@almightygpt/core 0.10.0 → 0.10.1

package/dist/auth/__tests__/keychain.test.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Keychain adapter tests.
+ *
+ * Strategy (addresses Codex's v0.8 plan-review R3 — "KeychainAdapter
+ * dependency injection"): we mock the dynamic import of
+ * `@napi-rs/keyring` itself, replacing the Entry class with a fake
+ * we control per test. This sidesteps needing to refactor the real
+ * code to accept an injected adapter — the dynamic-import boundary
+ * IS the seam we test against.
+ *
+ * Codex's main concern (P2 #4) was that read failures were silently
+ * converted into "absent". These tests prove the new behavior:
+ *   - found    → { kind: "found", key }
+ *   - absent   → { kind: "absent" }
+ *   - throws   → { kind: "error", message }  (was: silently dropped)
+ */
+export {};
+//# sourceMappingURL=keychain.test.d.ts.map

package/dist/auth/__tests__/keychain.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/keychain.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG"}

package/dist/auth/__tests__/keychain.test.js

@@ -0,0 +1,155 @@
+/**
+ * Keychain adapter tests.
+ *
+ * Strategy (addresses Codex's v0.8 plan-review R3 — "KeychainAdapter
+ * dependency injection"): we mock the dynamic import of
+ * `@napi-rs/keyring` itself, replacing the Entry class with a fake
+ * we control per test. This sidesteps needing to refactor the real
+ * code to accept an injected adapter — the dynamic-import boundary
+ * IS the seam we test against.
+ *
+ * Codex's main concern (P2 #4) was that read failures were silently
+ * converted into "absent". These tests prove the new behavior:
+ *   - found    → { kind: "found", key }
+ *   - absent   → { kind: "absent" }
+ *   - throws   → { kind: "error", message }  (was: silently dropped)
+ */
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { _resetKeychainCache } from "../keychain.js";
+// Track the entry methods per test so we can rewire mid-suite.
+let mockGetPassword;
+let mockSetPassword;
+let mockDeletePassword;
+let constructorThrows = false;
+let importThrows = false;
+vi.mock("@napi-rs/keyring", () => ({
+    get Entry() {
+        if (importThrows)
+            throw new Error("synthetic import failure");
+        return class FakeEntry {
+            constructor(_service, _account) {
+                if (constructorThrows) {
+                    throw new Error("native binding refused to initialize");
+                }
+            }
+            getPassword() {
+                return mockGetPassword();
+            }
+            setPassword(p) {
+                mockSetPassword(p);
+            }
+            deletePassword() {
+                return mockDeletePassword();
+            }
+        };
+    },
+}));
+import { getKeychain } from "../keychain.js";
+beforeEach(() => {
+    _resetKeychainCache();
+    mockGetPassword = () => null;
+    mockSetPassword = () => { };
+    mockDeletePassword = () => true;
+    constructorThrows = false;
+    importThrows = false;
+});
+describe("keychain adapter — availability", () => {
+    it("reports available=true when native binding loads cleanly", async () => {
+        const kc = await getKeychain();
+        expect(kc.available).toBe(true);
+        expect(kc.describeBackend()).not.toContain("unavailable");
+    });
+    it("reports available=false + reason when native binding throws on init", async () => {
+        constructorThrows = true;
+        const kc = await getKeychain();
+        expect(kc.available).toBe(false);
+        expect(kc.describeBackend()).toContain("unavailable");
+        expect(kc.describeBackend()).toMatch(/initialize|native/i);
+    });
+    it("get on unavailable adapter returns { kind: 'absent' } (not throw)", async () => {
+        constructorThrows = true;
+        const kc = await getKeychain();
+        const r = await kc.get("openai");
+        expect(r).toEqual({ kind: "absent" });
+    });
+    it("set on unavailable adapter throws with a clear hint", async () => {
+        constructorThrows = true;
+        const kc = await getKeychain();
+        await expect(kc.set("openai", "x")).rejects.toThrow(/unavailable|environment/i);
+    });
+});
+describe("keychain adapter — get behavior (Codex P2 #4 regression coverage)", () => {
+    it("found path returns { kind: 'found', key }", async () => {
+        mockGetPassword = () => "stored-secret";
+        const kc = await getKeychain();
+        const r = await kc.get("anthropic");
+        expect(r).toEqual({ kind: "found", key: "stored-secret" });
+    });
+    it("absent path returns { kind: 'absent' } when getPassword returns null", async () => {
+        mockGetPassword = () => null;
+        const kc = await getKeychain();
+        const r = await kc.get("openai");
+        expect(r).toEqual({ kind: "absent" });
+    });
+    it("error path returns { kind: 'error', message } when getPassword throws — NOT silently absent", async () => {
