@pellux/goodvibes-sdk 0.38.0 → 1.1.0

package/dist/platform/presentation/tones.d.ts

@@ -0,0 +1,121 @@
+/**
+ * tones.ts — the canonical UI tone-token table, hoisted from `goodvibes-tui`
+ * src/renderer/ui-primitives.ts (UI_TONES + DIFF_TONES + SPINNER_FRAMES) and
+ * src/renderer/theme.ts (resolveUiTones / UI_TONES_LIGHT).
+ *
+ * TONE_TOKENS mirrors the TUI's UI_TONES shape byte-for-byte (the TUI is the
+ * reference, and its dark values are the accepted baseline — this keeps a
+ * future TUI swap onto this module a no-op). resolveTones(mode) is the single
+ * mode-resolved read path: 'dark' returns TONE_TOKENS itself (so a byte-identity
+ * check against the constant is trivially true), 'light' returns the inverted
+ * chrome/accent variant tuned for legibility on a light terminal background.
+ *
+ * This module is PURE data — no fs, no terminal I/O, no process globals.
+ * Painting stays renderer-owned; this module owns only the token values and
+ * the mode-resolution function.
+ */
+/** Background mode — dark is the safe default until a caller's own bg-probe lands. */
+export type ThemeMode = 'dark' | 'light';
+/** The dark-mode (reference) tone-token table. */
+export declare const TONE_TOKENS: {
+    readonly fg: {
+        readonly primary: "#e2e8f0";
+        readonly secondary: "#cbd5e1";
+        readonly muted: "#94a3b8";
+        readonly dim: "#475569";
+        readonly inverse: "#0f172a";
+        /** Empty-state / placeholder foreground. */
+        readonly empty: "#334155";
+    };
+    readonly bg: {
+        readonly base: "#11131a";
+        readonly surface: "#161a22";
+        readonly title: "#0f172a";
+        readonly section: "#18202b";
+        readonly summary: "#1b2430";
+        readonly selected: "#223049";
+        readonly input: "#1e293b";
+        readonly warning: "#2b2116";
+        readonly error: "#2a161b";
+        readonly success: "#14241b";
+        /** Fullscreen/shell footer background. */
+        readonly footer: "#111827";
+    };
+    readonly state: {
+        readonly info: "#38bdf8";
+        readonly good: "#22c55e";
+        readonly warn: "#f59e0b";
+        readonly bad: "#ef4444";
+        readonly blocked: "#f97316";
+        readonly active: "#60a5fa";
+        /** Canonical reasoning/thinking purple. */
+        readonly reasoning: "#a855f7";
+    };
+    readonly accent: {
+        readonly browser: "#7dd3fc";
+        readonly control: "#22d3ee";
+        readonly inspector: "#c4b5fd";
+        readonly workflow: "#fbbf24";
+        readonly conversation: "#93c5fd";
+        /** Neon brand accent — header/splash/thinking gradient only. */
+        readonly brand: "#00ffff";
+        readonly gradientStart: "#00ffff";
+        readonly gradientEnd: "#d000ff";
+    };
+    /** Canonical border stroke color for fullscreen/panel chrome. */
+    readonly border: "#64748b";
+    /**
+     * Persistent-chrome foregrounds — header / footer / live-thinking rows that
+     * paint onto the TRANSPARENT terminal background (bg:''), NOT onto the
+     * opaque dark modal/panel surfaces that fg.* and state.* serve. In light
+     * mode this chrome sits on a light terminal and must invert toward dark to
+     * stay legible, which is why it carries its own role instead of reusing
+     * fg.muted/fg.dim (tuned light-on-dark for the opaque boxes). Dark values
+     * here are byte-identical to the tokens they mirror (fg.muted, fg.dim,
+     * state.warn, state.bad), so dark-mode chrome is unchanged by this table
+     * existing.
+     */
+    readonly chrome: {
+        /** Secondary chrome text (header conversation title). == fg.muted (dark). */
+        readonly label: "#94a3b8";
+        /** Faint chrome text (version, provider, header rule, clean git). == fg.dim (dark). */
+        readonly faint: "#475569";
+        /** Warn accent on terminal bg (dirty git, pending risk). == state.warn (dark). */
+        readonly warn: "#f59e0b";
+        /** Alert accent on terminal bg (DANGER banner, shell risk). == state.bad (dark). */
+        readonly bad: "#ef4444";
+        /** Success accent on terminal bg (tool-call checkmark status). == state.good (dark). */
+        readonly good: "#22c55e";
+        /** Remote-risk accent on terminal bg (risk:remote marker, plain status). */
+        readonly remote: "#a78bfa";
+    };
+};
+/**
+ * Diff surface accent color shared across diff-rendering surfaces (conversation
+ * diff view, file diff panel, git panel inline diff).
+ */
+export declare const DIFF_TONES: {
+    readonly add: "#00ff88";
+    readonly del: "#ff4444";
+    readonly hunk: "#88aaff";
+};
+/** Single spinner-frame source. */
+export declare const SPINNER_FRAMES: readonly ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+/** Recursively widen the `as const` literal leaves of TONE_TOKENS to `string`
+ * so the light variant can assign different colour values without fighting
+ * TypeScript's literal-type inference. */
+type DeepWidenToString<T> = T extends string ? string : {
+    [K in keyof T]: DeepWidenToString<T[K]>;
+};
+/** The mode-resolved shape returned by resolveTones — same keys as TONE_TOKENS,
+ * widened from literal string types to `string` so light values can differ. */
+export type ToneTokens = DeepWidenToString<typeof TONE_TOKENS>;
+/**
+ * resolveTones — return the tone-token table for the given background mode.
+ * 'dark' returns TONE_TOKENS itself (byte-identical, same object reference) so
+ * a consumer that has not wired mode detection can call resolveTones('dark')
+ * as the safe default with zero behavior change.
+ */
+export declare function resolveTones(mode: ThemeMode): Readonly<ToneTokens>;
+export {};
+//# sourceMappingURL=tones.d.ts.map

