@caupulican/pi-adaptative 0.81.39 → 0.81.41

package/dist/core/tools/secret-store.js

@@ -0,0 +1,412 @@
+import { Type } from "typebox";
+import { ExtensionEditorComponent } from "../../modes/interactive/components/extension-editor.js";
+import { defineTool } from "../extensions/types.js";
+import { parseDotenvDocument, SecretDotenvError } from "../secrets/secret-dotenv.js";
+import { MAX_VARIABLES_PER_PROFILE, SECRET_DESCRIPTION_MAX_CHARS, SECRET_PRINTABLE_METADATA_PATTERN, SECRET_PROFILE_ID_MAX_CHARS, SECRET_PROFILE_ID_PATTERN, SECRET_VARIABLE_NAME_MAX_CHARS, SECRET_VARIABLE_NAME_PATTERN, SecretVault, SecretVaultError, } from "../secrets/secret-vault.js";
+import { emptyOrchestrationCall, OrchestrationPanelComponent, } from "./orchestration-panel.js";
+const secretStoreSchema = Type.Object({
+    action: Type.Union([
+        Type.Literal("set"),
+        Type.Literal("list"),
+        Type.Literal("materialize"),
+        Type.Literal("remove"),
+        Type.Literal("lock"),
+    ], { description: "Credential-management action." }),
+    profile: Type.Optional(Type.String({
+        minLength: 1,
+        maxLength: SECRET_PROFILE_ID_MAX_CHARS,
+        pattern: SECRET_PROFILE_ID_PATTERN,
+        description: "Portable profile identifier, such as project-dev or aws-work.",
+    })),
+    description: Type.Optional(Type.String({
+        minLength: 1,
+        maxLength: SECRET_DESCRIPTION_MAX_CHARS,
+        pattern: SECRET_PRINTABLE_METADATA_PATTERN,
+        description: "Non-secret profile description.",
+    })),
+    envFile: Type.Optional(Type.String({
+        minLength: 1,
+        maxLength: 512,
+        description: "Relative dotenv location inside the current workspace, such as .env, .env.local, or config/dev.env. Valid only for set.",
+    })),
+    variableNames: Type.Optional(Type.Array(Type.String({
+        minLength: 1,
+        maxLength: SECRET_VARIABLE_NAME_MAX_CHARS,
+        pattern: SECRET_VARIABLE_NAME_PATTERN,
+    }), {
+        minItems: 1,
+        maxItems: MAX_VARIABLES_PER_PROFILE,
+        description: "Specific variable names to remove. Omit to remove the whole profile.",
+    })),
+    scope: Type.Optional(Type.Union([Type.Literal("managed"), Type.Literal("workspace")], {
+        description: "Materialization target. workspace resolves the durable current-project binding; managed writes private Pi state.",
+    })),
+}, { additionalProperties: false });
+function result(details, text) {
+    return { content: [{ type: "text", text }], details };
+}
+function cancelled(action, profile) {
+    return result({ action, status: "cancelled", ...(profile ? { profile } : {}), code: "owner_cancelled" }, "Secret store action was cancelled by the owner.");
+}
+function failed(action, error, profile) {
+    const code = error instanceof SecretVaultError ? error.code : "safe_failure";
+    const message = error instanceof SecretVaultError ? error.message : "Secret store failed safely without exposing values.";
+    return result({ action, status: "error", ...(profile ? { profile } : {}), code, message }, `Secret store failed: ${message}`);
+}
+function invalid(action, code, message, profile) {
+    return result({ action, status: "error", ...(profile ? { profile } : {}), code, message }, `Secret store request is invalid: ${message}`);
+}
+function panelModel(details, expanded) {
+    if (!details)
+        return { label: "secrets", status: "error", emptyText: "No secret-store result was retained." };
+    const success = ["listed", "locked", "materialized", "removed", "stored"].includes(details.status);
+    const rows = expanded
+        ? (details.profiles ?? []).map((profile) => ({
+            status: "info",
+            label: profile.profile,
+            meta: [
+                `${profile.variableNames.length} variable${profile.variableNames.length === 1 ? "" : "s"}`,
+                `${profile.bindings.length} binding${profile.bindings.length === 1 ? "" : "s"}`,
+            ],
+            details: [
+                ...(profile.description ? [profile.description] : []),
+                ...profile.bindings.map((binding) => `${binding.envFile} · ${binding.workspace}`),
+            ],
+        }))
+        : undefined;
+    return {
+        label: "secrets",
+        action: details.status,
+        status: success ? "success" : details.status === "cancelled" ? "warning" : "error",
+        summary: [
+            details.profile,
+            details.envFile,
+            details.scope,
+            details.variableNames
+                ? `${details.variableNames.length} variable${details.variableNames.length === 1 ? "" : "s"}`
+                : undefined,
+            details.profiles ? `${details.profiles.length} profile${details.profiles.length === 1 ? "" : "s"}` : undefined,
+        ].filter((value) => value !== undefined),
+        rows,
+        notices: expanded && details.message ? [{ status: success ? "info" : "error", text: details.message }] : undefined,
+    };
+}
+async function ensureUnlocked(vault, action, ctx, signal, profile) {
+    if (vault.isUnlocked)
+        return undefined;
+    if (await vault.exists()) {
+        while (!signal?.aborted) {
+            let passphrase = await ctx.ui.input("Unlock secret vault", "Master passphrase", {
+                signal,
+                sensitive: true,
+            });
+            if (passphrase === undefined || signal?.aborted)
+                return cancelled(action, profile);
+            try {
+                await vault.unlock(passphrase);
+                return undefined;
+            }
+            catch (error) {
+                if (error instanceof SecretVaultError && ["invalid_passphrase", "unlock_failed"].includes(error.code)) {
+                    ctx.ui.notify(error.message, "error");
+                    continue;
+                }
+                return failed(action, error, profile);
+            }
+            finally {
+                passphrase = "";
+            }
+        }
+        return cancelled(action, profile);
+    }
+    while (!signal?.aborted) {
+        let passphrase = await ctx.ui.input("Create secret vault", "New master passphrase", { signal, sensitive: true });
+        if (passphrase === undefined || signal?.aborted)
+            return cancelled(action, profile);
+        let confirmation = await ctx.ui.input("Confirm secret vault", "Repeat master passphrase", {
+            signal,
+            sensitive: true,
+        });
+        if (confirmation === undefined || signal?.aborted) {
+            passphrase = "";
+            return cancelled(action, profile);
+        }
+        try {
+            if (passphrase !== confirmation) {
+                ctx.ui.notify("The two master passphrases do not match.", "error");
+                continue;
+            }
+            await vault.initialize(passphrase);
+            return undefined;
+        }
+        catch (error) {
+            if (error instanceof SecretVaultError && error.code === "invalid_passphrase") {
+                ctx.ui.notify(error.message, "error");
+                continue;
+            }
+            return failed(action, error, profile);
+        }
+        finally {
+            passphrase = "";
+            confirmation = "";
+        }
+    }
+    return cancelled(action, profile);
+}
+function validateInput(input) {
+    if (input.action === "lock" || input.action === "list") {
+        if (input.profile !== undefined ||
+            input.description !== undefined ||
+            input.envFile !== undefined ||
+            input.variableNames !== undefined ||
+            input.scope !== undefined) {
+            return invalid(input.action, "unexpected_fields", `Action ${input.action} does not accept profile fields.`);
+        }
+        return undefined;
+    }
+    if (input.action === "set" && !input.profile) {
+        return invalid(input.action, "profile_required", "Action set requires a profile.");
+    }
+    if (input.action === "remove" && !input.profile) {
+        return invalid(input.action, "profile_required", "Action remove requires a profile.");
+    }
+    if (input.action !== "set" && (input.description !== undefined || input.envFile !== undefined)) {
