@poetic-ai/poetic 1.42.0

package/dist/chunk-AURFMVCD.js

@@ -0,0 +1,899 @@
+import {
+  resolveProviderReleaseStatus
+} from "./chunk-VBNCKCCI.js";
+import {
+  isSkipAuthEnvActive
+} from "./chunk-4VJITV4P.js";
+import {
+  resolveProviderCliCommand
+} from "./chunk-SURZ2WFE.js";
+import {
+  formatSandboxCapabilityFailure,
+  probeProviderSandboxCapability
+} from "./chunk-5WCQRDRB.js";
+import {
+  formatLinuxHostClassNote,
+  resolveLinuxHostClass
+} from "./chunk-RWREC3KJ.js";
+import {
+  ProviderRegistry
+} from "./chunk-AT4TNPWW.js";
+import {
+  POETIC_SKIP_READINESS_PREFLIGHT,
+  POETIC_STRICT_READINESS,
+  readRawEnv
+} from "./chunk-5DLKYTQX.js";
+
+// src/core/providers/readiness.ts
+import { constants as fsConstants } from "fs";
+import { access } from "fs/promises";
+import path from "path";
+import { execa } from "execa";
+function isProviderSkipAuthActive(config, env) {
+  const skipEnvVar = config.auth?.skip_env_var;
+  if (!skipEnvVar) {
+    return false;
+  }
+  return isSkipAuthEnvActive(skipEnvVar, env);
+}
+function resolveWriteBoundaryAdvisory(env) {
+  try {
+    const resolution = resolveLinuxHostClass(env ? { env } : {});
+    let detail;
+    if (resolution.hostClass === "desktop-unacked") {
+      detail = "Linux desktop write consent is not recorded. Run poetic sandbox trust linux --ack-desktop or poetic sandbox trust linux --host isolated.";
+    } else if (resolution.note) {
+      detail = resolution.note;
+    } else {
+      detail = formatLinuxHostClassNote(resolution) ?? `Host class ${resolution.hostClass} (source=${resolution.source})`;
+    }
+    return {
+      hostClass: resolution.hostClass,
+      source: String(resolution.source),
+      writesAllowed: resolution.writesAllowed,
+      detail
+    };
+  } catch {
+    return void 0;
+  }
+}
+function resolveAuthLabel(readiness) {
+  if (readiness.readinessNote === "env-var-auth-assumed") return "assumed-env";
+  switch (readiness.authenticated) {
+    case "yes":
+      return "authenticated";
+    case "no":
+      return "not-authenticated";
+    default:
+      return "unknown";
+  }
+}
+function resolveNamedReadiness(readiness, dryRun) {
+  const executableAvailable = readiness.installed && readiness.cliHealthy;
+  const configured = typeof readiness.configured === "boolean" ? readiness.configured : readiness.reasonCode !== "provider-not-found" && readiness.reasonCode !== "no-cli-channel" && readiness.known !== false;
+  const lastSuccessfulDryRun = dryRun?.fresh ? dryRun.lastSuccessMs : null;
+  const readyForRun = readiness.readinessNote === "env-var-auth-assumed" ? false : readiness.ready;
+  return {
+    configured,
+    authenticated: resolveAuthLabel(readiness),
+    executableAvailable,
+    lastSuccessfulDryRun,
+    readyForRun
+  };
+}
+function resolveProviderParityLabel(readiness, resolved) {
+  const named = resolved ?? resolveNamedReadiness(readiness);
+  if (!named.configured || !readiness.installed) {
+    return "missing";
+  }
+  if (!readiness.cliHealthy && readiness.reasonCode === "cli-unhealthy") {
+    return "installed-unhealthy";
+  }
+  if (!readiness.cliHealthy && readiness.reasonCode !== "cli-present-unprobed") {
+    return "installed-unhealthy";
+  }
+  if (readiness.readinessNote === "env-var-auth-assumed" || named.authenticated === "assumed-env") {
+    return "env-assumed";
+  }
+  if (readiness.ready && named.readyForRun) {
+    return "verified-ready";
+  }
+  if (readiness.authenticated === "no" || named.authenticated === "not-authenticated") {
+    return "auth-no";
+  }
+  return "auth-unknown";
+}
+function resolveAuthEvidence(readiness) {
+  if (readiness.readinessNote === "env-var-auth-assumed") {
+    return {
+      authEvidence: "assumed-env-var",
+      authDetail: "Auth inferred from a configured env var for setup readiness; execution still verifies provider access."
+    };
+  }
+  if (readiness.authenticated === "yes") {
+    return {
+      authEvidence: "provider-reported",
+      authDetail: "Provider readiness reported authentication available."
+    };
+  }
+  if (readiness.authenticated === "no") {
+    return {
+      authEvidence: "reported-missing",
+      authDetail: readiness.reason ?? "Provider readiness reported authentication missing."
