modelrig 0.0.1 → 0.2.0

package/dist/config.d.ts

@@ -0,0 +1,204 @@
+/**
+ * Configuration — plan §3. THE ONLY FILE that reads process.env in this
+ * package (adapters receive keys via constructors; enforced by
+ * __tests__/package-invariants.test.ts).
+ */
+import type { CapabilityFlag, ProviderId } from "./types/provider";
+export interface RigConfig {
+    readonly routesDir: string;
+    /** OPTIONAL directory of deployment-bundled INTERNAL infra routes, merged
+     * INTO `routesDir`'s routes (union, not replacement) by createRig. The server
+     * passes its gateway-internal-routes/ here so run-judge@v1 /
+     * analyst-summarize@v1 always resolve, independent of the operator's
+     * MODELRIG_ROUTES_DIR. Absent ⇒ exactly the pre-existing single-dir behavior. */
+    readonly extraRoutesDir?: string;
+    readonly telemetryDbPath: string;
+    readonly keys: {
+        readonly gemini?: string;
+        readonly openai?: string;
+        readonly deepseek?: string;
+        readonly anthropic?: string;
+        /** xAI — env: XAI_API_KEY (xAI's own convention). */
+        readonly grok?: string;
+        /** A1 aggregator hosts (generic openai-compatible adapter). */
+        readonly deepinfra?: string;
+        readonly fireworks?: string;
+    };
+    /** Budget for envelopes first opened by this rig (default: envelope.ts's $25). */
+    readonly envelopeBudgetUsd?: number;
+    /** Addendum A1: USD/MTok charged to an active envelope for models with no
+     * pricing entry (default $100 — generous-high; envelopes fail closed). */
+    readonly unpricedRateUsdPerMTok?: number;
+    /** Capability overrides — the escape hatch ABOVE the registry (precedence:
+     * overrides > probed > declared). When set for a provider, REPLACES the
+     * whole resolved flag set for every model of that provider — any misprobed
+     * fact is one config line from fixed. */
+    readonly capabilityOverrides?: Partial<Record<ProviderId, readonly CapabilityFlag[]>>;
+    /** Registry facts file (Phase 3 WS6) — default: the packaged
+     * registry/registry.json. Env: MODELRIG_REGISTRY_PATH. */
+    readonly registryPath?: string;
+    /** Search provider for the grounding-inject rung (Phase 3 WS3) — omitted
+     * means `require: grounded` routes resolve natively-grounded candidates
+     * only. */
+    readonly search?: {
+        readonly tavilyApiKey: string;
+        readonly costPerSearchUsd?: number;
+        readonly searchDepth?: "basic" | "advanced";
+    };
+    /** Watch loop (Phase 4 WS1): monthly paid-run cap + material-shift
+     * threshold. Defaults apply when unset; the loop itself is opt-in (a cron
+     * running `modelrig watch run`). */
+    readonly watch?: {
+        readonly monthlyUsd?: number;
+        readonly thresholdPct?: number;
+    };
+    /**
+     * Cloud telemetry sink — omitted => local SQLite only.
+     *
+     * telemetry-ingestion-boundary.md §2.4's three modes, as a discriminated
+     * union rather than a bag of optional fields: `api` and `direct` need
+     * different credentials and it should be impossible to half-configure one.
+     *
+     *   local-only  pure-router users, ZDR-strict      no credentials
+     *   api         every hosted customer               their rig_sk_ key only
+     *   direct      self-host + our own deployments     their own database
+     */
+    readonly export?: ApiExportConfig | DirectExportConfig;
+    /**
+     * OTLP span emission (E1) — ADDITIVE alongside `export`, never instead of it.
+     * `null` means no endpoint configured ⇒ no emitter is ever constructed and
+     * behaviour is unchanged (spec §6a). Set via MODELRIG_OTLP_ENDPOINT (+ optional
+     * MODELRIG_OTLP_HEADERS). `loadConfigFromEnv` ALWAYS resolves this (to null or
+     * a config) so `/status` can answer "configured|disabled" honestly; the field
+     * is optional only so hand-built configs (tests) need not spell out the
+     * off case — an absent value is read identically to null.