+        return invalid(input.action, "unexpected_profile_fields", "description and envFile are valid only for set.", input.profile);
+    }
+    if (input.action !== "remove" && input.variableNames !== undefined) {
+        return invalid(input.action, "unexpected_variable_names", "variableNames is valid only for remove.", input.profile);
+    }
+    if (input.action !== "materialize" && input.scope !== undefined) {
+        return invalid(input.action, "unexpected_scope", "scope is valid only for materialize.", input.profile);
+    }
+    if (input.variableNames && new Set(input.variableNames).size !== input.variableNames.length) {
+        return invalid(input.action, "duplicate_variables", "Variable names must be unique.", input.profile);
+    }
+    return undefined;
+}
+async function openPrivateDotenvEditor(ctx, title, prefill, signal) {
+    if (signal?.aborted)
+        return undefined;
+    try {
+        return await ctx.ui.custom((tui, _theme, keybindings, done) => new ExtensionEditorComponent(tui, keybindings, title, prefill, (value) => done(value), () => done(undefined), {
+            privateContent: true,
+            allowExternalEditor: false,
+            signal,
+            notice: "Private plaintext editor · content stays local and never enters model context",
+        }));
+    }
+    catch (error) {
+        if (signal?.aborted)
+            return undefined;
+        throw error;
+    }
+}
+async function captureValidDotenv(ctx, title, prefill, signal) {
+    let draft = prefill;
+    while (!signal?.aborted) {
+        const edited = await openPrivateDotenvEditor(ctx, title, draft, signal);
+        if (edited === undefined || signal?.aborted)
+            return undefined;
+        try {
+            const parsed = parseDotenvDocument(edited);
+            const variableNames = parsed.variables.map((variable) => variable.name);
+            for (const variable of parsed.variables)
+                variable.value = "";
+            draft = "";
+            return { document: parsed.document, variableNames };
+        }
+        catch (error) {
+            ctx.ui.notify(error instanceof SecretDotenvError ? error.message : "The dotenv document is invalid.", "error");
+            draft = edited;
+        }
+    }
+    return undefined;
+}
+async function executeSet(vault, input, ctx, signal) {
+    let document = "";
+    let originalUnmanagedContent;
+    try {
+        const target = vault.resolveBindingTarget(ctx.cwd, input.envFile ?? ".env");
+        const destinationState = await vault.inspectEnvDestination(target.destination, input.profile);
+        if (destinationState === "managed-other") {
+            return invalid(input.action, "destination_conflict", "The selected dotenv location is already managed by another profile.", input.profile);
+        }
+        const storedDocument = await vault.getProfileDocument(input.profile);
+        let prefill = storedDocument ?? "";
+        if (destinationState === "unmanaged") {
+            originalUnmanagedContent = await vault.readOwnerDotenv(target.destination);
+            prefill = originalUnmanagedContent;
+        }
+        if (destinationState === "managed-profile" && storedDocument === undefined) {
+            return invalid(input.action, "profile_missing", "The dotenv target claims this profile, but the encrypted profile is missing.", input.profile);
+        }
+        const captured = await captureValidDotenv(ctx, `Secrets · ${input.profile}  →  ${target.destination}`, prefill, signal);
+        prefill = "";
+        if (!captured)
+            return cancelled(input.action, input.profile);
+        document = captured.document;
+        await vault.replaceProfileDocument(input.profile, input.description, document, {
+            workspace: target.workspace,
+            envFile: target.envFile,
+        });
+        try {
+            await vault.materializeEnv(input.profile, target.destination, {
+                allowReplaceUnmanaged: destinationState === "unmanaged",
+                expectedUnmanagedContent: originalUnmanagedContent,
+            });
+        }
+        catch (error) {
+            const message = error instanceof SecretVaultError ? error.message : "Dotenv materialization failed safely.";
+            ctx.ui.notify(`Profile stored, but ${target.destination} was not refreshed: ${message}`, "warning");
+            return result({
+                action: input.action,
+                status: "stored",
+                profile: input.profile,
+                envFile: target.envFile,
+                variableNames: captured.variableNames,
+                materialized: false,
+                code: "materialization_failed",
+                message,
+            }, `Stored profile ${input.profile}, but its bound dotenv could not be refreshed. Retry secret_store materialize; no values were exposed.`);
+        }
+        ctx.ui.notify(`Credential profile ${input.profile} stored and activated at ${target.destination}`, "info");
+        return result({
+            action: input.action,
+            status: "stored",
+            profile: input.profile,
+            envFile: target.envFile,
+            variableNames: captured.variableNames,
+            materialized: true,
+        }, `Stored and activated ${captured.variableNames.length} variables for profile ${input.profile} at its bound workspace dotenv location. Values never entered model context.`);
+    }
+    catch (error) {
+        return failed(input.action, error, input.profile);
+    }
+    finally {
+        document = "";
+        originalUnmanagedContent = undefined;
+    }
+}
+async function executeMaterialize(vault, input, ctx) {
+    try {
+        const scope = input.scope ?? "workspace";
+        const binding = await vault.resolveBindingForWorkspace(ctx.cwd, input.profile);
+        const destination = scope === "managed" ? vault.getManagedEnvPath(binding.profile) : binding.destination;
+        const destinationState = await vault.inspectEnvDestination(destination, binding.profile);
+        if (destinationState === "unmanaged" || destinationState === "managed-other") {
+            return invalid(input.action, "destination_conflict", "The bound dotenv location is no longer safely managed. Use set to review it in the private editor.", binding.profile);
+        }
+        const materialized = await vault.materializeEnv(binding.profile, destination, {
+            activationWorkspace: ctx.cwd,
+            managed: scope === "managed",
+        });
+        ctx.ui.notify(`Credential profile ${binding.profile} activated at ${destination}`, "info");
+        return result({
+            action: input.action,
+            status: "materialized",
+            profile: binding.profile,
+            variableNames: materialized.variableNames,
+            scope,
+            envFile: scope === "workspace" ? binding.envFile : undefined,
+            materialized: true,
+        }, `Activated profile ${binding.profile} for the current workspace. Its dotenv and process environment are available without exposing values to the model.`);
+    }
+    catch (error) {
+        return failed(input.action, error, input.profile);
+    }
+}
+async function executeRemove(vault, input, ctx, signal) {
+    const target = input.variableNames?.length
+        ? `${input.variableNames.join(", ")} from profile ${input.profile}`
+        : `the entire profile ${input.profile}`;
+    const approved = await ctx.ui.confirm("Remove stored secrets", `Remove ${target}? Pi-managed workspace and private dotenv copies are invalidated.`, { signal });
+    if (!approved || signal?.aborted)
+        return cancelled(input.action, input.profile);
+    try {
+        const removal = await vault.removeProfile(input.profile, input.variableNames);
+        return result({
+            action: input.action,
+            status: "removed",
+            profile: input.profile,
+            variableNames: removal.removedVariableNames,
+        }, `Removed ${removal.removedVariableNames.length} secret variable${removal.removedVariableNames.length === 1 ? "" : "s"} from profile ${input.profile}.`);
+    }
+    catch (error) {
+        return failed(input.action, error, input.profile);
+    }
+}
+export function createSecretStoreToolDefinition(options) {
