@north-light/cli 0.3.561 → 0.3.563

package/dist/daemon/api/vendor-signin.js

@@ -1,4 +1,4 @@
-var O=Object.defineProperty;var o=(e,t)=>O(e,"name",{value:t,configurable:!0});import{randomBytes as P}from"node:crypto";import{joinedOwner as N}from"../../core/directory/join.js";import{consumeHandoffJti as R,handoffJtiConsumed as z}from"../../core/model-auth/handoff-jti.js";import{completeModelAuthFlow as H,modelAuthFlowFailure as V,modelAuthProvider as F,readModelAuthFlow as k,startModelAuthFlow as D,waitModelAuthFlow as B,VendorSignInError as x}from"../../core/model-auth/flows.js";import{emitEvent as m}from"../../core/events/emit.js";import{RunError as s}from"../../core/runs/operations.js";import{LONG_POLL_MAX_WAIT_SECONDS as I}from"../../api/long-poll.js";const f="/signin/vendor",$=900,U=I*1e3,G="https://chatgpt.com/#settings/Security";function m1(e){return e===f||e.startsWith(`${f}/`)}o(m1,"isVendorSignInPath");function p(){return new s(401,"unauthorized","invalid vendor sign-in handoff")}o(p,"unauthorized");async function _(e,t){const r=await e.verifyHandoff(t);let n;try{n=N()}catch{n=null}if(r.sub!==n)throw p();return r}o(_,"verifyOwnerHandoff");function J(e){const t=e.headers.authorization;return t?.startsWith("Bearer ")&&t.length>7?t.slice(7):void 0}o(J,"bearer");function y(e,t){const r=e.getAll(t);return r.length===1?r[0]:void 0}o(y,"single");function Z(e,t,r,n){const a=new URL(e);return a.searchParams.set("status",t),r&&a.searchParams.set("reason",r),n&&a.searchParams.set("step",n),a.toString()}o(Z,"returnUrl");function v(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t])}o(v,"escapeHtml");function C(e,t,r){e.writeHead(t,{"Content-Type":"application/json; charset=utf-8","Cache-Control":"no-store"}),e.end(JSON.stringify(r))}o(C,"sendJson");async function q(e){const t=[];let r=0;for await(const a of e){if(r+=a.length,r>64*1024)throw new s(400,"invalid_request","request body too large");t.push(a)}let n;try{n=JSON.parse(Buffer.concat(t).toString("utf8"))}catch{throw new s(400,"invalid_request","invalid JSON body")}if(typeof n!="object"||n===null||Array.isArray(n))throw new s(400,"invalid_request","request body must be a JSON object");return n}o(q,"jsonBody");const W=`
+var R=Object.defineProperty;var o=(e,t)=>R(e,"name",{value:t,configurable:!0});import{randomBytes as H}from"node:crypto";import{joinedOwner as V}from"../../core/directory/join.js";import{isCloudRole as k,runAsPerson as F}from"../../core/canvas/person.js";import{consumeHandoffJti as D,handoffJtiConsumed as $}from"../../core/model-auth/handoff-jti.js";import{completeModelAuthFlow as I,modelAuthFlowFailure as B,modelAuthProvider as G,readModelAuthFlow as _,startModelAuthFlow as U,waitModelAuthFlow as J,VendorSignInError as y}from"../../core/model-auth/flows.js";import{emitEvent as p}from"../../core/events/emit.js";import{RunError as s}from"../../core/runs/operations.js";import{LONG_POLL_MAX_WAIT_SECONDS as Z}from"../../api/long-poll.js";const h="/signin/vendor",S=900,W=Z*1e3,q="https://chatgpt.com/#settings/Security";function b1(e){return e===h||e.startsWith(`${h}/`)}o(b1,"isVendorSignInPath");function u(){return new s(401,"unauthorized","invalid vendor sign-in handoff")}o(u,"unauthorized");async function C(e,t){const n=await e.verifyHandoff(t);if(k()){if(!n.sub.startsWith("user:"))throw u();return n}let r;try{r=V()}catch{r=null}if(n.sub!==r)throw u();return n}o(C,"verifyOwnerHandoff");function T(e){const t=e.headers.authorization;return t?.startsWith("Bearer ")&&t.length>7?t.slice(7):void 0}o(T,"bearer");function L(e,t){const n=e.getAll(t);return n.length===1?n[0]:void 0}o(L,"single");function X(e,t,n,r){const a=new URL(e);return a.searchParams.set("status",t),n&&a.searchParams.set("reason",n),r&&a.searchParams.set("step",r),a.toString()}o(X,"returnUrl");function v(e){return e.replace(/[&<>"']/g,t=>({"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;"})[t])}o(v,"escapeHtml");function M(e,t,n){e.writeHead(t,{"Content-Type":"application/json; charset=utf-8","Cache-Control":"no-store"}),e.end(JSON.stringify(n))}o(M,"sendJson");async function Y(e){const t=[];let n=0;for await(const a of e){if(n+=a.length,n>64*1024)throw new s(400,"invalid_request","request body too large");t.push(a)}let r;try{r=JSON.parse(Buffer.concat(t).toString("utf8"))}catch{throw new s(400,"invalid_request","invalid JSON body")}if(typeof r!="object"||r===null||Array.isArray(r))throw new s(400,"invalid_request","request body must be a JSON object");return r}o(Y,"jsonBody");const K=`
 :root{color-scheme:light dark;
 --canvas:#f0f2f4;--surface:#fff;--sunken:#e5e7ea;--zone:#e5e7ea;--neutral:#e5e7ea;--neutral-hover:#d7d9dc;--neutral-pressed:#cbcdd0;
 --accent:#217f51;--accent-hover:#1e6e46;--accent-pressed:#1a5e3c;--accent-border:#217f51;--accent-subtle:#d5f7e1;--accent-fg:#1e6e46;--on-accent:#fff;
@@ -83,7 +83,7 @@ form{display:flex;flex-direction:column;gap:.75rem}
 @keyframes spin{to{transform:rotate(360deg)}}
 @media (min-width:40rem){.top{padding:0 1.5rem}main{padding:3.5rem 1rem}}
 @media (max-width:30rem){.card{padding:1.25rem}.btn{padding-left:.875rem;padding-right:.875rem}#device-link{font-size:.84375rem}.steps>li{gap:.75rem}.alert .act{margin-left:1.875rem}}
-`,X=`
+`,Q=`
 (function(){
 var cfg=JSON.parse(document.getElementById('cfg').textContent);
 history.replaceState(null,'',location.pathname);
@@ -146,37 +146,37 @@ if(cfg.kind==='anthropic'){
   })();
 }
 })();
-`,Y={arrow:'<path d="M7 7h10v10"/><path d="M7 17 17 7"/>',copy:'<rect width="14" height="14" x="8" y="8" rx="2" ry="2"/><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"/>',clock:'<circle cx="12" cy="12" r="10"/><path d="M12 6v6l4 2"/>',warn:'<path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"/><path d="M12 9v4"/><path d="M12 17h.01"/>',alert:'<circle cx="12" cy="12" r="10"/><path d="M12 8v4"/><path d="M12 16h.01"/>',check:'<path d="M20 6 9 18l-5-5"/>'};function d(e,t=""){return`<svg class="ic${t}" viewBox="0 0 24 24" aria-hidden="true" focusable="false">${Y[e]}</svg>`}o(d,"icon");const K='<svg viewBox="-77.5 12 931 931" aria-hidden="true" focusable="false"><path fill="currentColor" d="M234 294m0 0h2l-1 5-6 16-5 15-6 25-4 23-2 22-1 5v47l5 38 5 26 6 22 10 24 8 16 9 14 14 19 13 16 11 13 9 11 11 12 7 8 13 16 11 14 14 19 12 19 12 23 7 17 6 23 3 14 3-1 5-15 20-84 6-24 6-21 10-33 10-25 8-16 8-15 8-12 9-12 8-10 9-10 7-8 6-7 20-20h2l2-4 17-17 7-8 10-13 14-21 8-16 8-18 5-15 2-7 2 1 6 36 2 18v41l-4 28-5 19-7 19-10 21-8 13-10 15-13 17-11 13-12 14-9 10-7 8-9 11h-2l-2 4-9 11-14 19-8 12-15 25-11 21-12 26-9 23-5 12-13 38-12 39-5 18-5 17h-2l-9-29-9-27-14-38-13-29-8-16-11-18-10-13-7-9-25-25-3-2v-2l-3-1v-2l-4-2-10-9-8-7-14-12-20-18-13-13-9-11-12-16-12-20-12-25-7-19-6-23-4-24-1-11-1-3v-39l3-23 6-27 7-23 5-11 11-23 9-16 10-14 8-11 9-11 10-11zM430 22m0 0h2v2h2l7 8 10 11 9 11 12 16 9 15 8 16 6 15 5 19 2 11 1 12v18l-1 16-5 24-5 16-7 15-9 17-7 11-10 15-10 13-9 11-13 14-7 8-11 12-7 8-13 16-11 15-13 20-10 18-8 16-7 18-5 15-4 18-2 14-1 27 2 24 3 17 5 23 8 30 12 36 9 28 3 8 4 12v2l-4-2-68-102-13-22-11-23-9-24-7-26-4-23-2-16v-31l3-25 6-27 7-21 7-15 8-16 14-21 11-14 26-30 12-13 8-10h2l2-4 10-11 7-9 14-19 7-10 13-24 7-19 4-15 3-14 3-22 2-24v-20l-2-31zM615 384m0 0 2 1 6 36 2 18v41l-4 28-5 19-7 19-10 21-8 13-10 15-13 17-11 13-12 14-9 10-7 8-9 11h-2l-2 4-9 11-14 19-8 12-15 25-11 21-2 5h-3l-2 2h-13l-6-5-11-6 1-9h-2l2-14-2 3 1-8 9-36 6-21 10-33 10-25 8-16 8-15 8-12 9-12 8-10 9-10 7-8 6-7 20-20h2l2-4 17-17 7-8 10-13 14-21 8-16 8-18 5-15zM557 254m0 0 2 1 4 16 2 16v34l-2 18-5 20-8 24-14 28-10 16-11 16-13 15-12 14-11 13-11 14-14 19-12 20-8 16-7 19-6 20-4 20-4 35-3 41-3 52-4 28-1 3h-2l-8-42-10-52-7-33-7-43v-54l4-24 5-17 8-20 10-19 7-10 10-13 9-11 19-19 8-7 16-15 8-7 9-9 8-7 11-11 1-2h2l2-4 11-13 10-14 11-17 9-19 8-21zM185 615m0 0 4 5 6 10 9 12 2 1 3 5 5-2 1-1h8l5 5 2 3 7 3 6 3 4 5 8 6 5 3v2h2v2h6l4 3 6 1 1 8 10 3 4 2 9 2 5 6 6 1h6l8 8 7 1 9 7h5l1-4-4-6-10-13-7-9-1-3h-2l-7-9v-3l7 6 7 9 11 14 14 19 12 19 12 23 7 17 6 23 3 14 3-1 5-15 10-42 5-22h2l1-4 1 4-1 8h-2l3 4-1 8 11 6 5 4h13l4-3-1 6-8 17-9 23-5 12-13 38-12 39-5 18-5 17h-2l-9-29-9-27-14-38-13-29-8-16-11-18-10-13-7-9-25-25-3-2v-2l-3-1v-2l-4-2-10-9-8-7-14-12-20-18-13-13-9-11-12-16-9-15zM369 553m0 0h1l1 43 2 3 3 4-1 6-1 1v7l1 2 1 15 7 1 5-2 5 1v-2l3-1 4 1 1-2h-3l1-3 6-2 2 11-1 8-3 12h2v2l3-1 2-12h-2l1-4 1-1 3-21 4-21h1v10l-4 30-3 34-4 69-4 28-1 3h-2l-8-42-10-52-7-33-6-37zM430 22m0 0h2v2h2l7 8 10 11 9 11 4 5 1 5 2 4 1 7 2 2-1 3-5-1h-7l-8-2-5 1v7l-1 1h-5l-2-8-1-2-1-15h-2l-2-31zM417 598m0 0h1v10l-4 30-3 34-4 69-4 28-1 3h-2l-7-37-1-16h8l2 1v-2h2l1-2 2-35v-13l-2-3-3-5-1-8 1-9-1-4-5-2v-2l-3-1v-2l3-1 4 1 1-2h-3l1-3 6-2 2 11-1 8-3 12h2v2l3-1 2-12h-2l1-4 1-1 3-21zM417 598m0 0h1v10l-4 30-3 34-1 17h-2v15l-1 12h-1v-18l1-17v-13l-2-3-3-5-1-8 1-9-1-4-5-2v-2l-3-1v-2l3-1 4 1 1-2h-3l1-3 6-2 2 11-1 8-3 12h2v2l3-1 2-12h-2l1-4 1-1 3-21zM310 619m0 0 4 2 4 6 5 8 7 9 3 5 2-1 2 1 2 10 6-1 2 1v2h-5l3 7 9 13 6 9 3 1v-2l-4-14h3l5 16 3 8 4 12v2l-4-2-60-90zM255 597m0 0 5 3 12 16 9 11 11 13 9 11 11 12 4 5-1 3-7-7-4-1-7-4v-2l-4-2-4-4 4 1 3-1v-3l-5-2-3-5v-2h-2l-6-8v-2l-3-1-1-2-8-1 1-2-2-8-3-4v-2h-2l-4-6-3-4zM425 181m0 0 7 1 1 3 12 2 2 3 3 1v-2h3l1 3-6 2-1 3h-2v2h-2l-1 7-5 1-2-5 2-3h3l1-5-3 1-3 3-1-4-5-2v-5h-6l-3-3zM369 553m0 0h1l1 43 2 3 3 4-1 6-1 1v7l1 2 1 15 2 1h-2l3 13 2 10v5l-3-4-5-25-4-26zM340 614m0 0 1 2h2l6 20 6 18 3 15-2-1-5-15-2-4v-5h-6l-3-2-9-2 2-3v2l5-4h4 2l-1-5-3-12zM296 649m0 0 5 2 11 12 4 5-1 3-7-7-4-1-7-4v-2l-4-2-4-4 4 1 3-1zM403 625m0 0h2l2 11-1 8-2 7-2 1v-9l-1-4-5-2v-2l-3-1v-2l3-1 4 1 1-2h-3l1-3zM417 598m0 0h1v10l-4 30-2 24h-1l-1-17h-2l1-4 1-1 3-21zM163 561m0 0 2 3 5 16 2 6 2 1 3 9 2 4 4-1 1-2 1 3h-2l-2 5 3 6-1 2-3-3-11-24-4-11-2-10zM439 685m0 0 1 2h9l3 4v6l7 2 3 7-4-1-6-4-5-4v-7h-9l-2-2zM369 553m0 0h1l1 43 2 3 3 4-1 6-1 1-1 7-2-2v-7h-2zM434 687m0 0h1v6l-3 9-7 29-4 5 1-8 9-36zM317 672m0 0 6 4 9 11 11 14 6 8v2l-4-2-10-13-7-9-1-3h-2l-7-9zM276 622m0 0 5 5 11 13 7 8-1 2-7-4-3-5v-2h-2l-6-8v-2l-3-1-2-4zM310 619m0 0 4 2 4 6 5 8 7 9-1 4-4-5-8-11-7-11zM416 172m0 0 2 1-1 7h-2v5l4-1-1 3-5 2-3-1v-7l4-8zM381 664m0 0 2 4 6 27v5l-1-2h-2l-5-24zM443 655m0 0 1 4-7 25-1 2h-2l1-7 6-22h2zM163 561m0 0 2 3 5 16 2 6 2 1v5l-2 1-7-18-2-10zM490 702m0 0 1 3-10 15-3 5-4 3v-5l5-5 7-11zM387 698m0 0 1 2h2l3 16v14h-1l-5-26zM426 139m0 0 1 3-1 5-7 22-2-1 2-9 5-18h2zM466 739m0 0h2l-1 6-8 15-3 1 2-7 7-12zM411 636m0 0h2v12l-1 14h-1l-1-17h-2l1-4zM349 645m0 0h3l3 9 3 15-2-1-5-15-2-4zM335 694m0 0 5 3 9 12v2l-4-2-10-13zM386 633m0 0 7 1-3 2-4 1-2 4h-4l-2-6h5zM547 287m0 0 3 2-3 7-1 5h-2l-1 4-2-1 1-5zM557 254m0 0 2 1 3 13-4-1 1-2h-2l-1 3-1-3zM560 311m0 0 3 1-2 5-3 6-9-3v-1l9-1zM409 664m0 0h1v25h-1l-2-24zM340 614m0 0 1 2h2l4 16-4-2-3-12zM438 705m0 0 10 2 1 7-3-1-4-4h-5zM502 685m0 0 1 3-8 11-3 1 2-5zM422 191m0 0 4 1 3 4-2 4-5-3zM359 675m0 0h3l4 13-1 4-4-9zM225 599m0 0 5 2 12 6-3 1-9-4-6-3zM255 597m0 0 5 3 6 8-1 2-3-1-4-6-3-4zM414 180m0 0h1v5l4-1-1 3-5 2-3-1 1-5zM341 665m0 0 3 1 6 9-1 4-8-12zM370 608m0 0h1l1 9 3 1-2 10h-1l-2-12zM439 671m0 0 1 2-4 13h-2l1-7 3-7zM341 658m0 0 6 1v2h-5l-1 5-3-3 1-4zM373 625m0 0h2l1 9 2 1h-2l-1 5h-1l-1-6zM185 615m0 0 4 5 5 8-1 3-4-5-4-7zM434 687m0 0h1v6l-3 9-2 3 1-13zM385 686m0 0h2l2 9v5l-1-2h-2l-1-5zM390 711m0 0h2l1 8v11h-1l-2-10zM355 657m0 0 2 3 4 12v3l-3-1-2-10zM413 624m0 0h1v14l-1-2h-2l1-11zM494 120m0 0h2l2 6v10l-2-3-2-9zM163 561m0 0 2 3 4 13-1 3v-2h-2l-3-13zM489 106m0 0h2l4 10-2 4-4-11zM230 609m0 0 5 1 4 5 3 2-6-1-3-3v-2l-3-1zM392 660m0 0h2v2h2l5 5 2 1-1 4-10-10zM254 615m0 0 8 1 1 1v5l-2-1v-2l-6-2zM190 587m0 0 6 1 2-1 4 2 1 3-13-2zM417 598m0 0h1v10l-1 5-2-1 1-9zM273 545m0 0 2 3 3 8v3h-2l-3-8z"/></svg>',Q={claude:'<svg viewBox="0 0 48 48" aria-hidden="true" focusable="false"><rect width="48" height="48" fill="#F3E9D7"/><path transform="translate(24 24) scale(.13) translate(-124 -124)" fill="#D97757" d="M52.4285 162.873L98.7844 136.879L99.5485 134.602L98.7844 133.334H96.4921L88.7237 132.862L62.2346 132.153L39.3113 131.207L17.0249 130.026L11.4214 128.844L6.2 121.873L6.7094 118.447L11.4214 115.257L18.171 115.847L33.0711 116.911L55.485 118.447L71.6586 119.392L95.728 121.873H99.5485L100.058 120.337L98.7844 119.392L97.7656 118.447L74.5877 102.732L49.4995 86.1905L36.3823 76.62L29.3779 71.7757L25.8121 67.2858L24.2839 57.3608L30.6515 50.2716L39.3113 50.8623L41.4763 51.4531L50.2636 58.1879L68.9842 72.7209L93.4357 90.6804L97.0015 93.6343L98.4374 92.6652L98.6571 91.9801L97.0015 89.2625L83.757 65.2772L69.621 40.8192L63.2534 30.6579L61.5978 24.632C60.9565 22.1032 60.579 20.0111 60.579 17.4246L67.8381 7.49965L71.9133 6.19995L81.7193 7.49965L85.7946 11.0443L91.9074 24.9865L101.714 46.8451L116.996 76.62L121.453 85.4816L123.873 93.6343L124.764 96.1155H126.292V94.6976L127.566 77.9197L129.858 57.3608L132.15 30.8942L132.915 23.4505L136.608 14.4708L143.994 9.62643L149.725 12.344L154.437 19.0788L153.8 23.4505L150.998 41.6463L145.522 70.1215L141.957 89.2625H143.994L146.414 86.7813L156.093 74.0206L172.266 53.698L179.398 45.6635L187.803 36.802L193.152 32.5484H203.34L210.726 43.6549L207.415 55.1159L196.972 68.3492L188.312 79.5739L175.896 96.2095L168.191 109.585L168.882 110.689L170.738 110.53L198.755 104.504L213.91 101.787L231.994 98.7149L240.144 102.496L241.036 106.395L237.852 114.311L218.495 119.037L195.826 123.645L162.07 131.592L161.696 131.893L162.137 132.547L177.36 133.925L183.855 134.279H199.774L229.447 136.524L237.215 141.605L241.8 147.867L241.036 152.711L229.065 158.737L213.019 154.956L175.45 145.977L162.587 142.787H160.805V143.85L171.502 154.366L191.242 172.089L215.82 195.011L217.094 200.682L213.91 205.172L210.599 204.699L188.949 188.394L180.544 181.069L161.696 165.118H160.422V166.772L164.752 173.152L187.803 207.771L188.949 218.405L187.294 221.832L181.308 223.959L174.813 222.777L161.187 203.754L147.305 182.486L136.098 163.345L134.745 164.2L128.075 235.42L125.019 239.082L117.887 241.8L111.902 237.31L108.718 229.984L111.902 215.452L115.722 196.547L118.779 181.541L121.58 162.873L123.291 156.636L123.14 156.219L121.773 156.449L107.699 175.752L86.304 204.699L69.3663 222.777L65.291 224.431L58.2867 220.768L58.9235 214.27L62.8713 208.48L86.304 178.705L100.44 160.155L109.551 149.507L109.462 147.967L108.959 147.924L46.6977 188.512L35.6182 189.93L30.7788 185.44L31.4156 178.115L33.7079 175.752L52.4285 162.873Z"/></svg>',chatgpt:'<svg viewBox="0 0 48 48" aria-hidden="true" focusable="false"><rect width="48" height="48" fill="#0D0D0D"/><path transform="translate(24 24) scale(2.35) translate(-7.98 -8)" fill="#FFF" d="M12.9851 6.93777C13.1163 6.54364 13.1618 6.12607 13.1186 5.71295C13.0754 5.29983 12.9444 4.90072 12.7344 4.54231C12.4232 4.00021 11.9478 3.57101 11.3768 3.31664C10.8058 3.06227 10.1687 2.99589 9.55751 3.12706C9.28184 2.81639 8.943 2.56818 8.56362 2.39905C8.18425 2.22993 7.77314 2.14379 7.3578 2.1464C6.73292 2.1449 6.1237 2.34187 5.61797 2.70892C5.11225 3.07598 