@miller-tech/uap 2.21.2 → 2.36.1

package/dist/placement/preview.js

@@ -0,0 +1,61 @@
+/**
+ * Impact preview (spec §4.5): the victim list the operator sees BEFORE
+ * committing, and the re-derivation check enforcement uses AFTER the yes.
+ *
+ * Nothing in this view is advisory-only: enforcement re-derives the same
+ * victim set and refuses to proceed if it differs from what the operator
+ * approved. A preview that lies is worse than no preview.
+ *
+ * In-flight status is `unknown` in phase 1: the proxy exposes no live
+ * request state yet (the phase-2 in-flight-per-target endpoint supplies it).
+ * The preview must say unknown rather than guess "idle".
+ */
+import { isMeasuredConfig } from './registry.js';
+/** Consequence table, spec §4.5. */
+function consequenceFor(state, inflight) {
+    if (state === 'warming')
+        return 'load wasted; VRAM returns on stop';
+    if (state === 'paused')
+        return 'already offloaded; restore path lost';
+    if (inflight === true)
+        return 'active generation aborted; context lost';
+    if (inflight === false)
+        return 'session idle; context lost; reload needed';
+    // The proxy's /internal/placement/inflight endpoint shipped (phase 3);
+    // 'unknown' now means "the proxy did not answer", never "not wired yet".
+    return 'context lost; reload needed (in-flight view unavailable from the proxy)';
+}
+/** Build the victim preview for a displace option. */
+export function buildVictimPreviews(registry, victims, inflightOf = () => 'unknown') {
+    return victims.map((v) => {
+        const cfg = registry.models[v.model]?.configs[v.config];
+        return {
+            model: v.model,
+            config: v.config,
+            device: v.device,
+            state: v.state,
+            holders: v.holders,
+            inflight: inflightOf(v),
+            frees_gpu_mib: v.gpu_mib ?? 0,
+            frees_host_mib: v.host_rss_mib,
+            reload_cost_mib: cfg && isMeasuredConfig(cfg) ? cfg.resident_gpu_mib : undefined,
+            consequence: consequenceFor(v.state, inflightOf(v)),
+        };
+    });
+}
+/** Stable signature of a victim set — what the operator approved and what
+ * enforcement re-derives must produce the same string, or enforcement
+ * aborts. Order-insensitive; content-sensitive. */
+export function victimSignature(victims) {
+    return victims
+        .map((v) => `${v.model}/${v.config}`)
+        .sort()
+        .join(',');
+}
+/** The enforcement-time check: re-derive the victims from live state and
+ * refuse when the set the operator approved no longer matches. A mismatch
+ * means the world moved between preview and commit — abort, re-ask. */
+export function previewStillValid(approved, rederived) {
+    return victimSignature(approved) === victimSignature(rederived);
+}
+//# sourceMappingURL=preview.js.map

package/dist/placement/preview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview.js","sourceRoot":"","sources":["../../src/placement/preview.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,gBAAgB,EAAsB,MAAM,eAAe,CAAC;AAsBrE,oCAAoC;AACpC,SAAS,cAAc,CAAC,KAA8B,EAAE,QAAkB;IACxE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,mCAAmC,CAAC;IACpE,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,sCAAsC,CAAC;IACtE,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,yCAAyC,CAAC;IACxE,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,2CAA2C,CAAC;IAC3E,uEAAuE;IACvE,yEAAyE;IACzE,OAAO,yEAAyE,CAAC;AACnF,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,mBAAmB,CACjC,QAAuB,EACvB,OAAyB,EACzB,aAAmD,GAAG,EAAE,CAAC,SAAS;IAElE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACxD,OAAO;YACL,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;YACvB,aAAa,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC;YAC7B,cAAc,EAAE,CAAC,CAAC,YAAY;YAC9B,eAAe,EAAE,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS;YAChF,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;SACpD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;mDAEmD;AACnD,MAAM,UAAU,eAAe,CAAC,OAAiD;IAC/E,OAAO,OAAO;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;SACpC,IAAI,EAAE;SACN,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;uEAEuE;AACvE,MAAM,UAAU,iBAAiB,CAC/B,QAAkD,EAClD,SAAmD;IAEnD,OAAO,eAAe,CAAC,QAAQ,CAAC,KAAK,eAAe,CAAC,SAAS,CAAC,CAAC;AAClE,CAAC"}

