@wairon/cli 5.0.2-dev.14 → 5.0.2-dev.15

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.0.2-dev.14";
+    WAIRON_VERSION = "5.0.2-dev.15";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     ARCHITECT_AGENT_ID = "agent-architect";
     ARCHITECT_TEMPLATE_ID = "architect";
@@ -458,7 +458,7 @@ var init_domain = __esm({
 });
 
 // src/models/project.ts
-var import_zod3, BuiltinTargetConfigSchema, CustomTargetConfigSchema, TargetConfigSchema, NamingRuleConfigSchema, DocumentationRuleConfigSchema, ComplexityRuleConfigSchema, DesignDepthSchema, RulesConfigSchema, PathsConfigSchema, ProjectConfigSchema;
+var import_zod3, BuiltinTargetConfigSchema, CustomTargetConfigSchema, TargetConfigSchema, NamingRuleConfigSchema, DocumentationRuleConfigSchema, ComplexityRuleConfigSchema, DesignDepthSchema, RulesConfigSchema, PathsConfigSchema, ProfileSelectionSubjectSchema, ProjectProfileSelectionSchema, ProjectConfigSchema;
 var init_project = __esm({
   "src/models/project.ts"() {
     "use strict";
@@ -582,6 +582,24 @@ var init_project = __esm({
       /** Base directory containing SDD specification files, relative to project root */
       specsDir: import_zod3.z.string().default(".wai/specs")
     });
+    ProfileSelectionSubjectSchema = import_zod3.z.object({
+      userId: import_zod3.z.string(),
+      kind: import_zod3.z.string(),
+      issuer: import_zod3.z.string(),
+      externalSubject: import_zod3.z.string().optional(),
+      displayName: import_zod3.z.string().optional(),
+      email: import_zod3.z.string().optional()
+    });
+    ProjectProfileSelectionSchema = import_zod3.z.object({
+      /** Selected architectural profile ids. The first resolvable one is applied as projectType. */
+      profileIds: import_zod3.z.array(import_zod3.z.string()).default([]),
+      /** Pack names the governing policy requires for this project. */
+      requiredPackNames: import_zod3.z.array(import_zod3.z.string()).default([]),
+      /** Pack names applied by default unless explicitly overridden. */
+      defaultPackNames: import_zod3.z.array(import_zod3.z.string()).optional(),
+      selectedBy: ProfileSelectionSubjectSchema.optional(),
+      selectedAt: import_zod3.z.string()
+    });
     ProjectConfigSchema = import_zod3.z.object({
       /**
        * Schema version — used to detect incompatible config formats in future
@@ -622,6 +640,13 @@ var init_project = __esm({
         useGlobalPacks: import_zod3.z.boolean().default(true)
       }).optional(),
       paths: PathsConfigSchema.default({}),
+      /**
+       * The profile/pack selection a hosted policy workflow applied to this project.
+       * The RECORD of what was chosen; `projectType` above is what actually governs
+       * validation. Modeled so the parse/write round trip preserves it (see
+       * ProjectProfileSelectionSchema).
+       */
+      profileSelection: ProjectProfileSelectionSchema.optional(),
       /**
        * Path to a directory containing org/user-level default templates.
        * Resolved before built-in templates but after project-local templates.
