@north-light/cli 0.0.0-stage → 0.3.413

package/dist/core/profiles/manifest.d.ts

@@ -0,0 +1,120 @@
+import type { ProfileManifest } from '../../types.js';
+import type { DeliveryLimits, ProfileProject, ProfileProjectMemory } from '../../api/dto/profiles.js';
+export declare const ROOT_PROFILE_ID = "root-00000000";
+export declare function profileMemoryDir(profileId: string): string;
+export declare function assertProfileProjects(entries: unknown): asserts entries is ProfileProject[];
+export declare function assertDeliveryLimits(value: unknown): asserts value is DeliveryLimits;
+export interface ProfileEntry {
+    profileId: string;
+    manifest: ProfileManifest;
+}
+export interface ProfileEnumeration {
+    entries: ProfileEntry[];
+    unreadableIds: string[];
+}
+export declare function listProfiles(): ProfileEntry[];
+export type ProfileLookup = {
+    kind: 'resolved';
+    entry: ProfileEntry;
+} | {
+    kind: 'absent';
+} | {
+    kind: 'unreadable';
+    profileId: string;
+    manifestPath: string;
+};
+export declare function lookupProfile(profileIdOrName: string): ProfileLookup;
+/** Read one exact profile id without falling back to manifest-name matching.
+ * Used at persistence gates that already hold a resolved durable identity. */
+export declare function loadExactProfileManifest(profileId: string): ProfileEntry;
+/** Exact resolution only: the generated id, else a unique manifest `name`.
+ *  Returns `null` when nothing matches exactly; still THROWS when a name is
+ *  shared by several profiles, because that is a real collision the caller
+ *  cannot resolve by guessing (and fuzzy matching would only guess harder). */
+/** The two facts operand matching reads, from a stored entry or a daemon DTO. */
+export interface ProfileCandidate {
+    profileId: string;
+    name: string;
+}
+type CandidateOf<T> = (entry: T) => ProfileCandidate;
+export declare function loadProfileManifest(profileIdOrName: string): ProfileEntry;
+/** Resolve a profile the USER TYPED — a `--profile` flag or a `<profile>`
+ *  operand. Exact id or name wins outright; only when nothing matches exactly
+ *  does this fall back to fuzzy matching on name and id slug, so a typed
+ *  `crout`, `Crouter`, or `cruoter` reaches the `crouter` profile instead of
+ *  failing with a list the user has to read and retype. A fuzzy hit is
+ *  announced on STDERR (never stdout, which callers pipe) so the user always
+ *  knows which profile actually ran.
+ *
+ *  NEVER call this with a STORED `profile_id` (a node's `meta.profile_id`,
+ *  `CRTR_PROFILE_ID`, a pinned default). A durable id that no longer resolves
+ *  means the profile was deleted — the correct answer there is the not-found
+ *  those callers already handle, not the nearest surviving profile. Use
+ *  `loadProfileManifest` (or `loadExactProfileManifest`) for those. */
+export declare function resolveProfileOperand(operand: string): ProfileEntry;
+/** `resolveProfileOperand` over any candidate list — the CLI passes the
+ *  profiles the daemon lists for its caller. */
+export declare function matchProfileOperand<T>(all: readonly T[], operand: string, key: CandidateOf<T>): T;
+/** Hold the per-profile manifest lock for the duration of `fn`. ALL manifest
+ *  mutations (create/rename/add-project/remove-project/delete/last-used)
+ *  below run inside this. */
+export declare function withProfileManifestLock<T>(profileId: string, fn: () => T): T;
+export declare function ensureRootProfile(): ProfileEntry;
+/** The env name a metadata entry surfaces as (spawn-env source F). Also the
+ *  uniqueness domain for keys: the fold is lossy (`a-b`, `a_b`, `A_B` →
+ *  `CRTR_PROFILE_META_A_B`), so two stored keys may not share a fold. */
+export declare function metadataEnvName(key: string): string;
+/** Reject anything a valid metadata map may not carry. Takes `unknown`
+ *  because the API route hands over a caller-supplied body slice — the
+ *  TypeScript type on the DTO proves nothing at runtime. */
+export declare function assertProfileMetadata(entries: unknown): asserts entries is Record<string, string>;
+/** Drop entries no valid mutation could have written — a manifest is
+ *  hand-editable, so a projection or merge base must never trust it raw.
+ *  Never throws; on an env-name collision the first entry wins (matching
+ *  injection, where a deterministic winner beats insertion-order luck). */
+export declare function sanitizeProfileMetadata(stored: unknown): Record<string, string>;
+export declare function createProfile(name: string, projects?: ProfileProject[], opts?: {
+    defaultKind?: string;
+    metadata?: Record<string, string>;
+    grantee?: string;
+}): ProfileEntry;
+export declare function ensureAppProfile(grantee: string): ProfileEntry;
+export declare function updateProfileLastUsed(profileId: string): ProfileEntry;
+/** Paused check for an ALREADY-RESOLVED durable id (a canvas row's `profile_id`,
+ * `CRTR_PROFILE_ID`) — exact-id only, no name matching, so it costs one small
+ * read on the hot delivery paths that call it every poll. Fails OPEN: an id
+ * whose manifest is missing or corrupt is not paused, because treating it as
+ * paused would strand that node's queued inbox forever. */
+export declare function isProfilePaused(profileId: string | null | undefined): boolean;
+/** One set-based pause read for canvas-wide projections. */
+export declare function pausedCanvasProfiles(): Set<string>;
+/** Refuse a launch under a paused profile, naming the resume command. Shared by
+ * every gate that already holds a loaded manifest. */
+export declare function assertProfileEntryActive(entry: ProfileEntry): void;
+export declare function assertProfileActive(profileId: string | null | undefined): ProfileEntry | null;
+export declare function pauseProfile(profileId: string): ProfileEntry;
+export declare function resumeProfile(profileId: string): ProfileEntry & {
+    pausedAt: string | null;
+};
+export declare function setProfileDefaultKind(profileId: string, defaultKind: string): ProfileEntry;
+/** Merge `set` entries over the stored map and drop `unset` keys; the
+ *  `metadata` field is omitted entirely when the result is empty. */
+export declare function updateProfileMetadata(profileId: string, set: Record<string, string>, unset?: string[]): ProfileEntry;
+/** A profile's stored metadata for broker-env injection — sanitized entry by
+ *  entry (a manifest is hand-editable, so a bad key/value is dropped rather
+ *  than trusted) and never throwing: a stale/invalid/absent profile id is a
+ *  hot-path no-op, because broker-env resolution must never fail a launch
+ *  over a bad profile id (mirrors `readProfileEnvVars`). */
+export declare function readProfileMetadata(profileId: string | null): Record<string, string>;
+/** Change the manifest `name` only. Callers that own the canvas (the daemon's
+ *  `PATCH /v1/profiles/:name`) must also rename the profile's canvas handle —
+ *  use `renameProfileAndHandle` there; the CLI and panels go through that route. */
+export declare function renameProfile(profileId: string, name: string): ProfileEntry;
+/** A new path appends; a path already listed keeps its position. */
+export declare function addProfileProject(profileId: string, dir: string): ProfileEntry;
+/** Set one owner's automatic delivery limit. `content` is the uncapped level,
+ *  so it removes the owner's entry instead of storing it. */
+export declare function setProfileDeliveryLimit(profileId: string, owner: string, level: ProfileProjectMemory): ProfileEntry;
+export declare function removeProfileProject(profileId: string, dir: string): ProfileEntry;
+export declare function deleteProfile(profileId: string): void;
+export {};

