@openrig/cli 0.5.0 → 0.5.1

package/node_modules/@openrig/daemon/dist/domain/provider/provider-policy.d.ts

@@ -0,0 +1,38 @@
+import type { AccountAuthState, PrecheckResult, ProviderKind, ProviderSignal } from "./provider-types.js";
+export type AutomationRefusal = "sourceClass_unknown" | "authority_unknown" | "not_allow_switch_decision" | "no_freshness_bound" | "unparsable_freshness_bound" | "stale";
+export interface AutomationEligibility {
+    eligible: boolean;
+    refusals: AutomationRefusal[];
+}
+/**
+ * BR-2 eligibility. Eligible ONLY when the signal is known (source + authority), explicitly
+ * `allow_switch_decision`, and provably fresh. Fail-closed on freshness: a missing `staleAfter`
+ * or an unparsable one is ineligible (NaN must never compare as fresh). Expiry is INCLUSIVE:
+ * `now >= staleAfter` is stale. An unparsable `now` also cannot prove freshness → stale.
+ */
+export declare function signalEligibleForAutomation(signal: ProviderSignal, nowIso: string): AutomationEligibility;
+/** Fields common to a manual and an automated precheck. */
+interface PrecheckBase {
+    /** The provider of the account being switched TO. */
+    targetProvider: ProviderKind;
+    /** Validate-at-use: the target's auth state, checked at precheck time (never assumed). */
+    targetAuthState: AccountAuthState;
+    /** Whether the seat currently has a live turn/conversation in flight. */
+    seatHasLiveConversation: boolean;
+}
+/**
+ * A manual precheck carries NEITHER a triggering signal nor a clock; an automated precheck
+ * requires BOTH. The paired union makes "trigger without now" unrepresentable for typed
+ * callers (the fail-closed hole is closed at the type level; a runtime guard below covers
+ * untyped/JS callers).
+ */
+export type PrecheckInput = PrecheckBase & ({
+    triggeringSignal?: undefined;
+    now?: undefined;
+} | {
+    triggeringSignal: ProviderSignal;
+    now: string;
+});
+export declare function precheckSwitch(input: PrecheckInput): PrecheckResult;
+export {};
+//# sourceMappingURL=provider-policy.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/provider/provider-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-policy.d.ts","sourceRoot":"","sources":["../../../src/domain/provider/provider-policy.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,gBAAgB,EAEhB,cAAc,EACd,YAAY,EACZ,cAAc,EACf,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,iBAAiB,GACzB,qBAAqB,GACrB,mBAAmB,GACnB,2BAA2B,GAC3B,oBAAoB,GACpB,4BAA4B,GAC5B,OAAO,CAAC;AAEZ,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,iBAAiB,EAAE,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM,GACb,qBAAqB,CAqBvB;AAiBD,2DAA2D;AAC3D,UAAU,YAAY;IACpB,qDAAqD;IACrD,cAAc,EAAE,YAAY,CAAC;IAC7B,0FAA0F;IAC1F,eAAe,EAAE,gBAAgB,CAAC;IAClC,yEAAyE;IACzE,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAED;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,YAAY,GACtC,CAAC;IAAE,gBAAgB,CAAC,EAAE,SAAS,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,gBAAgB,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE1G,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,cAAc,CA0BnE"}