@@ -7313,7 +7338,7 @@ var init_extensions = __esm({
 });
 
 // src/core/rules/types.ts
-var BUILTIN_PROFILES;
+var BUILTIN_PROFILES, PROJECT_KINDS;
 var init_types = __esm({
   "src/core/rules/types.ts"() {
     "use strict";
@@ -7326,6 +7351,7 @@ var init_types = __esm({
       "realtime-embedded",
       "plc-cyclic"
     ];
+    PROJECT_KINDS = ["fullstack", "system-of-systems", "monorepo"];
   }
 });
 
@@ -10509,14 +10535,14 @@ var init_declarative_assertions = __esm({
 });
 
 // src/core/rules/profiles.ts
-var BACKEND_LIKE, FRONTEND_LIKE, PROJECT_KINDS, profilesRule;
+var BACKEND_LIKE, FRONTEND_LIKE, PROJECT_KINDS2, profilesRule;
 var init_profiles = __esm({
   "src/core/rules/profiles.ts"() {
     "use strict";
     init_types();
     BACKEND_LIKE = /* @__PURE__ */ new Set(["backend", "lowlevel-os", "game-ecs", "realtime-embedded", "plc-cyclic"]);
     FRONTEND_LIKE = /* @__PURE__ */ new Set(["frontend-reactive", "frontend-controller"]);
-    PROJECT_KINDS = /* @__PURE__ */ new Set(["fullstack", "system-of-systems", "monorepo"]);
+    PROJECT_KINDS2 = new Set(PROJECT_KINDS);
     profilesRule = {
       name: "architectural-profiles",
       description: "Per-profile stereotype constraints: View/FeatureComponent/RouterComponent only in frontend profiles; Actor/Supervisor forbidden in plc-cyclic (single scan cycle); Actor/Supervisor in frontend profiles warned. Extension packs may register custom profiles (family + forbidden/discouraged stereotype lists); unknown profile names are flagged.",
@@ -10540,7 +10566,7 @@ var init_profiles = __esm({
             );
           }
         }
-        if (!registered.has(ctx.projectType) && !PROJECT_KINDS.has(ctx.projectType)) {
+        if (!registered.has(ctx.projectType) && !PROJECT_KINDS2.has(ctx.projectType)) {
           ctx.addIssue(
             "warning",
             "UNKNOWN_PROFILE",
@@ -27126,7 +27152,15 @@ var hostCore = {
   /** The ids of wairon's built-in architectural profiles, read from the core rules
    *  registry's built-in profile set (BUILTIN_PROFILES) — a pure, side-effect-free
    *  read of a bundled constant. */
-  builtinProfileIds: () => [...BUILTIN_PROFILES]
+  builtinProfileIds: () => [...BUILTIN_PROFILES],
+  /** The ids of wairon's built-in COMPOSITE PROJECT KINDS, read from the core
+   *  rules registry's bundled constant (PROJECT_KINDS) — a pure, side-effect-free
+   *  read. The counterpart of builtinProfileIds: legal projectType values that
+   *  are not architectural profiles and carry no profile doctrine of their own,
+   *  so the hosted profile-application path recognizes a project kind as
+   *  resolvable-as-is (no contributing pack to adopt) instead of refusing it as
+   *  an unknown profile. */
+  builtinProjectKinds: () => [...PROJECT_KINDS]
 };
 function resolveContainedProjectPath(projectRoot2, projectPath) {
   return assertContainedProjectPath(projectRoot2, projectPath);
@@ -27747,6 +27781,35 @@ function storeListGlobalPacks() {
   );
   return [...instance, ...image];
 }
+function scanGlobalPackProfiles() {
+  const out = [];
+  for (const dir of [hostCore.globalPacksDir(), imagePacksDir()]) {
+    for (const full of hostCore.discoverPacks(dir)) {
+      try {
+        const loaded = hostCore.loadExtensionPacks([{ ref: full, scope: "global" }], path45.dirname(full));
+        if (loaded.errors.length) continue;
+        const source = loaded.packNames[0] ?? path45.basename(full);
+        for (const [id, def] of Object.entries(loaded.profiles)) out.push({ id, source, family: def.family });
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function scanProjectPackProfiles() {
+  const root = getProjectRoot();
+  const out = [];
+  for (const ref of loadProjectConfig().extensions?.packs ?? []) {
+    try {
+      const loaded = hostCore.loadExtensionPacks([{ ref, scope: "project" }], root);
+      if (loaded.errors.length) continue;
+      const source = loaded.packNames[0] ?? stem(ref);
+      for (const [id, def] of Object.entries(loaded.profiles)) out.push({ id, source, family: def.family });
+    } catch {
+    }
+  }
+  return out;
+}
 function storeListAvailableProfiles() {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
@@ -27757,19 +27820,21 @@ function storeListAvailableProfiles() {
     out.push(family ? { id, source, family } : { id, source });
   };
   for (const id of hostCore.builtinProfileIds()) emit(id, "builtin");
-  const scanTier = (dir) => {
