@promptctl/cc-candybar 1.42.1 → 1.43.0

package/src/render/active-segment.ts

@@ -1,78 +0,0 @@
-// The one record describing the segment a template is being evaluated for.
-//
-// [LAW:one-source-of-truth] Several template features need to know something
-// about the enclosing segment — `{{ menu }}` derives its identity from the
-// segment's name, `{{ color }}` must read the segment's own (transposed)
-// palette, `{{ bgOf }}` must read the segment's own resolved background. Each
-// of those could have carried its own published "current segment" pointer, and
-// then two features could disagree about which segment is current. One record,
-// one publisher, one clock.
-//
-// [LAW:no-ambient-temporal-coupling] This is *published state*, not ambient
-// context: the render walk sets it before evaluating a segment's templates and
-// clears it after, and nothing else writes it. The phase structure within a
-// segment is likewise state rather than luck — `bg` is genuinely undefined
-// while the `bg:` template is itself being evaluated, because at that moment
-// the background is the thing being computed. Readers get a message naming the
-// phase instead of a plausible-looking wrong color.
-
-import type { ColorRgba, Palette } from "@promptctl/rich-js";
-
-export interface ActiveSegment {
-  /** The segment's declared name — `{{ menu }}` derives its identity from it. */
-  readonly segName: string;
-  /**
-   * The palette this segment's colors resolve from: the base theme (session
-   * choice over config default, or an explicit per-segment `palette:` pin)
-   * after the render's look and this segment's hue shift.
-   *
-   * Template bodies read colors through THIS, not through a palette captured
-   * when the config was loaded — otherwise `{{ color "primary" }}` inside a
-   * segment paints from a different palette than the cell it sits in.
-   */
-  readonly palette: Palette;
-  /**
-   * The segment's resolved background, once known.
-   *
-   * Undefined during evaluation of the segment's own `bg:` template — the
-   * ordering is bg, then fg, then body, and a background cannot be an input to
-   * computing itself.
-   */
-  bg: ColorRgba | undefined;
-}
-
-/** The published pointer. Null between segments. */
-export interface ActiveSegmentRef {
-  current: ActiveSegment | null;
-}
-
-export function createActiveSegmentRef(): ActiveSegmentRef {
-  return { current: null };
-}
-
-/**
- * Read the active segment, or fail with a message that says *why* nothing is
- * active rather than what is missing.
- *
- * [LAW:no-defensive-null-guards] Null here is never a state to route around —
- * it means a segment-scoped template function fired outside a segment render,
- * which is either a wiring bug or an author using the function somewhere it
- * cannot mean anything (a variable template, a node `when`). Both need to be
- * seen, and in cc-candybar a thrown template error surfaces as a visible ⚠
- * cell that `cc-candybar check` fails on. [LAW:no-silent-failure]
- */
-export function requireActiveSegment(
-  ref: ActiveSegmentRef,
-  func: string,
-): ActiveSegment {
-  const active = ref.current;
-  if (active === null) {
-    throw new Error(
-      `{{ ${func} }} is only available inside a segment's templates — ` +
-        `there is no active segment here. Segment-scoped functions cannot be ` +
-        `used in variable declarations or layout-node "when" predicates, ` +
-        `which are evaluated outside any segment.`,
-    );
-  }
-  return active;
-}

package/src/render/diagnostic-style.ts

@@ -1,23 +0,0 @@
-// The cc-candybar diagnostic visual identity: the ANSI style constants for
-// every error/warning surface we draw (the client's permanent-failure glyph
-// and the daemon's per-render diagnostic strip).
-//
-// [LAW:one-source-of-truth] This leaf module is the single TS definition of
-// the diagnostic style. Recoloring diagnostics is an edit here, nowhere else
-// — a partial restyle that ships an inconsistent error language is no longer
-// expressible within the Node runtime.
