@caupulican/pi-adaptative 0.93.12 → 0.93.13

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (139) hide show
  1. package/CHANGELOG.md +13 -0
  2. package/dist/core/agent-paths.d.ts +6 -0
  3. package/dist/core/agent-paths.d.ts.map +1 -1
  4. package/dist/core/agent-paths.js +15 -0
  5. package/dist/core/agent-paths.js.map +1 -1
  6. package/dist/core/agent-session.d.ts.map +1 -1
  7. package/dist/core/agent-session.js +2 -0
  8. package/dist/core/agent-session.js.map +1 -1
  9. package/dist/core/background-lane-controller.d.ts +2 -0
  10. package/dist/core/background-lane-controller.d.ts.map +1 -1
  11. package/dist/core/background-lane-controller.js +3 -0
  12. package/dist/core/background-lane-controller.js.map +1 -1
  13. package/dist/core/background-tool-task-controller.d.ts +4 -0
  14. package/dist/core/background-tool-task-controller.d.ts.map +1 -1
  15. package/dist/core/background-tool-task-controller.js +22 -19
  16. package/dist/core/background-tool-task-controller.js.map +1 -1
  17. package/dist/core/delegation/worker-agent-control-coordinator.d.ts +3 -1
  18. package/dist/core/delegation/worker-agent-control-coordinator.d.ts.map +1 -1
  19. package/dist/core/delegation/worker-agent-control-coordinator.js +8 -0
  20. package/dist/core/delegation/worker-agent-control-coordinator.js.map +1 -1
  21. package/dist/core/delegation/worker-attempt-executor.d.ts +2 -1
  22. package/dist/core/delegation/worker-attempt-executor.d.ts.map +1 -1
  23. package/dist/core/delegation/worker-attempt-executor.js +14 -1
  24. package/dist/core/delegation/worker-attempt-executor.js.map +1 -1
  25. package/dist/core/delegation/worker-claim.d.ts +4 -1
  26. package/dist/core/delegation/worker-claim.d.ts.map +1 -1
  27. package/dist/core/delegation/worker-claim.js +20 -2
  28. package/dist/core/delegation/worker-claim.js.map +1 -1
  29. package/dist/core/delegation/worker-delegation-controller.d.ts.map +1 -1
  30. package/dist/core/delegation/worker-delegation-controller.js +2 -0
  31. package/dist/core/delegation/worker-delegation-controller.js.map +1 -1
  32. package/dist/core/delegation/worker-lifecycle.d.ts +1 -0
  33. package/dist/core/delegation/worker-lifecycle.d.ts.map +1 -1
  34. package/dist/core/delegation/worker-lifecycle.js +3 -0
  35. package/dist/core/delegation/worker-lifecycle.js.map +1 -1
  36. package/dist/core/delegation/worker-runner.d.ts.map +1 -1
  37. package/dist/core/delegation/worker-runner.js +15 -9
  38. package/dist/core/delegation/worker-runner.js.map +1 -1
  39. package/dist/core/delegation/worker-terminal-output-artifact.d.ts +14 -0
  40. package/dist/core/delegation/worker-terminal-output-artifact.d.ts.map +1 -0
  41. package/dist/core/delegation/worker-terminal-output-artifact.js +49 -0
  42. package/dist/core/delegation/worker-terminal-output-artifact.js.map +1 -0
  43. package/dist/core/foreground-terminal-handoff-controller.d.ts +3 -0
  44. package/dist/core/foreground-terminal-handoff-controller.d.ts.map +1 -1
  45. package/dist/core/foreground-terminal-handoff-controller.js +6 -0
  46. package/dist/core/foreground-terminal-handoff-controller.js.map +1 -1
  47. package/dist/core/goals/goal-session-controller.d.ts +2 -2
  48. package/dist/core/goals/goal-session-controller.d.ts.map +1 -1
  49. package/dist/core/goals/goal-session-controller.js +2 -11
  50. package/dist/core/goals/goal-session-controller.js.map +1 -1
  51. package/dist/core/orchestration/contracts.d.ts +2 -0
  52. package/dist/core/orchestration/contracts.d.ts.map +1 -1
  53. package/dist/core/orchestration/contracts.js +3 -0
  54. package/dist/core/orchestration/contracts.js.map +1 -1
  55. package/dist/core/orchestration/task-runtime-codecs.d.ts.map +1 -1
  56. package/dist/core/orchestration/task-runtime-codecs.js +11 -2
  57. package/dist/core/orchestration/task-runtime-codecs.js.map +1 -1
  58. package/dist/core/orchestration/worker-result-adapter.d.ts +2 -1
  59. package/dist/core/orchestration/worker-result-adapter.d.ts.map +1 -1
  60. package/dist/core/orchestration/worker-result-adapter.js +41 -7
  61. package/dist/core/orchestration/worker-result-adapter.js.map +1 -1
  62. package/dist/core/runtime-builder.d.ts +5 -2
  63. package/dist/core/runtime-builder.d.ts.map +1 -1
  64. package/dist/core/runtime-builder.js +26 -8
  65. package/dist/core/runtime-builder.js.map +1 -1
  66. package/dist/core/secrets/bitwarden-credential-storage-router.d.ts +22 -0
  67. package/dist/core/secrets/bitwarden-credential-storage-router.d.ts.map +1 -0
  68. package/dist/core/secrets/bitwarden-credential-storage-router.js +59 -0
  69. package/dist/core/secrets/bitwarden-credential-storage-router.js.map +1 -0
  70. package/dist/core/secrets/bitwarden-credential-storage.d.ts +2 -8
  71. package/dist/core/secrets/bitwarden-credential-storage.d.ts.map +1 -1
  72. package/dist/core/secrets/bitwarden-credential-storage.js +23 -134
  73. package/dist/core/secrets/bitwarden-credential-storage.js.map +1 -1
  74. package/dist/core/secrets/bitwarden-secrets-manager-storage.d.ts +46 -0
  75. package/dist/core/secrets/bitwarden-secrets-manager-storage.d.ts.map +1 -0
  76. package/dist/core/secrets/bitwarden-secrets-manager-storage.js +379 -0
  77. package/dist/core/secrets/bitwarden-secrets-manager-storage.js.map +1 -0
  78. package/dist/core/secrets/credential-cli-command.d.ts +22 -0
  79. package/dist/core/secrets/credential-cli-command.d.ts.map +1 -0
  80. package/dist/core/secrets/credential-cli-command.js +82 -0
  81. package/dist/core/secrets/credential-cli-command.js.map +1 -0
  82. package/dist/core/secrets/credential-exposure-guard.d.ts +1 -1
  83. package/dist/core/secrets/credential-exposure-guard.d.ts.map +1 -1
  84. package/dist/core/secrets/credential-exposure-guard.js +5 -1
  85. package/dist/core/secrets/credential-exposure-guard.js.map +1 -1
  86. package/dist/core/secrets/credential-machine-session.d.ts +13 -0
  87. package/dist/core/secrets/credential-machine-session.d.ts.map +1 -0
  88. package/dist/core/secrets/credential-machine-session.js +139 -0
  89. package/dist/core/secrets/credential-machine-session.js.map +1 -0
  90. package/dist/core/secrets/credential-manager.d.ts +11 -1
  91. package/dist/core/secrets/credential-manager.d.ts.map +1 -1
  92. package/dist/core/secrets/credential-manager.js +44 -9
  93. package/dist/core/secrets/credential-manager.js.map +1 -1
  94. package/dist/core/secrets/credential-profile-envelope.d.ts +10 -0
  95. package/dist/core/secrets/credential-profile-envelope.d.ts.map +1 -0
  96. package/dist/core/secrets/credential-profile-envelope.js +78 -0
  97. package/dist/core/secrets/credential-profile-envelope.js.map +1 -0
  98. package/dist/core/secrets/credential-session-connection.d.ts.map +1 -1
  99. package/dist/core/secrets/credential-session-connection.js +2 -1
  100. package/dist/core/secrets/credential-session-connection.js.map +1 -1
  101. package/dist/core/secrets/credential-source-discovery.d.ts +7 -3
  102. package/dist/core/secrets/credential-source-discovery.d.ts.map +1 -1
  103. package/dist/core/secrets/credential-source-discovery.js +48 -9
  104. package/dist/core/secrets/credential-source-discovery.js.map +1 -1
  105. package/dist/core/tools/delegate-status.d.ts +4 -0
  106. package/dist/core/tools/delegate-status.d.ts.map +1 -1
  107. package/dist/core/tools/delegate-status.js +20 -4
  108. package/dist/core/tools/delegate-status.js.map +1 -1
  109. package/dist/core/tools/goal.d.ts +2 -2
  110. package/dist/core/tools/goal.d.ts.map +1 -1
  111. package/dist/core/tools/goal.js +30 -11
  112. package/dist/core/tools/goal.js.map +1 -1
  113. package/dist/core/tools/secret-store.d.ts.map +1 -1
  114. package/dist/core/tools/secret-store.js +6 -15
  115. package/dist/core/tools/secret-store.js.map +1 -1
  116. package/dist/core/tools/tool-task.d.ts.map +1 -1
  117. package/dist/core/tools/tool-task.js +6 -3
  118. package/dist/core/tools/tool-task.js.map +1 -1
  119. package/dist/core/util/bounded-value.d.ts +2 -0
  120. package/dist/core/util/bounded-value.d.ts.map +1 -1
  121. package/dist/core/util/bounded-value.js +13 -0
  122. package/dist/core/util/bounded-value.js.map +1 -1
  123. package/dist/index.d.ts +3 -1
  124. package/dist/index.d.ts.map +1 -1
  125. package/dist/index.js +2 -0
  126. package/dist/index.js.map +1 -1
  127. package/dist/utils/tools-manager.d.ts +2 -1
  128. package/dist/utils/tools-manager.d.ts.map +1 -1
  129. package/dist/utils/tools-manager.js +29 -0
  130. package/dist/utils/tools-manager.js.map +1 -1
  131. package/examples/extensions/custom-provider-anthropic/package-lock.json +2 -2
  132. package/examples/extensions/custom-provider-anthropic/package.json +1 -1
  133. package/examples/extensions/custom-provider-gitlab-duo/package.json +1 -1
  134. package/examples/extensions/sandbox/package-lock.json +2 -2
  135. package/examples/extensions/sandbox/package.json +1 -1
  136. package/examples/extensions/with-deps/package-lock.json +2 -2
  137. package/examples/extensions/with-deps/package.json +1 -1
  138. package/npm-shrinkwrap.json +12 -12
  139. package/package.json +4 -4
package/dist/core/secrets/credential-manager.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"credential-manager.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,eAAe,GAAG,8BAA8B,CAAC;AACvD,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAC3D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAcxC,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAGhD,YAAY,IAAgC,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AASD,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAGhD,YAAY,IAAgC,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAgFD,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC5D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAC1E,MAAM,IAAI,sBAAsB,CAC/B,iBAAiB,EACjB,iGAAiG,CACjG,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,WAA+B;IAC5E,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,IACC,WAAW,CAAC,MAAM,KAAK,CAAC;QACxB,WAAW,CAAC,MAAM,GAAG,qBAAqB;QAC1C,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EACzB,CAAC;QACF,MAAM,IAAI,sBAAsB,CAC/B,qBAAqB,EACrB,oFAAoF,CACpF,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAmC;IACnE,IACC,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1B,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG;QAC3B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC9B,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,0CAA0C,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAA+B;IAC9E,6BAA6B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,6BAA6B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACrF,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,mDAAmD,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC;YACJ,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1C,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,gDAAgD,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,sBAAsB,CAC/B,yBAAyB,EACzB,kDAAkD,CAClD,CAAC;QACH,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,IACC,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC/B,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,oBAAoB;QAChD,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM;QAC9D,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC/D,CAAC;QACF,MAAM,IAAI,sBAAsB,CAC/B,yBAAyB,EACzB,uDAAuD,CACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC7C,IACC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC9B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QACzB,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,qBAAqB,EAC5D,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,YAAY,KAAK,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,QAAQ,CAAC;IACjB,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA8B;IACvD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,sBAAsB,CAC9B,SAAoD,EACpD,OAAe,EACf,eAAoC;IAEpC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAC1E,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,sBAAsB,CAC/B,gBAAgB,EAChB,4EAA4E,CAC5E,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,OAAO,iBAAiB;IAY7B,YAAY,OAAiC;QAR5B,uBAAkB,GAAG,IAAI,GAAG,EAAuC,CAAC;QACpE,oBAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAI7C,yBAAoB,GAAG,CAAC,CAAC;QACzB,cAAS,GAAG,KAAK,CAAC;QAGzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC7E,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACrD,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM;QACT,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;IAC3G,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,MAAoB;QACrD,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAClD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,IAAI,iBAAiB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,sBAAsB,GAAG,iBAAiB,CAAC;QAChD,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACJ,IAAI,kBAAkB,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACJ,MAAM,kBAAkB,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACR,sEAAsE;gBACvE,CAAC;YACF,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YACV,iBAAiB,GAAG,EAAE,CAAC;QACxB,CAAC;IACF,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,MAAoB;QACrD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAClC,OAAO,EAAE,6BAA6B,CAAC,OAAO,CAAC,OAAO,CAAC;YACvD,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,6BAA6B,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACpE,qBAAqB,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;SACjE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,OAAgB,EAAE,MAAoB;QAC3E,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3F,IAAI,QAAoD,CAAC;QACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,6BAA6B,CAAC,OAAO,CAAC,CAAC;YACvC,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;YACpE,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;YAC1G,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,+DAA+D,CAC/D,CAAC;YACH,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,mGAAmG,CACnG,CAAC;YACH,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,sBAAsB,CAC/B,2BAA2B,EAC3B,0FAA0F,CAC1F,CAAC;YACH,CAAC;YACD,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,+BAA+B,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,+DAA+D,CAC/D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO;YACN,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChE,OAAO,EAAE,QAAQ,CAAC,KAAK;SACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CACpB,GAAW,EACX,KAAgE,EAChE,MAAoB;QAEpB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,wBAAwB,CACnC,GAAG,EACH,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,EAC9G,MAAM,CACN,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CACxB,GAAW,EACX,KAAqD,EACrD,MAAoB;QAEpB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,sBAAsB,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC7B,GAAW,EACX,KAA4G,EAC5G,MAAoB;QAEpB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,6BAA6B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACnF,MAAM,cAAc,GAAG,QAAQ;YAC9B,CAAC,CAAC,+BAA+B,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClF,CAAC,CAAC,SAAS,CAAC;QACb,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClH,MAAM,MAAM,GAA4B;YACvC,OAAO;YACP,GAAG,CAAC,CAAC,WAAW,IAAI,cAAc,EAAE,WAAW,CAAC;gBAC/C,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,IAAI,cAAc,EAAE,WAAW,EAAE;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACN,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9F,WAAW;SACX,CAAC;QACF,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO;YACN,MAAM,EAAE,QAAQ;YAChB,OAAO;YACP,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChE,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,GAAW,EAAE,OAAe,EAAE,MAAoB;QAC5E,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,MAAM,GAAG,+BAA+B,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtF,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,OAAO;YACN,MAAM,EAAE,OAAO;YACf,OAAO;YACP,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChE,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,MAAoB;QACxD,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QACzG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,wBAAwB,GAAG,KAAK,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAChC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrC,wBAAwB,GAAG,IAAI,CAAC;YACjC,CAAC;QACF,CAAC;QACD,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,wBAAwB;YAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,oBAAoB,CAAC,GAAW;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,IAAI,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;QACxF,OAAO,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IAEO,qBAAqB,CAAC,MAAc;QAC3C,IAAI,QAAiD,CAAC;QACtD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,SAAS;YACjD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM;gBAAE,QAAQ,GAAG,MAAM,CAAC;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,oBAAoB,CAAC,GAAW;QAC/B,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,IAAY;QAC/B,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,IAAI;QACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,oBAAoB;YAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,MAAoB;QACjD,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAC1D,IAAI,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACxC,IAAI,CAAC,UAAU,EAAE,CAAC;YACjB,MAAM,IAAI,sBAAsB,CAC/B,sBAAsB,EACtB,oEAAoE,CACpE,CAAC;QACH,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,MAAM,iBAAiB,GAAG,CAAC,KAAK,IAAI,EAAE;YACrC,IAAI,CAAC;gBACJ,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;gBAC/C,IAAI,UAAU,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;oBAC9C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBACpB,MAAM,IAAI,sBAAsB,CAC/B,sBAAsB,EACtB,uEAAuE,CACvE,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACvB,CAAC;oBAAS,CAAC;gBACV,IAAI,UAAU,KAAK,IAAI,CAAC,oBAAoB;oBAAE,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;gBACjF,UAAU,GAAG,EAAE,CAAC;YACjB,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC;YACJ,MAAM,iBAAiB,CAAC;QACzB,CAAC;gBAAS,CAAC;YACV,IAAI,IAAI,CAAC,iBAAiB,KAAK,iBAAiB;gBAAE,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACtF,CAAC;IACF,CAAC;IAEO,sBAAsB,CAAC,UAAkB;QAChD,IAAI,UAAU,KAAK,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QACvE,MAAM,IAAI,sBAAsB,CAC/B,sBAAsB,EACtB,8EAA8E,CAC9E,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CACnC,GAAW,EACX,MAAoB;QAMpB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,MAA+B;QAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAC7B,CAAC;IAEO,sBAAsB;QAC7B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,sBAAsB;YAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACvF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YACvD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;CACD","sourcesContent":["import { realpathSync } from \"node:fs\";\nimport { isAbsolute, relative, resolve } from \"node:path\";\nimport {\n\tMAX_DOTENV_VARIABLES,\n\tparseDotenvDocument,\n\tvalidateDotenvValue,\n\tvalidateDotenvVariableName,\n} from \"./secret-dotenv.ts\";\n\nconst PROFILE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\nconst PROJECT_KEY_PATTERN = /^(?:git|local):[a-f0-9]{64}$/;\nconst MAX_PROFILE_CHARS = 96;\nconst MAX_DESCRIPTION_CHARS = 256;\nconst MAX_PROJECT_BINDINGS = 64;\nconst MAX_SESSION_KEY_BYTES = 16 * 1024;\n\nexport type CredentialManagerErrorCode =\n\t| \"ambiguous_project_binding\"\n\t| \"invalid_description\"\n\t| \"invalid_profile\"\n\t| \"invalid_project_identity\"\n\t| \"invalid_provider_record\"\n\t| \"invalid_session_key\"\n\t| \"owner_setup_required\"\n\t| \"profile_exists\"\n\t| \"profile_not_found\"\n\t| \"project_not_bound\";\n\nexport class CredentialManagerError extends Error {\n\treadonly code: CredentialManagerErrorCode;\n\n\tconstructor(code: CredentialManagerErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"CredentialManagerError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport type CredentialStorageErrorCode =\n\t| \"malformed_provider_data\"\n\t| \"not_connected\"\n\t| \"profile_not_found\"\n\t| \"provider_command_failed\"\n\t| \"provider_unavailable\";\n\nexport class CredentialStorageError extends Error {\n\treadonly code: CredentialStorageErrorCode;\n\n\tconstructor(code: CredentialStorageErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"CredentialStorageError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport interface CredentialProjectIdentity {\n\tkey: string;\n\troot: string;\n\tlabel: string;\n\tportable: boolean;\n}\n\nexport type CredentialProjectResolver = (cwd: string) => Promise<CredentialProjectIdentity>;\n\nexport interface CredentialVariable {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface CredentialProfileRecord {\n\tprofile: string;\n\tdescription?: string;\n\tvariables: CredentialVariable[];\n\tprojectKeys: string[];\n}\n\nexport interface StoredCredentialProfileSummary {\n\tprofile: string;\n\tdescription?: string;\n\tvariableNames: string[];\n\tprojectKeys: string[];\n}\n\nexport interface CredentialProfileStorage {\n\tconnect(sessionKey: string, signal?: AbortSignal): Promise<void>;\n\trefresh?(signal?: AbortSignal): Promise<void>;\n\tlistProfiles(signal?: AbortSignal): Promise<StoredCredentialProfileSummary[]>;\n\treadProfile(profile: string, signal?: AbortSignal): Promise<CredentialProfileRecord>;\n\twriteProfile(record: CredentialProfileRecord, signal?: AbortSignal): Promise<void>;\n\tdeleteProfile(profile: string, signal?: AbortSignal): Promise<void>;\n\tlock(): void;\n}\n\nexport interface CredentialProfileSummary {\n\tprofile: string;\n\tdescription?: string;\n\tvariableNames: string[];\n\tboundToCurrentProject: boolean;\n}\n\nexport interface CredentialActivationResult {\n\tstatus: \"activated\";\n\tprofile: string;\n\tvariableNames: string[];\n\tproject: string;\n}\n\nexport interface CredentialMutationResult {\n\tstatus: \"bound\" | \"removed\" | \"stored\";\n\tprofile: string;\n\tvariableNames: string[];\n\tproject?: string;\n\tportable?: boolean;\n}\n\nexport interface CredentialConnectionStatus {\n\tconnected: boolean;\n\tsessionAvailable: boolean;\n}\n\nexport interface CredentialManagerOptions {\n\tstorage: CredentialProfileStorage;\n\tresolveProject: CredentialProjectResolver;\n\tinitialSessionKey?: string;\n\tonEnvironmentChanged?: () => void;\n}\n\ninterface ActiveCredentialEnvironment {\n\tprofile: string;\n\troot: string;\n\tvalues: Record<string, string>;\n}\n\nexport function validateCredentialProfileName(profile: string): string {\n\tif (!PROFILE_PATTERN.test(profile) || profile.length > MAX_PROFILE_CHARS) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"invalid_profile\",\n\t\t\t\"Credential profile names must use 1-96 portable letters, digits, dots, underscores, or hyphens.\",\n\t\t);\n\t}\n\treturn profile;\n}\n\nexport function validateCredentialDescription(description: string | undefined): string | undefined {\n\tif (description === undefined) return undefined;\n\tif (\n\t\tdescription.length === 0 ||\n\t\tdescription.length > MAX_DESCRIPTION_CHARS ||\n\t\tdescription.includes(\"\\0\") ||\n\t\t/[\\r\\n]/.test(description)\n\t) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"invalid_description\",\n\t\t\t\"Credential descriptions must be a single printable line of at most 256 characters.\",\n\t\t);\n\t}\n\treturn description;\n}\n\nfunction validateProjectIdentity(identity: CredentialProjectIdentity): CredentialProjectIdentity {\n\tif (\n\t\t!PROJECT_KEY_PATTERN.test(identity.key) ||\n\t\t!isAbsolute(identity.root) ||\n\t\tidentity.label.length === 0 ||\n\t\tidentity.label.length > 256 ||\n\t\t/[\\0\\r\\n]/.test(identity.label)\n\t) {\n\t\tthrow new CredentialManagerError(\"invalid_project_identity\", \"The current project identity is invalid.\");\n\t}\n\treturn { ...identity, root: canonicalizeExistingPath(identity.root) };\n}\n\nexport function validateCredentialProfileRecord(record: CredentialProfileRecord): CredentialProfileRecord {\n\tvalidateCredentialProfileName(record.profile);\n\tvalidateCredentialDescription(record.description);\n\tif (record.variables.length === 0 || record.variables.length > MAX_DOTENV_VARIABLES) {\n\t\tthrow new CredentialManagerError(\"invalid_provider_record\", \"Credential profile has an invalid variable count.\");\n\t}\n\tconst variableNames = new Set<string>();\n\tfor (const variable of record.variables) {\n\t\ttry {\n\t\t\tvalidateDotenvVariableName(variable.name);\n\t\t\tvalidateDotenvValue(variable.value);\n\t\t} catch {\n\t\t\tthrow new CredentialManagerError(\"invalid_provider_record\", \"Credential profile contains invalid variables.\");\n\t\t}\n\t\tif (variableNames.has(variable.name)) {\n\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\"invalid_provider_record\",\n\t\t\t\t\"Credential profile contains duplicate variables.\",\n\t\t\t);\n\t\t}\n\t\tvariableNames.add(variable.name);\n\t}\n\tif (\n\t\trecord.projectKeys.length === 0 ||\n\t\trecord.projectKeys.length > MAX_PROJECT_BINDINGS ||\n\t\tnew Set(record.projectKeys).size !== record.projectKeys.length ||\n\t\trecord.projectKeys.some((key) => !PROJECT_KEY_PATTERN.test(key))\n\t) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"invalid_provider_record\",\n\t\t\t\"Credential profile contains invalid project bindings.\",\n\t\t);\n\t}\n\treturn record;\n}\n\nfunction validateSessionKey(sessionKey: string): string {\n\tif (\n\t\tsessionKey.trim().length === 0 ||\n\t\tsessionKey.includes(\"\\0\") ||\n\t\t/[\\r\\n]/.test(sessionKey) ||\n\t\tBuffer.byteLength(sessionKey, \"utf8\") > MAX_SESSION_KEY_BYTES\n\t) {\n\t\tthrow new CredentialManagerError(\"invalid_session_key\", \"The Bitwarden session key is invalid.\");\n\t}\n\treturn sessionKey;\n}\n\nfunction isPathInside(root: string, target: string): boolean {\n\tconst pathFromRoot = relative(root, target);\n\treturn pathFromRoot === \"\" || (!pathFromRoot.startsWith(\"..\") && !isAbsolute(pathFromRoot));\n}\n\nfunction canonicalizeExistingPath(path: string): string {\n\tconst absolute = resolve(path);\n\ttry {\n\t\treturn realpathSync.native(absolute);\n\t} catch {\n\t\treturn absolute;\n\t}\n}\n\nfunction cloneEnvironment(values: Record<string, string>): Record<string, string> {\n\treturn Object.fromEntries(Object.entries(values));\n}\n\nfunction findReplaceableProfile(\n\tsummaries: readonly StoredCredentialProfileSummary[],\n\tprofile: string,\n\treplaceExisting: boolean | undefined,\n): StoredCredentialProfileSummary | undefined {\n\tconst existing = summaries.find((summary) => summary.profile === profile);\n\tif (existing && replaceExisting !== true) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"profile_exists\",\n\t\t\t\"Credential profile already exists; replacement must be explicitly allowed.\",\n\t\t);\n\t}\n\treturn existing;\n}\n\nexport class CredentialManager {\n\tprivate readonly storage: CredentialProfileStorage;\n\tprivate readonly resolveProject: CredentialProjectResolver;\n\tprivate readonly onEnvironmentChanged: () => void;\n\tprivate readonly activeEnvironments = new Map<string, ActiveCredentialEnvironment>();\n\tprivate readonly sensitiveValues = new Set<string>();\n\tprivate pendingSessionKey: string | undefined;\n\tprivate sessionKeyForRedaction: string | undefined;\n\tprivate connectionPromise: Promise<void> | undefined;\n\tprivate connectionGeneration = 0;\n\tprivate connected = false;\n\n\tconstructor(options: CredentialManagerOptions) {\n\t\tthis.storage = options.storage;\n\t\tthis.resolveProject = options.resolveProject;\n\t\tthis.onEnvironmentChanged = options.onEnvironmentChanged ?? (() => {});\n\t\tthis.pendingSessionKey = options.initialSessionKey ?? process.env.BW_SESSION;\n\t\tthis.sessionKeyForRedaction = this.pendingSessionKey;\n\t\tthis.rebuildSensitiveValues();\n\t}\n\n\tget status(): CredentialConnectionStatus {\n\t\treturn { connected: this.connected, sessionAvailable: this.connected || Boolean(this.pendingSessionKey) };\n\t}\n\n\tasync connect(sessionKey: string, signal?: AbortSignal): Promise<void> {\n\t\tconst previousConnection = this.connectionPromise;\n\t\tthis.connectionGeneration++;\n\t\tlet privateSessionKey = validateSessionKey(sessionKey);\n\t\tthis.pendingSessionKey = privateSessionKey;\n\t\tthis.sessionKeyForRedaction = privateSessionKey;\n\t\tthis.rebuildSensitiveValues();\n\t\tthis.connected = false;\n\t\ttry {\n\t\t\tif (previousConnection) {\n\t\t\t\ttry {\n\t\t\t\t\tawait previousConnection;\n\t\t\t\t} catch {\n\t\t\t\t\t// The superseded connection is expected to fail its generation check.\n\t\t\t\t}\n\t\t\t}\n\t\t\tawait this.ensureConnected(signal);\n\t\t} finally {\n\t\t\tprivateSessionKey = \"\";\n\t\t}\n\t}\n\n\tasync listForProject(cwd: string, signal?: AbortSignal): Promise<CredentialProfileSummary[]> {\n\t\tconst { identity, summaries } = await this.refreshProjectProfiles(cwd, signal);\n\t\treturn summaries.map((summary) => ({\n\t\t\tprofile: validateCredentialProfileName(summary.profile),\n\t\t\t...(summary.description ? { description: validateCredentialDescription(summary.description) } : {}),\n\t\t\tvariableNames: summary.variableNames.map(validateDotenvVariableName),\n\t\t\tboundToCurrentProject: summary.projectKeys.includes(identity.key),\n\t\t}));\n\t}\n\n\tasync activateForProject(cwd: string, profile?: string, signal?: AbortSignal): Promise<CredentialActivationResult> {\n\t\tconst { generation, identity, summaries } = await this.refreshProjectProfiles(cwd, signal);\n\t\tlet selected: StoredCredentialProfileSummary | undefined;\n\t\tif (profile !== undefined) {\n\t\t\tvalidateCredentialProfileName(profile);\n\t\t\tselected = summaries.find((summary) => summary.profile === profile);\n\t\t\tif (!selected) throw new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t\tif (!selected.projectKeys.includes(identity.key)) {\n\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\"project_not_bound\",\n\t\t\t\t\t\"Credential profile is not authorized for the current project.\",\n\t\t\t\t);\n\t\t\t}\n\t\t} else {\n\t\t\tconst candidates = summaries.filter((summary) => summary.projectKeys.includes(identity.key));\n\t\t\tif (candidates.length === 0) {\n\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\"profile_not_found\",\n\t\t\t\t\t\"No credential profile is bound to the current project. The owner can configure one with /secrets.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (candidates.length > 1) {\n\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\"ambiguous_project_binding\",\n\t\t\t\t\t\"Multiple credential profiles are bound to the current project; select a profile by name.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\t[selected] = candidates;\n\t\t}\n\n\t\tif (!selected) throw new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\tconst record = validateCredentialProfileRecord(await this.storage.readProfile(selected.profile, signal));\n\t\tthis.assertAccessGeneration(generation);\n\t\tif (!record.projectKeys.includes(identity.key)) {\n\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\"project_not_bound\",\n\t\t\t\t\"Credential profile is not authorized for the current project.\",\n\t\t\t);\n\t\t}\n\t\tthis.activate(identity.root, record);\n\t\treturn {\n\t\t\tstatus: \"activated\",\n\t\t\tprofile: record.profile,\n\t\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\t\tproject: identity.label,\n\t\t};\n\t}\n\n\tasync storeForProject(\n\t\tcwd: string,\n\t\tinput: { profile: string; description?: string; dotenv: string },\n\t\tsignal?: AbortSignal,\n\t): Promise<CredentialMutationResult> {\n\t\tconst parsed = parseDotenvDocument(input.dotenv);\n\t\treturn this.storeVariablesForProject(\n\t\t\tcwd,\n\t\t\t{ profile: input.profile, description: input.description, variables: parsed.variables, replaceExisting: true },\n\t\t\tsignal,\n\t\t);\n\t}\n\n\tasync prepareForMigration(\n\t\tcwd: string,\n\t\tinput: { profile: string; replaceExisting?: boolean },\n\t\tsignal?: AbortSignal,\n\t): Promise<void> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst profile = validateCredentialProfileName(input.profile);\n\t\tvalidateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tfindReplaceableProfile(summaries, profile, input.replaceExisting);\n\t}\n\n\tasync storeVariablesForProject(\n\t\tcwd: string,\n\t\tinput: { profile: string; description?: string; variables: CredentialVariable[]; replaceExisting?: boolean },\n\t\tsignal?: AbortSignal,\n\t): Promise<CredentialMutationResult> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst profile = validateCredentialProfileName(input.profile);\n\t\tconst description = validateCredentialDescription(input.description);\n\t\tconst identity = validateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst existing = findReplaceableProfile(summaries, profile, input.replaceExisting);\n\t\tconst existingRecord = existing\n\t\t\t? validateCredentialProfileRecord(await this.storage.readProfile(profile, signal))\n\t\t\t: undefined;\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst projectKeys = existingRecord ? [...new Set([...existingRecord.projectKeys, identity.key])] : [identity.key];\n\t\tconst record: CredentialProfileRecord = {\n\t\t\tprofile,\n\t\t\t...((description ?? existingRecord?.description)\n\t\t\t\t? { description: description ?? existingRecord?.description }\n\t\t\t\t: {}),\n\t\t\tvariables: input.variables.map((variable) => ({ name: variable.name, value: variable.value })),\n\t\t\tprojectKeys,\n\t\t};\n\t\tvalidateCredentialProfileRecord(record);\n\t\tawait this.storage.writeProfile(record, signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tthis.activate(identity.root, record);\n\t\treturn {\n\t\t\tstatus: \"stored\",\n\t\t\tprofile,\n\t\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\t\tproject: identity.label,\n\t\t\tportable: identity.portable,\n\t\t};\n\t}\n\n\tasync bindProfileToProject(cwd: string, profile: string, signal?: AbortSignal): Promise<CredentialMutationResult> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tvalidateCredentialProfileName(profile);\n\t\tconst identity = validateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tif (!summaries.some((summary) => summary.profile === profile)) {\n\t\t\tthrow new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t}\n\t\tconst record = validateCredentialProfileRecord(await this.storage.readProfile(profile, signal));\n\t\tthis.assertAccessGeneration(generation);\n\t\tif (!record.projectKeys.includes(identity.key)) record.projectKeys.push(identity.key);\n\t\tvalidateCredentialProfileRecord(record);\n\t\tawait this.storage.writeProfile(record, signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\treturn {\n\t\t\tstatus: \"bound\",\n\t\t\tprofile,\n\t\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\t\tproject: identity.label,\n\t\t\tportable: identity.portable,\n\t\t};\n\t}\n\n\tasync removeProfile(profile: string, signal?: AbortSignal): Promise<CredentialMutationResult> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tvalidateCredentialProfileName(profile);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summary = summaries.find((candidate) => candidate.profile === profile);\n\t\tif (!summary) throw new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\tawait this.storage.deleteProfile(profile, signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tlet removedActiveEnvironment = false;\n\t\tfor (const [root, active] of this.activeEnvironments) {\n\t\t\tif (active.profile === profile) {\n\t\t\t\tthis.activeEnvironments.delete(root);\n\t\t\t\tremovedActiveEnvironment = true;\n\t\t\t}\n\t\t}\n\t\tthis.rebuildSensitiveValues();\n\t\tif (removedActiveEnvironment) this.onEnvironmentChanged();\n\t\treturn { status: \"removed\", profile, variableNames: [...summary.variableNames] };\n\t}\n\n\tgetEnvironmentForCwd(cwd: string): Record<string, string> | undefined {\n\t\tconst target = resolve(cwd);\n\t\tconst direct = this.findActiveEnvironment(target);\n\t\tconst selected = direct ?? this.findActiveEnvironment(canonicalizeExistingPath(target));\n\t\treturn selected ? cloneEnvironment(selected.values) : undefined;\n\t}\n\n\tprivate findActiveEnvironment(target: string): ActiveCredentialEnvironment | undefined {\n\t\tlet selected: ActiveCredentialEnvironment | undefined;\n\t\tfor (const active of this.activeEnvironments.values()) {\n\t\t\tif (!isPathInside(active.root, target)) continue;\n\t\t\tif (!selected || active.root.length > selected.root.length) selected = active;\n\t\t}\n\t\treturn selected;\n\t}\n\n\thasEnvironmentForCwd(cwd: string): boolean {\n\t\treturn this.getEnvironmentForCwd(cwd) !