@juspay/neurolink 12.44.5 → 12.44.7

package/dist/cli/commands/proxy.js

@@ -9,7 +9,7 @@ import chalk from "chalk";
 import ora from "ora";
 import { buildProxyHealthResponse, createProxyReadinessState, markProxyDrainingForUpdate, markProxyReady, resumeProxyConnections, waitForProxyReadiness, } from "../../proxy/proxyHealth.js";
 import { logger } from "../../utils/logger.js";
-import { applyAllClients, restoreAllClients, } from "../proxy-clients/registry.js";
+import { applyAllClients, applyClientsOnProxyStart, restoreAllClients, } from "../proxy-clients/registry.js";
 import { resolveProxyConfigPath } from "../../proxy/proxyConfig.js";
 import { redactUrlsInText, sanitizeForLog, } from "../../utils/logSanitize.js";
 import { raceWithAbort, withTimeout, } from "../../utils/async/withTimeout.js";
@@ -23,7 +23,7 @@ import { anthropicAccountKeysEqual, createAccountAllowlist, isAccountAllowed, LE
 import { resolveProxyStatusAccountIdentity } from "../../proxy/codexAccountUsage.js";
 import { beginProxyRequest, consumeInternalProxyRequest, releaseProxyRequestAccounting, withProxyFinalLogOwnership, getProxyActivitySnapshot, observeProxyFinalLog, takeProxyResponseObservers, trackProxyResponse, } from "../../proxy/proxyActivity.js";
 import { configureProxyLifecycleLogger, flushProxyLifecycleEvents, persistProxyLifecycleAcceptance, getProxyLifecycleLoggerSnapshot, hashProxyLifecycleSessionId, logProxyLifecycleEvent, } from "../../proxy/proxyLifecycle.js";
-import { describeInstallFailure, assertProxyServiceInstallIdle, probeProxyLaunchdPresence, inspectProxyPackage, isProxyServiceEnvironmentKey, parseProxyServiceInstallSettings, installStagedProxyPackage, readProxyPackageSelection, resolveProxyWorkerPackage, selectProxyPackage, writeProxyPackageLauncher, isTransientInstallFailure, resolveGlobalInstaller, validateInstalledVersion, } from "../../proxy/globalInstaller.js";
+import { describeInstallFailure, assertProxyServiceInstallIdle, probeProxyLaunchdPresence, inspectProxyPackage, isProxyServiceEnvironmentKey, parseProxyServiceInstallSettings, installStagedProxyPackage, prepareProxyPackageUpgrade, readProxyPackageSelection, resolveProxyWorkerPackage, selectProxyPackage, writeProxyPackageLauncher, isTransientInstallFailure, resolveGlobalInstaller, validateInstalledVersion, } from "../../proxy/globalInstaller.js";
 import { startUpdaterWorkerSupervisor } from "../../proxy/updaterSupervisor.js";
 import { openProxyWorkerLog } from "../../proxy/workerLog.js";
 import { startRollingProxyServer } from "../../proxy/rollingProxyServer.js";
@@ -2933,9 +2933,7 @@ async function startProxyRuntime(params) {
         logger.always(`  ${chalk.bold("Env File:")}   ${chalk.cyan(params.loadedEnvFile)}`);
     }
     if (!isDev) {
-        for (const result of await applyAllClients(url, {
-            configPath: params.configPath,
-        })) {
+        for (const result of await applyClientsOnProxyStart(url, { configPath: params.configPath }, managedByLaunchd)) {
             if (result.error) {
                 // Visible, not debug-level. A client whose config could not be written
                 // will keep talking to its own upstream, which looks like the proxy
@@ -2956,6 +2954,9 @@ async function startProxyRuntime(params) {
                 logger.always(chalk.dim(`    Restart ${result.displayName} to connect through proxy`));
             }
         }
+        if (managedByLaunchd) {
+            logger.always("  Service startup preserves client settings; use 'neurolink proxy setup' to change client routing.");
+        }
     }
     else {
         logger.always(chalk.dim("  ⊘ Dev mode: skipping client auto-configuration"));
@@ -4270,20 +4271,36 @@ export const proxyGuardCommand = {
                         return;
                     }
                     try {
-                        // Retain a validated rollback even when migrating from a mutable
-                        // global package whose on-disk version already differs from live.
-                        previousPackage = await installStagedProxyPackage({
-                            version: runningVersion,
-                            packagesDir: PROXY_PACKAGES_DIR,
-                            installer,
-                        });
+                        // Keep the exact serving tree, including a same-version local
+                        // build. Restaging by version would discard its edits and rollback.
+                        if (previousPackage?.version !== runningVersion) {
+                            try {
+                                const original = inspectProxyPackage(process.argv[1]);
+                                if (original.version === runningVersion) {
+                                    previousPackage = original;
+                                }
+                            }
+                            catch {
+                                // A mutable global entry may have disappeared since startup.
+                            }
+                        }
+                        if (previousPackage?.version !== runningVersion) {
+                            previousPackage = await installStagedProxyPackage({
+                                version: runningVersion,
+                                packagesDir: PROXY_PACKAGES_DIR,
+                                installer,
+                            });
+                        }
                         if (!isCurrentUpdateOwner()) {
                             return;
                         }
-                        candidatePackage = await installStagedProxyPackage({
+                        candidatePackage = await prepareProxyPackageUpgrade({
                             version: result.latestVersion,
                             packagesDir: PROXY_PACKAGES_DIR,
                             installer,
+                            activePackage: previousPackage,
+                            isCurrentOwner: isCurrentUpdateAttemptOwner,
+                            onPolyfills: ({ applied, alreadyIncluded }) => logger.always(`[updater] local polyfills: ${applied.length} files applied, ${alreadyIncluded.length} already included in release`),
                             onProgress: ({ elapsedMs, outputBytes }) => logger.debug(`[updater] staged install progress elapsedMs=${elapsedMs} outputBytes=${outputBytes}`),
                         });
                     }

