sessionpipe 0.10.0 → 0.12.0

package/dist/pool/cli.d.ts

@@ -0,0 +1,39 @@
+import { type LocalReply, type LocalRequest } from "../control/local.js";
+import { type Pool } from "./index.js";
+export declare const POOL_HELP = "  sessionpipe pool [--json]                        (the accounts in order, the room each has left)\n  sessionpipe pool on | off                        (point every Claude Code here at the pool, or stop)\n  sessionpipe pool add --import | --login [--code -]\n  sessionpipe pool remove|enable|disable <id|email> | order <id|email>\u2026 | refresh [<id|email>]";
+type PoolAsk = Extract<LocalRequest, {
+    op: "pool";
+}>;
+export interface PoolCliDeps {
+    /** One request to the running daemon; null when none answers (control/local.ts). */
+    ask: (req: PoolAsk, timeoutMs: number) => Promise<LocalReply | null>;
+    /** The engine in this process, for when no daemon runs. */
+    open: () => Pool;
+    /** Write and start the daemon's service; what it did, in words (control/pair.ts). */
+    installService: () => string;
+    /** The pasted `code#state`, read without echo. */
+    readSecret: () => Promise<string>;
+    now: () => number;
+}
+/** The installed CLI by its real path, so the service outlives a reinstall's symlink. */
+export declare function cliPath(distDir: string): string;
+export declare function poolMain(argv: string[], out: (s?: string) => void, distDir: string, over?: Partial<PoolCliDeps>): Promise<void>;
+/** `pool off` for `sessionpipe uninstall` (DESIGN §2.4): nothing to say when the pool
+ *  was never on; otherwise the same lines `pool off` prints. */
+export declare function poolOffForUninstall(out: (s?: string) => void, over?: Partial<PoolCliDeps>): Promise<void>;
+/** A terminal's input, as far as reading one secret line needs. */
+export interface SecretInput {
+    isTTY?: boolean;
+    setEncoding(enc: BufferEncoding): unknown;
+    on(event: "data" | "end", cb: (d: string) => void): unknown;
+    off(event: "data", cb: (d: string) => void): unknown;
+    setRawMode?(on: boolean): unknown;
+    resume(): unknown;
+    pause(): unknown;
+}
+/** The code, pasted: everything from a pipe, or one line typed at the terminal with
+ *  echo off (raw mode; backspace edits, Ctrl-C leaves). Never an argument: a command
+ *  line is in the shell's history and in `ps`. */
+export declare function readSecret(stdin?: SecretInput, err?: (s: string) => void, exit?: (code: number) => void): Promise<string>;
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/pool/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/pool/cli.ts"],"names":[],"mappings":"AAWA,OAAO,EAAO,KAAK,UAAU,EAAE,KAAK,YAAY,EAAc,MAAM,qBAAqB,CAAC;AAI1F,OAAO,EAAY,KAAK,IAAI,EAAgC,MAAM,YAAY,CAAC;AAE/E,eAAO,MAAM,SAAS,0WAGyE,CAAC;AAEhG,KAAK,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,oFAAoF;IACpF,GAAG,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACrE,2DAA2D;IAC3D,IAAI,EAAE,MAAM,IAAI,CAAC;IACjB,qFAAqF;IACrF,cAAc,EAAE,MAAM,MAAM,CAAC;IAC7B,kDAAkD;IAClD,UAAU,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,GAAG,EAAE,MAAM,MAAM,CAAC;CACnB;AASD,yFAAyF;AACzF,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAO/C;AAUD,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,EAAE,EACd,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EACzB,OAAO,EAAE,MAAM,EACf,IAAI,GAAE,OAAO,CAAC,WAAW,CAAM,GAC9B,OAAO,CAAC,IAAI,CAAC,CA+Gf;AAED;gEACgE;AAChE,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,EAAE,IAAI,GAAE,OAAO,CAAC,WAAW,CAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAInH;AA8ED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC;IAC1C,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;IAC5D,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC;IACrD,UAAU,CAAC,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC;IAClC,MAAM,IAAI,OAAO,CAAC;IAClB,KAAK,IAAI,OAAO,CAAC;CAClB;AAED;;kDAEkD;AAClD,wBAAgB,UAAU,CACxB,KAAK,GAAE,WAA2B,EAClC,GAAG,GAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAA0C,EAC9D,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAA6B,GACpD,OAAO,CAAC,MAAM,CAAC,CAgCjB"}

