@north-light/crouter 0.3.317 → 0.3.319

package/dist/core/runtime/command-surface.js

@@ -1,117 +1 @@
-// command-surface.ts — crouter's own metadata about the commands the engine
-// registers, and the one place that decides whether a command can complete its
-// outcome from a non-terminal chat surface.
-//
-// Eligibility is OPT-IN and fail-closed. An extension registration declares
-// `gateway: true`; a prompt template declares `gateway: true` in frontmatter.
-// Anything else — a missing flag, a malformed value, an unreadable file — is
-// not chat-capable. Capability is NEVER inferred from a command's name, its
-// source, or a hard-coded list, because the command set is whatever the active
-// VM registered, not a catalog crouter ships.
-//
-// pi keeps unknown registration fields on the resolved command object, so
-// `gateway`/`argumentHint` ride along beside `expansion` without touching pi's
-// global registration types. pi's prompt-template loader is the opposite: it
-// parses `argument-hint` into `argumentHint` and DROPS every other frontmatter
-// key. Capture `gateway` from the template file when the loader finishes, so
-// the eligibility and loaded template content share the same reload boundary.
-import { readFileSync } from 'node:fs';
-import { parseFrontmatterGeneric } from '../frontmatter.js';
-const NOT_CAPABLE = { gatewayCapable: false };
-// One resource load declares Gateway capability by extension identity and pi's
-// collision-resolved invocation name. Later registrations from that extension
-// retain only names the load declared.
-let startupGatewayNames = new WeakMap();
-// Pi drops unknown prompt frontmatter keys. This cache restores crouter's
-// metadata without re-reading a template during command disclosure.
-const templateChatSurfaces = new WeakMap();
-function hintOf(value) {
-    return typeof value === 'string' && value.trim() !== '' ? { argumentHint: value } : {};
-}
-/** Read the chat surface off a resolved extension command. `command` is an
- *  arbitrary runtime object from another package, so every field is probed
- *  rather than trusted. */
-export function registrationChatSurface(command) {
-    if (typeof command !== 'object' || command === null)
-        return NOT_CAPABLE;
-    const record = command;
-    const { sourceInfo, invocationName } = record;
-    if (typeof sourceInfo !== 'object' ||
-        sourceInfo === null ||
-        typeof invocationName !== 'string' ||
-        !startupGatewayNames.get(sourceInfo)?.has(invocationName))
-        return NOT_CAPABLE;
-    return { gatewayCapable: true, ...hintOf(record['argumentHint']) };
-}
-function captureExtensionCommandSurfaces(commands) {
-    startupGatewayNames = new WeakMap();
-    if (!Array.isArray(commands))
-        return;
-    for (const command of commands) {
-        if (typeof command !== 'object' || command === null)
-            continue;
-        const record = command;
-        const { sourceInfo, invocationName } = record;
-        if (record['gateway'] !== true ||
-            typeof sourceInfo !== 'object' ||
-            sourceInfo === null ||
-            typeof invocationName !== 'string')
-            continue;
-        const names = startupGatewayNames.get(sourceInfo) ?? new Set();
-        names.add(invocationName);
-        startupGatewayNames.set(sourceInfo, names);
-    }
-}
-/** Capture prompt-template chat metadata immediately after pi loads or reloads
- *  its templates. The opt-in is the template file's own frontmatter; the hint
- *  is pi's already-parsed `argument-hint`. A missing file, unreadable path, or
- *  invalid YAML is not chat-capable. */
-export function capturePromptTemplateChatSurfaces(templates) {
-    if (!Array.isArray(templates))
-        return;
-    for (const template of templates) {
-        if (typeof template !== 'object' || template === null)
-            continue;
-        const { filePath, argumentHint } = template;
-        let surface = NOT_CAPABLE;
-        if (typeof filePath === 'string' && filePath !== '') {
-            try {
-                const frontmatter = parseFrontmatterGeneric(readFileSync(filePath, 'utf8')).data;
-                if (frontmatter?.['gateway'] === true)
-                    surface = { gatewayCapable: true, ...hintOf(argumentHint) };
-            }
-            catch {
-                // Fail closed for malformed or unreadable template metadata.
