@amoree-code/ocean 0.0.0-stage → 1.1.0

package/dist/application/clients/clients.js

@@ -0,0 +1,646 @@
+import { spawn } from "node:child_process";
+import { createHash, randomBytes } from "node:crypto";
+import { accessSync, constants, existsSync, realpathSync } from "node:fs";
+import { appendFile, mkdir, readFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { clientJournalFile } from "@ocean/brain/memory/memory-paths.js";
+import { containsKnownSecret } from "@ocean/core/domain/redaction/redaction.js";
+import { atomicWrite, withFileLock } from "@ocean/core/shared/fs-utils.js";
+import { liveEngineEntry, oceanPath, SYSTEM_DIR, } from "@ocean/core/shared/paths.js";
+import { ENTRY_KEYS, ManualEdit, } from "./editors.js";
+import { CLIENT_ADAPTERS, mcpClientOf, } from "./registry.js";
+// A node inside a version manager's tree disappears when that version is removed (T-307).
+const VERSIONED_NODE = /[\\/](?:node-versions|\.nvm[\\/]versions[\\/]node|\.volta[\\/]tools[\\/]image[\\/]node|\.asdf[\\/]installs[\\/]nodejs|mise[\\/]installs[\\/]node|n[\\/]versions[\\/]node)[\\/]/;
+export function isVersionedNode(execPath) {
+    return VERSIONED_NODE.test(execPath);
+}
+// The `ocean` MCP entry. With a version-managed node it launches through the `ocean` shim, which
+// falls back to another node when that version is gone; a temporary engine keeps the direct form
+// so `temporaryEntryProblem` still refuses it.
+export function oceanServerEntry(execPath = process.execPath, engine = liveEngineEntry(), platform = process.platform) {
+    const direct = { command: execPath, args: [engine, "mcp", "serve"] };
+    if (platform === "win32" ||
+        !isVersionedNode(execPath) ||
+        temporaryEntryProblem(direct))
+        return direct;
+    return {
+        command: oceanPath(SYSTEM_DIR, "runtime", "shims", "ocean"),
+        args: ["mcp", "serve"],
+    };
+}
+export function defaultClientEnv() {
+    const home = os.homedir();
+    return {
+        home,
+        pathDirs: (process.env.PATH ?? "").split(path.delimiter).filter(Boolean),
+        appDirs: process.platform === "darwin"
+            ? ["/Applications", path.join(home, "Applications")]
+            : [],
+        entry: oceanServerEntry(),
+    };
+}
+const sha = (value) => createHash("sha256").update(value).digest("hex");
+function executable(file) {
+    try {
+        accessSync(file, constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function detect(adapter, env) {
+    const evidence = [];
+    for (const name of adapter.detect.binaries ?? [])
+        for (const dir of env.pathDirs)
+            if (executable(path.join(dir, name))) {
+                evidence.push(`binary ${name}`);
+                break;
+            }
+    for (const app of adapter.detect.apps ?? [])
+        if (env.appDirs.some((dir) => existsSync(path.join(dir, app))))
+            evidence.push(`app ${app}`);
+    for (const relative of adapter.detect.paths ?? [])
+        if (existsSync(path.join(env.home, relative)))
+            evidence.push(`~/${relative}`);
+    return evidence;
+}
+// A TOML entry with sub-tables carries a `__subtables` marker, which fails the key check too.
+const isOceanShaped = (value) => Boolean(value) &&
+    Object.keys(value ?? {}).every((key) => ENTRY_KEYS.includes(key));
+const sameEntry = (value, entry) => Boolean(value) &&
+    value?.command === entry.command &&
+    JSON.stringify(value?.args ?? []) === JSON.stringify(entry.args ?? []);
+const runsObsidian = (value) => Array.isArray(value.args) && value.args.includes("obsidian");
+// The retired atlas gateway: an entry that names it and whose program no longer exists.
+function staleAtlas(key, value) {
+    const command = typeof value.command === "string" ? value.command : "";
+    return ((/atlas/i.test(key) || /atlas/i.test(command)) &&
+        path.isAbsolute(command) &&
+        !existsSync(command));
+}
+// Windows' tmpdir can be an 8.3 short path (C:\\Users\\RUNNER~1\\...) while an engine's path is the
+// long form of the same directory.
