anypick 1.0.0

package/dist/core/doctor-types.d.ts

@@ -0,0 +1,89 @@
+import type { CatalogRegistry } from '../catalog/providers.js';
+import type { ClientRegistry } from '../clients/registry.js';
+import type { AccountService } from './service.js';
+import type { ProxyService } from './proxy-service.js';
+import type { ProfileService } from './profile-service.js';
+import type { RuntimeService } from './runtime-service.js';
+import type { BindingStore } from './binding-store.js';
+import type { LeaseStore } from './lease-store.js';
+import type { OperationJournal } from './journal.js';
+import type { AccountStore } from './store.js';
+import type { PluginLoadFailure, PluginRecord } from '../types.js';
+export interface DoctorCheck {
+    id: string;
+    ok: boolean;
+    message: string;
+    detail?: string;
+    /** When set, this finding is fixable via allowlisted --fix action. */
+    fixable?: DoctorFixActionKind;
+    /** When set, doctor must not auto-fix; show manual commands. */
+    forbidden?: DoctorForbiddenKind;
+    suggestions?: string[];
+}
+export interface DoctorReport {
+    ok: boolean;
+    root: string;
+    checks: DoctorCheck[];
+}
+/** Spec §18.4 — hard allowlist only. */
+export type DoctorFixActionKind = 'delete_stale_lock' | 'delete_stale_pid' | 'stop_orphan_proxy' | 'delete_temp_overlay' | 'repair_permissions' | 'rebuild_caches' | 'complete_journal_rollback';
+export declare const DOCTOR_FIX_ALLOWLIST: readonly DoctorFixActionKind[];
+/** Spec §18.5 — never auto-fixed. */
+export type DoctorForbiddenKind = 'modify_native_auth' | 'switch_or_clear_account' | 'mutate_binding' | 'modify_unmanaged_client_config' | 'revoke_token' | 'refresh_token' | 'replace_api_key' | 'change_gateway_endpoint' | 'assign_source_or_model' | 'import_external_config' | 'delete_user_resource' | 'reassign_live_proxy_port' | 'install_external_package';
+export declare const DOCTOR_FIX_FORBIDDEN: readonly DoctorForbiddenKind[];
+export interface DoctorFixAction {
+    id: string;
+    kind: DoctorFixActionKind;
+    description: string;
+    /** Absolute path or resource ref for the fix target. */
+    target: string;
+    /** Extra serializable params for journal. */
+    params?: Record<string, unknown>;
+}
+export interface DoctorFixPlan {
+    actions: DoctorFixAction[];
+    /** Forbidden findings with manual remediation only. */
+    manual: Array<{
+        id: string;
+        kind: DoctorForbiddenKind;
+        message: string;
+        suggestions: string[];
+    }>;
+}
+export interface DoctorFixResult {
+    plan: DoctorFixPlan;
+    applied: Array<{
+        id: string;
+        ok: boolean;
+        message: string;
+    }>;
+    dryRun: boolean;
+    journalId?: string;
+}
+export interface DoctorServiceDeps {
+    accounts: AccountService;
+    proxy: ProxyService;
+    profiles: ProfileService;
+    runtime: RuntimeService;
+    catalog: CatalogRegistry;
+    clients: ClientRegistry;
+    root?: string;
+    bindings?: BindingStore;
+    leases?: LeaseStore;
+    journal?: OperationJournal;
+    accountStore?: AccountStore;
+    /**
+     * Plugin state as it was resolved at startup, not re-read from disk.
+     *
+     * Doctor must report the graph this process is actually running, so a plugin
+     * that has been edited since load still shows as loaded here — `plugin list`
+     * is where the on-disk digest is re-checked.
+     */
+    plugins?: {
+        /** Re-read per run, so `plugin add` between doctor runs is reflected. */
+        installed: () => readonly PluginRecord[];
+        loadedNames: readonly string[];
+        failures: readonly PluginLoadFailure[];
+    };
+}
+//# sourceMappingURL=doctor-types.d.ts.map

package/dist/core/doctor-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-types.d.ts","sourceRoot":"","sources":["../../src/core/doctor-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAEhE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,gEAAgE;IAChE,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB;AAED,wCAAwC;AACxC,MAAM,MAAM,mBAAmB,GAC3B,mBAAmB,GACnB,kBAAkB,GAClB,mBAAmB,GACnB,qBAAqB,GACrB,oBAAoB,GACpB,gBAAgB,GAChB,2BAA2B,CAAC;AAEhC,eAAO,MAAM,oBAAoB,EAAE,SAAS,mBAAmB,EAQrD,CAAC;AAEX,qCAAqC;AACrC,MAAM,MAAM,mBAAmB,GAC3B,oBAAoB,GACpB,yBAAyB,GACzB,gBAAgB,GAChB,gCAAgC,GAChC,cAAc,GACd,eAAe,GACf,iBAAiB,GACjB,yBAAyB,GACzB,wBAAwB,GACxB,wBAAwB,GACxB,sBAAsB,GACtB,0BAA0B,GAC1B,0BAA0B,CAAC;AAE/B,eAAO,MAAM,oBAAoB,EAAE,SAAS,mBAAmB,EAcrD,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,uDAAuD;IACvD,MAAM,EAAE,KAAK,CAAC;QACZ,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,mBAAmB,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7D,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,YAAY,CAAC;IACpB,QAAQ,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,cAAc,CAAC;IACxB,OAAO,EAAE,eAAe,CAAC;IACzB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QACR,yEAAyE;QACzE,SAAS,EAAE,MAAM,SAAS,YAAY,EAAE,CAAC;QACzC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;QAC/B,QAAQ,EAAE,SAAS,iBAAiB,EAAE,CAAC;KACxC,CAAC;CACH"}

package/dist/core/doctor-types.js

@@ -0,0 +1,14 @@
+//#region src/core/doctor-types.ts
+var DOCTOR_FIX_ALLOWLIST = [
+	"delete_stale_lock",
+	"delete_stale_pid",
+	"stop_orphan_proxy",
+	"delete_temp_overlay",
+	"repair_permissions",
+	"rebuild_caches",
+	"complete_journal_rollback"
+];
+//#endregion
+export { DOCTOR_FIX_ALLOWLIST };
+
+//# sourceMappingURL=doctor-types.js.map

