@event4u/agent-config 14.8.0 → 14.9.0

package/dist/scripts/_lib/claude_plugin.js

@@ -0,0 +1,162 @@
+/**
+ * Claude Code plugin detection helpers — shared by `cmd_upgrade`,
+ * `cmd_doctor`, and the installer.
+ *
+ * Claude Code loads the FULL top-level command set (`/implement-ticket`,
+ * `/work`, `/review-changes`, …) from the installed plugin
+ * (`agent-config@event4u-agent-config`), NOT from the `~/.claude/commands/`
+ * file projection. A file-only install therefore silently misses top-level
+ * commands while namespaced subcommands (`/fix:pr-comments`, …) keep working
+ * — and an installed plugin stays pinned to its install-time git SHA until
+ * `claude plugin update` runs. These helpers detect both states so
+ * upgrade / doctor / install can refresh the plugin or surface the gap.
+ */
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import process from 'node:process';
+export const CLAUDE_PLUGIN_ID = 'agent-config';
+export const CLAUDE_MARKETPLACE_NAME = 'event4u-agent-config';
+export const CLAUDE_MARKETPLACE_REPO = 'event4u-app/agent-config';
+/** The one-time install commands surfaced when the plugin is missing. */
+export const CLAUDE_PLUGIN_INSTALL_HINT = [
+    `claude plugin marketplace add ${CLAUDE_MARKETPLACE_REPO}`,
+    `claude plugin install ${CLAUDE_PLUGIN_ID}@${CLAUDE_MARKETPLACE_NAME}`,
+];
+/**
+ * Official OpenAI codex plugin for Claude Code (team mode's Claude-Code
+ * transport). Marketplace name verified against the upstream repo's
+ * `.claude-plugin/marketplace.json` (`name: "openai-codex"`, plugin
+ * `name: "codex"`) at HEAD 2026-07-12.
+ */
+export const CODEX_PLUGIN_ID = 'codex';
+export const CODEX_MARKETPLACE_NAME = 'openai-codex';
+export const CODEX_MARKETPLACE_REPO = 'openai/codex-plugin-cc';
+/** The one-time install commands surfaced when the codex plugin is missing. */
+export const CODEX_PLUGIN_INSTALL_HINT = [
+    `claude plugin marketplace add ${CODEX_MARKETPLACE_REPO}`,
+    `claude plugin install ${CODEX_PLUGIN_ID}@${CODEX_MARKETPLACE_NAME}`,
+];
+/** Claude Code config dir — `CLAUDE_CONFIG_DIR` env override, else `~/.claude`. */
+export function claude_config_dir() {
+    const env = (process.env['CLAUDE_CONFIG_DIR'] ?? '').trim();
+    return env !== '' ? env : path.join(os.homedir(), '.claude');
+}
+/**
+ * True when a plugin with the given id is recorded in Claude Code's
+ * `plugins/installed_plugins.json` (any marketplace — matched by the
+ * `<id>@` key prefix). Unreadable / absent file → false. Read-only.
+ */
+function _plugin_id_recorded(plugin_id) {
+    const p = path.join(claude_config_dir(), 'plugins', 'installed_plugins.json');
+    let data;
+    try {
+        data = JSON.parse(fs.readFileSync(p, 'utf-8'));
+    }
+    catch {
+        return false;
+    }
+    if (data === null || typeof data !== 'object')
+        return false;
+    const plugins = data.plugins;
+    if (plugins === null || plugins === undefined || typeof plugins !== 'object')
+        return false;
+    return Object.keys(plugins).some((k) => k.startsWith(`${plugin_id}@`));
+}
+/**
+ * True when the agent-config plugin is recorded in Claude Code's
+ * `plugins/installed_plugins.json` (any marketplace — matched by the
+ * `agent-config@` id prefix). Unreadable / absent file → false.
