@boyingliu01/xp-gate 0.31.4 → 0.32.0

package/mutation/runners/mutmut-runner.ts

@@ -99,38 +99,90 @@ export class MutmutRunner implements MutationRunner {
     }
   }
 
+  /**
+   * Build the terminal-outcome handler for one `mutmut run`.
+   *
+   * Three separate events (close / error / timeout) can end a run, and each one
+   * has to cancel both timers, mark the promise settled exactly once, and hand
+   * back the right shape. Factoring that into a single small object keeps
+   * `runMutmut` down to spawning and wiring, which is all it should express.
+   */
+  private settleTracker(
+    resolve: (outcome: MutationRunOutcome) => void,
+    cancelTimers: () => void,
+  ): {
+    didTimeOut: () => boolean;
+    markTimedOut: () => void;
+    settle: (outcome: MutationRunOutcome) => void;
+    isSettled: () => boolean;
+  } {
+    let settled = false;
+    let timedOut = false;
+    return {
+      didTimeOut: () => timedOut,
+      markTimedOut: () => {
+        timedOut = true;
+      },
+      isSettled: () => settled,
+      settle: (outcome) => {
+        if (settled) return;
+        settled = true;
+        cancelTimers();
+        resolve(outcome);
+      },
+    };
+  }
+
+  /**
+   * How to invoke `mutmut run` for the current route, or null when a WSL path
+   * could not be derived (in which case the run must be skipped, not attempted).
+   */
+  private buildInvocation(cwd: string): { command: string; args: string[] } | null {
+    if (this.route !== 'wsl') {
+      return { command: 'mutmut', args: ['run'] };
+    }
+    const wslPath = this.toWslPath(cwd);
+    if (wslPath === null) return null;
+    return { command: 'wsl', args: ['--cd', wslPath, 'mutmut', 'run'] };
+  }
+
   private async runMutmut(options: RunMutationOptions): Promise<MutationRunOutcome> {
     return new Promise((resolve) => {
-      const command = this.route === 'wsl' ? 'wsl' : 'mutmut';
-      const wslPath = this.route === 'wsl' ? this.toWslPath(options.cwd) : options.cwd;
-      if (wslPath === null) {
+      const invocation = this.buildInvocation(options.cwd);
+      if (invocation === null) {
         resolve({ report: null, timedOut: false });
         return;
       }
-      const args = this.route === 'wsl' ? ['--cd', wslPath, 'mutmut', 'run'] : ['run'];
-      const child = spawn(command, args, { stdio: 'pipe', cwd: options.cwd });
 
-      let stderr = '';
+      const child = spawn(invocation.command, invocation.args, {
+        stdio: 'pipe',
+        cwd: options.cwd,
+      });
+
       let stdout = '';
-      let didTimeOut = false;
-      let settled = false;
+      let stderr = '';
+      let escalationId: NodeJS.Timeout | undefined;
+
+      // Both timers must be cancelled from three different terminal events
+      // (close, error, timeout). Keeping the pair in one place is what stops the
+      // settle path from drifting out of step with the timeout path.
+      const cancelTimers = (): void => {
+        clearTimeout(timeoutId);
+        if (escalationId) clearTimeout(escalationId);
+      };
+
+      const tracker = this.settleTracker(resolve, cancelTimers);
+
       const timeoutId = setTimeout(() => {
-        didTimeOut = true;
+        tracker.markTimedOut();
         child.kill('SIGTERM');
-        if (settled) return;
+        if (tracker.isSettled()) return;
+        // SIGTERM may be ignored; escalate once, and let the retry live in a
+        // variable so `cancelTimers` can reach it.
         escalationId = setTimeout(() => {
-          if (!settled) child.kill('SIGKILL');
+          if (!tracker.isSettled()) child.kill('SIGKILL');
         }, 5000);
       }, options.timeoutMs);
-      let escalationId: NodeJS.Timeout | undefined;
-
-      const settle = (outcome: MutationRunOutcome): void => {
-        if (settled) return;
-        settled = true;
-        if (timeoutId) clearTimeout(timeoutId);
-        if (escalationId) clearTimeout(escalationId);
-        resolve(outcome);
-      };
 