== undefined;\n\t}\n\n\tredactSensitiveText(text: string): string {\n\t\tlet redacted = text;\n\t\tfor (const value of [...this.sensitiveValues].sort((left, right) => right.length - left.length)) {\n\t\t\tif (value.length > 0) redacted = redacted.split(value).join(\"[REDACTED_SECRET]\");\n\t\t}\n\t\treturn redacted;\n\t}\n\n\tlock(): void {\n\t\tconst hadActiveEnvironment = this.activeEnvironments.size > 0;\n\t\tthis.connectionGeneration++;\n\t\tthis.storage.lock();\n\t\tthis.connected = false;\n\t\tthis.pendingSessionKey = undefined;\n\t\tthis.sessionKeyForRedaction = undefined;\n\t\tthis.connectionPromise = undefined;\n\t\tthis.activeEnvironments.clear();\n\t\tthis.sensitiveValues.clear();\n\t\tif (hadActiveEnvironment) this.onEnvironmentChanged();\n\t}\n\n\tprivate async ensureConnected(signal?: AbortSignal): Promise<void> {\n\t\tif (this.connected) return;\n\t\tif (this.connectionPromise) return this.connectionPromise;\n\t\tlet sessionKey = this.pendingSessionKey;\n\t\tif (!sessionKey) {\n\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\"owner_setup_required\",\n\t\t\t\t\"Bitwarden needs a BW_SESSION key through Pi's masked owner prompt.\",\n\t\t\t);\n\t\t}\n\t\tconst generation = this.connectionGeneration;\n\t\tconst connectionPromise = (async () => {\n\t\t\ttry {\n\t\t\t\tawait this.storage.connect(sessionKey, signal);\n\t\t\t\tif (generation !== this.connectionGeneration) {\n\t\t\t\t\tthis.storage.lock();\n\t\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\t\"owner_setup_required\",\n\t\t\t\t\t\t\"Bitwarden connection was cancelled when the owner locked credentials.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tthis.connected = true;\n\t\t\t} finally {\n\t\t\t\tif (generation === this.connectionGeneration) this.pendingSessionKey = undefined;\n\t\t\t\tsessionKey = \"\";\n\t\t\t}\n\t\t})();\n\t\tthis.connectionPromise = connectionPromise;\n\t\ttry {\n\t\t\tawait connectionPromise;\n\t\t} finally {\n\t\t\tif (this.connectionPromise === connectionPromise) this.connectionPromise = undefined;\n\t\t}\n\t}\n\n\tprivate assertAccessGeneration(generation: number): void {\n\t\tif (generation === this.connectionGeneration && this.connected) return;\n\t\tthrow new CredentialManagerError(\n\t\t\t\"owner_setup_required\",\n\t\t\t\"Bitwarden credential access was cancelled when the owner locked credentials.\",\n\t\t);\n\t}\n\n\tprivate async refreshProjectProfiles(\n\t\tcwd: string,\n\t\tsignal?: AbortSignal,\n\t): Promise<{\n\t\tgeneration: number;\n\t\tidentity: CredentialProjectIdentity;\n\t\tsummaries: StoredCredentialProfileSummary[];\n\t}> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tawait this.storage.refresh?.(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst identity = validateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\treturn { generation, identity, summaries };\n\t}\n\n\tprivate activate(root: string, record: CredentialProfileRecord): void {\n\t\tconst values = Object.fromEntries(record.variables.map((variable) => [variable.name, variable.value]));\n\t\tthis.activeEnvironments.set(resolve(root), { profile: record.profile, root: resolve(root), values });\n\t\tthis.rebuildSensitiveValues();\n\t\tthis.onEnvironmentChanged();\n\t}\n\n\tprivate rebuildSensitiveValues(): void {\n\t\tthis.sensitiveValues.clear();\n\t\tif (this.sessionKeyForRedaction) this.sensitiveValues.add(this.sessionKeyForRedaction);\n\t\tfor (const active of this.activeEnvironments.values()) {\n\t\t\tfor (const value of Object.values(active.values)) this.sensitiveValues.add(value);\n\t\t}\n\t}\n}\n"]}
1
+ {"version":3,"file":"credential-manager.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1D,OAAO,EACN,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,GAC1B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,eAAe,GAAG,8BAA8B,CAAC;AACvD,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAC3D,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAClC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAcxC,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAGhD,YAAY,IAAgC,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AASD,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAGhD,YAAY,IAAgC,EAAE,OAAe;QAC5D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AA0FD,MAAM,UAAU,6BAA6B,CAAC,OAAe;IAC5D,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,iBAAiB,EAAE,CAAC;QAC1E,MAAM,IAAI,sBAAsB,CAC/B,iBAAiB,EACjB,iGAAiG,CACjG,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,WAA+B;IAC5E,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAChD,IACC,WAAW,CAAC,MAAM,KAAK,CAAC;QACxB,WAAW,CAAC,MAAM,GAAG,qBAAqB;QAC1C,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EACzB,CAAC;QACF,MAAM,IAAI,sBAAsB,CAC/B,qBAAqB,EACrB,oFAAoF,CACpF,CAAC;IACH,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAmC;IACnE,IACC,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QACvC,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1B,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAC3B,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG;QAC3B,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC9B,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,0BAA0B,EAAE,0CAA0C,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,wBAAwB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,MAA+B;IAC9E,6BAA6B,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,6BAA6B,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,oBAAoB,EAAE,CAAC;QACrF,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,mDAAmD,CAAC,CAAC;IAClH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IACxC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC;YACJ,0BAA0B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC1C,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACR,MAAM,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,gDAAgD,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,sBAAsB,CAC/B,yBAAyB,EACzB,kDAAkD,CAClD,CAAC;QACH,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,IACC,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAC/B,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,oBAAoB;QAChD,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM;QAC9D,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC/D,CAAC;QACF,MAAM,IAAI,sBAAsB,CAC/B,yBAAyB,EACzB,uDAAuD,CACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,UAAkB;IAC7C,IACC,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC9B,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC;QACzB,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,qBAAqB,EAC5D,CAAC;QACF,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,MAAc;IACjD,MAAM,YAAY,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,OAAO,YAAY,KAAK,EAAE,IAAI,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC;QACJ,OAAO,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,QAAQ,CAAC;IACjB,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA8B;IACvD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,sBAAsB,CAC9B,SAAoD,EACpD,OAAe,EACf,eAAoC;IAEpC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAC1E,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC1C,MAAM,IAAI,sBAAsB,CAC/B,gBAAgB,EAChB,4EAA4E,CAC5E,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,OAAO,iBAAiB;IAc7B,YAAY,OAAiC;QAT5B,uBAAkB,GAAG,IAAI,GAAG,EAAuC,CAAC;QACpE,oBAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAK7C,yBAAoB,GAAG,CAAC,CAAC;QACzB,cAAS,GAAG,KAAK,CAAC;QAGzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;QAC3D,IAAI,CAAC,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,iBAAiB;YACrB,OAAO,CAAC,iBAAiB;gBACzB,CAAC,OAAO,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACpF,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QACrD,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM;QACT,OAAO;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,gBAAgB,EACf,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS;SAC9F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,UAAkB,EAAE,MAAoB;QACrD,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAClD,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,IAAI,iBAAiB,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC,sBAAsB,GAAG,4BAA4B,CAAC;QAC3D,IAAI,CAAC,sBAAsB,GAAG,iBAAiB,CAAC;QAChD,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACJ,IAAI,kBAAkB,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACJ,MAAM,kBAAkB,CAAC;gBAC1B,CAAC;gBAAC,MAAM,CAAC;oBACR,sEAAsE;gBACvE,CAAC;YACF,CAAC;YACD,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YACV,iBAAiB,GAAG,EAAE,CAAC;QACxB,CAAC;IACF,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAoB;QACzC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,MAAM,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,MAAoB;QACrD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/E,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAClC,OAAO,EAAE,6BAA6B,CAAC,OAAO,CAAC,OAAO,CAAC;YACvD,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,6BAA6B,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,aAAa,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,0BAA0B,CAAC;YACpE,qBAAqB,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;SACjE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,GAAW,EAAE,OAAgB,EAAE,MAAoB;QAC3E,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC3F,IAAI,QAAoD,CAAC;QACzD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,6BAA6B,CAAC,OAAO,CAAC,CAAC;YACvC,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;YACpE,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;YAC1G,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAClD,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,+DAA+D,CAC/D,CAAC;YACH,CAAC;QACF,CAAC;aAAM,CAAC;YACP,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7F,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,mGAAmG,CACnG,CAAC;YACH,CAAC;YACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,sBAAsB,CAC/B,2BAA2B,EAC3B,0FAA0F,CAC1F,CAAC;YACH,CAAC;YACD,CAAC,QAAQ,CAAC,GAAG,UAAU,CAAC;QACzB,CAAC;QAED,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QAC1G,MAAM,MAAM,GAAG,+BAA+B,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,sBAAsB,CAC/B,mBAAmB,EACnB,+DAA+D,CAC/D,CAAC;QACH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO;YACN,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChE,OAAO,EAAE,QAAQ,CAAC,KAAK;SACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CACpB,GAAW,EACX,KAAgE,EAChE,MAAoB;QAEpB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,wBAAwB,CACnC,GAAG,EACH,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,EAC9G,MAAM,CACN,CAAC;IACH,CAAC;IAED,KAAK,CAAC,mBAAmB,CACxB,GAAW,EACX,KAAqD,EACrD,MAAoB;QAEpB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,sBAAsB,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,wBAAwB,CAC7B,GAAW,EACX,KAA4G,EAC5G,MAAoB;QAEpB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,6BAA6B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,6BAA6B,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACnF,MAAM,cAAc,GAAG,QAAQ;YAC9B,CAAC,CAAC,+BAA+B,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAClF,CAAC,CAAC,SAAS,CAAC;QACb,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,WAAW,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClH,MAAM,MAAM,GAA4B;YACvC,OAAO;YACP,GAAG,CAAC,CAAC,WAAW,IAAI,cAAc,EAAE,WAAW,CAAC;gBAC/C,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,IAAI,cAAc,EAAE,WAAW,EAAE;gBAC7D,CAAC,CAAC,EAAE,CAAC;YACN,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9F,WAAW;SACX,CAAC;QACF,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACrC,OAAO;YACN,MAAM,EAAE,QAAQ;YAChB,OAAO;YACP,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChE,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,GAAW,EAAE,OAAe,EAAE,MAAoB;QAC5E,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,MAAM,GAAG,+BAA+B,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtF,+BAA+B,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,OAAO;YACN,MAAM,EAAE,OAAO;YACf,OAAO;YACP,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChE,OAAO,EAAE,QAAQ,CAAC,KAAK;YACvB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC3B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,MAAoB;QACxD,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAC7E,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,EAAE,mCAAmC,CAAC,CAAC;QACzG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,wBAAwB,GAAG,KAAK,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACtD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAChC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACrC,wBAAwB,GAAG,IAAI,CAAC;YACjC,CAAC;QACF,CAAC;QACD,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,wBAAwB;YAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;IAClF,CAAC;IAED,oBAAoB,CAAC,GAAW;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,IAAI,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC,CAAC;QACxF,OAAO,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjE,CAAC;IAEO,qBAAqB,CAAC,MAAc;QAC3C,IAAI,QAAiD,CAAC;QACtD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YACvD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;gBAAE,SAAS;YACjD,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM;gBAAE,QAAQ,GAAG,MAAM,CAAC;QAC/E,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,oBAAoB,CAAC,GAAW;QAC/B,OAAO,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IACrD,CAAC;IAED,mBAAmB,CAAC,IAAY;QAC/B,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACjG,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,QAAQ,CAAC;IACjB,CAAC;IAED,IAAI;QACH,MAAM,oBAAoB,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;QACxC,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACnC,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,oBAAoB;YAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC;IACvD,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,MAAoB;QACjD,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QAC3B,IAAI,IAAI,CAAC,iBAAiB;YAAE,OAAO,IAAI,CAAC,iBAAiB,CAAC;QAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,MAAM,iBAAiB,GAAG,CAAC,KAAK,IAAI,EAAE;YACrC,IAAI,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACxC,IAAI,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC;YAC3C,IAAI,CAAC;gBACJ,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBAC/C,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC;oBAChE,IAAI,UAAU,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;wBAC9C,MAAM,IAAI,sBAAsB,CAC/B,sBAAsB,EACtB,uEAAuE,CACvE,CAAC;oBACH,CAAC;oBACD,IAAI,cAAc,EAAE,CAAC;wBACpB,IACC,cAAc,CAAC,QAAQ,KAAK,4BAA4B;4BACxD,cAAc,CAAC,QAAQ,KAAK,2BAA2B,EACtD,CAAC;4BACF,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,oCAAoC,CAAC,CAAC;wBAC/F,CAAC;wBACD,UAAU,GAAG,kBAAkB,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;wBAC3D,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;wBACnC,IAAI,CAAC,iBAAiB,GAAG,UAAU,CAAC;wBACpC,IAAI,CAAC,sBAAsB,GAAG,QAAQ,CAAC;wBACvC,IAAI,CAAC,sBAAsB,GAAG,UAAU,CAAC;wBACzC,IAAI,CAAC,sBAAsB,EAAE,CAAC;oBAC/B,CAAC;gBACF,CAAC;gBACD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAC9B,MAAM,IAAI,sBAAsB,CAC/B,sBAAsB,EACtB,4FAA4F,CAC5F,CAAC;gBACH,CAAC;gBACD,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACzD,IAAI,UAAU,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;oBAC9C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;oBACpB,MAAM,IAAI,sBAAsB,CAC/B,sBAAsB,EACtB,uEAAuE,CACvE,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;YACvB,CAAC;oBAAS,CAAC;gBACV,IAAI,UAAU,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;oBAC9C,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;oBACnC,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;gBACzC,CAAC;gBACD,IAAI,UAAU;oBAAE,UAAU,GAAG,EAAE,CAAC;YACjC,CAAC;QACF,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,IAAI,CAAC;YACJ,MAAM,iBAAiB,CAAC;QACzB,CAAC;gBAAS,CAAC;YACV,IAAI,IAAI,CAAC,iBAAiB,KAAK,iBAAiB;gBAAE,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;QACtF,CAAC;IACF,CAAC;IAEO,sBAAsB,CAAC,UAAkB;QAChD,IAAI,UAAU,KAAK,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO;QACvE,MAAM,IAAI,sBAAsB,CAC/B,sBAAsB,EACtB,8EAA8E,CAC9E,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CACnC,GAAW,EACX,MAAoB;QAMpB,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,IAAI,CAAC,oBAAoB,CAAC;QAC7C,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,uBAAuB,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACxC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,MAA+B;QAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAC7B,CAAC;IAEO,sBAAsB;QAC7B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,sBAAsB;YAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACvF,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,CAAC;YACvD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnF,CAAC;IACF,CAAC;CACD","sourcesContent":["import { realpathSync } from \"node:fs\";\nimport { isAbsolute, relative, resolve } from \"node:path\";\nimport {\n\tMAX_DOTENV_VARIABLES,\n\tparseDotenvDocument,\n\tvalidateDotenvValue,\n\tvalidateDotenvVariableName,\n} from \"./secret-dotenv.ts\";\n\nconst PROFILE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;\nconst PROJECT_KEY_PATTERN = /^(?:git|local):[a-f0-9]{64}$/;\nconst MAX_PROFILE_CHARS = 96;\nconst MAX_DESCRIPTION_CHARS = 256;\nconst MAX_PROJECT_BINDINGS = 64;\nconst MAX_SESSION_KEY_BYTES = 16 * 1024;\n\nexport type CredentialManagerErrorCode =\n\t| \"ambiguous_project_binding\"\n\t| \"invalid_description\"\n\t| \"invalid_profile\"\n\t| \"invalid_project_identity\"\n\t| \"invalid_provider_record\"\n\t| \"invalid_session_key\"\n\t| \"owner_setup_required\"\n\t| \"profile_exists\"\n\t| \"profile_not_found\"\n\t| \"project_not_bound\";\n\nexport class CredentialManagerError extends Error {\n\treadonly code: CredentialManagerErrorCode;\n\n\tconstructor(code: CredentialManagerErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"CredentialManagerError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport type CredentialStorageErrorCode =\n\t| \"malformed_provider_data\"\n\t| \"not_connected\"\n\t| \"profile_not_found\"\n\t| \"provider_command_failed\"\n\t| \"provider_unavailable\";\n\nexport class CredentialStorageError extends Error {\n\treadonly code: CredentialStorageErrorCode;\n\n\tconstructor(code: CredentialStorageErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"CredentialStorageError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport interface CredentialProjectIdentity {\n\tkey: string;\n\troot: string;\n\tlabel: string;\n\tportable: boolean;\n}\n\nexport type CredentialProjectResolver = (cwd: string) => Promise<CredentialProjectIdentity>;\n\nexport interface CredentialVariable {\n\tname: string;\n\tvalue: string;\n}\n\nexport interface CredentialProfileRecord {\n\tprofile: string;\n\tdescription?: string;\n\tvariables: CredentialVariable[];\n\tprojectKeys: string[];\n}\n\nexport interface StoredCredentialProfileSummary {\n\tprofile: string;\n\tdescription?: string;\n\tvariableNames: string[];\n\tprojectKeys: string[];\n}\n\nexport type CredentialStorageProvider = \"bitwarden_password_manager\" | \"bitwarden_secrets_manager\";\n\nexport interface MachineCredentialSession {\n\tprovider: CredentialStorageProvider;\n\tsessionKey: string;\n}\n\nexport type MachineCredentialSessionResolver = (signal?: AbortSignal) => Promise<MachineCredentialSession | undefined>;\n\nexport interface CredentialProfileStorage {\n\tconnect(sessionKey: string, signal?: AbortSignal, provider?: CredentialStorageProvider): Promise<void>;\n\trefresh?(signal?: AbortSignal): Promise<void>;\n\tlistProfiles(signal?: AbortSignal): Promise<StoredCredentialProfileSummary[]>;\n\treadProfile(profile: string, signal?: AbortSignal): Promise<CredentialProfileRecord>;\n\twriteProfile(record: CredentialProfileRecord, signal?: AbortSignal): Promise<void>;\n\tdeleteProfile(profile: string, signal?: AbortSignal): Promise<void>;\n\tlock(): void;\n}\n\nexport interface CredentialProfileSummary {\n\tprofile: string;\n\tdescription?: string;\n\tvariableNames: string[];\n\tboundToCurrentProject: boolean;\n}\n\nexport interface CredentialActivationResult {\n\tstatus: \"activated\";\n\tprofile: string;\n\tvariableNames: string[];\n\tproject: string;\n}\n\nexport interface CredentialMutationResult {\n\tstatus: \"bound\" | \"removed\" | \"stored\";\n\tprofile: string;\n\tvariableNames: string[];\n\tproject?: string;\n\tportable?: boolean;\n}\n\nexport interface CredentialConnectionStatus {\n\tconnected: boolean;\n\tsessionAvailable: boolean;\n}\n\nexport interface CredentialManagerOptions {\n\tstorage: CredentialProfileStorage;\n\tresolveProject: CredentialProjectResolver;\n\tinitialSessionKey?: string;\n\tresolveMachineSession?: MachineCredentialSessionResolver;\n\tonEnvironmentChanged?: () => void;\n}\n\ninterface ActiveCredentialEnvironment {\n\tprofile: string;\n\troot: string;\n\tvalues: Record<string, string>;\n}\n\nexport function validateCredentialProfileName(profile: string): string {\n\tif (!PROFILE_PATTERN.test(profile) || profile.length > MAX_PROFILE_CHARS) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"invalid_profile\",\n\t\t\t\"Credential profile names must use 1-96 portable letters, digits, dots, underscores, or hyphens.\",\n\t\t);\n\t}\n\treturn profile;\n}\n\nexport function validateCredentialDescription(description: string | undefined): string | undefined {\n\tif (description === undefined) return undefined;\n\tif (\n\t\tdescription.length === 0 ||\n\t\tdescription.length > MAX_DESCRIPTION_CHARS ||\n\t\tdescription.includes(\"\\0\") ||\n\t\t/[\\r\\n]/.test(description)\n\t) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"invalid_description\",\n\t\t\t\"Credential descriptions must be a single printable line of at most 256 characters.\",\n\t\t);\n\t}\n\treturn description;\n}\n\nfunction validateProjectIdentity(identity: CredentialProjectIdentity): CredentialProjectIdentity {\n\tif (\n\t\t!PROJECT_KEY_PATTERN.test(identity.key) ||\n\t\t!isAbsolute(identity.root) ||\n\t\tidentity.label.length === 0 ||\n\t\tidentity.label.length > 256 ||\n\t\t/[\\0\\r\\n]/.test(identity.label)\n\t) {\n\t\tthrow new CredentialManagerError(\"invalid_project_identity\", \"The current project identity is invalid.\");\n\t}\n\treturn { ...identity, root: canonicalizeExistingPath(identity.root) };\n}\n\nexport function validateCredentialProfileRecord(record: CredentialProfileRecord): CredentialProfileRecord {\n\tvalidateCredentialProfileName(record.profile);\n\tvalidateCredentialDescription(record.description);\n\tif (record.variables.length === 0 || record.variables.length > MAX_DOTENV_VARIABLES) {\n\t\tthrow new CredentialManagerError(\"invalid_provider_record\", \"Credential profile has an invalid variable count.\");\n\t}\n\tconst variableNames = new Set<string>();\n\tfor (const variable of record.variables) {\n\t\ttry {\n\t\t\tvalidateDotenvVariableName(variable.name);\n\t\t\tvalidateDotenvValue(variable.value);\n\t\t} catch {\n\t\t\tthrow new CredentialManagerError(\"invalid_provider_record\", \"Credential profile contains invalid variables.\");\n\t\t}\n\t\tif (variableNames.has(variable.name)) {\n\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\"invalid_provider_record\",\n\t\t\t\t\"Credential profile contains duplicate variables.\",\n\t\t\t);\n\t\t}\n\t\tvariableNames.add(variable.name);\n\t}\n\tif (\n\t\trecord.projectKeys.length === 0 ||\n\t\trecord.projectKeys.length > MAX_PROJECT_BINDINGS ||\n\t\tnew Set(record.projectKeys).size !== record.projectKeys.length ||\n\t\trecord.projectKeys.some((key) => !PROJECT_KEY_PATTERN.test(key))\n\t) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"invalid_provider_record\",\n\t\t\t\"Credential profile contains invalid project bindings.\",\n\t\t);\n\t}\n\treturn record;\n}\n\nfunction validateSessionKey(sessionKey: string): string {\n\tif (\n\t\tsessionKey.trim().length === 0 ||\n\t\tsessionKey.includes(\"\\0\") ||\n\t\t/[\\r\\n]/.test(sessionKey) ||\n\t\tBuffer.byteLength(sessionKey, \"utf8\") > MAX_SESSION_KEY_BYTES\n\t) {\n\t\tthrow new CredentialManagerError(\"invalid_session_key\", \"The Bitwarden session key is invalid.\");\n\t}\n\treturn sessionKey;\n}\n\nfunction isPathInside(root: string, target: string): boolean {\n\tconst pathFromRoot = relative(root, target);\n\treturn pathFromRoot === \"\" || (!pathFromRoot.startsWith(\"..\") && !isAbsolute(pathFromRoot));\n}\n\nfunction canonicalizeExistingPath(path: string): string {\n\tconst absolute = resolve(path);\n\ttry {\n\t\treturn realpathSync.native(absolute);\n\t} catch {\n\t\treturn absolute;\n\t}\n}\n\nfunction cloneEnvironment(values: Record<string, string>): Record<string, string> {\n\treturn Object.fromEntries(Object.entries(values));\n}\n\nfunction findReplaceableProfile(\n\tsummaries: readonly StoredCredentialProfileSummary[],\n\tprofile: string,\n\treplaceExisting: boolean | undefined,\n): StoredCredentialProfileSummary | undefined {\n\tconst existing = summaries.find((summary) => summary.profile === profile);\n\tif (existing && replaceExisting !== true) {\n\t\tthrow new CredentialManagerError(\n\t\t\t\"profile_exists\",\n\t\t\t\"Credential profile already exists; replacement must be explicitly allowed.\",\n\t\t);\n\t}\n\treturn existing;\n}\n\nexport class CredentialManager {\n\tprivate readonly storage: CredentialProfileStorage;\n\tprivate readonly resolveProject: CredentialProjectResolver;\n\tprivate readonly resolveMachineSession: MachineCredentialSessionResolver | undefined;\n\tprivate readonly onEnvironmentChanged: () => void;\n\tprivate readonly activeEnvironments = new Map<string, ActiveCredentialEnvironment>();\n\tprivate readonly sensitiveValues = new Set<string>();\n\tprivate pendingSessionKey: string | undefined;\n\tprivate pendingStorageProvider: CredentialStorageProvider | undefined;\n\tprivate sessionKeyForRedaction: string | undefined;\n\tprivate connectionPromise: Promise<void> | undefined;\n\tprivate connectionGeneration = 0;\n\tprivate connected = false;\n\n\tconstructor(options: CredentialManagerOptions) {\n\t\tthis.storage = options.storage;\n\t\tthis.resolveProject = options.resolveProject;\n\t\tthis.resolveMachineSession = options.resolveMachineSession;\n\t\tthis.onEnvironmentChanged = options.onEnvironmentChanged ?? (() => {});\n\t\tthis.pendingSessionKey =\n\t\t\toptions.initialSessionKey ??\n\t\t\t(options.resolveMachineSession === undefined ? process.env.BW_SESSION : undefined);\n\t\tthis.pendingStorageProvider = this.pendingSessionKey ? \"bitwarden_password_manager\" : undefined;\n\t\tthis.sessionKeyForRedaction = this.pendingSessionKey;\n\t\tthis.rebuildSensitiveValues();\n\t}\n\n\tget status(): CredentialConnectionStatus {\n\t\treturn {\n\t\t\tconnected: this.connected,\n\t\t\tsessionAvailable:\n\t\t\t\tthis.connected || Boolean(this.pendingSessionKey) || this.resolveMachineSession !== undefined,\n\t\t};\n\t}\n\n\tasync connect(sessionKey: string, signal?: AbortSignal): Promise<void> {\n\t\tconst previousConnection = this.connectionPromise;\n\t\tthis.connectionGeneration++;\n\t\tlet privateSessionKey = validateSessionKey(sessionKey);\n\t\tthis.pendingSessionKey = privateSessionKey;\n\t\tthis.pendingStorageProvider = \"bitwarden_password_manager\";\n\t\tthis.sessionKeyForRedaction = privateSessionKey;\n\t\tthis.rebuildSensitiveValues();\n\t\tthis.connected = false;\n\t\ttry {\n\t\t\tif (previousConnection) {\n\t\t\t\ttry {\n\t\t\t\t\tawait previousConnection;\n\t\t\t\t} catch {\n\t\t\t\t\t// The superseded connection is expected to fail its generation check.\n\t\t\t\t}\n\t\t\t}\n\t\t\tawait this.ensureConnected(signal);\n\t\t} finally {\n\t\t\tprivateSessionKey = \"\";\n\t\t}\n\t}\n\n\tasync ensureAvailable(signal?: AbortSignal): Promise<CredentialConnectionStatus> {\n\t\tawait this.ensureConnected(signal);\n\t\treturn this.status;\n\t}\n\n\tasync listForProject(cwd: string, signal?: AbortSignal): Promise<CredentialProfileSummary[]> {\n\t\tconst { identity, summaries } = await this.refreshProjectProfiles(cwd, signal);\n\t\treturn summaries.map((summary) => ({\n\t\t\tprofile: validateCredentialProfileName(summary.profile),\n\t\t\t...(summary.description ? { description: validateCredentialDescription(summary.description) } : {}),\n\t\t\tvariableNames: summary.variableNames.map(validateDotenvVariableName),\n\t\t\tboundToCurrentProject: summary.projectKeys.includes(identity.key),\n\t\t}));\n\t}\n\n\tasync activateForProject(cwd: string, profile?: string, signal?: AbortSignal): Promise<CredentialActivationResult> {\n\t\tconst { generation, identity, summaries } = await this.refreshProjectProfiles(cwd, signal);\n\t\tlet selected: StoredCredentialProfileSummary | undefined;\n\t\tif (profile !== undefined) {\n\t\t\tvalidateCredentialProfileName(profile);\n\t\t\tselected = summaries.find((summary) => summary.profile === profile);\n\t\t\tif (!selected) throw new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t\tif (!selected.projectKeys.includes(identity.key)) {\n\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\"project_not_bound\",\n\t\t\t\t\t\"Credential profile is not authorized for the current project.\",\n\t\t\t\t);\n\t\t\t}\n\t\t} else {\n\t\t\tconst candidates = summaries.filter((summary) => summary.projectKeys.includes(identity.key));\n\t\t\tif (candidates.length === 0) {\n\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\"profile_not_found\",\n\t\t\t\t\t\"No credential profile is bound to the current project. The owner can configure one with /secrets.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\tif (candidates.length > 1) {\n\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\"ambiguous_project_binding\",\n\t\t\t\t\t\"Multiple credential profiles are bound to the current project; select a profile by name.\",\n\t\t\t\t);\n\t\t\t}\n\t\t\t[selected] = candidates;\n\t\t}\n\n\t\tif (!selected) throw new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\tconst record = validateCredentialProfileRecord(await this.storage.readProfile(selected.profile, signal));\n\t\tthis.assertAccessGeneration(generation);\n\t\tif (!record.projectKeys.includes(identity.key)) {\n\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\"project_not_bound\",\n\t\t\t\t\"Credential profile is not authorized for the current project.\",\n\t\t\t);\n\t\t}\n\t\tthis.activate(identity.root, record);\n\t\treturn {\n\t\t\tstatus: \"activated\",\n\t\t\tprofile: record.profile,\n\t\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\t\tproject: identity.label,\n\t\t};\n\t}\n\n\tasync storeForProject(\n\t\tcwd: string,\n\t\tinput: { profile: string; description?: string; dotenv: string },\n\t\tsignal?: AbortSignal,\n\t): Promise<CredentialMutationResult> {\n\t\tconst parsed = parseDotenvDocument(input.dotenv);\n\t\treturn this.storeVariablesForProject(\n\t\t\tcwd,\n\t\t\t{ profile: input.profile, description: input.description, variables: parsed.variables, replaceExisting: true },\n\t\t\tsignal,\n\t\t);\n\t}\n\n\tasync prepareForMigration(\n\t\tcwd: string,\n\t\tinput: { profile: string; replaceExisting?: boolean },\n\t\tsignal?: AbortSignal,\n\t): Promise<void> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst profile = validateCredentialProfileName(input.profile);\n\t\tvalidateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tfindReplaceableProfile(summaries, profile, input.replaceExisting);\n\t}\n\n\tasync storeVariablesForProject(\n\t\tcwd: string,\n\t\tinput: { profile: string; description?: string; variables: CredentialVariable[]; replaceExisting?: boolean },\n\t\tsignal?: AbortSignal,\n\t): Promise<CredentialMutationResult> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst profile = validateCredentialProfileName(input.profile);\n\t\tconst description = validateCredentialDescription(input.description);\n\t\tconst identity = validateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst existing = findReplaceableProfile(summaries, profile, input.replaceExisting);\n\t\tconst existingRecord = existing\n\t\t\t? validateCredentialProfileRecord(await this.storage.readProfile(profile, signal))\n\t\t\t: undefined;\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst projectKeys = existingRecord ? [...new Set([...existingRecord.projectKeys, identity.key])] : [identity.key];\n\t\tconst record: CredentialProfileRecord = {\n\t\t\tprofile,\n\t\t\t...((description ?? existingRecord?.description)\n\t\t\t\t? { description: description ?? existingRecord?.description }\n\t\t\t\t: {}),\n\t\t\tvariables: input.variables.map((variable) => ({ name: variable.name, value: variable.value })),\n\t\t\tprojectKeys,\n\t\t};\n\t\tvalidateCredentialProfileRecord(record);\n\t\tawait this.storage.writeProfile(record, signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tthis.activate(identity.root, record);\n\t\treturn {\n\t\t\tstatus: \"stored\",\n\t\t\tprofile,\n\t\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\t\tproject: identity.label,\n\t\t\tportable: identity.portable,\n\t\t};\n\t}\n\n\tasync bindProfileToProject(cwd: string, profile: string, signal?: AbortSignal): Promise<CredentialMutationResult> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tvalidateCredentialProfileName(profile);\n\t\tconst identity = validateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tif (!summaries.some((summary) => summary.profile === profile)) {\n\t\t\tthrow new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\t}\n\t\tconst record = validateCredentialProfileRecord(await this.storage.readProfile(profile, signal));\n\t\tthis.assertAccessGeneration(generation);\n\t\tif (!record.projectKeys.includes(identity.key)) record.projectKeys.push(identity.key);\n\t\tvalidateCredentialProfileRecord(record);\n\t\tawait this.storage.writeProfile(record, signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\treturn {\n\t\t\tstatus: \"bound\",\n\t\t\tprofile,\n\t\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\t\tproject: identity.label,\n\t\t\tportable: identity.portable,\n\t\t};\n\t}\n\n\tasync removeProfile(profile: string, signal?: AbortSignal): Promise<CredentialMutationResult> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tvalidateCredentialProfileName(profile);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summary = summaries.find((candidate) => candidate.profile === profile);\n\t\tif (!summary) throw new CredentialManagerError(\"profile_not_found\", \"Credential profile was not found.