@openrig/cli 0.6.11 → 0.6.12

package/daemon/dist/adapters/omp-rpc-frame.d.ts

@@ -0,0 +1,51 @@
+/** OMP's documented reassembly ceiling; an advertised limit above it is not trusted. */
+export declare const OMP_MAX_REASSEMBLED_FRAME_BYTES: number;
+/** OMP's documented physical frame limit, the line's LF included. Under v2 no stdout line may exceed it. */
+export declare const OMP_MAX_FRAME_BYTES: number;
+/** The most chunks one sequence can have: OMP v18.5.0 sends 256 KiB payloads, so 64 MiB is 256 chunks. */
+export declare const OMP_MAX_CHUNKS = 256;
+/** The reassembly limit to negotiate under, when the ready frame advertises protocol v2; otherwise null (stay on v1). */
+export declare function ompProtocolV2Limit(ready: Record<string, unknown>): number | null;
+export type OmpFrameResult = 
+/** A whole frame: a plain line, or a completed chunk sequence. `dropped` names a sequence the frame interrupted. */
+{
+    frame: Record<string, unknown>;
+    dropped?: string;
+}
+/** A chunk was accepted; the sequence isn't complete yet. */
+ | {
+    pending: true;
+}
+/** A chunk sequence was rejected and discarded. Its remaining chunks are skipped without another error. */
+ | {
+    dropped: string;
+}
+/** A chunk of a sequence already rejected. */
+ | {
+    skipped: true;
+};
+/** Reassembles protocol v2 `rpc_chunk` sequences from parsed stdout lines. Holds at most one sequence, never more
+ *  than `limitBytes` of it, and checks each chunk's declared length against the limit before keeping any of it. */
+export declare class OmpFrameDecoder {
+    private readonly limitBytes;
+    private pending;
+    /** Sequences already reported as rejected (at most two: an interleaving pair); their later chunks are skipped until
+     *  a frame or line outside any sequence arrives. */
+    private readonly rejected;
+    /** A chunk without a usable chunkId was rejected: later chunks without one are skipped, not reported again. */
+    private rejectedAnonymous;
+    constructor(limitBytes: number);
+    /** The sequence still waiting for chunks, if any: at end of stream it can never complete. */
+    incomplete(): string | null;
+    /** A stdout line that isn't a frame (not JSON, or not an object) arrived: a pending sequence is interrupted. */
+    interrupt(what: string): string | null;
+    /** A line rejected before it was parsed (over the physical frame limit). A pending sequence is dropped with it, and
+     *  so is the line's own sequence when its chunkId is known, so its later chunks aren't reported again. */
+    rejectLine(reason: string, chunkId?: string): string | null;
+    /** A frame or line outside any sequence ends the skipping of a rejected one: OMP writes each sequence
+     *  uninterrupted, so its chunks can't continue past it. A stray late chunk then gets one "index 0" error. */
+    private endSkipping;
+    private drop;
+    push(value: Record<string, unknown>): OmpFrameResult;
+}
+//# sourceMappingURL=omp-rpc-frame.d.ts.map

package/daemon/dist/adapters/omp-rpc-frame.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"omp-rpc-frame.d.ts","sourceRoot":"","sources":["../../src/adapters/omp-rpc-frame.ts"],"names":[],"mappings":"AAUA,wFAAwF;AACxF,eAAO,MAAM,+BAA+B,QAAmB,CAAC;AAChE,4GAA4G;AAC5G,eAAO,MAAM,mBAAmB,QAAc,CAAC;AAC/C,0GAA0G;AAC1G,eAAO,MAAM,cAAc,MAAM,CAAC;AAIlC,yHAAyH;AACzH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAOhF;AAED,MAAM,MAAM,cAAc;AACxB,oHAAoH;AAClH;IAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE;AACtD,6DAA6D;GAC3D;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE;AACnB,2GAA2G;GACzG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;AACrB,8CAA8C;GAC5C;IAAE,OAAO,EAAE,IAAI,CAAA;CAAE,CAAC;AAItB;mHACmH;AACnH,qBAAa,eAAe;IAQd,OAAO,CAAC,QAAQ,CAAC,UAAU;IAPvC,OAAO,CAAC,OAAO,CAAwB;IACvC;wDACoD;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAqB;IAC9C,+GAA+G;IAC/G,OAAO,CAAC,iBAAiB,CAAS;gBAEL,UAAU,EAAE,MAAM;IAE/C,6FAA6F;IAC7F,UAAU,IAAI,MAAM,GAAG,IAAI;IAI3B,gHAAgH;IAChH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAOtC;8GAC0G;IAC1G,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAS3D;iHAC6G;IAC7G,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,IAAI;IAOZ,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,cAAc;CA2DrD"}

package/daemon/dist/adapters/omp-rpc-frame.js

@@ -0,0 +1,153 @@
+// OMP RPC protocol v2 framing, from the client side (#1275).
+//
+// OMP caps each stdout line at 1 MiB in protocol v1, and answers a larger response with
+// `success: false, error: "RPC response exceeded the transport limit"`. Its `ready` frame can advertise
+// protocol v2: after `negotiate_protocol`, a larger frame (response or event) arrives as a sequence of
+// `rpc_chunk` lines carrying base64 segments of one JSON object, up to `maxReassembledFrameBytes`.
+// This decoder follows OMP's documented contract (docs/rpc.md "Transport and Framing", checked against
+// v18.5.0): validate chunkId, index, count and byteLength, reject interrupted or interleaved sequences,
+// enforce the reassembly limit, concatenate in index order, decode strict UTF-8, parse one JSON object.
