@caupulican/pi-adaptative 0.85.8 → 0.86.2

package/dist/core/tools/secret-store.js

@@ -1,355 +1,90 @@
 import { Type } from "typebox";
-import { ExtensionEditorComponent } from "../../modes/interactive/components/extension-editor.js";
 import { defineTool } from "../extensions/types.js";
-import { parseDotenvDocument, SecretDotenvError } from "../secrets/secret-dotenv.js";
-import { MAX_VARIABLES_PER_PROFILE, SECRET_DESCRIPTION_MAX_CHARS, SECRET_PRINTABLE_METADATA_PATTERN, SECRET_PROFILE_ID_MAX_CHARS, SECRET_PROFILE_ID_PATTERN, SECRET_VARIABLE_NAME_MAX_CHARS, SECRET_VARIABLE_NAME_PATTERN, SecretVault, SecretVaultError, } from "../secrets/secret-vault.js";
+import { CredentialManagerError, CredentialStorageError, } from "../secrets/credential-manager.js";
 import { emptyOrchestrationCall, OrchestrationPanelComponent, } from "./orchestration-panel.js";
 const secretStoreSchema = Type.Object({
-    action: Type.Union([
-        Type.Literal("set"),
-        Type.Literal("list"),
-        Type.Literal("materialize"),
-        Type.Literal("remove"),
-        Type.Literal("lock"),
-    ], { description: "Credential-management action." }),
+    action: Type.Union([Type.Literal("status"), Type.Literal("list"), Type.Literal("activate")], {
+        description: "Credential-use action. Credential mutation is owner-only through /secrets.",
+    }),
     profile: Type.Optional(Type.String({
         minLength: 1,
-        maxLength: SECRET_PROFILE_ID_MAX_CHARS,
-        pattern: SECRET_PROFILE_ID_PATTERN,
-        description: "Portable profile identifier, such as project-dev or aws-work.",
-    })),
-    description: Type.Optional(Type.String({
-        minLength: 1,
-        maxLength: SECRET_DESCRIPTION_MAX_CHARS,
-        pattern: SECRET_PRINTABLE_METADATA_PATTERN,
-        description: "Non-secret profile description.",
-    })),
-    envFile: Type.Optional(Type.String({
-        minLength: 1,
-        maxLength: 512,
-        description: "Relative dotenv location inside the current workspace, such as .env, .env.local, or config/dev.env. Valid only for set.",
-    })),
-    variableNames: Type.Optional(Type.Array(Type.String({
-        minLength: 1,
-        maxLength: SECRET_VARIABLE_NAME_MAX_CHARS,
-        pattern: SECRET_VARIABLE_NAME_PATTERN,
-    }), {
-        minItems: 1,
-        maxItems: MAX_VARIABLES_PER_PROFILE,
-        description: "Specific variable names to remove. Omit to remove the whole profile.",
-    })),
-    scope: Type.Optional(Type.Union([Type.Literal("managed"), Type.Literal("workspace")], {
-        description: "Materialization target. workspace resolves the durable current-project binding; managed writes private Pi state.",
+        maxLength: 96,
+        pattern: "^[A-Za-z0-9][A-Za-z0-9._-]*$",
+        description: "Bound profile to activate. Omit when the project has exactly one bound profile.",
     })),
 }, { additionalProperties: false });
 function result(details, text) {
     return { content: [{ type: "text", text }], details };
 }
-function cancelled(action, profile) {
-    return result({ action, status: "cancelled", ...(profile ? { profile } : {}), code: "owner_cancelled" }, "Secret store action was cancelled by the owner.");
-}
-function failed(action, error, profile) {
-    const code = error instanceof SecretVaultError ? error.code : "safe_failure";
-    const message = error instanceof SecretVaultError ? error.message : "Secret store failed safely without exposing values.";
-    return result({ action, status: "error", ...(profile ? { profile } : {}), code, message }, `Secret store failed: ${message}`);
+function invalid(input) {
+    if (input.action !== "activate" && input.profile !== undefined) {
+        return result({
+            action: input.action,
+            status: "error",
+            code: "unexpected_profile",
+            message: `Action ${input.action} does not accept a profile.`,
+        }, `Secret store request is invalid: action ${input.action} does not accept a profile.`);
+    }
+    return undefined;
 }
-function invalid(action, code, message, profile) {
-    return result({ action, status: "error", ...(profile ? { profile } : {}), code, message }, `Secret store request is invalid: ${message}`);
+function failed(input, error) {
+    const known = error instanceof CredentialManagerError || error instanceof CredentialStorageError;
+    const code = known ? error.code : "safe_failure";
+    const message = known ? error.message : "Credential activation failed safely without exposing values.";
+    const status = ["owner_setup_required", "not_connected", "provider_unavailable"].includes(code)
+        ? "unavailable"
+        : "error";
+    return result({
+        action: input.action,
+        status,
+        ...(input.profile ? { profile: input.profile } : {}),
+        code,
+        message,
+    }, `Credential action failed: ${message}`);
 }
 function panelModel(details, expanded) {
     if (!details)
-        return { label: "secrets", status: "error", emptyText: "No secret-store result was retained." };
-    const success = ["listed", "locked", "materialized", "removed", "stored"].includes(details.status);
-    const rows = expanded
-        ? (details.profiles ?? []).map((profile) => ({
-            status: "info",
-            label: profile.profile,
-            meta: [
-                `${profile.variableNames.length} variable${profile.variableNames.length === 1 ? "" : "s"}`,
-                `${profile.bindings.length} binding${profile.bindings.length === 1 ? "" : "s"}`,
-            ],
-            details: [
-                ...(profile.description ? [profile.description] : []),
-                ...profile.bindings.map((binding) => `${binding.envFile} · ${binding.workspace}`),
-            ],
-        }))
-        : undefined;
+        return { label: "secrets", status: "error", emptyText: "No credential result was retained." };
+    const success = ["activated", "available", "listed"].includes(details.status);
     return {
         label: "secrets",
         action: details.status,
         status: success ? "success" : details.status === "cancelled" ? "warning" : "error",
         summary: [
             details.profile,
-            details.envFile,
-            details.scope,
+            details.project,
             details.variableNames
                 ? `${details.variableNames.length} variable${details.variableNames.length === 1 ? "" : "s"}`
                 : undefined,
             details.profiles ? `${details.profiles.length} profile${details.profiles.length === 1 ? "" : "s"}` : undefined,
         ].filter((value) => value !== undefined),
-        rows,
+        rows: expanded
+            ? details.profiles?.map((profile) => ({
+                status: profile.boundToCurrentProject ? "succeeded" : "info",
+                label: profile.profile,
+                meta: [
+                    `${profile.variableNames.length} variable${profile.variableNames.length === 1 ? "" : "s"}`,
+                    profile.boundToCurrentProject ? "bound here" : "not bound here",
+                ],
+                details: profile.description ? [profile.description] : undefined,
+            }))
+            : undefined,
         notices: expanded && details.message ? [{ status: success ? "info" : "error", text: details.message }] : undefined,
     };
 }
-async function ensureUnlocked(vault, action, ctx, signal, profile) {
-    if (vault.isUnlocked)
-        return undefined;
-    if (await vault.exists()) {
-        while (!signal?.aborted) {
-            let passphrase = await ctx.ui.input("Unlock secret vault", "Master passphrase", {
-                signal,
-                sensitive: true,
-            });
-            if (passphrase === undefined || signal?.aborted)
-                return cancelled(action, profile);
-            try {
-                await vault.unlock(passphrase);
-                return undefined;
-            }
-            catch (error) {
-                if (error instanceof SecretVaultError && ["invalid_passphrase", "unlock_failed"].includes(error.code)) {
-                    ctx.ui.notify(error.message, "error");
-                    continue;
-                }
-                return failed(action, error, profile);
-            }
-            finally {
-                passphrase = "";
-            }
-        }
-        return cancelled(action, profile);
-    }
-    while (!signal?.aborted) {
-        let passphrase = await ctx.ui.input("Create secret vault", "New master passphrase", { signal, sensitive: true });
-        if (passphrase === undefined || signal?.aborted)
-            return cancelled(action, profile);
-        let confirmation = await ctx.ui.input("Confirm secret vault", "Repeat master passphrase", {
-            signal,
-            sensitive: true,
-        });
-        if (confirmation === undefined || signal?.aborted) {
-            passphrase = "";
-            return cancelled(action, profile);
-        }
-        try {
-            if (passphrase !== confirmation) {
-                ctx.ui.notify("The two master passphrases do not match.", "error");
-                continue;
-            }
-            await vault.initialize(passphrase);
-            return undefined;
-        }
-        catch (error) {
-            if (error instanceof SecretVaultError && error.code === "invalid_passphrase") {
-                ctx.ui.notify(error.message, "error");
-                continue;
-            }
-            return failed(action, error, profile);
-        }
-        finally {
-            passphrase = "";
-            confirmation = "";
-        }
-    }
-    return cancelled(action, profile);
-}
-function validateInput(input) {
-    if (input.action === "lock" || input.action === "list") {
-        if (input.profile !== undefined ||
-            input.description !== undefined ||
-            input.envFile !== undefined ||
-            input.variableNames !== undefined ||
-            input.scope !== undefined) {
-            return invalid(input.action, "unexpected_fields", `Action ${input.action} does not accept profile fields.`);
-        }
-        return undefined;
-    }
-    if (input.action === "set" && !input.profile) {
-        return invalid(input.action, "profile_required", "Action set requires a profile.");
-    }
-    if (input.action === "remove" && !input.profile) {
-        return invalid(input.action, "profile_required", "Action remove requires a profile.");
-    }
-    if (input.action !== "set" && (input.description !== undefined || input.envFile !== undefined)) {
-        return invalid(input.action, "unexpected_profile_fields", "description and envFile are valid only for set.", input.profile);
-    }
-    if (input.action !== "remove" && input.variableNames !== undefined) {
-        return invalid(input.action, "unexpected_variable_names", "variableNames is valid only for remove.", input.profile);
-    }
-    if (input.action !== "materialize" && input.scope !== undefined) {
-        return invalid(input.action, "unexpected_scope", "scope is valid only for materialize.", input.profile);
-    }
-    if (input.variableNames && new Set(input.variableNames).size !== input.variableNames.length) {
-        return invalid(input.action, "duplicate_variables", "Variable names must be unique.", input.profile);
-    }
-    return undefined;
-}
-async function openPrivateDotenvEditor(ctx, title, prefill, signal) {
-    if (signal?.aborted)
-        return undefined;
-    try {
-        return await ctx.ui.custom((tui, _theme, keybindings, done) => new ExtensionEditorComponent(tui, keybindings, title, prefill, (value) => done(value), () => done(undefined), {
-            privateContent: true,
-            allowExternalEditor: false,
-            signal,
-            notice: "Private plaintext editor · content stays local and never enters model context",
-        }));
-    }
-    catch (error) {
-        if (signal?.aborted)
-            return undefined;
-        throw error;
-    }
-}
-async function captureValidDotenv(ctx, title, prefill, signal) {
-    let draft = prefill;
-    while (!signal?.aborted) {
-        const edited = await openPrivateDotenvEditor(ctx, title, draft, signal);
-        if (edited === undefined || signal?.aborted)
-            return undefined;
-        try {
