talos-code 0.0.1 → 0.2.0

package/dist/provider/model-catalog.js

@@ -0,0 +1,168 @@
+import { REASONING_EFFORTS } from "../config/types.js";
+const SOURCE_RANK = Object.freeze({
+    unknown: 0, documented: 1, configured: 2, live: 3,
+});
+const CAPABILITY_RANK = Object.freeze({
+    unknown: 0, configured: 1, documented: 2, live: 3,
+});
+export function catalogSourceFromKernel(source, { successfulCatalogBoundary = false } = {}) {
+    const value = String(source ?? '').trim().toLowerCase().replace(/[_ ]+/gu, '-');
+    if (['config', 'configured', 'configurazione'].includes(value))
+        return 'configured';
+    if (['documented', 'documentation', 'documentazione', 'riserva', 'fallback'].includes(value))
+        return 'documented';
+    if (['live', 'fornitore', 'provider', 'remote', 'runtime', 'runtime-locale'].includes(value))
+        return 'live';
+    if (!value && successfulCatalogBoundary)
+        return 'live';
+    return 'unknown';
+}
+function effortsFrom(...values) {
+    let observed = false;
+    const out = [];
+    for (const value of values) {
+        if (!Array.isArray(value))
+            continue;
+        observed = true;
+        for (const item of value) {
+            if (typeof item !== 'string' || !REASONING_EFFORTS.includes(item))
+                continue;
+            const effort = item;
+            if (!out.includes(effort))
+                out.push(effort);
+        }
+    }
+    return observed ? out : null;
+}
+function evidenceMeta(row) {
+    const url = [row?.fonteMetadati, row?.fonteDichiarazione, row?.metadataSource, row?.declarationSource, row?.fonte]
+        .find(value => typeof value === 'string' && /^(?:https?:\/\/|urn:)/u.test(value)) ?? null;
+    const date = [row?.dataMetadati, row?.dataDichiarazione, row?.metadataDate, row?.declarationDate, row?.data]
+        .find(value => typeof value === 'string' && value.trim() !== '') ?? null;
+    return { url, date };
+}
+function evidence(value, source, meta = { url: null, date: null }) {
+    if (value === null)
+        return { value: null, source: 'unknown', evidenceUrl: null, evidenceDate: null };
+    return { value, source, evidenceUrl: meta.url, evidenceDate: meta.date };
+}
+function documentedCapabilitySource(row, rowSource, kind) {
+    if (rowSource === 'documented')
+        return 'documented';
+    const hasDocumentedMeta = typeof row?.fonteMetadati === 'string' || typeof row?.fonteDichiarazione === 'string'
+        || typeof row?.dataMetadati === 'string' || typeof row?.dataDichiarazione === 'string';
+    return hasDocumentedMeta && (kind === 'context' || kind === 'reasoning') ? 'documented' : rowSource;
+}
+export function normalizeModelRows(rows, provider, source) {
+    const seen = new Set();
+    const out = [];
+    for (const row of rows) {
+        const raw = String(row?.id ?? row?.modelId ?? row?.model ?? '').trim();
+        if (!raw)
+            continue;
+        const id = raw.startsWith(`${provider}:`) ? raw : `${provider}:${raw}`;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        const explicitSource = catalogSourceFromKernel(row?.fonte);
+        const rowSource = explicitSource === 'unknown' ? source : explicitSource;
+        const caps = row?.capacita ?? row?.capabilities ?? {};
+        const supportedParameters = Array.isArray(row?.supported_parameters) ? row.supported_parameters : Array.isArray(row?.supportedParameters) ? row.supportedParameters : null;
+        const supportedParameterSet = supportedParameters ? new Set(supportedParameters.filter((value) => typeof value === 'string').map((value) => value.toLowerCase())) : null;
+        const ownReasoning = row?.reasoning && typeof row.reasoning === 'object' && !Array.isArray(row.reasoning) ? row.reasoning : null;
+        const capReasoning = caps?.reasoning && typeof caps.reasoning === 'object' && !Array.isArray(caps.reasoning) ? caps.reasoning : null;
+        const reasoningEfforts = effortsFrom(row?.reasoningEfforts, row?.livelliRagionamento, row?.ragionamento?.livelli, ownReasoning?.supportedEfforts, ownReasoning?.supported_efforts, ownReasoning?.allowed_options, capReasoning?.supportedEfforts, capReasoning?.supported_efforts, capReasoning?.allowed_options, caps?.ragionamento?.livelli);
