@vibesdotdev/pm 0.0.0-stage → 1.0.0-rc.3

package/dist/managers/resource-manager.js

@@ -0,0 +1,767 @@
+/**
+ * Resource Manager
+ * Manages resource lifecycle using pluggable providers
+ */
+import * as z from 'zod/v4';
+import { CapabilityError, CaughtFailureSchema, isCapabilityError, valueFreeFailure } from '@vibesdotdev/kernel';
+import { getLogger } from '@vibesdotdev/logging';
+import { composeHookEnv } from "../helpers/process-credentials.js";
+import { redactedExcerpt } from '@vibesdotdev/shared/utils';
+import { isWaitTimeout } from "../utils/bounded-wait.js";
+import { attempt, failureText } from "../utils/attempt.js";
+import { getRuntimeHostCommands, requireRuntimeCwd } from '@vibesdotdev/kernel';
+import { runCapture } from '@vibesdotdev/kernel/execution';
+import { resolveHookCommand } from "../services/process-command.js";
+/** The reason of the deadline a bounded status probe raises. */
+const STATUS_TIMEOUT_REASON = 'pm-resource-status-timeout';
+/** A caller's probe bound ran out (the shared probe keeps running for other callers). */
+export function statusProbeTimeout(timeoutMs) {
+    return new CapabilityError(`Resource status probe timed out after ${timeoutMs}ms`, 'TIMEOUT', {
+        reason: STATUS_TIMEOUT_REASON,
+        details: { timeoutMs }
+    });
+}
+const StatusTimeoutDetailsSchema = z.object({ timeoutMs: z.number() });
+/** The bound a failure ran out of when it is the status probe deadline; otherwise none. */
+function readStatusTimeoutMs(failure) {
+    if (!isCapabilityError(failure) || failure.reason !== STATUS_TIMEOUT_REASON)
+        return undefined;
+    const details = StatusTimeoutDetailsSchema.safeParse(failure.details);
+    return details.success ? details.data.timeoutMs : undefined;
+}
+const StatusTimeoutOptionSchema = z.number().positive();
+function normalizeStatusTimeoutMs(options) {
+    const timeoutMs = StatusTimeoutOptionSchema.safeParse(options.timeoutMs);
+    return timeoutMs.success ? timeoutMs.data : undefined;
+}
+const SourceHashSchema = z.string();
+/** The most of a hook's output a failure message carries. */
+const HOOK_OUTPUT_EXCERPT_CHARS = 4_000;
+/**
+ * Statuses that mean "a setup/teardown-shaped operation (which may include
+ * a lifecycle hook) is currently in flight for this resource". `reload()`
+ * uses this as the "no hook running" gate from the config-watcher hot-reload
+ * contract: a config-only edit must never race a running hook.
+ */
+const RESOURCE_BUSY_STATUSES = new Set([
+    'creating',
+    'updating',
+    'stopping',
+    'deleting'
+]);
+export class ResourceManager {
+    store;
+    providers;
+    getRuntime;
+    inFlightStatusChecks = new Map();
+    cachedConfigs;
+    invalidateConfigCache() {
+        this.cachedConfigs = undefined;
+    }
+    async getOrLoadResourceConfigs() {
+        const now = Date.now();
+        if (this.cachedConfigs && now - this.cachedConfigs.timestamp < 30_000) {
+            return this.cachedConfigs.configs;
+        }
+        const { readPMGraph } = await import("../graph.js");
+        const configs = (await readPMGraph(this.getRuntime())).resources;
+        this.cachedConfigs = { configs, timestamp: now };
+        return configs;
+    }
+    /** The handed runtime's Logging, read per entry so it follows hot-reload generations (C083a). */
+    get log() {
+        return getLogger('pm:resource-manager', this.getRuntime());
+    }
+    constructor(store, providers, 
+    /** The daemon's serve host runtime; a getter, so it follows hot-reload generations. */
+    getRuntime) {
+        this.store = store;
+        this.providers = providers;
+        this.getRuntime = getRuntime;
+    }
+    /**
+     * The config each resource was last set up with by THIS manager (its
+     * daemon's state, never a provider module's singleton map): what
+     * status/stop/resume/teardown act on. Cleared on teardown.