+ */
+export function claude_plugin_installed() {
+    return _plugin_id_recorded(CLAUDE_PLUGIN_ID);
+}
+/** Marketplace names (the `@<marketplace>` suffix) a plugin id is installed from. */
+function _plugin_marketplaces(plugin_id) {
+    const p = path.join(claude_config_dir(), 'plugins', 'installed_plugins.json');
+    let data;
+    try {
+        data = JSON.parse(fs.readFileSync(p, 'utf-8'));
+    }
+    catch {
+        return [];
+    }
+    if (data === null || typeof data !== 'object')
+        return [];
+    const plugins = data.plugins;
+    if (plugins === null || plugins === undefined || typeof plugins !== 'object')
+        return [];
+    const prefix = `${plugin_id}@`;
+    return Object.keys(plugins)
+        .filter((k) => k.startsWith(prefix))
+        .map((k) => k.slice(prefix.length));
+}
+/** `source.repo` recorded for a marketplace in `known_marketplaces.json`, or null. */
+function _marketplace_source_repo(marketplace) {
+    const p = path.join(claude_config_dir(), 'plugins', 'known_marketplaces.json');
+    let data;
+    try {
+        data = JSON.parse(fs.readFileSync(p, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+    if (data === null || typeof data !== 'object')
+        return null;
+    const entry = data[marketplace];
+    if (entry === null || entry === undefined || typeof entry !== 'object')
+        return null;
+    const source = entry.source;
+    if (source === null || source === undefined || typeof source !== 'object')
+        return null;
+    const repo = source.repo;
+    return typeof repo === 'string' && repo.trim() !== '' ? repo.trim() : null;
+}
+/**
+ * Presence + identity of the official OpenAI codex plugin. Read-only:
+ * detection never writes under `~/.claude/`. See `CodexPluginIdentity`
+ * for the verification contract.
+ */
+export function codex_plugin_identity() {
+    const marketplaces = _plugin_marketplaces(CODEX_PLUGIN_ID);
+    if (marketplaces.length === 0) {
+        return { installed: false, identity_verified: false };
+    }
+    const want = CODEX_MARKETPLACE_REPO.toLowerCase();
+    const identity_verified = marketplaces.some((m) => (_marketplace_source_repo(m) ?? '').toLowerCase() === want);
+    return { installed: true, identity_verified };
+}
+/**
+ * True when the official OpenAI codex plugin is recorded in Claude Code's
+ * `plugins/installed_plugins.json` (any marketplace — matched by the
+ * `codex@` id prefix). Unreadable / absent file → false. Read-only:
+ * detection never writes under `~/.claude/`. Presence only — for
+ * namespace-resistant identity use `codex_plugin_identity()`.
+ */
+export function codex_plugin_installed() {
+    return codex_plugin_identity().installed;
+}
+/**
+ * Version recorded in the installed marketplace snapshot's
+ * `.claude-plugin/marketplace.json` (`metadata.version` — bumped per
+ * release, so it tracks the package version the snapshot was taken from).
+ * Null when the snapshot is absent or unreadable.
+ */
+export function claude_plugin_snapshot_version() {
+    const p = path.join(claude_config_dir(), 'plugins', 'marketplaces', CLAUDE_MARKETPLACE_NAME, '.claude-plugin', 'marketplace.json');
+    let data;
+    try {
+        data = JSON.parse(fs.readFileSync(p, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+    if (data === null || typeof data !== 'object')
+        return null;
+    const metadata = data.metadata;
+    if (metadata === null || metadata === undefined || typeof metadata !== 'object')
+        return null;
+    const v = metadata.version;
+    return typeof v === 'string' && v.trim() !== '' ? v.trim() : null;
+}
+//# sourceMappingURL=claude_plugin.js.map

