@north-light/crouter 0.3.317 → 0.3.319

package/dist/core/shell-segments.js

@@ -1,169 +1,4 @@
-// shell-segments.ts — best-effort shell text reading, shared by everything in
-// crtr that has to reason about a command string it did not execute: the doc
-// substrate's `command`/`pre-command` surface matching and the bash valve's
-// refusals. Pure text in, structure out; no execution, no expansion.
-//
-// This is deliberately NOT a shell parser. Subshells, backticks, process
-// substitution, and path-prefixed binaries stay unhandled. Every caller must
-// treat a miss as "this text did not obviously do X", never as "this text
-// cannot do X".
-/** Split a command into shell segments on unquoted `;`, newline, `&&`, `||`,
- *  `|`, and a single `&`. Subshell parentheses and backticks are left inside
- *  their segment. Heredoc bodies are a separate pre-read concern (see
- *  `stripHeredocs`). */
-export function splitCommandSegments(command) {
-    const segments = [];
-    let current = '';
-    let quote = null;
-    let escaped = false;
-    const finish = (background = false) => {
-        segments.push({ text: current, background });
-        current = '';
-    };
-    for (let i = 0; i < command.length; i += 1) {
-        const ch = command[i];
-        if (escaped) {
-            current += ch;
-            escaped = false;
-            continue;
-        }
-        if (ch === '\\' && quote !== "'") {
-            current += ch;
-            escaped = true;
-            continue;
-        }
-        if (quote !== null) {
-            current += ch;
-            if (ch === quote)
-                quote = null;
-            continue;
-        }
-        if (ch === "'" || ch === '"') {
-            current += ch;
-            quote = ch;
-            continue;
-        }
-        if (ch === '\n' || ch === ';') {
-            finish();
-            continue;
-        }
-        if ((ch === '&' || ch === '|') && command[i + 1] === ch) {
-            finish();
-            i += 1;
-            continue;
-        }
-        if (ch === '|') {
-            finish();
-            continue;
-        }
-        if (ch === '&') {
-            finish(true);
-            continue;
-        }
-        current += ch;
-    }
-    finish();
-    return segments;
-}
-/** Tokenize one segment into shell words, marking quoted spans opaque. */
-export function tokenizeCommandSegment(segment) {
-    const tokens = [];
-    let text = '';
-    let opaque = false;
-    let started = false;
-    let quote = null;
-    let escaped = false;
-    const finish = () => {
-        if (started)
-            tokens.push({ text, opaque });
-        text = '';
-        opaque = false;
-        started = false;
-    };
-    for (let i = 0; i < segment.length; i += 1) {
-        const ch = segment[i];
-        if (escaped) {
-            text += ch;
-            started = true;
-            escaped = false;
-            continue;
-        }
-        if (ch === '\\' && quote !== "'") {
-            escaped = true;
-            started = true;
-            continue;
-        }
-        if (quote !== null) {
-            started = true;
-            if (ch === quote) {
-                quote = null;
-            }
-            else {
-                text += ch;
-            }
-            continue;
-        }
-        if (ch === "'" || ch === '"') {
-            quote = ch;
-            opaque = true;
-            started = true;
-            continue;
-        }
-        if (/\s/.test(ch)) {
-            finish();
-            continue;
-        }
-        text += ch;
-        started = true;
-    }
-    if (escaped)
-        text += '\\';
-    finish();
-    return tokens;
-}
-/** Every non-empty command segment, paired with its raw text. */
-export function commandSegments(command) {
-    return splitCommandSegments(command)
-        .map(({ text, background }) => {
-        const tokens = tokenizeCommandSegment(text);
-        let first = 0;
-        while (first < tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[first].text))
-            first += 1;
-        return { text: text.trim(), assignments: tokens.slice(0, first).map((t) => t.text), tokens: tokens.slice(first), background };
-    })
-        .filter((segment) => segment.assignments.length > 0 || segment.tokens.length > 0);
-}
-const HEREDOC_OPEN = /<<(-?)\s*(["']?)([A-Za-z_][A-Za-z0-9_]*)\2/g;
-/** Remove heredoc BODIES (the stdin data between `<<DELIM` and its closing
- *  `DELIM` line) from a command before it is read. The opening line is kept —
- *  `crtr push final <<'EOF'` is still a real `push final` invocation — but the
- *  body lines, which are data fed on stdin and never executed as commands, are
- *  dropped. Without this, a doc-writing command whose body merely MENTIONS a
- *  matched invocation would have its whole call held or refused. */
-export function stripHeredocs(command) {
-    const lines = command.split('\n');
-    const out = [];
-    let i = 0;
-    while (i < lines.length) {
-        const line = lines[i];
-        out.push(line);
-        i += 1;
-        // Every heredoc opened on this line, left to right; their bodies stack and
-        // are consumed in that order.
-        const delims = [];
-        HEREDOC_OPEN.lastIndex = 0;
-        let m;
-        while ((m = HEREDOC_OPEN.exec(line)) !== null)
-            delims.push({ name: m[3], dash: m[1] === '-' });
-        for (const d of delims) {
-            while (i < lines.length) {
-                // `<<-` strips leading TABS from the body and the closing delimiter.
-                const probe = d.dash ? lines[i].replace(/^\t+/, '') : lines[i];
-                i += 1;
-                if (probe === d.name)
-                    break; // closing delimiter line — drop it, stop
-            }
-        }
-    }
-    return out.join('\n');
-}
+var h=Object.defineProperty;var f=(u,i)=>h(u,"name",{value:i,configurable:!0});function p(u){const i=[];let s="",t=null,n=!1;const l=f((o=!1)=>{i.push({text:s,background:o}),s=""},"finish");for(let o=0;o<u.length;o+=1){const e=u[o];if(n){s+=e,n=!1;continue}if(e==="\\"&&t!=="'"){s+=e,n=!0;continue}if(t!==null){s+=e,e===t&&(t=null);continue}if(e==="'"||e==='"'){s+=e,t=e;continue}if(e===`
+`||e===";"){l();continue}if((e==="&"||e==="|")&&u[o+1]===e){l(),o+=1;continue}if(e==="|"){l();continue}if(e==="&"){l(!0);continue}s+=e}return l(),i}f(p,"splitCommandSegments");function m(u){const i=[];let s="",t=!1,n=!1,l=null,o=!1;const e=f(()=>{n&&i.push({text:s,opaque:t}),s="",t=!1,n=!1},"finish");for(let r=0;r<u.length;r+=1){const c=u[r];if(o){s+=c,n=!0,o=!1;continue}if(c==="\\"&&l!=="'"){o=!0,n=!0;continue}if(l!==null){n=!0,c===l?l=null:s+=c;continue}if(c==="'"||c==='"'){l=c,t=!0,n=!0;continue}if(/\s/.test(c)){e();continue}s+=c,n=!0}return o&&(s+="\\"),e(),i}f(m,"tokenizeCommandSegment");function d(u){return p(u).map(({text:i,background:s})=>{const t=m(i);let n=0;for(;n<t.length&&/^[A-Za-z_][A-Za-z0-9_]*=/.test(t[n].text);)n+=1;return{text:i.trim(),assignments:t.slice(0,n).map(l=>l.text),tokens:t.slice(n),background:s}}).filter(i=>i.assignments.length>0||i.tokens.length>0)}f(d,"commandSegments");const a=/<<(-?)\s*(["']?)([A-Za-z_][A-Za-z0-9_]*)\2/g;function x(u){const i=u.split(`
+`),s=[];let t=0;for(;t<i.length;){const n=i[t];s.push(n),t+=1;const l=[];a.lastIndex=0;let o;for(;(o=a.exec(n))!==null;)l.push({name:o[3],dash:o[1]==="-"});for(const e of l)for(;t<i.length;){const r=e.dash?i[t].replace(/^\t+/,""):i[t];if(t+=1,r===e.name)break}}return s.join(`
+`)}f(x,"stripHeredocs");export{d as commandSegments,p as splitCommandSegments,x as stripHeredocs,m as tokenizeCommandSegment};

package/dist/core/spawn.js

@@ -1,26 +1 @@
-// Tmux reachability for the `human` command tree.
-//
-// The human surface gates on whether the canvas tmux server is reachable
-// (tmuxServerReachable) so it can decide whether to surface a prompt or degrade
-// to the inbox-drain follow-up. The canvas runtime has its own
-// one-window-per-node machinery in core/runtime/placement-tmux.ts.
