@nyte-ai/host 0.0.0-stage → 0.0.19

package/dist/src/local/command.d.ts

@@ -0,0 +1,20 @@
+import type { ChildProcess, SpawnOptions } from "node:child_process";
+export type Ran = {
+    readonly code: number | null;
+    readonly stdout: Buffer;
+    readonly stderr: string;
+    readonly truncated: boolean;
+};
+export declare function run(file: string, args: readonly string[], options: {
+    readonly cwd: string;
+    readonly env?: Readonly<Record<string, string>>;
+    readonly input?: string | Uint8Array;
+    readonly limit?: number;
+    /** Kills the command after this long; it then ends with a null code. */
+    readonly timeoutMs?: number;
+}): Promise<Ran>;
+/** Spawns `file` as `spawn` does, except that on Windows a `.cmd` or `.bat` file runs through `cmd.exe` with its arguments escaped, as Node no longer starts batch files without a shell. */
+export declare function spawnCommand(file: string, args: readonly string[], options: SpawnOptions): ChildProcess;
+/** Ends `child` with `signal`; on Windows, which has no signals, it ends the child's whole process tree with `taskkill /T /F`, as `kill` alone would leave what a batch file or a shell started running. */
+export declare function killTree(child: ChildProcess, signal: NodeJS.Signals): void;
+export declare function findExecutable(name: string, directories?: readonly string[]): Promise<string | null>;

package/dist/src/local/command.js

@@ -0,0 +1,12 @@
+import {
+  run2,
+  spawnCommand2,
+  killTree2,
+  findExecutable2
+} from "../../chunks/canvas-preview-bxnqt8cd.js";
+export {
+  findExecutable2 as findExecutable,
+  killTree2 as killTree,
+  run2 as run,
+  spawnCommand2 as spawnCommand
+};

package/dist/src/local/feed.d.ts

@@ -0,0 +1,7 @@
+import type { Disposer } from "@nyte-ai/schema";
+export type FeedSink<T> = {
+    push(value: T): void;
+    fail(error: unknown): void;
+    end(): void;
+};
+export declare function feed<T>(start: (sink: FeedSink<T>) => Disposer, merge?: (waiting: T, next: T) => T): AsyncIterable<T>;

package/dist/src/local/feed.js

@@ -0,0 +1,6 @@
+import {
+  feed2
+} from "../../chunks/canvas-preview-yjz0f7n4.js";
+export {
+  feed2 as feed
+};

package/dist/src/local/files.d.ts

@@ -0,0 +1,18 @@
+import type { ByteReader, FileVersion } from "@nyte-ai/schema";
+import type { FilesApi } from "@nyte-ai/core";
+/** Returns a byte reader that carries the version of the file it read, which the server answers as `X-Nyte-Version` (§40h, §40p). */
+export type VersionedReader = ByteReader & {
+    readonly version: FileVersion;
+};
+/** Returns the local `FilesApi`, its `bytes` typed with the version it read. */
+export type LocalFiles = Omit<FilesApi, "bytes"> & {
+    bytes(path: string): Promise<VersionedReader>;
+};
+/** The size past which `read` answers `large`: 1 MiB. */
+export declare const TEXT_LIMIT: number;
+/** Returns a folder's files over `node:fs`: a relative path resolves against `root`, an absolute one is taken as given (the ancestor context files are read through it, §37g). A version is the SHA-256 of what is there, never an mtime: a file's contents (through a symlink, its target's), a directory's sorted entry names, and, for `stat` of a symlink itself, its target path. `read` answers `text` for UTF-8 without NUL up to 1 MiB, `large` above, `binary` otherwise, `missing` when absent (`SdkError("invalid")` for a directory); `bytes` streams the file with its size, a null mime and its version (`SdkError("unknown")` when absent); `stat` uses `lstat` (a symlink with its `target`), null when absent. `write` compares `expect` with the current version first (`stale { current }`, `absent` needing no file), answers `missing-parent` unless `parents`, and writes through a temporary file renamed into place (through a symlink, at its target), keeping an existing file's mode; `remove` compares `expect` the same way (`stale { current: null }` when nothing is there) and answers `saved` with the version it removed. `batch()` returns a plan whose `apply` and `upload()` reject with `SdkError("unavailable")`: core lays its own over them (`wrapFiles`). `format` runs `formatter`, else the first of `oxfmt`, `prettier` and `biome` under `<root>/node_modules/.bin`, then on the `PATH`, with the contents on stdin and the path for its config, answering `unchanged` when equal and `unavailable { reason }` when there is none or it fails. `scan` walks `directory` (default the root; an absolute one is walked as its own root and answered with absolute paths) breadth-first in pages of 500 entries, skipping `.git` and, unless `ignored: "include"` or the directory is itself ignored, what `.gitignore` files and `.git/info/exclude` ignore (`ignore`), then `complete`, or `incomplete` with `limit` after 50,000 entries or `permission` after an unreadable directory; entries carry no version. `find` matches the query against the scanned file paths, case-insensitively: exact name, name prefix, name substring, path substring, then a fuzzy subsequence, shorter first, at most `limit` (default 20, capped at 50), the scan reused for 5 s. `search` runs `ripgrep` (else `rg` on the PATH; with neither, a scan of the text files up to 1 MiB with a JavaScript regex) for the query, literal unless `regex`, with smart case unless `caseSensitive` is given, whole words alone when `wholeWord`, over the files the `include` globs pick (all when none) less the `exclude` globs; a file with a draft is searched in its draft's contents instead of on disk. It yields a `match` per matching line (1-based line and column and the first match's length, the line cut at 500 characters), drafts first, then `complete`, or `truncated` at `limit` (default 200); a regex or glob `rg` cannot read throws `SdkError("invalid")`. `watch` uses a recursive `fs.watch` on the root (a 1 s poll where there is none) or, given `paths`, a watch on each of them alone that waits for a missing one to appear and never polls, without ignored paths or directories, coalescing changes over 100 ms into `created`, `modified` and `removed` events with the version after (null when removed), a path's last change winning while the reader is behind. `signal` ends every open `watch`. */
+export declare function localFiles(root: string, options?: {
+    readonly ripgrep?: string;
+    readonly formatter?: string;
+    readonly signal?: AbortSignal;
+}): LocalFiles;