+        const structuredReasoning = Boolean(ownReasoning || capReasoning || row?.ragionamento && typeof row.ragionamento === 'object' || caps?.ragionamento && typeof caps.ragionamento === 'object');
+        const reasoning = typeof row?.reasoning === 'boolean' ? row.reasoning
+            : typeof row?.supportsReasoning === 'boolean' ? row.supportsReasoning
+                : typeof caps?.reasoning === 'boolean' ? caps.reasoning
+                    : structuredReasoning || reasoningEfforts !== null || supportedParameterSet?.has('reasoning') === true || supportedParameterSet?.has('include_reasoning') === true ? true : null;
+        const contextWindow = Number.isFinite(row?.contextLength) ? Number(row.contextLength)
+            : Number.isFinite(row?.contextWindow) ? Number(row.contextWindow)
+                : Number.isFinite(row?.finestraContesto) ? Number(row.finestraContesto)
+                    : Number.isFinite(row?.context_length) ? Number(row.context_length) : null;
+        const toolCalling = typeof row?.toolCalling === 'boolean' ? row.toolCalling
+            : typeof row?.supportsTools === 'boolean' ? row.supportsTools
+                : typeof caps?.toolCall === 'boolean' ? caps.toolCall
+                    : typeof caps?.tools === 'boolean' ? caps.tools
+                        : supportedParameterSet?.has('tools') || supportedParameterSet?.has('tool_choice') ? true : null;
+        const explicitModalities = Array.isArray(row?.inputModalities) ? row.inputModalities
+            : Array.isArray(row?.input_modalities) ? row.input_modalities
+                : Array.isArray(row?.architecture?.input_modalities) ? row.architecture.input_modalities
+                    : Array.isArray(row?.architecture?.inputModalities) ? row.architecture.inputModalities : null;
+        const images = explicitModalities ? explicitModalities.includes('image')
+            : typeof row?.images === 'boolean' ? row.images
+                : typeof caps?.images === 'boolean' ? caps.images
+                    : typeof caps?.imageInput === 'boolean' ? caps.imageInput : null;
+        const meta = evidenceMeta(row);
+        const contextSource = documentedCapabilitySource(row, rowSource, 'context');
+        const reasoningSource = documentedCapabilitySource(row, rowSource, 'reasoning');
+        const capabilityEvidence = {
+            contextWindow: evidence(contextWindow, contextSource, contextSource === 'documented' ? meta : { url: null, date: null }),
+            toolCalling: evidence(toolCalling, rowSource, rowSource === 'documented' ? meta : { url: null, date: null }),
+            reasoning: evidence(reasoning, reasoningSource, reasoningSource === 'documented' ? meta : { url: null, date: null }),
+            reasoningEfforts: evidence(reasoningEfforts, reasoningSource, reasoningSource === 'documented' ? meta : { url: null, date: null }),
+            images: evidence(images, rowSource, rowSource === 'documented' ? meta : { url: null, date: null }),
+        };
+        out.push({
+            id, provider, name: String(row?.nome ?? row?.name ?? raw),
+            source: rowSource, available: rowSource, availabilityVerified: rowSource === 'live',
+            contextWindow, toolCalling, reasoning, reasoningEfforts, images,
+            capabilityEvidence,
+        });
+    }
+    return out;
+}
+function preferredCapability(left, right) {
+    if (left.value === null)
+        return right;
+    if (right.value === null)
+        return left;
+    return CAPABILITY_RANK[right.source] > CAPABILITY_RANK[left.source] ? right : left;
+}
+function withFlatCapabilities(row) {
+    const evidence = row.capabilityEvidence;
+    const reasoningEfforts = evidence.reasoningEfforts.value;
+    const reasoning = evidence.reasoning.value ?? (reasoningEfforts !== null ? true : null);
+    return {
+        ...row,
+        contextWindow: evidence.contextWindow.value,
+        toolCalling: evidence.toolCalling.value,
+        reasoning,
+        reasoningEfforts,
+        images: evidence.images.value,
+    };
+}
+function mergeTwo(left, right) {
+    const preferred = SOURCE_RANK[right.source] > SOURCE_RANK[left.source] ? right : left;
+    const capabilityEvidence = {
+        contextWindow: preferredCapability(left.capabilityEvidence.contextWindow, right.capabilityEvidence.contextWindow),
+        toolCalling: preferredCapability(left.capabilityEvidence.toolCalling, right.capabilityEvidence.toolCalling),