4.73616 3.59415 4.54391 4.18873C4.13684 4.27206 3.75225 4.44139 3.41591 4.68539C3.07957 4.92938 2.79924 5.24241 2.59368 5.60352C2.27994 6.14413 2.14602 6.77039 2.21123 7.39205C2.27644 8.01367 2.5374 8.59851 2.95649 9.06224C2.82527 9.45637 2.77975 9.87394 2.82297 10.2871C2.8662 10.7002 2.99718 11.0993 3.20713 11.4577C3.51841 11.9998 3.99385 12.4289 4.56484 12.6833C5.13584 12.9377 5.77289 13.0041 6.38407 12.8729C6.65975 13.1836 6.99862 13.4318 7.37796 13.601C7.75734 13.7701 8.16844 13.8562 8.58379 13.8536C9.20899 13.8552 9.81853 13.6582 10.3244 13.2909C10.8304 12.9236 11.2065 12.4051 11.3986 11.8101C11.8057 11.7268 12.1903 11.5575 12.5266 11.3135C12.8629 11.0695 13.1433 10.7564 13.3488 10.3953C13.6622 9.85477 13.7958 9.22866 13.7304 8.60726C13.6651 7.98587 13.4041 7.40129 12.9851 6.93777ZM8.58472 13.0883C8.0715 13.089 7.57441 12.9093 7.18031 12.5805C7.19808 12.5708 7.22925 12.5537 7.24956 12.5413L9.58061 11.1948C9.63911 11.1615 9.6877 11.1133 9.72136 11.055C9.75505 10.9967 9.77258 10.9305 9.77217 10.8632V7.57684L10.7575 8.14576C10.7626 8.14834 10.7671 8.15214 10.7704 8.15685C10.7738 8.16157 10.7759 8.16704 10.7766 8.17275V10.8943C10.7759 11.4756 10.5448 12.0329 10.1339 12.4441C9.72308 12.8554 9.16599 13.087 8.58472 13.0883ZM3.87091 11.075C3.61385 10.6309 3.5212 10.1105 3.60918 9.60485C3.62649 9.61524 3.65673 9.6337 3.67842 9.64617L6.00947 10.9926C6.06756 11.0266 6.13365 11.0445 6.20094 11.0445C6.2682 11.0445 6.33428 11.0266 6.39238 10.9926L9.23834 9.34936V10.4872C9.23867 10.493 9.23755 10.4988 9.23509 10.5041C9.23264 10.5094 9.22892 10.5139 9.22427 10.5174L6.86782 11.878C6.36379 12.1683 5.76516 12.2467 5.20333 12.0962C4.64148 11.9457 4.1623 11.5784 3.87091 11.075ZM3.25768 5.98617C3.51363 5.54141 3.91789 5.2009 4.39966 5.02421C4.39966 5.04429 4.39851 5.07985 4.39851 5.10452V7.79747C4.3981 7.86473 4.41561 7.93087 4.44924 7.98915C4.48287 8.04739 4.5314 8.09563 4.58984 8.1289L7.4358 9.77197L6.45054 10.3409C6.44568 10.3441 6.44009 10.346 6.43429 10.3465C6.4285 10.3471 6.42265 10.3462 6.41729 10.3439L4.06062 8.98216C3.55747 8.69077 3.19039 8.21176 3.03987 7.65013C2.88935 7.08853 2.96768 6.49014 3.25768 5.98617ZM11.3527 7.86994L8.50669 6.22667L9.49198 5.65799C9.49684 5.6548 9.50243 5.65283 9.50823 5.65231C9.51402 5.65178 9.51985 5.65272 9.5252 5.655L11.8819 7.01554C12.2429 7.2241 12.5371 7.53119 12.7299 7.90087C12.9228 8.27056 13.0063 8.68752 12.9707 9.10295C12.9351 9.51839 12.7819 9.91509 12.5291 10.2466C12.2762 10.5781 11.9341 10.8307 11.5428 10.9749C11.5428 10.9546 11.5428 10.919 11.5428 10.8943V8.20137C11.5434 8.13423 11.5261 8.06814 11.4926 8.0099C11.4592 7.95165 11.4109 7.90336 11.3527 7.86994ZM12.3333 6.394C12.316 6.38337 12.2858 6.36514 12.2641 6.3527L9.93303 5.00621C9.87493 4.97232 9.80887 4.95444 9.74158 4.95444C9.67432 4.95444 9.60824 4.97232 9.55014 5.00621L6.70418 6.64951V5.51167C6.70386 5.50585 6.70497 5.50005 6.70743 5.49479C6.70988 5.48952 6.7136 5.48492 6.71826 5.48144L9.0747 4.12203C9.4357 3.91387 9.84853 3.81281 10.2649 3.83068C10.6812 3.84856 11.0838 3.98462 11.4257 4.22296C11.7675 4.46129 12.0344 4.79204 12.1951 5.17652C12.3559 5.56099 12.4038 5.98327 12.3333 6.394ZM6.16851 8.42203L5.18299 7.85311C5.17784 7.85053 5.17336 7.84673 5.17002 7.84202C5.16668 7.8373 5.16455 7.83183 5.16385 7.82609V5.10452C5.16411 4.6877 5.28311 4.27956 5.5069 3.9279C5.73071 3.57623 6.05006 3.29559 6.42756 3.11883C6.80507 2.94206 7.22509 2.87649 7.63851 2.92977C8.05195 2.98306 8.44163 3.153 8.76197 3.41971C8.74421 3.42941 8.71327 3.44649 8.69272 3.45895L6.36168 4.80542C6.30317 4.83867 6.25462 4.8869 6.22093 4.94516C6.18727 5.0034 6.16974 5.06958 6.17012 5.13683L6.16851 8.42203ZM6.70371 7.26803L7.97126 6.53595L9.23878 7.26757V8.73127L7.97126 9.46292L6.70371 8.73127V7.26803Z"/></svg>'},S="team@northlight.ai";function T(e){const t=JSON.stringify(e.config).replace(/</g,"\\u003c");return`<!doctype html>
+`,e1={arrow:'<path d="M7 7h10v10"/><path d="M7 17 17 7"/>',copy:'<rect width="14" height="14" x="8" y="8" rx="2" ry="2"/><path d="M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2"/>',clock:'<circle cx="12" cy="12" r="10"/><path d="M12 6v6l4 2"/>',warn:'<path d="m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3"/><path d="M12 9v4"/><path d="M12 17h.01"/>',alert:'<circle cx="12" cy="12" r="10"/><path d="M12 8v4"/><path d="M12 16h.01"/>',check:'<path d="M20 6 9 18l-5-5"/>'};function d(e,t=""){return`<svg class="ic${t}" viewBox="0 0 24 24" aria-hidden="true" focusable="false">${e1[e]}</svg>`}o(d,"icon");const t1='<svg viewBox="-77.5 12 931 931" aria-hidden="true" focusable="false"><path fill="currentColor" d="M234 294m0 0h2l-1 5-6 16-5 15-6 25-4 23-2 22-1 5v47l5 38 5 26 6 22 10 24 8 16 9 14 14 19 13 16 11 13 9 11 11 12 7 8 13 16 11 14 14 19 12 19 12 23 7 17 6 23 3 14 3-1 5-15 20-84 6-24 6-21 10-33 10-25 8-16 8-15 8-12 9-12 8-10 9-10 7-8 6-7 20-20h2l2-4 17-17 7-8 10-13 14-21 8-16 8-18 5-15 2-7 2 1 6 36 2 18v41l-4 28-5 19-7 19-10 21-8 13-10 15-13 17-11 13-12 14-9 10-7 8-9 11h-2l-2 4-9 11-14 19-8 12-15 25-11 21-12 26-9 23-5 12-13 38-12 39-5 18-5 17h-2l-9-29-9-27-14-38-13-29-8-16-11-18-10-13-7-9-25-25-3-2v-2l-3-1v-2l-4-2-10-9-8-7-14-12-20-18-13-13-9-11-12-16-12-20-12-25-7-19-6-23-4-24-1-11-1-3v-39l3-23 6-27 7-23 5-11 11-23 9-16 10-14 8-11 9-11 10-11zM430 22m0 0h2v2h2l7 8 10 11 9 11 12 16 9 15 8 16 6 15 5 19 2 11 1 12v18l-1 16-5 24-5 16-7 15-9 17-7 11-10 15-10 13-9 11-13 14-7 8-11 12-7 8-13 16-11 15-13 20-10 18-8 16-7 18-5 15-4 18-2 14-1 27 2 24 3 17 5 23 8 30 12 36 9 28 3 8 4 12v2l-4-2-68-102-13-22-11-23-9-24-7-26-4-23-2-16v-31l3-25 6-27 7-21 7-15 8-16 14-21 11-14 26-30 12-13 8-10h2l2-4 10-11 7-9 14-19 7-10 13-24 7-19 4-15 3-14 3-22 2-24v-20l-2-31zM615 384m0 0 2 1 6 36 2 18v41l-4 28-5 19-7 19-10 21-8 13-10 15-13 17-11 13-12 14-9 10-7 8-9 11h-2l-2 4-9 11-14 19-8 12-15 25-11 21-2 5h-3l-2 2h-13l-6-5-11-6 1-9h-2l2-14-2 3 1-8 9-36 6-21 10-33 10-25 8-16 8-15 8-12 9-12 8-10 9-10 7-8 6-7 20-20h2l2-4 17-17 7-8 10-13 14-21 8-16 8-18 5-15zM557 254m0 0 2 1 4 16 2 16v34l-2 18-5 20-8 24-14 28-10 16-11 16-13 15-12 14-11 13-11 14-14 19-12 20-8 16-7 19-6 20-4 20-4 35-3 41-3 52-4 28-1 3h-2l-8-42-10-52-7-33-7-43v-54l4-24 5-17 8-20 10-19 7-10 10-13 9-11 19-19 8-7 16-15 8-7 9-9 8-7 11-11 1-2h2l2-4 11-13 10-14 11-17 9-19 8-21zM185 615m0 0 4 5 6 10 9 12 2 1 3 5 5-2 1-1h8l5 5 2 3 7 3 6 3 4 5 8 6 5 3v2h2v2h6l4 3 6 1 1 8 10 3 4 2 9 2 5 6 6 1h6l8 8 7 1 9 7h5l1-4-4-6-10-13-7-9-1-3h-2l-7-9v-3l7 6 7 9 11 14 14 19 12 19 12 23 7 17 6 23 3 14 3-1 5-15 10-42 5-22h2l1-4 1 4-1 8h-2l3 4-1 8 11 6 5 4h13l4-3-1 6-8 17-9 23-5 12-13 38-12 39-5 18-5 17h-2l-9-29-9-27-14-38-13-29-8-16-11-18-10-13-7-9-25-25-3-2v-2l-3-1v-2l-4-2-10-9-8-7-14-12-20-18-13-13-9-11-12-16-9-15zM369 553m0 0h1l1 43 2 3 3 4-1 6-1 1v7l1 2 1 15 7 1 5-2 5 1v-2l3-1 4 1 1-2h-3l1-3 6-2 2 11-1 8-3 12h2v2l3-1 2-12h-2l1-4 1-1 3-21 4-21h1v10l-4 30-3 34-4 69-4 28-1 3h-2l-8-42-10-52-7-33-6-37zM430 22m0 0h2v2h2l7 8 10 11 9 11 4 5 1 5 2 4 1 7 2 2-1 3-5-1h-7l-8-2-5 1v7l-1 1h-5l-2-8-1-2-1-15h-2l-2-31zM417 598m0 0h1v10l-4 30-3 34-4 69-4 28-1 3h-2l-7-37-1-16h8l2 1v-2h2l1-2 2-35v-13l-2-3-3-5-1-8 1-9-1-4-5-2v-2l-3-1v-2l3-1 4 1 1-2h-3l1-3 6-2 2 11-1 8-3 12h2v2l3-1 2-12h-2l1-4 1-1 3-21zM417 598m0 0h1v10l-4 30-3 34-1 17h-2v15l-1 12h-1v-18l1-17v-13l-2-3-3-5-1-8 1-9-1-4-5-2v-2l-3-1v-2l3-1 4 1 1-2h-3l1-3 6-2 2 11-1 8-3 12h2v2l3-1 2-12h-2l1-4 1-1 3-21zM310 619m0 0 4 2 4 6 5 8 7 9 3 5 2-1 2 1 2 10 6-1 2 1v2h-5l3 7 9 13 6 9 3 1v-2l-4-14h3l5 16 3 8 4 12v2l-4-2-60-90zM255 597m0 0 5 3 12 16 9 11 11 13 9 11 11 12 4 5-1 3-7-7-4-1-7-4v-2l-4-2-4-4 4 1 3-1v-3l-5-2-3-5v-2h-2l-6-8v-2l-3-1-1-2-8-1 1-2-2-8-3-4v-2h-2l-4-6-3-4zM425 181m0 0 7 1 1 3 12 2 2 3 3 1v-2h3l1 3-6 2-1 3h-2v2h-2l-1 7-5 1-2-5 2-3h3l1-5-3 1-3 3-1-4-5-2v-5h-6l-3-3zM369 553m0 0h1l1 43 2 3 3 4-1 6-1 1v7l1 2 1 15 2 1h-2l3 13 2 10v5l-3-4-5-25-4-26zM340 614m0 0 1 2h2l6 20 6 18 3 15-2-1-5-15-2-4v-5h-6l-3-2-9-2 2-3v2l5-4h4 2l-1-5-3-12zM296 649m0 0 5 2 11 12 4 5-1 3-7-7-4-1-7-4v-2l-4-2-4-4 4 1 3-1zM403 625m0 0h2l2 11-1 8-2 7-2 1v-9l-1-4-5-2v-2l-3-1v-2l3-1 4 1 1-2h-3l1-3zM417 598m0 0h1v10l-4 30-2 24h-1l-1-17h-2l1-4 1-1 3-21zM163 561m0 0 2 3 5 16 2 6 2 1 3 9 2 4 4-1 1-2 1 3h-2l-2 5 3 6-1 2-3-3-11-24-4-11-2-10zM439 685m0 0 1 2h9l3 4v6l7 2 3 7-4-1-6-4-5-4v-7h-9l-2-2zM369 553m0 0h1l1 43 2 3 3 4-1 6-1 1-1 7-2-2v-7h-2zM434 687m0 0h1v6l-3 9-7 29-4 5 1-8 9-36zM317 672m0 0 6 4 9 11 11 14 6 8v2l-4-2-10-13-7-9-1-3h-2l-7-9zM276 622m0 0 5 5 11 13 7 8-1 2-7-4-3-5v-2h-2l-6-8v-2l-3-1-2-4zM310 619m0 0 4 2 4 6 5 8 7 9-1 4-4-5-8-11-7-11zM416 172m0 0 2 1-1 7h-2v5l4-1-1 3-5 2-3-1v-7l4-8zM381 664m0 0 2 4 6 27v5l-1-2h-2l-5-24zM443 655m0 0 1 4-7 25-1 2h-2l1-7 6-22h2zM163 561m0 0 2 3 5 16 2 6 2 1v5l-2 1-7-18-2-10zM490 702m0 0 1 3-10 15-3 5-4 3v-5l5-5 7-11zM387 698m0 0 1 2h2l3 16v14h-1l-5-26zM426 139m0 0 1 3-1 5-7 22-2-1 2-9 5-18h2zM466 739m0 0h2l-1 6-8 15-3 1 2-7 7-12zM411 636m0 0h2v12l-1 14h-1l-1-17h-2l1-4zM349 645m0 0h3l3 9 3 15-2-1-5-15-2-4zM335 694m0 0 5 3 9 12v2l-4-2-10-13zM386 633m0 0 7 1-3 2-4 1-2 4h-4l-2-6h5zM547 287m0 0 3 2-3 7-1 5h-2l-1 4-2-1 1-5zM557 254m0 0 2 1 3 13-4-1 1-2h-2l-1 3-1-3zM560 311m0 0 3 1-2 5-3 6-9-3v-1l9-1zM409 664m0 0h1v25h-1l-2-24zM340 614m0 0 1 2h2l4 16-4-2-3-12zM438 705m0 0 10 2 1 7-3-1-4-4h-5zM502 685m0 0 1 3-8 11-3 1 2-5zM422 191m0 0 4 1 3 4-2 4-5-3zM359 675m0 0h3l4 13-1 4-4-9zM225 599m0 0 5 2 12 6-3 1-9-4-6-3zM255 597m0 0 5 3 6 8-1 2-3-1-4-6-3-4zM414 180m0 0h1v5l4-1-1 3-5 2-3-1 1-5zM341 665m0 0 3 1 6 9-1 4-8-12zM370 608m0 0h1l1 9 3 1-2 10h-1l-2-12zM439 671m0 0 1 2-4 13h-2l1-7 3-7zM341 658m0 0 6 1v2h-5l-1 5-3-3 1-4zM373 625m0 0h2l1 9 2 1h-2l-1 5h-1l-1-6zM185 615m0 0 4 5 5 8-1 3-4-5-4-7zM434 687m0 0h1v6l-3 9-2 3 1-13zM385 686m0 0h2l2 9v5l-1-2h-2l-1-5zM390 711m0 0h2l1 8v11h-1l-2-10zM355 657m0 0 2 3 4 12v3l-3-1-2-10zM413 624m0 0h1v14l-1-2h-2l1-11zM494 120m0 0h2l2 6v10l-2-3-2-9zM163 561m0 0 2 3 4 13-1 3v-2h-2l-3-13zM489 106m0 0h2l4 10-2 4-4-11zM230 609m0 0 5 1 4 5 3 2-6-1-3-3v-2l-3-1zM392 660m0 0h2v2h2l5 5 2 1-1 4-10-10zM254 615m0 0 8 1 1 1v5l-2-1v-2l-6-2zM190 587m0 0 6 1 2-1 4 2 1 3-13-2zM417 598m0 0h1v10l-1 5-2-1 1-9zM273 545m0 0 2 3 3 8v3h-2l-3-8z"/></svg>',n1={claude:'<svg viewBox="0 0 48 48" aria-hidden="true" focusable="false"><rect width="48" height="48" fill="#F3E9D7"/><path transform="translate(24 24) scale(.13) translate(-124 -124)" fill="#D97757" d="M52.4285 162.873L98.7844 136.879L99.5485 134.602L98.7844 133.334H96.4921L88.7237 132.862L62.2346 132.153L39.3113 131.207L17.0249 130.026L11.4214 128.844L6.2 121.873L6.7094 118.447L11.4214 115.257L18.171 115.847L33.0711 116.911L55.485 118.447L71.6586 119.392L95.728 121.873H99.5485L100.058 120.337L98.7844 119.392L97.7656 118.447L74.5877 102.732L49.4995 86.1905L36.3823 76.62L29.3779 71.7757L25.8121 67.2858L24.2839 57.3608L30.6515 50.2716L39.3113 50.8623L41.4763 51.4531L50.2636 58.1879L68.9842 72.7209L93.4357 90.6804L97.0015 93.6343L98.4374 92.6652L98.6571 91.9801L97.0015 89.2625L83.757 65.2772L69.621 40.8192L63.2534 30.6579L61.5978 24.632C60.9565 22.1032 60.579 20.0111 60.579 17.4246L67.8381 7.49965L71.9133 6.19995L81.7193 7.49965L85.7946 11.0443L91.9074 24.9865L101.714 46.8451L116.996 76.62L121.453 85.4816L123.873 93.6343L124.764 96.1155H126.292V94.6976L127.566 77.9197L129.858 57.3608L132.15 30.8942L132.915 23.4505L136.608 14.4708L143.994 9.62643L149.725 12.344L154.437 19.0788L153.8 23.4505L150.998 41.6463L145.522 70.1215L141.957 89.2625H143.994L146.414 86.7813L156.093 74.0206L172.266 53.698L179.398 45.6635L187.803 36.802L193.152 32.5484H203.34L210.726 43.6549L207.415 55.1159L196.972 68.3492L188.312 79.5739L175.896 96.2095L168.191 109.585L168.882 110.689L170.738 110.53L198.755 104.504L213.91 101.787L231.994 98.7149L240.144 102.496L241.036 106.395L237.852 114.311L218.495 119.037L195.826 123.645L162.07 131.592L161.696 131.893L162.137 132.547L177.36 133.925L183.855 134.279H199.774L229.447 136.524L237.215 141.605L241.8 147.867L241.036 152.711L229.065 158.737L213.019 154.956L175.45 145.977L162.587 142.787H160.805V143.85L171.502 154.366L191.242 172.089L215.82 195.011L217.094 200.682L213.91 205.172L210.599 204.699L188.949 188.394L180.544 181.069L161.696 165.118H160.422V166.772L164.752 173.152L187.803 207.771L188.949 218.405L187.294 221.832L181.308 223.959L174.813 222.777L161.187 203.754L147.305 182.486L136.098 163.345L134.745 164.2L128.075 235.42L125.019 239.082L117.887 241.8L111.902 237.31L108.718 229.984L111.902 215.452L115.722 196.547L118.779 181.541L121.58 162.873L123.291 156.636L123.14 156.219L121.773 156.449L107.699 175.752L86.304 204.699L69.3663 222.777L65.291 224.431L58.2867 220.768L58.9235 214.27L62.8713 208.48L86.304 178.705L100.44 160.155L109.551 149.507L109.462 147.967L108.959 147.924L46.6977 188.512L35.6182 189.93L30.7788 185.44L31.4156 178.115L33.7079 175.752L52.4285 162.873Z"/></svg>',chatgpt:'<svg viewBox="0 0 48 48" aria-hidden="true" focusable="false"><rect width="48" height="48" fill="#0D0D0D"/><path transform="translate(24 24) scale(2.35) translate(-7.98 -8)" fill="#FFF" d="M12.9851 6.93777C13.1163 6.54364 13.1618 6.12607 13.1186 5.71295C13.0754 5.29983 12.9444 4.90072 12.7344 4.54231C12.4232 4.00021 11.9478 3.57101 11.3768 3.31664C10.8058 3.06227 10.1687 2.99589 9.55751 3.12706C9.28184 2.81639 8.943 2.56818 8.56362 2.39905C8.18425 2.22993 7.77314 2.14379 7.3578 2.1464C6.73292 2.1449 6.1237 2.34187 5.61797 2.70892C5.11225 3.07598 4.73616 3.59415 4.54391 4.18873C4.13684 4.27206 3.75225 4.44139 3.41591 4.68539C3.07957 4.92938 2.79924 5.24241 2.59368 5.60352C2.27994 6.14413 2.14602 6.77039 2.21123 7.39205C2.27644 8.01367 2.5374 8.59851 2.95649 9.06224C2.82527 9.45637 2.77975 9.87394 2.82297 10.2871C2.8662 10.7002 2.99718 11.0993 3.20713 11.4577C3.51841 11.9998 3.99385 12.4289 4.56484 12.6833C5.13584 12.9377 5.77289 13.0041 6.38407 12.8729C6.65975 13.1836 6.99862 13.4318 7.37796 13.601C7.75734 13.7701 8.16844 13.8562 8.58379 13.8536C9.20899 13.8552 9.81853 13.6582 10.3244 13.2909C10.8304 12.9236 11.2065 12.4051 11.3986 11.8101C11.8057 11.7268 12.1903 11.5575 12.5266 11.3135C12.8629 11.0695 13.1433 10.7564 13.3488 10.3953C13.6622 9.85477 13.7958 9.22866 13.7304 8.60726C13.6651 7.98587 13.4041 7.40129 12.9851 6.93777ZM8.58472 13.0883C8.0715 13.089 7.57441 12.9093 7.18031 12.5805C7.19808 12.5708 7.22925 12.5537 7.24956 12.5413L9.58061 11.1948C9.63911 11.1615 9.6877 11.1133 9.72136 11.055C9.75505 10.9967 9.77258 10.9305 9.77217 10.8632V7.57684L10.7575 8.14576C10.7626 8.14834 10.7671 8.15214 10.7704 8.15685C10.7738 8.16157 10.7759 8.16704 10.7766 8.17275V10.8943C10.7759 11.4756 10.5448 12.0329 10.1339 12.4441C9.72308 12.8554 9.16599 13.087 8.58472 13.0883ZM3.87091 11.075C3.61385 10.6309 3.5212 10.1105 3.60918 9.60485C3.62649 9.61524 3.65673 9.6337 3.67842 9.64617L6.00947 10.9926C6.06756 11.0266 6.13365 11.0445 6.20094 11.0445C6.2682 11.0445 6.33428 11.0266 6.39238 10.9926L9.23834 9.34936V10.4872C9.23867 10.493 9.23755 10.4988 9.23509 