byollm 0.1.0 → 0.1.2

package/dist/{chunk-FUKJDD7M.js → chunk-K7QYAF7V.js}

@@ -613,11 +613,41 @@ var DaemonConfig = z.object({
    * The trade this switch represents is written down rather than
    * discovered: an auto-updating daemon means whoever controls the npm
    * publish controls the fleet. The controls on that are 2FA at publish,
-   * exact-version installs (never a tag), the canary and rollback in
-   * `update.ts`, and staged cohorts. It is the Chrome trade, taken
-   * deliberately.
+   * exact-version installs (never a tag), forward-only versions, offers
+   * from {@link updateAuthority} alone, SLSA provenance checked before the
+   * new binary runs, and the canary and rollback in `update.ts`. Staged
+   * cohorts are NOT among them yet: nothing in this file or on the wire
+   * spreads an offer over time, so every machine the authority offers a
+   * version to takes it on its next heartbeat. It is the Chrome trade,
+   * taken deliberately.
    */
   autoUpdate: z.boolean().default(false),
+  /**
+   * The one origin whose update offers this daemon takes — B360.
+   *
+   * Unset means the reference hub (`DEFAULT_ORIGIN` in `cli.ts`), and it is
+   * resolved there rather than defaulted here on purpose: `byollm offer`
+   * writes the PARSED config back, so a schema default would be baked into
+   * every owner's file — and an older daemon, which is exactly what a
+   * rollback installs, refuses a key its strict schema has never seen.
+   *
+   * Every other paired origin's offer is ignored and said once. The
+   * authority's own offers count only over a pairing that pinned a control
+   * plane; a direct-mode pairing never updates the daemon.
+   */
+  updateAuthority: z.string().refine(
+    (value) => {
+      try {
+        normalizeOrigin(value);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    {
+      message: "an origin byollm can reach, the way `byollm connect` takes one (https://hub.byollm.cloud)"
+    }
+  ).optional(),
   /**
    * The memory floor this device refuses model work below — B090.
    *
@@ -1152,37 +1182,58 @@ ${plan.say}
 }
 
 // src/update.ts
+import { compareVersions } from "@byollm/protocol";
 function exactVersion(value) {
   return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(value) ? value : void 0;
 }
 async function update(from, to, deps) {
   const target = exactVersion(to);
   if (target === void 0) {
-    const why2 = `refusing to install "${to}" \u2014 the updater installs exact versions only`;
-    deps.report(why2);
-    return { kind: "refused", why: why2 };
+    const why = `refusing to install "${to}" \u2014 the updater installs exact versions only`;
+    deps.report(why);
+    return { kind: "refused", why };
   }
-  if (target === from) {
+  if (exactVersion(from) === void 0) {
+    const why = `refusing to update from "${from}" \u2014 no version to roll back to`;
+    deps.report(why);
+    return { kind: "refused", why };
+  }
+  const order = compareVersions(target, from);
+  if (order === 0) {
     return { kind: "refused", why: `already on ${from}` };
   }
-  if (exactVersion(from) === void 0) {
-    const why2 = `refusing to update from "${from}" \u2014 no version to roll back to`;
-    deps.report(why2);
-    return { kind: "refused", why: why2 };
+  if (order === void 0 || order < 0) {
+    const why = order === void 0 ? `refusing to install ${target} \u2014 cannot tell whether it is newer than ${from}` : `refusing to install ${target} \u2014 it is older than ${from}, and the updater never downgrades`;
+    deps.report(why);
+    return { kind: "refused", why };
   }
   await deps.drain();
   if (!await deps.install(target)) {
     await deps.reregister();
-    const why2 = `could not install ${target} \u2014 staying on ${from}`;
-    deps.report(why2);
-    return { kind: "refused", why: why2 };
+    const why = `could not install ${target} \u2014 staying on ${from}`;
+    deps.report(why);
+    return { kind: "refused", why };
+  }
+  const proof = await deps.verify(target);
+  if (!proof.verified) {
+    return rollBack(
+      from,
+      `${target} failed its provenance check: ${proof.why}`,
+      deps
+    );
   }
   await deps.reregister();
   const reported = await deps.installedVersion();
   if (reported === target) {
     return { kind: "updated", to: target };
   }
-  const why = reported === void 0 ? `${target} did not answer after installing` : `installed ${target} but the binary reports ${reported}`;
+  return rollBack(
+    from,
