anypick 1.0.0

package/dist/core/proxy-hub-store.d.ts

@@ -0,0 +1,28 @@
+import type { ProxyHubConfig, ProxyHubRouteManifest, ProxyHubRuntimeState } from '../types.js';
+import type { AnyPickDatabase } from './db.js';
+export declare const DEFAULT_PROXY_HUB = "default";
+export declare const DEFAULT_PROXY_HUB_PORT = 4680;
+export interface ProxyHubRouteSecret {
+    routeId: string;
+    manifest: ProxyHubRouteManifest;
+    /** Keep this private to the Hub service/executor boundary. */
+    token: string;
+}
+export declare class ProxyHubStore {
+    private readonly db;
+    constructor(db: AnyPickDatabase);
+    get(name?: string): ProxyHubConfig | null;
+    getOrDefault(name?: string): ProxyHubConfig;
+    save(config: ProxyHubConfig): ProxyHubConfig;
+    getRuntime(name?: string): ProxyHubRuntimeState | null;
+    saveRuntime(state: ProxyHubRuntimeState): void;
+    clearRuntime(name?: string): void;
+    attachRoute(routeId: string, manifest: ProxyHubRouteManifest, token?: string): ProxyHubRouteSecret;
+    getRoute(routeId: string): ProxyHubRouteSecret | null;
+    getRouteByToken(token: string): ProxyHubRouteSecret | null;
+    /** Owner-only route records for the Hub server's constant-time auth check. */
+    listRouteSecrets(name?: string): ProxyHubRouteSecret[];
+    detachRoute(routeId: string): void;
+    countRoutes(name?: string): number;
+}
+//# sourceMappingURL=proxy-hub-store.d.ts.map

package/dist/core/proxy-hub-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-hub-store.d.ts","sourceRoot":"","sources":["../../src/core/proxy-hub-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAE5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AAE5C,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAC3C,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAmB3C,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,qBAAqB,CAAC;IAChC,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,EAAE;IAA/B,YAA6B,EAAE,EAAE,eAAe,EAAI;IAEpD,GAAG,CAAC,IAAI,SAAoB,GAAG,cAAc,GAAG,IAAI,CAKnD;IAED,YAAY,CAAC,IAAI,SAAoB,GAAG,cAAc,CAErD;IAED,IAAI,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAmB3C;IAED,UAAU,CAAC,IAAI,SAAoB,GAAG,oBAAoB,GAAG,IAAI,CAOhE;IAED,WAAW,CAAC,KAAK,EAAE,oBAAoB,GAAG,IAAI,CAU7C;IAED,YAAY,CAAC,IAAI,SAAoB,GAAG,IAAI,CAE3C;IAED,WAAW,CACT,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,qBAAqB,EAC/B,KAAK,SAAkC,GACtC,mBAAmB,CAoBrB;IAED,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAcpD;IAED,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,mBAAmB,GAAG,IAAI,CAczD;IAED,8EAA8E;IAC9E,gBAAgB,CAAC,IAAI,SAAoB,GAAG,mBAAmB,EAAE,CAYhE;IAED,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEjC;IAED,WAAW,CAAC,IAAI,SAAoB,GAAG,MAAM,CAK5C;CACF"}

package/dist/core/proxy-hub-store.js

@@ -0,0 +1,152 @@
+import { decode, decoders } from "./codec.js";
+import { randomBytes } from "node:crypto";
+//#region src/core/proxy-hub-store.ts
+var DEFAULT_PROXY_HUB = "default";
+var DEFAULT_PROXY_HUB_PORT = 4680;
+var ProxyHubStore = class {
+	db;
+	constructor(db) {
+		this.db = db;
+	}
+	get(name = DEFAULT_PROXY_HUB) {
+		const row = this.db.prepare("SELECT name, config_json FROM proxy_hubs WHERE name = ?").get(name);
+		return row ? decode(row.config_json, decoders.proxyHubConfig, `proxy-hub/${name}`) : null;
+	}
+	getOrDefault(name = DEFAULT_PROXY_HUB) {
+		return this.get(name) ?? defaultConfig(name);
+	}
+	save(config) {
+		const now = (/* @__PURE__ */ new Date()).toISOString();
+		const previous = this.get(config.name);
+		const next = {
+			...config,
+			revision: previous ? previous.revision + 1 : Math.max(1, config.revision),
+			createdAt: previous?.createdAt ?? config.createdAt ?? now,
+			updatedAt: now
+		};
+		this.db.prepare(`INSERT INTO proxy_hubs (name, config_json, created_at, updated_at)
+         VALUES (?, ?, ?, ?)
+         ON CONFLICT(name) DO UPDATE SET
+           config_json = excluded.config_json,
+           updated_at = excluded.updated_at`).run(next.name, JSON.stringify(next), next.createdAt, next.updatedAt);
+		return next;
+	}
+	getRuntime(name = DEFAULT_PROXY_HUB) {
+		const row = this.db.prepare("SELECT name, state_json FROM proxy_hub_runtime WHERE name = ?").get(name);
+		return row ? decode(row.state_json, decoders.proxyHubRuntimeState, `proxy-hub-runtime/${name}`) : null;
+	}
+	saveRuntime(state) {
+		this.db.prepare(`INSERT INTO proxy_hub_runtime (name, state_json, updated_at)
+         VALUES (?, ?, ?)
+         ON CONFLICT(name) DO UPDATE SET
+           state_json = excluded.state_json,
+           updated_at = excluded.updated_at`).run(state.name, JSON.stringify(state), (/* @__PURE__ */ new Date()).toISOString());
+	}
+	clearRuntime(name = DEFAULT_PROXY_HUB) {
+		this.db.prepare("DELETE FROM proxy_hub_runtime WHERE name = ?").run(name);
+	}
+	attachRoute(routeId, manifest, token = randomBytes(32).toString("hex")) {
+		this.db.prepare(`INSERT INTO proxy_hub_routes (route_id, hub_name, manifest_json, token_secret, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?, ?)
+         ON CONFLICT(route_id) DO UPDATE SET
+           hub_name = excluded.hub_name,
+           manifest_json = excluded.manifest_json,
+           token_secret = excluded.token_secret,
+           updated_at = excluded.updated_at`).run(routeId, manifest.hub, JSON.stringify(manifest), token, (/* @__PURE__ */ new Date()).toISOString(), (/* @__PURE__ */ new Date()).toISOString());
+		return {
+			routeId,
+			manifest,
+			token
+		};
+	}
+	getRoute(routeId) {
+		const row = this.db.prepare("SELECT route_id, hub_name, manifest_json, token_secret FROM proxy_hub_routes WHERE route_id = ?").get(routeId);
+		if (!row) return null;
+		return {
+			routeId: row.route_id,
+			manifest: decodeProxyHubManifest(row.manifest_json, `proxy-hub-route/${row.route_id}`),
+			token: row.token_secret
+		};
+	}
+	getRouteByToken(token) {
+		const row = this.db.prepare("SELECT route_id, hub_name, manifest_json, token_secret FROM proxy_hub_routes WHERE token_secret = ?").get(token);
+		if (!row) return null;
+		return {
+			routeId: row.route_id,
+			manifest: decodeProxyHubManifest(row.manifest_json, `proxy-hub-route/${row.route_id}`),
+			token: row.token_secret
+		};
+	}
+	/** Owner-only route records for the Hub server's constant-time auth check. */
+	listRouteSecrets(name = DEFAULT_PROXY_HUB) {
+		return this.db.prepare(`SELECT route_id, hub_name, manifest_json, token_secret
+         FROM proxy_hub_routes WHERE hub_name = ? ORDER BY route_id`).all(name).map((row) => ({
+			routeId: row.route_id,
+			manifest: decodeProxyHubManifest(row.manifest_json, `proxy-hub-route/${row.route_id}`),
+			token: row.token_secret
+		}));
+	}
+	detachRoute(routeId) {
+		this.db.prepare("DELETE FROM proxy_hub_routes WHERE route_id = ?").run(routeId);
+	}
+	countRoutes(name = DEFAULT_PROXY_HUB) {
+		const row = this.db.prepare("SELECT COUNT(*) AS count FROM proxy_hub_routes WHERE hub_name = ?").get(name);
+		return Number(row?.count ?? 0);
+	}
+};
+function defaultConfig(name) {
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	return {
+		name,
+		enabled: false,
+		host: "127.0.0.1",
+		port: DEFAULT_PROXY_HUB_PORT,
+		sources: [],
+		modelOwners: [],
+		revision: 1,
+		createdAt: now,
+		updatedAt: now
+	};
+}
+function decodeProxyHubManifest(json, key) {
+	const parsed = JSON.parse(json);
+	if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) throw new Error(`corrupt proxy hub route: ${key}`);
+	const value = parsed;
+	if (value.version !== 1 || typeof value.hub !== "string" || typeof value.revision !== "number" || typeof value.client !== "string" || value.protocol !== "openai" && value.protocol !== "anthropic" || !Array.isArray(value.routes)) throw new Error(`corrupt proxy hub route: ${key}`);
+	const routes = value.routes.map((route, index) => {
+		if (!route || typeof route !== "object" || Array.isArray(route)) throw new Error(`corrupt proxy hub route: ${key}.routes[${index}]`);
+		const target = route;
+		if (typeof target.model !== "string" || typeof target.upstreamModel !== "string" || !target.source || typeof target.source !== "object" || Array.isArray(target.source)) throw new Error(`corrupt proxy hub route: ${key}.routes[${index}]`);
+		const source = target.source;
+		if (source.kind === "account" && typeof source.provider === "string" && typeof source.name === "string") return {
+			model: target.model,
+			upstreamModel: target.upstreamModel,
+			source: {
+				kind: "account",
+				provider: source.provider,
+				name: source.name
+			}
+		};
+		if (source.kind === "account-pool" && typeof source.provider === "string") return {
+			model: target.model,
+			upstreamModel: target.upstreamModel,
+			source: {
+				kind: "account-pool",
+				provider: source.provider
+			}
+		};
+		throw new Error(`corrupt proxy hub route: ${key}.routes[${index}].source`);
+	});
+	return {
+		version: 1,
+		hub: value.hub,
+		revision: value.revision,
+		client: value.client,
+		protocol: value.protocol,
+		routes
+	};
+}
+//#endregion
+export { DEFAULT_PROXY_HUB, DEFAULT_PROXY_HUB_PORT, ProxyHubStore };
+
+//# sourceMappingURL=proxy-hub-store.js.map

