@open-agent-toolkit/cli 0.2.62 → 0.2.64

package/dist/commands/tools/shared/pack-lifecycle-outcome.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pack-lifecycle-outcome.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/shared/pack-lifecycle-outcome.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAEL,KAAK,4BAA4B,EACjC,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,aAAa,GAAG,MAAM,CAAC;IAClC,sBAAsB,EAAE,SAAS,aAAa,EAAE,CAAC;IACjD,YAAY,EAAE,SAAS,aAAa,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IACjC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;IACtD,SAAS,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,CAAC,CAAC;IACjB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,SAAS,EAAE;QACT,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,qBAAqB,CAAC;QACnE,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;KACzC,CAAC;IACF,IAAI,EAAE,mBAAmB,CAAC;IAC1B,aAAa,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC1C,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CACrC;AASD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,aAAa,GAAG,MAAM,CAAC;IAClC,mBAAmB,EAAE,SAAS,aAAa,EAAE,CAAC;IAC9C,aAAa,EAAE,SAAS,aAAa,EAAE,CAAC;CACzC,GAAG,kBAAkB,CAkBrB;AAED,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,cAAc,EACtB,SAAS,GAAE,SAAS,4BAA4B,EAAO,GACtD,mBAAmB,CAYrB;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,SAAS,EAAE,kBAAkB,CAAC;IAC9B,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC1C,IAAI,EAAE,mBAAmB,CAAC;IAC1B,aAAa,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,oBAAoB,CAqEvB"}
+{"version":3,"file":"pack-lifecycle-outcome.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/shared/pack-lifecycle-outcome.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAEL,KAAK,4BAA4B,EACjC,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,aAAa,GAAG,MAAM,CAAC;IAClC,sBAAsB,EAAE,SAAS,aAAa,EAAE,CAAC;IACjD,YAAY,EAAE,SAAS,aAAa,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IACjC,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;IACtD,SAAS,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACnD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,CAAC,CAAC;IACjB,SAAS,EAAE,kBAAkB,CAAC;IAC9B,SAAS,EAAE;QACT,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,qBAAqB,CAAC;QACnE,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;KACzC,CAAC;IACF,IAAI,EAAE,mBAAmB,CAAC;IAC1B,aAAa,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC1C,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CACrC;AASD,wBAAgB,iCAAiC,CAAC,KAAK,EAAE;IACvD,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE,aAAa,GAAG,MAAM,CAAC;IAClC,mBAAmB,EAAE,SAAS,aAAa,EAAE,CAAC;IAC9C,aAAa,EAAE,SAAS,aAAa,EAAE,CAAC;CACzC,GAAG,kBAAkB,CAkBrB;AAED;;;;;;;;GAQG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,cAAc,EACtB,SAAS,GAAE,SAAS,4BAA4B,EAAO,GACtD,mBAAmB,CAiBrB;AAED,6EAA6E;AAC7E,wBAAgB,yBAAyB,CACvC,SAAS,GAAE,SAAS,4BAA4B,EAAO,EACvD,MAAM,CAAC,EAAE,MAAM,GACd,mBAAmB,CAOrB;AAED,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,SAAS,EAAE,kBAAkB,CAAC;IAC9B,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC1C,IAAI,EAAE,mBAAmB,CAAC;IAC1B,aAAa,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACvC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,GAAG,oBAAoB,CAqEvB"}

package/dist/commands/tools/shared/pack-lifecycle-outcome.js

@@ -20,18 +20,39 @@ export function resolveAdditivePackScopeSelection(input) {
         ]),
     };
 }
+/**
+ * Derives the provider sync outcome from an auto-sync run and its evidence.
+ *
+ * Status follows the pinned severity matrix rather than the diagnostic code
+ * name: only an observed `failed` materialization degrades an otherwise
+ * successful run to `partial`. An inactive provider, an unsupported content
+ * kind, or a host that needs a catalog refresh are `info`-severity facts and
+ * leave the outcome `complete`, so a healthy install keeps exit code 0.
+ */
 export function providerSyncOutcomeFromAutoSync(result, providers = []) {
+    const materializationFailed = providers.some(({ materialization }) => materialization.state === 'failed');
     return {
         scopes: result.scopes,
         status: result.scopes.length === 0
             ? 'not-run'
-            : result.synced
-                ? 'complete'
-                : 'failed',
+            : !result.synced
+                ? 'failed'
+                : materializationFailed
+                    ? 'partial'
+                    : 'complete',
         providers,
         ...(result.error ? { error: result.error } : {}),
     };
 }
+/** A `not-run` sync outcome that still carries registry-derived evidence. */
+export function notRunProviderSyncOutcome(providers = [], reason) {
+    return {
+        scopes: [],
+        status: 'not-run',
+        providers,
+        ...(reason ? { error: reason } : {}),
+    };
+}
 export function evaluatePackLifecycleOutcome(input) {
     const recovery = [];
     let canonicalStatus;

