npm - @caupulican/pi-adaptative - Versions diffs - 0.81.42 → 0.84.1 - Mend

@caupulican/pi-adaptative 0.81.42 → 0.84.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1414) hide show

package/dist/core/secrets/credential-exposure-guard.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"credential-exposure-guard.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-exposure-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAGhE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AACnE,MAAM,2BAA2B,GAChC,kGAAkG,CAAC;AACpG,MAAM,oBAAoB,GACzB,0IAA0I,CAAC;AAC5I,MAAM,qBAAqB,GAAG,uFAAuF,CAAC;AACtH,MAAM,oBAAoB,GAAG,mCAAmC,CAAC;AACjE,MAAM,cAAc,GAAG,qCAAqC,CAAC;AAC7D,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAEzC,SAAS,QAAQ,CAAC,KAAc,EAAoC;IACnE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc,EAAW;IACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAAA,CAC3G;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe,EAAE,GAAW,EAAE,KAAmB,EAAW;IACrG,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,SAAS,KAAK,QAAQ;YAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;IACvE,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACJ,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;QACrE,CAAC;QACD,IAAI,CAAC;YACJ,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACR,wFAAwF;QACzF,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;QACrC,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9G,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAAA,CACxF,CAAC,CAAC;AAAA,CACH;AAED,SAAS,mBAAmB,CAC3B,OAAe,EACf,GAAW,EACX,KAAmB,EAC8B;IACjD,2BAA2B,CAAC,SAAS,GAAG,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACnE,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;QACpE,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,GAAG;gBAAE,SAAS;YAC/D,IAAI,yBAAyB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC;gBAAE,OAAO,iBAAiB,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;YACnG,OAAO,cAAc,CAAC;QACvB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,oBAAoB,CAAC,IAAY,EAAW;IACpD,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAC5E,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC;AAAA,CAChD;AAED,SAAS,qBAAqB,CAAC,OAAe,EAAE,GAAW,EAAW;IACrE,IAAI,CAAC;QACJ,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AAAA,CACD;AAED,SAAS,iCAAiC,CAAC,SAA4B,EAAE,GAAW,EAAW;IAC9F,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7B,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;IACF,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,aAAa,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAE/E,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC9C,IAAI,CAAC,cAAc,EAAE,CAAC;YACrB,cAAc,GAAG,IAAI,CAAC;YACtB,SAAS;QACV,CAAC;QACD,IAAI,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,GAAW,EAAE,KAAmB,EAAW;IAC9F,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,SAAS,IAAI,yBAAyB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,kBAAkB,CAAC,IAAa,EAAsB;IAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAAA,CAC7D;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CACxC,QAAgB,EAChB,IAAa,EACb,GAAW,EACX,KAAmB,EACE;IACrB,IAAI,QAAQ,KAAK,cAAc,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,0KAA0K,CAAC;QACnL,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IACC,CAAC,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACrD,CAAC,IAAI,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EACnD,CAAC;YACF,OAAO,mGAAmG,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,IAAI,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,uLAAuL,CAAC;QAChM,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IACC,CAAC,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACrD,CAAC,OAAO,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACzD,CAAC;YACF,OAAO,kGAAkG,CAAC;QAC3G,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QACpF,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YAClC,OAAO,uKAAuK,CAAC;QAChL,CAAC;QACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YAC3E,OAAO,sIAAsI,CAAC;QAC/I,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IACC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAChC,4BAA4B,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;YAC9C,CAAC,UAAU,KAAK,SAAS,IAAI,yBAAyB,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,EAC9E,CAAC;YACF,OAAO,uIAAuI,CAAC;QAChJ,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED,SAAS,YAAY,CAAI,MAA0B,EAAE,KAAmB,EAAsB;IAC7F,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC5B,OAAO;QACN,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChH,OAAO,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAM;KACrE,CAAC;AAAA,CACF;AAED,SAAS,uBAAuB,CAC/B,KAAc,EACd,MAAgC,EAChC,MAAyB,EACzB,KAAK,GAAG,CAAC,EACC;IACV,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,KAAK,IAAI,yBAAyB,IAAI,MAAM,CAAC,KAAK,GAAG,yBAAyB,EAAE,CAAC;QACpF,OAAO,yCAAyC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,oDAAoD,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAC7G,CAAC;AAAA,CACF;AAED,wGAAwG;AACxG,MAAM,UAAU,mCAAmC,CAClD,IAAsC,EACtC,GAAW,EACX,KAAmB,EACgB;IACnC,OAAO;QACN,GAAG,IAAI;QACP,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE;YACnD,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACzE,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,UAAU,GAAG,QAAQ;gBAC1B,CAAC,CAAC,CAAC,OAAkC,EAAE,EAAE,CAAC;oBACxC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;gBAAA,CACvC;gBACF,CAAC,CAAC,SAAS,CAAC;YACb,IAAI,CAAC;gBACJ,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;YACxF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBACvG,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;YAC9F,CAAC;QAAA,CACD;KACD,CAAC;AAAA,CACF","sourcesContent":["import { realpathSync, statSync } from \"node:fs\";\nimport { basename, isAbsolute, relative, resolve, sep } from \"node:path\";\nimport type { AgentTool, AgentToolResult } from \"@caupulican/pi-agent-core\";\nimport type { TSchema } from \"typebox\";\nimport { redactKnownSecrets } from \"../security/secret-text.ts\";\nimport type { SecretVault } from \"./secret-vault.ts\";\n\nconst DIRECT_PATH_TOOLS = new Set([\"read\", \"edit\", \"write\", \"ls\"]);\nconst SHELL_INSPECTION_COMMAND_RE =\n\t/\\b(cat\|head\|tail\|less\|more\|sed\|awk\|grep\|rg\|type\|get-content\|select-string\|source)\\b([^\\n;&\|])/gi;\nconst SHELL_SECRET_READ_RE =\n\t/\\b(?:cat\|head\|tail\|less\|more\|sed\|awk\|grep\|rg\|type\|get-content\|select-string\|source)\\b[^\\n;&\|](?:^\|[\\\\/])?\\.env(?:\\.[A-Za-z0-9._-]+)?\\b/i;\nconst PYTHON_SECRET_READ_RE = /\\b(?:open\|read_text\|read_bytes)\\s\\([^\\n)](?:^\|[\\\\/])?\\.env(?:\\.[A-Za-z0-9._-]+)?\\b/i;\nconst PYTHON_INSPECTION_RE = /\\b(?:open\|read_text\|read_bytes)\\b/;\nconst QUOTED_TEXT_RE = /([\"'])([^\"'\\\\](?:\\\\.[^\"'\\\\]))\\1/g;\nconst MAX_REDACTED_DETAIL_DEPTH = 8;\nconst MAX_REDACTED_DETAIL_NODES = 10_000;\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isInside(root: string, target: string): boolean {\n\tconst fromRoot = relative(root, target);\n\treturn fromRoot === \"\" \|\| (!fromRoot.startsWith(`..${sep}`) && fromRoot !== \"..\" && !isAbsolute(fromRoot));\n}\n\nexport function isProtectedCredentialPath(rawPath: string, cwd: string, vault?: SecretVault): boolean {\n\tconst resolved = resolve(cwd, rawPath);\n\tconst candidates = [resolved];\n\ttry {\n\t\tconst canonical = realpathSync.native(resolved);\n\t\tif (canonical !== resolved) candidates.push(canonical);\n\t} catch {\n\t\t// Nonexistent write targets still receive the lexical filename check.\n\t}\n\tconst vaultPaths = vault ? [resolve(vault.vaultPath)] : [];\n\tconst materializedRoots = vault ? [resolve(vault.materializedDir)] : [];\n\tif (vault) {\n\t\ttry {\n\t\t\tvaultPaths.push(realpathSync.native(vault.vaultPath));\n\t\t} catch {\n\t\t\t// A not-yet-created vault still retains its lexical protected path.\n\t\t}\n\t\ttry {\n\t\t\tmaterializedRoots.push(realpathSync.native(vault.materializedDir));\n\t\t} catch {\n\t\t\t// A not-yet-created materialization directory still retains its lexical protected root.\n\t\t}\n\t}\n\treturn candidates.some((candidate) => {\n\t\tif (vault && (vaultPaths.includes(candidate) \|\| materializedRoots.some((root) => isInside(root, candidate)))) {\n\t\t\treturn true;\n\t\t}\n\t\tconst fileName = basename(candidate);\n\t\treturn fileName === \".env\" \|\| fileName.startsWith(\".env.\") \|\| fileName.endsWith(\".env\");\n\t});\n}\n\nfunction shellCredentialRisk(\n\tcommand: string,\n\tcwd: string,\n\tvault?: SecretVault,\n): \"broad_search\" \| \"credential_path\" \| undefined {\n\tSHELL_INSPECTION_COMMAND_RE.lastIndex = 0;\n\tfor (const match of command.matchAll(SHELL_INSPECTION_COMMAND_RE)) {\n\t\tconst toolName = (match[1] ?? \"\").toLowerCase();\n\t\tconst tokens = (match[2] ?? \"\").match(/\"[^\"]\"\|'[^']'\|\\S+/g) ?? [];\n\t\tfor (const rawToken of tokens) {\n\t\t\tconst token = rawToken.replace(/^[\"']\|[\"']$/g, \"\");\n\t\t\tif (!token \|\| token.startsWith(\"-\") \|\| token === \".\") continue;\n\t\t\tif (isProtectedCredentialPath(token, cwd, vault)) return \"credential_path\";\n\t\t}\n\t\tif ((toolName === \"grep\" \|\| toolName === \"rg\") && !shellSearchHasCredentialSafeScope(tokens, cwd)) {\n\t\t\treturn \"broad_search\";\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction isCredentialSafeGlob(glob: string): boolean {\n\tif (/(?:^\|[\\\\/])?\\.env(?:\\.\|\\\|$)/i.test(glob)) return false;\n\tconst filePattern = glob.replace(/\\\\/g, \"/\").split(\"/\").at(-1) ?? \"\";\n\tconst suffix = filePattern.match(/\\.([A-Za-z0-9_-]+)$/)?.[1]?.toLowerCase();\n\treturn suffix !== undefined && suffix !== \"env\";\n}\n\nfunction isExistingRegularFile(rawPath: string, cwd: string): boolean {\n\ttry {\n\t\treturn statSync(resolve(cwd, rawPath)).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction shellSearchHasCredentialSafeScope(rawTokens: readonly string[], cwd: string): boolean {\n\tconst tokens = rawTokens.map((token) => token.replace(/^[\"']\|[\"']$/g, \"\"));\n\tconst positiveGlobs: string[] = [];\n\tfor (let index = 0; index < tokens.length; index++) {\n\t\tconst token = tokens[index] ?? \"\";\n\t\tif (token === \"-g\" \|\| token === \"--glob\") {\n\t\t\tconst glob = tokens[++index];\n\t\t\tif (glob && !glob.startsWith(\"!\")) positiveGlobs.push(glob);\n\t\t} else if (token.startsWith(\"--glob=\")) {\n\t\t\tconst glob = token.slice(\"--glob=\".length);\n\t\t\tif (glob && !glob.startsWith(\"!\")) positiveGlobs.push(glob);\n\t\t}\n\t}\n\tif (positiveGlobs.length > 0) return positiveGlobs.every(isCredentialSafeGlob);\n\n\tlet skippedPattern = false;\n\tfor (const token of tokens) {\n\t\tif (!token \|\| token.startsWith(\"-\")) continue;\n\t\tif (!skippedPattern) {\n\t\t\tskippedPattern = true;\n\t\t\tcontinue;\n\t\t}\n\t\tif (isExistingRegularFile(token, cwd)) return true;\n\t}\n\treturn false;\n}\n\nfunction pythonInspectsCredentialPath(code: string, cwd: string, vault?: SecretVault): boolean {\n\tif (!PYTHON_INSPECTION_RE.test(code)) return false;\n\tQUOTED_TEXT_RE.lastIndex = 0;\n\tfor (const match of code.matchAll(QUOTED_TEXT_RE)) {\n\t\tconst candidate = match[2]?.replace(/\\\\([\\\\\"'])/g, \"$1\");\n\t\tif (candidate && isProtectedCredentialPath(candidate, cwd, vault)) return true;\n\t}\n\treturn false;\n}\n\nfunction directPathFromArgs(args: unknown): string \| undefined {\n\tif (!isRecord(args)) return undefined;\n\treturn typeof args.path === \"string\" ? args.path : undefined;\n}\n\n/** Stable model-facing refusal for direct inspection/mutation of credential material. /\nexport function credentialToolBlockReason(\n\ttoolName: string,\n\targs: unknown,\n\tcwd: string,\n\tvault?: SecretVault,\n): string \| undefined {\n\tif (toolName === \"secret_store\" \|\| !isRecord(args)) return undefined;\n\tif (DIRECT_PATH_TOOLS.has(toolName)) {\n\t\tconst path = directPathFromArgs(args);\n\t\tif (path && isProtectedCredentialPath(path, cwd, vault)) {\n\t\t\treturn \"Credential file access is model-blind. Use secret_store to edit or materialize the bound profile, then run the consuming application without inspecting the dotenv file.\";\n\t\t}\n\t}\n\tif (toolName === \"grep\") {\n\t\tconst path = typeof args.path === \"string\" ? args.path : undefined;\n\t\tconst glob = typeof args.glob === \"string\" ? args.glob : undefined;\n\t\tif (\n\t\t\t(path && isProtectedCredentialPath(path, cwd, vault)) \|\|\n\t\t\t(glob && /(?:^\|[\\\\/])?\\.env(?:\\.\|\\\|$)/i.test(glob))\n\t\t) {\n\t\t\treturn \"Credential dotenv files are excluded from model-facing search. Use secret_store metadata instead.\";\n\t\t}\n\t\tif (!(path && isExistingRegularFile(path, cwd)) && !(glob && isCredentialSafeGlob(glob))) {\n\t\t\treturn \"Credential-safe grep requires one explicit regular file or a narrow non-dotenv file glob (for example .ts). Refine the search instead of scanning a directory without a file filter.\";\n\t\t}\n\t}\n\tif (toolName === \"find\") {\n\t\tconst path = typeof args.path === \"string\" ? args.path : undefined;\n\t\tconst pattern = typeof args.pattern === \"string\" ? args.pattern : undefined;\n\t\tif (\n\t\t\t(path && isProtectedCredentialPath(path, cwd, vault)) \|\|\n\t\t\t(pattern && /(?:^\|[\\\\/])?\\.env(?:\\.\|\\\|$)/i.test(pattern))\n\t\t) {\n\t\t\treturn \"Credential dotenv files are excluded from model-facing discovery. Use secret_store list instead.\";\n\t\t}\n\t}\n\tif (toolName === \"bash\" \|\| toolName === \"powershell\" \|\| toolName === \"run_process\") {\n\t\tconst command = typeof args.command === \"string\" ? args.command : \"\";\n\t\tconst shellRisk = shellCredentialRisk(command, cwd, vault);\n\t\tif (shellRisk === \"broad_search\") {\n\t\t\treturn \"Credential-safe shell search requires a narrow non-dotenv file glob (for example -g '.ts') or one explicit regular file. Refine the rg/grep command before retrying.\";\n\t\t}\n\t\tif (SHELL_SECRET_READ_RE.test(command) \|\| shellRisk === \"credential_path\") {\n\t\t\treturn \"Direct shell inspection of credential dotenv files is blocked. Use secret_store, then run the credential-consuming command normally.\";\n\t\t}\n\t}\n\tif (toolName === \"python\") {\n\t\tconst code = typeof args.code === \"string\" ? args.code : \"\";\n\t\tconst scriptPath = typeof args.scriptPath === \"string\" ? args.scriptPath : undefined;\n\t\tif (\n\t\t\tPYTHON_SECRET_READ_RE.test(code) \|\|\n\t\t\tpythonInspectsCredentialPath(code, cwd, vault) \|\|\n\t\t\t(scriptPath !== undefined && isProtectedCredentialPath(scriptPath, cwd, vault))\n\t\t) {\n\t\t\treturn \"Direct Python inspection of credential dotenv files is blocked. Use secret_store, then run the credential-consuming program normally.\";\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction redactResult<T>(result: AgentToolResult<T>, vault?: SecretVault): AgentToolResult<T> {\n\tconst redact = (text: string) => (vault ? vault.redactSensitiveText(text) : redactKnownSecrets(text));\n\tconst budget = { nodes: 0 };\n\treturn {\n\t\t...result,\n\t\tcontent: result.content.map((block) => (block.type === \"text\" ? { ...block, text: redact(block.text) } : block)),\n\t\tdetails: redactStructuredDetails(result.details, redact, budget) as T,\n\t};\n}\n\nfunction redactStructuredDetails(\n\tvalue: unknown,\n\tredact: (text: string) => string,\n\tbudget: { nodes: number },\n\tdepth = 0,\n): unknown {\n\tif (typeof value === \"string\") return redact(value);\n\tif (value === null \|\| typeof value !== \"object\") return value;\n\tbudget.nodes++;\n\tif (depth >= MAX_REDACTED_DETAIL_DEPTH \|\| budget.nodes > MAX_REDACTED_DETAIL_NODES) {\n\t\treturn \"[DETAIL OMITTED AT CREDENTIAL BOUNDARY]\";\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn value.map((entry) => redactStructuredDetails(entry, redact, budget, depth + 1));\n\t}\n\tlet prototype: object \| null;\n\ttry {\n\t\tprototype = Object.getPrototypeOf(value);\n\t} catch {\n\t\treturn \"[UNREADABLE DETAIL OMITTED AT CREDENTIAL BOUNDARY]\";\n\t}\n\tif (prototype !== Object.prototype && prototype !== null) return value;\n\treturn Object.fromEntries(\n\t\tObject.entries(value).map(([key, entry]) => [key, redactStructuredDetails(entry, redact, budget, depth + 1)]),\n\t);\n}\n\n/* Apply the same path refusal and output redaction to foreground, extension, scout, and lane tools. */\nexport function wrapToolWithCredentialExposureGuard<TParameters extends TSchema, TDetails>(\n\ttool: AgentTool<TParameters, TDetails>,\n\tcwd: string,\n\tvault?: SecretVault,\n): AgentTool<TParameters, TDetails> {\n\treturn {\n\t\t...tool,\n\t\tasync execute(toolCallId, params, signal, onUpdate) {\n\t\t\tconst refusal = credentialToolBlockReason(tool.name, params, cwd, vault);\n\t\t\tif (refusal) throw new Error(refusal);\n\t\t\tconst safeUpdate = onUpdate\n\t\t\t\t? (partial: AgentToolResult<TDetails>) => {\n\t\t\t\t\t\tonUpdate(redactResult(partial, vault));\n\t\t\t\t\t}\n\t\t\t\t: undefined;\n\t\t\ttry {\n\t\t\t\treturn redactResult(await tool.execute(toolCallId, params, signal, safeUpdate), vault);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof Error) {\n\t\t\t\t\tthrow new Error(vault ? vault.redactSensitiveText(error.message) : redactKnownSecrets(error.message));\n\t\t\t\t}\n\t\t\t\tthrow new Error(\"Credential-safe tool execution failed without retaining raw error output.\");\n\t\t\t}\n\t\t},\n\t};\n}\n"]}
1	+ {"version":3,"file":"credential-exposure-guard.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-exposure-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAGzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,+BAA+B,EAA+B,MAAM,kCAAkC,CAAC;AAChH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AAGxE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AACnE,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACzC,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,MAAM;IACN,IAAI;IACJ,SAAS;IACT,MAAM;IACN,aAAa;IACb,eAAe;IACf,QAAQ;CACR,CAAC,CAAC;AACH,MAAM,oBAAoB,GACzB,0IAA0I,CAAC;AAC5I,MAAM,qBAAqB,GAAG,uFAAuF,CAAC;AACtH,MAAM,oBAAoB,GAAG,mCAAmC,CAAC;AACjE,MAAM,cAAc,GAAG,qCAAqC,CAAC;AAC7D,MAAM,yBAAyB,GAAG,CAAC,CAAC;AACpC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AACzC,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;AAChE,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,CAAC;AAEjG,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC7C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAe,EAAE,GAAW,EAAE,KAAmB;IAC1F,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,SAAS,KAAK,QAAQ;YAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;IACvE,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,IAAI,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACJ,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;QACrE,CAAC;QACD,IAAI,CAAC;YACJ,iBAAiB,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACR,wFAAwF;QACzF,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACpC,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9G,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC3B,OAAe,EACf,GAAW,EACX,KAAmB;IAEnB,MAAM,WAAW,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,WAAW;QAAE,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;IAExF,MAAM,gBAAgB,GAAG,CACxB,UAAoB,EACpB,SAAkB,EACuD,EAAE;QAC3E,KAAK,IAAI,YAAY,GAAG,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC;YAC7E,MAAM,QAAQ,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAC9G,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;gBACpE,IAAI,MAAM,IAAI,+BAA+B,CAAC,MAAM,CAAC;oBAAE,OAAO,qBAAqB,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;YAChD,MAAM,UAAU,GACf,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC/F,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,+BAA+B,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;gBAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,yBAAyB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBACrG,OAAO,iBAAiB,CAAC;gBAC1B,CAAC;gBACD,MAAM,WAAW,GAChB,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnG,MAAM,oBAAoB,GACzB,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;oBACxB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,GAAG,IAAI,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;gBACvF,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,WAAW,IAAI,CAAC,oBAAoB;oBAAE,OAAO,cAAc,CAAC;gBACzG,SAAS;YACV,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBAC1B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,GAAG;oBAAE,SAAS;gBAC/D,IAAI,yBAAyB,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC;oBAAE,OAAO,iBAAiB,CAAC;YAC5E,CAAC;QACF,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;IAEF,IAAI,UAAU,GAAa,EAAE,CAAC;IAC9B,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,kBAAkB;gBAAE,kBAAkB,GAAG,KAAK,CAAC;;gBAC9C,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAClC,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,uEAAuE;YACvE,kEAAkE;YAClE,kBAAkB,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC5D,SAAS;QACV,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QACtB,UAAU,GAAG,EAAE,CAAC;QAChB,kBAAkB,GAAG,KAAK,CAAC;QAC3B,SAAS,GAAG,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;IACnC,CAAC;IACD,OAAO,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAc;IACvC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC3C,IAAI,4BAA4B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACV,CAAC;QACD,IAAI,2BAA2B,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,KAAK,EAAE,CAAC;YACR,SAAS;QACV,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,+BAA+B,CAAC,MAAc;IACtD,OAAO,mDAAmD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACzC,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IAC5E,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAe,EAAE,GAAW;IAC1D,IAAI,CAAC;QACJ,OAAO,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,SAAS,4BAA4B,CAAC,IAAY,EAAE,GAAW,EAAE,KAAmB;IACnF,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,SAAS,IAAI,yBAAyB,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAChF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAa;IACxC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,yBAAyB,CACxC,QAAgB,EAChB,IAAa,EACb,GAAW,EACX,KAAmB;IAEnB,IAAI,QAAQ,KAAK,cAAc,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACrE,IAAI,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,0KAA0K,CAAC;QACnL,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,IACC,CAAC,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACrD,CAAC,IAAI,IAAI,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EACnD,CAAC;YACF,OAAO,mGAAmG,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,CAAC,IAAI,IAAI,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1F,OAAO,uLAAuL,CAAC;QAChM,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,IACC,CAAC,IAAI,IAAI,yBAAyB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACrD,CAAC,OAAO,IAAI,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EACzD,CAAC;YACF,OAAO,kGAAkG,CAAC;QAC3G,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QACpF,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YAClC,OAAO,uKAAuK,CAAC;QAChL,CAAC;QACD,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;YACzC,OAAO,kIAAkI,CAAC;QAC3I,CAAC;QACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YAC3E,OAAO,sIAAsI,CAAC;QAC/I,CAAC;IACF,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,IACC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;YAChC,4BAA4B,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC;YAC9C,CAAC,UAAU,KAAK,SAAS,IAAI,yBAAyB,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,EAC9E,CAAC;YACF,OAAO,uIAAuI,CAAC;QAChJ,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAI,MAA0B,EAAE,KAAmB;IACvE,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAC5B,OAAO;QACN,GAAG,MAAM;QACT,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChH,OAAO,EAAE,uBAAuB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAM;KACrE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAC/B,KAAc,EACd,MAAgC,EAChC,MAAyB,EACzB,KAAK,GAAG,CAAC;IAET,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,KAAK,IAAI,yBAAyB,IAAI,MAAM,CAAC,KAAK,GAAG,yBAAyB,EAAE,CAAC;QACpF,OAAO,yCAAyC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,oDAAoD,CAAC;IAC7D,CAAC;IACD,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAC7G,CAAC;AACH,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,mCAAmC,CAClD,IAAsC,EACtC,GAAW,EACX,KAAmB;IAEnB,OAAO;QACN,GAAG,IAAI;QACP,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ;YACjD,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;YACzE,IAAI,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,UAAU,GAAG,QAAQ;gBAC1B,CAAC,CAAC,CAAC,OAAkC,EAAE,EAAE;oBACvC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;gBACxC,CAAC;gBACF,CAAC,CAAC,SAAS,CAAC;YACb,IAAI,CAAC;gBACJ,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC,CAAC;YACxF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;oBAC5B,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBACvG,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;YAC9F,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC","sourcesContent":["import { realpathSync, statSync } from \"node:fs\";\nimport { basename, isAbsolute, relative, resolve, sep } from \"node:path\";\nimport type { AgentTool, AgentToolResult } from \"@caupulican/pi-agent-core\";\nimport type { TSchema } from \"typebox\";\nimport { redactKnownSecrets } from \"../security/secret-text.ts\";\nimport { parseShellSearchInvocationScope, type ShellContentSearchTool } from \"../tools/search-command-guard.ts\";\nimport { tokenizeShellCommand } from \"../tools/shell-command-parser.ts\";\nimport type { SecretVault } from \"./secret-vault.ts\";\n\nconst DIRECT_PATH_TOOLS = new Set([\"read\", \"edit\", \"write\", \"ls\"]);\nconst SHELL_INSPECTION_COMMANDS = new Set([\n\t\"cat\",\n\t\"head\",\n\t\"tail\",\n\t\"less\",\n\t\"more\",\n\t\"sed\",\n\t\"awk\",\n\t\"grep\",\n\t\"rg\",\n\t\"ripgrep\",\n\t\"type\",\n\t\"get-content\",\n\t\"select-string\",\n\t\"source\",\n]);\nconst SHELL_SECRET_READ_RE =\n\t/\\b(?:cat\|head\|tail\|less\|more\|sed\|awk\|grep\|rg\|type\|get-content\|select-string\|source)\\b[^\\n;&\|](?:^\|[\\\\/])?