+        mockGetPassword = () => {
+            throw new Error("keyring locked by OS");
+        };
+        const kc = await getKeychain();
+        const r = await kc.get("openai");
+        expect(r.kind).toBe("error");
+        if (r.kind === "error") {
+            expect(r.message).toContain("keyring locked");
+        }
+    });
+    it("error path preserves non-Error throws via String(err)", async () => {
+        mockGetPassword = () => {
+            throw "raw string error";
+        };
+        const kc = await getKeychain();
+        const r = await kc.get("openai");
+        expect(r.kind).toBe("error");
+        if (r.kind === "error") {
+            expect(r.message).toContain("raw string error");
+        }
+    });
+});
+describe("keychain adapter — set / remove", () => {
+    it("set forwards the key to the underlying Entry", async () => {
+        const writes = [];
+        mockSetPassword = (p) => writes.push(p);
+        const kc = await getKeychain();
+        await kc.set("google", "new-key");
+        expect(writes).toEqual(["new-key"]);
+    });
+    it("remove returns true when entry existed", async () => {
+        mockDeletePassword = () => true;
+        const kc = await getKeychain();
+        const removed = await kc.remove("openai");
+        expect(removed).toBe(true);
+    });
+    it("remove returns false (not throws) when entry didn't exist", async () => {
+        mockDeletePassword = () => {
+            throw new Error("not found");
+        };
+        const kc = await getKeychain();
+        const removed = await kc.remove("openai");
+        expect(removed).toBe(false);
+    });
+});
+describe("keychain adapter — caching", () => {
+    it("getKeychain returns the same instance across calls (singleton)", async () => {
+        const a = await getKeychain();
+        const b = await getKeychain();
+        expect(a).toBe(b);
+    });
+    it("_resetKeychainCache forces a fresh load on next getKeychain", async () => {
+        const a = await getKeychain();
+        _resetKeychainCache();
+        constructorThrows = true; // change behavior between loads
+        const b = await getKeychain();
+        expect(a.available).toBe(true);
+        expect(b.available).toBe(false);
+    });
+});
+//# sourceMappingURL=keychain.test.js.map

package/dist/auth/__tests__/keychain.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/keychain.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,+DAA+D;AAC/D,IAAI,eAAoC,CAAC;AACzC,IAAI,eAAsC,CAAC;AAC3C,IAAI,kBAAiC,CAAC;AACtC,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B,IAAI,YAAY,GAAG,KAAK,CAAC;AAEzB,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,IAAI,KAAK;QACP,IAAI,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9D,OAAO,MAAM,SAAS;YACpB,YAAY,QAAgB,EAAE,QAAgB;gBAC5C,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;YACD,WAAW;gBACT,OAAO,eAAe,EAAE,CAAC;YAC3B,CAAC;YACD,WAAW,CAAC,CAAS;gBACnB,eAAe,CAAC,CAAC,CAAC,CAAC;YACrB,CAAC;YACD,cAAc;gBACZ,OAAO,kBAAkB,EAAE,CAAC;YAC9B,CAAC;SACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC,CAAC;AAEJ,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,UAAU,CAAC,GAAG,EAAE;IACd,mBAAmB,EAAE,CAAC;IACtB,eAAe,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;IAC7B,eAAe,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IAC3B,kBAAkB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;IAChC,iBAAiB,GAAG,KAAK,CAAC;IAC1B,YAAY,GAAG,KAAK,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,iBAAiB,GAAG,IAAI,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACtD,MAAM,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,iBAAiB,GAAG,IAAI,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,iBAAiB,GAAG,IAAI,CAAC;QACzB,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,mEAAmE,EAAE,GAAG,EAAE;IACjF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,eAAe,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC;QACxC,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,eAAe,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,KAAK,IAAI,EAAE;QAC3G,eAAe,GAAG,GAAG,EAAE;YACrB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAChD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,eAAe,GAAG,GAAG,EAAE;YACrB,MAAM,kBAAkB,CAAC;QAC3B,CAAC,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACvB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,eAAe,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,kBAAkB,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC;QAChC,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,kBAAkB,GAAG,GAAG,EAAE;YACxB,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC;QAC9B,mBAAmB,EAAE,CAAC;QACtB,iBAAiB,GAAG,IAAI,CAAC,CAAC,gCAAgC;QAC1D,MAAM,CAAC,GAAG,MAAM,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/__tests__/resolver.test.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Resolver tests — proves the priority chain.