package/dist/core/doctor-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-types.js","names":[],"sources":["../../src/core/doctor-types.ts"],"sourcesContent":["import type { CatalogRegistry } from '../catalog/providers';\nimport type { ClientRegistry } from '../clients/registry';\nimport type { AccountService } from './service';\nimport type { ProxyService } from './proxy-service';\nimport type { ProfileService } from './profile-service';\nimport type { RuntimeService } from './runtime-service';\nimport type { BindingStore } from './binding-store';\nimport type { LeaseStore } from './lease-store';\nimport type { OperationJournal } from './journal';\nimport type { AccountStore } from './store';\nimport type { PluginLoadFailure, PluginRecord } from '../types';\n\nexport interface DoctorCheck {\n  id: string;\n  ok: boolean;\n  message: string;\n  detail?: string;\n  /** When set, this finding is fixable via allowlisted --fix action. */\n  fixable?: DoctorFixActionKind;\n  /** When set, doctor must not auto-fix; show manual commands. */\n  forbidden?: DoctorForbiddenKind;\n  suggestions?: string[];\n}\n\nexport interface DoctorReport {\n  ok: boolean;\n  root: string;\n  checks: DoctorCheck[];\n}\n\n/** Spec §18.4 — hard allowlist only. */\nexport type DoctorFixActionKind =\n  | 'delete_stale_lock'\n  | 'delete_stale_pid'\n  | 'stop_orphan_proxy'\n  | 'delete_temp_overlay'\n  | 'repair_permissions'\n  | 'rebuild_caches'\n  | 'complete_journal_rollback';\n\nexport const DOCTOR_FIX_ALLOWLIST: readonly DoctorFixActionKind[] = [\n  'delete_stale_lock',\n  'delete_stale_pid',\n  'stop_orphan_proxy',\n  'delete_temp_overlay',\n  'repair_permissions',\n  'rebuild_caches',\n  'complete_journal_rollback',\n] as const;\n\n/** Spec §18.5 — never auto-fixed. */\nexport type DoctorForbiddenKind =\n  | 'modify_native_auth'\n  | 'switch_or_clear_account'\n  | 'mutate_binding'\n  | 'modify_unmanaged_client_config'\n  | 'revoke_token'\n  | 'refresh_token'\n  | 'replace_api_key'\n  | 'change_gateway_endpoint'\n  | 'assign_source_or_model'\n  | 'import_external_config'\n  | 'delete_user_resource'\n  | 'reassign_live_proxy_port'\n  | 'install_external_package';\n\nexport const DOCTOR_FIX_FORBIDDEN: readonly DoctorForbiddenKind[] = [\n  'modify_native_auth',\n  'switch_or_clear_account',\n  'mutate_binding',\n  'modify_unmanaged_client_config',\n  'revoke_token',\n  'refresh_token',\n  'replace_api_key',\n  'change_gateway_endpoint',\n  'assign_source_or_model',\n  'import_external_config',\n  'delete_user_resource',\n  'reassign_live_proxy_port',\n  'install_external_package',\n] as const;\n\nexport interface DoctorFixAction {\n  id: string;\n  kind: DoctorFixActionKind;\n  description: string;\n  /** Absolute path or resource ref for the fix target. */\n  target: string;\n  /** Extra serializable params for journal. */\n  params?: Record<string, unknown>;\n}\n\nexport interface DoctorFixPlan {\n  actions: DoctorFixAction[];\n  /** Forbidden findings with manual remediation only. */\n  manual: Array<{\n    id: string;\n    kind: DoctorForbiddenKind;\n    message: string;\n    suggestions: string[];\n  }>;\n}\n\nexport interface DoctorFixResult {\n  plan: DoctorFixPlan;\n  applied: Array<{ id: string; ok: boolean; message: string }>;\n  dryRun: boolean;\n  journalId?: string;\n}\n\nexport interface DoctorServiceDeps {\n  accounts: AccountService;\n  proxy: ProxyService;\n  profiles: ProfileService;\n  runtime: RuntimeService;\n  catalog: CatalogRegistry;\n  clients: ClientRegistry;\n  root?: string;\n  bindings?: BindingStore;\n  leases?: LeaseStore;\n  journal?: OperationJournal;\n  accountStore?: AccountStore;\n  /**\n   * Plugin state as it was resolved at startup, not re-read from disk.\n   *\n   * Doctor must report the graph this process is actually running, so a plugin\n   * that has been edited since load still shows as loaded here — `plugin list`\n   * is where the on-disk digest is re-checked.\n   */\n  plugins?: {\n    /** Re-read per run, so `plugin add` between doctor runs is reflected. */\n    installed: () => readonly PluginRecord[];\n    loadedNames: readonly string[];\n    failures: readonly PluginLoadFailure[];\n  };\n}\n"],"mappings":";AAwCA,IAAa,uBAAuD;CAClE;CACA;CACA;CACA;CACA;CACA;CACA;AACF"}

package/dist/core/doctor-utils.d.ts

@@ -0,0 +1,3 @@
+export declare function isUnderRoot(path: string, root: string): boolean;
+export declare function walkAnyPickOwned(root: string, visit: (path: string, isDir: boolean) => Promise<void>): Promise<void>;
+//# sourceMappingURL=doctor-utils.d.ts.map

package/dist/core/doctor-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-utils.d.ts","sourceRoot":"","sources":["../../src/core/doctor-utils.ts"],"names":[],"mappings":"AAIA,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAG/D;AAED,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,GACrD,OAAO,CAAC,IAAI,CAAC,CA6Bf"}

package/dist/core/doctor-utils.js

@@ -0,0 +1,36 @@
+import { pathExists } from "../utils/fs.js";
+import { join, relative } from "node:path";
+import { readdir, stat } from "node:fs/promises";
+//#region src/core/doctor-utils.ts
+function isUnderRoot(path, root) {
+	const rel = relative(root, path);
+	return rel === "" || !rel.startsWith("..") && !rel.startsWith("/");
+}
+async function walkAnyPickOwned(root, visit) {
+	if (!await pathExists(root)) return;
+	await visit(root, true);
+	const stack = [root];
+	while (stack.length) {
+		const dir = stack.pop();
+		let entries;
+		try {
+			entries = await readdir(dir);
+		} catch {
+			continue;
+		}
+		for (const name of entries) {
+			const full = join(dir, name);
+			try {
+				const st = await stat(full);
+				if (st.isDirectory()) {
+					await visit(full, true);
+					stack.push(full);
+				} else if (st.isFile()) await visit(full, false);
+			} catch {}
+		}
+	}
+}
+//#endregion
+export { isUnderRoot, walkAnyPickOwned };
+
+//# sourceMappingURL=doctor-utils.js.map

package/dist/core/doctor-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor-utils.js","names":[],"sources":["../../src/core/doctor-utils.ts"],"sourcesContent":["import { readdir, stat } from 'node:fs/promises';\nimport { join, relative } from 'node:path';\nimport { pathExists } from '../utils/fs';\n\nexport function isUnderRoot(path: string, root: string): boolean {\n  const rel = relative(root, path);\n  return rel === '' || (!rel.startsWith('..') && !rel.startsWith('/'));\n}\n\nexport async function walkAnyPickOwned(\n  root: string,\n  visit: (path: string, isDir: boolean) => Promise<void>,\n): Promise<void> {\n  if (!(await pathExists(root))) {\n    return;\n  }\n  await visit(root, true);\n  const stack = [root];\n  while (stack.length) {\n    const dir = stack.pop()!;\n    let entries: string[];\n    try {\n      entries = await readdir(dir);\n    } catch {\n      continue;\n    }\n    for (const name of entries) {\n      const full = join(dir, name);\n      try {\n        const st = await stat(full);\n        if (st.isDirectory()) {\n          await visit(full, true);\n          stack.push(full);\n        } else if (st.isFile()) {\n          await visit(full, false);\n        }\n      } catch {\n        // ignore\n      }\n    }\n  }\n}\n"],"mappings":";;;;AAIA,SAAgB,YAAY,MAAc,MAAuB;CAC/D,MAAM,MAAM,SAAS,MAAM,IAAI;CAC/B,OAAO,QAAQ,MAAO,CAAC,IAAI,WAAW,IAAI,KAAK,CAAC,IAAI,WAAW,GAAG;AACpE;AAEA,eAAsB,iBACpB,MACA,OACe;CACf,IAAI,CAAE,MAAM,WAAW,IAAI,GACzB;CAEF,MAAM,MAAM,MAAM,IAAI;CACtB,MAAM,QAAQ,CAAC,IAAI;CACnB,OAAO,MAAM,QAAQ;EACnB,MAAM,MAAM,MAAM,IAAI;EACtB,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,QAAQ,GAAG;EAC7B,QAAQ;GACN;EACF;EACA,KAAK,MAAM,QAAQ,SAAS;GAC1B,MAAM,OAAO,KAAK,KAAK,IAAI;GAC3B,IAAI;IACF,MAAM,KAAK,MAAM,KAAK,IAAI;IAC1B,IAAI,GAAG,YAAY,GAAG;KACpB,MAAM,MAAM,MAAM,IAAI;KACtB,MAAM,KAAK,IAAI;IACjB,OAAO,IAAI,GAAG,OAAO,GACnB,MAAM,MAAM,MAAM,KAAK;GAE3B,QAAQ,CAER;EACF;CACF;AACF"}

