@caupulican/pi-adaptative 0.93.11 → 0.93.13

package/dist/core/secrets/bitwarden-secrets-manager-storage.js

@@ -0,0 +1,379 @@
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { ensureToolWithDiagnostics } from "../../utils/tools-manager.js";
+import { withFileLock } from "../util/atomic-file.js";
+import { runCredentialCliCommand } from "./credential-cli-command.js";
+import { CredentialStorageError, validateCredentialProfileName, validateCredentialProfileRecord, } from "./credential-manager.js";
+import { CREDENTIAL_PROFILE_KEY_PREFIX, parseCredentialProfileEnvelope, serializeCredentialProfileEnvelope, summarizeCredentialProfiles, } from "./credential-profile-envelope.js";
+const PROJECT_NAME = "Pi Credential Profiles";
+const DATA_KEY_NAME = "Pi credential store · encryption key";
+const DATA_KEY_NOTE = "Pi-managed profile encryption key";
+const PROFILE_NOTE = "Pi-managed encrypted credential profile";
+const DATA_KEY_PREFIX = "pi-credential-key:v1:";
+const CIPHERTEXT_PREFIX = "pi-credential-profile:v1:";
+const MAX_PROVIDER_ITEMS = 256;
+const MAX_CIPHERTEXT_BYTES = 2 * 1024 * 1024;
+const SYNC_FRESHNESS_MS = 30_000;
+const PROVIDER_COORDINATION_LOCK_OPTIONS = Object.freeze({
+    retries: 60,
+    minRetryDelayMs: 50,
+    maxRetryDelayMs: 500,
+});
+const PROVIDER_ID_PATTERN = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu;
+export class BitwardenSecretsManagerStorageError extends CredentialStorageError {
+    constructor(code, message) {
+        super(code, message);
+        this.name = "BitwardenSecretsManagerStorageError";
+    }
+}
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseJson(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned malformed data.");
+    }
+}
+function parseProject(value) {
+    if (!isObject(value) ||
+        typeof value.id !== "string" ||
+        !PROVIDER_ID_PATTERN.test(value.id) ||
+        typeof value.organizationId !== "string" ||
+        !PROVIDER_ID_PATTERN.test(value.organizationId) ||
+        typeof value.name !== "string") {
+        throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned malformed project data.");
+    }
+    return { id: value.id, organizationId: value.organizationId, name: value.name };
+}
+function parseSecret(value, expectedProjectId) {
+    if (!isObject(value) ||
+        typeof value.id !== "string" ||
+        !PROVIDER_ID_PATTERN.test(value.id) ||
+        value.projectId !== expectedProjectId ||
+        typeof value.key !== "string" ||
+        typeof value.value !== "string" ||
+        Buffer.byteLength(value.value, "utf8") > MAX_CIPHERTEXT_BYTES) {
+        throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned malformed secret data.");
+    }
+    return { id: value.id, projectId: expectedProjectId, key: value.key, value: value.value };
+}
+function decodeBase64(value, expectedBytes) {
+    if (!/^[A-Za-z0-9+/]+={0,2}$/u.test(value)) {
+        throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned malformed encrypted profile data.");
+    }
+    const decoded = Buffer.from(value, "base64");
+    if ((expectedBytes !== undefined && decoded.length !== expectedBytes) || decoded.toString("base64") !== value) {
+        decoded.fill(0);
+        throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned malformed encrypted profile data.");
+    }
+    return decoded;
+}
+function parseDataKey(value) {
+    if (!value.startsWith(DATA_KEY_PREFIX)) {
+        throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned a malformed profile encryption key.");
+    }
+    return decodeBase64(value.slice(DATA_KEY_PREFIX.length), 32);
+}
+function encryptProfile(record, dataKey) {
+    let serialized = serializeCredentialProfileEnvelope(record);
+    const plaintext = Buffer.from(serialized, "utf8");
+    const iv = randomBytes(12);
+    try {
+        const cipher = createCipheriv("aes-256-gcm", dataKey, iv);
+        const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        try {
+            return `${CIPHERTEXT_PREFIX}${iv.toString("base64")}:${tag.toString("base64")}:${ciphertext.toString("base64")}`;
+        }
+        finally {
+            ciphertext.fill(0);
+            tag.fill(0);
+        }
+    }
+    finally {
+        serialized = "";
+        plaintext.fill(0);
+        iv.fill(0);
+    }
+}
+function decryptProfile(value, profile, dataKey) {
+    if (!value.startsWith(CIPHERTEXT_PREFIX) || Buffer.byteLength(value, "utf8") > MAX_CIPHERTEXT_BYTES) {
+        throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned malformed encrypted profile data.");
+    }
+    const encoded = value.slice(CIPHERTEXT_PREFIX.length).split(":");
+    if (encoded.length !== 3) {
+        throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned malformed encrypted profile data.");
+    }
+    const iv = decodeBase64(encoded[0] ?? "", 12);
+    const tag = decodeBase64(encoded[1] ?? "", 16);
+    const ciphertext = decodeBase64(encoded[2] ?? "");
+    let plaintext = Buffer.alloc(0);
+    let serialized = "";
+    try {
+        const decipher = createDecipheriv("aes-256-gcm", dataKey, iv);
+        decipher.setAuthTag(tag);
+        plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+        serialized = plaintext.toString("utf8");
+        return parseCredentialProfileEnvelope(serialized, profile);
+    }
+    catch (error) {
+        if (error instanceof BitwardenSecretsManagerStorageError)
+            throw error;
+        throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned malformed encrypted profile data.");
+    }
+    finally {
+        iv.fill(0);
+        tag.fill(0);
+        ciphertext.fill(0);
+        plaintext.fill(0);
+        serialized = "";
+    }
+}
+export async function runBitwardenSecretsManagerCommand(request) {
+    return runCredentialCliCommand({
+        executable: request.executable,
+        args: request.args,
+        authEnvironment: { name: "BWS_ACCESS_TOKEN", value: request.accessToken },
+        omitEnvironmentVariables: ["BW_SESSION"],
+        ...(request.signal ? { signal: request.signal } : {}),
+    });
+}
+export class BitwardenSecretsManagerCredentialStorage {
+    constructor(options) {
+        this.profiles = new Map();
+        this.lastSyncAt = 0;
+        if (options.coordinationFile.trim().length === 0) {
+            throw new TypeError("Bitwarden Secrets Manager requires a coordination file.");
+        }
+        this.coordinationFile = options.coordinationFile;
+        this.resolveTool = options.resolveTool ?? ensureToolWithDiagnostics;
+        this.runCommand = options.runCommand ?? runBitwardenSecretsManagerCommand;
+    }
+    async connect(accessToken, signal) {
+        this.lock();
+        const resolution = await this.resolveTool("bws", true);
+        if (resolution.status === "unavailable") {
+            throw new BitwardenSecretsManagerStorageError("provider_unavailable", `Bitwarden Secrets Manager CLI could not be provisioned (${resolution.failureCode}).`);
+        }
+        this.executable = resolution.path;
+        this.accessToken = accessToken;
+        try {
+            await this.reload(signal);
+        }
+        catch (error) {
+            this.lock();
+            throw error;
+        }
+    }
+    async refresh(signal) {
+        this.assertConnected();
+        if (Date.now() - this.lastSyncAt >= SYNC_FRESHNESS_MS)
+            await this.reload(signal);
+    }
+    async listProfiles() {
+        this.assertConnected();
+        return summarizeCredentialProfiles([...this.profiles.values()].map((profile) => profile.record));
+    }
+    async readProfile(profile) {
+        this.assertConnected();
+        const cached = this.profiles.get(profile);
