anypick 1.0.0

package/dist/providers/proxy-shared.js

@@ -0,0 +1,128 @@
+import { timingSafeEqual } from "node:crypto";
+//#region src/providers/proxy-shared.ts
+/**
+* Shared plumbing for the built-in compatibility proxies (grok / gemini /
+* opencode). These helpers are intentionally protocol-agnostic: each proxy
+* server still owns its *request-translation* and *header-forwarding* rules
+* (they differ per upstream protocol), but the low-level HTTP mechanics —
+* body buffering and the hop-by-hop header set — are identical and live here so
+* they are not copied across three servers.
+*/
+/** Headers that must never be forwarded to/from an upstream (RFC 7230 §6.1). */
+var HOP_BY_HOP = /* @__PURE__ */ new Set([
+	"connection",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailers",
+	"transfer-encoding",
+	"upgrade",
+	"host",
+	"content-length"
+]);
+/**
+* Codex model-provider `base_url` is a prefix and calls `/responses`, while
+* OpenAI SDK base URLs commonly call `/v1/responses`. Accept both spellings at
+* the local boundary and keep one canonical `/v1/*` path internally.
+*/
+function normalizeLocalApiUrl(url) {
+	const queryIndex = url.indexOf("?");
+	const path = queryIndex >= 0 ? url.slice(0, queryIndex) : url;
+	const query = queryIndex >= 0 ? url.slice(queryIndex) : "";
+	return path === "/responses" || path.startsWith("/responses/") || path === "/chat/completions" || path === "/models" || path.startsWith("/models/") || path === "/messages" || path.startsWith("/messages/") ? `/v1${path}${query}` : url;
+}
+/**
+* Buffer a request body into a single Buffer. Enforces a 32 MiB cap so a
+* malicious or runaway client cannot exhaust memory in a long-lived proxy.
+*/
+function readBody(req, maxBytes = 32 * 1024 * 1024) {
+	return new Promise((resolve, reject) => {
+		const chunks = [];
+		let size = 0;
+		req.on("data", (c) => {
+			size += c.length;
+			if (size > maxBytes) {
+				reject(/* @__PURE__ */ new Error("Request body too large"));
+				req.destroy();
+				return;
+			}
+			chunks.push(Buffer.isBuffer(c) ? c : Buffer.from(c));
+		});
+		req.on("end", () => resolve(Buffer.concat(chunks)));
+		req.on("error", reject);
+	});
+}
+/**
+* Install one idempotent graceful-shutdown path for a detached HTTP proxy.
+* New requests stop immediately, idle keep-alive sockets are closed, and only
+* genuinely stuck connections are destroyed after the grace period.
+*/
+function installProxyShutdown(server, graceMs = 2500) {
+	let shuttingDown = false;
+	const shutdown = () => {
+		if (shuttingDown) return;
+		shuttingDown = true;
+		server.closeIdleConnections?.();
+		server.close(() => {
+			process.exitCode = 0;
+		});
+		setTimeout(() => {
+			server.closeAllConnections?.();
+			process.exit(0);
+		}, graceMs).unref();
+	};
+	process.once("SIGINT", shutdown);
+	process.once("SIGTERM", shutdown);
+}
+/**
+* Constant-time compare of two secrets. Lengths are not equalized, but the
+* comparison short-circuits only after the shorter buffer is exhausted, so a
+* fixed expected token removes most timing signal. Rejects empty expected.
+*/
+function safeEqual(a, b) {
+	const ab = Buffer.from(a);
+	const bb = Buffer.from(b);
+	if (ab.length !== bb.length) {
+		timingSafeEqual(ab, ab);
+		return false;
+	}
+	return timingSafeEqual(ab, bb);
+}
+/**
+* Require the per-instance proxy secret on a credentialed route (PROXY-01).
+*
+* Accepts the secret via the client protocols' normal credential headers
+* (`Authorization: Bearer <token>` or `x-api-key: <token>`), normalizes it to
+* local authentication, and compares in constant time. On any mismatch the
+* response is a `401` and the caller must NOT contact upstream. When
+* `expectedToken` is empty/unset the proxy is misconfigured — fail closed.
+*
+* Returns `true` when the request is authenticated (caller may proceed).
+*/
+function requireProxyAuth(req, res, expectedToken) {
+	if (!expectedToken) {
+		res.writeHead(401, { "content-type": "application/json; charset=utf-8" });
+		res.end(JSON.stringify({ error: {
+			type: "unauthorized",
+			message: "Proxy authentication is not configured."
+		} }));
+		return false;
+	}
+	const auth = req.headers["authorization"];
+	const xApiKey = req.headers["x-api-key"];
+	const provided = (typeof auth === "string" && auth.startsWith("Bearer ") ? auth.slice(7).trim() : typeof auth === "string" ? auth.trim() : "") || (typeof xApiKey === "string" ? xApiKey.trim() : "");
+	if (!provided || !safeEqual(provided, expectedToken)) {
+		res.writeHead(401, { "content-type": "application/json; charset=utf-8" });
+		res.end(JSON.stringify({ error: {
+			type: "unauthorized",
+			message: "Missing or invalid proxy token."
+		} }));
+		return false;
+	}
+	return true;
+}
+//#endregion
+export { HOP_BY_HOP, installProxyShutdown, normalizeLocalApiUrl, readBody, requireProxyAuth };
+
+//# sourceMappingURL=proxy-shared.js.map