package/dist/core/doctor.d.ts

@@ -0,0 +1,14 @@
+import type { DoctorFixPlan, DoctorFixResult, DoctorServiceDeps, DoctorReport } from './doctor-types.js';
+export { DOCTOR_FIX_ALLOWLIST, DOCTOR_FIX_FORBIDDEN, type DoctorCheck, type DoctorFixAction, type DoctorFixActionKind, type DoctorFixPlan, type DoctorFixResult, type DoctorForbiddenKind, type DoctorReport, type DoctorServiceDeps, } from './doctor-types.js';
+export { enrichFixPlan, formatForbiddenManual } from './doctor-format.js';
+export declare class DoctorService {
+    private readonly deps;
+    constructor(deps: DoctorServiceDeps);
+    run(target?: string): Promise<DoctorReport>;
+    planFixes(target?: string): Promise<DoctorFixPlan>;
+    applyFixes(plan: DoctorFixPlan, opts?: {
+        dryRun?: boolean;
+        yes?: boolean;
+    }): Promise<DoctorFixResult>;
+}
+//# sourceMappingURL=doctor.d.ts.map

package/dist/core/doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/core/doctor.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EACf,iBAAiB,EACjB,YAAY,EACb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,YAAY,EACjB,KAAK,iBAAiB,GACvB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAEvE,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,iBAAiB,EAAI;IAExD,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAE1C;IAEK,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA+DvD;IAEK,UAAU,CACd,IAAI,EAAE,aAAa,EACnB,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,OAAO,CAAA;KAAO,GAC7C,OAAO,CAAC,eAAe,CAAC,CAqE1B;CACF"}

package/dist/core/doctor.js

@@ -0,0 +1,127 @@
+import { getAnyPickRoot } from "./paths.js";
+import { DOCTOR_FIX_ALLOWLIST } from "./doctor-types.js";
+import { runDoctorReport } from "./doctor-report.js";
+import { executeDoctorFix } from "./doctor-fixes.js";
+import { enrichFixPlan, formatForbiddenManual } from "./doctor-format.js";
+//#region src/core/doctor.ts
+var DoctorService = class {
+	deps;
+	constructor(deps) {
+		this.deps = deps;
+	}
+	run(target) {
+		return runDoctorReport(this.deps, target);
+	}
+	async planFixes(target) {
+		const report = await this.run(target);
+		const actions = [];
+		const manual = [];
+		const seen = /* @__PURE__ */ new Set();
+		for (const c of report.checks) {
+			if (c.ok) continue;
+			if (c.forbidden) {
+				manual.push({
+					id: c.id,
+					kind: c.forbidden,
+					message: c.message,
+					suggestions: c.suggestions ?? []
+				});
+				continue;
+			}
+			if (!c.fixable) continue;
+			if (!DOCTOR_FIX_ALLOWLIST.includes(c.fixable)) continue;
+			const actionId = `${c.fixable}:${c.id}`;
+			if (seen.has(actionId)) continue;
+			seen.add(actionId);
+			const params = { checkId: c.id };
+			if (c.fixable === "stop_orphan_proxy") {
+				const m = c.id.match(/^orphan-proxy:([^/]+)\/(.+)$/);
+				if (m) {
+					params.provider = m[1];
+					params.account = m[2];
+				}
+			}
+			actions.push({
+				id: actionId,
+				kind: c.fixable,
+				description: c.message,
+				target: c.detail ?? c.id,
+				params
+			});
+		}
+		if (report.checks.some((c) => c.id === "permissions" && !c.ok) && !actions.some((a) => a.kind === "repair_permissions")) actions.push({
+			id: "repair_permissions:root",
+			kind: "repair_permissions",
+			description: "Repair permissions on AnyPick-owned files",
+			target: report.root
+		});
+		return {
+			actions,
+			manual
+		};
+	}
+	async applyFixes(plan, opts = {}) {
+		const dryRun = Boolean(opts.dryRun);
+		const applied = [];
+		const root = getAnyPickRoot(this.deps.root);
+		for (const action of plan.actions) if (!DOCTOR_FIX_ALLOWLIST.includes(action.kind)) applied.push({
+			id: action.id,
+			ok: false,
+			message: `Refused non-allowlisted fix kind: ${action.kind}`
+		});
+		const safeActions = plan.actions.filter((a) => DOCTOR_FIX_ALLOWLIST.includes(a.kind));
+		let journalId;
+		if (!dryRun && this.deps.journal && safeActions.length > 0) journalId = this.deps.journal.create("doctor:fix", {
+			affectedResources: safeActions.map((a) => a.target),
+			params: { actions: safeActions.map((a) => ({
+				id: a.id,
+				kind: a.kind,
+				target: a.target
+			})) },
+			state: "executing"
+		}).id;
+		try {
+			for (const action of safeActions) {
+				if (dryRun) {
+					applied.push({
+						id: action.id,
+						ok: true,
+						message: `[dry-run] would ${action.kind}: ${action.description}`
+					});
+					continue;
+				}
+				try {
+					const msg = await executeDoctorFix(action, root, this.deps);
+					applied.push({
+						id: action.id,
+						ok: true,
+						message: msg
+					});
+				} catch (err) {
+					applied.push({
+						id: action.id,
+						ok: false,
+						message: err instanceof Error ? err.message : String(err)
+					});
+				}
+			}
+			if (journalId && this.deps.journal) {
+				const allOk = applied.every((a) => a.ok);
+				this.deps.journal.update(journalId, { state: allOk ? "committed" : "failed" });
+			}
+		} catch (err) {
+			if (journalId && this.deps.journal) this.deps.journal.update(journalId, { state: "failed" });
+			throw err;
+		}
+		return {
+			plan,
+			applied,
+			dryRun,
+			journalId
+		};
+	}
+};
+//#endregion
+export { DoctorService, enrichFixPlan, formatForbiddenManual };
+
+//# sourceMappingURL=doctor.js.map

