@georgedong32/ccs 7.67.0 → 8.0.0

package/dist/cliproxy/auth/oauth-trace/sink-file.js

@@ -0,0 +1,90 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFileSink = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+function createFileSink(options) {
+    const now = options.now ?? (() => new Date());
+    let warned = false;
+    const onError = options.onError ??
+        ((msg) => {
+            if (!warned) {
+                warned = true;
+                process.stderr.write(`[oauth-trace] file sink disabled: ${msg}\n`);
+            }
+        });
+    let cachedDate = null;
+    function ensureDir() {
+        fs.mkdirSync(options.dir, { recursive: true, mode: 0o700 });
+    }
+    function dateStr(d) {
+        const yyyy = d.getFullYear().toString().padStart(4, '0');
+        const mm = (d.getMonth() + 1).toString().padStart(2, '0');
+        const dd = d.getDate().toString().padStart(2, '0');
+        return `${yyyy}${mm}${dd}`;
+    }
+    function pathForToday() {
+        const ds = dateStr(now());
+        cachedDate = ds;
+        return path.join(options.dir, `oauth-${ds}.log`);
+    }
+    function appendOne(event) {
+        const file = pathForToday();
+        const line = JSON.stringify(event) + '\n';
+        let fd = null;
+        try {
+            ensureDir();
+            fd = fs.openSync(file, 'a', 0o600);
+            fs.writeSync(fd, line);
+        }
+        finally {
+            if (fd !== null) {
+                try {
+                    fs.closeSync(fd);
+                }
+                catch {
+                    // ignore
+                }
+            }
+        }
+    }
+    return {
+        write(event) {
+            try {
+                appendOne(event);
+            }
+            catch (err) {
+                onError(err.message);
+            }
+        },
+        async flush() {
+            // appendSync paths are flushed per-write; no buffer to drain.
+            void cachedDate;
+        },
+    };
+}
+exports.createFileSink = createFileSink;
+//# sourceMappingURL=sink-file.js.map

package/dist/cliproxy/auth/oauth-trace/sink-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink-file.js","sourceRoot":"","sources":["../../../../src/cliproxy/auth/oauth-trace/sink-file.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,2CAA6B;AAmB7B,SAAgB,cAAc,CAAC,OAAwB;IACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,OAAO,GACX,OAAO,CAAC,OAAO;QACf,CAAC,CAAC,GAAW,EAAE,EAAE;YACf,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,GAAG,IAAI,CAAC,CAAC;YACrE,CAAC;QACH,CAAC,CAAC,CAAC;IAEL,IAAI,UAAU,GAAkB,IAAI,CAAC;IAErC,SAAS,SAAS;QAChB,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,SAAS,OAAO,CAAC,CAAO;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1D,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnD,OAAO,GAAG,IAAI,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;IAC7B,CAAC;IAED,SAAS,YAAY;QACnB,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;QAC1B,UAAU,GAAG,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,SAAS,SAAS,CAAC,KAAsB;QACvC,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;QAC1C,IAAI,EAAE,GAAkB,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,SAAS,EAAE,CAAC;YACZ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACnC,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACzB,CAAC;gBAAS,CAAC;YACT,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACnB,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,KAAK;YACT,IAAI,CAAC;gBACH,SAAS,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK;YACT,8DAA8D;YAC9D,KAAK,UAAU,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC;AA/DD,wCA+DC"}

package/dist/cliproxy/auth/oauth-trace/sink-memory.d.ts

@@ -0,0 +1,13 @@
+import { OAuthTraceEvent, OAuthTraceSink } from './trace-events';
+/** Default ring-buffer capacity. Keeps latest N events; oldest are dropped. */
+export declare const MEMORY_SINK_MAX_EVENTS = 1000;
+/**
+ * In-memory ring buffer sink. Used for diagnose-failure analysis after a flow ends.
+ * Caps at MAX_EVENTS to bound memory; oldest are dropped when full.
+ * `droppedCount` tracks how many events were discarded so callers know data loss occurred.
+ */
+export declare function createMemorySink(maxEvents?: number): OAuthTraceSink & {
+    snapshot(): OAuthTraceEvent[];
+    droppedCount(): number;
+};
+//# sourceMappingURL=sink-memory.d.ts.map

package/dist/cliproxy/auth/oauth-trace/sink-memory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink-memory.d.ts","sourceRoot":"","sources":["../../../../src/cliproxy/auth/oauth-trace/sink-memory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEjE,+EAA+E;AAC/E,eAAO,MAAM,sBAAsB,OAAO,CAAC;AAE3C;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,SAAyB,GACjC,cAAc,GAAG;IAAE,QAAQ,IAAI,eAAe,EAAE,CAAC;IAAC,YAAY,IAAI,MAAM,CAAA;CAAE,CAkB5E"}