-import { tmuxClientsReachable } from './runtime/tmux-driver.js';
-/** Does THIS process sit inside a tmux client (its own $TMUX is set)? NOT the
- *  gate for the human surface — see tmuxServerReachable. A headless-broker child
- *  strips TMUX/TMUX_PANE (broker.ts, anti-stophook-hijack) yet can still drive
- *  the canvas tmux server, so gating the surface on this wrongly starves broker
- *  nodes of human-in-the-loop. */
-export function isInTmux() {
-    return Boolean(process.env.TMUX);
-}
-/** Is the canvas tmux SERVER reachable? The canvas runs on the DEFAULT tmux
- *  socket (no -L/-S in core/runtime/tmux-driver.ts), so any `crtr` child — including a
- *  headless-broker child that has deleted its own $TMUX — can split panes into
- *  it. The human surface gates on THIS (can I reach the server to open a pane
- *  the user is watching?), not on the caller's $TMUX. `list-clients` exits 0
- *  whenever a server is up (even with zero attached clients) and non-zero when
- *  no server is running — the true "no tmux to surface into" case that should
- *  degrade to the inbox-drain follow-up. */
-export function tmuxServerReachable() {
-    return tmuxClientsReachable();
-}
+var t=Object.defineProperty;var e=(r,n)=>t(r,"name",{value:n,configurable:!0});import{tmuxClientsReachable as o}from"./runtime/tmux-driver.js";function c(){return!!process.env.TMUX}e(c,"isInTmux");function i(){return o()}e(i,"tmuxServerReachable");export{c as isInTmux,i as tmuxServerReachable};

package/dist/core/stdout-errors.js

@@ -1,14 +1 @@
-/** Install the CLI's single stdout failure policy before dispatch begins. */
-export function installStdoutErrorPolicy(stdout = process.stdout, exit = process.exit) {
-    let exitingForBrokenPipe = false;
-    stdout.on('error', (error) => {
-        if (error.code !== 'EPIPE')
-            throw error;
-        if (exitingForBrokenPipe)
-            return;
-        exitingForBrokenPipe = true;
-        // Let writeStdout's per-write delivery listener settle before ending the
-        // process, so output-gated side effects remain gated on actual delivery.
-        setImmediate(() => exit(0));
-    });
-}
+var s=Object.defineProperty;var i=(e,t)=>s(e,"name",{value:t,configurable:!0});function c(e=process.stdout,t=process.exit){let o=!1;e.on("error",r=>{if(r.code!=="EPIPE")throw r;o||(o=!0,setImmediate(()=>t(0)))})}i(c,"installStdoutErrorPolicy");export{c as installStdoutErrorPolicy};

package/dist/core/subscription-state.js

@@ -1,193 +1,3 @@
-import { createHash, randomUUID } from 'node:crypto';
-import { join } from 'node:path';
-import { LockedJsonFile } from './locked-file.js';
-import { piAgentDir } from './runtime/package-health.js';
-import { openScopedStore } from './scoped-state/db.js';
-import { providerStore } from './scoped-state/paths.js';
-import { providerRowByReference, providerRows, providerWrite } from './scoped-state/providers.js';
-export const ANTHROPIC_PROVIDER_ID = 'anthropic';
-export const OPENAI_CODEX_PROVIDER_ID = 'openai-codex';
-export const INVALID_REFRESH_TOKEN_BACKOFF_MS = 30 * 24 * 60 * 60 * 1000;
-const DEFAULT_FALLBACK_STRENGTH = 'strong';
-const PROVIDERS = { anthropic: { label: 'Claude', credentials: 'anthropic-credentials.json' }, 'openai-codex': { label: 'OpenAI Codex', credentials: 'openai-codex-credentials.json' } };
-function agentDir() { return piAgentDir(); }
-function credentialFile(provider) { return join(agentDir(), PROVIDERS[provider].credentials); }
-function normalizeStrength(value) { return value === 'ultra' || value === 'strong' || value === 'medium' || value === 'light' ? value : undefined; }
-function key(label) { return label.toLowerCase(); }
-function credential(input) { const label = typeof input.label === 'string' ? input.label.trim() : ''; const refresh = typeof input.refresh === 'string' ? input.refresh.trim() : ''; const access = typeof input.access === 'string' ? input.access.trim() : ''; const expires = Number(input.expires); if (!label || !refresh || !access || !Number.isFinite(expires))
-    return undefined; const accountId = typeof input.accountId === 'string' && input.accountId.trim() ? input.accountId.trim() : undefined; return { label, refresh, access, expires, rateLimitedUntil: Number.isFinite(Number(input.rateLimitedUntil)) ? Number(input.rateLimitedUntil) : 0, lastAttemptAt: Number.isFinite(Number(input.lastAttemptAt)) ? Number(input.lastAttemptAt) : 0, lastRateLimitedAt: Number.isFinite(Number(input.lastRateLimitedAt)) ? Number(input.lastRateLimitedAt) : 0, ...(input.authFailure === 'invalid_grant' ? { authFailure: 'invalid_grant' } : {}), ...(accountId ? { accountId } : {}) }; }
-function assertCredential(provider, entry) { if (!entry.label?.trim())
-    throw new Error(`${getProviderLabel(provider)} subscription label cannot be empty`); const result = credential(entry); if (!result)
-    throw new Error(`Refusing to persist incomplete ${getProviderLabel(provider)} subscription "${entry.label.trim()}"; pool rows require both OAuth tokens.`); return result; }
-function parseCredentials(path, current) { if (!current || current.trim() === '')
-    return { version: 1, accounts: {} }; let parsed; try {
-    parsed = JSON.parse(current);
-}
-catch (error) {
-    throw new Error(`managed credential file ${path} is corrupt: ${error instanceof Error ? error.message : String(error)}`);
-} if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed) || parsed.version !== 1 || typeof parsed.accounts !== 'object' || parsed.accounts === null || Array.isArray(parsed.accounts))
-    throw new Error(`managed credential file ${path} is corrupt`); return parsed; }
-function toPublic(row, file) { const stored = file.accounts[row.id]; if (!stored || typeof stored.refresh !== 'string' || typeof stored.access !== 'string' || !Number.isFinite(stored.expires))
-    throw new Error(`managed ${row.providerId} account ${row.id} has no credential record`); return { label: row.label, refresh: stored.refresh, access: stored.access, expires: stored.expires, rateLimitedUntil: row.rateLimitedUntil, lastAttemptAt: row.lastAttemptAt, lastRateLimitedAt: row.lastRateLimitedAt, ...(row.authFailure ? { authFailure: row.authFailure } : {}), ...(stored.accountId ? { accountId: stored.accountId } : {}) }; }
-function rowsWithCredentials(provider, file) { return providerRows(agentDir(), provider).map((row) => ({ row, entry: toPublic(row, file) })); }
-function managedCredentialFile(provider) { return new LockedJsonFile(credentialFile(provider), true, '{"version":1,"accounts":{}}\n'); }
-function readFile(provider) { return parseCredentials(credentialFile(provider), managedCredentialFile(provider).readUnlocked()); }
-function identity(entry) { return entry.accountId?.trim() || (entry.refresh.trim() ? `refresh:${createHash('sha256').update(entry.refresh.trim()).digest('hex')}` : undefined); }
-function assertTokens(provider, label, value) { const refresh = value.refresh?.trim() ?? ''; const access = value.access?.trim() ?? ''; const expires = Number(value.expires); if (!refresh || !access || !Number.isFinite(expires))
-    throw new Error(`${getProviderLabel(provider)} subscription "${label}" returned an incomplete credential; the stored credential was left unchanged.`); return { refresh, access, expires }; }
-export function isManagedProvider(providerId) { return providerId === ANTHROPIC_PROVIDER_ID || providerId === OPENAI_CODEX_PROVIDER_ID; }
-export function getProviderLabel(providerId) { return PROVIDERS[providerId].label; }
-export function resolveProviderCandidates(candidates, now = Date.now(), options = {}) { const viable = []; const rejected = []; for (let i = 0; i < candidates.length; i++) {
-    const candidate = candidates[i];
-    const reason = !candidate.registered ? 'unregistered' : candidate.automaticFallback === false ? 'non-managed-fallback' : !candidate.authenticated ? 'unauthenticated' : (candidate.coolingUntil ?? 0) > now ? 'cooling' : undefined;
-    if (!reason)
-        viable.push(candidate);
-    else {
-        rejected.push({ candidate, reason });
