akm-cli 0.10.261014-beta → 0.10.261015-beta

package/CHANGELOG.md

@@ -6,6 +6,51 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.10.261015] - 2026-10-27
+
+### Changed
+
+- `akm setup` downloads what the configuration it saves needs (#1254). Choosing the
+  built-in embedder (`--embedding local`, or the wizard's choice) downloads ONNX
+  Runtime 1.24.3 for this platform once from the npm registry (about 86 MB,
+  checked against the registry's sha512 integrity before anything is extracted)
+  into `<cache dir>/onnxruntime/<version>-<platform>-<arch>/`, and the model
+  (about 127 MB), then loads both. The wizard asks first, as before; `--yes`
+  and `--from` do it once the config is saved and report `semanticAssets`
+  (`ready`, `blocked: <reason>`, or `skipped`). `--no-probe` now means nothing
+  is contacted or downloaded; the first `akm index` downloads what setup did
+  not, which is also how an install upgraded from an earlier release gets the
+  runtime: its next `akm index` downloads it once. The vectors are unchanged,
+  so no re-index is needed.
+- Local embeddings are offered on Linux x64 (glibc) and Apple-silicon
+  macOS (#1256). Every other platform uses keyword search or an embedding endpoint:
+  setup offers only those, with one sentence saying why, `--embedding local`
+  warns and saves keyword search, `--from` keeps the file's values, the index
+  reports semantic search unavailable for the platform, and `akm health` warns
+  with the setup arguments for keyword search or an endpoint.
+- When agent work runs on akm's own runtime, the setup wizard offers to download
+  its OpenCode binary now rather than on the first agent run. `--yes` and
+  `--from` leave it to the first run.
+- The npm package installs with no install script anywhere in its tree (#1255), so it
+  works as installed where npm runs none (npm 12 blocks dependency scripts by
+  default). On Node, the SQLite driver is `better-sqlite3` 13.0.3, which ships
+  prebuilt N-API bindings for Linux (glibc and musl) and macOS on x64 and arm64
+  and for Windows on x64 and arm64: a Node upgrade no longer needs
+  `npm rebuild`. 32-bit ARM Linux has no SQLite binding on Node.
+- Standalone binaries carry no native code and are up to 36 MB smaller (Linux
+  x64: 123.6 MB to 88.0 MB). A `noexec` temp directory no longer affects
+  semantic search (#1257); akm's cache directory must still allow executing files.
+
+### Removed
+
+- The `onnxruntime-node` dependency, and with it the install script that
+  downloaded about 317 MB of CUDA providers on every Linux x64 `npm install`
+  (akm uses the CPU only; #1254). akm loads that package's binding from its cache
+  instead.
+- The `preinstall` Node.js version check (#1255). Both launchers and the CLI still
+  refuse Node.js older than 22 when akm starts, and npm warns from
+  `engines.node` at install.
+
 ## [0.10.261014] - 2026-10-27
 
 ### Added

package/README.md

@@ -40,14 +40,13 @@ prefers Bun for execution; old, unusable, or absent Bun installations fall
 back to Node.js. Node.js remains required for the npm package. The standalone
 binaries are runtime-free.
 
-Local semantic search runs its embedding model on ONNX Runtime
-(`onnxruntime-node`). A standalone binary carries the library for its platform
-and copies it once into akm's cache (18 to 34 MB); a `noexec` temp directory
-blocks a standalone binary's semantic search (keyword search still works), so
-set `TMPDIR` to a writable, executable one.
-Alpine/musl and Intel macOS have no native ONNX Runtime, so semantic search is
-unavailable there and keyword search works. See
-[Getting Started](https://akm.fwdslsh.dev/docs/guides/getting-started/#standalone-binary-and-semantic-search).
+Local semantic search runs its embedding model on ONNX Runtime and is offered on
+Linux x64 (glibc) and Apple-silicon macOS; every other platform uses
+keyword search or an embedding endpoint. Choosing it in `akm setup`
+(`--embedding local`) downloads the runtime (about 86 MB) and the model (about
+127 MB) once into akm's cache: installing the package runs no install script and
+downloads nothing native. See
+[Getting Started](https://akm.fwdslsh.dev/docs/guides/getting-started/#local-semantic-search).
 