package/dist/commands/tools/shared/pack-provider-evidence.d.ts

@@ -0,0 +1,73 @@
+import type { ManagedContentKind, ProviderScopeContext, UserAgentMaterializationCoverage } from '../../../providers/shared/registry.js';
+import type { ConcreteScope } from '../../../shared/types.js';
+import type { AutoSyncResult } from './auto-sync.js';
+import { type ProviderReachabilityEvidence, type ToolPackEvidence } from './pack-evidence.js';
+import type { PackInventory, ScopedPackInventory } from './pack-inventory.js';
+import { type ProviderExtensionOperationEvidence, type ProviderSyncOperationEvidence, type ProviderRefreshPolicyLookup } from './provider-reachability.js';
+import type { PackName } from './types.js';
+type AssetsByContentKind = Partial<Record<ManagedContentKind, readonly string[]>>;
+/** Realized managed assets for one scope, grouped by provider content kind. */
+export declare function packAssetsByContentKind(scoped: ScopedPackInventory): AssetsByContentKind;
+/**
+ * Assets the pack inventory reports as having no provider materialization.
+ *
+ * This is an inventory observation about assets, not a reachability claim:
+ * the mapper still decides which providers are responsible from registry
+ * capability alone.
+ */
+export declare function unmaterializedAssetsByContentKind(scoped: ScopedPackInventory): AssetsByContentKind;
+export interface PackProviderEvidenceInput {
+    pack: PackName;
+    /** Per-scope pack inventory; the sole source of the asset lists. */
+    scopedInventories: readonly ScopedPackInventory[];
+    providerContexts: readonly ProviderScopeContext[];
+    mode: 'lifecycle' | 'inventory';
+    /** Only meaningful in `lifecycle` mode; `false` records a skipped sync. */
+    syncRan?: boolean;
+    syncOperationResults?: readonly ProviderSyncOperationEvidence[];
+    extensionResults?: readonly ProviderExtensionOperationEvidence[];
+    refreshPolicy?: ProviderRefreshPolicyLookup;
+    /** Restricts evidence to these scopes; defaults to every resolved context. */
+    scopes?: readonly ConcreteScope[];
+}
+/**
+ * The single seam that turns provider registry state plus pack inventory into
+ * reachability evidence, shared by the lifecycle outcomes and every inventory
+ * renderer so the two cannot drift.
+ */
+export declare function packProviderEvidence(input: PackProviderEvidenceInput): ProviderReachabilityEvidence[];
+/**
+ * Drops `user-agent-unmaterialized` when an active provider materializes all
+ * managed user-scope roles.
+ *
+ * `status` and `doctor` have always applied this; `list` and `info` did not,
+ * so they reported user agents as unmaterialized that the active Codex or
+ * Cursor adapter in fact supplies. Sharing one implementation is what makes
+ * the four surfaces agree.
+ */
+export declare function applyUserAgentCoverage(inventory: PackInventory, coverage: UserAgentMaterializationCoverage): PackInventory;
+/**
+ * Provider evidence for a pack lifecycle outcome (install, update, remove).
+ *
+ * When `sync` is absent the auto-sync step did not run, so no projection or
+ * materialization claim is made and the evidence carries activation and
+ * capability only — the pinned matrix's `not-run` row.
+ */
+export declare function lifecycleProviderEvidence(input: {
+    pack: PackName;
+    scopedInventories: readonly ScopedPackInventory[];
+    providerContexts: readonly ProviderScopeContext[];
+    scopes?: readonly ConcreteScope[];
+    sync?: AutoSyncResult;
+}): ProviderReachabilityEvidence[];
+/**
+ * Re-projects a pack evidence item with lifecycle provider evidence.
+ *
+ * `providerDiagnostics` only emits `provider-materialization-failed` in
+ * lifecycle mode, so an observed failure reaches pack evidence only when the
+ * outcome's `finalEvidence` is rebuilt with the run's provider rows. Without
+ * this the error-severity code would have no production emitter at all.
+ */
+export declare function withLifecycleProviderEvidence(evidence: ToolPackEvidence | null, providers: readonly ProviderReachabilityEvidence[]): ToolPackEvidence | null;
+export {};
+//# sourceMappingURL=pack-provider-evidence.d.ts.map