-        if (options.pinnedToFirst && i === 0 && reason !== 'cooling')
-            break;
-    }
-} return { candidates: viable, rejected }; }
-export class DuplicateSubscriptionError extends Error {
-    constructor(message) { super(message); this.name = 'DuplicateSubscriptionError'; }
-}
-export function readSubscriptionPool(provider) { return rowsWithCredentials(provider, readFile(provider)).map(({ entry }) => entry); }
-async function locked(provider, run) { const path = credentialFile(provider); return managedCredentialFile(provider).withLockAsync(async (current, _held, publish) => { const file = parseCredentials(path, current); return { result: await run(file, rowsWithCredentials(provider, file), (next) => publish(`${JSON.stringify(next)}\n`)) }; }); }
-function insert(db, provider, row) { db.prepare('INSERT INTO managed_accounts(provider_id,id,label,label_key,position,last_attempt_at,last_rate_limited_at,rate_limited_until,auth_failure) VALUES(?,?,?,?,?,?,?,?,?)').run(provider, row.id, row.label, row.labelKey, row.position, row.lastAttemptAt, row.lastRateLimitedAt, row.rateLimitedUntil, row.authFailure ?? null); }
-function update(db, row) { db.prepare('UPDATE managed_accounts SET label=?,label_key=?,position=?,last_attempt_at=?,last_rate_limited_at=?,rate_limited_until=?,auth_failure=? WHERE provider_id=? AND id=?').run(row.label, row.labelKey, row.position, row.lastAttemptAt, row.lastRateLimitedAt, row.rateLimitedUntil, row.authFailure ?? null, row.providerId, row.id); }
-function publicPool(provider, file) { return rowsWithCredentials(provider, file).map(({ entry }) => entry); }
-function writeMembershipAfterCredentialPublish(provider, write) { try {
-    write();
-}
-catch (error) {
-    throw new Error(`managed ${getProviderLabel(provider)} credential file was published, but its SQL membership update failed; SQL membership remains authoritative: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
-} }
-export async function writeSubscriptionPool(provider, next) { return locked(provider, async (file, rows, publish) => { const normalized = next.map((entry) => assertCredential(provider, entry)); const ids = normalized.map((entry, index) => ({ entry, id: rows[index]?.row.id ?? randomUUID() })); const accounts = {}; for (const { entry, id } of ids)
-    accounts[id] = { refresh: entry.refresh, access: entry.access, expires: entry.expires, ...(entry.accountId ? { accountId: entry.accountId } : {}) }; publish({ version: 1, accounts }); writeMembershipAfterCredentialPublish(provider, () => providerWrite(agentDir(), (db) => { db.prepare('DELETE FROM managed_accounts WHERE provider_id=?').run(provider); ids.forEach(({ entry, id }, position) => insert(db, provider, { providerId: provider, id, label: entry.label, labelKey: key(entry.label), position, lastAttemptAt: entry.lastAttemptAt, lastRateLimitedAt: entry.lastRateLimitedAt, rateLimitedUntil: entry.rateLimitedUntil, ...(entry.authFailure ? { authFailure: entry.authFailure } : {}) })); })); return normalized; }); }
-function resolve(rows, ref) { const needle = ref.trim().toLowerCase(); const number = Number.parseInt(needle, 10); if (Number.isFinite(number) && String(number) === needle && number >= 1 && number <= rows.length)
-    return number - 1; return rows.findIndex(({ entry }) => key(entry.label) === needle); }
-export async function addSubscription(provider, entry) { const checked = assertCredential(provider, entry); return locked(provider, async (file, rows, publish) => { if (rows.some(({ entry: existing }) => key(existing.label) === key(checked.label)))
-    throw new DuplicateSubscriptionError(`${getProviderLabel(provider)} subscription already exists: ${checked.label}`); const same = identity(checked); const collision = rows.find(({ entry: existing }) => identity(existing) === same); if (same && collision)
-    throw new DuplicateSubscriptionError(`This ${getProviderLabel(provider)} account is already added as “${collision.entry.label}” — it shares the same quota, so a second slot adds no redundancy.`); const id = randomUUID(); file.accounts[id] = { refresh: checked.refresh, access: checked.access, expires: checked.expires, ...(checked.accountId ? { accountId: checked.accountId } : {}) }; publish(file); writeMembershipAfterCredentialPublish(provider, () => providerWrite(agentDir(), (db) => insert(db, provider, { providerId: provider, id, label: checked.label, labelKey: key(checked.label), position: rows.length, lastAttemptAt: checked.lastAttemptAt, lastRateLimitedAt: checked.lastRateLimitedAt, rateLimitedUntil: checked.rateLimitedUntil, ...(checked.authFailure ? { authFailure: checked.authFailure } : {}) }))); return publicPool(provider, file); }); }
-export async function upsertSubscription(provider, entry) { const checked = assertCredential(provider, entry); const existing = readSubscriptionPool(provider).find((x) => key(x.label) === key(checked.label)); return existing ? upsertSubscriptionWithUniqueAccount(provider, checked) : addSubscription(provider, checked); }
-export async function upsertSubscriptionWithUniqueAccount(provider, entry) {
-    const checked = assertCredential(provider, entry);
-    return locked(provider, async (file, rows, publish) => {
-        const index = rows.findIndex(({ entry: existing }) => key(existing.label) === key(checked.label));
-        const existing = rows[index];
-        const duplicate = rows.find(({ entry: other }, i) => i !== index && identity(other) === identity(checked));
-        if (identity(checked) && duplicate)
-            throw new DuplicateSubscriptionError(`This ${getProviderLabel(provider)} account is already added as “${duplicate.entry.label}” — it shares the same quota, so a second slot adds no redundancy.`);
-        if (!existing) {
-            const id = randomUUID();
-            file.accounts[id] = { refresh: checked.refresh, access: checked.access, expires: checked.expires, ...(checked.accountId ? { accountId: checked.accountId } : {}) };
-            publish(file);
-            writeMembershipAfterCredentialPublish(provider, () => providerWrite(agentDir(), (db) => insert(db, provider, { providerId: provider, id, label: checked.label, labelKey: key(checked.label), position: rows.length, lastAttemptAt: checked.lastAttemptAt, lastRateLimitedAt: checked.lastRateLimitedAt, rateLimitedUntil: checked.rateLimitedUntil })));
-            return publicPool(provider, file);
-        }
-        const row = existing.row;
-        const cooldownIncoming = checked.lastRateLimitedAt >= row.lastRateLimitedAt;
-        file.accounts[row.id] = { refresh: checked.refresh, access: checked.access, expires: checked.expires, ...(checked.accountId ? { accountId: checked.accountId } : {}) };
-        publish(file);
-        writeMembershipAfterCredentialPublish(provider, () => providerWrite(agentDir(), (db) => update(db, { ...row, label: checked.label, labelKey: key(checked.label), lastAttemptAt: Math.max(row.lastAttemptAt, checked.lastAttemptAt), lastRateLimitedAt: cooldownIncoming ? checked.lastRateLimitedAt : row.lastRateLimitedAt, rateLimitedUntil: cooldownIncoming ? checked.rateLimitedUntil : row.rateLimitedUntil })));
-        return publicPool(provider, file);
-    });
-}
-export async function renameSubscription(provider, ref, nextLabel) { return locked(provider, async (file, rows) => { const index = resolve(rows, ref); if (index < 0)
-    throw new Error(`Unknown ${getProviderLabel(provider)} subscription: ${ref}`); const label = nextLabel.trim(); if (!label)
-    throw new Error(`${getProviderLabel(provider)} subscription label cannot be empty`); if (rows.some((value, i) => i !== index && key(value.entry.label) === key(label)))
-    throw new DuplicateSubscriptionError(`${getProviderLabel(provider)} subscription already exists: ${label}`); providerWrite(agentDir(), (db) => update(db, { ...rows[index].row, label, labelKey: key(label) })); return publicPool(provider, file); }); }
-async function remove(provider, ref) { return locked(provider, async (file, rows, publish) => { const index = resolve(rows, ref); if (index < 0)