10.5041C9.23264 10.5094 9.22892 10.5139 9.22427 10.5174L6.86782 11.878C6.36379 12.1683 5.76516 12.2467 5.20333 12.0962C4.64148 11.9457 4.1623 11.5784 3.87091 11.075ZM3.25768 5.98617C3.51363 5.54141 3.91789 5.2009 4.39966 5.02421C4.39966 5.04429 4.39851 5.07985 4.39851 5.10452V7.79747C4.3981 7.86473 4.41561 7.93087 4.44924 7.98915C4.48287 8.04739 4.5314 8.09563 4.58984 8.1289L7.4358 9.77197L6.45054 10.3409C6.44568 10.3441 6.44009 10.346 6.43429 10.3465C6.4285 10.3471 6.42265 10.3462 6.41729 10.3439L4.06062 8.98216C3.55747 8.69077 3.19039 8.21176 3.03987 7.65013C2.88935 7.08853 2.96768 6.49014 3.25768 5.98617ZM11.3527 7.86994L8.50669 6.22667L9.49198 5.65799C9.49684 5.6548 9.50243 5.65283 9.50823 5.65231C9.51402 5.65178 9.51985 5.65272 9.5252 5.655L11.8819 7.01554C12.2429 7.2241 12.5371 7.53119 12.7299 7.90087C12.9228 8.27056 13.0063 8.68752 12.9707 9.10295C12.9351 9.51839 12.7819 9.91509 12.5291 10.2466C12.2762 10.5781 11.9341 10.8307 11.5428 10.9749C11.5428 10.9546 11.5428 10.919 11.5428 10.8943V8.20137C11.5434 8.13423 11.5261 8.06814 11.4926 8.0099C11.4592 7.95165 11.4109 7.90336 11.3527 7.86994ZM12.3333 6.394C12.316 6.38337 12.2858 6.36514 12.2641 6.3527L9.93303 5.00621C9.87493 4.97232 9.80887 4.95444 9.74158 4.95444C9.67432 4.95444 9.60824 4.97232 9.55014 5.00621L6.70418 6.64951V5.51167C6.70386 5.50585 6.70497 5.50005 6.70743 5.49479C6.70988 5.48952 6.7136 5.48492 6.71826 5.48144L9.0747 4.12203C9.4357 3.91387 9.84853 3.81281 10.2649 3.83068C10.6812 3.84856 11.0838 3.98462 11.4257 4.22296C11.7675 4.46129 12.0344 4.79204 12.1951 5.17652C12.3559 5.56099 12.4038 5.98327 12.3333 6.394ZM6.16851 8.42203L5.18299 7.85311C5.17784 7.85053 5.17336 7.84673 5.17002 7.84202C5.16668 7.8373 5.16455 7.83183 5.16385 7.82609V5.10452C5.16411 4.6877 5.28311 4.27956 5.5069 3.9279C5.73071 3.57623 6.05006 3.29559 6.42756 3.11883C6.80507 2.94206 7.22509 2.87649 7.63851 2.92977C8.05195 2.98306 8.44163 3.153 8.76197 3.41971C8.74421 3.42941 8.71327 3.44649 8.69272 3.45895L6.36168 4.80542C6.30317 4.83867 6.25462 4.8869 6.22093 4.94516C6.18727 5.0034 6.16974 5.06958 6.17012 5.13683L6.16851 8.42203ZM6.70371 7.26803L7.97126 6.53595L9.23878 7.26757V8.73127L7.97126 9.46292L6.70371 8.73127V7.26803Z"/></svg>'},A="team@northlight.ai";function E(e){const t=JSON.stringify(e.config).replace(/</g,"\\u003c");return`<!doctype html>
 <html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
 <meta name="color-scheme" content="light dark">
-<title>${v(e.title)}</title><style nonce="${e.nonce}">${W}</style></head>
+<title>${v(e.title)}</title><style nonce="${e.nonce}">${K}</style></head>
 <body>
-<header class="top">${K}<span>Northlight</span></header>
+<header class="top">${t1}<span>Northlight</span></header>
 <main><div class="col">${e.body}</div></main>
-<footer class="foot"><span>Need help? Email <a href="mailto:${S}">${S}</a></span></footer>
+<footer class="foot"><span>Need help? Email <a href="mailto:${A}">${A}</a></span></footer>
 <script type="application/json" id="cfg">${t}<\/script>
-<script nonce="${e.nonce}">${X}<\/script>
-</body></html>`}o(T,"page");function A(e,t){return`<div class="head"><div class="logo">${Q[e]}</div><h1>${t}</h1></div>`}o(A,"header");function h(e,t,r="",n=""){return`<li${n}><span class="n"><span>${e}</span>${d("check")}</span><div class="body"><span class="title">${t}</span>${r}</div></li>`}o(h,"step");function e1(e,t,r,n){return T({nonce:t,title:"Sign in with Claude Code",body:`<div class="card">
-${A("claude","Sign in with Claude Code")}
+<script nonce="${e.nonce}">${Q}<\/script>
+</body></html>`}o(E,"page");function P(e,t){return`<div class="head"><div class="logo">${n1[e]}</div><h1>${t}</h1></div>`}o(P,"header");function f(e,t,n="",r=""){return`<li${r}><span class="n"><span>${e}</span>${d("check")}</span><div class="body"><span class="title">${t}</span>${n}</div></li>`}o(f,"step");function r1(e,t,n,r){return E({nonce:t,title:"Sign in with Claude Code",body:`<div class="card">
+${P("claude","Sign in with Claude Code")}
 <ol class="steps">
-${h(1,"Sign in at claude.ai",`<div><a class="btn" href="${v(e.url)}" target="_blank" rel="noopener noreferrer">Open claude.ai${d("arrow")}</a></div>`," data-pre")}
-${h(2,"Copy the code it shows",""," data-pre")}
-${h(3,"Paste it here",`<form id="paste" autocomplete="off">
+${f(1,"Sign in at claude.ai",`<div><a class="btn" href="${v(e.url)}" target="_blank" rel="noopener noreferrer">Open claude.ai${d("arrow")}</a></div>`," data-pre")}
+${f(2,"Copy the code it shows",""," data-pre")}
+${f(3,"Paste it here",`<form id="paste" autocomplete="off">
 <div class="field"><label for="code">Code from Claude</label>
 <input type="text" id="code" name="code" required spellcheck="false" autocapitalize="off" aria-describedby="error">
 <div id="error" class="err" role="alert">${d("alert")}<span id="error-text"></span></div></div>
 <button class="btn primary lg wide" type="submit">Continue</button>
 </form>`)}
 </ol>
-</div>`,config:{kind:"anthropic",base:`${f}/${encodeURIComponent(e.flow_id)}`,returnTo:r,handoff:n}})}o(e1,"anthropicPage");function t1(e,t){const r=Date.parse(e.expires_at)-t;return Math.max(0,Math.floor(Math.min(Number.isNaN(r)?$*1e3:r,$*1e3)/1e3))}o(t1,"codeSecondsLeft");function n1(e,t,r,n,a=Date.now()){const i=e.user_code??"";return T({nonce:t,title:"Sign in with Codex",body:`<div class="card">
-${A("chatgpt","Sign in with Codex")}
+</div>`,config:{kind:"anthropic",base:`${h}/${encodeURIComponent(e.flow_id)}`,returnTo:n,handoff:r}})}o(r1,"anthropicPage");function a1(e,t){const n=Date.parse(e.expires_at)-t;return Math.max(0,Math.floor(Math.min(Number.isNaN(n)?S*1e3:n,S*1e3)/1e3))}o(a1,"codeSecondsLeft");function i1(e,t,n,r,a=Date.now()){const i=e.user_code??"";return E({nonce:t,title:"Sign in with Codex",body:`<div class="card">
+${P("chatgpt","Sign in with Codex")}
 <ol class="steps" id="device">
-${h(1,"Turn on device code sign-in in ChatGPT settings",`<div><a class="btn" href="${G}" target="_blank" rel="noopener noreferrer">Open settings${d("arrow")}</a></div>`)}
-${h(2,"Open the OpenAI device page",`<div><a class="btn" id="device-link" href="${v(e.url)}" target="_blank" rel="noopener noreferrer">${v(e.url.replace(/^https:\/\//,""))}${d("arrow")}</a></div>`)}
-${h(3,"Enter this code",`<div class="codebox"><span class="code" id="user-code">${v(i)}</span>
+${f(1,"Turn on device code sign-in in ChatGPT settings",`<div><a class="btn" href="${q}" target="_blank" rel="noopener noreferrer">Open settings${d("arrow")}</a></div>`)}
+${f(2,"Open the OpenAI device page",`<div><a class="btn" id="device-link" href="${v(e.url)}" target="_blank" rel="noopener noreferrer">${v(e.url.replace(/^https:\/\//,""))}${d("arrow")}</a></div>`)}
+${f(3,"Enter this code",`<div class="codebox"><span class="code" id="user-code">${v(i)}</span>
 <span class="badge" id="expired-badge" hidden>Expired</span>
 <button class="btn sm" type="button" id="copy">${d("copy")}<span id="copy-label">Copy</span></button></div>`)}
-${h(4,"Approve the sign-in",`<span class="small">Make sure it's the account you want to use.</span>`)}
+${f(4,"Approve the sign-in",`<span class="small">Make sure it's the account you want to use.</span>`)}
 </ol>
 <div class="wait" id="waiting">
 <svg class="spin" viewBox="0 0 24 24" aria-hidden="true" focusable="false"><path d="M21 12a9 9 0 1 1-9-9"/></svg>
@@ -186,4 +186,4 @@ ${h(4,"Approve the sign-in",`<span class="small">Make sure it's the account you
 <div class="alert" id="expired" role="alert" hidden>${d("warn")}
 <div class="text"><strong>The code expired before it was approved</strong>Codes last 15 minutes. Getting a new one starts the sign-in over.</div>
 <div class="act"><button class="btn primary sm" type="button" id="renew">Get a new code</button></div></div>
-</div>`,config:{kind:"openai",base:`${f}/${encodeURIComponent(e.flow_id)}`,returnTo:r,handoff:n,userCode:i,expiresAt:e.expires_at,remainingSeconds:t1(e,a)}})}o(n1,"openaiPage");async function r1(e,t,r,n){const a=y(r.searchParams,"handoff"),i=await _(n,a);if(z(i.jti))throw p();const l=y(r.searchParams,"return_to");let L;try{L=l===void 0?void 0:new URL(l).origin}catch{L=void 0}if(l===void 0||L!==new URL(n.issuer).origin)throw new s(400,"invalid_request","return_to must be an absolute URL on the directory origin","return_to");const u=y(r.searchParams,"vendor");if(u!=="anthropic"&&u!=="openai")throw new s(400,"invalid_request","vendor must be anthropic or openai","vendor");if(!R(i.jti,i.exp))throw p();let w;try{w=await D({provider:F(u),jti:i.jti})}catch(c){const M=c instanceof x?c.category:"runtime";m({level:"error",event:"vendor_signin.start_failed",error:c,fields:{vendor:u,...c instanceof x?c.logFields():{category:M}}}),t.writeHead(303,{Location:Z(l,"failed",M,c instanceof x?c.step:void 0),"Cache-Control":"no-store","Referrer-Policy":"no-referrer"}),t.end();return}const b=P(16).toString("base64"),j=u==="anthropic"?e1(w,b,l,a):n1(w,b,l,a);t.writeHead(200,{"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","Referrer-Policy":"no-referrer","X-Content-Type-Options":"nosniff","Content-Security-Policy":`default-src 'none'; script-src 'nonce-${b}'; style-src 'nonce-${b}'; connect-src 'self'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'`}),t.end(j)}o(r1,"startPage");function g(e,t,r){const{category:n,step:a,fields:i}=V(t);m({level:"warn",event:"vendor_signin.failed",fields:{flow_id:t,message:r,...i}}),C(e,200,{status:"failed",reason:n,...a===void 0?{}:{step:a}})}o(g,"sendFailed");async function E(e,t,r){let n;try{n=await _(t,J(e))}catch(i){throw m({level:"warn",event:"vendor_signin.handoff_rejected",error:i,fields:{flow_id:r}}),i}const a=k(r);if(!a){if(z(n.jti))return!1;throw m({level:"warn",event:"vendor_signin.unauthorized",fields:{flow_id:r,reason:"unknown flow, handoff never started one"}}),p()}if(a.jti===void 0||a.jti!==n.jti)throw m({level:"warn",event:"vendor_signin.unauthorized",fields:{flow_id:r,reason:"handoff did not start this flow"}}),p();return!0}o(E,"followUpFlow");async function a1(e,t,r,n){if(!await E(e,r,n)){g(t,n,"flow_gone");return}const a=await q(e);try{await H(n,a.input),C(t,200,{status:"connected"})}catch(i){const l=k(n);if(l&&l.status!=="pending"){g(t,n,l.message??l.status);return}throw i}}o(a1,"submitCode");async function i1(e,t,r,n){if(!await E(e,r,n)){g(t,n,"flow_gone");return}const a=new AbortController;t.once("close",()=>a.abort());const i=await B(n,U,a.signal);if(!i){g(t,n,"flow_gone");return}if(i.status==="failed"){g(t,n,i.message??"failed");return}C(t,200,{status:i.status})}o(i1,"waitFlow");async function p1(e,t,r,n){const a=e.method??"GET";if(r.pathname===f&&a==="GET"){await r1(e,t,r,n);return}const i=r.pathname.slice(f.length+1).split("/");let l="";try{l=i[0]?decodeURIComponent(i[0]):""}catch{throw new s(404,"not_found","unknown operation")}if(l&&i.length===1&&a==="POST"){await a1(e,t,n,l);return}if(l&&i.length===2&&i[1]==="wait"&&a==="GET"){await i1(e,t,n,l);return}throw new s(404,"not_found","unknown operation")}o(p1,"handleVendorSignIn");export{f as VENDOR_SIGNIN_PATH,e1 as anthropicPage,v as escapeHtml,p1 as handleVendorSignIn,m1 as isVendorSignInPath,n1 as openaiPage};
+</div>`,config:{kind:"openai",base:`${h}/${encodeURIComponent(e.flow_id)}`,returnTo:n,handoff:r,userCode:i,expiresAt:e.expires_at,remainingSeconds:a1(e,a)}})}o(i1,"openaiPage");async function o1(e,t,n,r){const a=L(n.searchParams,"handoff"),i=await C(r,a);if(await $(i.jti))throw u();const l=L(n.searchParams,"return_to");let w;try{w=l===void 0?void 0:new URL(l).origin}catch{w=void 0}if(l===void 0||w!==new URL(r.issuer).origin)throw new s(400,"invalid_request","return_to must be an absolute URL on the directory origin","return_to");const m=L(n.searchParams,"vendor");if(m!=="anthropic"&&m!=="openai")throw new s(400,"invalid_request","vendor must be anthropic or openai","vendor");if(!await D(i.jti,i.exp))throw u();let x;try{x=await U({provider:G(m),jti:i.jti})}catch(c){const z=c instanceof y?c.category:"runtime";p({level:"error",event:"vendor_signin.start_failed",error:c,fields:{vendor:m,...c instanceof y?c.logFields():{category:z}}}),t.writeHead(303,{Location:X(l,"failed",z,c instanceof y?c.step:void 0),"Cache-Control":"no-store","Referrer-Policy":"no-referrer"}),t.end();return}const b=H(16).toString("base64"),N=m==="anthropic"?r1(x,b,l,a):i1(x,b,l,a);t.writeHead(200,{"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","Referrer-Policy":"no-referrer","X-Content-Type-Options":"nosniff","Content-Security-Policy":`default-src 'none'; script-src 'nonce-${b}'; style-src 'nonce-${b}'; connect-src 'self'; form-action 'none'; base-uri 'none'; frame-ancestors 'none'`}),t.end(N)}o(o1,"startPage");function g(e,t,n){const{category:r,step:a,fields:i}=B(t);p({level:"warn",event:"vendor_signin.failed",fields:{flow_id:t,message:n,...i}}),M(e,200,{status:"failed",reason:r,...a===void 0?{}:{step:a}})}o(g,"sendFailed");async function j(e,t,n){let r;try{r=await C(t,T(e))}catch(i){throw p({level:"warn",event:"vendor_signin.handoff_rejected",error:i,fields:{flow_id:n}}),i}const a=await _(n);if(!a){if(await $(r.jti))return!1;throw p({level:"warn",event:"vendor_signin.unauthorized",fields:{flow_id:n,reason:"unknown flow, handoff never started one"}}),u()}if(a.jti===void 0||a.jti!==r.jti)throw p({level:"warn",event:"vendor_signin.unauthorized",fields:{flow_id:n,reason:"handoff did not start this flow"}}),u();return!0}o(j,"followUpFlow");async function l1(e,t,n,r){if(!await j(e,n,r)){g(t,r,"flow_gone");return}const a=await Y(e);try{await I(r,a.input),M(t,200,{status:"connected"})}catch(i){const l=await _(r);if(l&&l.status!=="pending"){g(t,r,l.message??l.status);return}throw i}}o(l1,"submitCode");async function s1(e,t,n,r){if(!await j(e,n,r)){g(t,r,"flow_gone");return}const a=new AbortController;t.once("close",()=>a.abort());const i=await J(r,W,a.signal);if(!i){g(t,r,"flow_gone");return}if(i.status==="failed"){g(t,r,i.message??"failed");return}M(t,200,{status:i.status})}o(s1,"waitFlow");async function L1(e,t,n,r){if(!k()){await O(e,t,n,r);return}const a=n.pathname===h&&(e.method??"GET")==="GET",{sub:i}=await C(r,a?L(n.searchParams,"handoff"):T(e));await F(i,()=>O(e,t,n,r))}o(L1,"handleVendorSignIn");async function O(e,t,n,r){const a=e.method??"GET";if(n.pathname===h&&a==="GET"){await o1(e,t,n,r);return}const i=n.pathname.slice(h.length+1).split("/");let l="";try{l=i[0]?decodeURIComponent(i[0]):""}catch{throw new s(404,"not_found","unknown operation")}if(l&&i.length===1&&a==="POST"){await l1(e,t,r,l);return}if(l&&i.length===2&&i[1]==="wait"&&a==="GET"){await s1(e,t,r,l);return}throw new s(404,"not_found","unknown operation")}o(O,"serveVendorSignIn");export{h as VENDOR_SIGNIN_PATH,r1 as anthropicPage,v as escapeHtml,L1 as handleVendorSignIn,b1 as isVendorSignInPath,i1 as openaiPage};