package/node_modules/@openrig/daemon/dist/domain/provider/provider-policy.js

@@ -0,0 +1,76 @@
+// Slice-04 (OPR.0.5.0.4) — BR-2, the no-fire policy predicate (packet 3ffa3c22 §2 + BR-2).
+// A PURE predicate (no side effects, no action execution, no orchestration): it only decides
+// whether one signal is eligible to trigger an automated switch. Automation NEVER fires on a
+// signal that is unknown, not allow_switch_decision, or not provably fresh. Every failing
+// condition contributes an explicit, fail-visible refusal reason.
+/**
+ * BR-2 eligibility. Eligible ONLY when the signal is known (source + authority), explicitly
+ * `allow_switch_decision`, and provably fresh. Fail-closed on freshness: a missing `staleAfter`
+ * or an unparsable one is ineligible (NaN must never compare as fresh). Expiry is INCLUSIVE:
+ * `now >= staleAfter` is stale. An unparsable `now` also cannot prove freshness → stale.
+ */
+export function signalEligibleForAutomation(signal, nowIso) {
+    const refusals = [];
+    if (signal.sourceClass === "unknown")
+        refusals.push("sourceClass_unknown");
+    if (signal.authority === "unknown")
+        refusals.push("authority_unknown");
+    if (signal.automationUse !== "allow_switch_decision")
+        refusals.push("not_allow_switch_decision");
+    if (signal.staleAfter === undefined) {
+        refusals.push("no_freshness_bound");
+    }
+    else {
+        const staleMs = Date.parse(signal.staleAfter);
+        if (Number.isNaN(staleMs)) {
+            refusals.push("unparsable_freshness_bound");
+        }
+        else {
+            const nowMs = Date.parse(nowIso);
+            // Fail-closed: an unparsable `now`, or reaching/passing the bound, is stale.
+            if (Number.isNaN(nowMs) || nowMs >= staleMs)
+                refusals.push("stale");
+        }
+    }
+    return { eligible: refusals.length === 0, refusals };
+}
+// ── Precheck: the §1 switch-safety gate ─────────────────────────────────────────────────
+// precheckSwitch decides whether switching a seat to a target account is SAFE, so the UI and
+// automation never offer an unsafe action. Every unsafe condition is an explicit, fail-visible
+// reason; reasons combine deterministically. A pure predicate — no side effects.
+// The subset of BR-2 refusals that mean the triggering signal is unknown/stale (as opposed to
+// merely advisory, which is a BR-2 concern, not a precheck unknown/stale concern).
+const SIGNAL_UNKNOWN_OR_STALE_REFUSALS = [
+    "sourceClass_unknown",
+    "authority_unknown",
+    "no_freshness_bound",
+    "unparsable_freshness_bound",
+    "stale",
+];
+export function precheckSwitch(input) {
+    const reasons = [];
+    // rig auth is codex-only at the current switch substrate → a claude target can't be rebound.
+    if (input.targetProvider === "claude")
+        reasons.push("rebind_unsupported_for_runtime");
+    // Validate-at-use: only a confirmed-active target is safe. needs_reauth and unknown each fail
+    // closed under their OWN reason — unknown is never relabeled as a re-auth need.
+    if (input.targetAuthState === "needs_reauth")
+        reasons.push("target_needs_reauth");
+    else if (input.targetAuthState === "unknown")
+        reasons.push("target_auth_unknown");
+    if (input.seatHasLiveConversation)
+        reasons.push("would_strand_live_conversation");
+    // A triggering signal is present ONLY for an automated switch. Fail-closed for untyped/JS
+    // callers: if `now` is missing or unparsable it CANNOT prove freshness — the shared predicate
+    // maps an unparsable/absent now to NaN → stale, which is in the unknown/stale subset.
+    if (input.triggeringSignal !== undefined) {
+        const { refusals } = signalEligibleForAutomation(input.triggeringSignal, input.now);
+        if (refusals.some((r) => SIGNAL_UNKNOWN_OR_STALE_REFUSALS.includes(r))) {
+            reasons.push("signal_unknown_or_stale");
+        }
+    }
+    // Deterministic dedupe, insertion-order preserved.
+    const deduped = [...new Set(reasons)];
+    return deduped.length === 0 ? { safe: true } : { safe: false, reasons: deduped };
+}
+//# sourceMappingURL=provider-policy.js.map

package/node_modules/@openrig/daemon/dist/domain/provider/provider-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-policy.js","sourceRoot":"","sources":["../../../src/domain/provider/provider-policy.ts"],"names":[],"mappings":"AAAA,2FAA2F;AAC3F,6FAA6F;AAC7F,6FAA6F;AAC7F,0FAA0F;AAC1F,kEAAkE;AAuBlE;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAsB,EACtB,MAAc;IAEd,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,aAAa,KAAK,uBAAuB;QAAE,QAAQ,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAEjG,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QAC9C,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjC,6EAA6E;YAC7E,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;AACvD,CAAC;AAED,2FAA2F;AAC3F,6FAA6F;AAC7F,+FAA+F;AAC/F,iFAAiF;AAEjF,8FAA8F;AAC9F,mFAAmF;AACnF,MAAM,gCAAgC,GAAiC;IACrE,qBAAqB;IACrB,mBAAmB;IACnB,oBAAoB;IACpB,4BAA4B;IAC5B,OAAO;CACR,CAAC;AAqBF,MAAM,UAAU,cAAc,CAAC,KAAoB;IACjD,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,6FAA6F;IAC7F,IAAI,KAAK,CAAC,cAAc,KAAK,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAEtF,8FAA8F;IAC9F,gFAAgF;IAChF,IAAI,KAAK,CAAC,eAAe,KAAK,cAAc;QAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;SAC7E,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAElF,IAAI,KAAK,CAAC,uBAAuB;QAAE,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAElF,0FAA0F;IAC1F,8FAA8F;IAC9F,sFAAsF;IACtF,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,EAAE,QAAQ,EAAE,GAAG,2BAA2B,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,GAAa,CAAC,CAAC;QAC9F,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACnF,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/provider/provider-read-model.d.ts