package/dist/cliproxy/auth/oauth-trace/sink-memory.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createMemorySink = exports.MEMORY_SINK_MAX_EVENTS = void 0;
+/** Default ring-buffer capacity. Keeps latest N events; oldest are dropped. */
+exports.MEMORY_SINK_MAX_EVENTS = 1000;
+/**
+ * In-memory ring buffer sink. Used for diagnose-failure analysis after a flow ends.
+ * Caps at MAX_EVENTS to bound memory; oldest are dropped when full.
+ * `droppedCount` tracks how many events were discarded so callers know data loss occurred.
+ */
+function createMemorySink(maxEvents = exports.MEMORY_SINK_MAX_EVENTS) {
+    const events = [];
+    let dropped = 0;
+    return {
+        write(event) {
+            if (events.length >= maxEvents) {
+                events.shift();
+                dropped++;
+            }
+            events.push(event);
+        },
+        snapshot() {
+            return events.slice();
+        },
+        droppedCount() {
+            return dropped;
+        },
+    };
+}
+exports.createMemorySink = createMemorySink;
+//# sourceMappingURL=sink-memory.js.map

package/dist/cliproxy/auth/oauth-trace/sink-memory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink-memory.js","sourceRoot":"","sources":["../../../../src/cliproxy/auth/oauth-trace/sink-memory.ts"],"names":[],"mappings":";;;AAEA,+EAA+E;AAClE,QAAA,sBAAsB,GAAG,IAAI,CAAC;AAE3C;;;;GAIG;AACH,SAAgB,gBAAgB,CAC9B,SAAS,GAAG,8BAAsB;IAElC,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,OAAO;QACL,KAAK,CAAC,KAAK;YACT,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC/B,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,QAAQ;YACN,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;QACD,YAAY;YACV,OAAO,OAAO,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AApBD,4CAoBC"}

package/dist/cliproxy/auth/oauth-trace/sink-verbose-stdout.d.ts

@@ -0,0 +1,11 @@
+import { OAuthTraceSink } from './trace-events';
+/**
+ * Verbose stdout sink. Writes one ASCII line per event when verbose=true.
+ * Format: `[oauth-trace] +{elapsedMs}ms {phase} {key=val ...}`
+ * No emojis (CCS terminal rule). Goes to stderr to avoid mingling with normal stdout.
+ */
+export declare function createVerboseStdoutSink(opts: {
+    enabled: boolean;
+    out?: (line: string) => void;
+}): OAuthTraceSink;
+//# sourceMappingURL=sink-verbose-stdout.d.ts.map

package/dist/cliproxy/auth/oauth-trace/sink-verbose-stdout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink-verbose-stdout.d.ts","sourceRoot":"","sources":["../../../../src/cliproxy/auth/oauth-trace/sink-verbose-stdout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9B,GAAG,cAAc,CAoBjB"}

package/dist/cliproxy/auth/oauth-trace/sink-verbose-stdout.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createVerboseStdoutSink = void 0;
+/**
+ * Verbose stdout sink. Writes one ASCII line per event when verbose=true.
+ * Format: `[oauth-trace] +{elapsedMs}ms {phase} {key=val ...}`
+ * No emojis (CCS terminal rule). Goes to stderr to avoid mingling with normal stdout.
+ */
+function createVerboseStdoutSink(opts) {
+    const out = opts.out ?? ((line) => process.stderr.write(line + '\n'));
+    return {
+        write(event) {
+            if (!opts.enabled)
+                return;
+            const parts = [];
+            parts.push(`[oauth-trace] +${event.elapsedMs}ms ${event.phase}`);
+            if (event.data) {
+                for (const [k, v] of Object.entries(event.data)) {
+                    if (v === undefined)
+                        continue;
+                    parts.push(`${k}=${formatValue(v)}`);
+                }
+            }
+            if (event.error) {
+                parts.push(`error_code=${event.error.code ?? 'unknown'}`);
+                parts.push(`error_msg="${event.error.message.replace(/"/g, "'")}"`);
+            }
+            out(parts.join(' '));
+        },
+    };
+}
+exports.createVerboseStdoutSink = createVerboseStdoutSink;
+function formatValue(v) {
+    if (v === null)
+        return 'null';
+    if (typeof v === 'string')
+        return v.includes(' ') ? `"${v.replace(/"/g, "'")}"` : v;
+    if (typeof v === 'number' || typeof v === 'boolean')
+        return String(v);
+    try {
+        return JSON.stringify(v);
+    }
+    catch {
+        return '[unserializable]';
+    }
+}
+//# sourceMappingURL=sink-verbose-stdout.js.map

