anypick 1.0.0

package/dist/core/activation-executor.js

@@ -0,0 +1,690 @@
+import { ExitCode, anypickError, isAnyPickError } from "../utils/errors.js";
+import { makeEmitter } from "./events.js";
+import { pathExists } from "../utils/fs.js";
+import { waitForHttp } from "../utils/process/health.js";
+import { withMutationLocks } from "./mutation-lock.js";
+import { displayRef, mutationScopeForRef, parseRef, serializeRef } from "./refs.js";
+import { loadAccountForRef, loadProfileForRef, materializeResolvedSource } from "./resolve-source.js";
+import { dirname } from "node:path";
+import { copyFile, mkdir } from "node:fs/promises";
+//#region src/core/activation-executor.ts
+/**
+* Execute activation plans transactionally (spec §P7, §23).
+* Journals only serializable ResourceRef values — never adapter instances.
+*/
+function bindingEqual(a, b) {
+	return JSON.stringify({
+		client: a.client,
+		source: a.source,
+		model: a.model,
+		clientOptions: a.clientOptions ?? {}
+	}) === JSON.stringify({
+		client: b.client,
+		source: b.source,
+		model: b.model,
+		clientOptions: b.clientOptions ?? {}
+	});
+}
+function mutationScopes(plan) {
+	if (plan.resolvedSource.ref.kind === "proxy-hub") return [`client/${plan.client}`];
+	return [`client/${plan.client}`, mutationScopeForRef(plan.resolvedSource.ref)];
+}
+async function executeActivation(plan, deps, opts = {}) {
+	const dryRun = Boolean(opts.dryRun);
+	const existing = plan.mode === "persistent" && plan.bindingSpec && opts.skipIfActive !== false ? deps.bindings.getGlobal(plan.client) : void 0;
+	const alreadyActive = Boolean(existing && plan.bindingSpec && bindingEqual(existing.spec, plan.bindingSpec));
+	if (dryRun) return {
+		plan,
+		dryRun: true,
+		alreadyActive: false,
+		proxyEndpoint: plan.transport.endpoint
+	};
+	return withMutationLocks(deps.runtime.root, mutationScopes(plan), async () => {
+		return {
+			...await executeActivationLocked(plan, deps, opts),
+			alreadyActive
+		};
+	});
+}
+/**
+* Execute an activation plan by interpreting its `steps` as the source of
+* truth. Each mutating step records an inverse operation onto a rollback
+* stack; if any step throws, the stack is unwound in reverse so partial
+* state is undone (proxy stopped, lease released, prior account restored,
+* client config reset, binding removed).
+*
+* The plan is authoritative: the executor does not re-derive behavior from
+* transport capability, so the planner and executor cannot silently diverge.
+*/
+async function executeActivationLocked(plan, deps, opts) {
+	const affected = [`client/${plan.client}`, serializeRef(plan.resolvedSource.ref)];
+	const ctx = {
+		mutated: false,
+		undo: [],
+		startedProxies: [],
+		leaseIds: [],
+		backupPaths: []
+	};
+	const journal = deps.journal.create(`activate:${plan.mode}`, {
+		affectedResources: affected,
+		params: {
+			client: plan.client,
+			source: serializeRef(plan.resolvedSource.ref),
+			mode: plan.mode,
+			steps: plan.steps.map((s) => s.kind)
+		},
+		state: "planned"
+	});
+	try {
+		deps.journal.update(journal.id, { state: "executing" });
+		if (plan.transport.capability === "external_manual_proxy") throw anypickError(`Required external proxy for ${plan.resolvedSource.display} is not installed.\n\nInstall the provider proxy and retry.`, "MISSING_DEPENDENCY", {
+			exitCode: ExitCode.MISSING_DEPENDENCY,
+			suggestions: [`anypick doctor ${plan.client}`],
