@caupulican/pi-adaptative 0.85.4 → 0.86.1

package/dist/core/secrets/credential-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-manager.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAE1G,MAAM,eAAe,GAAG,8BAA8B,CAAC;AACvD,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAC3D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAaxC,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAGhD,YAAY,IAAgC,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AASD,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAGhD,YAAY,IAAgC,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAgFD,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC5D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAC1E,MAAM,IAAI,sBAAsB,CAC/B,iBAAiB,EACjB,iGAAiG,CACjG,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,WAA+B;IAC5E,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,IACC,WAAW,CAAC,MAAM,KAAK,CAAC;QACxB,WAAW,CAAC,MAAM,GAAG,qBAAqB;QAC1C,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EACzB,CAAC;QACF,MAAM,IAAI,sBAAsB,CAC/B,qBAAqB,EACrB,oFAAoF,CACpF,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAmC;IACnE,IACC,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1B,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG;QAC3B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC9B,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,0CAA0C,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAA+B;IAC9E,6BAA6B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,6BAA6B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,sCAAsC,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC;YACJ,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1C,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,gDAAgD,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,sBAAsB,CAC/B,yBAAyB,EACzB,kDAAkD,CAClD,CAAC;QACH,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,IACC,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC/B,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,oBAAoB;QAChD,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM;QAC9D,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC/D,CAAC;QACF,MAAM,IAAI,sBAAsB,CAC/B,yBAAyB,EACzB,uDAAuD,CACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC7C,IACC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC9B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QACzB,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,qBAAqB,EAC5D,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,YAAY,KAAK,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,QAAQ,CAAC;IACjB,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA8B;IACvD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,iBAAiB;IAY7B,YAAY,OAAiC;QAR5B,uBAAkB,GAAG,IAAI,GAAG,EAAuC,CAAC;QACpE,oBAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAI7C,yBAAoB,GAAG,CAAC,CAAC;QACzB,cAAS,GAAG,KAAK,CAAC;QAGzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC7E,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACrD,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM;QACT,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;IAC3G,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,MAAoB;QACrD,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAClD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,IAAI,iBAAiB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,sBAAsB,GAAG,iBAAiB,CAAC;QAChD,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACJ,IAAI,kBAAkB,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACJ,MAAM,kBAAkB,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACR,sEAAsE;gBACvE,CAAC;YACF,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YACV,iBAAiB,GAAG,EAAE,CAAC;QACxB,CAAC;IACF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,MAAoB;QACrD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAClC,OAAO,EAAE,6BAA6B,CAAC,OAAO,CAAC,OAAO,CAAC;YACvD,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,6BAA6B,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACpE,qBAAqB,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;SACjE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,OAAgB,EAAE,MAAoB;QAC3E,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3F,IAAI,QAAoD,CAAC;QACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,6BAA6B,CAAC,OAAO,CAAC,CAAC;YACvC,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;YACpE,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;YAC1G,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,+DAA+D,CAC/D,CAAC;YACH,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,mGAAmG,CACnG,CAAC;YACH,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,sBAAsB,CAC/B,2BAA2B,EAC3B,0FAA0F,CAC1F,CAAC;YACH,CAAC;YACD,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,+BAA+B,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,+DAA+D,CAC/D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO;YACN,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChE,OAAO,EAAE,QAAQ,CAAC,KAAK;SACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CACpB,GAAW,EACX,KAAgE,EAChE,MAAoB;QAEpB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,6BAA6B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAC1E,MAAM,cAAc,GAAG,QAAQ;YAC9B,CAAC,CAAC,+BAA+B,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClF,CAAC,CAAC,SAAS,CAAC;QACb,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClH,MAAM,MAAM,GAA4B;YACvC,OAAO;YACP,GAAG,CAAC,CAAC,WAAW,IAAI,cAAc,EAAE,WAAW,CAAC;gBAC/C,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,IAAI,cAAc,EAAE,WAAW,EAAE;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACN,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/F,WAAW;SACX,CAAC;QACF,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO;YACN,MAAM,EAAE,QAAQ;YAChB,OAAO;YACP,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChE,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,GAAW,EAAE,OAAe,EAAE,MAAoB;QAC5E,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,MAAM,GAAG,+BAA+B,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtF,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,OAAO;YACN,MAAM,EAAE,OAAO;YACf,OAAO;YACP,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChE,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,MAAoB;QACxD,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QACzG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,wBAAwB,GAAG,KAAK,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAChC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrC,wBAAwB,GAAG,IAAI,CAAC;YACjC,CAAC;QACF,CAAC;QACD,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,wBAAwB;YAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,oBAAoB,CAAC,GAAW;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,IAAI,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;QACxF,OAAO,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IAEO,qBAAqB,CAAC,MAAc;QAC3C,IAAI,QAAiD,CAAC;QACtD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,SAAS;YACjD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM;gBAAE,QAAQ,GAAG,MAAM,CAAC;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,oBAAoB,CAAC,GAAW;QAC/B,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,IAAY;QAC/B,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,IAAI;QACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,oBAAoB;YAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,MAAoB;QACjD,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAC1D,IAAI,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACxC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,IAAI,sBAAsB,CAC/B,sBAAsB,EACtB,gFAAgF,CAChF,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,MAAM,iBAAiB,GAAG,CAAC,KAAK,IAAI,EAAE;YACrC,IAAI,CAAC;gBACJ,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAC/C,IAAI,UAAU,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;oBAC9C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBACpB,MAAM,IAAI,sBAAsB,CAC/B,sBAAsB,EACtB,uEAAuE,CACvE,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACvB,CAAC;oBAAS,CAAC;gBACV,IAAI,UAAU,KAAK,IAAI,CAAC,oBAAoB;oBAAE,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;gBACjF,UAAU,GAAG,EAAE,CAAC;YACjB,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC;YACJ,MAAM,iBAAiB,CAAC;QACzB,CAAC;gBAAS,CAAC;YACV,IAAI,IAAI,CAAC,iBAAiB,KAAK,iBAAiB;gBAAE,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACtF,CAAC;IACF,CAAC;IAEO,sBAAsB,CAAC,UAAkB;QAChD,IAAI,UAAU,KAAK,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QACvE,MAAM,IAAI,sBAAsB,CAC/B,sBAAsB,EACtB,8EAA8E,CAC9E,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CACnC,GAAW,EACX,MAAoB;QAMpB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,MAA+B;QAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAC7B,CAAC;IAEO,sBAAsB;QAC7B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,sBAAsB;YAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACvF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YACvD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;CACD","sourcesContent":["import { realpathSync } from \"node:fs\";\nimport { isAbsolute, relative, resolve } from \"node:path\";\nimport { parseDotenvDocument, validateDotenvValue, validateDotenvVariableName } from \"./secret-dotenv.ts\";\n\nconst PROFILE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\nconst PROJECT_KEY_PATTERN = /^(?:git|local):[a-f0-9]{64}$/;\nconst MAX_PROFILE_CHARS = 96;\nconst MAX_DESCRIPTION_CHARS = 256;\nconst MAX_PROJECT_BINDINGS = 64;\nconst MAX_SESSION_KEY_BYTES = 16 * 1024;\n\nexport type CredentialManagerErrorCode =\n\t| \"ambiguous_project_binding\"\n\t| \"invalid_description\"\n\t| \"invalid_profile\"\n\t| \"invalid_project_identity\"\n\t| \"invalid_provider_record\"\n\t| \"invalid_session_key\"\n\t| \"owner_setup_required\"\n\t| \"profile_not_found\"\n\t| \"project_not_bound\";\n\nexport class CredentialManagerError extends Error {\n\treadonly code: CredentialManagerErrorCode;\n\n\tconstructor(code: CredentialManagerErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"CredentialManagerError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport type CredentialStorageErrorCode =\n\t| \"malformed_provider_data\"\n\t| \"not_connected\"\n\t| \"profile_not_found\"\n\t| \"provider_command_failed\"\n\t| \"provider_unavailable\";\n\nexport class CredentialStorageError extends Error {\n\treadonly code: CredentialStorageErrorCode;\n\n\tconstructor(code: CredentialStorageErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"CredentialStorageError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport interface CredentialProjectIdentity {\n\tkey: string;\n\troot: string;\n\tlabel: string;\n\tportable: boolean;\n}\n\nexport type CredentialProjectResolver = (cwd: string) => Promise<CredentialProjectIdentity>;\n\nexport interface CredentialVariable {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface CredentialProfileRecord {\n\tprofile: string;\n\tdescription?: string;\n\tvariables: CredentialVariable[];\n\tprojectKeys: string[];\n}\n\nexport interface StoredCredentialProfileSummary {\n\tprofile: string;\n\tdescription?: string;\n\tvariableNames: string[];\n\tprojectKeys: string[];\n}\n\nexport interface CredentialProfileStorage {\n\tconnect(sessionKey: string, signal?: AbortSignal): Promise<void>;\n\trefresh?(signal?: AbortSignal): Promise<void>;\n\tlistProfiles(signal?: AbortSignal): Promise<StoredCredentialProfileSummary[]>;\n\treadProfile(profile: string, signal?: AbortSignal): Promise<CredentialProfileRecord>;\n\twriteProfile(record: CredentialProfileRecord, signal?: AbortSignal): Promise<void>;\n\tdeleteProfile(profile: string, signal?: AbortSignal): Promise<void>;\n\tlock(): void;\n}\n\nexport interface CredentialProfileSummary {\n\tprofile: string;\n\tdescription?: string;\n\tvariableNames: string[];\n\tboundToCurrentProject: boolean;\n}\n\nexport interface CredentialActivationResult {\n\tstatus: \"activated\";\n\tprofile: string;\n\tvariableNames: string[];\n\tproject: string;\n}\n\nexport interface CredentialMutationResult {\n\tstatus: \"bound\" | \"removed\" | \"stored\";\n\tprofile: string;\n\tvariableNames: string[];\n\tproject?: string;\n\tportable?: boolean;\n}\n\nexport interface CredentialConnectionStatus {\n\tconnected: boolean;\n\tsessionAvailable: boolean;\n}\n\nexport interface CredentialManagerOptions {\n\tstorage: CredentialProfileStorage;\n\tresolveProject: CredentialProjectResolver;\n\tinitialSessionKey?: string;\n\tonEnvironmentChanged?: () => void;\n}\n\ninterface ActiveCredentialEnvironment {\n\tprofile: string;\n\troot: string;\n\tvalues: Record<string, string>;\n}\n\nexport function validateCredentialProfileName(profile: string): string {\n\tif (!PROFILE_PATTERN.test(profile) || profile.length > MAX_PROFILE_CHARS) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"invalid_profile\",\n\t\t\t\"Credential profile names must use 1-96 portable letters, digits, dots, underscores, or hyphens.\",\n\t\t);\n\t}\n\treturn profile;\n}\n\nexport function validateCredentialDescription(description: string | undefined): string | undefined {\n\tif (description === undefined) return undefined;\n\tif (\n\t\tdescription.length === 0 ||\n\t\tdescription.length > MAX_DESCRIPTION_CHARS ||\n\t\tdescription.includes(\"\\0\") ||\n\t\t/[\\r\\n]/.test(description)\n\t) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"invalid_description\",\n\t\t\t\"Credential descriptions must be a single printable line of at most 256 characters.\",\n\t\t);\n\t}\n\treturn description;\n}\n\nfunction validateProjectIdentity(identity: CredentialProjectIdentity): CredentialProjectIdentity {\n\tif (\n\t\t!PROJECT_KEY_PATTERN.test(identity.key) ||\n\t\t!isAbsolute(identity.root) ||\n\t\tidentity.label.length === 0 ||\n\t\tidentity.label.length > 256 ||\n\t\t/[\\0\\r\\n]/.test(identity.label)\n\t) {\n\t\tthrow new CredentialManagerError(\"invalid_project_identity\", \"The current project identity is invalid.\");\n\t}\n\treturn { ...identity, root: canonicalizeExistingPath(identity.root) };\n}\n\nexport function validateCredentialProfileRecord(record: CredentialProfileRecord): CredentialProfileRecord {\n\tvalidateCredentialProfileName(record.profile);\n\tvalidateCredentialDescription(record.description);\n\tif (record.variables.length === 0) {\n\t\tthrow new CredentialManagerError(\"invalid_provider_record\", \"Credential profile has no variables.