anypick 1.0.0 → 1.1.0

package/dist/core/runtime-service.js

@@ -1,422 +0,0 @@
-import { getAnyPickRoot, recoveryDir } from "./paths.js";
-import { normalizeProfileName } from "../utils/slug.js";
-import { resolveFromContext } from "../clients/resolve.js";
-import { syntheticProxyProfile } from "./profile-synth.js";
-import { proxyEndpointSourceAdapter } from "../sources/account-adapters.js";
-import { existsSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
-import { copyFile, mkdir, rm } from "node:fs/promises";
-import { homedir } from "node:os";
-import { createHash } from "node:crypto";
-//#region src/core/runtime-service.ts
-var RuntimeService = class {
-	profiles;
-	clientState;
-	clients;
-	config;
-	accountRegistry;
-	root;
-	constructor(profiles, clientState, clients, config, root, accountRegistry) {
-		this.profiles = profiles;
-		this.clientState = clientState;
-		this.clients = clients;
-		this.config = config;
-		this.accountRegistry = accountRegistry;
-		this.root = getAnyPickRoot(root);
-	}
-	/**
-	* Optional Codex live-config hooks, wired in app.ts so this service does not
-	* depend on Proxy/Hub services it was not constructed with.
-	*/
-	codexLiveConfigSync;
-	codexLiveConfigRestoreNative;
-	codexLiveConfigPublish;
-	setCodexLiveConfigSync(fn) {
-		this.codexLiveConfigSync = fn;
-	}
-	setCodexLiveConfigRestoreNative(fn) {
-		this.codexLiveConfigRestoreNative = fn;
-	}
-	setCodexLiveConfigPublish(fn) {
-		this.codexLiveConfigPublish = fn;
-	}
-	async syncCodexLiveConfig(opts) {
-		try {
-			await this.codexLiveConfigSync?.(opts);
-		} catch {}
-	}
-	/**
-	* Re-publish the Codex live block after the global binding is committed.
-	* AttachProxyHubRoute may sync earlier — before modelRoles land in the store —
-	* so Default/Model 2–5 would otherwise leave a stale Desktop catalog.
-	*/
-	async refreshCodexLiveConfig(opts) {
-		await this.syncCodexLiveConfig(opts ?? { forceRouted: true });
-	}
-	/** Restore user top-level Codex defaults after a native account switch. */
-	async restoreCodexLiveForNative() {
-		try {
-			await this.codexLiveConfigRestoreNative?.();
-		} catch {}
-	}
-	/**
-	* Switch to a runtime profile and apply it immediately.
-	* This is the main entry point (profile use / profile switch).
-	*/
-	async switchProfile(profileName, opts = {}) {
-		const name = normalizeProfileName(profileName);
-		await this.profiles.require(name);
-		const clientIds = await this.resolveTargetClients(opts);
-		const results = [];
-		for (const clientId of clientIds) results.push(await this.apply(name, clientId, {
-			dryRun: opts.dryRun,
-			verbose: opts.verbose
-		}));
-		if (!opts.dryRun && this.config) await this.config.update((cfg) => ({
-			...cfg,
-			activeProfile: name
-		}));
-		return {
-			profileName: name,
-			clients: results,
-			dryRun: Boolean(opts.dryRun)
-		};
-	}
-	/**
-	* Snapshot the client's previously-managed config files before overwriting.
-	* Returns `src=>dest` backup entries for any that currently exist on disk, so
-	* a crashed activation can be restored on next startup (TXN-01).
-	*
-	* Backups are stored in the owner-only AnyPick recovery directory (not the
-	* system temp dir) with collision-free hashed filenames, so two targets with
-	* the same basename — or concurrent activations — never clobber each other's
-	* backup. Files that do not yet exist (first apply) yield no backup: there is
-	* nothing to lose.
-	*/
-	async prepareClientConfigRecovery(clientId, operationId) {
-		try {
-			const prior = await this.clientState.get(clientId);
-			const inspected = await this.clients.get(clientId).inspect();
-			const targets = [
-				...prior?.managedPaths ?? [],
-				...inspected.configPaths,
-				join(this.root, "clients", clientId, "env.sh"),
-				join(this.root, "clients", clientId, "env.ps1")
-			].toSorted();
-			const unique = [...new Set(targets)];
-			const dir = operationId ? join(recoveryDir(this.root), "clients", clientId, operationId) : join(recoveryDir(this.root), "clients", clientId);
-			await mkdir(dir, {
-				recursive: true,
-				mode: 448
-			});
-			const entries = [];
-			for (const target of unique) {
-				if (!existsSync(target)) {
-					entries.push(`delete=>${target}`);
-					continue;
-				}
-				const dest = join(dir, `${createHash("sha1").update(target).digest("hex").slice(0, 16)}-${basename(target)}`);
-				try {
-					await copyFile(target, dest);
-					entries.push(`${dest}=>${target}`);
-				} catch (err) {
-					throw new Error(`Could not back up ${target}: ${err instanceof Error ? err.message : String(err)}`, { cause: err });
-				}
-			}
-			return { backupPaths: entries };
-		} catch {
-			throw new Error(`Could not prepare durable recovery for client ${clientId}`);
-		}
-	}
-	async restoreClientConfigRecovery(recovery) {
-		for (const entry of recovery.backupPaths) {
-			const [source, target] = entry.split("=>").map((value) => value.trim());
-			if (!source || !target) throw new Error(`Invalid client recovery entry: ${entry}`);
-			if (source === "delete") {
-				await rm(target, { force: true });
-				continue;
-			}
-			if (!existsSync(source)) throw new Error(`Client recovery backup is missing: ${source}`);
-			await mkdir(dirname(target), {
-				recursive: true,
-				mode: 448
-			});
-			await copyFile(source, target);
-		}
-	}
-	async apply(profileName, clientId, opts = {}) {
-		const name = normalizeProfileName(profileName);
-		const profile = await this.profiles.require(name);
-		const client = this.clients.get(clientId);
-		const dryRun = Boolean(opts.dryRun);
-		const recovery = dryRun ? { backupPaths: [] } : opts.recovery ?? await this.prepareClientConfigRecovery(clientId);
-		const ctx = {
-			profile,
-			clientId: client.id,
-			dryRun,
-			verbose: Boolean(opts.verbose),
-			anypickRoot: this.root,
-			proxyEndpoint: opts.proxyEndpoint
-		};
-		await client.validate(ctx);
-		const result = await client.apply(ctx);
-		if (!dryRun) {
-			const state = {
-				clientId: client.id,
-				mode: "profile",
-				profileName: name,
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-				managedPaths: result.managedPaths,
-				managedEnvKeys: result.managedEnvKeys
-			};
-			await this.clientState.write(state);
-			if (client.id === "codex") await this.publishCodexGatewayLive(ctx, name);
-		}
-		return {
-			clientId: client.id,
-			profileName: name,
-			managedPaths: result.managedPaths,
-			managedEnvKeys: result.managedEnvKeys,
-			dryRun,
-			envHint: `${this.root}/clients/${client.id}/env.sh`,
-			backupPaths: recovery.backupPaths.length ? recovery.backupPaths : void 0
-		};
-	}
-	async publishCodexProxyLive(source, endpoint, apiKey, defaultModel) {
-		try {
-			const token = apiKey?.trim();
-			if (!endpoint || !token) {
-				await this.syncCodexLiveConfig({ forceRouted: true });
-				return;
-			}
-			await this.codexLiveConfigPublish?.({
-				source,
-				endpoint,
-				token,
-				defaultModel
-			});
-		} catch {}
-	}
-	async publishCodexGatewayLive(ctx, profileName) {
-		try {
-			const resolved = resolveFromContext({
-				profile: ctx.profile,
-				clientId: "codex",
-				dryRun: false,
-				verbose: false,
-				anypickRoot: this.root,
-				proxyEndpoint: ctx.proxyEndpoint
-			});
-			if (!resolved.endpoint || !resolved.apiKey) return;
-			await this.codexLiveConfigPublish?.({
-				source: `gateway:${profileName}`,
-				endpoint: resolved.endpoint,
-				token: resolved.apiKey,
-				defaultModel: resolved.defaultModel
-			});
-		} catch {}
-	}
-	/**
-	* Apply client config for an account+proxy activation (spec §22).