+function realTemporaryDir() {
+    try {
+        return [realpathSync.native(os.tmpdir())];
+    }
+    catch {
+        return [];
+    }
+}
+// A build in a temporary directory (a scratch worktree) disappears with it, and every client
+// wired to it would then fail to start Ocean.
+const TEMPORARY_ROOTS = [
+    os.tmpdir(),
+    ...realTemporaryDir(),
+    "/tmp",
+    "/private/tmp",
+    "/var/folders",
+    "/private/var/folders",
+];
+// `paths` is a parameter so the Windows rules (separator, case, drives) are testable anywhere.
+export function isWithinDir(dir, file, paths = path) {
+    const relative = paths.relative(dir, file);
+    return (relative !== ".." &&
+        !relative.startsWith(`..${paths.sep}`) &&
+        !paths.isAbsolute(relative));
+}
+export function temporaryEntryProblem(entry) {
+    const program = Array.isArray(entry.args) ? entry.args[0] : undefined;
+    if (typeof program !== "string")
+        return null;
+    const resolved = path.resolve(program);
+    const root = TEMPORARY_ROOTS.find((dir) => isWithinDir(dir, resolved));
+    return root
+        ? `the Ocean engine ${resolved} is in a temporary directory (${root}); run this from the workspace kernel checkout`
+        : null;
+}
+async function readText(file) {
+    try {
+        return await readFile(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+}
+// The ops that bring one config text to the desired state, or why it needs a hand edit.
+function opsFor(adapter, text, entry) {
+    const editor = adapter.config?.editor;
+    const servers = editor?.servers(text);
+    if (!editor || !servers)
+        return {
+            ops: [],
+            manual: adapter.reason ?? "the server table cannot be read",
+        };
+    const ops = [];
+    const ocean = servers.get("ocean");
+    const legacy = ocean ? runsObsidian(ocean) : false;
+    if (ocean && legacy) {
+        if (!isOceanShaped(ocean))
+            return {
+                ops: [],
+                manual: "the legacy `ocean` entry has keys Ocean does not manage",
+            };
+        // With an `ocean-obsidian` already there, the legacy entry is simply replaced in place below.
+        if (!servers.has("ocean-obsidian"))
+            ops.push({ kind: "rename", key: "ocean", to: "ocean-obsidian" });
+    }
+    for (const [key, value] of servers)
+        if (key !== "ocean" && staleAtlas(key, value) && isOceanShaped(value))
+            ops.push({ kind: "remove", key });
+    if (!ocean || legacy)
+        ops.push({ kind: "set", key: "ocean", value: entry });
+    else if (!isOceanShaped(ocean))
+        return {
+            ops: [],
+            manual: "the `ocean` entry has keys Ocean does not manage",
+        };
+    else if (!sameEntry(ocean, entry))
+        ops.push({ kind: "set", key: "ocean", value: entry });
+    return { ops };
+}
+export async function planClients(env = defaultClientEnv()) {
+    const plans = [];
+    for (const adapter of CLIENT_ADAPTERS) {
+        const evidence = detect(adapter, env);
+        const plan = {
+            client: adapter.id,
+            label: adapter.label,
+            tier: adapter.tier,
+            installed: evidence.length > 0,
+            evidence,
+            file: adapter.config ? `~/${adapter.config.file}` : undefined,
+            status: "current",
+            ops: [],
+            nativeMemory: adapter.nativeMemory,
+            reason: adapter.reason,
+            fallback: adapter.fallback,
+        };
+        if (!plan.installed)
+            plan.status = "not-installed";
+        else if (adapter.tier !== "supported" || !adapter.config)
+            plan.status = adapter.tier === "supported" ? "unknown" : adapter.tier;
+        else {
+            const text = (await readText(path.join(env.home, adapter.config.file))) ?? "";
+            const { ops, manual } = opsFor(adapter, text, env.entry);
+            plan.ops = ops;
+            plan.status = ops.length ? "change" : "current";
+            if (!manual && ops.length)
+                try {
+                    adapter.config.editor.apply(text, ops);
+                }
+                catch (error) {
+                    if (!(error instanceof ManualEdit))
+                        throw error;
+                    plan.reason = error.message;
+                    plan.status = "manual";
+                }
+            if (manual) {
+                plan.reason = manual;
+                plan.status = "manual";
+            }
+            if (plan.status === "manual")
+                plan.snippet = JSON.stringify({ ocean: env.entry });
+        }
+        plans.push(plan);
+    }
+    return plans;
+}
+function stateFile() {
+    return oceanPath(SYSTEM_DIR, "state", "clients", "clients.json");
+}
+// How far a client's use of Ocean is proven (T-307). Only `in-app` — the client's model searched
+// Ocean during normal use and cited the record — counts as done; `blocked` names why that check
+// cannot run yet. A confirmation recorded before labels existed has none and proves nothing.