 With a connection and no harness, agent work runs on akm's own runtime, a pinned
 OpenCode 2 binary. The first time it runs, akm downloads that binary from the npm

package/SECURITY.md

@@ -104,6 +104,6 @@ for assets containing secrets or private notes.
   runtime-free. This is a compatibility limitation, not a security risk.
 - **Workflows can read any file the akm process can read.** This is not a
   bug — see "Threat model" above.
-- **Installing `akm-cli` runs the preinstall hook.** The hook only validates
-  the runtime version and exits non-zero when it is unsupported; it does not
-  phone home or write outside the install directory.
+- **Installing `akm-cli` runs no install script.** Neither `akm-cli` nor any
+  package it depends on declares one. The Node.js version is checked when akm
+  starts, not when it installs.

package/dist/cli.js

@@ -178,7 +178,7 @@ const setupCommand = defineCommand({
         },
         embedding: {
             type: "string",
-            description: "Embeddings: a model the connection serves, local (the built-in embedder), or off",
+            description: "Embeddings: a model the connection serves, local (the built-in embedder, on the platforms that have it; its runtime and model are downloaded now), or off",
         },
         "embedding-endpoint": {
             type: "string",
@@ -218,7 +218,7 @@ const setupCommand = defineCommand({
         // declaring `no-probe` is what puts the flag in `--help` and keeps the unknown-flag check from refusing it.
         "no-probe": {
             type: "boolean",
-            description: "Offline run: the endpoint is not contacted and its models are not listed. A connection added this way has no model until one is named with `akm models set`; the picks it already has are kept.",
+            description: "Offline run: nothing is contacted or downloaded. The endpoint's models are not listed, so a connection added this way has no model until one is named with `akm models set` (the picks it already has are kept), and the local embedder's runtime and model are fetched by the first `akm index`.",
         },
     },
     async run({ args }) {

package/dist/commands/health/semantic-search-check.js

@@ -62,10 +62,10 @@ export function semanticSearchCheck(state) {
     const asOf = builtAt ? ` at the last index (${builtAt})` : " at the last index";
     switch (record.status) {
         case "unavailable":
-            // No native library for this platform is not something to fix: keyword search is the healthy state there.
+            // No local embeddings on this platform is not something to fix: keyword search or a remote endpoint is the default there.
             return record.unavailable === "platform"
                 ? result("warn", `Semantic search is unavailable on this platform: ${record.reason} ` +
-                    'Set semanticSearchMode to "off", or embedding.endpoint to a remote embedding service.', evidence)
+                    "For keyword search run `akm setup --embedding off`; for a remote endpoint, `akm setup --embedding <model> --embedding-endpoint <url>`.", evidence)
                 : result("fail", `Semantic search was unavailable on this machine${asOf}: ${record.reason}`, evidence);
         case "blocked":
             return result("fail", `Semantic search was blocked${asOf}: ${record.reason}`, evidence);

