anypick 1.0.0 → 1.1.1

package/dist/core/activation-executor.js

@@ -1,690 +0,0 @@
-import { ExitCode, anypickError, isAnyPickError } from "../utils/errors.js";
-import { makeEmitter } from "./events.js";
-import { pathExists } from "../utils/fs.js";
-import { waitForHttp } from "../utils/process/health.js";
-import { withMutationLocks } from "./mutation-lock.js";
-import { displayRef, mutationScopeForRef, parseRef, serializeRef } from "./refs.js";
-import { loadAccountForRef, loadProfileForRef, materializeResolvedSource } from "./resolve-source.js";
-import { dirname } from "node:path";
-import { copyFile, mkdir } from "node:fs/promises";
-//#region src/core/activation-executor.ts
-/**
-* Execute activation plans transactionally (spec §P7, §23).
-* Journals only serializable ResourceRef values — never adapter instances.
-*/
-function bindingEqual(a, b) {
-	return JSON.stringify({
-		client: a.client,
-		source: a.source,
-		model: a.model,
-		clientOptions: a.clientOptions ?? {}
-	}) === JSON.stringify({
-		client: b.client,
-		source: b.source,
-		model: b.model,
-		clientOptions: b.clientOptions ?? {}
-	});
-}
-function mutationScopes(plan) {
-	if (plan.resolvedSource.ref.kind === "proxy-hub") return [`client/${plan.client}`];
-	return [`client/${plan.client}`, mutationScopeForRef(plan.resolvedSource.ref)];
-}
-async function executeActivation(plan, deps, opts = {}) {
-	const dryRun = Boolean(opts.dryRun);
-	const existing = plan.mode === "persistent" && plan.bindingSpec && opts.skipIfActive !== false ? deps.bindings.getGlobal(plan.client) : void 0;
-	const alreadyActive = Boolean(existing && plan.bindingSpec && bindingEqual(existing.spec, plan.bindingSpec));
-	if (dryRun) return {
-		plan,
-		dryRun: true,
-		alreadyActive: false,
-		proxyEndpoint: plan.transport.endpoint
-	};
-	return withMutationLocks(deps.runtime.root, mutationScopes(plan), async () => {
-		return {
-			...await executeActivationLocked(plan, deps, opts),
-			alreadyActive
-		};
-	});
-}
-/**
-* Execute an activation plan by interpreting its `steps` as the source of
-* truth. Each mutating step records an inverse operation onto a rollback
-* stack; if any step throws, the stack is unwound in reverse so partial
-* state is undone (proxy stopped, lease released, prior account restored,
-* client config reset, binding removed).
-*
-* The plan is authoritative: the executor does not re-derive behavior from
-* transport capability, so the planner and executor cannot silently diverge.
-*/
-async function executeActivationLocked(plan, deps, opts) {
-	const affected = [`client/${plan.client}`, serializeRef(plan.resolvedSource.ref)];
-	const ctx = {
-		mutated: false,
-		undo: [],
-		startedProxies: [],
-		leaseIds: [],
-		backupPaths: []
-	};
-	const journal = deps.journal.create(`activate:${plan.mode}`, {
-		affectedResources: affected,
-		params: {
-			client: plan.client,
-			source: serializeRef(plan.resolvedSource.ref),
-			mode: plan.mode,
-			steps: plan.steps.map((s) => s.kind)
-		},
-		state: "planned"
-	});
-	try {
-		deps.journal.update(journal.id, { state: "executing" });
-		if (plan.transport.capability === "external_manual_proxy") throw anypickError(`Required external proxy for ${plan.resolvedSource.display} is not installed.\n\nInstall the provider proxy and retry.`, "MISSING_DEPENDENCY", {
-			exitCode: ExitCode.MISSING_DEPENDENCY,
-			suggestions: [`anypick doctor ${plan.client}`],
