anypick 1.0.0 → 1.1.0

package/dist/core/proxy-service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"proxy-service.js","names":[],"sources":["../../src/core/proxy-service.ts"],"sourcesContent":["/**\n * Proxy lifecycle ownership (start/stop/status/logs) and multi-account pool\n * management for account-backed proxies.\n *\n * This was extracted from AccountService so that proxy concerns live in their\n * own collaborator: a Provider owns *where* live auth lives and how to\n * snapshot/restore it; this service owns *how a running proxy for that account\n * is orchestrated*. Client-config realignment (writing BASE_URL into bound\n * clients) is injected as RealignProxyClientsDeps rather than imported, so the\n * proxy service stays below the binding/runtime subsystems.\n *\n * Listen-port selection lives in `ProxyPortAllocator` (proxy-ports.ts), and the\n * lease table is a constructor dependency — both were previously inlined here,\n * which made this class impossible to construct in a test without also standing\n * up the whole app graph.\n */\n\nimport type {\n  AccountProxyConfig,\n  Provider,\n  ProviderProxyPool,\n  ProxyContext,\n  ProxyHandle,\n  ProxyStatus,\n} from '../types';\nimport { AnyPickError } from '../utils/errors';\nimport { normalizeAccountName } from '../utils/slug';\nimport { ensureDir, pathExists } from '../utils/fs';\nimport {\n  followFile,\n  isListenPortFree,\n  isProcessRunning,\n  readPidFile,\n  readPidRecord,\n} from '../utils/process';\nimport type { ProviderRegistry } from './registry';\nimport type { AccountStore } from './store';\nimport type { LeaseStore } from './lease-store';\nimport { accountSnapshotDir } from './paths';\nimport { PoolStore, poolRuntimeDir } from './pool-store';\nimport {\n  realignClientsToAccountProxy,\n  type RealignProxyClientsDeps,\n} from './realign-proxy-clients';\nimport { providerCanProxy } from './capabilities';\nimport { ProxyPortAllocator, validatePort } from './proxy-ports';\nimport { readFile } from 'node:fs/promises';\nimport { randomBytes } from 'node:crypto';\nimport { assertLoopbackHost } from '../utils/network';\nimport { withMutationLock } from './mutation-lock';\nimport type { QuotaGuardPolicy } from '../types';\nimport { readQuotaGuardState, type QuotaGuardEvent } from '../providers/quota-guard';\n\n/** Best-effort port extraction from an endpoint like http://127.0.0.1:8080. */\nfunction portFromEndpoint(endpoint: string): number {\n  const m = /:(\\d+)(?:\\/|$)/.exec(endpoint);\n  return m ? Number(m[1]) : 8080;\n}\n\n/**\n * A single-account proxy is never a pool member, so pool options must not reach\n * it. Older versions persisted `authDirs` onto the primary account's config and\n * nothing removed them when the pool went back to single mode; `authDirs` then\n * takes precedence over the account's own snapshot dir, so the proxy serves\n * whichever account happened to be primary. Dropping them on read retires those\n * records without a migration.\n */\nfunction withoutPoolOptions(config: AccountProxyConfig): AccountProxyConfig {\n  if (!config.options) {\n    return { ...config };\n  }\n  const { pool: _pool, authDirs: _authDirs, ...options } = config.options;\n  return { ...config, options };\n}\n\n/**\n * Owns proxy lifecycle and multi-account pools.\n * Constructed by the app composition root and exposed as `app.proxy`.\n */\nexport class ProxyService {\n  readonly pools: PoolStore;\n  /**\n   * Optional dependency used when a proxy starts: realign bound clients'\n   * BASE_URLs to the new endpoint. Injected at construction (composition time)\n   * rather than wired afterwards, so the service has no upward dependency on\n   * the app graph.\n   */\n  private readonly realign?: RealignProxyClientsDeps;\n  /**\n   * Lease table. Every proxy started through this service records a lease keyed\n   * to the owning process, so `reapStaleLeases` can stop orphaned proxies on the\n   * next startup — not just proxies started by the activation pipeline.\n   *\n   * Optional so a caller can build a proxy service without lease bookkeeping,\n   * but supplied at construction: it used to be wired by `setLeaseStore()` after\n   * the fact, which meant the service was observably half-built between the two\n   * calls and could not be constructed in a test without replaying that dance.\n   */\n  private readonly leases?: LeaseStore;\n  /** Listen-port allocation (see proxy-ports.ts). */\n  private readonly ports: ProxyPortAllocator;\n\n  constructor(\n    private readonly store: AccountStore,\n    private readonly registry: ProviderRegistry,\n    pools?: PoolStore,\n    realign?: RealignProxyClientsDeps,\n    leases?: LeaseStore,\n    private readonly quotaGuardPolicy: () => Promise<QuotaGuardPolicy> = async () => ({\n      enabled: false,\n      cooldownMinutes: 60,\n    }),\n  ) {\n    this.pools = pools ?? new PoolStore(store.root, store.db);\n    this.realign = realign;\n    this.leases = leases;\n    this.ports = new ProxyPortAllocator(registry, store);\n  }\n\n  /**\n   * Optional re-publisher for the live Codex config block, wired in app.ts so this\n   * service does not depend on Hub/Codex services it was not constructed with.\n   */\n  private codexLiveConfigSync?: () => Promise<void>;\n\n  setCodexLiveConfigSync(fn: () => Promise<void>): void {\n    this.codexLiveConfigSync = fn;\n  }\n\n  private async syncCodexLiveConfig(): Promise<void> {\n    try {\n      await this.codexLiveConfigSync?.();\n    } catch {\n      // Best-effort: a failed live-block refresh must never fail a proxy op.\n    }\n  }\n\n  /**\n   * Record a lease for a freshly started proxy owned by this process, replacing\n   * any prior lease for the same provider/account. No-op when no lease store is\n   * wired. Best-effort: lease bookkeeping must never fail a proxy start.\n   */\n  private recordLease(\n    provider: string,\n    account: string | undefined,\n    handle: ProxyHandle,\n    forcedOwnerPid?: number,\n  ): string | undefined {\n    if (!this.leases) {\n      return undefined;\n    }\n    try {\n      const previous = this.leases.findByProviderAccount(provider, account);\n      // Preserve a live supervisor (tray) owner. Legacy leases used the child\n      // proxy PID itself; those are deliberately replaced by the real owner.\n      const ownerPid =\n        forcedOwnerPid ??\n        (previous && previous.ownerPid !== handle.pid && isProcessRunning(previous.ownerPid)\n          ? previous.ownerPid\n          : process.pid);\n      this.leases.releaseByProviderAccount(provider, account);\n      const lease = this.leases.create({\n        provider,\n        account,\n        port: portFromEndpoint(handle.endpoint),\n        endpoint: handle.endpoint,\n        ownerPid,\n        instanceId: handle.instanceId,\n      });\n      handle.leaseId = lease.leaseId;\n      return lease.leaseId;\n    } catch {\n      // lease bookkeeping is best-effort\n      return undefined;\n    }\n  }\n\n  /** Release the lease for a stopped proxy. No-op without a lease store. */\n  private releaseLease(provider: string, account?: string): void {\n    if (!this.leases) {\n      return;\n    }\n    try {\n      this.leases.releaseByProviderAccount(provider, account);\n    } catch {\n      // best-effort\n    }\n  }\n\n  provider(id: string): Provider {\n    return this.registry.get(id);\n  }\n\n  listProviders(): Provider[] {\n    return this.registry.list();\n  }\n\n  // ── Multi-account proxy pool (opt-in; default is single) ────────\n\n  async getPool(providerId: string): Promise<ProviderProxyPool> {\n    this.requireProxyProvider(providerId);\n    const accounts = await this.store.listAccounts(providerId);\n    return this.pools.syncMembers(\n      providerId,\n      accounts.map((a) => a.meta.name),\n    );\n  }\n\n  /** Opt-in multi-account pool for a provider. */\n  async enablePoolMulti(\n    providerId: string,\n    opts: { port?: number; host?: string; start?: boolean } = {},\n  ): Promise<{ pool: ProviderProxyPool; started?: ProxyHandle }> {\n    const provider = this.requireProxyProvider(providerId);\n    const accounts = await this.store.listAccounts(providerId);\n    if (accounts.length === 0) {\n      throw new AnyPickError(`No saved logins for ${providerId}. Save one first.`, 'NO_ACCOUNTS');\n    }\n    const port = validatePort(opts.port ?? provider.defaultProxyPort ?? 8080);\n    assertLoopbackHost(opts.host ?? '127.0.0.1');\n    const pool = await this.pools.enableMulti(\n      providerId,\n      accounts.map((a) => a.meta.name),\n      { port, host: opts.host ?? '127.0.0.1' },\n    );\n    let started: ProxyHandle | undefined;\n    if (opts.start !== false) {\n      started = await this.startPoolProxy(providerId);\n    }\n    return { pool, started };\n  }\n\n  /** Back to per-account proxies (default). Stops pool process if running. */\n  async disablePoolMulti(providerId: string): Promise<ProviderProxyPool> {\n    this.requireProxyProvider(providerId);\n    try {\n      await this.stopPoolProxy(providerId);\n    } catch {\n      // ignore\n    }\n    return this.pools.disableMulti(providerId);\n  }\n\n  async setPoolMemberEnabled(\n    providerId: string,\n    account: string,\n    enabled: boolean,\n  ): Promise<ProviderProxyPool> {\n    this.requireProxyProvider(providerId);\n    const name = normalizeAccountName(account);\n    await this.store.requireAccount(providerId, name);\n    const pool = await this.pools.setMemberEnabled(providerId, name, enabled);\n    // Hot-reload pool if multi + running\n    if (pool.mode === 'multi' && pool.enabled) {\n      const st = await this.poolProxyStatus(providerId);\n      if (st.running) {\n        await this.startPoolProxy(providerId);\n      }\n    }\n    return pool;\n  }\n\n  async startPoolProxy(providerId: string): Promise<ProxyHandle> {\n    const provider = this.requireProxyProvider(providerId);\n    const pool = await this.getPool(providerId);\n    if (pool.mode !== 'multi') {\n      throw new AnyPickError(\n        `Pool multi-mode is off for ${providerId} (default is single account). Enable with: anypick proxy pool enable ${providerId}`,\n        'POOL_NOT_ENABLED',\n      );\n    }\n    const enabled = pool.members.filter((m) => m.enabled);\n    if (enabled.length === 0) {\n      throw new AnyPickError(\n        `No enabled accounts in ${providerId} pool. Enable a member first.`,\n        'POOL_EMPTY',\n      );\n    }\n\n    const host = pool.host ?? '127.0.0.1';\n    assertLoopbackHost(host);\n    const port = validatePort(pool.port ?? provider.defaultProxyPort ?? 8080);\n\n    // Persist enabled + port\n    await this.pools.set({\n      ...pool,\n      enabled: true,\n      host,\n      port,\n    });\n\n    // Use first enabled account's proxy process; for Gemini pass all auth dirs\n    const primary = enabled[0];\n    const config: AccountProxyConfig = {\n      enabled: true,\n      host,\n      port,\n    };\n\n    // Ensure primary account proxy config matches pool port. The pool's auth\n    // dirs stay out of it: they are absolute paths under the data root and this\n    // record outlives both the data root (there is no ~/.rotate migration) and\n    // the pool itself, after which the primary's own single-account proxy would\n    // still be handed --auth-dirs, which wins over its snapshot dir.