@@ -0,0 +1,28 @@
+import type { FourBlockReadModel, ProviderAccount, ProviderSignal } from "./provider-types.js";
+/**
+ * A collected seat↔account fact — a discriminated bound/unbound union over the honest field
+ * set (no anomalies; the assembler computes those). Mirrors ProviderBinding so the collector
+ * never has to fabricate account/binding data for an unbound seat.
+ */
+export type RawSeatBinding = {
+    accountId: string;
+    seatSession: string;
+    rigName: string;
+    boundAt: string;
+    bindingSource: string;
+} | {
+    accountId: null;
+    seatSession: string;
+    rigName: string;
+    boundAt: null;
+    bindingSource: null;
+};
+export interface AssembleInput {
+    accounts: ProviderAccount[];
+    rawBindings: RawSeatBinding[];
+    signals: ProviderSignal[];
+    /** The read model's asOf — a real caller-provided timestamp; anomalies borrow it (not invented). */
+    asOf: string;
+}
+export declare function assembleFourBlock(input: AssembleInput): FourBlockReadModel;
+//# sourceMappingURL=provider-read-model.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/provider/provider-read-model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-read-model.d.ts","sourceRoot":"","sources":["../../../src/domain/provider/provider-read-model.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAEV,kBAAkB,EAClB,eAAe,EAEf,cAAc,EAGf,MAAM,qBAAqB,CAAC;AAE7B;;;;GAIG;AACH,MAAM,MAAM,cAAc,GACtB;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,GACnG;IAAE,SAAS,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC;IAAC,aAAa,EAAE,IAAI,CAAA;CAAE,CAAC;AAElG,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,WAAW,EAAE,cAAc,EAAE,CAAC;IAC9B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,oGAAoG;IACpG,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,aAAa,GAAG,kBAAkB,CA+D1E"}

package/node_modules/@openrig/daemon/dist/domain/provider/provider-read-model.js

@@ -0,0 +1,68 @@
+// Slice-04 (OPR.0.5.0.4) — the four-block ASSEMBLY (packet 3ffa3c22 §1, proof item 4).
+// A PURE assembler over already-collected inputs (no CLI/auth I/O — collection is a separate
+// seam). It emits real bound rows + explicit unbound rows (seat_with_no_account), computes
+// same_account_on_n_seats ONLY from repeated real account IDs, attaches anomalies
+// deterministically, preserves signals unchanged, and invents no IDs/boundAt/asOf.
+export function assembleFourBlock(input) {
+    const { accounts, rawBindings, signals, asOf } = input;
+    // Group DISTINCT seat sessions by REAL account id (unbound/null-account seats never
+    // contribute). A Set so duplicate raw rows for the same account+seat cannot inflate the count.
+    const seatsByAccount = new Map();
+    for (const rb of rawBindings) {
+        if (rb.accountId === null)
+            continue;
+        const set = seatsByAccount.get(rb.accountId) ?? new Set();
+        set.add(rb.seatSession);
+        seatsByAccount.set(rb.accountId, set);
+    }
+    // A same_account_on_n_seats anomaly per account genuinely shared across >= 2 DISTINCT seats.
+    const sharedAnomalyByAccount = new Map();
+    for (const [accountId, seats] of seatsByAccount) {
+        if (seats.size < 2)
+            continue;
+        const sortedSeats = [...seats].sort(); // deterministic
+        sharedAnomalyByAccount.set(accountId, {
+            kind: "same_account_on_n_seats",
+            count: sortedSeats.length,
+            seats: sortedSeats,
+            evidence: `account ${accountId} bound on ${sortedSeats.length} seats: ${sortedSeats.join(", ")}`,
+            asOf,
+        });
+    }
+    const bindings = rawBindings.map((rb) => {
+        if (rb.accountId === null) {
+            const anomaly = {
+                kind: "seat_with_no_account",
+                seat: rb.seatSession,
+                evidence: `seat ${rb.seatSession} in rig ${rb.rigName} has no bound account`,
+                asOf,
+            };
+            // Non-empty tuple: the seat_with_no_account anomaly is required and always first.
+            return {
+                accountId: null,
+                seatSession: rb.seatSession,
+                rigName: rb.rigName,
+                boundAt: null,
+                bindingSource: null,
+                anomalies: [anomaly],
+            };
+        }
+        const shared = sharedAnomalyByAccount.get(rb.accountId);
+        const anomalies = shared ? [shared] : [];
+        return {
+            accountId: rb.accountId,
+            seatSession: rb.seatSession,
+            rigName: rb.rigName,
+            boundAt: rb.boundAt,
+            bindingSource: rb.bindingSource,
+            anomalies,
+        };
+    });
+    return {
+        accounts,
+        bindings,
+        signals, // preserved unchanged
+        asOf,
+    };
+}
+//# sourceMappingURL=provider-read-model.js.map

