@ran-sh/dsh-crew 1.8.0 → 1.9.1

package/src/provider-health.mjs

@@ -1,130 +1,130 @@
-// Bounded provider/model callability evidence.
-//
-// Catalog presence is not proof of a callable route. This store keeps only
-// sanitized state and timestamps; raw provider errors never leave the caller.
-
-export const PROVIDER_HEALTH_STATES = Object.freeze([
-  'callable', 'credential-missing', 'quota-exhausted', 'rate-limited',
-  'timeout', 'internal-error', 'disabled', 'not-configured', 'tombstoned', 'unprobed',
-]);
-
-const REASON_CODES = Object.freeze({
-  callable: 'PROVIDER_CALLABLE',
-  'credential-missing': 'CREDENTIAL_MISSING',
-  'quota-exhausted': 'QUOTA_EXHAUSTED',
-  'rate-limited': 'RATE_LIMITED',
-  timeout: 'PROBE_TIMEOUT',
-  'internal-error': 'PROVIDER_INTERNAL_ERROR',
-  disabled: 'PROVIDER_DISABLED',
-  'not-configured': 'PROVIDER_NOT_CONFIGURED',
-  tombstoned: 'PROVIDER_TOMBSTONED',
-});
-
-const DEFAULT_TTLS = Object.freeze({
-  callable: 5 * 60 * 1000,
-  'credential-missing': 30 * 1000,
-  'quota-exhausted': 15 * 60 * 1000,
-  'rate-limited': 60 * 1000,
-  timeout: 60 * 1000,
-  'internal-error': 60 * 1000,
-  disabled: 5 * 60 * 1000,
-  'not-configured': 30 * 1000,
-  tombstoned: 5 * 60 * 1000,
-});
-
-function text(value) {
-  return typeof value === 'string' && value.trim() ? value.trim() : null;
-}
-
-function providerKey(provider, model) {
-  const p = text(provider);
-  const m = text(model);
-  return p && m ? `${p}\u0000${m}` : null;
-}
-
-function errorText(error) {
-  if (!error || typeof error !== 'object') return '';
-  return [error.code, error.name, error.message, error.status].filter((value) => value !== undefined && value !== null).join(' ').toLowerCase();
-}
-
-/** Map an upstream error to one bounded, secret-free callability state. */
-export function classifyProviderError(error = {}) {
-  const textValue = errorText(error);
-  const code = text(error?.code)?.toUpperCase() ?? '';
-  if (code === 'MISSING_CREDENTIAL' || code === 'CREDENTIAL_MISSING' || /no (api )?key|credential.*missing|missing.*credential/.test(textValue)) {
-    return { state: 'credential-missing', reason_code: REASON_CODES['credential-missing'] };
-  }
-  if (code === 'QUOTA_EXCEEDED' || /monthly|account/.test(textValue) && /quota|exhaust|limit/.test(textValue)) {
-    return { state: 'quota-exhausted', reason_code: REASON_CODES['quota-exhausted'] };
-  }
-  if (Number(error?.status) === 429 || code === 'RATE_LIMITED' || /rate.?limit|too many requests/.test(textValue)) {
-    return { state: 'rate-limited', reason_code: REASON_CODES['rate-limited'] };
-  }
-  if (error?.name === 'TimeoutError' || error?.name === 'AbortError' || code === 'TIMEOUT' || /timed? out|timeout|aborted/.test(textValue)) {
-    return { state: 'timeout', reason_code: REASON_CODES.timeout };
-  }
-  return { state: 'internal-error', reason_code: REASON_CODES['internal-error'] };
-}
-
-function boundedTimestamp(value, fallback) {
-  return Number.isFinite(value) && value >= 0 ? value : fallback;
-}
-
-function view(entry, now) {
-  if (!entry) return { state: 'unprobed', reason_code: null, observed_at: null, expires_at: null, fresh: false };
-  const fresh = now < entry.expires_at;
-  if (!fresh) return { state: 'unprobed', reason_code: null, observed_at: entry.observed_at, expires_at: entry.expires_at, fresh: false };
-  return { ...entry, fresh: true };
-}
-
-export function createProviderHealthStore({ clock = () => Date.now(), ttls = {}, maxEntries = 256 } = {}) {
-  const records = new Map();
-  const limits = { ...DEFAULT_TTLS };
-  for (const state of PROVIDER_HEALTH_STATES) {
-    if (Number.isFinite(ttls[state]) && ttls[state] >= 0) limits[state] = Math.min(ttls[state], 24 * 60 * 60 * 1000);
-  }
-  const boundedMax = Number.isInteger(maxEntries) && maxEntries > 0 ? Math.min(maxEntries, 2048) : 256;
-
-  const get = (provider, model) => {
-    const key = providerKey(provider, model);
-    if (!key) return { provider: text(provider), model: text(model), state: 'unprobed', reason_code: null, observed_at: null, expires_at: null, fresh: false };
