@geminixiang/mama 0.2.0-beta.1 → 0.2.0-beta.2

package/dist/events.js

@@ -83,7 +83,8 @@ export class EventsWatcher {
                 results.push({
                     filename,
                     platform: data.platform,
-                    channelId: data.channelId,
+                    conversationId: data.conversationId,
+                    conversationKind: data.conversationKind,
                     text: data.text,
                     schedule: data.schedule,
                     timezone: data.timezone,
@@ -193,17 +194,24 @@ export class EventsWatcher {
     }
     parseEvent(content, filename) {
         const data = JSON.parse(content);
-        if (!data.type || !data.channelId || !data.text) {
-            throw new Error(`Missing required fields (type, channelId, text) in ${filename}`);
+        const conversationId = typeof data.conversationId === "string"
+            ? data.conversationId
+            : typeof data.channelId === "string"
+                ? data.channelId
+                : undefined;
+        if (!data.type || !conversationId || !data.text) {
+            throw new Error(`Missing required fields (type, conversationId, text) in ${filename}`);
         }
         const platform = this.resolvePlatform(data.platform, filename);
+        const conversationKind = this.resolveConversationKind(platform, conversationId, data.conversationKind);
         const userId = typeof data.userId === "string" ? data.userId : undefined;
         switch (data.type) {
             case "immediate":
                 return {
                     type: "immediate",
                     platform,
-                    channelId: data.channelId,
+                    conversationId,
+                    conversationKind,
                     userId,
                     text: data.text,
                 };
@@ -214,7 +222,8 @@ export class EventsWatcher {
                 return {
                     type: "one-shot",
                     platform,
-                    channelId: data.channelId,
+                    conversationId,
+                    conversationKind,
                     userId,
                     text: data.text,
                     at: data.at,
@@ -229,7 +238,8 @@ export class EventsWatcher {
                 return {
                     type: "periodic",
                     platform,
-                    channelId: data.channelId,
+                    conversationId,
+                    conversationKind,
                     userId,
                     text: data.text,
                     schedule: data.schedule,
@@ -253,6 +263,18 @@ export class EventsWatcher {
         }
         throw new Error(`Missing required field 'platform' in ${filename}. Available platforms: ${availablePlatforms.join(", ")}`);
     }
+    resolveConversationKind(platform, conversationId, conversationKindValue) {
+        if (conversationKindValue === "direct" || conversationKindValue === "shared") {
+            return conversationKindValue;
+        }
+        if (platform === "slack") {
+            return conversationId.startsWith("D") ? "direct" : "shared";
+        }
+        if (platform === "telegram") {
+            return conversationId.startsWith("-") ? "shared" : "direct";
+        }
+        return "shared";
+    }
     handleImmediate(filename, event) {
         const filePath = join(this.eventsDir, filename);
         // Check if stale (created before harness started)
@@ -327,19 +349,17 @@ export class EventsWatcher {
             }
             return;
         }
-        // Create synthetic BotEvent. Keep a stable channel session key so recurring
+        // Create synthetic BotEvent. Keep a stable conversation session key so recurring
         // reminders share context, but use a unique synthetic message id because
-        // some adapters treat `ts`/message id as a reply target.
-        // `user` falls back to "EVENT" when the event file omits a creator; vault
-        // routing then resolves to an empty auto-created entry or shared container vault
-        // with no credentials configured yet.
+        // some adapters treat ts/message id as a reply target.
         const syntheticEvent = {
             type: "mention",
-            conversationId: event.channelId,
+            conversationId: event.conversationId,
+            conversationKind: event.conversationKind,
             user: event.userId ?? "EVENT",
             text: message,
             ts: `event:${filename}`,
-            sessionKey: event.channelId,
+            sessionKey: event.conversationId,
         };
         // Enqueue for processing
         const enqueued = bot.enqueueEvent(syntheticEvent);

package/dist/events.js.map

@@ -1 +1 @@
-{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EACL,UAAU,EAEV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,KAAK,GACN,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AA8ChC,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,OAAO,aAAa;IAQxB,YACU,SAAiB,EACjB,cAAmC;QADnC,cAAS,GAAT,SAAS,CAAQ;QACjB,mBAAc,GAAd,cAAc,CAAqB;QATrC,WAAM,GAAgC,IAAI,GAAG,EAAE,CAAC;QAChD,UAAK,GAAsB,IAAI,GAAG,EAAE,CAAC;QACrC,mBAAc,GAAgC,IAAI,GAAG,EAAE,CAAC;QAExD,YAAO,GAAqB,IAAI,CAAC;QACjC,eAAU,GAAgB,IAAI,GAAG,EAAE,CAAC;QAM1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,iCAAiC;QACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,GAAG,CAAC,OAAO,CAAC,iCAAiC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAE/D,sBAAsB;QACtB,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,oBAAoB;QACpB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;YAC5D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO;YACrD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,OAAO,CAAC,oCAAoC,IAAI,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