\");\n\t}\n\tconst variableNames = new Set<string>();\n\tfor (const variable of record.variables) {\n\t\ttry {\n\t\t\tvalidateDotenvVariableName(variable.name);\n\t\t\tvalidateDotenvValue(variable.value);\n\t\t} catch {\n\t\t\tthrow new CredentialManagerError(\"invalid_provider_record\", \"Credential profile contains invalid variables.\");\n\t\t}\n\t\tif (variableNames.has(variable.name)) {\n\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\"invalid_provider_record\",\n\t\t\t\t\"Credential profile contains duplicate variables.\",\n\t\t\t);\n\t\t}\n\t\tvariableNames.add(variable.name);\n\t}\n\tif (\n\t\trecord.projectKeys.length === 0 ||\n\t\trecord.projectKeys.length > MAX_PROJECT_BINDINGS ||\n\t\tnew Set(record.projectKeys).size !== record.projectKeys.length ||\n\t\trecord.projectKeys.some((key) => !PROJECT_KEY_PATTERN.test(key))\n\t) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"invalid_provider_record\",\n\t\t\t\"Credential profile contains invalid project bindings.\",\n\t\t);\n\t}\n\treturn record;\n}\n\nfunction validateSessionKey(sessionKey: string): string {\n\tif (\n\t\tsessionKey.trim().length === 0 ||\n\t\tsessionKey.includes(\"\\0\") ||\n\t\t/[\\r\\n]/.test(sessionKey) ||\n\t\tBuffer.byteLength(sessionKey, \"utf8\") > MAX_SESSION_KEY_BYTES\n\t) {\n\t\tthrow new CredentialManagerError(\"invalid_session_key\", \"The Bitwarden session key is invalid.\");\n\t}\n\treturn sessionKey;\n}\n\nfunction isPathInside(root: string, target: string): boolean {\n\tconst pathFromRoot = relative(root, target);\n\treturn pathFromRoot === \"\" || (!pathFromRoot.startsWith(\"..\") && !isAbsolute(pathFromRoot));\n}\n\nfunction canonicalizeExistingPath(path: string): string {\n\tconst absolute = resolve(path);\n\ttry {\n\t\treturn realpathSync.native(absolute);\n\t} catch {\n\t\treturn absolute;\n\t}\n}\n\nfunction cloneEnvironment(values: Record<string, string>): Record<string, string> {\n\treturn Object.fromEntries(Object.entries(values));\n}\n\nexport class CredentialManager {\n\tprivate readonly storage: CredentialProfileStorage;\n\tprivate readonly resolveProject: CredentialProjectResolver;\n\tprivate readonly onEnvironmentChanged: () => void;\n\tprivate readonly activeEnvironments = new Map<string, ActiveCredentialEnvironment>();\n\tprivate readonly sensitiveValues = new Set<string>();\n\tprivate pendingSessionKey: string | undefined;\n\tprivate sessionKeyForRedaction: string | undefined;\n\tprivate connectionPromise: Promise<void> | undefined;\n\tprivate connectionGeneration = 0;\n\tprivate connected = false;\n\n\tconstructor(options: CredentialManagerOptions) {\n\t\tthis.storage = options.storage;\n\t\tthis.resolveProject = options.resolveProject;\n\t\tthis.onEnvironmentChanged = options.onEnvironmentChanged ?? (() => {});\n\t\tthis.pendingSessionKey = options.initialSessionKey ?? process.env.BW_SESSION;\n\t\tthis.sessionKeyForRedaction = this.pendingSessionKey;\n\t\tthis.rebuildSensitiveValues();\n\t}\n\n\tget status(): CredentialConnectionStatus {\n\t\treturn { connected: this.connected, sessionAvailable: this.connected || Boolean(this.pendingSessionKey) };\n\t}\n\n\tasync connect(sessionKey: string, signal?: AbortSignal): Promise<void> {\n\t\tconst previousConnection = this.connectionPromise;\n\t\tthis.connectionGeneration++;\n\t\tlet privateSessionKey = validateSessionKey(sessionKey);\n\t\tthis.pendingSessionKey = privateSessionKey;\n\t\tthis.sessionKeyForRedaction = privateSessionKey;\n\t\tthis.rebuildSensitiveValues();\n\t\tthis.connected = false;\n\t\ttry {\n\t\t\tif (previousConnection) {\n\t\t\t\ttry {\n\t\t\t\t\tawait previousConnection;\n\t\t\t\t} catch {\n\t\t\t\t\t// The superseded connection is expected to fail its generation check.\n\t\t\t\t}\n\t\t\t}\n\t\t\tawait this.ensureConnected(signal);\n\t\t} finally {\n\t\t\tprivateSessionKey = \"\";\n\t\t}\n\t}\n\n\tasync listForProject(cwd: string, signal?: AbortSignal): Promise<CredentialProfileSummary[]> {\n\t\tconst { identity, summaries } = await this.refreshProjectProfiles(cwd, signal);\n\t\treturn summaries.map((summary) => ({\n\t\t\tprofile: validateCredentialProfileName(summary.profile),\n\t\t\t...(summary.description ? { description: validateCredentialDescription(summary.description) } : {}),\n\t\t\tvariableNames: summary.variableNames.map(validateDotenvVariableName),\n\t\t\tboundToCurrentProject: summary.projectKeys.includes(identity.key),\n\t\t}));\n\t}\n\n\tasync activateForProject(cwd: string, profile?: string, signal?: AbortSignal): Promise<CredentialActivationResult> {\n\t\tconst { generation, identity, summaries } = await this.refreshProjectProfiles(cwd, signal);\n\t\tlet selected: StoredCredentialProfileSummary | undefined;\n\t\tif (profile !== undefined) {\n\t\t\tvalidateCredentialProfileName(profile);\n\t\t\tselected = summaries.find((summary) => summary.profile === profile);\n\t\t\tif (!selected) throw new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t\tif (!selected.projectKeys.includes(identity.key)) {\n\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\"project_not_bound\",\n\t\t\t\t\t\"Credential profile is not authorized for the current project.\",\n\t\t\t\t);\n\t\t\t}\n\t\t} else {\n\t\t\tconst candidates = summaries.filter((summary) => summary.projectKeys.includes(identity.key));\n\t\t\tif (candidates.length === 0) {\n\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\"profile_not_found\",\n\t\t\t\t\t\"No credential profile is bound to the current project. The owner can configure one with /secrets.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (candidates.length > 1) {\n\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\"ambiguous_project_binding\",\n\t\t\t\t\t\"Multiple credential profiles are bound to the current project; select a profile by name.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\t[selected] = candidates;\n\t\t}\n\n\t\tif (!selected) throw new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\tconst record = validateCredentialProfileRecord(await this.storage.readProfile(selected.profile, signal));\n\t\tthis.assertAccessGeneration(generation);\n\t\tif (!record.projectKeys.includes(identity.key)) {\n\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\"project_not_bound\",\n\t\t\t\t\"Credential profile is not authorized for the current project.\",\n\t\t\t);\n\t\t}\n\t\tthis.activate(identity.root, record);\n\t\treturn {\n\t\t\tstatus: \"activated\",\n\t\t\tprofile: record.profile,\n\t\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\t\tproject: identity.label,\n\t\t};\n\t}\n\n\tasync storeForProject(\n\t\tcwd: string,\n\t\tinput: { profile: string; description?: string; dotenv: string },\n\t\tsignal?: AbortSignal,\n\t): Promise<CredentialMutationResult> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst profile = validateCredentialProfileName(input.profile);\n\t\tconst description = validateCredentialDescription(input.description);\n\t\tconst identity = validateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst parsed = parseDotenvDocument(input.dotenv);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst existing = summaries.find((summary) => summary.profile === profile);\n\t\tconst existingRecord = existing\n\t\t\t? validateCredentialProfileRecord(await this.storage.readProfile(profile, signal))\n\t\t\t: undefined;\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst projectKeys = existingRecord ? [...new Set([...existingRecord.projectKeys, identity.key])] : [identity.key];\n\t\tconst record: CredentialProfileRecord = {\n\t\t\tprofile,\n\t\t\t...((description ?? existingRecord?.description)\n\t\t\t\t? { description: description ?? existingRecord?.description }\n\t\t\t\t: {}),\n\t\t\tvariables: parsed.variables.map((variable) => ({ name: variable.name, value: variable.value })),\n\t\t\tprojectKeys,\n\t\t};\n\t\tvalidateCredentialProfileRecord(record);\n\t\tawait this.storage.writeProfile(record, signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tthis.activate(identity.root, record);\n\t\treturn {\n\t\t\tstatus: \"stored\",\n\t\t\tprofile,\n\t\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\t\tproject: identity.label,\n\t\t\tportable: identity.portable,\n\t\t};\n\t}\n\n\tasync bindProfileToProject(cwd: string, profile: string, signal?: AbortSignal): Promise<CredentialMutationResult> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tvalidateCredentialProfileName(profile);\n\t\tconst identity = validateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tif (!summaries.some((summary) => summary.profile === profile)) {\n\t\t\tthrow new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t}\n\t\tconst record = validateCredentialProfileRecord(await this.storage.readProfile(profile, signal));\n\t\tthis.assertAccessGeneration(generation);\n\t\tif (!record.projectKeys.includes(identity.key)) record.projectKeys.push(identity.key);\n\t\tvalidateCredentialProfileRecord(record);\n\t\tawait this.storage.writeProfile(record, signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\treturn {\n\t\t\tstatus: \"bound\",\n\t\t\tprofile,\n\t\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\t\tproject: identity.label,\n\t\t\tportable: identity.portable,\n\t\t};\n\t}\n\n\tasync removeProfile(profile: string, signal?: AbortSignal): Promise<CredentialMutationResult> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tvalidateCredentialProfileName(profile);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summary = summaries.find((candidate) => candidate.profile === profile);\n\t\tif (!summary) throw new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\tawait this.storage.deleteProfile(profile, signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tlet removedActiveEnvironment = false;\n\t\tfor (const [root, active] of this.activeEnvironments) {\n\t\t\tif (active.profile === profile) {\n\t\t\t\tthis.activeEnvironments.delete(root);\n\t\t\t\tremovedActiveEnvironment = true;\n\t\t\t}\n\t\t}\n\t\tthis.rebuildSensitiveValues();\n\t\tif (removedActiveEnvironment) this.onEnvironmentChanged();\n\t\treturn { status: \"removed\", profile, variableNames: [...summary.variableNames] };\n\t}\n\n\tgetEnvironmentForCwd(cwd: string): Record<string, string> | undefined {\n\t\tconst target = resolve(cwd);\n\t\tconst direct = this.findActiveEnvironment(target);\n\t\tconst selected = direct ?? this.findActiveEnvironment(canonicalizeExistingPath(target));\n\t\treturn selected ? cloneEnvironment(selected.values) : undefined;\n\t}\n\n\tprivate findActiveEnvironment(target: string): ActiveCredentialEnvironment | undefined {\n\t\tlet selected: ActiveCredentialEnvironment | undefined;\n\t\tfor (const active of this.activeEnvironments.values()) {\n\t\t\tif (!isPathInside(active.root, target)) continue;\n\t\t\tif (!selected || active.root.length > selected.root.length) selected = active;\n\t\t}\n\t\treturn selected;\n\t}\n\n\thasEnvironmentForCwd(cwd: string): boolean {\n\t\treturn this.getEnvironmentForCwd(cwd) !== undefined;\n\t}\n\n\tredactSensitiveText(text: string): string {\n\t\tlet redacted = text;\n\t\tfor (const value of [...this.sensitiveValues].sort((left, right) => right.length - left.length)) {\n\t\t\tif (value.length > 0) redacted = redacted.split(value).join(\"[REDACTED_SECRET]\");\n\t\t}\n\t\treturn redacted;\n\t}\n\n\tlock(): void {\n\t\tconst hadActiveEnvironment = this.activeEnvironments.size > 0;\n\t\tthis.connectionGeneration++;\n\t\tthis.storage.lock();\n\t\tthis.connected = false;\n\t\tthis.pendingSessionKey = undefined;\n\t\tthis.sessionKeyForRedaction = undefined;\n\t\tthis.connectionPromise = undefined;\n\t\tthis.activeEnvironments.clear();\n\t\tthis.sensitiveValues.clear();\n\t\tif (hadActiveEnvironment) this.onEnvironmentChanged();\n\t}\n\n\tprivate async ensureConnected(signal?: AbortSignal): Promise<void> {\n\t\tif (this.connected) return;\n\t\tif (this.connectionPromise) return this.connectionPromise;\n\t\tlet sessionKey = this.pendingSessionKey;\n\t\tif (!sessionKey) {\n\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\"owner_setup_required\",\n\t\t\t\t\"Bitwarden is not connected. The owner can provide a session key with /secrets.\",\n\t\t\t);\n\t\t}\n\t\tconst generation = this.connectionGeneration;\n\t\tconst connectionPromise = (async () => {\n\t\t\ttry {\n\t\t\t\tawait this.storage.connect(sessionKey, signal);\n\t\t\t\tif (generation !== this.connectionGeneration) {\n\t\t\t\t\tthis.storage.lock();\n\t\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\t\"owner_setup_required\",\n\t\t\t\t\t\t\"Bitwarden connection was cancelled when the owner locked credentials.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tthis.connected = true;\n\t\t\t} finally {\n\t\t\t\tif (generation === this.connectionGeneration) this.pendingSessionKey = undefined;\n\t\t\t\tsessionKey = \"\";\n\t\t\t}\n\t\t})();\n\t\tthis.connectionPromise = connectionPromise;\n\t\ttry {\n\t\t\tawait connectionPromise;\n\t\t} finally {\n\t\t\tif (this.connectionPromise === connectionPromise) this.connectionPromise = undefined;\n\t\t}\n\t}\n\n\tprivate assertAccessGeneration(generation: number): void {\n\t\tif (generation === this.connectionGeneration && this.connected) return;\n\t\tthrow new CredentialManagerError(\n\t\t\t\"owner_setup_required\",\n\t\t\t\"Bitwarden credential access was cancelled when the owner locked credentials.\",\n\t\t);\n\t}\n\n\tprivate async refreshProjectProfiles(\n\t\tcwd: string,\n\t\tsignal?: AbortSignal,\n\t): Promise<{\n\t\tgeneration: number;\n\t\tidentity: CredentialProjectIdentity;\n\t\tsummaries: StoredCredentialProfileSummary[];\n\t}> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tawait this.storage.refresh?.(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst identity = validateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\treturn { generation, identity, summaries };\n\t}\n\n\tprivate activate(root: string, record: CredentialProfileRecord): void {\n\t\tconst values = Object.fromEntries(record.variables.map((variable) => [variable.name, variable.value]));\n\t\tthis.activeEnvironments.set(resolve(root), { profile: record.profile, root: resolve(root), values });\n\t\tthis.rebuildSensitiveValues();\n\t\tthis.onEnvironmentChanged();\n\t}\n\n\tprivate rebuildSensitiveValues(): void {\n\t\tthis.sensitiveValues.clear();\n\t\tif (this.sessionKeyForRedaction) this.sensitiveValues.add(this.sessionKeyForRedaction);\n\t\tfor (const active of this.activeEnvironments.values()) {\n\t\t\tfor (const value of Object.values(active.values)) this.sensitiveValues.add(value);\n\t\t}\n\t}\n}\n"]}

