@caupulican/pi-adaptative 0.93.11 → 0.93.13

package/dist/core/secrets/bitwarden-credential-storage-router.d.ts

@@ -0,0 +1,22 @@
+import { type CredentialProfileRecord, type CredentialProfileStorage, type CredentialStorageProvider, type StoredCredentialProfileSummary } from "./credential-manager.ts";
+export interface BitwardenCredentialStorageRouterOptions {
+    passwordManager?: CredentialProfileStorage;
+    secretsManager?: CredentialProfileStorage;
+    secretsManagerCoordinationFile?: string;
+}
+/** Provider strategy owner selected once by CredentialManager's validated machine session. */
+export declare class BitwardenCredentialStorageRouter implements CredentialProfileStorage {
+    private readonly passwordManager;
+    private readonly secretsManager;
+    private active;
+    constructor(options: BitwardenCredentialStorageRouterOptions);
+    connect(sessionKey: string, signal?: AbortSignal, provider?: CredentialStorageProvider): Promise<void>;
+    refresh(signal?: AbortSignal): Promise<void>;
+    listProfiles(signal?: AbortSignal): Promise<StoredCredentialProfileSummary[]>;
+    readProfile(profile: string, signal?: AbortSignal): Promise<CredentialProfileRecord>;
+    writeProfile(record: CredentialProfileRecord, signal?: AbortSignal): Promise<void>;
+    deleteProfile(profile: string, signal?: AbortSignal): Promise<void>;
+    lock(): void;
+    private requireActive;
+}
+//# sourceMappingURL=bitwarden-credential-storage-router.d.ts.map

package/dist/core/secrets/bitwarden-credential-storage-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitwarden-credential-storage-router.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/bitwarden-credential-storage-router.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAE7B,KAAK,yBAAyB,EAC9B,KAAK,8BAA8B,EACnC,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,uCAAuC;IACvD,eAAe,CAAC,EAAE,wBAAwB,CAAC;IAC3C,cAAc,CAAC,EAAE,wBAAwB,CAAC;IAC1C,8BAA8B,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,8FAA8F;AAC9F,qBAAa,gCAAiC,YAAW,wBAAwB;IAChF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA2B;IAC3D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA2B;IAC1D,OAAO,CAAC,MAAM,CAAuC;IAErD,YAAY,OAAO,EAAE,uCAAuC,EAY3D;IAEK,OAAO,CACZ,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,WAAW,EACpB,QAAQ,GAAE,yBAAwD,GAChE,OAAO,CAAC,IAAI,CAAC,CAWf;IAEK,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjD;IAEK,YAAY,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,8BAA8B,EAAE,CAAC,CAElF;IAEK,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAEzF;IAEK,YAAY,CAAC,MAAM,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvF;IAEK,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAExE;IAED,IAAI,IAAI,IAAI,CAIX;IAED,OAAO,CAAC,aAAa;CAIrB"}

package/dist/core/secrets/bitwarden-credential-storage-router.js

@@ -0,0 +1,59 @@
+import { BitwardenCredentialStorage } from "./bitwarden-credential-storage.js";
+import { BitwardenSecretsManagerCredentialStorage } from "./bitwarden-secrets-manager-storage.js";
+import { CredentialStorageError, } from "./credential-manager.js";
+/** Provider strategy owner selected once by CredentialManager's validated machine session. */
+export class BitwardenCredentialStorageRouter {
+    constructor(options) {
+        this.passwordManager = options.passwordManager ?? new BitwardenCredentialStorage();
+        if (options.secretsManager) {
+            this.secretsManager = options.secretsManager;
+        }
+        else {
+            if (!options.secretsManagerCoordinationFile) {
+                throw new TypeError("Bitwarden Secrets Manager requires a coordination file.");
+            }
+            this.secretsManager = new BitwardenSecretsManagerCredentialStorage({
+                coordinationFile: options.secretsManagerCoordinationFile,
+            });
+        }
+    }
+    async connect(sessionKey, signal, provider = "bitwarden_password_manager") {
+        this.lock();
+        const selected = provider === "bitwarden_secrets_manager" ? this.secretsManager : this.passwordManager;
+        this.active = selected;
+        try {
+            await selected.connect(sessionKey, signal, provider);
+        }
+        catch (error) {
+            selected.lock();
+            this.active = undefined;
+            throw error;
+        }
+    }
+    async refresh(signal) {
+        await this.requireActive().refresh?.(signal);
+    }
+    async listProfiles(signal) {
+        return this.requireActive().listProfiles(signal);
+    }
+    async readProfile(profile, signal) {
+        return this.requireActive().readProfile(profile, signal);
+    }
+    async writeProfile(record, signal) {
+        await this.requireActive().writeProfile(record, signal);
+    }
+    async deleteProfile(profile, signal) {
+        await this.requireActive().deleteProfile(profile, signal);
+    }
+    lock() {
+        this.passwordManager.lock();
+        this.secretsManager.lock();
+        this.active = undefined;
+    }
+    requireActive() {
+        if (!this.active)
+            throw new CredentialStorageError("not_connected", "Bitwarden is not connected.");
+        return this.active;
+    }
+}
+//# sourceMappingURL=bitwarden-credential-storage-router.js.map

package/dist/core/secrets/bitwarden-credential-storage-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitwarden-credential-storage-router.js","sourceRoot":"","sources":["../../../src/core/secrets/bitwarden-credential-storage-router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,wCAAwC,EAAE,MAAM,wCAAwC,CAAC;AAClG,OAAO,EAGN,sBAAsB,GAGtB,MAAM,yBAAyB,CAAC;AAQjC,8FAA8F;AAC9F,MAAM,OAAO,gCAAgC;IAK5C,YAAY,OAAgD;QAC3D,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,IAAI,0BAA0B,EAAE,CAAC;QACnF,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC9C,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,OAAO,CAAC,8BAA8B,EAAE,CAAC;gBAC7C,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,CAAC,cAAc,GAAG,IAAI,wCAAwC,CAAC;gBAClE,gBAAgB,EAAE,OAAO,CAAC,8BAA8B;aACxD,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO,CACZ,UAAkB,EAClB,MAAoB,EACpB,QAAQ,GAA8B,4BAA4B;QAElE,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,QAAQ,KAAK,2BAA2B,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;QACvG,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,QAAQ,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAoB;QACjC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAoB;QACtC,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,MAAoB;QACtD,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAA+B,EAAE,MAAoB;QACvE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,MAAoB;QACxD,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI;QACH,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IACzB,CAAC;IAEO,aAAa;QACpB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,sBAAsB,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QACnG,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;CACD","sourcesContent":["import { BitwardenCredentialStorage } from \"./bitwarden-credential-storage.ts\";\nimport { BitwardenSecretsManagerCredentialStorage } from \"./bitwarden-secrets-manager-storage.ts\";\nimport {\n\ttype CredentialProfileRecord,\n\ttype CredentialProfileStorage,\n\tCredentialStorageError,\n\ttype CredentialStorageProvider,\n\ttype StoredCredentialProfileSummary,\n} from \"./credential-manager.ts\";\n\nexport interface BitwardenCredentialStorageRouterOptions {\n\tpasswordManager?: CredentialProfileStorage;\n\tsecretsManager?: CredentialProfileStorage;\n\tsecretsManagerCoordinationFile?: string;\n}\n\n/** Provider strategy owner selected once by CredentialManager's validated machine session. */\nexport class BitwardenCredentialStorageRouter implements CredentialProfileStorage {\n\tprivate readonly passwordManager: CredentialProfileStorage;\n\tprivate readonly secretsManager: CredentialProfileStorage;\n\tprivate active: CredentialProfileStorage | undefined;\n\n\tconstructor(options: BitwardenCredentialStorageRouterOptions) {\n\t\tthis.passwordManager = options.passwordManager ?? new BitwardenCredentialStorage();\n\t\tif (options.secretsManager) {\n\t\t\tthis.secretsManager = options.secretsManager;\n\t\t} else {\n\t\t\tif (!options.secretsManagerCoordinationFile) {\n\t\t\t\tthrow new TypeError(\"Bitwarden Secrets Manager requires a coordination file.\");\n\t\t\t}\n\t\t\tthis.secretsManager = new BitwardenSecretsManagerCredentialStorage({\n\t\t\t\tcoordinationFile: options.secretsManagerCoordinationFile,\n\t\t\t});\n\t\t}\n\t}\n\n\tasync connect(\n\t\tsessionKey: string,\n\t\tsignal?: AbortSignal,\n\t\tprovider: CredentialStorageProvider = \"bitwarden_password_manager\",\n\t): Promise<void> {\n\t\tthis.lock();\n\t\tconst selected = provider === \"bitwarden_secrets_manager\" ? this.secretsManager : this.passwordManager;\n\t\tthis.active = selected;\n\t\ttry {\n\t\t\tawait selected.connect(sessionKey, signal, provider);\n\t\t} catch (error) {\n\t\t\tselected.lock();\n\t\t\tthis.active = undefined;\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync refresh(signal?: AbortSignal): Promise<void> {\n\t\tawait this.requireActive().refresh?.(signal);\n\t}\n\n\tasync listProfiles(signal?: AbortSignal): Promise<StoredCredentialProfileSummary[]> {\n\t\treturn this.requireActive().listProfiles(signal);\n\t}\n\n\tasync readProfile(profile: string, signal?: AbortSignal): Promise<CredentialProfileRecord> {\n\t\treturn this.requireActive().readProfile(profile, signal);\n\t}\n\n\tasync writeProfile(record: CredentialProfileRecord, signal?: AbortSignal): Promise<void> {\n\t\tawait this.requireActive().writeProfile(record, signal);\n\t}\n\n\tasync deleteProfile(profile: string, signal?: AbortSignal): Promise<void> {\n\t\tawait this.requireActive().deleteProfile(profile, signal);\n\t}\n\n\tlock(): void {\n\t\tthis.passwordManager.lock();\n\t\tthis.secretsManager.lock();\n\t\tthis.active = undefined;\n\t}\n\n\tprivate requireActive(): CredentialProfileStorage {\n\t\tif (!this.active) throw new CredentialStorageError(\"not_connected\", \"Bitwarden is not connected.\");\n\t\treturn this.active;\n\t}\n}\n"]}

