anypick 1.0.0 → 1.1.0

package/dist/types/account.d.ts

@@ -1,410 +0,0 @@
-import type { SourceAdapter } from './bindings.js';
-import type { ModelPolicy } from './catalog.js';
-import type { ProxyHubBackendContext, ProxyHubBackendHandle } from './proxy-hub.js';
-/**
- * Metadata stored alongside each saved account snapshot.
- * Secrets live only in the snapshot files, never in meta.
- */
-export interface AccountMeta {
-    /** Stable account name (slug), unique within a provider. */
-    name: string;
-    /** Provider id this account belongs to. */
-    provider: string;
-    /** When the snapshot was first created (ISO 8601). */
-    createdAt: string;
-    /** When the snapshot was last updated (ISO 8601). */
-    updatedAt: string;
-    /** Optional human label shown in list/interactive UI. */
-    label?: string;
-    /** Best-effort identity hint (email, account id) for display. */
-    identity?: string;
-    /** Free-form notes. */
-    notes?: string;
-    /**
-     * How this account's credential relates to the machine. Absent means
-     * `native`: a snapshot of the provider's own login file, which activation
-     * restores over the live credential.
-     *
-     * `proxy-only` is credential material the user supplied directly — an API key,
-     * say — that never occupies that file. Such an account can never be "live",
-     * must not be restored over a native login, and must not absorb a refreshed
-     * live token; it is reachable only through the provider's proxy.
-     */
-    credentialKind?: 'native' | 'proxy-only';
-}
-/** Fields a provider may contribute to AccountMeta when it writes a snapshot. */
-export type SnapshotMeta = Partial<Pick<AccountMeta, 'identity' | 'label' | 'notes' | 'credentialKind'>>;
-/**
- * Credential material typed by the user rather than read from a live login.
- *
- * The provider decides what a kind means and what it writes; core only carries
- * the value through to `backupInput` and never logs or persists it in meta.
- */
-export interface CredentialInput {
-    /** Provider-declared kind, e.g. `api-key`. */
-    kind: string;
-    /** The secret itself. */
-    secret: string;
-    /** Non-secret qualifiers the provider understands, e.g. `{ region }`. */
-    options?: Record<string, string>;
-}
-/**
- * One non-secret qualifier a credential input accepts, described well enough for
- * a caller to offer the values without knowing the provider.
- *
- * `choices` are values the provider knows are real, but a caller may pass
- * something else: these lists go stale as vendors add regions. The point is that
- * a picker beats free text for a field where a plausible-looking typo yields an
- * account that starts and then cannot serve a single request.
- */
-export interface CredentialInputField {
-    /** Key under `CredentialInput.options`, e.g. `region`. */
-    name: string;
-    label: string;
-    choices: readonly string[];
-    default?: string;
-}
-/**
- * Per-account proxy configuration (stored separately from secrets).
- * Provider-specific knobs go in `options`.
- */
-export interface AccountProxyConfig {
-    /** When true, switching to / activating this account starts the proxy. */
-    enabled: boolean;
-    /** Preferred listen port (provider may fall back if busy). */
-    port?: number;
-    /** Preferred listen host (default typically 127.0.0.1). */
-    host?: string;
-    /** Opaque provider-specific options. */
-    options?: Record<string, unknown>;
-}
-/**
- * A saved account: metadata + path to the opaque snapshot directory.
- */
-export interface Account {
-    meta: AccountMeta;
-    /** Absolute path to the snapshot directory for this account. */
-    snapshotDir: string;
-    /** Absolute path to the account directory (meta + snapshot + proxy). */
-    accountDir: string;
-    /** Per-account proxy configuration (defaults to disabled). */
-    proxy: AccountProxyConfig;
-}
-/**
- * Result of inspecting the live (active) auth state on disk.
- */
-export interface LiveAuthStatus {
-    /** Whether live auth material appears to be present. */
-    present: boolean;
-    /** Optional identity extracted from live auth (email, etc.). */
-    identity?: string;
-    /** Optional extra display details. */
-    details?: string;
-    /**
-     * Stable provider account id when known (e.g. ChatGPT `account_id`).
-     * Used for live matching when session tokens and display emails disagree.
-     */
-    accountId?: string;
-}
-/** A provider-reported rate-limit window for the account currently live on disk. */
-export interface LiveUsageWindow {
-    /** Short, provider-defined label such as "5h" or "weekly". */
-    label: string;
-    /** Percentage of this window that remains, from 0 to 100. */
-    remainingPercent: number;
-    /** Optional epoch milliseconds when the window resets. */
-    resetsAtMs?: number;
-}
-/** Best-effort usage snapshot. It is never read from a saved account snapshot. */
-export interface LiveUsage {
-    windows: LiveUsageWindow[];
-}
-/** Context passed to provider proxy lifecycle methods. */
-export interface ProxyContext {
-    providerId: string;
-    accountName: string;
-    /** Snapshot directory for this account (read-only for proxy). */
-    snapshotDir: string;
-    /**
-     * Writable runtime directory for this account's proxy
-     * (pid file, logs, state). Unique per provider+account.