+/** OMP's documented reassembly ceiling; an advertised limit above it is not trusted. */
+export const OMP_MAX_REASSEMBLED_FRAME_BYTES = 64 * 1024 * 1024;
+/** OMP's documented physical frame limit, the line's LF included. Under v2 no stdout line may exceed it. */
+export const OMP_MAX_FRAME_BYTES = 1024 * 1024;
+/** The most chunks one sequence can have: OMP v18.5.0 sends 256 KiB payloads, so 64 MiB is 256 chunks. */
+export const OMP_MAX_CHUNKS = 256;
+const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+/** The reassembly limit to negotiate under, when the ready frame advertises protocol v2; otherwise null (stay on v1). */
+export function ompProtocolV2Limit(ready) {
+    const versions = ready.supportedProtocolVersions;
+    if (!Array.isArray(versions) || !versions.includes(2))
+        return null;
+    const advertised = ready.maxReassembledFrameBytes;
+    return typeof advertised === "number" && Number.isSafeInteger(advertised) && advertised > 0
+        ? Math.min(advertised, OMP_MAX_REASSEMBLED_FRAME_BYTES)
+        : OMP_MAX_REASSEMBLED_FRAME_BYTES;
+}
+/** Reassembles protocol v2 `rpc_chunk` sequences from parsed stdout lines. Holds at most one sequence, never more
+ *  than `limitBytes` of it, and checks each chunk's declared length against the limit before keeping any of it. */
+export class OmpFrameDecoder {
+    limitBytes;
+    pending = null;
+    /** Sequences already reported as rejected (at most two: an interleaving pair); their later chunks are skipped until
+     *  a frame or line outside any sequence arrives. */
+    rejected = new Set();
+    /** A chunk without a usable chunkId was rejected: later chunks without one are skipped, not reported again. */
+    rejectedAnonymous = false;
+    constructor(limitBytes) {
+        this.limitBytes = limitBytes;
+    }
+    /** The sequence still waiting for chunks, if any: at end of stream it can never complete. */
+    incomplete() {
+        return this.pending ? `chunk sequence ${this.pending.chunkId} ended after ${this.pending.nextIndex} of ${this.pending.count} chunks` : null;
+    }
+    /** A stdout line that isn't a frame (not JSON, or not an object) arrived: a pending sequence is interrupted. */
+    interrupt(what) {
+        if (!this.pending) {
+            this.endSkipping();
+            return null;
+        }
+        const { chunkId } = this.pending;
+        this.drop(chunkId);
+        return `chunk sequence ${chunkId} was interrupted by ${what}`;
+    }
+    /** A line rejected before it was parsed (over the physical frame limit). A pending sequence is dropped with it, and
+     *  so is the line's own sequence when its chunkId is known, so its later chunks aren't reported again. */
+    rejectLine(reason, chunkId) {
+        // Another line of a sequence already reported: skipped, as push() skips its chunks.
+        if (chunkId && !this.pending && this.rejected.has(chunkId))
+            return null;
+        const interrupted = this.pending?.chunkId;
+        this.drop(interrupted);
+        if (chunkId)
+            this.rejected.add(chunkId);
+        return interrupted && interrupted !== chunkId ? `${reason}; chunk sequence ${interrupted} was interrupted by it` : reason;
+    }
+    /** A frame or line outside any sequence ends the skipping of a rejected one: OMP writes each sequence
+     *  uninterrupted, so its chunks can't continue past it. A stray late chunk then gets one "index 0" error. */
+    endSkipping() {
+        this.rejected.clear();
+        this.rejectedAnonymous = false;
+    }
+    drop(chunkId) {
+        this.pending = null;
+        this.rejected.clear();
+        this.rejectedAnonymous = false;
+        if (chunkId)
+            this.rejected.add(chunkId);
+    }
+    push(value) {
+        if (value.type !== "rpc_chunk") {
+            if (!this.pending) {
+                this.endSkipping();
+                return { frame: value };
+            }
+            const { chunkId } = this.pending;
+            this.drop(chunkId);
+            return { frame: value, dropped: `chunk sequence ${chunkId} was interrupted by a ${String(value.type)} frame` };
+        }
+        const { chunkId, index, count, byteLength, data } = value;
+        const validId = typeof chunkId === "string" && chunkId.length > 0 && chunkId.length <= 128;
+        if (validId ? this.rejected.has(chunkId) : this.rejectedAnonymous)
+            return { skipped: true };
+        const reject = (reason) => {
+            this.drop(validId ? chunkId : undefined);
+            if (!validId)
+                this.rejectedAnonymous = true;
+            return { dropped: reason };
+        };
+        if (!validId || !Number.isSafeInteger(index) || !Number.isSafeInteger(count) || !Number.isSafeInteger(byteLength)) {
+            return reject("a chunk with invalid metadata");
+        }
+        const at = index, of = count, length = byteLength;
+        if (length > this.limitBytes)
+            return reject(`chunk sequence ${chunkId} declares ${length} bytes, above the ${this.limitBytes}-byte reassembly limit`);
+        if (of < 2 || of > OMP_MAX_CHUNKS || at < 0 || at >= of || length < 1 || of > length)
+            return reject(`chunk sequence ${chunkId} has invalid metadata`);
+        if (typeof data !== "string" || data.length === 0 || data.length > OMP_MAX_FRAME_BYTES || !BASE64.test(data)) {
+            return reject(`chunk sequence ${chunkId} has invalid chunk data`);
+        }
+        const bytes = Buffer.from(data, "base64");
+        if (bytes.toString("base64") !== data)
+            return reject(`chunk sequence ${chunkId} has invalid chunk data`);
+        if (!this.pending) {
+            if (at !== 0)
+                return reject(`chunk sequence ${chunkId} did not start at index 0`);
+            this.rejected.clear();
+            this.rejectedAnonymous = false;
+            this.pending = { chunkId, count: of, byteLength: length, nextIndex: 0, chunks: [], received: 0 };
+        }
+        else if (this.pending.chunkId !== chunkId) {
+            const interrupted = this.pending.chunkId;
+            // Both sequences are unusable: the interrupted one is incomplete, and the newcomer interleaved it.