-			mutated: false
-		});
-		if (plan.transport.capability === "unsupported") throw anypickError(`Unsupported transport for ${plan.client} × ${plan.resolvedSource.display}`, "UNSUPPORTED_TRANSPORT", { exitCode: ExitCode.CAPABILITY_CONFLICT });
-		for (const step of plan.steps) await runStep(step, plan, deps, opts, ctx, journal.id);
-		deps.journal.update(journal.id, {
-			state: "verifying",
-			backupPaths: ctx.backupPaths
-		});
-		deps.journal.update(journal.id, { state: "committed" });
-		const cleanup = plan.mode === "ephemeral" ? makeEphemeralCleanup(ctx, deps) : void 0;
-		return {
-			plan,
-			dryRun: false,
-			alreadyActive: false,
-			binding: ctx.binding,
-			proxyEndpoint: plan.transport.endpoint,
-			journalId: journal.id,
-			isolated: ctx.isolated,
-			cleanup
-		};
-	} catch (err) {
-		const rethrow = err instanceof Error ? err : new Error(String(err));
-		const rolledBack = await runRollback(ctx, deps, journal.id);
-		await finalizeJournal(deps, journal.id, rolledBack);
-		const mutated = ctx.mutated && !rolledBack;
-		if (isAnyPickError(rethrow)) rethrow.mutated = mutated;
-		throw rethrow;
-	}
-}
-/** Planner-time markers: resolved while building the plan, no execution work. */
-var plannerOnlyStep = async () => {};
-/**
-* Exhaustive step-handler registry.
-*
-* Adding a PlanStepKind without a handler is a compile error (`satisfies`),
-* which is how ValidateCredential/WaitForHealth/VerifyEffectiveState came to
-* be advertised in `--dry-run` while doing nothing under a silent default.
-*/
-var STEP_HANDLERS = {
-	EnsureProxyHub: async ({ step, plan, deps, ctx }) => {
-		const name = hubNameForStep(step, plan);
-		const hub = requireProxyHub(deps);
-		const started = await hub.ensureRunning(name);
-		plan.transport.endpoint = started.endpoint;
-		if (started.startedNow) {
-			ctx.mutated = true;
-			ctx.undo.push(async () => {
-				if (hub.getAttachedRouteCount(name) === 0) await hub.stop(name);
-			});
-		}
-	},
-	AttachProxyHubRoute: async ({ step, plan, deps, ctx }) => {
-		const name = hubNameForStep(step, plan);
-		const routeId = routeIdForStep(step);
-		const hub = requireProxyHub(deps);
-		const previous = hub.getAttachedRoute(routeId);
-		const attached = await hub.attachRoute(routeId, plan.client, plan.transport.protocol, name, requestedHubModels(plan));
-		if (plan.transport.managedProxy) plan.transport.managedProxy.token = attached.token;
-		ctx.mutated = true;
-		ctx.undo.push(async () => {
-			await hub.restoreRoute(routeId, previous);
-		});
-	},
-	WaitForHubHealth: async ({ plan, opts }) => {
-		const endpoint = plan.transport.endpoint;
-		if (!endpoint) throw new Error("Internal plan error: Proxy Hub has no endpoint");
-		if (!await waitForHttp(`${endpoint}/health`, { timeoutMs: opts.healthTimeoutMs })) throw anypickError("Proxy Hub did not become healthy.", "PROXY_START_FAILED");
-	},
-	ValidateProxyHubRoute: async ({ plan, opts }) => {
-		const endpoint = plan.transport.endpoint;
-		const token = plan.transport.managedProxy?.token;
-		if (!endpoint || !token) throw new Error("Internal plan error: Proxy Hub route has no token");
-		if (!(await fetch(`${endpoint}/v1/models`, {
-			headers: { authorization: `Bearer ${token}` },
-			signal: AbortSignal.timeout(opts.healthTimeoutMs ?? 5e3)
-		})).ok) throw anypickError("Proxy Hub route could not be validated.", "PROXY_START_FAILED");
-	},