\\.env(?:\\.[A-Za-z0-9._-]+)?\\b/i;\nconst PYTHON_SECRET_READ_RE = /\\b(?:open\|read_text\|read_bytes)\\s\\([^\\n)](?:^\|[\\\\/])?\\.env(?:\\.[A-Za-z0-9._-]+)?\\b/i;\nconst PYTHON_INSPECTION_RE = /\\b(?:open\|read_text\|read_bytes)\\b/;\nconst QUOTED_TEXT_RE = /([\"'])([^\"'\\\\](?:\\\\.[^\"'\\\\]))\\1/g;\nconst MAX_REDACTED_DETAIL_DEPTH = 8;\nconst MAX_REDACTED_DETAIL_NODES = 10_000;\nconst JQ_OPTIONS_WITH_ONE_OPERAND = new Set([\"-L\", \"--indent\"]);\nconst JQ_OPTIONS_WITH_TWO_OPERANDS = new Set([\"--arg\", \"--argjson\", \"--rawfile\", \"--slurpfile\"]);\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction isInside(root: string, target: string): boolean {\n\tconst fromRoot = relative(root, target);\n\treturn fromRoot === \"\" \|\| (!fromRoot.startsWith(`..${sep}`) && fromRoot !== \"..\" && !isAbsolute(fromRoot));\n}\n\nexport function isProtectedCredentialPath(rawPath: string, cwd: string, vault?: SecretVault): boolean {\n\tconst resolved = resolve(cwd, rawPath);\n\tconst candidates = [resolved];\n\ttry {\n\t\tconst canonical = realpathSync.native(resolved);\n\t\tif (canonical !== resolved) candidates.push(canonical);\n\t} catch {\n\t\t// Nonexistent write targets still receive the lexical filename check.\n\t}\n\tconst vaultPaths = vault ? [resolve(vault.vaultPath)] : [];\n\tconst materializedRoots = vault ? [resolve(vault.materializedDir)] : [];\n\tif (vault) {\n\t\ttry {\n\t\t\tvaultPaths.push(realpathSync.native(vault.vaultPath));\n\t\t} catch {\n\t\t\t// A not-yet-created vault still retains its lexical protected path.\n\t\t}\n\t\ttry {\n\t\t\tmaterializedRoots.push(realpathSync.native(vault.materializedDir));\n\t\t} catch {\n\t\t\t// A not-yet-created materialization directory still retains its lexical protected root.\n\t\t}\n\t}\n\treturn candidates.some((candidate) => {\n\t\tif (vault && (vaultPaths.includes(candidate) \|\| materializedRoots.some((root) => isInside(root, candidate)))) {\n\t\t\treturn true;\n\t\t}\n\t\tconst fileName = basename(candidate);\n\t\treturn fileName === \".env\" \|\| fileName.startsWith(\".env.\") \|\| fileName.endsWith(\".env\");\n\t});\n}\n\nfunction shellCredentialRisk(\n\tcommand: string,\n\tcwd: string,\n\tvault?: SecretVault,\n): \"broad_search\" \| \"credential_path\" \| \"process_environment\" \| undefined {\n\tconst shellTokens = tokenizeShellCommand(command);\n\tif (!shellTokens) return /\\b(?:grep\|rg)\\b/iu.test(command) ? \"broad_search\" : undefined;\n\n\tconst assessInvocation = (\n\t\tinvocation: string[],\n\t\treadsPipe: boolean,\n\t): \"broad_search\" \| \"credential_path\" \| \"process_environment\" \| undefined => {\n\t\tfor (let commandIndex = 0; commandIndex < invocation.length; commandIndex++) {\n\t\t\tconst toolName = (invocation[commandIndex].split(/[\\\\/]/u).at(-1) ?? \"\").toLowerCase().replace(/\\.exe$/u, \"\");\n\t\t\tif (toolName === \"jq\") {\n\t\t\t\tconst filter = jqFilterFromArgs(invocation.slice(commandIndex + 1));\n\t\t\t\tif (filter && jqFilterReadsProcessEnvironment(filter)) return \"process_environment\";\n\t\t\t}\n\t\t\tif (!SHELL_INSPECTION_COMMANDS.has(toolName)) continue;\n\t\t\tconst args = invocation.slice(commandIndex + 1);\n\t\t\tconst searchTool: ShellContentSearchTool \| undefined =\n\t\t\t\ttoolName === \"rg\" \|\| toolName === \"ripgrep\" ? \"rg\" : toolName === \"grep\" ? \"grep\" : undefined;\n\t\t\tif (searchTool) {\n\t\t\t\tconst scope = parseShellSearchInvocationScope(searchTool, args, readsPipe);\n\t\t\t\tif (scope.targets.some((target) => target !== \"-\" && isProtectedCredentialPath(target, cwd, vault))) {\n\t\t\t\t\treturn \"credential_path\";\n\t\t\t\t}\n\t\t\t\tconst hasSafeGlob =\n\t\t\t\t\tscope.positiveGlobs.length > 0 && scope.positiveGlobs.every((glob) => isCredentialSafeGlob(glob));\n\t\t\t\tconst hasOnlyExplicitFiles =\n\t\t\t\t\tscope.targets.length > 0 &&\n\t\t\t\t\tscope.targets.every((target) => target === \"-\" \|\| isExistingRegularFile(target, cwd));\n\t\t\t\tif (!scope.metaOnly && !scope.readsStdin && !hasSafeGlob && !hasOnlyExplicitFiles) return \"broad_search\";\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tfor (const token of args) {\n\t\t\t\tif (!token \|\| token.startsWith(\"-\") \|\| token === \".\") continue;\n\t\t\t\tif (isProtectedCredentialPath(token, cwd, vault)) return \"credential_path\";\n\t\t\t}\n\t\t}\n\t\treturn undefined;\n\t};\n\n\tlet invocation: string[] = [];\n\tlet skipRedirectTarget = false;\n\tlet readsPipe = false;\n\tfor (const token of shellTokens) {\n\t\tif (token.kind === \"arg\") {\n\t\t\tif (skipRedirectTarget) skipRedirectTarget = false;\n\t\t\telse invocation.push(token.value);\n\t\t\tcontinue;\n\t\t}\n\t\tif (token.kind === \"redirect\") {\n\t\t\t// Descriptor duplication (`2>&1`) has no following path operand. Other\n\t\t\t// redirects do, and that target must never count as search scope.\n\t\t\tskipRedirectTarget = !/^\\d[<>]&[\\d-]+$/u.test(token.value);\n\t\t\tcontinue;\n\t\t}\n\t\tconst risk = assessInvocation(invocation, readsPipe);\n\t\tif (risk) return risk;\n\t\tinvocation = [];\n\t\tskipRedirectTarget = false;\n\t\treadsPipe = token.kind === \"pipe\";\n\t}\n\treturn assessInvocation(invocation, readsPipe);\n}\n\nfunction jqFilterFromArgs(args: string[]): string \| undefined {\n\tfor (let index = 0; index < args.length; index++) {\n\t\tconst token = args[index];\n\t\tif (token === \"--\") return args[index + 1];\n\t\tif (JQ_OPTIONS_WITH_TWO_OPERANDS.has(token)) {\n\t\t\tindex += 2;\n\t\t\tcontinue;\n\t\t}\n\t\tif (JQ_OPTIONS_WITH_ONE_OPERAND.has(token)) {\n\t\t\tindex++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (token.startsWith(\"-\")) continue;\n\t\treturn token;\n\t}\n\treturn undefined;\n}\n\nfunction jqFilterReadsProcessEnvironment(filter: string): boolean {\n\treturn /(?:^\|[\\s\|,(:;[])(?:env\|\\$ENV)(?=$\|[\\s\|),.;[\\]}])/u.test(filter);\n}\n\nfunction isCredentialSafeGlob(glob: string): boolean {\n\tif (/(?:^\|[\\\\/])?\\.env(?:\\.\|\\\|$)/i.test(glob)) return false;\n\tconst filePattern = glob.replace(/\\\\/g, \"/\").split(\"/\").at(-1) ?? \"\";\n\tconst suffix = filePattern.match(/\\.([A-Za-z0-9_-]+)$/)?.[1]?.toLowerCase();\n\treturn suffix !== undefined && suffix !== \"env\";\n}\n\nfunction isExistingRegularFile(rawPath: string, cwd: string): boolean {\n\ttry {\n\t\treturn statSync(resolve(cwd, rawPath)).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nfunction pythonInspectsCredentialPath(code: string, cwd: string, vault?: SecretVault): boolean {\n\tif (!PYTHON_INSPECTION_RE.test(code)) return false;\n\tQUOTED_TEXT_RE.lastIndex = 0;\n\tfor (const match of code.matchAll(QUOTED_TEXT_RE)) {\n\t\tconst candidate = match[2]?.replace(/\\\\([\\\\\"'])/g, \"$1\");\n\t\tif (candidate && isProtectedCredentialPath(candidate, cwd, vault)) return true;\n\t}\n\treturn false;\n}\n\nfunction directPathFromArgs(args: unknown): string \| undefined {\n\tif (!isRecord(args)) return undefined;\n\treturn typeof args.path === \"string\" ? args.path : undefined;\n}\n\n/** Stable model-facing refusal for direct inspection/mutation of credential material. /\nexport function credentialToolBlockReason(\n\ttoolName: string,\n\targs: unknown,\n\tcwd: string,\n\tvault?: SecretVault,\n): string \| undefined {\n\tif (toolName === \"secret_store\" \|\| !isRecord(args)) return undefined;\n\tif (DIRECT_PATH_TOOLS.has(toolName)) {\n\t\tconst path = directPathFromArgs(args);\n\t\tif (path && isProtectedCredentialPath(path, cwd, vault)) {\n\t\t\treturn \"Credential file access is model-blind. Use secret_store to edit or materialize the bound profile, then run the consuming application without inspecting the dotenv file.\";\n\t\t}\n\t}\n\tif (toolName === \"grep\") {\n\t\tconst path = typeof args.path === \"string\" ? args.path : undefined;\n\t\tconst glob = typeof args.glob === \"string\" ? args.glob : undefined;\n\t\tif (\n\t\t\t(path && isProtectedCredentialPath(path, cwd, vault)) \|\|\n\t\t\t(glob && /(?:^\|[\\\\/])?\\.env(?:\\.\|\\\|$)/i.test(glob))\n\t\t) {\n\t\t\treturn \"Credential dotenv files are excluded from model-facing search. Use secret_store metadata instead.\";\n\t\t}\n\t\tif (!(path && isExistingRegularFile(path, cwd)) && !(glob && isCredentialSafeGlob(glob))) {\n\t\t\treturn \"Credential-safe grep requires one explicit regular file or a narrow non-dotenv file glob (for example .ts). Refine the search instead of scanning a directory without a file filter.\";\n\t\t}\n\t}\n\tif (toolName === \"find\") {\n\t\tconst path = typeof args.path === \"string\" ? args.path : undefined;\n\t\tconst pattern = typeof args.pattern === \"string\" ? args.pattern : undefined;\n\t\tif (\n\t\t\t(path && isProtectedCredentialPath(path, cwd, vault)) \|\|\n\t\t\t(pattern && /(?:^\|[\\\\/])?\\.env(?:\\.\|\\\|$)/i.test(pattern))\n\t\t) {\n\t\t\treturn \"Credential dotenv files are excluded from model-facing discovery. Use secret_store list instead.\";\n\t\t}\n\t}\n\tif (toolName === \"bash\" \|\| toolName === \"powershell\" \|\| toolName === \"run_process\") {\n\t\tconst command = typeof args.command === \"string\" ? args.command : \"\";\n\t\tconst shellRisk = shellCredentialRisk(command, cwd, vault);\n\t\tif (shellRisk === \"broad_search\") {\n\t\t\treturn \"Credential-safe shell search requires a narrow non-dotenv file glob (for example -g '.ts') or one explicit regular file. Refine the rg/grep command before retrying.\";\n\t\t}\n\t\tif (shellRisk === \"process_environment\") {\n\t\t\treturn \"Direct jq projection of the process environment is blocked because it can expose credentials. Query bounded JSON inputs instead.\";\n\t\t}\n\t\tif (SHELL_SECRET_READ_RE.test(command) \|\| shellRisk === \"credential_path\") {\n\t\t\treturn \"Direct shell inspection of credential dotenv files is blocked. Use secret_store, then run the credential-consuming command normally.\";\n\t\t}\n\t}\n\tif (toolName === \"python\") {\n\t\tconst code = typeof args.code === \"string\" ? args.code : \"\";\n\t\tconst scriptPath = typeof args.scriptPath === \"string\" ? args.scriptPath : undefined;\n\t\tif (\n\t\t\tPYTHON_SECRET_READ_RE.test(code) \|\|\n\t\t\tpythonInspectsCredentialPath(code, cwd, vault) \|\|\n\t\t\t(scriptPath !== undefined && isProtectedCredentialPath(scriptPath, cwd, vault))\n\t\t) {\n\t\t\treturn \"Direct Python inspection of credential dotenv files is blocked. Use secret_store, then run the credential-consuming program normally.\";\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction redactResult<T>(result: AgentToolResult<T>, vault?: SecretVault): AgentToolResult<T> {\n\tconst redact = (text: string) => (vault ? vault.redactSensitiveText(text) : redactKnownSecrets(text));\n\tconst budget = { nodes: 0 };\n\treturn {\n\t\t...result,\n\t\tcontent: result.content.map((block) => (block.type === \"text\" ? { ...block, text: redact(block.text) } : block)),\n\t\tdetails: redactStructuredDetails(result.details, redact, budget) as T,\n\t};\n}\n\nfunction redactStructuredDetails(\n\tvalue: unknown,\n\tredact: (text: string) => string,\n\tbudget: { nodes: number },\n\tdepth = 0,\n): unknown {\n\tif (typeof value === \"string\") return redact(value);\n\tif (value === null \|\| typeof value !== \"object\") return value;\n\tbudget.nodes++;\n\tif (depth >= MAX_REDACTED_DETAIL_DEPTH \|\| budget.nodes > MAX_REDACTED_DETAIL_NODES) {\n\t\treturn \"[DETAIL OMITTED AT CREDENTIAL BOUNDARY]\";\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn value.map((entry) => redactStructuredDetails(entry, redact, budget, depth + 1));\n\t}\n\tlet prototype: object \| null;\n\ttry {\n\t\tprototype = Object.getPrototypeOf(value);\n\t} catch {\n\t\treturn \"[UNREADABLE DETAIL OMITTED AT CREDENTIAL BOUNDARY]\";\n\t}\n\tif (prototype !== Object.prototype && prototype !== null) return value;\n\treturn Object.fromEntries(\n\t\tObject.entries(value).map(([key, entry]) => [key, redactStructuredDetails(entry, redact, budget, depth + 1)]),\n\t);\n}\n\n/* Apply the same path refusal and output redaction to foreground, extension, scout, and lane tools. */\nexport function wrapToolWithCredentialExposureGuard<TParameters extends TSchema, TDetails>(\n\ttool: AgentTool<TParameters, TDetails>,\n\tcwd: string,\n\tvault?: SecretVault,\n): AgentTool<TParameters, TDetails> {\n\treturn {\n\t\t...tool,\n\t\tasync execute(toolCallId, params, signal, onUpdate) {\n\t\t\tconst refusal = credentialToolBlockReason(tool.name, params, cwd, vault);\n\t\t\tif (refusal) throw new Error(refusal);\n\t\t\tconst safeUpdate = onUpdate\n\t\t\t\t? (partial: AgentToolResult<TDetails>) => {\n\t\t\t\t\t\tonUpdate(redactResult(partial, vault));\n\t\t\t\t\t}\n\t\t\t\t: undefined;\n\t\t\ttry {\n\t\t\t\treturn redactResult(await tool.execute(toolCallId, params, signal, safeUpdate), vault);\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof Error) {\n\t\t\t\t\tthrow new Error(vault ? vault.redactSensitiveText(error.message) : redactKnownSecrets(error.message));\n\t\t\t\t}\n\t\t\t\tthrow new Error(\"Credential-safe tool execution failed without retaining raw error output.\");\n\t\t\t}\n\t\t},\n\t};\n}\n"]}

package/dist/core/secrets/secret-dotenv.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"secret-dotenv.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/secret-dotenv.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAClD,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAChD,eAAO,MAAM,yBAAyB,QAAa,CAAC;AAEpD,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,YAAY,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAIzC;CACD;AAED,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,oBAAoB,EAAE,CAAC;CAClC;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzD;AA6DD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,CA0EvE;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM,CAQxF","sourcesContent":["const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]$/;\n\nexport const SECRET_VARIABLE_NAME_MAX_CHARS = 128;\nexport const SECRET_VARIABLE_NAME_PATTERN = \"^[A-Za-z_][A-Za-z0-9_]$\";\nexport const MAX_DOTENV_VARIABLES = 64;\nexport const MAX_DOTENV_VALUE_BYTES = 64 * 1024;\nexport const MAX_DOTENV_DOCUMENT_BYTES = 512 * 1024;\n\nexport class SecretDotenvError extends Error {\n\treadonly line?: number;\n\n\tconstructor(message: string, line?: number) {\n\t\tsuper(line === undefined ? message : `Dotenv line ${line}: ${message}`);\n\t\tthis.name = \"SecretDotenvError\";\n\t\tthis.line = line;\n\t}\n}\n\nexport interface ParsedDotenvVariable {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface ParsedDotenvDocument {\n\tdocument: string;\n\tvariables: ParsedDotenvVariable[];\n}\n\nexport function validateDotenvVariableName(name: string): string {\n\tif (!ENV_NAME_RE.test(name) \|\| name.length > SECRET_VARIABLE_NAME_MAX_CHARS) {\n\t\tthrow new SecretDotenvError(\"environment variable name must use portable dotenv syntax\");\n\t}\n\treturn name;\n}\n\nexport function validateDotenvValue(value: string): string {\n\tif (value.includes(\"\\0\")) throw new SecretDotenvError(\"values cannot contain null bytes\");\n\tif (Buffer.byteLength(value, \"utf8\") > MAX_DOTENV_VALUE_BYTES) {\n\t\tthrow new SecretDotenvError(\"a value exceeds the 64 KiB limit\");\n\t}\n\treturn value;\n}\n\nfunction decodeDoubleQuoted(value: string, line: number): string {\n\tlet decoded = \"\";\n\tfor (let index = 0; index < value.length; index++) {\n\t\tconst character = value[index] ?? \"\";\n\t\tif (character !== \"\\\\\") {\n\t\t\tdecoded += character;\n\t\t\tcontinue;\n\t\t}\n\t\tconst escaped = value[++index];\n\t\tif (escaped === undefined) throw new SecretDotenvError(\"double-quoted value ends with an escape\", line);\n\t\tswitch (escaped) {\n\t\t\tcase \"n\":\n\t\t\t\tdecoded += \"\\n\";\n\t\t\t\tbreak;\n\t\t\tcase \"r\":\n\t\t\t\tdecoded += \"\\r\";\n\t\t\t\tbreak;\n\t\t\tcase \"t\":\n\t\t\t\tdecoded += \"\\t\";\n\t\t\t\tbreak;\n\t\t\tcase \"\\\\\":\n\t\t\tcase '\"':\n\t\t\tcase \"$\":\n\t\t\t\tdecoded += escaped;\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tdecoded += `\\\\${escaped}`;\n\t\t}\n\t}\n\treturn decoded;\n}\n\nfunction findClosingQuote(document: string, start: number, quote: string, line: number): number {\n\tfor (let index = start; index < document.length; index++) {\n\t\tif (document[index] !== quote) continue;\n\t\tif (quote !== '\"') return index;\n\t\tlet slashCount = 0;\n\t\tfor (let cursor = index - 1; cursor >= start && document[cursor] === \"\\\\\"; cursor--) slashCount++;\n\t\tif (slashCount % 2 === 0) return index;\n\t}\n\tthrow new SecretDotenvError(\"quoted value is not terminated\", line);\n}\n\nfunction endOfPhysicalLine(document: string, start: number): number {\n\tconst newline = document.indexOf(\"\\n\", start);\n\treturn newline === -1 ? document.length : newline;\n}\n\nfunction parseUnquotedValue(raw: string): string {\n\tlet commentIndex = -1;\n\tfor (let index = 0; index < raw.length; index++) {\n\t\tif (raw[index] === \"#\" && (index === 0 \|\| /\\s/.test(raw[index - 1] ?? \"\"))) {\n\t\t\tcommentIndex = index;\n\t\t\tbreak;\n\t\t}\n\t}\n\treturn (commentIndex === -1 ? raw : raw.slice(0, commentIndex)).trim();\n}\n\n/*\n Parse the practical dotenv surface Pi materializes: comments, blank lines, optional `export`,\n * unquoted values, and single/double/backtick quoted values (including multiline quoted values).\n * Error messages contain only a line number and grammar reason, never the rejected value.\n /\nexport function parseDotenvDocument(input: string): ParsedDotenvDocument {\n\tconst document = input.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n\tif (document.includes(\"\\0\")) throw new SecretDotenvError(\"document cannot contain null bytes\");\n\tif (Buffer.byteLength(document, \"utf8\") > MAX_DOTENV_DOCUMENT_BYTES) {\n\t\tthrow new SecretDotenvError(\"document exceeds the 512 KiB limit\");\n\t}\n\n\tconst variables: ParsedDotenvVariable[] = [];\n\tconst names = new Set<string>();\n\tlet offset = 0;\n\tlet line = 1;\n\twhile (offset < document.length) {\n\t\tconst physicalEnd = endOfPhysicalLine(document, offset);\n\t\tconst physical = document.slice(offset, physicalEnd);\n\t\tconst leading = physical.match(/^\\s/)?.[0].length ?? 0;\n\t\tlet cursor = offset + leading;\n\t\tif (cursor >= physicalEnd \|\| document[cursor] === \"#\") {\n\t\t\toffset = physicalEnd < document.length ? physicalEnd + 1 : document.length;\n\t\t\tline++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (document.slice(cursor, cursor + 6) === \"export\" && /\\s/.test(document[cursor + 6] ?? \"\")) {\n\t\t\tcursor += 6;\n\t\t\twhile (cursor < physicalEnd && /\\s/.test(document[cursor] ?? \"\")) cursor++;\n\t\t}\n\t\tconst equals = document.indexOf(\"=\", cursor);\n\t\tif (equals === -1 \|\| equals > physicalEnd) throw new SecretDotenvError(\"expected NAME=value\", line);\n\t\tlet name: string;\n\t\ttry {\n\t\t\tname = validateDotenvVariableName(document.slice(cursor, equals).trim());\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretDotenvError) throw new SecretDotenvError(error.message, line);\n\t\t\tthrow error;\n\t\t}\n\t\tif (names.has(name)) throw new SecretDotenvError(`variable ${name} is duplicated`, line);\n\t\tif (variables.length >= MAX_DOTENV_VARIABLES) {\n\t\t\tthrow new SecretDotenvError(`profile exceeds the ${MAX_DOTENV_VARIABLES}-variable limit`, line);\n\t\t}\n\n\t\tcursor = equals + 1;\n\t\twhile (cursor < physicalEnd && (document[cursor] === \" \" \|\| document[cursor] === \"\\t\")) cursor++;\n\t\tlet value: string;\n\t\tlet nextOffset: number;\n\t\tconst quote = document[cursor];\n\t\tif (quote === '\"' \|\| quote === \"'\" \|\| quote === \"`\") {\n\t\t\tconst closing = findClosingQuote(document, cursor + 1, quote, line);\n\t\t\tconst quoted = document.slice(cursor + 1, closing);\n\t\t\tconst trailingEnd = endOfPhysicalLine(document, closing + 1);\n\t\t\tconst trailing = document.slice(closing + 1, trailingEnd).trim();\n\t\t\tif (trailing && !trailing.startsWith(\"#\")) {\n\t\t\t\tthrow new SecretDotenvError(\"unexpected text follows the quoted value\", line);\n\t\t\t}\n\t\t\tvalue = quote === '\"' ? decodeDoubleQuoted(quoted, line) : quoted;\n\t\t\tconst consumedLines = document.slice(offset, trailingEnd).split(\"\\n\").length;\n\t\t\tline += consumedLines;\n\t\t\tnextOffset = trailingEnd < document.length ? trailingEnd + 1 : document.length;\n\t\t} else {\n\t\t\tvalue = parseUnquotedValue(document.slice(cursor, physicalEnd));\n\t\t\tline++;\n\t\t\tnextOffset = physicalEnd < document.length ? physicalEnd + 1 : document.length;\n\t\t}\n\t\ttry {\n\t\t\tvalidateDotenvValue(value);\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretDotenvError) throw new SecretDotenvError(error.message, line - 1);\n\t\t\tthrow error;\n\t\t}\n\t\tnames.add(name);\n\t\tvariables.push({ name, value });\n\t\toffset = nextOffset;\n\t}\n\n\tif (variables.length === 0) throw new SecretDotenvError(\"document must contain at least one assignment\");\n\treturn { document, variables };\n}\n\nexport function formatDotenvVariables(variables: readonly ParsedDotenvVariable[]): string {\n\treturn `${[...variables]\n\t\t.sort((left, right) => left.name.localeCompare(right.name))\n\t\t.map(\n\t\t\t(variable) =>\n\t\t\t\t`${validateDotenvVariableName(variable.name)}=${JSON.stringify(validateDotenvValue(variable.value))}`,\n\t\t)\n\t\t.join(\"\\n\")}\\n`;\n}\n"]}
1	+ {"version":3,"file":"secret-dotenv.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/secret-dotenv.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,8BAA8B,MAAM,CAAC;AAClD,eAAO,MAAM,4BAA4B,6BAA6B,CAAC;AACvE,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAChD,eAAO,MAAM,yBAAyB,QAAa,CAAC;AAEpD,qBAAa,iBAAkB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,YAAY,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAIzC;CACD;AAED,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,oBAAoB,EAAE,CAAC;CAClC;AAED,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK/D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMzD;AA6DD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,oBAAoB,CA0EvE;AAED,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,oBAAoB,EAAE,GAAG,MAAM,CAQxF"}

package/dist/core/secrets/secret-dotenv.js CHANGED Viewed

@@ -5,7 +5,6 @@ export const MAX_DOTENV_VARIABLES = 64;
 export const MAX_DOTENV_VALUE_BYTES = 64 * 1024;
 export const MAX_DOTENV_DOCUMENT_BYTES = 512 * 1024;
 export class SecretDotenvError extends Error {
-    line;
     constructor(message, line) {
         super(line === undefined ? message : `Dotenv line ${line}: ${message}`);
         this.name = "SecretDotenvError";