+    reported === void 0 ? `${target} did not answer after installing` : `installed ${target} but the binary reports ${reported}`,
+    deps
+  );
+}
+async function rollBack(from, why, deps) {
   if (!await deps.install(from)) {
     const stranded = `${why}; rolling back to ${from} also failed`;
     deps.report(stranded);
@@ -1198,6 +1249,115 @@ async function update(from, to, deps) {
   deps.report(`${why}; rolled back to ${from}`);
   return { kind: "rolled-back", to: from, why };
 }
+function offerInbox(input) {
+  let offered;
+  const refused = /* @__PURE__ */ new Set();
+  return {
+    receive: (origin, version) => {
+      const why = origin !== input.authority ? `updates are taken only from ${input.authority}` : input.hasControlPlane(origin) ? void 0 : "it is a direct-mode pairing, and those never update this daemon";
+      if (why === void 0) {
+        offered = version;
+        return;
+      }
+      if (refused.has(origin)) return;
+      refused.add(origin);
+      input.report(`ignoring an offer of ${version} from ${origin} \u2014 ${why}`);
+    },
+    current: () => offered
+  };
+}
+
+// src/provenance.ts
+var NPM_REGISTRY = "https://registry.npmjs.org";
+var RELEASE_REPOSITORY = "https://github.com/oftomorrowinc/byollm";
+var SLSA_V1 = "https://slsa.dev/provenance/v1";
+async function verifyProvenance(version, options = {}) {
+  const get = options.fetch ?? ((url) => fetch(url));
+  const registry = options.registry ?? NPM_REGISTRY;
+  const no = (why) => ({ verified: false, why });
+  const integrity = await readJson(get, `${registry}/byollm/${version}`);
+  if (!integrity.ok)
+    return no(`could not read the registry entry: ${integrity.why}`);
+  const expected = sha512Hex(
+    integrity.body?.dist?.integrity
+  );
+  if (expected === void 0) {
+    return no("the registry entry has no sha512 integrity to check against");
+  }
+  const listed = await readJson(
+    get,
+    `${registry}/-/npm/v1/attestations/byollm@${version}`
+  );
+  if (!listed.ok) return no(`could not read the attestations: ${listed.why}`);
+  const attestations = listed.body?.attestations;
+  if (!Array.isArray(attestations))
+    return no("the registry lists no attestations");
+  const slsa = attestations.filter(
+    (entry) => entry?.predicateType === SLSA_V1
+  );
+  if (slsa.length === 0) return no("there is no SLSA provenance for it");
+  for (const entry of slsa) {
+    const statement = decodeStatement(entry);
+    if (statement === void 0) return no("its provenance could not be read");
+    const why = checkStatement(statement, version, expected);
+    if (why !== void 0) return no(why);
+  }
+  return { verified: true };
+}
+function checkStatement(statement, version, expected) {
+  const workflow = statement.predicate?.buildDefinition?.externalParameters?.workflow;
+  if (workflow?.repository !== RELEASE_REPOSITORY) {
+    return `it was built by ${named(workflow?.repository)}, not ${RELEASE_REPOSITORY}`;
+  }
+  if (workflow.ref !== `refs/tags/v${version}`) {
+    return `it was built from ${named(workflow.ref)}, not refs/tags/v${version}`;
+  }
+  const subjects = Array.isArray(
+    statement.subject
+  ) ? statement.subject : [];
+  const ours = subjects.find((s) => s.name === `pkg:npm/byollm@${version}`);
+  if (ours === void 0)
+    return `its provenance does not name byollm@${version}`;
+  if (ours.digest?.sha512 !== expected) {
+    return "its provenance names a different tarball than the one npm installed";
+  }
+  return void 0;
+}
+async function readJson(get, url) {
+  try {
+    const response = await get(url);
+    if (!response.ok)
+      return { ok: false, why: `HTTP ${String(response.status)}` };
+    return { ok: true, body: await response.json() };
+  } catch (error) {
+    return {
+      ok: false,
+      why: error instanceof Error ? error.message : "unknown error"
+    };
+  }
+}
+function decodeStatement(entry) {
+  const payload = entry?.bundle?.dsseEnvelope?.payload;
+  if (typeof payload !== "string") return void 0;
+  try {
+    const parsed = JSON.parse(
+      Buffer.from(payload, "base64").toString("utf8")
+    );
+    return typeof parsed === "object" && parsed !== null ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function sha512Hex(integrity) {
+  if (typeof integrity !== "string") return void 0;
+  const match = /^sha512-([A-Za-z0-9+/]+={0,2})$/.exec(integrity.trim());
+  if (match?.[1] === void 0) return void 0;
+  const bytes2 = Buffer.from(match[1], "base64");
+  return bytes2.length === 64 ? bytes2.toString("hex") : void 0;