-//
-// [LAW:one-way-deps] A leaf: imports nothing, so both the daemon
-// (src/daemon/server.ts) and the client render path
-// (src/render/error-glyph.ts) can import it without daemon↔client coupling —
-// the same direction already used for ./diagnostic-text.
-//
-// The Rust client (rust-client/src/error_glyph.rs) cannot import a TS module,
-// so it mirrors the error trio as literal consts; scripts/check-protocol.mjs
-// diffs that mirror against this file and fails prepublishOnly on drift.
-
-export const DIAGNOSTIC_ERROR_FG = "\x1b[38;2;255;255;255m";
-export const DIAGNOSTIC_ERROR_BG = "\x1b[48;2;200;40;40m";
-export const DIAGNOSTIC_WARNING_FG = "\x1b[38;2;0;0;0m";
-export const DIAGNOSTIC_WARNING_BG = "\x1b[48;2;220;160;40m";
-export const ANSI_RESET = "\x1b[0m";

package/src/render/diagnostic-text.ts

@@ -1,77 +0,0 @@
-// [LAW:one-source-of-truth] The single sanitize-and-truncate primitive for
-// any diagnostic text we embed inside a single-line, ANSI-styled envelope.
-// Two callers today:
-//   - src/render/error-glyph.ts (permanent client-side glyph; budget 60)
-//   - src/daemon/server.ts composeWithDiagnostics (per-render diagnostic
-//     strip carrying the actual config error/warning message)
-// A third copy in the daemon would duplicate the security-critical
-// control-char neutralization rules; sharing the primitive guarantees the
-// rules cannot drift between callers.
-//
-// [LAW:types-are-the-program] Two functions, both pure (string, number)→
-// string|boolean. The contract is exactly: "make this text safe to splice
-// into a single-line ANSI-styled cell, clipped to maxLen visible code
-// points." Anything else is the caller's responsibility (which icon, which
-// colors, which click verb).
-
-const ELLIPSIS = "…";
-
-// [LAW:dataflow-not-control-flow] Every code point flows through the same
-// predicate. No special-case branches per kind of control; the Unicode Cc
-// class is the single discriminator that decides "this byte/code point
-// could hijack the envelope and must be neutralized."
-//
-// Why the C1 range matters (0x80..0x9F):
-//   ESC (U+001B) is the obvious ANSI-escape entry point, but some
-//   terminals interpret U+009B as 8-bit CSI directly — i.e. equivalent to
-//   ESC `[`. Sanitizing only the C0 range (≤0x1F + 0x7F) would leave the
-//   8-bit bypass open. With diagnostic messages echoing user-supplied
-//   data (config paths, key names, parse errors), that's reachable from
-//   crafted input even without a malicious daemon.
-//
-// Mirrors rust-client/src/error_glyph.rs's truncate(): `char::is_control()`
-// matches the exact same Unicode Cc set, so the TS and Rust runtimes
-// neutralize the same byte classes. The Rust side also mirrors the
-// collapse-whitespace-runs + trim pass below, so the two runtimes produce
-// byte-identical output — both suites pin the same fixtures.
-export function isControlChar(code: number): boolean {
-  return code < 0x20 || code === 0x7f || (code >= 0x80 && code <= 0x9f);
-}
-
-// Sanitize control characters (→ single space) and clip to maxLen visible
-// code points, ending with an ellipsis if the input was longer. Runs of
-// whitespace (post-sanitize) collapse to a single space so multi-line
-// indented messages don't display as awkwardly-spaced single lines.
-//
-// [LAW:dataflow-not-control-flow] One pass over the input; the trailing
-// `.replace(/.$/u, ELLIPSIS)` is the only branch and only fires when we
-// hit the cap. The cap-then-ellipsis is the same pattern error-glyph used
-// pre-extraction (preserved byte-for-byte: visible length stays at maxLen
-// when truncation happens).
-export function sanitizeAndTruncate(text: string, maxLen: number): string {
-  // First pass: sanitize control chars to spaces. We do this before the
-  // length count because a control char and its replacement space are both
-  // one visible code point in the output — equal contributions to length.