package/dist/scripts/_lib/claude_plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude_plugin.js","sourceRoot":"","sources":["../../../src/scripts/_lib/claude_plugin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAC/C,MAAM,CAAC,MAAM,uBAAuB,GAAG,sBAAsB,CAAC;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,0BAA0B,CAAC;AAElE,yEAAyE;AACzE,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IACzD,iCAAiC,uBAAuB,EAAE;IAC1D,yBAAyB,gBAAgB,IAAI,uBAAuB,EAAE;CACzE,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AACvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,cAAc,CAAC;AACrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IACxD,iCAAiC,sBAAsB,EAAE;IACzD,yBAAyB,eAAe,IAAI,sBAAsB,EAAE;CACvE,CAAC;AAEF,mFAAmF;AACnF,MAAM,UAAU,iBAAiB;IAC7B,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,OAAO,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,SAAiB;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAC9E,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5D,MAAM,OAAO,GAAI,IAA8B,CAAC,OAAO,CAAC;IACxD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3F,OAAO,MAAM,CAAC,IAAI,CAAC,OAAkC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9D,CAAC,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,CAChC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACnC,OAAO,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;AACjD,CAAC;AAuBD,qFAAqF;AACrF,SAAS,oBAAoB,CAAC,SAAiB;IAC3C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,wBAAwB,CAAC,CAAC;IAC9E,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzD,MAAM,OAAO,GAAI,IAA8B,CAAC,OAAO,CAAC;IACxD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACxF,MAAM,MAAM,GAAG,GAAG,SAAS,GAAG,CAAC;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,OAAkC,CAAC;SACjD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,sFAAsF;AACtF,SAAS,wBAAwB,CAAC,WAAmB;IACjD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAC/E,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,KAAK,GAAI,IAAgC,CAAC,WAAW,CAAC,CAAC;IAC7D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpF,MAAM,MAAM,GAAI,KAA8B,CAAC,MAAM,CAAC;IACtD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvF,MAAM,IAAI,GAAI,MAA6B,CAAC,IAAI,CAAC;IACjD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACjC,MAAM,YAAY,GAAG,oBAAoB,CAAC,eAAe,CAAC,CAAC;IAC3D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC;IAC1D,CAAC;IACD,MAAM,IAAI,GAAG,sBAAsB,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,iBAAiB,GAAG,YAAY,CAAC,IAAI,CACvC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CACpE,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB;IAClC,OAAO,qBAAqB,EAAE,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CACf,iBAAiB,EAAE,EACnB,SAAS,EACT,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,CACrB,CAAC;IACF,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,QAAQ,GAAI,IAA+B,CAAC,QAAQ,CAAC;IAC3D,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7F,MAAM,CAAC,GAAI,QAAkC,CAAC,OAAO,CAAC;IACtD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC"}

package/dist/scripts/_lib/environment_detector.js

@@ -0,0 +1,397 @@
+/**
+ * Read-only environment detection — one report, no spend (Phase 1 of
+ * `road-to-zero-ceremony-detection`).
+ *
+ * Answers "what does this machine already have?" in a single pass so the
+ * `doctor` surface and the council's transport resolution read the SAME
+ * facts instead of each probing on its own. Three record kinds:
+ *
+ * - `hosts` — which AI hosts are installed, their resolved binary, version.
+ * - `auth`  — which provider credentials are PRESENT, and of which source.
+ * - `keys`  — the `api_key_ref`-shaped reference for each present key.
+ *
+ * ## Guarantees
+ *
+ * - **Zero network.** Nothing here opens a socket. Enforced by the static
+ *   import check in the test suite, not by convention.
+ * - **Zero spend.** The only subprocess is `<binary> --version`, which no
+ *   provider bills. No completion, no token, ever — the roadmap's
+ *   install-time-completion item was cut for exactly this reason.
+ * - **Presence, never validity.** An `auth` record says "a credential of this
+ *   shape exists at this path". It does NOT say the credential works, is
+ *   unexpired, or is accepted by the provider. Runtime auth failure stays
+ *   authoritative (`CliClient._AUTH_FAILURE_PATTERNS`).
+ * - **Read-only.** Reads the filesystem and the injected env map; writes
+ *   nothing, creates no directory.
