@elizaos/vault 2.0.0-alpha.537

package/dist/manager.d.ts

@@ -0,0 +1,161 @@
+import { type ExecFn } from "./external-credentials.js";
+import { type ResolutionContext } from "./profiles.js";
+import { type Vault } from "./vault.js";
+/**
+ * SecretsManager — the high-level routing layer over Vault.
+ *
+ * Lets a user pick which backends to enable for sensitive secrets:
+ *
+ *   - "in-house"   → Eliza's local store (OS keychain master + AES-GCM file)
+ *   - "1password"  → 1Password CLI (`op`); references stored locally
+ *   - "protonpass" → Proton Pass (scaffolded; vendor CLI not stable yet)
+ *   - "bitwarden"  → Bitwarden CLI (`bw`); references stored locally
+ *
+ * Three modes the user can run in:
+ *
+ *   - **None enabled** → only "in-house" is used. Default.
+ *   - **One enabled**  → user picked (e.g.) "1password"; sensitive values
+ *     route there only when the caller stores an explicit reference.
+ *   - **All enabled**  → user can pick per-key in Settings; unsupported
+ *     direct external writes fail loudly instead of hiding the problem.
+ *
+ * The Vault stays the canonical store for non-sensitive config and
+ * for the references that point at external password managers.
+ */
+export type BackendId = "in-house" | "1password" | "protonpass" | "bitwarden";
+export interface BackendStatus {
+    readonly id: BackendId;
+    readonly label: string;
+    /** True if the backend is available on this machine. */
+    readonly available: boolean;
+    /**
+     * True if the user is currently authenticated to this backend.
+     * Undefined when not applicable (e.g., in-house) or detection
+     * isn't supported yet.
+     */
+    readonly signedIn?: boolean;
+    /** Human-readable detail for display when not fully ready. */
+    readonly detail?: string;
+    /**
+     * Authentication path the backend is using. `desktop-app` means the
+     * vendor's desktop app brokers auth (e.g. 1Password 8 native app
+     * integration with the `op` CLI), so no session token is required.
+     * `session-token` means we authenticated via stored session token.
+     * `null` when the backend is unavailable or not signed in.
+     *
+     * Undefined for backends that don't have multiple auth modes
+     * (e.g. in-house, protonpass).
+     */
+    readonly authMode?: "desktop-app" | "session-token" | null;
+}
+export interface ManagerPreferences {
+    /**
+     * Backends the user has enabled, ordered by priority.
+     * "in-house" is always available for non-sensitive values, but sensitive
+     * values follow this order exactly and fail if the selected backend cannot
+     * accept the write.
+     */
+    readonly enabled: readonly BackendId[];
+    /**
+     * Per-key routing overrides. Useful when a user wants e.g. work
+     * keys in 1Password and personal keys in Bitwarden.
+     */
+    readonly routing?: Readonly<Record<string, BackendId>>;
+}
+export declare const DEFAULT_PREFERENCES: ManagerPreferences;
+export interface ManagerSetOptions {
+    readonly sensitive?: boolean;
+    /** Force routing to a specific backend, overriding preferences. */
+    readonly store?: BackendId;
+    readonly caller?: string;
+}
+export interface SecretsManager {
+    /** The underlying vault. Use directly for advanced cases. */
+    readonly vault: Vault;
+    /** Set a value, routing per the user's preferences. */
+    set(key: string, value: string, opts?: ManagerSetOptions): Promise<void>;
+    /** Get a value, resolving through whatever backend it's stored in. */
+    get(key: string): Promise<string>;
+    /**
+     * Resolve a value through the profile + per-context routing layer.
+     *
+     * Resolution order:
+     *   1. Per-context routing rule that matches `ctx`
+     *   2. The key's `_meta.<key>.activeProfile`
+     *   3. The global `_routing.config.defaultProfile`
+     *   4. The bare key value (legacy path)
+     *
+     * For keys without any meta entry, this is identical to `get()`.