-	* Injects the managed proxy endpoint into the client without requiring
-	* a saved gateway profile.
-	*/
-	async applyProxyEndpoint(clientId, opts) {
-		const client = this.clients.get(clientId);
-		const dryRun = Boolean(opts.dryRun);
-		const recovery = dryRun ? { backupPaths: [] } : opts.recovery ?? await this.prepareClientConfigRecovery(clientId);
-		const label = opts.label ?? (opts.accountRef ? `proxy:${opts.accountRef.provider}/${opts.accountRef.name}` : "proxy:account");
-		const roles = opts.modelRoles;
-		const defaultModel = opts.defaultModel ?? roles?.default;
-		const profile = syntheticProxyProfile({
-			name: label,
-			endpoint: opts.endpoint,
-			apiKey: opts.apiKey ?? "anypick-proxy",
-			defaultModel,
-			sonnetModel: opts.sonnetModel ?? roles?.sonnet,
-			opusModel: opts.opusModel ?? roles?.opus,
-			haikuModel: opts.haikuModel ?? roles?.haiku,
-			modelRoles: roles,
-			provider: "custom"
-		});
-		if (client.applyPersistent) {
-			const providerId = opts.accountRef?.provider ?? "unknown";
-			const accountName = opts.accountRef?.name ?? "unknown";
-			const provider = this.accountRegistry?.has(providerId) ? this.accountRegistry.get(providerId) : void 0;
-			const plan = {
-				clientId: client.id,
-				source: {
-					ref: {
-						kind: "account",
-						provider: providerId,
-						name: accountName
-					},
-					kind: "account",
-					adapter: proxyEndpointSourceAdapter(providerId, accountName, provider),
-					display: label
-				},
-				transport: {
-					capability: "managed_builtin_proxy",
-					protocol: client.capabilities?.protocolPreference ?? client.capabilities?.acceptedProtocols[0] ?? "openai",
-					endpoint: opts.endpoint
-				},
-				model: defaultModel ? {
-					mode: "explicit",
-					id: defaultModel
-				} : { mode: "omitted" },
-				mode: "persistent",
-				profile,
-				dryRun,
-				verbose: Boolean(opts.verbose),
-				anypickRoot: this.root
-			};
-			const result = await client.applyPersistent(plan);
-			if (!dryRun) {
-				await this.clientState.write({
-					clientId: client.id,
-					mode: "account",
-					accountRef: opts.accountRef,
-					updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-					managedPaths: result.managedPaths,
-					managedEnvKeys: result.managedEnvKeys
-				});
-				if (client.id === "codex") await this.publishCodexProxyLive(label, opts.endpoint, opts.apiKey, defaultModel);
-			}
-			return {
-				clientId: client.id,
-				profileName: label,
-				managedPaths: result.managedPaths,
-				managedEnvKeys: result.managedEnvKeys,
-				dryRun,
-				envHint: `${this.root}/clients/${client.id}/env.sh`,
-				backupPaths: recovery.backupPaths.length ? recovery.backupPaths : void 0
-			};
-		}
-		const ctx = {
-			profile,
-			clientId: client.id,
-			dryRun,
-			verbose: Boolean(opts.verbose),
-			anypickRoot: this.root,
-			proxyEndpoint: opts.endpoint
-		};
-		await client.validate(ctx);
-		const result = await client.apply(ctx);
-		if (!dryRun) {
-			await this.clientState.write({
-				clientId: client.id,
-				mode: "account",
-				accountRef: opts.accountRef,
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-				managedPaths: result.managedPaths,
-				managedEnvKeys: result.managedEnvKeys
-			});
-			if (client.id === "codex") await this.publishCodexProxyLive(label, opts.endpoint, opts.apiKey, defaultModel);
-		}
-		return {
-			clientId: client.id,
-			profileName: label,
-			managedPaths: result.managedPaths,
-			managedEnvKeys: result.managedEnvKeys,
-			dryRun,
-			envHint: `${this.root}/clients/${client.id}/env.sh`,
-			backupPaths: recovery.backupPaths.length ? recovery.backupPaths : void 0
-		};
-	}
-	/**
-	* Build an isolated ephemeral runtime for `anypick run` (spec §9.7.1).
-	* Never mutates live client configuration.
-	*/
-	async createEphemeralRuntime(plan) {
-		const client = this.clients.get(plan.clientId);
-		const caps = client.capabilities;
-		if (caps?.supportsIsolatedHome && client.listIsolatablePaths && client.createIsolatedRuntime) {
-			const liveHome = process.env.HOME ?? homedir();
-			const paths = await client.listIsolatablePaths({ home: liveHome });
-			const runtime = await client.createIsolatedRuntime(plan, paths);
-			return {
-				environment: runtime.environment,
-				args: runtime.args,
-				cleanup: () => runtime.cleanup(),
-				directory: runtime.directory
-			};
-		}
-		if (caps?.supportsEnvironmentOverlay && client.createEnvironmentOverlay) {
-			const runtime = await client.createEnvironmentOverlay(plan);
-			return {
-				environment: runtime.environment,
-				args: runtime.args,
-				cleanup: () => runtime.cleanup(),
-				directory: runtime.directory
-			};
-		}
-		throw new Error(`Client ${plan.clientId} does not implement an ephemeral runtime`);
-	}
-	async reset(clientId, opts = {}) {
-		const client = this.clients.get(clientId);
-		const existing = await this.clientState.get(client.id);
-		const dryRun = Boolean(opts.dryRun);
-		const state = existing ?? {
-			clientId: client.id,
-			mode: "none",
-			updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-			managedPaths: [],
-			managedEnvKeys: []
-		};
-		if (!dryRun) {
-			await client.reset(state);
-			await this.clientState.write({
-				clientId: client.id,
-				mode: "none",
-				updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-				managedPaths: [],
-				managedEnvKeys: []
-			});
-		}
-		return {
-			clientId: client.id,
-			previousMode: state.mode,
-			previousProfile: state.profileName,
-			dryRun
-		};
-	}
-	async status(clientId) {
-		const list = clientId ? [this.clients.get(clientId)] : this.clients.list();
-		const out = [];
-		for (const c of list) out.push({
-			clientId: c.id,
-			clientName: c.name,
-			state: await this.clientState.get(c.id),
-			inspect: await c.inspect()
-		});
-		return out;
-	}
-	async which(clientId) {
-		this.clients.get(clientId);
-		return this.clientState.get(clientId);
-	}
-	async activeProfile() {
-		if (!this.config) return null;
-		return (await this.config.read()).activeProfile ?? null;
-	}
-	async resolveTargetClients(opts) {
-		if (opts.allClients) return this.clients.ids();
-		if (opts.client) {
-			this.clients.get(opts.client);
-			return [opts.client];
-		}
-		let defaultClient = "claude";
-		if (this.config) {
-			const cfg = await this.config.read();
-			if (cfg.defaultClient) defaultClient = cfg.defaultClient;