+    };
+  }
+  if (readiness.warning?.includes("active auth probe")) {
+    return {
+      authEvidence: "active-unverified",
+      authDetail: readiness.warning ?? "Active auth probe could not verify headless execution; this is not a confirmed credential failure."
+    };
+  }
+  if (readiness.warning || readiness.reason?.includes("Authentication status unknown")) {
+    return {
+      authEvidence: "passive-unknown",
+      authDetail: readiness.warning ?? readiness.reason ?? "Passive readiness could not verify provider-owned authentication state."
+    };
+  }
+  return {
+    authEvidence: "not-collected",
+    authDetail: "Authentication status was not collected for this diagnostic."
+  };
+}
+function classifyProviderReadiness(readiness, resolved) {
+  const auth = resolveAuthEvidence(readiness);
+  const named = resolved ?? resolveNamedReadiness(readiness);
+  if (!named.configured || !readiness.installed) {
+    return {
+      readinessStatus: "unavailable",
+      readinessStatusDetail: readiness.reason ?? "CLI is not installed.",
+      ...auth
+    };
+  }
+  if (!readiness.cliHealthy && readiness.reasonCode !== "cli-present-unprobed") {
+    return {
+      readinessStatus: "broken",
+      readinessStatusDetail: readiness.reason ?? "CLI is installed but failed health probes.",
+      ...auth
+    };
+  }
+  if (readiness.sandboxCapable === false) {
+    const sandboxDetail = readiness.sandboxReason ?? readiness.reason ?? "Execute-tier sandbox/policy probe blocked provider state access.";
+    return {
+      readinessStatus: "installed-but-unverified",
+      readinessStatusDetail: `Readiness caveat: ${sandboxDetail} This is not a broken CLI or confirmed auth failure.`,
+      ...auth
+    };
+  }
+  if (readiness.readinessNote === "env-var-auth-assumed") {
+    return {
+      readinessStatus: "installed-but-unverified",
+      readinessStatusDetail: "CLI is installed and setup readiness is assumed from configured env auth; execution still verifies provider access.",
+      ...auth
+    };
+  }
+  if (readiness.sandboxCapable === true && readiness.authenticated === "no") {
+    return {
+      readinessStatus: "contained-auth-needed",
+      readinessStatusDetail: "CLI is contained and healthy, but authentication is missing.",
+      ...auth
+    };
+  }
+  if (readiness.sandboxCapable === true && readiness.ready) {
+    return {
+      readinessStatus: "contained-ready",
+      readinessStatusDetail: "CLI, auth, and execute-tier containment checks are ready.",
+      ...auth
+    };
+  }
+  if (readiness.authenticated === "no" || resolved?.authenticated === "not-authenticated") {
+    return {
+      readinessStatus: "normal-auth-needed",
+      readinessStatusDetail: "CLI is installed and healthy, but authentication is missing.",
+      ...auth
+    };
+  }
+  if (readiness.ready || resolved?.readyForRun) {
+    return {
+      readinessStatus: "normal-auth-ready",
+      readinessStatusDetail: "CLI is installed and auth readiness evidence is present.",
+      ...auth
+    };
+  }
+  return {
+    readinessStatus: "installed-but-unverified",
+    readinessStatusDetail: readiness.reason ?? "CLI is installed and healthy, but auth or execution readiness is not verified.",
+    ...auth
+  };
+}
+var SETUP_CHECK_READINESS_OPTIONS = {
+  mode: "setup",
+  sandboxProbeMode: "execute"
+};
+function resolveReadinessScopeLabel(readiness, resolved) {
+  if (!readiness.installed) return "unknown";
+  if (!readiness.cliHealthy && readiness.reasonCode !== "cli-present-unprobed") {
+    return "degraded";
+  }
+  if (readiness.sandboxCapable === false) return "degraded";
+  if (readiness.readinessNote === "env-var-auth-assumed") return "assumed";
+  if (readiness.ready && readiness.readinessNote !== "env-var-auth-assumed" || resolved?.readyForRun) {
+    return "execute-ready";
+  }
+  if (readiness.authenticated === "yes" || resolved?.authenticated === "authenticated") {
+    return "authenticated";
+  }
+  if (readiness.authenticated === "no" || resolved?.authenticated === "not-authenticated") {
+    return "auth-needed";
+  }
+  if (readiness.installed) return "installed";
+  return "unknown";
+}
+function resolveReadinessScope(readiness, resolved) {
+  const label = resolveReadinessScopeLabel(readiness, resolved);
+  switch (label) {
+    case "unknown":
+      if (!readiness.installed) {