package/dist/core/profiles/manifest.js

@@ -0,0 +1 @@
+var Y=Object.defineProperty;var o=(e,t)=>Y(e,"name",{value:t,configurable:!0});import{randomUUID as G}from"node:crypto";import{existsSync as W,realpathSync as b,rmSync as S,statSync as B}from"node:fs";import{join as A,resolve as E}from"node:path";import{SCHEMA_VERSION as R}from"../../types.js";import{profileSpace as g}from"../layout.js";import{PROFILE_PROJECT_MEMORY_VALUES as O}from"../../api/dto/profiles.js";import{userScopeRoot as c}from"../scope.js";import{ensureDir as k,nowIso as m}from"../fs-utils.js";import{deleteStoredProfile as Q,getStoredProfile as h,insertStoredProfile as M,listStoredProfiles as X,pausedProfileIds as I,profilePaused as ee,updateStoredProfile as te}from"../scoped-state/profiles.js";import{usage as f,notFound as d,ambiguous as D,general as L}from"../errors.js";import{withExclusiveDirectoryLock as re}from"../exclusive-lock.js";import{fuzzyMatchProfile as ne}from"./fuzzy-match.js";const N=/^[a-z0-9]+(?:-[a-z0-9]+)*-[0-9a-f]{8}$/,p="root-00000000",oe="root";function P(e){return e.grantee??"app:terminal"}o(P,"profileApp");function w(e,t){k(g(P(t),e).memory)}o(w,"scaffoldProfile");function y(e){if(!N.test(e))throw f(`invalid profile id: ${e}`,{received:e,next:"Profile ids look like <slug>-<8-hex-chars> (as printed by `crtr profile new`). Pass an exact id or a profile name, not a raw path."})}o(y,"assertSafeProfileId");function Ee(e){y(e);const t=h(c(),e);if(t===null)throw d(`profile not found: ${e}`,{received:e});return g(P(t.manifest),e).memory}o(Ee,"profileMemoryDir");function z(e){if(!Array.isArray(e))throw f("projects must be an array of {path} objects",{received:typeof e,field:"projects",next:'Pass entries like {"path": "/abs/dir"}.'});for(const t of e){if(typeof t!="object"||t===null||Array.isArray(t))throw f(`invalid project entry: ${JSON.stringify(t)}`,{field:"projects",next:'Every project is an object like {"path": "/abs/dir"}.'});const{path:r}=t;if(typeof r!="string"||r.trim()==="")throw f(`project entry has no path: ${JSON.stringify(t)}`,{field:"projects",next:"Give every project entry a non-empty directory path."})}}o(z,"assertProfileProjects");function ie(e){const t=O.join(", ");if(typeof e!="object"||e===null||Array.isArray(e))throw f("delivery_limits must be an object mapping owner handles to a level",{received:typeof e,field:"delivery_limits",next:`Pass e.g. {"crouter": "preview"} \u2014 each level is one of: ${t}.`});for(const[r,n]of Object.entries(e)){if(r.trim()==="")throw f("delivery_limits has an empty owner handle",{field:"delivery_limits",next:"Key each limit by an owner handle such as a repo handle or `user`, or exactly by `<type>:<handle>` such as `repo:crouter`."});if(typeof n!="string"||!O.includes(n))throw f(`invalid delivery limit for ${r}: ${JSON.stringify(n)}`,{received:String(n),field:"delivery_limits",next:`Set ${r} to one of: ${t}.`})}}o(ie,"assertDeliveryLimits");function ae(){return{entries:X(c()),unreadableIds:[]}}o(ae,"enumerateProfiles");function x(){return ae().entries}o(x,"listProfiles");function se(e){const t=x(),r=J(t,e,$);return r?{kind:"resolved",entry:r}:{kind:"absent"}}o(se,"lookupProfile");function C(e){y(e);const t=h(c(),e);if(t!==null)return t;throw d(`profile not found: ${e}`,{received:e,next:"Run `crtr profile list` to see available profiles."})}o(C,"loadExactProfileManifest");const $=o(e=>({profileId:e.profileId,name:e.manifest.name}),"entryCandidate");function J(e,t,r){if(N.test(t)){const i=e.find(a=>r(a).profileId===t);if(i!==void 0)return i}const n=e.filter(i=>r(i).name===t);if(n.length===1)return n[0];if(n.length>1){const i=n.map(a=>r(a).profileId);throw D(`profile name "${t}" matches ${i.length} profiles: ${i.join(", ")}`,{received:t,candidates:i,next:`Re-run with one exact profile id: ${i.join(", ")}.`})}return null}o(J,"findExactProfile");function T(e,t,r){const n=e.map(i=>`${r(i).profileId} (${r(i).name})`);return d(`profile not found: ${t}`,{received:t,available:n,next:n.length>0?`Re-run with one of the profiles on this host: ${n.join(", ")} \u2014 or create one with \`crtr profile new --name <name>\`.`:"No profiles exist on this host yet \u2014 create one with `crtr profile new --name <name>`."})}o(T,"profileNotFound");function fe(e){const t=se(e);if(t.kind==="resolved")return t.entry;throw T(x(),e,$)}o(fe,"loadProfileManifest");function Re(e){return le(x(),e,$)}o(Re,"resolveProfileOperand");function le(e,t,r){const n=J(e,t,r);if(n!==null)return n;const{match:i,tied:a}=ne(t,e.map(r));if(i!==null){const s=e.find(l=>r(l).profileId===i.profileId);return console.error(`crtr: no profile named "${t}" \u2014 using the closest match: ${r(s).name} (${r(s).profileId})`),s}if(a.length>1){const s=a.map(l=>`${l.profileId} (${l.name})`);throw D(`"${t}" is equally close to ${a.length} profiles: ${s.join(", ")}`,{received:t,candidates:a.map(l=>l.profileId),next:`Re-run with one exact profile id or name: ${s.join(", ")}.`})}throw T(e,t,r)}o(le,"matchProfileOperand");function U(){return A(c(),"profile-locks")}o(U,"locksDir");function v(e,t){return y(e),k(U()),re(A(U(),`${e}.lock`),t,{timeoutError:o(()=>L(`timed out waiting for the profile lock: ${e}`,{next:"Retry \u2014 another `crtr profile` command may be running concurrently on this profile."}),"timeoutError")})}o(v,"withProfileManifestLock");function F(e){const t=E(e);if(!W(t)||!B(t).isDirectory())throw f(`project directory does not exist or is not a directory: ${e}`,{received:e,next:"Pass an existing directory path."});try{return b(t)}catch{return t}}o(F,"resolveExistingProjectDir");function K(e){const t=new Set,r=[];for(const n of e)t.has(n.path)||(t.add(n.path),r.push(n));return r}o(K,"dedupeProjects");function ce(e){let t=e.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"");return t.length>40&&(t=t.slice(0,40).replace(/-+$/g,"")),t.length>0?t:"profile"}o(ce,"slugify");function ue(e){const t=ce(e);for(let r=0;r<20;r++){const n=G().replace(/-/g,"").slice(0,8),i=`${t}-${n}`;if(h(c(),i)===null)return i}throw L(`failed to generate a unique profile id for "${e}" after 20 attempts`)}o(ue,"generateProfileId");function Oe(){return v(p,()=>{const e=h(c(),p);if(e!==null)return w(p,e.manifest),e;const t={schema_version:R,name:oe,projects:[],grantee:"app:terminal",paused_at:null,created_at:m(),last_used_at:m()};return w(p,t),M(c(),{profileId:p,manifest:t}),{profileId:p,manifest:t}})}o(Oe,"ensureRootProfile");const q=/^[A-Za-z0-9][A-Za-z0-9_-]*$/;function H(e){return`CRTR_PROFILE_META_${e.toUpperCase().replace(/[^A-Z0-9]+/g,"_")}`}o(H,"metadataEnvName");function _(e){if(typeof e!="object"||e===null||Array.isArray(e))throw f("metadata must be a map of string keys to string values",{field:"metadata",next:'Pass an object, e.g. {"role": "support"}.'});const t=new Map;for(const[r,n]of Object.entries(e)){if(!q.test(r))throw f(`invalid metadata key: ${JSON.stringify(r)}`,{received:r,field:"metadata",next:"Keys start with a letter or digit, followed by letters, digits, `_`, or `-`."});if(typeof n!="string")throw f(`metadata value for ${r} must be a string`,{received:typeof n,field:"metadata",next:"Every metadata value is an env-var value \u2014 pass strings only."});if(n.includes("\0"))throw f(`metadata value for ${r} contains a NUL byte, which no OS accepts in an environment variable`,{field:"metadata",next:"Remove NUL bytes from the value and retry."});const i=H(r),a=t.get(i);if(a!==void 0)throw f(`metadata keys ${JSON.stringify(a)} and ${JSON.stringify(r)} both surface as ${i}`,{field:"metadata",next:"Rename or drop one \u2014 keys must stay distinct after uppercasing and `_`-folding."});t.set(i,r)}}o(_,"assertProfileMetadata");function Z(e){if(typeof e!="object"||e===null||Array.isArray(e))return{};const t={},r=new Set;for(const[n,i]of Object.entries(e)){if(typeof i!="string"||!q.test(n)||i.includes("\0"))continue;const a=H(n);r.has(a)||(r.add(a),t[n]=i)}return t}o(Z,"sanitizeProfileMetadata");function de(e,t=[],r={}){const n=e.trim();if(n==="")throw f("profile name must not be empty");r.metadata!==void 0&&_(r.metadata),z(t);const i=K(t.map(s=>({path:F(s.path)}))),a=ue(n);return v(a,()=>{const s={schema_version:R,name:n,projects:i,paused_at:null,...r.grantee===void 0?{}:{grantee:r.grantee},...r.defaultKind!==void 0?{default_kind:r.defaultKind}:{},...r.metadata!==void 0&&Object.keys(r.metadata).length>0?{metadata:{...r.metadata}}:{},created_at:m(),last_used_at:null};return w(a,s),M(c(),{profileId:a,manifest:s}),{profileId:a,manifest:s}})}o(de,"createProfile");function ke(e){if(!e.startsWith("app:")||e.length<=4)throw f("an app grantee is required");const t=`app-${e.slice(4)}`,r=x().filter(n=>n.manifest.name===t&&n.manifest.grantee===e);if(r.length>1)throw new Error(`duplicate default profile for ${e}`);return r[0]?r[0]:de(t,[],{grantee:e})}o(ke,"ensureAppProfile");function V(e){if(y(e),h(c(),e)===null)throw d(`profile not found: ${e}`,{received:e,next:"Run `crtr profile list` to see available profiles."})}o(V,"requireExistingProfile");function u(e,t){return V(e),v(e,()=>{const r=te(c(),e,t);if(r===null)throw d(`profile not found: ${e}`,{received:e});return r})}o(u,"mutateManifest");function Me(e){return u(e,t=>({...t,last_used_at:m()}))}o(Me,"updateProfileLastUsed");function pe(e){if(e==null||e==="")return null;try{return fe(e)}catch{return null}}o(pe,"loadProfileManifestOrNull");function De(e){if(e==null||e==="")return!1;try{return y(e),ee(c(),e)}catch{return!1}}o(De,"isProfilePaused");function Le(){return I(c())}o(Le,"pausedCanvasProfiles");function me(e){if(e.manifest.paused_at!==null)throw f(`profile "${e.manifest.name}" is paused and cannot start nodes`,{received:e.profileId,next:`Resume it with \`crtr profile resume ${e.profileId}\`.`})}o(me,"assertProfileEntryActive");function Ne(e){const t=pe(e);return t===null?null:(me(t),t)}o(Ne,"assertProfileActive");function ze(e){return u(e,t=>({...t,paused_at:t.paused_at??m()}))}o(ze,"pauseProfile");function Ce(e){let t=null;return{...u(e,n=>(t=n.paused_at,{...n,paused_at:null})),pausedAt:t}}o(Ce,"resumeProfile");function Je(e,t){return u(e,r=>({...r,default_kind:t}))}o(Je,"setProfileDefaultKind");function Te(e,t,r=[]){return _(t),u(e,n=>{const i={...Z(n.metadata),...t};for(const l of r)delete i[l];_(i);const{metadata:a,...s}=n;return{...s,...Object.keys(i).length>0?{metadata:i}:{}}})}o(Te,"updateProfileMetadata");function Ue(e){if(e===null||e==="")return{};try{return Z(C(e).manifest.metadata)}catch{return{}}}o(Ue,"readProfileMetadata");function Fe(e,t){const r=t.trim();if(r==="")throw f("profile name must not be empty");return u(e,i=>({...i,name:r}))}o(Fe,"renameProfile");function Ke(e,t){z([{path:t}]);const r=F(t);return u(e,i=>({...i,projects:K([...i.projects,{path:r}])}))}o(Ke,"addProfileProject");function qe(e,t,r){return ie({[t]:r}),u(e,n=>{const{[t]:i,...a}=n.delivery_limits??{},s=r==="content"?a:{...a,[t]:r},{delivery_limits:l,...j}=n;return Object.keys(s).length===0?j:{...j,delivery_limits:s}})}o(qe,"setProfileDeliveryLimit");function He(e,t){const r=E(t);let n=r;try{n=b(r)}catch{}return u(e,a=>{const s=a.projects.filter(l=>l.path!==n&&l.path!==r);if(s.length===a.projects.length)throw d(`project not found on profile: ${t}`,{received:t,next:`Current projects: ${a.projects.length>0?a.projects.map(l=>l.path).join(", "):"(none)"}.`});return{...a,projects:s}})}o(He,"removeProfileProject");function Ze(e){V(e),v(e,()=>{const t=g(P(C(e).manifest),e);if(!Q(c(),e))throw d(`profile not found: ${e}`,{received:e});S(t.memory,{recursive:!0,force:!0}),S(t.env,{force:!0})})}o(Ze,"deleteProfile");export{p as ROOT_PROFILE_ID,Ke as addProfileProject,ie as assertDeliveryLimits,Ne as assertProfileActive,me as assertProfileEntryActive,_ as assertProfileMetadata,z as assertProfileProjects,de as createProfile,Ze as deleteProfile,ke as ensureAppProfile,Oe as ensureRootProfile,De as isProfilePaused,x as listProfiles,C as loadExactProfileManifest,fe as loadProfileManifest,se as lookupProfile,le as matchProfileOperand,H as metadataEnvName,ze as pauseProfile,Le as pausedCanvasProfiles,Ee as profileMemoryDir,Ue as readProfileMetadata,He as removeProfileProject,Fe as renameProfile,Re as resolveProfileOperand,Ce as resumeProfile,Z as sanitizeProfileMetadata,Je as setProfileDefaultKind,qe as setProfileDeliveryLimit,Me as updateProfileLastUsed,Te as updateProfileMetadata,v as withProfileManifestLock};