package/dist/placement/probes.d.ts

@@ -0,0 +1,47 @@
+/** Is a user unit active? Fail-closed to false when systemctl is missing. */
+export declare function isUnitActive(unit: string): boolean;
+/** Main PID of a user unit; null when systemctl is missing or the unit is
+ * inactive. Never a guess. */
+export declare function unitMainPid(unit: string): number | null;
+/** All PIDs in a user unit's cgroup. A backend can be multi-process — the
+ * strata unit's MainPID is the serve wrapper while the ENGINE child holds
+ * the GPU — so the whole-config footprint must aggregate the cgroup, not
+ * trust MainPID. Null when the unit or its cgroup is not readable. */
+export declare function unitCgroupPids(unit: string): number[] | null;
+/** PID of whatever listens on the port, via `ss -ltnp`. Fallback for
+ * unit-less backends. Null when nothing is listening. */
+export declare function listeningPortPid(port: number): number | null;
+/** Established (in-use) TCP connections to a backend endpoint, via
+ * `ss -tn state established`. This is the idle sweep's port-level safety:
+ * clients that bypass the gate (curl straight at the port, another agent
+ * talking to the backend directly) are invisible to the gated usage
+ * clock — an ESTABLISHED connection means SOMETHING is talking to the
+ * resident right now and it must not be unloaded. Null when `ss` cannot
+ * answer: unknown is a refusal to unload, never a guess that it's idle.
+ * Scoped to SPORT only: every connection TO the backend has a server-side
+ * socket with local port = the backend port, while matching DPORT too
+ * would also count this machine's own outbound traffic to any remote host
+ * on that port number (false "busy" — safe, but it would defer the sweep
+ * forever). All same-device backends share one endpoint port (the
+ * Conflicts graph keeps exactly one live). */
+export declare function endpointEstablishedConns(endpoint: string | undefined): number | null;
+/** Whole-config GPU MiB: sum of nvidia-smi compute-apps memory across the
+ * given PIDs. Null when none of them hold GPU memory — a refusal, not zero. */
+export declare function gpuComputeMiB(pids: number[]): number | null;
+/** Per-GPU stats keyed by index — one nvidia-smi call for every card.
+ * (probeGpuFreeMiB() in src/capacity reads GPU 0 only; the multi-device
+ * abstraction needs per-index readings. Spec §5 item 4.) */
+export interface GpuStats {
+    total_mib?: number;
+    free_mib?: number;
+}
+export declare function gpuStatsByIndex(): Map<number, GpuStats>;
+/** Host total RAM (MiB) from /proc/meminfo MemTotal. Null when unreadable. */
+export declare function hostTotalMiB(): number | null;
+/** Host available RAM (MiB) from /proc/meminfo MemAvailable. Null when the
+ * file is unreadable (non-Linux). */
+export declare function hostAvailableMiB(): number | null;
+/** Whole-config host RSS (MiB): sum of VmRSS across the given PIDs.
+ * Processes that vanish mid-sum are skipped; null when none could be read. */
+export declare function hostRssMiB(pids: number[]): number | null;
+//# sourceMappingURL=probes.d.ts.map

package/dist/placement/probes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probes.d.ts","sourceRoot":"","sources":["../../src/placement/probes.ts"],"names":[],"mappings":"AAcA,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAWlD;AAED;8BAC8B;AAC9B,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYvD;AAED;;;sEAGsE;AACtE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAiB5D;AAED;yDACyD;AACzD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY5D;AAED;;;;;;;;;;;;8CAY8C;AAC9C,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAkBpF;AAED;+EAC+E;AAC/E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAqB3D;AAED;;4DAE4D;AAC5D,MAAM,WAAW,QAAQ;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,eAAe,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAsBvD;AAED,8EAA8E;AAC9E,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAQ5C;AAED;qCACqC;AACrC,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAQhD;AAED;8EAC8E;AAC9E,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAaxD"}