-    const entry = records.get(key);
-    const current = view(entry, clock());
-    if (entry && !current.fresh) records.delete(key);
-    return { provider: text(provider), model: text(model), ...current };
-  };
-
-  const record = (provider, model, result = {}) => {
-    const key = providerKey(provider, model);
-    if (!key) return null;
-    const now = clock();
-    const observed = boundedTimestamp(result.observed_at, now);
-    const previous = records.get(key);
-    let classified;
-    if (result.ok === true) classified = { state: 'callable', reason_code: REASON_CODES.callable };
-    else if (PROVIDER_HEALTH_STATES.includes(result.state) && result.state !== 'unprobed') classified = { state: result.state, reason_code: REASON_CODES[result.state] ?? null };
-    else classified = classifyProviderError(result.error ?? result);
-    if (previous && previous.observed_at > observed) return get(provider, model);
-    if (previous && previous.observed_at === observed) {
-      const previousFailure = previous.state !== 'callable';
-      const incomingFailure = classified.state !== 'callable';
-      if (previousFailure && !incomingFailure) return get(provider, model);
-      if (previousFailure && incomingFailure && String(previous.state).localeCompare(String(classified.state)) <= 0) return get(provider, model);
-    }
-    const expires = observed + limits[classified.state];
-    records.set(key, {
-      provider: text(provider), model: text(model), ...classified,
-      observed_at: observed, expires_at: expires,
-    });
-    while (records.size > boundedMax) {
-      const oldest = [...records.entries()].sort((a, b) => a[1].observed_at - b[1].observed_at)[0]?.[0];
-      if (!oldest) break;
-      records.delete(oldest);
-    }
-    return get(provider, model);
-  };
-
-  const list = () => [...records.values()].map((entry) => view(entry, clock())).filter((entry) => entry.fresh).slice(0, boundedMax);
-
-  return { get, record, list, ttls: { ...limits }, maxEntries: boundedMax };
-}
+// Bounded provider/model callability evidence.
+//
+// Catalog presence is not proof of a callable route. This store keeps only
+// sanitized state and timestamps; raw provider errors never leave the caller.
+
+export const PROVIDER_HEALTH_STATES = Object.freeze([
+  'callable', 'credential-missing', 'quota-exhausted', 'rate-limited',
+  'timeout', 'internal-error', 'disabled', 'not-configured', 'tombstoned', 'unprobed',
+]);
+
+const REASON_CODES = Object.freeze({
+  callable: 'PROVIDER_CALLABLE',
+  'credential-missing': 'CREDENTIAL_MISSING',
+  'quota-exhausted': 'QUOTA_EXHAUSTED',
+  'rate-limited': 'RATE_LIMITED',
+  timeout: 'PROBE_TIMEOUT',
+  'internal-error': 'PROVIDER_INTERNAL_ERROR',
+  disabled: 'PROVIDER_DISABLED',
+  'not-configured': 'PROVIDER_NOT_CONFIGURED',
+  tombstoned: 'PROVIDER_TOMBSTONED',
+});
+
+const DEFAULT_TTLS = Object.freeze({
+  callable: 5 * 60 * 1000,
+  'credential-missing': 30 * 1000,
+  'quota-exhausted': 15 * 60 * 1000,
+  'rate-limited': 60 * 1000,
+  timeout: 60 * 1000,
+  'internal-error': 60 * 1000,
+  disabled: 5 * 60 * 1000,
+  'not-configured': 30 * 1000,
+  tombstoned: 5 * 60 * 1000,
+});
+
+function text(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function providerKey(provider, model) {
+  const p = text(provider);
+  const m = text(model);
+  return p && m ? `${p}\u0000${m}` : null;
+}
+
+function errorText(error) {
+  if (!error || typeof error !== 'object') return '';
+  return [error.code, error.name, error.message, error.status].filter((value) => value !== undefined && value !== null).join(' ').toLowerCase();
+}
+
+/** Map an upstream error to one bounded, secret-free callability state. */
+export function classifyProviderError(error = {}) {
+  const textValue = errorText(error);
+  const code = text(error?.code)?.toUpperCase() ?? '';
+  if (code === 'MISSING_CREDENTIAL' || code === 'CREDENTIAL_MISSING' || /no (api )?key|credential.*missing|missing.*credential/.test(textValue)) {
+    return { state: 'credential-missing', reason_code: REASON_CODES['credential-missing'] };