+ *
+ * Codex's v0.8 security review (P1 #3) called out that without these
+ * tests, the resolver could silently regress and ship — because
+ * `npm run test` would pass vacuously.
+ *
+ * Each test isolates the keychain via vi.mock so we control its
+ * behavior per case. Env vars are reset in beforeEach so test order
+ * doesn't matter.
+ */
+export {};
+//# sourceMappingURL=resolver.test.d.ts.map

package/dist/auth/__tests__/resolver.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/resolver.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/auth/__tests__/resolver.test.js

@@ -0,0 +1,182 @@
+/**
+ * Resolver tests — proves the priority chain.
+ *
+ * Codex's v0.8 security review (P1 #3) called out that without these
+ * tests, the resolver could silently regress and ship — because
+ * `npm run test` would pass vacuously.
+ *
+ * Each test isolates the keychain via vi.mock so we control its
+ * behavior per case. Env vars are reset in beforeEach so test order
+ * doesn't matter.
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import { resolveApiKey, requireApiKey } from "../resolver.js";
+import { AuthMissingError } from "../types.js";
+// Mock the keychain module before any test runs. Each test then
+// overrides the mock's return for getKeychain().
+vi.mock("../keychain.js", () => ({
+    getKeychain: vi.fn(),
+}));
+import { getKeychain } from "../keychain.js";
+const PROVIDER_ENV_VAR = {
+    openai: "OPENAI_API_KEY",
+    anthropic: "ANTHROPIC_API_KEY",
+    google: "GOOGLE_API_KEY",
+};
+function makeKeychainStub(behavior) {
+    return {
+        available: behavior.available,
+        describeBackend: () => "test-backend",
+        get: behavior.get ?? (async () => ({ kind: "absent" })),
+        set: async () => { },
+        remove: async () => true,
+    };
+}
+describe("resolveApiKey — priority order", () => {
+    const savedEnv = {};
+    beforeEach(() => {
+        // Snapshot + clear all provider env vars so test inputs are
+        // deterministic.
+        for (const v of Object.values(PROVIDER_ENV_VAR)) {
+            savedEnv[v] = process.env[v];
+            delete process.env[v];
+        }
+        delete process.env.GEMINI_API_KEY;
+        vi.clearAllMocks();
+    });
+    afterEach(() => {
+        // Restore original env so we don't pollute the runner / sibling tests.
+        for (const [k, v] of Object.entries(savedEnv)) {
+            if (v === undefined)
+                delete process.env[k];
+            else
+                process.env[k] = v;
+        }
+    });
+    it("explicit param wins over env (which would otherwise win over keychain)", async () => {
+        process.env.OPENAI_API_KEY = "from-env";
+        vi.mocked(getKeychain).mockResolvedValue(makeKeychainStub({
+            available: true,
+            get: async () => ({ kind: "found", key: "from-keychain" }),
+        }));
+        const r = await resolveApiKey("openai", { explicit: "from-explicit" });
+        expect(r.source).toBe("explicit");
+        expect(r.key).toBe("from-explicit");
+    });
+    it("env wins over keychain — prevents stale-keychain-key bug Codex flagged", async () => {
+        process.env.OPENAI_API_KEY = "from-env";
+        vi.mocked(getKeychain).mockResolvedValue(makeKeychainStub({
+            available: true,
+            get: async () => ({ kind: "found", key: "from-keychain" }),
+        }));
+        const r = await resolveApiKey("openai");
+        expect(r.source).toBe("env");
+        expect(r.key).toBe("from-env");
+        expect(r.envVar).toBe("OPENAI_API_KEY");
+    });
+    it("keychain wins over missing", async () => {
+        vi.mocked(getKeychain).mockResolvedValue(makeKeychainStub({
+            available: true,
+            get: async () => ({ kind: "found", key: "from-keychain" }),
+        }));
+        const r = await resolveApiKey("openai");
+        expect(r.source).toBe("keychain");
+        expect(r.key).toBe("from-keychain");
+    });
+    it("returns missing when no source has the key", async () => {
+        vi.mocked(getKeychain).mockResolvedValue(makeKeychainStub({ available: true }));
+        const r = await resolveApiKey("openai");
+        expect(r.source).toBe("missing");
+        expect(r.key).toBeUndefined();
+    });
+    it("returns keychain_error (not missing) when keychain read fails", async () => {
+        vi.mocked(getKeychain).mockResolvedValue(makeKeychainStub({
+            available: true,
+            get: async () => ({ kind: "error", message: "denied by OS" }),
+        }));