package/dist/platform/presentation/tones.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tones.d.ts","sourceRoot":"","sources":["../../../src/platform/presentation/tones.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,sFAAsF;AACtF,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzC,kDAAkD;AAClD,eAAO,MAAM,WAAW;;;;;;;QAOpB,4CAA4C;;;;;;;;;;;;;;QAc5C,0CAA0C;;;;;;;;;;QAU1C,2CAA2C;;;;;;;;;QAS3C,gEAAgE;;;;;IAKlE,iEAAiE;;IAEjE;;;;;;;;;;OAUG;;QAED,6EAA6E;;QAE7E,uFAAuF;;QAEvF,kFAAkF;;QAElF,oFAAoF;;QAEpF,wFAAwF;;QAExF,4EAA4E;;;CAGtE,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,UAAU;;;;CAIb,CAAC;AAEX,mCAAmC;AACnC,eAAO,MAAM,cAAc,6DAA8D,CAAC;AAE1F;;0CAE0C;AAC1C,KAAK,iBAAiB,CAAC,CAAC,IAAI,CAAC,SAAS,MAAM,GAAG,MAAM,GAAG;KAAG,CAAC,IAAI,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CAAE,CAAC;AAEpG;+EAC+E;AAC/E,MAAM,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,WAAW,CAAC,CAAC;AAuC/D;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,GAAG,QAAQ,CAAC,UAAU,CAAC,CAElE"}