+export const EVIDENCE_LABELS = [
+    "in-app",
+    "headless",
+    "connected",
+    "blocked",
+];
+export async function readClientState() {
+    const text = await readText(stateFile());
+    const parsed = text ? JSON.parse(text) : {};
+    return {
+        approved: parsed.approved ?? {},
+        verified: parsed.verified ?? {},
+        confirmed: parsed.confirmed ?? {},
+    };
+}
+async function approvedClients() {
+    return (await readClientState()).approved;
+}
+async function updateClientState(change) {
+    const file = stateFile();
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    await withFileLock(file, async () => {
+        const state = await readClientState();
+        change(state);
+        await atomicWrite(file, `${JSON.stringify(state, null, 2)}\n`, 0o600);
+    });
+}
+async function approve(ids) {
+    if (!ids.length)
+        return;
+    await updateClientState((state) => {
+        for (const id of ids)
+            state.approved[id] = { approvedAt: new Date().toISOString() };
+    });
+}
+export async function recordVerification(client, ok) {
+    await updateClientState((state) => {
+        state.verified[client] = { verifiedAt: new Date().toISOString(), ok };
+    });
+}
+const EVIDENCE_TEXT_MAX = 200;
+function evidenceText(value) {
+    const text = value?.replace(/\s+/g, " ").trim();
+    return text ? text.slice(0, EVIDENCE_TEXT_MAX) : undefined;
+}
+// The call ledger keeps the raw MCP client name. Each row also names the Ocean client it
+// belongs to and, where that client's modes send different names, the mode (T-307).
+export function attributeLedger(rows) {
+    return rows.map((row) => {
+        const known = mcpClientOf(row.client);
+        if (!known)
+            return row;
+        return {
+            ...row,
+            oceanClient: known.id,
+            ...(known.mode ? { mode: known.mode } : {}),
+        };
+    });
+}
+// Records what was proven about a client's use of Ocean, and how.
+export async function confirmClient(client, evidence) {
+    if (!CLIENT_ADAPTERS.some((adapter) => adapter.id === client))
+        throw new Error(`unknown client '${client}'`);
+    if (!EVIDENCE_LABELS.includes(evidence.label))
+        throw new Error(`unknown evidence label '${evidence.label}' (use ${EVIDENCE_LABELS.join(", ")})`);
+    const via = evidenceText(evidence.via);
+    const reason = evidenceText(evidence.reason);
+    if (evidence.label === "in-app" && !via)
+        throw new Error("an in-app confirmation needs --via <evidence>");
+    if (evidence.label === "blocked" && !reason)
+        throw new Error("a blocked client needs --reason <why>");
+    await updateClientState((state) => {
+        state.confirmed[client] = {
+            confirmedAt: new Date().toISOString(),
+            label: evidence.label,
+            ...(via ? { via } : {}),
+            ...(reason ? { reason } : {}),
+        };
+    });
+}
+export async function appendJournal(entries) {
+    if (!entries.length)
+        return;
+    const file = clientJournalFile();
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    await withFileLock(file, () => appendFile(file, entries.map((entry) => `${JSON.stringify(entry)}\n`).join(""), { mode: 0o600 }));
+}
+export async function readJournal() {
+    const text = await readText(clientJournalFile());
+    return (text ?? "")
+        .split("\n")
+        .filter(Boolean)
+        .map((line) => JSON.parse(line));
+}
+// A value goes into the journal only when it is Ocean-shaped and holds no secret; otherwise
+// only its hash, and restoring it can only remove Ocean's entry.