package/dist/core/secrets/secret-dotenv.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"secret-dotenv.js","sourceRoot":"","sources":["../../../src/core/secrets/secret-dotenv.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEpD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAClC,IAAI,CAAU;IAEvB,YAAY,OAAe,EAAE,IAAa,EAAE;QAC3C,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAAA,CACjB;CACD;AAYD,MAAM,UAAU,0BAA0B,CAAC,IAAY,EAAU;IAChE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,8BAA8B,EAAE,CAAC;QAC7E,MAAM,IAAI,iBAAiB,CAAC,2DAA2D,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC;AAAA,CACZ;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAU;IAC1D,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,sBAAsB,EAAE,CAAC;QAC/D,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAY,EAAU;IAChE,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,IAAI,SAAS,CAAC;YACrB,SAAS;QACV,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,EAAE,IAAI,CAAC,CAAC;QACxG,QAAQ,OAAO,EAAE,CAAC;YACjB,KAAK,GAAG;gBACP,OAAO,IAAI,IAAI,CAAC;gBAChB,MAAM;YACP,KAAK,GAAG;gBACP,OAAO,IAAI,IAAI,CAAC;gBAChB,MAAM;YACP,KAAK,GAAG;gBACP,OAAO,IAAI,IAAI,CAAC;gBAChB,MAAM;YACP,KAAK,IAAI,CAAC;YACV,KAAK,GAAG,CAAC;YACT,KAAK,GAAG;gBACP,OAAO,IAAI,OAAO,CAAC;gBACnB,MAAM;YACP;gBACC,OAAO,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,KAAa,EAAE,KAAa,EAAE,IAAY,EAAU;IAC/F,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK;YAAE,SAAS;QACxC,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,IAAI,MAAM,GAAG,KAAK,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,MAAM,EAAE;YAAE,UAAU,EAAE,CAAC;QAClG,IAAI,UAAU,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,EAAE,IAAI,CAAC,CAAC;AAAA,CACpE;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,KAAa,EAAU;IACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAAA,CAClD;AAED,SAAS,kBAAkB,CAAC,GAAW,EAAU;IAChD,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5E,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM;QACP,CAAC;IACF,CAAC;IACD,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAAA,CACvE;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAwB;IACxE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,oCAAoC,CAAC,CAAC;IAC/F,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;QACrE,MAAM,IAAI,iBAAiB,CAAC,oCAAoC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACxD,IAAI,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;QAC9B,IAAI,MAAM,IAAI,WAAW,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3E,IAAI,EAAE,CAAC;YACP,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,CAAC,CAAC;YACZ,OAAO,MAAM,GAAG,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACpG,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACJ,IAAI,GAAG,0BAA0B,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,iBAAiB;gBAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,YAAY,IAAI,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACzF,IAAI,SAAS,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,oBAAoB,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACjG,CAAC;QAED,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC;QACpB,OAAO,MAAM,GAAG,WAAW,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,MAAM,EAAE,CAAC;QACjG,IAAI,KAAa,CAAC;QAClB,IAAI,UAAkB,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;YACjE,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,EAAE,IAAI,CAAC,CAAC;YAC/E,CAAC;YACD,KAAK,GAAG,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAClE,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC7E,IAAI,IAAI,aAAa,CAAC;YACtB,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChF,CAAC;aAAM,CAAC;YACP,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAChE,IAAI,EAAE,CAAC;YACP,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChF,CAAC;QACD,IAAI,CAAC;YACJ,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,iBAAiB;gBAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;YAC7F,MAAM,KAAK,CAAC;QACb,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,UAAU,CAAC;IACrB,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,+CAA+C,CAAC,CAAC;IACzG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAAA,CAC/B;AAED,MAAM,UAAU,qBAAqB,CAAC,SAA0C,EAAU;IACzF,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC;SACtB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC1D,GAAG,CACH,CAAC,QAAQ,EAAE,EAAE,CACZ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CACtG;SACA,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAAA,CACjB","sourcesContent":["const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]$/;\n\nexport const SECRET_VARIABLE_NAME_MAX_CHARS = 128;\nexport const SECRET_VARIABLE_NAME_PATTERN = \"^[A-Za-z_][A-Za-z0-9_]$\";\nexport const MAX_DOTENV_VARIABLES = 64;\nexport const MAX_DOTENV_VALUE_BYTES = 64 * 1024;\nexport const MAX_DOTENV_DOCUMENT_BYTES = 512 * 1024;\n\nexport class SecretDotenvError extends Error {\n\treadonly line?: number;\n\n\tconstructor(message: string, line?: number) {\n\t\tsuper(line === undefined ? message : `Dotenv line ${line}: ${message}`);\n\t\tthis.name = \"SecretDotenvError\";\n\t\tthis.line = line;\n\t}\n}\n\nexport interface ParsedDotenvVariable {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface ParsedDotenvDocument {\n\tdocument: string;\n\tvariables: ParsedDotenvVariable[];\n}\n\nexport function validateDotenvVariableName(name: string): string {\n\tif (!ENV_NAME_RE.test(name) \|\| name.length > SECRET_VARIABLE_NAME_MAX_CHARS) {\n\t\tthrow new SecretDotenvError(\"environment variable name must use portable dotenv syntax\");\n\t}\n\treturn name;\n}\n\nexport function validateDotenvValue(value: string): string {\n\tif (value.includes(\"\\0\")) throw new SecretDotenvError(\"values cannot contain null bytes\");\n\tif (Buffer.byteLength(value, \"utf8\") > MAX_DOTENV_VALUE_BYTES) {\n\t\tthrow new SecretDotenvError(\"a value exceeds the 64 KiB limit\");\n\t}\n\treturn value;\n}\n\nfunction decodeDoubleQuoted(value: string, line: number): string {\n\tlet decoded = \"\";\n\tfor (let index = 0; index < value.length; index++) {\n\t\tconst character = value[index] ?? \"\";\n\t\tif (character !== \"\\\\\") {\n\t\t\tdecoded += character;\n\t\t\tcontinue;\n\t\t}\n\t\tconst escaped = value[++index];\n\t\tif (escaped === undefined) throw new SecretDotenvError(\"double-quoted value ends with an escape\", line);\n\t\tswitch (escaped) {\n\t\t\tcase \"n\":\n\t\t\t\tdecoded += \"\\n\";\n\t\t\t\tbreak;\n\t\t\tcase \"r\":\n\t\t\t\tdecoded += \"\\r\";\n\t\t\t\tbreak;\n\t\t\tcase \"t\":\n\t\t\t\tdecoded += \"\\t\";\n\t\t\t\tbreak;\n\t\t\tcase \"\\\\\":\n\t\t\tcase '\"':\n\t\t\tcase \"$\":\n\t\t\t\tdecoded += escaped;\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tdecoded += `\\\\${escaped}`;\n\t\t}\n\t}\n\treturn decoded;\n}\n\nfunction findClosingQuote(document: string, start: number, quote: string, line: number): number {\n\tfor (let index = start; index < document.length; index++) {\n\t\tif (document[index] !== quote) continue;\n\t\tif (quote !== '\"') return index;\n\t\tlet slashCount = 0;\n\t\tfor (let cursor = index - 1; cursor >= start && document[cursor] === \"\\\\\"; cursor--) slashCount++;\n\t\tif (slashCount % 2 === 0) return index;\n\t}\n\tthrow new SecretDotenvError(\"quoted value is not terminated\", line);\n}\n\nfunction endOfPhysicalLine(document: string, start: number): number {\n\tconst newline = document.indexOf(\"\\n\", start);\n\treturn newline === -1 ? document.length : newline;\n}\n\nfunction parseUnquotedValue(raw: string): string {\n\tlet commentIndex = -1;\n\tfor (let index = 0; index < raw.length; index++) {\n\t\tif (raw[index] === \"#\" && (index === 0 \|\| /\\s/.test(raw[index - 1] ?? \"\"))) {\n\t\t\tcommentIndex = index;\n\t\t\tbreak;\n\t\t}\n\t}\n\treturn (commentIndex === -1 ? raw : raw.slice(0, commentIndex)).trim();\n}\n\n/*\n Parse the practical dotenv surface Pi materializes: comments, blank lines, optional `export`,\n * unquoted values, and single/double/backtick quoted values (including multiline quoted values).\n * Error messages contain only a line number and grammar reason, never the rejected value.\n /\nexport function parseDotenvDocument(input: string): ParsedDotenvDocument {\n\tconst document = input.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n\tif (document.includes(\"\\0\")) throw new SecretDotenvError(\"document cannot contain null bytes\");\n\tif (Buffer.byteLength(document, \"utf8\") > MAX_DOTENV_DOCUMENT_BYTES) {\n\t\tthrow new SecretDotenvError(\"document exceeds the 512 KiB limit\");\n\t}\n\n\tconst variables: ParsedDotenvVariable[] = [];\n\tconst names = new Set<string>();\n\tlet offset = 0;\n\tlet line = 1;\n\twhile (offset < document.length) {\n\t\tconst physicalEnd = endOfPhysicalLine(document, offset);\n\t\tconst physical = document.slice(offset, physicalEnd);\n\t\tconst leading = physical.match(/^\\s/)?.[0].length ?? 0;\n\t\tlet cursor = offset + leading;\n\t\tif (cursor >= physicalEnd \|\| document[cursor] === \"#\") {\n\t\t\toffset = physicalEnd < document.length ? physicalEnd + 1 : document.length;\n\t\t\tline++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (document.slice(cursor, cursor + 6) === \"export\" && /\\s/.test(document[cursor + 6] ?? \"\")) {\n\t\t\tcursor += 6;\n\t\t\twhile (cursor < physicalEnd && /\\s/.test(document[cursor] ?? \"\")) cursor++;\n\t\t}\n\t\tconst equals = document.indexOf(\"=\", cursor);\n\t\tif (equals === -1 \|\| equals > physicalEnd) throw new SecretDotenvError(\"expected NAME=value\", line);\n\t\tlet name: string;\n\t\ttry {\n\t\t\tname = validateDotenvVariableName(document.slice(cursor, equals).trim());\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretDotenvError) throw new SecretDotenvError(error.message, line);\n\t\t\tthrow error;\n\t\t}\n\t\tif (names.has(name)) throw new SecretDotenvError(`variable ${name} is duplicated`, line);\n\t\tif (variables.length >= MAX_DOTENV_VARIABLES) {\n\t\t\tthrow new SecretDotenvError(`profile exceeds the ${MAX_DOTENV_VARIABLES}-variable limit`, line);\n\t\t}\n\n\t\tcursor = equals + 1;\n\t\twhile (cursor < physicalEnd && (document[cursor] === \" \" \|\| document[cursor] === \"\\t\")) cursor++;\n\t\tlet value: string;\n\t\tlet nextOffset: number;\n\t\tconst quote = document[cursor];\n\t\tif (quote === '\"' \|\| quote === \"'\" \|\| quote === \"`\") {\n\t\t\tconst closing = findClosingQuote(document, cursor + 1, quote, line);\n\t\t\tconst quoted = document.slice(cursor + 1, closing);\n\t\t\tconst trailingEnd = endOfPhysicalLine(document, closing + 1);\n\t\t\tconst trailing = document.slice(closing + 1, trailingEnd).trim();\n\t\t\tif (trailing && !trailing.startsWith(\"#\")) {\n\t\t\t\tthrow new SecretDotenvError(\"unexpected text follows the quoted value\", line);\n\t\t\t}\n\t\t\tvalue = quote === '\"' ? decodeDoubleQuoted(quoted, line) : quoted;\n\t\t\tconst consumedLines = document.slice(offset, trailingEnd).split(\"\\n\").length;\n\t\t\tline += consumedLines;\n\t\t\tnextOffset = trailingEnd < document.length ? trailingEnd + 1 : document.length;\n\t\t} else {\n\t\t\tvalue = parseUnquotedValue(document.slice(cursor, physicalEnd));\n\t\t\tline++;\n\t\t\tnextOffset = physicalEnd < document.length ? physicalEnd + 1 : document.length;\n\t\t}\n\t\ttry {\n\t\t\tvalidateDotenvValue(value);\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretDotenvError) throw new SecretDotenvError(error.message, line - 1);\n\t\t\tthrow error;\n\t\t}\n\t\tnames.add(name);\n\t\tvariables.push({ name, value });\n\t\toffset = nextOffset;\n\t}\n\n\tif (variables.length === 0) throw new SecretDotenvError(\"document must contain at least one assignment\");\n\treturn { document, variables };\n}\n\nexport function formatDotenvVariables(variables: readonly ParsedDotenvVariable[]): string {\n\treturn `${[...variables]\n\t\t.sort((left, right) => left.name.localeCompare(right.name))\n\t\t.map(\n\t\t\t(variable) =>\n\t\t\t\t`${validateDotenvVariableName(variable.name)}=${JSON.stringify(validateDotenvValue(variable.value))}`,\n\t\t)\n\t\t.join(\"\\n\")}\\n`;\n}\n"]}
1	+ {"version":3,"file":"secret-dotenv.js","sourceRoot":"","sources":["../../../src/core/secrets/secret-dotenv.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEpD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAG3C,YAAY,OAAe,EAAE,IAAa;QACzC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAYD,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACtD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,8BAA8B,EAAE,CAAC;QAC7E,MAAM,IAAI,iBAAiB,CAAC,2DAA2D,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,sBAAsB,EAAE,CAAC;QAC/D,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAY;IACtD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,IAAI,SAAS,CAAC;YACrB,SAAS;QACV,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,EAAE,IAAI,CAAC,CAAC;QACxG,QAAQ,OAAO,EAAE,CAAC;YACjB,KAAK,GAAG;gBACP,OAAO,IAAI,IAAI,CAAC;gBAChB,MAAM;YACP,KAAK,GAAG;gBACP,OAAO,IAAI,IAAI,CAAC;gBAChB,MAAM;YACP,KAAK,GAAG;gBACP,OAAO,IAAI,IAAI,CAAC;gBAChB,MAAM;YACP,KAAK,IAAI,CAAC;YACV,KAAK,GAAG,CAAC;YACT,KAAK,GAAG;gBACP,OAAO,IAAI,OAAO,CAAC;gBACnB,MAAM;YACP;gBACC,OAAO,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,KAAa,EAAE,KAAa,EAAE,IAAY;IACrF,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK;YAAE,SAAS;QACxC,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,IAAI,MAAM,GAAG,KAAK,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,MAAM,EAAE;YAAE,UAAU,EAAE,CAAC;QAClG,IAAI,UAAU,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,EAAE,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,KAAa;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACtC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5E,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM;QACP,CAAC;IACF,CAAC;IACD,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,oCAAoC,CAAC,CAAC;IAC/F,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;QACrE,MAAM,IAAI,iBAAiB,CAAC,oCAAoC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACxD,IAAI,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;QAC9B,IAAI,MAAM,IAAI,WAAW,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3E,IAAI,EAAE,CAAC;YACP,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,CAAC,CAAC;YACZ,OAAO,MAAM,GAAG,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACpG,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACJ,IAAI,GAAG,0BAA0B,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,iBAAiB;gBAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,YAAY,IAAI,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACzF,IAAI,SAAS,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,oBAAoB,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACjG,CAAC;QAED,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC;QACpB,OAAO,MAAM,GAAG,WAAW,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,MAAM,EAAE,CAAC;QACjG,IAAI,KAAa,CAAC;QAClB,IAAI,UAAkB,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;YACjE,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,EAAE,IAAI,CAAC,CAAC;YAC/E,CAAC;YACD,KAAK,GAAG,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAClE,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC7E,IAAI,IAAI,aAAa,CAAC;YACtB,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChF,CAAC;aAAM,CAAC;YACP,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAChE,IAAI,EAAE,CAAC;YACP,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChF,CAAC;QACD,IAAI,CAAC;YACJ,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,iBAAiB;gBAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;YAC7F,MAAM,KAAK,CAAC;QACb,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,UAAU,CAAC;IACrB,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,+CAA+C,CAAC,CAAC;IACzG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAA0C;IAC/E,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC;SACtB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC1D,GAAG,CACH,CAAC,QAAQ,EAAE,EAAE,CACZ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CACtG;SACA,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAClB,CAAC","sourcesContent":["const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]$/;\n\nexport const SECRET_VARIABLE_NAME_MAX_CHARS = 128;\nexport const SECRET_VARIABLE_NAME_PATTERN = \"^[A-Za-z_][A-Za-z0-9_]$\";\nexport const MAX_DOTENV_VARIABLES = 64;\nexport const MAX_DOTENV_VALUE_BYTES = 64 * 1024;\nexport const MAX_DOTENV_DOCUMENT_BYTES = 512 * 1024;\n\nexport class SecretDotenvError extends Error {\n\treadonly line?: number;\n\n\tconstructor(message: string, line?: number) {\n\t\tsuper(line === undefined ? message : `Dotenv line ${line}: ${message}`);\n\t\tthis.name = \"SecretDotenvError\";\n\t\tthis.line = line;\n\t}\n}\n\nexport interface ParsedDotenvVariable {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface ParsedDotenvDocument {\n\tdocument: string;\n\tvariables: ParsedDotenvVariable[];\n}\n\nexport function validateDotenvVariableName(name: string): string {\n\tif (!ENV_NAME_RE.test(name) \|\| name.length > SECRET_VARIABLE_NAME_MAX_CHARS) {\n\t\tthrow new SecretDotenvError(\"environment variable name must use portable dotenv syntax\");\n\t}\n\treturn name;\n}\n\nexport function validateDotenvValue(value: string): string {\n\tif (value.includes(\"\\0\")) throw new SecretDotenvError(\"values cannot contain null bytes\");\n\tif (Buffer.byteLength(value, \"utf8\") > MAX_DOTENV_VALUE_BYTES) {\n\t\tthrow new SecretDotenvError(\"a value exceeds the 64 KiB limit\");\n\t}\n\treturn value;\n}\n\nfunction decodeDoubleQuoted(value: string, line: number): string {\n\tlet decoded = \"\";\n\tfor (let index = 0; index < value.length; index++) {\n\t\tconst character = value[index] ?? \"\";\n\t\tif (character !== \"\\\\\") {\n\t\t\tdecoded += character;\n\t\t\tcontinue;\n\t\t}\n\t\tconst escaped = value[++index];\n\t\tif (escaped === undefined) throw new SecretDotenvError(\"double-quoted value ends with an escape\", line);\n\t\tswitch (escaped) {\n\t\t\tcase \"n\":\n\t\t\t\tdecoded += \"\\n\";\n\t\t\t\tbreak;\n\t\t\tcase \"r\":\n\t\t\t\tdecoded += \"\\r\";\n\t\t\t\tbreak;\n\t\t\tcase \"t\":\n\t\t\t\tdecoded += \"\\t\";\n\t\t\t\tbreak;\n\t\t\tcase \"\\\\\":\n\t\t\tcase '\"':\n\t\t\tcase \"$\":\n\t\t\t\tdecoded += escaped;\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tdecoded += `\\\\${escaped}`;\n\t\t}\n\t}\n\treturn decoded;\n}\n\nfunction findClosingQuote(document: string, start: number, quote: string, line: number): number {\n\tfor (let index = start; index < document.length; index++) {\n\t\tif (document[index] !== quote) continue;\n\t\tif (quote !== '\"') return index;\n\t\tlet slashCount = 0;\n\t\tfor (let cursor = index - 1; cursor >= start && document[cursor] === \"\\\\\"; cursor--) slashCount++;\n\t\tif (slashCount % 2 === 0) return index;\n\t}\n\tthrow new SecretDotenvError(\"quoted value is not terminated\", line);\n}\n\nfunction endOfPhysicalLine(document: string, start: number): number {\n\tconst newline = document.indexOf(\"\\n\", start);\n\treturn newline === -1 ? document.length : newline;\n}\n\nfunction parseUnquotedValue(raw: string): string {\n\tlet commentIndex = -1;\n\tfor (let index = 0; index < raw.length; index++) {\n\t\tif (raw[index] === \"#\" && (index === 0 \|\| /\\s/.test(raw[index - 1] ?? \"\"))) {\n\t\t\tcommentIndex = index;\n\t\t\tbreak;\n\t\t}\n\t}\n\treturn (commentIndex === -1 ? raw : raw.slice(0, commentIndex)).trim();\n}\n\n/*\n Parse the practical dotenv surface Pi materializes: comments, blank lines, optional `export`,\n * unquoted values, and single/double/backtick quoted values (including multiline quoted values).\n * Error messages contain only a line number and grammar reason, never the rejected value.\n /\nexport function parseDotenvDocument(input: string): ParsedDotenvDocument {\n\tconst document = input.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n\tif (document.includes(\"\\0\")) throw new SecretDotenvError(\"document cannot contain null bytes\");\n\tif (Buffer.byteLength(document, \"utf8\") > MAX_DOTENV_DOCUMENT_BYTES) {\n\t\tthrow new SecretDotenvError(\"document exceeds the 512 KiB limit\");\n\t}\n\n\tconst variables: ParsedDotenvVariable[] = [];\n\tconst names = new Set<string>();\n\tlet offset = 0;\n\tlet line = 1;\n\twhile (offset < document.length) {\n\t\tconst physicalEnd = endOfPhysicalLine(document, offset);\n\t\tconst physical = document.slice(offset, physicalEnd);\n\t\tconst leading = physical.match(/^\\s/)?.[0].length ?? 0;\n\t\tlet cursor = offset + leading;\n\t\tif (cursor >= physicalEnd \|\| document[cursor] === \"#\") {\n\t\t\toffset = physicalEnd < document.length ? physicalEnd + 1 : document.length;\n\t\t\tline++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (document.slice(cursor, cursor + 6) === \"export\" && /\\s/.test(document[cursor + 6] ?? \"\")) {\n\t\t\tcursor += 6;\n\t\t\twhile (cursor < physicalEnd && /\\s/.test(document[cursor] ?? \"\")) cursor++;\n\t\t}\n\t\tconst equals = document.indexOf(\"=\", cursor);\n\t\tif (equals === -1 \|\| equals > physicalEnd) throw new SecretDotenvError(\"expected NAME=value\", line);\n\t\tlet name: string;\n\t\ttry {\n\t\t\tname = validateDotenvVariableName(document.slice(cursor, equals).trim());\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretDotenvError) throw new SecretDotenvError(error.message, line);\n\t\t\tthrow error;\n\t\t}\n\t\tif (names.has(name)) throw new SecretDotenvError(`variable ${name} is duplicated`, line);\n\t\tif (variables.length >= MAX_DOTENV_VARIABLES) {\n\t\t\tthrow new SecretDotenvError(`profile exceeds the ${MAX_DOTENV_VARIABLES}-variable limit`, line);\n\t\t}\n\n\t\tcursor = equals + 1;\n\t\twhile (cursor < physicalEnd && (document[cursor] === \" \" \|\| document[cursor] === \"\\t\")) cursor++;\n\t\tlet value: string;\n\t\tlet nextOffset: number;\n\t\tconst quote = document[cursor];\n\t\tif (quote === '\"' \|\| quote === \"'\" \|\| quote === \"`\") {\n\t\t\tconst closing = findClosingQuote(document, cursor + 1, quote, line);\n\t\t\tconst quoted = document.slice(cursor + 1, closing);\n\t\t\tconst trailingEnd = endOfPhysicalLine(document, closing + 1);\n\t\t\tconst trailing = document.slice(closing + 1, trailingEnd).trim();\n\t\t\tif (trailing && !trailing.startsWith(\"#\")) {\n\t\t\t\tthrow new SecretDotenvError(\"unexpected text follows the quoted value\", line);\n\t\t\t}\n\t\t\tvalue = quote === '\"' ? decodeDoubleQuoted(quoted, line) : quoted;\n\t\t\tconst consumedLines = document.slice(offset, trailingEnd).split(\"\\n\").length;\n\t\t\tline += consumedLines;\n\t\t\tnextOffset = trailingEnd < document.length ? trailingEnd + 1 : document.length;\n\t\t} else {\n\t\t\tvalue = parseUnquotedValue(document.slice(cursor, physicalEnd));\n\t\t\tline++;\n\t\t\tnextOffset = physicalEnd < document.length ? physicalEnd + 1 : document.length;\n\t\t}\n\t\ttry {\n\t\t\tvalidateDotenvValue(value);\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretDotenvError) throw new SecretDotenvError(error.message, line - 1);\n\t\t\tthrow error;\n\t\t}\n\t\tnames.add(name);\n\t\tvariables.push({ name, value });\n\t\toffset = nextOffset;\n\t}\n\n\tif (variables.length === 0) throw new SecretDotenvError(\"document must contain at least one assignment\");\n\treturn { document, variables };\n}\n\nexport function formatDotenvVariables(variables: readonly ParsedDotenvVariable[]): string {\n\treturn `${[...variables]\n\t\t.sort((left, right) => left.name.localeCompare(right.name))\n\t\t.map(\n\t\t\t(variable) =>\n\t\t\t\t`${validateDotenvVariableName(variable.name)}=${JSON.stringify(validateDotenvValue(variable.value))}`,\n\t\t)\n\t\t.join(\"\\n\")}\\n`;\n}\n"]}