-            const parsed = parseDotenvDocument(edited);
-            const variableNames = parsed.variables.map((variable) => variable.name);
-            for (const variable of parsed.variables)
-                variable.value = "";
-            draft = "";
-            return { document: parsed.document, variableNames };
-        }
-        catch (error) {
-            ctx.ui.notify(error instanceof SecretDotenvError ? error.message : "The dotenv document is invalid.", "error");
-            draft = edited;
-        }
-    }
-    return undefined;
-}
-async function executeSet(vault, input, ctx, signal) {
-    let document = "";
-    let originalUnmanagedContent;
-    try {
-        const target = vault.resolveBindingTarget(ctx.cwd, input.envFile ?? ".env");
-        const destinationState = await vault.inspectEnvDestination(target.destination, input.profile);
-        if (destinationState === "managed-other") {
-            return invalid(input.action, "destination_conflict", "The selected dotenv location is already managed by another profile.", input.profile);
-        }
-        const storedDocument = await vault.getProfileDocument(input.profile);
-        let prefill = storedDocument ?? "";
-        if (destinationState === "unmanaged") {
-            originalUnmanagedContent = await vault.readOwnerDotenv(target.destination);
-            prefill = originalUnmanagedContent;
-        }
-        if (destinationState === "managed-profile" && storedDocument === undefined) {
-            return invalid(input.action, "profile_missing", "The dotenv target claims this profile, but the encrypted profile is missing.", input.profile);
-        }
-        const captured = await captureValidDotenv(ctx, `Secrets · ${input.profile}  →  ${target.destination}`, prefill, signal);
-        prefill = "";
-        if (!captured)
-            return cancelled(input.action, input.profile);
-        document = captured.document;
-        await vault.replaceProfileDocument(input.profile, input.description, document, {
-            workspace: target.workspace,
-            envFile: target.envFile,
-        });
-        try {
-            await vault.materializeEnv(input.profile, target.destination, {
-                allowReplaceUnmanaged: destinationState === "unmanaged",
-                expectedUnmanagedContent: originalUnmanagedContent,
-            });
-        }
-        catch (error) {
-            const message = error instanceof SecretVaultError ? error.message : "Dotenv materialization failed safely.";
-            ctx.ui.notify(`Profile stored, but ${target.destination} was not refreshed: ${message}`, "warning");
-            return result({
-                action: input.action,
-                status: "stored",
-                profile: input.profile,
-                envFile: target.envFile,
-                variableNames: captured.variableNames,
-                materialized: false,
-                code: "materialization_failed",
-                message,
-            }, `Stored profile ${input.profile}, but its bound dotenv could not be refreshed. Retry secret_store materialize; no values were exposed.`);
-        }
-        ctx.ui.notify(`Credential profile ${input.profile} stored and activated at ${target.destination}`, "info");
-        return result({
-            action: input.action,
-            status: "stored",
-            profile: input.profile,
-            envFile: target.envFile,
-            variableNames: captured.variableNames,
-            materialized: true,
-        }, `Stored and activated ${captured.variableNames.length} variables for profile ${input.profile} at its bound workspace dotenv location. Values never entered model context.`);
-    }
-    catch (error) {
-        return failed(input.action, error, input.profile);
-    }
-    finally {
-        document = "";
-        originalUnmanagedContent = undefined;
-    }
-}
-async function executeMaterialize(vault, input, ctx) {
-    try {
-        const scope = input.scope ?? "workspace";
-        const binding = await vault.resolveBindingForWorkspace(ctx.cwd, input.profile);
-        const destination = scope === "managed" ? vault.getManagedEnvPath(binding.profile) : binding.destination;
-        const destinationState = await vault.inspectEnvDestination(destination, binding.profile);
-        if (destinationState === "unmanaged" || destinationState === "managed-other") {
-            return invalid(input.action, "destination_conflict", "The bound dotenv location is no longer safely managed. Use set to review it in the private editor.", binding.profile);
-        }
-        const materialized = await vault.materializeEnv(binding.profile, destination, {
-            activationWorkspace: ctx.cwd,
-            managed: scope === "managed",
-        });
-        ctx.ui.notify(`Credential profile ${binding.profile} activated at ${destination}`, "info");
-        return result({
-            action: input.action,
-            status: "materialized",
-            profile: binding.profile,
-            variableNames: materialized.variableNames,
-            scope,
-            envFile: scope === "workspace" ? binding.envFile : undefined,
-            materialized: true,
-        }, `Activated profile ${binding.profile} for the current workspace. Its dotenv and process environment are available without exposing values to the model.`);
-    }
-    catch (error) {
-        return failed(input.action, error, input.profile);
-    }
-}
-async function executeRemove(vault, input, ctx, signal) {
-    const target = input.variableNames?.length
-        ? `${input.variableNames.join(", ")} from profile ${input.profile}`
-        : `the entire profile ${input.profile}`;
-    const approved = await ctx.ui.confirm("Remove stored secrets", `Remove ${target}? Pi-managed workspace and private dotenv copies are invalidated.`, { signal });
-    if (!approved || signal?.aborted)
-        return cancelled(input.action, input.profile);
-    try {
-        const removal = await vault.removeProfile(input.profile, input.variableNames);
-        return result({
-            action: input.action,
-            status: "removed",
-            profile: input.profile,
-            variableNames: removal.removedVariableNames,
-        }, `Removed ${removal.removedVariableNames.length} secret variable${removal.removedVariableNames.length === 1 ? "" : "s"} from profile ${input.profile}.`);
-    }
-    catch (error) {
-        return failed(input.action, error, input.profile);
-    }
-}
 export function createSecretStoreToolDefinition(options) {
-    const vault = options.vault ?? (options.agentDir ? SecretVault.forAgentDir(options.agentDir) : undefined);
-    if (!vault)
-        throw new Error("secret_store requires an agentDir or SecretVault");
+    const { manager } = options;
     return defineTool({
         name: "secret_store",
         label: "Secret Store",
-        description: "Open a model-blind native dotenv editor, encrypt owner credentials, bind profiles to workspace dotenv locations, and activate them for normal process use without returning values to the model.",
-        promptSnippet: "Manage credentials through the model-blind secret vault. Before credential-dependent work, materialize the current workspace binding; use set to open the owner's private dotenv editor.",
+        description: "Discover and activate owner-authorized Bitwarden credential profiles for the current project without exposing values.",
+        promptSnippet: "Activate project credentials with secret_store before credential-dependent commands. Credential setup and mutation are owner-only through /secrets.",
         promptGuidelines: [
-            "Use secret_store whenever credentials are needed. Never ask the owner to paste a secret into chat or place a value in tool arguments.",
-            "Use set with a profile and relative envFile. The harness opens a private plaintext editor, persists the workspace binding, writes the dotenv, and activates the environment.",
-            "Before credential-dependent commands in a later session, call materialize without a profile to resolve the current workspace binding. Use list only when selection or discovery is needed.",
-            "After activation, run the consuming application normally. Never read, grep, print, echo, source, or otherwise inspect credential files or environment values.",
-            "Treat cancellation as owner intent. Do not immediately repeat the same credential request.",
+            "Use secret_store activate before credential-dependent work. It works in TUI, print, and RPC modes and returns metadata only.",
+            "Omit profile when the project has one binding. Use list to select among multiple authorized profiles.",
+            "Never ask the owner to paste a credential into chat or pass a value through tool arguments.",
+            "After activation, run the consuming command normally. Never print, inspect, grep, or echo credential environment values.",
+            "If owner_setup_required is returned, tell the owner to run /secrets in a TUI session. Do not repeatedly retry.",
         ],
         parameters: secretStoreSchema,
         executionMode: "sequential",
@@ -361,50 +96,50 @@ export function createSecretStoreToolDefinition(options) {
             if (isPartial) {
                 return new OrchestrationPanelComponent(theme, {
                     label: "secrets",
-                    action: "waiting for you",
+                    action: "activating",
                     status: "running",
                 });
             }
             return new OrchestrationPanelComponent(theme, panelModel(toolResult.details, expanded), expanded);
         },
         async execute(_toolCallId, input, signal, _onUpdate, ctx) {
-            if (!ctx.hasUI || ctx.mode !== "tui") {
-                return result({
-                    action: input.action,
-                    status: "unavailable",
-                    ...(input.profile ? { profile: input.profile } : {}),
-                    code: "user_tui_required",
-                    message: "Secret values can be captured only in a user-visible TUI session.",
-                }, "secret_store requires a user-visible TUI session.");
+            if (signal?.aborted) {
+                return result({ action: input.action, status: "cancelled", code: "cancelled" }, "Credential action cancelled.");
             }
-            if (signal?.aborted)
-                return cancelled(input.action, input.profile);
-            const validation = validateInput(input);
+            const validation = invalid(input);
             if (validation)
                 return validation;
-            if (input.action === "lock") {
-                vault.lock();
-                return result({ action: input.action, status: "locked" }, "Secret vault locked; cached key, credential environment, and exact-value redaction cache were cleared.");
-            }
             try {
-                const unlockResult = await ensureUnlocked(vault, input.action, ctx, signal, input.profile);
-                if (unlockResult)
-                    return unlockResult;
-                if (input.action === "list") {
-                    const profiles = await vault.listProfiles();
-                    return result({ action: input.action, status: "listed", profiles }, `Secret vault contains ${profiles.length} profile${profiles.length === 1 ? "" : "s"}. Only names, variable names, and workspace bindings were returned.`);
+                if (input.action === "status") {
+                    const status = manager.status;
+                    if (!status.sessionAvailable) {
+                        return result({
+                            action: input.action,
+                            status: "unavailable",
+                            connected: false,
+                            code: "owner_setup_required",
+                            message: "The owner must connect Bitwarden with /secrets.",
+                        }, "Bitwarden owner setup is required. Run /secrets in a TUI session.");
+                    }
+                    return result({ action: input.action, status: "available", connected: status.connected }, status.connected
+                        ? "Bitwarden is connected for this Pi session."