+function journalValue(value) {
+    if (!value)
+        return { before: null };
+    const text = JSON.stringify(value);
+    if (isOceanShaped(value) && !containsKnownSecret(text))
+        return { before: value };
+    return { before: null, beforeSha: sha(text) };
+}
+function simulate(state, op) {
+    if (op.kind === "set")
+        state.set(op.key, op.value);
+    else if (op.kind === "remove")
+        state.delete(op.key);
+    else {
+        const value = state.get(op.key);
+        state.delete(op.key);
+        if (value)
+            state.set(op.to, value);
+    }
+}
+export const newBatch = () => `${new Date()
+    .toISOString()
+    .replace(/[-:TZ]/g, "")
+    .slice(0, 14)}-${randomBytes(4).toString("hex")}`;
+// Writes one client file: re-reads it right before the rename and recomputes when it changed
+// meanwhile, so an edit the user (or the client) made in between is never overwritten.
+// Exported for its test only.
+export async function edit(file, change, batch) {
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const text = await readText(file);
+        const result = change(text ?? "");
+        if (!result)
+            return "unchanged";
+        await mkdir(path.dirname(file), { recursive: true });
+        const outcome = await withFileLock(file, async () => {
+            if ((await readText(file)) !== text)
+                return "retry";
+            await atomicWrite(file, result.next, text === null ? 0o600 : undefined);
+            return "written";
+        });
+        if (outcome === "retry")
+            continue;
+        const ts = new Date().toISOString();
+        await appendJournal(result.entries.map((entry) => ({ ...entry, batch, ts })));
+        return "written";
+    }
+    throw new Error(`${file} kept changing while Ocean tried to edit it; try again`);
+}
+// `durable` (default: on for this machine's real env) refuses an engine in a temporary directory.
+export async function applyClients(options = {}) {
+    const env = options.env ?? defaultClientEnv();
+    if (options.durable ?? !options.env) {
+        const problem = temporaryEntryProblem(env.entry);
+        if (problem)
+            throw new Error(`Refusing to wire clients: ${problem}`);
+    }
+    const batch = options.batch ?? newBatch();
+    const results = [];
+    for (const plan of await planClients(env)) {
+        if (options.clients && !options.clients.includes(plan.client))
+            continue;
+        if (plan.status !== "change") {
+            if (options.clients)
+                results.push({ client: plan.client, result: plan.status });
+            continue;
+        }
+        const adapter = CLIENT_ADAPTERS.find((item) => item.id === plan.client);
+        if (!adapter?.config)
+            continue;
+        const config = adapter.config;
+        const file = path.join(env.home, config.file);
+        const result = await edit(file, (text) => {
+            const { ops, manual } = opsFor(adapter, text, env.entry);
+            if (manual || !ops.length)
+                return null;
+            // Each op's "before" is the table as the earlier ops of this batch left it.
+            const state = new Map(config.editor.servers(text) ?? []);
+            const entries = ops.map((op) => {
+                const entry = {
+                    client: adapter.id,
+                    file: config.file,
+                    op: op.kind,
+                    key: op.key,
+                    to: op.kind === "rename" ? op.to : undefined,
+                    ...(op.kind === "rename"
+                        ? { before: null }
+                        : journalValue(state.get(op.key))),
+                    after: op.kind === "set" ? op.value : null,
+                };
+                simulate(state, op);
+                return entry;
+            });
+            return { next: config.editor.apply(text, ops), entries };
+        }, batch);
+        results.push({ client: plan.client, result });
+    }
+    await approve(results
+        .filter((item) => item.result === "written")
+        .map((item) => item.client));
+    return { batch, results };
+}
+// Re-applies the desired entry for clients the owner already approved; never a new client.
+export async function repairClients(env) {
+    const approved = Object.keys(await approvedClients());
+    if (!approved.length)
+        return { batch: null, results: [] };
+    return applyClients({ clients: approved, env });
+}
+// Undoes one apply batch (default: the latest), entry by entry in reverse. An entry whose
+// node no longer holds what Ocean wrote is a conflict and is left alone.
+export async function restoreClients(options = {}) {
+    const env = options.env ?? defaultClientEnv();
+    const journal = await readJournal();
+    const batch = options.batch ??
+        [...journal].reverse().find((entry) => !entry.restoreOf)?.batch ??