-    throw new Error(`Unknown ${getProviderLabel(provider)} subscription: ${ref}`); const removed = rows[index].row; providerWrite(agentDir(), (db) => db.prepare('DELETE FROM managed_accounts WHERE provider_id=? AND id=?').run(provider, removed.id)); delete file.accounts[removed.id]; publish(file); return publicPool(provider, file); }); }
-export async function removeManagedAccount(provider, ref) { return remove(provider, ref); }
-export async function removeSubscription(provider, ref) { return remove(provider, ref); }
-export async function removeAllManagedAccounts(provider) { return locked(provider, async (file, rows, publish) => { providerWrite(agentDir(), (db) => db.prepare('DELETE FROM managed_accounts WHERE provider_id=?').run(provider)); for (const { row } of rows)
-    delete file.accounts[row.id]; publish(file); return rows.length; }); }
-export async function removeManagedProvider(provider, label) { if (label === undefined) {
-    await removeAllManagedAccounts(provider);
-    return [];
-} return remove(provider, label); }
-export async function promoteSubscription(provider, ref) { return locked(provider, async (file, rows) => { const index = resolve(rows, ref); if (index < 0)
-    throw new Error(`Unknown ${getProviderLabel(provider)} subscription: ${ref}`); providerWrite(agentDir(), (db) => { const reordered = [rows[index], ...rows.filter((_, i) => i !== index)]; reordered.forEach((item, position) => update(db, { ...item.row, position })); }); return publicPool(provider, file); }); }
-async function mutateHealth(provider, ref, mutate) { providerWrite(agentDir(), (db) => { const row = providerRowByReference(db, provider, ref); if (!row)
-    throw new Error(`Unknown ${getProviderLabel(provider)} subscription: ${ref}`); const next = mutate(row); if (next)
-    update(db, next); }); return readSubscriptionPool(provider); }
-export async function markSubscriptionAttempt(provider, ref, attemptAt = Date.now()) { return mutateHealth(provider, ref, (row) => ({ ...row, lastAttemptAt: Math.max(row.lastAttemptAt, attemptAt) })); }
-export async function markSubscriptionAuthenticationFailed(provider, ref, retryAfterMs, attemptAt = Date.now()) { return mutateHealth(provider, ref, (row) => ({ ...row, authFailure: 'invalid_grant', lastAttemptAt: Math.max(row.lastAttemptAt, attemptAt), rateLimitedUntil: Math.max(row.rateLimitedUntil, attemptAt + Math.max(0, retryAfterMs)) })); }
-export async function markSubscriptionRateLimited(provider, ref, retryAfterMs, attemptAt = Date.now(), rateLimitedAt = Date.now()) { return mutateHealth(provider, ref, (row) => rateLimitedAt < row.lastRateLimitedAt ? null : { ...row, lastAttemptAt: Math.max(row.lastAttemptAt, attemptAt), lastRateLimitedAt: rateLimitedAt, rateLimitedUntil: rateLimitedAt + Math.max(0, retryAfterMs) }); }
-export async function markSubscriptionSuccess(provider, ref, attemptAt = Date.now()) { return mutateHealth(provider, ref, (row) => attemptAt < row.lastRateLimitedAt ? null : { ...row, authFailure: undefined, lastAttemptAt: Math.max(row.lastAttemptAt, attemptAt), rateLimitedUntil: 0 }); }
-export async function refreshSubscriptionCredential(provider, label, exchange) { return locked(provider, async (file, rows, publish) => { const index = resolve(rows, label); if (index < 0)
-    throw new Error(`${getProviderLabel(provider)} subscription "${label}" no longer exists`); const current = rows[index]; if (current.entry.expires > Date.now())
-    return current.entry; const tokens = assertTokens(provider, current.entry.label, await exchange(current.entry.refresh)); file.accounts[current.row.id] = { ...file.accounts[current.row.id], ...tokens }; publish(file); return { ...current.entry, ...tokens }; }); }
-export function isInvalidRefreshTokenError(error) { const value = error; const message = [value?.errorMessage, value?.message, error instanceof Error ? error.message : ''].filter((part) => typeof part === 'string').join(' '); const status = typeof value?.status === 'number' ? value.status : Number(message.match(/\bstatus[=:]\s*(\d+)/i)?.[1]); return status === 400 && /invalid_grant|refresh token .*invalid|refresh token .*not found/i.test(message); }
-export async function modifyElectedSubscription(provider, elect, apply) { return locked(provider, async (file, rows, publish) => { const attempted = new Set(); let lastError; while (attempted.size < rows.length) {
-    const chosen = elect(rows.filter(({ entry }) => !attempted.has(entry.label)).map(({ entry }) => entry));
-    if (!chosen)
-        break;
-    const current = rows.find(({ entry }) => entry.label === chosen.label);
-    attempted.add(current.entry.label);
-    try {
-        const next = await apply(current.entry);
-        if (next) {
-            const tokens = assertTokens(provider, current.entry.label, next);
-            file.accounts[current.row.id] = { ...file.accounts[current.row.id], ...tokens };
-            publish(file);
-            return { ...current.entry, ...tokens };
-        }
-        return current.entry;
-    }
-    catch (error) {
-        if (!isInvalidRefreshTokenError(error))
-            throw error;
-        lastError = error;
-        const at = Date.now();
-        providerWrite(agentDir(), (db) => update(db, { ...current.row, authFailure: 'invalid_grant', lastAttemptAt: Math.max(current.row.lastAttemptAt, at), rateLimitedUntil: Math.max(current.row.rateLimitedUntil, at + INVALID_REFRESH_TOKEN_BACKOFF_MS) }));
-    }
-} if (lastError)
-    throw lastError; return undefined; }); }
-export async function enrichManagedLoginIdentity(provider, value) { const supplied = value.accountId?.trim(); if (provider !== ANTHROPIC_PROVIDER_ID)
-    return supplied ? { accountId: supplied } : {}; try {
-    const response = await fetch('https://api.anthropic.com/api/oauth/profile', { headers: { Authorization: `Bearer ${value.access}`, Accept: 'application/json' }, signal: AbortSignal.timeout(3_000) });
-    if (!response.ok)
-        return supplied ? { accountId: supplied } : {};
-    const body = await response.json();
-    const accountId = typeof body.account?.uuid === 'string' && body.account.uuid.trim() ? body.account.uuid.trim() : undefined;
-    const email = typeof body.account?.email === 'string' && body.account.email.trim() ? body.account.email.trim() : undefined;
-    return { ...(accountId ? { accountId } : {}), ...(email ? { email } : {}) };
-}
-catch {
-    return supplied ? { accountId: supplied } : {};
-} }
-export async function commitManagedLogin(provider, label, value) { const identityInfo = await enrichManagedLoginIdentity(provider, value); return locked(provider, async (file, rows, publish) => { const selected = value.autoLabel ? undefined : label?.trim(); const incomingIdentity = identity({ refresh: value.refresh, accountId: identityInfo.accountId }); const matching = (selected ? rows.find(({ entry }) => key(entry.label) === key(selected)) : undefined) ?? rows.find(({ entry }) => identity(entry) === incomingIdentity); let resolved = matching?.entry.label ?? selected; if (!resolved && value.autoLabel) {
-    const base = identityInfo.email || label?.trim() || `Account ${rows.length + 1}`;
-    resolved = base;
-    for (let n = 2; rows.some(({ entry }) => key(entry.label) === key(resolved)); n++)
-        resolved = `${base} (${n})`;
-} if (!resolved)
-    throw new Error(`${getProviderLabel(provider)} subscription label cannot be empty`); const entry = assertCredential(provider, { label: resolved, refresh: value.refresh, access: value.access, expires: value.expires, ...(identityInfo.accountId ? { accountId: identityInfo.accountId } : {}), rateLimitedUntil: 0, lastAttemptAt: Date.now(), lastRateLimitedAt: value.lastRateLimitedAt }); if (!matching) {
-    if (rows.some(({ entry: existing }) => key(existing.label) === key(entry.label)))
-        throw new DuplicateSubscriptionError(`${getProviderLabel(provider)} subscription already exists: ${entry.label}`);
-    const duplicate = rows.find(({ entry: existing }) => identity(existing) === identity(entry));