+			mutated: false
+		});
+		if (plan.transport.capability === "unsupported") throw anypickError(`Unsupported transport for ${plan.client} × ${plan.resolvedSource.display}`, "UNSUPPORTED_TRANSPORT", { exitCode: ExitCode.CAPABILITY_CONFLICT });
+		for (const step of plan.steps) await runStep(step, plan, deps, opts, ctx, journal.id);
+		deps.journal.update(journal.id, {
+			state: "verifying",
+			backupPaths: ctx.backupPaths
+		});
+		deps.journal.update(journal.id, { state: "committed" });
+		const cleanup = plan.mode === "ephemeral" ? makeEphemeralCleanup(ctx, deps) : void 0;
+		return {
+			plan,
+			dryRun: false,
+			alreadyActive: false,
+			binding: ctx.binding,
+			proxyEndpoint: plan.transport.endpoint,
+			journalId: journal.id,
+			isolated: ctx.isolated,
+			cleanup
+		};
+	} catch (err) {
+		const rethrow = err instanceof Error ? err : new Error(String(err));
+		const rolledBack = await runRollback(ctx, deps, journal.id);
+		await finalizeJournal(deps, journal.id, rolledBack);
+		const mutated = ctx.mutated && !rolledBack;
+		if (isAnyPickError(rethrow)) rethrow.mutated = mutated;
+		throw rethrow;
+	}
+}
+/** Planner-time markers: resolved while building the plan, no execution work. */
+var plannerOnlyStep = async () => {};
+/**
+* Exhaustive step-handler registry.
+*
+* Adding a PlanStepKind without a handler is a compile error (`satisfies`),
+* which is how ValidateCredential/WaitForHealth/VerifyEffectiveState came to
+* be advertised in `--dry-run` while doing nothing under a silent default.
+*/
+var STEP_HANDLERS = {
+	EnsureProxyHub: async ({ step, plan, deps, ctx }) => {
+		const name = hubNameForStep(step, plan);
+		const hub = requireProxyHub(deps);
+		const started = await hub.ensureRunning(name);
+		plan.transport.endpoint = started.endpoint;
+		if (started.startedNow) {
+			ctx.mutated = true;
+			ctx.undo.push(async () => {
+				if (hub.getAttachedRouteCount(name) === 0) await hub.stop(name);
+			});
+		}
+	},
+	AttachProxyHubRoute: async ({ step, plan, deps, ctx }) => {
+		const name = hubNameForStep(step, plan);
+		const routeId = routeIdForStep(step);
+		const hub = requireProxyHub(deps);
+		const previous = hub.getAttachedRoute(routeId);
+		const attached = await hub.attachRoute(routeId, plan.client, plan.transport.protocol, name, requestedHubModels(plan));
+		if (plan.transport.managedProxy) plan.transport.managedProxy.token = attached.token;
+		ctx.mutated = true;
+		ctx.undo.push(async () => {
+			await hub.restoreRoute(routeId, previous);
+		});
+	},
+	WaitForHubHealth: async ({ plan, opts }) => {
+		const endpoint = plan.transport.endpoint;
+		if (!endpoint) throw new Error("Internal plan error: Proxy Hub has no endpoint");
+		if (!await waitForHttp(`${endpoint}/health`, { timeoutMs: opts.healthTimeoutMs })) throw anypickError("Proxy Hub did not become healthy.", "PROXY_START_FAILED");
+	},
+	ValidateProxyHubRoute: async ({ plan, opts }) => {
+		const endpoint = plan.transport.endpoint;
+		const token = plan.transport.managedProxy?.token;
+		if (!endpoint || !token) throw new Error("Internal plan error: Proxy Hub route has no token");
+		if (!(await fetch(`${endpoint}/v1/models`, {
+			headers: { authorization: `Bearer ${token}` },
+			signal: AbortSignal.timeout(opts.healthTimeoutMs ?? 5e3)
+		})).ok) throw anypickError("Proxy Hub route could not be validated.", "PROXY_START_FAILED");
+	},