package/dist/platform/presentation/tones.js

@@ -0,0 +1,145 @@
+/**
+ * tones.ts — the canonical UI tone-token table, hoisted from `goodvibes-tui`
+ * src/renderer/ui-primitives.ts (UI_TONES + DIFF_TONES + SPINNER_FRAMES) and
+ * src/renderer/theme.ts (resolveUiTones / UI_TONES_LIGHT).
+ *
+ * TONE_TOKENS mirrors the TUI's UI_TONES shape byte-for-byte (the TUI is the
+ * reference, and its dark values are the accepted baseline — this keeps a
+ * future TUI swap onto this module a no-op). resolveTones(mode) is the single
+ * mode-resolved read path: 'dark' returns TONE_TOKENS itself (so a byte-identity
+ * check against the constant is trivially true), 'light' returns the inverted
+ * chrome/accent variant tuned for legibility on a light terminal background.
+ *
+ * This module is PURE data — no fs, no terminal I/O, no process globals.
+ * Painting stays renderer-owned; this module owns only the token values and
+ * the mode-resolution function.
+ */
+/** The dark-mode (reference) tone-token table. */
+export const TONE_TOKENS = {
+    fg: {
+        primary: '#e2e8f0',
+        secondary: '#cbd5e1',
+        muted: '#94a3b8',
+        dim: '#475569',
+        inverse: '#0f172a',
+        /** Empty-state / placeholder foreground. */
+        empty: '#334155',
+    },
+    bg: {
+        base: '#11131a',
+        surface: '#161a22',
+        title: '#0f172a',
+        section: '#18202b',
+        summary: '#1b2430',
+        selected: '#223049',
+        input: '#1e293b',
+        warning: '#2b2116',
+        error: '#2a161b',
+        success: '#14241b',
+        /** Fullscreen/shell footer background. */
+        footer: '#111827',
+    },
+    state: {
+        info: '#38bdf8',
+        good: '#22c55e',
+        warn: '#f59e0b',
+        bad: '#ef4444',
+        blocked: '#f97316',
+        active: '#60a5fa',
+        /** Canonical reasoning/thinking purple. */
+        reasoning: '#a855f7',
+    },
+    accent: {
+        browser: '#7dd3fc',
+        control: '#22d3ee',
+        inspector: '#c4b5fd',
+        workflow: '#fbbf24',
+        conversation: '#93c5fd',
+        /** Neon brand accent — header/splash/thinking gradient only. */
+        brand: '#00ffff',
+        gradientStart: '#00ffff',
+        gradientEnd: '#d000ff',
+    },
+    /** Canonical border stroke color for fullscreen/panel chrome. */
+    border: '#64748b',
+    /**
+     * Persistent-chrome foregrounds — header / footer / live-thinking rows that
+     * paint onto the TRANSPARENT terminal background (bg:''), NOT onto the
+     * opaque dark modal/panel surfaces that fg.* and state.* serve. In light
+     * mode this chrome sits on a light terminal and must invert toward dark to
+     * stay legible, which is why it carries its own role instead of reusing
+     * fg.muted/fg.dim (tuned light-on-dark for the opaque boxes). Dark values
+     * here are byte-identical to the tokens they mirror (fg.muted, fg.dim,
+     * state.warn, state.bad), so dark-mode chrome is unchanged by this table
+     * existing.
+     */
+    chrome: {
+        /** Secondary chrome text (header conversation title). == fg.muted (dark). */
+        label: '#94a3b8',
+        /** Faint chrome text (version, provider, header rule, clean git). == fg.dim (dark). */
+        faint: '#475569',
+        /** Warn accent on terminal bg (dirty git, pending risk). == state.warn (dark). */
+        warn: '#f59e0b',
+        /** Alert accent on terminal bg (DANGER banner, shell risk). == state.bad (dark). */
+        bad: '#ef4444',
+        /** Success accent on terminal bg (tool-call checkmark status). == state.good (dark). */
+        good: '#22c55e',
+        /** Remote-risk accent on terminal bg (risk:remote marker, plain status). */
+        remote: '#a78bfa',
+    },
+};
+/**
+ * Diff surface accent color shared across diff-rendering surfaces (conversation
+ * diff view, file diff panel, git panel inline diff).
+ */
+export const DIFF_TONES = {
+    add: '#00ff88',
+    del: '#ff4444',
+    hunk: '#88aaff',
+};
+/** Single spinner-frame source. */
+export const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+//
+// Light variant — inverts the chrome group (and the two accents/state roles
+// with no light-appropriate dark equivalent: state.info/reasoning,
+// accent.brand/gradientStart/gradientEnd) toward dark-on-light legibility.
+// Every other role has no light-specific value yet and is carried over from
+// TONE_TOKENS unchanged (spread below) — this mirrors the TUI's UI_TONES_LIGHT
+// exactly, including which roles it leaves untouched.
+//
+const TONE_TOKENS_LIGHT = {
+    ...TONE_TOKENS,
+    state: {
+        ...TONE_TOKENS.state,
+        info: '#0369a1',
+        reasoning: '#7c3aed',
+    },
+    accent: {
+        ...TONE_TOKENS.accent,
+        brand: '#0077aa',
+        gradientStart: '#0077aa',
+        gradientEnd: '#7c3aed',
+    },
+    chrome: {
+        ...TONE_TOKENS.chrome,
+        label: '#64748b',
+        faint: '#94a3b8',
+        warn: '#b45309',
+        bad: '#dc2626',
+        good: '#15803d',
+        remote: '#6d28d9',
+    },
+};
+Object.freeze(TONE_TOKENS_LIGHT.state);
+Object.freeze(TONE_TOKENS_LIGHT.accent);
+Object.freeze(TONE_TOKENS_LIGHT.chrome);
+Object.freeze(TONE_TOKENS_LIGHT);
+/**
+ * resolveTones — return the tone-token table for the given background mode.
+ * 'dark' returns TONE_TOKENS itself (byte-identical, same object reference) so
+ * a consumer that has not wired mode detection can call resolveTones('dark')
+ * as the safe default with zero behavior change.
+ */
+export function resolveTones(mode) {
+    return mode === 'light' ? TONE_TOKENS_LIGHT : TONE_TOKENS;
+}