package/dist/core/secrets/bitwarden-credential-storage.d.ts

@@ -1,4 +1,5 @@
 import { type ManagedToolResolver } from "../../utils/tools-manager.ts";
+import { type CredentialCliCommandResult } from "./credential-cli-command.ts";
 import { type CredentialProfileRecord, type CredentialProfileStorage, CredentialStorageError, type StoredCredentialProfileSummary } from "./credential-manager.ts";
 export type BitwardenCredentialStorageErrorCode = "provider_command_failed" | "provider_unavailable" | "malformed_provider_data" | "not_connected" | "profile_not_found";
 export declare class BitwardenCredentialStorageError extends CredentialStorageError {
@@ -12,14 +13,7 @@ export interface BitwardenCommandRequest {
     sessionKey: string;
     signal?: AbortSignal;
 }
-export interface BitwardenCommandResult {
-    exitCode: number;
-    stdout: string;
-    stderr: string;
-    aborted?: boolean;
-    timedOut?: boolean;
-    outputLimitExceeded?: boolean;
-}
+export type BitwardenCommandResult = CredentialCliCommandResult;
 export type BitwardenCommandRunner = (request: BitwardenCommandRequest) => Promise<BitwardenCommandResult>;
 export interface BitwardenCredentialStorageOptions {
     resolveTool?: ManagedToolResolver;

package/dist/core/secrets/bitwarden-credential-storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bitwarden-credential-storage.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/bitwarden-credential-storage.ts"],"names":[],"mappings":"AAEA,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnG,OAAO,EACN,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,sBAAsB,EACtB,KAAK,8BAA8B,EAGnC,MAAM,yBAAyB,CAAC;AAYjC,MAAM,MAAM,mCAAmC,GAC5C,yBAAyB,GACzB,sBAAsB,GACtB,yBAAyB,GACzB,eAAe,GACf,mBAAmB,CAAC;AAEvB,qBAAa,+BAAgC,SAAQ,sBAAsB;IAC1E,SAAiB,IAAI,EAAE,mCAAmC,CAAC;IAE3D,YAAY,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAGrE;CACD;AAED,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAE3G,MAAM,WAAW,iCAAiC;IACjD,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACpC;AAiCD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAkD3G;AA6GD,qBAAa,0BAA2B,YAAW,wBAAwB;IAC1E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyB;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6C;IACtE,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,UAAU,CAAK;IAEvB,YAAY,OAAO,GAAE,iCAAsC,EAG1D;IAEK,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBrE;IAEK,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAIjD;IAEK,YAAY,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,8BAA8B,EAAE,CAAC,CAKlF;IAEK,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAOzF;IAEK,YAAY,CAAC,MAAM,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA4CvF;IAEK,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CASxE;IAED,IAAI,IAAI,IAAI,CAUX;IAED,OAAO,CAAC,eAAe;YAOT,YAAY;YAKZ,MAAM;IAsCpB,OAAO,CAAC,gBAAgB;YAQV,UAAU;CA0BxB"}
+{"version":3,"file":"bitwarden-credential-storage.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/bitwarden-credential-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnG,OAAO,EAAE,KAAK,0BAA0B,EAA2B,MAAM,6BAA6B,CAAC;AACvG,OAAO,EACN,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,sBAAsB,EACtB,KAAK,8BAA8B,EAGnC,MAAM,yBAAyB,CAAC;AAYjC,MAAM,MAAM,mCAAmC,GAC5C,yBAAyB,GACzB,sBAAsB,GACtB,yBAAyB,GACzB,eAAe,GACf,mBAAmB,CAAC;AAEvB,qBAAa,+BAAgC,SAAQ,sBAAsB;IAC1E,SAAiB,IAAI,EAAE,mCAAmC,CAAC;IAE3D,YAAY,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,MAAM,EAGrE;CACD;AAED,MAAM,WAAW,uBAAuB;IACvC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAEhE,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,uBAAuB,KAAK,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAE3G,MAAM,WAAW,iCAAiC;IACjD,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACpC;AAQD,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,uBAAuB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAS3G;AAqDD,qBAAa,0BAA2B,YAAW,wBAAwB;IAC1E,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAyB;IACpD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6C;IACtE,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,UAAU,CAAK;IAEvB,YAAY,OAAO,GAAE,iCAAsC,EAG1D;IAEK,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBrE;IAEK,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAIjD;IAEK,YAAY,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,8BAA8B,EAAE,CAAC,CAGlF;IAEK,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAOzF;IAEK,YAAY,CAAC,MAAM,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA4CvF;IAEK,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CASxE;IAED,IAAI,IAAI,IAAI,CAUX;IAED,OAAO,CAAC,eAAe;YAOT,YAAY;YAKZ,MAAM;IAsCpB,OAAO,CAAC,gBAAgB;YAQV,UAAU;CA0BxB"}