package/dist/cliproxy/auth/oauth-trace/sink-verbose-stdout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sink-verbose-stdout.js","sourceRoot":"","sources":["../../../../src/cliproxy/auth/oauth-trace/sink-verbose-stdout.ts"],"names":[],"mappings":";;;AAEA;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,IAGvC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;IAC9E,OAAO;QACL,KAAK,CAAC,KAAK;YACT,IAAI,CAAC,IAAI,CAAC,OAAO;gBAAE,OAAO;YAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,SAAS,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;YACjE,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBAChD,IAAI,CAAC,KAAK,SAAS;wBAAE,SAAS;oBAC9B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC;gBAC1D,KAAK,CAAC,IAAI,CAAC,cAAc,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACtE,CAAC;YACD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAvBD,0DAuBC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAC9B,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/cliproxy/auth/oauth-trace/trace-events.d.ts

@@ -0,0 +1,51 @@
+/**
+ * OAuth trace event taxonomy.
+ *
+ * Single source of truth for phase IDs that flow through the OAuth pipeline.
+ * Additive only — never remove or renumber.
+ */
+export declare enum OAuthTracePhase {
+    PreflightStart = "preflight.start",
+    PreflightOk = "preflight.ok",
+    PreflightPortBlocked = "preflight.port_blocked",
+    BinarySpawn = "binary.spawn",
+    BinaryStdout = "binary.stdout",
+    BinaryStderr = "binary.stderr",
+    BinaryExit = "binary.exit",
+    AuthUrlDisplayed = "auth.url_displayed",
+    BrowserOpened = "browser.opened",
+    CallbackObservedHeuristic = "callback.observed_heuristic",
+    PasteCallbackPrompted = "paste.prompted",
+    PasteCallbackReceived = "paste.received",
+    PasteCallbackInvalid = "paste.invalid",
+    PasteCallbackSubmitted = "paste.submitted",
+    TokenExchangePending = "token.exchange_pending",
+    TokenFileAppeared = "token.file_appeared",
+    TokenFileMissing = "token.file_missing",
+    ProjectSelectionPrompted = "project.selection_prompted",
+    ProjectSelectionResolved = "project.selection_resolved",
+    AgyResponsibilityPrompted = "agy.responsibility_prompted",
+    AgyResponsibilityResolved = "agy.responsibility_resolved",
+    Timeout = "timeout",
+    Cancelled = "cancelled",
+    Error = "error"
+}
+/** A single OAuth trace event. `data` MUST be redacted before construction. */
+export interface OAuthTraceEvent {
+    sessionId: string;
+    provider: string;
+    phase: OAuthTracePhase;
+    ts: number;
+    elapsedMs: number;
+    data?: Record<string, unknown>;
+    error?: {
+        code?: string;
+        message: string;
+    };
+}
+/** Sink interface — accept events that have already been redacted. */
+export interface OAuthTraceSink {
+    write(event: OAuthTraceEvent): void;
+    flush?(): Promise<void>;
+}
+//# sourceMappingURL=trace-events.d.ts.map

package/dist/cliproxy/auth/oauth-trace/trace-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-events.d.ts","sourceRoot":"","sources":["../../../../src/cliproxy/auth/oauth-trace/trace-events.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,oBAAY,eAAe;IAEzB,cAAc,oBAAoB;IAClC,WAAW,iBAAiB;IAC5B,oBAAoB,2BAA2B;IAG/C,WAAW,iBAAiB;IAC5B,YAAY,kBAAkB;IAC9B,YAAY,kBAAkB;IAC9B,UAAU,gBAAgB;IAG1B,gBAAgB,uBAAuB;IACvC,aAAa,mBAAmB;IAChC,yBAAyB,gCAAgC;IAGzD,qBAAqB,mBAAmB;IACxC,qBAAqB,mBAAmB;IACxC,oBAAoB,kBAAkB;IACtC,sBAAsB,oBAAoB;IAG1C,oBAAoB,2BAA2B;IAC/C,iBAAiB,wBAAwB;IACzC,gBAAgB,uBAAuB;IAGvC,wBAAwB,+BAA+B;IACvD,wBAAwB,+BAA+B;IACvD,yBAAyB,gCAAgC;IACzD,yBAAyB,gCAAgC;IAGzD,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,KAAK,UAAU;CAChB;AAED,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,eAAe,CAAC;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI,CAAC;IACpC,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB"}