package/dist/pool/credentials.d.ts

@@ -0,0 +1,44 @@
+import type { PoolCredential } from "./types.js";
+/** Refresh this long before `expires_at`. */
+export declare const REFRESH_EARLY_MS: number;
+/** Don't ask a store that just refused again before this. */
+export declare const STORE_RETRY_MS = 30000;
+/** After a refresh the token endpoint failed (not refused), wait this long before the
+ *  next try: the sinks' cadence. Never one call per request. */
+export declare const REFRESH_BACKOFF_MS: readonly [30000, 60000, 300000];
+export interface CredentialDeps {
+    now: () => number;
+    /** From the secrets store; null when it can't be read right now. */
+    load: (id: string) => PoolCredential | null;
+    /** Into the secrets store; false when it refused (the memory copy still serves). */
+    save: (id: string, c: PoolCredential) => boolean;
+    refresh: (c: PoolCredential) => Promise<PoolCredential>;
+    isAuthError: (e: unknown) => boolean;
+    log: (line: string) => void;
+}
+export type Fetched = {
+    ok: true;
+    access: string /** Refreshed within this call or the last minute. */;
+    fresh: boolean;
+} | {
+    ok: false;
+    why: "unreadable" | "sign-in" | "upstream";
+    detail: string;
+};
+export declare class Credentials {
+    private readonly deps;
+    private readonly cache;
+    private readonly inflight;
+    private readonly refusedAt;
+    private readonly refreshedAt;
+    private readonly failed;
+    constructor(deps: CredentialDeps);
+    /** Put a credential just obtained (login, import) into memory and the store. */
+    set(id: string, c: PoolCredential): boolean;
+    forget(id: string): void;
+    /** The access token to send now. `force` refreshes whatever the expiry says (a 401
+     *  on a token that wasn't fresh). */
+    get(id: string, force?: boolean): Promise<Fetched>;
+    private fetch;
+}
+//# sourceMappingURL=credentials.d.ts.map

package/dist/pool/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/pool/credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB,QAAa,CAAC;AAC3C,6DAA6D;AAC7D,eAAO,MAAM,cAAc,QAAS,CAAC;AACrC;gEACgE;AAChE,eAAO,MAAM,kBAAkB,YAAI,KAAM,EAAE,KAAM,EAAE,MAAO,CAAU,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,oEAAoE;IACpE,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,cAAc,GAAG,IAAI,CAAC;IAC5C,oFAAoF;IACpF,IAAI,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,EAAE,cAAc,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC;IACrC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,MAAM,MAAM,OAAO,GACf;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,qDAAqD,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAClG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,YAAY,GAAG,SAAS,GAAG,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE9E,qBAAa,WAAW;IAMV,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAC3D,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuC;IAChE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA6B;IACvD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA6B;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgE;IACvF,YAA6B,IAAI,EAAE,cAAc,EAAI;IAErD,gFAAgF;IAChF,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAI1C;IAED,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAKvB;IAED;yCACqC;IACrC,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,UAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAM/C;YAEa,KAAK;CAuCpB"}

package/dist/pool/import.d.ts

@@ -0,0 +1,23 @@
+import type { PoolAccount } from "./store.js";
+import type { PoolCredential } from "./types.js";
+export interface ResolvedLogin {
+    dir: string;
+    account_uuid: string;
+    email: string;
+    credential: PoolCredential;
+}
+export interface Imported {
+    added: {
+        account: PoolAccount;
+        credential: PoolCredential;
+        dir: string;
+    }[];
+    /** Logins left out: already pooled, seen twice in this run, or unreadable. */
+    skipped: {
+        dir: string;
+        email?: string;
+        why: string;
+    }[];
+}
+export declare function importLogins(logins: readonly ResolvedLogin[], accounts: readonly PoolAccount[], now: number): Imported;
+//# sourceMappingURL=import.d.ts.map

package/dist/pool/import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"import.d.ts","sourceRoot":"","sources":["../../src/pool/import.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE;QAAE,OAAO,EAAE,WAAW,CAAC;QAAC,UAAU,EAAE,cAAc,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC3E,8EAA8E;IAC9E,OAAO,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACzD;AAED,wBAAgB,YAAY,CAC1B,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,GAAG,EAAE,MAAM,GACV,QAAQ,CAkBV"}