-		}
-		if (this.clients.has(defaultClient)) return [defaultClient];
-		const first = this.clients.ids()[0];
-		if (!first) throw new Error("No client adapters registered.");
-		return [first];
-	}
-};
-//#endregion
-export { RuntimeService };
-
-//# sourceMappingURL=runtime-service.js.map

package/dist/core/runtime-service.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"runtime-service.js","names":[],"sources":["../../src/core/runtime-service.ts"],"sourcesContent":["import type { ClientState, GlobalConfig, ResolvedClientPlan, RuntimeProfile } from '../types';\nimport type { ClientRegistry } from '../clients/registry';\nimport type { ClientStateStore } from './client-state-store';\nimport type { ProfileStore } from './profile-store';\nimport type { ConfigService } from './config-service';\nimport type { ProviderRegistry } from './registry';\nimport { resolveFromContext } from '../clients/resolve';\nimport { normalizeProfileName } from '../utils/slug';\nimport { getAnyPickRoot } from './paths';\nimport { syntheticProxyProfile } from './profile-synth';\nimport { proxyEndpointSourceAdapter } from '../sources/account-adapters';\nimport { homedir } from 'node:os';\nimport { mkdir, copyFile, rm } from 'node:fs/promises';\nimport { join, basename, dirname } from 'node:path';\nimport { existsSync } from 'node:fs';\nimport { createHash } from 'node:crypto';\nimport { recoveryDir } from './paths';\n\nexport interface RuntimeApplyResult {\n  clientId: string;\n  profileName: string;\n  managedPaths: string[];\n  managedEnvKeys: string[];\n  dryRun: boolean;\n  envHint?: string;\n  /**\n   * `src=>dest` entries of the on-disk backups taken for the files this apply\n   * was about to overwrite (the client's previously-managed config paths).\n   * Empty on first apply (nothing to lose). Consumed by the activation journal\n   * so a crash mid-activation can be restored on next startup.\n   */\n  backupPaths?: string[];\n}\n\nexport interface RuntimeSwitchResult {\n  profileName: string;\n  clients: RuntimeApplyResult[];\n  dryRun: boolean;\n}\n\nexport interface RuntimeResetResult {\n  clientId: string;\n  previousMode: string;\n  previousProfile?: string;\n  dryRun: boolean;\n}\n\n/**\n * Durable compensation prepared before a client adapter is allowed to mutate\n * local configuration. `backupPaths` is journal-compatible: `src=>dest`\n * restores an existing file while `delete=>dest` removes a newly-created one.\n */\nexport interface ClientConfigRecovery {\n  backupPaths: string[];\n}\n\nexport class RuntimeService {\n  readonly root: string;\n\n  constructor(\n    private readonly profiles: ProfileStore,\n    private readonly clientState: ClientStateStore,\n    private readonly clients: ClientRegistry,\n    private readonly config?: ConfigService,\n    root?: string,\n    private readonly accountRegistry?: ProviderRegistry,\n  ) {\n    this.root = getAnyPickRoot(root);\n  }\n\n  /**\n   * Optional Codex live-config hooks, wired in app.ts so this service does not\n   * depend on Proxy/Hub services it was not constructed with.\n   */\n  private codexLiveConfigSync?: (opts?: { forceRouted?: boolean }) => Promise<void>;\n  private codexLiveConfigRestoreNative?: () => Promise<void>;\n  private codexLiveConfigPublish?: (provider: {\n    source: string;\n    endpoint: string;\n    token: string;\n    defaultModel?: string;\n  }) => Promise<void>;\n\n  setCodexLiveConfigSync(fn: (opts?: { forceRouted?: boolean }) => Promise<void>): void {\n    this.codexLiveConfigSync = fn;\n  }\n\n  setCodexLiveConfigRestoreNative(fn: () => Promise<void>): void {\n    this.codexLiveConfigRestoreNative = fn;\n  }\n\n  setCodexLiveConfigPublish(\n    fn: (provider: {\n      source: string;\n      endpoint: string;\n      token: string;\n      defaultModel?: string;\n    }) => Promise<void>,\n  ): void {\n    this.codexLiveConfigPublish = fn;\n  }\n\n  private async syncCodexLiveConfig(opts?: { forceRouted?: boolean }): Promise<void> {\n    try {\n      await this.codexLiveConfigSync?.(opts);\n    } catch {\n      // Best-effort: a failed live-block refresh must never fail activation.\n    }\n  }\n\n  /**\n   * Re-publish the Codex live block after the global binding is committed.\n   * AttachProxyHubRoute may sync earlier — before modelRoles land in the store —\n   * so Default/Model 2–5 would otherwise leave a stale Desktop catalog.\n   */\n  async refreshCodexLiveConfig(opts?: { forceRouted?: boolean }): Promise<void> {\n    await this.syncCodexLiveConfig(opts ?? { forceRouted: true });\n  }\n\n  /** Restore user top-level Codex defaults after a native account switch. */\n  async restoreCodexLiveForNative(): Promise<void> {\n    try {\n      await this.codexLiveConfigRestoreNative?.();\n    } catch {\n      // Best-effort.\n    }\n  }\n\n  /**\n   * Switch to a runtime profile and apply it immediately.\n   * This is the main entry point (profile use / profile switch).\n   */\n  async switchProfile(\n    profileName: string,\n    opts: {\n      client?: string;\n      allClients?: boolean;\n      dryRun?: boolean;\n      verbose?: boolean;\n    } = {},\n  ): Promise<RuntimeSwitchResult> {\n    const name = normalizeProfileName(profileName);\n    await this.profiles.require(name);\n\n    const clientIds = await this.resolveTargetClients(opts);\n    const results: RuntimeApplyResult[] = [];\n    for (const clientId of clientIds) {\n      results.push(\n        await this.apply(name, clientId, {\n          dryRun: opts.dryRun,\n          verbose: opts.verbose,\n        }),\n      );\n    }\n\n    if (!opts.dryRun && this.config) {\n      await this.config.update(\n        (cfg) =>\n          ({\n            ...cfg,\n            activeProfile: name,\n          }) satisfies GlobalConfig,\n      );\n    }\n\n    return {\n      profileName: name,\n      clients: results,\n      dryRun: Boolean(opts.dryRun),\n    };\n  }\n\n  /**\n   * Snapshot the client's previously-managed config files before overwriting.\n   * Returns `src=>dest` backup entries for any that currently exist on disk, so\n   * a crashed activation can be restored on next startup (TXN-01).\n   *\n   * Backups are stored in the owner-only AnyPick recovery directory (not the\n   * system temp dir) with collision-free hashed filenames, so two targets with\n   * the same basename — or concurrent activations — never clobber each other's\n   * backup. Files that do not yet exist (first apply) yield no backup: there is\n   * nothing to lose.