package/dist/cliproxy/auth/oauth-trace/trace-events.js

@@ -0,0 +1,44 @@
+"use strict";
+/**
+ * OAuth trace event taxonomy.
+ *
+ * Single source of truth for phase IDs that flow through the OAuth pipeline.
+ * Additive only — never remove or renumber.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthTracePhase = void 0;
+var OAuthTracePhase;
+(function (OAuthTracePhase) {
+    // Pre-flight
+    OAuthTracePhase["PreflightStart"] = "preflight.start";
+    OAuthTracePhase["PreflightOk"] = "preflight.ok";
+    OAuthTracePhase["PreflightPortBlocked"] = "preflight.port_blocked";
+    // Binary process lifecycle (CLIProxyAPI Go binary)
+    OAuthTracePhase["BinarySpawn"] = "binary.spawn";
+    OAuthTracePhase["BinaryStdout"] = "binary.stdout";
+    OAuthTracePhase["BinaryStderr"] = "binary.stderr";
+    OAuthTracePhase["BinaryExit"] = "binary.exit";
+    // Browser / URL flow (Authorization Code)
+    OAuthTracePhase["AuthUrlDisplayed"] = "auth.url_displayed";
+    OAuthTracePhase["BrowserOpened"] = "browser.opened";
+    OAuthTracePhase["CallbackObservedHeuristic"] = "callback.observed_heuristic";
+    // Paste-callback (CCS-owned end-to-end)
+    OAuthTracePhase["PasteCallbackPrompted"] = "paste.prompted";
+    OAuthTracePhase["PasteCallbackReceived"] = "paste.received";
+    OAuthTracePhase["PasteCallbackInvalid"] = "paste.invalid";
+    OAuthTracePhase["PasteCallbackSubmitted"] = "paste.submitted";
+    // Token exchange + persistence
+    OAuthTracePhase["TokenExchangePending"] = "token.exchange_pending";
+    OAuthTracePhase["TokenFileAppeared"] = "token.file_appeared";
+    OAuthTracePhase["TokenFileMissing"] = "token.file_missing";
+    // Provider-specific gates (Phase 4/5 extend)
+    OAuthTracePhase["ProjectSelectionPrompted"] = "project.selection_prompted";
+    OAuthTracePhase["ProjectSelectionResolved"] = "project.selection_resolved";
+    OAuthTracePhase["AgyResponsibilityPrompted"] = "agy.responsibility_prompted";
+    OAuthTracePhase["AgyResponsibilityResolved"] = "agy.responsibility_resolved";
+    // Terminal states
+    OAuthTracePhase["Timeout"] = "timeout";
+    OAuthTracePhase["Cancelled"] = "cancelled";
+    OAuthTracePhase["Error"] = "error";
+})(OAuthTracePhase || (exports.OAuthTracePhase = OAuthTracePhase = {}));
+//# sourceMappingURL=trace-events.js.map

package/dist/cliproxy/auth/oauth-trace/trace-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-events.js","sourceRoot":"","sources":["../../../../src/cliproxy/auth/oauth-trace/trace-events.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,IAAY,eAsCX;AAtCD,WAAY,eAAe;IACzB,aAAa;IACb,qDAAkC,CAAA;IAClC,+CAA4B,CAAA;IAC5B,kEAA+C,CAAA;IAE/C,mDAAmD;IACnD,+CAA4B,CAAA;IAC5B,iDAA8B,CAAA;IAC9B,iDAA8B,CAAA;IAC9B,6CAA0B,CAAA;IAE1B,0CAA0C;IAC1C,0DAAuC,CAAA;IACvC,mDAAgC,CAAA;IAChC,4EAAyD,CAAA;IAEzD,wCAAwC;IACxC,2DAAwC,CAAA;IACxC,2DAAwC,CAAA;IACxC,yDAAsC,CAAA;IACtC,6DAA0C,CAAA;IAE1C,+BAA+B;IAC/B,kEAA+C,CAAA;IAC/C,4DAAyC,CAAA;IACzC,0DAAuC,CAAA;IAEvC,6CAA6C;IAC7C,0EAAuD,CAAA;IACvD,0EAAuD,CAAA;IACvD,4EAAyD,CAAA;IACzD,4EAAyD,CAAA;IAEzD,kBAAkB;IAClB,sCAAmB,CAAA;IACnB,0CAAuB,CAAA;IACvB,kCAAe,CAAA;AACjB,CAAC,EAtCW,eAAe,+BAAf,eAAe,QAsC1B"}

