@caupulican/pi-adaptative 0.85.8 → 0.86.2

package/dist/core/secrets/credential-manager.js

@@ -0,0 +1,384 @@
+import { realpathSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+import { parseDotenvDocument, validateDotenvValue, validateDotenvVariableName } from "./secret-dotenv.js";
+const PROFILE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+const PROJECT_KEY_PATTERN = /^(?:git|local):[a-f0-9]{64}$/;
+const MAX_PROFILE_CHARS = 96;
+const MAX_DESCRIPTION_CHARS = 256;
+const MAX_PROJECT_BINDINGS = 64;
+const MAX_SESSION_KEY_BYTES = 16 * 1024;
+export class CredentialManagerError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = "CredentialManagerError";
+        this.code = code;
+    }
+}
+export class CredentialStorageError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.name = "CredentialStorageError";
+        this.code = code;
+    }
+}
+export function validateCredentialProfileName(profile) {
+    if (!PROFILE_PATTERN.test(profile) || profile.length > MAX_PROFILE_CHARS) {
+        throw new CredentialManagerError("invalid_profile", "Credential profile names must use 1-96 portable letters, digits, dots, underscores, or hyphens.");
+    }
+    return profile;
+}
+export function validateCredentialDescription(description) {
+    if (description === undefined)
+        return undefined;
+    if (description.length === 0 ||
+        description.length > MAX_DESCRIPTION_CHARS ||
+        description.includes("\0") ||
+        /[\r\n]/.test(description)) {
+        throw new CredentialManagerError("invalid_description", "Credential descriptions must be a single printable line of at most 256 characters.");
+    }
+    return description;
+}
+function validateProjectIdentity(identity) {
+    if (!PROJECT_KEY_PATTERN.test(identity.key) ||
+        !isAbsolute(identity.root) ||
+        identity.label.length === 0 ||
+        identity.label.length > 256 ||
+        /[\0\r\n]/.test(identity.label)) {
+        throw new CredentialManagerError("invalid_project_identity", "The current project identity is invalid.");
+    }
+    return { ...identity, root: canonicalizeExistingPath(identity.root) };
+}
+export function validateCredentialProfileRecord(record) {
+    validateCredentialProfileName(record.profile);
+    validateCredentialDescription(record.description);
+    if (record.variables.length === 0) {
+        throw new CredentialManagerError("invalid_provider_record", "Credential profile has no variables.");
+    }
+    const variableNames = new Set();
+    for (const variable of record.variables) {
+        try {
+            validateDotenvVariableName(variable.name);
+            validateDotenvValue(variable.value);
+        }
+        catch {
+            throw new CredentialManagerError("invalid_provider_record", "Credential profile contains invalid variables.");
+        }
+        if (variableNames.has(variable.name)) {
+            throw new CredentialManagerError("invalid_provider_record", "Credential profile contains duplicate variables.");
+        }
+        variableNames.add(variable.name);
+    }
+    if (record.projectKeys.length === 0 ||
+        record.projectKeys.length > MAX_PROJECT_BINDINGS ||
+        new Set(record.projectKeys).size !== record.projectKeys.length ||
+        record.projectKeys.some((key) => !PROJECT_KEY_PATTERN.test(key))) {
+        throw new CredentialManagerError("invalid_provider_record", "Credential profile contains invalid project bindings.");
+    }
+    return record;
+}
+function validateSessionKey(sessionKey) {
+    if (sessionKey.trim().length === 0 ||
+        sessionKey.includes("\0") ||
+        /[\r\n]/.test(sessionKey) ||
+        Buffer.byteLength(sessionKey, "utf8") > MAX_SESSION_KEY_BYTES) {
+        throw new CredentialManagerError("invalid_session_key", "The Bitwarden session key is invalid.");
+    }
+    return sessionKey;
+}
+function isPathInside(root, target) {
+    const pathFromRoot = relative(root, target);
+    return pathFromRoot === "" || (!pathFromRoot.startsWith("..") && !isAbsolute(pathFromRoot));
+}
+function canonicalizeExistingPath(path) {
+    const absolute = resolve(path);
+    try {
+        return realpathSync.native(absolute);
+    }
+    catch {
+        return absolute;
+    }
+}
+function cloneEnvironment(values) {
+    return Object.fromEntries(Object.entries(values));
+}
+export class CredentialManager {
+    constructor(options) {
+        this.activeEnvironments = new Map();
+        this.sensitiveValues = new Set();
+        this.connectionGeneration = 0;
+        this.connected = false;
+        this.storage = options.storage;
+        this.resolveProject = options.resolveProject;
+        this.onEnvironmentChanged = options.onEnvironmentChanged ?? (() => { });
+        this.pendingSessionKey = options.initialSessionKey ?? process.env.BW_SESSION;
+        this.sessionKeyForRedaction = this.pendingSessionKey;
+        this.rebuildSensitiveValues();
+    }
+    get status() {
+        return { connected: this.connected, sessionAvailable: this.connected || Boolean(this.pendingSessionKey) };
+    }
+    async connect(sessionKey, signal) {
+        const previousConnection = this.connectionPromise;
+        this.connectionGeneration++;
+        let privateSessionKey = validateSessionKey(sessionKey);
+        this.pendingSessionKey = privateSessionKey;
+        this.sessionKeyForRedaction = privateSessionKey;
+        this.rebuildSensitiveValues();
+        this.connected = false;
+        try {
+            if (previousConnection) {
+                try {
+                    await previousConnection;
+                }
+                catch {
+                    // The superseded connection is expected to fail its generation check.