package/dist/daemon/api/viewer-presence.d.ts

@@ -1,6 +1,20 @@
-export declare function hasAttachedBrokerViewers(nodeId: string): boolean;
-export declare function hasPresentedViewer(nodeId: string): boolean;
-export declare function attachViewer(nodeId: string, connection: object): void;
-/** Marks an attending connection as shown the conversation. Returns true the first time only. */
-export declare function presentViewer(nodeId: string, connection: object): boolean;
-export declare function detachViewer(nodeId: string, connection: object): void;
+export declare const VIEWER_ROW_TTL_MS = 90000;
+export declare const VIEWER_ROW_REFRESH_MS = 30000;
+/** How long a viewer stays attending after its broker connection ended, for its redial to land. */
+export declare const VIEWER_REDIAL_HOLD_MS = 60000;
+/** This process's id on the rows it writes. */
+export declare const API_PROCESS_ID: `${string}-${string}-${string}-${string}-${string}`;
+/** Whether an unexpired attending row exists for the node. */
+export declare function hasAttachedBrokerViewers(nodeId: string): Promise<boolean>;
+/** Whether an unexpired attending row has been shown the conversation (the relay forwarded the broker's welcome). */
+export declare function hasPresentedViewer(nodeId: string): Promise<boolean>;
+/** The row id of an attached connection, for diagnostics and tests. */
+export declare function viewerConnectionId(connection: object): string | undefined;
+/** Insert the attending row for `connection` and keep it fresh until {@link detachViewer} or {@link holdViewerForRedial}. Repeating it is a no-op. */
+export declare function attachViewer(nodeId: string, connection: object): Promise<void>;
+/** Mark an attending connection as shown the conversation. Returns true the first time only. */
+export declare function presentViewer(_nodeId: string, connection: object): Promise<boolean>;
+/** A clean viewer close: delete the row. */
+export declare function detachViewer(_nodeId: string, connection: object): Promise<void>;
+/** The broker connection ended under an open viewer: stop refreshing and keep the row 60 s for the viewer's redial. */
+export declare function holdViewerForRedial(_nodeId: string, connection: object): Promise<void>;

package/dist/daemon/api/viewer-presence.js

@@ -1 +1,2 @@
-var o=Object.defineProperty;var r=(e,n)=>o(e,"name",{value:n,configurable:!0});const i=new Map,s=new Map;function f(e){return(i.get(e)?.size??0)>0}r(f,"hasAttachedBrokerViewers");function u(e){return(s.get(e)?.size??0)>0}r(u,"hasPresentedViewer");function p(e,n){let t=i.get(e);t||(t=new Set,i.set(e,t)),t.add(n)}r(p,"attachViewer");function w(e,n){if(!i.get(e)?.has(n))return!1;let t=s.get(e);return t||(t=new Set,s.set(e,t)),t.has(n)?!1:(t.add(n),!0)}r(w,"presentViewer");function g(e,n){for(const t of[i,s]){const a=t.get(e);a&&(a.delete(n),a.size===0&&t.delete(e))}}r(g,"detachViewer");export{p as attachViewer,g as detachViewer,f as hasAttachedBrokerViewers,u as hasPresentedViewer,w as presentViewer};
+var E=Object.defineProperty;var r=(e,t)=>E(e,"name",{value:t,configurable:!0});import{randomUUID as p}from"node:crypto";import{openDb as a}from"../../core/canvas/db.js";const _=9e4,u=3e4,f=6e4,I=p(),i=new WeakMap,o=r((e=0)=>new Date(Date.now()+e).toISOString(),"at");async function x(e){return await(await a()).prepare("SELECT 1 AS present FROM viewer_attachments WHERE node_id = ? AND attends = 1 AND expires_at > ? LIMIT 1").get(e,o())!==void 0}r(x,"hasAttachedBrokerViewers");async function T(e){return await(await a()).prepare("SELECT 1 AS present FROM viewer_attachments WHERE node_id = ? AND attends = 1 AND presented_at IS NOT NULL AND expires_at > ? LIMIT 1").get(e,o())!==void 0}r(T,"hasPresentedViewer");function A(e){return i.get(e)?.connectionId}r(A,"viewerConnectionId");async function L(e,t){if(i.has(t))return;const n=p(),s=setInterval(()=>{h(n).catch(()=>{})},u);s.unref();const w=(async()=>{const c=o();await(await a()).prepare(`INSERT INTO viewer_attachments (connection_id, node_id, api_process_id, attends, presented_at, opened_at, expires_at)
+      VALUES (?, ?, ?, 1, NULL, ?, ?)`).run(n,e,I,c,o(_))})();i.set(t,{connectionId:n,refresh:s,inserted:w.then(()=>!0,()=>!1)});try{await w}catch(c){throw i.get(t)?.connectionId===n&&d(t),c}}r(L,"attachViewer");async function h(e){await(await a()).prepare("UPDATE viewer_attachments SET expires_at = ? WHERE connection_id = ?").run(o(_),e)}r(h,"refreshViewer");async function l(e,t){const n=i.get(t);return n===void 0||!await n.inserted?!1:(await(await a()).prepare("UPDATE viewer_attachments SET presented_at = ? WHERE connection_id = ? AND presented_at IS NULL").run(o(),n.connectionId)).changes===1}r(l,"presentViewer");async function m(e,t){const n=d(t);n===void 0||!await n.inserted||await(await a()).prepare("DELETE FROM viewer_attachments WHERE connection_id = ?").run(n.connectionId)}r(m,"detachViewer");async function N(e,t){const n=d(t);n===void 0||!await n.inserted||await(await a()).prepare("UPDATE viewer_attachments SET expires_at = ? WHERE connection_id = ?").run(o(f),n.connectionId)}r(N,"holdViewerForRedial");function d(e){const t=i.get(e);if(t!==void 0)return clearInterval(t.refresh),i.delete(e),t}r(d,"release");export{I as API_PROCESS_ID,f as VIEWER_REDIAL_HOLD_MS,u as VIEWER_ROW_REFRESH_MS,_ as VIEWER_ROW_TTL_MS,L as attachViewer,m as detachViewer,x as hasAttachedBrokerViewers,T as hasPresentedViewer,N as holdViewerForRedial,l as presentViewer,A as viewerConnectionId};

package/dist/daemon/boot-settings.d.ts

@@ -0,0 +1,3 @@
+/** Apply `CRTR_BOOT_USER_FILES`, `CRTR_BOOT_LISTENER_ADDRESS`/`_PORT`, `CRTR_BOOT_STORAGE_URL` and the join file's identity to the user
+ *  settings, and move the legacy local person's profiles to `app:terminal` once a join exists. Writes nothing when the settings already hold them. */
+export declare function applyBootSettings(): Promise<void>;