package/dist/core/secrets/credential-project.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialProjectIdentity } from "./credential-manager.ts";
+export declare function createPortableGitProjectKey(remote: string): string;
+export declare function resolveCredentialProject(cwd: string): Promise<CredentialProjectIdentity>;
+//# sourceMappingURL=credential-project.d.ts.map

package/dist/core/secrets/credential-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-project.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/credential-project.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAuCzE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIlE;AA+ED,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAkB9F"}

package/dist/core/secrets/credential-project.js

@@ -0,0 +1,145 @@
+import { createHash } from "node:crypto";
+import { readFile, realpath, stat } from "node:fs/promises";
+import { hostname } from "node:os";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+const MAX_GIT_POINTER_BYTES = 4 * 1024;
+const MAX_GIT_CONFIG_BYTES = 1024 * 1024;
+function opaqueKey(kind, identity) {
+    return `${kind}:${createHash("sha256").update(identity).digest("hex")}`;
+}
+function canonicalizeGitRemote(remote) {
+    const candidate = remote.trim();
+    if (!candidate || /[\0\r\n]/.test(candidate))
+        return undefined;
+    if (!candidate.includes("://")) {
+        const scp = candidate.match(/^(?:[^@/\s]+@)?([^:/\s]+):(.+)$/);
+        if (!scp)
+            return undefined;
+        const host = scp[1]?.toLowerCase();
+        const path = scp[2]
+            ?.replace(/^\/+/, "")
+            .replace(/\/+$/, "")
+            .replace(/\.git$/i, "");
+        return host && path ? `${host}/${path}` : undefined;
+    }
+    try {
+        const url = new URL(candidate);
+        if (!["git:", "http:", "https:", "ssh:"].includes(url.protocol) || !url.hostname)
+            return undefined;
+        const path = url.pathname
+            .replace(/^\/+/, "")
+            .replace(/\/+$/, "")
+            .replace(/\.git$/i, "");
+        if (!path)
+            return undefined;
+        const host = `${url.hostname.toLowerCase()}${url.port ? `:${url.port}` : ""}`;
+        return `${host}/${path}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function createPortableGitProjectKey(remote) {
+    const canonical = canonicalizeGitRemote(remote);
+    if (!canonical)
+        throw new Error("Git remote is not portable.");
+    return opaqueKey("git", canonical);
+}
+async function isDirectory(path) {
+    try {
+        return (await stat(path)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+async function isFile(path) {
+    try {
+        return (await stat(path)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+async function readBounded(path, maxBytes) {
+    try {
+        const metadata = await stat(path);
+        if (!metadata.isFile() || metadata.size > maxBytes)
+            return undefined;
+        return await readFile(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+async function resolveGitDirectory(root, marker) {
+    if (await isDirectory(marker))
+        return marker;
+    if (!(await isFile(marker)))
+        return undefined;
+    const pointer = await readBounded(marker, MAX_GIT_POINTER_BYTES);
+    const gitDirValue = pointer?.match(/^gitdir:\s*(.+?)\s*$/im)?.[1];
+    if (!gitDirValue || /[\0\r\n]/.test(gitDirValue))
+        return undefined;
+    return resolve(root, gitDirValue);
+}
+async function findGitRepository(cwd) {
+    let current = await realpath(cwd).catch(() => resolve(cwd));
+    while (true) {
+        const gitDir = await resolveGitDirectory(current, join(current, ".git"));
+        if (gitDir)
+            return { root: current, gitDir };
+        const parent = dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+async function resolveGitConfigPath(gitDir) {
+    const direct = join(gitDir, "config");
+    if (await isFile(direct))
+        return direct;
+    const commonPointer = await readBounded(join(gitDir, "commondir"), MAX_GIT_POINTER_BYTES);
+    const commonValue = commonPointer?.trim();
+    if (!commonValue || /[\0\r\n]/.test(commonValue))
+        return undefined;
+    const commonDir = isAbsolute(commonValue) ? commonValue : resolve(gitDir, commonValue);
+    const shared = join(commonDir, "config");
+    return (await isFile(shared)) ? shared : undefined;
+}
+function readOriginRemote(config) {
+    let inOrigin = false;
+    for (const line of config.split(/\r?\n/)) {
+        const section = line.match(/^\s*\[([^\]]+)]\s*$/)?.[1];
+        if (section !== undefined) {
+            inOrigin = /^remote\s+"origin"$/i.test(section.trim());
+            continue;
+        }
+        if (!inOrigin)
+            continue;
+        const assignment = line.match(/^\s*url\s*=\s*(.*?)\s*$/i)?.[1];
+        if (assignment)
+            return assignment;
+    }
+    return undefined;
+}
+export async function resolveCredentialProject(cwd) {
+    const repository = await findGitRepository(cwd);
+    const root = repository?.root ?? (await realpath(cwd).catch(() => resolve(cwd)));
+    if (repository) {
+        const configPath = await resolveGitConfigPath(repository.gitDir);
+        const config = configPath ? await readBounded(configPath, MAX_GIT_CONFIG_BYTES) : undefined;
+        const remote = config ? readOriginRemote(config) : undefined;
+        const canonical = remote ? canonicalizeGitRemote(remote) : undefined;
+        if (canonical) {
+            return { key: opaqueKey("git", canonical), root, label: basename(root), portable: true };
+        }
+    }
+    return {
+        key: opaqueKey("local", `${hostname()}\0${root}`),
+        root,
+        label: basename(root) || root,
+        portable: false,
+    };
+}
+//# sourceMappingURL=credential-project.js.map