package/dist/core/npm-package.js

@@ -0,0 +1,89 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+/**
+ * Files out of a package on the npm registry, fetched without installing the
+ * package. akm's own agent runtime (an OpenCode binary) and the local
+ * embedder's runtime (onnxruntime-node's binding and library) come this way:
+ * installing either package would bring what akm does not use, every platform's
+ * binary in one case and an install script that downloads CUDA providers in the
+ * other.
+ */
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { writeResponseToFileCapped } from "../runtime.js";
+import { fetchWithRetry, isRecord } from "./common.js";
+import { extractTarGzMembers } from "./tar.js";
+export const NPM_REGISTRY = "https://registry.npmjs.org";
+/** The `sha512-<base64>` integrity npm records for a tarball. */
+function sha512Integrity(file) {
+    return new Promise((resolve, reject) => {
+        const hash = createHash("sha512");
+        fs.createReadStream(file)
+            .on("data", (chunk) => hash.update(chunk))
+            .on("error", reject)
+            .on("end", () => resolve(`sha512-${hash.digest("base64")}`));
+    });
+}
+/** Throws unless the tarball at `file` has the integrity the registry lists for it. */
+export async function verifyIntegrity(file, expected) {
+    const listed = expected.split(/\s+/).filter((integrity) => integrity.startsWith("sha512-"));
+    if (listed.length === 0)
+        throw new Error(`the registry lists no sha512 integrity for it (${expected || "none"})`);
+    const actual = await sha512Integrity(file);
+    if (!listed.includes(actual))
+        throw new Error(`its sha512 integrity is ${actual}, not the ${listed.join(" or ")} the registry lists`);
+}
+async function registryDocument(url) {
+    const response = await fetchWithRetry(url, { headers: { accept: "application/json" } }, { timeout: 30_000 });
+    if (!response.ok) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new Error(`the registry answered HTTP ${response.status}`);
+    }
+    const dist = (await response.json()).dist;
+    if (!isRecord(dist) || typeof dist.tarball !== "string" || typeof dist.integrity !== "string") {
+        throw new Error("the registry document has no dist.tarball and dist.integrity");
+    }
+    return { tarball: dist.tarball, integrity: dist.integrity };
+}
+/**
+ * Keep members of `name@version`'s tarball in `directory`, each as `file`: the registry document of that one version,
+ * its tarball, the check against the sha512 integrity the registry lists before anything is extracted, then each
+ * member by temp file and rename (mode 0755), in the order given. Two akm processes fetching at once both finish: a
+ * rename that loses to the other leaves the file the other made.
+ */
+export async function fetchNpmPackageFiles(name, version, directory, files) {
+    fs.mkdirSync(directory, { recursive: true });
+    const download = path.join(directory, `.download-${process.pid}.tgz`);
+    const partial = (file) => path.join(directory, `.${file}-${process.pid}.tmp`);
+    try {
+        const { tarball, integrity } = await registryDocument(`${NPM_REGISTRY}/${name}/${version}`);
+        const response = await fetchWithRetry(tarball, undefined, { timeout: 60_000 });
+        if (!response.ok) {
+            await response.body?.cancel().catch(() => undefined);
+            throw new Error(`${tarball} answered HTTP ${response.status}`);
+        }
+        // No overall deadline for a large tarball on a slow link: only 60 s without bytes fails it.
+        await writeResponseToFileCapped(download, response, { stallTimeoutMs: 60_000 });
+        await verifyIntegrity(download, integrity);
+        const sizes = await extractTarGzMembers(download, new Map(files.map(({ member, file }) => [member, partial(file)])));
+        for (const { member, file } of files) {
+            const target = path.join(directory, file);
+            fs.chmodSync(partial(file), 0o755);
+            try {
+                fs.renameSync(partial(file), target);
+            }
+            catch (error) {
+                // Where a file in use cannot be replaced, the other process's file stands.
+                if (!fs.existsSync(target) || fs.statSync(target).size !== sizes.get(member))
+                    throw error;
+            }
+        }
+    }
+    finally {
+        fs.rmSync(download, { force: true });
+        for (const { file } of files)
+            fs.rmSync(partial(file), { force: true });
+    }
+}