package/node_modules/@openrig/daemon/dist/domain/provider/provider-read-model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-read-model.js","sourceRoot":"","sources":["../../../src/domain/provider/provider-read-model.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,6FAA6F;AAC7F,2FAA2F;AAC3F,kFAAkF;AAClF,mFAAmF;AA6BnF,MAAM,UAAU,iBAAiB,CAAC,KAAoB;IACpD,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAEvD,oFAAoF;IACpF,+FAA+F;IAC/F,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;IACtD,KAAK,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC;QAC7B,IAAI,EAAE,CAAC,SAAS,KAAK,IAAI;YAAE,SAAS;QACpC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAClE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC;QACxB,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,6FAA6F;IAC7F,MAAM,sBAAsB,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC7E,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,cAAc,EAAE,CAAC;QAChD,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;YAAE,SAAS;QAC7B,MAAM,WAAW,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,gBAAgB;QACvD,sBAAsB,CAAC,GAAG,CAAC,SAAS,EAAE;YACpC,IAAI,EAAE,yBAAyB;YAC/B,KAAK,EAAE,WAAW,CAAC,MAAM;YACzB,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,WAAW,SAAS,aAAa,WAAW,CAAC,MAAM,WAAW,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAChG,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAsB,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACzD,IAAI,EAAE,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,OAAO,GAA6B;gBACxC,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,EAAE,CAAC,WAAW;gBACpB,QAAQ,EAAE,QAAQ,EAAE,CAAC,WAAW,WAAW,EAAE,CAAC,OAAO,uBAAuB;gBAC5E,IAAI;aACL,CAAC;YACF,kFAAkF;YAClF,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,EAAE,CAAC,WAAW;gBAC3B,OAAO,EAAE,EAAE,CAAC,OAAO;gBACnB,OAAO,EAAE,IAAI;gBACb,aAAa,EAAE,IAAI;gBACnB,SAAS,EAAE,CAAC,OAAO,CAAC;aACrB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,SAAS,GAAqB,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO;YACL,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,OAAO,EAAE,EAAE,CAAC,OAAO;YACnB,aAAa,EAAE,EAAE,CAAC,aAAa;YAC/B,SAAS;SACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,OAAO,EAAE,sBAAsB;QAC/B,IAAI;KACL,CAAC;AACJ,CAAC"}

package/node_modules/@openrig/daemon/dist/domain/provider/provider-service-impl.d.ts

@@ -0,0 +1,28 @@
+import type Database from "better-sqlite3";
+import { type AgentActivityStore } from "../agent-activity-store.js";
+import type { ProviderService, ProviderPrecheckInput, ProviderSwitchInput, ProviderSwitchResult } from "./provider-service.js";
+import type { FourBlockReadModel, PrecheckResult, ProviderSignal } from "./provider-types.js";
+export interface ProviderServiceImplDeps {
+    db: Database.Database;
+    /** The rig universe (rigRepo.listRigs()) — each rig's node-inventory contributes seats. */
+    listRigs: () => Array<{
+        id: string;
+    }>;
+    /** Slice-04 C3: the Claude statusline provider_usage signal source (undefined → signals []). */
+    collectClaudeSignals?: () => ProviderSignal[];
+    /** Slice-04 C4: the shipped structured activity detector. Undefined keeps the reactive lane empty. */
+    agentActivityStore?: Pick<AgentActivityStore, "getLatestForNode">;
+    /** W2a tap: operator-visible disposition sink. Observability only; never a verification producer. */
+    warn?: (message: string) => void;
+    env?: NodeJS.ProcessEnv;
+    now?: () => string;
+}
+export declare class ProviderServiceImpl implements ProviderService {
+    private readonly deps;
+    constructor(deps: ProviderServiceImplDeps);
+    getReadModel(): Promise<FourBlockReadModel>;
+    private listSeats;
+    precheck(input: ProviderPrecheckInput): Promise<PrecheckResult>;
+    switchAccount(input: ProviderSwitchInput): Promise<ProviderSwitchResult>;
+}
+//# sourceMappingURL=provider-service-impl.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/provider/provider-service-impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-service-impl.d.ts","sourceRoot":"","sources":["../../../src/domain/provider/provider-service-impl.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AAMpC,OAAO,KAAK,EACV,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE9F,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,2FAA2F;IAC3F,QAAQ,EAAE,MAAM,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtC,gGAAgG;IAChG,oBAAoB,CAAC,EAAE,MAAM,cAAc,EAAE,CAAC;IAC9C,sGAAsG;IACtG,kBAAkB,CAAC,EAAE,IAAI,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;IAClE,qGAAqG;IACrG,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,mBAAoB,YAAW,eAAe;IAC7C,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,uBAAuB;IAEpD,YAAY,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAiCjD,OAAO,CAAC,SAAS;IAgBX,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC;IAc/D,aAAa,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;CAW/E"}

package/node_modules/@openrig/daemon/dist/domain/provider/provider-service-impl.js