package/dist/core/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","names":[],"sources":["../../src/core/doctor.ts"],"sourcesContent":["import { DOCTOR_FIX_ALLOWLIST } from './doctor-types';\nimport { getAnyPickRoot } from './paths';\nimport { runDoctorReport } from './doctor-report';\nimport { executeDoctorFix } from './doctor-fixes';\nimport type {\n  DoctorFixPlan,\n  DoctorFixResult,\n  DoctorServiceDeps,\n  DoctorReport,\n} from './doctor-types';\n\nexport {\n  DOCTOR_FIX_ALLOWLIST,\n  DOCTOR_FIX_FORBIDDEN,\n  type DoctorCheck,\n  type DoctorFixAction,\n  type DoctorFixActionKind,\n  type DoctorFixPlan,\n  type DoctorFixResult,\n  type DoctorForbiddenKind,\n  type DoctorReport,\n  type DoctorServiceDeps,\n} from './doctor-types';\nexport { enrichFixPlan, formatForbiddenManual } from './doctor-format';\n\nexport class DoctorService {\n  constructor(private readonly deps: DoctorServiceDeps) {}\n\n  run(target?: string): Promise<DoctorReport> {\n    return runDoctorReport(this.deps, target);\n  }\n\n  async planFixes(target?: string): Promise<DoctorFixPlan> {\n    const report = await this.run(target);\n    const actions: DoctorFixPlan['actions'] = [];\n    const manual: DoctorFixPlan['manual'] = [];\n    const seen = new Set<string>();\n\n    for (const c of report.checks) {\n      if (c.ok) {\n        continue;\n      }\n      if (c.forbidden) {\n        manual.push({\n          id: c.id,\n          kind: c.forbidden,\n          message: c.message,\n          suggestions: c.suggestions ?? [],\n        });\n        continue;\n      }\n      if (!c.fixable) {\n        continue;\n      }\n      if (!DOCTOR_FIX_ALLOWLIST.includes(c.fixable)) {\n        continue;\n      }\n\n      const actionId = `${c.fixable}:${c.id}`;\n      if (seen.has(actionId)) {\n        continue;\n      }\n      seen.add(actionId);\n\n      const params: Record<string, unknown> = { checkId: c.id };\n      if (c.fixable === 'stop_orphan_proxy') {\n        const m = c.id.match(/^orphan-proxy:([^/]+)\\/(.+)$/);\n        if (m) {\n          params.provider = m[1];\n          params.account = m[2];\n        }\n      }\n\n      actions.push({\n        id: actionId,\n        kind: c.fixable,\n        description: c.message,\n        target: c.detail ?? c.id,\n        params,\n      });\n    }\n\n    if (\n      report.checks.some((c) => c.id === 'permissions' && !c.ok) &&\n      !actions.some((a) => a.kind === 'repair_permissions')\n    ) {\n      actions.push({\n        id: 'repair_permissions:root',\n        kind: 'repair_permissions',\n        description: 'Repair permissions on AnyPick-owned files',\n        target: report.root,\n      });\n    }\n\n    return { actions, manual };\n  }\n\n  async applyFixes(\n    plan: DoctorFixPlan,\n    opts: { dryRun?: boolean; yes?: boolean } = {},\n  ): Promise<DoctorFixResult> {\n    const dryRun = Boolean(opts.dryRun);\n    const applied: DoctorFixResult['applied'] = [];\n    const root = getAnyPickRoot(this.deps.root);\n\n    for (const action of plan.actions) {\n      if (!DOCTOR_FIX_ALLOWLIST.includes(action.kind)) {\n        applied.push({\n          id: action.id,\n          ok: false,\n          message: `Refused non-allowlisted fix kind: ${action.kind}`,\n        });\n      }\n    }\n    const safeActions = plan.actions.filter((a) => DOCTOR_FIX_ALLOWLIST.includes(a.kind));\n\n    let journalId: string | undefined;\n    if (!dryRun && this.deps.journal && safeActions.length > 0) {\n      const entry = this.deps.journal.create('doctor:fix', {\n        affectedResources: safeActions.map((a) => a.target),\n        params: {\n          actions: safeActions.map((a) => ({\n            id: a.id,\n            kind: a.kind,\n            target: a.target,\n          })),\n        },\n        state: 'executing',\n      });\n      journalId = entry.id;\n    }\n\n    try {\n      for (const action of safeActions) {\n        if (dryRun) {\n          applied.push({\n            id: action.id,\n            ok: true,\n            message: `[dry-run] would ${action.kind}: ${action.description}`,\n          });\n          continue;\n        }\n\n        try {\n          const msg = await executeDoctorFix(action, root, this.deps);\n          applied.push({ id: action.id, ok: true, message: msg });\n        } catch (err) {\n          applied.push({\n            id: action.id,\n            ok: false,\n            message: err instanceof Error ? err.message : String(err),\n          });\n        }\n      }\n\n      if (journalId && this.deps.journal) {\n        const allOk = applied.every((a) => a.ok);\n        this.deps.journal.update(journalId, {\n          state: allOk ? 'committed' : 'failed',\n        });\n      }\n    } catch (err) {\n      if (journalId && this.deps.journal) {\n        this.deps.journal.update(journalId, { state: 'failed' });\n      }\n      throw err;\n    }\n\n    return { plan, applied, dryRun, journalId };\n  }\n}\n"],"mappings":";;;;;;AAyBA,IAAa,gBAAb,MAA2B;CACI;CAA7B,YAAY,MAA0C;EAAzB,KAAA,OAAA;CAA0B;CAEvD,IAAI,QAAwC;EAC1C,OAAO,gBAAgB,KAAK,MAAM,MAAM;CAC1C;CAEA,MAAM,UAAU,QAAyC;EACvD,MAAM,SAAS,MAAM,KAAK,IAAI,MAAM;EACpC,MAAM,UAAoC,CAAC;EAC3C,MAAM,SAAkC,CAAC;EACzC,MAAM,uBAAO,IAAI,IAAY;EAE7B,KAAK,MAAM,KAAK,OAAO,QAAQ;GAC7B,IAAI,EAAE,IACJ;GAEF,IAAI,EAAE,WAAW;IACf,OAAO,KAAK;KACV,IAAI,EAAE;KACN,MAAM,EAAE;KACR,SAAS,EAAE;KACX,aAAa,EAAE,eAAe,CAAC;IACjC,CAAC;IACD;GACF;GACA,IAAI,CAAC,EAAE,SACL;GAEF,IAAI,CAAC,qBAAqB,SAAS,EAAE,OAAO,GAC1C;GAGF,MAAM,WAAW,GAAG,EAAE,QAAQ,GAAG,EAAE;GACnC,IAAI,KAAK,IAAI,QAAQ,GACnB;GAEF,KAAK,IAAI,QAAQ;GAEjB,MAAM,SAAkC,EAAE,SAAS,EAAE,GAAG;GACxD,IAAI,EAAE,YAAY,qBAAqB;IACrC,MAAM,IAAI,EAAE,GAAG,MAAM,8BAA8B;IACnD,IAAI,GAAG;KACL,OAAO,WAAW,EAAE;KACpB,OAAO,UAAU,EAAE;IACrB;GACF;GAEA,QAAQ,KAAK;IACX,IAAI;IACJ,MAAM,EAAE;IACR,aAAa,EAAE;IACf,QAAQ,EAAE,UAAU,EAAE;IACtB;GACF,CAAC;EACH;EAEA,IACE,OAAO,OAAO,MAAM,MAAM,EAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,KACzD,CAAC,QAAQ,MAAM,MAAM,EAAE,SAAS,oBAAoB,GAEpD,QAAQ,KAAK;GACX,IAAI;GACJ,MAAM;GACN,aAAa;GACb,QAAQ,OAAO;EACjB,CAAC;EAGH,OAAO;GAAE;GAAS;EAAO;CAC3B;CAEA,MAAM,WACJ,MACA,OAA4C,CAAC,GACnB;EAC1B,MAAM,SAAS,QAAQ,KAAK,MAAM;EAClC,MAAM,UAAsC,CAAC;EAC7C,MAAM,OAAO,eAAe,KAAK,KAAK,IAAI;EAE1C,KAAK,MAAM,UAAU,KAAK,SACxB,IAAI,CAAC,qBAAqB,SAAS,OAAO,IAAI,GAC5C,QAAQ,KAAK;GACX,IAAI,OAAO;GACX,IAAI;GACJ,SAAS,qCAAqC,OAAO;EACvD,CAAC;EAGL,MAAM,cAAc,KAAK,QAAQ,QAAQ,MAAM,qBAAqB,SAAS,EAAE,IAAI,CAAC;EAEpF,IAAI;EACJ,IAAI,CAAC,UAAU,KAAK,KAAK,WAAW,YAAY,SAAS,GAYvD,YAXc,KAAK,KAAK,QAAQ,OAAO,cAAc;GACnD,mBAAmB,YAAY,KAAK,MAAM,EAAE,MAAM;GAClD,QAAQ,EACN,SAAS,YAAY,KAAK,OAAO;IAC/B,IAAI,EAAE;IACN,MAAM,EAAE;IACR,QAAQ,EAAE;GACZ,EAAE,EACJ;GACA,OAAO;EACT,CACY,CAAA,CAAM;EAGpB,IAAI;GACF,KAAK,MAAM,UAAU,aAAa;IAChC,IAAI,QAAQ;KACV,QAAQ,KAAK;MACX,IAAI,OAAO;MACX,IAAI;MACJ,SAAS,mBAAmB,OAAO,KAAK,IAAI,OAAO;KACrD,CAAC;KACD;IACF;IAEA,IAAI;KACF,MAAM,MAAM,MAAM,iBAAiB,QAAQ,MAAM,KAAK,IAAI;KAC1D,QAAQ,KAAK;MAAE,IAAI,OAAO;MAAI,IAAI;MAAM,SAAS;KAAI,CAAC;IACxD,SAAS,KAAK;KACZ,QAAQ,KAAK;MACX,IAAI,OAAO;MACX,IAAI;MACJ,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;KAC1D,CAAC;IACH;GACF;GAEA,IAAI,aAAa,KAAK,KAAK,SAAS;IAClC,MAAM,QAAQ,QAAQ,OAAO,MAAM,EAAE,EAAE;IACvC,KAAK,KAAK,QAAQ,OAAO,WAAW,EAClC,OAAO,QAAQ,cAAc,SAC/B,CAAC;GACH;EACF,SAAS,KAAK;GACZ,IAAI,aAAa,KAAK,KAAK,SACzB,KAAK,KAAK,QAAQ,OAAO,WAAW,EAAE,OAAO,SAAS,CAAC;GAEzD,MAAM;EACR;EAEA,OAAO;GAAE;GAAM;GAAS;GAAQ;EAAU;CAC5C;AACF"}

