@caupulican/pi-adaptative 0.85.4 → 0.86.1

package/dist/core/secrets/secret-vault.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"secret-vault.js","sourceRoot":"","sources":["../../../src/core/secrets/secret-vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,EAAE,EAAc,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,yBAAyB,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EACN,gBAAgB,EAChB,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,yBAAyB,EACzB,wBAAwB,EACxB,YAAY,EACZ,yBAAyB,EACzB,oBAAoB,EACpB,aAAa,EACb,cAAc,EAQd,gBAAgB,EAEhB,OAAO,EACP,YAAY,EACZ,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EAGZ,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,6BAA6B,EAC7B,iBAAiB,EACjB,eAAe,EACf,mBAAmB,EACnB,oBAAoB,GACpB,MAAM,0BAA0B,CAAC;AAalC,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,iCAAiC,EACjC,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,EAC5B,gBAAgB,GAChB,MAAM,0BAA0B,CAAC;AAElC,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QACtG,CAAC,CAAC,KAAK,CAAC,IAAI;QACZ,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC;QACJ,OAAO,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACxD,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,KAAK,UAAU,sBAAsB,CACpC,QAAgB,EAChB,QAAgB,EAChB,KAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,GAAG,KAAK,wBAAwB,CAAC,CAAC;IAC7G,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CACzB,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,qBAAqB,EAClE,GAAG,KAAK,8BAA8B,CACtC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,gBAAgB,CACzB,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,EAC/D,GAAG,KAAK,gBAAgB,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,SAAS,CAC/E,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC;YACtG,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,iDAAiD,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,OAAO,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YACnC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1F,IAAI,SAAS,KAAK,CAAC;gBAAE,MAAM;YAC3B,MAAM,IAAI,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,gBAAgB,CACzB,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB,EAC/D,GAAG,KAAK,0CAA0C,CAClD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,OAAO,IAAI,CAAC;IACb,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,QAAgB;IAC/D,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3D,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,OAAO,IAAI,CAAC;IACb,CAAC;YAAS,CAAC;QACV,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACzC,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,yCAAyC,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC;AAaD,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IACjD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,WAAW;IAYvB,YAAY,OAA2B;QAH/B,mBAAc,GAA0B,EAAE,CAAC;QAClC,8BAAyB,GAAG,IAAI,GAAG,EAAkB,CAAC;QAGtE,IAAI,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,eAAe,GAAG,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,IAAI,gBAAgB,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAC1D,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,QAAgB;QAClC,OAAO,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,UAAU;QACb,OAAO,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM;QACX,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,cAAc,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,oCAAoC,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,QAAQ,KAAK,SAAS,CAAC;IAC/B,CAAC;IAED,IAAI;QACH,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,yBAAyB,CAAC,KAAK,EAAE,CAAC;QACvC,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACjC,CAAC;IAED,6EAA6E;IAC7E,oBAAoB,CAAC,GAAW;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;IAED,oBAAoB,CAAC,GAAW;QAC/B,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IACrD,CAAC;IAED,uGAAuG;IACvG,mBAAmB,CAAC,IAAY;QAC/B,IAAI,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG;YACd,GAAG,IAAI,GAAG,CACT,IAAI,CAAC,cAAc;iBACjB,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;iBACzE,MAAM,CAAC,OAAO,CAAC,CACjB;SACD,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;gBACvB,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACpD,SAAS;YACV,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,gBAAgB,YAAY,CAAC,KAAK,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;YACpF,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,MAAM,YAAY,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,UAAkB;QAClC,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAC7C,IAAI,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,sCAAsC,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YAC7C,MAAM,OAAO,GAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YACrE,IAAI,CAAC;gBACJ,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACZ,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC9B,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;QAC9G,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,OAAiC,CAAC;QACtC,IAAI,CAAC;YACJ,MAAM,iBAAiB,GAAG,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAC9D,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,iBAAiB,KAAK,IAAI,CAAC,4BAA4B,EAAE;gBAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,CAAC;QACb,CAAC;gBAAS,CAAC;YACV,IAAI,OAAO;gBAAE,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;IACF,CAAC;IAED,KAAK,CAAC,YAAY;QACjB,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,aAAa,CAClB,OAAe,EACf,WAA+B,EAC/B,MAAsC;QAEtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,gDAAgD,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;QACpC,MAAM,gBAAgB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC7C,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,wBAAwB,IAAI,iBAAiB,CAAC,CAAC;YAC/F,CAAC;YACD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,oBAAoB,CAC/B,OAAO,EACP,WAAW,EACX,uBAAuB,CAAC,gBAAgB,CAAC,EACzC,SAAS,EACT,IAAI,CACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC3B,OAAe,EACf,WAA+B,EAC/B,QAAgB,EAChB,OAAgD;QAEhD,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe;QACvC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACrD,OAAO,IAAI,CAAC,WAAW,CACtB,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,iBAAiB,CAAC,EAAE,MAAM,EAClG,KAAK,CACL,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,WAAmB;QACxC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACpC,OAAO,sBAAsB,CAAC,WAAW,EAAE,yBAAyB,EAAE,aAAa,CAAC,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,aAAiC;QACrE,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,eAAe,GAAG,aAAa,EAAE,GAAG,CAAC,oBAAoB,CAAC,CAAC;QACjE,IAAI,eAAe,IAAI,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,MAAM,EAAE,CAAC;YACjF,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,+CAA+C,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,6BAA6B,GAAG,KAAK,CAAC;QAC1C,IAAI,4BAA4B,GAAG,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACvD,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,iBAAiB,CAAC,CAAC;YACjG,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;YAC7F,MAAM,SAAS,GAAG,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC;YACzE,IAAI,cAAuB,CAAC;YAC5B,IAAI,oBAA8B,CAAC;YACnC,IAAI,SAAS,GAA0B,EAAE,CAAC;YAC1C,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBACnC,cAAc,GAAG,IAAI,CAAC;gBACtB,oBAAoB,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACnE,CAAC;iBAAM,CAAC;gBACP,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAClC,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,EAAE,qDAAqD,CAAC,CAAC;gBACvG,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC3C,oBAAoB,GAAG,SAAS;qBAC9B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;qBAClD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,oBAAoB,CAAC,MAAM,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;oBACpD,MAAM,IAAI,gBAAgB,CACzB,kBAAkB,EAClB,2DAA2D,CAC3D,CAAC;gBACH,CAAC;gBACD,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1E,cAAc,GAAG,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC;YACzC,CAAC;YAED,kFAAkF;YAClF,6BAA6B,GAAG,MAAM,IAAI,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,CAAC;YAC3F,4BAA4B,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;YAC9E,IAAI,cAAc;gBAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;iBACjD,CAAC;gBACL,MAAM,CAAC,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;gBACnD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YAC7C,CAAC;YACD,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,CAAC;QACjD,CAAC,EAAE,IAAI,CAAC,CAAC;QACT,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;QAC1C,OAAO;YACN,OAAO,EAAE,iBAAiB;YAC1B,GAAG,MAAM;YACT,6BAA6B;YAC7B,4BAA4B;SAC5B,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,OAAe;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,CAAC;IAED,oBAAoB,CACnB,SAAiB,EACjB,OAAe;QAMf,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,mBAAmB,EAAE,iBAAiB,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY,CAAC,mBAAmB,EAAE,WAAW,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,mDAAmD,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,GAAW,EAAE,OAAgB;QAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,iBAAiB,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,EAAE;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;gBACtD,IAAI,iBAAiB,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,KAAK,iBAAiB;oBAAE,OAAO,EAAE,CAAC;gBAC1F,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ;qBAChC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;qBAC/D,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3E,IAAI,CAAC,OAAO;oBAAE,OAAO,EAAE,CAAC;gBACxB,OAAO,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CACzB,iBAAiB,EACjB,iBAAiB;oBAChB,CAAC,CAAC,kBAAkB,iBAAiB,kCAAkC;oBACvE,CAAC,CAAC,+CAA+C,CAClD,CAAC;YACH,CAAC;YACD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACxF,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;YAC1F,IAAI,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YAC1B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAC1B,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,SAAS,CAAC,OAAO,CAClG,CAAC;gBACF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACb,MAAM,IAAI,gBAAgB,CACzB,mBAAmB,EACnB,+EAA+E,CAC/E,CAAC;gBACH,CAAC;gBACD,QAAQ,GAAG,MAAM,CAAC;YACnB,CAAC;YACD,MAAM,MAAM,GAAG,6BAA6B,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACxE,OAAO;gBACN,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO;gBACnC,GAAG,QAAQ,CAAC,OAAO;gBACnB,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC1E,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;aAChE,CAAC;QACH,CAAC,EAAE,KAAK,CAAC,CAAC;IACX,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,WAAmB,EAAE,OAAe;QAC/D,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC3B,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAChC,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,iDAAiD,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,kDAAkD,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,MAAM,cAAc,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtF,IAAI,SAAS,KAAK,GAAG,yBAAyB,GAAG,OAAO,EAAE;YAAE,OAAO,iBAAiB,CAAC;QACrF,IAAI,SAAS,CAAC,UAAU,CAAC,yBAAyB,CAAC;YAAE,OAAO,eAAe,CAAC;QAC5E,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,cAAc,CACnB,OAAe,EACf,WAAmB,EACnB,OAAO,GAKH,EAAE;QAEN,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;QACvF,MAAM,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAC7E,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;gBACjF,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,8CAA8C,CAAC,CAAC;YACnG,CAAC;YACD,MAAM,sBAAsB,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACP,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC;gBAC5B,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,8CAA8C,CAAC,CAAC;YACnG,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,iBAAiB,CAAC,CAAC;YAC7F,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,gCAAgC,CAAC,CAAC;YAC7F,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CACnC,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,CACvF,CAAC;YACF,MAAM,aAAa,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACrG,MAAM,iBAAiB,GAAG,aAAa;gBACtC,CAAC,CAAC,MAAM,CAAC,QAAQ;qBACd,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;qBACvE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAC3E,CAAC,CAAC,OAAO,CAAC;YACX,IAAI,aAAa,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzC,MAAM,IAAI,gBAAgB,CACzB,iBAAiB,EACjB,kBAAkB,iBAAiB,kCAAkC,CACrE,CAAC;YACH,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC/F,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;YACtF,MAAM,IAAI,CAAC,4BAA4B,CAAC,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAC5E,MAAM,aAAa,GAAG,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC9G,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC;YACjF,IAAI,MAAM,GAAG,GAAG,yBAAyB,GAAG,iBAAiB,gFAAgF,IAAI,EAAE,CAAC;YACpJ,IAAI,CAAC;gBACJ,MAAM,eAAe,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC5D,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;gBAC1C,IAAI,iBAAiB,EAAE,CAAC;oBACvB,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;gBACpF,CAAC;YACF,CAAC;oBAAS,CAAC;gBACV,MAAM,GAAG,EAAE,CAAC;YACb,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;QACnF,CAAC,EAAE,KAAK,CAAC,CAAC;IACX,CAAC;IAEO,KAAK,CAAC,oBAAoB,CACjC,OAAe,EACf,WAA+B,EAC/B,QAAgB,EAChB,OAA2D,EAC3D,KAAc;QAEd,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,qBAAqB,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAC/D,MAAM,cAAc,GAAG,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnG,MAAM,iBAAiB,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAExG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YACxD,IAAI,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,iBAAiB,CAAC,CAAC;YAC3F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,YAAY,EAAE,CAAC;gBACxD,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,iCAAiC,YAAY,YAAY,CAAC,CAAC;YACxG,CAAC;YACD,MAAM,YAAY,GAAG,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3E,IAAI,iBAAiB,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,EAAE,GAAG,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;gBAC5D,MAAM,aAAa,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,iBAAiB,CAAC,SAAS,CAAC,CAAC;gBACzG,IAAI,aAAa,KAAK,CAAC,CAAC;oBAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;oBAC7C,YAAY,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC;gBACxC,IAAI,YAAY,CAAC,MAAM,GAAG,wBAAwB,EAAE,CAAC;oBACpD,MAAM,IAAI,gBAAgB,CACzB,eAAe,EACf,qCAAqC,wBAAwB,sBAAsB,CACnF,CAAC;gBACH,CAAC;YACF,CAAC;YAED,IAAI,YAAY,GAAG,cAAc,CAAC,QAAQ,CAAC;YAC3C,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;gBACrB,MAAM,MAAM,GAAG,IAAI,GAAG,CACrB,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;oBACxE,QAAQ,CAAC,IAAI;oBACb,QAAQ,CAAC,KAAK;iBACd,CAAC,CACF,CAAC;gBACF,KAAK,MAAM,QAAQ,IAAI,cAAc,CAAC,SAAS;oBAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC3F,IAAI,MAAM,CAAC,IAAI,GAAG,yBAAyB,EAAE,CAAC;oBAC7C,MAAM,IAAI,gBAAgB,CACzB,gBAAgB,EAChB,qCAAqC,yBAAyB,aAAa,CAC3E,CAAC;gBACH,CAAC;gBACD,YAAY,GAAG,uBAAuB,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/F,CAAC;YAED,IAAI,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,CAAC,4BAA4B,CAAC,iBAAiB,CAAC,CAAC;gBAC3D,MAAM,IAAI,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAAC;YAChD,CAAC;iBAAM,CAAC;gBACP,MAAM,GAAG;oBACR,OAAO,EAAE,iBAAiB;oBAC1B,SAAS,EAAE,SAAS;oBACpB,SAAS,EAAE,SAAS;oBACpB,MAAM,EAAE,YAAY;oBACpB,QAAQ,EAAE,EAAE;iBACZ,CAAC;gBACF,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC;YACD,IAAI,qBAAqB,KAAK,SAAS;gBAAE,MAAM,CAAC,WAAW,GAAG,qBAAqB,CAAC;YACpF,MAAM,CAAC,MAAM,GAAG,YAAY,CAAC;YAC7B,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC,IAAI,CAClC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAC3G,CAAC;YACF,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;YAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAClF,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC,EAAE,IAAI,CAAC,CAAC;QACT,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,4BAA4B,CACzC,WAAmB,EACnB,KAAgC,EAChC,OAA+E;QAE/E,IAAI,KAAK,KAAK,eAAe,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CACzB,sBAAsB,EACtB,yEAAyE,CACzE,CAAC;QACH,CAAC;QACD,IAAI,KAAK,KAAK,WAAW;YAAE,OAAO;QAClC,IAAI,CAAC,OAAO,CAAC,qBAAqB,IAAI,OAAO,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;YACtF,MAAM,IAAI,gBAAgB,CACzB,sBAAsB,EACtB,uFAAuF,CACvF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,KAAK,OAAO,CAAC,wBAAwB,EAAE,CAAC;YACpF,MAAM,IAAI,gBAAgB,CACzB,sBAAsB,EACtB,wEAAwE,CACxE,CAAC;QACH,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,4BAA4B,CAAC,OAA6B,EAAE,WAAmB;QAC5F,IAAI,CAAC;YACJ,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC7C,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC9B,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;aACjC,CAAC,CAAC;YACH,IAAI,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC;gBAAE,OAAO;QAC7C,CAAC;QAAC,MAAM,CAAC;YACR,wFAAwF;QACzF,CAAC;QACD,MAAM,IAAI,gBAAgB,CACzB,qBAAqB,EACrB,oFAAoF,CACpF,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,WAAmB;QAC5C,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,gBAAgB,CACzB,qBAAqB,EACrB,+DAA+D,CAC/D,CAAC;QACH,CAAC;IACF,CAAC;IAEO,gBAAgB,CAAC,GAAW,EAAE,GAAa;QAClD,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;IAC7B,CAAC;IAEO,gBAAgB;QACvB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3C,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,EAAE,CAAC;IAC1B,CAAC;IAEO,iBAAiB,CAAC,OAAe;QACxC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACzE,IAAI,aAAa,KAAK,OAAO;gBAAE,SAAS;YACxC,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,OAAO,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QACtF,IAAI,MAAM,EAAE,CAAC;YACZ,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7D,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,OAAO;YAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC;IAC9C,CAAC;IAEO,wBAAwB;QAC/B,IAAI,CAAC;YACJ,IAAI,CAAC,oBAAoB,EAAE,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACR,qFAAqF;QACtF,CAAC;IACF,CAAC;IAEO,4BAA4B;QACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3C,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ;iBACrC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC;iBAC9F,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YACvE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,KAAK,MAAM,OAAO,IAAI,cAAc;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;YACtG,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC1C,IAAI,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YACnG,CAAC;QACF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAEO,kBAAkB,CAAC,OAAqB;QAC/C,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACxD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YAC7D,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAC/B,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,OAAO,CACtF;gBACA,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;gBACpF,CAAC,CAAC,EAAE;SACL,CAAC,CAAC,CAAC;QACJ,KAAK,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;YACnE,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAC1C,CAAC,SAAS,EAAE,EAAE,CACb,SAAS,CAAC,OAAO,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CACvG,CAAC;YACF,IAAI,CAAC,UAAU;gBAAE,IAAI,CAAC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;IACF,CAAC;IAEO,oBAAoB,CAC3B,GAAW;QAEX,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,cAAc;aACxB,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YACpB,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ;iBAC9B,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;iBACrE,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3E,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;aACxG,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,CAAC;IAEO,eAAe;QACtB,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACxC,MAAM,IAAI,gBAAgB,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IACrD,CAAC;IAEO,KAAK,CAAC,WAAW,CAAI,SAAoD,EAAE,KAAc;QAChG,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;YAC9C,MAAM,iBAAiB,GAAG,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAC9D,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAC5C,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,kCAAkC,CAAC,CAAC;YACnF,CAAC;YACD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACZ,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,kDAAkD,CAAC,CAAC;YACjG,CAAC;YACD,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACtD,IAAI,CAAC;gBACJ,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;gBACxC,IAAI,KAAK;oBAAE,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;gBACvD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;gBACjC,IAAI,iBAAiB,KAAK,IAAI,CAAC,4BAA4B,EAAE;oBAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC;gBAC/F,OAAO,MAAM,CAAC;YACf,CAAC;oBAAS,CAAC;gBACV,YAAY,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;QACF,CAAC,CAAC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAa,EAAE,OAAqB,EAAE,GAAW;QAC5E,IAAI,UAAU,GAAG,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC;YACJ,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACnE,MAAM,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9C,CAAC;gBAAS,CAAC;YACV,UAAU,GAAG,EAAE,CAAC;QACjB,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,2BAA2B,CAAC,MAGzC;QACA,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YAChE,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5E,IAAI,KAAK,KAAK,iBAAiB;gBAAE,SAAS;YAC1C,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC7B,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,4BAA4B,CAAC,OAAe;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,QAAQ,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,sCAAsC,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,KAAK,KAAK,iBAAiB;YAAE,OAAO,KAAK,CAAC;QAC9C,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;CACD","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { constants, promises as fs, type Stats } from \"node:fs\";\nimport { dirname, isAbsolute, join, relative, resolve, sep } from \"node:path\";\nimport { managedSecretEnvDir, secretsDir, secretVaultFile } from \"../agent-paths.ts\";\nimport { redactKnownSecrets } from \"../security/secret-text.ts\";\nimport { withFileLock, writeFileAtomic } from \"../util/atomic-file.ts\";\nimport { MAX_DOTENV_DOCUMENT_BYTES, parseDotenvDocument } from \"./secret-dotenv.ts\";\nimport {\n\tassertPassphrase,\n\tcreateVaultKdf,\n\tDEFAULT_SCRYPT_N,\n\tdecryptPayload,\n\tderiveKey,\n\tMANAGED_ENV_HEADER_PREFIX,\n\tMAX_BINDINGS_PER_PROFILE,\n\tMAX_PROFILES,\n\tMAX_VARIABLES_PER_PROFILE,\n\tMAX_VAULT_FILE_BYTES,\n\tparseEnvelope,\n\tprofileSummary,\n\ttype SecretBindingResolution,\n\ttype SecretBindingSummary,\n\ttype SecretEnvDestinationState,\n\ttype SecretMaterializationResult,\n\ttype SecretProfileSummary,\n\ttype SecretRemovalResult,\n\ttype SecretVariableValue,\n\tSecretVaultError,\n\ttype SecretVaultOptions,\n\tsameKdf,\n\tscrubPayload,\n\tserializeEnvelope,\n\tserializeVariableValues,\n\tVAULT_MARKER,\n\ttype VaultKdf,\n\ttype VaultPayload,\n\tvalidateBindingEnvFile,\n\tvalidateBindingWorkspace,\n\tvalidateDescription,\n\tvalidateDotenvProfileDocument,\n\tvalidateProfileId,\n\tvalidateScryptN,\n\tvalidateSecretValue,\n\tvalidateVariableName,\n} from \"./secret-vault-format.ts\";\n\nexport type {\n\tSecretBindingResolution,\n\tSecretBindingSummary,\n\tSecretEnvDestinationState,\n\tSecretMaterializationResult,\n\tSecretProfileSummary,\n\tSecretRemovalResult,\n\tSecretVariableValue,\n\tSecretVaultErrorCode,\n\tSecretVaultOptions,\n} from \"./secret-vault-format.ts\";\nexport {\n\tMAX_BINDINGS_PER_PROFILE,\n\tMAX_VARIABLES_PER_PROFILE,\n\tSECRET_DESCRIPTION_MAX_CHARS,\n\tSECRET_PRINTABLE_METADATA_PATTERN,\n\tSECRET_PROFILE_ID_MAX_CHARS,\n\tSECRET_PROFILE_ID_PATTERN,\n\tSECRET_VARIABLE_NAME_MAX_CHARS,\n\tSECRET_VARIABLE_NAME_PATTERN,\n\tSecretVaultError,\n} from \"./secret-vault-format.ts\";\n\nfunction nodeErrorCode(error: unknown): string | undefined {\n\treturn typeof error === \"object\" && error !== null && \"code\" in error && typeof error.code === \"string\"\n\t\t? error.code\n\t\t: undefined;\n}\n\nasync function lstatIfExists(path: string): Promise<Stats | undefined> {\n\ttry {\n\t\treturn await fs.lstat(path);\n\t} catch (error) {\n\t\tif (nodeErrorCode(error) === \"ENOENT\") return undefined;\n\t\tthrow error;\n\t}\n}\n\nasync function readBoundedRegularFile(\n\tfilePath: string,\n\tmaxBytes: number,\n\tlabel: \"Secret vault\" | \"Dotenv file\",\n): Promise<string> {\n\tconst before = await fs.lstat(filePath);\n\tif (before.isSymbolicLink()) throw new SecretVaultError(\"symlink_refused\", `${label} symlinks are refused.`);\n\tif (!before.isFile()) {\n\t\tthrow new SecretVaultError(\n\t\t\tlabel === \"Secret vault\" ? \"vault_corrupt\" : \"destination_invalid\",\n\t\t\t`${label} path is not a regular file.`,\n\t\t);\n\t}\n\tif (before.size > maxBytes) {\n\t\tthrow new SecretVaultError(\n\t\t\tlabel === \"Secret vault\" ? \"vault_too_large\" : \"invalid_dotenv\",\n\t\t\t`${label} exceeds its ${label === \"Secret vault\" ? \"4 MiB\" : \"512 KiB\"} limit.`,\n\t\t);\n\t}\n\tconst handle = await fs.open(filePath, constants.O_RDONLY);\n\ttry {\n\t\tconst opened = await handle.stat();\n\t\tif ((before.dev !== opened.dev || before.ino !== opened.ino) && before.ino !== 0 && opened.ino !== 0) {\n\t\t\tthrow new SecretVaultError(\"symlink_refused\", \"Secret vault changed while it was being opened.\");\n\t\t}\n\t\tconst output = Buffer.alloc(Math.min(maxBytes + 1, before.size + 1));\n\t\tlet offset = 0;\n\t\twhile (offset < output.byteLength) {\n\t\t\tconst { bytesRead } = await handle.read(output, offset, output.byteLength - offset, null);\n\t\t\tif (bytesRead === 0) break;\n\t\t\toffset += bytesRead;\n\t\t}\n\t\tif (offset > before.size || offset > maxBytes) {\n\t\t\toutput.fill(0);\n\t\t\tthrow new SecretVaultError(\n\t\t\t\tlabel === \"Secret vault\" ? \"vault_too_large\" : \"invalid_dotenv\",\n\t\t\t\t`${label} grew beyond its limit while being read.`,\n\t\t\t);\n\t\t}\n\t\tconst text = output.toString(\"utf8\", 0, offset);\n\t\toutput.fill(0);\n\t\treturn text;\n\t} finally {\n\t\tawait handle.close();\n\t}\n}\n\nasync function readBoundedFile(filePath: string): Promise<string> {\n\treturn readBoundedRegularFile(filePath, MAX_VAULT_FILE_BYTES, \"Secret vault\");\n}\n\nasync function readFilePrefix(filePath: string, maxBytes: number): Promise<string> {\n\tconst handle = await fs.open(filePath, constants.O_RDONLY);\n\ttry {\n\t\tconst output = Buffer.alloc(maxBytes);\n\t\tconst { bytesRead } = await handle.read(output, 0, output.byteLength, 0);\n\t\tconst text = output.toString(\"utf8\", 0, bytesRead);\n\t\toutput.fill(0);\n\t\treturn text;\n\t} finally {\n\t\tawait handle.close();\n\t}\n}\n\nasync function ensurePrivateDirectory(path: string): Promise<void> {\n\tconst existing = await lstatIfExists(path);\n\tif (existing?.isSymbolicLink()) {\n\t\tthrow new SecretVaultError(\"symlink_refused\", \"Secret storage directory symlinks are refused.\");\n\t}\n\tif (existing && !existing.isDirectory()) {\n\t\tthrow new SecretVaultError(\"destination_invalid\", \"Secret storage path is not a directory.\");\n\t}\n\tawait fs.mkdir(path, { recursive: true, mode: 0o700 });\n\tif (process.platform !== \"win32\") await fs.chmod(path, 0o700);\n}\n\nasync function enforcePrivateFileMode(path: string): Promise<void> {\n\tif (process.platform !== \"win32\") await fs.chmod(path, 0o600);\n}\n\ninterface CachedSecretVariable {\n\tname: string;\n\tvalue: string;\n}\n\ninterface CachedSecretProfile {\n\tprofile: string;\n\tbindings: SecretBindingSummary[];\n\tvariables: CachedSecretVariable[];\n}\n\nfunction isPathInside(root: string, target: string): boolean {\n\tconst fromRoot = relative(root, target);\n\treturn fromRoot === \"\" || (!fromRoot.startsWith(`..${sep}`) && fromRoot !== \"..\" && !isAbsolute(fromRoot));\n}\n\nfunction escapeRegExp(value: string): string {\n\treturn value.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n}\n\n/**\n * Encrypted generic credential vault. Only the derived key is retained in memory, until this\n * process explicitly locks the vault or exits. The native model-facing tool receives summaries,\n * never decrypted values or materialization paths.