package/dist/core/proxy-hub-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-hub-store.js","names":[],"sources":["../../src/core/proxy-hub-store.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\nimport type { ProxyHubConfig, ProxyHubRouteManifest, ProxyHubRuntimeState } from '../types';\nimport { decode, decoders } from './codec';\nimport type { AnyPickDatabase } from './db';\n\nexport const DEFAULT_PROXY_HUB = 'default';\nexport const DEFAULT_PROXY_HUB_PORT = 4680;\n\ninterface HubRow {\n  name: string;\n  config_json: string;\n}\n\ninterface HubRuntimeRow {\n  name: string;\n  state_json: string;\n}\n\ninterface HubRouteRow {\n  route_id: string;\n  hub_name: string;\n  manifest_json: string;\n  token_secret: string;\n}\n\nexport interface ProxyHubRouteSecret {\n  routeId: string;\n  manifest: ProxyHubRouteManifest;\n  /** Keep this private to the Hub service/executor boundary. */\n  token: string;\n}\n\nexport class ProxyHubStore {\n  constructor(private readonly db: AnyPickDatabase) {}\n\n  get(name = DEFAULT_PROXY_HUB): ProxyHubConfig | null {\n    const row = this.db\n      .prepare('SELECT name, config_json FROM proxy_hubs WHERE name = ?')\n      .get(name) as HubRow | undefined;\n    return row ? decode(row.config_json, decoders.proxyHubConfig, `proxy-hub/${name}`) : null;\n  }\n\n  getOrDefault(name = DEFAULT_PROXY_HUB): ProxyHubConfig {\n    return this.get(name) ?? defaultConfig(name);\n  }\n\n  save(config: ProxyHubConfig): ProxyHubConfig {\n    const now = new Date().toISOString();\n    const previous = this.get(config.name);\n    const next: ProxyHubConfig = {\n      ...config,\n      revision: previous ? previous.revision + 1 : Math.max(1, config.revision),\n      createdAt: previous?.createdAt ?? config.createdAt ?? now,\n      updatedAt: now,\n    };\n    this.db\n      .prepare(\n        `INSERT INTO proxy_hubs (name, config_json, created_at, updated_at)\n         VALUES (?, ?, ?, ?)\n         ON CONFLICT(name) DO UPDATE SET\n           config_json = excluded.config_json,\n           updated_at = excluded.updated_at`,\n      )\n      .run(next.name, JSON.stringify(next), next.createdAt, next.updatedAt);\n    return next;\n  }\n\n  getRuntime(name = DEFAULT_PROXY_HUB): ProxyHubRuntimeState | null {\n    const row = this.db\n      .prepare('SELECT name, state_json FROM proxy_hub_runtime WHERE name = ?')\n      .get(name) as HubRuntimeRow | undefined;\n    return row\n      ? decode(row.state_json, decoders.proxyHubRuntimeState, `proxy-hub-runtime/${name}`)\n      : null;\n  }\n\n  saveRuntime(state: ProxyHubRuntimeState): void {\n    this.db\n      .prepare(\n        `INSERT INTO proxy_hub_runtime (name, state_json, updated_at)\n         VALUES (?, ?, ?)\n         ON CONFLICT(name) DO UPDATE SET\n           state_json = excluded.state_json,\n           updated_at = excluded.updated_at`,\n      )\n      .run(state.name, JSON.stringify(state), new Date().toISOString());\n  }\n\n  clearRuntime(name = DEFAULT_PROXY_HUB): void {\n    this.db.prepare('DELETE FROM proxy_hub_runtime WHERE name = ?').run(name);\n  }\n\n  attachRoute(\n    routeId: string,\n    manifest: ProxyHubRouteManifest,\n    token = randomBytes(32).toString('hex'),\n  ): ProxyHubRouteSecret {\n    this.db\n      .prepare(\n        `INSERT INTO proxy_hub_routes (route_id, hub_name, manifest_json, token_secret, created_at, updated_at)\n         VALUES (?, ?, ?, ?, ?, ?)\n         ON CONFLICT(route_id) DO UPDATE SET\n           hub_name = excluded.hub_name,\n           manifest_json = excluded.manifest_json,\n           token_secret = excluded.token_secret,\n           updated_at = excluded.updated_at`,\n      )\n      .run(\n        routeId,\n        manifest.hub,\n        JSON.stringify(manifest),\n        token,\n        new Date().toISOString(),\n        new Date().toISOString(),\n      );\n    return { routeId, manifest, token };\n  }\n\n  getRoute(routeId: string): ProxyHubRouteSecret | null {\n    const row = this.db\n      .prepare(\n        'SELECT route_id, hub_name, manifest_json, token_secret FROM proxy_hub_routes WHERE route_id = ?',\n      )\n      .get(routeId) as HubRouteRow | undefined;\n    if (!row) {\n      return null;\n    }\n    return {\n      routeId: row.route_id,\n      manifest: decodeProxyHubManifest(row.manifest_json, `proxy-hub-route/${row.route_id}`),\n      token: row.token_secret,\n    };\n  }\n\n  getRouteByToken(token: string): ProxyHubRouteSecret | null {\n    const row = this.db\n      .prepare(\n        'SELECT route_id, hub_name, manifest_json, token_secret FROM proxy_hub_routes WHERE token_secret = ?',\n      )\n      .get(token) as HubRouteRow | undefined;\n    if (!row) {\n      return null;\n    }\n    return {\n      routeId: row.route_id,\n      manifest: decodeProxyHubManifest(row.manifest_json, `proxy-hub-route/${row.route_id}`),\n      token: row.token_secret,\n    };\n  }\n\n  /** Owner-only route records for the Hub server's constant-time auth check. */\n  listRouteSecrets(name = DEFAULT_PROXY_HUB): ProxyHubRouteSecret[] {\n    const rows = this.db\n      .prepare(\n        `SELECT route_id, hub_name, manifest_json, token_secret\n         FROM proxy_hub_routes WHERE hub_name = ? ORDER BY route_id`,\n      )\n      .all(name) as unknown as HubRouteRow[];\n    return rows.map((row) => ({\n      routeId: row.route_id,\n      manifest: decodeProxyHubManifest(row.manifest_json, `proxy-hub-route/${row.route_id}`),\n      token: row.token_secret,\n    }));\n  }\n\n  detachRoute(routeId: string): void {\n    this.db.prepare('DELETE FROM proxy_hub_routes WHERE route_id = ?').run(routeId);\n  }\n\n  countRoutes(name = DEFAULT_PROXY_HUB): number {\n    const row = this.db\n      .prepare('SELECT COUNT(*) AS count FROM proxy_hub_routes WHERE hub_name = ?')\n      .get(name) as { count?: number } | undefined;\n    return Number(row?.count ?? 