+     */
+    readonly otlp?: OtlpConfig | null;
+    /**
+     * Artifact / execution-graph namespace (Expansion E2). OFF by default —
+     * `enabled: false` (or absent) means the run/artifact SDK surface is inert,
+     * the exporter sends protocol v1 byte-identical to before, and zero new rows
+     * are written (spec §1.4). Set via `MODELRIG_ARTIFACTS=1`. Like `otlp`,
+     * `loadConfigFromEnv` ALWAYS resolves this so `/status` can answer
+     * "enabled|disabled" honestly; optional only so hand-built configs need not
+     * spell out the off case.
+     */
+    readonly artifacts?: ArtifactsConfig;
+}
+/** Scrub mode applied to content BEFORE upload (E2-C chunk B). Default `detect`
+ * when content custody is on. */
+export type ScrubMode = "off" | "detect" | "redact" | "block";
+/** Per-rig content-custody config (E2-C chunk A/B). Present ONLY when content
+ * custody is turned ON and the transport is configured; ABSENT (the default)
+ * means metadata + hash only — today's behaviour, unchanged. Consent, off by
+ * default (ruling 6). */
+export interface ArtifactContentConfig {
+    /** Full grant endpoint, e.g. https://server/v1/artifacts/uploads. */
+    readonly uploadsUrl: string;
+    /** `rig_sk_` key with the `artifact-write` scope (header only; never a URL — C2). */
+    readonly apiKey: string;
+    readonly scrub: ScrubMode;
+    /** Client-side ceiling short-circuit; the server enforces the real one. */
+    readonly maxBytes: number;
+}
+/** Resolved artifact-namespace config (E2 / E2-C). `enabled` is the E2 gate;
+ * `content` (E2-C) is present only when content custody is configured on. */
+export interface ArtifactsConfig {
+    readonly enabled: boolean;
+    readonly content?: ArtifactContentConfig;
+}
+/**
+ * Resolve the artifact config from raw env values (E2 / E2-C, default flip §2).
+ * Pure — env is read by the caller (the package's sole env-reader rule).
+ *   MODELRIG_ARTIFACTS unset                 → namespace ON when a control plane
+ *                                              is configured, OFF for local-only
+ *                                              (§2: metadata-on by default).
+ *   MODELRIG_ARTIFACTS=1|true|on             → force the namespace ON.
+ *   MODELRIG_ARTIFACTS=0|false|off           → force it OFF (the explicit opt-out).
+ *   MODELRIG_ARTIFACTS_CONTENT=on|1|true     → content custody ON (E2-C).
+ *   MODELRIG_CONTENT_UPLOAD_URL, MODELRIG_CONTENT_API_KEY → transport.
+ *   MODELRIG_ARTIFACTS_SCRUB=off|detect|redact|block → scrub mode (default detect).
+ *   MODELRIG_CONTENT_MAX_BYTES               → client ceiling (default 50MB).
+ * Content custody stays OFF (content absent) unless it is explicitly on AND the
+ * transport is fully configured — a half-configured custody is refused into the
+ * safe default (metadata only), never silently half-on. The metadata default
+ * flip does NOT flip content: content is its own gate (§2 "content unchanged").
+ */
+export declare function resolveArtifactsConfig(env: {
+    readonly artifacts?: string;
+    readonly content?: string;
+    readonly uploadsUrl?: string;
+    readonly apiKey?: string;
+    readonly scrub?: string;
+    readonly maxBytes?: string;
+}, 
+/** Is a cloud sink (api or direct) configured? Unset gate defaults ON when so,
+ * OFF otherwise. Defaults false so existing callers/tests keep local-only
+ * semantics (gate-only) unless they opt into the flip. */
+controlPlaneConfigured?: boolean): ArtifactsConfig;
+/** Resolved OTLP config (E1). Endpoint + sink-auth headers only; the emitter
+ * derives batch/interval + watermark from defaults + the source id. */
+export interface OtlpConfig {
+    /** OTLP/HTTP traces endpoint. NEVER logged/displayed — may embed a token (C2). */
+    readonly endpoint: string;
+    /** Sink auth headers from MODELRIG_OTLP_HEADERS (`k=v,k=v`). NEVER logged (C2). */
+    readonly headers: Record<string, string>;
+}
+/**
+ * Parse `MODELRIG_OTLP_HEADERS` ("k=v,k=v") into a header map (E1). Split on the
+ * FIRST `=` only, so a base64 Basic-auth value keeping its `=` padding survives.
+ * Blank/whitespace pairs and pairs with an empty key are dropped. Pure — env is
+ * read by the caller, this only shapes the string (keeps this file the sole
+ * env reader without smearing parsing into it).