-     */
-    runtimeDir: string;
-    /** Account proxy configuration. */
-    config: AccountProxyConfig;
-    /**
-     * Per-instance high-entropy secret required on every credentialed route.
-     * Generated once per proxy lifecycle; transmitted to the child only via the
-     * `ANYPICK_PROXY_TOKEN` env var. Never logged or returned in status.
-     */
-    token?: string;
-}
-/** Returned when a proxy successfully starts. */
-export interface ProxyHandle {
-    /** Local endpoint clients should use, e.g. http://127.0.0.1:8080 */
-    endpoint: string;
-    /** Human-readable protocol compatibility label. */
-    compatibility?: string;
-    /** OS process id if the proxy is a child process. */
-    pid?: number;
-    /** Opaque instance id (PROC-01) used to prove ownership via health echo. */
-    instanceId?: string;
-    /**
-     * Per-instance high-entropy secret (PROXY-01) accepted on every credentialed
-     * route. Transient — present only on the freshly started handle so the
-     * caller (executor) can bind it into client config. Never persisted beyond
-     * `proxy_state` and never returned in status/doctor.
-     */
-    token?: string;
-    /** Lease created for this lifecycle operation. */
-    leaseId?: string;
-    /** True only when this call spawned a new child process. */
-    startedNow?: boolean;
-    /** Path to the proxy log file, if any. */
-    logPath?: string;
-    /**
-     * Clients whose native config (e.g. ~/.claude/settings.json) was rewritten
-     * to this endpoint after a start/port bump.
-     */
-    realignedClients?: string[];
-}
-/** Status of a provider account's proxy. */
-export interface ProxyStatus {
-    enabled: boolean;
-    running: boolean;
-    /** Configured listen port (always set when known). */
-    port?: number;
-    /** Configured listen host (default 127.0.0.1). */
-    host?: string;
-    endpoint?: string;
-    compatibility?: string;
-    pid?: number;
-    logPath?: string;
-    detail?: string;
-}
-/** External application that must release live auth before a restore. */
-export interface RestoreOwnerStatus {
-    name: string;
-    running: boolean;
-}
-/** Human-facing native source represented by one provider snapshot. */
-export interface AccountSourceDescriptor {
-    id: string;
-    name: string;
-}
-/**
- * Provider contract.
- *
- * Each provider owns:
- * - where live auth lives on the machine
- * - how to copy it into a snapshot directory (backup)
- * - how to write a snapshot back to live paths (restore)
- * - optionally, a compatibility proxy lifecycle
- *
- * Snapshots are opaque directories. The core store never interprets
- * provider-specific secret formats beyond what describe* returns.
- * Proxy logic is entirely provider-specific; core only orchestrates.
- */
-export interface Provider extends ModelPolicy {
-    /** Stable machine id used in paths and CLI args (e.g. "codex"). */
-    readonly id: string;
-    /** Human-readable name (e.g. "OpenAI Codex"). */
-    readonly name: string;
-    /** One-line description for help text. */
-    readonly description: string;
-    /** Short UI label for lists and status lines. Defaults to `name`. */
-    readonly shortName?: string;
-    /**
-     * When true, the TUI/CLI account-add flow offers a multi-source picker before
-     * mode selection (e.g. Gemini CLI vs Antigravity). Driven by the provider so
-     * UI surfaces never hardcode provider ids.
-     */
-    readonly requiresAccountSourcePick?: boolean;
-    /**
-     * True when the compatibility proxy needs an API key from the snapshot and
-     * cannot be driven from an OAuth-only login. Callers gate the proxy on this
-     * instead of consulting a hardcoded provider-id set.
-     */
-    readonly proxyRequiresApiKey?: boolean;
-    /**
-     * Report whether `snapshotDir` carries the API key material this provider's
-     * proxy needs. Only consulted when `proxyRequiresApiKey` is true.
-     *
-     * Providers own this because only they know where the key lives inside their
-     * own snapshot layout. Returning a `hint` lets the UI explain what to do
-     * without core knowing anything about the provider's file format.
-     */
-    proxyApiKeyStatus?(snapshotDir: string): Promise<{
-        present: boolean;
-        hint?: string;
-    }>;
-    /**
-     * Default listen port when enabling proxy without an explicit `-p`.
-     * Used as the base for auto-allocation to avoid collisions.