+  }
+  if (code === 'QUOTA_EXCEEDED' || /monthly|account/.test(textValue) && /quota|exhaust|limit/.test(textValue)) {
+    return { state: 'quota-exhausted', reason_code: REASON_CODES['quota-exhausted'] };
+  }
+  if (Number(error?.status) === 429 || code === 'RATE_LIMITED' || /rate.?limit|too many requests/.test(textValue)) {
+    return { state: 'rate-limited', reason_code: REASON_CODES['rate-limited'] };
+  }
+  if (error?.name === 'TimeoutError' || error?.name === 'AbortError' || code === 'TIMEOUT' || /timed? out|timeout|aborted/.test(textValue)) {
+    return { state: 'timeout', reason_code: REASON_CODES.timeout };
+  }
+  return { state: 'internal-error', reason_code: REASON_CODES['internal-error'] };
+}
+
+function boundedTimestamp(value, fallback) {
+  return Number.isFinite(value) && value >= 0 ? value : fallback;
+}
+
+function view(entry, now) {
+  if (!entry) return { state: 'unprobed', reason_code: null, observed_at: null, expires_at: null, fresh: false };
+  const fresh = now < entry.expires_at;
+  if (!fresh) return { state: 'unprobed', reason_code: null, observed_at: entry.observed_at, expires_at: entry.expires_at, fresh: false };
+  return { ...entry, fresh: true };
+}
+
+export function createProviderHealthStore({ clock = () => Date.now(), ttls = {}, maxEntries = 256 } = {}) {
+  const records = new Map();
+  const limits = { ...DEFAULT_TTLS };
+  for (const state of PROVIDER_HEALTH_STATES) {
+    if (Number.isFinite(ttls[state]) && ttls[state] >= 0) limits[state] = Math.min(ttls[state], 24 * 60 * 60 * 1000);
+  }
+  const boundedMax = Number.isInteger(maxEntries) && maxEntries > 0 ? Math.min(maxEntries, 2048) : 256;
+
+  const get = (provider, model) => {
+    const key = providerKey(provider, model);
+    if (!key) return { provider: text(provider), model: text(model), state: 'unprobed', reason_code: null, observed_at: null, expires_at: null, fresh: false };
+    const entry = records.get(key);
+    const current = view(entry, clock());
+    if (entry && !current.fresh) records.delete(key);
+    return { provider: text(provider), model: text(model), ...current };
+  };
+
+  const record = (provider, model, result = {}) => {
+    const key = providerKey(provider, model);
+    if (!key) return null;
+    const now = clock();
+    const observed = boundedTimestamp(result.observed_at, now);
+    const previous = records.get(key);
+    let classified;
+    if (result.ok === true) classified = { state: 'callable', reason_code: REASON_CODES.callable };
+    else if (PROVIDER_HEALTH_STATES.includes(result.state) && result.state !== 'unprobed') classified = { state: result.state, reason_code: REASON_CODES[result.state] ?? null };
+    else classified = classifyProviderError(result.error ?? result);
+    if (previous && previous.observed_at > observed) return get(provider, model);
+    if (previous && previous.observed_at === observed) {
+      const previousFailure = previous.state !== 'callable';
+      const incomingFailure = classified.state !== 'callable';
+      if (previousFailure && !incomingFailure) return get(provider, model);
+      if (previousFailure && incomingFailure && String(previous.state).localeCompare(String(classified.state)) <= 0) return get(provider, model);
+    }
+    const expires = observed + limits[classified.state];
+    records.set(key, {
+      provider: text(provider), model: text(model), ...classified,
+      observed_at: observed, expires_at: expires,
+    });
+    while (records.size > boundedMax) {
+      const oldest = [...records.entries()].sort((a, b) => a[1].observed_at - b[1].observed_at)[0]?.[0];
+      if (!oldest) break;
+      records.delete(oldest);
+    }
+    return get(provider, model);
+  };
+
+  const list = () => [...records.values()].map((entry) => view(entry, clock())).filter((entry) => entry.fresh).slice(0, boundedMax);
+
+  return { get, record, list, ttls: { ...limits }, maxEntries: boundedMax };
+}

package/src/provider-inventory.mjs

@@ -1,182 +1,182 @@
-// Secret-free inventory projection for Harness providers.