\n */\nexport class SecretVault {\n\treadonly vaultPath: string;\n\treadonly materializedDir: string;\n\tprivate readonly rootDir: string;\n\tprivate readonly scryptN: number;\n\tprivate readonly now: () => Date;\n\tprivate readonly onEnvironmentChanged: (() => void) | undefined;\n\tprivate cachedKey: Buffer | undefined;\n\tprivate cachedKdf: VaultKdf | undefined;\n\tprivate cachedProfiles: CachedSecretProfile[] = [];\n\tprivate readonly activeProfilesByWorkspace = new Map<string, string>();\n\n\tconstructor(options: SecretVaultOptions) {\n\t\tthis.rootDir = secretsDir(options.agentDir);\n\t\tthis.vaultPath = secretVaultFile(options.agentDir);\n\t\tthis.materializedDir = managedSecretEnvDir(options.agentDir);\n\t\tthis.scryptN = validateScryptN(options.scryptN ?? DEFAULT_SCRYPT_N);\n\t\tthis.now = options.now ?? (() => new Date());\n\t\tthis.onEnvironmentChanged = options.onEnvironmentChanged;\n\t}\n\n\tstatic forAgentDir(agentDir: string): SecretVault {\n\t\treturn new SecretVault({ agentDir });\n\t}\n\n\tget isUnlocked(): boolean {\n\t\treturn this.cachedKey !== undefined;\n\t}\n\n\tasync exists(): Promise<boolean> {\n\t\tconst existing = await lstatIfExists(this.vaultPath);\n\t\tif (existing?.isSymbolicLink()) {\n\t\t\tthrow new SecretVaultError(\"symlink_refused\", \"Secret vault symlinks are refused.\");\n\t\t}\n\t\treturn existing !== undefined;\n\t}\n\n\tlock(): void {\n\t\tthis.cachedKey?.fill(0);\n\t\tthis.cachedKey = undefined;\n\t\tthis.cachedKdf = undefined;\n\t\tthis.clearSecretCache();\n\t\tthis.activeProfilesByWorkspace.clear();\n\t\tthis.notifyEnvironmentChanged();\n\t}\n\n\t/** Environment for the nearest explicitly activated profile covering cwd. */\n\tgetEnvironmentForCwd(cwd: string): NodeJS.ProcessEnv {\n\t\tconst match = this.resolveCachedProfile(cwd);\n\t\tif (!match) return {};\n\t\treturn Object.fromEntries(match.profile.variables.map((variable) => [variable.name, variable.value]));\n\t}\n\n\thasEnvironmentForCwd(cwd: string): boolean {\n\t\treturn this.resolveCachedProfile(cwd) !== undefined;\n\t}\n\n\t/** Remove exact unlocked vault values and high-confidence credential shapes from model-facing text. */\n\tredactSensitiveText(text: string): string {\n\t\tlet redacted = redactKnownSecrets(text);\n\t\tconst values = [\n\t\t\t...new Set(\n\t\t\t\tthis.cachedProfiles\n\t\t\t\t\t.flatMap((profile) => profile.variables.map((variable) => variable.value))\n\t\t\t\t\t.filter(Boolean),\n\t\t\t),\n\t\t].sort((left, right) => right.length - left.length);\n\t\tfor (const value of values) {\n\t\t\tif (value.length >= 4) {\n\t\t\t\tredacted = redacted.split(value).join(\"[REDACTED]\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst bounded = new RegExp(`(^|[\\\\s=:;,])${escapeRegExp(value)}(?=$|[\\\\s,;])`, \"g\");\n\t\t\tredacted = redacted.replace(bounded, (_match, prefix: string) => `${prefix}[REDACTED]`);\n\t\t}\n\t\treturn redacted;\n\t}\n\n\tasync initialize(passphrase: string): Promise<void> {\n\t\tassertPassphrase(passphrase, true);\n\t\tawait ensurePrivateDirectory(this.rootDir);\n\t\tawait withFileLock(this.vaultPath, async () => {\n\t\t\tif (await lstatIfExists(this.vaultPath)) {\n\t\t\t\tthrow new SecretVaultError(\"already_initialized\", \"Secret vault is already initialized.\");\n\t\t\t}\n\t\t\tconst kdf = createVaultKdf(this.scryptN);\n\t\t\tconst key = await deriveKey(passphrase, kdf);\n\t\t\tconst payload: VaultPayload = { marker: VAULT_MARKER, profiles: [] };\n\t\t\ttry {\n\t\t\t\tawait this.writeEnvelope(kdf, payload, key);\n\t\t\t\tthis.replaceCachedKey(key, kdf);\n\t\t\t} catch (error) {\n\t\t\t\tkey.fill(0);\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t});\n\t}\n\n\tasync unlock(passphrase: string): Promise<void> {\n\t\tassertPassphrase(passphrase, false);\n\t\tif (!(await this.exists())) throw new SecretVaultError(\"not_initialized\", \"Secret vault is not initialized.\");\n\t\tconst envelope = parseEnvelope(await readBoundedFile(this.vaultPath));\n\t\tconst key = await deriveKey(passphrase, envelope.kdf);\n\t\tlet payload: VaultPayload | undefined;\n\t\ttry {\n\t\t\tconst environmentBefore = this.activeEnvironmentFingerprint();\n\t\t\tpayload = decryptPayload(envelope.payload, key);\n\t\t\tthis.replaceCachedKey(key, envelope.kdf);\n\t\t\tthis.refreshSecretCache(payload);\n\t\t\tif (environmentBefore !== this.activeEnvironmentFingerprint()) this.notifyEnvironmentChanged();\n\t\t} catch (error) {\n\t\t\tkey.fill(0);\n\t\t\tthrow error;\n\t\t} finally {\n\t\t\tif (payload) scrubPayload(payload);\n\t\t}\n\t}\n\n\tasync listProfiles(): Promise<SecretProfileSummary[]> {\n\t\treturn this.withPayload((payload) => payload.profiles.map(profileSummary), false);\n\t}\n\n\tasync upsertProfile(\n\t\tprofile: string,\n\t\tdescription: string | undefined,\n\t\tvalues: readonly SecretVariableValue[],\n\t): Promise<SecretProfileSummary> {\n\t\tif (values.length === 0) {\n\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"At least one environment variable is required.\");\n\t\t}\n\t\tconst seenNames = new Set<string>();\n\t\tconst normalizedValues = values.map((entry) => {\n\t\t\tconst name = validateVariableName(entry.name);\n\t\t\tif (seenNames.has(name)) {\n\t\t\t\tthrow new SecretVaultError(\"invalid_variable\", `Environment variable ${name} is duplicated.`);\n\t\t\t}\n\t\t\tseenNames.add(name);\n\t\t\treturn { name, value: validateSecretValue(entry.value) };\n\t\t});\n\t\treturn this.storeProfileDocument(\n\t\t\tprofile,\n\t\t\tdescription,\n\t\t\tserializeVariableValues(normalizedValues),\n\t\t\tundefined,\n\t\t\ttrue,\n\t\t);\n\t}\n\n\tasync replaceProfileDocument(\n\t\tprofile: string,\n\t\tdescription: string | undefined,\n\t\tdocument: string,\n\t\tbinding?: { workspace: string; envFile: string },\n\t): Promise<SecretProfileSummary> {\n\t\treturn this.storeProfileDocument(profile, description, document, binding, false);\n\t}\n\n\tasync getProfileDocument(profile: string): Promise<string | undefined> {\n\t\tconst normalizedProfile = validateProfileId(profile);\n\t\treturn this.withPayload(\n\t\t\t(payload) => payload.profiles.find((candidate) => candidate.profile === normalizedProfile)?.dotenv,\n\t\t\tfalse,\n\t\t);\n\t}\n\n\tasync readOwnerDotenv(destination: string): Promise<string> {\n\t\tthis.assertDestination(destination);\n\t\treturn readBoundedRegularFile(destination, MAX_DOTENV_DOCUMENT_BYTES, \"Dotenv file\");\n\t}\n\n\tasync removeProfile(profile: string, variableNames?: readonly string[]): Promise<SecretRemovalResult> {\n\t\tconst normalizedProfile = validateProfileId(profile);\n\t\tconst normalizedNames = variableNames?.map(validateVariableName);\n\t\tif (normalizedNames && new Set(normalizedNames).size !== normalizedNames.length) {\n\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"Environment variable removals are duplicated.\");\n\t\t}\n\t\tlet managedMaterializationRemoved = false;\n\t\tlet boundMaterializationsRemoved = 0;\n\t\tconst result = await this.withPayload(async (payload) => {\n\t\t\tconst index = payload.profiles.findIndex((candidate) => candidate.profile === normalizedProfile);\n\t\t\tconst record = payload.profiles[index];\n\t\t\tif (!record) throw new SecretVaultError(\"profile_missing\", \"Secret profile does not exist.