-    if (identity(entry) && duplicate)
-        throw new DuplicateSubscriptionError(`This ${getProviderLabel(provider)} account is already added as “${duplicate.entry.label}” — it shares the same quota, so a second slot adds no redundancy.`);
-    const id = randomUUID();
-    file.accounts[id] = { refresh: entry.refresh, access: entry.access, expires: entry.expires, ...(entry.accountId ? { accountId: entry.accountId } : {}) };
-    publish(file);
-    writeMembershipAfterCredentialPublish(provider, () => providerWrite(agentDir(), (db) => insert(db, provider, { providerId: provider, id, label: entry.label, labelKey: key(entry.label), position: rows.length, lastAttemptAt: entry.lastAttemptAt, lastRateLimitedAt: entry.lastRateLimitedAt, rateLimitedUntil: entry.rateLimitedUntil })));
-    return publicPool(provider, file);
-} const row = matching.row; const duplicate = rows.find(({ entry: other }) => other.label !== matching.entry.label && identity(other) === identity(entry)); if (identity(entry) && duplicate)
-    throw new DuplicateSubscriptionError(`This ${getProviderLabel(provider)} account is already added as “${duplicate.entry.label}” — it shares the same quota, so a second slot adds no redundancy.`); file.accounts[row.id] = { refresh: entry.refresh, access: entry.access, expires: entry.expires, ...(entry.accountId ? { accountId: entry.accountId } : {}) }; publish(file); const clear = entry.lastRateLimitedAt >= row.lastRateLimitedAt; writeMembershipAfterCredentialPublish(provider, () => providerWrite(agentDir(), (db) => update(db, { ...row, lastAttemptAt: Math.max(row.lastAttemptAt, entry.lastAttemptAt), lastRateLimitedAt: clear ? entry.lastRateLimitedAt : row.lastRateLimitedAt, rateLimitedUntil: clear ? 0 : row.rateLimitedUntil }))); return publicPool(provider, file); }); }
-export function parseRetryAfterHeader(value, now = Date.now()) { if (!value?.trim())
-    return undefined; const seconds = Number(value.trim()); if (Number.isFinite(seconds))
-    return Math.max(0, Math.round(seconds * 1000)); const parsed = Date.parse(value); return Number.isFinite(parsed) ? Math.max(0, parsed - now) : undefined; }
-export function readRotationConfig() {
-    const row = openScopedStore(providerStore(agentDir())).prepare('SELECT default_fallback_strength,revert_when_available FROM rotation_settings WHERE singleton=1').get();
-    return { defaultFallbackStrength: normalizeStrength(row?.default_fallback_strength) ?? DEFAULT_FALLBACK_STRENGTH, revertWhenAvailable: row?.revert_when_available === undefined || row.revert_when_available === null ? true : Boolean(row.revert_when_available) };
-}
-export function writeRotationConfig(next) {
-    const current = readRotationConfig();
-    const merged = { defaultFallbackStrength: normalizeStrength(next.defaultFallbackStrength) ?? current.defaultFallbackStrength ?? DEFAULT_FALLBACK_STRENGTH, revertWhenAvailable: next.revertWhenAvailable ?? current.revertWhenAvailable ?? true };
-    providerWrite(agentDir(), (db) => db.prepare(`INSERT INTO rotation_settings(singleton,default_fallback_strength,revert_when_available) VALUES(1,?,?) ON CONFLICT(singleton) DO UPDATE SET default_fallback_strength=excluded.default_fallback_strength,revert_when_available=excluded.revert_when_available`).run(merged.defaultFallbackStrength, merged.revertWhenAvailable ? 1 : 0));
-    return merged;
-}
-export function formatStatusLine(provider, now = Date.now()) { const pool = readSubscriptionPool(provider); const ready = pool.filter((entry) => entry.authFailure === undefined && entry.rateLimitedUntil <= now); const label = getProviderLabel(provider); return ready.length === 0 ? `${label} pool exhausted` : `${label} ${ready[0]?.label ?? provider} (${ready.length}/${pool.length} ready)`; }
+var B=Object.defineProperty;var s=(t,n)=>B(t,"name",{value:n,configurable:!0});import{createHash as z,randomUUID as F}from"node:crypto";import{join as J}from"node:path";import{LockedJsonFile as Q}from"./locked-file.js";import{piAgentDir as G}from"./runtime/package-health.js";import{openScopedStore as X}from"./scoped-state/db.js";import{providerStore as Y}from"./scoped-state/paths.js";import{providerRowByReference as Z,providerRows as v,providerWrite as A}from"./scoped-state/providers.js";const P="anthropic",tt="openai-codex",et=720*60*60*1e3,W="strong",H={anthropic:{label:"Claude",credentials:"anthropic-credentials.json"},"openai-codex":{label:"OpenAI Codex",credentials:"openai-codex-credentials.json"}};function b(){return G()}s(b,"agentDir");function N(t){return J(b(),H[t].credentials)}s(N,"credentialFile");function K(t){return t==="ultra"||t==="strong"||t==="medium"||t==="light"?t:void 0}s(K,"normalizeStrength");function f(t){return t.toLowerCase()}s(f,"key");function nt(t){const n=typeof t.label=="string"?t.label.trim():"",e=typeof t.refresh=="string"?t.refresh.trim():"",a=typeof t.access=="string"?t.access.trim():"",r=Number(t.expires);if(!n||!e||!a||!Number.isFinite(r))return;const i=typeof t.accountId=="string"&&t.accountId.trim()?t.accountId.trim():void 0;return{label:n,refresh:e,access:a,expires:r,rateLimitedUntil:Number.isFinite(Number(t.rateLimitedUntil))?Number(t.rateLimitedUntil):0,lastAttemptAt:Number.isFinite(Number(t.lastAttemptAt))?Number(t.lastAttemptAt):0,lastRateLimitedAt:Number.isFinite(Number(t.lastRateLimitedAt))?Number(t.lastRateLimitedAt):0,...t.authFailure==="invalid_grant"?{authFailure:"invalid_grant"}:{},...i?{accountId:i}:{}}}s(nt,"credential");function $(t,n){if(!n.label?.trim())throw new Error(`${h(t)} subscription label cannot be empty`);const e=nt(n);if(!e)throw new Error(`Refusing to persist incomplete ${h(t)} subscription "${n.label.trim()}"; pool rows require both OAuth tokens.`);return e}s($,"assertCredential");function j(t,n){if(!n||n.trim()==="")return{version:1,accounts:{}};let e;try{e=JSON.parse(n)}catch(a){throw new Error(`managed credential file ${t} is corrupt: ${a instanceof Error?a.message:String(a)}`)}if(typeof e!="object"||e===null||Array.isArray(e)||e.version!==1||typeof e.accounts!="object"||e.accounts===null||Array.isArray(e.accounts))throw new Error(`managed credential file ${t} is corrupt`);return e}s(j,"parseCredentials");function at(t,n){const e=n.accounts[t.id];if(!e||typeof e.refresh!="string"||typeof e.access!="string"||!Number.isFinite(e.expires))throw new Error(`managed ${t.providerId} account ${t.id} has no credential record`);return{label:t.label,refresh:e.refresh,access:e.access,expires:e.expires,rateLimitedUntil:t.rateLimitedUntil,lastAttemptAt:t.lastAttemptAt,lastRateLimitedAt:t.lastRateLimitedAt,...t.authFailure?{authFailure:t.authFailure}:{},...e.accountId?{accountId:e.accountId}:{}}}s(at,"toPublic");function D(t,n){return v(b(),t).map(e=>({row:e,entry:at(e,n)}))}s(D,"rowsWithCredentials");function q(t){return new Q(N(t),!0,`{"version":1,"accounts":{}}
+`)}s(q,"managedCredentialFile");function rt(t){return j(N(t),q(t).readUnlocked())}s(rt,"readFile");function y(t){return t.accountId?.trim()||(t.refresh.trim()?`refresh:${z("sha256").update(t.refresh.trim()).digest("hex")}`:void 0)}s(y,"identity");function V(t,n,e){const a=e.refresh?.trim()??"",r=e.access?.trim()??"",i=Number(e.expires);if(!a||!r||!Number.isFinite(i))throw new Error(`${h(t)} subscription "${n}" returned an incomplete credential; the stored credential was left unchanged.`);return{refresh:a,access:r,expires:i}}s(V,"assertTokens");function gt(t){return t===P||t===tt}s(gt,"isManagedProvider");function h(t){return H[t].label}s(h,"getProviderLabel");function xt(t,n=Date.now(),e={}){const a=[],r=[];for(let i=0;i<t.length;i++){const c=t[i],u=c.registered?c.automaticFallback===!1?"non-managed-fallback":c.authenticated?(c.coolingUntil??0)>n?"cooling":void 0:"unauthenticated":"unregistered";if(!u)a.push(c);else if(r.push({candidate:c,reason:u}),e.pinnedToFirst&&i===0&&u!=="cooling")break}return{candidates:a,rejected:r}}s(xt,"resolveProviderCandidates");class I extends Error{static{s(this,"DuplicateSubscriptionError")}constructor(n){super(n),this.name="DuplicateSubscriptionError"}}function M(t){return D(t,rt(t)).map(({entry:n})=>n)}s(M,"readSubscriptionPool");async function x(t,n){const e=N(t);return q(t).withLockAsync(async(a,r,i)=>{const c=j(e,a);return{result:await n(c,D(t,c),u=>i(`${JSON.stringify(u)}
