@tangle-network/braid 0.1.0

package/dist/bin/production-setup-discovery.js

@@ -0,0 +1,115 @@
+import { DEFAULT_TANGLE_INFERENCE_ENDPOINT, isLoopbackEndpoint, stripCliBridgeVersion, } from '../adapters/connections/production-connection-endpoints.js';
+import { DEFAULT_TANGLE_SANDBOX_ENDPOINT } from '../adapters/connections/production-connection-types.js';
+import { discoverProfiles } from '../app/profiles.js';
+import { createConnectionId } from '../domain/ids.js';
+import { normalizeBridgeEndpoint, ProductionBridgeRequestError, } from './production-bridge-client.js';
+import { discoverBridge } from './production-bridge-discovery.js';
+import { recoverPendingConnectionCredentialRemoval } from './production-connection-credential-cleanup.js';
+import { productionConfigPath, resolveProductionDatabaseKeyFile } from './production-key-path.js';
+import { projectSetupProfiles, trustedProfileSources } from './production-profile-projection.js';
+import { recoverPendingProductionCredential } from './production-setup-credentials.js';
+import { ProductionStartupError } from './production-startup.js';
+export const DEFAULT_CLI_BRIDGE_ENDPOINT = 'http://127.0.0.1:3344';
+function cliBridgeEndpoint(options) {
+    return options.cliBridgeEndpoint ?? DEFAULT_CLI_BRIDGE_ENDPOINT;
+}
+function canonicalBridgeEndpoint(options) {
+    const configured = cliBridgeEndpoint(options);
+    try {
+        const endpoint = stripCliBridgeVersion(normalizeBridgeEndpoint(configured));
+        if (new URL(endpoint).protocol === 'http:' && !isLoopbackEndpoint(endpoint)) {
+            throw new ProductionBridgeRequestError('BRIDGE_ENDPOINT_INVALID', endpoint, 'CLI Bridge discovery rejects remote HTTP; use HTTPS or a loopback endpoint');
+        }
+        return endpoint;
+    }
+    catch (error) {
+        throw new ProductionStartupError('PRODUCTION_CONFIGURATION_INVALID', error instanceof ProductionBridgeRequestError
+            ? error.message
+            : 'The selected CLI Bridge endpoint is invalid; use an HTTP(S) URL without credentials, query, or fragment data', error);
+    }
+}
+function cliBridgeConnection(endpoint, health) {
+    const now = new Date().toISOString();
+    return {
+        id: createConnectionId('connection-local-cli-bridge'),
+        kind: 'cli-bridge',
+        name: 'Local CLI Bridge',
+        endpoint,
+        providerOptions: {
+            transport: 'local',
+            capabilityHints: ['stream', 'usage'],
+        },
+        createdAt: now,
+        updatedAt: now,
+        lastHealth: health,
+    };
+}
+function tangleConnection(kind, now) {
+    const inference = kind === 'tangle-inference';
+    return {
+        id: createConnectionId(inference ? 'connection-tangle-inference' : 'connection-tangle-sandbox'),
+        kind,
+        name: inference ? 'Tangle Inference' : 'Tangle Sandbox',
+        endpoint: inference ? DEFAULT_TANGLE_INFERENCE_ENDPOINT : DEFAULT_TANGLE_SANDBOX_ENDPOINT,
+        providerOptions: {
+            transport: 'https',
+            capabilityHints: inference ? ['stream', 'usage'] : ['stream', 'placement', 'usage'],
+        },
+        createdAt: now,
+        updatedAt: now,
+        lastHealth: { status: 'unknown' },
+    };
+}
+/** Composes first-run setup from independently bounded bridge and profile services. */
+export async function loadProductionSetup(options) {
+    if (!options.workspace) {
+        throw new ProductionStartupError('PRODUCTION_CONFIGURATION_REQUIRED', 'Production startup requires a workspace path');
+    }
+    const configPath = productionConfigPath(options.workspace, options.configPath);
+    if (options.databaseKeyFile !== undefined) {
+        resolveProductionDatabaseKeyFile(options.databaseKeyFile, configPath, options.workspace);
+    }
+    await recoverPendingProductionCredential(configPath, {
+        ...(options.credentialStore === undefined ? {} : { credentialStore: options.credentialStore }),
+        ...(options.credentialContext === undefined
+            ? {}
+            : { credentialContext: options.credentialContext }),
+    });
+    await recoverPendingConnectionCredentialRemoval(configPath, {
+        ...(options.credentialStore === undefined ? {} : { credentialStore: options.credentialStore }),
+        ...(options.credentialContext === undefined
+            ? {}
+            : { credentialContext: options.credentialContext }),
+        ...(options.credentialRefResolver === undefined
+            ? {}
+            : { credentialRefResolver: options.credentialRefResolver }),
+    });
+    const endpoint = canonicalBridgeEndpoint(options);
+    const [bridge, discovered] = await Promise.all([
+        discoverBridge(options, endpoint),
+        discoverProfiles({
+            explicit: trustedProfileSources(options),
+            resolverContext: { workspaceRoot: options.workspace },
+        }),
+    ]);
+    const profiles = projectSetupProfiles(options, endpoint, bridge.models, discovered);
+    const now = new Date().toISOString();
+    return {
+        configPath,
+        profiles: profiles.profiles,
+        connections: [
+            cliBridgeConnection(endpoint, bridge.health),
+            tangleConnection('tangle-inference', now),
+            tangleConnection('tangle-sandbox', now),
+        ],
+        diagnostics: [...bridge.diagnostics, ...profiles.diagnostics],
+        ...(profiles.initialProfileId === undefined
+            ? {}
+            : { initialProfileId: profiles.initialProfileId }),
+        verification: {
+            status: 'unverified',
+            detail: 'Discovery only: /health and /v1/models do not prove that the selected model can authenticate or run.',
+        },
+    };
+}
+//# sourceMappingURL=production-setup-discovery.js.map