-     * Proxy capability is determined by presence of startProxy(), not a boolean flag.
-     */
-    readonly defaultProxyPort?: number;
-    /**
-     * Optional short label for what the proxy speaks
-     * (e.g. "OpenAI API", "Anthropic + OpenAI API").
-     */
-    readonly proxyCompatibility?: string;
-    /**
-     * Provider-owned source policy. Implement this instead of relying on core
-     * provider-id conditionals when an account supports direct or proxy-backed
-     * activation. The returned adapter is scoped to one saved account.
-     */
-    sourceAdapter?(account: Account): SourceAdapter;
-    /**
-     * Provider-owned source policy for an opt-in multi-account pool.
-     * Omit when pooling is unsupported.
-     */
-    poolSourceAdapter?(): SourceAdapter;
-    /**
-     * Optional provider-owned backend for the unified Proxy Hub. Core owns local
-     * auth/routing only; each provider keeps its protocol translation and
-     * credential lifecycle behind this boundary.
-     */
-    createProxyHubBackend?(ctx: ProxyHubBackendContext): Promise<ProxyHubBackendHandle>;
-    /**
-     * Inspect the currently active (live) auth on this machine.
-     * Must not throw for "not logged in" — return present: false.
-     */
-    detectLive(): Promise<LiveAuthStatus>;
-    /**
-     * Read usage for the currently live local login only. Implementations must
-     * not restore, inspect, or authenticate with a saved AnyPick snapshot.
-     */
-    liveUsage?(): Promise<LiveUsage | null>;
-    /**
-     * Copy live auth material into `destDir`.
-     * `destDir` is empty and already created by the store.
-     * Return display fields that should be merged into AccountMeta.
-     */
-    backup(destDir: string): Promise<SnapshotMeta>;
-    /**
-     * Credential kinds this provider accepts as direct user input, e.g.
-     * `['api-key']`. Declaring one is what makes `backupInput` reachable from the
-     * CLI, so core can validate a request without knowing the provider.
-     */
-    readonly credentialInputs?: readonly string[];
-    /**
-     * Non-secret qualifiers a credential kind accepts, in the order a caller
-     * should ask for them. The TUI turns each into a picker and the CLI into a
-     * flag, so a provider that needs one does not have to be special-cased.
-     */
-    credentialInputFields?(kind: string): readonly CredentialInputField[];
-    /**
-     * Write a snapshot from credential material the user supplied, rather than
-     * from a live login. There is nothing on disk to detect first, so core skips
-     * the live-auth gate for this path — the provider must validate the input
-     * itself and throw if it is unusable.
-     */
-    backupInput?(input: CredentialInput, destDir: string): Promise<SnapshotMeta>;
-    /**
-     * Optional source-parameterized liveness check. Providers that support more
-     * than one sign-in source (e.g. Gemini CLI vs Antigravity) implement this to
-     * detect a specific source on explicit user request. Sources that read the OS
-     * keychain must be gated here, never in detectLive() (which runs frequently).
-     */
-    detectLiveSource?(source: string): Promise<LiveAuthStatus>;
-    /**
-     * Optional source-parameterized backup, paired with detectLiveSource.
-     */
-    backupSource?(source: string, destDir: string): Promise<SnapshotMeta>;
-    /**
-     * Optional source-parameterized clear, paired with detectLiveSource. Without
-     * it, stashing a non-default source would wipe the wrong credential store and
-     * leave the chosen source still signed in.
-     */
-    clearLiveSource?(source: string): Promise<void>;
-    /**
-     * Restore auth material from `srcDir` (a previous backup) into live paths.
-     * Should overwrite live auth atomically where practical.
-     */
-    restore(srcDir: string): Promise<void>;
-    /**
-     * Optional mutation-free restore guard.
-     *
-     * Core calls this before taking a live-auth checkpoint or stopping proxies,
-     * so an unsafe external owner can reject the switch without triggering a
-     * rollback for work that never started.
-     */
-    preflightRestore?(srcDir: string): Promise<void>;
-    /**
-     * Optional status for an external application that owns the live credential.
-     * TUI previews use this to explain a required quit before the user commits,
-     * instead of discovering the requirement as an operational error.
-     */
-    restoreOwnerStatus?(srcDir: string): Promise<RestoreOwnerStatus | null>;
-    /**
-     * Optional account-source label when one provider manages multiple native
-     * products. This keeps product identity out of core and TUI conditionals.
-     */
-    accountSource?(srcDir: string): Promise<AccountSourceDescriptor>;
-    /** Source label for a live login that has not been saved to a snapshot yet. */
-    liveAccountSource?(live: LiveAuthStatus): Promise<AccountSourceDescriptor>;
-    /**
-     * Optional: read identity/label from an existing snapshot without restoring.