-	StartProxy: async ({ plan, deps, ctx }) => {
-		const endpoint = await startManagedProxy(plan, deps, ctx);
-		if (endpoint) plan.transport.endpoint = endpoint;
-	},
-	WriteNativeAuth: async ({ plan, deps, ctx, journalId }) => {
-		if (plan.mode === "ephemeral") throw anypickError("Internal plan error: ephemeral activation must not write live native auth.", "UNSUPPORTED_TRANSPORT", { exitCode: ExitCode.CAPABILITY_CONFLICT });
-		if (plan.resolvedSource.ref.kind === "account") {
-			const { provider, name } = plan.resolvedSource.ref;
-			const checkpoint = await deps.accounts.checkpointLiveAuth(provider, { durable: true });
-			const journal = deps.journal.get(journalId);
-			deps.journal.update(journalId, { params: {
-				...journal?.params,
-				nativeAuthCheckpoint: checkpoint
-			} });
-			ctx.nativeAuthCheckpoint = checkpoint;
-			ctx.mutated = true;
-			ctx.undo.push(async () => {
-				try {
-					await deps.accounts.restoreLiveAuthCheckpoint(checkpoint);
-				} finally {
-					await deps.accounts.discardLiveAuthCheckpoint(checkpoint);
-				}
-			});
-			await deps.accounts.use(provider, name, { noProxy: plan.transport.capability !== "direct" });
-		}
-	},
-	WriteClientConfig: async ({ plan, deps, opts, ctx, journalId }) => {
-		if ((plan.resolvedSource.kind === "account" || plan.resolvedSource.kind === "proxy-hub") && plan.transport.endpoint && plan.transport.capability !== "direct") {
-			const recovery = await prepareClientRecovery(plan.client, deps, ctx, journalId);
-			ctx.clientConfigWritten = plan.client;
-			ctx.mutated = true;
-			ctx.undo.push(async () => {
-				await deps.runtime.restoreClientConfigRecovery(recovery);
-			});
-			if (plan.mode === "persistent" && plan.resolvedSource.ref.kind !== "proxy-hub") await detachClientHubRoute(deps, plan.client);
-			await injectProxyEndpoint(plan, deps, opts, recovery);
-		} else if (plan.resolvedSource.kind === "gateway" && plan.resolvedSource.ref.kind === "gateway" && (plan.mode === "persistent" || plan.mode === "project")) {
-			const recovery = await prepareClientRecovery(plan.client, deps, ctx, journalId);
-			ctx.clientConfigWritten = plan.client;
-			ctx.mutated = true;
-			ctx.undo.push(async () => {
-				await deps.runtime.restoreClientConfigRecovery(recovery);
-			});
-			if (plan.mode === "persistent") await detachClientHubRoute(deps, plan.client);
-			await deps.runtime.apply(plan.resolvedSource.ref.name, plan.client, {
-				dryRun: false,
-				verbose: opts.verbose,
-				proxyEndpoint: plan.transport.endpoint,
-				recovery
-			});
-		} else if (plan.client === "codex" && plan.mode === "persistent" && plan.transport.capability === "direct") {
-			await deps.runtime.restoreCodexLiveForNative();
-			await detachClientHubRoute(deps, "codex");
-		}
-	},
-	ValidateCredential: async ({ plan, deps }) => {
-		await validateCredential(plan, deps);
-	},
-	WaitForHealth: async ({ plan, opts }) => {
-		await waitForProxyHealth(plan, opts);
-	},
-	VerifyEffectiveState: async ({ plan, deps }) => {
-		await verifyEffectiveState(plan, deps);
-	},
-	CreateTemporaryClientHome: async (args) => {
-		await createEphemeralHome(args);
-	},
-	CreateEnvironmentOverlay: async (args) => {
-		await createEphemeralHome(args);
-	},
-	SpawnChild: async () => {},
-	CommitGlobalBinding: async ({ plan, deps, ctx }) => {
-		if (plan.mode !== "persistent" || !plan.bindingSpec || !plan.provenance) throw new Error("Internal plan error: invalid global binding commit");