       child.stdout?.on('data', (data: Buffer) => {
         stdout += data.toString();
@@ -141,25 +193,23 @@ export class MutmutRunner implements MutationRunner {
       });
 
       child.on('close', (code) => {
-        clearTimeout(timeoutId);
-
+        // A null exit code means the process was killed ("timed out" when we did
+        // it, "unknown" otherwise); there is no report to parse either way.
         if (code === null) {
-          settle({ report: null, timedOut: didTimeOut });
+          tracker.settle({ report: null, timedOut: tracker.didTimeOut() });
           return;
         }
 
-        // Parse results from mutmut run stdout (v3.x emoji progress)
-        const report = this.parseEmojiProgress(stdout);
-        settle({
-          report,
-          timedOut: didTimeOut,
+        tracker.settle({
+          // Parse results from mutmut run stdout (v3.x emoji progress)
+          report: this.parseEmojiProgress(stdout),
+          timedOut: tracker.didTimeOut(),
           error: code !== 0 ? stderr || stdout : undefined,
         });
       });
 
       child.on('error', (err) => {
-        clearTimeout(timeoutId);
-        settle({ report: null, timedOut: didTimeOut, error: err.message });
+        tracker.settle({ report: null, timedOut: tracker.didTimeOut(), error: err.message });
       });
     });
   }

package/mutation/runners/pitest-runner.ts

@@ -38,48 +38,7 @@ export class PitestRunner implements MutationRunner {
   readonly extensions = ['java', 'kt', 'kts'];
 
   async isAvailable(): Promise<boolean> {
-    // Check Maven availability: mvn exists + pom.xml with pitest-maven plugin
-    try {
-      execSync('mvn --version', { stdio: 'pipe', timeout: 5000 });
-      if (existsSync('pom.xml')) {
-        const pom = readFileSync('pom.xml', 'utf-8');
-        if (
-          pom.includes('pitest-maven') ||
-          pom.includes('org.pitest')
-        ) {
-          return true;
-        }
-      }
-    } catch {
-      // Maven not available
-    }
-
-    // Check Gradle availability: gradle/gradlew exists + build.gradle(.kts) with pitest plugin
-    const gradlewPath = './gradlew';
-    const hasGradlew = existsSync(gradlewPath);
-    try {
-      if (!hasGradlew) {
-        execSync('gradle --version', { stdio: 'pipe', timeout: 5000 });
-      }
-      const buildGradle = existsSync('build.gradle.kts')
-        ? 'build.gradle.kts'
-        : existsSync('build.gradle')
-          ? 'build.gradle'
-          : null;
-      if (buildGradle) {
-        const content = readFileSync(buildGradle, 'utf-8');
-        if (
-          content.includes('info.solidsoft.pitest') ||
-          content.includes('info.solidsoft.gradle.pitest')
-        ) {
-          return true;
-        }
-      }
-    } catch {
-      return false;
-    }
-
-    return false;
+    return mavenPitestConfigured() || gradlePitestConfigured();
   }
 