-            }
-        }
-        templateChatSurfaces.set(template, surface);
-    }
-}
-/** Capture the Gateway capabilities declared by one completed resource load. */
-export function captureChatCapabilities(input) {
-    captureExtensionCommandSurfaces(input.commands);
-    capturePromptTemplateChatSurfaces(input.templates);
-}
-/** Capture every startup-declared command and prompt template a session
- *  currently exposes. A broken getter leaves that surface fail-closed. */
-export function captureSessionChatCapabilities(session) {
-    try {
-        if (typeof session !== 'object' || session === null)
-            return;
-        const value = session;
-        captureChatCapabilities({
-            commands: value.extensionRunner?.getRegisteredCommands?.(),
-            templates: value.promptTemplates,
-        });
-    }
-    catch {
-        // Fail closed when an engine cannot expose its loaded resources.
-    }
-}
-/** Read the chat surface captured for this loaded template. An uncaptured
- *  template is not disclosed to chat surfaces. */
-export function templateChatSurface(template) {
-    if (typeof template !== 'object' || template === null)
-        return NOT_CAPABLE;
-    return templateChatSurfaces.get(template) ?? NOT_CAPABLE;
-}
+var s=Object.defineProperty;var a=(t,e)=>s(t,"name",{value:e,configurable:!0});import{readFileSync as l}from"node:fs";import{parseFrontmatterGeneric as m}from"../frontmatter.js";const c={gatewayCapable:!1};let i=new WeakMap;const u=new WeakMap;function p(t){return typeof t=="string"&&t.trim()!==""?{argumentHint:t}:{}}a(p,"hintOf");function d(t){if(typeof t!="object"||t===null)return c;const e=t,{sourceInfo:r,invocationName:n}=e;return typeof r!="object"||r===null||typeof n!="string"||!i.get(r)?.has(n)?c:{gatewayCapable:!0,...p(e.argumentHint)}}a(d,"registrationChatSurface");function y(t){if(i=new WeakMap,!!Array.isArray(t))for(const e of t){if(typeof e!="object"||e===null)continue;const r=e,{sourceInfo:n,invocationName:o}=r;if(r.gateway!==!0||typeof n!="object"||n===null||typeof o!="string")continue;const f=i.get(n)??new Set;f.add(o),i.set(n,f)}}a(y,"captureExtensionCommandSurfaces");function g(t){if(Array.isArray(t))for(const e of t){if(typeof e!="object"||e===null)continue;const{filePath:r,argumentHint:n}=e;let o=c;if(typeof r=="string"&&r!=="")try{m(l(r,"utf8")).data?.gateway===!0&&(o={gatewayCapable:!0,...p(n)})}catch{}u.set(e,o)}}a(g,"capturePromptTemplateChatSurfaces");function C(t){y(t.commands),g(t.templates)}a(C,"captureChatCapabilities");function S(t){try{if(typeof t!="object"||t===null)return;const e=t;C({commands:e.extensionRunner?.getRegisteredCommands?.(),templates:e.promptTemplates})}catch{}}a(S,"captureSessionChatCapabilities");function j(t){return typeof t!="object"||t===null?c:u.get(t)??c}a(j,"templateChatSurface");export{C as captureChatCapabilities,g as capturePromptTemplateChatSurfaces,S as captureSessionChatCapabilities,d as registrationChatSurface,j as templateChatSurface};

package/dist/core/runtime/connectivity.js

@@ -1,73 +1 @@
-// connectivity.ts — "is the network reachable right now" for the daemon.
-//
-// Used by the daemon's connectivity-recovery pass to decide whether a node
-// parked on a CONNECTION error should be nudged to continue. The signal the
-// user thinks in terms of is "my wifi is back" — so this is a coarse internet-
-// reachability probe, NOT a per-provider health check.
-//
-// Implementation: a fast TCP connect to a couple of well-known anycast resolvers
-// on 443. RAW IPs (no DNS lookup) on purpose — DNS itself fails when the network
-// is down, so resolving a hostname would conflate "wifi down" with "DNS down" and
-// add latency; the IPs below are stable anycast addresses. Online = ANY target
-// accepts a TCP connection within the timeout. Never throws.