\n    await this.store.setProxyConfig(providerId, primary.account, config);\n\n    // Route pool runtime to shared dir for pid when multi\n    const runtimeDir = poolRuntimeDir(this.store.root, providerId);\n    await ensureDir(runtimeDir);\n\n    if (!provider.startProxy) {\n      throw new AnyPickError('PROXY_NOT_IMPLEMENTED', 'PROXY_NOT_IMPLEMENTED');\n    }\n\n    // Stop previous pool / primary proxy\n    try {\n      await this.stopPoolProxy(providerId);\n    } catch {\n      // ignore\n    }\n    try {\n      await this.stopProxyInternal(provider, primary.account);\n    } catch {\n      // ignore\n    }\n\n    const priorState = await this.store.readProxyState(providerId, primary.account);\n    const poolToken =\n      priorState?.token && priorState.token.length > 0\n        ? priorState.token\n        : randomBytes(32).toString('hex');\n    const quotaGuard = await this.quotaGuardPolicy();\n    const ctx: ProxyContext = {\n      providerId,\n      accountName: primary.account,\n      snapshotDir: accountSnapshotDir(this.store.root, providerId, primary.account),\n      runtimeDir,\n      config: {\n        ...config,\n        options: {\n          pool: true,\n          authDirs: enabled.map((m) => accountSnapshotDir(this.store.root, providerId, m.account)),\n          quotaGuardAccountNames: enabled.map((m) => m.account),\n          quotaGuard: {\n            enabled: quotaGuard.enabled,\n            cooldownMs: quotaGuard.cooldownMinutes * 60_000,\n          },\n        },\n      },\n      token: poolToken,\n    };\n    const handle = await provider.startProxy(ctx);\n    await this.store.writeProxyState(providerId, primary.account, {\n      accountName: primary.account,\n      endpoint: handle.endpoint,\n      compatibility: handle.compatibility ?? provider.proxyCompatibility,\n      pid: handle.pid,\n      logPath: handle.logPath,\n      startedAt: new Date().toISOString(),\n      token: poolToken,\n    });\n    this.recordLease(providerId, undefined, handle);\n    handle.startedNow = true;\n    return handle;\n  }\n\n  /** Restart only pools that are currently serving, after changing a pool-wide policy. */\n  async restartRunningPools(): Promise<void> {\n    for (const provider of this.registry.list().filter((entry) => providerCanProxy(entry))) {\n      try {\n        const pool = await this.getPool(provider.id);\n        const status = await this.poolProxyStatus(provider.id);\n        if (pool.mode === 'multi' && pool.enabled && status.running) {\n          await this.startPoolProxy(provider.id);\n        }\n      } catch {\n        // An unrelated provider must not prevent a setting from applying to its pool.\n      }\n    }\n  }\n\n  /** Secret-free audit events written by an enabled compatibility proxy pool. */\n  async quotaGuardEvents(): Promise<QuotaGuardEvent[]> {\n    const events: QuotaGuardEvent[] = [];\n    for (const provider of this.registry.list().filter((entry) => providerCanProxy(entry))) {\n      try {\n        const pool = await this.getPool(provider.id);\n        if (pool.mode !== 'multi') {\n          continue;\n        }\n        const state = await readQuotaGuardState(\n          `${poolRuntimeDir(this.store.root, provider.id)}/quota-guard.json`,\n        );\n        events.push(\n          ...state.events.map((event) => ({\n            ...event,\n            providerId: event.providerId ?? provider.id,\n          })),\n        );\n      } catch {\n        // Runtime observability is best-effort and must never make a proxy unavailable.\n      }\n    }\n    return events.toSorted((left, right) => right.createdAt.localeCompare(left.createdAt));\n  }\n\n  async stopPoolProxy(providerId: string): Promise<void> {\n    const provider = this.requireProxyProvider(providerId);\n    const pool = await this.pools.getOrDefault(providerId);\n    const primary = pool.members.find((m) => m.enabled)?.account;\n    const runtimeDir = poolRuntimeDir(this.store.root, providerId);\n    if (provider.stopProxy && primary) {\n      const config = await this.store.getProxyConfig(providerId, primary);\n      await provider.stopProxy({\n        providerId,\n        accountName: primary,\n        snapshotDir: accountSnapshotDir(this.store.root, providerId, primary),\n        runtimeDir,\n        config: { ...config, enabled: false },\n      });\n    }\n    this.releaseLease(providerId, undefined);\n  }\n\n  async poolProxyStatus(providerId: string): Promise<ProxyStatus> {\n    const provider = this.requireProxyProvider(providerId);\n    const pool = await this.pools.getOrDefault(providerId);\n    const primary = pool.members.find((m) => m.enabled)?.account;\n    if (!primary || pool.mode !== 'multi') {\n      return {\n        enabled: pool.mode === 'multi' && pool.enabled,\n        running: false,\n        detail: pool.mode === 'single' ? 'single-account mode' : 'no enabled members',\n      };\n    }\n    const runtimeDir = poolRuntimeDir(this.store.root, providerId);\n    const config = await this.store.getProxyConfig(providerId, primary);\n    if (provider.proxyStatus) {\n      return provider.proxyStatus({\n        providerId,\n        accountName: primary,\n        snapshotDir: accountSnapshotDir(this.store.root, providerId, primary),\n        runtimeDir,\n        config: {\n          ...config,\n          enabled: pool.enabled,\n          host: pool.host ?? config.host,\n          port: pool.port ?? config.port,\n        },\n      });\n    }\n    return {\n      enabled: pool.enabled,\n      running: false,\n    };\n  }\n\n  // ── Proxy commands ──────────────────────────────────────────────\n\n  requireProxyProvider(providerId: string): Provider {\n    const provider = this.registry.get(providerId);\n    if (!providerCanProxy(provider)) {\n      throw new AnyPickError(\n        `Provider \"${providerId}\" does not support a compatibility proxy.`,\n        'PROXY_UNSUPPORTED',\n      );\n    }\n    return provider;\n  }\n\n  async enableProxy(\n    providerId: string,\n    name: string,\n    opts: {\n      port?: number;\n      host?: string;\n      start?: boolean;\n      /** Provider options merge (e.g. opencode plan: zen|go). */\n      options?: Record<string, unknown>;\n    } = {},\n  ): Promise<{ config: AccountProxyConfig; started?: ProxyHandle }> {\n    const provider = this.requireProxyProvider(providerId);\n    const accountName = normalizeAccountName(name);\n    await this.store.requireAccount(providerId, accountName);\n\n    const existing = await this.store.getProxyConfig(providerId, accountName);\n    const port = await this.ports.resolve(provider, {\n      requested: opts.port,\n      existing: existing.port,\n      providerId,\n      accountName,\n    });\n    const config: AccountProxyConfig = {\n      ...existing,\n      enabled: true,\n      port,\n      host: opts.host ?? existing.host ?? '127.0.0.1',\n      options: opts.options != null ? { ...existing.options, ...opts.options } : existing.options,\n    };\n    assertLoopbackHost(config.host ?? '127.0.0.1');\n    await this.store.setProxyConfig(providerId, accountName, config);\n\n    let started: ProxyHandle | undefined;\n    const active = await this.store.getActive(providerId);\n    const shouldStart = opts.start !== false && active === accountName;\n    if (shouldStart) {\n      started = await this.startProxyInternal(provider, accountName, config);\n    }\n    void this.syncCodexLiveConfig();\n\n    return { config, started };\n  }\n\n  /** Restore a previously captured config without starting a process. Scoped\n   * ephemeral runs use this to avoid leaving an account auto-proxy enabled. */\n  async restoreProxyConfig(\n    providerId: string,\n    name: string,\n    config: AccountProxyConfig,\n  ): Promise<void> {\n    const accountName = normalizeAccountName(name);\n    await this.store.requireAccount(providerId, accountName);\n    await this.store.setProxyConfig(providerId, accountName, config);\n  }\n\n  /**\n   * Update proxy listen port/host without toggling enabled.\n   * Restarts the proxy if it is currently running.\n   */\n  async configureProxy(\n    providerId: string,\n    name: string,\n    opts: {\n      port?: number;\n      host?: string;\n      restart?: boolean;\n      /** Provider options merge (e.g. opencode plan: zen|go). */\n      options?: Record<string, unknown>;\n    } = {},\n  ): Promise<{\n    config: AccountProxyConfig;\n    restarted?: ProxyHandle;\n    wasRunning: boolean;\n  }> {\n    const provider = this.requireProxyProvider(providerId);\n    const accountName = normalizeAccountName(name);\n    await this.store.requireAccount(providerId, accountName);\n\n    if (opts.port == null && opts.host == null && opts.options == null) {\n      throw new AnyPickError(\n        'Pass --port and/or --host to configure the proxy.',\n        'PROXY_CONFIG_EMPTY',\n      );\n    }\n\n    const existing = await this.store.getProxyConfig(providerId, accountName);\n    let port: number;\n    if (opts.port != null) {\n      port = validatePort(opts.port);\n      await this.ports.assertAvailable(port, providerId, accountName);\n    } else if (existing.port != null) {\n      port = existing.port;\n    } else {\n      port = await this.ports.allocateFrom(\n        provider.defaultProxyPort ?? 8080,\n        providerId,\n        accountName,\n      );\n    }\n\n    const config: AccountProxyConfig = {\n      ...existing,\n      port,\n      host: opts.host ?? existing.host ?? '127.0.0.1',\n      options: opts.options != null ? { ...existing.options, ...opts.options } : existing.options,\n    };\n    assertLoopbackHost(config.host ?? '127.0.0.1');\n    await this.store.setProxyConfig(providerId, accountName, config);\n\n    const before = await this.proxyStatus(providerId, accountName);\n    const wasRunning = before.running;\n    let restarted: ProxyHandle | undefined;\n    if (wasRunning && opts.restart !== false) {\n      await this.stopProxyInternal(provider, accountName);\n      restarted = await this.startProxyInternal(provider, accountName, config);\n    }\n    void this.syncCodexLiveConfig();\n\n    return { config, restarted, wasRunning };\n  }\n\n  async disableProxy(providerId: string, name: string): Promise<AccountProxyConfig> {\n    const provider = this.requireProxyProvider(providerId);\n    const accountName = normalizeAccountName(name);\n    await this.store.requireAccount(providerId, accountName);\n\n    const existing = await this.store.getProxyConfig(providerId, accountName);\n    const config: AccountProxyConfig = { ...existing, enabled: false };\n    await this.store.setProxyConfig(providerId, accountName, config);\n\n    await this.stopProxyInternal(provider, accountName);\n    void this.syncCodexLiveConfig();\n    return config;\n  }\n\n  async startProxy(\n    providerId: string,\n    name?: string,\n    opts: { port?: number; host?: string } = {},\n  ): Promise<ProxyHandle> {\n    const provider = this.requireProxyProvider(providerId);\n    const accountName = name\n      ? normalizeAccountName(name)\n      : await this.requireActiveName(providerId);\n\n    const account = await this.store.requireAccount(providerId, accountName);\n    assertLoopbackHost(opts.host ?? account.proxy.host ?? '127.0.0.1');\n    if (!account.proxy.enabled) {\n      throw new AnyPickError(\n        `Proxy is not enabled for ${providerId}/${accountName}. Run: anypick proxy enable ${providerId} ${accountName}`,\n        'PROXY_DISABLED',\n      );\n    }\n\n    let config = account.proxy;\n    if (opts.port != null || opts.host != null) {\n      let port: number;\n      if (opts.port != null) {\n        port = validatePort(opts.port);\n        await this.ports.assertAvailable(port, providerId, accountName);\n      } else if (config.port != null) {\n        port = config.port;\n      } else {\n        port = await this.ports.allocateFrom(\n          provider.defaultProxyPort ?? 