+                        : "A Bitwarden session key is available and will be validated on activation.");
                 }
-                if (input.action === "set" && input.profile) {
-                    return executeSet(vault, { ...input, profile: input.profile }, ctx, signal);
+                if (input.action === "list") {
+                    const profiles = await manager.listForProject(ctx.cwd, signal);
+                    return result({ action: input.action, status: "listed", profiles }, `Found ${profiles.length} credential profile${profiles.length === 1 ? "" : "s"}; only metadata was returned.`);
                 }
-                if (input.action === "materialize")
-                    return executeMaterialize(vault, input, ctx);
-                if (!input.profile)
-                    return invalid(input.action, "profile_required", "A profile is required.");
-                return executeRemove(vault, { ...input, profile: input.profile }, ctx, signal);
+                const activated = await manager.activateForProject(ctx.cwd, input.profile, signal);
+                return result({
+                    action: input.action,
+                    status: "activated",
+                    profile: activated.profile,
+                    variableNames: activated.variableNames,
+                    project: activated.project,
+                }, `Activated ${activated.profile} for ${activated.project}. Credential values remain hidden.`);
             }
             catch (error) {
-                return failed(input.action, error, input.profile);
+                return failed(input, error);
             }
         },
     });

package/dist/core/tools/secret-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../../src/core/tools/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAElG,OAAO,EAAE,UAAU,EAAyB,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrF,OAAO,EACN,yBAAyB,EACzB,4BAA4B,EAC5B,iCAAiC,EACjC,2BAA2B,EAC3B,yBAAyB,EACzB,8BAA8B,EAC9B,4BAA4B,EAE5B,WAAW,EACX,gBAAgB,GAChB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACN,sBAAsB,EACtB,2BAA2B,GAE3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CACpC;IACC,MAAM,EAAE,IAAI,CAAC,KAAK,CACjB;QACC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;KACpB,EACD,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAChD;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,2BAA2B;QACtC,OAAO,EAAE,yBAAyB;QAClC,WAAW,EAAE,+DAA+D;KAC5E,CAAC,CACF;IACD,WAAW,EAAE,IAAI,CAAC,QAAQ,CACzB,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,4BAA4B;QACvC,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EAAE,iCAAiC;KAC9C,CAAC,CACF;IACD,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,WAAW,EACV,yHAAyH;KAC1H,CAAC,CACF;IACD,aAAa,EAAE,IAAI,CAAC,QAAQ,CAC3B,IAAI,CAAC,KAAK,CACT,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,8BAA8B;QACzC,OAAO,EAAE,4BAA4B;KACrC,CAAC,EACF;QACC,QAAQ,EAAE,CAAC;QACX,QAAQ,EAAE,yBAAyB;QACnC,WAAW,EAAE,sEAAsE;KACnF,CACD,CACD;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE;QAChE,WAAW,EACV,kHAAkH;KACnH,CAAC,CACF;CACD,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B,CAAC;AAqCF,SAAS,MAAM,CAAC,OAA+B,EAAE,IAAY;IAC5D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,MAAsC,EAAE,OAAgB;IAC1E,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EACzF,iDAAiD,CACjD,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,MAAsC,EAAE,KAAc,EAAE,OAAgB;IACvF,MAAM,IAAI,GAAG,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IAC7E,MAAM,OAAO,GACZ,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,qDAAqD,CAAC;IAC3G,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAC3E,wBAAwB,OAAO,EAAE,CACjC,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CACf,MAAsC,EACtC,IAAY,EACZ,OAAe,EACf,OAAgB;IAEhB,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAC3E,oCAAoC,OAAO,EAAE,CAC7C,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAA2C,EAAE,QAAiB;IACjF,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,sCAAsC,EAAE,CAAC;IAC9G,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnG,MAAM,IAAI,GAAG,QAAQ;QACpB,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3C,MAAM,EAAE,MAAe;YACvB,KAAK,EAAE,OAAO,CAAC,OAAO;YACtB,IAAI,EAAE;gBACL,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,YAAY,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC1F,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,WAAW,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;aAC/E;YACD,OAAO,EAAE;gBACR,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrD,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;aACjF;SACD,CAAC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IACb,OAAO;QACN,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QAClF,OAAO,EAAE;YACR,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,KAAK;YACb,OAAO,CAAC,aAAa;gBACpB,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,YAAY,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC5F,CAAC,CAAC,SAAS;YACZ,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,WAAW,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;SAC9G,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACzD,IAAI;QACJ,OAAO,EACN,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;KAC1G,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,KAAkB,EAClB,MAAsC,EACtC,GAAqB,EACrB,MAA+B,EAC/B,OAAgB;IAEhB,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IACvC,IAAI,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YACzB,IAAI,UAAU,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,mBAAmB,EAAE;gBAC/E,MAAM;gBACN,SAAS,EAAE,IAAI;aACf,CAAC,CAAC;YACH,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACnF,IAAI,CAAC;gBACJ,MAAM,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBAC/B,OAAO,SAAS,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,gBAAgB,IAAI,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvG,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;oBACtC,SAAS;gBACV,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACvC,CAAC;oBAAS,CAAC;gBACV,UAAU,GAAG,EAAE,CAAC;YACjB,CAAC;QACF,CAAC;QACD,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,IAAI,UAAU,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjH,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnF,IAAI,YAAY,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,sBAAsB,EAAE,0BAA0B,EAAE;YACzF,MAAM;YACN,SAAS,EAAE,IAAI;SACf,CAAC,CAAC;QACH,IAAI,YAAY,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACnD,UAAU,GAAG,EAAE,CAAC;YAChB,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC;YACJ,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;gBACjC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,0CAA0C,EAAE,OAAO,CAAC,CAAC;gBACnE,SAAS;YACV,CAAC;YACD,MAAM,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;YACnC,OAAO,SAAS,CAAC;QAClB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;gBAC9E,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACtC,SAAS;YACV,CAAC;YACD,OAAO,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;gBAAS,CAAC;YACV,UAAU,GAAG,EAAE,CAAC;YAChB,YAAY,GAAG,EAAE,CAAC;QACnB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,aAAa,CAAC,KAA2B;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxD,IACC,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,KAAK,CAAC,WAAW,KAAK,SAAS;YAC/B,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,KAAK,CAAC,aAAa,KAAK,SAAS;YACjC,KAAK,CAAC,KAAK,KAAK,SAAS,EACxB,CAAC;YACF,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,mBAAmB,EAAE,UAAU,KAAK,CAAC,MAAM,kCAAkC,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACjD,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,mCAAmC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,EAAE,CAAC;QAChG,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,2BAA2B,EAC3B,iDAAiD,EACjD,KAAK,CAAC,OAAO,CACb,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACpE,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,2BAA2B,EAC3B,yCAAyC,EACzC,KAAK,CAAC,OAAO,CACb,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QACjE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,sCAAsC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;QAC7F,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,qBAAqB,EAAE,gCAAgC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,uBAAuB,CACrC,GAAqB,EACrB,KAAa,EACb,OAAe,EACf,MAA+B;IAE/B,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC;QACJ,OAAO,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CACzB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAClC,IAAI,wBAAwB,CAC3B,GAAG,EACH,WAAW,EACX,KAAK,EACL,OAAO,EACP,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EACtB,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EACrB;YACC,cAAc,EAAE,IAAI;YACpB,mBAAmB,EAAE,KAAK;YAC1B,MAAM;YACN,MAAM,EAAE,+EAA+E