acryl-cli-linux-x64 0.1.35 → 0.1.36

package/runtime/node_modules/acryl-control/lib/index.js

@@ -348,6 +348,71 @@ function parseAcrylSessionSnapshot(value) {
 	});
 }
 //#endregion
+//#region src/credential/projection.ts
+/** Read a nested value out of an untyped resolved/raw settings section. */
+function getAtPath(value, path) {
+	let current = value;
+	for (const key of path) {
+		if (current === null || typeof current !== "object") return void 0;
+		current = current[key];
+	}
+	return current;
+}
+/** Compute every provider route's joined credential/settings/live-registration row. */
+async function computeCredentialProjection(services, options) {
+	const scope = options.loginRecordScope ?? "llm-pi-ai";
+	const configurable = services.llm.listConfigurableProviders();
+	const live = new Set(services.llm.listProviders().map((provider) => provider.id));
+	const descriptors = services.settings.describe({ redactSecrets: true });
+	const byNs = new Map(descriptors.map((descriptor) => [descriptor.ns, descriptor]));
+	const rows = [];
+	for (const entry of configurable) {
+		const descriptor = byNs.get(entry.settingsNs);
+		const value = descriptor === void 0 ? void 0 : getAtPath(descriptor.value, entry.settingsPath);
+		const userValue = descriptor === void 0 ? void 0 : getAtPath(descriptor.user, entry.settingsPath);
+		const apiKeyRef = value?.apiKeyEnv ?? options.deriveApiKeyRef(entry.provider);
+		const info = await services.credentials.describe(apiKeyRef);
+		const loginRecord = await services.credentials.readRecord?.(`${scope}/${entry.provider}`);
+		const authMethod = loginRecord !== void 0 ? loginRecord.kind === "grant" ? "oauth" : "api-key" : info.configured ? "api-key" : void 0;
+		const isLive = live.has(entry.provider);
+		const models = isLive ? await services.llm.listModels(entry.provider).catch(() => value?.models ?? []) : value?.models ?? [];
+		rows.push({
+			route: entry.provider,
+			displayName: value?.displayName ?? entry.displayName,
+			settingsNs: entry.settingsNs,
+			settingsPath: entry.settingsPath,
+			hasSettingsProfile: userValue !== void 0,
+			hasCredential: info.configured || loginRecord !== void 0,
+			isLive,
+			authMethod,
+			api: value?.api,
+			baseURL: value?.baseURL,
+			apiKeyRef,
+			models,
+			revision: descriptor?.revision
+		});
+	}
+	return rows;
+}
+//#endregion
+//#region src/authorization/service.ts
+var AuthorizationService = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	async begin(request) {
+		const outcome = await this.deps.authorization.begin(request);
+		if (outcome.status === "authorized") {
+			const slash = request.key.indexOf("/");
+			const providerId = slash === -1 ? request.key : request.key.slice(slash + 1);
+			if (this.deps.routeActivation !== void 0) await this.deps.routeActivation.ensureRouteActivated(providerId, request.method);
+			this.deps.onCredentialChanged(request.key);
+		}
+		return outcome;
+	}
+};
+//#endregion
 //#region src/lifecycle/controller.ts
 var PluginLifecycleError = class extends Error {
 	code;
@@ -530,6 +595,6 @@ function nonEmptyCommandId(value) {
 	return value;
 }
 //#endregion
-export { AcrAgentControlError, AcrAgentControlService, AcrPluginLifecycleController, AcrPluginLifecycleService, AcrRuntimeArchitectureService, Context, PROVIDER_CAPABILITIES, PluginLifecycleError, Service, acpProvider, claudeProvider, codexProvider, createAcrylSessionClient, createProviderPlugin, dshNativeProvider, parseAcrylSessionSnapshot, projectRuntimeArchitecture };
+export { AcrAgentControlError, AcrAgentControlService, AcrPluginLifecycleController, AcrPluginLifecycleService, AcrRuntimeArchitectureService, AuthorizationService, Context, PROVIDER_CAPABILITIES, PluginLifecycleError, Service, acpProvider, claudeProvider, codexProvider, computeCredentialProjection, createAcrylSessionClient, createProviderPlugin, dshNativeProvider, parseAcrylSessionSnapshot, projectRuntimeArchitecture };
 