package/dist/commands/tools/shared/pack-provider-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-provider-evidence.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/shared/pack-provider-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,oBAAoB,EACpB,gCAAgC,EACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAGL,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAEL,KAAK,kCAAkC,EACvC,KAAK,6BAA6B,EAClC,KAAK,2BAA2B,EACjC,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAiB,QAAQ,EAAE,MAAM,SAAS,CAAC;AAiBvD,KAAK,mBAAmB,GAAG,OAAO,CAChC,MAAM,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC,CAC9C,CAAC;AAUF,+EAA+E;AAC/E,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,mBAAmB,GAC1B,mBAAmB,CAUrB;AAED;;;;;;GAMG;AACH,wBAAgB,iCAAiC,CAC/C,MAAM,EAAE,mBAAmB,GAC1B,mBAAmB,CAOrB;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,QAAQ,CAAC;IACf,oEAAoE;IACpE,iBAAiB,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAClD,gBAAgB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAClD,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;IAChC,2EAA2E;IAC3E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oBAAoB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAChE,gBAAgB,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;IACjE,aAAa,CAAC,EAAE,2BAA2B,CAAC;IAC5C,8EAA8E;IAC9E,MAAM,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,yBAAyB,GAC/B,4BAA4B,EAAE,CA4BhC;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,aAAa,EACxB,QAAQ,EAAE,gCAAgC,GACzC,aAAa,CAkBf;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE;IAC/C,IAAI,EAAE,QAAQ,CAAC;IACf,iBAAiB,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAClD,gBAAgB,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAClD,MAAM,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAClC,IAAI,CAAC,EAAE,cAAc,CAAC;CACvB,GAAG,4BAA4B,EAAE,CAiBjC;AAED;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAC3C,QAAQ,EAAE,gBAAgB,GAAG,IAAI,EACjC,SAAS,EAAE,SAAS,4BAA4B,EAAE,GACjD,gBAAgB,GAAG,IAAI,CA2BzB"}