   async run(options: RunMutationOptions): Promise<MutationRunOutcome> {
@@ -288,3 +247,62 @@ export class PitestRunner implements MutationRunner {
     }
   }
 }
+
+/**
+ * True when `command` can be executed at all.
+ *
+ * `execSync` with a short timeout is the cheapest cross-platform probe: the
+ * command either resolves and runs, or throws (missing / not executable). Only
+ * the throw matters here — the output is irrelevant.
+ */
+function commandRuns(command: string): boolean {
+  try {
+    execSync(command, { stdio: 'pipe', timeout: 5000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * True when `file` exists and contains any of `markers`.
+ *
+ * The read is guarded: a file can exist and still be unreadable (permissions,
+ * a directory named like a build file, a transient IO error). Treating that as
+ * "does not mention" keeps the caller's answer honest — an unreadable build file
+ * does not configure pitest — instead of throwing out of `isAvailable`.
+ */
+function fileMentions(file: string, markers: readonly string[]): boolean {
+  if (!existsSync(file)) return false;
+  try {
+    const content = readFileSync(file, 'utf-8');
+    return markers.some((marker) => content.includes(marker));
+  } catch {
+    return false;
+  }
+}
+
+/** Maven is usable when `mvn` runs and the POM configures the pitest plugin. */
+function mavenPitestConfigured(): boolean {
+  if (!commandRuns('mvn --version')) return false;
+  return fileMentions('pom.xml', ['pitest-maven', 'org.pitest']);
+}
+
+/**
+ * The Gradle build file PITest would read, preferring the Kotlin DSL.
+ * @returns the file name, or null when neither exists.
+ */
+function gradleBuildFile(): string | null {
+  if (existsSync('build.gradle.kts')) return 'build.gradle.kts';
+  if (existsSync('build.gradle')) return 'build.gradle';
+  return null;
+}
+
+/** Gradle is usable when a launcher runs and the build file configures pitest. */
+function gradlePitestConfigured(): boolean {
+  const hasWrapper = existsSync('./gradlew');
+  if (!hasWrapper && !commandRuns('gradle --version')) return false;
+  const buildFile = gradleBuildFile();
+  if (buildFile === null) return false;
+  return fileMentions(buildFile, ['info.solidsoft.pitest', 'info.solidsoft.gradle.pitest']);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@boyingliu01/xp-gate",
-  "version": "0.31.4",
+  "version": "0.32.0",
   "description": "AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow",
   "bin": {
     "xp-gate": "bin/xp-gate.js"
@@ -12,6 +12,7 @@
     "lib/",
     "skills/",
     "plugins/",
+    "dsh.bundle.patch.yml",
     "adapter-common.sh",
     "principles/",
     "mutation/",
@@ -25,10 +26,21 @@
     "gate-9.sh",
     "gate-10.sh",
     "gate-12-file-hygiene.sh",
+    "gate-13-compiler-strictness.sh",
     "sprint-gate.sh"
   ],
+  "dsh": {
+    "bundle": {
+      "patch": "./dsh.bundle.patch.yml"
+    }
+  },
   "exports": {
-    "./tui": "./plugins/opencode/tui-plugin.ts"
+    "./tui": "./plugins/opencode/tui-plugin.ts",
+    "./dsh": {
+      "import": "./plugins/dsh/lib/index.js",
+      "default": "./plugins/dsh/lib/index.js"
+    },
+    "./package.json": "./package.json"
   },
   "repository": {
     "type": "git",

package/plugins/claude-code/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "xp-gate",
-  "version": "0.31.4",
+  "version": "0.32.0",
   "displayName": "XP-Gate",
   "description": "Extreme Programming quality gates + AI workflow skills for Claude Code. Includes 12 pre-commit gates (Gate 0-11), 8 pre-push gates, Sprint Flow (6 phases), and Delphi multi-expert review (>=90% consensus).",
   "author": {

package/plugins/claude-code/skills/delphi-review/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/DELPHI-REVIEW KNOWLEDGE BASE
 
-**Generated:** 2026-10-26
-**Commit:** dfe3bf53
+**Generated:** 2026-10-28
+**Commit:** 0f58c300
 **Branch:** main
-**Version:** 0.31.4.0
+**Version:** 0.32.0.0
 
 ## OVERVIEW
 Delphi Consensus Review — multi-round anonymous expert review (≥90% threshold, exactly 3 experts with distinct executable model IDs). Supports design, requirements, and code-walkthrough modes.

package/plugins/claude-code/skills/sprint-flow/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/SPRINT-FLOW KNOWLEDGE BASE
 
-**Generated:** 2026-10-26
-**Commit:** dfe3bf53
+**Generated:** 2026-10-28
+**Commit:** 0f58c300
 **Branch:** main
-**Version:** 0.31.4.0
+**Version:** 0.32.0.0
 
 ## OVERVIEW
 **6-phase** development pipeline (v2.0 compact redesign, Issue #290): PREP → DESIGN → BUILD → VERIFY → SHIP → CLOSE. Phase 3/6 BUILD default build mode is **ralph-loop** (REQ-level iteration, 40-67% token savings vs parallel). HARD-GATE between DESIGN (2/6) and BUILD (3/6): design must pass Delphi review (≥90% consensus) before any coding.