package/dist/core/profiles/select.d.ts

@@ -0,0 +1,46 @@
+import { type ProfileEntry } from './manifest.js';
+import { type BindingId, type BindingResolution, type RawTerminalInput } from '../keybindings/index.js';
+declare const PROFILE_MENU_ACTIONS: readonly ["crtr.profile.menu.abort", "crtr.profile.menu.up", "crtr.profile.menu.down", "crtr.profile.menu.select", "crtr.profile.menu.accept-default", "crtr.profile.menu.slot.1", "crtr.profile.menu.slot.2", "crtr.profile.menu.slot.3", "crtr.profile.menu.slot.4", "crtr.profile.menu.slot.5", "crtr.profile.menu.slot.6", "crtr.profile.menu.slot.7", "crtr.profile.menu.slot.8", "crtr.profile.menu.slot.9", "crtr.profile.menu.create", "crtr.profile.menu.search-existing", "crtr.profile.menu.use-root", "crtr.profile.menu.set-default", "crtr.profile.menu.add-directory", "crtr.profile.menu.unpin", "crtr.profile.menu.manage"];
+declare const PROFILE_SEARCH_ACTIONS: readonly ["crtr.profile.search.abort", "crtr.profile.search.back", "crtr.profile.search.pick", "crtr.profile.search.up", "crtr.profile.search.down", "crtr.profile.search.delete"];
+export declare function resolveProfileMenuAction(bindings: BindingResolution<BindingId>, raw: RawTerminalInput): (typeof PROFILE_MENU_ACTIONS)[number] | null;
+export declare function resolveProfileSearchAction(bindings: BindingResolution<BindingId>, raw: RawTerminalInput): (typeof PROFILE_SEARCH_ACTIONS)[number] | null;
+/** Whether a profile's purview covers `cwd` (cwd at/under one of its project
+ *  dirs, or a project dir under cwd — the workspace-root case). Exported for
+ *  `crtr profile default set`, which rejects pinning a profile that doesn't
+ *  cover cwd (the selector would ignore/self-heal such a pin anyway). */
+export declare function profileCoversCwd(entry: ProfileEntry, cwd: string): boolean;
+/** Resolve the headless selector against existing state without changing it. */
+export declare function selectProfileForCwdReadOnly(cwd: string): string;
+/** Select the profile a node about to boot at `cwd` should run under.
+ *
+ *  1. `explicitProfile` present → resolve it as a user-typed operand (exact id,
+ *     exact name, then the closest fuzzy match — nobody recalls the generated
+ *     `<slug>-<8hex>` id, and a near-miss name should still start the session). If
+ *     its manifest does not already cover `cwd` and the session is interactive,
+ *     offer to add `cwd` to its purview (default yes). Bump `last_used_at`,
+ *     return the id.
+ *  1b. Else, a per-cwd PINNED default (menu `d`) that still covers `cwd` is
+ *     auto-picked outright — interactive and headless alike, no prompt (that is
+ *     what "default" means). Interactive prints a breadcrumb naming it and how
+ *     to change it. `forcePicker` (`crtr --pick-profile`) bypasses the pin to
+ *     re-open the menu. A stale pin (profile gone / no longer covering) is
+ *     cleared and ignored.
+ *  2. Else, if EXACTLY ONE profile's project dir IS `cwd` (you're at a project
+ *     root, unambiguously one owner), auto-pick it with no prompt — the
+ *     strongest signal. If SEVERAL profiles claim `cwd` exactly, it's genuinely
+ *     ambiguous: interactive → menu among them + create; headless → MRU.
+ *  3. Else, among profiles whose project list otherwise COVERS `cwd` (cwd sits
+ *     in a subdir of, or a workspace above, one of their project dirs):
+ *       - Interactive: prompt with a MENU of those covering profiles + "create
+ *         a new profile here", BEFORE pi boots (no root option — the directory
+ *         is covered). Default is the MRU covering profile.
+ *       - Non-interactive: auto-pick the MRU covering profile, no prompt.
+ *  4. Else — nothing covers cwd walking all the way up. Interactive: prompt to
+ *     create a profile here, select an existing profile (a searchable list of
+ *     every profile, for when you started somewhere none of them cover and
+ *     can't recall the exact name — the pick then offers to adopt cwd), or use
+ *     the root profile. Non-interactive (no TTY):
+ *     default to the root profile and print the recovery instruction to STDERR —
+ *     never stdout, which the caller may be piping. */
+export declare function selectProfileForCwd(cwd: string, explicitProfile?: string | null, forcePicker?: boolean): Promise<string>;
+export {};

