@agimon-ai/po-vault 0.0.0-alpha.61

package/dist/extensions/server.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.cjs","names":["randomBytes","createCipheriv","Buffer","open","createDecipheriv","Buffer","open","asVaultError","VAULT_DB_PREFIX","VAULT_META_ID","randomBytes","VaultError","VAULT_KEYRING_ACCOUNT_PREFIX","VAULT_META_CHECK","VAULT_CHECK_PLAINTEXT","VAULT_CHECK_AAD","VAULT_INIT_LEASE","VAULT_KEY_LOST_NOTICE","randomUUID","serializeValue","constants","mkdir","lstat","VaultError","chmod","open","path","VAULT_KEY_FILE","unlink","VAULT_KEYRING_SERVICE","path","poHomeDirectory","VAULT_DIRECTORY","PO_SERVER_SCOPE_SERVICE","PO_DB_SERVICE","requirePoDb","requirePoServerScope","PO_VAULT_CONTRACT","defineRoot","PO_DB_CONTRACT","defineServerPlugin","composeServerProviderOverrides","rootGlobal","composeRootInjects","composeRootHooks"],"sources":["../../src/services/vaultCrypto/index.ts","../../src/services/vault/index.ts","../../src/services/vaultDirectory/index.ts","../../src/services/vaultKeyring/index.ts","../../src/extensions/(backend)/_lib/root.server.ts","../../src/extensions/(backend)/root.server.ts","../../generated/server.ts"],"sourcesContent":["import { Buffer } from 'node:buffer';\nimport { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\n\nimport { VAULT_IV_BYTES, VAULT_KEY_BYTES, VAULT_TAG_BYTES } from '../../constants/vault';\nimport type { SealedBox } from './type';\n\n/** AES-256-GCM with a fresh 12-byte IV, bound to `aad`. Ported from the MCP proxy's FileTokenStore. */\nexport function seal(key: Uint8Array, plaintext: string, aad: string): SealedBox {\n  const iv = randomBytes(VAULT_IV_BYTES);\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n  cipher.setAAD(Buffer.from(aad, 'utf8'));\n  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n  return { iv, tag: cipher.getAuthTag(), ciphertext };\n}\n\n/** The plaintext, or `undefined` when the key, the AAD or any byte of the box is wrong. */\nexport function open(key: Uint8Array, box: SealedBox, aad: string): string | undefined {\n  if (key.length !== VAULT_KEY_BYTES || box.iv.length !== VAULT_IV_BYTES || box.tag.length !== VAULT_TAG_BYTES)\n    return undefined;\n  try {\n    const decipher = createDecipheriv('aes-256-gcm', key, box.iv);\n    decipher.setAAD(Buffer.from(aad, 'utf8'));\n    decipher.setAuthTag(box.tag);\n    return Buffer.concat([decipher.update(box.ciphertext), decipher.final()]).toString('utf8');\n  } catch {\n    return undefined;\n  }\n}\n\n/** `iv | tag | ciphertext`, the layout of the stored key check. */\nexport function packBox(box: SealedBox): Uint8Array {\n  return Buffer.concat([box.iv, box.tag, box.ciphertext]);\n}\n\nexport function unpackBox(packed: Uint8Array): SealedBox | undefined {\n  const bytes = Buffer.from(packed.buffer, packed.byteOffset, packed.byteLength);\n  if (bytes.length <= VAULT_IV_BYTES + VAULT_TAG_BYTES) return undefined;\n  return {\n    iv: bytes.subarray(0, VAULT_IV_BYTES),\n    tag: bytes.subarray(VAULT_IV_BYTES, VAULT_IV_BYTES + VAULT_TAG_BYTES),\n    ciphertext: bytes.subarray(VAULT_IV_BYTES + VAULT_TAG_BYTES),\n  };\n}\n\nexport function randomKey(): Uint8Array {\n  return randomBytes(VAULT_KEY_BYTES);\n}\n","import { Buffer } from 'node:buffer';\nimport { randomBytes, randomUUID } from 'node:crypto';\n\nimport type { PoDbMigration } from '@agimon-ai/po-db';\n\nimport {\n  VAULT_CHECK_AAD,\n  VAULT_CHECK_PLAINTEXT,\n  VAULT_DB_PREFIX,\n  VAULT_ID_BYTES,\n  VAULT_INIT_LEASE,\n  VAULT_KEY_BYTES,\n  VAULT_KEY_LOST_NOTICE,\n  VAULT_KEYRING_ACCOUNT_PREFIX,\n  VAULT_LEASE_JITTER_MS,\n  VAULT_LEASE_POLL_MS,\n  VAULT_LEASE_RENEW_MS,\n  VAULT_LEASE_TTL_MS,\n  VAULT_LEASE_WAIT_MS,\n  VAULT_META_CHECK,\n  VAULT_META_ID,\n} from '../../constants/vault';\nimport { open, packBox, randomKey, seal, unpackBox } from '../vaultCrypto';\nimport type { SealedBox } from '../vaultCrypto/type';\nimport { asVaultError, assertEntryName, assertRevision, serializeValue, VaultError } from '../vaultRules';\nimport type {\n  CreateVaultOptions,\n  VaultDeleteOptions,\n  VaultHandle,\n  VaultKeyring,\n  VaultPutOptions,\n  VaultRecord,\n  VaultValue,\n} from './type';\n\n/** The vault's schema in po-db. Every object carries the `vault_` prefix po-db enforces. */\nexport const VAULT_MIGRATIONS: readonly PoDbMigration[] = [\n  {\n    version: 1,\n    statements: [\n      'CREATE TABLE vault_meta (name TEXT PRIMARY KEY, value BLOB NOT NULL) STRICT, WITHOUT ROWID',\n      `CREATE TABLE vault_entries (\n        namespace TEXT NOT NULL, key TEXT NOT NULL,\n        revision INTEGER NOT NULL CHECK (revision >= 1), updated_at INTEGER NOT NULL,\n        iv BLOB NOT NULL CHECK (length(iv) = 12), tag BLOB NOT NULL CHECK (length(tag) = 16),\n        ciphertext BLOB NOT NULL, PRIMARY KEY (namespace, key)\n      ) STRICT, WITHOUT ROWID`,\n      'CREATE TABLE vault_lease (name TEXT PRIMARY KEY, owner TEXT NOT NULL, expires_at INTEGER NOT NULL) STRICT, WITHOUT ROWID',\n    ],\n  },\n];\n\ninterface EntryRow {\n  revision: number;\n  updated_at: number;\n  iv: Uint8Array;\n  tag: Uint8Array;\n  ciphertext: Uint8Array;\n}\n\ninterface WrittenRow {\n  revision: number;\n  updated_at: number;\n}\n\ninterface LoadedKey {\n  readonly key: Uint8Array;\n  /** The `dek_check` bytes this key was proven against. */\n  readonly check: Uint8Array;\n}\n\ninterface Candidate {\n  readonly source: 'keyring' | 'file';\n  readonly key: Uint8Array;\n}\n\ninterface Gathered {\n  readonly candidates: readonly Candidate[];\n  readonly keyring: VaultKeyring | null;\n  readonly keyringFailed: boolean;\n  readonly fileFailed: boolean;\n}\n\nconst SELECT_ENTRY =\n  'SELECT revision, updated_at, iv, tag, ciphertext FROM vault_entries WHERE namespace = ? AND key = ?';\nconst PUT_LAST_WRITE_WINS = `INSERT INTO vault_entries (namespace, key, revision, updated_at, iv, tag, ciphertext)\n  VALUES (?, ?, 1, ?, ?, ?, ?)