@skrr-ai/cli 0.1.92 → 0.1.93

package/dist/lib/json-output.js

@@ -0,0 +1,78 @@
+"use strict";
+/**
+ * Storage-field stripping for `--json` output (audit P9).
+ *
+ * The API returns Mongo documents, so every row carries `_id` and `__v` beside
+ * the real `id`: 47 keys per task row, two of which are storage detail an agent
+ * pays tokens for and can mistake for the identifier (OSK-12205 was exactly
+ * that: a 24-hex `_id` passed where a task id was wanted).
+ *
+ * This runs at the CLI SERIALIZER only (`BaseCommand.log`), never in the API or
+ * the data layer, so no other consumer's payload changes. `--raw` (or
+ * `OVERSKY_CLI_RAW=1`) turns it off for the caller that does want them.
+ *
+ * Two rules, both conservative:
+ *   - `__v` is the Mongoose version key and is always dropped.
+ *   - `_id` is dropped only when the same object has a usable `id`. A row that
+ *     has ONLY `_id` (some legacy collections) keeps it: removing the sole
+ *     identifier would turn a cosmetic cleanup into data loss.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stripStorageFields = stripStorageFields;
+exports.stripStorageFieldsFromText = stripStorageFieldsFromText;
+function usableId(value) {
+    return (typeof value === 'string' && value.length > 0) || typeof value === 'number';
+}
+/**
+ * Returns the SAME reference when nothing needed stripping, so a caller can tell
+ * "unchanged" apart from "rebuilt" and leave the original text alone.
+ */
+function stripStorageFields(value) {
+    if (Array.isArray(value)) {
+        let changed = false;
+        const next = value.map((item) => {
+            const stripped = stripStorageFields(item);
+            if (stripped !== item)
+                changed = true;
+            return stripped;
+        });
+        return changed ? next : value;
+    }
+    if (value === null || typeof value !== 'object')
+        return value;
+    const source = value;
+    const dropId = '_id' in source && usableId(source.id);
+    const dropVersion = '__v' in source;
+    let changed = dropId || dropVersion;
+    const next = {};
+    for (const [key, child] of Object.entries(source)) {
+        if ((key === '_id' && dropId) || (key === '__v' && dropVersion))
+            continue;
+        const stripped = stripStorageFields(child);
+        if (stripped !== child)
+            changed = true;
+        next[key] = stripped;
+    }
+    return changed ? next : value;
+}
+/**
+ * Apply {@link stripStorageFields} to one line of CLI output. Anything that is
+ * not a JSON object/array (prose, a bare string, malformed text) is returned
+ * untouched, as is JSON with nothing to strip, so existing formatting survives.
+ */
+function stripStorageFieldsFromText(text) {
+    const head = text.trimStart()[0];
+    if (head !== '{' && head !== '[')
+        return text;
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+    const stripped = stripStorageFields(parsed);
+    if (stripped === parsed)
+        return text;
+    return JSON.stringify(stripped, null, text.includes('\n') ? 2 : undefined);
+}