8080,\n          providerId,\n          accountName,\n        );\n      }\n      config = {\n        ...config,\n        port,\n        host: opts.host ?? config.host ?? '127.0.0.1',\n      };\n      await this.store.setProxyConfig(providerId, accountName, config);\n    } else if (config.port == null) {\n      // Legacy configs without a port: allocate and persist so restarts stay stable\n      const port = await this.ports.resolve(provider, {\n        providerId,\n        accountName,\n      });\n      config = { ...config, port, host: config.host ?? '127.0.0.1' };\n      await this.store.setProxyConfig(providerId, accountName, config);\n    }\n\n    const handle = await this.startProxyInternal(provider, accountName, config);\n    void this.syncCodexLiveConfig();\n    return handle;\n  }\n\n  async stopProxy(providerId: string, name?: string): Promise<void> {\n    const provider = this.requireProxyProvider(providerId);\n    const accountName = name\n      ? normalizeAccountName(name)\n      : await this.requireActiveName(providerId);\n    await this.store.requireAccount(providerId, accountName);\n    await this.stopProxyInternal(provider, accountName);\n    void this.syncCodexLiveConfig();\n  }\n\n  async proxyStatus(providerId: string, name?: string): Promise<ProxyStatus> {\n    const provider = this.requireProxyProvider(providerId);\n    const accountName = name\n      ? normalizeAccountName(name)\n      : await this.requireActiveName(providerId);\n\n    const account = await this.store.requireAccount(providerId, accountName);\n    const ctx = this.buildProxyContext(providerId, accountName, account.proxy);\n    const host = account.proxy.host ?? '127.0.0.1';\n    const port = account.proxy.port ?? provider.defaultProxyPort ?? undefined;\n\n    let status: ProxyStatus;\n    if (provider.proxyStatus) {\n      status = await provider.proxyStatus(ctx);\n    } else {\n      // Default: pid file + saved state\n      const pid = await readPidFile(this.store.pidPath(providerId, accountName));\n      const running = pid != null && isProcessRunning(pid);\n      const state = await this.store.readProxyState(providerId, accountName);\n      const logPath = this.store.logPath(providerId, accountName);\n\n      status = {\n        enabled: account.proxy.enabled,\n        running,\n        endpoint: running ? state?.endpoint : undefined,\n        compatibility: running\n          ? (state?.compatibility ?? provider.proxyCompatibility)\n          : provider.proxyCompatibility,\n        pid: running ? (pid ?? undefined) : undefined,\n        logPath: (await pathExists(logPath)) ? logPath : undefined,\n        detail: running ? undefined : account.proxy.enabled ? 'stopped' : 'disabled',\n      };\n    }\n\n    // Always surface configured bind address (even when stopped). When the\n    // provider selected a different port (for example after a collision),\n    // proxy_state is authoritative while that exact process is alive. TUI and\n    // client realignment must probe the endpoint the child actually owns.\n    status.port = port;\n    status.host = host;\n    if (status.running && status.pid != null) {\n      const runtimeState = await this.store.readProxyState(providerId, accountName);\n      if (runtimeState?.pid === status.pid && runtimeState.endpoint) {\n        status.endpoint = runtimeState.endpoint;\n        status.port = portFromEndpoint(runtimeState.endpoint);\n        try {\n          status.host = new URL(runtimeState.endpoint).hostname;\n        } catch {\n          // Keep the configured host for malformed legacy state.\n        }\n      }\n    }\n    if (!status.endpoint && status.running && port != null) {\n      status.endpoint = `http://${host}:${port}`;\n    }\n    return status;\n  }\n\n  async proxyLogs(providerId: string, name?: string, lines = 50): Promise<string> {\n    const provider = this.requireProxyProvider(providerId);\n    const accountName = name\n      ? normalizeAccountName(name)\n      : await this.requireActiveName(providerId);\n\n    const account = await this.store.requireAccount(providerId, accountName);\n    const ctx = this.buildProxyContext(providerId, accountName, account.proxy);\n\n    if (provider.readProxyLogs) {\n      return provider.readProxyLogs(ctx, lines);\n    }\n\n    const logPath = this.store.logPath(providerId, accountName);\n    if (!(await pathExists(logPath))) {\n      return '(no log file yet)';\n    }\n    const raw = await readFile(logPath, 'utf8');\n    const all = raw.split(/\\r?\\n/);\n    return all.slice(Math.max(0, all.length - lines)).join('\\n');\n  }\n\n  /**\n   * Stream proxy logs live (tail -f style). Calls `onLine` for each new line\n   * and resolves when `signal` aborts. Returns immediately if no log file yet.\n   */\n  async proxyLogsFollow(\n    providerId: string,\n    name: string | undefined,\n    onLine: (line: string) => void,\n    opts: { lines?: number; signal?: AbortSignal } = {},\n  ): Promise<void> {\n    const accountName = name\n      ? normalizeAccountName(name)\n      : await this.requireActiveName(providerId);\n    const logPath = this.store.logPath(providerId, accountName);\n\n    if (!(await pathExists(logPath))) {\n      onLine('(waiting for log file…)');\n    }\n\n    // Print the current tail first so the user has context.\n    if (opts.lines && (await pathExists(logPath))) {\n      const raw = await readFile(logPath, 'utf8');\n      const all = raw\n        .split('\\n')\n        .map((l) => l.replace(/\\r$/, ''))\n        .filter(Boolean);\n      for (const l of all.slice(Math.max(0, all.length - opts.lines))) {\n        onLine(l);\n      }\n    }\n\n    const onAbort = () => {};\n    opts.signal?.addEventListener('abort', onAbort);\n\n    try {\n      await followFile(logPath, onLine, opts.signal);\n    } finally {\n      opts.signal?.removeEventListener('abort', onAbort);\n    }\n  }\n\n  /**\n   * List proxy-capable accounts (for `anypick proxy` / status).\n   * If provider omitted → all proxy providers. If name omitted → active or all enabled.\n   */\n  async listProxyRows(providerId?: string): Promise<\n    Array<{\n      provider: string;\n      name: string;\n      active: boolean;\n      status: ProxyStatus;\n    }>\n  > {\n    const providers = providerId\n      ? [this.requireProxyProvider(providerId)]\n      : this.registry.list().filter((p) => providerCanProxy(p));\n\n    const rows = [];\n    for (const p of providers) {\n      const active = await this.store.getActive(p.id);\n      const accounts = await this.store.listAccounts(p.id);\n      for (const a of accounts) {\n        // Show active always; others only if proxy enabled or running\n        const status = await this.proxyStatus(p.id, a.meta.name).catch(\n          (): ProxyStatus => ({\n            enabled: a.proxy.enabled,\n            running: false,\n            detail: 'unavailable',\n          }),\n        );\n        if (a.meta.name === active || a.proxy.enabled || status.running) {\n          rows.push({\n            provider: p.id,\n            name: a.meta.name,\n            active: a.meta.name === active,\n            status,\n          });\n        }\n      }\n    }\n    return rows;\n  }\n\n  /**\n   * Start proxies. No args → active account on each proxy provider (if enabled).\n   */\n  async startProxies(\n    providerId?: string,\n    name?: string,\n  ): Promise<\n    Array<{\n      provider: string;\n      name: string;\n      ok: boolean;\n      endpoint?: string;\n      realignedClients?: string[];\n      error?: string;\n    }>\n  > {\n    const targets = await this.resolveProxyTargets(providerId, name, {\n      requireEnabled: true,\n      preferActive: !name,\n    });\n    const out: Array<{\n      provider: string;\n      name: string;\n      ok: boolean;\n      endpoint?: string;\n      realignedClients?: string[];\n      error?: string;\n    }> = [];\n    for (const t of targets) {\n      try {\n        const handle = await this.startProxy(t.provider, t.name);\n        out.push({\n          provider: t.provider,\n          name: t.name,\n          ok: true,\n          endpoint: handle.endpoint,\n          realignedClients: handle.realignedClients,\n        });\n      } catch (err) {\n        out.push({\n          provider: t.provider,\n          name: t.name,\n          ok: false,\n          error: err instanceof Error ? err.message : String(err),\n        });\n      }\n    }\n    return out;\n  }\n\n  async stopProxies(\n    providerId?: string,\n    name?: string,\n  ): Promise<Array<{ provider: string; name: string; ok: boolean; error?: string }>> {\n    const targets = await this.resolveProxyTargets(providerId, name, {\n      requireEnabled: false,\n      preferActive: !name,\n      runningOnly: !name && !providerId,\n    });\n    const out = [];\n    for (const t of targets) {\n      try {\n        await this.stopProxy(t.provider, t.name);\n        out.push({ provider: t.provider, name: t.name, ok: true });\n      } catch (err) {\n        out.push({\n          provider: t.provider,\n          name: t.name,\n          ok: false,\n          error: err instanceof Error ? err.message : String(err),\n        });\n      }\n    }\n    return out;\n  }\n\n  /** Transfer all currently running proxy leases to a long-lived supervisor. */\n  async adoptRunningProxies(ownerPid = process.pid): Promise<number> {\n    let adopted = 0;\n    for (const row of await this.listProxyRows()) {\n      const { status } = row;\n      if (!status.running || status.pid == null || !status.endpoint) {\n        continue;\n      }\n      this.recordLease(\n        row.provider,\n        row.name,\n        {\n          endpoint: status.endpoint,\n          compatibility: status.compatibility,\n          pid: status.pid,\n          logPath: status.logPath,\n        },\n        ownerPid,\n      );\n      adopted += 1;\n    }\n    for (const provider of this.registry.list().filter((item) => providerCanProxy(item))) {\n      try {\n        const status = await this.poolProxyStatus(provider.id);\n        if (!status.running || status.pid == null || !status.endpoint) {\n          continue;\n        }\n        this.recordLease(\n          provider.id,\n          undefined,\n          {\n            endpoint: status.endpoint,\n            compatibility: status.compatibility,\n            pid: status.pid,\n            logPath: status.logPath,\n          },\n          ownerPid,\n        );\n        adopted += 1;\n      } catch {\n        // Provider has no configured pool.