/**
 * sdk-env-merge.ts — SDK 0.3.149 `Options.env` replace-not-merge guard.
 *
 * Finding (claude-agent-sdk-typescript CHANGELOG 0.3.149, late May 2026):
 *
 *   "Clarified that `Options.env` REPLACES the subprocess environment rather
 *    than merging with `process.env`."
 *
 * This is a silent foot-gun. Olam's SDK launch options (`buildSdkOptions` in
 * driver-runner.ts, `buildAskQueryOptions` in cli/src/ask/sdk-client.ts)
 * deliberately set NO `env` field — they rely on the spawned Claude Code
 * subprocess inheriting the supervisor's `process.env` (PATH, HOME,
 * ANTHROPIC_BASE_URL, HOST_CP_URL/BEARER, AGENT_DRIVER_TOOLS_ENABLED, the
 * vault-routing vars, etc.). See the comment at driver-runner.ts:159-161.
 *
 * If a future change ever sets `options.env = { ONE_VAR: 'x' }` to inject a
 * single variable, the SDK would WIPE the entire inherited environment —
 * breaking `withCredential` routing, the chunk-poster URL, the bearer auth,
 * and the tools escape-hatch all at once, with no error (the subprocess just
 * boots with an empty env and fails downstream in confusing ways).
 *
 * This module provides the SAFE way to inject env into SDK Options: always
 * MERGE on top of `process.env`. Pair it with the audit guard in
 * `sdk-env-merge.audit.test.ts`, which fails red if any olam Options builder
 * sets `env` to a non-merged literal.
 */
/**
 * Build a subprocess environment for `Options.env` that MERGES the given
 * overrides on top of the inherited base env (default `process.env`).
 *
 * Because SDK 0.3.149+ treats `Options.env` as a full REPLACEMENT, you must
 * never pass a bare `{ MY_VAR: 'x' }` literal — that strips PATH/HOME/auth.
 * This helper guarantees the inherited env survives.
 *
 * `undefined` values in `base` (the natural shape of `process.env`) are
 * dropped, so the result is a clean `Record<string, string>` the SDK accepts.
 * Overrides win over base on key collision (immutable — a fresh object is
 * returned; neither input is mutated).
 *
 * @param overrides Variables to set/replace on top of the inherited env.
 * @param base      Inherited env to merge onto. Defaults to `process.env`.
 */
export function mergeSubprocessEnv(overrides, base = process.env) {
    const merged = {};
    for (const [k, v] of Object.entries(base)) {
        if (typeof v === 'string')
            merged[k] = v;
    }
    for (const [k, v] of Object.entries(overrides)) {
        merged[k] = v;
    }
    return merged;
}
/**
 * Assert that an SDK Options object's `env` field (if present) is a SAFE
 * merge — i.e. it preserves the load-bearing inherited keys rather than being
 * a bare replacement literal. Returns the list of MISSING load-bearing keys
 * (empty = safe). Use in tests/guards; do not throw from hot paths.
 *
 * "Safe" here is intentionally conservative: if `env` is absent, the
 * subprocess inherits everything → always safe (returns `[]`). If `env` is
 * present, every key in `requiredKeys` that exists in the inherited base env
 * MUST also appear in `env`, or it is flagged.
 *
 * @param env          The `Options.env` value (or undefined if unset).
 * @param requiredKeys Inherited keys that MUST survive into the subprocess.
 * @param base         Inherited env to check against. Defaults to `process.env`.
 */
export function findStrippedEnvKeys(env, requiredKeys, base = process.env) {
    if (env === undefined)
        return []; // inherit-all → safe
    const missing = [];
    for (const key of requiredKeys) {
        const inheritedHasIt = typeof base[key] === 'string';
        if (inheritedHasIt && !(key in env))
            missing.push(key);
    }
    return missing;
}
/**
 * The load-bearing env keys an olam Claude Code subprocess depends on. If any
 * of these is silently stripped by a bare `Options.env` replacement, the
 * subprocess breaks in a confusing, non-erroring way. Used by the audit guard.
 */
export const OLAM_LOAD_BEARING_SUBPROCESS_ENV = [
    'PATH',
    'HOME',
    // Auth / vault routing (see root CLAUDE.md "Outbound Claude API calls").
    'ANTHROPIC_BASE_URL',
    'ANTHROPIC_API_KEY',
    'OLAM_ANTHROPIC_BASE_URL',
    // Host control-plane wiring read by driver-runner.ts main().
    'HOST_CP_URL',
    'HOST_CP_BEARER',
    // Tools escape-hatch read from the child process (driver-runner.ts:173).
    'AGENT_DRIVER_TOOLS_ENABLED',
];
//# sourceMappingURL=sdk-env-merge.js.map