package/dist/cli/commands/proxyPolyfill.d.ts

@@ -0,0 +1,4 @@
+import type { CommandModule } from "yargs";
+import type { ProxyPolyfillArgs } from "../../types/index.js";
+/** Record the base of a locally patched package without changing running services. */
+export declare const proxyPolyfillCommand: CommandModule<object, ProxyPolyfillArgs>;

package/dist/cli/commands/proxyPolyfill.js

@@ -0,0 +1,55 @@
+import { inspectProxyPackage } from "../../proxy/globalInstaller.js";
+import { captureProxyPackageBaseline } from "../../proxy/proxyPackagePolyfills.js";
+/** Record the base of a locally patched package without changing running services. */
+export const proxyPolyfillCommand = {
+    command: "polyfill <action>",
+    describe: "Preserve local proxy compatibility edits across staged upgrades",
+    builder: (yargs) => yargs
+        .positional("action", {
+        choices: ["capture"],
+        type: "string",
+        demandOption: true,
+    })
+        .option("base", {
+        type: "string",
+        demandOption: true,
+        description: "CLI entry script of the pristine package used for the local edit",
+    })
+        .option("patched", {
+        type: "string",
+        demandOption: true,
+        description: "CLI entry script of the locally patched package",
+    })
+        .option("format", {
+        choices: ["text", "json"],
+        type: "string",
+        default: "text",
+    })
+        .example("neurolink proxy polyfill capture --base /original/dist/cli/index.js --patched /local/dist/cli/index.js", "Record the exact original files so later upgrades can apply only the local diff"),
+    handler: async (argv) => {
+        try {
+            const base = inspectProxyPackage(argv.base);
+            const patched = inspectProxyPackage(argv.patched);
+            const files = captureProxyPackageBaseline(base, patched);
+            const result = {
+                captured: true,
+                baseVersion: base.version,
+                patchedVersion: patched.version,
+                files,
+            };
+            console.info(argv.format === "json"
+                ? JSON.stringify(result)
+                : `Recorded ${files.length} local proxy polyfill file(s). Upgrades will apply remaining diff hunks, skip included fixes, and retain the current worker on conflicts.`);
+        }
+        catch (error) {
+            const message = error instanceof Error
+                ? error.message
+                : "Proxy polyfill capture failed";
+            console.error(argv.format === "json"
+                ? JSON.stringify({ captured: false, message })
+                : message);
+            process.exitCode = 1;
+        }
+    },
+};
+//# sourceMappingURL=proxyPolyfill.js.map