package/dist/core/secrets/secret-vault-format.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"secret-vault-format.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/secret-vault-format.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,YAAY,uBAAuB,CAAC;AAOjD,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAKvC,eAAO,MAAM,oBAAoB,QAAkB,CAAC;AAEpD,eAAO,MAAM,YAAY,KAAK,CAAC;AAC/B,eAAO,MAAM,yBAAyB,KAAuB,CAAC;AAC9D,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAG3C,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,yBAAyB,sDAAsF,CAAC;AAC7H,OAAO,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClG,eAAO,MAAM,iCAAiC,yCAAyC,CAAC;AACxF,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,MAAM,MAAM,oBAAoB,GAC7B,qBAAqB,GACrB,mBAAmB,GACnB,iBAAiB,GACjB,sBAAsB,GACtB,qBAAqB,GACrB,qBAAqB,GACrB,gBAAgB,GAChB,oBAAoB,GACpB,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,cAAc,GACd,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,GACf,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,iBAAiB,CAAC;AAErB,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAEpC,YAAY,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAItD;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAwB,SAAQ,oBAAoB;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,iBAAiB,GAAG,eAAe,GAAG,WAAW,CAAC;AAEtG,MAAM,WAAW,2BAA2B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,yBAAyB,CAAC;CACzC;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,6BAA6B,EAAE,OAAO,CAAC;IACvC,4BAA4B,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,wFAAwF;IACxF,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,QAAQ;IACxB,SAAS,EAAE,QAAQ,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,GAAG,EAAE,QAAQ,CAAC;IACd,OAAO,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,OAAO,YAAY,CAAC;IAC5B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CAChC;AAkBD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAcxD;AAkCD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAWzD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOvF;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAUlE;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAsB9D;AAoBD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASzD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAczD;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,mBAAmB,EAAE,CAAC;CACjC,CAOA;AA8DD,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAExD;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAa5E;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAShE;AAED,wBAAsB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAalF;AAgCD,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CA6BrF;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAO3F;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,oBAAoB,CAUjF;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,GAAG,MAAM,CAEtF","sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes, scrypt } from \"node:crypto\";\nimport { isAbsolute, normalize, sep } from \"node:path\";\nimport {\n\tformatDotenvVariables,\n\tMAX_DOTENV_VARIABLES,\n\tparseDotenvDocument,\n\tSecretDotenvError,\n\tvalidateDotenvValue,\n\tvalidateDotenvVariableName,\n} from \"./secret-dotenv.ts\";\n\nconst VAULT_VERSION = 1;\nexport const VAULT_MARKER = \"pi-secret-vault-v1\";\nconst VAULT_AAD = Buffer.from(\"pi-secret-vault:v1\", \"utf8\");\nconst AES_ALGORITHM = \"aes-256-gcm\";\nconst KEY_LENGTH = 32;\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 16;\nexport const DEFAULT_SCRYPT_N = 32_768;\nconst SCRYPT_R = 8;\nconst SCRYPT_P = 1;\nconst MIN_SCRYPT_N = 1_024;\nconst MAX_SCRYPT_N = 65_536;\nexport const MAX_VAULT_FILE_BYTES = 4 * 1024 * 1024;\nconst MAX_VAULT_PAYLOAD_BYTES = 2 * 1024 * 1024;\nexport const MAX_PROFILES = 64;\nexport const MAX_VARIABLES_PER_PROFILE = MAX_DOTENV_VARIABLES;\nexport const MAX_BINDINGS_PER_PROFILE = 16;\nconst MAX_PASSPHRASE_CHARS = 4_096;\nconst MIN_NEW_PASSPHRASE_CHARS = 12;\nexport const SECRET_PROFILE_ID_MAX_CHARS = 64;\nexport const SECRET_DESCRIPTION_MAX_CHARS = 240;\nexport const SECRET_PROFILE_ID_PATTERN = `^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,${SECRET_PROFILE_ID_MAX_CHARS - 2}}[A-Za-z0-9])?$`;\nexport { SECRET_VARIABLE_NAME_MAX_CHARS, SECRET_VARIABLE_NAME_PATTERN } from \"./secret-dotenv.ts\";\nexport const SECRET_PRINTABLE_METADATA_PATTERN = \"^[^\\\\u0000-\\\\u001f\\\\u007f-\\\\u009f]+$\";\nexport const MANAGED_ENV_HEADER_PREFIX = \"# pi-secret-store:v1 profile=\";\nconst PROFILE_ID_RE = new RegExp(SECRET_PROFILE_ID_PATTERN);\nconst PRINTABLE_METADATA_RE = new RegExp(SECRET_PRINTABLE_METADATA_PATTERN);\nconst WINDOWS_RESERVED_NAME_RE = /^(?:con\|prn\|aux\|nul\|com[1-9]\|lpt[1-9])(?:\\.\|$)/i;\n\nexport type SecretVaultErrorCode =\n\t\| \"already_initialized\"\n\t\| \"ambiguous_binding\"\n\t\| \"binding_missing\"\n\t\| \"destination_conflict\"\n\t\| \"destination_invalid\"\n\t\| \"invalid_description\"\n\t\| \"invalid_dotenv\"\n\t\| \"invalid_passphrase\"\n\t\| \"invalid_profile\"\n\t\| \"invalid_variable\"\n\t\| \"not_initialized\"\n\t\| \"not_unlocked\"\n\t\| \"profile_limit\"\n\t\| \"profile_missing\"\n\t\| \"symlink_refused\"\n\t\| \"unlock_failed\"\n\t\| \"value_too_large\"\n\t\| \"variable_limit\"\n\t\| \"vault_corrupt\"\n\t\| \"vault_too_large\";\n\nexport class SecretVaultError extends Error {\n\treadonly code: SecretVaultErrorCode;\n\n\tconstructor(code: SecretVaultErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"SecretVaultError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport interface SecretVariableValue {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface SecretProfileSummary {\n\tprofile: string;\n\tdescription?: string;\n\tvariableNames: string[];\n\tbindings: SecretBindingSummary[];\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface SecretBindingSummary {\n\tworkspace: string;\n\tenvFile: string;\n\tupdatedAt: string;\n}\n\nexport interface SecretBindingResolution extends SecretBindingSummary {\n\tprofile: string;\n\tdestination: string;\n\tvariableNames: string[];\n}\n\nexport type SecretEnvDestinationState = \"missing\" \| \"managed-profile\" \| \"managed-other\" \| \"unmanaged\";\n\nexport interface SecretMaterializationResult {\n\tprofile: string;\n\tvariableNames: string[];\n\tpreviousState: SecretEnvDestinationState;\n}\n\nexport interface SecretRemovalResult {\n\tprofile: string;\n\tremovedProfile: boolean;\n\tremovedVariableNames: string[];\n\tmanagedMaterializationRemoved: boolean;\n\tboundMaterializationsRemoved: number;\n}\n\nexport interface SecretVaultOptions {\n\tagentDir: string;\n\t/** Test-only cost override. Production callers should retain the default. /\n\tscryptN?: number;\n\tnow?: () => Date;\n\t/* Reset credential-bearing child process state after activation, mutation, or lock. /\n\tonEnvironmentChanged?: () => void;\n}\n\nexport interface VaultKdf {\n\talgorithm: \"scrypt\";\n\tsalt: string;\n\tN: number;\n\tr: number;\n\tp: number;\n\tkeyLength: number;\n}\n\nexport interface VaultCiphertext {\n\tiv: string;\n\ttag: string;\n\tciphertext: string;\n}\n\nexport interface VaultEnvelope {\n\tversion: 1;\n\tkdf: VaultKdf;\n\tpayload: VaultCiphertext;\n}\n\nexport interface SecretProfileRecord {\n\tprofile: string;\n\tdescription?: string;\n\tcreatedAt: string;\n\tupdatedAt: string;\n\tdotenv: string;\n\tbindings: SecretBindingSummary[];\n}\n\nexport interface VaultPayload {\n\tmarker: typeof VAULT_MARKER;\n\tprofiles: SecretProfileRecord[];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction decodeCanonicalBase64(value: unknown, field: string, expectedBytes?: number): Buffer {\n\tif (typeof value !== \"string\" \|\| value.length === 0 \|\| value.length > MAX_VAULT_FILE_BYTES) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", `Secret vault ${field} is invalid.`);\n\t}\n\tconst decoded = Buffer.from(value, \"base64\");\n\tif (decoded.toString(\"base64\") !== value \|\| (expectedBytes !== undefined && decoded.byteLength !== expectedBytes)) {\n\t\tdecoded.fill(0);\n\t\tthrow new SecretVaultError(\"vault_corrupt\", `Secret vault ${field} is invalid.`);\n\t}\n\treturn decoded;\n}\n\nexport function validateScryptN(value: number): number {\n\tif (!Number.isInteger(value) \|\| value < MIN_SCRYPT_N \|\| value > MAX_SCRYPT_N \|\| (value & (value - 1)) !== 0) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF settings are invalid.\");\n\t}\n\treturn value;\n}\n\nexport function createVaultKdf(scryptN: number): VaultKdf {\n\tconst salt = randomBytes(SALT_LENGTH);\n\ttry {\n\t\treturn {\n\t\t\talgorithm: \"scrypt\",\n\t\t\tsalt: salt.toString(\"base64\"),\n\t\t\tN: validateScryptN(scryptN),\n\t\t\tr: SCRYPT_R,\n\t\t\tp: SCRYPT_P,\n\t\t\tkeyLength: KEY_LENGTH,\n\t\t};\n\t} finally {\n\t\tsalt.fill(0);\n\t}\n}\n\nfunction parseKdf(value: unknown): VaultKdf {\n\tif (!isRecord(value)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF is missing.\");\n\tif (value.algorithm !== \"scrypt\" \|\| value.r !== SCRYPT_R \|\| value.p !== SCRYPT_P \|\| value.keyLength !== KEY_LENGTH) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF settings are unsupported.\");\n\t}\n\tconst salt = decodeCanonicalBase64(value.salt, \"salt\", SALT_LENGTH);\n\tsalt.fill(0);\n\treturn {\n\t\talgorithm: \"scrypt\",\n\t\tsalt: value.salt as string,\n\t\tN: validateScryptN(value.N as number),\n\t\tr: SCRYPT_R,\n\t\tp: SCRYPT_P,\n\t\tkeyLength: KEY_LENGTH,\n\t};\n}\n\nfunction parseCiphertext(value: unknown): VaultCiphertext {\n\tif (!isRecord(value)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is missing.\");\n\tconst iv = decodeCanonicalBase64(value.iv, \"IV\", IV_LENGTH);\n\tconst tag = decodeCanonicalBase64(value.tag, \"authentication tag\", AUTH_TAG_LENGTH);\n\tconst ciphertext = decodeCanonicalBase64(value.ciphertext, \"ciphertext\");\n\tiv.fill(0);\n\ttag.fill(0);\n\tciphertext.fill(0);\n\treturn {\n\t\tiv: value.iv as string,\n\t\ttag: value.tag as string,\n\t\tciphertext: value.ciphertext as string,\n\t};\n}\n\nexport function parseEnvelope(text: string): VaultEnvelope {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(text);\n\t} catch {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault data is not valid JSON.\");\n\t}\n\tif (!isRecord(parsed) \|\| parsed.version !== VAULT_VERSION) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault version is unsupported.\");\n\t}\n\treturn { version: VAULT_VERSION, kdf: parseKdf(parsed.kdf), payload: parseCiphertext(parsed.payload) };\n}\n\nexport function validateProfileId(profile: string): string {\n\tif (!PROFILE_ID_RE.test(profile) \|\| WINDOWS_RESERVED_NAME_RE.test(profile)) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"invalid_profile\",\n\t\t\t\"Profile names must be portable 1-64 character identifiers using letters, numbers, dot, dash, or underscore.\",\n\t\t);\n\t}\n\treturn profile;\n}\n\nexport function validateDescription(description: string \| undefined): string \| undefined {\n\tif (description === undefined) return undefined;\n\tconst normalized = description.trim();\n\tif (!normalized \|\| normalized.length > SECRET_DESCRIPTION_MAX_CHARS \|\| !PRINTABLE_METADATA_RE.test(normalized)) {\n\t\tthrow new SecretVaultError(\"invalid_description\", \"Secret profile descriptions must be short printable text.\");\n\t}\n\treturn normalized;\n}\n\nexport function validateBindingWorkspace(workspace: string): string {\n\tif (\n\t\t!isAbsolute(workspace) \|\|\n\t\tworkspace.length > 4_096 \|\|\n\t\tworkspace.includes(\"\\0\") \|\|\n\t\t/[\\u0000-\\u001f\\u007f-\\u009f]/.test(workspace)\n\t) {\n\t\tthrow new SecretVaultError(\"destination_invalid\", \"Credential workspace must be an absolute local path.\");\n\t}\n\treturn normalize(workspace);\n}\n\nexport function validateBindingEnvFile(envFile: string): string {\n\tconst trimmed = envFile.trim();\n\tconst normalized = normalize(trimmed);\n\tconst segments = normalized.split(/[\\\\/]+/);\n\tconst fileName = segments.at(-1) ?? \"\";\n\tif (\n\t\t!trimmed \|\|\n\t\ttrimmed.length > 512 \|\|\n\t\tisAbsolute(trimmed) \|\|\n\t\tnormalized === \"..\" \|\|\n\t\tnormalized.startsWith(`..${sep}`) \|\|\n\t\tsegments.includes(\"..\") \|\|\n\t\ttrimmed.includes(\"\\0\") \|\|\n\t\t/[\\u0000-\\u001f\\u007f-\\u009f]/.test(trimmed) \|\|\n\t\t!(fileName === \".env\" \|\| fileName.startsWith(\".env.\") \|\| fileName.endsWith(\".env\"))\n\t) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"destination_invalid\",\n\t\t\t\"Credential target must be a relative dotenv path inside the workspace (for example .env or config/dev.env).\",\n\t\t);\n\t}\n\treturn normalized;\n}\n\nfunction parseBinding(value: unknown): SecretBindingSummary {\n\tif (!isRecord(value) \|\| typeof value.workspace !== \"string\" \|\| typeof value.envFile !== \"string\") {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding data is invalid.\");\n\t}\n\ttry {\n\t\treturn {\n\t\t\tworkspace: validateBindingWorkspace(value.workspace),\n\t\t\tenvFile: validateBindingEnvFile(value.envFile),\n\t\t\tupdatedAt: validateTimestamp(value.updatedAt),\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SecretVaultError) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding data is invalid.\");\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateVariableName(name: string): string {\n\ttry {\n\t\treturn validateDotenvVariableName(name);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) {\n\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"Environment variable names must use portable dotenv syntax.\");\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateSecretValue(value: string): string {\n\ttry {\n\t\treturn validateDotenvValue(value);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\terror.message.includes(\"64 KiB\") ? \"value_too_large\" : \"invalid_variable\",\n\t\t\t\terror.message.includes(\"64 KiB\")\n\t\t\t\t\t? \"A secret value exceeds the 64 KiB limit.\"\n\t\t\t\t\t: \"Secret values cannot contain null bytes.\",\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateDotenvProfileDocument(document: string): {\n\tdocument: string;\n\tvariables: SecretVariableValue[];\n} {\n\ttry {\n\t\treturn parseDotenvDocument(document);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) throw new SecretVaultError(\"invalid_dotenv\", error.message);\n\t\tthrow error;\n\t}\n}\n\nfunction validateTimestamp(value: unknown): string {\n\tif (typeof value !== \"string\" \|\| value.length > 64 \|\| Number.isNaN(Date.parse(value))) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault timestamps are invalid.\");\n\t}\n\treturn value;\n}\n\nfunction parsePayload(value: unknown): VaultPayload {\n\tif (!isRecord(value) \|\| value.marker !== VAULT_MARKER \|\| !Array.isArray(value.profiles)) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is invalid.\");\n\t}\n\tif (value.profiles.length > MAX_PROFILES) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profile count exceeds its bound.\");\n\t}\n\tconst profileNames = new Set<string>();\n\tconst profiles: SecretProfileRecord[] = value.profiles.map((candidate) => {\n\t\tif (!isRecord(candidate) \|\| typeof candidate.dotenv !== \"string\" \|\| !Array.isArray(candidate.bindings)) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profile data is invalid.\");\n\t\t}\n\t\tconst profile = validateProfileId(typeof candidate.profile === \"string\" ? candidate.profile : \"\");\n\t\tif (profileNames.has(profile))\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profiles are duplicated.\");\n\t\tprofileNames.add(profile);\n\t\tlet dotenv: string;\n\t\ttry {\n\t\t\tdotenv = validateDotenvProfileDocument(candidate.dotenv).document;\n\t\t} catch {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault dotenv data is invalid.\");\n\t\t}\n\t\tif (candidate.bindings.length > MAX_BINDINGS_PER_PROFILE) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding count exceeds its bound.\");\n\t\t}\n\t\tconst bindingIds = new Set<string>();\n\t\tconst bindings = candidate.bindings.map((binding) => {\n\t\t\tconst parsed = parseBinding(binding);\n\t\t\tconst id = `${parsed.workspace}\\0${parsed.envFile}`;\n\t\t\tif (bindingIds.has(id)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault bindings are duplicated.\");\n\t\t\tbindingIds.add(id);\n\t\t\treturn parsed;\n\t\t});\n\t\treturn {\n\t\t\tprofile,\n\t\t\t...(candidate.description !== undefined\n\t\t\t\t? {\n\t\t\t\t\t\tdescription: validateDescription(\n\t\t\t\t\t\t\ttypeof candidate.description === \"string\" ? candidate.description : \"\",\n\t\t\t\t\t\t),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\tcreatedAt: validateTimestamp(candidate.createdAt),\n\t\t\tupdatedAt: validateTimestamp(candidate.updatedAt),\n\t\t\tdotenv,\n\t\t\tbindings: bindings.sort(\n\t\t\t\t(left, right) => left.workspace.localeCompare(right.workspace) \|\| left.envFile.localeCompare(right.envFile),\n\t\t\t),\n\t\t};\n\t});\n\treturn { marker: VAULT_MARKER, profiles: profiles.sort((left, right) => left.profile.localeCompare(right.profile)) };\n}\n\nexport function scrubPayload(payload: VaultPayload): void {\n\tfor (const profile of payload.profiles) profile.dotenv = \"\";\n}\n\nexport function assertPassphrase(passphrase: string, creating: boolean): void {\n\tif (\n\t\tpassphrase.length > MAX_PASSPHRASE_CHARS \|\|\n\t\tpassphrase.includes(\"\\0\") \|\|\n\t\t(creating ? passphrase.length < MIN_NEW_PASSPHRASE_CHARS : passphrase.length === 0)\n\t) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"invalid_passphrase\",\n\t\t\tcreating\n\t\t\t\t? `The vault passphrase must contain ${MIN_NEW_PASSPHRASE_CHARS}-${MAX_PASSPHRASE_CHARS} characters.`\n\t\t\t\t: \"The vault passphrase is invalid.\",\n\t\t);\n\t}\n}\n\nexport function sameKdf(left: VaultKdf, right: VaultKdf): boolean {\n\treturn (\n\t\tleft.algorithm === right.algorithm &&\n\t\tleft.salt === right.salt &&\n\t\tleft.N === right.N &&\n\t\tleft.r === right.r &&\n\t\tleft.p === right.p &&\n\t\tleft.keyLength === right.keyLength\n\t);\n}\n\nexport async function deriveKey(passphrase: string, kdf: VaultKdf): Promise<Buffer> {\n\tconst salt = Buffer.from(kdf.salt, \"base64\");\n\tconst maxmem = Math.max(64 1024 * 1024, 128 * kdf.N * kdf.r + 16 * 1024 * 1024);\n\ttry {\n\t\treturn await new Promise<Buffer>((resolveKey, reject) => {\n\t\t\tscrypt(passphrase, salt, kdf.keyLength, { N: kdf.N, r: kdf.r, p: kdf.p, maxmem }, (error, key) => {\n\t\t\t\tif (error) reject(error);\n\t\t\t\telse resolveKey(key);\n\t\t\t});\n\t\t});\n\t} finally {\n\t\tsalt.fill(0);\n\t}\n}\n\nfunction encryptPayload(payload: VaultPayload, key: Buffer): VaultCiphertext {\n\tlet serialized = JSON.stringify(payload);\n\tif (Buffer.byteLength(serialized, \"utf8\") > MAX_VAULT_PAYLOAD_BYTES) {\n\t\tserialized = \"\";\n\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault payload exceeds its 2 MiB limit.\");\n\t}\n\tconst plaintext = Buffer.from(serialized, \"utf8\");\n\tserialized = \"\";\n\tconst iv = randomBytes(IV_LENGTH);\n\ttry {\n\t\tconst cipher = createCipheriv(AES_ALGORITHM, key, iv);\n\t\tcipher.setAAD(VAULT_AAD);\n\t\tconst ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);\n\t\tconst tag = cipher.getAuthTag();\n\t\ttry {\n\t\t\treturn {\n\t\t\t\tiv: iv.toString(\"base64\"),\n\t\t\t\ttag: tag.toString(\"base64\"),\n\t\t\t\tciphertext: ciphertext.toString(\"base64\"),\n\t\t\t};\n\t\t} finally {\n\t\t\ttag.fill(0);\n\t\t\tciphertext.fill(0);\n\t\t}\n\t} finally {\n\t\tplaintext.fill(0);\n\t\tiv.fill(0);\n\t}\n}\n\nexport function decryptPayload(ciphertext: VaultCiphertext, key: Buffer): VaultPayload {\n\tconst iv = Buffer.from(ciphertext.iv, \"base64\");\n\tconst tag = Buffer.from(ciphertext.tag, \"base64\");\n\tconst encrypted = Buffer.from(ciphertext.ciphertext, \"base64\");\n\tlet plaintext: Buffer \| undefined;\n\ttry {\n\t\tconst decipher = createDecipheriv(AES_ALGORITHM, key, iv);\n\t\tdecipher.setAAD(VAULT_AAD);\n\t\tdecipher.setAuthTag(tag);\n\t\tplaintext = Buffer.concat([decipher.update(encrypted), decipher.final()]);\n\t\tif (plaintext.byteLength > MAX_VAULT_PAYLOAD_BYTES) {\n\t\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault payload exceeds its 2 MiB limit.\");\n\t\t}\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(plaintext.toString(\"utf8\"));\n\t\t} catch {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is invalid.\");\n\t\t}\n\t\treturn parsePayload(parsed);\n\t} catch (error) {\n\t\tif (error instanceof SecretVaultError) throw error;\n\t\tthrow new SecretVaultError(\"unlock_failed\", \"The vault passphrase is incorrect or the vault is damaged.\");\n\t} finally {\n\t\tiv.fill(0);\n\t\ttag.fill(0);\n\t\tencrypted.fill(0);\n\t\tplaintext?.fill(0);\n\t}\n}\n\nexport function serializeEnvelope(kdf: VaultKdf, payload: VaultPayload, key: Buffer): string {\n\tconst envelope: VaultEnvelope = { version: VAULT_VERSION, kdf, payload: encryptPayload(payload, key) };\n\tconst serialized = `${JSON.stringify(envelope, null, 2)}\\n`;\n\tif (Buffer.byteLength(serialized, \"utf8\") > MAX_VAULT_FILE_BYTES) {\n\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault file exceeds its 4 MiB limit.\");\n\t}\n\treturn serialized;\n}\n\nexport function profileSummary(profile: SecretProfileRecord): SecretProfileSummary {\n\tconst parsed = validateDotenvProfileDocument(profile.dotenv);\n\treturn {\n\t\tprofile: profile.profile,\n\t\t...(profile.description ? { description: profile.description } : {}),\n\t\tvariableNames: parsed.variables.map((variable) => variable.name),\n\t\tbindings: profile.bindings.map((binding) => ({ ...binding })),\n\t\tcreatedAt: profile.createdAt,\n\t\tupdatedAt: profile.updatedAt,\n\t};\n}\n\nexport function serializeVariableValues(values: readonly SecretVariableValue[]): string {\n\treturn formatDotenvVariables(values);\n}\n"]}
1	+ {"version":3,"file":"secret-vault-format.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/secret-vault-format.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,YAAY,uBAAuB,CAAC;AAOjD,eAAO,MAAM,gBAAgB,QAAS,CAAC;AAKvC,eAAO,MAAM,oBAAoB,QAAkB,CAAC;AAEpD,eAAO,MAAM,YAAY,KAAK,CAAC;AAC/B,eAAO,MAAM,yBAAyB,KAAuB,CAAC;AAC9D,eAAO,MAAM,wBAAwB,KAAK,CAAC;AAG3C,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,eAAO,MAAM,yBAAyB,sDAAsF,CAAC;AAC7H,OAAO,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClG,eAAO,MAAM,iCAAiC,yCAAyC,CAAC;AACxF,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AAKzE,MAAM,MAAM,oBAAoB,GAC7B,qBAAqB,GACrB,mBAAmB,GACnB,iBAAiB,GACjB,sBAAsB,GACtB,qBAAqB,GACrB,qBAAqB,GACrB,gBAAgB,GAChB,oBAAoB,GACpB,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,cAAc,GACd,eAAe,GACf,iBAAiB,GACjB,iBAAiB,GACjB,eAAe,GACf,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,iBAAiB,CAAC;AAErB,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAEpC,YAAY,IAAI,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAItD;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,EAAE,oBAAoB,EAAE,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,uBAAwB,SAAQ,oBAAoB;IACpE,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,MAAM,yBAAyB,GAAG,SAAS,GAAG,iBAAiB,GAAG,eAAe,GAAG,WAAW,CAAC;AAEtG,MAAM,WAAW,2BAA2B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,yBAAyB,CAAC;CACzC;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;IACxB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,6BAA6B,EAAE,OAAO,CAAC;IACvC,4BAA4B,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,wFAAwF;IACxF,oBAAoB,CAAC,EAAE,MAAM,IAAI,CAAC;CAClC;AAED,MAAM,WAAW,QAAQ;IACxB,SAAS,EAAE,QAAQ,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC7B,OAAO,EAAE,CAAC,CAAC;IACX,GAAG,EAAE,QAAQ,CAAC;IACd,OAAO,EAAE,eAAe,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,OAAO,YAAY,CAAC;IAC5B,QAAQ,EAAE,mBAAmB,EAAE,CAAC;CAChC;AAkBD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKrD;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAcxD;AAkCD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAWzD;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQzD;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOvF;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAUlE;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAsB9D;AAoBD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASzD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAczD;AAED,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG;IAChE,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,mBAAmB,EAAE,CAAC;CACjC,CAOA;AA8DD,wBAAgB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAExD;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,IAAI,CAa5E;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,GAAG,OAAO,CAShE;AAED,wBAAsB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAalF;AAgCD,wBAAgB,cAAc,CAAC,UAAU,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,CA6BrF;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAO3F;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,mBAAmB,GAAG,oBAAoB,CAUjF;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,GAAG,MAAM,CAEtF"}

package/dist/core/secrets/secret-vault-format.js CHANGED Viewed

@@ -31,7 +31,6 @@ const PROFILE_ID_RE = new RegExp(SECRET_PROFILE_ID_PATTERN);
 const PRINTABLE_METADATA_RE = new RegExp(SECRET_PRINTABLE_METADATA_PATTERN);
 const WINDOWS_RESERVED_NAME_RE = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i;