package/dist/daemon/boot-settings.js

@@ -0,0 +1 @@
+var R=Object.defineProperty;var u=(t,n)=>R(t,"name",{value:n,configurable:!0});import{isDeepStrictEqual as _}from"node:util";import{readConfig as p,updateConfig as T}from"../core/config.js";import{joinedClient as c}from"../core/directory/join.js";import{LEGACY_LOCAL_PERSON as m}from"../core/canvas/legacy-person.js";import{writeSettings as E}from"../core/scoped-state/person-store.js";function f(t){const n=process.env[t];return n===void 0||n===""?void 0:n}u(f,"bootEnv");function O(){const t=f("CRTR_BOOT_LISTENER_ADDRESS"),n=f("CRTR_BOOT_LISTENER_PORT"),e=f("CRTR_BOOT_STORAGE_URL");if(t===void 0&&n===void 0&&e===void 0)return null;const s={};if(t===void 0!=(n===void 0))throw new Error("CRTR_BOOT_LISTENER_ADDRESS and CRTR_BOOT_LISTENER_PORT must be set together");if(t!==void 0&&n!==void 0){const o=Number(n);if(!Number.isInteger(o)||o<1||o>65535)throw new Error(`CRTR_BOOT_LISTENER_PORT is not a port: ${n}`);s.listener={address:t,port:o}}if(e!==void 0){try{new URL(e)}catch{throw new Error(`CRTR_BOOT_STORAGE_URL is not a URL: ${e}`)}s.storage={service_url:e,base_url:e}}return s}u(O,"bootRuntimeSettings");async function B(){const t=f("CRTR_BOOT_USER_FILES"),n=O(),e=c(),s=p("user"),d=u(i=>{let r=i;const a=e!==null&&e.is_default===!1;if(e!==null){const l=i?.issuer===e.issuer&&i?.audience===e.url;r=a&&!l?{issuer:e.issuer,audience:e.url,unsandboxed:!0}:{...r,issuer:e.issuer,audience:e.url}}return n!==null&&!a&&(r={...r,...n}),r},"runtimeNext")(s.runtime);(t!==void 0&&s.paths?.user_files!==t||!_(d,s.runtime))&&await T("user",i=>{t!==void 0&&(i.paths={...i.paths,user_files:t}),d!==void 0&&(i.runtime=d)}),e!==null&&await E(i=>i.profiles.filter(r=>r.manifest.grantee===m).map(r=>({op:"profile.update",profile:{profileId:r.profileId,manifest:{...r.manifest,grantee:"app:terminal"}}})))}u(B,"applyBootSettings");export{B as applyBootSettings};

package/dist/daemon/broker-signals/bus.d.ts

@@ -1,35 +1,72 @@
 import type { BrokerExtensionNodeDTO } from '../../api/dto/broker-ops.js';
 /** Node-owned mutable fields in extensionNode's projection. Keep this list and
  * the typed cache view together; object/worktree-owned fields are never cached. */
-export declare const BROKER_SIGNAL_NODE_COLUMNS: readonly ["description", "title", "icon", "mode", "lifecycle", "status", "cwd", "parent", "fork_from", "profile_id", "review_binding_json", "persona_ack_json", "intent"];
+export declare const BROKER_SIGNAL_NODE_COLUMNS: readonly ["description", "title", "icon", "mode", "lifecycle", "status", "cwd", "parent", "fork_from", "profile_id", "review_binding_json", "persona_ack_json", "intent", "situational_card"];
 type ProjectedNodeKey<C extends string> = C extends 'review_binding_json' ? 'review_binding' : C extends 'persona_ack_json' ? 'persona_ack' : C;
-export type BrokerSignalCachedNode = Pick<BrokerExtensionNodeDTO, Extract<ProjectedNodeKey<(typeof BROKER_SIGNAL_NODE_COLUMNS)[number]>, keyof BrokerExtensionNodeDTO>>;
+export type BrokerSignalCachedNode = Pick<BrokerExtensionNodeDTO, Extract<ProjectedNodeKey<Exclude<(typeof BROKER_SIGNAL_NODE_COLUMNS)[number], 'situational_card'>>, keyof BrokerExtensionNodeDTO>>;
 /** Only node-owned columns are suitable for P4's cache. The same columns
- * appear in `crtr_sig_node_upd` in schema-pg.sql; keep the two lists together. */
+ * appear in `crtr_sig_node_upd` (002-fleet.sql recreates it with `situational_card`); keep the two lists together. */
 export declare function cachedBrokerNodeFields(node: BrokerExtensionNodeDTO): BrokerSignalCachedNode;
-export type BrokerSignalKind = 'mail' | 'node';
-export type BrokerSignalSubscriber = (nodeId: string, kind: BrokerSignalKind) => void;
-/** Hints, not delivery state: a rolled-back write may mark a node. The consumer
- * always re-reads durable state. Pending marks are bounded by distinct node ids. */
+/** What a `crtr_signal` notification names. `mail` and `node` carry a node id; the others name the row that changed
+ *  (D39): a grant id, run or node id, structured request, queue, limit, or environment object. `fault_retry` carries a node id: the
+ *  fault-retry backstop publishes it in the commit that claims the nudge, and the API process holding that node's stream turns it
+ *  into a `fault-retry` line. The writers fire them (the
+ *  schema's triggers, or the unit that owns the writer); the bus only delivers. */
+export declare const BROKER_SIGNAL_KINDS: readonly ["mail", "node", "grant", "run_event", "report", "structured_request", "queue", "spend_limits", "environment_image", "fault_retry", "settings"];
+export type BrokerSignalKind = (typeof BROKER_SIGNAL_KINDS)[number];
+export type BrokerSignalSubscriber = (id: string, kind: BrokerSignalKind) => void;
+export interface BrokerSignalSubscription {
+    /** The kinds this subscriber hears. Default `mail` and `node`, the two a node's broker stream reads. */
+    kinds?: readonly BrokerSignalKind[];
+    /** Called each time the listen connection starts or restarts (LISTEN is active). Notifications sent while it was down
+     *  are lost, so a subscriber re-reads its durable state here; that is its catch-up. A subscriber added while the bus
+     *  is already listening is called once, soon after subscribing. */
+    onListenStart?: () => void;
+}
+export interface BrokerSignalBusOptions {
+    /** How often the listen connection is checked with `SELECT 1`. Default 30 s. */
+    checkIntervalMs?: number;
+    /** How long a check may take before the connection counts as lost. Default 10 s. */
+    checkTimeoutMs?: number;
+    /** Delay before a lost listen connection reconnects. Default 1 s. */
+    reconnectMs?: number;
+}
+/** Hints, not delivery state: a rolled-back write may mark an id. The consumer always re-reads durable state. Pending
+ * marks are bounded by distinct (kind, id) pairs and delivered once per flush. */
 export declare class BrokerSignalBus {
     private readonly dirty;
     private readonly subscribers;
     private scheduled;
-    subscribe(listener: BrokerSignalSubscriber): Promise<() => void>;
+    private readonly checkIntervalMs;
+    private readonly checkTimeoutMs;
+    private readonly reconnectMs;
+    constructor(options?: BrokerSignalBusOptions);
+    subscribe(listener: BrokerSignalSubscriber, subscription?: BrokerSignalSubscription): Promise<() => void>;
     markMail(nodeId: string): void;
     markNode(nodeId: string): void;
+    /** Hint any kind, as a notification of that kind would. */
+    markSignal(kind: BrokerSignalKind, id: string): void;
     private mark;
     private flush;
+    private callListenStart;
     /** Start listening on `crtr_signal` over a second, listen-only connection to `url` (the schema's `pg_notify`
-     * triggers publish `mail:<node id>` and `node:<node id>` at commit). Resolves once LISTEN is active, so a write
-     * committed after it returns is heard. A lost connection reconnects with backoff; signals sent while it was down
-     * are lost, which is safe because they are hints and every consumer re-reads durable state. */
+     * triggers publish `<kind>:<id>` at commit). Resolves once LISTEN is active, so a write committed after it returns is
+     * heard. A lost connection (an error, an end, or a failed `SELECT 1` check) reconnects with a fixed delay and calls every
+     * subscriber's `onListenStart` once LISTEN is active again. Signals sent while it was down are lost, which is safe because
+     * they are hints and every consumer re-reads durable state, at `onListenStart` and otherwise. */
     listen(url: string): Promise<void>;
     private listener;
     private listening;
     private url;
     private reconnect;
+    private check;
     private connectListener;
+    /** `SELECT 1` on the listen connection every interval. A dead TCP connection (a dropped route, a failover) raises no
+     *  error by itself, so a failed or unanswered check is what tells the bus the connection is lost. */
+    private startChecks;
+    private stopChecks;
+    private dropListener;
+    private scheduleReconnect;
     /** Stop listening and drop pending marks. The returned promise resolves once the connection has closed. */
     close(): Promise<void>;
 }

package/dist/daemon/broker-signals/bus.js

@@ -1 +1 @@
-var a=Object.defineProperty;var s=(n,e)=>a(n,"name",{value:e,configurable:!0});import h from"pg";const u=["description","title","icon","mode","lifecycle","status","cwd","parent","fork_from","profile_id","review_binding_json","persona_ack_json","intent"],f=s(n=>n==="review_binding_json"?"review_binding":n==="persona_ack_json"?"persona_ack":n,"nodeField");function _(n){const e={};for(const i of u){const t=f(i);e[t]=n[t]}return e}s(_,"cachedBrokerNodeFields");class m{static{s(this,"BrokerSignalBus")}dirty=new Map;subscribers=new Set;scheduled;async subscribe(e){return this.subscribers.add(e),()=>{this.subscribers.delete(e)}}markMail(e){this.mark(e,1)}markNode(e){this.mark(e,2)}mark(e,i){this.dirty.set(e,(this.dirty.get(e)??0)|i),this.scheduled??=setImmediate(()=>this.flush())}flush(){this.scheduled=void 0;const e=[...this.dirty];this.dirty.clear();for(const[i,t]of e)for(const r of this.subscribers)try{t&1&&r(i,"mail"),t&2&&r(i,"node")}catch{}}async listen(e){this.listener!==void 0||this.listening!==void 0||(this.url=e,this.listening=this.connectListener().finally(()=>{this.listening=void 0}),await this.listening)}listener;listening;url;reconnect;async connectListener(){const e=new h.Client({connectionString:this.url,application_name:`crtr-signal-${process.pid}`});e.on("notification",r=>{const c=r.payload??"",o=c.indexOf(":");if(o<0)return;const d=c.slice(0,o),l=c.slice(o+1);d==="mail"?this.markMail(l):d==="node"&&this.markNode(l)});const i=s(()=>{this.listener===e&&(this.listener=void 0,e.removeAllListeners(),e.on("error",()=>{}),e.end().catch(()=>{}),this.url!==void 0&&(this.reconnect=setTimeout(()=>{this.reconnect=void 0,this.connectListener().catch(()=>t())},1e3)))},"lost"),t=s(()=>{this.url===void 0||this.reconnect!==void 0||(this.reconnect=setTimeout(()=>{this.reconnect=void 0,this.connectListener().catch(()=>t())},1e3))},"lostRetry");e.on("error",i),e.on("end",i),await e.connect(),await e.query("LISTEN crtr_signal"),this.listener=e}close(){this.url=void 0,this.reconnect!==void 0&&clearTimeout(this.reconnect),this.reconnect=void 0;const e=this.listener;return this.listener=void 0,this.scheduled!==void 0&&clearImmediate(this.scheduled),this.scheduled=void 0,this.dirty.clear(),this.subscribers.clear(),e===void 0?Promise.resolve():(e.removeAllListeners("notification"),e.end().catch(()=>{}))}}const g=new m;export{u as BROKER_SIGNAL_NODE_COLUMNS,m as BrokerSignalBus,g as brokerSignalBus,_ as cachedBrokerNodeFields};
+var h=Object.defineProperty;var r=(i,e)=>h(i,"name",{value:e,configurable:!0});import d from"pg";const l=["description","title","icon","mode","lifecycle","status","cwd","parent","fork_from","profile_id","review_binding_json","persona_ack_json","intent","situational_card"],a=r(i=>i==="review_binding_json"?"review_binding":i==="persona_ack_json"?"persona_ack":i,"nodeField");function p(i){const e={};for(const n of l){if(n==="situational_card")continue;const t=a(n);e[t]=i[t]}return e}r(p,"cachedBrokerNodeFields");const u=["mail","node","grant","run_event","report","structured_request","queue","spend_limits","environment_image","fault_retry","settings"],f=new Set(u);class k{static{r(this,"BrokerSignalBus")}dirty=new Map;subscribers=new Set;scheduled;checkIntervalMs;checkTimeoutMs;reconnectMs;constructor(e={}){this.checkIntervalMs=e.checkIntervalMs??3e4,this.checkTimeoutMs=e.checkTimeoutMs??1e4,this.reconnectMs=e.reconnectMs??1e3}async subscribe(e,n={}){const t={listener:e,kinds:new Set(n.kinds??["mail","node"]),onListenStart:n.onListenStart};return this.subscribers.add(t),this.listener!==void 0&&t.onListenStart!==void 0&&queueMicrotask(()=>{this.subscribers.has(t)&&this.callListenStart(t)}),()=>{this.subscribers.delete(t)}}markMail(e){this.mark("mail",e)}markNode(e){this.mark("node",e)}markSignal(e,n){this.mark(e,n)}mark(e,n){const t=`${e}:${n}`;this.dirty.has(t)||this.dirty.set(t,{id:n,kind:e}),this.scheduled??=setImmediate(()=>this.flush())}flush(){this.scheduled=void 0;const e=[...this.dirty.values()];this.dirty.clear();for(const{id:n,kind:t}of e)for(const s of this.subscribers)if(s.kinds.has(t))try{s.listener(n,t)}catch{}}callListenStart(e){try{e.onListenStart?.()}catch{}}async listen(e){this.listener!==void 0||this.listening!==void 0||(this.url=e,this.listening=this.connectListener().finally(()=>{this.listening=void 0}),await this.listening)}listener;listening;url;reconnect;check;async connectListener(){const e=new d.Client({connectionString:this.url,application_name:`crtr-signal-${process.pid}`,keepAlive:!0});e.on("notification",t=>{const s=t.payload??"",c=s.indexOf(":");if(c<0)return;const o=s.slice(0,c);f.has(o)&&this.mark(o,s.slice(c+1))});const n=r(()=>{this.listener===e&&(this.dropListener(e),this.scheduleReconnect())},"lost");e.on("error",n),e.on("end",n);try{await e.connect(),await e.query("LISTEN crtr_signal")}catch(t){throw e.removeAllListeners(),e.on("error",()=>{}),e.end().catch(()=>{}),t}if(this.url===void 0){e.removeAllListeners(),e.on("error",()=>{}),e.end().catch(()=>{});return}this.listener=e,this.startChecks(e,n);for(const t of[...this.subscribers])this.callListenStart(t)}startChecks(e,n){this.stopChecks(),this.check=setInterval(()=>{if(this.listener!==e)return;let t;const s=new Promise((c,o)=>{t=setTimeout(()=>o(new Error("listen connection check timed out")),this.checkTimeoutMs)});Promise.race([e.query("SELECT 1"),s]).catch(()=>n()).finally(()=>clearTimeout(t))},this.checkIntervalMs),this.check.unref()}stopChecks(){this.check!==void 0&&clearInterval(this.check),this.check=void 0}dropListener(e){this.listener=void 0,this.stopChecks(),e.removeAllListeners(),e.on("error",()=>{}),e.end().catch(()=>{})}scheduleReconnect(){this.url===void 0||this.reconnect!==void 0||(this.reconnect=setTimeout(()=>{this.reconnect=void 0,this.url!==void 0&&(this.listening=this.connectListener().catch(()=>this.scheduleReconnect()).finally(()=>{this.listening=void 0}))},this.reconnectMs))}close(){this.url=void 0,this.reconnect!==void 0&&clearTimeout(this.reconnect),this.reconnect=void 0,this.stopChecks();const e=this.listener;return this.listener=void 0,this.scheduled!==void 0&&clearImmediate(this.scheduled),this.scheduled=void 0,this.dirty.clear(),this.subscribers.clear(),e===void 0?Promise.resolve():(e.removeAllListeners("notification"),e.removeAllListeners("error"),e.on("error",()=>{}),e.end().catch(()=>{}))}}const b=new k;export{u as BROKER_SIGNAL_KINDS,l as BROKER_SIGNAL_NODE_COLUMNS,k as BrokerSignalBus,b as brokerSignalBus,p as cachedBrokerNodeFields};