package/dist/core/profiles/select.js

@@ -0,0 +1,35 @@
+var oe=Object.defineProperty;var l=(t,e)=>oe(t,"name",{value:e,configurable:!0});import{spawnSync as ie}from"node:child_process";import{existsSync as se,realpathSync as le}from"node:fs";import{basename as ce,resolve as ae,sep as S}from"node:path";import{createInterface as v}from"node:readline/promises";import{emitKeypressEvents as E}from"node:readline";import{initializeFreshScopedStore as fe}from"../scoped-state/migrate.js";import{userScopeRoot as ue}from"../scope.js";import{listProfiles as A,loadProfileManifest as pe,resolveProfileOperand as de,updateProfileLastUsed as P,createProfile as me,addProfileProject as j,ensureRootProfile as k,ROOT_PROFILE_ID as D}from"./manifest.js";import{getDefaultProfileId as he,setDefaultProfileId as $e,clearDefaultProfile as O}from"./default-binding.js";import{tildify as b}from"../fs-utils.js";import{stdoutColor as M}from"../output.js";import{inTmux as ge}from"../runtime/placement-tmux.js";import{surfaceTmuxStyleArgs as Ie}from"../runtime/surface-bg.js";import{formatBinding as g,matchesTerminalInput as we,resolveUserKeybindings as ye}from"../keybindings/index.js";const xe=["crtr.profile.menu.abort","crtr.profile.menu.up","crtr.profile.menu.down","crtr.profile.menu.select","crtr.profile.menu.accept-default","crtr.profile.menu.slot.1","crtr.profile.menu.slot.2","crtr.profile.menu.slot.3","crtr.profile.menu.slot.4","crtr.profile.menu.slot.5","crtr.profile.menu.slot.6","crtr.profile.menu.slot.7","crtr.profile.menu.slot.8","crtr.profile.menu.slot.9","crtr.profile.menu.create","crtr.profile.menu.search-existing","crtr.profile.menu.use-root","crtr.profile.menu.set-default","crtr.profile.menu.add-directory","crtr.profile.menu.unpin","crtr.profile.menu.manage"],Pe=["crtr.profile.search.abort","crtr.profile.search.back","crtr.profile.search.pick","crtr.profile.search.up","crtr.profile.search.down","crtr.profile.search.delete"];function L(t,e){return{input:e.ctrl===!0||e.meta===!0?e.name??t:t,upArrow:e.name==="up",downArrow:e.name==="down",return:e.name==="return"||e.name==="enter",escape:e.name==="escape",backspace:e.name==="backspace",ctrl:e.ctrl,meta:e.meta,shift:e.shift}}l(L,"profileRawInput");function N(t,e,r){return e.find(n=>we(t,n,r))??null}l(N,"firstProfileMatch");function be(t,e){return N(t,xe,e)}l(be,"resolveProfileMenuAction");function ve(t,e){return N(t,Pe,e)}l(ve,"resolveProfileSearchAction");function Y(t){const e=ae(t);if(!se(e))return e;try{return le(e)}catch{return e}}l(Y,"resolveCwd");function B(t,e){return!!(t===e||t.startsWith(e+S)||e.startsWith(t+S))}l(B,"projectCovers");function F(t,e){return t.manifest.projects.some(r=>B(e,r.path))}l(F,"profileCoversCwd");function T(t,e){return t===null?!1:e===null?!0:t>e}l(T,"isMoreRecent");function W(t){return t.reduce((e,r)=>T(r.manifest.last_used_at,e.manifest.last_used_at)?r:e)}l(W,"pickMostRecent");function U(t){const e=Y(t),r=A().filter(o=>F(o,e)),n=r.filter(o=>o.manifest.projects.some(u=>u.path===e)),s=he(e),i=s===null?null:r.find(o=>o.profileId===s)??null;return{covering:r,exact:n,pinnedId:s,pinned:i}}l(U,"profileSelectionState");function Je(t){const{covering:e,exact:r,pinned:n}=U(t);if(n!==null)return n.profileId;if(r.length===1)return r[0].profileId;const s=r.length>0?r:e;return s.length>0?W(s).profileId:D}l(Je,"selectProfileForCwdReadOnly");function H(){return!!process.stdin.isTTY&&!!process.stdout.isTTY}l(H,"isInteractive");const $=M.dim,x=M.bold,w=M.cyan;function Me(t){return w(x(t))}l(Me,"key");function K(t){if(t===null)return"never used";const e=Date.parse(t);if(Number.isNaN(e))return"used recently";const r=Math.max(0,Math.floor((Date.now()-e)/1e3));if(r<60)return"used just now";const n=Math.floor(r/60);if(n<60)return`used ${n}m ago`;const s=Math.floor(n/60);if(s<24)return`used ${s}h ago`;const i=Math.floor(s/24);if(i<30)return`used ${i}d ago`;const o=Math.floor(i/30);return o<12?`used ${o}mo ago`:`used ${Math.floor(o/12)}y ago`}l(K,"relativeUsed");function Te(t,e){const r=e!==void 0?`  ${$(e)}
+`:"";process.stdout.write(`
+  ${x(t)}
+${r}
+`)}l(Te,"writeHeader");function _e(t){const e=t.manifest.projects.length,r=t.manifest.projects[0];return r===void 0?K(t.manifest.last_used_at):e>1?`${b(r.path)} \xB7 ${e} dirs total`:b(r.path)}l(_e,"purviewSummary");const q=w("\u25B8"),z=l(t=>t>0?`\x1B[${t}A\r`:"","cursorUp"),G="\x1B[0J",Ce=/\u001b\[[0-9;]*m/g;function J(t){const e=process.stdout.columns??80,r=t.split(`
+`),n=r.length-1;let s=0;for(let i=0;i<n;i++){const o=r[i].replace(Ce,"").length;e>0&&o>e&&(s+=Math.ceil(o/e)-1)}return n+s}l(J,"blockRows");function Re(t,e,r,n,s,i){let o=`
+  ${x(e)}
+`;r!==void 0&&(o+=`  ${$(r)}
+`),o+=`
+`;let u=0;for(const[h,m]of n.entries()){const a=m.bindingId===void 0?++u:0,d=m.bindingId!==void 0?g(t,m.bindingId):a<=9?g(t,`crtr.profile.menu.slot.${a}`):"",p=h===s?q:" ",f=m.detail!==""?"  "+$(m.detail):"",c=m.isDefault?"  "+w("\xB7 "+(m.defaultText??"default")):"";o+=`  ${p} ${Me(d)}  ${m.label}${f}${c}
+`}return i!==void 0&&(o+=`
+    ${$(i)}
+`),o+=`
+  ${$(`${g(t,"crtr.profile.menu.up")}/${g(t,"crtr.profile.menu.down")} move  ${g(t,"crtr.profile.menu.select")} select  ${g(t,"crtr.profile.menu.accept-default")} default  ${g(t,"crtr.profile.menu.abort")} quit`)}
+`,o}l(Re,"renderMenu");function Q(t,e,r,n,s={}){const i=[];n.forEach((u,h)=>{u.bindingId===void 0&&i.push(h)});let o=s.initialIndex??0;return new Promise(u=>{let h=0;const m=l(()=>{const p=Re(t,e,r,n,o,s.hint);process.stdout.write((h>0?z(h)+G:"")+p),h=J(p)},"draw"),a=l(()=>{process.stdin.off("keypress",d),process.stdin.isTTY&&process.stdin.setRawMode(!1),process.stdin.pause()},"cleanup"),d=l((p,f)=>{const c=be(t,L(p,f));if(c==="crtr.profile.menu.abort"&&(a(),process.stdout.write(`
+`),process.exit(130)),c==="crtr.profile.menu.up"){o=(o-1+n.length)%n.length,m();return}if(c==="crtr.profile.menu.down"){o=(o+1)%n.length,m();return}if(c==="crtr.profile.menu.select"){a(),u({index:o});return}if(c==="crtr.profile.menu.accept-default"){a(),u({index:s.initialIndex??0});return}if(c?.startsWith("crtr.profile.menu.slot.")){const I=Number.parseInt(c.slice(-1),10);I>=1&&I<=i.length&&(o=i[I-1],m());return}const y=n.findIndex(I=>I.bindingId!==void 0&&I.bindingId===c);if(y>=0){a(),u({index:y});return}c!==null&&s.actionBindingIds?.includes(c)===!0&&(a(),u({index:o,action:c}))},"onKey");E(process.stdin),process.stdin.isTTY&&process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("keypress",d),m()})}l(Q,"runMenu");function V(t){return ge()?(ie("tmux",["display-popup","-E","-T"," profiles ","-w","90%","-h","85%","-d",t,...Ie(),"crtr sys settings --page profiles"],{stdio:"inherit"}),!0):(process.stdout.write(`  ${$("the profile manager needs tmux \u2014 run `crtr sys settings` instead")}
+`),!1)}l(V,"openProfileManager");const _=Symbol("profile-manager-ran");function X(t){return`  ${w("\u203A")} ${$(t)} `}l(X,"caret");function Se(t){return`crtr: no profile covers ${t}, and this session is non-interactive \u2014 using the root profile.
+Run \`crtr profile new --name <name> --project ${t}\` to create a dedicated profile, or pass --profile <id-or-name> next time.
+`}l(Se,"rootProfileMessage");async function Ee(t,e){const r=v({input:process.stdin,output:process.stdout});try{Te(`Profile "${t.manifest.name}" doesn't cover this directory`),await Z(r,t,e)}finally{r.close()}}l(Ee,"promptAddDirToProfile");async function Z(t,e,r){const n=(await t.question(X(`add this directory to "${e.manifest.name}"? [Y/n]`))).trim().toLowerCase();n==="n"||n==="no"||(j(e.profileId,r),process.stdout.write(`  ${w("\u2713")} ${$(`added this directory to "${e.manifest.name}"`)}
+`))}l(Z,"offerAddDirToProfile");async function Ae(t){const e=[...A()].filter(i=>i.profileId!==D).sort((i,o)=>T(i.manifest.last_used_at,o.manifest.last_used_at)?-1:1);if(e.length===0)return process.stdout.write(`  ${$("no existing profiles to select")}
+`),null;let r="",n=0;const s=l(()=>r===""?e:e.filter(i=>i.manifest.name.toLowerCase().includes(r)||i.manifest.projects.some(o=>b(o.path).toLowerCase().includes(r))),"matchesOf");return new Promise(i=>{let o=0;const u=l(()=>{const a=s();n>=a.length&&(n=Math.max(0,a.length-1));let d=`
+  ${x("Select an existing profile")}
+`;if(d+=`  ${$("across every profile, not just this directory")}
+
+`,a.length===0)d+=`    ${$(`no match for "${r}"`)}
+`;else{const p=Math.max(...a.map(f=>f.manifest.name.length));a.forEach((f,c)=>{d+=`  ${c===n?q:" "} ${x(f.manifest.name.padEnd(p))}  ${$(_e(f))}
+`})}d+=`
+  ${w("\u203A")} ${r}${$("\u2588")}
+`,d+=`  ${$(`type to filter  ${g(t,"crtr.profile.search.up")}/${g(t,"crtr.profile.search.down")} move  ${g(t,"crtr.profile.search.pick")} pick  ${g(t,"crtr.profile.search.back")} back`)}
+`,process.stdout.write((o>0?z(o)+G:"")+d),o=J(d)},"draw"),h=l(()=>{process.stdin.off("keypress",m),process.stdin.isTTY&&process.stdin.setRawMode(!1),process.stdin.pause()},"cleanup"),m=l((a,d)=>{const p=ve(t,L(a,d));if(p==="crtr.profile.search.abort"&&(h(),process.stdout.write(`
+`),process.exit(130)),p==="crtr.profile.search.back"){h(),i(null);return}const f=s();if(p==="crtr.profile.search.pick"){f.length>0&&(h(),i(f[n].profileId));return}if(p==="crtr.profile.search.up"){f.length>0&&(n=(n-1+f.length)%f.length,u());return}if(p==="crtr.profile.search.down"){f.length>0&&(n=(n+1)%f.length,u());return}if(p==="crtr.profile.search.delete"){r=r.slice(0,-1),n=0,u();return}a!==void 0&&a.length===1&&a>=" "&&d.ctrl!==!0&&(r+=a.toLowerCase(),n=0,u())},"onKey");E(process.stdin),process.stdin.isTTY&&process.stdin.setRawMode(!0),process.stdin.resume(),process.stdin.on("keypress",m),u()})}l(Ae,"promptSelectExistingProfile");async function ee(t,e){const r=ce(e)||"profile",n=(await t.question(X(`name the new profile [${r}]`))).trim(),s=n!==""?n:r,i=me(s,[{path:e}]).profileId;return process.stdout.write(`  ${w("\u2713")} ${$(`created profile "${s}"`)}
+`),i}l(ee,"createProfileHere");async function je(t,e){const r=[{label:"create a profile here",detail:"",bindingId:"crtr.profile.menu.create"},{label:"select an existing profile",detail:"",bindingId:"crtr.profile.menu.search-existing"},{label:$("use the root profile"),detail:"",bindingId:"crtr.profile.menu.use-root",isDefault:!0}];for(;;){const n=await Q(e,"No profile covers this directory",void 0,r,{initialIndex:2,actionBindingIds:["crtr.profile.menu.manage"],hint:`${g(e,"crtr.profile.menu.manage")}=manage profiles`});if(n.action==="crtr.profile.menu.manage"){if(V(t))return _;continue}if(n.index===0){const s=v({input:process.stdin,output:process.stdout});try{return await ee(s,t)}finally{s.close()}}if(n.index===1){const s=await Ae(e);if(s===null)continue;const i=pe(s),o=v({input:process.stdin,output:process.stdout});try{await Z(o,i,t)}finally{o.close()}return i.profileId}return k().profileId}}l(je,"promptCreateOrRoot");async function C(t,e,r,n,s){const i=[...t].sort((c,y)=>T(c.manifest.last_used_at,y.manifest.last_used_at)?-1:1),o=n!==null?i.find(c=>c.profileId===n)??null:null,u=o!==null?[o,...i.filter(c=>c!==o)]:i,h=Math.max(...u.map(c=>c.manifest.name.length)),m=u.map((c,y)=>{const I=c.manifest.projects.length,te=r?`${K(c.manifest.last_used_at)}${I>1?` \xB7 ${I} dirs total`:""}`:(()=>{const R=c.manifest.projects.find(ne=>B(e,ne.path))??c.manifest.projects[0];return I>1?`matches ${b(R.path)} \xB7 ${I} dirs total`:`matches ${b(R.path)}`})(),re=o!==null&&u[0]===o?"default (pinned)":"default";return{label:x(c.manifest.name.padEnd(h)),detail:te,isDefault:y===0,defaultText:re}});m.push({label:$("create a new profile here"),detail:"",bindingId:"crtr.profile.menu.create"});const a=["crtr.profile.menu.set-default","crtr.profile.menu.manage"];r||a.push("crtr.profile.menu.add-directory"),o!==null&&a.push("crtr.profile.menu.unpin");const d=[`${g(s,"crtr.profile.menu.set-default")}=set default`];r||d.push(`${g(s,"crtr.profile.menu.add-directory")}=add dir here`),o!==null&&d.push(`${g(s,"crtr.profile.menu.unpin")}=unpin`),d.push(`${g(s,"crtr.profile.menu.manage")}=manage profiles`);const p=await Q(s,r?"Choose a profile":"Select a profile",r?"Several profiles claim this directory as their project":"This directory falls under existing profile(s)",m,{actionBindingIds:a,hint:d.join("  ")});if(p.action==="crtr.profile.menu.manage")return V(e)?_:await C(t,e,r,n,s);if(p.index>=u.length){const c=v({input:process.stdin,output:process.stdout});try{return await ee(c,e)}finally{c.close()}}const f=u[p.index];return p.action==="crtr.profile.menu.unpin"?(O(e),process.stdout.write(`  ${w("\u2713")} ${$("cleared the default for this directory")}
+`),f.profileId):(p.action==="crtr.profile.menu.set-default"?($e(e,f.profileId),process.stdout.write(`  ${w("\u2713")} ${$(`"${f.manifest.name}" is now the default here`)}
+`)):p.action==="crtr.profile.menu.add-directory"&&(j(f.profileId,e),process.stdout.write(`  ${w("\u2713")} ${$(`added this directory to "${f.manifest.name}"`)}
+`)),f.profileId)}l(C,"promptPickProfileOrCreate");async function Qe(t,e,r=!1){fe({kind:"user",root:ue()});const n=Y(t),s=ye();if(e!=null&&e!==""){const i=de(e);return!F(i,n)&&H()&&await Ee(i,n),P(i.profileId),i.profileId}for(;;){const{covering:i,exact:o,pinnedId:u,pinned:h}=U(n);if(u!==null&&h===null&&O(n),h!==null&&!r)return P(h.profileId),h.profileId;if(!r&&h===null&&o.length===1)return P(o[0].profileId),o[0].profileId;if(!H()){const d=o.length>0?o:i;if(d.length>0){const f=W(d);return P(f.profileId),f.profileId}const p=k();return process.stderr.write(Se(n)),p.profileId}const m=h!==null?h.profileId:null,a=o.length>1?await C(o,n,!0,m,s):i.length>0?await C(i,n,!1,m,s):await je(n,s);if(a!==_)return P(a),a}}l(Qe,"selectProfileForCwd");export{F as profileCoversCwd,be as resolveProfileMenuAction,ve as resolveProfileSearchAction,Qe as selectProfileForCwd,Je as selectProfileForCwdReadOnly};