+ *
+ * ## No third probe shape — what each field absorbs
+ *
+ * Auth probing already existed in two shapes before this module and a third
+ * must not appear. This module composes; it re-implements nothing:
+ *
+ * | Field | Absorbed from |
+ * |---|---|
+ * | `hosts[].installed` | `install/toolDetection.ts::detectInstalledTools` (the 23-host signal table) |
+ * | `hosts[].binary` | `install/toolDetection.ts::resolveToolBinary` (same table, path-returning) |
+ * | `hosts[].version` | `install/agentSwitchDetection.ts::parseVersionOutput` (the first-dotted-number parser) |
+ * | `auth` (`openai`, `cli-*`) | `_cli/cmd_doctor.ts`'s read-only `$CODEX_HOME/auth.json` probe — `codexHome()` moved HERE and imported back, so there is one definition |
+ * | `auth` (`anthropic`, `cli-subscription`) | `_lib/claude_plugin.ts::claude_config_dir` (`CLAUDE_CONFIG_DIR` override incl.) |
+ * | `auth` (`key-file`) | `_lib/user_global_paths.ts::resolve_with_fallback` (new namespace, legacy read-fallback) |
+ *
+ * The council's TTL'd `AuthCache` (`ai_council/solo_dispatch.ts`) is the third
+ * existing shape and is deliberately NOT absorbed: it caches a *liveness*
+ * verdict from an injected probe that may spend a call. This module only
+ * reports presence, so it needs no TTL — a per-process memo is enough.
+ *
+ * ## Known limitation — CLI logins the filesystem does not reveal
+ *
+ * A vendor CLI that stores its subscription credential OUTSIDE the filesystem
+ * is undetectable here. Measured case: on macOS the `claude` CLI keeps its
+ * OAuth credential in the system Keychain, so `~/.claude/.credentials.json`
+ * is absent even for a logged-in Claude Pro user. The detector reports
+ * `cli-subscription` only where a credential FILE exists (Linux, and the
+ * `CLAUDE_CONFIG_DIR` profile layouts).
+ *
+ * Consequence, stated because it costs money: with no detectable CLI login,
+ * `mode: auto` skips the cli rung and resolves to `api` — metered — for a user
+ * who does hold a subscription. This is a FALSE NEGATIVE, which is the
+ * direction this module is built to fail in (a false positive would claim a
+ * subscription that is not there and switch the USD gate off). The remedy is an
+ * explicit `mode: cli` on the member; `doctor` shows the detected source so the
+ * gap is visible rather than silent. Reading the Keychain would require a
+ * `security(1)` subprocess against a credential store — a spend-free but
+ * privacy-relevant probe, and out of scope here.
+ *
+ * @see docs/contracts/ai-council-config.md § Transport modes — the billing rules
+ *      `classifyBilling` implements.
+ */
+import { spawnSync } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { detectInstalledTools, knownToolIds, resolveToolBinary, } from '../../install/toolDetection.js';
+import { parseVersionOutput } from '../../install/agentSwitchDetection.js';
+import { claude_config_dir } from './claude_plugin.js';
+import { hardenedSpawnEnv } from './spawn_env.js';
+import { resolve_with_fallback } from './user_global_paths.js';
+/**
+ * Provider → (default CLI binary, community-wrapper flag).
+ *
+ * Mirrors the `CliClient` subclass attributes without importing the client
+ * layer. The boolean is the load-bearing billing input: a VENDOR-OFFICIAL CLI
+ * (`false`) runs under the user's subscription; a COMMUNITY wrapper (`true`)
+ * shells out to the same paid API and stays metered. Canonical here so
+ * `cmd_doctor` and this module cannot drift.
+ */
+export const PROVIDER_CLI_META = {
+    anthropic: ['claude', false],
+    openai: ['codex', false],
+    gemini: ['gemini', false],
+    xai: ['grok', true],
+    perplexity: ['perplexity', true],
+};
+/** Provider → environment variable carrying a raw API key. */
+const PROVIDER_ENV_KEY = {
+    anthropic: 'ANTHROPIC_API_KEY',
+    openai: 'OPENAI_API_KEY',
+    gemini: 'GEMINI_API_KEY',
+    xai: 'XAI_API_KEY',
+    perplexity: 'PERPLEXITY_API_KEY',
+};
+/** Provider → key-file name under the user-global root (`file:` ref target). */
+const PROVIDER_KEY_FILE = {
+    anthropic: 'anthropic.key',
+    openai: 'openai.key',
+    gemini: 'gemini.key',
+    xai: 'xai.key',
+    perplexity: 'perplexity.key',
+};
+/** Providers this module knows how to classify, in a stable order. */
+export function knownProviders() {
+    return Object.keys(PROVIDER_CLI_META);
+}
+/** True when `provider`'s CLI is a community wrapper around the paid API. */
+export function isCommunityCli(provider) {
+    return PROVIDER_CLI_META[provider]?.[1] ?? false;
+}
+/**
+ * Billing class from (provider, detected auth source) — NEVER from transport.