package/dist/core/secrets/bitwarden-credential-storage.js

@@ -1,13 +1,8 @@
-import { spawnProcess, waitForChildProcessWithTermination } from "../../utils/child-process.js";
 import { ensureToolWithDiagnostics } from "../../utils/tools-manager.js";
+import { runCredentialCliCommand } from "./credential-cli-command.js";
 import { CredentialStorageError, validateCredentialProfileName, validateCredentialProfileRecord, } from "./credential-manager.js";
-const ITEM_NAME_PREFIX = "Pi credential profile · ";
-const ENVELOPE_KIND = "pi.credential-profile";
-const ENVELOPE_SCHEMA = 1;
-const MAX_COMMAND_OUTPUT_BYTES = 4 * 1024 * 1024;
+import { CREDENTIAL_PROFILE_KEY_PREFIX, parseCredentialProfileEnvelope, serializeCredentialProfileEnvelope, summarizeCredentialProfiles, } from "./credential-profile-envelope.js";
 const MAX_PROFILE_ITEMS = 256;
-const MAX_NOTE_BYTES = 1024 * 1024;
-const COMMAND_TIMEOUT_MS = 30_000;
 const SYNC_FRESHNESS_MS = 30_000;
 const ITEM_ID_PATTERN = /^[A-Za-z0-9-]{1,128}$/;
 export class BitwardenCredentialStorageError extends CredentialStorageError {
@@ -16,75 +11,15 @@ export class BitwardenCredentialStorageError extends CredentialStorageError {
         this.name = "BitwardenCredentialStorageError";
     }
 }
-function appendBounded(current, chunk, limit) {
-    const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
-    if (Buffer.byteLength(current, "utf8") + Buffer.byteLength(text, "utf8") <= limit) {
-        return { value: current + text, exceeded: false };
-    }
-    return { value: current, exceeded: true };
-}
-function combineAbortSignal(source, controller) {
-    if (!source)
-        return () => { };
-    const abort = () => controller.abort();
-    if (source.aborted)
-        abort();
-    else
-        source.addEventListener("abort", abort, { once: true });
-    return () => source.removeEventListener("abort", abort);
-}
 export async function runBitwardenCommand(request) {
-    const controller = new AbortController();
-    const detachAbort = combineAbortSignal(request.signal, controller);
-    let stdout = "";
-    let stderr = "";
-    let outputLimitExceeded = false;
-    let child;
-    try {
-        child = spawnProcess(request.executable, request.args, {
-            env: { ...process.env, BW_SESSION: request.sessionKey, NO_COLOR: "1" },
-            stdio: ["pipe", "pipe", "pipe"],
-            windowsHide: true,
-        });
-        child.stdout?.on("data", (chunk) => {
-            const appended = appendBounded(stdout, chunk, MAX_COMMAND_OUTPUT_BYTES);
-            stdout = appended.value;
-            if (appended.exceeded) {
-                outputLimitExceeded = true;
-                controller.abort();
-            }
-        });
-        child.stderr?.on("data", (chunk) => {
-            const appended = appendBounded(stderr, chunk, MAX_COMMAND_OUTPUT_BYTES);
-            stderr = appended.value;
-            if (appended.exceeded) {
-                outputLimitExceeded = true;
-                controller.abort();
-            }
-        });
-        child.stdin?.end(request.input);
-        const terminal = await waitForChildProcessWithTermination(child, {
-            signal: controller.signal,
-            timeoutMs: COMMAND_TIMEOUT_MS,
-            killGraceMs: 2_000,
-        });
-        return {
-            exitCode: terminal.code ?? 1,
-            stdout,
-            stderr,
-            ...(terminal.reason === "aborted" ? { aborted: true } : {}),
-            ...(terminal.reason === "timeout" ? { timedOut: true } : {}),
-            ...(outputLimitExceeded ? { outputLimitExceeded: true } : {}),
-        };
-    }
-    catch {
-        return { exitCode: 1, stdout: "", stderr: "" };
-    }
-    finally {
-        detachAbort();
-        stdout = "";
-        stderr = "";
-    }
+    return runCredentialCliCommand({
+        executable: request.executable,
+        args: request.args,
+        ...(request.input !== undefined ? { input: request.input } : {}),
+        authEnvironment: { name: "BW_SESSION", value: request.sessionKey },
+        omitEnvironmentVariables: ["BWS_ACCESS_TOKEN"],
+        ...(request.signal ? { signal: request.signal } : {}),
+    });
 }
 function isObject(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -97,42 +32,11 @@ function parseJson(value) {
         throw new BitwardenCredentialStorageError("malformed_provider_data", "Bitwarden returned malformed profile data.");
     }
 }
-function parseEnvelope(note, expectedProfile) {
-    if (Buffer.byteLength(note, "utf8") > MAX_NOTE_BYTES) {
-        throw new BitwardenCredentialStorageError("malformed_provider_data", "Bitwarden returned an oversized profile record.");
-    }
-    const value = parseJson(note);
-    if (!isObject(value) ||
-        value.kind !== ENVELOPE_KIND ||
-        value.schema !== ENVELOPE_SCHEMA ||
-        value.profile !== expectedProfile ||
-        (value.description !== undefined && typeof value.description !== "string") ||
-        !Array.isArray(value.variables) ||
-        !Array.isArray(value.projectKeys) ||
-        !value.variables.every((variable) => isObject(variable) && typeof variable.name === "string" && typeof variable.value === "string") ||
-        !value.projectKeys.every((key) => typeof key === "string")) {
-        throw new BitwardenCredentialStorageError("malformed_provider_data", "Bitwarden returned malformed profile data.");
-    }
-    const record = {
-        profile: expectedProfile,
-        ...(typeof value.description === "string" ? { description: value.description } : {}),
-        variables: value.variables.map((variable) => ({
-            name: variable.name,
-            value: variable.value,
-        })),
-        projectKeys: value.projectKeys,
-    };
-    try {
-        return validateCredentialProfileRecord(record);
-    }
-    catch {
-        throw new BitwardenCredentialStorageError("malformed_provider_data", "Bitwarden returned malformed profile data.");
-    }
-}
 function parseProfileItem(value) {
-    if (!isObject(value) || typeof value.name !== "string" || !value.name.startsWith(ITEM_NAME_PREFIX))
+    if (!isObject(value) || typeof value.name !== "string" || !value.name.startsWith(CREDENTIAL_PROFILE_KEY_PREFIX)) {
         return undefined;
-    const profile = value.name.slice(ITEM_NAME_PREFIX.length);
+    }
+    const profile = value.name.slice(CREDENTIAL_PROFILE_KEY_PREFIX.length);
     if (value.type !== 2 ||
         typeof value.id !== "string" ||
         !ITEM_ID_PATTERN.test(value.id) ||
@@ -147,25 +51,12 @@ function parseProfileItem(value) {
     catch {
         throw new BitwardenCredentialStorageError("malformed_provider_data", "Bitwarden returned malformed profile data.");
     }
-    return { id: value.id, item: value, record: parseEnvelope(value.notes, profile) };
-}
-function profileSummary(record) {
-    return {
-        profile: record.profile,
-        ...(record.description ? { description: record.description } : {}),
-        variableNames: record.variables.map((variable) => variable.name),
-        projectKeys: [...record.projectKeys],
-    };
-}
-function createEnvelope(record) {
-    return {
-        kind: ENVELOPE_KIND,
-        schema: ENVELOPE_SCHEMA,
-        profile: record.profile,
-        ...(record.description ? { description: record.description } : {}),
-        variables: record.variables.map((variable) => ({ ...variable })),
-        projectKeys: [...record.projectKeys],
-    };
+    try {
+        return { id: value.id, item: value, record: parseCredentialProfileEnvelope(value.notes, profile) };
+    }
+    catch {
+        throw new BitwardenCredentialStorageError("malformed_provider_data", "Bitwarden returned malformed profile data.");
+    }
 }
 export class BitwardenCredentialStorage {
     constructor(options = {}) {
@@ -199,9 +90,7 @@ export class BitwardenCredentialStorage {
     }
     async listProfiles(signal) {
         await this.ensureLoaded(signal);
-        return [...this.profiles.values()]
-            .map((profile) => profileSummary(profile.record))
-            .sort((left, right) => left.profile.localeCompare(right.profile));
+        return summarizeCredentialProfiles([...this.profiles.values()].map((profile) => profile.record));
     }
     async readProfile(profile, signal) {
         await this.ensureLoaded(signal);
@@ -227,8 +116,8 @@ export class BitwardenCredentialStorage {
             item = template;
         }
         item.type = 2;
-        item.name = `${ITEM_NAME_PREFIX}${record.profile}`;
-        item.notes = JSON.stringify(createEnvelope(record));
+        item.name = `${CREDENTIAL_PROFILE_KEY_PREFIX}${record.profile}`;
+        item.notes = serializeCredentialProfileEnvelope(record);
         item.secureNote = { type: 0 };
         let serialized = "";
         let encoded = "";
@@ -296,7 +185,7 @@ export class BitwardenCredentialStorage {
                 // A network sync failure must not discard a locally available encrypted vault.
             }
         }
-        const rawItems = parseJson(await this.runChecked(["list", "items", "--search", ITEM_NAME_PREFIX], undefined, signal));
+        const rawItems = parseJson(await this.runChecked(["list", "items", "--search", CREDENTIAL_PROFILE_KEY_PREFIX], undefined, signal));
         if (!Array.isArray(rawItems) || rawItems.length > MAX_PROFILE_ITEMS) {
             throw new BitwardenCredentialStorageError("malformed_provider_data", "Bitwarden returned an invalid number of profile items.");
         }