package/dist/bin/production-setup-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-setup-discovery.js","sourceRoot":"","sources":["../../src/bin/production-setup-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iCAAiC,EACjC,kBAAkB,EAClB,qBAAqB,GACtB,MAAM,4DAA4D,CAAA;AACnE,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAA;AACxG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EACL,uBAAuB,EACvB,4BAA4B,GAC7B,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAA;AACjE,OAAO,EAAE,yCAAyC,EAAE,MAAM,+CAA+C,CAAA;AACzG,OAAO,EAAE,oBAAoB,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAA;AACjG,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAA;AAChG,OAAO,EAAE,kCAAkC,EAAE,MAAM,mCAAmC,CAAA;AAEtF,OAAO,EAAE,sBAAsB,EAAqC,MAAM,yBAAyB,CAAA;AAEnG,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAA;AAElE,SAAS,iBAAiB,CAAC,OAAqC;IAC9D,OAAO,OAAO,CAAC,iBAAiB,IAAI,2BAA2B,CAAA;AACjE,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAqC;IACpE,MAAM,UAAU,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC7C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,qBAAqB,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAA;QAC3E,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,4BAA4B,CACpC,yBAAyB,EACzB,QAAQ,EACR,4EAA4E,CAC7E,CAAA;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,sBAAsB,CAC9B,kCAAkC,EAClC,KAAK,YAAY,4BAA4B;YAC3C,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,8GAA8G,EAClH,KAAK,CACN,CAAA;IACH,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,QAAgB,EAChB,MAAsC;IAEtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,OAAO;QACL,EAAE,EAAE,kBAAkB,CAAC,6BAA6B,CAAC;QACrD,IAAI,EAAE,YAAY;QAClB,IAAI,EAAE,kBAAkB;QACxB,QAAQ;QACR,eAAe,EAAE;YACf,SAAS,EAAE,OAAO;YAClB,eAAe,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;SACrC;QACD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,MAAM;KACnB,CAAA;AACH,CAAC;AAED,SAAS,gBAAgB,CACvB,IAA8E,EAC9E,GAAW;IAEX,MAAM,SAAS,GAAG,IAAI,KAAK,kBAAkB,CAAA;IAC7C,OAAO;QACL,EAAE,EAAE,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,2BAA2B,CAAC;QAC/F,IAAI;QACJ,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB;QACvD,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,+BAA+B;QACzF,eAAe,EAAE;YACf,SAAS,EAAE,OAAO;YAClB,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC;SACpF;QACD,SAAS,EAAE,GAAG;QACd,SAAS,EAAE,GAAG;QACd,UAAU,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;KAClC,CAAA;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAqC;IAErC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,sBAAsB,CAC9B,mCAAmC,EACnC,8CAA8C,CAC/C,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAA;IAC9E,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC1C,gCAAgC,CAAC,OAAO,CAAC,eAAe,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC1F,CAAC;IACD,MAAM,kCAAkC,CAAC,UAAU,EAAE;QACnD,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QAC9F,GAAG,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;KACtD,CAAC,CAAA;IACF,MAAM,yCAAyC,CAAC,UAAU,EAAE;QAC1D,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC;QAC9F,GAAG,CAAC,OAAO,CAAC,iBAAiB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC;QACrD,GAAG,CAAC,OAAO,CAAC,qBAAqB,KAAK,SAAS;YAC7C,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,EAAE,CAAC;KAC9D,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;IACjD,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7C,cAAc,CAAC,OAAO,EAAE,QAAQ,CAAC;QACjC,gBAAgB,CAAC;YACf,QAAQ,EAAE,qBAAqB,CAAC,OAAO,CAAC;YACxC,eAAe,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE;SACtD,CAAC;KACH,CAAC,CAAA;IACF,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACnF,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,OAAO;QACL,UAAU;QACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,WAAW,EAAE;YACX,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YAC5C,gBAAgB,CAAC,kBAAkB,EAAE,GAAG,CAAC;YACzC,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,CAAC;SACxC;QACD,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC;QAC7D,GAAG,CAAC,QAAQ,CAAC,gBAAgB,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QACpD,YAAY,EAAE;YACZ,MAAM,EAAE,YAAY;YACpB,MAAM,EACJ,sGAAsG;SACzG;KACF,CAAA;AACH,CAAC"}

package/dist/bin/production-setup-persistence.d.ts

@@ -0,0 +1,20 @@
+import type { AgentProfile } from '@tangle-network/agent-interface';
+import type { ConfigurationSelection } from '../app/configuration-session.js';
+import type { ConnectionRecord } from '../domain/entities.js';
+import { type ProductionConfigMutationLock } from './production-config-mutation-lock.js';
+export interface ProductionStartupPersistence {
+    readonly rollback: () => Promise<void>;
+}
+export interface ProductionStartupPersistenceOptions {
+    readonly databaseKeyFile?: string;
+    readonly connections?: readonly ConnectionRecord[];
+    readonly mutationLock?: ProductionConfigMutationLock;
+}
+/** Returns the exact validated profile that is safe to publish and reload. */
+export declare function persistableProductionProfile(profile: Readonly<AgentProfile>): AgentProfile;
+export declare function productionConnectionsForSelection(selection: ConfigurationSelection, candidates?: readonly ConnectionRecord[]): readonly ConnectionRecord[];
+/** Publishes a selection only after the caller has prepared the replacement app. */
+export declare function persistProductionStartupSelection(configPath: string, selection: ConfigurationSelection, options?: ProductionStartupPersistenceOptions): Promise<ProductionStartupPersistence>;
+/** Persists selected metadata only; credentials remain in the operating-system store. */
+export declare function saveProductionStartupSelection(configPath: string, selection: ConfigurationSelection, options?: ProductionStartupPersistenceOptions): Promise<void>;
+//# sourceMappingURL=production-setup-persistence.d.ts.map

