@telora/daemon 0.18.61 → 0.18.68

package/dist/host-control/capability.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Per-endpoint host-control capability detection (Local model host control, D1).
+ *
+ * The control plane is an OPTIONAL capability detected per-endpoint, never
+ * assumed. `detectHostCapability` runs a CHEAP, FAIL-SAFE probe against the host
+ * root's control surface: a 2xx with a well-formed (non-empty, usable) catalog
+ * means controllable; ANY other outcome -- error, non-2xx, parse failure,
+ * timeout, or an empty/unusable payload -- means NOT controllable, so the caller
+ * falls back to the `/v1/models` floor. This guarantees a plain
+ * OpenAI-compatible endpoint is never broken by the probe.
+ */
+import type { HostCapability } from './types.js';
+/**
+ * Pure decision: does a control-surface payload prove the host is controllable?
+ * True only when the payload normalizes to at least one usable loadable-model
+ * entry. A malformed, empty, or non-catalog payload yields false. Exported for
+ * unit testing the interpret-a-payload -> controllable? boundary in isolation.
+ */
+export declare function isControllableCatalogPayload(payload: unknown): boolean;
+/**
+ * Probe an endpoint's host root for the optional control capability. Cheap (a
+ * single GET, time-boxed by the client) and FAIL-SAFE: every failure mode --
+ * SSRF rejection, network error, non-2xx, invalid JSON, timeout, or an
+ * empty/unusable catalog -- resolves to `{ controllable: false }` rather than
+ * throwing, so the caller can unconditionally proceed to the floor.
+ *
+ * `apiKey` is the bearer VALUE (resolved from the Telora secret) authorizing the
+ * probe against an auth-protected host.
+ */
+export declare function detectHostCapability(baseUrl: string, apiKey?: string | null): Promise<HostCapability>;
+//# sourceMappingURL=capability.d.ts.map

package/dist/host-control/capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/host-control/capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAEtE;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC,cAAc,CAAC,CAezB"}

package/dist/host-control/capability.js

@@ -0,0 +1,50 @@
+/**
+ * Per-endpoint host-control capability detection (Local model host control, D1).
+ *
+ * The control plane is an OPTIONAL capability detected per-endpoint, never
+ * assumed. `detectHostCapability` runs a CHEAP, FAIL-SAFE probe against the host
+ * root's control surface: a 2xx with a well-formed (non-empty, usable) catalog
+ * means controllable; ANY other outcome -- error, non-2xx, parse failure,
+ * timeout, or an empty/unusable payload -- means NOT controllable, so the caller
+ * falls back to the `/v1/models` floor. This guarantees a plain
+ * OpenAI-compatible endpoint is never broken by the probe.
+ */
+import { hostGet, hostRootFromBaseUrl, HOST_CONTROL_FETCH_TIMEOUT_MS } from './client.js';
+import { HOST_CONTROL_CATALOG_PATH, normalizeLocalCatalog } from './catalog.js';
+/**
+ * Pure decision: does a control-surface payload prove the host is controllable?
+ * True only when the payload normalizes to at least one usable loadable-model
+ * entry. A malformed, empty, or non-catalog payload yields false. Exported for
+ * unit testing the interpret-a-payload -> controllable? boundary in isolation.
+ */
+export function isControllableCatalogPayload(payload) {
+    return normalizeLocalCatalog(payload).length > 0;
+}
+/**
+ * Probe an endpoint's host root for the optional control capability. Cheap (a
+ * single GET, time-boxed by the client) and FAIL-SAFE: every failure mode --
+ * SSRF rejection, network error, non-2xx, invalid JSON, timeout, or an
+ * empty/unusable catalog -- resolves to `{ controllable: false }` rather than
+ * throwing, so the caller can unconditionally proceed to the floor.
+ *
+ * `apiKey` is the bearer VALUE (resolved from the Telora secret) authorizing the
+ * probe against an auth-protected host.
+ */
+export async function detectHostCapability(baseUrl, apiKey) {
+    const root = hostRootFromBaseUrl(baseUrl);
+    const catalogUrl = `${root}${HOST_CONTROL_CATALOG_PATH}`;
+    try {
+        const payload = await hostGet(catalogUrl, {
+            apiKey,
+            timeoutMs: HOST_CONTROL_FETCH_TIMEOUT_MS,
+        });
+        return { controllable: isControllableCatalogPayload(payload) };
+    }
+    catch {
+        // Fail-safe: any error => not controllable. Detail is intentionally swallowed
+        // here (the catalog reader logs on its own fall-through); the probe must never
+        // surface a probe-oracle or break the floor path.
+        return { controllable: false };
+    }
+}
+//# sourceMappingURL=capability.js.map