package/dist/core/secrets/bitwarden-credential-storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"bitwarden-credential-storage.js","sourceRoot":"","sources":["../../../src/core/secrets/bitwarden-credential-storage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAA4B,MAAM,8BAA8B,CAAC;AACnG,OAAO,EAGN,sBAAsB,EAEtB,6BAA6B,EAC7B,+BAA+B,GAC/B,MAAM,yBAAyB,CAAC;AAEjC,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AACpD,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAC9C,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACjD,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AACnC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAShD,MAAM,OAAO,+BAAgC,SAAQ,sBAAsB;IAG1E,YAAY,IAAyC,EAAE,OAAe;QACrE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAC/C,CAAC;CACD;AAyCD,SAAS,aAAa,CAAC,OAAe,EAAE,KAAsB,EAAE,KAAa;IAC5E,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACnF,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA+B,EAAE,UAA2B;IACvF,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,EAAE,CAAC;;QACvB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAgC;IACzE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,KAAmB,CAAC;IACxB,IAAI,CAAC;QACJ,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE;YACtD,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,QAAQ,EAAE,GAAG,EAAE;YACtE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,WAAW,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC;YACxE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC;YACxB,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,mBAAmB,GAAG,IAAI,CAAC;gBAC3B,UAAU,CAAC,KAAK,EAAE,CAAC;YACpB,CAAC;QACF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC;YACxE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC;YACxB,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,mBAAmB,GAAG,IAAI,CAAC;gBAC3B,UAAU,CAAC,KAAK,EAAE,CAAC;YACpB,CAAC;QACF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,kCAAkC,CAAC,KAAK,EAAE;YAChE,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,kBAAkB;YAC7B,WAAW,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,OAAO;YACN,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC;YAC5B,MAAM;YACN,MAAM;YACN,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;YAAS,CAAC;QACV,WAAW,EAAE,CAAC;QACd,MAAM,GAAG,EAAE,CAAC;QACZ,MAAM,GAAG,EAAE,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,4CAA4C,CAC5C,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,eAAuB;IAC3D,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,cAAc,EAAE,CAAC;QACtD,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,iDAAiD,CACjD,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,IACC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,KAAK,CAAC,IAAI,KAAK,aAAa;QAC5B,KAAK,CAAC,MAAM,KAAK,eAAe;QAChC,KAAK,CAAC,OAAO,KAAK,eAAe;QACjC,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC;QAC1E,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;QAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACjC,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CACrB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAC3G;QACD,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EACzD,CAAC;QACF,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,4CAA4C,CAC5C,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAA4B;QACvC,OAAO,EAAE,eAAe;QACxB,GAAG,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC7C,IAAI,EAAG,QAAoC,CAAC,IAAc;YAC1D,KAAK,EAAG,QAAoC,CAAC,KAAe;SAC5D,CAAC,CAAC;QACH,WAAW,EAAE,KAAK,CAAC,WAAuB;KAC1C,CAAC;IACF,IAAI,CAAC;QACJ,OAAO,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,4CAA4C,CAC5C,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,SAAS,CAAC;IACrH,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1D,IACC,KAAK,CAAC,IAAI,KAAK,CAAC;QAChB,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QAC3B,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,EAC1B,CAAC;QACF,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,4CAA4C,CAC5C,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACJ,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,4CAA4C,CAC5C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B;IACtD,OAAO;QACN,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChE,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;KACpC,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B;IACtD,OAAO;QACN,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAChE,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;KACpC,CAAC;AACH,CAAC;AAED,MAAM,OAAO,0BAA0B;IAStC,YAAY,OAAO,GAAsC,EAAE;QAN1C,aAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;QAG9D,WAAM,GAAG,KAAK,CAAC;QACf,eAAU,GAAG,CAAC,CAAC;QAGtB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,yBAAyB,CAAC;QACpE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,MAAoB;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACzC,MAAM,IAAI,+BAA+B,CACxC,sBAAsB,EACtB,2CAA2C,UAAU,CAAC,WAAW,IAAI,CACrE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAoB;QACjC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,iBAAiB;YAAE,OAAO;QAC5E,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAoB;QACtC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;aAChC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;aAChD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,MAAoB;QACtD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,+BAA+B,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAA+B,EAAE,MAAoB;QACvE,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,IAA6B,CAAC;QAClC,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACP,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,+CAA+C,CAC/C,CAAC;YACH,CAAC;YACD,IAAI,GAAG,QAAQ,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,GAAG,gBAAgB,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAE9B,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,QAAQ;gBACtB,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC;gBACvE,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3D,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,4CAA4C,CAC5C,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACV,UAAU,GAAG,EAAE,CAAC;YAChB,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACjB,CAAC;IACF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,MAAoB;QACxD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,+BAA+B,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI;QACH,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IACrB,CAAC;IAEO,eAAe;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,+BAA+B,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACrE,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,MAAoB;QAC9C,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAA+B,EAAE,WAAoB;QACzE,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC;gBACJ,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,CAAC,KAAK,YAAY,+BAA+B,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;oBACrG,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,+EAA+E;YAChF,CAAC;QACF,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CACzB,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CACzF,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACrE,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,wDAAwD,CACxD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkC,CAAC;QACvD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,sDAAsD,CACtD,CAAC;YACH,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IAEO,gBAAgB;QACvB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,UAAU,CACvB,IAAc,EACd,KAAyB,EACzB,MAA+B;QAE/B,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;YACpC,UAAU;YACV,IAAI;YACJ,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,UAAU;YACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IACC,MAAM,CAAC,QAAQ,KAAK,CAAC;YACrB,MAAM,CAAC,OAAO,KAAK,IAAI;YACvB,MAAM,CAAC,QAAQ,KAAK,IAAI;YACxB,MAAM,CAAC,mBAAmB,KAAK,IAAI,EAClC,CAAC;YACF,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,mEAAmE,CACnE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACtB,CAAC;CACD","sourcesContent":["import type { ChildProcess } from \"node:child_process\";\nimport { spawnProcess, waitForChildProcessWithTermination } from \"../../utils/child-process.ts\";\nimport { ensureToolWithDiagnostics, type ManagedToolResolver } from \"../../utils/tools-manager.ts\";\nimport {\n\ttype CredentialProfileRecord,\n\ttype CredentialProfileStorage,\n\tCredentialStorageError,\n\ttype StoredCredentialProfileSummary,\n\tvalidateCredentialProfileName,\n\tvalidateCredentialProfileRecord,\n} from \"./credential-manager.ts\";\n\nconst ITEM_NAME_PREFIX = \"Pi credential profile · \";\nconst ENVELOPE_KIND = \"pi.credential-profile\";\nconst ENVELOPE_SCHEMA = 1;\nconst MAX_COMMAND_OUTPUT_BYTES = 4 * 1024 * 1024;\nconst MAX_PROFILE_ITEMS = 256;\nconst MAX_NOTE_BYTES = 1024 * 1024;\nconst COMMAND_TIMEOUT_MS = 30_000;\nconst SYNC_FRESHNESS_MS = 30_000;\nconst ITEM_ID_PATTERN = /^[A-Za-z0-9-]{1,128}$/;\n\nexport type BitwardenCredentialStorageErrorCode =\n\t| \"provider_command_failed\"\n\t| \"provider_unavailable\"\n\t| \"malformed_provider_data\"\n\t| \"not_connected\"\n\t| \"profile_not_found\";\n\nexport class BitwardenCredentialStorageError extends CredentialStorageError {\n\tdeclare readonly code: BitwardenCredentialStorageErrorCode;\n\n\tconstructor(code: BitwardenCredentialStorageErrorCode, message: string) {\n\t\tsuper(code, message);\n\t\tthis.name = \"BitwardenCredentialStorageError\";\n\t}\n}\n\nexport interface BitwardenCommandRequest {\n\texecutable: string;\n\targs: string[];\n\tinput?: string;\n\tsessionKey: string;\n\tsignal?: AbortSignal;\n}\n\nexport interface BitwardenCommandResult {\n\texitCode: number;\n\tstdout: string;\n\tstderr: string;\n\taborted?: boolean;\n\ttimedOut?: boolean;\n\toutputLimitExceeded?: boolean;\n}\n\nexport type BitwardenCommandRunner = (request: BitwardenCommandRequest) => Promise<BitwardenCommandResult>;\n\nexport interface BitwardenCredentialStorageOptions {\n\tresolveTool?: ManagedToolResolver;\n\trunCommand?: BitwardenCommandRunner;\n}\n\ninterface BitwardenProfileEnvelope {\n\tkind: typeof ENVELOPE_KIND;\n\tschema: typeof ENVELOPE_SCHEMA;\n\tprofile: string;\n\tdescription?: string;\n\tvariables: Array<{ name: string; value: string }>;\n\tprojectKeys: string[];\n}\n\ninterface CachedBitwardenProfile {\n\tid: string;\n\titem: Record<string, unknown>;\n\trecord: CredentialProfileRecord;\n}\n\nfunction appendBounded(current: string, chunk: Buffer | string, limit: number): { value: string; exceeded: boolean } {\n\tconst text = typeof chunk === \"string\" ? chunk : chunk.toString(\"utf8\");\n\tif (Buffer.byteLength(current, \"utf8\") + Buffer.byteLength(text, \"utf8\") <= limit) {\n\t\treturn { value: current + text, exceeded: false };\n\t}\n\treturn { value: current, exceeded: true };\n}\n\nfunction combineAbortSignal(source: AbortSignal | undefined, controller: AbortController): () => void {\n\tif (!source) return () => {};\n\tconst abort = () => controller.abort();\n\tif (source.aborted) abort();\n\telse source.addEventListener(\"abort\", abort, { once: true });\n\treturn () => source.removeEventListener(\"abort\", abort);\n}\n\nexport async function runBitwardenCommand(request: BitwardenCommandRequest): Promise<BitwardenCommandResult> {\n\tconst controller = new AbortController();\n\tconst detachAbort = combineAbortSignal(request.signal, controller);\n\tlet stdout = \"\";\n\tlet stderr = \"\";\n\tlet outputLimitExceeded = false;\n\tlet child: ChildProcess;\n\ttry {\n\t\tchild = spawnProcess(request.executable, request.args, {\n\t\t\tenv: { ...process.env, BW_SESSION: request.sessionKey, NO_COLOR: \"1\" },\n\t\t\tstdio: [\"pipe\", \"pipe\", \"pipe\"],\n\t\t\twindowsHide: true,\n\t\t});\n\t\tchild.stdout?.on(\"data\", (chunk: Buffer | string) => {\n\t\t\tconst appended = appendBounded(stdout, chunk, MAX_COMMAND_OUTPUT_BYTES);\n\t\t\tstdout = appended.value;\n\t\t\tif (appended.exceeded) {\n\t\t\t\toutputLimitExceeded = true;\n\t\t\t\tcontroller.abort();\n\t\t\t}\n\t\t});\n\t\tchild.stderr?.on(\"data\", (chunk: Buffer | string) => {\n\t\t\tconst appended = appendBounded(stderr, chunk, MAX_COMMAND_OUTPUT_BYTES);\n\t\t\tstderr = appended.value;\n\t\t\tif (appended.exceeded) {\n\t\t\t\toutputLimitExceeded = true;\n\t\t\t\tcontroller.abort();\n\t\t\t}\n\t\t});\n\t\tchild.stdin?.end(request.input);\n\t\tconst terminal = await waitForChildProcessWithTermination(child, {\n\t\t\tsignal: controller.signal,\n\t\t\ttimeoutMs: COMMAND_TIMEOUT_MS,\n\t\t\tkillGraceMs: 2_000,\n\t\t});\n\t\treturn {\n\t\t\texitCode: terminal.code ?? 1,\n\t\t\tstdout,\n\t\t\tstderr,\n\t\t\t...(terminal.reason === \"aborted\" ? { aborted: true } : {}),\n\t\t\t...(terminal.reason === \"timeout\" ? { timedOut: true } : {}),\n\t\t\t...(outputLimitExceeded ? { outputLimitExceeded: true } : {}),\n\t\t};\n\t} catch {\n\t\treturn { exitCode: 1, stdout: \"\", stderr: \"\" };\n\t} finally {\n\t\tdetachAbort();\n\t\tstdout = \"\";\n\t\tstderr = \"\";\n\t}\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction parseJson(value: string): unknown {\n\ttry {\n\t\treturn JSON.parse(value) as unknown;\n\t} catch {\n\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden returned malformed profile data.\",\n\t\t);\n\t}\n}\n\nfunction parseEnvelope(note: string, expectedProfile: string): CredentialProfileRecord {\n\tif (Buffer.byteLength(note, \"utf8\") > MAX_NOTE_BYTES) {\n\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden returned an oversized profile record.\",\n\t\t);\n\t}\n\tconst value = parseJson(note);\n\tif (\n\t\t!isObject(value) ||\n\t\tvalue.kind !== ENVELOPE_KIND ||\n\t\tvalue.schema !== ENVELOPE_SCHEMA ||\n\t\tvalue.profile !== expectedProfile ||\n\t\t(value.description !== undefined && typeof value.description !== \"string\") ||\n\t\t!Array.isArray(value.variables) ||\n\t\t!Array.isArray(value.projectKeys) ||\n\t\t!value.variables.every(\n\t\t\t(variable) => isObject(variable) && typeof variable.name === \"string\" && typeof variable.value === \"string\",\n\t\t) ||\n\t\t!value.projectKeys.every((key) => typeof key === \"string\")\n\t) {\n\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden returned malformed profile data.\",\n\t\t);\n\t}\n\tconst record: CredentialProfileRecord = {\n\t\tprofile: expectedProfile,\n\t\t...(typeof value.description === \"string\" ? { description: value.description } : {}),\n\t\tvariables: value.variables.map((variable) => ({\n\t\t\tname: (variable as Record<string, unknown>).name as string,\n\t\t\tvalue: (variable as Record<string, unknown>).value as string,\n\t\t})),\n\t\tprojectKeys: value.projectKeys as string[],\n\t};\n\ttry {\n\t\treturn validateCredentialProfileRecord(record);\n\t} catch {\n\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden returned malformed profile data.\",\n\t\t);\n\t}\n}\n\nfunction parseProfileItem(value: unknown): CachedBitwardenProfile | undefined {\n\tif (!isObject(value) || typeof value.name !== \"string\" || !value.name.startsWith(ITEM_NAME_PREFIX)) return undefined;\n\tconst profile = value.name.slice(ITEM_NAME_PREFIX.length);\n\tif (\n\t\tvalue.type !== 2 ||\n\t\ttypeof value.id !== \"string\" ||\n\t\t!ITEM_ID_PATTERN.test(value.id) ||\n\t\ttypeof value.notes !== \"string\" ||\n\t\t!isObject(value.secureNote) ||\n\t\tvalue.secureNote.type !== 0\n\t) {\n\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden returned malformed profile data.\",\n\t\t);\n\t}\n\ttry {\n\t\tvalidateCredentialProfileName(profile);\n\t} catch {\n\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden returned malformed profile data.\",\n\t\t);\n\t}\n\treturn { id: value.id, item: value, record: parseEnvelope(value.notes, profile) };\n}\n\nfunction profileSummary(record: CredentialProfileRecord): StoredCredentialProfileSummary {\n\treturn {\n\t\tprofile: record.profile,\n\t\t...(record.description ? { description: record.description } : {}),\n\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\tprojectKeys: [...record.projectKeys],\n\t};\n}\n\nfunction createEnvelope(record: CredentialProfileRecord): BitwardenProfileEnvelope {\n\treturn {\n\t\tkind: ENVELOPE_KIND,\n\t\tschema: ENVELOPE_SCHEMA,\n\t\tprofile: record.profile,\n\t\t...(record.description ? { description: record.description } : {}),\n\t\tvariables: record.variables.map((variable) => ({ ...variable })),\n\t\tprojectKeys: [...record.projectKeys],\n\t};\n}\n\nexport class BitwardenCredentialStorage implements CredentialProfileStorage {\n\tprivate readonly resolveTool: ManagedToolResolver;\n\tprivate readonly runCommand: BitwardenCommandRunner;\n\tprivate readonly profiles = new Map<string, CachedBitwardenProfile>();\n\tprivate executable: string | undefined;\n\tprivate sessionKey: string | undefined;\n\tprivate loaded = false;\n\tprivate lastSyncAt = 0;\n\n\tconstructor(options: BitwardenCredentialStorageOptions = {}) {\n\t\tthis.resolveTool = options.resolveTool ?? ensureToolWithDiagnostics;\n\t\tthis.runCommand = options.runCommand ?? runBitwardenCommand;\n\t}\n\n\tasync connect(sessionKey: string, signal?: AbortSignal): Promise<void> {\n\t\tthis.lock();\n\t\tconst resolution = await this.resolveTool(\"bw\", true);\n\t\tif (resolution.status === \"unavailable\") {\n\t\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\t\"provider_unavailable\",\n\t\t\t\t`Bitwarden CLI could not be provisioned (${resolution.failureCode}).`,\n\t\t\t);\n\t\t}\n\t\tthis.executable = resolution.path;\n\t\tthis.sessionKey = sessionKey;\n\t\ttry {\n\t\t\tawait this.reload(signal, true);\n\t\t} catch (error) {\n\t\t\tthis.lock();\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync refresh(signal?: AbortSignal): Promise<void> {\n\t\tthis.assertConnected();\n\t\tif (this.loaded && Date.now() - this.lastSyncAt < SYNC_FRESHNESS_MS) return;\n\t\tawait this.reload(signal, true);\n\t}\n\n\tasync listProfiles(signal?: AbortSignal): Promise<StoredCredentialProfileSummary[]> {\n\t\tawait this.ensureLoaded(signal);\n\t\treturn [...this.profiles.values()]\n\t\t\t.map((profile) => profileSummary(profile.record))\n\t\t\t.sort((left, right) => left.profile.localeCompare(right.profile));\n\t}\n\n\tasync readProfile(profile: string, signal?: AbortSignal): Promise<CredentialProfileRecord> {\n\t\tawait this.ensureLoaded(signal);\n\t\tconst cached = this.profiles.get(profile);\n\t\tif (!cached) {\n\t\t\tthrow new BitwardenCredentialStorageError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t}\n\t\treturn structuredClone(cached.record);\n\t}\n\n\tasync writeProfile(record: CredentialProfileRecord, signal?: AbortSignal): Promise<void> {\n\t\tvalidateCredentialProfileRecord(record);\n\t\tawait this.ensureLoaded(signal);\n\t\tconst existing = this.profiles.get(record.profile);\n\t\tlet item: Record<string, unknown>;\n\t\tif (existing) {\n\t\t\titem = structuredClone(existing.item);\n\t\t} else {\n\t\t\tconst template = parseJson(await this.runChecked([\"get\", \"template\", \"item\"], undefined, signal));\n\t\t\tif (!isObject(template)) {\n\t\t\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\t\"Bitwarden returned a malformed item template.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\titem = template;\n\t\t}\n\t\titem.type = 2;\n\t\titem.name = `${ITEM_NAME_PREFIX}${record.profile}`;\n\t\titem.notes = JSON.stringify(createEnvelope(record));\n\t\titem.secureNote = { type: 0 };\n\n\t\tlet serialized = \"\";\n\t\tlet encoded = \"\";\n\t\ttry {\n\t\t\tserialized = JSON.stringify(item);\n\t\t\tencoded = Buffer.from(serialized, \"utf8\").toString(\"base64\");\n\t\t\tconst output = existing\n\t\t\t\t? await this.runChecked([\"edit\", \"item\", existing.id], encoded, signal)\n\t\t\t\t: await this.runChecked([\"create\", \"item\"], encoded, signal);\n\t\t\tconst updated = parseProfileItem(parseJson(output));\n\t\t\tif (!updated || updated.record.profile !== record.profile) {\n\t\t\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\t\"Bitwarden returned malformed profile data.