+        reasoning: preferredCapability(left.capabilityEvidence.reasoning, right.capabilityEvidence.reasoning),
+        reasoningEfforts: preferredCapability(left.capabilityEvidence.reasoningEfforts, right.capabilityEvidence.reasoningEfforts),
+        images: preferredCapability(left.capabilityEvidence.images, right.capabilityEvidence.images),
+    };
+    return withFlatCapabilities({
+        id: left.id,
+        provider: left.provider,
+        name: preferred.name,
+        source: preferred.source,
+        available: preferred.source,
+        availabilityVerified: preferred.source === 'live',
+        capabilityEvidence,
+    });
+}
+export function mergeModelRows(...rows) {
+    const byId = new Map();
+    const order = [];
+    for (const row of rows) {
+        const previous = byId.get(row.id);
+        if (!previous) {
+            byId.set(row.id, row);
+            order.push(row.id);
+            continue;
+        }
+        byId.set(row.id, mergeTwo(previous, row));
+    }
+    return order.map(id => byId.get(id));
+}

package/dist/provider/openrouter-login.js

@@ -0,0 +1,172 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+/*
+ * P21 (owner, 2026-09-26: "la possibilità di fare accesso oauth con Open Router, come fa l'applicazione desktop"; decisions
+ * the same day): sign in to OpenRouter from the CLI without pasting a key. The end of the flow is a plain OpenRouter API key,
+ * stored like a pasted one.
+ *
+ * The PKCE arithmetic is the desktop's own (`harness-ui/src/openrouter-oauth.mjs`, researched 2026-09-10 on OpenRouter's
+ * OAuth PKCE docs and RFC 7636): S256 always, the verifier never leaves this process, a single-use code that OpenRouter lets
+ * live 10 minutes, `state` carried in the callback PATH because OpenRouter documents no `state`, and error codes without
+ * response bodies. This file adds what a CLI needs, read on 2026-09-26:
+ * - a one-shot loopback server on 127.0.0.1 and a port the system picks, open only while the sign-in lasts (RFC 8252 §7.3,
+ *   §8.3: the IP literal, not `localhost`; listen on loopback only; close the port once the answer is in); the system browser,
+ *   never an embedded one (§8.12). Pi (`packages/ai/src/auth/oauth/openrouter.ts`) and Hermes (`hermes_cli/auth_openrouter.py`)
+ *   do the same, Codex for its own sign-in (`codex-rs/login/src/server.rs`);
+ * - a code pasted by hand, raced against the browser (Pi): the code alone or the whole address the browser landed on;
+ * - a remote session (SSH) goes to OpenRouter's no-callback mode at once, where the page SHOWS the code (Hermes).
+ */
+import { spawn } from 'node:child_process';
+import { createServer } from 'node:http';
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+/** The desktop's PKCE module, from the checkout or from the package's own copy of the kernel (`vendor/harness-ui`). */
+export async function loadOpenRouterOAuth(repoRoot) {
+    return await import(__rewriteRelativeImportExtension(pathToFileURL(join(repoRoot, 'harness-ui', 'src', 'openrouter-oauth.mjs')).href));
+}
+/** What OpenRouter writes beside the key on the person's key page, so they can tell which program asked and revoke it. */
+export const LOGIN_LABEL = 'TALOS CLI';
+/** OpenRouter's code lives 10 minutes ("The code is single-use and expires after 10 minutes"); the wait is the same. */
+export const LOGIN_TIMEOUT_MS = 10 * 60 * 1000;
+const EXCHANGE_TIMEOUT_MS = 30_000;
+export function isRemoteSession(env = process.env) {
+    return Boolean(env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY);
+}
+/** The code in what the person pasted: the code itself, or the address (or query) the browser landed on. */
+export function codeFromInput(input) {
+    const value = String(input ?? '').trim();
+    if (!value)
+        return null;
+    try {
+        const url = new URL(value);
+        return url.searchParams.get('code') || null;
+    }
+    catch { /* not an address */ }
+    if (value.includes('code=')) {
+        const code = new URLSearchParams(value.replace(/^[^?]*\?/u, '')).get('code');
+        return code || null;
+    }
+    return /\s/u.test(value) ? null : value;
+}
+/**
+ * Opens the address in the system browser, without a shell (on Windows `&` in an address would split a `cmd` line).
+ * A test profile never opens a window: the address is only shown.