package/dist/{integrations/harnesses/opencode/runtime → core}/tar.js

@@ -2,10 +2,10 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * One member of a gzip-compressed tar archive, streamed to a file. This is all
- * akm needs of tar: the OpenCode binary is a single regular file of about 240 MB
- * inside its package tarball, so it is never held in memory and no tar library
- * is a dependency.
+ * Named members of a gzip-compressed tar archive, streamed to files. This is all
+ * akm needs of tar: a few regular files out of an npm package tarball (the
+ * OpenCode binary, about 240 MB; onnxruntime-node's binding and library), so
+ * nothing is held in memory and no tar library is a dependency.
  */
 import fs from "node:fs";
 import { pipeline } from "node:stream";
@@ -57,35 +57,41 @@ const field = (header, start, end) => {
     return bytes.subarray(0, stop < 0 ? bytes.length : stop).toString("utf8");
 };
 /**
- * Write the regular file `member` of the `.tgz` at `archive` to `destination` (mode 0755) and return its size. Entries
- * are matched by the header's name field alone, which holds up to 100 bytes; a longer name, which tar keeps in the
- * ustar prefix field or a PAX `path` record, is not read, so such a member is never found. The one member akm reads,
- * `package/bin/opencode`, is short. Extended headers are skipped like any other entry that is not the member.
+ * Write each regular file of the `.tgz` at `archive` that `members` names (archive path → destination, mode 0755) and
+ * return each one's size, in one pass that stops once the last is written. Entries are matched by the header's name
+ * field alone, which holds up to 100 bytes; a longer name, which tar keeps in the ustar prefix field or a PAX `path`
+ * record, is not read, so such a member is never found. The members akm reads (`package/bin/opencode`,
+ * `package/bin/napi-v6/<platform>/<arch>/<file>`) are short. Extended headers are skipped like any other entry that is
+ * not a member.
  */
-export async function extractTarGzMember(archive, member, destination) {
+export async function extractTarGzMembers(archive, members) {
     const gunzip = zlib.createGunzip();
     pipeline(fs.createReadStream(archive), gunzip, () => { });
     const reader = new ByteReader(gunzip);
     try {
-        return await extractFrom(reader, archive, member, destination);
+        return await extractFrom(reader, archive, members);
     }
     finally {
         // The rest of the archive is not read: close it now rather than when the stream is collected.
         gunzip.destroy();
     }
 }
-async function extractFrom(reader, archive, member, destination) {
+async function extractFrom(reader, archive, members) {
+    const sizes = new Map();
     for (;;) {
         const header = await reader.exact(BLOCK_BYTES);
-        if (header.every((byte) => byte === 0))
-            throw new Error(`${archive} has no ${member}`);
+        if (header.every((byte) => byte === 0)) {
+            const missing = [...members.keys()].filter((member) => !sizes.has(member));
+            throw new Error(`${archive} has no ${missing.join(", ")}`);
+        }
         const name = field(header, 0, 100).replace(/^\.\//, "");
         const typeflag = String.fromCharCode(header[156] ?? 0);
         const size = Number.parseInt(field(header, 124, 136).trim() || "0", 8);
         if (!Number.isSafeInteger(size))
             throw new Error(`${archive} is not a tar archive this reader understands`);
         const padding = (BLOCK_BYTES - (size % BLOCK_BYTES)) % BLOCK_BYTES;
-        if (name !== member || (typeflag !== "0" && typeflag !== "\0")) {
+        const destination = members.get(name);
+        if (destination === undefined || sizes.has(name) || (typeflag !== "0" && typeflag !== "\0")) {
             await reader.skip(size + padding);
             continue;
         }
@@ -94,7 +100,7 @@ async function extractFrom(reader, archive, member, destination) {
             for (let left = size; left > 0;) {
                 const part = await reader.read(left);
                 if (!part)
-                    throw new Error(`${archive} ends inside ${member}`);
+                    throw new Error(`${archive} ends inside ${name}`);
                 await out.writeFile(part);
                 left -= part.length;
             }
@@ -102,6 +108,9 @@ async function extractFrom(reader, archive, member, destination) {
         finally {
             await out.close();
         }
-        return size;
+        sizes.set(name, size);
+        if (sizes.size === members.size)
+            return sizes;
+        await reader.skip(padding);
     }
 }