+     */
+    appliedConfigs = new Map();
+    /** What every provider call runs against: the current generation of the handed runtime, and the resource's config. */
+    providerContext(config) {
+        const context = { runtime: this.getRuntime() };
+        if (config)
+            return { ...context, config };
+        return context;
+    }
+    /**
+     * The context for a call that names a resource by id: the config this
+     * manager applied, else the caller's explicit config, else (a resource set
+     * up before this daemon started) its declared config from the graph; none
+     * when it is none of these.
+     */
+    async providerContextFor(id, explicit) {
+        const applied = this.appliedConfigs.get(id) ?? explicit;
+        if (applied)
+            return this.providerContext(applied);
+        const declared = (await this.getOrLoadResourceConfigs()).find((config) => config.id === id);
+        return this.providerContext(declared);
+    }
+    getOrStartProviderStatus(id, provider, explicit) {
+        const existing = this.inFlightStatusChecks.get(id);
+        if (existing) {
+            return existing;
+        }
+        const status = this.providerContextFor(id, explicit)
+            .then((context) => provider.status(id, context))
+            .finally(() => {
+            this.inFlightStatusChecks.delete(id);
+        });
+        this.inFlightStatusChecks.set(id, status);
+        return status;
+    }
+    async providerStatus(id, provider, options, explicit) {
+        const status = this.getOrStartProviderStatus(id, provider, explicit);
+        const timeoutMs = normalizeStatusTimeoutMs(options);
+        if (!timeoutMs) {
+            return status;
+        }
+        // The shared in-flight probe keeps running for other callers; this
+        // caller's bound is a lifecycle wait (RC07).
+        const bounded = await attempt(() => this.getRuntime().lifecycle.wait(() => status, { timeoutMs, reason: 'pm-resource-status' }));
+        if (bounded.ok)
+            return bounded.value;
+        if (isWaitTimeout(bounded.failure))
+            throw statusProbeTimeout(timeoutMs);
+        throw bounded.failure;
+    }
+    timeoutFallbackState(state, timeoutMs) {
+        const now = new Date();
+        return {
+            ...state,
+            error: state.error ?? statusProbeTimeout(timeoutMs).message,
+            lastChecked: now,
+            metadata: {
+                ...state.metadata,
+                statusProbe: {
+                    timedOut: true,
+                    timeoutMs,
+                    checkedAt: now.toISOString()
+                }
+            }
+        };
+    }
+    /** The stored state, marked with the probe failure that stopped it being refreshed (nothing is persisted). */
+    probeFailedState(state, failure) {
+        const now = new Date();
+        return {
+            ...state,
+            error: state.error ?? failureText(failure),
+            lastChecked: now,
+            metadata: {
+                ...state.metadata,
+                statusProbe: {
+                    failed: true,
+                    failure: failureText(failure),
+                    checkedAt: now.toISOString()
+                }
+            }
+        };
+    }
+    /**
+     * Setup (create or ensure) a resource.
+     *
+     * When the provider implements `computeSourceHash` and a stored
+     * state is already `ready` with a matching hash, setup short-circuits
+     * with `result.skipped = true` and does not re-invoke the provider.
+     * Pass `{ force: true }` to bypass the drift check and always apply.
+     */
+    async setup(config, options = {}) {
+        // Get provider for this resource type
+        const provider = await this.providers.get(config.type);
+        // Drift detection: if the provider supports source hashing and we
+        // have a prior ready state with a matching hash, skip the re-apply.
+        let freshHash = null;
+        if (provider.computeSourceHash) {
+            const computeSourceHash = provider.computeSourceHash.bind(provider);
+            const hashed = await attempt(() => computeSourceHash(config, this.providerContext(config)));
+            if (hashed.ok) {
+                freshHash = hashed.value;
+            }
+            else {
+                this.log.warn('computeSourceHash failed', {
+                    resourceId: config.id,
+                    failure: valueFreeFailure(hashed.failure)
+                });
+            }
+        }
+        if (!options.force && freshHash) {
+            const prior = await this.store.getResource(config.id);
+            const storedHash = SourceHashSchema.safeParse(prior?.metadata?.sourceHash);
+            const priorHash = storedHash.success ? storedHash.data : undefined;
+            if (prior && prior.status === 'ready' && priorHash && priorHash === freshHash) {
+                const refreshed = {
+                    ...prior,
+                    lastChecked: new Date()
+                };
+                await this.store.setResource(refreshed);
+                return {
+                    state: refreshed,
+                    skipped: true,
+                    skipReason: 'source unchanged'
+                };
+            }
+        }
+        // Update state to 'creating'
+        const now = new Date();
+        const existingForCreate = await this.store.getResource(config.id);
+        const creatingState = {
+            id: config.id,
+            type: config.type,
+            status: 'creating',
+            createdAt: existingForCreate?.createdAt ?? now,
+            lastChecked: now
+        };
+        await this.store.setResource(creatingState);
+        try {
+            // Call provider setup
+            this.appliedConfigs.set(config.id, config);
+            const result = await provider.setup(config, this.providerContext(config));
+            // Merge the fresh source hash into the state metadata so the
+            // next setup() call can detect drift without re-invoking the
+            // provider. Providers are free to write their own metadata
+            // too — the manager only owns `sourceHash`.