-		const previous = deps.bindings.getGlobal(plan.client);
-		ctx.binding = deps.bindings.upsertGlobal(plan.client, plan.bindingSpec, plan.provenance);
-		ctx.mutated = true;
-		ctx.undo.push(async () => {
-			if (previous) deps.bindings.upsertGlobal(plan.client, previous.spec, previous.provenance);
-			else deps.bindings.deleteGlobal(plan.client);
-		});
-		if (plan.client === "codex" && plan.resolvedSource.ref.kind === "proxy-hub") await deps.runtime.refreshCodexLiveConfig({ forceRouted: true });
-	},
-	CommitProjectBinding: async ({ step, plan, deps, opts, ctx }) => {
-		if (plan.mode !== "project" || !plan.bindingSpec || !plan.provenance) throw new Error("Internal plan error: invalid project binding commit");
-		const root = typeof step.params?.projectRoot === "string" ? step.params.projectRoot : opts.projectRoot;
-		if (!root) throw anypickError("projectRoot required for project binding commit", "INVALID_USAGE", { exitCode: ExitCode.INVALID_USAGE });
-		const previous = deps.bindings.getProject(root, plan.client);
-		ctx.binding = deps.bindings.upsertProject(root, plan.client, plan.bindingSpec, plan.provenance);
-		ctx.mutated = true;
-		ctx.undo.push(async () => {
-			if (previous) deps.bindings.upsertProject(root, plan.client, previous.spec, previous.provenance);
-			else deps.bindings.deleteProject(root, plan.client);
-		});
-	},
-	ResolveSource: plannerOnlyStep,
-	ExpandPreset: plannerOnlyStep,
-	ValidateCompatibility: plannerOnlyStep,
-	ResolveTransport: plannerOnlyStep,
-	ValidateExternalDependency: plannerOnlyStep,
-	AllocateProxyLease: plannerOnlyStep,
-	InspectClientState: plannerOnlyStep,
-	ReleaseLease: plannerOnlyStep,
-	RestoreTemporaryState: plannerOnlyStep
-};
-async function createEphemeralHome({ plan, deps, opts, ctx }) {
-	if (plan.resolvedSource.ref.kind === "account" || plan.resolvedSource.ref.kind === "gateway" || plan.resolvedSource.ref.kind === "proxy-hub") {
-		const profile = await loadProfileForRef(plan.resolvedSource.ref, deps);
-		const account = await loadAccountForRef(plan.resolvedSource.ref, deps);
-		const resolvedPlan = {
-			clientId: plan.client,
-			source: plan.resolvedSource,
-			transport: plan.transport,
-			model: plan.model,
-			mode: "ephemeral",
-			profile,
-			account,
-			dryRun: false,
-			verbose: Boolean(opts.verbose),
-			anypickRoot: deps.runtime.root
-		};
-		const isolated = await deps.runtime.createEphemeralRuntime(resolvedPlan);
-		ctx.isolated = isolated;
-		ctx.mutated = true;
-		ctx.undo.push(async () => {
-			await isolated.cleanup();
-		});
-	}
-}
-/**
-* Execute one plan step. Validation/inspection steps are no-ops at execution
-* time (the planner already resolved and validated); mutating steps perform
-* the side effect and register its inverse on the rollback stack.
-*/
-async function runStep(step, plan, deps, opts, ctx, journalId) {
-	const handler = STEP_HANDLERS[step.kind];
-	await handler({
-		step,
-		plan,
-		deps,
-		opts,
-		ctx,
-		journalId
-	});
-}
-/**
-* Assert the credential behind this source is usable before anything mutates
-* live state. For accounts this is a presence check on the saved snapshot plus
-* an opportunistic refresh when the provider supports it: activating onto an
-* expired token otherwise fails later, after the client config was rewritten.
-* Gateways carry their key material in the profile, so presence is sufficient.