package/dist/src/local/files.js

@@ -0,0 +1,13 @@
+import {
+  TEXT_LIMIT2,
+  localFiles2
+} from "../../chunks/canvas-preview-drctegz4.js";
+import"../../chunks/canvas-preview-kn7kvbfj.js";
+import"../../chunks/canvas-preview-yjz0f7n4.js";
+import"../../chunks/canvas-preview-bxnqt8cd.js";
+import"../../chunks/canvas-preview-0nq75h9k.js";
+import"../../chunks/canvas-preview-mgcx2b2p.js";
+export {
+  TEXT_LIMIT2 as TEXT_LIMIT,
+  localFiles2 as localFiles
+};

package/dist/src/local/git-watch.d.ts

@@ -0,0 +1,15 @@
+import type { Disposer, GitStatus } from "@nyte-ai/schema";
+import type { FeedSink } from "./feed.ts";
+/** Where `localGit` found the repository holding its workspace: the worktree root, its git directory, the common directory linked worktrees share (the git directory otherwise), and the workspace's path below the root (`""` or ending in `/`). */
+export type Repository = {
+    readonly root: string;
+    readonly gitDir: string;
+    readonly commonDir: string;
+    readonly prefix: string;
+};
+/** One status watch shared by `localGit`'s feeds. */
+export type GitWatcher = {
+    subscribe(listener: (status: GitStatus) => void, fail: FeedSink<GitStatus>["fail"]): Disposer;
+};
+/** Returns the status watch `localGit` shares among its watchers: the first subscriber starts it and the last one stops it, and each gets the status at once, then again whenever a change could move it. A recursive `fs.watch` on the workspace hears worktree paths that `.gitignore` and `.git/info/exclude` do not ignore, and, in the git directory and the common directory, only HEAD, the index, branch and remote refs, `packed-refs`, `config` and the merge, cherry-pick, revert and rebase state, so object writes, logs and Nyte's snapshot refs read nothing; the `.git` entry itself appearing or going (not a change inside it, which Windows also reports on the folder) drops the remembered repository and starts over. Only where `fs.watch` is unavailable does it poll, every 2 s. */
+export declare function createWatcher(cwd: string, read: () => Promise<GitStatus>, repository: () => Promise<Repository | null>, forget: () => void): GitWatcher;

package/dist/src/local/git-watch.js

@@ -0,0 +1,7 @@
+import {
+  createWatcher2
+} from "../../chunks/canvas-preview-af86jz8t.js";
+import"../../chunks/canvas-preview-mgcx2b2p.js";
+export {
+  createWatcher2 as createWatcher
+};