+	StartProxy: async ({ plan, deps, ctx }) => {
+		const endpoint = await startManagedProxy(plan, deps, ctx);
+		if (endpoint) plan.transport.endpoint = endpoint;
+	},
+	WriteNativeAuth: async ({ plan, deps, ctx, journalId }) => {
+		if (plan.mode === "ephemeral") throw anypickError("Internal plan error: ephemeral activation must not write live native auth.", "UNSUPPORTED_TRANSPORT", { exitCode: ExitCode.CAPABILITY_CONFLICT });
+		if (plan.resolvedSource.ref.kind === "account") {
+			const { provider, name } = plan.resolvedSource.ref;
+			const checkpoint = await deps.accounts.checkpointLiveAuth(provider, { durable: true });
+			const journal = deps.journal.get(journalId);
+			deps.journal.update(journalId, { params: {
+				...journal?.params,
+				nativeAuthCheckpoint: checkpoint
+			} });
+			ctx.nativeAuthCheckpoint = checkpoint;
+			ctx.mutated = true;
+			ctx.undo.push(async () => {
+				try {
+					await deps.accounts.restoreLiveAuthCheckpoint(checkpoint);
+				} finally {
+					await deps.accounts.discardLiveAuthCheckpoint(checkpoint);
+				}
+			});
+			await deps.accounts.use(provider, name, { noProxy: plan.transport.capability !== "direct" });
+		}
+	},
+	WriteClientConfig: async ({ plan, deps, opts, ctx, journalId }) => {
+		if ((plan.resolvedSource.kind === "account" || plan.resolvedSource.kind === "proxy-hub") && plan.transport.endpoint && plan.transport.capability !== "direct") {
+			const recovery = await prepareClientRecovery(plan.client, deps, ctx, journalId);
+			ctx.clientConfigWritten = plan.client;
+			ctx.mutated = true;
+			ctx.undo.push(async () => {
+				await deps.runtime.restoreClientConfigRecovery(recovery);
+			});
+			if (plan.mode === "persistent" && plan.resolvedSource.ref.kind !== "proxy-hub") await detachClientHubRoute(deps, plan.client);
+			await injectProxyEndpoint(plan, deps, opts, recovery);
+		} else if (plan.resolvedSource.kind === "gateway" && plan.resolvedSource.ref.kind === "gateway" && (plan.mode === "persistent" || plan.mode === "project")) {
+			const recovery = await prepareClientRecovery(plan.client, deps, ctx, journalId);
+			ctx.clientConfigWritten = plan.client;
+			ctx.mutated = true;
+			ctx.undo.push(async () => {
+				await deps.runtime.restoreClientConfigRecovery(recovery);
+			});
+			if (plan.mode === "persistent") await detachClientHubRoute(deps, plan.client);
+			await deps.runtime.apply(plan.resolvedSource.ref.name, plan.client, {
+				dryRun: false,
+				verbose: opts.verbose,
+				proxyEndpoint: plan.transport.endpoint,
+				recovery
+			});
+		} else if (plan.client === "codex" && plan.mode === "persistent" && plan.transport.capability === "direct") {
+			await deps.runtime.restoreCodexLiveForNative();
+			await detachClientHubRoute(deps, "codex");
+		}
+	},
+	ValidateCredential: async ({ plan, deps }) => {
+		await validateCredential(plan, deps);
+	},
+	WaitForHealth: async ({ plan, opts }) => {
+		await waitForProxyHealth(plan, opts);
+	},
+	VerifyEffectiveState: async ({ plan, deps }) => {
+		await verifyEffectiveState(plan, deps);
+	},
+	CreateTemporaryClientHome: async (args) => {
+		await createEphemeralHome(args);
+	},
+	CreateEnvironmentOverlay: async (args) => {
+		await createEphemeralHome(args);
+	},
+	SpawnChild: async () => {},
+	CommitGlobalBinding: async ({ plan, deps, ctx }) => {
+		if (plan.mode !== "persistent" || !plan.bindingSpec || !plan.provenance) throw new Error("Internal plan error: invalid global binding commit");