-*/
-async function validateCredential(plan, deps) {
-	const ref = plan.resolvedSource.ref;
-	if (ref.kind === "account") {
-		if (!await deps.accounts.get(ref.provider, ref.name)) throw anypickError(`Account ${ref.provider}/${ref.name} has no stored credential snapshot.`, "AUTH_REQUIRED", {
-			exitCode: ExitCode.AUTH_REQUIRED,
-			suggestions: [`anypick add ${ref.provider} --name ${ref.name}`]
-		});
-		if (plan.resolvedSource.adapter.capabilities.canRefresh) try {
-			await deps.accounts.refresh(ref.provider, ref.name);
-		} catch (err) {
-			makeEmitter(deps.eventSink)("warn", "credential_refresh_failed", `Could not refresh credential for ${ref.provider}/${ref.name} before activation`, {
-				step: "ValidateCredential",
-				resourceIds: [serializeRef(ref)],
-				context: { error: err instanceof Error ? err.message : String(err) }
-			});
-		}
-		return;
-	}
-	if (ref.kind === "gateway") {
-		if (!await loadProfileForRef(ref, deps)) throw anypickError(`Gateway not found: ${ref.name}`, "GATEWAY_NOT_FOUND", { exitCode: ExitCode.NOT_FOUND });
-		return;
-	}
-	if (ref.kind === "proxy-hub") {
-		if (!(await requireProxyHub(deps).get(ref.name)).enabled) throw anypickError(`Proxy Hub hub:${ref.name} is disabled.`, "PROXY_DISABLED");
-		return;
-	}
-	if (ref.kind === "account-pool") {
-		if (((deps.pools ? await deps.pools.get(ref.provider) : void 0)?.members.filter((m) => m.enabled) ?? []).length === 0) throw anypickError(`Pool ${ref.provider} has no enabled members to activate.`, "AUTH_REQUIRED", {
-			exitCode: ExitCode.AUTH_REQUIRED,
-			suggestions: [`anypick proxy pool ${ref.provider}`]
-		});
-	}
-}
-/**
-* Confirm the managed proxy is actually serving before its endpoint is written
-* into a client config.
-*
-* Provider `startProxy` implementations already poll `/health` with instance-id
-* verification and throw `PROXY_START_FAILED` on timeout, so under normal
-* sequencing this step is a cheap re-assertion rather than the primary gate.
-* It matters for the reuse path: when `startProxy` adopts an already-running
-* process it returns without a fresh readiness probe, and for a process that
-* died in the window between start and config write.
-*/
-async function waitForProxyHealth(plan, opts) {
-	const endpoint = plan.transport.endpoint;
-	if (!endpoint) return;
-	const ref = plan.resolvedSource.ref;
-	if (!await waitForHttp(`${endpoint}/health`, { timeoutMs: opts.healthTimeoutMs ?? 5e3 })) throw anypickError(`Proxy for ${plan.resolvedSource.display} is not responding at ${endpoint}.`, "HEALTH_FAILURE", {
-		exitCode: ExitCode.HEALTH_FAILURE,
-		suggestions: [`anypick proxy logs ${ref.kind === "account" ? `${ref.provider} ${ref.name}` : ""}`.trim(), `anypick doctor ${plan.client}`]
-	});
-}
-/**
-* Read back the client configuration this activation just wrote and confirm the
-* adapter reports it as present. Without this, a client adapter whose write
-* silently no-ops leaves `anypick use` reporting success while the client keeps
-* talking to the previous endpoint — the exact silent inconsistency the journal
-* exists to prevent.
-*
-* Non-fatal by design: a failed read-back is reported as a degraded-state event
-* rather than rolling back a correct write, because `inspect()` is a heuristic
-* and a false negative must not undo a good activation.
-*/
-async function verifyEffectiveState(plan, deps) {
-	if (plan.mode === "ephemeral") return;
-	const client = deps.clients.get(plan.client);
-	let inspected;
-	try {
-		inspected = await client.inspect();
-	} catch (err) {
-		makeEmitter(deps.eventSink)("warn", "effective_state_unverified", `Could not read back ${plan.client} configuration after activation`, {
-			step: "VerifyEffectiveState",
-			resourceIds: [`client/${plan.client}`],
-			context: { error: err instanceof Error ? err.message : String(err) }
-		});
-		return;
-	}
-	if (!inspected.present) makeEmitter(deps.eventSink)("warn", "effective_state_mismatch", `${plan.client} reports no anypick-managed configuration after activation`, {
-		step: "VerifyEffectiveState",
-		resourceIds: [`client/${plan.client}`],
-		context: { issues: inspected.issues?.join("; ") }
-	});
-}
-/**
-* Start the managed proxy (pool or account) for this activation, create its
-* lease, and record inverse operations. Returns the proxy endpoint.