package/dist/bin/production-setup-persistence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-setup-persistence.d.ts","sourceRoot":"","sources":["../../src/bin/production-setup-persistence.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAA;AAanE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAE7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAEL,KAAK,4BAA4B,EAElC,MAAM,sCAAsC,CAAA;AAI7C,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACvC;AAED,MAAM,WAAW,mCAAmC;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAA;IAClD,QAAQ,CAAC,YAAY,CAAC,EAAE,4BAA4B,CAAA;CACrD;AA+ID,8EAA8E;AAC9E,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,YAAY,CAe1F;AAED,wBAAgB,iCAAiC,CAC/C,SAAS,EAAE,sBAAsB,EACjC,UAAU,GAAE,SAAS,gBAAgB,EAAO,GAC3C,SAAS,gBAAgB,EAAE,CAI7B;AAkDD,oFAAoF;AACpF,wBAAsB,iCAAiC,CACrD,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,sBAAsB,EACjC,OAAO,GAAE,mCAAwC,GAChD,OAAO,CAAC,4BAA4B,CAAC,CA2CvC;AAED,yFAAyF;AACzF,wBAAsB,8BAA8B,CAClD,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,sBAAsB,EACjC,OAAO,GAAE,mCAAwC,GAChD,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/bin/production-setup-persistence.js