+                }
+            }
+            await this.ensureConnected(signal);
+        }
+        finally {
+            privateSessionKey = "";
+        }
+    }
+    async listForProject(cwd, signal) {
+        const { identity, summaries } = await this.refreshProjectProfiles(cwd, signal);
+        return summaries.map((summary) => ({
+            profile: validateCredentialProfileName(summary.profile),
+            ...(summary.description ? { description: validateCredentialDescription(summary.description) } : {}),
+            variableNames: summary.variableNames.map(validateDotenvVariableName),
+            boundToCurrentProject: summary.projectKeys.includes(identity.key),
+        }));
+    }
+    async activateForProject(cwd, profile, signal) {
+        const { generation, identity, summaries } = await this.refreshProjectProfiles(cwd, signal);
+        let selected;
+        if (profile !== undefined) {
+            validateCredentialProfileName(profile);
+            selected = summaries.find((summary) => summary.profile === profile);
+            if (!selected)
+                throw new CredentialManagerError("profile_not_found", "Credential profile was not found.");
+            if (!selected.projectKeys.includes(identity.key)) {
+                throw new CredentialManagerError("project_not_bound", "Credential profile is not authorized for the current project.");
+            }
+        }
+        else {
+            const candidates = summaries.filter((summary) => summary.projectKeys.includes(identity.key));
+            if (candidates.length === 0) {
+                throw new CredentialManagerError("profile_not_found", "No credential profile is bound to the current project. The owner can configure one with /secrets.");
+            }
+            if (candidates.length > 1) {
+                throw new CredentialManagerError("ambiguous_project_binding", "Multiple credential profiles are bound to the current project; select a profile by name.");
+            }
+            [selected] = candidates;
+        }
+        if (!selected)
+            throw new CredentialManagerError("profile_not_found", "Credential profile was not found.");
+        const record = validateCredentialProfileRecord(await this.storage.readProfile(selected.profile, signal));
+        this.assertAccessGeneration(generation);
+        if (!record.projectKeys.includes(identity.key)) {
+            throw new CredentialManagerError("project_not_bound", "Credential profile is not authorized for the current project.");
+        }
+        this.activate(identity.root, record);
+        return {
+            status: "activated",
+            profile: record.profile,
+            variableNames: record.variables.map((variable) => variable.name),
+            project: identity.label,
+        };
+    }
+    async storeForProject(cwd, input, signal) {
+        await this.ensureConnected(signal);
+        const generation = this.connectionGeneration;
+        this.assertAccessGeneration(generation);
+        const profile = validateCredentialProfileName(input.profile);
+        const description = validateCredentialDescription(input.description);
+        const identity = validateProjectIdentity(await this.resolveProject(cwd));
+        this.assertAccessGeneration(generation);
+        const parsed = parseDotenvDocument(input.dotenv);
+        const summaries = await this.storage.listProfiles(signal);
+        this.assertAccessGeneration(generation);
+        const existing = summaries.find((summary) => summary.profile === profile);
+        const existingRecord = existing
+            ? validateCredentialProfileRecord(await this.storage.readProfile(profile, signal))
+            : undefined;
+        this.assertAccessGeneration(generation);
+        const projectKeys = existingRecord ? [...new Set([...existingRecord.projectKeys, identity.key])] : [identity.key];
+        const record = {
+            profile,
+            ...((description ?? existingRecord?.description)
+                ? { description: description ?? existingRecord?.description }
+                : {}),
+            variables: parsed.variables.map((variable) => ({ name: variable.name, value: variable.value })),
+            projectKeys,
+        };
+        validateCredentialProfileRecord(record);
+        await this.storage.writeProfile(record, signal);
+        this.assertAccessGeneration(generation);
+        this.activate(identity.root, record);
+        return {
+            status: "stored",
+            profile,
+            variableNames: record.variables.map((variable) => variable.name),
+            project: identity.label,
+            portable: identity.portable,
+        };
+    }
+    async bindProfileToProject(cwd, profile, signal) {
+        await this.ensureConnected(signal);
+        const generation = this.connectionGeneration;
+        this.assertAccessGeneration(generation);
+        validateCredentialProfileName(profile);
+        const identity = validateProjectIdentity(await this.resolveProject(cwd));
+        this.assertAccessGeneration(generation);
+        const summaries = await this.storage.listProfiles(signal);
+        this.assertAccessGeneration(generation);
+        if (!summaries.some((summary) => summary.profile === profile)) {
+            throw new CredentialManagerError("profile_not_found", "Credential profile was not found.");
+        }
+        const record = validateCredentialProfileRecord(await this.storage.readProfile(profile, signal));
+        this.assertAccessGeneration(generation);
+        if (!record.projectKeys.includes(identity.key))
+            record.projectKeys.push(identity.key);
+        validateCredentialProfileRecord(record);
+        await this.storage.writeProfile(record, signal);
+        this.assertAccessGeneration(generation);
+        return {
+            status: "bound",
+            profile,
+            variableNames: record.variables.map((variable) => variable.name),
+            project: identity.label,
+            portable: identity.portable,
+        };
+    }
+    async removeProfile(profile, signal) {
+        await this.ensureConnected(signal);
+        const generation = this.connectionGeneration;
+        this.assertAccessGeneration(generation);
+        validateCredentialProfileName(profile);
+        const summaries = await this.storage.listProfiles(signal);
+        this.assertAccessGeneration(generation);
+        const summary = summaries.find((candidate) => candidate.profile === profile);
+        if (!summary)
+            throw new CredentialManagerError("profile_not_found", "Credential profile was not found.");
+        await this.storage.deleteProfile(profile, signal);
+        this.assertAccessGeneration(generation);
+        let removedActiveEnvironment = false;
+        for (const [root, active] of this.activeEnvironments) {
+            if (active.profile === profile) {
+                this.activeEnvironments.delete(root);
+                removedActiveEnvironment = true;
+            }
+        }
+        this.rebuildSensitiveValues();
+        if (removedActiveEnvironment)
+            this.onEnvironmentChanged();
+        return { status: "removed", profile, variableNames: [...summary.variableNames] };
+    }
+    getEnvironmentForCwd(cwd) {
+        const target = resolve(cwd);
+        const direct = this.findActiveEnvironment(target);
+        const selected = direct ?? this.findActiveEnvironment(canonicalizeExistingPath(target));
+        return selected ? cloneEnvironment(selected.values) : undefined;
+    }
+    findActiveEnvironment(target) {
+        let selected;
+        for (const active of this.activeEnvironments.values()) {
+            if (!isPathInside(active.root, target))
+                continue;
+            if (!selected || active.root.length > selected.root.length)
+                selected = active;