+}
+function named(value) {
+  return typeof value === "string" ? value : "an unnamed workflow";
+}
 
 // src/update-deps.ts
 function realUpdateDeps(input) {
@@ -1209,6 +1369,8 @@ function realUpdateDeps(input) {
         "npm",
         "install",
         "--global",
+        "--ignore-scripts",
+        `--registry=${NPM_REGISTRY}`,
         `byollm@${version}`
       ]);
       if (result.code !== 0) {
@@ -1218,6 +1380,7 @@ function realUpdateDeps(input) {
       }
       return result.code === 0;
     },
+    verify: input.verify ?? ((version) => verifyProvenance(version)),
     reregister: async () => (await input.run([binary, "start"])).code === 0,
     installedVersion: async () => {
       const result = await input.run([binary, "--version"]);
@@ -1548,6 +1711,7 @@ var FIXED_ARGV = Object.freeze([
   "--strict-mcp-config",
   "--mcp-config",
   '{"mcpServers":{}}',
+  "--restricted",
   "--no-session-persistence"
 ]);
 var ENV_ALLOWLIST = Object.freeze([
@@ -2346,7 +2510,7 @@ var CLAUDE_ALIASES = [
   { id: "sonnet", note: "balanced" },
   { id: "fable", note: "fastest" }
 ];
-async function readJson(path) {
+async function readJson2(path) {
   try {
     return JSON.parse(await readFile6(path, "utf8"));
   } catch {
@@ -2371,7 +2535,7 @@ function codexSuggestions(cache) {
   }));
 }
 async function claudeSuggestions(home) {
-  const settings = await readJson(join3(home, ".claude", "settings.json"));
+  const settings = await readJson2(join3(home, ".claude", "settings.json"));
   const configured = typeof settings === "object" && settings !== null ? settings.model : void 0;
   const out = [];
   if (typeof configured === "string" && configured !== "") {
@@ -2388,7 +2552,7 @@ async function claudeSuggestions(home) {
 async function modelSuggestions(cli, home = homedir()) {
   if (cli === "codex-cli") {
     return codexSuggestions(
-      await readJson(join3(home, ".codex", "models_cache.json"))
+      await readJson2(join3(home, ".codex", "models_cache.json"))
     );
   }
   if (cli === "claude-cli") return claudeSuggestions(home);
@@ -3076,14 +3240,14 @@ async function candidates(input) {
     let model = cli.model;
     let namedByOwner = false;
     if (model === void 0) {
-      const named = await modelByHand({
+      const named2 = await modelByHand({
         cli,
         io: input.io,
         verifier: input.verifier,
         ...input.suggest === void 0 ? {} : { suggest: input.suggest }
       });
-      if (named === void 0) continue;
-      model = named;
+      if (named2 === void 0) continue;
+      model = named2;
       namedByOwner = true;
     }
     const proof = await input.verifier(cli.id, model);
@@ -4813,7 +4977,7 @@ function isNotFound2(error) {
 }
 
 // src/console-agent.ts
-import { Buffer } from "buffer";
+import { Buffer as Buffer2 } from "buffer";
 import {
   ConsoleFrame,
   CONSOLE_FRAME_VERSION,
@@ -4973,7 +5137,7 @@ function consoleSession(deps) {
         case "stdin":
           if (!started) return;
           fromBrowser += 1;
-          deps.shell.write(Buffer.from(consoleDataBytes(frame.data)));
+          deps.shell.write(Buffer2.from(consoleDataBytes(frame.data)));
           return;
         case "resize":
           if (!started) return;
@@ -4992,7 +5156,7 @@ function consoleSession(deps) {
 }
 
 // src/pty-shell.ts
-import { Buffer as Buffer2 } from "buffer";
+import { Buffer as Buffer3 } from "buffer";
 var NO_PTY_MESSAGE = "byollm console-agent needs node-pty, which is a hosted-box feature and is not installed here.\nIf you are self-hosting a box, install it beside byollm: npm i -g node-pty";
 var NoPtyError = class extends Error {
   constructor() {
@@ -5032,7 +5196,7 @@ async function openPtyShell(options) {
   let exited;
   let announce;
   child.onData((data) => {
-    const chunk = Buffer2.from(data, "utf8");
+    const chunk = Buffer3.from(data, "utf8");
     if (deliver !== void 0) {
       deliver(chunk);
       return;
@@ -7550,11 +7714,14 @@ var Runner = class {
         jobId: job.id,
         senderKeyId: keyId2(publicIdentityOf2(keys).identity),
         recipientKeyId: keyId2(this.#pinFor(job).identity),
-        // This runner's clock, not the process's — cloud_008 §31. The only
-        // `Date.now()` left in this class, in the one place that stamps a
-        // deadline somebody else enforces: a test that moves time moved every
-        // other clock here and not this one, so a sealed result carried an
-        // expiry from a different timeline than the lease it answered.