package/dist/integrations/harnesses/opencode/runtime/binary.js

@@ -15,14 +15,12 @@
  * `postinstall.mjs` of `@opencode/cli`.
  */
 import { spawnSync } from "node:child_process";
-import { createHash } from "node:crypto";
 import fs from "node:fs";
 import path from "node:path";
-import { fetchWithRetry, isRecord, toErrorMessage } from "../../../../core/common.js";
+import { toErrorMessage } from "../../../../core/common.js";
+import { fetchNpmPackageFiles, NPM_REGISTRY } from "../../../../core/npm-package.js";
 import { getCacheDir } from "../../../../core/paths.js";
 import { info } from "../../../../core/warn.js";
-import { writeResponseToFileCapped } from "../../../../runtime.js";
-import { extractTarGzMember } from "./tar.js";
 /**
  * The OpenCode release akm's own runtime runs. It is pinned because the runtime depends on things no OpenCode release
  * promises: the inline config's shape, the `--standalone` flag, the plugin API, the text `run` prints, and the
@@ -31,7 +29,6 @@ import { extractTarGzMember } from "./tar.js";
  * binary (it fetches it) and read `docs/reference/configuration.md` ("Without a harness") for what the version changes.
  */
 export const OPENCODE_RUNTIME_VERSION = "2.1.4";
-const REGISTRY = "https://registry.npmjs.org";
 /** The platform packages of `@opencode/cli` at {@link OPENCODE_RUNTIME_VERSION}. */
 const PACKAGES = new Set([
     "@opencode/cli-linux-x64",
@@ -109,84 +106,20 @@ export function detectHost(env = process.env, operatingSystem = process.platform
 export function runtimeBinaryPath(platform = process.platform) {
     return path.join(getCacheDir(), "opencode", OPENCODE_RUNTIME_VERSION, platform === "win32" ? "opencode.exe" : "opencode");
 }
-/** The `sha512-<base64>` integrity npm records for a tarball. */
-function sha512Integrity(file) {
-    return new Promise((resolve, reject) => {
-        const hash = createHash("sha512");
-        fs.createReadStream(file)
-            .on("data", (chunk) => hash.update(chunk))
-            .on("error", reject)
-            .on("end", () => resolve(`sha512-${hash.digest("base64")}`));
-    });
-}
-/** Throws unless the tarball at `file` has the integrity the registry lists for it. */
-export async function verifyIntegrity(file, expected) {
-    const listed = expected.split(/\s+/).filter((integrity) => integrity.startsWith("sha512-"));
-    if (listed.length === 0)
-        throw new Error(`the registry lists no sha512 integrity for it (${expected || "none"})`);
-    const actual = await sha512Integrity(file);
-    if (!listed.includes(actual))
-        throw new Error(`its sha512 integrity is ${actual}, not the ${listed.join(" or ")} the registry lists`);
-}
-async function registryDocument(url) {
-    const response = await fetchWithRetry(url, { headers: { accept: "application/json" } }, { timeout: 30_000 });
-    if (!response.ok) {
-        await response.body?.cancel().catch(() => undefined);
-        throw new Error(`the registry answered HTTP ${response.status}`);
-    }
-    const dist = (await response.json()).dist;
-    if (!isRecord(dist) || typeof dist.tarball !== "string" || typeof dist.integrity !== "string") {
-        throw new Error("the registry document has no dist.tarball and dist.integrity");
-    }
-    return { tarball: dist.tarball, integrity: dist.integrity };
-}
-/**
- * Fetch the binary of the package `name` into `binary`: the registry document of that one package, its tarball, the
- * integrity check before anything is extracted, then the executable by temp file and rename. Two akm processes fetching
- * at once both finish: a rename that loses to the other leaves the file the other made.
- */
-async function fetchBinary(name, binary) {
-    const directory = path.dirname(binary);
-    fs.mkdirSync(directory, { recursive: true });
-    const download = path.join(directory, `.download-${process.pid}.tgz`);
-    const partial = path.join(directory, `.opencode-${process.pid}.tmp`);
-    try {
-        const { tarball, integrity } = await registryDocument(`${REGISTRY}/${name}/${OPENCODE_RUNTIME_VERSION}`);
-        info(`Fetching OpenCode ${OPENCODE_RUNTIME_VERSION} for akm's own agent runtime (about 114 MB, once) into ${directory}.`);
-        const response = await fetchWithRetry(tarball, undefined, { timeout: 60_000 });
-        if (!response.ok) {
-            await response.body?.cancel().catch(() => undefined);
-            throw new Error(`${tarball} answered HTTP ${response.status}`);
-        }
-        // No overall deadline for a 114 MB file on a slow link: only 60 s without bytes fails it.
-        await writeResponseToFileCapped(download, response, { stallTimeoutMs: 60_000 });
-        await verifyIntegrity(download, integrity);
-        const size = await extractTarGzMember(download, `package/bin/${path.basename(binary)}`, partial);
-        fs.chmodSync(partial, 0o755);
-        try {
-            fs.renameSync(partial, binary);
-        }
-        catch (error) {
-            // Where an open executable cannot be replaced, the other process's file stands.
-            if (!fs.existsSync(binary) || fs.statSync(binary).size !== size)
-                throw error;
-        }
-    }
-    finally {
-        fs.rmSync(download, { force: true });
-        fs.rmSync(partial, { force: true });
-    }
-}
 /** Fetch the binary for this machine, naming the package, its URL and the cache path when it cannot. */
 async function fetchForThisMachine(binary) {
     let name = "an @opencode/cli platform package";
     try {
         name = opencodePackage(detectHost());
-        await fetchBinary(name, binary);
+        info(`Fetching OpenCode ${OPENCODE_RUNTIME_VERSION} for akm's own agent runtime (about 114 MB, once) into ${path.dirname(binary)}.`);
+        const file = path.basename(binary);
+        await fetchNpmPackageFiles(name, OPENCODE_RUNTIME_VERSION, path.dirname(binary), [
+            { member: `package/bin/${file}`, file },
+        ]);
         return binary;
     }
     catch (error) {
-        throw new Error(`Could not fetch OpenCode ${OPENCODE_RUNTIME_VERSION}, which akm's own agent runtime runs: package ${name} from ${REGISTRY}/${name}/${OPENCODE_RUNTIME_VERSION} into ${path.dirname(binary)}: ${toErrorMessage(error)}. ` +
+        throw new Error(`Could not fetch OpenCode ${OPENCODE_RUNTIME_VERSION}, which akm's own agent runtime runs: package ${name} from ${NPM_REGISTRY}/${name}/${OPENCODE_RUNTIME_VERSION} into ${path.dirname(binary)}: ${toErrorMessage(error)}. ` +
             "Without network access for this step, enable the opencode harness with an installed OpenCode 2 instead (see docs/reference/configuration.md).");
     }
 }