\n      }\n    }\n    return adopted;\n  }\n\n  // ── Internals (also used by AccountService for switch/stash/delete) ──\n\n  /** Stop a proxy during account lifecycle ops (switch/stash/delete). */\n  async stopProxyForAccount(provider: Provider, accountName: string): Promise<void> {\n    await this.stopProxyInternal(provider, accountName);\n    void this.syncCodexLiveConfig();\n  }\n\n  /** Start a proxy as part of account switch (when enabled). */\n  async startProxyForAccount(\n    provider: Provider,\n    accountName: string,\n    config: AccountProxyConfig,\n  ): Promise<{ endpoint?: string; running: boolean; error?: string }> {\n    if (!providerCanProxy(provider) || !config.enabled) {\n      return { running: false };\n    }\n    try {\n      const handle = await this.startProxyInternal(provider, accountName, config);\n      void this.syncCodexLiveConfig();\n      return {\n        endpoint: handle.endpoint,\n        running: true,\n      };\n    } catch (err) {\n      return {\n        running: false,\n        error: err instanceof Error ? err.message : String(err),\n      };\n    }\n  }\n\n  private async resolveProxyTargets(\n    providerId: string | undefined,\n    name: string | undefined,\n    opts: {\n      requireEnabled: boolean;\n      preferActive: boolean;\n      runningOnly?: boolean;\n    },\n  ): Promise<Array<{ provider: string; name: string }>> {\n    if (providerId && name) {\n      this.requireProxyProvider(providerId);\n      await this.store.requireAccount(providerId, normalizeAccountName(name));\n      return [{ provider: providerId, name: normalizeAccountName(name) }];\n    }\n\n    if (providerId) {\n      const p = this.requireProxyProvider(providerId);\n      if (opts.preferActive) {\n        const active = await this.store.getActive(p.id);\n        if (active) {\n          const acc = await this.store.requireAccount(p.id, active);\n          if (!opts.requireEnabled || acc.proxy.enabled) {\n            return [{ provider: p.id, name: active }];\n          }\n        }\n      }\n      const accounts = await this.store.listAccounts(p.id);\n      return accounts\n        .filter((a) => !opts.requireEnabled || a.proxy.enabled)\n        .map((a) => ({ provider: p.id, name: a.meta.name }));\n    }\n\n    // All proxy providers\n    const providers = this.registry.list().filter((p) => providerCanProxy(p));\n    const targets: Array<{ provider: string; name: string }> = [];\n    for (const p of providers) {\n      if (opts.runningOnly) {\n        const accounts = await this.store.listAccounts(p.id);\n        for (const account of accounts) {\n          const status = await this.proxyStatus(p.id, account.meta.name);\n          if (status.running) {\n            targets.push({ provider: p.id, name: account.meta.name });\n          }\n        }\n        continue;\n      }\n      const active = await this.store.getActive(p.id);\n      if (active) {\n        const acc = await this.store.getAccount(p.id, active);\n        if (!acc) {\n          continue;\n        }\n        if (!opts.requireEnabled || acc.proxy.enabled) {\n          targets.push({ provider: p.id, name: active });\n        }\n      }\n    }\n    return targets;\n  }\n\n  private async requireActiveName(providerId: string): Promise<string> {\n    const active = await this.store.getActive(providerId);\n    if (!active) {\n      throw new AnyPickError(\n        `No active account for \"${providerId}\". Pass an account name.`,\n        'NO_ACTIVE_ACCOUNT',\n      );\n    }\n    return active;\n  }\n\n  private buildProxyContext(\n    providerId: string,\n    accountName: string,\n    config: AccountProxyConfig,\n    token?: string,\n  ): ProxyContext {\n    return {\n      providerId,\n      accountName,\n      snapshotDir: accountSnapshotDir(this.store.root, providerId, accountName),\n      runtimeDir: this.store.runtimeDir(providerId, accountName),\n      config,\n      token,\n    };\n  }\n\n  private async startProxyInternal(\n    provider: Provider,\n    accountName: string,\n    config: AccountProxyConfig,\n  ): Promise<ProxyHandle> {\n    return withMutationLock(this.store.root, `proxy/${provider.id}/${accountName}`, () =>\n      this.startProxyInternalUnlocked(provider, accountName, config),\n    );\n  }\n\n  private async startProxyInternalUnlocked(\n    provider: Provider,\n    accountName: string,\n    config: AccountProxyConfig,\n  ): Promise<ProxyHandle> {\n    if (!provider.startProxy) {\n      throw new AnyPickError(\n        `Provider \"${provider.id}\" declares proxy support but does not implement startProxy().`,\n        'PROXY_NOT_IMPLEMENTED',\n      );\n    }\n\n    let effective = withoutPoolOptions(config);\n    const host = effective.host ?? '127.0.0.1';\n    assertLoopbackHost(host);\n    let port = effective.port ?? provider.defaultProxyPort ?? 8080;\n    const pidPath = this.store.pidPath(provider.id, accountName);\n    const existingPid = await readPidFile(pidPath);\n    const previousState = await this.store.readProxyState(provider.id, accountName);\n\n    // Per-instance high-entropy secret (PROXY-01). Reuse a prior token so a\n    // process-reuse realign binds clients to the already-running child's secret.\n    const proxyToken =\n      previousState?.token && previousState.token.length > 0\n        ? previousState.token\n        : randomBytes(32).toString('hex');\n\n    // Already healthy on our pid → reuse process, still realign clients (port/config drift)\n    if (existingPid != null && isProcessRunning(existingPid) && port !== 0) {\n      const candidates = [previousState?.endpoint, `http://${host}:${port}`].filter(\n        (value, index, all): value is string => Boolean(value) && all.indexOf(value) === index,\n      );\n      for (const candidate of candidates) {\n        try {\n          const { waitForHttp } = await import('../utils/process');\n          const ok = await waitForHttp(candidate, {\n            timeoutMs: 800,\n            requirePid: existingPid,\n          });\n          if (!ok) {\n            continue;\n          }\n          const actual = new URL(candidate);\n          const actualHost = actual.hostname === '::1' ? '[::1]' : actual.hostname;\n          const actualPort = Number(actual.port);\n          if (actualPort > 0 && (actualPort !== port || actualHost !== host)) {\n            port = actualPort;\n            effective = { ...effective, port, host: actualHost };\n            await this.store.setProxyConfig(provider.id, accountName, effective);\n          }\n          const handle: ProxyHandle = {\n            endpoint: candidate,\n            compatibility: provider.proxyCompatibility,\n            pid: existingPid,\n            logPath: this.store.logPath(provider.id, accountName),\n            startedNow: false,\n            token: proxyToken,\n          };\n          await this.store.writeProxyState(provider.id, accountName, {\n            accountName,\n            endpoint: handle.endpoint,\n            compatibility: handle.compatibility,\n            pid: handle.pid,\n            logPath: handle.logPath,\n            startedAt: new Date().toISOString(),\n            token: proxyToken,\n          });\n          handle.realignedClients = await this.realignBoundClients(\n            provider.id,\n            accountName,\n            handle.endpoint,\n            proxyToken,\n          );\n          this.recordLease(provider.id, accountName, handle);\n          return handle;\n        } catch {\n          // Try the next known endpoint before replacing the child.\n        }\n      }\n      // Only stop *our* pid file process (never foreign listeners)\n      await this.stopProxyInternalUnlocked(provider, accountName);\n    } else if (existingPid != null) {\n      // Stale pid file\n      await this.stopProxyInternalUnlocked(provider, accountName);\n    }\n\n    // Port taken (by anyone) → bump to next free port. Never kill foreign processes.\n    if (port !== 0 && !(await isListenPortFree(port, host))) {\n      const next = await this.ports.allocateFrom(port + 1, provider.id, accountName);\n      effective = { ...effective, port: next, host };\n      await this.store.setProxyConfig(provider.id, accountName, effective);\n      port = next;\n    } else if (effective.port == null) {\n      effective = { ...effective, port, host };\n      await this.store.setProxyConfig(provider.id, accountName, effective);\n    }\n\n    const ctx = this.buildProxyContext(provider.id, accountName, effective, proxyToken);\n    const handle = await provider.startProxy(ctx);\n\n    // Child died immediately — don't claim success on someone else's health endpoint\n    if (handle.pid != null && !isProcessRunning(handle.pid)) {\n      // Port race: try once more on next free port\n      if (port !== 0) {\n        const next = await this.ports.allocateFrom(port + 1, provider.id, accountName);\n        effective = { ...effective, port: next, host };\n        await this.store.setProxyConfig(provider.id, accountName, effective);\n        const retry = await provider.startProxy(\n          this.buildProxyContext(provider.id, accountName, effective, proxyToken),\n        );\n        if (retry.pid != null && isProcessRunning(retry.pid)) {\n          await this.store.writeProxyState(provider.id, accountName, {\n            accountName,\n            endpoint: retry.endpoint,\n            compatibility: retry.compatibility ?? provider.proxyCompatibility,\n            pid: retry.pid,\n            logPath: retry.logPath ?? this.store.logPath(provider.id, accountName),\n            startedAt: new Date().toISOString(),\n            token: proxyToken,\n          });\n          retry.startedNow = true;\n          retry.token = proxyToken;\n          this.recordLease(provider.id, accountName, retry);\n          retry.realignedClients = await this.realignBoundClients(\n            provider.id,\n            accountName,\n            retry.endpoint,\n            proxyToken,\n          );\n          return retry;\n        }\n      }\n      throw new AnyPickError(\n        `Proxy for ${provider.id}/${accountName} failed to bind (tried port ${port}). Check: anypick proxy logs ${provider.id} ${accountName}`,\n        'PROXY_START_FAILED',\n      );\n    }\n\n    await this.store.writeProxyState(provider.id, accountName, {\n      accountName,\n      endpoint: handle.endpoint,\n      compatibility: handle.compatibility ?? provider.proxyCompatibility,\n      pid: handle.pid,\n      logPath: handle.logPath ?? this.store.logPath(provider.id, accountName),\n      startedAt: new Date().toISOString(),\n      token: proxyToken,\n    });\n\n    handle.startedNow = true;\n    this.recordLease(provider.id, accountName, handle);\n\n    handle.realignedClients = await this.realignBoundClients(\n      provider.id,\n      accountName,\n      handle.endpoint,\n      proxyToken,\n    );\n    return handle;\n  }\n\n  /** Rewrite bound clients' BASE_URL to the live proxy endpoint. */\n  private async realignBoundClients(\n    providerId: string,\n    accountName: string,\n    endpoint: string,\n    token?: string,\n  ): Promise<string[]> {\n    if (!this.realign) {\n      return [];\n    }\n    try {\n      return await realignClientsToAccountProxy(\n        this.realign,\n        providerId,\n        accountName,\n        endpoint,\n        token,\n      );\n    } catch {\n      return [];\n    }\n  }\n\n  private async stopProxyInternal(provider: Provider, accountName: string): Promise<void> {\n    return withMutationLock(this.store.root, `proxy/${provider.id}/${accountName}`, () =>\n      this.stopProxyInternalUnlocked(provider, accountName),\n    );\n  }\n\n  private async stopProxyInternalUnlocked(provider: Provider, accountName: string): Promise<void> {\n    const config = await this.store.getProxyConfig(provider.id, accountName);\n    const ctx = this.buildProxyContext(provider.id, accountName, config);\n\n    const pidPath = this.store.pidPath(provider.id, accountName);\n    const before = await readPidRecord(pidPath);\n    if (provider.stopProxy) {\n      await provider.stopProxy(ctx);\n    } else {\n      // Generic pid-file stop if provider did not implement stopProxy\n      const { stopPidFile } = await import('../utils/process');\n      await stopPidFile(this.store.pidPath(provider.id, accountName));\n    }\n\n    // A provider may fail closed when it cannot verify PID ownership. Do not\n    // erase state/leases in that case: an orphaned credential-bearing proxy is\n    // safer to diagnose than to forget.