package/dist/lib/list-output.d.ts

@@ -0,0 +1,75 @@
+export type ListWarning = {
+    code: string;
+    value?: unknown;
+    hint: string;
+};
+export type ListEnvelope = {
+    object: 'list';
+    data: Array<Record<string, unknown>>;
+    has_more: boolean;
+    next_cursor: string | null;
+    limit_applied?: number;
+    warnings?: ListWarning[];
+} & Record<string, unknown>;
+/**
+ * The navigation projection per resource: enough to identify a row, decide
+ * whether it matters and fetch it with `show`. Allowlists, not drop-lists, so a
+ * field the server adds tomorrow does not silently re-inflate every compact row.
+ * Documented in docs/cli/SKRR_TASKS.md (List output for agents).
+ */
+export declare const COMPACT_FIELDS: {
+    readonly task: readonly ["id", "identifier", "ref", "title", "status", "statusType", "priority", "estimate", "assigneeAgentIds", "assigneeUserIds", "parentId", "spaceId", "projectId", "goalId", "dueDate", "scheduledFor", "labelIds", "tags", "externalKey", "version", "executionMode", "nextAction", "createdAt", "updatedAt", "url"];
+    readonly space: readonly ["id", "identifier", "title", "status", "parentSpaceId", "leadAgentId", "labelIds", "archivedAt", "createdAt", "updatedAt", "url"];
+    readonly project: readonly ["id", "identifier", "title", "spaceId", "externalKey", "taskCounts", "archivedAt", "createdAt", "updatedAt", "url"];
+};
+export type ListResource = keyof typeof COMPACT_FIELDS;
+/** The three flags every projecting list command declares. */
+export declare const listOutputFlags: {
+    fields: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    compact: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    ndjson: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+};
+export type ListOutputFlags = {
+    fields?: string;
+    compact?: boolean;
+    ndjson?: boolean;
+};
+/** `--fields a, b ,c` -> ['a','b','c']; empty/blank -> undefined. */
+export declare function parseFields(raw: string | undefined): string[] | undefined;
+export declare function projectRow(row: Record<string, unknown>, fields: readonly string[]): Record<string, unknown>;
+/**
+ * Normalize any list response to the shared envelope. `data` is where rows live
+ * for every list command; `projects` (an older serialization) is folded into it.
+ * A response that is not list-shaped is returned untouched (never invent rows).
+ */
+export declare function toListEnvelope(response: unknown): ListEnvelope | undefined;
+export type ShapeListOptions = ListOutputFlags & {
+    resource: ListResource;
+    /** What the caller asked for with --limit (undefined when the command has none). */
+    requestedLimit?: number;
+    warnings?: ListWarning[];
+    /** A filter the CLI applied that the caller did not ask for (E12). Echoed as `filter_applied`. */
+    filterApplied?: Record<string, unknown>;
+};
+/** Pure: envelope + projection + notes. Returns the response untouched if not a list. */
+export declare function shapeListResponse(response: unknown, options: ShapeListOptions): unknown;
+/**
+ * E11: the server silently clamps `--limit` (cap) and coerces `0` to its default.
+ * Echo what was applied. `applied` is only reported when we can prove it: a full
+ * page that still has more rows means the cap is exactly the row count.
+ */
+export declare function limitNote(requested: number | undefined, rowCount: number, hasMore: boolean): {
+    applied?: number;
+    warning?: ListWarning;
+};
+/** The text-mode twin of a warning: one `Note:` line a person can act on. */
+export declare function warningLines(warnings: readonly ListWarning[] | undefined): string[];
+export type ListOutput = {
+    stdout: string[];
+    stderr: string[];
+};
+/**
+ * Render a shaped list for `--json` (pretty envelope) or `--ndjson` (rows one per
+ * line, `_meta` on stderr). Pure; the caller writes the lines.
+ */
+export declare function renderListOutput(shaped: unknown, ndjson: boolean): ListOutput;