+     */
+    getActive(key: string, ctx?: ResolutionContext): Promise<string>;
+    /** Existence check. */
+    has(key: string): Promise<boolean>;
+    /** Remove (clears the local entry; doesn't delete from external password manager). */
+    remove(key: string): Promise<void>;
+    /** List keys. */
+    list(prefix?: string): Promise<readonly string[]>;
+    /** Probe each known backend; returns availability + sign-in status. */
+    detectBackends(): Promise<readonly BackendStatus[]>;
+    /** Read the user's saved preferences. */
+    getPreferences(): Promise<ManagerPreferences>;
+    /** Save the user's preferences. Persisted to the vault. */
+    setPreferences(prefs: ManagerPreferences): Promise<void>;
+    /**
+     * List saved logins from every available source: in-house vault always,
+     * plus 1Password and Bitwarden when they're signed in.
+     *
+     * Per-backend errors are collected into `failures` rather than thrown —
+     * a flaky external CLI must not block the in-house list.
+     */
+    listAllSavedLogins(opts?: ListAllSavedLoginsOptions): Promise<UnifiedLoginListResult>;
+    /** Reveal a single login (full credentials) from the indicated source. */
+    revealSavedLogin(source: "in-house" | "1password" | "bitwarden", identifier: string): Promise<UnifiedLoginReveal>;
+}
+export interface CreateManagerOptions {
+    /** Provide your own Vault. Default: `createVault()`. */
+    readonly vault?: Vault;
+    /**
+     * Subprocess executor for password-manager CLIs. Tests inject a stub.
+     * Defaults to a real `child_process.execFile`-based runner.
+     */
+    readonly exec?: ExecFn;
+}
+/**
+ * Source-tagged saved-login summary spanning every backend.
+ *
+ * `identifier`:
+ *   - `in-house`  → `<domain>:<username>` (matches the route shape used
+ *                   to delete + reveal a single in-house credential)
+ *   - `1password` → the 1Password item id (op_uuid)
+ *   - `bitwarden` → the Bitwarden item id (uuid)
+ */
+export interface UnifiedLoginListEntry {
+    readonly source: "in-house" | "1password" | "bitwarden";
+    readonly identifier: string;
+    readonly domain: string | null;
+    readonly username: string;
+    /** Display name. For in-house this == username; external == op/bw title. */
+    readonly title: string;
+    readonly updatedAt: number;
+}
+export interface UnifiedLoginReveal {
+    readonly source: "in-house" | "1password" | "bitwarden";
+    readonly identifier: string;
+    readonly username: string;
+    readonly password: string;
+    readonly totp?: string;
+    readonly domain: string | null;
+}
+export interface UnifiedLoginListResult {
+    readonly logins: readonly UnifiedLoginListEntry[];
+    /** Per-backend errors. The list still returns whatever succeeded. */
+    readonly failures: ReadonlyArray<{
+        readonly source: "1password" | "bitwarden";
+        readonly message: string;
+    }>;
+}
+export interface ListAllSavedLoginsOptions {
+    readonly domain?: string;
+}
+export declare function createManager(opts?: CreateManagerOptions): SecretsManager;
+//# sourceMappingURL=manager.d.ts.map

package/dist/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../src/manager.ts"],"names":[],"mappings":"AAOA,OAAO,EAEL,KAAK,MAAM,EAOZ,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAe,KAAK,KAAK,EAAkB,MAAM,YAAY,CAAC;AAKrE;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,YAAY,GAAG,WAAW,CAAC;AAE9E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,GAAG,eAAe,GAAG,IAAI,CAAC;CAC5D;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;IACvC;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;CACxD;AAED,eAAO,MAAM,mBAAmB,EAAE,kBAEjC,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,uDAAuD;IACvD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzE,sEAAsE;IACtE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC;;;;;;;;;;OAUG;IACH,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjE,uBAAuB;IACvB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,sFAAsF;IACtF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,iBAAiB;IACjB,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAClD,uEAAuE;IACvE,cAAc,IAAI,OAAO,CAAC,SAAS,aAAa,EAAE,CAAC,CAAC;IACpD,yCAAyC;IACzC,cAAc,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9C,2DAA2D;IAC3D,cAAc,