+            if (freshHash) {
+                result.state = {
+                    ...result.state,
+                    metadata: {
+                        ...result.state.metadata,
+                        sourceHash: freshHash
+                    }
+                };
+            }
+            const appliedAt = new Date();
+            result.state = {
+                ...result.state,
+                createdAt: result.state.createdAt ?? appliedAt,
+                updatedAt: appliedAt
+            };
+            // Save successful state
+            await this.store.setResource(result.state);
+            // Run onCreate hook if specified
+            if (config.onCreate) {
+                await this.runHook(config.onCreate, config.id);
+            }
+            // Wait for ready if configured
+            if (config.waitForReady && provider.checkReady) {
+                await this.waitForReady(config, result.state, {
+                    timeout: config.readyTimeout
+                });
+            }
+            return result;
+        }
+        catch (error) {
+            // CRITICAL FIX (Issue 2.6): Preserve previous state context when saving error
+            const existingState = await this.store.getResource(config.id);
+            const errorMessage = failureText(CaughtFailureSchema.parse(error));
+            const errorState = {
+                // Preserve all existing fields
+                ...(existingState ?? {
+                    id: config.id,
+                    type: config.type
+                }),
+                // Update error fields with history
+                status: 'error',
+                error: errorMessage,
+                // Append to error history if available
+                lastError: existingState?.lastError
+                    ? `${existingState.lastError} | New error: ${errorMessage}`
+                    : errorMessage,
+                lastChecked: new Date()
+            };
+            await this.store.setResource(errorState);
+            throw error;
+        }
+    }
+    /**
+     * Hot-reload a resource's config without a daemon restart.
+     *
+     * Mirrors process hot-reload (`ProcessManager.register`): the caller
+     * (ConfigWatcher) diffs discovered configs against what it last saw and
+     * only calls `reload()` for ids whose config actually changed.
+     *
+     * - Idle resource (no setup/teardown operation in flight): the new
+     *   config is applied via `setup(config, { force: true })` — this
+     *   bypasses the source-hash short-circuit (the on-disk config changed
+     *   by definition, e.g. a hook path fix) and re-runs the provider's
+     *   setup + onCreate hook + readiness check against the new config, the
+     *   same path a `pm resource apply` would take.
+     * - Busy resource (status is creating/updating/stopping/deleting — a
+     *   hook is presumed in flight): returns `{ status: 'deferred' }` and
+     *   does nothing, so the swap can never race a running hook. The caller
+     *   is responsible for retrying once the resource is idle again.
+     */
+    async reload(config) {
+        const existing = await this.store.getResource(config.id);
+        if (existing && RESOURCE_BUSY_STATUSES.has(existing.status)) {
+            return { status: 'deferred' };
+        }
+        const result = await this.setup(config, { force: true });
+        // A declared `onUpdate` hook runs when an existing resource took a new config.
