,UAAU,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,SAAS;QACxD,OAAO,EAAE,MAAM,CAAC,WAAW;QAC3B,eAAe,EAAE,SAAS,CAAC,eAAe,IAAI,yBAAyB;QACvE,cAAc,EAAE,SAAS,CAAC,cAAc,IAAI,wBAAwB;QACpE,sBAAsB,EAAE,SAAS,CAAC,sBAAsB,IAAI,iCAAiC;QAC7F,iBAAiB,EAAE,SAAS,CAAC,iBAAiB,IAAI,2BAA2B;QAC7E,eAAe,EAAE,SAAS,CAAC,eAAe,IAAI,IAAI,CAAC,UAAU,EAAE,kBAAkB,EAAE,sBAAsB,CAAC;KAC3G,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC;AACrD,CAAC;AAUD;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,YAAoB;IAChD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACnG,MAAM,IAAI,uBAAuB,CAC/B,6CAA6C,YAAY,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CACnH,CAAC;IACJ,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAC/B,8BAA8B,YAAY,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CACtH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAC/B,8BAA8B,YAAY,+CAA+C,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,uBAAuB,CAAC,8BAA8B,YAAY,kCAAkC,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC;AAED,oEAAoE;AACpE,SAAS,iBAAiB,CAAC,GAAY;IACrC,OAAO,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,sBAAsB,CAAC;AAC9D,CAAC;AA2BD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAsC;IAEtC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,6BAA6B,EAAE,CAAC;IAC7E,MAAM,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAE9E,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,KAAK,CAAC,CAAC;IAEjC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,aAAa,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAEjF,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC;AAClE,CAAC"}

package/dist/source-graph/deeplake-credentials.d.ts

@@ -1,57 +0,0 @@
-/** The SHARED credentials directory name under the user's home. */
-export declare const CREDENTIALS_DIR_NAME = ".deeplake";
-/** The credentials file name within the dir. */
-export declare const CREDENTIALS_FILE_NAME = "credentials.json";
-/** The canonical Deep Lake API base URL used when a file omits `apiUrl`. */
-export declare const DEFAULT_DEEPLAKE_API_URL = "https://api.deeplake.ai";
-/** The validated Deep Lake connection details the transport is built from. */
-export interface DeepLakeCredentials {
-    /** Deep Lake HTTP query endpoint. Defaults to {@link DEFAULT_DEEPLAKE_API_URL}. */
-    readonly apiUrl: string;
-    /** The org-bound bearer token (SECRET; never logged in full). */
-    readonly token: string;
-    /** The org id the token is bound to. */
-    readonly orgId: string;
-    /** The active workspace id. */
-    readonly workspaceId: string;
-}
-/**
- * Options for {@link loadDeepLakeCredentials}, injectable so a test points the
- * file read at a temp dir without touching the real `~/.deeplake` (mirrors
- * honeycomb's `CredentialsFileProviderOptions`). All optional.
- */
-export interface LoadCredentialsOptions {
-    /** Override the credentials directory (tests). Defaults to `~/.deeplake`. */
-    readonly dir?: string;
-}
-/**
- * Structured, fail-closed rejection. Carries exactly which fields were missing
- * or invalid so a caller (or an operator reading a log line) knows what to
- * fix without the loader ever echoing the file's contents (which may hold the
- * token).
- */
-export declare class DeepLakeCredentialsError extends Error {
-    readonly missing: readonly string[];
-    constructor(missing: readonly string[]);
-}
-/** Resolve the credentials directory, honoring the test override. */
-export declare function credentialsDir(options?: LoadCredentialsOptions): string;
-/** Resolve the full credentials file path within the (possibly overridden) dir. */
-export declare function credentialsPath(options?: LoadCredentialsOptions): string;
-/**
- * Load and validate `~/.deeplake/credentials.json` (or the overridden dir in
- * `options.dir`). Throws {@link DeepLakeCredentialsError} listing every
- * problem found: a missing file, invalid JSON, a non-object payload, or a
- * missing/empty `token` / `orgId` / `workspaceId`. Never returns a partial
- * credential — the caller either gets a fully-populated `DeepLakeCredentials`
- * or a clear, typed reason it could not.
- */
-export declare function loadDeepLakeCredentials(options?: LoadCredentialsOptions): DeepLakeCredentials;
-/**
- * Redact a token for logs and errors. Never echoes a token in full: keeps the
- * last 4 chars for correlation, masks the rest. An empty/short value collapses
- * to a fixed mask so length isn't leaked either. Mirrors honeycomb's
- * `redactToken` (`src/daemon/runtime/auth/credentials-store.ts:254-257`).
- */
-export declare function redactToken(value: string): string;
-//# sourceMappingURL=deeplake-credentials.d.ts.map

