@north-light/cli 0.3.560 → 0.3.562

package/dist/core/model-config.js

@@ -1 +1 @@
-var O=Object.defineProperty;var h=(r,t)=>O(r,"name",{value:t,configurable:!0});import{updateRawConfigAtomically as j}from"./config.js";const b=["ultra","strong","medium","light"],R=/^[^/\s]+\/(ultra|strong|medium|light)$/;function u(r,t){if(r===null||typeof r!="object"||Array.isArray(r))throw new Error(`${t} must be an object`);return r}h(u,"object");function c(r,t){if(typeof r!="string"||r.trim()==="")throw new Error(`${t} must be a non-empty string`);return r}h(c,"nonempty");function M(r){const t=u(r,"model config"),g=u(t.modelRoutes,"modelRoutes"),s={};for(const[e,a]of Object.entries(g)){c(e,"route id");const i=u(a,`modelRoutes.${e}`),l=c(i.providerId,`modelRoutes.${e}.providerId`),d=u(i.models,`modelRoutes.${e}.models`),p={};for(const m of b){const y=c(d[m],`modelRoutes.${e}.models.${m}`),k=y.indexOf("/");if(k<=0||k===y.length-1||y.slice(0,k)!==l)throw new Error(`modelRoutes.${e}.models.${m} must be a ${l}/id ref`);p[m]=y}for(const m of Object.keys(d))if(!b.includes(m))throw new Error(`modelRoutes.${e}.models.${m} is not a model strength`);s[e]={family:c(i.family,`modelRoutes.${e}.family`),credentialSource:c(i.credentialSource,`modelRoutes.${e}.credentialSource`),providerId:l,models:p}}const o=u(t.modelRouting,"modelRouting");for(const e of["credentialSourceOrder","familyOrder"])if(o[e]!==void 0&&(!Array.isArray(o[e])||!o[e].every(a=>typeof a=="string"&&a.trim()!=="")))throw new Error(`modelRouting.${e} must be an array of non-empty strings`);if(o.strengthFallback!==void 0&&(!Array.isArray(o.strengthFallback)||!o.strengthFallback.every(e=>b.includes(e))))throw new Error("modelRouting.strengthFallback must be an array of model strengths");const n=new Set(Object.values(s).map(e=>e.family)),f=new Set(Object.values(s).map(e=>e.credentialSource));for(const e of o.familyOrder??[])if(!n.has(e))throw new Error(`modelRouting.familyOrder names unknown route family ${e}`);for(const e of o.credentialSourceOrder??[])if(!f.has(e))throw new Error(`modelRouting.credentialSourceOrder names unknown credential source ${e}`);const $=u(t.kinds,"kinds"),w={};for(const[e,a]of Object.entries($)){c(e,"kind");const i=u(a,`kinds.${e}`),l=c(i.model,`kinds.${e}.model`);if(!R.test(l))throw new Error(`kinds.${e}.model must be family/strength`);if(!n.has(l.slice(0,l.lastIndexOf("/"))))throw new Error(`kinds.${e}.model names unknown route family`);const d=i.orchestratorModel===void 0?void 0:c(i.orchestratorModel,`kinds.${e}.orchestratorModel`);if(d!==void 0&&!R.test(d))throw new Error(`kinds.${e}.orchestratorModel must be family/strength`);if(d!==void 0&&!n.has(d.slice(0,d.lastIndexOf("/"))))throw new Error(`kinds.${e}.orchestratorModel names unknown route family`);w[e]={model:l,...d===void 0?{}:{orchestratorModel:d}}}return{modelRoutes:s,modelRouting:structuredClone(o),kinds:w}}h(M,"validateCoreModelConfig");function S(r){j("user",t=>{const g=t.kinds!==null&&typeof t.kinds=="object"&&!Array.isArray(t.kinds)?t.kinds:{},s=Object.fromEntries(Object.entries(g).map(([o,n])=>{const f=n!==null&&typeof n=="object"&&!Array.isArray(n)?n:{},{model:$,orchestratorModel:w,...e}=f;return[o,e]}));for(const[o,n]of Object.entries(r.kinds)){const f=s[o]!==null&&typeof s[o]=="object"&&!Array.isArray(s[o])?s[o]:{};s[o]={...f,model:n.model,orchestratorModel:n.orchestratorModel??n.model}}return{...t,modelRoutes:structuredClone(r.modelRoutes),modelRouting:structuredClone(r.modelRouting),kinds:s}})}h(S,"replaceCoreModelConfig");export{S as replaceCoreModelConfig,M as validateCoreModelConfig};
+var O=Object.defineProperty;var h=(r,t)=>O(r,"name",{value:t,configurable:!0});import{updateRawConfigAtomically as j}from"./config.js";const b=["ultra","strong","medium","light"],R=/^[^/\s]+\/(ultra|strong|medium|light)$/;function a(r,t){if(r===null||typeof r!="object"||Array.isArray(r))throw new Error(`${t} must be an object`);return r}h(a,"object");function c(r,t){if(typeof r!="string"||r.trim()==="")throw new Error(`${t} must be a non-empty string`);return r}h(c,"nonempty");function M(r){const t=a(r,"model config"),g=a(t.modelRoutes,"modelRoutes"),s={};for(const[e,u]of Object.entries(g)){c(e,"route id");const i=a(u,`modelRoutes.${e}`),l=c(i.providerId,`modelRoutes.${e}.providerId`),d=a(i.models,`modelRoutes.${e}.models`),p={};for(const m of b){const y=c(d[m],`modelRoutes.${e}.models.${m}`),k=y.indexOf("/");if(k<=0||k===y.length-1||y.slice(0,k)!==l)throw new Error(`modelRoutes.${e}.models.${m} must be a ${l}/id ref`);p[m]=y}for(const m of Object.keys(d))if(!b.includes(m))throw new Error(`modelRoutes.${e}.models.${m} is not a model strength`);s[e]={family:c(i.family,`modelRoutes.${e}.family`),credentialSource:c(i.credentialSource,`modelRoutes.${e}.credentialSource`),providerId:l,models:p}}const o=a(t.modelRouting,"modelRouting");for(const e of["credentialSourceOrder","familyOrder"])if(o[e]!==void 0&&(!Array.isArray(o[e])||!o[e].every(u=>typeof u=="string"&&u.trim()!=="")))throw new Error(`modelRouting.${e} must be an array of non-empty strings`);if(o.strengthFallback!==void 0&&(!Array.isArray(o.strengthFallback)||!o.strengthFallback.every(e=>b.includes(e))))throw new Error("modelRouting.strengthFallback must be an array of model strengths");const n=new Set(Object.values(s).map(e=>e.family)),f=new Set(Object.values(s).map(e=>e.credentialSource));for(const e of o.familyOrder??[])if(!n.has(e))throw new Error(`modelRouting.familyOrder names unknown route family ${e}`);for(const e of o.credentialSourceOrder??[])if(!f.has(e))throw new Error(`modelRouting.credentialSourceOrder names unknown credential source ${e}`);const $=a(t.kinds,"kinds"),w={};for(const[e,u]of Object.entries($)){c(e,"kind");const i=a(u,`kinds.${e}`),l=c(i.model,`kinds.${e}.model`);if(!R.test(l))throw new Error(`kinds.${e}.model must be family/strength`);if(!n.has(l.slice(0,l.lastIndexOf("/"))))throw new Error(`kinds.${e}.model names unknown route family`);const d=i.orchestratorModel===void 0?void 0:c(i.orchestratorModel,`kinds.${e}.orchestratorModel`);if(d!==void 0&&!R.test(d))throw new Error(`kinds.${e}.orchestratorModel must be family/strength`);if(d!==void 0&&!n.has(d.slice(0,d.lastIndexOf("/"))))throw new Error(`kinds.${e}.orchestratorModel names unknown route family`);w[e]={model:l,...d===void 0?{}:{orchestratorModel:d}}}return{modelRoutes:s,modelRouting:structuredClone(o),kinds:w}}h(M,"validateCoreModelConfig");async function S(r){await j("user",t=>{const g=t.kinds!==null&&typeof t.kinds=="object"&&!Array.isArray(t.kinds)?t.kinds:{},s=Object.fromEntries(Object.entries(g).map(([o,n])=>{const f=n!==null&&typeof n=="object"&&!Array.isArray(n)?n:{},{model:$,orchestratorModel:w,...e}=f;return[o,e]}));for(const[o,n]of Object.entries(r.kinds)){const f=s[o]!==null&&typeof s[o]=="object"&&!Array.isArray(s[o])?s[o]:{};s[o]={...f,model:n.model,orchestratorModel:n.orchestratorModel??n.model}}return{...t,modelRoutes:structuredClone(r.modelRoutes),modelRouting:structuredClone(r.modelRouting),kinds:s}})}h(S,"replaceCoreModelConfig");export{S as replaceCoreModelConfig,M as validateCoreModelConfig};

package/dist/core/model-routes-pool.d.ts

@@ -0,0 +1,14 @@
+import { type InitialModelRegistryLike, type InitialModelRouteSelection, type ModelRegistryLike, type ModelRequest, type RouteAvailability, type RoutedCandidate } from './model-routes.js';
+/** Probe the common availability facts consumed unchanged by resolveProviderCandidates. Reads the person's credential rows: daemon-side callers only. */
+export declare function probeRouteAvailability(candidate: RoutedCandidate, registry: ModelRegistryLike, now?: number): Promise<RouteAvailability>;
+/** Select the first viable route for a new SDK session. Route declarations own
+ * preference order; logical requests append registered models not declared by a
+ * route. The caller owns broker faults/events and the no-viable outcome. */
+export declare function selectInitialModelRoute<Model extends {
+    provider: string;
+    id: string;
+}>(request: ModelRequest, registry: InitialModelRegistryLike<Model>, options?: {
+    cwd?: string;
+    profileId?: string | null;
+    now?: number;
+}): Promise<InitialModelRouteSelection<Model>>;

package/dist/core/model-routes-pool.js

@@ -0,0 +1 @@
+var m=Object.defineProperty;var c=(t,r)=>m(t,"name",{value:r,configurable:!0});import{isManagedProvider as l,resolveProviderCandidates as w}from"./managed-providers.js";import{readSubscriptionPool as y}from"./subscription-state.js";import{expandModelCandidates as b,routeAvailability as h}from"./model-routes.js";async function $(t,r,i=Date.now()){return h(t,r,l(t.providerId)?await y(t.providerId):void 0,i)}c($,"probeRouteAvailability");async function P(t,r,i={}){const n=await b(t,i.cwd,i.profileId),f=new Set(n.map(e=>`${e.providerId}/${e.modelId}`)),I=t.kind==="logical"?r.getAll().filter(e=>!f.has(`${e.provider}/${e.id}`)).map((e,d)=>({routeId:`registry:${e.provider}/${e.id}`,credentialSource:"registry",family:e.provider,strength:"strong",providerId:e.provider,modelId:e.id,rank:n.length+d})):[],a=[...n,...I],p=i.now??Date.now(),s=new Map;for(const e of a)s.set(e,await $(e,r,p));const g=a.some(e=>{const d=s.get(e);return l(e.providerId)&&d.registered&&d.authenticated}),u=w(a.map(e=>({...e,...s.get(e),automaticFallback:e.routeId.startsWith("registry:")?l(e.providerId)||!g:!0})),p,{pinnedToFirst:t.kind==="exact"}),o=u.candidates[0],v=o===void 0?void 0:r.find(o.providerId,o.modelId);return{...o!==void 0&&v!==void 0?{selected:{model:v,candidate:o}}:{},rejected:u.rejected}}c(P,"selectInitialModelRoute");export{$ as probeRouteAvailability,P as selectInitialModelRoute};