-*/
-async function startManagedProxy(plan, deps, ctx) {
-	const ref = plan.resolvedSource.ref;
-	if (ref.kind === "account-pool") {
-		const started = await deps.proxy.startPoolProxy(ref.provider);
-		if (started.startedNow) ctx.startedProxies.push({ provider: ref.provider });
-		ctx.mutated = true;
-		if (started.startedNow) ctx.undo.push(async () => {
-			await deps.proxy.stopPoolProxy(ref.provider);
-		});
-		if (started.leaseId) ctx.leaseIds.push(started.leaseId);
-		if (plan.transport.managedProxy) {
-			if (started.leaseId) plan.transport.managedProxy.leaseId = started.leaseId;
-			if (started.token) plan.transport.managedProxy.token = started.token;
-		}
-		return started.endpoint;
-	}
-	if (ref.kind === "account") {
-		const accountBefore = await deps.accounts.get(ref.provider, ref.name);
-		if (!accountBefore) throw anypickError(`Account not found: ${ref.provider}/${ref.name}`, "NOT_FOUND");
-		if (plan.mode === "ephemeral" && !accountBefore.proxy.enabled) {
-			const priorConfig = accountBefore.proxy;
-			ctx.mutated = true;
-			ctx.undo.push(async () => {
-				await deps.proxy.restoreProxyConfig(ref.provider, ref.name, priorConfig);
-			});
-		}
-		try {
-			await deps.proxy.enableProxy(ref.provider, ref.name, {});
-		} catch {}
-		const started = await deps.proxy.startProxy(ref.provider, ref.name);
-		if (started.startedNow) ctx.startedProxies.push({
-			provider: ref.provider,
-			account: ref.name
-		});
-		ctx.mutated = true;
-		if (started.startedNow) ctx.undo.push(async () => {
-			await deps.proxy.stopProxy(ref.provider, ref.name);
-		});
-		if (started.leaseId) ctx.leaseIds.push(started.leaseId);
-		if (plan.transport.managedProxy) {
-			if (started.leaseId) plan.transport.managedProxy.leaseId = started.leaseId;
-			if (started.token) plan.transport.managedProxy.token = started.token;
-		}
-		return started.endpoint;
-	}
-}
-/** Inject the managed proxy endpoint into native client config (account proxy). */
-async function injectProxyEndpoint(plan, deps, opts, recovery) {
-	const endpoint = plan.transport.endpoint;
-	if (!endpoint) return;
-	const ref = plan.resolvedSource.ref;
-	const modelId = plan.model.mode === "explicit" ? plan.model.id : void 0;
-	const rawRoles = plan.bindingSpec?.clientOptions?.modelRoles;
-	const modelRoles = rawRoles && typeof rawRoles === "object" && !Array.isArray(rawRoles) ? Object.fromEntries(Object.entries(rawRoles).filter((e) => typeof e[1] === "string" && e[1].trim() !== "")) : void 0;
-	const accountRef = ref.kind === "account" ? {
-		provider: ref.provider,
-		name: ref.name
-	} : {
-		provider: plan.resolvedSource.adapter.capabilities.provider,
-		name: "*"
-	};
-	await deps.runtime.applyProxyEndpoint(plan.client, {
-		endpoint,
-		apiKey: plan.transport.managedProxy?.token ?? "anypick-proxy",
-		defaultModel: modelRoles?.default ?? modelId,
-		modelRoles,
-		accountRef,
-		dryRun: false,
-		verbose: opts.verbose,
-		label: displayRef(plan.resolvedSource.ref),
-		recovery
-	});
-}
-function hubNameForStep(step, plan) {
-	const name = typeof step.params?.hub === "string" ? step.params.hub : void 0;
-	if (name) return name;
-	if (plan.resolvedSource.ref.kind === "proxy-hub") return plan.resolvedSource.ref.name;
-	throw new Error("Internal plan error: Proxy Hub step has no hub name");
-}
-function requireProxyHub(deps) {
-	if (!deps.hub) throw new Error("Proxy Hub service is unavailable in this composition.");
-	return deps.hub;
-}