+        if (existing && config.onUpdate) {
+            await this.runHook(config.onUpdate, config.id);
+        }
+        return { status: 'applied', state: result.state };
+    }
+    /**
+     * Stop a resource (non-destructive)
+     * Scales down deployments to 0 replicas without deleting resources
+     */
+    async stop(id, state) {
+        // Get current state if not provided
+        const resolvedState = state ?? (await this.store.getResource(id));
+        if (!resolvedState) {
+            // Resource doesn't exist in state
+            return;
+        }
+        // Get provider
+        const provider = await this.providers.get(resolvedState.type);
+        // Check if provider supports stop
+        if (!provider.stop) {
+            // Provider doesn't support stop - this is a no-op
+            // Resource stays running (e.g., for resources that can't be "stopped")
+            this.log.info('Provider does not support stop, skipping', {
+                resourceId: id,
+                resourceType: resolvedState.type
+            });
+            return;
+        }
+        // Update state to 'stopping'
+        await this.store.updateResource(id, {
+            status: 'stopping',
+            lastChecked: new Date()
+        });
+        const providerStop = provider.stop.bind(provider);
+        const stopped = await attempt(async () => {
+            await providerStop(id, resolvedState, await this.providerContextFor(id));
+            // Update state to 'stopped'
+            await this.store.updateResource(id, {
+                status: 'stopped',
+                lastChecked: new Date()
+            });
+        });
+        if (!stopped.ok) {
+            // CRITICAL FIX (Issue 2.6): Get existing state to preserve error context
+            const existingState = await this.store.getResource(id);
+            const errorMessage = failureText(stopped.failure);
+            // Save error state but don't throw - stop failures shouldn't block other stops
+            await this.store.updateResource(id, {
+                status: 'error',
+                error: errorMessage,
+                lastError: existingState?.lastError
+                    ? `${existingState.lastError} | Stop error: ${errorMessage}`
+                    : errorMessage,
+                lastChecked: new Date()
+            });
+            // Log but don't throw - allows other resources to continue stopping
+            this.log.error('Failed to stop resource', {
+                resourceId: id,
+                failure: valueFreeFailure(stopped.failure)
+            });
+        }
+    }
+    /**
+     * Resume a stopped resource
+     */
+    async resume(id, state) {
+        // Get current state if not provided
+        const resolvedState = state ?? (await this.store.getResource(id));
+        if (!resolvedState) {
+            // Resource doesn't exist in state
+            return;
+        }
+        // Get provider
+        const provider = await this.providers.get(resolvedState.type);
+        // Check if provider supports resume
+        if (!provider.resume) {
+            // Provider doesn't support resume - this is a no-op
+            this.log.info('Provider does not support resume, skipping', {
+                resourceId: id,
+                resourceType: resolvedState.type
+            });
+            return;
+        }
+        // Update state to 'resuming'
+        await this.store.updateResource(id, {
+            status: 'creating', // Reuse 'creating' status for resuming
+            lastChecked: new Date()
+        });
+        try {
+            await provider.resume(id, resolvedState, await this.providerContextFor(id));
+            // Update state to 'ready'
+            await this.store.updateResource(id, {
+                status: 'ready',
+                lastChecked: new Date()
+            });
+        }
+        catch (error) {
+            // CRITICAL FIX (Issue 2.6): Get existing state to preserve error context
+            const existingState = await this.store.getResource(id);
+            const errorMessage = failureText(CaughtFailureSchema.parse(error));
+            await this.store.updateResource(id, {
+                status: 'error',
+                error: errorMessage,
+                lastError: existingState?.lastError
+                    ? `${existingState.lastError} | Resume error: ${errorMessage}`
+                    : errorMessage,
+                lastChecked: new Date()
+            });
+            throw error;
+        }
+    }
+    /**
+     * Teardown (delete) a resource
+     */
+    async teardown(id, state) {
+        // Get current state if not provided
+        const resolvedState = state ?? (await this.store.getResource(id));
+        if (!resolvedState) {
+            // Resource doesn't exist in state, but try to clean it up anyway
+            return;
+        }
+        // Get provider
+        const provider = await this.providers.get(resolvedState.type);
+        // Update state to 'deleting'
+        await this.store.updateResource(id, {
+            status: 'deleting',
+            lastChecked: new Date()
+        });
+        try {
+            // A declared `onDelete` hook runs before the provider tears down.