-    for (const full of hostCore.discoverPacks(dir)) {
-      try {
-        const loaded = hostCore.loadExtensionPacks([{ ref: full, scope: "global" }], path45.dirname(full));
-        if (loaded.errors.length) continue;
-        const source = loaded.packNames[0] ?? path45.basename(full);
-        for (const [id, def] of Object.entries(loaded.profiles)) emit(id, source, def.family);
-      } catch {
-      }
-    }
+  for (const c of scanGlobalPackProfiles()) emit(c.id, c.source, c.family);
+  return out;
+}
+function storeListProjectProfiles() {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const emit = (id, source, installed, family) => {
+    const key = JSON.stringify([id, source]);
+    if (seen.has(key)) return;
+    seen.add(key);
+    out.push({ id, source, ...family ? { family } : {}, installed });
   };
-  scanTier(hostCore.globalPacksDir());
-  scanTier(imagePacksDir());
+  for (const id of hostCore.builtinProfileIds()) emit(id, "builtin", true);
+  for (const c of scanProjectPackProfiles()) emit(c.id, c.source, true, c.family);
+  for (const c of scanGlobalPackProfiles()) emit(c.id, c.source, false, c.family);
   return out;
 }
 function readPackContent(full) {
@@ -27962,6 +28027,10 @@ function listAvailableProfiles(cfg, credential) {
   requirePrincipal2(cfg, credential);
   return storeListAvailableProfiles();
 }
+function listProjectProfiles(cfg, credential, project2) {
+  requireCap(cfg, credential, "project:read", "project", project2, "Forbidden \u2014 listing a project's selectable profiles requires project:read over the project");
+  return executeApprovedListProjectProfiles(cfg, project2);
+}
 function listAdoptableProjectPacks(cfg, credential, project2) {
   requireCap(cfg, credential, "project:read", "project", project2, "Forbidden \u2014 listing adoptable packs requires project:read over the project");
   return storeListGlobalPacks();
@@ -27984,6 +28053,26 @@ function executeApprovedInstallProjectPack(cfg, project2, name, content) {
 function executeApprovedResolveGlobalPacks(names) {
   return storeResolveGlobalPacks(names);
 }
+function executeApprovedListProjectProfiles(cfg, project2) {
+  return runWithProjectRoot(boundProject2(cfg, project2), () => storeListProjectProfiles());
+}
+function executeApprovedEnsureProfileInstalled(cfg, project2, profileId) {
+  if (hostCore.builtinProjectKinds().includes(profileId) || hostCore.builtinProfileIds().includes(profileId)) {
+    return { profileId, source: "builtin" };
+  }
+  const contributors = executeApprovedListProjectProfiles(cfg, project2).filter((p) => p.id === profileId);
+  const installed = contributors.find((p) => p.installed);
+  if (installed) return { profileId, source: installed.source };
+  const adoptable = contributors[0];
+  const resolved = adoptable ? executeApprovedResolveGlobalPacks([adoptable.source]).resolved[0] : void 0;
+  if (!resolved) {
+    throw new Error(
+      `Unknown profile "${profileId}" \u2014 no built-in profile or project kind carries it, no pack registered in project "${project2}" contributes it, and no server-global pack (mutable instance tier or immutable image tier) contributes it. Writing an unresolvable id as the projectType would silently disable the whole profile doctrine (UNKNOWN_PROFILE), so it is refused instead of applied.`
+    );
+  }
+  executeApprovedInstallProjectPack(cfg, project2, resolved.name, resolved.content);
+  return { profileId, source: resolved.name, adoptedPackName: resolved.name };
+}
 function removeProjectPack(cfg, credential, project2, name) {
   requireCap(cfg, credential, "project:admin", "project", project2, "Forbidden \u2014 removing a project pack requires project:admin over the project");
   runWithProjectRoot(boundProject2(cfg, project2), () => storeRemoveProjectPack(name));
@@ -28978,6 +29067,40 @@ function requestPackNames(request) {
   if (!sel) return [];
   return [.../* @__PURE__ */ new Set([...sel.requiredPackNames ?? [], ...sel.defaultPackNames ?? []])];
 }
+function classifyProfile(projectType, catalog) {
+  if (hostCore.builtinProfileIds().includes(projectType) || hostCore.builtinProjectKinds().includes(projectType)) {
+    return { source: "builtin", resolvable: true };
+  }
+  const installed = catalog.find((p) => p.id === projectType && p.installed);
+  if (installed) return { source: installed.source, resolvable: true };
+  return { resolvable: false };
+}
+function firstApplicableProfileId(candidates, catalog) {