+            this.drop(interrupted);
+            this.rejected.add(chunkId);
+            return { dropped: `chunk sequence ${interrupted} was interleaved with ${chunkId}` };
+        }
+        const pending = this.pending;
+        if (pending.count !== of || pending.byteLength !== length || pending.nextIndex !== at) {
+            return reject(`chunk sequence ${chunkId} is out of order or changed its metadata`);
+        }
+        if (pending.received + bytes.byteLength > pending.byteLength)
+            return reject(`chunk sequence ${chunkId} exceeds its declared length`);
+        pending.chunks.push(bytes);
+        pending.received += bytes.byteLength;
+        pending.nextIndex++;
+        if (pending.nextIndex < pending.count)
+            return { pending: true };
+        this.pending = null;
+        if (pending.received !== pending.byteLength)
+            return reject(`chunk sequence ${chunkId} is shorter than its declared length`);
+        let frame;
+        try {
+            frame = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(pending.chunks)));
+        }
+        catch {
+            return reject(`chunk sequence ${chunkId} is not one UTF-8 JSON object`);
+        }
+        if (frame === null || typeof frame !== "object" || Array.isArray(frame))
+            return reject(`chunk sequence ${chunkId} is not one JSON object`);
+        return { frame: frame };
+    }
+}
+//# sourceMappingURL=omp-rpc-frame.js.map

package/daemon/dist/adapters/omp-rpc-frame.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"omp-rpc-frame.js","sourceRoot":"","sources":["../../src/adapters/omp-rpc-frame.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,wFAAwF;AACxF,wGAAwG;AACxG,uGAAuG;AACvG,mGAAmG;AACnG,uGAAuG;AACvG,wGAAwG;AACxG,wGAAwG;AAExG,wFAAwF;AACxF,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAChE,4GAA4G;AAC5G,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,GAAG,IAAI,CAAC;AAC/C,0GAA0G;AAC1G,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAElC,MAAM,MAAM,GAAG,kEAAkE,CAAC;AAElF,yHAAyH;AACzH,MAAM,UAAU,kBAAkB,CAAC,KAA8B;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,yBAAyB,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,MAAM,UAAU,GAAG,KAAK,CAAC,wBAAwB,CAAC;IAClD,OAAO,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC;QACzF,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,+BAA+B,CAAC;QACvD,CAAC,CAAC,+BAA+B,CAAC;AACtC,CAAC;AAcD;mHACmH;AACnH,MAAM,OAAO,eAAe;IAQG;IAPrB,OAAO,GAAmB,IAAI,CAAC;IACvC;wDACoD;IACnC,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9C,+GAA+G;IACvG,iBAAiB,GAAG,KAAK,CAAC;IAElC,YAA6B,UAAkB;QAAlB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAEnD,6FAA6F;IAC7F,UAAU;QACR,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,OAAO,CAAC,OAAO,gBAAgB,IAAI,CAAC,OAAO,CAAC,SAAS,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9I,CAAC;IAED,gHAAgH;IAChH,SAAS,CAAC,IAAY;QACpB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACvD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,OAAO,kBAAkB,OAAO,uBAAuB,IAAI,EAAE,CAAC;IAChE,CAAC;IAED;8GAC0G;IAC1G,UAAU,CAAC,MAAc,EAAE,OAAgB;QACzC,oFAAoF;QACpF,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvB,IAAI,OAAO;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,WAAW,IAAI,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,oBAAoB,WAAW,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5H,CAAC;IAED;iHAC6G;IACrG,WAAW;QACjB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;IACjC,CAAC;IAEO,IAAI,CAAC,OAAgB;QAC3B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;QAC/B,IAAI,OAAO;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,KAA8B;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YAAC,CAAC;YACnE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,kBAAkB,OAAO,yBAAyB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACjH,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAC1D,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC;QAC3F,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC5F,MAAM,MAAM,GAAG,CAAC,MAAc,EAAkB,EAAE;YAChD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO;gBAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YAClH,OAAO,MAAM,CAAC,+BAA+B,CAAC,CAAC;QACjD,CAAC;QACD,MAAM,EAAE,GAAG,KAAe,EAAE,EAAE,GAAG,KAAe,EAAE,MAAM,GAAG,UAAoB,CAAC;QAChF,IAAI,MAAM,GAAG,IAAI,CAAC,UAAU;YAAE,OAAO,MAAM,CAAC,kBAAkB,OAAO,aAAa,MAAM,qBAAqB,IAAI,CAAC,UAAU,wBAAwB,CAAC,CAAC;QACtJ,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,cAAc,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,GAAG,MAAM;YAAE,OAAO,MAAM,CAAC,kBAAkB,OAAO,uBAAuB,CAAC,CAAC;QACtJ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,mBAAmB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7G,OAAO,MAAM,CAAC,kBAAkB,OAAO,yBAAyB,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,kBAAkB,OAAO,yBAAyB,CAAC,CAAC;QAEzG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,EAAE,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,kBAAkB,OAAO,2BAA2B,CAAC,CAAC;YAClF,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC;YAC/B,IAAI,CAAC,OAAO,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACnG,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;YACzC,mGAAmG;YACnG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3B,OAAO,EAAE,OAAO,EAAE,kBAAkB,WAAW,yBAAyB,OAAO,EAAE,EAAE,CAAC;QACtF,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,CAAC,KAAK,KAAK,EAAE,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YACtF,OAAO,MAAM,CAAC,kBAAkB,OAAO,0CAA0C,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU;YAAE,OAAO,MAAM,CAAC,kBAAkB,OAAO,8BAA8B,CAAC,CAAC;QACrI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC;QACrC,OAAO,CAAC,SAAS,EAAE,CAAC;QACpB,IAAI,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,KAAK;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,UAAU;YAAE,OAAO,MAAM,CAAC,kBAAkB,OAAO,sCAAsC,CAAC,CAAC;QAC5H,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACtG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,MAAM,CAAC,kBAAkB,OAAO,+BAA+B,CAAC,CAAC;QAC1E,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,kBAAkB,OAAO,yBAAyB,CAAC,CAAC;QAC3I,OAAO,EAAE,KAAK,EAAE,KAAgC,EAAE,CAAC;IACrD,CAAC;CACF"}