package/dist/cliproxy/auth/oauth-trace/trace-recorder.d.ts

@@ -0,0 +1,34 @@
+import { OAuthTraceEvent, OAuthTracePhase, OAuthTraceSink } from './trace-events';
+export interface OAuthTraceRecorder {
+    record(phase: OAuthTracePhase, data?: Record<string, unknown>, error?: {
+        code?: string;
+        message: string;
+    } | Error): void;
+    snapshot(): OAuthTraceEvent[];
+    summary(): {
+        totalMs: number;
+        phaseCounts: Record<string, number>;
+        lastPhase?: OAuthTracePhase;
+    };
+    flush(): Promise<void>;
+}
+export interface OAuthTraceRecorderOptions {
+    sessionId: string;
+    provider: string;
+    verbose: boolean;
+    fileSink?: OAuthTraceSink;
+    /** Test seam — defaults to `Date.now`. */
+    now?: () => number;
+    /** Test seam — override verbose sink output channel. */
+    verboseOut?: (line: string) => void;
+}
+/**
+ * Create a per-attempt recorder. Always wires:
+ *  - memory sink (read via `snapshot()`)
+ *  - verbose stdout sink (no-op when verbose=false)
+ *  - optional file sink (Phase 8)
+ *
+ * All event data passes through the redactor before reaching any sink.
+ */
+export declare function createOAuthTraceRecorder(options: OAuthTraceRecorderOptions): OAuthTraceRecorder;
+//# sourceMappingURL=trace-recorder.d.ts.map

package/dist/cliproxy/auth/oauth-trace/trace-recorder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-recorder.d.ts","sourceRoot":"","sources":["../../../../src/cliproxy/auth/oauth-trace/trace-recorder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAKlF,MAAM,WAAW,kBAAkB;IACjC,MAAM,CACJ,KAAK,EAAE,eAAe,EACtB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,GACjD,IAAI,CAAC;IACR,QAAQ,IAAI,eAAe,EAAE,CAAC;IAC9B,OAAO,IAAI;QACT,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACpC,SAAS,CAAC,EAAE,eAAe,CAAC;KAC7B,CAAC;IACF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,wDAAwD;IACxD,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACrC;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,kBAAkB,CAmE/F"}

package/dist/cliproxy/auth/oauth-trace/trace-recorder.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createOAuthTraceRecorder = void 0;
+const sink_memory_1 = require("./sink-memory");
+const sink_verbose_stdout_1 = require("./sink-verbose-stdout");
+const redactor_1 = require("./redactor");
+/**
+ * Create a per-attempt recorder. Always wires:
+ *  - memory sink (read via `snapshot()`)
+ *  - verbose stdout sink (no-op when verbose=false)
+ *  - optional file sink (Phase 8)
+ *
+ * All event data passes through the redactor before reaching any sink.
+ */
+function createOAuthTraceRecorder(options) {
+    const now = options.now ?? Date.now;
+    const start = now();
+    const memory = (0, sink_memory_1.createMemorySink)();
+    const verbose = (0, sink_verbose_stdout_1.createVerboseStdoutSink)({ enabled: options.verbose, out: options.verboseOut });
+    const sinks = [memory, verbose];
+    if (options.fileSink)
+        sinks.push(options.fileSink);
+    const phaseCounts = {};
+    let lastPhase;
+    function toErrorObj(err) {
+        if (!err)
+            return undefined;
+        if (err instanceof Error) {
+            return { message: err.message };
+        }
+        return { code: err.code, message: err.message };
+    }
+    return {
+        record(phase, data, error) {
+            const ts = now();
+            const elapsedMs = ts - start;
+            const redacted = data ? (0, redactor_1.redactJsonShallow)(data) : undefined;
+            const event = {
+                sessionId: options.sessionId,
+                provider: options.provider,
+                phase,
+                ts,
+                elapsedMs,
+                data: redacted,
+                error: toErrorObj(error),
+            };
+            phaseCounts[phase] = (phaseCounts[phase] ?? 0) + 1;
+            lastPhase = phase;
+            for (const sink of sinks) {
+                try {
+                    sink.write(event);
+                }
+                catch {
+                    // Sinks must never throw out — drop on failure.
+                }
+            }
+        },
+        snapshot() {
+            return memory.snapshot();
+        },
+        summary() {
+            return {
+                totalMs: now() - start,
+                phaseCounts: { ...phaseCounts },
+                lastPhase,
+            };
+        },
+        async flush() {
+            for (const sink of sinks) {
+                if (sink.flush) {
+                    try {
+                        await sink.flush();
+                    }
+                    catch {
+                        // ignore
+                    }
+                }
+            }
+        },
+    };
+}
+exports.createOAuthTraceRecorder = createOAuthTraceRecorder;
+//# sourceMappingURL=trace-recorder.js.map