-//
-// The broker calls this probe for connection-fault retries; tests can stub it
-// directly where the retry loop is exercised, so the network state stays deterministic.
-import { Socket } from 'node:net';
-/** Anycast resolvers reachable from essentially any connected network. A single
- *  success means the box has working internet; we don't care WHICH target. */
-const PROBE_TARGETS = [
-    { host: '1.1.1.1', port: 443 }, // Cloudflare
-    { host: '8.8.8.8', port: 443 }, // Google
-];
-/** Default per-target connect timeout. Short — a healthy network connects in
- *  tens of ms; a down network should be declared down quickly so the daemon tick
- *  isn't held up. */
-export const PROBE_TIMEOUT_MS = 3000;
-/** Resolve true iff a TCP connection to host:port completes within timeoutMs.
- *  Any error/timeout resolves false (never rejects). The socket is always torn
- *  down. Exported for unit testing against a local listener. */
-export function tcpReachable(host, port, timeoutMs) {
-    return new Promise((resolve) => {
-        const sock = new Socket();
-        let settled = false;
-        const done = (ok) => {
-            if (settled)
-                return;
-            settled = true;
-            try {
-                sock.destroy();
-            }
-            catch {
-                /* already torn down */
-            }
-            resolve(ok);
-        };
-        sock.setTimeout(timeoutMs);
-        sock.once('connect', () => done(true));
-        sock.once('timeout', () => done(false));
-        sock.once('error', () => done(false));
-        try {
-            sock.connect(port, host);
-        }
-        catch {
-            done(false);
-        }
-    });
-}
-/** True when the box can reach the internet (any PROBE_TARGET accepts a TCP
- *  connection within the timeout). The broker uses this for connection-fault
- *  retries. Never throws. */
-export async function probeOnline(timeoutMs = PROBE_TIMEOUT_MS) {
-    try {
-        const results = await Promise.all(PROBE_TARGETS.map((t) => tcpReachable(t.host, t.port, timeoutMs)));
-        return results.some((ok) => ok);
-    }
-    catch {
-        // Promise.all only rejects if a target promise rejects — they never do, but
-        // be defensive: an unexpected throw reads as "can't tell", and "can't tell"
-        // must never claim the network is UP (which would nudge nodes into a retry
-        // that fails again). Treat as offline.
-        return false;
-    }
-}
+var u=Object.defineProperty;var c=(o,r)=>u(o,"name",{value:r,configurable:!0});import{Socket as i}from"node:net";const p=[{host:"1.1.1.1",port:443},{host:"8.8.8.8",port:443}],f=3e3;function m(o,r,t){return new Promise(a=>{const e=new i;let s=!1;const n=c(l=>{if(!s){s=!0;try{e.destroy()}catch{}a(l)}},"done");e.setTimeout(t),e.once("connect",()=>n(!0)),e.once("timeout",()=>n(!1)),e.once("error",()=>n(!1));try{e.connect(r,o)}catch{n(!1)}})}c(m,"tcpReachable");async function T(o=f){try{return(await Promise.all(p.map(t=>m(t.host,t.port,o)))).some(t=>t)}catch{return!1}}c(T,"probeOnline");export{f as PROBE_TIMEOUT_MS,T as probeOnline,m as tcpReachable};

package/dist/core/runtime/deliver-live.js

@@ -1,88 +1 @@
-// deliver-live.ts — push a custom message into a node's ALREADY-BOOTED session
-// without waking it. The answer to "what can a live engine still be told?" for
-// everything that is a CLAIM-time property of a warm spare rather than a
-// mint-time one.
-//
-// Two callers today, both on the warm-pool claim path:
-//   • bearings (`deliverBearingsLive`) — a spare mints with NO bearings, because
-//     a block built at mint would assert the SPARE's persona (always
-//     `general`/`base`) and a snapshot of the repo as it looked whenever the
-//     spare happened to boot. Built and delivered here instead, it is exact for
-//     the node actually handed out. Pushed with no delivery option, so at the
-//     idle start of a still-empty session it lands as the FIRST entry, exactly
-//     where the context-intro extension's session_start injection would have put
-//     it — ahead of the claimant's kickoff prompt.