\");\n\t\t\tconst variables = validateDotenvProfileDocument(record.dotenv).variables;\n\t\t\tlet removedProfile: boolean;\n\t\t\tlet removedVariableNames: string[];\n\t\t\tlet remaining: SecretVariableValue[] = [];\n\t\t\tif (normalizedNames === undefined) {\n\t\t\t\tremovedProfile = true;\n\t\t\t\tremovedVariableNames = variables.map((variable) => variable.name);\n\t\t\t} else {\n\t\t\t\tif (normalizedNames.length === 0) {\n\t\t\t\t\tthrow new SecretVaultError(\"invalid_variable\", \"Select at least one environment variable to remove.\");\n\t\t\t\t}\n\t\t\t\tconst requested = new Set(normalizedNames);\n\t\t\t\tremovedVariableNames = variables\n\t\t\t\t\t.filter((variable) => requested.has(variable.name))\n\t\t\t\t\t.map((variable) => variable.name);\n\t\t\t\tif (removedVariableNames.length !== requested.size) {\n\t\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\t\"invalid_variable\",\n\t\t\t\t\t\t\"One or more requested environment variables do not exist.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tremaining = variables.filter((variable) => !requested.has(variable.name));\n\t\t\t\tremovedProfile = remaining.length === 0;\n\t\t\t}\n\n\t\t\t// Validate the complete mutation before removing any recoverable materialization.\n\t\t\tmanagedMaterializationRemoved = await this.removeManagedMaterialization(normalizedProfile);\n\t\t\tboundMaterializationsRemoved = await this.removeBoundMaterializations(record);\n\t\t\tif (removedProfile) payload.profiles.splice(index, 1);\n\t\t\telse {\n\t\t\t\trecord.dotenv = serializeVariableValues(remaining);\n\t\t\t\trecord.updatedAt = this.now().toISOString();\n\t\t\t}\n\t\t\treturn { removedProfile, removedVariableNames };\n\t\t}, true);\n\t\tthis.deactivateProfile(normalizedProfile);\n\t\treturn {\n\t\t\tprofile: normalizedProfile,\n\t\t\t...result,\n\t\t\tmanagedMaterializationRemoved,\n\t\t\tboundMaterializationsRemoved,\n\t\t};\n\t}\n\n\tgetManagedEnvPath(profile: string): string {\n\t\treturn join(this.materializedDir, `${validateProfileId(profile)}.env`);\n\t}\n\n\tresolveBindingTarget(\n\t\tworkspace: string,\n\t\tenvFile: string,\n\t): {\n\t\tworkspace: string;\n\t\tenvFile: string;\n\t\tdestination: string;\n\t} {\n\t\tconst normalizedWorkspace = validateBindingWorkspace(resolve(workspace));\n\t\tconst normalizedEnvFile = validateBindingEnvFile(envFile);\n\t\tconst destination = resolve(normalizedWorkspace, normalizedEnvFile);\n\t\tif (!isPathInside(normalizedWorkspace, destination)) {\n\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Credential target must stay inside its workspace.\");\n\t\t}\n\t\treturn { workspace: normalizedWorkspace, envFile: normalizedEnvFile, destination };\n\t}\n\n\tasync resolveBindingForWorkspace(cwd: string, profile?: string): Promise<SecretBindingResolution> {\n\t\tconst normalizedCwd = resolve(cwd);\n\t\tconst normalizedProfile = profile === undefined ? undefined : validateProfileId(profile);\n\t\treturn this.withPayload((payload) => {\n\t\t\tconst matches = payload.profiles.flatMap((candidate) => {\n\t\t\t\tif (normalizedProfile !== undefined && candidate.profile !== normalizedProfile) return [];\n\t\t\t\tconst binding = candidate.bindings\n\t\t\t\t\t.filter((entry) => isPathInside(entry.workspace, normalizedCwd))\n\t\t\t\t\t.sort((left, right) => right.workspace.length - left.workspace.length)[0];\n\t\t\t\tif (!binding) return [];\n\t\t\t\treturn [{ candidate, binding }];\n\t\t\t});\n\t\t\tif (matches.length === 0) {\n\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\"binding_missing\",\n\t\t\t\t\tnormalizedProfile\n\t\t\t\t\t\t? `Secret profile ${normalizedProfile} is not bound to this workspace.`\n\t\t\t\t\t\t: \"No secret profile is bound to this workspace.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst longestRoot = Math.max(...matches.map((match) => match.binding.workspace.length));\n\t\t\tconst nearest = matches.filter((match) => match.binding.workspace.length === longestRoot);\n\t\t\tlet selected = nearest[0];\n\t\t\tif (nearest.length > 1) {\n\t\t\t\tconst active = nearest.find(\n\t\t\t\t\t(match) => this.activeProfilesByWorkspace.get(match.binding.workspace) === match.candidate.profile,\n\t\t\t\t);\n\t\t\t\tif (!active) {\n\t\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\t\"ambiguous_binding\",\n\t\t\t\t\t\t\"Multiple secret profiles apply to this workspace; select one by profile name.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tselected = active;\n\t\t\t}\n\t\t\tconst parsed = validateDotenvProfileDocument(selected.candidate.dotenv);\n\t\t\treturn {\n\t\t\t\tprofile: selected.candidate.profile,\n\t\t\t\t...selected.binding,\n\t\t\t\tdestination: resolve(selected.binding.workspace, selected.binding.envFile),\n\t\t\t\tvariableNames: parsed.variables.map((variable) => variable.name),\n\t\t\t};\n\t\t}, false);\n\t}\n\n\tasync inspectEnvDestination(destination: string, profile: string): Promise<SecretEnvDestinationState> {\n\t\tvalidateProfileId(profile);\n\t\tthis.assertDestination(destination);\n\t\tconst existing = await lstatIfExists(destination);\n\t\tif (!existing) return \"missing\";\n\t\tif (existing.isSymbolicLink()) {\n\t\t\tthrow new SecretVaultError(\"symlink_refused\", \"Secret dotenv destination symlinks are refused.\");\n\t\t}\n\t\tif (!existing.isFile()) {\n\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Secret dotenv destination is not a regular file.\");\n\t\t}\n\t\tconst firstLine = (await readFilePrefix(destination, 512)).split(/\\r?\\n/, 1)[0] ?? \"\";\n\t\tif (firstLine === `${MANAGED_ENV_HEADER_PREFIX}${profile}`) return \"managed-profile\";\n\t\tif (firstLine.startsWith(MANAGED_ENV_HEADER_PREFIX)) return \"managed-other\";\n\t\treturn \"unmanaged\";\n\t}\n\n\tasync materializeEnv(\n\t\tprofile: string,\n\t\tdestination: string,\n\t\toptions: {\n\t\t\tactivationWorkspace?: string;\n\t\t\tallowReplaceUnmanaged?: boolean;\n\t\t\texpectedUnmanagedContent?: string;\n\t\t\tmanaged?: boolean;\n\t\t} = {},\n\t): Promise<SecretMaterializationResult> {\n\t\tconst normalizedProfile = validateProfileId(profile);\n\t\tthis.assertDestination(destination);\n\t\tconst previousState = await this.inspectEnvDestination(destination, normalizedProfile);\n\t\tawait this.assertReplaceableDestination(destination, previousState, options);\n\t\tif (options.managed) {\n\t\t\tif (resolve(destination) !== resolve(this.getManagedEnvPath(normalizedProfile))) {\n\t\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Managed dotenv destination is not canonical.\");\n\t\t\t}\n\t\t\tawait ensurePrivateDirectory(this.materializedDir);\n\t\t} else {\n\t\t\tconst parent = await lstatIfExists(dirname(destination));\n\t\t\tif (!parent?.isDirectory()) {\n\t\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Dotenv destination directory does not exist.