+        if (!cached) {
+            throw new BitwardenSecretsManagerStorageError("profile_not_found", "Credential profile was not found.");
+        }
+        return structuredClone(cached.record);
+    }
+    async writeProfile(record, signal) {
+        validateCredentialProfileRecord(record);
+        this.assertConnected();
+        await this.withProviderCoordination(signal, async () => {
+            await this.reloadUnderCoordination(signal);
+            const { project } = this.assertConnected();
+            const dataKey = await this.ensureDataKeyUnderCoordination(signal);
+            let ciphertext = encryptProfile(record, dataKey);
+            try {
+                const existing = this.profiles.get(record.profile);
+                const key = `${CREDENTIAL_PROFILE_KEY_PREFIX}${record.profile}`;
+                const output = existing
+                    ? await this.runChecked([
+                        "secret",
+                        "edit",
+                        existing.id,
+                        "--key",
+                        key,
+                        "--value",
+                        ciphertext,
+                        "--note",
+                        PROFILE_NOTE,
+                        "--project-id",
+                        project.id,
+                    ], signal)
+                    : await this.runChecked(["secret", "create", key, ciphertext, project.id, "--note", PROFILE_NOTE], signal);
+                const stored = parseSecret(parseJson(output), project.id);
+                if (stored.key !== key || stored.value !== ciphertext) {
+                    throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned malformed profile data.");
+                }
+                this.profiles.set(record.profile, { id: stored.id, record: structuredClone(record) });
+                this.lastSyncAt = Date.now();
+            }
+            finally {
+                ciphertext = "";
+            }
+        });
+    }
+    async deleteProfile(profile, signal) {
+        this.assertConnected();
+        await this.withProviderCoordination(signal, async () => {
+            await this.reloadUnderCoordination(signal);
+            const cached = this.profiles.get(profile);
+            if (!cached) {
+                throw new BitwardenSecretsManagerStorageError("profile_not_found", "Credential profile was not found.");
+            }
+            await this.runChecked(["secret", "delete", cached.id], signal);
+            for (const variable of cached.record.variables)
+                variable.value = "";
+            this.profiles.delete(profile);
+            this.lastSyncAt = Date.now();
+        });
+    }
+    lock() {
+        this.executable = undefined;
+        this.accessToken = undefined;
+        this.project = undefined;
+        this.dataKey?.fill(0);
+        this.dataKey = undefined;
+        for (const cached of this.profiles.values()) {
+            for (const variable of cached.record.variables)
+                variable.value = "";
+        }
+        this.profiles.clear();
+        this.lastSyncAt = 0;
+    }
+    assertConnected() {
+        if (!this.executable || !this.accessToken || !this.project) {
+            throw new BitwardenSecretsManagerStorageError("not_connected", "Bitwarden is not connected.");
+        }
+        return { executable: this.executable, accessToken: this.accessToken, project: this.project };
+    }
+    async reload(signal) {
+        await this.withProviderCoordination(signal, () => this.reloadUnderCoordination(signal));
+    }
+    async reloadUnderCoordination(signal) {
+        const projectsValue = parseJson(await this.runChecked(["project", "list"], signal));
+        if (!Array.isArray(projectsValue) || projectsValue.length > MAX_PROVIDER_ITEMS) {
+            throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned an invalid project list.");
+        }
+        const matchingProjects = projectsValue.map(parseProject).filter((project) => project.name === PROJECT_NAME);
+        if (matchingProjects.length > 1) {
+            throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager contains duplicate Pi credential projects.");
+        }
+        const project = matchingProjects[0] ??
+            parseProject(parseJson(await this.runChecked(["project", "create", PROJECT_NAME], signal)));
+        if (project.name !== PROJECT_NAME) {
+            throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned the wrong credential project.");
+        }
+        this.project = project;
+        const secretsValue = parseJson(await this.runChecked(["secret", "list", project.id], signal));
+        if (!Array.isArray(secretsValue) || secretsValue.length > MAX_PROVIDER_ITEMS) {
+            throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned an invalid secret list.");
+        }
+        const secrets = secretsValue.map((secret) => parseSecret(secret, project.id));
+        const keySecrets = secrets.filter((secret) => secret.key === DATA_KEY_NAME);
+        if (keySecrets.length > 1) {
+            throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager contains duplicate Pi encryption keys.");
+        }
+        const nextKey = keySecrets[0] ? parseDataKey(keySecrets[0].value) : undefined;
+        const nextProfiles = new Map();
+        try {
+            for (const secret of secrets) {
+                if (!secret.key.startsWith(CREDENTIAL_PROFILE_KEY_PREFIX))
+                    continue;
+                if (!nextKey) {
+                    throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager profile encryption key is missing.");
+                }
+                const profile = secret.key.slice(CREDENTIAL_PROFILE_KEY_PREFIX.length);
+                try {
+                    validateCredentialProfileName(profile);
+                }
+                catch {
+                    throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned malformed profile data.");
+                }
+                if (nextProfiles.has(profile)) {
+                    throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager contains duplicate Pi credential profiles.");
+                }
+                nextProfiles.set(profile, { id: secret.id, record: decryptProfile(secret.value, profile, nextKey) });
+            }
+        }
+        catch (error) {
+            for (const cached of nextProfiles.values()) {
+                for (const variable of cached.record.variables)
+                    variable.value = "";
+            }
+            nextKey?.fill(0);
+            throw error;
+        }
+        this.dataKey?.fill(0);
+        this.dataKey = nextKey;
+        for (const cached of this.profiles.values()) {
+            for (const variable of cached.record.variables)
+                variable.value = "";
+        }
+        this.profiles.clear();
+        for (const [profile, cached] of nextProfiles)
+            this.profiles.set(profile, cached);
+        this.lastSyncAt = Date.now();
+    }
+    async ensureDataKeyUnderCoordination(signal) {
+        if (this.dataKey)
+            return this.dataKey;
+        const { project } = this.assertConnected();
+        const generated = randomBytes(32);
+        let serialized = `${DATA_KEY_PREFIX}${generated.toString("base64")}`;
+        try {
+            const stored = parseSecret(parseJson(await this.runChecked(["secret", "create", DATA_KEY_NAME, serialized, project.id, "--note", DATA_KEY_NOTE], signal)), project.id);
+            if (stored.key !== DATA_KEY_NAME || stored.value !== serialized) {