-//   • situational context (`situational-live.ts`, which layers the durable
-//     sidecar write over this) — `nextTurn`, so it rides the claimant's first
-//     real turn instead of starting one nobody asked for.
-//
-// A DORMANT node needs neither: its next revive renders both into the kickoff.
-import { getNode } from '../canvas/index.js';
-import { oneShotControllerRequest } from './broker-request.js';
-import { isBrokerLive } from './model-swap.js';
-import { buildContextBearings, CONTEXT_INTRO_CUSTOM_TYPE } from './bearings.js';
-import { renderPreferencesForNodeSubject } from './broker-extension-render.js';
-import { assembleNodeSubject } from '../substrate/subject.js';
-import { exposureTarget, freezePreferenceSnapshot, loadContextExposureState, saveContextExposureState, } from '../substrate/injected-store.js';
-import { formatCard } from '../../shared/generated-context.js';
-/** Deliver `message` into `nodeId`'s live session. Resolves without doing
- *  anything when the node has no live broker. Rejects when a live broker cannot
- *  be reached or refuses the frame — the caller decides what that means (for a
- *  warm claim it is fatal: a node wearing the wrong bearings is worse than a
- *  slow one, so the spare is abandoned and the create goes cold). */
-export async function deliverCustomMessageLive(nodeId, message) {
-    const meta = getNode(nodeId);
-    if (meta === null)
-        throw new Error(`deliverCustomMessageLive: unknown node ${nodeId}`);
-    if (!isBrokerLive(meta))
-        return;
-    await oneShotControllerRequest({
-        nodeId,
-        what: `the ${message.customType} delivery`,
-        ackFor: 'deliver_custom_message',
-        frame: () => ({
-            type: 'deliver_custom_message',
-            customType: message.customType,
-            content: message.content,
-            ...(message.deliverAs !== undefined ? { deliverAs: message.deliverAs } : {}),
-            ...(message.details !== undefined ? { details: message.details } : {}),
-        }),
-        result: () => undefined,
-    });
-}
-/** Build and deliver `nodeId`'s bearings into its live session, and freeze the
- *  preference snapshot that goes with them. Called by the warm-pool claim once
- *  the row already wears the claimant's kind/mode/name, so the identity
- *  assertion, the knowledge catalog, the `<project_context>` environment
- *  snapshot, and the preference block are all built for the node being handed
- *  out.
- *
- *  The snapshot is frozen HERE for the same reason bearings are built here: a
- *  spare boots with no claimant, so `canvas-context-intro` skips warm spares
- *  and the block would otherwise assert the SPARE's preferences. Claim is the
- *  first moment the real persona, profile, and cwd exist, and it is the last
- *  moment before the claimant's first turn — which reaches the provider through
- *  the persona gate, and which need not be a typed prompt. A slash command
- *  opens its turn through `sendMessage({ triggerTurn: true })`, and Pi emits
- *  `before_agent_start` only on the typed-prompt path, so the broker's own
- *  freeze in `canvas-doc-substrate` never runs for it.
- *
- *  The `details.nodeId` stamp is what the context-intro extension's idempotency
- *  guard matches on, so a LATER revive of this node sees its own bearings
- *  already on the branch and does not inject a second copy. */
-export async function deliverBearingsLive(nodeId) {
-    // Claim runs in the daemon while the spare's Pi process is already alive.
-    // Persist transcript registrations after Pi accepts the bearings so the
-    // broker merges the same context state before later event deliveries.