package/daemon/dist/adapters/pi-openrouter-charge.d.ts

@@ -0,0 +1,67 @@
+import { type PiProviderCharge } from "../domain/openrouter-charge.js";
+import type { PiUsageFact } from "../domain/pi-usage-facts.js";
+/** Whether a request's credential is established (from pi-readiness judgeChargeProvenance). */
+export type ChargeProvenance = {
+    ok: true;
+    credentialSource: string;
+} | {
+    ok: false;
+    reason: string;
+};
+export type GenerationReply = {
+    status: number;
+    body: unknown;
+} | {
+    status: number;
+    malformed: true;
+} | {
+    status: number;
+    tooLarge: true;
+} | {
+    error: "timeout" | "network";
+};
+export interface ChargeLookupIo {
+    /** GET /api/v1/generation?id=… with the forwarded key. Never throws. */
+    fetchGeneration(generationId: string): Promise<GenerationReply>;
+    /** POST the outcomes to the daemon; the entry ids it stored or already had (false when the post failed). */
+    postCharges(piSessionId: string, charges: PiProviderCharge[]): Promise<ReadonlySet<string> | false>;
+    schedule(fn: () => void, ms: number): void;
+    /** A line for the seat's pane (an outcome the daemon kept refusing). */
+    notice?(line: string): void;
+}
+/** The largest generation reply read; a larger one is an explicit "unavailable", never parsed. */
+export declare const OPENROUTER_REPLY_LIMIT_BYTES: number;
+/** The production lookup: GET /api/v1/generation?id=… with the given key, bounded by one timeout that covers the
+ *  headers and the body, and by a byte limit on the body. Never throws; the key goes only into the Authorization
+ *  header and is scrubbed from the reply. A body cut off by the timeout is a timeout; a complete body that isn't
+ *  JSON is "malformed"; a body over the limit is "too large". */
+export declare function openRouterGenerationFetcher(key: () => string | undefined, fetchImpl?: typeof fetch | undefined, timeoutMs?: number, limitBytes?: number): (generationId: string) => Promise<GenerationReply>;
+export declare const OPENROUTER_CHARGE_MAX_ATTEMPTS = 5;
+/** How often an outcome the daemon didn't acknowledge is posted again before it is given up (with a notice). */
+export declare const OPENROUTER_CHARGE_MAX_POSTS = 5;
+export declare class OpenRouterChargeLookup {
+    private readonly io;
+    private readonly retryDelaysMs;
+    private readonly queue;
+    /** Keys queued, being looked up, or finished (stored by the daemon). */
+    private readonly known;
+    private readonly unposted;
+    private running;
+    private flushScheduled;
+    constructor(io: ChargeLookupIo, retryDelaysMs?: number[]);
+    private delay;
+    /** Queue the own OpenRouter requests among facts the daemon has stored, each with its credential provenance;
+     *  `charged` already have a charge there. */
+    enqueue(piSessionId: string, items: Array<{
+        fact: PiUsageFact;
+        provenance: ChargeProvenance;
+    }>, charged: ReadonlySet<string>): void;
+    private pump;
+    /** Post the outcomes not yet acknowledged, per Pi session. What the daemon didn't acknowledge is posted again
+     *  later on its own schedule (never looked up again), up to a cap, then given up with a notice. */
+    private flush;
+    /** A scheduled post retry on a quiet seat: posts only, never another lookup. */
+    private flushAlone;
+    private lookUp;
+}
+//# sourceMappingURL=pi-openrouter-charge.d.ts.map

package/daemon/dist/adapters/pi-openrouter-charge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-openrouter-charge.d.ts","sourceRoot":"","sources":["../../src/adapters/pi-openrouter-charge.ts"],"names":[],"mappings":"AAeA,OAAO,EAAgF,KAAK,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACrJ,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAC;AAE/D,+FAA+F;AAC/F,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtG,MAAM,MAAM,eAAe,GACvB;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACjC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,IAAI,CAAA;CAAE,GACnC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,IAAI,CAAA;CAAE,GAClC;IAAE,KAAK,EAAE,SAAS,GAAG,SAAS,CAAA;CAAE,CAAC;AAErC,MAAM,WAAW,cAAc;IAC7B,wEAAwE;IACxE,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAChE,4GAA4G;IAC5G,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC;IACpG,QAAQ,CAAC,EAAE,EAAE,MAAM,IAAI,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,wEAAwE;IACxE,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,kGAAkG;AAClG,eAAO,MAAM,4BAA4B,QAAY,CAAC;AAatD;;;iEAGiE;AACjE,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,MAAM,MAAM,GAAG,SAAS,EAC7B,SAAS,GAAE,OAAO,KAAK,GAAG,SAA2D,EACrF,SAAS,SAAO,EAChB,UAAU,SAA+B,GACxC,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CA0CpD;AAED,eAAO,MAAM,8BAA8B,IAAI,CAAC;AAChD,gHAAgH;AAChH,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAM7C,qBAAa,sBAAsB;IAQrB,OAAO,CAAC,QAAQ,CAAC,EAAE;IAAkB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAP/E,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IACvC,wEAAwE;IACxE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA+B;IACxD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,cAAc,CAAS;gBAEF,EAAE,EAAE,cAAc,EAAmB,aAAa,WAAkB;IAEjG,OAAO,CAAC,KAAK;IAIb;iDAC6C;IAC7C,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,UAAU,EAAE,gBAAgB,CAAA;KAAE,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI;YAYrH,IAAI;IAkBlB;uGACmG;YACrF,KAAK;IAuBnB,gFAAgF;YAClE,UAAU;YAMV,MAAM;CA0BrB"}

package/daemon/dist/adapters/pi-openrouter-charge.js

@@ -0,0 +1,228 @@
+// OPR.0.7.0.2 (cost reporting, K4): the Pi runner's lookup of OpenRouter's actual charge for its own requests.