-  let sanitized = "";
-  for (const ch of text) {
-    sanitized += isControlChar(ch.codePointAt(0) ?? 0) ? " " : ch;
-  }
-  // Collapse whitespace runs (introduced by newline→space + the existing
-  // indentation in multi-line error messages). One space conveys the same
-  // "this was a break in the source" information without wasting cells.
-  sanitized = sanitized.replace(/\s+/g, " ").trim();
-
-  // Truncate-with-ellipsis. The /.$/u regex matches a full code point
-  // (unicode flag), not a UTF-16 unit — important for emoji and other
-  // astral-plane chars in user-supplied paths.
-  let out = "";
-  let count = 0;
-  for (const ch of sanitized) {
-    if (count === maxLen) {
-      return out.replace(/.$/u, ELLIPSIS);
-    }
-    out += ch;
-    count++;
-  }
-  return out;
-}

package/src/render/error-glyph.ts

@@ -1,53 +0,0 @@
-// One-line styled diagnostic glyph emitted on permanent daemon failures.
-//
-// [LAW:single-enforcer] One formatter per runtime. The Node entry in
-// src/index.ts calls formatPermanentGlyph; nothing else builds this string.
-//
-// [LAW:one-type-per-behavior] The Rust mirror at rust-client/src/error_glyph.rs
-// must produce byte-identical output for the same logical cause — both
-// runtimes show the same diagnostic so the user's experience does not depend
-// on which client is on the hot path. The mirrored constants are diffed by
-// scripts/check-protocol.mjs; the sanitize/collapse/truncate behavior is
-// pinned by paired fixture tests on both sides.
-//
-// [LAW:one-source-of-truth] Both shared primitives live in leaf modules under
-// ./: the style constants in ./diagnostic-style (shared with the daemon's
-// composeWithDiagnostics so the diagnostic visual language cannot drift) and
-// the sanitize-and-truncate primitive in ./diagnostic-text (shared with
-// src/daemon/server.ts so the security-critical control-char neutralization
-// (C0 + DEL + C1/8-bit-CSI) cannot drift between the two callers).
-
-import type { PermanentOutcome } from "../daemon/client-transport";
-import {
-  ANSI_RESET,
-  DIAGNOSTIC_ERROR_BG,
-  DIAGNOSTIC_ERROR_FG,
-} from "./diagnostic-style";
-import { sanitizeAndTruncate } from "./diagnostic-text";
-
-const OPEN = `${DIAGNOSTIC_ERROR_BG}${DIAGNOSTIC_ERROR_FG}`;
-const PREFIX = "⚠ cc-candybar: ";
-
-// Long messages from the daemon (parse errors, internal exception strings)
-// can be arbitrarily long. The glyph must fit on a single statusline row, so
-// truncate to a budget that leaves room for the prefix at typical widths.
-const MAX_MESSAGE_LEN = 60;
-
-export function formatPermanentGlyph(outcome: PermanentOutcome): string {
-  return `${OPEN}${PREFIX}${describe(outcome)}${ANSI_RESET}\n`;
-}
-
-function describe(outcome: PermanentOutcome): string {
-  switch (outcome.cause) {
-    case "version_mismatch": {
-      const daemon = outcome.daemonV === 0 ? "unknown" : `v${outcome.daemonV}`;
-      return `protocol mismatch (client v${outcome.clientV} ≠ daemon ${daemon})`;
-    }
-    case "bad_request":
-      return `daemon rejected request: ${sanitizeAndTruncate(outcome.message, MAX_MESSAGE_LEN)}`;
-    case "render_failed":
-      return `render failed: ${sanitizeAndTruncate(outcome.message, MAX_MESSAGE_LEN)}`;
-    case "malformed_response":
-      return `malformed daemon response: ${sanitizeAndTruncate(outcome.message, MAX_MESSAGE_LEN)}`;
-  }
-}

package/src/render/menu.ts

@@ -1,257 +0,0 @@
-// [LAW:locality-or-seam] The runtime half of the `{{ menu }}` seam — sibling to
-// `{{ action }}`/`{{ picker }}`. A menu is a self-contained disclosure: an inline
-// TRIGGER that toggles open/closed, and (when open) its body — a picker grid —
-// that DROPS onto the line(s) below the enclosing row. The body is the one picker
-// renderer (`renderPicker`); the trigger is a coupled set-state the menu composes
-// directly (like the picker's closeOnPick) — it toggles the open-state AND resets
-// the page cursor in one atomic batch, gated by the synthesized cycle action.