package/plugins/claude-code/skills/test-specification-alignment/AGENTS.md

@@ -1,9 +1,9 @@
 # SKILLS/TEST-SPECIFICATION-ALIGNMENT KNOWLEDGE BASE
 
-**Generated:** 2026-10-26
-**Commit:** dfe3bf53
+**Generated:** 2026-10-28
+**Commit:** 0f58c300
 **Branch:** main
-**Version:** 0.31.4.0
+**Version:** 0.32.0.0
 
 ## OVERVIEW
 Test-Specification Alignment Engine — two-stage validation ensuring tests accurately reflect requirements and design specs.

package/plugins/dsh/lib/command.d.ts

@@ -0,0 +1,38 @@
+import { type ShellDialect } from "./dialect.js";
+export { type ShellDialect, detectDialect, shellQuote, shq } from "./dialect.js";
+/**
+ * Allowlist of xp-gate gate aliases that are safe to invoke standalone
+ * (non-preCommitOnly gates + common aliases). Anything outside this set is
+ * rejected before reaching the shell.
+ */
+export declare const GATE_WHITELIST: readonly ["duplicates", "complexity", "principles", "arch", "architecture", "iac", "secrets", "sast"];
+export type GateId = (typeof GATE_WHITELIST)[number];
+export declare function isGateAllowed(gate: string): boolean;
+export interface BuildCommandOptions {
+    subcommand: "check" | "principles" | "arch";
+    target?: string;
+    gates?: readonly string[];
+    config?: string;
+    /**
+     * Executor dialect. Defaults to `"posix"` so existing callers keep working;
+     * callers running under DSH on Windows must pass `"powershell"`.
+     */
+    dialect?: ShellDialect;
+}
+/**
+ * Build a single unconditional shell command.
+ *
+ * There is deliberately no presence probe. An earlier version wrapped the call
+ * in `if command -v xp-gate …; then …; else print hint; fi`, which left the exit
+ * code at 0 on the else branch — so a CLI that resolved but then failed produced
+ * empty stdout with exit 0, and the model read that as a pass.
+ *
+ * Running unconditionally turns "not installed" into an ordinary command-not-found
+ * (nonzero exit, empty output), which renderGateResult classifies as
+ * INDETERMINATE and pairs with an install hint. It also removes the branch that
+ * could not distinguish "absent" from "present but broken".
+ */
+export declare function buildCommand(options: BuildCommandOptions): string;
+/** Resolve a model-supplied path against the session cwd; absolutes pass through. */
+export declare function resolveTarget(rawPath: string, cwd: string): string;
+//# sourceMappingURL=command.d.ts.map

package/plugins/dsh/lib/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../src/command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,YAAY,EAAc,MAAM,cAAc,CAAA;AAI5D,OAAO,EAAE,KAAK,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAEhF;;;;GAIG;AACH,eAAO,MAAM,cAAc,uGASjB,CAAA;AAEV,MAAM,MAAM,MAAM,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,OAAO,GAAG,YAAY,GAAG,MAAM,CAAA;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,OAAO,CAAC,EAAE,YAAY,CAAA;CACvB;AA+BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAajE;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAElE"}