package/dist/core/provider-credential.d.ts

@@ -0,0 +1,6 @@
+import type { ModelRegistry, ModelRuntime } from '@earendil-works/pi-coding-agent';
+/** Whether the provider has a credential crouter can use. This is the same
+ * configured predicate shown by the setup Providers panel. */
+export declare function isProviderCredentialConfigured(providerId: string, registry: ModelRegistry): boolean;
+/** Whether any provider in the setup catalog has a usable configured credential. */
+export declare function hasProviderCredential(runtime: ModelRuntime, registry: ModelRegistry): boolean;

package/dist/core/provider-credential.js

@@ -0,0 +1 @@
+var i=Object.defineProperty;var t=(e,r)=>i(e,"name",{value:r,configurable:!0});import{isManagedProvider as n,readSubscriptionPool as d}from"./subscription-state.js";function a(e,r){return r.getProviderAuthStatus(e).configured||n(e)&&d(e).length>0}t(a,"isProviderCredentialConfigured");function g(e,r){return[...new Set([...e.getProviders().map(o=>o.id),...r.getAll().map(o=>o.provider)])].some(o=>a(o,r))}t(g,"hasProviderCredential");export{g as hasProviderCredential,a as isProviderCredentialConfigured};

package/dist/core/provider-error-recognition.d.ts

@@ -0,0 +1,27 @@
+export type ProviderErrorSignalKind = 'rate-limit' | 'auth' | 'protocol' | 'context-overflow' | 'overloaded' | 'overloaded-only' | 'transient-http' | 'connection' | 'connection-only' | 'socket' | 'service-unavailable' | 'other';
+export type ProviderErrorMatchedOn = 'errno' | 'status' | 'websocket-close' | 'text' | 'none';
+export interface ProviderErrorTextMatch {
+    kind: ProviderErrorSignalKind;
+    match: string;
+}
+export interface ProviderErrorSignal {
+    kind: ProviderErrorSignalKind;
+    matchedOn: ProviderErrorMatchedOn;
+    status?: number;
+    retryAfterMs?: number;
+    match?: string;
+    textKind?: ProviderErrorSignalKind;
+    textMatch?: string;
+    textMatches?: readonly ProviderErrorTextMatch[];
+}
+export interface ProviderErrorRecognitionInput {
+    status?: unknown;
+    retryAfterMs?: number;
+    code?: unknown;
+    errno?: unknown;
+    wsCloseCode?: unknown;
+    wsCloseReason?: unknown;
+    message?: string;
+}
+/** Recognizes provider failure facts. Consumers apply their own retry policy. */
+export declare function recognizeProviderError(input: ProviderErrorRecognitionInput): ProviderErrorSignal;

package/dist/core/provider-error-recognition.js

@@ -0,0 +1 @@
+var b=Object.defineProperty;var a=(t,e)=>b(t,"name",{value:e,configurable:!0});function d(t){return typeof t=="string"?t:""}a(d,"text");function n(t,e,o={}){return{kind:t,matchedOn:e,...o}}a(n,"signal");function i(t,e){return e.matchedOn==="text"?{...t,textKind:e.kind,textMatch:e.match,textMatches:e.textMatches}:t}a(i,"withTextMatch");const h=[["rate-limit",/rate.?limit|\b429\b|too many requests|usage[ _]limit|usage_not_included|usagelimiterror|insufficient_quota|quota exceeded/i],["protocol",/\b413\b|payload too large|entity too large|request too large|entity\.too\.large|body exceeds/i],["auth",/invalid_grant|refresh token|unauthori[sz]ed|invalid.?api.?key|authentication failed|\b401\b|\b403\b/i],["context-overflow",/context overflow recovery failed/i],["protocol",/websocket.*(?:closed.*\b(?:1002|1003|1007|1008|1009|1010)\b|protocol error|policy violation|unsupported data|invalid (?:frame|payload)|message too big|mandatory extension)/i],["overloaded-only",/lock file is already being held/i],["overloaded",/overloaded|temporarily unavailable/i],["service-unavailable",/service.?unavailable/i],["overloaded-only",/internal server error|api.?error|\b5\d\d\b|capacity|server.{0,3}busy/i],["connection",/connection|econnreset|etimedout|enotfound|econnrefused|network|fetch failed|socket hang|timed? out|timeout|websocket\s+(?:was\s+)?closed|websocket stream closed before response\.completed|websocket\s+error|websocket.*interrupt/i],["socket",/socket/i],["connection-only",/eai_again|epipe|ehostunreach|enetunreach|\bterminated\b|other side closed|premature close/i]];function f(t){const e=h.flatMap(([c,r])=>{const s=t.match(r);return s?[{kind:c,match:s[0]}]:[]}),o=e[0];return o===void 0?n("other","none"):{...n(o.kind,"text",{match:o.match}),textMatches:e}}a(f,"recognizeText");function E(t){const e=t.retryAfterMs,o=f(t.message??""),c=d(t.code)||d(t.errno);if(/^(ECONNREFUSED|ECONNRESET|ETIMEDOUT|ENOENT|ENOTFOUND|EAI_AGAIN|EPIPE|EHOSTUNREACH|ENETUNREACH)$/i.test(c))return i(n("connection","errno",{retryAfterMs:e}),o);if(/^ELOCKED$/i.test(c))return i(n("overloaded","errno",{retryAfterMs:e}),o);const r=typeof t.status=="number"?t.status:void 0;if(r!==void 0){if(r===401||r===403)return i(n("auth","status",{status:r,retryAfterMs:e}),o);if(r===429)return i(n("rate-limit","status",{status:r,retryAfterMs:e}),o);if(r===500||r===502||r===503||r===504)return i(n("transient-http","status",{status:r,retryAfterMs:e}),o);if(r>=500&&r<=599)return i(n("overloaded","status",{status:r,retryAfterMs:e}),o);if(r>=400&&r<=499)return i(n("protocol","status",{status:r,retryAfterMs:e}),o)}const s=typeof t.wsCloseCode=="number"?t.wsCloseCode:void 0;if(s===1008)return i(n("protocol","websocket-close",{retryAfterMs:e}),o);if(s===1006)return i(n("connection","websocket-close",{retryAfterMs:e}),o);if(s===1011){const l=d(t.wsCloseReason),u=f(l);return/no running broker/i.test(l)||u.kind==="connection"||u.kind==="connection-only"?i(n("connection","websocket-close",{retryAfterMs:e}),o):i(n("other","websocket-close",{retryAfterMs:e}),o)}return e===void 0?o:{...o,retryAfterMs:e}}a(E,"recognizeProviderError");export{E as recognizeProviderError};

package/dist/core/provider-failure.d.ts

@@ -0,0 +1,42 @@
+import type { AssistantMessageDiagnostic } from '@earendil-works/pi-ai';
+export declare const PROVIDER_FAILURE_DIAGNOSTIC = "crtr:provider-failure";
+export interface ProviderFailureCause {
+    message?: string;
+    status?: number;
+    code?: string | number;
+    errno?: string;
+    body?: string;
+}
+/** A 429's rate-limit facts: which scope it cooled and its rate-limit headers (no auth material). */
+export interface ProviderRateLimitDetails {
+    /** `account`, or `model:<family>` when only one model family on the account was cooled. */
+    scope?: string;
+    /** `anthropic-ratelimit-unified-representative-claim`, when the response carried one. */
+    claim?: string;
+    /** The account label that was rate-limited, for managed subscription pools. */
+    account?: string;
+    /** `provider/model` the 429 answered, when it differs from the fault's own model. */
+    model?: string;
+    headers: Record<string, string>;
+}
+export interface ProviderFailureDetails {
+    status?: number;
+    code?: string | number;
+    errno?: string;
+    body?: string;
+    causes?: ProviderFailureCause[];
+    ratelimit?: ProviderRateLimitDetails;
+}
+export interface NormalizedProviderFailure extends ProviderFailureDetails {
+    message: string;
+}
+/** Converts an arbitrary provider failure into serializable facts before an SDK stream flattens it to `errorMessage`. */
+export declare function normalizeProviderFailure(error: unknown, observed?: {
+    status?: number;
+}): NormalizedProviderFailure;
+/** The stable diagnostic carrier for normalized provider error facts on an assistant error message. */
+export declare function providerFailureDiagnostic(details: ProviderFailureDetails): AssistantMessageDiagnostic;
+/** Strictly parse a recorded rate-limit block: string headers only, capped, unknown keys dropped. */
+export declare function parseProviderRateLimit(value: unknown): ProviderRateLimitDetails | undefined;
+/** Reads provider facts from the assistant-message diagnostic without trusting arbitrary nested error objects. */
+export declare function extractProviderFailureDetails(message: unknown): ProviderFailureDetails | undefined;