package/dist/daemon/cron/armed-context.js

@@ -1 +1 @@
-var p=Object.defineProperty;var o=(r,e)=>p(r,"name",{value:e,configurable:!0});import{envHomeOverride as m}from"../../shared/env.js";import{loadProfileManifest as h,lookupProfile as v}from"../../core/profiles/manifest.js";import{readProfileEnvVars as g}from"../../core/profiles/env-store.js";import{readAppEnvVars as R}from"../../core/profiles/app-env-store.js";import{ADMITTED_HOST_PATH_ENV as f,buildOperationalEnvBase as w}from"../../core/runtime/spawn-env.js";import{getNode as c}from"../../core/canvas/canvas.js";import{contextDir as y}from"../../core/canvas/paths.js";import{appendRunEvent as O}from"../../core/runs/events.js";import{payerOfGrant as b}from"../../core/grants/mirror.js";import{scopeAllowed as E}from"../../core/scopes.js";import{cronPrincipalOf as C}from"./authority.js";import{personId as x}from"../../core/canvas/person.js";function _(r){if(r.profile==null)return null;let e;try{e=v(r.profile)}catch{return null}if(e.kind==="resolved")return e.entry.profileId;if(e.kind==="absent")return null;throw new l(`the armed profile "${r.profile}" is still on this host but its manifest could not be read (${e.manifestPath}) \u2014 running as root would silently give this cron a different identity, env store, and purview. Repair the manifest, or re-arm the cron under a profile that resolves.`)}o(_,"resolveLiveProfile");function B(r){return{...C(r),cron_id:r.cron_id,origin_run_id:r.origin_run_id,isolated:r.isolated,creator:r.created_by}}o(B,"cronBirthPrincipalOf");async function V(r,e){const n=r.creator===null?null:await c(r.creator);return n!==null&&r.origin_run_id!==null&&n.run_id===r.origin_run_id&&(await c(r.origin_run_id))?.deleting_at==null&&n.grantee===r.grantee&&(n.sub??x())===r.sub&&(n.grant_id??null)===r.grant_id&&(r.scopes===null?n.scopes==null:r.scopes.every(t=>E(n.scopes,t)))?{parent:n.node_id,...r.scopes===null?{}:{scopes:[...r.scopes]}}:{root:!0,rootLifecycle:"terminal",...r.scopes===null?{}:{scopes:[...r.scopes]},run:{grantee:r.grantee,sub:r.sub,grant_id:r.grant_id,client_id:null,metadata_json:JSON.stringify(r.cron_id===null?{exec:!0}:{cron_id:r.cron_id}),run_id:e,event_cursor:1,usage_json:JSON.stringify({input_tokens:0,output_tokens:0,cache_read_tokens:0,cache_write_tokens:0,cost_usd:0})},withinCreate:o(async(t,a)=>{await O(t,e,e,"run.started",{scopes:a.scopes??null,payer:await b(r.grant_id),usage:JSON.parse(a.usage_json)})},"withinCreate")}}o(V,"cronBirthPlacement");function F(r){try{return _(r)}catch{return null}}o(F,"resolveLiveProfileOrRoot");function G(r){if(r.profile!=null)try{return h(r.profile).manifest.name}catch{return}}o(G,"resolveLiveProfileName");class l extends Error{static{o(this,"ArmedContextError")}constructor(e){super(e),this.name="ArmedContextError"}}function N(r){if(r==null)return{};let e;try{e=JSON.parse(r)}catch(i){throw new l(`the armed env snapshot is not valid JSON (${i.message}) \u2014 this cron's stored env_json is corrupt, so the run would silently drop every armed variable. Re-arm the cron with a valid --env.`)}if(typeof e!="object"||e===null||Array.isArray(e))throw new l("the armed env snapshot is not a JSON object \u2014 this cron's stored env_json is corrupt. Re-arm the cron with a valid --env.");const n={};for(const[i,t]of Object.entries(e)){if(typeof t!="string")throw new l(`the armed env snapshot's value for "${i}" is not a string \u2014 this cron's stored env_json is corrupt, so the run would silently drop that variable. Re-arm the cron with a valid --env.`);n[i]=t}return n}o(N,"parseArmedEnv");async function U(r,e){const n=N(r.env_json),i=r.grantee==="app:terminal",t=i?_(r):null,a=w({targetCwd:r.cwd,targetProfileId:t,skipSpawnAllow:!i}),s={...a,...R(r.grantee),...i?g(t):{},...n,...t!==null?{CRTR_PROFILE_ID:t}:{},CRTR_CRON_ID:r.cron_id,CRTR_CRON_NAME:r.name,CRTR_RUN_ID:e},u=m();if(u!==void 0&&u!==""&&(s.CRTR_HOME=u),r.anchor_node!=null){s.CRTR_ANCHOR=r.anchor_node;const d=await c(r.anchor_node);d!==null&&(s.CRTR_CONTEXT_DIR=y(d.node_id,d.grantee))}return s[f]=a[f],{profileId:t,env:s}}o(U,"buildArmedRunContext");export{l as ArmedContextError,U as buildArmedRunContext,V as cronBirthPlacement,B as cronBirthPrincipalOf,_ as resolveLiveProfile,G as resolveLiveProfileName,F as resolveLiveProfileOrRoot};
+var p=Object.defineProperty;var o=(e,r)=>p(e,"name",{value:r,configurable:!0});import{envHomeOverride as m}from"../../shared/env.js";import{loadProfileManifest as h,lookupProfile as v}from"../../core/profiles/manifest.js";import{localEnvironmentSecrets as g}from"../../core/secrets/environment-owner.js";import{ADMITTED_HOST_PATH_ENV as f,buildOperationalEnvBase as w}from"../../core/runtime/spawn-env.js";import{getNode as c}from"../../core/canvas/canvas.js";import{contextDir as R}from"../../core/canvas/paths.js";import{appendRunEvent as y}from"../../core/runs/events.js";import{payerOfGrant as O}from"../../core/grants/mirror.js";import{scopeAllowed as b}from"../../core/scopes.js";import{cronPrincipalOf as C}from"./authority.js";import{personId as E}from"../../core/canvas/person.js";function _(e){if(e.profile==null)return null;let r;try{r=v(e.profile)}catch{return null}if(r.kind==="resolved")return r.entry.profileId;if(r.kind==="absent")return null;throw new l(`the armed profile "${e.profile}" is still on this host but its manifest could not be read (${r.manifestPath}) \u2014 running as root would silently give this cron a different identity, env store, and purview. Repair the manifest, or re-arm the cron under a profile that resolves.`)}o(_,"resolveLiveProfile");function M(e){return{...C(e),cron_id:e.cron_id,origin_run_id:e.origin_run_id,isolated:e.isolated,creator:e.created_by}}o(M,"cronBirthPrincipalOf");async function $(e,r){const n=e.creator===null?null:await c(e.creator);return n!==null&&e.origin_run_id!==null&&n.run_id===e.origin_run_id&&(await c(e.origin_run_id))?.deleting_at==null&&n.grantee===e.grantee&&(n.sub??E())===e.sub&&(n.grant_id??null)===e.grant_id&&(e.scopes===null?n.scopes==null:e.scopes.every(t=>b(n.scopes,t)))?{parent:n.node_id,...e.scopes===null?{}:{scopes:[...e.scopes]}}:{root:!0,rootLifecycle:"terminal",...e.scopes===null?{}:{scopes:[...e.scopes]},run:{grantee:e.grantee,sub:e.sub,grant_id:e.grant_id,client_id:null,metadata_json:JSON.stringify(e.cron_id===null?{exec:!0}:{cron_id:e.cron_id}),run_id:r,event_cursor:1,usage_json:JSON.stringify({input_tokens:0,output_tokens:0,cache_read_tokens:0,cache_write_tokens:0,cost_usd:0})},withinCreate:o(async(t,a)=>{await y(t,r,r,"run.started",{scopes:a.scopes??null,payer:await O(e.grant_id),usage:JSON.parse(a.usage_json)})},"withinCreate")}}o($,"cronBirthPlacement");function B(e){try{return _(e)}catch{return null}}o(B,"resolveLiveProfileOrRoot");function F(e){if(e.profile!=null)try{return h(e.profile).manifest.name}catch{return}}o(F,"resolveLiveProfileName");class l extends Error{static{o(this,"ArmedContextError")}constructor(r){super(r),this.name="ArmedContextError"}}function x(e){if(e==null)return{};let r;try{r=JSON.parse(e)}catch(i){throw new l(`the armed env snapshot is not valid JSON (${i.message}) \u2014 this cron's stored env_json is corrupt, so the run would silently drop every armed variable. Re-arm the cron with a valid --env.`)}if(typeof r!="object"||r===null||Array.isArray(r))throw new l("the armed env snapshot is not a JSON object \u2014 this cron's stored env_json is corrupt. Re-arm the cron with a valid --env.");const n={};for(const[i,t]of Object.entries(r)){if(typeof t!="string")throw new l(`the armed env snapshot's value for "${i}" is not a string \u2014 this cron's stored env_json is corrupt, so the run would silently drop that variable. Re-arm the cron with a valid --env.`);n[i]=t}return n}o(x,"parseArmedEnv");async function G(e,r){const n=x(e.env_json),i=e.grantee==="app:terminal",t=i?_(e):null,a=w({targetCwd:e.cwd,targetProfileId:t,skipSpawnAllow:!i}),s={...a,...await g(t,e.grantee),...n,...t!==null?{CRTR_PROFILE_ID:t}:{},CRTR_CRON_ID:e.cron_id,CRTR_CRON_NAME:e.name,CRTR_RUN_ID:r},u=m();if(u!==void 0&&u!==""&&(s.CRTR_HOME=u),e.anchor_node!=null){s.CRTR_ANCHOR=e.anchor_node;const d=await c(e.anchor_node);d!==null&&(s.CRTR_CONTEXT_DIR=R(d.node_id,d.grantee))}return s[f]=a[f],{profileId:t,env:s}}o(G,"buildArmedRunContext");export{l as ArmedContextError,G as buildArmedRunContext,$ as cronBirthPlacement,M as cronBirthPrincipalOf,_ as resolveLiveProfile,F as resolveLiveProfileName,B as resolveLiveProfileOrRoot};

package/dist/daemon/cron/lease-recovery.js

@@ -1 +1 @@
-var v=Object.defineProperty;var d=(e,r)=>v(e,"name",{value:r,configurable:!0});import{randomUUID as m}from"node:crypto";import{setTimeout as w}from"node:timers/promises";import{CRON_DEATH_POLL_MS as S,CRON_KILL_GRACE_MS as A,EMPTY_STDOUT_SHA256 as f}from"./capture.js";import{cronDaemonInstanceId as C}from"./live-runs.js";import{crashedOneShotSummary as L,escalateFailure as y}from"./escalation.js";import{settleRun as h}from"./settle.js";import{runningCrons as H,stopLeasedCronRun as p,setCronState as M,verifyLeasedCronRun as l}from"../../core/canvas/crons.js";import{emitEvent as c}from"../../core/events/emit.js";const i=new Set;async function K(e,r={}){for(const t of await H()){if(t.run_lease_owner===C||i.has(t.cron_id))continue;if(t.run_pid===null||!l(t)){i.add(t.cron_id),x(t,e,r);continue}const a=t.run_started_at!=null?new Date(t.run_started_at).getTime():e;if(e-a<t.run_timeout_s*1e3)continue;const o={runId:t.run_execution_id??m(),startedAtIso:t.run_started_at??new Date(e).toISOString(),exitCode:-1,timedOut:!0,runTimeoutS:t.run_timeout_s,processErrorMessage:null,stdoutHead:"",stdoutSha256:f,stderrHead:`run timed out after ${t.run_timeout_s}s (recovered stale lease from a prior daemon instance)`};i.add(t.cron_id);const n=(async()=>{await p(t),await g(t),await h(t,{outOfBand:!1,outcome:{kind:"disposed",ctx:o},record:{runId:o.runId,startedAtIso:o.startedAtIso,finishedAtMs:e,durationMs:e-a,exitCode:-1,stdoutHead:null,stderrHead:o.stderrHead},lease:{kind:"clear"}})})().finally(()=>i.delete(t.cron_id));r.register?.(n),n.catch(s=>{c({level:"error",event:"cron.stale_lease.settle_failed",error:s,fields:{cron_id:t.cron_id}})})}}d(K,"recoverStaleCronLeases");async function g(e){if(!await I(e)&&(await p(e,"SIGKILL"),!await I(e)))throw new Error(`cron ${e.cron_id} run ${e.run_pid} survived SIGKILL`)}d(g,"awaitLeasedRunDeath");async function I(e){const r=Date.now()+A;for(;Date.now()<r;){if(!l(e))return!0;await w(S)}return!l(e)}d(I,"pollLeasedRunGone");function x(e,r,t){const a=e.recur==null,o=e.run_started_at!=null?new Date(e.run_started_at).getTime():r,n=e.run_pid===null?"the daemon life that claimed this run ended before its launch pid was recorded \u2014 the command may have started and its outcome is unknown":"the daemon life that owned this run ended before it settled \u2014 the process is gone and its outcome was never observed",s={runId:e.run_execution_id??m(),startedAtIso:e.run_started_at??new Date(r).toISOString(),exitCode:null,timedOut:!1,runTimeoutS:e.run_timeout_s,processErrorMessage:n,stdoutHead:"",stdoutSha256:f,stderrHead:`run outcome unobserved: ${n}`},_=(async()=>{let u=`crashed: ${n}${a?"":" \u2014 the next occurrence is unaffected"}`;a&&(await M(e.cron_id,"paused"),u=e.on_output==="silent"?`crashed: ${n} \u2014 one-shot paused, not re-fired (silent: not escalated)`:`crashed one-shot: ${await y(e,s,L(n))}`),await h(e,{outOfBand:!1,outcome:{kind:"stated",delivered:u,paused:a},record:{runId:s.runId,startedAtIso:s.startedAtIso,finishedAtMs:r,durationMs:Math.max(0,r-o),exitCode:null,stdoutHead:null,stderrHead:s.stderrHead},lease:"release"}),c({level:"warn",event:"cron.run.unobserved",fields:{cron_id:e.cron_id,name:e.name,one_shot:a}})})().finally(()=>i.delete(e.cron_id));t.register?.(_),_.catch(u=>{c({level:"error",event:"cron.crashed_run.settle_failed",error:u,fields:{cron_id:e.cron_id}})})}d(x,"settleCrashedRun");export{K as recoverStaleCronLeases};
+var v=Object.defineProperty;var d=(e,r)=>v(e,"name",{value:r,configurable:!0});import{randomUUID as m}from"node:crypto";import{setTimeout as I}from"node:timers/promises";import{CRON_DEATH_POLL_MS as S,CRON_KILL_GRACE_MS as A,EMPTY_STDOUT_SHA256 as f}from"./capture.js";import{cronDaemonInstanceId as C,cronOwnerAlive as L,ensureCronOwnerLease as O}from"./live-runs.js";import{crashedOneShotSummary as y,escalateFailure as H}from"./escalation.js";import{settleRun as h}from"./settle.js";import{runningCrons as M,stopLeasedCronRun as w,setCronState as g,verifyLeasedCronRun as l}from"../../core/canvas/crons.js";import{emitEvent as c}from"../../core/events/emit.js";const i=new Set;async function B(e,r={}){await O();for(const t of await M()){if(t.run_lease_owner===C||i.has(t.cron_id)||t.run_lease_owner!==null&&await L(t.run_lease_owner))continue;if(t.run_pid===null||!l(t)){i.add(t.cron_id),D(t,e,r);continue}const a=t.run_started_at!=null?new Date(t.run_started_at).getTime():e;if(e-a<t.run_timeout_s*1e3)continue;const o={runId:t.run_execution_id??m(),startedAtIso:t.run_started_at??new Date(e).toISOString(),exitCode:-1,timedOut:!0,runTimeoutS:t.run_timeout_s,processErrorMessage:null,stdoutHead:"",stdoutSha256:f,stderrHead:`run timed out after ${t.run_timeout_s}s (recovered stale lease from a prior daemon instance)`};i.add(t.cron_id);const n=(async()=>{await w(t),await x(t),await h(t,{outOfBand:!1,outcome:{kind:"disposed",ctx:o},record:{runId:o.runId,startedAtIso:o.startedAtIso,finishedAtMs:e,durationMs:e-a,exitCode:-1,stdoutHead:null,stderrHead:o.stderrHead},lease:{kind:"clear"}})})().finally(()=>i.delete(t.cron_id));r.register?.(n),n.catch(s=>{c({level:"error",event:"cron.stale_lease.settle_failed",error:s,fields:{cron_id:t.cron_id}})})}}d(B,"recoverStaleCronLeases");async function x(e){if(!await p(e)&&(await w(e,"SIGKILL"),!await p(e)))throw new Error(`cron ${e.cron_id} run ${e.run_pid} survived SIGKILL`)}d(x,"awaitLeasedRunDeath");async function p(e){const r=Date.now()+A;for(;Date.now()<r;){if(!l(e))return!0;await I(S)}return!l(e)}d(p,"pollLeasedRunGone");function D(e,r,t){const a=e.recur==null,o=e.run_started_at!=null?new Date(e.run_started_at).getTime():r,n=e.run_pid===null?"the daemon life that claimed this run ended before its launch pid was recorded \u2014 the command may have started and its outcome is unknown":"the daemon life that owned this run ended before it settled \u2014 the process is gone and its outcome was never observed",s={runId:e.run_execution_id??m(),startedAtIso:e.run_started_at??new Date(r).toISOString(),exitCode:null,timedOut:!1,runTimeoutS:e.run_timeout_s,processErrorMessage:n,stdoutHead:"",stdoutSha256:f,stderrHead:`run outcome unobserved: ${n}`},_=(async()=>{let u=`crashed: ${n}${a?"":" \u2014 the next occurrence is unaffected"}`;a&&(await g(e.cron_id,"paused"),u=e.on_output==="silent"?`crashed: ${n} \u2014 one-shot paused, not re-fired (silent: not escalated)`:`crashed one-shot: ${await H(e,s,y(n))}`),await h(e,{outOfBand:!1,outcome:{kind:"stated",delivered:u,paused:a},record:{runId:s.runId,startedAtIso:s.startedAtIso,finishedAtMs:r,durationMs:Math.max(0,r-o),exitCode:null,stdoutHead:null,stderrHead:s.stderrHead},lease:"release"}),c({level:"warn",event:"cron.run.unobserved",fields:{cron_id:e.cron_id,name:e.name,one_shot:a}})})().finally(()=>i.delete(e.cron_id));t.register?.(_),_.catch(u=>{c({level:"error",event:"cron.crashed_run.settle_failed",error:u,fields:{cron_id:e.cron_id}})})}d(D,"settleCrashedRun");export{B as recoverStaleCronLeases};

package/dist/daemon/cron/live-runs.d.ts

@@ -1,5 +1,11 @@
 import type { CronRefusalReason } from './authority.js';
 export declare const cronDaemonInstanceId: `${string}-${string}-${string}-${string}-${string}`;
+export declare const CRON_OWNER_HEARTBEAT_TTL_MS = 15000;
+/** Call before naming this process the owner of a cron run lease. Keeps the heartbeat alive from then on; the heartbeat stops
+ *  itself if a beat fails, and the next call restarts it. */
+export declare function ensureCronOwnerLease(): Promise<void>;
+/** Whether `owner` (another process's instance id) has a live heartbeat. */
+export declare function cronOwnerAlive(owner: string): Promise<boolean>;
 export interface LiveRun {
     runId: string;
     replaced: boolean;