0);\n  }\n}\n\nfunction defaultConfig(name: string): ProxyHubConfig {\n  const now = new Date().toISOString();\n  return {\n    name,\n    enabled: false,\n    host: '127.0.0.1',\n    port: DEFAULT_PROXY_HUB_PORT,\n    sources: [],\n    modelOwners: [],\n    revision: 1,\n    createdAt: now,\n    updatedAt: now,\n  };\n}\n\nfunction decodeProxyHubManifest(json: string, key: string): ProxyHubRouteManifest {\n  const parsed = JSON.parse(json) as unknown;\n  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {\n    throw new Error(`corrupt proxy hub route: ${key}`);\n  }\n  const value = parsed as Record<string, unknown>;\n  if (\n    value.version !== 1 ||\n    typeof value.hub !== 'string' ||\n    typeof value.revision !== 'number' ||\n    typeof value.client !== 'string' ||\n    (value.protocol !== 'openai' && value.protocol !== 'anthropic') ||\n    !Array.isArray(value.routes)\n  ) {\n    throw new Error(`corrupt proxy hub route: ${key}`);\n  }\n  const routes = value.routes.map((route, index) => {\n    if (!route || typeof route !== 'object' || Array.isArray(route)) {\n      throw new Error(`corrupt proxy hub route: ${key}.routes[${index}]`);\n    }\n    const target = route as Record<string, unknown>;\n    if (\n      typeof target.model !== 'string' ||\n      typeof target.upstreamModel !== 'string' ||\n      !target.source ||\n      typeof target.source !== 'object' ||\n      Array.isArray(target.source)\n    ) {\n      throw new Error(`corrupt proxy hub route: ${key}.routes[${index}]`);\n    }\n    const source = target.source as Record<string, unknown>;\n    if (\n      source.kind === 'account' &&\n      typeof source.provider === 'string' &&\n      typeof source.name === 'string'\n    ) {\n      return {\n        model: target.model,\n        upstreamModel: target.upstreamModel,\n        source: { kind: 'account' as const, provider: source.provider, name: source.name },\n      };\n    }\n    if (source.kind === 'account-pool' && typeof source.provider === 'string') {\n      return {\n        model: target.model,\n        upstreamModel: target.upstreamModel,\n        source: { kind: 'account-pool' as const, provider: source.provider },\n      };\n    }\n    throw new Error(`corrupt proxy hub route: ${key}.routes[${index}].source`);\n  });\n  return {\n    version: 1,\n    hub: value.hub,\n    revision: value.revision,\n    client: value.client,\n    protocol: value.protocol,\n    routes,\n  };\n}\n"],"mappings":";;;AAKA,IAAa,oBAAoB;AACjC,IAAa,yBAAyB;AA0BtC,IAAa,gBAAb,MAA2B;CACI;CAA7B,YAAY,IAAsC;EAArB,KAAA,KAAA;CAAsB;CAEnD,IAAI,OAAO,mBAA0C;EACnD,MAAM,MAAM,KAAK,GACd,QAAQ,yDAAyD,CAAC,CAClE,IAAI,IAAI;EACX,OAAO,MAAM,OAAO,IAAI,aAAa,SAAS,gBAAgB,aAAa,MAAM,IAAI;CACvF;CAEA,aAAa,OAAO,mBAAmC;EACrD,OAAO,KAAK,IAAI,IAAI,KAAK,cAAc,IAAI;CAC7C;CAEA,KAAK,QAAwC;EAC3C,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;EACnC,MAAM,WAAW,KAAK,IAAI,OAAO,IAAI;EACrC,MAAM,OAAuB;GAC3B,GAAG;GACH,UAAU,WAAW,SAAS,WAAW,IAAI,KAAK,IAAI,GAAG,OAAO,QAAQ;GACxE,WAAW,UAAU,aAAa,OAAO,aAAa;GACtD,WAAW;EACb;EACA,KAAK,GACF,QACC;;;;4CAKF,CAAC,CACA,IAAI,KAAK,MAAM,KAAK,UAAU,IAAI,GAAG,KAAK,WAAW,KAAK,SAAS;EACtE,OAAO;CACT;CAEA,WAAW,OAAO,mBAAgD;EAChE,MAAM,MAAM,KAAK,GACd,QAAQ,+DAA+D,CAAC,CACxE,IAAI,IAAI;EACX,OAAO,MACH,OAAO,IAAI,YAAY,SAAS,sBAAsB,qBAAqB,MAAM,IACjF;CACN;CAEA,YAAY,OAAmC;EAC7C,KAAK,GACF,QACC;;;;4CAKF,CAAC,CACA,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK,oBAAG,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC;CACpE;CAEA,aAAa,OAAO,mBAAyB;EAC3C,KAAK,GAAG,QAAQ,8CAA8C,CAAC,CAAC,IAAI,IAAI;CAC1E;CAEA,YACE,SACA,UACA,QAAQ,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK,GACjB;EACrB,KAAK,GACF,QACC;;;;;;4CAOF,CAAC,CACA,IACC,SACA,SAAS,KACT,KAAK,UAAU,QAAQ,GACvB,wBACA,IAAI,KAAK,EAAA,CAAE,YAAY,oBACvB,IAAI,KAAK,EAAA,CAAE,YAAY,CACzB;EACF,OAAO;GAAE;GAAS;GAAU;EAAM;CACpC;CAEA,SAAS,SAA6C;EACpD,MAAM,MAAM,KAAK,GACd,QACC,iGACF,CAAC,CACA,IAAI,OAAO;EACd,IAAI,CAAC,KACH,OAAO;EAET,OAAO;GACL,SAAS,IAAI;GACb,UAAU,uBAAuB,IAAI,eAAe,mBAAmB,IAAI,UAAU;GACrF,OAAO,IAAI;EACb;CACF;CAEA,gBAAgB,OAA2C;EACzD,MAAM,MAAM,KAAK,GACd,QACC,qGACF,CAAC,CACA,IAAI,KAAK;EACZ,IAAI,CAAC,KACH,OAAO;EAET,OAAO;GACL,SAAS,IAAI;GACb,UAAU,uBAAuB,IAAI,eAAe,mBAAmB,IAAI,UAAU;GACrF,OAAO,IAAI;EACb;CACF;;CAGA,iBAAiB,OAAO,mBAA0C;EAOhE,OANa,KAAK,GACf,QACC;oEAEF,CAAC,CACA,IAAI,IACA,CAAA,CAAK,KAAK,SAAS;GACxB,SAAS,IAAI;GACb,UAAU,uBAAuB,IAAI,eAAe,mBAAmB,IAAI,UAAU;GACrF,OAAO,IAAI;EACb,EAAE;CACJ;CAEA,YAAY,SAAuB;EACjC,KAAK,GAAG,QAAQ,iDAAiD,CAAC,CAAC,IAAI,OAAO;CAChF;CAEA,YAAY,OAAO,mBAA2B;EAC5C,MAAM,MAAM,KAAK,GACd,QAAQ,mEAAmE,CAAC,CAC5E,IAAI,IAAI;EACX,OAAO,OAAO,KAAK,SAAS,CAAC;CAC/B;AACF;AAEA,SAAS,cAAc,MAA8B;CACnD,MAAM,uBAAM,IAAI,KAAK,EAAA,CAAE,YAAY;CACnC,OAAO;EACL;EACA,SAAS;EACT,MAAM;EACN,MAAM;EACN,SAAS,CAAC;EACV,aAAa,CAAC;EACd,UAAU;EACV,WAAW;EACX,WAAW;CACb;AACF;AAEA,SAAS,uBAAuB,MAAc,KAAoC;CAChF,MAAM,SAAS,KAAK,MAAM,IAAI;CAC9B,IAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAC/D,MAAM,IAAI,MAAM,4BAA4B,KAAK;CAEnD,MAAM,QAAQ;CACd,IACE,MAAM,YAAY,KAClB,OAAO,MAAM,QAAQ,YACrB,OAAO,MAAM,aAAa,YAC1B,OAAO,MAAM,WAAW,YACvB,MAAM,aAAa,YAAY,MAAM,aAAa,eACnD,CAAC,MAAM,QAAQ,MAAM,MAAM,GAE3B,MAAM,IAAI,MAAM,4BAA4B,KAAK;CAEnD,MAAM,SAAS,MAAM,OAAO,KAAK,OAAO,UAAU;EAChD,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAC5D,MAAM,IAAI,MAAM,4BAA4B,IAAI,UAAU,MAAM,EAAE;EAEpE,MAAM,SAAS;EACf,IACE,OAAO,OAAO,UAAU,YACxB,OAAO,OAAO,kBAAkB,YAChC,CAAC,OAAO,UACR,OAAO,OAAO,WAAW,YACzB,MAAM,QAAQ,OAAO,MAAM,GAE3B,MAAM,IAAI,MAAM,4BAA4B,IAAI,UAAU,MAAM,EAAE;EAEpE,MAAM,SAAS,OAAO;EACtB,IACE,OAAO,SAAS,aAChB,OAAO,OAAO,aAAa,YAC3B,OAAO,OAAO,SAAS,UAEvB,OAAO;GACL,OAAO,OAAO;GACd,eAAe,OAAO;GACtB,QAAQ;IAAE,MAAM;IAAoB,UAAU,OAAO;IAAU,MAAM,OAAO;GAAK;EACnF;EAEF,IAAI,OAAO,SAAS,kBAAkB,OAAO,OAAO,aAAa,UAC/D,OAAO;GACL,OAAO,OAAO;GACd,eAAe,OAAO;GACtB,QAAQ;IAAE,MAAM;IAAyB,UAAU,OAAO;GAAS;EACrE;EAEF,MAAM,IAAI,MAAM,4BAA4B,IAAI,UAAU,MAAM,SAAS;CAC3E,CAAC;CACD,OAAO;EACL,SAAS;EACT,KAAK,MAAM;EACX,UAAU,MAAM;EAChB,QAAQ,MAAM;EACd,UAAU,MAAM;EAChB;CACF;AACF"}