package/dist/placement/probes.js

@@ -0,0 +1,207 @@
+/**
+ * Host probes for the placement layer: unit liveness, whole-cgroup process
+ * discovery, GPU memory, host RSS, and device free memory.
+ *
+ * Same doctrine as src/capacity/probe.ts: execFileSync with argv arrays only
+ * (no shell), bounded timeouts, every probe fails soft to null — callers
+ * decide what null means, and for placement null always means REFUSE, never
+ * a guess.
+ */
+import { execFileSync } from 'child_process';
+import { readFileSync } from 'fs';
+const PROBE_TIMEOUT_MS = 5000;
+/** Is a user unit active? Fail-closed to false when systemctl is missing. */
+export function isUnitActive(unit) {
+    try {
+        const out = execFileSync('systemctl', ['--user', 'is-active', '--', unit], {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout: PROBE_TIMEOUT_MS,
+        });
+        return out.trim() === 'active';
+    }
+    catch {
+        return false;
+    }
+}
+/** Main PID of a user unit; null when systemctl is missing or the unit is
+ * inactive. Never a guess. */
+export function unitMainPid(unit) {
+    try {
+        const out = execFileSync('systemctl', ['--user', 'show', '-p', 'MainPID', '--', unit], {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout: PROBE_TIMEOUT_MS,
+        });
+        const pid = Number(out.trim().split('=')[1]);
+        return Number.isFinite(pid) && pid > 0 ? pid : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** All PIDs in a user unit's cgroup. A backend can be multi-process — the
+ * strata unit's MainPID is the serve wrapper while the ENGINE child holds
+ * the GPU — so the whole-config footprint must aggregate the cgroup, not
+ * trust MainPID. Null when the unit or its cgroup is not readable. */
+export function unitCgroupPids(unit) {
+    try {
+        const out = execFileSync('systemctl', ['--user', 'show', '-p', 'ControlGroup', '--', unit], {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout: PROBE_TIMEOUT_MS,
+        });
+        const cg = out.trim().split('=')[1];
+        if (!cg)
+            return null;
+        const procs = readFileSync(`/sys/fs/cgroup${cg}/cgroup.procs`, 'utf-8');
+        return procs
+            .split('\n')
+            .map((l) => Number(l.trim()))
+            .filter((p) => Number.isFinite(p) && p > 0);
+    }
+    catch {
+        return null;
+    }
+}
+/** PID of whatever listens on the port, via `ss -ltnp`. Fallback for
+ * unit-less backends. Null when nothing is listening. */
+export function listeningPortPid(port) {
+    try {
+        const out = execFileSync('ss', ['-ltnp', `sport = :${port}`], {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout: PROBE_TIMEOUT_MS,
+        });
+        const m = out.match(/pid=(\d+)/);
+        return m ? Number(m[1]) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Established (in-use) TCP connections to a backend endpoint, via
+ * `ss -tn state established`. This is the idle sweep's port-level safety:
+ * clients that bypass the gate (curl straight at the port, another agent
+ * talking to the backend directly) are invisible to the gated usage
+ * clock — an ESTABLISHED connection means SOMETHING is talking to the
+ * resident right now and it must not be unloaded. Null when `ss` cannot
+ * answer: unknown is a refusal to unload, never a guess that it's idle.
+ * Scoped to SPORT only: every connection TO the backend has a server-side
+ * socket with local port = the backend port, while matching DPORT too
+ * would also count this machine's own outbound traffic to any remote host
+ * on that port number (false "busy" — safe, but it would defer the sweep
+ * forever). All same-device backends share one endpoint port (the
+ * Conflicts graph keeps exactly one live). */
+export function endpointEstablishedConns(endpoint) {
+    const m = endpoint?.match(/:(\d+)(?:\/|$)/);
+    if (!m)
+        return null; // no port in the endpoint — unknown, fail closed
+    const port = Number(m[1]);
+    if (!Number.isInteger(port) || port <= 0)
+        return null;
+    try {
+        const out = execFileSync('ss', ['-tn', `state established`, `sport = :${port}`], {
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+            timeout: PROBE_TIMEOUT_MS,
+        });
+        return out
+            .split('\n')
+            .filter((l) => l.trim() && !l.startsWith('State'))
+            .length;
+    }
+    catch {
+        return null; // ss missing/unhappy — unknown, never "idle"
+    }
+}
+/** Whole-config GPU MiB: sum of nvidia-smi compute-apps memory across the
+ * given PIDs. Null when none of them hold GPU memory — a refusal, not zero. */
+export function gpuComputeMiB(pids) {
+    try {
+        const out = execFileSync('nvidia-smi', ['--query-compute-apps=pid,used_memory', '--format=csv,noheader,nounits'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: PROBE_TIMEOUT_MS });
+        const want = new Set(pids);
+        let total = null;
+        for (const line of out.split('\n')) {
+            const [p, mem] = line.split(',').map((s) => s.trim());
+            if (!p)
+                continue; // trailing newline must not parse as pid 0
+            if (!want.has(Number(p)))
+                continue;
+            const mib = Number(mem);
+            if (!Number.isFinite(mib))
+                continue;
+            total = (total ?? 0) + Math.round(mib);
+        }
+        return total;
+    }
+    catch {
+        return null;
+    }
+}
+export function gpuStatsByIndex() {
+    const out = new Map();
+    try {
+        const text = execFileSync('nvidia-smi', ['--query-gpu=index,memory.total,memory.free', '--format=csv,noheader,nounits'], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'], timeout: PROBE_TIMEOUT_MS });
+        for (const line of text.split('\n')) {
+            if (!line.trim())
+                continue; // trailing newline: Number('')===0 must not become GPU 0
+            const [idx, total, free] = line.split(',').map((s) => s.trim());
+            const i = Number(idx);
+            if (!Number.isFinite(i))
+                continue;
+            const stats = {};
+            if (Number.isFinite(Number(total)))
+                stats.total_mib = Math.round(Number(total));
+            if (Number.isFinite(Number(free)))
+                stats.free_mib = Math.round(Number(free));
+            out.set(i, stats);
+        }
+    }
+    catch {
+        // no nvidia-smi — empty map; every device reads as unprobed
+    }
+    return out;
+}
+/** Host total RAM (MiB) from /proc/meminfo MemTotal. Null when unreadable. */
+export function hostTotalMiB() {
+    try {
+        const meminfo = readFileSync('/proc/meminfo', 'utf-8');
+        const m = meminfo.match(/^MemTotal:\s+(\d+)\s+kB$/m);
+        return m ? Math.round(Number(m[1]) / 1024) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Host available RAM (MiB) from /proc/meminfo MemAvailable. Null when the
+ * file is unreadable (non-Linux). */
+export function hostAvailableMiB() {
+    try {
+        const meminfo = readFileSync('/proc/meminfo', 'utf-8');
+        const m = meminfo.match(/^MemAvailable:\s+(\d+)\s+kB$/m);
+        return m ? Math.round(Number(m[1]) / 1024) : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Whole-config host RSS (MiB): sum of VmRSS across the given PIDs.
+ * Processes that vanish mid-sum are skipped; null when none could be read. */
+export function hostRssMiB(pids) {
+    let total = null;
+    for (const pid of pids) {
+        try {
+            const status = readFileSync(`/proc/${pid}/status`, 'utf-8');
+            const m = status.match(/^VmRSS:\s+(\d+)\s+kB$/m);
+            if (!m)
+                continue;
+            total = (total ?? 0) + Math.round(Number(m[1]) / 1024);
+        }
+        catch {
+            // process exited between cgroup read and proc read — skip it
+        }
+    }
+    return total;
+}
+//# sourceMappingURL=probes.js.map

