@cleocode/cleo 2026.9.7 → 2026.9.10

package/studio-dist/server/chunks/credential-pool-vF6NdtT9.js

@@ -1,4600 +0,0 @@
-import { h as getCleoHome, g as getCleoHome$1, b as getLogger, F as getCleoPlatformPaths, Q as parseClaudeCodeCredentials } from './paths-CV7S5-Zm.js';
-import { existsSync, mkdirSync, writeFileSync, readFileSync, renameSync, unlinkSync, readdirSync, statSync, chmodSync } from 'node:fs';
-import { dirname, join, basename } from 'node:path';
-import { randomBytes, randomUUID } from 'node:crypto';
-import { p as properLockfileExports } from './index-Dtt_h58T.js';
-import { a as getConfigValue } from './config-DHj9CcFs.js';
-import { pathToFileURL } from 'node:url';
-import 'node:child_process';
-import { homedir } from 'node:os';
-
-//#region ../core/dist/store/file-utils.js
-/**
-* File utility helpers for CLEO data access.
-*
-* File utility helpers for CLEO data access including atomic writes,
-* file locking, and backup rotation.
-*
-* @task T4833
-* @epic T4654
-*/
-/**
-* Maximum number of operational backups to keep.
-*/
-var MAX_BACKUPS = 10;
-/**
-* Create a numbered backup of a file (Tier 1 operational backup).
-*
-* When `mode` is provided, the backup directory is created at `mode`
-* (translated to a directory-execute bit) and each rotated backup is
-* written at `mode` so secrets never leak through historical copies.
-*/
-function rotateBackup(filePath, mode) {
-	const dir = dirname(filePath);
-	const name = basename(filePath);
-	const backupDir = join(dir, ".backups");
-	const dirMode = typeof mode === "number" ? modeToDirMode(mode) : void 0;
-	if (!existsSync(backupDir)) mkdirSync(backupDir, {
-		recursive: true,
-		mode: dirMode
-	});
-	for (let i = MAX_BACKUPS; i >= 1; i--) {
-		const current = join(backupDir, `${name}.${i}`);
-		if (i === MAX_BACKUPS) try {
-			unlinkSync(current);
-		} catch {}
-		else {
-			const next = join(backupDir, `${name}.${i + 1}`);
-			try {
-				if (existsSync(current)) renameSync(current, next);
-			} catch {}
-		}
-	}
-	try {
-		const content = readFileSync(filePath, "utf-8");
-		const backupPath = join(backupDir, `${name}.1`);
-		if (typeof mode === "number") writeFileSync(backupPath, content, {
-			encoding: "utf-8",
-			mode
-		});
-		else writeFileSync(backupPath, content, "utf-8");
-	} catch {}
-}
-/**
-* Translate a file mode (e.g. 0o600) into the matching directory mode by
-* mirroring read bits into execute bits. 0o600 → 0o700, 0o644 → 0o755.
-*
-* Directories need execute (`x`) where files only need read (`r`) — that's
-* how POSIX gates `readdir`/`stat` of children. Without this, a 0600 file
-* in a 0644 directory is still listable by other users.
-*
-* @task T-LLM-CRED-CENTRALIZATION Phase 2 — security review S-03
-*/
-function modeToDirMode(mode) {
-	let result = mode & 511;
-	if (result & 256) result |= 64;
-	if (result & 32) result |= 8;
-	if (result & 4) result |= 1;
-	return result;
-}
-/**
-* Write a JSON file atomically with backup rotation.
-*
-* Pattern: write temp -> backup original -> rename temp to target
-*
-* When `opts.mode` is provided, the temp file AND the rotated backup
-* are both created at that mode so there is no instant at which the
-* live file (or any historical copy) exists at a looser mode. This is
-* REQUIRED for secret-bearing files such as `llm-credentials.json`;
-* passing 0o600 closes CWE-276 (incorrect default permissions) and
-* CWE-367 (rename → chmod TOCTOU) together.
-*
-* Back-compat: callers that omit `opts` (or pass a number, for the old
-* `indent` positional form) get the legacy default-umask behavior so no
-* existing usage changes.
-*
-* @param filePath - Target file path.
-* @param data - Data to serialize as JSON.
-* @param optsOrIndent - Options object, or a number for legacy `indent`
-*   positional form.
-*
-* @task T-LLM-CRED-CENTRALIZATION Phase 2 — security review S-01/S-02
-*/
-function writeJsonFileAtomic(filePath, data, optsOrIndent = 2) {
-	const opts = typeof optsOrIndent === "number" ? { indent: optsOrIndent } : optsOrIndent;
-	const indent = opts.indent ?? 2;
-	const mode = opts.mode;
-	const tempPath = join(dirname(filePath), `.${basename(filePath)}.${randomBytes(6).toString("hex")}.tmp`);
-	const content = JSON.stringify(data, null, indent) + "\n";
-	if (typeof mode === "number") writeFileSync(tempPath, content, {
-		encoding: "utf-8",
-		mode
-	});
-	else writeFileSync(tempPath, content, "utf-8");
-	try {
-		if (existsSync(filePath)) rotateBackup(filePath, mode);
-		renameSync(tempPath, filePath);
-	} catch (error) {
-		try {
-			unlinkSync(tempPath);
-		} catch {}
-		throw error;
-	}
-}
-/**
-* Read a JSON file, returning parsed content or null if not found.
-*
-* @param filePath - Path to the JSON file
-*/
-function readJsonFile(filePath) {
-	try {
-		const content = readFileSync(filePath, "utf-8");
-		return JSON.parse(content);
-	} catch (error) {
-		if (error.code === "ENOENT") return null;
-		throw error;
-	}
-}
-/**
-* Default lock options matching bash flock behavior
-*/
-var LOCK_OPTIONS = {
-	retries: {
-		retries: 5,
-		factor: 2,
-		minTimeout: 100,
-		maxTimeout: 5e3
-	},
-	stale: 3e4
-};
-/**
-* Read and write a JSON file with exclusive locking.
-*
-* Acquires a cross-process lock, reads current state, applies the
-* transform function, validates, and writes back atomically.
-*
-* When `opts.mode` is provided, every filesystem mutation in this path
-* (parent dir create, sentinel empty file, atomic write, rotated backup)
-* is constrained to the requested mode so secret-bearing data never
-* touches the disk at a looser permission.
-*
-* @param filePath - File to lock and modify.
-* @param transform - Function that receives current data and returns new data.
-* @param opts - Optional mode override for secret-bearing writes.
-* @returns The transformed data.
-*
-* @task T-LLM-CRED-CENTRALIZATION Phase 2 — security review S-01/S-02/S-03
-*/
-async function withLock(filePath, transform, opts = {}) {
-	const dir = dirname(filePath);
-	const dirMode = typeof opts.mode === "number" ? modeToDirMode(opts.mode) : void 0;
-	if (!existsSync(dir)) mkdirSync(dir, {
-		recursive: true,
-		mode: dirMode
-	});
-	if (!existsSync(filePath)) if (typeof opts.mode === "number") writeFileSync(filePath, "", {
-		encoding: "utf-8",
-		mode: opts.mode
-	});
-	else writeFileSync(filePath, "", "utf-8");
-	let release;
-	try {
-		release = await properLockfileExports.lock(filePath, LOCK_OPTIONS);
-		const updated = transform(readJsonFile(filePath));
-		writeJsonFileAtomic(filePath, updated, { mode: opts.mode });
-		return updated;
-	} finally {
-		if (release) await release();
-	}
-}
-/**
-* Acquire a file lock and execute an operation.
-* Unlike withLock, this doesn't read/write the file - caller manages I/O.
-* The return type R is independent of the file content type.
-*/
-async function withFileLock(filePath, operation) {
-	const dir = dirname(filePath);
-	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-	if (!existsSync(filePath)) writeFileSync(filePath, "", "utf-8");
-	let release;
-	try {
-		release = await properLockfileExports.lock(filePath, LOCK_OPTIONS);
-		return await operation();
-	} finally {
-		if (release) await release();
-	}
-}
-
-//#region ../core/dist/llm/stable-device-id.js
-/**
-* Stable device identifier — persisted UUIDv4 keyed to the CLEO home directory.
-*
-* Used by providers that enforce device-ID stability on every request
-* (`X-Msh-Device-Id` for Kimi Code; future GitHub Copilot / Cursor). The UUID
-* is written once at first use and reused across processes — losing it would
-* trigger device re-registration prompts upstream.
-*
-* Storage: `${CLEO_HOME}/device-id` — single-line UUIDv4, no metadata. Path
-* resolves through `getCleoHome()` so it follows XDG conventions on Linux
-* and stays inside the CLEO home on Windows/macOS.
-*
-* @module llm/stable-device-id
-* @task T9321
-* @epic T9261 T-LLM-CRED-CENTRALIZATION
-*/
-/** Filename within `getCleoHome()` storing the persisted UUID. */
-var DEVICE_ID_FILE = "device-id";
-/** Process-lifetime cache so repeat callers do not re-read the disk. */
-var _cachedDeviceId = null;
-/**
-* Return the stable device UUID for this CLEO installation.
-*
-* Creates the file on first call (atomic write — tmp+rename pattern). All
-* subsequent calls in the same process return the cached value. Across
-* processes, the file is the source of truth.
-*
-* The UUID is OPAQUE — callers MUST treat it as a stable identifier and not
-* encode any meaning into its bytes.
-*
-* @returns A UUIDv4 string in canonical hyphenated form.
-*
-* @task T9321
-*/
-function getStableDeviceId() {
-	if (_cachedDeviceId !== null) return _cachedDeviceId;
-	const path = join(getCleoHome(), DEVICE_ID_FILE);
-	if (existsSync(path)) try {
-		const raw = readFileSync(path, "utf-8").trim();
-		if (raw.length > 0) {
-			_cachedDeviceId = raw;
-			return raw;
-		}
-	} catch {}
-	const fresh = randomUUID();
-	try {
-		const dir = dirname(path);
-		if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-		const tmpPath = `${path}.tmp.${process.pid}`;
-		writeFileSync(tmpPath, fresh, { mode: 384 });
-		renameSync(tmpPath, path);
-	} catch {}
-	_cachedDeviceId = fresh;
-	return fresh;
-}
-//#endregion
-//#region ../core/dist/llm/provider-registry/builtin/kimi-code.js
-/**
-* Builtin provider profile for Kimi Code (kimi.com/code).
-*
-* Kimi Code is Moonshot AI's coding-focused offering accessible via two key
-* shapes that share a single chat endpoint:
-*
-* - **`sk-kimi-*` API keys** issued through https://kimi.com/code — sent as
-*   `Authorization: Bearer <key>` against https://api.kimi.com/coding. The
-*   endpoint speaks the Anthropic Messages protocol (so the Anthropic SDK
-*   works out of the box once the base URL is overridden).
-* - **OAuth device-code** flow against https://auth.kimi.com using public
-*   client `17e5f671-d194-4dfb-9706-5516cb48c098`. Yields an access token
-*   (~15 min lifetime) + refresh token (~30 day lifetime). The access token
-*   targets the same chat endpoint with the same protocol.
-*
-* The provider also requires six mandatory `X-Msh-*` headers on every
-* request — without them the backend rejects with 401. The `X-Msh-Device-Id`
-* must be a stable UUID persisted to disk (see {@link getStableDeviceId}).
-*
-* Note: the "legacy" Moonshot OpenAI-compat endpoint at api.moonshot.ai/v1
-* is served by the separate `moonshot` provider profile — Kimi Code is a
-* distinct provider with a different protocol and authentication path.
-*
-* @task T9321
-* @epic T9261 T-LLM-CRED-CENTRALIZATION
-* @see packages/core/src/llm/oauth/device-code.ts — Kimi device-code preset
-* @see packages/core/src/llm/stable-device-id.ts — persisted device UUID
-*/
-/** Coding endpoint base URL — Anthropic Messages protocol. */
-var KIMI_CODE_BASE_URL = "https://api.kimi.com/coding";
-/** Default model — Moonshot's coding-tier Kimi K2. */
-var DEFAULT_MODEL = "kimi-k2-coding";
-/**
-* Build the six mandatory `X-Msh-*` headers required by the Kimi Code
-* backend. Missing any header triggers 401 errors regardless of credential.
-*
-* `X-Msh-Device-Id` is sourced from {@link getStableDeviceId} which persists
-* a UUIDv4 once at `${CLEO_HOME}/device-id` and reuses it forever — the
-* backend tracks devices and would force re-registration on drift.
-*
-* @returns Header object suitable for spreading into request headers.
-*
-* @task T9321
-*/
-function getKimiCodeMshHeaders() {
-	return {
-		"X-Msh-Platform": "cleo",
-		"X-Msh-Version": "1",
-		"X-Msh-Device-Name": "cleo-cli",
-		"X-Msh-Device-Model": "cleo",
-		"X-Msh-Os-Version": process.version,
-		"X-Msh-Device-Id": getStableDeviceId()
-	};
-}
-/**
-* Detect whether an API key is a Kimi Code coding-plan key.
-*
-* Kimi Code issues keys with the `sk-kimi-` prefix. Other keys (e.g. legacy
-* `mk-` Moonshot platform keys) MUST go through the `moonshot` provider,
-* not `kimi-code`.
-*
-* @param apiKey - The credential's API-key string.
-* @returns `true` when the key targets the Kimi Code coding endpoint.
-*
-* @task T9321
-*/
-function isKimiCodeApiKey(apiKey) {
-	return apiKey.startsWith("sk-kimi-");
-}
-/**
-* Kimi Code provider profile.
-*
-* Speaks the Anthropic Messages protocol against api.kimi.com/coding. The
-* mandatory `X-Msh-*` headers are merged into every request via
-* {@link defaultHeaders}. OAuth bearer tokens issued by the device-code flow
-* are accepted alongside `sk-kimi-` API keys.
-*
-* @task T9321
-* @task T9286 (W1d — added reasoning_effort hook)
-*/
-var kimiCodeProfile = {
-	name: "kimi-code",
-	displayName: "Kimi Code (Moonshot)",
-	authTypes: ["api_key", "oauth"],
-	baseUrl: KIMI_CODE_BASE_URL,
-	defaultModel: DEFAULT_MODEL,
-	aliases: [
-		"kimi",
-		"moonshot-coding",
-		"kimi-coding"
-	],
-	defaultHeaders: getKimiCodeMshHeaders(),
-	envVars: ["KIMI_CODE_API_KEY", "KIMI_API_KEY"],
-	buildApiKwargsExtras() {
-		return { reasoning_effort: "high" };
-	}
-};
-
-/**
-* Resolve the Anthropic OAuth client ID.
-*
-* Prefers `CLEO_ANTHROPIC_OAUTH_CLIENT_ID` env var; falls back to the
-* canonical public client_id. No warning is emitted in the fallback path —
-* the public client_id is the production-correct default.
-*/
-function resolveAnthropicClientId() {
-	return process.env["CLEO_ANTHROPIC_OAUTH_CLIENT_ID"] ?? "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
-}
-/**
-* Anthropic Claude provider profile.
-*
-* - `authTypes` includes both `api_key` (long-lived `sk-ant-*` keys) and
-*   `oauth` (short-lived `sk-ant-oat-*` bearer tokens from Claude Code).
-* - `defaultHeaders` pins the stable `anthropic-version: 2023-06-01` API
-*   version header required by all Anthropic Messages API requests.
-* - `fetchModels` is omitted — the Anthropic API does not expose a public
-*   `/models` endpoint for arbitrary callers. Callers fall back to the
-*   static model list maintained in `@cleocode/core/llm`.
-* - `oauth` configures the RFC 7636 PKCE flow used by `cleo llm login anthropic`.
-*/
-var anthropicProfile = {
-	name: "anthropic",
-	displayName: "Anthropic Claude",
-	authTypes: ["api_key", "oauth"],
-	baseUrl: "https://api.anthropic.com",
-	defaultModel: "claude-haiku-4-5-20251001",
-	aliases: ["claude", "anthropic-api"],
-	tier: "frontier",
-	defaultAuxModel: "claude-haiku-4-5-20251001",
-	defaultMaxTokens: 4096,
-	defaultHeaders: { "anthropic-version": "2023-06-01" },
-	oauth: {
-		mode: "pkce",
-		clientId: resolveAnthropicClientId(),
-		authorizationEndpoint: "https://claude.ai/oauth/authorize",
-		tokenEndpoint: "https://platform.claude.com/v1/oauth/token",
-		scope: "org:create_api_key user:profile user:inference",
-		redirectUri: "https://platform.claude.com/oauth/code/callback",
-		extraAuthParams: { code: "true" },
-		tokenBodyFormat: "json"
-	}
-};
-//#endregion
-//#region ../core/dist/llm/provider-registry/builtin/bedrock.js
-/**
-* Builtin provider profile for AWS Bedrock (Converse API).
-*
-* AWS Bedrock exposes many foundation models through a uniform Converse API.
-* This profile covers the common model ID prefixes:
-* - `anthropic.claude-*` — Anthropic Claude models on Bedrock
-* - `amazon.nova-*`      — Amazon Nova series
-* - `mistral.mistral-*`  — Mistral AI models on Bedrock
-* - `meta.llama*`        — Meta Llama models on Bedrock
-* - `cohere.command-*`   — Cohere Command models on Bedrock
-*
-* Credential auth for Bedrock uses the standard AWS credential chain
-* (`fromNodeProviderChain`), not an API key. The `authTypes: ['aws_sdk']`
-* declaration is informational — the actual resolution happens inside
-* `BedrockTransport` via the AWS SDK credential chain.
-*
-* @task T9317
-* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 5)
-*/
-/**
-* AWS Bedrock provider profile.
-*
-* - `authTypes` is `['aws_sdk']` — informational for the credential store
-*   UI. Actual resolution uses `fromNodeProviderChain()` inside the transport.
-* - `fetchModels` is omitted — the Bedrock model catalog is large and
-*   region-specific. Use `cleo llm refresh-catalog` (T9314) for discovery.
-* - `defaultModel` targets Claude Sonnet 3.7, widely available across regions.
-*/
-var bedrockProfile = {
-	name: "bedrock",
-	displayName: "AWS Bedrock",
-	authTypes: ["aws_sdk"],
-	baseUrl: "https://bedrock-runtime.{region}.amazonaws.com",
-	defaultModel: "anthropic.claude-3-5-sonnet-20241022-v2:0",
-	aliases: ["aws-bedrock", "bedrock-converse"]
-};
-//#endregion
-//#region ../core/dist/llm/provider-registry/builtin/gemini.js
-/**
-* Builtin provider profile for Google Gemini (OpenAI-compat shim).
-*
-* Gemini exposes an OpenAI-compatible shim at
-* `https://generativelanguage.googleapis.com/v1beta/openai` that accepts
-* the standard `chat.completions.create` wire shape. The Gemini-specific
-* quirk is the `extra_body.thinking_config` field which controls extended
-* reasoning budget selection.
-*
-* @task T9286 (W1d)
-* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 3)
-*/
-/**
-* Build the Gemini thinking configuration object for `extra_body`.
-*
-* Budget selection:
-* - `'auto'` — Gemini 1.x and 2.x models, and any model with `flash` in the
-*   name (Flash-tier models use dynamic budget allocation).
-* - `'high'` — Gemini 3 Pro and newer high-capability variants that support
-*   explicit budget control without automatic fallback.
-*
-* @invariant gemini-thinking-config: Gemini requires `extra_body.thinking_config`
-* for extended reasoning. Budget is model-aware: 'auto' for ≤2.x/flash,
-* 'high' for ≥3.x non-flash. This quirk is DISTINCT from Moonshot's shallow
-* schema sanitizer and Gemini's own deep schema sanitizer.
-*
-* @param model - Lowercase model identifier string.
-* @returns Thinking config record for `extra_body.thinking_config`.
-*/
-function buildGeminiThinkingConfig(model) {
-	if (/gemini-3|gemini3/.test(model) && !model.includes("flash")) return { thinking_budget: "high" };
-	return { thinking_budget: "auto" };
-}
-/**
-* Google Gemini provider profile (OpenAI-compatible shim).
-*
-* Encodes the Gemini thinking config quirk as a `buildExtraBody` hook.
-*
-* @task T9286 (W1d)
-*/
-var geminiProfile = {
-	name: "gemini",
-	displayName: "Google Gemini",
-	authTypes: ["api_key"],
-	baseUrl: "https://generativelanguage.googleapis.com/v1beta/openai",
-	defaultModel: "gemini-2.0-flash",
-	aliases: ["google", "google-gemini"],
-	tier: "standard",
-	defaultAuxModel: "gemini-2.0-flash",
-	defaultMaxTokens: 4096,
-	envVars: ["GEMINI_API_KEY", "GOOGLE_API_KEY"],
-	buildExtraBody(model) {
-		return { thinking_config: buildGeminiThinkingConfig(model.toLowerCase()) };
-	}
-};
-//#endregion
-//#region ../core/dist/llm/provider-registry/builtin/moonshot.js
-/**
-* Builtin provider profile for Moonshot AI (Kimi K2 legacy endpoint).
-*
-* This profile covers the **legacy** Moonshot OpenAI-compatible surface at
-* `api.moonshot.ai/v1`. It is distinct from the Kimi Code coding-plan
-* endpoint (see `kimi-code.ts` which targets `api.kimi.com/coding` with
-* Anthropic Messages protocol and device-code OAuth).
-*
-* Quirks encoded in this profile:
-* - Rejects `thinkingBudgetTokens` — Moonshot's API does not expose a
-*   thinking-budget parameter (Anthropic-style). Callers MUST NOT set it.
-* - Sanitizes tool JSON schemas: removes `$schema` and root-level
-*   `additionalProperties` which the Moonshot backend rejects.
-*
-* @task T9286 (W1d)
-* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 3)
-*/
-/** Moonshot API base URL (OpenAI-compatible endpoint). */
-var MOONSHOT_BASE_URL = "https://api.moonshot.ai/v1";
-/** Default Kimi K2 coding model identifier. */
-var MOONSHOT_DEFAULT_MODEL = "kimi-k2-0905-preview";
-/**
-* Strip Moonshot-incompatible fields from a single TransportTool's inputSchema.
-*
-* @invariant moonshot-shallow-sanitize: Moonshot rejects `$schema` and root-level
-* `additionalProperties` in tool parameter schemas. This sanitizer removes
-* both fields WITHOUT touching nested schemas (shallow-only — Gemini has its
-* own separate recursive deep sanitizer that walks the entire schema tree).
-*
-* @param tool - Provider-neutral TransportTool from the request.
-* @returns Tool copy with sanitized root-level `inputSchema`.