-//
-// [LAW:one-source-of-truth] The trigger's TEXT is authored, never emitted here.
-// This module used to append ▸/▾ from the glyph constants, while the codebase's
-// other disclosure — group sugar — spliced those same constants into the
-// template it synthesized, where an author could see and change them. Two
-// policies for one fact; the docs sided with the visible one ("the trigger is
-// any template content you like") while a menu appended a glyph nobody wrote,
-// which is why edit mode's `+` rendered `+▸`. A menu's disclosure IS a
-// two-member cycle, so its trigger now binds displays exactly as a cycle
-// `{{ action }}` does, through the same `pickCycleDisplay` (candybar-settings-
-// ui-aok.4).
-//
-// [LAW:effects-at-boundaries] The helper is a PURE function of its inputs (the
-// walk-published placement + the live store): it computes the inline glyph and,
-// when open, the body, and RETURNS them together — the glyph as the fragment, the
-// body carried as out-of-band metadata on that returned RichText (a symbol the
-// segment boundary reads). It mutates no shared sink; the EFFECT of placing the
-// body below the row is performed at the boundary (collectMenuDrops + the segment
-// walk). Pure core returns a description; the edge performs it.
-//
-// [LAW:decomposition] The glyph and the body travel on SEPARATE channels: the
-// glyph is the visible fragment, the body rides as metadata invisible to the
-// inline render. This is the fix for the old `\n`-in-the-stream representation —
-// the body never enters the visible inline text, so a menu may sit ANYWHERE in a
-// template (content after it stays inline on row 0), and a segment may contain
-// ANY NUMBER of menus (each returned glyph carries its own body).
-//
-// [LAW:one-source-of-truth] A menu is CONTEXT-FREE about its NAME in the template
-// (it cannot see the segment it sits in), so the host segment name is published
-// into this runtime by the render walk before each segment's template evaluates.
-// The helper combines that segment name with its own apply-action arg (and an
-// optional shared key) to derive identity via menu-keys — the SAME derivation the
-// loader synthesis uses — so the rendered toggle and the loader-synthesized state
-// var + gate share one source.
-//
-// [LAW:dataflow-not-control-flow] Openness is the value of the menu's state key,
-// not a when-gated reveal: open ⇔ the state key holds THIS menu's member name.
-// The body metadata is a list whose length carries open/closed (1 open, 0 closed).
-
-import type { RichText } from "@promptctl/rich-js";
-import type { FuncMap } from "@promptctl/go-template-js";
-import {
-  menuMember,
-  menuPageKey,
-  menuStateKey,
-  parseMenuOptions,
-  type MenuOptions,
-} from "../config/menu-keys.js";
-import { DISCLOSURE_CLOSED, pickCycleDisplay } from "../config/disclosure.js";
-import { effectsUrl, VERB_SET_STATE } from "../click/wire.js";
-import { linkFragment, readVar, type ActionRuntime } from "./action.js";
-import { renderPicker } from "./picker.js";
-import type { ActiveSegmentRef } from "./active-segment.js";
-
-// [LAW:one-type-per-behavior] A `{{ menu }}` needs one structural fact it cannot
-// see about itself — the name of the segment it renders inside. That used to be
-// its own `MenuPlacement` type; it is now a field on the ONE active-segment
-// record the walk publishes (see render/active-segment.ts), because "which
-// segment is rendering" is a single fact and a per-feature copy of it is a
-// second clock. The menu reads `segName` and ignores the rest.