+        }
+        return selected;
+    }
+    hasEnvironmentForCwd(cwd) {
+        return this.getEnvironmentForCwd(cwd) !== undefined;
+    }
+    redactSensitiveText(text) {
+        let redacted = text;
+        for (const value of [...this.sensitiveValues].sort((left, right) => right.length - left.length)) {
+            if (value.length > 0)
+                redacted = redacted.split(value).join("[REDACTED_SECRET]");
+        }
+        return redacted;
+    }
+    lock() {
+        const hadActiveEnvironment = this.activeEnvironments.size > 0;
+        this.connectionGeneration++;
+        this.storage.lock();
+        this.connected = false;
+        this.pendingSessionKey = undefined;
+        this.sessionKeyForRedaction = undefined;
+        this.connectionPromise = undefined;
+        this.activeEnvironments.clear();
+        this.sensitiveValues.clear();
+        if (hadActiveEnvironment)
+            this.onEnvironmentChanged();
+    }
+    async ensureConnected(signal) {
+        if (this.connected)
+            return;
+        if (this.connectionPromise)
+            return this.connectionPromise;
+        let sessionKey = this.pendingSessionKey;
+        if (!sessionKey) {
+            throw new CredentialManagerError("owner_setup_required", "Bitwarden is not connected. The owner can provide a session key with /secrets.");
+        }
+        const generation = this.connectionGeneration;
+        const connectionPromise = (async () => {
+            try {
+                await this.storage.connect(sessionKey, signal);
+                if (generation !== this.connectionGeneration) {
+                    this.storage.lock();
+                    throw new CredentialManagerError("owner_setup_required", "Bitwarden connection was cancelled when the owner locked credentials.");
+                }
+                this.connected = true;
+            }
+            finally {
+                if (generation === this.connectionGeneration)
+                    this.pendingSessionKey = undefined;
+                sessionKey = "";
+            }
+        })();
+        this.connectionPromise = connectionPromise;
+        try {
+            await connectionPromise;
+        }
+        finally {
+            if (this.connectionPromise === connectionPromise)
+                this.connectionPromise = undefined;
+        }
+    }
+    assertAccessGeneration(generation) {
+        if (generation === this.connectionGeneration && this.connected)
+            return;
+        throw new CredentialManagerError("owner_setup_required", "Bitwarden credential access was cancelled when the owner locked credentials.");
+    }
+    async refreshProjectProfiles(cwd, signal) {
+        await this.ensureConnected(signal);
+        const generation = this.connectionGeneration;
+        this.assertAccessGeneration(generation);
+        await this.storage.refresh?.(signal);
+        this.assertAccessGeneration(generation);
+        const identity = validateProjectIdentity(await this.resolveProject(cwd));
+        this.assertAccessGeneration(generation);
+        const summaries = await this.storage.listProfiles(signal);
+        this.assertAccessGeneration(generation);
+        return { generation, identity, summaries };
+    }
+    activate(root, record) {
+        const values = Object.fromEntries(record.variables.map((variable) => [variable.name, variable.value]));
+        this.activeEnvironments.set(resolve(root), { profile: record.profile, root: resolve(root), values });
+        this.rebuildSensitiveValues();
+        this.onEnvironmentChanged();
+    }
+    rebuildSensitiveValues() {
+        this.sensitiveValues.clear();
+        if (this.sessionKeyForRedaction)
+            this.sensitiveValues.add(this.sessionKeyForRedaction);
+        for (const active of this.activeEnvironments.values()) {
+            for (const value of Object.values(active.values))
+                this.sensitiveValues.add(value);
+        }
+    }
+}
+//# sourceMappingURL=credential-manager.js.map

package/dist/core/secrets/credential-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-manager.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAE1G,MAAM,eAAe,GAAG,8BAA8B,CAAC;AACvD,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAC3D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAaxC,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAGhD,YAAY,IAAgC,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AASD,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAGhD,YAAY,IAAgC,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAgFD,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC5D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAC1E,MAAM,IAAI,sBAAsB,CAC/B,iBAAiB,EACjB,iGAAiG,CACjG,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,WAA+B;IAC5E,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,IACC,WAAW,CAAC,MAAM,KAAK,CAAC;QACxB,WAAW,CAAC,MAAM,GAAG,qBAAqB;QAC1C,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EACzB,CAAC;QACF,MAAM,IAAI,sBAAsB,CAC/B,qBAAqB,EACrB,oFAAoF,CACpF,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAmC;IACnE,IACC,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1B,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG;QAC3B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC9B,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,0CAA0C,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAA+B;IAC9E,6BAA6B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,6BAA6B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,sCAAsC,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC;YACJ,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1C,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,gDAAgD,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,sBAAsB,CAC/B,yBAAyB,EACzB,kDAAkD,CAClD,CAAC;QACH,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,IACC,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC/B,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,oBAAoB;QAChD,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM;QAC9D,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC/D,CAAC;QACF,MAAM,IAAI,sBAAsB,CAC/B,yBAAyB,EACzB,uDAAuD,CACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC7C,IACC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC9B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QACzB,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,qBAAqB,EAC5D,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,YAAY,KAAK,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,QAAQ,CAAC;IACjB,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA8B;IACvD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,OAAO,iBAAiB;IAY7B,YAAY,OAAiC;QAR5B,uBAAkB,GAAG,IAAI,GAAG,EAAuC,CAAC;QACpE,oBAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAI7C,yBAAoB,GAAG,CAAC,CAAC;QACzB,cAAS,GAAG,KAAK,CAAC;QAGzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC7E,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACrD,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM;QACT,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;IAC3G,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,MAAoB;QACrD,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAClD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,IAAI,iBAAiB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,sBAAsB,GAAG,iBAAiB,CAAC;QAChD,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACJ,IAAI,kBAAkB,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACJ,MAAM,kBAAkB,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACR,sEAAsE;gBACvE,CAAC;YACF,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YACV,iBAAiB,GAAG,EAAE,CAAC;QACxB,CAAC;IACF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,MAAoB;QACrD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAClC,OAAO,EAAE,6BAA6B,CAAC,OAAO,CAAC,OAAO,CAAC;YACvD,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