package/dist/lib/list-output.js

@@ -0,0 +1,266 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listOutputFlags = exports.COMPACT_FIELDS = void 0;
+exports.parseFields = parseFields;
+exports.projectRow = projectRow;
+exports.toListEnvelope = toListEnvelope;
+exports.shapeListResponse = shapeListResponse;
+exports.limitNote = limitNote;
+exports.warningLines = warningLines;
+exports.renderListOutput = renderListOutput;
+/**
+ * Shared output shaping for `skrr` LIST commands (agent-surface audit
+ * OSK-14039 / OSK-14040: P3, P4, E1, E11).
+ *
+ * A list command's `--json` used to print whatever the server sent: 4.4 KB per
+ * task, 38% of it `activityLog`, with no way to ask for less, and an envelope
+ * that differed per command. This module is the one place that decides:
+ *
+ *   - the ENVELOPE: `{object:'list', data, has_more, next_cursor, ...}`, the same
+ *     for every list command (`data` is always the row array, so a consumer that
+ *     read `.data` keeps working);
+ *   - the PROJECTION: `--fields a,b,c` (explicit, wins) or `--compact` (a
+ *     documented per-resource navigation set), applied to `data` rows only;
+ *   - `--ndjson`: one JSON row per line on stdout, metadata on stderr;
+ *   - NOTES: `limit_applied` / `warnings[]`, so "the server clamped your limit" and
+ *     "your filter matched nothing because it is not a state id" are visible in
+ *     JSON the way they already are in text.
+ *
+ * Pure functions, no oclif: the commands own I/O, this owns the shape.
+ */
+const core_1 = require("@oclif/core");
+/**
+ * The navigation projection per resource: enough to identify a row, decide
+ * whether it matters and fetch it with `show`. Allowlists, not drop-lists, so a
+ * field the server adds tomorrow does not silently re-inflate every compact row.
+ * Documented in docs/cli/SKRR_TASKS.md (List output for agents).
+ */
+exports.COMPACT_FIELDS = {
+    task: [
+        'id',
+        'identifier',
+        'ref',
+        'title',
+        'status',
+        'statusType',
+        'priority',
+        'estimate',
+        'assigneeAgentIds',
+        'assigneeUserIds',
+        'parentId',
+        'spaceId',
+        'projectId',
+        'goalId',
+        'dueDate',
+        'scheduledFor',
+        'labelIds',
+        'tags',
+        'externalKey',
+        'version',
+        'executionMode',
+        'nextAction',
+        'createdAt',
+        'updatedAt',
+        'url',
+    ],
+    space: [
+        'id',
+        'identifier',
+        'title',
+        'status',
+        'parentSpaceId',
+        'leadAgentId',
+        'labelIds',
+        'archivedAt',
+        'createdAt',
+        'updatedAt',
+        'url',
+    ],
+    project: [
+        'id',
+        'identifier',
+        'title',
+        'spaceId',
+        'externalKey',
+        'taskCounts',
+        'archivedAt',
+        'createdAt',
+        'updatedAt',
+        'url',
+    ],
+};
+/** The three flags every projecting list command declares. */
+exports.listOutputFlags = {
+    fields: core_1.Flags.string({
+        description: 'JSON only: comma-separated fields to keep on each row (dotted paths allowed, e.g. id,title,assignee.name). Wins over --compact.',
+    }),
+    compact: core_1.Flags.boolean({
+        description: 'JSON only: keep the navigation fields of each row (id, ref, title, status, owners, dates, url) and drop activity logs, lifecycle and other bulk. See docs/cli/SKRR_TASKS.md (List output for agents).',
+    }),
+    ndjson: core_1.Flags.boolean({
+        description: 'One JSON object per line on stdout (rows only; paging and warnings go to stderr as one {"_meta":...} line). Implies --json.',
+    }),
+};
+/** `--fields a, b ,c` -> ['a','b','c']; empty/blank -> undefined. */
+function parseFields(raw) {
+    if (!raw)
+        return undefined;
+    const fields = raw
+        .split(',')
+        .map((f) => f.trim())
+        .filter(Boolean);
+    return fields.length > 0 ? Array.from(new Set(fields)) : undefined;
+}
+function pick(row, path) {
+    let current = row;
+    for (const segment of path.split('.')) {
+        if (current === null || typeof current !== 'object' || !(segment in current)) {
+            return { found: false, value: undefined };
+        }
+        current = current[segment];
+    }
+    return { found: true, value: current };
+}
+function assign(target, path, value) {
+    const segments = path.split('.');
+    let cursor = target;
+    for (const segment of segments.slice(0, -1)) {
+        const next = cursor[segment];
+        if (next === null || typeof next !== 'object' || Array.isArray(next))
+            cursor[segment] = {};
+        cursor = cursor[segment];
+    }
+    cursor[segments[segments.length - 1]] = value;
+}
+function projectRow(row, fields) {
+    const out = {};
+    for (const field of fields) {
+        const { found, value } = pick(row, field);