+        return { label, detail: "CLI not installed" };
+      }
+      if (readiness.authenticated === "no" || resolved?.authenticated === "not-authenticated") {
+        return { label, detail: "Authentication not configured" };
+      }
+      return {
+        label,
+        detail: "Auth status not verified at this diagnostic scope"
+      };
+    case "degraded":
+      if (!readiness.cliHealthy) {
+        return { label, detail: readiness.reason ?? "CLI not healthy" };
+      }
+      if (readiness.sandboxCapable === false) {
+        const sandboxDetail = readiness.sandboxReason ?? readiness.reason ?? "execute-tier sandbox/policy blocked provider state access";
+        return {
+          label,
+          detail: `Readiness caveat: ${sandboxDetail}`
+        };
+      }
+      return { label, detail: readiness.reason ?? "Provider degraded" };
+    case "assumed":
+      return {
+        label,
+        detail: "Assumed from configured env var for setup only; execution still verifies provider access"
+      };
+    case "auth-needed":
+      return { label, detail: "Authentication not configured" };
+    case "installed":
+      return {
+        label,
+        detail: "CLI installed; auth not verified by passive setup-tier checks"
+      };
+    case "authenticated":
+      return { label, detail: "Authenticated; execute-tier checks incomplete" };
+    case "execute-ready":
+      return { label };
+  }
+}
+function readinessProbeContextForOptions(options = {}) {
+  const modeProbes = options.mode ? readinessProbesForMode(options.mode) : void 0;
+  const cliProbeMode = options.cliProbeMode ?? modeProbes?.cliProbeMode ?? "execute";
+  const authProbeMode = options.probeAuth !== void 0 ? "deferred" : options.authProbeMode ?? modeProbes?.authProbeMode ?? "passive";
+  return {
+    mode: options.mode ?? "execute",
+    cliProbeMode,
+    authProbeMode,
+    sandboxProbeMode: options.sandboxProbeMode ?? (options.mode === "setup" ? "none" : "execute")
+  };
+}
+var EXECUTE_CLI_PROBE_OPTIONS = {
+  timeoutMs: 15e3,
+  retries: 1
+};
+function readinessProbesForMode(mode) {
+  switch (mode) {
+    case "setup":
+      return { cliProbeMode: "execute", authProbeMode: "passive" };
+    case "execute":
+      return { cliProbeMode: "execute", authProbeMode: "passive" };
+  }
+}
+function formatAuthReadinessReason(displayName, authenticated, authProbeMode, authNote) {
+  if (authenticated === "yes") return void 0;
+  if (authenticated === "no") {
+    return authNote ? `Authentication missing. ${authNote}` : "Authentication missing";
+  }
+  if (authProbeMode === "active") {
+    const detail = authNote ? ` Detail: ${authNote}` : "";
+    return `${displayName} active auth probe could not verify headless execution; this is not a confirmed credential failure. Check provider runtime, sandbox, and CLI diagnostics.${detail}`;
+  }
+  return "Authentication status unknown; runtime will defer to the provider CLI.";
+}
+var ProviderNotReadyError = class extends Error {
+  provider;
+  readiness;
+  constructor(readiness, message = formatProviderNotReadyMessage(readiness)) {
+    super(message);
+    this.name = "ProviderNotReadyError";
+    this.provider = readiness.provider;
+    this.readiness = readiness;
+  }
+};
+var DEFAULT_CLI_PROBE_ARGS = [
+  ["--version"],
+  ["-v"],
+  ["--help"]
+];
+var CLI_PRESENT_PATTERNS = [
+  /unknown (flag|option|argument)/i,
+  /unrecognized (flag|option|argument)/i,
+  /invalid (flag|option|argument)/i,
+  /no such option/i
+];
+async function pathIsExecutable(filePath) {
+  try {
+    await access(filePath, fsConstants.X_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function pathEntries() {
+  return (process.env.PATH ?? "").split(path.delimiter).map((entry) => entry.trim()).filter(Boolean);
+}
+function providerSupportsCli(config) {
+  if (config.id === "openrouter") return false;
+  if (!config.cli?.command || config.cli.command === "N/A") return false;
+  if (!Array.isArray(config.channels)) return true;
+  return config.channels.includes("cli");
+}
+async function probeProviderCliOnce(command, preferredArgs, prefixArgs, timeoutMs) {
+  const probeArgs = [
+    ...preferredArgs && preferredArgs.length > 0 ? [Array.from(preferredArgs)] : [],
+    ...DEFAULT_CLI_PROBE_ARGS
+  ];
+  let lastErrorMessage;
+  let sawUnknownFlag = false;
+  for (const args of probeArgs) {