-     */
-    describeSnapshot?(srcDir: string): Promise<SnapshotMeta>;
-    /**
-     * Remove live auth files so the tool thinks you are logged out,
-     * WITHOUT calling the provider logout/revoke endpoint.
-     * Tokens in anypick snapshots stay valid for later restore.
-     */
-    clearLive?(): Promise<void>;
-    /**
-     * Refresh OAuth/OIDC tokens for auth material under `authDir`
-     * (a snapshot directory containing provider auth files, e.g. auth.json).
-     * Mutates files in place. Return updated display fields if known.
-     */
-    refreshAuth?(authDir: string): Promise<SnapshotMeta>;
-    /**
-     * Determine whether the auth material in `snapshotDir` is the currently
-     * live (active) login for this provider.
-     *
-     * Providers own this comparison because only they know the shape of their
-     * own credentials and which field (refresh_token, account_id, API key bag…)
-     * is authoritative for "same login". The default core path falls back to an
-     * email/identity string comparison when a provider does not implement this.
-     *
-     * Returning `false` must never throw — a missing or unreadable snapshot is
-     * simply "not the live login".
-     */
-    snapshotMatchesLive?(snapshotDir: string): Promise<boolean>;
-    /**
-     * Start the compatibility proxy for this account.
-     * Presence of this method indicates proxy capability (replaces supportsProxy).
-     * Only called when the account has proxy enabled.
-     *
-     * Idempotency contract: a second call while a healthy process for this
-     * account already exists must NOT spawn a second orphaned child. This
-     * guarantee is enforced by `ProxyService.startProxyInternal` (it reuses the
-     * existing pid via the pid-file check), not by this method — so implementors
-     * may call `provider.startProxy` directly only when they own the lifecycle.
-     */
-    startProxy?(ctx: ProxyContext): Promise<ProxyHandle>;
-    /**
-     * Stop the compatibility proxy for this account if running.
-     * Must not throw if already stopped.
-     */
-    stopProxy?(ctx: ProxyContext): Promise<void>;
-    /**
-     * Report whether the proxy is running and its endpoint.
-     * Core falls back to pid-file heuristics if omitted.
-     */
-    proxyStatus?(ctx: ProxyContext): Promise<ProxyStatus>;
-    /**
-     * Return recent log text for `proxy logs`.
-     * Core falls back to reading `runtimeDir/proxy.log` if omitted.
-     */
-    readProxyLogs?(ctx: ProxyContext, lines?: number): Promise<string>;
-}
-export interface AnyPickConfig {
-    /** Absolute path to the anypick data root. Default: ~/.anypick */
-    rootDir: string;
-}
-export declare const DEFAULT_PROXY_CONFIG: AccountProxyConfig;
-/** Protocol family for client adapters. */
-//# sourceMappingURL=account.d.ts.map

package/dist/types/account.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../src/types/account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEjF;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,yDAAyD;IACzD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;CAC1C;AAED,iFAAiF;AACjF,MAAM,MAAM,YAAY,GAAG,OAAO,CAChC,IAAI,CAAC,WAAW,EAAE,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,gBAAgB,CAAC,CACrE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,OAAO,EAAE,OAAO,CAAC;IACjB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,WAAW,CAAC;IAClB,gEAAgE;IAChE,WAAW,EAAE,MAAM,CAAC;IACpB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,KAAK,EAAE,kBAAkB,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,OAAO,EAAE,OAAO,CAAC;IACjB,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,oFAAoF;AACpF,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd,6DAA6D;IAC7D,gBAAgB,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,kFAAkF;AAClF,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,eAAe,EAAE,CAAC;CAC5B;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC;IACnB,mCAAmC;IACnC,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,iDAAiD;AACjD,MAAM,WAAW,WAAW;IAC1B,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,yEAAyE;AACzE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,uEAAuE;AACvE,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,QAAS,SAAQ,WAAW;IAC3C,mEAAmE;IACnE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,qEAAqE;IACrE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE5B;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAE7C;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAEvC;;;;;;;OAOG;IACH,iBAAiB,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEtF;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAEnC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAErC;;;;OAIG;IACH,aAAa,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAAC;IAEhD;;;OAGG;IACH,iBAAiB,CAAC,IAAI,aAAa,CAAC;IAEpC;;;;OAIG;IACH,qBAAqB,CAAC