slidemind 0.3.20 → 0.4.0

package/src/pptx/tags.mjs

@@ -18,6 +18,8 @@ import {
   relsFor,
   relsPathFor,
   resolvePartPath,
+  tagAttr,
+  tagElements,
 } from "./ooxml.mjs";
 
 export const CHUNK_BYTES = 12288;
@@ -75,7 +77,34 @@ function xmlEsc(s) {
 // input: { name, jsx, guid, bundle:{presFP,etag}, renderer, assets:[{name,bytes}],
 //          baseline?, pushedAt, metaExtra? }
 // `metaExtra` merges extra properties into SRC_META (e.g. kind:"template-fill");
-// decoders ignore unknown properties.
+// decoders ignore unknown properties. Two keys are in use:
+//   kind: "template-fill"  — the pack-filled dialect (src/pptx/fill/engine.mjs)
+//   imageIntent: {v, uses, assets}
+//     the slide's approved image obligations and the registry entries they name
+//     (src/lib/image-intent-tags.mjs). Their BYTES need no arrangement here: the
+//     jsx references `./assets/local/<assetId>.<ext>`, so `referencedAssets`
+//     already embeds them like any other deck asset. A slide with no image use
+//     carries the key not at all, so its tags are unchanged.
+//     ONE writer, on purpose (decided 2026-09-21, spec §2.2): the server bakes
+//     this deck's tags on the render path but only ever receives the TRANSPORT
+//     projection of an asset, which omits `provenance` BY DESIGN (design
+//     decision 5: the envelope is a projection, not the registry — `provenance`
+//     is client-side knowledge no model endpoint has a use for, and adding it
+//     would churn the frozen contract fixture in both repos for a field only
+//     the client reads back). So the server's `assets` would be lossy exactly
+//     where `adopt` needs them. Do NOT fix that by teaching the server to write
+//     a provenance-less copy: the CLI holds the registry, so the CLI writes the
+//     key on BOTH bake paths, topping the server's meta up through
+//     `augmentSourceMeta` rather than letting two writers answer one key
+//     differently.
+//   preservation: the slide's `state/slide-preservation.json` entry
+//     — what it must still contain, its `active` requirements AND the ones an
+//     operation superseded (src/lib/preservation-tags.mjs). The state file does
+//     not travel and the .pptx does, so without this a deck adopted into a fresh
+//     workspace comes back owing nothing, and a deletion the user asked for
+//     comes back owed again. Restored only for a slide adopt proved current, and
+//     never over a record the target deck already holds. A slide with no record
+//     carries the key not at all.
 export function encodeSourceTags(input) {
   const tags = { [TAG_GUID]: input.guid };
 
@@ -263,9 +292,9 @@ export function readSlideTags(files, slidePath) {
       const partPath = tagRels[ref[1]];
       const tagXml = partPath ? readText(files, partPath) : null;
       if (!tagXml) continue;
-      for (const t of tagXml.matchAll(/<p:tag\b([^>]*)\/>/g)) {
-        const name = t[1].match(/\bname="([^"]*)"/)?.[1];
-        const val = t[1].match(/\bval="([^"]*)"/)?.[1];
+      for (const t of tagElements(tagXml)) {
+        const name = tagAttr(t[1], "name");
+        const val = tagAttr(t[1], "val");
         if (name) out[decodeXmlEntities(name)] = decodeXmlEntities(val ?? "");
       }
     }
@@ -273,6 +302,76 @@ export function readSlideTags(files, slidePath) {
   return out;
 }
 