-//
-// Harness owns the live provider/model catalog; Crew owns the routing policy
-// and (where explicitly marked) profile provenance. This module only joins
-// those observations into a bounded record set for lifecycle/readiness UIs.
-
-import { classifyCredentialReference } from './credential-reference.mjs';
-
-const LIFECYCLE_ORIGINS = new Set(['builtin', 'profile-managed', 'dynamic', 'unknown']);
-const OWNERSHIPS = new Set(['harness', 'crew-managed-profile', 'user-managed-profile', 'dynamic-user', 'unknown']);
-const MUTABLE_AUTHORITY_KINDS = new Set(['crew-profile', 'harness-settings']);
-export const IMMUTABLE_HARNESS_PROVIDER_IDS = Object.freeze(['deepseek-official']);
-
-function text(value) {
-  return typeof value === 'string' && value.trim() ? value.trim() : null;
-}
-
-function normalizeProviderId(value) {
-  return text(value);
-}
-
-function normalizeCredentialRefs(declarations) {
-  const entries = Array.isArray(declarations) ? declarations : [declarations];
-  const seen = new Map();
-  const refs = [];
-  let redacted = false;
-  for (const declaration of entries) {
-    const raw = declaration?.credential_refs ?? declaration?.credential_ref;
-    const values = Array.isArray(raw) ? raw : raw === undefined ? [] : [raw];
-    for (const candidate of values) {
-      const kind = text(typeof candidate === 'object' ? candidate.kind : null) ?? 'env';
-      const classified = classifyCredentialReference(candidate, { kind });
-      if (classified.redacted) redacted = true;
-      const name = classified.value;
-      const ownership = text(typeof candidate === 'object' ? candidate.ownership : null) ?? 'crew';
-      const normalized = {
-        kind: ['env', 'crew-store', 'harness-store', 'unknown'].includes(kind) ? kind : 'unknown',
-        name_or_handle: name,
-        ownership: ['crew', 'user', 'external', 'unknown'].includes(ownership) ? ownership : 'unknown',
-      };
-      if (!name) continue;
-      const key = `${normalized.kind}:${normalized.name_or_handle}`;
-      const existing = seen.get(key);
-      if (existing) {
-        if (existing.ownership !== normalized.ownership) existing.ownership = 'unknown';
-      } else {
-        seen.set(key, normalized);
-        refs.push(normalized);
-      }
-    }
-  }
-  return { refs, redacted };
-}
-
-function findPriorityIndex(policy, key, providerId) {
-  const list = Array.isArray(policy?.[key]) ? policy[key] : [];
-  const index = list.findIndex((entry) => normalizeProviderId(entry?.provider) === providerId);
-  return index >= 0 ? index : null;
-}
-
-function declarationsFor(declarations, id) {
-  return declarations.filter((entry) => normalizeProviderId(entry?.id) === id);
-}
-
-function normalizeAuthority(value) {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
-  const kind = text(value.kind);
-  const locator = text(value.locator);
-  return kind && locator ? { kind, locator } : null;
-}
-
-function catalogFor(providers, id) {
-  return providers.find((entry) => normalizeProviderId(entry?.id) === id) ?? null;
-}
-
-function normalizeOrigin(value) {
-  const origin = text(value) ?? 'unknown';
-  return LIFECYCLE_ORIGINS.has(origin) ? origin : 'unknown';
-}
-
-function normalizeOwnership(value) {
-  const ownership = text(value) ?? 'unknown';
-  return OWNERSHIPS.has(ownership) ? ownership : 'unknown';
-}
-
-function modelIds(provider) {
-  if (!Array.isArray(provider?.models)) return [];
-  return [...new Set(provider.models.map((model) => text(typeof model === 'object' ? model?.id : model)).filter(Boolean))];
-}
-
-/**
- * Build a secret-free provider inventory from live Harness and Crew-owned
- * observations. No credential value is accepted or copied into the result.