package/dist/platform/presentation/waiting-wording.d.ts

@@ -0,0 +1,54 @@
+/**
+ * waiting-wording.ts — the honest waiting-state WORDING contract, extracted
+ * from `goodvibes-tui` src/renderer/ui-factory.ts:554-584 (the phrase-selection
+ * branch inside createThinkingFragment; the companion :522-552
+ * computeStallInfo/computeRenderStallInfo signal computation stays
+ * renderer-local — each renderer has its own stream-metrics shape to derive
+ * a WaitingState from).
+ *
+ * The split this hoists is a DATA/pure-function contract: a renderer decides
+ * WHICH state it is in (from its own approval/stall/reconnect signals, in the
+ * TUI's precedence order — approval beats reconnect beats pre-first-token
+ * beats stalled beats thinking) and calls waitingPhrase(state, ctx) for the
+ * exact wording. Neither renderer should carry its own copy of these five
+ * strings/rotation — that duplication is exactly what the renderer/input parity audit found
+ * (the agent's ui-factory.ts:308-313 was rotating-only, with no honest
+ * stall/reconnect/approval split at all).
+ *
+ * PURE — no fs, no terminal I/O, no timers. Gradient color, spinner glyph,
+ * tok/s and elapsed-time suffixes stay renderer-owned (ui-factory.ts's
+ * createThinkingFragment composes those around the phrase this returns).
+ */
+/**
+ * The five honest waiting states, in the TUI's precedence order:
+ *  - 'approval'         — a card is waiting on the USER; the turn is not
+ *                          stalled and the provider is not at fault.
+ *  - 'reconnecting'     — the transport is retrying after a drop.
+ *  - 'pre-first-token'  — no delta yet this turn; normal for reasoning models
+ *                          that think before emitting (NOT "stalled" — that
+ *                          would wrongly blame the provider for ordinary
+ *                          pre-token latency).
+ *  - 'stalled'          — silence AFTER the stream had already started
+ *                          producing tokens.
+ *  - 'thinking'         — the ordinary case: tokens are flowing at a normal
+ *                          cadence, show a rotating whimsical phrase.
+ */
+export type WaitingState = 'approval' | 'reconnecting' | 'pre-first-token' | 'stalled' | 'thinking';
+/** Inputs waitingPhrase needs for the states that carry numbers. Fields
+ * unused by the selected state are ignored. */
+export interface WaitingPhraseContext {
+    /** 'reconnecting' — the current retry attempt number. */
+    readonly reconnectAttempt?: number;
+    /** 'reconnecting' — the configured maximum retry attempts. */
+    readonly reconnectMaxAttempts?: number;
+    /** 'pre-first-token' / 'stalled' — elapsed silence since the last delta, in ms. */
+    readonly msSinceLastDelta?: number;
+    /** 'thinking' — the render frame counter driving the phrase rotation. */
+    readonly frame?: number;
+}
+/**
+ * waitingPhrase — the state -> wording mapping, golden-matched against the
+ * TUI's ui-factory.ts:554-584 output for identical inputs.
+ */
+export declare function waitingPhrase(state: WaitingState, ctx?: WaitingPhraseContext): string;
+//# sourceMappingURL=waiting-wording.d.ts.map