package/dist/providers/proxy-shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-shared.js","names":[],"sources":["../../src/providers/proxy-shared.ts"],"sourcesContent":["/**\n * Shared plumbing for the built-in compatibility proxies (grok / gemini /\n * opencode). These helpers are intentionally protocol-agnostic: each proxy\n * server still owns its *request-translation* and *header-forwarding* rules\n * (they differ per upstream protocol), but the low-level HTTP mechanics —\n * body buffering and the hop-by-hop header set — are identical and live here so\n * they are not copied across three servers.\n */\n\nimport { timingSafeEqual } from 'node:crypto';\nimport type { IncomingMessage, Server, ServerResponse } from 'node:http';\n\n/** Headers that must never be forwarded to/from an upstream (RFC 7230 §6.1). */\nexport const HOP_BY_HOP = new Set([\n  'connection',\n  'keep-alive',\n  'proxy-authenticate',\n  'proxy-authorization',\n  'te',\n  'trailers',\n  'transfer-encoding',\n  'upgrade',\n  'host',\n  'content-length',\n]);\n\n/** True when `name` is a hop-by-hop header (case-insensitive). */\nexport function isHopByHop(name: string): boolean {\n  return HOP_BY_HOP.has(name.toLowerCase());\n}\n\n/**\n * Codex model-provider `base_url` is a prefix and calls `/responses`, while\n * OpenAI SDK base URLs commonly call `/v1/responses`. Accept both spellings at\n * the local boundary and keep one canonical `/v1/*` path internally.\n */\nexport function normalizeLocalApiUrl(url: string): string {\n  const queryIndex = url.indexOf('?');\n  const path = queryIndex >= 0 ? url.slice(0, queryIndex) : url;\n  const query = queryIndex >= 0 ? url.slice(queryIndex) : '';\n  const rootApiPath =\n    path === '/responses' ||\n    path.startsWith('/responses/') ||\n    path === '/chat/completions' ||\n    path === '/models' ||\n    path.startsWith('/models/') ||\n    path === '/messages' ||\n    path.startsWith('/messages/');\n  return rootApiPath ? `/v1${path}${query}` : url;\n}\n\n/**\n * Buffer a request body into a single Buffer. Enforces a 32 MiB cap so a\n * malicious or runaway client cannot exhaust memory in a long-lived proxy.\n */\nexport function readBody(req: IncomingMessage, maxBytes = 32 * 1024 * 1024): Promise<Buffer> {\n  return new Promise((resolve, reject) => {\n    const chunks: Buffer[] = [];\n    let size = 0;\n    req.on('data', (c: Buffer) => {\n      size += c.length;\n      if (size > maxBytes) {\n        reject(new Error('Request body too large'));\n        req.destroy();\n        return;\n      }\n      chunks.push(Buffer.isBuffer(c) ? c : Buffer.from(c));\n    });\n    req.on('end', () => resolve(Buffer.concat(chunks)));\n    req.on('error', reject);\n  });\n}\n\n/**\n * Install one idempotent graceful-shutdown path for a detached HTTP proxy.\n * New requests stop immediately, idle keep-alive sockets are closed, and only\n * genuinely stuck connections are destroyed after the grace period.\n */\nexport function installProxyShutdown(server: Server, graceMs = 2500): void {\n  let shuttingDown = false;\n  const shutdown = () => {\n    if (shuttingDown) {\n      return;\n    }\n    shuttingDown = true;\n    server.closeIdleConnections?.();\n    server.close(() => {\n      process.exitCode = 0;\n    });\n    const force = setTimeout(() => {\n      server.closeAllConnections?.();\n      process.exit(0);\n    }, graceMs);\n    force.unref();\n  };\n  process.once('SIGINT', shutdown);\n  process.once('SIGTERM', shutdown);\n}\n\n/**\n * Constant-time compare of two secrets. Lengths are not equalized, but the\n * comparison short-circuits only after the shorter buffer is exhausted, so a\n * fixed expected token removes most timing signal. Rejects empty expected.\n */\nfunction safeEqual(a: string, b: string): boolean {\n  const ab = Buffer.from(a);\n  const bb = Buffer.from(b);\n  if (ab.length !== bb.length) {\n    // Still run a compare so timing does not reveal length mismatch early.\n    timingSafeEqual(ab, ab);\n    return false;\n  }\n  return timingSafeEqual(ab, bb);\n}\n\n/**\n * Require the per-instance proxy secret on a credentialed route (PROXY-01).\n *\n * Accepts the secret via the client protocols' normal credential headers\n * (`Authorization: Bearer <token>` or `x-api-key: <token>`), normalizes it to\n * local authentication, and compares in constant time. On any mismatch the\n * response is a `401` and the caller must NOT contact upstream. When\n * `expectedToken` is empty/unset the proxy is misconfigured — fail closed.\n *\n * Returns `true` when the request is authenticated (caller may proceed).\n */\nexport function requireProxyAuth(\n  req: IncomingMessage,\n  res: ServerResponse,\n  expectedToken?: string,\n): boolean {\n  if (!expectedToken) {\n    res.writeHead(401, { 'content-type': 'application/json; charset=utf-8' });\n    res.end(\n      JSON.stringify({\n        error: { type: 'unauthorized', message: 'Proxy authentication is not configured.' },\n      }),\n    );\n    return false;\n  }\n  const auth = req.headers['authorization'];\n  const xApiKey = req.headers['x-api-key'];\n  const provided =\n    (typeof auth === 'string' && auth.startsWith('Bearer ')\n      ? auth.slice('Bearer '.length).trim()\n      : typeof auth === 'string'\n        ? auth.trim()\n        : '') || (typeof xApiKey === 'string' ? xApiKey.trim() : '');\n  if (!provided || !safeEqual(provided, expectedToken)) {\n    res.writeHead(401, { 'content-type': 'application/json; charset=utf-8' });\n    res.end(\n      JSON.stringify({\n        error: { type: 'unauthorized', message: 'Missing or invalid proxy token.' },\n      }),\n    );\n    return false;\n  }\n  return true;\n}\n"],"mappings":";;;;;;;;;;;AAaA,IAAa,6BAAa,IAAI,IAAI;CAChC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;;;;;;AAYD,SAAgB,qBAAqB,KAAqB;CACxD,MAAM,aAAa,IAAI,QAAQ,GAAG;CAClC,MAAM,OAAO,cAAc,IAAI,IAAI,MAAM,GAAG,UAAU,IAAI;CAC1D,MAAM,QAAQ,cAAc,IAAI,IAAI,MAAM,UAAU,IAAI;CASxD,OAPE,SAAS,gBACT,KAAK,WAAW,aAAa,KAC7B,SAAS,uBACT,SAAS,aACT,KAAK,WAAW,UAAU,KAC1B,SAAS,eACT,KAAK,WAAW,YAAY,IACT,MAAM,OAAO,UAAU;AAC9C;;;;;AAMA,SAAgB,SAAS,KAAsB,WAAW,KAAK,OAAO,MAAuB;CAC3F,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,SAAmB,CAAC;EAC1B,IAAI,OAAO;EACX,IAAI,GAAG,SAAS,MAAc;GAC5B,QAAQ,EAAE;GACV,IAAI,OAAO,UAAU;IACnB,uBAAO,IAAI,MAAM,wBAAwB,CAAC;IAC1C,IAAI,QAAQ;IACZ;GACF;GACA,OAAO,KAAK,OAAO,SAAS,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,CAAC;EACrD,CAAC;EACD,IAAI,GAAG,aAAa,QAAQ,OAAO,OAAO,MAAM,CAAC,CAAC;EAClD,IAAI,GAAG,SAAS,MAAM;CACxB,CAAC;AACH;;;;;;AAOA,SAAgB,qBAAqB,QAAgB,UAAU,MAAY;CACzE,IAAI,eAAe;CACnB,MAAM,iBAAiB;EACrB,IAAI,cACF;EAEF,eAAe;EACf,OAAO,uBAAuB;EAC9B,OAAO,YAAY;GACjB,QAAQ,WAAW;EACrB,CAAC;EAKD,iBAJ+B;GAC7B,OAAO,sBAAsB;GAC7B,QAAQ,KAAK,CAAC;EAChB,GAAG,OACH,CAAA,CAAM,MAAM;CACd;CACA,QAAQ,KAAK,UAAU,QAAQ;CAC/B,QAAQ,KAAK,WAAW,QAAQ;AAClC;;;;;;AAOA,SAAS,UAAU,GAAW,GAAoB;CAChD,MAAM,KAAK,OAAO,KAAK,CAAC;CACxB,MAAM,KAAK,OAAO,KAAK,CAAC;CACxB,IAAI,GAAG,WAAW,GAAG,QAAQ;EAE3B,gBAAgB,IAAI,EAAE;EACtB,OAAO;CACT;CACA,OAAO,gBAAgB,IAAI,EAAE;AAC/B;;;;;;;;;;;;AAaA,SAAgB,iBACd,KACA,KACA,eACS;CACT,IAAI,CAAC,eAAe;EAClB,IAAI,UAAU,KAAK,EAAE,gBAAgB,kCAAkC,CAAC;EACxE,IAAI,IACF,KAAK,UAAU,EACb,OAAO;GAAE,MAAM;GAAgB,SAAS;EAA0C,EACpF,CAAC,CACH;EACA,OAAO;CACT;CACA,MAAM,OAAO,IAAI,QAAQ;CACzB,MAAM,UAAU,IAAI,QAAQ;CAC5B,MAAM,YACH,OAAO,SAAS,YAAY,KAAK,WAAW,SAAS,IAClD,KAAK,MAAM,CAAgB,CAAC,CAAC,KAAK,IAClC,OAAO,SAAS,WACd,KAAK,KAAK,IACV,QAAQ,OAAO,YAAY,WAAW,QAAQ,KAAK,IAAI;CAC/D,IAAI,CAAC,YAAY,CAAC,UAAU,UAAU,aAAa,GAAG;EACpD,IAAI,UAAU,KAAK,EAAE,gBAAgB,kCAAkC,CAAC;EACxE,IAAI,IACF,KAAK,UAAU,EACb,OAAO;GAAE,MAAM;GAAgB,SAAS;EAAkC,EAC5E,CAAC,CACH;EACA,OAAO;CACT;CACA,OAAO;AACT"}