 export class SecretVaultError extends Error {
-    code;
     constructor(code, message) {
         super(message);
         this.name = "SecretVaultError";

package/dist/core/secrets/secret-vault-format.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"secret-vault-format.js","sourceRoot":"","sources":["../../../src/core/secrets/secret-vault-format.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EACN,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AACjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;AAC5D,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACpD,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC;AAC/B,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,yBAAyB,GAAG,mCAAmC,2BAA2B,GAAG,CAAC,iBAAiB,CAAC;AAC7H,OAAO,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClG,MAAM,CAAC,MAAM,iCAAiC,GAAG,sCAAsC,CAAC;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;AACzE,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAC5D,MAAM,qBAAqB,GAAG,IAAI,MAAM,CAAC,iCAAiC,CAAC,CAAC;AAC5E,MAAM,wBAAwB,GAAG,iDAAiD,CAAC;AAwBnF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACjC,IAAI,CAAuB;IAEpC,YAAY,IAA0B,EAAE,OAAe,EAAE;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAAA,CACjB;CACD;AAwFD,SAAS,QAAQ,CAAC,KAAc,EAAoC;IACnE,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAAA,CAC5E;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa,EAAE,aAAsB,EAAU;IAC7F,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC5F,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,gBAAgB,KAAK,cAAc,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,aAAa,CAAC,EAAE,CAAC;QACnH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,gBAAgB,KAAK,cAAc,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAU;IACtD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,YAAY,IAAI,KAAK,GAAG,YAAY,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,MAAM,UAAU,cAAc,CAAC,OAAe,EAAY;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC;QACJ,OAAO;YACN,SAAS,EAAE,QAAQ;YACnB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7B,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC;YAC3B,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,SAAS,EAAE,UAAU;SACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AAAA,CACD;AAED,SAAS,QAAQ,CAAC,KAAc,EAAY;IAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;IAClG,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACpH,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,4CAA4C,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACpE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACb,OAAO;QACN,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,KAAK,CAAC,IAAc;QAC1B,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAW,CAAC;QACrC,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,SAAS,EAAE,UAAU;KACrB,CAAC;AAAA,CACF;AAED,SAAS,eAAe,CAAC,KAAc,EAAmB;IACzD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACtG,MAAM,EAAE,GAAG,qBAAqB,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,eAAe,CAAC,CAAC;IACpF,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACzE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACX,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACZ,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO;QACN,EAAE,EAAE,KAAK,CAAC,EAAY;QACtB,GAAG,EAAE,KAAK,CAAC,GAAa;QACxB,UAAU,EAAE,KAAK,CAAC,UAAoB;KACtC,CAAC;AAAA,CACF;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAiB;IAC1D,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QAC3D,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAAA,CACvG;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAU;IAC1D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,gBAAgB,CACzB,iBAAiB,EACjB,6GAA6G,CAC7G,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED,MAAM,UAAU,mBAAmB,CAAC,WAA+B,EAAsB;IACxF,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,4BAA4B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChH,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,2DAA2D,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,UAAU,CAAC;AAAA,CAClB;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAiB,EAAU;IACnE,IACC,CAAC,UAAU,CAAC,SAAS,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,KAAK;QACxB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxB,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC,EAC7C,CAAC;QACF,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,sDAAsD,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;AAAA,CAC5B;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAU;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IACC,CAAC,OAAO;QACR,OAAO,CAAC,MAAM,GAAG,GAAG;QACpB,UAAU,CAAC,OAAO,CAAC;QACnB,UAAU,KAAK,IAAI;QACnB,UAAU,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QACjC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5C,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAClF,CAAC;QACF,MAAM,IAAI,gBAAgB,CACzB,qBAAqB,EACrB,6GAA6G,CAC7G,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AAAA,CAClB;AAED,SAAS,YAAY,CAAC,KAAc,EAAwB;IAC3D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAClG,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC;QACJ,OAAO;YACN,SAAS,EAAE,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC;YACpD,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9C,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC;SAC7C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAU;IAC1D,IAAI,CAAC;QACJ,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,6DAA6D,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAU;IAC1D,IAAI,CAAC;QACJ,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CACzB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,EACzE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC/B,CAAC,CAAC,0CAA0C;gBAC5C,CAAC,CAAC,0CAA0C,CAC7C,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED,MAAM,UAAU,6BAA6B,CAAC,QAAgB,EAG5D;IACD,IAAI,CAAC;QACJ,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,iBAAiB;YAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpG,MAAM,KAAK,CAAC;IACb,CAAC;AAAA,CACD;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAU;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,SAAS,YAAY,CAAC,KAAc,EAAgB;IACnD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,QAAQ,GAA0B,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC;QACzE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;QACtF,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACJ,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1D,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;YAC7G,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnB,OAAO,MAAM,CAAC;QAAA,CACd,CAAC,CAAC;QACH,OAAO;YACN,OAAO;YACP,GAAG,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS;gBACtC,CAAC,CAAC;oBACA,WAAW,EAAE,mBAAmB,CAC/B,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CACtE;iBACD;gBACF,CAAC,CAAC,EAAE,CAAC;YACN,SAAS,EAAE,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC;YACjD,SAAS,EAAE,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC;YACjD,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,IAAI,CACtB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAC3G;SACD,CAAC;IAAA,CACF,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AAAA,CACrH;AAED,MAAM,UAAU,YAAY,CAAC,OAAqB,EAAQ;IACzD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AAAA,CAC5D;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,QAAiB,EAAQ;IAC7E,IACC,UAAU,CAAC,MAAM,GAAG,oBAAoB;QACxC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAClF,CAAC;QACF,MAAM,IAAI,gBAAgB,CACzB,oBAAoB,EACpB,QAAQ;YACP,CAAC,CAAC,qCAAqC,wBAAwB,IAAI,oBAAoB,cAAc;YACrG,CAAC,CAAC,kCAAkC,CACrC,CAAC;IACH,CAAC;AAAA,CACD;AAED,MAAM,UAAU,OAAO,CAAC,IAAc,EAAE,KAAe,EAAW;IACjE,OAAO,CACN,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAClC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAClC,CAAC;AAAA,CACF;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,GAAa,EAAmB;IACnF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC;QACJ,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC;YACxD,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;gBACjG,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;oBACpB,UAAU,CAAC,GAAG,CAAC,CAAC;YAAA,CACrB,CAAC,CAAC;QAAA,CACH,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AAAA,CACD;AAED,SAAS,cAAc,CAAC,OAAqB,EAAE,GAAW,EAAmB;IAC5E,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,uBAAuB,EAAE,CAAC;QACrE,UAAU,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,UAAU,GAAG,EAAE,CAAC;IAChB,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC;YACJ,OAAO;gBACN,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC3B,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACzC,CAAC;QACH,CAAC;gBAAS,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;YAAS,CAAC;QACV,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;AAAA,CACD;AAED,MAAM,UAAU,cAAc,CAAC,UAA2B,EAAE,GAAW,EAAgB;IACtF,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,SAAS,CAAC,UAAU,GAAG,uBAAuB,EAAE,CAAC;YACpD,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,gBAAgB;YAAE,MAAM,KAAK,CAAC;QACnD,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,4DAA4D,CAAC,CAAC;IAC3G,CAAC;YAAS,CAAC;QACV,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AAAA,CACD;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAa,EAAE,OAAqB,EAAE,GAAW,EAAU;IAC5F,MAAM,QAAQ,GAAkB,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IACvG,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;QAClE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,UAAU,CAAC;AAAA,CAClB;AAED,MAAM,UAAU,cAAc,CAAC,OAA4B,EAAwB;IAClF,MAAM,MAAM,GAAG,6BAA6B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO;QACN,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAC7D,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC5B,CAAC;AAAA,CACF;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAsC,EAAU;IACvF,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AAAA,CACrC","sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes, scrypt } from \"node:crypto\";\nimport { isAbsolute, normalize, sep } from \"node:path\";\nimport {\n\tformatDotenvVariables,\n\tMAX_DOTENV_VARIABLES,\n\tparseDotenvDocument,\n\tSecretDotenvError,\n\tvalidateDotenvValue,\n\tvalidateDotenvVariableName,\n} from \"./secret-dotenv.ts\";\n\nconst VAULT_VERSION = 1;\nexport const VAULT_MARKER = \"pi-secret-vault-v1\";\nconst VAULT_AAD = Buffer.from(\"pi-secret-vault:v1\", \"utf8\");\nconst AES_ALGORITHM = \"aes-256-gcm\";\nconst KEY_LENGTH = 32;\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 16;\nexport const DEFAULT_SCRYPT_N = 32_768;\nconst SCRYPT_R = 8;\nconst SCRYPT_P = 1;\nconst MIN_SCRYPT_N = 1_024;\nconst MAX_SCRYPT_N = 65_536;\nexport const MAX_VAULT_FILE_BYTES = 4 * 1024 * 1024;\nconst MAX_VAULT_PAYLOAD_BYTES = 2 * 1024 * 1024;\nexport const MAX_PROFILES = 64;\nexport const MAX_VARIABLES_PER_PROFILE = MAX_DOTENV_VARIABLES;\nexport const MAX_BINDINGS_PER_PROFILE = 16;\nconst MAX_PASSPHRASE_CHARS = 4_096;\nconst MIN_NEW_PASSPHRASE_CHARS = 12;\nexport const SECRET_PROFILE_ID_MAX_CHARS = 64;\nexport const SECRET_DESCRIPTION_MAX_CHARS = 240;\nexport const SECRET_PROFILE_ID_PATTERN = `^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,${SECRET_PROFILE_ID_MAX_CHARS - 2}}[A-Za-z0-9])?$`;\nexport { SECRET_VARIABLE_NAME_MAX_CHARS, SECRET_VARIABLE_NAME_PATTERN } from \"./secret-dotenv.ts\";\nexport const SECRET_PRINTABLE_METADATA_PATTERN = \"^[^\\\\u0000-\\\\u001f\\\\u007f-\\\\u009f]+$\";\nexport const MANAGED_ENV_HEADER_PREFIX = \"# pi-secret-store:v1 profile=\";\nconst PROFILE_ID_RE = new RegExp(SECRET_PROFILE_ID_PATTERN);\nconst PRINTABLE_METADATA_RE = new RegExp(SECRET_PRINTABLE_METADATA_PATTERN);\nconst WINDOWS_RESERVED_NAME_RE = /^(?:con\|prn\|aux\|nul\|com[1-9]\|lpt[1-9])(?:\\.\|$)/i;\n\nexport type SecretVaultErrorCode =\n\t\| \"already_initialized\"\n\t\| \"ambiguous_binding\"\n\t\| \"binding_missing\"\n\t\| \"destination_conflict\"\n\t\| \"destination_invalid\"\n\t\| \"invalid_description\"\n\t\| \"invalid_dotenv\"\n\t\| \"invalid_passphrase\"\n\t\| \"invalid_profile\"\n\t\| \"invalid_variable\"\n\t\| \"not_initialized\"\n\t\| \"not_unlocked\"\n\t\| \"profile_limit\"\n\t\| \"profile_missing\"\n\t\| \"symlink_refused\"\n\t\| \"unlock_failed\"\n\t\| \"value_too_large\"\n\t\| \"variable_limit\"\n\t\| \"vault_corrupt\"\n\t\| \"vault_too_large\";\n\nexport class SecretVaultError extends Error {\n\treadonly code: SecretVaultErrorCode;\n\n\tconstructor(code: SecretVaultErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"SecretVaultError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport interface SecretVariableValue {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface SecretProfileSummary {\n\tprofile: string;\n\tdescription?: string;\n\tvariableNames: string[];\n\tbindings: SecretBindingSummary[];\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface SecretBindingSummary {\n\tworkspace: string;\n\tenvFile: string;\n\tupdatedAt: string;\n}\n\nexport interface SecretBindingResolution extends SecretBindingSummary {\n\tprofile: string;\n\tdestination: string;\n\tvariableNames: string[];\n}\n\nexport type SecretEnvDestinationState = \"missing\" \| \"managed-profile\" \| \"managed-other\" \| \"unmanaged\";\n\nexport interface SecretMaterializationResult {\n\tprofile: string;\n\tvariableNames: string[];\n\tpreviousState: SecretEnvDestinationState;\n}\n\nexport interface SecretRemovalResult {\n\tprofile: string;\n\tremovedProfile: boolean;\n\tremovedVariableNames: string[];\n\tmanagedMaterializationRemoved: boolean;\n\tboundMaterializationsRemoved: number;\n}\n\nexport interface SecretVaultOptions {\n\tagentDir: string;\n\t/** Test-only cost override. Production callers should retain the default. /\n\tscryptN?: number;\n\tnow?: () => Date;\n\t/* Reset credential-bearing child process state after activation, mutation, or lock. /\n\tonEnvironmentChanged?: () => void;\n}\n\nexport interface VaultKdf {\n\talgorithm: \"scrypt\";\n\tsalt: string;\n\tN: number;\n\tr: number;\n\tp: number;\n\tkeyLength: number;\n}\n\nexport interface VaultCiphertext {\n\tiv: string;\n\ttag: string;\n\tciphertext: string;\n}\n\nexport interface VaultEnvelope {\n\tversion: 1;\n\tkdf: VaultKdf;\n\tpayload: VaultCiphertext;\n}\n\nexport interface SecretProfileRecord {\n\tprofile: string;\n\tdescription?: string;\n\tcreatedAt: string;\n\tupdatedAt: string;\n\tdotenv: string;\n\tbindings: SecretBindingSummary[];\n}\n\nexport interface VaultPayload {\n\tmarker: typeof VAULT_MARKER;\n\tprofiles: SecretProfileRecord[];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction decodeCanonicalBase64(value: unknown, field: string, expectedBytes?: number): Buffer {\n\tif (typeof value !== \"string\" \|\| value.length === 0 \|\| value.length > MAX_VAULT_FILE_BYTES) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", `Secret vault ${field} is invalid.`);\n\t}\n\tconst decoded = Buffer.from(value, \"base64\");\n\tif (decoded.toString(\"base64\") !== value \|\| (expectedBytes !== undefined && decoded.byteLength !== expectedBytes)) {\n\t\tdecoded.fill(0);\n\t\tthrow new SecretVaultError(\"vault_corrupt\", `Secret vault ${field} is invalid.`);\n\t}\n\treturn decoded;\n}\n\nexport function validateScryptN(value: number): number {\n\tif (!Number.isInteger(value) \|\| value < MIN_SCRYPT_N \|\| value > MAX_SCRYPT_N \|\| (value & (value - 1)) !== 0) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF settings are invalid.\");\n\t}\n\treturn value;\n}\n\nexport function createVaultKdf(scryptN: number): VaultKdf {\n\tconst salt = randomBytes(SALT_LENGTH);\n\ttry {\n\t\treturn {\n\t\t\talgorithm: \"scrypt\",\n\t\t\tsalt: salt.toString(\"base64\"),\n\t\t\tN: validateScryptN(scryptN),\n\t\t\tr: SCRYPT_R,\n\t\t\tp: SCRYPT_P,\n\t\t\tkeyLength: KEY_LENGTH,\n\t\t};\n\t} finally {\n\t\tsalt.fill(0);\n\t}\n}\n\nfunction parseKdf(value: unknown): VaultKdf {\n\tif (!isRecord(value)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF is missing.\");\n\tif (value.algorithm !== \"scrypt\" \|\| value.r !== SCRYPT_R \|\| value.p !== SCRYPT_P \|\| value.keyLength !== KEY_LENGTH) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF settings are unsupported.\");\n\t}\n\tconst salt = decodeCanonicalBase64(value.salt, \"salt\", SALT_LENGTH);\n\tsalt.fill(0);\n\treturn {\n\t\talgorithm: \"scrypt\",\n\t\tsalt: value.salt as string,\n\t\tN: validateScryptN(value.N as number),\n\t\tr: SCRYPT_R,\n\t\tp: SCRYPT_P,\n\t\tkeyLength: KEY_LENGTH,\n\t};\n}\n\nfunction parseCiphertext(value: unknown): VaultCiphertext {\n\tif (!isRecord(value)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is missing.\");\n\tconst iv = decodeCanonicalBase64(value.iv, \"IV\", IV_LENGTH);\n\tconst tag = decodeCanonicalBase64(value.tag, \"authentication tag\", AUTH_TAG_LENGTH);\n\tconst ciphertext = decodeCanonicalBase64(value.ciphertext, \"ciphertext\");\n\tiv.fill(0);\n\ttag.fill(0);\n\tciphertext.fill(0);\n\treturn {\n\t\tiv: value.iv as string,\n\t\ttag: value.tag as string,\n\t\tciphertext: value.ciphertext as string,\n\t};\n}\n\nexport function parseEnvelope(text: string): VaultEnvelope {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(text);\n\t} catch {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault data is not valid JSON.\");\n\t}\n\tif (!isRecord(parsed) \|\| parsed.version !== VAULT_VERSION) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault version is unsupported.\");\n\t}\n\treturn { version: VAULT_VERSION, kdf: parseKdf(parsed.kdf), payload: parseCiphertext(parsed.payload) };\n}\n\nexport function validateProfileId(profile: string): string {\n\tif (!PROFILE_ID_RE.test(profile) \|\| WINDOWS_RESERVED_NAME_RE.test(profile)) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"invalid_profile\",\n\t\t\t\"Profile names must be portable 1-64 character identifiers using letters, numbers, dot, dash, or underscore.\",\n\t\t);\n\t}\n\treturn profile;\n}\n\nexport function validateDescription(description: string \| undefined): string \| undefined {\n\tif (description === undefined) return undefined;\n\tconst normalized = description.trim();\n\tif (!normalized \|\| normalized.length > SECRET_DESCRIPTION_MAX_CHARS \|\| !PRINTABLE_METADATA_RE.test(normalized)) {\n\t\tthrow new SecretVaultError(\"invalid_description\", \"Secret profile descriptions must be short printable text.\");\n\t}\n\treturn normalized;\n}\n\nexport function validateBindingWorkspace(workspace: string): string {\n\tif (\n\t\t!isAbsolute(workspace) \|\|\n\t\tworkspace.length > 4_096 \|\|\n\t\tworkspace.includes(\"\\0\") \|\|\n\t\t/[\\u0000-\\u001f\\u007f-\\u009f]/.test(workspace)\n\t) {\n\t\tthrow new SecretVaultError(\"destination_invalid\", \"Credential workspace must be an absolute local path.\");\n\t}\n\treturn normalize(workspace);\n}\n\nexport function validateBindingEnvFile(envFile: string): string {\n\tconst trimmed = envFile.trim();\n\tconst normalized = normalize(trimmed);\n\tconst segments = normalized.split(/[\\\\/]+/);\n\tconst fileName = segments.at(-1) ?? \"\";\n\tif (\n\t\t!trimmed \|\|\n\t\ttrimmed.length > 512 \|\|\n\t\tisAbsolute(trimmed) \|\|\n\t\tnormalized === \"..\" \|\|\n\t\tnormalized.startsWith(`..${sep}`) \|\|\n\t\tsegments.includes(\"..\") \|\|\n\t\ttrimmed.includes(\"\\0\") \|\|\n\t\t/[\\u0000-\\u001f\\u007f-\\u009f]/.test(trimmed) \|\|\n\t\t!(fileName === \".env\" \|\| fileName.startsWith(\".env.\") \|\| fileName.endsWith(\".env\"))\n\t) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"destination_invalid\",\n\t\t\t\"Credential target must be a relative dotenv path inside the workspace (for example .env or config/dev.env).\",\n\t\t);\n\t}\n\treturn normalized;\n}\n\nfunction parseBinding(value: unknown): SecretBindingSummary {\n\tif (!isRecord(value) \|\| typeof value.workspace !== \"string\" \|\| typeof value.envFile !== \"string\") {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding data is invalid.\");\n\t}\n\ttry {\n\t\treturn {\n\t\t\tworkspace: validateBindingWorkspace(value.workspace),\n\t\t\tenvFile: validateBindingEnvFile(value.envFile),\n\t\t\tupdatedAt: validateTimestamp(value.updatedAt),\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SecretVaultError) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding data is invalid.\");\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateVariableName(name: string): string {\n\ttry {\n\t\treturn validateDotenvVariableName(name);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) {\n\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"Environment variable names must use portable dotenv syntax.\");\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateSecretValue(value: string): string {\n\ttry {\n\t\treturn validateDotenvValue(value);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\terror.message.includes(\"64 KiB\") ? \"value_too_large\" : \"invalid_variable\",\n\t\t\t\terror.message.includes(\"64 KiB\")\n\t\t\t\t\t? \"A secret value exceeds the 64 KiB limit.\"\n\t\t\t\t\t: \"Secret values cannot contain null bytes.\",\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateDotenvProfileDocument(document: string): {\n\tdocument: string;\n\tvariables: SecretVariableValue[];\n} {\n\ttry {\n\t\treturn parseDotenvDocument(document);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) throw new SecretVaultError(\"invalid_dotenv\", error.message);\n\t\tthrow error;\n\t}\n}\n\nfunction validateTimestamp(value: unknown): string {\n\tif (typeof value !== \"string\" \|\| value.length > 64 \|\| Number.isNaN(Date.parse(value))) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault timestamps are invalid.\");\n\t}\n\treturn value;\n}\n\nfunction parsePayload(value: unknown): VaultPayload {\n\tif (!isRecord(value) \|\| value.marker !== VAULT_MARKER \|\| !Array.isArray(value.profiles)) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is invalid.\");\n\t}\n\tif (value.profiles.length > MAX_PROFILES) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profile count exceeds its bound.\");\n\t}\n\tconst profileNames = new Set<string>();\n\tconst profiles: SecretProfileRecord[] = value.profiles.map((candidate) => {\n\t\tif (!isRecord(candidate) \|\| typeof candidate.dotenv !== \"string\" \|\| !Array.isArray(candidate.bindings)) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profile data is invalid.\");\n\t\t}\n\t\tconst profile = validateProfileId(typeof candidate.profile === \"string\" ? candidate.profile : \"\");\n\t\tif (profileNames.has(profile))\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profiles are duplicated.\");\n\t\tprofileNames.add(profile);\n\t\tlet dotenv: string;\n\t\ttry {\n\t\t\tdotenv = validateDotenvProfileDocument(candidate.dotenv).document;\n\t\t} catch {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault dotenv data is invalid.\");\n\t\t}\n\t\tif (candidate.bindings.length > MAX_BINDINGS_PER_PROFILE) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding count exceeds its bound.\");\n\t\t}\n\t\tconst bindingIds = new Set<string>();\n\t\tconst bindings = candidate.bindings.map((binding) => {\n\t\t\tconst parsed = parseBinding(binding);\n\t\t\tconst id = `${parsed.workspace}\\0${parsed.envFile}`;\n\t\t\tif (bindingIds.has(id)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault bindings are duplicated.\");\n\t\t\tbindingIds.add(id);\n\t\t\treturn parsed;\n\t\t});\n\t\treturn {\n\t\t\tprofile,\n\t\t\t...(candidate.description !== undefined\n\t\t\t\t? {\n\t\t\t\t\t\tdescription: validateDescription(\n\t\t\t\t\t\t\ttypeof candidate.description === \"string\" ? candidate.description : \"\",\n\t\t\t\t\t\t),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\tcreatedAt: validateTimestamp(candidate.createdAt),\n\t\t\tupdatedAt: validateTimestamp(candidate.updatedAt),\n\t\t\tdotenv,\n\t\t\tbindings: bindings.sort(\n\t\t\t\t(left, right) => left.workspace.localeCompare(right.workspace) \|\| left.envFile.localeCompare(right.envFile),\n\t\t\t),\n\t\t};\n\t});\n\treturn { marker: VAULT_MARKER, profiles: profiles.sort((left, right) => left.profile.localeCompare(right.profile)) };\n}\n\nexport function scrubPayload(payload: VaultPayload): void {\n\tfor (const profile of payload.profiles) profile.dotenv = \"\";\n}\n\nexport function assertPassphrase(passphrase: string, creating: boolean): void {\n\tif (\n\t\tpassphrase.length > MAX_PASSPHRASE_CHARS \|\|\n\t\tpassphrase.includes(\"\\0\") \|\|\n\t\t(creating ? passphrase.length < MIN_NEW_PASSPHRASE_CHARS : passphrase.length === 0)\n\t) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"invalid_passphrase\",\n\t\t\tcreating\n\t\t\t\t? `The vault passphrase must contain ${MIN_NEW_PASSPHRASE_CHARS}-${MAX_PASSPHRASE_CHARS} characters.