package/dist/host-control/capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.js","sourceRoot":"","sources":["../../src/host-control/capability.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,aAAa,CAAC;AAC1F,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAGhF;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,OAAgB;IAC3D,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,MAAsB;IAEtB,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,yBAAyB,EAAE,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAU,UAAU,EAAE;YACjD,MAAM;YACN,SAAS,EAAE,6BAA6B;SACzC,CAAC,CAAC;QACH,OAAO,EAAE,YAAY,EAAE,4BAA4B,CAAC,OAAO,CAAC,EAAE,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;QAC9E,+EAA+E;QAC/E,kDAAkD;QAClD,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/host-control/catalog.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Loadable-model catalog reader for the host-control plane (Local model host
+ * control, D1).
+ *
+ * A controllable host (e.g. Unsloth Studio @ :8888) exposes its FULL
+ * downloaded-but-unloaded catalog under the control surface
+ * `<root>/api/models/local`, returning every loadable model -- not just the one
+ * currently loaded that `/v1/models` reports. This module reads that catalog and
+ * degrades CLEANLY to the `/v1/models` floor (via discovery-poll's
+ * `fetchModels`) when the host is not controllable or the catalog read fails for
+ * any reason. The floor path is byte-identical to today's behavior, so a plain
+ * OpenAI-compatible endpoint is never broken.
+ *
+ * The live catalog JSON shape is host-specific (observed: 25 entries under
+ * `/api/models/local`, each carrying a load path). We do NOT have the exact live
+ * shape pinned, so `normalizeLocalCatalog` is DEFENSIVE: it tolerates a range of
+ * reasonable container and field names and is easy to extend per the runbook's
+ * live-shape reconciliation.
+ */
+import type { LoadableCatalog, LoadableModel } from './types.js';
+/** The control-surface path (under the host ROOT, not `/v1`) for the full catalog. */
+export declare const HOST_CONTROL_CATALOG_PATH = "/api/models/local";
+/**
+ * Normalize a control-surface catalog payload into clean `LoadableModel`
+ * entries. Pure + DEFENSIVE: tolerates a bare array or a wrapped container,
+ * non-object items, missing/blank ids (dropped), and a missing model_path
+ * (captured as null). De-duplicates by id (first entry with a model_path wins
+ * its path). Exported for unit testing.
+ */
+export declare function normalizeLocalCatalog(payload: unknown): LoadableModel[];
+/**
+ * Read an endpoint's loadable-model catalog, preferring the controllable host
+ * catalog and degrading cleanly to the `/v1/models` floor.
+ *
+ * Control path: GET `<root>/api/models/local`, normalize, and if it yields at
+ * least one usable entry return the full loadable list (`controllable: true`).
+ *
+ * Floor path: on ANY control-surface failure (unreachable, non-2xx, invalid
+ * JSON, timeout, or an empty/unusable catalog) fall back to `fetchModels`
+ * (`/v1/models`) so behavior is exactly today's load-then-discover. The floor
+ * fetch's own failure propagates to the caller (same contract as the existing
+ * discovery path).
+ *
+ * `apiKey` is the bearer VALUE (resolved from the Telora secret); it authorizes
+ * both the control probe and the floor fetch.
+ */
+export declare function readLoadableCatalog(baseUrl: string, apiKey?: string | null): Promise<LoadableCatalog>;
+//# sourceMappingURL=catalog.d.ts.map

package/dist/host-control/catalog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.d.ts","sourceRoot":"","sources":["../../src/host-control/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEjE,sFAAsF;AACtF,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAgD7D;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,EAAE,CAkBvE;AAYD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC,eAAe,CAAC,CAwB1B"}