package/dist/commands/tools/shared/pack-provider-evidence.js

@@ -0,0 +1,161 @@
+import { PROVIDER_DIAGNOSTIC_SOURCE, providerDiagnostics, } from './pack-evidence.js';
+import { projectProviderReachability, } from './provider-reachability.js';
+import { refreshPolicyFromAdvice } from './sync-evidence.js';
+/**
+ * Pack asset kinds that a provider can project.
+ *
+ * `template`, `script`, and `seed` assets are canonical-only: no provider
+ * mapping or materialization extension consumes them, so claiming provider
+ * reachability for them would invent a surface that does not exist.
+ */
+const PROVIDER_CONTENT_KIND = {
+    skill: 'skill',
+    agent: 'agent',
+    directory: 'directory',
+};
+function pushAsset(target, contentKind, path) {
+    (target[contentKind] ??= []).push(path);
+}
+/** Realized managed assets for one scope, grouped by provider content kind. */
+export function packAssetsByContentKind(scoped) {
+    const grouped = {};
+    for (const asset of scoped.assets) {
+        if (asset.status === 'missing')
+            continue;
+        if (asset.definition.ownership[scoped.scope] !== 'managed')
+            continue;
+        const contentKind = PROVIDER_CONTENT_KIND[asset.definition.kind];
+        if (contentKind === undefined)
+            continue;
+        pushAsset(grouped, contentKind, asset.path);
+    }
+    return grouped;
+}
+/**
+ * Assets the pack inventory reports as having no provider materialization.
+ *
+ * This is an inventory observation about assets, not a reachability claim:
+ * the mapper still decides which providers are responsible from registry
+ * capability alone.
+ */
+export function unmaterializedAssetsByContentKind(scoped) {
+    const grouped = {};
+    for (const diagnostic of scoped.diagnostics) {
+        if (diagnostic.code !== 'user-agent-unmaterialized')
+            continue;
+        for (const path of diagnostic.paths)
+            pushAsset(grouped, 'agent', path);
+    }
+    return grouped;
+}
+/**
+ * The single seam that turns provider registry state plus pack inventory into
+ * reachability evidence, shared by the lifecycle outcomes and every inventory
+ * renderer so the two cannot drift.
+ */
+export function packProviderEvidence(input) {
+    const contexts = input.scopes
+        ? input.providerContexts.filter((context) => input.scopes.includes(context.scope))
+        : input.providerContexts;
+    return contexts.flatMap((providerScopeContext) => {
+        const scoped = input.scopedInventories.find(({ scope }) => scope === providerScopeContext.scope);
+        if (scoped === undefined)
+            return [];
+        const assets = packAssetsByContentKind(scoped);
+        if (Object.keys(assets).length === 0)
+            return [];
+        return projectProviderReachability({
+            providerScopeContext,
+            assets,
+            mode: input.mode,
+            ...(input.syncRan !== undefined ? { syncRan: input.syncRan } : {}),
+            ...(input.syncOperationResults
+                ? { syncOperationResults: input.syncOperationResults }
+                : {}),
+            ...(input.extensionResults
+                ? { extensionResults: input.extensionResults }
+                : {}),
+            ...(input.refreshPolicy ? { refreshPolicy: input.refreshPolicy } : {}),
+            unmaterializedAssets: unmaterializedAssetsByContentKind(scoped),
+        });
+    });
+}
+/**
+ * Drops `user-agent-unmaterialized` when an active provider materializes all
+ * managed user-scope roles.
+ *
+ * `status` and `doctor` have always applied this; `list` and `info` did not,
+ * so they reported user agents as unmaterialized that the active Codex or
+ * Cursor adapter in fact supplies. Sharing one implementation is what makes
+ * the four surfaces agree.
+ */
+export function applyUserAgentCoverage(inventory, coverage) {
+    if (coverage !== 'all')
+        return inventory;
+    return {
+        ...inventory,
+        scopes: inventory.scopes.map((scoped) => scoped.scope === 'user'
+            ? {
+                ...scoped,
+                diagnostics: scoped.diagnostics.filter(({ code }) => code !== 'user-agent-unmaterialized'),
+            }
+            : scoped),
+        diagnostics: inventory.diagnostics.filter(({ code }) => code !== 'user-agent-unmaterialized'),
+    };
+}
+/**
+ * Provider evidence for a pack lifecycle outcome (install, update, remove).
+ *
+ * When `sync` is absent the auto-sync step did not run, so no projection or
+ * materialization claim is made and the evidence carries activation and
+ * capability only — the pinned matrix's `not-run` row.
+ */
+export function lifecycleProviderEvidence(input) {
+    const runs = input.sync?.evidence ?? [];
+    return packProviderEvidence({
+        pack: input.pack,
+        scopedInventories: input.scopedInventories,
+        providerContexts: input.providerContexts,
+        mode: 'lifecycle',
+        syncRan: runs.some(({ ran }) => ran),
+        syncOperationResults: runs.flatMap(({ operationResults }) => operationResults),
+        extensionResults: runs.flatMap(({ extensionResults }) => extensionResults),
+        refreshPolicy: refreshPolicyFromAdvice(runs.flatMap(({ refreshAdvice }) => refreshAdvice)),
+        ...(input.scopes ? { scopes: input.scopes } : {}),
+    });
+}
+/**
+ * Re-projects a pack evidence item with lifecycle provider evidence.
+ *
+ * `providerDiagnostics` only emits `provider-materialization-failed` in
+ * lifecycle mode, so an observed failure reaches pack evidence only when the
+ * outcome's `finalEvidence` is rebuilt with the run's provider rows. Without
+ * this the error-severity code would have no production emitter at all.
+ */
+export function withLifecycleProviderEvidence(evidence, providers) {
+    if (evidence === null || providers.length === 0)
+        return evidence;
+    // Diagnostics are merged onto the existing item rather than re-derived
+    // through `projectPackEvidence`: that helper re-resolves the pack name from
+    // canonical inventory or scope facts and throws when neither is present,
+    // which must never happen inside a lifecycle path that already succeeded.
+    // Every already-computed field, including scope verification, is preserved.
+    return {
+        ...evidence,
+        providers,
+        diagnostics: [
+            // Previously projected provider rows are replaced, not appended to. The
+            // update and removal flows project once before auto-sync and again
+            // afterwards, so appending would emit each inactive or unsupported
+            // provider twice in the final JSON. Canonical diagnostics and the
+            // unattributed inventory-derived warning use a different `source` and
+            // are preserved.
+            ...evidence.diagnostics.filter(({ source }) => source !== PROVIDER_DIAGNOSTIC_SOURCE),
+            ...providerDiagnostics({
+                pack: evidence.pack,
+                providers,
+                mode: 'lifecycle',
+            }),
+        ],
+    };
+}