-/** Drop a client's persistent Hub route when it leaves the Hub for another source. */
-async function detachClientHubRoute(deps, clientId) {
-	try {
-		await deps.hub?.detachRoute(`global/${clientId}`);
-	} catch {}
-}
-function routeIdForStep(step) {
-	const routeId = typeof step.params?.routeId === "string" ? step.params.routeId : void 0;
-	if (!routeId) throw new Error("Internal plan error: Proxy Hub route step has no route id");
-	return routeId;
-}
-function requestedHubModels(plan) {
-	const models = [];
-	const seen = /* @__PURE__ */ new Set();
-	const push = (raw) => {
-		if (typeof raw !== "string") return;
-		const model = raw.trim();
-		if (!model || seen.has(model)) return;
-		seen.add(model);
-		models.push(model);
-	};
-	const rawRoles = plan.bindingSpec?.clientOptions?.modelRoles;
-	if (rawRoles && typeof rawRoles === "object" && !Array.isArray(rawRoles)) {
-		const roles = rawRoles;
-		for (const id of [
-			"default",
-			"list2",
-			"list3",
-			"list4",
-			"list5"
-		]) push(roles[id]);
-		for (const value of Object.values(roles)) push(value);
-	}
-	if (plan.model.mode === "explicit") push(plan.model.id);
-	return models;
-}
-/** Persist file compensation before a client adapter is permitted to mutate. */
-async function prepareClientRecovery(clientId, deps, ctx, journalId) {
-	const recovery = await deps.runtime.prepareClientConfigRecovery(clientId, journalId);
-	ctx.backupPaths.push(...recovery.backupPaths);
-	deps.journal.update(journalId, { backupPaths: ctx.backupPaths });
-	return recovery;
-}
-/**
-* Unwind a failed activation in reverse. Returns true when every recorded
-* inverse operation completed (state fully restored).
-*/
-async function runRollback(ctx, deps, journalId) {
-	if (!ctx.mutated) return true;
-	deps.journal.update(journalId, { state: "rolling_back" });
-	return runUndo(ctx);
-}
-async function runUndo(ctx) {
-	let allUndone = true;
-	for (let i = ctx.undo.length - 1; i >= 0; i--) try {
-		await ctx.undo[i]();
-	} catch {
-		allUndone = false;
-	}
-	return allUndone;
-}
-/**
-* A successful `run` is still scoped: when its child exits we reverse every
-* setup side effect (temporary home, native auth, proxy and lease). The closure
-* is idempotent because signal/error paths can race normal child exit.
-*/
-function makeEphemeralCleanup(ctx, deps) {
-	let cleanup;
-	return async () => {
-		cleanup ??= (async () => {
-			const restored = await runUndo(ctx);
-			for (const leaseId of ctx.leaseIds) deps.leases.release(leaseId);
-			if (!restored) throw anypickError("Ephemeral run cleanup could not restore all local state. Run anypick doctor before switching accounts.", "EPHEMERAL_CLEANUP_FAILED");
-		})();
-		return cleanup;
-	};
-}
-async function finalizeJournal(deps, journalId, rolledBack) {
-	try {
-		deps.journal.update(journalId, { state: rolledBack ? "rolled_back" : "failed" });
-	} catch {}
-}
-/**
-* Parse a canonical resource ref from journal params / affectedResources.
-*/
-function sourceRefFromJournal(entry) {
-	const raw = (typeof entry.params?.source === "string" ? entry.params.source : void 0) ?? entry.affectedResources.find((r) => r.startsWith("account/") || r.startsWith("gateway/") || r.startsWith("hub/") || r.startsWith("preset/"));
-	if (!raw) return null;
-	try {
-		return parseRef(raw);
-	} catch {
-		return null;
-	}
-}
-/**
-* Startup recovery: re-resolve adapters from stored ResourceRef values;
-* complete exact rollbacks when possible; never substitute another source (spec §23.4).