@@ -0,0 +1,253 @@
+import { mkdir } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { canonicalCandidateJson, snapshotAgentProfile, } from '../adapters/agent-interface/profile-runtime.js';
+import { assertNoSymlinkPath, assertSafeDirectory, readNoFollow, removePrivateFile, replacePrivateFile, writePrivateFile, } from '../adapters/persistence/safe-file.js';
+import { ConnectionRegistry } from '../app/connections.js';
+import { assertProductionConfigMutationLock, withProductionConfigMutationLock, } from './production-config-mutation-lock.js';
+const MAX_STARTUP_CONFIG_BYTES = 2 * 1024 * 1024;
+const INLINE_SECRET_VALUE = /(?:\bsk[-_][-_A-Za-z0-9]{10,}\b|\bgh[pousr]_[A-Za-z0-9]{12,}\b|\bgithub_pat_[A-Za-z0-9_]{12,}\b|\bAKIA[A-Z0-9]{12,}\b|-----BEGIN [A-Z ]*PRIVATE KEY-----|\b(?:api[-_ ]?key|access[-_ ]?token|refresh[-_ ]?token|client[-_ ]?secret|password|credential|secret)\b\s*[:=]\s*\S+|\b(?:canary|fixture|test)[-_ ]?(?:secret|token|credential|key|auth|bearer|basic)\b|\b(?:secret|token|credential|key|auth|bearer|basic)[-_ ]?(?:canary|fixture|test)\b)/iu;
+const AUTH_SCHEME_VALUE = /\b(?:Bearer|Basic)\s+([A-Za-z0-9+/_=.-]{8,})/iu;
+const AUTH_SCHEME_PROSE = new Set([
+    'auth',
+    'authentication',
+    'authorization',
+    'basic',
+    'bearer',
+    'credential',
+    'credentials',
+    'header',
+    'headers',
+    'scheme',
+    'token',
+    'tokens',
+    'value',
+    'values',
+]);
+function hasObviousSecretValue(value) {
+    if (INLINE_SECRET_VALUE.test(value))
+        return true;
+    const schemeValue = AUTH_SCHEME_VALUE.exec(value)?.[1];
+    if (schemeValue === undefined || AUTH_SCHEME_PROSE.has(schemeValue.toLowerCase()))
+        return false;
+    if (/(?:canary|fixture|test|secret|token|credential|password|key|auth)/iu.test(schemeValue))
+        return true;
+    if (/^[A-Za-z0-9+/]{12,}={0,2}$/u.test(schemeValue)) {
+        const hasUpper = /[A-Z]/u.test(schemeValue);
+        const hasLower = /[a-z]/u.test(schemeValue);
+        if (hasUpper && hasLower)
+            return true;
+    }
+    return schemeValue.length >= 20;
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function hasOnlyKeys(value, allowed) {
+    const accepted = new Set(allowed);
+    return Object.keys(value).every((key) => accepted.has(key));
+}
+function validateTypedConfigValue(value, path) {
+    if (!isRecord(value)) {
+        throw new Error(`Typed credential configuration at ${path} must use a typed public value or typed secret-ref wrapper`);
+    }
+    if (value.kind === 'public') {
+        if (!hasOnlyKeys(value, ['kind', 'value']) || typeof value.value !== 'string') {
+            throw new Error(`Typed credential configuration at ${path} has an invalid public wrapper`);
+        }
+        return;
+    }
+    if (value.kind === 'secret-ref') {
+        if (!hasOnlyKeys(value, ['kind', 'key', 'format']) ||
+            typeof value.key !== 'string' ||
+            (value.format !== undefined && value.format !== 'raw' && value.format !== 'bearer')) {
+            throw new Error(`Typed credential configuration at ${path} has an invalid secret-ref wrapper`);
+        }
+        return;
+    }
+    throw new Error(`Typed credential configuration at ${path} must use a typed public value or typed secret-ref wrapper`);
+}
+function validateTypedConfigRecord(value, path) {
+    if (!isRecord(value)) {
+        throw new Error(`Typed credential configuration at ${path} must be an object`);
+    }
+    for (const [key, child] of Object.entries(value)) {
+        validateTypedConfigValue(child, `${path}.${key}`);
+    }
+}
+function validateTypedConfigArray(value, path) {
+    if (!Array.isArray(value)) {
+        throw new Error(`Typed credential configuration at ${path} must be an array`);
+    }
+    value.forEach((child, index) => {
+        validateTypedConfigValue(child, `${path}[${index}]`);
+    });
+}
+function validateTypedConfigLocations(profile) {
+    const hooks = profile.hooks;
+    if (isRecord(hooks)) {
+        for (const [name, commands] of Object.entries(hooks)) {
+            if (!Array.isArray(commands)) {
+                throw new Error(`Typed credential configuration at hooks.${name} must be an array`);
+            }
+            commands.forEach((command, index) => {
+                if (isRecord(command) && command.env !== undefined) {
+                    validateTypedConfigRecord(command.env, `hooks.${name}[${index}].env`);
+                }
+            });
+        }
+    }
+    const mcp = profile.mcp;
+    if (!isRecord(mcp))
+        return;
+    for (const [name, server] of Object.entries(mcp)) {
+        if (!isRecord(server))
+            continue;
+        if (server.args !== undefined)
+            validateTypedConfigArray(server.args, `mcp.${name}.args`);
+        if (server.env !== undefined)
+            validateTypedConfigRecord(server.env, `mcp.${name}.env`);
+        if (server.headers !== undefined)
+            validateTypedConfigRecord(server.headers, `mcp.${name}.headers`);
+    }
+}
+function rejectObviousSecretValues(value, path, seen = new Set()) {
+    if (typeof value === 'string') {
+        if (hasObviousSecretValue(value)) {
+            throw new Error(`Inline credential material is not allowed at ${path}; use a typed secret-ref`);
+        }
+        return;
+    }
+    if (value === null || typeof value !== 'object')
+        return;
+    if (seen.has(value))
+        throw new Error(`The profile contains a cyclic value at ${path}`);
+    seen.add(value);
+    try {
+        if (Array.isArray(value)) {
+            value.forEach((entry, index) => {
+                rejectObviousSecretValues(entry, `${path}[${index}]`, seen);
+            });
+            return;
+        }
+        for (const [key, child] of Object.entries(value)) {
+            rejectObviousSecretValues(child, `${path}.${key}`, seen);
+        }
+    }
+    finally {
+        seen.delete(value);
+    }
+}
+/** Returns the exact validated profile that is safe to publish and reload. */
+export function persistableProductionProfile(profile) {
+    validateTypedConfigLocations(profile);
+    let snapshot;
+    try {
+        snapshot = snapshotAgentProfile(profile);
+    }
+    catch (error) {
+        throw new Error('The selected profile is not a canonical AgentProfile', { cause: error });
+    }
+    rejectObviousSecretValues(snapshot, 'profile');
+    try {
+        canonicalCandidateJson(snapshot);
+    }
+    catch (error) {
+        throw new Error('The selected profile has no canonical JSON representation', { cause: error });
+    }
+    return snapshot;
+}
+export function productionConnectionsForSelection(selection, candidates = []) {
+    const records = new Map(candidates.map((record) => [record.id, record]));
+    records.set(selection.connection.id, selection.connection);
+    return new ConnectionRegistry([...records.values()]).list();
+}
+function serializedSelection(selection, databaseKeyFile, connections) {
+    return `${canonicalCandidateJson({
+        format: 'braid-startup-config',
+        schemaVersion: 2,
+        profile: persistableProductionProfile(selection.profile.profile),
+        connectionId: selection.connection.id,
+        connections: productionConnectionsForSelection(selection, connections),
+        ...(databaseKeyFile === undefined ? {} : { databaseKeyFile }),
+    })}\n`;
+}
+function publish(target, bytes, previous) {
+    if (previous === undefined) {
+        writePrivateFile(target, bytes);
+        return;
+    }
+    replacePrivateFile(target, bytes, {
+        overwrite: true,
+        expected: (current) => {
+            if (current === undefined || !current.equals(previous)) {
+                throw new Error('The production configuration changed while setup was applying');
+            }
+        },
+        maxExistingBytes: MAX_STARTUP_CONFIG_BYTES,
+    });
+}
+function restore(target, bytes, previous) {
+    if (previous !== undefined) {
+        replacePrivateFile(target, previous, {
+            overwrite: true,
+            expected: (current) => {
+                if (current === undefined || !current.equals(bytes)) {
+                    throw new Error('The production configuration changed during setup rollback');
+                }
+            },
+            maxExistingBytes: MAX_STARTUP_CONFIG_BYTES,
+        });
+        return;
+    }
+    const current = readNoFollow(target, MAX_STARTUP_CONFIG_BYTES);
+    if (current?.equals(bytes))
+        removePrivateFile(target);
+}
+/** Publishes a selection only after the caller has prepared the replacement app. */
+export async function persistProductionStartupSelection(configPath, selection, options = {}) {
+    const target = resolve(configPath);
+    const directory = dirname(target);
+    assertNoSymlinkPath(directory);
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    assertNoSymlinkPath(directory);
+    assertSafeDirectory(directory);
+    const publishSelection = async (lock) => {
+        assertProductionConfigMutationLock(lock, target);
+        const previous = readNoFollow(target, MAX_STARTUP_CONFIG_BYTES);
+        const bytes = Buffer.from(serializedSelection(selection, options.databaseKeyFile, options.connections), 'utf8');
+        try {
+            publish(target, bytes, previous);
+        }
+        catch (error) {
+            try {
+                restore(target, bytes, previous);
+            }
+            catch (rollbackError) {
+                throw new Error('The production configuration could not be safely rolled back', {
+                    cause: rollbackError,
+                });
+            }
+            throw error;
+        }
+        return {
+            rollback: async () => {
+                const rollback = async (activeLock) => {
+                    assertProductionConfigMutationLock(activeLock, target);
+                    restore(target, bytes, previous);
+                };
+                if (options.mutationLock !== undefined)
+                    return rollback(options.mutationLock);
+                return withProductionConfigMutationLock(target, rollback);
+            },
+        };
+    };
+    if (options.mutationLock !== undefined) {
+        return publishSelection(options.mutationLock);
+    }
+    return withProductionConfigMutationLock(target, publishSelection);
+}
+/** Persists selected metadata only; credentials remain in the operating-system store. */
+export async function saveProductionStartupSelection(configPath, selection, options = {}) {
+    await persistProductionStartupSelection(configPath, selection, options);
+}
+//# sourceMappingURL=production-setup-persistence.js.map