@@ -0,0 +1,91 @@
+// Slice-04 (OPR.0.5.0.4) C1 (resume) — the production ProviderService. getReadModel is fully
+// wired over the collection seam (real codex-auth reader + node-inventory across rigs + clock).
+// precheck composes the pure precheckSwitch gate (fails closed on unknown auth per BR-3). switch
+// is precheck-gated and NEVER fabricates success — the switch-execution + BR-1 action-record path
+// is the D seam; until it lands, switch returns an honest failed_safely with an operational reason.
+import { AGENT_ACTIVITY_FRESHNESS_MS, } from "../agent-activity-store.js";
+import { getNodeInventory } from "../node-inventory.js";
+import { readCodexAuthMetadata } from "./codex-auth-reader.js";
+import { collectFourBlockReadModel } from "./provider-collect.js";
+import { precheckSwitch } from "./provider-policy.js";
+import { collectReactiveEventSignals } from "./reactive-tap.js";
+export class ProviderServiceImpl {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async getReadModel() {
+        const env = this.deps.env ?? process.env;
+        const asOf = (this.deps.now ?? (() => new Date().toISOString()))();
+        let auth;
+        let seats;
+        const readAuth = () => auth ??= readCodexAuthMetadata(env);
+        const listSeats = () => seats ??= this.listSeats();
+        const collectReactiveSignals = () => {
+            if (!this.deps.agentActivityStore)
+                return [];
+            const result = collectReactiveEventSignals({
+                seats: listSeats(),
+                auth: readAuth(),
+                activity: this.deps.agentActivityStore,
+                now: asOf,
+                freshnessMs: AGENT_ACTIVITY_FRESHNESS_MS,
+            });
+            const warn = this.deps.warn ?? ((message) => console.warn(message));
+            for (const disposition of [...result.triggers, ...result.discards]) {
+                warn(`[provider-reactive-tap] ${JSON.stringify(disposition)}`);
+            }
+            return result.signals;
+        };
+        return collectFourBlockReadModel({
+            readCodexAuth: readAuth,
+            listSeats,
+            collectSignals: () => [
+                ...(this.deps.collectClaudeSignals?.() ?? []),
+                ...collectReactiveSignals(),
+            ],
+            now: () => asOf,
+        });
+    }
+    listSeats() {
+        const seats = [];
+        for (const rig of this.deps.listRigs()) {
+            for (const entry of getNodeInventory(this.deps.db, rig.id)) {
+                if (!entry.canonicalSessionName)
+                    continue;
+                seats.push({
+                    seatSession: entry.canonicalSessionName,
+                    rigName: entry.rigName ?? "",
+                    runtime: entry.runtime ?? "unknown",
+                    lifecycleState: entry.lifecycleState,
+                });
+            }
+        }
+        return seats;
+    }
+    async precheck(input) {
+        const model = await this.getReadModel();
+        const target = model.accounts.find((a) => a.accountId === input.toAccount);
+        // Validate-at-use: an unknown target OR unknown auth fails closed (BR-3 — disk presence never
+        // asserts active). Live-conversation state is not yet wired (the C2 activity seam), so assume
+        // live — the conservative direction never strands a conversation silently. This is the MANUAL
+        // precheck variant (no triggeringSignal; that's for automated policy-driven switches).
+        return precheckSwitch({
+            targetProvider: target?.provider ?? "codex",
+            targetAuthState: target?.authState ?? "unknown",
+            seatHasLiveConversation: true,
+        });
+    }
+    async switchAccount(input) {
+        // Precheck-gate: never switch past an unsafe verdict unless explicitly forced.
+        const verdict = await this.precheck({ seat: input.seat, toAccount: input.toAccount });
+        if (verdict.safe === false && !input.forceUnsafe) {
+            const reasons = verdict.reasons.length > 0 ? verdict.reasons : ["precheck_unsafe"];
+            return { outcome: "failed_safely", reasons: reasons };
+        }
+        // D seam (compose the rig-auth codex switch + BR-1 durable action record) is NOT yet wired.
+        // Honest operational failure — never fabricate a succeeded/rebind_in_progress outcome.
+        return { outcome: "failed_safely", reasons: ["switch_execution_not_yet_wired"] };
+    }
+}
+//# sourceMappingURL=provider-service-impl.js.map

package/node_modules/@openrig/daemon/dist/domain/provider/provider-service-impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-service-impl.js","sourceRoot":"","sources":["../../../src/domain/provider/provider-service-impl.ts"],"names":[],"mappings":"AAAA,6FAA6F;AAC7F,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,oGAAoG;AAGpG,OAAO,EACL,2BAA2B,GAE5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAA0B,MAAM,wBAAwB,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAqB,MAAM,uBAAuB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAuBhE,MAAM,OAAO,mBAAmB;IACD;IAA7B,YAA6B,IAA6B;QAA7B,SAAI,GAAJ,IAAI,CAAyB;IAAG,CAAC;IAE9D,KAAK,CAAC,YAAY;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACzC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QACnE,IAAI,IAAmC,CAAC;QACxC,IAAI,KAAiC,CAAC;QACtC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;QACnD,MAAM,sBAAsB,GAAG,GAAqB,EAAE;YACpD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB;gBAAE,OAAO,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,2BAA2B,CAAC;gBACzC,KAAK,EAAE,SAAS,EAAE;gBAClB,IAAI,EAAE,QAAQ,EAAE;gBAChB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB;gBACtC,GAAG,EAAE,IAAI;gBACT,WAAW,EAAE,2BAA2B;aACzC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,OAAe,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5E,KAAK,MAAM,WAAW,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnE,IAAI,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC,CAAC;QACF,OAAO,yBAAyB,CAAC;YAC/B,aAAa,EAAE,QAAQ;YACvB,SAAS;YACT,cAAc,EAAE,GAAG,EAAE,CAAC;gBACpB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC;gBAC7C,GAAG,sBAAsB,EAAE;aAC5B;YACD,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAEO,SAAS;QACf,MAAM,KAAK,GAAmB,EAAE,CAAC;QACjC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACvC,KAAK,MAAM,KAAK,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC3D,IAAI,CAAC,KAAK,CAAC,oBAAoB;oBAAE,SAAS;gBAC1C,KAAK,CAAC,IAAI,CAAC;oBACT,WAAW,EAAE,KAAK,CAAC,oBAAoB;oBACvC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;oBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS;oBACnC,cAAc,EAAE,KAAK,CAAC,cAAc;iBACrC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAA4B;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;QAC3E,8FAA8F;QAC9F,8FAA8F;QAC9F,8FAA8F;QAC9F,uFAAuF;QACvF,OAAO,cAAc,CAAC;YACpB,cAAc,EAAE,MAAM,EAAE,QAAQ,IAAI,OAAO;YAC3C,eAAe,EAAE,MAAM,EAAE,SAAS,IAAI,SAAS;YAC/C,uBAAuB,EAAE,IAAI;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA0B;QAC5C,+EAA+E;QAC/E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;QACtF,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACjD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACnF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,OAAgC,EAAE,CAAC;QACjF,CAAC;QACD,4FAA4F;QAC5F,uFAAuF;QACvF,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,gCAAgC,CAAC,EAAE,CAAC;IACnF,CAAC;CACF"}