+ */
+export declare function parseOtlpHeaders(raw: string | undefined): Record<string, string>;
+/**
+ * Resolve the OTLP config from raw env values (E1). Pure so it is testable
+ * without touching `process.env` (the package-invariants env-reader rule) —
+ * `loadConfigFromEnv` reads the two vars and hands them here. A blank/absent
+ * endpoint ⇒ `null` = off by default (spec §6a).
+ */
+export declare function resolveOtlpConfig(endpoint: string | undefined, headersRaw: string | undefined): OtlpConfig | null;
+interface ExportCommon {
+    readonly sourceId?: string;
+    readonly batchSize?: number;
+    readonly intervalMs?: number;
+}
+export interface ApiExportConfig extends ExportCommon {
+    readonly mode: "api";
+    /** `rig_sk_…` with the `ingest` scope. The ONLY credential a hosted
+     * customer holds — database credentials never leave our infrastructure. */
+    readonly apiKey: string;
+    readonly ingestUrl: string;
+}
+export interface DirectExportConfig extends ExportCommon {
+    readonly mode: "direct";
+    readonly supabaseUrl: string;
+    readonly serviceRoleKey: string;
+    /** The tenant this deployment stamps. Defaults to the house org, which is
+     * the right answer for a self-hosted control plane: there is one org there
+     * and everything belongs to it. */
+    readonly orgId?: string;
+    readonly projectId?: string | null;
+}
+/** Provider → the env var that keys it. One table so error surfaces can say
+ * WHICH variable to set rather than "no key configured" (F1 / WS3: errors
+ * that teach). `loadConfigFromEnv` below reads the same names. */
+export declare const PROVIDER_KEY_ENV: Readonly<Record<string, string>>;
+export declare function loadConfigFromEnv(overrides?: Partial<RigConfig>): RigConfig;
+/**
+ * Narrow `config.export` to DIRECT mode, or explain why the command cannot run.
+ *
+ * Phase 6 WS2 gave the export config two modes. Every command below needs a
+ * service-role control-plane client — proposals, swap events, bake-off
+ * mirrors, sample purges — and none of those has an ingest endpoint. A rig
+ * configured in api mode therefore genuinely cannot run them, and saying so is
+ * better than the `undefined` deref this used to be one refactor away from.
+ */
+export declare function directExportOf(config: RigConfig, what: string): {
+    readonly supabaseUrl: string;
+    readonly serviceRoleKey: string;
+    readonly sourceId?: string;
+};
+export {};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnE,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;qFAIiF;IACjF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE;QACb,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,qDAAqD;QACrD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,+DAA+D;QAC/D,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,kFAAkF;IAClF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;8EAC0E;IAC1E,QAAQ,CAAC,sBAAsB,CAAC,EAAE,MAAM,CAAC;IACzC;;;6CAGyC;IACzC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC,CAAC,CAAC;IACtF;8DAC0D;IAC1D,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;eAEW;IACX,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;KAC7C,CAAC;IACF;;wCAEoC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;KAChC,CAAC;IACF;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAC;IACvD;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAClC;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;CACtC;AAED;iCACiC;AACjC,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE9D;;;yBAGyB;AACzB,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qFAAqF;IACrF,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;6EAC6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AAWD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AACD;;0DAE0D;AAC1D,sBAAsB,UAAQ,GAC7B,eAAe,CAuBjB;AAED;uEACuE;AACvE,MAAM,WAAW,UAAU;IACzB,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYhF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,UAAU,GAAG,IAAI,CAGnB;AAED,UAAU,YAAY;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACnD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB;+EAC2E;IAC3E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;;uCAEmC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACpC;AAED;;kEAEkE;AAClE,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ7D,CAAC;AAKF,wBAAgB,iBAAiB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,SAAS,CAgI3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,MAAM,GACX;IAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAgB/F"}

package/dist/config.js

@@ -0,0 +1,252 @@
+"use strict";
+/**
+ * Configuration — plan §3. THE ONLY FILE that reads process.env in this
+ * package (adapters receive keys via constructors; enforced by
+ * __tests__/package-invariants.test.ts).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROVIDER_KEY_ENV = void 0;
+exports.resolveArtifactsConfig = resolveArtifactsConfig;
+exports.parseOtlpHeaders = parseOtlpHeaders;
+exports.resolveOtlpConfig = resolveOtlpConfig;
+exports.loadConfigFromEnv = loadConfigFromEnv;
+exports.directExportOf = directExportOf;
+const ingest_protocol_1 = require("./telemetry/ingest-protocol");
+const DEFAULT_SDK_CONTENT_MAX_BYTES = 52428800;
+function resolveScrubMode(raw, contentOn) {
+    const v = (raw ?? "").trim().toLowerCase();
+    if (v === "off" || v === "detect" || v === "redact" || v === "block")
+        return v;
+    // Default when content is on is `detect` — scan and count, upload verbatim.