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzD;;;;;;OAMG;IACH,kBAAkB,CAChB,IAAI,CAAC,EAAE,yBAAyB,GAC/B,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEnC,0EAA0E;IAC1E,gBAAgB,CACd,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,EAC9C,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,wDAAwD;IACxD,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,WAAW,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAClD,qEAAqE;IACrE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAAC;QAC3C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;KAC1B,CAAC,CAAC;CACJ;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,aAAa,CAAC,IAAI,GAAE,oBAAyB,GAAG,cAAc,CAI7E"}

package/dist/manager.js

@@ -0,0 +1,466 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { listSavedLogins, getSavedLogin, } from "./credentials.js";
+import { defaultExecFn, listBitwardenLogins, listOnePasswordLogins, revealBitwardenLogin, revealOnePasswordLogin, } from "./external-credentials.js";
+import { resolveActiveValue } from "./profiles.js";
+import { createVault, VaultMissError } from "./vault.js";
+const exec = promisify(execFile);
+export const DEFAULT_PREFERENCES = {
+    enabled: ["in-house"],
+};
+export function createManager(opts = {}) {
+    const vault = opts.vault ?? createVault();
+    const execFn = opts.exec ?? defaultExecFn();
+    return new ManagerImpl(vault, execFn);
+}
+const PREFERENCES_KEY = "_manager.preferences";
+class ManagerImpl {
+    vault;
+    execFn;
+    constructor(vault, execFn) {
+        this.vault = vault;
+        this.execFn = execFn;
+    }
+    async getPreferences() {
+        try {
+            const raw = await this.vault.get(PREFERENCES_KEY);
+            const parsed = JSON.parse(raw);
+            return normalizePreferences(parsed);
+        }
+        catch (err) {
+            if (err instanceof VaultMissError) {
+                return DEFAULT_PREFERENCES;
+            }
+            throw err;
+        }
+    }
+    async setPreferences(prefs) {
+        const normalized = normalizePreferences(prefs);
+        // Encrypt at rest. The `routing` map can contain password-manager item
+        // paths (e.g. "Personal/OpenRouter/api-key") which are internal-disclosure
+        // information; storing them as a plain `kind: "value"` entry would write
+        // those paths to vault.json in clear text.
+        await this.vault.set(PREFERENCES_KEY, JSON.stringify(normalized), {
+            sensitive: true,
+        });
+    }
+    async set(key, value, opts = {}) {
+        const target = await this.resolveTargetBackend(key, opts);
+        if (target === "in-house") {
+            await this.vault.set(key, value, {
+                ...(opts.sensitive ? { sensitive: true } : {}),
+                ...(opts.caller ? { caller: opts.caller } : {}),
+            });
+            return;
+        }
+        throw new Error(`manager.set: backend "${target}" cannot accept direct writes yet. Store the secret in that password manager first and save a reference explicitly.`);
+    }
+    async get(key) {
+        return this.vault.get(key);
+    }
+    async getActive(key, ctx) {
+        return resolveActiveValue(this.vault, key, ctx);
+    }
+    async has(key) {
+        return this.vault.has(key);
+    }
+    async remove(key) {
+        return this.vault.remove(key);
+    }
+    async list(prefix) {
+        const all = await this.vault.list(prefix);
+        // Filter out manager-internal keys plus the inventory layer's
+        // reserved prefixes — `_meta.*` (per-key metadata) and
+        // `_routing.config` (global routing rules) are implementation
+        // details, not user-visible keys.
+        return all.filter((k) => !k.startsWith("_manager.") &&
+            !k.startsWith("_meta.") &&
+            k !== "_routing.config");
+    }
+    async detectBackends() {
+        return Promise.all([
+            Promise.resolve(detectInHouse()),
+            detectOnePassword(this.vault),
+            detectProtonPass(),
+            detectBitwarden(this.vault),
+        ]);
+    }
+    async listAllSavedLogins(opts = {}) {
+        const requestedDomain = opts.domain
+            ? opts.domain.trim().toLowerCase()
+            : undefined;
+        // In-house always queries successfully (or surfaces a real disk error).