+/**
+ * Rewrite ONE existing slide tag's value, in the part that already holds it.
+ *
+ * The bake next door is additive: handed a tag name a slide already carries, it
+ * appends a SECOND `<p:tag>` under the same name. For a fresh slide that is
+ * right — nothing is ever renumbered or overwritten (rule C1). For amending a
+ * tag the SERVER wrote it is not: two `SLIDEMIND_SRC_META` tags in one tagLst
+ * let one reader take the first and another the last, so the same file says two
+ * different things. This rewrites the value where it stands instead.
+ *
+ * Attribute-order tolerant on purpose — a PowerPoint round trip may reorder
+ * them, and the server's writer is a different implementation of the same
+ * format. Returns true when a tag was found and rewritten.
+ */
+export function updateSlideTag(files, slidePath, name, value) {
+  const xml = readText(files, slidePath);
+  if (!xml) return false;
+  const dir = slidePath.slice(0, slidePath.lastIndexOf("/"));
+  const tagRels = {};
+  for (const rel of relsFor(files, slidePath)) {
+    if (rel.id && rel.type === TAGS_REL_TYPE) tagRels[rel.id] = resolvePartPath(dir, rel.target);
+  }
+  for (const cust of xml.matchAll(/<p:custDataLst\b[\s\S]*?<\/p:custDataLst>/g)) {
+    for (const ref of cust[0].matchAll(/<p:tags\b[^>]*\br:id="([^"]+)"/g)) {
+      const partPath = tagRels[ref[1]];
+      const tagXml = partPath ? readText(files, partPath) : null;
+      if (!tagXml) continue;
+      for (const t of tagElements(tagXml)) {
+        if (decodeXmlEntities(tagAttr(t[1], "name") ?? "") !== name) continue;
+        const replaced = t[0].replace(/\bval=(?:"[^"]*"|'[^']*')/, `val="${xmlEsc(value)}"`);
+        files[partPath] = enc(tagXml.replace(t[0], replaced));
+        return true;
+      }
+    }
+  }
+  return false;
+}
+
+/**
+ * Add SRC_META extras to a slide whose source was baked by SOMEONE ELSE.
+ *
+ * The server bakes the tags on the render path, and there are extras it cannot
+ * write: `imageIntent` needs the deck's registry (the transport descriptor the
+ * server holds deliberately carries no `provenance`), and the local records
+ * beside it are the CLI's own. Rather than a second writer emitting a lossy
+ * payload under the same key, the CLI tops the server's meta up in place.
+ *
+ * Additive and idempotent: only the named keys are touched, an extra already
+ * equal to what is there is not rewritten, and a slide with no SRC_META at all
+ * is left alone. Returns true when the part changed.
+ */
+export function augmentSourceMeta(files, slidePath, extras) {
+  if (!extras || Object.keys(extras).length === 0) return false;
+  const raw = readSlideTags(files, slidePath)[TAG_SRC_META];
+  if (!raw) return false;
+  let meta;
+  try {
+    meta = JSON.parse(raw);
+  } catch {
+    return false; // not ours to repair — a corrupt payload stays corrupt
+  }
+  let changed = false;
+  for (const [key, value] of Object.entries(extras)) {
+    if (JSON.stringify(meta[key]) === JSON.stringify(value)) continue;
+    meta[key] = value;
+    changed = true;
+  }
+  return changed ? updateSlideTag(files, slidePath, TAG_SRC_META, JSON.stringify(meta)) : false;
+}
+
 // True when a slide part carries any tag key OUTSIDE the SLIDEMIND_ namespace
 // (another add-in marked it — think-cell tags every shape it owns).
 export function slideHasForeignTags(files, slidePath) {
@@ -345,6 +444,24 @@ export function bakeSlideSourceTags(files, entries) {
     const slideXml = readText(files, entry.partName);
     if (!slideXml || !slideXml.includes("</p:cSld>")) continue;
 
+    // One p:tags per customer-data list (CT_CustomerDataList): a slide that
+    // already carries one gets our tags merged into that part.
+    const sharedRef = slideXml.match(/<\/p:spTree>\s*<p:custDataLst\b[^>]*>[\s\S]*?<p:tags\b[^>]*\br:id="([^"]+)"/);
+    if (sharedRef) {
+      const slideDir = entry.partName.slice(0, entry.partName.lastIndexOf("/"));
+      const rel = relsFor(files, entry.partName).find((r) => r.id === sharedRef[1] && r.type === TAGS_REL_TYPE);
+      const sharedPart = rel ? resolvePartPath(slideDir, rel.target) : null;
+      const sharedXml = sharedPart ? readText(files, sharedPart) : null;
+      if (sharedXml && sharedXml.includes("</p:tagLst>")) {
+        const ours = Object.entries(entry.tags)
+          .map(([name, val]) => `<p:tag name="${xmlEsc(name)}" val="${xmlEsc(val)}"/>`)
+          .join("");
+        files[sharedPart] = enc(sharedXml.replace("</p:tagLst>", `${ours}</p:tagLst>`));
+        changed = true;
+        continue;
+      }
+    }
+
     const partName = `ppt/tags/tag${tagIndex}.xml`;
     files[partName] = enc(tagPartXml(entry.tags));
     if (!contentTypes.includes(`PartName="/${partName}"`)) {
@@ -448,7 +565,13 @@ const TOP_SHAPE_RE =
 const UNIT_BLOCK_KIND = "graphicFrame";
 