package/dist/integrations/harnesses/opencode/runtime/index.js

@@ -24,7 +24,7 @@ import { resolveAkmInvocation } from "../../../../tasks/resolve-akm-bin.js";
 import { buildChildEnv, runBuiltCommand, } from "../../../agent/spawn.js";
 import { akmOpencodeDatabasePath, akmRuntimeDir } from "../roots.js";
 import { v2SessionTokens } from "../session-log-v2.js";
-import { ensureRuntimeBinary, OPENCODE_RUNTIME_VERSION } from "./binary.js";
+import { ensureRuntimeBinary, OPENCODE_RUNTIME_VERSION, runtimeBinaryPath } from "./binary.js";
 import { runtimeArgv, runtimeConfig, runtimeEnv, runtimePrepareArgv } from "./command.js";
 /**
  * What a request is lowered for when it runs here. The persona goes in the prompt, as for the opencode harness
@@ -126,6 +126,10 @@ function sessionRecord(sessionId) {
 }
 export const opencodeRuntime = {
     lowering: runtimeLowerer,
+    pendingFetch: () => fs.existsSync(runtimeBinaryPath()) ? undefined : `OpenCode ${OPENCODE_RUNTIME_VERSION} (about 114 MB, once)`,
+    async fetch() {
+        await ensureRuntimeBinary();
+    },
     async run(profile, opts, connection) {
         const label = `akm's runtime on connection "${profile.name}"`;
         const dispatch = opts.dispatch;