+		const previous = deps.bindings.getGlobal(plan.client);
+		ctx.binding = deps.bindings.upsertGlobal(plan.client, plan.bindingSpec, plan.provenance);
+		ctx.mutated = true;
+		ctx.undo.push(async () => {
+			if (previous) deps.bindings.upsertGlobal(plan.client, previous.spec, previous.provenance);
+			else deps.bindings.deleteGlobal(plan.client);
+		});
+		if (plan.client === "codex" && plan.resolvedSource.ref.kind === "proxy-hub") await deps.runtime.refreshCodexLiveConfig({ forceRouted: true });
+	},
+	CommitProjectBinding: async ({ step, plan, deps, opts, ctx }) => {
+		if (plan.mode !== "project" || !plan.bindingSpec || !plan.provenance) throw new Error("Internal plan error: invalid project binding commit");
+		const root = typeof step.params?.projectRoot === "string" ? step.params.projectRoot : opts.projectRoot;
+		if (!root) throw anypickError("projectRoot required for project binding commit", "INVALID_USAGE", { exitCode: ExitCode.INVALID_USAGE });
+		const previous = deps.bindings.getProject(root, plan.client);
+		ctx.binding = deps.bindings.upsertProject(root, plan.client, plan.bindingSpec, plan.provenance);
+		ctx.mutated = true;
+		ctx.undo.push(async () => {
+			if (previous) deps.bindings.upsertProject(root, plan.client, previous.spec, previous.provenance);
+			else deps.bindings.deleteProject(root, plan.client);
+		});
+	},
+	ResolveSource: plannerOnlyStep,
+	ExpandPreset: plannerOnlyStep,
+	ValidateCompatibility: plannerOnlyStep,
+	ResolveTransport: plannerOnlyStep,
+	ValidateExternalDependency: plannerOnlyStep,
+	AllocateProxyLease: plannerOnlyStep,
+	InspectClientState: plannerOnlyStep,
+	ReleaseLease: plannerOnlyStep,
+	RestoreTemporaryState: plannerOnlyStep
+};
+async function createEphemeralHome({ plan, deps, opts, ctx }) {
+	if (plan.resolvedSource.ref.kind === "account" || plan.resolvedSource.ref.kind === "gateway" || plan.resolvedSource.ref.kind === "proxy-hub") {
+		const profile = await loadProfileForRef(plan.resolvedSource.ref, deps);
+		const account = await loadAccountForRef(plan.resolvedSource.ref, deps);
+		const resolvedPlan = {
+			clientId: plan.client,
+			source: plan.resolvedSource,
+			transport: plan.transport,
+			model: plan.model,
+			mode: "ephemeral",
+			profile,
+			account,
+			dryRun: false,
+			verbose: Boolean(opts.verbose),
+			anypickRoot: deps.runtime.root
+		};
+		const isolated = await deps.runtime.createEphemeralRuntime(resolvedPlan);
+		ctx.isolated = isolated;
+		ctx.mutated = true;
+		ctx.undo.push(async () => {
+			await isolated.cleanup();
+		});
+	}
+}
+/**
+* Execute one plan step. Validation/inspection steps are no-ops at execution
+* time (the planner already resolved and validated); mutating steps perform
+* the side effect and register its inverse on the rollback stack.
+*/
+async function runStep(step, plan, deps, opts, ctx, journalId) {
+	const handler = STEP_HANDLERS[step.kind];
+	await handler({
+		step,
+		plan,
+		deps,
+		opts,
+		ctx,
+		journalId
+	});
+}
+/**
+* Assert the credential behind this source is usable before anything mutates
+* live state. For accounts this is a presence check on the saved snapshot plus
+* an opportunistic refresh when the provider supports it: activating onto an
+* expired token otherwise fails later, after the client config was rewritten.
+* Gateways carry their key material in the profile, so presence is sufficient.