+        if (found)
+            assign(out, field, value);
+    }
+    return out;
+}
+/**
+ * Normalize any list response to the shared envelope. `data` is where rows live
+ * for every list command; `projects` (an older serialization) is folded into it.
+ * A response that is not list-shaped is returned untouched (never invent rows).
+ */
+function toListEnvelope(response) {
+    if (Array.isArray(response)) {
+        return {
+            object: 'list',
+            data: response,
+            has_more: false,
+            next_cursor: null,
+        };
+    }
+    if (!response || typeof response !== 'object')
+        return undefined;
+    const r = response;
+    const rows = Array.isArray(r.data) ? r.data : Array.isArray(r.projects) ? r.projects : undefined;
+    if (!rows)
+        return undefined;
+    const { projects: _legacy, ...rest } = r;
+    void _legacy;
+    return {
+        ...rest,
+        object: 'list',
+        data: rows,
+        has_more: typeof r.has_more === 'boolean' ? r.has_more : Boolean(r.next_cursor),
+        next_cursor: typeof r.next_cursor === 'string' ? r.next_cursor : null,
+    };
+}
+/** Pure: envelope + projection + notes. Returns the response untouched if not a list. */
+function shapeListResponse(response, options) {
+    const envelope = toListEnvelope(response);
+    if (!envelope)
+        return response;
+    const warnings = [...(options.warnings ?? [])];
+    const fields = parseFields(options.fields);
+    let data = envelope.data;
+    if (fields) {
+        data = data.map((row) => projectRow(row, fields));
+        if (envelope.data.length > 0) {
+            for (const field of fields) {
+                if (!envelope.data.some((row) => pick(row, field).found)) {
+                    warnings.push({
+                        code: 'UNKNOWN_FIELD',
+                        value: field,
+                        hint: `No row carried "${field}". Run without --fields to see the available keys.`,
+                    });
+                }
+            }
+        }
+    }
+    else if (options.compact) {
+        const keep = exports.COMPACT_FIELDS[options.resource];
+        data = data.map((row) => {
+            const kept = projectRow(row, keep);
+            // A row that carries none of the navigation fields is an unknown shape;
+            // dropping it to `{}` would hide it rather than compact it.
+            return Object.keys(kept).length > 0 ? kept : row;
+        });
+    }
+    const limit = limitNote(options.requestedLimit, envelope.data.length, envelope.has_more);
+    if (limit.warning)
+        warnings.push(limit.warning);
+    return {
+        ...envelope,
+        data,
+        ...(limit.applied !== undefined ? { limit_applied: limit.applied } : {}),
+        ...(options.filterApplied ? { filter_applied: options.filterApplied } : {}),
+        ...(warnings.length > 0 ? { warnings } : {}),
+    };
+}
+/**
+ * E11: the server silently clamps `--limit` (cap) and coerces `0` to its default.
+ * Echo what was applied. `applied` is only reported when we can prove it: a full
+ * page that still has more rows means the cap is exactly the row count.
+ */
+function limitNote(requested, rowCount, hasMore) {
+    if (requested === undefined)
+        return {};
+    if (requested <= 0) {
+        return {
+            applied: hasMore ? rowCount : undefined,
+            warning: {
+                code: 'LIMIT_COERCED',
+                value: requested,
+                hint: '--limit must be >= 1; the server applied its default page size instead. Pass an explicit positive --limit.',
+            },
+        };
+    }
+    if (hasMore && rowCount > 0 && rowCount < requested) {
+        return {
+            applied: rowCount,
+            warning: {
+                code: 'LIMIT_CLAMPED',
+                value: requested,
+                hint: `The server returned ${rowCount} rows, its per-page cap, not the ${requested} requested. Follow next_cursor for the rest.`,
+            },
+        };
+    }
+    return {};
+}
+/** The text-mode twin of a warning: one `Note:` line a person can act on. */
+function warningLines(warnings) {
+    return (warnings ?? []).map((w) => `Note: ${w.hint}`);
+}
+/**
+ * Render a shaped list for `--json` (pretty envelope) or `--ndjson` (rows one per
+ * line, `_meta` on stderr). Pure; the caller writes the lines.
+ */
+function renderListOutput(shaped, ndjson) {
+    if (!ndjson)
+        return { stdout: [JSON.stringify(shaped, null, 2)], stderr: [] };
+    const envelope = shaped;
+    if (!envelope || !Array.isArray(envelope.data)) {
+        return { stdout: [JSON.stringify(shaped)], stderr: [] };
+    }
+    const { data, ...meta } = envelope;
+    return {
+        stdout: data.map((row) => JSON.stringify(row)),
+        stderr: [JSON.stringify({ _meta: meta })],
+    };
+}