\n  ON CONFLICT (namespace, key) DO UPDATE SET revision = vault_entries.revision + 1, updated_at = excluded.updated_at,\n    iv = excluded.iv, tag = excluded.tag, ciphertext = excluded.ciphertext\n  RETURNING revision, updated_at`;\nconst PUT_CREATE_ONLY = `INSERT INTO vault_entries (namespace, key, revision, updated_at, iv, tag, ciphertext)\n  VALUES (?, ?, 1, ?, ?, ?, ?)\n  ON CONFLICT (namespace, key) DO NOTHING\n  RETURNING revision, updated_at`;\nconst PUT_EXPECT_REVISION = `UPDATE vault_entries SET revision = ?, updated_at = ?, iv = ?, tag = ?, ciphertext = ?\n  WHERE namespace = ? AND key = ? AND revision = ?\n  RETURNING revision, updated_at`;\nconst ACQUIRE_LEASE = `INSERT INTO vault_lease (name, owner, expires_at) VALUES (?, ?, ?)\n  ON CONFLICT (name) DO UPDATE SET owner = excluded.owner, expires_at = excluded.expires_at\n  WHERE vault_lease.expires_at < ? OR vault_lease.owner = excluded.owner\n  RETURNING owner`;\nconst RELEASE_LEASE = 'DELETE FROM vault_lease WHERE name = ? AND owner = ?';\nconst SELECT_META = 'SELECT value FROM vault_meta WHERE name = ?';\nconst INSERT_META = 'INSERT INTO vault_meta (name, value) VALUES (?, ?) ON CONFLICT (name) DO NOTHING';\nconst REPLACE_META =\n  'INSERT INTO vault_meta (name, value) VALUES (?, ?) ON CONFLICT (name) DO UPDATE SET value = excluded.value';\n\nfunction entryAad(namespace: string, key: string): string {\n  return `${namespace}\\0${key}`;\n}\n\nfunction bytesEqual(left: Uint8Array, right: Uint8Array): boolean {\n  return Buffer.compare(left, right) === 0;\n}\n\nfunction boxOf(row: EntryRow): SealedBox {\n  return { iv: row.iv, tag: row.tag, ciphertext: row.ciphertext };\n}\n\nfunction provesKey(key: Uint8Array, check: Uint8Array): boolean {\n  const box = unpackBox(check);\n  return box !== undefined && open(key, box, VAULT_CHECK_AAD) === VAULT_CHECK_PLAINTEXT;\n}\n\nfunction isBusy(error: unknown): boolean {\n  if (error === null || typeof error !== 'object') return false;\n  const code = 'errcode' in error ? error.errcode : undefined;\n  // SQLITE_BUSY and SQLITE_LOCKED.\n  if (code === 5 || code === 6) return true;\n  return error instanceof Error && /database (?:table )?is locked|SQLITE_BUSY/u.test(error.message);\n}\n\nfunction sleep(ms: number, signal: AbortSignal | undefined): Promise<void> {\n  return new Promise((resolve, reject) => {\n    const onAbort = () => {\n      clearTimeout(timer);\n      reject(signal?.reason);\n    };\n    const timer = setTimeout(() => {\n      signal?.removeEventListener('abort', onAbort);\n      resolve();\n    }, ms);\n    signal?.addEventListener('abort', onAbort, { once: true });\n  });\n}\n\n/**\n * The vault on po-db: AES-256-GCM rows in `vault_entries` under one data-encryption key kept in\n * the OS keyring or, without one, in an owner-only `key.bin`.\n *\n * Every read and write is a single statement, so nothing here holds the shared connection's\n * write lock across a network call. Cross-process work that must span one goes through\n * `withLock`, a lease row with a TTL.\n */\nexport function createVault(options: CreateVaultOptions): VaultHandle {\n  const { db, directory, keyFiles, onNotice } = options;\n  const database = db.database;\n  const now = options.now ?? Date.now;\n  const leaseTtlMs = options.leaseTtlMs ?? VAULT_LEASE_TTL_MS;\n  const leaseRenewMs = options.leaseRenewMs ?? VAULT_LEASE_RENEW_MS;\n  const leaseWaitMs = options.leaseWaitMs ?? VAULT_LEASE_WAIT_MS;\n  const renewals = new Set<ReturnType<typeof setInterval>>();\n  let migrated: Promise<void> | undefined;\n  let loaded: Promise<LoadedKey> | undefined;\n  let keyringModule: Promise<VaultKeyring | null> | undefined;\n  let backend: 'keyring' | 'file' | undefined;\n  let closed = false;\n\n  async function guarded<T>(work: () => Promise<T>): Promise<T> {\n    try {\n      return await work();\n    } catch (error) {\n      throw asVaultError(error);\n    }\n  }\n\n  function ready(): Promise<void> {\n    migrated ??= guarded(() => db.migrate(VAULT_DB_PREFIX, VAULT_MIGRATIONS)).catch((error: unknown) => {\n      migrated = undefined;\n      throw error;\n    });\n    return migrated;\n  }\n\n  async function readMeta(name: string): Promise<Uint8Array | undefined> {\n    return (await database.get<{ value: Uint8Array }>(SELECT_META, name))?.value;\n  }\n\n  async function keyringAccount(): Promise<string> {\n    await database.run(INSERT_META, VAULT_META_ID, randomBytes(VAULT_ID_BYTES));\n    const id = await readMeta(VAULT_META_ID);\n    if (id === undefined) throw new VaultError('unavailable');\n    return `${VAULT_KEYRING_ACCOUNT_PREFIX}${Buffer.from(id).toString('hex')}`;\n  }\n\n  async function gather(account: string): Promise<Gathered> {\n    keyringModule ??= options.keyring().catch(() => null);\n    const keyring = await keyringModule;\n    const candidates: Candidate[] = [];\n    let keyringFailed = false;\n    let fileFailed = false;\n    if (keyring !== null) {\n      try {\n        const password = await keyring.getPassword(account);\n        if (password !