package/dist/core/provider-failure.js

@@ -0,0 +1 @@
+var I=Object.defineProperty;var r=(e,n)=>I(e,"name",{value:n,configurable:!0});import{isRecord as h}from"../shared/predicates.js";const g="crtr:provider-failure",A=8;function i(e){return typeof e=="string"&&e.trim()!==""?e.trim():void 0}r(i,"text");function a(e){return typeof e=="number"&&Number.isFinite(e)?e:void 0}r(a,"status");function m(e){return typeof e=="string"||typeof e=="number"?e:void 0}r(m,"code");function u(e){return h(e)?e:void 0}r(u,"record");function y(e){const n=i(e.errorMessage)??i(e.message)??i(e.reason)??i(e.statusText),d={...n===void 0?{}:{message:n},...a(e.status)===void 0?{}:{status:a(e.status)},...m(e.code)===void 0?{}:{code:m(e.code)},...i(e.errno)===void 0?{}:{errno:i(e.errno)},...i(e.body)===void 0?{}:{body:i(e.body)}};return Object.keys(d).length===0?void 0:d}r(y,"failureCause");function M(e,n={}){const d=u(e),o=d===void 0?void 0:y(d),t=[],s=new Set([e]);let f=d===void 0?void 0:u(d.cause);for(;f!==void 0&&!s.has(f)&&t.length<A;){s.add(f);const c=y(f);c!==void 0&&t.push(c),f=u(f.cause)}return{message:o?.message??(e instanceof Error?e.message:void 0)??String(e??"Provider request failed"),...(n.status??o?.status)===void 0?{}:{status:n.status??o?.status},...o?.code===void 0?{}:{code:o.code},...o?.errno===void 0?{}:{errno:o.errno},...o?.body===void 0?{}:{body:o.body},...t.length===0?{}:{causes:t}}}r(M,"normalizeProviderFailure");function _(e){return{type:g,timestamp:Date.now(),details:E(e)}}r(_,"providerFailureDiagnostic");function E(e){const n=b(e);if(e.causes!==void 0&&(n.causes=e.causes.map(b)),e.ratelimit!==void 0){const d={headers:{...e.ratelimit.headers}};e.ratelimit.scope!==void 0&&(d.scope=e.ratelimit.scope),e.ratelimit.claim!==void 0&&(d.claim=e.ratelimit.claim),e.ratelimit.account!==void 0&&(d.account=e.ratelimit.account),e.ratelimit.model!==void 0&&(d.model=e.ratelimit.model),n.ratelimit=d}return n}r(E,"jsonDetails");const L=48,R=256;function l(e){const n=u(e),d=u(n?.headers);if(n===void 0||d===void 0)return;const o={};for(const[t,s]of Object.entries(d)){if(Object.keys(o).length>=L)break;typeof s=="string"&&(o[t.toLowerCase()]=s.slice(0,R))}return{...i(n.scope)===void 0?{}:{scope:i(n.scope)},...i(n.claim)===void 0?{}:{claim:i(n.claim)},...i(n.account)===void 0?{}:{account:i(n.account)},...i(n.model)===void 0?{}:{model:i(n.model)},headers:o}}r(l,"parseProviderRateLimit");function b(e){const n={};return e.message!==void 0&&(n.message=e.message),e.status!==void 0&&(n.status=e.status),e.code!==void 0&&(n.code=e.code),e.errno!==void 0&&(n.errno=e.errno),e.body!==void 0&&(n.body=e.body),n}r(b,"jsonCause");function T(e){const n=u(e)?.diagnostics;if(Array.isArray(n))for(const d of n){const o=u(d);if(o?.type!==g)continue;const t=u(o.details);if(t===void 0)continue;const s=Array.isArray(t.causes)?t.causes.flatMap(f=>{const p=u(f),c=p===void 0?void 0:y(p);return c===void 0?[]:[c]}):void 0;return{...a(t.status)===void 0?{}:{status:a(t.status)},...m(t.code)===void 0?{}:{code:m(t.code)},...i(t.errno)===void 0?{}:{errno:i(t.errno)},...i(t.body)===void 0?{}:{body:i(t.body)},...s===void 0||s.length===0?{}:{causes:s},...l(t.ratelimit)===void 0?{}:{ratelimit:l(t.ratelimit)}}}}r(T,"providerFailureDetails");function w(e){return T(e)}r(w,"extractProviderFailureDetails");export{g as PROVIDER_FAILURE_DIAGNOSTIC,w as extractProviderFailureDetails,M as normalizeProviderFailure,l as parseProviderRateLimit,_ as providerFailureDiagnostic};

package/dist/core/provider-management.d.ts

@@ -0,0 +1,12 @@
+/** The minimal shape of a Providers-panel row the removal router needs. */
+export interface RemovableProviderRow {
+    providerId: string;
+    name: string;
+    managed: boolean;
+    configured?: boolean;
+    label?: string;
+}
+/** Route a row's removal to the coordinated service (managed) or auth.json (non-managed) and
+ *  return the truthful panel notice. May throw (e.g. an unknown-subscription error) — callers
+ *  surface that as the notice. */
+export declare function removeProviderRow(agentDir: string, row: RemovableProviderRow): Promise<string>;

package/dist/core/provider-management.js

@@ -0,0 +1 @@
+var i=Object.defineProperty;var a=(r,e)=>i(r,"name",{value:e,configurable:!0});import{join as m}from"node:path";import{deleteAuthCredential as n}from"./auth-file.js";import{secretsDir as t}from"./layout.js";import{removeManagedProvider as o}from"./subscription-state.js";async function l(r,e){return e.managed?(await o(e.providerId,e.label),e.label===void 0?`Removed ${e.name}`:`Removed ${e.name} account`):(await n(e.providerId,m(t(),"auth.json")),`Removed ${e.name}`)}a(l,"removeProviderRow");export{l as removeProviderRow};

package/dist/core/providers/approval.d.ts

@@ -0,0 +1,23 @@
+import type { ProviderCaller, ProviderCallInput } from '../../daemon/api/handlers/providers.js';
+import type { PreparedFileCall } from './files.js';
+export interface ApprovalQuestion {
+    title: string;
+    body: string;
+    options: Array<{
+        option_id: string;
+        label: string;
+    }>;
+}
+/** A runless repeat consumes an answer exactly once, before any provider request. */
+export declare function consumeApproval(caller: ProviderCaller, input: ProviderCallInput, callShape: string): {
+    option: string;
+    requestId: string;
+    prepared: PreparedFileCall | null;
+};
+/** Called when the human ticket settles (answer or cancel), in the settlement transaction. */
+export declare function notifyProviderApproval(questionId: string): void;
+/** Create a page and either suspend a run or return its durable id to an app. */
+export declare function requireProviderApproval(caller: ProviderCaller, input: ProviderCallInput, requestId: string, question: unknown, signal: AbortSignal, callShape?: string, prepared?: PreparedFileCall): Promise<{
+    option: string;
+    questionId: string;
+}>;

package/dist/core/providers/approval.js

@@ -0,0 +1,3 @@
+var b=Object.defineProperty;var a=(r,e)=>b(r,"name",{value:e,configurable:!0});import{prepared as l}from"../sqlite-statements.js";import{createHash as q}from"node:crypto";import{openDb as E,withCanvasWrite as v}from"../canvas/db.js";import{newNodeId as A}from"../runtime/nodes.js";import{createPageRequest as S,getRequest as N}from"../human/requests.js";import{providerApprovalPage as O}from"../runs/questions.js";import{ProviderError as c}from"./errors.js";function _(r){return Array.isArray(r)?r.map(_):r!==null&&typeof r=="object"?Object.fromEntries(Object.entries(r).sort(([e],[n])=>e.localeCompare(n)).map(([e,n])=>[e,_(n)])):r}a(_,"canonical");function y(r){return q("sha256").update(JSON.stringify(_(r))).digest("hex")}a(y,"hashArgs");function f(){return new c("invalid_request","approval is not an answered question for this call",{param:"approval"})}a(f,"invalidApproval");function s(){return new c("user_denied","the user did not approve this call")}a(s,"denied");function R(r){if(r.aborted)throw s()}a(R,"canceled");function m(r){return l(E(),"SELECT * FROM provider_approvals WHERE question_id = ?").get(r)}a(m,"row");function z(r,e,n){const o=e.approval;if(!o||r.run_id!==null||r.grantee===null||r.sub===null)throw f();const t=m(o);if(!t||t.grantee!==r.grantee||t.sub!==r.sub||t.provider!==e.provider||t.tool!==e.tool||t.version!==(e.version??null)||t.args_hash!==y(e.arguments)||t.call_shape!==n)throw f();const p=N(o);if(!p||p.state!=="settled"||p.outcome!=="answered"||t.status!=="answered")throw f();const i=t.option_id;if(!i||v(d=>l(d,"UPDATE provider_approvals SET status = 'consumed' WHERE question_id = ? AND status = 'answered'").run(o).changes)!==1)throw f();if(i==="deny")throw s();return{option:i,requestId:t.request_id,prepared:t.prepared_files?JSON.parse(t.prepared_files):null}}a(z,"consumeApproval");function T(r){if(!r||typeof r!="object"||Array.isArray(r))throw new c("provider_error","provider approval question is invalid",{origin:"provider"});const e=r,n=e.options;if(typeof e.title!="string"||!e.title.trim()||typeof e.body!="string"||!Array.isArray(n)||n.length===0||n.some(o=>!o||typeof o!="object"||typeof o.option_id!="string"||!/^[A-Za-z0-9_-]{1,64}$/.test(o.option_id)||o.option_id==="deny"||typeof o.label!="string"||!o.label.trim())||new Set(n.map(o=>o.option_id)).size!==n.length)throw new c("provider_error","provider approval question is invalid",{origin:"provider"});return e}a(T,"validateQuestion");const w=new Map;function C(r){for(const e of w.get(r)??[])queueMicrotask(e)}a(C,"notifyProviderApproval");async function P(r,e){const n=a(()=>{const t=m(r);if(!t||t.status==="canceled")throw s();return t.status==="answered"?t.option_id:null},"read");if(e.aborted)throw s();let o=n();if(o==="deny")throw s();if(o!==null)return o;if(await new Promise(t=>{const p=w.get(r)??new Set,i=a(()=>{e.removeEventListener("abort",i),p.delete(i),p.size||w.delete(r),t()},"wake");p.add(i),w.set(r,p),e.addEventListener("abort",i,{once:!0}),(e.aborted||m(r)?.status!=="open")&&i()}),e.aborted||(o=n(),o===null||o==="deny"))throw s();return o}a(P,"waitForApproval");async function F(r,e,n,o,t,p,i){const g=T(o);if(!r.sub||!r.grantee)throw new c("grant_revoked","caller has no active grant");R(t);const d=A();v(u=>l(u,`INSERT INTO provider_approvals
+    (question_id, grantee, sub, provider, tool, version, args_hash, request_id, status, call_shape, prepared_files)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, 'open', ?, ?)`).run(d,r.grantee,r.sub,e.provider,e.tool,e.version??null,y(e.arguments),n,p??null,i&&(i.copies.length||i.upload)?JSON.stringify(i):null));try{S({request_id:d,requester_node_id:r.run_id?r.node_id:null,prepared:O(g)})}catch(u){throw v(h=>l(h,"DELETE FROM provider_approvals WHERE question_id = ? AND status = 'open'").run(d)),u}if(!r.run_id){if(t.aborted){const{cancelHumanTicket:u}=await import("../../daemon/human/finish.js");throw await u(d,{reason:"the provider call was canceled"}),s()}throw new c("approval_pending","the provider requires the user to answer a question",{question_id:d})}try{const u=await P(d,t);if(t.aborted)throw s();return{option:u,questionId:d}}catch(u){if(t.aborted){const{cancelHumanTicket:h}=await import("../../daemon/human/finish.js");throw await h(d,{reason:"the provider call was canceled"}),s()}throw u}}a(F,"requireProviderApproval");export{z as consumeApproval,C as notifyProviderApproval,F as requireProviderApproval};