+        // This runner's clock, not the process's — cloud_008 §31. This was a
+        // `Date.now()`, in the one place that stamps a deadline somebody else
+        // enforces: a test that moves time moved every other clock here and
+        // not this one, so a sealed result carried an expiry from a different
+        // timeline than the lease it answered. The retirement window had the
+        // same two clocks until it was found the same way; `drain` is the one
+        // read left on the process clock, because it waits out real time
+        // beside a real sleep.
         deadlineAt: this.#now() + ENVELOPE_MAX_AGE_MS,
         direction: "result"
       }
@@ -7861,7 +8028,7 @@ var Runner = class {
     for (const id of [...this.#sites.keys()]) {
       if (id in sites) continue;
       const until2 = this.#retiring.get(id);
-      if (until2 !== void 0 && Date.now() < until2) continue;
+      if (until2 !== void 0 && this.#now() < until2) continue;
       this.#retiring.delete(id);
       this.#sites.delete(id);
       for (const [leaseId, held] of this.#active) {
@@ -7943,7 +8110,7 @@ var Runner = class {
     if (!previous) return false;
     this.#known.set(id, site);
     this.#sites.set(id, site);
-    const ceiling = Date.now() + RETIREMENT_WINDOW_MS;
+    const ceiling = this.#now() + RETIREMENT_WINDOW_MS;
     const proposed = offered.retiringUntil ?? ceiling;
     this.#retiring.set(walk.from, Math.min(proposed, ceiling));
     this.#options.onEvent?.({
@@ -8975,18 +9142,18 @@ function consoleSpecArg(args) {
 var UNRESTRICTED = "--unrestricted-shell";
 function consoleShellChoice(args) {
   const at = args.indexOf("--shell");
-  const named = at === -1 ? void 0 : args[at + 1];
+  const named2 = at === -1 ? void 0 : args[at + 1];
   const escaped = args.includes(UNRESTRICTED);
-  if (at !== -1 && (named === void 0 || named.startsWith("--"))) {
+  if (at !== -1 && (named2 === void 0 || named2.startsWith("--"))) {
     return { ok: false, why: "`--shell` needs a path to the shell to run." };
   }
-  if (named !== void 0 && escaped) {
+  if (named2 !== void 0 && escaped) {
     return {
       ok: false,
       why: `\`--shell\` and \`${UNRESTRICTED}\` disagree about what to run.`
     };
   }
-  if (named !== void 0) return { ok: true, command: named, fenced: true };
+  if (named2 !== void 0) return { ok: true, command: named2, fenced: true };
   if (escaped) return { ok: true, command: "/bin/sh", fenced: false };
   return {
     ok: false,
@@ -9120,9 +9287,9 @@ async function commandConsoleAgent(paths, args, io) {
 }
 var DEFAULT_ORIGIN = "https://hub.byollm.cloud";
 function connectTarget(args) {
-  const named = args.indexOf("--name");
+  const named2 = args.indexOf("--name");
   const positional = args.filter(
-    (arg, at) => !arg.startsWith("-") && (named === -1 || at !== named && at !== named + 1)
+    (arg, at) => !arg.startsWith("-") && (named2 === -1 || at !== named2 && at !== named2 + 1)
   );
   return positional[0] ?? DEFAULT_ORIGIN;
 }
@@ -9191,10 +9358,14 @@ async function commandModel(paths, args, io) {
     const shown = await showModel(paths.config, service, io);
     return shown.code;
   }
+  const loaded = await loadConfig(paths.config).catch(() => void 0);
+  const configured = loaded?.config.services[service];
   const set = await setModel(
     { configPath: paths.config, service, model },
     io,
-    backendVerifier((id) => createBackend(id, {})),
+    backendVerifier(
+      (id) => backendFor({ type: id, baseUrl: configured?.baseUrl })
+    ),
     /**
      * The memory guard on the owner's own command — B106.