package/dist/commands/tools/shared/provider-context.d.ts

@@ -0,0 +1,88 @@
+import type { SyncConfig } from '../../../config/sync-config.js';
+import { type ProviderScopeContext, type UserAgentMaterializationCoverage } from '../../../providers/shared/registry.js';
+import type { ConcreteScope } from '../../../shared/types.js';
+export interface ProviderContextDependencies {
+    loadSyncConfig?: (configPath: string) => Promise<SyncConfig>;
+    resolveProviderScopeContext?: (input: {
+        scope: ConcreteScope;
+        scopeRoot: string;
+        config: SyncConfig;
+    }) => Promise<ProviderScopeContext>;
+}
+/**
+ * Outcome of one scope's provider-context resolution.
+ *
+ * A caller that only needs the context can keep using
+ * {@link resolveScopeProviderContext}, which collapses `failed` to `null`.
+ * A diagnostic that exists to explain why a provider view is missing needs the
+ * failure itself: silently dropping the scope tells that user "no providers
+ * configured" when the truth is "your sync config could not be read".
+ *
+ * There is no separate `absent` case on purpose. `loadSyncConfig` answers
+ * `ENOENT` with the defaults rather than throwing, so an absent config
+ * resolves normally and only a config that is present-but-unreadable — invalid
+ * JSON, schema-invalid, `EACCES`, a directory — reaches `failed`.
+ */
+export type ScopeProviderContextOutcome = {
+    status: 'resolved';
+    context: ProviderScopeContext;
+} | {
+    status: 'failed';
+    error: unknown;
+};
+/**
+ * Resolves the config-aware provider context for one scope, keeping the
+ * failure.
+ *
+ * Never throws: provider reachability is additive evidence on a lifecycle or
+ * inventory result, so a sync config that cannot be read must not fail an
+ * install that already succeeded. The error is returned instead of swallowed so
+ * a caller that can report it honestly is able to.
+ */
+export declare function resolveScopeProviderContextOutcome(input: {
+    scope: ConcreteScope;
+    scopeRoot: string;
+    dependencies?: ProviderContextDependencies;
+}): Promise<ScopeProviderContextOutcome>;
+/**
+ * Resolves the config-aware provider context for one scope.
+ *
+ * Returns `null` rather than throwing: provider reachability is additive
+ * evidence on a lifecycle or inventory result, so a missing or unreadable
+ * sync config must degrade to "no provider evidence" instead of failing an
+ * install that already succeeded. Callers that need to tell a failure apart
+ * from a legitimately empty result use
+ * {@link resolveScopeProviderContextOutcome} instead.
+ */
+export declare function resolveScopeProviderContext(input: {
+    scope: ConcreteScope;
+    scopeRoot: string;
+    dependencies?: ProviderContextDependencies;
+}): Promise<ProviderScopeContext | null>;
+/** Resolves provider contexts for every scope with a known root. */
+export declare function resolveProviderScopeContexts(input: {
+    scopeRoots: Readonly<Partial<Record<ConcreteScope, string>>>;
+    dependencies?: ProviderContextDependencies;
+}): Promise<ProviderScopeContext[]>;
+export interface PackProviderSurface {
+    contexts: ProviderScopeContext[];
+    /**
+     * Whether an active provider supplies managed user-scope agent roles.
+     * Derived from registry capability and sync config only, never from the
+     * presence of a provider directory.
+     */
+    userAgentCoverage: UserAgentMaterializationCoverage;
+}
+/**
+ * Resolves the provider surface every pack inventory renderer needs.
+ *
+ * `list`, `info`, `status`, and `doctor` all report the same packs, so they
+ * must agree on whether user-scope managed roles are materialized. Sharing
+ * this resolution is what keeps `list`/`info` from reporting unmaterialized
+ * user agents that `status`/`doctor` correctly suppress.
+ */
+export declare function resolvePackProviderSurface(input: {
+    scopeRoots: Readonly<Partial<Record<ConcreteScope, string>>>;
+    dependencies?: ProviderContextDependencies;
+}): Promise<PackProviderSurface>;
+//# sourceMappingURL=provider-context.d.ts.map