 // Split the spTree inner XML into top-level shape subtrees (depth-aware).
-function topLevelShapes(spTreeInner) {
+//
+// Exported for `src/pptx/package-evidence.mjs`, which needs the same units this
+// projection reports — in the same order, with the same MC-block rule — to bind
+// each one to its `p:cNvPr/@id` and its package dependencies. Re-deriving the
+// split there would be a second normalizer that WILL drift from this one. This
+// export adds no behaviour, so the cross-repo parity fixture is untouched.
+export function topLevelShapes(spTreeInner) {
   const shapes = [];
   let depth = 0;
   let start = -1;
@@ -630,9 +753,9 @@ function parseProv(files, slidePath, shapeXml) {
     if (!rel?.type.endsWith("/tags")) continue;
     const tagXml = readText(files, resolvePartPath(dir, rel.target));
     if (!tagXml) continue;
-    for (const t of tagXml.matchAll(/<p:tag\b([^>]*)\/>/g)) {
-      const name = t[1].match(/\bname="([^"]+)"/)?.[1];
-      const val = t[1].match(/\bval="([^"]*)"/)?.[1];
+    for (const t of tagElements(tagXml)) {
+      const name = tagAttr(t[1], "name");
+      const val = tagAttr(t[1], "val");
       if (name) tags[xmlUnescape(name)] = xmlUnescape(val ?? "");
     }
   }
@@ -649,6 +772,34 @@ function parseProv(files, slidePath, shapeXml) {
   return null;
 }
 
+// Every leaf shape inside a group subtree, document order (nested groups walked).
+function groupLeaves(groupXml) {
+  const inner = groupXml.slice(groupXml.indexOf(">") + 1, groupXml.lastIndexOf("</p:grpSp>"));
+  const out = [];
+  for (const child of topLevelShapes(inner)) {
+    if (child.kind === "grpSp") out.push(...groupLeaves(child.xml));
+    else out.push(child);
+  }
+  return out;
+}
+
+// A group's parts (`ProjectionShape.parts`): a card moved or recoloured INSIDE
+// a group is a manual edit the group's own box and first fill cannot show.
+// LOCKSTEP with the add-in's `slide-source-projection.ts` `groupParts`.
+function groupParts(raw) {
+  return groupLeaves(raw.xml).map((leaf) => {
+    const paint = parseFillAndLine(leaf.xml);
+    const runs = parseTextRuns(leaf.xml);
+    return {
+      kind: leaf.kind,
+      geom: parseXfrm(leaf.xml),
+      fill: paint.fill,
+      line: paint.line,
+      t: runs ? runs.map((r) => r.t).join("") : null,
+    };
+  });
+}
+
 // Structural projection of a slide in an unzipped package (the FIRST slide when
 // `slidePathOverride` is omitted — the single-slide case). Deterministic;
 // excludes every id/name/theme-resolved churn source. Groups are one entry each
@@ -675,6 +826,7 @@ export function computeProjection(files, slidePathOverride) {
       // are byte-compared); the VALUE is the one thing this mirror cannot
       // reproduce.
       chart: null,
+      ...(raw.kind === "grpSp" ? { parts: groupParts(raw) } : {}),
     });
   }
   return { v: 1, shapes };
@@ -701,9 +853,9 @@ export function computeProjection(files, slidePathOverride) {
 // or styling changed. Everything else about the slide — geometry, text, fill,
 // line, media — still compares exactly. The consumers below therefore drop the
 // field from BOTH sides before comparing, so a chart can never produce a FALSE
-// "someone edited this" refusal; the price is that a chart-ONLY edit is
-// invisible to the CLI's guard (the add-in's own drift check, which does have
-// the reader, still catches it on the next push).
+// "someone edited this" refusal. A chart-ONLY edit is invisible to that
+// comparison, so manual-edit reconcile (src/lib/reconcile.mjs) sends every
+// chart-holding slide to the add-in as its package and lets its reader decide.
 //
 // Closing it properly means giving this repo the reader as a GENERATED artifact
 // built from the add-in's TypeScript — never a hand-written copy.