\n    if (before && isProcessRunning(before.pid)) {\n      // In-process providers (including the test fake) share the CLI PID, so\n      // PID liveness alone cannot tell whether their server has stopped.\n      // Ask a provider-specific status probe when available; detached providers\n      // still fail closed if their recorded process remains alive.\n      const status = provider.proxyStatus ? await provider.proxyStatus(ctx) : undefined;\n      if (!status || status.running) {\n        throw new AnyPickError(\n          `Could not verify that the ${provider.name} proxy stopped (pid ${before.pid}).`,\n          {\n            code: 'PROXY_STOP_UNVERIFIED',\n            suggestions: ['Run anypick doctor to inspect the proxy record before retrying.'],\n          },\n        );\n      }\n    }\n\n    await this.store.clearProxyState(provider.id, accountName);\n    this.releaseLease(provider.id, accountName);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAsDA,SAAS,iBAAiB,UAA0B;CAClD,MAAM,IAAI,iBAAiB,KAAK,QAAQ;CACxC,OAAO,IAAI,OAAO,EAAE,EAAE,IAAI;AAC5B;;;;;;;;;AAUA,SAAS,mBAAmB,QAAgD;CAC1E,IAAI,CAAC,OAAO,SACV,OAAO,EAAE,GAAG,OAAO;CAErB,MAAM,EAAE,MAAM,OAAO,UAAU,WAAW,GAAG,YAAY,OAAO;CAChE,OAAO;EAAE,GAAG;EAAQ;CAAQ;AAC9B;;;;;AAMA,IAAa,eAAb,MAA0B;CAwBL;CACA;CAIA;CA5BnB;;;;;;;CAOA;;;;;;;;;;;CAWA;;CAEA;CAEA,YACE,OACA,UACA,OACA,SACA,QACA,mBAAqE,aAAa;EAChF,SAAS;EACT,iBAAiB;CACnB,IACA;EATiB,KAAA,QAAA;EACA,KAAA,WAAA;EAIA,KAAA,mBAAA;EAKjB,KAAK,QAAQ,SAAS,IAAI,UAAU,MAAM,MAAM,MAAM,EAAE;EACxD,KAAK,UAAU;EACf,KAAK,SAAS;EACd,KAAK,QAAQ,IAAI,mBAAmB,UAAU,KAAK;CACrD;;;;;CAMA;CAEA,uBAAuB,IAA+B;EACpD,KAAK,sBAAsB;CAC7B;CAEA,MAAc,sBAAqC;EACjD,IAAI;GACF,MAAM,KAAK,sBAAsB;EACnC,QAAQ,CAER;CACF;;;;;;CAOA,YACE,UACA,SACA,QACA,gBACoB;EACpB,IAAI,CAAC,KAAK,QACR;EAEF,IAAI;GACF,MAAM,WAAW,KAAK,OAAO,sBAAsB,UAAU,OAAO;GAGpE,MAAM,WACJ,mBACC,YAAY,SAAS,aAAa,OAAO,OAAO,iBAAiB,SAAS,QAAQ,IAC/E,SAAS,WACT,QAAQ;GACd,KAAK,OAAO,yBAAyB,UAAU,OAAO;GACtD,MAAM,QAAQ,KAAK,OAAO,OAAO;IAC/B;IACA;IACA,MAAM,iBAAiB,OAAO,QAAQ;IACtC,UAAU,OAAO;IACjB;IACA,YAAY,OAAO;GACrB,CAAC;GACD,OAAO,UAAU,MAAM;GACvB,OAAO,MAAM;EACf,QAAQ;GAEN;EACF;CACF;;CAGA,aAAqB,UAAkB,SAAwB;EAC7D,IAAI,CAAC,KAAK,QACR;EAEF,IAAI;GACF,KAAK,OAAO,yBAAyB,UAAU,OAAO;EACxD,QAAQ,CAER;CACF;CAEA,SAAS,IAAsB;EAC7B,OAAO,KAAK,SAAS,IAAI,EAAE;CAC7B;CAEA,gBAA4B;EAC1B,OAAO,KAAK,SAAS,KAAK;CAC5B;CAIA,MAAM,QAAQ,YAAgD;EAC5D,KAAK,qBAAqB,UAAU;EACpC,MAAM,WAAW,MAAM,KAAK,MAAM,aAAa,UAAU;EACzD,OAAO,KAAK,MAAM,YAChB,YACA,SAAS,KAAK,MAAM,EAAE,KAAK,IAAI,CACjC;CACF;;CAGA,MAAM,gBACJ,YACA,OAA0D,CAAC,GACE;EAC7D,MAAM,WAAW,KAAK,qBAAqB,UAAU;EACrD,MAAM,WAAW,MAAM,KAAK,MAAM,aAAa,UAAU;EACzD,IAAI,SAAS,WAAW,GACtB,MAAM,IAAI,aAAa,uBAAuB,WAAW,oBAAoB,aAAa;EAE5F,MAAM,OAAO,aAAa,KAAK,QAAQ,SAAS,oBAAoB,IAAI;EACxE,mBAAmB,KAAK,QAAQ,WAAW;EAC3C,MAAM,OAAO,MAAM,KAAK,MAAM,YAC5B,YACA,SAAS,KAAK,MAAM,EAAE,KAAK,IAAI,GAC/B;GAAE;GAAM,MAAM,KAAK,QAAQ;EAAY,CACzC;EACA,IAAI;EACJ,IAAI,KAAK,UAAU,OACjB,UAAU,MAAM,KAAK,eAAe,UAAU;EAEhD,OAAO;GAAE;GAAM;EAAQ;CACzB;;CAGA,MAAM,iBAAiB,YAAgD;EACrE,KAAK,qBAAqB,UAAU;EACpC,IAAI;GACF,MAAM,KAAK,cAAc,UAAU;EACrC,QAAQ,CAER;EACA,OAAO,KAAK,MAAM,aAAa,UAAU;CAC3C;CAEA,MAAM,qBACJ,YACA,SACA,SAC4B;EAC5B,KAAK,qBAAqB,UAAU;EACpC,MAAM,OAAO,qBAAqB,OAAO;EACzC,MAAM,KAAK,MAAM,eAAe,YAAY,IAAI;EAChD,MAAM,OAAO,MAAM,KAAK,MAAM,iBAAiB,YAAY,MAAM,OAAO;EAExE,IAAI,KAAK,SAAS,WAAW,KAAK;QAE5B,MADa,KAAK,gBAAgB,UAAU,EAAA,CACzC,SACL,MAAM,KAAK,eAAe,UAAU;EAAA;EAGxC,OAAO;CACT;CAEA,MAAM,eAAe,YAA0C;EAC7D,MAAM,WAAW,KAAK,qBAAqB,UAAU;EACrD,MAAM,OAAO,MAAM,KAAK,QAAQ,UAAU;EAC1C,IAAI,KAAK,SAAS,SAChB,MAAM,IAAI,aACR,8BAA8B,WAAW,uEAAuE,cAChH,kBACF;EAEF,MAAM,UAAU,KAAK,QAAQ,QAAQ,MAAM,EAAE,OAAO;EACpD,IAAI,QAAQ,WAAW,GACrB,MAAM,IAAI,aACR,0BAA0B,WAAW,gCACrC,YACF;EAGF,MAAM,OAAO,KAAK,QAAQ;EAC1B,mBAAmB,IAAI;EACvB,MAAM,OAAO,aAAa,KAAK,QAAQ,SAAS,oBAAoB,IAAI;EAGxE,MAAM,KAAK,MAAM,IAAI;GACnB,GAAG;GACH,SAAS;GACT;GACA;EACF,CAAC;EAGD,MAAM,UAAU,QAAQ;EACxB,MAAM,SAA6B;GACjC,SAAS;GACT;GACA;EACF;EAOA,MAAM,KAAK,MAAM,eAAe,YAAY,QAAQ,SAAS,MAAM;EAGnE,MAAM,aAAa,eAAe,KAAK,MAAM,MAAM,UAAU;EAC7D,MAAM,UAAU,UAAU;EAE1B,IAAI,CAAC,SAAS,YACZ,MAAM,IAAI,aAAa,yBAAyB,uBAAuB;EAIzE,IAAI;GACF,MAAM,KAAK,cAAc,UAAU;EACrC,QAAQ,CAER;EACA,IAAI;GACF,MAAM,KAAK,kBAAkB,UAAU,QAAQ,OAAO;EACxD,QAAQ,CAER;EAEA,MAAM,aAAa,MAAM,KAAK,MAAM,eAAe,YAAY,QAAQ,OAAO;EAC9E,MAAM,YACJ,YAAY,SAAS,WAAW,MAAM,SAAS,IAC3C,WAAW,QACX,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;EACpC,MAAM,aAAa,MAAM,KAAK,iBAAiB;EAC/C,MAAM,MAAoB;GACxB;GACA,aAAa,QAAQ;GACrB,aAAa,mBAAmB,KAAK,MAAM,MAAM,YAAY,QAAQ,OAAO;GAC5E;GACA,QAAQ;IACN,GAAG;IACH,SAAS;KACP,MAAM;KACN,UAAU,QAAQ,KAAK,MAAM,mBAAmB,KAAK,MAAM,MAAM,YAAY,EAAE,OAAO,CAAC;KACvF,wBAAwB,QAAQ,KAAK,MAAM,EAAE,OAAO;KACpD,YAAY;MACV,SAAS,WAAW;MACpB,YAAY,WAAW,kBAAkB;KAC3C;IACF;GACF;GACA,OAAO;EACT;EACA,MAAM,SAAS,MAAM,SAAS,WAAW,GAAG;EAC5C,MAAM,KAAK,MAAM,gBAAgB,YAAY,QAAQ,SAAS;GAC5D,aAAa,QAAQ;GACrB,UAAU,OAAO;GACjB,eAAe,OAAO,iBAAiB,SAAS;GAChD,KAAK,OAAO;GACZ,SAAS,OAAO;GAChB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,OAAO;EACT,CAAC;EACD,KAAK,YAAY,YAAY,KAAA,GAAW,MAAM;EAC9C,OAAO,aAAa;EACpB,OAAO;CACT;;CAGA,MAAM,sBAAqC;EACzC,KAAK,MAAM,YAAY,KAAK,SAAS,KAAK,CAAC,CAAC,QAAQ,UAAU,iBAAiB,KAAK,CAAC,GACnF,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,QAAQ,SAAS,EAAE;GAC3C,MAAM,SAAS,MAAM,KAAK,gBAAgB,SAAS,EAAE;GACrD,IAAI,KAAK,SAAS,WAAW,KAAK,WAAW,OAAO,SAClD,MAAM,KAAK,eAAe,SAAS,EAAE;EAEzC,QAAQ,CAER;CAEJ;;CAGA,MAAM,mBAA+C;EACnD,MAAM,SAA4B,CAAC;EACnC,KAAK,MAAM,YAAY,KAAK,SAAS,KAAK,CAAC,CAAC,QAAQ,UAAU,iBAAiB,KAAK,CAAC,GACnF,IAAI;GAEF,KAAI,MADe,KAAK,QAAQ,SAAS,EAAE,EAAA,CAClC,SAAS,SAChB;GAEF,MAAM,QAAQ,MAAM,oBAClB,GAAG,eAAe,KAAK,MAAM,MAAM,SAAS,EAAE,EAAE,kBAClD;GACA,OAAO,KACL,GAAG,MAAM,OAAO,KAAK,WAAW;IAC9B,GAAG;IACH,YAAY,MAAM,cAAc,SAAS;GAC3C,EAAE,CACJ;EACF,QAAQ,CAER;EAEF,OAAO,OAAO,UAAU,MAAM,UAAU,MAAM,UAAU,cAAc,KAAK,SAAS,CAAC;CACvF;CAEA,MAAM,cAAc,YAAmC;EACrD,MAAM,WAAW,KAAK,qBAAqB,UAAU;EAErD,MAAM,WAAU,MADG,KAAK,MAAM,aAAa,UAAU,EAAA,CAChC,QAAQ,MAAM,MAAM,EAAE,OAAO,CAAC,EAAE;EACrD,MAAM,aAAa,eAAe,KAAK,MAAM,MAAM,UAAU;EAC7D,IAAI,SAAS,aAAa,SAAS;GACjC,MAAM,SAAS,MAAM,KAAK,MAAM,eAAe,YAAY,OAAO;GAClE,MAAM,SAAS,UAAU;IACvB;IACA,aAAa;IACb,aAAa,mBAAmB,KAAK,MAAM,MAAM,YAAY,OAAO;IACpE;IACA,QAAQ;KAAE,GAAG;KAAQ,SAAS;IAAM;GACtC,CAAC;EACH;EACA,KAAK,aAAa,YAAY,KAAA,CAAS;CACzC;CAEA,MAAM,gBAAgB,YAA0C;EAC9D,MAAM,WAAW,KAAK,qBAAqB,UAAU;EACrD,MAAM,OAAO,MAAM,KAAK,MAAM,aAAa,UAAU;EACrD,MAAM,UAAU,KAAK,QAAQ,MAAM,MAAM,EAAE,OAAO,CAAC,EAAE;EACrD,IAAI,CAAC,WAAW,KAAK,SAAS,SAC5B,OAAO;GACL,SAAS,KAAK,SAAS,WAAW,KAAK;GACvC,SAAS;GACT,QAAQ,KAAK,SAAS,WAAW,wBAAwB;EAC3D;EAEF,MAAM,aAAa,eAAe,KAAK,MAAM,MAAM,UAAU;EAC7D,MAAM,SAAS,MAAM,KAAK,MAAM,eAAe,YAAY,OAAO;EAClE,IAAI,SAAS,aACX,OAAO,SAAS,YAAY;GAC1B;GACA,aAAa;GACb,aAAa,mBAAmB,KAAK,MAAM,MAAM,YAAY,OAAO;GACpE;GACA,QAAQ;IACN,GAAG;IACH,SAAS,KAAK;IACd,MAAM,KAAK,QAAQ,OAAO;IAC1B,MAAM,KAAK,QAAQ,OAAO;GAC5B;EACF,CAAC;EAEH,OAAO;GACL,SAAS,KAAK;GACd,SAAS;EACX;CACF;CAIA,qBAAqB,YAA8B;EACjD,MAAM,WAAW,KAAK,SAAS,IAAI,UAAU;EAC7C,IAAI,CAAC,iBAAiB,QAAQ,GAC5B,MAAM,IAAI,aACR,aAAa,WAAW,4CACxB,mBACF;EAEF,OAAO;CACT;CAEA,MAAM,YACJ,YACA,MACA,OAMI,CAAC,GAC2D;EAChE,MAAM,WAAW,KAAK,qBAAqB,UAAU;EACrD,MAAM,cAAc,qBAAqB,IAAI;EAC7C,MAAM,KAAK,MAAM,eAAe,YAAY,WAAW;EAEvD,MAAM,WAAW,MAAM,KAAK,MAAM,eAAe,YAAY,WAAW;EACxE,MAAM,OAAO,MAAM,KAAK,MAAM,QAAQ,UAAU;GAC9C,WAAW,KAAK;GAChB,UAAU,SAAS;GACnB;GACA;EACF,CAAC;EACD,MAAM,SAA6B;GACjC,GAAG;GACH,SAAS;GACT;GACA,MAAM,KAAK,QAAQ,SAAS,QAAQ;GACpC,SAAS,KAAK,WAAW,OAAO;IAAE,GAAG,SAAS;IAAS,GAAG,KAAK;GAAQ,IAAI,SAAS;EACtF;EACA,mBAAmB,OAAO,QAAQ,WAAW;EAC7C,MAAM,KAAK,MAAM,eAAe,YAAY,aAAa,MAAM;EAE/D,IAAI;EACJ,MAAM,SAAS,MAAM,KAAK,MAAM,UAAU,UAAU;EAEpD,IADoB,KAAK,UAAU,SAAS,WAAW,aAErD,UAAU,MAAM,KAAK,mBAAmB,UAAU,aAAa,MAAM;EAEvE,KAAU,oBAAoB;EAE9B,OAAO;GAAE;GAAQ;EAAQ;CAC3B;;;CAIA,MAAM,mBACJ,YACA,MACA,QACe;EACf,MAAM,cAAc,qBAAqB,IAAI;EAC7C,MAAM,KAAK,MAAM,eAAe,YAAY,WAAW;EACvD,MAAM,KAAK,MAAM,eAAe,YAAY,aAAa,MAAM;CACjE;;;;;CAMA,MAAM,eACJ,YACA,MACA,OAMI,CAAC,GAKJ;EACD,MAAM,WAAW,KAAK,qBAAqB,UAAU;EACrD,MAAM,cAAc,qBAAqB,IAAI;EAC7C,MAAM,KAAK,MAAM,eAAe,YAAY,WAAW;EAEvD,IAAI,KAAK,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,KAAK,WAAW,MAC5D,MAAM,IAAI,aACR,qDACA,oBACF;EAGF,MAAM,WAAW,MAAM,KAAK,MAAM,eAAe,YAAY,WAAW;EACxE,IAAI;EACJ,IAAI,KAAK,QAAQ,MAAM;GACrB,OAAO,aAAa,KAAK,IAAI;GAC7B,MAAM,KAAK,MAAM,gBAAgB,MAAM,YAAY,WAAW;EAChE,OAAO,IAAI,SAAS,QAAQ,MAC1B,OAAO,SAAS;OAEhB,OAAO,MAAM,KAAK,MAAM,aACtB,SAAS,oBAAoB,MAC7B,YACA,WACF;EAGF,MAAM,SAA6B;GACjC,GAAG;GACH;GACA,MAAM,KAAK,QAAQ,SAAS,QAAQ;GACpC,SAAS,KAAK,WAAW,OAAO;IAAE,GAAG,SAAS;IAAS,GAAG,KAAK;GAAQ,IAAI,SAAS;EACtF;EACA,mBAAmB,OAAO,QAAQ,WAAW;EAC7C,MAAM,KAAK,MAAM,eAAe,YAAY,aAAa,MAAM;EAG/D,MAAM,cAAa,MADE,KAAK,YAAY,YAAY,WAAW,EAAA,CACnC;EAC1B,IAAI;EACJ,IAAI,cAAc,KAAK,YAAY,OAAO;GACxC,MAAM,KAAK,kBAAkB,UAAU,WAAW;GAClD,YAAY,MAAM,KAAK,mBAAmB,UAAU,aAAa,MAAM;EACzE;EACA,KAAU,oBAAoB;EAE9B,OAAO;GAAE;GAAQ;GAAW;EAAW;CACzC;CAEA,MAAM,aAAa,YAAoB,MAA2C;EAChF,MAAM,WAAW,KAAK,qBAAqB,UAAU;EACrD,MAAM,cAAc,qBAAqB,IAAI;EAC7C,MAAM,KAAK,MAAM,eAAe,YAAY,WAAW;EAGvD,MAAM,SAA6B;GAAE,GAAG,MADjB,KAAK,MAAM,eAAe,YAAY,WAAW;GACtB,SAAS;EAAM;EACjE,MAAM,KAAK,MAAM,eAAe,YAAY,aAAa,MAAM;EAE/D,MAAM,KAAK,kBAAkB,UAAU,WAAW;EAClD,KAAU,oBAAoB;EAC9B,OAAO;CACT;CAEA,MAAM,WACJ,YACA,MACA,OAAyC,CAAC,GACpB;EACtB,MAAM,WAAW,KAAK,qBAAqB,UAAU;EACrD,MAAM,cAAc,OAChB,qBAAqB,IAAI,IACzB,MAAM,KAAK,kBAAkB,UAAU;EAE3C,MAAM,UAAU,MAAM,KAAK,MAAM,eAAe,YAAY,WAAW;EACvE,mBAAmB,KAAK,QAAQ,QAAQ,MAAM,QAAQ,WAAW;EACjE,IAAI,CAAC,QAAQ,MAAM,SACjB,MAAM,IAAI,aACR,4BAA4B,WAAW,GAAG,YAAY,8BAA8B,WAAW,GAAG,eAClG,gBACF;EAGF,IAAI,SAAS,QAAQ;EACrB,IAAI,KAAK,QAAQ,QAAQ,KAAK,QAAQ,MAAM;GAC1C,IAAI;GACJ,IAAI,KAAK,QAAQ,MAAM;IACrB,OAAO,aAAa,KAAK,IAAI;IAC7B,MAAM,KAAK,MAAM,gBAAgB,MAAM,YAAY,WAAW;GAChE,OAAO,IAAI,OAAO,QAAQ,MACxB,OAAO,OAAO;QAEd,OAAO,MAAM,KAAK,MAAM,aACtB,SAAS,oBAAoB,MAC7B,YACA,WACF;GAEF,SAAS;IACP,GAAG;IACH;