,CAAC;IAChF,CAAC;IAED;;OAEG;IACH,IAAI;QACF,kBAAkB;QAClB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;QAED,6BAA6B;QAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAE5B,8BAA8B;QAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAEpB,uBAAuB;QACvB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAEnB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAChD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAChD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ;oBACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,IAAI;iBACrC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,QAAQ,CAAC,QAAgB,EAAE,EAAc;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CACrB,QAAQ,EACR,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrC,EAAE,EAAE,CAAC;QACP,CAAC,EAAE,WAAW,CAAC,CAChB,CAAC;IACJ,CAAC;IAEO,YAAY;QAClB,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,iCAAiC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,QAAgB;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEhD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,mBAAmB;YACnB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,sDAAsD;YACtD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,WAAW;YACX,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,QAAgB;QACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAE3C,GAAG,CAAC,OAAO,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAEO,eAAe,CAAC,QAAgB;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,QAAgB;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEhD,qBAAqB;QACrB,IAAI,KAAK,GAAqB,IAAI,CAAC;QACnC,IAAI,SAAS,GAAiB,IAAI,CAAC;QAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAClD,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC3C,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChE,IAAI,CAAC,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,UAAU,CACZ,oCAAoC,WAAW,aAAa,QAAQ,EAAE,EACtE,SAAS,EAAE,OAAO,CACnB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE9B,yBAAyB;QACzB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,WAAW;gBACd,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACtC,MAAM;YACR,KAAK,UAAU;gBACb,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACpC,MAAM;YACR,KAAK,UAAU;gBACb,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACrC,MAAM;QACV,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,OAAe,EAAE,QAAgB;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEjC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAEzE,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,WAAW;gBACd,OAAO;oBACL,IAAI,EAAE,WAAW;oBACjB,QAAQ;oBACR,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,MAAM;oBACN,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC;YAEJ,KAAK,UAAU;gBACb,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,EAAE,CAAC,CAAC;gBAC1E,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,QAAQ;oBACR,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,MAAM;oBACN,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,EAAE,EAAE,IAAI,CAAC,EAAE;iBACZ,CAAC;YAEJ,KAAK,UAAU;gBACb,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,QAAQ,EAAE,CAAC,CAAC;gBAChF,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,QAAQ,EAAE,CAAC,CAAC;gBAChF,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,QAAQ;oBACR,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,MAAM;oBACN,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC;YAEJ;gBACE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,IAAI,QAAQ,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,aAAsB,EAAE,QAAgB;QAC9D,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE5D,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,qBAAqB,aAAa,QAAQ,QAAQ,sBAAsB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ,0BAA0B,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1G,CAAC;IACJ,CAAC;IAEO,eAAe,CAAC,QAAgB,EAAE,KAAqB;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEhD,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChC,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;gBAClC,GAAG,CAAC,OAAO,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAC;gBAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;YAC7B,OAAO;QACT,CAAC;QAED,GAAG,CAAC,OAAO,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAEO,aAAa,CAAC,QAAgB,EAAE,KAAmB;QACzD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,kCAAkC;YAClC,GAAG,CAAC,OAAO,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;QAC3B,GAAG,CAAC,OAAO,CAAC,8BAA8B,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7B,GAAG,CAAC,OAAO,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC,EAAE,KAAK,CAAC,CAAC;QAEV,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAEO,cAAc,CAAC,QAAgB,EAAE,KAAoB;QAC3D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE;gBACvE,GAAG,CAAC,OAAO,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;gBACrD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,+BAA+B;YACvE,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,GAAG,CAAC,OAAO,CACT,6BAA6B,QAAQ,eAAe,IAAI,EAAE,WAAW,EAAE,IAAI,SAAS,EAAE,CACvF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,6BAA6B,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACxF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,QAAgB,EAAE,KAAgB,EAAE,WAAW,GAAY,IAAI;QAC7E,qBAAqB;QACrB,IAAI,YAAoB,CAAC;QACzB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,WAAW;gBACd,YAAY,GAAG,WAAW,CAAC;gBAC3B,MAAM;YACR,KAAK,UAAU;gBACb,YAAY,GAAG,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM;YACR,KAAK,UAAU;gBACb,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC;gBAC9B,MAAM;QACV,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,QAAQ,IAAI,KAAK,CAAC,IAAI,IAAI,YAAY,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAClF,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEhD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