package/dist/core/events.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Structured event sink for degraded / lifecycle conditions (spec OBS-01).
+ *
+ * AnyPick surfaces partial failures — startup recovery refusal, lease mismatch,
+ * proxy realignment failure, unverified processes, cleanup failure — as typed
+ * events rather than swallowing them or leaking them into stderr with secrets.
+ * Library consumers can supply their own sink (e.g. to feed a TUI status bar);
+ * when none is supplied, events are recorded in an in-memory ring that `doctor`
+ * / `status` can read, and (optionally) echoed to stderr behind ANYPICK_DEBUG.
+ *
+ * All event context is sanitized at the boundary: secret material (keys,
+ * tokens, auth files, full headers, complete imported payloads) is never placed
+ * into an event.
+ */
+export type AnyPickEventSeverity = 'info' | 'warn' | 'error';
+export interface AnyPickEvent {
+    /** Correlation id (e.g. a journal operation id) when available. */
+    opId?: string;
+    /** Resource ids touched by the condition (scoped, not secret). */
+    resourceIds?: string[];
+    /** Lifecycle step the event corresponds to, when relevant. */
+    step?: string;
+    severity: AnyPickEventSeverity;
+    /** Stable machine-readable code (no spaces). */
+    code: string;
+    /** Human-readable message; must not contain secrets. */
+    message: string;
+    /** Sanitized context (no keys/tokens/paths-to-credentials). */
+    context?: Record<string, unknown>;
+    /** ISO timestamp. */
+    timestamp: string;
+}
+export interface AnyPickEventSink {
+    emit(event: AnyPickEvent): void;
+}
+export declare function sanitizeContext(context: Record<string, unknown> | undefined): Record<string, unknown> | undefined;
+export interface EmitOptions {
+    opId?: string;
+    resourceIds?: string[];
+    step?: string;
+    context?: Record<string, unknown>;
+}
+/** Build a sanitized event and hand it to the sink. */
+export declare function makeEmitter(sink: AnyPickEventSink | undefined): (severity: AnyPickEventSeverity, code: string, message: string, opts?: EmitOptions) => void;
+/** In-memory ring buffer used when no external sink is supplied. */
+export declare class InMemoryEventSink implements AnyPickEventSink {
+    private readonly events;
+    private readonly max;
+    constructor(max?: number);
+    emit(event: AnyPickEvent): void;
+    list(): readonly AnyPickEvent[];
+    clear(): void;
+}
+/** Sink that echoes to stderr (only when ANYPICK_DEBUG is set). */
+export declare class DebugStderrEventSink implements AnyPickEventSink {
+    emit(event: AnyPickEvent): void;
+}
+//# sourceMappingURL=events.d.ts.map

package/dist/core/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/core/events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE7D,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,OAAO,EAAE,MAAM,CAAC;IAChB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAAC;CACjC;AAwBD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAkBrC;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,uDAAuD;AACvD,wBAAgB,WAAW,CAAC,IAAI,EAAE,gBAAgB,GAAG,SAAS,cAEhD,oBAAoB,QACxB,MAAM,WACH,MAAM,SACT,WAAW,KAChB,IAAI,CAeR;AAED,oEAAoE;AACpE,qBAAa,iBAAkB,YAAW,gBAAgB;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;IAC7C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAE7B,YAAY,GAAG,SAAM,EAEpB;IAED,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAK9B;IAED,IAAI,IAAI,SAAS,YAAY,EAAE,CAE9B;IAED,KAAK,IAAI,IAAI,CAEZ;CACF;AAED,mEAAmE;AACnE,qBAAa,oBAAqB,YAAW,gBAAgB;IAC3D,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,IAAI,CAM9B;CACF"}

package/dist/core/events.js

@@ -0,0 +1,88 @@
+//#region src/core/events.ts
+/**
+* Redact obviously-sensitive keys from a context object. Returns a shallow copy
+* with known-secret fields replaced by a constant placeholder. Values that are
+* themselves objects are not traversed (context is meant to be flat and small).
+*/
+var SENSITIVE_KEYS = /* @__PURE__ */ new Set([
+	"key",
+	"keys",
+	"token",
+	"tokens",
+	"secret",
+	"secrets",
+	"password",
+	"apiKey",
+	"api_key",
+	"authorization",
+	"auth",
+	"accessToken",
+	"refreshToken",
+	"bearer"
+]);
+function sanitizeContext(context) {
+	if (!context) return;
+	const out = {};
+	for (const [k, v] of Object.entries(context)) {
+		if (SENSITIVE_KEYS.has(k)) {
+			out[k] = "<redacted>";
+			continue;
+		}
+		if (typeof v === "string" && v.length > 24 && /[\w-]{24,}/.test(v)) {
+			out[k] = "<redacted>";
+			continue;
+		}
+		out[k] = v;
+	}
+	return out;
+}
+/** Build a sanitized event and hand it to the sink. */
+function makeEmitter(sink) {
+	return function emit(severity, code, message, opts = {}) {
+		if (!sink) return;
+		sink.emit({
+			opId: opts.opId,
+			resourceIds: opts.resourceIds,
+			step: opts.step,
+			severity,
+			code,
+			message,
+			context: sanitizeContext(opts.context),
+			timestamp: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	};
+}
+/** In-memory ring buffer used when no external sink is supplied. */
+var InMemoryEventSink = class {
+	events = [];
+	max;
+	constructor(max = 200) {
+		this.max = max;
+	}
+	emit(event) {
+		this.events.push(event);
+		if (this.events.length > this.max) this.events.shift();
+	}
+	list() {
+		return this.events;
+	}
+	clear() {
+		this.events.length = 0;
+	}
+};
+/** Sink that echoes to stderr (only when ANYPICK_DEBUG is set). */
+var DebugStderrEventSink = class {
+	emit(event) {
+		if (process.env.ANYPICK_DEBUG !== "1" && process.env.ANYPICK_DEBUG !== "true") return;
+		const loc = [
+			event.code,
+			event.opId,
+			...event.resourceIds ?? []
+		].filter(Boolean).join(" ");
+		process.stderr.write(`[anypick:event:${event.severity}] ${loc}: ${event.message}\n`);
+	}
+};
+//#endregion
+export { DebugStderrEventSink, InMemoryEventSink, makeEmitter, sanitizeContext };
+
+//# sourceMappingURL=events.js.map