+//
+// Only with --openrouter-charge (usage.pi_openrouter_charge on, which needs usage.pi_cost_facts). The charge is
+// looked up with the credential that generated the request, and only when that is established: Pi records no
+// per-request credential, so the runner observes Pi's credential metadata at launch and at every refresh, and
+// a request is eligible only when the observations before and after it both show the OPENROUTER_API_KEY OpenRig
+// forwarded, no extension that could replace it, and no change in between (pi-readiness judgeChargeProvenance).
+// Anything else records "unavailable" with that reason; no other credential is used, and nothing is decided
+// from a later read.
+//
+// One lookup at a time, with a timeout covering the reply and a byte limit on it. "Not there yet" answers (404,
+// 408, 429, 5xx, timeout, network) are retried later up to a cap; then, like a refusal, a malformed or
+// oversized reply, they record "unavailable" with the reason. An outcome is done only once the daemon says it
+// stored it (or already had it); an unacknowledged one is posted again on its own bounded schedule, without
+// another lookup. Work never waits on any of this.
+import { OPENROUTER_GENERATION_URL, openRouterChargeTarget, parseOpenRouterGeneration } from "../domain/openrouter-charge.js";
+/** The largest generation reply read; a larger one is an explicit "unavailable", never parsed. */
+export const OPENROUTER_REPLY_LIMIT_BYTES = 64 * 1024;
+/** Replace any string that contains `secret` (anywhere in the reply) with null, so a reply that reflects the key
+ *  can never be stored or shown. */
+function scrub(value, secret) {
+    if (typeof value === "string")
+        return value.includes(secret) ? null : value;
+    if (Array.isArray(value))
+        return value.map((item) => scrub(item, secret));
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, scrub(v, secret)]));
+    }
+    return value;
+}
+/** The production lookup: GET /api/v1/generation?id=… with the given key, bounded by one timeout that covers the
+ *  headers and the body, and by a byte limit on the body. Never throws; the key goes only into the Authorization
+ *  header and is scrubbed from the reply. A body cut off by the timeout is a timeout; a complete body that isn't
+ *  JSON is "malformed"; a body over the limit is "too large". */
+export function openRouterGenerationFetcher(key, fetchImpl = typeof fetch === "function" ? fetch : undefined, timeoutMs = 5000, limitBytes = OPENROUTER_REPLY_LIMIT_BYTES) {
+    return async (generationId) => {
+        const apiKey = key()?.trim();
+        if (!apiKey || !fetchImpl)
+            return { error: "network" };
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const res = await fetchImpl(`${OPENROUTER_GENERATION_URL}?id=${encodeURIComponent(generationId)}`, {
+                headers: { authorization: `Bearer ${apiKey}` }, signal: controller.signal, redirect: "error",
+            });
+            if (!res.ok) {
+                await res.body?.cancel().catch(() => { });
+                return { status: res.status, body: null };
+            }
+            const declared = Number(res.headers.get("content-length"));
+            if (Number.isFinite(declared) && declared > limitBytes) {
+                await res.body?.cancel().catch(() => { });
+                return { status: res.status, tooLarge: true };
+            }
+            const chunks = [];
+            let size = 0;
+            const reader = res.body?.getReader();
+            if (reader) {
+                for (;;) {
+                    const { done, value } = await reader.read();
+                    if (done)
+                        break;
+                    size += value.byteLength;
+                    if (size > limitBytes) {
+                        await reader.cancel().catch(() => { });
+                        return { status: res.status, tooLarge: true };
+                    }
+                    chunks.push(value);
+                }
+            }
+            const text = new TextDecoder().decode(Buffer.concat(chunks));
+            let body;
+            try {
+                body = JSON.parse(text);
+            }
+            catch {
+                return { status: res.status, malformed: true };
+            }
+            return { status: res.status, body: scrub(body, apiKey) };
+        }
+        catch {
+            return { error: controller.signal.aborted ? "timeout" : "network" };
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    };
+}
+export const OPENROUTER_CHARGE_MAX_ATTEMPTS = 5;
+/** How often an outcome the daemon didn't acknowledge is posted again before it is given up (with a notice). */
+export const OPENROUTER_CHARGE_MAX_POSTS = 5;
+const RETRY_DELAYS_MS = [5_000, 15_000, 30_000, 60_000];
+export class OpenRouterChargeLookup {
+    io;
+    retryDelaysMs;
+    queue = [];
+    /** Keys queued, being looked up, or finished (stored by the daemon). */
+    known = new Set();
+    unposted = new Map();
+    running = false;
+    flushScheduled = false;
+    constructor(io, retryDelaysMs = RETRY_DELAYS_MS) {
+        this.io = io;
+        this.retryDelaysMs = retryDelaysMs;
+    }
+    delay(attempt) {
+        return this.retryDelaysMs[Math.min(attempt - 1, this.retryDelaysMs.length - 1)] ?? 60_000;
+    }
+    /** Queue the own OpenRouter requests among facts the daemon has stored, each with its credential provenance;
+     *  `charged` already have a charge there. */
+    enqueue(piSessionId, items, charged) {
+        for (const { fact, provenance } of items) {
+            if (fact.origin !== "own")
+                continue; // a fork's history belongs to its parent occupant
+            const target = openRouterChargeTarget(fact);
+            const key = `${piSessionId}\u0000${fact.entryId}`;
+            if (!("generationId" in target) || charged.has(fact.entryId) || this.known.has(key))
+                continue;
+            this.known.add(key);
+            this.queue.push({ piSessionId, entryId: fact.entryId, generationId: target.generationId, attempts: 0, provenance });
+        }
+        void this.pump();