package/dist/core/providers/audit.d.ts

@@ -0,0 +1,28 @@
+import type { ProviderCaller } from '../../daemon/api/handlers/providers.js';
+export interface ProviderAudit {
+    request_id: string;
+    caller: ProviderCaller;
+    provider: string;
+    tool: string;
+    scope_checked?: string;
+    outcome: string;
+    jti?: string;
+    receipt_id?: string;
+    responder?: string;
+    question_id?: string;
+}
+/** One row per authorization, including refusals before a token is minted. */
+export declare function writeProviderAudit(row: ProviderAudit): void;
+export interface AuditFilters {
+    after?: number;
+    limit: number;
+    operation?: string;
+    outcome?: string;
+    run_id?: string;
+    since?: string;
+    until?: string;
+}
+export declare function listAudit(grantee: string | null, filters: AuditFilters): {
+    rows: Record<string, unknown>[];
+    next: string | null;
+};

package/dist/core/providers/audit.js

@@ -0,0 +1,4 @@
+var a=Object.defineProperty;var r=(n,e)=>a(n,"name",{value:e,configurable:!0});import{prepared as m}from"../sqlite-statements.js";import{openDb as p}from"../canvas/db.js";import{runtimeId as h}from"../grants/sync.js";import{terminalGrant as _}from"../grants/mirror.js";function O(n){const{caller:e}=n,i=e.sub??(e.class==="person"?_()?.sub??null:null),t=e.grantee??i,o=i&&t?[i,t,`runtime:${h()}`]:null;m(p(),`INSERT INTO audit_rows
+    (request_id, time, grantee, sub, client_id, class, operation, scope_checked,
+     outcome, node_id, run_id, resource, initiator_chain, provider, tool, jti, receipt_id, responder, question_id)
+    VALUES (?, ?, ?, ?, ?, ?, 'provider.call', ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(n.request_id,new Date().toISOString(),t,i,e.client_id,e.class,n.scope_checked??null,n.outcome,e.node_id,e.run_id,`${n.provider} ${n.tool}`,o?JSON.stringify(o):null,n.provider,n.tool,n.jti??null,n.receipt_id??null,n.responder??null,n.question_id??null)}r(O,"writeProviderAudit");function $(n,e){const i=[],t=[];n!==null&&(i.push("grantee = ?"),t.push(n)),e.after!==void 0&&(i.push("id < ?"),t.push(e.after));for(const u of["operation","outcome","run_id"])e[u]!==void 0&&(i.push(`${u} = ?`),t.push(e[u]));e.since!==void 0&&(i.push("time >= ?"),t.push(e.since)),e.until!==void 0&&(i.push("time <= ?"),t.push(e.until));const o=p().prepare(`SELECT * FROM audit_rows ${i.length?`WHERE ${i.join(" AND ")}`:""} ORDER BY id DESC LIMIT ?`).all(...t,e.limit+1),d=o.length>e.limit;d&&o.pop();const l=d?String(o.at(-1)?.id):null;return{rows:o.map(({id:u,initiator_chain:s,...c})=>({...c,initiator_chain:typeof s=="string"?JSON.parse(s):null})),next:l}}r($,"listAudit");export{$ as listAudit,O as writeProviderAudit};

package/dist/core/providers/bundles.d.ts

@@ -0,0 +1,68 @@
+import { type ValidatedCommandManifest } from '../../api/command-manifest/manifest.js';
+import { type ProviderBlock } from '../command-plugins/bundle.js';
+import { type GrantRecord } from '../grants/mirror.js';
+import { ProviderError } from './errors.js';
+export type ProviderTransport = {
+    kind: 'http';
+    endpoint: string;
+};
+/** One major of a provider, as a call is served against it. */
+export interface ResolvedProviderBundle {
+    id: string;
+    major: number;
+    provider: ProviderBlock;
+    commands: ValidatedCommandManifest;
+    /** The provider's endpoint from `bundle.json` (never the directory's). */
+    transport: ProviderTransport;
+    /** `installed` — the newest major at `<plugins>/<id>`; `pinned` — a cached
+     *  major from `?version=N`. */
+    source: 'installed' | 'pinned';
+    /** The installed plugin root; absent for a pinned major. */
+    root?: string;
+}
+/** Every provider id a scope of an active grant's resolved set names: a
+ *  `<id>:<group>` string whose id is not `crtr` (the runtime's own namespace). */
+export declare function providerIdsFromGrants(grants: readonly GrantRecord[]): string[];
+/** Install attempts are owned by this daemon process. An installed bundle remains
+ * usable after a failed refresh; only absent bundles expose the last failure.
+ * A new daemon starts another grant-sync pass, so no duplicate on-disk ledger is
+ * needed. There is no per-provider retry deadline: sync and calls may retry. */
+export type ProviderInstallState = {
+    status: 'installing' | 'install_failed';
+    error?: string;
+};
+export declare function providerInstallState(id: string): ProviderInstallState | undefined;
+/** A stable, sanitized error for calls while the newest bundle is absent. */
+export declare function unavailableProviderError(id: string): ProviderError;
+/** What happened to an installed-major fetch. */
+export type ProviderBundleOutcome = 'installed' | 'updated' | 'unchanged';
+/** Install the provider's newest major when it is absent (D3-CALL-5); an
+ *  installed one is left as is. Throws like `refreshProviderBundle`. */
+export declare function ensureProviderBundle(id: string): Promise<void>;
+/**
+ * Bring a provider's bundle in step with the directory. `conditional`
+ * (grant sync, D3-INS-2) sends the stored ETag; unconditional (a
+ * `manifest_stale` answer, D3-ERR-5) asks for the archive outright. With
+ * `version`, the pinned major's cache is refetched instead.
+ */
+export declare function refreshProviderBundle(id: string, options: {
+    conditional: boolean;
+    version?: number;
+}): Promise<ProviderBundleOutcome>;
+/**
+ * The major a call runs against (D3-VER-1, D3-VER-3). No `version`: the
+ * installed newest major (`not_found` when none is installed — call
+ * `ensureProviderBundle` first). `version: N`: the installed bundle when it is
+ * major N, else major N's cached archive, fetched on first use; a retired
+ * major is `provider_version_retired` with no fetch, one never served is
+ * `not_found`.
+ */
+export declare function resolveProviderBundle(id: string, version?: number): Promise<ResolvedProviderBundle>;
+/**
+ * After a grant sync (D3-INS-1, D3-INS-2, D3-INS-4, D3-VER-2): install every
+ * provider an active grant names that is absent, refresh each installed one
+ * conditionally, then revalidate every cached pinned major. Never throws;
+ * each failure is logged and leaves the previous bundle. Syncs that arrive
+ * while one runs coalesce into one more pass.
+ */
+export declare function syncProviderBundles(): Promise<void>;