,UAAU,CAAC,yCAAyC,KAAK,CAAC,QAAQ,GAAG,EAAE,QAAQ,CAAC,CAAC;YACrF,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO;QACT,CAAC;QAED,4EAA4E;QAC5E,yEAAyE;QACzE,yDAAyD;QACzD,0EAA0E;QAC1E,iFAAiF;QACjF,sCAAsC;QACtC,MAAM,cAAc,GAAa;YAC/B,IAAI,EAAE,SAAS;YACf,cAAc,EAAE,KAAK,CAAC,SAAS;YAC/B,IAAI,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO;YAC7B,IAAI,EAAE,OAAO;YACb,EAAE,EAAE,SAAS,QAAQ,EAAE;YACvB,UAAU,EAAE,KAAK,CAAC,SAAS;SAC5B,CAAC;QAEF,yBAAyB;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QAElD,IAAI,QAAQ,IAAI,WAAW,EAAE,CAAC;YAC5B,gEAAgE;YAChE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,GAAG,CAAC,UAAU,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;YAC3D,oDAAoD;YACpD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,IAAI,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnE,GAAG,CAAC,UAAU,CAAC,gCAAgC,QAAQ,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,cAAmC;IAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO,IAAI,aAAa,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;AACtD,CAAC","sourcesContent":["import { Cron } from \"croner\";\nimport {\n  existsSync,\n  type FSWatcher,\n  mkdirSync,\n  readdirSync,\n  readFileSync,\n  statSync,\n  unlinkSync,\n  watch,\n} from \"fs\";\nimport { readFile } from \"fs/promises\";\nimport { join } from \"path\";\nimport type { Bot, BotEvent } from \"./adapter.js\";\nimport * as log from \"./log.js\";\n\n// ============================================================================\n// Event Types\n// ============================================================================\n\nexport interface ImmediateEvent {\n  type: \"immediate\";\n  platform: string;\n  channelId: string;\n  /** Creator userId — routes tool execution to the sandbox's vault selection for that user when fired. */\n  userId?: string;\n  text: string;\n}\n\nexport interface OneShotEvent {\n  type: \"one-shot\";\n  platform: string;\n  channelId: string;\n  userId?: string;\n  text: string;\n  at: string; // ISO 8601 with timezone offset\n}\n\nexport interface PeriodicEvent {\n  type: \"periodic\";\n  platform: string;\n  channelId: string;\n  userId?: string;\n  text: string;\n  schedule: string; // cron syntax\n  timezone: string; // IANA timezone\n}\n\nexport type MamaEvent = ImmediateEvent | OneShotEvent | PeriodicEvent;\n\nexport interface PeriodicEventInfo {\n  filename: string;\n  platform: string;\n  channelId: string;\n  text: string;\n  schedule: string;\n  timezone: string;\n  nextRun: string | null; // ISO 8601\n}\n\n// ============================================================================\n// EventsWatcher\n// ============================================================================\n\nconst DEBOUNCE_MS = 100;\nconst MAX_RETRIES = 3;\nconst RETRY_BASE_MS = 100;\n\nexport class EventsWatcher {\n  private timers: Map<string, NodeJS.Timeout> = new Map();\n  private crons: Map<string, Cron> = new Map();\n  private debounceTimers: Map<string, NodeJS.Timeout> = new Map();\n  private startTime: number;\n  private watcher: FSWatcher | null = null;\n  private knownFiles: Set<string> = new Set();\n\n  constructor(\n    private eventsDir: string,\n    private botsByPlatform: Record<string, Bot>,\n  ) {\n    this.startTime = Date.now();\n  }\n\n  /**\n   * Start watching for events. Call this after platform bots are initialized.\n   */\n  start(): void {\n    // Ensure events directory exists\n    if (!existsSync(this.eventsDir)) {\n      mkdirSync(this.eventsDir, { recursive: true });\n    }\n\n    log.logInfo(`Events watcher starting, dir: ${this.eventsDir}`);\n\n    // Scan existing files\n    this.scanExisting();\n\n    // Watch for changes\n    this.watcher = watch(this.eventsDir, (_eventType, filename) => {\n      if (!filename || !filename.endsWith(\".json\")) return;\n      this.debounce(filename, () => this.handleFileChange(filename));\n    });\n\n    log.logInfo(`Events watcher started, tracking ${this.knownFiles.size} files`);\n  }\n\n  /**\n   * Stop watching and cancel all scheduled events.\n   */\n  stop(): void {\n    // Stop fs watcher\n    if (this.watcher) {\n      this.watcher.close();\n      this.watcher = null;\n    }\n\n    // Cancel all debounce timers\n    for (const timer of this.debounceTimers.values()) {\n      clearTimeout(timer);\n    }\n    this.debounceTimers.clear();\n\n    // Cancel all scheduled timers\n    for (const timer of this.timers.values()) {\n      clearTimeout(timer);\n    }\n    this.timers.clear();\n\n    // Cancel all cron jobs\n    for (const cron of this.crons.values()) {\n      cron.stop();\n    }\n    this.crons.clear();\n\n    this.knownFiles.clear();\n    log.logInfo(\"Events watcher stopped\");\n  }\n\n  /**\n   * Return all active periodic (cron) events with their next run time.\n   */\n  getPeriodicEvents(): PeriodicEventInfo[] {\n    const results: PeriodicEventInfo[] = [];\n    for (const [filename, cron] of this.crons) {\n      const filePath = join(this.eventsDir, filename);\n      try {\n        const content = readFileSync(filePath, \"utf-8\");\n        const data = this.parseEvent(content, filename);\n        if (!data || data.type !