,6BAA6B,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACpE,qBAAqB,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;SACjE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,OAAgB,EAAE,MAAoB;QAC3E,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3F,IAAI,QAAoD,CAAC;QACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,6BAA6B,CAAC,OAAO,CAAC,CAAC;YACvC,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;YACpE,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;YAC1G,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,+DAA+D,CAC/D,CAAC;YACH,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,mGAAmG,CACnG,CAAC;YACH,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,sBAAsB,CAC/B,2BAA2B,EAC3B,0FAA0F,CAC1F,CAAC;YACH,CAAC;YACD,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,+BAA+B,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,+DAA+D,CAC/D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO;YACN,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChE,OAAO,EAAE,QAAQ,CAAC,KAAK;SACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CACpB,GAAW,EACX,KAAgE,EAChE,MAAoB;QAEpB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,6BAA6B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAC1E,MAAM,cAAc,GAAG,QAAQ;YAC9B,CAAC,CAAC,+BAA+B,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClF,CAAC,CAAC,SAAS,CAAC;QACb,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClH,MAAM,MAAM,GAA4B;YACvC,OAAO;YACP,GAAG,CAAC,CAAC,WAAW,IAAI,cAAc,EAAE,WAAW,CAAC;gBAC/C,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,IAAI,cAAc,EAAE,WAAW,EAAE;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACN,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/F,WAAW;SACX,CAAC;QACF,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO;YACN,MAAM,EAAE,QAAQ;YAChB,OAAO;YACP,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChE,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,GAAW,EAAE,OAAe,EAAE,MAAoB;QAC5E,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,MAAM,GAAG,+BAA+B,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtF,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,OAAO;YACN,MAAM,EAAE,OAAO;YACf,OAAO;YACP,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChE,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,MAAoB;QACxD,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QACzG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,wBAAwB,GAAG,KAAK,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAChC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrC,wBAAwB,GAAG,IAAI,CAAC;YACjC,CAAC;QACF,CAAC;QACD,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,wBAAwB;YAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,oBAAoB,CAAC,GAAW;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,IAAI,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;QACxF,OAAO,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IAEO,qBAAqB,CAAC,MAAc;QAC3C,IAAI,QAAiD,CAAC;QACtD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,SAAS;YACjD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM;gBAAE,QAAQ,GAAG,MAAM,CAAC;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,oBAAoB,CAAC,GAAW;QAC/B,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,IAAY;QAC/B,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,IAAI;QACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,oBAAoB;YAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,MAAoB;QACjD,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAC1D,IAAI,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACxC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,IAAI,sBAAsB,CAC/B,sBAAsB,EACtB,gFAAgF,CAChF,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,MAAM,iBAAiB,GAAG,CAAC,KAAK,IAAI,EAAE;YACrC,IAAI,CAAC;gBACJ,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAC/C,IAAI,UAAU,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;oBAC9C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBACpB,MAAM,IAAI,sBAAsB,CAC/B,sBAAsB,EACtB,uEAAuE,CACvE,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACvB,CAAC;oBAAS,CAAC;gBACV,IAAI,UAAU,KAAK,IAAI,CAAC,oBAAoB;oBAAE,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;gBACjF,UAAU,GAAG,EAAE,CAAC;YACjB,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC;YACJ,MAAM,iBAAiB,CAAC;QACzB,CAAC;gBAAS,CAAC;YACV,IAAI,IAAI,CAAC,iBAAiB,KAAK,iBAAiB;gBAAE,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACtF,CAAC;IACF,CAAC;IAEO,sBAAsB,CAAC,UAAkB;QAChD,IAAI,UAAU,KAAK,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QACvE,MAAM,IAAI,sBAAsB,CAC/B,sBAAsB,EACtB,8EAA8E,CAC9E,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CACnC,GAAW,EACX,MAAoB;QAMpB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,MAA+B;QAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAC7B,CAAC;IAEO,sBAAsB;QAC7B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,sBAAsB;YAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACvF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YACvD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;CACD","sourcesContent":["import { realpathSync } from \"node:fs\";\nimport { isAbsolute, relative, resolve } from \"node:path\";\nimport { parseDotenvDocument, validateDotenvValue, validateDotenvVariableName } from \"./secret-dotenv.ts\";\n\nconst PROFILE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\nconst PROJECT_KEY_PATTERN = /^(?:git|local):[a-f0-9]{64}$/;\nconst MAX_PROFILE_CHARS = 96;\nconst MAX_DESCRIPTION_CHARS = 256;\nconst MAX_PROJECT_BINDINGS = 64;\nconst MAX_SESSION_KEY_BYTES = 16 * 1024;\n\nexport type CredentialManagerErrorCode =\n\t| \"ambiguous_project_binding\"\n\t| \"invalid_description\"\n\t| \"invalid_profile\"\n\t| \"invalid_project_identity\"\n\t| \"invalid_provider_record\"\n\t| \"invalid_session_key\"\n\t| \"owner_setup_required\"\n\t| \"profile_not_found\"\n\t| \"project_not_bound\";\n\nexport class CredentialManagerError extends Error {\n\treadonly code: CredentialManagerErrorCode;\n\n\tconstructor(code: CredentialManagerErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"CredentialManagerError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport type CredentialStorageErrorCode =\n\t| \"malformed_provider_data\"\n\t| \"not_connected\"\n\t| \"profile_not_found\"\n\t| \"provider_command_failed\"\n\t| \"provider_unavailable\";\n\nexport class CredentialStorageError extends Error {\n\treadonly code: CredentialStorageErrorCode;\n\n\tconstructor(code: CredentialStorageErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"CredentialStorageError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport interface CredentialProjectIdentity {\n\tkey: string;\n\troot: string;\n\tlabel: string;\n\tportable: boolean;\n}\n\nexport type CredentialProjectResolver = (cwd: string) => Promise<CredentialProjectIdentity>;\n\nexport interface CredentialVariable {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface CredentialProfileRecord {\n\tprofile: string;\n\tdescription?: string;\n\tvariables: CredentialVariable[];\n\tprojectKeys: string[];\n}\n\nexport interface StoredCredentialProfileSummary {\n\tprofile: string;\n\tdescription?: string;\n\tvariableNames: string[];\n\tprojectKeys: string[];\n}\n\nexport interface CredentialProfileStorage {\n\tconnect(sessionKey: string, signal?: AbortSignal): Promise<void>;\n\trefresh?