+    return contentOn ? "detect" : "off";
+}
+/**
+ * Resolve the artifact config from raw env values (E2 / E2-C, default flip §2).
+ * Pure — env is read by the caller (the package's sole env-reader rule).
+ *   MODELRIG_ARTIFACTS unset                 → namespace ON when a control plane
+ *                                              is configured, OFF for local-only
+ *                                              (§2: metadata-on by default).
+ *   MODELRIG_ARTIFACTS=1|true|on             → force the namespace ON.
+ *   MODELRIG_ARTIFACTS=0|false|off           → force it OFF (the explicit opt-out).
+ *   MODELRIG_ARTIFACTS_CONTENT=on|1|true     → content custody ON (E2-C).
+ *   MODELRIG_CONTENT_UPLOAD_URL, MODELRIG_CONTENT_API_KEY → transport.
+ *   MODELRIG_ARTIFACTS_SCRUB=off|detect|redact|block → scrub mode (default detect).
+ *   MODELRIG_CONTENT_MAX_BYTES               → client ceiling (default 50MB).
+ * Content custody stays OFF (content absent) unless it is explicitly on AND the
+ * transport is fully configured — a half-configured custody is refused into the
+ * safe default (metadata only), never silently half-on. The metadata default
+ * flip does NOT flip content: content is its own gate (§2 "content unchanged").
+ */
+function resolveArtifactsConfig(env, 
+/** Is a cloud sink (api or direct) configured? Unset gate defaults ON when so,
+ * OFF otherwise. Defaults false so existing callers/tests keep local-only
+ * semantics (gate-only) unless they opt into the flip. */
+controlPlaneConfigured = false) {
+    const gate = (env.artifacts ?? "").trim().toLowerCase();
+    const explicitOn = gate === "1" || gate === "true" || gate === "on";
+    const explicitOff = gate === "0" || gate === "false" || gate === "off";
+    // §2 default flip: explicit wins; an unset gate follows the control plane.
+    const enabled = explicitOn || (!explicitOff && controlPlaneConfigured);
+    const contentGate = (env.content ?? "").trim().toLowerCase();
+    const contentOn = contentGate === "on" || contentGate === "1" || contentGate === "true";
+    const uploadsUrl = (env.uploadsUrl ?? "").trim();
+    const apiKey = (env.apiKey ?? "").trim();
+    const maxBytesRaw = env.maxBytes !== undefined && env.maxBytes !== "" ? Number(env.maxBytes) : NaN;
+    const maxBytes = Number.isInteger(maxBytesRaw) && maxBytesRaw > 0 ? maxBytesRaw : DEFAULT_SDK_CONTENT_MAX_BYTES;
+    // Content is on ONLY when the namespace is enabled, the gate is on, AND the
+    // transport is present. Missing transport → stays metadata-only (fail-safe).
+    const content = enabled && contentOn && uploadsUrl !== "" && apiKey !== ""
+        ? { uploadsUrl, apiKey, scrub: resolveScrubMode(env.scrub, true), maxBytes }
+        : undefined;
+    return { enabled, ...(content !== undefined ? { content } : {}) };
+}
+/**
+ * Parse `MODELRIG_OTLP_HEADERS` ("k=v,k=v") into a header map (E1). Split on the
+ * FIRST `=` only, so a base64 Basic-auth value keeping its `=` padding survives.
+ * Blank/whitespace pairs and pairs with an empty key are dropped. Pure — env is
+ * read by the caller, this only shapes the string (keeps this file the sole
+ * env reader without smearing parsing into it).
+ */
+function parseOtlpHeaders(raw) {
+    const out = {};
+    if (raw === undefined || raw.trim() === "")
+        return out;
+    for (const pair of raw.split(",")) {
+        const eq = pair.indexOf("=");
+        if (eq === -1)
+            continue;
+        const key = pair.slice(0, eq).trim();
+        const value = pair.slice(eq + 1).trim();
+        if (key === "")
+            continue;
+        out[key] = value;
+    }
+    return out;
+}
+/**
+ * Resolve the OTLP config from raw env values (E1). Pure so it is testable
+ * without touching `process.env` (the package-invariants env-reader rule) —
+ * `loadConfigFromEnv` reads the two vars and hands them here. A blank/absent
+ * endpoint ⇒ `null` = off by default (spec §6a).