\n   */\n  async prepareClientConfigRecovery(\n    clientId: string,\n    operationId?: string,\n  ): Promise<ClientConfigRecovery> {\n    try {\n      const prior = await this.clientState.get(clientId);\n      const client = this.clients.get(clientId);\n      const inspected = await client.inspect();\n      const targets = [\n        ...(prior?.managedPaths ?? []),\n        ...inspected.configPaths,\n        // All bundled adapters use these AnyPick-owned environment files. They\n        // must be compensated too even on a first apply.\n        join(this.root, 'clients', clientId, 'env.sh'),\n        join(this.root, 'clients', clientId, 'env.ps1'),\n      ].toSorted();\n      const unique = [...new Set(targets)];\n      const dir = operationId\n        ? join(recoveryDir(this.root), 'clients', clientId, operationId)\n        : join(recoveryDir(this.root), 'clients', clientId);\n      await mkdir(dir, { recursive: true, mode: 0o700 });\n      const entries: string[] = [];\n      for (const target of unique) {\n        if (!existsSync(target)) {\n          entries.push(`delete=>${target}`);\n          continue;\n        }\n        // Hash the absolute target so two different files named e.g. settings.json\n        // back up to distinct paths; include the basename for human readability.\n        const hash = createHash('sha1').update(target).digest('hex').slice(0, 16);\n        const dest = join(dir, `${hash}-${basename(target)}`);\n        try {\n          await copyFile(target, dest);\n          entries.push(`${dest}=>${target}`);\n        } catch (err) {\n          // Existing state that cannot be snapshotted is not safe to overwrite.\n          // Do not turn this into a best-effort backup: the caller has already\n          // promised the journal can compensate every managed write.\n          throw new Error(\n            `Could not back up ${target}: ${err instanceof Error ? err.message : String(err)}`,\n            { cause: err },\n          );\n        }\n      }\n      return { backupPaths: entries };\n    } catch {\n      // A recovery plan that cannot be prepared must never permit a mutation.\n      throw new Error(`Could not prepare durable recovery for client ${clientId}`);\n    }\n  }\n\n  async restoreClientConfigRecovery(recovery: ClientConfigRecovery): Promise<void> {\n    for (const entry of recovery.backupPaths) {\n      const [source, target] = entry.split('=>').map((value) => value.trim());\n      if (!source || !target) {\n        throw new Error(`Invalid client recovery entry: ${entry}`);\n      }\n      if (source === 'delete') {\n        await rm(target, { force: true });\n        continue;\n      }\n      if (!existsSync(source)) {\n        throw new Error(`Client recovery backup is missing: ${source}`);\n      }\n      await mkdir(dirname(target), { recursive: true, mode: 0o700 });\n      await copyFile(source, target);\n    }\n  }\n\n  async apply(\n    profileName: string,\n    clientId: string,\n    opts: {\n      dryRun?: boolean;\n      verbose?: boolean;\n      /** Override endpoint (e.g. managed proxy URL). */\n      proxyEndpoint?: string;\n      /** Prepared and journaled before this method is allowed to mutate. */\n      recovery?: ClientConfigRecovery;\n    } = {},\n  ): Promise<RuntimeApplyResult> {\n    const name = normalizeProfileName(profileName);\n    const profile = await this.profiles.require(name);\n    const client = this.clients.get(clientId);\n    const dryRun = Boolean(opts.dryRun);\n\n    const recovery = dryRun\n      ? { backupPaths: [] }\n      : (opts.recovery ?? (await this.prepareClientConfigRecovery(clientId)));\n\n    const ctx = {\n      profile,\n      clientId: client.id,\n      dryRun,\n      verbose: Boolean(opts.verbose),\n      anypickRoot: this.root,\n      proxyEndpoint: opts.proxyEndpoint,\n    };\n\n    await client.validate(ctx);\n    const result = await client.apply(ctx);\n\n    if (!dryRun) {\n      const state: ClientState = {\n        clientId: client.id,\n        mode: 'profile',\n        profileName: name,\n        updatedAt: new Date().toISOString(),\n        managedPaths: result.managedPaths,\n        managedEnvKeys: result.managedEnvKeys,\n      };\n      await this.clientState.write(state);\n      // Gateway profile apply: also take over top-level ~/.codex/config.toml so\n      // plain `codex` / desktop honor the gateway without --profile.\n      if (client.id === 'codex') {\n        await this.publishCodexGatewayLive(ctx, name);\n      }\n    }\n\n    return {\n      clientId: client.id,\n      profileName: name,\n      managedPaths: result.managedPaths,\n      managedEnvKeys: result.managedEnvKeys,\n      dryRun,\n      envHint: `${this.root}/clients/${client.id}/env.sh`,\n      backupPaths: recovery.backupPaths.length ? recovery.backupPaths : undefined,\n    };\n  }\n\n  private async publishCodexProxyLive(\n    source: string,\n    endpoint: string,\n    apiKey: string | undefined,\n    defaultModel: string | undefined,\n  ): Promise<void> {\n    try {\n      const token = apiKey?.trim();\n      if (!endpoint || !token) {\n        // Fall back to hub/proxy resolution without a sticky model override.\n        await this.syncCodexLiveConfig({ forceRouted: true });\n        return;\n      }\n      await this.codexLiveConfigPublish?.({\n        source,\n        endpoint,\n        token,\n        defaultModel,\n      });\n    } catch {\n      // Best-effort: profile files already written.\n    }\n  }\n\n  private async publishCodexGatewayLive(\n    ctx: {\n      profile: RuntimeProfile;\n      proxyEndpoint?: string;\n    },\n    profileName: string,\n  ): Promise<void> {\n    try {\n      const resolved = resolveFromContext({\n        profile: ctx.profile,\n        clientId: 'codex',\n        dryRun: false,\n        verbose: false,\n        anypickRoot: this.root,\n        proxyEndpoint: ctx.proxyEndpoint,\n      });\n      if (!resolved.endpoint || !resolved.apiKey) {\n        return;\n      }\n      await this.codexLiveConfigPublish?.({\n        source: `gateway:${profileName}`,\n        endpoint: resolved.endpoint,\n        token: resolved.apiKey,\n        defaultModel: resolved.defaultModel,\n      });\n    } catch {\n      // Best-effort: profile files already written.