package/dist/src/local/git.d.ts

@@ -0,0 +1,5 @@
+import type { ExecutionEnv, GitApi } from "@nyte-ai/core";
+/** Returns git over the CLI (`git`, default `git` on the PATH) for the repository holding `env.cwd`; every path it takes and answers is relative to the workspace (`env.cwd`), as `FilesApi`'s and the snapshots' are (§41j): the commands run at the repository root, and where the workspace is a subdirectory of the repository its prefix is added to every path going into git (`stage`, `unstage`, `discard` and `commit` files, `patches`, `contents` and `blame` paths) and stripped from every path coming out (`status`, `changes`, `patches`), the listings limited to it by pathspec (a rename source outside it reads `../…`); `root` stays the repository root, and `log`, `refs`, `branch`, `push` and `commit` of `staged` or `all` are repository-wide. `status` reads `git status --porcelain=v2 --branch -z --untracked-files=all` (`none` outside a repository, `head` null when unborn) with the staged and unstaged line stats (`git diff --numstat`), its `revision` the SHA-256 of those outputs with HEAD and each dirty worktree file's size and modification time, so an edit to an already-modified file moves it; `watch` yields the status whenever that revision moves, re-reading only on fs events that can move it (`createWatcher`: worktree paths git does not ignore and the git directory's HEAD, index and refs, coalesced over 250 ms; a 2 s poll only where `fs.watch` is unavailable). The repository (`git rev-parse`) is looked up once and kept while its git directory holds a HEAD. `changes(scope)` reads statuses with `git diff --name-status -z -M` and line stats with `--numstat` (`--ignore-all-space` under `ignoreWhitespace`, for the stats and patches only, so a whitespace-only change stays listed; `worktree` HEAD to the worktree, `staged` HEAD to the index, `unstaged` the index to the worktree, `commit` its parent (or the empty tree) to it, `branch` the merge base with HEAD to HEAD; HEAD of an unborn repository is the empty tree), untracked files joining `worktree` and `unstaged` with status `untracked` and their line count as added; its `revision` the status revision; `watchChanges` re-reads it as that revision moves. `patches` reads `git diff -U3` for the requested paths the scope reports (paths it does not report are left out), at most 32 per command, one `PatchEntry` per path, a text one carrying the path's section of the unified text as its `patch` (`binary`; `empty` when the scope reports the path but the diff shows no text, as under `ignoreWhitespace`; `too-large` past 1 MiB; `failed` alone when one path's read fails), `digest` the SHA-256 of the path's section; an untracked file is diffed against nothing on the host (its digest that of its patch), `failed` when it is gone or cannot be read. It yields one full `PatchSet` per revision as it moves. `contents` reads both sides (`git cat-file blob <rev>:<path>`, the index, the worktree file, or absent; a rename's old side at its old path; text, `truncated { head }` past 1 MiB, or binary). `log` pages `git log` with the cursor holding the next skip (default 50 a page); `refs` reads `git symbolic-ref`, `git for-each-ref refs/heads` and `git remote`; `blame` reads `git blame --porcelain` of the worktree file. Every write answers `busy { runs: [] }` while `index.lock` exists for the writes that take it (all but `push` and `branch` without checkout; the run-based busy is core's), then compares `expect` with the current status revision (`stale { revision }`): `stage` (`git add -A`), `unstage` (`git restore --staged`, `git rm --cached` when unborn), `discard` (`git restore --worktree`, untracked paths removed with `git clean -f`), `commit` (`staged`, `all` as `-a`, or the listed paths added and committed alone), `branch` (`git switch -c` when `checkout`, else `git branch`), `push` (`--porcelain`, `--set-upstream origin <branch>` when asked; a detached HEAD cannot set one); each answers `applied { revision }`, `unchanged` (`stage`, `unstage`, `discard` and `commit` when the revision did not move or git had nothing to commit, `push` when every ref was already up to date; `branch` always applies), or `rejected { reason }` with git's message. Reads outside a repository throw `SdkError("unavailable")`. */
+export declare function localGit(env: ExecutionEnv, options?: {
+    readonly git?: string;
+}): GitApi;

package/dist/src/local/git.js

@@ -0,0 +1,13 @@
+import {
+  localGit2
+} from "../../chunks/canvas-preview-5ekjx6sw.js";
+import"../../chunks/canvas-preview-tjhabynd.js";
+import"../../chunks/canvas-preview-kn7kvbfj.js";
+import"../../chunks/canvas-preview-yjz0f7n4.js";
+import"../../chunks/canvas-preview-af86jz8t.js";
+import"../../chunks/canvas-preview-bxnqt8cd.js";
+import"../../chunks/canvas-preview-0nq75h9k.js";
+import"../../chunks/canvas-preview-mgcx2b2p.js";
+export {
+  localGit2 as localGit
+};

package/dist/src/local/github.d.ts

@@ -0,0 +1,30 @@
+import type { ExecutionEnv, GitHubAccountApi, GitHubApi } from "@nyte-ai/core";
+/**
+ * Returns the machine's GitHub CLI login through `gh` (`gh`, default `gh` on
+ * the PATH), run in `home` (default `os.homedir()`). Nothing runs until it is
+ * asked for. `account` reads the github.com account (`gh auth status`, then
+ * `gh api user`); while a sign-in runs, it answers its code until it ends,
+ * then what the login became. `signIn` starts at most one `gh auth login`
+ * for the whole machine and `signOut` cancels it or runs `gh auth logout`.
+ */
+export declare function localGitHubAccount(options?: {
+    readonly gh?: string;
+    readonly home?: string;
+}): GitHubAccountApi;
+/**
+ * Returns GitHub for each local workspace through the machine's `gh` (`gh`,
+ * default `gh` on the PATH) and `git`. Nothing runs until a state is asked
+ * for. `state` reads the repository from the remotes in gh's
+ * base-repository order (`upstream`, `github`, `origin`, then the rest; only
+ * github.com remotes) and, while gh has a login, the checked-out branch's
+ * pull request with its check rollup (`gh pr view <branch> --json`, the
+ * branch as `<owner>:<branch>` when it tracks a fork); without one the pull
+ * request is `unavailable`. `createPullRequest` answers each precondition, an
+ * open pull request as `exists`, and otherwise runs
+ * `gh pr create --head <branch>` with the title as an argument, the body on
+ * stdin, and `--fill` for whichever of the two is missing.
+ */
+export declare function localGitHub(options?: {
+    readonly gh?: string;
+    readonly git?: string;
+}): (env: ExecutionEnv) => GitHubApi;