== null) {\n          const key = Buffer.from(password, 'base64');\n          if (key.length === VAULT_KEY_BYTES) candidates.push({ source: 'keyring', key });\n          else keyringFailed = true;\n        }\n      } catch {\n        keyringFailed = true;\n      }\n    }\n    try {\n      const key = await keyFiles.readKeyFile(directory);\n      if (key !== undefined) candidates.push({ source: 'file', key });\n    } catch {\n      fileFailed = true;\n    }\n    return { candidates, keyring, keyringFailed, fileFailed };\n  }\n\n  /** The first candidate that decrypts `dek_check`, seeding the check from the first candidate when there is none. */\n  async function pick(gathered: Gathered): Promise<LoadedKey | undefined> {\n    let check = await readMeta(VAULT_META_CHECK);\n    if (check === undefined) {\n      const first = gathered.candidates[0];\n      if (first === undefined) return undefined;\n      await database.run(\n        INSERT_META,\n        VAULT_META_CHECK,\n        packBox(seal(first.key, VAULT_CHECK_PLAINTEXT, VAULT_CHECK_AAD)),\n      );\n      check = await readMeta(VAULT_META_CHECK);\n      if (check === undefined) return undefined;\n    }\n    for (const candidate of gathered.candidates) {\n      if (!provesKey(candidate.key, check)) continue;\n      backend = candidate.source;\n      return { key: candidate.key, check };\n    }\n    return undefined;\n  }\n\n  /**\n   * A source that failed may still hold the real key, so no new key replaces it. A throwing\n   * keyring only blocks once a check row exists: before that there is nothing to lose, and a\n   * host whose keyring daemon is missing falls back to `key.bin`.\n   */\n  function blocked(gathered: Gathered, check: Uint8Array | undefined): boolean {\n    return gathered.fileFailed || (gathered.keyringFailed && check !== undefined);\n  }\n\n  /** Stores a new key in the keyring, read back to prove it; otherwise in a new `key.bin`. Never both. */\n  async function store(gathered: Gathered, account: string, key: Uint8Array): Promise<'keyring' | 'file'> {\n    if (gathered.keyring !== null) {\n      const encoded = Buffer.from(key).toString('base64');\n      try {\n        await gathered.keyring.setPassword(account, encoded);\n        if ((await gathered.keyring.getPassword(account)) === encoded) return 'keyring';\n      } catch {\n        // Falls through to the key file.\n      }\n    }\n    // A key.bin that failed the check belongs to no key this database knows; O_EXCL needs it gone.\n    if (gathered.candidates.some((candidate) => candidate.source === 'file')) await keyFiles.removeKeyFile(directory);\n    await keyFiles.createKeyFile(directory, key);\n    return 'file';\n  }\n\n  async function loadKey(): Promise<LoadedKey> {\n    await ready();\n    const account = await keyringAccount();\n    const first = await gather(account);\n    const found = await pick(first);\n    if (found !== undefined) return found;\n    if (blocked(first, await readMeta(VAULT_META_CHECK))) throw new VaultError('unavailable');\n    return lease(VAULT_INIT_LEASE, async () => {\n      const again = await gather(account);\n      const existing = await pick(again);\n      if (existing !== undefined) return existing;\n      const check = await readMeta(VAULT_META_CHECK);\n      if (blocked(again, check)) throw new VaultError('unavailable');\n      const key = randomKey();\n      const source = await store(again, account, key);\n      const packed = packBox(seal(key, VAULT_CHECK_PLAINTEXT, VAULT_CHECK_AAD));\n      if (check === undefined) {\n        await database.run(REPLACE_META, VAULT_META_CHECK, packed);\n      } else {\n        // The old key is gone, so its rows can never be read again.\n        await database.transaction(async (transaction) => {\n          await transaction.run('DELETE FROM vault_entries');\n          await transaction.run(REPLACE_META, VAULT_META_CHECK, packed);\n        });\n        onNotice(VAULT_KEY_LOST_NOTICE);\n      }\n      backend = source;\n      return { key, check: packed };\n    });\n  }\n\n  function currentKey(): Promise<LoadedKey> {\n    loaded ??= guarded(loadKey).catch((error: unknown) => {\n      loaded = undefined;\n      throw error;\n    });\n    return loaded;\n  }\n\n  /** The key, reloaded first when another process has replaced `dek_check` since it was loaded. */\n  async function freshKey(): Promise<LoadedKey> {\n    const cached = await currentKey();\n    const check = await guarded(() => readMeta(VAULT_META_CHECK));\n    if (check !== undefined && bytesEqual(check, cached.check)) return cached;\n    if (loaded !== undefined && (await loaded) === cached) loaded = undefined;\n    return currentKey();\n  }\n\n  async function tryAcquire(name: string, owner: string): Promise<boolean> {\n    const at = now();\n    try {\n      return (await database.get(ACQUIRE_LEASE, name, owner, at + leaseTtlMs, at)) !== undefined;\n    } catch (error) {\n      if (isBusy(error)) return false;\n      throw new VaultError('unavailable');\n    }\n  }\n\n  async function lease<T>(name: string, op: (signal: AbortSignal) => Promise<T>, signal?: AbortSignal): Promise<T> {\n    if (closed) throw new VaultError('unavailable');\n    await ready();\n    const owner = randomUUID();\n    const deadline = now() + leaseWaitMs;\n    for (;;) {\n      signal?.throwIfAborted();\n      if (await tryAcquire(name, owner)) break;\n      if (now() >= deadline) throw new VaultError('unavailable');\n      await sleep(VAULT_LEASE_POLL_MS + Math.random() * VAULT_LEASE_JITTER_MS, signal);\n    }\n    const controller = new AbortController();\n    const onAbort = () => controller.abort(signal?.reason);\n    signal?.addEventListener('abort', onAbort, { once: true });\n    const timer = setInterval(() => {\n      tryAcquire(name, owner).then(\n        (held) => {\n          if (!held) controller.abort(new VaultError('unavailable'));\n        },\n        // ponytail: a failed renewal waits for the next tick; the TTL decides whether the lease survives.