package/dist/core/proxy-lifecycle.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Proxy process lifecycle ownership.
+ *
+ * Proxies are spawned as detached child processes so they survive the CLI
+ * command that started them. That means nothing in the original process
+ * reaps them — they linger across sessions and hold their ports. The lease
+ * table records the owning pid; on startup we release leases whose owner is
+ * no longer alive and stop the proxy process they reference.
+ */
+import type { ProxyService } from './proxy-service.js';
+import type { LeaseStore } from './lease-store.js';
+import type { PoolStore } from './pool-store.js';
+export interface ProxyLifecycleDeps {
+    proxy: ProxyService;
+    leases: LeaseStore;
+    pools?: PoolStore;
+}
+/**
+ * Release leases whose owning process has exited and stop any proxy process
+ * they reference. Returns the lease ids that were reaped.
+ *
+ * Best-effort: individual stop/release failures are swallowed so one dead
+ * lease cannot block reaping of the rest.
+ */
+export declare function reapStaleLeases(deps: ProxyLifecycleDeps): Promise<string[]>;
+//# sourceMappingURL=proxy-lifecycle.d.ts.map

package/dist/core/proxy-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-lifecycle.d.ts","sourceRoot":"","sources":["../../src/core/proxy-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAG9C,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,YAAY,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA+CjF"}

package/dist/core/proxy-lifecycle.js

@@ -0,0 +1,33 @@
+import { isProcessRunning } from "../utils/process/pid.js";
+//#region src/core/proxy-lifecycle.ts
+/**
+* Release leases whose owning process has exited and stop any proxy process
+* they reference. Returns the lease ids that were reaped.
+*
+* Best-effort: individual stop/release failures are swallowed so one dead
+* lease cannot block reaping of the rest.
+*/
+async function reapStaleLeases(deps) {
+	const reaped = [];
+	const leases = deps.leases.list();
+	for (const lease of leases) {
+		const ownerAlive = typeof lease.ownerPid === "number" && lease.ownerPid > 0 ? isProcessRunning(lease.ownerPid) : false;
+		let legacySelfOwned = false;
+		if (ownerAlive) try {
+			legacySelfOwned = (lease.account ? await deps.proxy.proxyStatus(lease.provider, lease.account) : await deps.proxy.poolProxyStatus(lease.provider)).pid === lease.ownerPid;
+		} catch {}
+		if (ownerAlive && !legacySelfOwned) continue;
+		if (lease.account) try {
+			await deps.proxy.stopProxy(lease.provider, lease.account);
+		} catch {}
+		else try {
+			await deps.proxy.stopPoolProxy(lease.provider);
+		} catch {}
+		if (deps.leases.release(lease.leaseId)) reaped.push(lease.leaseId);
+	}
+	return reaped;
+}
+//#endregion
+export { reapStaleLeases };
+
+//# sourceMappingURL=proxy-lifecycle.js.map

package/dist/core/proxy-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-lifecycle.js","names":[],"sources":["../../src/core/proxy-lifecycle.ts"],"sourcesContent":["/**\n * Proxy process lifecycle ownership.\n *\n * Proxies are spawned as detached child processes so they survive the CLI\n * command that started them. That means nothing in the original process\n * reaps them — they linger across sessions and hold their ports. The lease\n * table records the owning pid; on startup we release leases whose owner is\n * no longer alive and stop the proxy process they reference.\n */\n\nimport type { ProxyService } from './proxy-service';\nimport type { LeaseStore } from './lease-store';\nimport type { PoolStore } from './pool-store';\nimport { isProcessRunning } from '../utils/process';\n\nexport interface ProxyLifecycleDeps {\n  proxy: ProxyService;\n  leases: LeaseStore;\n  pools?: PoolStore;\n}\n\n/**\n * Release leases whose owning process has exited and stop any proxy process\n * they reference. Returns the lease ids that were reaped.\n *\n * Best-effort: individual stop/release failures are swallowed so one dead\n * lease cannot block reaping of the rest.\n */\nexport async function reapStaleLeases(deps: ProxyLifecycleDeps): Promise<string[]> {\n  const reaped: string[] = [];\n  const leases = deps.leases.list();\n\n  for (const lease of leases) {\n    const ownerAlive =\n      typeof lease.ownerPid === 'number' && lease.ownerPid > 0\n        ? isProcessRunning(lease.ownerPid)\n        : false;\n    // v0.8.0 accidentally recorded the proxy child as its own owner. Detect\n    // and reap that legacy shape; a child cannot supervise its own lifecycle.\n    let legacySelfOwned = false;\n    if (ownerAlive) {\n      try {\n        const status = lease.account\n          ? await deps.proxy.proxyStatus(lease.provider, lease.account)\n          : await deps.proxy.poolProxyStatus(lease.provider);\n        legacySelfOwned = status.pid === lease.ownerPid;\n      } catch {\n        // Unknown/live owner is safer to preserve.\n      }\n    }\n    if (ownerAlive && !legacySelfOwned) {\n      continue;\n    }\n\n    // Pool leases have no concrete account; stop the pool process instead.\n    if (lease.account) {\n      try {\n        await deps.proxy.stopProxy(lease.provider, lease.account);\n      } catch {\n        // proxy already stopped or account missing — proceed to release lease\n      }\n    } else {\n      try {\n        await deps.proxy.stopPoolProxy(lease.provider);\n      } catch {\n        // ignore\n      }\n    }\n\n    if (deps.leases.release(lease.leaseId)) {\n      reaped.push(lease.leaseId);\n    }\n  }\n\n  return reaped;\n}\n"],"mappings":";;;;;;;;;AA4BA,eAAsB,gBAAgB,MAA6C;CACjF,MAAM,SAAmB,CAAC;CAC1B,MAAM,SAAS,KAAK,OAAO,KAAK;CAEhC,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,aACJ,OAAO,MAAM,aAAa,YAAY,MAAM,WAAW,IACnD,iBAAiB,MAAM,QAAQ,IAC/B;EAGN,IAAI,kBAAkB;EACtB,IAAI,YACF,IAAI;GAIF,mBAHe,MAAM,UACjB,MAAM,KAAK,MAAM,YAAY,MAAM,UAAU,MAAM,OAAO,IAC1D,MAAM,KAAK,MAAM,gBAAgB,MAAM,QAAQ,EAAA,CAC1B,QAAQ,MAAM;EACzC,QAAQ,CAER;EAEF,IAAI,cAAc,CAAC,iBACjB;EAIF,IAAI,MAAM,SACR,IAAI;GACF,MAAM,KAAK,MAAM,UAAU,MAAM,UAAU,MAAM,OAAO;EAC1D,QAAQ,CAER;OAEA,IAAI;GACF,MAAM,KAAK,MAAM,cAAc,MAAM,QAAQ;EAC/C,QAAQ,CAER;EAGF,IAAI,KAAK,OAAO,QAAQ,MAAM,OAAO,GACnC,OAAO,KAAK,MAAM,OAAO;CAE7B;CAEA,OAAO;AACT"}