,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAEpF;;;OAGG;IACH,UAAU,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAEtC;;;OAGG;IACH,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE/C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAE9C;;;;OAIG;IACH,qBAAqB,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,oBAAoB,EAAE,CAAC;IAEtE;;;;;OAKG;IACH,WAAW,CAAC,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7E;;;;;OAKG;IACH,gBAAgB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAE3D;;OAEG;IACH,YAAY,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAEtE;;;;OAIG;IACH,eAAe,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhD;;;OAGG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvC;;;;;;OAMG;IACH,gBAAgB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD;;;;OAIG;IACH,kBAAkB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IAExE;;;OAGG;IACH,aAAa,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEjE,+EAA+E;IAC/E,iBAAiB,CAAC,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE3E;;OAEG;IACH,gBAAgB,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAEzD;;;;OAIG;IACH,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5B;;;;OAIG;IACH,WAAW,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAErD;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5D;;;;;;;;;;OAUG;IACH,UAAU,CAAC,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAErD;;;OAGG;IACH,SAAS,CAAC,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C;;;OAGG;IACH,WAAW,CAAC,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAEtD;;;OAGG;IACH,aAAa,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACpE;AAED,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,oBAAoB,EAAE,kBAElC,CAAC;AAIF,2CAA2C"}

package/dist/types/account.js

@@ -1,7 +0,0 @@
-//#region src/types/account.ts
-var DEFAULT_PROXY_CONFIG = { enabled: false };
-/** Protocol family for client adapters. */
-//#endregion
-export { DEFAULT_PROXY_CONFIG };
-
-//# sourceMappingURL=account.js.map

package/dist/types/account.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"account.js","names":[],"sources":["../../src/types/account.ts"],"sourcesContent":["import type { SourceAdapter } from './bindings';\nimport type { ModelPolicy } from './catalog';\nimport type { ProxyHubBackendContext, ProxyHubBackendHandle } from './proxy-hub';\n\n/**\n * Metadata stored alongside each saved account snapshot.\n * Secrets live only in the snapshot files, never in meta.\n */\nexport interface AccountMeta {\n  /** Stable account name (slug), unique within a provider. */\n  name: string;\n  /** Provider id this account belongs to. */\n  provider: string;\n  /** When the snapshot was first created (ISO 8601). */\n  createdAt: string;\n  /** When the snapshot was last updated (ISO 8601). */\n  updatedAt: string;\n  /** Optional human label shown in list/interactive UI. */\n  label?: string;\n  /** Best-effort identity hint (email, account id) for display. */\n  identity?: string;\n  /** Free-form notes. */\n  notes?: string;\n  /**\n   * How this account's credential relates to the machine. Absent means\n   * `native`: a snapshot of the provider's own login file, which activation\n   * restores over the live credential.\n   *\n   * `proxy-only` is credential material the user supplied directly — an API key,\n   * say — that never occupies that file. Such an account can never be \"live\",\n   * must not be restored over a native login, and must not absorb a refreshed\n   * live token; it is reachable only through the provider's proxy.\n   */\n  credentialKind?: 'native' | 'proxy-only';\n}\n\n/** Fields a provider may contribute to AccountMeta when it writes a snapshot. */\nexport type SnapshotMeta = Partial<\n  Pick<AccountMeta, 'identity' | 'label' | 'notes' | 'credentialKind'>\n>;\n\n/**\n * Credential material typed by the user rather than read from a live login.\n *\n * The provider decides what a kind means and what it writes; core only carries\n * the value through to `backupInput` and never logs or persists it in meta.\n */\nexport interface CredentialInput {\n  /** Provider-declared kind, e.g. `api-key`. */\n  kind: string;\n  /** The secret itself. */\n  secret: string;\n  /** Non-secret qualifiers the provider understands, e.g. `{ region }`. */\n  options?: Record<string, string>;\n}\n\n/**\n * One non-secret qualifier a credential input accepts, described well enough for\n * a caller to offer the values without knowing the provider.\n *\n * `choices` are values the provider knows are real, but a caller may pass\n * something else: these lists go stale as vendors add regions. The point is that\n * a picker beats free text for a field where a plausible-looking typo yields an\n * account that starts and then cannot serve a single request.