package/dist/providers/quota-guard.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Runtime-only policy passed to a compatibility proxy. This is intentionally
+ * not an account setting: a pool can be stopped, restarted, or deleted without
+ * changing a user's native login.
+ */
+export interface QuotaGuardOptions {
+    enabled: boolean;
+    cooldownMs: number;
+    /** Saved-account labels in the same order as the proxy credential ring. */
+    accountNames?: string[];
+    /** Owner-only, secret-free state below the pool runtime directory. */
+    statePath?: string;
+    providerId?: string;
+}
+export interface QuotaGuardEvent {
+    id: string;
+    createdAt: string;
+    providerId?: string;
+    from: string;
+    to?: string;
+    cooldownUntil: number;
+}
+export interface QuotaGuardState {
+    version: 1;
+    /** Last account that successfully took over. */
+    activeAccount?: string;
+    cooling: Record<string, number>;
+    events: QuotaGuardEvent[];
+}
+export declare function readQuotaGuardState(path: string | undefined): Promise<QuotaGuardState>;
+/**
+ * Keeps account cooldowns across proxy restarts. It only accepts saved account
+ * names supplied by the pool and never writes credential material.
+ */
+export declare class QuotaGuard {
+    private readonly options;
+    private state;
+    private write;
+    constructor(options: QuotaGuardOptions);
+    get enabled(): boolean;
+    ordered<T extends {
+        accountName?: string;
+    }>(candidates: readonly T[]): Promise<T[]>;
+    exhausted(from: string | undefined, to: string | undefined, retryAfterMs?: number): Promise<void>;
+    activate(account: string | undefined): Promise<void>;
+    private load;
+    private mutate;
+}
+//# sourceMappingURL=quota-guard.d.ts.map

package/dist/providers/quota-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-guard.d.ts","sourceRoot":"","sources":["../../src/providers/quota-guard.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAID,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC,CAW5F;AAED;;;GAGG;AACH,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHpC,OAAO,CAAC,KAAK,CAA8B;IAC3C,OAAO,CAAC,KAAK,CAAqB;IAElC,YAA6B,OAAO,EAAE,iBAAiB,EAAI;IAE3D,IAAI,OAAO,IAAI,OAAO,CAErB;IAEK,OAAO,CAAC,CAAC,SAAS;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAkBxF;IAEK,SAAS,CACb,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,EAAE,EAAE,MAAM,GAAG,SAAS,EACtB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAqBf;IAEK,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAUzD;YAEa,IAAI;YAWJ,MAAM;CASrB"}

package/dist/providers/quota-guard.js

@@ -0,0 +1,107 @@
+import { pathExists, readJsonFile, writeJsonFile } from "../utils/fs.js";
+//#region src/providers/quota-guard.ts
+var MAX_EVENTS = 100;
+async function readQuotaGuardState(path) {
+	if (!path || !await pathExists(path)) return emptyQuotaGuardState();
+	try {
+		return normalizeQuotaGuardState(await readJsonFile(path));
+	} catch {
+		return emptyQuotaGuardState();
+	}
+}
+/**
+* Keeps account cooldowns across proxy restarts. It only accepts saved account
+* names supplied by the pool and never writes credential material.
+*/
+var QuotaGuard = class {
+	options;
+	state;
+	write = Promise.resolve();
+	constructor(options) {
+		this.options = options;
+	}
+	get enabled() {
+		return this.options.enabled;
+	}
+	async ordered(candidates) {
+		if (!this.enabled || candidates.length < 2) return [...candidates];
+		const state = await this.load();
+		const now = Date.now();
+		const eligible = candidates.filter((candidate) => {
+			const account = candidate.accountName;
+			return !account || (state.cooling[account] ?? 0) <= now;
+		});
+		if (eligible.length === 0) return [];
+		if (!state.activeAccount) return eligible;
+		const active = eligible.find((candidate) => candidate.accountName === state.activeAccount);
+		return active ? [active, ...eligible.filter((candidate) => candidate !== active)] : eligible;
+	}
+	async exhausted(from, to, retryAfterMs) {
+		if (!this.enabled || !from) return;
+		const cooldownMs = Math.max(1e3, retryAfterMs ?? this.options.cooldownMs);
+		const cooldownUntil = Date.now() + cooldownMs;
+		await this.mutate((state) => {
+			state.cooling[from] = cooldownUntil;
+			if (to) state.activeAccount = to;
+			state.events.unshift({
+				id: `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				providerId: this.options.providerId,
+				from,
+				to,
+				cooldownUntil
+			});
+			state.events = state.events.slice(0, MAX_EVENTS);
+		});
+	}
+	async activate(account) {
+		if (!this.enabled || !account) return;
+		if ((await this.load()).activeAccount === account) return;
+		await this.mutate((state) => {
+			state.activeAccount = account;
+		});
+	}
+	async load() {
+		if (!this.state) {
+			this.state = await readQuotaGuardState(this.options.statePath);
+			const now = Date.now();
+			this.state.cooling = Object.fromEntries(Object.entries(this.state.cooling).filter(([, until]) => until > now));
+		}
+		return this.state;
+	}
+	async mutate(change) {
+		await (this.write = this.write.then(async () => {
+			const state = await this.load();
+			change(state);
+			if (this.options.statePath) await writeJsonFile(this.options.statePath, state);
+		}));
+	}
+};
+function emptyQuotaGuardState() {
+	return {
+		version: 1,
+		cooling: {},
+		events: []
+	};
+}
+function normalizeQuotaGuardState(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return emptyQuotaGuardState();
+	const record = value;
+	const cooling = record.cooling && typeof record.cooling === "object" && !Array.isArray(record.cooling) ? Object.fromEntries(Object.entries(record.cooling).filter(([account, until]) => account.length <= 128 && typeof until === "number" && until > 0)) : {};
+	const events = Array.isArray(record.events) ? record.events.filter(isQuotaGuardEvent).slice(0, MAX_EVENTS) : [];
+	return {
+		version: 1,
+		activeAccount: typeof record.activeAccount === "string" ? record.activeAccount : void 0,
+		cooling,
+		events
+	};
+}
+function isQuotaGuardEvent(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+	const event = value;
+	return typeof event.id === "string" && typeof event.createdAt === "string" && typeof event.from === "string" && (event.to === void 0 || typeof event.to === "string") && typeof event.cooldownUntil === "number";
+}
+//#endregion
+export { QuotaGuard, readQuotaGuardState };
+
+//# sourceMappingURL=quota-guard.js.map