package/dist/platform/presentation/waiting-wording.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"waiting-wording.d.ts","sourceRoot":"","sources":["../../../src/platform/presentation/waiting-wording.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,cAAc,GAAG,iBAAiB,GAAG,SAAS,GAAG,UAAU,CAAC;AAEpG;+CAC+C;AAC/C,MAAM,WAAW,oBAAoB;IACnC,yDAAyD;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,8DAA8D;IAC9D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,mFAAmF;IACnF,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,GAAE,oBAAyB,GAAG,MAAM,CAqBzF"}

package/dist/platform/presentation/waiting-wording.js

@@ -0,0 +1,51 @@
+/**
+ * waiting-wording.ts — the honest waiting-state WORDING contract, extracted
+ * from `goodvibes-tui` src/renderer/ui-factory.ts:554-584 (the phrase-selection
+ * branch inside createThinkingFragment; the companion :522-552
+ * computeStallInfo/computeRenderStallInfo signal computation stays
+ * renderer-local — each renderer has its own stream-metrics shape to derive
+ * a WaitingState from).
+ *
+ * The split this hoists is a DATA/pure-function contract: a renderer decides
+ * WHICH state it is in (from its own approval/stall/reconnect signals, in the
+ * TUI's precedence order — approval beats reconnect beats pre-first-token
+ * beats stalled beats thinking) and calls waitingPhrase(state, ctx) for the
+ * exact wording. Neither renderer should carry its own copy of these five
+ * strings/rotation — that duplication is exactly what the renderer/input parity audit found
+ * (the agent's ui-factory.ts:308-313 was rotating-only, with no honest
+ * stall/reconnect/approval split at all).
+ *
+ * PURE — no fs, no terminal I/O, no timers. Gradient color, spinner glyph,
+ * tok/s and elapsed-time suffixes stay renderer-owned (ui-factory.ts's
+ * createThinkingFragment composes those around the phrase this returns).
+ */
+import { THINKING_PHRASES } from './thinking-phrases.js';
+/** Frame cadence the 'thinking' rotation advances at (frames tick at 80ms in
+ * the TUI, so ~30s per phrase) — the TUI's PHRASE_ROTATION_FRAMES verbatim. */
+const PHRASE_ROTATION_FRAMES = 375;
+/**
+ * waitingPhrase — the state -> wording mapping, golden-matched against the
+ * TUI's ui-factory.ts:554-584 output for identical inputs.
+ */
+export function waitingPhrase(state, ctx = {}) {
+    switch (state) {
+        case 'approval':
+            // An approval card is waiting on the user — blame-free, precedence over
+            // stall/reconnect framing: waiting on the user is the true state.
+            return 'Waiting for your approval';
+        case 'reconnecting':
+            return `Reconnecting (attempt ${ctx.reconnectAttempt ?? 0}/${ctx.reconnectMaxAttempts ?? 0})...`;
+        case 'pre-first-token':
+            return `Waiting for model ${Math.floor((ctx.msSinceLastDelta ?? 0) / 1000)}s...`;
+        case 'stalled':
+            return `Stalled ${Math.floor((ctx.msSinceLastDelta ?? 0) / 1000)}s...`;
+        case 'thinking': {
+            const frame = ctx.frame ?? 0;
+            const phraseIndex = Math.floor(frame / PHRASE_ROTATION_FRAMES) % THINKING_PHRASES.length;
+            // phraseIndex is always in [0, THINKING_PHRASES.length) — the modulo above
+            // guarantees an in-bounds index; the non-null assertion only satisfies
+            // noUncheckedIndexedAccess and is never actually unsound.
+            return THINKING_PHRASES[phraseIndex];
+        }
+    }
+}