 //# sourceMappingURL=index.js.map

package/runtime/node_modules/acryl-control/lib/types/authorization/service.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `AuthorizationService`: the `beginAuthorization` use-case, owned outside
+ * the terminal surface (finding R1). Forwards to the underlying
+ * `AuthorizationPort`, activates the route on success (no display-name
+ * encoding — the `-oauth` suffix hack is deleted, not moved; see finding R2),
+ * and emits `credential.changed` so subscribers can invalidate a targeted
+ * projection instead of a shotgun dual reload (finding R4).
+ *
+ * Framework-free: every dependency is a plain port, so this is directly
+ * unit-testable with stubs — no Cordis boot required.
+ */
+import type { AuthorizationBeginRequest, AuthorizationOutcome, AuthorizationPort, CredentialChangedListener, RouteActivationPort } from './types.ts';
+export interface AuthorizationServiceDeps {
+    readonly authorization: AuthorizationPort;
+    /** Optional: absent profiles degrade to "not available" (matches the surface's own optional-service pattern). */
+    readonly routeActivation?: RouteActivationPort;
+    readonly onCredentialChanged: CredentialChangedListener;
+}
+export declare class AuthorizationService {
+    private readonly deps;
+    constructor(deps: AuthorizationServiceDeps);
+    begin(request: AuthorizationBeginRequest): Promise<AuthorizationOutcome>;
+}

package/runtime/node_modules/acryl-control/lib/types/authorization/types.d.ts

@@ -0,0 +1,46 @@
+/** Typed authorization use-case contract: `/login`'s `beginAuthorization` action. */
+/** A question the running flow needs answered before it can continue (opaque pass-through). */
+export interface AuthorizationInteraction {
+    notify(notice: {
+        readonly message: string;
+        readonly url?: string;
+        readonly code?: string;
+    }): void;
+    prompt(prompt: {
+        readonly kind: 'text' | 'secret' | 'select';
+        readonly message: string;
+        readonly options?: readonly {
+            readonly id: string;
+            readonly label: string;
+            readonly description?: string;
+        }[];
+        readonly placeholder?: string;
+        readonly signal?: AbortSignal;
+    }): Promise<string>;
+}
+export interface AuthorizationBeginRequest {
+    /** The credential record key this flow writes (`<scope>/<id>`). */
+    readonly key: string;
+    readonly method: string | undefined;
+    readonly interaction: AuthorizationInteraction;
+}
+export interface AuthorizationOutcome {
+    readonly status: string;
+    readonly [extra: string]: unknown;
+}
+/** The underlying pi-ai (or equivalent) authorization flow runner. */
+export interface AuthorizationPort {
+    begin(request: AuthorizationBeginRequest): Promise<AuthorizationOutcome>;
+}
+/**
+ * Make a route usable from `/model` after a successful sign-in: `dsh-llm-pi-ai`
+ * only registers a route as live once its settings section names it (even an
+ * empty profile — "use the installed catalog's defaults" — counts), so a
+ * signed-in-but-never-configured route stays credentialed but absent from
+ * `ctx.llm`'s live directory otherwise. A no-op when the route already has a
+ * settings profile, so it never clobbers one the user already configured.
+ */
+export interface RouteActivationPort {
+    ensureRouteActivated(providerId: string, method: string | undefined): Promise<void>;
+}
+export type CredentialChangedListener = (key: string) => void;

package/runtime/node_modules/acryl-control/lib/types/credential/projection.d.ts

@@ -0,0 +1,63 @@
+/**
+ * `CredentialProjection`: the one join of `ctx.llm` + `ctx.settings` +
+ * `ctx.credentials` into provider rows. Replaces the surface's own
+ * `computeProviderRows`/`loadAuthorizationFlows` duplicate joins (finding R1)
+ * so `/login` and `/model` read the same projection instead of two
+ * independently-fetched pictures of the same state.
+ *
+ * Framework-free: takes plain service ports (not a Cordis `Context`), so it
+ * is directly unit-testable with stubs — no Cordis boot required. The
+ * surface wires these ports from `host.ctx.get(...)`.
+ */
+import type { CredentialModelEntry, CredentialProjectionRow } from './types.ts';
+export interface CredentialProjectionConfigurableProvider {
+    readonly provider: string;
+    readonly displayName: string;
+    readonly settingsNs: string;
+    readonly settingsPath: readonly string[];
+}
+export interface CredentialProjectionLlmPort {
+    listConfigurableProviders(): readonly CredentialProjectionConfigurableProvider[];
+    listProviders(): readonly {
+        readonly id: string;
+    }[];
+    listModels(provider: string): Promise<readonly CredentialModelEntry[]>;
+}
+export interface CredentialProjectionSettingsDescriptor {
+    readonly ns: string;
+    readonly value: unknown;
+    readonly user?: unknown;
+    readonly revision?: number;
+}
+export interface CredentialProjectionSettingsPort {
+    describe(options: {
+        readonly redactSecrets: boolean;
+    }): readonly CredentialProjectionSettingsDescriptor[];
+}
+export interface CredentialProjectionRecord {
+    readonly kind: string;
+}
+export interface CredentialProjectionCredentialsPort {
+    describe(ref: string): Promise<{
+        readonly configured: boolean;
+    }>;
+    readRecord?(key: string): Promise<CredentialProjectionRecord | undefined>;
+}
+export interface CredentialProjectionServices {
+    readonly llm: CredentialProjectionLlmPort;
+    readonly settings: CredentialProjectionSettingsPort;
+    readonly credentials: CredentialProjectionCredentialsPort;
+}
+export interface CredentialProjectionOptions {
+    /** Derive the settings-fallback `apiKeyEnv` reference for a route with no stored profile. */
+    readonly deriveApiKeyRef: (route: string) => string;
+    /**
+     * The scope a `/login` sign-in's own credential record lives under
+     * (`dsh-llm-pi-ai`'s `credentialKey(scope, providerId)`), separate from the
+     * `apiKeyEnv` reference a manually configured provider's settings profile
+     * points at. Defaults to `'llm-pi-ai'`.
+     */
+    readonly loginRecordScope?: string;
+}
+/** Compute every provider route's joined credential/settings/live-registration row. */
+export declare function computeCredentialProjection(services: CredentialProjectionServices, options: CredentialProjectionOptions): Promise<readonly CredentialProjectionRow[]>;