+ *
+ * This signature is the invariant: there is no transport / mode parameter, so
+ * no caller can make billing depend on which transport was chosen. That is
+ * what keeps the per-provider rules intact when `auto` picks a transport at
+ * invocation time: a vendor-official CLI logged in under a subscription is
+ * unmetered; everything else — including a community CLI and including an
+ * unknown source — is metered, i.e. deliberately over-gated.
+ *
+ * `null` source means "nothing detected" and classifies as `per-token`: the
+ * safe direction is to keep the USD gate on.
+ */
+export function classifyBilling(provider, source) {
+    if (source !== 'cli-subscription')
+        return 'per-token';
+    if (isCommunityCli(provider))
+        return 'per-token';
+    return 'subscription';
+}
+/**
+ * Codex CLI home — `CODEX_HOME` env override (the codex CLI's own
+ * convention), else `~/.codex`. Single definition; `cmd_doctor` imports it.
+ */
+export function codexHome(env) {
+    const map = env ?? process.env;
+    const override = (map['CODEX_HOME'] ?? '').trim();
+    return override !== '' ? override : path.join(homeOf(env), '.codex');
+}
+function homeOf(env) {
+    const map = env ?? process.env;
+    const injected = (map['HOME'] ?? '').trim();
+    return injected !== '' ? injected : os.homedir();
+}
+const VERSION_PROBE_TIMEOUT_MS = 2000;
+/** Keychain service name Claude Code writes its subscription credential under. */
+export const CLAUDE_KEYCHAIN_SERVICE = 'Claude Code-credentials';
+/**
+ * Is the Claude Code subscription credential in the macOS login Keychain?
+ *
+ * Claude Code stores its OAuth credential in the Keychain on macOS and only
+ * falls back to `~/.claude/.credentials.json` elsewhere. Looking for the file
+ * alone therefore reports "no subscription" on the platform where the
+ * subscription is most likely to exist — which sent every macOS anthropic
+ * member down the metered `api` rung while a paid Claude subscription sat
+ * unused on the same machine. That is the defect this probe closes.
+ *
+ * `-w` is deliberately NOT passed: without it `security` prints attributes and
+ * never the password, so the secret cannot reach a log, a report, or a crash
+ * dump. Presence is read from the exit code alone.
+ */
+function defaultProbeKeychain(service) {
+    if (process.platform !== 'darwin')
+        return false;
+    try {
+        const res = spawnSync('security', ['find-generic-password', '-s', service], {
+            timeout: VERSION_PROBE_TIMEOUT_MS,
+            encoding: 'utf-8',
+            windowsHide: true,
+            env: hardenedSpawnEnv(),
+        });
+        if (res.error !== undefined || res.signal !== null)
+            return false;
+        return res.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * `<binary> --version` under a hardened env. Never throws — a spawn error,
+ * timeout, signal, or unparseable output all collapse to `null`, which the
+ * caller degrades to `'unknown'`.
+ *
+ * Hardened per `docs/spawn-site-policy.md` (this runs on the consumer runtime
+ * via `doctor`). Note the env scrub deliberately does NOT strip
+ * `CLAUDE_CONFIG_DIR` — see `docs/threat-model.md` row i.
