@ouro.bot/cli 0.1.0-alpha.343 → 0.1.0-alpha.345

package/changelog.json

@@ -1,6 +1,19 @@
 {
   "_note": "This changelog is maintained as part of the PR/version-bump workflow. Agent-curated, not auto-generated. Agents read this file directly via read_file to understand what changed between versions.",
   "versions": [
+    {
+      "version": "0.1.0-alpha.345",
+      "changes": [
+        "Machine-wide provider credentials now have a local pool at `~/.agentsecrets/providers.json` with one active record per provider, generated credential revisions, safe provenance, redacted summaries, and explicit migration from legacy per-agent `~/.agentsecrets/<agent>/secrets.json` files."
+      ]
+    },
+    {
+      "version": "0.1.0-alpha.344",
+      "changes": [
+        "Provider readiness groundwork now has stable machine identity stored at `~/.ouro-cli/machine.json`, preserving random machine IDs across hostname changes while recording aliases for diagnostics.",
+        "Per-agent provider bindings and readiness can now be read, validated, written, and bootstrapped in `<agent>.ouro/state/providers.json` using explicit `outward` and `inner` lanes without storing credentials in bundle state."
+      ]
+    },
     {
       "version": "0.1.0-alpha.343",
       "changes": [

package/dist/heart/machine-identity.js

@@ -0,0 +1,161 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getMachineIdentityPath = getMachineIdentityPath;
+exports.loadOrCreateMachineIdentity = loadOrCreateMachineIdentity;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../nerves/runtime");
+function nowIso(deps) {
+    return (deps.now?.() ?? new Date()).toISOString();
+}
+function currentHostname(deps) {
+    return (deps.hostname?.() ?? os.hostname()).trim();
+}
+function defaultRandomId() {
+    return `machine_${crypto.randomUUID()}`;
+}
+function normalizeAliases(value) {
+    if (!Array.isArray(value))
+        return [];
+    const aliases = [];
+    for (const alias of value) {
+        if (typeof alias !== "string")
+            continue;
+        const trimmed = alias.trim();
+        if (trimmed && !aliases.includes(trimmed))
+            aliases.push(trimmed);
+    }
+    return aliases;
+}
+function parseMachineIdentity(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    const aliases = normalizeAliases(record.hostnameAliases);
+    if (record.schemaVersion !== 1 ||
+        typeof record.machineId !== "string" ||
+        record.machineId.trim().length === 0 ||
+        typeof record.createdAt !== "string" ||
+        record.createdAt.trim().length === 0 ||
+        typeof record.updatedAt !== "string" ||
+        record.updatedAt.trim().length === 0) {
+        return null;
+    }
+    return {
+        schemaVersion: 1,
+        machineId: record.machineId,
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+        hostnameAliases: aliases,
+    };
+}
+function writeMachineIdentity(machinePath, identity) {
+    fs.mkdirSync(path.dirname(machinePath), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(machinePath, `${JSON.stringify(identity, null, 2)}\n`, { encoding: "utf-8", mode: 0o600 });
+}
+function getMachineIdentityPath(homeDir = os.homedir()) {
+    return path.join(homeDir, ".ouro-cli", "machine.json");
+}
+function loadOrCreateMachineIdentity(deps = {}) {
+    const homeDir = deps.homeDir ?? os.homedir();
+    const machinePath = getMachineIdentityPath(homeDir);
+    const hostname = currentHostname(deps);
+    let existing = null;
+    let hadInvalidFile = false;
+    try {
+        existing = parseMachineIdentity(JSON.parse(fs.readFileSync(machinePath, "utf-8")));
+        if (!existing)
+            hadInvalidFile = true;
+    }
+    catch (error) {
+        const code = error && typeof error === "object" && "code" in error
+            ? error.code
+            : undefined;
+        if (code !== "ENOENT")
+            hadInvalidFile = true;
+    }
+    if (hadInvalidFile) {
+        (0, runtime_1.emitNervesEvent)({
+            level: "warn",
+            component: "config/identity",
+            event: "config.machine_identity_invalid",
+            message: "machine identity file is invalid; replacing it",
+            meta: { path: machinePath },
+        });
+    }
+    if (existing) {
+        if (hostname && !existing.hostnameAliases.includes(hostname)) {
+            const updated = {
+                ...existing,
+                updatedAt: nowIso(deps),
+                hostnameAliases: [...existing.hostnameAliases, hostname],