;SACvF,CACD,CACF,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QACtC,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,GAAqB,EACrB,KAAa,EACb,OAAe,EACf,MAA+B;IAE/B,IAAI,KAAK,GAAG,OAAO,CAAC;IACpB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QAC9D,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACxE,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YAC7D,KAAK,GAAG,EAAE,CAAC;YACX,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,YAAY,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,iCAAiC,EAAE,OAAO,CAAC,CAAC;YAC/G,KAAK,GAAG,MAAM,CAAC;QAChB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,UAAU,CACxB,KAAkB,EAClB,KAAiD,EACjD,GAAqB,EACrB,MAA+B;IAE/B,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,wBAA4C,CAAC;IACjD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC;QAC5E,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9F,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;YAC1C,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,sBAAsB,EACtB,qEAAqE,EACrE,KAAK,CAAC,OAAO,CACb,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrE,IAAI,OAAO,GAAG,cAAc,IAAI,EAAE,CAAC;QACnC,IAAI,gBAAgB,KAAK,WAAW,EAAE,CAAC;YACtC,wBAAwB,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC3E,OAAO,GAAG,wBAAwB,CAAC;QACpC,CAAC;QACD,IAAI,gBAAgB,KAAK,iBAAiB,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YAC5E,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,iBAAiB,EACjB,8EAA8E,EAC9E,KAAK,CAAC,OAAO,CACb,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACxC,GAAG,EACH,aAAa,KAAK,CAAC,OAAO,QAAQ,MAAM,CAAC,WAAW,EAAE,EACtD,OAAO,EACP,MAAM,CACN,CAAC;QACF,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,QAAQ,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC7B,MAAM,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE;YAC9E,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;SACvB,CAAC,CAAC;QACH,IAAI,CAAC;YACJ,MAAM,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,WAAW,EAAE;gBAC7D,qBAAqB,EAAE,gBAAgB,KAAK,WAAW;gBACvD,wBAAwB,EAAE,wBAAwB;aAClD,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uCAAuC,CAAC;YAC5G,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,uBAAuB,MAAM,CAAC,WAAW,uBAAuB,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;YACpG,OAAO,MAAM,CACZ;gBACC,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,YAAY,EAAE,KAAK;gBACnB,IAAI,EAAE,wBAAwB;gBAC9B,OAAO;aACP,EACD,kBAAkB,KAAK,CAAC,OAAO,wGAAwG,CACvI,CAAC;QACH,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,KAAK,CAAC,OAAO,4BAA4B,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3G,OAAO,MAAM,CACZ;YACC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,YAAY,EAAE,IAAI;SAClB,EACD,wBAAwB,QAAQ,CAAC,aAAa,CAAC,MAAM,0BAA0B,KAAK,CAAC,OAAO,8EAA8E,CAC1K,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;YAAS,CAAC;QACV,QAAQ,GAAG,EAAE,CAAC;QACd,wBAAwB,GAAG,SAAS,CAAC;IACtC,CAAC;AACF,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,KAAkB,EAClB,KAA2B,EAC3B,GAAqB;IAErB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QACzG,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACzF,IAAI,gBAAgB,KAAK,WAAW,IAAI,gBAAgB,KAAK,eAAe,EAAE,CAAC;YAC9E,OAAO,OAAO,CACb,KAAK,CAAC,MAAM,EACZ,sBAAsB,EACtB,oGAAoG,EACpG,OAAO,CAAC,OAAO,CACf,CAAC;QACH,CAAC;QACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE;YAC7E,mBAAmB,EAAE,GAAG,CAAC,GAAG;YAC5B,OAAO,EAAE,KAAK,KAAK,SAAS;SAC5B,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,sBAAsB,OAAO,CAAC,OAAO,iBAAiB,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3F,OAAO,MAAM,CACZ;YACC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,KAAK;YACL,OAAO,EAAE,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;YAC5D,YAAY,EAAE,IAAI;SAClB,EACD,qBAAqB,OAAO,CAAC,OAAO,oHAAoH,CACxJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;AACF,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,KAAkB,EAClB,KAAiD,EACjD,GAAqB,EACrB,MAA+B;IAE/B,MAAM,MAAM,GAAG,KAAK,CAAC,aAAa,EAAE,MAAM;QACzC,CAAC,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,OAAO,EAAE;QACnE,CAAC,CAAC,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,OAAO,CACpC,uBAAuB,EACvB,UAAU,MAAM,mEAAmE,EACnF,EAAE,MAAM,EAAE,CACV,CAAC;IACF,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE,OAAO;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChF,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QAC9E,OAAO,MAAM,CACZ;YACC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,aAAa,EAAE,OAAO,CAAC,oBAAoB;SAC3C,EACD,WAAW,OAAO,CAAC,oBAAoB,CAAC,MAAM,mBAAmB,OAAO,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,iBAAiB,KAAK,CAAC,OAAO,GAAG,CACtJ,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;AACF,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAA+B;IAC9E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1G,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IAChF,OAAO,UAAU,CAAmD;QACnE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,cAAc;QACrB,WAAW,EACV,kMAAkM;QACnM,aAAa,EACZ,0LAA0L;QAC3L,gBAAgB,EAAE;YACjB,uIAAuI;YACvI,8KAA8K;YAC9K,4LAA4L;YAC5L,+JAA+J;YAC/J,4FAA4F;SAC5F;QACD,UAAU,EAAE,iBAAiB;QAC7B,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,MAAM;QACnB,UAAU;YACT,OAAO,sBAAsB,EAAE,CAAC;QACjC,CAAC;QACD,YAAY,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,KAAY;YAC7D,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,2BAA2B,CAAC,KAAK,EAAE;oBAC7C,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE,iBAAiB;oBACzB,MAAM,EAAE,SAAS;iBACjB,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,2BAA2B,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnG,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG;YACvD,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;gBACtC,OAAO,MAAM,CACZ;oBACC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,aAAa;oBACrB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpD,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,mEAAmE;iBAC5E,EACD,mDAAmD,CACnD,CAAC;YACH,CAAC;YACD,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACnE,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;YAClC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,KAAK,CAAC,IAAI,EAAE,CAAC;gBACb,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAC1C,wGAAwG,CACxG,CAAC;YACH,CAAC;YACD,IAAI,CAAC;gBACJ,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC3F,IAAI,YAAY;oBAAE,OAAO,YAAY,CAAC;gBACtC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC7B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;oBAC5C,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EACpD,yBAAyB,QAAQ,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,qEAAqE,CACxJ,CAAC;gBACH,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;oBAC7C,OAAO,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC7E,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa;oBAAE,OAAO,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;gBACjF,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,EAAE,wBAAwB,CAAC,CAAC;gBAC/F,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;YAChF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACnD,CAAC;QACF,CAAC;KACD,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { type Static, Type } from \"typebox\";\nimport { ExtensionEditorComponent } from \"../../modes/interactive/components/extension-editor.ts\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport { defineTool, type ExtensionContext } from \"../extensions/types.ts\";\nimport { parseDotenvDocument, SecretDotenvError } from \"../secrets/secret-dotenv.ts\";\nimport {\n\tMAX_VARIABLES_PER_PROFILE,\n\tSECRET_DESCRIPTION_MAX_CHARS,\n\tSECRET_PRINTABLE_METADATA_PATTERN,\n\tSECRET_PROFILE_ID_MAX_CHARS,\n\tSECRET_PROFILE_ID_PATTERN,\n\tSECRET_VARIABLE_NAME_MAX_CHARS,\n\tSECRET_VARIABLE_NAME_PATTERN,\n\ttype SecretProfileSummary,\n\tSecretVault,\n\tSecretVaultError,\n} from \"../secrets/secret-vault.ts\";\nimport {\n\temptyOrchestrationCall,\n\tOrchestrationPanelComponent,\n\ttype OrchestrationPanelModel,\n} from \"./orchestration-panel.ts\";\n\nconst secretStoreSchema = Type.Object(\n\t{\n\t\taction: Type.Union(\n\t\t\t[\n\t\t\t\tType.Literal(\"set\"),\n\t\t\t\tType.Literal(\"list\"),\n\t\t\t\tType.Literal(\"materialize\"),\n\t\t\t\tType.Literal(\"remove\"),\n\t\t\t\tType.Literal(\"lock\"),\n\t\t\t],\n\t\t\t{ description: \"Credential-management action.\" },\n\t\t),\n\t\tprofile: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: SECRET_PROFILE_ID_MAX_CHARS,\n\t\t\t\tpattern: SECRET_PROFILE_ID_PATTERN,\n\t\t\t\tdescription: \"Portable profile identifier, such as project-dev or aws-work.\",\n\t\t\t}),\n\t\t),\n\t\tdescription: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: SECRET_DESCRIPTION_MAX_CHARS,\n\t\t\t\tpattern: SECRET_PRINTABLE_METADATA_PATTERN,\n\t\t\t\tdescription: \"Non-secret profile description.