package/dist/pool/index.d.ts

@@ -0,0 +1,138 @@
+import { type InstallReport } from "@sessionpipe/core";
+import { type Runner, type StoreName } from "../secrets.js";
+import { type Imported } from "./import.js";
+import { type PoolEnvState } from "./install.js";
+import { type AccountSummary } from "./policy.js";
+import { type PoolAccount, type PoolConfig } from "./store.js";
+import type { Exec, LimitWindow, PoolAdapter, PoolLimits } from "./types.js";
+export type { Credentials } from "./credentials.js";
+export { cleanEnv, installedPoolEnv, installPoolEnv, poolEnv, uninstallPoolEnv } from "./install.js";
+export { accountId } from "./login.js";
+export { type AccountStatus, type AccountSummary, choose, expirePins, HOLD_MS, observe, PIN_IDLE_MS, type PolicyState, SWITCH_PERCENT, summary, } from "./policy.js";
+export { type PoolServer, type PoolStats, startPoolServer } from "./server.js";
+export { type PoolAccount, type PoolConfig, poolFile, poolStateFile, readPool } from "./store.js";
+export type * from "./types.js";
+/** Idle accounts are asked for their usage this often (and at once on add/enable/refresh). */
+export declare const POLL_MS: number;
+/** The hello lists at most this many (core's hello schema). */
+export declare const ACCOUNTS_MAX = 20;
+/** How long the listener trusts its copy of the bearer before asking the store again. */
+export declare const BEARER_CACHE_MS = 5000;
+/** How long state.json may lag the pins and holds in memory. */
+export declare const PERSIST_MS = 1000;
+/** After a rotation the bearer before it is still accepted this long: a Claude Code
+ *  session keeps the token it read at its start (bb gives the same grace). */
+export declare const ROTATION_GRACE_MS: number;
+export interface PoolDeps {
+    /** core's `claudePool` unless a test says otherwise (types.ts says what of it is used). */
+    adapter?: PoolAdapter;
+    fetch?: typeof fetch;
+    now?: () => number;
+    log?: (line: string) => void;
+    env?: NodeJS.ProcessEnv;
+    /** Runs `security` / `secret-tool` for the secrets store. */
+    run?: Runner;
+    /** Runs the keychain reader for `addImport`; by default `run`, failing loudly. */
+    exec?: Exec;
+    claudeDirs?: () => string[];
+    /** PKCE randomness (tests). */
+    random?: (n: number) => Buffer;
+    onLimits?: (accountUuid: string, session: string | null, limits: PoolLimits) => void;
+    onChange?: () => void;
+    /** Where requests go (tests: the fake upstream). */
+    upstream?: string;
+    pollMs?: number;
+    /** How long state.json may lag memory (tests shorten it). */
+    persistMs?: number;
+}
+export type PoolErrorCode = "pool_account" | "pool_order" | "pool_off" | "login" | "pool";
+export declare class PoolError extends Error {
+    readonly code: PoolErrorCode;
+    constructor(code: PoolErrorCode, message: string);
+}
+export interface HelloPoolAccount {
+    /** The account uuid: joins with `limits.observed.account_id` and `session.account_id`. */
+    id: string;
+    email?: string;
+    label?: string;
+    enabled: boolean;
+    status: AccountSummary["status"];
+    current: boolean;
+    until?: string;
+    windows?: LimitWindow[];
+    limited_by?: string;
+}
+export interface HelloPool {
+    on: boolean;
+    harness: "claude-code";
+    accounts: HelloPoolAccount[];
+}
+export interface PoolStatus {
+    on: boolean;
+    port: number;
+    /** The listener is up in this process. */
+    listening: boolean;
+    /** Another daemon answers on pool.json's port; this process stood down (start()). */
+    another_daemon?: true;
+    /** The last bearer rotation; the one before is accepted until ROTATION_GRACE_MS after. */
+    rotated_at?: string;
+    /** Requests it is answering right now (0 when it isn't up). */
+    in_flight: number;
+    settings: {
+        file: string;
+        state: PoolEnvState;
+        note?: string;
+    }[];
+    accounts: (PoolAccount & AccountSummary & {
+        limits?: PoolLimits;
+    })[];
+    pending?: {
+        id: string;
+        url: string;
+        expires_at: string;
+    };
+}
+export interface Pool {
+    start(): Promise<{
+        port: number;
+        moved: boolean;
+        other?: true;
+    }>;
+    stop(): Promise<void>;
+    setOn(on: boolean): Promise<InstallReport[]>;
+    beginLogin(): {
+        id: string;
+        url: string;
+        expires_at: string;
+    };
+    completeLogin(code: string, pendingId?: string): Promise<PoolAccount>;
+    requireOn(): void;
+    addImport(): Promise<Imported>;
+    remove(ref: string): PoolAccount;
+    enable(ref: string): PoolAccount;
+    disable(ref: string): PoolAccount;
+    order(refs: readonly string[]): PoolAccount[];
+    refresh(ref?: string): Promise<void>;
+    find(ref: string): PoolAccount | null;
+    accounts(): PoolAccount[];
+    status(): PoolStatus;
+    helloPool(): HelloPool;
+    /** Move the bearer and every credential into another store and pin it there. */
+    moveSecrets(to: StoreName): {
+        moved: string[];
+        kept: string[];
+    };
+    /** A new bearer now (settings rewritten while on); the old one is good for
+     *  ROTATION_GRACE_MS more. */
+    rotate(): InstallReport[];
+    readonly config: PoolConfig;
+}
+/** The pool in one line, for an ack's `detail` and the first line of `sessionpipe pool`
+ *  (CONTROL.md §6): `on · 3 accounts · 2 with room · serving Fiction`. */
+export declare function summaryLine(s: Pick<PoolStatus, "on" | "accounts">): string;
+/** The origins the adapter talks to: the API and its OAuth endpoints. */
+export declare function vendorOrigins(adapter: Pick<PoolAdapter, "POOL_ENDPOINTS">): string[];
+/** A fetch whose requests to any of `origins` go to `to` instead, path and query kept. */
+export declare function rerouted(fetchFn: typeof fetch, origins: readonly string[], to: string): typeof fetch;
+export declare function openPool(deps: PoolDeps): Pool;
+//# sourceMappingURL=index.d.ts.map