package/runtime/node_modules/acryl-control/lib/types/credential/types.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Typed read-model for a provider route's credential/authorization state.
+ * `/login` and `/model` (in `acryl-cli`) both consume the *same* projection —
+ * this is the one place `hasCredential`/`hasSettingsProfile`/`isLive`/
+ * `authMethod` are defined, so no field means two different things across
+ * the two overlays (see `specs/001-acryl-refactor-improvements-and-tech-debt`,
+ * finding R3).
+ */
+/** How a stored credential was obtained. */
+export type AuthMethod = 'oauth' | 'api-key';
+/** One model entry within a provider's catalog (subset shared with the surface's own `ModelEntry`). */
+export interface CredentialModelEntry {
+    readonly id: string;
+    readonly name?: string;
+    readonly contextWindow?: number;
+    readonly maxTokens?: number;
+}
+/** One provider route, joined from `ctx.llm` + `ctx.settings` + `ctx.credentials`. */
+export interface CredentialProjectionRow {
+    readonly route: string;
+    readonly displayName: string;
+    readonly settingsNs: string;
+    readonly settingsPath: readonly string[];
+    /** Whether the user's settings document has an override for this route (a `/model` save, not a `/login` sign-in). */
+    readonly hasSettingsProfile: boolean;
+    /** Whether a credential — an `apiKeyEnv` secret or a `/login` record — is stored for this route. */
+    readonly hasCredential: boolean;
+    /** Whether the route is currently registered/live in `ctx.llm`. */
+    readonly isLive: boolean;
+    /** How the credential behind `hasCredential` was obtained, or `undefined` when none is configured. */
+    readonly authMethod: AuthMethod | undefined;
+    readonly api: string | undefined;
+    readonly baseURL: string | undefined;
+    readonly apiKeyRef: string;
+    readonly models: readonly CredentialModelEntry[];
+    /** Settings revision this row was read at; replay as `expectedRevision` on write. */
+    readonly revision: number | undefined;
+}

package/runtime/node_modules/acryl-control/lib/types/index.d.ts

@@ -10,6 +10,10 @@ export * from './architecture/projection.ts';
 export * from './architecture/provider.ts';
 export * from './contracts/operations.ts';
 export * from './contracts/session.ts';
+export * from './credential/types.ts';
+export * from './credential/projection.ts';
+export * from './authorization/types.ts';
+export * from './authorization/service.ts';
 export * from './events.ts';
 export * from './lifecycle/controller.ts';
 export * from './lifecycle/provider.ts';

package/runtime/node_modules/acryl-control/package.json

@@ -1,6 +1,6 @@
 {
   "name": "acryl-control",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "private": false,
   "description": "Host-neutral Cordis control plane for ACRYL",
   "license": "MIT",

package/runtime/node_modules/acryl-harness-runtime/package.json

@@ -1,6 +1,6 @@
 {
   "name": "acryl-harness-runtime",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "private": false,
   "license": "MIT",
   "type": "module",

package/runtime/package.json

@@ -1,6 +1,6 @@
 {
-  "name": "acryl-tui",
-  "version": "0.1.35",
+  "name": "acryl-cli",
+  "version": "0.1.36",
   "private": true,
   "description": "Canonical ACRYL pi-tui coding-agent terminal client",
   "license": "MIT",

package/runtime/receipt.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "surface": "cli",
   "target": "linux-x64",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "packageName": "acryl-cli-linux-x64",
-  "payloadSha256": "0e4da558f00aca2aa26c52a10677258683194e04e009d906f8d1d534ca688d53"
+  "payloadSha256": "99de89fd03be2f9ae485b5d15b52063a909928eaff7c9330f178d98e55a22a32"
 }