+                throw new BitwardenSecretsManagerStorageError("malformed_provider_data", "Bitwarden Secrets Manager returned a malformed profile encryption key.");
+            }
+            this.dataKey = Buffer.from(generated);
+            return this.dataKey;
+        }
+        finally {
+            generated.fill(0);
+            serialized = "";
+        }
+    }
+    async withProviderCoordination(signal, operation) {
+        signal?.throwIfAborted();
+        try {
+            return await withFileLock(this.coordinationFile, async () => {
+                signal?.throwIfAborted();
+                return operation();
+            }, PROVIDER_COORDINATION_LOCK_OPTIONS);
+        }
+        catch (error) {
+            if (error instanceof CredentialStorageError || signal?.aborted)
+                throw error;
+            throw new BitwardenSecretsManagerStorageError("provider_command_failed", "Bitwarden Secrets Manager coordination failed safely.");
+        }
+    }
+    async runChecked(args, signal) {
+        if (!this.executable || !this.accessToken) {
+            throw new BitwardenSecretsManagerStorageError("not_connected", "Bitwarden is not connected.");
+        }
+        const result = await this.runCommand({
+            executable: this.executable,
+            args,
+            accessToken: this.accessToken,
+            ...(signal ? { signal } : {}),
+        });
+        if (result.exitCode !== 0 ||
+            result.aborted === true ||
+            result.timedOut === true ||
+            result.outputLimitExceeded === true) {
+            throw new BitwardenSecretsManagerStorageError("provider_command_failed", "Bitwarden Secrets Manager command failed safely without exposing provider output.");
+        }
+        return result.stdout;
+    }
+}
+//# sourceMappingURL=bitwarden-secrets-manager-storage.js.map

package/dist/core/secrets/bitwarden-secrets-manager-storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitwarden-secrets-manager-storage.js","sourceRoot":"","sources":["../../../src/core/secrets/bitwarden-secrets-manager-storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAA4B,MAAM,8BAA8B,CAAC;AACnG,OAAO,EAA8B,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAmC,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACvG,OAAO,EAGN,sBAAsB,EAEtB,6BAA6B,EAC7B,+BAA+B,GAC/B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,6BAA6B,EAC7B,8BAA8B,EAC9B,kCAAkC,EAClC,2BAA2B,GAC3B,MAAM,kCAAkC,CAAC;AAE1C,MAAM,YAAY,GAAG,wBAAwB,CAAC;AAC9C,MAAM,aAAa,GAAG,sCAAsC,CAAC;AAC7D,MAAM,aAAa,GAAG,mCAAmC,CAAC;AAC1D,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAC/D,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAChD,MAAM,iBAAiB,GAAG,2BAA2B,CAAC;AACtD,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAC/B,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7C,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,kCAAkC,GAAoC,MAAM,CAAC,MAAM,CAAC;IACzF,OAAO,EAAE,EAAE;IACX,eAAe,EAAE,EAAE;IACnB,eAAe,EAAE,GAAG;CACpB,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,6EAA6E,CAAC;AAE1G,MAAM,OAAO,mCAAoC,SAAQ,sBAAsB;IAC9E,YAAY,IAAoC,EAAE,OAAe;QAChE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;IACnD,CAAC;CACD;AAuCD,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC/B,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,oDAAoD,CACpD,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,IACC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;QACxC,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;QAC/C,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAC7B,CAAC;QACF,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,4DAA4D,CAC5D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,iBAAyB;IAC7D,IACC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAC5B,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,SAAS,KAAK,iBAAiB;QACrC,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;QAC7B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,oBAAoB,EAC5D,CAAC;QACF,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,2DAA2D,CAC3D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AAC3F,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,aAAsB;IAC1D,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,sEAAsE,CACtE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,sEAAsE,CACtE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,wEAAwE,CACxE,CAAC;IACH,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B,EAAE,OAAe;IACvE,IAAI,UAAU,GAAG,kCAAkC,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAChC,IAAI,CAAC;YACJ,OAAO,GAAG,iBAAiB,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClH,CAAC;gBAAS,CAAC;YACV,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;IACF,CAAC;YAAS,CAAC;QACV,UAAU,GAAG,EAAE,CAAC;QAChB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACZ,CAAC;AACF,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,OAAe,EAAE,OAAe;IACtE,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,oBAAoB,EAAE,CAAC;QACrG,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,sEAAsE,CACtE,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,sEAAsE,CACtE,CAAC;IACH,CAAC;IACD,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC9D,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACzB,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC3E,UAAU,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,OAAO,8BAA8B,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,KAAK,YAAY,mCAAmC;YAAE,MAAM,KAAK,CAAC;QACtE,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,sEAAsE,CACtE,CAAC;IACH,CAAC;YAAS,CAAC;QACV,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACX,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,UAAU,GAAG,EAAE,CAAC;IACjB,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACtD,OAA8C;IAE9C,OAAO,uBAAuB,CAAC;QAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,eAAe,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,CAAC,WAAW,EAAE;QACzE,wBAAwB,EAAE,CAAC,YAAY,CAAC;QACxC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,wCAAwC;IAWpD,YAAY,OAAwD;QAPnD,aAAQ,GAAG,IAAI,GAAG,EAAuC,CAAC;QAKnE,eAAU,GAAG,CAAC,CAAC;QAGtB,IAAI,OAAO,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,yBAAyB,CAAC;QACpE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,iCAAiC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,WAAmB,EAAE,MAAoB;QACtD,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,UAAU,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACzC,MAAM,IAAI,mCAAmC,CAC5C,sBAAsB,EACtB,2DAA2D,UAAU,CAAC,WAAW,IAAI,CACrF,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC;QAClC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAoB;QACjC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB;YAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,YAAY;QACjB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,2BAA2B,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClG,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,OAAe;QAChC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,MAAM,IAAI,mCAAmC,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAA+B,EAAE,MAAoB;QACvE,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;YAClE,IAAI,UAAU,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnD,MAAM,GAAG,GAAG,GAAG,6BAA6B,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;gBAChE,MAAM,MAAM,GAAG,QAAQ;oBACtB,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CACrB;wBACC,QAAQ;wBACR,MAAM;wBACN,QAAQ,CAAC,EAAE;wBACX,OAAO;wBACP,GAAG;wBACH,SAAS;wBACT,UAAU;wBACV,QAAQ;wBACR,YAAY;wBACZ,cAAc;wBACd,OAAO,CAAC,EAAE;qBACV,EACD,MAAM,CACN;oBACF,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU,CACrB,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,EACzE,MAAM,CACN,CAAC;gBACJ,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;gBAC1D,