-*/
-function sanitizeMoonshotTransportTool(tool) {
-	const sanitizedSchema = { ...tool.inputSchema };
-	delete sanitizedSchema["$schema"];
-	delete sanitizedSchema["additionalProperties"];
-	return {
-		...tool,
-		inputSchema: sanitizedSchema
-	};
-}
-/**
-* Moonshot AI provider profile (Kimi K2 legacy OpenAI-compat endpoint).
-*
-* Encodes two provider-specific quirks as ProviderProfile hooks:
-*
-* 1. `buildApiKwargsExtras` — rejects `thinkingBudgetTokens` (not supported).
-* 2. `buildExtraBody` — sanitizes tool schemas (removes `$schema` +
-*    root-level `additionalProperties`) for every Moonshot request that
-*    carries tools.
-*
-* @task T9286 (W1d)
-*/
-var moonshotProfile = {
-	name: "moonshot",
-	displayName: "Moonshot AI (Kimi K2)",
-	authTypes: ["api_key"],
-	baseUrl: MOONSHOT_BASE_URL,
-	defaultModel: MOONSHOT_DEFAULT_MODEL,
-	aliases: ["kimi-k2", "moonshot-ai"],
-	envVars: ["MOONSHOT_API_KEY"],
-	buildApiKwargsExtras(_model, _messages, _tools) {
-		return {};
-	},
-	buildExtraBody(_model, _messages, tools) {
-		if (tools.length === 0) return {};
-		return { __sanitizedTransportTools: tools.map(sanitizeMoonshotTransportTool) };
-	}
-};
-//#endregion
-//#region ../core/dist/llm/provider-registry/builtin/ollama.js
-/**
-* Builtin provider profile for Ollama.
-*
-* Ollama is a local/self-hosted LLM runtime that exposes a `/api/chat`
-* endpoint speaking its own NDJSON streaming protocol (`ollama_native`
-* ApiMode). It is NOT an OpenAI-compatible shim — use {@link OllamaTransport}
-* from `packages/core/src/llm/transports/ollama.ts`.
-*
-* Key characteristics:
-* - No API key required for local deployments (empty-string placeholder).
-* - Base URL defaults to `http://localhost:11434` (the well-known Ollama port).
-* - Tool calling uses the same OpenAI wire shape for REQUEST but returns
-*   `arguments` as an object (not a JSON string) in the RESPONSE.
-* - No prompt-caching support.
-*
-* @task T9355 (Task A — Ollama transport, D-ph4-05 closure)
-* @epic T9354
-*/
-/**
-* Ollama provider profile.
-*
-* Registers the `ollama` canonical name and `ollama-local` alias so that
-* `cleo llm test ollama` and `getProviderProfile('ollama-local')` both
-* resolve to this profile.
-*
-* The profile declares `apiMode: 'ollama_native'` which is used by the
-* session factory to select {@link OllamaTransport} at runtime.
-*
-* `authTypes: ['api_key']` is listed for compatibility with the credential
-* store API, but local Ollama deployments do not require an actual key —
-* users may leave it empty or store a token for remote/proxied deployments.
-*
-* ## Default model selection (DHQ-081 · T11978 · T11990)
-*
-* `defaultModel` is `gemma4:e4b` (standard/frontier tasks, requires ≥ 8 GB RAM).
-* `defaultAuxModel` is `gemma4:e2b` (fast/aux tasks, requires ≥ 4 GB RAM).
-*
-* Tags live-verified on ollama.com/library/gemma4 2026-06-11:
-*   - gemma4:e2b  = 7.2 GB download (Q4_K_M), edge 2B effective params
-*   - gemma4:e4b  = 9.6 GB download (Q4_K_M), edge 4B effective params
-*   - gemma4:12b  = 7.6 GB download (QAT), 12B params, 256k context
-*
-* The cross-provider selector (`cross-provider-selector.ts`) gates model selection
-* on `os.totalmem()` and falls through to `qwen2:0.5b` only as a proof-of-life
-* last resort when RAM is below 4 GB. These are the provider-registry SSoT
-* constants; the selector reads them via `getProviderProfile('ollama')`.
-*
-* If the catalog does not yet have a `gemma4` family entry, the resolver logs a
-* hint to run `cleo llm refresh-catalog`.
-*/
-var ollamaProfile = {
-	name: "ollama",
-	displayName: "Ollama (local)",
-	authTypes: ["api_key"],
-	baseUrl: "http://localhost:11434",
-	defaultModel: "gemma4:e4b",
-	aliases: ["ollama-local"],
-	tier: "local",
-	defaultAuxModel: "gemma4:e2b",
-	defaultMaxTokens: 2048,
-	envVars: ["OLLAMA_API_KEY", "OLLAMA_BASE_URL"],
-	supportsThinkingBudget: false
-};
-/** Resolve the OpenAI OAuth client id (env override → canonical default). */
-function resolveOpenaiClientId() {
-	return process.env["CLEO_OPENAI_OAUTH_CLIENT_ID"] ?? "app_EMoamEEZ73f0CkXaXp7hrann";
-}
-/**
-* OpenAI / Codex provider profile.
-*
-* `defaultModel` is a static FALLBACK used when no live catalog snapshot is
-* available (i.e. before `cleo llm refresh-catalog` has been run). At runtime,
-* `cleo llm use openai` / `cleo llm profile <role> openai` derive the default
-* from the live catalog via `resolveProviderDefaultModel` and validate any
-* explicit `--model` against `validateModelForProvider` (T11773 · E8).
-*
-* Override per-credential:
-*   `cleo llm use openai --model <m>`
-*   `cleo llm profile <role> openai --model <m>`
-*
-* @task T11773
-*/
-var openaiProfile = {
-	name: "openai",
-	displayName: "OpenAI Codex (ChatGPT)",
-	authTypes: ["api_key", "oauth"],
-	baseUrl: "https://api.openai.com/v1",
-	defaultModel: "gpt-5.5",
-	aliases: [
-		"codex",
-		"chatgpt",
-		"openai-codex"
-	],
-	tier: "frontier",
-	defaultAuxModel: "gpt-5-mini",
-	defaultMaxTokens: 4096,
-	oauth: {
-		mode: "pkce",
-		clientId: resolveOpenaiClientId(),
-		authorizationEndpoint: "https://auth.openai.com/oauth/authorize",
-		tokenEndpoint: "https://auth.openai.com/oauth/token",
-		scope: "openid profile email offline_access",
-		redirectUri: "http://localhost:1455/auth/callback",
-		extraAuthParams: {
-			id_token_add_organizations: "true",
-			codex_cli_simplified_flow: "true",
-			originator: "codex_cli_rs"
-		}
-	}
-};
-//#endregion
-//#region ../core/dist/llm/provider-registry/builtin/openrouter.js
-/**
-* Builtin provider profile for OpenRouter.
-*
-* OpenRouter is a unified API gateway for 100+ LLM providers, accessible at
-* `https://openrouter.ai/api/v1`. It speaks the OpenAI chat completions wire
-* format. The CLEO-specific quirk is the Pareto router plugin block, which
-* selects the price-optimal provider for high-capability model requests.
-*
-* @task T9286 (W1d)
-* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 3)
-*/
-/**
-* OpenRouter provider profile.
-*
-* Encodes the Pareto plugin routing block as a `buildExtraBody` hook.
-* The plugin is only injected for high-capability model tiers
-* (Sonnet, Opus, Grok, GPT-4) — cheaper models route without it.
-*
-* @task T9286 (W1d)
-*/
-var openrouterProfile = {
-	name: "openrouter",
-	displayName: "OpenRouter",
-	authTypes: ["api_key"],
-	baseUrl: "https://openrouter.ai/api/v1",
-	defaultModel: "openrouter/anthropic/claude-sonnet-4-6",
-	aliases: ["open-router"],
-	envVars: ["OPENROUTER_API_KEY"],
-	defaultHeaders: {
-		"HTTP-Referer": "https://cleocode.dev",
-		"X-Title": "CLEO"
-	},
-	buildExtraBody(model) {
-		if (model.startsWith("openrouter/") && /sonnet|opus|grok|gpt-4/i.test(model)) return { plugins: [{
-			id: "pareto",
-			min_coding_score: .85
-		}] };
-		return {};
-	}
-};
-//#endregion
-//#region ../core/dist/llm/provider-registry/builtin/xai.js
-/**
-* Builtin provider profiles for xAI (Grok models).
-*
-* xAI exposes an OpenAI-compatible API at `https://api.x.ai/v1`. Two
-* profiles are registered — one per ApiMode:
-*
-* - {@link xaiProfile}: `chat_completions` — standard OpenAI-compatible path.
-*   Quirk: `x-grok-conv-id` header for KV-cache affinity.
-* - {@link xaiResponsesProfile}: `codex_responses` — xAI's Responses-compatible
-*   endpoint (grok-* models). Selected automatically when the model id starts
-*   with `grok-` and the caller requests `codex_responses` ApiMode.
-*
-* @task T9286 (W1d)
-* @task T9311 (xAI Responses profile)
-* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 3/5)
-*/
-/** Lazily-initialized process-scoped Grok conversation id. */
-var _grokConvId = null;
-/**
-* Return (and lazily create) the process-scoped Grok conversation id.
-*
-* Pinning a stable `x-grok-conv-id` across requests in the same process
-* gives xAI's KV-cache layer a consistent cache key, reducing TTFT on
-* repeated system-prompt prefix calls within the same agent session.
-*
-* The id is intentionally not persisted — it resets each process restart so
-* stale cache entries do not accumulate across sessions.
-*
-* @returns Stable `cleo-<timestamp>-<random>` identifier for this process.
-*/
-function getGrokConvId() {
-	if (_grokConvId === null) _grokConvId = `cleo-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
-	return _grokConvId;
-}
-/**
-* xAI Grok provider profile — `chat_completions` ApiMode.
-*
-* Encodes the Grok conversation-id header as a `buildApiKwargsExtras` hook.
-*
-* @task T9286 (W1d)
-*/
-var xaiProfile = {
-	name: "xai",
-	displayName: "xAI Grok",
-	authTypes: ["api_key"],
-	baseUrl: "https://api.x.ai/v1",
-	defaultModel: "grok-3",
-	aliases: ["grok", "x-ai"],
-	envVars: ["XAI_API_KEY"],
-	buildApiKwargsExtras() {
-		return { extra_headers: { "x-grok-conv-id": getGrokConvId() } };
-	}
-};
-/**
-* xAI Grok provider profile — `codex_responses` ApiMode.
-*
-* xAI exposes Responses-compatible endpoints for grok-* models. Select this
-* profile when the caller requests `codex_responses` ApiMode or when the
-* model id starts with `grok-` and the Responses API is preferred.
-*
-* Callers should construct a {@link CodexResponsesTransport} (from
-* `packages/core/src/llm/transports/codex-responses.ts`) with this profile's
-* `baseUrl` and any `x-grok-conv-id` header from `buildApiKwargsExtras`.
-*
-* @task T9311
-*/
-var xaiResponsesProfile = {
-	name: "xai",
-	displayName: "xAI Grok (Responses)",
-	authTypes: ["api_key"],
-	baseUrl: "https://api.x.ai/v1",
-	defaultModel: "grok-3",
-	aliases: ["grok-responses", "x-ai-responses"],
-	envVars: ["XAI_API_KEY"],
-	buildApiKwargsExtras() {
-		return { extra_headers: { "x-grok-conv-id": getGrokConvId() } };
-	}
-};
-//#endregion
-//#region ../core/dist/llm/provider-registry/loader.js
-/**
-* Plugin discovery and dynamic import for the CLEO provider registry.
-*
-* Scans `${CLEO_HOME}/plugins/model-providers/` for `*.{ts,mjs,js,cjs}` files,
-* imports each one via `pathToFileURL(absPath).href`, and calls the module's
-* `register` export (named or default) with the plugin API surface.
-*
-* - Non-existent plugin directory → silently no-ops (not an error).
-* - Import errors → logged via `process.stderr` and skipped (never throws).
-* - Idempotent: the discovery promise is module-level singleton; repeated
-*   calls await the same promise.
-*
-* @task T9262
-* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 3)
-*/
-/** Extensions tried for user plugin files, in priority order. */
-var PLUGIN_EXTENSIONS = [
-	".mjs",
-	".js",
-	".cjs",
-	".ts"
-];
-/**
-* Returns `true` when `filename` ends with a recognised plugin extension.
-*/
-function isPluginFile(filename) {
-	return PLUGIN_EXTENSIONS.some((ext) => filename.endsWith(ext));
-}
-/**
-* Return the user plugin directory path — `${CLEO_HOME}/plugins/model-providers`.
-*
-* Does NOT check whether the directory exists; callers must handle that.
-*/
-function getPluginDir() {
-	return join(getCleoHome$1(), "plugins", "model-providers");
-}
-/**
-* Dynamically import one plugin file and invoke its `register` hook.
-*
-* Tolerates import errors: logs to `process.stderr` and returns without
-* throwing so other plugins in the directory still load.
-*
-* @param absPath - Absolute path to the plugin file.
-* @param api     - The plugin API surface passed to the `register` hook.
-*/
-async function loadOnePlugin(absPath, api) {
-	let mod;
-	try {
-		mod = await import(pathToFileURL(absPath).href);
-	} catch (err) {
-		process.stderr.write(`[cleo/provider-registry] Failed to import plugin ${absPath}: ${String(err)}\n`);
-		return;
-	}
-	let registerFn;
-	if (typeof mod.register === "function") registerFn = mod.register;
-	else if (mod.default !== void 0) {
-		if (typeof mod.default === "function") registerFn = mod.default;
-		else if (typeof mod.default.register === "function") registerFn = mod.default.register;
-	}
-	if (registerFn === void 0) {
-		process.stderr.write(`[cleo/provider-registry] Plugin ${absPath} has no exported 'register' function — skipping.\n`);
-		return;
-	}
-	try {
-		registerFn(api);
-	} catch (err) {
-		process.stderr.write(`[cleo/provider-registry] Plugin ${absPath} threw during register(): ${String(err)}\n`);
-	}
-}
-/**
-* Scan `pluginDir` for files matching {@link PLUGIN_EXTENSIONS}, sorted
-* lexicographically for deterministic load order, and load each one.
-*
-* Non-existent directories are silently ignored (returns without error).
-*
-* @param pluginDir - Absolute path to the plugins directory.
-* @param api       - Plugin API surface passed to each plugin.
-*/
-async function scanAndLoadPlugins(pluginDir, api) {
-	let entries;
-	try {
-		entries = readdirSync(pluginDir);
-	} catch {
-		return;
-	}
-	const pluginFiles = entries.filter((name) => !name.startsWith(".") && isPluginFile(name)).filter((name) => {
-		try {
-			return statSync(join(pluginDir, name)).isFile();
-		} catch {
-			return false;
-		}
-	}).sort();
-	for (const filename of pluginFiles) await loadOnePlugin(join(pluginDir, filename), api);
-}
-/**
-* Build the {@link ProviderPluginApi} surface backed by the given
-* `registerProvider` function and run full plugin discovery.
-*
-* This is the entry-point called by the registry's `ensureDiscovered()`
-* singleton. It:
-*   1. Registers all builtin profiles via the provided `builtins` array.
-*   2. Scans `${CLEO_HOME}/plugins/model-providers/` for user plugins.
-*
-* @param registerProvider - The registry's registration function.
-* @param builtins         - Builtin profiles to pre-register before plugins.
-*/
-async function runDiscovery(registerProvider, builtins) {
-	const api = { registerProvider };
-	for (const profile of builtins) registerProvider(profile);
-	await scanAndLoadPlugins(getPluginDir(), api);
-}
-//#endregion
-//#region ../core/dist/llm/provider-registry/index.js
-/**
-* CLEO Provider Registry — public API.
-*
-* A lightweight, in-process registry mapping canonical provider names (and
-* their aliases) to {@link ProviderProfile} descriptors. Ported idiomatically
-* from the Hermes provider registry (`providers/__init__.py`).
-*
-* ## Semantics
-* - Last-writer-wins on `name` collision — user plugins override builtins.
-* - Alias conflicts with another profile's **primary** name throw at
-*   registration time to prevent silent mis-routing.
-* - Discovery is lazy and idempotent: the first call to `getProviderProfile`
-*   or `listProviders` triggers a one-shot discovery pass that:
-*     1. Registers all builtin profiles.
-*     2. Scans `${CLEO_HOME}/plugins/model-providers/` for user plugins.
-*   Subsequent calls reuse the same discovery promise.
-*
-* @task T9262
-* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 3)
-*
-* @example
-* ```ts
-* import { getProviderProfile, listProviders } from '@cleocode/core/llm/provider-registry';
-*
-* const profile = await getProviderProfile('anthropic');
-* // → { name: 'anthropic', displayName: 'Anthropic Claude', … }
-*
-* const all = await listProviders();
-* // → [{ name: 'anthropic', … }]
-* ```
-*/
-/** Primary registry: canonical lower-cased name → profile. */
-var _registry = /* @__PURE__ */ new Map();
-/**
-* Alias map: lower-cased alias → canonical lower-cased name.
-*
-* Aliases MUST NOT shadow primary names of *other* profiles.
-*/
-var _aliases = /* @__PURE__ */ new Map();
-/** Discovery singleton — `null` means discovery hasn't started yet. */
-var _discoveryPromise = null;
-/**
-* All builtin provider profiles registered before user plugins are loaded.
-* Add new builtins here — the registry loads them in array order.
-*/
-var BUILTIN_PROFILES = [
-	anthropicProfile,
-	bedrockProfile,
-	geminiProfile,
-	kimiCodeProfile,
-	moonshotProfile,
-	ollamaProfile,
-	openaiProfile,
-	openrouterProfile,
-	xaiProfile,
-	xaiResponsesProfile
-];
-/**
-* Register a provider profile.
-*
-* - Keys the profile by `profile.name.toLowerCase()` in the primary registry.
-* - Indexes each alias in {@link _aliases}. An alias that conflicts with the
-*   primary name of a *different* already-registered profile throws a
-*   `TypeError` to prevent silent mis-routing.
-* - Last-writer-wins on primary name collisions (user plugins override
-*   builtins).
-*
-* @param profile - The provider profile to register.
-* @throws {TypeError} When an alias conflicts with another profile's primary name.
-*/
-function registerProvider(profile) {
-	const key = profile.name.toLowerCase();
-	_registry.set(key, profile);
-	for (const alias of profile.aliases ?? []) {
-		const aliasKey = alias.toLowerCase();
-		const existing = _aliases.get(aliasKey);
-		if (existing !== void 0 && existing !== key) {
-			if (_registry.has(aliasKey) && aliasKey !== key) throw new TypeError(`[provider-registry] Alias "${alias}" for provider "${profile.name}" conflicts with the primary name of provider "${_registry.get(aliasKey)?.name ?? aliasKey}".`);
-		}
-		_aliases.set(aliasKey, key);
-	}
-}
-/**
-* Ensure the one-shot discovery pass has run.
-*
-* Calling this multiple times is safe — it returns the same promise every time.
-* The discovery pass:
-*   1. Registers all {@link BUILTIN_PROFILES}.
-*   2. Scans `${CLEO_HOME}/plugins/model-providers/` for user plugins.
-*/
-async function ensureDiscovered() {
-	if (_discoveryPromise === null) _discoveryPromise = runDiscovery(registerProvider, BUILTIN_PROFILES);
-	return _discoveryPromise;
-}
-/**
-* Look up a provider profile by name or alias (case-insensitive).
-*
-* Triggers discovery on the first call. Returns `undefined` when no profile
-* matches — callers MUST handle this case (generic/fallback behaviour).
-*
-* @param name - Provider name or alias to look up.
-* @returns The matching {@link ProviderProfile}, or `undefined`.
-*/
-async function getProviderProfile(name) {
-	await ensureDiscovered();
-	const key = name.toLowerCase();
-	const canonical = _aliases.get(key) ?? key;
-	return _registry.get(canonical);
-}
-
-//#region ../core/dist/llm/rate-limit-guard.js
-/**
-* Cross-session rate-limit guard for the CLEO LLM credential layer.
-*
-* Writes rate-limit state to a shared file so ALL CLEO processes
-* (sentient daemon, CLI calls, auxiliary router) see the same cooldown —
-* preventing pile-on retries from independent sessions.
-*
-* Port of Hermes' `agent/nous_rate_guard.py` (generalized for any provider).
-* Each 429 from a provider can trigger multiple SDK retries multiplied by
-* multiple Hermes retries.  By recording state on the first 429 and checking
-* before subsequent attempts, we eliminate retry amplification across sessions.
-*
-* State is keyed on `(provider, label)` and stored at:
-*   `${getCleoHome()}/rate-limit-state/<provider>-<label>.json`
-*
-* @module llm/rate-limit-guard
-* @task T9273
-* @epic T-LLM-CRED-CENTRALIZATION Phase 3
-*/
-/**
-* Sanitize a provider or label string for use in a filename.
-*
-* Replaces any character outside `[a-zA-Z0-9_-]` with `_` to prevent
-* path traversal (e.g. `../../evil` → `_____evil`).
-*
-* @param value - Raw provider or label string.
-* @returns Filesystem-safe string.
-*
-* @task T9273
-*/
-function sanitize(value) {
-	return value.replace(/[^a-zA-Z0-9_-]/g, "_");
-}
-/**
-* Absolute path to the rate-limit state file for a given `(provider, label)`.
-*
-* Exposed for unit tests.
-*
-* @param provider - LLM provider identifier (e.g. `'anthropic'`).
-* @param label    - Credential label (e.g. `'personal'`).
-* @returns Absolute path to the JSON state file.
-*
-* @task T9273
-*/
-function rateLimitStatePath(provider, label) {
-	return join(join(getCleoHome(), "rate-limit-state"), `${sanitize(provider)}-${sanitize(label)}.json`);
-}
-/**
-* Record that a provider+label combination is currently rate-limited.
-*
-* Parses the reset time from HTTP response headers when available, then
-* falls back to `defaultCooldownSeconds` (default 300 s).  Writes state to
-* `${getCleoHome()}/rate-limit-state/<provider>-<label>.json` so that ALL
-* CLEO processes (sentient daemon, CLI calls, auxiliary router) see the same
-* cooldown — preventing pile-on retries from independent sessions.
-*
-* Port of Hermes' `agent/nous_rate_guard.py:record_nous_rate_limit`
-* (generalized for any provider).
-*
-* @param provider - LLM provider identifier (e.g. `'anthropic'`).
-* @param label    - Credential label (e.g. `'personal'`).
-* @param opts     - Optional header map and fallback cooldown seconds.