\");\n\t\t\t}\n\t\t}\n\t\treturn this.withPayload(async (payload) => {\n\t\t\tconst record = payload.profiles.find((candidate) => candidate.profile === normalizedProfile);\n\t\t\tif (!record) throw new SecretVaultError(\"profile_missing\", \"Secret profile does not exist.\");\n\t\t\tconst binding = record.bindings.find(\n\t\t\t\t(candidate) => resolve(candidate.workspace, candidate.envFile) === resolve(destination),\n\t\t\t);\n\t\t\tconst activationCwd = options.activationWorkspace ? resolve(options.activationWorkspace) : undefined;\n\t\t\tconst activationBinding = activationCwd\n\t\t\t\t? record.bindings\n\t\t\t\t\t\t.filter((candidate) => isPathInside(candidate.workspace, activationCwd))\n\t\t\t\t\t\t.sort((left, right) => right.workspace.length - left.workspace.length)[0]\n\t\t\t\t: binding;\n\t\t\tif (activationCwd && !activationBinding) {\n\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\"binding_missing\",\n\t\t\t\t\t`Secret profile ${normalizedProfile} is not bound to this workspace.`,\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (binding && !options.managed) await this.assertBoundDestinationParent(binding, destination);\n\t\t\tconst currentState = await this.inspectEnvDestination(destination, normalizedProfile);\n\t\t\tawait this.assertReplaceableDestination(destination, currentState, options);\n\t\t\tconst variableNames = validateDotenvProfileDocument(record.dotenv).variables.map((variable) => variable.name);\n\t\t\tconst body = record.dotenv.endsWith(\"\\n\") ? record.dotenv : `${record.dotenv}\\n`;\n\t\t\tlet dotenv = `${MANAGED_ENV_HEADER_PREFIX}${normalizedProfile}\\n# Generated by Pi. Do not edit, inspect, source as shell code, or commit.\\n${body}`;\n\t\t\ttry {\n\t\t\t\tawait writeFileAtomic(destination, dotenv, { mode: 0o600 });\n\t\t\t\tawait enforcePrivateFileMode(destination);\n\t\t\t\tif (activationBinding) {\n\t\t\t\t\tthis.activeProfilesByWorkspace.set(activationBinding.workspace, normalizedProfile);\n\t\t\t\t}\n\t\t\t} finally {\n\t\t\t\tdotenv = \"\";\n\t\t\t}\n\t\t\treturn { profile: normalizedProfile, variableNames, previousState: currentState };\n\t\t}, false);\n\t}\n\n\tprivate async storeProfileDocument(\n\t\tprofile: string,\n\t\tdescription: string | undefined,\n\t\tdocument: string,\n\t\tbinding: { workspace: string; envFile: string } | undefined,\n\t\tmerge: boolean,\n\t): Promise<SecretProfileSummary> {\n\t\tconst normalizedProfile = validateProfileId(profile);\n\t\tconst normalizedDescription = validateDescription(description);\n\t\tconst parsedDocument = validateDotenvProfileDocument(document);\n\t\tconst target = binding ? this.resolveBindingTarget(binding.workspace, binding.envFile) : undefined;\n\t\tconst normalizedBinding = target ? { workspace: target.workspace, envFile: target.envFile } : undefined;\n\n\t\tconst summary = await this.withPayload(async (payload) => {\n\t\t\tlet record = payload.profiles.find((candidate) => candidate.profile === normalizedProfile);\n\t\t\tconst timestamp = this.now().toISOString();\n\t\t\tif (!record && payload.profiles.length >= MAX_PROFILES) {\n\t\t\t\tthrow new SecretVaultError(\"profile_limit\", `Secret vault supports at most ${MAX_PROFILES} profiles.`);\n\t\t\t}\n\t\t\tconst nextBindings = record?.bindings.map((entry) => ({ ...entry })) ?? [];\n\t\t\tif (normalizedBinding) {\n\t\t\t\tconst next = { ...normalizedBinding, updatedAt: timestamp };\n\t\t\t\tconst existingIndex = nextBindings.findIndex((entry) => entry.workspace === normalizedBinding.workspace);\n\t\t\t\tif (existingIndex === -1) nextBindings.push(next);\n\t\t\t\telse nextBindings[existingIndex] = next;\n\t\t\t\tif (nextBindings.length > MAX_BINDINGS_PER_PROFILE) {\n\t\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\t\"profile_limit\",\n\t\t\t\t\t\t`A secret profile supports at most ${MAX_BINDINGS_PER_PROFILE} workspace bindings.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tlet nextDocument = parsedDocument.document;\n\t\t\tif (merge && record) {\n\t\t\t\tconst merged = new Map(\n\t\t\t\t\tvalidateDotenvProfileDocument(record.dotenv).variables.map((variable) => [\n\t\t\t\t\t\tvariable.name,\n\t\t\t\t\t\tvariable.value,\n\t\t\t\t\t]),\n\t\t\t\t);\n\t\t\t\tfor (const variable of parsedDocument.variables) merged.set(variable.name, variable.value);\n\t\t\t\tif (merged.size > MAX_VARIABLES_PER_PROFILE) {\n\t\t\t\t\tthrow new SecretVaultError(\n\t\t\t\t\t\t\"variable_limit\",\n\t\t\t\t\t\t`A secret profile supports at most ${MAX_VARIABLES_PER_PROFILE} variables.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tnextDocument = serializeVariableValues([...merged].map(([name, value]) => ({ name, value })));\n\t\t\t}\n\n\t\t\tif (record) {\n\t\t\t\tawait this.removeManagedMaterialization(normalizedProfile);\n\t\t\t\tawait this.removeBoundMaterializations(record);\n\t\t\t} else {\n\t\t\t\trecord = {\n\t\t\t\t\tprofile: normalizedProfile,\n\t\t\t\t\tcreatedAt: timestamp,\n\t\t\t\t\tupdatedAt: timestamp,\n\t\t\t\t\tdotenv: nextDocument,\n\t\t\t\t\tbindings: [],\n\t\t\t\t};\n\t\t\t\tpayload.profiles.push(record);\n\t\t\t}\n\t\t\tif (normalizedDescription !== undefined) record.description = normalizedDescription;\n\t\t\trecord.dotenv = nextDocument;\n\t\t\trecord.bindings = nextBindings.sort(\n\t\t\t\t(left, right) => left.workspace.localeCompare(right.workspace) || left.envFile.localeCompare(right.envFile),\n\t\t\t);\n\t\t\trecord.updatedAt = timestamp;\n\t\t\tpayload.profiles.sort((left, right) => left.profile.localeCompare(right.profile));\n\t\t\treturn profileSummary(record);\n\t\t}, true);\n\t\tthis.deactivateProfile(normalizedProfile);\n\t\treturn summary;\n\t}\n\n\tprivate async assertReplaceableDestination(\n\t\tdestination: string,\n\t\tstate: SecretEnvDestinationState,\n\t\toptions: { allowReplaceUnmanaged?: boolean; expectedUnmanagedContent?: string },\n\t): Promise<void> {\n\t\tif (state === \"managed-other\") {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"Destination already contains a file managed for another secret profile.\",\n\t\t\t);\n\t\t}\n\t\tif (state !== \"unmanaged\") return;\n\t\tif (!options.allowReplaceUnmanaged || options.expectedUnmanagedContent === undefined) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"Destination already contains an unmanaged file that was not reviewed for replacement.\",\n\t\t\t);\n\t\t}\n\t\tif ((await this.readOwnerDotenv(destination)) !== options.expectedUnmanagedContent) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The reviewed dotenv file changed before replacement and was preserved.\",\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate async assertBoundDestinationParent(binding: SecretBindingSummary, destination: string): Promise<void> {\n\t\ttry {\n\t\t\tconst [workspace, parent] = await Promise.all([\n\t\t\t\tfs.realpath(binding.workspace),\n\t\t\t\tfs.realpath(dirname(destination)),\n\t\t\t]);\n\t\t\tif (isPathInside(workspace, parent)) return;\n\t\t} catch {\n\t\t\t// Collapse filesystem detail so a model-facing failure cannot disclose unrelated paths.\n\t\t}\n\t\tthrow new SecretVaultError(\n\t\t\t\"destination_invalid\",\n\t\t\t\"Credential destination resolves outside its bound workspace or cannot be verified.