package/dist/providers/quota-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota-guard.js","names":[],"sources":["../../src/providers/quota-guard.ts"],"sourcesContent":["import { pathExists, readJsonFile, writeJsonFile } from '../utils/fs';\n\n/**\n * Runtime-only policy passed to a compatibility proxy. This is intentionally\n * not an account setting: a pool can be stopped, restarted, or deleted without\n * changing a user's native login.\n */\nexport interface QuotaGuardOptions {\n  enabled: boolean;\n  cooldownMs: number;\n  /** Saved-account labels in the same order as the proxy credential ring. */\n  accountNames?: string[];\n  /** Owner-only, secret-free state below the pool runtime directory. */\n  statePath?: string;\n  providerId?: string;\n}\n\nexport interface QuotaGuardEvent {\n  id: string;\n  createdAt: string;\n  providerId?: string;\n  from: string;\n  to?: string;\n  cooldownUntil: number;\n}\n\nexport interface QuotaGuardState {\n  version: 1;\n  /** Last account that successfully took over. */\n  activeAccount?: string;\n  cooling: Record<string, number>;\n  events: QuotaGuardEvent[];\n}\n\nconst MAX_EVENTS = 100;\n\nexport async function readQuotaGuardState(path: string | undefined): Promise<QuotaGuardState> {\n  if (!path || !(await pathExists(path))) {\n    return emptyQuotaGuardState();\n  }\n  try {\n    const value = await readJsonFile<unknown>(path);\n    return normalizeQuotaGuardState(value);\n  } catch {\n    // A runtime audit file must never prevent a proxy from serving a request.\n    return emptyQuotaGuardState();\n  }\n}\n\n/**\n * Keeps account cooldowns across proxy restarts. It only accepts saved account\n * names supplied by the pool and never writes credential material.\n */\nexport class QuotaGuard {\n  private state: QuotaGuardState | undefined;\n  private write = Promise.resolve();\n\n  constructor(private readonly options: QuotaGuardOptions) {}\n\n  get enabled(): boolean {\n    return this.options.enabled;\n  }\n\n  async ordered<T extends { accountName?: string }>(candidates: readonly T[]): Promise<T[]> {\n    if (!this.enabled || candidates.length < 2) {\n      return [...candidates];\n    }\n    const state = await this.load();\n    const now = Date.now();\n    const eligible = candidates.filter((candidate) => {\n      const account = candidate.accountName;\n      return !account || (state.cooling[account] ?? 0) <= now;\n    });\n    if (eligible.length === 0) {\n      return [];\n    }\n    if (!state.activeAccount) {\n      return eligible;\n    }\n    const active = eligible.find((candidate) => candidate.accountName === state.activeAccount);\n    return active ? [active, ...eligible.filter((candidate) => candidate !== active)] : eligible;\n  }\n\n  async exhausted(\n    from: string | undefined,\n    to: string | undefined,\n    retryAfterMs?: number,\n  ): Promise<void> {\n    if (!this.enabled || !from) {\n      return;\n    }\n    const cooldownMs = Math.max(1_000, retryAfterMs ?? this.options.cooldownMs);\n    const cooldownUntil = Date.now() + cooldownMs;\n    await this.mutate((state) => {\n      state.cooling[from] = cooldownUntil;\n      if (to) {\n        state.activeAccount = to;\n      }\n      state.events.unshift({\n        id: `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`,\n        createdAt: new Date().toISOString(),\n        providerId: this.options.providerId,\n        from,\n        to,\n        cooldownUntil,\n      });\n      state.events = state.events.slice(0, MAX_EVENTS);\n    });\n  }\n\n  async activate(account: string | undefined): Promise<void> {\n    if (!this.enabled || !account) {\n      return;\n    }\n    if ((await this.load()).activeAccount === account) {\n      return;\n    }\n    await this.mutate((state) => {\n      state.activeAccount = account;\n    });\n  }\n\n  private async load(): Promise<QuotaGuardState> {\n    if (!this.state) {\n      this.state = await readQuotaGuardState(this.options.statePath);\n      const now = Date.now();\n      this.state.cooling = Object.fromEntries(\n        Object.entries(this.state.cooling).filter(([, until]) => until > now),\n      );\n    }\n    return this.state;\n  }\n\n  private async mutate(change: (state: QuotaGuardState) => void): Promise<void> {\n    await (this.write = this.write.then(async () => {\n      const state = await this.load();\n      change(state);\n      if (this.options.statePath) {\n        await writeJsonFile(this.options.statePath, state);\n      }\n    }));\n  }\n}\n\nfunction emptyQuotaGuardState(): QuotaGuardState {\n  return { version: 1, cooling: {}, events: [] };\n}\n\nfunction normalizeQuotaGuardState(value: unknown): QuotaGuardState {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    return emptyQuotaGuardState();\n  }\n  const record = value as Record<string, unknown>;\n  const cooling =\n    record.cooling && typeof record.cooling === 'object' && !Array.isArray(record.cooling)\n      ? Object.fromEntries(\n          Object.entries(record.cooling as Record<string, unknown>).filter(\n            ([account, until]) => account.length <= 128 && typeof until === 'number' && until > 0,\n          ) as Array<[string, number]>,\n        )\n      : {};\n  const events = Array.isArray(record.events)\n    ? record.events.filter(isQuotaGuardEvent).slice(0, MAX_EVENTS)\n    : [];\n  return {\n    version: 1,\n    activeAccount: typeof record.activeAccount === 'string' ? record.activeAccount : undefined,\n    cooling,\n    events,\n  };\n}\n\nfunction isQuotaGuardEvent(value: unknown): value is QuotaGuardEvent {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) {\n    return false;\n  }\n  const event = value as Record<string, unknown>;\n  return (\n    typeof event.id === 'string' &&\n    typeof event.createdAt === 'string' &&\n    typeof event.from === 'string' &&\n    (event.to === undefined || typeof event.to === 'string') &&\n    typeof event.cooldownUntil === 'number'\n  );\n}\n"],"mappings":";;AAkCA,IAAM,aAAa;AAEnB,eAAsB,oBAAoB,MAAoD;CAC5F,IAAI,CAAC,QAAQ,CAAE,MAAM,WAAW,IAAI,GAClC,OAAO,qBAAqB;CAE9B,IAAI;EAEF,OAAO,yBAAyB,MADZ,aAAsB,IAAI,CACT;CACvC,QAAQ;EAEN,OAAO,qBAAqB;CAC9B;AACF;;;;;AAMA,IAAa,aAAb,MAAwB;CAIO;CAH7B;CACA,QAAgB,QAAQ,QAAQ;CAEhC,YAAY,SAA6C;EAA5B,KAAA,UAAA;CAA6B;CAE1D,IAAI,UAAmB;EACrB,OAAO,KAAK,QAAQ;CACtB;CAEA,MAAM,QAA4C,YAAwC;EACxF,IAAI,CAAC,KAAK,WAAW,WAAW,SAAS,GACvC,OAAO,CAAC,GAAG,UAAU;EAEvB,MAAM,QAAQ,MAAM,KAAK,KAAK;EAC9B,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,WAAW,WAAW,QAAQ,cAAc;GAChD,MAAM,UAAU,UAAU;GAC1B,OAAO,CAAC,YAAY,MAAM,QAAQ,YAAY,MAAM;EACtD,CAAC;EACD,IAAI,SAAS,WAAW,GACtB,OAAO,CAAC;EAEV,IAAI,CAAC,MAAM,eACT,OAAO;EAET,MAAM,SAAS,SAAS,MAAM,cAAc,UAAU,gBAAgB,MAAM,aAAa;EACzF,OAAO,SAAS,CAAC,QAAQ,GAAG,SAAS,QAAQ,cAAc,cAAc,MAAM,CAAC,IAAI;CACtF;CAEA,MAAM,UACJ,MACA,IACA,cACe;EACf,IAAI,CAAC,KAAK,WAAW,CAAC,MACpB;EAEF,MAAM,aAAa,KAAK,IAAI,KAAO,gBAAgB,KAAK,QAAQ,UAAU;EAC1E,MAAM,gBAAgB,KAAK,IAAI,IAAI;EACnC,MAAM,KAAK,QAAQ,UAAU;GAC3B,MAAM,QAAQ,QAAQ;GACtB,IAAI,IACF,MAAM,gBAAgB;GAExB,MAAM,OAAO,QAAQ;IACnB,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;IACvE,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;IAClC,YAAY,KAAK,QAAQ;IACzB;IACA;IACA;GACF,CAAC;GACD,MAAM,SAAS,MAAM,OAAO,MAAM,GAAG,UAAU;EACjD,CAAC;CACH;CAEA,MAAM,SAAS,SAA4C;EACzD,IAAI,CAAC,KAAK,WAAW,CAAC,SACpB;EAEF,KAAK,MAAM,KAAK,KAAK,EAAA,CAAG,kBAAkB,SACxC;EAEF,MAAM,KAAK,QAAQ,UAAU;GAC3B,MAAM,gBAAgB;EACxB,CAAC;CACH;CAEA,MAAc,OAAiC;EAC7C,IAAI,CAAC,KAAK,OAAO;GACf,KAAK,QAAQ,MAAM,oBAAoB,KAAK,QAAQ,SAAS;GAC7D,MAAM,MAAM,KAAK,IAAI;GACrB,KAAK,MAAM,UAAU,OAAO,YAC1B,OAAO,QAAQ,KAAK,MAAM,OAAO,CAAC,CAAC,QAAQ,GAAG,WAAW,QAAQ,GAAG,CACtE;EACF;EACA,OAAO,KAAK;CACd;CAEA,MAAc,OAAO,QAAyD;EAC5E,OAAO,KAAK,QAAQ,KAAK,MAAM,KAAK,YAAY;GAC9C,MAAM,QAAQ,MAAM,KAAK,KAAK;GAC9B,OAAO,KAAK;GACZ,IAAI,KAAK,QAAQ,WACf,MAAM,cAAc,KAAK,QAAQ,WAAW,KAAK;EAErD,CAAC;CACH;AACF;AAEA,SAAS,uBAAwC;CAC/C,OAAO;EAAE,SAAS;EAAG,SAAS,CAAC;EAAG,QAAQ,CAAC;CAAE;AAC/C;AAEA,SAAS,yBAAyB,OAAiC;CACjE,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAC5D,OAAO,qBAAqB;CAE9B,MAAM,SAAS;CACf,MAAM,UACJ,OAAO,WAAW,OAAO,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,OAAO,IACjF,OAAO,YACL,OAAO,QAAQ,OAAO,OAAkC,CAAC,CAAC,QACvD,CAAC,SAAS,WAAW,QAAQ,UAAU,OAAO,OAAO,UAAU,YAAY,QAAQ,CACtF,CACF,IACA,CAAC;CACP,MAAM,SAAS,MAAM,QAAQ,OAAO,MAAM,IACtC,OAAO,OAAO,OAAO,iBAAiB,CAAC,CAAC,MAAM,GAAG,UAAU,IAC3D,CAAC;CACL,OAAO;EACL,SAAS;EACT,eAAe,OAAO,OAAO,kBAAkB,WAAW,OAAO,gBAAgB,KAAA;EACjF;EACA;CACF;AACF;AAEA,SAAS,kBAAkB,OAA0C;CACnE,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAC5D,OAAO;CAET,MAAM,QAAQ;CACd,OACE,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,cAAc,YAC3B,OAAO,MAAM,SAAS,aACrB,MAAM,OAAO,KAAA,KAAa,OAAO,MAAM,OAAO,aAC/C,OAAO,MAAM,kBAAkB;AAEnC"}