+*/
+async function validateCredential(plan, deps) {
+	const ref = plan.resolvedSource.ref;
+	if (ref.kind === "account") {
+		if (!await deps.accounts.get(ref.provider, ref.name)) throw anypickError(`Account ${ref.provider}/${ref.name} has no stored credential snapshot.`, "AUTH_REQUIRED", {
+			exitCode: ExitCode.AUTH_REQUIRED,
+			suggestions: [`anypick add ${ref.provider} --name ${ref.name}`]
+		});
+		if (plan.resolvedSource.adapter.capabilities.canRefresh) try {
+			await deps.accounts.refresh(ref.provider, ref.name);
+		} catch (err) {
+			makeEmitter(deps.eventSink)("warn", "credential_refresh_failed", `Could not refresh credential for ${ref.provider}/${ref.name} before activation`, {
+				step: "ValidateCredential",
+				resourceIds: [serializeRef(ref)],
+				context: { error: err instanceof Error ? err.message : String(err) }
+			});
+		}
+		return;
+	}
+	if (ref.kind === "gateway") {
+		if (!await loadProfileForRef(ref, deps)) throw anypickError(`Gateway not found: ${ref.name}`, "GATEWAY_NOT_FOUND", { exitCode: ExitCode.NOT_FOUND });
+		return;
+	}
+	if (ref.kind === "proxy-hub") {
+		if (!(await requireProxyHub(deps).get(ref.name)).enabled) throw anypickError(`Proxy Hub hub:${ref.name} is disabled.`, "PROXY_DISABLED");
+		return;
+	}
+	if (ref.kind === "account-pool") {
+		if (((deps.pools ? await deps.pools.get(ref.provider) : void 0)?.members.filter((m) => m.enabled) ?? []).length === 0) throw anypickError(`Pool ${ref.provider} has no enabled members to activate.`, "AUTH_REQUIRED", {
+			exitCode: ExitCode.AUTH_REQUIRED,
+			suggestions: [`anypick proxy pool ${ref.provider}`]
+		});
+	}
+}
+/**
+* Confirm the managed proxy is actually serving before its endpoint is written
+* into a client config.
+*
+* Provider `startProxy` implementations already poll `/health` with instance-id
+* verification and throw `PROXY_START_FAILED` on timeout, so under normal
+* sequencing this step is a cheap re-assertion rather than the primary gate.
+* It matters for the reuse path: when `startProxy` adopts an already-running
+* process it returns without a fresh readiness probe, and for a process that
+* died in the window between start and config write.
+*/
+async function waitForProxyHealth(plan, opts) {
+	const endpoint = plan.transport.endpoint;
+	if (!endpoint) return;
+	const ref = plan.resolvedSource.ref;
+	if (!await waitForHttp(`${endpoint}/health`, { timeoutMs: opts.healthTimeoutMs ?? 5e3 })) throw anypickError(`Proxy for ${plan.resolvedSource.display} is not responding at ${endpoint}.`, "HEALTH_FAILURE", {
+		exitCode: ExitCode.HEALTH_FAILURE,
+		suggestions: [`anypick proxy logs ${ref.kind === "account" ? `${ref.provider} ${ref.name}` : ""}`.trim(), `anypick doctor ${plan.client}`]
+	});
+}
+/**
+* Read back the client configuration this activation just wrote and confirm the
+* adapter reports it as present. Without this, a client adapter whose write
+* silently no-ops leaves `anypick use` reporting success while the client keeps
+* talking to the previous endpoint — the exact silent inconsistency the journal
+* exists to prevent.
+*
+* Non-fatal by design: a failed read-back is reported as a degraded-state event
+* rather than rolling back a correct write, because `inspect()` is a heuristic
+* and a false negative must not undo a good activation.
+*/
+async function verifyEffectiveState(plan, deps) {
+	if (plan.mode === "ephemeral") return;
+	const client = deps.clients.get(plan.client);
+	let inspected;
+	try {
+		inspected = await client.inspect();
+	} catch (err) {
+		makeEmitter(deps.eventSink)("warn", "effective_state_unverified", `Could not read back ${plan.client} configuration after activation`, {
+			step: "VerifyEffectiveState",
+			resourceIds: [`client/${plan.client}`],
+			context: { error: err instanceof Error ? err.message : String(err) }
+		});
+		return;
+	}
+	if (!inspected.present) makeEmitter(deps.eventSink)("warn", "effective_state_mismatch", `${plan.client} reports no anypick-managed configuration after activation`, {
+		step: "VerifyEffectiveState",
+		resourceIds: [`client/${plan.client}`],
+		context: { issues: inspected.issues?.join("; ") }
+	});
+}
+/**
+* Start the managed proxy (pool or account) for this activation, create its
+* lease, and record inverse operations. Returns the proxy endpoint.