+        const r = await resolveApiKey("openai");
+        expect(r.source).toBe("keychain_error");
+        expect(r.keychainError).toBe("denied by OS");
+    });
+    it("keychain unavailability degrades to missing (not error) — backward compat", async () => {
+        vi.mocked(getKeychain).mockResolvedValue(makeKeychainStub({ available: false }));
+        const r = await resolveApiKey("openai");
+        expect(r.source).toBe("missing");
+    });
+    it("skipKeychain option bypasses keychain entirely", async () => {
+        process.env.OPENAI_API_KEY = "from-env";
+        // Keychain mock would throw if called — proves skipKeychain takes effect.
+        vi.mocked(getKeychain).mockImplementation(() => {
+            throw new Error("getKeychain should not be called when skipKeychain is true");
+        });
+        const r = await resolveApiKey("openai", { skipKeychain: true });
+        expect(r.source).toBe("env");
+    });
+    it("Google provider checks BOTH GOOGLE_API_KEY and GEMINI_API_KEY", async () => {
+        delete process.env.GOOGLE_API_KEY;
+        process.env.GEMINI_API_KEY = "from-gemini-env";
+        vi.mocked(getKeychain).mockResolvedValue(makeKeychainStub({ available: false }));
+        const r = await resolveApiKey("google");
+        expect(r.source).toBe("env");
+        expect(r.key).toBe("from-gemini-env");
+        expect(r.envVar).toBe("GEMINI_API_KEY");
+    });
+    it("Google prefers GOOGLE_API_KEY over GEMINI_API_KEY when both set", async () => {
+        process.env.GOOGLE_API_KEY = "primary";
+        process.env.GEMINI_API_KEY = "secondary";
+        vi.mocked(getKeychain).mockResolvedValue(makeKeychainStub({ available: false }));
+        const r = await resolveApiKey("google");
+        expect(r.source).toBe("env");
+        expect(r.envVar).toBe("GOOGLE_API_KEY");
+        expect(r.key).toBe("primary");
+    });
+    it("empty env var is treated as not set (falls through to keychain)", async () => {
+        process.env.OPENAI_API_KEY = "";
+        vi.mocked(getKeychain).mockResolvedValue(makeKeychainStub({
+            available: true,
+            get: async () => ({ kind: "found", key: "from-keychain" }),
+        }));
+        const r = await resolveApiKey("openai");
+        expect(r.source).toBe("keychain");
+    });
+});
+describe("requireApiKey — throws AuthMissingError on missing / keychain_error", () => {
+    const savedEnv = {};
+    beforeEach(() => {
+        for (const v of Object.values(PROVIDER_ENV_VAR)) {
+            savedEnv[v] = process.env[v];
+            delete process.env[v];
+        }
+        delete process.env.GEMINI_API_KEY;
+        vi.clearAllMocks();
+    });
+    afterEach(() => {
+        for (const [k, v] of Object.entries(savedEnv)) {
+            if (v === undefined)
+                delete process.env[k];
+            else
+                process.env[k] = v;
+        }
+    });
+    it("returns the key when found", async () => {
+        process.env.ANTHROPIC_API_KEY = "the-key";
+        vi.mocked(getKeychain).mockResolvedValue(makeKeychainStub({ available: false }));
+        const key = await requireApiKey("anthropic");
+        expect(key).toBe("the-key");
+    });
+    it("throws AuthMissingError with provider + env var when missing", async () => {
+        vi.mocked(getKeychain).mockResolvedValue(makeKeychainStub({ available: true }));
+        await expect(requireApiKey("anthropic")).rejects.toThrow(AuthMissingError);
+        await expect(requireApiKey("anthropic")).rejects.toThrow(/anthropic/);
+        await expect(requireApiKey("anthropic")).rejects.toThrow(/ANTHROPIC_API_KEY/);
+    });
+    it("throws AuthMissingError with a DIFFERENT message for keychain_error", async () => {
+        vi.mocked(getKeychain).mockResolvedValue(makeKeychainStub({
+            available: true,
+            get: async () => ({ kind: "error", message: "keyring locked" }),
+        }));
+        await expect(requireApiKey("anthropic")).rejects.toThrow(/keyring locked/);
+        await expect(requireApiKey("anthropic")).rejects.toThrow(/Keychain read failed/);
+    });
+});
+//# sourceMappingURL=resolver.test.js.map