package/dist/pool/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/pool/index.ts"],"names":[],"mappings":"AAwDA,OAAO,EAA4C,KAAK,aAAa,EAAY,MAAM,mBAAmB,CAAC;AAC3G,OAAO,EAA4B,KAAK,MAAM,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAEtF,OAAO,EAAE,KAAK,QAAQ,EAAoC,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAoC,KAAK,YAAY,EAAoB,MAAM,cAAc,CAAC;AAErG,OAAO,EAAE,KAAK,cAAc,EAAkD,MAAM,aAAa,CAAC;AAElG,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,UAAU,EAWhB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,IAAI,EAAmB,WAAW,EAAE,WAAW,EAAE,UAAU,EAAe,MAAM,YAAY,CAAC;AAE3G,YAAY,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACrG,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,MAAM,EACN,UAAU,EACV,OAAO,EACP,OAAO,EACP,WAAW,EACX,KAAK,WAAW,EAChB,cAAc,EACd,OAAO,GACR,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,UAAU,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAClG,mBAAmB,YAAY,CAAC;AAEhC,8FAA8F;AAC9F,eAAO,MAAM,OAAO,QAAa,CAAC;AAClC,+DAA+D;AAC/D,eAAO,MAAM,YAAY,KAAK,CAAC;AAC/B,yFAAyF;AACzF,eAAO,MAAM,eAAe,OAAQ,CAAC;AACrC,gEAAgE;AAChE,eAAO,MAAM,UAAU,OAAQ,CAAC;AAChC;8EAC8E;AAC9E,eAAO,MAAM,iBAAiB,QAAc,CAAC;AAE7C,MAAM,WAAW,QAAQ;IACvB,2FAA2F;IAC3F,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,6DAA6D;IAC7D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,MAAM,EAAE,CAAC;IAC5B,+BAA+B;IAC/B,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/B,QAAQ,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACrF,QAAQ,CAAC,EAAE,MAAM,IAAI,CAAC;IACtB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,cAAc,GAAG,YAAY,GAAG,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAC1F,qBAAa,SAAU,SAAQ,KAAK;IAEhC,QAAQ,CAAC,IAAI,EAAE,aAAa;IAD9B,YACW,IAAI,EAAE,aAAa,EAC5B,OAAO,EAAE,MAAM,EAGhB;CACF;AAED,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AACD,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,0CAA0C;IAC1C,SAAS,EAAE,OAAO,CAAC;IACnB,qFAAqF;IACrF,cAAc,CAAC,EAAE,IAAI,CAAC;IACtB,0FAA0F;IAC1F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,YAAY,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjE,QAAQ,EAAE,CAAC,WAAW,GAAG,cAAc,GAAG;QAAE,MAAM,CAAC,EAAE,UAAU,CAAA;KAAE,CAAC,EAAE,CAAC;IACrE,OAAO,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3D;AAED,MAAM,WAAW,IAAI;IACnB,KAAK,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IACjE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAC7C,UAAU,IAAI;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IAC9D,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtE,SAAS,IAAI,IAAI,CAAC;IAClB,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAAC;IACjC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,CAAC;IAClC,KAAK,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;IACtC,QAAQ,IAAI,WAAW,EAAE,CAAC;IAC1B,MAAM,IAAI,UAAU,CAAC;IACrB,SAAS,IAAI,SAAS,CAAC;IACvB,gFAAgF;IAChF,WAAW,CAAC,EAAE,EAAE,SAAS,GAAG;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChE;kCAC8B;IAC9B,MAAM,IAAI,aAAa,EAAE,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED;0EAC0E;AAC1E,wBAAgB,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,UAAU,CAAC,GAAG,MAAM,CAQ1E;AAED,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,GAAG,MAAM,EAAE,CASpF;AAED,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,KAAK,CAUpG;AAED,wBAAgB,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CAyhB7C"}

package/dist/pool/install.d.ts

@@ -0,0 +1,46 @@
+import type { InstallReport } from "@sessionpipe/core";
+export declare const POOL_ENV_KEYS: readonly ["ANTHROPIC_BASE_URL", "ANTHROPIC_AUTH_TOKEN", "_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL"];
+export declare const poolBaseUrl: (port: number) => string;
+/** The three values for a listener on `port` with bearer `token`. */
+export declare function poolEnv(port: number, token: string): Record<(typeof POOL_ENV_KEYS)[number], string>;
+/** What identifies a block as ours: this listener, or the one it moved from, or this
+ *  token, or the one before it while a rotation is under way. */
+export interface Ours {
+    port: number;
+    token: string;
+    /** The port before the listener moved (pool.json's `last_port`). */
+    lastPort?: number | undefined;
+    /** The bearer before `pool on` minted this one. */
+    lastToken?: string | undefined;
+    /** Where the original bytes of a changed file are kept for `off` (see the header). */
+    keep?: string | undefined;
+}
+/** Write the block into each config dir's settings.json. */
+export declare function installPoolEnv(dirs: readonly string[], o: Ours): InstallReport[];
+/** Remove exactly what we wrote. `created` names the files `pool on` made, deleted
+ *  again once nothing else is in them. */
+export declare function uninstallPoolEnv(dirs: readonly string[], o: Ours & {
+    created?: readonly string[];
+}): InstallReport[];
+export type PoolEnvState = 
+/** Our block, pointing at this port with this token. */
+"current"
+/** Our block, but another port or token: `pool on` again rewrites it. */
+ | "stale" | "missing"
+/** Someone else's base URL or token: that config dir does not go through the pool. */
+ | "other"
+/** A config dir anyone else can write to: `pool on` won't put a token there. */
+ | "unsafe" | "unreadable";
+/** Per settings.json: does Claude Code there go through this listener? */
+export declare function installedPoolEnv(dirs: readonly string[], o: Ours): {
+    file: string;
+    state: PoolEnvState;
+    note?: string;
+}[];
+/** An environment for a child that must talk to the vendor directly: the pool's
+ *  variables (and bb's, which are the same names) taken out. Note what it is not: Claude
+ *  Code also reads `env` from settings.json, so a `claude` child still goes through the
+ *  pool while it is on; `claude auth status` needs no network and is unaffected either
+ *  way. The daemon's own usage polls use fetch, never Claude Code. */
+export declare function cleanEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+//# sourceMappingURL=install.d.ts.map