package/dist/cliproxy/auth/oauth-trace/trace-recorder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trace-recorder.js","sourceRoot":"","sources":["../../../../src/cliproxy/auth/oauth-trace/trace-recorder.ts"],"names":[],"mappings":";;;AACA,+CAAiD;AACjD,+DAAgE;AAChE,yCAA+C;AA4B/C;;;;;;;GAOG;AACH,SAAgB,wBAAwB,CAAC,OAAkC;IACzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,IAAA,8BAAgB,GAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAA,6CAAuB,EAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEnD,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,IAAI,SAAsC,CAAC;IAE3C,SAAS,UAAU,CACjB,GAA2D;QAE3D,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IAED,OAAO;QACL,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK;YACvB,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,EAAE,GAAG,KAAK,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,IAAA,4BAAiB,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,MAAM,KAAK,GAAoB;gBAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK;gBACL,EAAE;gBACF,SAAS;gBACT,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC;aACzB,CAAC;YACF,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACnD,SAAS,GAAG,KAAK,CAAC;YAClB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACpB,CAAC;gBAAC,MAAM,CAAC;oBACP,gDAAgD;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;QACD,QAAQ;YACN,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QACD,OAAO;YACL,OAAO;gBACL,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK;gBACtB,WAAW,EAAE,EAAE,GAAG,WAAW,EAAE;gBAC/B,SAAS;aACV,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,KAAK;YACT,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;oBACrB,CAAC;oBAAC,MAAM,CAAC;wBACP,SAAS;oBACX,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAnED,4DAmEC"}

package/dist/cliproxy/auth/project-selection-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-selection-handler.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/project-selection-handler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtC;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAYD,eAAO,MAAM,sBAAsB,uBAAqB,CAAC;AAQzD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAgBhE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGjE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAErD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuBvF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAgBlF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAejE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,GAAG,IAAI,CAGpF;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAE9D;;;;;;;;;;;;;;AAED,wBAYE"}

package/dist/cliproxy/auth/project-selection-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-selection-handler.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/project-selection-handler.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,mCAAsC;AAuCtC,oDAAoD;AACvC,QAAA,sBAAsB,GAAG,IAAI,qBAAY,EAAE,CAAC;AAEzD,mCAAmC;AACnC,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA4B,CAAC;AAE9D,qDAAqD;AACrD,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC;;;;;;;;GAQG;AACH,SAAgB,gBAAgB,CAAC,MAAc;IAC7C,MAAM,QAAQ,GAAoB,EAAE,CAAC;IAErC,kDAAkD;IAClD,MAAM,YAAY,GAAG,kCAAkC,CAAC;IACxD,IAAI,KAAK,CAAC;IAEV,OAAO,CAAC,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC7B,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;YACZ,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;SACf,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAhBD,4CAgBC;AAED;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,MAAc;IAChD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACpE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjC,CAAC;AAHD,kDAGC;AAED;;GAEG;AACH,SAAgB,wBAAwB,CAAC,MAAc;IACrD,OAAO,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC3E,CAAC;AAFD,4DAEC;AAED;;GAEG;AACH,SAAgB,aAAa,CAAC,MAAc;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,kCAAkC,CAAC,CAAC;AAC7D,CAAC;AAFD,sCAEC;AAED;;GAEG;AACH,SAAgB,iBAAiB;IAC/B,OAAO,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAFD,8CAEC;AAED;;;;;;GAMG;AACH,SAAgB,uBAAuB,CAAC,MAA8B;IACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,iCAAiC;QACjC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACxD,IAAI,OAAO,EAAE,CAAC;gBACZ,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC3C,iCAAiC;gBACjC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;gBACjC,8BAAsB,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACrE,CAAC;QACH,CAAC,EAAE,oBAAoB,CAAC,CAAC;QAEzB,0BAA0B;QAC1B,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE;YACtC,MAAM;YACN,OAAO;YACP,OAAO;SACR,CAAC,CAAC;QAEH,qCAAqC;QACrC,8BAAsB,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC;AAvBD,0DAuBC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,QAAkC;IACvE,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAE1D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wCAAwC;IACxC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAE7C,uCAAuC;IACvC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACrC,8BAAsB,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;IAE7D,OAAO,IAAI,CAAC;AACd,CAAC;AAhBD,wDAgBC;AAED;;GAEG;AACH,SAAgB,sBAAsB,CAAC,SAAiB;IACtD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IAED,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,iBAAiB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAEpC,qDAAqD;IACrD,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpB,8BAAsB,CAAC,IAAI,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;IAE9D,OAAO,IAAI,CAAC;AACd,CAAC;AAfD,wDAeC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,SAAiB;IACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjD,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAHD,kDAGC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,SAAiB;IACnD,OAAO,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC1C,CAAC;AAFD,kDAEC;AAED,kBAAe;IACb,gBAAgB;IAChB,mBAAmB;IACnB,wBAAwB;IACxB,aAAa;IACb,iBAAiB;IACjB,uBAAuB;IACvB,sBAAsB;IACtB,sBAAsB;IACtB,mBAAmB;IACnB,mBAAmB;IACnB,sBAAsB,EAAtB,8BAAsB;CACvB,CAAC"}