-
-// [LAW:locality-or-seam] The runtime the `menu` func closes over. It shares the
-// ACTION runtime (the menu's glyph and body resolve their actions/state from the
-// same compiled table + store as every other helper) and READS the walk-published
-// active segment — both inputs, never written by the helper. The record is
-// mutated only by the single owner (the render walk, around each segment eval) —
-// the spatial cousin of the hue cursor, one mutator, never ambient.
-// [LAW:no-ambient-temporal-coupling]
-export interface MenuRuntime {
-  readonly action: ActionRuntime;
-  // [LAW:one-source-of-truth] The menu does not publish its own "which segment
-  // is current" pointer — it reads the ONE record the render walk publishes for
-  // every segment-scoped feature (the palette `{{ color }}` resolves against and
-  // the background `{{ bgOf }}` returns ride the same record). A second pointer
-  // would be a second clock for the same fact.
-  readonly activeSegment: ActiveSegmentRef;
-}
-
-// [LAW:effects-at-boundaries] The body a `{{ menu }}` drops below its row rides as
-// out-of-band metadata on the returned glyph (a symbol the boundary reads), so the
-// helper returns a description rather than mutating a shared sink. A list whose
-// length carries open/closed — `[body]` open, `[]` closed.
-const MENU_DROP = Symbol("cc-candybar.menuDrop");
-type GlyphWithDrop = RichText & { [MENU_DROP]?: readonly RichText[] };
-
-// [LAW:single-enforcer] THE reader of the drop metadata, used by the segment
-// boundary (injected by the driver — node-registry never imports this module).
-// Scans a segment's evaluated fragments in template order and returns every menu
-// body carried on them; a fragment with no metadata contributes nothing.
-export function collectMenuDrops(
-  fragments: readonly RichText[],
-): readonly RichText[] {
-  return fragments.flatMap((f) => (f as GlyphWithDrop)[MENU_DROP] ?? []);
-}
-
-// Realize a `{{ menu }}` against the live placement + state: return its inline
-// trigger, carrying the (open) body as out-of-band metadata for the boundary.
-function renderMenu(
-  applyName: string,
-  displays: readonly string[],
-  options: MenuOptions,
-  runtime: MenuRuntime,
-): RichText {
-  const placement = runtime.activeSegment.current;
-  // [LAW:no-defensive-null-guards] The walk publishes a placement before every
-  // segment template evaluates; a `{{ menu }}` only renders inside a segment. A
-  // null here is a wiring bug (the func fired with no current segment), surfaced
-  // loudly rather than rendering a placeless menu.
-  if (placement === null) {
-    throw new Error(
-      "{{ menu }} rendered with no active segment placement — the render walk must publish one before evaluating a segment template",
-    );
-  }
-  const action = runtime.action;
-  // [LAW:one-source-of-truth] Identity — and the page-cursor key derived from it
-  // — comes from the SAME menu-keys derivation the loader synthesis used, so the
-  // key this render reads/writes is the key whose state var + int gate the
-  // loader emitted. No page-action argument to mis-wire.
-  const stateKey = menuStateKey(placement.segName, applyName, options.key);
-  const pageKey = menuPageKey(stateKey);
-  const member = menuMember(applyName);
-
-  // [LAW:dataflow-not-control-flow] Open ⇔ the state key holds this menu's member.
-  // A foreign value (an accordion sibling's member under a shared key) reads as
-  // closed here — exactly the binary [closed, member] cycle the synthesized action
-  // gates. This ONE read drives both the glyph and the body, so what the glyph
-  // promises and what drops below cannot disagree.