-    const contextExposure = loadContextExposureState(nodeId);
-    await deliverCustomMessageLive(nodeId, {
-        customType: CONTEXT_INTRO_CUSTOM_TYPE,
-        content: formatCard('bearings', {}, buildContextBearings(nodeId, exposureTarget(contextExposure, 'transcript'))),
-        details: { nodeId },
-    });
-    const subject = assembleNodeSubject(nodeId);
-    if (subject === null)
-        throw new Error(`deliverBearingsLive: no document subject for ${nodeId}`);
-    freezePreferenceSnapshot(contextExposure, renderPreferencesForNodeSubject(nodeId, subject, exposureTarget(contextExposure, 'system')));
-    saveContextExposureState(nodeId, contextExposure);
-}
+var n=Object.defineProperty;var o=(e,t)=>n(e,"name",{value:t,configurable:!0});import{getNode as s}from"../canvas/index.js";import{oneShotControllerRequest as u}from"./broker-request.js";import{isBrokerLive as a}from"./model-swap.js";import{buildContextBearings as c,CONTEXT_INTRO_CUSTOM_TYPE as m}from"./bearings.js";import{renderPreferencesForNodeSubject as l}from"./broker-extension-render.js";import{assembleNodeSubject as f}from"../substrate/subject.js";import{exposureTarget as i,freezePreferenceSnapshot as p,loadContextExposureState as v,saveContextExposureState as d}from"../substrate/injected-store.js";import{formatCard as x}from"../../shared/generated-context.js";async function T(e,t){const r=s(e);if(r===null)throw new Error(`deliverCustomMessageLive: unknown node ${e}`);a(r)&&await u({nodeId:e,what:`the ${t.customType} delivery`,ackFor:"deliver_custom_message",frame:o(()=>({type:"deliver_custom_message",customType:t.customType,content:t.content,...t.deliverAs!==void 0?{deliverAs:t.deliverAs}:{},...t.details!==void 0?{details:t.details}:{}}),"frame"),result:o(()=>{},"result")})}o(T,"deliverCustomMessageLive");async function N(e){const t=v(e);await T(e,{customType:m,content:x("bearings",{},c(e,i(t,"transcript"))),details:{nodeId:e}});const r=f(e);if(r===null)throw new Error(`deliverBearingsLive: no document subject for ${e}`);p(t,l(e,r,i(t,"system"))),d(e,t)}o(N,"deliverBearingsLive");export{N as deliverBearingsLive,T as deliverCustomMessageLive};

package/dist/core/runtime/fault-recovery.js

@@ -1,83 +1 @@
-const POLICIES = {
-    connection: { kind: 'connection', gate: 'online', max: 8, baseDelayMs: 5_000, capDelayMs: 60_000, fatal: false },
-    'rate-limit': { kind: 'rate-limit', gate: 'time', max: 6, baseDelayMs: 30_000, capDelayMs: 5 * 60_000, fatal: false },
-    overloaded: { kind: 'overloaded', gate: 'time', max: 6, baseDelayMs: 10_000, capDelayMs: 2 * 60_000, fatal: false },
-    auth: { kind: 'auth', gate: 'none', max: 0, baseDelayMs: 0, capDelayMs: 0, fatal: true },
-    protocol: { kind: 'protocol', gate: 'none', max: 0, baseDelayMs: 0, capDelayMs: 0, fatal: true },
-    'context-overflow': { kind: 'context-overflow', gate: 'none', max: 0, baseDelayMs: 0, capDelayMs: 0, fatal: true },
-    other: { kind: 'other', gate: 'none', max: 0, baseDelayMs: 0, capDelayMs: 0, fatal: true },
-    // A wedge is a daemon-detected stall, never auto-retried — recovery is a
-    // deliberate agent/operator decision (kill the runaway subprocess), not a
-    // provider back-off.
-    wedged: { kind: 'wedged', gate: 'none', max: 0, baseDelayMs: 0, capDelayMs: 0, fatal: true },
-    // A launch-time model resolution failure (unregistered/unauthenticated spec) —
-    // never auto-retried, since retrying with the same unresolved model would just
-    // fail again identically. Fixing it requires a new --model or new credentials.