\n        () => undefined,\n      );\n    }, leaseRenewMs);\n    timer.unref?.();\n    renewals.add(timer);\n    try {\n      return await op(controller.signal);\n    } finally {\n      clearInterval(timer);\n      renewals.delete(timer);\n      signal?.removeEventListener('abort', onAbort);\n      try {\n        await database.run(RELEASE_LEASE, name, owner);\n      } catch {\n        // The TTL releases a lease whose delete failed.\n      }\n    }\n  }\n\n  async function writeRow(sql: string, params: readonly (string | number | Uint8Array)[]): Promise<WrittenRow> {\n    const row = await guarded(() => database.get<WrittenRow>(sql, ...params));\n    if (row === undefined) throw new VaultError('conflict');\n    return row;\n  }\n\n  return {\n    async get(namespace: string, key: string): Promise<VaultRecord | undefined> {\n      assertEntryName(namespace, key);\n      await ready();\n      const row = await guarded(() => database.get<EntryRow>(SELECT_ENTRY, namespace, key));\n      if (row === undefined) return undefined;\n      const aad = entryAad(namespace, key);\n      let loadedKey = await currentKey();\n      let text = open(loadedKey.key, boxOf(row), aad);\n      if (text === undefined) {\n        const check = await guarded(() => readMeta(VAULT_META_CHECK));\n        if (check === undefined || !provesKey(loadedKey.key, check)) {\n          loaded = undefined;\n          loadedKey = await currentKey();\n          text = open(loadedKey.key, boxOf(row), aad);\n        }\n      }\n      if (text === undefined) {\n        // The key is right and the row still fails: it was tampered with or moved; nobody can read it.\n        await guarded(() =>\n          database.run(\n            'DELETE FROM vault_entries WHERE namespace = ? AND key = ? AND revision = ?',\n            namespace,\n            key,\n            row.revision,\n          ),\n        );\n        return undefined;\n      }\n      return { value: JSON.parse(text) as VaultValue, revision: row.revision, updatedAt: row.updated_at };\n    },\n\n    async put(namespace: string, key: string, value: VaultValue, putOptions?: VaultPutOptions): Promise<VaultRecord> {\n      assertEntryName(namespace, key);\n      const expectRevision = putOptions?.expectRevision;\n      if (expectRevision !== undefined && expectRevision !== null) assertRevision(expectRevision);\n      const text = serializeValue(value);\n      await ready();\n      const loadedKey = await freshKey();\n      const box = seal(loadedKey.key, text, entryAad(namespace, key));\n      const at = now();\n      const row =\n        expectRevision === undefined\n          ? await writeRow(PUT_LAST_WRITE_WINS, [namespace, key, at, box.iv, box.tag, box.ciphertext])\n          : expectRevision === null\n            ? await writeRow(PUT_CREATE_ONLY, [namespace, key, at, box.iv, box.tag, box.ciphertext])\n            : await writeRow(PUT_EXPECT_REVISION, [\n                expectRevision + 1,\n                at,\n                box.iv,\n                box.tag,\n                box.ciphertext,\n                namespace,\n                key,\n                expectRevision,\n              ]);\n      return { value: JSON.parse(text) as VaultValue, revision: row.revision, updatedAt: row.updated_at };\n    },\n\n    async delete(namespace: string, key: string, deleteOptions?: VaultDeleteOptions): Promise<void> {\n      assertEntryName(namespace, key);\n      const expectRevision = deleteOptions?.expectRevision;\n      if (expectRevision !== undefined) assertRevision(expectRevision);\n      await ready();\n      if (expectRevision === undefined) {\n        await guarded(() => database.run('DELETE FROM vault_entries WHERE namespace = ? AND key = ?', namespace, key));\n        return;\n      }\n      await writeRow(\n        'DELETE FROM vault_entries WHERE namespace = ? AND key = ? AND revision = ? RETURNING revision, 0 AS updated_at',\n        [namespace, key, expectRevision],\n      );\n    },\n\n    withLock<T>(\n      namespace: string,\n      key: string,\n      op: (signal: AbortSignal) => Promise<T>,\n      signal?: AbortSignal,\n    ): Promise<T> {\n      try {\n        assertEntryName(namespace, key);\n      } catch (error) {\n        return Promise.reject(error);\n      }\n      if (typeof op !== 'function') return Promise.reject(new VaultError('invalid'));\n      return lease(entryAad(namespace, key), op, signal);\n    },\n\n    status() {\n      return { backend };\n    },\n\n    close(): void {\n      closed = true;\n      for (const timer of renewals) clearInterval(timer);\n      renewals.clear();\n    },\n  };\n}\n","import { constants } from 'node:fs';\nimport { lstat, mkdir, open, chmod, unlink } from 'node:fs/promises';\nimport path from 'node:path';\n\nimport { VAULT_DIRECTORY_MODE, VAULT_KEY_BYTES, VAULT_KEY_FILE, VAULT_KEY_FILE_MODE } from '../../constants/vault';\nimport { VaultError } from '../vaultRules';\n\n/** Windows has no O_NOFOLLOW; there a plain open stands in. */\nconst NO_FOLLOW = constants.O_NOFOLLOW ?? 0;\nconst GROUP_OTHER_BITS = 0o077;\nconst POSIX = process.platform !