package/dist/core/providers/bundles.js

@@ -0,0 +1,2 @@
+var X=Object.defineProperty;var i=(e,r)=>X(e,"name",{value:r,configurable:!0});import{existsSync as h,readdirSync as N,readFileSync as $,rmSync as y,statSync as H}from"node:fs";import{join as c}from"node:path";import{validateCommandManifest as Y}from"../../api/command-manifest/manifest.js";import{crtrHome as O}from"../canvas/paths.js";import{withCanvasWrite as ee}from"../canvas/db.js";import{bundleVersion as re,isInstalledGeneration as ne,recordCheckedGeneration as te}from"../command-plugins/bundle.js";import{readConfig as U,readState as oe}from"../config.js";import{emitEvent as g}from"../events/emit.js";import{withExclusiveDirectoryLockAsync as ie}from"../exclusive-lock.js";import{atomicWriteText as x,ensureDir as M,pathExists as ae}from"../fs-utils.js";import{reconcilePackageDocuments as se}from"../graph/package-docs.js";import{readPluginManifest as W}from"../manifest.js";import{bundleSwapLockPath as de}from"../plugin-swap-lock.js";import{pluginsDir as ue,userScopeRoot as ce}from"../scope.js";import{allGrants as fe}from"../grants/mirror.js";import{ProviderError as u}from"./errors.js";const I="[A-Za-z0-9_-]{1,64}",le=new RegExp(`^(${I}):(${I})$`),F=new RegExp(`^${I}$`),pe=3e4,me=3e4;function ve(e){const r=new Set;for(const n of e)if(n.status==="active")for(const{scope:t}of n.resolved_scopes){const o=le.exec(t);o&&o[1]!=="crtr"&&r.add(o[1])}return[...r].sort()}i(ve,"providerIdsFromGrants");function b(e){return c(ue("user"),e)}i(b,"pluginRoot");function G(){return c(O(),"providers")}i(G,"providersRoot");function q(e,r){return c(G(),e,`v${r}`)}i(q,"majorDir");function T(e){if(!F.test(e))throw new u("not_found",`"${e}" is not a provider id`,{param:"provider"})}i(T,"assertId");function A(){const e=U("user").runtime?.issuer;if(!e)throw new u("not_found","provider bundles need a directory-connected runtime");return e.replace(/\/+$/,"")}i(A,"directoryBase");async function z(e,r){const n=`${A()}/providers/${encodeURIComponent(e)}/plugin${r.version!==void 0?`?version=${r.version}`:""}`;let t;try{t=await fetch(n,{headers:{Accept:"application/x-tar",...r.ifNoneMatch!==void 0?{"If-None-Match":r.ifNoneMatch}:{}},signal:AbortSignal.timeout(pe)})}catch(s){return{status:"failed",message:`could not reach ${n}: ${s instanceof Error?s.message:String(s)}`}}if(t.status===304)return r.ifNoneMatch===void 0?{status:"failed",message:`HTTP 304 from ${n} without a conditional request`}:{status:304};if(t.status===404||t.status===410)return await t.body?.cancel().catch(()=>{}),{status:t.status===404?404:410,message:`HTTP ${t.status} from ${n}`};if(t.status<200||t.status>=300)return await t.body?.cancel().catch(()=>{}),{status:"failed",message:`HTTP ${t.status} from ${n}`};let o;try{o=new Uint8Array(await t.arrayBuffer())}catch(s){return{status:"failed",message:`reading ${n} failed: ${s instanceof Error?s.message:String(s)}`}}const a=t.headers.get("etag");return{status:200,raw:o,...a!==null?{etag:a}:{}}}i(z,"fetchProviderBundle");const _=new WeakSet;class S extends Error{static{i(this,"BundleInvalid")}issues;constructor(r,n){super(r),this.issues=n}}function V(e,r,n){if(n.provider===void 0)return"the archive carries no provider block";if(n.provider.id!==e)return`the archive is provider "${n.provider.id}", not "${e}"`;if(r!==void 0&&n.provider.major!==r)return`the archive is major ${n.provider.major}, not ${r}`;const t=["hooks","kinds","page_components","memory_extensions"].filter(o=>n[o]!==void 0);if(t.length>0)return`a provider bundle may not carry ${t.join(", ")}`}i(V,"wrongBundle");function C(e,r,n){g({level:"error",event:"daemon.providers.bundle_invalid",fields:{provider:e,...r!==void 0?{major:r}:{},...n instanceof S?{issues:n.issues}:{}},error:n})}i(C,"logInvalid");function Z(e,r,n){g({level:"warn",event:"daemon.providers.bundle_fetch_failed",fields:{provider:e,...r!==void 0?{major:r}:{},message:n}})}i(Z,"logFailure");async function L(){return import("../../commands/pkg/plugin-manage.js")}i(L,"pluginManage");const P=new Map,E=i(e=>`${O()}\0${e}`,"installKey");function he(e){const r=e,n=r?.code??r?.cause?.code;return typeof n=="string"&&/^[A-Z][A-Z0-9_]{1,30}$/.test(n)?`${n} on provider install directory`:e instanceof u&&e.message.includes("HTTP 404")?"directory returned HTTP 404":e instanceof u&&e.message.includes("HTTP 410")?"directory returned HTTP 410":"provider bundle could not be installed"}i(he,"publicInstallCause");function ge(e){if(m(e)===void 0)return P.get(E(e))??{status:"installing"}}i(ge,"providerInstallState");function we(e){return new u("provider_unavailable",`provider "${e}" unavailable: ${ge(e)?.error??"bundle installation pending"}`)}i(we,"unavailableProviderError");function m(e){const r=W(b(e));if(!(r?.provider===void 0||r.transport?.kind!=="http")&&ae(c(b(e),"commands.json")))return{provider:r.provider,transport:{kind:"http",endpoint:r.transport.endpoint}}}i(m,"installedManifest");async function j(e,r,n=!1){const t=ce();m(e)===void 0&&P.set(E(e),{status:"installing"});try{return M(c(t,"tmp")),await ie(de(t,e),async()=>{const o=b(e),a=W(o);if(a!==null&&a.provider===void 0)throw new u("provider_unavailable",`plugin "${e}" is installed and is not the directory's provider bundle`);const s=m(e)!==void 0;if(s&&n)return"unchanged";const f=s&&r?oe("user").plugins[e]?.etag:void 0,d=await z(e,f!==void 0?{ifNoneMatch:f}:{});if(d.status===304)return"unchanged";if(d.status===404||d.status===410)throw new u("not_found",`the directory serves no provider "${e}" (${d.message})`,{param:"provider"});if(d.status==="failed")throw new u("provider_unavailable",`provider "${e}" bundle fetch failed: ${d.message}`);const l=re(d.raw);if(s&&ne(e,"user",o,l))return te("user",e,d.etag,{swapped:!1}),"unchanged";const{installPluginArchive:v}=await L();try{await v(e,d.raw,{scope:"user",scopeRootPath:t,root:o,version:l,etag:d.etag,enable:!s,bundle:{endpoint:`${A()}/providers/${encodeURIComponent(e)}/plugin`},transport:{kind:"http",endpoint:A()},accept:i(p=>V(e,void 0,p),"accept")})}catch(p){C(e,void 0,p);const D=new u("not_found",`provider "${e}" served an invalid bundle: ${p instanceof Error?p.message:String(p)}`,{param:"provider"});throw _.add(D),D}try{ee(p=>se(p))}catch(p){g({level:"error",event:"daemon.providers.docs_reconcile_failed",fields:{provider:e},error:p})}return g({level:"info",event:"daemon.providers.bundle_installed",fields:{provider:e,version:l,replaced:s}}),P.delete(E(e)),s?"updated":"installed"},{timeoutMs:me,timeoutError:i(()=>new u("provider_unavailable",`timed out waiting for another process replacing plugin "${e}"`),"timeoutError")})}catch(o){throw m(e)===void 0&&P.set(E(e),{status:"install_failed",error:he(o)}),o instanceof u?o:(g({level:"error",event:"daemon.providers.bundle_install_failed",fields:{provider:e},error:o}),we(e))}}i(j,"refreshInstalled");async function We(e){T(e),m(e)===void 0&&await j(e,!1,!0)}i(We,"ensureProviderBundle");async function Fe(e,r){return T(e),r.version!==void 0&&m(e)?.provider.major!==r.version?k(e,r.version,r.conditional):j(e,r.conditional)}i(Fe,"refreshProviderBundle");async function J(e,r,n){const{validatePluginArchive:t}=await L(),o=await t(n);if(o.bundle===void 0)throw new S(`provider "${e}" major ${r} bundle is invalid: ${o.issues.map(s=>s.message).join("; ")}`,o.issues);const a=V(e,r,o.bundle);if(a!==void 0)throw new S(`provider "${e}" major ${r} bundle is invalid: ${a}`,[]);if(o.bundle.transport===void 0)throw new S(`provider "${e}" major ${r} bundle declares no transport`,[]);return o.bundle}i(J,"validateArchive");function $e(e){M(e),x(c(e,"retired"),`${new Date().toISOString()}
+`),y(c(e,"bundle.tar"),{force:!0}),y(c(e,"etag"),{force:!0})}i($e,"retire");function K(e,r){return new u("provider_version_retired",`provider "${e}" major ${r} is retired`,{param:"version"})}i(K,"retiredError");async function k(e,r,n){const t=q(e,r),o=c(t,"bundle.tar"),a=h(o),s=a&&n&&h(c(t,"etag"))?$(c(t,"etag"),"utf8"):void 0,f=await z(e,{version:r,...s!==void 0?{ifNoneMatch:s}:{}});if(f.status===304)return"unchanged";if(f.status===410)throw $e(t),g({level:"info",event:"daemon.providers.major_retired",fields:{provider:e,major:r}}),K(e,r);if(f.status===404)throw new u("not_found",`provider "${e}" never served major ${r}`,{param:"version"});if(f.status==="failed")throw new u("provider_unavailable",`provider "${e}" major ${r} bundle fetch failed: ${f.message}`);try{await J(e,r,f.raw)}catch(l){C(e,r,l);const v=new u(a?"provider_unavailable":"not_found",l instanceof Error?l.message:String(l),{param:"version"});throw _.add(v),v}M(t),y(c(t,"retired"),{force:!0});const d=a&&Buffer.from(f.raw).equals($(o));return d||x(o,f.raw),f.etag!==void 0?x(c(t,"etag"),f.etag):y(c(t,"etag"),{force:!0}),d?"unchanged":a?"updated":"installed"}i(k,"refreshPinned");function ye(){const e=[],r=G();if(!h(r))return e;for(const n of N(r)){if(!F.test(n))continue;let t;try{t=N(c(r,n))}catch{continue}for(const o of t){const a=/^v([1-9][0-9]*)$/.exec(o);a&&h(c(r,n,o,"bundle.tar"))&&e.push([n,Number(a[1])])}}return e}i(ye,"cachedMajors");function be(e){const r=Y(e,{transport:"http",reservedCoreNames:new Set});if(r.manifest===void 0)throw new u("not_found","the provider bundle's commands.json no longer validates");return r.manifest}i(be,"readCommands");const R=new Map,Q=new Map;function _e(e,r){const n=H(r),t=`${n.ino}:${n.mtimeMs}:${n.size}`,o=Q.get(e);if(o?.stamp===t)return o.commands;const a=be(JSON.parse($(r,"utf8")));return Q.set(e,{stamp:t,commands:a}),a}i(_e,"installedCommands");async function Ge(e,r){T(e);const n=m(e);if(r===void 0||n?.provider.major===r){if(n===void 0)throw new u("not_found",`provider "${e}" has no installed bundle`,{param:"provider"});const l=b(e),v=_e(e,c(l,"commands.json"));return{id:e,major:n.provider.major,provider:n.provider,commands:v,transport:n.transport,source:"installed",root:l}}if(!Number.isInteger(r)||r<1)throw new u("invalid_request","version must be an integer of at least 1",{param:"version"});const t=q(e,r);if(h(c(t,"retired")))throw K(e,r);const o=c(t,"bundle.tar");h(o)||await k(e,r,!1);const a=`${e}/${r}`,s=H(o),f=`${s.mtimeMs}:${s.size}`;let d=R.get(a)?.stamp===f?R.get(a).bundle:void 0;if(d===void 0){try{d=await J(e,r,new Uint8Array($(o)))}catch(l){throw C(e,r,l),new u("not_found",`provider "${e}" has no valid bundle for major ${r}`,{param:"version"})}R.set(a,{stamp:f,bundle:d})}return{id:e,major:r,provider:d.provider,commands:d.commands,transport:{kind:"http",endpoint:d.transport.endpoint},source:"pinned"}}i(Ge,"resolveProviderBundle");let w=null,B=!1;async function Se(){if(U("user").runtime?.issuer){for(const e of ve(fe()))try{await j(e,!0)}catch(r){r instanceof Object&&_.has(r)||Z(e,void 0,r instanceof Error?r.message:String(r))}for(const[e,r]of ye())try{await k(e,r,!0)}catch(n){if(n instanceof u&&n.code==="provider_version_retired"||n instanceof Object&&_.has(n))continue;Z(e,r,n instanceof Error?n.message:String(n))}}}i(Se,"syncOnce");function qe(){return w!==null?(B=!0,w):(w=(async()=>{try{do B=!1,await Se();while(B)}finally{w=null}})(),w)}i(qe,"syncProviderBundles");export{We as ensureProviderBundle,ve as providerIdsFromGrants,ge as providerInstallState,Fe as refreshProviderBundle,Ge as resolveProviderBundle,qe as syncProviderBundles,we as unavailableProviderError};