package/dist/bin/production-setup-persistence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-setup-persistence.js","sourceRoot":"","sources":["../../src/bin/production-setup-persistence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE5C,OAAO,EACL,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gDAAgD,CAAA;AACvD,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,sCAAsC,CAAA;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE1D,OAAO,EACL,kCAAkC,EAElC,gCAAgC,GACjC,MAAM,sCAAsC,CAAA;AAE7C,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAYhD,MAAM,mBAAmB,GACvB,wbAAwb,CAAA;AAE1b,MAAM,iBAAiB,GAAG,gDAAgD,CAAA;AAC1E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM;IACN,gBAAgB;IAChB,eAAe;IACf,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;CACT,CAAC,CAAA;AAEF,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAChD,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACtD,IAAI,WAAW,KAAK,SAAS,IAAI,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/F,IAAI,qEAAqE,CAAC,IAAI,CAAC,WAAW,CAAC;QACzF,OAAO,IAAI,CAAA;IACb,IAAI,6BAA6B,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC3C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC3C,IAAI,QAAQ,IAAI,QAAQ;YAAE,OAAO,IAAI,CAAA;IACvC,CAAC;IACD,OAAO,WAAW,CAAC,MAAM,IAAI,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B,EAAE,OAA0B;IAC7E,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;IACjC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc,EAAE,IAAY;IAC5D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,4DAA4D,CACtG,CAAA;IACH,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,gCAAgC,CAAC,CAAA;QAC5F,CAAC;QACD,OAAM;IACR,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAChC,IACE,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;YAC9C,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;YAC7B,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,EACnF,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,oCAAoC,CAAC,CAAA;QAChG,CAAC;QACD,OAAM;IACR,CAAC;IACD,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,4DAA4D,CACtG,CAAA;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc,EAAE,IAAY;IAC7D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,oBAAoB,CAAC,CAAA;IAChF,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,wBAAwB,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;IACnD,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc,EAAE,IAAY;IAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,mBAAmB,CAAC,CAAA;IAC/E,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC7B,wBAAwB,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,4BAA4B,CAAC,OAA+B;IACnE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;IAC3B,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,2CAA2C,IAAI,mBAAmB,CAAC,CAAA;YACrF,CAAC;YACD,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE;gBAClC,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;oBACnD,yBAAyB,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC,CAAA;gBACvE,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAA;IACvB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAM;IAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAQ;QAC/B,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;YAAE,wBAAwB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,IAAI,OAAO,CAAC,CAAA;QACxF,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS;YAAE,yBAAyB,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,CAAA;QACtF,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS;YAC9B,yBAAyB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,IAAI,UAAU,CAAC,CAAA;IACpE,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAc,EAAE,IAAY,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU;IACvF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,0BAA0B,CAC/E,CAAA;QACH,CAAC;QACD,OAAM;IACR,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAM;IACvD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAA;IACtF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACf,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;gBAC7B,yBAAyB,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,IAAI,CAAC,CAAA;YAC7D,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,yBAAyB,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,IAAI,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,4BAA4B,CAAC,OAA+B;IAC1E,4BAA4B,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,QAAsB,CAAA;IAC1B,IAAI,CAAC;QACH,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC3F,CAAC;IACD,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAC9C,IAAI,CAAC;QACH,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,2DAA2D,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAChG,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAC/C,SAAiC,EACjC,UAAU,GAAgC,EAAE;IAE5C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAU,CAAC,CAAC,CAAA;IACjF,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,UAAU,CAAC,CAAA;IAC1D,OAAO,IAAI,kBAAkB,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AAC7D,CAAC;AAED,SAAS,mBAAmB,CAC1B,SAAiC,EACjC,eAAwB,EACxB,WAAyC;IAEzC,OAAO,GAAG,sBAAsB,CAAC;QAC/B,MAAM,EAAE,sBAAsB;QAC9B,aAAa,EAAE,CAAC;QAChB,OAAO,EAAE,4BAA4B,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC;QAChE,YAAY,EAAE,SAAS,CAAC,UAAU,CAAC,EAAE;QACrC,WAAW,EAAE,iCAAiC,CAAC,SAAS,EAAE,WAAW,CAAC;QACtE,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC;KAC9D,CAAC,IAAI,CAAA;AACR,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,KAAa,EAAE,QAA4B;IAC1E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAC/B,OAAM;IACR,CAAC;IACD,kBAAkB,CAAC,MAAM,EAAE,KAAK,EAAE;QAChC,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;YACpB,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAA;YAClF,CAAC;QACH,CAAC;QACD,gBAAgB,EAAE,wBAAwB;KAC3C,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,KAAa,EAAE,QAA4B;IAC1E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,kBAAkB,CAAC,MAAM,EAAE,QAAQ,EAAE;YACnC,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;gBACpB,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;gBAC/E,CAAC;YACH,CAAC;YACD,gBAAgB,EAAE,wBAAwB;SAC3C,CAAC,CAAA;QACF,OAAM;IACR,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;IAC9D,IAAI,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC;QAAE,iBAAiB,CAAC,MAAM,CAAC,CAAA;AACvD,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,UAAkB,EAClB,SAAiC,EACjC,OAAO,GAAwC,EAAE;IAEjD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAClC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACjC,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC9B,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACxD,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC9B,mBAAmB,CAAC,SAAS,CAAC,CAAA;IAC9B,MAAM,gBAAgB,GAAG,KAAK,EAC5B,IAAkC,EACK,EAAE;QACzC,kCAAkC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAA;QAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,WAAW,CAAC,EAC5E,MAAM,CACP,CAAA;QACD,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;YAClC,CAAC;YAAC,OAAO,aAAa,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,8DAA8D,EAAE;oBAC9E,KAAK,EAAE,aAAa;iBACrB,CAAC,CAAA;YACJ,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACnB,MAAM,QAAQ,GAAG,KAAK,EAAE,UAAwC,EAAiB,EAAE;oBACjF,kCAAkC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAA;oBACtD,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;gBAClC,CAAC,CAAA;gBACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS;oBAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBAC7E,OAAO,gCAAgC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;YAC3D,CAAC;SACF,CAAA;IACH,CAAC,CAAA;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,OAAO,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,gCAAgC,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAA;AACnE,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,UAAkB,EAClB,SAAiC,EACjC,OAAO,GAAwC,EAAE;IAEjD,MAAM,iCAAiC,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;AACzE,CAAC"}