package/dist/placement/probes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probes.js","sourceRoot":"","sources":["../../src/placement/probes.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAElC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YACzE,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,IAAI,EAAE,KAAK,QAAQ,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;8BAC8B;AAC9B,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YACrF,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;sEAGsE;AACtE,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YAC1F,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,MAAM,KAAK,GAAG,YAAY,CAAC,iBAAiB,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QACxE,OAAO,KAAK;aACT,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;yDACyD;AACzD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,YAAY,IAAI,EAAE,CAAC,EAAE;YAC5D,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;8CAY8C;AAC9C,MAAM,UAAU,wBAAwB,CAAC,QAA4B;IACnE,MAAM,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC5C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,iDAAiD;IACtE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,mBAAmB,EAAE,YAAY,IAAI,EAAE,CAAC,EAAE;YAC/E,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,OAAO,EAAE,gBAAgB;SAC1B,CAAC,CAAC;QACH,OAAO,GAAG;aACP,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;aACjD,MAAM,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,6CAA6C;IAC5D,CAAC;AACH,CAAC;AAED;+EAC+E;AAC/E,MAAM,UAAU,aAAa,CAAC,IAAc;IAC1C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,YAAY,EACZ,CAAC,sCAAsC,EAAE,+BAA+B,CAAC,EACzE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAClF,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,CAAC;gBAAE,SAAS,CAAC,2CAA2C;YAC7D,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAoB,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CACvB,YAAY,EACZ,CAAC,4CAA4C,EAAE,+BAA+B,CAAC,EAC/E,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAClF,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS,CAAC,yDAAyD;YACrF,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAChE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,SAAS;YAClC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAChF,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7E,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;qCACqC;AACrC,MAAM,UAAU,gBAAgB;IAC9B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;8EAC8E;AAC9E,MAAM,UAAU,UAAU,CAAC,IAAc;IACvC,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,GAAG,SAAS,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACjD,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/placement/proxy-env.d.ts