      *
@@ -9206,12 +9377,11 @@ async function commandModel(paths, args, io) {
      * job — `minAvailableMemoryBytes`, one value, one meaning, whoever asked.
      */
     async (backendId) => {
-      const loaded = await loadConfig(paths.config).catch(() => void 0);
       if (loaded === void 0) return { ask: false };
       const { memory, pressure } = await readHostMemory();
       return modelLoadQuestion({
         backendId,
-        baseUrl: loaded.config.services[service]?.baseUrl,
+        baseUrl: configured?.baseUrl,
         model,
         memory,
         pressure,
@@ -9223,9 +9393,9 @@ async function commandModel(paths, args, io) {
   return set.code;
 }
 async function commandConnect(paths, args, io, signal) {
-  const named = args.indexOf("--name");
-  const name = named === -1 ? void 0 : args[named + 1];
-  if (named !== -1 && (name === void 0 || name.startsWith("-"))) {
+  const named2 = args.indexOf("--name");
+  const name = named2 === -1 ? void 0 : args[named2 + 1];
+  if (named2 !== -1 && (name === void 0 || name.startsWith("-"))) {
     io.err("usage: byollm connect [<url>] [--name <name>]\n");
     return 2;
   }
@@ -9563,7 +9733,16 @@ async function runLoop(paths, origins, io, signal, supervised = !process.stdout.
   );
   if (signal?.aborted === true) controller.abort();
   const runners = [];
-  let offered;
+  const inbox = loaded.config.autoUpdate ? offerInbox({
+    authority: normalizeOrigin(
+      loaded.config.updateAuthority ?? DEFAULT_ORIGIN
+    ),
+    hasControlPlane: (origin) => pairings.get(origin)?.controlPlanePublic !== void 0,
+    report: (line) => {
+      io.err(`update: ${line}
+`);
+    }
+  }) : void 0;
   for (const origin of origins) {
     const pairing = pairings.get(origin);
     if (!pairing) {
@@ -9662,7 +9841,8 @@ async function runLoop(paths, origins, io, signal, supervised = !process.stdout.
       },
       onEvent: (event) => {
         report(origin, event, io);
-        if (event.type === "update-offered") offered = event.version;
+        if (event.type === "update-offered")
+          inbox?.receive(origin, event.version);
         if (event.type === "heartbeat") {
           void recordSites(pairings, origin, runner.sites, {
             known: runner.known
@@ -9717,11 +9897,11 @@ Which sites may send work is enabled from your dashboard. Ctrl-C to stop.
 `
   );
   await ingress.applyRetention(Date.now());
-  const updated = loaded.config.autoUpdate ? watchForUpdate({
+  const updated = inbox ? watchForUpdate({
     runners,
     io,
     signal: controller.signal,
-    offered: () => offered
+    offered: inbox.current
   }) : new Promise(() => void 0);
   const tookUpdate = await Promise.race([
     Promise.all(runners.map((runner) => runner.run(controller.signal))).then(
@@ -9747,6 +9927,7 @@ async function watchForUpdate(input) {
       const outcome = await update(DAEMON_VERSION, version, {
         ...realUpdateDeps({
           run: input.run ?? spawnCommand,
+          ...input.verify === void 0 ? {} : { verify: input.verify },
           drain: async () => {
             await Promise.all(
               input.runners.map(
@@ -9910,7 +10091,7 @@ function describeAge(ms) {
   return seconds < 120 ? `${String(seconds)} seconds` : `${String(Math.round(seconds / 60))} minutes`;
 }
 async function commandStatus(paths, io, service) {
-  const { loaded, ingress, budgets, spend, spentGrants } = await context(paths);
+  const { loaded, configured, ingress, budgets, spend, spentGrants } = await context(paths);
   const pairings = new Pairings(paths.pairings);
   await pairings.load();
   reportSkipped(pairings, io);
@@ -9931,10 +10112,17 @@ async function commandStatus(paths, io, service) {
   const plan = servicePlan(serviceTarget(paths, service));
   const supervision = await serviceState(plan, service.run);
   const revoked = await revokedMark(paths.health);
+  const notSetUp = !configured && beat === void 0;
   io.out(
-    `state: ${revoked !== void 0 ? "REVOKED" : supervision.state === "installed" || stale ? "NOT RUNNING" : failing ? "NOT REPORTING" : "running"}
+    `state: ${revoked !== void 0 ? "REVOKED" : supervision.state === "installed" || stale ? "NOT RUNNING" : failing ? "NOT REPORTING" : notSetUp ? "NOT SET UP" : "running"}
 `
   );
+  if (revoked === void 0 && !stale && !failing && notSetUp) {
+    io.out(
+      `  no config at ${paths.config}, and nothing has run here yet.