\",\n\t\t\t}),\n\t\t),\n\t\tenvFile: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: 512,\n\t\t\t\tdescription:\n\t\t\t\t\t\"Relative dotenv location inside the current workspace, such as .env, .env.local, or config/dev.env. Valid only for set.\",\n\t\t\t}),\n\t\t),\n\t\tvariableNames: Type.Optional(\n\t\t\tType.Array(\n\t\t\t\tType.String({\n\t\t\t\t\tminLength: 1,\n\t\t\t\t\tmaxLength: SECRET_VARIABLE_NAME_MAX_CHARS,\n\t\t\t\t\tpattern: SECRET_VARIABLE_NAME_PATTERN,\n\t\t\t\t}),\n\t\t\t\t{\n\t\t\t\t\tminItems: 1,\n\t\t\t\t\tmaxItems: MAX_VARIABLES_PER_PROFILE,\n\t\t\t\t\tdescription: \"Specific variable names to remove. Omit to remove the whole profile.\",\n\t\t\t\t},\n\t\t\t),\n\t\t),\n\t\tscope: Type.Optional(\n\t\t\tType.Union([Type.Literal(\"managed\"), Type.Literal(\"workspace\")], {\n\t\t\t\tdescription:\n\t\t\t\t\t\"Materialization target. workspace resolves the durable current-project binding; managed writes private Pi state.\",\n\t\t\t}),\n\t\t),\n\t},\n\t{ additionalProperties: false },\n);\n\nexport type SecretStoreToolInput = Static<typeof secretStoreSchema>;\n\nexport type SecretStoreStatus =\n\t| \"cancelled\"\n\t| \"error\"\n\t| \"listed\"\n\t| \"locked\"\n\t| \"materialized\"\n\t| \"removed\"\n\t| \"stored\"\n\t| \"unavailable\";\n\nexport interface SecretStoreToolDetails {\n\taction: SecretStoreToolInput[\"action\"];\n\tstatus: SecretStoreStatus;\n\tprofile?: string;\n\tvariableNames?: string[];\n\tprofiles?: SecretProfileSummary[];\n\tscope?: \"managed\" | \"workspace\";\n\tenvFile?: string;\n\tmaterialized?: boolean;\n\tcode?: string;\n\tmessage?: string;\n}\n\nexport interface SecretStoreToolOptions {\n\tagentDir?: string;\n\tvault?: SecretVault;\n}\n\ntype SecretStoreResult = {\n\tcontent: Array<{ type: \"text\"; text: string }>;\n\tdetails: SecretStoreToolDetails;\n};\n\nfunction result(details: SecretStoreToolDetails, text: string): SecretStoreResult {\n\treturn { content: [{ type: \"text\", text }], details };\n}\n\nfunction cancelled(action: SecretStoreToolInput[\"action\"], profile?: string): SecretStoreResult {\n\treturn result(\n\t\t{ action, status: \"cancelled\", ...(profile ? { profile } : {}), code: \"owner_cancelled\" },\n\t\t\"Secret store action was cancelled by the owner.\",\n\t);\n}\n\nfunction failed(action: SecretStoreToolInput[\"action\"], error: unknown, profile?: string): SecretStoreResult {\n\tconst code = error instanceof SecretVaultError ? error.code : \"safe_failure\";\n\tconst message =\n\t\terror instanceof SecretVaultError ? error.message : \"Secret store failed safely without exposing values.\";\n\treturn result(\n\t\t{ action, status: \"error\", ...(profile ? { profile } : {}), code, message },\n\t\t`Secret store failed: ${message}`,\n\t);\n}\n\nfunction invalid(\n\taction: SecretStoreToolInput[\"action\"],\n\tcode: string,\n\tmessage: string,\n\tprofile?: string,\n): SecretStoreResult {\n\treturn result(\n\t\t{ action, status: \"error\", ...(profile ? { profile } : {}), code, message },\n\t\t`Secret store request is invalid: ${message}`,\n\t);\n}\n\nfunction panelModel(details: SecretStoreToolDetails | undefined, expanded: boolean): OrchestrationPanelModel {\n\tif (!details) return { label: \"secrets\", status: \"error\", emptyText: \"No secret-store result was retained.\" };\n\tconst success = [\"listed\", \"locked\", \"materialized\", \"removed\", \"stored\"].includes(details.status);\n\tconst rows = expanded\n\t\t? (details.profiles ?? []).map((profile) => ({\n\t\t\t\tstatus: \"info\" as const,\n\t\t\t\tlabel: profile.profile,\n\t\t\t\tmeta: [\n\t\t\t\t\t`${profile.variableNames.length} variable${profile.variableNames.length === 1 ? \"\" : \"s\"}`,\n\t\t\t\t\t`${profile.bindings.length} binding${profile.bindings.length === 1 ? \"\" : \"s\"}`,\n\t\t\t\t],\n\t\t\t\tdetails: [\n\t\t\t\t\t...(profile.description ? [profile.description] : []),\n\t\t\t\t\t...profile.bindings.map((binding) => `${binding.envFile} · ${binding.workspace}`),\n\t\t\t\t],\n\t\t\t}))\n\t\t: undefined;\n\treturn {\n\t\tlabel: \"secrets\",\n\t\taction: details.status,\n\t\tstatus: success ? \"success\" : details.status === \"cancelled\" ? \"warning\" : \"error\",\n\t\tsummary: [\n\t\t\tdetails.profile,\n\t\t\tdetails.envFile,\n\t\t\tdetails.scope,\n\t\t\tdetails.variableNames\n\t\t\t\t? `${details.variableNames.length} variable${details.variableNames.length === 1 ? \"\" : \"s\"}`\n\t\t\t\t: undefined,\n\t\t\tdetails.profiles ? `${details.profiles.length} profile${details.profiles.length === 1 ? \"\" : \"s\"}` : undefined,\n\t\t].filter((value): value is string => value !== undefined),\n\t\trows,\n\t\tnotices:\n\t\t\texpanded && details.message ? [{ status: success ? \"info\" : \"error\", text: details.message }] : undefined,\n\t};\n}\n\nasync function ensureUnlocked(\n\tvault: SecretVault,\n\taction: SecretStoreToolInput[\"action\"],\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n\tprofile?: string,\n): Promise<SecretStoreResult | undefined> {\n\tif (vault.isUnlocked) return undefined;\n\tif (await vault.exists()) {\n\t\twhile (!signal?.aborted) {\n\t\t\tlet passphrase = await ctx.ui.input(\"Unlock secret vault\", \"Master passphrase\", {\n\t\t\t\tsignal,\n\t\t\t\tsensitive: true,\n\t\t\t});\n\t\t\tif (passphrase === undefined || signal?.aborted) return cancelled(action, profile);\n\t\t\ttry {\n\t\t\t\tawait vault.unlock(passphrase);\n\t\t\t\treturn undefined;\n\t\t\t} catch (error) {\n\t\t\t\tif (error instanceof SecretVaultError && [\"invalid_passphrase\", \"unlock_failed\"].includes(error.code)) {\n\t\t\t\t\tctx.ui.notify(error.message, \"error\");\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\treturn failed(action, error, profile);\n\t\t\t} finally {\n\t\t\t\tpassphrase = \"\";\n\t\t\t}\n\t\t}\n\t\treturn cancelled(action, profile);\n\t}\n\n\twhile (!signal?.aborted) {\n\t\tlet passphrase = await ctx.ui.input(\"Create secret vault\", \"New master passphrase\", { signal, sensitive: true });\n\t\tif (passphrase === undefined || signal?.aborted) return cancelled(action, profile);\n\t\tlet confirmation = await ctx.ui.input(\"Confirm secret vault\", \"Repeat master passphrase\", {\n\t\t\tsignal,\n\t\t\tsensitive: true,\n\t\t});\n\t\tif (confirmation === undefined || signal?.aborted) {\n\t\t\tpassphrase = \"\";\n\t\t\treturn cancelled(action, profile);\n\t\t}\n\t\ttry {\n\t\t\tif (passphrase !== confirmation) {\n\t\t\t\tctx.ui.notify(\"The two master passphrases do not match.\", \"error\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tawait vault.initialize(passphrase);\n\t\t\treturn undefined;\n\t\t} catch (error) {\n\t\t\tif (error instanceof SecretVaultError && error.code === \"invalid_passphrase\") {\n\t\t\t\tctx.ui.notify(error.message, \"error\");\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\treturn failed(action, error, profile);\n\t\t} finally {\n\t\t\tpassphrase = \"\";\n\t\t\tconfirmation = \"\";\n\t\t}\n\t}\n\treturn cancelled(action, profile);\n}\n\nfunction validateInput(input: SecretStoreToolInput): SecretStoreResult | undefined {\n\tif (input.action === \"lock\" || input.action === \"list\") {\n\t\tif (\n\t\t\tinput.profile !== undefined ||\n\t\t\tinput.description !== undefined ||\n\t\t\tinput.envFile !== undefined ||\n\t\t\tinput.variableNames !== undefined ||\n\t\t\tinput.scope !== undefined\n\t\t) {\n\t\t\treturn invalid(input.action, \"unexpected_fields\", `Action ${input.action} does not accept profile fields.`);\n\t\t}\n\t\treturn undefined;\n\t}\n\tif (input.action === \"set\" && !input.profile) {\n\t\treturn invalid(input.action, \"profile_required\", \"Action set requires a profile.\");\n\t}\n\tif (input.action === \"remove\" && !input.profile) {\n\t\treturn invalid(input.action, \"profile_required\", \"Action remove requires a profile.\");\n\t}\n\tif (input.action !== \"set\" && (input.description !== undefined || input.envFile !== undefined)) {\n\t\treturn invalid(\n\t\t\tinput.action,\n\t\t\t\"unexpected_profile_fields\",\n\t\t\t\"description and envFile are valid only for set.\",\n\t\t\tinput.profile,\n\t\t);\n\t}\n\tif (input.action !== \"remove\" && input.variableNames !== undefined) {\n\t\treturn invalid(\n\t\t\tinput.action,\n\t\t\t\"unexpected_variable_names\",\n\t\t\t\"variableNames is valid only for remove.\",\n\t\t\tinput.profile,\n\t\t);\n\t}\n\tif (input.action !== \"materialize\" && input.scope !== undefined) {\n\t\treturn invalid(input.action, \"unexpected_scope\", \"scope is valid only for materialize.\", input.profile);\n\t}\n\tif (input.variableNames && new Set(input.variableNames).size !== input.variableNames.length) {\n\t\treturn invalid(input.action, \"duplicate_variables\", \"Variable names must be unique.