package/dist/core/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","names":[],"sources":["../../src/core/events.ts"],"sourcesContent":["/**\n * Structured event sink for degraded / lifecycle conditions (spec OBS-01).\n *\n * AnyPick surfaces partial failures — startup recovery refusal, lease mismatch,\n * proxy realignment failure, unverified processes, cleanup failure — as typed\n * events rather than swallowing them or leaking them into stderr with secrets.\n * Library consumers can supply their own sink (e.g. to feed a TUI status bar);\n * when none is supplied, events are recorded in an in-memory ring that `doctor`\n * / `status` can read, and (optionally) echoed to stderr behind ANYPICK_DEBUG.\n *\n * All event context is sanitized at the boundary: secret material (keys,\n * tokens, auth files, full headers, complete imported payloads) is never placed\n * into an event.\n */\n\nexport type AnyPickEventSeverity = 'info' | 'warn' | 'error';\n\nexport interface AnyPickEvent {\n  /** Correlation id (e.g. a journal operation id) when available. */\n  opId?: string;\n  /** Resource ids touched by the condition (scoped, not secret). */\n  resourceIds?: string[];\n  /** Lifecycle step the event corresponds to, when relevant. */\n  step?: string;\n  severity: AnyPickEventSeverity;\n  /** Stable machine-readable code (no spaces). */\n  code: string;\n  /** Human-readable message; must not contain secrets. */\n  message: string;\n  /** Sanitized context (no keys/tokens/paths-to-credentials). */\n  context?: Record<string, unknown>;\n  /** ISO timestamp. */\n  timestamp: string;\n}\n\nexport interface AnyPickEventSink {\n  emit(event: AnyPickEvent): void;\n}\n\n/**\n * Redact obviously-sensitive keys from a context object. Returns a shallow copy\n * with known-secret fields replaced by a constant placeholder. Values that are\n * themselves objects are not traversed (context is meant to be flat and small).\n */\nconst SENSITIVE_KEYS = new Set([\n  'key',\n  'keys',\n  'token',\n  'tokens',\n  'secret',\n  'secrets',\n  'password',\n  'apiKey',\n  'api_key',\n  'authorization',\n  'auth',\n  'accessToken',\n  'refreshToken',\n  'bearer',\n]);\n\nexport function sanitizeContext(\n  context: Record<string, unknown> | undefined,\n): Record<string, unknown> | undefined {\n  if (!context) {\n    return undefined;\n  }\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(context)) {\n    if (SENSITIVE_KEYS.has(k)) {\n      out[k] = '<redacted>';\n      continue;\n    }\n    // Redact any value that looks like a long bearer/token string.\n    if (typeof v === 'string' && v.length > 24 && /[\\w-]{24,}/.test(v)) {\n      out[k] = '<redacted>';\n      continue;\n    }\n    out[k] = v;\n  }\n  return out;\n}\n\nexport interface EmitOptions {\n  opId?: string;\n  resourceIds?: string[];\n  step?: string;\n  context?: Record<string, unknown>;\n}\n\n/** Build a sanitized event and hand it to the sink. */\nexport function makeEmitter(sink: AnyPickEventSink | undefined) {\n  return function emit(\n    severity: AnyPickEventSeverity,\n    code: string,\n    message: string,\n    opts: EmitOptions = {},\n  ): void {\n    if (!sink) {\n      return;\n    }\n    sink.emit({\n      opId: opts.opId,\n      resourceIds: opts.resourceIds,\n      step: opts.step,\n      severity,\n      code,\n      message,\n      context: sanitizeContext(opts.context),\n      timestamp: new Date().toISOString(),\n    });\n  };\n}\n\n/** In-memory ring buffer used when no external sink is supplied. */\nexport class InMemoryEventSink implements AnyPickEventSink {\n  private readonly events: AnyPickEvent[] = [];\n  private readonly max: number;\n\n  constructor(max = 200) {\n    this.max = max;\n  }\n\n  emit(event: AnyPickEvent): void {\n    this.events.push(event);\n    if (this.events.length > this.max) {\n      this.events.shift();\n    }\n  }\n\n  list(): readonly AnyPickEvent[] {\n    return this.events;\n  }\n\n  clear(): void {\n    this.events.length = 0;\n  }\n}\n\n/** Sink that echoes to stderr (only when ANYPICK_DEBUG is set). */\nexport class DebugStderrEventSink implements AnyPickEventSink {\n  emit(event: AnyPickEvent): void {\n    if (process.env.ANYPICK_DEBUG !== '1' && process.env.ANYPICK_DEBUG !== 'true') {\n      return;\n    }\n    const loc = [event.code, event.opId, ...(event.resourceIds ?? [])].filter(Boolean).join(' ');\n    process.stderr.write(`[anypick:event:${event.severity}] ${loc}: ${event.message}\\n`);\n  }\n}\n"],"mappings":";;;;;;AA4CA,IAAM,iCAAiB,IAAI,IAAI;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAgB,gBACd,SACqC;CACrC,IAAI,CAAC,SACH;CAEF,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,GAAG;EAC5C,IAAI,eAAe,IAAI,CAAC,GAAG;GACzB,IAAI,KAAK;GACT;EACF;EAEA,IAAI,OAAO,MAAM,YAAY,EAAE,SAAS,MAAM,aAAa,KAAK,CAAC,GAAG;GAClE,IAAI,KAAK;GACT;EACF;EACA,IAAI,KAAK;CACX;CACA,OAAO;AACT;;AAUA,SAAgB,YAAY,MAAoC;CAC9D,OAAO,SAAS,KACd,UACA,MACA,SACA,OAAoB,CAAC,GACf;EACN,IAAI,CAAC,MACH;EAEF,KAAK,KAAK;GACR,MAAM,KAAK;GACX,aAAa,KAAK;GAClB,MAAM,KAAK;GACX;GACA;GACA;GACA,SAAS,gBAAgB,KAAK,OAAO;GACrC,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EACpC,CAAC;CACH;AACF;;AAGA,IAAa,oBAAb,MAA2D;CACzD,SAA0C,CAAC;CAC3C;CAEA,YAAY,MAAM,KAAK;EACrB,KAAK,MAAM;CACb;CAEA,KAAK,OAA2B;EAC9B,KAAK,OAAO,KAAK,KAAK;EACtB,IAAI,KAAK,OAAO,SAAS,KAAK,KAC5B,KAAK,OAAO,MAAM;CAEtB;CAEA,OAAgC;EAC9B,OAAO,KAAK;CACd;CAEA,QAAc;EACZ,KAAK,OAAO,SAAS;CACvB;AACF;;AAGA,IAAa,uBAAb,MAA8D;CAC5D,KAAK,OAA2B;EAC9B,IAAI,QAAQ,IAAI,kBAAkB,OAAO,QAAQ,IAAI,kBAAkB,QACrE;EAEF,MAAM,MAAM;GAAC,MAAM;GAAM,MAAM;GAAM,GAAI,MAAM,eAAe,CAAC;EAAE,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;EAC3F,QAAQ,OAAO,MAAM,kBAAkB,MAAM,SAAS,IAAI,IAAI,IAAI,MAAM,QAAQ,GAAG;CACrF;AACF"}