+`))}})}s(x,"locked");function S(t,n,e){t.prepare("INSERT INTO managed_accounts(provider_id,id,label,label_key,position,last_attempt_at,last_rate_limited_at,rate_limited_until,auth_failure) VALUES(?,?,?,?,?,?,?,?,?)").run(n,e.id,e.label,e.labelKey,e.position,e.lastAttemptAt,e.lastRateLimitedAt,e.rateLimitedUntil,e.authFailure??null)}s(S,"insert");function E(t,n){t.prepare("UPDATE managed_accounts SET label=?,label_key=?,position=?,last_attempt_at=?,last_rate_limited_at=?,rate_limited_until=?,auth_failure=? WHERE provider_id=? AND id=?").run(n.label,n.labelKey,n.position,n.lastAttemptAt,n.lastRateLimitedAt,n.rateLimitedUntil,n.authFailure??null,n.providerId,n.id)}s(E,"update");function L(t,n){return D(t,n).map(({entry:e})=>e)}s(L,"publicPool");function R(t,n){try{n()}catch(e){throw new Error(`managed ${h(t)} credential file was published, but its SQL membership update failed; SQL membership remains authoritative: ${e instanceof Error?e.message:String(e)}`,{cause:e})}}s(R,"writeMembershipAfterCredentialPublish");async function Lt(t,n){return x(t,async(e,a,r)=>{const i=n.map(d=>$(t,d)),c=i.map((d,l)=>({entry:d,id:a[l]?.row.id??F()})),u={};for(const{entry:d,id:l}of c)u[l]={refresh:d.refresh,access:d.access,expires:d.expires,...d.accountId?{accountId:d.accountId}:{}};return r({version:1,accounts:u}),R(t,()=>A(b(),d=>{d.prepare("DELETE FROM managed_accounts WHERE provider_id=?").run(t),c.forEach(({entry:l,id:m},o)=>S(d,t,{providerId:t,id:m,label:l.label,labelKey:f(l.label),position:o,lastAttemptAt:l.lastAttemptAt,lastRateLimitedAt:l.lastRateLimitedAt,rateLimitedUntil:l.rateLimitedUntil,...l.authFailure?{authFailure:l.authFailure}:{}}))})),i})}s(Lt,"writeSubscriptionPool");function U(t,n){const e=n.trim().toLowerCase(),a=Number.parseInt(e,10);return Number.isFinite(a)&&String(a)===e&&a>=1&&a<=t.length?a-1:t.findIndex(({entry:r})=>f(r.label)===e)}s(U,"resolve");async function it(t,n){const e=$(t,n);return x(t,async(a,r,i)=>{if(r.some(({entry:l})=>f(l.label)===f(e.label)))throw new I(`${h(t)} subscription already exists: ${e.label}`);const c=y(e),u=r.find(({entry:l})=>y(l)===c);if(c&&u)throw new I(`This ${h(t)} account is already added as \u201C${u.entry.label}\u201D \u2014 it shares the same quota, so a second slot adds no redundancy.`);const d=F();return a.accounts[d]={refresh:e.refresh,access:e.access,expires:e.expires,...e.accountId?{accountId:e.accountId}:{}},i(a),R(t,()=>A(b(),l=>S(l,t,{providerId:t,id:d,label:e.label,labelKey:f(e.label),position:r.length,lastAttemptAt:e.lastAttemptAt,lastRateLimitedAt:e.lastRateLimitedAt,rateLimitedUntil:e.rateLimitedUntil,...e.authFailure?{authFailure:e.authFailure}:{}}))),L(t,a)})}s(it,"addSubscription");async function _t(t,n){const e=$(t,n);return M(t).find(r=>f(r.label)===f(e.label))?st(t,e):it(t,e)}s(_t,"upsertSubscription");async function st(t,n){const e=$(t,n);return x(t,async(a,r,i)=>{const c=r.findIndex(({entry:o})=>f(o.label)===f(e.label)),u=r[c],d=r.find(({entry:o},g)=>g!==c&&y(o)===y(e));if(y(e)&&d)throw new I(`This ${h(t)} account is already added as \u201C${d.entry.label}\u201D \u2014 it shares the same quota, so a second slot adds no redundancy.`);if(!u){const o=F();return a.accounts[o]={refresh:e.refresh,access:e.access,expires:e.expires,...e.accountId?{accountId:e.accountId}:{}},i(a),R(t,()=>A(b(),g=>S(g,t,{providerId:t,id:o,label:e.label,labelKey:f(e.label),position:r.length,lastAttemptAt:e.lastAttemptAt,lastRateLimitedAt:e.lastRateLimitedAt,rateLimitedUntil:e.rateLimitedUntil}))),L(t,a)}const l=u.row,m=e.lastRateLimitedAt>=l.lastRateLimitedAt;return a.accounts[l.id]={refresh:e.refresh,access:e.access,expires:e.expires,...e.accountId?{accountId:e.accountId}:{}},i(a),R(t,()=>A(b(),o=>E(o,{...l,label:e.label,labelKey:f(e.label),lastAttemptAt:Math.max(l.lastAttemptAt,e.lastAttemptAt),lastRateLimitedAt:m?e.lastRateLimitedAt:l.lastRateLimitedAt,rateLimitedUntil:m?e.rateLimitedUntil:l.rateLimitedUntil}))),L(t,a)})}s(st,"upsertSubscriptionWithUniqueAccount");async function It(t,n,e){return x(t,async(a,r)=>{const i=U(r,n);if(i<0)throw new Error(`Unknown ${h(t)} subscription: ${n}`);const c=e.trim();if(!c)throw new Error(`${h(t)} subscription label cannot be empty`);if(r.some((u,d)=>d!==i&&f(u.entry.label)===f(c)))throw new I(`${h(t)} subscription already exists: ${c}`);return A(b(),u=>E(u,{...r[i].row,label:c,labelKey:f(c)})),L(t,a)})}s(It,"renameSubscription");async function T(t,n){return x(t,async(e,a,r)=>{const i=U(a,n);if(i<0)throw new Error(`Unknown ${h(t)} subscription: ${n}`);const c=a[i].row;return A(b(),u=>u.prepare("DELETE FROM managed_accounts WHERE provider_id=? AND id=?").run(t,c.id)),delete e.accounts[c.id],r(e),L(t,e)})}s(T,"remove");async function Et(t,n){return T(t,n)}s(Et,"removeManagedAccount");async function Rt(t,n){return T(t,n)}s(Rt,"removeSubscription");async function ct(t){return x(t,async(n,e,a)=>{A(b(),r=>r.prepare("DELETE FROM managed_accounts WHERE provider_id=?").run(t));for(const{row:r}of e)delete n.accounts[r.id];return a(n),e.length})}s(ct,"removeAllManagedAccounts");async function wt(t,n){return n===void 0?(await ct(t),[]):T(t,n)}s(wt,"removeManagedProvider");async function $t(t,n){return x(t,async(e,a)=>{const r=U(a,n);if(r<0)throw new Error(`Unknown ${h(t)} subscription: ${n}`);return A(b(),i=>{[a[r],...a.filter((u,d)=>d!==r)].forEach((u,d)=>E(i,{...u.row,position:d}))}),L(t,e)})}s($t,"promoteSubscription");async function k(t,n,e){return A(b(),a=>{const r=Z(a,t,n);if(!r)throw new Error(`Unknown ${h(t)} subscription: ${n}`);const i=e(r);i&&E(a,i)}),M(t)}s(k,"mutateHealth");async function Ft(t,n,e=Date.now()){return k(t,n,a=>({...a,lastAttemptAt:Math.max(a.lastAttemptAt,e)}))}s(Ft,"markSubscriptionAttempt");async function St(t,n,e,a=Date.now()){return k(t,n,r=>({...r,authFailure:"invalid_grant",lastAttemptAt:Math.max(r.lastAttemptAt,a),rateLimitedUntil:Math.max(r.rateLimitedUntil,a+Math.max(0,e))}))}s(St,"markSubscriptionAuthenticationFailed");async function Ut(t,n,e,a=Date.now(),r=Date.now()){return k(t,n,i=>r<i.lastRateLimitedAt?null:{...i,lastAttemptAt:Math.max(i.lastAttemptAt,a),lastRateLimitedAt:r,rateLimitedUntil:r+Math.max(0,e)})}s(Ut,"markSubscriptionRateLimited");async function kt(t,n,e=Date.now()){return k(t,n,a=>e<a.lastRateLimitedAt?null:{...a,authFailure:void 0,lastAttemptAt:Math.max(a.lastAttemptAt,e),rateLimitedUntil:0})}s(kt,"markSubscriptionSuccess");async function Nt(t,n,e){return x(t,async(a,r,i)=>{const c=U(r,n);if(c<0)throw new Error(`${h(t)} subscription "${n}" no longer exists`);const u=r[c];if(u.entry.expires>Date.now())return u.entry;const d=V(t,u.entry.label,await e(u.entry.refresh));return a.accounts[u.row.id]={...a.accounts[u.row.id],...d},i(a),{...u.entry,...d}})}s(Nt,"refreshSubscriptionCredential");function ot(t){const n=t,e=[n?.errorMessage,n?.message,t instanceof Error?t.message:""].filter(r=>typeof r=="string").join(" ");return(typeof n?.status=="number"?n.status:Number(e.match(/\bstatus[=:]\s*(\d+)/i)?.[1]))===400&&/invalid_grant|refresh token .*invalid|refresh token .*not found/i.test(e)}s(ot,"isInvalidRefreshTokenError");async function Dt(t,n,e){return x(t,async(a,r,i)=>{const c=new Set;let u;for(;c.size<r.length;){const d=n(r.filter(({entry:m})=>!c.has(m.label)).map(({entry:m})=>m));if(!d)break;const l=r.find(({entry:m})=>m.label===d.label);c.add(l.entry.label);try{const m=await e(l.entry);if(m){const o=V(t,l.entry.label,m);return a.accounts[l.row.id]={...a.accounts[l.row.id],...o},i(a),{...l.entry,...o}}return l.entry}catch(m){if(!ot(m))throw m;u=m;const o=Date.now();A(b(),g=>E(g,{...l.row,authFailure:"invalid_grant",lastAttemptAt:Math.max(l.row.lastAttemptAt,o),rateLimitedUntil:Math.max(l.row.rateLimitedUntil,o+et)}))}}if(u)throw u})}s(Dt,"modifyElectedSubscription");async function lt(t,n){const e=n.accountId?.trim();if(t!==P)return e?