+    const vault = options.vault ?? (options.agentDir ? SecretVault.forAgentDir(options.agentDir) : undefined);
+    if (!vault)
+        throw new Error("secret_store requires an agentDir or SecretVault");
+    return defineTool({
+        name: "secret_store",
+        label: "Secret Store",
+        description: "Open a model-blind native dotenv editor, encrypt owner credentials, bind profiles to workspace dotenv locations, and activate them for normal process use without returning values to the model.",
+        promptSnippet: "Manage credentials through the model-blind secret vault. Before credential-dependent work, materialize the current workspace binding; use set to open the owner's private dotenv editor.",
+        promptGuidelines: [
+            "Use secret_store whenever credentials are needed. Never ask the owner to paste a secret into chat or place a value in tool arguments.",
+            "Use set with a profile and relative envFile. The harness opens a private plaintext editor, persists the workspace binding, writes the dotenv, and activates the environment.",
+            "Before credential-dependent commands in a later session, call materialize without a profile to resolve the current workspace binding. Use list only when selection or discovery is needed.",
+            "After activation, run the consuming application normally. Never read, grep, print, echo, source, or otherwise inspect credential files or environment values.",
+            "Treat cancellation as owner intent. Do not immediately repeat the same credential request.",
+        ],
+        parameters: secretStoreSchema,
+        executionMode: "sequential",
+        renderShell: "self",
+        renderCall() {
+            return emptyOrchestrationCall();
+        },
+        renderResult(toolResult, { expanded, isPartial }, theme) {
+            if (isPartial) {
+                return new OrchestrationPanelComponent(theme, {
+                    label: "secrets",
+                    action: "waiting for you",
+                    status: "running",
+                });
+            }
+            return new OrchestrationPanelComponent(theme, panelModel(toolResult.details, expanded), expanded);
+        },
+        async execute(_toolCallId, input, signal, _onUpdate, ctx) {
+            if (!ctx.hasUI || ctx.mode !== "tui") {
+                return result({
+                    action: input.action,
+                    status: "unavailable",
+                    ...(input.profile ? { profile: input.profile } : {}),
+                    code: "user_tui_required",
+                    message: "Secret values can be captured only in a user-visible TUI session.",
+                }, "secret_store requires a user-visible TUI session.");
+            }
+            if (signal?.aborted)
+                return cancelled(input.action, input.profile);
+            const validation = validateInput(input);
+            if (validation)
+                return validation;
+            if (input.action === "lock") {
+                vault.lock();
+                return result({ action: input.action, status: "locked" }, "Secret vault locked; cached key, credential environment, and exact-value redaction cache were cleared.");
+            }
+            try {
+                const unlockResult = await ensureUnlocked(vault, input.action, ctx, signal, input.profile);
+                if (unlockResult)
+                    return unlockResult;
+                if (input.action === "list") {
+                    const profiles = await vault.listProfiles();
+                    return result({ action: input.action, status: "listed", profiles }, `Secret vault contains ${profiles.length} profile${profiles.length === 1 ? "" : "s"}. Only names, variable names, and workspace bindings were returned.`);
+                }
+                if (input.action === "set" && input.profile) {
+                    return executeSet(vault, { ...input, profile: input.profile }, ctx, signal);
+                }
+                if (input.action === "materialize")
+                    return executeMaterialize(vault, input, ctx);
+                if (!input.profile)
+                    return invalid(input.action, "profile_required", "A profile is required.");
+                return executeRemove(vault, { ...input, profile: input.profile }, ctx, signal);
+            }
+            catch (error) {
+                return failed(input.action, error, input.profile);
+            }
+        },
+    });
+}
+//# sourceMappingURL=secret-store.js.map

package/dist/core/tools/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../../src/core/tools/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAElG,OAAO,EAAE,UAAU,EAAyB,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EACN,yBAAyB,EACzB,4BAA4B,EAC5B,iCAAiC,EACjC,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,EAE5B,WAAW,EACX,gBAAgB,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,sBAAsB,EACtB,2BAA2B,GAE3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CACpC;IACC,MAAM,EAAE,IAAI,CAAC,KAAK,CACjB;QACC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;KACpB,EACD,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAChD;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,2BAA2B;QACtC,OAAO,EAAE,yBAAyB;QAClC,WAAW,EAAE,+DAA+D;KAC5E,CAAC,CACF;IACD,WAAW,EAAE,IAAI,CAAC,QAAQ,CACzB,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,4BAA4B;QACvC,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EAAE,iCAAiC;KAC9C,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,WAAW,EACV,yHAAyH;KAC1H,CAAC,CACF;IACD,aAAa,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,KAAK,CACT,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,8BAA8B;QACzC,OAAO,EAAE,4BAA4B;KACrC,CAAC,EACF;QACC,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,yBAAyB;QACnC,WAAW,EAAE,sEAAsE;KACnF,CACD,CACD;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE;QAChE,WAAW,EACV,kHAAkH;KACnH,CAAC,CACF;CACD,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B,CAAC;AAqCF,SAAS,MAAM,CAAC,OAA+B,EAAE,IAAY,EAAqB;IACjF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AAAA,CACtD;AAED,SAAS,SAAS,CAAC,MAAsC,EAAE,OAAgB,EAAqB;IAC/F,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EACzF,iDAAiD,CACjD,CAAC;AAAA,CACF;AAED,SAAS,MAAM,CAAC,MAAsC,EAAE,KAAc,EAAE,OAAgB,EAAqB;IAC5G,MAAM,IAAI,GAAG,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IAC7E,MAAM,OAAO,GACZ,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qDAAqD,CAAC;IAC3G,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAC3E,wBAAwB,OAAO,EAAE,CACjC,CAAC;AAAA,CACF;AAED,SAAS,OAAO,CACf,MAAsC,EACtC,IAAY,EACZ,OAAe,EACf,OAAgB,EACI;IACpB,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAC3E,oCAAoC,OAAO,EAAE,CAC7C,CAAC;AAAA,CACF;AAED,SAAS,UAAU,CAAC,OAA2C,EAAE,QAAiB,EAA2B;IAC5G,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,sCAAsC,EAAE,CAAC;IAC9G,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,QAAQ;QACpB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,MAAM,EAAE,MAAe;YACvB,KAAK,EAAE,OAAO,CAAC,OAAO;YACtB,IAAI,EAAE;gBACL,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,YAAY,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC1F,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,WAAW,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;aAC/E;YACD,OAAO,EAAE;gBACR,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,OAAM,OAAO,CAAC,SAAS,EAAE,CAAC;aACjF;SACD,CAAC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACb,OAAO;QACN,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QAClF,OAAO,EAAE;YACR,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,KAAK;YACb,OAAO,CAAC,aAAa;gBACpB,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,YAAY,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC5F,CAAC,CAAC,SAAS;YACZ,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,WAAW,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;SAC9G,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACzD,IAAI;QACJ,OAAO,EACN,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;KAC1G,CAAC;AAAA,CACF;AAED,KAAK,UAAU,cAAc,CAC5B,KAAkB,EAClB,MAAsC,EACtC,GAAqB,EACrB,MAA+B,EAC/B,OAAgB,EACyB;IACzC,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACzB,IAAI,UAAU,