package/dist/providers/reasoning.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Protocol-neutral reasoning controls shared by the compatibility proxies.
+ *
+ * The public APIs use different names for the same intent:
+ * OpenAI uses `reasoning_effort` / `reasoning.effort`, Anthropic uses
+ * `output_config.effort` plus `thinking`, and Gemini uses `thinkingConfig`.
+ * Keep extraction and the necessarily lossy level mapping in one place so a
+ * proxy translation never silently drops the caller's intent.
+ */
+export type ReasoningEffort = 'none' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max';
+export interface ReasoningIntent {
+    effort?: ReasoningEffort;
+    /** Explicit thinking switch. Undefined means the client did not specify it. */
+    enabled?: boolean;
+    /** Exact Anthropic manual thinking budget, when supplied. */
+    budgetTokens?: number;
+    /** The client requested a visible reasoning/thinking summary. */
+    includeSummary?: boolean;
+}
+export declare function normalizeReasoningEffort(value: unknown): ReasoningEffort | undefined;
+export declare function reasoningFromOpenAI(request: Record<string, unknown>): ReasoningIntent;
+export declare function reasoningFromAnthropic(request: Record<string, unknown>): ReasoningIntent;
+/** Convert Anthropic controls to the closest OpenAI Chat effort value. */
+export declare function anthropicToOpenAIEffort(request: Record<string, unknown>): Exclude<ReasoningEffort, 'max'> | undefined;
+/** Convert OpenAI's extra levels to an Anthropic API effort value. */
+export declare function openAIToAnthropicEffort(effort: ReasoningEffort | undefined): 'low' | 'medium' | 'high' | 'xhigh' | 'max' | undefined;
+//# sourceMappingURL=reasoning.d.ts.map

package/dist/providers/reasoning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reasoning.d.ts","sourceRoot":"","sources":["../../src/providers/reasoning.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAE/F,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,GAAG,SAAS,CAiBpF;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,CAarF;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,CAuBxF;AAED,0EAA0E;AAC1E,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,GAAG,SAAS,CAuB7C;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,eAAe,GAAG,SAAS,GAClC,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,SAAS,CAQzD"}

package/dist/providers/reasoning.js

@@ -0,0 +1,61 @@
+//#region src/providers/reasoning.ts
+function normalizeReasoningEffort(value) {
+	if (typeof value !== "string") return;
+	const normalized = value.trim().toLowerCase();
+	switch (normalized) {
+		case "none":
+		case "minimal":
+		case "low":
+		case "medium":
+		case "high":
+		case "xhigh":
+		case "max": return normalized;
+		default: return;
+	}
+}
+function reasoningFromOpenAI(request) {
+	const reasoning = isRecord(request.reasoning) ? request.reasoning : void 0;
+	const effort = normalizeReasoningEffort(request.reasoning_effort) ?? normalizeReasoningEffort(reasoning?.effort) ?? normalizeReasoningEffort(request.effort);
+	const summary = reasoning?.summary ?? reasoning?.generate_summary;
+	return {
+		...effort ? {
+			effort,
+			enabled: effort !== "none"
+		} : {},
+		...summary === "auto" || summary === "concise" || summary === "detailed" ? { includeSummary: true } : {}
+	};
+}
+function reasoningFromAnthropic(request) {
+	const thinking = isRecord(request.thinking) ? request.thinking : void 0;
+	const effort = normalizeReasoningEffort((isRecord(request.output_config) ? request.output_config : void 0)?.effort);
+	const thinkingType = typeof thinking?.type === "string" ? thinking.type.toLowerCase() : void 0;
+	const budget = typeof thinking?.budget_tokens === "number" && Number.isFinite(thinking.budget_tokens) && thinking.budget_tokens >= 0 ? Math.trunc(thinking.budget_tokens) : void 0;
+	const enabled = thinkingType === "disabled" ? false : thinkingType === "enabled" || thinkingType === "adaptive" ? true : void 0;
+	return {
+		...effort ? { effort } : {},
+		...enabled != null ? { enabled } : {},
+		...budget != null ? { budgetTokens: budget } : {},
+		...enabled === true && thinking?.display !== "omitted" ? { includeSummary: true } : {}
+	};
+}
+/** Convert Anthropic controls to the closest OpenAI Chat effort value. */
+function anthropicToOpenAIEffort(request) {
+	const intent = reasoningFromAnthropic(request);
+	if (intent.enabled === false) return "none";
+	if (intent.effort) return intent.effort === "max" ? "xhigh" : intent.effort;
+	if (intent.budgetTokens != null) {
+		const maxTokens = typeof request.max_tokens === "number" && request.max_tokens > 0 ? request.max_tokens : void 0;
+		const ratio = maxTokens ? intent.budgetTokens / maxTokens : void 0;
+		if (intent.budgetTokens <= 1024 || ratio != null && ratio <= .25) return "low";
+		if (ratio != null && ratio <= .6) return "medium";
+		return "high";
+	}
+	return intent.enabled ? "medium" : void 0;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+export { anthropicToOpenAIEffort, normalizeReasoningEffort, reasoningFromAnthropic, reasoningFromOpenAI };
+
+//# sourceMappingURL=reasoning.js.map