package/plugins/dsh/lib/command.js

@@ -0,0 +1,87 @@
+import { isAbsolute, resolve } from "node:path";
+import { shellQuote } from "./dialect.js";
+// Re-exported so existing importers of this module keep working; the dialect
+// primitives themselves live in ./dialect.ts.
+export { detectDialect, shellQuote, shq } from "./dialect.js";
+/**
+ * Allowlist of xp-gate gate aliases that are safe to invoke standalone
+ * (non-preCommitOnly gates + common aliases). Anything outside this set is
+ * rejected before reaching the shell.
+ */
+export const GATE_WHITELIST = [
+    "duplicates",
+    "complexity",
+    "principles",
+    "arch",
+    "architecture",
+    "iac",
+    "secrets",
+    "sast",
+];
+export function isGateAllowed(gate) {
+    return GATE_WHITELIST.includes(gate);
+}
+function buildInner(options, dialect) {
+    const { subcommand, target, gates, config } = options;
+    const q = (value) => shellQuote(value, dialect);
+    if (subcommand === "check") {
+        const tokens = ["xp-gate", "check"];
+        if (target !== undefined)
+            tokens.push(q(target));
+        if (gates !== undefined && gates.length > 0) {
+            // Defense-in-depth: the JSON-schema enum already rejects unknown gate ids,
+            // but we also whitelist here so a non-whitelisted value can never reach the shell.
+            const allowed = gates.filter(isGateAllowed);
+            if (allowed.length > 0)
+                tokens.push("--gates", q(allowed.join(",")));
+        }
+        return tokens.join(" ");
+    }
+    if (subcommand === "principles") {
+        const tokens = ["xp-gate", "principles"];
+        if (target !== undefined)
+            tokens.push(q(target));
+        return tokens.join(" ");
+    }
+    // subcommand === "arch" — the only remaining member of the union.
+    // #447: the default path runs the pinned local @archlinter/cli with its
+    // built-in rules — no config needed. Forcing `--config architecture.yaml`
+    // (the old default) hit the pre-0.16 schema that archlint itself rejects.
+    // Only forward an explicitly provided config, via the opt-in --use-config.
+    const tokens = ["xp-gate", "arch"];
+    if (config !== undefined)
+        tokens.push("--use-config", q(config));
+    return tokens.join(" ");
+}
+/**
+ * Build a single unconditional shell command.
+ *
+ * There is deliberately no presence probe. An earlier version wrapped the call
+ * in `if command -v xp-gate …; then …; else print hint; fi`, which left the exit
+ * code at 0 on the else branch — so a CLI that resolved but then failed produced
+ * empty stdout with exit 0, and the model read that as a pass.
+ *
+ * Running unconditionally turns "not installed" into an ordinary command-not-found
+ * (nonzero exit, empty output), which renderGateResult classifies as
+ * INDETERMINATE and pairs with an install hint. It also removes the branch that
+ * could not distinguish "absent" from "present but broken".
+ */
+export function buildCommand(options) {
+    const dialect = options.dialect ?? "posix";
+    const inner = buildInner(options, dialect);
+    if (dialect === "posix") {
+        // Merge stderr into stdout so a failure that only writes to stderr still
+        // reaches the renderer, then echo the status so the exit code survives the
+        // pipeline.
+        return `${inner} 2>&1; printf '\\n[XP-Gate] exit:%s\\n' "$?"`;
+    }
+    // PowerShell: merge streams and report $LASTEXITCODE explicitly. The
+    // .cmd/.ps1 shims npm writes under %APPDATA%\npm are visible here but not to a
+    // Git-Bash PATH lookup, which is why Windows uses this dialect.
+    return `${inner} 2>&1; Write-Output "[XP-Gate] exit:$LASTEXITCODE"`;
+}
+/** Resolve a model-supplied path against the session cwd; absolutes pass through. */
+export function resolveTarget(rawPath, cwd) {
+    return isAbsolute(rawPath) ? rawPath : resolve(cwd, rawPath);
+}
+//# sourceMappingURL=command.js.map