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,mBAAmB,EAAE;gBAC/E,MAAM;gBACN,SAAS,EAAE,IAAI;aACf,CAAC,CAAC;YACH,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACnF,IAAI,CAAC;gBACJ,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC/B,OAAO,SAAS,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,gBAAgB,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvG,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACtC,SAAS;gBACV,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACvC,CAAC;oBAAS,CAAC;gBACV,UAAU,GAAG,EAAE,CAAC;YACjB,CAAC;QACF,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,IAAI,UAAU,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjH,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnF,IAAI,YAAY,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,sBAAsB,EAAE,0BAA0B,EAAE;YACzF,MAAM;YACN,SAAS,EAAE,IAAI;SACf,CAAC,CAAC;QACH,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACnD,UAAU,GAAG,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC;YACJ,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBACjC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,0CAA0C,EAAE,OAAO,CAAC,CAAC;gBACnE,SAAS;YACV,CAAC;YACD,MAAM,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,SAAS,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAC9E,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACtC,SAAS;YACV,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACV,UAAU,GAAG,EAAE,CAAC;YAChB,YAAY,GAAG,EAAE,CAAC;QACnB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAAA,CAClC;AAED,SAAS,aAAa,CAAC,KAA2B,EAAiC;IAClF,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxD,IACC,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,KAAK,CAAC,WAAW,KAAK,SAAS;YAC/B,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,KAAK,CAAC,aAAa,KAAK,SAAS;YACjC,KAAK,CAAC,KAAK,KAAK,SAAS,EACxB,CAAC;YACF,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,EAAE,UAAU,KAAK,CAAC,MAAM,kCAAkC,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,mCAAmC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAChG,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,2BAA2B,EAC3B,iDAAiD,EACjD,KAAK,CAAC,OAAO,CACb,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACpE,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,2BAA2B,EAC3B,yCAAyC,EACzC,KAAK,CAAC,OAAO,CACb,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,sCAAsC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAC7F,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,EAAE,gCAAgC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,KAAK,UAAU,uBAAuB,CACrC,GAAqB,EACrB,KAAa,EACb,OAAe,EACf,MAA+B,EACD;IAC9B,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC;QACJ,OAAO,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CACzB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAClC,IAAI,wBAAwB,CAC3B,GAAG,EACH,WAAW,EACX,KAAK,EACL,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EACtB,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EACrB;YACC,cAAc,EAAE,IAAI;YACpB,mBAAmB,EAAE,KAAK;YAC1B,MAAM;YACN,MAAM,EAAE,gFAA+E;SACvF,CACD,CACF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED,KAAK,UAAU,kBAAkB,CAChC,GAAqB,EACrB,KAAa,EACb,OAAe,EACf,MAA+B,EACsC;IACrE,IAAI,KAAK,GAAG,OAAO,CAAC;IACpB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QAC9D,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7D,KAAK,GAAG,EAAE,CAAC;YACX,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC;YAC/G,KAAK,GAAG,MAAM,CAAC;QAChB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,KAAK,UAAU,UAAU,CACxB,KAAkB,EAClB,KAAiD,EACjD,GAAqB,EACrB,MAA+B,EACF;IAC7B,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,wBAA4C,CAAC;IACjD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;QAC5E,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9F,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;YAC1C,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,sBAAsB,EACtB,qEAAqE,EACrE,KAAK,CAAC,OAAO,CACb,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,OAAO,GAAG,cAAc,IAAI,EAAE,CAAC;QACnC,IAAI,gBAAgB,KAAK,WAAW,EAAE,CAAC;YACtC,wBAAwB,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC3E,OAAO,GAAG,wBAAwB,CAAC;QACpC,CAAC;QACD,IAAI,gBAAgB,KAAK,iBAAiB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC5E,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,iBAAiB,EACjB,8EAA8E,EAC9E,KAAK,CAAC,OAAO,CACb,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACxC,GAAG,EACH,cAAa,KAAK,CAAC,OAAO,UAAQ,MAAM,CAAC,WAAW,EAAE,EACtD,OAAO,EACP,MAAM,CACN,CAAC;QACF,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC7B,MAAM,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE;YAC9E,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;SACvB,CAAC,CAAC;QACH,IAAI,CAAC;YACJ,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE;gBAC7D,qBAAqB,EAAE,gBAAgB,KAAK,WAAW;gBACvD,wBAAwB,EAAE,wBAAwB;aAClD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC,CAAC;YAC5G,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,uBAAuB,MAAM,CAAC,WAAW,uBAAuB,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;YACpG,OAAO,MAAM,CACZ;gBACC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,YAAY,EAAE,KAAK;gBACnB,IAAI,EAAE,wBAAwB;gBAC9B,OAAO;aACP,EACD,kBAAkB,KAAK,CAAC,OAAO,wGAAwG,CACvI,CAAC;QACH,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,KAAK,CAAC,OAAO,4BAA4B,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3G,OAAO,MAAM,CACZ;YACC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,YAAY,EAAE,IAAI;SAClB,EACD,wBAAwB,QAAQ,CAAC,aAAa,CAAC,MAAM,0BAA0B,KAAK,CAAC,OAAO,8EAA8E,CAC1K,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QACV,QAAQ,GAAG,EAAE,CAAC;QACd,wBAAwB,GAAG,SAAS,CAAC;IACtC,CAAC;AAAA,CACD;AAED,KAAK,UAAU,kBAAkB,CAChC,KAAkB,EAClB,KAA2B,EAC3B,GAAqB,EACQ;IAC7B,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QACzG,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,gBAAgB,KAAK,WAAW,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;YAC9E,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,sBAAsB,EACtB,oGAAoG,EACpG,OAAO,CAAC,OAAO,CACf,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE;YAC7E,mBAAmB,EAAE,GAAG,CAAC,GAAG;YAC5B,OAAO,EAAE,KAAK,KAAK,SAAS;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,OAAO,CAAC,OAAO,iBAAiB,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3F,OAAO,MAAM,CACZ;YACC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,KAAK;YACL,OAAO,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAC5D,YAAY,EAAE,IAAI;SAClB,EACD,qBAAqB,OAAO,CAAC,OAAO,oHAAoH,CACxJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;AAAA,CACD;AAED,KAAK,UAAU,aAAa,CAC3B,KAAkB,EAClB,KAAiD,EACjD,GAAqB,EACrB,MAA+B,EACF;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,EAAE,MAAM;QACzC,CAAC,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,OAAO,EAAE;QACnE,CAAC,CAAC,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,OAAO,CACpC,uBAAuB,EACvB,UAAU,MAAM,mEAAmE,EACnF,EAAE,MAAM,EAAE,CACV,CAAC;IACF,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChF,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC9E,OAAO,MAAM,CACZ;YACC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,OAAO,CAAC,oBAAoB;SAC3C,EACD,WAAW,OAAO,CAAC,oBAAoB,CAAC,MAAM,mBAAmB,OAAO,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,iBAAiB,KAAK,CAAC,OAAO,GAAG,CACtJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;AAAA,CACD;AAED,MAAM,UAAU,+BAA+B,CAAC,OAA+B,EAAE;IAChF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1G,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAChF,OAAO,UAAU,CAAmD;QACnE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,cAAc;QACrB,WAAW,EACV,kMAAkM;QACnM,aAAa,EACZ,0LAA0L;QAC3L,gBAAgB,EAAE;YACjB,uIAAuI;YACvI,8KAA8K;YAC9K,4LAA4L;YAC5L,+JAA+J;YAC/J,4FAA4F;SAC5F;QACD,UAAU,EAAE,iBAAiB;QAC7B,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,MAAM;QACnB,UAAU,GAAG;YACZ,OAAO,sBAAsB,EAAE,CAAC;QAAA,CAChC;QACD,YAAY,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,KAAY,EAAE;YAC/D,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,2BAA2B,CAAC,KAAK,EAAE;oBAC7C,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE,iBAAiB;oBACzB,MAAM,EAAE,SAAS;iBACjB,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,2BAA2B,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QAAA,CAClG;QACD,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE;YACzD,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBACtC,OAAO,MAAM,CACZ;oBACC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,aAAa;oBACrB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,mEAAmE;iBAC5E,EACD,mDAAmD,CACnD,CAAC;YACH,CAAC;YACD,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACnE,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAC1C,wGAAwG,CACxG,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACJ,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3F,IAAI,YAAY;oBAAE,OAAO,YAAY,CAAC;gBACtC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;oBAC5C,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EACpD,yBAAyB,QAAQ,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qEAAqE,CACxJ,CAAC;gBACH,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;oBAC7C,OAAO,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC7E,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa;oBAAE,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBACjF,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;gBAC/F,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAChF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACnD,CAAC;QAAA,CACD;KACD,CAAC,CAAC;AAAA,CACH","sourcesContent":["import { type Static, Type } from \"typebox\";\nimport { ExtensionEditorComponent } from \"../../modes/interactive/components/extension-editor.ts\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport { defineTool, type ExtensionContext } from \"../extensions/types.ts\";\nimport { parseDotenvDocument, SecretDotenvError } from \"../secrets/secret-dotenv.ts\";\nimport {\n\tMAX_VARIABLES_PER_PROFILE,\n\tSECRET_DESCRIPTION_MAX_CHARS,\n\tSECRET_PRINTABLE_METADATA_PATTERN,\n\tSECRET_PROFILE_ID_MAX_CHARS,\n\tSECRET_PROFILE_ID_PATTERN,\n\tSECRET_VARIABLE_NAME_MAX_CHARS,\n\tSECRET_VARIABLE_NAME_PATTERN,\n\ttype SecretProfileSummary,\n\tSecretVault,\n\tSecretVaultError,\n} from \"../secrets/secret-vault.ts\";\nimport {\n\temptyOrchestrationCall,\n\tOrchestrationPanelComponent,\n\ttype OrchestrationPanelModel,\n} from \"./orchestration-panel.ts\";\n\nconst secretStoreSchema = Type.Object(\n\t{\n\t\taction: Type.Union(\n\t\t\t[\n\t\t\t\tType.Literal(\"set\"),\n\t\t\t\tType.Literal(\"list\"),\n\t\t\t\tType.Literal(\"materialize\"),\n\t\t\t\tType.Literal(\"remove\"),\n\t\t\t\tType.Literal(\"lock\"),\n\t\t\t],\n\t\t\t{ description: \"Credential-management action.\" },\n\t\t),\n\t\tprofile: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: SECRET_PROFILE_ID_MAX_CHARS,\n\t\t\t\tpattern: SECRET_PROFILE_ID_PATTERN,\n\t\t\t\tdescription: \"Portable profile identifier, such as project-dev or aws-work.\",\n\t\t\t}),\n\t\t),\n\t\tdescription: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: SECRET_DESCRIPTION_MAX_CHARS,\n\t\t\t\tpattern: SECRET_PRINTABLE_METADATA_PATTERN,\n\t\t\t\tdescription: \"Non-secret profile description.\",\n\t\t\t}),\n\t\t),\n\t\tenvFile: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: 512,\n\t\t\t\tdescription:\n\t\t\t\t\t\"Relative dotenv location inside the current workspace, such as .env, .env.local, or config/dev.env. Valid only for set.\",\n\t\t\t}),\n\t\t),\n\t\tvariableNames: Type.Optional(\n\t\t\tType.Array(\n\t\t\t\tType.String({\n\t\t\t\t\tminLength: 1,\n\t\t\t\t\tmaxLength: SECRET_VARIABLE_NAME_MAX_CHARS,\n\t\t\t\t\tpattern: SECRET_VARIABLE_NAME_PATTERN,\n\t\t\t\t}),\n\t\t\t\t{\n\t\t\t\t\tminItems: 1,\n\t\t\t\t\tmaxItems: MAX_VARIABLES_PER_PROFILE,\n\t\t\t\t\tdescription: \"Specific variable names to remove. Omit to remove the whole profile.\",\n\t\t\t\t},\n\t\t\t),\n\t\t),\n\t\tscope: Type.Optional(\n\t\t\tType.Union([Type.Literal(\"managed\"), Type.Literal(\"workspace\")], {\n\t\t\t\tdescription:\n\t\t\t\t\t\"Materialization target. workspace resolves the durable current-project binding; managed writes private Pi state.\",\n\t\t\t}),\n\t\t),\n\t},\n\t{ additionalProperties: false },\n);\n\nexport type SecretStoreToolInput = Static<typeof secretStoreSchema>;\n\nexport type SecretStoreStatus =\n\t| \"cancelled\"\n\t| \"error\"\n\t| \"listed\"\n\t| \"locked\"\n\t| \"materialized\"\n\t| \"removed\"\n\t| \"stored\"\n\t| \"unavailable\";\n\nexport interface SecretStoreToolDetails {\n\taction: SecretStoreToolInput[\"action\"];\n\tstatus: SecretStoreStatus;\n\tprofile?: string;\n\tvariableNames?: string[];\n\tprofiles?: SecretProfileSummary[];\n\tscope?: \"managed\" | \"workspace\";\n\tenvFile?: string;\n\tmaterialized?: boolean;\n\tcode?: string;\n\tmessage?: string;\n}\n\nexport interface SecretStoreToolOptions {\n\tagentDir?: string;\n\tvault?: SecretVault;\n}\n\ntype SecretStoreResult = {\n\tcontent: Array<{ type: \"text\"; text: string }>;\n\tdetails: SecretStoreToolDetails;\n};\n\nfunction result(details: SecretStoreToolDetails, text: string): SecretStoreResult {\n\treturn { content: [{ type: \"text\", text }], details };\n}\n\nfunction cancelled(action: SecretStoreToolInput[\"action\"], profile?: string): SecretStoreResult {\n\treturn result(\n\t\t{ action, status: \"cancelled\", ...(profile ? { profile } : {}), code: \"owner_cancelled\" },\n\t\t\"Secret store action was cancelled by the owner.\",\n\t);\n}\n\nfunction failed(action: SecretStoreToolInput[\"action\"], error: unknown, profile?: string): SecretStoreResult {\n\tconst code = error instanceof SecretVaultError ? error.code : \"safe_failure\";\n\tconst message =\n\t\terror instanceof SecretVaultError ? error.message : \"Secret store failed safely without exposing values.\";\n\treturn result(\n\t\t{ action, status: \"error\", ...(profile ? { profile } : {}), code, message },\n\t\t`Secret store failed: ${message}`,\n\t);\n}\n\nfunction invalid(\n\taction: SecretStoreToolInput[\"action\"],\n\tcode: string,\n\tmessage: string,\n\tprofile?: string,\n): SecretStoreResult {\n\treturn result(\n\t\t{ action, status: \"error\", ...(profile ? { profile } : {}), code, message },\n\t\t`Secret store request is invalid: ${message}`,\n\t);\n}\n\nfunction panelModel(details: SecretStoreToolDetails | undefined, expanded: boolean): OrchestrationPanelModel {\n\tif (!details) return { label: \"secrets\", status: \"error\", emptyText: \"No secret-store result was retained.\" };\n\tconst success = [\"listed\", \"locked\", \"materialized\", \"removed\", \"stored\"].includes(details.status);\n\tconst rows = expanded\n\t\t? (details.profiles ?? []).map((profile) => ({\n\t\t\t\tstatus: \"info\" as const,\n\t\t\t\tlabel: profile.profile,\n\t\t\t\tmeta: [\n\t\t\t\t\t`${profile.variableNames.length} variable${profile.variableNames.length === 1 ? \"\" : \"s\"}`,\n\t\t\t\t\t`${profile.bindings.length} binding${profile.bindings.length === 1 ? \"\" : \"s\"}`,\n\t\t\t\t],\n\t\t\t\tdetails: [\n\t\t\t\t\t...(profile.description ? [profile.description] : []),\n\t\t\t\t\t...profile.bindings.map((binding) => `${binding.envFile} · ${binding.workspace}`),\n\t\t\t\t],\n\t\t\t}))\n\t\t: undefined;\n\treturn {\n\t\tlabel: \"secrets\",\n\t\taction: details.status,\n\t\tstatus: success ? \"success\" : details.status === \"cancelled\" ? \"warning\" : \"error\",\n\t\tsummary: [\n\t\t\tdetails.profile,\n\t\t\tdetails.envFile,\n\t\t\tdetails.scope,\n\t\t\tdetails.variableNames\n\t\t\t\t? `${details.variableNames.length} variable${details.variableNames.length === 1 ? \"\" : \"s\"}`\n\t\t\t\t: undefined,\n\t\t\tdetails.profiles ? `${details.profiles.length} profile${details.profiles.length === 1 ? \"\" : \"s\"}` : undefined,\n\t\t].filter((value): value is string => value !== undefined),\n\t\trows,\n\t\tnotices:\n\t\t\texpanded && details.message ? [{ status: success ? \"info\" : \"error\", text: details.message }] : undefined,\n\t};\n}\n\nasync function ensureUnlocked(\n\tvault: SecretVault,\n\taction: SecretStoreToolInput[\"action\"],\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n\tprofile?: string,\n): Promise<SecretStoreResult | undefined> {\n\tif (vault.isUnlocked) return undefined;\n\tif (await vault.exists()) {\n\t\twhile (!signal?.aborted) {\n\t\t\tlet passphrase = await ctx.ui.input(\"Unlock secret vault\", \"Master passphrase\", {\n\t\t\t\tsignal,\n\t\t\t\tsensitive: true,\n\t\t\t});\n\t\t\tif (passphrase === undefined || signal?.aborted) return cancelled(action, profile);\n\t\t\ttry {\n\t\t\t\tawait vault.unlock(passphrase);\n\t\t\t\treturn undefined;\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof SecretVaultError && [\"invalid_passphrase\", \"unlock_failed\"].includes(error.code)) {\n\t\t\t\t\tctx.ui.notify(error.message, \"error\");\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn failed(action, error, profile);\n\t\t\t} finally {\n\t\t\t\tpassphrase = \"\";\n\t\t\t}\n\t\t}\n\t\treturn cancelled(action, profile);\n\t}\n\n\twhile (!signal?.aborted) {\n\t\tlet passphrase = await ctx.ui.input(\"Create secret vault\", \"New master passphrase\", { signal, sensitive: true });\n\t\tif (passphrase === undefined || signal?.aborted) return cancelled(action, profile);\n\t\tlet confirmation = await ctx.ui.input(\"Confirm secret vault\", \"Repeat master passphrase\", {\n\t\t\tsignal,\n\t\t\tsensitive: true,\n\t\t});\n\t\tif (confirmation === undefined || signal?.aborted) {\n\t\t\tpassphrase = \"\";\n\t\t\treturn cancelled(action, profile);\n\t\t}\n\t\ttry {\n\t\t\tif (passphrase !