+        null;
+    const restored = [];
+    const conflicts = [];
+    if (!batch)
+        return { batch, restored, conflicts };
+    const entries = journal
+        .filter((entry) => entry.batch === batch &&
+        entry.op !== "hook-add" &&
+        entry.op !== "native-set")
+        .reverse();
+    const undo = newBatch();
+    for (const file of [...new Set(entries.map((entry) => entry.file))]) {
+        const adapter = CLIENT_ADAPTERS.find((item) => item.config?.file === file);
+        if (!adapter?.config)
+            continue;
+        const config = adapter.config;
+        // Collected per attempt: edit() may run the change again when the file moved under it.
+        let fileRestored = [];
+        let fileConflicts = [];
+        await edit(path.join(env.home, file), (text) => {
+            fileRestored = [];
+            fileConflicts = [];
+            const restored = fileRestored;
+            const conflicts = fileConflicts;
+            const read = config.editor.servers(text);
+            if (!read) {
+                conflicts.push(`${adapter.id}: config no longer readable`);
+                return null;
+            }
+            const servers = new Map(read);
+            const ops = [];
+            const queue = (op) => {
+                ops.push(op);
+                simulate(servers, op);
+            };
+            const notes = [];
+            for (const entry of entries.filter((item) => item.file === file)) {
+                const label = `${adapter.id}:${entry.key}`;
+                if (entry.op === "rename" && entry.to) {
+                    if (servers.has(entry.to) && !servers.has(entry.key)) {
+                        queue({ kind: "rename", key: entry.to, to: entry.key });
+                        restored.push(label);
+                    }
+                    else
+                        conflicts.push(label);
+                }
+                else if (entry.op === "set") {
+                    if (!sameEntry(servers.get(entry.key), entry.after ?? {})) {
+                        conflicts.push(label);
+                        continue;
+                    }
+                    if (entry.before)
+                        queue({ kind: "set", key: entry.key, value: entry.before });
+                    else
+                        queue({ kind: "remove", key: entry.key });
+                    restored.push(entry.beforeSha
+                        ? `${label} (removed; original not stored)`
+                        : label);
+                }
+                else if (entry.op === "remove") {
+                    if (servers.has(entry.key) || !entry.before) {
+                        conflicts.push(label);
+                        continue;
+                    }
+                    queue({ kind: "set", key: entry.key, value: entry.before });
+                    restored.push(label);
+                }
+                notes.push({ ...entry, restoreOf: batch });
+            }
+            if (!ops.length)
+                return null;
+            return { next: config.editor.apply(text, ops), entries: notes };
+        }, undo);
+        restored.push(...fileRestored);
+        conflicts.push(...fileConflicts);
+    }
+    return { batch, restored, conflicts };
+}
+// Starts the client's configured `ocean` command and checks it answers as the brain server.
+// This proves the entry launches; it does not prove the client app connects to it.
+export async function verifyClient(client, env = defaultClientEnv()) {
+    const adapter = CLIENT_ADAPTERS.find((item) => item.id === client);
+    if (!adapter?.config)
+        return { client, ok: false, detail: "no MCP config" };
+    const text = await readText(path.join(env.home, adapter.config.file));
+    const entry = text
+        ? adapter.config.editor.servers(text)?.get("ocean")
+        : undefined;
+    if (!entry || typeof entry.command !== "string")
+        return { client, ok: false, detail: "no `ocean` entry" };
+    return new Promise((resolve) => {
+        const child = spawn(entry.command, entry.args ?? [], {
+            stdio: ["pipe", "pipe", "ignore"],
+        });
+        let output = "";
+        let done = false;
+        const finish = (ok, detail) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            child.kill();
+            resolve({ client, ok, detail });
+        };
+        const timer = setTimeout(() => finish(false, "no answer within 15 s"), 15_000);
+        child.on("error", (error) => finish(false, error.message));
+        child.on("exit", (code) => finish(false, `exited with code ${code} before answering`));
+        child.stdout.on("data", (chunk) => {
+            output += chunk.toString("utf8");
+            // Only complete lines: a large reply (tools/list) arrives in several chunks.