package/dist/core/journal.d.ts

@@ -0,0 +1,23 @@
+import type { JournalState, OperationJournalEntry } from '../types.js';
+import type { AnyPickDatabase } from './db.js';
+export declare class OperationJournal {
+    private readonly db;
+    constructor(db: AnyPickDatabase);
+    create(type: string, opts?: {
+        affectedResources?: string[];
+        backupPaths?: string[];
+        params?: Record<string, unknown>;
+        state?: JournalState;
+    }): OperationJournalEntry;
+    get(id: string): OperationJournalEntry | null;
+    update(id: string, patch: {
+        state?: JournalState;
+        backupPaths?: string[];
+        affectedResources?: string[];
+        params?: Record<string, unknown>;
+    }): OperationJournalEntry;
+    /** Incomplete entries that may need recovery on startup. */
+    listIncomplete(): OperationJournalEntry[];
+    listRecent(limit?: number): OperationJournalEntry[];
+}
+//# sourceMappingURL=journal.d.ts.map

package/dist/core/journal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.d.ts","sourceRoot":"","sources":["../../src/core/journal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AA8C5C,qBAAa,gBAAgB;IACf,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,eAAe,EAAI;IAEpD,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QACJ,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACjC,KAAK,CAAC,EAAE,YAAY,CAAC;KACjB,GACL,qBAAqB,CA6BvB;IAED,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAS5C;IAED,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,YAAY,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,GACA,qBAAqB,CA6BvB;IAED,4DAA4D;IAC5D,cAAc,IAAI,qBAAqB,EAAE,CAWxC;IAED,UAAU,CAAC,KAAK,SAAK,GAAG,qBAAqB,EAAE,CAW9C;CACF"}

package/dist/core/journal.js

@@ -0,0 +1,93 @@
+import { decode, decoders } from "./codec.js";
+import { randomUUID } from "node:crypto";
+//#region src/core/journal.ts
+function nowIso() {
+	return (/* @__PURE__ */ new Date()).toISOString();
+}
+function parse(row) {
+	let affectedResources;
+	let backupPaths;
+	let params;
+	try {
+		affectedResources = JSON.parse(row.affected_resources_json);
+		backupPaths = JSON.parse(row.backup_paths_json);
+		params = row.params_json === null ? void 0 : JSON.parse(row.params_json);
+	} catch {
+		return decode("{", decoders.journalEntry, `journal/${row.id}`);
+	}
+	return decode(JSON.stringify({
+		id: row.id,
+		type: row.type,
+		state: row.state,
+		affectedResources,
+		backupPaths,
+		params,
+		startedAt: row.started_at,
+		updatedAt: row.updated_at
+	}), decoders.journalEntry, `journal/${row.id}`);
+}
+var OperationJournal = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	create(type, opts = {}) {
+		const ts = nowIso();
+		const entry = {
+			id: randomUUID(),
+			type,
+			state: opts.state ?? "planned",
+			affectedResources: opts.affectedResources ?? [],
+			backupPaths: opts.backupPaths ?? [],
+			params: opts.params,
+			startedAt: ts,
+			updatedAt: ts
+		};
+		this.db.prepare(`INSERT INTO operation_journal
+           (id, type, state, affected_resources_json, backup_paths_json, params_json, started_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(entry.id, entry.type, entry.state, JSON.stringify(entry.affectedResources), JSON.stringify(entry.backupPaths), entry.params ? JSON.stringify(entry.params) : null, entry.startedAt, entry.updatedAt);
+		return entry;
+	}
+	get(id) {
+		const row = this.db.prepare(`SELECT id, type, state, affected_resources_json, backup_paths_json,
+                params_json, started_at, updated_at
+         FROM operation_journal WHERE id = ?`).get(id);
+		return row ? parse(row) : null;
+	}
+	update(id, patch) {
+		const existing = this.get(id);
+		if (!existing) throw new Error(`Journal entry not found: ${id}`);
+		const next = {
+			...existing,
+			state: patch.state ?? existing.state,
+			backupPaths: patch.backupPaths ?? existing.backupPaths,
+			affectedResources: patch.affectedResources ?? existing.affectedResources,
+			params: patch.params ?? existing.params,
+			updatedAt: nowIso()
+		};
+		this.db.prepare(`UPDATE operation_journal SET
+           state = ?, affected_resources_json = ?, backup_paths_json = ?,
+           params_json = ?, updated_at = ?
+         WHERE id = ?`).run(next.state, JSON.stringify(next.affectedResources), JSON.stringify(next.backupPaths), next.params ? JSON.stringify(next.params) : null, next.updatedAt, id);
+		return next;
+	}
+	/** Incomplete entries that may need recovery on startup. */
+	listIncomplete() {
+		return this.db.prepare(`SELECT id, type, state, affected_resources_json, backup_paths_json,
+                params_json, started_at, updated_at
+         FROM operation_journal
+         WHERE state IN ('planned', 'executing', 'verifying', 'rolling_back')
+         ORDER BY started_at`).all().map(parse);
+	}
+	listRecent(limit = 50) {
+		return this.db.prepare(`SELECT id, type, state, affected_resources_json, backup_paths_json,
+                params_json, started_at, updated_at
+         FROM operation_journal
+         ORDER BY started_at DESC
+         LIMIT ?`).all(limit).map(parse);
+	}
+};
+//#endregion
+export { OperationJournal };
+
+//# sourceMappingURL=journal.js.map