(signal?: AbortSignal): Promise<void>;\n\tlistProfiles(signal?: AbortSignal): Promise<StoredCredentialProfileSummary[]>;\n\treadProfile(profile: string, signal?: AbortSignal): Promise<CredentialProfileRecord>;\n\twriteProfile(record: CredentialProfileRecord, signal?: AbortSignal): Promise<void>;\n\tdeleteProfile(profile: string, signal?: AbortSignal): Promise<void>;\n\tlock(): void;\n}\n\nexport interface CredentialProfileSummary {\n\tprofile: string;\n\tdescription?: string;\n\tvariableNames: string[];\n\tboundToCurrentProject: boolean;\n}\n\nexport interface CredentialActivationResult {\n\tstatus: \"activated\";\n\tprofile: string;\n\tvariableNames: string[];\n\tproject: string;\n}\n\nexport interface CredentialMutationResult {\n\tstatus: \"bound\" | \"removed\" | \"stored\";\n\tprofile: string;\n\tvariableNames: string[];\n\tproject?: string;\n\tportable?: boolean;\n}\n\nexport interface CredentialConnectionStatus {\n\tconnected: boolean;\n\tsessionAvailable: boolean;\n}\n\nexport interface CredentialManagerOptions {\n\tstorage: CredentialProfileStorage;\n\tresolveProject: CredentialProjectResolver;\n\tinitialSessionKey?: string;\n\tonEnvironmentChanged?: () => void;\n}\n\ninterface ActiveCredentialEnvironment {\n\tprofile: string;\n\troot: string;\n\tvalues: Record<string, string>;\n}\n\nexport function validateCredentialProfileName(profile: string): string {\n\tif (!PROFILE_PATTERN.test(profile) || profile.length > MAX_PROFILE_CHARS) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"invalid_profile\",\n\t\t\t\"Credential profile names must use 1-96 portable letters, digits, dots, underscores, or hyphens.\",\n\t\t);\n\t}\n\treturn profile;\n}\n\nexport function validateCredentialDescription(description: string | undefined): string | undefined {\n\tif (description === undefined) return undefined;\n\tif (\n\t\tdescription.length === 0 ||\n\t\tdescription.length > MAX_DESCRIPTION_CHARS ||\n\t\tdescription.includes(\"\\0\") ||\n\t\t/[\\r\\n]/.test(description)\n\t) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"invalid_description\",\n\t\t\t\"Credential descriptions must be a single printable line of at most 256 characters.\",\n\t\t);\n\t}\n\treturn description;\n}\n\nfunction validateProjectIdentity(identity: CredentialProjectIdentity): CredentialProjectIdentity {\n\tif (\n\t\t!PROJECT_KEY_PATTERN.test(identity.key) ||\n\t\t!isAbsolute(identity.root) ||\n\t\tidentity.label.length === 0 ||\n\t\tidentity.label.length > 256 ||\n\t\t/[\\0\\r\\n]/.test(identity.label)\n\t) {\n\t\tthrow new CredentialManagerError(\"invalid_project_identity\", \"The current project identity is invalid.\");\n\t}\n\treturn { ...identity, root: canonicalizeExistingPath(identity.root) };\n}\n\nexport function validateCredentialProfileRecord(record: CredentialProfileRecord): CredentialProfileRecord {\n\tvalidateCredentialProfileName(record.profile);\n\tvalidateCredentialDescription(record.description);\n\tif (record.variables.length === 0) {\n\t\tthrow new CredentialManagerError(\"invalid_provider_record\", \"Credential profile has no variables.\");\n\t}\n\tconst variableNames = new Set<string>();\n\tfor (const variable of record.variables) {\n\t\ttry {\n\t\t\tvalidateDotenvVariableName(variable.name);\n\t\t\tvalidateDotenvValue(variable.value);\n\t\t} catch {\n\t\t\tthrow new CredentialManagerError(\"invalid_provider_record\", \"Credential profile contains invalid variables.\");\n\t\t}\n\t\tif (variableNames.has(variable.name)) {\n\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\"invalid_provider_record\",\n\t\t\t\t\"Credential profile contains duplicate variables.\",\n\t\t\t);\n\t\t}\n\t\tvariableNames.add(variable.name);\n\t}\n\tif (\n\t\trecord.projectKeys.length === 0 ||\n\t\trecord.projectKeys.length > MAX_PROJECT_BINDINGS ||\n\t\tnew Set(record.projectKeys).size !== record.projectKeys.length ||\n\t\trecord.projectKeys.some((key) => !PROJECT_KEY_PATTERN.test(key))\n\t) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"invalid_provider_record\",\n\t\t\t\"Credential profile contains invalid project bindings.\",\n\t\t);\n\t}\n\treturn record;\n}\n\nfunction validateSessionKey(sessionKey: string): string {\n\tif (\n\t\tsessionKey.trim().length === 0 ||\n\t\tsessionKey.includes(\"\\0\") ||\n\t\t/[\\r\\n]/.test(sessionKey) ||\n\t\tBuffer.byteLength(sessionKey, \"utf8\") > MAX_SESSION_KEY_BYTES\n\t) {\n\t\tthrow new CredentialManagerError(\"invalid_session_key\", \"The Bitwarden session key is invalid.\");\n\t}\n\treturn sessionKey;\n}\n\nfunction isPathInside(root: string, target: string): boolean {\n\tconst pathFromRoot = relative(root, target);\n\treturn pathFromRoot === \"\" || (!pathFromRoot.startsWith(\"..\") && !isAbsolute(pathFromRoot));\n}\n\nfunction canonicalizeExistingPath(path: string): string {\n\tconst absolute = resolve(path);\n\ttry {\n\t\treturn realpathSync.native(absolute);\n\t} catch {\n\t\treturn absolute;\n\t}\n}\n\nfunction cloneEnvironment(values: Record<string, string>): Record<string, string> {\n\treturn Object.fromEntries(Object.entries(values));\n}\n\nexport class CredentialManager {\n\tprivate readonly storage: CredentialProfileStorage;\n\tprivate readonly resolveProject: CredentialProjectResolver;\n\tprivate readonly onEnvironmentChanged: () => void;\n\tprivate readonly activeEnvironments = new Map<string, ActiveCredentialEnvironment>();\n\tprivate readonly sensitiveValues = new Set<string>();\n\tprivate pendingSessionKey: string | undefined;\n\tprivate sessionKeyForRedaction: string | undefined;\n\tprivate connectionPromise: Promise<void> | undefined;\n\tprivate connectionGeneration = 0;\n\tprivate connected = false;\n\n\tconstructor(options: CredentialManagerOptions) {\n\t\tthis.storage = options.storage;\n\t\tthis.resolveProject = options.resolveProject;\n\t\tthis.onEnvironmentChanged = options.onEnvironmentChanged ?? (() => {});\n\t\tthis.pendingSessionKey = options.initialSessionKey ?? process.env.BW_SESSION;\n\t\tthis.sessionKeyForRedaction = this.pendingSessionKey;\n\t\tthis.rebuildSensitiveValues();\n\t}\n\n\tget status(): CredentialConnectionStatus {\n\t\treturn { connected: this.connected, sessionAvailable: this.connected || Boolean(this.pendingSessionKey) };\n\t}\n\n\tasync connect(sessionKey: string, signal?: AbortSignal): Promise<void> {\n\t\tconst previousConnection = this.connectionPromise;\n\t\tthis.connectionGeneration++;\n\t\tlet privateSessionKey = validateSessionKey(sessionKey);\n\t\tthis.pendingSessionKey = privateSessionKey;\n\t\tthis.sessionKeyForRedaction = privateSessionKey;\n\t\tthis.rebuildSensitiveValues();\n\t\tthis.connected = false;\n\t\ttry {\n\t\t\tif (previousConnection) {\n\t\t\t\ttry {\n\t\t\t\t\tawait previousConnection;\n\t\t\t\t} catch {\n\t\t\t\t\t// The superseded connection is expected to fail its generation check.\n\t\t\t\t}\n\t\t\t}\n\t\t\tawait this.ensureConnected(signal);\n\t\t} finally {\n\t\t\tprivateSessionKey = \"\";\n\t\t}\n\t}\n\n\tasync listForProject(cwd: string, signal?: AbortSignal): Promise<CredentialProfileSummary[]> {\n\t\tconst { identity, summaries } = await this.refreshProjectProfiles(cwd, signal);\n\t\treturn summaries.map((summary) => ({\n\t\t\tprofile: validateCredentialProfileName(summary.profile),\n\t\t\t...(summary.description ? { description: validateCredentialDescription(summary.description) } : {}),\n\t\t\tvariableNames: summary.variableNames.map(validateDotenvVariableName),\n\t\t\tboundToCurrentProject: summary.projectKeys.includes(identity.key),\n\t\t}));\n\t}\n\n\tasync activateForProject(cwd: string, profile?: string, signal?: AbortSignal): Promise<CredentialActivationResult> {\n\t\tconst { generation, identity, summaries } = await this.refreshProjectProfiles(cwd, signal);\n\t\tlet selected: StoredCredentialProfileSummary | undefined;\n\t\tif (profile !== undefined) {\n\t\t\tvalidateCredentialProfileName(profile);\n\t\t\tselected = summaries.find((summary) => summary.profile === profile);\n\t\t\tif (!selected) throw new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t\tif (!selected.projectKeys.includes(identity.key)) {\n\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\"project_not_bound\",\n\t\t\t\t\t\"Credential profile is not authorized for the current project.\",\n\t\t\t\t);\n\t\t\t}\n\t\t} else {\n\t\t\tconst candidates = summaries.filter((summary) => summary.projectKeys.includes(identity.key));\n\t\t\tif (candidates.length === 0) {\n\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\"profile_not_found\",\n\t\t\t\t\t\"No credential profile is bound to the current project. The owner can configure one with /secrets.