+    }
+    async pump() {
+        if (this.running)
+            return;
+        this.running = true;
+        try {
+            for (let next = this.queue.shift(); next; next = this.queue.shift()) {
+                const outcome = await this.lookUp(next);
+                if (outcome === "retry") {
+                    this.io.schedule(() => { this.queue.push(next); void this.pump(); }, this.delay(next.attempts));
+                    continue;
+                }
+                this.unposted.set(`${next.piSessionId}\u0000${next.entryId}`, { piSessionId: next.piSessionId, charge: outcome, posts: 0 });
+                await this.flush();
+            }
+        }
+        finally {
+            this.running = false;
+        }
+    }
+    /** Post the outcomes not yet acknowledged, per Pi session. What the daemon didn't acknowledge is posted again
+     *  later on its own schedule (never looked up again), up to a cap, then given up with a notice. */
+    async flush() {
+        const bySession = new Map();
+        for (const item of this.unposted.values())
+            bySession.set(item.piSessionId, [...(bySession.get(item.piSessionId) ?? []), item]);
+        for (const [piSessionId, items] of bySession) {
+            let acknowledged = false;
+            try {
+                acknowledged = await this.io.postCharges(piSessionId, items.map((item) => item.charge));
+            }
+            catch {
+                acknowledged = false;
+            }
+            for (const item of items) {
+                const key = `${piSessionId}\u0000${item.charge.entryId}`;
+                if (acknowledged && acknowledged.has(item.charge.entryId)) {
+                    this.unposted.delete(key);
+                    continue;
+                }
+                item.posts += 1;
+                if (item.posts >= OPENROUTER_CHARGE_MAX_POSTS) {
+                    this.unposted.delete(key);
+                    this.io.notice?.(`[pi-runner] OpenRouter charge outcome for entry ${item.charge.entryId}: the daemon didn't acknowledge storing it after ${item.posts} posts, so storage couldn't be confirmed; no further posts`);
+                }
+            }
+        }
+        const remaining = Math.max(0, ...[...this.unposted.values()].map((item) => item.posts));
+        if (this.unposted.size > 0 && !this.flushScheduled) {
+            this.flushScheduled = true;
+            this.io.schedule(() => { this.flushScheduled = false; void this.flushAlone(); }, this.delay(remaining));
+        }
+    }
+    /** A scheduled post retry on a quiet seat: posts only, never another lookup. */
+    async flushAlone() {
+        if (this.running)
+            return; // the pump in progress flushes on its own
+        this.running = true;
+        try {
+            await this.flush();
+        }
+        finally {
+            this.running = false;
+        }
+    }
+    async lookUp(p) {
+        const unavailable = (reason, credentialSource) => ({
+            entryId: p.entryId, generationId: p.generationId, status: "unavailable", totalCostUsd: null, upstreamInferenceCostUsd: null,
+            cacheDiscountUsd: null, isByok: null, providerName: null, model: null, apiType: null, workspaceId: null,
+            generationCreatedAt: null, credentialSource, reason,
+        });
+        if (!p.provenance.ok)
+            return unavailable(`the generating credential isn't established: ${p.provenance.reason}`, "not established");
+        const credentialSource = p.provenance.credentialSource;
+        p.attempts += 1;
+        let reply;
+        try {
+            reply = await this.io.fetchGeneration(p.generationId);
+        }
+        catch {
+            reply = { error: "network" };
+        }
+        const status = "error" in reply ? null : reply.status;
+        if (status === null || status === 404 || status === 408 || status === 429 || status >= 500) {
+            p.last = "error" in reply ? reply.error : `HTTP ${status}`;
+            if (p.attempts < OPENROUTER_CHARGE_MAX_ATTEMPTS)
+                return "retry";
+            return unavailable(`not available after ${p.attempts} lookups (last: ${p.last})`, credentialSource);
+        }
+        if ("error" in reply)
+            return unavailable("lookup failed", credentialSource);
+        if (status === 401 || status === 403)
+            return unavailable(`the generating key can't read this generation (HTTP ${status})`, credentialSource);
+        if (status !== 200)
+            return unavailable(`lookup refused (HTTP ${status})`, credentialSource);
+        if ("tooLarge" in reply)
+            return unavailable(`reply larger than ${OPENROUTER_REPLY_LIMIT_BYTES} bytes`, credentialSource);
+        if ("malformed" in reply)
+            return unavailable("malformed reply: not JSON", credentialSource);
+        const parsed = parseOpenRouterGeneration(reply.body, p.generationId);
+        if (!parsed.ok)
+            return unavailable(parsed.reason, credentialSource);
+        return { entryId: p.entryId, generationId: p.generationId, status: "charged", credentialSource, reason: null, ...parsed.fields };
+    }
+}
+//# sourceMappingURL=pi-openrouter-charge.js.map

package/daemon/dist/adapters/pi-openrouter-charge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-openrouter-charge.js","sourceRoot":"","sources":["../../src/adapters/pi-openrouter-charge.ts"],"names":[],"mappings":"AAAA,+GAA+G;AAC/G,EAAE;AACF,gHAAgH;AAChH,6GAA6G;AAC7G,8GAA8G;AAC9G,gHAAgH;AAChH,gHAAgH;AAChH,4GAA4G;AAC5G,qBAAqB;AACrB,EAAE;AACF,gHAAgH;AAChH,uGAAuG;AACvG,8GAA8G;AAC9G,4GAA4G;AAC5G,mDAAmD;AACnD,OAAO,EAAE,yBAAyB,EAAE,sBAAsB,EAAE,yBAAyB,EAAyB,MAAM,gCAAgC,CAAC;AAsBrJ,kGAAkG;AAClG,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtD;oCACoC;AACpC,SAAS,KAAK,CAAC,KAAc,EAAE,MAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;iEAGiE;AACjE,MAAM,UAAU,2BAA2B,CACzC,GAA6B,EAC7B,YAAsC,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EACrF,SAAS,GAAG,IAAI,EAChB,UAAU,GAAG,4BAA4B;IAEzC,OAAO,KAAK,EAAE,YAAY,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,yBAAyB,OAAO,kBAAkB,CAAC,YAAY,CAAC,EAAE,EAAE;gBACjG,