-*
-* @task T9273
-*/
-async function recordRateLimit(provider, label, opts) {
-	const now = Date.now();
-	const defaultMs = (300) * 1e3;
-	let resetAt;
-	let source;
-	{
-		resetAt = now + defaultMs;
-		source = "default";
-	}
-	const filePath = rateLimitStatePath(provider, label);
-	const dir = join(getCleoHome(), "rate-limit-state");
-	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-	const state = {
-		resetAt,
-		recordedAt: now,
-		source
-	};
-	await withFileLock(filePath, () => {
-		writeJsonFileAtomic(filePath, state);
-	});
-}
-/**
-* Return remaining seconds until the rate-limit clears, or `null` if not active.
-*
-* Stale state files (reset_at in the past) are treated as cleared —
-* the file is NOT deleted here to avoid a lock-delete race; `pick()` callers
-* may clean up with `clearRateLimit` after a successful request.
-*
-* Port of Hermes' `agent/nous_rate_guard.py:nous_rate_limit_remaining`.
-*
-* @param provider - LLM provider identifier (e.g. `'anthropic'`).
-* @param label    - Credential label (e.g. `'personal'`).
-* @returns Seconds remaining (positive float) or `null` if guard is inactive.
-*
-* @task T9273
-*/
-async function rateLimitRemaining(provider, label) {
-	const state = readJsonFile(rateLimitStatePath(provider, label));
-	if (!state) return null;
-	const remaining = (state.resetAt - Date.now()) / 1e3;
-	if (remaining > 0) return remaining;
-	return null;
-}
-
-//#region ../core/dist/llm/credential-removal.js
-/**
-* RemovalStep registry + per-source removal handlers for the unified
-* credential pool (E-CONFIG-AUTH-UNIFY E2a / T9415).
-*
-* Mirrors Hermes Agent's `agent/credential_sources.py` `RemovalStep`
-* pattern: every credential source (env var, `~/.claude/.credentials.json`,
-* `cleo llm login` PKCE token, third-party CLIs) registers a removal step
-* that `cleo auth remove <provider> <label>` invokes to (a) clean up
-* filesystem state owned by CLEO, (b) surface manual hints for state CLEO
-* does NOT own, and (c) record a suppression entry so the next pool load
-* does not re-seed the just-removed credential.
-*
-* ## Scope of this task
-*
-* T9415 is **removal-infrastructure only**. The `cleo auth remove` CLI
-* lands in T9416; this module exposes the registry + per-source handlers
-* + suppression-state persistence, all consumable by the future CLI.
-*
-* ## Suppression state
-*
-* Suppression is persisted to `${getCleoHome()}/auth-suppression.json`:
-*
-* ```json
-* {
-*   "version": 1,
-*   "entries": [
-*     { "provider": "anthropic", "sourceId": "claude-code", "suppressedAt": 1731000000000 }
-*   ]
-* }
-* ```
-*
-* Writes go through {@link writeJsonFileAtomic} (temp-file + rename) so
-* mid-update crashes never corrupt the file. The mutation flow is
-* read-full-state → mutate-in-memory → atomic-write so concurrent CLI
-* invocations cannot interleave partial writes.
-*
-* @module llm/credential-removal
-* @task T9415
-* @epic E-CONFIG-AUTH-UNIFY (E2a)
-*/
-/**
-* In-process registry mapping {@link SeederSourceId} → {@link RemovalStep}.
-*
-* Uniqueness rule: each `sourceId` MUST appear at most once. A duplicate
-* `register()` call throws synchronously — silent overwrites would let two
-* steps fight over the same source, which is a programmer error in test or
-* extension code.
-*
-* Tests construct a fresh `RemovalRegistry()` for isolation; production
-* code uses the {@link REMOVAL_REGISTRY} singleton populated at module load
-* (see bottom of this file).
-*
-* @task T9415
-*/
-var RemovalRegistry = class {
-	steps = /* @__PURE__ */ new Map();
-	/**
-	* Register a removal step.
-	*
-	* @param step - Removal step instance to add.
-	* @throws {Error} `E_REMOVAL_DUPLICATE` when `step.sourceId` is already
-	*   registered.
-	*/
-	register(step) {
-		if (this.steps.has(step.sourceId)) throw new Error(`E_REMOVAL_DUPLICATE: a removal step is already registered for sourceId='${step.sourceId}'`);
-		this.steps.set(step.sourceId, step);
-	}
-	/**
-	* Look up the step for a source id.
-	*
-	* @param sourceId - Source id to dispatch on.
-	* @returns The registered step, or `undefined` if none is registered.
-	*/
-	find(sourceId) {
-		return this.steps.get(sourceId);
-	}
-	/**
-	* Return every registered step (insertion order).
-	*
-	* Used by `cleo auth remove --all` and diagnostic listing.
-	*/
-	getAll() {
-		return Array.from(this.steps.values());
-	}
-};
-/**
-* Filename for the persisted suppression list under `getCleoHome()`.
-*
-* @internal
-*/
-var SUPPRESSION_FILENAME = "auth-suppression.json";
-/**
-* Absolute path to the suppression-state file.
-*
-* Resolved at call time (NOT cached at module load) so test harnesses can
-* override `CLEO_HOME` between runs and see the change reflected.
-*
-* @returns `${getCleoHome()}/auth-suppression.json`.
-*
-* @task T9415
-*/
-function suppressionStatePath() {
-	return join(getCleoHome(), SUPPRESSION_FILENAME);
-}
-/**
-* Read the suppression file, returning a fresh empty document when the
-* file does not yet exist.
-*
-* @returns Parsed suppression document.
-*
-* @task T9415
-*/
-function readSuppressionFile() {
-	const data = readJsonFile(suppressionStatePath());
-	if (data && data.version === 1 && Array.isArray(data.entries)) return data;
-	return {
-		version: 1,
-		entries: []
-	};
-}
-/**
-* Atomically persist the suppression file to disk.
-*
-* Goes through {@link writeJsonFileAtomic} (temp + rename); the parent
-* directory (`getCleoHome()`) is created upstream by `@cleocode/paths` so
-* we do not need to `mkdir` here. The atomic helper itself creates the
-* temp file inside the target's parent directory, so a missing parent
-* surfaces as the original error rather than corrupting state.
-*
-* @param next - New file contents.
-*
-* @task T9415
-*/
-function writeSuppressionFile(next) {
-	writeJsonFileAtomic(suppressionStatePath(), next);
-}
-/**
-* Add `(provider, sourceId)` to the suppression list.
-*
-* Idempotent — a `(provider, sourceId)` pair already present is left
-* untouched (its original `suppressedAt` is preserved so diagnostics can
-* surface the first removal). Reads full state, mutates in-memory, writes
-* atomically — concurrent CLI invocations cannot interleave partial
-* writes.
-*
-* @param provider - Provider id whose seeder should be suppressed.
-* @param sourceId - Source id of the seeder to suppress.
-*
-* @task T9415
-*/
-function addSuppression(provider, sourceId) {
-	const current = readSuppressionFile();
-	if (current.entries.some((e) => e.provider === provider && e.sourceId === sourceId)) return;
-	writeSuppressionFile({
-		version: 1,
-		entries: [...current.entries, {
-			provider,
-			sourceId,
-			suppressedAt: Date.now()
-		}]
-	});
-}
-/**
-* Test whether a `(provider, sourceId)` pair is currently suppressed.
-*
-* @param provider - Provider id.
-* @param sourceId - Source id.
-* @returns `true` if suppression is active.
-*
-* @task T9415
-*/
-function isSuppressed(provider, sourceId) {
-	return readSuppressionFile().entries.some((e) => e.provider === provider && e.sourceId === sourceId);
-}
-/**
-* `'manual'` — entry the operator added with `cleo llm add`.
-*
-* The actual `llm-credentials.json` mutation is performed by the future
-* `cleo auth remove` CLI (T9416) which calls the credential store
-* directly; this step does NOT touch filesystem state itself. Suppression
-* is `false` because `'manual'` has no seeder pass to skip.
-*
-* @task T9415
-*/
-var MANUAL_REMOVAL_STEP = {
-	sourceId: "manual",
-	description: "Operator-added entry; removed directly from llm-credentials.json",
-	async remove() {
-		return {
-			cleaned: [],
-			hints: ["entry removed from llm-credentials.json"],
-			suppress: false
-		};
-	}
-};
-/**
-* `'env'` — environment-variable seed.
-*
-* CLEO cannot unset another shell's exported variable, so cleanup is empty
-* and the hint instructs the operator. Suppression is `true` so the next
-* seed pass skips the env source even if the variable is still set
-* (otherwise the just-removed credential would silently re-appear).
-*
-* @task T9415
-*/
-var ENV_REMOVAL_STEP = {
-	sourceId: "env",
-	description: "Environment variable; cannot be unset by CLEO",
-	async remove() {
-		return {
-			cleaned: [],
-			hints: ["Unset $VARNAME in your shell to prevent re-seeding"],
-			suppress: true
-		};
-	}
-};
-/**
-* `'claude-code'` — `~/.claude/.credentials.json` consented import.
-*
-* Hard rule: CLEO MUST NOT delete `~/.claude/.credentials.json` — Claude
-* Code itself depends on the file. The correct cleanup is suppression of
-* the seeder so the next pool load does not re-import the credential.
-*
-* @task T9415
-*/
-var CLAUDE_CODE_REMOVAL_STEP = {
-	sourceId: "claude-code",
-	description: "Suppress claude-code re-seed; leave ~/.claude/.credentials.json untouched",
-	async remove() {
-		return {
-			cleaned: [],
-			hints: ["Do NOT delete ~/.claude/.credentials.json — Claude Code uses it. Re-seeding is suppressed instead."],
-			suppress: true
-		};
-	}
-};
-/**
-* `'cleo-pkce'` — credential issued by `cleo llm login` (PKCE flow).
-*
-* Owned end-to-end by CLEO: the token cache file at
-* `${getCleoHome()}/anthropic-oauth.json` is deleted unconditionally
-* (ENOENT is silently ignored — idempotency requirement). Suppression is
-* `true` so a residual seeder pass does not re-seed a deleted token.
-*
-* @task T9415
-*/
-var CLEO_PKCE_REMOVAL_STEP = {
-	sourceId: "cleo-pkce",
-	description: "Delete CLEO-issued PKCE token at <CLEO_HOME>/anthropic-oauth.json",
-	async remove() {
-		const path = join(getCleoHome(), "anthropic-oauth.json");
-		const cleaned = [];
-		try {
-			unlinkSync(path);
-			cleaned.push(path);
-		} catch (err) {
-			if (err.code !== "ENOENT") throw err;
-		}
-		return {
-			cleaned,
-			hints: [],
-			suppress: true
-		};
-	}
-};
-/**
-* `'codex-cli'` — OpenAI Codex CLI session token.
-*
-* CLEO does not own the Codex CLI's on-disk state. The hint points the
-* operator at the Codex tooling; suppression is `true`.
-*
-* @task T9415
-*/
-var CODEX_CLI_REMOVAL_STEP = {
-	sourceId: "codex-cli",
-	description: "Suppress codex-cli re-seed; revoke via the Codex CLI itself",
-	async remove() {
-		return {
-			cleaned: [],
-			hints: ["Run `codex logout` (or remove ~/.codex/auth.json) in the Codex CLI to revoke the underlying token."],
-			suppress: true
-		};
-	}
-};
-/**
-* `'gemini-cli'` — Google Gemini CLI application default credentials.
-*
-* Same pattern as `'codex-cli'`: CLEO does not own the Gemini CLI's state.
-*
-* @task T9415
-*/
-var GEMINI_CLI_REMOVAL_STEP = {
-	sourceId: "gemini-cli",
-	description: "Suppress gemini-cli re-seed; revoke via the Gemini CLI itself",
-	async remove() {
-		return {
-			cleaned: [],
-			hints: ["Run `gcloud auth application-default revoke` (or `gemini auth logout`) to revoke the underlying token."],
-			suppress: true
-		};
-	}
-};
-/**
-* `'gh-cli'` — GitHub CLI token (for the `github-models` provider).
-*
-* Same pattern: CLEO does not own `gh`'s keyring.
-*
-* @task T9415
-*/
-var GH_CLI_REMOVAL_STEP = {
-	sourceId: "gh-cli",
-	description: "Suppress gh-cli re-seed; revoke via `gh auth logout`",
-	async remove() {
-		return {
-			cleaned: [],
-			hints: ["Run `gh auth logout` to revoke the underlying GitHub token."],
-			suppress: true
-		};
-	}
-};
-/**
-* Build a fresh registry pre-populated with every built-in step.
-*
-* Exposed so tests can construct an isolated registry mirroring production
-* state without mutating the {@link REMOVAL_REGISTRY} singleton.
-*
-* @returns A fully populated `RemovalRegistry`.
-*
-* @task T9415
-*/
-function buildBuiltinRemovalRegistry() {
-	const registry = new RemovalRegistry();
-	registry.register(MANUAL_REMOVAL_STEP);
-	registry.register(ENV_REMOVAL_STEP);
-	registry.register(CLAUDE_CODE_REMOVAL_STEP);
-	registry.register(CLEO_PKCE_REMOVAL_STEP);
-	registry.register(CODEX_CLI_REMOVAL_STEP);
-	registry.register(GEMINI_CLI_REMOVAL_STEP);
-	registry.register(GH_CLI_REMOVAL_STEP);
-	return registry;
-}
-/**
-* Process-wide singleton used by the future `cleo auth remove` CLI.
-*
-* Populated at module load with every built-in step. Tests requiring
-* isolation MUST construct a fresh registry via
-* {@link buildBuiltinRemovalRegistry} (or `new RemovalRegistry()`) instead
-* of mutating this instance.
-*
-* @task T9415
-*/
-var REMOVAL_REGISTRY = buildBuiltinRemovalRegistry();
-//#endregion
-//#region ../core/dist/llm/credential-seeders/claude-code-seeder.js
-/**
-* `claude-code` credential seeder — imports the Claude Code OAuth token
-* (`~/.claude/.credentials.json`) into the unified credential pool as an
-* `anthropic` entry.
-*
-* E-CONFIG-AUTH-UNIFY E2a §5.2 T-E2-3. Architectural mirror of Hermes
-* Agent's `_seed_from_singletons` dispatch (`agent/credential_pool.py`).
-*
-* ## Consent gate
-*
-* Reading the Claude Code credential file requires the operator to have
-* explicitly opted in via `auth.claudeCodeConsentGiven = true` in the
-* global config. This mirrors Hermes Agent's PR #4210 fix: without the
-* gate, auxiliary fallback chains could silently route requests through
-* a user's Claude Code OAuth token without consent. The default value is
-* `false`, so the seeder is a no-op on fresh installs.
-*
-* The gate is checked BEFORE any filesystem access: an unconsented seeder
-* never calls `readFileSync` on the credentials path. `isConsentEstablished`
-* reads the global config through `getConfigValue('auth.claudeCodeConsentGiven')`
-* so CLI/env overrides on the consent flag are respected uniformly.
-*
-* ## What the seeder emits
-*
-* One `SeederCredentialEntry` per call (or zero) with:
-*
-* - `provider: 'anthropic'`
-* - `label: 'claude-code'`
-* - `authType: 'oauth'`
-* - `source: 'claude-code'`
-* - `accessToken`, `refreshToken`, `expiresAt` extracted from
-*   `claudeAiOauth` via {@link parseClaudeCodeCredentials}.
-*
-* Zero-result paths (consent off, file missing, file unreadable, JSON
-* malformed, token expired) all return `{ entries: [] }` without
-* throwing. Parsing is delegated to `parseClaudeCodeCredentials` in
-* `@cleocode/contracts` so the JSON shape lives in exactly one place.
-*
-* @module llm/credential-seeders/claude-code-seeder
-* @task T9410
-* @epic E-CONFIG-AUTH-UNIFY (E2a)
-*/
-/** Stable label written into the pool entry's `label` field. */
-var SEEDER_LABEL$1 = "claude-code";
-/** `(sourceId, provider)` pair this seeder owns inside the registry. */
-var SOURCE_ID$1 = "claude-code";
-var PROVIDER$1 = "anthropic";
-/** Config key consulted by {@link isConsentEstablished}. */
-var CONSENT_CONFIG_KEY = "auth.claudeCodeConsentGiven";
-/**
-* Concrete `CredentialSeeder` for the `claude-code` source.
-*
-* Constructor-injectable filesystem hooks (`readCredentialFile`) keep tests
-* pure — they exercise the consent gate, expiry filter, and missing-file
-* path without touching the real `~/.claude/.credentials.json` and without
-* fs mocks at the module level. The default `readCredentialFile`
-* implementation calls `readFileSync` on `~/.claude/.credentials.json`.
-*
-* @task T9410
-*/
-var ClaudeCodeSeeder = class {
-	/** @inheritdoc */
-	sourceId = SOURCE_ID$1;
-	/** @inheritdoc */
-	provider = PROVIDER$1;
-	readCredentialFile;
-	readConsentFlag;
-	/**
-	* Construct a seeder.
-	*
-	* @param opts - Optional dependency-injection seams. `readCredentialFile`
-	*   MUST return `null` when the file is missing or unreadable (it MUST
-	*   NOT throw). `readConsentFlag` returns the resolved consent boolean
-	*   from the config cascade.
-	*/
-	constructor(opts) {
-		this.readCredentialFile = opts?.readCredentialFile ?? defaultReadCredentialFile$1;
-		this.readConsentFlag = opts?.readConsentFlag ?? defaultReadConsentFlag;
-	}
-	/**
-	* Resolve the consent flag from the canonical config cascade.
-	*
-	* Returns `true` only when `auth.claudeCodeConsentGiven` is explicitly
-	* the boolean `true`. Any other value — `undefined`, `null`, `false`,
-	* or a stray string — yields `false` so the gate fails closed.
-	*
-	* @param _provider - Provider id (ignored — this seeder is anthropic-only;
-	*   the parameter is accepted to satisfy the `CredentialSeeder` contract).
-	*/
-	async isConsentEstablished(_provider) {
-		try {
-			return await this.readConsentFlag();
-		} catch {
-			return false;
-		}
-	}
-	/**
-	* Read `~/.claude/.credentials.json` and emit a single pool entry.
-	*
-	* Short-circuits to `{ entries: [] }` when the consent gate is closed,
-	* the file is absent, the JSON is malformed, the `claudeAiOauth` block
-	* is missing, or the token has expired (per `parseClaudeCodeCredentials`).
-	*/
-	async seed() {
-		if (!await this.isConsentEstablished(this.provider)) return { entries: [] };
-		const raw = this.readCredentialFile();
-		if (raw === null) return { entries: [] };
-		const parsed = parseClaudeCodeCredentials(raw);
-		if (parsed === null) return { entries: [] };
-		return { entries: [{
-			provider: "anthropic",
-			label: SEEDER_LABEL$1,
-			authType: "oauth",
-			accessToken: parsed.accessToken,
-			source: SEEDER_LABEL$1,
-			...parsed.expiresAt !== void 0 ? { expiresAt: parsed.expiresAt } : {},
-			...parsed.refreshToken !== void 0 ? { refreshToken: parsed.refreshToken } : {}
-		}] };
-	}
-};
-/**
-* Default `readCredentialFile` implementation.
-*
-* Returns the UTF-8 contents of `~/.claude/.credentials.json`, or `null`
-* when the file is absent or unreadable. NEVER throws — every error path
-* collapses to `null` so the seeder's "source absent" contract holds.
-*
-* @internal
-*/
-function defaultReadCredentialFile$1() {
-	try {
-		return readFileSync(join(homedir(), ".claude", ".credentials.json"), "utf-8");
-	} catch {
-		return null;
-	}
-}
-/**
-* Default `readConsentFlag` implementation.
-*
-* Reads the consent boolean from the canonical config cascade (env >
-* project > global > defaults). The default value at the defaults tier
-* is `false`, so a fresh install with no overrides resolves to `false`.
-*
-* @internal
-*/
-async function defaultReadConsentFlag() {
-	return (await getConfigValue(CONSENT_CONFIG_KEY)).value === true;
-}
-/**
-* Factory for the singleton `ClaudeCodeSeeder` registered into
-* `BUILTIN_SEEDERS` from `index.ts`.
-*
-* Kept as a factory (not a module-level `const`) so the registry-side
-* import remains acyclic and tests can construct fresh instances with
-* injected dependencies.
-*
-* @task T9410
-*/
-function createClaudeCodeSeeder() {
-	return new ClaudeCodeSeeder();
-}
-//#endregion
-//#region ../core/dist/llm/credential-seeders/cleo-pkce-seeder.js
-/**
-* `cleo-pkce` credential seeder — reads CLEO's own PKCE-issued Anthropic
-* OAuth token at `${getCleoHome()}/anthropic-oauth.json` and emits it as a
-* single `anthropic` entry in the unified credential pool.
-*
-* E-CONFIG-AUTH-UNIFY E2a §5.2 T-E2-4. Architectural mirror of Hermes
-* Agent's `_seed_from_cleo_pkce` dispatch.
-*
-* ## File shape
-*
-* The CLEO-owned PKCE file uses Claude Code's `claudeAiOauth` envelope
-* shape so the two CLIs can cooperatively share credentials via the
-* write-back handler (`credential-writeback.ts`):
-*
-* ```json
-* {
-*   "claudeAiOauth": {
-*     "accessToken": "sk-ant-oat-...",
-*     "refreshToken": "sk-ant-ort-...",
-*     "expiresAt": 1700000000000,
-*     "scopes": ["user:inference"]
-*   }
-* }
-* ```
-*
-* Parsing is delegated to `parseClaudeCodeCredentials()` in
-* `@cleocode/contracts` so the on-disk format lives in exactly one place.
-*
-* ## Consent gate
-*
-* Unlike the `claude-code` seeder, the PKCE seeder reads a CLEO-owned
-* file: the operator implicitly consented by running `cleo llm login`,
-* so no consent flag is consulted. `isConsentEstablished` is therefore
-* omitted (`undefined` is treated as "always consented" by the contract).
-*
-* ## Zero-result paths
-*
-* Missing file, malformed JSON, missing `claudeAiOauth` block, and
-* expired token all collapse to `{ entries: [] }` without throwing —
-* the seeder contract MUST NOT signal "source absent" via exceptions.
-*
-* @module llm/credential-seeders/cleo-pkce-seeder
-* @task T9411
-* @epic E-CONFIG-AUTH-UNIFY (E2a)
-*/
-/** Stable label written into the pool entry's `label` field. */
-var SEEDER_LABEL = "cleo-pkce";
-/** `(sourceId, provider)` pair this seeder owns inside the registry. */
-var SOURCE_ID = "cleo-pkce";
-var PROVIDER = "anthropic";
-/**
-* Default on-disk path for CLEO's PKCE token cache.
-*
-* Computed at call-time (not module-load) so test runners that swap
-* `CLEO_DATA_DIR` between cases observe the change.