IACA,MAAM,KAAK,QAAQ,OAAO,QAAQ;GACpC;GACA,MAAM,KAAK,MAAM,eAAe,YAAY,aAAa,MAAM;EACjE,OAAO,IAAI,OAAO,QAAQ,MAAM;GAE9B,MAAM,OAAO,MAAM,KAAK,MAAM,QAAQ,UAAU;IAC9C;IACA;GACF,CAAC;GACD,SAAS;IAAE,GAAG;IAAQ;IAAM,MAAM,OAAO,QAAQ;GAAY;GAC7D,MAAM,KAAK,MAAM,eAAe,YAAY,aAAa,MAAM;EACjE;EAEA,MAAM,SAAS,MAAM,KAAK,mBAAmB,UAAU,aAAa,MAAM;EAC1E,KAAU,oBAAoB;EAC9B,OAAO;CACT;CAEA,MAAM,UAAU,YAAoB,MAA8B;EAChE,MAAM,WAAW,KAAK,qBAAqB,UAAU;EACrD,MAAM,cAAc,OAChB,qBAAqB,IAAI,IACzB,MAAM,KAAK,kBAAkB,UAAU;EAC3C,MAAM,KAAK,MAAM,eAAe,YAAY,WAAW;EACvD,MAAM,KAAK,kBAAkB,UAAU,WAAW;EAClD,KAAU,oBAAoB;CAChC;CAEA,MAAM,YAAY,YAAoB,MAAqC;EACzE,MAAM,WAAW,KAAK,qBAAqB,UAAU;EACrD,MAAM,cAAc,OAChB,qBAAqB,IAAI,IACzB,MAAM,KAAK,kBAAkB,UAAU;EAE3C,MAAM,UAAU,MAAM,KAAK,MAAM,eAAe,YAAY,WAAW;EACvE,MAAM,MAAM,KAAK,kBAAkB,YAAY,aAAa,QAAQ,KAAK;EACzE,MAAM,OAAO,QAAQ,MAAM,QAAQ;EACnC,MAAM,OAAO,QAAQ,MAAM,QAAQ,SAAS,oBAAoB,KAAA;EAEhE,IAAI;EACJ,IAAI,SAAS,aACX,SAAS,MAAM,SAAS,YAAY,GAAG;OAClC;GAEL,MAAM,MAAM,MAAM,YAAY,KAAK,MAAM,QAAQ,YAAY,WAAW,CAAC;GACzE,MAAM,UAAU,OAAO,QAAQ,iBAAiB,GAAG;GACnD,MAAM,QAAQ,MAAM,KAAK,MAAM,eAAe,YAAY,WAAW;GACrE,MAAM,UAAU,KAAK,MAAM,QAAQ,YAAY,WAAW;GAE1D,SAAS;IACP,SAAS,QAAQ,MAAM;IACvB;IACA,UAAU,UAAU,OAAO,WAAW,KAAA;IACtC,eAAe,UACV,OAAO,iBAAiB,SAAS,qBAClC,SAAS;IACb,KAAK,UAAW,OAAO,KAAA,IAAa,KAAA;IACpC,SAAU,MAAM,WAAW,OAAO,IAAK,UAAU,KAAA;IACjD,QAAQ,UAAU,KAAA,IAAY,QAAQ,MAAM,UAAU,YAAY;GACpE;EACF;EAMA,OAAO,OAAO;EACd,OAAO,OAAO;EACd,IAAI,OAAO,WAAW,OAAO,OAAO,MAAM;GACxC,MAAM,eAAe,MAAM,KAAK,MAAM,eAAe,YAAY,WAAW;GAC5E,IAAI,cAAc,QAAQ,OAAO,OAAO,aAAa,UAAU;IAC7D,OAAO,WAAW,aAAa;IAC/B,OAAO,OAAO,iBAAiB,aAAa,QAAQ;IACpD,IAAI;KACF,OAAO,OAAO,IAAI,IAAI,aAAa,QAAQ,CAAC,CAAC;IAC/C,QAAQ,CAER;GACF;EACF;EACA,IAAI,CAAC,OAAO,YAAY,OAAO,WAAW,QAAQ,MAChD,OAAO,WAAW,UAAU,KAAK,GAAG;EAEtC,OAAO;CACT;CAEA,MAAM,UAAU,YAAoB,MAAe,QAAQ,IAAqB;EAC9E,MAAM,WAAW,KAAK,qBAAqB,UAAU;EACrD,MAAM,cAAc,OAChB,qBAAqB,IAAI,IACzB,MAAM,KAAK,kBAAkB,UAAU;EAE3C,MAAM,UAAU,MAAM,KAAK,MAAM,eAAe,YAAY,WAAW;EACvE,MAAM,MAAM,KAAK,kBAAkB,YAAY,aAAa,QAAQ,KAAK;EAEzE,IAAI,SAAS,eACX,OAAO,SAAS,cAAc,KAAK,KAAK;EAG1C,MAAM,UAAU,KAAK,MAAM,QAAQ,YAAY,WAAW;EAC1D,IAAI,CAAE,MAAM,WAAW,OAAO,GAC5B,OAAO;EAGT,MAAM,OAAM,MADM,SAAS,SAAS,MAAM,EAAA,CAC1B,MAAM,OAAO;EAC7B,OAAO,IAAI,MAAM,KAAK,IAAI,GAAG,IAAI,SAAS,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;CAC7D;;;;;CAMA,MAAM,gBACJ,YACA,MACA,QACA,OAAiD,CAAC,GACnC;EACf,MAAM,cAAc,OAChB,qBAAqB,IAAI,IACzB,MAAM,KAAK,kBAAkB,UAAU;EAC3C,MAAM,UAAU,KAAK,MAAM,QAAQ,YAAY,WAAW;EAE1D,IAAI,CAAE,MAAM,WAAW,OAAO,GAC5B,OAAO,yBAAyB;EAIlC,IAAI,KAAK,SAAU,MAAM,WAAW,OAAO,GAAI;GAE7C,MAAM,OAAM,MADM,SAAS,SAAS,MAAM,EAAA,CAEvC,MAAM,IAAI,CAAC,CACX,KAAK,MAAM,EAAE,QAAQ,OAAO,EAAE,CAAC,CAAC,CAChC,OAAO,OAAO;GACjB,KAAK,MAAM,KAAK,IAAI,MAAM,KAAK,IAAI,GAAG,IAAI,SAAS,KAAK,KAAK,CAAC,GAC5D,OAAO,CAAC;EAEZ;EAEA,MAAM,gBAAgB,CAAC;EACvB,KAAK,QAAQ,iBAAiB,SAAS,OAAO;EAE9C,IAAI;GACF,MAAM,WAAW,SAAS,QAAQ,KAAK,MAAM;EAC/C,UAAU;GACR,KAAK,QAAQ,oBAAoB,SAAS,OAAO;EACnD;CACF;;;;;CAMA,MAAM,cAAc,YAOlB;EACA,MAAM,YAAY,aACd,CAAC,KAAK,qBAAqB,UAAU,CAAC,IACtC,KAAK,SAAS,KAAK,CAAC,CAAC,QAAQ,MAAM,iBAAiB,CAAC,CAAC;EAE1D,MAAM,OAAO,CAAC;EACd,KAAK,MAAM,KAAK,WAAW;GACzB,MAAM,SAAS,MAAM,KAAK,MAAM,UAAU,EAAE,EAAE;GAC9C,MAAM,WAAW,MAAM,KAAK,MAAM,aAAa,EAAE,EAAE;GACnD,KAAK,MAAM,KAAK,UAAU;IAExB,MAAM,SAAS,MAAM,KAAK,YAAY,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,CAAC,aACnC;KAClB,SAAS,EAAE,MAAM;KACjB,SAAS;KACT,QAAQ;IACV,EACF;IACA,IAAI,EAAE,KAAK,SAAS,UAAU,EAAE,MAAM,WAAW,OAAO,SACtD,KAAK,KAAK;KACR,UAAU,EAAE;KACZ,MAAM,EAAE,KAAK;KACb,QAAQ,EAAE,KAAK,SAAS;KACxB;IACF,CAAC;GAEL;EACF;EACA,OAAO;CACT;;;;CAKA,MAAM,aACJ,YACA,MAUA;EACA,MAAM,UAAU,MAAM,KAAK,oBAAoB,YAAY,MAAM;GAC/D,gBAAgB;GAChB,cAAc,CAAC;EACjB,CAAC;EACD,MAAM,MAOD,CAAC;EACN,KAAK,MAAM,KAAK,SACd,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,WAAW,EAAE,UAAU,EAAE,IAAI;GACvD,IAAI,KAAK;IACP,UAAU,EAAE;IACZ,MAAM,EAAE;IACR,IAAI;IACJ,UAAU,OAAO;IACjB,kBAAkB,OAAO;GAC3B,CAAC;EACH,SAAS,KAAK;GACZ,IAAI,KAAK;IACP,UAAU,EAAE;IACZ,MAAM,EAAE;IACR,IAAI;IACJ,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;EACH;EAEF,OAAO;CACT;CAEA,MAAM,YACJ,YACA,MACiF;EACjF,MAAM,UAAU,MAAM,KAAK,oBAAoB,YAAY,MAAM;GAC/D,gBAAgB;GAChB,cAAc,CAAC;GACf,aAAa,CAAC,QAAQ,CAAC;EACzB,CAAC;EACD,MAAM,MAAM,CAAC;EACb,KAAK,MAAM,KAAK,SACd,IAAI;GACF,MAAM,KAAK,UAAU,EAAE,UAAU,EAAE,IAAI;GACvC,IAAI,KAAK;IAAE,UAAU,EAAE;IAAU,MAAM,EAAE;IAAM,IAAI;GAAK,CAAC;EAC3D,SAAS,KAAK;GACZ,IAAI,KAAK;IACP,UAAU,EAAE;IACZ,MAAM,EAAE;IACR,IAAI;IACJ,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD,CAAC;EACH;EAEF,OAAO;CACT;;CAGA,MAAM,oBAAoB,WAAW,QAAQ,KAAsB;EACjE,IAAI,UAAU;EACd,KAAK,MAAM,OAAO,MAAM,KAAK,cAAc,GAAG;GAC5C,MAAM,EAAE,WAAW;GACnB,IAAI,CAAC,OAAO,WAAW,OAAO,OAAO,QAAQ,CAAC,OAAO,UACnD;GAEF,KAAK,YACH,IAAI,UACJ,IAAI,MACJ;IACE,UAAU,OAAO;IACjB,eAAe,OAAO;IACtB,KAAK,OAAO;IACZ,SAAS,OAAO;GAClB,GACA,QACF;GACA,WAAW;EACb;EACA,KAAK,MAAM,YAAY,KAAK,SAAS,KAAK,CAAC,CAAC,QAAQ,SAAS,iBAAiB,IAAI,CAAC,GACjF,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,gBAAgB,SAAS,EAAE;GACrD,IAAI,CAAC,OAAO,WAAW,OAAO,OAAO,QAAQ,CAAC,OAAO,UACnD;GAEF,KAAK,YACH,SAAS,IACT,KAAA,GACA;IACE,UAAU,OAAO;IACjB,eAAe,OAAO;IACtB,KAAK,OAAO;IACZ,SAAS,OAAO;GAClB,GACA,QACF;GACA,WAAW;EACb,QAAQ,CAER;EAEF,OAAO;CACT;;CAKA,MAAM,oBAAoB,UAAoB,aAAoC;EAChF,MAAM,KAAK,kBAAkB,UAAU,WAAW;EAClD,KAAU,oBAAoB;CAChC;;CAGA,MAAM,qBACJ,UACA,aACA,QACkE;EAClE,IAAI,CAAC,iBAAiB,QAAQ,KAAK,CAAC,OAAO,SACzC,OAAO,EAAE,SAAS,MAAM;EAE1B,IAAI;GACF,MAAM,SAAS,MAAM,KAAK,mBAAmB,UAAU,aAAa,MAAM;GAC1E,KAAU,oBAAoB;GAC9B,OAAO;IACL,UAAU,OAAO;IACjB,SAAS;GACX;EACF,SAAS,KAAK;GACZ,OAAO;IACL,SAAS;IACT,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GACxD;EACF;CACF;CAEA,MAAc,oBACZ,YACA,MACA,MAKoD;EACpD,IAAI,cAAc,MAAM;GACtB,KAAK,qBAAqB,UAAU;GACpC,MAAM,KAAK,MAAM,eAAe,YAAY,qBAAqB,IAAI,CAAC;GACtE,OAAO,CAAC;IAAE,UAAU;IAAY,MAAM,qBAAqB,IAAI;GAAE,CAAC;EACpE;EAEA,IAAI,YAAY;GACd,MAAM,IAAI,KAAK,qBAAqB,UAAU;GAC9C,IAAI,KAAK,cAAc;IACrB,MAAM,SAAS,MAAM,KAAK,MAAM,UAAU,EAAE,EAAE;IAC9C,IAAI,QAAQ;KACV,MAAM,MAAM,MAAM,KAAK,MAAM,eAAe,EAAE,IAAI,MAAM;KACxD,IAAI,CAAC,KAAK,kBAAkB,IAAI,MAAM,SACpC,OAAO,CAAC;MAAE,UAAU,EAAE;MAAI,MAAM;KAAO,CAAC;IAE5C;GACF;GAEA,QAAO,MADgB,KAAK,MAAM,aAAa,EAAE,EAAE,EAAA,CAEhD,QAAQ,MAAM,CAAC,KAAK,kBAAkB,EAAE,MAAM,OAAO,CAAC,CACtD,KAAK,OAAO;IAAE,UAAU,EAAE;IAAI,MAAM,EAAE,KAAK;GAAK,EAAE;EACvD;EAGA,MAAM,YAAY,KAAK,SAAS,KAAK,CAAC,CAAC,QAAQ,MAAM,iBAAiB,CAAC,CAAC;EACxE,MAAM,UAAqD,CAAC;EAC5D,KAAK,MAAM,KAAK,WAAW;GACzB,IAAI,KAAK,aAAa;IACpB,MAAM,WAAW,MAAM,KAAK,MAAM,aAAa,EAAE,EAAE;IACnD,KAAK,MAAM,WAAW,UAEpB,KAAI,MADiB,KAAK,YAAY,EAAE,IAAI,QAAQ,KAAK,IAAI,EAAA,CAClD,SACT,QAAQ,KAAK;KAAE,UAAU,EAAE;KAAI,MAAM,QAAQ,KAAK;IAAK,CAAC;IAG5D;GACF;GACA,MAAM,SAAS,MAAM,KAAK,MAAM,UAAU,EAAE,EAAE;GAC9C,IAAI,QAAQ;IACV,MAAM,MAAM,MAAM,KAAK,MAAM,WAAW,EAAE,IAAI,MAAM;IACpD,IAAI,CAAC,KACH;IAEF,IAAI,CAAC,KAAK,kBAAkB,IAAI,MAAM,SACpC,QAAQ,KAAK;KAAE,UAAU,EAAE;KAAI,MAAM;IAAO,CAAC;GAEjD;EACF;EACA,OAAO;CACT;CAEA,MAAc,kBAAkB,YAAqC;EACnE,MAAM,SAAS,MAAM,KAAK,MAAM,UAAU,UAAU;EACpD,IAAI,CAAC,QACH,MAAM,IAAI,aACR,0BAA0B,WAAW,2BACrC,mBACF;EAEF,OAAO;CACT;CAEA,kBACE,YACA,aACA,QACA,OACc;EACd,OAAO;GACL;GACA;GACA,aAAa,mBAAmB,KAAK,MAAM,MAAM,YAAY,WAAW;GACxE,YAAY,KAAK,MAAM,WAAW,YAAY,WAAW;GACzD;GACA;EACF;CACF;CAEA,MAAc,mBACZ,UACA,aACA,QACsB;EACtB,OAAO,iBAAiB,KAAK,MAAM,MAAM,SAAS,SAAS,GAAG,GAAG,qBAC/D,KAAK,2BAA2B,UAAU,aAAa,MAAM,CAC/D;CACF;CAEA,MAAc,2BACZ,UACA,aACA,QACsB;EACtB,IAAI,CAAC,SAAS,YACZ,MAAM,IAAI,aACR,aAAa,SAAS,GAAG,gEACzB,uBACF;EAGF,IAAI,YAAY,mBAAmB,MAAM;EACzC,MAAM,OAAO,UAAU,QAAQ;EAC/B,mBAAmB,IAAI;EACvB,IAAI,OAAO,UAAU,QAAQ,SAAS,oBAAoB;EAE1D,MAAM,cAAc,MAAM,YADV,KAAK,MAAM,QAAQ,SAAS,IAAI,WACV,CAAO;EAC7C,MAAM,gBAAgB,MAAM,KAAK,MAAM,eAAe,SAAS,IAAI,WAAW;EAI9E,MAAM,aACJ,eAAe,SAAS,cAAc,MAAM,SAAS,IACjD,cAAc,QACd,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;EAGpC,IAAI,eAAe,QAAQ,iBAAiB,WAAW,KAAK,SAAS,GAAG;GACtE,MAAM,aAAa,CAAC,eAAe,UAAU,UAAU,KAAK,GAAG,MAAM,CAAC,CAAC,QACpE,OAAO,OAAO,QAAyB,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,MAAM,KACnF;GACA,KAAK,MAAM,aAAa,YACtB,IAAI;IACF,MAAM,EAAE,gBAAgB,MAAM,OAAO;IAKrC,IAAI,CAAC,MAJY,YAAY,WAAW;KACtC,WAAW;KACX,YAAY;IACd,CAAC,GAEC;IAEF,MAAM,SAAS,IAAI,IAAI,SAAS;IAChC,MAAM,aAAa,OAAO,aAAa,QAAQ,UAAU,OAAO;IAChE,MAAM,aAAa,OAAO,OAAO,IAAI;IACrC,IAAI,aAAa,MAAM,eAAe,QAAQ,eAAe,OAAO;KAClE,OAAO;KACP,YAAY;MAAE,GAAG;MAAW;MAAM,MAAM;KAAW;KACnD,MAAM,KAAK,MAAM,eAAe,SAAS,IAAI,aAAa,SAAS;IACrE;IACA,MAAM,SAAsB;KAC1B,UAAU;KACV,eAAe,SAAS;KACxB,KAAK;KACL,SAAS,KAAK,MAAM,QAAQ,SAAS,IAAI,WAAW;KACpD,YAAY;KACZ,OAAO;IACT;IACA,MAAM,KAAK,MAAM,gBAAgB,SAAS,IAAI,aAAa;KACzD;KACA,UAAU,OAAO;KACjB,eAAe,OAAO;KACtB,KAAK,OAAO;KACZ,SAAS,OAAO;KAChB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;KAClC,OAAO;IACT,CAAC;IACD,OAAO,mBAAmB,MAAM,KAAK,oBACnC,SAAS,IACT,aACA,OAAO,UACP,UACF;IACA,KAAK,YAAY,SAAS,IAAI,aAAa,MAAM;IACjD,OAAO;GACT,QAAQ,CAER;GAGF,MAAM,KAAK,0BAA0B,UAAU,WAAW;EAC5D,OAAO,IAAI,eAAe,MAExB,MAAM,KAAK,0BAA0B,UAAU,WAAW;EAI5D,IAAI,SAAS,KAAK,CAAE,MAAM,iBAAiB,MAAM,IAAI,GAAI;GACvD,MAAM,OAAO,MAAM,KAAK,MAAM,aAAa,OAAO,GAAG,SAAS,IAAI,WAAW;GAC7E,YAAY;IAAE,GAAG;IAAW,MAAM;IAAM;GAAK;GAC7C,MAAM,KAAK,MAAM,eAAe,SAAS,IAAI,aAAa,SAAS;GACnE,OAAO;EACT,OAAO,IAAI,UAAU,QAAQ,MAAM;GACjC,YAAY;IAAE,GAAG;IAAW;IAAM;GAAK;GACvC,MAAM,KAAK,MAAM,eAAe,SAAS,IAAI,aAAa,SAAS;EACrE;EAEA,MAAM,MAAM,KAAK,kBAAkB,SAAS,IAAI,aAAa,WAAW,UAAU;EAClF,MAAM,SAAS,MAAM,SAAS,WAAW,GAAG;EAG5C,IAAI,OAAO,OAAO,QAAQ,CAAC,iBAAiB,OAAO,GAAG,GAAG;GAEvD,IAAI,SAAS,GAAG;IACd,MAAM,OAAO,MAAM,KAAK,MAAM,aAAa,OAAO,GAAG,SAAS,IAAI,WAAW;IAC7E,YAAY;KAAE,GAAG;KAAW,MAAM;KAAM;IAAK;IAC7C,MAAM,KAAK,MAAM,eAAe,SAAS,IAAI,aAAa,SAAS;IACnE,MAAM,QAAQ,MAAM,SAAS,WAC3B,KAAK,kBAAkB,SAAS,IAAI,aAAa,WAAW,UAAU,CACxE;IACA,IAAI,MAAM,OAAO,QAAQ,iBAAiB,MAAM,GAAG,GAAG;KACpD,MAAM,KAAK,MAAM,gBAAgB,SAAS,IAAI,aAAa;MACzD;MACA,UAAU,MAAM;MAChB,eAAe,MAAM,iBAAiB,SAAS;MAC/C,KAAK,MAAM;MACX,SAAS,MAAM,WAAW,KAAK,MAAM,QAAQ,SAAS,IAAI,WAAW;MACrE,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;MAClC,OAAO;KACT,CAAC;KACD,MAAM,aAAa;KACnB,MAAM,QAAQ;KACd,KAAK,YAAY,SAAS,IAAI,aAAa,KAAK;KAChD,MAAM,mBAAmB,MAAM,KAAK,oBAClC,SAAS,IACT,aACA,MAAM,UACN,UACF;KACA,OAAO;IACT;GACF;GACA,MAAM,IAAI,aACR,aAAa,SAAS,GAAG,GAAG,YAAY,8BAA8B,KAAK,+BAA+B,SAAS,GAAG,GAAG,eACzH,oBACF;EACF;EAEA,MAAM,KAAK,MAAM,gBAAgB,SAAS,IAAI,aAAa;GACzD;GACA,UAAU,OAAO;GACjB,eAAe,OAAO,iBAAiB,SAAS;GAChD,KAAK,OAAO;GACZ,SAAS,OAAO,WAAW,KAAK,MAAM,QAAQ,SAAS,IAAI,WAAW;GACtE,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,OAAO;EACT,CAAC;EAED,OAAO,aAAa;EACpB,KAAK,YAAY,SAAS,IAAI,aAAa,MAAM;EAEjD,OAAO,mBAAmB,MAAM,KAAK,oBACnC,SAAS,IACT,aACA,OAAO,UACP,UACF;EACA,OAAO;CACT;;CAGA,MAAc,oBACZ,YACA,aACA,UACA,OACmB;EACnB,IAAI,CAAC,KAAK,SACR,OAAO,CAAC;EAEV,IAAI;GACF,OAAO,MAAM,6BACX,KAAK,SACL,YACA,aACA,UACA,KACF;EACF,QAAQ;GACN,OAAO,CAAC;EACV;CACF;CAEA,MAAc,kBAAkB,UAAoB,aAAoC;EACtF,OAAO,iBAAiB,KAAK,MAAM,MAAM,SAAS,SAAS,GAAG,GAAG,qBAC/D,KAAK,0BAA0B,UAAU,WAAW,CACtD;CACF;CAEA,MAAc,0BAA0B,UAAoB,aAAoC;EAC9F,MAAM,SAAS,MAAM,KAAK,MAAM,eAAe,SAAS,IAAI,WAAW;EACvE,MAAM,MAAM,KAAK,kBAAkB,SAAS,IAAI,aAAa,MAAM;EAGnE,MAAM,SAAS,MAAM,cADL,KAAK,MAAM,QAAQ,SAAS,IAAI,WACb,CAAO;EAC1C,IAAI,SAAS,WACX,MAAM,SAAS,UAAU,GAAG;OACvB;GAEL,MAAM,EAAE,gBAAgB,MAAM,OAAO;GACrC,MAAM,YAAY,KAAK,MAAM,QAAQ,SAAS,IAAI,WAAW,CAAC;EAChE;EAKA,IAAI,UAAU,iBAAiB,OAAO,GAAG,GAAG;GAK1C,MAAM,SAAS,SAAS,cAAc,MAAM,SAAS,YAAY,GAAG,IAAI,KAAA;GACxE,IAAI,CAAC,UAAU,OAAO,SACpB,MAAM,IAAI,aACR,6BAA6B,SAAS,KAAK,sBAAsB,OAAO,IAAI,KAC5E;IACE,MAAM;IACN,aAAa,CAAC,iEAAiE;GACjF,CACF;EAEJ;EAEA,MAAM,KAAK,MAAM,gBAAgB,SAAS,IAAI,WAAW;EACzD,KAAK,aAAa,SAAS,IAAI,WAAW;CAC5C;AACF"}