+ */
+function defaultProbeVersion(binary) {
+    try {
+        const res = spawnSync(binary, ['--version'], {
+            timeout: VERSION_PROBE_TIMEOUT_MS,
+            encoding: 'utf-8',
+            windowsHide: true,
+            env: hardenedSpawnEnv(),
+        });
+        if (res.error !== undefined || res.signal !== null)
+            return null;
+        return `${res.stdout ?? ''}\n${res.stderr ?? ''}`;
+    }
+    catch {
+        return null;
+    }
+}
+function isFile(p) {
+    try {
+        return fs.statSync(p).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function exists(p) {
+    try {
+        return fs.existsSync(p);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Classify a codex `auth.json` by which credential shape it carries.
+ *
+ * OAuth tokens ⇒ the user logged in with a ChatGPT plan (`cli-subscription`);
+ * anything else ⇒ metered (`cli-api-key`). A present-but-unreadable or
+ * malformed file also reports `cli-api-key` — the over-gated direction, since
+ * assuming a plan would switch the USD gate off on no evidence.
+ */
+function classifyCodexAuth(authPath) {
+    let data;
+    try {
+        data = JSON.parse(fs.readFileSync(authPath, 'utf-8'));
+    }
+    catch {
+        // Present but unreadable: over-gate (metered) rather than assume a plan.
+        return 'cli-api-key';
+    }
+    if (typeof data !== 'object' || data === null || Array.isArray(data)) {
+        return 'cli-api-key';
+    }
+    const d = data;
+    const tokens = d['tokens'];
+    const hasOauth = typeof tokens === 'object' &&
+        tokens !== null &&
+        !Array.isArray(tokens) &&
+        Object.keys(tokens).length > 0;
+    if (hasOauth)
+        return 'cli-subscription';
+    return 'cli-api-key';
+}
+/** Provider-specific `cli-subscription` evidence path, or `null` when none applies. */
+function cliSubscriptionEvidence(provider, home, env, claudeConfigDir, probeKeychain) {
+    if (provider === 'anthropic') {
+        const configDir = claudeConfigDir;
+        for (const rel of ['.credentials.json', 'credentials.json']) {
+            const p = path.join(configDir, rel);
+            if (isFile(p))
+                return { source: 'cli-subscription', evidence: p };
+        }
+        // macOS keeps the credential in the Keychain instead of the file above.
+        // The evidence string is a locator, never the secret.
+        if (probeKeychain(CLAUDE_KEYCHAIN_SERVICE)) {
+            return { source: 'cli-subscription', evidence: `keychain:${CLAUDE_KEYCHAIN_SERVICE}` };
+        }
+        return null;
+    }
+    if (provider === 'openai') {
+        const p = path.join(codexHome(env), 'auth.json');
+        if (isFile(p))
+            return { source: classifyCodexAuth(p), evidence: p };
+        return null;
+    }
+    if (provider === 'gemini') {
+        const p = path.join(home, '.gemini', 'oauth_creds.json');
+        if (isFile(p))
+            return { source: 'cli-subscription', evidence: p };
+        return null;
+    }
+    // xai / perplexity ship no subscription login — their CLIs read an API key.
+    return null;
+}
+function detectHosts(opts) {
+    const installedMap = detectInstalledTools({
+        ...(opts.home !== undefined ? { home: opts.home } : {}),
+        pathEnv: opts.pathEnv,
+    });
+    const probe = opts.probeVersion ?? defaultProbeVersion;
+    const out = [];
+    for (const id of knownToolIds()) {
+        const binary = resolveToolBinary(id, opts.pathEnv);
+        let version = null;
+        if (binary !== null) {
+            let raw;
+            try {
+                raw = probe(binary);
+            }
+            catch {
+                raw = null;
+            }
+            // An unparseable version degrades to 'unknown' — never throws,
+            // never omits the host from the report.
+            version = raw === null ? 'unknown' : (parseVersionOutput(raw) ?? 'unknown');
+        }
+        out.push({ id, installed: installedMap[id] ?? false, binary, version });
+    }
+    return out;
+}
+function detectAuth(opts) {
+    const env = opts.env ?? process.env;
+    const home = opts.home ?? homeOf(opts.env);
+    // Delegate to claude_plugin's resolver on the live path (it owns the
+    // CLAUDE_CONFIG_DIR override); derive from the injected home otherwise.