package/dist/lib/machine-daemon-log.d.ts

@@ -0,0 +1,36 @@
+import { COMPUTER_DAEMON_LOG_LEVELS, COMPUTER_DAEMON_LOG_LIMITS, type ComputerDaemonLogResult } from '@skrr-ai/data-provider';
+import { type ComputerFileFailure } from './computer-files';
+/**
+ * machine-daemon-log.ts — request client for `GET /api/machines/:machineId/daemon-log`
+ * (`computer_daemon_log_v1`): the tail of what a machine's daemon logged about
+ * itself, so an owner can see why it reconnected, re-registered or failed
+ * without reading syslog (which a Dedicated Runtime guest's tenant uid cannot).
+ *
+ * The daemon serves an in-memory ring of its OWN logger's lines, redacted
+ * before they were kept; a `watch` grantee reads it too. Vocabulary, limits
+ * and the result shape are owned by `@skrr-ai/data-provider`.
+ *
+ * ## Inline path literal
+ *
+ * `domain-api-parity` resolves a command to an endpoint by reading this
+ * string; a helper that assembled the URL would read as unreachable.
+ */
+export { COMPUTER_DAEMON_LOG_LEVELS, COMPUTER_DAEMON_LOG_LIMITS };
+export type { ComputerDaemonLogResult };
+export interface MachineDaemonLogQuery {
+    lines?: number;
+    sinceMs?: number;
+    level?: (typeof COMPUTER_DAEMON_LOG_LEVELS)[number];
+}
+export declare function getMachineDaemonLog(machineId: string, query?: MachineDaemonLogQuery): Promise<ComputerDaemonLogResult>;
+/** `--since 90s|30m|2h|1d` as milliseconds, bounded by what the daemon will look back. */
+export declare function parseDaemonLogSince(value: string): number;
+/**
+ * A failed read as the sentence the command prints. `capability_missing` is the
+ * zero state: this machine's daemon predates the log, and the fix is the image.
+ * `consent_missing` is a personal machine that has not run `skrr computer allow`.
+ */
+export declare function describeDaemonLogFailure(err: unknown, ctx: {
+    bin: string;
+    leaseId: string;
+}): ComputerFileFailure | null;

package/dist/lib/machine-daemon-log.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMPUTER_DAEMON_LOG_LIMITS = exports.COMPUTER_DAEMON_LOG_LEVELS = void 0;
+exports.getMachineDaemonLog = getMachineDaemonLog;
+exports.parseDaemonLogSince = parseDaemonLogSince;
+exports.describeDaemonLogFailure = describeDaemonLogFailure;
+const data_provider_1 = require("@skrr-ai/data-provider");
+Object.defineProperty(exports, "COMPUTER_DAEMON_LOG_LEVELS", { enumerable: true, get: function () { return data_provider_1.COMPUTER_DAEMON_LOG_LEVELS; } });
+Object.defineProperty(exports, "COMPUTER_DAEMON_LOG_LIMITS", { enumerable: true, get: function () { return data_provider_1.COMPUTER_DAEMON_LOG_LIMITS; } });
+const api_fetch_1 = require("./api-fetch");
+const computer_files_1 = require("./computer-files");
+async function getMachineDaemonLog(machineId, query = {}) {
+    const params = new URLSearchParams();
+    if (query.lines !== undefined)
+        params.set('lines', String(query.lines));
+    if (query.sinceMs !== undefined)
+        params.set('sinceMs', String(query.sinceMs));
+    if (query.level)
+        params.set('level', query.level);
+    const qs = params.toString();
+    const suffix = qs ? `?${qs}` : '';
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/daemon-log` + suffix);
+}
+const SINCE_UNIT_MS = {
+    s: 1000,
+    m: 60_000,
+    h: 3_600_000,
+    d: 86_400_000,
+};
+/** `--since 90s|30m|2h|1d` as milliseconds, bounded by what the daemon will look back. */
+function parseDaemonLogSince(value) {
+    const match = value.trim().match(/^(\d+)([smhd])$/i);
+    if (!match) {
+        throw new Error(`Invalid --since value: ${value}. Use an age such as 90s, 30m, 2h or 1d.`);
+    }
+    const ms = Number(match[1]) * SINCE_UNIT_MS[match[2].toLowerCase()];
+    if (ms < 1 || ms > data_provider_1.COMPUTER_DAEMON_LOG_LIMITS.maxSinceMs) {
+        throw new Error(`--since must be between 1s and ${data_provider_1.COMPUTER_DAEMON_LOG_LIMITS.maxSinceMs / 3_600_000}h; the daemon keeps a short, recent log.`);
+    }
+    return ms;
+}
+/**
+ * A failed read as the sentence the command prints. `capability_missing` is the
+ * zero state: this machine's daemon predates the log, and the fix is the image.
+ * `consent_missing` is a personal machine that has not run `skrr computer allow`.
+ */
+function describeDaemonLogFailure(err, ctx) {
+    const refusal = (0, computer_files_1.computerFileRefusalInfo)(err);
+    if (refusal?.code === 'capability_missing') {
+        return {
+            message: `This machine's daemon predates daemon logs, so it has none to show. ` +
+                `\`${ctx.bin} machines dedicated update-image ${ctx.leaseId}\` moves the machine onto the current image, which keeps one.`,
+            code: 'capability_missing',
+            status: refusal.status,
+            retryable: false,
+            details: refusal.body,
+        };
+    }
+    if (refusal?.code === 'consent_missing') {
+        return {
+            message: `${refusal.message} The person who uses the machine sets this on it: \`${ctx.bin} computer allow\`.`,
+            code: 'consent_missing',
+            status: refusal.status,
+            retryable: false,
+            details: refusal.body,
+        };
+    }
+    if (refusal?.code === 'unauthorized') {
+        return {
+            message: `${refusal.message} Reading a machine's daemon log needs at least the watch tier — see \`${ctx.bin} machines shares ${ctx.leaseId}\`.`,
+            code: 'unauthorized',
+            status: refusal.status,
+            retryable: false,
+            details: refusal.body,
+        };
+    }
+    return (0, computer_files_1.describeComputerFileFailure)(err, ctx);
+}