-  const open = readVar(action.store, stateKey) === member;
-
-  // [LAW:one-source-of-truth] / [LAW:locality-or-seam] The disclosure click is ONE
-  // atomic set-state that keeps the two split keys coherent: it toggles the open-
-  // state (the binary cycle — successor is closed when open, the member when
-  // closed) AND resets the page cursor to page 0, in one batch. So a reopened menu
-  // is never stranded on a stale page left by ←/→ before the last close. This
-  // mirrors the picker's closeOnPick page-reset fold: the picker builds its set-
-  // state URLs directly (not via renderAction) so it can couple two writes; the
-  // menu — the one part that knows BOTH the open-state key and the page key
-  // [LAW:decomposition] — does the same. The synthesized cycle action stays the
-  // GATE source (deriveActionValidators); both keys are independently gated, so the
-  // coupled batch passes the same wire gate every click does [LAW:single-enforcer].
-  const sessionId = readVar(action.store, "session.id");
-  const successor = open ? DISCLOSURE_CLOSED : member;
-  // [LAW:one-source-of-truth] The trigger's text is AUTHORED, resolved through
-  // the one display rule a cycle `{{ action }}` uses — a menu's disclosure is a
-  // two-member cycle, so binding `"▸" "▾"` gives the per-state form and binding
-  // `"+"` gives the static one. Nothing is appended here: a disclosure glyph an
-  // author never wrote is a glyph they cannot decline, which is exactly how
-  // edit mode's `+` came to read `+▸`.
-  const glyph = linkFragment(
-    pickCycleDisplay(`{{ menu "${applyName}" }}`, displays, 2, open ? 1 : 0),
-    effectsUrl([
-      {
-        verb: VERB_SET_STATE,
-        args: [sessionId, stateKey, successor, pageKey, "0"],
-      },
-    ]),
-    false,
-  ) as GlyphWithDrop;
-
-  // [LAW:effects-at-boundaries] The body is a VALUE whose length carries open/
-  // closed — `[body]` open, `[]` closed — attached to the glyph the helper returns.
-  // No shared mutation: the boundary reads this metadata to place the body.
-  // (renderPicker is pure, so it is only built when open — skipping wasted
-  // computation, gating no effect.)
-  // [LAW:one-source-of-truth] The body's page cursor is the identity-derived
-  // key (its synthesized state var is named by it, the disclosure-var
-  // convention), and CLOSING — the ✕ affordance or a closeOnPick pick — writes
-  // the disclosure back to the closed sentinel and resets the page, the same
-  // coupled pair the toggle glyph above writes. What the ▾ promised, ✕ delivers.
-  glyph[MENU_DROP] = open
-    ? [
-        renderPicker(
-          applyName,
-          { key: pageKey, stateVar: pageKey },
-          [
-            [stateKey, DISCLOSURE_CLOSED],
-            [pageKey, "0"],
-          ],
-          options.closeOnPick,
-          options.paged,
-          action,
-        ),
-      ]
-    : [];
-  return glyph;
-}
-
-// [LAW:parse-dont-validate] THE crossing for a `{{ menu }}`'s argument tail.
-// The engine cannot type these slots for us — displays are strings and the
-// optional trailing knobs are a dict, so one declared slot type would refuse
-// one of them — so the tail arrives as opaque values and leaves here as a
-// record whose shape the renderer can no longer doubt: displays are strings,
-// options are parsed. Every rejected shape names the legal one.
-interface MenuArgs {
-  readonly displays: readonly string[];
-  readonly options: MenuOptions;
-}
-// [LAW:one-source-of-truth] This splits the tail on VALUES; the loader splits
-// the same tail on EXPRS (`menu-synth.ts`). They agree because the loader admits
-// only call sites where they provably must: a last argument that is neither a
-// string literal nor a literal `(dict …)` is a load error whenever both readings
-// would be legal, so what reaches here can only match the loader's reading or
-// throw below.
-const isDict = (v: unknown): v is Record<string, unknown> =>
-  typeof v === "object" && v !== null && !Array.isArray(v);
-
-function parseMenuArgs(applyName: string, tail: readonly unknown[]): MenuArgs {
-  // The dict is the LAST argument when present; everything before it is a
-  // display. One position, so a reader never has to count.