+    try {
+      await execa(command, [...prefixArgs ?? [], ...args], {
+        timeout: timeoutMs
+      });
+      return { present: true, healthy: true, healthProbed: true };
+    } catch (error) {
+      const err = error;
+      const message = err?.message ?? "";
+      const stderr = err?.stderr ?? "";
+      const combined = `${message}
+${stderr}`;
+      const isNotFound = err?.code === "ENOENT" || /spawn .* ENOENT/i.test(message) || /\bENOENT\b/i.test(message) || /command not found/i.test(combined) || /is not recognized as an internal or external command/i.test(combined);
+      if (isNotFound) {
+        return { present: false, healthy: false, healthProbed: true };
+      }
+      if (CLI_PRESENT_PATTERNS.some((pattern) => pattern.test(combined))) {
+        sawUnknownFlag = true;
+        continue;
+      }
+      lastErrorMessage = (stderr || message).trim() || lastErrorMessage;
+    }
+  }
+  return {
+    present: true,
+    healthy: false,
+    healthProbed: true,
+    degradedReason: lastErrorMessage ?? (sawUnknownFlag ? "CLI found but did not accept version/help probes" : "CLI found but failed to respond to version/help probes")
+  };
+}
+async function probeProviderCli(command, preferredArgs, prefixArgs, options = {}) {
+  const timeoutMs = options.timeoutMs ?? 5e3;
+  const maxAttempts = (options.retries ?? 0) + 1;
+  let lastResult = { present: false, healthy: false };
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    lastResult = await probeProviderCliOnce(command, preferredArgs, prefixArgs, timeoutMs);
+    if (lastResult.present && lastResult.healthy) {
+      return lastResult;
+    }
+    if (!lastResult.present) {
+      return lastResult;
+    }
+  }
+  return lastResult;
+}
+async function probeProviderCliPresence(command, prefixArgs) {
+  if (prefixArgs && prefixArgs.length > 0) {
+    return probeProviderCli(command, ["--version"], prefixArgs);
+  }
+  if (path.isAbsolute(command) || command.includes(path.sep)) {
+    return await pathIsExecutable(command) ? { present: true, healthy: false, healthProbed: false } : { present: false, healthy: false, healthProbed: false };
+  }
+  for (const entry of pathEntries()) {
+    const candidate = path.join(entry, command);
+    if (await pathIsExecutable(candidate)) {
+      return { present: true, healthy: false, healthProbed: false };
+    }
+  }
+  return { present: false, healthy: false, healthProbed: false };
+}
+var NATIVE_PROVIDER_AUTH_IDS = /* @__PURE__ */ new Set([
+  "claude",
+  "codex",
+  "cursor",
+  "gemini",
+  "grok",
+  "copilot",
+  "opencode",
+  "kiro",
+  "antigravity",
+  "pi"
+]);
+function isSetupTierReadiness(options) {
+  if (options.mode === "setup") return true;
+  if (options.mode === "execute") return false;
+  return options.cliProbeMode === "presence" && options.authProbeMode !== "active";
+}
+function readConfiguredEnvValue(env, key) {
+  return env ? env[key] : process.env[key];
+}
+function hasConfiguredEnvVarAuth(config, env) {
+  const envVars = config.auth?.env_vars ?? [];
+  return envVars.some((key) => {
+    const value = readConfiguredEnvValue(env, key);
+    return typeof value === "string" && value.trim().length > 0;
+  });
+}
+function resolveEnvVarAuthReadinessPromotion(_providerId, config, authenticated, sandboxBlocked, options) {
+  if (authenticated !== "unknown" || sandboxBlocked) return void 0;
+  if (readRawEnv(POETIC_STRICT_READINESS) === "1") return void 0;
+  if (!hasConfiguredEnvVarAuth(config, options.authProbeEnv)) return void 0;
+  return "env-var-auth-assumed";
+}
+function normalizePassiveAuthForEnvVarPromotion(providerId, config, authenticated, authProbeMode, options) {
+  if (!isSetupTierReadiness(options)) return authenticated;
+  if (authenticated !== "no") return authenticated;
+  if (authProbeMode === "active") return authenticated;
+  if (providerId !== "opencode") return authenticated;
+  if (!hasConfiguredEnvVarAuth(config, options.authProbeEnv)) return authenticated;
+  return "unknown";
+}
+function shouldProbeSandboxCapability(executeTier, options) {
+  if (options.sandboxProbeMode === "none") return false;
+  if (options.probeSandboxCapability) return true;
+  if (options.sandboxProbeMode === "execute") {
+    const runningUnderVitest2 = Boolean(process.env.VITEST || process.env.VITEST_WORKER_ID) || process.env.NODE_ENV === "test";
+    return !runningUnderVitest2;