package/dist/commands/tools/shared/provider-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-context.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/shared/provider-context.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAGL,KAAK,oBAAoB,EACzB,KAAK,gCAAgC,EACtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,MAAM,WAAW,2BAA2B;IAC1C,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7D,2BAA2B,CAAC,EAAE,CAAC,KAAK,EAAE;QACpC,KAAK,EAAE,aAAa,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,UAAU,CAAC;KACpB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;CACrC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,2BAA2B,GACnC;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC;AAEzC;;;;;;;;GAQG;AACH,wBAAsB,kCAAkC,CAAC,KAAK,EAAE;IAC9D,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,2BAA2B,CAAC;CAC5C,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAsBvC;AAED;;;;;;;;;GASG;AACH,wBAAsB,2BAA2B,CAAC,KAAK,EAAE;IACvD,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,2BAA2B,CAAC;CAC5C,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAGvC;AAED,oEAAoE;AACpE,wBAAsB,4BAA4B,CAAC,KAAK,EAAE;IACxD,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7D,YAAY,CAAC,EAAE,2BAA2B,CAAC;CAC5C,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAgBlC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC;;;;OAIG;IACH,iBAAiB,EAAE,gCAAgC,CAAC;CACrD;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAAC,KAAK,EAAE;IACtD,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7D,YAAY,CAAC,EAAE,2BAA2B,CAAC;CAC5C,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAY/B"}

package/dist/commands/tools/shared/provider-context.js

@@ -0,0 +1,77 @@
+import { join } from 'node:path';
+import { DEFAULT_SYNC_CONFIG, loadSyncConfig } from '../../../config/index.js';
+import { resolveProviderScopeContext, userAgentMaterializationCoverage, } from '../../../providers/shared/registry.js';
+/**
+ * Resolves the config-aware provider context for one scope, keeping the
+ * failure.
+ *
+ * Never throws: provider reachability is additive evidence on a lifecycle or
+ * inventory result, so a sync config that cannot be read must not fail an
+ * install that already succeeded. The error is returned instead of swallowed so
+ * a caller that can report it honestly is able to.
+ */
+export async function resolveScopeProviderContextOutcome(input) {
+    const load = input.dependencies?.loadSyncConfig ??
+        ((configPath) => loadSyncConfig(configPath, DEFAULT_SYNC_CONFIG));
+    const resolve = input.dependencies?.resolveProviderScopeContext ??
+        resolveProviderScopeContext;
+    try {
+        const config = await load(join(input.scopeRoot, '.oat', 'sync', 'config.json'));
+        return {
+            status: 'resolved',
+            context: await resolve({
+                scope: input.scope,
+                scopeRoot: input.scopeRoot,
+                config,
+            }),
+        };
+    }
+    catch (error) {
+        return { status: 'failed', error };
+    }
+}
+/**
+ * Resolves the config-aware provider context for one scope.
+ *
+ * Returns `null` rather than throwing: provider reachability is additive
+ * evidence on a lifecycle or inventory result, so a missing or unreadable
+ * sync config must degrade to "no provider evidence" instead of failing an
+ * install that already succeeded. Callers that need to tell a failure apart
+ * from a legitimately empty result use
+ * {@link resolveScopeProviderContextOutcome} instead.
+ */
+export async function resolveScopeProviderContext(input) {
+    const outcome = await resolveScopeProviderContextOutcome(input);
+    return outcome.status === 'resolved' ? outcome.context : null;
+}
+/** Resolves provider contexts for every scope with a known root. */
+export async function resolveProviderScopeContexts(input) {
+    const entries = Object.entries(input.scopeRoots).filter((entry) => Boolean(entry[1]));
+    const contexts = await Promise.all(entries.map(([scope, scopeRoot]) => resolveScopeProviderContext({
+        scope,
+        scopeRoot,
+        ...(input.dependencies ? { dependencies: input.dependencies } : {}),
+    })));
+    return contexts.filter((context) => context !== null);
+}
+/**
+ * Resolves the provider surface every pack inventory renderer needs.
+ *
+ * `list`, `info`, `status`, and `doctor` all report the same packs, so they
+ * must agree on whether user-scope managed roles are materialized. Sharing
+ * this resolution is what keeps `list`/`info` from reporting unmaterialized
+ * user agents that `status`/`doctor` correctly suppress.
+ */
+export async function resolvePackProviderSurface(input) {
+    const contexts = await resolveProviderScopeContexts(input);
+    const userContext = contexts.find(({ scope }) => scope === 'user');
+    return {
+        contexts,
+        userAgentCoverage: userContext
+            ? userAgentMaterializationCoverage({
+                registrations: userContext.registrations,
+                activeProviders: userContext.activeProviders,
+            })
+            : 'none',
+    };
+}