package/dist/core/proxy-ports.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Listen-port allocation for account-backed and pool proxies.
+ *
+ * Extracted from `ProxyService`, which had grown to own lifecycle, pools, leases
+ * and allocation at once. Allocation is a cohesive unit with a narrow
+ * dependency surface — it needs only to enumerate proxy-capable providers and
+ * their saved port preferences — so it tests and evolves independently.
+ *
+ * Two deliberately different behaviours:
+ *
+ * - An **explicitly requested** port is validated and rejected if taken. Moving
+ *   a port the user typed would turn `-p` from an instruction into a suggestion.
+ * - An **unspecified** port falls back to the provider default (or the saved
+ *   preference) and walks upward past anything already reserved or bound.
+ */
+import type { Provider } from '../types.js';
+import type { ProviderRegistry } from './registry.js';
+import type { AccountStore } from './store.js';
+export declare function validatePort(port: number): number;
+export interface ResolvePortRequest {
+    /** Port the caller asked for explicitly. Validated, never relocated. */
+    requested?: number;
+    /** Port already saved on this account's proxy config. */
+    existing?: number;
+    providerId: string;
+    accountName: string;
+}
+/** Enumerates reserved ports and picks free ones. */
+export declare class ProxyPortAllocator {
+    private readonly registry;
+    private readonly store;
+    constructor(registry: ProviderRegistry, store: AccountStore);
+    /**
+     * Resolve the port a proxy should bind. Honors an explicit request (failing if
+     * unavailable) and otherwise finds the nearest free port at or above the
+     * provider's preference.
+     */
+    resolve(provider: Provider, opts: ResolvePortRequest): Promise<number>;
+    /** Ports already reserved by other anypick proxy configs. */
+    collectUsedPorts(excludeProvider?: string, excludeAccount?: string): Promise<Set<number>>;
+    /** First free port at or above `base`, skipping anypick-reserved ports. */
+    allocateFrom(base: number, providerId: string, accountName: string): Promise<number>;
+    /**
+     * Throw unless `port` is free, both in anypick's own config and on the machine.
+     * Names the conflicting account when anypick itself already reserved the port,
+     * because "used by codex/work" is actionable where a bare port number is not.
+     */
+    assertAvailable(port: number, providerId: string, accountName: string): Promise<void>;
+}
+//# sourceMappingURL=proxy-ports.d.ts.map

package/dist/core/proxy-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-ports.d.ts","sourceRoot":"","sources":["../../src/core/proxy-ports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK5C,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASjD;AAED,MAAM,WAAW,kBAAkB;IACjC,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qDAAqD;AACrD,qBAAa,kBAAkB;IAE3B,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFxB,YACmB,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,YAAY,EAClC;IAEJ;;;;OAIG;IACG,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAmB3E;IAED,6DAA6D;IACvD,gBAAgB,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAkB9F;IAED,2EAA2E;IACrE,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAezF;IAED;;;;OAIG;IACG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B1F;CACF"}

package/dist/core/proxy-ports.js

@@ -0,0 +1,86 @@
+import { AnyPickError } from "../utils/errors.js";
+import { isListenPortFree } from "../utils/process/health.js";
+import { providerCanProxy } from "./capabilities.js";
+//#region src/core/proxy-ports.ts
+/**
+* Listen-port allocation for account-backed and pool proxies.
+*
+* Extracted from `ProxyService`, which had grown to own lifecycle, pools, leases
+* and allocation at once. Allocation is a cohesive unit with a narrow
+* dependency surface — it needs only to enumerate proxy-capable providers and
+* their saved port preferences — so it tests and evolves independently.
+*
+* Two deliberately different behaviours:
+*
+* - An **explicitly requested** port is validated and rejected if taken. Moving
+*   a port the user typed would turn `-p` from an instruction into a suggestion.
+* - An **unspecified** port falls back to the provider default (or the saved
+*   preference) and walks upward past anything already reserved or bound.
+*/
+/** Highest valid TCP port. 0 means "let the OS pick" (tests / advanced use). */
+var MAX_PORT = 65535;
+function validatePort(port) {
+	if (!Number.isInteger(port) || port < 0 || port > MAX_PORT) throw new AnyPickError(`Invalid port ${port}. Use an integer 0–${MAX_PORT} (0 = ephemeral).`, "PROXY_PORT_INVALID");
+	return port;
+}
+/** Enumerates reserved ports and picks free ones. */
+var ProxyPortAllocator = class {
+	registry;
+	store;
+	constructor(registry, store) {
+		this.registry = registry;
+		this.store = store;
+	}
+	/**
+	* Resolve the port a proxy should bind. Honors an explicit request (failing if
+	* unavailable) and otherwise finds the nearest free port at or above the
+	* provider's preference.
+	*/
+	async resolve(provider, opts) {
+		if (opts.requested != null) {
+			const port = validatePort(opts.requested);
+			await this.assertAvailable(port, opts.providerId, opts.accountName);
+			return port;
+		}
+		const preferred = opts.existing != null && Number.isInteger(opts.existing) ? validatePort(opts.existing) : provider.defaultProxyPort ?? 8080;
+		if (preferred === 0 || await isListenPortFree(preferred, "127.0.0.1") && !(await this.collectUsedPorts(opts.providerId, opts.accountName)).has(preferred)) return preferred;
+		return this.allocateFrom(preferred + 1, opts.providerId, opts.accountName);
+	}
+	/** Ports already reserved by other anypick proxy configs. */
+	async collectUsedPorts(excludeProvider, excludeAccount) {
+		const used = /* @__PURE__ */ new Set();
+		for (const p of this.registry.list().filter((x) => providerCanProxy(x))) for (const a of await this.store.listAccounts(p.id)) {
+			if (excludeProvider && excludeAccount && p.id === excludeProvider && a.meta.name === excludeAccount) continue;
+			if (a.proxy.port != null && Number.isInteger(a.proxy.port)) used.add(a.proxy.port);
+		}
+		return used;
+	}
+	/** First free port at or above `base`, skipping anypick-reserved ports. */
+	async allocateFrom(base, providerId, accountName) {
+		const used = await this.collectUsedPorts(providerId, accountName);
+		const start = validatePort(base);
+		for (let port = start; port <= MAX_PORT; port++) {
+			if (used.has(port)) continue;
+			if (await isListenPortFree(port, "127.0.0.1")) return port;
+		}
+		throw new AnyPickError(`No free proxy port found starting from ${start}.`, "PROXY_PORT_EXHAUSTED");
+	}
+	/**
+	* Throw unless `port` is free, both in anypick's own config and on the machine.
+	* Names the conflicting account when anypick itself already reserved the port,
+	* because "used by codex/work" is actionable where a bare port number is not.
+	*/
+	async assertAvailable(port, providerId, accountName) {
+		if (port === 0) return;
+		if ((await this.collectUsedPorts(providerId, accountName)).has(port)) {
+			const owners = [];
+			for (const p of this.registry.list().filter((x) => providerCanProxy(x))) for (const a of await this.store.listAccounts(p.id)) if (a.proxy.port === port && !(p.id === providerId && a.meta.name === accountName)) owners.push(`${p.id}/${a.meta.name}`);
+			throw new AnyPickError(`Port ${port} is already used by ${owners.join(", ") || "another account"}. Pick another with -p.`, "PROXY_PORT_IN_USE");
+		}
+		if (!await isListenPortFree(port, "127.0.0.1")) throw new AnyPickError(`Port ${port} is already in use on this machine. Pick another with -p, or stop the process holding it.`, "PROXY_PORT_IN_USE");
+	}
+};
+//#endregion
+export { ProxyPortAllocator, validatePort };
+
+//# sourceMappingURL=proxy-ports.js.map