package/src/update-check.mjs

@@ -19,7 +19,11 @@ import { fileURLToPath } from "node:url";
 
 import { compareCliVersions } from "./bridge/client.mjs";
 import { sessionConfigDir } from "./bridge/config.mjs";
-import { isClaudePluginInstall, updateCliInstruction } from "./install-channel.mjs";
+import {
+  globalInstallBlock,
+  isClaudePluginInstall,
+  updateCliInstruction,
+} from "./install-channel.mjs";
 
 const PACKAGE_ROOT = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
@@ -117,9 +121,15 @@ function autoUpdateEnabled(channel) {
 
 // The message, as one pure function — everything above it decides WHETHER to
 // call it, this decides WHAT it says. `auto` is what we actually kicked off.
-export function updateNotice({ current, latest, channel, auto, stalled }) {
+export function updateNotice({ current, latest, channel, auto, stalled, blocked }) {
   if (!latest || compareCliVersions(current, latest) >= 0) return null;
   const head = `slidemind ${current} is out of date — ${latest} is on npm.`;
+  // The running process can't replace the global install itself (a sandbox, or
+  // a root-owned prefix): say so and ask for escalated rights, never claim a
+  // background update that silently failed.
+  if (blocked) {
+    return `${head} ${updateCliInstruction(blocked)}`;
+  }
   if (stalled) {
     return (
       `${head} A background auto-update to ${latest} was started earlier but this ` +
@@ -207,7 +217,14 @@ export async function announceUpdate({ command, current, force = false }) {
       prior?.version === latest &&
       Date.now() - (Number(prior.at) || 0) < intervalMs();
     let auto = false;
-    if (autoUpdateEnabled(channel) && !attempted) {
+    // Will a background `npm install -g` even stick? In a Codex sandbox (and
+    // behind a root-owned prefix) it cannot: the install fails, and with the
+    // config dir unwritable too the attempt record never persists — so a doomed
+    // install would respawn on every single command while the nudge kept
+    // claiming success. Pre-flight it. When the global install is unwritable we
+    // don't spawn; the notice asks for escalated rights instead.
+    const blocked = autoUpdateEnabled(channel) ? globalInstallBlock() : null;
+    if (autoUpdateEnabled(channel) && !blocked && !attempted) {
       auto = startBackgroundUpdate(latest);
       if (auto) {
         writeCache({
@@ -222,7 +239,8 @@ export async function announceUpdate({ command, current, force = false }) {
       latest,
       channel,
       auto,
-      stalled: attempted,
+      stalled: attempted && !blocked,
+      blocked,
     });
     if (notice) process.stderr.write(`slidemind: ${notice}\n`);
   } catch {