package/dist/auth/__tests__/resolver.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/resolver.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,gEAAgE;AAChE,iDAAiD;AACjD,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/B,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;CACrB,CAAC,CAAC,CAAC;AACJ,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAE7C,MAAM,gBAAgB,GAAG;IACvB,MAAM,EAAE,gBAAgB;IACxB,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;CAChB,CAAC;AAEX,SAAS,gBAAgB,CAAC,QAOzB;IACC,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,eAAe,EAAE,GAAG,EAAE,CAAC,cAAc;QACrC,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC,CAAC;QAChE,GAAG,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC;QACnB,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;KACzB,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,MAAM,QAAQ,GAAuC,EAAE,CAAC;IAExD,UAAU,CAAC,GAAG,EAAE;QACd,4DAA4D;QAC5D,iBAAiB;QACjB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChD,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAClC,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,uEAAuE;QACvE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;;gBACtC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,UAAU,CAAC;QACxC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,iBAAiB,CACtC,gBAAgB,CAAC;YACf,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;SAC3D,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,UAAU,CAAC;QACxC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,iBAAiB,CACtC,gBAAgB,CAAC;YACf,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;SAC3D,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,iBAAiB,CACtC,gBAAgB,CAAC;YACf,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;SAC3D,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,iBAAiB,CACtC,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CACtC,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,iBAAiB,CACtC,gBAAgB,CAAC;YACf,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;SAC9D,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,iBAAiB,CACtC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CACvC,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,UAAU,CAAC;QACxC,0EAA0E;QAC1E,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE;YAC7C,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,iBAAiB,CAAC;QAC/C,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,iBAAiB,CACtC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CACvC,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,SAAS,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,WAAW,CAAC;QACzC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,iBAAiB,CACtC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CACvC,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,EAAE,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,iBAAiB,CACtC,gBAAgB,CAAC;YACf,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC;SAC3D,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qEAAqE,EAAE,GAAG,EAAE;IACnF,MAAM,QAAQ,GAAuC,EAAE,CAAC;IAExD,UAAU,CAAC,GAAG,EAAE;QACd,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChD,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QAClC,EAAE,CAAC,aAAa,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;;gBACtC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,SAAS,CAAC;QAC1C,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,iBAAiB,CACtC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CACvC,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,iBAAiB,CACtC,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CACtC,CAAC;QACF,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC3E,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,iBAAiB,CACtC,gBAAgB,CAAC;YACf,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;SAChE,CAAC,CACH,CAAC;QACF,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAC3E,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/__tests__/validator.test.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Validator tests with mocked fetch.
+ *
+ * Covers Codex's v0.8 security review demand:
+ *   "Add a regression test that failed validation never logs or returns
+ *    a URL containing the key."
+ *
+ * Plus the broader contract:
+ *   - happy path → ok: true with model
+ *   - timeout → ok: false with friendly message
+ *   - non-OK response → normalized error with statusCode, never raw body
+ *   - submitted key NEVER appears in error / model field for ANY provider
+ */
+export {};
+//# sourceMappingURL=validator.test.d.ts.map

package/dist/auth/__tests__/validator.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/validator.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG"}

package/dist/auth/__tests__/validator.test.js

@@ -0,0 +1,197 @@
+/**
+ * Validator tests with mocked fetch.
+ *
+ * Covers Codex's v0.8 security review demand:
+ *   "Add a regression test that failed validation never logs or returns
+ *    a URL containing the key."