package/dist/src/local/github.js

@@ -0,0 +1,9 @@
+import {
+  localGitHubAccount2,
+  localGitHub2
+} from "../../chunks/canvas-preview-8xc0vn7v.js";
+import"../../chunks/canvas-preview-bxnqt8cd.js";
+export {
+  localGitHub2 as localGitHub,
+  localGitHubAccount2 as localGitHubAccount
+};

package/dist/src/local/identity.d.ts

@@ -0,0 +1,3 @@
+import type { EnvironmentIdentity } from "@nyte-ai/schema";
+/** Returns a folder's identity from its inode and nanosecond creation time, independent of boot-assigned device numbers and its path. A rename keeps it; a replacement folder gets another identity. Without an inode or creation time, hashes the real path. An unresolved path hashes its absolute form so inspection can report it unavailable. */
+export declare function folderIdentity(path: string): Promise<EnvironmentIdentity>;

package/dist/src/local/identity.js

@@ -0,0 +1,7 @@
+import {
+  folderIdentity2
+} from "../../chunks/canvas-preview-1sq7z9jq.js";
+import"../../chunks/canvas-preview-0nq75h9k.js";
+export {
+  folderIdentity2 as folderIdentity
+};

package/dist/src/local/jobs.d.ts

@@ -0,0 +1,7 @@
+import type { ExecutionEnv } from "@nyte-ai/core";
+/** Returns `exec` for a folder: each call starts one process as a `Job` (a fresh id; `key` null, core keys pty jobs) in `cwd` resolved against `root` (default `root`), with `env` laid over `process.env`. A string command runs through the platform shell (`/bin/sh -c`, `cmd.exe /d /s /c` on Windows) and an argv directly; `[]` with `pty` runs the login shell (`shell()` read at each start, else `$SHELL`, else `/bin/sh`, as a login shell; §37h), a pty's environment carrying `TERM=xterm-256color`, `COLORTERM=truecolor` and `TERM_PROGRAM=Nyte` without Electron's `ELECTRON_RUN_AS_NODE` and `NODE_OPTIONS`, and `[]` without one throws `SdkError("invalid")`. A program that cannot start throws `SdkError("unavailable")`. Without `pty` the process is piped through `node:child_process` in its own process group, stdout and stderr interleaved in `output` (with `stdio: "protocol"`, stderr's frames tagged `stream: "stderr"` and the pipe paced like a pty, so a reader open from the start misses nothing) and stdin fed by `write`; with `pty` it runs under `@lydell/node-pty`, loaded on first use through `createRequire` (§41a; `loadPty`, given, loads it instead, on every pty start), at the given size, and a platform where it does not load throws `SdkError("unavailable")`. `output()` opens a reader over the last 1 MiB of output that yields `bytes`, a `gap` where the reader fell behind or opened after output was dropped, and `exit { code }` last; a merged pipe never stalls, and a pty or a protocol pipe pauses while its slowest open reader is 256 KiB behind, resuming once it is within 64 KiB. `resize` resizes a pty (`not-pty` for a pipe, `missing` once it ended); `idle` checks the OS process table for a login shell with no live children (false for a pipe or explicit command, true once it ended); `stop` sends SIGTERM to a pipe's process group (SIGHUP to a pty), SIGKILL after 2 s (on Windows, which has no signals, it ends a pipe's process tree at once with `taskkill /T /F`), and answers `settled { outcome }` (also once it ended); `settled` resolves `exited { code, reason }` (`code` null after a signal), `reason` `exited` when the process ended on its own and `terminated` after `stop` or an aborted `signal`, and an aborted `settled` signal rejects with `SdkError("unavailable")`; `close` detaches this handle's readers. An aborted `signal` stops the process. `signal` on the options ends every reader of every job started here, leaving the processes running (what the provider's `close` does). */
+export declare function localExec(root: string, options?: {
+    readonly shell?: () => string | null;
+    readonly signal?: AbortSignal;
+    readonly loadPty?: () => unknown;
+}): ExecutionEnv["exec"];

package/dist/src/local/jobs.js

@@ -0,0 +1,7 @@
+import {
+  localExec2
+} from "../../chunks/canvas-preview-vm9zdp2t.js";
+import"../../chunks/canvas-preview-bxnqt8cd.js";
+export {
+  localExec2 as localExec
+};

package/dist/src/local/legacy-trust.d.ts

@@ -0,0 +1,10 @@
+import type { StoreConnection } from "@nyte-ai/core";
+/**
+ * Carries the folders an older Nyte, or uji before it, was told to trust into
+ * the store, once per store: the grants in `~/.nyte/workspaces.json`,
+ * `~/.nyte/trust.json` and `~/.uji/trust.json` become folder trust decisions
+ * where the store saved none. A folder that is gone, the home folder and the
+ * folders above it are skipped: home holds the user's own files, and a grant
+ * there trusted every project under it. The files are left as they are.
+ */
+export declare function importLegacyTrust(connection: StoreConnection, home: string): Promise<void>;