== confirmation) {\n\t\t\t\tctx.ui.notify(\"The two master passphrases do not match.\", \"error\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tawait vault.initialize(passphrase);\n\t\t\treturn undefined;\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretVaultError && error.code === \"invalid_passphrase\") {\n\t\t\t\tctx.ui.notify(error.message, \"error\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\treturn failed(action, error, profile);\n\t\t} finally {\n\t\t\tpassphrase = \"\";\n\t\t\tconfirmation = \"\";\n\t\t}\n\t}\n\treturn cancelled(action, profile);\n}\n\nfunction validateInput(input: SecretStoreToolInput): SecretStoreResult | undefined {\n\tif (input.action === \"lock\" || input.action === \"list\") {\n\t\tif (\n\t\t\tinput.profile !== undefined ||\n\t\t\tinput.description !== undefined ||\n\t\t\tinput.envFile !== undefined ||\n\t\t\tinput.variableNames !== undefined ||\n\t\t\tinput.scope !== undefined\n\t\t) {\n\t\t\treturn invalid(input.action, \"unexpected_fields\", `Action ${input.action} does not accept profile fields.`);\n\t\t}\n\t\treturn undefined;\n\t}\n\tif (input.action === \"set\" && !input.profile) {\n\t\treturn invalid(input.action, \"profile_required\", \"Action set requires a profile.\");\n\t}\n\tif (input.action === \"remove\" && !input.profile) {\n\t\treturn invalid(input.action, \"profile_required\", \"Action remove requires a profile.\");\n\t}\n\tif (input.action !== \"set\" && (input.description !== undefined || input.envFile !== undefined)) {\n\t\treturn invalid(\n\t\t\tinput.action,\n\t\t\t\"unexpected_profile_fields\",\n\t\t\t\"description and envFile are valid only for set.\",\n\t\t\tinput.profile,\n\t\t);\n\t}\n\tif (input.action !== \"remove\" && input.variableNames !== undefined) {\n\t\treturn invalid(\n\t\t\tinput.action,\n\t\t\t\"unexpected_variable_names\",\n\t\t\t\"variableNames is valid only for remove.\",\n\t\t\tinput.profile,\n\t\t);\n\t}\n\tif (input.action !== \"materialize\" && input.scope !== undefined) {\n\t\treturn invalid(input.action, \"unexpected_scope\", \"scope is valid only for materialize.\", input.profile);\n\t}\n\tif (input.variableNames && new Set(input.variableNames).size !== input.variableNames.length) {\n\t\treturn invalid(input.action, \"duplicate_variables\", \"Variable names must be unique.\", input.profile);\n\t}\n\treturn undefined;\n}\n\nasync function openPrivateDotenvEditor(\n\tctx: ExtensionContext,\n\ttitle: string,\n\tprefill: string,\n\tsignal: AbortSignal | undefined,\n): Promise<string | undefined> {\n\tif (signal?.aborted) return undefined;\n\ttry {\n\t\treturn await ctx.ui.custom<string | undefined>(\n\t\t\t(tui, _theme, keybindings, done) =>\n\t\t\t\tnew ExtensionEditorComponent(\n\t\t\t\t\ttui,\n\t\t\t\t\tkeybindings,\n\t\t\t\t\ttitle,\n\t\t\t\t\tprefill,\n\t\t\t\t\t(value) => done(value),\n\t\t\t\t\t() => done(undefined),\n\t\t\t\t\t{\n\t\t\t\t\t\tprivateContent: true,\n\t\t\t\t\t\tallowExternalEditor: false,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t\tnotice: \"Private plaintext editor · content stays local and never enters model context\",\n\t\t\t\t\t},\n\t\t\t\t),\n\t\t);\n\t} catch (error) {\n\t\tif (signal?.aborted) return undefined;\n\t\tthrow error;\n\t}\n}\n\nasync function captureValidDotenv(\n\tctx: ExtensionContext,\n\ttitle: string,\n\tprefill: string,\n\tsignal: AbortSignal | undefined,\n): Promise<{ document: string; variableNames: string[] } | undefined> {\n\tlet draft = prefill;\n\twhile (!signal?.aborted) {\n\t\tconst edited = await openPrivateDotenvEditor(ctx, title, draft, signal);\n\t\tif (edited === undefined || signal?.aborted) return undefined;\n\t\ttry {\n\t\t\tconst parsed = parseDotenvDocument(edited);\n\t\t\tconst variableNames = parsed.variables.map((variable) => variable.name);\n\t\t\tfor (const variable of parsed.variables) variable.value = \"\";\n\t\t\tdraft = \"\";\n\t\t\treturn { document: parsed.document, variableNames };\n\t\t} catch (error) {\n\t\t\tctx.ui.notify(error instanceof SecretDotenvError ? error.message : \"The dotenv document is invalid.\", \"error\");\n\t\t\tdraft = edited;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nasync function executeSet(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput & { profile: string },\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n): Promise<SecretStoreResult> {\n\tlet document = \"\";\n\tlet originalUnmanagedContent: string | undefined;\n\ttry {\n\t\tconst target = vault.resolveBindingTarget(ctx.cwd, input.envFile ?? \".env\");\n\t\tconst destinationState = await vault.inspectEnvDestination(target.destination, input.profile);\n\t\tif (destinationState === \"managed-other\") {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The selected dotenv location is already managed by another profile.\",\n\t\t\t\tinput.profile,\n\t\t\t);\n\t\t}\n\t\tconst storedDocument = await vault.getProfileDocument(input.profile);\n\t\tlet prefill = storedDocument ?? \"\";\n\t\tif (destinationState === \"unmanaged\") {\n\t\t\toriginalUnmanagedContent = await vault.readOwnerDotenv(target.destination);\n\t\t\tprefill = originalUnmanagedContent;\n\t\t}\n\t\tif (destinationState === \"managed-profile\" && storedDocument === undefined) {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"profile_missing\",\n\t\t\t\t\"The dotenv target claims this profile, but the encrypted profile is missing.\",\n\t\t\t\tinput.profile,\n\t\t\t);\n\t\t}\n\n\t\tconst captured = await captureValidDotenv(\n\t\t\tctx,\n\t\t\t`Secrets · ${input.profile}  →  ${target.destination}`,\n\t\t\tprefill,\n\t\t\tsignal,\n\t\t);\n\t\tprefill = \"\";\n\t\tif (!captured) return cancelled(input.action, input.profile);\n\t\tdocument = captured.document;\n\t\tawait vault.replaceProfileDocument(input.profile, input.description, document, {\n\t\t\tworkspace: target.workspace,\n\t\t\tenvFile: target.envFile,\n\t\t});\n\t\ttry {\n\t\t\tawait vault.materializeEnv(input.profile, target.destination, {\n\t\t\t\tallowReplaceUnmanaged: destinationState === \"unmanaged\",\n\t\t\t\texpectedUnmanagedContent: originalUnmanagedContent,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof SecretVaultError ? error.message : \"Dotenv materialization failed safely.\";\n\t\t\tctx.ui.notify(`Profile stored, but ${target.destination} was not refreshed: ${message}`, \"warning\");\n\t\t\treturn result(\n\t\t\t\t{\n\t\t\t\t\taction: input.action,\n\t\t\t\t\tstatus: \"stored\",\n\t\t\t\t\tprofile: input.profile,\n\t\t\t\t\tenvFile: target.envFile,\n\t\t\t\t\tvariableNames: captured.variableNames,\n\t\t\t\t\tmaterialized: false,\n\t\t\t\t\tcode: \"materialization_failed\",\n\t\t\t\t\tmessage,\n\t\t\t\t},\n\t\t\t\t`Stored profile ${input.profile}, but its bound dotenv could not be refreshed. Retry secret_store materialize; no values were exposed.`,\n\t\t\t);\n\t\t}\n\t\tctx.ui.notify(`Credential profile ${input.profile} stored and activated at ${target.destination}`, \"info\");\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"stored\",\n\t\t\t\tprofile: input.profile,\n\t\t\t\tenvFile: target.envFile,\n\t\t\t\tvariableNames: captured.variableNames,\n\t\t\t\tmaterialized: true,\n\t\t\t},\n\t\t\t`Stored and activated ${captured.variableNames.length} variables for profile ${input.profile} at its bound workspace dotenv location. Values never entered model context.