+            const context = await this.providerContextFor(id);
+            if (context.config?.onDelete) {
+                await this.runHook(context.config.onDelete, id);
+            }
+            await provider.teardown(id, resolvedState, context);
+            this.appliedConfigs.delete(id);
+            // Remove from state
+            await this.store.deleteResource(id);
+        }
+        catch (error) {
+            // CRITICAL FIX (Issue 2.6): Get existing state to preserve error context
+            const existingState = await this.store.getResource(id);
+            const errorMessage = failureText(CaughtFailureSchema.parse(error));
+            // Save error state
+            await this.store.updateResource(id, {
+                status: 'error',
+                error: errorMessage,
+                lastError: existingState?.lastError
+                    ? `${existingState.lastError} | Teardown error: ${errorMessage}`
+                    : errorMessage,
+                lastChecked: new Date()
+            });
+            throw error;
+        }
+    }
+    /**
+     * Get resource status
+     */
+    async status(id, options = {}, explicitConfig) {
+        // Try to get from state
+        const state = await this.store.getResource(id);
+        // Strengthen probe (per 019ea542 "Fleet resources ready + shaped" tranche):
+        // Previously only on !state (complete absence). But awareness resources (fleet/*)
+        // can have persisted 'missing' states (e.g. from prior provider.setup which returns 'missing'
+        // for read-only, or early runs before reg). Per pm/fleet/wire.ts + pm/SPEC.md §"Resource provider registry":
+        // providers always emit 'ready' + exact FleetDeploymentRecord[] / FleetCloudDevSlice[] shapes.
+        // list.impl (pm/src/cli/pm.list.impl.ts) + resource status impl collect via client.getResourceStatus
+        // and forward metadata for "fleet" section / json.
+        // The !state probe reads the declared resources through readPMGraph (the kernel-discovered
+        // 'pm/resource' descriptors plus config.plugins.pm; graph.ts).
+        // Extend condition to also probe on stored 'missing' or fleet/ types: always prefer provider 'ready'+shaped metadata
+        // over stale 'missing'. Persist from probe so getAll etc see shaped, and clears stale for future.
+        // This ensures BOTH `pm resource status <fleet-id> --json` and `pm list --env=... --json` "fleet" reliably have ready + records/slices.
+        // Reusable for awareness; runtime-first (fleet details+providers in pm/; manager/list/client in pm).
+        // No mutation (infra-deploy sole owner of real deploys).
+        if (!state || state.status === 'missing' || state.type.startsWith('fleet/')) {
+            // Resource not in state, or has stale 'missing', or is fleet awareness (per wire.ts).
+            // Probe provider directly (using loaded config) so shaped data (Fleet* per pm/fleet/wire.ts)
+            // is surfaced. readPMGraph reads the declared pm/resource descriptors (kernel discovery plus config.plugins.pm)
+            // and triggers co-located *.pm.process.ts imports (side-effect reg of instance fleet providers in this process,
+            // critical for daemon since fleet reg not in builtin).
+            let probeTimedOutMs;
+            const probed = await attempt(async () => {
+                const config = explicitConfig ||
+                    (await this.getOrLoadResourceConfigs()).find((candidate) => candidate.id === id);
+                if (!config)
+                    return undefined;
+                const provider = await this.providers.get(config.type);
+                if (!provider)
+                    return undefined;
+                const statusResult = await this.providerStatus(id, provider, options, config);
+                const probedState = {
+                    id,
+                    type: config.type,
+                    status: statusResult.status,
+                    metadata: {
+                        ...config.config,
+                        ...statusResult.metadata
+                    },
+                    error: statusResult.error,
+                    lastChecked: new Date()
+                };
+                // Persist so subsequent getState/getAllResourceStates see 'ready' + shaped metadata (records/slices),
+                // and future status hits present-path refresh. Clears any prior 'missing' from store.
+                await this.store.setResource(probedState);
+                return probedState;
+            });
+            if (probed.ok) {
+                if (probed.value)
+                    return probed.value;
+            }
+            else {
+                // A probe that timed out falls through to the synthetic missing (or
+                // the existing state below). Any other failure is the provider's and
+                // propagates typed; it is never read as "missing".
+                const timedOutMs = readStatusTimeoutMs(probed.failure);
+                if (timedOutMs === undefined)
+                    throw probed.failure;
+                if (options.staleOnTimeout && state) {
+                    return this.timeoutFallbackState(state, timedOutMs);
+                }
+                probeTimedOutMs = timedOutMs;
+            }
+            if (!state) {
+                // Default: resource not in state - return missing
+                return {
+                    id,
+                    type: 'unknown',
+                    status: 'missing',
+                    error: probeTimedOutMs
+                        ? `Resource status probe timed out after ${probeTimedOutMs}ms`
+                        : undefined,
+                    lastChecked: new Date()
+                };
+            }
+            // Had state (e.g. missing) but probe didn't yield provider/config this time; fall through to return it (with possible later refresh).