package/dist/core/model-routes.d.ts

@@ -1,5 +1,5 @@
 import type { ModelStrength } from '../types.js';
-import { type ProviderCandidate, type ProviderCandidateRejection } from './subscription-state.js';
+import { type ProviderCandidate, type ProviderCandidateRejection, type SubscriptionCredential } from './managed-providers.js';
 export type ModelRequest = {
     kind: 'logical';
     family: string;
@@ -66,8 +66,13 @@ export declare function parseModelSpec(spec: string): {
     modelId: string;
     thinkingLevel?: string;
 } | undefined;
+type RotationReader = () => Promise<{
+    defaultFallbackStrength?: ModelStrength;
+}>;
+/** The process that owns the person's rows (daemon, API) registers how to read their rotation settings; a broker reads its launch snapshot, and a CLI process has neither and gets the default. */
+export declare function registerRotationReader(reader: RotationReader): void;
 /** Expand config-derived route order only. Availability never affects rank. */
-export declare function expandModelCandidates(request: ModelRequest, cwd?: string, profileId?: string | null): RoutedCandidate[];
+export declare function expandModelCandidates(request: ModelRequest, cwd?: string, profileId?: string | null): Promise<RoutedCandidate[]>;
 /** Identify the one permanently invalid recipe shape: a concrete/exact request
  * whose requested provider/model is absent from the serving registry. Auth and
  * cooldown are deliberately outside this discriminator so callers retain their
@@ -75,18 +80,8 @@ export declare function expandModelCandidates(request: ModelRequest, cwd?: strin
 export declare function unregisteredConcreteModel(request: ModelRequest | undefined, registry: ModelRegistryLike, options?: {
     cwd?: string;
     profileId?: string | null;
-}): UnregisteredConcreteModel | undefined;
-/** Probe the common availability facts consumed unchanged by resolveProviderCandidates. */
-export declare function probeRouteAvailability(candidate: RoutedCandidate, registry: ModelRegistryLike, now?: number): RouteAvailability;
-/** Select the first viable route for a new SDK session. Route declarations own
- * preference order; logical requests append registered models not declared by a
- * route. The caller owns broker faults/events and the no-viable outcome. */
-export declare function selectInitialModelRoute<Model extends {
-    provider: string;
-    id: string;
-}>(request: ModelRequest, registry: InitialModelRegistryLike<Model>, options?: {
-    cwd?: string;
-    profileId?: string | null;
-    now?: number;
-}): InitialModelRouteSelection<Model>;
+}): Promise<UnregisteredConcreteModel | undefined>;
+/** The availability facts of one route given the managed pool already read for its provider (undefined for a provider that has no pool). */
+export declare function routeAvailability(candidate: RoutedCandidate, registry: ModelRegistryLike, pool: readonly SubscriptionCredential[] | undefined, now?: number): RouteAvailability;
 export declare function modelRequestFromConfig(model: string | undefined, modelIntent: string | undefined, exact: boolean): ModelRequest | undefined;
+export {};

package/dist/core/model-routes.js

@@ -1 +1 @@
-var E=Object.defineProperty;var f=(e,t)=>E(e,"name",{value:t,configurable:!0});import{readMergedLaunchConfig as U}from"./config.js";import{isManagedProvider as F,readRotationConfig as D,coolingUntilFor as L,readSubscriptionPool as G,resolveProviderCandidates as H}from"./subscription-state.js";const S="app",b=["ultra","strong","medium","light"],A=new Set(["off","minimal","low","medium","high","xhigh","max"]);function x(e){const t=e.indexOf("/");if(t<=0||t===e.length-1)return;const o=e.slice(0,t),n=e.slice(t+1),s=n.lastIndexOf(":"),u=s>0?n.slice(s+1).toLowerCase():void 0;return{providerId:o,modelId:u!==void 0&&A.has(u)?n.slice(0,s):n,...u!==void 0&&A.has(u)&&u!=="off"?{thinkingLevel:u}:{}}}f(x,"parseModelSpec");function K(e){const t=f(o=>{const n=e[o].strong.slice(0,e[o].strong.indexOf("/"));return{family:o,credentialSource:"default",providerId:n,models:e[o]}},"route");return{anthropic:t("anthropic"),openai:t("openai")}}f(K,"synthesizeRoutes");function $(e,t){return[e,...t.filter(o=>o!==e)]}f($,"ordered");function _(e,t){return $(e,t).filter((o,n,s)=>s.indexOf(o)===n)}f(_,"strengths");function j(e,t,o){if(e.kind==="exact"){const r=x(e.spec);return r?[{routeId:"exact",credentialSource:"exact",family:r.providerId,strength:"strong",...r,rank:0}]:[]}if(e.kind==="logical"&&e.family===S){const r=x(e.spec);return r?[{routeId:S,credentialSource:S,family:S,strength:e.strength,...r,rank:0}]:[]}const n=U(t,o??null),s={...n.modelRoutes??{},...n.legacyModelRoutes??{}},u=Object.keys(s).length>0?s:K(n.modelLadders),l=Object.entries(u),m=n.modelRouting?.strengthFallback??[D().defaultFallbackStrength??"strong"],y=l.map(([,r])=>r.family).filter((r,d,a)=>a.indexOf(r)===d),I=l.map(([,r])=>r.credentialSource).filter((r,d,a)=>a.indexOf(r)===d),c=e.kind==="concrete"?x(e.spec):void 0,v=e.kind==="logical"?e:void 0,i=f((r,d)=>{const a=x(r);return a!==void 0&&c!==void 0&&a.providerId===c.providerId&&a.modelId===c.modelId&&(!d||a.thinkingLevel===c.thinkingLevel)},"matchesConcrete"),p=c===void 0?void 0:l.find(([,r])=>Object.values(r.models).some(d=>i(d,!1))),O=v?.strength??(()=>{if(!c)return"strong";for(const r of[!0,!1])for(const d of r?b:[...b].reverse())if(l.some(([,a])=>{const h=a.models[d];return h!==void 0&&i(h,r)}))return d;return"strong"})(),R=v?.family??p?.[1].family??c?.providerId??"anthropic",T=c?I:n.modelRouting?.credentialSourceOrder??I,N=c?[R]:n.modelRouting?.familyOrder??y,w=[],C=new Set,M=f((r,d,a,h)=>{const g=x(h);if(!g||c&&g.modelId!==c.modelId)return;const k=JSON.stringify([r,g.providerId,g.modelId,g.thinkingLevel]);C.has(k)||(C.add(k),w.push({routeId:r,credentialSource:d.credentialSource,family:d.family,strength:a,...g,rank:w.length}))},"append");if(c){const[r,d]=p??["concrete",{family:R,credentialSource:"default"}];M(r,d,O,e.spec)}for(const r of T)for(const d of c?[O]:_(O,m))for(const a of $(R,N))for(const[h,g]of l){if(g.credentialSource!==r||g.family!==a)continue;const k=g.models[d];k&&M(h,g,d,k)}return w.map((r,d)=>({...r,rank:d}))}f(j,"expandModelCandidates");function X(e,t,o={}){if(e===void 0||e.kind==="logical")return;const n=j(e,o.cwd,o.profileId)[0];if(!(n===void 0||t.find(n.providerId,n.modelId)!==void 0))return{request:e,candidate:n,reason:"unregistered"}}f(X,"unregisteredConcreteModel");function P(e,t,o=Date.now()){const n=t.find(e.providerId,e.modelId);if(n===void 0)return{registered:!1,authenticated:!1};if(!F(e.providerId))return{registered:!0,authenticated:t.hasConfiguredAuth(n)};const s=G(e.providerId).filter(l=>l.authFailure===void 0),u=s.length>0&&s.every(l=>L(l,e.modelId)>o);return{registered:!0,authenticated:s.length>0||t.hasConfiguredAuth(n),...u?{coolingUntil:Math.min(...s.map(l=>L(l,e.modelId)))}:{}}}f(P,"probeRouteAvailability");function Y(e,t,o={}){const n=j(e,o.cwd,o.profileId),s=new Set(n.map(i=>`${i.providerId}/${i.modelId}`)),u=e.kind==="logical"?t.getAll().filter(i=>!s.has(`${i.provider}/${i.id}`)).map((i,p)=>({routeId:`registry:${i.provider}/${i.id}`,credentialSource:"registry",family:i.provider,strength:"strong",providerId:i.provider,modelId:i.id,rank:n.length+p})):[],l=[...n,...u],m=o.now??Date.now(),y=l.some(i=>{const p=P(i,t,m);return F(i.providerId)&&p.registered&&p.authenticated}),I=H(l.map(i=>({...i,...P(i,t,m),automaticFallback:i.routeId.startsWith("registry:")?F(i.providerId)||!y:!0})),m,{pinnedToFirst:e.kind==="exact"}),c=I.candidates[0],v=c===void 0?void 0:t.find(c.providerId,c.modelId);return{...c!==void 0&&v!==void 0?{selected:{model:v,candidate:c}}:{},rejected:I.rejected}}f(Y,"selectInitialModelRoute");function B(e,t,o){if(e){if(o)return{kind:"exact",spec:e};if(t){const n=t.lastIndexOf("/"),s=n>0?t.slice(n+1):"";if(b.includes(s))return{kind:"logical",family:t.slice(0,n),strength:s,spec:e}}return{kind:"concrete",spec:e}}}f(B,"modelRequestFromConfig");export{S as APP_FAMILY,j as expandModelCandidates,B as modelRequestFromConfig,x as parseModelSpec,P as probeRouteAvailability,Y as selectInitialModelRoute,X as unregisteredConcreteModel};
+var E=Object.defineProperty;var s=(e,t)=>E(e,"name",{value:t,configurable:!0});import{readMergedLaunchConfig as U}from"./config.js";import{brokerConfigSnapshot as G}from"./config.js";import{coolingUntilFor as L}from"./managed-providers.js";const I="app",y=["ultra","strong","medium","light"],M=new Set(["off","minimal","low","medium","high","xhigh","max"]);function p(e){const t=e.indexOf("/");if(t<=0||t===e.length-1)return;const o=e.slice(0,t),r=e.slice(t+1),d=r.lastIndexOf(":"),a=d>0?r.slice(d+1).toLowerCase():void 0;return{providerId:o,modelId:a!==void 0&&M.has(a)?r.slice(0,d):r,...a!==void 0&&M.has(a)&&a!=="off"?{thinkingLevel:a}:{}}}s(p,"parseModelSpec");function H(e){const t=s(o=>{const r=e[o].strong.slice(0,e[o].strong.indexOf("/"));return{family:o,credentialSource:"default",providerId:r,models:e[o]}},"route");return{anthropic:t("anthropic"),openai:t("openai")}}s(H,"synthesizeRoutes");function A(e,t){return[e,...t.filter(o=>o!==e)]}s(A,"ordered");function P(e,t){return A(e,t).filter((o,r,d)=>d.indexOf(o)===r)}s(P,"strengths");let v;function Y(e){v=e}s(Y,"registerRotationReader");async function _(){const e=G();return e?e.rotation:v?v():{}}s(_,"rotationConfig");async function z(e,t,o){if(e.kind==="exact"){const n=p(e.spec);return n?[{routeId:"exact",credentialSource:"exact",family:n.providerId,strength:"strong",...n,rank:0}]:[]}if(e.kind==="logical"&&e.family===I){const n=p(e.spec);return n?[{routeId:I,credentialSource:I,family:I,strength:e.strength,...n,rank:0}]:[]}const r=U(t,o??null),d={...r.modelRoutes??{},...r.legacyModelRoutes??{}},a=Object.keys(d).length>0?d:H(r.modelLadders),u=Object.entries(a),g=r.modelRouting?.strengthFallback??[(await _()).defaultFallbackStrength??"strong"],N=u.map(([,n])=>n.family).filter((n,i,c)=>c.indexOf(n)===i),O=u.map(([,n])=>n.credentialSource).filter((n,i,c)=>c.indexOf(n)===i),f=e.kind==="concrete"?p(e.spec):void 0,R=e.kind==="logical"?e:void 0,C=s((n,i)=>{const c=p(n);return c!==void 0&&f!==void 0&&c.providerId===f.providerId&&c.modelId===f.modelId&&(!i||c.thinkingLevel===f.thinkingLevel)},"matchesConcrete"),F=f===void 0?void 0:u.find(([,n])=>Object.values(n.models).some(i=>C(i,!1))),x=R?.strength??(()=>{if(!f)return"strong";for(const n of[!0,!1])for(const i of n?y:[...y].reverse())if(u.some(([,c])=>{const m=c.models[i];return m!==void 0&&C(m,n)}))return i;return"strong"})(),k=R?.family??F?.[1].family??f?.providerId??"anthropic",T=f?O:r.modelRouting?.credentialSourceOrder??O,j=f?[k]:r.modelRouting?.familyOrder??N,S=[],b=new Set,w=s((n,i,c,m)=>{const l=p(m);if(!l||f&&l.modelId!==f.modelId)return;const h=JSON.stringify([n,l.providerId,l.modelId,l.thinkingLevel]);b.has(h)||(b.add(h),S.push({routeId:n,credentialSource:i.credentialSource,family:i.family,strength:c,...l,rank:S.length}))},"append");if(f){const[n,i]=F??["concrete",{family:k,credentialSource:"default"}];w(n,i,x,e.spec)}for(const n of T)for(const i of f?[x]:P(x,g))for(const c of A(k,j))for(const[m,l]of u){if(l.credentialSource!==n||l.family!==c)continue;const h=l.models[i];h&&w(m,l,i,h)}return S.map((n,i)=>({...n,rank:i}))}s(z,"expandModelCandidates");async function B(e,t,o={}){if(e===void 0||e.kind==="logical")return;const r=(await z(e,o.cwd,o.profileId))[0];if(!(r===void 0||t.find(r.providerId,r.modelId)!==void 0))return{request:e,candidate:r,reason:"unregistered"}}s(B,"unregisteredConcreteModel");function Q(e,t,o,r=Date.now()){const d=t.find(e.providerId,e.modelId);if(d===void 0)return{registered:!1,authenticated:!1};if(o===void 0)return{registered:!0,authenticated:t.hasConfiguredAuth(d)};const a=o.filter(g=>g.authFailure===void 0),u=a.length>0&&a.every(g=>L(g,e.modelId)>r);return{registered:!0,authenticated:a.length>0||t.hasConfiguredAuth(d),...u?{coolingUntil:Math.min(...a.map(g=>L(g,e.modelId)))}:{}}}s(Q,"routeAvailability");function V(e,t,o){if(e){if(o)return{kind:"exact",spec:e};if(t){const r=t.lastIndexOf("/"),d=r>0?t.slice(r+1):"";if(y.includes(d))return{kind:"logical",family:t.slice(0,r),strength:d,spec:e}}return{kind:"concrete",spec:e}}}s(V,"modelRequestFromConfig");export{I as APP_FAMILY,z as expandModelCandidates,V as modelRequestFromConfig,p as parseModelSpec,Y as registerRotationReader,Q as routeAvailability,B as unregisteredConcreteModel};