+  }
+  if (!executeTier) return false;
+  const runningUnderVitest = Boolean(process.env.VITEST || process.env.VITEST_WORKER_ID) || process.env.NODE_ENV === "test";
+  return !runningUnderVitest;
+}
+async function probeProviderAuthReadinessPassive(providerId, config, env) {
+  if (isProviderSkipAuthActive(config, env)) return "yes";
+  if (NATIVE_PROVIDER_AUTH_IDS.has(providerId)) {
+    const { invokeProviderAuthState } = await import("./invoke-provider-auth-GRUYP44M.js");
+    return invokeProviderAuthState(providerId, env ? { mode: "passive", env } : "passive");
+  }
+  return "unknown";
+}
+async function probeProviderAuthReadiness(providerId, config, options = {}) {
+  return (await probeProviderAuthReadinessDetailed(providerId, config, options)).state;
+}
+async function probeProviderAuthReadinessDetailed(providerId, config, options = {}) {
+  const providerConfig = config ?? ProviderRegistry.getProviderConfig(providerId);
+  const mode = options.mode ?? "passive";
+  if (mode === "passive") {
+    return {
+      state: await probeProviderAuthReadinessPassive(providerId, providerConfig, options.env)
+    };
+  }
+  if (isProviderSkipAuthActive(providerConfig, options.env)) return { state: "yes" };
+  if (NATIVE_PROVIDER_AUTH_IDS.has(providerId)) {
+    const { invokeProviderAuthReadiness } = await import("./invoke-provider-auth-GRUYP44M.js");
+    try {
+      return await invokeProviderAuthReadiness(
+        providerId,
+        options.env ? { mode: "active", env: options.env } : "active"
+      );
+    } catch {
+      return { state: "unknown" };
+    }
+  }
+  return { state: "unknown" };
+}
+async function getProviderReadiness(providerId, options = {}) {
+  let config;
+  try {
+    config = options.providers?.find((provider) => provider.id === providerId) ?? ProviderRegistry.getProviderConfig(providerId);
+  } catch (error) {
+    return {
+      provider: providerId,
+      displayName: providerId,
+      known: false,
+      configured: false,
+      installed: false,
+      cliHealthy: false,
+      authenticated: "unknown",
+      ready: false,
+      order: 99,
+      reasonCode: "provider-not-found",
+      reason: error instanceof Error ? error.message : "Provider not found"
+    };
+  }
+  const installCommand = config.cli?.install_command;
+  const normalizedProviderId = config.id ?? providerId;
+  const displayName = config.display_name ?? normalizedProviderId;
+  const order = config.order ?? 99;
+  const experimental = resolveProviderReleaseStatus(config) === "experimental";
+  if (!providerSupportsCli(config)) {
+    return {
+      provider: normalizedProviderId,
+      displayName,
+      known: true,
+      configured: false,
+      installed: false,
+      cliHealthy: false,
+      authenticated: "unknown",
+      ready: false,
+      installCommand,
+      authCommand: config.auth?.note,
+      order,
+      reasonCode: "no-cli-channel",
+      reason: "Provider does not expose a local CLI execution channel"
+    };
+  }
+  let cli;
+  try {
+    cli = (options.resolveCliCommand ?? resolveProviderCliCommand)(normalizedProviderId);
+  } catch (error) {
+    return {
+      provider: normalizedProviderId,
+      displayName,
+      known: true,
+      configured: true,
+      installed: false,
+      cliHealthy: false,
+      authenticated: "unknown",
+      ready: false,
+      installCommand,
+      authCommand: config.auth?.note,
+      order,
+      reasonCode: "cli-resolve-failed",
+      reason: error instanceof Error ? error.message : "Provider CLI could not be resolved"
+    };
+  }
+  const modeProbes = options.mode ? readinessProbesForMode(options.mode) : void 0;
+  const cliProbeMode = options.cliProbeMode ?? modeProbes?.cliProbeMode;
+  const authProbeMode = options.authProbeMode ?? modeProbes?.authProbeMode;
+  const executeTier = options.mode === "execute" || options.mode === void 0 && cliProbeMode === "execute";
+  const healthProbeRequested = cliProbeMode === "execute";
+  const setupTier = isSetupTierReadiness(options);
+  const probe = options.probeCli !== void 0 ? await options.probeCli(cli.command, ["--version"], cli.prefixArgs) : cliProbeMode === "presence" ? await probeProviderCliPresence(cli.command, cli.prefixArgs) : await probeProviderCli(
+    cli.command,
+    ["--version"],
+    cli.prefixArgs,
+    healthProbeRequested ? EXECUTE_CLI_PROBE_OPTIONS : void 0