package/dist/host-control/catalog.js

@@ -0,0 +1,149 @@
+/**
+ * Loadable-model catalog reader for the host-control plane (Local model host
+ * control, D1).
+ *
+ * A controllable host (e.g. Unsloth Studio @ :8888) exposes its FULL
+ * downloaded-but-unloaded catalog under the control surface
+ * `<root>/api/models/local`, returning every loadable model -- not just the one
+ * currently loaded that `/v1/models` reports. This module reads that catalog and
+ * degrades CLEANLY to the `/v1/models` floor (via discovery-poll's
+ * `fetchModels`) when the host is not controllable or the catalog read fails for
+ * any reason. The floor path is byte-identical to today's behavior, so a plain
+ * OpenAI-compatible endpoint is never broken.
+ *
+ * The live catalog JSON shape is host-specific (observed: 25 entries under
+ * `/api/models/local`, each carrying a load path). We do NOT have the exact live
+ * shape pinned, so `normalizeLocalCatalog` is DEFENSIVE: it tolerates a range of
+ * reasonable container and field names and is easy to extend per the runbook's
+ * live-shape reconciliation.
+ */
+import { fetchModels } from '../discovery-poll.js';
+import { hostGet, hostRootFromBaseUrl, HOST_CONTROL_FETCH_TIMEOUT_MS, HostControlError, } from './client.js';
+/** The control-surface path (under the host ROOT, not `/v1`) for the full catalog. */
+export const HOST_CONTROL_CATALOG_PATH = '/api/models/local';
+/**
+ * Candidate keys that may carry the array of catalog entries. The live host
+ * (Unsloth Studio) returned a bare array under `/api/models/local`; other hosts
+ * may wrap it. Defensive: we accept a top-level array OR any of these container
+ * keys. Easy to extend per the runbook.
+ */
+const CATALOG_ARRAY_KEYS = ['models', 'data', 'local', 'items'];
+/**
+ * Candidate keys for a catalog entry's served model id. `id` is canonical;
+ * `model`/`name` are common alternates on local-model hosts.
+ */
+const ID_KEYS = ['id', 'model', 'name'];
+/**
+ * Candidate keys for a catalog entry's host load path. `model_path` is the
+ * observed convention; the rest are reasonable alternates. Captured verbatim so
+ * Delivery 2 can resolve id -> path to load the model.
+ */
+const MODEL_PATH_KEYS = ['model_path', 'modelPath', 'path', 'file', 'gguf_path'];
+/** Read the first string-valued key present on an object, trimmed; '' if none. */
+function firstString(obj, keys) {
+    for (const key of keys) {
+        const v = obj[key];
+        if (typeof v === 'string') {
+            const trimmed = v.trim();
+            if (trimmed)
+                return trimmed;
+        }
+    }
+    return '';
+}
+/** Extract the catalog-entry array from a payload that is either a bare array or
+ *  a single-keyed container. Returns [] when no array is found (defensive). */
+function extractEntryArray(payload) {
+    if (Array.isArray(payload))
+        return payload;
+    if (!payload || typeof payload !== 'object')
+        return [];
+    const obj = payload;
+    for (const key of CATALOG_ARRAY_KEYS) {
+        const v = obj[key];
+        if (Array.isArray(v))
+            return v;
+    }
+    return [];
+}
+/**
+ * Normalize a control-surface catalog payload into clean `LoadableModel`
+ * entries. Pure + DEFENSIVE: tolerates a bare array or a wrapped container,
+ * non-object items, missing/blank ids (dropped), and a missing model_path
+ * (captured as null). De-duplicates by id (first entry with a model_path wins
+ * its path). Exported for unit testing.
+ */
+export function normalizeLocalCatalog(payload) {
+    const entries = extractEntryArray(payload);
+    const byId = new Map();
+    for (const item of entries) {
+        if (!item || typeof item !== 'object')
+            continue;
+        const obj = item;
+        const id = firstString(obj, ID_KEYS);
+        if (!id)
+            continue; // an entry with no usable id is unselectable -- drop it.
+        const modelPath = firstString(obj, MODEL_PATH_KEYS) || null;
+        const existing = byId.get(id);
+        if (!existing) {
+            byId.set(id, { id, modelPath });
+        }
+        else if (existing.modelPath === null && modelPath !== null) {
+            // Prefer the duplicate that carries a load path over a path-less twin.
+            byId.set(id, { id, modelPath });
+        }
+    }
+    return [...byId.values()];
+}
+/** Build the floor-path catalog from a `/v1/models` id list. `modelPath` is null
+ *  on the floor -- the floor knows only the loaded id, never a load path. */
+function floorCatalog(ids) {
+    return {
+        controllable: false,
+        ids,
+        models: ids.map((id) => ({ id, modelPath: null })),
+    };
+}
+/**
+ * Read an endpoint's loadable-model catalog, preferring the controllable host
+ * catalog and degrading cleanly to the `/v1/models` floor.
+ *
+ * Control path: GET `<root>/api/models/local`, normalize, and if it yields at
+ * least one usable entry return the full loadable list (`controllable: true`).
+ *
+ * Floor path: on ANY control-surface failure (unreachable, non-2xx, invalid
+ * JSON, timeout, or an empty/unusable catalog) fall back to `fetchModels`
+ * (`/v1/models`) so behavior is exactly today's load-then-discover. The floor
+ * fetch's own failure propagates to the caller (same contract as the existing
+ * discovery path).
+ *
+ * `apiKey` is the bearer VALUE (resolved from the Telora secret); it authorizes
+ * both the control probe and the floor fetch.
+ */
+export async function readLoadableCatalog(baseUrl, apiKey) {
+    const root = hostRootFromBaseUrl(baseUrl);
+    const catalogUrl = `${root}${HOST_CONTROL_CATALOG_PATH}`;
+    try {
+        const payload = await hostGet(catalogUrl, {
+            apiKey,
+            timeoutMs: HOST_CONTROL_FETCH_TIMEOUT_MS,
+        });
+        const models = normalizeLocalCatalog(payload);
+        if (models.length > 0) {
+            return { controllable: true, ids: models.map((m) => m.id), models };
+        }
+        // Well-formed but empty (or no usable ids): not a usable control catalog --
+        // fall through to the floor so the picklist still offers the loaded model.
+    }
+    catch (err) {
+        // Fail-safe: any control-surface error means "not controllable here". Log the
+        // rich detail daemon-side (address-free dbMessage available for categorizing)
+        // and fall through to the floor. Never break a plain endpoint.
+        const detail = err instanceof HostControlError ? err.message : err.message;
+        console.log(`[host-control] catalog read fell back to /v1/models floor: ${detail}`);
+    }
+    // Floor: the OpenAI-compatible `/v1/models` listing (today's behavior).
+    const ids = await fetchModels(baseUrl, apiKey);
+    return floorCatalog(ids);
+}
+//# sourceMappingURL=catalog.js.map