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBACvD,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,4DAA4D,CAC5D,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACtF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,CAAC;oBAAS,CAAC;gBACV,UAAU,GAAG,EAAE,CAAC;YACjB,CAAC;QACF,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,MAAoB;QACxD,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;YACtD,MAAM,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,IAAI,mCAAmC,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;YACzG,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YAC/D,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YACpE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC,CAAC,CAAC;IACJ,CAAC;IAED,IAAI;QACH,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;IACrB,CAAC;IAEO,eAAe;QAKtB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5D,MAAM,IAAI,mCAAmC,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC9F,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAAoB;QACxC,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC;IACzF,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,MAAoB;QACzD,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;YAChF,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,6DAA6D,CAC7D,CAAC;QACH,CAAC;QACD,MAAM,gBAAgB,GAAG,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;QAC5G,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,sEAAsE,CACtE,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GACZ,gBAAgB,CAAC,CAAC,CAAC;YACnB,YAAY,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC7F,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACnC,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,kEAAkE,CAClE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,kBAAkB,EAAE,CAAC;YAC9E,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,4DAA4D,CAC5D,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9E,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC;QAC5E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,kEAAkE,CAClE,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuC,CAAC;QACpE,IAAI,CAAC;YACJ,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,6BAA6B,CAAC;oBAAE,SAAS;gBACpE,IAAI,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,8DAA8D,CAC9D,CAAC;gBACH,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,MAAM,CAAC,CAAC;gBACvE,IAAI,CAAC;oBACJ,6BAA6B,CAAC,OAAO,CAAC,CAAC;gBACxC,CAAC;gBAAC,MAAM,CAAC;oBACR,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,4DAA4D,CAC5D,CAAC;gBACH,CAAC;gBACD,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,sEAAsE,CACtE,CAAC;gBACH,CAAC;gBACD,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;YACtG,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC5C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS;oBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;YACrE,CAAC;YACD,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,KAAK,CAAC;QACb,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS;gBAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,YAAY;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjF,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,8BAA8B,CAAC,MAAoB;QAChE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC;QACtC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,UAAU,GAAG,GAAG,eAAe,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,WAAW,CACzB,SAAS,CACR,MAAM,IAAI,CAAC,UAAU,CACpB,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,EACpF,MAAM,CACN,CACD,EACD,OAAO,CAAC,EAAE,CACV,CAAC;YACF,IAAI,MAAM,CAAC,GAAG,KAAK,aAAa,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;gBACjE,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,wEAAwE,CACxE,CAAC;YACH,CAAC;YACD,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC,OAAO,CAAC;QACrB,CAAC;gBAAS,CAAC;YACV,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,UAAU,GAAG,EAAE,CAAC;QACjB,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,wBAAwB,CAAI,MAA+B,EAAE,SAA2B;QACrG,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,CAAC;YACJ,OAAO,MAAM,YAAY,CACxB,IAAI,CAAC,gBAAgB,EACrB,KAAK,IAAI,EAAE;gBACV,MAAM,EAAE,cAAc,EAAE,CAAC;gBACzB,OAAO,SAAS,EAAE,CAAC;YACpB,CAAC,EACD,kCAAkC,CAClC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,sBAAsB,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,KAAK,CAAC;YAC5E,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,uDAAuD,CACvD,CAAC;QACH,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,IAAc,EAAE,MAAoB;QAC5D,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,IAAI,mCAAmC,CAAC,eAAe,EAAE,6BAA6B,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;YACpC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI;YACJ,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IACC,MAAM,CAAC,QAAQ,KAAK,CAAC;YACrB,MAAM,CAAC,OAAO,KAAK,IAAI;YACvB,MAAM,CAAC,QAAQ,KAAK,IAAI;YACxB,MAAM,CAAC,mBAAmB,KAAK,IAAI,EAClC,CAAC;YACF,MAAM,IAAI,mCAAmC,CAC5C,yBAAyB,EACzB,mFAAmF,CACnF,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC;IACtB,CAAC;CACD","sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\nimport { ensureToolWithDiagnostics, type ManagedToolResolver } from \"../../utils/tools-manager.ts\";\nimport { type AtomicFileLockOptions, withFileLock } from \"../util/atomic-file.ts\";\nimport { type CredentialCliCommandResult, runCredentialCliCommand } from \"./credential-cli-command.ts\";\nimport {\n\ttype CredentialProfileRecord,\n\ttype CredentialProfileStorage,\n\tCredentialStorageError,\n\ttype StoredCredentialProfileSummary,\n\tvalidateCredentialProfileName,\n\tvalidateCredentialProfileRecord,\n} from \"./credential-manager.ts\";\nimport {\n\tCREDENTIAL_PROFILE_KEY_PREFIX,\n\tparseCredentialProfileEnvelope,\n\tserializeCredentialProfileEnvelope,\n\tsummarizeCredentialProfiles,\n} from \"./credential-profile-envelope.ts\";\n\nconst PROJECT_NAME = \"Pi Credential Profiles\";\nconst DATA_KEY_NAME = \"Pi credential store · encryption key\";\nconst DATA_KEY_NOTE = \"Pi-managed profile encryption key\";\nconst PROFILE_NOTE = \"Pi-managed encrypted credential profile\";\nconst DATA_KEY_PREFIX = \"pi-credential-key:v1:\";\nconst CIPHERTEXT_PREFIX = \"pi-credential-profile:v1:\";\nconst MAX_PROVIDER_ITEMS = 256;\nconst MAX_CIPHERTEXT_BYTES = 2 * 1024 * 1024;\nconst SYNC_FRESHNESS_MS = 30_000;\nconst PROVIDER_COORDINATION_LOCK_OPTIONS: Readonly<AtomicFileLockOptions> = Object.freeze({\n\tretries: 60,\n\tminRetryDelayMs: 50,\n\tmaxRetryDelayMs: 500,\n});\nconst PROVIDER_ID_PATTERN = /^[a-f0-9]{8}-[a-f0-9]{4}-[1-8][a-f0-9]{3}-[89ab][a-f0-9]{3}-[a-f0-9]{12}$/iu;\n\nexport class BitwardenSecretsManagerStorageError extends CredentialStorageError {\n\tconstructor(code: CredentialStorageError[\"code\"], message: string) {\n\t\tsuper(code, message);\n\t\tthis.name = \"BitwardenSecretsManagerStorageError\";\n\t}\n}\n\nexport interface BitwardenSecretsManagerCommandRequest {\n\texecutable: string;\n\targs: string[];\n\taccessToken: string;\n\tsignal?: AbortSignal;\n}\n\nexport type BitwardenSecretsManagerCommandResult = CredentialCliCommandResult;\n\nexport type BitwardenSecretsManagerCommandRunner = (\n\trequest: BitwardenSecretsManagerCommandRequest,\n) => Promise<BitwardenSecretsManagerCommandResult>;\n\nexport interface BitwardenSecretsManagerCredentialStorageOptions {\n\tcoordinationFile: string;\n\tresolveTool?: ManagedToolResolver;\n\trunCommand?: BitwardenSecretsManagerCommandRunner;\n}\n\ninterface SecretsManagerProject {\n\tid: string;\n\torganizationId: string;\n\tname: string;\n}\n\ninterface SecretsManagerSecret {\n\tid: string;\n\tprojectId: string;\n\tkey: string;\n\tvalue: string;\n}\n\ninterface CachedSecretsManagerProfile {\n\tid: string;\n\trecord: CredentialProfileRecord;\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction parseJson(value: string): unknown {\n\ttry {\n\t\treturn JSON.parse(value) as unknown;\n\t} catch {\n\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden Secrets Manager returned malformed data.