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO;aAC7F,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACzC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC5C,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,UAAU,EAAE,CAAC;gBACvD,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACzC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;YAChD,CAAC;YACD,MAAM,MAAM,GAAiB,EAAE,CAAC;YAChC,IAAI,IAAI,GAAG,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YACrC,IAAI,MAAM,EAAE,CAAC;gBACX,SAAS,CAAC;oBACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;oBAC5C,IAAI,IAAI;wBAAE,MAAM;oBAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;oBACzB,IAAI,IAAI,GAAG,UAAU,EAAE,CAAC;wBACtB,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;wBACtC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;oBAChD,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YAC7D,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YAAC,CAAC;YAC1F,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACtE,CAAC;gBAAS,CAAC;YAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC;AAChD,gHAAgH;AAChH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAC7C,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAKxD,MAAM,OAAO,sBAAsB;IAQJ;IAAqC;IAPjD,KAAK,GAAc,EAAE,CAAC;IACvC,wEAAwE;IACvD,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1B,QAAQ,GAAG,IAAI,GAAG,EAAoB,CAAC;IAChD,OAAO,GAAG,KAAK,CAAC;IAChB,cAAc,GAAG,KAAK,CAAC;IAE/B,YAA6B,EAAkB,EAAmB,gBAAgB,eAAe;QAApE,OAAE,GAAF,EAAE,CAAgB;QAAmB,kBAAa,GAAb,aAAa,CAAkB;IAAG,CAAC;IAE7F,KAAK,CAAC,OAAe;QAC3B,OAAO,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC5F,CAAC;IAED;iDAC6C;IAC7C,OAAO,CAAC,WAAmB,EAAE,KAAiE,EAAE,OAA4B;QAC1H,KAAK,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,KAAK,EAAE,CAAC;YACzC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK;gBAAE,SAAS,CAAC,kDAAkD;YACvF,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,GAAG,GAAG,GAAG,WAAW,SAAS,IAAI,CAAC,OAAO,EAAE,CAAC;YAClD,IAAI,CAAC,CAAC,cAAc,IAAI,MAAM,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC9F,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACpB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;IACnB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;gBACpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACxC,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;oBACxB,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAChG,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,SAAS,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC5H,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED;uGACmG;IAC3F,KAAK,CAAC,KAAK;QACjB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;QAChD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC/H,KAAK,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;YAC7C,IAAI,YAAY,GAAgC,KAAK,CAAC;YACtD,IAAI,CAAC;gBAAC,YAAY,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,YAAY,GAAG,KAAK,CAAC;YAAC,CAAC;YAChI,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,GAAG,GAAG,GAAG,WAAW,SAAS,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACzD,IAAI,YAAY,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;oBAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACnG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;gBAChB,IAAI,IAAI,CAAC,KAAK,IAAI,2BAA2B,EAAE,CAAC;oBAC9C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBAC1B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,mDAAmD,IAAI,CAAC,MAAM,CAAC,OAAO,oDAAoD,IAAI,CAAC,KAAK,4DAA4D,CAAC,CAAC;gBACrN,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACxF,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACnD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;YAC3B,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,UAAU;QACtB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,0CAA0C;QACpE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QAAC,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,CAAU;QAC7B,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,gBAAwB,EAAoB,EAAE,CAAC,CAAC;YACnF,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI;YAC3H,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI;YACvG,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,WAAW,CAAC,gDAAgD,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACnI,MAAM,gBAAgB,GAAG,CAAC,CAAC,UAAU,CAAC,gBAAgB,CAAC;QACvD,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC;QAChB,IAAI,KAAsB,CAAC;QAC3B,IAAI,CAAC;YAAC,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,KAAK,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;QAAC,CAAC;QACtG,MAAM,MAAM,GAAG,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACtD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAC3F,CAAC,CAAC,IAAI,GAAG,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC;YAC3D,IAAI,CAAC,CAAC,QAAQ,GAAG,8BAA8B;gBAAE,OAAO,OAAO,CAAC;YAChE,OAAO,WAAW,CAAC,uBAAuB,CAAC,CAAC,QAAQ,mBAAmB,CAAC,CAAC,IAAI,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,OAAO,IAAI,KAAK;YAAE,OAAO,WAAW,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;QAC5E,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,WAAW,CAAC,uDAAuD,MAAM,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC7I,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,WAAW,CAAC,wBAAwB,MAAM,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5F,IAAI,UAAU,IAAI,KAAK;YAAE,OAAO,WAAW,CAAC,qBAAqB,4BAA4B,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACzH,IAAI,WAAW,IAAI,KAAK;YAAE,OAAO,WAAW,CAAC,2BAA2B,EAAE,gBAAgB,CAAC,CAAC;QAC5F,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACpE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;IACnI,CAAC;CACF"}

package/daemon/dist/adapters/pi-readiness.d.ts

@@ -1,15 +1,91 @@
 /** The daemon and pane may resolve different executables. Never turn a
  * version observation into a new launch refusal or echo arbitrary stdout. */
 export declare function piVersionNotice(output: string): string;
-/** Metadata-only, advisory check of the EXACT managed child environment and
- * agent directory. No global login read, credential command, refresh or API
- * request. Presence is not a successful authentication claim. Pi's own loader
- * remains authoritative (including extension/custom-provider credentials).