package/dist/core/proxy-ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-ports.js","names":[],"sources":["../../src/core/proxy-ports.ts"],"sourcesContent":["/**\n * Listen-port allocation for account-backed and pool proxies.\n *\n * Extracted from `ProxyService`, which had grown to own lifecycle, pools, leases\n * and allocation at once. Allocation is a cohesive unit with a narrow\n * dependency surface — it needs only to enumerate proxy-capable providers and\n * their saved port preferences — so it tests and evolves independently.\n *\n * Two deliberately different behaviours:\n *\n * - An **explicitly requested** port is validated and rejected if taken. Moving\n *   a port the user typed would turn `-p` from an instruction into a suggestion.\n * - An **unspecified** port falls back to the provider default (or the saved\n *   preference) and walks upward past anything already reserved or bound.\n */\n\nimport { AnyPickError } from '../utils/errors';\nimport { isListenPortFree } from '../utils/process';\nimport { providerCanProxy } from './capabilities';\nimport type { Provider } from '../types';\nimport type { ProviderRegistry } from './registry';\nimport type { AccountStore } from './store';\n\n/** Highest valid TCP port. 0 means \"let the OS pick\" (tests / advanced use). */\nconst MAX_PORT = 65535;\n\nexport function validatePort(port: number): number {\n  // 0 = OS ephemeral (tests / advanced); 1–65535 = explicit bind\n  if (!Number.isInteger(port) || port < 0 || port > MAX_PORT) {\n    throw new AnyPickError(\n      `Invalid port ${port}. Use an integer 0–${MAX_PORT} (0 = ephemeral).`,\n      'PROXY_PORT_INVALID',\n    );\n  }\n  return port;\n}\n\nexport interface ResolvePortRequest {\n  /** Port the caller asked for explicitly. Validated, never relocated. */\n  requested?: number;\n  /** Port already saved on this account's proxy config. */\n  existing?: number;\n  providerId: string;\n  accountName: string;\n}\n\n/** Enumerates reserved ports and picks free ones. */\nexport class ProxyPortAllocator {\n  constructor(\n    private readonly registry: ProviderRegistry,\n    private readonly store: AccountStore,\n  ) {}\n\n  /**\n   * Resolve the port a proxy should bind. Honors an explicit request (failing if\n   * unavailable) and otherwise finds the nearest free port at or above the\n   * provider's preference.\n   */\n  async resolve(provider: Provider, opts: ResolvePortRequest): Promise<number> {\n    if (opts.requested != null) {\n      const port = validatePort(opts.requested);\n      await this.assertAvailable(port, opts.providerId, opts.accountName);\n      return port;\n    }\n    const preferred =\n      opts.existing != null && Number.isInteger(opts.existing)\n        ? validatePort(opts.existing)\n        : (provider.defaultProxyPort ?? 8080);\n    // Prefer saved/default if free; otherwise walk upward\n    if (\n      preferred === 0 ||\n      ((await isListenPortFree(preferred, '127.0.0.1')) &&\n        !(await this.collectUsedPorts(opts.providerId, opts.accountName)).has(preferred))\n    ) {\n      return preferred;\n    }\n    return this.allocateFrom(preferred + 1, opts.providerId, opts.accountName);\n  }\n\n  /** Ports already reserved by other anypick proxy configs. */\n  async collectUsedPorts(excludeProvider?: string, excludeAccount?: string): Promise<Set<number>> {\n    const used = new Set<number>();\n    for (const p of this.registry.list().filter((x) => providerCanProxy(x))) {\n      for (const a of await this.store.listAccounts(p.id)) {\n        if (\n          excludeProvider &&\n          excludeAccount &&\n          p.id === excludeProvider &&\n          a.meta.name === excludeAccount\n        ) {\n          continue;\n        }\n        if (a.proxy.port != null && Number.isInteger(a.proxy.port)) {\n          used.add(a.proxy.port);\n        }\n      }\n    }\n    return used;\n  }\n\n  /** First free port at or above `base`, skipping anypick-reserved ports. */\n  async allocateFrom(base: number, providerId: string, accountName: string): Promise<number> {\n    const used = await this.collectUsedPorts(providerId, accountName);\n    const start = validatePort(base);\n    for (let port = start; port <= MAX_PORT; port++) {\n      if (used.has(port)) {\n        continue;\n      }\n      if (await isListenPortFree(port, '127.0.0.1')) {\n        return port;\n      }\n    }\n    throw new AnyPickError(\n      `No free proxy port found starting from ${start}.`,\n      'PROXY_PORT_EXHAUSTED',\n    );\n  }\n\n  /**\n   * Throw unless `port` is free, both in anypick's own config and on the machine.\n   * Names the conflicting account when anypick itself already reserved the port,\n   * because \"used by codex/work\" is actionable where a bare port number is not.\n   */\n  async assertAvailable(port: number, providerId: string, accountName: string): Promise<void> {\n    // Ephemeral port 0 is never \"in use\" in config terms\n    if (port === 0) {\n      return;\n    }\n    const used = await this.collectUsedPorts(providerId, accountName);\n    if (used.has(port)) {\n      const owners: string[] = [];\n      for (const p of this.registry.list().filter((x) => providerCanProxy(x))) {\n        for (const a of await this.store.listAccounts(p.id)) {\n          if (a.proxy.port === port && !(p.id === providerId && a.meta.name === accountName)) {\n            owners.push(`${p.id}/${a.meta.name}`);\n          }\n        }\n      }\n      throw new AnyPickError(\n        `Port ${port} is already used by ${\n          owners.join(', ') || 'another account'\n        }. Pick another with -p.`,\n        'PROXY_PORT_IN_USE',\n      );\n    }\n    // Also refuse ports held by foreign OS processes (other apps / zombie proxies)\n    if (!(await isListenPortFree(port, '127.0.0.1'))) {\n      throw new AnyPickError(\n        `Port ${port} is already in use on this machine. Pick another with -p, or stop the process holding it.`,\n        'PROXY_PORT_IN_USE',\n      );\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,WAAW;AAEjB,SAAgB,aAAa,MAAsB;CAEjD,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,UAChD,MAAM,IAAI,aACR,gBAAgB,KAAK,qBAAqB,SAAS,oBACnD,oBACF;CAEF,OAAO;AACT;;AAYA,IAAa,qBAAb,MAAgC;CAEX;CACA;CAFnB,YACE,UACA,OACA;EAFiB,KAAA,WAAA;EACA,KAAA,QAAA;CAChB;;;;;;CAOH,MAAM,QAAQ,UAAoB,MAA2C;EAC3E,IAAI,KAAK,aAAa,MAAM;GAC1B,MAAM,OAAO,aAAa,KAAK,SAAS;GACxC,MAAM,KAAK,gBAAgB,MAAM,KAAK,YAAY,KAAK,WAAW;GAClE,OAAO;EACT;EACA,MAAM,YACJ,KAAK,YAAY,QAAQ,OAAO,UAAU,KAAK,QAAQ,IACnD,aAAa,KAAK,QAAQ,IACzB,SAAS,oBAAoB;EAEpC,IACE,cAAc,KACZ,MAAM,iBAAiB,WAAW,WAAW,KAC7C,EAAE,MAAM,KAAK,iBAAiB,KAAK,YAAY,KAAK,WAAW,EAAA,CAAG,IAAI,SAAS,GAEjF,OAAO;EAET,OAAO,KAAK,aAAa,YAAY,GAAG,KAAK,YAAY,KAAK,WAAW;CAC3E;;CAGA,MAAM,iBAAiB,iBAA0B,gBAA+C;EAC9F,MAAM,uBAAO,IAAI,IAAY;EAC7B,KAAK,MAAM,KAAK,KAAK,SAAS,KAAK,CAAC,CAAC,QAAQ,MAAM,iBAAiB,CAAC,CAAC,GACpE,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,aAAa,EAAE,EAAE,GAAG;GACnD,IACE,mBACA,kBACA,EAAE,OAAO,mBACT,EAAE,KAAK,SAAS,gBAEhB;GAEF,IAAI,EAAE,MAAM,QAAQ,QAAQ,OAAO,UAAU,EAAE,MAAM,IAAI,GACvD,KAAK,IAAI,EAAE,MAAM,IAAI;EAEzB;EAEF,OAAO;CACT;;CAGA,MAAM,aAAa,MAAc,YAAoB,aAAsC;EACzF,MAAM,OAAO,MAAM,KAAK,iBAAiB,YAAY,WAAW;EAChE,MAAM,QAAQ,aAAa,IAAI;EAC/B,KAAK,IAAI,OAAO,OAAO,QAAQ,UAAU,QAAQ;GAC/C,IAAI,KAAK,IAAI,IAAI,GACf;GAEF,IAAI,MAAM,iBAAiB,MAAM,WAAW,GAC1C,OAAO;EAEX;EACA,MAAM,IAAI,aACR,0CAA0C,MAAM,IAChD,sBACF;CACF;;;;;;CAOA,MAAM,gBAAgB,MAAc,YAAoB,aAAoC;EAE1F,IAAI,SAAS,GACX;EAGF,KAAI,MADe,KAAK,iBAAiB,YAAY,WAAW,EAAA,CACvD,IAAI,IAAI,GAAG;GAClB,MAAM,SAAmB,CAAC;GAC1B,KAAK,MAAM,KAAK,KAAK,SAAS,KAAK,CAAC,CAAC,QAAQ,MAAM,iBAAiB,CAAC,CAAC,GACpE,KAAK,MAAM,KAAK,MAAM,KAAK,MAAM,aAAa,EAAE,EAAE,GAChD,IAAI,EAAE,MAAM,SAAS,QAAQ,EAAE,EAAE,OAAO,cAAc,EAAE,KAAK,SAAS,cACpE,OAAO,KAAK,GAAG,EAAE,GAAG,GAAG,EAAE,KAAK,MAAM;GAI1C,MAAM,IAAI,aACR,QAAQ,KAAK,sBACX,OAAO,KAAK,IAAI,KAAK,kBACtB,0BACD,mBACF;EACF;EAEA,IAAI,CAAE,MAAM,iBAAiB,MAAM,WAAW,GAC5C,MAAM,IAAI,aACR,QAAQ,KAAK,4FACb,mBACF;CAEJ;AACF"}