\n */\nexport interface CredentialInputField {\n  /** Key under `CredentialInput.options`, e.g. `region`. */\n  name: string;\n  label: string;\n  choices: readonly string[];\n  default?: string;\n}\n\n/**\n * Per-account proxy configuration (stored separately from secrets).\n * Provider-specific knobs go in `options`.\n */\nexport interface AccountProxyConfig {\n  /** When true, switching to / activating this account starts the proxy. */\n  enabled: boolean;\n  /** Preferred listen port (provider may fall back if busy). */\n  port?: number;\n  /** Preferred listen host (default typically 127.0.0.1). */\n  host?: string;\n  /** Opaque provider-specific options. */\n  options?: Record<string, unknown>;\n}\n\n/**\n * A saved account: metadata + path to the opaque snapshot directory.\n */\nexport interface Account {\n  meta: AccountMeta;\n  /** Absolute path to the snapshot directory for this account. */\n  snapshotDir: string;\n  /** Absolute path to the account directory (meta + snapshot + proxy). */\n  accountDir: string;\n  /** Per-account proxy configuration (defaults to disabled). */\n  proxy: AccountProxyConfig;\n}\n\n/**\n * Result of inspecting the live (active) auth state on disk.\n */\nexport interface LiveAuthStatus {\n  /** Whether live auth material appears to be present. */\n  present: boolean;\n  /** Optional identity extracted from live auth (email, etc.). */\n  identity?: string;\n  /** Optional extra display details. */\n  details?: string;\n  /**\n   * Stable provider account id when known (e.g. ChatGPT `account_id`).\n   * Used for live matching when session tokens and display emails disagree.\n   */\n  accountId?: string;\n}\n\n/** A provider-reported rate-limit window for the account currently live on disk. */\nexport interface LiveUsageWindow {\n  /** Short, provider-defined label such as \"5h\" or \"weekly\". */\n  label: string;\n  /** Percentage of this window that remains, from 0 to 100. */\n  remainingPercent: number;\n  /** Optional epoch milliseconds when the window resets. */\n  resetsAtMs?: number;\n}\n\n/** Best-effort usage snapshot. It is never read from a saved account snapshot. */\nexport interface LiveUsage {\n  windows: LiveUsageWindow[];\n}\n\n/** Context passed to provider proxy lifecycle methods. */\nexport interface ProxyContext {\n  providerId: string;\n  accountName: string;\n  /** Snapshot directory for this account (read-only for proxy). */\n  snapshotDir: string;\n  /**\n   * Writable runtime directory for this account's proxy\n   * (pid file, logs, state). Unique per provider+account.\n   */\n  runtimeDir: string;\n  /** Account proxy configuration. */\n  config: AccountProxyConfig;\n  /**\n   * Per-instance high-entropy secret required on every credentialed route.\n   * Generated once per proxy lifecycle; transmitted to the child only via the\n   * `ANYPICK_PROXY_TOKEN` env var. Never logged or returned in status.\n   */\n  token?: string;\n}\n\n/** Returned when a proxy successfully starts. */\nexport interface ProxyHandle {\n  /** Local endpoint clients should use, e.g. http://127.0.0.1:8080 */\n  endpoint: string;\n  /** Human-readable protocol compatibility label. */\n  compatibility?: string;\n  /** OS process id if the proxy is a child process. */\n  pid?: number;\n  /** Opaque instance id (PROC-01) used to prove ownership via health echo. */\n  instanceId?: string;\n  /**\n   * Per-instance high-entropy secret (PROXY-01) accepted on every credentialed\n   * route. Transient — present only on the freshly started handle so the\n   * caller (executor) can bind it into client config. Never persisted beyond\n   * `proxy_state` and never returned in status/doctor.\n   */\n  token?: string;\n  /** Lease created for this lifecycle operation. */\n  leaseId?: string;\n  /** True only when this call spawned a new child process. */\n  startedNow?: boolean;\n  /** Path to the proxy log file, if any. */\n  logPath?: string;\n  /**\n   * Clients whose native config (e.g. ~/.claude/settings.json) was rewritten\n   * to this endpoint after a start/port bump.\n   */\n  realignedClients?: string[];\n}\n\n/** Status of a provider account's proxy. */\nexport interface ProxyStatus {\n  enabled: boolean;\n  running: boolean;\n  /** Configured listen port (always set when known). */\n  port?: number;\n  /** Configured listen host (default 127.0.0.1). */\n  host?: string;\n  endpoint?: string;\n  compatibility?: string;\n  pid?: number;\n  logPath?: string;\n  detail?: string;\n}\n\n/** External application that must release live auth before a restore. */\nexport interface RestoreOwnerStatus {\n  name: string;\n  running: boolean;\n}\n\n/** Human-facing native source represented by one provider snapshot. */\nexport interface AccountSourceDescriptor {\n  id: string;\n  name: string;\n}\n\n/**\n * Provider contract.