== \"periodic\") {\n          continue;\n        }\n        const next = cron.nextRun();\n        results.push({\n          filename,\n          platform: data.platform,\n          channelId: data.channelId,\n          text: data.text,\n          schedule: data.schedule,\n          timezone: data.timezone,\n          nextRun: next?.toISOString() ?? null,\n        });\n      } catch {\n        // File may have been deleted or corrupted, skip\n      }\n    }\n    return results;\n  }\n\n  private debounce(filename: string, fn: () => void): void {\n    const existing = this.debounceTimers.get(filename);\n    if (existing) {\n      clearTimeout(existing);\n    }\n    this.debounceTimers.set(\n      filename,\n      setTimeout(() => {\n        this.debounceTimers.delete(filename);\n        fn();\n      }, DEBOUNCE_MS),\n    );\n  }\n\n  private scanExisting(): void {\n    let files: string[];\n    try {\n      files = readdirSync(this.eventsDir).filter((f) => f.endsWith(\".json\"));\n    } catch (err) {\n      log.logWarning(\"Failed to read events directory\", String(err));\n      return;\n    }\n\n    for (const filename of files) {\n      this.handleFile(filename);\n    }\n  }\n\n  private handleFileChange(filename: string): void {\n    const filePath = join(this.eventsDir, filename);\n\n    if (!existsSync(filePath)) {\n      // File was deleted\n      this.handleDelete(filename);\n    } else if (this.knownFiles.has(filename)) {\n      // File was modified - cancel existing and re-schedule\n      this.cancelScheduled(filename);\n      this.handleFile(filename);\n    } else {\n      // New file\n      this.handleFile(filename);\n    }\n  }\n\n  private handleDelete(filename: string): void {\n    if (!this.knownFiles.has(filename)) return;\n\n    log.logInfo(`Event file deleted: ${filename}`);\n    this.cancelScheduled(filename);\n    this.knownFiles.delete(filename);\n  }\n\n  private cancelScheduled(filename: string): void {\n    const timer = this.timers.get(filename);\n    if (timer) {\n      clearTimeout(timer);\n      this.timers.delete(filename);\n    }\n\n    const cron = this.crons.get(filename);\n    if (cron) {\n      cron.stop();\n      this.crons.delete(filename);\n    }\n  }\n\n  private async handleFile(filename: string): Promise<void> {\n    const filePath = join(this.eventsDir, filename);\n\n    // Parse with retries\n    let event: MamaEvent | null = null;\n    let lastError: Error | null = null;\n\n    for (let i = 0; i < MAX_RETRIES; i++) {\n      try {\n        const content = await readFile(filePath, \"utf-8\");\n        event = this.parseEvent(content, filename);\n        break;\n      } catch (err) {\n        lastError = err instanceof Error ? err : new Error(String(err));\n        if (i < MAX_RETRIES - 1) {\n          await this.sleep(RETRY_BASE_MS * 2 ** i);\n        }\n      }\n    }\n\n    if (!event) {\n      log.logWarning(\n        `Failed to parse event file after ${MAX_RETRIES} retries: ${filename}`,\n        lastError?.message,\n      );\n      this.deleteFile(filename);\n      return;\n    }\n\n    this.knownFiles.add(filename);\n\n    // Schedule based on type\n    switch (event.type) {\n      case \"immediate\":\n        this.handleImmediate(filename, event);\n        break;\n      case \"one-shot\":\n        this.handleOneShot(filename, event);\n        break;\n      case \"periodic\":\n        this.handlePeriodic(filename, event);\n        break;\n    }\n  }\n\n  private parseEvent(content: string, filename: string): MamaEvent | null {\n    const data = JSON.parse(content);\n\n    if (!data.type || !data.channelId || !data.text) {\n      throw new Error(`Missing required fields (type, channelId, text) in ${filename}`);\n    }\n\n    const platform = this.resolvePlatform(data.platform, filename);\n\n    const userId = typeof data.userId === \"string\" ? data.userId : undefined;\n\n    switch (data.type) {\n      case \"immediate\":\n        return {\n          type: \"immediate\",\n          platform,\n          channelId: data.channelId,\n          userId,\n          text: data.text,\n        };\n\n      case \"one-shot\":\n        if (!data.at) {\n          throw new Error(`Missing 'at' field for one-shot event in ${filename}`);\n        }\n        return {\n          type: \"one-shot\",\n          platform,\n          channelId: data.channelId,\n          userId,\n          text: data.text,\n          at: data.at,\n        };\n\n      case \"periodic\":\n        if (!data.schedule) {\n          throw new Error(`Missing 'schedule' field for periodic event in ${filename}`);\n        }\n        if (!data.timezone) {\n          throw new Error(`Missing 'timezone' field for periodic event in ${filename}`);\n        }\n        return {\n          type: \"periodic\",\n          platform,\n          channelId: data.channelId,\n          userId,\n          text: data.text,\n          schedule: data.schedule,\n          timezone: data.timezone,\n        };\n\n      default:\n        throw new Error(`Unknown event type '${data.type}' in ${filename}`);\n    }\n  }\n\n  private resolvePlatform(platformValue: unknown, filename: string): string {\n    const availablePlatforms = Object.keys(this.botsByPlatform);\n\n    if (typeof platformValue === \"string\" && platformValue.trim().length > 0) {\n      const platform = platformValue.trim().toLowerCase();\n      if (!this.botsByPlatform[platform]) {\n        throw new Error(\n          `Unknown platform '${platformValue}' in ${filename}. Expected one of: ${availablePlatforms.join(\", \")}`,\n        );\n      }\n      return platform;\n    }\n\n    if (availablePlatforms.length === 1) {\n      return availablePlatforms[0];\n    }\n\n    throw new Error(\n      `Missing required field 'platform' in ${filename}. Available platforms: ${availablePlatforms.join(\", \")}`,\n    );\n  }\n\n  private handleImmediate(filename: string, event: ImmediateEvent): void {\n    const filePath = join(this.eventsDir, filename);\n\n    // Check if stale (created before harness started)\n    try {\n      const stat = statSync(filePath);\n      if (stat.mtimeMs < this.startTime) {\n        log.logInfo(`Stale immediate event, deleting: ${filename}`);\n        this.deleteFile(filename);\n        return;\n      }\n    } catch {\n      // File may have been deleted\n      return;\n    }\n\n    log.logInfo(`Executing