+ */
+function resolveOtlpConfig(endpoint, headersRaw) {
+    if (endpoint === undefined || endpoint.trim() === "")
+        return null;
+    return { endpoint: endpoint.trim(), headers: parseOtlpHeaders(headersRaw) };
+}
+/** Provider → the env var that keys it. One table so error surfaces can say
+ * WHICH variable to set rather than "no key configured" (F1 / WS3: errors
+ * that teach). `loadConfigFromEnv` below reads the same names. */
+exports.PROVIDER_KEY_ENV = {
+    gemini: "GEMINI_API_KEY",
+    openai: "OPENAI_API_KEY",
+    deepseek: "DEEPSEEK_API_KEY",
+    anthropic: "ANTHROPIC_API_KEY",
+    grok: "XAI_API_KEY",
+    deepinfra: "MODELRIG_DEEPINFRA_API_KEY",
+    fireworks: "MODELRIG_FIREWORKS_API_KEY",
+};
+const DEFAULT_ROUTES_DIR = "./modelrig/routes";
+const DEFAULT_TELEMETRY_DB = "./.modelrig/telemetry.db";
+function loadConfigFromEnv(overrides) {
+    const env = process.env;
+    const budgetRaw = env.MODELRIG_ENVELOPE_BUDGET_USD;
+    const budget = budgetRaw !== undefined && budgetRaw !== "" ? Number(budgetRaw) : undefined;
+    const supabaseUrl = env.MODELRIG_SUPABASE_URL;
+    const serviceRoleKey = env.MODELRIG_SUPABASE_SERVICE_ROLE_KEY;
+    const apiKey = env.MODELRIG_API_KEY;
+    // OTLP span emission (E1) — off unless an endpoint is set. Additive to
+    // `export`; a rig may emit OTLP with no control-plane sink and vice-versa.
+    const otlp = resolveOtlpConfig(env.MODELRIG_OTLP_ENDPOINT, env.MODELRIG_OTLP_HEADERS);
+    // Artifact / execution-graph namespace (E2, default flip §2) — ON by default
+    // when a control plane is configured (api key OR the direct supabase pair),
+    // OFF for a pure local-only rig; MODELRIG_ARTIFACTS=0 is the explicit opt-out.
+    // Always resolved so /status + the boot banner answer honestly. Content
+    // custody (E2-C) stays its own gate — the metadata flip never flips content.
+    const controlPlaneConfigured = Boolean(apiKey) || Boolean(supabaseUrl && serviceRoleKey);
+    const artifacts = resolveArtifactsConfig({
+        artifacts: env.MODELRIG_ARTIFACTS,
+        content: env.MODELRIG_ARTIFACTS_CONTENT,
+        uploadsUrl: env.MODELRIG_CONTENT_UPLOAD_URL,
+        apiKey: env.MODELRIG_CONTENT_API_KEY ?? env.MODELRIG_API_KEY,
+        scrub: env.MODELRIG_ARTIFACTS_SCRUB,
+        maxBytes: env.MODELRIG_CONTENT_MAX_BYTES,
+    }, controlPlaneConfigured);
+    const fromEnv = {
+        routesDir: env.MODELRIG_ROUTES_DIR ?? DEFAULT_ROUTES_DIR,
+        telemetryDbPath: env.MODELRIG_TELEMETRY_DB ?? DEFAULT_TELEMETRY_DB,
+        otlp,
+        artifacts,
+        ...(env.MODELRIG_REGISTRY_PATH ? { registryPath: env.MODELRIG_REGISTRY_PATH } : {}),
+        keys: {
+            ...(env.GEMINI_API_KEY ? { gemini: env.GEMINI_API_KEY } : {}),
+            ...(env.OPENAI_API_KEY ? { openai: env.OPENAI_API_KEY } : {}),
+            ...(env.DEEPSEEK_API_KEY ? { deepseek: env.DEEPSEEK_API_KEY } : {}),
+            ...(env.ANTHROPIC_API_KEY ? { anthropic: env.ANTHROPIC_API_KEY } : {}),
+            ...(env.XAI_API_KEY ? { grok: env.XAI_API_KEY } : {}),
+            // A1 hosts: ModelRig-scoped names on purpose (same doctrine as Tavily).