+        // External backends contribute only when they're signed in. Detection
+        // is the gate, but we don't re-detect inline here — we pull the
+        // session-token check into each adapter (it throws BackendNotSignedInError
+        // when no session is stored), and skip those backends silently.
+        const failures = [];
+        const inHouseEntries = await this.fetchInHouseEntries(requestedDomain);
+        const externalEntries = [];
+        const backends = await this.detectBackends();
+        const onePasswordReady = backends.find((b) => b.id === "1password")?.signedIn === true;
+        const bitwardenReady = backends.find((b) => b.id === "bitwarden")?.signedIn === true;
+        if (onePasswordReady) {
+            const result = await safeListExternal("1password", () => listOnePasswordLogins(this.vault, this.execFn));
+            if (result.ok === true)
+                externalEntries.push(...result.entries);
+            else
+                failures.push({ source: "1password", message: result.message });
+        }
+        if (bitwardenReady) {
+            const result = await safeListExternal("bitwarden", () => listBitwardenLogins(this.vault, this.execFn));
+            if (result.ok === true)
+                externalEntries.push(...result.entries);
+            else
+                failures.push({ source: "bitwarden", message: result.message });
+        }
+        // Domain filter (case-insensitive) applies uniformly. External
+        // adapters don't accept domain filters at the CLI layer — bw doesn't
+        // expose one and op item list filters by tag/category only — so the
+        // cost is "list everything, filter client-side". For a typical user
+        // (dozens to low-hundreds of items) this stays under a second.
+        const filteredExternal = requestedDomain
+            ? externalEntries.filter((e) => e.domain !== null && e.domain.toLowerCase() === requestedDomain)
+            : externalEntries;
+        const externalUnified = filteredExternal
+            .map((e) => ({
+            source: e.source,
+            identifier: e.externalId,
+            domain: e.domain,
+            username: e.username,
+            title: e.title,
+            updatedAt: e.updatedAt,
+        }))
+            .sort((a, b) => b.updatedAt - a.updatedAt);
+        // In-house first (sort by domain asc, username asc), then externals
+        // by updatedAt desc — matches the spec.
+        const sortedInHouse = [...inHouseEntries].sort((a, b) => {
+            const dA = (a.domain ?? "").toLowerCase();
+            const dB = (b.domain ?? "").toLowerCase();
+            if (dA !== dB)
+                return dA < dB ? -1 : 1;
+            return a.username < b.username ? -1 : a.username > b.username ? 1 : 0;
+        });
+        return {
+            logins: [...sortedInHouse, ...externalUnified],
+            failures,
+        };
+    }
+    async revealSavedLogin(source, identifier) {
+        if (typeof identifier !== "string" || identifier.length === 0) {
+            throw new TypeError("revealSavedLogin: identifier required");
+        }
+        if (source === "in-house") {
+            // In-house identifier is "<domain>:<username>". The username can
+            // contain `:` (rare in emails, but legitimate as a literal), so we
+            // split on the FIRST colon only.
+            const colon = identifier.indexOf(":");
+            if (colon <= 0) {
+                throw new TypeError(`revealSavedLogin: in-house identifier must be "<domain>:<username>", got "${identifier}"`);
+            }
+            const domain = identifier.slice(0, colon);
+            const username = identifier.slice(colon + 1);
+            const login = await getSavedLogin(this.vault, domain, username);
+            if (!login) {
+                throw new Error(`revealSavedLogin: no in-house login for ${domain}:${username}`);
+            }
+            const reveal = {
+                source: "in-house",
+                identifier,
+                username: login.username,
+                password: login.password,
+                domain: login.domain,
+                ...(login.otpSeed ? { totp: login.otpSeed } : {}),
+            };
+            return reveal;
+        }
+        if (source === "1password") {
+            const out = await revealOnePasswordLogin(this.vault, this.execFn, identifier);
+            return mapExternalReveal(out);
+        }
+        // bitwarden
+        const out = await revealBitwardenLogin(this.vault, this.execFn, identifier);
+        return mapExternalReveal(out);
+    }
+    async fetchInHouseEntries(requestedDomain) {
+        const summaries = requestedDomain
+            ? await listSavedLogins(this.vault, requestedDomain)
+            : await listSavedLogins(this.vault);
+        return summaries.map((s) => ({
+            source: "in-house",
+            identifier: `${s.domain}:${s.username}`,
+            domain: s.domain,
+            username: s.username,
+            title: s.username,
+            updatedAt: s.lastModified,
+        }));
+    }
+    async resolveTargetBackend(key, opts) {
+        // Explicit per-call override always wins.