package/dist/lib/node-adapter.js

@@ -18,6 +18,7 @@ const delegated_cli_1 = require("./delegated-cli");
 const workspace_header_1 = require("./workspace-header");
 const non_json_response_1 = require("./non-json-response");
 require("./auth-core-init");
+const rate_limit_retry_1 = require("./rate-limit-retry");
 // ---------------------------------------------------------------------
 // Per-process credential override — set by BaseCommand.init().
 // Pulled out of the closure so test harnesses or long-lived callers
@@ -146,6 +147,8 @@ function createNodeAdapter(opts = {}) {
         }
         return u.toString();
     }
+    /** The last 429's `Retry-After`, read off the response of the most recent attempt. */
+    let lastRetryAfterMs;
     async function rawRequest(method, url, body, options, isFormData) {
         const headers = buildHeaders(options?.headers);
         let finalBody;
@@ -163,7 +166,10 @@ function createNodeAdapter(opts = {}) {
         // OSK-12020 — a DPoP-bound hand-off token needs a fresh proof per request
         // (and per retry: proofs are single-use). No-op for every other token.
         Object.assign(headers, await (0, dpop_auth_1.dpopHeadersFor)(currentCredential().token, method, finalUrl));
-        return fetch(finalUrl, { method, headers, body: finalBody });
+        // E6: bounded retry on 429 for a GET or an idempotency-keyed write.
+        const { response, retryAfterMs } = await (0, rate_limit_retry_1.fetchWithRateLimitRetry)(() => fetch(finalUrl, { method, headers, body: finalBody }), { method, headers });
+        lastRetryAfterMs = retryAfterMs;
+        return response;
     }
     /**
      * Inner refresh: delegates to `refresh.ts`, the shared CLI refresh
@@ -359,6 +365,9 @@ function createNodeAdapter(opts = {}) {
             // "which of these requests was mine" is otherwise unanswerable, and a
             // 409 that belonged to another session was nearly filed as a CLI bug.
             err.requestId = res.headers.get('x-request-id') || undefined;
+            if (res.status === 429 && lastRetryAfterMs !== undefined) {
+                err.retryAfterMs = lastRetryAfterMs;
+            }
             throw err;
         }
         if (options?.responseType === 'arraybuffer') {

package/dist/lib/open-target.d.ts

@@ -0,0 +1,12 @@
+export declare const OPEN_REF_KINDS: readonly string[];
+export type OpenTargetErrorCode = 'OPEN_TARGET_EMPTY' | 'OPEN_TARGET_FOREIGN' | 'OPEN_TARGET_UNKNOWN';
+export declare class OpenTargetError extends Error {
+    readonly code: OpenTargetErrorCode;
+    constructor(message: string, code: OpenTargetErrorCode);
+}
+export type ResolvedOpenTarget = {
+    url: string;
+    /** Which spelling was given — echoed by `--json` so a script can tell. */
+    form: 'url' | 'path' | 'ref' | 'agent';
+};
+export declare function resolveOpenTarget(input: string, baseURL: string): Promise<ResolvedOpenTarget>;