+  );
+  if (!probe.present) {
+    return {
+      provider: normalizedProviderId,
+      displayName,
+      known: true,
+      configured: true,
+      installed: false,
+      cliHealthy: false,
+      authenticated: "unknown",
+      ready: false,
+      command: cli.command,
+      prefixArgs: cli.prefixArgs,
+      installCommand,
+      authCommand: config.auth?.note,
+      order,
+      reasonCode: "cli-not-installed",
+      reason: "CLI is not installed"
+    };
+  }
+  const healthProbed = probe.healthProbed === true || probe.healthy === true;
+  const presenceOnly = cliProbeMode === "presence" && !healthProbed && !probe.healthy;
+  if (!probe.healthy && !presenceOnly) {
+    return {
+      provider: normalizedProviderId,
+      displayName,
+      known: true,
+      configured: true,
+      installed: true,
+      cliHealthy: false,
+      authenticated: "unknown",
+      ready: false,
+      command: cli.command,
+      prefixArgs: cli.prefixArgs,
+      installCommand,
+      authCommand: config.auth?.note,
+      order,
+      reasonCode: "cli-unhealthy",
+      reason: probe.degradedReason ?? "CLI found but failed health probes"
+    };
+  }
+  const cliHealthy = probe.healthy;
+  const presentUnprobed = presenceOnly;
+  const sandboxCapability = shouldProbeSandboxCapability(executeTier, options) ? options.probeSandboxCapability ? options.probeSandboxCapability(normalizedProviderId) : probeProviderSandboxCapability(normalizedProviderId, {
+    env: options.authProbeEnv
+  }) : void 0;
+  const sandboxCapable = sandboxCapability?.capable;
+  const sandboxReason = sandboxCapability && !sandboxCapability.capable ? formatSandboxCapabilityFailure(sandboxCapability) : void 0;
+  const sandboxBlocked = sandboxCapable === false;
+  const sandboxDeniedPaths = sandboxCapability?.missing.map((entry) => entry.path);
+  const writeBoundary = resolveWriteBoundaryAdvisory(options.authProbeEnv);
+  if (sandboxBlocked) {
+    return {
+      provider: normalizedProviderId,
+      displayName,
+      known: true,
+      configured: true,
+      installed: true,
+      // Presence-only leaves health unverified; execute probes that reached here were healthy.
+      cliHealthy: !presentUnprobed,
+      authenticated: "unknown",
+      sandboxCapable,
+      ...sandboxReason ? { sandboxReason } : {},
+      ...sandboxDeniedPaths && sandboxDeniedPaths.length > 0 ? { sandboxDeniedPaths } : {},
+      ...writeBoundary ? { writeBoundary } : {},
+      ready: false,
+      command: cli.command,
+      prefixArgs: cli.prefixArgs,
+      installCommand,
+      authCommand: config.auth?.note,
+      order,
+      reasonCode: "sandbox-blocked",
+      reason: sandboxReason
+    };
+  }
+  const injectedAuthProbe = options.probeAuth;
+  const authReadiness = injectedAuthProbe ? { state: await injectedAuthProbe(normalizedProviderId, config) } : await probeProviderAuthReadinessDetailed(normalizedProviderId, config, {
+    mode: authProbeMode ?? "passive",
+    ...options.authProbeEnv ? { env: options.authProbeEnv } : {}
+  });
+  const rawAuthenticated = authReadiness.state;
+  const normalizedAuthenticated = injectedAuthProbe ? rawAuthenticated : normalizePassiveAuthForEnvVarPromotion(
+    normalizedProviderId,
+    config,
+    rawAuthenticated,
+    authProbeMode,
+    options
+  );
+  const unverifiedEnvAuth = !injectedAuthProbe && authReadiness.evidence !== "execution" && !isProviderSkipAuthActive(config, options.authProbeEnv) && hasConfiguredEnvVarAuth(config, options.authProbeEnv);
+  const authenticated = unverifiedEnvAuth && !(authProbeMode === "active" && normalizedAuthenticated === "no") ? "unknown" : normalizedAuthenticated;
+  const readinessNote = resolveEnvVarAuthReadinessPromotion(
+    normalizedProviderId,
+    config,
+    authenticated,
+    sandboxBlocked,
+    options
+  );
+  const ready = readinessNote !== void 0 ? setupTier && cliHealthy : authenticated === "yes" && !sandboxBlocked && (cliHealthy || !presentUnprobed);
+  const attemptEligible = executeTier && !sandboxBlocked && (authenticated === "unknown" || readinessNote !== void 0) && authenticated !== "no";
+  const authReason = formatAuthReadinessReason(
+    displayName,
+    authenticated,
+    authProbeMode,
+    authReadiness.reason ?? config.auth?.note
+  );