-  const last = tail[tail.length - 1];
-  const optsArg = isDict(last) ? last : undefined;
-  const displayArgs = optsArg === undefined ? tail : tail.slice(0, -1);
-  const bad = displayArgs.findIndex((d) => typeof d !== "string");
-  if (bad !== -1) {
-    throw new Error(
-      `{{ menu "${applyName}" }} display #${bad + 1} is not text (${JSON.stringify(displayArgs[bad])}) — a menu binds its trigger text, then an optional trailing (dict …) of options`,
-    );
-  }
-  return {
-    displays: displayArgs as readonly string[],
-    // [LAW:one-source-of-truth] The same option reader the loader folds over
-    // the static dict — vocabulary, types, defaults live once.
-    options: parseMenuOptions(optsArg ?? {}),
-  };
-}
-
-// [LAW:dataflow-not-control-flow] One func; the apply-action NAME is the menu's
-// whole identity (the page cursor is derived from it, not passed), the TRIGGER
-// TEXT is bound like a cycle action's display (one per state, or one static),
-// and the rare knobs travel as ONE optional trailing `(dict …)` — closeOnPick
-// (default false: stay-open), paged (default true: a drop menu wants bounded
-// height), key (accordion grouping: omitted ⇒ independent, present ⇒ mutually
-// exclusive with siblings sharing it). Values, not modes. The loader gates the
-// same dict statically (staticDictEntries), so an old positional tail never
-// reaches this fn — it is a migration-pointing load error.
-//
-// [LAW:one-way-deps] Injected into the engine by registerDslConfig as data; the
-// generic engine never imports this module.
-export function menuFuncs(runtime: MenuRuntime): FuncMap {
-  return {
-    menu: {
-      fn: (applyName: string, ...tail: unknown[]) => {
-        const { displays, options } = parseMenuArgs(applyName, tail);
-        return renderMenu(applyName, displays, options, runtime);
-      },
-      argTypes: ["string", "value"],
-      returnType: "T",
-    },
-  };
-}

package/src/render/outcome-plan.ts

@@ -1,45 +0,0 @@
-// Pure mapping from ClientOutcome to a render plan: what to write, whether
-// to kick a fresh daemon, and (if relevant) the debug message that describes
-// why. All variability lives in the returned value — including the debug
-// string — so this module has no observable side effects. The runtime
-// composition in src/index.ts consumes the plan and owns every side effect
-// (debug logging, kick, write, exit).
-//
-// [LAW:dataflow-not-control-flow] Variability lives in the returned values
-// (output string, kick flag, debug message). The caller's debug/kick/write/
-// exit run unconditionally against those values — no caller-side branching
-// on outcome.kind.
-//
-// [LAW:types-are-the-program] Exhaustive over ClientOutcome.kind. Adding a
-// new variant fails typecheck rather than silently falling out the bottom
-// of the switch.
-
-import { formatPermanentGlyph } from "./error-glyph";
-import type { ClientOutcome } from "../daemon/client";
-
-export interface OutcomePlan {
-  output: string;
-  kick: boolean;
-  // Debug message the caller should log, or null when there is nothing
-  // worth logging (the "ok" path). Held as data so this module stays pure.
-  debug: string | null;
-}
-
-export function planOutcome(outcome: ClientOutcome): OutcomePlan {
-  switch (outcome.kind) {
-    case "ok":
-      return { output: outcome.value, kick: false, debug: null };
-    case "transient":
-      return {
-        output: "\n",
-        kick: true,
-        debug: `daemon unavailable (transient: ${outcome.cause}: ${outcome.message}) — kicking daemon`,
-      };
-    case "permanent":
-      return {
-        output: formatPermanentGlyph(outcome),
-        kick: false,
-        debug: `daemon refused request (permanent: ${outcome.cause}) — not kicking`,
-      };
-  }
-}