\", input.profile);\n\t}\n\treturn undefined;\n}\n\nasync function openPrivateDotenvEditor(\n\tctx: ExtensionContext,\n\ttitle: string,\n\tprefill: string,\n\tsignal: AbortSignal | undefined,\n): Promise<string | undefined> {\n\tif (signal?.aborted) return undefined;\n\ttry {\n\t\treturn await ctx.ui.custom<string | undefined>(\n\t\t\t(tui, _theme, keybindings, done) =>\n\t\t\t\tnew ExtensionEditorComponent(\n\t\t\t\t\ttui,\n\t\t\t\t\tkeybindings,\n\t\t\t\t\ttitle,\n\t\t\t\t\tprefill,\n\t\t\t\t\t(value) => done(value),\n\t\t\t\t\t() => done(undefined),\n\t\t\t\t\t{\n\t\t\t\t\t\tprivateContent: true,\n\t\t\t\t\t\tallowExternalEditor: false,\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t\tnotice: \"Private plaintext editor · content stays local and never enters model context\",\n\t\t\t\t\t},\n\t\t\t\t),\n\t\t);\n\t} catch (error) {\n\t\tif (signal?.aborted) return undefined;\n\t\tthrow error;\n\t}\n}\n\nasync function captureValidDotenv(\n\tctx: ExtensionContext,\n\ttitle: string,\n\tprefill: string,\n\tsignal: AbortSignal | undefined,\n): Promise<{ document: string; variableNames: string[] } | undefined> {\n\tlet draft = prefill;\n\twhile (!signal?.aborted) {\n\t\tconst edited = await openPrivateDotenvEditor(ctx, title, draft, signal);\n\t\tif (edited === undefined || signal?.aborted) return undefined;\n\t\ttry {\n\t\t\tconst parsed = parseDotenvDocument(edited);\n\t\t\tconst variableNames = parsed.variables.map((variable) => variable.name);\n\t\t\tfor (const variable of parsed.variables) variable.value = \"\";\n\t\t\tdraft = \"\";\n\t\t\treturn { document: parsed.document, variableNames };\n\t\t} catch (error) {\n\t\t\tctx.ui.notify(error instanceof SecretDotenvError ? error.message : \"The dotenv document is invalid.\", \"error\");\n\t\t\tdraft = edited;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nasync function executeSet(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput & { profile: string },\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n): Promise<SecretStoreResult> {\n\tlet document = \"\";\n\tlet originalUnmanagedContent: string | undefined;\n\ttry {\n\t\tconst target = vault.resolveBindingTarget(ctx.cwd, input.envFile ?? \".env\");\n\t\tconst destinationState = await vault.inspectEnvDestination(target.destination, input.profile);\n\t\tif (destinationState === \"managed-other\") {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The selected dotenv location is already managed by another profile.\",\n\t\t\t\tinput.profile,\n\t\t\t);\n\t\t}\n\t\tconst storedDocument = await vault.getProfileDocument(input.profile);\n\t\tlet prefill = storedDocument ?? \"\";\n\t\tif (destinationState === \"unmanaged\") {\n\t\t\toriginalUnmanagedContent = await vault.readOwnerDotenv(target.destination);\n\t\t\tprefill = originalUnmanagedContent;\n\t\t}\n\t\tif (destinationState === \"managed-profile\" && storedDocument === undefined) {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"profile_missing\",\n\t\t\t\t\"The dotenv target claims this profile, but the encrypted profile is missing.\",\n\t\t\t\tinput.profile,\n\t\t\t);\n\t\t}\n\n\t\tconst captured = await captureValidDotenv(\n\t\t\tctx,\n\t\t\t`Secrets · ${input.profile}  →  ${target.destination}`,\n\t\t\tprefill,\n\t\t\tsignal,\n\t\t);\n\t\tprefill = \"\";\n\t\tif (!captured) return cancelled(input.action, input.profile);\n\t\tdocument = captured.document;\n\t\tawait vault.replaceProfileDocument(input.profile, input.description, document, {\n\t\t\tworkspace: target.workspace,\n\t\t\tenvFile: target.envFile,\n\t\t});\n\t\ttry {\n\t\t\tawait vault.materializeEnv(input.profile, target.destination, {\n\t\t\t\tallowReplaceUnmanaged: destinationState === \"unmanaged\",\n\t\t\t\texpectedUnmanagedContent: originalUnmanagedContent,\n\t\t\t});\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof SecretVaultError ? error.message : \"Dotenv materialization failed safely.\";\n\t\t\tctx.ui.notify(`Profile stored, but ${target.destination} was not refreshed: ${message}`, \"warning\");\n\t\t\treturn result(\n\t\t\t\t{\n\t\t\t\t\taction: input.action,\n\t\t\t\t\tstatus: \"stored\",\n\t\t\t\t\tprofile: input.profile,\n\t\t\t\t\tenvFile: target.envFile,\n\t\t\t\t\tvariableNames: captured.variableNames,\n\t\t\t\t\tmaterialized: false,\n\t\t\t\t\tcode: \"materialization_failed\",\n\t\t\t\t\tmessage,\n\t\t\t\t},\n\t\t\t\t`Stored profile ${input.profile}, but its bound dotenv could not be refreshed. Retry secret_store materialize; no values were exposed.`,\n\t\t\t);\n\t\t}\n\t\tctx.ui.notify(`Credential profile ${input.profile} stored and activated at ${target.destination}`, \"info\");\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"stored\",\n\t\t\t\tprofile: input.profile,\n\t\t\t\tenvFile: target.envFile,\n\t\t\t\tvariableNames: captured.variableNames,\n\t\t\t\tmaterialized: true,\n\t\t\t},\n\t\t\t`Stored and activated ${captured.variableNames.length} variables for profile ${input.profile} at its bound workspace dotenv location. Values never entered model context.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t} finally {\n\t\tdocument = \"\";\n\t\toriginalUnmanagedContent = undefined;\n\t}\n}\n\nasync function executeMaterialize(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput,\n\tctx: ExtensionContext,\n): Promise<SecretStoreResult> {\n\ttry {\n\t\tconst scope = input.scope ?? \"workspace\";\n\t\tconst binding = await vault.resolveBindingForWorkspace(ctx.cwd, input.profile);\n\t\tconst destination = scope === \"managed\" ? vault.getManagedEnvPath(binding.profile) : binding.destination;\n\t\tconst destinationState = await vault.inspectEnvDestination(destination, binding.profile);\n\t\tif (destinationState === \"unmanaged\" || destinationState === \"managed-other\") {\n\t\t\treturn invalid(\n\t\t\t\tinput.action,\n\t\t\t\t\"destination_conflict\",\n\t\t\t\t\"The bound dotenv location is no longer safely managed. Use set to review it in the private editor.\",\n\t\t\t\tbinding.profile,\n\t\t\t);\n\t\t}\n\t\tconst materialized = await vault.materializeEnv(binding.profile, destination, {\n\t\t\tactivationWorkspace: ctx.cwd,\n\t\t\tmanaged: scope === \"managed\",\n\t\t});\n\t\tctx.ui.notify(`Credential profile ${binding.profile} activated at ${destination}`, \"info\");\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"materialized\",\n\t\t\t\tprofile: binding.profile,\n\t\t\t\tvariableNames: materialized.variableNames,\n\t\t\t\tscope,\n\t\t\t\tenvFile: scope === \"workspace\" ? binding.envFile : undefined,\n\t\t\t\tmaterialized: true,\n\t\t\t},\n\t\t\t`Activated profile ${binding.profile} for the current workspace. Its dotenv and process environment are available without exposing values to the model.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t}\n}\n\nasync function executeRemove(\n\tvault: SecretVault,\n\tinput: SecretStoreToolInput & { profile: string },\n\tctx: ExtensionContext,\n\tsignal: AbortSignal | undefined,\n): Promise<SecretStoreResult> {\n\tconst target = input.variableNames?.length\n\t\t? `${input.variableNames.join(\", \")} from profile ${input.profile}`\n\t\t: `the entire profile ${input.profile}`;\n\tconst approved = await ctx.ui.confirm(\n\t\t\"Remove stored secrets\",\n\t\t`Remove ${target}? Pi-managed workspace and private dotenv copies are invalidated.`,\n\t\t{ signal },\n\t);\n\tif (!approved || signal?.aborted) return cancelled(input.action, input.profile);\n\ttry {\n\t\tconst removal = await vault.removeProfile(input.profile, input.variableNames);\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"removed\",\n\t\t\t\tprofile: input.profile,\n\t\t\t\tvariableNames: removal.removedVariableNames,\n\t\t\t},\n\t\t\t`Removed ${removal.removedVariableNames.length} secret variable${removal.removedVariableNames.length === 1 ? \"\" : \"s\"} from profile ${input.profile}.`,\n\t\t);\n\t} catch (error) {\n\t\treturn failed(input.action, error, input.profile);\n\t}\n}\n\nexport function createSecretStoreToolDefinition(options: SecretStoreToolOptions) {\n\tconst vault = options.vault ?? (options.agentDir ? SecretVault.forAgentDir(options.agentDir) : undefined);\n\tif (!vault) throw new Error(\"secret_store requires an agentDir or SecretVault\");\n\treturn defineTool<typeof secretStoreSchema, SecretStoreToolDetails>({\n\t\tname: \"secret_store\",\n\t\tlabel: \"Secret Store\",\n\t\tdescription:\n\t\t\t\"Open a model-blind native dotenv editor, encrypt owner credentials, bind profiles to workspace dotenv locations, and activate them for normal process use without returning values to the model.\",\n\t\tpromptSnippet:\n\t\t\t\"Manage credentials through the model-blind secret vault. Before credential-dependent work, materialize the current workspace binding; use set to open the owner's private dotenv editor.