package/dist/src/local/legacy-trust.js

@@ -0,0 +1,6 @@
+import {
+  importLegacyTrust2
+} from "../../chunks/canvas-preview-9aqczacs.js";
+export {
+  importLegacyTrust2 as importLegacyTrust
+};

package/dist/src/local/patch.d.ts

@@ -0,0 +1,16 @@
+import type { FileStatus, LineStat, PatchEntry } from "@nyte-ai/schema";
+import type { Ran } from "./command.ts";
+export declare const PATCH_LIMIT: number;
+export type Changed = {
+    readonly path: string;
+    readonly status: FileStatus;
+    readonly from?: string;
+};
+/** The entry for two texts diffed on the host: a text entry's digest is its patch's, so it moves with the whitespace mode; an empty one digests both sides and the mode. */
+export declare function textEntry(path: string, status: FileStatus, before: string | null, after: string | null, options?: {
+    readonly ignoreWhitespace?: boolean;
+}): PatchEntry;
+export declare function readPatches(files: readonly Changed[], read: (files: readonly Changed[], limit: number) => Promise<Ran>, emptyDigest: (file: Changed) => string): Promise<readonly PatchEntry[]>;
+export declare function lineStat(before: string, after: string): LineStat;
+export declare function parseNumstat(output: string): ReadonlyMap<string, LineStat>;
+export declare function parseNameStatus(output: string): readonly Changed[];

package/dist/src/local/patch.js

@@ -0,0 +1,17 @@
+import {
+  PATCH_LIMIT2,
+  textEntry2,
+  readPatches2,
+  lineStat2,
+  parseNumstat2,
+  parseNameStatus2
+} from "../../chunks/canvas-preview-tjhabynd.js";
+import"../../chunks/canvas-preview-0nq75h9k.js";
+export {
+  PATCH_LIMIT2 as PATCH_LIMIT,
+  lineStat2 as lineStat,
+  parseNameStatus2 as parseNameStatus,
+  parseNumstat2 as parseNumstat,
+  readPatches2 as readPatches,
+  textEntry2 as textEntry
+};

package/dist/src/local/provider.d.ts

@@ -0,0 +1,11 @@
+import type { EnvironmentProvider } from "@nyte-ai/core";
+/** Returns the local environment provider (`kind: "local"`): a folder on this machine. `inspect` answers a `{ kind: "local", path }` target's `folderIdentity` (§41d), `available` when the path is a readable directory (else `unavailable { unreachable }`; a target without a path `unavailable { unsupported }`, identified by the hash of its locator), and the project sources present under it, relative to it, in this order: the plugin files `.nyte/plugins/<name>.{ts,mts,js,mjs}` and `.nyte/plugins/<name>/index.<ext>`, the skills `.nyte/skills/<name>/SKILL.md` and `.agents/skills/<name>/SKILL.md`, the prompts `.nyte/prompts/<name>.md`, then `.nyte/SYSTEM.md`, `.nyte/APPEND_SYSTEM.md` and `.nyte/mcp.json`: the files project trust gates. Context files such as `AGENTS.md` load without trust and are not listed. `attach` resolves the real path (a target that is not a directory throws `SdkError("unavailable")`) and returns an `ExecutionEnv` with that identity, `cwd` the real path, `files` from `localFiles` (with `ripgrep` and `formatter`), `exec` from `localExec`, and a `close` that ends its file watches and the jobs' readers, leaving running jobs alone. `git` is `localGit` (with `git`), `github` is `localGitHub` (with `gh` and `git`; the login is the machine's, `localGitHubAccount`), `snapshots` is `localSnapshots` storing tree walks under `<home>/.nyte/snapshots` (`home` default `os.homedir()`), and absent for a folder that contains `<home>/.nyte` or lies inside it outside `<home>/.nyte/worktrees` (the home folder itself, its ancestors, Nyte's own state): there a snapshot would walk or stage everything under home, the store and secrets included, to report changes in the store it just wrote; `worktrees` is `localWorktrees` (with `home` and `git`); no `browser` (the desktop wraps one in); `destroy` rejects with `SdkError("unavailable")`: a local folder is never torn down. */
+export declare function localProvider(options?: {
+    readonly home?: string;
+    readonly git?: string;
+    readonly gh?: string;
+    readonly ripgrep?: string;
+    readonly formatter?: string;
+    /** The login shell a pty job without a command runs, read at each start; null or absent is `$SHELL`. */
+    readonly shell?: () => string | null;
+}): EnvironmentProvider;

package/dist/src/local/provider.js

@@ -0,0 +1,20 @@
+import {
+  localProvider2
+} from "../../chunks/canvas-preview-e3vnkkc5.js";
+import"../../chunks/canvas-preview-2jwbe14k.js";
+import"../../chunks/canvas-preview-5ekjx6sw.js";
+import"../../chunks/canvas-preview-8xc0vn7v.js";
+import"../../chunks/canvas-preview-1sq7z9jq.js";
+import"../../chunks/canvas-preview-vm9zdp2t.js";
+import"../../chunks/canvas-preview-crmzxxt8.js";
+import"../../chunks/canvas-preview-tjhabynd.js";
+import"../../chunks/canvas-preview-drctegz4.js";
+import"../../chunks/canvas-preview-kn7kvbfj.js";
+import"../../chunks/canvas-preview-yjz0f7n4.js";
+import"../../chunks/canvas-preview-af86jz8t.js";
+import"../../chunks/canvas-preview-bxnqt8cd.js";
+import"../../chunks/canvas-preview-0nq75h9k.js";
+import"../../chunks/canvas-preview-mgcx2b2p.js";
+export {
+  localProvider2 as localProvider
+};