package/dist/source-graph/deeplake-credentials.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deeplake-credentials.d.ts","sourceRoot":"","sources":["../../src/source-graph/deeplake-credentials.ts"],"names":[],"mappings":"AA4BA,mEAAmE;AACnE,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAChD,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AACxD,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,4BAA4B,CAAC;AAElE,8EAA8E;AAC9E,MAAM,WAAW,mBAAmB;IAClC,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,iEAAiE;IACjE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IACjD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;gBACxB,OAAO,EAAE,SAAS,MAAM,EAAE;CAKvC;AAED,qEAAqE;AACrE,wBAAgB,cAAc,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CAE3E;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,OAAO,GAAE,sBAA2B,GAAG,MAAM,CAE5E;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,sBAA2B,GAAG,mBAAmB,CAkCjG;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGjD"}

package/dist/source-graph/deeplake-credentials.js

@@ -1,109 +0,0 @@
-/**
- * Deep Lake credentials loader for hivenectar (PRD-005).
- *
- * Reads the SHARED `~/.deeplake/credentials.json` file that `hivemind login`
- * (and honeycomb) already write, mirroring the shape honeycomb's
- * `loadDiskCredentials` / `deeplakeCredentialsFileProvider`
- * (`src/daemon/runtime/auth/credentials-store.ts`,
- * `src/daemon/storage/config.ts`) read: `{ apiUrl, token, orgId, workspaceId }`.
- * Per ADR-0002, hivenectar never imports honeycomb's runtime for this; it
- * reads the same on-disk file with its own loader.
- *
- * Fail-closed by design (mirrors honeycomb's `StorageConfigError` posture): a
- * missing file, malformed JSON, or a missing required field throws a
- * `DeepLakeCredentialsError` listing exactly what is wrong, rather than
- * returning a partially-undefined credential object a caller could
- * accidentally use. `apiUrl` is the one field with a documented default (a
- * legacy or hand-written file may omit it); `token`, `orgId`, and
- * `workspaceId` are load-bearing and always required.
- *
- * The token is never logged or included in an error message in full;
- * `redactToken` keeps only the last 4 characters, exactly like honeycomb's
- * `redactToken` (`src/daemon/runtime/auth/credentials-store.ts:254-257`, its
- * `defaultCredentialProvider` variant).
- */
-import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-/** The SHARED credentials directory name under the user's home. */
-export const CREDENTIALS_DIR_NAME = ".deeplake";
-/** The credentials file name within the dir. */
-export const CREDENTIALS_FILE_NAME = "credentials.json";
-/** The canonical Deep Lake API base URL used when a file omits `apiUrl`. */
-export const DEFAULT_DEEPLAKE_API_URL = "https://api.deeplake.ai";
-/**
- * Structured, fail-closed rejection. Carries exactly which fields were missing
- * or invalid so a caller (or an operator reading a log line) knows what to
- * fix without the loader ever echoing the file's contents (which may hold the
- * token).
- */
-export class DeepLakeCredentialsError extends Error {
-    missing;
-    constructor(missing) {
-        super(`Invalid Deep Lake credentials: ${missing.join("; ")}`);
-        this.name = "DeepLakeCredentialsError";
-        this.missing = missing;
-    }
-}
-/** Resolve the credentials directory, honoring the test override. */
-export function credentialsDir(options = {}) {
-    return options.dir ?? join(homedir(), CREDENTIALS_DIR_NAME);
-}
-/** Resolve the full credentials file path within the (possibly overridden) dir. */
-export function credentialsPath(options = {}) {
-    return join(credentialsDir(options), CREDENTIALS_FILE_NAME);
-}
-/**
- * Load and validate `~/.deeplake/credentials.json` (or the overridden dir in