+            };
+            writeMachineIdentity(machinePath, updated);
+            (0, runtime_1.emitNervesEvent)({
+                component: "config/identity",
+                event: "config.machine_identity_alias_added",
+                message: "recorded hostname alias for stable machine identity",
+                meta: { machineId: updated.machineId, hostname },
+            });
+            return updated;
+        }
+        (0, runtime_1.emitNervesEvent)({
+            component: "config/identity",
+            event: "config.machine_identity_loaded",
+            message: "loaded stable machine identity",
+            meta: { machineId: existing.machineId },
+        });
+        return existing;
+    }
+    const timestamp = nowIso(deps);
+    const identity = {
+        schemaVersion: 1,
+        machineId: (deps.randomId?.() ?? defaultRandomId()).trim() || defaultRandomId(),
+        createdAt: timestamp,
+        updatedAt: timestamp,
+        hostnameAliases: hostname ? [hostname] : [],
+    };
+    writeMachineIdentity(machinePath, identity);
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.machine_identity_created",
+        message: "created stable machine identity",
+        meta: { machineId: identity.machineId },
+    });
+    return identity;
+}

package/dist/heart/provider-credential-pool.js

@@ -0,0 +1,386 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getProviderCredentialPoolPath = getProviderCredentialPoolPath;
+exports.validateProviderCredentialPool = validateProviderCredentialPool;
+exports.readProviderCredentialPool = readProviderCredentialPool;
+exports.writeProviderCredentialPool = writeProviderCredentialPool;
+exports.upsertProviderCredential = upsertProviderCredential;
+exports.redactProviderCredentialPool = redactProviderCredentialPool;
+exports.summarizeProviderCredentialPool = summarizeProviderCredentialPool;
+exports.readLegacyAgentProviderCredentials = readLegacyAgentProviderCredentials;
+exports.migrateLegacyAgentProviderCredentials = migrateLegacyAgentProviderCredentials;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../nerves/runtime");
+const VALID_PROVIDERS = ["azure", "minimax", "anthropic", "openai-codex", "github-copilot"];
+const VALID_PROVENANCE_SOURCES = ["auth-flow", "legacy-agent-secrets", "manual"];
+const PROVIDER_FIELD_SPLITS = {
+    anthropic: {
+        credentials: ["setupToken", "refreshToken", "expiresAt"],
+        config: [],
+        meaningfulCredentials: ["setupToken", "refreshToken"],
+    },
+    "openai-codex": {
+        credentials: ["oauthAccessToken"],
+        config: [],
+        meaningfulCredentials: ["oauthAccessToken"],
+    },
+    azure: {
+        credentials: ["apiKey"],
+        config: ["endpoint", "deployment", "apiVersion", "managedIdentityClientId"],
+        meaningfulCredentials: ["apiKey", "managedIdentityClientId"],
+    },
+    minimax: {
+        credentials: ["apiKey"],
+        config: [],
+        meaningfulCredentials: ["apiKey"],
+    },
+    "github-copilot": {
+        credentials: ["githubToken"],
+        config: ["baseUrl"],
+        meaningfulCredentials: ["githubToken"],
+    },
+};
+function isRecord(value) {
+    return !!value && typeof value === "object" && !Array.isArray(value);
+}
+function isAgentProvider(value) {
+    return VALID_PROVIDERS.includes(value);
+}
+function isProvenanceSource(value) {
+    return typeof value === "string" && VALID_PROVENANCE_SOURCES.includes(value);
+}
+function isCredentialValue(value) {
+    return typeof value === "string" || typeof value === "number";
+}
+function isPresentCredentialValue(value) {
+    if (!isCredentialValue(value))
+        return false;
+    if (typeof value === "string")
+        return value.trim().length > 0;
+    return Number.isFinite(value) && value !== 0;
+}
+function copyKnownFields(source, fields) {
+    const result = {};
+    for (const field of fields) {
+        const value = source[field];
+        if (isPresentCredentialValue(value)) {
+            result[field] = value;
+        }
+    }
+    return result;
+}
+function splitLegacyProviderConfig(provider, rawConfig) {
+    const fields = PROVIDER_FIELD_SPLITS[provider];
+    return {
+        credentials: copyKnownFields(rawConfig, fields.credentials),
+        config: copyKnownFields(rawConfig, fields.config),
+    };
+}
+function legacyProviderHasCredentialData(provider, rawConfig) {
+    const fields = PROVIDER_FIELD_SPLITS[provider];
+    return fields.meaningfulCredentials.some((field) => isPresentCredentialValue(rawConfig[field]));