package/dist/cli/parser.js

@@ -24,6 +24,7 @@ import { TelemetryCommandFactory } from "./commands/telemetry.js";
 import { proxyStartCommand, proxyStatusCommand, proxyTelemetryCommand, proxySetupCommand, proxyGuardCommand, proxyInstallCommand, proxyUninstallCommand, } from "./commands/proxy.js";
 import { proxyAnalyzeCommand } from "./commands/proxyAnalyze.js";
 import { proxyRestartCommand } from "./commands/proxyRestart.js";
+import { proxyPolyfillCommand } from "./commands/proxyPolyfill.js";
 import { proxyShareCommand } from "./commands/proxyShare.js";
 import { proxyPeerCommand } from "./commands/proxyPeer.js";
 import { proxyExposeCommand } from "./commands/proxyExpose.js";
@@ -229,6 +230,7 @@ export function initializeCliParser() {
             .command(proxyStartCommand)
             .command(proxyStatusCommand)
             .command(proxyRestartCommand)
+            .command(proxyPolyfillCommand)
             .command(proxyShareCommand)
             .command(proxyPeerCommand)
             .command(proxyExposeCommand)
@@ -239,7 +241,7 @@ export function initializeCliParser() {
             .command(proxyGuardCommand)
             .command(proxyInstallCommand)
             .command(proxyUninstallCommand)
-            .demandCommand(1, "Please specify a proxy subcommand: start, status, restart, share <create|provision|url|list|status|pause|resume|revoke|topup|set|link|rotate|level|note|notes|receipts|delete>, peer <add|request|sync|receipts|net|redeem|list|status|test|remove|pause|resume|set>, expose, analyze, replay <export|compare>, telemetry <setup|start|stop|status|logs|import-dashboard>, setup, guard, install, or uninstall"),
+            .demandCommand(1, "Please specify a proxy subcommand: start, status, restart, polyfill capture, share <create|provision|url|list|status|pause|resume|revoke|topup|set|link|rotate|level|note|notes|receipts|delete>, peer <add|request|sync|receipts|net|redeem|list|status|test|remove|pause|resume|set>, expose, analyze, replay <export|compare>, telemetry <setup|start|stop|status|logs|import-dashboard>, setup, guard, install, or uninstall"),
         handler: () => { },
     })
         // Evaluate Command Group - Using EvaluateCommandFactory

package/dist/cli/proxy-clients/registry.d.ts

@@ -15,5 +15,7 @@ export declare const PROXY_CLIENT_CONFIGURATORS: readonly CliProxyClientConfigur
  * while the setup wizard prints a visible warning.
  */
 export declare function applyAllClients(proxyBaseUrl: string, options?: CliProxyClientApplyOptions): Promise<CliProxyClientApplyResult[]>;
+/** Service replacements own the server process, not the user's client routing. */
+export declare function applyClientsOnProxyStart(proxyBaseUrl: string, options: CliProxyClientApplyOptions, managedByLaunchd: boolean): Promise<CliProxyClientApplyResult[]>;
 /** Restore every client's previous configuration. See applyAllClients. */
 export declare function restoreAllClients(proxyBaseUrl: string): Promise<CliProxyClientRestoreResult[]>;

package/dist/cli/proxy-clients/registry.js

@@ -77,6 +77,10 @@ export async function applyAllClients(proxyBaseUrl, options) {
     }
     return results;
 }
+/** Service replacements own the server process, not the user's client routing. */
+export async function applyClientsOnProxyStart(proxyBaseUrl, options, managedByLaunchd) {
+    return managedByLaunchd ? [] : applyAllClients(proxyBaseUrl, options);
+}
 /** Restore every client's previous configuration. See applyAllClients. */
 export async function restoreAllClients(proxyBaseUrl) {
     const results = [];

package/dist/proxy/accountCooldown.js

@@ -98,7 +98,9 @@ export async function saveAccountCooldown(accountKey, coolingUntil, reason) {
         await ensureAccountCooldownsLoaded();
         // Another worker (a draining one during a rolling restart) may have written
         // the file since this one loaded it, so the change folds onto the file as
-        // it is now rather than onto this worker's copy.
+        // it is now rather than onto this worker's copy. Best-effort: the mutex is
+        // per process, so two workers writing within the same few ms can still
+        // lose one update.
         const onDisk = await readCooldownsFromDisk(memoryCache);
         memoryCache = onDisk;
         const current = onDisk[accountKey];
@@ -116,7 +118,8 @@ export async function clearAccountCooldown(accountKey, expectedCoolingUntil) {
     await mutationMutex.runExclusive(async () => {
         await ensureAccountCooldownsLoaded();
         // Compare against the file, not this worker's copy: another worker may
-        // have extended this cooldown since, and that one must survive.
+        // have extended this cooldown since, and that one must survive. Same
+        // best-effort limit as saveAccountCooldown: no cross-process lock.
         const onDisk = await readCooldownsFromDisk(memoryCache);
         memoryCache = onDisk;
         const current = onDisk[accountKey];