\",\n\t\t);\n\t}\n}\n\nfunction parseProject(value: unknown): SecretsManagerProject {\n\tif (\n\t\t!isObject(value) ||\n\t\ttypeof value.id !== \"string\" ||\n\t\t!PROVIDER_ID_PATTERN.test(value.id) ||\n\t\ttypeof value.organizationId !== \"string\" ||\n\t\t!PROVIDER_ID_PATTERN.test(value.organizationId) ||\n\t\ttypeof value.name !== \"string\"\n\t) {\n\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden Secrets Manager returned malformed project data.\",\n\t\t);\n\t}\n\treturn { id: value.id, organizationId: value.organizationId, name: value.name };\n}\n\nfunction parseSecret(value: unknown, expectedProjectId: string): SecretsManagerSecret {\n\tif (\n\t\t!isObject(value) ||\n\t\ttypeof value.id !== \"string\" ||\n\t\t!PROVIDER_ID_PATTERN.test(value.id) ||\n\t\tvalue.projectId !== expectedProjectId ||\n\t\ttypeof value.key !== \"string\" ||\n\t\ttypeof value.value !== \"string\" ||\n\t\tBuffer.byteLength(value.value, \"utf8\") > MAX_CIPHERTEXT_BYTES\n\t) {\n\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden Secrets Manager returned malformed secret data.\",\n\t\t);\n\t}\n\treturn { id: value.id, projectId: expectedProjectId, key: value.key, value: value.value };\n}\n\nfunction decodeBase64(value: string, expectedBytes?: number): Buffer {\n\tif (!/^[A-Za-z0-9+/]+={0,2}$/u.test(value)) {\n\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden Secrets Manager returned malformed encrypted profile data.\",\n\t\t);\n\t}\n\tconst decoded = Buffer.from(value, \"base64\");\n\tif ((expectedBytes !== undefined && decoded.length !== expectedBytes) || decoded.toString(\"base64\") !== value) {\n\t\tdecoded.fill(0);\n\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden Secrets Manager returned malformed encrypted profile data.\",\n\t\t);\n\t}\n\treturn decoded;\n}\n\nfunction parseDataKey(value: string): Buffer {\n\tif (!value.startsWith(DATA_KEY_PREFIX)) {\n\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden Secrets Manager returned a malformed profile encryption key.\",\n\t\t);\n\t}\n\treturn decodeBase64(value.slice(DATA_KEY_PREFIX.length), 32);\n}\n\nfunction encryptProfile(record: CredentialProfileRecord, dataKey: Buffer): string {\n\tlet serialized = serializeCredentialProfileEnvelope(record);\n\tconst plaintext = Buffer.from(serialized, \"utf8\");\n\tconst iv = randomBytes(12);\n\ttry {\n\t\tconst cipher = createCipheriv(\"aes-256-gcm\", dataKey, iv);\n\t\tconst ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);\n\t\tconst tag = cipher.getAuthTag();\n\t\ttry {\n\t\t\treturn `${CIPHERTEXT_PREFIX}${iv.toString(\"base64\")}:${tag.toString(\"base64\")}:${ciphertext.toString(\"base64\")}`;\n\t\t} finally {\n\t\t\tciphertext.fill(0);\n\t\t\ttag.fill(0);\n\t\t}\n\t} finally {\n\t\tserialized = \"\";\n\t\tplaintext.fill(0);\n\t\tiv.fill(0);\n\t}\n}\n\nfunction decryptProfile(value: string, profile: string, dataKey: Buffer): CredentialProfileRecord {\n\tif (!value.startsWith(CIPHERTEXT_PREFIX) || Buffer.byteLength(value, \"utf8\") > MAX_CIPHERTEXT_BYTES) {\n\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden Secrets Manager returned malformed encrypted profile data.\",\n\t\t);\n\t}\n\tconst encoded = value.slice(CIPHERTEXT_PREFIX.length).split(\":\");\n\tif (encoded.length !== 3) {\n\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden Secrets Manager returned malformed encrypted profile data.\",\n\t\t);\n\t}\n\tconst iv = decodeBase64(encoded[0] ?? \"\", 12);\n\tconst tag = decodeBase64(encoded[1] ?? \"\", 16);\n\tconst ciphertext = decodeBase64(encoded[2] ?? \"\");\n\tlet plaintext = Buffer.alloc(0);\n\tlet serialized = \"\";\n\ttry {\n\t\tconst decipher = createDecipheriv(\"aes-256-gcm\", dataKey, iv);\n\t\tdecipher.setAuthTag(tag);\n\t\tplaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n\t\tserialized = plaintext.toString(\"utf8\");\n\t\treturn parseCredentialProfileEnvelope(serialized, profile);\n\t} catch (error) {\n\t\tif (error instanceof BitwardenSecretsManagerStorageError) throw error;\n\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\"malformed_provider_data\",\n\t\t\t\"Bitwarden Secrets Manager returned malformed encrypted profile data.\",\n\t\t);\n\t} finally {\n\t\tiv.fill(0);\n\t\ttag.fill(0);\n\t\tciphertext.fill(0);\n\t\tplaintext.fill(0);\n\t\tserialized = \"\";\n\t}\n}\n\nexport async function runBitwardenSecretsManagerCommand(\n\trequest: BitwardenSecretsManagerCommandRequest,\n): Promise<BitwardenSecretsManagerCommandResult> {\n\treturn runCredentialCliCommand({\n\t\texecutable: request.executable,\n\t\targs: request.args,\n\t\tauthEnvironment: { name: \"BWS_ACCESS_TOKEN\", value: request.accessToken },\n\t\tomitEnvironmentVariables: [\"BW_SESSION\"],\n\t\t...(request.signal ? { signal: request.signal } : {}),\n\t});\n}\n\nexport class BitwardenSecretsManagerCredentialStorage implements CredentialProfileStorage {\n\tprivate readonly coordinationFile: string;\n\tprivate readonly resolveTool: ManagedToolResolver;\n\tprivate readonly runCommand: BitwardenSecretsManagerCommandRunner;\n\tprivate readonly profiles = new Map<string, CachedSecretsManagerProfile>();\n\tprivate executable: string | undefined;\n\tprivate accessToken: string | undefined;\n\tprivate project: SecretsManagerProject | undefined;\n\tprivate dataKey: Buffer | undefined;\n\tprivate lastSyncAt = 0;\n\n\tconstructor(options: BitwardenSecretsManagerCredentialStorageOptions) {\n\t\tif (options.coordinationFile.trim().length === 0) {\n\t\t\tthrow new TypeError(\"Bitwarden Secrets Manager requires a coordination file.\");\n\t\t}\n\t\tthis.coordinationFile = options.coordinationFile;\n\t\tthis.resolveTool = options.resolveTool ?? ensureToolWithDiagnostics;\n\t\tthis.runCommand = options.runCommand ?? runBitwardenSecretsManagerCommand;\n\t}\n\n\tasync connect(accessToken: string, signal?: AbortSignal): Promise<void> {\n\t\tthis.lock();\n\t\tconst resolution = await this.resolveTool(\"bws\", true);\n\t\tif (resolution.status === \"unavailable\") {\n\t\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\t\"provider_unavailable\",\n\t\t\t\t`Bitwarden Secrets Manager CLI could not be provisioned (${resolution.failureCode}).`,\n\t\t\t);\n\t\t}\n\t\tthis.executable = resolution.path;\n\t\tthis.accessToken = accessToken;\n\t\ttry {\n\t\t\tawait this.reload(signal);\n\t\t} catch (error) {\n\t\t\tthis.lock();\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync refresh(signal?: AbortSignal): Promise<void> {\n\t\tthis.assertConnected();\n\t\tif (Date.now() - this.lastSyncAt >= SYNC_FRESHNESS_MS) await this.reload(signal);\n\t}\n\n\tasync listProfiles(): Promise<StoredCredentialProfileSummary[]> {\n\t\tthis.assertConnected();\n\t\treturn summarizeCredentialProfiles([...this.profiles.values()].map((profile) => profile.record));\n\t}\n\n\tasync readProfile(profile: string): Promise<CredentialProfileRecord> {\n\t\tthis.assertConnected();\n\t\tconst cached = this.profiles.get(profile);\n\t\tif (!cached) {\n\t\t\tthrow new BitwardenSecretsManagerStorageError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t}\n\t\treturn structuredClone(cached.record);\n\t}\n\n\tasync writeProfile(record: CredentialProfileRecord, signal?: AbortSignal): Promise<void> {\n\t\tvalidateCredentialProfileRecord(record);\n\t\tthis.assertConnected();\n\t\tawait this.withProviderCoordination(signal, async () => {\n\t\t\tawait this.reloadUnderCoordination(signal);\n\t\t\tconst { project } = this.assertConnected();\n\t\t\tconst dataKey = await this.ensureDataKeyUnderCoordination(signal);\n\t\t\tlet ciphertext = encryptProfile(record, dataKey);\n\t\t\ttry {\n\t\t\t\tconst existing = this.profiles.get(record.profile);\n\t\t\t\tconst key = `${CREDENTIAL_PROFILE_KEY_PREFIX}${record.profile}`;\n\t\t\t\tconst output = existing\n\t\t\t\t\t? await this.runChecked(\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t\"secret\",\n\t\t\t\t\t\t\t\t\"edit\",\n\t\t\t\t\t\t\t\texisting.id,\n\t\t\t\t\t\t\t\t\"--key\",\n\t\t\t\t\t\t\t\tkey,\n\t\t\t\t\t\t\t\t\"--value\",\n\t\t\t\t\t\t\t\tciphertext,\n\t\t\t\t\t\t\t\t\"--note\",\n\t\t\t\t\t\t\t\tPROFILE_NOTE,\n\t\t\t\t\t\t\t\t\"--project-id\",\n\t\t\t\t\t\t\t\tproject.id,\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t)\n\t\t\t\t\t: await this.runChecked(\n\t\t\t\t\t\t\t[\"secret\", \"create\", key, ciphertext, project.id, \"--note\", PROFILE_NOTE],\n\t\t\t\t\t\t\tsignal,\n\t\t\t\t\t\t);\n\t\t\t\tconst stored = parseSecret(parseJson(output), project.id);\n\t\t\t\tif (stored.key !