-*/
-async function recoverIncompleteOperations(deps) {
-	const incomplete = deps.journal.listIncomplete();
-	const failed = [];
-	const refused = [];
-	let recovered = 0;
-	const emit = makeEmitter(deps.events);
-	for (const entry of incomplete) {
-		const sourceRef = sourceRefFromJournal(entry);
-		let reResolvedOk = true;
-		if (sourceRef && deps.resolve) if (sourceRef.kind === "preset") reResolvedOk = false;
-		else try {
-			const resolved = await materializeResolvedSource(sourceRef, deps.resolve);
-			if (serializeRef(resolved.ref) !== (typeof entry.params?.source === "string" ? entry.params.source : serializeRef(sourceRef))) reResolvedOk = false;
-			if (typeof resolved.adapter.transportFor !== "function") reResolvedOk = false;
-		} catch {
-			reResolvedOk = false;
-		}
-		else if (sourceRef && !deps.resolve) reResolvedOk = false;
-		let restoredDurableState = false;
-		if (entry.backupPaths.length > 0) try {
-			let allRestored = true;
-			for (const backup of entry.backupPaths) if (backup.includes("=>")) {
-				const [src, dest] = backup.split("=>").map((s) => s.trim());
-				if (!src || !dest) {
-					allRestored = false;
-					break;
-				}
-				if (src === "delete") {
-					const { rm } = await import("node:fs/promises");
-					await rm(dest, { force: true });
-					continue;
-				}
-				if (!await pathExists(src)) {
-					allRestored = false;
-					break;
-				}
-				await mkdir(dirname(dest), { recursive: true });
-				await copyFile(src, dest);
-			} else if (!await pathExists(backup)) {
-				allRestored = false;
-				break;
-			}
-			if (allRestored) restoredDurableState = true;
-			else {
-				deps.journal.update(entry.id, { state: "failed" });
-				failed.push(entry.id);
-				continue;
-			}
-		} catch {
-			deps.journal.update(entry.id, { state: "failed" });
-			failed.push(entry.id);
-			continue;
-		}
-		const rawCheckpoint = entry.params?.nativeAuthCheckpoint;
-		if (isLiveAuthCheckpoint(rawCheckpoint)) {
-			if (!deps.resolve) {
-				deps.journal.update(entry.id, { state: "failed" });
-				failed.push(entry.id);
-				continue;
-			}
-			try {
-				await deps.resolve.accounts.restoreLiveAuthCheckpoint(rawCheckpoint);
-				await deps.resolve.accounts.discardLiveAuthCheckpoint(rawCheckpoint);
-				restoredDurableState = true;
-			} catch {
-				deps.journal.update(entry.id, { state: "failed" });
-				failed.push(entry.id);
-				continue;
-			}
-		}
-		if (restoredDurableState) {
-			deps.journal.update(entry.id, { state: "rolled_back" });
-			recovered++;
-			continue;
-		}
-		if (sourceRef && !reResolvedOk) {
-			deps.journal.update(entry.id, { state: "failed" });
-			refused.push(entry.id);
-			failed.push(entry.id);
-			emit("warn", "recovery_refused", "Journal recovery refused: source could not be re-resolved exactly", {
-				opId: entry.id,
-				context: {
-					reason: "source-not-reresolvable",
-					resourceIds: entry.affectedResources
-				}
-			});
-			continue;
-		}
-		if (entry.state === "planned") {
-			deps.journal.update(entry.id, { state: "failed" });
-			recovered++;
-			continue;
-		}
-		deps.journal.update(entry.id, { state: "failed" });
-		failed.push(entry.id);
-	}
-	return {
-		recovered,
-		failed,
-		refused
-	};
-}
-function isLiveAuthCheckpoint(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
-	const checkpoint = value;
-	return typeof checkpoint.providerId === "string" && (typeof checkpoint.activeAccount === "string" || checkpoint.activeAccount === null) && typeof checkpoint.hadLiveAuth === "boolean" && typeof checkpoint.directory === "string";
-}
-//#endregion
-export { executeActivation, recoverIncompleteOperations };
-
-//# sourceMappingURL=activation-executor.js.map