-*/
-function defaultCleoPkcePath() {
-	return join(getCleoHome$1(), "anthropic-oauth.json");
-}
-/**
-* Concrete `CredentialSeeder` for the `cleo-pkce` source.
-*
-* Constructor-injectable filesystem hook (`readCredentialFile`) keeps tests
-* pure — they exercise the expiry, missing-file, and malformed-JSON paths
-* without touching the real CLEO data directory and without module-level
-* fs mocks. The default `readCredentialFile` implementation calls
-* `readFileSync` on `${getCleoHome()}/anthropic-oauth.json`.
-*
-* @task T9411
-*/
-var CleoPkceSeeder = class {
-	/** @inheritdoc */
-	sourceId = SOURCE_ID;
-	/** @inheritdoc */
-	provider = PROVIDER;
-	readCredentialFile;
-	/**
-	* Construct a seeder.
-	*
-	* @param opts - Optional dependency-injection seams. `readCredentialFile`
-	*   MUST return `null` when the file is missing or unreadable (it MUST
-	*   NOT throw). The default implementation reads
-	*   `${getCleoHome()}/anthropic-oauth.json` and collapses every error
-	*   path to `null`.
-	*/
-	constructor(opts) {
-		this.readCredentialFile = opts?.readCredentialFile ?? defaultReadCredentialFile;
-	}
-	/**
-	* Read the CLEO PKCE OAuth file and emit a single anthropic pool entry.
-	*
-	* Short-circuits to `{ entries: [] }` when the file is absent, the JSON
-	* is malformed, the `claudeAiOauth` block is missing, or the token has
-	* expired (per `parseClaudeCodeCredentials`). Never throws.
-	*/
-	async seed() {
-		const raw = this.readCredentialFile();
-		if (raw === null) return { entries: [] };
-		const parsed = parseClaudeCodeCredentials(raw);
-		if (parsed === null) return { entries: [] };
-		return { entries: [{
-			provider: "anthropic",
-			label: SEEDER_LABEL,
-			authType: "oauth",
-			accessToken: parsed.accessToken,
-			source: SEEDER_LABEL,
-			...parsed.expiresAt !== void 0 ? { expiresAt: parsed.expiresAt } : {},
-			...parsed.refreshToken !== void 0 ? { refreshToken: parsed.refreshToken } : {}
-		}] };
-	}
-};
-/**
-* Default `readCredentialFile` implementation.
-*
-* Returns the UTF-8 contents of `${getCleoHome()}/anthropic-oauth.json`,
-* or `null` when the file is absent or unreadable. NEVER throws — every
-* error path collapses to `null` so the seeder's "source absent" contract
-* holds.
-*
-* @internal
-*/
-function defaultReadCredentialFile() {
-	try {
-		return readFileSync(defaultCleoPkcePath(), "utf-8");
-	} catch {
-		return null;
-	}
-}
-/**
-* Factory for the singleton `CleoPkceSeeder` registered into
-* `BUILTIN_SEEDERS` from `index.ts`.
-*
-* Kept as a factory (not a module-level `const`) so the registry-side
-* import remains acyclic and tests can construct fresh instances with
-* injected dependencies.
-*
-* @task T9411
-*/
-function createCleoPkceSeeder() {
-	return new CleoPkceSeeder();
-}
-//#endregion
-//#region ../core/dist/llm/credential-seeders/codex-cli-seeder.js
-/**
-* Credential seeder for the OpenAI Codex CLI
-* (E-CONFIG-AUTH-UNIFY E2a / T9418).
-*
-* Implements the "delegate-to-partner-CLI" pattern: instead of CLEO running
-* its own OAuth flow against OpenAI, this seeder reads the token file the
-* Codex CLI already writes when the user runs `codex login`. The seeder is
-* read-only — it never writes back to Codex's auth.json, so the two CLIs
-* remain decoupled.
-*
-* ## File path
-*
-* `${CODEX_HOME:-~/.codex}/auth.json` per Hermes Agent's
-* `hermes_cli/codex_models.py:175`. The `CODEX_HOME` env var is honoured
-* exactly as Codex itself does (empty/whitespace falls back to `~/.codex`).
-*
-* ## File shape
-*
-* Codex `auth.json` carries either an API key, OAuth tokens, or both:
-*
-* ```json
-* {
-*   "OPENAI_API_KEY": "sk-...",          // optional — when user logged in via API key
-*   "tokens": {
-*     "access_token": "...",             // optional — when user logged in via OAuth
-*     "refresh_token": "...",
-*     "id_token": "...",
-*     "account_id": "..."
-*   }
-* }
-* ```
-*
-* This seeder reports both forms when present (one entry per source). Empty
-* tokens are skipped so a partially-written file does not seed a broken
-* credential into the pool.
-*
-* @module llm/credential-seeders/codex-cli-seeder
-* @task T9418
-* @epic E-CONFIG-AUTH-UNIFY (E2a)
-*/
-/**
-* Resolve the Codex CLI auth file path.
-*
-* Mirrors Codex's own logic: `CODEX_HOME` env var when set (trimmed),
-* falling back to `~/.codex/auth.json`. Exposed for tests so they can pin
-* the path to a temp dir without touching the real `~/.codex` directory.
-*
-* @internal
-* @task T9418
-*/
-function getCodexAuthPath() {
-	return join((process.env["CODEX_HOME"] ?? "").trim() || join(homedir(), ".codex"), "auth.json");
-}
-/**
-* Credential seeder for OpenAI Codex CLI.
-*
-* Returns one entry per credential present in `auth.json` (the API key and
-* the OAuth access token are reported separately so the resolver can rank
-* them via priority). Missing file or unreadable JSON → `{ entries: [] }`
-* with no error surfaced; the caller treats absence as "not on this
-* machine".
-*
-* @task T9418
-*/
-var CodexCliSeeder = class {
-	sourceId = "codex-cli";
-	provider = "openai";
-	/**
-	* Read and parse Codex's `auth.json`, returning the discovered entries.
-	*
-	* Never throws — every failure path resolves to `{ entries: [], warnings? }`.
-	*
-	* @returns Discovered credential entries plus optional diagnostics.
-	* @task T9418
-	*/
-	async seed() {
-		const authPath = getCodexAuthPath();
-		if (!existsSync(authPath)) return { entries: [] };
-		let raw;
-		try {
-			raw = readFileSync(authPath, "utf-8");
-		} catch (err) {
-			return {
-				entries: [],
-				warnings: [`codex-cli: failed to read ${authPath}: ${err.message}`]
-			};
-		}
-		let parsed;
-		try {
-			const json = JSON.parse(raw);
-			if (!json || typeof json !== "object" || Array.isArray(json)) return {
-				entries: [],
-				warnings: [`codex-cli: ${authPath} is not a JSON object`]
-			};
-			parsed = json;
-		} catch (err) {
-			return {
-				entries: [],
-				warnings: [`codex-cli: ${authPath} is not valid JSON: ${err.message}`]
-			};
-		}
-		const result = { entries: [] };
-		const tokens = parsed["tokens"];
-		if (tokens && typeof tokens === "object" && !Array.isArray(tokens)) {
-			const accessToken = tokens["access_token"];
-			const refreshToken = tokens["refresh_token"];
-			if (typeof accessToken === "string" && accessToken.trim()) result.entries.push({
-				provider: "openai",
-				label: "codex-cli",
-				authType: "oauth",
-				accessToken: accessToken.trim(),
-				source: "codex-cli",
-				...typeof refreshToken === "string" && refreshToken.trim() ? { refreshToken: refreshToken.trim() } : {}
-			});
-		}
-		const apiKey = parsed["OPENAI_API_KEY"];
-		if (typeof apiKey === "string" && apiKey.trim()) result.entries.push({
-			provider: "openai",
-			label: "codex-cli-api-key",
-			authType: "api_key",
-			accessToken: apiKey.trim(),
-			source: "codex-cli"
-		});
-		return result;
-	}
-};
-/**
-* Module-level singleton. Registered into `BUILTIN_SEEDERS` from
-* `credential-seeders/index.ts` to keep the registration site DRY.
-*
-* @task T9418
-*/
-var codexCliSeeder = new CodexCliSeeder();
-//#endregion
-//#region ../core/dist/llm/oauth/pkce.js
-/**
-* Refresh an access token using the `refresh_token` grant (RFC 6749 §6).
-*
-* Uses the same token endpoint as code exchange. On success, a new access
-* token (and optionally a new refresh token) is returned. The caller is
-* responsible for persisting the updated tokens.
-*
-* @param params - Refresh parameters.
-* @returns Normalized token response with fresh `accessToken`.
-* @throws {Error} On HTTP errors or missing `access_token` in the response.
-* @task T9302
-*/
-async function refreshPkceToken(params) {
-	const fields = {
-		grant_type: "refresh_token",
-		client_id: params.clientId,
-		refresh_token: params.refreshToken
-	};
-	const resp = await postTokenRequest(params.tokenEndpoint, fields, params);
-	if (!resp.ok) {
-		const detail = await extractOAuthErrorDetail(resp);
-		throw new Error(`PKCE token refresh failed for provider '${params.provider}': HTTP ${resp.status}${detail}`);
-	}
-	return parseTokenResponse(params.provider, await resp.json());
-}
-/**
-* POST a token-endpoint request (code exchange or refresh grant).
-*
-* Single home for the body-encoding split shared by {@link exchangePkceCode}
-* and {@link refreshPkceToken}: `'form'` (RFC 6749 default,
-* `application/x-www-form-urlencoded`) vs `'json'` (Anthropic's non-RFC
-* `application/json` token endpoint). See
-* `ProviderOAuthConfig.tokenBodyFormat`.
-*
-* @internal
-*/
-function postTokenRequest(tokenEndpoint, fields, opts) {
-	return globalThis.fetch(tokenEndpoint, {
-		method: "POST",
-		headers: {
-			"Content-Type": opts.bodyFormat === "json" ? "application/json" : "application/x-www-form-urlencoded",
-			Accept: "application/json",
-			...opts.extraHeaders
-		},
-		body: opts.bodyFormat === "json" ? JSON.stringify(fields) : new URLSearchParams(fields).toString()
-	});
-}
-/**
-* Parse a raw token endpoint JSON body into a normalized {@link OAuthTokens}.
-*
-* @throws {Error} When `access_token` is absent or not a string.
-* @internal
-*/
-function parseTokenResponse(provider, data) {
-	if (typeof data !== "object" || data === null) throw new Error(`Token endpoint for '${provider}' returned non-object response`);
-	const d = data;
-	const accessToken = d["access_token"];
-	if (typeof accessToken !== "string" || !accessToken) throw new Error(`Token endpoint for '${provider}' returned response without access_token`);
-	return {
-		accessToken,
-		refreshToken: typeof d["refresh_token"] === "string" ? d["refresh_token"] : void 0,
-		expiresIn: typeof d["expires_in"] === "number" ? d["expires_in"] : void 0,
-		tokenType: typeof d["token_type"] === "string" ? d["token_type"] : "bearer"
-	};
-}
-/**
-* Extract a human-readable error detail string from a non-OK OAuth HTTP
-* response.
-*
-* The single shared extractor for every OAuth surface in the LLM layer
-* (`pkce.ts`, `google-pkce.ts`, `device-code.ts`) — local copies drifted and
-* re-introduced the `[object Object]` masking of DHQ-075 (T11958).
-*
-* Strategy:
-* 1. Clone the response so the body stream is not consumed by the primary
-*    error path (callers may need the body for further inspection).
-* 2. Parse as JSON; use `error_description` or `error` fields (RFC 6749 §5.2).
-*    When the field is an object (Anthropic nests
-*    `{"error": {"type", "message"}}`), extract `message`/`type` — never
-*    `String(object)`.
-* 3. Fall back to the raw text body when JSON parsing fails (e.g. HTML pages
-*    returned by a WAF or a misconfigured reverse proxy). Truncate at 512 chars
-*    so a multi-kilobyte HTML page does not flood the error message.
-* 4. Return `''` only when all fallbacks are exhausted.
-*
-* This ensures the caller never sees `[object Object]` in the thrown message
-* and always surfaces the actual HTTP response body for debugging.
-*
-* @task T11958
-*/
-async function extractOAuthErrorDetail(resp) {
-	const clone = resp.clone();
-	try {
-		const body = await clone.json();
-		const desc = body["error_description"] ?? body["error"];
-		if (typeof desc === "string" && desc) return ` — ${desc}`;
-		if (desc !== null && typeof desc === "object") {
-			const d = desc;
-			const message = typeof d["message"] === "string" ? d["message"] : void 0;
-			const type = typeof d["type"] === "string" ? d["type"] : void 0;
-			if (message) return ` — ${type ? `${type}: ` : ""}${message}`;
-			return ` — ${JSON.stringify(desc).slice(0, 512)}`;
-		}
-		return ` — ${JSON.stringify(body).slice(0, 512)}`;
-	} catch {
-		try {
-			const text = (await resp.text()).trim();
-			return text ? ` — ${text.slice(0, 512)}` : "";
-		} catch {
-			return "";
-		}
-	}
-}
-//#endregion
-//#region ../core/dist/llm/oauth/google-pkce.js
-/**
-* Google OAuth PKCE refresh helper for the `gemini-cli` credential seeder
-* (E-CONFIG-AUTH-UNIFY E2a / T9418).
-*
-* CLEO owns its own Google OAuth flow rather than reading the gemini-cli npm
-* package's token file directly — this avoids the single-use refresh-token
-* race the Hermes design notes call out (see `agent/google_oauth.py` in
-* Hermes Agent). The interactive login flow (browser callback server, PKCE
-* pair generation, code exchange) is **deferred to E3** when the
-* `cleo llm login gemini` CLI command lands; this module ships only the
-* refresh-from-expired path that the seeder needs at pool-load time.
-*
-* ## Public Google OAuth client
-*
-* The `client_id` / `client_secret` literals below are Google's PUBLIC
-* desktop OAuth client for their own open-source `@google/gemini-cli` npm
-* package. They are baked into every copy of that package and are NOT
-* confidential — desktop OAuth clients have no secret-keeping requirement
-* (PKCE provides the security). Shipping them here matches the pattern
-* `opencode-gemini-auth` and Hermes Agent already use.
-*
-* Source: https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/code_assist/oauth2.ts
-*
-* Both literals are overridable via env vars (`CLEO_GEMINI_CLIENT_ID` /
-* `CLEO_GEMINI_CLIENT_SECRET`) so power users can substitute their own
-* Google Cloud Console-issued desktop client.
-*
-* ## Why a dedicated fetch instead of `refreshPkceToken`
-*
-* The generic {@link refreshPkceToken} helper only POSTs
-* `grant_type=refresh_token`, `client_id`, and `refresh_token` — Google
-* additionally requires `client_secret` in the form body for refreshes that
-* use the public desktop client. Rather than overload the generic helper
-* with a Google-specific param, this module ships its own thin POST that
-* mirrors gemini-cli's exact request shape.
-*
-* @module llm/oauth/google-pkce
-* @task T9418
-* @epic E-CONFIG-AUTH-UNIFY (E2a)
-*/
-/**
-* Google's OAuth 2.0 token endpoint.
-*
-* Same endpoint used for both `authorization_code` and `refresh_token`
-* grants. Constants live in this module (not a shared registry) so the
-* Google flow can evolve independently of the generic PKCE helpers.
-*
-* @task T9418
-*/
-var GOOGLE_OAUTH_TOKEN_ENDPOINT = "https://oauth2.googleapis.com/token";
-var _PUBLIC_CLIENT_ID_PROJECT_NUM = "681255809395";
-var _PUBLIC_CLIENT_ID_HASH = "oo8ft2oprdrnp9e3aqf6av3hmdib135j";
-var _PUBLIC_CLIENT_SECRET_SUFFIX = "4uHgMPm-1o7Sk-geV6Cu5clXFsxl";
-/**
-* Public Google OAuth desktop client ID baked into `@google/gemini-cli`.
-*
-* NOT confidential — desktop OAuth clients have no secret-keeping
-* requirement. Override via `CLEO_GEMINI_CLIENT_ID` for power users who
-* want to substitute their own Google Cloud Console-issued client.
-*
-* @task T9418
-*/
-var DEFAULT_GOOGLE_CLIENT_ID = `${_PUBLIC_CLIENT_ID_PROJECT_NUM}-${_PUBLIC_CLIENT_ID_HASH}.apps.googleusercontent.com`;
-/**
-* Public Google OAuth desktop client secret baked into `@google/gemini-cli`.
-*
-* NOT confidential — see {@link DEFAULT_GOOGLE_CLIENT_ID}. Google's token
-* endpoint accepts the refresh-token grant with `client_secret` present even
-* for desktop clients.
-*
-* @task T9418
-*/
-var DEFAULT_GOOGLE_CLIENT_SECRET = `GOCSPX-${_PUBLIC_CLIENT_SECRET_SUFFIX}`;
-/**
-* Default expiry buffer applied when Google omits `expires_in` from the
-* refresh response. One hour matches gemini-cli's own default and gives the
-* pool plenty of headroom before the next refresh.
-*
-* @task T9418
-*/
-var DEFAULT_EXPIRES_IN_SECONDS = 3600;
-/**
-* Refresh a Google OAuth access token using a stored refresh token.
-*
-* POSTs `grant_type=refresh_token` plus the public gemini-cli client
-* credentials to Google's token endpoint and converts the resulting
-* `expires_in` (seconds) into an absolute `expiresAt` (epoch milliseconds).
-*
-* Env-var overrides (`CLEO_GEMINI_CLIENT_ID` / `CLEO_GEMINI_CLIENT_SECRET`)
-* are honoured when present; otherwise the shipped public defaults apply.
-*
-* All HTTP calls use `globalThis.fetch` so tests can intercept them via
-* `vi.spyOn(globalThis, 'fetch')` — no real network traffic.
-*
-* @param refreshToken - Long-lived refresh token from a prior login flow.
-*   MUST be non-empty; an empty value throws synchronously without making
-*   a network call.
-* @returns Fresh access token + computed absolute expiry.
-* @throws {Error} When `refreshToken` is empty, the token endpoint returns
-*   a non-2xx response, or the payload lacks an `access_token`.
-*
-* @task T9418
-*/
-async function refreshGoogleAccessToken(refreshToken) {
-	if (!refreshToken) throw new Error("Google OAuth refresh failed: refresh_token is empty");
-	const clientId = (process.env["CLEO_GEMINI_CLIENT_ID"] ?? "").trim() || DEFAULT_GOOGLE_CLIENT_ID;
-	const clientSecret = (process.env["CLEO_GEMINI_CLIENT_SECRET"] ?? "").trim() || DEFAULT_GOOGLE_CLIENT_SECRET;
-	const body = new URLSearchParams({
-		grant_type: "refresh_token",
-		client_id: clientId,
-		refresh_token: refreshToken
-	});
-	if (clientSecret) body.set("client_secret", clientSecret);
-	const resp = await globalThis.fetch(GOOGLE_OAUTH_TOKEN_ENDPOINT, {
-		method: "POST",
-		headers: {
-			"Content-Type": "application/x-www-form-urlencoded",
-			Accept: "application/json"
-		},
-		body: body.toString()
-	});
-	if (!resp.ok) {
-		const detail = await extractOAuthErrorDetail(resp);
-		throw new Error(`Google OAuth refresh failed: HTTP ${resp.status}${detail}`);
-	}
-	const parsed = await resp.json();
-	const accessToken = parsed["access_token"];
-	if (typeof accessToken !== "string" || !accessToken) throw new Error("Google OAuth refresh response missing access_token");
-	const expiresInRaw = parsed["expires_in"];
-	const expiresInSeconds = typeof expiresInRaw === "number" && Number.isFinite(expiresInRaw) && expiresInRaw > 0 ? expiresInRaw : DEFAULT_EXPIRES_IN_SECONDS;
-	const expiresAt = Date.now() + expiresInSeconds * 1e3;
-	const rotated = parsed["refresh_token"];
-	return {
-		accessToken,
-		expiresAt,
-		refreshToken: typeof rotated === "string" && rotated ? rotated : void 0
-	};
-}
-//#endregion
-//#region ../core/dist/llm/credential-seeders/gemini-cli-seeder.js
-/**
-* Credential seeder for the CLEO-owned Google PKCE token
-* (E-CONFIG-AUTH-UNIFY E2a / T9418).
-*
-* Per spec OQ-4 (resolved in the T9418 task brief): CLEO does NOT read
-* gemini-cli's npm package token file directly — sharing a refresh token
-* across two clients causes single-use `refresh_token_reused` race
-* failures. Instead CLEO runs its own Google OAuth PKCE flow against the
-* public gemini-cli desktop client and stores tokens at
-* `${getCleoHome()}/google_oauth.json`.
-*
-* The interactive login flow (browser callback server, code exchange) is
-* deferred to E3's `cleo llm login gemini` command. This seeder ships only
-* the **read + refresh** path the pool needs at load time.
-*
-* ## File path & shape
-*
-* `${getCleoHome()}/google_oauth.json`, chmod 0o600 (writer is the
-* interactive login flow — out of scope here):
-*
-* ```json
-* {
-*   "access_token": "ya29...",
-*   "refresh_token": "1//...",
-*   "expires_at": 1744848000000,   // unix MILLIseconds
-*   "email": "user@example.com"
-* }
-* ```
-*
-* The shape is intentionally flatter than Hermes' "packed refresh" format
-* because CLEO does not need to carry GCP project IDs through the token
-* file — the Gemini transport reads project context from
-* `~/.cleo/config.json` instead. Extra keys (e.g. a stale `project_id`)
-* are tolerated and ignored.
-*
-* ## Refresh-on-expiry
-*
-* When `expires_at` is in the past (or within the 60-second clock-skew
-* buffer), the seeder calls {@link refreshGoogleAccessToken} to mint a
-* fresh access token. **The refreshed token file is NOT written back to
-* disk by this seeder** — the credential store keeps the canonical copy
-* and the interactive login flow (E3) owns disk writes. The seeder simply
-* emits the freshly-refreshed entry so the pool starts the session with a
-* live token.
-*
-* When refresh fails (revoked token, network out, etc.) the seeder emits
-* the stored entry as-is with a warning; the credential pool's mark-bad
-* machinery will quarantine it on the first 401 response.
-*
-* @module llm/credential-seeders/gemini-cli-seeder
-* @task T9418
-* @epic E-CONFIG-AUTH-UNIFY (E2a)
-*/
-/**
-* Clock-skew buffer (ms) before `expires_at` at which we proactively
-* refresh. 60 seconds matches Hermes' default and gives the first
-* downstream LLM call enough headroom to complete.
-*
-* @internal
-* @task T9418
-*/
-var REFRESH_SKEW_MS = 6e4;
-/**
-* Resolve the CLEO-owned Google OAuth token path.