+}
+function makeEmptyProviderCredentialPool(now) {
+    return {
+        schemaVersion: 1,
+        updatedAt: now.toISOString(),
+        providers: {},
+    };
+}
+function makeRevision() {
+    return `cred_${crypto.randomUUID()}`;
+}
+function getProviderCredentialPoolPath(homeDir = os.homedir()) {
+    return path.join(homeDir, ".agentsecrets", "providers.json");
+}
+function validateProviderCredentialPool(value) {
+    if (!isRecord(value)) {
+        throw new Error("provider credential pool must be an object");
+    }
+    if (value.schemaVersion !== 1) {
+        throw new Error("provider credential pool schemaVersion must be 1");
+    }
+    if (typeof value.updatedAt !== "string" || value.updatedAt.length === 0) {
+        throw new Error("provider credential pool updatedAt must be a non-empty string");
+    }
+    if (!isRecord(value.providers)) {
+        throw new Error("provider credential pool providers must be an object");
+    }
+    const providers = value.providers;
+    for (const [providerKey, rawRecord] of Object.entries(providers)) {
+        if (!isAgentProvider(providerKey)) {
+            throw new Error(`provider credential pool has unsupported provider ${providerKey}`);
+        }
+        if (!isRecord(rawRecord)) {
+            throw new Error(`${providerKey} credential record must be an object`);
+        }
+        if (rawRecord.provider !== providerKey) {
+            throw new Error(`${providerKey}.provider must match its provider key`);
+        }
+        if (typeof rawRecord.revision !== "string" || rawRecord.revision.length === 0) {
+            throw new Error(`${providerKey}.revision must be a non-empty string`);
+        }
+        if (typeof rawRecord.updatedAt !== "string" || rawRecord.updatedAt.length === 0) {
+            throw new Error(`${providerKey}.updatedAt must be a non-empty string`);
+        }
+        if (!isRecord(rawRecord.credentials)) {
+            throw new Error(`${providerKey}.credentials must be an object`);
+        }
+        if (!isRecord(rawRecord.config)) {
+            throw new Error(`${providerKey}.config must be an object`);
+        }
+        for (const [field, fieldValue] of Object.entries(rawRecord.credentials)) {
+            if (!isCredentialValue(fieldValue)) {
+                throw new Error(`${providerKey}.credentials.${field} must be a string or number`);
+            }
+        }
+        for (const [field, fieldValue] of Object.entries(rawRecord.config)) {
+            if (!isCredentialValue(fieldValue)) {
+                throw new Error(`${providerKey}.config.${field} must be a string or number`);
+            }
+        }
+        if (!isRecord(rawRecord.provenance)) {
+            throw new Error(`${providerKey}.provenance must be an object`);
+        }
+        if (!isProvenanceSource(rawRecord.provenance.source)) {
+            throw new Error(`${providerKey}.provenance.source must be auth-flow, legacy-agent-secrets, or manual`);
+        }
+        const contributedByAgent = rawRecord.provenance.contributedByAgent;
+        if (contributedByAgent !== undefined && typeof contributedByAgent !== "string") {
+            throw new Error(`${providerKey}.provenance.contributedByAgent must be a string when present`);
+        }
+        if (typeof rawRecord.provenance.updatedAt !== "string" || rawRecord.provenance.updatedAt.length === 0) {
+            throw new Error(`${providerKey}.provenance.updatedAt must be a non-empty string`);
+        }
+    }
+    return value;
+}
+function readProviderCredentialPool(homeDir = os.homedir()) {
+    const poolPath = getProviderCredentialPoolPath(homeDir);
+    try {
+        const raw = fs.readFileSync(poolPath, "utf-8");
+        const parsed = JSON.parse(raw);
+        const pool = validateProviderCredentialPool(parsed);
+        (0, runtime_1.emitNervesEvent)({
+            component: "config/identity",
+            event: "config.provider_credential_pool_read",
+            message: "read provider credential pool",
+            meta: { poolPath },
+        });
+        return { ok: true, poolPath, pool };
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            (0, runtime_1.emitNervesEvent)({
+                component: "config/identity",
+                event: "config.provider_credential_pool_missing",
+                message: "provider credential pool not found",
+                meta: { poolPath },
+            });
+            return {