package/dist/pool/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/pool/install.ts"],"names":[],"mappings":"AAqCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAEvD,eAAO,MAAM,aAAa,YACxB,oBAAoB,EACpB,sBAAsB,EACtB,0CAA0C,CAClC,CAAC;AAEX,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,MAAoC,CAAC;AAEhF,qEAAqE;AACrE,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAMnG;AAED;iEACiE;AACjE,MAAM,WAAW,IAAI;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,mDAAmD;IACnD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,sFAAsF;IACtF,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AA+FD,4DAA4D;AAC5D,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG,aAAa,EAAE,CAyChF;AAED;0CAC0C;AAC1C,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,GAAG;IAAE,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAAG,aAAa,EAAE,CA8BpH;AAED,MAAM,MAAM,YAAY;AACtB,wDAAwD;AACtD,SAAS;AACX,yEAAyE;GACvE,OAAO,GACP,SAAS;AACX,sFAAsF;GACpF,OAAO;AACT,gFAAgF;GAC9E,QAAQ,GACR,YAAY,CAAC;AAEjB,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,CAAC,EAAE,IAAI,GACN;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,YAAY,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,CAcxD;AAED;;;;sEAIsE;AACtE,wBAAgB,QAAQ,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAIhF"}

package/dist/pool/login.d.ts

@@ -0,0 +1,27 @@
+import type { PoolAccount, PoolState } from "./store.js";
+import type { PoolAdapter, PoolCredential, PoolProfile } from "./types.js";
+export declare const LOGIN_TTL_MS: number;
+export type Pending = NonNullable<PoolState["pending"]>;
+/** The pool's id for an account: eight hex digits of its uuid, like a session's short
+ *  id, the same on every machine that pools it. */
+export declare const accountId: (accountUuid: string) => string;
+export declare function beginLogin(adapter: Pick<PoolAdapter, "beginLogin">, now: number, random?: (n: number) => Buffer): Pending;
+/** The pending login `id` names, still valid; null with why not. */
+export declare function pendingLogin(pending: Pending | undefined, id: string | undefined, now: number): {
+    pending: Pending;
+} | {
+    why: "no_pending" | "login_expired" | "unknown_login";
+};
+/** A record for a profile, or the existing record of the same account brought up to
+ *  date (a login repeated for an account already in the pool refreshes its credential
+ *  and its email, never makes a twin). */
+export declare function accountFor(accounts: readonly PoolAccount[], profile: PoolProfile, now: number): {
+    account: PoolAccount;
+    existed: boolean;
+};
+export declare function completeLogin(adapter: Pick<PoolAdapter, "completeLogin">, fetch: typeof globalThis.fetch, pending: Pending, code: string, accounts: readonly PoolAccount[], now: number): Promise<{
+    account: PoolAccount;
+    existed: boolean;
+    credential: PoolCredential;
+}>;
+//# sourceMappingURL=login.d.ts.map

package/dist/pool/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/pool/login.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE3E,eAAO,MAAM,YAAY,QAAc,CAAC;AAExC,MAAM,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AAExD;mDACmD;AACnD,eAAO,MAAM,SAAS,gBAAiB,MAAM,KAAG,MAAkD,CAAC;AAEnG,wBAAgB,UAAU,CACxB,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,EACxC,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAC7B,OAAO,CAST;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAC1B,OAAO,EAAE,OAAO,GAAG,SAAS,EAC5B,EAAE,EAAE,MAAM,GAAG,SAAS,EACtB,GAAG,EAAE,MAAM,GACV;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,YAAY,GAAG,eAAe,GAAG,eAAe,CAAA;CAAE,CAKlF;AAED;;0CAE0C;AAC1C,wBAAgB,UAAU,CACxB,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,OAAO,EAAE,WAAW,EACpB,GAAG,EAAE,MAAM,GACV;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAa5C;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,EAC3C,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,EAC9B,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,SAAS,WAAW,EAAE,EAChC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,cAAc,CAAA;CAAE,CAAC,CAGjF"}