package/dist/core/quota-guard-policy.d.ts

@@ -1,8 +0,0 @@
-import type { GlobalConfig, QuotaGuardPolicy } from '../types.js';
-export declare const DEFAULT_QUOTA_GUARD_POLICY: QuotaGuardPolicy;
-/**
- * Quota Guard only governs multi-account compatibility proxies. It never
- * changes a native tool login or sends a saved credential anywhere.
- */
-export declare function quotaGuardPolicy(config: GlobalConfig): QuotaGuardPolicy;
-//# sourceMappingURL=quota-guard-policy.d.ts.map

package/dist/core/quota-guard-policy.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"quota-guard-policy.d.ts","sourceRoot":"","sources":["../../src/core/quota-guard-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAE/D,eAAO,MAAM,0BAA0B,EAAE,gBAGxC,CAAC;AAEF;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,gBAAgB,CAavE"}

package/dist/core/quota-guard-policy.js

@@ -1,21 +0,0 @@
-//#region src/core/quota-guard-policy.ts
-var DEFAULT_QUOTA_GUARD_POLICY = {
-	enabled: false,
-	cooldownMinutes: 60
-};
-/**
-* Quota Guard only governs multi-account compatibility proxies. It never
-* changes a native tool login or sends a saved credential anywhere.
-*/
-function quotaGuardPolicy(config) {
-	const raw = config.ui?.quotaGuard;
-	const cooldownMinutes = raw?.cooldownMinutes;
-	return {
-		enabled: raw?.enabled === true,
-		cooldownMinutes: typeof cooldownMinutes === "number" && Number.isInteger(cooldownMinutes) && cooldownMinutes >= 1 && cooldownMinutes <= 1440 ? cooldownMinutes : DEFAULT_QUOTA_GUARD_POLICY.cooldownMinutes
-	};
-}
-//#endregion
-export { DEFAULT_QUOTA_GUARD_POLICY, quotaGuardPolicy };
-
-//# sourceMappingURL=quota-guard-policy.js.map

package/dist/core/quota-guard-policy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"quota-guard-policy.js","names":[],"sources":["../../src/core/quota-guard-policy.ts"],"sourcesContent":["import type { GlobalConfig, QuotaGuardPolicy } from '../types';\n\nexport const DEFAULT_QUOTA_GUARD_POLICY: QuotaGuardPolicy = {\n  enabled: false,\n  cooldownMinutes: 60,\n};\n\n/**\n * Quota Guard only governs multi-account compatibility proxies. It never\n * changes a native tool login or sends a saved credential anywhere.\n */\nexport function quotaGuardPolicy(config: GlobalConfig): QuotaGuardPolicy {\n  const raw = config.ui?.quotaGuard;\n  const cooldownMinutes = raw?.cooldownMinutes;\n  return {\n    enabled: raw?.enabled === true,\n    cooldownMinutes:\n      typeof cooldownMinutes === 'number' &&\n      Number.isInteger(cooldownMinutes) &&\n      cooldownMinutes >= 1 &&\n      cooldownMinutes <= 24 * 60\n        ? cooldownMinutes\n        : DEFAULT_QUOTA_GUARD_POLICY.cooldownMinutes,\n  };\n}\n"],"mappings":";AAEA,IAAa,6BAA+C;CAC1D,SAAS;CACT,iBAAiB;AACnB;;;;;AAMA,SAAgB,iBAAiB,QAAwC;CACvE,MAAM,MAAM,OAAO,IAAI;CACvB,MAAM,kBAAkB,KAAK;CAC7B,OAAO;EACL,SAAS,KAAK,YAAY;EAC1B,iBACE,OAAO,oBAAoB,YAC3B,OAAO,UAAU,eAAe,KAChC,mBAAmB,KACnB,mBAAmB,OACf,kBACA,2BAA2B;CACnC;AACF"}

package/dist/core/realign-proxy-clients.d.ts

@@ -1,19 +0,0 @@
-/**
- * When a proxy rebinds to a new port/endpoint, rewrite every bound client
- * (settings.json / env) so ANTHROPIC_BASE_URL / OPENAI_BASE_URL stay in sync.
- * User should never need `anypick use --current` just because the port bumped.
- */
-import type { BindingStore } from './binding-store.js';
-import type { RuntimeService } from './runtime-service.js';
-import type { ClientStateStore } from './client-state-store.js';
-export interface RealignProxyClientsDeps {
-    bindings: BindingStore;
-    runtime: RuntimeService;
-    clientState?: ClientStateStore;
-}
-/**
- * Find clients bound to provider/account (global + project bindings + client_state)
- * and re-apply the live proxy endpoint into their native config.
- */
-export declare function realignClientsToAccountProxy(deps: RealignProxyClientsDeps, providerId: string, accountName: string, endpoint: string, token?: string): Promise<string[]>;
-//# sourceMappingURL=realign-proxy-clients.d.ts.map

package/dist/core/realign-proxy-clients.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"realign-proxy-clients.d.ts","sourceRoot":"","sources":["../../src/core/realign-proxy-clients.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAG7D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,YAAY,CAAC;IACvB,OAAO,EAAE,cAAc,CAAC;IACxB,WAAW,CAAC,EAAE,gBAAgB,CAAC;CAChC;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,uBAAuB,EAC7B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,EAAE,CAAC,CA6CnB"}

package/dist/core/realign-proxy-clients.js

@@ -1,40 +0,0 @@
-import { modelRolesFromClientOptions } from "./model-roles.js";
-//#region src/core/realign-proxy-clients.ts
-/**
-* Find clients bound to provider/account (global + project bindings + client_state)
-* and re-apply the live proxy endpoint into their native config.
-*/
-async function realignClientsToAccountProxy(deps, providerId, accountName, endpoint, token) {
-	const clients = /* @__PURE__ */ new Set();
-	for (const b of deps.bindings.listGlobal()) if (bindingMatchesAccount(b.spec.source, providerId, accountName)) clients.add(b.client);
-	if (deps.clientState) {
-		for (const st of await deps.clientState.list()) if (st.mode === "account" && st.accountRef?.provider === providerId && st.accountRef?.name === accountName) clients.add(st.clientId);
-	}
-	const updated = [];
-	for (const clientId of clients) try {
-		const global = deps.bindings.getGlobal(clientId);
-		const roles = modelRolesFromClientOptions(global?.spec.clientOptions);
-		const modelId = global?.spec.model.mode === "explicit" ? global.spec.model.id : roles?.default;
-		await deps.runtime.applyProxyEndpoint(clientId, {
-			endpoint,
-			apiKey: token ?? "anypick-proxy",
-			defaultModel: modelId,
-			modelRoles: roles,
-			accountRef: {
-				provider: providerId,
-				name: accountName
-			},
-			label: `proxy:${providerId}/${accountName}`
-		});
-		updated.push(clientId);
-	} catch {}
-	return updated;
-}
-function bindingMatchesAccount(source, providerId, accountName) {
-	if (source.kind === "account") return source.provider === providerId && source.name === accountName;
-	return false;
-}
-//#endregion
-export { realignClientsToAccountProxy };
-
-//# sourceMappingURL=realign-proxy-clients.js.map

package/dist/core/realign-proxy-clients.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"realign-proxy-clients.js","names":[],"sources":["../../src/core/realign-proxy-clients.ts"],"sourcesContent":["/**\n * When a proxy rebinds to a new port/endpoint, rewrite every bound client\n * (settings.json / env) so ANTHROPIC_BASE_URL / OPENAI_BASE_URL stay in sync.\n * User should never need `anypick use --current` just because the port bumped.\n */\n\nimport type { BindingStore } from './binding-store';\nimport type { RuntimeService } from './runtime-service';\nimport type { ClientStateStore } from './client-state-store';\nimport { modelRolesFromClientOptions } from './model-roles';\n\nexport interface RealignProxyClientsDeps {\n  bindings: BindingStore;\n  runtime: RuntimeService;\n  clientState?: ClientStateStore;\n}\n\n/**\n * Find clients bound to provider/account (global + project bindings + client_state)\n * and re-apply the live proxy endpoint into their native config.\n */\nexport async function realignClientsToAccountProxy(\n  deps: RealignProxyClientsDeps,\n  providerId: string,\n  accountName: string,\n  endpoint: string,\n  token?: string,\n): Promise<string[]> {\n  const clients = new Set<string>();\n\n  for (const b of deps.bindings.listGlobal()) {\n    if (bindingMatchesAccount(b.spec.source, providerId, accountName)) {\n      clients.add(b.client);\n    }\n  }\n  // Project bindings are scoped to a project activation. Rewriting a native\n  // global client config here would leak that project binding globally.\n\n  if (deps.clientState) {\n    for (const st of await deps.clientState.list()) {\n      if (\n        st.mode === 'account' &&\n        st.accountRef?.provider === providerId &&\n        st.accountRef?.name === accountName\n      ) {\n        clients.add(st.clientId);\n      }\n    }\n  }\n\n  const updated: string[] = [];\n  for (const clientId of clients) {\n    try {\n      const global = deps.bindings.getGlobal(clientId);\n      const roles = modelRolesFromClientOptions(global?.spec.clientOptions);\n      const modelId =\n        global?.spec.model.mode === 'explicit' ? global.spec.model.id : roles?.default;\n\n      await deps.runtime.applyProxyEndpoint(clientId, {\n        endpoint,\n        apiKey: token ?? 'anypick-proxy',\n        defaultModel: modelId,\n        modelRoles: roles,\n        accountRef: { provider: providerId, name: accountName },\n        label: `proxy:${providerId}/${accountName}`,\n      });\n      updated.push(clientId);\n    } catch {\n      // Best-effort — one broken client should not block others\n    }\n  }\n  return updated;\n}\n\nfunction bindingMatchesAccount(\n  source: { kind: string; provider?: string; name?: string },\n  providerId: string,\n  accountName: string,\n): boolean {\n  if (source.kind === 'account') {\n    return source.provider === providerId && source.name === accountName;\n  }\n  // A single-account process must never rewrite clients bound to a provider\n  // pool (or another account). Pool lifecycle owns its own client binding.\n  return false;\n}\n"],"mappings":";;;;;;AAqBA,eAAsB,6BACpB,MACA,YACA,aACA,UACA,OACmB;CACnB,MAAM,0BAAU,IAAI,IAAY;CAEhC,KAAK,MAAM,KAAK,KAAK,SAAS,WAAW,GACvC,IAAI,sBAAsB,EAAE,KAAK,QAAQ,YAAY,WAAW,GAC9D,QAAQ,IAAI,EAAE,MAAM;CAMxB,IAAI,KAAK;OACF,MAAM,MAAM,MAAM,KAAK,YAAY,KAAK,GAC3C,IACE,GAAG,SAAS,aACZ,GAAG,YAAY,aAAa,cAC5B,GAAG,YAAY,SAAS,aAExB,QAAQ,IAAI,GAAG,QAAQ;CAAA;CAK7B,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,YAAY,SACrB,IAAI;EACF,MAAM,SAAS,KAAK,SAAS,UAAU,QAAQ;EAC/C,MAAM,QAAQ,4BAA4B,QAAQ,KAAK,aAAa;EACpE,MAAM,UACJ,QAAQ,KAAK,MAAM,SAAS,aAAa,OAAO,KAAK,MAAM,KAAK,OAAO;EAEzE,MAAM,KAAK,QAAQ,mBAAmB,UAAU;GAC9C;GACA,QAAQ,SAAS;GACjB,cAAc;GACd,YAAY;GACZ,YAAY;IAAE,UAAU;IAAY,MAAM;GAAY;GACtD,OAAO,SAAS,WAAW,GAAG;EAChC,CAAC;EACD,QAAQ,KAAK,QAAQ;CACvB,QAAQ,CAER;CAEF,OAAO;AACT;AAEA,SAAS,sBACP,QACA,YACA,aACS;CACT,IAAI,OAAO,SAAS,WAClB,OAAO,OAAO,aAAa,cAAc,OAAO,SAAS;CAI3D,OAAO;AACT"}