+                ok: false,
+                reason: "missing",
+                poolPath,
+                error: "provider credential pool not found",
+            };
+        }
+        (0, runtime_1.emitNervesEvent)({
+            level: "error",
+            component: "config/identity",
+            event: "config.provider_credential_pool_invalid",
+            message: "provider credential pool invalid",
+            meta: { poolPath, reason: String(error) },
+        });
+        return {
+            ok: false,
+            reason: "invalid",
+            poolPath,
+            error: String(error),
+        };
+    }
+}
+function writeProviderCredentialPool(homeDir, pool) {
+    const validated = validateProviderCredentialPool(pool);
+    const poolPath = getProviderCredentialPoolPath(homeDir);
+    fs.mkdirSync(path.dirname(poolPath), { recursive: true });
+    fs.writeFileSync(poolPath, `${JSON.stringify(validated, null, 2)}\n`, "utf-8");
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.provider_credential_pool_written",
+        message: "wrote provider credential pool",
+        meta: { poolPath, providerCount: Object.keys(validated.providers).length },
+    });
+}
+function upsertProviderCredential(input) {
+    const homeDir = input.homeDir ?? os.homedir();
+    const now = input.now ?? new Date();
+    const updatedAt = now.toISOString();
+    const readResult = readProviderCredentialPool(homeDir);
+    const pool = readResult.ok ? readResult.pool : makeEmptyProviderCredentialPool(now);
+    if (!readResult.ok && readResult.reason === "invalid") {
+        throw new Error(`Cannot update invalid provider credential pool at ${readResult.poolPath}: ${readResult.error}`);
+    }
+    const record = {
+        provider: input.provider,
+        revision: (input.makeRevision ?? makeRevision)(),
+        updatedAt,
+        credentials: { ...input.credentials },
+        config: { ...input.config },
+        provenance: {
+            ...input.provenance,
+            updatedAt,
+        },
+    };
+    pool.updatedAt = updatedAt;
+    pool.providers[input.provider] = record;
+    writeProviderCredentialPool(homeDir, pool);
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.provider_credential_upserted",
+        message: "upserted provider credential record",
+        meta: { provider: input.provider, revision: record.revision, source: record.provenance.source },
+    });
+    return record;
+}
+function redactProviderCredentialPool(pool) {
+    const validated = validateProviderCredentialPool(pool);
+    const providers = {};
+    for (const [provider, record] of Object.entries(validated.providers)) {
+        const redactedCredentials = {};
+        for (const key of Object.keys(record.credentials)) {
+            redactedCredentials[key] = "[redacted]";
+        }
+        providers[provider] = {
+            ...record,
+            credentials: redactedCredentials,
+            config: { ...record.config },
+            provenance: { ...record.provenance },
+        };
+    }
+    return {
+        ...validated,
+        providers,
+    };
+}
+function summarizeProviderCredentialPool(pool) {
+    const validated = validateProviderCredentialPool(pool);
+    return {
+        providers: Object.entries(validated.providers).map(([, record]) => ({
+            provider: record.provider,
+            revision: record.revision,
+            source: record.provenance.source,
+            contributedByAgent: record.provenance.contributedByAgent,
+            updatedAt: record.updatedAt,
+            credentialFields: Object.keys(record.credentials).sort(),
+            configFields: Object.keys(record.config).sort(),
+        })),
+    };
+}
+function readLegacyAgentProviderCredentials(input) {
+    const homeDir = input.homeDir ?? os.homedir();
+    const secretsPath = path.join(homeDir, ".agentsecrets", input.agentName, "secrets.json");
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(secretsPath, "utf-8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return [];
+        }
+        throw new Error(`Failed to read legacy provider credentials for ${input.agentName}: ${String(error)}`);
+    }
+    if (!isRecord(parsed) || !isRecord(parsed.providers)) {
+        return [];
+    }
+    const candidates = [];
+    for (const [providerKey, rawProviderConfig] of Object.entries(parsed.providers)) {
+        if (!isAgentProvider(providerKey) || !isRecord(rawProviderConfig)) {
+            continue;
+        }