+*/
+async function startManagedProxy(plan, deps, ctx) {
+	const ref = plan.resolvedSource.ref;
+	if (ref.kind === "account-pool") {
+		const started = await deps.proxy.startPoolProxy(ref.provider);
+		if (started.startedNow) ctx.startedProxies.push({ provider: ref.provider });
+		ctx.mutated = true;
+		if (started.startedNow) ctx.undo.push(async () => {
+			await deps.proxy.stopPoolProxy(ref.provider);
+		});
+		if (started.leaseId) ctx.leaseIds.push(started.leaseId);
+		if (plan.transport.managedProxy) {
+			if (started.leaseId) plan.transport.managedProxy.leaseId = started.leaseId;
+			if (started.token) plan.transport.managedProxy.token = started.token;
+		}
+		return started.endpoint;
+	}
+	if (ref.kind === "account") {
+		const accountBefore = await deps.accounts.get(ref.provider, ref.name);
+		if (!accountBefore) throw anypickError(`Account not found: ${ref.provider}/${ref.name}`, "NOT_FOUND");
+		if (plan.mode === "ephemeral" && !accountBefore.proxy.enabled) {
+			const priorConfig = accountBefore.proxy;
+			ctx.mutated = true;
+			ctx.undo.push(async () => {
+				await deps.proxy.restoreProxyConfig(ref.provider, ref.name, priorConfig);
+			});
+		}
+		try {
+			await deps.proxy.enableProxy(ref.provider, ref.name, {});
+		} catch {}
+		const started = await deps.proxy.startProxy(ref.provider, ref.name);
+		if (started.startedNow) ctx.startedProxies.push({
+			provider: ref.provider,
+			account: ref.name
+		});
+		ctx.mutated = true;
+		if (started.startedNow) ctx.undo.push(async () => {
+			await deps.proxy.stopProxy(ref.provider, ref.name);
+		});
+		if (started.leaseId) ctx.leaseIds.push(started.leaseId);
+		if (plan.transport.managedProxy) {
+			if (started.leaseId) plan.transport.managedProxy.leaseId = started.leaseId;
+			if (started.token) plan.transport.managedProxy.token = started.token;
+		}
+		return started.endpoint;
+	}
+}
+/** Inject the managed proxy endpoint into native client config (account proxy). */
+async function injectProxyEndpoint(plan, deps, opts, recovery) {
+	const endpoint = plan.transport.endpoint;
+	if (!endpoint) return;
+	const ref = plan.resolvedSource.ref;
+	const modelId = plan.model.mode === "explicit" ? plan.model.id : void 0;
+	const rawRoles = plan.bindingSpec?.clientOptions?.modelRoles;
+	const modelRoles = rawRoles && typeof rawRoles === "object" && !Array.isArray(rawRoles) ? Object.fromEntries(Object.entries(rawRoles).filter((e) => typeof e[1] === "string" && e[1].trim() !== "")) : void 0;
+	const accountRef = ref.kind === "account" ? {
+		provider: ref.provider,
+		name: ref.name
+	} : {
+		provider: plan.resolvedSource.adapter.capabilities.provider,
+		name: "*"
+	};
+	await deps.runtime.applyProxyEndpoint(plan.client, {
+		endpoint,
+		apiKey: plan.transport.managedProxy?.token ?? "anypick-proxy",
+		defaultModel: modelRoles?.default ?? modelId,
+		modelRoles,
+		accountRef,
+		dryRun: false,
+		verbose: opts.verbose,
+		label: displayRef(plan.resolvedSource.ref),
+		recovery
+	});
+}
+function hubNameForStep(step, plan) {
+	const name = typeof step.params?.hub === "string" ? step.params.hub : void 0;
+	if (name) return name;
+	if (plan.resolvedSource.ref.kind === "proxy-hub") return plan.resolvedSource.ref.name;
+	throw new Error("Internal plan error: Proxy Hub step has no hub name");
+}
+function requireProxyHub(deps) {
+	if (!deps.hub) throw new Error("Proxy Hub service is unavailable in this composition.");
+	return deps.hub;
+}