+        if (opts.store)
+            return opts.store;
+        // Non-sensitive values always go in-house — no point routing UI
+        // config strings through a password manager. Checked BEFORE the
+        // routing map so a stale/misconfigured `routing.ui.theme = "1password"`
+        // entry can't accidentally push non-sensitive data into an
+        // external store.
+        if (!opts.sensitive)
+            return "in-house";
+        const prefs = await this.getPreferences();
+        // Per-key routing override (sensitive case only).
+        const routed = prefs.routing?.[key];
+        if (routed)
+            return routed;
+        // Default for sensitive: first enabled backend; in-house if nothing is
+        // enabled. External backends currently require explicit references.
+        return prefs.enabled[0] ?? "in-house";
+    }
+}
+function normalizePreferences(prefs) {
+    const validIds = new Set([
+        "in-house",
+        "1password",
+        "protonpass",
+        "bitwarden",
+    ]);
+    const enabled = (Array.isArray(prefs.enabled) ? prefs.enabled : []).filter((id) => validIds.has(id));
+    if (enabled.length === 0)
+        enabled.push("in-house");
+    const routing = {};
+    if (prefs.routing && typeof prefs.routing === "object") {
+        for (const [k, v] of Object.entries(prefs.routing)) {
+            if (typeof k === "string" && validIds.has(v)) {
+                routing[k] = v;
+            }
+        }
+    }
+    return { enabled, ...(Object.keys(routing).length > 0 ? { routing } : {}) };
+}
+// ── Detection helpers ──────────────────────────────────────────────
+function detectInHouse() {
+    return {
+        id: "in-house",
+        label: "Eliza (local, encrypted)",
+        available: true,
+        signedIn: true,
+    };
+}
+async function readStoredSession(vault, backend) {
+    try {
+        const value = await vault.get(`pm.${backend}.session`);
+        return value.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+async function detectOnePassword(vault) {
+    const present = await isCommandAvailable("op");
+    if (!present) {
+        return {
+            id: "1password",
+            label: "1Password",
+            available: false,
+            detail: "`op` CLI not installed. Get it at https://developer.1password.com/docs/cli",
+            authMode: null,
+        };
+    }
+    // 1Password 8's CLI refuses to pick a default account when more than
+    // one is registered. `op whoami` with no flags exits 1 ("account is
+    // not signed in") even when desktop integration is fully active and
+    // every concrete `op vault list --account=<sh>` succeeds. Probe the
+    // registered accounts once and pass --account=<sh> to disambiguate.
+    const account = await readDefaultOpAccount();
+    // Step 1: probe `op whoami --account=<sh>` with no session token. When
+    // the user has 1Password 8 desktop app installed and CLI integration
+    // enabled, the CLI authenticates via the desktop app and `whoami`
+    // returns 0 without any session being passed.
+    if (await isOnePasswordDesktopActive(account)) {
+        return {
+            id: "1password",
+            label: "1Password",
+            available: true,
+            signedIn: true,
+            authMode: "desktop-app",
+            detail: "Authenticated via 1Password desktop app.",
+        };
+    }
+    // Step 2: fall back to the stored session token path.