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tthis.profiles.set(record.profile, updated);\n\t\t\tthis.lastSyncAt = Date.now();\n\t\t} finally {\n\t\t\tserialized = \"\";\n\t\t\tencoded = \"\";\n\t\t\titem.notes = \"\";\n\t\t}\n\t}\n\n\tasync deleteProfile(profile: string, signal?: AbortSignal): Promise<void> {\n\t\tawait this.ensureLoaded(signal);\n\t\tconst cached = this.profiles.get(profile);\n\t\tif (!cached) {\n\t\t\tthrow new BitwardenCredentialStorageError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t}\n\t\tawait this.runChecked([\"delete\", \"item\", cached.id], undefined, signal);\n\t\tthis.profiles.delete(profile);\n\t\tthis.lastSyncAt = Date.now();\n\t}\n\n\tlock(): void {\n\t\tthis.executable = undefined;\n\t\tthis.sessionKey = undefined;\n\t\tfor (const cached of this.profiles.values()) {\n\t\t\tfor (const variable of cached.record.variables) variable.value = \"\";\n\t\t\tcached.item.notes = \"\";\n\t\t}\n\t\tthis.profiles.clear();\n\t\tthis.loaded = false;\n\t\tthis.lastSyncAt = 0;\n\t}\n\n\tprivate assertConnected(): { executable: string; sessionKey: string } {\n\t\tif (!this.executable || !this.sessionKey) {\n\t\t\tthrow new BitwardenCredentialStorageError(\"not_connected\", \"Bitwarden is not connected.\");\n\t\t}\n\t\treturn { executable: this.executable, sessionKey: this.sessionKey };\n\t}\n\n\tprivate async ensureLoaded(signal?: AbortSignal): Promise<void> {\n\t\tthis.assertConnected();\n\t\tif (!this.loaded) await this.reload(signal, false);\n\t}\n\n\tprivate async reload(signal: AbortSignal | undefined, attemptSync: boolean): Promise<void> {\n\t\tif (attemptSync) {\n\t\t\ttry {\n\t\t\t\tawait this.runChecked([\"sync\"], undefined, signal);\n\t\t\t} catch (error) {\n\t\t\t\tif (!(error instanceof BitwardenCredentialStorageError) || error.code !== \"provider_command_failed\") {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\t// A network sync failure must not discard a locally available encrypted vault.\n\t\t\t}\n\t\t}\n\t\tconst rawItems = parseJson(\n\t\t\tawait this.runChecked([\"list\", \"items\", \"--search\", ITEM_NAME_PREFIX], undefined, signal),\n\t\t);\n\t\tif (!Array.isArray(rawItems) || rawItems.length > MAX_PROFILE_ITEMS) {\n\t\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\"Bitwarden returned an invalid number of profile items.\",\n\t\t\t);\n\t\t}\n\t\tconst next = new Map<string, CachedBitwardenProfile>();\n\t\tfor (const rawItem of rawItems) {\n\t\t\tconst parsed = parseProfileItem(rawItem);\n\t\t\tif (!parsed) continue;\n\t\t\tif (next.has(parsed.record.profile)) {\n\t\t\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\t\"Bitwarden contains duplicate Pi credential profiles.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tnext.set(parsed.record.profile, parsed);\n\t\t}\n\t\tthis.lockProfileCache();\n\t\tfor (const [profile, cached] of next) this.profiles.set(profile, cached);\n\t\tthis.loaded = true;\n\t\tthis.lastSyncAt = Date.now();\n\t}\n\n\tprivate lockProfileCache(): void {\n\t\tfor (const cached of this.profiles.values()) {\n\t\t\tfor (const variable of cached.record.variables) variable.value = \"\";\n\t\t\tcached.item.notes = \"\";\n\t\t}\n\t\tthis.profiles.clear();\n\t}\n\n\tprivate async runChecked(\n\t\targs: string[],\n\t\tinput: string | undefined,\n\t\tsignal: AbortSignal | undefined,\n\t): Promise<string> {\n\t\tconst { executable, sessionKey } = this.assertConnected();\n\t\tconst result = await this.runCommand({\n\t\t\texecutable,\n\t\t\targs,\n\t\t\t...(input !== undefined ? { input } : {}),\n\t\t\tsessionKey,\n\t\t\t...(signal ? { signal } : {}),\n\t\t});\n\t\tif (\n\t\t\tresult.exitCode !== 0 ||\n\t\t\tresult.aborted === true ||\n\t\t\tresult.timedOut === true ||\n\t\t\tresult.outputLimitExceeded === true\n\t\t) {\n\t\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\t\"provider_command_failed\",\n\t\t\t\t\"Bitwarden command failed safely without exposing provider output.\",\n\t\t\t);\n\t\t}\n\t\treturn result.stdout;\n\t}\n}\n"]}
+{"version":3,"file":"bitwarden-credential-storage.js","sourceRoot":"","sources":["../../../src/core/secrets/bitwarden-credential-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAA4B,MAAM,8BAA8B,CAAC;AACnG,OAAO,EAAmC,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACvG,OAAO,EAGN,sBAAsB,EAEtB,6BAA6B,EAC7B,+BAA+B,GAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAC9B,kCAAkC,EAClC,2BAA2B,GAC3B,MAAM,kCAAkC,CAAC;AAE1C,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAShD,MAAM,OAAO,+BAAgC,SAAQ,sBAAsB;IAG1E,YAAY,IAAyC,EAAE,OAAe;QACrE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAC/C,CAAC;CACD;AAyBD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAgC;IACzE,OAAO,uBAAuB,CAAC;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,eAAe,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE;QAClE,wBAAwB,EAAE,CAAC,kBAAkB,CAAC;QAC9C,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,4CAA4C,CAC5C,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,6BAA6B,CAAC,EAAE,CAAC;QACjH,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACvE,IACC,KAAK,CAAC,IAAI,KAAK,CAAC;QAChB,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QAC3B,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,EAC1B,CAAC;QACF,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,4CAA4C,CAC5C,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACJ,6BAA6B,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,4CAA4C,CAC5C,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,4CAA4C,CAC5C,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,OAAO,0BAA0B;IAStC,YAAY,OAAO,GAAsC,EAAE;QAN1C,aAAQ,GAAG,IAAI,GAAG,EAAkC,CAAC;QAG9D,WAAM,GAAG,KAAK,CAAC;QACf,eAAU,GAAG,CAAC,CAAC;QAGtB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,yBAAyB,CAAC;QACpE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,MAAoB;QACrD,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACzC,MAAM,IAAI,+BAA+B,CACxC,sBAAsB,EACtB,2CAA2C,UAAU,CAAC,WAAW,IAAI,CACrE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC;QAClC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAoB;QACjC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,iBAAiB;YAAE,OAAO;QAC5E,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAoB;QACtC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,2BAA2B,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,MAAoB;QACtD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,+BAA+B,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAA+B,EAAE,MAAoB;QACvE,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,IAA6B,CAAC;QAClC,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACP,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,+CAA+C,CAC/C,CAAC;YACH,CAAC;YACD,IAAI,GAAG,QAAQ,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QACd,IAAI,CAAC,IAAI,GAAG,GAAG,6BAA6B,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;QAChE,IAAI,CAAC,KAAK,GAAG,kCAAkC,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAE9B,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC;YACJ,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7D,MAAM,MAAM,GAAG,QAAQ;gBACtB,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC;gBACvE,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACpD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC3D,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,4CAA4C,CAC5C,CAAC;YACH,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACV,UAAU,GAAG,EAAE,CAAC;YAChB,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACjB,CAAC;IACF,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,MAAoB;QACxD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,+BAA+B,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI;QACH,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IACrB,CAAC;IAEO,eAAe;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAC1C,MAAM,IAAI,+BAA+B,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACrE,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,MAAoB;QAC9C,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAA+B,EAAE,WAAoB;QACzE,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,CAAC;gBACJ,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,CAAC,CAAC,KAAK,YAAY,+BAA+B,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;oBACrG,MAAM,KAAK,CAAC;gBACb,CAAC;gBACD,+EAA+E;YAChF,CAAC;QACF,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CACzB,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,6BAA6B,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,CACtG,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACrE,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,wDAAwD,CACxD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkC,CAAC;QACvD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,sDAAsD,CACtD,CAAC;YACH,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,IAAI;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IAEO,gBAAgB;QACvB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YACpE,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,UAAU,CACvB,IAAc,EACd,KAAyB,EACzB,MAA+B;QAE/B,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;YACpC,UAAU;YACV,IAAI;YACJ,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,UAAU;YACV,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IACC,MAAM,CAAC,QAAQ,KAAK,CAAC;YACrB,MAAM,CAAC,OAAO,KAAK,IAAI;YACvB,MAAM,CAAC,QAAQ,KAAK,IAAI;YACxB,MAAM,CAAC,mBAAmB,KAAK,IAAI,EAClC,CAAC;YACF,MAAM,IAAI,+BAA+B,CACxC,yBAAyB,EACzB,mEAAmE,CACnE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACtB,CAAC;CACD","sourcesContent":["import { ensureToolWithDiagnostics, type ManagedToolResolver } from \"../../utils/tools-manager.ts\";\nimport { type CredentialCliCommandResult, runCredentialCliCommand } from \"./credential-cli-command.ts\";\nimport {\n\ttype CredentialProfileRecord,\n\ttype CredentialProfileStorage,\n\tCredentialStorageError,\n\ttype StoredCredentialProfileSummary,\n\tvalidateCredentialProfileName,\n\tvalidateCredentialProfileRecord,\n} from \"./credential-manager.ts\";\nimport {\n\tCREDENTIAL_PROFILE_KEY_PREFIX,\n\tparseCredentialProfileEnvelope,\n\tserializeCredentialProfileEnvelope,\n\tsummarizeCredentialProfiles,\n} from \"./credential-profile-envelope.ts\";\n\nconst MAX_PROFILE_ITEMS = 256;\nconst SYNC_FRESHNESS_MS = 30_000;\nconst ITEM_ID_PATTERN = /^[A-Za-z0-9-]{1,128}$/;\n\nexport type BitwardenCredentialStorageErrorCode =\n\t| \"provider_command_failed\"\n\t| \"provider_unavailable\"\n\t| \"malformed_provider_data\"\n\t| \"not_connected\"\n\t| \"profile_not_found\";\n\nexport class BitwardenCredentialStorageError extends CredentialStorageError {\n\tdeclare readonly code: BitwardenCredentialStorageErrorCode;\n\n\tconstructor(code: BitwardenCredentialStorageErrorCode, message: string) {\n\t\tsuper(code, message);\n\t\tthis.name = \"BitwardenCredentialStorageError\";\n\t}\n}\n\nexport interface BitwardenCommandRequest {\n\texecutable: string;\n\targs: string[];\n\tinput?: string;\n\tsessionKey: string;\n\tsignal?: AbortSignal;\n}\n\nexport type BitwardenCommandResult = CredentialCliCommandResult;\n\nexport type BitwardenCommandRunner = (request: BitwardenCommandRequest) => Promise<BitwardenCommandResult>;\n\nexport interface BitwardenCredentialStorageOptions {\n\tresolveTool?: ManagedToolResolver;\n\trunCommand?: BitwardenCommandRunner;\n}\n\ninterface CachedBitwardenProfile {\n\tid: string;\n\titem: Record<string, unknown>;\n\trecord: CredentialProfileRecord;\n}\n\nexport async function runBitwardenCommand(request: BitwardenCommandRequest): Promise<BitwardenCommandResult> {\n\treturn runCredentialCliCommand({\n\t\texecutable: request.executable,\n\t\targs: request.args,\n\t\t...