package/dist/cliproxy/auth/provider-entitlement-evidence.d.ts

@@ -0,0 +1,17 @@
+import type { AccountTier } from '../accounts/types';
+import type { ProviderAccessState, ProviderCapacityState, ProviderEntitlementEvidence, ProviderEntitlementSource } from './provider-entitlement-types';
+export declare function normalizeProviderTierId(rawTierId: string | null | undefined): AccountTier;
+export declare function getProviderTierLabel(rawTierId: string | null | undefined): string | null;
+export declare function buildProviderEntitlementEvidence(input: {
+    normalizedTier: AccountTier;
+    rawTierId?: string | null;
+    rawTierLabel?: string | null;
+    source: ProviderEntitlementSource;
+    confidence: 'high' | 'medium' | 'low';
+    accessState: ProviderAccessState;
+    capacityState: ProviderCapacityState;
+    notes?: string | null;
+    lastVerifiedAt?: number;
+}): ProviderEntitlementEvidence;
+export declare function isModelCapacityExhausted(message: string | null | undefined, detail: string | null | undefined, errorCode: string | null | undefined): boolean;
+//# sourceMappingURL=provider-entitlement-evidence.d.ts.map

package/dist/cliproxy/auth/provider-entitlement-evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-entitlement-evidence.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/provider-entitlement-evidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EACV,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,EAC3B,yBAAyB,EAC1B,MAAM,8BAA8B,CAAC;AAUtC,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,CAQzF;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIxF;AAED,wBAAgB,gCAAgC,CAAC,KAAK,EAAE;IACtD,cAAc,EAAE,WAAW,CAAC;IAC5B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,WAAW,EAAE,mBAAmB,CAAC;IACjC,aAAa,EAAE,qBAAqB,CAAC;IACrC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,2BAA2B,CAa9B;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACnC,OAAO,CAOT"}

package/dist/cliproxy/auth/provider-entitlement-evidence.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isModelCapacityExhausted = exports.buildProviderEntitlementEvidence = exports.getProviderTierLabel = exports.normalizeProviderTierId = void 0;
+const RAW_TIER_LABELS = {
+    'free-tier': 'Free',
+    'legacy-tier': 'Legacy',
+    'standard-tier': 'Standard',
+    'g1-pro-tier': 'Pro',
+    'g1-ultra-tier': 'Ultra',
+};
+function normalizeProviderTierId(rawTierId) {
+    if (!rawTierId)
+        return 'unknown';
+    const normalized = rawTierId.trim().toLowerCase();
+    if (!normalized)
+        return 'unknown';
+    if (normalized.includes('ultra'))
+        return 'ultra';
+    if (normalized.includes('pro'))
+        return 'pro';
+    if (normalized.includes('free') || normalized.includes('legacy'))
+        return 'free';
+    return 'unknown';
+}
+exports.normalizeProviderTierId = normalizeProviderTierId;
+function getProviderTierLabel(rawTierId) {
+    if (!rawTierId)
+        return null;
+    const normalized = rawTierId.trim().toLowerCase();
+    return normalized ? (RAW_TIER_LABELS[normalized] ?? rawTierId.trim()) : null;
+}
+exports.getProviderTierLabel = getProviderTierLabel;
+function buildProviderEntitlementEvidence(input) {
+    const rawTierId = input.rawTierId?.trim() || null;
+    return {
+        normalizedTier: input.normalizedTier,
+        rawTierId,
+        rawTierLabel: input.rawTierLabel ?? getProviderTierLabel(rawTierId),
+        source: input.source,
+        confidence: input.confidence,
+        accessState: input.accessState,
+        capacityState: input.capacityState,
+        notes: input.notes ?? null,
+        lastVerifiedAt: input.lastVerifiedAt ?? Date.now(),
+    };
+}
+exports.buildProviderEntitlementEvidence = buildProviderEntitlementEvidence;
+function isModelCapacityExhausted(message, detail, errorCode) {
+    const haystack = `${message || ''} ${detail || ''} ${errorCode || ''}`.toLowerCase();
+    return (haystack.includes('model_capacity_exhausted') ||
+        haystack.includes('no capacity available') ||
+        haystack.includes('capacity exhausted'));
+}
+exports.isModelCapacityExhausted = isModelCapacityExhausted;
+//# sourceMappingURL=provider-entitlement-evidence.js.map