-    'model-not-found': { kind: 'model-not-found', gate: 'none', max: 0, baseDelayMs: 0, capDelayMs: 0, fatal: true },
-};
-export function policyFor(kind) {
-    return POLICIES[kind];
-}
-function clampDelay(delayMs, capMs) {
-    if (!Number.isFinite(delayMs) || delayMs <= 0)
-        return 0;
-    return Math.min(Math.max(1, Math.round(delayMs)), capMs);
-}
-function defaultOverloadedJitterMs(fault, attempt) {
-    const seed = `${fault.link}|${fault.kind}|${fault.message}|${fault.since}|${attempt}`;
-    let hash = 0;
-    for (let i = 0; i < seed.length; i++) {
-        hash = (hash * 33 + seed.charCodeAt(i)) >>> 0;
-    }
-    return hash % 1_000;
-}
-function retryDelayMs(fault, attempt, opts) {
-    const policy = policyFor(fault.kind);
-    if (policy.fatal)
-        return 0;
-    if (fault.kind === 'rate-limit' && typeof opts?.retryAfterMs === 'number' && Number.isFinite(opts.retryAfterMs)) {
-        return clampDelay(opts.retryAfterMs, policy.capDelayMs);
-    }
-    const delay = policy.baseDelayMs * 2 ** Math.max(0, attempt - 1);
-    const jitter = fault.kind === 'overloaded'
-        ? Math.max(0, Math.round(opts?.jitterMs?.(fault, attempt) ?? defaultOverloadedJitterMs(fault, attempt)))
-        : 0;
-    return clampDelay(delay + jitter, policy.capDelayMs);
-}
-export function nextFaultRetry(fault, now, opts) {
-    const policy = policyFor(fault.kind);
-    if (policy.fatal)
-        return null;
-    const attempt = (fault.retry.attempt ?? 0) + 1;
-    if (attempt > policy.max)
-        return null;
-    const delayMs = retryDelayMs(fault, attempt, opts);
-    return {
-        fault: {
-            ...fault,
-            retry: {
-                ...fault.retry,
-                disposition: 'auto',
-                by: fault.retry.by ?? 'daemon',
-                attempt,
-                max: policy.max,
-                nextAt: new Date(now + delayMs).toISOString(),
-            },
-        },
-        attempt,
-        max: policy.max,
-        nextAt: new Date(now + delayMs).toISOString(),
-        delayMs,
-    };
-}
-export function markFatalOnExhaust(fault) {
-    const retry = {
-        ...fault.retry,
-        disposition: 'fatal',
-        by: fault.retry.by ?? 'daemon',
-        max: policyFor(fault.kind).max,
-        attempt: fault.retry.attempt ?? 0,
-    };
-    delete retry.nextAt;
-    return { ...fault, retry };
-}
+var y=Object.defineProperty;var o=(e,t)=>y(e,"name",{value:t,configurable:!0});const d={connection:{kind:"connection",gate:"online",max:8,baseDelayMs:5e3,capDelayMs:6e4,fatal:!1},"rate-limit":{kind:"rate-limit",gate:"time",max:6,baseDelayMs:3e4,capDelayMs:3e5,fatal:!1},overloaded:{kind:"overloaded",gate:"time",max:6,baseDelayMs:1e4,capDelayMs:12e4,fatal:!1},auth:{kind:"auth",gate:"none",max:0,baseDelayMs:0,capDelayMs:0,fatal:!0},protocol:{kind:"protocol",gate:"none",max:0,baseDelayMs:0,capDelayMs:0,fatal:!0},"context-overflow":{kind:"context-overflow",gate:"none",max:0,baseDelayMs:0,capDelayMs:0,fatal:!0},other:{kind:"other",gate:"none",max:0,baseDelayMs:0,capDelayMs:0,fatal:!0},wedged:{kind:"wedged",gate:"none",max:0,baseDelayMs:0,capDelayMs:0,fatal:!0},"model-not-found":{kind:"model-not-found",gate:"none",max:0,baseDelayMs:0,capDelayMs:0,fatal:!0}};function s(e){return d[e]}o(s,"policyFor");function l(e,t){return!Number.isFinite(e)||e<=0?0:Math.min(Math.max(1,Math.round(e)),t)}o(l,"clampDelay");function c(e,t){const r=`${e.link}|${e.kind}|${e.message}|${e.since}|${t}`;let a=0;for(let n=0;n<r.length;n++)a=a*33+r.charCodeAt(n)>>>0;return a%1e3}o(c,"defaultOverloadedJitterMs");function m(e,t,r){const a=s(e.kind);if(a.fatal)return 0;if(e.kind==="rate-limit"&&typeof r?.retryAfterMs=="number"&&Number.isFinite(r.retryAfterMs))return l(r.retryAfterMs,a.capDelayMs);const n=a.baseDelayMs*2**Math.max(0,t-1),i=e.kind==="overloaded"?Math.max(0,Math.round(r?.jitterMs?.