package/dist/bin/production-setup-transition.d.ts

@@ -0,0 +1,43 @@
+import type { BraidApplication } from '../app/application.js';
+import type { ConnectionRegistry } from '../app/connections.js';
+import type { ConfigurationSelection } from '../app/configuration-session.js';
+import { type ProductionStartupPersistence } from './production-setup-persistence.js';
+import type { ProductionSetupVerification, ProductionStartupSetup } from './production-setup-types.js';
+import { validateProductionSelection } from './production-setup-validation.js';
+import type { ProductionStartupLoadOptions } from './production-startup.js';
+export interface ProductionApplicationHandle {
+    readonly app: BraidApplication;
+    readonly connections?: ConnectionRegistry;
+    readonly close: () => Promise<void>;
+}
+export interface ProductionApplicationSlot {
+    current: ProductionApplicationHandle;
+}
+export interface ProductionSetupController {
+    /**
+     * Replaces the active app atomically: a rejected promise must leave the old
+     * app installed and must not publish a partially installed replacement.
+     */
+    replaceApplication(next: BraidApplication, workspace: string): Promise<void>;
+}
+export interface ProductionSetupTransitionOptions {
+    readonly setup: ProductionStartupSetup;
+    readonly startupOptions: ProductionStartupLoadOptions;
+    readonly selection: ConfigurationSelection;
+    readonly workspace: string;
+    /** Session-only credential captured by the terminal; the caller retains ownership. */
+    readonly credential?: Uint8Array;
+    readonly controller: ProductionSetupController;
+    readonly active: ProductionApplicationSlot;
+    /** Opens and durably initializes from the in-memory selection. */
+    readonly openApplication: (selection: ConfigurationSelection, options: ProductionStartupLoadOptions) => Promise<ProductionApplicationHandle>;
+    readonly activate?: (next: ProductionApplicationHandle, selection: ConfigurationSelection, startupOptions: ProductionStartupLoadOptions) => Promise<void>;
+    readonly validate?: typeof validateProductionSelection;
+    readonly persist?: (configPath: string, selection: ConfigurationSelection, options?: {
+        readonly databaseKeyFile?: string;
+        readonly connections?: readonly import('../domain/entities.js').ConnectionRecord[];
+    }) => Promise<ProductionStartupPersistence>;
+}
+/** Validates, prepares, persists, swaps, and finally closes the previous application. */
+export declare function transitionProductionSelection(options: ProductionSetupTransitionOptions): Promise<ProductionSetupVerification>;
+//# sourceMappingURL=production-setup-transition.d.ts.map

package/dist/bin/production-setup-transition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-setup-transition.d.ts","sourceRoot":"","sources":["../../src/bin/production-setup-transition.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC/D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAE7E,OAAO,EACL,KAAK,4BAA4B,EAElC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,KAAK,EACV,2BAA2B,EAC3B,sBAAsB,EACvB,MAAM,6BAA6B,CAAA;AACpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAA;AAC9E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAA;AAE3E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,GAAG,EAAE,gBAAgB,CAAA;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;IACzC,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CACpC;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,2BAA2B,CAAA;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,kBAAkB,CAAC,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7E;AAED,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAA;IACtC,QAAQ,CAAC,cAAc,EAAE,4BAA4B,CAAA;IACrD,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAA;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,yBAAyB,CAAA;IAC9C,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAA;IAC1C,kEAAkE;IAClE,QAAQ,CAAC,eAAe,EAAE,CACxB,SAAS,EAAE,sBAAsB,EACjC,OAAO,EAAE,4BAA4B,KAClC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAClB,IAAI,EAAE,2BAA2B,EACjC,SAAS,EAAE,sBAAsB,EACjC,cAAc,EAAE,4BAA4B,KACzC,OAAO,CAAC,IAAI,CAAC,CAAA;IAClB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,2BAA2B,CAAA;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,CACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,sBAAsB,EACjC,OAAO,CAAC,EAAE;QACR,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;QACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,OAAO,uBAAuB,EAAE,gBAAgB,EAAE,CAAA;KACnF,KACE,OAAO,CAAC,4BAA4B,CAAC,CAAA;CAC3C;AAsCD,yFAAyF;AACzF,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,2BAA2B,CAAC,CAsEtC"}