- */
-export function buildProviderInventory({ catalog = {}, declarations = [], policy = {}, tombstones = {}, activeJobs = [], additionalProviderIds = [] } = {}) {
-  const catalogProviders = Array.isArray(catalog?.providers) ? catalog.providers : [];
-  const safeDeclarations = Array.isArray(declarations) ? declarations : [];
-  const ids = [];
-  const seen = new Set();
-  for (const source of [catalogProviders, safeDeclarations, Array.isArray(additionalProviderIds) ? additionalProviderIds.map((id) => ({ id })) : []]) {
-    for (const entry of source) {
-      const id = normalizeProviderId(entry?.id);
-      if (!id || seen.has(id)) continue;
-      seen.add(id);
-      ids.push(id);
-    }
-  }
-
-  const harnessDefault = normalizeProviderId(catalog?.harness_default?.provider);
-  const records = ids.map((id) => {
-    const catalogEntry = catalogFor(catalogProviders, id);
-    const providerDeclarations = declarationsFor(safeDeclarations, id);
-    const baseDeclarations = providerDeclarations.filter((entry) => normalizeAuthority(entry?.declaration_authority)?.kind === 'crew-profile');
-    const userDeclarations = providerDeclarations.filter((entry) => normalizeAuthority(entry?.declaration_authority)?.kind === 'harness-settings');
-    const declaration = providerDeclarations[0] ?? null;
-    const declared = declaration !== null;
-    const catalogued = catalogEntry !== null;
-    const tombstoned = tombstones?.[id] === 'absent';
-    const configured = declared;
-    const active = Array.isArray(activeJobs)
-      ? activeJobs.filter((job) => normalizeProviderId(job?.provider) === id
-        && !['done', 'failed', 'cancelled'].includes(job?.status)).length
-      : Number.isInteger(activeJobs?.[id]) ? Math.max(0, activeJobs[id]) : 0;
-    const declarationFile = text(declaration?.file);
-    const locator = text(declaration?.locator);
-
-    const authorities = providerDeclarations.map((entry) => normalizeAuthority(entry.declaration_authority)).filter(Boolean);
-    const uniqueAuthorities = [...new Map(authorities.map((authority) => [`${authority.kind}:${authority.locator}`, authority])).values()];
-    const mutableAuthorities = uniqueAuthorities.filter((authority) => MUTABLE_AUTHORITY_KINDS.has(authority.kind));
-    const immutable = IMMUTABLE_HARNESS_PROVIDER_IDS.includes(id);
-    const allAuthoritiesKnown = providerDeclarations.length > 0
-      && uniqueAuthorities.length === providerDeclarations.length
-      && uniqueAuthorities.every((authority) => MUTABLE_AUTHORITY_KINDS.has(authority.kind));
-    const deleteCapability = immutable ? 'immutable-builtin' : allAuthoritiesKnown && mutableAuthorities.length > 0 ? 'supported' : 'source-unresolved';
-    const deleteBlocker = immutable ? 'PROVIDER_BUILTIN_IMMUTABLE' : deleteCapability === 'supported' ? null : 'PROVIDER_DELETE_SOURCE_UNRESOLVED';