== key || stored.value !== ciphertext) {\n\t\t\t\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\t\t\"Bitwarden Secrets Manager returned malformed profile data.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tthis.profiles.set(record.profile, { id: stored.id, record: structuredClone(record) });\n\t\t\t\tthis.lastSyncAt = Date.now();\n\t\t\t} finally {\n\t\t\t\tciphertext = \"\";\n\t\t\t}\n\t\t});\n\t}\n\n\tasync deleteProfile(profile: string, signal?: AbortSignal): Promise<void> {\n\t\tthis.assertConnected();\n\t\tawait this.withProviderCoordination(signal, async () => {\n\t\t\tawait this.reloadUnderCoordination(signal);\n\t\t\tconst cached = this.profiles.get(profile);\n\t\t\tif (!cached) {\n\t\t\t\tthrow new BitwardenSecretsManagerStorageError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t\t}\n\t\t\tawait this.runChecked([\"secret\", \"delete\", cached.id], signal);\n\t\t\tfor (const variable of cached.record.variables) variable.value = \"\";\n\t\t\tthis.profiles.delete(profile);\n\t\t\tthis.lastSyncAt = Date.now();\n\t\t});\n\t}\n\n\tlock(): void {\n\t\tthis.executable = undefined;\n\t\tthis.accessToken = undefined;\n\t\tthis.project = undefined;\n\t\tthis.dataKey?.fill(0);\n\t\tthis.dataKey = undefined;\n\t\tfor (const cached of this.profiles.values()) {\n\t\t\tfor (const variable of cached.record.variables) variable.value = \"\";\n\t\t}\n\t\tthis.profiles.clear();\n\t\tthis.lastSyncAt = 0;\n\t}\n\n\tprivate assertConnected(): {\n\t\texecutable: string;\n\t\taccessToken: string;\n\t\tproject: SecretsManagerProject;\n\t} {\n\t\tif (!this.executable || !this.accessToken || !this.project) {\n\t\t\tthrow new BitwardenSecretsManagerStorageError(\"not_connected\", \"Bitwarden is not connected.\");\n\t\t}\n\t\treturn { executable: this.executable, accessToken: this.accessToken, project: this.project };\n\t}\n\n\tprivate async reload(signal?: AbortSignal): Promise<void> {\n\t\tawait this.withProviderCoordination(signal, () => this.reloadUnderCoordination(signal));\n\t}\n\n\tprivate async reloadUnderCoordination(signal?: AbortSignal): Promise<void> {\n\t\tconst projectsValue = parseJson(await this.runChecked([\"project\", \"list\"], signal));\n\t\tif (!Array.isArray(projectsValue) || projectsValue.length > MAX_PROVIDER_ITEMS) {\n\t\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\"Bitwarden Secrets Manager returned an invalid project list.\",\n\t\t\t);\n\t\t}\n\t\tconst matchingProjects = projectsValue.map(parseProject).filter((project) => project.name === PROJECT_NAME);\n\t\tif (matchingProjects.length > 1) {\n\t\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\"Bitwarden Secrets Manager contains duplicate Pi credential projects.\",\n\t\t\t);\n\t\t}\n\t\tconst project =\n\t\t\tmatchingProjects[0] ??\n\t\t\tparseProject(parseJson(await this.runChecked([\"project\", \"create\", PROJECT_NAME], signal)));\n\t\tif (project.name !== PROJECT_NAME) {\n\t\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\"Bitwarden Secrets Manager returned the wrong credential project.\",\n\t\t\t);\n\t\t}\n\t\tthis.project = project;\n\t\tconst secretsValue = parseJson(await this.runChecked([\"secret\", \"list\", project.id], signal));\n\t\tif (!Array.isArray(secretsValue) || secretsValue.length > MAX_PROVIDER_ITEMS) {\n\t\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\"Bitwarden Secrets Manager returned an invalid secret list.\",\n\t\t\t);\n\t\t}\n\t\tconst secrets = secretsValue.map((secret) => parseSecret(secret, project.id));\n\t\tconst keySecrets = secrets.filter((secret) => secret.key === DATA_KEY_NAME);\n\t\tif (keySecrets.length > 1) {\n\t\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\"Bitwarden Secrets Manager contains duplicate Pi encryption keys.\",\n\t\t\t);\n\t\t}\n\t\tconst nextKey = keySecrets[0] ? parseDataKey(keySecrets[0].value) : undefined;\n\t\tconst nextProfiles = new Map<string, CachedSecretsManagerProfile>();\n\t\ttry {\n\t\t\tfor (const secret of secrets) {\n\t\t\t\tif (!secret.key.startsWith(CREDENTIAL_PROFILE_KEY_PREFIX)) continue;\n\t\t\t\tif (!nextKey) {\n\t\t\t\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\t\t\"Bitwarden Secrets Manager profile encryption key is missing.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tconst profile = secret.key.slice(CREDENTIAL_PROFILE_KEY_PREFIX.length);\n\t\t\t\ttry {\n\t\t\t\t\tvalidateCredentialProfileName(profile);\n\t\t\t\t} catch {\n\t\t\t\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\t\t\"Bitwarden Secrets Manager returned malformed profile data.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tif (nextProfiles.has(profile)) {\n\t\t\t\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\t\t\"Bitwarden Secrets Manager contains duplicate Pi credential profiles.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tnextProfiles.set(profile, { id: secret.id, record: decryptProfile(secret.value, profile, nextKey) });\n\t\t\t}\n\t\t} catch (error) {\n\t\t\tfor (const cached of nextProfiles.values()) {\n\t\t\t\tfor (const variable of cached.record.variables) variable.value = \"\";\n\t\t\t}\n\t\t\tnextKey?.fill(0);\n\t\t\tthrow error;\n\t\t}\n\t\tthis.dataKey?.fill(0);\n\t\tthis.dataKey = nextKey;\n\t\tfor (const cached of this.profiles.values()) {\n\t\t\tfor (const variable of cached.record.variables) variable.value = \"\";\n\t\t}\n\t\tthis.profiles.clear();\n\t\tfor (const [profile, cached] of nextProfiles) this.profiles.set(profile, cached);\n\t\tthis.lastSyncAt = Date.now();\n\t}\n\n\tprivate async ensureDataKeyUnderCoordination(signal?: AbortSignal): Promise<Buffer> {\n\t\tif (this.dataKey) return this.dataKey;\n\t\tconst { project } = this.assertConnected();\n\t\tconst generated = randomBytes(32);\n\t\tlet serialized = `${DATA_KEY_PREFIX}${generated.toString(\"base64\")}`;\n\t\ttry {\n\t\t\tconst stored = parseSecret(\n\t\t\t\tparseJson(\n\t\t\t\t\tawait this.runChecked(\n\t\t\t\t\t\t[\"secret\", \"create\", DATA_KEY_NAME, serialized, project.id, \"--note\", DATA_KEY_NOTE],\n\t\t\t\t\t\tsignal,\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t\tproject.id,\n\t\t\t);\n\t\t\tif (stored.key !== DATA_KEY_NAME || stored.value !== serialized) {\n\t\t\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\t\t\"malformed_provider_data\",\n\t\t\t\t\t\"Bitwarden Secrets Manager returned a malformed profile encryption key.