package/node_modules/@openrig/daemon/dist/domain/provider/provider-service.d.ts

@@ -0,0 +1,33 @@
+import type { FourBlockReadModel, PrecheckResult } from "./provider-types.js";
+export interface ProviderPrecheckInput {
+    seat: string;
+    toAccount: string;
+}
+export interface ProviderSwitchInput {
+    seat: string;
+    toAccount: string;
+    forceUnsafe: boolean;
+}
+/**
+ * A discriminated union that TYPE-ENFORCES BR-1 fail-visibility: `succeeded`/`rebind_in_progress`
+ * carry NO reasons; `failed_safely` REQUIRES a non-empty reason tuple — a failed switch with no
+ * explanation cannot compile. Reasons are string[] so seam D can surface OPERATIONAL failures
+ * (auth-switch failure, action-record failure), not only PrecheckReason refusals.
+ */
+export type ProviderSwitchResult = {
+    outcome: "succeeded";
+} | {
+    outcome: "rebind_in_progress";
+} | {
+    outcome: "failed_safely";
+    reasons: [string, ...string[]];
+};
+export interface ProviderService {
+    /** The ONE four-block read model; the filtered block routes are projections of this. */
+    getReadModel(): Promise<FourBlockReadModel>;
+    /** Resolve the target/seat state at call time (validate-at-use) and return the safety verdict. */
+    precheck(input: ProviderPrecheckInput): Promise<PrecheckResult>;
+    /** Precheck-gated switch; returns an explicit business outcome (never a transport error). */
+    switchAccount(input: ProviderSwitchInput): Promise<ProviderSwitchResult>;
+}
+//# sourceMappingURL=provider-service.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/provider/provider-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-service.d.ts","sourceRoot":"","sources":["../../../src/domain/provider/provider-service.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE9E,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,OAAO,EAAE,WAAW,CAAA;CAAE,GACxB;IAAE,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACjC;IAAE,OAAO,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;CAAE,CAAC;AAEjE,MAAM,WAAW,eAAe;IAC9B,wFAAwF;IACxF,YAAY,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5C,kGAAkG;IAClG,QAAQ,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChE,6FAA6F;IAC7F,aAAa,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;CAC1E"}

package/node_modules/@openrig/daemon/dist/domain/provider/provider-service.js

@@ -0,0 +1,6 @@
+// Slice-04 (OPR.0.5.0.4) — the ProviderService seam. The routes (seam B) are thin over this
+// interface; the real implementation (collection from rig auth + seat registry + the three lanes,
+// switch composition + action recording) is seams C/D. Keeping this an interface lets the routes
+// register and honestly 503 until the production service is wired.
+export {};
+//# sourceMappingURL=provider-service.js.map

package/node_modules/@openrig/daemon/dist/domain/provider/provider-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-service.js","sourceRoot":"","sources":["../../../src/domain/provider/provider-service.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,kGAAkG;AAClG,iGAAiG;AACjG,mEAAmE"}