package/dist/core/peer/ingest.d.ts

@@ -19,6 +19,8 @@ export interface IngestResult {
 export declare const isCatalogLag: (code: string) => boolean;
 /** The delivery key prefix of one sender's message; a delivery's full key adds `:<destination>`. */
 export declare const ingestKey: (via: string, messageId: string) => string;
+/** Postgres `deadlock_detected` (40P01) or `serialization_failure` (40001). */
+export declare const isTransientDbError: (error: unknown) => boolean;
 /** Apply a batch from machine `via`. One event's failure rejects only that event. Runs in the caller's write transaction.
  *
  *  The home sends one row per destination while the receipt is per message, so the destination's half is handled for every row:

package/dist/core/peer/ingest.js

@@ -1 +1 @@
-var g=Object.defineProperty;var o=(e,t)=>g(e,"name",{value:t,configurable:!0});import{CrtrError as k}from"../errors.js";import{getById as u}from"../graph/objects.js";import{publish as O}from"../graph/events.js";import{markLinkWatch as R,recordWatch as N}from"../graph/watches.js";import{armObjectWaitForWatch as T}from"../graph/object-waits.js";import{ackRows as h,claimRows as L}from"./outbox-store.js";import{ensureStub as y,localOwnerActor as C,stubOf as w}from"./stubs.js";import{withCanvasWrite as S}from"../canvas/db.js";const K=100,P=o(e=>e==="unknown_event"||e==="unknown_kind","isCatalogLag"),f=o((e,t)=>`peer:${e}:${t}`,"ingestKey");async function $(e,t){return await e.prepare("SELECT 1 FROM peer_ingested WHERE key = ?").get(t)!==void 0?!0:await e.prepare("SELECT 1 FROM deliveries WHERE idempotency_key >= ? AND idempotency_key < ? LIMIT 1").get(`${t}:`,`${t};`)!==void 0}o($,"applied");const m=o(async(e,t,n)=>{await e.prepare("INSERT INTO peer_ingested_destinations (key, ingested_at) VALUES (?, ?) ON CONFLICT DO NOTHING").run(`${t}:${n}`,Date.now())},"markDestination");async function F(e,t,n){return await e.prepare("SELECT 1 FROM peer_ingested_destinations WHERE key = ?").get(`${t}:${n}`)!==void 0||await e.prepare("SELECT 1 FROM deliveries WHERE idempotency_key = ?").get(`${t}:${n}`)!==void 0}o(F,"destinationDone");async function I(e,t,n){return await C(e,t)??await y(e,t.id,t.type,n,void 0,t)}o(I,"actorFor");async function E(e,t,n,r,i){const c=n.actor===null?null:await I(e,n.actor,t),l=n.body_text,a=n.body===void 0&&l===void 0?void 0:{...n.body??{},...l===void 0?{}:{body:l}};await O(e,{event:n.event,object:r,actor:c,level:n.level,attrs:n.attrs,...a===void 0?{}:{messageBody:a},idempotencyKey:f(t,n.message_id),...i===void 0?{}:{onlyWatchers:i}})}o(E,"apply");async function W(e,t){const n=`ev:${t.message_id}:`;if(!t.key.startsWith(n)||t.key.length===n.length)return null;const r=await u(e,t.key.slice(n.length));return r!==null&&r.type==="node"&&r.deleted_at===null&&await w(e,r)===null?r:null}o(W,"localDestination");async function U(e,t,n){const r={accepted:[],rejected:[]};for(const i of n){const c=f(t,i.message_id),l=await $(e,c);try{await S(async()=>{const a=await W(e,i);if(l&&a===null)return;const s=await y(e,i.object.id,i.object.type,t,void 0,i.object),d=i.linked===!0&&a!==null&&s.owner!==null?await u(e,s.owner):null,p=d!==null&&d.type==="app"?d:null;if(a!==null&&await e.prepare("SELECT 1 FROM watches WHERE watcher = ? AND object = ?").get(a.id,s.id)===void 0?(await N(e,a,s,"act",{patterns:[">"],...p===null?{}:{linkApp:p}}),await T(e,a,s)):a!==null&&p!==null&&await R(e,a,s,p),l)await F(e,c,a.id)||await E(e,t,i,s,[a.id]);else{await E(e,t,i,s),await e.prepare("INSERT INTO peer_ingested (key, ingested_at) VALUES (?, ?) ON CONFLICT DO NOTHING").run(c,Date.now());for(const _ of await e.prepare("SELECT destination_id FROM deliveries WHERE idempotency_key >= ? AND idempotency_key < ?").all(`${c}:`,`${c};`))await m(e,c,_.destination_id)}a!==null&&await m(e,c,a.id)},{savepoint:!0}),r.accepted.push(i.key)}catch(a){const s=a instanceof k?a.code:"invalid_event";r.rejected.push({key:i.key,code:s,message:a instanceof Error?a.message:String(a)})}}return r}o(U,"ingestPeerEvents");const X=o(async(e,t,n)=>(await w(e,t))?.home_machine===n,"isStubOf"),q=o(async(e,t,n)=>await L(e,t,n),"claimFor"),v=o(async(e,t,n)=>await h(e,t,n),"ackFor");export{K as MAX_EVENTS_PER_CALL,v as ackFor,q as claimFor,f as ingestKey,U as ingestPeerEvents,P as isCatalogLag,X as isStubOf};
+var _=Object.defineProperty;var o=(e,t)=>_(e,"name",{value:t,configurable:!0});import{CrtrError as O}from"../errors.js";import{getById as w}from"../graph/objects.js";import{publish as h}from"../graph/events.js";import{markLinkWatch as L,recordWatch as R}from"../graph/watches.js";import{armObjectWaitForWatch as T}from"../graph/object-waits.js";import{ackRows as N,claimRows as C}from"./outbox-store.js";import{actorLockKeys as S,ensureStub as f,localOwnerActor as $,lockInOrder as F,stubLockKeys as I,stubOf as m}from"./stubs.js";import{withCanvasWrite as j}from"../canvas/db.js";const z=100,J=o(e=>e==="unknown_event"||e==="unknown_kind","isCatalogLag"),y=o((e,t)=>`peer:${e}:${t}`,"ingestKey");async function x(e,t){return await e.prepare("SELECT 1 FROM peer_ingested WHERE key = ?").get(t)!==void 0?!0:await e.prepare("SELECT 1 FROM deliveries WHERE idempotency_key >= ? AND idempotency_key < ? LIMIT 1").get(`${t}:`,`${t};`)!==void 0}o(x,"applied");const E=o(async(e,t,n)=>{await e.prepare("INSERT INTO peer_ingested_destinations (key, ingested_at) VALUES (?, ?) ON CONFLICT DO NOTHING").run(`${t}:${n}`,Date.now())},"markDestination");async function D(e,t,n){return await e.prepare("SELECT 1 FROM peer_ingested_destinations WHERE key = ?").get(`${t}:${n}`)!==void 0||await e.prepare("SELECT 1 FROM deliveries WHERE idempotency_key = ?").get(`${t}:${n}`)!==void 0}o(D,"destinationDone");async function W(e,t,n){return await $(e,t)??await f(e,t.id,t.type,n,void 0,t)}o(W,"actorFor");async function k(e,t,n,r,l){const i=n.actor===null?null:await W(e,n.actor,t),s=n.body_text,p=n.body===void 0&&s===void 0?void 0:{...n.body??{},...s===void 0?{}:{body:s}};await h(e,{event:n.event,object:r,actor:i,level:n.level,attrs:n.attrs,...p===void 0?{}:{messageBody:p},idempotencyKey:y(t,n.message_id),...l===void 0?{}:{onlyWatchers:l}})}o(k,"apply");async function A(e,t){const n=`ev:${t.message_id}:`;if(!t.key.startsWith(n)||t.key.length===n.length)return null;const r=await w(e,t.key.slice(n.length));return r!==null&&r.type==="node"&&r.deleted_at===null&&await m(e,r)===null?r:null}o(A,"localDestination");const H=o(e=>{const t=e?.code;return t==="40P01"||t==="40001"},"isTransientDbError");async function Q(e,t,n){const r={accepted:[],rejected:[]},l=[];for(const i of n)l.push(`ingest:${y(t,i.message_id)}`,...await I(e,i.object.id,i.object.type,null,i.object)),i.actor!==null&&l.push(...await S(e,i.actor));await F(e,l);for(const i of n){const s=y(t,i.message_id),p=await x(e,s);try{await j(async()=>{const a=await A(e,i);if(p&&a===null)return;const c=await f(e,i.object.id,i.object.type,t,void 0,i.object),d=i.linked===!0&&a!==null&&c.owner!==null?await w(e,c.owner):null,u=d!==null&&d.type==="app"?d:null;if(a!==null&&await e.prepare("SELECT 1 FROM watches WHERE watcher = ? AND object = ?").get(a.id,c.id)===void 0?(await R(e,a,c,"act",{patterns:[">"],...u===null?{}:{linkApp:u}}),await T(e,a,c)):a!==null&&u!==null&&await L(e,a,c,u),p)await D(e,s,a.id)||await k(e,t,i,c,[a.id]);else{await k(e,t,i,c),await e.prepare("INSERT INTO peer_ingested (key, ingested_at) VALUES (?, ?) ON CONFLICT DO NOTHING").run(s,Date.now());for(const g of await e.prepare("SELECT destination_id FROM deliveries WHERE idempotency_key >= ? AND idempotency_key < ?").all(`${s}:`,`${s};`))await E(e,s,g.destination_id)}a!==null&&await E(e,s,a.id)},{savepoint:!0}),r.accepted.push(i.key)}catch(a){if(H(a))throw a;const c=a instanceof O?a.code:"invalid_event";r.rejected.push({key:i.key,code:c,message:a instanceof Error?a.message:String(a)})}}return r}o(Q,"ingestPeerEvents");const Y=o(async(e,t,n)=>(await m(e,t))?.home_machine===n,"isStubOf"),Z=o(async(e,t,n)=>await C(e,t,n),"claimFor"),v=o(async(e,t,n)=>await N(e,t,n),"ackFor");export{z as MAX_EVENTS_PER_CALL,v as ackFor,Z as claimFor,y as ingestKey,Q as ingestPeerEvents,J as isCatalogLag,Y as isStubOf,H as isTransientDbError};