immediate event: ${filename}`);\n    this.execute(filename, event);\n  }\n\n  private handleOneShot(filename: string, event: OneShotEvent): void {\n    const atTime = new Date(event.at).getTime();\n    const now = Date.now();\n\n    if (atTime <= now) {\n      // Past - delete without executing\n      log.logInfo(`One-shot event in the past, deleting: ${filename}`);\n      this.deleteFile(filename);\n      return;\n    }\n\n    const delay = atTime - now;\n    log.logInfo(`Scheduling one-shot event: ${filename} in ${Math.round(delay / 1000)}s`);\n\n    const timer = setTimeout(() => {\n      this.timers.delete(filename);\n      log.logInfo(`Executing one-shot event: ${filename}`);\n      this.execute(filename, event);\n    }, delay);\n\n    this.timers.set(filename, timer);\n  }\n\n  private handlePeriodic(filename: string, event: PeriodicEvent): void {\n    try {\n      const cron = new Cron(event.schedule, { timezone: event.timezone }, () => {\n        log.logInfo(`Executing periodic event: ${filename}`);\n        this.execute(filename, event, false); // Don't delete periodic events\n      });\n\n      this.crons.set(filename, cron);\n\n      const next = cron.nextRun();\n      log.logInfo(\n        `Scheduled periodic event: ${filename}, next run: ${next?.toISOString() ?? \"unknown\"}`,\n      );\n    } catch (err) {\n      log.logWarning(`Invalid cron schedule for ${filename}: ${event.schedule}`, String(err));\n      this.deleteFile(filename);\n    }\n  }\n\n  private execute(filename: string, event: MamaEvent, deleteAfter: boolean = true): void {\n    // Format the message\n    let scheduleInfo: string;\n    switch (event.type) {\n      case \"immediate\":\n        scheduleInfo = \"immediate\";\n        break;\n      case \"one-shot\":\n        scheduleInfo = event.at;\n        break;\n      case \"periodic\":\n        scheduleInfo = event.schedule;\n        break;\n    }\n\n    const message = `[EVENT:${filename}:${event.type}:${scheduleInfo}] ${event.text}`;\n    const bot = this.botsByPlatform[event.platform];\n\n    if (!bot) {\n      log.logWarning(`No bot configured for event platform '${event.platform}'`, filename);\n      if (deleteAfter) {\n        this.deleteFile(filename);\n      }\n      return;\n    }\n\n    // Create synthetic BotEvent. Keep a stable channel session key so recurring\n    // reminders share context, but use a unique synthetic message id because\n    // some adapters treat `ts`/message id as a reply target.\n    // `user` falls back to \"EVENT\" when the event file omits a creator; vault\n    // routing then resolves to an empty auto-created entry or shared container vault\n    // with no credentials configured yet.\n    const syntheticEvent: BotEvent = {\n      type: \"mention\",\n      conversationId: event.channelId,\n      user: event.userId ?? \"EVENT\",\n      text: message,\n      ts: `event:${filename}`,\n      sessionKey: event.channelId,\n    };\n\n    // Enqueue for processing\n    const enqueued = bot.enqueueEvent(syntheticEvent);\n\n    if (enqueued && deleteAfter) {\n      // Delete file after successful enqueue (immediate and one-shot)\n      this.deleteFile(filename);\n    } else if (!enqueued) {\n      log.logWarning(`Event queue full, discarded: ${filename}`);\n      // Still delete immediate/one-shot even if discarded\n      if (deleteAfter) {\n        this.deleteFile(filename);\n      }\n    }\n  }\n\n  private deleteFile(filename: string): void {\n    const filePath = join(this.eventsDir, filename);\n    try {\n      unlinkSync(filePath);\n    } catch (err) {\n      // ENOENT is fine (file already deleted), other errors are warnings\n      if (err instanceof Error && \"code\" in err && err.code !== \"ENOENT\") {\n        log.logWarning(`Failed to delete event file: ${filename}`, String(err));\n      }\n    }\n    this.knownFiles.delete(filename);\n  }\n\n  private sleep(ms: number): Promise<void> {\n    return new Promise((resolve) => setTimeout(resolve, ms));\n  }\n}\n\n/**\n * Create an events watcher for all configured platforms.\n */\nexport function createEventsWatcher(\n  workspaceDir: string,\n  botsByPlatform: Record<string, Bot>,\n): EventsWatcher {\n  const eventsDir = join(workspaceDir, \"events\");\n  return new EventsWatcher(eventsDir, botsByPlatform);\n}\n"]}
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EACL,UAAU,EAEV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,KAAK,GACN,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAkDhC,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B,MAAM,OAAO,aAAa;IAQxB,YACU,SAAiB,EACjB,cAAmC;QADnC,cAAS,GAAT,SAAS,CAAQ;QACjB,mBAAc,GAAd,cAAc,CAAqB;QATrC,WAAM,GAAgC,IAAI,GAAG,EAAE,CAAC;QAChD,UAAK,GAAsB,IAAI,GAAG,EAAE,CAAC;QACrC,mBAAc,GAAgC,IAAI,GAAG,EAAE,CAAC;QAExD,YAAO,GAAqB,IAAI,CAAC;QACjC,eAAU,GAAgB,IAAI,GAAG,EAAE,CAAC;QAM1C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,KAAK;QACH,iCAAiC;QACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QAED,GAAG,CAAC,OAAO,CAAC,iCAAiC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAE/D,sBAAsB;QACtB,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,oBAAoB;QACpB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE;YAC5D,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO;YACrD,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,OAAO,CAAC,oCAAoC,IAAI,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,CAAC;IAChF,CAAC;IAED;;OAEG;IACH,IAAI;QACF,kBAAkB;QAClB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACtB,CAAC;QAED,6BAA6B;QAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;YACjD,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAE5B,8BAA8B;QAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAEpB,uBAAuB;QACvB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAEnB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACxC,CAAC;IAED;;OAEG;IACH,iBAAiB;QACf,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAChD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAChD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACtC,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC5B,OAAO,CAAC,IAAI,CAAC;oBACX,QAAQ;oBACR,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,cAAc,EAAE,IAAI,CAAC,cAAc;oBACnC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;oBACvC,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,IAAI;iBACrC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;YAClD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,QAAQ,CAAC,QAAgB,EAAE,EAAc;QAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,GAAG,CACrB,QAAQ,EACR,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACrC,EAAE,EAAE,CAAC;QACP,CAAC,EAAE,WAAW,CAAC,CAChB,CAAC;IACJ,CAAC;IAEO,YAAY;QAClB,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,iCAAiC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,QAAgB;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEhD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,mBAAmB;YACnB,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,sDAAsD;YACtD,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC/B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,WAAW;YACX,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,QAAgB;QACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,OAAO;QAE3C,GAAG,CAAC,OAAO,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAEO,eAAe,CAAC,QAAgB;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,QAAgB;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEhD,qBAAqB;QACrB,IAAI,KAAK,GAAqB,IAAI,CAAC;QACnC,IAAI,SAAS,GAAiB,IAAI,CAAC;QAEnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAClD,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC3C,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChE,IAAI,CAAC,GAAG,WAAW,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,UAAU,CACZ,oCAAoC,WAAW,aAAa,QAAQ,EAAE,EACtE,SAAS,EAAE,OAAO,CACnB,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAE9B,yBAAyB;QACzB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,WAAW;gBACd,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACtC,MAAM;YACR,KAAK,UAAU;gBACb,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACpC,MAAM;YACR,KAAK,UAAU;gBACb,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACrC,MAAM;QACV,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,OAAe,EAAE,QAAgB;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,cAAc,GAClB,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ;YACrC,CAAC,CAAC,IAAI,CAAC,cAAc;YACrB,CAAC,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAClC,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,SAAS,CAAC;QAElB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,2DAA2D,QAAQ,EAAE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC/D,MAAM,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CACnD,QAAQ,EACR,cAAc,EACd,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAEzE,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,WAAW;gBACd,OAAO;oBACL,IAAI,EAAE,WAAW;oBACjB,QAAQ;oBACR,cAAc;oBACd,gBAAgB;oBAChB,MAAM;oBACN,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,CAAC;YAEJ,KAAK,UAAU;gBACb,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,EAAE,CAAC,CAAC;gBAC1E,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,QAAQ;oBACR,cAAc;oBACd,gBAAgB;oBAChB,MAAM;oBACN,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,EAAE,EAAE,IAAI,CAAC,EAAE;iBACZ,CAAC;YAEJ,KAAK,UAAU;gBACb,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,QAAQ,EAAE,CAAC,CAAC;gBAChF,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,QAAQ,EAAE,CAAC,CAAC;gBAChF,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,UAAU;oBAChB,QAAQ;oBACR,cAAc;oBACd,gBAAgB;oBAChB,MAAM;oBACN,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC;YAEJ;gBACE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,IAAI,QAAQ,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IAEO,eAAe,CAAC,aAAsB,EAAE,QAAgB;QAC9D,MAAM,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAE5D,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,KAAK,CACb,qBAAqB,aAAa,QAAQ,QAAQ,sBAAsB,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxG,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,IAAI,KAAK,CACb,wCAAwC,QAAQ,0BAA0B,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1G,CAAC;IACJ,CAAC;IAEO,uBAAuB,CAC7B,QAAgB,EAChB,cAAsB,EACtB,qBAA8B;QAE9B,IAAI,qBAAqB,KAAK,QAAQ,IAAI,qBAAqB,KAAK,QAAQ,EAAE,CAAC;YAC7E,OAAO,qBAAqB,CAAC;QAC/B,CAAC;QAED,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,OAAO,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9D,CAAC;QAED,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC5B,OAAO,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9D,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,eAAe,CAAC,QAAgB,EAAE,KAAqB;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAEhD,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChC,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;gBAClC,GAAG,CAAC,OAAO,CAAC,oCAAoC,QAAQ,EAAE,CAAC,CAAC;gBAC5D,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;YAC7B,OAAO;QACT,CAAC;QAED,GAAG,CAAC,OAAO,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAEO,aAAa,CAAC,QAAgB,EAAE,KAAmB;QACzD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;YAClB,kCAAkC;YAClC,GAAG,CAAC,OAAO,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;QAC3B,GAAG,CAAC,OAAO,CAAC,8BAA8B,QAAQ,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7B,GAAG,CAAC,OAAO,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC,EAAE,KAAK,CAAC,CAAC;QAEV,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAEO,cAAc,CAAC,QAAgB,EAAE,KAAoB;QAC3D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE;gBACvE,GAAG,CAAC,OAAO,CAAC,6BAA6B,QAAQ,EAAE,CAAC,CAAC;gBACrD,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,+BAA+B;YACvE,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5B,GAAG,CAAC,OAAO,CACT,6BAA6B,QAAQ,eAAe,IAAI,EAAE,WAAW,EAAE,IAAI,SAAS,EAAE,CACvF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,6BAA6B,QAAQ,KAAK,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YACxF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,QAAgB,EAAE,KAAgB,EAAE,WAAW,GAAY,IAAI;QAC7E,qBAAqB;QACrB,IAAI,YAAoB,CAAC;QACzB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,WAAW;gBACd,YAAY,GAAG,WAAW,CAAC;gBAC3B,MAAM;YACR,KAAK,UAAU;gBACb,YAAY,GAAG,KAAK,CAAC,EAAE,CAAC;gBACxB,MAAM;YACR,KAAK,UAAU;gBACb,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC;gBAC9B,MAAM;QACV,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,QAAQ,IAAI,KAAK,CAAC,IAAI,IAAI,YAAY,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;QAClF,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAEhD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,UAAU,CAAC,yCAAyC,KAAK,CAAC,QAAQ,GAAG,EAAE,QAAQ,CAAC,CAAC;YACrF,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO;QACT,CAAC;QAED,iFAAiF;QACjF,yEAAyE;QACzE,uDAAuD;QACvD,MAAM,cAAc,GAAa;YAC/B,IAAI,EAAE,SAAS;YACf,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,IAAI,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO;YAC7B,IAAI,EAAE,OAAO;YACb,EAAE,EAAE,SAAS,QAAQ,EAAE;YACvB,UAAU,EAAE,KAAK,CAAC,cAAc;SACjC,CAAC;QAEF,yBAAyB;QACzB,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QAElD,IAAI,QAAQ,IAAI,WAAW,EAAE,CAAC;YAC5B,gEAAgE;YAChE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,GAAG,CAAC,UAAU,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;YAC3D,oDAAoD;YACpD,IAAI,WAAW,EAAE,CAAC;gBAChB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,QAAgB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,UAAU,CAAC,QAAQ,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,IAAI,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACnE,GAAG,CAAC,UAAU,CAAC,gCAAgC,QAAQ,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAEO,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,cAAmC;IAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO,IAAI,aAAa,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;AACtD,CAAC","sourcesContent":["import { Cron } from \"croner\";\nimport {\n  existsSync,\n  type FSWatcher,\n  mkdirSync,\n  readdirSync,\n  readFileSync,\n  statSync,\n  unlinkSync,\n  watch,\n} from \"fs\";\nimport { readFile } from \"fs/promises\";\nimport { join } from \"path\";\nimport type { Bot, BotEvent, ConversationKind } from \"./adapter.js\";\nimport * as log from \"./log.js\";\n\n// ============================================================================\n// Event Types\n// ============================================================================\n\nexport interface ImmediateEvent {\n  type: \"immediate\";\n  platform: string;\n  conversationId: string;\n  conversationKind: ConversationKind;\n  /** Creator userId — routes tool execution to that user's vault selection when fired. */\n  userId?: string;\n  text: string;\n}\n\nexport interface OneShotEvent {\n  type: \"one-shot\";\n  platform: string;\n  conversationId: string;\n  conversationKind: ConversationKind;\n  userId?: string;\n  text: string;\n  at: string; // ISO 8601 with timezone offset\n}\n\nexport interface PeriodicEvent {\n  type: \"periodic\";\n  platform: string;\n  conversationId: string;\n  conversationKind: ConversationKind;\n  userId?: string;\n  text: string;\n  schedule: string; // cron syntax\n  timezone: string; // IANA timezone\n}\n\nexport type MamaEvent = ImmediateEvent | OneShotEvent | PeriodicEvent;\n\nexport interface PeriodicEventInfo {\n  filename: string;\n  platform: string;\n  conversationId: string;\n  conversationKind: ConversationKind;\n  text: string;\n  schedule: string;\n  timezone: string;\n  nextRun: string | null; // ISO 8601\n}\n\n// ============================================================================\n// EventsWatcher\n// ============================================================================\n\nconst DEBOUNCE_MS = 100;\nconst MAX_RETRIES = 3;\nconst RETRY_BASE_MS = 100;\n\nexport class EventsWatcher {\n  private timers: Map<string, NodeJS.Timeout> = new Map();\n  private crons: Map<string, Cron> = new Map();\n  private debounceTimers: Map<string, NodeJS.Timeout> = new Map();\n  private startTime: number;\n  private watcher: FSWatcher | null = null;\n  private knownFiles: Set<string> = new Set();\n\n  constructor(\n    private eventsDir: string,\n    private botsByPlatform: Record<string, Bot>,\n  ) {\n    this.startTime = Date.now();\n  }\n\n  /**\n   * Start watching for events. Call this after platform bots are initialized.\n   */\n  start(): void {\n    // Ensure events directory exists\n    if (!existsSync(this.eventsDir)) {\n      mkdirSync(this.eventsDir, { recursive: true });\n    }\n\n    log.logInfo(`Events watcher starting, dir: ${this.eventsDir}`);\n\n    // Scan existing files\n    this.scanExisting();\n\n    // Watch for changes\n    this.watcher = watch(this.eventsDir, (_eventType, filename) => {\n      if (!filename || !filename.endsWith(\".json\")) return;\n      this.debounce(filename, () => this.handleFileChange(filename));\n    });\n\n    log.logInfo(`Events watcher started, tracking ${this.knownFiles.size} files`);\n  }\n\n  /**\n   * Stop watching and cancel all scheduled events.