package/dist/host-control/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/host-control/catalog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,6BAA6B,EAC7B,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAGrB,sFAAsF;AACtF,MAAM,CAAC,MAAM,yBAAyB,GAAG,mBAAmB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAEzE;;;GAGG;AACH,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAU,CAAC;AAEjD;;;;GAIG;AACH,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,CAAU,CAAC;AAE1F,kFAAkF;AAClF,SAAS,WAAW,CAAC,GAA4B,EAAE,IAAuB;IACxE,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,OAAO;gBAAE,OAAO,OAAO,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;+EAC+E;AAC/E,SAAS,iBAAiB,CAAC,OAAgB;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,GAAG,GAAG,OAAkC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QAChD,MAAM,GAAG,GAAG,IAA+B,CAAC;QAC5C,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE;YAAE,SAAS,CAAC,yDAAyD;QAC5E,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,IAAI,CAAC;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAClC,CAAC;aAAM,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YAC7D,uEAAuE;YACvE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED;6EAC6E;AAC7E,SAAS,YAAY,CAAC,GAAa;IACjC,OAAO;QACL,YAAY,EAAE,KAAK;QACnB,GAAG;QACH,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAe,EACf,MAAsB;IAEtB,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,yBAAyB,EAAE,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAU,UAAU,EAAE;YACjD,MAAM;YACN,SAAS,EAAE,6BAA6B;SACzC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;QACtE,CAAC;QACD,4EAA4E;QAC5E,2EAA2E;IAC7E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8EAA8E;QAC9E,8EAA8E;QAC9E,+DAA+D;QAC/D,MAAM,MAAM,GAAG,GAAG,YAAY,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,GAAa,CAAC,OAAO,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,8DAA8D,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,wEAAwE;IACxE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/C,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC"}

package/dist/host-control/client.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Typed JSON HTTP helpers for the host-control plane (Local model host control, D1).
+ *
+ * These mirror the security posture of `discovery-poll.ts` exactly: the host
+ * control surface is an operator-supplied LAN endpoint, so every request must
+ * (1) pass the SSRF guard before any network call (TEL-5), (2) time-box with an
+ * AbortController so an unreachable host fails fast (TEL-6), (3) cap the body
+ * read so a malicious/oversized response can't OOM the daemon (TEL-6), and
+ * (4) surface only address-free error categories -- the raw URL/system detail is
+ * logged daemon-side, never returned to a caller that may write it to an
+ * org-readable column (TEL-5, probe-oracle defense).
+ *
+ * `hostGet`/`hostPost` are deliberately generic over the decoded shape; the
+ * caller validates the `unknown` payload with a defensive normalizer (the
+ * control-surface JSON shape is host-specific and reconciled per the runbook).
+ */
+/**
+ * Time-box a single host-control fetch. Mirrors `DISCOVERY_FETCH_TIMEOUT_MS`
+ * (5000ms) so the control probe fails fast on an unreachable host exactly like
+ * the `/v1/models` probe it rides alongside. Re-exported so callers and tests
+ * reference one source of truth.
+ */
+export declare const HOST_CONTROL_FETCH_TIMEOUT_MS = 5000;
+/**
+ * Hard ceiling on a host-control response body. A model catalog is small (~25
+ * entries observed live); this cap defends against an endpoint streaming an
+ * unbounded body to OOM the daemon (TEL-6). Mirrors discovery-poll's
+ * `MAX_DISCOVERY_BYTES` (1MB) -- declared as its own literal rather than
+ * re-exported to avoid an init-order coupling with the cyclic discovery-poll
+ * import (this module is imported by discovery-poll, which it also imports from).
+ */
+export declare const HOST_CONTROL_MAX_BYTES = 1000000;
+/**
+ * Address-free error categories for the host-control client. The control plane
+ * is fail-safe -- callers turn any of these into "not controllable, fall back to
+ * the floor" rather than propagating detail -- but they are kept distinct (and
+ * address-free) so daemon-side logs can categorize without leaking the endpoint.
+ */
+export declare const HOST_CONTROL_ERROR_REJECTED_URL = "Rejected non-http(s) host URL";
+export declare const HOST_CONTROL_ERROR_STATUS = "Host returned an error status";
+export declare const HOST_CONTROL_ERROR_UNREACHABLE = "Host unreachable or timed out";
+export declare const HOST_CONTROL_ERROR_INVALID = "Host response was not valid";
+/**
+ * A host-control client error carrying a sanitized, address-free `dbMessage`
+ * alongside the rich `message` (URL/system detail) that is safe only for the
+ * daemon log. Same precedent as `discovery-poll`'s `DiscoveryError`.
+ */
+export declare class HostControlError extends Error {
+    /** Address-free category string safe to surface anywhere (TEL-5). */
+    readonly dbMessage: string;
+    constructor(message: string, 
+    /** Address-free category string safe to surface anywhere (TEL-5). */
+    dbMessage: string);
+}
+/** Options common to host-control requests. */
+export interface HostRequestOptions {
+    /** Bearer key VALUE for an authenticated host (resolved from the Telora secret). */
+    apiKey?: string | null;
+    /** Per-request timeout override; defaults to `HOST_CONTROL_FETCH_TIMEOUT_MS`. */
+    timeoutMs?: number;
+}
+/** Typed JSON GET against a host-control URL. See `hostRequest` for the posture. */
+export declare function hostGet<T>(url: string, opts?: HostRequestOptions): Promise<T>;
+/** Typed JSON POST against a host-control URL. The body is JSON-encoded. */
+export declare function hostPost<T>(url: string, body: unknown, opts?: HostRequestOptions): Promise<T>;
+/**
+ * Derive the host ROOT from a stored `baseUrl`. The registry stores the
+ * OpenAI-compatible base (e.g. `http://host:8888/v1`), but the control surface
+ * lives under `/api` at the host root, NOT under `/v1`. Strip a single trailing
+ * `/v1` segment and any trailing slashes so callers can append `/api/...`. A
+ * `baseUrl` that is already a bare root passes through unchanged.
+ *
+ * Pure + exported for unit testing.
+ */
+export declare function hostRootFromBaseUrl(baseUrl: string): string;
+//# sourceMappingURL=client.d.ts.map