+            ...(env.MODELRIG_DEEPINFRA_API_KEY ? { deepinfra: env.MODELRIG_DEEPINFRA_API_KEY } : {}),
+            ...(env.MODELRIG_FIREWORKS_API_KEY ? { fireworks: env.MODELRIG_FIREWORKS_API_KEY } : {}),
+        },
+        ...(budget !== undefined && Number.isFinite(budget) ? { envelopeBudgetUsd: budget } : {}),
+        ...(env.MODELRIG_UNPRICED_RATE_USD_PER_MTOK &&
+            Number.isFinite(Number(env.MODELRIG_UNPRICED_RATE_USD_PER_MTOK))
+            ? { unpricedRateUsdPerMTok: Number(env.MODELRIG_UNPRICED_RATE_USD_PER_MTOK) }
+            : {}),
+        // Grounding-inject search (WS3). ModelRig-scoped key on purpose — never
+        // silently reusing another app's TAVILY_API_KEY.
+        ...(env.MODELRIG_TAVILY_API_KEY
+            ? {
+                search: {
+                    tavilyApiKey: env.MODELRIG_TAVILY_API_KEY,
+                    ...(env.MODELRIG_SEARCH_COST_USD && Number.isFinite(Number(env.MODELRIG_SEARCH_COST_USD))
+                        ? { costPerSearchUsd: Number(env.MODELRIG_SEARCH_COST_USD) }
+                        : {}),
+                    ...(env.MODELRIG_SEARCH_DEPTH === "advanced" ? { searchDepth: "advanced" } : {}),
+                },
+            }
+            : {}),
+        // Watch loop caps (Phase 4 WS1) — folded only when either env is set.
+        ...(() => {
+            const monthly = env.MODELRIG_WATCH_MONTHLY_USD;
+            const threshold = env.MODELRIG_WATCH_THRESHOLD_PCT;
+            const monthlyNum = monthly !== undefined && monthly !== "" ? Number(monthly) : undefined;
+            const thresholdNum = threshold !== undefined && threshold !== "" ? Number(threshold) : undefined;
+            const watch = {
+                ...(monthlyNum !== undefined && Number.isFinite(monthlyNum) && monthlyNum > 0
+                    ? { monthlyUsd: monthlyNum }
+                    : {}),
+                ...(thresholdNum !== undefined && Number.isFinite(thresholdNum) && thresholdNum > 0
+                    ? { thresholdPct: thresholdNum }
+                    : {}),
+            };
+            return Object.keys(watch).length > 0 ? { watch } : {};
+        })(),
+        // The sink is optional and never required for the run loop (spec §5).
+        // Selection follows telemetry-ingestion-boundary.md §2.1 exactly.
+        ...(() => {
+            const common = {
+                ...(env.MODELRIG_SOURCE_ID ? { sourceId: env.MODELRIG_SOURCE_ID } : {}),
+            };
+            if (apiKey) {
+                if (supabaseUrl && serviceRoleKey) {
+                    // Both configured. api wins — it is the mode that does not hand a
+                    // service-role key to a client — and the warning is loud because a
+                    // silent choice between two live sinks is how telemetry ends up in
+                    // the wrong place with nobody looking.
+                    console.warn("[modelrig] both MODELRIG_API_KEY and MODELRIG_SUPABASE_URL are set — using api mode. " +
+                        "Remove the MODELRIG_SUPABASE_* pair unless this deployment is self-hosting its own " +
+                        "control plane.");
+                }
+                return {
+                    export: {
+                        mode: "api",
+                        apiKey,
+                        ingestUrl: env.MODELRIG_INGEST_URL || ingest_protocol_1.DEFAULT_INGEST_URL,
+                        ...common,
+                    },
+                };
+            }
+            if (supabaseUrl && serviceRoleKey) {
+                return {
+                    export: {
+                        mode: "direct",
+                        supabaseUrl,
+                        serviceRoleKey,
+                        ...(env.MODELRIG_ORG_ID ? { orgId: env.MODELRIG_ORG_ID } : {}),
+                        ...(env.MODELRIG_PROJECT_ID ? { projectId: env.MODELRIG_PROJECT_ID } : {}),
+                        ...common,
+                    },
+                };
+            }
+            return {};
+        })(),
+    };
+    return {
+        ...fromEnv,
+        ...overrides,
+        keys: { ...fromEnv.keys, ...overrides?.keys },
+    };
+}
+/**
+ * Narrow `config.export` to DIRECT mode, or explain why the command cannot run.