+            const replies = output
+                .split("\n")
+                .slice(0, -1)
+                .filter((line) => line.startsWith("{"))
+                .map((line) => JSON.parse(line));
+            const init = replies.find((reply) => reply.id === 1);
+            const list = replies.find((reply) => reply.id === 2);
+            if (!init || !list)
+                return;
+            const name = init.result?.serverInfo
+                ?.name;
+            const tools = (list.result?.tools ?? []).map((tool) => tool.name);
+            const ok = name === "ocean" &&
+                tools.includes("brain_search") &&
+                tools.includes("memory_write");
+            finish(ok, ok
+                ? "answers as the ocean brain server with memory tools"
+                : `serverInfo ${name}, ${tools.length} tools`);
+        });
+        child.stdin.write(`${JSON.stringify({ jsonrpc: "2.0", id: 1, method: "initialize", params: { clientInfo: { name: "ocean-verify" } } })}\n${JSON.stringify({ jsonrpc: "2.0", id: 2, method: "tools/list" })}\n`);
+    });
+}
+// Doctor view: a supported client that is installed but not wired fails; unsupported clients
+// are reported with their fallback; an unknown capability is a warning, never a pass. On this
+// machine's real env, an engine in a temporary directory is named first: every plan below then
+// points at a build that will disappear (T-300).
+// A wired client's status says only what its evidence proves: "checked in the app" is reserved
+// for an in-app confirmation.
+function evidenceFinding(name, client, record) {
+    const confirm = `\`ocean clients confirm ${client} --label in-app --via <evidence>\``;
+    const date = record?.confirmedAt.slice(0, 10);
+    if (record?.label === "in-app")
+        return {
+            code: "CLIENT_WIRED",
+            severity: "OK",
+            message: `${name}: \`ocean\` entry current, checked in the app ${date} (${record.via})`,
+            fixable: false,
+        };
+    if (record?.label === "blocked")
+        return {
+            code: "CLIENT_BLOCKED",
+            severity: "WARN",
+            message: `${name}: \`ocean\` entry current; in-app check blocked since ${date}: ${record.reason}`,
+            fixable: false,
+        };
+    const proven = record?.label
+        ? `${record.label} only (${date}${record.via ? `: ${record.via}` : ""})`
+        : record
+            ? `confirmed ${date} without an evidence label`
+            : "in-app check not recorded";
+    return {
+        code: "CLIENT_CHECK_PENDING",
+        severity: "WARN",
+        message: `${name}: \`ocean\` entry current; ${proven} — ask it a question that needs Ocean, then ${confirm}`,
+        fixable: false,
+    };
+}
+export async function clientFindings(env) {
+    const findings = [];
+    const problem = env ? null : temporaryEntryProblem(defaultClientEnv().entry);
+    if (problem)
+        findings.push({
+            code: "CLIENT_ENGINE_TEMPORARY",
+            severity: "WARN",
+            message: `the client plans below are for a temporary engine — ${problem}`,
+            fixable: false,
+        });
+    env ??= defaultClientEnv();
+    const { confirmed } = await readClientState();
+    for (const plan of await planClients(env)) {
+        if (!plan.installed)
+            continue;
+        const name = `${plan.label} (${plan.client})`;
+        if (plan.status === "current")
+            findings.push(evidenceFinding(name, plan.client, confirmed[plan.client]));
+        else if (plan.status === "change")
+            findings.push({
+                code: "CLIENT_NOT_WIRED",
+                severity: "FAIL",
+                message: `${name}: ${plan.ops.map((op) => `${op.kind} ${op.key}`).join(", ")} pending in ${plan.file} — run \`ocean clients apply --yes\``,
+                fixable: true,
+            });
+        else if (plan.status === "manual")
+            findings.push({
+                code: "CLIENT_MANUAL",
+                severity: "FAIL",
+                message: `${name}: needs a hand edit (${plan.reason}); add ${plan.snippet}`,
+                fixable: false,
+            });
+        else if (plan.status === "unknown")
+            findings.push({
+                code: "CLIENT_UNKNOWN",
+                severity: "WARN",
+                message: `${name}: capability unknown — ${plan.reason}`,
+                fixable: false,
+            });
+        else
+            findings.push({
+                code: "CLIENT_UNSUPPORTED",
+                severity: "OK",
+                message: `${name}: ${plan.status} — ${plan.reason}; fallback: ${plan.fallback}`,
+                fixable: false,
+            });
+    }
+    return findings;
+}
+//# sourceMappingURL=clients.js.map