package/src/workspace/adapters.mjs

@@ -0,0 +1,222 @@
+// Trusted workspace adapter — protocol `slidemind.workspace-adapter` v1.
+//
+// The persistent workspace shows a pack deck's plan through the pack that owns
+// it. The pack is a separate, privately installed program; this is the wire.
+// The single rule, inherited from src/lib/extensions.mjs: **the deck names an
+// adapter id, this machine's registry names what runs.** No deck file, remote
+// record or HTTP request ever supplies an executable or an argument.
+//
+// One JSON request on stdin, one JSON response on stdout, stderr is the pack's
+// diagnostics. Bounded in time (30s, 120s for a workbook operation) and in
+// output (8 MiB — read incrementally and killed past the bound, so the daemon
+// never buffers an unbounded child). A failure on the other side comes back
+// as `{ status: "error", error }`, never as an exception: the caller decides
+// what a missing pack means for THIS view, and it is not a stack trace.
+
+import { spawn } from "node:child_process";
+import path from "node:path";
+
+import { readRegistry } from "../lib/extensions.mjs";
+
+export const PROTOCOL = "slidemind.workspace-adapter";
+export const PROTOCOL_VERSION = 1;
+export const METHODS = ["describe", "read", "render", "save-local", "import-workbook", "validate", "approve", "apply-remote"];
+export const STATUSES = ["ok", "blocked", "error"];
+
+export const DEFAULT_TIMEOUT_MS = 30_000;
+export const WORKBOOK_TIMEOUT_MS = 120_000;
+export const MAX_OUTPUT_BYTES = 8 * 1024 * 1024;
+const MAX_STDERR_BYTES = 64 * 1024;
+// How long after the process exited we still wait for its pipes to reach EOF
+// before answering anyway. Real drain is immediate; only a leaked helper holding
+// the adapter's stdout takes the whole grace.
+const EXIT_GRACE_MS = 250;
+
+const error = (code, message, { retryable = false, details } = {}) => ({
+  status: "error",
+  data: null,
+  error: { code, message, retryable, ...(details ? { details } : {}) },
+});
+
+/**
+ * Which installed adapter serves an id. `{ id, entry }` when usable —
+ * `entry.workspace.command` is the argv — or `{ id, blocker }` with the
+ * remedy spelled out: `extension_missing` (install it) vs
+ * `extension_incompatible` (the installed copy predates the workspace, or
+ * speaks another protocol version).
+ */
+export function resolveWorkspaceAdapter(id, registry = readRegistry(), { protocolVersion = PROTOCOL_VERSION } = {}) {
+  if (typeof id !== "string" || !id) {
+    return { id: null, blocker: { code: "extension_incompatible", message: "no adapter id", actor: "user" } };
+  }
+  const entry = registry.extensions[id];
+  if (!entry) {
+    return {
+      id,
+      blocker: {
+        code: "extension_missing",
+        message: `this deck's plan is owned by the '${id}' pack, which is not installed on this machine. Install it to edit the plan here; the deck's files are untouched.`,
+        actor: "user",
+      },
+    };
+  }
+  if (!entry.workspace) {
+    return {
+      id,
+      blocker: {
+        code: "extension_incompatible",
+        message: `the installed '${id}' pack has no workspace adapter. Update it to a version that registers one.`,
+        actor: "user",
+      },
+    };
+  }
+  if (!entry.workspace.protocolVersions.includes(protocolVersion)) {
+    return {
+      id,
+      blocker: {
+        code: "extension_incompatible",
+        message: `the workspace speaks '${id}' adapter protocol v${protocolVersion}; the installed copy speaks v${entry.workspace.protocolVersions.join(", v")}. Update one of them.`,
+        actor: "user",
+      },
+    };
+  }
+  return { id, entry };
+}
+
+export function buildRequest({ method, deckRoot, payload = {}, operationId = null }) {
+  return { protocol: PROTOCOL, version: PROTOCOL_VERSION, operationId, method, deckRoot, payload };
+}
+
+/**
+ * Run one adapter method. Resolves to `{ status, data, error }`; rejects only
+ * for a programming error (unknown method, entry without a workspace command).
+ *
+ * `ownerToken` is the deck lock token of the operation this call executes
+ * inside (src/workspace/operations.mjs) — it goes to the child as
+ * `SLIDEMIND_OWNER` and nowhere else. Without one the child gets NO token, not
+ * the daemon's inherited environment. `SLIDEMIND_WORKSPACE_ADAPTER=1` marks
+ * the child so the pack can refuse to call back into the daemon.
+ */
+export function dispatchAdapter(entry, { method, deckRoot, payload = {}, operationId = null, ownerToken = null, timeoutMs = null } = {}) {
+  if (!METHODS.includes(method)) throw new Error(`unknown workspace adapter method: ${method}`);
+  const argv = entry?.workspace?.command;
+  if (!Array.isArray(argv) || argv.length === 0) throw new Error("adapter entry has no workspace command");
+  if (typeof deckRoot !== "string" || !path.isAbsolute(deckRoot)) {
+    return Promise.resolve(error("validation_failed", "deckRoot must be an absolute local path"));