package/dist/llm/embedders/local.js

@@ -2,9 +2,9 @@
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 /**
- * Local embedder: a BERT-family embedding model run with onnxruntime-node,
- * its text encoded by @huggingface/tokenizers, mean-pooled over the attention
- * mask and L2-normalised.
+ * Local embedder: a BERT-family embedding model run on onnxruntime-node's binding
+ * (`./onnx-runtime.ts`), its text encoded by @huggingface/tokenizers, mean-pooled
+ * over the attention mask and L2-normalised.
  *
  * Encapsulates the model's lifecycle as instance state on a `LocalEmbedder` so
  * tests can construct fresh instances without leaking loaded models across
@@ -13,8 +13,9 @@
  */
 import fs from "node:fs";
 import path from "node:path";
-import { preloadOnnxRuntimeLibrary } from "../../standalone/onnxruntime-library.js";
+import { toErrorMessage } from "../../core/common.js";
 import { ensureLocalModelFiles } from "./local-model-files.js";
+import { hasLocalEmbeddings, loadOnnxRuntime, noLocalEmbeddingsReason, OnnxTensor } from "./onnx-runtime.js";
 /**
  * Default local model for embeddings.
  * `bge-small-en-v1.5` scores higher on MTEB benchmarks than the previous
@@ -24,10 +25,10 @@ export const DEFAULT_LOCAL_MODEL = "Xenova/bge-small-en-v1.5";
 /** The runtime the local embedder reports once its model has loaded. */
 export const LOCAL_EMBEDDING_RUNTIME = "onnxruntime-node";
 /**
- * The embedding runtime is not usable on this machine. `platform`: onnxruntime-node
- * has no native library for it, so keyword search is all there is. `load`: it has
- * one, which did not load (a missing package or addon, a `noexec` temp or cache
- * directory).
+ * The embedding runtime is not usable on this machine. `platform`: akm offers no
+ * local embeddings here, so keyword search and remote embeddings are what there
+ * is. `load`: it does, and the runtime could not be fetched or did not load (no
+ * network for the fetch, a `noexec` cache directory).
  */
 export class LocalRuntimeUnavailableError extends Error {
     kind;
@@ -55,50 +56,17 @@ const LOCAL_BATCH_SIZE = 32;
 function resolveLocalModelName(overrideModel) {
     return overrideModel || DEFAULT_LOCAL_MODEL;
 }
-/**
- * A standalone binary built for a target with no native library (`none`) must not
- * bundle the package: its addon for that platform does not exist. The bundler
- * drops only the branch a build constant rules out, so the import sits in an
- * `else`, not after the `throw`.
- */
-async function importOnnxRuntime() {
-    if (typeof AKM_STANDALONE_NATIVE_MODULE !== "undefined" && AKM_STANDALONE_NATIVE_MODULE === "./native/none") {
-        throw new Error("no native library is available for this platform");
-    }
-    else {
-        await preloadOnnxRuntimeLibrary();
-        return import("onnxruntime-node");
-    }
-}
-/**
- * Whether onnxruntime-node has a native library for this machine. A standalone
- * binary knows from its build (`none`). The package has one for glibc Linux
- * x64/arm64, Apple-silicon macOS and Windows x64/arm64, and none for musl Linux
- * or Intel macOS.
- */
-function hasNativeLibrary() {
-    if (typeof AKM_STANDALONE_NATIVE_MODULE !== "undefined")
-        return AKM_STANDALONE_NATIVE_MODULE !== "./native/none";
-    if (process.platform === "linux") {
-        const header = process.report?.getReport()?.header;
-        if (!header?.glibcVersionRuntime)
-            return false;
-    }
-    return ["linux-x64", "linux-arm64", "darwin-arm64", "win32-x64", "win32-arm64"].includes(`${process.platform}-${process.arch}`);
-}
-async function loadOnnxRuntime() {
+async function loadRuntime() {
+    if (!hasLocalEmbeddings())
+        throw new LocalRuntimeUnavailableError(noLocalEmbeddingsReason(), "platform");
     try {
-        return await importOnnxRuntime();
+        return await loadOnnxRuntime();