== 'win32';\n\nfunction currentUid(): number | undefined {\n  return typeof process.getuid === 'function' ? process.getuid() : undefined;\n}\n\nfunction ownedByUser(uid: number): boolean {\n  const user = currentUid();\n  return user === undefined || uid === user;\n}\n\nfunction errorCode(error: unknown): string | undefined {\n  return error !== null && typeof error === 'object' && 'code' in error ? String(error.code) : undefined;\n}\n\n/**\n * Creates `directory` owner-only, or checks and repairs an existing one.\n *\n * Refuses a symlink, a non-directory and a folder another user owns. Loose permission bits\n * are tightened to 0700.\n */\nexport async function preparePrivateDirectory(directory: string): Promise<void> {\n  try {\n    await mkdir(directory, { recursive: true, mode: VAULT_DIRECTORY_MODE });\n    const stats = await lstat(directory);\n    if (stats.isSymbolicLink() || !stats.isDirectory() || !ownedByUser(stats.uid)) throw new VaultError('unavailable');\n    if (POSIX && (stats.mode & GROUP_OTHER_BITS) !== 0) await chmod(directory, VAULT_DIRECTORY_MODE);\n  } catch (error) {\n    throw error instanceof VaultError ? error : new VaultError('unavailable');\n  }\n}\n\n/**\n * The 32-byte key in `<directory>/key.bin`, or `undefined` when there is none.\n *\n * The file must be a regular, owner-only file with one link, opened without following a\n * symlink; anything else throws `unavailable` so the caller never replaces a key it could not read.\n */\nexport async function readKeyFile(directory: string): Promise<Uint8Array | undefined> {\n  let handle;\n  try {\n    handle = await open(path.join(directory, VAULT_KEY_FILE), constants.O_RDONLY | NO_FOLLOW);\n  } catch (error) {\n    if (errorCode(error) === 'ENOENT' || errorCode(error) === 'ENOTDIR') return undefined;\n    throw new VaultError('unavailable');\n  }\n  try {\n    const stats = await handle.stat();\n    if (\n      !stats.isFile() ||\n      stats.nlink !== 1 ||\n      !ownedByUser(stats.uid) ||\n      (POSIX && (stats.mode & GROUP_OTHER_BITS) !== 0) ||\n      stats.size !== VAULT_KEY_BYTES\n    ) {\n      throw new VaultError('unavailable');\n    }\n    const key = Buffer.alloc(VAULT_KEY_BYTES);\n    const { bytesRead } = await handle.read(key, 0, VAULT_KEY_BYTES, 0);\n    if (bytesRead !== VAULT_KEY_BYTES) throw new VaultError('unavailable');\n    return key;\n  } catch (error) {\n    throw error instanceof VaultError ? error : new VaultError('unavailable');\n  } finally {\n    await handle.close();\n  }\n}\n\n/** Writes a new `key.bin` (0600, exclusive create, no symlink follow) and syncs it to disk. */\nexport async function createKeyFile(directory: string, key: Uint8Array): Promise<void> {\n  if (key.length !== VAULT_KEY_BYTES) throw new VaultError('invalid');\n  await preparePrivateDirectory(directory);\n  try {\n    const handle = await open(\n      path.join(directory, VAULT_KEY_FILE),\n      constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | NO_FOLLOW,\n      VAULT_KEY_FILE_MODE,\n    );\n    try {\n      await handle.write(key, 0, key.length, 0);\n      await handle.sync();\n    } finally {\n      await handle.close();\n    }\n  } catch {\n    throw new VaultError('unavailable');\n  }\n}\n\n/** Removes a `key.bin` the vault proved stale; a missing file is fine. */\nexport async function removeKeyFile(directory: string): Promise<void> {\n  try {\n    await unlink(path.join(directory, VAULT_KEY_FILE));\n  } catch (error) {\n    if (errorCode(error) !== 'ENOENT') throw new VaultError('unavailable');\n  }\n}\n","import { VAULT_KEYRING_SERVICE } from '../../constants/vault';\nimport type { VaultKeyring } from '../vault/type';\n\n/**\n * The OS keyring through `@napi-rs/keyring`, loaded on first use, or `null` when this platform\n * has no build of the module.\n */\nexport async function loadKeyring(): Promise<VaultKeyring | null> {\n  try {\n    const { AsyncEntry } = await import('@napi-rs/keyring');\n    return {\n      getPassword: (account) => new AsyncEntry(VAULT_KEYRING_SERVICE, account).getPassword(),\n      setPassword: (account, password) => new AsyncEntry(VAULT_KEYRING_SERVICE, account).setPassword(password),\n    };\n  } catch {\n    return null;\n  }\n}\n","import path from 'node:path';\n\nimport type { RootDeclaration } from '@agimon-ai/po-core/extensionFile';\nimport { poHomeDirectory } from '@agimon-ai/po-core/piSettings';\nimport {\n  PO_SERVER_SCOPE_SERVICE,\n  requirePoServerScope,\n  type PoServerPluginContext,\n} from '@agimon-ai/po-core/serverPlugin';\nimport { PO_DB_SERVICE, requirePoDb, type PoDb } from '@agimon-ai/po-db';\n\nimport { VAULT_DIRECTORY } from '../../../constants/vault';\nimport { PO_VAULT_CONTRACT } from '../../../schemas/contracts';\nimport { createVault } from '../../../services/vault';\nimport type { VaultHandle } from '../../../services/vault/type';\nimport { createKeyFile, readKeyFile, removeKeyFile } from '../../../services/vaultDirectory';\nimport { loadKeyring } from '../../../services/vaultKeyring';\n\n/**\n * The vault, bound as `po/vault` at the global level on top of the shared `po/db`.\n *\n * Only a global host with a home directory builds it. The vault loads its key lazily on first\n * use, so mounting never touches the keyring or `<po home>/vault`.\n */\nexport async function createPoVaultGlobalRoot(\n  plugin: PoServerPluginContext,\n): Promise<RootDeclaration<VaultHandle | undefined, PoServerPluginContext>> {\n  const host = plugin.host;\n  const homeDirectory = host.context.homeDirectory;\n  if (host.scope !