package/dist/daemon/cron/live-runs.js

@@ -1 +1 @@
-var i=Object.defineProperty;var n=(e,t)=>i(e,"name",{value:t,configurable:!0});import{randomUUID as c}from"node:crypto";const x=c(),o=new Map;function d(e){return o.get(e)}n(d,"liveRunFor");function l(e,t){o.set(e,t)}n(l,"registerLiveRun");function p(e,t){const r=o.get(e);r!==void 0&&r.runId===t&&o.delete(e)}n(p,"clearLiveRun");function a(e,t){const r=o.get(e);return r===void 0||r.runId!==t?!1:(r.selfCanceled=!0,!0)}n(a,"markSelfCanceledCronRun");const u=new Map;function v(e){u.set(e.executionId,e)}n(v,"registerCronExecution");function g(e){return u.get(e)}n(g,"cronExecutionFor");function m(e){u.delete(e)}n(m,"dropCronExecution");function C(){return[...u.values()]}n(C,"cronExecutions");export{p as clearLiveRun,x as cronDaemonInstanceId,g as cronExecutionFor,C as cronExecutions,m as dropCronExecution,d as liveRunFor,a as markSelfCanceledCronRun,v as registerCronExecution,l as registerLiveRun};
+var d=Object.defineProperty;var n=(e,t)=>d(e,"name",{value:t,configurable:!0});import{randomUUID as x}from"node:crypto";import{claimReconcilerLease as E,renewReconcilerLease as R}from"../../core/canvas/reconciler-leases.js";import{openDb as w}from"../../core/canvas/db.js";const a=x(),u="cron-owner",f=15e3,l=5e3;let o,s=0;async function p(){if(await R(u,a,a,f)){s=Date.now();return}await E(u,a,a,f),s=Date.now()}n(p,"beat");async function C(){o!==void 0&&Date.now()-s<l||(await p(),o===void 0&&(o=setInterval(()=>{p().catch(()=>{clearInterval(o),o=void 0})},l),o.unref()))}n(C,"ensureCronOwnerLease");async function O(e){return await(await w()).prepare("SELECT 1 AS alive FROM reconciler_leases WHERE lane = ? AND key = ? AND expires_at > ?").get(u,e,new Date().toISOString())!==void 0}n(O,"cronOwnerAlive");const i=new Map;function D(e){return i.get(e)}n(D,"liveRunFor");function N(e,t){i.set(e,t)}n(N,"registerLiveRun");function g(e,t){const r=i.get(e);r!==void 0&&r.runId===t&&i.delete(e)}n(g,"clearLiveRun");function I(e,t){const r=i.get(e);return r===void 0||r.runId!==t?!1:(r.selfCanceled=!0,!0)}n(I,"markSelfCanceledCronRun");const c=new Map;function L(e){c.set(e.executionId,e)}n(L,"registerCronExecution");function S(e){return c.get(e)}n(S,"cronExecutionFor");function T(e){c.delete(e)}n(T,"dropCronExecution");function M(){return[...c.values()]}n(M,"cronExecutions");export{f as CRON_OWNER_HEARTBEAT_TTL_MS,g as clearLiveRun,a as cronDaemonInstanceId,S as cronExecutionFor,M as cronExecutions,O as cronOwnerAlive,T as dropCronExecution,C as ensureCronOwnerLease,D as liveRunFor,I as markSelfCanceledCronRun,L as registerCronExecution,N as registerLiveRun};

package/dist/daemon/cron/run-socket.js

@@ -1 +1 @@
-var R=Object.defineProperty;var i=(r,n)=>R(r,"name",{value:n,configurable:!0});import{createServer as F}from"node:http";import{chmodSync as x,existsSync as g,mkdirSync as A,readdirSync as O,rmSync as _,unlinkSync as z}from"node:fs";import{dirname as H,join as f}from"node:path";import{peerUid as M}from"../../native/linux.js";import{nodeRunDir as s}from"../../core/canvas/paths.js";import{readConfig as U,readMergedLaunchConfig as j}from"../../core/config.js";import{readRotationConfig as q}from"../../core/subscription-state.js";import{runningCrons as v}from"../../core/canvas/crons.js";import{emitEvent as u}from"../../core/events/emit.js";import{cronLaunchId as a}from"../../core/spaces/process.js";import{ensureAppSpace as B}from"../../core/spaces/space.js";import{launcherPresent as y,listSandboxes as b}from"../../core/grants/sandboxes.js";import{uidForApp as J}from"../../core/spaces/users.js";import{setModeBeneath as L,writeFileBeneath as N}from"../../core/spaces/open-beneath.js";import{cronExecutionFor as w,cronExecutions as D,dropCronExecution as S,registerCronExecution as C}from"./live-runs.js";let p=null;function sr(r){p=r}i(sr,"setCronRequestHandler");const E=i(r=>process.platform==="linux"?M(r.socket):null,"linuxPeerUid");let k=E;function dr(r){k=r??E}i(dr,"__setCronPeerUidForTest");const m=new Map;function T(r){return f(s(a(r)),"cli.sock")}i(T,"cronSocketPath");function W(r){const n={class:"cron",app:r.grantee,sub:r.sub,grant:r.grantId,scopes:r.scopes,execution:r.executionId,from_exec:r.fromExec,origin_run:r.originRunId,isolated:r.isolated,anchor:r.anchor,uid:r.uid};return r.kind==="cron"?{...n,kind:"cron",cron:r.cronId}:{...n,kind:"exec",cron:null}}i(W,"cronPrincipalClassOf");function d(r,n,t,o){r.writeHead(n,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:t,message:o,type:"invalid_request_error",origin:"runtime",retryable:!1}}))}i(d,"refuse");function G(r){return(n,t)=>{try{const o=w(r);if(o===void 0){d(t,401,"unauthorized","this cron execution has ended");return}const e=k(n);if(e!==null&&e!==o.uid){u({event:"api.principal.denied",level:"warn",fields:{method:n.method,execution:r}}),d(t,401,"unauthorized","missing or invalid bearer token");return}if(p===null){d(t,503,"daemon_unavailable","the API server is not running");return}p(n,t,W(o))}catch(o){u({event:"api.principal.failed",level:"error",error:o instanceof Error?o:new Error(String(o))}),t.headersSent||d(t,401,"unauthorized","missing or invalid bearer token")}}}i(G,"onCronRequest");async function I(r){const n=T(r);g(n)&&z(n);const t=F(G(r));await new Promise((o,e)=>{t.once("error",e),t.listen(n,()=>{t.off("error",e),o()})}),x(n,438),m.set(r,t)}i(I,"listen");async function lr(r,n,t){const o=s(a(r.executionId));C(r);try{A(o,{recursive:!0,mode:504}),x(o,504);const e={user:U("user"),launch:j(n,t),rotation:q()},c=f(o,"cron-launch.json");if(N(o,c,JSON.stringify({configSnapshot:e}),{atomic:!0,mode:416}),y()){const l=await B(r.grantee);L(o,c,416,{uid:process.getuid(),gid:l.gid})}await I(r.executionId)}catch(e){throw P(r.executionId),e}}i(lr,"openCronExecution");function P(r){S(r);const n=m.get(r);m.delete(r),n!==void 0&&(n.closeAllConnections(),n.close());try{_(s(a(r)),{recursive:!0,force:!0})}catch{}}i(P,"closeCronExecution");let h=Promise.resolve();function fr(){return h}i(fr,"cronExecutionsReady");function pr(r=b){return h=(async()=>{if(r===b&&!y())return;const t=new Set((await r()).map(e=>e.nodeId));for(const e of await v()){const c=e.run_execution_id;if(!(c==null||!t.has(a(c))||w(c)!==void 0))try{C({executionId:c,kind:"cron",cronId:e.cron_id,fromExec:e.armed_from_exec,grantee:e.grantee,sub:e.sub,grantId:e.grant_id,scopes:e.scopes,originRunId:e.origin_run_id,isolated:e.isolated,anchor:e.anchor_node,uid:await J(e.grantee),rebuilt:!0,refusal:null}),await I(c),u({level:"info",event:"cron.execution.rebuilt",fields:{cron_id:e.cron_id,execution_id:c}})}catch(l){S(c),u({level:"error",event:"cron.execution.rebuild_failed",error:l,fields:{cron_id:e.cron_id,execution_id:c}})}}if(process.platform!=="linux")return;const o=H(s(a("x")));if(g(o)){for(const e of O(o))if(!(!e.startsWith("cron-")||t.has(e)))try{_(f(o,e),{recursive:!0,force:!0})}catch{}}})().catch(t=>{u({level:"error",event:"cron.execution.rebuild_failed",error:t})}),h}i(pr,"rebuildCronExecutions");async function mr(){const r=new Set((await v()).map(n=>n.run_execution_id));for(const n of D())n.rebuilt&&!r.has(n.executionId)&&P(n.executionId)}i(mr,"reapRebuiltCronExecutions");export{dr as __setCronPeerUidForTest,P as closeCronExecution,fr as cronExecutionsReady,W as cronPrincipalClassOf,T as cronSocketPath,lr as openCronExecution,mr as reapRebuiltCronExecutions,pr as rebuildCronExecutions,sr as setCronRequestHandler};
+var R=Object.defineProperty;var i=(r,n)=>R(r,"name",{value:n,configurable:!0});import{createServer as F}from"node:http";import{chmodSync as x,existsSync as g,mkdirSync as A,readdirSync as O,rmSync as _,unlinkSync as z}from"node:fs";import{dirname as H,join as f}from"node:path";import{peerUid as M}from"../../native/linux.js";import{nodeRunDir as s}from"../../core/canvas/paths.js";import{readConfig as U,readMergedLaunchConfig as j}from"../../core/config.js";import{loadRotationConfig as q}from"../../core/subscription-state.js";import{runningCrons as v}from"../../core/canvas/crons.js";import{emitEvent as u}from"../../core/events/emit.js";import{cronLaunchId as a}from"../../core/spaces/process.js";import{ensureAppSpace as B}from"../../core/spaces/space.js";import{launcherPresent as y,listSandboxes as w}from"../../core/grants/sandboxes.js";import{uidForApp as J}from"../../core/spaces/users.js";import{setModeBeneath as L,writeFileBeneath as N}from"../../core/spaces/open-beneath.js";import{cronExecutionFor as b,cronExecutions as D,dropCronExecution as S,registerCronExecution as C}from"./live-runs.js";let p=null;function sr(r){p=r}i(sr,"setCronRequestHandler");const E=i(r=>process.platform==="linux"?M(r.socket):null,"linuxPeerUid");let k=E;function dr(r){k=r??E}i(dr,"__setCronPeerUidForTest");const m=new Map;function T(r){return f(s(a(r)),"cli.sock")}i(T,"cronSocketPath");function W(r){const n={class:"cron",app:r.grantee,sub:r.sub,grant:r.grantId,scopes:r.scopes,execution:r.executionId,from_exec:r.fromExec,origin_run:r.originRunId,isolated:r.isolated,anchor:r.anchor,uid:r.uid};return r.kind==="cron"?{...n,kind:"cron",cron:r.cronId}:{...n,kind:"exec",cron:null}}i(W,"cronPrincipalClassOf");function d(r,n,t,o){r.writeHead(n,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:t,message:o,type:"invalid_request_error",origin:"runtime",retryable:!1}}))}i(d,"refuse");function G(r){return(n,t)=>{try{const o=b(r);if(o===void 0){d(t,401,"unauthorized","this cron execution has ended");return}const e=k(n);if(e!==null&&e!==o.uid){u({event:"api.principal.denied",level:"warn",fields:{method:n.method,execution:r}}),d(t,401,"unauthorized","missing or invalid bearer token");return}if(p===null){d(t,503,"daemon_unavailable","the API server is not running");return}p(n,t,W(o))}catch(o){u({event:"api.principal.failed",level:"error",error:o instanceof Error?o:new Error(String(o))}),t.headersSent||d(t,401,"unauthorized","missing or invalid bearer token")}}}i(G,"onCronRequest");async function I(r){const n=T(r);g(n)&&z(n);const t=F(G(r));await new Promise((o,e)=>{t.once("error",e),t.listen(n,()=>{t.off("error",e),o()})}),x(n,438),m.set(r,t)}i(I,"listen");async function lr(r,n,t){const o=s(a(r.executionId));C(r);try{A(o,{recursive:!0,mode:504}),x(o,504);const e={user:U("user"),launch:j(n,t),rotation:await q()},c=f(o,"cron-launch.json");if(N(o,c,JSON.stringify({configSnapshot:e}),{atomic:!0,mode:416}),y()){const l=await B(r.grantee);L(o,c,416,{uid:process.getuid(),gid:l.gid})}await I(r.executionId)}catch(e){throw P(r.executionId),e}}i(lr,"openCronExecution");function P(r){S(r);const n=m.get(r);m.delete(r),n!==void 0&&(n.closeAllConnections(),n.close());try{_(s(a(r)),{recursive:!0,force:!0})}catch{}}i(P,"closeCronExecution");let h=Promise.resolve();function fr(){return h}i(fr,"cronExecutionsReady");function pr(r=w){return h=(async()=>{if(r===w&&!y())return;const t=new Set((await r()).map(e=>e.nodeId));for(const e of await v()){const c=e.run_execution_id;if(!(c==null||!t.has(a(c))||b(c)!==void 0))try{C({executionId:c,kind:"cron",cronId:e.cron_id,fromExec:e.armed_from_exec,grantee:e.grantee,sub:e.sub,grantId:e.grant_id,scopes:e.scopes,originRunId:e.origin_run_id,isolated:e.isolated,anchor:e.anchor_node,uid:await J(e.grantee),rebuilt:!0,refusal:null}),await I(c),u({level:"info",event:"cron.execution.rebuilt",fields:{cron_id:e.cron_id,execution_id:c}})}catch(l){S(c),u({level:"error",event:"cron.execution.rebuild_failed",error:l,fields:{cron_id:e.cron_id,execution_id:c}})}}if(process.platform!=="linux")return;const o=H(s(a("x")));if(g(o)){for(const e of O(o))if(!(!e.startsWith("cron-")||t.has(e)))try{_(f(o,e),{recursive:!0,force:!0})}catch{}}})().catch(t=>{u({level:"error",event:"cron.execution.rebuild_failed",error:t})}),h}i(pr,"rebuildCronExecutions");async function mr(){const r=new Set((await v()).map(n=>n.run_execution_id));for(const n of D())n.rebuilt&&!r.has(n.executionId)&&P(n.executionId)}i(mr,"reapRebuiltCronExecutions");export{dr as __setCronPeerUidForTest,P as closeCronExecution,fr as cronExecutionsReady,W as cronPrincipalClassOf,T as cronSocketPath,lr as openCronExecution,mr as reapRebuiltCronExecutions,pr as rebuildCronExecutions,sr as setCronRequestHandler};