\",\n\t\t);\n\t}\n\n\tprivate assertDestination(destination: string): void {\n\t\tif (!isAbsolute(destination) || resolve(destination) === resolve(this.vaultPath)) {\n\t\t\tthrow new SecretVaultError(\n\t\t\t\t\"destination_invalid\",\n\t\t\t\t\"Secret dotenv destination must be an absolute non-vault path.\",\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate replaceCachedKey(key: Buffer, kdf: VaultKdf): void {\n\t\tthis.cachedKey?.fill(0);\n\t\tthis.cachedKey = key;\n\t\tthis.cachedKdf = { ...kdf };\n\t}\n\n\tprivate clearSecretCache(): void {\n\t\tfor (const profile of this.cachedProfiles) {\n\t\t\tfor (const variable of profile.variables) variable.value = \"\";\n\t\t}\n\t\tthis.cachedProfiles = [];\n\t}\n\n\tprivate deactivateProfile(profile: string): void {\n\t\tlet changed = false;\n\t\tfor (const [workspace, activeProfile] of this.activeProfilesByWorkspace) {\n\t\t\tif (activeProfile !== profile) continue;\n\t\t\tthis.activeProfilesByWorkspace.delete(workspace);\n\t\t\tchanged = true;\n\t\t}\n\t\tconst cached = this.cachedProfiles.find((candidate) => candidate.profile === profile);\n\t\tif (cached) {\n\t\t\tfor (const variable of cached.variables) variable.value = \"\";\n\t\t\tcached.variables = [];\n\t\t}\n\t\tif (changed) this.notifyEnvironmentChanged();\n\t}\n\n\tprivate notifyEnvironmentChanged(): void {\n\t\ttry {\n\t\t\tthis.onEnvironmentChanged?.();\n\t\t} catch {\n\t\t\t// Credential state changes remain authoritative even if host cleanup is best-effort.\n\t\t}\n\t}\n\n\tprivate activeEnvironmentFingerprint(): string {\n\t\tconst hash = createHash(\"sha256\");\n\t\tfor (const profile of this.cachedProfiles) {\n\t\t\tconst activeBindings = profile.bindings\n\t\t\t\t.filter((binding) => this.activeProfilesByWorkspace.get(binding.workspace) === profile.profile)\n\t\t\t\t.sort((left, right) => left.workspace.localeCompare(right.workspace));\n\t\t\tif (activeBindings.length === 0) continue;\n\t\t\thash.update(`${profile.profile.length}:${profile.profile}`);\n\t\t\tfor (const binding of activeBindings) hash.update(`${binding.workspace.length}:${binding.workspace}`);\n\t\t\tfor (const variable of profile.variables) {\n\t\t\t\thash.update(`${variable.name.length}:${variable.name}${variable.value.length}:${variable.value}`);\n\t\t\t}\n\t\t}\n\t\treturn hash.digest(\"hex\");\n\t}\n\n\tprivate refreshSecretCache(payload: VaultPayload): void {\n\t\tthis.clearSecretCache();\n\t\tthis.cachedProfiles = payload.profiles.map((profile) => ({\n\t\t\tprofile: profile.profile,\n\t\t\tbindings: profile.bindings.map((binding) => ({ ...binding })),\n\t\t\tvariables: profile.bindings.some(\n\t\t\t\t(binding) => this.activeProfilesByWorkspace.get(binding.workspace) === profile.profile,\n\t\t\t)\n\t\t\t\t? parseDotenvDocument(profile.dotenv).variables.map((variable) => ({ ...variable }))\n\t\t\t\t: [],\n\t\t}));\n\t\tfor (const [workspace, profile] of this.activeProfilesByWorkspace) {\n\t\t\tconst stillBound = this.cachedProfiles.some(\n\t\t\t\t(candidate) =>\n\t\t\t\t\tcandidate.profile === profile && candidate.bindings.some((binding) => binding.workspace === workspace),\n\t\t\t);\n\t\t\tif (!stillBound) this.activeProfilesByWorkspace.delete(workspace);\n\t\t}\n\t}\n\n\tprivate resolveCachedProfile(\n\t\tcwd: string,\n\t): { profile: CachedSecretProfile; binding: SecretBindingSummary } | undefined {\n\t\tconst resolvedCwd = resolve(cwd);\n\t\treturn this.cachedProfiles\n\t\t\t.flatMap((profile) => {\n\t\t\t\tconst binding = profile.bindings\n\t\t\t\t\t.filter((candidate) => isPathInside(candidate.workspace, resolvedCwd))\n\t\t\t\t\t.sort((left, right) => right.workspace.length - left.workspace.length)[0];\n\t\t\t\treturn binding ? [{ profile, binding }] : [];\n\t\t\t})\n\t\t\t.filter((match) => this.activeProfilesByWorkspace.get(match.binding.workspace) === match.profile.profile)\n\t\t\t.sort((left, right) => right.binding.workspace.length - left.binding.workspace.length)[0];\n\t}\n\n\tprivate requireUnlocked(): { key: Buffer; kdf: VaultKdf } {\n\t\tif (!this.cachedKey || !this.cachedKdf) {\n\t\t\tthrow new SecretVaultError(\"not_unlocked\", \"Secret vault is locked.\");\n\t\t}\n\t\treturn { key: this.cachedKey, kdf: this.cachedKdf };\n\t}\n\n\tprivate async withPayload<T>(operation: (payload: VaultPayload) => T | Promise<T>, write: boolean): Promise<T> {\n\t\treturn withFileLock(this.vaultPath, async () => {\n\t\t\tconst environmentBefore = this.activeEnvironmentFingerprint();\n\t\t\tconst { key, kdf } = this.requireUnlocked();\n\t\t\tif (!(await lstatIfExists(this.vaultPath))) {\n\t\t\t\tthrow new SecretVaultError(\"not_initialized\", \"Secret vault is not initialized.\");\n\t\t\t}\n\t\t\tconst envelope = parseEnvelope(await readBoundedFile(this.vaultPath));\n\t\t\tif (!sameKdf(kdf, envelope.kdf)) {\n\t\t\t\tthis.lock();\n\t\t\t\tthrow new SecretVaultError(\"unlock_failed\", \"Secret vault changed and must be unlocked again.\");\n\t\t\t}\n\t\t\tconst payload = decryptPayload(envelope.payload, key);\n\t\t\ttry {\n\t\t\t\tconst result = await operation(payload);\n\t\t\t\tif (write) await this.writeEnvelope(kdf, payload, key);\n\t\t\t\tthis.refreshSecretCache(payload);\n\t\t\t\tif (environmentBefore !== this.activeEnvironmentFingerprint()) this.notifyEnvironmentChanged();\n\t\t\t\treturn result;\n\t\t\t} finally {\n\t\t\t\tscrubPayload(payload);\n\t\t\t}\n\t\t});\n\t}\n\n\tprivate async writeEnvelope(kdf: VaultKdf, payload: VaultPayload, key: Buffer): Promise<void> {\n\t\tlet serialized = serializeEnvelope(kdf, payload, key);\n\t\ttry {\n\t\t\tawait writeFileAtomic(this.vaultPath, serialized, { mode: 0o600 });\n\t\t\tawait enforcePrivateFileMode(this.vaultPath);\n\t\t} finally {\n\t\t\tserialized = \"\";\n\t\t}\n\t}\n\n\tprivate async removeBoundMaterializations(record: {\n\t\tprofile: string;\n\t\tbindings: SecretBindingSummary[];\n\t}): Promise<number> {\n\t\tlet removed = 0;\n\t\tfor (const binding of record.bindings) {\n\t\t\tconst destination = resolve(binding.workspace, binding.envFile);\n\t\t\tconst existing = await lstatIfExists(destination);\n\t\t\tif (!existing) continue;\n\t\t\tconst state = await this.inspectEnvDestination(destination, record.profile);\n\t\t\tif (state !== \"managed-profile\") continue;\n\t\t\tawait fs.unlink(destination);\n\t\t\tremoved++;\n\t\t}\n\t\treturn removed;\n\t}\n\n\tprivate async removeManagedMaterialization(profile: string): Promise<boolean> {\n\t\tconst path = this.getManagedEnvPath(profile);\n\t\tconst existing = await lstatIfExists(path);\n\t\tif (!existing) return false;\n\t\tif (existing.isSymbolicLink()) {\n\t\t\tthrow new SecretVaultError(\"symlink_refused\", \"Managed dotenv symlinks are refused.\");\n\t\t}\n\t\tif (!existing.isFile()) {\n\t\t\tthrow new SecretVaultError(\"destination_invalid\", \"Managed dotenv path is not a regular file.\");\n\t\t}\n\t\tconst state = await this.inspectEnvDestination(path, profile);\n\t\tif (state !== \"managed-profile\") return false;\n\t\tawait fs.unlink(path);\n\t\treturn true;\n\t}\n}\n"]}