     }
     catch (error) {
-        const msg = error instanceof Error ? error.message : String(error);
-        const kind = hasNativeLibrary() ? "load" : "platform";
-        // Only the package itself missing calls for a reinstall; a platform it ships no addon for (Intel macOS) fails on
-        // `../bin/napi-v6/<platform>/<arch>/onnxruntime_binding.node` and is reported below.
-        if (kind === "load" && /Cannot find (?:module|package) ['"]onnxruntime-node['"]/.test(msg)) {
-            throw new LocalRuntimeUnavailableError("Semantic search requires onnxruntime-node. Reinstall akm-cli.", kind);
-        }
-        throw new LocalRuntimeUnavailableError(`Failed to load the embedding runtime (onnxruntime-node): ${msg}. Semantic search with the local model is unavailable; keyword search still works.`, kind);
+        const msg = toErrorMessage(error).replace(/\.$/, "");
+        // A `noexec` mount maps nothing executable, so the binding cannot load from the cache there.
+        const mount = /failed to map segment/.test(msg) ? " akm's cache directory must allow executing files." : "";
+        throw new LocalRuntimeUnavailableError(`Failed to load the embedding runtime (onnxruntime-node): ${msg}.${mount} Semantic search with the local model is unavailable; keyword search still works.`, "load");
     }
 }
 /** The mean of one text's token vectors (padding excluded), scaled to unit length. */
@@ -116,17 +84,14 @@ function meanPooled(hidden, offset, tokens, dim) {
     return vector.map((value) => value / Math.sqrt(norm));
 }
 async function loadOnnxPipeline(modelName) {
-    const ort = await loadOnnxRuntime();
+    const ort = await loadRuntime();
     const { Tokenizer } = await import("@huggingface/tokenizers");
     const modelDir = await ensureLocalModelFiles(modelName);
     const readJson = (file) => JSON.parse(fs.readFileSync(path.join(modelDir, file), "utf8"));
     const tokenizerConfig = readJson("tokenizer_config.json");
     const tokenizer = new Tokenizer(readJson("tokenizer.json"), tokenizerConfig);
     const maxLength = typeof tokenizerConfig.model_max_length === "number" ? tokenizerConfig.model_max_length : Number.POSITIVE_INFINITY;
-    const session = await ort.InferenceSession.create(path.join(modelDir, "onnx", "model.onnx"), {
-        executionProviders: ["cpu"],
-        logSeverityLevel: 3,
-    });
+    const session = ort.createSession(path.join(modelDir, "onnx", "model.onnx"));
     return async (texts) => {
         // A text longer than the model's maximum is cut to it. Shorter ones are padded
         // to the longest in the batch; the mask keeps padding out of the pooling.
@@ -142,13 +107,13 @@ async function loadOnnxPipeline(modelName) {
         });
         const dims = [texts.length, length];
         const inputs = {
-            input_ids: new ort.Tensor("int64", ids, dims),
-            attention_mask: new ort.Tensor("int64", mask, dims),
-            token_type_ids: new ort.Tensor("int64", new BigInt64Array(texts.length * length), dims),
+            input_ids: new OnnxTensor("int64", ids, dims),
+            attention_mask: new OnnxTensor("int64", mask, dims),
+            token_type_ids: new OnnxTensor("int64", new BigInt64Array(texts.length * length), dims),
         };
         // Models that take fewer inputs (no token_type_ids) are fed only theirs.
         const feeds = Object.fromEntries(session.inputNames.flatMap((name) => (inputs[name] ? [[name, inputs[name]]] : [])));
-        const outputs = await session.run(feeds);
+        const outputs = session.run(feeds);
         const hidden = (outputs.last_hidden_state ?? outputs.token_embeddings ?? outputs.logits)?.data;
         const dim = hidden.length / (texts.length * length);
         return encoded.map((row, i) => meanPooled(hidden, i * length * dim, row.length, dim));