(request.input !== undefined ? { input: request.input } : {}),\n\t\tauthEnvironment: { name: \"BW_SESSION\", value: request.sessionKey },\n\t\tomitEnvironmentVariables: [\"BWS_ACCESS_TOKEN\"],\n\t\t...(request.signal ? { signal: request.signal } : {}),\n\t});\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction parseJson(value: string): unknown {\n\ttry {\n\t\treturn JSON.parse(value) as unknown;\n\t} catch {\n\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden returned malformed profile data.\",\n\t\t);\n\t}\n}\n\nfunction parseProfileItem(value: unknown): CachedBitwardenProfile | undefined {\n\tif (!isObject(value) || typeof value.name !== \"string\" || !value.name.startsWith(CREDENTIAL_PROFILE_KEY_PREFIX)) {\n\t\treturn undefined;\n\t}\n\tconst profile = value.name.slice(CREDENTIAL_PROFILE_KEY_PREFIX.length);\n\tif (\n\t\tvalue.type !== 2 ||\n\t\ttypeof value.id !== \"string\" ||\n\t\t!ITEM_ID_PATTERN.test(value.id) ||\n\t\ttypeof value.notes !== \"string\" ||\n\t\t!isObject(value.secureNote) ||\n\t\tvalue.secureNote.type !== 0\n\t) {\n\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden returned malformed profile data.\",\n\t\t);\n\t}\n\ttry {\n\t\tvalidateCredentialProfileName(profile);\n\t} catch {\n\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden returned malformed profile data.\",\n\t\t);\n\t}\n\ttry {\n\t\treturn { id: value.id, item: value, record: parseCredentialProfileEnvelope(value.notes, profile) };\n\t} catch {\n\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden returned malformed profile data.\",\n\t\t);\n\t}\n}\n\nexport class BitwardenCredentialStorage implements CredentialProfileStorage {\n\tprivate readonly resolveTool: ManagedToolResolver;\n\tprivate readonly runCommand: BitwardenCommandRunner;\n\tprivate readonly profiles = new Map<string, CachedBitwardenProfile>();\n\tprivate executable: string | undefined;\n\tprivate sessionKey: string | undefined;\n\tprivate loaded = false;\n\tprivate lastSyncAt = 0;\n\n\tconstructor(options: BitwardenCredentialStorageOptions = {}) {\n\t\tthis.resolveTool = options.resolveTool ?? ensureToolWithDiagnostics;\n\t\tthis.runCommand = options.runCommand ?? runBitwardenCommand;\n\t}\n\n\tasync connect(sessionKey: string, signal?: AbortSignal): Promise<void> {\n\t\tthis.lock();\n\t\tconst resolution = await this.resolveTool(\"bw\", true);\n\t\tif (resolution.status === \"unavailable\") {\n\t\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\t\"provider_unavailable\",\n\t\t\t\t`Bitwarden CLI could not be provisioned (${resolution.failureCode}).`,\n\t\t\t);\n\t\t}\n\t\tthis.executable = resolution.path;\n\t\tthis.sessionKey = sessionKey;\n\t\ttry {\n\t\t\tawait this.reload(signal, true);\n\t\t} catch (error) {\n\t\t\tthis.lock();\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync refresh(signal?: AbortSignal): Promise<void> {\n\t\tthis.assertConnected();\n\t\tif (this.loaded && Date.now() - this.lastSyncAt < SYNC_FRESHNESS_MS) return;\n\t\tawait this.reload(signal, true);\n\t}\n\n\tasync listProfiles(signal?: AbortSignal): Promise<StoredCredentialProfileSummary[]> {\n\t\tawait this.ensureLoaded(signal);\n\t\treturn summarizeCredentialProfiles([...this.profiles.values()].map((profile) => profile.record));\n\t}\n\n\tasync readProfile(profile: string, signal?: AbortSignal): Promise<CredentialProfileRecord> {\n\t\tawait this.ensureLoaded(signal);\n\t\tconst cached = this.profiles.get(profile);\n\t\tif (!cached) {\n\t\t\tthrow new BitwardenCredentialStorageError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t}\n\t\treturn structuredClone(cached.record);\n\t}\n\n\tasync writeProfile(record: CredentialProfileRecord, signal?: AbortSignal): Promise<void> {\n\t\tvalidateCredentialProfileRecord(record);\n\t\tawait this.ensureLoaded(signal);\n\t\tconst existing = this.profiles.get(record.profile);\n\t\tlet item: Record<string, unknown>;\n\t\tif (existing) {\n\t\t\titem = structuredClone(existing.item);\n\t\t} else {\n\t\t\tconst template = parseJson(await this.runChecked([\"get\", \"template\", \"item\"], undefined, signal));\n\t\t\tif (!isObject(template)) {\n\t\t\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\t\"Bitwarden returned a malformed item template.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\titem = template;\n\t\t}\n\t\titem.type = 2;\n\t\titem.name = `${CREDENTIAL_PROFILE_KEY_PREFIX}${record.profile}`;\n\t\titem.notes = serializeCredentialProfileEnvelope(record);\n\t\titem.secureNote = { type: 0 };\n\n\t\tlet serialized = \"\";\n\t\tlet encoded = \"\";\n\t\ttry {\n\t\t\tserialized = JSON.stringify(item);\n\t\t\tencoded = Buffer.from(serialized, \"utf8\").toString(\"base64\");\n\t\t\tconst output = existing\n\t\t\t\t? await this.runChecked([\"edit\", \"item\", existing.id], encoded, signal)\n\t\t\t\t: await this.runChecked([\"create\", \"item\"], encoded, signal);\n\t\t\tconst updated = parseProfileItem(parseJson(output));\n\t\t\tif (!updated || updated.record.profile !== record.profile) {\n\t\t\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\t\"Bitwarden returned malformed profile data.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tthis.profiles.set(record.profile, updated);\n\t\t\tthis.lastSyncAt = Date.now();\n\t\t} finally {\n\t\t\tserialized = \"\";\n\t\t\tencoded = \"\";\n\t\t\titem.notes = \"\";\n\t\t}\n\t}\n\n\tasync deleteProfile(profile: string, signal?: AbortSignal): Promise<void> {\n\t\tawait this.ensureLoaded(signal);\n\t\tconst cached = this.profiles.get(profile);\n\t\tif (!cached) {\n\t\t\tthrow new BitwardenCredentialStorageError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t}\n\t\tawait this.runChecked([\"delete\", \"item\", cached.id], undefined, signal);\n\t\tthis.profiles.delete(profile);\n\t\tthis.lastSyncAt = Date.now();\n\t}\n\n\tlock(): void {\n\t\tthis.executable = undefined;\n\t\tthis.sessionKey = undefined;\n\t\tfor (const cached of this.profiles.values()) {\n\t\t\tfor (const variable of cached.record.variables) variable.value = \"\";\n\t\t\tcached.item.notes = \"\";\n\t\t}\n\t\tthis.profiles.clear();\n\t\tthis.loaded = false;\n\t\tthis.lastSyncAt = 0;\n\t}\n\n\tprivate assertConnected(): { executable: string; sessionKey: string } {\n\t\tif (!this.executable || !this.sessionKey) {\n\t\t\tthrow new BitwardenCredentialStorageError(\"not_connected\", \"Bitwarden is not connected.\");\n\t\t}\n\t\treturn { executable: this.executable, sessionKey: this.sessionKey };\n\t}\n\n\tprivate async ensureLoaded(signal?: AbortSignal): Promise<void> {\n\t\tthis.assertConnected();\n\t\tif (!this.loaded) await this.reload(signal, false);\n\t}\n\n\tprivate async reload(signal: AbortSignal | undefined, attemptSync: boolean): Promise<void> {\n\t\tif (attemptSync) {\n\t\t\ttry {\n\t\t\t\tawait this.runChecked([\"sync\"], undefined, signal);\n\t\t\t} catch (error) {\n\t\t\t\tif (!(error instanceof BitwardenCredentialStorageError) || error.code !== \"provider_command_failed\") {\n\t\t\t\t\tthrow error;\n\t\t\t\t}\n\t\t\t\t// A network sync failure must not discard a locally available encrypted vault.\n\t\t\t}\n\t\t}\n\t\tconst rawItems = parseJson(\n\t\t\tawait this.runChecked([\"list\", \"items\", \"--search\", CREDENTIAL_PROFILE_KEY_PREFIX], undefined, signal),\n\t\t);\n\t\tif (!Array.isArray(rawItems) || rawItems.length > MAX_PROFILE_ITEMS) {\n\t\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\"Bitwarden returned an invalid number of profile items.\",\n\t\t\t);\n\t\t}\n\t\tconst next = new Map<string, CachedBitwardenProfile>();\n\t\tfor (const rawItem of rawItems) {\n\t\t\tconst parsed = parseProfileItem(rawItem);\n\t\t\tif (!parsed) continue;\n\t\t\tif (next.has(parsed.record.profile)) {\n\t\t\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\t\"Bitwarden contains duplicate Pi credential profiles.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tnext.set(parsed.record.profile, parsed);\n\t\t}\n\t\tthis.lockProfileCache();\n\t\tfor (const [profile, cached] of next) this.profiles.set(profile, cached);\n\t\tthis.loaded = true;\n\t\tthis.lastSyncAt = Date.now();\n\t}\n\n\tprivate lockProfileCache(): void {\n\t\tfor (const cached of this.profiles.values()) {\n\t\t\tfor (const variable of cached.record.variables) variable.value = \"\";\n\t\t\tcached.item.notes = \"\";\n\t\t}\n\t\tthis.profiles.clear();\n\t}\n\n\tprivate async runChecked(\n\t\targs: string[],\n\t\tinput: string | undefined,\n\t\tsignal: AbortSignal | undefined,\n\t): Promise<string> {\n\t\tconst { executable, sessionKey } = this.assertConnected();\n\t\tconst result = await this.runCommand({\n\t\t\texecutable,\n\t\t\targs,\n\t\t\t...(input !== undefined ? { input } : {}),\n\t\t\tsessionKey,\n\t\t\t...(signal ? { signal } : {}),\n\t\t});\n\t\tif (\n\t\t\tresult.exitCode !== 0 ||\n\t\t\tresult.aborted === true ||\n\t\t\tresult.timedOut === true ||\n\t\t\tresult.outputLimitExceeded === true\n\t\t) {\n\t\t\tthrow new BitwardenCredentialStorageError(\n\t\t\t\t\"provider_command_failed\",\n\t\t\t\t\"Bitwarden command failed safely without exposing provider output.\",\n\t\t\t);\n\t\t}\n\t\treturn result.stdout;\n\t}\n}\n"]}