package/dist/core/peer/stubs.d.ts

@@ -56,6 +56,14 @@ export declare const isStub: (db: CanvasDb, object: ObjectRow) => Promise<boolea
  *  owner, not a thing that lives on one machine: it is the same object here as there, so it is never given a stub (a stub would collide
  *  with the local owner object of the same handle, as with an installed plugin's app). */
 export declare function localOwnerActor(db: CanvasDb, ref: ObjectRef): Promise<ObjectRow | null>;
+/** Lock every key in `keys` in one global order (family rank, then lock hash), so no two transactions that lock overlapping sets can wait on
+ *  each other. Locks are held to the end of the transaction, and taking one again is free. */
+export declare function lockInOrder(db: CanvasDb, keys: readonly string[]): Promise<void>;
+/** Every advisory lock `ensureStub` takes for this object: the stub, the custom kind its reference declares, and each owner it may create.
+ *  A caller that touches several stubs locks the union with `lockInOrder` first, so the order never depends on which stub comes first. */
+export declare function stubLockKeys(db: CanvasDb, id: string, type: string, identity: StubIdentity | null, ref: ObjectRef | undefined): Promise<string[]>;
+/** The advisory locks `actorFor` takes for an event's actor. */
+export declare function actorLockKeys(db: CanvasDb, ref: ObjectRef): Promise<string[]>;
 /**
  * The stub of the object `id` that lives on `machine`, created on first sight. Idempotent: a second
  * call returns the same row and, given an `envelope`, replaces the identity it stores. Refuses

package/dist/core/peer/stubs.js

@@ -1 +1 @@
-var T=Object.defineProperty;var a=(n,e)=>T(n,"name",{value:e,configurable:!0});import{createObject as O,getById as c,ownerForGrantee as _}from"../graph/objects.js";import{readLegacyPrivacy as x}from"../graph/types.js";import{upsertKind as A}from"../graph/custom.js";import{CrtrError as w}from"../errors.js";import{ExitCode as d}from"../../types.js";import{normalizeMachineId as b}from"./names.js";import{personId as g,personIdAsync as H}from"../canvas/person.js";import{writeActsFor as N}from"../permissions/facts.js";const W=["public","private"],D=a(n=>{const e=n.act.act;return e===void 0?{sub:n.sub,app:null,node:null,node_scopes:null,place:null}:{sub:n.sub,app:e.sub,node:e.node,node_scopes:e.node_scopes,place:e.place}},"identityOfEnvelope");async function h(n,e){const i=typeof e=="string"?await c(n,e):e;if(i===null)return null;const t=await n.prepare("SELECT home_machine, envelope_json FROM peer_stubs WHERE object = ?").get(i.id);return t?{object:i,home_machine:t.home_machine,identity:t.envelope_json===null?null:JSON.parse(t.envelope_json)}:null}a(h,"stubOf");const G=a(async(n,e)=>await n.prepare("SELECT 1 FROM peer_stubs WHERE object = ?").get(e.id)!==void 0,"isStub");async function E(n){return await _(n,g())}a(E,"localPerson");async function f(n,e){return await _(n,e)}a(f,"localApp");async function K(n,e){return e.type==="app"?await f(n,`app:${e.name}`):e.type==="person"?await E(n):null}a(K,"localOwnerActor");async function v(n,e,i){if(e!==null)return e.app===null?await E(n):await f(n,e.app);const t=i?.owner;return t?.type==="app"?await f(n,t.external_id??`app:${t.handle}`):await E(n)}a(v,"ownerFor");async function P(n,e,i,t,m,r){const p=m===void 0?null:D(m),s=x(r?.privacy??"public");if(!W.includes(s))throw new w("invalid_event",`invalid privacy ${JSON.stringify(s)}`,d.GENERAL,{id:e});const o=await c(n,e);if(o!==null){const l=await h(n,o);if(l===null)throw new w("conflict",`${e} is a local ${o.type}, not a stub of ${t}`,d.GENERAL,{id:e});if(l.home_machine!==t)throw new w("conflict",`${e} is already a stub of ${l.home_machine}, not ${t}`,d.GENERAL,{id:e,home_machine:l.home_machine});return p!==null&&(await n.prepare("UPDATE peer_stubs SET envelope_json = ? WHERE object = ?").run(JSON.stringify(p),o.id),await n.prepare("UPDATE objects SET reception = 2 WHERE id = ?").run(o.id)),r!==void 0&&(await S(n,i,r),r.privacy!==void 0&&o.privacy!==s)?(await n.prepare("UPDATE objects SET privacy = ? WHERE id = ?").run(s,o.id),await c(n,o.id)):o}const y=await v(n,p,r);await S(n,i,r);const u=await O(n,{id:e,type:i,kind:r?.kind??null,owner:y.id,privacy:s,name:r?.name??e,preview:r?.preview??"",home_machine:t});return await n.prepare("INSERT INTO peer_stubs (object, home_machine, envelope_json, created_at) VALUES (?, ?, ?, ?)").run(u.id,t,p===null?null:JSON.stringify(p),new Date().toISOString()),y.type==="app"&&await N(n,u.id,await H()),p!==null&&await n.prepare("UPDATE objects SET reception = 2 WHERE id = ?").run(u.id),await c(n,u.id)}a(P,"ensureStub");async function S(n,e,i){const t=i?.kind_decl;t===void 0||t.name!==e||await A(n,{name:t.name,owner:await v(n,null,{...i,owner:t.owner}),description:t.description,events:t.events,read:null,source:"peer"})}a(S,"holdKind");async function V(n,e,i){const t=await P(n,e,"node",b(i));return await n.prepare("UPDATE objects SET reception = 2 WHERE id = ?").run(t.id),await c(n,t.id)}a(V,"ensureNodeStub");async function z(n,e,i){const t=await h(n,e);t===null||t.home_machine===i||(await n.prepare("UPDATE peer_stubs SET home_machine = ? WHERE object = ?").run(i,t.object.id),await n.prepare("UPDATE objects SET home_machine = ? WHERE id = ?").run(i,t.object.id))}a(z,"rehomeStub");async function B(n,e){const i=await j(n,e.owner===null?null:await c(n,e.owner)),t=await R(n,e.type);return{id:e.id,type:e.type,kind:e.kind,name:e.name,preview:e.preview,owner:i,privacy:e.privacy,...t===null?{}:{kind_decl:t}}}a(B,"describeObject");async function j(n,e){if(e===null||e.type!=="person"&&e.type!=="app"&&e.type!=="repo"&&e.type!=="profile")return null;const i=await n.prepare("SELECT scheme, external_id FROM identities WHERE object = ?").get(e.id);return{id:e.id,type:e.type,scheme:i?.scheme??null,external_id:i?.external_id??null,handle:e.name}}a(j,"ownerRefOf");async function R(n,e){const i=await n.prepare("SELECT owner, description, events_json FROM object_kinds WHERE name = ?").get(e),t=i===void 0?null:await j(n,await c(n,i.owner));return i===void 0||t===null?null:{name:e,description:i.description,events:JSON.parse(i.events_json),owner:t}}a(R,"kindDeclarationOf");async function Y(n,e,i){const t=await R(n,e.type);return t===null?i:{...i,kind_decl:t}}a(Y,"withKindDecl");export{B as describeObject,V as ensureNodeStub,P as ensureStub,D as identityOfEnvelope,G as isStub,R as kindDeclarationOf,K as localOwnerActor,z as rehomeStub,h as stubOf,Y as withKindDecl};
+var T=Object.defineProperty;var r=(n,e)=>T(n,"name",{value:e,configurable:!0});import{createObject as A,getById as s,ownerForGrantee as f,ownerLockKey as L}from"../graph/objects.js";import{readLegacyPrivacy as N}from"../graph/types.js";import{upsertKind as g}from"../graph/custom.js";import{CrtrError as y}from"../errors.js";import{ExitCode as m}from"../../types.js";import{normalizeMachineId as W}from"./names.js";import{personId as d,personIdAsync as $}from"../canvas/person.js";import{writeActsFor as b}from"../permissions/facts.js";const I=["public","private"],H=r(n=>{const e=n.act.act;return e===void 0?{sub:n.sub,app:null,node:null,node_scopes:null,place:null}:{sub:n.sub,app:e.sub,node:e.node,node_scopes:e.node_scopes,place:e.place}},"identityOfEnvelope");async function S(n,e){const t=typeof e=="string"?await s(n,e):e;if(t===null)return null;const i=await n.prepare("SELECT home_machine, envelope_json FROM peer_stubs WHERE object = ?").get(t.id);return i?{object:t,home_machine:i.home_machine,identity:i.envelope_json===null?null:JSON.parse(i.envelope_json)}:null}r(S,"stubOf");const Q=r(async(n,e)=>await n.prepare("SELECT 1 FROM peer_stubs WHERE object = ?").get(e.id)!==void 0,"isStub");async function C(n){return await f(n,d())}r(C,"localPerson");async function D(n,e){return await f(n,e)}r(D,"localApp");async function X(n,e){return e.type==="app"?await D(n,`app:${e.name}`):e.type==="person"?await C(n):null}r(X,"localOwnerActor");function h(n,e){return n!==null?n.app===null?d():n.app:e?.type==="app"?e.external_id??`app:${e.handle}`:d()}r(h,"ownerGrantee");async function k(n,e,t){return await f(n,h(e,t?.owner))}r(k,"ownerFor");const P=["ingest:","stub:","owner:","kind:"],v=r(n=>{const e=P.findIndex(t=>n.startsWith(t));if(e<0)throw new Error(`lockInOrder: ${JSON.stringify(n)} is not a known lock key`);return e},"rankOf");async function U(n,e){const t=[...new Set(e)];if(t.length===0)return;const p=(await n.prepareUncached(t.map((a,o)=>`SELECT ${o} AS i, hashtext(?) AS h`).join(" UNION ALL ")).all(...t)).map(a=>({key:t[Number(a.i)],hash:Number(a.h)})).sort((a,o)=>v(a.key)-v(o.key)||a.hash-o.hash);for(const{key:a}of p)await n.prepare("SELECT pg_advisory_xact_lock(hashtext(?))").get(a)}r(U,"lockInOrder");async function E(n,e){const[t,i]=e.startsWith("app:")?["app",e]:["user",e];return await n.prepare("SELECT 1 FROM identities WHERE scheme = ? AND external_id = ?").get(t,i)===void 0?[L(t,i)]:[]}r(E,"missingOwnerKey");async function O(n,e,t,i,p){const a=[`stub:${e}`],o=p?.kind_decl;return o!==void 0&&o.name===t&&a.push(`kind:${t}`,...await E(n,h(null,o.owner))),await s(n,e)===null&&a.push(...await E(n,h(i,p?.owner))),a}r(O,"stubLockKeys");async function Z(n,e){return e.type==="app"?await E(n,`app:${e.name}`):e.type==="person"?await E(n,d()):await O(n,e.id,e.type,null,e)}r(Z,"actorLockKeys");async function K(n,e,t,i,p,a){const o=p===void 0?null:H(p),u=N(a?.privacy??"public");if(!I.includes(u))throw new y("invalid_event",`invalid privacy ${JSON.stringify(u)}`,m.GENERAL,{id:e});await U(n,await O(n,e,t,o,a));const c=await s(n,e);if(c!==null){const w=await S(n,c);if(w===null)throw new y("conflict",`${e} is a local ${c.type}, not a stub of ${i}`,m.GENERAL,{id:e});if(w.home_machine!==i)throw new y("conflict",`${e} is already a stub of ${w.home_machine}, not ${i}`,m.GENERAL,{id:e,home_machine:w.home_machine});return o!==null&&(await n.prepare("UPDATE peer_stubs SET envelope_json = ? WHERE object = ?").run(JSON.stringify(o),c.id),await n.prepare("UPDATE objects SET reception = 2 WHERE id = ?").run(c.id)),a!==void 0&&(await x(n,t,a),a.privacy!==void 0&&c.privacy!==u)?(await n.prepare("UPDATE objects SET privacy = ? WHERE id = ?").run(u,c.id),await s(n,c.id)):c}const _=await k(n,o,a);await x(n,t,a);const l=await A(n,{id:e,type:t,kind:a?.kind??null,owner:_.id,privacy:u,name:a?.name??e,preview:a?.preview??"",home_machine:i});return await n.prepare("INSERT INTO peer_stubs (object, home_machine, envelope_json, created_at) VALUES (?, ?, ?, ?)").run(l.id,i,o===null?null:JSON.stringify(o),new Date().toISOString()),_.type==="app"&&await b(n,l.id,await $()),o!==null&&await n.prepare("UPDATE objects SET reception = 2 WHERE id = ?").run(l.id),await s(n,l.id)}r(K,"ensureStub");async function x(n,e,t){const i=t?.kind_decl;i===void 0||i.name!==e||await g(n,{name:i.name,owner:await k(n,null,{...t,owner:i.owner}),description:i.description,events:i.events,read:null,source:"peer"})}r(x,"holdKind");async function ee(n,e,t){const i=await K(n,e,"node",W(t));return await n.prepare("UPDATE objects SET reception = 2 WHERE id = ?").run(i.id),await s(n,i.id)}r(ee,"ensureNodeStub");async function ne(n,e,t){const i=await S(n,e);i===null||i.home_machine===t||(await n.prepare("UPDATE peer_stubs SET home_machine = ? WHERE object = ?").run(t,i.object.id),await n.prepare("UPDATE objects SET home_machine = ? WHERE id = ?").run(t,i.object.id))}r(ne,"rehomeStub");async function te(n,e){const t=await R(n,e.owner===null?null:await s(n,e.owner)),i=await j(n,e.type);return{id:e.id,type:e.type,kind:e.kind,name:e.name,preview:e.preview,owner:t,privacy:e.privacy,...i===null?{}:{kind_decl:i}}}r(te,"describeObject");async function R(n,e){if(e===null||e.type!=="person"&&e.type!=="app"&&e.type!=="repo"&&e.type!=="profile")return null;const t=await n.prepare("SELECT scheme, external_id FROM identities WHERE object = ?").get(e.id);return{id:e.id,type:e.type,scheme:t?.scheme??null,external_id:t?.external_id??null,handle:e.name}}r(R,"ownerRefOf");async function j(n,e){const t=await n.prepare("SELECT owner, description, events_json FROM object_kinds WHERE name = ?").get(e),i=t===void 0?null:await R(n,await s(n,t.owner));return t===void 0||i===null?null:{name:e,description:t.description,events:JSON.parse(t.events_json),owner:i}}r(j,"kindDeclarationOf");async function ie(n,e,t){const i=await j(n,e.type);return i===null?t:{...t,kind_decl:i}}r(ie,"withKindDecl");export{Z as actorLockKeys,te as describeObject,ee as ensureNodeStub,K as ensureStub,H as identityOfEnvelope,Q as isStub,j as kindDeclarationOf,X as localOwnerActor,U as lockInOrder,ne as rehomeStub,O as stubLockKeys,S as stubOf,ie as withKindDecl};