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (candidates.length > 1) {\n\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\"ambiguous_project_binding\",\n\t\t\t\t\t\"Multiple credential profiles are bound to the current project; select a profile by name.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\t[selected] = candidates;\n\t\t}\n\n\t\tif (!selected) throw new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\tconst record = validateCredentialProfileRecord(await this.storage.readProfile(selected.profile, signal));\n\t\tthis.assertAccessGeneration(generation);\n\t\tif (!record.projectKeys.includes(identity.key)) {\n\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\"project_not_bound\",\n\t\t\t\t\"Credential profile is not authorized for the current project.\",\n\t\t\t);\n\t\t}\n\t\tthis.activate(identity.root, record);\n\t\treturn {\n\t\t\tstatus: \"activated\",\n\t\t\tprofile: record.profile,\n\t\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\t\tproject: identity.label,\n\t\t};\n\t}\n\n\tasync storeForProject(\n\t\tcwd: string,\n\t\tinput: { profile: string; description?: string; dotenv: string },\n\t\tsignal?: AbortSignal,\n\t): Promise<CredentialMutationResult> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst profile = validateCredentialProfileName(input.profile);\n\t\tconst description = validateCredentialDescription(input.description);\n\t\tconst identity = validateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst parsed = parseDotenvDocument(input.dotenv);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst existing = summaries.find((summary) => summary.profile === profile);\n\t\tconst existingRecord = existing\n\t\t\t? validateCredentialProfileRecord(await this.storage.readProfile(profile, signal))\n\t\t\t: undefined;\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst projectKeys = existingRecord ? [...new Set([...existingRecord.projectKeys, identity.key])] : [identity.key];\n\t\tconst record: CredentialProfileRecord = {\n\t\t\tprofile,\n\t\t\t...((description ?? existingRecord?.description)\n\t\t\t\t? { description: description ?? existingRecord?.description }\n\t\t\t\t: {}),\n\t\t\tvariables: parsed.variables.map((variable) => ({ name: variable.name, value: variable.value })),\n\t\t\tprojectKeys,\n\t\t};\n\t\tvalidateCredentialProfileRecord(record);\n\t\tawait this.storage.writeProfile(record, signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tthis.activate(identity.root, record);\n\t\treturn {\n\t\t\tstatus: \"stored\",\n\t\t\tprofile,\n\t\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\t\tproject: identity.label,\n\t\t\tportable: identity.portable,\n\t\t};\n\t}\n\n\tasync bindProfileToProject(cwd: string, profile: string, signal?: AbortSignal): Promise<CredentialMutationResult> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tvalidateCredentialProfileName(profile);\n\t\tconst identity = validateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tif (!summaries.some((summary) => summary.profile === profile)) {\n\t\t\tthrow new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t}\n\t\tconst record = validateCredentialProfileRecord(await this.storage.readProfile(profile, signal));\n\t\tthis.assertAccessGeneration(generation);\n\t\tif (!record.projectKeys.includes(identity.key)) record.projectKeys.push(identity.key);\n\t\tvalidateCredentialProfileRecord(record);\n\t\tawait this.storage.writeProfile(record, signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\treturn {\n\t\t\tstatus: \"bound\",\n\t\t\tprofile,\n\t\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\t\tproject: identity.label,\n\t\t\tportable: identity.portable,\n\t\t};\n\t}\n\n\tasync removeProfile(profile: string, signal?: AbortSignal): Promise<CredentialMutationResult> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tvalidateCredentialProfileName(profile);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summary = summaries.find((candidate) => candidate.profile === profile);\n\t\tif (!summary) throw new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\tawait this.storage.deleteProfile(profile, signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tlet removedActiveEnvironment = false;\n\t\tfor (const [root, active] of this.activeEnvironments) {\n\t\t\tif (active.profile === profile) {\n\t\t\t\tthis.activeEnvironments.delete(root);\n\t\t\t\tremovedActiveEnvironment = true;\n\t\t\t}\n\t\t}\n\t\tthis.rebuildSensitiveValues();\n\t\tif (removedActiveEnvironment) this.onEnvironmentChanged();\n\t\treturn { status: \"removed\", profile, variableNames: [...summary.variableNames] };\n\t}\n\n\tgetEnvironmentForCwd(cwd: string): Record<string, string> | undefined {\n\t\tconst target = resolve(cwd);\n\t\tconst direct = this.findActiveEnvironment(target);\n\t\tconst selected = direct ?? this.findActiveEnvironment(canonicalizeExistingPath(target));\n\t\treturn selected ? cloneEnvironment(selected.values) : undefined;\n\t}\n\n\tprivate findActiveEnvironment(target: string): ActiveCredentialEnvironment | undefined {\n\t\tlet selected: ActiveCredentialEnvironment | undefined;\n\t\tfor (const active of this.activeEnvironments.values()) {\n\t\t\tif (!isPathInside(active.root, target)) continue;\n\t\t\tif (!selected || active.root.length > selected.root.length) selected = active;\n\t\t}\n\t\treturn selected;\n\t}\n\n\thasEnvironmentForCwd(cwd: string): boolean {\n\t\treturn this.getEnvironmentForCwd(cwd) !== undefined;\n\t}\n\n\tredactSensitiveText(text: string): string {\n\t\tlet redacted = text;\n\t\tfor (const value of [...this.sensitiveValues].sort((left, right) => right.length - left.length)) {\n\t\t\tif (value.length > 0) redacted = redacted.split(value).join(\"[REDACTED_SECRET]\");\n\t\t}\n\t\treturn redacted;\n\t}\n\n\tlock(): void {\n\t\tconst hadActiveEnvironment = this.activeEnvironments.size > 0;\n\t\tthis.connectionGeneration++;\n\t\tthis.storage.lock();\n\t\tthis.connected = false;\n\t\tthis.pendingSessionKey = undefined;\n\t\tthis.sessionKeyForRedaction = undefined;\n\t\tthis.connectionPromise = undefined;\n\t\tthis.activeEnvironments.clear();\n\t\tthis.sensitiveValues.clear();\n\t\tif (hadActiveEnvironment) this.onEnvironmentChanged();\n\t}\n\n\tprivate async ensureConnected(signal?: AbortSignal): Promise<void> {\n\t\tif (this.connected) return;\n\t\tif (this.connectionPromise) return this.connectionPromise;\n\t\tlet sessionKey = this.pendingSessionKey;\n\t\tif (!sessionKey) {\n\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\"owner_setup_required\",\n\t\t\t\t\"Bitwarden is not connected. The owner can provide a session key with /secrets.\",\n\t\t\t);\n\t\t}\n\t\tconst generation = this.connectionGeneration;\n\t\tconst connectionPromise = (async () => {\n\t\t\ttry {\n\t\t\t\tawait this.storage.connect(sessionKey, signal);\n\t\t\t\tif (generation !== this.connectionGeneration) {\n\t\t\t\t\tthis.storage.lock();\n\t\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\t\"owner_setup_required\",\n\t\t\t\t\t\t\"Bitwarden connection was cancelled when the owner locked credentials.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tthis.connected = true;\n\t\t\t} finally {\n\t\t\t\tif (generation === this.connectionGeneration) this.pendingSessionKey = undefined;\n\t\t\t\tsessionKey = \"\";\n\t\t\t}\n\t\t})();\n\t\tthis.connectionPromise = connectionPromise;\n\t\ttry {\n\t\t\tawait connectionPromise;\n\t\t} finally {\n\t\t\tif (this.connectionPromise === connectionPromise) this.connectionPromise = undefined;\n\t\t}\n\t}\n\n\tprivate assertAccessGeneration(generation: number): void {\n\t\tif (generation === this.connectionGeneration && this.connected) return;\n\t\tthrow new CredentialManagerError(\n\t\t\t\"owner_setup_required\",\n\t\t\t\"Bitwarden credential access was cancelled when the owner locked credentials.