@@ -0,0 +1,21 @@
+/** Absolute path to the proxy's systemd EnvironmentFile. */
+export declare function proxyEnvPath(homeDir?: string): string;
+/**
+ * Read the last (last-wins) value of KEY in the proxy env file, or null if the
+ * file is missing or the key is unset. Used to honor an operator local-only pin
+ * before overwriting ANTHROPIC_PASSTHROUGH_MODELS.
+ */
+export declare function readProxyEnvVar(key: string, homeDir?: string): string | null;
+/**
+ * One resolution of the loopback proxy base URL + auth headers (process env
+ * wins, then the proxy env file, then the loopback default). Previously two
+ * copies in enforce.ts drifted silently; one composer now.
+ */
+export declare function proxyBaseAndHeaders(opts?: {
+    proxyBaseUrl?: string;
+    proxyToken?: string;
+}): {
+    base: string;
+    headers: Record<string, string>;
+};
+//# sourceMappingURL=proxy-env.d.ts.map

package/dist/placement/proxy-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-env.d.ts","sourceRoot":"","sources":["../../src/placement/proxy-env.ts"],"names":[],"mappings":"AAYA,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,OAAO,GAAE,MAAkB,GAAG,MAAM,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,GAAE,MAAkB,GAAG,MAAM,GAAG,IAAI,CAQvF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,GACxD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAInD"}

package/dist/placement/proxy-env.js

@@ -0,0 +1,42 @@
+/**
+ * Shared proxy-env resolution for the placement domain (spec §4.3/§4.6).
+ *
+ * Lives in src/placement/ — NOT imported from src/cli/ — so the domain layer
+ * (consumed by both the CLI and the dashboard) never reaches into a surface
+ * layer. src/cli/systemd-services.ts re-exports readProxyEnvVar for its
+ * existing callers.
+ */
+import { existsSync, readFileSync } from 'fs';
+import { homedir } from 'os';
+import { join } from 'path';
+/** Absolute path to the proxy's systemd EnvironmentFile. */
+export function proxyEnvPath(homeDir = homedir()) {
+    return join(homeDir, '.config', 'uap', 'anthropic-proxy.env');
+}
+/**
+ * Read the last (last-wins) value of KEY in the proxy env file, or null if the
+ * file is missing or the key is unset. Used to honor an operator local-only pin
+ * before overwriting ANTHROPIC_PASSTHROUGH_MODELS.
+ */
+export function readProxyEnvVar(key, homeDir = homedir()) {
+    const path = proxyEnvPath(homeDir);
+    if (!existsSync(path))
+        return null;
+    const lines = readFileSync(path, 'utf8').split('\n');
+    for (let i = lines.length - 1; i >= 0; i--) {
+        if (lines[i].startsWith(`${key}=`))
+            return lines[i].slice(key.length + 1);
+    }
+    return null;
+}
+/**
+ * One resolution of the loopback proxy base URL + auth headers (process env
+ * wins, then the proxy env file, then the loopback default). Previously two
+ * copies in enforce.ts drifted silently; one composer now.
+ */
+export function proxyBaseAndHeaders(opts = {}) {
+    const base = (opts.proxyBaseUrl ?? process.env.UAP_PROXY_URL ?? 'http://127.0.0.1:4000').replace(/\/$/, '');
+    const token = opts.proxyToken ?? process.env.PROXY_AUTH_TOKEN ?? readProxyEnvVar('PROXY_AUTH_TOKEN') ?? '';
+    return { base, headers: token ? { Authorization: `Bearer ${token}` } : {} };
+}
+//# sourceMappingURL=proxy-env.js.map

package/dist/placement/proxy-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-env.js","sourceRoot":"","sources":["../../src/placement/proxy-env.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,UAAkB,OAAO,EAAE;IACtD,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,CAAC,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,UAAkB,OAAO,EAAE;IACtE,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAuD,EAAE;IAEzD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC5G,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,eAAe,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IAC3G,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC9E,CAAC"}