package/dist/cliproxy/auth/provider-entitlement-evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-entitlement-evidence.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/provider-entitlement-evidence.ts"],"names":[],"mappings":";;;AAQA,MAAM,eAAe,GAA2B;IAC9C,WAAW,EAAE,MAAM;IACnB,aAAa,EAAE,QAAQ;IACvB,eAAe,EAAE,UAAU;IAC3B,aAAa,EAAE,KAAK;IACpB,eAAe,EAAE,OAAO;CACzB,CAAC;AAEF,SAAgB,uBAAuB,CAAC,SAAoC;IAC1E,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACjD,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IAChF,OAAO,SAAS,CAAC;AACnB,CAAC;AARD,0DAQC;AAED,SAAgB,oBAAoB,CAAC,SAAoC;IACvE,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAJD,oDAIC;AAED,SAAgB,gCAAgC,CAAC,KAUhD;IACC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAClD,OAAO;QACL,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,SAAS;QACT,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,oBAAoB,CAAC,SAAS,CAAC;QACnE,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE;KACnD,CAAC;AACJ,CAAC;AAvBD,4EAuBC;AAED,SAAgB,wBAAwB,CACtC,OAAkC,EAClC,MAAiC,EACjC,SAAoC;IAEpC,MAAM,QAAQ,GAAG,GAAG,OAAO,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE,IAAI,SAAS,IAAI,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC;IACrF,OAAO,CACL,QAAQ,CAAC,QAAQ,CAAC,0BAA0B,CAAC;QAC7C,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC;QAC1C,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CACxC,CAAC;AACJ,CAAC;AAXD,4DAWC"}

package/dist/cliproxy/auth/provider-entitlement-types.d.ts

@@ -0,0 +1,16 @@
+import type { AccountTier } from '../accounts/types';
+export type ProviderEntitlementSource = 'runtime_api' | 'runtime_inference' | 'registry_cache' | 'official_docs';
+export type ProviderAccessState = 'entitled' | 'not_entitled' | 'capacity_exhausted' | 'temporarily_unavailable' | 'unknown';
+export type ProviderCapacityState = 'available' | 'capacity_exhausted' | 'rate_limited' | 'temporarily_unavailable' | 'unknown';
+export interface ProviderEntitlementEvidence {
+    normalizedTier: AccountTier;
+    rawTierId: string | null;
+    rawTierLabel: string | null;
+    source: ProviderEntitlementSource;
+    confidence: 'high' | 'medium' | 'low';
+    accessState: ProviderAccessState;
+    capacityState: ProviderCapacityState;
+    lastVerifiedAt: number;
+    notes?: string | null;
+}
+//# sourceMappingURL=provider-entitlement-types.d.ts.map

package/dist/cliproxy/auth/provider-entitlement-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-entitlement-types.d.ts","sourceRoot":"","sources":["../../../src/cliproxy/auth/provider-entitlement-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,MAAM,yBAAyB,GACjC,aAAa,GACb,mBAAmB,GACnB,gBAAgB,GAChB,eAAe,CAAC;AAEpB,MAAM,MAAM,mBAAmB,GAC3B,UAAU,GACV,cAAc,GACd,oBAAoB,GACpB,yBAAyB,GACzB,SAAS,CAAC;AAEd,MAAM,MAAM,qBAAqB,GAC7B,WAAW,GACX,oBAAoB,GACpB,cAAc,GACd,yBAAyB,GACzB,SAAS,CAAC;AAEd,MAAM,WAAW,2BAA2B;IAC1C,cAAc,EAAE,WAAW,CAAC;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IACtC,WAAW,EAAE,mBAAmB,CAAC;IACjC,aAAa,EAAE,qBAAqB,CAAC;IACrC,cAAc,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB"}

package/dist/cliproxy/auth/provider-entitlement-types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=provider-entitlement-types.js.map

package/dist/cliproxy/auth/provider-entitlement-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-entitlement-types.js","sourceRoot":"","sources":["../../../src/cliproxy/auth/provider-entitlement-types.ts"],"names":[],"mappings":""}

package/dist/cliproxy/auth/provider-refreshers/index.d.ts

@@ -4,8 +4,7 @@
  * Exports refresh functions for each OAuth provider.
  *
  * Refresh responsibility:
- * - CCS-managed: gemini (CCS refreshes tokens directly via Google OAuth)
- * - CLIProxy-delegated: codex, agy, kiro, ghcp, qwen, iflow, kimi
+ * - CLIProxy-delegated: gemini, codex, agy, kiro, ghcp, qwen, iflow, kimi
  *   (CLIProxyAPIPlus handles refresh automatically in background)
  * - Not implemented: claude
  */

package/dist/cliproxy/auth/provider-refreshers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/cliproxy/auth/provider-refreshers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAQ/C,2BAA2B;AAC3B,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAMD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAEtE;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,CAuChC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/cliproxy/auth/provider-refreshers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAO/C,2BAA2B;AAC3B,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oEAAoE;IACpE,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAMD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAEtE;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC,CAsChC"}