+        if (!legacyProviderHasCredentialData(providerKey, rawProviderConfig)) {
+            continue;
+        }
+        const { credentials, config } = splitLegacyProviderConfig(providerKey, rawProviderConfig);
+        candidates.push({
+            provider: providerKey,
+            credentials,
+            config,
+            provenance: {
+                source: "legacy-agent-secrets",
+                contributedByAgent: input.agentName,
+            },
+        });
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.provider_credential_legacy_read",
+        message: "read legacy provider credential candidates",
+        meta: { agentName: input.agentName, providerCount: candidates.length },
+    });
+    return candidates;
+}
+function migrateLegacyAgentProviderCredentials(input) {
+    const homeDir = input.homeDir ?? os.homedir();
+    const migrated = [];
+    for (const agentName of input.agentNames) {
+        const candidates = readLegacyAgentProviderCredentials({ homeDir, agentName });
+        for (const candidate of candidates) {
+            const record = upsertProviderCredential({
+                homeDir,
+                provider: candidate.provider,
+                credentials: candidate.credentials,
+                config: candidate.config,
+                provenance: candidate.provenance,
+                now: input.now,
+                makeRevision: input.makeRevision,
+            });
+            migrated.push({ agentName, provider: candidate.provider, revision: record.revision });
+        }
+    }
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.provider_credential_legacy_migrated",
+        message: "migrated legacy provider credentials",
+        meta: { migratedCount: migrated.length },
+    });
+    return {
+        poolPath: getProviderCredentialPoolPath(homeDir),
+        migrated,
+    };
+}

package/dist/heart/provider-state.js

@@ -0,0 +1,208 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateProviderState = validateProviderState;
+exports.getProviderStatePath = getProviderStatePath;
+exports.readProviderState = readProviderState;
+exports.writeProviderState = writeProviderState;
+exports.bootstrapProviderStateFromAgentConfig = bootstrapProviderStateFromAgentConfig;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const runtime_1 = require("../nerves/runtime");
+const identity_1 = require("./identity");
+const LANES = ["outward", "inner"];
+const VALID_SOURCES = new Set(["bootstrap", "local"]);
+const VALID_READINESS = new Set(["ready", "failed", "stale", "unknown"]);
+function isProvider(value) {
+    return typeof value === "string" && Object.prototype.hasOwnProperty.call(identity_1.PROVIDER_CREDENTIALS, value);
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function validateBinding(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error(`${label} must be an object`);
+    }
+    const record = value;
+    if (!isProvider(record.provider))
+        throw new Error(`${label}.provider must be a valid provider`);
+    if (!isNonEmptyString(record.model))
+        throw new Error(`${label}.model must be a non-empty string`);
+    if (!VALID_SOURCES.has(record.source)) {
+        throw new Error(`${label}.source must be bootstrap or local`);
+    }
+    if (!isNonEmptyString(record.updatedAt))
+        throw new Error(`${label}.updatedAt must be a non-empty string`);
+    return {
+        provider: record.provider,
+        model: record.model,
+        source: record.source,
+        updatedAt: record.updatedAt,
+    };
+}
+function validateReadiness(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error(`${label} must be an object`);
+    }
+    const record = value;
+    if (!VALID_READINESS.has(record.status)) {
+        throw new Error(`${label}.status must be ready, failed, stale, or unknown`);
+    }
+    if (!isProvider(record.provider))
+        throw new Error(`${label}.provider must be a valid provider`);
+    if (!isNonEmptyString(record.model))
+        throw new Error(`${label}.model must be a non-empty string`);
+    if (record.checkedAt !== undefined && typeof record.checkedAt !== "string") {
+        throw new Error(`${label}.checkedAt must be a string when present`);
+    }
+    if (record.credentialRevision !== undefined && typeof record.credentialRevision !== "string") {
+        throw new Error(`${label}.credentialRevision must be a string when present`);
+    }
+    if (record.error !== undefined && typeof record.error !== "string") {
+        throw new Error(`${label}.error must be a string when present`);