+  ${NOT_SET_UP_HINT}`
+    );
+  }
   if (revoked !== void 0) {
     io.out(
       `  ${REVOKED_SENTENCE}.
@@ -10000,8 +10188,10 @@ async function commandStatus(paths, io, service) {
   io.out("\nservices\n");
   const recorded = await readServiceStates(paths.serviceStates);
   const deviceName = await labelFor(paths, void 0);
-  const declared = Object.entries(loaded.config.services);
-  if (declared.length === 0) {
+  const declared = configured ? Object.entries(loaded.config.services) : [];
+  if (!configured) {
+    io.out("  (none \u2014 run `byollm setup`)\n");
+  } else if (declared.length === 0) {
     io.out("  (none configured)\n");
   }
   for (const [name, service2] of declared) {
@@ -10506,7 +10696,16 @@ ${summarise(outcome).join("\n")}
   return signal?.aborted === true ? 1 : 0;
 }
 async function commandServices(paths, io, service) {
-  const { loaded, ingress, budgets, spend, spentGrants } = await context(paths);
+  const { loaded, configured, ingress, budgets, spend, spentGrants } = await context(paths);
+  if (!configured) {
+    io.out(
+      `services
+  (none \u2014 no config at ${paths.config})
+
+` + NOT_SET_UP_HINT
+    );
+    return 1;
+  }
   const pairings = new Pairings(paths.pairings);
   await pairings.load();
   const hasRelay = pairings.list().some((pairing) => pairing.controlPlanePublic !== void 0);
@@ -10602,6 +10801,10 @@ with the device's page, and after installing a new CLI run
 }
 async function context(paths) {
   const loaded = await loadConfig(paths.config);
+  const configured = await access(paths.config).then(
+    () => true,
+    () => false
+  );
   const ingress = new IngressLog({
     path: paths.ingressLog,
     communityPromptDays: loaded.config.ingress.communityPromptDays,
@@ -10613,8 +10816,9 @@ async function context(paths) {
   const spentGrants = new SpentGrants(paths.spentGrants);
   spentGrants.load(Date.now());
   await spend.load(Date.now());
-  return { loaded, ingress, budgets, spend, spentGrants };
+  return { loaded, configured, ingress, budgets, spend, spentGrants };
 }
+var NOT_SET_UP_HINT = "Run `byollm setup` to find what this computer already has.\n";
 async function confirmInteractively(question) {
   if (!process.stdin.isTTY) {
     process.stderr.write(
@@ -10680,7 +10884,7 @@ async function exists(path) {
 }
 
 // src/index.ts
-var DAEMON_VERSION = "0.1.0";
+var DAEMON_VERSION = "0.1.2";
 function daemonVersion() {
   return {
     daemon: DAEMON_VERSION,
@@ -10697,6 +10901,8 @@ ${v.platform}-${v.arch}, node ${v.node}
 }
 
 export {
+  UnusableOrigin,
+  normalizeOrigin,
   checkBaseUrl,
   BASE_URL_REFUSAL_MESSAGES,
   DaemonConfig,
@@ -10710,8 +10916,6 @@ export {
   createBackend,
   SpendLedger,
   estimateCents,
-  UnusableOrigin,
-  normalizeOrigin,
   Budgets,
   ClientError,
   ProtocolClient,
@@ -10739,4 +10943,4 @@ export {
   runCli,
   main
 };
-//# sourceMappingURL=chunk-FUKJDD7M.js.map
+//# sourceMappingURL=chunk-K7QYAF7V.js.map