package/dist/pool/policy.d.ts

@@ -0,0 +1,100 @@
+import type { LimitWindow, PoolLimits } from "./types.js";
+/** A window this full sends new work elsewhere (bb's threshold; Claude Code's own
+ *  footer turns red about there). */
+export declare const SWITCH_PERCENT = 98;
+/** A session that sent nothing for this long is no longer pinned. */
+export declare const PIN_IDLE_MS: number;
+/** How long an account rests after an upstream 5xx or a 429 that named no reset. */
+export declare const HOLD_MS = 60000;
+/** A `rejected` status with no window naming a reset is believed this long. */
+export declare const REJECTED_MS: number;
+/** The longest a Retry-After is believed: a vendor's typo must not park an account for a year. */
+export declare const MAX_HOLD_MS: number;
+/** Pins kept at most; the oldest go first. A caller inventing session ids fills nothing
+ *  but this. */
+export declare const PINS_MAX = 4096;
+export interface AccountState {
+    id: string;
+    enabled: boolean;
+    /** Why the account can't serve until a person acts (`sign in again`). */
+    error?: string;
+    /** Out of the rotation until this time (ms): a 429's Retry-After, a 5xx rest. */
+    hold_until?: number;
+    /** When the hold was set. A clock that then went backwards (NTP on a laptop) would
+     *  stretch a minute's rest into an hour; a hold set in the future is cut to HOLD_MS. */
+    hold_at?: number;
+    /** Why: `limit` (a 429 or a `rejected`: the pool knows the answer and says it itself)
+     *  or `upstream` (a 5xx rest: the upstream's own answer still passes through). */
+    hold_why?: "limit" | "upstream";
+    /** The freshest numbers, whatever their source, and when they were taken (ms). */
+    limits?: PoolLimits;
+    limits_at?: number;
+}
+export interface Pin {
+    account: string;
+    /** Last request at (ms). */
+    used: number;
+}
+export interface PolicyState {
+    /** In the person's order. */
+    accounts: AccountState[];
+    /** Session uuid → the account serving it. */
+    pins: Record<string, Pin>;
+}
+export type Observation = PoolLimits | {
+    status: 429;
+    retryAfterMs?: number;
+} | {
+    upstream5xx: true;
+} | {
+    error: string;
+} | {
+    error: null;
+};
+export type Reason = "pinned" | "first-with-room" | "moved" | "none";
+/** When the account has room again, as far as its numbers say; null when it has room
+ *  now, or when nothing says (an error, disabled). */
+export declare function roomAt(a: AccountState, now: number): number | null;
+export declare const hasRoom: (a: AccountState, now: number) => boolean;
+/** The account a request goes to. A pinned session stays while its account has room
+ *  (and isn't excluded: the retry after a 429 names the account that just refused). */
+export declare function choose(state: PolicyState, o: {
+    session?: string | undefined;
+    now: number;
+    exclude?: readonly string[];
+}): {
+    account: AccountState | null;
+    reason: Reason;
+};
+/** Record that `session` was just served by `account`. Only a uuid-shaped session id
+ *  (Claude Code's) is pinned: anything else is a caller's string, not a session. */
+export declare function pin(state: PolicyState, session: string | undefined, account: string, now: number): void;
+/** Forget pins idle for PIN_IDLE_MS and pins to accounts no longer in the pool. */
+export declare function expirePins(state: PolicyState, now: number): number;
+/** Take in what was just learnt about an account. Newest wins. Returns whether the
+ *  account's windows changed (the daemon appends a `limits.observed` then) — a 429, a
+ *  5xx or an error changes its standing, not its numbers. */
+export declare function observe(state: PolicyState, accountId: string, what: Observation, now: number): boolean;
+export type AccountStatus = "ready" | "limited" | "error" | "disabled";
+export interface AccountSummary {
+    id: string;
+    status: AccountStatus;
+    /** Serving new sessions now: the first with room. */
+    current: boolean;
+    /** Limited: when it has room again, RFC 3339, if known. */
+    until?: string;
+    /** The fullest window, for a status line. */
+    used_percent?: number;
+    /** The freshest numbers, from headers or the idle poll (1–8 windows). */
+    windows?: LimitWindow[];
+    /** What took it out: the window that is full (the one that resets last when
+     *  several are), else the window a `rejected` status named (`claim`), else
+     *  `rejected` for a 429 / a 5xx rest, `error` for a sign-in needed. Only with
+     *  status limited or error. */
+    limited_by?: string;
+}
+/** What the hello and `pool status` say per account. */
+export declare function summary(state: PolicyState, now: number): AccountSummary[];
+/** How many accounts have room now (the /health answer). */
+export declare const withRoom: (state: PolicyState, now: number) => number;
+//# sourceMappingURL=policy.d.ts.map

package/dist/pool/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/pool/policy.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D;qCACqC;AACrC,eAAO,MAAM,cAAc,KAAK,CAAC;AACjC,qEAAqE;AACrE,eAAO,MAAM,WAAW,QAAc,CAAC;AACvC,oFAAoF;AACpF,eAAO,MAAM,OAAO,QAAS,CAAC;AAC9B,+EAA+E;AAC/E,eAAO,MAAM,WAAW,QAAa,CAAC;AACtC,kGAAkG;AAClG,eAAO,MAAM,WAAW,QAAc,CAAC;AACvC;gBACgB;AAChB,eAAO,MAAM,QAAQ,OAAO,CAAC;AAG7B,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;4FACwF;IACxF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;sFACkF;IAClF,QAAQ,CAAC,EAAE,OAAO,GAAG,UAAU,CAAC;IAChC,kFAAkF;IAClF,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,6BAA6B;IAC7B,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAC3B;AAED,MAAM,MAAM,WAAW,GACnB,UAAU,GACV;IAAE,MAAM,EAAE,GAAG,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,WAAW,EAAE,IAAI,CAAA;CAAE,GACrB;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,GACjB;IAAE,KAAK,EAAE,IAAI,CAAA;CAAE,CAAC;AAEpB,MAAM,MAAM,MAAM,GAAG,QAAQ,GAAG,iBAAiB,GAAG,OAAO,GAAG,MAAM,CAAC;AAyBrE;sDACsD;AACtD,wBAAgB,MAAM,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBlE;AAED,eAAO,MAAM,OAAO,MAAO,YAAY,OAAO,MAAM,KAAG,OAA2D,CAAC;AAEnH;uFACuF;AACvF,wBAAgB,MAAM,CACpB,KAAK,EAAE,WAAW,EAClB,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC5E;IAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAUlD;AAED;oFACoF;AACpF,wBAAgB,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CASvG;AAED,mFAAmF;AACnF,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CASlE;AAKD;;6DAE6D;AAC7D,wBAAgB,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAgDtG;AAED,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AAEvE,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,aAAa,CAAC;IACtB,qDAAqD;IACrD,OAAO,EAAE,OAAO,CAAC;IACjB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB;;;mCAG+B;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAaD,wDAAwD;AACxD,wBAAgB,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,EAAE,CAgBzE;AAED,4DAA4D;AAC5D,eAAO,MAAM,QAAQ,UAAW,WAAW,OAAO,MAAM,KAAG,MACL,CAAC"}