package/dist/core/proxy-service.d.ts

@@ -0,0 +1,184 @@
+/**
+ * Proxy lifecycle ownership (start/stop/status/logs) and multi-account pool
+ * management for account-backed proxies.
+ *
+ * This was extracted from AccountService so that proxy concerns live in their
+ * own collaborator: a Provider owns *where* live auth lives and how to
+ * snapshot/restore it; this service owns *how a running proxy for that account
+ * is orchestrated*. Client-config realignment (writing BASE_URL into bound
+ * clients) is injected as RealignProxyClientsDeps rather than imported, so the
+ * proxy service stays below the binding/runtime subsystems.
+ *
+ * Listen-port selection lives in `ProxyPortAllocator` (proxy-ports.ts), and the
+ * lease table is a constructor dependency — both were previously inlined here,
+ * which made this class impossible to construct in a test without also standing
+ * up the whole app graph.
+ */
+import type { AccountProxyConfig, Provider, ProviderProxyPool, ProxyHandle, ProxyStatus } from '../types.js';
+import type { ProviderRegistry } from './registry.js';
+import type { AccountStore } from './store.js';
+import type { LeaseStore } from './lease-store.js';
+import { PoolStore } from './pool-store.js';
+import { type RealignProxyClientsDeps } from './realign-proxy-clients.js';
+import type { QuotaGuardPolicy } from '../types.js';
+import { type QuotaGuardEvent } from '../providers/quota-guard.js';
+/**
+ * Owns proxy lifecycle and multi-account pools.
+ * Constructed by the app composition root and exposed as `app.proxy`.
+ */
+export declare class ProxyService {
+    private readonly store;
+    private readonly registry;
+    private readonly quotaGuardPolicy;
+    readonly pools: PoolStore;
+    /**
+     * Optional dependency used when a proxy starts: realign bound clients'
+     * BASE_URLs to the new endpoint. Injected at construction (composition time)
+     * rather than wired afterwards, so the service has no upward dependency on
+     * the app graph.
+     */
+    private readonly realign?;
+    /**
+     * Lease table. Every proxy started through this service records a lease keyed
+     * to the owning process, so `reapStaleLeases` can stop orphaned proxies on the
+     * next startup — not just proxies started by the activation pipeline.
+     *
+     * Optional so a caller can build a proxy service without lease bookkeeping,
+     * but supplied at construction: it used to be wired by `setLeaseStore()` after
+     * the fact, which meant the service was observably half-built between the two
+     * calls and could not be constructed in a test without replaying that dance.
+     */
+    private readonly leases?;
+    /** Listen-port allocation (see proxy-ports.ts). */
+    private readonly ports;
+    constructor(store: AccountStore, registry: ProviderRegistry, pools?: PoolStore, realign?: RealignProxyClientsDeps, leases?: LeaseStore, quotaGuardPolicy?: () => Promise<QuotaGuardPolicy>);
+    /**
+     * Optional re-publisher for the live Codex config block, wired in app.ts so this
+     * service does not depend on Hub/Codex services it was not constructed with.
+     */
+    private codexLiveConfigSync?;
+    setCodexLiveConfigSync(fn: () => Promise<void>): void;
+    private syncCodexLiveConfig;
+    /**
+     * Record a lease for a freshly started proxy owned by this process, replacing
+     * any prior lease for the same provider/account. No-op when no lease store is
+     * wired. Best-effort: lease bookkeeping must never fail a proxy start.
+     */
+    private recordLease;
+    /** Release the lease for a stopped proxy. No-op without a lease store. */
+    private releaseLease;
+    provider(id: string): Provider;
+    listProviders(): Provider[];
+    getPool(providerId: string): Promise<ProviderProxyPool>;
+    /** Opt-in multi-account pool for a provider. */
+    enablePoolMulti(providerId: string, opts?: {
+        port?: number;
+        host?: string;
+        start?: boolean;
+    }): Promise<{
+        pool: ProviderProxyPool;
+        started?: ProxyHandle;
+    }>;
+    /** Back to per-account proxies (default). Stops pool process if running. */
+    disablePoolMulti(providerId: string): Promise<ProviderProxyPool>;
+    setPoolMemberEnabled(providerId: string, account: string, enabled: boolean): Promise<ProviderProxyPool>;
+    startPoolProxy(providerId: string): Promise<ProxyHandle>;
+    /** Restart only pools that are currently serving, after changing a pool-wide policy. */
+    restartRunningPools(): Promise<void>;
+    /** Secret-free audit events written by an enabled compatibility proxy pool. */
+    quotaGuardEvents(): Promise<QuotaGuardEvent[]>;
+    stopPoolProxy(providerId: string): Promise<void>;
+    poolProxyStatus(providerId: string): Promise<ProxyStatus>;
+    requireProxyProvider(providerId: string): Provider;
+    enableProxy(providerId: string, name: string, opts?: {
+        port?: number;
+        host?: string;
+        start?: boolean;
+        /** Provider options merge (e.g. opencode plan: zen|go). */
+        options?: Record<string, unknown>;
+    }): Promise<{
+        config: AccountProxyConfig;
+        started?: ProxyHandle;
+    }>;
+    /** Restore a previously captured config without starting a process. Scoped
+     * ephemeral runs use this to avoid leaving an account auto-proxy enabled. */
+    restoreProxyConfig(providerId: string, name: string, config: AccountProxyConfig): Promise<void>;
+    /**
+     * Update proxy listen port/host without toggling enabled.
+     * Restarts the proxy if it is currently running.
+     */
+    configureProxy(providerId: string, name: string, opts?: {
+        port?: number;
+        host?: string;
+        restart?: boolean;
+        /** Provider options merge (e.g. opencode plan: zen|go). */
+        options?: Record<string, unknown>;
+    }): Promise<{
+        config: AccountProxyConfig;
+        restarted?: ProxyHandle;
+        wasRunning: boolean;
+    }>;
+    disableProxy(providerId: string, name: string): Promise<AccountProxyConfig>;
+    startProxy(providerId: string, name?: string, opts?: {
+        port?: number;
+        host?: string;
+    }): Promise<ProxyHandle>;
+    stopProxy(providerId: string, name?: string): Promise<void>;
+    proxyStatus(providerId: string, name?: string): Promise<ProxyStatus>;
+    proxyLogs(providerId: string, name?: string, lines?: number): Promise<string>;
+    /**
+     * Stream proxy logs live (tail -f style). Calls `onLine` for each new line
+     * and resolves when `signal` aborts. Returns immediately if no log file yet.
+     */
+    proxyLogsFollow(providerId: string, name: string | undefined, onLine: (line: string) => void, opts?: {
+        lines?: number;
+        signal?: AbortSignal;
+    }): Promise<void>;
+    /**
+     * List proxy-capable accounts (for `anypick proxy` / status).
+     * If provider omitted → all proxy providers. If name omitted → active or all enabled.
+     */
+    listProxyRows(providerId?: string): Promise<Array<{
+        provider: string;
+        name: string;
+        active: boolean;
+        status: ProxyStatus;
+    }>>;
+    /**
+     * Start proxies. No args → active account on each proxy provider (if enabled).
+     */
+    startProxies(providerId?: string, name?: string): Promise<Array<{
+        provider: string;
+        name: string;
+        ok: boolean;
+        endpoint?: string;
+        realignedClients?: string[];
+        error?: string;
+    }>>;
+    stopProxies(providerId?: string, name?: string): Promise<Array<{
+        provider: string;
+        name: string;
+        ok: boolean;
+        error?: string;
+    }>>;
+    /** Transfer all currently running proxy leases to a long-lived supervisor. */
+    adoptRunningProxies(ownerPid?: number): Promise<number>;
+    /** Stop a proxy during account lifecycle ops (switch/stash/delete). */
+    stopProxyForAccount(provider: Provider, accountName: string): Promise<void>;
+    /** Start a proxy as part of account switch (when enabled). */
+    startProxyForAccount(provider: Provider, accountName: string, config: AccountProxyConfig): Promise<{
+        endpoint?: string;
+        running: boolean;
+        error?: string;
+    }>;
+    private resolveProxyTargets;
+    private requireActiveName;
+    private buildProxyContext;
+    private startProxyInternal;
+    private startProxyInternalUnlocked;
+    /** Rewrite bound clients' BASE_URL to the live proxy endpoint. */
+    private realignBoundClients;
+    private stopProxyInternal;
+    private stopProxyInternalUnlocked;
+}
+//# sourceMappingURL=proxy-service.d.ts.map