\n    }\n  }\n\n  /**\n   * Apply client config for an account+proxy activation (spec §22).\n   * Injects the managed proxy endpoint into the client without requiring\n   * a saved gateway profile.\n   */\n  async applyProxyEndpoint(\n    clientId: string,\n    opts: {\n      endpoint: string;\n      apiKey?: string;\n      defaultModel?: string;\n      sonnetModel?: string;\n      opusModel?: string;\n      haikuModel?: string;\n      /** Role id → model id (preferred; fills default/sonnet/opus/haiku). */\n      modelRoles?: Record<string, string>;\n      accountRef?: { provider: string; name: string };\n      dryRun?: boolean;\n      verbose?: boolean;\n      /** Label for synthetic profile / state tracking. */\n      label?: string;\n      /** Prepared and journaled before this method is allowed to mutate. */\n      recovery?: ClientConfigRecovery;\n    },\n  ): Promise<RuntimeApplyResult> {\n    const client = this.clients.get(clientId);\n    const dryRun = Boolean(opts.dryRun);\n    const recovery = dryRun\n      ? { backupPaths: [] }\n      : (opts.recovery ?? (await this.prepareClientConfigRecovery(clientId)));\n    const label =\n      opts.label ??\n      (opts.accountRef\n        ? `proxy:${opts.accountRef.provider}/${opts.accountRef.name}`\n        : 'proxy:account');\n\n    const roles = opts.modelRoles;\n    const defaultModel = opts.defaultModel ?? roles?.default;\n    const profile: RuntimeProfile = syntheticProxyProfile({\n      name: label,\n      endpoint: opts.endpoint,\n      apiKey: opts.apiKey ?? 'anypick-proxy',\n      defaultModel,\n      sonnetModel: opts.sonnetModel ?? roles?.sonnet,\n      opusModel: opts.opusModel ?? roles?.opus,\n      haikuModel: opts.haikuModel ?? roles?.haiku,\n      modelRoles: roles,\n      provider: 'custom',\n    });\n\n    // Prefer applyPersistent when available\n    if (client.applyPersistent) {\n      const providerId = opts.accountRef?.provider ?? 'unknown';\n      const accountName = opts.accountRef?.name ?? 'unknown';\n      const provider = this.accountRegistry?.has(providerId)\n        ? this.accountRegistry.get(providerId)\n        : undefined;\n      const plan: ResolvedClientPlan = {\n        clientId: client.id,\n        source: {\n          ref: { kind: 'account', provider: providerId, name: accountName },\n          kind: 'account',\n          adapter: proxyEndpointSourceAdapter(providerId, accountName, provider),\n          display: label,\n        },\n        transport: {\n          capability: 'managed_builtin_proxy',\n          protocol:\n            client.capabilities?.protocolPreference ??\n            client.capabilities?.acceptedProtocols[0] ??\n            'openai',\n          endpoint: opts.endpoint,\n        },\n        model: defaultModel ? { mode: 'explicit', id: defaultModel } : { mode: 'omitted' },\n        mode: 'persistent',\n        profile,\n        dryRun,\n        verbose: Boolean(opts.verbose),\n        anypickRoot: this.root,\n      };\n      const result = await client.applyPersistent(plan);\n      if (!dryRun) {\n        await this.clientState.write({\n          clientId: client.id,\n          mode: 'account',\n          accountRef: opts.accountRef,\n          updatedAt: new Date().toISOString(),\n          managedPaths: result.managedPaths,\n          managedEnvKeys: result.managedEnvKeys,\n        });\n        if (client.id === 'codex') {\n          // Activation bound Codex to a proxy: take over top-level with the\n          // chosen default model (force routed even after a native switch).\n          await this.publishCodexProxyLive(label, opts.endpoint, opts.apiKey, defaultModel);\n        }\n      }\n      return {\n        clientId: client.id,\n        profileName: label,\n        managedPaths: result.managedPaths,\n        managedEnvKeys: result.managedEnvKeys,\n        dryRun,\n        envHint: `${this.root}/clients/${client.id}/env.sh`,\n        backupPaths: recovery.backupPaths.length ? recovery.backupPaths : undefined,\n      };\n    }\n\n    const ctx = {\n      profile,\n      clientId: client.id,\n      dryRun,\n      verbose: Boolean(opts.verbose),\n      anypickRoot: this.root,\n      proxyEndpoint: opts.endpoint,\n    };\n    await client.validate(ctx);\n    const result = await client.apply(ctx);\n    if (!dryRun) {\n      await this.clientState.write({\n        clientId: client.id,\n        mode: 'account',\n        accountRef: opts.accountRef,\n        updatedAt: new Date().toISOString(),\n        managedPaths: result.managedPaths,\n        managedEnvKeys: result.managedEnvKeys,\n      });\n      if (client.id === 'codex') {\n        await this.publishCodexProxyLive(label, opts.endpoint, opts.apiKey, defaultModel);\n      }\n    }\n    return {\n      clientId: client.id,\n      profileName: label,\n      managedPaths: result.managedPaths,\n      managedEnvKeys: result.managedEnvKeys,\n      dryRun,\n      envHint: `${this.root}/clients/${client.id}/env.sh`,\n      backupPaths: recovery.backupPaths.length ? recovery.backupPaths : undefined,\n    };\n  }\n\n  /**\n   * Build an isolated ephemeral runtime for `anypick run` (spec §9.7.1).\n   * Never mutates live client configuration.\n   */\n  async createEphemeralRuntime(plan: ResolvedClientPlan): Promise<{\n    environment: Record<string, string>;\n    args?: string[];\n    cleanup: () => Promise<void>;\n    directory: string;\n  }> {\n    const client = this.clients.get(plan.clientId);\n    const caps = client.capabilities;\n    if (caps?.supportsIsolatedHome && client.listIsolatablePaths && client.createIsolatedRuntime) {\n      const liveHome = process.env.HOME ?? homedir();\n      const paths = await client.listIsolatablePaths({ home: liveHome });\n      const runtime = await client.createIsolatedRuntime(plan, paths);\n      return {\n        environment: runtime.environment,\n        args: runtime.args,\n        cleanup: () => runtime.cleanup(),\n        directory: runtime.directory,\n      };\n    }\n\n    if (caps?.supportsEnvironmentOverlay && client.createEnvironmentOverlay) {\n      const runtime = await client.createEnvironmentOverlay(plan);\n      return {\n        environment: runtime.environment,\n        args: runtime.args,\n        cleanup: () => runtime.cleanup(),\n        directory: runtime.directory,\n      };\n    }\n\n    throw new Error(`Client ${plan.clientId} does not implement an ephemeral runtime`);\n  }\n\n  async reset(clientId: string, opts: { dryRun?: boolean } = {}): Promise<RuntimeResetResult> {\n    const client = this.clients.get(clientId);\n    const existing = await this.clientState.get(client.id);\n    const dryRun = Boolean(opts.dryRun);\n\n    const state: ClientState = existing ?? {\n      clientId: client.id,\n      mode: 'none',\n      updatedAt: new Date().toISOString(),\n      managedPaths: [],\n      managedEnvKeys: [],\n    };\n\n    if (!dryRun) {\n      await client.reset(state);\n      await this.clientState.write({\n        clientId: client.id,\n        mode: 'none',\n        updatedAt: new Date().toISOString(),\n        managedPaths: [],\n        managedEnvKeys: [],\n      });\n    }\n\n    return {\n      clientId: client.id,\n      previousMode: state.mode,\n      previousProfile: state.profileName,\n      dryRun,\n    };\n  }\n\n  async status(clientId?: string): Promise<\n    Array<{\n      clientId: string;\n      clientName: string;\n      state: ClientState | null;\n      inspect: Awaited<ReturnType<import('../types').ClientAdapter['inspect']>>;\n    }>\n  > {\n    const list = clientId ? [this.clients.get(clientId)] : this.clients.list();\n\n    const out = [];\n    for (const c of list) {\n      out.push({\n        clientId: c.id,\n        clientName: c.name,\n        state: await this.clientState.get(c.id),\n        inspect: await c.inspect(),\n      });\n    }\n    return out;\n  }\n\n  async which(clientId: string): Promise<ClientState | null> {\n    this.clients.get(clientId);\n    return this.clientState.get(clientId);\n  }\n\n  async activeProfile(): Promise<string | null> {\n    if (!this.config) {\n      return null;\n    }\n    const cfg = await this.config.read();\n    return cfg.activeProfile ?? null;\n  }\n\n  private async resolveTargetClients(opts: {\n    client?: string;\n    allClients?: boolean;\n  }): Promise<string[]> {\n    if (opts.allClients) {\n      return this.clients.ids();\n    }\n    if (opts.client) {\n      this.clients.get(opts.client);\n      return [opts.client];\n    }\n    // Default client from config (claude)\n    let defaultClient = 'claude';\n    if (this.config) {\n      const cfg = await this.config.read();\n      if (cfg.defaultClient) {\n        defaultClient = cfg.defaultClient;\n      }\n    }\n    if (this.clients.has(defaultClient)) {\n      return [defaultClient];\n    }\n    const first = this.clients.ids()[0];\n    if (!first) {\n      throw new Error('No client adapters registered.');\n    }\n    return [first];\n  }\n}\n"],"mappings":";;;;;;;;;;;AAwDA,IAAa,iBAAb,MAA4B;CAIP;CACA;CACA;CACA;CAEA;CARnB;CAEA,YACE,UACA,aACA,SACA,QACA,MACA,iBACA;EANiB,KAAA,WAAA;EACA,KAAA,cAAA;EACA,KAAA,UAAA;EACA,KAAA,SAAA;EAEA,KAAA,kBAAA;EAEjB,KAAK,OAAO,eAAe,IAAI;CACjC;;;;;CAMA;CACA;CACA;CAOA,uBAAuB,IAA+D;EACpF,KAAK,sBAAsB;CAC7B;CAEA,gCAAgC,IAA+B;EAC7D,KAAK,+BAA+B;CACtC;CAEA,0BACE,IAMM;EACN,KAAK,yBAAyB;CAChC;CAEA,MAAc,oBAAoB,MAAiD;EACjF,IAAI;GACF,MAAM,KAAK,sBAAsB,IAAI;EACvC,QAAQ,CAER;CACF;;;;;;CAOA,MAAM,uBAAuB,MAAiD;EAC5E,MAAM,KAAK,oBAAoB,QAAQ,EAAE,aAAa,KAAK,CAAC;CAC9D;;CAGA,MAAM,4BAA2C;EAC/C,IAAI;GACF,MAAM,KAAK,+BAA+B;EAC5C,QAAQ,CAER;CACF;;;;;CAMA,MAAM,cACJ,aACA,OAKI,CAAC,GACyB;EAC9B,MAAM,OAAO,qBAAqB,WAAW;EAC7C,MAAM,KAAK,SAAS,QAAQ,IAAI;EAEhC,MAAM,YAAY,MAAM,KAAK,qBAAqB,IAAI;EACtD,MAAM,UAAgC,CAAC;EACvC,KAAK,MAAM,YAAY,WACrB,QAAQ,KACN,MAAM,KAAK,MAAM,MAAM,UAAU;GAC/B,QAAQ,KAAK;GACb,SAAS,KAAK;EAChB,CAAC,CACH;EAGF,IAAI,CAAC,KAAK,UAAU,KAAK,QACvB,MAAM,KAAK,OAAO,QACf,SACE;GACC,GAAG;GACH,eAAe;EACjB,EACJ;EAGF,OAAO;GACL,aAAa;GACb,SAAS;GACT,QAAQ,QAAQ,KAAK,MAAM;EAC7B;CACF;;;;;;;;;;;;CAaA,MAAM,4BACJ,UACA,aAC+B;EAC/B,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,YAAY,IAAI,QAAQ;GAEjD,MAAM,YAAY,MADH,KAAK,QAAQ,IAAI,QACR,CAAA,CAAO,QAAQ;GACvC,MAAM,UAAU;IACd,GAAI,OAAO,gBAAgB,CAAC;IAC5B,GAAG,UAAU;IAGb,KAAK,KAAK,MAAM,WAAW,UAAU,QAAQ;IAC7C,KAAK,KAAK,MAAM,WAAW,UAAU,SAAS;GAChD,CAAC,CAAC,SAAS;GACX,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC;GACnC,MAAM,MAAM,cACR,KAAK,YAAY,KAAK,IAAI,GAAG,WAAW,UAAU,WAAW,IAC7D,KAAK,YAAY,KAAK,IAAI,GAAG,WAAW,QAAQ;GACpD,MAAM,MAAM,KAAK;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GACjD,MAAM,UAAoB,CAAC;GAC3B,KAAK,MAAM,UAAU,QAAQ;IAC3B,IAAI,CAAC,WAAW,MAAM,GAAG;KACvB,QAAQ,KAAK,WAAW,QAAQ;KAChC;IACF;IAIA,MAAM,OAAO,KAAK,KAAK,GADV,WAAW,MAAM,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,EAC5C,EAAK,GAAG,SAAS,MAAM,GAAG;IACpD,IAAI;KACF,MAAM,SAAS,QAAQ,IAAI;KAC3B,QAAQ,KAAK,GAAG,KAAK,IAAI,QAAQ;IACnC,SAAS,KAAK;KAIZ,MAAM,IAAI,MACR,qBAAqB,OAAO,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,KAC/E,EAAE,OAAO,IAAI,CACf;IACF;GACF;GACA,OAAO,EAAE,aAAa,QAAQ;EAChC,QAAQ;GAEN,MAAM,IAAI,MAAM,iDAAiD,UAAU;EAC7E;CACF;CAEA,MAAM,4BAA4B,UAA+C;EAC/E,KAAK,MAAM,SAAS,SAAS,aAAa;GACxC,MAAM,CAAC,QAAQ,UAAU,MAAM,MAAM,IAAI,CAAC,CAAC,KAAK,UAAU,MAAM,KAAK,CAAC;GACtE,IAAI,CAAC,UAAU,CAAC,QACd,MAAM,IAAI,MAAM,kCAAkC,OAAO;GAE3D,IAAI,WAAW,UAAU;IACvB,MAAM,GAAG,QAAQ,EAAE,OAAO,KAAK,CAAC;IAChC;GACF;GACA,IAAI,CAAC,WAAW,MAAM,GACpB,MAAM,IAAI,MAAM,sCAAsC,QAAQ;GAEhE,MAAM,MAAM,QAAQ,MAAM,GAAG;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GAC7D,MAAM,SAAS,QAAQ,MAAM;EAC/B;CACF;CAEA,MAAM,MACJ,aACA,UACA,OAOI,CAAC,GACwB;EAC7B,MAAM,OAAO,qBAAqB,WAAW;EAC7C,MAAM,UAAU,MAAM,KAAK,SAAS,QAAQ,IAAI;EAChD,MAAM,SAAS,KAAK,QAAQ,IAAI,QAAQ;EACxC,MAAM,SAAS,QAAQ,KAAK,MAAM;EAElC,MAAM,WAAW,SACb,EAAE,aAAa,CAAC,EAAE,IACjB,KAAK,YAAa,MAAM,KAAK,4BAA4B,QAAQ;EAEtE,MAAM,MAAM;GACV;GACA,UAAU,OAAO;GACjB;GACA,SAAS,QAAQ,KAAK,OAAO;GAC7B,aAAa,KAAK;GAClB,eAAe,KAAK;EACtB;EAEA,MAAM,OAAO,SAAS,GAAG;EACzB,MAAM,SAAS,MAAM,OAAO,MAAM,GAAG;EAErC,IAAI,CAAC,QAAQ;GACX,MAAM,QAAqB;IACzB,UAAU,OAAO;IACjB,MAAM;IACN,aAAa;IACb,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;IAClC,cAAc,OAAO;IACrB,gBAAgB,OAAO;GACzB;GACA,MAAM,KAAK,YAAY,MAAM,KAAK;GAGlC,IAAI,OAAO,OAAO,SAChB,MAAM,KAAK,wBAAwB,KAAK,IAAI;EAEhD;EAEA,OAAO;GACL,UAAU,OAAO;GACjB,aAAa;GACb,cAAc,OAAO;GACrB,gBAAgB,OAAO;GACvB;GACA,SAAS,GAAG,KAAK,KAAK,WAAW,OAAO,GAAG;GAC3C,aAAa,SAAS,YAAY,SAAS,SAAS,cAAc,KAAA;EACpE;CACF;CAEA,MAAc,sBACZ,QACA,UACA,QACA,cACe;EACf,IAAI;GACF,MAAM,QAAQ,QAAQ,KAAK;GAC3B,IAAI,CAAC,YAAY,CAAC,OAAO;IAEvB,MAAM,KAAK,oBAAoB,EAAE,aAAa,KAAK,CAAC;IACpD;GACF;GACA,MAAM,KAAK,yBAAyB;IAClC;IACA;IACA;IACA;GACF,CAAC;EACH,QAAQ,CAER;CACF;CAEA,MAAc,wBACZ,KAIA,aACe;EACf,IAAI;GACF,MAAM,WAAW,mBAAmB;IAClC,SAAS,IAAI;IACb,UAAU;IACV,QAAQ;IACR,SAAS;IACT,aAAa,KAAK;IAClB,eAAe,IAAI;GACrB,CAAC;GACD,IAAI,CAAC,SAAS,YAAY,CAAC,SAAS,QAClC;GAEF,MAAM,KAAK,yBAAyB;IAClC,QAAQ,WAAW;IACnB,UAAU,SAAS;IACnB,OAAO,SAAS;IAChB,cAAc,SAAS;GACzB,CAAC;EACH,QAAQ,CAER;CACF;;;;;;CAOA,MAAM,mBACJ,UACA,MAiB6B;EAC7B,MAAM,SAAS,KAAK,QAAQ,IAAI,QAAQ;EACxC,MAAM,SAAS,QAAQ,KAAK,MAAM;EAClC,MAAM,WAAW,SACb,EAAE,aAAa,CAAC,EAAE,IACjB,KAAK,YAAa,MAAM,KAAK,4BAA4B,QAAQ;EACtE,MAAM,QACJ,KAAK,UACJ,KAAK,aACF,SAAS,KAAK,WAAW,SAAS,GAAG,KAAK,WAAW,SACrD;EAEN,MAAM,QAAQ,KAAK;EACnB,MAAM,eAAe,KAAK,gBAAgB,OAAO;EACjD,MAAM,UAA0B,sBAAsB;GACpD,MAAM;GACN,UAAU,KAAK;GACf,QAAQ,KAAK,UAAU;GACvB;GACA,aAAa,KAAK,eAAe,OAAO;GACxC,WAAW,KAAK,aAAa,OAAO;GACpC,YAAY,KAAK,cAAc,OAAO;GACtC,YAAY;GACZ,UAAU;EACZ,CAAC;EAGD,IAAI,OAAO,iBAAiB;GAC1B,MAAM,aAAa,KAAK,YAAY,YAAY;GAChD,MAAM,cAAc,KAAK,YAAY,QAAQ;GAC7C,MAAM,WAAW,KAAK,iBAAiB,IAAI,UAAU,IACjD,KAAK,gBAAgB,IAAI,UAAU,IACnC,KAAA;GACJ,MAAM,OAA2B;IAC/B,UAAU,OAAO;IACjB,QAAQ;KACN,KAAK;MAAE,MAAM;MAAW,UAAU;MAAY,MAAM;KAAY;KAChE,MAAM;KACN,SAAS,2BAA2B,YAAY,aAAa,QAAQ;KACrE,SAAS;IACX;IACA,WAAW;KACT,YAAY;KACZ,UACE,OAAO,cAAc,sBACrB,OAAO,cAAc,kBAAkB,MACvC;KACF,UAAU,KAAK;IACjB;IACA,OAAO,eAAe;KAAE,MAAM;KAAY,IAAI;IAAa,IAAI,EAAE,MAAM,UAAU;IACjF,MAAM;IACN;IACA;IACA,SAAS,QAAQ,KAAK,OAAO;IAC7B,aAAa,KAAK;GACpB;GACA,MAAM,SAAS,MAAM,OAAO,gBAAgB,IAAI;GAChD,IAAI,CAAC,QAAQ;IACX,MAAM,KAAK,YAAY,MAAM;KAC3B,UAAU,OAAO;KACjB,MAAM;KACN,YAAY,KAAK;KACjB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;KAClC,cAAc,OAAO;KACrB,gBAAgB,OAAO;IACzB,CAAC;IACD,IAAI,OAAO,OAAO,SAGhB,MAAM,KAAK,sBAAsB,OAAO,KAAK,UAAU,KAAK,QAAQ,YAAY;GAEpF;GACA,OAAO;IACL,UAAU,OAAO;IACjB,aAAa;IACb,cAAc,OAAO;IACrB,gBAAgB,OAAO;IACvB;IACA,SAAS,GAAG,KAAK,KAAK,WAAW,OAAO,GAAG;IAC3C,aAAa,SAAS,YAAY,SAAS,SAAS,cAAc,KAAA;GACpE;EACF;EAEA,MAAM,MAAM;GACV;GACA,UAAU,OAAO;GACjB;GACA,SAAS,QAAQ,KAAK,OAAO;GAC7B,aAAa,KAAK;GAClB,eAAe,KAAK;EACtB;EACA,MAAM,OAAO,SAAS,GAAG;EACzB,MAAM,SAAS,MAAM,OAAO,MAAM,GAAG;EACrC,IAAI,CAAC,QAAQ;GACX,MAAM,KAAK,YAAY,MAAM;IAC3B,UAAU,OAAO;IACjB,MAAM;IACN,YAAY,KAAK;IACjB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;IAClC,cAAc,OAAO;IACrB,gBAAgB,OAAO;GACzB,CAAC;GACD,IAAI,OAAO,OAAO,SAChB,MAAM,KAAK,sBAAsB,OAAO,KAAK,UAAU,KAAK,QAAQ,YAAY;EAEpF;EACA,OAAO;GACL,UAAU,OAAO;GACjB,aAAa;GACb,cAAc,OAAO;GACrB,gBAAgB,OAAO;GACvB;GACA,SAAS,GAAG,KAAK,KAAK,WAAW,OAAO,GAAG;GAC3C,aAAa,SAAS,YAAY,SAAS,SAAS,cAAc,KAAA;EACpE;CACF;;;;;CAMA,MAAM,uBAAuB,MAK1B;EACD,MAAM,SAAS,KAAK,QAAQ,IAAI,KAAK,QAAQ;EAC7C,MAAM,OAAO,OAAO;EACpB,IAAI,MAAM,wBAAwB,OAAO,uBAAuB,OAAO,uBAAuB;GAC5F,MAAM,WAAW,QAAQ,IAAI,QAAQ,QAAQ;GAC7C,MAAM,QAAQ,MAAM,OAAO,oBAAoB,EAAE,MAAM,SAAS,CAAC;GACjE,MAAM,UAAU,MAAM,OAAO,sBAAsB,MAAM,KAAK;GAC9D,OAAO;IACL,aAAa,QAAQ;IACrB,MAAM,QAAQ;IACd,eAAe,QAAQ,QAAQ;IAC/B,WAAW,QAAQ;GACrB;EACF;EAEA,IAAI,MAAM,8BAA8B,OAAO,0BAA0B;GACvE,MAAM,UAAU,MAAM,OAAO,yBAAyB,IAAI;GAC1D,OAAO;IACL,aAAa,QAAQ;IACrB,MAAM,QAAQ;IACd,eAAe,QAAQ,QAAQ;IAC/B,WAAW,QAAQ;GACrB;EACF;EAEA,MAAM,IAAI,MAAM,UAAU,KAAK,SAAS,yCAAyC;CACnF;CAEA,MAAM,MAAM,UAAkB,OAA6B,CAAC,GAAgC;EAC1F,MAAM,SAAS,KAAK,QAAQ,IAAI,QAAQ;EACxC,MAAM,WAAW,MAAM,KAAK,YAAY,IAAI,OAAO,EAAE;EACrD,MAAM,SAAS,QAAQ,KAAK,MAAM;EAElC,MAAM,QAAqB,YAAY;GACrC,UAAU,OAAO;GACjB,MAAM;GACN,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,cAAc,CAAC;GACf,gBAAgB,CAAC;EACnB;EAEA,IAAI,CAAC,QAAQ;GACX,MAAM,OAAO,MAAM,KAAK;GACxB,MAAM,KAAK,YAAY,MAAM;IAC3B,UAAU,OAAO;IACjB,MAAM;IACN,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;IAClC,cAAc,CAAC;IACf,gBAAgB,CAAC;GACnB,CAAC;EACH;EAEA,OAAO;GACL,UAAU,OAAO;GACjB,cAAc,MAAM;GACpB,iBAAiB,MAAM;GACvB;EACF;CACF;CAEA,MAAM,OAAO,UAOX;EACA,MAAM,OAAO,WAAW,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,KAAK;EAEzE,MAAM,MAAM,CAAC;EACb,KAAK,MAAM,KAAK,MACd,IAAI,KAAK;GACP,UAAU,EAAE;GACZ,YAAY,EAAE;GACd,OAAO,MAAM,KAAK,YAAY,IAAI,EAAE,EAAE;GACtC,SAAS,MAAM,EAAE,QAAQ;EAC3B,CAAC;EAEH,OAAO;CACT;CAEA,MAAM,MAAM,UAA+C;EACzD,KAAK,QAAQ,IAAI,QAAQ;EACzB,OAAO,KAAK,YAAY,IAAI,QAAQ;CACtC;CAEA,MAAM,gBAAwC;EAC5C,IAAI,CAAC,KAAK,QACR,OAAO;EAGT,QAAO,MADW,KAAK,OAAO,KAAK,EAAA,CACxB,iBAAiB;CAC9B;CAEA,MAAc,qBAAqB,MAGb;EACpB,IAAI,KAAK,YACP,OAAO,KAAK,QAAQ,IAAI;EAE1B,IAAI,KAAK,QAAQ;GACf,KAAK,QAAQ,IAAI,KAAK,MAAM;GAC5B,OAAO,CAAC,KAAK,MAAM;EACrB;EAEA,IAAI,gBAAgB;EACpB,IAAI,KAAK,QAAQ;GACf,MAAM,MAAM,MAAM,KAAK,OAAO,KAAK;GACnC,IAAI,IAAI,eACN,gBAAgB,IAAI;EAExB;EACA,IAAI,KAAK,QAAQ,IAAI,aAAa,GAChC,OAAO,CAAC,aAAa;EAEvB,MAAM,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC;EACjC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,gCAAgC;EAElD,OAAO,CAAC,KAAK;CACf;AACF"}

package/dist/core/service.d.ts

@@ -1,200 +0,0 @@
-import type { Account, AccountMeta, CredentialInput, LiveAuthStatus, LiveUsage, Provider } from '../types.js';
-import type { ProviderRegistry } from './registry.js';
-import type { AccountStore } from './store.js';
-import { ProxyService } from './proxy-service.js';
-export interface ListedAccount {
-    name: string;
-    provider: string;
-    identity?: string;
-    label?: string;
-    active: boolean;
-    updatedAt: string;
-    createdAt: string;
-    proxyEnabled: boolean;
-    proxyRunning: boolean;
-    /** True when this snapshot's material matches the current live login. */
-    isLiveMatch: boolean;
-    /** False when comparing this provider's live credential would require a secret prompt. */
-    liveMatchKnown: boolean;
-}
-export interface SwitchResult {
-    provider: string;
-    providerName: string;
-    from: string | null;
-    to: string;
-    /** Whether the previous live auth was re-saved into the prior active account. */
-    refreshedPrevious: boolean;
-    /** Saved account whose snapshot received the latest live auth before switching. */
-    refreshedAccount?: string;
-    /** Proxy outcome for the newly active account (if any). */
-    proxy?: {
-        enabled: boolean;
-        running: boolean;
-        endpoint?: string;
-        compatibility?: string;
-        error?: string;
-    };
-}
-/** Exact local-auth checkpoint used to compensate a failed/scoped switch. */
-export interface LiveAuthCheckpoint {
-    providerId: string;
-    activeAccount: string | null;
-    hadLiveAuth: boolean;
-    directory: string;
-}
-/**
- * High-level account operations: save, switch, stash, refresh, delete,
- * and account metadata listing. Proxy lifecycle, pools, and port allocation
- * live in the injected `ProxyService` (exposed as `app.proxy`); this service
- * delegates to it for the proxy side effects of switch/stash/delete.