package/dist/bin/production-setup-transition.js

@@ -0,0 +1,85 @@
+import { prepareProductionSelection } from './production-setup-credentials.js';
+import { persistProductionStartupSelection, } from './production-setup-persistence.js';
+import { validateProductionSelection } from './production-setup-validation.js';
+async function closeAfterFailure(next, failure, rollbackCredential) {
+    await next.close().catch(() => undefined);
+    try {
+        await rollbackCredential();
+    }
+    catch (rollbackError) {
+        throw new Error('The secure connection credential could not be rolled back after setup failed', {
+            cause: rollbackError,
+        });
+    }
+    throw failure;
+}
+async function failBeforeOpen(rollbackCredential, failure) {
+    try {
+        await rollbackCredential();
+    }
+    catch (rollbackError) {
+        throw new Error('The secure connection credential could not be rolled back after setup failed', {
+            cause: rollbackError,
+        });
+    }
+    throw failure;
+}
+/** Validates, prepares, persists, swaps, and finally closes the previous application. */
+export async function transitionProductionSelection(options) {
+    const prepared = await prepareProductionSelection(options.startupOptions, options.selection, options.setup.configPath, options.credential);
+    let verification;
+    let next;
+    try {
+        verification = await (options.validate ?? validateProductionSelection)(prepared.startupOptions, prepared.selection);
+        next = await options.openApplication(prepared.selection, prepared.startupOptions);
+    }
+    catch (error) {
+        return failBeforeOpen(prepared.rollback, error);
+    }
+    let persistence;
+    try {
+        persistence = await (options.persist ?? persistProductionStartupSelection)(options.setup.configPath, prepared.selection, {
+            ...(prepared.startupOptions.databaseKeyFile === undefined
+                ? {}
+                : { databaseKeyFile: prepared.startupOptions.databaseKeyFile }),
+            connections: options.setup.connections,
+        });
+    }
+    catch (error) {
+        return closeAfterFailure(next, error, prepared.rollback);
+    }
+    try {
+        await options.activate?.(next, prepared.selection, prepared.startupOptions);
+    }
+    catch (error) {
+        try {
+            await persistence.rollback();
+        }
+        catch (rollbackError) {
+            return closeAfterFailure(next, new Error('The production configuration could not be rolled back after activation failed', {
+                cause: rollbackError,
+            }), prepared.rollback);
+        }
+        return closeAfterFailure(next, error, prepared.rollback);
+    }
+    try {
+        await options.controller.replaceApplication(next.app, options.workspace);
+    }
+    catch (error) {
+        try {
+            await persistence.rollback();
+        }
+        catch (rollbackError) {
+            return closeAfterFailure(next, new Error('The production configuration could not be rolled back after activation failed', {
+                cause: rollbackError,
+            }), prepared.rollback);
+        }
+        return closeAfterFailure(next, error, prepared.rollback);
+    }
+    const previous = options.active.current;
+    options.active.current = next;
+    await previous.close().catch(() => undefined);
+    await prepared.commit();
+    return verification;
+}
+//# sourceMappingURL=production-setup-transition.js.map

package/dist/bin/production-setup-transition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-setup-transition.js","sourceRoot":"","sources":["../../src/bin/production-setup-transition.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAA;AAC9E,OAAO,EAEL,iCAAiC,GAClC,MAAM,mCAAmC,CAAA;AAK1C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAA;AAmD9E,KAAK,UAAU,iBAAiB,CAC9B,IAAiC,EACjC,OAAgB,EAChB,kBAAuC;IAEvC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACzC,IAAI,CAAC;QACH,MAAM,kBAAkB,EAAE,CAAA;IAC5B,CAAC;IAAC,OAAO,aAAa,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,8EAA8E,EAC9E;YACE,KAAK,EAAE,aAAa;SACrB,CACF,CAAA;IACH,CAAC;IACD,MAAM,OAAO,CAAA;AACf,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,kBAAuC,EACvC,OAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,kBAAkB,EAAE,CAAA;IAC5B,CAAC;IAAC,OAAO,aAAa,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,8EAA8E,EAC9E;YACE,KAAK,EAAE,aAAa;SACrB,CACF,CAAA;IACH,CAAC;IACD,MAAM,OAAO,CAAA;AACf,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAyC;IAEzC,MAAM,QAAQ,GAAG,MAAM,0BAA0B,CAC/C,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,KAAK,CAAC,UAAU,EACxB,OAAO,CAAC,UAAU,CACnB,CAAA;IACD,IAAI,YAAyC,CAAA;IAC7C,IAAI,IAAiC,CAAA;IACrC,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,2BAA2B,CAAC,CACpE,QAAQ,CAAC,cAAc,EACvB,QAAQ,CAAC,SAAS,CACnB,CAAA;QACD,IAAI,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAA;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,cAAc,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IACjD,CAAC;IACD,IAAI,WAAyC,CAAA;IAC7C,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,iCAAiC,CAAC,CACxE,OAAO,CAAC,KAAK,CAAC,UAAU,EACxB,QAAQ,CAAC,SAAS,EAClB;YACE,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,eAAe,KAAK,SAAS;gBACvD,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;YACjE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;SACvC,CACF,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAA;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAA;QAC9B,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACvB,OAAO,iBAAiB,CACtB,IAAI,EACJ,IAAI,KAAK,CAAC,+EAA+E,EAAE;gBACzF,KAAK,EAAE,aAAa;aACrB,CAAC,EACF,QAAQ,CAAC,QAAQ,CAClB,CAAA;QACH,CAAC;QACD,OAAO,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC1D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,CAAA;IAC1E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAA;QAC9B,CAAC;QAAC,OAAO,aAAa,EAAE,CAAC;YACvB,OAAO,iBAAiB,CACtB,IAAI,EACJ,IAAI,KAAK,CAAC,+EAA+E,EAAE;gBACzF,KAAK,EAAE,aAAa;aACrB,CAAC,EACF,QAAQ,CAAC,QAAQ,CAClB,CAAA;QACH,CAAC;QACD,OAAO,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAA;IACvC,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,IAAI,CAAA;IAC7B,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAC7C,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;IACvB,OAAO,YAAY,CAAA;AACrB,CAAC"}