+ *
+ * Phase 6 WS2 gave the export config two modes. Every command below needs a
+ * service-role control-plane client — proposals, swap events, bake-off
+ * mirrors, sample purges — and none of those has an ingest endpoint. A rig
+ * configured in api mode therefore genuinely cannot run them, and saying so is
+ * better than the `undefined` deref this used to be one refactor away from.
+ */
+function directExportOf(config, what) {
+    const exp = config.export;
+    if (exp === undefined) {
+        throw new Error(`${what} needs the control plane: set MODELRIG_SUPABASE_URL and ` +
+            "MODELRIG_SUPABASE_SERVICE_ROLE_KEY");
+    }
+    if (exp.mode !== "direct") {
+        throw new Error(`${what} needs direct control-plane access, and this rig is in api mode ` +
+            "(MODELRIG_API_KEY). Telemetry ingest goes through the hosted API; this command does " +
+            "not — run it where MODELRIG_SUPABASE_URL and MODELRIG_SUPABASE_SERVICE_ROLE_KEY are set.");
+    }
+    return exp;
+}

package/dist/deprecations.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Loud, one-time deprecation warnings (settings-plane §3).
+ *
+ * Two flags are on their way out now that governance lives in the control plane:
+ *   • YAML `capture:` — IGNORED when a control plane is configured; capture is a
+ *     task setting (console / API / MCP). Honored only for local-only rigs.
+ *   • the `direct` sink (MODELRIG_SUPABASE_*) — the supported path is api mode
+ *     (a `rig_sk_` key). Still works; will be removed (Matt's §0-row-5 decision).
+ *
+ * "Loud, never silent divergence" (spec §1.5): each warning fires ONCE per
+ * process (a module-level guard) so a user learns their YAML flag is being
+ * ignored, rather than quietly diverging from the console. The parked chunk-0.2
+ * commit carried no warn-once mechanism, so it is authored here from scratch.
+ */
+import type { RigConfig } from "./config";
+import type { RouteBundle } from "./types/route";
+/**
+ * Warn (once) that YAML `capture:` is ignored under a control plane. Fires only
+ * when a control plane is configured AND at least one loaded route still sets
+ * `capture: true` in YAML — a local-only rig keeps YAML as its mechanism and
+ * hears nothing.
+ */
+export declare function warnYamlCaptureDeprecated(routes: readonly RouteBundle[], controlPlaneConfigured: boolean): void;
+/**
+ * Warn (once) that the `direct` sink is deprecated, naming api mode as the path.
+ * Fires only for a rig actually configured in direct mode.
+ */
+export declare function warnDirectSinkDeprecated(config: RigConfig): void;
+/** Reset the once-per-process guards — TESTS ONLY, so warn-once cases are
+ * independent of run order. */
+export declare function __resetDeprecationWarningsForTest(): void;
+//# sourceMappingURL=deprecations.d.ts.map

package/dist/deprecations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deprecations.d.ts","sourceRoot":"","sources":["../src/deprecations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAKjD;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,sBAAsB,EAAE,OAAO,GAC9B,IAAI,CAYN;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAShE;AAED;+BAC+B;AAC/B,wBAAgB,iCAAiC,IAAI,IAAI,CAGxD"}

package/dist/deprecations.js

@@ -0,0 +1,59 @@
+"use strict";
+/**
+ * Loud, one-time deprecation warnings (settings-plane §3).
+ *
+ * Two flags are on their way out now that governance lives in the control plane:
+ *   • YAML `capture:` — IGNORED when a control plane is configured; capture is a
+ *     task setting (console / API / MCP). Honored only for local-only rigs.
+ *   • the `direct` sink (MODELRIG_SUPABASE_*) — the supported path is api mode
+ *     (a `rig_sk_` key). Still works; will be removed (Matt's §0-row-5 decision).