(e,t)??c(e,t))):0;return l(n+i,a.capDelayMs)}o(m,"retryDelayMs");function x(e,t,r){const a=s(e.kind);if(a.fatal)return null;const n=(e.retry.attempt??0)+1;if(n>a.max)return null;const i=m(e,n,r);return{fault:{...e,retry:{...e.retry,disposition:"auto",by:e.retry.by??"daemon",attempt:n,max:a.max,nextAt:new Date(t+i).toISOString()}},attempt:n,max:a.max,nextAt:new Date(t+i).toISOString(),delayMs:i}}o(x,"nextFaultRetry");function D(e){const t={...e.retry,disposition:"fatal",by:e.retry.by??"daemon",max:s(e.kind).max,attempt:e.retry.attempt??0};return delete t.nextAt,{...e,retry:t}}o(D,"markFatalOnExhaust");export{D as markFatalOnExhaust,x as nextFaultRetry,s as policyFor};

package/dist/core/runtime/fault.js

@@ -1,17 +1 @@
-export const FAULT_QUIET_MS = 5 * 60_000;
-/** True when Pi could not resolve credentials for a provider. */
-export function isProviderUnconfiguredError(message) {
-    const value = message ?? '';
-    if (/provider is not configured\b/i.test(value))
-        return true;
-    return /credential store (?:read|modify) failed\b/i.test(value);
-}
-/** True when a provider reports that a requested model is unavailable. */
-export function isModelNotFoundError(message) {
-    const value = message ?? '';
-    if (/not_found_error/i.test(value))
-        return true;
-    if (/model[^.]{0,40}(not\s*found|does not exist|is not available|unavailable)|(no such|unknown) model/i.test(value))
-        return true;
-    return /\b404\b/.test(value) && /not\s*found|not available|does not exist/i.test(value);
-}
+var r=Object.defineProperty;var o=(e,t)=>r(e,"name",{value:t,configurable:!0});const i=3e5;function s(e){const t=e??"";return/provider is not configured\b/i.test(t)?!0:/credential store (?:read|modify) failed\b/i.test(t)}o(s,"isProviderUnconfiguredError");function u(e){const t=e??"";return/not_found_error/i.test(t)||/model[^.]{0,40}(not\s*found|does not exist|is not available|unavailable)|(no such|unknown) model/i.test(t)?!0:/\b404\b/.test(t)&&/not\s*found|not available|does not exist/i.test(t)}o(u,"isModelNotFoundError");export{i as FAULT_QUIET_MS,u as isModelNotFoundError,s as isProviderUnconfiguredError};

package/dist/core/runtime/fleet.js

@@ -1,58 +1 @@
-// src/core/runtime/fleet.ts — the fleet-registry SEAM (daemon-epoch broker
-// ownership). Core defines the interface and a process-global binding holder;
-// the daemon (src/daemon/fleet.ts) constructs the one real implementation at
-// boot and injects it via `bindFleet` — the same core-seam/daemon-impl split as
-// `bindDaemonEventSource` (events/source.ts). No core→daemon import exists.
-//
-// The registry is the daemon's normal liveness authority: every broker launch
-// (`headlessBrokerHost.launch`) synchronously registers the ChildProcess-backed
-// handle here, and the handle's real `exit` event — not any pid probe — drives
-// dead-node policy. `boundFleet()` THROWS when no registry is bound, which is
-// the structural enforcement that broker launches happen only inside crtrd
-// (design D-2): a CLI or library process has no fleet and cannot launch an
-// unowned broker.
-import { readConfig } from '../config.js';
-import { InputError } from '../io.js';
-import { envMaxLiveBrokers, envWarnLiveBrokers } from '../../shared/env.js';
-/** The daemon's live-broker thresholds. The hard cap is the ledger's admission
- *  bound; `warning` is the saturation notice supervision fires below it. Lives
- *  here — beside the ledger that enforces it — so the ledger, a refusal
- *  message, and supervision's warning all read ONE definition. */
-export function brokerThresholdsForDaemon() {
-    const configured = readConfig('user').brokerThresholds;
-    const automaticReviveCap = envMaxLiveBrokers() ?? configured.automaticReviveCap;
-    const warning = envWarnLiveBrokers() ?? configured.warning;
-    return { warning: Math.min(warning, automaticReviveCap), automaticReviveCap };
-}
-/** The typed refusal a caller that cannot wait gets when the ledger is full.