== 'global' || homeDirectory === undefined) return { value: undefined };\n  const directory = path.join(poHomeDirectory(homeDirectory, host.context.environment ?? {}), VAULT_DIRECTORY);\n  let vault: VaultHandle | undefined;\n  let boundDb: PoDb | undefined;\n  const provider = plugin.context.inject([PO_SERVER_SCOPE_SERVICE, PO_DB_SERVICE], (injected) => {\n    // One vault per po-db binding; a re-run of this fiber with the same database only publishes it again.\n    const db = requirePoDb(injected);\n    if (vault === undefined || boundDb !== db) {\n      vault?.close();\n      boundDb = db;\n      vault = createVault({\n        db,\n        directory,\n        keyring: loadKeyring,\n        keyFiles: { readKeyFile, createKeyFile, removeKeyFile },\n        onNotice: (message) => host.context.onNotice(`Vault: ${message}`),\n      });\n    }\n    return requirePoServerScope(injected).provide(PO_VAULT_CONTRACT, vault);\n  });\n  await provider.await();\n  return {\n    value: vault,\n    onDispose: async () => {\n      await provider.dispose();\n      vault?.close();\n    },\n  };\n}\n","import { defineRoot } from '@agimon-ai/po-core/extensionFile';\nimport { PO_DB_CONTRACT } from '@agimon-ai/po-db';\n\nimport { createPoVaultGlobalRoot } from './_lib/root.server';\n\nexport default defineRoot(createPoVaultGlobalRoot, { inject: [PO_DB_CONTRACT] });\n","// Generated by @agimon-ai/po-build. Do not edit by hand.\nimport { defineServerPlugin, type PoServerSessionPlugin } from '@agimon-ai/po-core/serverPlugin';\nimport { composeServerProviderOverrides } from '@agimon-ai/po-core/serverPlugin';\nimport { composeRootHooks, composeRootInjects } from '@agimon-ai/po-core/extensionFile';\n\nimport rootGlobal from '../src/extensions/(backend)/root.server';\n\nexport const serverPlugin = defineServerPlugin({\n  name: '@agimon-ai/po-vault',\n  providerOverrides: composeServerProviderOverrides(rootGlobal),\n  injects: composeRootInjects({ global: [rootGlobal], workspace: [rootGlobal], session: [rootGlobal] }),\n  global: async (context) => {\n    const scopeGlobal = await context.scopeRoot('global', rootGlobal, context);\n    return {\n      ...composeRootHooks(scopeGlobal),\n      services: [...(scopeGlobal.services ?? [])],\n    };\n  },\n  workspace: async (context) => {\n    const scopeGlobal = await context.scopeRoot('global', rootGlobal, context);\n    return {\n      ...composeRootHooks(scopeGlobal),\n      services: [...(scopeGlobal.services ?? [])],\n    };\n  },\n  session: async (context) => {\n    const scopeGlobal = await context.scopeRoot('global', rootGlobal, context);\n    return {\n      ...composeRootHooks(scopeGlobal),\n      services: [...(scopeGlobal.services ?? [])],\n      get activities(): PoServerSessionPlugin['activities'] { return [...(scopeGlobal.activities ?? [])]; },\n    };\n  },\n});\n\nexport default serverPlugin;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,SAAgB,KAAK,KAAiB,WAAmB,KAAwB;CAC/E,MAAM,MAAA,GAAKA,YAAAA,YAAAA,CAAAA,EAA0B;CACrC,MAAM,UAAA,GAASC,YAAAA,eAAAA,CAAe,eAAe,KAAK,EAAE;CACpD,OAAO,OAAOC,YAAAA,OAAO,KAAK,KAAK,MAAM,CAAC;CACtC,MAAM,aAAaA,YAAAA,OAAO,OAAO,CAAC,OAAO,OAAO,WAAW,MAAM,GAAG,OAAO,MAAM,CAAC,CAAC;CACnF,OAAO;EAAE;EAAI,KAAK,OAAO,WAAW;EAAG;CAAW;AACpD;;AAGA,SAAgBC,OAAK,KAAiB,KAAgB,KAAiC;CACrF,IAAI,IAAI,WAAA,MAA8B,IAAI,GAAG,WAAA,MAA6B,IAAI,IAAI,WAAA,IAChF,OAAO,KAAA;CACT,IAAI;EACF,MAAM,YAAA,GAAWC,YAAAA,iBAAAA,CAAiB,eAAe,KAAK,IAAI,EAAE;EAC5D,SAAS,OAAOF,YAAAA,OAAO,KAAK,KAAK,MAAM,CAAC;EACxC,SAAS,WAAW,IAAI,GAAG;EAC3B,OAAOA,YAAAA,OAAO,OAAO,CAAC,SAAS,OAAO,IAAI,UAAU,GAAG,SAAS,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM;CAC3F,QAAQ;EACN;CACF;AACF;;AAGA,SAAgB,QAAQ,KAA4B;CAClD,OAAOA,YAAAA,OAAO,OAAO;EAAC,IAAI;EAAI,IAAI;EAAK,IAAI;CAAU,CAAC;AACxD;AAEA,SAAgB,UAAU,QAA2C;CACnE,MAAM,QAAQA,YAAAA,OAAO,KAAK,OAAO,QAAQ,OAAO,YAAY,OAAO,UAAU;CAC7E,IAAI,MAAM,UAAA,IAA4C,OAAO,KAAA;CAC7D,OAAO;EACL,IAAI,MAAM,SAAS,GAAA,EAAiB;EACpC,KAAK,MAAM,SAAA,IAAA,EAAyD;EACpE,YAAY,MAAM,SAAA,EAAyC;CAC7D;AACF;AAEA,SAAgB,YAAwB;CACtC,QAAA,GAAOF,YAAAA,YAAAA,CAAAA,EAA2B;AACpC;;;;ACVA,MAAa,mBAA6C,CACxD;CACE,SAAS;CACT,YAAY;EACV;EACA;;;;;;EAMA;CACF;AACF,CACF;AAiCA,MAAM,eACJ;AACF,MAAM,sBAAsB;;;;;AAK5B,MAAM,kBAAkB;;;;AAIxB,MAAM,sBAAsB;;;AAG5B,MAAM,gBAAgB;;;;AAItB,MAAM,gBAAgB;AACtB,MAAM,cAAc;AACpB,MAAM,cAAc;AACpB,MAAM,eACJ;AAEF,SAAS,SAAS,WAAmB,KAAqB;CACxD,OAAO,GAAG,UAAU,IAAI;AAC1B;AAEA,SAAS,WAAW,MAAkB,OAA4B;CAChE,OAAOK,YAAAA,OAAO,QAAQ,MAAM,KAAK,MAAM;AACzC;AAEA,SAAS,MAAM,KAA0B;CACvC,OAAO;EAAE,IAAI,IAAI;EAAI,KAAK,IAAI;EAAK,YAAY,IAAI;CAAW;AAChE;AAEA,SAAS,UAAU,KAAiB,OAA4B;CAC9D,MAAM,MAAM,UAAU,KAAK;CAC3B,OAAO,QAAQ,KAAA,KAAaC,OAAK,KAAK,KAAA,gBAAoB,MAAA;AAC5D;AAEA,SAAS,OAAO,OAAyB;CACvC,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,MAAM,OAAO,aAAa,QAAQ,MAAM,UAAU,KAAA;CAElD,IAAI,SAAS,KAAK,SAAS,GAAG,OAAO;CACrC,OAAO,iBAAiB,SAAS,6CAA6C,KAAK,MAAM,OAAO;AAClG;AAEA,SAAS,MAAM,IAAY,QAAgD;CACzE,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,gBAAgB;GACpB,aAAa,KAAK;GAClB,OAAO,QAAQ,MAAM;EACvB;EACA,MAAM,QAAQ,iBAAiB;GAC7B,QAAQ,oBAAoB,SAAS,OAAO;GAC5C,QAAQ;EACV,GAAG,EAAE;EACL,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CAC3D,CAAC;AACH;;;;;;;;;AAUA,SAAgB,YAAY,SAA0C;CACpE,MAAM,EAAE,IAAI,WAAW,UAAU,aAAa;CAC9C,MAAM,WAAW,GAAG;CACpB,MAAM,MAAM,QAAQ,OAAO,KAAK;CAChC,MAAM,aAAa,QAAQ,cAAA;CAC3B,MAAM,eAAe,QAAQ,gBAAA;CAC7B,MAAM,cAAc,QAAQ,eAAA;CAC5B,MAAM,2BAAW,IAAI,IAAoC;CACzD,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI,SAAS;CAEb,eAAe,QAAW,MAAoC;EAC5D,IAAI;GACF,OAAO,MAAM,KAAK;EACpB,SAAS,OAAO;GACd,MAAMC,mBAAAA,aAAa,KAAK;EAC1B;CACF;CAEA,SAAS,QAAuB;EAC9B,aAAa,cAAc,GAAG,QAAQC,mBAAAA,iBAAiB,gBAAgB,CAAC,CAAC,CAAC,OAAO,UAAmB;GAClG,WAAW,KAAA;GACX,MAAM;EACR,CAAC;EACD,OAAO;CACT;CAEA,eAAe,SAAS,MAA+C;EACrE,QAAQ,MAAM,SAAS,IAA2B,aAAa,IAAI,EAAA,EAAI;CACzE;CAEA,eAAe,iBAAkC;EAC/C,MAAM,SAAS,IAAI,aAAaC,mBAAAA,gBAAAA,GAAeC,YAAAA,YAAAA,CAAAA,EAA0B,CAAC;EAC1E,MAAM,KAAK,MAAM,SAASD,mBAAAA,aAAa;EACvC,IAAI,OAAO,KAAA,GAAW,MAAM,IAAIE,mBAAAA,WAAW,aAAa;EACxD,OAAO,GAAGC,mBAAAA,+BAA+BP,YAAAA,OAAO,KAAK,EAAE,CAAC,CAAC,SAAS,KAAK;CACzE;CAEA,eAAe,OAAO,SAAoC;EACxD,kBAAkB,QAAQ,QAAQ,CAAC,CAAC,YAAY,IAAI;EACpD,MAAM,UAAU,MAAM;EACtB,MAAM,aAA0B,CAAC;EACjC,IAAI,gBAAgB;EACpB,IAAI,aAAa;EACjB,IAAI,YAAY,MACd,IAAI;GACF,MAAM,WAAW,MAAM,QAAQ,YAAY,OAAO;GAClD,IAAI,aAAa,MAAM;IACrB,MAAM,MAAMA,YAAAA,OAAO,KAAK,UAAU,QAAQ;IAC1C,IAAI,IAAI,WAAA,IAA4B,WAAW,KAAK;KAAE,QAAQ;KAAW;IAAI,CAAC;SACzE,gBAAgB;GACvB;EACF,QAAQ;GACN,gBAAgB;EAClB;EAEF,IAAI;GACF,MAAM,MAAM,MAAM,SAAS,YAAY,SAAS;GAChD,IAAI,QAAQ,KAAA,GAAW,WAAW,KAAK;IAAE,QAAQ;IAAQ;GAAI,CAAC;EAChE,QAAQ;GACN,aAAa;EACf;EACA,OAAO;GAAE;GAAY;GAAS;GAAe;EAAW;CAC1D;;CAGA,eAAe,KAAK,UAAoD;EACtE,IAAI,QAAQ,MAAM,SAASQ,mBAAAA,gBAAgB;EAC3C,IAAI,UAAU,KAAA,GAAW;GACvB,MAAM,QAAQ,SAAS,WAAW;GAClC,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;GAChC,MAAM,SAAS,IACb,aACAA,mBAAAA,kBACA,QAAQ,KAAK,MAAM,KAAKC,mBAAAA,uBAAuBC,mBAAAA,eAAe,CAAC,CACjE;GACA,QAAQ,MAAM,SAASF,mBAAAA,gBAAgB;GACvC,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;EAClC;EACA,KAAK,MAAM,aAAa,SAAS,YAAY;GAC3C,IAAI,CAAC,UAAU,UAAU,KAAK,KAAK,GAAG;GACtC,UAAU,UAAU;GACpB,OAAO;IAAE,KAAK,UAAU;IAAK;GAAM;EACrC;CAEF;;;;;;CAOA,SAAS,QAAQ,UAAoB,OAAwC;EAC3E,OAAO,SAAS,cAAe,SAAS,iBAAiB,UAAU,KAAA;CACrE;;CAGA,eAAe,MAAM,UAAoB,SAAiB,KAA8C;EACtG,IAAI,SAAS,YAAY,MAAM;GAC7B,MAAM,UAAUR,YAAAA,OAAO,KAAK,GAAG,CAAC,CAAC,SAAS,QAAQ;GAClD,IAAI;IACF,MAAM,SAAS,QAAQ,YAAY,SAAS,OAAO;IACnD,IAAK,MAAM,SAAS,QAAQ,YAAY,OAAO,MAAO,SAAS,OAAO;GACxE,QAAQ,CAER;EACF;EAEA,IAAI,SAAS,WAAW,MAAM,cAAc,UAAU,WAAW,MAAM,GAAG,MAAM,SAAS,cAAc,SAAS;EAChH,MAAM,SAAS,cAAc,WAAW,GAAG;EAC3C,OAAO;CACT;CAEA,eAAe,UAA8B;EAC3C,MAAM,MAAM;EACZ,MAAM,UAAU,MAAM,eAAe;EACrC,MAAM,QAAQ,MAAM,OAAO,OAAO;EAClC,MAAM,QAAQ,MAAM,KAAK,KAAK;EAC9B,IAAI,UAAU,KAAA,GAAW,OAAO;EAChC,IAAI,QAAQ,OAAO,MAAM,SAAA,WAAyB,CAAC,GAAG,MAAM,IAAIM,mBAAAA,WAAW,aAAa;EACxF,OAAO,MAAMK,mBAAAA,kBAAkB,YAAY;GACzC,MAAM,QAAQ,MAAM,OAAO,OAAO;GAClC,MAAM,WAAW,MAAM,KAAK,KAAK;GACjC,IAAI,aAAa,KAAA,GAAW,OAAO;GACnC,MAAM,QAAQ,MAAM,SAASH,mBAAAA,gBAAgB;GAC7C,IAAI,QAAQ,OAAO,KAAK,GAAG,MAAM,IAAIF,mBAAAA,WAAW,aAAa;GAC7D,MAAM,MAAM,UAAU;GACtB,MAAM,SAAS,MAAM,MAAM,OAAO,SAAS,GAAG;GAC9C,MAAM,SAAS,QAAQ,KAAK,KAAKG,mBAAAA,uBAAuBC,mBAAAA,eAAe,CAAC;GACxE,IAAI,UAAU,KAAA,GACZ,MAAM,SAAS,IAAI,cAAcF,mBAAAA,kBAAkB,MAAM;QACpD;IAEL,MAAM,SAAS,YAAY,OAAO,gBAAgB;KAChD,MAAM,YAAY,IAAI,2BAA2B;KACjD,MAAM,YAAY,IAAI,cAAcA,mBAAAA,kBAAkB,MAAM;IAC9D,CAAC;IACD,SAASI,mBAAAA,qBAAqB;GAChC;GACA,UAAU;GACV,OAAO;IAAE;IAAK,OAAO;GAAO;EAC9B,CAAC;CACH;CAEA,SAAS,aAAiC;EACxC,WAAW,QAAQ,OAAO,CAAC,CAAC,OAAO,UAAmB;GACpD,SAAS,KAAA;GACT,MAAM;EACR,CAAC;EACD,OAAO;CACT;;CAGA,eAAe,WAA+B;EAC5C,MAAM,SAAS,MAAM,WAAW;EAChC,MAAM,QAAQ,MAAM,cAAc,SAASJ,mBAAAA,gBAAgB,CAAC;EAC5D,IAAI,UAAU,KAAA,KAAa,WAAW,OAAO,OAAO,KAAK,GAAG,OAAO;EACnE,IAAI,WAAW,KAAA,KAAc,MAAM,WAAY,QAAQ,SAAS,KAAA;EAChE,OAAO,WAAW;CACpB;CAEA,eAAe,WAAW,MAAc,OAAiC;EACvE,MAAM,KAAK,IAAI;EACf,IAAI;GACF,OAAQ,MAAM,SAAS,IAAI,eAAe,MAAM,OAAO,KAAK,YAAY,EAAE,MAAO,KAAA;EACnF,SAAS,OAAO;GACd,IAAI,OAAO,KAAK,GAAG,OAAO;GAC1B,MAAM,IAAIF,mBAAAA,WAAW,aAAa;EACpC;CACF;CAEA,eAAe,MAAS,MAAc,IAAyC,QAAkC;EAC/G,IAAI,QAAQ,MAAM,IAAIA,mBAAAA,WAAW,aAAa;EAC9C,MAAM,MAAM;EACZ,MAAM,SAAA,GAAQO,YAAAA,WAAAA,CAAW;EACzB,MAAM,WAAW,IAAI,IAAI;EACzB,SAAS;GACP,QAAQ,eAAe;GACvB,IAAI,MAAM,WAAW,MAAM,KAAK,GAAG;GACnC,IAAI,IAAI,KAAK,UAAU,MAAM,IAAIP,mBAAAA,WAAW,aAAa;GACzD,MAAM,MAAA,KAA4B,KAAK,OAAO,IAAA,IAA2B,MAAM;EACjF;EACA,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,gBAAgB,WAAW,MAAM,QAAQ,MAAM;EACrD,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;EACzD,MAAM,QAAQ,kBAAkB;GAC9B,WAAW,MAAM,KAAK,CAAC,CAAC,MACrB,SAAS;IACR,IAAI,CAAC,MAAM,WAAW,MAAM,IAAIA,mBAAAA,WAAW,aAAa,CAAC;GAC3D,SAEM,KAAA,CACR;EACF,GAAG,YAAY;EACf,MAAM,QAAQ;EACd,SAAS,IAAI,KAAK;EAClB,IAAI;GACF,OAAO,MAAM,GAAG,WAAW,MAAM;EACnC,UAAU;GACR,cAAc,KAAK;GACnB,SAAS,OAAO,KAAK;GACrB,QAAQ,oBAAoB,SAAS,OAAO;GAC5C,IAAI;IACF,MAAM,SAAS,IAAI,eAAe,MAAM,KAAK;GAC/C,QAAQ,CAER;EACF;CACF;CAEA,eAAe,SAAS,KAAa,QAAwE;EAC3G,MAAM,MAAM,MAAM,cAAc,SAAS,IAAgB,KAAK,GAAG,MAAM,CAAC;EACxE,IAAI,QAAQ,KAAA,GAAW,MAAM,IAAIA,mBAAAA,WAAW,UAAU;EACtD,OAAO;CACT;CAEA,OAAO;EACL,MAAM,IAAI,WAAmB,KAA+C;GAC1E,mBAAA,gBAAgB,WAAW,GAAG;GAC9B,MAAM,MAAM;GACZ,MAAM,MAAM,MAAM,cAAc,SAAS,IAAc,cAAc,WAAW,GAAG,CAAC;GACpF,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;GAC9B,MAAM,MAAM,SAAS,WAAW,GAAG;GACnC,IAAI,YAAY,MAAM,WAAW;GACjC,IAAI,OAAOL,OAAK,UAAU,KAAK,MAAM,GAAG,GAAG,GAAG;GAC9C,IAAI,SAAS,KAAA,GAAW;IACtB,MAAM,QAAQ,MAAM,cAAc,SAASO,mBAAAA,gBAAgB,CAAC;IAC5D,IAAI,UAAU,KAAA,KAAa,CAAC,UAAU,UAAU,KAAK,KAAK,GAAG;KAC3D,SAAS,KAAA;KACT,YAAY,MAAM,WAAW;KAC7B,OAAOP,OAAK,UAAU,KAAK,MAAM,GAAG,GAAG,GAAG;IAC5C;GACF;GACA,IAAI,SAAS,KAAA,GAAW;IAEtB,MAAM,cACJ,SAAS,IACP,8EACA,WACA,KACA,IAAI,QACN,CACF;IACA;GACF;GACA,OAAO;IAAE,OAAO,KAAK,MAAM,IAAI;IAAiB,UAAU,IAAI;IAAU,WAAW,IAAI;GAAW;EACpG;EAEA,MAAM,IAAI,WAAmB,KAAa,OAAmB,YAAoD;GAC/G,mBAAA,gBAAgB,WAAW,GAAG;GAC9B,MAAM,iBAAiB,YAAY;GACnC,IAAI,mBAAmB,KAAA,KAAa,mBAAmB,MAAM,mBAAA,eAAe,cAAc;GAC1F,MAAM,OAAOa,mBAAAA,eAAe,KAAK;GACjC,MAAM,MAAM;GAEZ,MAAM,MAAM,MAAK,MADO,SAAS,EAChB,CAAU,KAAK,MAAM,SAAS,WAAW,GAAG,CAAC;GAC9D,MAAM,KAAK,IAAI;GACf,MAAM,MACJ,mBAAmB,KAAA,IACf,MAAM,SAAS,qBAAqB;