+        }
+        // Get provider and check current status
+        const refreshed = await attempt(async () => {
+            const provider = await this.providers.get(state.type);
+            const statusResult = await this.providerStatus(id, provider, options);
+            // If provider returns 'missing' but we have a stored 'ready' state,
+            // the provider's in-memory cache was likely cleared (daemon restart).
+            // Don't overwrite the valid stored state - just return it with updated lastChecked.
+            // The state will be properly refreshed on next setup() call.
+            if (statusResult.status === 'missing' && state.status === 'ready') {
+                const preservedState = {
+                    ...state,
+                    lastChecked: new Date()
+                };
+                await this.store.setResource(preservedState);
+                return preservedState;
+            }
+            // Update state with fresh status
+            const updatedState = {
+                ...state,
+                status: statusResult.status,
+                metadata: { ...state.metadata, ...statusResult.metadata },
+                error: statusResult.error,
+                lastChecked: new Date()
+            };
+            await this.store.setResource(updatedState);
+            return updatedState;
+        });
+        if (refreshed.ok)
+            return refreshed.value;
+        const timedOutMs = readStatusTimeoutMs(refreshed.failure);
+        if (timedOutMs !== undefined && options.staleOnTimeout) {
+            return this.timeoutFallbackState(state, timedOutMs);
+        }
+        // The status check failed: the stored state is returned, marked with the
+        // failure (never as if it had been refreshed) and the failure is reported.
+        this.log.warn('Resource status probe failed; returning the stored state', {
+            resourceId: id,
+            failure: valueFreeFailure(refreshed.failure)
+        });
+        return this.probeFailedState(state, refreshed.failure);
+    }
+    /**
+     * Get resource state (from store only, no provider check)
+     */
+    getState(id) {
+        return this.store.getResource(id);
+    }
+    /**
+     * Check if a resource's source config has drifted from what was last applied.
+     *
+     * Returns { stale: true } when the provider's computeSourceHash produces
+     * a different value than the one stored in state metadata.
+     */
+    async checkStaleness(config) {
+        const provider = await this.providers.get(config.type);
+        if (!provider.computeSourceHash) {
+            return { stale: false };
+        }
+        const state = await this.store.getResource(config.id);
+        if (!state || state.status !== 'ready') {
+            return { stale: false };
+        }
+        const stored = SourceHashSchema.safeParse(state.metadata?.sourceHash);
+        const storedHash = stored.success ? stored.data : undefined;
+        if (!storedHash) {
+            return { stale: false };
+        }
+        // A source hash that cannot be computed is not "not stale": the
+        // provider's failure propagates typed to the staleness caller.
+        const currentHash = await provider.computeSourceHash(config, this.providerContext(config));
+        if (!currentHash) {
+            return { stale: false, storedHash };
+        }
+        return {
+            stale: storedHash !== currentHash,
+            storedHash,
+            currentHash
+        };
+    }
+    /**
+     * Get all resource states
+     */
+    async getAllStates() {
+        const states = await this.store.getAllResources();
+        return new Map(states.map((s) => [s.id, s]));
+    }
+    /**
+     * Wait for resource to be ready
+     */
+    async waitForReady(config, state, options = {}) {
+        const timeout = options.timeout || config.readyTimeout || 60000;
+        const pollInterval = options.pollInterval || 1000;
+        const provider = await this.providers.get(config.type);
+        if (!provider.checkReady) {
+            // Provider doesn't support ready checks - assume ready after setup
+            return;
+        }
+        // Bounded by the runtime lifecycle (RC07). Poll: a provider (owner)
+        // answers readiness only when asked (`checkReady`), and may say when to
+        // ask again (`retryAfter`); it publishes no readiness event.