- *  An InputError so its details round-trip through crtrd's error body and reach
- *  a CLI caller as the real cap text instead of an opaque 5xx. */
-export function brokerCapReached(cap, live) {
-    return new InputError({
-        error: 'broker_cap_reached',
-        message: `no broker slot is free — ${live} live brokers at the cap of ${cap}.`,
-        next: `Finish or close a live node (\`crtr canvas dashboard\` shows them), or raise the cap with CRTR_MAX_LIVE_BROKERS, then retry.`,
-    });
-}
-let bound;
-/** Inject the daemon's fleet registry. Idempotent for the same instance;
- *  throws on a conflicting rebind (one registry per process, ever). */
-export function bindFleet(registry) {
-    if (bound !== undefined && bound !== registry) {
-        throw new Error('a fleet registry is already bound for this process');
-    }
-    bound = registry;
-}
-/** The bound registry. Throws when unbound: broker launches happen only inside
- *  crtrd (or a test harness that explicitly bound an in-process fleet). */
-export function boundFleet() {
-    if (bound === undefined) {
-        throw new Error('no fleet registry is bound in this process — broker launches happen only inside crtrd (route launch verbs through the /v1 API)');
-    }
-    return bound;
-}
-/** Test-only: clear the process-global binding, mirroring
- *  resetEventSourceForTests. Production processes bind exactly once. */
-export function resetFleetForTests() {
-    bound = undefined;
-}
+var i=Object.defineProperty;var o=(e,r)=>i(e,"name",{value:r,configurable:!0});import{readConfig as s}from"../config.js";import{InputError as a}from"../io.js";import{envMaxLiveBrokers as h,envWarnLiveBrokers as c}from"../../shared/env.js";function l(){const e=s("user").brokerThresholds,r=h()??e.automaticReviveCap,t=c()??e.warning;return{warning:Math.min(t,r),automaticReviveCap:r}}o(l,"brokerThresholdsForDaemon");function b(e,r){return new a({error:"broker_cap_reached",message:`no broker slot is free \u2014 ${r} live brokers at the cap of ${e}.`,next:"Finish or close a live node (`crtr canvas dashboard` shows them), or raise the cap with CRTR_MAX_LIVE_BROKERS, then retry."})}o(b,"brokerCapReached");let n;function v(e){if(n!==void 0&&n!==e)throw new Error("a fleet registry is already bound for this process");n=e}o(v,"bindFleet");function m(){if(n===void 0)throw new Error("no fleet registry is bound in this process \u2014 broker launches happen only inside crtrd (route launch verbs through the /v1 API)");return n}o(m,"boundFleet");function w(){n=void 0}o(w,"resetFleetForTests");export{v as bindFleet,m as boundFleet,b as brokerCapReached,l as brokerThresholdsForDaemon,w as resetFleetForTests};

package/dist/core/runtime/front-door-env.js

@@ -1,16 +1 @@
-// The front-door recursion-guard env name, alone in a dependency-free module.
-//
-// `front-door.ts` owns the boot path and reaches the canvas through the
-// dynamic imports inside `maybeBootRoot`; every module that only needs the
-// MARKER NAME must not inherit that reach. The shipped broker extensions are
-// gated on their static import graph, which cannot tell a lazily-imported boot
-// dependency from an eagerly-loaded one, so importing the constant from
-// `front-door.js` reads as an extension reaching canvas.db.
-//
-// `front-door.ts` re-exports this, so `FRONT_DOOR_ENV` stays importable from
-// either module and every pi-booting path keeps setting the same marker.
-/** Env marker set on every pi the front door boots. Its presence means we are
- *  already inside a front-door-booted root, so a nested front-door launch must
- *  be refused — otherwise a removed/renamed subcommand that a child pi re-runs
- *  (e.g. `crtr node -h`) fork-bombs pi until the machine must be rebooted. */
-export const FRONT_DOOR_ENV = 'CRTR_FRONT_DOOR';
+const O="CRTR_FRONT_DOOR";export{O as FRONT_DOOR_ENV};