package/dist/core/journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.js","names":[],"sources":["../../src/core/journal.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto';\nimport type { JournalState, OperationJournalEntry } from '../types';\nimport { decode, decoders } from './codec';\nimport type { AnyPickDatabase } from './db';\n\ninterface JournalRow {\n  id: string;\n  type: string;\n  state: string;\n  affected_resources_json: string;\n  backup_paths_json: string;\n  params_json: string | null;\n  started_at: string;\n  updated_at: string;\n}\n\nfunction nowIso(): string {\n  return new Date().toISOString();\n}\n\nfunction parse(row: JournalRow): OperationJournalEntry {\n  let affectedResources: unknown;\n  let backupPaths: unknown;\n  let params: unknown;\n  try {\n    affectedResources = JSON.parse(row.affected_resources_json);\n    backupPaths = JSON.parse(row.backup_paths_json);\n    params = row.params_json === null ? undefined : JSON.parse(row.params_json);\n  } catch {\n    // `decode` supplies a stable record kind while keeping stored values out\n    // of the message (params may carry credential-adjacent metadata).\n    return decode('{', decoders.journalEntry, `journal/${row.id}`);\n  }\n  return decode(\n    JSON.stringify({\n      id: row.id,\n      type: row.type,\n      state: row.state,\n      affectedResources,\n      backupPaths,\n      params,\n      startedAt: row.started_at,\n      updatedAt: row.updated_at,\n    }),\n    decoders.journalEntry,\n    `journal/${row.id}`,\n  );\n}\n\nexport class OperationJournal {\n  constructor(private readonly db: AnyPickDatabase) {}\n\n  create(\n    type: string,\n    opts: {\n      affectedResources?: string[];\n      backupPaths?: string[];\n      params?: Record<string, unknown>;\n      state?: JournalState;\n    } = {},\n  ): OperationJournalEntry {\n    const ts = nowIso();\n    const entry: OperationJournalEntry = {\n      id: randomUUID(),\n      type,\n      state: opts.state ?? 'planned',\n      affectedResources: opts.affectedResources ?? [],\n      backupPaths: opts.backupPaths ?? [],\n      params: opts.params,\n      startedAt: ts,\n      updatedAt: ts,\n    };\n    this.db\n      .prepare(\n        `INSERT INTO operation_journal\n           (id, type, state, affected_resources_json, backup_paths_json, params_json, started_at, updated_at)\n         VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n      )\n      .run(\n        entry.id,\n        entry.type,\n        entry.state,\n        JSON.stringify(entry.affectedResources),\n        JSON.stringify(entry.backupPaths),\n        entry.params ? JSON.stringify(entry.params) : null,\n        entry.startedAt,\n        entry.updatedAt,\n      );\n    return entry;\n  }\n\n  get(id: string): OperationJournalEntry | null {\n    const row = this.db\n      .prepare(\n        `SELECT id, type, state, affected_resources_json, backup_paths_json,\n                params_json, started_at, updated_at\n         FROM operation_journal WHERE id = ?`,\n      )\n      .get(id) as JournalRow | undefined;\n    return row ? parse(row) : null;\n  }\n\n  update(\n    id: string,\n    patch: {\n      state?: JournalState;\n      backupPaths?: string[];\n      affectedResources?: string[];\n      params?: Record<string, unknown>;\n    },\n  ): OperationJournalEntry {\n    const existing = this.get(id);\n    if (!existing) {\n      throw new Error(`Journal entry not found: ${id}`);\n    }\n    const next: OperationJournalEntry = {\n      ...existing,\n      state: patch.state ?? existing.state,\n      backupPaths: patch.backupPaths ?? existing.backupPaths,\n      affectedResources: patch.affectedResources ?? existing.affectedResources,\n      params: patch.params ?? existing.params,\n      updatedAt: nowIso(),\n    };\n    this.db\n      .prepare(\n        `UPDATE operation_journal SET\n           state = ?, affected_resources_json = ?, backup_paths_json = ?,\n           params_json = ?, updated_at = ?\n         WHERE id = ?`,\n      )\n      .run(\n        next.state,\n        JSON.stringify(next.affectedResources),\n        JSON.stringify(next.backupPaths),\n        next.params ? JSON.stringify(next.params) : null,\n        next.updatedAt,\n        id,\n      );\n    return next;\n  }\n\n  /** Incomplete entries that may need recovery on startup. */\n  listIncomplete(): OperationJournalEntry[] {\n    const rows = this.db\n      .prepare(\n        `SELECT id, type, state, affected_resources_json, backup_paths_json,\n                params_json, started_at, updated_at\n         FROM operation_journal\n         WHERE state IN ('planned', 'executing', 'verifying', 'rolling_back')\n         ORDER BY started_at`,\n      )\n      .all() as unknown as JournalRow[];\n    return rows.map(parse);\n  }\n\n  listRecent(limit = 50): OperationJournalEntry[] {\n    const rows = this.db\n      .prepare(\n        `SELECT id, type, state, affected_resources_json, backup_paths_json,\n                params_json, started_at, updated_at\n         FROM operation_journal\n         ORDER BY started_at DESC\n         LIMIT ?`,\n      )\n      .all(limit) as unknown as JournalRow[];\n    return rows.map(parse);\n  }\n}\n"],"mappings":";;;AAgBA,SAAS,SAAiB;CACxB,wBAAO,IAAI,KAAK,EAAA,CAAE,YAAY;AAChC;AAEA,SAAS,MAAM,KAAwC;CACrD,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,oBAAoB,KAAK,MAAM,IAAI,uBAAuB;EAC1D,cAAc,KAAK,MAAM,IAAI,iBAAiB;EAC9C,SAAS,IAAI,gBAAgB,OAAO,KAAA,IAAY,KAAK,MAAM,IAAI,WAAW;CAC5E,QAAQ;EAGN,OAAO,OAAO,KAAK,SAAS,cAAc,WAAW,IAAI,IAAI;CAC/D;CACA,OAAO,OACL,KAAK,UAAU;EACb,IAAI,IAAI;EACR,MAAM,IAAI;EACV,OAAO,IAAI;EACX;EACA;EACA;EACA,WAAW,IAAI;EACf,WAAW,IAAI;CACjB,CAAC,GACD,SAAS,cACT,WAAW,IAAI,IACjB;AACF;AAEA,IAAa,mBAAb,MAA8B;CACC;CAA7B,YAAY,IAAsC;EAArB,KAAA,KAAA;CAAsB;CAEnD,OACE,MACA,OAKI,CAAC,GACkB;EACvB,MAAM,KAAK,OAAO;EAClB,MAAM,QAA+B;GACnC,IAAI,WAAW;GACf;GACA,OAAO,KAAK,SAAS;GACrB,mBAAmB,KAAK,qBAAqB,CAAC;GAC9C,aAAa,KAAK,eAAe,CAAC;GAClC,QAAQ,KAAK;GACb,WAAW;GACX,WAAW;EACb;EACA,KAAK,GACF,QACC;;yCAGF,CAAC,CACA,IACC,MAAM,IACN,MAAM,MACN,MAAM,OACN,KAAK,UAAU,MAAM,iBAAiB,GACtC,KAAK,UAAU,MAAM,WAAW,GAChC,MAAM,SAAS,KAAK,UAAU,MAAM,MAAM,IAAI,MAC9C,MAAM,WACN,MAAM,SACR;EACF,OAAO;CACT;CAEA,IAAI,IAA0C;EAC5C,MAAM,MAAM,KAAK,GACd,QACC;;6CAGF,CAAC,CACA,IAAI,EAAE;EACT,OAAO,MAAM,MAAM,GAAG,IAAI;CAC5B;CAEA,OACE,IACA,OAMuB;EACvB,MAAM,WAAW,KAAK,IAAI,EAAE;EAC5B,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,4BAA4B,IAAI;EAElD,MAAM,OAA8B;GAClC,GAAG;GACH,OAAO,MAAM,SAAS,SAAS;GAC/B,aAAa,MAAM,eAAe,SAAS;GAC3C,mBAAmB,MAAM,qBAAqB,SAAS;GACvD,QAAQ,MAAM,UAAU,SAAS;GACjC,WAAW,OAAO;EACpB;EACA,KAAK,GACF,QACC;;;sBAIF,CAAC,CACA,IACC,KAAK,OACL,KAAK,UAAU,KAAK,iBAAiB,GACrC,KAAK,UAAU,KAAK,WAAW,GAC/B,KAAK,SAAS,KAAK,UAAU,KAAK,MAAM,IAAI,MAC5C,KAAK,WACL,EACF;EACF,OAAO;CACT;;CAGA,iBAA0C;EAUxC,OATa,KAAK,GACf,QACC;;;;6BAKF,CAAC,CACA,IACI,CAAA,CAAK,IAAI,KAAK;CACvB;CAEA,WAAW,QAAQ,IAA6B;EAU9C,OATa,KAAK,GACf,QACC;;;;iBAKF,CAAC,CACA,IAAI,KACA,CAAA,CAAK,IAAI,KAAK;CACvB;AACF"}