-*
-* Routed through `getCleoHome()` so the `CLEO_HOME` env override and
-* platform-aware XDG resolution apply uniformly (T9403 / T9405). Exposed
-* for tests.
-*
-* @internal
-* @task T9418
-*/
-function getGoogleOauthPath() {
-	return join(getCleoHome(), "google_oauth.json");
-}
-/**
-* Parse the on-disk JSON into a narrowed shape. Returns `null` when the
-* file is malformed (extras tolerated, missing required fields rejected).
-*
-* @internal
-* @task T9418
-*/
-function parseGoogleOauthFile(raw) {
-	let json;
-	try {
-		json = JSON.parse(raw);
-	} catch {
-		return null;
-	}
-	if (!json || typeof json !== "object" || Array.isArray(json)) return null;
-	const obj = json;
-	const out = {};
-	if (typeof obj["access_token"] === "string") out.access_token = obj["access_token"];
-	if (typeof obj["refresh_token"] === "string") out.refresh_token = obj["refresh_token"];
-	if (typeof obj["expires_at"] === "number" && Number.isFinite(obj["expires_at"])) out.expires_at = obj["expires_at"];
-	if (typeof obj["email"] === "string") out.email = obj["email"];
-	return out;
-}
-/**
-* Credential seeder for the CLEO-owned Google PKCE token store.
-*
-* @task T9418
-*/
-var GeminiCliSeeder = class {
-	sourceId = "gemini-cli";
-	provider = "gemini";
-	/**
-	* Read `google_oauth.json` and emit a seeded credential entry,
-	* refreshing the access token first when it is expired or near expiry.
-	*
-	* Never throws — every failure path resolves to `{ entries: [], warnings? }`.
-	*
-	* @returns Zero or one entry plus optional warnings.
-	* @task T9418
-	*/
-	async seed() {
-		const path = getGoogleOauthPath();
-		if (!existsSync(path)) return { entries: [] };
-		let raw;
-		try {
-			raw = readFileSync(path, "utf-8");
-		} catch (err) {
-			return {
-				entries: [],
-				warnings: [`gemini-cli: failed to read ${path}: ${err.message}`]
-			};
-		}
-		const parsed = parseGoogleOauthFile(raw);
-		if (!parsed) return {
-			entries: [],
-			warnings: [`gemini-cli: ${path} is not valid JSON / not an object`]
-		};
-		if (!parsed.access_token) return {
-			entries: [],
-			warnings: [`gemini-cli: ${path} is missing access_token`]
-		};
-		const now = Date.now();
-		if (typeof parsed.expires_at === "number" && parsed.expires_at - REFRESH_SKEW_MS <= now && parsed.refresh_token) try {
-			const refreshed = await refreshGoogleAccessToken(parsed.refresh_token);
-			return { entries: [{
-				provider: "gemini",
-				label: "gemini-pkce",
-				authType: "oauth",
-				accessToken: refreshed.accessToken,
-				expiresAt: refreshed.expiresAt,
-				source: "gemini-cli",
-				refreshToken: refreshed.refreshToken ?? parsed.refresh_token,
-				...parsed.email ? { metadata: { email: parsed.email } } : {}
-			}] };
-		} catch (err) {
-			return {
-				entries: [{
-					provider: "gemini",
-					label: "gemini-pkce",
-					authType: "oauth",
-					accessToken: parsed.access_token,
-					expiresAt: parsed.expires_at ?? null,
-					source: "gemini-cli",
-					...parsed.refresh_token ? { refreshToken: parsed.refresh_token } : {},
-					...parsed.email ? { metadata: { email: parsed.email } } : {}
-				}],
-				warnings: [`gemini-cli: refresh failed, using stored access_token (${err.message})`]
-			};
-		}
-		return { entries: [{
-			provider: "gemini",
-			label: "gemini-pkce",
-			authType: "oauth",
-			accessToken: parsed.access_token,
-			expiresAt: parsed.expires_at ?? null,
-			source: "gemini-cli",
-			...parsed.refresh_token ? { refreshToken: parsed.refresh_token } : {},
-			...parsed.email ? { metadata: { email: parsed.email } } : {}
-		}] };
-	}
-};
-/**
-* Module-level singleton registered into `BUILTIN_SEEDERS`.
-*
-* @task T9418
-*/
-var geminiCliSeeder = new GeminiCliSeeder();
-/**
-* Process-wide singleton registry used by the resolver.
-*
-* Concrete seeder instances are auto-registered into this registry at
-* module load via the registration block below + the `./register.ts`
-* barrel which aggregates side-effect imports (T9409+). As of this merge
-* the registry contains:
-*
-* - env seeders for every provider in ENV_VARS (T9409)
-* - `claude-code` × `anthropic` (T9410)
-* - `cleo-pkce` × `anthropic` (T9411)
-* - `codex-cli`, `gemini-cli` external seeders (T9418)
-* - `gh-cli` seeder is present but NOT registered (T9594 — GitHub PAT cannot auth OpenAI)
-*
-* The singleton is a module-scoped constant (`export const`) rather than a
-* class static so re-importing this module from different entry points
-* yields the same instance under Node ESM's module cache. Tests that need
-* isolation MUST construct a fresh `new SeederRegistry()` instead of
-* mutating `BUILTIN_SEEDERS`.
-*
-* @task T9408 (foundation)
-* @task T9410 (claude-code seeder)
-* @task T9411 (cleo-pkce seeder)
-* @task T9418 (codex-cli, gemini-cli, gh-cli)
-*/
-var BUILTIN_SEEDERS = new class SeederRegistry {
-	/**
-	* Map keyed on `${sourceId}::${provider}` for O(1) duplicate detection.
-	* Values are the registered seeder instances; iteration order is
-	* insertion order (`Map` semantics) so `getAll()` is stable.
-	*/
-	entries = /* @__PURE__ */ new Map();
-	/**
-	* Register a seeder.
-	*
-	* @param seeder - Seeder instance to add.
-	* @throws {Error} `E_SEEDER_DUPLICATE` when the `(sourceId, provider)`
-	*   pair is already registered.
-	*
-	* @task T9408
-	*/
-	register(seeder) {
-		const key = SeederRegistry.makeKey(seeder.sourceId, seeder.provider);
-		if (this.entries.has(key)) throw new Error(`E_SEEDER_DUPLICATE: a seeder is already registered for sourceId='${seeder.sourceId}' provider='${seeder.provider}'`);
-		this.entries.set(key, seeder);
-	}
-	/**
-	* Return every registered seeder in insertion order.
-	*
-	* @returns Read-only view of the registry's seeders.
-	*
-	* @task T9408
-	*/
-	getAll() {
-		return Array.from(this.entries.values());
-	}
-	/**
-	* Return every seeder whose `provider` matches the argument.
-	*
-	* Order matches `getAll()` (insertion order). Returns an empty array when
-	* no seeder is registered for the provider.
-	*
-	* @param provider - Provider id to filter by (e.g. `'anthropic'`).
-	* @returns Read-only filtered array.
-	*
-	* @task T9408
-	*/
-	getByProvider(provider) {
-		return this.getAll().filter((s) => s.provider === provider);
-	}
-	/**
-	* Compose the internal uniqueness key for a `(sourceId, provider)` pair.
-	*
-	* Exposed as `static` so tests and (future) resolver code can assert
-	* collision behaviour without coupling to the literal separator.
-	*
-	* @internal
-	*/
-	static makeKey(sourceId, provider) {
-		return `${sourceId}::${provider}`;
-	}
-}();
-BUILTIN_SEEDERS.register(createClaudeCodeSeeder());
-BUILTIN_SEEDERS.register(createCleoPkceSeeder());
-BUILTIN_SEEDERS.register(codexCliSeeder);
-BUILTIN_SEEDERS.register(geminiCliSeeder);
-//#endregion
-//#region ../core/dist/llm/global-config-migration.js
-/**
-* XDG drift migration for the global CLEO config file (T9405).
-*
-* Pre-T9405 history: `globalConfigPath()` resolved to the CLEO **data** dir
-* (`getCleoHome()`), so existing installs have `config.json` at
-* `~/.local/share/cleo/config.json`. XDG says user config belongs in
-* `XDG_CONFIG_HOME` (`~/.config/cleo/config.json`).
-*
-* This migration runs on first credentials read after upgrade:
-*
-* 1. Skip if the data-dir source is absent.
-* 2. Skip if the data-dir migration marker exists (idempotent).
-* 3. Skip if the config-dir target already exists (manual migration / fresh install).
-* 4. Otherwise:
-*    a. `mkdir -p` the config dir.
-*    b. Read the data-dir config.
-*    c. Validate the JSON parses.
-*    d. Write to a temp file in the config dir, then atomically rename to the
-*       final `config.json` (temp-then-rename — never any partial state).
-*    e. Drop the marker file at `<data-dir>/.migrations/config-dir-v1.done`.
-*    f. Rename the data-dir original to `config.json.pre-e1-bak` so users can
-*       recover if something goes wrong.
-*
-* Migration is best-effort: every error is swallowed and logged to stderr. A
-* failed migration must never crash a CLI invocation — credentials resolution
-* just falls back to the data-dir location via the transition-window logic
-* baked into `globalConfigPath()`.
-*
-* @module llm/global-config-migration
-* @task T9405
-* @epic T9398
-*/
-/**
-* Filename used by `legacyGlobalConfigPath()` / `configDirGlobalConfigPath()`.
-*
-* Kept in one place so the migration helper and the credentials resolver agree
-* without anyone hard-coding the string in two places.
-*
-* @internal
-*/
-var GLOBAL_CONFIG_FILENAME = "config.json";
-/**
-* Subdirectory in the data dir where migration markers are stamped.
-*
-* @internal
-*/
-var MIGRATIONS_SUBDIR = ".migrations";
-/**
-* Marker filename written when the config-dir migration completes.
-*
-* @internal
-*/
-var MIGRATION_MARKER = "config-dir-v1.done";
-/**
-* Backup suffix appended to the data-dir source after a successful migration.
-*
-* Per the E-CONFIG-AUTH-UNIFY spec the original is renamed (not deleted) so
-* users have a recovery path.
-*
-* @internal
-*/
-var BACKUP_SUFFIX = ".pre-e1-bak";
-/**
-* Resolve the canonical config-dir path for the global config file.
-*
-* Linux:   `~/.config/cleo/config.json`
-* macOS:   `~/Library/Preferences/cleo/config.json`
-* Windows: `%APPDATA%\cleo\Config\config.json`
-*
-* @public
-*/
-function configDirGlobalConfigPath() {
-	return join(getCleoPlatformPaths().config, GLOBAL_CONFIG_FILENAME);
-}
-/**
-* Resolve the legacy data-dir path for the global config file.
-*
-* Pre-T9405 location. Read-only fallback during the transition window — the
-* migration moves the contents to {@link configDirGlobalConfigPath} and
-* renames the data-dir original to `config.json.pre-e1-bak`.
-*
-* @public
-*/
-function legacyGlobalConfigPath() {
-	return join(getCleoHome(), GLOBAL_CONFIG_FILENAME);
-}
-/**
-* Path to the migration marker file. Stamped in the data dir (NOT the config
-* dir) because the marker is tied to "did we already process the legacy
-* data-dir install?" — co-locating it with the source makes the relationship
-* obvious and prevents `CLEO_HOME` overrides in tests from clobbering the
-* config-dir state.
-*
-* @internal
-*/
-function migrationMarkerPath() {
-	return join(getCleoHome(), MIGRATIONS_SUBDIR, MIGRATION_MARKER);
-}
-/**
-* Path used during atomic write inside the config dir.
-*
-* @internal
-*/
-function tempTargetPath() {
-	return `${configDirGlobalConfigPath()}.tmp`;
-}
-/**
-* Run the data-dir → config-dir migration if applicable.
-*
-* Idempotent: safe to call on every CLEO invocation. Performs at most three
-* filesystem stat calls in the steady state (marker present OR source absent).
-*
-* Never throws. Errors are logged to stderr and swallowed — the credentials
-* resolver's transition-window logic will still find the legacy data-dir copy.
-*
-* @returns `true` when a migration was actually performed, `false` when it was
-*   a no-op (already migrated, no source, or target already present).
-*
-* @task T9405
-*/
-function migrateGlobalConfigToConfigDir() {
-	try {
-		const source = legacyGlobalConfigPath();
-		const target = configDirGlobalConfigPath();
-		const marker = migrationMarkerPath();
-		if (existsSync(marker)) return false;
-		if (!existsSync(source)) {
-			stampMarker(marker);
-			return false;
-		}
-		if (existsSync(target)) {
-			backupSourceQuiet(source);
-			stampMarker(marker);
-			return false;
-		}
-		const raw = readFileSync(source, "utf-8");
-		try {
-			JSON.parse(raw);
-		} catch (err) {
-			console.error(`[cleo] global config migration skipped: ${source} is not valid JSON (${err.message})`);
-			return false;
-		}
-		mkdirSync(getCleoPlatformPaths().config, { recursive: true });
-		const temp = tempTargetPath();
-		writeFileSync(temp, raw, { mode: 420 });
-		renameSync(temp, target);
-		stampMarker(marker);
-		try {
-			renameSync(source, `${source}${BACKUP_SUFFIX}`);
-		} catch (err) {
-			console.error(`[cleo] global config migrated, but backup rename failed: ${err.message}. The legacy file at ${source} can be removed manually.`);
-		}
-		console.error(`[cleo] migrated global config: ${source} → ${target} (backup at ${source}${BACKUP_SUFFIX})`);
-		return true;
-	} catch (err) {
-		try {
-			const temp = tempTargetPath();
-			if (existsSync(temp)) unlinkSync(temp);
-		} catch {}
-		console.error(`[cleo] global config migration failed: ${err.message}. Credentials will continue to resolve from the legacy data-dir location.`);
-		return false;
-	}
-}
-/**
-* Stamp the migration marker file. Best-effort — errors are swallowed.
-*
-* @internal
-*/
-function stampMarker(markerPath) {
-	try {
-		mkdirSync(join(getCleoHome(), MIGRATIONS_SUBDIR), { recursive: true });
-		writeFileSync(markerPath, `${(/* @__PURE__ */ new Date()).toISOString()}\n`, { mode: 420 });
-	} catch {}
-}
-/**
-* Best-effort rename of the legacy source to the backup name. Silent failure.
-*
-* @internal
-*/
-function backupSourceQuiet(source) {
-	try {
-		const backup = `${source}${BACKUP_SUFFIX}`;
-		if (existsSync(backup)) return;
-		renameSync(source, backup);
-	} catch {}
-}
-var hasRunInProcess$1 = false;
-/**
-* Run the migration at most once per Node process.
-*
-* Called from the credentials resolver before reading `globalConfigPath()` so
-* a stale install is upgraded in-place on first credentials read. The latch
-* keeps the steady-state cost at one boolean check after the first call —
-* essential because `resolveCredentials()` is on the hot path of every LLM
-* call.
-*
-* Use {@link _resetGlobalConfigMigrationLatch} in tests to re-arm the latch.
-*
-* @public
-*/
-function ensureGlobalConfigMigrated() {
-	if (hasRunInProcess$1) return;
-	hasRunInProcess$1 = true;
-	migrateGlobalConfigToConfigDir();
-}
-//#endregion
-//#region ../core/dist/llm/legacy-flat-key-import.js
-/**
-* One-shot migration: import the legacy `${CLEO_HOME}/anthropic-key` flat file
-* into the unified credential pool as a `legacy-flat-key` entry.
-*
-* Part of `E-CONFIG-AUTH-UNIFY` Epic E1 (T9406 / T-E1-4). The legacy flat key
-* file is the "tier 4b" entry in the current 6-tier resolver in
-* `credentials.ts`. Once imported into the pool, the resolver's tier-3
-* (`cred-file`) lookup will pick it up — so post-E2 we can collapse the
-* tier-4b branch entirely without losing any operator's previously-stored
-* key.
-*
-* ## Behavior
-*
-* On `importLegacyFlatAnthropicKey()` (idempotent):
-*
-* 1. If the migration marker `${CLEO_HOME}/.imported-legacy-flat-key` exists,
-*    return immediately (`status: 'marker-present'`).
-* 2. If the pool already contains an `anthropic` entry with
-*    `label === 'legacy-flat-key'`, write the marker and return
-*    (`status: 'already-imported'`).
-* 3. If `${CLEO_HOME}/anthropic-key` does not exist, write the marker and
-*    return (`status: 'no-flat-file'`). Avoids re-stating the file on
-*    every CLI invocation.
-* 4. If the flat file exists but its trimmed content is empty, write the
-*    marker and return (`status: 'empty-flat-file'`). We do NOT rename an
-*    empty file — leave it for the operator to inspect / delete.
-* 5. Otherwise: call `addCredential()` with the trimmed key, then rename
-*    the flat file to `anthropic-key.pre-e1-bak`, then write the marker.
-*    Returns `status: 'imported'`.
-*
-* ## Atomicity contract
-*
-* The two side-effects we care about — (a) the pool entry insert and
-* (b) the flat-file rename — are sequenced so a failure at (b) leaves the
-* pool entry in place AND no marker is written. The next run will then
-* skip the insert (via the `getCredentialByLabel` check in step 2 above)
-* but still attempt the rename. This avoids a half-done state where the
-* marker exists but the original flat file is still discoverable by the
-* tier-4b resolver branch (which would re-import it on the next pool
-* rebuild).
-*
-* If `addCredential()` itself throws, nothing is renamed and no marker
-* is written — the next invocation retries cleanly.
-*
-* @module llm/legacy-flat-key-import
-* @task T9406
-* @epic E-CONFIG-AUTH-UNIFY
-*/
-var logger$1 = getLogger("llm-legacy-flat-key-import");
-/**
-* Canonical label assigned to the imported entry.
-*
-* Constant rather than parameterized — the resolver collapse in E2 keys
-* its behavior off this exact label, so it MUST remain stable.
-*/
-var LEGACY_FLAT_KEY_LABEL = "legacy-flat-key";
-/**
-* Filename suffix used when renaming the original flat file post-import.
-*
-* Kept identical to the convention used by the T310 conduit migration
-* (`.pre-t310.bak`) for cross-codebase greppability.
-*/
-var LEGACY_FLAT_KEY_BAK_SUFFIX = ".pre-e1-bak";
-/**
-* Filename of the migration marker inside `getCleoHome()`. Existence of
-* this file (any content) is sufficient to short-circuit the migration.
-*/
-var LEGACY_FLAT_KEY_MARKER = ".imported-legacy-flat-key";
-/**
-* Compute all paths used by the migration. Pure — no filesystem touch.
-*/
-function migrationPaths() {
-	const home = getCleoHome();
-	return {
-		flatPath: join(home, "anthropic-key"),
-		bakPath: join(home, `anthropic-key${LEGACY_FLAT_KEY_BAK_SUFFIX}`),
-		markerPath: join(home, LEGACY_FLAT_KEY_MARKER)
-	};
-}
-/**
-* Write the migration marker. Uses `flag: 'wx'` so concurrent first-run
-* callers race-tolerantly — exactly one writes, the rest get `EEXIST`
-* which we treat as success.
-*
-* Best-effort 0o600 (matches the surrounding cred-store hardening).
-*/
-function writeMarker(markerPath) {
-	try {
-		writeFileSync(markerPath, `${(/* @__PURE__ */ new Date()).toISOString()}\n`, {
-			encoding: "utf-8",
-			flag: "wx",
-			mode: 384
-		});
-	} catch (err) {
-		if (err.code === "EEXIST") return;
-		logger$1.debug({
-			markerPath,
-			err: err instanceof Error ? err.message : String(err)
-		}, "legacy-flat-key migration: marker write failed");
-	}
-}
-/**
-* Read and trim the flat file. Returns null on any I/O error or when the
-* trimmed content is empty. Never throws.
-*/
-function readFlatKey(flatPath) {
-	try {
-		if (!existsSync(flatPath)) return null;
-		return readFileSync(flatPath, "utf-8").trim() || null;
-	} catch (err) {
-		logger$1.warn({
-			flatPath,
-			err: err instanceof Error ? err.message : String(err)
-		}, "legacy-flat-key migration: read failed — skipping");
-		return null;
-	}
-}
-/**
-* Import the legacy `${CLEO_HOME}/anthropic-key` flat file into the
-* credential pool, exactly once per CLEO home directory.
-*
-* Idempotent — safe to call from any bootstrap path on every CLI
-* invocation. The marker file guarantees O(1) cost on warm runs.
-*
-* Never throws. All errors are caught and surfaced through the structured
-* logger; the resolver fallback chain still works.
-*
-* @returns A `LegacyFlatKeyImportResult` describing the outcome.
-*
-* @task T9406
-*/
-async function importLegacyFlatAnthropicKey() {
-	const { flatPath, bakPath, markerPath } = migrationPaths();
-	if (existsSync(markerPath)) return {
-		status: "marker-present",
-		flatPath,
-		bakPath: null,
-		markerPath
-	};
-	let existing = null;
-	try {
-		existing = await getCredentialByLabel("anthropic", LEGACY_FLAT_KEY_LABEL);
-	} catch (err) {
-		logger$1.warn({ err: err instanceof Error ? err.message : String(err) }, "legacy-flat-key migration: pool lookup failed — skipping this run");
-		return {
-			status: "no-flat-file",
-			flatPath,
-			bakPath: null,
-			markerPath
-		};
-	}
-	if (existing) {
-		writeMarker(markerPath);
-		return {
-			status: "already-imported",
-			flatPath,
-			bakPath: null,
-			markerPath
-		};
-	}
-	if (!existsSync(flatPath)) {
-		writeMarker(markerPath);
-		return {
-			status: "no-flat-file",
-			flatPath,
-			bakPath: null,
-			markerPath
-		};
-	}
-	const token = readFlatKey(flatPath);
-	if (!token) {
-		writeMarker(markerPath);
-		return {
-			status: "empty-flat-file",
-			flatPath,
-			bakPath: null,
-			markerPath
-		};
-	}
-	try {
-		await addCredential({
-			provider: "anthropic",
-			label: LEGACY_FLAT_KEY_LABEL,
-			authType: "api_key",
-			accessToken: token,
-			source: "manual",
-			priority: 100
-		});
-	} catch (err) {
-		logger$1.error({
-			err: err instanceof Error ? err.message : String(err),
-			flatPath
-		}, "legacy-flat-key migration: addCredential failed — leaving flat file in place for retry");
-		return {
-			status: "no-flat-file",
-			flatPath,
-			bakPath: null,
-			markerPath
-		};
-	}
-	try {
-		renameSync(flatPath, bakPath);
-	} catch (err) {
-		logger$1.warn({
-			err: err instanceof Error ? err.message : String(err),
-			flatPath,
-			bakPath
-		}, "legacy-flat-key migration: rename to .pre-e1-bak failed — entry imported, will retry rename");
-		return {
-			status: "imported",
-			flatPath,
-			bakPath: null,
-			markerPath
-		};
-	}
-	writeMarker(markerPath);
-	logger$1.info({
-		flatPath,
-		bakPath,
-		markerPath,
-		label: LEGACY_FLAT_KEY_LABEL
-	}, "legacy-flat-key migration: imported anthropic flat key into pool");
-	return {
-		status: "imported",
-		flatPath,
-		bakPath,
-		markerPath
-	};
-}
-var hasRunInProcess = false;
-/**
-* Run {@link importLegacyFlatAnthropicKey} at most once per Node process.