\",\n\t\tpromptGuidelines: [\n\t\t\t\"Use secret_store whenever credentials are needed. Never ask the owner to paste a secret into chat or place a value in tool arguments.\",\n\t\t\t\"Use set with a profile and relative envFile. The harness opens a private plaintext editor, persists the workspace binding, writes the dotenv, and activates the environment.\",\n\t\t\t\"Before credential-dependent commands in a later session, call materialize without a profile to resolve the current workspace binding. Use list only when selection or discovery is needed.\",\n\t\t\t\"After activation, run the consuming application normally. Never read, grep, print, echo, source, or otherwise inspect credential files or environment values.\",\n\t\t\t\"Treat cancellation as owner intent. Do not immediately repeat the same credential request.\",\n\t\t],\n\t\tparameters: secretStoreSchema,\n\t\texecutionMode: \"sequential\",\n\t\trenderShell: \"self\",\n\t\trenderCall() {\n\t\t\treturn emptyOrchestrationCall();\n\t\t},\n\t\trenderResult(toolResult, { expanded, isPartial }, theme: Theme) {\n\t\t\tif (isPartial) {\n\t\t\t\treturn new OrchestrationPanelComponent(theme, {\n\t\t\t\t\tlabel: \"secrets\",\n\t\t\t\t\taction: \"waiting for you\",\n\t\t\t\t\tstatus: \"running\",\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn new OrchestrationPanelComponent(theme, panelModel(toolResult.details, expanded), expanded);\n\t\t},\n\t\tasync execute(_toolCallId, input, signal, _onUpdate, ctx) {\n\t\t\tif (!ctx.hasUI || ctx.mode !== \"tui\") {\n\t\t\t\treturn result(\n\t\t\t\t\t{\n\t\t\t\t\t\taction: input.action,\n\t\t\t\t\t\tstatus: \"unavailable\",\n\t\t\t\t\t\t...(input.profile ? { profile: input.profile } : {}),\n\t\t\t\t\t\tcode: \"user_tui_required\",\n\t\t\t\t\t\tmessage: \"Secret values can be captured only in a user-visible TUI session.\",\n\t\t\t\t\t},\n\t\t\t\t\t\"secret_store requires a user-visible TUI session.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (signal?.aborted) return cancelled(input.action, input.profile);\n\t\t\tconst validation = validateInput(input);\n\t\t\tif (validation) return validation;\n\t\t\tif (input.action === \"lock\") {\n\t\t\t\tvault.lock();\n\t\t\t\treturn result(\n\t\t\t\t\t{ action: input.action, status: \"locked\" },\n\t\t\t\t\t\"Secret vault locked; cached key, credential environment, and exact-value redaction cache were cleared.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\ttry {\n\t\t\t\tconst unlockResult = await ensureUnlocked(vault, input.action, ctx, signal, input.profile);\n\t\t\t\tif (unlockResult) return unlockResult;\n\t\t\t\tif (input.action === \"list\") {\n\t\t\t\t\tconst profiles = await vault.listProfiles();\n\t\t\t\t\treturn result(\n\t\t\t\t\t\t{ action: input.action, status: \"listed\", profiles },\n\t\t\t\t\t\t`Secret vault contains ${profiles.length} profile${profiles.length === 1 ? \"\" : \"s\"}. Only names, variable names, and workspace bindings were returned.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (input.action === \"set\" && input.profile) {\n\t\t\t\t\treturn executeSet(vault, { ...input, profile: input.profile }, ctx, signal);\n\t\t\t\t}\n\t\t\t\tif (input.action === \"materialize\") return executeMaterialize(vault, input, ctx);\n\t\t\t\tif (!input.profile) return invalid(input.action, \"profile_required\", \"A profile is required.\");\n\t\t\t\treturn executeRemove(vault, { ...input, profile: input.profile }, ctx, signal);\n\t\t\t} catch (error) {\n\t\t\t\treturn failed(input.action, error, input.profile);\n\t\t\t}\n\t\t},\n\t});\n}\n"]}
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../../src/core/tools/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAEN,sBAAsB,EAEtB,sBAAsB,GACtB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACN,sBAAsB,EACtB,2BAA2B,GAE3B,MAAM,0BAA0B,CAAC;AAElC,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CACpC;IACC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE;QAC5F,WAAW,EAAE,4EAA4E;KACzF,CAAC;IACF,OAAO,EAAE,IAAI,CAAC,QAAQ,CACrB,IAAI,CAAC,MAAM,CAAC;QACX,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,EAAE;QACb,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,iFAAiF;KAC9F,CAAC,CACF;CACD,EACD,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAC/B,CAAC;AA2BF,SAAS,MAAM,CAAC,OAA+B,EAAE,IAAY;IAC5D,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,OAAO,CAAC,KAA2B;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChE,OAAO,MAAM,CACZ;YACC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,UAAU,KAAK,CAAC,MAAM,6BAA6B;SAC5D,EACD,2CAA2C,KAAK,CAAC,MAAM,6BAA6B,CACpF,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,MAAM,CAAC,KAA2B,EAAE,KAAc;IAC1D,MAAM,KAAK,GAAG,KAAK,YAAY,sBAAsB,IAAI,KAAK,YAAY,sBAAsB,CAAC;IACjG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8DAA8D,CAAC;IACvG,MAAM,MAAM,GAAsB,CAAC,sBAAsB,EAAE,eAAe,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACjH,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,OAAO,CAAC;IACX,OAAO,MAAM,CACZ;QACC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,IAAI;QACJ,OAAO;KACP,EACD,6BAA6B,OAAO,EAAE,CACtC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAA2C,EAAE,QAAiB;IACjF,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,oCAAoC,EAAE,CAAC;IAC5G,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9E,OAAO;QACN,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;QAClF,OAAO,EAAE;YACR,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,OAAO;YACf,OAAO,CAAC,aAAa;gBACpB,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,YAAY,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;gBAC5F,CAAC,CAAC,SAAS;YACZ,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,WAAW,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS;SAC9G,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC;QACzD,IAAI,EAAE,QAAQ;YACb,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACpC,MAAM,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAE,WAAqB,CAAC,CAAC,CAAE,MAAgB;gBAClF,KAAK,EAAE,OAAO,CAAC,OAAO;gBACtB,IAAI,EAAE;oBACL,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,YAAY,OAAO,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;oBAC1F,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB;iBAC/D;gBACD,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;aAChE,CAAC,CAAC;YACJ,CAAC,CAAC,SAAS;QACZ,OAAO,EACN,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;KAC1G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAA+B;IAC9E,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,OAAO,UAAU,CAAmD;QACnE,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,cAAc;QACrB,WAAW,EACV,uHAAuH;QACxH,aAAa,EACZ,qJAAqJ;QACtJ,gBAAgB,EAAE;YACjB,8HAA8H;YAC9H,uGAAuG;YACvG,6FAA6F;YAC7F,0HAA0H;YAC1H,gHAAgH;SAChH;QACD,UAAU,EAAE,iBAAiB;QAC7B,aAAa,EAAE,YAAY;QAC3B,WAAW,EAAE,MAAM;QACnB,UAAU;YACT,OAAO,sBAAsB,EAAE,CAAC;QACjC,CAAC;QACD,YAAY,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,KAAY;YAC7D,IAAI,SAAS,EAAE,CAAC;gBACf,OAAO,IAAI,2BAA2B,CAAC,KAAK,EAAE;oBAC7C,KAAK,EAAE,SAAS;oBAChB,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,SAAS;iBACjB,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,2BAA2B,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnG,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG;YACvD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;gBACrB,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,EAChE,8BAA8B,CAC9B,CAAC;YACH,CAAC;YACD,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;YAClC,IAAI,CAAC;gBACJ,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;oBAC9B,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;wBAC9B,OAAO,MAAM,CACZ;4BACC,MAAM,EAAE,KAAK,CAAC,MAAM;4BACpB,MAAM,EAAE,aAAa;4BACrB,SAAS,EAAE,KAAK;4BAChB,IAAI,EAAE,sBAAsB;4BAC5B,OAAO,EAAE,iDAAiD;yBAC1D,EACD,mEAAmE,CACnE,CAAC;oBACH,CAAC;oBACD,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAC1E,MAAM,CAAC,SAAS;wBACf,CAAC,CAAC,6CAA6C;wBAC/C,CAAC,CAAC,2EAA2E,CAC9E,CAAC;gBACH,CAAC;gBACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC7B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBAC/D,OAAO,MAAM,CACZ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,EACpD,SAAS,QAAQ,CAAC,MAAM,sBAAsB,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,+BAA+B,CAC7G,CAAC;gBACH,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBACnF,OAAO,MAAM,CACZ;oBACC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,WAAW;oBACnB,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,aAAa,EAAE,SAAS,CAAC,aAAa;oBACtC,OAAO,EAAE,SAAS,CAAC,OAAO;iBAC1B,EACD,aAAa,SAAS,CAAC,OAAO,QAAQ,SAAS,CAAC,OAAO,oCAAoC,CAC3F,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC7B,CAAC;QACF,CAAC;KACD,CAAC,CAAC;AACJ,CAAC","sourcesContent":["import { type Static, Type } from \"typebox\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport { defineTool } from \"../extensions/types.ts\";\nimport {\n\ttype CredentialManager,\n\tCredentialManagerError,\n\ttype CredentialProfileSummary,\n\tCredentialStorageError,\n} from \"../secrets/credential-manager.ts\";\nimport {\n\temptyOrchestrationCall,\n\tOrchestrationPanelComponent,\n\ttype OrchestrationPanelModel,\n} from \"./orchestration-panel.ts\";\n\nconst secretStoreSchema = Type.Object(\n\t{\n\t\taction: Type.Union([Type.Literal(\"status\"), Type.Literal(\"list\"), Type.Literal(\"activate\")], {\n\t\t\tdescription: \"Credential-use action. Credential mutation is owner-only through /secrets.