package/dist/core/proxy-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-service.d.ts","sourceRoot":"","sources":["../../src/core/proxy-service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,QAAQ,EACR,iBAAiB,EAEjB,WAAW,EACX,WAAW,EACZ,MAAM,UAAU,CAAC;AAWlB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAkB,MAAM,cAAc,CAAC;AACzD,OAAO,EAEL,KAAK,uBAAuB,EAC7B,MAAM,yBAAyB,CAAC;AAOjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAuB,KAAK,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAwBrF;;;GAGG;AACH,qBAAa,YAAY;IAwBrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAIzB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IA5BnC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAA0B;IACnD;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAa;IACrC,mDAAmD;IACnD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqB;IAE3C,YACmB,KAAK,EAAE,YAAY,EACnB,QAAQ,EAAE,gBAAgB,EAC3C,KAAK,CAAC,EAAE,SAAS,EACjB,OAAO,CAAC,EAAE,uBAAuB,EACjC,MAAM,CAAC,EAAE,UAAU,EACF,gBAAgB,GAAE,MAAM,OAAO,CAAC,gBAAgB,CAG/D,EAMH;IAED;;;OAGG;IACH,OAAO,CAAC,mBAAmB,CAAC,CAAsB;IAElD,sBAAsB,CAAC,EAAE,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAEpD;YAEa,mBAAmB;IAQjC;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAmCnB,0EAA0E;IAC1E,OAAO,CAAC,YAAY;IAWpB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,CAE7B;IAED,aAAa,IAAI,QAAQ,EAAE,CAE1B;IAIK,OAAO,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAO5D;IAED,gDAAgD;IAC1C,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAO,GAC3D,OAAO,CAAC;QAAE,IAAI,EAAE,iBAAiB,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC,CAkB7D;IAED,4EAA4E;IACtE,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAQrE;IAEK,oBAAoB,CACxB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAa5B;IAEK,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAsG7D;IAED,wFAAwF;IAClF,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAYzC;IAED,+EAA+E;IACzE,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAsBnD;IAEK,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBrD;IAEK,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CA+B9D;IAID,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,QAAQ,CASjD;IAEK,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QACJ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,2DAA2D;QAC3D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC9B,GACL,OAAO,CAAC;QAAE,MAAM,EAAE,kBAAkB,CAAC;QAAC,OAAO,CAAC,EAAE,WAAW,CAAA;KAAE,CAAC,CA+BhE;IAED;iFAC6E;IACvE,kBAAkB,CACtB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,IAAI,CAAC,CAIf;IAED;;;OAGG;IACG,cAAc,CAClB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;QACJ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,2DAA2D;QAC3D,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAC9B,GACL,OAAO,CAAC;QACT,MAAM,EAAE,kBAAkB,CAAC;QAC3B,SAAS,CAAC,EAAE,WAAW,CAAC;QACxB,UAAU,EAAE,OAAO,CAAC;KACrB,CAAC,CA8CD;IAEK,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAYhF;IAEK,UAAU,CACd,UAAU,EAAE,MAAM,EAClB,IAAI,CAAC,EAAE,MAAM,EACb,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAO,GAC1C,OAAO,CAAC,WAAW,CAAC,CAiDtB;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhE;IAEK,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAwDzE;IAEK,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAoB9E;IAED;;;OAGG;IACG,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAClD,OAAO,CAAC,IAAI,CAAC,CA8Bf;IAED;;;OAGG;IACG,aAAa,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAC/C,KAAK,CAAC;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,OAAO,CAAC;QAChB,MAAM,EAAE,WAAW,CAAC;KACrB,CAAC,CACH,CA6BA;IAED;;OAEG;IACG,YAAY,CAChB,UAAU,CAAC,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CACR,KAAK,CAAC;QACJ,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,EAAE,EAAE,OAAO,CAAC;QACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC,CACH,CAiCA;IAEK,WAAW,CACf,UAAU,CAAC,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAqBjF;IAED,8EAA8E;IACxE,mBAAmB,CAAC,QAAQ,SAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CA2CjE;IAID,uEAAuE;IACjE,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhF;IAED,8DAA8D;IACxD,oBAAoB,CACxB,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAiBlE;YAEa,mBAAmB;YA4DnB,iBAAiB;IAW/B,OAAO,CAAC,iBAAiB;YAgBX,kBAAkB;YAUlB,0BAA0B;IAgKxC,kEAAkE;YACpD,mBAAmB;YAsBnB,iBAAiB;YAMjB,yBAAyB;CAqCxC"}