package/dist/pool/server.d.ts

@@ -0,0 +1,76 @@
+import type { Credentials } from "./credentials.js";
+import { type PolicyState } from "./policy.js";
+import type { PoolAdapter, PoolLimits } from "./types.js";
+export declare const BODY_CAP: number;
+export interface PoolServerDeps {
+    adapter: Pick<PoolAdapter, "POOL_ENDPOINTS" | "readLimits" | "parseUserId" | "withAccount" | "upstreamHeaders">;
+    fetch: typeof fetch;
+    now: () => number;
+    /** Nothing secret ever goes in: account ids, statuses, timings. */
+    log: (line: string) => void;
+    /** The port pool.json remembers; 0 or taken: a free one is picked. */
+    port: number;
+    /** The bearers Claude Code may present: the current one (settings.json) and, for a
+     *  while after a rotation, the one before it, so a session that started with the old
+     *  token keeps working. Read on every request, since `pool on` mints in another
+     *  process. Null: the secrets store can't be read right now, which is a 503, not an
+     *  unknown bearer. */
+    token: () => readonly string[] | null;
+    on: () => boolean;
+    /** Shared with the façade and mutated here through choose/observe/pin. */
+    state: PolicyState;
+    accountUuid: (id: string) => string | null;
+    credentials: Credentials;
+    /** The state changed (a pin, a hold, fresh numbers): write it down. */
+    persist: () => void;
+    /** An account's windows changed on a request: the daemon's `limits.observed`.
+     *  `accountId` is the pool's id; the façade maps it to the account uuid. */
+    onLimits: (accountId: string, session: string | null, limits: PoolLimits) => void;
+    /** An account's standing changed (held, in error): the daemon sends a hello. */
+    onStanding?: () => void;
+    /** Where requests go (tests: the fake upstream). */
+    upstream?: string;
+    bodyCap?: number;
+}
+export interface PoolStats {
+    requests: number;
+    upstream: number;
+    retries: number;
+    /** Answered with our own 429: no account could even be tried. */
+    refused: number;
+    /** Requests whose client left before the answer ended. */
+    aborted: number;
+    /** Requests being answered right now (the daemon's busy(): never restart mid-stream). */
+    in_flight: number;
+}
+export interface PoolServer {
+    port: number;
+    /** True when the port isn't the one asked for: settings.json must be rewritten. */
+    moved: boolean;
+    stats: PoolStats;
+    close(): Promise<void>;
+}
+/** The path as the upstream will read it, or null for one it must never see: each
+ *  segment percent-decoded once (an upstream router decodes before it routes, so the
+ *  deny list has to read what the router reads), then refused if anything is still
+ *  encoded (`%` left over: a double encoding), if a decoded byte is a slash, a
+ *  backslash, whitespace or a control character (an encoded separator or an odd byte
+ *  Claude Code never sends), if a segment is empty or a dot segment (`//`, `%2e%2e`),
+ *  or if a segment does not decode at all. What comes back is re-encoded per segment,
+ *  so what was checked is what is sent. */
+export declare function normalPath(pathname: string): string | null;
+/** The upstream URL for a request-target, or why not. Built from the parsed, then
+ *  normalised path (normalPath), compared lower-cased: the upstream's routes are not
+ *  case-sensitive in any way the pool should bet on. */
+export declare function upstreamUrl(target: string, base: string): {
+    url: string;
+} | {
+    status: 400 | 403;
+    why: string;
+};
+/** The Host this loopback answers to: itself, by address or name, with its own port. */
+export declare function hostOk(host: string | undefined, port: number): boolean;
+/** A bearer compared in constant time, whatever its length: both sides are hashed first. */
+export declare function bearerOk(header: string | undefined, token: string): boolean;
+export declare function startPoolServer(deps: PoolServerDeps): Promise<PoolServer>;
+//# sourceMappingURL=server.d.ts.map

package/dist/pool/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/pool/server.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAsC,KAAK,WAAW,EAAyB,MAAM,aAAa,CAAC;AAC1G,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE1D,eAAO,MAAM,QAAQ,QAAmB,CAAC;AAEzC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,gBAAgB,GAAG,YAAY,GAAG,aAAa,GAAG,aAAa,GAAG,iBAAiB,CAAC,CAAC;IAChH,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,mEAAmE;IACnE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb;;;;0BAIsB;IACtB,KAAK,EAAE,MAAM,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACtC,EAAE,EAAE,MAAM,OAAO,CAAC;IAClB,0EAA0E;IAC1E,KAAK,EAAE,WAAW,CAAC;IACnB,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;IAC3C,WAAW,EAAE,WAAW,CAAC;IACzB,uEAAuE;IACvE,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB;gFAC4E;IAC5E,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IAClF,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,IAAI,CAAC;IACxB,oDAAoD;IACpD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,yFAAyF;IACzF,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,KAAK,EAAE,OAAO,CAAC;IACf,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAqCD;;;;;;;2CAO2C;AAC3C,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAc1D;AAED;;wDAEwD;AACxD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAU9G;AAED,wFAAwF;AACxF,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAGtE;AAED,4FAA4F;AAC5F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAQ3E;AAuCD,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAwRzE"}