\",\n\t\t}),\n\t\tprofile: Type.Optional(\n\t\t\tType.String({\n\t\t\t\tminLength: 1,\n\t\t\t\tmaxLength: 96,\n\t\t\t\tpattern: \"^[A-Za-z0-9][A-Za-z0-9._-]*$\",\n\t\t\t\tdescription: \"Bound profile to activate. Omit when the project has exactly one bound profile.\",\n\t\t\t}),\n\t\t),\n\t},\n\t{ additionalProperties: false },\n);\n\nexport type SecretStoreToolInput = Static<typeof secretStoreSchema>;\n\nexport type SecretStoreStatus = \"activated\" | \"available\" | \"cancelled\" | \"error\" | \"listed\" | \"unavailable\";\n\nexport interface SecretStoreToolDetails {\n\taction: SecretStoreToolInput[\"action\"];\n\tstatus: SecretStoreStatus;\n\tprofile?: string;\n\tvariableNames?: string[];\n\tprofiles?: CredentialProfileSummary[];\n\tproject?: string;\n\tconnected?: boolean;\n\tcode?: string;\n\tmessage?: string;\n}\n\nexport interface SecretStoreToolOptions {\n\tmanager: CredentialManager;\n}\n\ntype SecretStoreResult = {\n\tcontent: Array<{ type: \"text\"; text: string }>;\n\tdetails: SecretStoreToolDetails;\n};\n\nfunction result(details: SecretStoreToolDetails, text: string): SecretStoreResult {\n\treturn { content: [{ type: \"text\", text }], details };\n}\n\nfunction invalid(input: SecretStoreToolInput): SecretStoreResult | undefined {\n\tif (input.action !== \"activate\" && input.profile !== undefined) {\n\t\treturn result(\n\t\t\t{\n\t\t\t\taction: input.action,\n\t\t\t\tstatus: \"error\",\n\t\t\t\tcode: \"unexpected_profile\",\n\t\t\t\tmessage: `Action ${input.action} does not accept a profile.`,\n\t\t\t},\n\t\t\t`Secret store request is invalid: action ${input.action} does not accept a profile.`,\n\t\t);\n\t}\n\treturn undefined;\n}\n\nfunction failed(input: SecretStoreToolInput, error: unknown): SecretStoreResult {\n\tconst known = error instanceof CredentialManagerError || error instanceof CredentialStorageError;\n\tconst code = known ? error.code : \"safe_failure\";\n\tconst message = known ? error.message : \"Credential activation failed safely without exposing values.\";\n\tconst status: SecretStoreStatus = [\"owner_setup_required\", \"not_connected\", \"provider_unavailable\"].includes(code)\n\t\t? \"unavailable\"\n\t\t: \"error\";\n\treturn result(\n\t\t{\n\t\t\taction: input.action,\n\t\t\tstatus,\n\t\t\t...(input.profile ? { profile: input.profile } : {}),\n\t\t\tcode,\n\t\t\tmessage,\n\t\t},\n\t\t`Credential action failed: ${message}`,\n\t);\n}\n\nfunction panelModel(details: SecretStoreToolDetails | undefined, expanded: boolean): OrchestrationPanelModel {\n\tif (!details) return { label: \"secrets\", status: \"error\", emptyText: \"No credential result was retained.\" };\n\tconst success = [\"activated\", \"available\", \"listed\"].includes(details.status);\n\treturn {\n\t\tlabel: \"secrets\",\n\t\taction: details.status,\n\t\tstatus: success ? \"success\" : details.status === \"cancelled\" ? \"warning\" : \"error\",\n\t\tsummary: [\n\t\t\tdetails.profile,\n\t\t\tdetails.project,\n\t\t\tdetails.variableNames\n\t\t\t\t? `${details.variableNames.length} variable${details.variableNames.length === 1 ? \"\" : \"s\"}`\n\t\t\t\t: undefined,\n\t\t\tdetails.profiles ? `${details.profiles.length} profile${details.profiles.length === 1 ? \"\" : \"s\"}` : undefined,\n\t\t].filter((value): value is string => value !== undefined),\n\t\trows: expanded\n\t\t\t? details.profiles?.map((profile) => ({\n\t\t\t\t\tstatus: profile.boundToCurrentProject ? (\"succeeded\" as const) : (\"info\" as const),\n\t\t\t\t\tlabel: profile.profile,\n\t\t\t\t\tmeta: [\n\t\t\t\t\t\t`${profile.variableNames.length} variable${profile.variableNames.length === 1 ? \"\" : \"s\"}`,\n\t\t\t\t\t\tprofile.boundToCurrentProject ? \"bound here\" : \"not bound here\",\n\t\t\t\t\t],\n\t\t\t\t\tdetails: profile.description ? [profile.description] : undefined,\n\t\t\t\t}))\n\t\t\t: undefined,\n\t\tnotices:\n\t\t\texpanded && details.message ? [{ status: success ? \"info\" : \"error\", text: details.message }] : undefined,\n\t};\n}\n\nexport function createSecretStoreToolDefinition(options: SecretStoreToolOptions) {\n\tconst { manager } = options;\n\treturn defineTool<typeof secretStoreSchema, SecretStoreToolDetails>({\n\t\tname: \"secret_store\",\n\t\tlabel: \"Secret Store\",\n\t\tdescription:\n\t\t\t\"Discover and activate owner-authorized Bitwarden credential profiles for the current project without exposing values.\",\n\t\tpromptSnippet:\n\t\t\t\"Activate project credentials with secret_store before credential-dependent commands. Credential setup and mutation are owner-only through /secrets.\",\n\t\tpromptGuidelines: [\n\t\t\t\"Use secret_store activate before credential-dependent work. It works in TUI, print, and RPC modes and returns metadata only.\",\n\t\t\t\"Omit profile when the project has one binding. Use list to select among multiple authorized profiles.\",\n\t\t\t\"Never ask the owner to paste a credential into chat or pass a value through tool arguments.\",\n\t\t\t\"After activation, run the consuming command normally. Never print, inspect, grep, or echo credential environment values.\",\n\t\t\t\"If owner_setup_required is returned, tell the owner to run /secrets in a TUI session. Do not repeatedly retry.\",\n\t\t],\n\t\tparameters: secretStoreSchema,\n\t\texecutionMode: \"sequential\",\n\t\trenderShell: \"self\",\n\t\trenderCall() {\n\t\t\treturn emptyOrchestrationCall();\n\t\t},\n\t\trenderResult(toolResult, { expanded, isPartial }, theme: Theme) {\n\t\t\tif (isPartial) {\n\t\t\t\treturn new OrchestrationPanelComponent(theme, {\n\t\t\t\t\tlabel: \"secrets\",\n\t\t\t\t\taction: \"activating\",\n\t\t\t\t\tstatus: \"running\",\n\t\t\t\t});\n\t\t\t}\n\t\t\treturn new OrchestrationPanelComponent(theme, panelModel(toolResult.details, expanded), expanded);\n\t\t},\n\t\tasync execute(_toolCallId, input, signal, _onUpdate, ctx) {\n\t\t\tif (signal?.aborted) {\n\t\t\t\treturn result(\n\t\t\t\t\t{ action: input.action, status: \"cancelled\", code: \"cancelled\" },\n\t\t\t\t\t\"Credential action cancelled.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst validation = invalid(input);\n\t\t\tif (validation) return validation;\n\t\t\ttry {\n\t\t\t\tif (input.action === \"status\") {\n\t\t\t\t\tconst status = manager.status;\n\t\t\t\t\tif (!status.sessionAvailable) {\n\t\t\t\t\t\treturn result(\n\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\taction: input.action,\n\t\t\t\t\t\t\t\tstatus: \"unavailable\",\n\t\t\t\t\t\t\t\tconnected: false,\n\t\t\t\t\t\t\t\tcode: \"owner_setup_required\",\n\t\t\t\t\t\t\t\tmessage: \"The owner must connect Bitwarden with /secrets.\",\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\"Bitwarden owner setup is required. Run /secrets in a TUI session.\",\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\treturn result(\n\t\t\t\t\t\t{ action: input.action, status: \"available\", connected: status.connected },\n\t\t\t\t\t\tstatus.connected\n\t\t\t\t\t\t\t? \"Bitwarden is connected for this Pi session.\"\n\t\t\t\t\t\t\t: \"A Bitwarden session key is available and will be validated on activation.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (input.action === \"list\") {\n\t\t\t\t\tconst profiles = await manager.listForProject(ctx.cwd, signal);\n\t\t\t\t\treturn result(\n\t\t\t\t\t\t{ action: input.action, status: \"listed\", profiles },\n\t\t\t\t\t\t`Found ${profiles.length} credential profile${profiles.length === 1 ? \"\" : \"s\"}; only metadata was returned.`,\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tconst activated = await manager.activateForProject(ctx.cwd, input.profile, signal);\n\t\t\t\treturn result(\n\t\t\t\t\t{\n\t\t\t\t\t\taction: input.action,\n\t\t\t\t\t\tstatus: \"activated\",\n\t\t\t\t\t\tprofile: activated.profile,\n\t\t\t\t\t\tvariableNames: activated.variableNames,\n\t\t\t\t\t\tproject: activated.project,\n\t\t\t\t\t},\n\t\t\t\t\t`Activated ${activated.profile} for ${activated.project}. Credential values remain hidden.`,\n\t\t\t\t);\n\t\t\t} catch (error) {\n\t\t\t\treturn failed(input, error);\n\t\t\t}\n\t\t},\n\t});\n}\n"]}