+/** Drop a client's persistent Hub route when it leaves the Hub for another source. */
+async function detachClientHubRoute(deps, clientId) {
+	try {
+		await deps.hub?.detachRoute(`global/${clientId}`);
+	} catch {}
+}
+function routeIdForStep(step) {
+	const routeId = typeof step.params?.routeId === "string" ? step.params.routeId : void 0;
+	if (!routeId) throw new Error("Internal plan error: Proxy Hub route step has no route id");
+	return routeId;
+}
+function requestedHubModels(plan) {
+	const models = [];
+	const seen = /* @__PURE__ */ new Set();
+	const push = (raw) => {
+		if (typeof raw !== "string") return;
+		const model = raw.trim();
+		if (!model || seen.has(model)) return;
+		seen.add(model);
+		models.push(model);
+	};
+	const rawRoles = plan.bindingSpec?.clientOptions?.modelRoles;
+	if (rawRoles && typeof rawRoles === "object" && !Array.isArray(rawRoles)) {
+		const roles = rawRoles;
+		for (const id of [
+			"default",
+			"list2",
+			"list3",
+			"list4",
+			"list5"
+		]) push(roles[id]);
+		for (const value of Object.values(roles)) push(value);
+	}
+	if (plan.model.mode === "explicit") push(plan.model.id);
+	return models;
+}
+/** Persist file compensation before a client adapter is permitted to mutate. */
+async function prepareClientRecovery(clientId, deps, ctx, journalId) {
+	const recovery = await deps.runtime.prepareClientConfigRecovery(clientId, journalId);
+	ctx.backupPaths.push(...recovery.backupPaths);
+	deps.journal.update(journalId, { backupPaths: ctx.backupPaths });
+	return recovery;
+}
+/**
+* Unwind a failed activation in reverse. Returns true when every recorded
+* inverse operation completed (state fully restored).
+*/
+async function runRollback(ctx, deps, journalId) {
+	if (!ctx.mutated) return true;
+	deps.journal.update(journalId, { state: "rolling_back" });
+	return runUndo(ctx);
+}
+async function runUndo(ctx) {
+	let allUndone = true;
+	for (let i = ctx.undo.length - 1; i >= 0; i--) try {
+		await ctx.undo[i]();
+	} catch {
+		allUndone = false;
+	}
+	return allUndone;
+}
+/**
+* A successful `run` is still scoped: when its child exits we reverse every
+* setup side effect (temporary home, native auth, proxy and lease). The closure
+* is idempotent because signal/error paths can race normal child exit.
+*/
+function makeEphemeralCleanup(ctx, deps) {
+	let cleanup;
+	return async () => {
+		cleanup ??= (async () => {
+			const restored = await runUndo(ctx);
+			for (const leaseId of ctx.leaseIds) deps.leases.release(leaseId);
+			if (!restored) throw anypickError("Ephemeral run cleanup could not restore all local state. Run anypick doctor before switching accounts.", "EPHEMERAL_CLEANUP_FAILED");
+		})();
+		return cleanup;
+	};
+}
+async function finalizeJournal(deps, journalId, rolledBack) {
+	try {
+		deps.journal.update(journalId, { state: rolledBack ? "rolled_back" : "failed" });
+	} catch {}
+}
+/**
+* Parse a canonical resource ref from journal params / affectedResources.
+*/
+function sourceRefFromJournal(entry) {
+	const raw = (typeof entry.params?.source === "string" ? entry.params.source : void 0) ?? entry.affectedResources.find((r) => r.startsWith("account/") || r.startsWith("gateway/") || r.startsWith("hub/") || r.startsWith("preset/"));
+	if (!raw) return null;
+	try {
+		return parseRef(raw);
+	} catch {
+		return null;
+	}
+}
+/**
+* Startup recovery: re-resolve adapters from stored ResourceRef values;
+* complete exact rollbacks when possible; never substitute another source (spec §23.4).