package/node_modules/@openrig/daemon/dist/domain/provider/provider-signals.d.ts

@@ -0,0 +1,76 @@
+import type { ProviderKind, ProviderSignal } from "./provider-types.js";
+/** One provider-native usage window from the Codex app-server `account/rateLimits/read`. */
+export interface CodexWindowReading {
+    usedPercent: number;
+    windowDurationMins: number;
+    resetsAt: string;
+}
+/** Subset of the Codex app-server `account/rateLimits/read` response we consume. */
+export interface CodexRateLimitReading {
+    primary?: CodexWindowReading;
+    secondary?: CodexWindowReading;
+}
+export interface CodexSignalInput {
+    accountRef: string;
+    /** Result of feature-probing the app-server generated schema for the rate-limit methods. */
+    probe: {
+        supported: boolean;
+    };
+    /** Present only when the probe was supported and a read actually returned. */
+    reading?: CodexRateLimitReading;
+    asOf: string;
+    staleAfter?: string;
+}
+export declare const CODEX_UNKNOWN_REASON: {
+    readonly probe_unsupported: "codex_app_server_unavailable";
+    readonly empty_reading: "codex_read_returned_no_windows";
+};
+/**
+ * Normalize a Codex app-server rate-limit read into `signals[]` rows.
+ * - probe unsupported → one explicit `unknown` row.
+ * - supported but no windows → one explicit `unknown` row (never fabricated zeros).
+ * - supported with windows → one `provider_structured_read` row per provider-native window,
+ *   preserving the native primary/secondary distinction.
+ */
+export declare function codexRateLimitSignals(input: CodexSignalInput): ProviderSignal[];
+/** One Claude subscription window from the statusline `rate_limits` object. */
+export interface ClaudeStatuslineWindow {
+    usedPercent: number;
+    resetsAt: string;
+}
+export interface ClaudeStatuslineReading {
+    five_hour?: ClaudeStatuslineWindow;
+    seven_day?: ClaudeStatuslineWindow;
+}
+export interface ClaudeSignalInput {
+    /** Claude statusline carries session identity but no honest account identity (Option A). */
+    seatSession: string;
+    /** false = the statusline cache has not been written yet (before the first API response). */
+    cachePresent: boolean;
+    /** Present only when the cache exists and carried a rate_limits object. */
+    reading?: ClaudeStatuslineReading;
+    asOf: string;
+    staleAfter?: string;
+}
+export declare const CLAUDE_UNKNOWN_REASON: {
+    readonly no_statusline_cache_yet: "claude_no_statusline_cache_yet";
+    readonly empty_reading: "claude_statusline_cache_had_no_windows";
+};
+/**
+ * Normalize a Claude statusline `rate_limits` reading into `signals[]` rows.
+ * - seat before first response (no cache) → explicit unknown row.
+ * - seat with subscription windows → one `provider_statusline` row per window (five_hour, and
+ *   seven_day normalized to "weekly"); a genuine 0 survives as 0.
+ * - subscription with cache but no windows → explicit unknown row (never fabricated zeros).
+ */
+export declare function claudeStatuslineSignals(input: ClaudeSignalInput): ProviderSignal[];
+export type ReactiveEventKind = "at_limit" | "stream_failure" | "stop_error";
+export interface ReactiveEventInput {
+    provider: ProviderKind;
+    accountRef: string;
+    kind: ReactiveEventKind;
+    asOf: string;
+    staleAfter: string;
+}
+export declare function reactiveEventSignal(input: ReactiveEventInput): ProviderSignal;
+//# sourceMappingURL=provider-signals.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/provider/provider-signals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-signals.d.ts","sourceRoot":"","sources":["../../../src/domain/provider/provider-signals.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAExE,4FAA4F;AAC5F,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,SAAS,CAAC,EAAE,kBAAkB,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,4FAA4F;IAC5F,KAAK,EAAE;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,oBAAoB;;;CAGvB,CAAC;AA2BX;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,gBAAgB,GAAG,cAAc,EAAE,CAsC/E;AASD,+EAA+E;AAC/E,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,sBAAsB,CAAC;IACnC,SAAS,CAAC,EAAE,sBAAsB,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAC;IACpB,6FAA6F;IAC7F,YAAY,EAAE,OAAO,CAAC;IACtB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,qBAAqB;;;CAGxB,CAAC;AAsBX;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,iBAAiB,GAAG,cAAc,EAAE,CAkClF;AAQD,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,gBAAgB,GAAG,YAAY,CAAC;AAE7E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,YAAY,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,iBAAiB,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IAGb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,cAAc,CAe7E"}