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t} finally {\n\t\tdocument = \"\";\n\t\toriginalUnmanagedContent = undefined;\n\t}\n}\n\nasync function executeMaterialize(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput,\n\tctx: ExtensionContext,\n): Promise<SecretStoreResult> {\n\ttry {\n\t\tconst scope = input.scope ?? \"workspace\";\n\t\tconst binding = await vault.resolveBindingForWorkspace(ctx.cwd, input.profile);\n\t\tconst destination = scope === \"managed\" ? vault.getManagedEnvPath(binding.profile) : binding.destination;\n\t\tconst destinationState = await vault.inspectEnvDestination(destination, binding.profile);\n\t\tif (destinationState === \"unmanaged\" || destinationState === \"managed-other\") {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The bound dotenv location is no longer safely managed. Use set to review it in the private editor.\",\n\t\t\t\tbinding.profile,\n\t\t\t);\n\t\t}\n\t\tconst materialized = await vault.materializeEnv(binding.profile, destination, {\n\t\t\tactivationWorkspace: ctx.cwd,\n\t\t\tmanaged: scope === \"managed\",\n\t\t});\n\t\tctx.ui.notify(`Credential profile ${binding.profile} activated at ${destination}`, \"info\");\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"materialized\",\n\t\t\t\tprofile: binding.profile,\n\t\t\t\tvariableNames: materialized.variableNames,\n\t\t\t\tscope,\n\t\t\t\tenvFile: scope === \"workspace\" ? binding.envFile : undefined,\n\t\t\t\tmaterialized: true,\n\t\t\t},\n\t\t\t`Activated profile ${binding.profile} for the current workspace. Its dotenv and process environment are available without exposing values to the model.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t}\n}\n\nasync function executeRemove(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput & { profile: string },\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n): Promise<SecretStoreResult> {\n\tconst target = input.variableNames?.length\n\t\t? `${input.variableNames.join(\", \")} from profile ${input.profile}`\n\t\t: `the entire profile ${input.profile}`;\n\tconst approved = await ctx.ui.confirm(\n\t\t\"Remove stored secrets\",\n\t\t`Remove ${target}? Pi-managed workspace and private dotenv copies are invalidated.`,\n\t\t{ signal },\n\t);\n\tif (!approved || signal?.aborted) return cancelled(input.action, input.profile);\n\ttry {\n\t\tconst removal = await vault.removeProfile(input.profile, input.variableNames);\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"removed\",\n\t\t\t\tprofile: input.profile,\n\t\t\t\tvariableNames: removal.removedVariableNames,\n\t\t\t},\n\t\t\t`Removed ${removal.removedVariableNames.length} secret variable${removal.removedVariableNames.length === 1 ? \"\" : \"s\"} from profile ${input.profile}.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t}\n}\n\nexport function createSecretStoreToolDefinition(options: SecretStoreToolOptions) {\n\tconst vault = options.vault ?? (options.agentDir ? SecretVault.forAgentDir(options.agentDir) : undefined);\n\tif (!vault) throw new Error(\"secret_store requires an agentDir or SecretVault\");\n\treturn defineTool<typeof secretStoreSchema, SecretStoreToolDetails>({\n\t\tname: \"secret_store\",\n\t\tlabel: \"Secret Store\",\n\t\tdescription:\n\t\t\t\"Open a model-blind native dotenv editor, encrypt owner credentials, bind profiles to workspace dotenv locations, and activate them for normal process use without returning values to the model.\",\n\t\tpromptSnippet:\n\t\t\t\"Manage credentials through the model-blind secret vault. Before credential-dependent work, materialize the current workspace binding; use set to open the owner's private dotenv editor.\",\n\t\tpromptGuidelines: [\n\t\t\t\"Use secret_store whenever credentials are needed. Never ask the owner to paste a secret into chat or place a value in tool arguments.\",\n\t\t\t\"Use set with a profile and relative envFile. The harness opens a private plaintext editor, persists the workspace binding, writes the dotenv, and activates the environment.\",\n\t\t\t\"Before credential-dependent commands in a later session, call materialize without a profile to resolve the current workspace binding. Use list only when selection or discovery is needed.\",\n\t\t\t\"After activation, run the consuming application normally. Never read, grep, print, echo, source, or otherwise inspect credential files or environment values.\",\n\t\t\t\"Treat cancellation as owner intent. Do not immediately repeat the same credential request.\",\n\t\t],\n\t\tparameters: secretStoreSchema,\n\t\texecutionMode: \"sequential\",\n\t\trenderShell: \"self\",\n\t\trenderCall() {\n\t\t\treturn emptyOrchestrationCall();\n\t\t},\n\t\trenderResult(toolResult, { expanded, isPartial }, theme: Theme) {\n\t\t\tif (isPartial) {\n\t\t\t\treturn new OrchestrationPanelComponent(theme, {\n\t\t\t\t\tlabel: \"secrets\",\n\t\t\t\t\taction: \"waiting for you\",\n\t\t\t\t\tstatus: \"running\",\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn new OrchestrationPanelComponent(theme, panelModel(toolResult.details, expanded), expanded);\n\t\t},\n\t\tasync execute(_toolCallId, input, signal, _onUpdate, ctx) {\n\t\t\tif (!ctx.hasUI || ctx.mode !== \"tui\") {\n\t\t\t\treturn result(\n\t\t\t\t\t{\n\t\t\t\t\t\taction: input.action,\n\t\t\t\t\t\tstatus: \"unavailable\",\n\t\t\t\t\t\t...(input.profile ? { profile: input.profile } : {}),\n\t\t\t\t\t\tcode: \"user_tui_required\",\n\t\t\t\t\t\tmessage: \"Secret values can be captured only in a user-visible TUI session.\",\n\t\t\t\t\t},\n\t\t\t\t\t\"secret_store requires a user-visible TUI session.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (signal?.aborted) return cancelled(input.action, input.profile);\n\t\t\tconst validation = validateInput(input);\n\t\t\tif (validation) return validation;\n\t\t\tif (input.action === \"lock\") {\n\t\t\t\tvault.lock();\n\t\t\t\treturn result(\n\t\t\t\t\t{ action: input.action, status: \"locked\" },\n\t\t\t\t\t\"Secret vault locked; cached key, credential environment, and exact-value redaction cache were cleared.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst unlockResult = await ensureUnlocked(vault, input.action, ctx, signal, input.profile);\n\t\t\t\tif (unlockResult) return unlockResult;\n\t\t\t\tif (input.action === \"list\") {\n\t\t\t\t\tconst profiles = await vault.listProfiles();\n\t\t\t\t\treturn result(\n\t\t\t\t\t\t{ action: input.action, status: \"listed\", profiles },\n\t\t\t\t\t\t`Secret vault contains ${profiles.length} profile${profiles.length === 1 ? \"\" : \"s\"}. Only names, variable names, and workspace bindings were returned.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (input.action === \"set\" && input.profile) {\n\t\t\t\t\treturn executeSet(vault, { ...input, profile: input.profile }, ctx, signal);\n\t\t\t\t}\n\t\t\t\tif (input.action === \"materialize\") return executeMaterialize(vault, input, ctx);\n\t\t\t\tif (!input.profile) return invalid(input.action, \"profile_required\", \"A profile is required.\");\n\t\t\t\treturn executeRemove(vault, { ...input, profile: input.profile }, ctx, signal);\n\t\t\t} catch (error) {\n\t\t\t\treturn failed(input.action, error, input.profile);\n\t\t\t}\n\t\t},\n\t});\n}\n"]}

package/dist/core/tools/shell-command-parser.d.ts

@@ -0,0 +1,16 @@
+export type ShellTokenKind = "arg" | "operator" | "pipe" | "redirect";
+export interface ShellToken {
+    kind: ShellTokenKind;
+    value: string;
+}
+/** Tokenize one simple command while preserving the pre-existing quote/escape contract. */
+export declare function tokenizeCommand(command: string): string[] | null;
+/** Tokenize a shell command and expose quote-aware command boundaries and redirects. */
+export declare function tokenizeShellCommand(command: string): ShellToken[] | null;
+export interface ParsedCommand {
+    envVars: Record<string, string>;
+    coreCommandTokens: string[];
+}
+export declare function parseCommandPrefixes(command: string): ParsedCommand | null;
+export declare function isComplexShellCommand(command: string): boolean;
+//# sourceMappingURL=shell-command-parser.d.ts.map