+  const kinds = hostCore.builtinProjectKinds();
+  const catalogIds = new Set(catalog.map((p) => p.id));
+  return candidates.find((id) => kinds.includes(id) || catalogIds.has(id));
+}
+function unappliedIds(selectedProfileIds, governingProfileId) {
+  return selectedProfileIds.filter((id) => id !== governingProfileId);
+}
+function foldAppliedProfile(root, profileId, actor) {
+  const recorded = readProjectProfileSelection(root);
+  const folded = {
+    profileIds: [profileId, ...unappliedIds(recorded?.profileIds ?? [], profileId)],
+    requiredPackNames: recorded?.requiredPackNames ?? [],
+    selectedBy: actor,
+    selectedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  if (recorded?.defaultPackNames) folded.defaultPackNames = recorded.defaultPackNames;
+  recordProjectProfileSelection(root, folded);
+  return folded;
+}
+function overridingSubsystemIds(root) {
+  return runWithProjectRoot(
+    root,
+    () => hostCore.loadSubsystemSpecs().filter((s) => !!s.profile).map((s) => s.id)
+  );
+}
 function resolvedSelection(request, policy, selectedBy) {
   const sel = request.profileSelection;
   const selection = {
@@ -28996,7 +29119,8 @@ function buildEvaluation(input) {
     selectedProfileIds,
     hasSelection,
     countMissingPacksAsViolation,
-    requiredDefaultResolution
+    requiredDefaultResolution,
+    governingProfileId
   } = input;
   const present = new Set(presentPackNames);
   let missingPackNames;
@@ -29017,6 +29141,7 @@ function buildEvaluation(input) {
   const allowed = policy.allowedProfileIds;
   const disallowedProfileIds = allowed && allowed.length > 0 ? selectedProfileIds.filter((id) => !allowed.includes(id)) : [];
   const selectionRequiredUnmet = policy.requireProfileSelection && !hasSelection;
+  const unappliedProfileIds = governingProfileId ? unappliedIds(selectedProfileIds, governingProfileId) : [];
   const messages = [];
   if (selectionRequiredUnmet) {
     messages.push("Profile selection is required by policy but none was provided.");
@@ -29028,16 +29153,24 @@ function buildEvaluation(input) {
   for (const n of blockedPackNames) messages.push(`Pack "${n}" is blocked by policy.`);
   for (const id of missingProfileIds) messages.push(`Required profile "${id}" is not selected.`);
   for (const id of disallowedProfileIds) messages.push(`Profile "${id}" is not permitted by policy.`);
+  for (const id of unappliedProfileIds) {
+    messages.push(
+      `Selected profile "${id}" is recorded but does not govern the project (projectType is "${governingProfileId}") \u2014 a project has exactly one governing profile.`
+    );
+  }
   const violation = selectionRequiredUnmet || blockedPackNames.length > 0 || missingProfileIds.length > 0 || disallowedProfileIds.length > 0 || countMissingPacksAsViolation && (missingPackNames.length > 0 || unresolvedPacks.length > 0);
-  return {
+  const result = {
     compliant: !violation,
     mode: policy.enforcementMode,
     missingPackNames,
     blockedPackNames,
     missingProfileIds,
     unresolvedPacks,
+    unappliedProfileIds,
     messages
   };
+  if (governingProfileId) result.governingProfileId = governingProfileId;
+  return result;
 }
 function performInit(cfg, request, principal) {
   const policy = effectivePolicy(cfg.dataDir);
@@ -29057,17 +29190,24 @@ function performInit(cfg, request, principal) {
     request.ownerUnitId,
     principal ? principalSubject3(principal) : void 0
   );
-  installResolvedPacks(
-    cfg,
-    record2.id,
-    executeApprovedResolveGlobalPacks([
-      ...policy.requiredGlobalPacks,
-      ...policy.defaultProjectPacks,
-      ...requestPackNames(request)
-    ])
-  );
+  const packResolution = executeApprovedResolveGlobalPacks([
+    ...policy.requiredGlobalPacks,
+    ...policy.defaultProjectPacks,
+    ...requestPackNames(request)
+  ]);
+  installResolvedPacks(cfg, record2.id, packResolution);
   const selectedBy = principal ? principalSubject3(principal) : void 0;
-  recordProjectProfileSelection(record2.rootPath, resolvedSelection(request, policy, selectedBy));
+  const selection = resolvedSelection(request, policy, selectedBy);
+  recordProjectProfileSelection(record2.rootPath, selection);
+  const catalog = executeApprovedListProjectProfiles(cfg, record2.id);
+  const appliedProfileId = firstApplicableProfileId(selection.profileIds, catalog);
+  let appliedSource;
+  if (appliedProfileId) {