- * Shapes: earendil-works/pi v0.87.1 auth-storage.ts and docs/models.md. */
+/** Which credential Pi will resolve for a provider in the EXACT managed child environment and agent directory,
+ * in Pi's own order: a stored sign-in or key in auth.json, then a models.json provider key, then the provider's
+ * environment key. Metadata only: no global login read, credential command, refresh or API request, and never a
+ * credential value. Presence is not a successful authentication claim. Pi's own loader remains authoritative
+ * (including extension/custom-provider credentials). Shapes: earendil-works/pi v0.87.1 auth-storage.ts and
+ * docs/models.md. */
+/** Whether a models.json provider entry can change how Pi authenticates for that provider (Pi 0.87.1
+ *  provider-composer.js): a key, OAuth, headers, an auth header, or a base URL (where the key is sent), on the
+ *  entry or on any of its custom models or model overrides. An entry that only adds or adjusts models without
+ *  these keeps the inherited credential (for OpenRouter, the environment key). */
+export declare function providerEntryAuth(entry: unknown): "none" | "bearing" | "unknown";
+/** Pi 0.87.1 parses models.json as JSON.parse(stripJsonComments(stripBom(text))) (model-config.js, utils/json.js):
+ *  `//` line comments outside strings and trailing commas are removed. The same here, so a file Pi reads is read. */
+export declare function parsePiModelsJson(text: string): unknown;
+export type PiCredentialSource = {
+    kind: "stored-sign-in" | "stored-key" | "models-key";
+    provider: string;
+} | {
+    kind: "managed-env";
+    provider: string;
+    envVar: string;
+} | {
+    kind: "none";
+    provider: string;
+    envVar: string | undefined;
+} | {
+    kind: "unknown";
+};
+export declare function piCredentialSource(opts: {
+    model?: string;
+    agentDir: string;
+    env: Readonly<Record<string, string | undefined>>;
+    readFile: (file: string) => string;
+}): PiCredentialSource;
+/** Advisory launch notice from {@link piCredentialSource}. */
 export declare function piCredentialNotice(opts: {
     model?: string;
     agentDir: string;
     env: Readonly<Record<string, string | undefined>>;
     readFile: (file: string) => string;
 }): string;
+/** OPR.0.7.0.2 K4: what metadata shows about Pi's OpenRouter credential at one moment. Pi records no
+ *  per-request credential, so a request's credential is established by two of these, taken before and after
+ *  it (see judgeChargeProvenance). Metadata only: credential files are classified, never used; settings are
+ *  read only for extension entries; extension directories are listed, never loaded. */
+export type PiCredentialEvidence = {
+    at: number;
+    source: PiCredentialSource;
+    /** Whether a Pi extension could load (and so register a provider or a runtime key): Pi 0.87.1 discovers
+     *  <agentDir>/extensions, <cwd>/.pi/extensions, and `packages`/`extensions` entries in either settings.json.
+     *  OpenRig passes no -e flags. */
+    extensions: "none" | "present" | "unknown";
+    /** Whether models.json has an OpenRouter provider entry that can change authentication (providerEntryAuth),
+     *  whichever credential wins and whether or not its key is literal: Pi's provider composer holds it from load
+     *  until a reload. A credential-free entry (models only) is "none". */
+    modelsOpenRouterEntry: "none" | "present" | "unknown";
+    /** Identity of every file and directory above, so a change between two observations is visible. */
+    fingerprint: string;
+};
+export declare function piCredentialEvidence(opts: {
+    agentDir: string;
+    cwd: string;
+    env: Readonly<Record<string, string | undefined>>;
+    now: () => number;
+    /** "absent", or a stable identity for a file (e.g. ino:size:mtime). */
+    statId: (file: string) => string;
+    /** Entry names of a directory; [] when it doesn't exist. Throws when it can't be read. */
+    listDir: (dir: string) => string[];
+    readFile: (file: string) => string;
+}): PiCredentialEvidence;
+/** What, seen in any observation of this runner process, Pi may still hold until it restarts: an extension
+ *  (Pi 0.87.1 loads extensions at start and again only on an explicit /reload) or a models.json OpenRouter key
+ *  (Pi loads models.json at start and again only on an explicit refresh). Clean files later don't change what
+ *  the running Pi loaded, so once seen, this is sticky for the process. */
+export declare function credentialTaint(e: PiCredentialEvidence): {
+    sticky: string;
+} | null;
+/** Whether a request's credential is established as the key OpenRig forwarded: it was persisted after `before`
+ *  and observed by `after`, both show Pi's OpenRouter credential as that key with no extension able to replace
+ *  it, and nothing changed in between. Otherwise the reason it isn't. */
+export declare function judgeChargeProvenance(before: PiCredentialEvidence | null, after: PiCredentialEvidence, entryTimestamp: string): {
+    ok: true;
+    credentialSource: string;
+} | {
+    ok: false;
+    reason: string;
+};
 //# sourceMappingURL=pi-readiness.d.ts.map