package/dist/core/secrets/credential-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-project.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzE,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,CAAC;AACvC,MAAM,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzC,SAAS,SAAS,CAAC,IAAqB,EAAE,QAAgB;IACzD,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAE/D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;YAClB,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACzB,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QACnG,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ;aACvB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9E,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACzD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,QAAgB;IACxD,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,GAAG,QAAQ;YAAE,OAAO,SAAS,CAAC;QACrE,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAOD,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAAc;IAC9D,IAAI,MAAM,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,OAAO,EAAE,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,OAAO,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACzE,IAAI,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACzC,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC1F,MAAM,WAAW,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzC,OAAO,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACvC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,SAAS;QACV,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAW;IACzD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC1F,CAAC;IACF,CAAC;IACD,OAAO;QACN,GAAG,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI;QACJ,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI;QAC7B,QAAQ,EAAE,KAAK;KACf,CAAC;AACH,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { readFile, realpath, stat } from \"node:fs/promises\";\nimport { hostname } from \"node:os\";\nimport { basename, dirname, isAbsolute, join, resolve } from \"node:path\";\nimport type { CredentialProjectIdentity } from \"./credential-manager.ts\";\n\nconst MAX_GIT_POINTER_BYTES = 4 * 1024;\nconst MAX_GIT_CONFIG_BYTES = 1024 * 1024;\n\nfunction opaqueKey(kind: \"git\" | \"local\", identity: string): string {\n\treturn `${kind}:${createHash(\"sha256\").update(identity).digest(\"hex\")}`;\n}\n\nfunction canonicalizeGitRemote(remote: string): string | undefined {\n\tconst candidate = remote.trim();\n\tif (!candidate || /[\\0\\r\\n]/.test(candidate)) return undefined;\n\n\tif (!candidate.includes(\"://\")) {\n\t\tconst scp = candidate.match(/^(?:[^@/\\s]+@)?([^:/\\s]+):(.+)$/);\n\t\tif (!scp) return undefined;\n\t\tconst host = scp[1]?.toLowerCase();\n\t\tconst path = scp[2]\n\t\t\t?.replace(/^\\/+/, \"\")\n\t\t\t.replace(/\\/+$/, \"\")\n\t\t\t.replace(/\\.git$/i, \"\");\n\t\treturn host && path ? `${host}/${path}` : undefined;\n\t}\n\n\ttry {\n\t\tconst url = new URL(candidate);\n\t\tif (![\"git:\", \"http:\", \"https:\", \"ssh:\"].includes(url.protocol) || !url.hostname) return undefined;\n\t\tconst path = url.pathname\n\t\t\t.replace(/^\\/+/, \"\")\n\t\t\t.replace(/\\/+$/, \"\")\n\t\t\t.replace(/\\.git$/i, \"\");\n\t\tif (!path) return undefined;\n\t\tconst host = `${url.hostname.toLowerCase()}${url.port ? `:${url.port}` : \"\"}`;\n\t\treturn `${host}/${path}`;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nexport function createPortableGitProjectKey(remote: string): string {\n\tconst canonical = canonicalizeGitRemote(remote);\n\tif (!canonical) throw new Error(\"Git remote is not portable.\");\n\treturn opaqueKey(\"git\", canonical);\n}\n\nasync function isDirectory(path: string): Promise<boolean> {\n\ttry {\n\t\treturn (await stat(path)).isDirectory();\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nasync function isFile(path: string): Promise<boolean> {\n\ttry {\n\t\treturn (await stat(path)).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nasync function readBounded(path: string, maxBytes: number): Promise<string | undefined> {\n\ttry {\n\t\tconst metadata = await stat(path);\n\t\tif (!metadata.isFile() || metadata.size > maxBytes) return undefined;\n\t\treturn await readFile(path, \"utf8\");\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\ninterface GitRepositoryLocation {\n\troot: string;\n\tgitDir: string;\n}\n\nasync function resolveGitDirectory(root: string, marker: string): Promise<string | undefined> {\n\tif (await isDirectory(marker)) return marker;\n\tif (!(await isFile(marker))) return undefined;\n\tconst pointer = await readBounded(marker, MAX_GIT_POINTER_BYTES);\n\tconst gitDirValue = pointer?.match(/^gitdir:\\s*(.+?)\\s*$/im)?.[1];\n\tif (!gitDirValue || /[\\0\\r\\n]/.test(gitDirValue)) return undefined;\n\treturn resolve(root, gitDirValue);\n}\n\nasync function findGitRepository(cwd: string): Promise<GitRepositoryLocation | undefined> {\n\tlet current = await realpath(cwd).catch(() => resolve(cwd));\n\twhile (true) {\n\t\tconst gitDir = await resolveGitDirectory(current, join(current, \".git\"));\n\t\tif (gitDir) return { root: current, gitDir };\n\t\tconst parent = dirname(current);\n\t\tif (parent === current) return undefined;\n\t\tcurrent = parent;\n\t}\n}\n\nasync function resolveGitConfigPath(gitDir: string): Promise<string | undefined> {\n\tconst direct = join(gitDir, \"config\");\n\tif (await isFile(direct)) return direct;\n\tconst commonPointer = await readBounded(join(gitDir, \"commondir\"), MAX_GIT_POINTER_BYTES);\n\tconst commonValue = commonPointer?.trim();\n\tif (!commonValue || /[\\0\\r\\n]/.test(commonValue)) return undefined;\n\tconst commonDir = isAbsolute(commonValue) ? commonValue : resolve(gitDir, commonValue);\n\tconst shared = join(commonDir, \"config\");\n\treturn (await isFile(shared)) ? shared : undefined;\n}\n\nfunction readOriginRemote(config: string): string | undefined {\n\tlet inOrigin = false;\n\tfor (const line of config.split(/\\r?\\n/)) {\n\t\tconst section = line.match(/^\\s*\\[([^\\]]+)]\\s*$/)?.[1];\n\t\tif (section !== undefined) {\n\t\t\tinOrigin = /^remote\\s+\"origin\"$/i.test(section.trim());\n\t\t\tcontinue;\n\t\t}\n\t\tif (!inOrigin) continue;\n\t\tconst assignment = line.match(/^\\s*url\\s*=\\s*(.*?)\\s*$/i)?.[1];\n\t\tif (assignment) return assignment;\n\t}\n\treturn undefined;\n}\n\nexport async function resolveCredentialProject(cwd: string): Promise<CredentialProjectIdentity> {\n\tconst repository = await findGitRepository(cwd);\n\tconst root = repository?.root ?? (await realpath(cwd).catch(() => resolve(cwd)));\n\tif (repository) {\n\t\tconst configPath = await resolveGitConfigPath(repository.gitDir);\n\t\tconst config = configPath ? await readBounded(configPath, MAX_GIT_CONFIG_BYTES) : undefined;\n\t\tconst remote = config ? readOriginRemote(config) : undefined;\n\t\tconst canonical = remote ? canonicalizeGitRemote(remote) : undefined;\n\t\tif (canonical) {\n\t\t\treturn { key: opaqueKey(\"git\", canonical), root, label: basename(root), portable: true };\n\t\t}\n\t}\n\treturn {\n\t\tkey: opaqueKey(\"local\", `${hostname()}\\0${root}`),\n\t\troot,\n\t\tlabel: basename(root) || root,\n\t\tportable: false,\n\t};\n}\n"]}

package/dist/core/secrets/secret-dotenv.d.ts

@@ -18,7 +18,7 @@ export interface ParsedDotenvDocument {
 export declare function validateDotenvVariableName(name: string): string;
 export declare function validateDotenvValue(value: string): string;
 /**
- * Parse the practical dotenv surface Pi materializes: comments, blank lines, optional `export`,
+ * Parse the practical dotenv surface Pi accepts for provider-backed credential profiles: comments, blank lines, optional `export`,
  * unquoted values, and single/double/backtick quoted values (including multiline quoted values).
  * Error messages contain only a line number and grammar reason, never the rejected value.
  */

package/dist/core/secrets/secret-dotenv.js

@@ -86,7 +86,7 @@ function parseUnquotedValue(raw) {
     return (commentIndex === -1 ? raw : raw.slice(0, commentIndex)).trim();
 }
 /**
- * Parse the practical dotenv surface Pi materializes: comments, blank lines, optional `export`,
+ * Parse the practical dotenv surface Pi accepts for provider-backed credential profiles: comments, blank lines, optional `export`,
  * unquoted values, and single/double/backtick quoted values (including multiline quoted values).
  * Error messages contain only a line number and grammar reason, never the rejected value.
  */