+ */
+export function openInBrowser(url, { env = process.env, platform = process.platform, spawnImpl = spawn } = {}) {
+    if (env.TALOS_TEST_PROFILE === '1')
+        return false;
+    if (!/^https:\/\//u.test(url))
+        return false;
+    const [command, args] = platform === 'win32' ? ['rundll32', ['url.dll,FileProtocolHandler', url]] : platform === 'darwin' ? ['open', [url]] : ['xdg-open', [url]];
+    try {
+        const child = spawnImpl(command, args, { detached: true, stdio: 'ignore', windowsHide: true });
+        child.on('error', () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export class OpenRouterLoginError extends Error {
+    code;
+    status;
+    constructor(code, message, status = null) { super(message); this.name = 'OpenRouterLoginError'; this.code = code; this.status = status; }
+}
+const failure = (error) => error instanceof OpenRouterLoginError ? error : new OpenRouterLoginError(String(error?.code ?? 'OAUTH_FAILED'), 'The sign-in did not complete.', typeof error?.stato === 'number' ? error.stato : null);
+const PAGE = (title) => `<!doctype html><html lang="en"><head><meta charset="utf-8"><title>TALOS</title></head><body style="font-family:sans-serif;margin:3em"><h1>${title}</h1></body></html>`;
+export async function startOpenRouterLogin({ oauth, env = process.env, paste = false, open = openInBrowser, fetchImpl = globalThis.fetch, timeoutMs = LOGIN_TIMEOUT_MS, label = LOGIN_LABEL }) {
+    const { verifier, challenge } = oauth.creaCoppiaPkce();
+    const state = oauth.creaStato();
+    const byHand = paste || isRemoteSession(env);
+    let settled = false, claimed = false, server = null, timer = null;
+    let resolveKey = () => { };
+    let rejectKey = () => { };
+    const key = new Promise((resolve, reject) => { resolveKey = resolve; rejectKey = reject; });
+    key.catch(() => { });
+    /* The port stops taking requests as soon as the sign-in is decided (RFC 8252 §8.3); the page the browser is waiting for is
+       still sent (a forced close there showed the person a broken connection instead of "Signed in"). Only a cancel or a
+       timeout drops the open connections too. */
+    const close = (force) => { if (timer) {
+        clearTimeout(timer);
+        timer = null;
+    } if (server) {
+        server.close();
+        if (force)
+            server.closeAllConnections?.();
+        server = null;
+    } };
+    const finish = (outcome, force = false) => { if (settled)
+        return; settled = true; close(force); if ('key' in outcome)
+        resolveKey(outcome.key);
+    else
+        rejectKey(outcome.error); };
+    const fetchDiRete = ((input, init) => fetchImpl(input, { ...init, signal: AbortSignal.timeout(EXCHANGE_TIMEOUT_MS) }));
+    const exchange = async (code) => {
+        claimed = true;
+        try {
+            const { chiave } = await oauth.scambiaCodicePerChiave({ codice: code, verifier, fetchDiRete });
+            finish({ key: chiave });
+        }
+        catch (error) {
+            finish({ error: failure(error) });
+        }
+        return key;
+    };
+    let callbackUrl = null;
+    if (!byHand) {
+        const path = `/openrouter/callback/${encodeURIComponent(state)}`;
+        server = createServer((request, response) => {
+            const send = (status, title) => { response.statusCode = status; response.setHeader('content-type', 'text/html; charset=utf-8'); response.setHeader('cache-control', 'no-store'); response.setHeader('connection', 'close'); response.end(PAGE(title)); };
+            const requestUrl = new URL(request.url ?? '/', 'http://127.0.0.1');
+            if (request.method !== 'GET' || requestUrl.pathname !== path) {
+                send(404, 'Not found.');
+                return;
+            }
+            if (claimed || settled) {
+                send(409, 'This sign-in has already been used.');
+                return;
+            }
+            if (requestUrl.searchParams.get('error')) {
+                send(400, 'OpenRouter sign-in was cancelled. You can close this page.');
+                finish({ error: new OpenRouterLoginError('OAUTH_DENIED', 'OpenRouter sign-in was cancelled in the browser.') });
+                return;
+            }
+            const code = requestUrl.searchParams.get('code');
+            if (!code) {
+                send(400, 'OpenRouter returned no code.');