+    const claudeConfigDir = opts.home === undefined && opts.env === undefined
+        ? claude_config_dir()
+        : ((env['CLAUDE_CONFIG_DIR'] ?? '').trim() || path.join(home, '.claude'));
+    const probeKeychain = opts.probeKeychain ?? defaultProbeKeychain;
+    const auth = [];
+    const keys = [];
+    for (const provider of knownProviders()) {
+        const cli = cliSubscriptionEvidence(provider, home, env, claudeConfigDir, probeKeychain);
+        if (cli !== null) {
+            auth.push({ provider, source: cli.source, evidence: cli.evidence });
+        }
+        const keyFile = PROVIDER_KEY_FILE[provider];
+        if (keyFile !== undefined) {
+            let resolved = null;
+            try {
+                resolved = resolve_with_fallback(keyFile, { env });
+            }
+            catch {
+                resolved = null;
+            }
+            if (resolved !== null && exists(resolved)) {
+                auth.push({ provider, source: 'key-file', evidence: resolved });
+                keys.push({ provider, ref: `file:${keyFile}` });
+            }
+        }
+        const envVar = PROVIDER_ENV_KEY[provider];
+        if (envVar !== undefined && (env[envVar] ?? '').trim() !== '') {
+            auth.push({ provider, source: 'env-key', evidence: `env:${envVar}` });
+            keys.push({ provider, ref: `env:${envVar}` });
+        }
+    }
+    return { auth, keys };
+}
+/**
+ * Strongest auth source detected for `provider`, or `null`.
+ *
+ * "Strongest" is the transport-preference order `auto` walks: a vendor CLI
+ * login beats a stored key. Pure over an already-built report.
+ */
+export function strongestAuth(report, provider) {
+    const order = [
+        'cli-subscription',
+        'cli-api-key',
+        'key-file',
+        'env-key',
+    ];
+    for (const source of order) {
+        const hit = report.auth.find((a) => a.provider === provider && a.source === source);
+        if (hit !== undefined)
+            return hit;
+    }
+    return null;
+}
+let _cached = null;
+/**
+ * Build the environment report.
+ *
+ * Cached per process for the no-argument call (the production shape) so
+ * `doctor` and transport resolution observe one consistent snapshot; any call
+ * that injects options bypasses the cache and returns a fresh read, so tests
+ * and fixture machines never poison each other. Reset with
+ * `resetEnvironmentCache()`.
+ */
+export function detectEnvironment(opts = {}) {
+    const isDefaultCall = Object.keys(opts).length === 0;
+    if (isDefaultCall && _cached !== null)
+        return _cached;
+    const hosts = detectHosts(opts);
+    const { auth, keys } = detectAuth(opts);
+    const report = { hosts, auth, keys };
+    if (isDefaultCall)
+        _cached = report;
+    return report;
+}
+/** Drop the per-process memo. Tests only. */
+export function resetEnvironmentCache() {
+    _cached = null;
+}
+//# sourceMappingURL=environment_detector.js.map

package/dist/scripts/_lib/environment_detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment_detector.js","sourceRoot":"","sources":["../../../src/scripts/_lib/environment_detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACH,oBAAoB,EACpB,YAAY,EACZ,iBAAiB,GACpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAe,MAAM,wBAAwB,CAAC;AA4C5E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAyD;IACnF,SAAS,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;IAC5B,MAAM,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,MAAM,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,GAAG,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC;IACnB,UAAU,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC;CACnC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,gBAAgB,GAAqC;IACvD,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,gBAAgB;IACxB,MAAM,EAAE,gBAAgB;IACxB,GAAG,EAAE,aAAa;IAClB,UAAU,EAAE,oBAAoB;CACnC,CAAC;AAEF,gFAAgF;AAChF,MAAM,iBAAiB,GAAqC;IACxD,SAAS,EAAE,eAAe;IAC1B,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;IACpB,GAAG,EAAE,SAAS;IACd,UAAU,EAAE,gBAAgB;CAC/B,CAAC;AAEF,sEAAsE;AACtE,MAAM,UAAU,cAAc;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAC1C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC3C,OAAO,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,MAAyB;IACvE,IAAI,MAAM,KAAK,kBAAkB;QAAE,OAAO,WAAW,CAAC;IACtD,IAAI,cAAc,CAAC,QAAQ,CAAC;QAAE,OAAO,WAAW,CAAC;IACjD,OAAO,cAAc,CAAC;AAC1B