package/dist/core/permissions/evaluator.d.ts

@@ -5,14 +5,19 @@ import { type SubjectSet } from './compile.js';
 import { type Frag } from './sql.js';
 export type Permission = 'read' | 'edit' | 'message' | 'use' | 'share';
 export declare const PERMISSIONS: readonly Permission[];
-/** A reader with its user and subject set resolved: build once, pass to many `permits`/`check` calls. */
+/** A reader with its user and subject set resolved: build once, pass to many `permits`/`check` calls. `userId` is null for a reader
+ *  that acts for no person (see `readerUser`): its subjects are `*` alone. */
 export interface EvalReader {
     reader: Reader;
-    userId: string;
+    userId: string | null;
     subjects: SubjectSet;
 }
 /** The user a reader acts for: a person's own identity; an app call's `sub`; a node's `sub`; otherwise the install's person. */
 export declare function userOf(db: CanvasDb, reader: Reader): Promise<string>;
+/** The user a reader reads as: `userOf`, except that on a cloud role an app reader with no `sub` (a runtime-owned call, such as
+ *  package link derivation at boot) acts for no person and answers null. `userOf` itself keeps throwing there, so no write path
+ *  records an object as kept for a person that is not there. */
+export declare function readerUser(db: CanvasDb, reader: Reader): Promise<string | null>;
 /** The user ids a subject stands for (the user and `*`) and every group it reaches, directly or through nested groups. */
 export declare function subjectSet(db: CanvasDb, userId: string): Promise<SubjectSet>;
 export declare function resolveReader(db: CanvasDb, reader: Reader): Promise<EvalReader>;

package/dist/core/permissions/evaluator.js

@@ -1,6 +1,6 @@
-var L=Object.defineProperty;var a=(e,t)=>L(e,"name",{value:t,configurable:!0});import{personIdAsync as l}from"../canvas/person.js";import{OBJECT_TYPE as O,GROUP_TYPE as w}from"./builtin.js";import{ceilingFrag as b,resolveCeiling as C}from"./ceiling.js";import{compilePermission as f}from"./compile.js";import{PermissionError as I}from"./errors.js";import{loadDefinitions as g}from"./schemas.js";import{TRUE as $,and as H,f as E,or as x,raw as p}from"./sql.js";const D=["read","edit","message","use","share"],U={read:"read",use:"read",edit:"write",share:"write",message:"message"},m=a(e=>e.replace(/^user:/,""),"bareUser");async function W(e,t){if(t.class==="person"){const c=await e.prepare("SELECT external_id FROM identities WHERE object = ? AND scheme = 'user'").get(t.person.id);return m(c?.external_id??await l())}if(t.class==="app")return m(t.sub??await l());const s=t.class==="node"?t.node.id:t.object.id,r=await e.prepare("SELECT sub FROM nodes WHERE node_id = ?").get(s);return m(r?.sub??await l())}a(W,"userOf");async function y(e,t){const s=[t,"*"],r=await e.prepareUncached(`WITH RECURSIVE g(id) AS (
+var j=Object.defineProperty;var o=(e,t)=>j(e,"name",{value:t,configurable:!0});import{isCloudRole as C,personIdAsync as m}from"../canvas/person.js";import{OBJECT_TYPE as I,GROUP_TYPE as w}from"./builtin.js";import{ceilingFrag as L,resolveCeiling as O}from"./ceiling.js";import{compilePermission as f}from"./compile.js";import{PermissionError as $}from"./errors.js";import{loadDefinitions as A}from"./schemas.js";import{TRUE as x,and as H,f as E,or as U,raw as p}from"./sql.js";const D=["read","edit","message","use","share"],W={read:"read",use:"read",edit:"write",share:"write",message:"message"},l=o(e=>e.replace(/^user:/,""),"bareUser");async function F(e,t){if(t.class==="person"){const c=await e.prepare("SELECT external_id FROM identities WHERE object = ? AND scheme = 'user'").get(t.person.id);return l(c?.external_id??await m())}if(t.class==="app")return l(t.sub??await m());const s=t.class==="node"?t.node.id:t.object.id,r=await e.prepare("SELECT sub FROM nodes WHERE node_id = ?").get(s);return l(r?.sub??await m())}o(F,"userOf");async function M(e,t){return t.class==="app"&&t.sub===void 0&&C()?null:await F(e,t)}o(M,"readerUser");async function _(e,t){const s=[t,"*"],r=await e.prepareUncached(`WITH RECURSIVE g(id) AS (
       SELECT resource_id FROM relations WHERE resource_type = ? AND relation = 'member' AND subject_type = 'user' AND subject_id = ANY(?::text[])
       UNION
       SELECT r.resource_id FROM relations r JOIN g ON r.subject_type = ? AND r.subject_id = g.id AND r.subject_relation = 'member'
        WHERE r.resource_type = ? AND r.relation = 'member')
-    SELECT id FROM g`).all(w,s,w,w);return{userIds:s,groupIds:r.map(c=>c.id)}}a(y,"subjectSet");async function F(e,t){const s=await W(e,t);return{reader:t,userId:s,subjects:await y(e,s)}}a(F,"resolveReader");const M=a(e=>"subjects"in e,"isEval");async function k(e,t,s,r="o",c={}){if(!D.includes(s))throw new I(400,"unknown_permission",`unknown permission ${s}`);const n=M(t)?t:await F(e,t),i=await g(e),d=p(`${r}.id`),N=f(i,n.subjects,O,s,d),S=s==="read"?x([N,p(`${r}.type = 'app'`)]):N,h=n.reader.class==="person"?null:n.reader.app.id,T=n.reader.class==="app"&&n.reader.place===void 0&&h!==null?await P(e,h):new Set,u=[];for(const[o,_]of i){if(o.startsWith("crtr/")||o==="user"||o==="app"||!(s in _.permissions)&&!(s in _.relations))continue;const j=o.split("/")[0];u.push(E`WHEN ${p(r)}.schema_type = ${o} THEN ${T.has(j)?$:f(i,n.subjects,o,s,d)}`)}const A=u.length===0?E`(CASE WHEN ${p(r)}.schema_type IS NULL THEN ${S} ELSE FALSE END)`:E`(CASE WHEN ${p(r)}.schema_type IS NULL THEN ${S} ${{sql:u.map(o=>o.sql).join(" "),params:u.flatMap(o=>o.params)}} ELSE FALSE END)`,R=await C(e,n.reader,U[s],c);return R===null?A:H([b(R,r),A])}a(k,"permits");async function P(e,t){const s=await e.prepare("SELECT s.namespace FROM schemas s JOIN identities i ON i.external_id = s.app AND i.scheme = 'app' WHERE i.object = ?").all(t);return new Set(s.map(r=>r.namespace))}a(P,"ownNamespaceTypes");async function Q(e,t,s,r,c={}){const n=await k(e,t,s,"o",c);return(await e.prepareUncached(`SELECT ${n.sql} AS ok FROM objects o WHERE o.id = ?`).get(...n.params,r))?.ok===!0}a(Q,"check");async function X(e,t,s,r){const c=await y(e,m(t)),n=await g(e),i=f(n,c,r.type,s,E`${r.id}::text`);return(await e.prepareUncached(`SELECT ${i.sql} AS ok`).get(...i.params))?.ok===!0}a(X,"checkUser");export{D as PERMISSIONS,Q as check,X as checkUser,k as permits,F as resolveReader,y as subjectSet,W as userOf};
+    SELECT id FROM g`).all(w,s,w,w);return{userIds:s,groupIds:r.map(c=>c.id)}}o(_,"subjectSet");async function k(e,t){const s=await M(e,t);return{reader:t,userId:s,subjects:s===null?{userIds:["*"],groupIds:[]}:await _(e,s)}}o(k,"resolveReader");const P=o(e=>"subjects"in e,"isEval");async function v(e,t,s,r="o",c={}){if(!D.includes(s))throw new $(400,"unknown_permission",`unknown permission ${s}`);const n=P(t)?t:await k(e,t),i=await A(e),d=p(`${r}.id`),N=f(i,n.subjects,I,s,d),S=s==="read"?U([N,p(`${r}.type = 'app'`)]):N,R=n.reader.class==="person"?null:n.reader.app.id,T=n.reader.class==="app"&&n.reader.place===void 0&&R!==null?await q(e,R):new Set,u=[];for(const[a,y]of i){if(a.startsWith("crtr/")||a==="user"||a==="app"||!(s in y.permissions)&&!(s in y.relations))continue;const b=a.split("/")[0];u.push(E`WHEN ${p(r)}.schema_type = ${a} THEN ${T.has(b)?x:f(i,n.subjects,a,s,d)}`)}const g=u.length===0?E`(CASE WHEN ${p(r)}.schema_type IS NULL THEN ${S} ELSE FALSE END)`:E`(CASE WHEN ${p(r)}.schema_type IS NULL THEN ${S} ${{sql:u.map(a=>a.sql).join(" "),params:u.flatMap(a=>a.params)}} ELSE FALSE END)`,h=await O(e,n.reader,W[s],c);return h===null?g:H([L(h,r),g])}o(v,"permits");async function q(e,t){const s=await e.prepare("SELECT s.namespace FROM schemas s JOIN identities i ON i.external_id = s.app AND i.scheme = 'app' WHERE i.object = ?").all(t);return new Set(s.map(r=>r.namespace))}o(q,"ownNamespaceTypes");async function Z(e,t,s,r,c={}){const n=await v(e,t,s,"o",c);return(await e.prepareUncached(`SELECT ${n.sql} AS ok FROM objects o WHERE o.id = ?`).get(...n.params,r))?.ok===!0}o(Z,"check");async function ee(e,t,s,r){const c=await _(e,l(t)),n=await A(e),i=f(n,c,r.type,s,E`${r.id}::text`);return(await e.prepareUncached(`SELECT ${i.sql} AS ok`).get(...i.params))?.ok===!0}o(ee,"checkUser");export{D as PERMISSIONS,Z as check,ee as checkUser,v as permits,M as readerUser,k as resolveReader,_ as subjectSet,F as userOf};