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tthis.dataKey = Buffer.from(generated);\n\t\t\treturn this.dataKey;\n\t\t} finally {\n\t\t\tgenerated.fill(0);\n\t\t\tserialized = \"\";\n\t\t}\n\t}\n\n\tprivate async withProviderCoordination<T>(signal: AbortSignal | undefined, operation: () => Promise<T>): Promise<T> {\n\t\tsignal?.throwIfAborted();\n\t\ttry {\n\t\t\treturn await withFileLock(\n\t\t\t\tthis.coordinationFile,\n\t\t\t\tasync () => {\n\t\t\t\t\tsignal?.throwIfAborted();\n\t\t\t\t\treturn operation();\n\t\t\t\t},\n\t\t\t\tPROVIDER_COORDINATION_LOCK_OPTIONS,\n\t\t\t);\n\t\t} catch (error) {\n\t\t\tif (error instanceof CredentialStorageError || signal?.aborted) throw error;\n\t\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\t\"provider_command_failed\",\n\t\t\t\t\"Bitwarden Secrets Manager coordination failed safely.\",\n\t\t\t);\n\t\t}\n\t}\n\n\tprivate async runChecked(args: string[], signal?: AbortSignal): Promise<string> {\n\t\tif (!this.executable || !this.accessToken) {\n\t\t\tthrow new BitwardenSecretsManagerStorageError(\"not_connected\", \"Bitwarden is not connected.\");\n\t\t}\n\t\tconst result = await this.runCommand({\n\t\t\texecutable: this.executable,\n\t\t\targs,\n\t\t\taccessToken: this.accessToken,\n\t\t\t...(signal ? { signal } : {}),\n\t\t});\n\t\tif (\n\t\t\tresult.exitCode !== 0 ||\n\t\t\tresult.aborted === true ||\n\t\t\tresult.timedOut === true ||\n\t\t\tresult.outputLimitExceeded === true\n\t\t) {\n\t\t\tthrow new BitwardenSecretsManagerStorageError(\n\t\t\t\t\"provider_command_failed\",\n\t\t\t\t\"Bitwarden Secrets Manager command failed safely without exposing provider output.\",\n\t\t\t);\n\t\t}\n\t\treturn result.stdout;\n\t}\n}\n"]}

package/dist/core/secrets/credential-cli-command.d.ts

@@ -0,0 +1,22 @@
+export interface CredentialCliCommandRequest {
+    executable: string;
+    args: string[];
+    input?: string;
+    authEnvironment: {
+        name: "BWS_ACCESS_TOKEN" | "BW_SESSION";
+        value: string;
+    };
+    omitEnvironmentVariables?: readonly string[];
+    signal?: AbortSignal;
+}
+export interface CredentialCliCommandResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    aborted?: boolean;
+    timedOut?: boolean;
+    outputLimitExceeded?: boolean;
+}
+/** Shared bounded process boundary for Bitwarden provider adapters. */
+export declare function runCredentialCliCommand(request: CredentialCliCommandRequest): Promise<CredentialCliCommandResult>;
+//# sourceMappingURL=credential-cli-command.d.ts.map

package/dist/core/secrets/credential-cli-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-cli-command.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/credential-cli-command.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,2BAA2B;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,EAAE;QAAE,IAAI,EAAE,kBAAkB,GAAG,YAAY,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5E,wBAAwB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,0BAA0B;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAkBD,uEAAuE;AACvE,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CAwDrC"}

package/dist/core/secrets/credential-cli-command.js

@@ -0,0 +1,82 @@
+import { spawnProcess, waitForChildProcessWithTermination } from "../../utils/child-process.js";
+const MAX_COMMAND_OUTPUT_BYTES = 4 * 1024 * 1024;
+const COMMAND_TIMEOUT_MS = 30_000;
+function appendBounded(current, chunk) {
+    const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+    if (Buffer.byteLength(current, "utf8") + Buffer.byteLength(text, "utf8") <= MAX_COMMAND_OUTPUT_BYTES) {
+        return { value: current + text, exceeded: false };
+    }
+    return { value: current, exceeded: true };
+}
+function combineAbortSignal(source, controller) {
+    if (!source)
+        return () => { };
+    const abort = () => controller.abort();
+    if (source.aborted)
+        abort();
+    else
+        source.addEventListener("abort", abort, { once: true });
+    return () => source.removeEventListener("abort", abort);
+}
+/** Shared bounded process boundary for Bitwarden provider adapters. */
+export async function runCredentialCliCommand(request) {
+    const controller = new AbortController();
+    const detachAbort = combineAbortSignal(request.signal, controller);
+    let stdout = "";
+    let stderr = "";
+    let outputLimitExceeded = false;
+    let child;
+    try {
+        const environment = {
+            ...process.env,
+            [request.authEnvironment.name]: request.authEnvironment.value,
+            NO_COLOR: "1",
+        };
+        for (const name of request.omitEnvironmentVariables ?? [])
+            delete environment[name];
+        child = spawnProcess(request.executable, request.args, {
+            env: environment,
+            stdio: ["pipe", "pipe", "pipe"],
+            windowsHide: true,
+        });
+        child.stdout?.on("data", (chunk) => {
+            const appended = appendBounded(stdout, chunk);
+            stdout = appended.value;
+            if (appended.exceeded) {
+                outputLimitExceeded = true;
+                controller.abort();
+            }
+        });
+        child.stderr?.on("data", (chunk) => {
+            const appended = appendBounded(stderr, chunk);
+            stderr = appended.value;
+            if (appended.exceeded) {
+                outputLimitExceeded = true;
+                controller.abort();
+            }
+        });
+        child.stdin?.end(request.input);
+        const terminal = await waitForChildProcessWithTermination(child, {
+            signal: controller.signal,
+            timeoutMs: COMMAND_TIMEOUT_MS,
+            killGraceMs: 2_000,
+        });
+        return {
+            exitCode: terminal.code ?? 1,
+            stdout,
+            stderr,
+            ...(terminal.reason === "aborted" ? { aborted: true } : {}),
+            ...(terminal.reason === "timeout" ? { timedOut: true } : {}),
+            ...(outputLimitExceeded ? { outputLimitExceeded: true } : {}),
+        };
+    }
+    catch {
+        return { exitCode: 1, stdout: "", stderr: "" };
+    }
+    finally {
+        detachAbort();
+        stdout = "";
+        stderr = "";
+    }
+}
+//# sourceMappingURL=credential-cli-command.js.map

package/dist/core/secrets/credential-cli-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-cli-command.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-cli-command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,kCAAkC,EAAE,MAAM,8BAA8B,CAAC;AAEhG,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACjD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAoBlC,SAAS,aAAa,CAAC,OAAe,EAAE,KAAsB;IAC7D,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,wBAAwB,EAAE,CAAC;QACtG,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA+B,EAAE,UAA2B;IACvF,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IACvC,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,EAAE,CAAC;;QACvB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAoC;IAEpC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,mBAAmB,GAAG,KAAK,CAAC;IAChC,IAAI,KAAmB,CAAC;IACxB,IAAI,CAAC;QACJ,MAAM,WAAW,GAAG;YACnB,GAAG,OAAO,CAAC,GAAG;YACd,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,KAAK;YAC7D,QAAQ,EAAE,GAAG;SACb,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,wBAAwB,IAAI,EAAE;YAAE,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;QACpF,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE;YACtD,GAAG,EAAE,WAAW;YAChB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAC/B,WAAW,EAAE,IAAI;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9C,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC;YACxB,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,mBAAmB,GAAG,IAAI,CAAC;gBAC3B,UAAU,CAAC,KAAK,EAAE,CAAC;YACpB,CAAC;QACF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAC9C,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC;YACxB,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,mBAAmB,GAAG,IAAI,CAAC;gBAC3B,UAAU,CAAC,KAAK,EAAE,CAAC;YACpB,CAAC;QACF,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,kCAAkC,CAAC,KAAK,EAAE;YAChE,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,SAAS,EAAE,kBAAkB;YAC7B,WAAW,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,OAAO;YACN,QAAQ,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC;YAC5B,MAAM;YACN,MAAM;YACN,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAChD,CAAC;YAAS,CAAC;QACV,WAAW,EAAE,CAAC;QACd,MAAM,GAAG,EAAE,CAAC;QACZ,MAAM,GAAG,EAAE,CAAC;IACb,CAAC;AACF,CAAC","sourcesContent":["import