package/dist/proxy/accountQuota.js

@@ -387,6 +387,8 @@ async function flushToDisk() {
             // Another worker (a draining one during a rolling restart) may have
             // written the file since this one loaded it: fold only this worker's
             // changes onto the file as it is now, never rewrite it from this copy.
+            // Best-effort: the mutexes are per process, so two workers flushing
+            // within the same few ms can still lose one update.
             const onDisk = await readQuotasFromDisk(filePath, fallback);
             const merged = { ...onDisk };
             for (const [key, quota] of Object.entries(flushing)) {

package/dist/proxy/codexFallback.js

@@ -343,10 +343,9 @@ function codexSessionId(body) {
         return undefined;
     }
     const fields = parsed;
-    const sessionId = fields.session_id ?? fields.parent_session_id;
-    return typeof sessionId === "string" && sessionId.length > 0
-        ? sessionId
-        : undefined;
+    // `??` would let an empty or non-string session_id shadow a usable
+    // parent_session_id, so each field has to qualify on its own.
+    return [fields.session_id, fields.parent_session_id].find((value) => typeof value === "string" && value.length > 0);
 }
 /** Convert a Claude Messages request into the ChatGPT Codex Responses shape. */
 export function convertClaudeRequestToCodex(body, model, reasoningEffort) {

package/dist/proxy/globalInstaller.d.ts

@@ -1,4 +1,4 @@
-import type { ProxyServiceInstallSettings, ProxyPackageSelection, ProxyStagedInstallOptions, GlobalInstallerExecFile, GlobalInstallerKind, GlobalInstallerResolution, InstalledVersionValidation, ResolveGlobalInstallerOptions, ValidateInstalledVersionOptions } from "../types/index.js";
+import type { ProxyServiceInstallSettings, ProxyPackageSelection, ProxyStagedInstallOptions, ProxyPackageUpgradeOptions, GlobalInstallerExecFile, GlobalInstallerKind, GlobalInstallerResolution, InstalledVersionValidation, ResolveGlobalInstallerOptions, ValidateInstalledVersionOptions } from "../types/index.js";
 /** Resolve a package manager that can update the installation currently running. */
 export declare function resolveGlobalInstaller(options?: ResolveGlobalInstallerOptions): GlobalInstallerResolution;
 export declare function getGlobalInstallArgs(kind: GlobalInstallerKind, packageSpec: string): string[];
@@ -32,6 +32,8 @@ export declare function selectProxyPackage(packagesDir: string, selection: Proxy
 export declare function writeProxyPackageLauncher(path: string, selection: ProxyPackageSelection, isCurrentOwner?: () => boolean): void;
 /** Install in a private tree, then publish the immutable directory after validation. */
 export declare function installStagedProxyPackage(options: ProxyStagedInstallOptions): Promise<ProxyPackageSelection>;
+/** Preserve local runtime diff hunks before any launcher or live selection changes. */
+export declare function prepareProxyPackageUpgrade(options: ProxyPackageUpgradeOptions): Promise<ProxyPackageSelection>;
 /** Only operator runtime settings survive reinstall, never worker IPC identity. */
 export declare function isProxyServiceEnvironmentKey(name: string): boolean;
 /** Parse plutil JSON without exposing credentials or invoking the saved launcher. */