+ *
+ * Plus the broader contract:
+ *   - happy path → ok: true with model
+ *   - timeout → ok: false with friendly message
+ *   - non-OK response → normalized error with statusCode, never raw body
+ *   - submitted key NEVER appears in error / model field for ANY provider
+ */
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { validateKey } from "../validator.js";
+const fetchMock = vi.fn();
+vi.stubGlobal("fetch", fetchMock);
+// Keys with recognizable patterns so we can grep for them in any output.
+const KEYS = {
+    openai: "sk-test-openai-CANARY-VALUE-12345",
+    anthropic: "sk-ant-test-anthropic-CANARY-VALUE-67890",
+    google: "AIza-test-google-CANARY-VALUE-abcde",
+};
+function jsonResponse(status, body) {
+    return new Response(typeof body === "string" ? body : JSON.stringify(body), {
+        status,
+        headers: { "content-type": "application/json" },
+    });
+}
+beforeEach(() => {
+    fetchMock.mockReset();
+});
+describe("validator — OpenAI", () => {
+    it("happy path returns ok with model name from response", async () => {
+        fetchMock.mockResolvedValueOnce(jsonResponse(200, { model: "gpt-4o-2024-08-06", choices: [] }));
+        const r = await validateKey("openai", KEYS.openai);
+        expect(r.ok).toBe(true);
+        expect(r.model).toBe("gpt-4o-2024-08-06");
+        expect(r.latencyMs).toBeGreaterThanOrEqual(0);
+    });
+    it("posts to /v1/chat/completions with the key as Bearer header (NOT in URL)", async () => {
+        fetchMock.mockResolvedValueOnce(jsonResponse(200, { model: "gpt-4o" }));
+        await validateKey("openai", KEYS.openai);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(String(url)).toBe("https://api.openai.com/v1/chat/completions");
+        expect(String(url)).not.toContain(KEYS.openai);
+        expect(init.headers).toMatchObject({
+            authorization: `Bearer ${KEYS.openai}`,
+        });
+    });
+    it("non-OK response returns normalized error with statusCode and no raw body in error", async () => {
+        fetchMock.mockResolvedValueOnce(jsonResponse(401, {
+            error: {
+                message: "Incorrect API key provided",
+                type: "invalid_request_error",
+                code: "invalid_api_key",
+            },
+        }));
+        const r = await validateKey("openai", KEYS.openai);
+        expect(r.ok).toBe(false);
+        expect(r.statusCode).toBe(401);
+        expect(r.error).toContain("Incorrect API key provided");
+        // The error string should be short — not the raw JSON body.
+        expect(r.error.length).toBeLessThan(200);
+        // rawBody is preserved separately for explicit debug use.
+        expect(r.rawBody).toBeDefined();
+    });
+});
+describe("validator — Anthropic", () => {
+    it("happy path returns ok with model from response", async () => {
+        fetchMock.mockResolvedValueOnce(jsonResponse(200, { model: "claude-sonnet-4-6", content: [] }));
+        const r = await validateKey("anthropic", KEYS.anthropic);
+        expect(r.ok).toBe(true);
+        expect(r.model).toBe("claude-sonnet-4-6");
+    });
+    it("posts to /v1/messages with x-api-key header (NOT in URL)", async () => {
+        fetchMock.mockResolvedValueOnce(jsonResponse(200, { model: "claude-sonnet-4-6" }));
+        await validateKey("anthropic", KEYS.anthropic);
+        const [url, init] = fetchMock.mock.calls[0];
+        expect(String(url)).toBe("https://api.anthropic.com/v1/messages");
+        expect(String(url)).not.toContain(KEYS.anthropic);
+        expect(init.headers).toMatchObject({
+            "x-api-key": KEYS.anthropic,
+        });
+    });
+    it("non-OK response returns normalized error with parsed message", async () => {
+        fetchMock.mockResolvedValueOnce(jsonResponse(400, {
+            type: "error",
+            error: {
+                type: "authentication_error",
+                message: "invalid x-api-key",
+            },
+        }));
+        const r = await validateKey("anthropic", KEYS.anthropic);
+        expect(r.ok).toBe(false);
+        expect(r.statusCode).toBe(400);
+        expect(r.error).toContain("invalid x-api-key");
+    });
+});
+describe("validator — Google", () => {
+    it("happy path returns ok with the configured model name", async () => {
+        fetchMock.mockResolvedValueOnce(jsonResponse(200, { candidates: [{ content: { parts: [] } }] }));
+        const r = await validateKey("google", KEYS.google);
+        expect(r.ok).toBe(true);
+        expect(r.model).toBe("gemini-2.5-flash");
+    });
+    it("CODEX V0.8 P1: uses x-goog-api-key header — NEVER puts the key in the URL", async () => {
+        fetchMock.mockResolvedValueOnce(jsonResponse(200, { candidates: [] }));
+        await validateKey("google", KEYS.google);
+        const [url, init] = fetchMock.mock.calls[0];
+        // This is the regression-test Codex specifically requested.