package/dist/core/secrets/secret-dotenv.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-dotenv.js","sourceRoot":"","sources":["../../../src/core/secrets/secret-dotenv.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEpD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAG3C,YAAY,OAAe,EAAE,IAAa;QACzC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAYD,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACtD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,8BAA8B,EAAE,CAAC;QAC7E,MAAM,IAAI,iBAAiB,CAAC,2DAA2D,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,sBAAsB,EAAE,CAAC;QAC/D,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAY;IACtD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,IAAI,SAAS,CAAC;YACrB,SAAS;QACV,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,EAAE,IAAI,CAAC,CAAC;QACxG,QAAQ,OAAO,EAAE,CAAC;YACjB,KAAK,GAAG;gBACP,OAAO,IAAI,IAAI,CAAC;gBAChB,MAAM;YACP,KAAK,GAAG;gBACP,OAAO,IAAI,IAAI,CAAC;gBAChB,MAAM;YACP,KAAK,GAAG;gBACP,OAAO,IAAI,IAAI,CAAC;gBAChB,MAAM;YACP,KAAK,IAAI,CAAC;YACV,KAAK,GAAG,CAAC;YACT,KAAK,GAAG;gBACP,OAAO,IAAI,OAAO,CAAC;gBACnB,MAAM;YACP;gBACC,OAAO,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,KAAa,EAAE,KAAa,EAAE,IAAY;IACrF,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK;YAAE,SAAS;QACxC,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,IAAI,MAAM,GAAG,KAAK,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,MAAM,EAAE;YAAE,UAAU,EAAE,CAAC;QAClG,IAAI,UAAU,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,EAAE,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,KAAa;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACtC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5E,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM;QACP,CAAC;IACF,CAAC;IACD,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,oCAAoC,CAAC,CAAC;IAC/F,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;QACrE,MAAM,IAAI,iBAAiB,CAAC,oCAAoC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACxD,IAAI,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;QAC9B,IAAI,MAAM,IAAI,WAAW,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3E,IAAI,EAAE,CAAC;YACP,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,CAAC,CAAC;YACZ,OAAO,MAAM,GAAG,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACpG,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACJ,IAAI,GAAG,0BAA0B,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,iBAAiB;gBAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,YAAY,IAAI,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACzF,IAAI,SAAS,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,oBAAoB,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACjG,CAAC;QAED,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC;QACpB,OAAO,MAAM,GAAG,WAAW,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,MAAM,EAAE,CAAC;QACjG,IAAI,KAAa,CAAC;QAClB,IAAI,UAAkB,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;YACjE,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,EAAE,IAAI,CAAC,CAAC;YAC/E,CAAC;YACD,KAAK,GAAG,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAClE,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC7E,IAAI,IAAI,aAAa,CAAC;YACtB,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChF,CAAC;aAAM,CAAC;YACP,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAChE,IAAI,EAAE,CAAC;YACP,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChF,CAAC;QACD,IAAI,CAAC;YACJ,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,iBAAiB;gBAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;YAC7F,MAAM,KAAK,CAAC;QACb,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,UAAU,CAAC;IACrB,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,+CAA+C,CAAC,CAAC;IACzG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAA0C;IAC/E,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC;SACtB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC1D,GAAG,CACH,CAAC,QAAQ,EAAE,EAAE,CACZ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CACtG;SACA,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAClB,CAAC","sourcesContent":["const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\nexport const SECRET_VARIABLE_NAME_MAX_CHARS = 128;\nexport const SECRET_VARIABLE_NAME_PATTERN = \"^[A-Za-z_][A-Za-z0-9_]*$\";\nexport const MAX_DOTENV_VARIABLES = 64;\nexport const MAX_DOTENV_VALUE_BYTES = 64 * 1024;\nexport const MAX_DOTENV_DOCUMENT_BYTES = 512 * 1024;\n\nexport class SecretDotenvError extends Error {\n\treadonly line?: number;\n\n\tconstructor(message: string, line?: number) {\n\t\tsuper(line === undefined ? message : `Dotenv line ${line}: ${message}`);\n\t\tthis.name = \"SecretDotenvError\";\n\t\tthis.line = line;\n\t}\n}\n\nexport interface ParsedDotenvVariable {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface ParsedDotenvDocument {\n\tdocument: string;\n\tvariables: ParsedDotenvVariable[];\n}\n\nexport function validateDotenvVariableName(name: string): string {\n\tif (!ENV_NAME_RE.test(name) || name.length > SECRET_VARIABLE_NAME_MAX_CHARS) {\n\t\tthrow new SecretDotenvError(\"environment variable name must use portable dotenv syntax\");\n\t}\n\treturn name;\n}\n\nexport function validateDotenvValue(value: string): string {\n\tif (value.includes(\"\\0\")) throw new SecretDotenvError(\"values cannot contain null bytes\");\n\tif (Buffer.byteLength(value, \"utf8\") > MAX_DOTENV_VALUE_BYTES) {\n\t\tthrow new SecretDotenvError(\"a value exceeds the 64 KiB limit\");\n\t}\n\treturn value;\n}\n\nfunction decodeDoubleQuoted(value: string, line: number): string {\n\tlet decoded = \"\";\n\tfor (let index = 0; index < value.length; index++) {\n\t\tconst character = value[index] ?? \"\";\n\t\tif (character !== \"\\\\\") {\n\t\t\tdecoded += character;\n\t\t\tcontinue;\n\t\t}\n\t\tconst escaped = value[++index];\n\t\tif (escaped === undefined) throw new SecretDotenvError(\"double-quoted value ends with an escape\", line);\n\t\tswitch (escaped) {\n\t\t\tcase \"n\":\n\t\t\t\tdecoded += \"\\n\";\n\t\t\t\tbreak;\n\t\t\tcase \"r\":\n\t\t\t\tdecoded += \"\\r\";\n\t\t\t\tbreak;\n\t\t\tcase \"t\":\n\t\t\t\tdecoded += \"\\t\";\n\t\t\t\tbreak;\n\t\t\tcase \"\\\\\":\n\t\t\tcase '\"':\n\t\t\tcase \"$\":\n\t\t\t\tdecoded += escaped;\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tdecoded += `\\\\${escaped}`;\n\t\t}\n\t}\n\treturn decoded;\n}\n\nfunction findClosingQuote(document: string, start: number, quote: string, line: number): number {\n\tfor (let index = start; index < document.length; index++) {\n\t\tif (document[index] !== quote) continue;\n\t\tif (quote !== '\"') return index;\n\t\tlet slashCount = 0;\n\t\tfor (let cursor = index - 1; cursor >= start && document[cursor] === \"\\\\\"; cursor--) slashCount++;\n\t\tif (slashCount % 2 === 0) return index;\n\t}\n\tthrow new SecretDotenvError(\"quoted value is not terminated\", line);\n}\n\nfunction endOfPhysicalLine(document: string, start: number): number {\n\tconst newline = document.indexOf(\"\\n\", start);\n\treturn newline === -1 ? document.length : newline;\n}\n\nfunction parseUnquotedValue(raw: string): string {\n\tlet commentIndex = -1;\n\tfor (let index = 0; index < raw.length; index++) {\n\t\tif (raw[index] === \"#\" && (index === 0 || /\\s/.test(raw[index - 1] ?? \"\"))) {\n\t\t\tcommentIndex = index;\n\t\t\tbreak;\n\t\t}\n\t}\n\treturn (commentIndex === -1 ? raw : raw.slice(0, commentIndex)).trim();\n}\n\n/**\n * Parse the practical dotenv surface Pi materializes: comments, blank lines, optional `export`,\n * unquoted values, and single/double/backtick quoted values (including multiline quoted values).\n * Error messages contain only a line number and grammar reason, never the rejected value.\n */\nexport function parseDotenvDocument(input: string): ParsedDotenvDocument {\n\tconst document = input.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n\tif (document.includes(\"\\0\")) throw new SecretDotenvError(\"document cannot contain null bytes\");\n\tif (Buffer.byteLength(document, \"utf8\") > MAX_DOTENV_DOCUMENT_BYTES) {\n\t\tthrow new SecretDotenvError(\"document exceeds the 512 KiB limit\");\n\t}\n\n\tconst variables: ParsedDotenvVariable[] = [];\n\tconst names = new Set<string>();\n\tlet offset = 0;\n\tlet line = 1;\n\twhile (offset < document.length) {\n\t\tconst physicalEnd = endOfPhysicalLine(document, offset);\n\t\tconst physical = document.slice(offset, physicalEnd);\n\t\tconst leading = physical.match(/^\\s*/)?.[0].length ?? 0;\n\t\tlet cursor = offset + leading;\n\t\tif (cursor >= physicalEnd || document[cursor] === \"#\") {\n\t\t\toffset = physicalEnd < document.length ? physicalEnd + 1 : document.length;\n\t\t\tline++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (document.slice(cursor, cursor + 6) === \"export\" && /\\s/.test(document[cursor + 6] ?? \"\")) {\n\t\t\tcursor += 6;\n\t\t\twhile (cursor < physicalEnd && /\\s/.test(document[cursor] ?? \"\")) cursor++;\n\t\t}\n\t\tconst equals = document.indexOf(\"=\", cursor);\n\t\tif (equals === -1 || equals > physicalEnd) throw new SecretDotenvError(\"expected NAME=value\", line);\n\t\tlet name: string;\n\t\ttry {\n\t\t\tname = validateDotenvVariableName(document.slice(cursor, equals).trim());\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretDotenvError) throw new SecretDotenvError(error.message, line);\n\t\t\tthrow error;\n\t\t}\n\t\tif (names.has(name)) throw new SecretDotenvError(`variable ${name} is duplicated`, line);\n\t\tif (variables.length >= MAX_DOTENV_VARIABLES) {\n\t\t\tthrow new SecretDotenvError(`profile exceeds the ${MAX_DOTENV_VARIABLES}-variable limit`, line);\n\t\t}\n\n\t\tcursor = equals + 1;\n\t\twhile (cursor < physicalEnd && (document[cursor] === \" \" || document[cursor] === \"\\t\")) cursor++;\n\t\tlet value: string;\n\t\tlet nextOffset: number;\n\t\tconst quote = document[cursor];\n\t\tif (quote === '\"' || quote === \"'\" || quote === \"`\") {\n\t\t\tconst closing = findClosingQuote(document, cursor + 1, quote, line);\n\t\t\tconst quoted = document.slice(cursor + 1, closing);\n\t\t\tconst trailingEnd = endOfPhysicalLine(document, closing + 1);\n\t\t\tconst trailing = document.slice(closing + 1, trailingEnd).trim();\n\t\t\tif (trailing && !trailing.startsWith(\"#\")) {\n\t\t\t\tthrow new SecretDotenvError(\"unexpected text follows the quoted value\", line);\n\t\t\t}\n\t\t\tvalue = quote === '\"' ? decodeDoubleQuoted(quoted, line) : quoted;\n\t\t\tconst consumedLines = document.slice(offset, trailingEnd).split(\"\\n\").length;\n\t\t\tline += consumedLines;\n\t\t\tnextOffset = trailingEnd < document.length ? trailingEnd + 1 : document.length;\n\t\t} else {\n\t\t\tvalue = parseUnquotedValue(document.slice(cursor, physicalEnd));\n\t\t\tline++;\n\t\t\tnextOffset = physicalEnd < document.length ? physicalEnd + 1 : document.length;\n\t\t}\n\t\ttry {\n\t\t\tvalidateDotenvValue(value);\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretDotenvError) throw new SecretDotenvError(error.message, line - 1);\n\t\t\tthrow error;\n\t\t}\n\t\tnames.add(name);\n\t\tvariables.push({ name, value });\n\t\toffset = nextOffset;\n\t}\n\n\tif (variables.length === 0) throw new SecretDotenvError(\"document must contain at least one assignment\");\n\treturn { document, variables };\n}\n\nexport function formatDotenvVariables(variables: readonly ParsedDotenvVariable[]): string {\n\treturn `${[...variables]\n\t\t.sort((left, right) => left.name.localeCompare(right.name))\n\t\t.map(\n\t\t\t(variable) =>\n\t\t\t\t`${validateDotenvVariableName(variable.name)}=${JSON.stringify(validateDotenvValue(variable.value))}`,\n\t\t)\n\t\t.join(\"\\n\")}\\n`;\n}\n"]}