package/dist/core/secrets/bitwarden-secrets-manager-storage.d.ts

@@ -0,0 +1,46 @@
+import { type ManagedToolResolver } from "../../utils/tools-manager.ts";
+import { type CredentialCliCommandResult } from "./credential-cli-command.ts";
+import { type CredentialProfileRecord, type CredentialProfileStorage, CredentialStorageError, type StoredCredentialProfileSummary } from "./credential-manager.ts";
+export declare class BitwardenSecretsManagerStorageError extends CredentialStorageError {
+    constructor(code: CredentialStorageError["code"], message: string);
+}
+export interface BitwardenSecretsManagerCommandRequest {
+    executable: string;
+    args: string[];
+    accessToken: string;
+    signal?: AbortSignal;
+}
+export type BitwardenSecretsManagerCommandResult = CredentialCliCommandResult;
+export type BitwardenSecretsManagerCommandRunner = (request: BitwardenSecretsManagerCommandRequest) => Promise<BitwardenSecretsManagerCommandResult>;
+export interface BitwardenSecretsManagerCredentialStorageOptions {
+    coordinationFile: string;
+    resolveTool?: ManagedToolResolver;
+    runCommand?: BitwardenSecretsManagerCommandRunner;
+}
+export declare function runBitwardenSecretsManagerCommand(request: BitwardenSecretsManagerCommandRequest): Promise<BitwardenSecretsManagerCommandResult>;
+export declare class BitwardenSecretsManagerCredentialStorage implements CredentialProfileStorage {
+    private readonly coordinationFile;
+    private readonly resolveTool;
+    private readonly runCommand;
+    private readonly profiles;
+    private executable;
+    private accessToken;
+    private project;
+    private dataKey;
+    private lastSyncAt;
+    constructor(options: BitwardenSecretsManagerCredentialStorageOptions);
+    connect(accessToken: string, signal?: AbortSignal): Promise<void>;
+    refresh(signal?: AbortSignal): Promise<void>;
+    listProfiles(): Promise<StoredCredentialProfileSummary[]>;
+    readProfile(profile: string): Promise<CredentialProfileRecord>;
+    writeProfile(record: CredentialProfileRecord, signal?: AbortSignal): Promise<void>;
+    deleteProfile(profile: string, signal?: AbortSignal): Promise<void>;
+    lock(): void;
+    private assertConnected;
+    private reload;
+    private reloadUnderCoordination;
+    private ensureDataKeyUnderCoordination;
+    private withProviderCoordination;
+    private runChecked;
+}
+//# sourceMappingURL=bitwarden-secrets-manager-storage.d.ts.map

package/dist/core/secrets/bitwarden-secrets-manager-storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitwarden-secrets-manager-storage.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/bitwarden-secrets-manager-storage.ts"],"names":[],"mappings":"AACA,OAAO,EAA6B,KAAK,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AAEnG,OAAO,EAAE,KAAK,0BAA0B,EAA2B,MAAM,6BAA6B,CAAC;AACvG,OAAO,EACN,KAAK,uBAAuB,EAC5B,KAAK,wBAAwB,EAC7B,sBAAsB,EACtB,KAAK,8BAA8B,EAGnC,MAAM,yBAAyB,CAAC;AAwBjC,qBAAa,mCAAoC,SAAQ,sBAAsB;IAC9E,YAAY,IAAI,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAGhE;CACD;AAED,MAAM,WAAW,qCAAqC;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,MAAM,oCAAoC,GAAG,0BAA0B,CAAC;AAE9E,MAAM,MAAM,oCAAoC,GAAG,CAClD,OAAO,EAAE,qCAAqC,KAC1C,OAAO,CAAC,oCAAoC,CAAC,CAAC;AAEnD,MAAM,WAAW,+CAA+C;IAC/D,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,UAAU,CAAC,EAAE,oCAAoC,CAAC;CAClD;AA+JD,wBAAsB,iCAAiC,CACtD,OAAO,EAAE,qCAAqC,GAC5C,OAAO,CAAC,oCAAoC,CAAC,CAQ/C;AAED,qBAAa,wCAAyC,YAAW,wBAAwB;IACxF,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAuC;IAClE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkD;IAC3E,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,OAAO,CAAoC;IACnD,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,UAAU,CAAK;IAEvB,YAAY,OAAO,EAAE,+CAA+C,EAOnE;IAEK,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBtE;IAEK,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjD;IAEK,YAAY,IAAI,OAAO,CAAC,8BAA8B,EAAE,CAAC,CAG9D;IAEK,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAOnE;IAEK,YAAY,CAAC,MAAM,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CA6CvF;IAEK,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAaxE;IAED,IAAI,IAAI,IAAI,CAWX;IAED,OAAO,CAAC,eAAe;YAWT,MAAM;YAIN,uBAAuB;YAqFvB,8BAA8B;YA6B9B,wBAAwB;YAoBxB,UAAU;CAuBxB"}