+        expect(String(url)).not.toContain(KEYS.google);
+        expect(String(url)).not.toContain("?key=");
+        // And the key MUST be in the header instead.
+        expect(init.headers).toMatchObject({
+            "x-goog-api-key": KEYS.google,
+        });
+    });
+    it("non-OK response returns normalized error with statusCode", async () => {
+        fetchMock.mockResolvedValueOnce(jsonResponse(403, {
+            error: {
+                code: 403,
+                message: "API key not valid",
+                status: "PERMISSION_DENIED",
+            },
+        }));
+        const r = await validateKey("google", KEYS.google);
+        expect(r.ok).toBe(false);
+        expect(r.statusCode).toBe(403);
+        expect(r.error).toContain("API key not valid");
+    });
+});
+describe("validator — KEY-LEAK REGRESSION (Codex v0.8 P2 #6)", () => {
+    /**
+     * The submitted key must never appear in `error` or `model` for
+     * ANY provider, in ANY failure path. Tests every provider × every
+     * failure mode we care about.
+     */
+    const failureModes = [
+        { status: 400, body: { error: { message: "bad request" } } },
+        { status: 401, body: { error: { message: "unauthorized" } } },
+        { status: 403, body: { error: { message: "forbidden" } } },
+        { status: 429, body: { error: { message: "rate limited" } } },
+        { status: 500, body: "Internal Server Error (plain text body)" },
+        {
+            status: 200,
+            body: "malformed-not-json{{{",
+        },
+    ];
+    for (const provider of ["openai", "anthropic", "google"]) {
+        for (const mode of failureModes) {
+            it(`${provider} ${mode.status}: error message never contains the submitted key verbatim`, async () => {
+                fetchMock.mockResolvedValueOnce(jsonResponse(mode.status, mode.body));
+                const key = KEYS[provider];
+                const r = await validateKey(provider, key);
+                // Check every string-shaped field we expose to users.
+                for (const field of [r.error, r.model]) {
+                    if (field) {
+                        expect(field).not.toContain(key);
+                    }
+                }
+            });
+        }
+    }
+    it("if a provider echoes the key in its error body, the normalized error MUST NOT include the key", async () => {
+        // Worst-case: provider literally echoes the key in the response.
+        // Could happen with poorly-written upstream tooling.
+        fetchMock.mockResolvedValueOnce(jsonResponse(400, {
+            error: {
+                message: `key ${KEYS.openai} is malformed`,
+            },
+        }));
+        const r = await validateKey("openai", KEYS.openai);
+        expect(r.ok).toBe(false);
+        // The normalized error MUST redact the key.