package/dist/proxy/globalInstaller.js

@@ -1,9 +1,10 @@
 import { execFileSync as nodeExecFileSync, spawn as nodeSpawn, } from "node:child_process";
 import { accessSync, constants, existsSync, realpathSync, readFileSync, mkdirSync, writeFileSync, renameSync, chmodSync, rmSync, } from "node:fs";
-import { mkdir, mkdtemp, rename, rm, writeFile } from "node:fs/promises";
+import { cp, mkdir, mkdtemp, rename, rm, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { randomUUID } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { basename, dirname, isAbsolute, join, resolve, relative, } from "node:path";
+import { changedProxyRuntimeFiles, proxyPackageRoot, readProxyPackageBaseline, reconcileProxyPackagePolyfills, snapshotProxyPackage, writeProxyPackageBaseline, writeProxyPolyfilledFile, } from "./proxyPackagePolyfills.js";
 function runText(execFileSync, bin, args) {
     return String(execFileSync(bin, args, {
         encoding: "utf8",
@@ -373,7 +374,10 @@ export function selectProxyPackage(packagesDir, selection, isCurrentOwner) {
     const state = {
         schemaVersion: 1,
         active: selection,
-        previous: current.active && current.active.version !== selection.version
+        previous: current.active &&
+            (current.active.version !== selection.version ||
+                current.active.entryScript !== selection.entryScript ||
+                current.active.nodePath !== selection.nodePath)
             ? current.active
             : current.previous,
     };
@@ -539,7 +543,8 @@ export async function installStagedProxyPackage(options) {
                 }
             });
         });
-        validate(staging);
+        const stagedSelection = validate(staging);
+        writeProxyPackageBaseline(stagedSelection, snapshotProxyPackage(stagedSelection));
         await rename(staging, destination);
         return validate(destination);
     }
@@ -547,6 +552,148 @@ export async function installStagedProxyPackage(options) {
         await rm(staging, { recursive: true, force: true });
     }
 }
+/** Registry comparison must never inherit an existing directory's dependencies. */
+async function installFreshProxyRegistryPackage(options) {
+    if (!/^\d+\.\d+\.\d+$/.test(options.version)) {
+        throw new Error("Invalid proxy package version");
+    }
+    await mkdir(options.packagesDir, { recursive: true, mode: 0o700 });
+    const container = await mkdtemp(join(options.packagesDir, `.registry-${options.version}-`));
+    try {
+        const selection = await installStagedProxyPackage({
+            ...options,
+            packagesDir: container,
+        });
+        return { selection, container };
+    }
+    catch (error) {
+        await rm(container, { recursive: true, force: true });
+        throw error;
+    }
+}
+/** Preserve local runtime diff hunks before any launcher or live selection changes. */
+export async function prepareProxyPackageUpgrade(options) {
+    const assertOwner = () => assertPackageSelectionOwner(options.isCurrentOwner);
+    assertOwner();
+    const active = options.activePackage;
+    let baseline = readProxyPackageBaseline(active);
+    if (!baseline) {
+        // Legacy packages need a clean registry comparison. Never invent a baseline
+        // from edited files: an unknown local build must remain serving until its
+        // operator records the actual base with `proxy polyfill capture`.
+        const original = await installFreshProxyRegistryPackage({
+            ...options,
+            version: active.version,
+        });
+        let retainReference = false;
+        try {
+            assertOwner();
+            baseline = readProxyPackageBaseline(original.selection);
+            if (!baseline) {
+                throw new Error("Pristine registry package baseline is missing");
+            }
+            if (changedProxyRuntimeFiles(baseline, snapshotProxyPackage(active)).length) {
+                retainReference = true;
+                throw new Error(`Active proxy contains local changes without a recorded base; upgrade retained the serving package. Record its actual original package with 'proxy polyfill capture --base <original-entry> --patched <local-entry>'. Downloaded registry reference: ${original.selection.entryScript}`);
+            }
+            writeProxyPackageBaseline(active, baseline);
+        }
+        finally {
+            if (!retainReference) {
+                await rm(original.container, { recursive: true, force: true });
+            }
+        }
+    }
+    const local = snapshotProxyPackage(active);
+    // Also rejects unsupported local dependency/entrypoint changes.
+    changedProxyRuntimeFiles(baseline, local);
+    const fresh = await installFreshProxyRegistryPackage(options);
+    try {
+        const candidate = fresh.selection;
+        assertOwner();
+        const candidateBase = readProxyPackageBaseline(candidate);
+        if (!candidateBase ||
+            changedProxyRuntimeFiles(candidateBase, snapshotProxyPackage(candidate))
+                .length) {
+            throw new Error("Candidate proxy package has no trustworthy pristine baseline");
+        }
+        const { files, report } = reconcileProxyPackagePolyfills(baseline, local, candidateBase);
+        const assertLocalUnchanged = () => {
+            assertOwner();
+            if (JSON.stringify(snapshotProxyPackage(active)) !== JSON.stringify(local)) {
+                throw new Error("Active proxy files changed while preparing the upgrade; activation refused");
+            }
+        };
+        assertLocalUnchanged();
+        if (!report.applied.length) {
+            const destination = join(options.packagesDir, `${options.version}-release-${randomUUID()}`);
+            await rename(resolve(proxyPackageRoot(candidate.entryScript), "../../.."), destination);
+            const selected = inspectProxyPackage(join(destination, "node_modules", "@juspay", "neurolink", candidateBase.entryRelative));
+            assertOwner();
+            options.onPolyfills?.(report);
+            return selected;
+        }
+        const digest = createHash("sha256")
+            .update(JSON.stringify({ version: options.version, files }))
+            .digest("hex")
+            .slice(0, 16);
+        const destination = join(options.packagesDir, `${options.version}-polyfills-${digest}-${randomUUID()}`);
+        const candidateRoot = proxyPackageRoot(candidate.entryScript);
+        const expected = { ...candidateBase.files };
+        for (const [path, content] of Object.entries(files)) {
+            if (content === null) {
+                delete expected[path];
+            }
+            else {
+                expected[path] = content;
+            }
+        }
+        const validateCopy = (root) => {
+            const selection = inspectProxyPackage(join(root, "node_modules", "@juspay", "neurolink", candidateBase.entryRelative));
+            const snapshot = snapshotProxyPackage(selection);
+            if (selection.version !== options.version ||
+                snapshot.manifest !== candidateBase.manifest ||
+                Object.keys({ ...snapshot.files, ...expected }).some((path) => snapshot.files[path] !== expected[path])) {
+                throw new Error("Polyfilled proxy package does not match its validated plan");
+            }
+            for (const path of report.applied) {
+                if (files[path] !== null && /\.[cm]?js$/.test(path)) {
+                    (options.execFileSync ?? nodeExecFileSync)(selection.nodePath, ["--check", join(proxyPackageRoot(selection.entryScript), path)], { timeout: 10_000, stdio: "pipe" });
+                }
+            }
+            return selection;
+        };
+        const staging = await mkdtemp(join(options.packagesDir, `.polyfill-${options.version}-`));
+        try {
+            await cp(resolve(candidateRoot, "../../.."), staging, {
+                recursive: true,
+                mode: constants.COPYFILE_FICLONE,
+                verbatimSymlinks: true,
+            });
+            const root = join(staging, "node_modules", "@juspay", "neurolink");
+            for (const [path, content] of Object.entries(files)) {
+                if (content === null) {
+                    await rm(join(root, path));
+                }
+                else {
+                    writeProxyPolyfilledFile(root, path, content);
+                }
+            }
+            validateCopy(staging);
+            assertLocalUnchanged();
+            await rename(staging, destination);
+            const selection = validateCopy(destination);
+            options.onPolyfills?.(report);
+            return selection;
+        }
+        finally {
+            await rm(staging, { recursive: true, force: true });
+        }
+    }
+    finally {
+        await rm(fresh.container, { recursive: true, force: true });
+    }
+}
 /** Only operator runtime settings survive reinstall, never worker IPC identity. */
 export function isProxyServiceEnvironmentKey(name) {
     return ((name.startsWith("OTEL_") ||