+  }
+  const timeout = timeoutMs ?? (method === "import-workbook" ? WORKBOOK_TIMEOUT_MS : DEFAULT_TIMEOUT_MS);
+  const request = buildRequest({ method, deckRoot, payload, operationId });
+
+  const env = { ...process.env, SLIDEMIND_WORKSPACE_ADAPTER: "1" };
+  delete env.SLIDEMIND_OWNER;
+  if (ownerToken) env.SLIDEMIND_OWNER = ownerToken;
+
+  return new Promise((resolve) => {
+    let child;
+    try {
+      child = spawn(argv[0], argv.slice(1), { env, shell: false, stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
+    } catch (err) {
+      resolve(error("extension_incompatible", `the adapter could not be started (${err.code ?? err.message})`));
+      return;
+    }
+    const out = [];
+    let outBytes = 0;
+    let err = "";
+    let settled = false;
+    let why = null; // "timeout" | "oversize" once we killed it
+    let exitGrace = null;
+    const finish = (value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      clearTimeout(exitGrace);
+      resolve(value);
+    };
+    const kill = (reason) => {
+      why = reason;
+      child.kill("SIGKILL");
+    };
+    const timer = setTimeout(() => kill("timeout"), timeout);
+
+    child.on("error", (e) =>
+      finish(error("extension_incompatible", `the adapter could not be run (${e.code ?? e.message})`)),
+    );
+    child.stdout.on("data", (chunk) => {
+      outBytes += chunk.length;
+      if (outBytes > MAX_OUTPUT_BYTES) {
+        out.length = 0;
+        kill("oversize");
+        return;
+      }
+      out.push(chunk);
+    });
+    child.stderr.on("data", (chunk) => {
+      if (err.length < MAX_STDERR_BYTES) err += chunk.toString("utf8");
+    });
+    const done = (code, signal) => {
+      const lastLine = err.trim().split("\n").filter(Boolean).slice(-1)[0] ?? "";
+      if (why === "timeout") {
+        finish(error("extension_incompatible", `the adapter did not answer ${method} within ${timeout} ms`, { retryable: true }));
+        return;
+      }
+      if (why === "oversize") {
+        finish(error("extension_incompatible", `the adapter's ${method} answer exceeded ${MAX_OUTPUT_BYTES} bytes`));
+        return;
+      }
+      if (code !== 0) {
+        finish(error("extension_incompatible", `the adapter exited ${code ?? signal}${lastLine ? `: ${lastLine}` : ""}`));
+        return;
+      }
+      finish(parseResponse(Buffer.concat(out).toString("utf8"), method));
+    };
+    child.on("close", done);
+    // `close` needs stdio EOF, which never arrives when the adapter left a helper
+    // holding its stdout open — not even after SIGKILL, since the pipe belongs to
+    // the helper. This promise would then never settle, so `runDeckOperation` would
+    // never release the deck's busy.json and every later save, task and sync on that
+    // deck would answer `deck_busy` until the daemon restarts. The process itself is
+    // gone here: give the pipes a moment to drain, then answer with what arrived.
+    child.on("exit", (code, signal) => {
+      if (settled || exitGrace) return;
+      exitGrace = setTimeout(() => done(code, signal), EXIT_GRACE_MS);
+      exitGrace.unref?.();
+    });
+    child.stdin.on("error", () => {}); // child gone before it read: `close` reports it
+    child.stdin.end(JSON.stringify(request));
+  });
+}
+
+/** One JSON object, a known status, data as an object, version 1 when stated. */
+export function parseResponse(text, method) {
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return error("extension_incompatible", `the adapter did not answer ${method} with JSON`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    return error("extension_incompatible", `the adapter's ${method} answer is not an object`);
+  }
+  if (parsed.version !== undefined && parsed.version !== PROTOCOL_VERSION) {
+    return error("extension_incompatible", `the adapter answered with protocol version ${parsed.version}; this workspace speaks v${PROTOCOL_VERSION}`);
+  }
+  if (parsed.protocol !== undefined && parsed.protocol !== PROTOCOL) {
+    return error("extension_incompatible", `the adapter answered protocol '${parsed.protocol}'`);
+  }
+  if (!STATUSES.includes(parsed.status)) {
+    return error("extension_incompatible", `the adapter's ${method} status '${parsed.status}' is not ok/blocked/error`);
+  }
+  const data = parsed.data && typeof parsed.data === "object" ? parsed.data : null;
+  if (parsed.status === "ok") return { status: "ok", data, error: null };
+  const e = parsed.error && typeof parsed.error === "object" ? parsed.error : {};
+  return {
+    status: parsed.status,
+    data,
+    error: {
+      code: typeof e.code === "string" ? e.code : parsed.status === "blocked" ? "blocked" : "adapter_error",
+      message: typeof e.message === "string" ? e.message : `${method} did not pass`,
+      retryable: e.retryable === true,
+      ...(e.details !== undefined ? { details: e.details } : {}),
+    },
+  };
+}