package/dist/platform/providers/runtime-snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-snapshot.d.ts","sourceRoot":"","sources":["../../../src/platform/providers/runtime-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAmB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGvE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;QACvC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QACxC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;IACxD,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/D;AAiED,wBAAsB,4BAA4B,CAChD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,GAAG,eAAe,GAAG,iBAAiB,GAAG,YAAY,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,iBAAiB,CAAC,GAC/K,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAG7C;AAED,wBAAsB,0BAA0B,CAC9C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,GAAG,iBAAiB,GAAG,YAAY,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,iBAAiB,CAAC,EAC9J,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAEzC;AAED,wBAAsB,wBAAwB,CAC5C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,GAAG,iBAAiB,GAAG,YAAY,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,iBAAiB,CAAC,EAC9J,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAiBvC"}
+{"version":3,"file":"runtime-snapshot.d.ts","sourceRoot":"","sources":["../../../src/platform/providers/runtime-snapshot.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,KAAK,EAAmB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAGvE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;QACvC,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;QACxC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAC;IAC1C,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;CACnD;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtD,QAAQ,CAAC,aAAa,EAAE,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;IACxD,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,uBAAuB,CAAC,OAAO,CAAC,CAAC,CAAC;CAC/D;AA0ED,wBAAsB,4BAA4B,CAChD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,GAAG,eAAe,GAAG,iBAAiB,GAAG,YAAY,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,iBAAiB,CAAC,GAC/K,OAAO,CAAC,SAAS,uBAAuB,EAAE,CAAC,CAG7C;AAED,wBAAsB,0BAA0B,CAC9C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,GAAG,iBAAiB,GAAG,YAAY,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,iBAAiB,CAAC,EAC9J,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAEzC;AAED,wBAAsB,wBAAwB,CAC5C,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,eAAe,GAAG,iBAAiB,GAAG,YAAY,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,iBAAiB,CAAC,EAC9J,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAiBvC"}

package/dist/platform/providers/runtime-snapshot.js

@@ -41,14 +41,24 @@ async function buildSnapshotForProvider(providerRegistry, providerId) {
         models: { models: provider.models },
         usage: { streaming: true, toolCalling: true, parallelTools: false },
     };
-    const currentModel = providerRegistry.getCurrentModel();
+    // Read-only display path: never let an unresolved current model (e.g. a fresh
+    // isolated home whose pricing catalog has not hydrated, so the configured
+    // default has no materialized definition) turn this snapshot into a 500. Treat
+    // an unresolvable current model as "no provider is active" rather than throwing.
+    let currentModel;
+    try {
+        currentModel = providerRegistry.getCurrentModel();
+    }
+    catch {
+        currentModel = null;
+    }
     const models = providerRegistry
         .listModels()
         .filter((model) => model.provider === providerId)
         .map((model) => toModelSnapshot(model, providerRegistry));
     return {
         providerId,
-        active: currentModel.provider === providerId,
+        active: currentModel?.provider === providerId,
         modelCount: models.length,
         runtime: resolvedRuntime,
         models,

package/dist/platform/push/delivery.d.ts

@@ -0,0 +1,48 @@
+/**
+ * push/delivery.ts
+ *
+ * The single place a push message is actually encrypted and sent. Every send —
+ * a `push.subscriptions.verify` test, or an approval/completion fan-out — flows
+ * through `deliverToSubscription`, so the honesty rules live in one spot:
+ *
+ *  - A push service that answers 404/410 means the browser subscription is gone;
+ *    the record is pruned and the receipt says `pruned`, never a fake success.
+ *  - Any other non-2xx (or a transport error) is reported as `failed` with the
+ *    status/reason, never swallowed into a success.
+ *  - The request carries the RFC 8188 `Content-Encoding: aes128gcm` body plus
+ *    the `TTL`, `Urgency`, and VAPID `Authorization` headers a push service
+ *    requires.
+ *
+ * The endpoint is whatever the browser registered. In tests that is a local
+ * HTTP sink; in production it is the browser vendor's push service. This module
+ * never contacts a hard-coded external service of its own.
+ */
+import type { VapidManager } from './vapid.js';
+import type { PushSubscriptionStore } from './subscription-store.js';
+import type { PushDeliveryReceipt, PushMessage, StoredPushSubscription } from './types.js';
+/** The `fetch` slice used to POST an encrypted payload. Injectable for tests. */
+export type PushTransport = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: Buffer;
+}) => Promise<{
+    status: number;
+}>;
+export interface DeliveryDeps {
+    readonly vapid: VapidManager;
+    readonly store: PushSubscriptionStore;
+    readonly transport?: PushTransport | undefined;
+}
+/**
+ * Encrypt and send one message to one subscription, prune-on-gone, and return
+ * an honest receipt. The subscription's `lastOutcome` is stamped either way.
+ */
+export declare function deliverToSubscription(subscription: StoredPushSubscription, message: PushMessage, deps: DeliveryDeps): Promise<PushDeliveryReceipt>;
+/**
+ * Fan one message out to every stored subscription, delivering (and pruning) in
+ * sequence. Returns one receipt per subscription — an empty array when there
+ * are no subscriptions at all (the honest "nobody to notify" result, not a
+ * silent success).
+ */
+export declare function deliverToAll(message: PushMessage, deps: DeliveryDeps): Promise<PushDeliveryReceipt[]>;
+//# sourceMappingURL=delivery.d.ts.map