package/dist/core/plugin-env.js

@@ -1 +1 @@
-var u=Object.defineProperty;var s=(t,e)=>u(t,"name",{value:e,configurable:!0});import{validateEnvVarName as a}from"./env-name.js";import{isReservedEnvName as f}from"./profiles/env-store.js";function l(t){if(!t||typeof t!="object"||Array.isArray(t))return["env must be an object mapping variable names to declarations"];const e=[];for(const[r,i]of Object.entries(t)){if((!a(r).isValid||f(r))&&e.push(`env.${r} has an invalid or reserved name`),!i||typeof i!="object"||Array.isArray(i)){e.push(`env.${r} must be an object`);continue}const n=i;(typeof n.description!="string"||!n.description.trim())&&e.push(`env.${r}.description must be a non-empty string`),n.required!==void 0&&typeof n.required!="boolean"&&e.push(`env.${r}.required must be boolean`),n.secret!==void 0&&typeof n.secret!="boolean"&&e.push(`env.${r}.secret must be boolean`),n.url!==void 0&&(typeof n.url!="string"||!/^https:\/\/[^\s]+$/.test(n.url))&&e.push(`env.${r}.url must be an https URL`);for(const o of Object.keys(n))["description","required","secret","url"].includes(o)||e.push(`env.${r}.${o} is unknown`)}return e}s(l,"invalidPluginEnvReasons");function m(t){return Object.entries(t??{}).filter(([,e])=>e.required!==!1).map(([e])=>e)}s(m,"requiredPluginEnv");export{l as invalidPluginEnvReasons,m as requiredPluginEnv};
+var u=Object.defineProperty;var s=(t,e)=>u(t,"name",{value:e,configurable:!0});import{isReservedEnvName as a,validateEnvVarName as f}from"./env-name.js";function d(t){if(!t||typeof t!="object"||Array.isArray(t))return["env must be an object mapping variable names to declarations"];const e=[];for(const[r,i]of Object.entries(t)){if((!f(r).isValid||a(r))&&e.push(`env.${r} has an invalid or reserved name`),!i||typeof i!="object"||Array.isArray(i)){e.push(`env.${r} must be an object`);continue}const n=i;(typeof n.description!="string"||!n.description.trim())&&e.push(`env.${r}.description must be a non-empty string`),n.required!==void 0&&typeof n.required!="boolean"&&e.push(`env.${r}.required must be boolean`),n.secret!==void 0&&typeof n.secret!="boolean"&&e.push(`env.${r}.secret must be boolean`),n.url!==void 0&&(typeof n.url!="string"||!/^https:\/\/[^\s]+$/.test(n.url))&&e.push(`env.${r}.url must be an https URL`);for(const o of Object.keys(n))["description","required","secret","url"].includes(o)||e.push(`env.${r}.${o} is unknown`)}return e}s(d,"invalidPluginEnvReasons");function l(t){return Object.entries(t??{}).filter(([,e])=>e.required!==!1).map(([e])=>e)}s(l,"requiredPluginEnv");export{d as invalidPluginEnvReasons,l as requiredPluginEnv};

package/dist/core/pool-credential-store.d.ts

@@ -11,17 +11,14 @@ import { type ManagedProviderId, type SubscriptionCredential } from './subscript
  * nothing: deciding a turn is unservable belongs to the rotation loop, and an `undefined` here
  * would make pi's eager launch gate FATAL a node that rotation could still have serviced.
  */
-export declare function electPoolCredential(providerId: ManagedProviderId, now?: number): SubscriptionCredential | undefined;
+export declare function electPoolCredential(providerId: ManagedProviderId, now?: number): Promise<SubscriptionCredential | undefined>;
 export declare class PoolCredentialStore implements CredentialStore {
-    private readonly authPath;
     private readonly auth;
-    constructor(authPath?: string);
     read(providerId: string): Promise<Credential | undefined>;
     list(): Promise<readonly CredentialInfo[]>;
     /**
      * pi's locked read-modify-write, chiefly its OAuth refresh. The whole transaction — electing
-     * the account, running pi's `fn`, committing the result — happens under the pool file's
-     * cross-process lock, because a refresh token is single-use: two brokers electing the same
+     * the account, running pi's `fn`, committing the result — happens under the account row locks, because a refresh token is single-use: two brokers electing the same
      * expired account outside a lock would both spend it and the loser would get a genuine
      * `invalid_grant`. Electing under the lock is also what guarantees the refreshed token lands
      * back on exactly the account whose token was spent.

package/dist/core/pool-credential-store.js

@@ -1 +1 @@
-var l=Object.defineProperty;var s=(n,t)=>l(n,"name",{value:t,configurable:!0});import{CrouterCredentialStore as m,defaultAuthPath as w}from"./auth-file.js";import{MANAGED_PROVIDER_IDS as x,getProviderLabel as g,isManagedProvider as c,modifyElectedSubscription as y,readSubscriptionPool as h,removeManagedAccount as P}from"./subscription-state.js";function r(n,t=Date.now()){return f(h(n),t)}s(r,"electPoolCredential");function f(n,t=Date.now()){return n.find(e=>!e.authFailure&&(!e.rateLimitedUntil||e.rateLimitedUntil<=t))??n[0]}s(f,"electFrom");function d(n){return{type:"oauth",refresh:n.refresh,access:n.access,expires:n.expires,...n.accountId?{accountId:n.accountId}:{},...n.clientId?{clientId:n.clientId}:{}}}s(d,"toCredential");class D{static{s(this,"PoolCredentialStore")}authPath;auth;constructor(t=w()){this.authPath=t,this.auth=new m(t)}async read(t){if(!c(t))return this.auth.read(t);const e=r(t);if(e!==void 0)return d(e);const i=await this.auth.read(t);return i?.type==="oauth"?void 0:i}async list(){const t=(await this.auth.list()).filter(e=>!(c(e.providerId)&&e.type==="oauth"));for(const e of x)t.some(i=>i.providerId===e)||h(e).length>0&&t.push({providerId:e,type:"oauth"});return t}async modify(t,e){if(!c(t))return this.auth.modify(t,e);if(r(t)===void 0){if(await this.read(t)!==void 0)return this.auth.modify(t,e);throw new Error(`${g(t)} has no account to update \u2014 add one with \`crtr sys settings\` or \`/provider-sub ${t} add\`.`)}const i=await y(t,u=>f(u),async u=>{const a=await e(d(u));if(a===void 0||a.type!=="oauth")return;const o=a.clientId;return{refresh:a.refresh,access:a.access,expires:a.expires,...typeof o=="string"&&o?{clientId:o}:{}}});return i===void 0?void 0:d(i)}async delete(t){if(!c(t))return this.auth.delete(t);const e=r(t);e!==void 0&&await P(t,e.label),await this.auth.read(t)!==void 0&&await this.auth.delete(t)}}export{D as PoolCredentialStore,r as electPoolCredential};
+var l=Object.defineProperty;var s=(i,t)=>l(i,"name",{value:t,configurable:!0});import{CrouterCredentialStore as w}from"./auth-file.js";import{MANAGED_PROVIDER_IDS as m,getProviderLabel as g,isManagedProvider as u,modifyElectedSubscription as x,readSubscriptionPool as f,removeManagedAccount as y}from"./subscription-state.js";import{registerGateCredentialStore as p}from"./runtime/provider-credential-gate.js";async function c(i,t=Date.now()){return h(await f(i),t)}s(c,"electPoolCredential");function h(i,t=Date.now()){return i.find(e=>!e.authFailure&&(!e.rateLimitedUntil||e.rateLimitedUntil<=t))??i[0]}s(h,"electFrom");function d(i){return{type:"oauth",refresh:i.refresh,access:i.access,expires:i.expires,...i.accountId?{accountId:i.accountId}:{},...i.clientId?{clientId:i.clientId}:{}}}s(d,"toCredential");class C{static{s(this,"PoolCredentialStore")}auth=new w;async read(t){if(!u(t))return this.auth.read(t);const e=await c(t);if(e!==void 0)return d(e);const a=await this.auth.read(t);return a?.type==="oauth"?void 0:a}async list(){const t=(await this.auth.list()).filter(e=>!(u(e.providerId)&&e.type==="oauth"));for(const e of m)t.some(a=>a.providerId===e)||(await f(e)).length>0&&t.push({providerId:e,type:"oauth"});return t}async modify(t,e){if(!u(t))return this.auth.modify(t,e);if(await c(t)===void 0){if(await this.read(t)!==void 0)return this.auth.modify(t,e);throw new Error(`${g(t)} has no account to update \u2014 add one with \`crtr sys settings\` or \`/provider-sub ${t} add\`.`)}const a=await x(t,r=>h(r),async r=>{const n=await e(d(r));if(n===void 0||n.type!=="oauth")return;const o=n.clientId;return{refresh:n.refresh,access:n.access,expires:n.expires,...typeof o=="string"&&o?{clientId:o}:{}}});return a===void 0?void 0:d(a)}async delete(t){if(!u(t))return this.auth.delete(t);const e=await c(t);e!==void 0&&await y(t,e.label),await this.auth.read(t)!==void 0&&await this.auth.delete(t)}}p(new C);export{C as PoolCredentialStore,c as electPoolCredential};