package/dist/proxy/proxyPackagePolyfills.d.ts

@@ -0,0 +1,18 @@
+import type { ProxyPackageBaseline, ProxyPackagePolyfillReport, ProxyPackageSelection } from "../types/index.js";
+/** Locate the package without importing its executable or provider graph. */
+export declare function proxyPackageRoot(entryScript: string): string;
+/** Bounded baseline of shipped proxy code; operator config and dependencies are excluded. */
+export declare function snapshotProxyPackage(selection: ProxyPackageSelection): ProxyPackageBaseline;
+/** Invalid or missing baseline must never be silently replaced with edited files. */
+export declare function readProxyPackageBaseline(selection: ProxyPackageSelection): ProxyPackageBaseline | null;
+export declare function writeProxyPackageBaseline(selection: ProxyPackageSelection, baseline: ProxyPackageBaseline): void;
+/** Operator supplies the pristine base for a legacy local build; this does not activate it. */
+export declare function captureProxyPackageBaseline(base: ProxyPackageSelection, patched: ProxyPackageSelection): string[];
+export declare function changedProxyRuntimeFiles(base: ProxyPackageBaseline, current: ProxyPackageBaseline): string[];
+/** Apply exact local hunks, leaving independent upstream changes intact. */
+export declare function reconcileProxyPackagePolyfills(base: ProxyPackageBaseline, local: ProxyPackageBaseline, candidate: ProxyPackageBaseline): {
+    files: Record<string, string | null>;
+    report: ProxyPackagePolyfillReport;
+};
+/** Writes are confined to a new staged copy, never the serving package. */
+export declare function writeProxyPolyfilledFile(root: string, path: string, content: string): void;