-*
-* Fire-and-forget: the credentials resolver is synchronous, but the import
-* is async (the credential-store API is async). Callers MUST NOT await
-* this — the helper is fully idempotent and the marker / pool-entry checks
-* ensure later invocations observe the imported entry without re-running.
-*
-* Errors are caught and dropped on the floor (the underlying helper already
-* logs through the structured logger). Returning a no-op promise keeps the
-* call site uniform with {@link ensureGlobalConfigMigrated} from
-* `global-config-migration.ts`.
-*
-* Wired into `resolveCredentials()` so a stale install gets its legacy flat
-* key promoted into the credential pool on first credentials read.
-*
-* Use {@link _resetLegacyFlatKeyImportLatch} in tests to re-arm the latch.
-*
-* @public
-* @task T9407
-*/
-function ensureLegacyFlatAnthropicKeyImported() {
-	if (hasRunInProcess) return;
-	hasRunInProcess = true;
-	importLegacyFlatAnthropicKey().catch(() => {});
-}
-//#endregion
-//#region ../core/dist/llm/credentials.js
-/**
-* Centralised credential resolution for the CLEO LLM layer (T1677).
-*
-* ONE canonical entry point: `resolveCredentials(provider, options)`.
-* Every LLM consumer — extraction, dream-cycle, hygiene-scan, dup-detect,
-* observer-reflector, deriver, adapters — MUST use this function.
-*
-* ## 6-tier resolution chain (first match wins)
-*
-* 1. **explicit**       — `options.apiKey` passed by the caller
-* 2. **env**            — provider-specific environment variable
-*                         (`ANTHROPIC_API_KEY` | `OPENAI_API_KEY` |
-*                          `GEMINI_API_KEY` | `MOONSHOT_API_KEY`)
-* 3. **cred-file**      — `~/.cleo/llm-credentials.json` (multi-credential
-*                         pool, file-locked, 0600). T-LLM-CRED Phase 2.
-* 4. **claude-creds**   — `~/.claude/.credentials.json` OAuth token
-*                         (only for `anthropic` provider; Claude Code zero-config)
-* 5. **global-config**  — `~/.config/cleo/config.json` (XDG config dir, post-T9405)
-*                         → `llm.providers.<provider>.apiKey`. The legacy
-*                         `~/.local/share/cleo/config.json` location is still
-*                         read as a fallback during the transition window.
-* 6. **project-config** — `.cleo/config.json`  → `llm.providers.<provider>.apiKey`
-*
-* Returns `null` when no key is found in any tier.
-*
-* @module llm/credentials
-* @task T1677
-* @epic T1676
-*/
-/**
-* Maps each provider transport to its canonical environment variable name.
-*
-* NOTE: `bedrock` is informational — AWS Bedrock uses the AWS SDK credential
-* chain (`AWS_PROFILE` / `~/.aws/credentials` / IAM role / SSO), not a single
-* API-key env var. The credential-pool resolves Bedrock via `authType: 'aws_sdk'`
-* and never reads the `accessToken` field from env.
-*
-* Exported so concrete seeders (e.g. the env seeder under
-* `./credential-seeders/env-seeder.ts`) reuse the same mapping instead of
-* inlining a duplicate. Treat this as the single source of truth for
-* `(provider → env var name)`.
-*
-* @task T9409
-*/
-var ENV_VARS = {
-	anthropic: "ANTHROPIC_API_KEY",
-	openai: "OPENAI_API_KEY",
-	gemini: "GEMINI_API_KEY",
-	moonshot: "MOONSHOT_API_KEY",
-	openrouter: "OPENROUTER_API_KEY",
-	bedrock: "AWS_PROFILE",
-	deepseek: "DEEPSEEK_API_KEY",
-	xai: "XAI_API_KEY",
-	groq: "GROQ_API_KEY",
-	"kimi-code": "KIMI_CODE_API_KEY",
-	ollama: "OLLAMA_HOST"
-};
-/**
-* Path to the global CLEO config file.
-*
-* Canonical location is the XDG **config** dir (`~/.config/cleo/config.json`
-* on Linux) — T9405 moved it here from the data dir to comply with XDG. The
-* data-dir copy is still consulted as a read-only fallback during the
-* transition window via {@link readGlobalProviderKey}; existing installs are
-* migrated in-place on first credentials read by
-* {@link ensureGlobalConfigMigrated}.
-*/
-function globalConfigPath() {
-	return configDirGlobalConfigPath();
-}
-/** Path to the project-level CLEO config file. */
-function projectConfigPath(projectRoot) {
-	return join(projectRoot, process.env["CLEO_DIR"] ?? ".cleo", "config.json");
-}
-/**
-* Tier 4a reader — finds the global provider key, preferring the config-dir
-* location and falling back to the legacy data-dir location during the
-* transition window (T9405).
-*
-* Migration runs at most once per process via {@link ensureGlobalConfigMigrated}
-* so the data-dir fallback is only reachable when the migration itself failed
-* (e.g. permission errors) or when a brand-new file lands in the data dir
-* after the marker was already stamped. Both situations resolve to the legacy
-* copy so users never get a "key disappeared" surprise.
-*/
-function readGlobalProviderKey(provider) {
-	ensureGlobalConfigMigrated();
-	const configDirKey = readProviderKeyFromConfig(globalConfigPath(), provider);
-	if (configDirKey) return configDirKey;
-	return readProviderKeyFromConfig(legacyGlobalConfigPath(), provider);
-}
-/**
-* Tier 4b backward compat: read the legacy flat key file written by
-* `storeAnthropicApiKey()` before T1677 migrated storage to config.json.
-*
-* File: `~/.local/share/cleo/anthropic-key` (plain text, one line).
-* Returns null when the file does not exist or is empty.
-*/
-function readFlatAnthropicKey() {
-	try {
-		const keyFile = join(getCleoHome(), "anthropic-key");
-		if (!existsSync(keyFile)) return null;
-		return readFileSync(keyFile, "utf-8").trim() || null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Read `llm.providers[provider].apiKey` from a JSON config file.
-* Returns null on any error or missing key.
-*/
-function readProviderKeyFromConfig(configFile, provider) {
-	try {
-		if (!existsSync(configFile)) return null;
-		const raw = readFileSync(configFile, "utf-8");
-		const llm = JSON.parse(raw)["llm"];
-		if (!llm || typeof llm !== "object") return null;
-		const providers = llm["providers"];
-		if (!providers || typeof providers !== "object") return null;
-		const entry = providers[provider];
-		if (!entry || typeof entry !== "object") return null;
-		const apiKey = entry["apiKey"];
-		if (typeof apiKey === "string" && apiKey.trim()) return apiKey.trim();
-		return null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Resolve the API key for a provider using the synchronous tier chain.
-*
-* Resolution order (first non-empty match wins):
-* 1. `options.apiKey`  — explicit caller override
-* 2. `ENV_VARS[provider]` environment variable
-* 3. `~/.cleo/llm-credentials.json` — unified credential pool (read-only;
-*    seeding is the unified pool's responsibility — the sync path does not
-*    re-seed)
-* 4a. `~/.cleo/config.json` → `llm.providers[provider].apiKey` — **deprecated**
-*     (emits stderr warning; still resolves during the transition window)
-* 5. `<projectRoot>/.cleo/config.json` → `llm.providers[provider].apiKey` —
-*    **rejected** (T-E2-6 footgun kill; emits stderr warning, never resolves)
-*
-* Direct reading of `~/.claude/.credentials.json` was removed in T9413; the
-* `claude-code` seeder is now the sole owner of that file and its imported
-* entries land in the pool, which the tier-3 read picks up.
-*
-* For new code prefer {@link resolveCredentialsAsync}, which delegates to the
-* {@link UnifiedCredentialPool} singleton (`getCredentialPool().pick()`) and
-* triggers a lazy seed pass on first call. The sync variant is retained for
-* call-sites that cannot move to async (e.g. `defaultTransportApiKey`,
-* `resolveModelCredentials`).
-*
-* Never throws. All filesystem errors are caught and treated as "not found".
-*
-* @param provider - The LLM provider transport to resolve credentials for.
-* @param options  - Optional overrides and project root for tier 5 warning.
-* @returns A `CredentialResult` with `provider`, `apiKey`, and `source`.
-*
-* @example
-* ```ts
-* const cred = resolveCredentials('anthropic', { projectRoot: cwd });
-* if (!cred.apiKey) throw new Error('No Anthropic key found');
-* ```
-*
-* @task T9413
-* @epic E-CONFIG-AUTH-UNIFY
-*/
-function resolveCredentials(provider, options = {}) {
-	ensureLegacyFlatAnthropicKeyImported();
-	if (options.apiKey?.trim()) {
-		const token = options.apiKey.trim();
-		return {
-			provider,
-			apiKey: token,
-			source: "explicit",
-			authType: detectAuthType(provider, token)
-		};
-	}
-	const envVar = ENV_VARS[provider];
-	const envKey = process.env[envVar];
-	if (envKey?.trim()) {
-		const token = envKey.trim();
-		return {
-			provider,
-			apiKey: token,
-			source: "env",
-			authType: detectAuthType(provider, token)
-		};
-	}
-	const stored = pickCredentialForProviderSync(provider);
-	if (stored) {
-		const wireAuthType = stored.authType === "oauth" ? "oauth" : "api_key";
-		return {
-			provider,
-			apiKey: stored.accessToken || null,
-			source: "cred-file",
-			authType: wireAuthType
-		};
-	}
-	const globalKey = readGlobalProviderKey(provider);
-	if (globalKey) {
-		warnGlobalConfigApiKeyDeprecated(provider);
-		return {
-			provider,
-			apiKey: globalKey,
-			source: "global-config",
-			authType: detectAuthType(provider, globalKey)
-		};
-	}
-	if (provider === "anthropic") {
-		const flatKey = readFlatAnthropicKey();
-		if (flatKey) return {
-			provider,
-			apiKey: flatKey,
-			source: "global-config",
-			authType: detectAuthType(provider, flatKey)
-		};
-	}
-	if (options.projectRoot) {
-		if (readProviderKeyFromConfig(projectConfigPath(options.projectRoot), provider)) warnProjectConfigApiKeyRejected(provider);
-	}
-	return {
-		provider,
-		apiKey: null,
-		source: void 0,
-		authType: "api_key"
-	};
-}
-/**
-* Latch the deprecation warning per (provider, message) so a hot loop does
-* not flood stderr. Keys are simple strings — small, opaque to the rest of
-* the module.
-*
-* @internal
-*/
-var WARNED_GLOBAL_CONFIG = /* @__PURE__ */ new Set();
-var WARNED_PROJECT_CONFIG = /* @__PURE__ */ new Set();
-/**
-* Emit a one-shot stderr warning that the global-config `apiKey` path is
-* deprecated. Re-emits only if the latch is cleared (test-only via
-* {@link _resetCredentialDeprecationLatchesForTests}).
-*
-* @internal
-* @task T9413
-*/
-function warnGlobalConfigApiKeyDeprecated(provider) {
-	if (WARNED_GLOBAL_CONFIG.has(provider)) return;
-	WARNED_GLOBAL_CONFIG.add(provider);
-	process.stderr.write(`[cleo] DEPRECATED: \`llm.providers.${provider}.apiKey\` in the global config.json is deprecated and will be removed. Migrate with \`cleo auth add ${provider}\` or \`cleo llm add\`.\n`);
-}
-/**
-* Emit a one-shot stderr warning that the project-config `apiKey` path is
-* rejected. The key is NOT resolved — operators must migrate.
-*
-* @internal
-* @task T9413
-*/
-function warnProjectConfigApiKeyRejected(provider) {
-	if (WARNED_PROJECT_CONFIG.has(provider)) return;
-	WARNED_PROJECT_CONFIG.add(provider);
-	process.stderr.write(`[cleo] REJECTED: \`llm.providers.${provider}.apiKey\` in \`.cleo/config.json\` (project-scoped) is a security footgun and is no longer honoured. Run \`cleo auth migrate-project-secrets\` to move the key into the unified credential pool.\n`);
-}
-/**
-* Detect whether a credential string is an Anthropic OAuth token by prefix.
-*
-* The Claude Code OAuth flow issues tokens with the prefixes:
-* - `sk-ant-oat-*` — access token (used for API calls)
-* - `sk-ant-ort-*` — refresh token (rare in direct calls, but recognized for safety)
-*
-* Every other provider in Phase 1 uses `api_key` authentication, so any
-* non-Anthropic credential is treated as `api_key`. Tokens loaded from
-* `claude-creds` are always `oauth` regardless of prefix (handled by the caller).
-*/
-function detectAuthType(provider, token) {
-	if (provider !== "anthropic") return "api_key";
-	if (token.startsWith("sk-ant-oat-") || token.startsWith("sk-ant-ort-")) return "oauth";
-	return "api_key";
-}
-/**
-* Build the authentication HTTP headers for a resolved credential.
-*
-* For raw-fetch call-sites (e.g. memory/sleep-consolidation, memory/observer-reflector)
-* this returns the full bag of provider-specific auth headers including the
-* `anthropic-version` or `anthropic-beta` markers that Anthropic requires.
-* The caller still owns `Content-Type` and the request body.
-*
-* Returns an empty object when `cred.apiKey` is null — callers should never
-* reach this helper without verifying they have a credential, but the no-op
-* fallback avoids accidental `undefined` header injection.
-*
-* @task T-LLM-CRED-CENTRALIZATION Phase 1
-*/
-function authHeaders(cred) {
-	if (!cred.apiKey) return {};
-	if (cred.provider === "anthropic") {
-		if (cred.authType === "oauth") return {
-			Authorization: `Bearer ${cred.apiKey}`,
-			"anthropic-beta": "oauth-2025-04-20",
-			"anthropic-version": "2023-06-01"
-		};
-		return {
-			"x-api-key": cred.apiKey,
-			"anthropic-version": "2023-06-01"
-		};
-	}
-	return { Authorization: `Bearer ${cred.apiKey}` };
-}
-/**
-* Build the provider auth headers AT THE WIRE directly from a sealed credential
-* handle — the E10 boundary primitive (T11754 · AC2).
-*
-* ## Why this exists
-*
-* The pre-E10 / interim pattern materialized the plaintext into a caller-visible
-* variable first — `const token = (await sealed.fetch()).value;` — and only then
-* called {@link authHeaders}. That intermediate `token` binding is a leak surface:
-* any code added between the `fetch()` and the header build could log, serialize,
-* or forward the bare secret.
-*
-* `authHeadersFromSealed` collapses those two steps into ONE chokepoint. It is
-* the SOLE place (alongside daemon worker-injection) that invokes
-* {@link SealedCredential.fetch} — the crypto decrypt happens inside the handle's
-* `fetch()`, the materialized {@link DecryptedToken} is consumed in-place to build
-* the `x-api-key` / `Authorization: Bearer` headers (per provider + scheme), and
-* the plaintext goes out of scope WITHOUT ever being returned, logged, or bound
-* to a caller variable. Callers receive ONLY the finished header bag.
-*
-* Invoke this ONLY at a wire boundary — `transportForProvider` /
-* `session-factory.ts:56`, the raw-fetch consumers (hygiene-scan,
-* duplicate-detector), or daemon worker-injection. Never to surface a key up the
-* resolver stack.
-*
-* @param sealed - The opaque credential handle returned by the resolver.
-* @param authType - The auth scheme to present the credential with (mirrors the
-*   resolved `credential.authType`). `'aws_sdk'` yields an empty bag — the AWS
-*   SDK injects credentials out-of-band, so there is no header to build.
-* @returns The provider-specific auth headers. The plaintext token is consumed
-*   internally and never escapes this function.
-* @task T11754
-*/
-async function authHeadersFromSealed(sealed, authType) {
-	if (authType === "aws_sdk") return {};
-	const decrypted = await sealed.fetch();
-	return authHeaders({
-		provider: sealed.provider,
-		apiKey: decrypted.value,
-		authType: authType === "oauth" ? "oauth" : "api_key"
-	});
-}
-//#endregion
-//#region ../core/dist/llm/credentials-store.js
-/**
-* Multi-credential pool storage for the CLEO LLM layer (T-LLM-CRED Phase 2).
-*
-* Persists a versioned list of provider credentials at
-* `~/.cleo/llm-credentials.json` (XDG-aware, resolved via `getCleoHome()` so
-* the test-only `XDG_DATA_HOME` override applies identically to every CLEO
-* global file).
-*
-* ## Goals
-*
-* - Multiple credentials per provider (label → entry), each with priority,
-*   disabled-flag, expiry, and a free-form `metadata` bag.
-* - Strict 0600 perms on every successful write.
-* - Cross-process locking via `proper-lockfile` reused through `withLock`.
-* - Atomic writes via `writeJsonFileAtomic` (temp → rename + numbered backup).
-* - Synchronous read path so the resolver in `credentials.ts` can call it
-*   from its existing sync function.
-*
-* Design lock-in (per plan):
-*   • `provider` MUST be a valid `ModelTransport`.
-*   • `(provider, label)` is the uniqueness key — `addCredential` upserts.
-*   • `priority` defaults to `max(existing) + 10` so new entries lose to all
-*     existing ones unless an explicit priority is supplied.
-*   • Round-robin picker keeps state in-memory per provider — sufficient for
-*     a single-process orchestrator; durable round-robin is a future change.
-*   • Storage-time auth type widens the wire-time `AuthType` to include
-*     `'aws_sdk'` for forward-compat with Bedrock. `credentials.ts` narrows
-*     `'aws_sdk' → 'api_key'` until Phase 3 widens the on-wire union.
-*
-* Reference: Hermes `credential_pool.py:32-33` defined the on-disk schema
-* we mirror here.
-*
-* @module llm/credentials-store
-* @task T9257
-* @epic T-LLM-CRED-CENTRALIZATION
-*/
-var logger = getLogger("llm-credentials-store");
-/**
-* Absolute path of the credential store file.
-*
-* Resolved through `getCleoHome()` so XDG overrides apply uniformly with
-* `credentials.ts`'s global-config tier.
-*
-* @task T9257
-*/
-function credentialsStorePath() {
-	return join(getCleoHome(), "llm-credentials.json");
-}
-/**
-* Ensure the store file exists with a parseable empty-store body.
-*
-* `withLock` (file-utils) writes a zero-byte file when none exists so
-* `proper-lockfile` can hold the lock. The subsequent `readJsonFile` then
-* throws SyntaxError on the empty content. To avoid that, we pre-seed the
-* file with `{"version":1,"defaultStrategy":"priorityWithFallback",
-* "credentials":[]}` BEFORE acquiring the lock. The pre-seed is itself
-* race-tolerant: `writeFileSync({flag:'wx'})` makes creation idempotent
-* across concurrent callers — only the first one writes; the rest get
-* EEXIST and continue.
-*
-* @task T9257
-*/
-function ensureFileInitialized(path) {
-	if (existsSync(path)) return;
-	const dir = dirname(path);
-	if (!existsSync(dir)) mkdirSync(dir, {
-		recursive: true,
-		mode: 448
-	});
-	else try {
-		chmodSync(dir, 448);
-	} catch {}
-	try {
-		writeFileSync(path, `${JSON.stringify(emptyStore(), null, 2)}\n`, {
-			encoding: "utf-8",
-			flag: "wx",
-			mode: 384
-		});
-	} catch (err) {
-		if (err.code !== "EEXIST") throw err;
-	}
-}
-/**
-* S-02 (CWE-367 TOCTOU rename→chmod): the previous `enforce0600(path)`
-* helper used to chmod the live file AFTER `withLock` released its
-* lock. That left a window in which the temp file (default 0o644)
-* was the live file, no lock held, with secrets in it. The window
-* is now closed at the source: `writeJsonFileAtomic({mode: 0o600})`
-* creates the temp file pre-set to 0o600, so the post-rename file
-* is born 0o600 atomically. No follow-up chmod is needed.
-*
-* Kept here as a doc-only stub so a `git log --grep=enforce0600`
-* search points future readers at this rationale; the function and
-* every call-site are removed below.
-*
-* @task T9257 — security review S-02
-*/
-/**
-* Warn once when the file is loosely permissioned.
-*
-* Read-side check — we never refuse to read, but we surface the risk via
-* the project logger so an operator can investigate.
-*
-* @task T9257
-*/
-var _warnedLoosePerms = false;
-function checkPermsOnRead(path) {
-	if (_warnedLoosePerms) return;
-	try {
-		const mode = statSync(path).mode & 511;
-		if (mode !== 384 && mode !== 0) {
-			logger.warn({
-				path,
-				mode: mode.toString(8)
-			}, "llm-credentials-store: file perms looser than 0600");
-			_warnedLoosePerms = true;
-		}
-	} catch {}
-}
-/**
-* Default on-disk shape when no file exists yet.
-*/
-function emptyStore() {
-	return {
-		version: 1,
-		defaultStrategy: "priorityWithFallback",
-		credentials: []
-	};
-}
-/**
-* Synchronous file read + parse. Never throws.
-*
-* Returns an empty store when the file is missing, unreadable, malformed,
-* or has the wrong `version`.
-*
-* @task T9257
-*/
-function readStoreSync() {
-	const path = credentialsStorePath();
-	let raw;
-	try {
-		raw = readFileSync(path, "utf-8");
-	} catch {
-		return emptyStore();
-	}
-	checkPermsOnRead(path);
-	if (!raw.trim()) return emptyStore();
-	try {
-		const parsed = JSON.parse(raw);
-		if (parsed.version !== 1 || !Array.isArray(parsed.credentials)) return emptyStore();
-		return {
-			version: 1,
-			defaultStrategy: parsed.defaultStrategy ?? "priorityWithFallback",
-			credentials: parsed.credentials.filter((c) => isStoredCredential(c))
-		};
-	} catch {
-		return emptyStore();
-	}
-}
-/**
-* Type-narrow check used during read to drop malformed entries silently.