- * `options.dir`). Throws {@link DeepLakeCredentialsError} listing every
- * problem found: a missing file, invalid JSON, a non-object payload, or a
- * missing/empty `token` / `orgId` / `workspaceId`. Never returns a partial
- * credential — the caller either gets a fully-populated `DeepLakeCredentials`
- * or a clear, typed reason it could not.
- */
-export function loadDeepLakeCredentials(options = {}) {
-    const path = credentialsPath(options);
-    if (!existsSync(path)) {
-        throw new DeepLakeCredentialsError([`credentials file not found at ${path}`]);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(readFileSync(path, "utf8"));
-    }
-    catch {
-        throw new DeepLakeCredentialsError([`credentials file at ${path} is not valid JSON`]);
-    }
-    if (typeof parsed !== "object" || parsed === null) {
-        throw new DeepLakeCredentialsError([`credentials file at ${path} does not contain a JSON object`]);
-    }
-    const record = parsed;
-    const missing = [];
-    if (typeof record.token !== "string" || record.token.length === 0)
-        missing.push("token");
-    if (typeof record.orgId !== "string" || record.orgId.length === 0)
-        missing.push("orgId");
-    if (typeof record.workspaceId !== "string" || record.workspaceId.length === 0)
-        missing.push("workspaceId");
-    if (missing.length > 0) {
-        throw new DeepLakeCredentialsError(missing);
-    }
-    const apiUrl = typeof record.apiUrl === "string" && record.apiUrl.length > 0 ? record.apiUrl : DEFAULT_DEEPLAKE_API_URL;
-    return {
-        apiUrl,
-        token: record.token,
-        orgId: record.orgId,
-        workspaceId: record.workspaceId,
-    };
-}
-/**
- * Redact a token for logs and errors. Never echoes a token in full: keeps the
- * last 4 chars for correlation, masks the rest. An empty/short value collapses
- * to a fixed mask so length isn't leaked either. Mirrors honeycomb's
- * `redactToken` (`src/daemon/runtime/auth/credentials-store.ts:254-257`).
- */
-export function redactToken(value) {
-    if (value.length <= 4)
-        return "****";
-    return `****${value.slice(-4)}`;
-}
-//# sourceMappingURL=deeplake-credentials.js.map

package/dist/source-graph/deeplake-credentials.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"deeplake-credentials.js","sourceRoot":"","sources":["../../src/source-graph/deeplake-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,mEAAmE;AACnE,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAChD,gDAAgD;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAC;AACxD,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAwBlE;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,OAAO,CAAoB;IACpC,YAAY,OAA0B;QACpC,KAAK,CAAC,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,UAAkC,EAAE;IACjE,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,oBAAoB,CAAC,CAAC;AAC9D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,UAAkC,EAAE;IAClE,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkC,EAAE;IAC1E,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,wBAAwB,CAAC,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,wBAAwB,CAAC,CAAC,uBAAuB,IAAI,oBAAoB,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,wBAAwB,CAAC,CAAC,uBAAuB,IAAI,iCAAiC,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzF,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzF,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3G,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,MAAM,GACV,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC;IAE3G,OAAO;QACL,MAAM;QACN,KAAK,EAAE,MAAM,CAAC,KAAe;QAC7B,KAAK,EAAE,MAAM,CAAC,KAAe;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAqB;KAC1C,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,OAAO,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC"}