package/dist/core/profiles/app-env-store.d.ts

@@ -1,6 +1,6 @@
 export declare const isDeploymentName: (name: string) => boolean;
-/** Every var an app's processes receive: its own store plus the deployment-wide one. */
-export declare function readAppEnvVars(app: string): Record<string, string>;
-export declare function listAppEnvNames(app: string): string[];
-export declare function setAppEnvVar(app: string, name: string, value: string): boolean;
-export declare function removeAppEnvVar(app: string, name: string): boolean;
+/** Every var an app's processes receive: its own rows plus the deployment-wide ones. */
+export declare function readAppEnvVars(app: string, person?: string): Promise<Record<string, string>>;
+export declare function listAppEnvNames(app: string, person?: string): Promise<string[]>;
+export declare function setAppEnvVar(app: string, name: string, value: string, person?: string): Promise<boolean>;
+export declare function removeAppEnvVar(app: string, name: string, person?: string): Promise<boolean>;

package/dist/core/profiles/app-env-store.js

@@ -1,2 +1 @@
-var N=Object.defineProperty;var o=(t,r)=>N(t,"name",{value:r,configurable:!0});import{existsSync as O,readFileSync as S,writeFileSync as w,chmodSync as A,renameSync as b}from"node:fs";import{basename as D,dirname as p,join as u}from"node:path";import{appSpace as _,secretsDir as f}from"../layout.js";import{ensureDir as m}from"../fs-utils.js";import{withExclusiveDirectoryLock as j}from"../exclusive-lock.js";import{isReservedEnvName as x}from"./env-store.js";import{validateEnvVarName as d}from"../env-name.js";import{usage as l}from"../errors.js";const T=new Set(["CRTR_FEEDBACK_ENDPOINT","CRTR_FEEDBACK_TOKEN"]),s=o(t=>T.has(t),"isDeploymentName"),v=o(t=>!x(t),"isAppName"),E={path:o(()=>u(f(),"env","_deployment"),"path"),admits:s},h=o(t=>({path:o(()=>u(f(),"env",D(_(t).root),"_app"),"path"),admits:v}),"appStore"),V=o((t,r)=>s(r)?E:h(t),"storeFor");function a(t){const r=Object.create(null);try{if(!O(t.path()))return r;const e=JSON.parse(S(t.path(),"utf8"));if(!e||typeof e!="object"||!("vars"in e)||!e.vars||typeof e.vars!="object"||Array.isArray(e.vars))return r;for(const[n,i]of Object.entries(e.vars))d(n).isValid&&t.admits(n)&&typeof i=="string"&&!i.includes("\0")&&(r[n]=i)}catch{}return r}o(a,"read");function R(t,r){const e=t.path();m(p(e));const n=`${e}.tmp.${process.pid}.${Math.random().toString(36).slice(2)}`;w(n,JSON.stringify({vars:r})+`
-`,{mode:384}),A(n,384),b(n,e)}o(R,"write");function F(t){if(!d(t).isValid||!(v(t)||s(t)))throw l(`invalid or reserved env var name: ${t}`,{field:"name"})}o(F,"validate");function y(t,r,e){F(r);const n=V(t,r);return m(p(n.path())),j(`${n.path()}.lock`,()=>{const i=a(n),c=e(i);return c!==null&&R(n,i),c})}o(y,"update");function $(t){return{...a(h(t)),...a(E)}}o($,"readAppEnvVars");function Y(t){return Object.keys($(t)).sort()}o(Y,"listAppEnvNames");function q(t,r,e){if(!e||e.includes("\0"))throw l("a non-empty env value without NUL bytes is required",{field:"value"});return y(t,r,n=>{const i=!Object.hasOwn(n,r);return n[r]=e,i})}o(q,"setAppEnvVar");function I(t,r){return y(t,r,e=>Object.hasOwn(e,r)?(delete e[r],!0):null)??!1}o(I,"removeAppEnvVar");export{s as isDeploymentName,Y as listAppEnvNames,$ as readAppEnvVars,I as removeAppEnvVar,q as setAppEnvVar};
+var u=Object.defineProperty;var a=(t,e)=>u(t,"name",{value:e,configurable:!0});import{isReservedEnvName as N,validateEnvVarName as c}from"../env-name.js";import{usage as E}from"../errors.js";import{personIdAsync as y}from"../canvas/person.js";import{listEnvRowNames as w,putEnvRow as R,readEnvRows as d,removeEnvRow as A}from"../secrets/env-rows.js";import{DEPLOYMENT_ID as O}from"../secrets/environment-secrets.js";const D=new Set(["CRTR_FEEDBACK_ENDPOINT","CRTR_FEEDBACK_TOKEN"]),i=a(t=>D.has(t),"isDeploymentName"),o=a(t=>!N(t),"isAppName"),s={person:null,kind:"deployment",id:O},p=a(async(t,e)=>({person:e??await y(),kind:"app",id:t}),"appOwner"),v=a(async(t,e,n)=>i(e)?s:await p(t,n),"ownerFor");function m(t){if(!c(t).isValid||!(o(t)||i(t)))throw E(`invalid or reserved env var name: ${t}`,{field:"name"})}a(m,"validate");const f=a((t,e)=>{const n=Object.create(null);for(const[r,l]of Object.entries(t))c(r).isValid&&e(r)&&(n[r]=l);return n},"admitted");async function L(t,e){return{...f(await d(await p(t,e)),o),...f(await d(s),i)}}a(L,"readAppEnvVars");async function M(t,e){return[...(await w(await p(t,e))).filter(o),...(await w(s)).filter(i)].sort()}a(M,"listAppEnvNames");async function P(t,e,n,r){if(!n||n.includes("\0"))throw E("a non-empty env value without NUL bytes is required",{field:"value"});return m(e),await R(await v(t,e,r),e,n)}a(P,"setAppEnvVar");async function b(t,e,n){return m(e),await A(await v(t,e,n),e)}a(b,"removeAppEnvVar");export{i as isDeploymentName,M as listAppEnvNames,L as readAppEnvVars,b as removeAppEnvVar,P as setAppEnvVar};

package/dist/core/profiles/default-binding.d.ts

@@ -1,15 +1,15 @@
 export declare function resolveBindingCwd(cwd: string): string;
 export declare function getDefaultProfileId(cwd: string): string | null;
-export declare function setDefaultProfileId(cwd: string, profileId: string): void;
-export declare function clearDefaultProfile(cwd: string): void;
+export declare function setDefaultProfileId(cwd: string, profileId: string): Promise<void>;
+export declare function clearDefaultProfile(cwd: string): Promise<void>;
 export declare function defaultProfileDirs(profileId: string): string[];
-export declare function clearDefaultProfileId(profileId: string): string[];
+export declare function clearDefaultProfileId(profileId: string): Promise<string[]>;
 export declare function listDefaultPins(): Array<{
     dir: string;
     profileId: string;
 }>;
 /** Drop every pin whose directory no longer exists; returns what was removed. */
-export declare function clearMissingDefaultDirs(): Array<{
+export declare function clearMissingDefaultDirs(): Promise<Array<{
     dir: string;
     profile_id: string;
-}>;
+}>>;

package/dist/core/profiles/default-binding.js

@@ -1 +1 @@
-var u=Object.defineProperty;var o=(t,e)=>u(t,"name",{value:e,configurable:!0});import{existsSync as a,realpathSync as d}from"node:fs";import{resolve as p}from"node:path";import{userScopeRoot as l}from"../scope.js";import{mutateStoredDefaults as s,readStoredDefaults as m}from"../scoped-state/profiles.js";function f(t){const e=p(t);if(!a(e))return e;try{return d(e)}catch{return e}}o(f,"resolveBindingCwd");function c(){return m(l())}o(c,"bindings");function y(t){return c()[f(t)]??null}o(y,"getDefaultProfileId");function O(t,e){const i=f(t);s(l(),r=>({...r,[i]:e}))}o(O,"setDefaultProfileId");function S(t){const e=f(t);s(l(),i=>{const r={...i};return delete r[e],r})}o(S,"clearDefaultProfile");function g(t){return Object.entries(c()).filter(([,e])=>e===t).map(([e])=>e).sort()}o(g,"defaultProfileDirs");function h(t){let e=[];return s(l(),i=>{e=Object.entries(i).filter(([,n])=>n===t).map(([n])=>n).sort();const r={...i};for(const n of e)delete r[n];return r}),e}o(h,"clearDefaultProfileId");function v(){return Object.entries(c()).map(([t,e])=>({dir:t,profileId:e})).sort((t,e)=>t.dir.localeCompare(e.dir))}o(v,"listDefaultPins");function C(){let t=[];return s(l(),e=>{t=Object.entries(e).filter(([r])=>!a(r)).map(([r,n])=>({dir:r,profile_id:n})).sort((r,n)=>r.dir.localeCompare(n.dir));const i=new Set(t.map(r=>r.dir));return Object.fromEntries(Object.entries(e).filter(([r])=>!i.has(r)))}),t}o(C,"clearMissingDefaultDirs");export{S as clearDefaultProfile,h as clearDefaultProfileId,C as clearMissingDefaultDirs,g as defaultProfileDirs,y as getDefaultProfileId,v as listDefaultPins,f as resolveBindingCwd,O as setDefaultProfileId};
+var f=Object.defineProperty;var n=(t,e)=>f(t,"name",{value:e,configurable:!0});import{existsSync as l,realpathSync as u}from"node:fs";import{resolve as d}from"node:path";import{cachedDefaults as p,writeSettings as m}from"../scoped-state/person-store.js";function s(t){const e=d(t);if(!l(e))return e;try{return u(e)}catch{return e}}n(s,"resolveBindingCwd");function c(){return p()}n(c,"bindings");function w(t){return c()[s(t)]??null}n(w,"getDefaultProfileId");async function a(t){await m(e=>[{op:"defaults.replace",defaults:t({...e.defaults})}])}n(a,"replaceDefaults");async function P(t,e){const i=s(t);await a(r=>({...r,[i]:e}))}n(P,"setDefaultProfileId");async function g(t){const e=s(t);await a(i=>{const r={...i};return delete r[e],r})}n(g,"clearDefaultProfile");function j(t){return Object.entries(c()).filter(([,e])=>e===t).map(([e])=>e).sort()}n(j,"defaultProfileDirs");async function O(t){let e=[];return await a(i=>{e=Object.entries(i).filter(([,o])=>o===t).map(([o])=>o).sort();const r={...i};for(const o of e)delete r[o];return r}),e}n(O,"clearDefaultProfileId");function h(){return Object.entries(c()).map(([t,e])=>({dir:t,profileId:e})).sort((t,e)=>t.dir.localeCompare(e.dir))}n(h,"listDefaultPins");async function v(){let t=[];return await a(e=>{t=Object.entries(e).filter(([r])=>!l(r)).map(([r,o])=>({dir:r,profile_id:o})).sort((r,o)=>r.dir.localeCompare(o.dir));const i=new Set(t.map(r=>r.dir));return Object.fromEntries(Object.entries(e).filter(([r])=>!i.has(r)))}),t}n(v,"clearMissingDefaultDirs");export{g as clearDefaultProfile,O as clearDefaultProfileId,v as clearMissingDefaultDirs,j as defaultProfileDirs,w as getDefaultProfileId,h as listDefaultPins,s as resolveBindingCwd,P as setDefaultProfileId};