\",\n\t\t);\n\t}\n\n\tprivate async refreshProjectProfiles(\n\t\tcwd: string,\n\t\tsignal?: AbortSignal,\n\t): Promise<{\n\t\tgeneration: number;\n\t\tidentity: CredentialProjectIdentity;\n\t\tsummaries: StoredCredentialProfileSummary[];\n\t}> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tawait this.storage.refresh?.(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst identity = validateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\treturn { generation, identity, summaries };\n\t}\n\n\tprivate activate(root: string, record: CredentialProfileRecord): void {\n\t\tconst values = Object.fromEntries(record.variables.map((variable) => [variable.name, variable.value]));\n\t\tthis.activeEnvironments.set(resolve(root), { profile: record.profile, root: resolve(root), values });\n\t\tthis.rebuildSensitiveValues();\n\t\tthis.onEnvironmentChanged();\n\t}\n\n\tprivate rebuildSensitiveValues(): void {\n\t\tthis.sensitiveValues.clear();\n\t\tif (this.sessionKeyForRedaction) this.sensitiveValues.add(this.sessionKeyForRedaction);\n\t\tfor (const active of this.activeEnvironments.values()) {\n\t\t\tfor (const value of Object.values(active.values)) this.sensitiveValues.add(value);\n\t\t}\n\t}\n}\n"]}

package/dist/core/secrets/credential-project.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialProjectIdentity } from "./credential-manager.ts";
+export declare function createPortableGitProjectKey(remote: string): string;
+export declare function resolveCredentialProject(cwd: string): Promise<CredentialProjectIdentity>;
+//# sourceMappingURL=credential-project.d.ts.map

package/dist/core/secrets/credential-project.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-project.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/credential-project.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAuCzE,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIlE;AA+ED,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAkB9F"}

package/dist/core/secrets/credential-project.js

@@ -0,0 +1,145 @@
+import { createHash } from "node:crypto";
+import { readFile, realpath, stat } from "node:fs/promises";
+import { hostname } from "node:os";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+const MAX_GIT_POINTER_BYTES = 4 * 1024;
+const MAX_GIT_CONFIG_BYTES = 1024 * 1024;
+function opaqueKey(kind, identity) {
+    return `${kind}:${createHash("sha256").update(identity).digest("hex")}`;
+}
+function canonicalizeGitRemote(remote) {
+    const candidate = remote.trim();
+    if (!candidate || /[\0\r\n]/.test(candidate))
+        return undefined;
+    if (!candidate.includes("://")) {
+        const scp = candidate.match(/^(?:[^@/\s]+@)?([^:/\s]+):(.+)$/);
+        if (!scp)
+            return undefined;
+        const host = scp[1]?.toLowerCase();
+        const path = scp[2]
+            ?.replace(/^\/+/, "")
+            .replace(/\/+$/, "")
+            .replace(/\.git$/i, "");
+        return host && path ? `${host}/${path}` : undefined;
+    }
+    try {
+        const url = new URL(candidate);
+        if (!["git:", "http:", "https:", "ssh:"].includes(url.protocol) || !url.hostname)
+            return undefined;
+        const path = url.pathname
+            .replace(/^\/+/, "")
+            .replace(/\/+$/, "")
+            .replace(/\.git$/i, "");
+        if (!path)
+            return undefined;
+        const host = `${url.hostname.toLowerCase()}${url.port ? `:${url.port}` : ""}`;
+        return `${host}/${path}`;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function createPortableGitProjectKey(remote) {
+    const canonical = canonicalizeGitRemote(remote);
+    if (!canonical)
+        throw new Error("Git remote is not portable.");
+    return opaqueKey("git", canonical);
+}
+async function isDirectory(path) {
+    try {
+        return (await stat(path)).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+async function isFile(path) {
+    try {
+        return (await stat(path)).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+async function readBounded(path, maxBytes) {
+    try {
+        const metadata = await stat(path);
+        if (!metadata.isFile() || metadata.size > maxBytes)
+            return undefined;
+        return await readFile(path, "utf8");
+    }
+    catch {
+        return undefined;
+    }
+}
+async function resolveGitDirectory(root, marker) {
+    if (await isDirectory(marker))
+        return marker;
+    if (!(await isFile(marker)))
+        return undefined;
+    const pointer = await readBounded(marker, MAX_GIT_POINTER_BYTES);
+    const gitDirValue = pointer?.match(/^gitdir:\s*(.+?)\s*$/im)?.[1];
+    if (!gitDirValue || /[\0\r\n]/.test(gitDirValue))
+        return undefined;
+    return resolve(root, gitDirValue);
+}
+async function findGitRepository(cwd) {
+    let current = await realpath(cwd).catch(() => resolve(cwd));
+    while (true) {
+        const gitDir = await resolveGitDirectory(current, join(current, ".git"));
+        if (gitDir)
+            return { root: current, gitDir };
+        const parent = dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+async function resolveGitConfigPath(gitDir) {
+    const direct = join(gitDir, "config");
+    if (await isFile(direct))
+        return direct;
+    const commonPointer = await readBounded(join(gitDir, "commondir"), MAX_GIT_POINTER_BYTES);
+    const commonValue = commonPointer?.trim();
+    if (!commonValue || /[\0\r\n]/.test(commonValue))
+        return undefined;
+    const commonDir = isAbsolute(commonValue) ? commonValue : resolve(gitDir, commonValue);
+    const shared = join(commonDir, "config");
+    return (await isFile(shared)) ? shared : undefined;
+}
+function readOriginRemote(config) {
+    let inOrigin = false;
+    for (const line of config.split(/\r?\n/)) {
+        const section = line.match(/^\s*\[([^\]]+)]\s*$/)?.[1];
+        if (section !== undefined) {
+            inOrigin = /^remote\s+"origin"$/i.test(section.trim());
+            continue;
+        }
+        if (!inOrigin)
+            continue;
+        const assignment = line.match(/^\s*url\s*=\s*(.*?)\s*$/i)?.[1];
+        if (assignment)
+            return assignment;
+    }
+    return undefined;
+}
+export async function resolveCredentialProject(cwd) {
+    const repository = await findGitRepository(cwd);
+    const root = repository?.root ?? (await realpath(cwd).catch(() => resolve(cwd)));
+    if (repository) {
+        const configPath = await resolveGitConfigPath(repository.gitDir);
+        const config = configPath ? await readBounded(configPath, MAX_GIT_CONFIG_BYTES) : undefined;
+        const remote = config ? readOriginRemote(config) : undefined;
+        const canonical = remote ? canonicalizeGitRemote(remote) : undefined;
+        if (canonical) {
+            return { key: opaqueKey("git", canonical), root, label: basename(root), portable: true };
+        }
+    }
+    return {
+        key: opaqueKey("local", `${hostname()}\0${root}`),
+        root,
+        label: basename(root) || root,
+        portable: false,
+    };
+}
+//# sourceMappingURL=credential-project.js.map