`\n\t\t\t\t: \"The vault passphrase is invalid.\",\n\t\t);\n\t}\n}\n\nexport function sameKdf(left: VaultKdf, right: VaultKdf): boolean {\n\treturn (\n\t\tleft.algorithm === right.algorithm &&\n\t\tleft.salt === right.salt &&\n\t\tleft.N === right.N &&\n\t\tleft.r === right.r &&\n\t\tleft.p === right.p &&\n\t\tleft.keyLength === right.keyLength\n\t);\n}\n\nexport async function deriveKey(passphrase: string, kdf: VaultKdf): Promise<Buffer> {\n\tconst salt = Buffer.from(kdf.salt, \"base64\");\n\tconst maxmem = Math.max(64 1024 * 1024, 128 * kdf.N * kdf.r + 16 * 1024 * 1024);\n\ttry {\n\t\treturn await new Promise<Buffer>((resolveKey, reject) => {\n\t\t\tscrypt(passphrase, salt, kdf.keyLength, { N: kdf.N, r: kdf.r, p: kdf.p, maxmem }, (error, key) => {\n\t\t\t\tif (error) reject(error);\n\t\t\t\telse resolveKey(key);\n\t\t\t});\n\t\t});\n\t} finally {\n\t\tsalt.fill(0);\n\t}\n}\n\nfunction encryptPayload(payload: VaultPayload, key: Buffer): VaultCiphertext {\n\tlet serialized = JSON.stringify(payload);\n\tif (Buffer.byteLength(serialized, \"utf8\") > MAX_VAULT_PAYLOAD_BYTES) {\n\t\tserialized = \"\";\n\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault payload exceeds its 2 MiB limit.\");\n\t}\n\tconst plaintext = Buffer.from(serialized, \"utf8\");\n\tserialized = \"\";\n\tconst iv = randomBytes(IV_LENGTH);\n\ttry {\n\t\tconst cipher = createCipheriv(AES_ALGORITHM, key, iv);\n\t\tcipher.setAAD(VAULT_AAD);\n\t\tconst ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);\n\t\tconst tag = cipher.getAuthTag();\n\t\ttry {\n\t\t\treturn {\n\t\t\t\tiv: iv.toString(\"base64\"),\n\t\t\t\ttag: tag.toString(\"base64\"),\n\t\t\t\tciphertext: ciphertext.toString(\"base64\"),\n\t\t\t};\n\t\t} finally {\n\t\t\ttag.fill(0);\n\t\t\tciphertext.fill(0);\n\t\t}\n\t} finally {\n\t\tplaintext.fill(0);\n\t\tiv.fill(0);\n\t}\n}\n\nexport function decryptPayload(ciphertext: VaultCiphertext, key: Buffer): VaultPayload {\n\tconst iv = Buffer.from(ciphertext.iv, \"base64\");\n\tconst tag = Buffer.from(ciphertext.tag, \"base64\");\n\tconst encrypted = Buffer.from(ciphertext.ciphertext, \"base64\");\n\tlet plaintext: Buffer \| undefined;\n\ttry {\n\t\tconst decipher = createDecipheriv(AES_ALGORITHM, key, iv);\n\t\tdecipher.setAAD(VAULT_AAD);\n\t\tdecipher.setAuthTag(tag);\n\t\tplaintext = Buffer.concat([decipher.update(encrypted), decipher.final()]);\n\t\tif (plaintext.byteLength > MAX_VAULT_PAYLOAD_BYTES) {\n\t\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault payload exceeds its 2 MiB limit.\");\n\t\t}\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(plaintext.toString(\"utf8\"));\n\t\t} catch {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is invalid.\");\n\t\t}\n\t\treturn parsePayload(parsed);\n\t} catch (error) {\n\t\tif (error instanceof SecretVaultError) throw error;\n\t\tthrow new SecretVaultError(\"unlock_failed\", \"The vault passphrase is incorrect or the vault is damaged.\");\n\t} finally {\n\t\tiv.fill(0);\n\t\ttag.fill(0);\n\t\tencrypted.fill(0);\n\t\tplaintext?.fill(0);\n\t}\n}\n\nexport function serializeEnvelope(kdf: VaultKdf, payload: VaultPayload, key: Buffer): string {\n\tconst envelope: VaultEnvelope = { version: VAULT_VERSION, kdf, payload: encryptPayload(payload, key) };\n\tconst serialized = `${JSON.stringify(envelope, null, 2)}\\n`;\n\tif (Buffer.byteLength(serialized, \"utf8\") > MAX_VAULT_FILE_BYTES) {\n\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault file exceeds its 4 MiB limit.\");\n\t}\n\treturn serialized;\n}\n\nexport function profileSummary(profile: SecretProfileRecord): SecretProfileSummary {\n\tconst parsed = validateDotenvProfileDocument(profile.dotenv);\n\treturn {\n\t\tprofile: profile.profile,\n\t\t...(profile.description ? { description: profile.description } : {}),\n\t\tvariableNames: parsed.variables.map((variable) => variable.name),\n\t\tbindings: profile.bindings.map((binding) => ({ ...binding })),\n\t\tcreatedAt: profile.createdAt,\n\t\tupdatedAt: profile.updatedAt,\n\t};\n}\n\nexport function serializeVariableValues(values: readonly SecretVariableValue[]): string {\n\treturn formatDotenvVariables(values);\n}\n"]}
1	+ {"version":3,"file":"secret-vault-format.js","sourceRoot":"","sources":["../../../src/core/secrets/secret-vault-format.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACvD,OAAO,EACN,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,0BAA0B,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,CAAC,MAAM,YAAY,GAAG,oBAAoB,CAAC;AACjD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;AAC5D,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACpD,MAAM,uBAAuB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,CAAC;AAC/B,MAAM,CAAC,MAAM,yBAAyB,GAAG,oBAAoB,CAAC;AAC9D,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAC3C,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC,MAAM,wBAAwB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,CAAC;AAC9C,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAChD,MAAM,CAAC,MAAM,yBAAyB,GAAG,mCAAmC,2BAA2B,GAAG,CAAC,iBAAiB,CAAC;AAC7H,OAAO,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClG,MAAM,CAAC,MAAM,iCAAiC,GAAG,sCAAsC,CAAC;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;AACzE,MAAM,aAAa,GAAG,IAAI,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAC5D,MAAM,qBAAqB,GAAG,IAAI,MAAM,CAAC,iCAAiC,CAAC,CAAC;AAC5E,MAAM,wBAAwB,GAAG,iDAAiD,CAAC;AAwBnF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAG1C,YAAY,IAA0B,EAAE,OAAe;QACtD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAwFD,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa,EAAE,aAAsB;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QAC5F,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,gBAAgB,KAAK,cAAc,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,aAAa,CAAC,EAAE,CAAC;QACnH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,gBAAgB,KAAK,cAAc,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,YAAY,IAAI,KAAK,GAAG,YAAY,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7G,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAe;IAC7C,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC;QACJ,OAAO;YACN,SAAS,EAAE,QAAQ;YACnB,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC7B,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC;YAC3B,CAAC,EAAE,QAAQ;YACX,CAAC,EAAE,QAAQ;YACX,SAAS,EAAE,UAAU;SACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,8BAA8B,CAAC,CAAC;IAClG,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;QACpH,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,4CAA4C,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACpE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACb,OAAO;QACN,SAAS,EAAE,QAAQ;QACnB,IAAI,EAAE,KAAK,CAAC,IAAc;QAC1B,CAAC,EAAE,eAAe,CAAC,KAAK,CAAC,CAAW,CAAC;QACrC,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,SAAS,EAAE,UAAU;KACrB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACtC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACtG,MAAM,EAAE,GAAG,qBAAqB,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,eAAe,CAAC,CAAC;IACpF,MAAM,UAAU,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACzE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACX,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACZ,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,OAAO;QACN,EAAE,EAAE,KAAK,CAAC,EAAY;QACtB,GAAG,EAAE,KAAK,CAAC,GAAa;QACxB,UAAU,EAAE,KAAK,CAAC,UAAoB;KACtC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY;IACzC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;QAC3D,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AACxG,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAChD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,gBAAgB,CACzB,iBAAiB,EACjB,6GAA6G,CAC7G,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,WAA+B;IAClE,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,4BAA4B,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAChH,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,2DAA2D,CAAC,CAAC;IAChH,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,SAAiB;IACzD,IACC,CAAC,UAAU,CAAC,SAAS,CAAC;QACtB,SAAS,CAAC,MAAM,GAAG,KAAK;QACxB,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxB,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC,EAC7C,CAAC;QACF,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,sDAAsD,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvC,IACC,CAAC,OAAO;QACR,OAAO,CAAC,MAAM,GAAG,GAAG;QACpB,UAAU,CAAC,OAAO,CAAC;QACnB,UAAU,KAAK,IAAI;QACnB,UAAU,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QACjC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC;QAC5C,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAClF,CAAC;QACF,MAAM,IAAI,gBAAgB,CACzB,qBAAqB,EACrB,6GAA6G,CAC7G,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAClG,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC;QACJ,OAAO;YACN,SAAS,EAAE,wBAAwB,CAAC,KAAK,CAAC,SAAS,CAAC;YACpD,OAAO,EAAE,sBAAsB,CAAC,KAAK,CAAC,OAAO,CAAC;YAC9C,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC;SAC7C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAChD,IAAI,CAAC;QACJ,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,6DAA6D,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAChD,IAAI,CAAC;QACJ,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CACzB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,EACzE,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC/B,CAAC,CAAC,0CAA0C;gBAC5C,CAAC,CAAC,0CAA0C,CAC7C,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,QAAgB;IAI7D,IAAI,CAAC;QACJ,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,iBAAiB;YAAE,MAAM,IAAI,gBAAgB,CAAC,gBAAgB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QACpG,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QAC1C,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,MAAM,QAAQ,GAA0B,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QACxE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;QACtF,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1B,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACJ,MAAM,GAAG,6BAA6B,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,sCAAsC,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1D,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;YACnD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACrC,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YACpD,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;YAC7G,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnB,OAAO,MAAM,CAAC;QACf,CAAC,CAAC,CAAC;QACH,OAAO;YACN,OAAO;YACP,GAAG,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS;gBACtC,CAAC,CAAC;oBACA,WAAW,EAAE,mBAAmB,CAC/B,OAAO,SAAS,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CACtE;iBACD;gBACF,CAAC,CAAC,EAAE,CAAC;YACN,SAAS,EAAE,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC;YACjD,SAAS,EAAE,iBAAiB,CAAC,SAAS,CAAC,SAAS,CAAC;YACjD,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,IAAI,CACtB,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAC3G;SACD,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAqB;IACjD,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,QAAiB;IACrE,IACC,UAAU,CAAC,MAAM,GAAG,oBAAoB;QACxC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAClF,CAAC;QACF,MAAM,IAAI,gBAAgB,CACzB,oBAAoB,EACpB,QAAQ;YACP,CAAC,CAAC,qCAAqC,wBAAwB,IAAI,oBAAoB,cAAc;YACrG,CAAC,CAAC,kCAAkC,CACrC,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAc,EAAE,KAAe;IACtD,OAAO,CACN,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS;QAClC,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAClC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,GAAa;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC;IAClF,IAAI,CAAC;QACJ,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE;YACvD,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAChG,IAAI,KAAK;oBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;oBACpB,UAAU,CAAC,GAAG,CAAC,CAAC;YACtB,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,OAAqB,EAAE,GAAW;IACzD,IAAI,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,uBAAuB,EAAE,CAAC;QACrE,UAAU,GAAG,EAAE,CAAC;QAChB,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,UAAU,GAAG,EAAE,CAAC;IAChB,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC;YACJ,OAAO;gBACN,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACzB,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAC3B,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC;aACzC,CAAC;QACH,CAAC;gBAAS,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACF,CAAC;YAAS,CAAC;QACV,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;AACF,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAA2B,EAAE,GAAW;IACtE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/D,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC1E,IAAI,SAAS,CAAC,UAAU,GAAG,uBAAuB,EAAE,CAAC;YACpD,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,+CAA+C,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,gBAAgB;YAAE,MAAM,KAAK,CAAC;QACnD,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,4DAA4D,CAAC,CAAC;IAC3G,CAAC;YAAS,CAAC;QACV,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAa,EAAE,OAAqB,EAAE,GAAW;IAClF,MAAM,QAAQ,GAAkB,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC;IACvG,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAC5D,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;QAClE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,4CAA4C,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAA4B;IAC1D,MAAM,MAAM,GAAG,6BAA6B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,OAAO;QACN,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAC7D,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC5B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAsC;IAC7E,OAAO,qBAAqB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC","sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes, scrypt } from \"node:crypto\";\nimport { isAbsolute, normalize, sep } from \"node:path\";\nimport {\n\tformatDotenvVariables,\n\tMAX_DOTENV_VARIABLES,\n\tparseDotenvDocument,\n\tSecretDotenvError,\n\tvalidateDotenvValue,\n\tvalidateDotenvVariableName,\n} from \"./secret-dotenv.ts\";\n\nconst VAULT_VERSION = 1;\nexport const VAULT_MARKER = \"pi-secret-vault-v1\";\nconst VAULT_AAD = Buffer.from(\"pi-secret-vault:v1\", \"utf8\");\nconst AES_ALGORITHM = \"aes-256-gcm\";\nconst KEY_LENGTH = 32;\nconst IV_LENGTH = 12;\nconst AUTH_TAG_LENGTH = 16;\nconst SALT_LENGTH = 16;\nexport const DEFAULT_SCRYPT_N = 32_768;\nconst SCRYPT_R = 8;\nconst SCRYPT_P = 1;\nconst MIN_SCRYPT_N = 1_024;\nconst MAX_SCRYPT_N = 65_536;\nexport const MAX_VAULT_FILE_BYTES = 4 * 1024 * 1024;\nconst MAX_VAULT_PAYLOAD_BYTES = 2 * 1024 * 1024;\nexport const MAX_PROFILES = 64;\nexport const MAX_VARIABLES_PER_PROFILE = MAX_DOTENV_VARIABLES;\nexport const MAX_BINDINGS_PER_PROFILE = 16;\nconst MAX_PASSPHRASE_CHARS = 4_096;\nconst MIN_NEW_PASSPHRASE_CHARS = 12;\nexport const SECRET_PROFILE_ID_MAX_CHARS = 64;\nexport const SECRET_DESCRIPTION_MAX_CHARS = 240;\nexport const SECRET_PROFILE_ID_PATTERN = `^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,${SECRET_PROFILE_ID_MAX_CHARS - 2}}[A-Za-z0-9])?$`;\nexport { SECRET_VARIABLE_NAME_MAX_CHARS, SECRET_VARIABLE_NAME_PATTERN } from \"./secret-dotenv.ts\";\nexport const SECRET_PRINTABLE_METADATA_PATTERN = \"^[^\\\\u0000-\\\\u001f\\\\u007f-\\\\u009f]+$\";\nexport const MANAGED_ENV_HEADER_PREFIX = \"# pi-secret-store:v1 profile=\";\nconst PROFILE_ID_RE = new RegExp(SECRET_PROFILE_ID_PATTERN);\nconst PRINTABLE_METADATA_RE = new RegExp(SECRET_PRINTABLE_METADATA_PATTERN);\nconst WINDOWS_RESERVED_NAME_RE = /^(?:con\|prn\|aux\|nul\|com[1-9]\|lpt[1-9])(?:\\.\|$)/i;\n\nexport type SecretVaultErrorCode =\n\t\| \"already_initialized\"\n\t\| \"ambiguous_binding\"\n\t\| \"binding_missing\"\n\t\| \"destination_conflict\"\n\t\| \"destination_invalid\"\n\t\| \"invalid_description\"\n\t\| \"invalid_dotenv\"\n\t\| \"invalid_passphrase\"\n\t\| \"invalid_profile\"\n\t\| \"invalid_variable\"\n\t\| \"not_initialized\"\n\t\| \"not_unlocked\"\n\t\| \"profile_limit\"\n\t\| \"profile_missing\"\n\t\| \"symlink_refused\"\n\t\| \"unlock_failed\"\n\t\| \"value_too_large\"\n\t\| \"variable_limit\"\n\t\| \"vault_corrupt\"\n\t\| \"vault_too_large\";\n\nexport class SecretVaultError extends Error {\n\treadonly code: SecretVaultErrorCode;\n\n\tconstructor(code: SecretVaultErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"SecretVaultError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport interface SecretVariableValue {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface SecretProfileSummary {\n\tprofile: string;\n\tdescription?: string;\n\tvariableNames: string[];\n\tbindings: SecretBindingSummary[];\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface SecretBindingSummary {\n\tworkspace: string;\n\tenvFile: string;\n\tupdatedAt: string;\n}\n\nexport interface SecretBindingResolution extends SecretBindingSummary {\n\tprofile: string;\n\tdestination: string;\n\tvariableNames: string[];\n}\n\nexport type SecretEnvDestinationState = \"missing\" \| \"managed-profile\" \| \"managed-other\" \| \"unmanaged\";\n\nexport interface SecretMaterializationResult {\n\tprofile: string;\n\tvariableNames: string[];\n\tpreviousState: SecretEnvDestinationState;\n}\n\nexport interface SecretRemovalResult {\n\tprofile: string;\n\tremovedProfile: boolean;\n\tremovedVariableNames: string[];\n\tmanagedMaterializationRemoved: boolean;\n\tboundMaterializationsRemoved: number;\n}\n\nexport interface SecretVaultOptions {\n\tagentDir: string;\n\t/** Test-only cost override. Production callers should retain the default. /\n\tscryptN?: number;\n\tnow?: () => Date;\n\t/* Reset credential-bearing child process state after activation, mutation, or lock. /\n\tonEnvironmentChanged?: () => void;\n}\n\nexport interface VaultKdf {\n\talgorithm: \"scrypt\";\n\tsalt: string;\n\tN: number;\n\tr: number;\n\tp: number;\n\tkeyLength: number;\n}\n\nexport interface VaultCiphertext {\n\tiv: string;\n\ttag: string;\n\tciphertext: string;\n}\n\nexport interface VaultEnvelope {\n\tversion: 1;\n\tkdf: VaultKdf;\n\tpayload: VaultCiphertext;\n}\n\nexport interface SecretProfileRecord {\n\tprofile: string;\n\tdescription?: string;\n\tcreatedAt: string;\n\tupdatedAt: string;\n\tdotenv: string;\n\tbindings: SecretBindingSummary[];\n}\n\nexport interface VaultPayload {\n\tmarker: typeof VAULT_MARKER;\n\tprofiles: SecretProfileRecord[];\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction decodeCanonicalBase64(value: unknown, field: string, expectedBytes?: number): Buffer {\n\tif (typeof value !== \"string\" \|\| value.length === 0 \|\| value.length > MAX_VAULT_FILE_BYTES) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", `Secret vault ${field} is invalid.`);\n\t}\n\tconst decoded = Buffer.from(value, \"base64\");\n\tif (decoded.toString(\"base64\") !== value \|\| (expectedBytes !== undefined && decoded.byteLength !== expectedBytes)) {\n\t\tdecoded.fill(0);\n\t\tthrow new SecretVaultError(\"vault_corrupt\", `Secret vault ${field} is invalid.`);\n\t}\n\treturn decoded;\n}\n\nexport function validateScryptN(value: number): number {\n\tif (!Number.isInteger(value) \|\| value < MIN_SCRYPT_N \|\| value > MAX_SCRYPT_N \|\| (value & (value - 1)) !== 0) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF settings are invalid.\");\n\t}\n\treturn value;\n}\n\nexport function createVaultKdf(scryptN: number): VaultKdf {\n\tconst salt = randomBytes(SALT_LENGTH);\n\ttry {\n\t\treturn {\n\t\t\talgorithm: \"scrypt\",\n\t\t\tsalt: salt.toString(\"base64\"),\n\t\t\tN: validateScryptN(scryptN),\n\t\t\tr: SCRYPT_R,\n\t\t\tp: SCRYPT_P,\n\t\t\tkeyLength: KEY_LENGTH,\n\t\t};\n\t} finally {\n\t\tsalt.fill(0);\n\t}\n}\n\nfunction parseKdf(value: unknown): VaultKdf {\n\tif (!isRecord(value)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF is missing.\");\n\tif (value.algorithm !== \"scrypt\" \|\| value.r !== SCRYPT_R \|\| value.p !== SCRYPT_P \|\| value.keyLength !== KEY_LENGTH) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault KDF settings are unsupported.\");\n\t}\n\tconst salt = decodeCanonicalBase64(value.salt, \"salt\", SALT_LENGTH);\n\tsalt.fill(0);\n\treturn {\n\t\talgorithm: \"scrypt\",\n\t\tsalt: value.salt as string,\n\t\tN: validateScryptN(value.N as number),\n\t\tr: SCRYPT_R,\n\t\tp: SCRYPT_P,\n\t\tkeyLength: KEY_LENGTH,\n\t};\n}\n\nfunction parseCiphertext(value: unknown): VaultCiphertext {\n\tif (!isRecord(value)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is missing.\");\n\tconst iv = decodeCanonicalBase64(value.iv, \"IV\", IV_LENGTH);\n\tconst tag = decodeCanonicalBase64(value.tag, \"authentication tag\", AUTH_TAG_LENGTH);\n\tconst ciphertext = decodeCanonicalBase64(value.ciphertext, \"ciphertext\");\n\tiv.fill(0);\n\ttag.fill(0);\n\tciphertext.fill(0);\n\treturn {\n\t\tiv: value.iv as string,\n\t\ttag: value.tag as string,\n\t\tciphertext: value.ciphertext as string,\n\t};\n}\n\nexport function parseEnvelope(text: string): VaultEnvelope {\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(text);\n\t} catch {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault data is not valid JSON.\");\n\t}\n\tif (!isRecord(parsed) \|\| parsed.version !== VAULT_VERSION) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault version is unsupported.\");\n\t}\n\treturn { version: VAULT_VERSION, kdf: parseKdf(parsed.kdf), payload: parseCiphertext(parsed.payload) };\n}\n\nexport function validateProfileId(profile: string): string {\n\tif (!PROFILE_ID_RE.test(profile) \|\| WINDOWS_RESERVED_NAME_RE.test(profile)) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"invalid_profile\",\n\t\t\t\"Profile names must be portable 1-64 character identifiers using letters, numbers, dot, dash, or underscore.\",\n\t\t);\n\t}\n\treturn profile;\n}\n\nexport function validateDescription(description: string \| undefined): string \| undefined {\n\tif (description === undefined) return undefined;\n\tconst normalized = description.trim();\n\tif (!normalized \|\| normalized.length > SECRET_DESCRIPTION_MAX_CHARS \|\| !PRINTABLE_METADATA_RE.test(normalized)) {\n\t\tthrow new SecretVaultError(\"invalid_description\", \"Secret profile descriptions must be short printable text.\");\n\t}\n\treturn normalized;\n}\n\nexport function validateBindingWorkspace(workspace: string): string {\n\tif (\n\t\t!isAbsolute(workspace) \|\|\n\t\tworkspace.length > 4_096 \|\|\n\t\tworkspace.includes(\"\\0\") \|\|\n\t\t/[\\u0000-\\u001f\\u007f-\\u009f]/.test(workspace)\n\t) {\n\t\tthrow new SecretVaultError(\"destination_invalid\", \"Credential workspace must be an absolute local path.\");\n\t}\n\treturn normalize(workspace);\n}\n\nexport function validateBindingEnvFile(envFile: string): string {\n\tconst trimmed = envFile.trim();\n\tconst normalized = normalize(trimmed);\n\tconst segments = normalized.split(/[\\\\/]+/);\n\tconst fileName = segments.at(-1) ?? \"\";\n\tif (\n\t\t!trimmed \|\|\n\t\ttrimmed.length > 512 \|\|\n\t\tisAbsolute(trimmed) \|\|\n\t\tnormalized === \"..\" \|\|\n\t\tnormalized.startsWith(`..${sep}`) \|\|\n\t\tsegments.includes(\"..\") \|\|\n\t\ttrimmed.includes(\"\\0\") \|\|\n\t\t/[\\u0000-\\u001f\\u007f-\\u009f]/.test(trimmed) \|\|\n\t\t!(fileName === \".env\" \|\| fileName.startsWith(\".env.\") \|\| fileName.endsWith(\".env\"))\n\t) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"destination_invalid\",\n\t\t\t\"Credential target must be a relative dotenv path inside the workspace (for example .env or config/dev.env).\",\n\t\t);\n\t}\n\treturn normalized;\n}\n\nfunction parseBinding(value: unknown): SecretBindingSummary {\n\tif (!isRecord(value) \|\| typeof value.workspace !== \"string\" \|\| typeof value.envFile !== \"string\") {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding data is invalid.\");\n\t}\n\ttry {\n\t\treturn {\n\t\t\tworkspace: validateBindingWorkspace(value.workspace),\n\t\t\tenvFile: validateBindingEnvFile(value.envFile),\n\t\t\tupdatedAt: validateTimestamp(value.updatedAt),\n\t\t};\n\t} catch (error) {\n\t\tif (error instanceof SecretVaultError) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding data is invalid.