package/dist/providers/reasoning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reasoning.js","names":[],"sources":["../../src/providers/reasoning.ts"],"sourcesContent":["/**\n * Protocol-neutral reasoning controls shared by the compatibility proxies.\n *\n * The public APIs use different names for the same intent:\n * OpenAI uses `reasoning_effort` / `reasoning.effort`, Anthropic uses\n * `output_config.effort` plus `thinking`, and Gemini uses `thinkingConfig`.\n * Keep extraction and the necessarily lossy level mapping in one place so a\n * proxy translation never silently drops the caller's intent.\n */\n\nexport type ReasoningEffort = 'none' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' | 'max';\n\nexport interface ReasoningIntent {\n  effort?: ReasoningEffort;\n  /** Explicit thinking switch. Undefined means the client did not specify it. */\n  enabled?: boolean;\n  /** Exact Anthropic manual thinking budget, when supplied. */\n  budgetTokens?: number;\n  /** The client requested a visible reasoning/thinking summary. */\n  includeSummary?: boolean;\n}\n\nexport function normalizeReasoningEffort(value: unknown): ReasoningEffort | undefined {\n  if (typeof value !== 'string') {\n    return undefined;\n  }\n  const normalized = value.trim().toLowerCase();\n  switch (normalized) {\n    case 'none':\n    case 'minimal':\n    case 'low':\n    case 'medium':\n    case 'high':\n    case 'xhigh':\n    case 'max':\n      return normalized;\n    default:\n      return undefined;\n  }\n}\n\nexport function reasoningFromOpenAI(request: Record<string, unknown>): ReasoningIntent {\n  const reasoning = isRecord(request.reasoning) ? request.reasoning : undefined;\n  const effort =\n    normalizeReasoningEffort(request.reasoning_effort) ??\n    normalizeReasoningEffort(reasoning?.effort) ??\n    normalizeReasoningEffort(request.effort);\n  const summary = reasoning?.summary ?? reasoning?.generate_summary;\n  return {\n    ...(effort ? { effort, enabled: effort !== 'none' } : {}),\n    ...(summary === 'auto' || summary === 'concise' || summary === 'detailed'\n      ? { includeSummary: true }\n      : {}),\n  };\n}\n\nexport function reasoningFromAnthropic(request: Record<string, unknown>): ReasoningIntent {\n  const thinking = isRecord(request.thinking) ? request.thinking : undefined;\n  const outputConfig = isRecord(request.output_config) ? request.output_config : undefined;\n  const effort = normalizeReasoningEffort(outputConfig?.effort);\n  const thinkingType = typeof thinking?.type === 'string' ? thinking.type.toLowerCase() : undefined;\n  const budget =\n    typeof thinking?.budget_tokens === 'number' &&\n    Number.isFinite(thinking.budget_tokens) &&\n    thinking.budget_tokens >= 0\n      ? Math.trunc(thinking.budget_tokens)\n      : undefined;\n  const enabled =\n    thinkingType === 'disabled'\n      ? false\n      : thinkingType === 'enabled' || thinkingType === 'adaptive'\n        ? true\n        : undefined;\n  return {\n    ...(effort ? { effort } : {}),\n    ...(enabled != null ? { enabled } : {}),\n    ...(budget != null ? { budgetTokens: budget } : {}),\n    ...(enabled === true && thinking?.display !== 'omitted' ? { includeSummary: true } : {}),\n  };\n}\n\n/** Convert Anthropic controls to the closest OpenAI Chat effort value. */\nexport function anthropicToOpenAIEffort(\n  request: Record<string, unknown>,\n): Exclude<ReasoningEffort, 'max'> | undefined {\n  const intent = reasoningFromAnthropic(request);\n  if (intent.enabled === false) {\n    return 'none';\n  }\n  if (intent.effort) {\n    return intent.effort === 'max' ? 'xhigh' : intent.effort;\n  }\n  if (intent.budgetTokens != null) {\n    const maxTokens =\n      typeof request.max_tokens === 'number' && request.max_tokens > 0\n        ? request.max_tokens\n        : undefined;\n    const ratio = maxTokens ? intent.budgetTokens / maxTokens : undefined;\n    if (intent.budgetTokens <= 1024 || (ratio != null && ratio <= 0.25)) {\n      return 'low';\n    }\n    if (ratio != null && ratio <= 0.6) {\n      return 'medium';\n    }\n    return 'high';\n  }\n  return intent.enabled ? 'medium' : undefined;\n}\n\n/** Convert OpenAI's extra levels to an Anthropic API effort value. */\nexport function openAIToAnthropicEffort(\n  effort: ReasoningEffort | undefined,\n): 'low' | 'medium' | 'high' | 'xhigh' | 'max' | undefined {\n  if (!effort) {\n    return undefined;\n  }\n  if (effort === 'none' || effort === 'minimal') {\n    return 'low';\n  }\n  return effort;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n"],"mappings":";AAsBA,SAAgB,yBAAyB,OAA6C;CACpF,IAAI,OAAO,UAAU,UACnB;CAEF,MAAM,aAAa,MAAM,KAAK,CAAC,CAAC,YAAY;CAC5C,QAAQ,YAAR;EACE,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,OACH,OAAO;EACT,SACE;CACJ;AACF;AAEA,SAAgB,oBAAoB,SAAmD;CACrF,MAAM,YAAY,SAAS,QAAQ,SAAS,IAAI,QAAQ,YAAY,KAAA;CACpE,MAAM,SACJ,yBAAyB,QAAQ,gBAAgB,KACjD,yBAAyB,WAAW,MAAM,KAC1C,yBAAyB,QAAQ,MAAM;CACzC,MAAM,UAAU,WAAW,WAAW,WAAW;CACjD,OAAO;EACL,GAAI,SAAS;GAAE;GAAQ,SAAS,WAAW;EAAO,IAAI,CAAC;EACvD,GAAI,YAAY,UAAU,YAAY,aAAa,YAAY,aAC3D,EAAE,gBAAgB,KAAK,IACvB,CAAC;CACP;AACF;AAEA,SAAgB,uBAAuB,SAAmD;CACxF,MAAM,WAAW,SAAS,QAAQ,QAAQ,IAAI,QAAQ,WAAW,KAAA;CAEjE,MAAM,SAAS,0BADM,SAAS,QAAQ,aAAa,IAAI,QAAQ,gBAAgB,KAAA,EAAA,EACzB,MAAM;CAC5D,MAAM,eAAe,OAAO,UAAU,SAAS,WAAW,SAAS,KAAK,YAAY,IAAI,KAAA;CACxF,MAAM,SACJ,OAAO,UAAU,kBAAkB,YACnC,OAAO,SAAS,SAAS,aAAa,KACtC,SAAS,iBAAiB,IACtB,KAAK,MAAM,SAAS,aAAa,IACjC,KAAA;CACN,MAAM,UACJ,iBAAiB,aACb,QACA,iBAAiB,aAAa,iBAAiB,aAC7C,OACA,KAAA;CACR,OAAO;EACL,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,WAAW,OAAO,EAAE,QAAQ,IAAI,CAAC;EACrC,GAAI,UAAU,OAAO,EAAE,cAAc,OAAO,IAAI,CAAC;EACjD,GAAI,YAAY,QAAQ,UAAU,YAAY,YAAY,EAAE,gBAAgB,KAAK,IAAI,CAAC;CACxF;AACF;;AAGA,SAAgB,wBACd,SAC6C;CAC7C,MAAM,SAAS,uBAAuB,OAAO;CAC7C,IAAI,OAAO,YAAY,OACrB,OAAO;CAET,IAAI,OAAO,QACT,OAAO,OAAO,WAAW,QAAQ,UAAU,OAAO;CAEpD,IAAI,OAAO,gBAAgB,MAAM;EAC/B,MAAM,YACJ,OAAO,QAAQ,eAAe,YAAY,QAAQ,aAAa,IAC3D,QAAQ,aACR,KAAA;EACN,MAAM,QAAQ,YAAY,OAAO,eAAe,YAAY,KAAA;EAC5D,IAAI,OAAO,gBAAgB,QAAS,SAAS,QAAQ,SAAS,KAC5D,OAAO;EAET,IAAI,SAAS,QAAQ,SAAS,IAC5B,OAAO;EAET,OAAO;CACT;CACA,OAAO,OAAO,UAAU,WAAW,KAAA;AACrC;AAeA,SAAS,SAAS,OAAkD;CAClE,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAC5E"}

package/dist/providers/upstream-policy.d.ts

@@ -0,0 +1,33 @@
+export type UpstreamFailureKind = 'rate_limit' | 'auth' | 'transient' | 'server' | 'permanent';
+export type LimitScope = 'ip' | 'credential' | 'model' | 'unknown';
+export interface ClassifiedFailure {
+    kind: UpstreamFailureKind;
+    status?: number;
+    scope: LimitScope;
+    retryAfterMs?: number;
+    message?: string;
+}
+/**
+ * Billing exhaustion is credential-scoped, unlike an IP/model rate limit.
+ * Keep this deliberately narrow: a generic 403 can be a model entitlement or
+ * policy rejection and must not silently disable an otherwise healthy account.
+ */
+export declare function isInsufficientBalanceFailure(status: number, bodyPreview?: string): boolean;
+/**
+ * A 429 is normally shared by an IP, endpoint, or model. This deliberately
+ * returns true only for vendor responses that explicitly attribute exhaustion
+ * to an API key, project, account, billing balance, or quota allocation.
+ * Generic 429s must remain on the current account.
+ */
+export declare function isCredentialQuotaFailure(status: number, headers: Headers, bodyPreview?: string): boolean;
+export declare function parseRetryAfter(value: string | null | undefined, now?: number): number | undefined;
+export declare function classifyUpstreamFailure(status: number, headers: Headers, bodyPreview?: string, now?: number): ClassifiedFailure;
+export declare class CooldownRegistry {
+    private readonly now;
+    private readonly deadlines;
+    constructor(now?: () => number);
+    set(key: string, delayMs: number): void;
+    remainingMs(key: string): number;
+    get size(): number;
+}
+//# sourceMappingURL=upstream-policy.d.ts.map