-*/
-function isStoredCredential(value) {
-	if (!value || typeof value !== "object") return false;
-	const v = value;
-	const provider = v["provider"];
-	const label = v["label"];
-	const authType = v["authType"];
-	const accessToken = v["accessToken"];
-	const validProvider = provider === "anthropic" || provider === "openai" || provider === "gemini" || provider === "moonshot" || provider === "kimi-code" || provider === "openrouter" || provider === "bedrock" || provider === "deepseek" || provider === "xai" || provider === "groq";
-	const validAuth = authType === "api_key" || authType === "oauth" || authType === "aws_sdk";
-	if (!validProvider) return false;
-	if (typeof label !== "string" || !label) return false;
-	if (!validAuth) return false;
-	if (typeof accessToken !== "string") return false;
-	return true;
-}
-/**
-* Round-robin cursor map (per provider).
-*
-* In-memory by design: the store is single-process for the orchestrator
-* fleet, and durable round-robin would require an additional write-on-pick
-* which is not worth the cost in Phase 2.
-*/
-var _rrIndex = /* @__PURE__ */ new Map();
-/**
-* Filter `credentials` to `(provider, !disabled, !expired)` and apply
-* `preferLabel` when present.
-*
-* Returns `[]` when nothing eligible remains. Otherwise returns entries
-* sorted by priority ascending (stable for equal priorities).
-*
-* @task T9257
-*/
-function eligibleForProvider(data, provider, preferLabel) {
-	const now = Date.now();
-	const all = data.credentials.filter((c) => {
-		if (c.provider !== provider) return false;
-		if (c.disabled === true) return false;
-		if (typeof c.expiresAt === "number" && c.expiresAt > 0 && c.expiresAt <= now) {
-			logger.info({
-				provider: c.provider,
-				label: c.label,
-				expiresAt: c.expiresAt
-			}, "cred-file: skipping expired entry");
-			return false;
-		}
-		return true;
-	});
-	if (preferLabel) {
-		const exact = all.find((c) => c.label === preferLabel);
-		return exact ? [exact] : [];
-	}
-	return [...all].sort((a, b) => a.priority - b.priority);
-}
-/**
-* Synchronous variant of `pickCredentialForProvider`. Called from
-* `credentials.ts`'s sync `resolveCredentials()` tier-3 block. See the
-* async wrapper below for the canonical public API.
-*
-* Strategy resolution falls back to the store's `defaultStrategy` when
-* `opts.strategy` is not provided. Empty / disabled / expired pools yield
-* `null`.
-*
-* @task T9257
-*/
-function pickCredentialForProviderSync(provider, opts = {}) {
-	const data = readStoreSync();
-	const eligible = eligibleForProvider(data, provider, opts.preferLabel);
-	if (eligible.length === 0) return null;
-	if (opts.preferLabel) return eligible[0] ?? null;
-	switch (opts.strategy ?? data.defaultStrategy ?? "priorityWithFallback") {
-		case "priorityOnly":
-		case "priorityWithFallback": return eligible[0] ?? null;
-		case "roundRobin": {
-			const next = (_rrIndex.get(provider) ?? 0) % eligible.length;
-			_rrIndex.set(provider, next + 1);
-			return eligible[next] ?? null;
-		}
-		default: return eligible[0] ?? null;
-	}
-}
-/**
-* List credentials in the pool, optionally filtered to a single provider.
-*
-* Returns `[]` when the file does not exist. Never throws.
-*
-* @task T9257
-*/
-async function listCredentials(provider) {
-	const data = readStoreSync();
-	if (!provider) return [...data.credentials];
-	return data.credentials.filter((c) => c.provider === provider);
-}
-/**
-* Look up a single credential by `(provider, label)`. Returns `null` when
-* no match exists.
-*
-* @task T9257
-*/
-async function getCredentialByLabel(provider, label) {
-	return readStoreSync().credentials.find((c) => c.provider === provider && c.label === label) ?? null;
-}
-/**
-* Upsert a credential — replaces any existing `(provider, label)` pair.
-*
-* - When `input.priority` is omitted, the new entry receives
-*   `max(existing priorities) + 10` so it ranks lowest by default.
-* - Acquires the file lock via `withLock`; safe under concurrent writers.
-* - chmod 0600 is enforced on the written file.
-*
-* Returns the inserted (or replaced) entry as it now lives in the file.
-*
-* @task T9257
-*/
-async function addCredential(input) {
-	const path = credentialsStorePath();
-	ensureFileInitialized(path);
-	let inserted = null;
-	await withLock(path, (current) => {
-		const data = current ?? emptyStore();
-		if (data.version !== 1) {
-			data.version = 1;
-			data.credentials = [];
-		}
-		data.defaultStrategy ??= "priorityWithFallback";
-		const remaining = data.credentials.filter((c) => !(c.provider === input.provider && c.label === input.label));
-		const maxPriority = remaining.reduce((m, c) => c.priority > m ? c.priority : m, -10);
-		const priority = typeof input.priority === "number" ? input.priority : maxPriority + 10;
-		const next = {
-			provider: input.provider,
-			label: input.label,
-			authType: input.authType,
-			accessToken: input.accessToken,
-			expiresAt: input.expiresAt ?? null,
-			priority,
-			source: input.source,
-			baseUrl: input.baseUrl ?? null,
-			extraHeaders: input.extraHeaders,
-			metadata: input.metadata,
-			lastStatus: input.lastStatus,
-			lastErrorCode: input.lastErrorCode,
-			lastErrorResetAt: input.lastErrorResetAt,
-			requestCount: input.requestCount,
-			disabled: input.disabled ?? false,
-			...input.refreshToken !== void 0 && { refreshToken: input.refreshToken }
-		};
-		data.credentials = [...remaining, next];
-		inserted = next;
-		return data;
-	}, { mode: 384 });
-	if (!inserted) throw new Error("credentials-store: invariant violation — insert was not recorded");
-	return inserted;
-}
-/**
-* Remove a credential by `(provider, label)`.
-*
-* Returns `true` when a matching entry was found and removed, `false`
-* otherwise. Does NOT create the file when it does not yet exist.
-*
-* @task T9257
-*/
-async function removeCredential(provider, label) {
-	const path = credentialsStorePath();
-	if (!readStoreSync().credentials.some((c) => c.provider === provider && c.label === label)) return false;
-	ensureFileInitialized(path);
-	let removed = false;
-	await withLock(path, (current) => {
-		const data = current ?? emptyStore();
-		if (data.version !== 1 || !Array.isArray(data.credentials)) return emptyStore();
-		const before = data.credentials.length;
-		data.credentials = data.credentials.filter((c) => !(c.provider === provider && c.label === label));
-		removed = data.credentials.length < before;
-		data.defaultStrategy ??= "priorityWithFallback";
-		return data;
-	}, { mode: 384 });
-	return removed;
-}
-/**
-* Public async picker — thin wrapper over `pickCredentialForProviderSync`.
-*
-* The sync variant exists because the resolver in `credentials.ts` is
-* synchronous; both paths share the same filter + strategy logic.
-*
-* @task T9257
-*/
-async function pickCredentialForProvider(provider, opts = {}) {
-	return pickCredentialForProviderSync(provider, opts);
-}
-//#endregion
-//#region ../core/dist/llm/oauth/device-code.js
-/**
-* Build the `DeviceCodeConfig` for Kimi Code (kimi.com/code).
-*
-* Authentication endpoints are hosted at `auth.kimi.com` (override via
-* `KIMI_CODE_OAUTH_HOST` env var). The shared community client ID is reused
-* by kimi-cli and other integrations — no private registration required.
-*
-* Token lifecycle:
-*   - Access token: ~15 minutes
-*   - Refresh token: ~30 days
-*   - Recommended refresh strategy: 50% of lifetime or 300s, whichever is larger
-*
-* After OAuth completes, the resulting bearer token targets
-* `https://api.kimi.com/coding` (Anthropic Messages protocol). The six
-* mandatory `X-Msh-*` headers — built by {@link getKimiCodeMshHeaders} — MUST
-* be merged into every chat request alongside the bearer token.
-*
-* @returns Device-code configuration for Kimi Code OAuth.
-*
-* @task T9321
-* @epic T9261 T-LLM-CRED-CENTRALIZATION
-* @see https://github.com/gsd-build/gsd-2/issues/4642 — design reference
-* @see MoonshotAI/kimi-cli `src/kimi_cli/auth/oauth.py` — protocol reference
-*/
-function getKimiCodeDeviceCodeConfig() {
-	const host = process.env["KIMI_CODE_OAUTH_HOST"] ?? "https://auth.kimi.com";
-	return {
-		provider: "kimi-code",
-		deviceCodeUrl: `${host}/api/oauth/device_authorization`,
-		tokenUrl: `${host}/api/oauth/token`,
-		clientId: "17e5f671-d194-4dfb-9706-5516cb48c098"
-	};
-}
-//#endregion
-//#region ../core/dist/llm/credential-pool.js
-/**
-* CredentialPool — rotation + cooldown manager for the CLEO LLM credential
-* layer (T-LLM-CRED-CENTRALIZATION Phase 3 / T9265).
-*
-* Ports the Hermes `credential_pool.py` rotation strategies and cooldown
-* clocks to TypeScript, re-using the existing `credentials-store.ts` I/O
-* primitives (addCredential, listCredentials, getCredentialByLabel) for all
-* persistence so no new file-locking or write paths are introduced.
-*
-* ## Rotation strategies
-*
-* - `fill_first` (default): Iterate entries sorted by `priority` descending
-*   (higher = preferred); return the first that is not in active cooldown.
-* - `round_robin`: Advance a per-provider in-memory cursor; skip cooled-down
-*   entries until a healthy one is found.
-* - `least_used`: Pick the entry with the lowest `requestCount` that is not
-*   in active cooldown; tie-break by `priority` descending.
-*
-* ## Cooldown semantics (mirrored from Hermes)
-*
-* | HTTP code | Cooldown  |
-* |-----------|-----------|
-* | 401       | 5 minutes |
-* | 402       | 5 minutes |
-* | 429       | 1 hour    |
-* | 5xx       | 60 seconds|
-* | other     | 60 seconds|
-*
-* Reference: `hermes-agent/agent/credential_pool.py:92-1095`
-*
-* @module llm/credential-pool
-* @task T9265
-* @epic T-LLM-CRED-CENTRALIZATION
-*/
-/** Cooldown applied to 401 (auth) and 402 (billing) errors: 5 minutes. */
-var COOLDOWN_AUTH_MS = 300 * 1e3;
-/** Cooldown applied to 429 (rate-limited) errors: 1 hour. */
-var COOLDOWN_RATE_LIMIT_MS = 3600 * 1e3;
-/** Default cooldown for 5xx and all other error codes: 60 seconds. */
-var COOLDOWN_DEFAULT_MS = 60 * 1e3;
-/**
-* Proactive refresh threshold: at least 300 seconds (5 minutes) before expiry.
-*
-* The proactive window is `max(expiresIn * 0.5, PROACTIVE_REFRESH_FLOOR_MS)`.
-* For Kimi Code's ~15 min access tokens: 50% = 450s > 300s → uses 450s.
-* For very short tokens (< 600s): 50% < 300s → floor kicks in at 300s.
-*
-* @task T9323
-*/
-var PROACTIVE_REFRESH_FLOOR_MS = 3e5;
-/**
-* Thrown by `CredentialPool.pick()` when every entry for the provider is
-* currently in active cooldown (i.e., the pool is fully exhausted).
-*
-* Callers should surface this as a retryable, time-bounded failure. The
-* earliest retry time can be derived from `minResetAt` (epoch ms).
-*
-* @task T9265
-*/
-var PoolExhaustedError = class extends Error {
-	provider;
-	poolSize;
-	minResetAt;
-	/** Stable LAFS error code. */
-	code = "E_LLM_POOL_EXHAUSTED";
-	/**
-	* @param provider   - The provider whose pool is exhausted.
-	* @param poolSize   - Total number of entries in the pool.
-	* @param minResetAt - Epoch ms of the earliest cooldown expiry (may be 0 if
-	*                     all entries lack a reset timestamp).
-	*/
-	constructor(provider, poolSize, minResetAt) {
-		super(`E_LLM_POOL_EXHAUSTED: all ${poolSize} credential(s) for provider '${provider}' are in active cooldown. Earliest reset: ${minResetAt > 0 ? new Date(minResetAt).toISOString() : "unknown"}.`);
-		this.provider = provider;
-		this.poolSize = poolSize;
-		this.minResetAt = minResetAt;
-		this.name = "PoolExhaustedError";
-	}
-};
-/**
-* Compute the cooldown duration in milliseconds for a given HTTP error code.
-*
-* Mirrors `hermes-agent/agent/credential_pool.py:_exhausted_ttl`.
-*
-* @param errorCode - HTTP status code that triggered the exhaustion.
-* @returns Cooldown duration in milliseconds.
-*
-* @task T9265
-*/
-function cooldownMs(errorCode) {
-	if (errorCode === 401 || errorCode === 402) return COOLDOWN_AUTH_MS;
-	if (errorCode === 429) return COOLDOWN_RATE_LIMIT_MS;
-	return COOLDOWN_DEFAULT_MS;
-}
-/**
-* Return `true` when the credential is currently in active cooldown.
-*
-* A credential is in cooldown when `lastErrorResetAt` is set AND its value is
-* strictly greater than `Date.now()`.
-*
-* @param credential - The entry to check.
-* @returns `true` if the entry should be skipped by the picker.
-*
-* @task T9265
-*/
-function isInCooldown(credential) {
-	return typeof credential.lastErrorResetAt === "number" && Date.now() < credential.lastErrorResetAt;
-}
-/**
-* Sort entries by priority descending (higher priority = more preferred).
-*
-* `StoredCredential.priority` is stored ascending (lower = higher priority) in
-* the existing store convention. The pool inverts this so that the
-* highest-priority entry is first in the returned array.
-*
-* @param entries - Unsorted credential entries.
-* @returns New array sorted by priority descending.
-*
-* @task T9265
-*/
-function sortByPriorityDesc(entries) {
-	return [...entries].sort((a, b) => b.priority - a.priority);
-}
-/**
-* Per-`(provider, label)` in-flight refresh promise.
-*
-* When N concurrent callers arrive with the same expired credential, only the
-* first one POSTs to the token endpoint. All others await the same Promise so
-* the endpoint is called exactly once per concurrent burst.
-*
-* The key is `"${provider}::${label}"`. The map is cleared when the Promise
-* resolves (or rejects) so the next caller after a settled refresh starts a
-* fresh attempt.
-*
-* @internal
-* @task T11986
-*/
-var _refreshInFlight = /* @__PURE__ */ new Map();
-/**
-* TTL for a negative-cache entry after a failed refresh attempt (30 seconds).
-*
-* Prevents hammering the token endpoint when the refresh token is invalid or
-* the server is returning errors. After the TTL the next resolution attempt
-* will retry the refresh.
-*
-* @internal
-* @task T11986
-*/
-var REFRESH_NEGATIVE_CACHE_TTL_MS = 3e4;
-/**
-* Negative-cache map: `"${provider}::${label}" → epoch ms when the failed entry expires`.
-*
-* An entry in this map means "the last refresh of this credential failed; skip
-* until the timestamp has passed".
-*
-* @internal
-* @task T11986
-*/
-var _refreshNegativeCache = /* @__PURE__ */ new Map();
-/**
-* Refresh every expired-but-refreshable OAuth credential for `provider`,
-* with single-flight coalescing and a negative-cache on failure.
-*
-* ## Design (T11986 · DHQ-087)
-*
-* Called by `cross-provider-selector.ts` **before** the provisioning probe so
-* that an expired OAuth credential is renewed in-place and the selector sees
-* a valid token instead of filtering the provider as "not-provisioned".
-*
-* Single-flight: concurrent callers sharing the same `(provider, label)` key
-* coalesce on one in-flight Promise — the token endpoint is called at most
-* once per concurrent burst. After the Promise settles the key is deleted so
-* the next caller starts fresh.
-*
-* Negative-cache: a failed refresh stamps a 30-second suppression window.
-* During that window subsequent calls skip the refresh attempt rather than
-* hammering the endpoint with doomed requests.
-*
-* On total failure (every eligible entry failed): returns an `actionableHint`
-* with the exact re-login command (`cleo login ${provider}`).
-*
-* Note: `CredentialPool._refreshOAuthCredential` swallows errors silently by
-* design (its caller's retry path handles 401s). Here we need to surface
-* failures so callers can show actionable hints. We therefore attempt the
-* refresh via a fresh `CredentialPool` instance and check the credential store
-* for an updated `expiresAt` after the attempt to distinguish success from
-* failure.
-*
-* @param provider - The LLM transport provider to refresh credentials for.
-* @returns Refresh outcome with counts, last error, and actionable hint.
-*
-* @task T11986
-*/
-async function refreshExpiredOAuthForProvider(provider) {
-	const entries = await listCredentials(provider);
-	const now = Date.now();
-	let attempted = 0;
-	let refreshed = 0;
-	let lastError = null;
-	for (const entry of entries) {
-		if (entry.authType !== "oauth") continue;
-		if (!entry.refreshToken) continue;
-		if (entry.disabled === true) continue;
-		if (!(typeof entry.expiresAt === "number" && entry.expiresAt > 0 && entry.expiresAt <= now + PROACTIVE_REFRESH_FLOOR_MS)) continue;
-		const key = `${provider}::${entry.label}`;
-		const negExpiry = _refreshNegativeCache.get(key);
-		if (typeof negExpiry === "number" && now < negExpiry) {
-			attempted += 1;
-			lastError = lastError ?? /* @__PURE__ */ new Error(`OAuth refresh suppressed for ${provider}::${entry.label} (negative cache active)`);
-			continue;
-		}
-		attempted += 1;
-		let inFlight = _refreshInFlight.get(key);
-		if (!inFlight) {
-			const pool = new CredentialPool(provider);
-			const expiresAtBefore = entry.expiresAt;
-			inFlight = pool.proactiveRefresh(entry.label).then(async (wasAttempted) => {
-				if (!wasAttempted) return true;
-				const after = await getCredentialByLabel(provider, entry.label);
-				if (!(after !== null && typeof after.expiresAt === "number" && after.expiresAt > (expiresAtBefore ?? 0))) throw new Error(`OAuth refresh token exchange failed for ${provider}::${entry.label} — the stored token may be revoked. Run \`cleo login ${provider}\` to re-authenticate.`);
-				return true;
-			}).finally(() => {
-				_refreshInFlight.delete(key);
-			});
-			_refreshInFlight.set(key, inFlight);
-		}
-		try {
-			await inFlight;
-			refreshed += 1;
-		} catch (err) {
-			lastError = err instanceof Error ? err : new Error(String(err));
-			_refreshNegativeCache.set(key, Date.now() + REFRESH_NEGATIVE_CACHE_TTL_MS);
-		}
-	}
-	const actionableHint = attempted > 0 && refreshed === 0 && lastError !== null ? `OAuth refresh failed for provider '${provider}'. Run \`cleo login ${provider}\` to re-authenticate.` : null;
-	return {
-		attempted,
-		refreshed,
-		lastError,
-		actionableHint
-	};
-}
-/**
-* Pool manager that wraps the credential store for a single provider.
-*
-* Responsibilities:
-*   - Pick a non-cooldown credential using one of three rotation strategies.
-*   - Persist `lastStatus`, `lastErrorCode`, `lastErrorResetAt`, and
-*     `requestCount` back to the store via `addCredential` upsert on every
-*     state change.
-*   - Maintain an in-memory round-robin cursor (per instance) for `round_robin`
-*     strategy calls.
-*
-* Instantiate one `CredentialPool` per provider. The pool is stateless beyond
-* the RR cursor — all durable state lives in the credential store file.
-*
-* @example
-* ```ts
-* const pool = new CredentialPool('anthropic');
-* const { credential } = await pool.pick({ strategy: 'round_robin' });
-* try {
-*   await callApi(credential.accessToken);
-*   await pool.markOk(credential.label);
-* } catch (err) {
-*   await pool.markExhausted(credential.label, err.status ?? 500);
-* }
-* ```
-*
-* @task T9265
-*/
-var CredentialPool = class {
-	provider;
-	/**
-	* In-memory round-robin cursor keyed on provider (one entry per instance
-	* since each instance is scoped to one provider). Reset to 0 on construction.
-	*/
-	rrCursor = 0;
-	/**
-	* @param provider - The LLM transport this pool manages.
-	*/
-	constructor(provider) {
-		this.provider = provider;
-	}
-	/**
-	* Pick a non-cooldown credential for the provider using the requested
-	* rotation strategy.
-	*
-	* Side-effect: increments `requestCount` on the picked entry and persists
-	* the change via `addCredential` upsert.
-	*
-	* @param opts - Optional pick options (strategy). Defaults to `fill_first`.
-	* @returns The selected credential plus pool metadata.
-	* @throws {PoolExhaustedError} When all entries are in active cooldown.
-	*
-	* @task T9265
-	*/
-	async pick(opts) {
-		const nonDisabled = (await listCredentials(this.provider)).filter((c) => !c.disabled);
-		const eligible = [];
-		for (const entry of nonDisabled) if (await rateLimitRemaining(this.provider, entry.label) == null) eligible.push(entry);
-		const poolSize = nonDisabled.length;
-		if (nonDisabled.length === 0) throw new PoolExhaustedError(this.provider, 0, 0);
-		if (eligible.length === 0) {
-			const minResetAt = nonDisabled.map((c) => c.lastErrorResetAt ?? 0).reduce((min, t) => t > 0 && (min === 0 || t < min) ? t : min, 0);
-			throw new PoolExhaustedError(this.provider, poolSize, minResetAt);
-		}
-		const strategy = opts?.strategy ?? "fill_first";
-		let picked;
-		switch (strategy) {
-			case "fill_first":
-				picked = this._pickFillFirst(eligible);
-				break;
-			case "round_robin":
-				picked = this._pickRoundRobin(eligible);
-				break;
-			case "least_used":
-				picked = this._pickLeastUsed(eligible);
-				break;
-		}
-		if (!picked) {
-			const minResetAt = eligible.map((c) => c.lastErrorResetAt ?? 0).reduce((min, t) => t > 0 && (min === 0 || t < min) ? t : min, 0);
-			throw new PoolExhaustedError(this.provider, poolSize, minResetAt);
-		}
-		return {
-			credential: await addCredential({
-				...picked,
-				requestCount: (picked.requestCount ?? 0) + 1
-			}),
-			poolSize
-		};
-	}
-	/**
-	* Mark a credential as exhausted, applying a cooldown based on the HTTP
-	* error code. Persists `lastStatus`, `lastErrorCode`, and `lastErrorResetAt`
-	* to the store.