type { ChildProcess } from \"node:child_process\";\nimport { spawnProcess, waitForChildProcessWithTermination } from \"../../utils/child-process.ts\";\n\nconst MAX_COMMAND_OUTPUT_BYTES = 4 * 1024 * 1024;\nconst COMMAND_TIMEOUT_MS = 30_000;\n\nexport interface CredentialCliCommandRequest {\n\texecutable: string;\n\targs: string[];\n\tinput?: string;\n\tauthEnvironment: { name: \"BWS_ACCESS_TOKEN\" | \"BW_SESSION\"; value: string };\n\tomitEnvironmentVariables?: readonly string[];\n\tsignal?: AbortSignal;\n}\n\nexport interface CredentialCliCommandResult {\n\texitCode: number;\n\tstdout: string;\n\tstderr: string;\n\taborted?: boolean;\n\ttimedOut?: boolean;\n\toutputLimitExceeded?: boolean;\n}\n\nfunction appendBounded(current: string, chunk: Buffer | string): { value: string; exceeded: boolean } {\n\tconst text = typeof chunk === \"string\" ? chunk : chunk.toString(\"utf8\");\n\tif (Buffer.byteLength(current, \"utf8\") + Buffer.byteLength(text, \"utf8\") <= MAX_COMMAND_OUTPUT_BYTES) {\n\t\treturn { value: current + text, exceeded: false };\n\t}\n\treturn { value: current, exceeded: true };\n}\n\nfunction combineAbortSignal(source: AbortSignal | undefined, controller: AbortController): () => void {\n\tif (!source) return () => {};\n\tconst abort = () => controller.abort();\n\tif (source.aborted) abort();\n\telse source.addEventListener(\"abort\", abort, { once: true });\n\treturn () => source.removeEventListener(\"abort\", abort);\n}\n\n/** Shared bounded process boundary for Bitwarden provider adapters. */\nexport async function runCredentialCliCommand(\n\trequest: CredentialCliCommandRequest,\n): Promise<CredentialCliCommandResult> {\n\tconst controller = new AbortController();\n\tconst detachAbort = combineAbortSignal(request.signal, controller);\n\tlet stdout = \"\";\n\tlet stderr = \"\";\n\tlet outputLimitExceeded = false;\n\tlet child: ChildProcess;\n\ttry {\n\t\tconst environment = {\n\t\t\t...process.env,\n\t\t\t[request.authEnvironment.name]: request.authEnvironment.value,\n\t\t\tNO_COLOR: \"1\",\n\t\t};\n\t\tfor (const name of request.omitEnvironmentVariables ?? []) delete environment[name];\n\t\tchild = spawnProcess(request.executable, request.args, {\n\t\t\tenv: environment,\n\t\t\tstdio: [\"pipe\", \"pipe\", \"pipe\"],\n\t\t\twindowsHide: true,\n\t\t});\n\t\tchild.stdout?.on(\"data\", (chunk: Buffer | string) => {\n\t\t\tconst appended = appendBounded(stdout, chunk);\n\t\t\tstdout = appended.value;\n\t\t\tif (appended.exceeded) {\n\t\t\t\toutputLimitExceeded = true;\n\t\t\t\tcontroller.abort();\n\t\t\t}\n\t\t});\n\t\tchild.stderr?.on(\"data\", (chunk: Buffer | string) => {\n\t\t\tconst appended = appendBounded(stderr, chunk);\n\t\t\tstderr = appended.value;\n\t\t\tif (appended.exceeded) {\n\t\t\t\toutputLimitExceeded = true;\n\t\t\t\tcontroller.abort();\n\t\t\t}\n\t\t});\n\t\tchild.stdin?.end(request.input);\n\t\tconst terminal = await waitForChildProcessWithTermination(child, {\n\t\t\tsignal: controller.signal,\n\t\t\ttimeoutMs: COMMAND_TIMEOUT_MS,\n\t\t\tkillGraceMs: 2_000,\n\t\t});\n\t\treturn {\n\t\t\texitCode: terminal.code ?? 1,\n\t\t\tstdout,\n\t\t\tstderr,\n\t\t\t...(terminal.reason === \"aborted\" ? { aborted: true } : {}),\n\t\t\t...(terminal.reason === \"timeout\" ? { timedOut: true } : {}),\n\t\t\t...(outputLimitExceeded ? { outputLimitExceeded: true } : {}),\n\t\t};\n\t} catch {\n\t\treturn { exitCode: 1, stdout: \"\", stderr: \"\" };\n\t} finally {\n\t\tdetachAbort();\n\t\tstdout = \"\";\n\t\tstderr = \"\";\n\t}\n}\n"]}

package/dist/core/secrets/credential-exposure-guard.d.ts

@@ -9,5 +9,5 @@ export declare function isProtectedCredentialPath(rawPath: string, cwd: string,
 /** Stable model-facing refusal for direct inspection/mutation of credential material. */
 export declare function credentialToolBlockReason(toolName: string, args: unknown, cwd: string, boundary?: CredentialExposureBoundary): string | undefined;
 /** Apply the same path refusal and output redaction to foreground, extension, scout, and lane tools. */
-export declare function wrapToolWithCredentialExposureGuard<TParameters extends TSchema, TDetails>(tool: AgentTool<TParameters, TDetails>, _cwd: string, boundary?: CredentialExposureBoundary): AgentTool<TParameters, TDetails>;
+export declare function wrapToolWithCredentialExposureGuard<TParameters extends TSchema, TDetails>(tool: AgentTool<TParameters, TDetails>, cwd: string, boundary?: CredentialExposureBoundary): AgentTool<TParameters, TDetails>;
 //# sourceMappingURL=credential-exposure-guard.d.ts.map

package/dist/core/secrets/credential-exposure-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-exposure-guard.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/credential-exposure-guard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,SAAS,EAAiD,MAAM,2BAA2B,CAAC;AAC1G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAgCvC,MAAM,WAAW,0BAA0B;IAC1C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAWD,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAgCT;AAyHD,yFAAyF;AACzF,wBAAgB,yBAAyB,CACxC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,0BAA0B,GACnC,MAAM,GAAG,SAAS,CAwDpB;AAuCD,wGAAwG;AACxG,wBAAgB,mCAAmC,CAAC,WAAW,SAAS,OAAO,EAAE,QAAQ,EACxF,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,EACtC,IAAI,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,0BAA0B,GACnC,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,CAyBlC"}
+{"version":3,"file":"credential-exposure-guard.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/credential-exposure-guard.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,SAAS,EAAiD,MAAM,2BAA2B,CAAC;AAC1G,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAgCvC,MAAM,WAAW,0BAA0B;IAC1C,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACzC;AAWD,wBAAgB,yBAAyB,CACxC,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,0BAA0B,GACnC,OAAO,CAgCT;AAyHD,yFAAyF;AACzF,wBAAgB,yBAAyB,CACxC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,0BAA0B,GACnC,MAAM,GAAG,SAAS,CAwDpB;AAuCD,wGAAwG;AACxG,wBAAgB,mCAAmC,CAAC,WAAW,SAAS,OAAO,EAAE,QAAQ,EACxF,IAAI,EAAE,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,EACtC,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,0BAA0B,GACnC,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,CAkClC"}

package/dist/core/secrets/credential-exposure-guard.js

@@ -275,10 +275,14 @@ function redactStructuredDetails(value, redact, budget, depth = 0) {
     return Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, redactStructuredDetails(entry, redact, budget, depth + 1)]));
 }
 /** Apply the same path refusal and output redaction to foreground, extension, scout, and lane tools. */
-export function wrapToolWithCredentialExposureGuard(tool, _cwd, boundary) {
+export function wrapToolWithCredentialExposureGuard(tool, cwd, boundary) {
     return {
         ...tool,
         async execute(toolCallId, params, signal, onUpdate) {
+            const blockReason = credentialToolBlockReason(tool.name, params, cwd, boundary);
+            if (blockReason) {
+                throw new AgentToolExecutionError(blockReason, "credential_access_blocked", "credential-access-blocked", "tool_failure");
+            }
             const safeUpdate = onUpdate
                 ? (partial) => {
                     onUpdate(redactResult(partial, boundary));