-    const origin = normalizeOrigin(declaration?.origin ?? (immutable ? 'builtin' : declared ? 'profile-managed' : 'unknown'));
-    const ownership = normalizeOwnership(declaration?.ownership ?? (immutable ? 'harness' : declared ? 'crew-managed-profile' : 'unknown'));
-    const credentialProjection = normalizeCredentialRefs(providerDeclarations);
-    return {
-      id,
-      display_name: text(declaration?.display_name) ?? text(declaration?.name) ?? text(catalogEntry?.name) ?? id,
-      origin,
-      ownership,
-      declaration: {
-        ...(declarationFile ? { file: declarationFile } : {}),
-        ...(locator ? { locator } : {}),
-        ...(normalizeAuthority(declaration?.declaration_authority) ? { authority: normalizeAuthority(declaration.declaration_authority) } : {}),
-        present: declared,
-      },
-      declaration_authorities: uniqueAuthorities,
-      layers: {
-        base: [...new Set(baseDeclarations.map((entry) => normalizeAuthority(entry.declaration_authority)?.kind).filter(Boolean))],
-        user: [...new Set(userDeclarations.map((entry) => normalizeAuthority(entry.declaration_authority)?.kind).filter(Boolean))],
-      },
-      native_removable: userDeclarations.length > 0 && baseDeclarations.length === 0,
-      delete_capability: deleteCapability,
-      ...(deleteBlocker ? { delete_blocker: deleteBlocker } : {}),
-      models: modelIds(catalogEntry),
-      lifecycle: {
-        installed: declared || catalogued,
-        configured,
-        enabled: !tombstoned && declaration?.enabled !== false,
-        catalogued,
-      },
-      credential_refs: credentialProjection.refs,
-      ...(credentialProjection.redacted ? { credential_status: 'present-redacted' } : {}),
-      references: {
-        harness_default: harnessDefault === id,
-        ...(harnessDefault === id && normalizeAuthority(catalog?.harness_default_authority) ? { harness_default_authority: normalizeAuthority(catalog.harness_default_authority) } : {}),
-        worker_priority: findPriorityIndex(policy?.worker, 'priority', id),
-        worker_escalation: findPriorityIndex(policy?.worker, 'escalation_priority', id),
-        reviewer_priority: findPriorityIndex(policy?.reviewer ?? policy?.review, 'priority', id),
-        reviewer_escalation: findPriorityIndex(policy?.reviewer ?? policy?.review, 'escalation_priority', id),
-        active_jobs: active,
-      },
-      desired_state: tombstoned ? 'absent' : 'present',
-      activation: declared ? 'restart-required' : 'live',
-    };
-  });
-
-  return { schema_version: 1, records, harness_default: catalog?.harness_default ?? null };
-}
+// Secret-free inventory projection for Harness providers.
+//
+// Harness owns the live provider/model catalog; Crew owns the routing policy
+// and (where explicitly marked) profile provenance. This module only joins
+// those observations into a bounded record set for lifecycle/readiness UIs.