package/dist/host-control/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/host-control/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,OAAO,CAAC;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB,UAAY,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,+BAA+B,kCAAkC,CAAC;AAC/E,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AACzE,eAAO,MAAM,8BAA8B,kCAAkC,CAAC;AAC9E,eAAO,MAAM,0BAA0B,gCAAgC,CAAC;AAExE;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IAGvC,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM;gBAF1B,OAAO,EAAE,MAAM;IACf,qEAAqE;IAC5D,SAAS,EAAE,MAAM;CAK7B;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,iFAAiF;IACjF,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA0ID,oFAAoF;AACpF,wBAAsB,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,kBAAuB,GAAG,OAAO,CAAC,CAAC,CAAC,CAEvF;AAED,4EAA4E;AAC5E,wBAAsB,QAAQ,CAAC,CAAC,EAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,OAAO,EACb,IAAI,GAAE,kBAAuB,GAC5B,OAAO,CAAC,CAAC,CAAC,CAMZ;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAO3D"}

package/dist/host-control/client.js

@@ -0,0 +1,203 @@
+/**
+ * Typed JSON HTTP helpers for the host-control plane (Local model host control, D1).
+ *
+ * These mirror the security posture of `discovery-poll.ts` exactly: the host
+ * control surface is an operator-supplied LAN endpoint, so every request must
+ * (1) pass the SSRF guard before any network call (TEL-5), (2) time-box with an
+ * AbortController so an unreachable host fails fast (TEL-6), (3) cap the body
+ * read so a malicious/oversized response can't OOM the daemon (TEL-6), and
+ * (4) surface only address-free error categories -- the raw URL/system detail is
+ * logged daemon-side, never returned to a caller that may write it to an
+ * org-readable column (TEL-5, probe-oracle defense).
+ *
+ * `hostGet`/`hostPost` are deliberately generic over the decoded shape; the
+ * caller validates the `unknown` payload with a defensive normalizer (the
+ * control-surface JSON shape is host-specific and reconciled per the runbook).
+ */
+import { isAllowedDiscoveryUrl } from '../discovery-poll.js';
+/**
+ * Time-box a single host-control fetch. Mirrors `DISCOVERY_FETCH_TIMEOUT_MS`
+ * (5000ms) so the control probe fails fast on an unreachable host exactly like
+ * the `/v1/models` probe it rides alongside. Re-exported so callers and tests
+ * reference one source of truth.
+ */
+export const HOST_CONTROL_FETCH_TIMEOUT_MS = 5000;
+/**
+ * Hard ceiling on a host-control response body. A model catalog is small (~25
+ * entries observed live); this cap defends against an endpoint streaming an
+ * unbounded body to OOM the daemon (TEL-6). Mirrors discovery-poll's
+ * `MAX_DISCOVERY_BYTES` (1MB) -- declared as its own literal rather than
+ * re-exported to avoid an init-order coupling with the cyclic discovery-poll
+ * import (this module is imported by discovery-poll, which it also imports from).
+ */
+export const HOST_CONTROL_MAX_BYTES = 1_000_000;
+/**
+ * Address-free error categories for the host-control client. The control plane
+ * is fail-safe -- callers turn any of these into "not controllable, fall back to
+ * the floor" rather than propagating detail -- but they are kept distinct (and
+ * address-free) so daemon-side logs can categorize without leaking the endpoint.
+ */
+export const HOST_CONTROL_ERROR_REJECTED_URL = 'Rejected non-http(s) host URL';
+export const HOST_CONTROL_ERROR_STATUS = 'Host returned an error status';
+export const HOST_CONTROL_ERROR_UNREACHABLE = 'Host unreachable or timed out';
+export const HOST_CONTROL_ERROR_INVALID = 'Host response was not valid';
+/**
+ * A host-control client error carrying a sanitized, address-free `dbMessage`
+ * alongside the rich `message` (URL/system detail) that is safe only for the
+ * daemon log. Same precedent as `discovery-poll`'s `DiscoveryError`.
+ */
+export class HostControlError extends Error {
+    dbMessage;
+    constructor(message, 
+    /** Address-free category string safe to surface anywhere (TEL-5). */
+    dbMessage) {
+        super(message);
+        this.dbMessage = dbMessage;
+        this.name = 'HostControlError';
+    }
+}
+/**
+ * Build request headers for a host-control call. When a bearer key VALUE is
+ * provided an `Authorization: Bearer <value>` header is added; a blank/absent
+ * value yields no auth header (unauthenticated probe). The value is never
+ * logged or persisted by this module. Mirrors `buildDiscoveryHeaders`.
+ */
+function buildHostHeaders(apiKey, extra) {
+    const headers = { accept: 'application/json', ...extra };
+    const value = typeof apiKey === 'string' ? apiKey.trim() : '';
+    if (value)
+        headers.Authorization = `Bearer ${value}`;
+    return headers;
+}
+/**
+ * Read a fetch response body with a hard byte ceiling, aborting once the cap is
+ * exceeded so a lying Content-Length (or a chunked body with none) can't OOM the
+ * daemon (TEL-6). Returns the decoded text. Throws a `HostControlError` past the
+ * ceiling. Mirrors `discovery-poll`'s `readBodyCapped`.
+ */
+async function readBodyCapped(res) {
+    const body = res.body;
+    if (!body) {
+        // No stream available -- fall back to arrayBuffer but still cap by byteLength.