package/dist/commands/tools/shared/provider-reachability.d.ts

@@ -0,0 +1,93 @@
+import type { SyncOperationResult } from '../../../engine/engine.types.js';
+import type { MaterializationOperationResult } from '../../../providers/shared/materialization-extension.js';
+import type { ManagedContentKind, ProviderCatalogRefreshPolicy, ProviderContentCapability, ProviderScopeContext } from '../../../providers/shared/registry.js';
+import type { ConcreteScope } from '../../../shared/types.js';
+import type { ProviderReachabilityEvidence } from './pack-evidence.js';
+/**
+ * Maps config-aware provider registry state onto per-pack reachability
+ * evidence.
+ *
+ * Per DR-260831 the reachability decision is registry- and config-derived:
+ * activation comes from `ProviderScopeContext.activation` (sync config plus
+ * adapter detection), capability and refresh policy come from the registered
+ * `ProviderContentCapability` rows, and projection/materialization come from
+ * the sync run's own operation results. The mapper never probes the
+ * filesystem for a provider directory to decide that a provider is reachable.
+ *
+ * The one absence signal that originates outside the registry is
+ * `unmaterializedAssets`: the pack inventory's list of managed assets that
+ * have no provider materialization. That list is an inventory observation
+ * about assets, not a reachability claim about a provider — the mapper still
+ * decides *which* providers are responsible for it from registry capability
+ * alone, and attributes it to none when no active provider supports the
+ * scope and content kind.
+ */
+/** A sync operation result narrowed to the fields reachability needs. */
+export type ProviderSyncOperationEvidence = Pick<SyncOperationResult, 'provider' | 'contentKind' | 'asset' | 'status'> & {
+    scope: ConcreteScope;
+    failure?: string;
+};
+/** A materialization-extension result narrowed the same way. */
+export type ProviderExtensionOperationEvidence = Pick<MaterializationOperationResult, 'provider' | 'status'> & {
+    scope: ConcreteScope;
+    contentKind?: ManagedContentKind;
+    path?: string;
+    /**
+     * `role` targets one managed entry; `config` targets the provider's shared
+     * aggregate configuration, which every managed role for that provider
+     * depends on.
+     */
+    target?: string;
+    failure?: string;
+};
+/** Optional per-provider refresh-policy override observed by a sync run. */
+export type ProviderRefreshPolicyLookup = (input: {
+    provider: string;
+    scope: ConcreteScope;
+    contentKind: ManagedContentKind;
+}) => ProviderCatalogRefreshPolicy | undefined;
+export interface ProviderReachabilityInput {
+    /** Config-aware activation, detection, and registrations for one scope. */
+    providerScopeContext: ProviderScopeContext;
+    /** Content kinds the pack actually places at this scope, with their assets. */
+    assets: Readonly<Partial<Record<ManagedContentKind, readonly string[]>>>;
+    /** Registry capability rows; defaults to each registration's own rows. */
+    capabilities?: readonly ProviderContentCapability[];
+    /** Core sync operation results for this scope, when a sync ran. */
+    syncOperationResults?: readonly ProviderSyncOperationEvidence[];
+    /** Materialization-extension results for this scope, when a sync ran. */
+    extensionResults?: readonly ProviderExtensionOperationEvidence[];
+    /** Overrides the registry catalog-refresh policy with observed advice. */
+    refreshPolicy?: ProviderRefreshPolicyLookup;
+    /**
+     * `lifecycle` means a sync actually ran and its results are authoritative.
+     * `inventory` is a read-only surface that observed no sync.
+     */
+    mode: 'lifecycle' | 'inventory';
+    /**
+     * `false` records that auto-sync was disabled or skipped: no projection or
+     * materialization claim can be made, so no diagnostic is produced.
+     */
+    syncRan?: boolean;
+    /** Managed assets the pack inventory reports as unmaterialized. */
+    unmaterializedAssets?: Readonly<Partial<Record<ManagedContentKind, readonly string[]>>>;
+}
+/**
+ * Projects one reachability row per active-or-registered provider and per
+ * content kind the pack places at this scope.
+ */
+export declare function projectProviderReachability(input: ProviderReachabilityInput): ProviderReachabilityEvidence[];
+/**
+ * Re-projects existing reachability rows with a sync run's observed results.
+ *
+ * Activation and capability were already derived from the registry before the
+ * sync ran and do not change; only projection, materialization, visibility,
+ * and recovery are refined. Inactive or unsupported rows are returned
+ * untouched.
+ */
+export declare function applySyncEvidence(providers: readonly ProviderReachabilityEvidence[], input: {
+    syncRan: boolean;
+    syncOperationResults?: readonly ProviderSyncOperationEvidence[];
+    extensionResults?: readonly ProviderExtensionOperationEvidence[];
+}): ProviderReachabilityEvidence[];
+//# sourceMappingURL=provider-reachability.d.ts.map