+  const authWarning = authenticated === "unknown" ? authProbeMode === "active" ? `${displayName} active auth probe could not verify headless execution; runtime may still fail in the provider CLI.${authReadiness.reason ? ` Detail: ${authReadiness.reason}` : ""}` : "Auth status was not collected by passive readiness checks; runtime will defer to the provider CLI." : void 0;
+  const reasonCode = (() => {
+    if (ready && readinessNote === void 0) return "ready";
+    if (readinessNote !== void 0) return "env-var-auth-assumed";
+    if (authenticated === "no") return "auth-missing";
+    if (authProbeMode === "active" && authenticated === "unknown") {
+      return "auth-active-unverified";
+    }
+    if (authenticated === "unknown") return "auth-unknown";
+    if (presentUnprobed) return "cli-present-unprobed";
+    return "ready";
+  })();
+  return {
+    provider: normalizedProviderId,
+    displayName,
+    known: true,
+    configured: true,
+    installed: true,
+    cliHealthy,
+    authenticated,
+    ...sandboxCapable !== void 0 ? { sandboxCapable } : {},
+    ...sandboxReason ? { sandboxReason } : {},
+    ...writeBoundary ? { writeBoundary } : {},
+    ready,
+    ...readinessNote ? { readinessNote } : {},
+    ...attemptEligible ? { attemptEligible: true } : {},
+    ...experimental ? { experimental: true } : {},
+    command: cli.command,
+    prefixArgs: cli.prefixArgs,
+    installCommand,
+    authCommand: config.auth?.note,
+    order,
+    reasonCode,
+    reason: ready && readinessNote === void 0 ? void 0 : readinessNote ? "Auth assumed from configured env var; not verified for execute-tier readiness." : authReason,
+    warning: authWarning
+  };
+}
+async function getAllProviderReadiness(options = {}) {
+  const providers = (options.providers ?? ProviderRegistry.getEnabledProviders()).filter(
+    providerSupportsCli
+  );
+  const results = await Promise.all(
+    providers.map((provider) => getProviderReadiness(provider.id, { ...options, providers }))
+  );
+  return results.sort((a, b) => a.order - b.order);
+}
+function selectReadyProvider(readiness) {
+  const ready = readiness.filter((provider) => provider.ready).sort((a, b) => a.order - b.order);
+  if (ready.length === 0) {
+    return { kind: "none", candidates: readiness };
+  }
+  const stable = ready.filter((provider) => !provider.experimental);
+  const candidates = stable.length > 0 ? stable : ready;
+  if (candidates.length === 1 && candidates[0]) {
+    return { kind: "single", provider: candidates[0], candidates };
+  }
+  return { kind: "multiple", candidates };
+}
+function formatProviderSetupGuidance(readiness) {
+  const lines = ["No ready AI provider CLI found.", "", "Install or authenticate one provider:"];
+  const candidates = readiness.length > 0 ? readiness : [];
+  for (const provider of candidates) {
+    const action = provider.installed ? provider.authCommand ?? `Authenticate ${provider.displayName}` : provider.installCommand ?? `Install ${provider.displayName}`;
+    lines.push(`  ${provider.displayName}: ${action}`);
+  }
+  lines.push("", "Run poetic provider list after setup completes.");
+  return lines.join("\n");
+}
+function formatProviderNotReadyMessage(readiness, options = {}) {
+  if (readiness.sandboxCapable === false) {
+    const roleSuffix = options.role ? ` (${options.role})` : "";
+    const deniedPaths = readiness.sandboxDeniedPaths?.join(", ");
+    const pathLine = deniedPaths ? `Denied path(s): ${deniedPaths}.` : void 0;
+    const reason2 = readiness.sandboxReason ?? readiness.reason ?? "Required state paths are not writable.";
+    return [
+      `${readiness.displayName}${roleSuffix} is blocked by sandbox/policy access, not an auth failure.`,
+      pathLine,
+      reason2,
+      "Action: grant write access to the denied path(s) in the effective sandbox, or run outside the inherited sandbox.",
+      `Run poetic doctor --provider ${readiness.provider} for execute-tier diagnostics.`
+    ].filter((line) => Boolean(line)).join("\n");
+  }
+  const reason = readiness.reason ?? "provider is not ready";
+  const action = readiness.installed ? readiness.authCommand ?? `Authenticate ${readiness.displayName}` : readiness.installCommand ?? `Install ${readiness.displayName}`;
+  return [
+    `Configured provider ${readiness.displayName} is not ready: ${reason}.`,
+    `Action: ${action}`,
+    "Run poetic provider list after setup completes."