+    const session = await readStoredSession(vault, "1password");
+    if (!session) {
+        return {
+            id: "1password",
+            label: "1Password",
+            available: true,
+            signedIn: false,
+            authMode: null,
+            detail: "`op` is installed but not signed in. Enable 1Password desktop app integration (Settings → Developer → Integrate with 1Password CLI) or use the Sign-in button.",
+        };
+    }
+    const accountArg = account ? [`--account=${account}`] : [];
+    try {
+        await exec("op", [...accountArg, "whoami", `--session=${session}`], {
+            timeout: 3000,
+        });
+        return {
+            id: "1password",
+            label: "1Password",
+            available: true,
+            signedIn: true,
+            authMode: "session-token",
+        };
+    }
+    catch {
+        return {
+            id: "1password",
+            label: "1Password",
+            available: true,
+            signedIn: false,
+            authMode: null,
+            detail: "Stored 1Password session is no longer valid. Sign in again.",
+        };
+    }
+}
+/** Read the first registered 1Password account shorthand, or null. */
+async function readDefaultOpAccount() {
+    try {
+        const { stdout } = await exec("op", ["account", "list", "--format=json"], {
+            timeout: 3000,
+            encoding: "utf8",
+        });
+        const accounts = JSON.parse(stdout);
+        for (const a of accounts) {
+            if (typeof a.shorthand === "string" && a.shorthand.length > 0) {
+                return a.shorthand;
+            }
+            if (typeof a.url === "string") {
+                const sub = a.url.split(".")[0];
+                if (sub)
+                    return sub;
+            }
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * True when a real vault query succeeds without a session token — i.e.
+ * 1Password desktop app integration is active. `op whoami` is unusable
+ * here: even with desktop integration active it exits 1 demanding a
+ * session token. A vault list query IS handled by desktop session
+ * delegation, so probe with that instead. Requires a known account.
+ */
+async function isOnePasswordDesktopActive(account) {
+    if (!account)
+        return false;
+    try {
+        await exec("op", [`--account=${account}`, "vault", "list", "--format=json"], { timeout: 3000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function detectProtonPass() {
+    const present = await isCommandAvailable("protonpass-cli");
+    return {
+        id: "protonpass",
+        label: "Proton Pass",
+        available: present,
+        authMode: null,
+        detail: present
+            ? "Detected; reference storage will be wired when the vendor CLI stabilizes."
+            : "`protonpass-cli` not installed (vendor CLI is in beta).",
+    };
+}
+async function detectBitwarden(vault) {
+    const present = await isCommandAvailable("bw");
+    if (!present) {
+        return {
+            id: "bitwarden",
+            label: "Bitwarden",
+            available: false,
+            detail: "`bw` CLI not installed. https://bitwarden.com/help/cli/",
+            authMode: null,
+        };
+    }
+    const session = await readStoredSession(vault, "bitwarden");
+    const env = session ? { ...process.env, BW_SESSION: session } : process.env;
+    try {
+        const { stdout } = await exec("bw", ["status"], {
+            timeout: 3000,
+            encoding: "utf8",
+            env,
+        });
+        const status = JSON.parse(stdout.trim());
+        if (status.status === "unlocked") {
+            return {
+                id: "bitwarden",
+                label: "Bitwarden",
+                available: true,
+                signedIn: true,
+                authMode: session ? "session-token" : null,
+            };
+        }
+        return {
+            id: "bitwarden",
+            label: "Bitwarden",
+            available: true,
+            signedIn: false,
+            authMode: null,
+            detail: session
+                ? "Stored Bitwarden session is no longer valid. Sign in again."
+                : status.status === "locked"
+                    ? "`bw` is signed in but locked. Use the Sign-in button."
+                    : "`bw` is installed but not signed in. Use the Sign-in button.",
+        };
+    }
+    catch {
+        return {
+            id: "bitwarden",
+            label: "Bitwarden",
+            available: true,
+            signedIn: false,
+            authMode: null,
+            detail: "`bw status` failed; CLI may need an update.",
+        };
+    }
+}
+function mapExternalReveal(out) {
+    return {
+        source: out.source,
+        identifier: out.externalId,
+        username: out.username,
+        password: out.password,
+        domain: out.domain,
+        ...(out.totp ? { totp: out.totp } : {}),
+    };
+}
+async function safeListExternal(_source, fn) {
+    try {
+        const entries = await fn();
+        return { ok: true, entries };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return { ok: false, message };
+    }
+}
+async function isCommandAvailable(cmd) {
+    try {
+        if (process.platform === "win32") {
+            await exec("where.exe", [cmd], { timeout: 3000 });
+        }
+        else {
+            // Use `which` directly — argv array, no shell interpolation.