package/dist/bin/production-setup-types.d.ts

@@ -0,0 +1,44 @@
+import type { ProductionConnectionOptions } from '../adapters/connections/production-connections.js';
+import type { ProfileRecord } from '../app/profile-types.js';
+import type { ConnectionRecord } from '../domain/entities.js';
+import type { CredentialPort } from '../ports/credentials.js';
+import type { ProductionCredentialContext } from './production-credential-context.js';
+export interface ProductionStartupLoadOptions {
+    readonly workspace: string;
+    readonly configPath?: string;
+    readonly profileReference?: string;
+    readonly connectionId?: string;
+    readonly model?: string;
+    readonly runner?: string;
+    readonly effort?: string;
+    /** Protected headless SQLite key file, absolute or relative to the config directory. */
+    readonly databaseKeyFile?: string;
+    readonly fetch?: typeof fetch;
+    /** Explicit non-default bridge endpoint for isolated local or test setups. */
+    readonly cliBridgeEndpoint?: string;
+    /** Optional in-memory bridge authorization; never persisted in startup config. */
+    readonly bridgeAuth?: string;
+    /** Optional in-memory Tangle authorization; never persisted in startup config. */
+    readonly tangleAuth?: string;
+    /** Discovery timeout for /health and /v1/models. */
+    readonly discoveryTimeoutMs?: number;
+    /** Realistic bounded timeout for a cold first-run model request. */
+    readonly modelValidationTimeoutMs?: number;
+    readonly credentialStore?: CredentialPort;
+    /** Shared key-backed store for setup, recovery, and the durable app. */
+    readonly credentialContext?: ProductionCredentialContext;
+    readonly credentialRefResolver?: ProductionConnectionOptions['credentialRefResolver'];
+}
+export interface ProductionSetupVerification {
+    readonly status: 'unverified' | 'verified';
+    readonly detail: string;
+}
+export interface ProductionStartupSetup {
+    readonly configPath: string;
+    readonly profiles: readonly ProfileRecord[];
+    readonly connections: readonly ConnectionRecord[];
+    readonly diagnostics: readonly string[];
+    readonly initialProfileId?: ProfileRecord['id'];
+    readonly verification: ProductionSetupVerification;
+}
+//# sourceMappingURL=production-setup-types.d.ts.map

package/dist/bin/production-setup-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-setup-types.d.ts","sourceRoot":"","sources":["../../src/bin/production-setup-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAA;AACpG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAC7D,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,oCAAoC,CAAA;AAErF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,wFAAwF;IACxF,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,oDAAoD;IACpD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;IACpC,oEAAoE;IACpE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAA;IAC1C,QAAQ,CAAC,eAAe,CAAC,EAAE,cAAc,CAAA;IACzC,wEAAwE;IACxE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,2BAA2B,CAAA;IACxD,QAAQ,CAAC,qBAAqB,CAAC,EAAE,2BAA2B,CAAC,uBAAuB,CAAC,CAAA;CACtF;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAAA;IAC1C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAA;IAC3C,QAAQ,CAAC,WAAW,EAAE,SAAS,gBAAgB,EAAE,CAAA;IACjD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,CAAA;IAC/C,QAAQ,CAAC,YAAY,EAAE,2BAA2B,CAAA;CACnD"}

package/dist/bin/production-setup-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=production-setup-types.js.map

package/dist/bin/production-setup-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-setup-types.js","sourceRoot":"","sources":["../../src/bin/production-setup-types.ts"],"names":[],"mappings":""}

package/dist/bin/production-setup-validation.d.ts

@@ -0,0 +1,8 @@
+import type { ConfigurationEffectiveValues, ConfigurationSelection } from '../app/configuration-session.js';
+import type { ProductionSetupVerification } from './production-setup-types.js';
+import type { ProductionStartupLoadOptions } from './production-startup.js';
+/** Runs one bounded, non-streaming request and requires a real completion body. */
+export declare function validateProductionSelection(options: ProductionStartupLoadOptions, selection: ConfigurationSelection): Promise<ProductionSetupVerification>;
+/** Shows effective values and names dimensions the chosen provider cannot honor. */
+export declare function describeProductionSelection(selection: ConfigurationSelection, workspace: string, verification?: ProductionSetupVerification): ConfigurationEffectiveValues;
+//# sourceMappingURL=production-setup-validation.d.ts.map

package/dist/bin/production-setup-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"production-setup-validation.d.ts","sourceRoot":"","sources":["../../src/bin/production-setup-validation.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,4BAA4B,EAC5B,sBAAsB,EACvB,MAAM,iCAAiC,CAAA;AASxC,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAC9E,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAA;AA4F3E,mFAAmF;AACnF,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,4BAA4B,EACrC,SAAS,EAAE,sBAAsB,GAChC,OAAO,CAAC,2BAA2B,CAAC,CAqDtC;AAED,oFAAoF;AACpF,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,sBAAsB,EACjC,SAAS,EAAE,MAAM,EACjB,YAAY,GAAE,2BAGb,GACA,4BAA4B,CAkC9B"}