+{"version":3,"file":"secret-dotenv.js","sourceRoot":"","sources":["../../../src/core/secrets/secret-dotenv.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAE/C,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,CAAC;AAClD,MAAM,CAAC,MAAM,4BAA4B,GAAG,0BAA0B,CAAC;AACvE,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAChD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,GAAG,IAAI,CAAC;AAEpD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAG3C,YAAY,OAAe,EAAE,IAAa;QACzC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAYD,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACtD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,8BAA8B,EAAE,CAAC;QAC7E,MAAM,IAAI,iBAAiB,CAAC,2DAA2D,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;IAC1F,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,sBAAsB,EAAE,CAAC;QAC/D,MAAM,IAAI,iBAAiB,CAAC,kCAAkC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAa,EAAE,IAAY;IACtD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,IAAI,SAAS,CAAC;YACrB,SAAS;QACV,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,EAAE,IAAI,CAAC,CAAC;QACxG,QAAQ,OAAO,EAAE,CAAC;YACjB,KAAK,GAAG;gBACP,OAAO,IAAI,IAAI,CAAC;gBAChB,MAAM;YACP,KAAK,GAAG;gBACP,OAAO,IAAI,IAAI,CAAC;gBAChB,MAAM;YACP,KAAK,GAAG;gBACP,OAAO,IAAI,IAAI,CAAC;gBAChB,MAAM;YACP,KAAK,IAAI,CAAC;YACV,KAAK,GAAG,CAAC;YACT,KAAK,GAAG;gBACP,OAAO,IAAI,OAAO,CAAC;gBACnB,MAAM;YACP;gBACC,OAAO,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,CAAC;IACF,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,KAAa,EAAE,KAAa,EAAE,IAAY;IACrF,KAAK,IAAI,KAAK,GAAG,KAAK,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC1D,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,KAAK;YAAE,SAAS;QACxC,IAAI,KAAK,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,IAAI,MAAM,GAAG,KAAK,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,MAAM,EAAE;YAAE,UAAU,EAAE,CAAC;QAClG,IAAI,UAAU,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,EAAE,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB,EAAE,KAAa;IACzD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AACnD,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACtC,IAAI,YAAY,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC5E,YAAY,GAAG,KAAK,CAAC;YACrB,MAAM;QACP,CAAC;IACF,CAAC;IACD,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAChD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,oCAAoC,CAAC,CAAC;IAC/F,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,yBAAyB,EAAE,CAAC;QACrE,MAAM,IAAI,iBAAiB,CAAC,oCAAoC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,OAAO,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACxD,IAAI,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;QAC9B,IAAI,MAAM,IAAI,WAAW,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;YACvD,MAAM,GAAG,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC3E,IAAI,EAAE,CAAC;YACP,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9F,MAAM,IAAI,CAAC,CAAC;YACZ,OAAO,MAAM,GAAG,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAAE,MAAM,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC;QACpG,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACJ,IAAI,GAAG,0BAA0B,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,iBAAiB;gBAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzF,MAAM,KAAK,CAAC;QACb,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,YAAY,IAAI,gBAAgB,EAAE,IAAI,CAAC,CAAC;QACzF,IAAI,SAAS,CAAC,MAAM,IAAI,oBAAoB,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,oBAAoB,iBAAiB,EAAE,IAAI,CAAC,CAAC;QACjG,CAAC;QAED,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC;QACpB,OAAO,MAAM,GAAG,WAAW,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC;YAAE,MAAM,EAAE,CAAC;QACjG,IAAI,KAAa,CAAC;QAClB,IAAI,UAAkB,CAAC;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;YACjE,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,iBAAiB,CAAC,0CAA0C,EAAE,IAAI,CAAC,CAAC;YAC/E,CAAC;YACD,KAAK,GAAG,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAClE,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;YAC7E,IAAI,IAAI,aAAa,CAAC;YACtB,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChF,CAAC;aAAM,CAAC;YACP,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;YAChE,IAAI,EAAE,CAAC;YACP,UAAU,GAAG,WAAW,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChF,CAAC;QACD,IAAI,CAAC;YACJ,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,iBAAiB;gBAAE,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;YAC7F,MAAM,KAAK,CAAC;QACb,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,UAAU,CAAC;IACrB,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,iBAAiB,CAAC,+CAA+C,CAAC,CAAC;IACzG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,SAA0C;IAC/E,OAAO,GAAG,CAAC,GAAG,SAAS,CAAC;SACtB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC1D,GAAG,CACH,CAAC,QAAQ,EAAE,EAAE,CACZ,GAAG,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CACtG;SACA,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAClB,CAAC","sourcesContent":["const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\nexport const SECRET_VARIABLE_NAME_MAX_CHARS = 128;\nexport const SECRET_VARIABLE_NAME_PATTERN = \"^[A-Za-z_][A-Za-z0-9_]*$\";\nexport const MAX_DOTENV_VARIABLES = 64;\nexport const MAX_DOTENV_VALUE_BYTES = 64 * 1024;\nexport const MAX_DOTENV_DOCUMENT_BYTES = 512 * 1024;\n\nexport class SecretDotenvError extends Error {\n\treadonly line?: number;\n\n\tconstructor(message: string, line?: number) {\n\t\tsuper(line === undefined ? message : `Dotenv line ${line}: ${message}`);\n\t\tthis.name = \"SecretDotenvError\";\n\t\tthis.line = line;\n\t}\n}\n\nexport interface ParsedDotenvVariable {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface ParsedDotenvDocument {\n\tdocument: string;\n\tvariables: ParsedDotenvVariable[];\n}\n\nexport function validateDotenvVariableName(name: string): string {\n\tif (!ENV_NAME_RE.test(name) || name.length > SECRET_VARIABLE_NAME_MAX_CHARS) {\n\t\tthrow new SecretDotenvError(\"environment variable name must use portable dotenv syntax\");\n\t}\n\treturn name;\n}\n\nexport function validateDotenvValue(value: string): string {\n\tif (value.includes(\"\\0\")) throw new SecretDotenvError(\"values cannot contain null bytes\");\n\tif (Buffer.byteLength(value, \"utf8\") > MAX_DOTENV_VALUE_BYTES) {\n\t\tthrow new SecretDotenvError(\"a value exceeds the 64 KiB limit\");\n\t}\n\treturn value;\n}\n\nfunction decodeDoubleQuoted(value: string, line: number): string {\n\tlet decoded = \"\";\n\tfor (let index = 0; index < value.length; index++) {\n\t\tconst character = value[index] ?? \"\";\n\t\tif (character !== \"\\\\\") {\n\t\t\tdecoded += character;\n\t\t\tcontinue;\n\t\t}\n\t\tconst escaped = value[++index];\n\t\tif (escaped === undefined) throw new SecretDotenvError(\"double-quoted value ends with an escape\", line);\n\t\tswitch (escaped) {\n\t\t\tcase \"n\":\n\t\t\t\tdecoded += \"\\n\";\n\t\t\t\tbreak;\n\t\t\tcase \"r\":\n\t\t\t\tdecoded += \"\\r\";\n\t\t\t\tbreak;\n\t\t\tcase \"t\":\n\t\t\t\tdecoded += \"\\t\";\n\t\t\t\tbreak;\n\t\t\tcase \"\\\\\":\n\t\t\tcase '\"':\n\t\t\tcase \"$\":\n\t\t\t\tdecoded += escaped;\n\t\t\t\tbreak;\n\t\t\tdefault:\n\t\t\t\tdecoded += `\\\\${escaped}`;\n\t\t}\n\t}\n\treturn decoded;\n}\n\nfunction findClosingQuote(document: string, start: number, quote: string, line: number): number {\n\tfor (let index = start; index < document.length; index++) {\n\t\tif (document[index] !== quote) continue;\n\t\tif (quote !== '\"') return index;\n\t\tlet slashCount = 0;\n\t\tfor (let cursor = index - 1; cursor >= start && document[cursor] === \"\\\\\"; cursor--) slashCount++;\n\t\tif (slashCount % 2 === 0) return index;\n\t}\n\tthrow new SecretDotenvError(\"quoted value is not terminated\", line);\n}\n\nfunction endOfPhysicalLine(document: string, start: number): number {\n\tconst newline = document.indexOf(\"\\n\", start);\n\treturn newline === -1 ? document.length : newline;\n}\n\nfunction parseUnquotedValue(raw: string): string {\n\tlet commentIndex = -1;\n\tfor (let index = 0; index < raw.length; index++) {\n\t\tif (raw[index] === \"#\" && (index === 0 || /\\s/.test(raw[index - 1] ?? \"\"))) {\n\t\t\tcommentIndex = index;\n\t\t\tbreak;\n\t\t}\n\t}\n\treturn (commentIndex === -1 ? raw : raw.slice(0, commentIndex)).trim();\n}\n\n/**\n * Parse the practical dotenv surface Pi accepts for provider-backed credential profiles: comments, blank lines, optional `export`,\n * unquoted values, and single/double/backtick quoted values (including multiline quoted values).\n * Error messages contain only a line number and grammar reason, never the rejected value.\n */\nexport function parseDotenvDocument(input: string): ParsedDotenvDocument {\n\tconst document = input.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\");\n\tif (document.includes(\"\\0\")) throw new SecretDotenvError(\"document cannot contain null bytes\");\n\tif (Buffer.byteLength(document, \"utf8\") > MAX_DOTENV_DOCUMENT_BYTES) {\n\t\tthrow new SecretDotenvError(\"document exceeds the 512 KiB limit\");\n\t}\n\n\tconst variables: ParsedDotenvVariable[] = [];\n\tconst names = new Set<string>();\n\tlet offset = 0;\n\tlet line = 1;\n\twhile (offset < document.length) {\n\t\tconst physicalEnd = endOfPhysicalLine(document, offset);\n\t\tconst physical = document.slice(offset, physicalEnd);\n\t\tconst leading = physical.match(/^\\s*/)?.[0].length ?? 0;\n\t\tlet cursor = offset + leading;\n\t\tif (cursor >= physicalEnd || document[cursor] === \"#\") {\n\t\t\toffset = physicalEnd < document.length ? physicalEnd + 1 : document.length;\n\t\t\tline++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (document.slice(cursor, cursor + 6) === \"export\" && /\\s/.test(document[cursor + 6] ?? \"\")) {\n\t\t\tcursor += 6;\n\t\t\twhile (cursor < physicalEnd && /\\s/.test(document[cursor] ?? \"\")) cursor++;\n\t\t}\n\t\tconst equals = document.indexOf(\"=\", cursor);\n\t\tif (equals === -1 || equals > physicalEnd) throw new SecretDotenvError(\"expected NAME=value\", line);\n\t\tlet name: string;\n\t\ttry {\n\t\t\tname = validateDotenvVariableName(document.slice(cursor, equals).trim());\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretDotenvError) throw new SecretDotenvError(error.message, line);\n\t\t\tthrow error;\n\t\t}\n\t\tif (names.has(name)) throw new SecretDotenvError(`variable ${name} is duplicated`, line);\n\t\tif (variables.length >= MAX_DOTENV_VARIABLES) {\n\t\t\tthrow new SecretDotenvError(`profile exceeds the ${MAX_DOTENV_VARIABLES}-variable limit`, line);\n\t\t}\n\n\t\tcursor = equals + 1;\n\t\twhile (cursor < physicalEnd && (document[cursor] === \" \" || document[cursor] === \"\\t\")) cursor++;\n\t\tlet value: string;\n\t\tlet nextOffset: number;\n\t\tconst quote = document[cursor];\n\t\tif (quote === '\"' || quote === \"'\" || quote === \"`\") {\n\t\t\tconst closing = findClosingQuote(document, cursor + 1, quote, line);\n\t\t\tconst quoted = document.slice(cursor + 1, closing);\n\t\t\tconst trailingEnd = endOfPhysicalLine(document, closing + 1);\n\t\t\tconst trailing = document.slice(closing + 1, trailingEnd).trim();\n\t\t\tif (trailing && !trailing.startsWith(\"#\")) {\n\t\t\t\tthrow new SecretDotenvError(\"unexpected text follows the quoted value\", line);\n\t\t\t}\n\t\t\tvalue = quote === '\"' ? decodeDoubleQuoted(quoted, line) : quoted;\n\t\t\tconst consumedLines = document.slice(offset, trailingEnd).split(\"\\n\").length;\n\t\t\tline += consumedLines;\n\t\t\tnextOffset = trailingEnd < document.length ? trailingEnd + 1 : document.length;\n\t\t} else {\n\t\t\tvalue = parseUnquotedValue(document.slice(cursor, physicalEnd));\n\t\t\tline++;\n\t\t\tnextOffset = physicalEnd < document.length ? physicalEnd + 1 : document.length;\n\t\t}\n\t\ttry {\n\t\t\tvalidateDotenvValue(value);\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretDotenvError) throw new SecretDotenvError(error.message, line - 1);\n\t\t\tthrow error;\n\t\t}\n\t\tnames.add(name);\n\t\tvariables.push({ name, value });\n\t\toffset = nextOffset;\n\t}\n\n\tif (variables.length === 0) throw new SecretDotenvError(\"document must contain at least one assignment\");\n\treturn { document, variables };\n}\n\nexport function formatDotenvVariables(variables: readonly ParsedDotenvVariable[]): string {\n\treturn `${[...variables]\n\t\t.sort((left, right) => left.name.localeCompare(right.name))\n\t\t.map(\n\t\t\t(variable) =>\n\t\t\t\t`${validateDotenvVariableName(variable.name)}=${JSON.stringify(validateDotenvValue(variable.value))}`,\n\t\t)\n\t\t.join(\"\\n\")}\\n`;\n}\n"]}