+        const buf = await res.arrayBuffer();
+        if (buf.byteLength > HOST_CONTROL_MAX_BYTES) {
+            throw new HostControlError('Response body exceeded byte ceiling', HOST_CONTROL_ERROR_INVALID);
+        }
+        return new TextDecoder().decode(buf);
+    }
+    const reader = body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (value) {
+                total += value.byteLength;
+                if (total > HOST_CONTROL_MAX_BYTES) {
+                    throw new HostControlError('Response body exceeded byte ceiling', HOST_CONTROL_ERROR_INVALID);
+                }
+                chunks.push(value);
+            }
+        }
+    }
+    finally {
+        // Stop the underlying transfer; ignore cancel errors.
+        await reader.cancel().catch(() => { });
+    }
+    const merged = new Uint8Array(total);
+    let offset = 0;
+    for (const c of chunks) {
+        merged.set(c, offset);
+        offset += c.byteLength;
+    }
+    return new TextDecoder().decode(merged);
+}
+/**
+ * Map a non-2xx status to an address-free category. 401/403 surface as a status
+ * error here (the host-control plane is optional, so an auth wall just means we
+ * fall back to the floor) -- unlike discovery, we don't disclose an auth-specific
+ * message, because a control-surface 401 is not independently actionable.
+ */
+function statusDbMessage(_status) {
+    return HOST_CONTROL_ERROR_STATUS;
+}
+/**
+ * Issue a host-control request and decode the JSON body, enforcing the full
+ * security posture (SSRF guard, timeout, byte cap, address-free errors). Shared
+ * core of `hostGet`/`hostPost`. Throws a `HostControlError` on any failure.
+ */
+async function hostRequest(url, init, opts) {
+    // TEL-5: validate the operator-supplied URL before any network call -- reject
+    // anything that isn't a parseable http/https URL (no file:, ftp:, etc).
+    if (!isAllowedDiscoveryUrl(url)) {
+        throw new HostControlError(`Rejected non-http(s) host-control URL: ${url}`, HOST_CONTROL_ERROR_REJECTED_URL);
+    }
+    const timeoutMs = opts.timeoutMs ?? HOST_CONTROL_FETCH_TIMEOUT_MS;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const extra = init.method === 'POST' && init.contentType ? { 'content-type': init.contentType } : undefined;
+        const res = await fetch(url, {
+            method: init.method,
+            signal: controller.signal,
+            headers: buildHostHeaders(opts.apiKey, extra),
+            ...(init.body !== undefined ? { body: init.body } : {}),
+        });
+        if (!res.ok) {
+            throw new HostControlError(`Host returned HTTP ${res.status}`, statusDbMessage(res.status));
+        }
+        // TEL-6: reject a too-large declared body up front, then defensively cap the
+        // actual stream in case the header lied / is absent.
+        const declared = Number(res.headers.get('content-length'));
+        if (Number.isFinite(declared) && declared > HOST_CONTROL_MAX_BYTES) {
+            throw new HostControlError(`Declared Content-Length ${declared} exceeds cap`, HOST_CONTROL_ERROR_INVALID);
+        }
+        const text = await readBodyCapped(res);
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            throw new HostControlError('Response body was not valid JSON', HOST_CONTROL_ERROR_INVALID);
+        }
+    }
+    catch (err) {
+        if (err instanceof HostControlError)
+            throw err;
+        if (err.name === 'AbortError') {
+            throw new HostControlError(`Timed out after ${timeoutMs}ms reaching ${url}`, HOST_CONTROL_ERROR_UNREACHABLE);
+        }
+        // Network-level failure (DNS, connection refused, TLS): generic to callers.
+        throw new HostControlError(err.message || `Failed to reach ${url}`, HOST_CONTROL_ERROR_UNREACHABLE);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Typed JSON GET against a host-control URL. See `hostRequest` for the posture. */
+export async function hostGet(url, opts = {}) {
+    return hostRequest(url, { method: 'GET' }, opts);
+}
+/** Typed JSON POST against a host-control URL. The body is JSON-encoded. */
+export async function hostPost(url, body, opts = {}) {
+    return hostRequest(url, { method: 'POST', body: JSON.stringify(body ?? {}), contentType: 'application/json' }, opts);
+}
+/**
+ * Derive the host ROOT from a stored `baseUrl`. The registry stores the
+ * OpenAI-compatible base (e.g. `http://host:8888/v1`), but the control surface
+ * lives under `/api` at the host root, NOT under `/v1`. Strip a single trailing
+ * `/v1` segment and any trailing slashes so callers can append `/api/...`. A
+ * `baseUrl` that is already a bare root passes through unchanged.
+ *
+ * Pure + exported for unit testing.
+ */
+export function hostRootFromBaseUrl(baseUrl) {
+    // Trim trailing slashes first so a trailing-slash `/v1/` still matches.
+    const trimmed = baseUrl.replace(/\/+$/, '');
+    // Strip exactly one trailing `/v1` segment (case-sensitive, the API convention).
+    const root = trimmed.replace(/\/v1$/, '');
+    // A `/v1` with its own trailing slash (`/v1/`) leaves a dangling slash; clean it.
+    return root.replace(/\/+$/, '');
+}
+//# sourceMappingURL=client.js.map