+ *
+ * "Loud, never silent divergence" (spec §1.5): each warning fires ONCE per
+ * process (a module-level guard) so a user learns their YAML flag is being
+ * ignored, rather than quietly diverging from the console. The parked chunk-0.2
+ * commit carried no warn-once mechanism, so it is authored here from scratch.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.warnYamlCaptureDeprecated = warnYamlCaptureDeprecated;
+exports.warnDirectSinkDeprecated = warnDirectSinkDeprecated;
+exports.__resetDeprecationWarningsForTest = __resetDeprecationWarningsForTest;
+let yamlCaptureWarned = false;
+let directSinkWarned = false;
+/**
+ * Warn (once) that YAML `capture:` is ignored under a control plane. Fires only
+ * when a control plane is configured AND at least one loaded route still sets
+ * `capture: true` in YAML — a local-only rig keeps YAML as its mechanism and
+ * hears nothing.
+ */
+function warnYamlCaptureDeprecated(routes, controlPlaneConfigured) {
+    if (yamlCaptureWarned || !controlPlaneConfigured)
+        return;
+    const withCapture = routes.filter((b) => b.capture).map((b) => b.route);
+    if (withCapture.length === 0)
+        return;
+    yamlCaptureWarned = true;
+    console.warn(`[modelrig] DEPRECATED: ${withCapture.length} route(s) set \`capture:\` in YAML ` +
+        `(${withCapture.join(", ")}). This flag is IGNORED when a control plane is configured — ` +
+        "capture is a task setting now. Set it in the console, the API " +
+        "(PATCH /v1/tasks/:task/settings), or via the MCP tool. YAML `capture:` is honored only " +
+        "for local-only rigs (no control plane).");
+}
+/**
+ * Warn (once) that the `direct` sink is deprecated, naming api mode as the path.
+ * Fires only for a rig actually configured in direct mode.
+ */
+function warnDirectSinkDeprecated(config) {
+    if (directSinkWarned || config.export?.mode !== "direct")
+        return;
+    directSinkWarned = true;
+    console.warn("[modelrig] DEPRECATED: the `direct` sink (MODELRIG_SUPABASE_URL + " +
+        "MODELRIG_SUPABASE_SERVICE_ROLE_KEY) is on its way out. The supported path is api mode — " +
+        "a `rig_sk_` key in MODELRIG_API_KEY, no database credentials in the client. Direct mode " +
+        "still works; migrate when convenient.");
+}
+/** Reset the once-per-process guards — TESTS ONLY, so warn-once cases are
+ * independent of run order. */
+function __resetDeprecationWarningsForTest() {
+    yamlCaptureWarned = false;
+    directSinkWarned = false;
+}

package/dist/feedback/coverage.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Optimization coverage, rungs 0–1 — Phase 4 WS2. Pure aggregation over
+ * telemetry + feedback rows; no store access, so the console, the server
+ * and tests all compute identically.
+ *
+ * Rungs (the eval ladder's bottom, per plan §4):
+ *   rung 0 — implicit signals only: conformance / repair / refusal rates
+ *            from telemetry. Enough confidence for schema-mechanical swap
+ *            proposals (the bake-off gate).
+ *   rung 1 — ≥ RUNG1_MIN_FEEDBACK human/agent verdicts attached: prose
+ *            routes (no schema to conform to) gain proposal confidence.
+ *   rung 2+ — judges; Phase 5+, out of scope by decision.
+ */
+import type { FeedbackRow, TelemetryRow } from "../types/telemetry";
+export declare const RUNG1_MIN_FEEDBACK = 10;
+export interface RouteCoverage {
+    readonly route: string;
+    readonly samples: number;
+    /** Share of rows with no failure class — the implicit conformance signal. */
+    readonly conformRate: number;
+    readonly repairRate: number;
+    readonly refusalRate: number;
+    readonly feedbackCount: number;
+    readonly rung: 0 | 1;
+    /** Teaching copy: what reaching the next rung takes and unlocks. */
+    readonly nextRungUnlock: string;
+}
+/** Attribution: a feedback row joins a route via its inference id, or via
+ * its episode key matching a row's run_id tag. Unmatched feedback attaches
+ * to nothing (never guessed). */
+export declare function computeCoverage(rows: readonly TelemetryRow[], feedback: readonly FeedbackRow[]): RouteCoverage[];
+//# sourceMappingURL=coverage.d.ts.map

package/dist/feedback/coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.d.ts","sourceRoot":"","sources":["../../src/feedback/coverage.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEpE,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;IACrB,oEAAoE;IACpE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;iCAEiC;AACjC,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,YAAY,EAAE,EAC7B,QAAQ,EAAE,SAAS,WAAW,EAAE,GAC/B,aAAa,EAAE,CA2EjB"}