package/dist/src/local/snapshots.d.ts

@@ -0,0 +1,7 @@
+import type { ExecutionEnv, SnapshotsApi } from "@nyte-ai/core";
+/** Returns content-addressed snapshots of an environment's tree, so equal trees are equal ids whichever run took them. `before(run)` is taken once per run in this process and answered again after; `after(run)` is taken on every call. In a repository (`git`, default `git` on the PATH), a snapshot writes the environment's part of the worktree, tracked and untracked files that are not ignored, into a temporary index seeded from the real one (`GIT_INDEX_FILE`, `git add -A`, `git write-tree --prefix` for a workspace below the root; the real index is never touched) and keeps the tree reachable for good from the hidden ref `refs/nyte/kept`, a tree of generation trees `g000000`, `g000001`, ... that each hold up to 1,000 snapshot trees named by their hash (only the newest generation and the root are rewritten, in the background after a snapshot of a tree this process has not kept, so a snapshot costs two git spawns: `add` and `write-tree`; the per-tree refs `refs/nyte/snapshots/<tree>` of earlier versions all fold into it and go); the id is `git:<tree>`. The repository is looked up once. Without a repository it walks the tree as `localFiles.scan` does (up to `limit` entries, default 50 000), stores each file's bytes up to 1 MiB once under `<store>/objects/<sha256>` (a larger file is hashed, not stored; a file whose size, mtime and inode did not move is not re-read) and the tree, `{ incomplete, files }` (whether the walk stopped short, at its limit or at an unreadable directory, and the manifest of paths to content hashes), under `<store>/trees/<sha256 of it>.json`; the id is `tree:<hash>`. `diff(from, to)` answers the `ChangeSet` between two snapshots of one kind (empty, without running git, when they are equal; `git diff-tree -r -M --name-status`/`--numstat`, or the two manifests compared, an exact-content move a rename; the empty id `""` is the empty tree), its `revision` `to`; a path only an incomplete side lacks is neither added nor deleted but `modified` with an `unknown` stat; `patches(from, to, paths, options)` answers one `PatchEntry` per path the comparison reports, a text one carrying its unified diff as `localGit`'s do (`git diff` between the trees, read as `localGit.patches` reads: a path past 1 MiB `too-large`, one whose read fails `failed`, the others fine), or, between manifests, from the stored contents with the line diff, a text entry's digest its patch's so it moves with `ignoreWhitespace` (`too-large` for a file not stored, `binary` for one not text, `failed { reason: "incomplete" }` for a path only an incomplete side lacks). Snapshots of two kinds do not compare: `SdkError("invalid")`. */
+export declare function localSnapshots(env: ExecutionEnv, options: {
+    readonly store: string;
+    readonly git?: string;
+    readonly limit?: number;
+}): SnapshotsApi;

package/dist/src/local/snapshots.js

@@ -0,0 +1,11 @@
+import {
+  localSnapshots2
+} from "../../chunks/canvas-preview-crmzxxt8.js";
+import"../../chunks/canvas-preview-tjhabynd.js";
+import"../../chunks/canvas-preview-kn7kvbfj.js";
+import"../../chunks/canvas-preview-bxnqt8cd.js";
+import"../../chunks/canvas-preview-0nq75h9k.js";
+import"../../chunks/canvas-preview-mgcx2b2p.js";
+export {
+  localSnapshots2 as localSnapshots
+};

package/dist/src/local/text.d.ts

@@ -0,0 +1 @@
+export declare function decodeText(bytes: Uint8Array): string | null;

package/dist/src/local/text.js

@@ -0,0 +1,6 @@
+import {
+  decodeText2
+} from "../../chunks/canvas-preview-kn7kvbfj.js";
+export {
+  decodeText2 as decodeText
+};