package/dist/daemon/cron-run.js

@@ -1,2 +1,2 @@
-var N=Object.defineProperty;var i=(e,t)=>N(e,"name",{value:t,configurable:!0});import{randomUUID as Y}from"node:crypto";import{CRON_OUTPUT_HEAD_BYTES as E,EMPTY_STDOUT_SHA256 as q,formatCronOutputHead as A}from"./cron/capture.js";import{clearLiveRun as g,cronDaemonInstanceId as $,registerLiveRun as J}from"./cron/live-runs.js";import{closeCronExecution as V,openCronExecution as X}from"./cron/run-socket.js";import{appProcessSandboxed as z}from"../core/spaces/process.js";import{nodeAgentDir as G}from"../core/canvas/paths.js";import{uidForApp as K}from"../core/spaces/users.js";import{buildArmedRunContext as Q}from"./cron/armed-context.js";import{ensureCronFolder as W}from"./cron/folders.js";import{checkCronFire as Z,cronPrincipalOf as j}from"./cron/authority.js";import{refusalError as ee}from"../core/ledger/index.js";import{startRefusal as te}from"../core/runtime/start-check.js";import{decideHeldSettle as re,EXIT_HELD as ne,HELD_DELIVERED as oe}from"./cron/held.js";import{settleRun as O}from"./cron/settle.js";import{applyOverlapPolicies as ae,expireDueCrons as se}from"./cron/passes.js";import{dueClockCrons as de,acquireCronRunLease as ie,releaseCronRunLease as le,attachCronRunPid as ue,advanceCron as ce,setCronState as fe}from"../core/canvas/crons.js";import{emitEvent as L}from"../core/events/emit.js";import{runAppCommand as me}from"../core/runtime/run-command.js";import{nextSlotAfter as pe}from"../core/wake.js";import{CRON_OUTPUT_HEAD_BYTES as Ne}from"./cron/capture.js";import{cronDaemonInstanceId as qe,markSelfCanceledCronRun as Je}from"./cron/live-runs.js";import{recoverStaleCronLeases as Xe}from"./cron/lease-recovery.js";async function he(e,t){const{runId:a,outOfBand:s,startedAtIso:u,finishedAtMs:c,code:d,timedOut:n,processError:f}=t,w=!s&&!n&&f==null&&d===ne&&!t.wasReplaced&&!t.wasSelfCanceled;let p,r;return t.wasReplaced?(p={kind:"stated",delivered:"replaced (overlap=replace)"},r="release"):w?(p={kind:"stated",delivered:oe},r=await re(e,u,c)??"release"):(p={kind:"disposed",ctx:{runId:a,startedAtIso:u,exitCode:n?-1:d,timedOut:n,runTimeoutS:e.run_timeout_s,processErrorMessage:f!=null?f.message:null,stdoutHead:t.stdoutHead,stdoutSha256:t.stdoutSha256,stderrHead:t.stderrHead},selfCanceled:t.wasSelfCanceled},r=s?"release":{kind:"clear"}),O(e,{outOfBand:s,outcome:p,record:{runId:a,startedAtIso:u,finishedAtMs:c,durationMs:c-t.startedAtMs,exitCode:n?-1:d,stdoutHead:t.stdoutHead===""?null:t.stdoutHead,stderrHead:f!=null?`run process error: ${f.message}`.slice(0,E):t.stderrHead===""?null:t.stderrHead},lease:r})}i(he,"settleClosedRun");function R(e,t,a,s){const u=Date.now(),c=`${a}: ${s.message}`.slice(0,E);return O(e,{outOfBand:t.outOfBand,outcome:{kind:"disposed",ctx:{runId:t.runId,startedAtIso:t.startedAtIso,exitCode:null,timedOut:!1,runTimeoutS:e.run_timeout_s,processErrorMessage:s.message,stdoutHead:"",stdoutSha256:q,stderrHead:c}},record:{runId:t.runId,startedAtIso:t.startedAtIso,finishedAtMs:u,durationMs:u-t.startedAtMs,exitCode:null,stdoutHead:null,stderrHead:c},lease:"release"})}i(R,"settleUnspawnedRun");async function P(e,t){let a;try{a=pe(e.recur,new Date(t))}catch(s){return L({level:"error",event:"cron.recur.unparseable",error:s,fields:{cron_id:e.cron_id,name:e.name,recur:e.recur}}),await fe(e.cron_id,"paused"),new Error(`unparseable recurrence ${JSON.stringify(e.recur)}: ${s.message} \u2014 this cron cannot be rescheduled until its recurrence is fixed (\`crtr cron cancel\` and re-arm it), so it has been paused.`)}return await ce(e.cron_id,a),null}i(P,"advanceRecurrence");function Pe(e,t){return B(e,t).settled}i(Pe,"executeCron");function B(e,t){const{outOfBand:a}=t;let s=i(()=>{},"admit");const u=new Promise(d=>{s=d}),c=new Promise((d,n)=>{let f=!1,w=i(()=>{},"undo");const p=i(r=>{if(w(),!f){n(r);return}f=!1,le(e.cron_id).then(()=>n(r),m=>{L({level:"error",event:"cron.lease.release_failed",error:m,fields:{cron_id:e.cron_id}}),n(r)})},"fail");(async()=>{const r=Y(),m=Date.now(),C=new Date(m).toISOString(),S={runId:r,outOfBand:a,startedAtIso:C,startedAtMs:m};if(!await ie(e.cron_id,$,C,a,r)){d(null);return}f=!0;let h=await Z(j(e));if(h.allowed){const o=await te({grantee:e.grantee,sub:e.sub,grant_id:e.grant_id});o!==null&&(h={allowed:!1,reason:"limit_reached",message:ee(o).message})}if(!h.allowed){try{if(!a&&e.recur!=null){const _=await P(e,m);if(_!==null)throw _}}catch(_){R(e,S,"run could not be armed",_).then(d,n);return}const o=Date.now();O(e,{outOfBand:a,outcome:{kind:"refused",reason:h.reason,message:h.message},record:{runId:r,startedAtIso:C,finishedAtMs:o,durationMs:o-m,exitCode:null,stdoutHead:null,stderrHead:`${h.reason}: ${h.message}`.slice(0,E)},lease:"release"}).then(d,n);return}let M;try{if(e.isolated&&W(e.grantee,e.cron_id),{env:M}=await Q(e,r),!a&&e.recur!=null){const o=await P(e,m);if(o!==null)throw o}}catch(o){R(e,S,"run could not be armed",o).then(d,n);return}let b=null,T=!1;const D={runId:r,replaced:!1,selfCanceled:!1,kill:i(()=>{b!==null?b():T=!0},"kill")};J(e.cron_id,D),w=i(()=>g(e.cron_id,r),"undo"),s();const x=z()?{executionId:r,kind:"cron",cronId:e.cron_id,fromExec:e.armed_from_exec,grantee:e.grantee,sub:e.sub,grantId:e.grant_id,scopes:e.scopes,originRunId:e.origin_run_id,isolated:e.isolated,anchor:e.anchor_node,uid:await K(e.grantee),rebuilt:!1,refusal:null}:null,I=i(()=>{x!==null&&V(r)},"closeExecution");w=i(()=>{g(e.cron_id,r),I()},"undo"),i(async()=>(x!==null&&await X(x,e.cwd,e.profile),me({command:e.command,cwd:e.cwd,env:M,app:e.grantee,isolated:e.isolated,principal:{sub:e.sub,grantId:e.grant_id,scopes:e.scopes},...e.isolated?{folder:e.cwd}:{},...x!==null?{cron:{executionId:r,...e.anchor_node===null||e.isolated?{}:{anchorDir:G(e.anchor_node,e.grantee)}}}:e.anchor_node===null||e.isolated?{}:{nodeId:e.anchor_node},timeoutMs:e.run_timeout_s*1e3,headBytes:E})),"launch")().then(async o=>{if(o.pid===null){g(e.cron_id,r),I(),o.completion.then(l=>{R(e,S,"run failed to spawn",l.processError??new Error("bash did not provide a process id")).then(d,n)},n);return}w=i(()=>{g(e.cron_id,r),I(),o.terminate()},"undo");let _=!1;const v=i(()=>{o.completion.then(l=>{const k=D.replaced,U=D.selfCanceled,H=x?.refusal??null;if(g(e.cron_id,r),I(),_){d(null);return}if(H!==null&&!k){const y=Date.now(),F=A(l.stderr,l.stderrTruncated);O(e,{outOfBand:a,outcome:{kind:"refused",reason:H.reason,message:H.message},record:{runId:r,startedAtIso:C,finishedAtMs:y,durationMs:y-m,exitCode:l.exitCode,stdoutHead:A(l.stdout,l.stdoutTruncated)||null,stderrHead:`${H.reason}: ${H.message}
-${F}`.trim().slice(0,E)},lease:"release"}).then(d,n);return}he(e,{runId:r,outOfBand:a,startedAtIso:C,startedAtMs:m,finishedAtMs:Date.now(),code:l.exitCode,timedOut:l.timedOut,processError:l.processError,stdoutHead:A(l.stdout,l.stdoutTruncated),stderrHead:A(l.stderr,l.stderrTruncated),stdoutSha256:l.stdoutSha256,wasReplaced:k,wasSelfCanceled:U}).then(d,n)},n)},"settleCommand");if(!await ue(e.cron_id,$,C,o.pid)&&!D.selfCanceled){_=!0,o.terminate(),v();return}b=o.terminate,T&&o.terminate(),v()},o=>{g(e.cron_id,r),I(),R(e,S,"run failed to spawn",o).then(d,n)}).catch(p)})().catch(p)});return c.then(s,s),{admitted:u,settled:c}}i(B,"startCron");async function Be(e,t={}){const a=new Date(e).toISOString();await se(a),await ae(e,a);const s=[];for(const u of await de(a)){const{admitted:c,settled:d}=B(u,{outOfBand:!1}),n=d.then(()=>{});n.catch(()=>{}),await c,s.push(n),t.register?.(n)}for(const u of s)u.catch(()=>{});return s}i(Be,"runDueCrons");export{Ne as CRON_OUTPUT_HEAD_BYTES,qe as cronDaemonInstanceId,Pe as executeCron,Je as markSelfCanceledCronRun,Xe as recoverStaleCronLeases,Be as runDueCrons,B as startCron};
+var N=Object.defineProperty;var i=(e,t)=>N(e,"name",{value:t,configurable:!0});import{randomUUID as Y}from"node:crypto";import{CRON_OUTPUT_HEAD_BYTES as E,EMPTY_STDOUT_SHA256 as q,formatCronOutputHead as A}from"./cron/capture.js";import{clearLiveRun as g,cronDaemonInstanceId as L,ensureCronOwnerLease as J,registerLiveRun as V}from"./cron/live-runs.js";import{closeCronExecution as X,openCronExecution as z}from"./cron/run-socket.js";import{appProcessSandboxed as G}from"../core/spaces/process.js";import{nodeAgentDir as K}from"../core/canvas/paths.js";import{uidForApp as Q}from"../core/spaces/users.js";import{buildArmedRunContext as W}from"./cron/armed-context.js";import{ensureCronFolder as Z}from"./cron/folders.js";import{checkCronFire as j,cronPrincipalOf as ee}from"./cron/authority.js";import{refusalError as te}from"../core/ledger/index.js";import{startRefusal as re}from"../core/runtime/start-check.js";import{decideHeldSettle as ne,EXIT_HELD as oe,HELD_DELIVERED as ae}from"./cron/held.js";import{settleRun as O}from"./cron/settle.js";import{applyOverlapPolicies as se,expireDueCrons as de}from"./cron/passes.js";import{dueClockCrons as ie,acquireCronRunLease as le,releaseCronRunLease as ue,attachCronRunPid as ce,advanceCron as fe,setCronState as me}from"../core/canvas/crons.js";import{emitEvent as $}from"../core/events/emit.js";import{runAppCommand as pe}from"../core/runtime/run-command.js";import{nextSlotAfter as he}from"../core/wake.js";import{CRON_OUTPUT_HEAD_BYTES as Ye}from"./cron/capture.js";import{cronDaemonInstanceId as Je,markSelfCanceledCronRun as Ve}from"./cron/live-runs.js";import{recoverStaleCronLeases as ze}from"./cron/lease-recovery.js";async function we(e,t){const{runId:a,outOfBand:s,startedAtIso:u,finishedAtMs:c,code:d,timedOut:n,processError:f}=t,_=!s&&!n&&f==null&&d===oe&&!t.wasReplaced&&!t.wasSelfCanceled;let p,r;return t.wasReplaced?(p={kind:"stated",delivered:"replaced (overlap=replace)"},r="release"):_?(p={kind:"stated",delivered:ae},r=await ne(e,u,c)??"release"):(p={kind:"disposed",ctx:{runId:a,startedAtIso:u,exitCode:n?-1:d,timedOut:n,runTimeoutS:e.run_timeout_s,processErrorMessage:f!=null?f.message:null,stdoutHead:t.stdoutHead,stdoutSha256:t.stdoutSha256,stderrHead:t.stderrHead},selfCanceled:t.wasSelfCanceled},r=s?"release":{kind:"clear"}),O(e,{outOfBand:s,outcome:p,record:{runId:a,startedAtIso:u,finishedAtMs:c,durationMs:c-t.startedAtMs,exitCode:n?-1:d,stdoutHead:t.stdoutHead===""?null:t.stdoutHead,stderrHead:f!=null?`run process error: ${f.message}`.slice(0,E):t.stderrHead===""?null:t.stderrHead},lease:r})}i(we,"settleClosedRun");function R(e,t,a,s){const u=Date.now(),c=`${a}: ${s.message}`.slice(0,E);return O(e,{outOfBand:t.outOfBand,outcome:{kind:"disposed",ctx:{runId:t.runId,startedAtIso:t.startedAtIso,exitCode:null,timedOut:!1,runTimeoutS:e.run_timeout_s,processErrorMessage:s.message,stdoutHead:"",stdoutSha256:q,stderrHead:c}},record:{runId:t.runId,startedAtIso:t.startedAtIso,finishedAtMs:u,durationMs:u-t.startedAtMs,exitCode:null,stdoutHead:null,stderrHead:c},lease:"release"})}i(R,"settleUnspawnedRun");async function P(e,t){let a;try{a=he(e.recur,new Date(t))}catch(s){return $({level:"error",event:"cron.recur.unparseable",error:s,fields:{cron_id:e.cron_id,name:e.name,recur:e.recur}}),await me(e.cron_id,"paused"),new Error(`unparseable recurrence ${JSON.stringify(e.recur)}: ${s.message} \u2014 this cron cannot be rescheduled until its recurrence is fixed (\`crtr cron cancel\` and re-arm it), so it has been paused.`)}return await fe(e.cron_id,a),null}i(P,"advanceRecurrence");function Be(e,t){return B(e,t).settled}i(Be,"executeCron");function B(e,t){const{outOfBand:a}=t;let s=i(()=>{},"admit");const u=new Promise(d=>{s=d}),c=new Promise((d,n)=>{let f=!1,_=i(()=>{},"undo");const p=i(r=>{if(_(),!f){n(r);return}f=!1,ue(e.cron_id).then(()=>n(r),m=>{$({level:"error",event:"cron.lease.release_failed",error:m,fields:{cron_id:e.cron_id}}),n(r)})},"fail");(async()=>{const r=Y(),m=Date.now(),C=new Date(m).toISOString(),S={runId:r,outOfBand:a,startedAtIso:C,startedAtMs:m};if(await J(),!await le(e.cron_id,L,C,a,r)){d(null);return}f=!0;let h=await j(ee(e));if(h.allowed){const o=await re({grantee:e.grantee,sub:e.sub,grant_id:e.grant_id});o!==null&&(h={allowed:!1,reason:"limit_reached",message:te(o).message})}if(!h.allowed){try{if(!a&&e.recur!=null){const w=await P(e,m);if(w!==null)throw w}}catch(w){R(e,S,"run could not be armed",w).then(d,n);return}const o=Date.now();O(e,{outOfBand:a,outcome:{kind:"refused",reason:h.reason,message:h.message},record:{runId:r,startedAtIso:C,finishedAtMs:o,durationMs:o-m,exitCode:null,stdoutHead:null,stderrHead:`${h.reason}: ${h.message}`.slice(0,E)},lease:"release"}).then(d,n);return}let M;try{if(e.isolated&&Z(e.grantee,e.cron_id),{env:M}=await W(e,r),!a&&e.recur!=null){const o=await P(e,m);if(o!==null)throw o}}catch(o){R(e,S,"run could not be armed",o).then(d,n);return}let b=null,T=!1;const D={runId:r,replaced:!1,selfCanceled:!1,kill:i(()=>{b!==null?b():T=!0},"kill")};V(e.cron_id,D),_=i(()=>g(e.cron_id,r),"undo"),s();const x=G()?{executionId:r,kind:"cron",cronId:e.cron_id,fromExec:e.armed_from_exec,grantee:e.grantee,sub:e.sub,grantId:e.grant_id,scopes:e.scopes,originRunId:e.origin_run_id,isolated:e.isolated,anchor:e.anchor_node,uid:await Q(e.grantee),rebuilt:!1,refusal:null}:null,I=i(()=>{x!==null&&X(r)},"closeExecution");_=i(()=>{g(e.cron_id,r),I()},"undo"),i(async()=>(x!==null&&await z(x,e.cwd,e.profile),pe({command:e.command,cwd:e.cwd,env:M,app:e.grantee,isolated:e.isolated,principal:{sub:e.sub,grantId:e.grant_id,scopes:e.scopes},...e.isolated?{folder:e.cwd}:{},...x!==null?{cron:{executionId:r,...e.anchor_node===null||e.isolated?{}:{anchorDir:K(e.anchor_node,e.grantee)}}}:e.anchor_node===null||e.isolated?{}:{nodeId:e.anchor_node},timeoutMs:e.run_timeout_s*1e3,headBytes:E})),"launch")().then(async o=>{if(o.pid===null){g(e.cron_id,r),I(),o.completion.then(l=>{R(e,S,"run failed to spawn",l.processError??new Error("bash did not provide a process id")).then(d,n)},n);return}_=i(()=>{g(e.cron_id,r),I(),o.terminate()},"undo");let w=!1;const v=i(()=>{o.completion.then(l=>{const k=D.replaced,U=D.selfCanceled,H=x?.refusal??null;if(g(e.cron_id,r),I(),w){d(null);return}if(H!==null&&!k){const y=Date.now(),F=A(l.stderr,l.stderrTruncated);O(e,{outOfBand:a,outcome:{kind:"refused",reason:H.reason,message:H.message},record:{runId:r,startedAtIso:C,finishedAtMs:y,durationMs:y-m,exitCode:l.exitCode,stdoutHead:A(l.stdout,l.stdoutTruncated)||null,stderrHead:`${H.reason}: ${H.message}
+${F}`.trim().slice(0,E)},lease:"release"}).then(d,n);return}we(e,{runId:r,outOfBand:a,startedAtIso:C,startedAtMs:m,finishedAtMs:Date.now(),code:l.exitCode,timedOut:l.timedOut,processError:l.processError,stdoutHead:A(l.stdout,l.stdoutTruncated),stderrHead:A(l.stderr,l.stderrTruncated),stdoutSha256:l.stdoutSha256,wasReplaced:k,wasSelfCanceled:U}).then(d,n)},n)},"settleCommand");if(!await ce(e.cron_id,L,C,o.pid)&&!D.selfCanceled){w=!0,o.terminate(),v();return}b=o.terminate,T&&o.terminate(),v()},o=>{g(e.cron_id,r),I(),R(e,S,"run failed to spawn",o).then(d,n)}).catch(p)})().catch(p)});return c.then(s,s),{admitted:u,settled:c}}i(B,"startCron");async function Ue(e,t={}){const a=new Date(e).toISOString();await de(a),await se(e,a);const s=[];for(const u of await ie(a)){const{admitted:c,settled:d}=B(u,{outOfBand:!1}),n=d.then(()=>{});n.catch(()=>{}),await c,s.push(n),t.register?.(n)}for(const u of s)u.catch(()=>{});return s}i(Ue,"runDueCrons");export{Ye as CRON_OUTPUT_HEAD_BYTES,Je as cronDaemonInstanceId,Be as executeCron,Ve as markSelfCanceledCronRun,ze as recoverStaleCronLeases,Ue as runDueCrons,B as startCron};

package/dist/daemon/crtrd-cli.js

@@ -1 +1 @@
-var p=Object.defineProperty;var i=(e,r)=>p(e,"name",{value:r,configurable:!0});import"../suppress-experimental-warnings.js";import{runDaemon as o}from"./crtrd.js";import{configureDaemonHttpDispatcher as c}from"./http-dispatcher.js";function s(e){for(let r=0;r<e.length;r++){const t=e[r];if(t==="--tcp")return e[r+1];if(t!==void 0&&t.startsWith("--tcp="))return t.slice(6)}}i(s,"parseTcpArg");function a(e){return e.includes("--prepare")}i(a,"parsePrepareArg");const n=process.argv.slice(2);if(n[0]==="export-sqlite"){const{runExportSqlite:e}=await import("./export-sqlite-run.js");process.exitCode=await e()}else c(),await o({tcp:s(n),prepare:a(n)});
+var c=Object.defineProperty;var i=(e,r)=>c(e,"name",{value:r,configurable:!0});import"../suppress-experimental-warnings.js";import{runDaemon as p}from"./crtrd.js";import{configureDaemonHttpDispatcher as s}from"./http-dispatcher.js";function l(e){for(let r=0;r<e.length;r++){const t=e[r];if(t==="--tcp")return e[r+1];if(t!==void 0&&t.startsWith("--tcp="))return t.slice(6)}}i(l,"parseTcpArg");function u(e){for(let r=0;r<e.length;r++){const t=e[r],n=t==="--role"?e[r+1]:t?.startsWith("--role=")?t.slice(7):void 0;if(n!==void 0){if(n!=="api"&&n!=="reconcile")throw new Error(`--role must be api or reconcile, got ${n}`);return n}}}i(u,"parseRoleArg");function a(e){return e.includes("--prepare")}i(a,"parsePrepareArg");const o=process.argv.slice(2);if(o[0]==="export-sqlite"){const{runExportSqlite:e}=await import("./export-sqlite-run.js");process.exitCode=await e()}else s(),await p({tcp:l(o),prepare:a(o),role:u(o)});

package/dist/daemon/crtrd.d.ts

@@ -17,7 +17,17 @@ export interface DaemonOpts {
     tcp?: string;
     /** Hold after storage preparation until `POST /v1/daemon/admit`. */
     prepare?: boolean;
+    /** `api`: serves requests, runs no reconciler lane. `reconcile`: runs the lanes and serves only the probe API.
+     *  Absent (a Mac): one process doing both, holding the `daemon_owner` claim. */
+    role?: DaemonRole;
 }
+export type DaemonRole = 'api' | 'reconcile';
+/** Whether a process of this role runs the reconciler lanes and their boot sweeps (an api process does not). */
+export declare function roleRunsLanes(role: DaemonRole | undefined): boolean;
+/** Whether a process of this role serves conversations, documents and the app listener (a reconcile process does not). */
+export declare function roleServesRequests(role: DaemonRole | undefined): boolean;
+/** How long an api process lets in-flight requests run after SIGTERM; `/v1/llm` takes up to 610 s. */
+export declare const API_DRAIN_GRACE_MS = 660000;
 /** Start the supervisor loop after winning the authoritative canvas claim.
  *
  *  A losing claimant stays unbound and returns an inert async teardown so its