+    const application = executeApprovedEnsureProfileInstalled(cfg, record2.id, appliedProfileId);
+    writeProjectType(record2.rootPath, application.profileId);
+    appliedSource = application.source;
+  }
+  const unapplied = appliedProfileId ? unappliedIds(selection.profileIds, appliedProfileId) : [...selection.profileIds];
   const actor = principal ? principalSubject3(principal) : SYSTEM_SUBJECT;
   tryAppendAudit2(
     cfg,
@@ -29076,7 +29216,18 @@ function performInit(cfg, request, principal) {
       "project.init.policy",
       "info",
       "project",
-      { target: record2.id, projectId: record2.id },
+      {
+        target: record2.id,
+        projectId: record2.id,
+        metadata: JSON.stringify({
+          ...appliedProfileId ? { appliedProfileId, profileSource: appliedSource } : {
+            appliedProfileId: null,
+            profileNotApplied: selection.profileIds.length === 0 ? "no profile was selected \u2014 the default projectType stands" : "no selected profile is resolvable on this instance \u2014 the default projectType stands"
+          },
+          ...unapplied.length > 0 ? { unappliedProfileIds: unapplied } : {},
+          ...packResolution.unresolved.length > 0 ? { unresolvedPacks: packResolution.unresolved } : {}
+        })
+      },
       principal?.tokenId
     )
   );
@@ -29117,6 +29268,7 @@ function evaluateProjectPolicy(cfg, credential, projectId) {
   const root = resolveProjectRoot(cfg.dataDir, principal, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
   const policy = effectivePolicy(cfg.dataDir);
+  const governingProfileId = readProjectType(root);
   const selection = readProjectProfileSelection(root);
   return buildEvaluation({
     policy,
@@ -29124,7 +29276,8 @@ function evaluateProjectPolicy(cfg, credential, projectId) {
     selectedProfileIds: selection?.profileIds ?? [],
     hasSelection: !!selection,
     countMissingPacksAsViolation: true,
-    requiredDefaultResolution: executeApprovedResolveGlobalPacks(requiredDefaultNames(policy))
+    requiredDefaultResolution: executeApprovedResolveGlobalPacks(requiredDefaultNames(policy)),
+    governingProfileId
   });
 }
 function reconcileProjectPolicy(cfg, credential, projectId) {
@@ -29139,20 +29292,41 @@ function reconcileProjectPolicy(cfg, credential, projectId) {
   const policy = effectivePolicy(cfg.dataDir);
   const selection = readProjectProfileSelection(root);
   const resolution = executeApprovedResolveGlobalPacks(requiredDefaultNames(policy));
-  let installed = installedPackNames(cfg, projectId);
-  const installedSet = new Set(installed);
+  const installedSet = new Set(installedPackNames(cfg, projectId));
   const toApply = resolution.resolved.filter((p) => !installedSet.has(p.name));
+  const appliedPackNames = toApply.map((p) => p.name);
   if (toApply.length > 0) {
     installResolvedPacks(cfg, projectId, { resolved: toApply, unresolved: [] });
-    installed = installedPackNames(cfg, projectId);
+  }
+  const catalog = executeApprovedListProjectProfiles(cfg, projectId);
+  const previousProfileId = readProjectType(root);
+  let governingProfileId = previousProfileId;
+  const requiredProfileIds = policy.requiredProfileIds ?? [];
+  const policyUnsatisfied = requiredProfileIds.length > 0 && !requiredProfileIds.includes(governingProfileId);
+  const governingUnresolvable = !classifyProfile(governingProfileId, catalog).resolvable;
+  let repairedProfileId;
+  let selectedProfileIds = selection?.profileIds ?? [];
+  if (policyUnsatisfied || governingUnresolvable) {
+    const target = firstApplicableProfileId(
+      [...requiredProfileIds, ...selection?.profileIds ?? []],
+      catalog
+    );
+    if (target) {
+      const application = executeApprovedEnsureProfileInstalled(cfg, projectId, target);
+      writeProjectType(root, application.profileId);
+      governingProfileId = application.profileId;
+      repairedProfileId = application.profileId;
+      selectedProfileIds = foldAppliedProfile(root, application.profileId, principalSubject3(principal)).profileIds;
+    }
   }
   const result = buildEvaluation({
     policy,
-    presentPackNames: installed,
-    selectedProfileIds: selection?.profileIds ?? [],
+    presentPackNames: installedPackNames(cfg, projectId),
+    selectedProfileIds,
     hasSelection: !!selection,
     countMissingPacksAsViolation: true,
-    requiredDefaultResolution: resolution
+    requiredDefaultResolution: resolution,