package/dist/pool/store.d.ts

@@ -0,0 +1,89 @@
+import { type Runner, type StoreName } from "../secrets.js";
+import type { AccountState, Pin } from "./policy.js";
+import type { PendingLogin, PoolCredential, PoolLimits } from "./types.js";
+export interface PoolAccount {
+    /** The pool's short id for the account (eight hex digits of its uuid, short-id.ts). */
+    id: string;
+    label?: string;
+    email: string;
+    /** Claude Code's account uuid: what events and the hello name (DESIGN §2.3). */
+    account_uuid: string;
+    enabled: boolean;
+    added_at: string;
+}
+export interface PoolConfig {
+    on: boolean;
+    /** 0 until the listener first picks one. */
+    port: number;
+    /** The port before the last move: a settings.json still naming it is still ours. */
+    last_port?: number;
+    /** Where the secrets live, pinned when the first one is written (`file` included, so
+     *  a later terminal with a keychain never picks another store); absent only before
+     *  that, or in a pool.json from before this field, which means the file. */
+    secrets_in?: StoreName;
+    accounts: PoolAccount[];
+    /** settings.json files `pool on` created, so `pool off` can delete them again. */
+    created?: string[];
+    /** When the bearer was last rotated (`pool on` again, `rotate`): the one before it is
+     *  still accepted for a while after, for sessions that started with it. */
+    rotated_at?: string;
+}
+export interface PoolStateAccount {
+    hold_until?: number;
+    hold_at?: number;
+    hold_why?: "limit" | "upstream";
+    error?: string;
+    limits?: PoolLimits;
+    limits_at?: number;
+}
+export interface PoolState {
+    pins: Record<string, Pin>;
+    accounts: Record<string, PoolStateAccount>;
+    pending?: PendingLogin & {
+        id: string;
+        expires_at: number;
+    };
+}
+export declare const poolFile: (env?: NodeJS.ProcessEnv) => string;
+export declare const poolSecretsFile: (env?: NodeJS.ProcessEnv) => string;
+export declare const poolStateFile: (env?: NodeJS.ProcessEnv) => string;
+/** pool.json as read: defensive, every account checked, anything off the shape dropped. */
+export declare function readPool(env?: NodeJS.ProcessEnv): PoolConfig;
+export declare const writePool: (c: PoolConfig, env?: NodeJS.ProcessEnv) => void;
+export declare function readPoolState(env?: NodeJS.ProcessEnv): PoolState;
+export declare const writePoolState: (s: PoolState, env?: NodeJS.ProcessEnv) => void;
+/** The policy's view: the config's accounts in order, each with its remembered standing. */
+export declare function policyAccounts(cfg: PoolConfig, st: PoolState): AccountState[];
+/** Write the policy's accounts back into the state (the config keeps `enabled`). */
+export declare function keepStanding(st: PoolState, accounts: AccountState[]): void;
+export declare const TOKEN_NAME = "pool:token";
+/** The bearer before the last rotation, kept for the grace period. */
+export declare const PREVIOUS_TOKEN_NAME = "pool:token.previous";
+export declare const credentialName: (id: string) => string;
+/** The pool's secrets, wherever they live. `secrets_in` picks the keychain or the
+ *  Secret Service; otherwise pool.secrets.json, which is what a headless machine has. A
+ *  store that can't be read right now (a keychain locked with nobody at the screen)
+ *  answers null; the caller keeps what it has in memory and asks again later. */
+export declare class PoolSecrets {
+    private readonly env;
+    private readonly run;
+    constructor(env?: NodeJS.ProcessEnv, run?: Runner);
+    /** Where secrets go: `secrets_in` from pool.json, else the file. */
+    store(cfg: PoolConfig): StoreName;
+    get(cfg: PoolConfig, name: string): string | null;
+    /** The value, and whether a missing one is really missing or the store can't be
+     *  read right now (a 0000 file, a locked keychain): the listener answers those two
+     *  differently. The keychain is probed only when an item came back empty. */
+    read(cfg: PoolConfig, name: string): {
+        value: string | null;
+        unreadable: boolean;
+    };
+    /** False when the store refused (then nothing was written anywhere). */
+    set(cfg: PoolConfig, name: string, value: string): boolean;
+    del(cfg: PoolConfig, name: string): void;
+    /** A credential is JSON, base64url: `security -i` takes a double-quoted word, so
+     *  the quotes and spaces of JSON could never go into the keychain as they are. */
+    credential(cfg: PoolConfig, id: string): PoolCredential | null;
+    setCredential(cfg: PoolConfig, id: string, c: PoolCredential): boolean;
+}
+//# sourceMappingURL=store.d.ts.map