+
+import { classifyCredentialReference } from './credential-reference.mjs';
+
+const LIFECYCLE_ORIGINS = new Set(['builtin', 'profile-managed', 'dynamic', 'unknown']);
+const OWNERSHIPS = new Set(['harness', 'crew-managed-profile', 'user-managed-profile', 'dynamic-user', 'unknown']);
+const MUTABLE_AUTHORITY_KINDS = new Set(['crew-profile', 'harness-settings']);
+export const IMMUTABLE_HARNESS_PROVIDER_IDS = Object.freeze(['deepseek-official']);
+
+function text(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function normalizeProviderId(value) {
+  return text(value);
+}
+
+function normalizeCredentialRefs(declarations) {
+  const entries = Array.isArray(declarations) ? declarations : [declarations];
+  const seen = new Map();
+  const refs = [];
+  let redacted = false;
+  for (const declaration of entries) {
+    const raw = declaration?.credential_refs ?? declaration?.credential_ref;
+    const values = Array.isArray(raw) ? raw : raw === undefined ? [] : [raw];
+    for (const candidate of values) {
+      const kind = text(typeof candidate === 'object' ? candidate.kind : null) ?? 'env';
+      const classified = classifyCredentialReference(candidate, { kind });
+      if (classified.redacted) redacted = true;
+      const name = classified.value;
+      const ownership = text(typeof candidate === 'object' ? candidate.ownership : null) ?? 'crew';
+      const normalized = {
+        kind: ['env', 'crew-store', 'harness-store', 'unknown'].includes(kind) ? kind : 'unknown',
+        name_or_handle: name,
+        ownership: ['crew', 'user', 'external', 'unknown'].includes(ownership) ? ownership : 'unknown',
+      };
+      if (!name) continue;
+      const key = `${normalized.kind}:${normalized.name_or_handle}`;
+      const existing = seen.get(key);
+      if (existing) {
+        if (existing.ownership !== normalized.ownership) existing.ownership = 'unknown';
+      } else {
+        seen.set(key, normalized);
+        refs.push(normalized);
+      }
+    }
+  }
+  return { refs, redacted };
+}
+
+function findPriorityIndex(policy, key, providerId) {
+  const list = Array.isArray(policy?.[key]) ? policy[key] : [];
+  const index = list.findIndex((entry) => normalizeProviderId(entry?.provider) === providerId);
+  return index >= 0 ? index : null;
+}
+
+function declarationsFor(declarations, id) {
+  return declarations.filter((entry) => normalizeProviderId(entry?.id) === id);
+}
+
+function normalizeAuthority(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const kind = text(value.kind);
+  const locator = text(value.locator);
+  return kind && locator ? { kind, locator } : null;
+}
+
+function catalogFor(providers, id) {
+  return providers.find((entry) => normalizeProviderId(entry?.id) === id) ?? null;
+}
+
+function normalizeOrigin(value) {
+  const origin = text(value) ?? 'unknown';
+  return LIFECYCLE_ORIGINS.has(origin) ? origin : 'unknown';
+}
+
+function normalizeOwnership(value) {
+  const ownership = text(value) ?? 'unknown';
+  return OWNERSHIPS.has(ownership) ? ownership : 'unknown';
+}
+
+function modelIds(provider) {
+  if (!Array.isArray(provider?.models)) return [];
+  return [...new Set(provider.models.map((model) => text(typeof model === 'object' ? model?.id : model)).filter(Boolean))];
+}
+
+/**
+ * Build a secret-free provider inventory from live Harness and Crew-owned
+ * observations. No credential value is accepted or copied into the result.
+ */
+export function buildProviderInventory({ catalog = {}, declarations = [], policy = {}, tombstones = {}, activeJobs = [], additionalProviderIds = [] } = {}) {
+  const catalogProviders = Array.isArray(catalog?.providers) ? catalog.providers : [];
+  const safeDeclarations = Array.isArray(declarations) ? declarations : [];
+  const ids = [];
+  const seen = new Set();
+  for (const source of [catalogProviders, safeDeclarations, Array.isArray(additionalProviderIds) ? additionalProviderIds.map((id) => ({ id })) : []]) {
+    for (const entry of source) {
+      const id = normalizeProviderId(entry?.id);
+      if (!id || seen.has(id)) continue;
+      seen.add(id);
+      ids.push(id);
+    }
+  }
+
+  const harnessDefault = normalizeProviderId(catalog?.harness_default?.provider);
+  const records = ids.map((id) => {
+    const catalogEntry = catalogFor(catalogProviders, id);
+    const providerDeclarations = declarationsFor(safeDeclarations, id);