+        expect(r.error).not.toContain(KEYS.openai);
+        expect(r.error).toContain("<redacted-key>");
+    });
+});
+describe("validator — network failure handling", () => {
+    it("network throw returns ok:false with friendly message (not stack trace)", async () => {
+        fetchMock.mockRejectedValueOnce(new TypeError("fetch failed: ECONNREFUSED"));
+        const r = await validateKey("openai", KEYS.openai);
+        expect(r.ok).toBe(false);
+        expect(r.error).toBeDefined();
+        expect(r.error).not.toContain(KEYS.openai);
+        // friendlyNetworkError should produce a short message
+        expect(r.error.length).toBeLessThan(150);
+    });
+    it("abort (timeout) returns ok:false with friendly message", async () => {
+        fetchMock.mockRejectedValueOnce(Object.assign(new Error("aborted"), { name: "AbortError" }));
+        const r = await validateKey("openai", KEYS.openai);
+        expect(r.ok).toBe(false);
+        expect(r.error).toMatch(/timed out|abort/i);
+    });
+});
+//# sourceMappingURL=validator.test.js.map

package/dist/auth/__tests__/validator.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validator.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/validator.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC1B,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;AAElC,yEAAyE;AACzE,MAAM,IAAI,GAAG;IACX,MAAM,EAAE,mCAAmC;IAC3C,SAAS,EAAE,0CAA0C;IACrD,MAAM,EAAE,qCAAqC;CACrC,CAAC;AAEX,SAAS,YAAY,CAAC,MAAc,EAAE,IAAqB;IACzD,OAAO,IAAI,QAAQ,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QAC1E,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,UAAU,CAAC,GAAG,EAAE;IACd,SAAS,CAAC,SAAS,EAAE,CAAC;AACxB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,SAAS,CAAC,qBAAqB,CAC7B,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAC/D,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC1C,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,SAAS,CAAC,qBAAqB,CAC7B,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CACvC,CAAC;QACF,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAE,IAAoB,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC;YAClD,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;SACvC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,SAAS,CAAC,qBAAqB,CAC7B,YAAY,CAAC,GAAG,EAAE;YAChB,KAAK,EAAE;gBACL,OAAO,EAAE,4BAA4B;gBACrC,IAAI,EAAE,uBAAuB;gBAC7B,IAAI,EAAE,iBAAiB;aACxB;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QACxD,4DAA4D;QAC5D,MAAM,CAAC,CAAC,CAAC,KAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC1C,0DAA0D;QAC1D,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,SAAS,CAAC,qBAAqB,CAC7B,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAC/D,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,SAAS,CAAC,qBAAqB,CAC7B,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAClD,CAAC;QACF,MAAM,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAClD,MAAM,CAAE,IAAoB,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC;YAClD,WAAW,EAAE,IAAI,CAAC,SAAS;SAC5B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,SAAS,CAAC,qBAAqB,CAC7B,YAAY,CAAC,GAAG,EAAE;YAChB,IAAI,EAAE,OAAO;YACb,KAAK,EAAE;gBACL,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,mBAAmB;aAC7B;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,SAAS,CAAC,qBAAqB,CAC7B,YAAY,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAChE,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,SAAS,CAAC,qBAAqB,CAC7B,YAAY,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CACtC,CAAC;QACF,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAC7C,4DAA4D;QAC5D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC3C,6CAA6C;QAC7C,MAAM,CAAE,IAAoB,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC;YAClD,gBAAgB,EAAE,IAAI,CAAC,MAAM;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,SAAS,CAAC,qBAAqB,CAC7B,YAAY,CAAC,GAAG,EAAE;YAChB,KAAK,EAAE;gBACL,IAAI,EAAE,GAAG;gBACT,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE,mBAAmB;aAC5B;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAClE;;;;OAIG;IACH,MAAM,YAAY,GAAqD;QACrE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE;QAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;QAC7D,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE;QAC1D,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE;QAC7D,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,yCAAyC,EAAE;QAChE;YACE,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,uBAAuB;SAC9B;KACF,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAU,EAAE,CAAC;QAClE,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,EAAE,CAAC,GAAG,QAAQ,IAAI,IAAI,CAAC,MAAM,2DAA2D,EAAE,KAAK,IAAI,EAAE;gBACnG,SAAS,CAAC,qBAAqB,CAC7B,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CACrC,CAAC;gBACF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC3B,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC3C,sDAAsD;gBACtD,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAA8B,EAAE,CAAC;oBACpE,IAAI,KAAK,EAAE,CAAC;wBACV,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnC,CAAC;gBACH,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,EAAE,CAAC,+FAA+F,EAAE,KAAK,IAAI,EAAE;QAC7G,iEAAiE;QACjE,qDAAqD;QACrD,SAAS,CAAC,qBAAqB,CAC7B,YAAY,CAAC,GAAG,EAAE;YAChB,KAAK,EAAE;gBACL,OAAO,EAAE,OAAO,IAAI,CAAC,MAAM,eAAe;aAC3C;SACF,CAAC,CACH,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,4CAA4C;QAC5C,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sCAAsC,EAAE,GAAG,EAAE;IACpD,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,SAAS,CAAC,qBAAqB,CAC7B,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAC5C,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,sDAAsD;QACtD,MAAM,CAAC,CAAC,CAAC,KAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,SAAS,CAAC,qBAAqB,CAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAC5D,CAAC;QACF,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}