package/dist/host-control/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/host-control/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAElD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,+BAA+B,CAAC;AAC/E,MAAM,CAAC,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;AACzE,MAAM,CAAC,MAAM,8BAA8B,GAAG,+BAA+B,CAAC;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,6BAA6B,CAAC;AAExE;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAI9B;IAHX,YACE,OAAe;IACf,qEAAqE;IAC5D,SAAiB;QAE1B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,cAAS,GAAT,SAAS,CAAQ;QAG1B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAUD;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,MAAiC,EACjC,KAA8B;IAE9B,MAAM,OAAO,GAA2B,EAAE,MAAM,EAAE,kBAAkB,EAAE,GAAG,KAAK,EAAE,CAAC;IACjF,MAAM,KAAK,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,KAAK;QAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;IACrD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,GAAa;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,+EAA+E;QAC/E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,UAAU,GAAG,sBAAsB,EAAE,CAAC;YAC5C,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,EAAE,0BAA0B,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;IAChC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,CAAC;QACH,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,KAAK,GAAG,sBAAsB,EAAE,CAAC;oBACnC,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,EAAE,0BAA0B,CAAC,CAAC;gBAChG,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,sDAAsD;QACtD,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACtB,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CACxB,GAAW,EACX,IAAqE,EACrE,IAAwB;IAExB,8EAA8E;IAC9E,wEAAwE;IACxE,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,gBAAgB,CACxB,0CAA0C,GAAG,EAAE,EAC/C,+BAA+B,CAChC,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,6BAA6B,CAAC;IAClE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,GACT,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;YAC7C,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,GAAG,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9F,CAAC;QACD,6EAA6E;QAC7E,qDAAqD;QACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC3D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,sBAAsB,EAAE,CAAC;YACnE,MAAM,IAAI,gBAAgB,CACxB,2BAA2B,QAAQ,cAAc,EACjD,0BAA0B,CAC3B,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,kCAAkC,EAAE,0BAA0B,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,GAAG,CAAC;QAC/C,IAAK,GAAa,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACzC,MAAM,IAAI,gBAAgB,CACxB,mBAAmB,SAAS,eAAe,GAAG,EAAE,EAChD,8BAA8B,CAC/B,CAAC;QACJ,CAAC;QACD,4EAA4E;QAC5E,MAAM,IAAI,gBAAgB,CACvB,GAAa,CAAC,OAAO,IAAI,mBAAmB,GAAG,EAAE,EAClD,8BAA8B,CAC/B,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,OAAO,CAAI,GAAW,EAAE,OAA2B,EAAE;IACzE,OAAO,WAAW,CAAI,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAW,EACX,IAAa,EACb,OAA2B,EAAE;IAE7B,OAAO,WAAW,CAChB,GAAG,EACH,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,EACrF,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,wEAAwE;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,iFAAiF;IACjF,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC1C,kFAAkF;IAClF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC"}