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAmB;IACzC,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC/B,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,MAAM,CAAC,GAAmB;IAC/B,MAAM,GAAG,GAAG,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IAC/B,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;AACrD,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,CAAC;AA8BtC,kFAAkF;AAClF,MAAM,CAAC,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,SAAS,oBAAoB,CAAC,OAAe;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;YACxE,OAAO,EAAE,wBAAwB;YACjC,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,IAAI;YACjB,GAAG,EAAE,gBAAgB,EAAE;SAC1B,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACjE,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,MAAc;IACvC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,EAAE;YACzC,OAAO,EAAE,wBAAwB;YACjC,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,IAAI;YACjB,GAAG,EAAE,gBAAgB,EAAE;SAC1B,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChE,OAAO,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACrB,IAAI,CAAC;QACD,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACrB,IAAI,CAAC;QACD,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,QAAgB;IACvC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACL,yEAAyE;QACzE,OAAO,aAAa,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,OAAO,aAAa,CAAC;IACzB,CAAC;IACD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3B,MAAM,QAAQ,GACV,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,MAAiC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9D,IAAI,QAAQ;QAAE,OAAO,kBAAkB,CAAC;IACxC,OAAO,aAAa,CAAC;AACzB,CAAC;AAED,uFAAuF;AACvF,SAAS,uBAAuB,CAC5B,QAAgB,EAChB,IAAY,EACZ,GAAW,EACX,eAAuB,EACvB,aAA4B;IAE5B,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,eAAe,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,EAAE,CAAC;YAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACpC,IAAI,MAAM,CAAC,CAAC,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACtE,CAAC;QACD,wEAAwE;QACxE,sDAAsD;QACtD,IAAI,aAAa,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,uBAAuB,EAAE,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,4EAA4E;IAC5E,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,IAA8B;IAC/C,MAAM,YAAY,GAAG,oBAAoB,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,CAAC,OAAO;KACxB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;IACvD,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,OAAO,GAAgB,IAAI,CAAC;QAChC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClB,IAAI,GAAkB,CAAC;YACvB,IAAI,CAAC;gBACD,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACL,GAAG,GAAG,IAAI,CAAC;YACf,CAAC;YACD,+DAA+D;YAC/D,wCAAwC;YACxC,OAAO,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,IAA8B;IAI9C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,qEAAqE;IACrE,wEAAwE;IACxE,MAAM,eAAe,GACjB,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;QAC7C,CAAC,CAAC,iBAAiB,EAAE;QACrB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,oBAAoB,CAAC;IACjE,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,MAAM,IAAI,GAAkB,EAAE,CAAC;IAE/B,KAAK,MAAM,QAAQ,IAAI,cAAc,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,uBAAuB,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC;QACzF,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,QAAQ,GAAkB,IAAI,CAAC;YACnC,IAAI,CAAC;gBACD,QAAQ,GAAG,qBAAqB,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACL,QAAQ,GAAG,IAAI,CAAC;YACpB,CAAC;YACD,IAAI,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAChE,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,OAAO,EAAE,EAAE,CAAC,CAAC;YACpD,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,MAAM,EAAE,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CACzB,MAAyB,EACzB,QAAgB;IAEhB,MAAM,KAAK,GAA0B;QACjC,kBAAkB;QAClB,aAAa;QACb,UAAU;QACV,SAAS;KACZ,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QACpF,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,GAAG,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,IAAI,OAAO,GAA6B,IAAI,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAiC,EAAE;IACjE,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACrD,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACtD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,MAAM,GAAsB,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxD,IAAI,aAAa;QAAE,OAAO,GAAG,MAAM,CAAC;IACpC,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,qBAAqB;IACjC,OAAO,GAAG,IAAI,CAAC;AACnB,CAAC"}