package/dist/src/local/tree.d.ts

@@ -0,0 +1,50 @@
+import type { Disposer } from "@nyte-ai/schema";
+type TreeEntry = {
+    readonly path: string;
+    readonly kind: "file" | "directory" | "symlink";
+    readonly size: number | null;
+};
+export type WalkFrame = {
+    readonly kind: "entries";
+    readonly entries: readonly TreeEntry[];
+} | {
+    readonly kind: "complete";
+} | {
+    readonly kind: "incomplete";
+    readonly reason: "limit" | "permission";
+};
+export type Ignores = {
+    matches(path: string, directory: boolean): Promise<boolean>;
+    ignored(path: string, directory: boolean): Promise<boolean>;
+    forget(directory: string): void;
+};
+export declare const WALK_LIMIT = 50000;
+export declare function createIgnores(root: string): Ignores;
+export declare function walkTree(root: string, options: {
+    readonly directory?: string;
+    readonly ignored: "exclude" | "include";
+    readonly ignores?: Ignores;
+    readonly limit?: number;
+    readonly page?: number;
+}): AsyncGenerator<WalkFrame>;
+/** Calls `changed` with the paths below `root` that moved, coalesced over `delay`, from a recursive `fs.watch`; where that is unavailable it walks the tree every `poll` ms when one is given, and calls `unwatched` once either way. */
+export declare function watchTree(root: string, options: {
+    readonly delay: number;
+    readonly poll: number | null;
+    readonly unwatched?: () => void;
+}, changed: (paths: ReadonlySet<string>) => void): Disposer;
+/**
+ * Calls `changed` when what is at the absolute `target` moves, coalesced over
+ * `delay`: with `""` for the target itself (created, removed, replaced or, for
+ * a file, written) and the path below it for a change inside a directory,
+ * which is watched recursively. A file is watched itself and re-watched when
+ * it is replaced, a directory beside a watch on its parent for its own name;
+ * while the target is missing, the nearest directory above it that exists is
+ * watched for the next missing name, and the watch moves down as they appear.
+ * Nothing polls.
+ */
+export declare function watchPath(target: string, options: {
+    readonly delay: number;
+}, changed: (paths: ReadonlySet<string>) => void): Disposer;
+export declare function readErrorCode(error: unknown): string | null;
+export {};

package/dist/src/local/tree.js

@@ -0,0 +1,16 @@
+import {
+  WALK_LIMIT2,
+  createIgnores2,
+  walkTree2,
+  watchTree2,
+  watchPath2,
+  readErrorCode2
+} from "../../chunks/canvas-preview-mgcx2b2p.js";
+export {
+  WALK_LIMIT2 as WALK_LIMIT,
+  createIgnores2 as createIgnores,
+  readErrorCode2 as readErrorCode,
+  walkTree2 as walkTree,
+  watchPath2 as watchPath,
+  watchTree2 as watchTree
+};

package/dist/src/local/workspace-migration.d.ts

@@ -0,0 +1,2 @@
+import type { StoreConnection } from "@nyte-ai/core";
+export declare function migrateLocalWorkspaceIdentities(connection: StoreConnection): Promise<void>;

package/dist/src/local/workspace-migration.js

@@ -0,0 +1,7 @@
+import {
+  migrateLocalWorkspaceIdentities2
+} from "../../chunks/canvas-preview-4e0pxa32.js";
+import"../../chunks/canvas-preview-0nq75h9k.js";
+export {
+  migrateLocalWorkspaceIdentities2 as migrateLocalWorkspaceIdentities
+};

package/dist/src/local/worktrees.d.ts

@@ -0,0 +1,46 @@
+import type { WorktreeProvider } from "@nyte-ai/core";
+/** One checkout of a repository: its folder and the branch it has out, null when HEAD is detached. */
+export interface ListedWorktree {
+    readonly path: string;
+    readonly branch: string | null;
+}
+/** Lists every worktree of the repository holding `cwd` (`git worktree list --porcelain -z`), the main checkout first. */
+export declare function listWorktrees(cwd: string, options?: {
+    readonly git?: string;
+}): Promise<readonly ListedWorktree[]>;
+/** Checks `branch` out in a new worktree at `path` (`git worktree add`), creating the branch at `from` when given. */
+export declare function addWorktree(cwd: string, input: {
+    readonly path: string;
+    readonly branch: string;
+    readonly from?: string;
+}, options?: {
+    readonly git?: string;
+}): Promise<void>;
+/** Whether `name` is a local branch of the repository holding `cwd`. */
+export declare function hasBranch(cwd: string, name: string, options?: {
+    readonly git?: string;
+}): Promise<boolean>;
+/**
+ * Returns git worktrees for local workspaces (`git`, default `git` on the
+ * PATH), each under `<home>/.nyte/worktrees/<repository>/<slug>` on the branch
+ * `nyte/<slug>`, the slug the title's words and a hash of the name.
+ *
+ * `create` refuses a folder outside a repository or one without a commit, then
+ * answers the worktree already on that branch, or adds one from HEAD and
+ * copies the workspace's uncommitted changes in: the worktree's tracked and
+ * untracked files, ignored ones aside, are written to a tree through a
+ * temporary index seeded from the real one (which is never touched), and the
+ * new checkout moves to that tree with its index left at HEAD, so the changes
+ * show as uncommitted there too. A workspace below the repository's root gets
+ * the same folder below the worktree's.
+ *
+ * `remove` keeps a worktree, folder and branch, while it holds uncommitted
+ * changes or ignored files, since none were copied in and one may be a
+ * `.env` or a local database (a wholly ignored folder such as `node_modules`
+ * or a build's output aside); otherwise it removes the folder
+ * (`git worktree remove`) and deletes the branch unless it moved past `base`.
+ */
+export declare function localWorktrees(options?: {
+    readonly home?: string;
+    readonly git?: string;
+}): WorktreeProvider;