\");\n\t\tawait this.storage.deleteProfile(profile, signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tlet removedActiveEnvironment = false;\n\t\tfor (const [root, active] of this.activeEnvironments) {\n\t\t\tif (active.profile === profile) {\n\t\t\t\tthis.activeEnvironments.delete(root);\n\t\t\t\tremovedActiveEnvironment = true;\n\t\t\t}\n\t\t}\n\t\tthis.rebuildSensitiveValues();\n\t\tif (removedActiveEnvironment) this.onEnvironmentChanged();\n\t\treturn { status: \"removed\", profile, variableNames: [...summary.variableNames] };\n\t}\n\n\tgetEnvironmentForCwd(cwd: string): Record<string, string> | undefined {\n\t\tconst target = resolve(cwd);\n\t\tconst direct = this.findActiveEnvironment(target);\n\t\tconst selected = direct ?? this.findActiveEnvironment(canonicalizeExistingPath(target));\n\t\treturn selected ? cloneEnvironment(selected.values) : undefined;\n\t}\n\n\tprivate findActiveEnvironment(target: string): ActiveCredentialEnvironment | undefined {\n\t\tlet selected: ActiveCredentialEnvironment | undefined;\n\t\tfor (const active of this.activeEnvironments.values()) {\n\t\t\tif (!isPathInside(active.root, target)) continue;\n\t\t\tif (!selected || active.root.length > selected.root.length) selected = active;\n\t\t}\n\t\treturn selected;\n\t}\n\n\thasEnvironmentForCwd(cwd: string): boolean {\n\t\treturn this.getEnvironmentForCwd(cwd) !== undefined;\n\t}\n\n\tredactSensitiveText(text: string): string {\n\t\tlet redacted = text;\n\t\tfor (const value of [...this.sensitiveValues].sort((left, right) => right.length - left.length)) {\n\t\t\tif (value.length > 0) redacted = redacted.split(value).join(\"[REDACTED_SECRET]\");\n\t\t}\n\t\treturn redacted;\n\t}\n\n\tlock(): void {\n\t\tconst hadActiveEnvironment = this.activeEnvironments.size > 0;\n\t\tthis.connectionGeneration++;\n\t\tthis.storage.lock();\n\t\tthis.connected = false;\n\t\tthis.pendingSessionKey = undefined;\n\t\tthis.pendingStorageProvider = undefined;\n\t\tthis.sessionKeyForRedaction = undefined;\n\t\tthis.connectionPromise = undefined;\n\t\tthis.activeEnvironments.clear();\n\t\tthis.sensitiveValues.clear();\n\t\tif (hadActiveEnvironment) this.onEnvironmentChanged();\n\t}\n\n\tprivate async ensureConnected(signal?: AbortSignal): Promise<void> {\n\t\tif (this.connected) return;\n\t\tif (this.connectionPromise) return this.connectionPromise;\n\t\tconst generation = this.connectionGeneration;\n\t\tconst connectionPromise = (async () => {\n\t\t\tlet sessionKey = this.pendingSessionKey;\n\t\t\tlet provider = this.pendingStorageProvider;\n\t\t\ttry {\n\t\t\t\tif (!sessionKey && this.resolveMachineSession) {\n\t\t\t\t\tconst machineSession = await this.resolveMachineSession(signal);\n\t\t\t\t\tif (generation !== this.connectionGeneration) {\n\t\t\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\t\t\"owner_setup_required\",\n\t\t\t\t\t\t\t\"Bitwarden connection was cancelled when the owner locked credentials.\",\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t\tif (machineSession) {\n\t\t\t\t\t\tif (\n\t\t\t\t\t\t\tmachineSession.provider !== \"bitwarden_password_manager\" &&\n\t\t\t\t\t\t\tmachineSession.provider !== \"bitwarden_secrets_manager\"\n\t\t\t\t\t\t) {\n\t\t\t\t\t\t\tthrow new CredentialManagerError(\"invalid_session_key\", \"The Bitwarden provider is invalid.\");\n\t\t\t\t\t\t}\n\t\t\t\t\t\tsessionKey = validateSessionKey(machineSession.sessionKey);\n\t\t\t\t\t\tprovider = machineSession.provider;\n\t\t\t\t\t\tthis.pendingSessionKey = sessionKey;\n\t\t\t\t\t\tthis.pendingStorageProvider = provider;\n\t\t\t\t\t\tthis.sessionKeyForRedaction = sessionKey;\n\t\t\t\t\t\tthis.rebuildSensitiveValues();\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif (!sessionKey || !provider) {\n\t\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\t\"owner_setup_required\",\n\t\t\t\t\t\t\"No machine-owned Bitwarden session is available; TUI can accept one masked BW_SESSION key.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tawait this.storage.connect(sessionKey, signal, provider);\n\t\t\t\tif (generation !== this.connectionGeneration) {\n\t\t\t\t\tthis.storage.lock();\n\t\t\t\t\tthrow new CredentialManagerError(\n\t\t\t\t\t\t\"owner_setup_required\",\n\t\t\t\t\t\t\"Bitwarden connection was cancelled when the owner locked credentials.\",\n\t\t\t\t\t);\n\t\t\t\t}\n\t\t\t\tthis.connected = true;\n\t\t\t} finally {\n\t\t\t\tif (generation === this.connectionGeneration) {\n\t\t\t\t\tthis.pendingSessionKey = undefined;\n\t\t\t\t\tthis.pendingStorageProvider = undefined;\n\t\t\t\t}\n\t\t\t\tif (sessionKey) sessionKey = \"\";\n\t\t\t}\n\t\t})();\n\t\tthis.connectionPromise = connectionPromise;\n\t\ttry {\n\t\t\tawait connectionPromise;\n\t\t} finally {\n\t\t\tif (this.connectionPromise === connectionPromise) this.connectionPromise = undefined;\n\t\t}\n\t}\n\n\tprivate assertAccessGeneration(generation: number): void {\n\t\tif (generation === this.connectionGeneration && this.connected) return;\n\t\tthrow new CredentialManagerError(\n\t\t\t\"owner_setup_required\",\n\t\t\t\"Bitwarden credential access was cancelled when the owner locked credentials.\",\n\t\t);\n\t}\n\n\tprivate async refreshProjectProfiles(\n\t\tcwd: string,\n\t\tsignal?: AbortSignal,\n\t): Promise<{\n\t\tgeneration: number;\n\t\tidentity: CredentialProjectIdentity;\n\t\tsummaries: StoredCredentialProfileSummary[];\n\t}> {\n\t\tawait this.ensureConnected(signal);\n\t\tconst generation = this.connectionGeneration;\n\t\tthis.assertAccessGeneration(generation);\n\t\tawait this.storage.refresh?.(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst identity = validateProjectIdentity(await this.resolveProject(cwd));\n\t\tthis.assertAccessGeneration(generation);\n\t\tconst summaries = await this.storage.listProfiles(signal);\n\t\tthis.assertAccessGeneration(generation);\n\t\treturn { generation, identity, summaries };\n\t}\n\n\tprivate activate(root: string, record: CredentialProfileRecord): void {\n\t\tconst values = Object.fromEntries(record.variables.map((variable) => [variable.name, variable.value]));\n\t\tthis.activeEnvironments.set(resolve(root), { profile: record.profile, root: resolve(root), values });\n\t\tthis.rebuildSensitiveValues();\n\t\tthis.onEnvironmentChanged();\n\t}\n\n\tprivate rebuildSensitiveValues(): void {\n\t\tthis.sensitiveValues.clear();\n\t\tif (this.sessionKeyForRedaction) this.sensitiveValues.add(this.sessionKeyForRedaction);\n\t\tfor (const active of this.activeEnvironments.values()) {\n\t\t\tfor (const value of Object.values(active.values)) this.sensitiveValues.add(value);\n\t\t}\n\t}\n}\n"]}
package/dist/core/secrets/credential-profile-envelope.d.ts ADDED
@@ -0,0 +1,10 @@
1
+ import { type CredentialProfileRecord, type StoredCredentialProfileSummary } from "./credential-manager.ts";
2
+ export declare const CREDENTIAL_PROFILE_KEY_PREFIX = "Pi credential profile \u00B7 ";
3
+ export declare class CredentialProfileEnvelopeError extends Error {
4
+ constructor(message: string);
5
+ }
6
+ export declare function serializeCredentialProfileEnvelope(record: CredentialProfileRecord): string;
7
+ export declare function parseCredentialProfileEnvelope(value: string, expectedProfile: string): CredentialProfileRecord;
8
+ /** Provider-neutral metadata projection and ordering for stored profiles. */
9
+ export declare function summarizeCredentialProfiles(records: Iterable<CredentialProfileRecord>): StoredCredentialProfileSummary[];
10
+ //# sourceMappingURL=credential-profile-envelope.d.ts.map
package/dist/core/secrets/credential-profile-envelope.d.ts.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"credential-profile-envelope.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/credential-profile-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,EAEnC,MAAM,yBAAyB,CAAC;AAEjC,eAAO,MAAM,6BAA6B,kCAA6B,CAAC;AAcxE,qBAAa,8BAA+B,SAAQ,KAAK;IACxD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACD;AAMD,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAW1F;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,uBAAuB,CAwC9G;AAED,6EAA6E;AAC7E,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,QAAQ,CAAC,uBAAuB,CAAC,GACxC,8BAA8B,EAAE,CASlC"}
package/dist/core/secrets/credential-profile-envelope.js ADDED
@@ -0,0 +1,78 @@
1
+ import { validateCredentialProfileRecord, } from "./credential-manager.js";
2
+ export const CREDENTIAL_PROFILE_KEY_PREFIX = "Pi credential profile · ";
3
+ const ENVELOPE_KIND = "pi.credential-profile";
4
+ const ENVELOPE_SCHEMA = 1;
5
+ const MAX_ENVELOPE_BYTES = 1024 * 1024;
6
+ export class CredentialProfileEnvelopeError extends Error {
7
+ constructor(message) {
8
+ super(message);
9
+ this.name = "CredentialProfileEnvelopeError";
10
+ }
11
+ }
12
+ function isObject(value) {
13
+ return typeof value === "object" && value !== null && !Array.isArray(value);
14
+ }
15
+ export function serializeCredentialProfileEnvelope(record) {
16
+ validateCredentialProfileRecord(record);
17
+ const envelope = {
18
+ kind: ENVELOPE_KIND,
19
+ schema: ENVELOPE_SCHEMA,
20
+ profile: record.profile,
21
+ ...(record.description ? { description: record.description } : {}),
22
+ variables: record.variables.map((variable) => ({ ...variable })),
23
+ projectKeys: [...record.projectKeys],
24
+ };
25
+ return JSON.stringify(envelope);
26
+ }
27
+ export function parseCredentialProfileEnvelope(value, expectedProfile) {
28
+ if (Buffer.byteLength(value, "utf8") > MAX_ENVELOPE_BYTES) {
29
+ throw new CredentialProfileEnvelopeError("Credential provider returned an oversized profile record.");
30
+ }
31
+ let parsed;
32
+ try {
33
+ parsed = JSON.parse(value);
34
+ }
35
+ catch {
36
+ throw new CredentialProfileEnvelopeError("Credential provider returned malformed profile data.");
37
+ }
38
+ if (!isObject(parsed) ||
39
+ parsed.kind !== ENVELOPE_KIND ||
40
+ parsed.schema !== ENVELOPE_SCHEMA ||
41
+ parsed.profile !== expectedProfile ||
42
+ (parsed.description !== undefined && typeof parsed.description !== "string") ||
43
+ !Array.isArray(parsed.variables) ||
44
+ !Array.isArray(parsed.projectKeys) ||
45
+ !parsed.variables.every((variable) => isObject(variable) && typeof variable.name === "string" && typeof variable.value === "string") ||
46
+ !parsed.projectKeys.every((key) => typeof key === "string")) {
47
+ throw new CredentialProfileEnvelopeError("Credential provider returned malformed profile data.");
48
+ }
49
+ const record = {
50
+ profile: expectedProfile,
51
+ ...(typeof parsed.description === "string" ? { description: parsed.description } : {}),
52
+ variables: parsed.variables.map((variable) => ({
53
+ name: variable.name,
54
+ value: variable.value,
55
+ })),
56
+ projectKeys: parsed.projectKeys,
57
+ };
58
+ try {
59
+ return validateCredentialProfileRecord(record);
60
+ }
61
+ catch {
62
+ for (const variable of record.variables)
63
+ variable.value = "";
64
+ throw new CredentialProfileEnvelopeError("Credential provider returned malformed profile data.");
65
+ }
66
+ }
67
+ /** Provider-neutral metadata projection and ordering for stored profiles. */
68
+ export function summarizeCredentialProfiles(records) {
69
+ return [...records]
70
+ .map((record) => ({
71
+ profile: record.profile,
72
+ ...(record.description ? { description: record.description } : {}),
73
+ variableNames: record.variables.map((variable) => variable.name),
74
+ projectKeys: [...record.projectKeys],
75
+ }))
76
+ .sort((left, right) => left.profile.localeCompare(right.profile));
77
+ }
78
+ //# sourceMappingURL=credential-profile-envelope.js.map
package/dist/core/secrets/credential-profile-envelope.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"credential-profile-envelope.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-profile-envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,+BAA+B,GAC/B,MAAM,yBAAyB,CAAC;AAEjC,MAAM,CAAC,MAAM,6BAA6B,GAAG,0BAA0B,CAAC;AACxE,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAC9C,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAC;AAWvC,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACxD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC9C,CAAC;CACD;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,MAA+B;IACjF,+BAA+B,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,QAAQ,GAA8B;QAC3C,IAAI,EAAE,aAAa;QACnB,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAChE,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;KACpC,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,KAAa,EAAE,eAAuB;IACpF,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,kBAAkB,EAAE,CAAC;QAC3D,MAAM,IAAI,8BAA8B,CAAC,2DAA2D,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,8BAA8B,CAAC,sDAAsD,CAAC,CAAC;IAClG,CAAC;IACD,IACC,CAAC,QAAQ,CAAC,MAAM,CAAC;QACjB,MAAM,CAAC,IAAI,KAAK,aAAa;QAC7B,MAAM,CAAC,MAAM,KAAK,eAAe;QACjC,MAAM,CAAC,OAAO,KAAK,eAAe;QAClC,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC;QAC5E,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;QAChC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QAClC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CACtB,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,CAC3G;QACD,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,EAC1D,CAAC;QACF,MAAM,IAAI,8BAA8B,CAAC,sDAAsD,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,MAAM,GAA4B;QACvC,OAAO,EAAE,eAAe;QACxB,GAAG,CAAC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9C,IAAI,EAAG,QAAoC,CAAC,IAAc;YAC1D,KAAK,EAAG,QAAoC,CAAC,KAAe;SAC5D,CAAC,CAAC;QACH,WAAW,EAAE,MAAM,CAAC,WAAuB;KAC3C,CAAC;IACF,IAAI,CAAC;QACJ,OAAO,+BAA+B,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACR,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS;YAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAA8B,CAAC,sDAAsD,CAAC,CAAC;IAClG,CAAC;AACF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,2BAA2B,CAC1C,OAA0C;IAE1C,OAAO,CAAC,GAAG,OAAO,CAAC;SACjB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC;QAChE,WAAW,EAAE,CAAC,GAAG,MAAM,CAAC,WAAW,CAAC;KACpC,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AACpE,CAAC","sourcesContent":["import {\n\ttype CredentialProfileRecord,\n\ttype StoredCredentialProfileSummary,\n\tvalidateCredentialProfileRecord,\n} from \"./credential-manager.ts\";\n\nexport const CREDENTIAL_PROFILE_KEY_PREFIX = \"Pi credential profile · \";\nconst ENVELOPE_KIND = \"pi.credential-profile\";\nconst ENVELOPE_SCHEMA = 1;\nconst MAX_ENVELOPE_BYTES = 1024 * 1024;\n\ninterface CredentialProfileEnvelope {\n\tkind: typeof ENVELOPE_KIND;\n\tschema: typeof ENVELOPE_SCHEMA;\n\tprofile: string;\n\tdescription?: string;\n\tvariables: Array<{ name: string; value: string }>;\n\tprojectKeys: string[];\n}\n\nexport class CredentialProfileEnvelopeError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"CredentialProfileEnvelopeError\";\n\t}\n}\n\nfunction isObject(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nexport function serializeCredentialProfileEnvelope(record: CredentialProfileRecord): string {\n\tvalidateCredentialProfileRecord(record);\n\tconst envelope: CredentialProfileEnvelope = {\n\t\tkind: ENVELOPE_KIND,\n\t\tschema: ENVELOPE_SCHEMA,\n\t\tprofile: record.profile,\n\t\t...(record.description ? { description: record.description } : {}),\n\t\tvariables: record.variables.map((variable) => ({ ...variable })),\n\t\tprojectKeys: [...record.projectKeys],\n\t};\n\treturn JSON.stringify(envelope);\n}\n\nexport function parseCredentialProfileEnvelope(value: string, expectedProfile: string): CredentialProfileRecord {\n\tif (Buffer.byteLength(value, \"utf8\") > MAX_ENVELOPE_BYTES) {\n\t\tthrow new CredentialProfileEnvelopeError(\"Credential provider returned an oversized profile record.\");\n\t}\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(value) as unknown;\n\t} catch {\n\t\tthrow new CredentialProfileEnvelopeError(\"Credential provider returned malformed profile data.\");\n\t}\n\tif (\n\t\t!isObject(parsed) ||\n\t\tparsed.kind !== ENVELOPE_KIND ||\n\t\tparsed.schema !== ENVELOPE_SCHEMA ||\n\t\tparsed.profile !== expectedProfile ||\n\t\t(parsed.description !== undefined && typeof parsed.description !== \"string\") ||\n\t\t!Array.isArray(parsed.variables) ||\n\t\t!Array.isArray(parsed.projectKeys) ||\n\t\t!parsed.variables.every(\n\t\t\t(variable) => isObject(variable) && typeof variable.name === \"string\" && typeof variable.value === \"string\",\n\t\t) ||\n\t\t!parsed.projectKeys.every((key) => typeof key === \"string\")\n\t) {\n\t\tthrow new CredentialProfileEnvelopeError(\"Credential provider returned malformed profile data.\");\n\t}\n\tconst record: CredentialProfileRecord = {\n\t\tprofile: expectedProfile,\n\t\t...(typeof parsed.description === \"string\" ? { description: parsed.description } : {}),\n\t\tvariables: parsed.variables.map((variable) => ({\n\t\t\tname: (variable as Record<string, unknown>).name as string,\n\t\t\tvalue: (variable as Record<string, unknown>).value as string,\n\t\t})),\n\t\tprojectKeys: parsed.projectKeys as string[],\n\t};\n\ttry {\n\t\treturn validateCredentialProfileRecord(record);\n\t} catch {\n\t\tfor (const variable of record.variables) variable.value = \"\";\n\t\tthrow new CredentialProfileEnvelopeError(\"Credential provider returned malformed profile data.\");\n\t}\n}\n\n/** Provider-neutral metadata projection and ordering for stored profiles. */\nexport function summarizeCredentialProfiles(\n\trecords: Iterable<CredentialProfileRecord>,\n): StoredCredentialProfileSummary[] {\n\treturn [...records]\n\t\t.map((record) => ({\n\t\t\tprofile: record.profile,\n\t\t\t...(record.description ? { description: record.description } : {}),\n\t\t\tvariableNames: record.variables.map((variable) => variable.name),\n\t\t\tprojectKeys: [...record.projectKeys],\n\t\t}))\n\t\t.sort((left, right) => left.profile.localeCompare(right.profile));\n}\n"]}