package/dist/commands/tools/shared/provider-reachability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-reachability.d.ts","sourceRoot":"","sources":["../../../../src/commands/tools/shared/provider-reachability.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,6CAA6C,CAAC;AAClG,OAAO,KAAK,EACV,kBAAkB,EAClB,4BAA4B,EAC5B,yBAAyB,EAEzB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,KAAK,EAEV,4BAA4B,EAG7B,MAAM,iBAAiB,CAAC;AAEzB;;;;;;;;;;;;;;;;;;GAkBG;AAEH,yEAAyE;AACzE,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAC9C,mBAAmB,EACnB,UAAU,GAAG,aAAa,GAAG,OAAO,GAAG,QAAQ,CAChD,GAAG;IACF,KAAK,EAAE,aAAa,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,gEAAgE;AAChE,MAAM,MAAM,kCAAkC,GAAG,IAAI,CACnD,8BAA8B,EAC9B,UAAU,GAAG,QAAQ,CACtB,GAAG;IACF,KAAK,EAAE,aAAa,CAAC;IACrB,WAAW,CAAC,EAAE,kBAAkB,CAAC;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,2BAA2B,GAAG,CAAC,KAAK,EAAE;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,aAAa,CAAC;IACrB,WAAW,EAAE,kBAAkB,CAAC;CACjC,KAAK,4BAA4B,GAAG,SAAS,CAAC;AAE/C,MAAM,WAAW,yBAAyB;IACxC,2EAA2E;IAC3E,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,+EAA+E;IAC/E,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACzE,0EAA0E;IAC1E,YAAY,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAC;IACpD,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAChE,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;IACjE,0EAA0E;IAC1E,aAAa,CAAC,EAAE,2BAA2B,CAAC;IAC5C;;;OAGG;IACH,IAAI,EAAE,WAAW,GAAG,WAAW,CAAC;IAChC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mEAAmE;IACnE,oBAAoB,CAAC,EAAE,QAAQ,CAC7B,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CACvD,CAAC;CACH;AAwHD;;;GAGG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,yBAAyB,GAC/B,4BAA4B,EAAE,CAmJhC;AA2GD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,SAAS,4BAA4B,EAAE,EAClD,KAAK,EAAE;IACL,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,CAAC,EAAE,SAAS,6BAA6B,EAAE,CAAC;IAChE,gBAAgB,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;CAClE,GACA,4BAA4B,EAAE,CAwChC"}