+                return;
+            }
+            void exchange(code).then(() => send(200, 'Signed in to OpenRouter. You can close this page and go back to TALOS.'), () => send(502, 'The sign-in did not complete. Go back to TALOS.'));
+        });
+        await new Promise((resolve, reject) => { server.once('error', reject); server.listen(0, '127.0.0.1', () => { server.removeListener('error', reject); resolve(); }); });
+        const address = server.address();
+        if (!address || typeof address === 'string') {
+            close(true);
+            throw new OpenRouterLoginError('OAUTH_CALLBACK_UNAVAILABLE', 'TALOS could not listen for OpenRouter on this machine.');
+        }
+        callbackUrl = `http://127.0.0.1:${address.port}${path}`;
+    }
+    const url = oauth.indirizzoDiAutorizzazione({ challenge, callbackUrl, etichetta: label });
+    timer = setTimeout(() => finish({ error: new OpenRouterLoginError('OAUTH_TIMEOUT', 'The sign-in took longer than 10 minutes.') }, true), timeoutMs);
+    timer.unref?.();
+    const opened = byHand ? false : open(url);
+    return {
+        url, mode: byHand ? 'paste' : 'browser', opened, key,
+        async submit(input) {
+            if (settled || claimed)
+                return key;
+            const code = codeFromInput(input);
+            if (!code)
+                throw new OpenRouterLoginError('OAUTH_CODE_MISSING', 'That is not a code from OpenRouter.');
+            return exchange(code);
+        },
+        cancel() { finish({ error: new OpenRouterLoginError('OAUTH_CANCELLED', 'The sign-in was cancelled.') }, true); },
+    };
+}

package/dist/provider/provider-text.js

@@ -0,0 +1,13 @@
+/*
+ * R2 (D-05, gate E1/E4): the one place a provider's label and description reach the screen or `talos provider list`. Mapped
+ * by provider ID, never by the kernel's words; the kernel registry (and what the model or the kernel receives) is untouched.
+ */
+import { en, t } from "../i18n/index.js";
+function entry(id, field) {
+    const key = `provider.${id}.${field}`;
+    return Object.hasOwn(en, key) ? t(key) : null;
+}
+/** The English label for provider `id`, or `fallback` (the registry text) when the registry label is already English. */
+export function providerLabelText(id, fallback) { return entry(id, 'label') ?? fallback; }
+/** The English description for provider `id`, or `fallback` (the registry text). */
+export function providerDescriptionText(id, fallback) { return entry(id, 'description') ?? fallback; }

package/dist/provider/store.js

@@ -0,0 +1,95 @@
+import { loadTalosSystemKeyring, systemKeyringAdapter } from "./system-keyring.js";
+import { t } from "../i18n/index.js";
+import { CliRuntimeError } from "../runtime/types.js";
+import { CREDENTIAL_STORES } from "../config/types.js";
+const SERVICE = 'talos-cli-provider';
+function cleanKey(v) { const x = v.trim(); if (!x || x.length > 4096 || /[\r\n\0]/u.test(x))
+    throw new Error('PROVIDER_KEY_INVALID'); return x; }
+export function createCliProviderStore({ env, keyring, definitions }) {
+    const def = (id) => { const d = definitions[id]; if (!d)
+        throw new Error('PROVIDER_INVALID'); return d; };
+    const envKey = (id) => { for (const n of def(id).env) {
+        const v = env[n];
+        if (v?.trim())
+            return cleanKey(v);
+    } return null; };
+    return {
+        async getKey(id) { const e = envKey(id); if (e)
+            return e; const v = await keyring.get(SERVICE, id); return v ? cleanKey(v) : null; },
+        async setKey(id, value) { def(id); await keyring.set(SERVICE, id, cleanKey(value)); },
+        async removeKey(id) { def(id); await keyring.remove(SERVICE, id); },
+        async listPublic() { const rows = []; for (const [id, d] of Object.entries(definitions)) {
+            rows.push({ id, label: d.label ?? id, requiresKey: d.requiresKey, configured: d.requiresKey ? Boolean(await this.getKey(id)) : true });
+        } return rows; },
+    };
+}
+export const CREDENTIAL_STORE_VARIABLE = 'TALOS_CREDENTIAL_STORE';
+export const TEST_PROFILE_VARIABLE = 'TALOS_TEST_PROFILE';
+export function isTestProfile(env) {
+    return env[TEST_PROFILE_VARIABLE] === '1' || (typeof env.NODE_TEST_CONTEXT === 'string' && env.NODE_TEST_CONTEXT !== '');
+}
+export function chooseCredentialStore({ env, config, ownLoader = false }) {