package/dist/core/secrets/credential-session-connection.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"credential-session-connection.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/credential-session-connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,KAAK,iBAAiB,EAAkD,MAAM,yBAAyB,CAAC;AAEjH,MAAM,MAAM,iCAAiC,GAAG,WAAW,GAAG,WAAW,CAAC;AAE1E,KAAK,mBAAmB,GAAG,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;AAExE,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAMtE;AAQD,gFAAgF;AAChF,wBAAsB,wCAAwC,CAC7D,OAAO,EAAE,iBAAiB,EAC1B,EAAE,EAAE,mBAAmB,EACvB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,iCAAiC,CAAC,CAoB5C"}
1
+ {"version":3,"file":"credential-session-connection.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/credential-session-connection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,KAAK,iBAAiB,EAAkD,MAAM,yBAAyB,CAAC;AAEjH,MAAM,MAAM,iCAAiC,GAAG,WAAW,GAAG,WAAW,CAAC;AAE1E,KAAK,mBAAmB,GAAG,IAAI,CAAC,kBAAkB,EAAE,OAAO,GAAG,QAAQ,CAAC,CAAC;AAExE,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAOtE;AAQD,gFAAgF;AAChF,wBAAsB,wCAAwC,CAC7D,OAAO,EAAE,iBAAiB,EAC1B,EAAE,EAAE,mBAAmB,EACvB,MAAM,CAAC,EAAE,WAAW,GAClB,OAAO,CAAC,iCAAiC,CAAC,CAoB5C"}
package/dist/core/secrets/credential-session-connection.js CHANGED
@@ -2,7 +2,8 @@ import { CredentialManagerError, CredentialStorageError } from "./credential-man
2
2
  export function isCredentialSessionKeyRequired(error) {
3
3
  return ((error instanceof CredentialManagerError &&
4
4
  ["invalid_session_key", "owner_setup_required"].includes(error.code)) ||
5
- (error instanceof CredentialStorageError && ["not_connected", "provider_command_failed"].includes(error.code)));
5
+ (error instanceof CredentialStorageError &&
6
+ ["not_connected", "provider_command_failed", "provider_unavailable"].includes(error.code)));
6
7
  }
7
8
  function safeConnectionError(error) {
8
9
  return error instanceof CredentialManagerError || error instanceof CredentialStorageError
package/dist/core/secrets/credential-session-connection.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"credential-session-connection.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-session-connection.ts"],"names":[],"mappings":"AACA,OAAO,EAA0B,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAMjH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC5D,OAAO,CACN,CAAC,KAAK,YAAY,sBAAsB;QACvC,CAAC,qBAAqB,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtE,CAAC,KAAK,YAAY,sBAAsB,IAAI,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAC9G,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,KAAK,YAAY,sBAAsB,IAAI,KAAK,YAAY,sBAAsB;QACxF,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,mEAAmE,CAAC;AACxE,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC7D,OAA0B,EAC1B,EAAuB,EACvB,MAAoB;IAEpB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,8BAA8B,EAAE;YACpF,SAAS,EAAE,IAAI;YACf,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC;QACjD,IAAI,CAAC;YACJ,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC1C,EAAE,CAAC,MAAM,CAAC,+DAA+D,EAAE,MAAM,CAAC,CAAC;YACnF,OAAO,WAAW,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,WAAW,CAAC;YACxC,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACxD,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;gBAAS,CAAC;YACV,UAAU,GAAG,EAAE,CAAC;QACjB,CAAC;IACF,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC","sourcesContent":["import type { ExtensionUIContext } from \"../extensions/types.ts\";\nimport { type CredentialManager, CredentialManagerError, CredentialStorageError } from \"./credential-manager.ts\";\n\nexport type CredentialSessionConnectionResult = \"cancelled\" | \"connected\";\n\ntype CredentialSessionUI = Pick<ExtensionUIContext, \"input\" | \"notify\">;\n\nexport function isCredentialSessionKeyRequired(error: unknown): boolean {\n\treturn (\n\t\t(error instanceof CredentialManagerError &&\n\t\t\t[\"invalid_session_key\", \"owner_setup_required\"].includes(error.code)) ||\n\t\t(error instanceof CredentialStorageError && [\"not_connected\", \"provider_command_failed\"].includes(error.code))\n\t);\n}\n\nfunction safeConnectionError(error: unknown): string {\n\treturn error instanceof CredentialManagerError || error instanceof CredentialStorageError\n\t\t? error.message\n\t\t: \"Bitwarden connection failed safely without exposing private data.\";\n}\n\n/** Own the only Pi-side vault setup input: one masked BW_SESSION key prompt. */\nexport async function connectCredentialSessionWithMaskedPrompt(\n\tmanager: CredentialManager,\n\tui: CredentialSessionUI,\n\tsignal?: AbortSignal,\n): Promise<CredentialSessionConnectionResult> {\n\twhile (!signal?.aborted) {\n\t\tlet sessionKey = await ui.input(\"Connect Bitwarden\", \"Paste BW_SESSION session key\", {\n\t\t\tsensitive: true,\n\t\t\t...(signal ? { signal } : {}),\n\t\t});\n\t\tif (sessionKey === undefined) return \"cancelled\";\n\t\ttry {\n\t\t\tawait manager.connect(sessionKey, signal);\n\t\t\tui.notify(\"Bitwarden connected. Pi keeps the session key in memory only.\", \"info\");\n\t\t\treturn \"connected\";\n\t\t} catch (error) {\n\t\t\tif (signal?.aborted) return \"cancelled\";\n\t\t\tif (!isCredentialSessionKeyRequired(error)) throw error;\n\t\t\tui.notify(safeConnectionError(error), \"error\");\n\t\t} finally {\n\t\t\tsessionKey = \"\";\n\t\t}\n\t}\n\treturn \"cancelled\";\n}\n"]}
1
+ {"version":3,"file":"credential-session-connection.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-session-connection.ts"],"names":[],"mappings":"AACA,OAAO,EAA0B,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAMjH,MAAM,UAAU,8BAA8B,CAAC,KAAc;IAC5D,OAAO,CACN,CAAC,KAAK,YAAY,sBAAsB;QACvC,CAAC,qBAAqB,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtE,CAAC,KAAK,YAAY,sBAAsB;YACvC,CAAC,eAAe,EAAE,yBAAyB,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAC3F,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,OAAO,KAAK,YAAY,sBAAsB,IAAI,KAAK,YAAY,sBAAsB;QACxF,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,mEAAmE,CAAC;AACxE,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,wCAAwC,CAC7D,OAA0B,EAC1B,EAAuB,EACvB,MAAoB;IAEpB,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACzB,IAAI,UAAU,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,8BAA8B,EAAE;YACpF,SAAS,EAAE,IAAI;YACf,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,WAAW,CAAC;QACjD,IAAI,CAAC;YACJ,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC1C,EAAE,CAAC,MAAM,CAAC,+DAA+D,EAAE,MAAM,CAAC,CAAC;YACnF,OAAO,WAAW,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,WAAW,CAAC;YACxC,IAAI,CAAC,8BAA8B,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YACxD,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC;gBAAS,CAAC;YACV,UAAU,GAAG,EAAE,CAAC;QACjB,CAAC;IACF,CAAC;IACD,OAAO,WAAW,CAAC;AACpB,CAAC","sourcesContent":["import type { ExtensionUIContext } from \"../extensions/types.ts\";\nimport { type CredentialManager, CredentialManagerError, CredentialStorageError } from \"./credential-manager.ts\";\n\nexport type CredentialSessionConnectionResult = \"cancelled\" | \"connected\";\n\ntype CredentialSessionUI = Pick<ExtensionUIContext, \"input\" | \"notify\">;\n\nexport function isCredentialSessionKeyRequired(error: unknown): boolean {\n\treturn (\n\t\t(error instanceof CredentialManagerError &&\n\t\t\t[\"invalid_session_key\", \"owner_setup_required\"].includes(error.code)) ||\n\t\t(error instanceof CredentialStorageError &&\n\t\t\t[\"not_connected\", \"provider_command_failed\", \"provider_unavailable\"].includes(error.code))\n\t);\n}\n\nfunction safeConnectionError(error: unknown): string {\n\treturn error instanceof CredentialManagerError || error instanceof CredentialStorageError\n\t\t? error.message\n\t\t: \"Bitwarden connection failed safely without exposing private data.\";\n}\n\n/** Own the only Pi-side vault setup input: one masked BW_SESSION key prompt. */\nexport async function connectCredentialSessionWithMaskedPrompt(\n\tmanager: CredentialManager,\n\tui: CredentialSessionUI,\n\tsignal?: AbortSignal,\n): Promise<CredentialSessionConnectionResult> {\n\twhile (!signal?.aborted) {\n\t\tlet sessionKey = await ui.input(\"Connect Bitwarden\", \"Paste BW_SESSION session key\", {\n\t\t\tsensitive: true,\n\t\t\t...(signal ? { signal } : {}),\n\t\t});\n\t\tif (sessionKey === undefined) return \"cancelled\";\n\t\ttry {\n\t\t\tawait manager.connect(sessionKey, signal);\n\t\t\tui.notify(\"Bitwarden connected. Pi keeps the session key in memory only.\", \"info\");\n\t\t\treturn \"connected\";\n\t\t} catch (error) {\n\t\t\tif (signal?.aborted) return \"cancelled\";\n\t\t\tif (!isCredentialSessionKeyRequired(error)) throw error;\n\t\t\tui.notify(safeConnectionError(error), \"error\");\n\t\t} finally {\n\t\t\tsessionKey = \"\";\n\t\t}\n\t}\n\treturn \"cancelled\";\n}\n"]}
package/dist/core/secrets/credential-source-discovery.d.ts CHANGED
@@ -14,10 +14,14 @@ export interface CredentialMigrationDiscoveryResult {
14
14
  truncated: boolean;
15
15
  }
16
16
  export type CredentialMigrationSourceDiscoverer = (cwd: string, signal?: AbortSignal) => Promise<CredentialMigrationDiscoveryResult>;
17
+ export interface CredentialMigrationDiscoveryOptions {
18
+ additionalRoots?: readonly string[];
19
+ excludedFiles?: readonly string[];
20
+ }
17
21
  /**
18
22
  * Discover supported credential sources without returning their values. The scan is deliberately
19
- * bounded to the current working tree plus the current process environment, never follows symlinks,
20
- * and skips dependency/build trees and dotenv templates.
23
+ * bounded to the current working tree, explicit machine roots, and the current process environment.
24
+ * It never follows symlinks and skips dependency/build trees, dotenv templates, and store bootstraps.
21
25
  */
22
- export declare function discoverCredentialMigrationSources(cwd: string, signal?: AbortSignal, environment?: NodeJS.ProcessEnv): Promise<CredentialMigrationDiscoveryResult>;
26
+ export declare function discoverCredentialMigrationSources(cwd: string, signal?: AbortSignal, environment?: NodeJS.ProcessEnv, options?: CredentialMigrationDiscoveryOptions): Promise<CredentialMigrationDiscoveryResult>;
23
27
  //# sourceMappingURL=credential-source-discovery.d.ts.map
package/dist/core/secrets/credential-source-discovery.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"credential-source-discovery.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/credential-source-discovery.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,yBAAyB,EAAqC,MAAM,kCAAkC,CAAC;AA8BrH,MAAM,MAAM,qCAAqC,GAAG,qBAAqB,GAAG,uBAAuB,CAAC;AAEpG,qBAAa,iCAAkC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,IAAI,EAAE,qCAAqC,CAAC;IAErD,YAAY,IAAI,EAAE,qCAAqC,EAAE,OAAO,EAAE,MAAM,EAIvE;CACD;AAED,MAAM,WAAW,kCAAkC;IAClD,MAAM,EAAE,yBAAyB,CAAC;IAClC,aAAa,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,kCAAkC;IAClD,UAAU,EAAE,kCAAkC,EAAE,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,mCAAmC,GAAG,CACjD,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,WAAW,KAChB,OAAO,CAAC,kCAAkC,CAAC,CAAC;AAoDjD;;;;GAIG;AACH,wBAAsB,kCAAkC,CACvD,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,WAAW,EACpB,WAAW,GAAE,MAAM,CAAC,UAAwB,GAC1C,OAAO,CAAC,kCAAkC,CAAC,CA0G7C"}
1
+ {"version":3,"file":"credential-source-discovery.d.ts","sourceRoot":"","sources":["../../../src/core/secrets/credential-source-discovery.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,KAAK,yBAAyB,EAAqC,MAAM,kCAAkC,CAAC;AAgCrH,MAAM,MAAM,qCAAqC,GAAG,qBAAqB,GAAG,uBAAuB,CAAC;AAEpG,qBAAa,iCAAkC,SAAQ,KAAK;IAC3D,QAAQ,CAAC,IAAI,EAAE,qCAAqC,CAAC;IAErD,YAAY,IAAI,EAAE,qCAAqC,EAAE,OAAO,EAAE,MAAM,EAIvE;CACD;AAED,MAAM,WAAW,kCAAkC;IAClD,MAAM,EAAE,yBAAyB,CAAC;IAClC,aAAa,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,kCAAkC;IAClD,UAAU,EAAE,kCAAkC,EAAE,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,MAAM,mCAAmC,GAAG,CACjD,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,WAAW,KAChB,OAAO,CAAC,kCAAkC,CAAC,CAAC;AAEjD,MAAM,WAAW,mCAAmC;IACnD,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC;AAoDD;;;;GAIG;AACH,wBAAsB,kCAAkC,CACvD,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,WAAW,EACpB,WAAW,GAAE,MAAM,CAAC,UAAwB,EAC5C,OAAO,GAAE,mCAAwC,GAC/C,OAAO,CAAC,kCAAkC,CAAC,CAgJ7C"}
package/dist/core/secrets/credential-source-discovery.js CHANGED
@@ -1,7 +1,8 @@
1
1
  import { readdir, realpath, stat } from "node:fs/promises";
2
- import { join, relative } from "node:path";
2
+ import { join, relative, resolve } from "node:path";
3
3
  import { resolveCredentialMigrationSources } from "./credential-migration-source.js";
4
4
  const MAX_DISCOVERY_DEPTH = 6;
5
+ const MAX_DISCOVERY_ROOTS = 8;
5
6
  const MAX_DISCOVERY_DIRECTORIES = 256;
6
7
  const MAX_DISCOVERY_ENTRIES = 10_000;
7
8
  const MAX_DISCOVERY_ENVIRONMENT_CANDIDATES = 32;
@@ -26,7 +27,8 @@ const EXCLUDED_DIRECTORY_NAMES = new Set([
26
27
  const DOTENV_TEMPLATE_NAME_RE = /(?:^|[._-])(?:defaults?|dist|example|sample|template)(?:$|[._-])/i;
27
28
  const CREDENTIAL_ENV_NAME_RE = /(?:^|_)(?:ACCESS_KEY|API_KEY|CREDENTIALS?|CLIENT_SECRET|PASS|PASSWORD|PRIVATE_KEY|SECRET|TOKEN)(?:_|$)/i;
28
29
  const CREDENTIAL_URL_NAME_RE = /^(?:DATABASE|DB|MONGO(?:DB)?|MYSQL|POSTGRES(?:QL)?|REDIS)_URL$/i;
29
- const EXCLUDED_ENVIRONMENT_NAMES = new Set(["BW_SESSION"]);
30
+ const EXCLUDED_ENVIRONMENT_NAMES = new Set(["BWS_ACCESS_TOKEN", "BW_SESSION"]);
31
+ const EXCLUDED_BOOTSTRAP_FILE_NAMES = new Set(["bws.env", "bw.env"]);
30
32
  export class CredentialMigrationDiscoveryError extends Error {
31
33
  constructor(code, message) {
32
34
  super(message);
@@ -75,10 +77,10 @@ async function inspectSource(source, cwd, signal, environment) {
75
77
  }
76
78
  /**
77
79
  * Discover supported credential sources without returning their values. The scan is deliberately
78
- * bounded to the current working tree plus the current process environment, never follows symlinks,
79
- * and skips dependency/build trees and dotenv templates.
80
+ * bounded to the current working tree, explicit machine roots, and the current process environment.
81
+ * It never follows symlinks and skips dependency/build trees, dotenv templates, and store bootstraps.
80
82
  */
81
- export async function discoverCredentialMigrationSources(cwd, signal, environment = process.env) {
83
+ export async function discoverCredentialMigrationSources(cwd, signal, environment = process.env, options = {}) {
82
84
  throwIfCancelled(signal);
83
85
  let root;
84
86
  try {
@@ -96,6 +98,7 @@ export async function discoverCredentialMigrationSources(cwd, signal, environmen
96
98
  let dotenvCandidateCount = 0;
97
99
  let variableNameCount = 0;
98
100
  let metadataBytes = 0;
101
+ const excludedFiles = new Set((options.excludedFiles ?? []).map((path) => resolve(path)));
99
102
  const addCandidate = (candidate, category) => {
100
103
  const categoryCount = category === "environment" ? environmentCandidateCount : dotenvCandidateCount;
101
104
  const categoryLimit = category === "environment" ? MAX_DISCOVERY_ENVIRONMENT_CANDIDATES : MAX_DISCOVERY_DOTENV_CANDIDATES;
@@ -129,7 +132,30 @@ export async function discoverCredentialMigrationSources(cwd, signal, environmen
129
132
  if (!addCandidate({ source, variableNames }, "environment"))
130
133
  break;
131
134
  }
132
- const directories = [{ path: root, depth: 0 }];
135
+ const scanRoots = [{ path: root, relativeToProject: true }];
136
+ const seenRoots = new Set([root]);
137
+ const requestedAdditionalRoots = options.additionalRoots ?? [];
138
+ if (requestedAdditionalRoots.length > MAX_DISCOVERY_ROOTS - 1)
139
+ truncated = true;
140
+ for (const candidate of requestedAdditionalRoots.slice(0, MAX_DISCOVERY_ROOTS - 1)) {
141
+ throwIfCancelled(signal);
142
+ let canonical;
143
+ try {
144
+ canonical = await realpath(candidate);
145
+ if (!(await stat(canonical)).isDirectory())
146
+ throw new Error("not a directory");
147
+ }
148
+ catch {
149
+ skipped++;
150
+ continue;
151
+ }
152
+ if (seenRoots.has(canonical))
153
+ continue;
154
+ seenRoots.add(canonical);
155
+ scanRoots.push({ path: canonical, relativeToProject: false });
156
+ }
157
+ const directories = scanRoots.map((scanRoot) => ({ ...scanRoot, depth: 0 }));
158
+ const queuedDirectories = new Set(scanRoots.map((scanRoot) => scanRoot.path));
133
159
  let directoryIndex = 0;
134
160
  let visitedEntries = 0;
135
161
  let stopDirectoryScan = false;
@@ -161,14 +187,27 @@ export async function discoverCredentialMigrationSources(cwd, signal, environmen
161
187
  continue;
162
188
  const path = join(current.path, entry.name);
163
189
  if (entry.isDirectory()) {
164
- if (current.depth < MAX_DISCOVERY_DEPTH && !EXCLUDED_DIRECTORY_NAMES.has(entry.name.toLowerCase())) {
165
- directories.push({ path, depth: current.depth + 1 });
190
+ if (current.depth < MAX_DISCOVERY_DEPTH &&
191
+ !EXCLUDED_DIRECTORY_NAMES.has(entry.name.toLowerCase()) &&
192
+ !queuedDirectories.has(path)) {
193
+ queuedDirectories.add(path);
194
+ directories.push({
195
+ path,
196
+ depth: current.depth + 1,
197
+ relativeToProject: current.relativeToProject,
198
+ });
166
199
  }
167
200
  continue;
168
201
  }
169
202
  if (!entry.isFile() || !isDotenvCandidateName(entry.name))
170
203
  continue;
171