IAAC;IAAW;IAAK;IAAI,IAAI;IAAI,IAAI;IAAK,IAAI;GAAU,CAAC,IACzF,mBAAmB,OACjB,MAAM,SAAS,iBAAiB;IAAC;IAAW;IAAK;IAAI,IAAI;IAAI,IAAI;IAAK,IAAI;GAAU,CAAC,IACrF,MAAM,SAAS,qBAAqB;IAClC,iBAAiB;IACjB;IACA,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ;IACA;IACA;GACF,CAAC;GACT,OAAO;IAAE,OAAO,KAAK,MAAM,IAAI;IAAiB,UAAU,IAAI;IAAU,WAAW,IAAI;GAAW;EACpG;EAEA,MAAM,OAAO,WAAmB,KAAa,eAAmD;GAC9F,mBAAA,gBAAgB,WAAW,GAAG;GAC9B,MAAM,iBAAiB,eAAe;GACtC,IAAI,mBAAmB,KAAA,GAAW,mBAAA,eAAe,cAAc;GAC/D,MAAM,MAAM;GACZ,IAAI,mBAAmB,KAAA,GAAW;IAChC,MAAM,cAAc,SAAS,IAAI,6DAA6D,WAAW,GAAG,CAAC;IAC7G;GACF;GACA,MAAM,SACJ,kHACA;IAAC;IAAW;IAAK;GAAc,CACjC;EACF;EAEA,SACE,WACA,KACA,IACA,QACY;GACZ,IAAI;IACF,mBAAA,gBAAgB,WAAW,GAAG;GAChC,SAAS,OAAO;IACd,OAAO,QAAQ,OAAO,KAAK;GAC7B;GACA,IAAI,OAAO,OAAO,YAAY,OAAO,QAAQ,OAAO,IAAIR,mBAAAA,WAAW,SAAS,CAAC;GAC7E,OAAO,MAAM,SAAS,WAAW,GAAG,GAAG,IAAI,MAAM;EACnD;EAEA,SAAS;GACP,OAAO,EAAE,QAAQ;EACnB;EAEA,QAAc;GACZ,SAAS;GACT,KAAK,MAAM,SAAS,UAAU,cAAc,KAAK;GACjD,SAAS,MAAM;EACjB;CACF;AACF;;;;AChdA,MAAM,YAAYS,QAAAA,UAAU,cAAc;AAC1C,MAAM,mBAAmB;AACzB,MAAM,QAAQ,QAAQ,aAAa;AAEnC,SAAS,aAAiC;CACxC,OAAO,OAAO,QAAQ,WAAW,aAAa,QAAQ,OAAO,IAAI,KAAA;AACnE;AAEA,SAAS,YAAY,KAAsB;CACzC,MAAM,OAAO,WAAW;CACxB,OAAO,SAAS,KAAA,KAAa,QAAQ;AACvC;AAEA,SAAS,UAAU,OAAoC;CACrD,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,UAAU,QAAQ,OAAO,MAAM,IAAI,IAAI,KAAA;AAC/F;;;;;;;AAQA,eAAsB,wBAAwB,WAAkC;CAC9E,IAAI;EACF,OAAA,GAAMC,iBAAAA,MAAAA,CAAM,WAAW;GAAE,WAAW;GAAM,MAAA;EAA2B,CAAC;EACtE,MAAM,QAAQ,OAAA,GAAMC,iBAAAA,MAAAA,CAAM,SAAS;EACnC,IAAI,MAAM,eAAe,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,YAAY,MAAM,GAAG,GAAG,MAAM,IAAIC,mBAAAA,WAAW,aAAa;EACjH,IAAI,UAAU,MAAM,OAAO,sBAAsB,GAAG,OAAA,GAAMC,iBAAAA,MAAAA,CAAM,WAAA,GAA+B;CACjG,SAAS,OAAO;EACd,MAAM,iBAAiBD,mBAAAA,aAAa,QAAQ,IAAIA,mBAAAA,WAAW,aAAa;CAC1E;AACF;;;;;;;AAQA,eAAsB,YAAY,WAAoD;CACpF,IAAI;CACJ,IAAI;EACF,SAAS,OAAA,GAAME,iBAAAA,KAAAA,CAAKC,UAAAA,QAAK,KAAK,WAAWC,mBAAAA,cAAc,GAAGP,QAAAA,UAAU,WAAW,SAAS;CAC1F,SAAS,OAAO;EACd,IAAI,UAAU,KAAK,MAAM,YAAY,UAAU,KAAK,MAAM,WAAW,OAAO,KAAA;EAC5E,MAAM,IAAIG,mBAAAA,WAAW,aAAa;CACpC;CACA,IAAI;EACF,MAAM,QAAQ,MAAM,OAAO,KAAK;EAChC,IACE,CAAC,MAAM,OAAO,KACd,MAAM,UAAU,KAChB,CAAC,YAAY,MAAM,GAAG,KACrB,UAAU,MAAM,OAAO,sBAAsB,KAC9C,MAAM,SAAA,IAEN,MAAM,IAAIA,mBAAAA,WAAW,aAAa;EAEpC,MAAM,MAAM,OAAO,MAAA,EAAqB;EACxC,MAAM,EAAE,cAAc,MAAM,OAAO,KAAK,KAAK,GAAA,IAAoB,CAAC;EAClE,IAAI,cAAA,IAA+B,MAAM,IAAIA,mBAAAA,WAAW,aAAa;EACrE,OAAO;CACT,SAAS,OAAO;EACd,MAAM,iBAAiBA,mBAAAA,aAAa,QAAQ,IAAIA,mBAAAA,WAAW,aAAa;CAC1E,UAAU;EACR,MAAM,OAAO,MAAM;CACrB;AACF;;AAGA,eAAsB,cAAc,WAAmB,KAAgC;CACrF,IAAI,IAAI,WAAA,IAA4B,MAAM,IAAIA,mBAAAA,WAAW,SAAS;CAClE,MAAM,wBAAwB,SAAS;CACvC,IAAI;EACF,MAAM,SAAS,OAAA,GAAME,iBAAAA,KAAAA,CACnBC,UAAAA,QAAK,KAAK,WAAWC,mBAAAA,cAAc,GACnCP,QAAAA,UAAU,WAAWA,QAAAA,UAAU,UAAUA,QAAAA,UAAU,SAAS,WAAA,GAE9D;EACA,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC;GACxC,MAAM,OAAO,KAAK;EACpB,UAAU;GACR,MAAM,OAAO,MAAM;EACrB;CACF,QAAQ;EACN,MAAM,IAAIG,mBAAAA,WAAW,aAAa;CACpC;AACF;;AAGA,eAAsB,cAAc,WAAkC;CACpE,IAAI;EACF,OAAA,GAAMK,iBAAAA,OAAAA,CAAOF,UAAAA,QAAK,KAAK,WAAWC,mBAAAA,cAAc,CAAC;CACnD,SAAS,OAAO;EACd,IAAI,UAAU,KAAK,MAAM,UAAU,MAAM,IAAIJ,mBAAAA,WAAW,aAAa;CACvE;AACF;;;;;;;ACnGA,eAAsB,cAA4C;CAChE,IAAI;EACF,MAAM,EAAE,eAAe,MAAM,OAAO;EACpC,OAAO;GACL,cAAc,YAAY,IAAI,WAAWM,mBAAAA,uBAAuB,OAAO,CAAC,CAAC,YAAY;GACrF,cAAc,SAAS,aAAa,IAAI,WAAWA,mBAAAA,uBAAuB,OAAO,CAAC,CAAC,YAAY,QAAQ;EACzG;CACF,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;ACOA,eAAsB,wBACpB,QAC0E;CAC1E,MAAM,OAAO,OAAO;CACpB,MAAM,gBAAgB,KAAK,QAAQ;CACnC,IAAI,KAAK,UAAU,YAAY,kBAAkB,KAAA,GAAW,OAAO,EAAE,OAAO,KAAA,EAAU;CACtF,MAAM,YAAYC,UAAAA,QAAK,MAAA,GAAKC,8BAAAA,gBAAAA,CAAgB,eAAe,KAAK,QAAQ,eAAe,CAAC,CAAC,GAAGC,mBAAAA,eAAe;CAC3G,IAAI;CACJ,IAAI;CACJ,MAAM,WAAW,OAAO,QAAQ,OAAO,CAACC,gCAAAA,yBAAyBC,iBAAAA,aAAa,IAAI,aAAa;EAE7F,MAAM,MAAA,GAAKC,iBAAAA,YAAAA,CAAY,QAAQ;EAC/B,IAAI,UAAU,KAAA,KAAa,YAAY,IAAI;GACzC,OAAO,MAAM;GACb,UAAU;GACV,QAAQ,YAAY;IAClB;IACA;IACA,SAAS;IACT,UAAU;KAAE;KAAa;KAAe;IAAc;IACtD,WAAW,YAAY,KAAK,QAAQ,SAAS,UAAU,SAAS;GAClE,CAAC;EACH;EACA,QAAA,GAAOC,gCAAAA,qBAAAA,CAAqB,QAAQ,CAAC,CAAC,QAAQC,kBAAAA,mBAAmB,KAAK;CACxE,CAAC;CACD,MAAM,SAAS,MAAM;CACrB,OAAO;EACL,OAAO;EACP,WAAW,YAAY;GACrB,MAAM,SAAS,QAAQ;GACvB,OAAO,MAAM;EACf;CACF;AACF;;;ACpDA,IAAA,uBAAA,GAAeC,iCAAAA,WAAAA,CAAW,yBAAyB,EAAE,QAAQ,CAACC,iBAAAA,cAAc,EAAE,CAAC;;;ACE/E,MAAa,gBAAA,GAAeC,gCAAAA,mBAAAA,CAAmB;CAC7C,MAAM;CACN,oBAAA,GAAmBC,gCAAAA,+BAAAA,CAA+BC,mBAAU;CAC5D,UAAA,GAASC,iCAAAA,mBAAAA,CAAmB;EAAE,QAAQ,CAACD,mBAAU;EAAG,WAAW,CAACA,mBAAU;EAAG,SAAS,CAACA,mBAAU;CAAE,CAAC;CACpG,QAAQ,OAAO,YAAY;EACzB,MAAM,cAAc,MAAM,QAAQ,UAAU,UAAUA,qBAAY,OAAO;EACzE,OAAO;GACL,IAAA,GAAGE,iCAAAA,iBAAAA,CAAiB,WAAW;GAC/B,UAAU,CAAC,GAAI,YAAY,YAAY,CAAC,CAAE;EAC5C;CACF;CACA,WAAW,OAAO,YAAY;EAC5B,MAAM,cAAc,MAAM,QAAQ,UAAU,UAAUF,qBAAY,OAAO;EACzE,OAAO;GACL,IAAA,GAAGE,iCAAAA,iBAAAA,CAAiB,WAAW;GAC/B,UAAU,CAAC,GAAI,YAAY,YAAY,CAAC,CAAE;EAC5C;CACF;CACA,SAAS,OAAO,YAAY;EAC1B,MAAM,cAAc,MAAM,QAAQ,UAAU,UAAUF,qBAAY,OAAO;EACzE,OAAO;GACL,IAAA,GAAGE,iCAAAA,iBAAAA,CAAiB,WAAW;GAC/B,UAAU,CAAC,GAAI,YAAY,YAAY,CAAC,CAAE;GAC1C,IAAI,aAAkD;IAAE,OAAO,CAAC,GAAI,YAAY,cAAc,CAAC,CAAE;GAAG;EACtG;CACF;AACF,CAAC"}

package/dist/extensions/server.d.mts

@@ -0,0 +1,5 @@
+//#region generated/server.d.ts
+export declare const serverPlugin: import("@agimon-ai/po-core/serverPlugin").PoServerPlugin;
+//#endregion
+export { serverPlugin as default };
+//# sourceMappingURL=server.d.mts.map

package/dist/extensions/server.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.mts","names":[],"sources":["../../generated/server.ts"],"mappings":";qBAOa,wDAAY"}