package/dist/src/local/worktrees.js

@@ -0,0 +1,14 @@
+import {
+  listWorktrees2,
+  addWorktree2,
+  hasBranch2,
+  localWorktrees2
+} from "../../chunks/canvas-preview-2jwbe14k.js";
+import"../../chunks/canvas-preview-bxnqt8cd.js";
+import"../../chunks/canvas-preview-0nq75h9k.js";
+export {
+  addWorktree2 as addWorktree,
+  hasBranch2 as hasBranch,
+  listWorktrees2 as listWorktrees,
+  localWorktrees2 as localWorktrees
+};

package/dist/src/mcp/config.d.ts

@@ -0,0 +1,75 @@
+import type { Json, McpChange, McpExposure, McpOAuthConfig, McpScope, ValidationIssue } from "@nyte-ai/schema";
+type McpTransportConfig = {
+    readonly kind: "stdio";
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly env: Readonly<Record<string, string>>;
+    readonly cwd: string | null;
+} | {
+    readonly kind: "http";
+    readonly url: string;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly oauth: McpOAuthConfig;
+};
+export type McpServerEntry = {
+    readonly name: string;
+    readonly scope: McpScope;
+    readonly path: string;
+    readonly override: string | null;
+    readonly transport: McpTransportConfig;
+    readonly enabled: boolean;
+    readonly timeoutMs: number;
+    readonly description: string | null;
+    readonly exposure: McpExposure;
+    /** Patterns in file order; `*` matches any characters. */
+    readonly toolExposure: readonly (readonly [pattern: string, exposure: McpExposure])[];
+};
+export type McpFileContents = {
+    readonly kind: "missing";
+} | {
+    readonly kind: "text";
+    readonly text: string;
+} | {
+    readonly kind: "unreadable";
+    readonly message: string;
+};
+export type McpFile = {
+    readonly path: string;
+    readonly scope: McpScope;
+    readonly contents: McpFileContents;
+};
+export type McpConfig = {
+    readonly servers: ReadonlyMap<string, McpServerEntry>;
+    readonly issues: readonly ValidationIssue[];
+};
+/** Reads one `mcp.json`; a file that cannot be read is `unreadable`, not missing. */
+export declare function readMcpFile(path: string): Promise<McpFileContents>;
+/**
+ * Merges the user file and then the project file into one server list. A
+ * project entry replaces the user entry of the same name; one with only
+ * `enabled`, `exposure` or `toolExposure` overrides those fields instead.
+ * An invalid entry becomes an issue and is left out.
+ */
+export declare function parseMcpConfig(files: readonly McpFile[]): McpConfig;
+/**
+ * Plans a change to the `mcpServers` of one `mcp.json`, keeping the rest of
+ * the file: `change` returns the new servers, or `null` when it has nothing
+ * to change. A missing file starts empty; one that is not a JSON object is
+ * refused. Nothing is written; pass the text to {@link writeMcpFile}.
+ */
+export declare function planMcpEdit(path: string, change: (servers: {
+    readonly [name: string]: Json;
+}) => {
+    readonly [name: string]: Json;
+} | null): Promise<{
+    readonly kind: "planned";
+    readonly text: string;
+} | Exclude<McpChange, {
+    kind: "updated";
+}>>;
+/**
+ * Replaces one `mcp.json` whole, readable only by the user as it may hold
+ * secrets. A symlinked file is written through the link.
+ */
+export declare function writeMcpFile(path: string, text: string): Promise<void>;
+export {};

package/dist/src/mcp/config.js

@@ -0,0 +1,12 @@
+import {
+  readMcpFile2,
+  parseMcpConfig2,
+  planMcpEdit2,
+  writeMcpFile2
+} from "../../chunks/canvas-preview-kdqgrstc.js";
+export {
+  parseMcpConfig2 as parseMcpConfig,
+  planMcpEdit2 as planMcpEdit,
+  readMcpFile2 as readMcpFile,
+  writeMcpFile2 as writeMcpFile
+};

package/dist/src/mcp/connect.d.ts

@@ -0,0 +1,15 @@
+import type { McpTransport } from "@earendil-works/pi-mcp";
+import type { OAuthChallenge } from "@earendil-works/pi-mcp/oauth";
+import type { PluginStorage } from "@nyte-ai/core";
+import type { McpWorkspace } from "@nyte-ai/core/server";
+import type { McpOAuthConfig } from "@nyte-ai/schema";
+import type { McpServerEntry } from "./config.ts";
+import type { McpOAuthSettings } from "./oauth.ts";
+export type McpConnector = (entry: McpServerEntry, context: {
+    readonly workspace: McpWorkspace;
+    readonly home: string;
+    readonly secrets: PluginStorage["secrets"];
+    readonly challenged: (challenge: OAuthChallenge) => void;
+}) => McpTransport;
+export declare const connectServer: McpConnector;
+export declare function oauthSettings(config: McpOAuthConfig, server: string): McpOAuthSettings;

package/dist/src/mcp/connect.js

@@ -0,0 +1,9 @@
+import {
+  connectServer2,
+  oauthSettings2
+} from "../../chunks/canvas-preview-pkzqg96v.js";
+import"../../chunks/canvas-preview-5z63am63.js";
+export {
+  connectServer2 as connectServer,
+  oauthSettings2 as oauthSettings
+};