package/dist/providers/upstream-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-policy.d.ts","sourceRoot":"","sources":["../../src/providers/upstream-policy.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG,YAAY,GAAG,MAAM,GAAG,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;AAC/F,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,YAAY,GAAG,OAAO,GAAG,SAAS,CAAC;AAEnE,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,SAAK,GAAG,OAAO,CAUtF;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,WAAW,SAAK,GACf,OAAO,CAgBT;AAED,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,GAAG,SAAa,GACf,MAAM,GAAG,SAAS,CAcpB;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,EAChB,WAAW,SAAK,EAChB,GAAG,SAAa,GACf,iBAAiB,CAuBnB;AAED,qBAAa,gBAAgB;IAEf,OAAO,CAAC,QAAQ,CAAC,GAAG;IADhC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,YAA6B,GAAG,GAAE,MAAM,MAAiB,EAAI;IAC7D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAItC;IACD,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAW/B;IACD,IAAI,IAAI,IAAI,MAAM,CAEjB;CACF"}

package/dist/providers/upstream-policy.js

@@ -0,0 +1,97 @@
+//#region src/providers/upstream-policy.ts
+/**
+* Billing exhaustion is credential-scoped, unlike an IP/model rate limit.
+* Keep this deliberately narrow: a generic 403 can be a model entitlement or
+* policy rejection and must not silently disable an otherwise healthy account.
+*/
+function isInsufficientBalanceFailure(status, bodyPreview = "") {
+	if (status !== 402 && status !== 403) return false;
+	const text = bodyPreview.slice(0, 2e3).toLowerCase();
+	return /insufficient[_\s-]*(?:account[_\s-]*)?balance/.test(text) || /account[_\s-]*balance[^.]{0,80}insufficient/.test(text) || /balance[^.]{0,80}(?:depleted|exhausted)/.test(text);
+}
+/**
+* A 429 is normally shared by an IP, endpoint, or model. This deliberately
+* returns true only for vendor responses that explicitly attribute exhaustion
+* to an API key, project, account, billing balance, or quota allocation.
+* Generic 429s must remain on the current account.
+*/
+function isCredentialQuotaFailure(status, headers, bodyPreview = "") {
+	if (status !== 429 && !isInsufficientBalanceFailure(status, bodyPreview)) return false;
+	const text = `${headers.get("x-goog-api-client") ?? ""} ${bodyPreview.slice(0, 2e3)}`.toLowerCase();
+	if (/freeusagelimit|free usage|\bip(?: address)?\b|per[-\s]?minute|rate limit/.test(text)) return false;
+	return /resource[_\s-]*exhausted/.test(text) || /(?:api[_\s-]*key|credential|project|account|billing)[^.]{0,100}(?:quota|balance|exhausted|limit)/.test(text) || /(?:quota|balance)[^.]{0,100}(?:exhausted|depleted|exceeded|insufficient)/.test(text);
+}
+function parseRetryAfter(value, now = Date.now()) {
+	if (!value) return;
+	const raw = value.trim();
+	if (/^[+-]?\d+(?:\.\d+)?$/.test(raw)) {
+		const seconds = Number(raw);
+		return Number.isFinite(seconds) && seconds >= 0 ? Math.floor(seconds * 1e3) : void 0;
+	}
+	const date = Date.parse(value);
+	if (!Number.isNaN(date) && date >= now) return date - now;
+}
+function classifyUpstreamFailure(status, headers, bodyPreview = "", now = Date.now()) {
+	const text = bodyPreview.slice(0, 2e3);
+	if (status === 429) {
+		const lower = text.toLowerCase();
+		return {
+			kind: "rate_limit",
+			status,
+			scope: /freeusagelimit|free usage|\bip\b/.test(lower) ? "ip" : "unknown",
+			retryAfterMs: parseRetryAfter(headers.get("retry-after"), now),
+			message: text || void 0
+		};
+	}
+	if (status === 401 || status === 403) return {
+		kind: "auth",
+		status,
+		scope: "credential",
+		message: text || void 0
+	};
+	if (status === 408 || status === 502 || status === 503 || status === 504) return {
+		kind: "transient",
+		status,
+		scope: "unknown",
+		message: text || void 0
+	};
+	if (status >= 500) return {
+		kind: "server",
+		status,
+		scope: "unknown",
+		message: text || void 0
+	};
+	return {
+		kind: "permanent",
+		status,
+		scope: "unknown",
+		message: text || void 0
+	};
+}
+var CooldownRegistry = class {
+	now;
+	deadlines = /* @__PURE__ */ new Map();
+	constructor(now = Date.now) {
+		this.now = now;
+	}
+	set(key, delayMs) {
+		if (delayMs > 0) this.deadlines.set(key, this.now() + delayMs);
+	}
+	remainingMs(key) {
+		const deadline = this.deadlines.get(key);
+		if (deadline === void 0) return 0;
+		const remaining = deadline - this.now();
+		if (remaining <= 0) {
+			this.deadlines.delete(key);
+			return 0;
+		}
+		return remaining;
+	}
+	get size() {
+		return this.deadlines.size;
+	}
+};
+//#endregion
+export { CooldownRegistry, classifyUpstreamFailure, isCredentialQuotaFailure, isInsufficientBalanceFailure, parseRetryAfter };
+
+//# sourceMappingURL=upstream-policy.js.map