package/dist/host-control/index.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Host-control plane barrel (Local model host control, D1).
+ *
+ * The spine for detecting and reading a controllable model host ABOVE the
+ * OpenAI-compatible `/v1/models` floor. Delivery 1 ships the client, capability
+ * detection, and catalog read; later deliveries add `load.ts` (id -> model_path
+ * load/unload) and `sizing.ts` -- export those from here when they land.
+ */
+export type { HostCapability, LoadableCatalog, LoadableModel, HostStatus, LoadModelParams, SwapAction, SwapDecision, HostHardware, KvCacheEstimate, KvCacheEstimateParams, SafeMaxSeqInput, SafeMaxSeqResult, } from './types.js';
+export { hostGet, hostPost, hostRootFromBaseUrl, HostControlError, HOST_CONTROL_FETCH_TIMEOUT_MS, HOST_CONTROL_MAX_BYTES, HOST_CONTROL_ERROR_REJECTED_URL, HOST_CONTROL_ERROR_STATUS, HOST_CONTROL_ERROR_UNREACHABLE, HOST_CONTROL_ERROR_INVALID, } from './client.js';
+export type { HostRequestOptions } from './client.js';
+export { detectHostCapability, isControllableCatalogPayload } from './capability.js';
+export { readLoadableCatalog, normalizeLocalCatalog, HOST_CONTROL_CATALOG_PATH, } from './catalog.js';
+export { loadModel, unloadModel, getStatus, resolveModelPath, decideSwap, ensureLoaded, normalizeStatus, DEFAULT_MAX_SEQ_LENGTH, HOST_CONTROL_LOAD_PATH, HOST_CONTROL_UNLOAD_PATH, HOST_CONTROL_STATUS_PATH, HOST_CONTROL_LOAD_READY_TIMEOUT_MS, HOST_CONTROL_LOAD_POLL_INTERVAL_MS, HOST_CONTROL_ERROR_LOAD_TIMEOUT, } from './load.js';
+export type { EnsureLoadedOptions } from './load.js';
+export { getHardware, getKvCacheEstimate, normalizeHardware, normalizeKvCacheEstimate, computeSafeMaxSeqLength, resolveSafeLoadOptions, CODEX_TURN1_FLOOR, VRAM_SAFETY_MARGIN_MB, KV_CACHE_MB_PER_TOKEN, KV_QUANT_FOOTPRINT_FACTOR, KV_QUANT_CACHE_TYPE, MAX_SEQ_LENGTH_CEILING, HOST_CONTROL_HARDWARE_PATH, HOST_CONTROL_KV_CACHE_PATH, } from './sizing.js';
+export type { SafeLoadSizingHints } from './sizing.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/host-control/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/host-control/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EACV,cAAc,EACd,eAAe,EACf,aAAa,EACb,UAAU,EACV,eAAe,EACf,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,OAAO,EACP,QAAQ,EACR,mBAAmB,EACnB,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,+BAA+B,EAC/B,yBAAyB,EACzB,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAErF,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,SAAS,EACT,WAAW,EACX,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,eAAe,EACf,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,EACxB,kCAAkC,EAClC,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAErD,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC"}

package/dist/host-control/index.js

@@ -0,0 +1,14 @@
+/**
+ * Host-control plane barrel (Local model host control, D1).
+ *
+ * The spine for detecting and reading a controllable model host ABOVE the
+ * OpenAI-compatible `/v1/models` floor. Delivery 1 ships the client, capability
+ * detection, and catalog read; later deliveries add `load.ts` (id -> model_path
+ * load/unload) and `sizing.ts` -- export those from here when they land.
+ */
+export { hostGet, hostPost, hostRootFromBaseUrl, HostControlError, HOST_CONTROL_FETCH_TIMEOUT_MS, HOST_CONTROL_MAX_BYTES, HOST_CONTROL_ERROR_REJECTED_URL, HOST_CONTROL_ERROR_STATUS, HOST_CONTROL_ERROR_UNREACHABLE, HOST_CONTROL_ERROR_INVALID, } from './client.js';
+export { detectHostCapability, isControllableCatalogPayload } from './capability.js';
+export { readLoadableCatalog, normalizeLocalCatalog, HOST_CONTROL_CATALOG_PATH, } from './catalog.js';
+export { loadModel, unloadModel, getStatus, resolveModelPath, decideSwap, ensureLoaded, normalizeStatus, DEFAULT_MAX_SEQ_LENGTH, HOST_CONTROL_LOAD_PATH, HOST_CONTROL_UNLOAD_PATH, HOST_CONTROL_STATUS_PATH, HOST_CONTROL_LOAD_READY_TIMEOUT_MS, HOST_CONTROL_LOAD_POLL_INTERVAL_MS, HOST_CONTROL_ERROR_LOAD_TIMEOUT, } from './load.js';
+export { getHardware, getKvCacheEstimate, normalizeHardware, normalizeKvCacheEstimate, computeSafeMaxSeqLength, resolveSafeLoadOptions, CODEX_TURN1_FLOOR, VRAM_SAFETY_MARGIN_MB, KV_CACHE_MB_PER_TOKEN, KV_QUANT_FOOTPRINT_FACTOR, KV_QUANT_CACHE_TYPE, MAX_SEQ_LENGTH_CEILING, HOST_CONTROL_HARDWARE_PATH, HOST_CONTROL_KV_CACHE_PATH, } from './sizing.js';
+//# sourceMappingURL=index.js.map

package/dist/host-control/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/host-control/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAiBH,OAAO,EACL,OAAO,EACP,QAAQ,EACR,mBAAmB,EACnB,gBAAgB,EAChB,6BAA6B,EAC7B,sBAAsB,EACtB,+BAA+B,EAC/B,yBAAyB,EACzB,8BAA8B,EAC9B,0BAA0B,GAC3B,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,oBAAoB,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AAErF,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,SAAS,EACT,WAAW,EACX,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,eAAe,EACf,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,EACxB,kCAAkC,EAClC,kCAAkC,EAClC,+BAA+B,GAChC,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,wBAAwB,EACxB,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,aAAa,CAAC"}