+  ].join("\n");
+}
+function isSandboxOnlyReadinessBlock(readiness) {
+  return readiness.sandboxCapable === false && readiness.installed === true && readiness.cliHealthy === true && readiness.authenticated !== "no";
+}
+function shouldBlockOnProviderReadiness(readiness) {
+  if (readiness.ready) {
+    return false;
+  }
+  if (readiness.attemptEligible) {
+    return false;
+  }
+  return true;
+}
+async function assertProviderReady(providerId, options = {}) {
+  if (readRawEnv(POETIC_SKIP_READINESS_PREFLIGHT) === "1") {
+    return getProviderReadiness(providerId, {
+      mode: options.mode ?? "execute",
+      probeAuth: async () => "unknown"
+    });
+  }
+  const readiness = await getProviderReadiness(providerId, {
+    mode: options.mode ?? "execute",
+    probeAuth: async () => "unknown"
+  });
+  if (shouldBlockOnProviderReadiness(readiness)) {
+    throw new ProviderNotReadyError(readiness);
+  }
+  return readiness;
+}
+function isGateReadyProvider(readiness) {
+  if (readiness.ready) return true;
+  return readiness.cliHealthy && readiness.readinessNote === "env-var-auth-assumed";
+}
+function buildRemediation(readiness) {
+  if (isGateReadyProvider(readiness)) return void 0;
+  if (!readiness.configured || !readiness.known) {
+    return `${readiness.displayName}: provider is not configured for local CLI use`;
+  }
+  if (!readiness.installed) {
+    return readiness.installCommand ? `${readiness.displayName}: install with \`${readiness.installCommand}\`` : `${readiness.displayName}: install the provider CLI`;
+  }
+  if (!readiness.cliHealthy && readiness.reasonCode === "cli-unhealthy") {
+    return `${readiness.displayName}: CLI is installed but unhealthy${readiness.reason ? ` (${readiness.reason})` : ""}`;
+  }
+  if (readiness.authenticated === "no") {
+    return readiness.authCommand ? `${readiness.displayName}: authenticate with \`${readiness.authCommand}\`` : `${readiness.displayName}: authenticate the provider CLI`;
+  }
+  if (readiness.authenticated === "unknown") {
+    return `${readiness.displayName}: auth not verified; run \`poetic doctor --probe --provider ${readiness.provider}\` or \`poetic provider setup\``;
+  }
+  return readiness.reason ? `${readiness.displayName}: ${readiness.reason}` : `${readiness.displayName}: not ready`;
+}
+function toSnapshot(readiness, dryRun) {
+  const resolved = resolveNamedReadiness(readiness, dryRun);
+  const classification = classifyProviderReadiness(readiness, resolved);
+  const scope = resolveReadinessScope(readiness, resolved);
+  return {
+    readiness,
+    resolved,
+    classification,
+    scope,
+    parityLabel: resolveProviderParityLabel(readiness, resolved)
+  };
+}
+async function collectProviderReadinessGate(options = {}) {
+  const baseOptions = options.readinessOptions ?? {
+    mode: "setup",
+    sandboxProbeMode: "none"
+  };
+  let readinessList = await getAllProviderReadiness(baseOptions);
+  if (options.activeAuthWhenNeeded) {
+    readinessList = await Promise.all(
+      readinessList.map(async (entry) => {
+        if (isGateReadyProvider(entry)) return entry;
+        if (!entry.installed) return entry;
+        if (entry.authenticated === "no") return entry;
+        return getProviderReadiness(entry.provider, {
+          ...baseOptions,
+          mode: baseOptions.mode ?? "execute",
+          authProbeMode: "active",
+          cliProbeMode: baseOptions.cliProbeMode ?? "execute",
+          providers: baseOptions.providers,
+          resolveCliCommand: baseOptions.resolveCliCommand,
+          probeCli: baseOptions.probeCli,
+          authProbeEnv: baseOptions.authProbeEnv,
+          probeSandboxCapability: baseOptions.probeSandboxCapability,
+          sandboxProbeMode: baseOptions.sandboxProbeMode
+        });
+      })
+    );
+  }
+  const providers = readinessList.map(
+    (entry) => toSnapshot(entry, options.dryRunForProvider?.(entry.provider))
+  );
+  const readyProviders = providers.filter((entry) => isGateReadyProvider(entry.readiness)).map((entry) => entry.readiness.provider);
+  const readyCount = readyProviders.length;
+  const gateLabel = readyCount === 0 ? "zero-ready" : readyCount === 1 ? "one-ready" : "multi-ready";
+  const requireAtLeastOneReady = options.requireAtLeastOneReady === true;
+  const gatePassed = !requireAtLeastOneReady || readyCount > 0;
+  const remediations = providers.map((entry) => buildRemediation(entry.readiness)).filter((line) => Boolean(line));
+  return {
+    providers,
+    readyCount,
+    readyProviders,
+    gatePassed,
+    gateLabel,
+    remediations
+  };
+}
+
+export {
+  resolveNamedReadiness,
+  resolveProviderParityLabel,
+  classifyProviderReadiness,
+  SETUP_CHECK_READINESS_OPTIONS,
+  resolveReadinessScope,
+  readinessProbeContextForOptions,
+  EXECUTE_CLI_PROBE_OPTIONS,
+  readinessProbesForMode,
+  ProviderNotReadyError,
+  probeProviderCli,
+  probeProviderCliPresence,
+  probeProviderAuthReadiness,
+  getProviderReadiness,
+  getAllProviderReadiness,
+  selectReadyProvider,
+  formatProviderSetupGuidance,
+  formatProviderNotReadyMessage,
+  isSandboxOnlyReadinessBlock,
+  shouldBlockOnProviderReadiness,
+  assertProviderReady,
+  isGateReadyProvider,
+  collectProviderReadinessGate
+};
+//# sourceMappingURL=chunk-AURFMVCD.js.map