\n *\n * Each provider owns:\n * - where live auth lives on the machine\n * - how to copy it into a snapshot directory (backup)\n * - how to write a snapshot back to live paths (restore)\n * - optionally, a compatibility proxy lifecycle\n *\n * Snapshots are opaque directories. The core store never interprets\n * provider-specific secret formats beyond what describe* returns.\n * Proxy logic is entirely provider-specific; core only orchestrates.\n */\nexport interface Provider extends ModelPolicy {\n  /** Stable machine id used in paths and CLI args (e.g. \"codex\"). */\n  readonly id: string;\n  /** Human-readable name (e.g. \"OpenAI Codex\"). */\n  readonly name: string;\n  /** One-line description for help text. */\n  readonly description: string;\n\n  /** Short UI label for lists and status lines. Defaults to `name`. */\n  readonly shortName?: string;\n\n  /**\n   * When true, the TUI/CLI account-add flow offers a multi-source picker before\n   * mode selection (e.g. Gemini CLI vs Antigravity). Driven by the provider so\n   * UI surfaces never hardcode provider ids.\n   */\n  readonly requiresAccountSourcePick?: boolean;\n\n  /**\n   * True when the compatibility proxy needs an API key from the snapshot and\n   * cannot be driven from an OAuth-only login. Callers gate the proxy on this\n   * instead of consulting a hardcoded provider-id set.\n   */\n  readonly proxyRequiresApiKey?: boolean;\n\n  /**\n   * Report whether `snapshotDir` carries the API key material this provider's\n   * proxy needs. Only consulted when `proxyRequiresApiKey` is true.\n   *\n   * Providers own this because only they know where the key lives inside their\n   * own snapshot layout. Returning a `hint` lets the UI explain what to do\n   * without core knowing anything about the provider's file format.\n   */\n  proxyApiKeyStatus?(snapshotDir: string): Promise<{ present: boolean; hint?: string }>;\n\n  /**\n   * Default listen port when enabling proxy without an explicit `-p`.\n   * Used as the base for auto-allocation to avoid collisions.\n   * Proxy capability is determined by presence of startProxy(), not a boolean flag.\n   */\n  readonly defaultProxyPort?: number;\n\n  /**\n   * Optional short label for what the proxy speaks\n   * (e.g. \"OpenAI API\", \"Anthropic + OpenAI API\").\n   */\n  readonly proxyCompatibility?: string;\n\n  /**\n   * Provider-owned source policy. Implement this instead of relying on core\n   * provider-id conditionals when an account supports direct or proxy-backed\n   * activation. The returned adapter is scoped to one saved account.\n   */\n  sourceAdapter?(account: Account): SourceAdapter;\n\n  /**\n   * Provider-owned source policy for an opt-in multi-account pool.\n   * Omit when pooling is unsupported.\n   */\n  poolSourceAdapter?(): SourceAdapter;\n\n  /**\n   * Optional provider-owned backend for the unified Proxy Hub. Core owns local\n   * auth/routing only; each provider keeps its protocol translation and\n   * credential lifecycle behind this boundary.\n   */\n  createProxyHubBackend?(ctx: ProxyHubBackendContext): Promise<ProxyHubBackendHandle>;\n\n  /**\n   * Inspect the currently active (live) auth on this machine.\n   * Must not throw for \"not logged in\" — return present: false.\n   */\n  detectLive(): Promise<LiveAuthStatus>;\n\n  /**\n   * Read usage for the currently live local login only. Implementations must\n   * not restore, inspect, or authenticate with a saved AnyPick snapshot.\n   */\n  liveUsage?(): Promise<LiveUsage | null>;\n\n  /**\n   * Copy live auth material into `destDir`.\n   * `destDir` is empty and already created by the store.\n   * Return display fields that should be merged into AccountMeta.\n   */\n  backup(destDir: string): Promise<SnapshotMeta>;\n\n  /**\n   * Credential kinds this provider accepts as direct user input, e.g.\n   * `['api-key']`. Declaring one is what makes `backupInput` reachable from the\n   * CLI, so core can validate a request without knowing the provider.\n   */\n  readonly credentialInputs?: readonly string[];\n\n  /**\n   * Non-secret qualifiers a credential kind accepts, in the order a caller\n   * should ask for them. The TUI turns each into a picker and the CLI into a\n   * flag, so a provider that needs one does not have to be special-cased.\n   */\n  credentialInputFields?(kind: string): readonly CredentialInputField[];\n\n  /**\n   * Write a snapshot from credential material the user supplied, rather than\n   * from a live login. There is nothing on disk to detect first, so core skips\n   * the live-auth gate for this path — the provider must validate the input\n   * itself and throw if it is unusable.\n   */\n  backupInput?(input: CredentialInput, destDir: string): Promise<SnapshotMeta>;\n\n  /**\n   * Optional source-parameterized liveness check. Providers that support more\n   * than one sign-in source (e.g. Gemini CLI vs Antigravity) implement this to\n   * detect a specific source on explicit user request. Sources that read the OS\n   * keychain must be gated here, never in detectLive() (which runs frequently).