package/dist/core/refs.d.ts

@@ -1,84 +0,0 @@
-/**
- * Deterministic resource reference parsing (spec §15).
- *
- * Grammar:
- *   provider/account       → account
- *   account/provider/account → account
- *   gateway-name           → gateway
- *   gateway/gateway-name   → gateway
- *   @preset-name           → preset
- *   preset/preset-name     → preset
- *
- * No cross-kind ambiguity. Fuzzy matching never used for direct execution.
- */
-import type { AccountPoolResourceRef, AccountResourceRef, ClientId, GatewayResourceRef, ProxyHubResourceRef, PresetResourceRef, ResourceRef } from '../types.js';
-/** Known account-auth provider ids (file-snapshot providers). */
-declare const DEFAULT_ACCOUNT_PROVIDERS: Set<string>;
-export interface ParseRefContext {
-    /** Known account provider ids (default: builtin set). */
-    accountProviders?: ReadonlySet<string>;
-    /**
-     * Optional exact gateway existence check. When provided and plain input
-     * is not a gateway but an exact preset exists, throws NOT_FOUND with @suggestion.
-     */
-    gatewayExists?: (name: string) => boolean | Promise<boolean>;
-    presetExists?: (name: string) => boolean | Promise<boolean>;
-}
-/**
- * Mutation scope covering a provider's live credential file *and* all of its
- * saved snapshots.
- *
- * Deliberately coarser than one lock per account. Every snapshot mutation is
- * reached through the single live auth file the provider owns on disk, so two
- * activations pointing different clients at different accounts of the same
- * provider are not independent — per-account locks would let them interleave
- * two rewrites of that one file. Save/use/stash also resolve their target
- * account *by identity* mid-operation, so the exact account is not knowable
- * up front and could not be locked in a fixed order (ADR 0009).
- */
-export declare function providerScope(providerId: string): string;
-/**
- * Mutation scope an activation must hold for its resolved source. Account and
- * pool sources both reach the provider's live auth, so they collapse onto
- * `providerScope`, which is what the services lock — one lock file, so the
- * nested service call re-enters instead of self-deadlocking.
- */
-export declare function mutationScopeForRef(ref: ResourceRef): string;
-export declare function serializeRef(ref: ResourceRef): string;
-export declare function displayRef(ref: ResourceRef): string;
-export declare function accountRef(provider: string, name: string): AccountResourceRef;
-export declare function gatewayRef(name: string): GatewayResourceRef;
-export declare function proxyHubRef(name: string): ProxyHubResourceRef;
-export declare function presetRef(name: string): PresetResourceRef;
-export declare function accountPoolRef(provider: string): AccountPoolResourceRef;
-/**
- * Parse a source/preset reference string into a typed ResourceRef.
- * Synchronous path — does not perform existence checks.
- * Use resolveSourceRef for existence + preset suggestion.
- */
-export declare function parseRef(input: string, ctx?: ParseRefContext): ResourceRef;
-/**
- * Resolve a reference with optional existence checks.
- * When a plain gateway name is missing but an exact preset exists,
- * throws NOT_FOUND suggesting `@name` (never auto-resolves).
- */
-export declare function resolveSourceRef(input: string, ctx: ParseRefContext & {
-    gatewayExists: (name: string) => boolean | Promise<boolean>;
-    presetExists?: (name: string) => boolean | Promise<boolean>;
-    accountExists?: (provider: string, name: string) => boolean | Promise<boolean>;
-}): Promise<ResourceRef>;
-/**
- * Optional native-account shorthand: `anypick use codex/personal`
- * Valid only when provider is also a supported client and the account
- * is a native source for that same client.
- */
-export declare function parseNativeAccountShorthand(input: string, opts: {
-    accountProviders: ReadonlySet<string>;
-    clientIds: ReadonlySet<string>;
-}): {
-    client: ClientId;
-    source: AccountResourceRef;
-} | null;
-export declare function isKnownAccountProvider(id: string, providers?: ReadonlySet<string>): boolean;
-export { DEFAULT_ACCOUNT_PROVIDERS };
-//# sourceMappingURL=refs.d.ts.map

package/dist/core/refs.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"refs.d.ts","sourceRoot":"","sources":["../../src/core/refs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,kBAAkB,EAClB,QAAQ,EACR,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,WAAW,EACZ,MAAM,UAAU,CAAC;AAGlB,iEAAiE;AACjE,QAAA,MAAM,yBAAyB,aAA2D,CAAC;AAE3F,MAAM,WAAW,eAAe;IAC9B,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACvC;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAc5D;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAiBrD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAiBnD;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAE7E;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAE3D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAE7D;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAEzD;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,sBAAsB,CAEvE;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,eAAoB,GAAG,WAAW,CA2I9E;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,eAAe,GAAG;IACrB,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChF,GACA,OAAO,CAAC,WAAW,CAAC,CA2EtB;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE;IACJ,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAChC,GACA;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAAG,IAAI,CA+BzD;AAED,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,MAAM,EACV,SAAS,GAAE,WAAW,CAAC,MAAM,CAA6B,GACzD,OAAO,CAET;AAED,OAAO,EAAE,yBAAyB,EAAE,CAAC"}

package/dist/core/refs.js

@@ -1,250 +0,0 @@
-import { ExitCode, anypickError } from "../utils/errors.js";
-//#region src/core/refs.ts
-/** Known account-auth provider ids (file-snapshot providers). */
-var DEFAULT_ACCOUNT_PROVIDERS = /* @__PURE__ */ new Set([
-	"codex",
-	"gemini",
-	"grok",
-	"kiro",
-	"opencode"
-]);
-/**
-* Mutation scope covering a provider's live credential file *and* all of its
-* saved snapshots.
-*
-* Deliberately coarser than one lock per account. Every snapshot mutation is
-* reached through the single live auth file the provider owns on disk, so two
-* activations pointing different clients at different accounts of the same
-* provider are not independent — per-account locks would let them interleave
-* two rewrites of that one file. Save/use/stash also resolve their target
-* account *by identity* mid-operation, so the exact account is not knowable
-* up front and could not be locked in a fixed order (ADR 0009).
-*/
-function providerScope(providerId) {
-	return `provider/${providerId}`;
-}
-/**
-* Mutation scope an activation must hold for its resolved source. Account and
-* pool sources both reach the provider's live auth, so they collapse onto
-* `providerScope`, which is what the services lock — one lock file, so the
-* nested service call re-enters instead of self-deadlocking.
-*/
-function mutationScopeForRef(ref) {
-	switch (ref.kind) {
-		case "account":
-		case "account-pool": return providerScope(ref.provider);
-		case "gateway":
-		case "proxy-hub":
-		case "preset": return serializeRef(ref);
-		default: throw new Error(`Unknown resource ref: ${JSON.stringify(ref)}`);
-	}
-}
-function serializeRef(ref) {
-	switch (ref.kind) {
-		case "account": return `account/${ref.provider}/${ref.name}`;
-		case "gateway": return `gateway/${ref.name}`;
-		case "proxy-hub": return `hub/${ref.name}`;
-		case "preset": return `preset/${ref.name}`;
-		case "account-pool": return `pool/${ref.provider}`;
-		default: throw new Error(`Unknown resource ref: ${JSON.stringify(ref)}`);
-	}
-}
-function displayRef(ref) {
-	switch (ref.kind) {
-		case "account": return `${ref.provider}/${ref.name}`;
-		case "gateway": return ref.name;
-		case "proxy-hub": return `hub:${ref.name}`;
-		case "preset": return `@${ref.name}`;
-		case "account-pool": return `pool:${ref.provider}`;
-		default: throw new Error(`Unknown resource ref: ${JSON.stringify(ref)}`);
-	}
-}
-function accountRef(provider, name) {
-	return {
-		kind: "account",
-		provider,
-		name
-	};
-}
-function gatewayRef(name) {
-	return {
-		kind: "gateway",
-		name
-	};
-}
-function proxyHubRef(name) {
-	return {
-		kind: "proxy-hub",
-		name
-	};
-}
-function presetRef(name) {
-	return {
-		kind: "preset",
-		name
-	};
-}
-function accountPoolRef(provider) {
-	return {
-		kind: "account-pool",
-		provider
-	};
-}
-/**
-* Parse a source/preset reference string into a typed ResourceRef.
-* Synchronous path — does not perform existence checks.
-* Use resolveSourceRef for existence + preset suggestion.
-*/
-function parseRef(input, ctx = {}) {
-	const raw = input.trim();
-	if (!raw) throw anypickError("Empty resource reference.", "INVALID_REFERENCE", {
-		exitCode: ExitCode.INVALID_USAGE,
-		suggestions: [
-			"Accounts use provider/name:  grok/work",
-			"Gateways use their saved name:  openrouter-work",
-			"Presets use @name:  @work-grok"
-		]
-	});
-	const providers = ctx.accountProviders ?? DEFAULT_ACCOUNT_PROVIDERS;
-	if (raw.startsWith("@")) {
-		const name = raw.slice(1).trim();
-		if (!name) throw anypickError("Preset name is required after @.", "INVALID_REFERENCE", { exitCode: ExitCode.INVALID_USAGE });
-		return presetRef(name);
-	}
-	if (raw.startsWith("preset/")) {
-		const name = raw.slice(7).trim();
-		if (!name) throw anypickError("Preset name is required after preset/.", "INVALID_REFERENCE", { exitCode: ExitCode.INVALID_USAGE });
-		return presetRef(name);
-	}
-	if (raw.startsWith("hub:") || raw.startsWith("hub/")) {
-		const name = raw.startsWith("hub:") ? raw.slice(4).trim() : raw.slice(4).trim();
-		if (!name || name.includes("/") || name.includes(":")) throw anypickError(`Invalid Proxy Hub reference: ${raw}`, "INVALID_REFERENCE", { exitCode: ExitCode.INVALID_USAGE });
-		return proxyHubRef(name);
-	}
-	if (raw.startsWith("pool:") || raw.startsWith("pool/")) {
-		const provider = raw.startsWith("pool:") ? raw.slice(5).trim() : raw.slice(5).trim();
-		if (!provider || provider.includes("/") || provider.includes(":")) throw anypickError(`Invalid pool reference: ${raw}. Expected pool:provider (e.g. pool:gemini)`, "INVALID_REFERENCE", { exitCode: ExitCode.INVALID_USAGE });
-		if (!providers.has(provider)) throw anypickError(`Unknown account provider "${provider}" in pool reference: ${raw}`, "INVALID_REFERENCE", {
-			exitCode: ExitCode.INVALID_USAGE,
-			suggestions: [`Known: ${[...providers].toSorted().join(", ")}`]
-		});
-		return accountPoolRef(provider);
-	}
-	if (raw.startsWith("gateway/")) {
-		const name = raw.slice(8).trim();
-		if (!name || name.includes("/")) throw anypickError(`Invalid gateway reference: ${raw}`, "INVALID_REFERENCE", { exitCode: ExitCode.INVALID_USAGE });
-		return gatewayRef(name);
-	}
-	if (raw.startsWith("account/")) {
-		const rest = raw.slice(8);
-		const slash = rest.indexOf("/");
-		if (slash <= 0 || slash === rest.length - 1) throw anypickError(`Invalid account reference: ${raw}. Expected account/provider/name`, "INVALID_REFERENCE", { exitCode: ExitCode.INVALID_USAGE });
-		return accountRef(rest.slice(0, slash), rest.slice(slash + 1));
-	}
-	const slash = raw.indexOf("/");
-	if (slash > 0) {
-		const provider = raw.slice(0, slash);
-		const name = raw.slice(slash + 1);
-		if (providers.has(provider)) {
-			if (!name || name.includes("/")) throw anypickError(`Invalid account reference: ${raw}. Expected provider/account`, "INVALID_REFERENCE", { exitCode: ExitCode.INVALID_USAGE });
-			return accountRef(provider, name);
-		}
-		throw anypickError(`Unknown account provider "${provider}" in reference: ${raw}`, "INVALID_REFERENCE", {
-			exitCode: ExitCode.INVALID_USAGE,
-			suggestions: [
-				`Known account providers: ${[...providers].toSorted().join(", ")}`,
-				"Gateways use a plain name without /",
-				"Presets use @name"
-			]
-		});
-	}
-	if (raw.includes("/") || raw.startsWith("@")) throw anypickError(`Invalid gateway name: ${raw}`, "INVALID_REFERENCE", { exitCode: ExitCode.INVALID_USAGE });
-	return gatewayRef(raw);
-}
-/**
-* Resolve a reference with optional existence checks.
-* When a plain gateway name is missing but an exact preset exists,
-* throws NOT_FOUND suggesting `@name` (never auto-resolves).
-*/
-async function resolveSourceRef(input, ctx) {
-	const ref = parseRef(input, ctx);
-	if (ref.kind === "gateway") {
-		if (!await ctx.gatewayExists(ref.name)) {
-			if (ctx.presetExists && await ctx.presetExists(ref.name)) throw anypickError(`Gateway \`${ref.name}\` was not found.\n\nA preset with that name exists.\nDid you mean:\n  anypick use <client> --with @${ref.name}`, "RESOURCE_NOT_FOUND", {
-				exitCode: ExitCode.NOT_FOUND,
-				suggestions: [`anypick use <client> --with @${ref.name}`],
-				details: {
-					kind: "gateway",
-					name: ref.name,
-					presetSuggestion: ref.name
-				}
-			});
-			throw anypickError(`Gateway \`${ref.name}\` was not found.`, "GATEWAY_NOT_FOUND", {
-				exitCode: ExitCode.NOT_FOUND,
-				suggestions: [
-					"Accounts use provider/name:",
-					"  anypick use claude --with grok/work",
-					"Gateways use their saved name:",
-					"  anypick use claude --with openrouter-work",
-					"Presets use @name:",
-					"  anypick use claude --with @work-grok"
-				],
-				details: {
-					kind: "gateway",
-					name: ref.name
-				}
-			});
-		}
-		return ref;
-	}
-	if (ref.kind === "proxy-hub") {
-		if (ref.name !== "default") throw anypickError(`Proxy Hub \`${ref.name}\` was not found.`, "RESOURCE_NOT_FOUND", { exitCode: ExitCode.NOT_FOUND });
-		return ref;
-	}
-	if (ref.kind === "account" && ctx.accountExists) {
-		if (!await ctx.accountExists(ref.provider, ref.name)) throw anypickError(`Account \`${ref.provider}/${ref.name}\` was not found.`, "ACCOUNT_NOT_FOUND", {
-			exitCode: ExitCode.NOT_FOUND,
-			suggestions: [`anypick add account ${ref.provider} --current --name ${ref.name}`, `anypick list accounts`],
-			details: {
-				kind: "account",
-				provider: ref.provider,
-				name: ref.name
-			}
-		});
-	}
-	if (ref.kind === "preset" && ctx.presetExists) {
-		if (!await ctx.presetExists(ref.name)) throw anypickError(`Preset \`@${ref.name}\` was not found.`, "PRESET_NOT_FOUND", {
-			exitCode: ExitCode.NOT_FOUND,
-			suggestions: ["anypick list presets"],
-			details: {
-				kind: "preset",
-				name: ref.name
-			}
-		});
-	}
-	return ref;
-}
-/**
-* Optional native-account shorthand: `anypick use codex/personal`
-* Valid only when provider is also a supported client and the account
-* is a native source for that same client.
-*/
-function parseNativeAccountShorthand(input, opts) {
-	const raw = input.trim();
-	if (!raw || raw.startsWith("@") || raw.startsWith("account/") || raw.startsWith("gateway/") || raw.startsWith("preset/")) return null;
-	const slash = raw.indexOf("/");
-	if (slash <= 0) return null;
-	const provider = raw.slice(0, slash);
-	const name = raw.slice(slash + 1);
-	if (!name || name.includes("/")) return null;
-	if (!opts.accountProviders.has(provider)) return null;
-	if (!opts.clientIds.has(provider)) return null;
-	return {
-		client: provider,
-		source: accountRef(provider, name)
-	};
-}
-//#endregion
-export { DEFAULT_ACCOUNT_PROVIDERS, accountPoolRef, accountRef, displayRef, gatewayRef, mutationScopeForRef, parseNativeAccountShorthand, parseRef, presetRef, providerScope, proxyHubRef, resolveSourceRef, serializeRef };
-
-//# sourceMappingURL=refs.js.map