+    }
+    if (record.attempts !== undefined && typeof record.attempts !== "number") {
+        throw new Error(`${label}.attempts must be a number when present`);
+    }
+    return {
+        status: record.status,
+        provider: record.provider,
+        model: record.model,
+        ...(record.checkedAt !== undefined ? { checkedAt: record.checkedAt } : {}),
+        ...(record.credentialRevision !== undefined ? { credentialRevision: record.credentialRevision } : {}),
+        ...(record.error !== undefined ? { error: record.error } : {}),
+        ...(record.attempts !== undefined ? { attempts: record.attempts } : {}),
+    };
+}
+function validateProviderState(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw new Error("provider state must be an object");
+    }
+    const record = value;
+    if (record.schemaVersion !== 1)
+        throw new Error("schemaVersion must be 1");
+    if (!isNonEmptyString(record.machineId))
+        throw new Error("machineId must be a non-empty string");
+    if (!isNonEmptyString(record.updatedAt))
+        throw new Error("updatedAt must be a non-empty string");
+    if (!record.lanes || typeof record.lanes !== "object" || Array.isArray(record.lanes)) {
+        throw new Error("lanes must be an object");
+    }
+    const rawLanes = record.lanes;
+    const lanes = {
+        outward: validateBinding(rawLanes.outward, "outward"),
+        inner: validateBinding(rawLanes.inner, "inner"),
+    };
+    if (!record.readiness || typeof record.readiness !== "object" || Array.isArray(record.readiness)) {
+        throw new Error("readiness must be an object");
+    }
+    const rawReadiness = record.readiness;
+    const readiness = {};
+    for (const lane of LANES) {
+        if (rawReadiness[lane] !== undefined) {
+            readiness[lane] = validateReadiness(rawReadiness[lane], `${lane}.readiness`);
+        }
+    }
+    return {
+        schemaVersion: 1,
+        machineId: record.machineId,
+        updatedAt: record.updatedAt,
+        lanes,
+        readiness,
+    };
+}
+function getProviderStatePath(agentRoot) {
+    return path.join(agentRoot, "state", "providers.json");
+}
+function readProviderState(agentRoot) {
+    const statePath = getProviderStatePath(agentRoot);
+    let raw;
+    try {
+        raw = fs.readFileSync(statePath, "utf-8");
+    }
+    catch (error) {
+        const code = error.code;
+        if (code === "ENOENT") {
+            return { ok: false, reason: "missing", statePath, error: "provider state not found" };
+        }
+        return { ok: false, reason: "invalid", statePath, error: String(error) };
+    }
+    try {
+        const state = validateProviderState(JSON.parse(raw));
+        (0, runtime_1.emitNervesEvent)({
+            component: "config/identity",
+            event: "config.provider_state_read",
+            message: "read provider state",
+            meta: { statePath, machineId: state.machineId },
+        });
+        return { ok: true, statePath, state };
+    }
+    catch (error) {
+        return { ok: false, reason: "invalid", statePath, error: String(error) };
+    }
+}
+function writeProviderState(agentRoot, state) {
+    const statePath = getProviderStatePath(agentRoot);
+    const validated = validateProviderState(state);
+    fs.mkdirSync(path.dirname(statePath), { recursive: true });
+    fs.writeFileSync(statePath, `${JSON.stringify(validated, null, 2)}\n`, "utf-8");
+    (0, runtime_1.emitNervesEvent)({
+        component: "config/identity",
+        event: "config.provider_state_written",
+        message: "wrote provider state",
+        meta: { statePath, machineId: validated.machineId },
+    });
+}
+function binding(provider, model, updatedAt) {
+    return {
+        provider,
+        model,
+        source: "bootstrap",
+        updatedAt,
+    };
+}
+function bootstrapProviderStateFromAgentConfig(input) {
+    const updatedAt = input.now.toISOString();
+    return {
+        schemaVersion: 1,
+        machineId: input.machineId,
+        updatedAt,
+        lanes: {
+            outward: binding(input.agentConfig.humanFacing.provider, input.agentConfig.humanFacing.model, updatedAt),
+            inner: binding(input.agentConfig.agentFacing.provider, input.agentConfig.agentFacing.model, updatedAt),
+        },
+        readiness: {},
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.343",
+  "version": "0.1.0-alpha.345",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",