- *
- * CLI commands call this for account CRUD, and `app.proxy` for proxy control.
- */
-export declare class AccountService {
-    private readonly store;
-    private readonly registry;
-    /** Proxy lifecycle collaborator (start/stop/pool/port). */
-    readonly proxy: ProxyService;
-    /**
-     * Optional post-delete side effects (Proxy Hub source prune, pool member
-     * sync). Wired from app.ts after Hub exists — AccountService is constructed
-     * before Hub to avoid a cycle.
-     */
-    private afterDelete?;
-    /**
-     * `proxy` stays optional for callers that only need account CRUD (several
-     * tests, and any embedder that never starts a proxy). When omitted a private
-     * one is built here — deliberately without a lease store, because a service
-     * that was never handed the app's lease table must not record leases into a
-     * table nobody reaps.
-     */
-    constructor(store: AccountStore, registry: ProviderRegistry, proxy?: ProxyService);
-    setAfterDelete(fn: (providerId: string, accountName: string) => Promise<void>): void;
-    provider(id: string): Provider;
-    listProviders(): Provider[];
-    /** Currently active (live) account name for a provider, if any. */
-    getActive(providerId: string): Promise<string | null>;
-    /** Load a saved account or return null if missing. */
-    get(providerId: string, name: string): Promise<Account | null>;
-    /** Saved local name for an upstream identity, if one is already known. */
-    findNameByIdentity(providerId: string, identity: string): Promise<string | null>;
-    /**
-     * Capture the real local login before a switch. The checkpoint is private to
-     * the current operation and must be cleaned by `discardLiveAuthCheckpoint`.
-     */
-    checkpointLiveAuth(providerId: string, opts?: {
-        durable?: boolean;
-    }): Promise<LiveAuthCheckpoint>;
-    /** Restore a checkpoint, including the provider active pointer. */
-    restoreLiveAuthCheckpoint(checkpoint: LiveAuthCheckpoint): Promise<void>;
-    discardLiveAuthCheckpoint(checkpoint: LiveAuthCheckpoint): Promise<void>;
-    list(providerId?: string): Promise<ListedAccount[]>;
-    current(providerId: string): Promise<{
-        active: string | null;
-        live: LiveAuthStatus;
-        account: Account | null;
-        proxy: import('../types.js').ProxyStatus | null;
-        isLiveMatch: boolean;
-        liveMatchKnown: boolean;
-    }>;
-    /** Best-effort usage for the provider's currently live local login only. */
-    liveUsage(providerId: string): Promise<LiveUsage | null>;
-    /**
-     * Save current live auth as a named account.
-     * If the name already exists, overwrite the snapshot (refresh).
-     * Proxy config is preserved.
-     */
-    save(providerId: string, name: string, opts?: {
-        label?: string;
-        notes?: string;
-        force?: boolean;
-        source?: string;
-        /** Credential typed by the user; replaces reading a live login. */
-        input?: CredentialInput;
-    }): Promise<AccountMeta>;
-    private saveLocked;
-    /**
-     * Resolve the saved name for the auth material currently on disk.
-     *
-     * Existing identities always win so a refreshed token overwrites its saved
-     * snapshot instead of creating an alias such as "default". A new login gets
-     * a stable identity-derived name unless the caller supplied one.
-     */
-    resolveCurrentSaveName(providerId: string, requestedName?: string): Promise<string>;
-    /** Save current auth, reusing its existing account whenever possible. */
-    saveCurrent(providerId: string, requestedName?: string): Promise<AccountMeta>;
-    /**
-     * Switch live auth to a saved account.
-     * Stops the previous account's proxy, restores auth, starts the new proxy if enabled.
-     */
-    use(providerId: string, name: string, opts?: {
-        noRefresh?: boolean;
-        noProxy?: boolean;
-    }): Promise<SwitchResult>;
-    private useLocked;
-    /**
-     * Stash live auth: auto-backup (prefer matching email), then remove local
-     * live files so the tool allows a new login — WITHOUT server-side logout/revoke.
-     */
-    stash(providerId: string, opts?: {
-        /** Skip auto-backup before removing live files. */
-        noBackup?: boolean;
-        /** Force backup into this account name. */
-        as?: string;
-        /** Sign-in source to stash for providers that have more than one. */
-        source?: 'gemini-cli' | 'antigravity';
-    }): Promise<{
-        provider: string;
-        cleared: boolean;
-        backedUpTo: string | null;
-        previousIdentity?: string;
-        /** True when backup reused an existing account with the same email. */
-        matchedByIdentity: boolean;
-        /** True when there was no live auth to back up (nothing to save). */
-        skippedBackup: boolean;
-    }>;
-    private stashLocked;
-    /**
-     * Pick account name for stash auto-backup, preferring same-email reuse.
-     */
-    private resolveStashBackupTarget;
-    private findAccountNameByIdentity;
-    /**
-     * Save live auth only into an already-saved account.
-     *
-     * Switching must never invent a new account or overwrite a stale active
-     * pointer with another identity. An unsaved login is blocked so the caller
-     * can explicitly name/save it before replacing the live auth file.
-     */
-    private saveLiveIntoExistingAccount;
-    /** Resolve a duplicate identity to its existing local account after confirmation. */
-    private resolveIdentityTarget;
-    /**
-     * Refresh OAuth/OIDC tokens.
-     *
-     * - `refresh codex` → live auth (+ sync into active saved account if any)
-     * - `refresh codex lucy` → saved snapshot `lucy` (+ restore to live if active)
-     * - `refresh codex --all` → every saved account for a provider
-     */
-    refresh(providerId: string, name?: string, opts?: {
-        all?: boolean;
-    }): Promise<Array<{
-        target: string;
-        identity?: string;
-        ok: boolean;
-        error?: string;
-    }>>;
-    private refreshLocked;
-    private refreshSavedAccount;
-    private refreshLiveAuth;
-    /** Update display metadata without touching the credential snapshot bytes. */
-    edit(providerId: string, name: string, opts: {
-        label?: string | null;
-    }): Promise<AccountMeta>;
-    delete(providerId: string, name: string): Promise<void>;
-    exportAccount(providerId: string, name: string, outPath: string): Promise<void>;
-    importAccount(providerId: string, name: string, inPath: string, opts?: {
-        force?: boolean;
-    }): Promise<AccountMeta>;
-}
-//# sourceMappingURL=service.d.ts.map