package/node_modules/@openrig/daemon/dist/domain/provider/provider-signals.js

@@ -0,0 +1,144 @@
+// Slice-04 (OPR.0.5.0.4) — signals[] normalization (the §2 detection design, encoded).
+// Authority: locked packet 3ffa3c22 IMPLEMENTATION-PRD §2 + the 2026-07-31 RESEARCH verdict.
+// Honesty rules enforced here: feature-probe-negative and empty reads become EXPLICIT
+// `unknown` rows (never silent zeros, never missing rows); only a real structured read is
+// `allow_switch_decision` (BR-2).
+export const CODEX_UNKNOWN_REASON = {
+    probe_unsupported: "codex_app_server_unavailable",
+    empty_reading: "codex_read_returned_no_windows",
+};
+function codexUnknownSignal(accountRef, asOf, unknownReason, supportsNotification, staleAfter) {
+    return {
+        provider: "codex",
+        accountRef,
+        sourceClass: "unknown",
+        authority: "unknown",
+        asOf,
+        staleAfter,
+        unknownReason,
+        // Unknown DATA must not erase KNOWN transport capability: when the app-server is present
+        // (supported-but-empty) `account/rateLimits/updated` still exists, so the notification
+        // capability is true; only an absent app-server (probe unsupported) is false.
+        supportsNotification,
+        automationUse: "do_not_automate",
+        // usedPercent / resetsAt / window deliberately OMITTED — an unknown row never carries a
+        // fabricated zero (the BR-2 silent-zero trap). A genuine 0 only ever comes from a real read.
+    };
+}
+/**
+ * Normalize a Codex app-server rate-limit read into `signals[]` rows.
+ * - probe unsupported → one explicit `unknown` row.
+ * - supported but no windows → one explicit `unknown` row (never fabricated zeros).
+ * - supported with windows → one `provider_structured_read` row per provider-native window,
+ *   preserving the native primary/secondary distinction.
+ */
+export function codexRateLimitSignals(input) {
+    const { accountRef, probe, reading, asOf, staleAfter } = input;
+    if (!probe.supported) {
+        // App-server absent → no notification transport.
+        return [codexUnknownSignal(accountRef, asOf, CODEX_UNKNOWN_REASON.probe_unsupported, false, staleAfter)];
+    }
+    const windows = [
+        ["primary", reading?.primary],
+        ["secondary", reading?.secondary],
+    ];
+    const rows = [];
+    for (const [window, w] of windows) {
+        if (!w)
+            continue;
+        rows.push({
+            provider: "codex",
+            accountRef,
+            sourceClass: "provider_structured_read",
+            authority: "account_cross_device",
+            window,
+            usedPercent: w.usedPercent,
+            resetsAt: w.resetsAt,
+            windowDurationMins: w.windowDurationMins,
+            asOf,
+            staleAfter,
+            supportsNotification: true, // Codex app-server carries account/rateLimits/updated
+            automationUse: "allow_switch_decision",
+        });
+    }
+    if (rows.length === 0) {
+        // App-server present but returned no windows → unknown DATA, but the transport capability
+        // (account/rateLimits/updated) is still KNOWN present → supportsNotification stays true.
+        return [codexUnknownSignal(accountRef, asOf, CODEX_UNKNOWN_REASON.empty_reading, true, staleAfter)];
+    }
+    return rows;
+}
+export const CLAUDE_UNKNOWN_REASON = {
+    no_statusline_cache_yet: "claude_no_statusline_cache_yet",
+    empty_reading: "claude_statusline_cache_had_no_windows",
+};
+function claudeUnknownSignal(seatSession, asOf, unknownReason, staleAfter) {
+    return {
+        provider: "claude",
+        seatSession,
+        sourceClass: "unknown",
+        authority: "unknown",
+        asOf,
+        staleAfter,
+        unknownReason,
+        supportsNotification: false, // Claude statusline has no push transport
+        automationUse: "do_not_automate",
+        // usedPercent / resetsAt / window OMITTED — never a fabricated zero.
+    };
+}
+/**
+ * Normalize a Claude statusline `rate_limits` reading into `signals[]` rows.
+ * - seat before first response (no cache) → explicit unknown row.
+ * - seat with subscription windows → one `provider_statusline` row per window (five_hour, and
+ *   seven_day normalized to "weekly"); a genuine 0 survives as 0.
+ * - subscription with cache but no windows → explicit unknown row (never fabricated zeros).
+ */
+export function claudeStatuslineSignals(input) {
+    const { seatSession, cachePresent, reading, asOf, staleAfter } = input;
+    if (!cachePresent) {
+        return [claudeUnknownSignal(seatSession, asOf, CLAUDE_UNKNOWN_REASON.no_statusline_cache_yet, staleAfter)];
+    }
+    const windows = [
+        ["five_hour", reading?.five_hour],
+        ["weekly", reading?.seven_day],
+    ];
+    const rows = [];
+    for (const [window, w] of windows) {
+        if (!w)
+            continue;
+        rows.push({
+            provider: "claude",
+            seatSession,
+            sourceClass: "provider_statusline",
+            authority: "account_cross_device", // Claude.ai Pro/Max subscription windows are account-level
+            window,
+            usedPercent: w.usedPercent,
+            resetsAt: w.resetsAt,
+            asOf,
+            staleAfter,
+            supportsNotification: false, // no push unless OpenRig later supplies a cache-update event
+            automationUse: "allow_switch_decision",
+        });
+    }
+    if (rows.length === 0) {
+        return [claudeUnknownSignal(seatSession, asOf, CLAUDE_UNKNOWN_REASON.empty_reading, staleAfter)];
+    }
+    return rows;
+}
+export function reactiveEventSignal(input) {
+    return {
+        provider: input.provider,
+        accountRef: input.accountRef,
+        sourceClass: "provider_event",
+        authority: "reactive_error",
+        asOf: input.asOf,
+        staleAfter: input.staleAfter,
+        // supportsNotification is OMITTED: it describes a per-account transport capability (true for
+        // Codex account/rateLimits/updated, false/unknown for Claude statusline). A generic reactive
+        // event does not establish that capability — hard-coding false would fabricate it.
+        // At-limit exhaustion is an actionable switch trigger; stream/stop errors are advisory.
+        automationUse: input.kind === "at_limit" ? "allow_switch_decision" : "advisory_only",
+        // No usedPercent — a reactive event is exhaustion evidence, not a remaining meter.
+    };
+}
+//# sourceMappingURL=provider-signals.js.map