+            await exec("which", [cmd], { timeout: 3000 });
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../src/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EACL,eAAe,EACf,aAAa,GAEd,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,aAAa,EAIb,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAA0B,MAAM,eAAe,CAAC;AAC3E,OAAO,EAAE,WAAW,EAAc,cAAc,EAAE,MAAM,YAAY,CAAC;AAGrE,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAmEjC,MAAM,CAAC,MAAM,mBAAmB,GAAuB;IACrD,OAAO,EAAE,CAAC,UAAU,CAAC;CACtB,CAAC;AA8GF,MAAM,UAAU,aAAa,CAAC,OAA6B,EAAE;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,IAAI,aAAa,EAAE,CAAC;IAC5C,OAAO,IAAI,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAE/C,MAAM,WAAW;IAEJ;IACQ;IAFnB,YACW,KAAY,EACJ,MAAc;QADtB,UAAK,GAAL,KAAK,CAAO;QACJ,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;YACrD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;gBAClC,OAAO,mBAAmB,CAAC;YAC7B,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAyB;QAC5C,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAC/C,uEAAuE;QACvE,2EAA2E;QAC3E,yEAAyE;QACzE,2CAA2C;QAC3C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;YAChE,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CACP,GAAW,EACX,KAAa,EACb,OAA0B,EAAE;QAE5B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1D,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE;gBAC/B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yBAAyB,MAAM,qHAAqH,CACrJ,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,GAAuB;QAClD,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAe;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,8DAA8D;QAC9D,uDAAuD;QACvD,8DAA8D;QAC9D,kCAAkC;QAClC,OAAO,GAAG,CAAC,MAAM,CACf,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC;YAC1B,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;YACvB,CAAC,KAAK,iBAAiB,CAC1B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,OAAO,CAAC,GAAG,CAAC;YACjB,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAChC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;YAC7B,gBAAgB,EAAE;YAClB,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAkC,EAAE;QAEpC,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM;YACjC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,CAAC,CAAC,SAAS,CAAC;QAEd,wEAAwE;QACxE,sEAAsE;QACtE,gEAAgE;QAChE,2EAA2E;QAC3E,gEAAgE;QAChE,MAAM,QAAQ,GAGT,EAAE,CAAC;QAER,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QAEvE,MAAM,eAAe,GAA6B,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC7C,MAAM,gBAAgB,GACpB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE,QAAQ,KAAK,IAAI,CAAC;QAChE,MAAM,cAAc,GAClB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,EAAE,QAAQ,KAAK,IAAI,CAAC;QAEhE,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,CACtD,qBAAqB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAC/C,CAAC;YACF,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI;gBAAE,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;;gBAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,CACtD,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAC7C,CAAC;YACF,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI;gBAAE,eAAe,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;;gBAC3D,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,+DAA+D;QAC/D,qEAAqE;QACrE,oEAAoE;QACpE,oEAAoE;QACpE,+DAA+D;QAC/D,MAAM,gBAAgB,GAAG,eAAe;YACtC,CAAC,CAAC,eAAe,CAAC,MAAM,CACpB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,eAAe,CAClE;YACH,CAAC,CAAC,eAAe,CAAC;QAEpB,MAAM,eAAe,GAA4B,gBAAgB;aAC9D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;aACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAE7C,oEAAoE;QACpE,wCAAwC;QACxC,MAAM,aAAa,GAAG,CAAC,GAAG,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACtD,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1C,IAAI,EAAE,KAAK,EAAE;gBAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,MAAM,EAAE,CAAC,GAAG,aAAa,EAAE,GAAG,eAAe,CAAC;YAC9C,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,MAA8C,EAC9C,UAAkB;QAElB,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,iEAAiE;YACjE,mEAAmE;YACnE,iCAAiC;YACjC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;gBACf,MAAM,IAAI,SAAS,CACjB,6EAA6E,UAAU,GAAG,CAC3F,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAC7C,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,IAAI,QAAQ,EAAE,CAChE,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAuB;gBACjC,MAAM,EAAE,UAAU;gBAClB,UAAU;gBACV,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,MAAM,sBAAsB,CACtC,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,MAAM,EACX,UAAU,CACX,CAAC;YACF,