\n   */\n  detectLiveSource?(source: string): Promise<LiveAuthStatus>;\n\n  /**\n   * Optional source-parameterized backup, paired with detectLiveSource.\n   */\n  backupSource?(source: string, destDir: string): Promise<SnapshotMeta>;\n\n  /**\n   * Optional source-parameterized clear, paired with detectLiveSource. Without\n   * it, stashing a non-default source would wipe the wrong credential store and\n   * leave the chosen source still signed in.\n   */\n  clearLiveSource?(source: string): Promise<void>;\n\n  /**\n   * Restore auth material from `srcDir` (a previous backup) into live paths.\n   * Should overwrite live auth atomically where practical.\n   */\n  restore(srcDir: string): Promise<void>;\n\n  /**\n   * Optional mutation-free restore guard.\n   *\n   * Core calls this before taking a live-auth checkpoint or stopping proxies,\n   * so an unsafe external owner can reject the switch without triggering a\n   * rollback for work that never started.\n   */\n  preflightRestore?(srcDir: string): Promise<void>;\n\n  /**\n   * Optional status for an external application that owns the live credential.\n   * TUI previews use this to explain a required quit before the user commits,\n   * instead of discovering the requirement as an operational error.\n   */\n  restoreOwnerStatus?(srcDir: string): Promise<RestoreOwnerStatus | null>;\n\n  /**\n   * Optional account-source label when one provider manages multiple native\n   * products. This keeps product identity out of core and TUI conditionals.\n   */\n  accountSource?(srcDir: string): Promise<AccountSourceDescriptor>;\n\n  /** Source label for a live login that has not been saved to a snapshot yet. */\n  liveAccountSource?(live: LiveAuthStatus): Promise<AccountSourceDescriptor>;\n\n  /**\n   * Optional: read identity/label from an existing snapshot without restoring.\n   */\n  describeSnapshot?(srcDir: string): Promise<SnapshotMeta>;\n\n  /**\n   * Remove live auth files so the tool thinks you are logged out,\n   * WITHOUT calling the provider logout/revoke endpoint.\n   * Tokens in anypick snapshots stay valid for later restore.\n   */\n  clearLive?(): Promise<void>;\n\n  /**\n   * Refresh OAuth/OIDC tokens for auth material under `authDir`\n   * (a snapshot directory containing provider auth files, e.g. auth.json).\n   * Mutates files in place. Return updated display fields if known.\n   */\n  refreshAuth?(authDir: string): Promise<SnapshotMeta>;\n\n  /**\n   * Determine whether the auth material in `snapshotDir` is the currently\n   * live (active) login for this provider.\n   *\n   * Providers own this comparison because only they know the shape of their\n   * own credentials and which field (refresh_token, account_id, API key bag…)\n   * is authoritative for \"same login\". The default core path falls back to an\n   * email/identity string comparison when a provider does not implement this.\n   *\n   * Returning `false` must never throw — a missing or unreadable snapshot is\n   * simply \"not the live login\".\n   */\n  snapshotMatchesLive?(snapshotDir: string): Promise<boolean>;\n\n  /**\n   * Start the compatibility proxy for this account.\n   * Presence of this method indicates proxy capability (replaces supportsProxy).\n   * Only called when the account has proxy enabled.\n   *\n   * Idempotency contract: a second call while a healthy process for this\n   * account already exists must NOT spawn a second orphaned child. This\n   * guarantee is enforced by `ProxyService.startProxyInternal` (it reuses the\n   * existing pid via the pid-file check), not by this method — so implementors\n   * may call `provider.startProxy` directly only when they own the lifecycle.\n   */\n  startProxy?(ctx: ProxyContext): Promise<ProxyHandle>;\n\n  /**\n   * Stop the compatibility proxy for this account if running.\n   * Must not throw if already stopped.\n   */\n  stopProxy?(ctx: ProxyContext): Promise<void>;\n\n  /**\n   * Report whether the proxy is running and its endpoint.\n   * Core falls back to pid-file heuristics if omitted.\n   */\n  proxyStatus?(ctx: ProxyContext): Promise<ProxyStatus>;\n\n  /**\n   * Return recent log text for `proxy logs`.\n   * Core falls back to reading `runtimeDir/proxy.log` if omitted.\n   */\n  readProxyLogs?(ctx: ProxyContext, lines?: number): Promise<string>;\n}\n\nexport interface AnyPickConfig {\n  /** Absolute path to the anypick data root. Default: ~/.anypick */\n  rootDir: string;\n}\n\nexport const DEFAULT_PROXY_CONFIG: AccountProxyConfig = {\n  enabled: false,\n};\n\n// ── API provider catalog (runtime profiles) ──────────────────────\n\n/** Protocol family for client adapters. */\n"],"mappings":";AAscA,IAAa,uBAA2C,EACtD,SAAS,MACX"}