package/dist/core/profiles/env-store.d.ts

@@ -1,22 +1,11 @@
-export declare function isReservedEnvName(name: string): boolean;
-/** Every stored variable NAME for a profile, sorted. Never returns values. */
-export declare function listProfileEnvNames(profileId: string): string[];
-/** Set one variable, replacing any prior value under the same name. Holds the
- *  same per-profile lock manifest mutations use (`withProfileManifestLock`),
- *  so a concurrent `profile delete` can never race a write into an
- *  about-to-vanish profile dir — whichever runs first wins the lock, and the
- *  loser either sees `not_found` (delete-then-set) or removes the file right
- *  back out from under a just-written value (set-then-delete, via
- *  `deleteProfile`'s recursive rm of the whole profile root). Returns whether
- *  the name was newly added (`true`) or replaced an existing value (`false`). */
-export declare function setProfileEnvVar(profileId: string, name: string, value: string): boolean;
+/** Every stored variable NAME for a profile, sorted. Never opens or returns values. */
+export declare function listProfileEnvNames(profileId: string, person?: string): Promise<string[]>;
+/** Set one variable, replacing any prior value under the same name. Returns whether the name was newly added (`true`) or replaced an
+ *  existing value (`false`). One upsert on the sealed row; the profile must exist. */
+export declare function setProfileEnvVar(profileId: string, name: string, value: string, person?: string): Promise<boolean>;
 /** Remove one variable. Returns whether it was present. */
-export declare function removeProfileEnvVar(profileId: string, name: string): boolean;
-/** Every stored `{name: value}` for a profile — the ONLY function that
- *  returns raw values, called exclusively by `buildBrokerEnv`
- *  (`core/runtime/spawn-env.ts`) to inject them directly into a launched
- *  broker's env. Never throws: a stale/invalid/deleted profile id is a
- *  hot-path no-op (mirrors `readRawProfileConfig` in `core/config.ts`),
- *  because broker-env resolution must never fail a launch over a bad profile
- *  id. */
-export declare function readProfileEnvVars(profileId: string | null): Record<string, string>;
+export declare function removeProfileEnvVar(profileId: string, name: string, person?: string): Promise<boolean>;
+/** Every stored `{name: value}` for a profile — the ONLY function that returns raw values, called by `buildBrokerEnv`
+ *  (`core/runtime/spawn-env.ts`), the bash handler and cron. A null or empty profile id is `{}`. A row that fails to open
+ *  (another key, altered bytes) throws: a launch never proceeds with a silently empty environment. */
+export declare function readProfileEnvVars(profileId: string | null, person?: string): Promise<Record<string, string>>;

package/dist/core/profiles/env-store.js

@@ -1,2 +1 @@
-var E=Object.defineProperty;var n=(e,t)=>E(e,"name",{value:t,configurable:!0});import{existsSync as p,readFileSync as y,renameSync as S,writeFileSync as O,chmodSync as b}from"node:fs";import{dirname as w}from"node:path";import{profileSpace as R}from"../layout.js";import{loadExactProfileManifest as c,withProfileManifestLock as u}from"./manifest.js";import{ensureDir as x}from"../fs-utils.js";import{notFound as N,usage as f}from"../errors.js";const P="CRTR_",g=new Set(["HOME"]);function v(e){return e.startsWith(P)||g.has(e)}n(v,"isReservedEnvName");function m(e){return e.includes("\0")}n(m,"hasNulByte");function l(e){const t=c(e);return R(t.manifest.grantee??"app:terminal",e).env}n(l,"envPath");function s(e){const t=l(e),r=Object.create(null);if(!p(t))return{vars:r};try{const o=JSON.parse(y(t,"utf8"));for(const[i,a]of Object.entries(o.vars??{}))typeof a=="string"&&(m(a)||v(i)||(r[i]=a))}catch{}return{vars:r}}n(s,"readStoreUnlocked");function d(e,t){const r=l(e);x(w(r));const o=`${r}.tmp.${process.pid}.${Math.random().toString(36).slice(2)}`;O(o,JSON.stringify(t,null,2)+`
-`,{mode:384}),b(o,384),S(o,r)}n(d,"writeStoreAtomic");function h(e){try{c(e)}catch(t){throw t instanceof Error&&t.message.startsWith("profile not found:")?N(`profile not found: ${e}`,{received:e}):t}}n(h,"requireProfileExists");function F(e){return Object.keys(s(e).vars).sort()}n(F,"listProfileEnvNames");function A(e,t,r){if(v(t))throw f(`env var name is reserved by crtr: ${t}`,{received:t,field:"name",next:"crtr identity/routing names (CRTR_* and HOME) cannot be stored in a profile env store \u2014 a stored value under one of these names could redirect a broker to a different canvas home. Choose a different name."});if(m(r))throw f("env var value contains a NUL byte, which no OS accepts in an environment variable",{field:"value",next:"Remove NUL bytes from the piped value and retry."});return u(e,()=>{h(e);const o=s(e),i=!Object.hasOwn(o.vars,t);return o.vars[t]=r,d(e,o),i})}n(A,"setProfileEnvVar");function D(e,t){return u(e,()=>{h(e);const r=s(e);return Object.hasOwn(r.vars,t)?(delete r.vars[t],d(e,r),!0):!1})}n(D,"removeProfileEnvVar");function L(e){if(e===null||e==="")return{};try{return{...s(e).vars}}catch{return{}}}n(L,"readProfileEnvVars");export{v as isReservedEnvName,F as listProfileEnvNames,L as readProfileEnvVars,D as removeProfileEnvVar,A as setProfileEnvVar};
+var c=Object.defineProperty;var n=(e,r)=>c(e,"name",{value:r,configurable:!0});import{loadExactProfileManifest as v}from"./manifest.js";import{notFound as u,usage as s}from"../errors.js";import{isReservedEnvName as i}from"../env-name.js";import{personIdAsync as m}from"../canvas/person.js";import{listEnvRowNames as d,putEnvRow as l,readEnvRows as w,removeEnvRow as y}from"../secrets/env-rows.js";function h(e){return e.includes("\0")}n(h,"hasNulByte");const a=n(async(e,r)=>({person:r??await m(),kind:"profile",id:e}),"ownerOf");function f(e){try{v(e)}catch(r){throw r instanceof Error&&r.message.startsWith("profile not found:")?u(`profile not found: ${e}`,{received:e}):r}}n(f,"requireProfileExists");async function P(e,r){return(await d(await a(e,r))).filter(t=>!i(t))}n(P,"listProfileEnvNames");async function O(e,r,t,o){if(i(r))throw s(`env var name is reserved by crtr: ${r}`,{received:r,field:"name",next:"crtr identity/routing names (CRTR_* and HOME) cannot be stored in a profile env store \u2014 a stored value under one of these names could redirect a broker to a different canvas home. Choose a different name."});if(h(t))throw s("env var value contains a NUL byte, which no OS accepts in an environment variable",{field:"value",next:"Remove NUL bytes from the piped value and retry."});return f(e),await l(await a(e,o),r,t)}n(O,"setProfileEnvVar");async function g(e,r,t){return f(e),await y(await a(e,t),r)}n(g,"removeProfileEnvVar");async function k(e,r){if(e===null||e==="")return{};const t=await w(await a(e,r));for(const o of Object.keys(t))i(o)&&delete t[o];return t}n(k,"readProfileEnvVars");export{P as listProfileEnvNames,k as readProfileEnvVars,g as removeProfileEnvVar,O as setProfileEnvVar};

package/dist/core/profiles/manifest.d.ts

@@ -55,11 +55,7 @@ export declare function resolveProfileOperand(operand: string): ProfileEntry;
 /** `resolveProfileOperand` over any candidate list — the CLI passes the
  *  profiles the daemon lists for its caller. */
 export declare function matchProfileOperand<T>(all: readonly T[], operand: string, key: CandidateOf<T>): T;
-/** Hold the per-profile manifest lock for the duration of `fn`. ALL manifest
- *  mutations (create/rename/add-project/remove-project/delete/last-used)
- *  below run inside this. */
-export declare function withProfileManifestLock<T>(profileId: string, fn: () => T): T;
-export declare function ensureRootProfile(): ProfileEntry;
+export declare function ensureRootProfile(): Promise<ProfileEntry>;
 /** The env name a metadata entry surfaces as (spawn-env source F). Also the
  *  uniqueness domain for keys: the fold is lossy (`a-b`, `a_b`, `A_B` →
  *  `CRTR_PROFILE_META_A_B`), so two stored keys may not share a fold. */
@@ -77,9 +73,9 @@ export declare function createProfile(name: string, projects?: ProfileProject[],
     defaultKind?: string;
     metadata?: Record<string, string>;
     grantee?: string;
-}): ProfileEntry;
-export declare function ensureAppProfile(grantee: string): ProfileEntry;
-export declare function updateProfileLastUsed(profileId: string): ProfileEntry;
+}): Promise<ProfileEntry>;
+export declare function ensureAppProfile(grantee: string): Promise<ProfileEntry>;
+export declare function updateProfileLastUsed(profileId: string): Promise<ProfileEntry>;
 /** Paused check for an ALREADY-RESOLVED durable id (a canvas row's `profile_id`,
  * `CRTR_PROFILE_ID`) — exact-id only, no name matching, so it costs one small
  * read on the hot delivery paths that call it every poll. Fails OPEN: an id
@@ -92,14 +88,14 @@ export declare function pausedCanvasProfiles(): Set<string>;
  * every gate that already holds a loaded manifest. */
 export declare function assertProfileEntryActive(entry: ProfileEntry): void;
 export declare function assertProfileActive(profileId: string | null | undefined): ProfileEntry | null;
-export declare function pauseProfile(profileId: string): ProfileEntry;
-export declare function resumeProfile(profileId: string): ProfileEntry & {
+export declare function pauseProfile(profileId: string): Promise<ProfileEntry>;
+export declare function resumeProfile(profileId: string): Promise<ProfileEntry & {
     pausedAt: string | null;
-};
-export declare function setProfileDefaultKind(profileId: string, defaultKind: string): ProfileEntry;
+}>;
+export declare function setProfileDefaultKind(profileId: string, defaultKind: string): Promise<ProfileEntry>;
 /** Merge `set` entries over the stored map and drop `unset` keys; the
  *  `metadata` field is omitted entirely when the result is empty. */
-export declare function updateProfileMetadata(profileId: string, set: Record<string, string>, unset?: string[]): ProfileEntry;
+export declare function updateProfileMetadata(profileId: string, set: Record<string, string>, unset?: string[]): Promise<ProfileEntry>;
 /** A profile's stored metadata for broker-env injection — sanitized entry by
  *  entry (a manifest is hand-editable, so a bad key/value is dropped rather
  *  than trusted) and never throwing: a stale/invalid/absent profile id is a
@@ -109,12 +105,12 @@ export declare function readProfileMetadata(profileId: string | null): Record<st
 /** Change the manifest `name` only. Callers that own the canvas (the daemon's
  *  `PATCH /v1/profiles/:name`) must also rename the profile's canvas handle —
  *  use `renameProfileAndHandle` there; the CLI and panels go through that route. */
-export declare function renameProfile(profileId: string, name: string): ProfileEntry;
+export declare function renameProfile(profileId: string, name: string): Promise<ProfileEntry>;
 /** A new path appends; a path already listed keeps its position. */
-export declare function addProfileProject(profileId: string, dir: string): ProfileEntry;
+export declare function addProfileProject(profileId: string, dir: string): Promise<ProfileEntry>;
 /** Set one owner's automatic delivery limit. `content` is the uncapped level,
  *  so it removes the owner's entry instead of storing it. */
-export declare function setProfileDeliveryLimit(profileId: string, owner: string, level: ProfileProjectMemory): ProfileEntry;
-export declare function removeProfileProject(profileId: string, dir: string): ProfileEntry;
-export declare function deleteProfile(profileId: string): void;
+export declare function setProfileDeliveryLimit(profileId: string, owner: string, level: ProfileProjectMemory): Promise<ProfileEntry>;
+export declare function removeProfileProject(profileId: string, dir: string): Promise<ProfileEntry>;
+export declare function deleteProfile(profileId: string): Promise<void>;
 export {};