{accountId:e}:{};try{const a=await fetch("https://api.anthropic.com/api/oauth/profile",{headers:{Authorization:`Bearer ${n.access}`,Accept:"application/json"},signal:AbortSignal.timeout(3e3)});if(!a.ok)return e?{accountId:e}:{};const r=await a.json(),i=typeof r.account?.uuid=="string"&&r.account.uuid.trim()?r.account.uuid.trim():void 0,c=typeof r.account?.email=="string"&&r.account.email.trim()?r.account.email.trim():void 0;return{...i?{accountId:i}:{},...c?{email:c}:{}}}catch{return e?{accountId:e}:{}}}s(lt,"enrichManagedLoginIdentity");async function Mt(t,n,e){const a=await lt(t,e);return x(t,async(r,i,c)=>{const u=e.autoLabel?void 0:n?.trim(),d=y({refresh:e.refresh,accountId:a.accountId}),l=(u?i.find(({entry:p})=>f(p.label)===f(u)):void 0)??i.find(({entry:p})=>y(p)===d);let m=l?.entry.label??u;if(!m&&e.autoLabel){const p=a.email||n?.trim()||`Account ${i.length+1}`;m=p;for(let w=2;i.some(({entry:_})=>f(_.label)===f(m));w++)m=`${p} (${w})`}if(!m)throw new Error(`${h(t)} subscription label cannot be empty`);const o=$(t,{label:m,refresh:e.refresh,access:e.access,expires:e.expires,...a.accountId?{accountId:a.accountId}:{},rateLimitedUntil:0,lastAttemptAt:Date.now(),lastRateLimitedAt:e.lastRateLimitedAt});if(!l){if(i.some(({entry:_})=>f(_.label)===f(o.label)))throw new I(`${h(t)} subscription already exists: ${o.label}`);const p=i.find(({entry:_})=>y(_)===y(o));if(y(o)&&p)throw new I(`This ${h(t)} account is already added as \u201C${p.entry.label}\u201D \u2014 it shares the same quota, so a second slot adds no redundancy.`);const w=F();return r.accounts[w]={refresh:o.refresh,access:o.access,expires:o.expires,...o.accountId?{accountId:o.accountId}:{}},c(r),R(t,()=>A(b(),_=>S(_,t,{providerId:t,id:w,label:o.label,labelKey:f(o.label),position:i.length,lastAttemptAt:o.lastAttemptAt,lastRateLimitedAt:o.lastRateLimitedAt,rateLimitedUntil:o.rateLimitedUntil}))),L(t,r)}const g=l.row,O=i.find(({entry:p})=>p.label!==l.entry.label&&y(p)===y(o));if(y(o)&&O)throw new I(`This ${h(t)} account is already added as \u201C${O.entry.label}\u201D \u2014 it shares the same quota, so a second slot adds no redundancy.`);r.accounts[g.id]={refresh:o.refresh,access:o.access,expires:o.expires,...o.accountId?{accountId:o.accountId}:{}},c(r);const C=o.lastRateLimitedAt>=g.lastRateLimitedAt;return R(t,()=>A(b(),p=>E(p,{...g,lastAttemptAt:Math.max(g.lastAttemptAt,o.lastAttemptAt),lastRateLimitedAt:C?o.lastRateLimitedAt:g.lastRateLimitedAt,rateLimitedUntil:C?0:g.rateLimitedUntil}))),L(t,r)})}s(Mt,"commitManagedLogin");function Tt(t,n=Date.now()){if(!t?.trim())return;const e=Number(t.trim());if(Number.isFinite(e))return Math.max(0,Math.round(e*1e3));const a=Date.parse(t);return Number.isFinite(a)?Math.max(0,a-n):void 0}s(Tt,"parseRetryAfterHeader");function ut(){const t=X(Y(b())).prepare("SELECT default_fallback_strength,revert_when_available FROM rotation_settings WHERE singleton=1").get();return{defaultFallbackStrength:K(t?.default_fallback_strength)??W,revertWhenAvailable:t?.revert_when_available===void 0||t.revert_when_available===null?!0:!!t.revert_when_available}}s(ut,"readRotationConfig");function Ot(t){const n=ut(),e={defaultFallbackStrength:K(t.defaultFallbackStrength)??n.defaultFallbackStrength??W,revertWhenAvailable:t.revertWhenAvailable??n.revertWhenAvailable??!0};return A(b(),a=>a.prepare("INSERT INTO rotation_settings(singleton,default_fallback_strength,revert_when_available) VALUES(1,?,?) ON CONFLICT(singleton) DO UPDATE SET default_fallback_strength=excluded.default_fallback_strength,revert_when_available=excluded.revert_when_available").run(e.defaultFallbackStrength,e.revertWhenAvailable?1:0)),e}s(Ot,"writeRotationConfig");function Ct(t,n=Date.now()){const e=M(t),a=e.filter(i=>i.authFailure===void 0&&i.rateLimitedUntil<=n),r=h(t);return a.length===0?`${r} pool exhausted`:`${r} ${a[0]?.label??t} (${a.length}/${e.length} ready)`}s(Ct,"formatStatusLine");export{P as ANTHROPIC_PROVIDER_ID,I as DuplicateSubscriptionError,et as INVALID_REFRESH_TOKEN_BACKOFF_MS,tt as OPENAI_CODEX_PROVIDER_ID,it as addSubscription,Mt as commitManagedLogin,lt as enrichManagedLoginIdentity,Ct as formatStatusLine,h as getProviderLabel,ot as isInvalidRefreshTokenError,gt as isManagedProvider,Ft as markSubscriptionAttempt,St as markSubscriptionAuthenticationFailed,Ut as markSubscriptionRateLimited,kt as markSubscriptionSuccess,Dt as modifyElectedSubscription,Tt as parseRetryAfterHeader,$t as promoteSubscription,ut as readRotationConfig,M as readSubscriptionPool,Nt as refreshSubscriptionCredential,ct as removeAllManagedAccounts,Et as removeManagedAccount,wt as removeManagedProvider,Rt as removeSubscription,It as renameSubscription,xt as resolveProviderCandidates,_t as upsertSubscription,st as upsertSubscriptionWithUniqueAccount,Ot as writeRotationConfig,Lt as writeSubscriptionPool};

package/dist/core/substrate/frontmatter-validation.js

@@ -1,105 +1 @@
-import { isDocKind, parseSubstrateFrontmatter, SURFACE_EVENTS, SURFACE_RUNGS } from './schema.js';
-const RETIRED_FIELDS = ['system-prompt-visibility', 'file-read-visibility', 'applies-to', 'read-when'];
-const SURFACE_ENTRY_KEYS = ['on', 'match', 'match-frontmatter', 'gate', 'at'];
-export const SUPPRESSIBLE_RULES = ['length', 'broad-memory-read', 'orphan'];
-/** Strict validation of one raw routing entry. Runtime parsing deliberately
- * tolerates malformed docs; this authoring/preflight contract does not. */
-export function lintSubstrateSurfaces(value) {
-    if (value === undefined)
-        return null;
-    if (!Array.isArray(value))
-        return `invalid surfaces: ${JSON.stringify(value)} (expected a list of {on, at, match?, match-frontmatter?, gate?} entries)`;
-    for (const raw of value) {
-        if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
-            return `invalid surfaces entry: ${JSON.stringify(raw)} (expected an {on, at, match?, match-frontmatter?, gate?} object)`;
-        }
-        const entry = raw;
-        for (const key of Object.keys(entry)) {
-            if (!SURFACE_ENTRY_KEYS.includes(key)) {
-                return `invalid surfaces entry: unknown key \`${key}\` (an entry carries only on, match, match-frontmatter, gate, at)`;
-            }
-        }
-        const on = entry['on'];
-        if (typeof on !== 'string' || !SURFACE_EVENTS.includes(on)) {
-            return `invalid surfaces entry \`on\`: ${JSON.stringify(on)} (expected ${SURFACE_EVENTS.join('|')})`;
-        }
-        const at = entry['at'];
-        if (typeof at !== 'string' || !SURFACE_RUNGS.includes(at)) {
-            return `invalid surfaces entry \`at\`: ${JSON.stringify(at)} (expected ${SURFACE_RUNGS.join('|')})`;
-        }
-        let hasMatch = false;
-        if (entry['match'] !== undefined) {
-            if (on === 'boot' || on === 'workspace-open') {
-                return `invalid surfaces entry: \`match\` is meaningless on \`${on}\` — the entry's presence is the match; drop it`;
-            }
-            const match = entry['match'];
-            const globs = typeof match === 'string' ? [match] : Array.isArray(match) && match.every((glob) => typeof glob === 'string') ? match : null;
-            if (globs === null || globs.length === 0 || globs.some((glob) => glob.trim() === '')) {
-                return `invalid surfaces entry \`match\`: ${JSON.stringify(match)} (expected a non-empty glob or non-empty glob list)`;
-            }
-            hasMatch = true;
-        }
-        const matchFrontmatter = entry['match-frontmatter'];
-        if (matchFrontmatter !== undefined) {
-            if (on !== 'read')
-                return 'invalid surfaces entry: `match-frontmatter` is a `read`-event predicate only';
-            if (matchFrontmatter === null || typeof matchFrontmatter !== 'object' || Array.isArray(matchFrontmatter)) {
-                return `invalid surfaces entry \`match-frontmatter\`: ${JSON.stringify(matchFrontmatter)} (expected a field→matcher object)`;
-            }
-        }
-        if ((on === 'read' || on === 'memory-read' || on === 'command' || on === 'pre-command') && !hasMatch && matchFrontmatter === undefined) {