package/plugins/dsh/lib/credentials.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Resolve the API key that a Delphi provider config points at, without assuming the
+ * value is in this process's environment.
+ *
+ * The credential service shipped with DSH layers environment, a provider-managed
+ * store, and `.env` files behind one `CredentialRef`. That is exactly the order the
+ * plugin needs: on the machine that prompted this work the key lived in a user-level
+ * environment variable and in `~/.dsh/.credentials.yaml`, while DSH's own process
+ * inherited neither — so `delphi-review` failed with a missing-variable error while
+ * every other gate worked.
+ *
+ * Resolution is deliberately single-layer. When `ctx.credentials` is present and
+ * reports `undefined`, this module does NOT fall back to `process.env`: the service
+ * has already consulted the environment, so a second look would resurrect a value it
+ * deliberately reported as absent and would make a DSH session resolve differently
+ * from a terminal session.
+ */
+/** A credential service, narrowed to the one method this module needs. */
+export interface CredentialService {
+    resolve(ref: unknown): Promise<{
+        value: string;
+    } | undefined>;
+}
+/** Resolve one environment-variable-style reference to its current value. */
+export type ApiKeyResolver = (ref: string) => Promise<string | undefined>;
+/**
+ * Build an `ApiKeyResolver` over the available credential service.
+ *
+ * @param credentials - `ctx.credentials`, or undefined when the host does not offer
+ *   one. Absence degrades to reading the process environment directly, which keeps
+ *   the plugin working outside DSH (CLI use, tests).
+ * @param env - environment to read in that fallback. Injected rather than read from
+ *   the global so the module stays testable offline.
+ * @param brand - converts a raw name into the service's nominal `CredentialRef`.
+ *   Injected so this module needs no import of the peer package and tests can pass
+ *   an identity function.
+ */
+export declare function createCredentialResolver(credentials: CredentialService | undefined, env: NodeJS.ProcessEnv, brand?: (value: string) => unknown): ApiKeyResolver;
+//# sourceMappingURL=credentials.d.ts.map

package/plugins/dsh/lib/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,0EAA0E;AAC1E,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;CAC9D;AAED,6EAA6E;AAC7E,MAAM,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;AAYzE;;;;;;;;;;;GAWG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,iBAAiB,GAAG,SAAS,EAC1C,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,KAAK,GAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAA0B,GACnD,cAAc,CAkBhB"}

package/plugins/dsh/lib/credentials.js

@@ -0,0 +1,57 @@
+/**
+ * Resolve the API key that a Delphi provider config points at, without assuming the
+ * value is in this process's environment.
+ *
+ * The credential service shipped with DSH layers environment, a provider-managed
+ * store, and `.env` files behind one `CredentialRef`. That is exactly the order the
+ * plugin needs: on the machine that prompted this work the key lived in a user-level
+ * environment variable and in `~/.dsh/.credentials.yaml`, while DSH's own process
+ * inherited neither — so `delphi-review` failed with a missing-variable error while
+ * every other gate worked.
+ *
+ * Resolution is deliberately single-layer. When `ctx.credentials` is present and
+ * reports `undefined`, this module does NOT fall back to `process.env`: the service
+ * has already consulted the environment, so a second look would resurrect a value it
+ * deliberately reported as absent and would make a DSH session resolve differently
+ * from a terminal session.
+ */
+/**
+ * Environment-variable names: a POSIX shell identifier. Anything else cannot name a
+ * credential, so it reads as "not set" rather than reaching the store.
+ */
+const REFERENCE_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function isReferenceName(value) {
+    return REFERENCE_NAME.test(value);
+}
+/**
+ * Build an `ApiKeyResolver` over the available credential service.
+ *
+ * @param credentials - `ctx.credentials`, or undefined when the host does not offer
+ *   one. Absence degrades to reading the process environment directly, which keeps
+ *   the plugin working outside DSH (CLI use, tests).
+ * @param env - environment to read in that fallback. Injected rather than read from
+ *   the global so the module stays testable offline.
+ * @param brand - converts a raw name into the service's nominal `CredentialRef`.
+ *   Injected so this module needs no import of the peer package and tests can pass
+ *   an identity function.
+ */
+export function createCredentialResolver(credentials, env, brand = (value) => value) {
+    return async (ref) => {
+        if (!isReferenceName(ref))
+            return undefined;
+        if (credentials !== undefined) {
+            try {
+                const resolved = await credentials.resolve(brand(ref));
+                return resolved?.value;
+            }
+            catch {
+                // A broken provider must not take the tool down; the caller turns the
+                // missing value into a DelphiSetupError that names the variable.
+                return undefined;
+            }
+        }
+        const value = env[ref];
+        return typeof value === "string" && value.length > 0 ? value : undefined;
+    };
+}
+//# sourceMappingURL=credentials.js.map