\");\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateVariableName(name: string): string {\n\ttry {\n\t\treturn validateDotenvVariableName(name);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) {\n\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"Environment variable names must use portable dotenv syntax.\");\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateSecretValue(value: string): string {\n\ttry {\n\t\treturn validateDotenvValue(value);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\terror.message.includes(\"64 KiB\") ? \"value_too_large\" : \"invalid_variable\",\n\t\t\t\terror.message.includes(\"64 KiB\")\n\t\t\t\t\t? \"A secret value exceeds the 64 KiB limit.\"\n\t\t\t\t\t: \"Secret values cannot contain null bytes.\",\n\t\t\t);\n\t\t}\n\t\tthrow error;\n\t}\n}\n\nexport function validateDotenvProfileDocument(document: string): {\n\tdocument: string;\n\tvariables: SecretVariableValue[];\n} {\n\ttry {\n\t\treturn parseDotenvDocument(document);\n\t} catch (error) {\n\t\tif (error instanceof SecretDotenvError) throw new SecretVaultError(\"invalid_dotenv\", error.message);\n\t\tthrow error;\n\t}\n}\n\nfunction validateTimestamp(value: unknown): string {\n\tif (typeof value !== \"string\" \|\| value.length > 64 \|\| Number.isNaN(Date.parse(value))) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault timestamps are invalid.\");\n\t}\n\treturn value;\n}\n\nfunction parsePayload(value: unknown): VaultPayload {\n\tif (!isRecord(value) \|\| value.marker !== VAULT_MARKER \|\| !Array.isArray(value.profiles)) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is invalid.\");\n\t}\n\tif (value.profiles.length > MAX_PROFILES) {\n\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profile count exceeds its bound.\");\n\t}\n\tconst profileNames = new Set<string>();\n\tconst profiles: SecretProfileRecord[] = value.profiles.map((candidate) => {\n\t\tif (!isRecord(candidate) \|\| typeof candidate.dotenv !== \"string\" \|\| !Array.isArray(candidate.bindings)) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profile data is invalid.\");\n\t\t}\n\t\tconst profile = validateProfileId(typeof candidate.profile === \"string\" ? candidate.profile : \"\");\n\t\tif (profileNames.has(profile))\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault profiles are duplicated.\");\n\t\tprofileNames.add(profile);\n\t\tlet dotenv: string;\n\t\ttry {\n\t\t\tdotenv = validateDotenvProfileDocument(candidate.dotenv).document;\n\t\t} catch {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault dotenv data is invalid.\");\n\t\t}\n\t\tif (candidate.bindings.length > MAX_BINDINGS_PER_PROFILE) {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault binding count exceeds its bound.\");\n\t\t}\n\t\tconst bindingIds = new Set<string>();\n\t\tconst bindings = candidate.bindings.map((binding) => {\n\t\t\tconst parsed = parseBinding(binding);\n\t\t\tconst id = `${parsed.workspace}\\0${parsed.envFile}`;\n\t\t\tif (bindingIds.has(id)) throw new SecretVaultError(\"vault_corrupt\", \"Secret vault bindings are duplicated.\");\n\t\t\tbindingIds.add(id);\n\t\t\treturn parsed;\n\t\t});\n\t\treturn {\n\t\t\tprofile,\n\t\t\t...(candidate.description !== undefined\n\t\t\t\t? {\n\t\t\t\t\t\tdescription: validateDescription(\n\t\t\t\t\t\t\ttypeof candidate.description === \"string\" ? candidate.description : \"\",\n\t\t\t\t\t\t),\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t\tcreatedAt: validateTimestamp(candidate.createdAt),\n\t\t\tupdatedAt: validateTimestamp(candidate.updatedAt),\n\t\t\tdotenv,\n\t\t\tbindings: bindings.sort(\n\t\t\t\t(left, right) => left.workspace.localeCompare(right.workspace) \|\| left.envFile.localeCompare(right.envFile),\n\t\t\t),\n\t\t};\n\t});\n\treturn { marker: VAULT_MARKER, profiles: profiles.sort((left, right) => left.profile.localeCompare(right.profile)) };\n}\n\nexport function scrubPayload(payload: VaultPayload): void {\n\tfor (const profile of payload.profiles) profile.dotenv = \"\";\n}\n\nexport function assertPassphrase(passphrase: string, creating: boolean): void {\n\tif (\n\t\tpassphrase.length > MAX_PASSPHRASE_CHARS \|\|\n\t\tpassphrase.includes(\"\\0\") \|\|\n\t\t(creating ? passphrase.length < MIN_NEW_PASSPHRASE_CHARS : passphrase.length === 0)\n\t) {\n\t\tthrow new SecretVaultError(\n\t\t\t\"invalid_passphrase\",\n\t\t\tcreating\n\t\t\t\t? `The vault passphrase must contain ${MIN_NEW_PASSPHRASE_CHARS}-${MAX_PASSPHRASE_CHARS} characters.`\n\t\t\t\t: \"The vault passphrase is invalid.\",\n\t\t);\n\t}\n}\n\nexport function sameKdf(left: VaultKdf, right: VaultKdf): boolean {\n\treturn (\n\t\tleft.algorithm === right.algorithm &&\n\t\tleft.salt === right.salt &&\n\t\tleft.N === right.N &&\n\t\tleft.r === right.r &&\n\t\tleft.p === right.p &&\n\t\tleft.keyLength === right.keyLength\n\t);\n}\n\nexport async function deriveKey(passphrase: string, kdf: VaultKdf): Promise<Buffer> {\n\tconst salt = Buffer.from(kdf.salt, \"base64\");\n\tconst maxmem = Math.max(64 1024 * 1024, 128 * kdf.N * kdf.r + 16 * 1024 * 1024);\n\ttry {\n\t\treturn await new Promise<Buffer>((resolveKey, reject) => {\n\t\t\tscrypt(passphrase, salt, kdf.keyLength, { N: kdf.N, r: kdf.r, p: kdf.p, maxmem }, (error, key) => {\n\t\t\t\tif (error) reject(error);\n\t\t\t\telse resolveKey(key);\n\t\t\t});\n\t\t});\n\t} finally {\n\t\tsalt.fill(0);\n\t}\n}\n\nfunction encryptPayload(payload: VaultPayload, key: Buffer): VaultCiphertext {\n\tlet serialized = JSON.stringify(payload);\n\tif (Buffer.byteLength(serialized, \"utf8\") > MAX_VAULT_PAYLOAD_BYTES) {\n\t\tserialized = \"\";\n\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault payload exceeds its 2 MiB limit.\");\n\t}\n\tconst plaintext = Buffer.from(serialized, \"utf8\");\n\tserialized = \"\";\n\tconst iv = randomBytes(IV_LENGTH);\n\ttry {\n\t\tconst cipher = createCipheriv(AES_ALGORITHM, key, iv);\n\t\tcipher.setAAD(VAULT_AAD);\n\t\tconst ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);\n\t\tconst tag = cipher.getAuthTag();\n\t\ttry {\n\t\t\treturn {\n\t\t\t\tiv: iv.toString(\"base64\"),\n\t\t\t\ttag: tag.toString(\"base64\"),\n\t\t\t\tciphertext: ciphertext.toString(\"base64\"),\n\t\t\t};\n\t\t} finally {\n\t\t\ttag.fill(0);\n\t\t\tciphertext.fill(0);\n\t\t}\n\t} finally {\n\t\tplaintext.fill(0);\n\t\tiv.fill(0);\n\t}\n}\n\nexport function decryptPayload(ciphertext: VaultCiphertext, key: Buffer): VaultPayload {\n\tconst iv = Buffer.from(ciphertext.iv, \"base64\");\n\tconst tag = Buffer.from(ciphertext.tag, \"base64\");\n\tconst encrypted = Buffer.from(ciphertext.ciphertext, \"base64\");\n\tlet plaintext: Buffer \| undefined;\n\ttry {\n\t\tconst decipher = createDecipheriv(AES_ALGORITHM, key, iv);\n\t\tdecipher.setAAD(VAULT_AAD);\n\t\tdecipher.setAuthTag(tag);\n\t\tplaintext = Buffer.concat([decipher.update(encrypted), decipher.final()]);\n\t\tif (plaintext.byteLength > MAX_VAULT_PAYLOAD_BYTES) {\n\t\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault payload exceeds its 2 MiB limit.\");\n\t\t}\n\t\tlet parsed: unknown;\n\t\ttry {\n\t\t\tparsed = JSON.parse(plaintext.toString(\"utf8\"));\n\t\t} catch {\n\t\t\tthrow new SecretVaultError(\"vault_corrupt\", \"Secret vault payload is invalid.\");\n\t\t}\n\t\treturn parsePayload(parsed);\n\t} catch (error) {\n\t\tif (error instanceof SecretVaultError) throw error;\n\t\tthrow new SecretVaultError(\"unlock_failed\", \"The vault passphrase is incorrect or the vault is damaged.\");\n\t} finally {\n\t\tiv.fill(0);\n\t\ttag.fill(0);\n\t\tencrypted.fill(0);\n\t\tplaintext?.fill(0);\n\t}\n}\n\nexport function serializeEnvelope(kdf: VaultKdf, payload: VaultPayload, key: Buffer): string {\n\tconst envelope: VaultEnvelope = { version: VAULT_VERSION, kdf, payload: encryptPayload(payload, key) };\n\tconst serialized = `${JSON.stringify(envelope, null, 2)}\\n`;\n\tif (Buffer.byteLength(serialized, \"utf8\") > MAX_VAULT_FILE_BYTES) {\n\t\tthrow new SecretVaultError(\"vault_too_large\", \"Secret vault file exceeds its 4 MiB limit.\");\n\t}\n\treturn serialized;\n}\n\nexport function profileSummary(profile: SecretProfileRecord): SecretProfileSummary {\n\tconst parsed = validateDotenvProfileDocument(profile.dotenv);\n\treturn {\n\t\tprofile: profile.profile,\n\t\t...(profile.description ? { description: profile.description } : {}),\n\t\tvariableNames: parsed.variables.map((variable) => variable.name),\n\t\tbindings: profile.bindings.map((binding) => ({ ...binding })),\n\t\tcreatedAt: profile.createdAt,\n\t\tupdatedAt: profile.updatedAt,\n\t};\n}\n\nexport function serializeVariableValues(values: readonly SecretVariableValue[]): string {\n\treturn formatDotenvVariables(values);\n}\n"]}

package/dist/core/secrets/secret-vault.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"secret-vault.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/secret-vault.ts"],"names":[],"mappings":"AAOA,OAAO,EAaN,KAAK,uBAAuB,EAE5B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EAExB,KAAK,kBAAkB,EAgBvB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACX,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,iCAAiC,EACjC,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,EAC5B,gBAAgB,GAChB,MAAM,0BAA0B,CAAC;AAqHlC;;;;GAIG;AACH,qBAAa,WAAW;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA2B;IAChE,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAA6B;IAEvE,YAAY,OAAO,EAAE,kBAAkB,EAOtC;IAED,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAEhD;IAED,IAAI,UAAU,IAAI,OAAO,CAExB;IAEK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAM/B;IAED,IAAI,IAAI,IAAI,CAOX;IAED,6EAA6E;IAC7E,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAInD;IAED,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzC;IAED,uGAAuG;IACvG,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBxC;IAEK,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBlD;IAEK,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB9C;IAEK,YAAY,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAEpD;IAEK,aAAa,CAClB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,MAAM,EAAE,SAAS,mBAAmB,EAAE,GACpC,OAAO,CAAC,oBAAoB,CAAC,CAoB/B;IAEK,sBAAsB,CAC3B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC,oBAAoB,CAAC,CAE/B;IAEK,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAMrE;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1D;IAEK,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsDpG;IAED,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzC;IAED,oBAAoB,CACnB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACb;QACF,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACpB,CAQA;IAEK,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA2ChG;IAEK,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAepG;IAEK,cAAc,CACnB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QACR,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,OAAO,CAAC,EAAE,OAAO,CAAC;KACb,GACJ,OAAO,CAAC,2BAA2B,CAAC,CAmDtC;YAEa,oBAAoB;YA6EpB,4BAA4B;YA0B5B,4BAA4B;IAgB1C,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,wBAAwB;IAQhC,OAAO,CAAC,4BAA4B;IAgBpC,OAAO,CAAC,kBAAkB;IAoB1B,OAAO,CAAC,oBAAoB;IAe5B,OAAO,CAAC,eAAe;YAOT,WAAW;YAyBX,aAAa;YAUb,2BAA2B;YAiB3B,4BAA4B;CAe1C","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { constants, promises as fs, type Stats } from \"node:fs\";\nimport { dirname, isAbsolute, join, relative, resolve, sep } from \"node:path\";\nimport { managedSecretEnvDir, secretsDir, secretVaultFile } from \"../agent-paths.ts\";\nimport { redactKnownSecrets } from \"../security/secret-text.ts\";\nimport { withFileLock, writeFileAtomic } from \"../util/atomic-file.ts\";\nimport { MAX_DOTENV_DOCUMENT_BYTES, parseDotenvDocument } from \"./secret-dotenv.ts\";\nimport {\n\tassertPassphrase,\n\tcreateVaultKdf,\n\tDEFAULT_SCRYPT_N,\n\tdecryptPayload,\n\tderiveKey,\n\tMANAGED_ENV_HEADER_PREFIX,\n\tMAX_BINDINGS_PER_PROFILE,\n\tMAX_PROFILES,\n\tMAX_VARIABLES_PER_PROFILE,\n\tMAX_VAULT_FILE_BYTES,\n\tparseEnvelope,\n\tprofileSummary,\n\ttype SecretBindingResolution,\n\ttype SecretBindingSummary,\n\ttype SecretEnvDestinationState,\n\ttype SecretMaterializationResult,\n\ttype SecretProfileSummary,\n\ttype SecretRemovalResult,\n\ttype SecretVariableValue,\n\tSecretVaultError,\n\ttype SecretVaultOptions,\n\tsameKdf,\n\tscrubPayload,\n\tserializeEnvelope,\n\tserializeVariableValues,\n\tVAULT_MARKER,\n\ttype VaultKdf,\n\ttype VaultPayload,\n\tvalidateBindingEnvFile,\n\tvalidateBindingWorkspace,\n\tvalidateDescription,\n\tvalidateDotenvProfileDocument,\n\tvalidateProfileId,\n\tvalidateScryptN,\n\tvalidateSecretValue,\n\tvalidateVariableName,\n} from \"./secret-vault-format.ts\";\n\nexport type {\n\tSecretBindingResolution,\n\tSecretBindingSummary,\n\tSecretEnvDestinationState,\n\tSecretMaterializationResult,\n\tSecretProfileSummary,\n\tSecretRemovalResult,\n\tSecretVariableValue,\n\tSecretVaultErrorCode,\n\tSecretVaultOptions,\n} from \"./secret-vault-format.ts\";\nexport {\n\tMAX_BINDINGS_PER_PROFILE,\n\tMAX_VARIABLES_PER_PROFILE,\n\tSECRET_DESCRIPTION_MAX_CHARS,\n\tSECRET_PRINTABLE_METADATA_PATTERN,\n\tSECRET_PROFILE_ID_MAX_CHARS,\n\tSECRET_PROFILE_ID_PATTERN,\n\tSECRET_VARIABLE_NAME_MAX_CHARS,\n\tSECRET_VARIABLE_NAME_PATTERN,\n\tSecretVaultError,\n} from \"./secret-vault-format.ts\";\n\nfunction nodeErrorCode(error: unknown): string \| undefined {\n\treturn typeof error === \"object\" && error !== null && \"code\" in error && typeof error.code === \"string\"\n\t\t? error.code\n\t\t: undefined;\n}\n\nasync function lstatIfExists(path: string): Promise<Stats \| undefined> {\n\ttry {\n\t\treturn await fs.lstat(path);\n\t} catch (error) {\n\t\tif (nodeErrorCode(error) === \"ENOENT\") return undefined;\n\t\tthrow error;\n\t}\n}\n\nasync function readBoundedRegularFile(\n\tfilePath: string,\n\tmaxBytes: number,\n\tlabel: \"Secret vault\" \| \"Dotenv file\",\n): Promise<string> {\n\tconst before = await fs.lstat(filePath);\n\tif (before.isSymbolicLink()) throw new SecretVaultError(\"symlink_refused\", `${label} symlinks are refused.`);\n\tif (!before.isFile()) {\n\t\tthrow new SecretVaultError(\n\t\t\tlabel === \"Secret vault\" ? \"vault_corrupt\" : \"destination_invalid\",\n\t\t\t`${label} path is not a regular file.`,\n\t\t);\n\t}\n\tif (before.size > maxBytes) {\n\t\tthrow new SecretVaultError(\n\t\t\tlabel === \"Secret vault\" ? \"vault_too_large\" : \"invalid_dotenv\",\n\t\t\t`${label} exceeds its ${label === \"Secret vault\" ? \"4 MiB\" : \"512 KiB\"} limit.`,\n\t\t);\n\t}\n\tconst handle = await fs.open(filePath, constants.O_RDONLY);\n\ttry {\n\t\tconst opened = await handle.stat();\n\t\tif ((before.dev !== opened.dev \|\| before.ino !== opened.ino) && before.ino !== 0 && opened.ino !== 0) {\n\t\t\tthrow new SecretVaultError(\"symlink_refused\", \"Secret vault changed while it was being opened.\");\n\t\t}\n\t\tconst output = Buffer.alloc(Math.min(maxBytes + 1, before.size + 1));\n\t\tlet offset = 0;\n\t\twhile (offset < output.byteLength) {\n\t\t\tconst { bytesRead } = await handle.read(output, offset, output.byteLength - offset, null);\n\t\t\tif (bytesRead === 0) break;\n\t\t\toffset += bytesRead;\n\t\t}\n\t\tif (offset > before.size \|\| offset > maxBytes) {\n\t\t\toutput.fill(0);\n\t\t\tthrow new SecretVaultError(\n\t\t\t\tlabel === \"Secret vault\" ? \"vault_too_large\" : \"invalid_dotenv\",\n\t\t\t\t`${label} grew beyond its limit while being read.`,\n\t\t\t);\n\t\t}\n\t\tconst text = output.toString(\"utf8\", 0, offset);\n\t\toutput.fill(0);\n\t\treturn text;\n\t} finally {\n\t\tawait handle.close();\n\t}\n}\n\nasync function readBoundedFile(filePath: string): Promise<string> {\n\treturn readBoundedRegularFile(filePath, MAX_VAULT_FILE_BYTES, \"Secret vault\");\n}\n\nasync function readFilePrefix(filePath: string, maxBytes: number): Promise<string> {\n\tconst handle = await fs.open(filePath, constants.O_RDONLY);\n\ttry {\n\t\tconst output = Buffer.alloc(maxBytes);\n\t\tconst { bytesRead } = await handle.read(output, 0, output.byteLength, 0);\n\t\tconst text = output.toString(\"utf8\", 0, bytesRead);\n\t\toutput.fill(0);\n\t\treturn text;\n\t} finally {\n\t\tawait handle.close();\n\t}\n}\n\nasync function ensurePrivateDirectory(path: string): Promise<void> {\n\tconst existing = await lstatIfExists(path);\n\tif (existing?.isSymbolicLink()) {\n\t\tthrow new SecretVaultError(\"symlink_refused\", \"Secret storage directory symlinks are refused.\");\n\t}\n\tif (existing && !existing.isDirectory()) {\n\t\tthrow new SecretVaultError(\"destination_invalid\", \"Secret storage path is not a directory.\");\n\t}\n\tawait fs.mkdir(path, { recursive: true, mode: 0o700 });\n\tif (process.platform !== \"win32\") await fs.chmod(path, 0o700);\n}\n\nasync function enforcePrivateFileMode(path: string): Promise<void> {\n\tif (process.platform !== \"win32\") await fs.chmod(path, 0o600);\n}\n\ninterface CachedSecretVariable {\n\tname: string;\n\tvalue: string;\n}\n\ninterface CachedSecretProfile {\n\tprofile: string;\n\tbindings: SecretBindingSummary[];\n\tvariables: CachedSecretVariable[];\n}\n\nfunction isPathInside(root: string, target: string): boolean {\n\tconst fromRoot = relative(root, target);\n\treturn fromRoot === \"\" \|\| (!fromRoot.startsWith(`..${sep}`) && fromRoot !== \"..\" && !isAbsolute(fromRoot));\n}\n\nfunction escapeRegExp(value: string): string {\n\treturn value.replace(/[.+?^${}()\|[\\]\\\\]/g, \"\\\\$&\");\n}\n\n/\n Encrypted generic credential vault. Only the derived key is retained in memory, until this\n * process explicitly locks the vault or exits. The native model-facing tool receives summaries,\n * never decrypted values or materialization paths.\n /\nexport class SecretVault {\n\treadonly vaultPath: string;\n\treadonly materializedDir: string;\n\tprivate readonly rootDir: string;\n\tprivate readonly scryptN: number;\n\tprivate readonly now: () => Date;\n\tprivate readonly onEnvironmentChanged: (() => void) \| undefined;\n\tprivate cachedKey: Buffer \| undefined;\n\tprivate cachedKdf: VaultKdf \| undefined;\n\tprivate cachedProfiles: CachedSecretProfile[] = [];\n\tprivate readonly activeProfilesByWorkspace = new Map<string, string>();\n\n\tconstructor(options: SecretVaultOptions) {\n\t\tthis.rootDir = secretsDir(options.agentDir);\n\t\tthis.vaultPath = secretVaultFile(options.agentDir);\n\t\tthis.materializedDir = managedSecretEnvDir(options.agentDir);\n\t\tthis.scryptN = validateScryptN(options.scryptN ?? DEFAULT_SCRYPT_N);\n\t\tthis.now = options.now ?? (() => new Date());\n\t\tthis.onEnvironmentChanged = options.onEnvironmentChanged;\n\t}\n\n\tstatic forAgentDir(agentDir: string): SecretVault {\n\t\treturn new SecretVault({ agentDir });\n\t}\n\n\tget isUnlocked(): boolean {\n\t\treturn this.cachedKey !== undefined;\n\t}\n\n\tasync exists(): Promise<boolean> {\n\t\tconst existing = await lstatIfExists(this.vaultPath);\n\t\tif (existing?.isSymbolicLink()) {\n\t\t\tthrow new SecretVaultError(\"symlink_refused\", \"Secret vault symlinks are refused.\");\n\t\t}\n\t\treturn existing !== undefined;\n\t}\n\n\tlock(): void {\n\t\tthis.cachedKey?.fill(0);\n\t\tthis.cachedKey = undefined;\n\t\tthis.cachedKdf = undefined;\n\t\tthis.clearSecretCache();\n\t\tthis.activeProfilesByWorkspace.clear();\n\t\tthis.notifyEnvironmentChanged();\n\t}\n\n\t/* Environment for the nearest explicitly activated profile covering cwd. /\n\tgetEnvironmentForCwd(cwd: string): NodeJS.ProcessEnv {\n\t\tconst match = this.resolveCachedProfile(cwd);\n\t\tif (!match) return {};\n\t\treturn Object.fromEntries(match.profile.variables.map((variable) => [variable.name, variable.value]));\n\t}\n\n\thasEnvironmentForCwd(cwd: string): boolean {\n\t\treturn this.resolveCachedProfile(cwd) !== undefined;\n\t}\n\n\t/* Remove exact unlocked vault values and high-confidence credential shapes from model-facing text. */\n\tredactSensitiveText(text: string): string {\n\t\tlet redacted = redactKnownSecrets(text);\n\t\tconst values = [\n\t\t\t...new Set(\n\t\t\t\tthis.cachedProfiles\n\t\t\t\t\t.flatMap((profile) => profile.variables.map((variable) => variable.value))\n\t\t\t\t\t.filter(Boolean),\n\t\t\t),\n\t\t].sort((left, right) => right.length - left.length);\n\t\tfor (const value of values) {\n\t\t\tif (value.length >= 4) {\n\t\t\t\tredacted = redacted.split(value).join(\"[REDACTED]\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst bounded = new RegExp(`(^\|[\\\\s=:;,])${escapeRegExp(value)}(?=$\|[\\\\s,;])`, \"g\");\n\t\t\tredacted = redacted.replace(bounded, (_match, prefix: string) => `${prefix}[REDACTED]`);\n\t\t}\n\t\treturn redacted;\n\t}\n\n\tasync initialize(passphrase: string): Promise<void> {\n\t\tassertPassphrase(passphrase, true);\n\t\tawait ensurePrivateDirectory(this.rootDir);\n\t\tawait withFileLock(this.vaultPath, async () => {\n\t\t\tif (await lstatIfExists(this.vaultPath)) {\n\t\t\t\tthrow new SecretVaultError(\"already_initialized\", \"Secret vault is already initialized.\");\n\t\t\t}\n\t\t\tconst kdf = createVaultKdf(this.scryptN);\n\t\t\tconst key = await deriveKey(passphrase, kdf);\n\t\t\tconst payload: VaultPayload = { marker: VAULT_MARKER, profiles: [] };\n\t\t\ttry {\n\t\t\t\tawait this.writeEnvelope(kdf, payload, key);\n\t\t\t\tthis.replaceCachedKey(key, kdf);\n\t\t\t} catch (error) {\n\t\t\t\tkey.fill(0);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t});\n\t}\n\n\tasync unlock(passphrase: string): Promise<void> {\n\t\tassertPassphrase(passphrase, false);\n\t\tif (!(await this.exists())) throw new SecretVaultError(\"not_initialized\", \"Secret vault is not initialized.\");\n\t\tconst envelope = parseEnvelope(await readBoundedFile(this.vaultPath));\n\t\tconst key = await deriveKey(passphrase, envelope.kdf);\n\t\tlet payload: VaultPayload \| undefined;\n\t\ttry {\n\t\t\tconst environmentBefore = this.activeEnvironmentFingerprint();\n\t\t\tpayload = decryptPayload(envelope.payload, key);\n\t\t\tthis.replaceCachedKey(key, envelope.kdf);\n\t\t\tthis.refreshSecretCache(payload);\n\t\t\tif (environmentBefore !== this.activeEnvironmentFingerprint()) this.notifyEnvironmentChanged();\n\t\t} catch (error) {\n\t\t\tkey.fill(0);\n\t\t\tthrow error;\n\t\t} finally {\n\t\t\tif (payload) scrubPayload(payload);\n\t\t}\n\t}\n\n\tasync listProfiles(): Promise<SecretProfileSummary[]> {\n\t\treturn this.withPayload((payload) => payload.profiles.map(profileSummary), false);\n\t}\n\n\tasync upsertProfile(\n\t\tprofile: string,\n\t\tdescription: string \| undefined,\n\t\tvalues: readonly SecretVariableValue[],\n\t): Promise<SecretProfileSummary> {\n\t\tif (values.length === 0) {\n\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"At least one environment variable is required.\");\n\t\t}\n\t\tconst seenNames = new Set<string>();\n\t\tconst normalizedValues = values.map((entry) => {\n\t\t\tconst name = validateVariableName(entry.name);\n\t\t\tif (seenNames.has(name)) {\n\t\t\t\tthrow new SecretVaultError(\"invalid_variable\", `Environment variable ${name} is duplicated.`);\n\t\t\t}\n\t\t\tseenNames.add(name);\n\t\t\treturn { name, value: validateSecretValue(entry.value) };\n\t\t});\n\t\treturn this.storeProfileDocument(\n\t\t\tprofile,\n\t\t\tdescription,\n\t\t\tserializeVariableValues(normalizedValues),\n\t\t\tundefined,\n\t\t\ttrue,\n\t\t);\n\t}\n\n\tasync replaceProfileDocument(\n\t\tprofile: string,\n\t\tdescription: string \| undefined,\n\t\tdocument: string,\n\t\tbinding?: { workspace: string; envFile: string },\n\t): Promise<SecretProfileSummary> {\n\t\treturn this.storeProfileDocument(profile, description, document, binding, false);\n\t}\n\n\tasync getProfileDocument(profile: string): Promise<string \| undefined> {\n\t\tconst normalizedProfile = validateProfileId(profile);\n\t\treturn this.withPayload(\n\t\t\t(payload) => payload.profiles.find((candidate) => candidate.profile === normalizedProfile)?.dotenv,\n\t\t\tfalse,\n\t\t);\n\t}\n\n\tasync readOwnerDotenv(destination: string): Promise<string> {\n\t\tthis.assertDestination(destination);\n\t\treturn readBoundedRegularFile(destination, MAX_DOTENV_DOCUMENT_BYTES, \"Dotenv file\");\n\t}\n\n\tasync removeProfile(profile: string, variableNames?: readonly string[]): Promise<SecretRemovalResult> {\n\t\tconst normalizedProfile = validateProfileId(profile);\n\t\tconst normalizedNames = variableNames?.map(validateVariableName);\n\t\tif (normalizedNames && new Set(normalizedNames).size !