package/dist/core/security/context-threat-scanner.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Pure text boundary for context and durable-memory threat screening.
+ *
+ * Memory providers run during ordinary session construction, so this module must remain independent
+ * from resource discovery, themes, package management, Jiti, and extension loading.
+ */
+export type ThreatScope = "context" | "strict";
+export declare function hasInvisibleUnicode(content: string): boolean;
+export declare function stripInvisibleUnicode(content: string): {
+    cleaned: string;
+    removed: number;
+};
+export declare function scanContextFileThreats(content: string, scope?: ThreatScope): string[];
+//# sourceMappingURL=context-threat-scanner.d.ts.map

package/dist/core/security/context-threat-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-threat-scanner.d.ts","sourceRoot":"","sources":["../../../src/core/security/context-threat-scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAwD/C,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAG5D;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAO3F;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,WAAuB,GAAG,MAAM,EAAE,CAIhG"}

package/dist/core/security/context-threat-scanner.js

@@ -0,0 +1,71 @@
+/**
+ * Pure text boundary for context and durable-memory threat screening.
+ *
+ * Memory providers run during ordinary session construction, so this module must remain independent
+ * from resource discovery, themes, package management, Jiti, and extension loading.
+ */
+const THREAT_PATTERNS = [
+    {
+        label: "instruction override",
+        pattern: /\b(?:ignore|disregard|override|bypass)\b.{0,80}\b(?:previous|prior|above|system|developer|agent)\b.{0,80}\binstructions?\b/i,
+        scope: "context",
+    },
+    {
+        label: "secret exfiltration",
+        pattern: /\b(?:reveal|print|dump|exfiltrate|send|upload)\b.{0,80}\b(?:secrets?|tokens?|api[_ -]?keys?|credentials?|environment variables?|\.env)\b/i,
+        scope: "context",
+    },
+    {
+        label: "hidden instruction",
+        pattern: /\b(?:do not tell|don't tell|hide this from)\b.{0,80}\b(?:user|operator|developer)\b/i,
+        scope: "context",
+    },
+    {
+        label: "role hijack",
+        pattern: /\byou\s+are\s+(?:\w+\s+){0,4}now\s+(?:a|an|the)\s+\w+/i,
+        scope: "context",
+    },
+    {
+        label: "system prompt leak",
+        pattern: /\b(?:output|print|reveal|repeat|show)\b.{0,40}\b(?:system|initial|developer)\b.{0,20}\bprompt\b/i,
+        scope: "context",
+    },
+    {
+        label: "credential exfil command",
+        pattern: /\b(?:curl|wget|fetch|invoke-webrequest|nc)\b.{0,100}\$\{?\w*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i,
+        scope: "strict",
+    },
+    {
+        label: "ssh backdoor",
+        pattern: /authorized_keys|(?:~|\$HOME)\/\.ssh\b/i,
+        scope: "strict",
+    },
+    {
+        label: "secret file read",
+        pattern: /\bcat\b.{0,40}(?:\.env\b|\.netrc|\.pgpass|\.npmrc|\.pypirc|credentials)/i,
+        scope: "strict",
+    },
+    {
+        label: "data exfil to url",
+        pattern: /\b(?:send|post|upload|exfiltrate|transmit|curl|wget)\b.{0,80}https?:\/\//i,
+        scope: "strict",
+    },
+];
+/** Excludes ZWNJ, ZWJ, LRM, and RLM because they are load-bearing in international text and emoji. */
+const INVISIBLE_UNICODE_RE = /[\u200B\u202A-\u202E\u2060-\u2064\u2066-\u206F\uFEFF]/g;
+export function hasInvisibleUnicode(content) {
+    INVISIBLE_UNICODE_RE.lastIndex = 0;
+    return INVISIBLE_UNICODE_RE.test(content);
+}
+export function stripInvisibleUnicode(content) {
+    let removed = 0;
+    const cleaned = content.replace(INVISIBLE_UNICODE_RE, () => {
+        removed++;
+        return "";
+    });
+    return { cleaned, removed };
+}
+export function scanContextFileThreats(content, scope = "context") {
+    return THREAT_PATTERNS.filter((candidate) => (scope === "strict" || candidate.scope === "context") && candidate.pattern.test(content)).map(({ label }) => label);
+}
+//# sourceMappingURL=context-threat-scanner.js.map

package/dist/core/security/context-threat-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context-threat-scanner.js","sourceRoot":"","sources":["../../../src/core/security/context-threat-scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,eAAe,GAA0E;IAC9F;QACC,KAAK,EAAE,sBAAsB;QAC7B,OAAO,EACN,6HAA6H;QAC9H,KAAK,EAAE,SAAS;KAChB;IACD;QACC,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EACN,2IAA2I;QAC5I,KAAK,EAAE,SAAS;KAChB;IACD;QACC,KAAK,EAAE,oBAAoB;QAC3B,OAAO,EAAE,sFAAsF;QAC/F,KAAK,EAAE,SAAS;KAChB;IACD;QACC,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,wDAAwD;QACjE,KAAK,EAAE,SAAS;KAChB;IACD;QACC,KAAK,EAAE,oBAAoB;QAC3B,OAAO,EAAE,kGAAkG;QAC3G,KAAK,EAAE,SAAS;KAChB;IACD;QACC,KAAK,EAAE,0BAA0B;QACjC,OAAO,EACN,2GAA2G;QAC5G,KAAK,EAAE,QAAQ;KACf;IACD;QACC,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,wCAAwC;QACjD,KAAK,EAAE,QAAQ;KACf;IACD;QACC,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,0EAA0E;QACnF,KAAK,EAAE,QAAQ;KACf;IACD;QACC,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,2EAA2E;QACpF,KAAK,EAAE,QAAQ;KACf;CACD,CAAC;AAEF,sGAAsG;AACtG,MAAM,oBAAoB,GAAG,wDAAwD,CAAC;AAEtF,MAAM,UAAU,mBAAmB,CAAC,OAAe;IAClD,oBAAoB,CAAC,SAAS,GAAG,CAAC,CAAC;IACnC,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACpD,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAC1D,OAAO,EAAE,CAAC;QACV,OAAO,EAAE,CAAC;IACX,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,KAAK,GAAgB,SAAS;IACrF,OAAO,eAAe,CAAC,MAAM,CAC5B,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CACvG,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC","sourcesContent":["/**\n * Pure text boundary for context and durable-memory threat screening.\n *\n * Memory providers run during ordinary session construction, so this module must remain independent\n * from resource discovery, themes, package management, Jiti, and extension loading.\n */\n\nexport type ThreatScope = \"context\" | \"strict\";\n\nconst THREAT_PATTERNS: ReadonlyArray<{ label: string; pattern: RegExp; scope: ThreatScope }> = [\n\t{\n\t\tlabel: \"instruction override\",\n\t\tpattern:\n\t\t\t/\\b(?:ignore|disregard|override|bypass)\\b.{0,80}\\b(?:previous|prior|above|system|developer|agent)\\b.{0,80}\\binstructions?\\b/i,\n\t\tscope: \"context\",\n\t},\n\t{\n\t\tlabel: \"secret exfiltration\",\n\t\tpattern:\n\t\t\t/\\b(?:reveal|print|dump|exfiltrate|send|upload)\\b.{0,80}\\b(?:secrets?|tokens?|api[_ -]?keys?|credentials?|environment variables?|\\.env)\\b/i,\n\t\tscope: \"context\",\n\t},\n\t{\n\t\tlabel: \"hidden instruction\",\n\t\tpattern: /\\b(?:do not tell|don't tell|hide this from)\\b.{0,80}\\b(?:user|operator|developer)\\b/i,\n\t\tscope: \"context\",\n\t},\n\t{\n\t\tlabel: \"role hijack\",\n\t\tpattern: /\\byou\\s+are\\s+(?:\\w+\\s+){0,4}now\\s+(?:a|an|the)\\s+\\w+/i,\n\t\tscope: \"context\",\n\t},\n\t{\n\t\tlabel: \"system prompt leak\",\n\t\tpattern: /\\b(?:output|print|reveal|repeat|show)\\b.{0,40}\\b(?:system|initial|developer)\\b.{0,20}\\bprompt\\b/i,\n\t\tscope: \"context\",\n\t},\n\t{\n\t\tlabel: \"credential exfil command\",\n\t\tpattern:\n\t\t\t/\\b(?:curl|wget|fetch|invoke-webrequest|nc)\\b.{0,100}\\$\\{?\\w*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL|API)/i,\n\t\tscope: \"strict\",\n\t},\n\t{\n\t\tlabel: \"ssh backdoor\",\n\t\tpattern: /authorized_keys|(?:~|\\$HOME)\\/\\.ssh\\b/i,\n\t\tscope: \"strict\",\n\t},\n\t{\n\t\tlabel: \"secret file read\",\n\t\tpattern: /\\bcat\\b.{0,40}(?:\\.env\\b|\\.netrc|\\.pgpass|\\.npmrc|\\.pypirc|credentials)/i,\n\t\tscope: \"strict\",\n\t},\n\t{\n\t\tlabel: \"data exfil to url\",\n\t\tpattern: /\\b(?:send|post|upload|exfiltrate|transmit|curl|wget)\\b.{0,80}https?:\\/\\//i,\n\t\tscope: \"strict\",\n\t},\n];\n\n/** Excludes ZWNJ, ZWJ, LRM, and RLM because they are load-bearing in international text and emoji. */\nconst INVISIBLE_UNICODE_RE = /[\\u200B\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u206F\\uFEFF]/g;\n\nexport function hasInvisibleUnicode(content: string): boolean {\n\tINVISIBLE_UNICODE_RE.lastIndex = 0;\n\treturn INVISIBLE_UNICODE_RE.test(content);\n}\n\nexport function stripInvisibleUnicode(content: string): { cleaned: string; removed: number } {\n\tlet removed = 0;\n\tconst cleaned = content.replace(INVISIBLE_UNICODE_RE, () => {\n\t\tremoved++;\n\t\treturn \"\";\n\t});\n\treturn { cleaned, removed };\n}\n\nexport function scanContextFileThreats(content: string, scope: ThreatScope = \"context\"): string[] {\n\treturn THREAT_PATTERNS.filter(\n\t\t(candidate) => (scope === \"strict\" || candidate.scope === \"context\") && candidate.pattern.test(content),\n\t).map(({ label }) => label);\n}\n"]}