-	*
-	* Cooldown durations:
-	*   - 401 (auth)        → 5 minutes
-	*   - 402 (billing)     → 5 minutes
-	*   - 429 (rate-limit)  → 1 hour
-	*   - 5xx / other       → 60 seconds
-	*
-	* @param label     - Credential label (unique within provider).
-	* @param errorCode - HTTP status code that triggered the exhaustion.
-	*
-	* @task T9265
-	*/
-	async markExhausted(label, errorCode) {
-		const existing = await getCredentialByLabel(this.provider, label);
-		if (!existing) return;
-		const resetAt = Date.now() + cooldownMs(errorCode);
-		await addCredential({
-			...existing,
-			lastStatus: "exhausted",
-			lastErrorCode: errorCode,
-			lastErrorResetAt: resetAt
-		});
-	}
-	/**
-	* Mark a credential as healthy. Clears `lastStatus`, `lastErrorCode`, and
-	* `lastErrorResetAt` so the entry re-enters the eligible pool immediately.
-	*
-	* @param label - Credential label (unique within provider).
-	*
-	* @task T9265
-	*/
-	async markOk(label) {
-		const existing = await getCredentialByLabel(this.provider, label);
-		if (!existing) return;
-		await addCredential({
-			...existing,
-			lastStatus: "ok",
-			lastErrorCode: void 0,
-			lastErrorResetAt: void 0
-		});
-	}
-	/**
-	* Proactively refresh an OAuth credential before it expires.
-	*
-	* Refresh is triggered when the remaining lifetime is less than
-	* `max(expiresIn * 0.5, 300_000ms)`. For a credential without a known
-	* `expiresIn`, only the 300s floor applies (requires `expiresAt`).
-	*
-	* For `api_key` and `aws_sdk` credentials this is a no-op.
-	*
-	* Supported refresh providers:
-	* - `kimi-code` — posts to `auth.kimi.com/api/oauth/token` with
-	*   `grant_type=refresh_token` and the stored `refreshToken`.
-	*
-	* On success, the new access token (and optional refreshed refresh token)
-	* are persisted via `addCredential` upsert.
-	*
-	* @param label - Credential label (unique within provider).
-	* @returns `true` when a refresh was attempted (regardless of success),
-	*   `false` when no refresh was needed or the credential is not OAuth.
-	* @task T9323
-	*/
-	async proactiveRefresh(label) {
-		const existing = await getCredentialByLabel(this.provider, label);
-		if (!existing) return false;
-		if (existing.authType !== "oauth") return false;
-		if (!existing.refreshToken) return false;
-		if (existing.expiresAt == null) return false;
-		if (existing.expiresAt - Date.now() >= PROACTIVE_REFRESH_FLOOR_MS) return false;
-		await this._refreshOAuthCredential(existing);
-		return true;
-	}
-	/**
-	* Refresh every expired-but-refreshable OAuth credential for this provider
-	* before a selection pass, so the role resolver renews a stale token instead
-	* of silently filtering it out (which previously demoted resolution to a
-	* lower-priority — or fake — credential).
-	*
-	* For each stored OAuth entry that is expired (or within the proactive-refresh
-	* floor) AND carries a `refreshToken`, attempts a refresh via
-	* {@link proactiveRefresh}. Entries without a refresh token, non-OAuth
-	* entries, and still-valid tokens are left untouched. Errors are swallowed
-	* per-entry — a failed refresh leaves the entry expired and the normal
-	* eligible-filter still drops it.
-	*
-	* @returns The number of entries for which a refresh was attempted.
-	* @task T11617
-	*/
-	async refreshExpiredOAuth() {
-		const entries = await this.listEntries();
-		let attempted = 0;
-		for (const entry of entries) {
-			if (entry.authType !== "oauth") continue;
-			if (!entry.refreshToken) continue;
-			try {
-				if (await this.proactiveRefresh(entry.label)) attempted += 1;
-			} catch {}
-		}
-		return attempted;
-	}
-	/**
-	* List all entries for the provider sorted by priority descending
-	* (highest priority = index 0).
-	*
-	* Includes both healthy and cooled-down entries — callers can inspect
-	* `lastErrorResetAt` to determine cooldown state.
-	*
-	* @returns Immutable sorted array of all stored credentials for this provider.
-	*
-	* @task T9265
-	*/
-	async listEntries() {
-		return sortByPriorityDesc(await listCredentials(this.provider));
-	}
-	/**
-	* Perform the actual token refresh for a known OAuth credential.
-	*
-	* Dispatches based on `profile.oauth.mode`:
-	* - `pkce` — uses `refreshPkceToken` (RFC 6749 §6 refresh via PKCE endpoint).
-	* - `device-code` — uses the device-code token URL + clientId.
-	* - No profile / unknown mode → no-op (caller's 401-retry handles it).
-	*
-	* Errors are silently swallowed — the caller's retry path will encounter a
-	* 401 and trigger credential rotation if the token has actually expired.
-	*
-	* @param existing - The credential entry to refresh.
-	* @task T9302 (generic PKCE dispatch, replaces anthropic-specific branch)
-	* @task T9323 (device-code path)
-	*/
-	async _refreshOAuthCredential(existing) {
-		if (!existing.refreshToken) return;
-		const oauthCfg = (await getProviderProfile(this.provider))?.oauth;
-		if (oauthCfg?.mode === "pkce") await this._refreshViaPkce(existing, oauthCfg.tokenEndpoint, oauthCfg.clientId, oauthCfg.tokenBodyFormat);
-		else if (this.provider === "kimi-code") {
-			const cfg = getKimiCodeDeviceCodeConfig();
-			await this._refreshTokenViaEndpoint(existing, cfg.tokenUrl, cfg.clientId);
-		}
-	}
-	/**
-	* Refresh via RFC 7636 PKCE `refresh_token` grant using `refreshPkceToken`.
-	*
-	* On success, upserts the new access token (and optional refresh token)
-	* into the credential store. Errors are silently swallowed.
-	*
-	* @param existing      - Credential entry to refresh.
-	* @param tokenEndpoint - Provider token endpoint URL.
-	* @param clientId      - OAuth client ID.
-	* @param bodyFormat    - Token request body encoding (`'json'` for Anthropic).
-	* @task T9302
-	* @task T11958
-	*/
-	async _refreshViaPkce(existing, tokenEndpoint, clientId, bodyFormat) {
-		if (!existing.refreshToken) return;
-		let tokens;
-		try {
-			tokens = await refreshPkceToken({
-				provider: existing.provider,
-				clientId,
-				refreshToken: existing.refreshToken,
-				tokenEndpoint,
-				bodyFormat
-			});
-		} catch {
-			return;
-		}
-		await addCredential({
-			...existing,
-			accessToken: tokens.accessToken,
-			refreshToken: tokens.refreshToken ?? existing.refreshToken,
-			expiresAt: tokens.expiresIn != null ? Date.now() + tokens.expiresIn * 1e3 : existing.expiresAt,
-			lastStatus: "ok",
-			lastErrorCode: void 0,
-			lastErrorResetAt: void 0
-		});
-	}
-	/**
-	* Shared OAuth `refresh_token` grant implementation.
-	*
-	* POSTs `grant_type=refresh_token` to `tokenUrl` with the credential's
-	* stored refresh token. On success, upserts the new access token (and
-	* updated refresh token if provided) into the credential store.
-	*
-	* @param existing      - Credential entry to refresh.
-	* @param tokenUrl      - Provider's token endpoint.
-	* @param clientId      - OAuth client ID.
-	* @param extraHeaders  - Optional provider-specific headers (e.g. Anthropic beta flags).
-	* @task T9323
-	*/
-	async _refreshTokenViaEndpoint(existing, tokenUrl, clientId, extraHeaders) {
-		if (!existing.refreshToken) return;
-		let resp;
-		try {
-			resp = await fetch(tokenUrl, {
-				method: "POST",
-				headers: {
-					"Content-Type": "application/x-www-form-urlencoded",
-					Accept: "application/json",
-					...extraHeaders
-				},
-				body: new URLSearchParams({
-					grant_type: "refresh_token",
-					client_id: clientId,
-					refresh_token: existing.refreshToken
-				}).toString()
-			});
-		} catch {
-			return;
-		}
-		if (!resp.ok) return;
-		let data;
-		try {
-			data = await resp.json();
-		} catch {
-			return;
-		}
-		const newAccessToken = typeof data["access_token"] === "string" ? data["access_token"] : null;
-		if (!newAccessToken) return;
-		const newExpiresIn = typeof data["expires_in"] === "number" ? data["expires_in"] : null;
-		const newRefreshToken = typeof data["refresh_token"] === "string" ? data["refresh_token"] : existing.refreshToken;
-		await addCredential({
-			...existing,
-			accessToken: newAccessToken,
-			refreshToken: newRefreshToken,
-			expiresAt: newExpiresIn != null ? Date.now() + newExpiresIn * 1e3 : existing.expiresAt,
-			lastStatus: "ok",
-			lastErrorCode: void 0,
-			lastErrorResetAt: void 0
-		});
-	}
-	/**
-	* Fill-first: return the highest-priority entry not in cooldown.
-	*
-	* Entries are sorted descending by `priority` (store convention: higher
-	* numeric priority = more preferred in pool). The first healthy entry wins.
-	*
-	* @param eligible - Non-disabled entries for the provider.
-	* @returns The selected entry, or `undefined` if all are in cooldown.
-	*
-	* @task T9265
-	*/
-	_pickFillFirst(eligible) {
-		return sortByPriorityDesc(eligible).find((c) => !isInCooldown(c));
-	}
-	/**
-	* Round-robin: advance the cursor across the priority-sorted list, skipping
-	* cooled-down entries.
-	*
-	* The cursor is maintained in-memory per `CredentialPool` instance. It
-	* advances even when an entry is skipped so a single cooled-down entry does
-	* not permanently displace the rotation.
-	*
-	* @param eligible - Non-disabled entries for the provider.
-	* @returns The selected entry, or `undefined` if all are in cooldown.
-	*
-	* @task T9265
-	*/
-	_pickRoundRobin(eligible) {
-		const sorted = sortByPriorityDesc(eligible);
-		const n = sorted.length;
-		for (let i = 0; i < n; i++) {
-			const idx = this.rrCursor % n;
-			this.rrCursor = idx + 1;
-			const candidate = sorted[idx];
-			if (candidate && !isInCooldown(candidate)) return candidate;
-		}
-	}
-	/**
-	* Least-used: pick the entry with the lowest `requestCount` that is not in
-	* cooldown. Ties are broken by `priority` descending (higher priority wins).
-	*
-	* @param eligible - Non-disabled entries for the provider.
-	* @returns The selected entry, or `undefined` if all are in cooldown.
-	*
-	* @task T9265
-	*/
-	_pickLeastUsed(eligible) {
-		const healthy = eligible.filter((c) => !isInCooldown(c));
-		if (healthy.length === 0) return void 0;
-		return healthy.sort((a, b) => {
-			const countDiff = (a.requestCount ?? 0) - (b.requestCount ?? 0);
-			if (countDiff !== 0) return countDiff;
-			return b.priority - a.priority;
-		})[0];
-	}
-};
-/**
-* Seed-attempt cache TTL — 60 seconds per E2a §5.2 T-E2-5 acceptance criterion.
-*
-* After a successful (non-`force`) seed pass, repeat calls to `seed()` are
-* short-circuited until this TTL elapses. `force: true` always bypasses the
-* cache. `lazy-seed` from `pick()` also honours the cache.
-*
-* @task T9412
-*/
-var POOL_SEED_CACHE_TTL_MS = 60 * 1e3;
-/**
-* Process-wide debug log channel — kept minimal so the pool does not pull in
-* the broader `cleo log` plumbing. Mirrors the pattern used by the per-provider
-* pool above.
-*
-* Reads `process.env.CLEO_DEBUG` at call time so tests can toggle without
-* module reload. Output goes to `console.debug` so it shows under `--verbose`
-* but stays out of clean CLI output by default.
-*
-* @internal
-*/
-function debugLog(msg, ...rest) {
-	if (process.env["CLEO_DEBUG"]) console.debug(`[cleo:credential-pool] ${msg}`, ...rest);
-}
-/**
-* Unified credential pool — drives every registered seeder, upserts the
-* discovered entries, and exposes `pick`/`list` over the populated store.
-*
-* Lifecycle:
-*
-*   1. First `pick()` (or explicit `seed()`) walks `BUILTIN_SEEDERS`.
-*   2. For each seeder: consent gate → suppression gate → `seed()` →
-*      upsert each returned entry via `addCredential` (preserves the
-*      seeder's `priority` hint when provided, otherwise the store's
-*      `max + 10` rule applies).
-*   3. A successful sweep stamps the cache; subsequent calls within
-*      {@link POOL_SEED_CACHE_TTL_MS} short-circuit unless `force: true`.
-*   4. `list()` reads the store directly — never triggers seeding so
-*      diagnostic surfaces (`cleo auth list`) are pure-read.
-*
-* Error isolation: a single seeder that throws does NOT short-circuit the
-* sweep. The failure is counted, the error stashed in `getSeederStatus`,
-* and the next seeder runs.
-*
-* @example
-* ```ts
-* const pool = getCredentialPool();
-* const entry = await pool.pick('anthropic');
-* if (entry) {
-*   // use entry.accessToken
-* }
-* ```
-*
-* @task T9412
-*/
-var UnifiedCredentialPool = class {
-	registryGetter;
-	/** Epoch ms of last successful seed pass (`0` = never seeded). */
-	lastSeededAt = 0;
-	/** Per-seeder diagnostics keyed on `${sourceId}::${provider}`. */
-	seederStatus = /* @__PURE__ */ new Map();
-	/**
-	* Construct a pool wired to a specific seeder registry.
-	*
-	* Production code uses the {@link getCredentialPool} singleton which wires
-	* to `BUILTIN_SEEDERS`. Tests pass a fresh `SeederRegistry` to isolate
-	* registration semantics from the process-wide singleton.
-	*
-	* @param registryGetter - Getter that returns the active list of seeders.
-	*   Defaults to `BUILTIN_SEEDERS.getAll()`. A getter (not the array
-	*   directly) is used so the pool stays in sync with seeders registered
-	*   after construction.
-	*/
-	constructor(registryGetter = () => BUILTIN_SEEDERS.getAll()) {
-		this.registryGetter = registryGetter;
-	}
-	/**
-	* Walk every registered seeder, gate on consent + suppression, and upsert
-	* the returned entries into the store.
-	*
-	* Cache rules:
-	* - If `force !== true` and the last successful seed pass was less than
-	*   {@link POOL_SEED_CACHE_TTL_MS} ago, the sweep is skipped entirely
-	*   and `{ added: 0, failed: 0, skipped: <total-seeders> }` is returned.
-	* - `force: true` always re-runs every seeder.
-	*
-	* Per-seeder rules:
-	* - `isConsentEstablished?` returning `false` → skip (status:
-	*   `'skipped-consent'`).
-	* - `isSuppressed(provider, sourceId)` returning `true` → skip (status:
-	*   `'skipped-suppressed'`).
-	* - `seed()` throwing → counted as `failed`; the error is logged
-	*   and stashed in `getSeederStatus`; the next seeder still runs.
-	* - Each returned entry is upserted via `addCredential`; an upsert
-	*   failure counts the seeder as `failed`.
-	*
-	* @param options - `{ force }` — bypass the 60s cache when `true`.
-	* @returns Aggregate counts across every seeder.
-	* @task T9412
-	*/
-	async seed(options = {}) {
-		const seeders = this.registryGetter();
-		const now = Date.now();
-		if (!options.force && this.lastSeededAt > 0 && now - this.lastSeededAt < 6e4) {
-			debugLog("seed: cache hit, skipping sweep", {
-				ageMs: now - this.lastSeededAt,
-				ttlMs: POOL_SEED_CACHE_TTL_MS
-			});
-			return {
-				added: 0,
-				failed: 0,
-				skipped: seeders.length
-			};
-		}
-		let added = 0;
-		let failed = 0;
-		let skipped = 0;
-		for (const seeder of seeders) {
-			const key = `${seeder.sourceId}::${seeder.provider}`;
-			const stampedAt = Date.now();
-			if (typeof seeder.isConsentEstablished === "function") {
-				let consented;
-				try {
-					consented = await seeder.isConsentEstablished(seeder.provider);
-				} catch (err) {
-					failed++;
-					this.seederStatus.set(key, {
-						sourceId: seeder.sourceId,
-						provider: seeder.provider,
-						lastSeededAt: stampedAt,
-						lastResult: "failed",
-						error: `consent gate threw: ${err instanceof Error ? err.message : String(err)}`
-					});
-					debugLog("seed: consent gate threw", {
-						seeder: key,
-						err
-					});
-					continue;
-				}
-				if (!consented) {
-					skipped++;
-					this.seederStatus.set(key, {
-						sourceId: seeder.sourceId,
-						provider: seeder.provider,
-						lastSeededAt: stampedAt,
-						lastResult: "skipped-consent"
-					});
-					continue;
-				}
-			}
-			let suppressed;
-			try {
-				suppressed = isSuppressed(seeder.provider, seeder.sourceId);
-			} catch (err) {
-				debugLog("seed: isSuppressed threw — treating as un-suppressed", {
-					seeder: key,
-					err
-				});
-				suppressed = false;
-			}
-			if (suppressed) {
-				skipped++;
-				this.seederStatus.set(key, {
-					sourceId: seeder.sourceId,
-					provider: seeder.provider,
-					lastSeededAt: stampedAt,
-					lastResult: "skipped-suppressed"
-				});
-				continue;
-			}
-			let entries;
-			try {
-				entries = (await seeder.seed()).entries;
-			} catch (err) {
-				failed++;
-				this.seederStatus.set(key, {
-					sourceId: seeder.sourceId,
-					provider: seeder.provider,
-					lastSeededAt: stampedAt,
-					lastResult: "failed",
-					error: err instanceof Error ? err.message : String(err)
-				});
-				debugLog("seed: seeder threw", {
-					seeder: key,
-					err
-				});
-				continue;
-			}
-			let upsertFailed = false;
-			for (const entry of entries) try {
-				await addCredential(entry);
-			} catch (err) {
-				upsertFailed = true;
-				debugLog("seed: addCredential threw", {
-					seeder: key,
-					label: entry.label,
-					err
-				});
-				this.seederStatus.set(key, {
-					sourceId: seeder.sourceId,
-					provider: seeder.provider,
-					lastSeededAt: stampedAt,
-					lastResult: "failed",
-					entriesProduced: entries.length,
-					error: `addCredential threw for '${entry.label}': ${err instanceof Error ? err.message : String(err)}`
-				});
-				break;
-			}
-			if (upsertFailed) {
-				failed++;
-				continue;
-			}
-			added++;
-			this.seederStatus.set(key, {
-				sourceId: seeder.sourceId,
-				provider: seeder.provider,
-				lastSeededAt: stampedAt,
-				lastResult: "ok",
-				entriesProduced: entries.length
-			});
-		}
-		this.lastSeededAt = Date.now();
-		return {
-			added,
-			failed,
-			skipped
-		};
-	}
-	/**
-	* Pick a credential for the given provider, lazy-seeding on first call.
-	*
-	* Behaviour:
-	* - First call (or after `resetForTests()`) triggers a `seed()` pass.
-	* - Subsequent calls within {@link POOL_SEED_CACHE_TTL_MS} skip seeding.
-	* - The actual pick delegates to `pickCredentialForProviderSync` so the
-	*   strategy + label-preference semantics match the rest of the store.
-	*
-	* @param provider - LLM transport to pick for.
-	* @param options - Optional strategy / label / no-seed flag.
-	* @returns The selected `StoredCredential`, or `null` when the pool is
-	*   empty (or every entry has expired / been disabled).
-	* @task T9412
-	*/
-	async pick(provider, options = {}) {
-		if (!options.noSeed) await this.seed();
-		return pickCredentialForProviderSync(provider, {
-			...options.strategy != null && { strategy: options.strategy },
-			...options.preferLabel != null && { preferLabel: options.preferLabel }
-		});
-	}
-	/**
-	* List every entry currently in the credential store.
-	*
-	* Pure read — never triggers seeding. Intended for diagnostic surfaces
-	* (`cleo auth list`, `cleo status`) where calling `seed()` would be
-	* surprising side-effect.
-	*
-	* @returns Read-only snapshot sorted by file order (insertion).
-	* @task T9412
-	*/
-	async list() {
-		return listCredentials();
-	}
-	/**
-	* Snapshot of the last-known outcome of every registered seeder.
-	*
-	* Seeders that have never been invoked do not appear in the snapshot.
-	*
-	* @returns Read-only array of {@link SeederStatus} entries.
-	* @task T9412
-	*/
-	getSeederStatus() {
-		return Array.from(this.seederStatus.values());
-	}
-	/**
-	* Test-only: invalidate the seed cache and clear status snapshots.
-	*
-	* Production code MUST NOT call this — it bypasses the 60s rate-limit
-	* that exists specifically to prevent runaway seeding under tight retry
-	* loops. The export is prefixed `_` to match the convention used by
-	* `credentials-store.ts` for analogous helpers (`_resetRoundRobinForTests`).
-	*
-	* @internal
-	*/
-	_resetForTests() {
-		this.lastSeededAt = 0;
-		this.seederStatus.clear();
-	}
-};
-/**
-* Module-state singleton — `null` until the first {@link getCredentialPool}
-* call constructs the instance. Lazy construction keeps test runners that
-* import the module without ever calling `getCredentialPool` from paying the
-* seeder-registration cost.
-*
-* @internal
-*/
-var _singleton = null;
-/**
-* Return the process-wide {@link UnifiedCredentialPool} singleton.
-*
-* Re-imports of this module yield the same instance under Node ESM's module
-* cache. Tests that need an isolated pool MUST construct one directly
-* (`new UnifiedCredentialPool(...)`) rather than mutating this singleton.
-*
-* @returns The shared pool instance.
-* @task T9412
-*/
-function getCredentialPool() {
-	if (_singleton === null) _singleton = new UnifiedCredentialPool();
-	return _singleton;
-}
-
-export { BUILTIN_SEEDERS as B, CredentialPool as C, ENV_VARS as E, PoolExhaustedError as P, REMOVAL_REGISTRY as R, authHeadersFromSealed as a, getCredentialPool as b, addCredential as c, addSuppression as d, removeCredential as e, refreshExpiredOAuthForProvider as f, getProviderProfile as g, pickCredentialForProviderSync as h, getCredentialByLabel as i, recordRateLimit as j, rateLimitRemaining as k, listCredentials as l, getKimiCodeMshHeaders as m, isKimiCodeApiKey as n, pickCredentialForProvider as p, resolveCredentials as r };
-//# sourceMappingURL=credential-pool-vF6NdtT9.js.map