package/dist/core/secrets/credential-project.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-project.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-project.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGzE,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,CAAC;AACvC,MAAM,oBAAoB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEzC,SAAS,SAAS,CAAC,IAAqB,EAAE,QAAgB;IACzD,OAAO,GAAG,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAE/D,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;YAClB,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACpB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACzB,OAAO,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QACnG,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ;aACvB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;aACnB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9E,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc;IACzD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC/D,OAAO,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,KAAK,CAAC;IACd,CAAC;AACF,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,QAAgB;IACxD,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,GAAG,QAAQ;YAAE,OAAO,SAAS,CAAC;QACrE,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAOD,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAAc;IAC9D,IAAI,MAAM,WAAW,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7C,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,OAAO,EAAE,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,OAAO,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,GAAW;IAC3C,IAAI,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACzE,IAAI,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAC;QACzC,OAAO,GAAG,MAAM,CAAC;IAClB,CAAC;AACF,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC1F,MAAM,WAAW,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,WAAW,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvF,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACzC,OAAO,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACvC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACvD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,SAAS;QACV,CAAC;QACD,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAW;IACzD,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjF,IAAI,UAAU,EAAE,CAAC;QAChB,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC1F,CAAC;IACF,CAAC;IACD,OAAO;QACN,GAAG,EAAE,SAAS,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;QACjD,IAAI;QACJ,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI;QAC7B,QAAQ,EAAE,KAAK;KACf,CAAC;AACH,CAAC","sourcesContent":["import { createHash } from \"node:crypto\";\nimport { readFile, realpath, stat } from \"node:fs/promises\";\nimport { hostname } from \"node:os\";\nimport { basename, dirname, isAbsolute, join, resolve } from \"node:path\";\nimport type { CredentialProjectIdentity } from \"./credential-manager.ts\";\n\nconst MAX_GIT_POINTER_BYTES = 4 * 1024;\nconst MAX_GIT_CONFIG_BYTES = 1024 * 1024;\n\nfunction opaqueKey(kind: \"git\" | \"local\", identity: string): string {\n\treturn `${kind}:${createHash(\"sha256\").update(identity).digest(\"hex\")}`;\n}\n\nfunction canonicalizeGitRemote(remote: string): string | undefined {\n\tconst candidate = remote.trim();\n\tif (!candidate || /[\\0\\r\\n]/.test(candidate)) return undefined;\n\n\tif (!candidate.includes(\"://\")) {\n\t\tconst scp = candidate.match(/^(?:[^@/\\s]+@)?([^:/\\s]+):(.+)$/);\n\t\tif (!scp) return undefined;\n\t\tconst host = scp[1]?.toLowerCase();\n\t\tconst path = scp[2]\n\t\t\t?.replace(/^\\/+/, \"\")\n\t\t\t.replace(/\\/+$/, \"\")\n\t\t\t.replace(/\\.git$/i, \"\");\n\t\treturn host && path ? `${host}/${path}` : undefined;\n\t}\n\n\ttry {\n\t\tconst url = new URL(candidate);\n\t\tif (![\"git:\", \"http:\", \"https:\", \"ssh:\"].includes(url.protocol) || !url.hostname) return undefined;\n\t\tconst path = url.pathname\n\t\t\t.replace(/^\\/+/, \"\")\n\t\t\t.replace(/\\/+$/, \"\")\n\t\t\t.replace(/\\.git$/i, \"\");\n\t\tif (!path) return undefined;\n\t\tconst host = `${url.hostname.toLowerCase()}${url.port ? `:${url.port}` : \"\"}`;\n\t\treturn `${host}/${path}`;\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\nexport function createPortableGitProjectKey(remote: string): string {\n\tconst canonical = canonicalizeGitRemote(remote);\n\tif (!canonical) throw new Error(\"Git remote is not portable.\");\n\treturn opaqueKey(\"git\", canonical);\n}\n\nasync function isDirectory(path: string): Promise<boolean> {\n\ttry {\n\t\treturn (await stat(path)).isDirectory();\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nasync function isFile(path: string): Promise<boolean> {\n\ttry {\n\t\treturn (await stat(path)).isFile();\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nasync function readBounded(path: string, maxBytes: number): Promise<string | undefined> {\n\ttry {\n\t\tconst metadata = await stat(path);\n\t\tif (!metadata.isFile() || metadata.size > maxBytes) return undefined;\n\t\treturn await readFile(path, \"utf8\");\n\t} catch {\n\t\treturn undefined;\n\t}\n}\n\ninterface GitRepositoryLocation {\n\troot: string;\n\tgitDir: string;\n}\n\nasync function resolveGitDirectory(root: string, marker: string): Promise<string | undefined> {\n\tif (await isDirectory(marker)) return marker;\n\tif (!(await isFile(marker))) return undefined;\n\tconst pointer = await readBounded(marker, MAX_GIT_POINTER_BYTES);\n\tconst gitDirValue = pointer?.match(/^gitdir:\\s*(.+?)\\s*$/im)?.[1];\n\tif (!gitDirValue || /[\\0\\r\\n]/.test(gitDirValue)) return undefined;\n\treturn resolve(root, gitDirValue);\n}\n\nasync function findGitRepository(cwd: string): Promise<GitRepositoryLocation | undefined> {\n\tlet current = await realpath(cwd).catch(() => resolve(cwd));\n\twhile (true) {\n\t\tconst gitDir = await resolveGitDirectory(current, join(current, \".git\"));\n\t\tif (gitDir) return { root: current, gitDir };\n\t\tconst parent = dirname(current);\n\t\tif (parent === current) return undefined;\n\t\tcurrent = parent;\n\t}\n}\n\nasync function resolveGitConfigPath(gitDir: string): Promise<string | undefined> {\n\tconst direct = join(gitDir, \"config\");\n\tif (await isFile(direct)) return direct;\n\tconst commonPointer = await readBounded(join(gitDir, \"commondir\"), MAX_GIT_POINTER_BYTES);\n\tconst commonValue = commonPointer?.trim();\n\tif (!commonValue || /[\\0\\r\\n]/.test(commonValue)) return undefined;\n\tconst commonDir = isAbsolute(commonValue) ? commonValue : resolve(gitDir, commonValue);\n\tconst shared = join(commonDir, \"config\");\n\treturn (await isFile(shared)) ? shared : undefined;\n}\n\nfunction readOriginRemote(config: string): string | undefined {\n\tlet inOrigin = false;\n\tfor (const line of config.split(/\\r?\\n/)) {\n\t\tconst section = line.match(/^\\s*\\[([^\\]]+)]\\s*$/)?.[1];\n\t\tif (section !== undefined) {\n\t\t\tinOrigin = /^remote\\s+\"origin\"$/i.test(section.trim());\n\t\t\tcontinue;\n\t\t}\n\t\tif (!inOrigin) continue;\n\t\tconst assignment = line.match(/^\\s*url\\s*=\\s*(.*?)\\s*$/i)?.[1];\n\t\tif (assignment) return assignment;\n\t}\n\treturn undefined;\n}\n\nexport async function resolveCredentialProject(cwd: string): Promise<CredentialProjectIdentity> {\n\tconst repository = await findGitRepository(cwd);\n\tconst root = repository?.root ?? (await realpath(cwd).catch(() => resolve(cwd)));\n\tif (repository) {\n\t\tconst configPath = await resolveGitConfigPath(repository.gitDir);\n\t\tconst config = configPath ? await readBounded(configPath, MAX_GIT_CONFIG_BYTES) : undefined;\n\t\tconst remote = config ? readOriginRemote(config) : undefined;\n\t\tconst canonical = remote ? canonicalizeGitRemote(remote) : undefined;\n\t\tif (canonical) {\n\t\t\treturn { key: opaqueKey(\"git\", canonical), root, label: basename(root), portable: true };\n\t\t}\n\t}\n\treturn {\n\t\tkey: opaqueKey(\"local\", `${hostname()}\\0${root}`),\n\t\troot,\n\t\tlabel: basename(root) || root,\n\t\tportable: false,\n\t};\n}\n"]}

package/dist/core/secrets/secret-dotenv.d.ts

@@ -18,7 +18,7 @@ export interface ParsedDotenvDocument {
 export declare function validateDotenvVariableName(name: string): string;
 export declare function validateDotenvValue(value: string): string;
 /**
- * Parse the practical dotenv surface Pi materializes: comments, blank lines, optional `export`,
+ * Parse the practical dotenv surface Pi accepts for provider-backed credential profiles: comments, blank lines, optional `export`,
  * unquoted values, and single/double/backtick quoted values (including multiline quoted values).
  * Error messages contain only a line number and grammar reason, never the rejected value.
  */