package/dist/platform/push/delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../../../src/platform/push/delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EACV,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAgCjC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CAChD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,sBAAsB,EACpC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,mBAAmB,CAAC,CAyD9B;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAOhC"}

package/dist/platform/push/delivery.js

@@ -0,0 +1,117 @@
+/**
+ * push/delivery.ts
+ *
+ * The single place a push message is actually encrypted and sent. Every send —
+ * a `push.subscriptions.verify` test, or an approval/completion fan-out — flows
+ * through `deliverToSubscription`, so the honesty rules live in one spot:
+ *
+ *  - A push service that answers 404/410 means the browser subscription is gone;
+ *    the record is pruned and the receipt says `pruned`, never a fake success.
+ *  - Any other non-2xx (or a transport error) is reported as `failed` with the
+ *    status/reason, never swallowed into a success.
+ *  - The request carries the RFC 8188 `Content-Encoding: aes128gcm` body plus
+ *    the `TTL`, `Urgency`, and VAPID `Authorization` headers a push service
+ *    requires.
+ *
+ * The endpoint is whatever the browser registered. In tests that is a local
+ * HTTP sink; in production it is the browser vendor's push service. This module
+ * never contacts a hard-coded external service of its own.
+ */
+import { encryptPushPayload } from './encryption.js';
+const DEFAULT_TTL_SECONDS = 24 * 60 * 60;
+const GONE_STATUSES = new Set([404, 410]);
+function defaultTransport() {
+    return async (url, init) => {
+        // Re-wrap over a plain ArrayBuffer so the body matches fetch's BodyInit.
+        const res = await fetch(url, {
+            method: init.method,
+            headers: init.headers,
+            body: new Uint8Array(init.body),
+        });
+        return { status: res.status };
+    };
+}
+function endpointOrigin(endpoint) {
+    try {
+        return new URL(endpoint).origin;
+    }
+    catch {
+        return 'invalid';
+    }
+}
+function messagePlaintext(message) {
+    return Buffer.from(JSON.stringify({ title: message.title, body: message.body, data: message.data ?? {} }), 'utf8');
+}
+/**
+ * Encrypt and send one message to one subscription, prune-on-gone, and return
+ * an honest receipt. The subscription's `lastOutcome` is stamped either way.
+ */
+export async function deliverToSubscription(subscription, message, deps) {
+    const origin = endpointOrigin(subscription.endpoint);
+    const transport = deps.transport ?? defaultTransport();
+    let httpStatus;
+    try {
+        const encrypted = encryptPushPayload(subscription.keys, messagePlaintext(message));
+        const authorization = await deps.vapid.buildAuthorizationHeader(subscription.endpoint);
+        const headers = {
+            'content-encoding': encrypted.contentEncoding,
+            'content-type': 'application/octet-stream',
+            ttl: String(message.ttlSeconds ?? DEFAULT_TTL_SECONDS),
+            urgency: message.urgency ?? 'normal',
+            authorization,
+        };
+        const result = await transport(subscription.endpoint, {
+            method: 'POST',
+            headers,
+            body: encrypted.body,
+        });
+        httpStatus = result.status;
+    }
+    catch (error) {
+        await deps.store.recordOutcome(subscription.id, 'failed');
+        return {
+            subscriptionId: subscription.id,
+            endpointOrigin: origin,
+            outcome: 'failed',
+            detail: `delivery request failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    if (httpStatus >= 200 && httpStatus < 300) {
+        await deps.store.recordOutcome(subscription.id, 'delivered');
+        return { subscriptionId: subscription.id, endpointOrigin: origin, outcome: 'delivered', httpStatus };
+    }
+    if (GONE_STATUSES.has(httpStatus)) {
+        // The subscription is gone at the push service — prune it (delete means
+        // delete) and report the prune with the status that proved it dead.
+        await deps.store.remove(subscription.id);
+        return {
+            subscriptionId: subscription.id,
+            endpointOrigin: origin,
+            outcome: 'pruned',
+            httpStatus,
+            detail: `push endpoint reported ${httpStatus} gone; subscription removed`,
+        };
+    }
+    await deps.store.recordOutcome(subscription.id, 'failed');
+    return {
+        subscriptionId: subscription.id,
+        endpointOrigin: origin,
+        outcome: 'failed',
+        httpStatus,
+        detail: `push service returned ${httpStatus}`,
+    };
+}
+/**
+ * Fan one message out to every stored subscription, delivering (and pruning) in
+ * sequence. Returns one receipt per subscription — an empty array when there
+ * are no subscriptions at all (the honest "nobody to notify" result, not a
+ * silent success).
+ */
+export async function deliverToAll(message, deps) {
+    const subscriptions = await deps.store.all();
+    const receipts = [];
+    for (const subscription of subscriptions) {
+        receipts.push(await deliverToSubscription(subscription, message, deps));
+    }
+    return receipts;
+}