- const source = { kind: "dotenv_file", path: relative(root, path) };
204
+ if (EXCLUDED_BOOTSTRAP_FILE_NAMES.has(entry.name.toLowerCase()) || excludedFiles.has(resolve(path))) {
205
+ continue;
206
+ }
207
+ const source = {
208
+ kind: "dotenv_file",
209
+ path: current.relativeToProject ? relative(root, path) : path,
210
+ };
172
211
  const variableNames = await inspectSource(source, root, signal, environment);
173
212
  throwIfCancelled(signal);
174
213
  if (!variableNames) {
package/dist/core/secrets/credential-source-discovery.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"credential-source-discovery.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-source-discovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAkC,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AAErH,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,oCAAoC,GAAG,EAAE,CAAC;AAChD,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C,MAAM,4BAA4B,GAAG,GAAG,CAAC;AACzC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACxC,MAAM;IACN,KAAK;IACL,MAAM;IACN,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,OAAO;IACP,UAAU;IACV,MAAM;IACN,cAAc;IACd,QAAQ;IACR,QAAQ;CACR,CAAC,CAAC;AACH,MAAM,uBAAuB,GAAG,mEAAmE,CAAC;AACpG,MAAM,sBAAsB,GAC3B,yGAAyG,CAAC;AAC3G,MAAM,sBAAsB,GAAG,iEAAiE,CAAC;AACjG,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAI3D,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAG3D,YAAY,IAA2C,EAAE,OAAe;QACvE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAkBD,SAAS,gBAAgB,CAAC,MAA+B;IACxD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,iCAAiC,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;IAC3G,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY;IAChD,OAAO,CACN,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACnD,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACxE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IAC1C,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,sBAAsB,CAAC,SAA6C;IAC5E,MAAM,cAAc,GACnB,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa;QACtC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI;QACvB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;YACjC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;YAC1D,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;IAC3B,OAAO,CACN,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC;QACzC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAC3F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,MAAiC,EACjC,GAAW,EACX,MAA+B,EAC/B,WAA8B;IAE9B,IAAI,SAAS,GAAyB,EAAE,CAAC;IACzC,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,iCAAiC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxF,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;YAAS,CAAC;QACV,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;QACtD,SAAS,GAAG,EAAE,CAAC;IAChB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACvD,GAAW,EACX,MAAoB,EACpB,WAAW,GAAsB,OAAO,CAAC,GAAG;IAE5C,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,iCAAiC,CAAC,uBAAuB,EAAE,2CAA2C,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,UAAU,GAAyC,EAAE,CAAC;IAC5D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,yBAAyB,GAAG,CAAC,CAAC;IAClC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,MAAM,YAAY,GAAG,CACpB,SAA6C,EAC7C,QAAkC,EACxB,EAAE;QACZ,MAAM,aAAa,GAAG,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACpG,MAAM,aAAa,GAClB,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,+BAA+B,CAAC;QACrG,MAAM,iBAAiB,GAAG,aAAa,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC5E,IACC,aAAa,IAAI,aAAa;YAC9B,iBAAiB,GAAG,SAAS,CAAC,aAAa,CAAC,MAAM,GAAG,4BAA4B;YACjF,iBAAiB,GAAG,4BAA4B,EAC/C,CAAC;YACF,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,QAAQ,KAAK,aAAa;YAAE,yBAAyB,EAAE,CAAC;;YACvD,oBAAoB,EAAE,CAAC;QAC5B,iBAAiB,IAAI,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC;QACpD,aAAa,GAAG,iBAAiB,CAAC;QAClC,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9F,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC;YAAE,SAAS;QACjD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,aAAsB,EAAE,IAAI,EAAE,CAAC;QACtD,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC7E,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,aAAa,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,aAAa,CAAC;YAAE,MAAM;IACpE,CAAC;IAED,MAAM,WAAW,GAA2C,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACvF,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,OAAO,cAAc,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClE,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,cAAc,IAAI,yBAAyB,EAAE,CAAC;YACjD,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM;QACP,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;QAC9C,IAAI,OAAyB,CAAC;QAC9B,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzB,cAAc,EAAE,CAAC;YACjB,IAAI,cAAc,GAAG,qBAAqB,EAAE,CAAC;gBAC5C,SAAS,GAAG,IAAI,CAAC;gBACjB,iBAAiB,GAAG,IAAI,CAAC;gBACzB,MAAM;YACP,CAAC;YACD,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzB,IAAI,OAAO,CAAC,KAAK,GAAG,mBAAmB,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBACpG,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;gBACtD,CAAC;gBACD,SAAS;YACV,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACpE,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,aAAsB,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC5E,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YAC7E,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzB,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,OAAO,EAAE,CAAC;gBACV,SAAS;YACV,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACxD,iBAAiB,GAAG,IAAI,CAAC;gBACzB,MAAM;YACP,CAAC;QACF,CAAC;IACF,CAAC;IAED,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC3C,CAAC","sourcesContent":["import type { Dirent } from \"node:fs\";\nimport { readdir, realpath, stat } from \"node:fs/promises\";\nimport { join, relative } from \"node:path\";\nimport type { CredentialVariable } from \"./credential-manager.ts\";\nimport { type CredentialMigrationSource, resolveCredentialMigrationSources } from \"./credential-migration-source.ts\";\n\nconst MAX_DISCOVERY_DEPTH = 6;\nconst MAX_DISCOVERY_DIRECTORIES = 256;\nconst MAX_DISCOVERY_ENTRIES = 10_000;\nconst MAX_DISCOVERY_ENVIRONMENT_CANDIDATES = 32;\nconst MAX_DISCOVERY_DOTENV_CANDIDATES = 32;\nconst MAX_DISCOVERY_VARIABLE_NAMES = 256;\nconst MAX_DISCOVERY_METADATA_BYTES = 64 * 1024;\nconst EXCLUDED_DIRECTORY_NAMES = new Set([\n\t\".git\",\n\t\".hg\",\n\t\".svn\",\n\t\".cache\",\n\t\".next\",\n\t\".turbo\",\n\t\".yarn\",\n\t\"build\",\n\t\"coverage\",\n\t\"dist\",\n\t\"node_modules\",\n\t\"target\",\n\t\"vendor\",\n]);\nconst DOTENV_TEMPLATE_NAME_RE = /(?:^|[._-])(?:defaults?|dist|example|sample|template)(?:$|[._-])/i;\nconst CREDENTIAL_ENV_NAME_RE =\n\t/(?:^|_)(?:ACCESS_KEY|API_KEY|CREDENTIALS?|CLIENT_SECRET|PASS|PASSWORD|PRIVATE_KEY|SECRET|TOKEN)(?:_|$)/i;\nconst CREDENTIAL_URL_NAME_RE = /^(?:DATABASE|DB|MONGO(?:DB)?|MYSQL|POSTGRES(?:QL)?|REDIS)_URL$/i;\nconst EXCLUDED_ENVIRONMENT_NAMES = new Set([\"BW_SESSION\"]);\n\nexport type CredentialMigrationDiscoveryErrorCode = \"discovery_cancelled\" | \"discovery_unavailable\";\n\nexport class CredentialMigrationDiscoveryError extends Error {\n\treadonly code: CredentialMigrationDiscoveryErrorCode;\n\n\tconstructor(code: CredentialMigrationDiscoveryErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"CredentialMigrationDiscoveryError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport interface CredentialMigrationSourceCandidate {\n\tsource: CredentialMigrationSource;\n\tvariableNames: string[];\n}\n\nexport interface CredentialMigrationDiscoveryResult {\n\tcandidates: CredentialMigrationSourceCandidate[];\n\tskipped: number;\n\ttruncated: boolean;\n}\n\nexport type CredentialMigrationSourceDiscoverer = (\n\tcwd: string,\n\tsignal?: AbortSignal,\n) => Promise<CredentialMigrationDiscoveryResult>;\n\nfunction throwIfCancelled(signal: AbortSignal | undefined): void {\n\tif (signal?.aborted) {\n\t\tthrow new CredentialMigrationDiscoveryError(\"discovery_cancelled\", \"Credential discovery was cancelled.\");\n\t}\n}\n\nfunction isCredentialEnvironmentName(name: string): boolean {\n\treturn (\n\t\t!EXCLUDED_ENVIRONMENT_NAMES.has(name.toUpperCase()) &&\n\t\t(CREDENTIAL_ENV_NAME_RE.test(name) || CREDENTIAL_URL_NAME_RE.test(name))\n\t);\n}\n\nfunction isDotenvCandidateName(name: string): boolean {\n\tif (DOTENV_TEMPLATE_NAME_RE.test(name)) return false;\n\tconst lower = name.toLowerCase();\n\treturn lower === \".env\" || lower.startsWith(\".env.\") || lower.endsWith(\".env\");\n}\n\nfunction candidateMetadataBytes(candidate: CredentialMigrationSourceCandidate): number {\n\tconst sourceIdentity =\n\t\tcandidate.source.kind === \"environment\"\n\t\t\t? candidate.source.name\n\t\t\t: candidate.source.kind === \"file\"\n\t\t\t\t? `${candidate.source.path}\\0${candidate.source.variable}`\n\t\t\t\t: candidate.source.path;\n\treturn (\n\t\tBuffer.byteLength(sourceIdentity, \"utf8\") +\n\t\tcandidate.variableNames.reduce((total, name) => total + Buffer.byteLength(name, \"utf8\"), 0)\n\t);\n}\n\nasync function inspectSource(\n\tsource: CredentialMigrationSource,\n\tcwd: string,\n\tsignal: AbortSignal | undefined,\n\tenvironment: NodeJS.ProcessEnv,\n): Promise<string[] | undefined> {\n\tlet variables: CredentialVariable[] = [];\n\ttry {\n\t\tvariables = await resolveCredentialMigrationSources([source], cwd, signal, environment);\n\t\treturn variables.map((variable) => variable.name);\n\t} catch {\n\t\treturn undefined;\n\t} finally {\n\t\tfor (const variable of variables) variable.value = \"\";\n\t\tvariables = [];\n\t}\n}\n\n/**\n * Discover supported credential sources without returning their values. The scan is deliberately\n * bounded to the current working tree plus the current process environment, never follows symlinks,\n * and skips dependency/build trees and dotenv templates.\n */\nexport async function discoverCredentialMigrationSources(\n\tcwd: string,\n\tsignal?: AbortSignal,\n\tenvironment: NodeJS.ProcessEnv = process.env,\n): Promise<CredentialMigrationDiscoveryResult> {\n\tthrowIfCancelled(signal);\n\tlet root: string;\n\ttry {\n\t\troot = await realpath(cwd);\n\t\tif (!(await stat(root)).isDirectory()) throw new Error(\"not a directory\");\n\t} catch {\n\t\tthrow new CredentialMigrationDiscoveryError(\"discovery_unavailable\", \"Credential discovery root is unavailable.\");\n\t}\n\n\tconst candidates: CredentialMigrationSourceCandidate[] = [];\n\tlet skipped = 0;\n\tlet truncated = false;\n\tlet environmentCandidateCount = 0;\n\tlet dotenvCandidateCount = 0;\n\tlet variableNameCount = 0;\n\tlet metadataBytes = 0;\n\tconst addCandidate = (\n\t\tcandidate: CredentialMigrationSourceCandidate,\n\t\tcategory: \"environment\" | \"dotenv\",\n\t): boolean => {\n\t\tconst categoryCount = category === \"environment\" ? environmentCandidateCount : dotenvCandidateCount;\n\t\tconst categoryLimit =\n\t\t\tcategory === \"environment\" ? MAX_DISCOVERY_ENVIRONMENT_CANDIDATES : MAX_DISCOVERY_DOTENV_CANDIDATES;\n\t\tconst nextMetadataBytes = metadataBytes + candidateMetadataBytes(candidate);\n\t\tif (\n\t\t\tcategoryCount >= categoryLimit ||\n\t\t\tvariableNameCount + candidate.variableNames.length > MAX_DISCOVERY_VARIABLE_NAMES ||\n\t\t\tnextMetadataBytes > MAX_DISCOVERY_METADATA_BYTES\n\t\t) {\n\t\t\ttruncated = true;\n\t\t\treturn false;\n\t\t}\n\t\tcandidates.push(candidate);\n\t\tif (category === \"environment\") environmentCandidateCount++;\n\t\telse dotenvCandidateCount++;\n\t\tvariableNameCount += candidate.variableNames.length;\n\t\tmetadataBytes = nextMetadataBytes;\n\t\treturn true;\n\t};\n\n\tfor (const name of Object.keys(environment).sort((left, right) => left.localeCompare(right))) {\n\t\tthrowIfCancelled(signal);\n\t\tif (!isCredentialEnvironmentName(name)) continue;\n\t\tconst source = { kind: \"environment\" as const, name };\n\t\tconst variableNames = await inspectSource(source, root, signal, environment);\n\t\tthrowIfCancelled(signal);\n\t\tif (!variableNames) {\n\t\t\tskipped++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!addCandidate({ source, variableNames }, \"environment\")) break;\n\t}\n\n\tconst directories: Array<{ path: string; depth: number }> = [{ path: root, depth: 0 }];\n\tlet directoryIndex = 0;\n\tlet visitedEntries = 0;\n\tlet stopDirectoryScan = false;\n\twhile (directoryIndex < directories.length && !stopDirectoryScan) {\n\t\tthrowIfCancelled(signal);\n\t\tif (directoryIndex >= MAX_DISCOVERY_DIRECTORIES) {\n\t\t\ttruncated = true;\n\t\t\tbreak;\n\t\t}\n\t\tconst current = directories[directoryIndex++];\n\t\tlet entries: Dirent<string>[];\n\t\ttry {\n\t\t\tentries = await readdir(current.path, { withFileTypes: true });\n\t\t} catch {\n\t\t\tskipped++;\n\t\t\tcontinue;\n\t\t}\n\t\tentries.sort((left, right) => left.name.localeCompare(right.name));\n\t\tfor (const entry of entries) {\n\t\t\tthrowIfCancelled(signal);\n\t\t\tvisitedEntries++;\n\t\t\tif (visitedEntries > MAX_DISCOVERY_ENTRIES) {\n\t\t\t\ttruncated = true;\n\t\t\t\tstopDirectoryScan = true;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (entry.isSymbolicLink()) continue;\n\t\t\tconst path = join(current.path, entry.name);\n\t\t\tif (entry.isDirectory()) {\n\t\t\t\tif (current.depth < MAX_DISCOVERY_DEPTH && !EXCLUDED_DIRECTORY_NAMES.has(entry.name.toLowerCase())) {\n\t\t\t\t\tdirectories.push({ path, depth: current.depth + 1 });\n\t\t\t\t}\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!entry.isFile() || !isDotenvCandidateName(entry.name)) continue;\n\t\t\tconst source = { kind: \"dotenv_file\" as const, path: relative(root, path) };\n\t\t\tconst variableNames = await inspectSource(source, root, signal, environment);\n\t\t\tthrowIfCancelled(signal);\n\t\t\tif (!variableNames) {\n\t\t\t\tskipped++;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!addCandidate({ source, variableNames }, \"dotenv\")) {\n\t\t\t\tstopDirectoryScan = true;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t}\n\n\tthrowIfCancelled(signal);\n\treturn { candidates, skipped, truncated };\n}\n"]}
1
+ {"version":3,"file":"credential-source-discovery.js","sourceRoot":"","sources":["../../../src/core/secrets/credential-source-discovery.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpD,OAAO,EAAkC,iCAAiC,EAAE,MAAM,kCAAkC,CAAC;AAErH,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,yBAAyB,GAAG,GAAG,CAAC;AACtC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,oCAAoC,GAAG,EAAE,CAAC;AAChD,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C,MAAM,4BAA4B,GAAG,GAAG,CAAC;AACzC,MAAM,4BAA4B,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACxC,MAAM;IACN,KAAK;IACL,MAAM;IACN,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,OAAO;IACP,UAAU;IACV,MAAM;IACN,cAAc;IACd,QAAQ;IACR,QAAQ;CACR,CAAC,CAAC;AACH,MAAM,uBAAuB,GAAG,mEAAmE,CAAC;AACpG,MAAM,sBAAsB,GAC3B,yGAAyG,CAAC;AAC3G,MAAM,sBAAsB,GAAG,iEAAiE,CAAC;AACjG,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC;AAC/E,MAAM,6BAA6B,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AAIrE,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAG3D,YAAY,IAA2C,EAAE,OAAe;QACvE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAClB,CAAC;CACD;AAuBD,SAAS,gBAAgB,CAAC,MAA+B;IACxD,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,iCAAiC,CAAC,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;IAC3G,CAAC;AACF,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY;IAChD,OAAO,CACN,CAAC,0BAA0B,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACnD,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACxE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IAC1C,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,sBAAsB,CAAC,SAA6C;IAC5E,MAAM,cAAc,GACnB,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa;QACtC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI;QACvB,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM;YACjC,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE;YAC1D,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;IAC3B,OAAO,CACN,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC;QACzC,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAC3F,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,MAAiC,EACjC,GAAW,EACX,MAA+B,EAC/B,WAA8B;IAE9B,IAAI,SAAS,GAAyB,EAAE,CAAC;IACzC,IAAI,CAAC;QACJ,SAAS,GAAG,MAAM,iCAAiC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACxF,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;YAAS,CAAC;QACV,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,CAAC,KAAK,GAAG,EAAE,CAAC;QACtD,SAAS,GAAG,EAAE,CAAC;IAChB,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACvD,GAAW,EACX,MAAoB,EACpB,WAAW,GAAsB,OAAO,CAAC,GAAG,EAC5C,OAAO,GAAwC,EAAE;IAEjD,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,iCAAiC,CAAC,uBAAuB,EAAE,2CAA2C,CAAC,CAAC;IACnH,CAAC;IAED,MAAM,UAAU,GAAyC,EAAE,CAAC;IAC5D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,yBAAyB,GAAG,CAAC,CAAC;IAClC,IAAI,oBAAoB,GAAG,CAAC,CAAC;IAC7B,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1F,MAAM,YAAY,GAAG,CACpB,SAA6C,EAC7C,QAAkC,EACxB,EAAE;QACZ,MAAM,aAAa,GAAG,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,oBAAoB,CAAC;QACpG,MAAM,aAAa,GAClB,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,+BAA+B,CAAC;QACrG,MAAM,iBAAiB,GAAG,aAAa,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAC5E,IACC,aAAa,IAAI,aAAa;YAC9B,iBAAiB,GAAG,SAAS,CAAC,aAAa,CAAC,MAAM,GAAG,4BAA4B;YACjF,iBAAiB,GAAG,4BAA4B,EAC/C,CAAC;YACF,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,KAAK,CAAC;QACd,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,IAAI,QAAQ,KAAK,aAAa;YAAE,yBAAyB,EAAE,CAAC;;YACvD,oBAAoB,EAAE,CAAC;QAC5B,iBAAiB,IAAI,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC;QACpD,aAAa,GAAG,iBAAiB,CAAC;QAClC,OAAO,IAAI,CAAC;IACb,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9F,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC;YAAE,SAAS;QACjD,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,aAAsB,EAAE,IAAI,EAAE,CAAC;QACtD,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAC7E,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,aAAa,EAAE,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,aAAa,CAAC;YAAE,MAAM;IACpE,CAAC;IAED,MAAM,SAAS,GAAwD,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;IACjH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClC,MAAM,wBAAwB,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;IAC/D,IAAI,wBAAwB,CAAC,MAAM,GAAG,mBAAmB,GAAG,CAAC;QAAE,SAAS,GAAG,IAAI,CAAC;IAChF,KAAK,MAAM,SAAS,IAAI,wBAAwB,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,GAAG,CAAC,CAAC,EAAE,CAAC;QACpF,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACJ,SAAS,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAChF,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QACvC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,WAAW,GAAuE,SAAS,CAAC,GAAG,CACpG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CACzC,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,OAAO,cAAc,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClE,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,cAAc,IAAI,yBAAyB,EAAE,CAAC;YACjD,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM;QACP,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC,cAAc,EAAE,CAAC,CAAC;QAC9C,IAAI,OAAyB,CAAC;QAC9B,IAAI,CAAC;YACJ,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACnE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzB,cAAc,EAAE,CAAC;YACjB,IAAI,cAAc,GAAG,qBAAqB,EAAE,CAAC;gBAC5C,SAAS,GAAG,IAAI,CAAC;gBACjB,iBAAiB,GAAG,IAAI,CAAC;gBACzB,MAAM;YACP,CAAC;YACD,IAAI,KAAK,CAAC,cAAc,EAAE;gBAAE,SAAS;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzB,IACC,OAAO,CAAC,KAAK,GAAG,mBAAmB;oBACnC,CAAC,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;oBACvD,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAC3B,CAAC;oBACF,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC5B,WAAW,CAAC,IAAI,CAAC;wBAChB,IAAI;wBACJ,KAAK,EAAE,OAAO,CAAC,KAAK,GAAG,CAAC;wBACxB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;qBAC5C,CAAC,CAAC;gBACJ,CAAC;gBACD,SAAS;YACV,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACpE,IAAI,6BAA6B,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrG,SAAS;YACV,CAAC;YACD,MAAM,MAAM,GAAG;gBACd,IAAI,EAAE,aAAsB;gBAC5B,IAAI,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;aAC7D,CAAC;YACF,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YAC7E,gBAAgB,CAAC,MAAM,CAAC,CAAC;YACzB,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,OAAO,EAAE,CAAC;gBACV,SAAS;YACV,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACxD,iBAAiB,GAAG,IAAI,CAAC;gBACzB,MAAM;YACP,CAAC;QACF,CAAC;IACF,CAAC;IAED,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAC3C,CAAC","sourcesContent":["import type { Dirent } from \"node:fs\";\nimport { readdir, realpath, stat } from \"node:fs/promises\";\nimport { join, relative, resolve } from \"node:path\";\nimport type { CredentialVariable } from \"./credential-manager.ts\";\nimport { type CredentialMigrationSource, resolveCredentialMigrationSources } from \"./credential-migration-source.ts\";\n\nconst MAX_DISCOVERY_DEPTH = 6;\nconst MAX_DISCOVERY_ROOTS = 8;\nconst MAX_DISCOVERY_DIRECTORIES = 256;\nconst MAX_DISCOVERY_ENTRIES = 10_000;\nconst MAX_DISCOVERY_ENVIRONMENT_CANDIDATES = 32;\nconst MAX_DISCOVERY_DOTENV_CANDIDATES = 32;\nconst MAX_DISCOVERY_VARIABLE_NAMES = 256;\nconst MAX_DISCOVERY_METADATA_BYTES = 64 * 1024;\nconst EXCLUDED_DIRECTORY_NAMES = new Set([\n\t\".git\",\n\t\".hg\",\n\t\".svn\",\n\t\".cache\",\n\t\".next\",\n\t\".turbo\",\n\t\".yarn\",\n\t\"build\",\n\t\"coverage\",\n\t\"dist\",\n\t\"node_modules\",\n\t\"target\",\n\t\"vendor\",\n]);\nconst DOTENV_TEMPLATE_NAME_RE = /(?:^|[._-])(?:defaults?|dist|example|sample|template)(?:$|[._-])/i;\nconst CREDENTIAL_ENV_NAME_RE =\n\t/(?:^|_)(?:ACCESS_KEY|API_KEY|CREDENTIALS?|CLIENT_SECRET|PASS|PASSWORD|PRIVATE_KEY|SECRET|TOKEN)(?:_|$)/i;\nconst CREDENTIAL_URL_NAME_RE = /^(?:DATABASE|DB|MONGO(?:DB)?|MYSQL|POSTGRES(?:QL)?|REDIS)_URL$/i;\nconst EXCLUDED_ENVIRONMENT_NAMES = new Set([\"BWS_ACCESS_TOKEN\", \"BW_SESSION\"]);\nconst EXCLUDED_BOOTSTRAP_FILE_NAMES = new Set([\"bws.env\", \"bw.env\"]);\n\nexport type CredentialMigrationDiscoveryErrorCode = \"discovery_cancelled\" | \"discovery_unavailable\";\n\nexport class CredentialMigrationDiscoveryError extends Error {\n\treadonly code: CredentialMigrationDiscoveryErrorCode;\n\n\tconstructor(code: CredentialMigrationDiscoveryErrorCode, message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"CredentialMigrationDiscoveryError\";\n\t\tthis.code = code;\n\t}\n}\n\nexport interface CredentialMigrationSourceCandidate {\n\tsource: CredentialMigrationSource;\n\tvariableNames: string[];\n}\n\nexport interface CredentialMigrationDiscoveryResult {\n\tcandidates: CredentialMigrationSourceCandidate[];\n\tskipped: number;\n\ttruncated: boolean;\n}\n\nexport type CredentialMigrationSourceDiscoverer = (\n\tcwd: string,\n\tsignal?: AbortSignal,\n) => Promise<CredentialMigrationDiscoveryResult>;\n\nexport interface CredentialMigrationDiscoveryOptions {\n\tadditionalRoots?: readonly string[];\n\texcludedFiles?: readonly string[];\n}\n\nfunction throwIfCancelled(signal: AbortSignal | undefined): void {\n\tif (signal?.aborted) {\n\t\tthrow new CredentialMigrationDiscoveryError(\"discovery_cancelled\", \"Credential discovery was cancelled.\");\n\t}\n}\n\nfunction isCredentialEnvironmentName(name: string): boolean {\n\treturn (\n\t\t!EXCLUDED_ENVIRONMENT_NAMES.has(name.toUpperCase()) &&\n\t\t(CREDENTIAL_ENV_NAME_RE.test(name) || CREDENTIAL_URL_NAME_RE.test(name))\n\t);\n}\n\nfunction isDotenvCandidateName(name: string): boolean {\n\tif (DOTENV_TEMPLATE_NAME_RE.test(name)) return false;\n\tconst lower = name.toLowerCase();\n\treturn lower === \".env\" || lower.startsWith(\".env.\") || lower.endsWith(\".env\");\n}\n\nfunction candidateMetadataBytes(candidate: CredentialMigrationSourceCandidate): number {\n\tconst sourceIdentity =\n\t\tcandidate.source.kind === \"environment\"\n\t\t\t? candidate.source.name\n\t\t\t: candidate.source.kind === \"file\"\n\t\t\t\t? `${candidate.source.path}\\0${candidate.source.variable}`\n\t\t\t\t: candidate.source.path;\n\treturn (\n\t\tBuffer.byteLength(sourceIdentity, \"utf8\") +\n\t\tcandidate.variableNames.reduce((total, name) => total + Buffer.byteLength(name, \"utf8\"), 0)\n\t);\n}\n\nasync function inspectSource(\n\tsource: CredentialMigrationSource,\n\tcwd: string,\n\tsignal: AbortSignal | undefined,\n\tenvironment: NodeJS.ProcessEnv,\n): Promise<string[] | undefined> {\n\tlet variables: CredentialVariable[] = [];\n\ttry {\n\t\tvariables = await resolveCredentialMigrationSources([source], cwd, signal, environment);\n\t\treturn variables.map((variable) => variable.name);\n\t} catch {\n\t\treturn undefined;\n\t} finally {\n\t\tfor (const variable of variables) variable.value = \"\";\n\t\tvariables = [];\n\t}\n}\n\n/**\n * Discover supported credential sources without returning their values. The scan is deliberately\n * bounded to the current working tree, explicit machine roots, and the current process environment.\n * It never follows symlinks and skips dependency/build trees, dotenv templates, and store bootstraps.\n */\nexport async function discoverCredentialMigrationSources(\n\tcwd: string,\n\tsignal?: AbortSignal,\n\tenvironment: NodeJS.ProcessEnv = process.env,\n\toptions: CredentialMigrationDiscoveryOptions = {},\n): Promise<CredentialMigrationDiscoveryResult> {\n\tthrowIfCancelled(signal);\n\tlet root: string;\n\ttry {\n\t\troot = await realpath(cwd);\n\t\tif (!(await stat(root)).isDirectory()) throw new Error(\"not a directory\");\n\t} catch {\n\t\tthrow new CredentialMigrationDiscoveryError(\"discovery_unavailable\", \"Credential discovery root is unavailable.\");\n\t}\n\n\tconst candidates: CredentialMigrationSourceCandidate[] = [];\n\tlet skipped = 0;\n\tlet truncated = false;\n\tlet environmentCandidateCount = 0;\n\tlet dotenvCandidateCount = 0;\n\tlet variableNameCount = 0;\n\tlet metadataBytes = 0;\n\tconst excludedFiles = new Set((options.excludedFiles ?? []).map((path) => resolve(path)));\n\tconst addCandidate = (\n\t\tcandidate: CredentialMigrationSourceCandidate,\n\t\tcategory: \"environment\" | \"dotenv\",\n\t): boolean => {\n\t\tconst categoryCount = category === \"environment\" ? environmentCandidateCount : dotenvCandidateCount;\n\t\tconst categoryLimit =\n\t\t\tcategory === \"environment\" ? MAX_DISCOVERY_ENVIRONMENT_CANDIDATES : MAX_DISCOVERY_DOTENV_CANDIDATES;\n\t\tconst nextMetadataBytes = metadataBytes + candidateMetadataBytes(candidate);\n\t\tif (\n\t\t\tcategoryCount >= categoryLimit ||\n\t\t\tvariableNameCount + candidate.variableNames.length > MAX_DISCOVERY_VARIABLE_NAMES ||\n\t\t\tnextMetadataBytes > MAX_DISCOVERY_METADATA_BYTES\n\t\t) {\n\t\t\ttruncated = true;\n\t\t\treturn false;\n\t\t}\n\t\tcandidates.push(candidate);\n\t\tif (category === \"environment\") environmentCandidateCount++;\n\t\telse dotenvCandidateCount++;\n\t\tvariableNameCount += candidate.variableNames.length;\n\t\tmetadataBytes = nextMetadataBytes;\n\t\treturn true;\n\t};\n\n\tfor (const name of Object.keys(environment).sort((left, right) => left.localeCompare(right))) {\n\t\tthrowIfCancelled(signal);\n\t\tif (!isCredentialEnvironmentName(name)) continue;\n\t\tconst source = { kind: \"environment\" as const, name };\n\t\tconst variableNames = await inspectSource(source, root, signal, environment);\n\t\tthrowIfCancelled(signal);\n\t\tif (!variableNames) {\n\t\t\tskipped++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (!addCandidate({ source, variableNames }, \"environment\")) break;\n\t}\n\n\tconst scanRoots: Array<{ path: string; relativeToProject: boolean }> = [{ path: root, relativeToProject: true }];\n\tconst seenRoots = new Set([root]);\n\tconst requestedAdditionalRoots = options.additionalRoots ?? [];\n\tif (requestedAdditionalRoots.length > MAX_DISCOVERY_ROOTS - 1) truncated = true;\n\tfor (const candidate of requestedAdditionalRoots.slice(0, MAX_DISCOVERY_ROOTS - 1)) {\n\t\tthrowIfCancelled(signal);\n\t\tlet canonical: string;\n\t\ttry {\n\t\t\tcanonical = await realpath(candidate);\n\t\t\tif (!(await stat(canonical)).isDirectory()) throw new Error(\"not a directory\");\n\t\t} catch {\n\t\t\tskipped++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (seenRoots.has(canonical)) continue;\n\t\tseenRoots.add(canonical);\n\t\tscanRoots.push({ path: canonical, relativeToProject: false });\n\t}\n\n\tconst directories: Array<{ path: string; depth: number; relativeToProject: boolean }> = scanRoots.map(\n\t\t(scanRoot) => ({ ...scanRoot, depth: 0 }),\n\t);\n\tconst queuedDirectories = new Set(scanRoots.map((scanRoot) => scanRoot.path));\n\tlet directoryIndex = 0;\n\tlet visitedEntries = 0;\n\tlet stopDirectoryScan = false;\n\twhile (directoryIndex < directories.length && !stopDirectoryScan) {\n\t\tthrowIfCancelled(signal);\n\t\tif (directoryIndex >= MAX_DISCOVERY_DIRECTORIES) {\n\t\t\ttruncated = true;\n\t\t\tbreak;\n\t\t}\n\t\tconst current = directories[directoryIndex++];\n\t\tlet entries: Dirent<string>[];\n\t\ttry {\n\t\t\tentries = await readdir(current.path, { withFileTypes: true });\n\t\t} catch {\n\t\t\tskipped++;\n\t\t\tcontinue;\n\t\t}\n\t\tentries.sort((left, right) => left.name.localeCompare(right.name));\n\t\tfor (const entry of entries) {\n\t\t\tthrowIfCancelled(signal);\n\t\t\tvisitedEntries++;\n\t\t\tif (visitedEntries > MAX_DISCOVERY_ENTRIES) {\n\t\t\t\ttruncated = true;\n\t\t\t\tstopDirectoryScan = true;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (entry.isSymbolicLink()) continue;\n\t\t\tconst path = join(current.path, entry.name);\n\t\t\tif (entry.isDirectory()) {\n\t\t\t\tif (\n\t\t\t\t\tcurrent.depth < MAX_DISCOVERY_DEPTH &&\n\t\t\t\t\t!EXCLUDED_DIRECTORY_NAMES.has(entry.name.toLowerCase()) &&\n\t\t\t\t\t!queuedDirectories.has(path)\n\t\t\t\t) {\n\t\t\t\t\tqueuedDirectories.add(path);\n\t\t\t\t\tdirectories.push({\n\t\t\t\t\t\tpath,\n\t\t\t\t\t\tdepth: current.depth + 1,\n\t\t\t\t\t\trelativeToProject: current.relativeToProject,\n\t\t\t\t\t});\n\t\t\t\t}\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!entry.isFile() || !isDotenvCandidateName(entry.name)) continue;\n\t\t\tif (EXCLUDED_BOOTSTRAP_FILE_NAMES.has(entry.name.toLowerCase()) || excludedFiles.has(resolve(path))) {\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tconst source = {\n\t\t\t\tkind: \"dotenv_file\" as const,\n\t\t\t\tpath: current.relativeToProject ? relative(root, path) : path,\n\t\t\t};\n\t\t\tconst variableNames = await inspectSource(source, root, signal, environment);\n\t\t\tthrowIfCancelled(signal);\n\t\t\tif (!variableNames) {\n\t\t\t\tskipped++;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tif (!addCandidate({ source, variableNames }, \"dotenv\")) {\n\t\t\t\tstopDirectoryScan = true;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t}\n\t}\n\n\tthrowIfCancelled(signal);\n\treturn { candidates, skipped, truncated };\n}\n"]}
package/dist/core/tools/delegate-status.d.ts CHANGED
@@ -1,5 +1,6 @@
1
1
  import type { WorkerClaim } from "../autonomy/contracts.ts";
2
2
  import type { LaneRecord } from "../autonomy/lane-tracker.ts";
3
+ import type { WorkerResultContract } from "../orchestration/contracts.ts";
3
4
  import type { OrchestrationPanelModel } from "./orchestration-panel.ts";
4
5
  export declare const WORKER_QUEUED_CAVEMAN_GUIDANCE = "CAVEMAN MODE - MANDATORY: queued is admitted durable nonterminal state, not stall or harness failure. Host starts it event-driven when dependencies, capacity, or safety reservations clear. Never poll, interrupt, or cancel a healthy running worker to force the queue. For genuine parallel read-only work, start a fresh worker whose authority.toolNames omits write and edit; write-capable workers may serialize. If you start a fresh narrower replacement, cancel this queued agent after the replacement starts; otherwise both tasks will run.";
5
6
  export declare const DELEGATE_STATUS_ACTIONS: readonly ["status", "review"];
@@ -36,6 +37,8 @@ export interface DelegateStatusToolDetails {
36
37
  reviewedAt?: string;
37
38
  reason?: string;
38
39
  claimSummary?: string;
40
+ outputArtifactUri?: string;
41
+ outputArtifactSizeBytes?: number;
39
42
  changedFiles?: readonly string[];
40
43
  blockers?: readonly string[];
41
44
  }
@@ -50,6 +53,7 @@ export type AcknowledgeWorkerReviewResult = {
50
53
  export interface DelegateStatusDependencies {
51
54
  getLaneRecords(): LaneRecord[];
52
55
  getWorkerClaimSnapshots(): WorkerClaim[];
56
+ getWorkerResult?(laneId: string): Pick<WorkerResultContract, "artifacts"> | undefined;
53
57
  acknowledgeWorkerReview?(requestId: string): AcknowledgeWorkerReviewResult;
54
58
  }
55
59
  export declare function delegateStatusPanelModel(details: DelegateStatusToolDetails): OrchestrationPanelModel;
package/dist/core/tools/delegate-status.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"delegate-status.d.ts","sourceRoot":"","sources":["../../../src/core/tools/delegate-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAE,uBAAuB,EAAyB,MAAM,0BAA0B,CAAC;AAI/F,eAAO,MAAM,8BAA8B,+hBACkf,CAAC;AAE9hB,eAAO,MAAM,uBAAuB,YAAI,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAErE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,MAAM,WAAW,mBAAmB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;IACzD,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,KAAK,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,6BAA6B,GACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,GAAG,aAAa,GAAG,kBAAkB,CAAA;CAAE,CAAC;AAEtF,MAAM,WAAW,0BAA0B;IAC1C,cAAc,IAAI,UAAU,EAAE,CAAC;IAC/B,uBAAuB,IAAI,WAAW,EAAE,CAAC;IACzC,uBAAuB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,6BAA6B,CAAC;CAC3E;AAsFD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,uBAAuB,CAqDpG;AAED,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,0BAA0B,GAC9B;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,EAAE,yBAAyB,CAAA;CAAE,CAwHxF"}
1
+ {"version":3,"file":"delegate-status.d.ts","sourceRoot":"","sources":["../../../src/core/tools/delegate-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,uBAAuB,EAAyB,MAAM,0BAA0B,CAAC;AAI/F,eAAO,MAAM,8BAA8B,+hBACkf,CAAC;AAE9hB,eAAO,MAAM,uBAAuB,YAAI,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAErE,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5E,MAAM,WAAW,mBAAmB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,sBAAsB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,WAAW,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC;IACzD,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACzC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,IAAI,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,KAAK,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,MAAM,6BAA6B,GACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,GAAG,aAAa,GAAG,kBAAkB,CAAA;CAAE,CAAC;AAEtF,MAAM,WAAW,0BAA0B;IAC1C,cAAc,IAAI,UAAU,EAAE,CAAC;IAC/B,uBAAuB,IAAI,WAAW,EAAE,CAAC;IACzC,eAAe,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC,oBAAoB,EAAE,WAAW,CAAC,GAAG,SAAS,CAAC;IACtF,uBAAuB,CAAC,CAAC,SAAS,EAAE,MAAM,GAAG,6BAA6B,CAAC;CAC3E;AAiGD,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,uBAAuB,CAqDpG;AAED,wBAAgB,2BAA2B,CAC1C,MAAM,EAAE,oBAAoB,EAC5B,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,0BAA0B,GAC9B;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,OAAO,EAAE,yBAAyB,CAAA;CAAE,CAyIxF"}