+        const runtime = this.getRuntime();
+        let lastReason;
+        const waitOptions = options.signal
+            ? { timeoutMs: timeout, reason: 'pm-resource-ready', signal: options.signal }
+            : { timeoutMs: timeout, reason: 'pm-resource-ready' };
+        const checkReady = provider.checkReady.bind(provider);
+        const ready = await attempt(() => runtime.lifecycle.wait(async (signal) => {
+            for (;;) {
+                const result = await checkReady(config, state, this.providerContext(config));
+                if (result.ready) {
+                    await this.store.updateResource(config.id, { status: 'ready', lastChecked: new Date() });
+                    return;
+                }
+                lastReason = result.reason;
+                await runtime.lifecycle.delay(result.retryAfter || pollInterval, signal);
+            }
+        }, waitOptions));
+        if (ready.ok)
+            return;
+        if (isWaitTimeout(ready.failure)) {
+            throw new CapabilityError(`Resource ${config.id} did not become ready within ${timeout}ms. Reason: ${lastReason || 'unknown'}`, 'TIMEOUT', {
+                reason: 'pm-resource-ready-timeout',
+                details: { resourceId: config.id, timeoutMs: timeout },
+                cause: ready.failure
+            });
+        }
+        throw ready.failure;
+    }
+    /**
+     * Setup multiple resources in batch
+     */
+    async setupAll(configs) {
+        const results = new Map();
+        // Sequential execution for now - could optimize with dependency-aware parallel execution
+        for (const config of configs) {
+            const setUp = await attempt(() => this.setup(config));
+            if (setUp.ok) {
+                results.set(config.id, setUp.value);
+                continue;
+            }
+            // Continue with other resources even if one fails, but record
+            // the failure in the result map — a silently missing id made
+            // a broken resource indistinguishable from an absent one.
+            this.log.error('Failed to setup resource', {
+                resourceId: config.id,
+                failure: valueFreeFailure(setUp.failure)
+            });
+            results.set(config.id, {
+                state: {
+                    id: config.id,
+                    type: config.type,
+                    status: 'error',
+                    lastChecked: new Date(),
+                    error: failureText(setUp.failure)
+                }
+            });
+        }
+        return results;
+    }
+    /**
+     * Teardown multiple resources in batch
+     */
+    async teardownAll(ids) {
+        // Sequential execution in reverse order; iterate a copy so the
+        // caller's array keeps its order.
+        for (const id of [...ids].reverse()) {
+            const torn = await attempt(() => this.teardown(id));
+            // Continue with other resources even if one fails
+            if (!torn.ok) {
+                this.log.error('Failed to teardown resource', {
+                    resourceId: id,
+                    failure: valueFreeFailure(torn.failure)
+                });
+            }
+        }
+    }
+    /**
+     * Run a lifecycle hook
+     */
+    async runHook(hook, resourceId) {
+        // A resource hook is a PM child (C15): the base set, the host's re-entry
+        // facts and roots, the names it inherits, its declared env, and its
+        // declared credentials resolved at spawn (D-RC05), never argv.
+        const runtime = this.getRuntime();
+        const cwd = hook.cwd ?? requireRuntimeCwd(runtime);
+        const hookEnv = await composeHookEnv(runtime, hook, cwd, `${resourceId}:hook`);
+        const hostCommands = hook.selfSpawn ? await getRuntimeHostCommands(runtime) : undefined;
+        const resolved = resolveHookCommand(hook, hostCommands, `PM resource '${resourceId}' hook`);
+        // The hook's whole environment is the one composed above.
+        const ran = await attempt(() => runCapture(runtime, resolved.command, resolved.args, {
+            env: hookEnv.env,
+            envMode: 'replace',
+            cwd
+        }));
+        if (!ran.ok) {
+            hookEnv.audit('failure');
+            throw ran.failure;
+        }
+        const { exitCode } = ran.value;
+        hookEnv.audit(exitCode === 0 ? 'success' : 'failure');
+        // A credential the hook printed never reaches the failure message: its
+        // output is a bounded, credential-free excerpt.
+        const excerpt = (text) => redactedExcerpt(text, { secrets: hookEnv.redact, maxChars: HOOK_OUTPUT_EXCERPT_CHARS });
+        const stdout = excerpt(ran.value.stdout);
+        const stderr = excerpt(ran.value.stderr);
+        if (exitCode !== 0) {
+            const message = `Hook failed for resource ${resourceId}: ${stderr || stdout}`;
+            if (!hook.ignoreFailure) {
+                throw new CapabilityError(message, 'UNAVAILABLE', {
+                    reason: 'pm-resource-hook-failed',
+                    details: { resourceId, exitCode }
+                });
+            }
+            this.log.warn('Hook failed but ignoreFailure=true', {
+                resourceId,
+                exitCode,
+                error: message
+            });
+        }
+    }
+}
+//# sourceMappingURL=resource-manager.js.map