-            return `invalid surfaces entry: a \`${on}\` entry requires \`match\`${on === 'read' ? ' or `match-frontmatter`' : ''}`;
-        }
-        const gate = entry['gate'];
-        if (gate !== undefined && (gate === null || typeof gate !== 'object' || Array.isArray(gate))) {
-            return `invalid surfaces entry \`gate\`: ${JSON.stringify(gate)} (expected a field→matcher object)`;
-        }
-    }
-    return null;
-}
-/** Strict substrate frontmatter checker shared by lint and package preflight. */
-export function lintSubstrateFrontmatter(fm) {
-    if (fm === null)
-        return 'missing frontmatter: a memory store doc requires `kind: knowledge|preference`';
-    if (!isDocKind(fm.kind))
-        return `invalid kind: ${JSON.stringify(fm.kind)} (expected knowledge|preference)`;
-    if ('when' in fm || 'why' in fm) {
-        return 'retired `when`/`why` keys: merge them into one `when-and-why-to-read` line — "When <circumstance>, this <kind> should be read because <broader downstream payoff>." WHY is the benefit unlocked by reading, not the document summary, rule, or obedience rationale.';
-    }
-    if (typeof fm['when-and-why-to-read'] !== 'string' || fm['when-and-why-to-read'].trim() === '') {
-        return 'missing `when-and-why-to-read`: one routing line — "When <circumstance>, this <kind> should be read because <broader downstream payoff>." WHY is the benefit unlocked by reading, not the document summary, rule, or obedience rationale.';
-    }
-    for (const field of RETIRED_FIELDS) {
-        if (field in fm) {
-            return `retired \`${field}\` key: the visibility axes were replaced by \`surfaces\` event routing — run \`crtr sys migrate\` to convert old-format docs, or author \`surfaces\` entries by hand (\`crtr memory write -h\`)`;
-        }
-    }
-    if (fm['unlisted'] !== undefined && typeof fm['unlisted'] !== 'boolean') {
-        return `invalid unlisted: ${JSON.stringify(fm['unlisted'])} (expected a boolean)`;
-    }
-    const surfacesError = lintSubstrateSurfaces(fm['surfaces']);
-    if (surfacesError !== null)
-        return surfacesError;
-    if (fm.gate !== undefined && (fm.gate === null || typeof fm.gate !== 'object' || Array.isArray(fm.gate))) {
-        return `invalid gate: ${JSON.stringify(fm.gate)} (expected a field→matcher object)`;
-    }
-    if (fm.slash !== undefined && typeof fm.slash !== 'boolean') {
-        return `invalid slash: ${JSON.stringify(fm.slash)} (expected a boolean)`;
-    }
-    if (fm.rationale !== undefined && typeof fm.rationale !== 'string') {
-        return `invalid rationale: ${JSON.stringify(fm.rationale)} (expected a string)`;
-    }
-    if (fm['lint-ignore'] !== undefined) {
-        const rules = Array.isArray(fm['lint-ignore']) ? fm['lint-ignore'] : [fm['lint-ignore']];
-        if (rules.length === 0 || !rules.every((rule) => typeof rule === 'string' && SUPPRESSIBLE_RULES.includes(rule))) {
-            return `invalid lint-ignore: ${JSON.stringify(fm['lint-ignore'])} (suppressible rules: ${SUPPRESSIBLE_RULES.map((rule) => `\`${rule}\``).join(', ')})`;
-        }
-    }
-    return null;
-}
-/** Compatibility name for consumers that adopted lint's former export. */
-export const lintSubstrateSchema = lintSubstrateFrontmatter;
-/** Parsed routing entries for checks that run after strict validation. */
-export function parsedSubstrateSurfaces(fm) {
-    return parseSubstrateFrontmatter(fm)?.surfaces ?? [];
-}
+var g=Object.defineProperty;var s=(e,n)=>g(e,"name",{value:n,configurable:!0});import{isDocKind as p,parseSubstrateFrontmatter as m,SURFACE_EVENTS as f,SURFACE_RUNGS as y}from"./schema.js";const b=["system-prompt-visibility","file-read-visibility","applies-to","read-when"],S=["on","match","match-frontmatter","gate","at"],h=["length","broad-memory-read","orphan"];function v(e){if(e===void 0)return null;if(!Array.isArray(e))return`invalid surfaces: ${JSON.stringify(e)} (expected a list of {on, at, match?, match-frontmatter?, gate?} entries)`;for(const n of e){if(n===null||typeof n!="object"||Array.isArray(n))return`invalid surfaces entry: ${JSON.stringify(n)} (expected an {on, at, match?, match-frontmatter?, gate?} object)`;const r=n;for(const i of Object.keys(r))if(!S.includes(i))return`invalid surfaces entry: unknown key \`${i}\` (an entry carries only on, match, match-frontmatter, gate, at)`;const t=r.on;if(typeof t!="string"||!f.includes(t))return`invalid surfaces entry \`on\`: ${JSON.stringify(t)} (expected ${f.join("|")})`;const c=r.at;if(typeof c!="string"||!y.includes(c))return`invalid surfaces entry \`at\`: ${JSON.stringify(c)} (expected ${y.join("|")})`;let u=!1;if(r.match!==void 0){if(t==="boot"||t==="workspace-open")return`invalid surfaces entry: \`match\` is meaningless on \`${t}\` \u2014 the entry's presence is the match; drop it`;const i=r.match,d=typeof i=="string"?[i]:Array.isArray(i)&&i.every(l=>typeof l=="string")?i:null;if(d===null||d.length===0||d.some(l=>l.trim()===""))return`invalid surfaces entry \`match\`: ${JSON.stringify(i)} (expected a non-empty glob or non-empty glob list)`;u=!0}const a=r["match-frontmatter"];if(a!==void 0){if(t!=="read")return"invalid surfaces entry: `match-frontmatter` is a `read`-event predicate only";if(a===null||typeof a!="object"||Array.isArray(a))return`invalid surfaces entry \`match-frontmatter\`: ${JSON.stringify(a)} (expected a field\u2192matcher object)`}if((t==="read"||t==="memory-read"||t==="command"||t==="pre-command")&&!u&&a===void 0)return`invalid surfaces entry: a \`${t}\` entry requires \`match\`${t==="read"?" or `match-frontmatter`":""}`;const o=r.gate;if(o!==void 0&&(o===null||typeof o!="object"||Array.isArray(o)))return`invalid surfaces entry \`gate\`: ${JSON.stringify(o)} (expected a field\u2192matcher object)`}return null}s(v,"lintSubstrateSurfaces");function w(e){if(e===null)return"missing frontmatter: a memory store doc requires `kind: knowledge|preference`";if(!p(e.kind))return`invalid kind: ${JSON.stringify(e.kind)} (expected knowledge|preference)`;if("when"in e||"why"in e)return'retired `when`/`why` keys: merge them into one `when-and-why-to-read` line \u2014 "When <circumstance>, this <kind> should be read because <broader downstream payoff>." WHY is the benefit unlocked by reading, not the document summary, rule, or obedience rationale.';if(typeof e["when-and-why-to-read"]!="string"||e["when-and-why-to-read"].trim()==="")return'missing `when-and-why-to-read`: one routing line \u2014 "When <circumstance>, this <kind> should be read because <broader downstream payoff>." WHY is the benefit unlocked by reading, not the document summary, rule, or obedience rationale.';for(const r of b)if(r in e)return`retired \`${r}\` key: the visibility axes were replaced by \`surfaces\` event routing \u2014 run \`crtr sys migrate\` to convert old-format docs, or author \`surfaces\` entries by hand (\`crtr memory write -h\`)`;if(e.unlisted!==void 0&&typeof e.unlisted!="boolean")return`invalid unlisted: ${JSON.stringify(e.unlisted)} (expected a boolean)`;const n=v(e.surfaces);if(n!==null)return n;if(e.gate!==void 0&&(e.gate===null||typeof e.gate!="object"||Array.isArray(e.gate)))return`invalid gate: ${JSON.stringify(e.gate)} (expected a field\u2192matcher object)`;if(e.slash!==void 0&&typeof e.slash!="boolean")return`invalid slash: ${JSON.stringify(e.slash)} (expected a boolean)`;if(e.rationale!==void 0&&typeof e.rationale!="string")return`invalid rationale: ${JSON.stringify(e.rationale)} (expected a string)`;if(e["lint-ignore"]!==void 0){const r=Array.isArray(e["lint-ignore"])?e["lint-ignore"]:[e["lint-ignore"]];if(r.length===0||!r.every(t=>typeof t=="string"&&h.includes(t)))return`invalid lint-ignore: ${JSON.stringify(e["lint-ignore"])} (suppressible rules: ${h.map(t=>`\`${t}\``).join(", ")})`}return null}s(w,"lintSubstrateFrontmatter");const k=w;function A(e){return m(e)?.surfaces??[]}s(A,"parsedSubstrateSurfaces");export{h as SUPPRESSIBLE_RULES,w as lintSubstrateFrontmatter,k as lintSubstrateSchema,v as lintSubstrateSurfaces,A as parsedSubstrateSurfaces};