== normalizedNames.length) {\n\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"Environment variable removals are duplicated.\");\n\t\t}\n\t\tlet managedMaterializationRemoved = false;\n\t\tlet boundMaterializationsRemoved = 0;\n\t\tconst result = await this.withPayload(async (payload) => {\n\t\t\tconst index = payload.profiles.findIndex((candidate) => candidate.profile === normalizedProfile);\n\t\t\tconst record = payload.profiles[index];\n\t\t\tif (!record) throw new SecretVaultError(\"profile_missing\", \"Secret profile does not exist.\");\n\t\t\tconst variables = validateDotenvProfileDocument(record.dotenv).variables;\n\t\t\tlet removedProfile: boolean;\n\t\t\tlet removedVariableNames: string[];\n\t\t\tlet remaining: SecretVariableValue[] = [];\n\t\t\tif (normalizedNames === undefined) {\n\t\t\t\tremovedProfile = true;\n\t\t\t\tremovedVariableNames = variables.map((variable) => variable.name);\n\t\t\t} else {\n\t\t\t\tif (normalizedNames.length === 0) {\n\t\t\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"Select at least one environment variable to remove.\");\n\t\t\t\t}\n\t\t\t\tconst requested = new Set(normalizedNames);\n\t\t\t\tremovedVariableNames = variables\n\t\t\t\t\t.filter((variable) => requested.has(variable.name))\n\t\t\t\t\t.map((variable) => variable.name);\n\t\t\t\tif (removedVariableNames.length !== requested.size) {\n\t\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\t\"invalid_variable\",\n\t\t\t\t\t\t\"One or more requested environment variables do not exist.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tremaining = variables.filter((variable) => !requested.has(variable.name));\n\t\t\t\tremovedProfile = remaining.length === 0;\n\t\t\t}\n\n\t\t\t// Validate the complete mutation before removing any recoverable materialization.\n\t\t\tmanagedMaterializationRemoved = await this.removeManagedMaterialization(normalizedProfile);\n\t\t\tboundMaterializationsRemoved = await this.removeBoundMaterializations(record);\n\t\t\tif (removedProfile) payload.profiles.splice(index, 1);\n\t\t\telse {\n\t\t\t\trecord.dotenv = serializeVariableValues(remaining);\n\t\t\t\trecord.updatedAt = this.now().toISOString();\n\t\t\t}\n\t\t\treturn { removedProfile, removedVariableNames };\n\t\t}, true);\n\t\tthis.deactivateProfile(normalizedProfile);\n\t\treturn {\n\t\t\tprofile: normalizedProfile,\n\t\t\t...result,\n\t\t\tmanagedMaterializationRemoved,\n\t\t\tboundMaterializationsRemoved,\n\t\t};\n\t}\n\n\tgetManagedEnvPath(profile: string): string {\n\t\treturn join(this.materializedDir, `${validateProfileId(profile)}.env`);\n\t}\n\n\tresolveBindingTarget(\n\t\tworkspace: string,\n\t\tenvFile: string,\n\t): {\n\t\tworkspace: string;\n\t\tenvFile: string;\n\t\tdestination: string;\n\t} {\n\t\tconst normalizedWorkspace = validateBindingWorkspace(resolve(workspace));\n\t\tconst normalizedEnvFile = validateBindingEnvFile(envFile);\n\t\tconst destination = resolve(normalizedWorkspace, normalizedEnvFile);\n\t\tif (!isPathInside(normalizedWorkspace, destination)) {\n\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Credential target must stay inside its workspace.\");\n\t\t}\n\t\treturn { workspace: normalizedWorkspace, envFile: normalizedEnvFile, destination };\n\t}\n\n\tasync resolveBindingForWorkspace(cwd: string, profile?: string): Promise<SecretBindingResolution> {\n\t\tconst normalizedCwd = resolve(cwd);\n\t\tconst normalizedProfile = profile === undefined ? undefined : validateProfileId(profile);\n\t\treturn this.withPayload((payload) => {\n\t\t\tconst matches = payload.profiles.flatMap((candidate) => {\n\t\t\t\tif (normalizedProfile !== undefined && candidate.profile !== normalizedProfile) return [];\n\t\t\t\tconst binding = candidate.bindings\n\t\t\t\t\t.filter((entry) => isPathInside(entry.workspace, normalizedCwd))\n\t\t\t\t\t.sort((left, right) => right.workspace.length - left.workspace.length)[0];\n\t\t\t\tif (!binding) return [];\n\t\t\t\treturn [{ candidate, binding }];\n\t\t\t});\n\t\t\tif (matches.length === 0) {\n\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\"binding_missing\",\n\t\t\t\t\tnormalizedProfile\n\t\t\t\t\t\t? `Secret profile ${normalizedProfile} is not bound to this workspace.`\n\t\t\t\t\t\t: \"No secret profile is bound to this workspace.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst longestRoot = Math.max(...matches.map((match) => match.binding.workspace.length));\n\t\t\tconst nearest = matches.filter((match) => match.binding.workspace.length === longestRoot);\n\t\t\tlet selected = nearest[0];\n\t\t\tif (nearest.length > 1) {\n\t\t\t\tconst active = nearest.find(\n\t\t\t\t\t(match) => this.activeProfilesByWorkspace.get(match.binding.workspace) === match.candidate.profile,\n\t\t\t\t);\n\t\t\t\tif (!active) {\n\t\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\t\"ambiguous_binding\",\n\t\t\t\t\t\t\"Multiple secret profiles apply to this workspace; select one by profile name.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tselected = active;\n\t\t\t}\n\t\t\tconst parsed = validateDotenvProfileDocument(selected.candidate.dotenv);\n\t\t\treturn {\n\t\t\t\tprofile: selected.candidate.profile,\n\t\t\t\t...selected.binding,\n\t\t\t\tdestination: resolve(selected.binding.workspace, selected.binding.envFile),\n\t\t\t\tvariableNames: parsed.variables.map((variable) => variable.name),\n\t\t\t};\n\t\t}, false);\n\t}\n\n\tasync inspectEnvDestination(destination: string, profile: string): Promise<SecretEnvDestinationState> {\n\t\tvalidateProfileId(profile);\n\t\tthis.assertDestination(destination);\n\t\tconst existing = await lstatIfExists(destination);\n\t\tif (!existing) return \"missing\";\n\t\tif (existing.isSymbolicLink()) {\n\t\t\tthrow new SecretVaultError(\"symlink_refused\", \"Secret dotenv destination symlinks are refused.\");\n\t\t}\n\t\tif (!existing.isFile()) {\n\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Secret dotenv destination is not a regular file.\");\n\t\t}\n\t\tconst firstLine = (await readFilePrefix(destination, 512)).split(/\\r?\\n/, 1)[0] ?? \"\";\n\t\tif (firstLine === `${MANAGED_ENV_HEADER_PREFIX}${profile}`) return \"managed-profile\";\n\t\tif (firstLine.startsWith(MANAGED_ENV_HEADER_PREFIX)) return \"managed-other\";\n\t\treturn \"unmanaged\";\n\t}\n\n\tasync materializeEnv(\n\t\tprofile: string,\n\t\tdestination: string,\n\t\toptions: {\n\t\t\tactivationWorkspace?: string;\n\t\t\tallowReplaceUnmanaged?: boolean;\n\t\t\texpectedUnmanagedContent?: string;\n\t\t\tmanaged?: boolean;\n\t\t} = {},\n\t): Promise<SecretMaterializationResult> {\n\t\tconst normalizedProfile = validateProfileId(profile);\n\t\tthis.assertDestination(destination);\n\t\tconst previousState = await this.inspectEnvDestination(destination, normalizedProfile);\n\t\tawait this.assertReplaceableDestination(destination, previousState, options);\n\t\tif (options.managed) {\n\t\t\tif (resolve(destination) !== resolve(this.getManagedEnvPath(normalizedProfile))) {\n\t\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Managed dotenv destination is not canonical.\");\n\t\t\t}\n\t\t\tawait ensurePrivateDirectory(this.materializedDir);\n\t\t} else {\n\t\t\tconst parent = await lstatIfExists(dirname(destination));\n\t\t\tif (!parent?.isDirectory()) {\n\t\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Dotenv destination directory does not exist.\");\n\t\t\t}\n\t\t}\n\t\treturn this.withPayload(async (payload) => {\n\t\t\tconst record = payload.profiles.find((candidate) => candidate.profile === normalizedProfile);\n\t\t\tif (!record) throw new SecretVaultError(\"profile_missing\", \"Secret profile does not exist.\");\n\t\t\tconst binding = record.bindings.find(\n\t\t\t\t(candidate) => resolve(candidate.workspace, candidate.envFile) === resolve(destination),\n\t\t\t);\n\t\t\tconst activationCwd = options.activationWorkspace ? resolve(options.activationWorkspace) : undefined;\n\t\t\tconst activationBinding = activationCwd\n\t\t\t\t? record.bindings\n\t\t\t\t\t\t.filter((candidate) => isPathInside(candidate.workspace, activationCwd))\n\t\t\t\t\t\t.sort((left, right) => right.workspace.length - left.workspace.length)[0]\n\t\t\t\t: binding;\n\t\t\tif (activationCwd && !activationBinding) {\n\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\"binding_missing\",\n\t\t\t\t\t`Secret profile ${normalizedProfile} is not bound to this workspace.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (binding && !options.managed) await this.assertBoundDestinationParent(binding, destination);\n\t\t\tconst currentState = await this.inspectEnvDestination(destination, normalizedProfile);\n\t\t\tawait this.assertReplaceableDestination(destination, currentState, options);\n\t\t\tconst variableNames = validateDotenvProfileDocument(record.dotenv).variables.map((variable) => variable.name);\n\t\t\tconst body = record.dotenv.endsWith(\"\\n\") ? record.dotenv : `${record.dotenv}\\n`;\n\t\t\tlet dotenv = `${MANAGED_ENV_HEADER_PREFIX}${normalizedProfile}\\n# Generated by Pi. Do not edit, inspect, source as shell code, or commit.\\n${body}`;\n\t\t\ttry {\n\t\t\t\tawait writeFileAtomic(destination, dotenv, { mode: 0o600 });\n\t\t\t\tawait enforcePrivateFileMode(destination);\n\t\t\t\tif (activationBinding) {\n\t\t\t\t\tthis.activeProfilesByWorkspace.set(activationBinding.workspace, normalizedProfile);\n\t\t\t\t}\n\t\t\t} finally {\n\t\t\t\tdotenv = \"\";\n\t\t\t}\n\t\t\treturn { profile: normalizedProfile, variableNames, previousState: currentState };\n\t\t}, false);\n\t}\n\n\tprivate async storeProfileDocument(\n\t\tprofile: string,\n\t\tdescription: string \| undefined,\n\t\tdocument: string,\n\t\tbinding: { workspace: string; envFile: string } \| undefined,\n\t\tmerge: boolean,\n\t): Promise<SecretProfileSummary> {\n\t\tconst normalizedProfile = validateProfileId(profile);\n\t\tconst normalizedDescription = validateDescription(description);\n\t\tconst parsedDocument = validateDotenvProfileDocument(document);\n\t\tconst target = binding ? this.resolveBindingTarget(binding.workspace, binding.envFile) : undefined;\n\t\tconst normalizedBinding = target ? { workspace: target.workspace, envFile: target.envFile } : undefined;\n\n\t\tconst summary = await this.withPayload(async (payload) => {\n\t\t\tlet record = payload.profiles.find((candidate) => candidate.profile === normalizedProfile);\n\t\t\tconst timestamp = this.now().toISOString();\n\t\t\tif (!record && payload.profiles.length >= MAX_PROFILES) {\n\t\t\t\tthrow new SecretVaultError(\"profile_limit\", `Secret vault supports at most ${MAX_PROFILES} profiles.`);\n\t\t\t}\n\t\t\tconst nextBindings = record?.bindings.map((entry) => ({ ...entry })) ?? [];\n\t\t\tif (normalizedBinding) {\n\t\t\t\tconst next = { ...normalizedBinding, updatedAt: timestamp };\n\t\t\t\tconst existingIndex = nextBindings.findIndex((entry) => entry.workspace === normalizedBinding.workspace);\n\t\t\t\tif (existingIndex === -1) nextBindings.push(next);\n\t\t\t\telse nextBindings[existingIndex] = next;\n\t\t\t\tif (nextBindings.length > MAX_BINDINGS_PER_PROFILE) {\n\t\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\t\"profile_limit\",\n\t\t\t\t\t\t`A secret profile supports at most ${MAX_BINDINGS_PER_PROFILE} workspace bindings.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tlet nextDocument = parsedDocument.document;\n\t\t\tif (merge && record) {\n\t\t\t\tconst merged = new Map(\n\t\t\t\t\tvalidateDotenvProfileDocument(record.dotenv).variables.map((variable) => [\n\t\t\t\t\t\tvariable.name,\n\t\t\t\t\t\tvariable.value,\n\t\t\t\t\t]),\n\t\t\t\t);\n\t\t\t\tfor (const variable of parsedDocument.variables) merged.set(variable.name, variable.value);\n\t\t\t\tif (merged.size > MAX_VARIABLES_PER_PROFILE) {\n\t\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\t\"variable_limit\",\n\t\t\t\t\t\t`A secret profile supports at most ${MAX_VARIABLES_PER_PROFILE} variables.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tnextDocument = serializeVariableValues([...merged].map(([name, value]) => ({ name, value })));\n\t\t\t}\n\n\t\t\tif (record) {\n\t\t\t\tawait this.removeManagedMaterialization(normalizedProfile);\n\t\t\t\tawait this.removeBoundMaterializations(record);\n\t\t\t} else {\n\t\t\t\trecord = {\n\t\t\t\t\tprofile: normalizedProfile,\n\t\t\t\t\tcreatedAt: timestamp,\n\t\t\t\t\tupdatedAt: timestamp,\n\t\t\t\t\tdotenv: nextDocument,\n\t\t\t\t\tbindings: [],\n\t\t\t\t};\n\t\t\t\tpayload.profiles.push(record);\n\t\t\t}\n\t\t\tif (normalizedDescription !== undefined) record.description = normalizedDescription;\n\t\t\trecord.dotenv = nextDocument;\n\t\t\trecord.bindings = nextBindings.sort(\n\t\t\t\t(left, right) => left.workspace.localeCompare(right.workspace) \|\| left.envFile.localeCompare(right.envFile),\n\t\t\t);\n\t\t\trecord.updatedAt = timestamp;\n\t\t\tpayload.profiles.sort((left, right) => left.profile.localeCompare(right.profile));\n\t\t\treturn profileSummary(record);\n\t\t}, true);\n\t\tthis.deactivateProfile(normalizedProfile);\n\t\treturn summary;\n\t}\n\n\tprivate async assertReplaceableDestination(\n\t\tdestination: string,\n\t\tstate: SecretEnvDestinationState,\n\t\toptions: { allowReplaceUnmanaged?: boolean; expectedUnmanagedContent?: string },\n\t): Promise<void> {\n\t\tif (state === \"managed-other\") {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"Destination already contains a file managed for another secret profile.\",\n\t\t\t);\n\t\t}\n\t\tif (state !== \"unmanaged\") return;\n\t\tif (!options.allowReplaceUnmanaged \|\| options.expectedUnmanagedContent === undefined) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"Destination already contains an unmanaged file that was not reviewed for replacement.\",\n\t\t\t);\n\t\t}\n\t\tif ((await this.readOwnerDotenv(destination)) !== options.expectedUnmanagedContent) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The reviewed dotenv file changed before replacement and was preserved.\",\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate async assertBoundDestinationParent(binding: SecretBindingSummary, destination: string): Promise<void> {\n\t\ttry {\n\t\t\tconst [workspace, parent] = await Promise.all([\n\t\t\t\tfs.realpath(binding.workspace),\n\t\t\t\tfs.realpath(dirname(destination)),\n\t\t\t]);\n\t\t\tif (isPathInside(workspace, parent)) return;\n\t\t} catch {\n\t\t\t// Collapse filesystem detail so a model-facing failure cannot disclose unrelated paths.\n\t\t}\n\t\tthrow new SecretVaultError(\n\t\t\t\"destination_invalid\",\n\t\t\t\"Credential destination resolves outside its bound workspace or cannot be verified.\",\n\t\t);\n\t}\n\n\tprivate assertDestination(destination: string): void {\n\t\tif (!isAbsolute(destination) \|\| resolve(destination) === resolve(this.vaultPath)) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\t\"destination_invalid\",\n\t\t\t\t\"Secret dotenv destination must be an absolute non-vault path.\",\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate replaceCachedKey(key: Buffer, kdf: VaultKdf): void {\n\t\tthis.cachedKey?.fill(0);\n\t\tthis.cachedKey = key;\n\t\tthis.cachedKdf = { ...kdf };\n\t}\n\n\tprivate clearSecretCache(): void {\n\t\tfor (const profile of this.cachedProfiles) {\n\t\t\tfor (const variable of profile.variables) variable.value = \"\";\n\t\t}\n\t\tthis.cachedProfiles = [];\n\t}\n\n\tprivate deactivateProfile(profile: string): void {\n\t\tlet changed = false;\n\t\tfor (const [workspace, activeProfile] of this.activeProfilesByWorkspace) {\n\t\t\tif (activeProfile !== profile) continue;\n\t\t\tthis.activeProfilesByWorkspace.delete(workspace);\n\t\t\tchanged = true;\n\t\t}\n\t\tconst cached = this.cachedProfiles.find((candidate) => candidate.profile === profile);\n\t\tif (cached) {\n\t\t\tfor (const variable of cached.variables) variable.value = \"\";\n\t\t\tcached.variables = [];\n\t\t}\n\t\tif (changed) this.notifyEnvironmentChanged();\n\t}\n\n\tprivate notifyEnvironmentChanged(): void {\n\t\ttry {\n\t\t\tthis.onEnvironmentChanged?.();\n\t\t} catch {\n\t\t\t// Credential state changes remain authoritative even if host cleanup is best-effort.\n\t\t}\n\t}\n\n\tprivate activeEnvironmentFingerprint(): string {\n\t\tconst hash = createHash(\"sha256\");\n\t\tfor (const profile of this.cachedProfiles) {\n\t\t\tconst activeBindings = profile.bindings\n\t\t\t\t.filter((binding) => this.activeProfilesByWorkspace.get(binding.workspace) === profile.profile)\n\t\t\t\t.sort((left, right) => left.workspace.localeCompare(right.workspace));\n\t\t\tif (activeBindings.length === 0) continue;\n\t\t\thash.update(`${profile.profile.length}:${profile.profile}`);\n\t\t\tfor (const binding of activeBindings) hash.update(`${binding.workspace.length}:${binding.workspace}`);\n\t\t\tfor (const variable of profile.variables) {\n\t\t\t\thash.update(`${variable.name.length}:${variable.name}${variable.value.length}:${variable.value}`);\n\t\t\t}\n\t\t}\n\t\treturn hash.digest(\"hex\");\n\t}\n\n\tprivate refreshSecretCache(payload: VaultPayload): void {\n\t\tthis.clearSecretCache();\n\t\tthis.cachedProfiles = payload.profiles.map((profile) => ({\n\t\t\tprofile: profile.profile,\n\t\t\tbindings: profile.bindings.map((binding) => ({ ...binding })),\n\t\t\tvariables: profile.bindings.some(\n\t\t\t\t(binding) => this.activeProfilesByWorkspace.get(binding.workspace) === profile.profile,\n\t\t\t)\n\t\t\t\t? parseDotenvDocument(profile.dotenv).variables.map((variable) => ({ ...variable }))\n\t\t\t\t: [],\n\t\t}));\n\t\tfor (const [workspace, profile] of this.activeProfilesByWorkspace) {\n\t\t\tconst stillBound = this.cachedProfiles.some(\n\t\t\t\t(candidate) =>\n\t\t\t\t\tcandidate.profile === profile && candidate.bindings.some((binding) => binding.workspace === workspace),\n\t\t\t);\n\t\t\tif (!stillBound) this.activeProfilesByWorkspace.delete(workspace);\n\t\t}\n\t}\n\n\tprivate resolveCachedProfile(\n\t\tcwd: string,\n\t): { profile: CachedSecretProfile; binding: SecretBindingSummary } \| undefined {\n\t\tconst resolvedCwd = resolve(cwd);\n\t\treturn this.cachedProfiles\n\t\t\t.flatMap((profile) => {\n\t\t\t\tconst binding = profile.bindings\n\t\t\t\t\t.filter((candidate) => isPathInside(candidate.workspace, resolvedCwd))\n\t\t\t\t\t.sort((left, right) => right.workspace.length - left.workspace.length)[0];\n\t\t\t\treturn binding ? [{ profile, binding }] : [];\n\t\t\t})\n\t\t\t.filter((match) => this.activeProfilesByWorkspace.get(match.binding.workspace) === match.profile.profile)\n\t\t\t.sort((left, right) => right.binding.workspace.length - left.binding.workspace.length)[0];\n\t}\n\n\tprivate requireUnlocked(): { key: Buffer; kdf: VaultKdf } {\n\t\tif (!this.cachedKey \|\| !this.cachedKdf) {\n\t\t\tthrow new SecretVaultError(\"not_unlocked\", \"Secret vault is locked.\");\n\t\t}\n\t\treturn { key: this.cachedKey, kdf: this.cachedKdf };\n\t}\n\n\tprivate async withPayload<T>(operation: (payload: VaultPayload) => T \| Promise<T>, write: boolean): Promise<T> {\n\t\treturn withFileLock(this.vaultPath, async () => {\n\t\t\tconst environmentBefore = this.activeEnvironmentFingerprint();\n\t\t\tconst { key, kdf } = this.requireUnlocked();\n\t\t\tif (!(await lstatIfExists(this.vaultPath))) {\n\t\t\t\tthrow new SecretVaultError(\"not_initialized\", \"Secret vault is not initialized.\");\n\t\t\t}\n\t\t\tconst envelope = parseEnvelope(await readBoundedFile(this.vaultPath));\n\t\t\tif (!sameKdf(kdf, envelope.kdf)) {\n\t\t\t\tthis.lock();\n\t\t\t\tthrow new SecretVaultError(\"unlock_failed\", \"Secret vault changed and must be unlocked again.\");\n\t\t\t}\n\t\t\tconst payload = decryptPayload(envelope.payload, key);\n\t\t\ttry {\n\t\t\t\tconst result = await operation(payload);\n\t\t\t\tif (write) await this.writeEnvelope(kdf, payload, key);\n\t\t\t\tthis.refreshSecretCache(payload);\n\t\t\t\tif (environmentBefore !== this.activeEnvironmentFingerprint()) this.notifyEnvironmentChanged();\n\t\t\t\treturn result;\n\t\t\t} finally {\n\t\t\t\tscrubPayload(payload);\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate async writeEnvelope(kdf: VaultKdf, payload: VaultPayload, key: Buffer): Promise<void> {\n\t\tlet serialized = serializeEnvelope(kdf, payload, key);\n\t\ttry {\n\t\t\tawait writeFileAtomic(this.vaultPath, serialized, { mode: 0o600 });\n\t\t\tawait enforcePrivateFileMode(this.vaultPath);\n\t\t} finally {\n\t\t\tserialized = \"\";\n\t\t}\n\t}\n\n\tprivate async removeBoundMaterializations(record: {\n\t\tprofile: string;\n\t\tbindings: SecretBindingSummary[];\n\t}): Promise<number> {\n\t\tlet removed = 0;\n\t\tfor (const binding of record.bindings) {\n\t\t\tconst destination = resolve(binding.workspace, binding.envFile);\n\t\t\tconst existing = await lstatIfExists(destination);\n\t\t\tif (!existing) continue;\n\t\t\tconst state = await this.inspectEnvDestination(destination, record.profile);\n\t\t\tif (state !== \"managed-profile\") continue;\n\t\t\tawait fs.unlink(destination);\n\t\t\tremoved++;\n\t\t}\n\t\treturn removed;\n\t}\n\n\tprivate async removeManagedMaterialization(profile: string): Promise<boolean> {\n\t\tconst path = this.getManagedEnvPath(profile);\n\t\tconst existing = await lstatIfExists(path);\n\t\tif (!existing) return false;\n\t\tif (existing.isSymbolicLink()) {\n\t\t\tthrow new SecretVaultError(\"symlink_refused\", \"Managed dotenv symlinks are refused.\");\n\t\t}\n\t\tif (!existing.isFile()) {\n\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Managed dotenv path is not a regular file.\");\n\t\t}\n\t\tconst state = await this.inspectEnvDestination(path, profile);\n\t\tif (state !== \"managed-profile\") return false;\n\t\tawait fs.unlink(path);\n\t\treturn true;\n\t}\n}\n"]}
1	+ {"version":3,"file":"secret-vault.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/secret-vault.ts"],"names":[],"mappings":"AAOA,OAAO,EAaN,KAAK,uBAAuB,EAE5B,KAAK,yBAAyB,EAC9B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EAExB,KAAK,kBAAkB,EAgBvB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACX,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,2BAA2B,EAC3B,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,iCAAiC,EACjC,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,EAC5B,gBAAgB,GAChB,MAAM,0BAA0B,CAAC;AAqHlC;;;;GAIG;AACH,qBAAa,WAAW;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;IACjC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA2B;IAChE,OAAO,CAAC,SAAS,CAAqB;IACtC,OAAO,CAAC,SAAS,CAAuB;IACxC,OAAO,CAAC,cAAc,CAA6B;IACnD,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAA6B;IAEvE,YAAY,OAAO,EAAE,kBAAkB,EAOtC;IAED,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,CAEhD;IAED,IAAI,UAAU,IAAI,OAAO,CAExB;IAEK,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,CAM/B;IAED,IAAI,IAAI,IAAI,CAOX;IAED,6EAA6E;IAC7E,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAInD;IAED,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzC;IAED,uGAAuG;IACvG,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBxC;IAEK,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBlD;IAEK,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB9C;IAEK,YAAY,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAEpD;IAEK,aAAa,CAClB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,MAAM,EAAE,SAAS,mBAAmB,EAAE,GACpC,OAAO,CAAC,oBAAoB,CAAC,CAoB/B;IAEK,sBAAsB,CAC3B,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC,oBAAoB,CAAC,CAE/B;IAEK,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAMrE;IAEK,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAG1D;IAEK,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAsDpG;IAED,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzC;IAED,oBAAoB,CACnB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,GACb;QACF,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACpB,CAQA;IAEK,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CA2ChG;IAEK,qBAAqB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAepG;IAEK,cAAc,CACnB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE;QACR,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;QAChC,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,OAAO,CAAC,EAAE,OAAO,CAAC;KACb,GACJ,OAAO,CAAC,2BAA2B,CAAC,CAmDtC;YAEa,oBAAoB;YA6EpB,4BAA4B;YA0B5B,4BAA4B;IAgB1C,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,gBAAgB;IAOxB,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,wBAAwB;IAQhC,OAAO,CAAC,4BAA4B;IAgBpC,OAAO,CAAC,kBAAkB;IAoB1B,OAAO,CAAC,oBAAoB;IAe5B,OAAO,CAAC,eAAe;YAOT,WAAW;YAyBX,aAAa;YAUb,2BAA2B;YAiB3B,4BAA4B;CAe1C"}