+*/
+async function recoverIncompleteOperations(deps) {
+	const incomplete = deps.journal.listIncomplete();
+	const failed = [];
+	const refused = [];
+	let recovered = 0;
+	const emit = makeEmitter(deps.events);
+	for (const entry of incomplete) {
+		const sourceRef = sourceRefFromJournal(entry);
+		let reResolvedOk = true;
+		if (sourceRef && deps.resolve) if (sourceRef.kind === "preset") reResolvedOk = false;
+		else try {
+			const resolved = await materializeResolvedSource(sourceRef, deps.resolve);
+			if (serializeRef(resolved.ref) !== (typeof entry.params?.source === "string" ? entry.params.source : serializeRef(sourceRef))) reResolvedOk = false;
+			if (typeof resolved.adapter.transportFor !== "function") reResolvedOk = false;
+		} catch {
+			reResolvedOk = false;
+		}
+		else if (sourceRef && !deps.resolve) reResolvedOk = false;
+		let restoredDurableState = false;
+		if (entry.backupPaths.length > 0) try {
+			let allRestored = true;
+			for (const backup of entry.backupPaths) if (backup.includes("=>")) {
+				const [src, dest] = backup.split("=>").map((s) => s.trim());
+				if (!src || !dest) {
+					allRestored = false;
+					break;
+				}
+				if (src === "delete") {
+					const { rm } = await import("node:fs/promises");
+					await rm(dest, { force: true });
+					continue;
+				}
+				if (!await pathExists(src)) {
+					allRestored = false;
+					break;
+				}
+				await mkdir(dirname(dest), { recursive: true });
+				await copyFile(src, dest);
+			} else if (!await pathExists(backup)) {
+				allRestored = false;
+				break;
+			}
+			if (allRestored) restoredDurableState = true;
+			else {
+				deps.journal.update(entry.id, { state: "failed" });
+				failed.push(entry.id);
+				continue;
+			}
+		} catch {
+			deps.journal.update(entry.id, { state: "failed" });
+			failed.push(entry.id);
+			continue;
+		}
+		const rawCheckpoint = entry.params?.nativeAuthCheckpoint;
+		if (isLiveAuthCheckpoint(rawCheckpoint)) {
+			if (!deps.resolve) {
+				deps.journal.update(entry.id, { state: "failed" });
+				failed.push(entry.id);
+				continue;
+			}
+			try {
+				await deps.resolve.accounts.restoreLiveAuthCheckpoint(rawCheckpoint);
+				await deps.resolve.accounts.discardLiveAuthCheckpoint(rawCheckpoint);
+				restoredDurableState = true;
+			} catch {
+				deps.journal.update(entry.id, { state: "failed" });
+				failed.push(entry.id);
+				continue;
+			}
+		}
+		if (restoredDurableState) {
+			deps.journal.update(entry.id, { state: "rolled_back" });
+			recovered++;
+			continue;
+		}
+		if (sourceRef && !reResolvedOk) {
+			deps.journal.update(entry.id, { state: "failed" });
+			refused.push(entry.id);
+			failed.push(entry.id);
+			emit("warn", "recovery_refused", "Journal recovery refused: source could not be re-resolved exactly", {
+				opId: entry.id,
+				context: {
+					reason: "source-not-reresolvable",
+					resourceIds: entry.affectedResources
+				}
+			});
+			continue;
+		}
+		if (entry.state === "planned") {
+			deps.journal.update(entry.id, { state: "failed" });
+			recovered++;
+			continue;
+		}
+		deps.journal.update(entry.id, { state: "failed" });
+		failed.push(entry.id);
+	}
+	return {
+		recovered,
+		failed,
+		refused
+	};
+}
+function isLiveAuthCheckpoint(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const checkpoint = value;
+	return typeof checkpoint.providerId === "string" && (typeof checkpoint.activeAccount === "string" || checkpoint.activeAccount === null) && typeof checkpoint.hadLiveAuth === "boolean" && typeof checkpoint.directory === "string";
+}
+//#endregion
+export { executeActivation, recoverIncompleteOperations };
+
+//# sourceMappingURL=activation-executor.js.map