+    const baseDeclarations = providerDeclarations.filter((entry) => normalizeAuthority(entry?.declaration_authority)?.kind === 'crew-profile');
+    const userDeclarations = providerDeclarations.filter((entry) => normalizeAuthority(entry?.declaration_authority)?.kind === 'harness-settings');
+    const declaration = providerDeclarations[0] ?? null;
+    const declared = declaration !== null;
+    const catalogued = catalogEntry !== null;
+    const tombstoned = tombstones?.[id] === 'absent';
+    const configured = declared;
+    const active = Array.isArray(activeJobs)
+      ? activeJobs.filter((job) => normalizeProviderId(job?.provider) === id
+        && !['done', 'failed', 'cancelled'].includes(job?.status)).length
+      : Number.isInteger(activeJobs?.[id]) ? Math.max(0, activeJobs[id]) : 0;
+    const declarationFile = text(declaration?.file);
+    const locator = text(declaration?.locator);
+
+    const authorities = providerDeclarations.map((entry) => normalizeAuthority(entry.declaration_authority)).filter(Boolean);
+    const uniqueAuthorities = [...new Map(authorities.map((authority) => [`${authority.kind}:${authority.locator}`, authority])).values()];
+    const mutableAuthorities = uniqueAuthorities.filter((authority) => MUTABLE_AUTHORITY_KINDS.has(authority.kind));
+    const immutable = IMMUTABLE_HARNESS_PROVIDER_IDS.includes(id);
+    const allAuthoritiesKnown = providerDeclarations.length > 0
+      && uniqueAuthorities.length === providerDeclarations.length
+      && uniqueAuthorities.every((authority) => MUTABLE_AUTHORITY_KINDS.has(authority.kind));
+    const deleteCapability = immutable ? 'immutable-builtin' : allAuthoritiesKnown && mutableAuthorities.length > 0 ? 'supported' : 'source-unresolved';
+    const deleteBlocker = immutable ? 'PROVIDER_BUILTIN_IMMUTABLE' : deleteCapability === 'supported' ? null : 'PROVIDER_DELETE_SOURCE_UNRESOLVED';
+    const origin = normalizeOrigin(declaration?.origin ?? (immutable ? 'builtin' : declared ? 'profile-managed' : 'unknown'));
+    const ownership = normalizeOwnership(declaration?.ownership ?? (immutable ? 'harness' : declared ? 'crew-managed-profile' : 'unknown'));
+    const credentialProjection = normalizeCredentialRefs(providerDeclarations);
+    return {
+      id,
+      display_name: text(declaration?.display_name) ?? text(declaration?.name) ?? text(catalogEntry?.name) ?? id,
+      origin,
+      ownership,
+      declaration: {
+        ...(declarationFile ? { file: declarationFile } : {}),
+        ...(locator ? { locator } : {}),
+        ...(normalizeAuthority(declaration?.declaration_authority) ? { authority: normalizeAuthority(declaration.declaration_authority) } : {}),
+        present: declared,
+      },
+      declaration_authorities: uniqueAuthorities,
+      layers: {
+        base: [...new Set(baseDeclarations.map((entry) => normalizeAuthority(entry.declaration_authority)?.kind).filter(Boolean))],
+        user: [...new Set(userDeclarations.map((entry) => normalizeAuthority(entry.declaration_authority)?.kind).filter(Boolean))],
+      },
+      native_removable: userDeclarations.length > 0 && baseDeclarations.length === 0,
+      delete_capability: deleteCapability,
+      ...(deleteBlocker ? { delete_blocker: deleteBlocker } : {}),
+      models: modelIds(catalogEntry),
+      lifecycle: {
+        installed: declared || catalogued,
+        configured,
+        enabled: !tombstoned && declaration?.enabled !== false,
+        catalogued,
+      },
+      credential_refs: credentialProjection.refs,
+      ...(credentialProjection.redacted ? { credential_status: 'present-redacted' } : {}),
+      references: {
+        harness_default: harnessDefault === id,
+        ...(harnessDefault === id && normalizeAuthority(catalog?.harness_default_authority) ? { harness_default_authority: normalizeAuthority(catalog.harness_default_authority) } : {}),
+        worker_priority: findPriorityIndex(policy?.worker, 'priority', id),
+        worker_escalation: findPriorityIndex(policy?.worker, 'escalation_priority', id),
+        reviewer_priority: findPriorityIndex(policy?.reviewer ?? policy?.review, 'priority', id),
+        reviewer_escalation: findPriorityIndex(policy?.reviewer ?? policy?.review, 'escalation_priority', id),
+        active_jobs: active,
+      },
+      desired_state: tombstoned ? 'absent' : 'present',
+      activation: declared ? 'restart-required' : 'live',
+    };
+  });
+
+  return { schema_version: 1, records, harness_default: catalog?.harness_default ?? null };
+}