package/dist/providers/upstream-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream-policy.js","names":[],"sources":["../../src/providers/upstream-policy.ts"],"sourcesContent":["export type UpstreamFailureKind = 'rate_limit' | 'auth' | 'transient' | 'server' | 'permanent';\nexport type LimitScope = 'ip' | 'credential' | 'model' | 'unknown';\n\nexport interface ClassifiedFailure {\n  kind: UpstreamFailureKind;\n  status?: number;\n  scope: LimitScope;\n  retryAfterMs?: number;\n  message?: string;\n}\n\n/**\n * Billing exhaustion is credential-scoped, unlike an IP/model rate limit.\n * Keep this deliberately narrow: a generic 403 can be a model entitlement or\n * policy rejection and must not silently disable an otherwise healthy account.\n */\nexport function isInsufficientBalanceFailure(status: number, bodyPreview = ''): boolean {\n  if (status !== 402 && status !== 403) {\n    return false;\n  }\n  const text = bodyPreview.slice(0, 2000).toLowerCase();\n  return (\n    /insufficient[_\\s-]*(?:account[_\\s-]*)?balance/.test(text) ||\n    /account[_\\s-]*balance[^.]{0,80}insufficient/.test(text) ||\n    /balance[^.]{0,80}(?:depleted|exhausted)/.test(text)\n  );\n}\n\n/**\n * A 429 is normally shared by an IP, endpoint, or model. This deliberately\n * returns true only for vendor responses that explicitly attribute exhaustion\n * to an API key, project, account, billing balance, or quota allocation.\n * Generic 429s must remain on the current account.\n */\nexport function isCredentialQuotaFailure(\n  status: number,\n  headers: Headers,\n  bodyPreview = '',\n): boolean {\n  if (status !== 429 && !isInsufficientBalanceFailure(status, bodyPreview)) {\n    return false;\n  }\n  const text =\n    `${headers.get('x-goog-api-client') ?? ''} ${bodyPreview.slice(0, 2000)}`.toLowerCase();\n  if (/freeusagelimit|free usage|\\bip(?: address)?\\b|per[-\\s]?minute|rate limit/.test(text)) {\n    return false;\n  }\n  return (\n    /resource[_\\s-]*exhausted/.test(text) ||\n    /(?:api[_\\s-]*key|credential|project|account|billing)[^.]{0,100}(?:quota|balance|exhausted|limit)/.test(\n      text,\n    ) ||\n    /(?:quota|balance)[^.]{0,100}(?:exhausted|depleted|exceeded|insufficient)/.test(text)\n  );\n}\n\nexport function parseRetryAfter(\n  value: string | null | undefined,\n  now = Date.now(),\n): number | undefined {\n  if (!value) {\n    return undefined;\n  }\n  const raw = value.trim();\n  if (/^[+-]?\\d+(?:\\.\\d+)?$/.test(raw)) {\n    const seconds = Number(raw);\n    return Number.isFinite(seconds) && seconds >= 0 ? Math.floor(seconds * 1000) : undefined;\n  }\n  const date = Date.parse(value);\n  if (!Number.isNaN(date) && date >= now) {\n    return date - now;\n  }\n  return undefined;\n}\n\nexport function classifyUpstreamFailure(\n  status: number,\n  headers: Headers,\n  bodyPreview = '',\n  now = Date.now(),\n): ClassifiedFailure {\n  const text = bodyPreview.slice(0, 2000);\n  if (status === 429) {\n    const lower = text.toLowerCase();\n    const scope: LimitScope = /freeusagelimit|free usage|\\bip\\b/.test(lower) ? 'ip' : 'unknown';\n    return {\n      kind: 'rate_limit',\n      status,\n      scope,\n      retryAfterMs: parseRetryAfter(headers.get('retry-after'), now),\n      message: text || undefined,\n    };\n  }\n  if (status === 401 || status === 403) {\n    return { kind: 'auth', status, scope: 'credential', message: text || undefined };\n  }\n  if (status === 408 || status === 502 || status === 503 || status === 504) {\n    return { kind: 'transient', status, scope: 'unknown', message: text || undefined };\n  }\n  if (status >= 500) {\n    return { kind: 'server', status, scope: 'unknown', message: text || undefined };\n  }\n  return { kind: 'permanent', status, scope: 'unknown', message: text || undefined };\n}\n\nexport class CooldownRegistry {\n  private readonly deadlines = new Map<string, number>();\n  constructor(private readonly now: () => number = Date.now) {}\n  set(key: string, delayMs: number): void {\n    if (delayMs > 0) {\n      this.deadlines.set(key, this.now() + delayMs);\n    }\n  }\n  remainingMs(key: string): number {\n    const deadline = this.deadlines.get(key);\n    if (deadline === undefined) {\n      return 0;\n    }\n    const remaining = deadline - this.now();\n    if (remaining <= 0) {\n      this.deadlines.delete(key);\n      return 0;\n    }\n    return remaining;\n  }\n  get size(): number {\n    return this.deadlines.size;\n  }\n}\n"],"mappings":";;;;;;AAgBA,SAAgB,6BAA6B,QAAgB,cAAc,IAAa;CACtF,IAAI,WAAW,OAAO,WAAW,KAC/B,OAAO;CAET,MAAM,OAAO,YAAY,MAAM,GAAG,GAAI,CAAC,CAAC,YAAY;CACpD,OACE,gDAAgD,KAAK,IAAI,KACzD,8CAA8C,KAAK,IAAI,KACvD,0CAA0C,KAAK,IAAI;AAEvD;;;;;;;AAQA,SAAgB,yBACd,QACA,SACA,cAAc,IACL;CACT,IAAI,WAAW,OAAO,CAAC,6BAA6B,QAAQ,WAAW,GACrE,OAAO;CAET,MAAM,OACJ,GAAG,QAAQ,IAAI,mBAAmB,KAAK,GAAG,GAAG,YAAY,MAAM,GAAG,GAAI,IAAI,YAAY;CACxF,IAAI,2EAA2E,KAAK,IAAI,GACtF,OAAO;CAET,OACE,2BAA2B,KAAK,IAAI,KACpC,mGAAmG,KACjG,IACF,KACA,2EAA2E,KAAK,IAAI;AAExF;AAEA,SAAgB,gBACd,OACA,MAAM,KAAK,IAAI,GACK;CACpB,IAAI,CAAC,OACH;CAEF,MAAM,MAAM,MAAM,KAAK;CACvB,IAAI,uBAAuB,KAAK,GAAG,GAAG;EACpC,MAAM,UAAU,OAAO,GAAG;EAC1B,OAAO,OAAO,SAAS,OAAO,KAAK,WAAW,IAAI,KAAK,MAAM,UAAU,GAAI,IAAI,KAAA;CACjF;CACA,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,IAAI,CAAC,OAAO,MAAM,IAAI,KAAK,QAAQ,KACjC,OAAO,OAAO;AAGlB;AAEA,SAAgB,wBACd,QACA,SACA,cAAc,IACd,MAAM,KAAK,IAAI,GACI;CACnB,MAAM,OAAO,YAAY,MAAM,GAAG,GAAI;CACtC,IAAI,WAAW,KAAK;EAClB,MAAM,QAAQ,KAAK,YAAY;EAE/B,OAAO;GACL,MAAM;GACN;GACA,OAJwB,mCAAmC,KAAK,KAAK,IAAI,OAAO;GAKhF,cAAc,gBAAgB,QAAQ,IAAI,aAAa,GAAG,GAAG;GAC7D,SAAS,QAAQ,KAAA;EACnB;CACF;CACA,IAAI,WAAW,OAAO,WAAW,KAC/B,OAAO;EAAE,MAAM;EAAQ;EAAQ,OAAO;EAAc,SAAS,QAAQ,KAAA;CAAU;CAEjF,IAAI,WAAW,OAAO,WAAW,OAAO,WAAW,OAAO,WAAW,KACnE,OAAO;EAAE,MAAM;EAAa;EAAQ,OAAO;EAAW,SAAS,QAAQ,KAAA;CAAU;CAEnF,IAAI,UAAU,KACZ,OAAO;EAAE,MAAM;EAAU;EAAQ,OAAO;EAAW,SAAS,QAAQ,KAAA;CAAU;CAEhF,OAAO;EAAE,MAAM;EAAa;EAAQ,OAAO;EAAW,SAAS,QAAQ,KAAA;CAAU;AACnF;AAEA,IAAa,mBAAb,MAA8B;CAEC;CAD7B,4BAA6B,IAAI,IAAoB;CACrD,YAAY,MAAqC,KAAK,KAAK;EAA9B,KAAA,MAAA;CAA+B;CAC5D,IAAI,KAAa,SAAuB;EACtC,IAAI,UAAU,GACZ,KAAK,UAAU,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO;CAEhD;CACA,YAAY,KAAqB;EAC/B,MAAM,WAAW,KAAK,UAAU,IAAI,GAAG;EACvC,IAAI,aAAa,KAAA,GACf,OAAO;EAET,MAAM,YAAY,WAAW,KAAK,IAAI;EACtC,IAAI,aAAa,GAAG;GAClB,KAAK,UAAU,OAAO,GAAG;GACzB,OAAO;EACT;EACA,OAAO;CACT;CACA,IAAI,OAAe;EACjB,OAAO,KAAK,UAAU;CACxB;AACF"}

package/dist/public-types.d.ts

@@ -0,0 +1,3 @@
+/** Stable domain and extension type exports for `anypick/types`. */
+export type * from './types.js';
+//# sourceMappingURL=public-types.d.ts.map

package/dist/public-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-types.d.ts","sourceRoot":"","sources":["../src/public-types.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,mBAAmB,SAAS,CAAC"}

package/dist/public.d.ts

@@ -0,0 +1,19 @@
+import type { AnyPick } from './core/app.js';
+import type { AnyPickEventSink } from './core/events.js';
+/** Options accepted by the supported programmatic application factory. */
+export interface CreateAnyPickAppOptions {
+    /** Data root. Defaults to `~/.anypick` (or `ANYPICK_HOME`). */
+    root?: string;
+    /** Optional sanitized lifecycle-event sink owned by the caller. */
+    events?: AnyPickEventSink;
+}
+/**
+ * Open a fully initialized AnyPick application.
+ *
+ * The promise resolves only after schema migration, legacy migration, plugin
+ * loading, and startup recovery have completed. The returned facade excludes
+ * SQLite, stores, journals, and leases; call `close()` when finished.
+ */
+export declare function createAnyPickApp(options?: CreateAnyPickAppOptions): Promise<AnyPick>;
+export type { AnyPick } from './core/app.js';
+//# sourceMappingURL=public.d.ts.map

package/dist/public.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.d.ts","sourceRoot":"","sources":["../src/public.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtD,0EAA0E;AAC1E,MAAM,WAAW,uBAAuB;IACtC,+DAA+D;IAC/D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,MAAM,CAAC,EAAE,gBAAgB,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,OAAO,CAAC,CAG9F;AAED,YAAY,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC"}

package/dist/public.js

@@ -0,0 +1,16 @@
+//#region src/public.ts
+/**
+* Open a fully initialized AnyPick application.
+*
+* The promise resolves only after schema migration, legacy migration, plugin
+* loading, and startup recovery have completed. The returned facade excludes
+* SQLite, stores, journals, and leases; call `close()` when finished.
+*/
+async function createAnyPickApp(options = {}) {
+	const { createAppReady } = await import("./core/app.js");
+	return createAppReady(options);
+}
+//#endregion
+export { createAnyPickApp };
+
+//# sourceMappingURL=public.js.map