package/dist/core/tools/shell-command-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-command-parser.d.ts","sourceRoot":"","sources":["../../../src/core/tools/shell-command-parser.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,GAAG,UAAU,CAAC;AAEtE,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACd;AA0FD,2FAA2F;AAC3F,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI,CAEhE;AAED,wFAAwF;AACxF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,IAAI,CAEzE;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAgB1E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE9D","sourcesContent":["export type ShellTokenKind = \"arg\" | \"operator\" | \"pipe\" | \"redirect\";\n\nexport interface ShellToken {\n\tkind: ShellTokenKind;\n\tvalue: string;\n}\n\ninterface TokenizeOptions {\n\toperators: boolean;\n}\n\nfunction pushArgument(tokens: ShellToken[], current: string): string {\n\tif (current.length > 0) tokens.push({ kind: \"arg\", value: current });\n\treturn \"\";\n}\n\nfunction tokenize(input: string, options: TokenizeOptions): ShellToken[] | null {\n\tconst tokens: ShellToken[] = [];\n\tlet current = \"\";\n\tlet quote: \"'\" | '\"' | undefined;\n\tlet escaped = false;\n\n\tfor (let index = 0; index < input.length; index++) {\n\t\tconst char = input[index];\n\t\tif (escaped) {\n\t\t\tcurrent += char;\n\t\t\tescaped = false;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"\\\\\" && quote !== \"'\") {\n\t\t\tescaped = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (quote) {\n\t\t\tif (char === quote) quote = undefined;\n\t\t\telse current += char;\n\t\t\tcontinue;\n\t\t}\n\t\tif (char === \"'\" || char === '\"') {\n\t\t\tquote = char;\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (options.operators && (char === \"|\" || char === \"&\" || char === \";\" || char === \"\\n\" || char === \"\\r\")) {\n\t\t\tcurrent = pushArgument(tokens, current);\n\t\t\tif (char === \"|\" && input[index + 1] === \"&\") {\n\t\t\t\ttokens.push({ kind: \"pipe\", value: \"|&\" });\n\t\t\t\tindex++;\n\t\t\t} else if ((char === \"|\" || char === \"&\") && input[index + 1] === char) {\n\t\t\t\ttokens.push({ kind: \"operator\", value: `${char}${char}` });\n\t\t\t\tindex++;\n\t\t\t} else if (char === \"|\") {\n\t\t\t\ttokens.push({ kind: \"pipe\", value: char });\n\t\t\t} else {\n\t\t\t\ttokens.push({ kind: \"operator\", value: char });\n\t\t\t}\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (options.operators && (char === \">\" || char === \"<\")) {\n\t\t\tlet fileDescriptor = \"\";\n\t\t\tif (char === \">\" && /^\\d+$/u.test(current)) {\n\t\t\t\tfileDescriptor = current;\n\t\t\t\tcurrent = \"\";\n\t\t\t} else {\n\t\t\t\tcurrent = pushArgument(tokens, current);\n\t\t\t}\n\t\t\tlet value = `${fileDescriptor}${char}`;\n\t\t\tif (input[index + 1] === char) {\n\t\t\t\tvalue += char;\n\t\t\t\tindex++;\n\t\t\t}\n\t\t\tif (input[index + 1] === \"&\") {\n\t\t\t\tvalue += \"&\";\n\t\t\t\tindex++;\n\t\t\t\twhile (index + 1 < input.length && /[\\d-]/u.test(input[index + 1])) {\n\t\t\t\t\tvalue += input[++index];\n\t\t\t\t}\n\t\t\t}\n\t\t\ttokens.push({ kind: \"redirect\", value });\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (/\\s/u.test(char)) {\n\t\t\tcurrent = pushArgument(tokens, current);\n\t\t\tcontinue;\n\t\t}\n\t\tcurrent += char;\n\t}\n\n\tif (quote || escaped) return null;\n\tpushArgument(tokens, current);\n\treturn tokens;\n}\n\n/** Tokenize one simple command while preserving the pre-existing quote/escape contract. */\nexport function tokenizeCommand(command: string): string[] | null {\n\treturn tokenize(command, { operators: false })?.map((token) => token.value) ?? null;\n}\n\n/** Tokenize a shell command and expose quote-aware command boundaries and redirects. */\nexport function tokenizeShellCommand(command: string): ShellToken[] | null {\n\treturn tokenize(command, { operators: true });\n}\n\nexport interface ParsedCommand {\n\tenvVars: Record<string, string>;\n\tcoreCommandTokens: string[];\n}\n\nexport function parseCommandPrefixes(command: string): ParsedCommand | null {\n\tconst tokens = tokenizeCommand(command);\n\tif (!tokens || tokens.length === 0) return null;\n\n\tconst envVars: Record<string, string> = {};\n\tlet index = 0;\n\tconst envPattern = /^([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$/u;\n\n\twhile (index < tokens.length) {\n\t\tconst match = tokens[index].match(envPattern);\n\t\tif (!match) break;\n\t\tenvVars[match[1]] = match[2];\n\t\tindex++;\n\t}\n\n\treturn { envVars, coreCommandTokens: tokens.slice(index) };\n}\n\nexport function isComplexShellCommand(command: string): boolean {\n\treturn /[|><&;\\n\\r$`()*?[\\]#]/u.test(command);\n}\n"]}

package/dist/core/tools/shell-command-parser.js

@@ -0,0 +1,113 @@
+function pushArgument(tokens, current) {
+    if (current.length > 0)
+        tokens.push({ kind: "arg", value: current });
+    return "";
+}
+function tokenize(input, options) {
+    const tokens = [];
+    let current = "";
+    let quote;
+    let escaped = false;
+    for (let index = 0; index < input.length; index++) {
+        const char = input[index];
+        if (escaped) {
+            current += char;
+            escaped = false;
+            continue;
+        }
+        if (char === "\\" && quote !== "'") {
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (char === quote)
+                quote = undefined;
+            else
+                current += char;
+            continue;
+        }
+        if (char === "'" || char === '"') {
+            quote = char;
+            continue;
+        }
+        if (options.operators && (char === "|" || char === "&" || char === ";" || char === "\n" || char === "\r")) {
+            current = pushArgument(tokens, current);
+            if (char === "|" && input[index + 1] === "&") {
+                tokens.push({ kind: "pipe", value: "|&" });
+                index++;
+            }
+            else if ((char === "|" || char === "&") && input[index + 1] === char) {
+                tokens.push({ kind: "operator", value: `${char}${char}` });
+                index++;
+            }
+            else if (char === "|") {
+                tokens.push({ kind: "pipe", value: char });
+            }
+            else {
+                tokens.push({ kind: "operator", value: char });
+            }
+            continue;
+        }
+        if (options.operators && (char === ">" || char === "<")) {
+            let fileDescriptor = "";
+            if (char === ">" && /^\d+$/u.test(current)) {
+                fileDescriptor = current;
+                current = "";
+            }
+            else {
+                current = pushArgument(tokens, current);
+            }
+            let value = `${fileDescriptor}${char}`;
+            if (input[index + 1] === char) {
+                value += char;
+                index++;
+            }
+            if (input[index + 1] === "&") {
+                value += "&";
+                index++;
+                while (index + 1 < input.length && /[\d-]/u.test(input[index + 1])) {
+                    value += input[++index];
+                }
+            }
+            tokens.push({ kind: "redirect", value });
+            continue;
+        }
+        if (/\s/u.test(char)) {
+            current = pushArgument(tokens, current);
+            continue;
+        }
+        current += char;
+    }
+    if (quote || escaped)
+        return null;
+    pushArgument(tokens, current);
+    return tokens;
+}
+/** Tokenize one simple command while preserving the pre-existing quote/escape contract. */
+export function tokenizeCommand(command) {
+    return tokenize(command, { operators: false })?.map((token) => token.value) ?? null;
+}
+/** Tokenize a shell command and expose quote-aware command boundaries and redirects. */
+export function tokenizeShellCommand(command) {
+    return tokenize(command, { operators: true });
+}
+export function parseCommandPrefixes(command) {
+    const tokens = tokenizeCommand(command);
+    if (!tokens || tokens.length === 0)
+        return null;
+    const envVars = {};
+    let index = 0;
+    const envPattern = /^([a-zA-Z_][a-zA-Z0-9_]*)=(.*)$/u;
+    while (index < tokens.length) {
+        const match = tokens[index].match(envPattern);
+        if (!match)
+            break;
+        envVars[match[1]] = match[2];
+        index++;
+    }
+    return { envVars, coreCommandTokens: tokens.slice(index) };
+}
+export function isComplexShellCommand(command) {
+    return /[|><&;\n\r$`()*?[\]#]/u.test(command);
+}
+//# sourceMappingURL=shell-command-parser.js.map