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,YAAY;QACZ,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC5E,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAC/B,eAAmC;QAEnC,MAAM,SAAS,GAAiC,eAAe;YAC7D,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,eAAe,CAAC;YACpD,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3B,MAAM,EAAE,UAAmB;YAC3B,UAAU,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE;YACvC,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,QAAQ;YACjB,SAAS,EAAE,CAAC,CAAC,YAAY;SAC1B,CAAC,CAAC,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,GAAW,EACX,IAAuB;QAEvB,0CAA0C;QAC1C,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,gEAAgE;QAChE,gEAAgE;QAChE,wEAAwE;QACxE,2DAA2D;QAC3D,kBAAkB;QAClB,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,UAAU,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,kDAAkD;QAClD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,uEAAuE;QACvE,oEAAoE;QACpE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;IACxC,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,KAAyB;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAY;QAClC,UAAU;QACV,WAAW;QACX,YAAY;QACZ,WAAW;KACZ,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CACxE,CAAC,EAAE,EAAmB,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAe,CAAC,CACvD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,IAAI,KAAK,CAAC,OAAO,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED,sEAAsE;AAEtE,SAAS,aAAa;IACpB,OAAO;QACL,EAAE,EAAE,UAAU;QACd,KAAK,EAAE,0BAA0B;QACjC,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,KAAY,EACZ,OAAkC;IAElC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,MAAM,OAAO,UAAU,CAAC,CAAC;QACvD,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAAY;IAC3C,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,KAAK;YAChB,MAAM,EACJ,4EAA4E;YAC9E,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAED,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAE7C,uEAAuE;IACvE,qEAAqE;IACrE,kEAAkE;IAClE,8CAA8C;IAC9C,IAAI,MAAM,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,aAAa;YACvB,MAAM,EAAE,0CAA0C;SACnD,CAAC;IACJ,CAAC;IAED,sDAAsD;IACtD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;YACd,MAAM,EACJ,gKAAgK;SACnK,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,UAAU,EAAE,QAAQ,EAAE,aAAa,OAAO,EAAE,CAAC,EAAE;YAClE,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,eAAe;SAC1B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,6DAA6D;SACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,oBAAoB;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE;YACxE,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAGhC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9D,OAAO,CAAC,CAAC,SAAS,CAAC;YACrB,CAAC;YACD,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAChC,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,0BAA0B,CACvC,OAAsB;IAEtB,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,CACR,IAAI,EACJ,CAAC,aAAa,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,EAC1D,EAAE,OAAO,EAAE,IAAI,EAAE,CAClB,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC7B,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,YAAY;QAChB,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,OAAO;QAClB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO;YACb,CAAC,CAAC,2EAA2E;YAC7E,CAAC,CAAC,yDAAyD;KAC9D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAY;IACzC,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,yDAAyD;YACjE,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,EAAE;YAC9C,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,MAAM;YAChB,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAwB,CAAC;QAChE,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACjC,OAAO;gBACL,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,WAAW;gBAClB,SAAS,EAAE,IAAI;gBACf,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI;aAC3C,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,6DAA6D;gBAC/D,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;oBAC1B,CAAC,CAAC,uDAAuD;oBACzD,CAAC,CAAC,8DAA8D;SACrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,WAAW;YACf,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,IAAI;YACf,QAAQ,EAAE,KAAK;YACf,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,6CAA6C;SACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAwB;IACjD,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAWD,KAAK,UAAU,gBAAgB,CAC7B,OAAkC,EAClC,EAAoD;IAEpD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAC3C,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,6DAA6D;YAC7D,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}