+    governingProfileId
   });
   tryAppendAudit2(
     cfg,
@@ -29161,7 +29335,15 @@ function reconcileProjectPolicy(cfg, credential, projectId) {
       "policy.reconcile",
       "info",
       "policy",
-      { target: projectId, projectId },
+      {
+        target: projectId,
+        projectId,
+        metadata: JSON.stringify({
+          ...appliedPackNames.length > 0 ? { appliedPackNames } : {},
+          ...repairedProfileId ? { repairedProfileId, previousProfileId } : {},
+          ...resolution.unresolved.length > 0 ? { unresolvedPacks: resolution.unresolved } : {}
+        })
+      },
       principal.tokenId
     )
   );
@@ -29177,8 +29359,19 @@ function getProjectConfig(cfg, credential, projectId) {
   const root = resolveProjectRoot(cfg.dataDir, principal, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
   const projectType = readProjectType(root);
+  const selection = readProjectProfileSelection(root);
+  const classified = classifyProfile(projectType, executeApprovedListProjectProfiles(cfg, projectId));
   const locked = runWithProjectRoot(root, () => hostCore.readLockRecord() !== null);
-  return { projectType, locked };
+  const overriding = overridingSubsystemIds(root);
+  const view = {
+    projectType,
+    locked,
+    profileResolvable: classified.resolvable,
+    unappliedProfileIds: unappliedIds(selection?.profileIds ?? [], projectType),
+    overridingSubsystemIds: overriding
+  };
+  if (classified.source) view.profileSource = classified.source;
+  return view;
 }
 function setProjectType(cfg, credential, projectId, projectType) {
   const principal = requirePrincipal4(cfg, credential);
@@ -29189,9 +29382,23 @@ function setProjectType(cfg, credential, projectId, projectType) {
   }
   const root = resolveProjectRoot(cfg.dataDir, principal, projectId);
   if (!root) throw new Error(`Unknown project "${projectId}".`);
-  writeProjectType(root, projectType);
+  const application = executeApprovedEnsureProfileInstalled(cfg, projectId, projectType);
+  writeProjectType(root, application.profileId);
+  const folded = foldAppliedProfile(root, application.profileId, principalSubject3(principal));
+  const remainder = folded.profileIds.slice(1);
   const locked = runWithProjectRoot(root, () => hostCore.readLockRecord() !== null);
-  return { projectType, locked };
+  const overriding = overridingSubsystemIds(root);
+  const view = {
+    projectType: application.profileId,
+    locked,
+    profileSource: application.source,
+    // The write path guarantees resolvability — the ensure seam refused anything else.
+    profileResolvable: true,
+    unappliedProfileIds: remainder,
+    overridingSubsystemIds: overriding
+  };
+  if (application.adoptedPackName) view.adoptedPackName = application.adoptedPackName;
+  return view;
 }
 function getPackPolicy(cfg, credential) {
   requirePrincipal4(cfg, credential);
@@ -32185,6 +32392,9 @@ function getProjectConfig2(cfg, credential, projectId) {
 function setProjectType2(cfg, credential, projectId, projectType) {
   return setProjectType(cfg, credential, projectId, projectType);
 }
+function listProjectProfiles2(cfg, credential, project2) {
+  return listProjectProfiles(cfg, credential, project2);
+}
 function listProducers2(cfg, credential, project2) {
   return listProducers(cfg, credential, project2);
 }
@@ -35546,6 +35756,9 @@ function opsGetProjectConfig(cfg, sessionId, url, res) {
 function opsSetProjectConfig(cfg, sessionId, body, res) {
   sendJson(res, 200, setProjectType2(cfg, sessionId, String(body?.projectId ?? ""), String(body?.projectType ?? "")));
 }
+function opsListProjectProfiles(cfg, sessionId, url, res) {
+  sendJson(res, 200, { profiles: listProjectProfiles2(cfg, sessionId, q(url, "projectId") ?? "") });
+}
 function opsListProducers(cfg, sessionId, url, res) {
   sendJson(res, 200, { producers: listProducers2(cfg, sessionId, q(url, "projectId") ?? "") });
 }
@@ -35785,6 +35998,9 @@ async function handleWebRequest(cfg, req, res, body, url, ctx) {
       if (req.method === "POST" && parts.length === 3 && parts[2] === "config") {
         return opsSetProjectConfig(cfg, sessionId, body, res);
       }
+      if (req.method === "GET" && parts.length === 3 && parts[2] === "profiles") {
+        return opsListProjectProfiles(cfg, sessionId, url, res);
+      }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "policy") {
         return opsPolicyEvaluate(cfg, sessionId, url, res);
       }