package/dist/core/session-supervision-runtime.d.ts

@@ -10,7 +10,7 @@ export interface SessionSupervisionRuntimeOptions {
     promptConfirm: (message: string) => Promise<boolean>;
     resumeWorker: (payload: ResumablePayload, parentSessionId: string) => Promise<ResumeWorkerLaunchOutcome>;
     onDiagnostic: (message: string) => void;
-    requestExit: (session: AgentSession) => void;
+    requestExit: () => Promise<void>;
 }
 /**
  * Owns the process-matrix and worktree-sync handles for the currently active session.
@@ -20,11 +20,14 @@ export interface SessionSupervisionRuntimeOptions {
 export declare class SessionSupervisionRuntime implements AgentSessionRuntimeResource {
     private readonly options;
     private generation;
+    private lifecycleTail;
     private processMatrix?;
     private worktreeSync?;
     constructor(options: SessionSupervisionRuntimeOptions);
     start(session: AgentSession): Promise<void>;
+    private startGeneration;
     stop(): Promise<void>;
+    private enqueueLifecycle;
     private stopHandles;
     private notify;
 }

package/dist/core/session-supervision-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-supervision-runtime.d.ts","sourceRoot":"","sources":["../../src/core/session-supervision-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAIN,KAAK,yBAAyB,EAE9B,MAAM,6BAA6B,CAAC;AAIrC,MAAM,WAAW,gCAAgC;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACzG,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,WAAW,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;CAC7C;AAED;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,2BAA2B;IAC5E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,aAAa,CAAC,CAA6B;IACnD,OAAO,CAAC,YAAY,CAAC,CAA4B;IAEjD,YAAY,OAAO,EAAE,gCAAgC,EAEpD;IAEK,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA4DhD;IAEK,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAG1B;YAEa,WAAW;YAQX,MAAM;CAYpB"}
+{"version":3,"file":"session-supervision-runtime.d.ts","sourceRoot":"","sources":["../../src/core/session-supervision-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAE9E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAIN,KAAK,yBAAyB,EAE9B,MAAM,6BAA6B,CAAC;AAwBrC,MAAM,WAAW,gCAAgC;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,cAAc,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IACzC,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,YAAY,EAAE,CAAC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACzG,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,WAAW,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACjC;AAED;;;;GAIG;AACH,qBAAa,yBAA0B,YAAW,2BAA2B;IAC5E,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,aAAa,CAAoC;IACzD,OAAO,CAAC,aAAa,CAAC,CAA6B;IACnD,OAAO,CAAC,YAAY,CAAC,CAA4B;IAEjD,YAAY,OAAO,EAAE,gCAAgC,EAEpD;IAED,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1C;YAEa,eAAe;IA6E7B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAGpB;IAED,OAAO,CAAC,gBAAgB;YAMV,WAAW;YAQX,MAAM;CAYpB"}

package/dist/core/session-supervision-runtime.js

@@ -1,6 +1,22 @@
 import { createAgentIdentity } from "./orchestration/agent-resume.js";
 import { getOrchestrationAgentId, getProcessTaskRef, startProcessMatrixRuntime, } from "./process-matrix/runtime.js";
 import { getBoundWorktreeLaneKey, startWorktreeSyncRuntime } from "./worktree-sync/runtime.js";
+function rejectionReasons(results) {
+    return results.flatMap((result) => (result.status === "rejected" ? [result.reason] : []));
+}
+function throwLifecycleErrors(errors, message) {
+    if (errors.length === 1)
+        throw errors[0];
+    if (errors.length > 1)
+        throw new AggregateError(errors, message);
+}
+async function stopSupervisionHandles(worktreeSync, processMatrix) {
+    const results = await Promise.allSettled([
+        Promise.resolve().then(() => worktreeSync?.stop()),
+        Promise.resolve().then(() => processMatrix?.stop()),
+    ]);
+    throwLifecycleErrors(rejectionReasons(results), "Session supervision shutdown failed.");
+}
 /**
  * Owns the process-matrix and worktree-sync handles for the currently active session.
  * Replacement stops the old generation before a new one is started, so no watcher can retain a
@@ -9,10 +25,14 @@ import { getBoundWorktreeLaneKey, startWorktreeSyncRuntime } from "./worktree-sy
 export class SessionSupervisionRuntime {
     constructor(options) {
         this.generation = 0;
+        this.lifecycleTail = Promise.resolve();
         this.options = options;
     }
-    async start(session) {
+    start(session) {
         const generation = ++this.generation;
+        return this.enqueueLifecycle(() => this.startGeneration(session, generation));
+    }
+    async startGeneration(session, generation) {
         await this.stopHandles();
         const sessionManager = session.sessionManager;
         const sessionId = sessionManager.getSessionId();
@@ -35,8 +55,8 @@ export class SessionSupervisionRuntime {
             ...(session.model ? { modelRef: `${session.model.provider}/${session.model.id}` } : {}),
             contextPointers: [],
         });
-        const [worktreeSync, processMatrix] = await Promise.all([
-            startWorktreeSyncRuntime({
+        const [worktreeResult, processMatrixResult] = await Promise.allSettled([
+            Promise.resolve().then(() => startWorktreeSyncRuntime({
                 cwd: sessionManager.getCwd(),
                 agentDir: this.options.agentDir,
                 settingsManager: session.settingsManager,
@@ -45,8 +65,8 @@ export class SessionSupervisionRuntime {
                     void this.notify(session, "worktree-sync-notice", text).catch(() => { });
                 },
                 onDiagnostic: this.options.onDiagnostic,
-            }),
-            startProcessMatrixRuntime({
+            })),
+            Promise.resolve().then(() => startProcessMatrixRuntime({
                 agentDir: this.options.agentDir,
                 agent,
                 ...(taskRef ? { taskRef } : {}),
@@ -59,26 +79,44 @@ export class SessionSupervisionRuntime {
                 promptConfirm: this.options.promptConfirm,
                 notify: (text) => this.notify(session, "process-matrix-notice", text),
                 onDiagnostic: this.options.onDiagnostic,
-                requestExit: () => this.options.requestExit(session),
-            }),
+                requestExit: this.options.requestExit,
+            })),
         ]);
+        const worktreeSync = worktreeResult.status === "fulfilled" ? worktreeResult.value : undefined;
+        const processMatrix = processMatrixResult.status === "fulfilled" ? processMatrixResult.value : undefined;
+        const startupErrors = rejectionReasons([worktreeResult, processMatrixResult]);
+        if (startupErrors.length > 0) {
+            try {
+                await stopSupervisionHandles(worktreeSync, processMatrix);
+            }
+            catch (error) {
+                startupErrors.push(error);
+            }
+            throwLifecycleErrors(startupErrors, "Session supervision startup failed.");
+            return;
+        }
         if (generation !== this.generation) {
-            await Promise.all([worktreeSync.stop(), processMatrix.stop()]);
+            await stopSupervisionHandles(worktreeSync, processMatrix);
             return;
         }
         this.worktreeSync = worktreeSync;
         this.processMatrix = processMatrix;
     }
-    async stop() {
+    stop() {
         this.generation++;
-        await this.stopHandles();
+        return this.enqueueLifecycle(() => this.stopHandles());
+    }
+    enqueueLifecycle(operation) {
+        const current = this.lifecycleTail.then(operation);
+        this.lifecycleTail = current.catch(() => { });
+        return current;
     }
     async stopHandles() {
         const worktreeSync = this.worktreeSync;
         const processMatrix = this.processMatrix;
         this.worktreeSync = undefined;
         this.processMatrix = undefined;
-        await Promise.all([worktreeSync?.stop(), processMatrix?.stop()]);
+        await stopSupervisionHandles(worktreeSync, processMatrix);
     }
     async notify(session, customType, text) {
         try {