package/dist/platform/push/encryption.d.ts

@@ -0,0 +1,41 @@
+/**
+ * push/encryption.ts
+ *
+ * Browser-push payload encryption, implemented with Node's built-in crypto
+ * (node:crypto) — no third-party web-push dependency. This is the daemon-side
+ * (Node/Bun) delivery path only; nothing here is imported by the runtime-neutral
+ * or browser bundles (see scripts/browser-compat-check.ts).
+ *
+ * Two standards are combined here, exactly as a browser Push service expects:
+ *
+ *  - RFC 8291 (Message Encryption for Web Push): derive a shared secret from an
+ *    ephemeral P-256 keypair and the subscription's public key + auth secret.
+ *  - RFC 8188 (aes128gcm content encoding): expand that secret into a
+ *    content-encryption key + nonce and encrypt one record, then frame it with
+ *    the salt / record-size / sender-public-key header the receiver reads back.
+ *
+ * The output Buffer is the raw request body sent to the subscription endpoint
+ * with `Content-Encoding: aes128gcm`.
+ */
+/** The subscription's own key material, base64url-encoded (browser PushSubscription shape). */
+export interface SubscriptionKeyMaterial {
+    /** The receiver's public key — 65-byte uncompressed P-256 point, base64url. */
+    readonly p256dh: string;
+    /** The receiver's 16-byte authentication secret, base64url. */
+    readonly auth: string;
+}
+export interface EncryptedPushPayload {
+    /** The aes128gcm request body: header || ciphertext || GCM tag. */
+    readonly body: Buffer;
+    /** Always `aes128gcm` — the value for the Content-Encoding request header. */
+    readonly contentEncoding: 'aes128gcm';
+}
+/**
+ * Encrypt `plaintext` for a subscription's key material.
+ *
+ * A fresh ephemeral sender keypair and salt are generated per call (RFC 8291
+ * requires this — the same salt/key pair must never encrypt two messages), so
+ * the result is non-deterministic by design.
+ */
+export declare function encryptPushPayload(keys: SubscriptionKeyMaterial, plaintext: Buffer): EncryptedPushPayload;
+//# sourceMappingURL=encryption.d.ts.map

package/dist/platform/push/encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.d.ts","sourceRoot":"","sources":["../../../src/platform/push/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,+FAA+F;AAC/F,MAAM,WAAW,uBAAuB;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,oBAAoB;IACnC,mEAAmE;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC;CACvC;AAyBD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,uBAAuB,EAC7B,SAAS,EAAE,MAAM,GAChB,oBAAoB,CA2CtB"}