+    const testProfile = isTestProfile(env);
+    const raw = env[CREDENTIAL_STORE_VARIABLE];
+    if (typeof raw === 'string' && raw.trim() !== '') {
+        const kind = raw.trim().toLowerCase();
+        if (!CREDENTIAL_STORES.includes(kind))
+            throw new CliRuntimeError('CREDENTIAL_STORE_INVALID', t('store.invalid', { value: raw.trim(), variable: CREDENTIAL_STORE_VARIABLE }), { variable: CREDENTIAL_STORE_VARIABLE });
+        return { kind: kind, source: 'environment', testProfile };
+    }
+    const configured = config?.credentials?.store;
+    if (configured === 'system' || configured === 'memory')
+        return { kind: configured, source: 'config', testProfile };
+    return testProfile && !ownLoader ? { kind: 'memory', source: 'test-profile', testProfile } : { kind: 'system', source: 'default', testProfile };
+}
+/** The name `doctor` and the refusal give the store: the OS store's own name on this platform. */
+export function credentialStoreName(kind, platform = process.platform) {
+    if (kind === 'memory')
+        return t('store.name.memory');
+    return t(platform === 'win32' ? 'store.name.system.win32' : platform === 'darwin' ? 'store.name.system.darwin' : 'store.name.system.other');
+}
+export function credentialStoreSourceText(choice) {
+    return choice.source === 'environment' ? t('store.source.environment', { variable: CREDENTIAL_STORE_VARIABLE })
+        : choice.source === 'config' ? t('store.source.config') : choice.source === 'test-profile' ? t('store.source.testProfile') : t('store.source.default');
+}
+/* Per profile (Codex keys its ephemeral store by `compute_store_key(codex_home)`): a runtime rebuilt in the same process (the
+   supervisor's restart) still sees a key saved a minute ago, and two profiles in one test process do not share keys. */
+const MEMORY_STORES = new Map();
+export function createMemoryKeyring(scope) {
+    let values = MEMORY_STORES.get(scope);
+    if (!values) {
+        values = new Map();
+        MEMORY_STORES.set(scope, values);
+    }
+    const map = values;
+    const key = (service, account) => `${service}\u0000${account}`;
+    return { get: (service, account) => map.get(key(service, account)) ?? null, set: (service, account, value) => { map.set(key(service, account), value); }, remove: (service, account) => { map.delete(key(service, account)); } };
+}
+let active = null;
+/** The store the last resolution in this process chose (for the sentences that name it), or null before any. */
+export function activeCredentialStore() { return active; }
+/** What `/provider` says after a key passed its test and was saved: where it now lives. */
+export function keySavedText() { return t(active?.kind === 'memory' ? 'store.saved.memory' : 'store.saved.system'); }
+/**
+ * Resolves and opens the store. `scope` separates memory stores (the profile's data root). Throws `CREDENTIAL_STORE_INVALID` or
+ * `CREDENTIAL_STORE_REAL_IN_TEST`; a system store that cannot be loaded is `keyring: null` with its `problem`, as before R2.
+ */
+export function openCredentialStore({ repoRoot, scope, env = process.env, config, loader }) {
+    const ownLoader = typeof loader?.load === 'function';
+    const choice = chooseCredentialStore({ env, config: config ?? null, ownLoader });
+    if (choice.kind === 'system' && choice.testProfile && !ownLoader) {
+        throw new CliRuntimeError('CREDENTIAL_STORE_REAL_IN_TEST', t('store.refusedInTest', { store: credentialStoreName('system'), variable: CREDENTIAL_STORE_VARIABLE }), { store: 'system', source: choice.source });
+    }
+    active = choice;
+    if (choice.kind === 'memory')
+        return { ...choice, keyring: createMemoryKeyring(scope), problem: null };
+    const loaded = loadTalosSystemKeyring(repoRoot, loader ?? {});
+    return loaded.ok ? { ...choice, keyring: systemKeyringAdapter(loaded.Entry), problem: null } : { ...choice, keyring: null, problem: loaded };
+}
+/** R2 (E13): through the resolver, so a test profile never reaches the OS store from here either. */
+export async function createSystemKeyring(repoRoot, { scope = repoRoot, env = process.env, config } = {}) {
+    const opened = openCredentialStore({ repoRoot, scope, env, config: config ?? null });
+    if (!opened.keyring)
+        throw new Error('PROVIDER_STORE_UNAVAILABLE');
+    return opened.keyring;
+}