\n   */\n  stop(): void {\n    // Stop fs watcher\n    if (this.watcher) {\n      this.watcher.close();\n      this.watcher = null;\n    }\n\n    // Cancel all debounce timers\n    for (const timer of this.debounceTimers.values()) {\n      clearTimeout(timer);\n    }\n    this.debounceTimers.clear();\n\n    // Cancel all scheduled timers\n    for (const timer of this.timers.values()) {\n      clearTimeout(timer);\n    }\n    this.timers.clear();\n\n    // Cancel all cron jobs\n    for (const cron of this.crons.values()) {\n      cron.stop();\n    }\n    this.crons.clear();\n\n    this.knownFiles.clear();\n    log.logInfo(\"Events watcher stopped\");\n  }\n\n  /**\n   * Return all active periodic (cron) events with their next run time.\n   */\n  getPeriodicEvents(): PeriodicEventInfo[] {\n    const results: PeriodicEventInfo[] = [];\n    for (const [filename, cron] of this.crons) {\n      const filePath = join(this.eventsDir, filename);\n      try {\n        const content = readFileSync(filePath, \"utf-8\");\n        const data = this.parseEvent(content, filename);\n        if (!data || data.type !== \"periodic\") {\n          continue;\n        }\n        const next = cron.nextRun();\n        results.push({\n          filename,\n          platform: data.platform,\n          conversationId: data.conversationId,\n          conversationKind: data.conversationKind,\n          text: data.text,\n          schedule: data.schedule,\n          timezone: data.timezone,\n          nextRun: next?.toISOString() ?? null,\n        });\n      } catch {\n        // File may have been deleted or corrupted, skip\n      }\n    }\n    return results;\n  }\n\n  private debounce(filename: string, fn: () => void): void {\n    const existing = this.debounceTimers.get(filename);\n    if (existing) {\n      clearTimeout(existing);\n    }\n    this.debounceTimers.set(\n      filename,\n      setTimeout(() => {\n        this.debounceTimers.delete(filename);\n        fn();\n      }, DEBOUNCE_MS),\n    );\n  }\n\n  private scanExisting(): void {\n    let files: string[];\n    try {\n      files = readdirSync(this.eventsDir).filter((f) => f.endsWith(\".json\"));\n    } catch (err) {\n      log.logWarning(\"Failed to read events directory\", String(err));\n      return;\n    }\n\n    for (const filename of files) {\n      this.handleFile(filename);\n    }\n  }\n\n  private handleFileChange(filename: string): void {\n    const filePath = join(this.eventsDir, filename);\n\n    if (!existsSync(filePath)) {\n      // File was deleted\n      this.handleDelete(filename);\n    } else if (this.knownFiles.has(filename)) {\n      // File was modified - cancel existing and re-schedule\n      this.cancelScheduled(filename);\n      this.handleFile(filename);\n    } else {\n      // New file\n      this.handleFile(filename);\n    }\n  }\n\n  private handleDelete(filename: string): void {\n    if (!this.knownFiles.has(filename)) return;\n\n    log.logInfo(`Event file deleted: ${filename}`);\n    this.cancelScheduled(filename);\n    this.knownFiles.delete(filename);\n  }\n\n  private cancelScheduled(filename: string): void {\n    const timer = this.timers.get(filename);\n    if (timer) {\n      clearTimeout(timer);\n      this.timers.delete(filename);\n    }\n\n    const cron = this.crons.get(filename);\n    if (cron) {\n      cron.stop();\n      this.crons.delete(filename);\n    }\n  }\n\n  private async handleFile(filename: string): Promise<void> {\n    const filePath = join(this.eventsDir, filename);\n\n    // Parse with retries\n    let event: MamaEvent | null = null;\n    let lastError: Error | null = null;\n\n    for (let i = 0; i < MAX_RETRIES; i++) {\n      try {\n        const content = await readFile(filePath, \"utf-8\");\n        event = this.parseEvent(content, filename);\n        break;\n      } catch (err) {\n        lastError = err instanceof Error ? err : new Error(String(err));\n        if (i < MAX_RETRIES - 1) {\n          await this.sleep(RETRY_BASE_MS * 2 ** i);\n        }\n      }\n    }\n\n    if (!event) {\n      log.logWarning(\n        `Failed to parse event file after ${MAX_RETRIES} retries: ${filename}`,\n        lastError?.message,\n      );\n      this.deleteFile(filename);\n      return;\n    }\n\n    this.knownFiles.add(filename);\n\n    // Schedule based on type\n    switch (event.type) {\n      case \"immediate\":\n        this.handleImmediate(filename, event);\n        break;\n      case \"one-shot\":\n        this.handleOneShot(filename, event);\n        break;\n      case \"periodic\":\n        this.handlePeriodic(filename, event);\n        break;\n    }\n  }\n\n  private parseEvent(content: string, filename: string): MamaEvent | null {\n    const data = JSON.parse(content);\n    const conversationId =\n      typeof data.conversationId === \"string\"\n        ? data.conversationId\n        : typeof data.channelId === \"string\"\n          ? data.channelId\n          : undefined;\n\n    if (!data.type || !conversationId || !data.text) {\n      throw new Error(`Missing required fields (type, conversationId, text) in ${filename}`);\n    }\n\n    const platform = this.resolvePlatform(data.platform, filename);\n    const conversationKind = this.resolveConversationKind(\n      platform,\n      conversationId,\n      data.conversationKind,\n    );\n    const userId = typeof data.userId === \"string\" ? data.userId : undefined;\n\n    switch (data.type) {\n      case \"immediate\":\n        return {\n          type: \"immediate\",\n          platform,\n          conversationId,\n          conversationKind,\n          userId,\n          text: data.text,\n        };\n\n      case \"one-shot\":\n        if (!data.at) {\n          throw new Error(`Missing 'at' field for one-shot event in ${filename}`);\n        }\n        return {\n          type: \"one-shot\",\n          platform,\n          conversationId,\n          conversationKind,\n          userId,\n          text: data.text,\n          at: data.at,\n        };\n\n      case \"periodic\":\n        if (!data.schedule) {\n          throw new Error(`Missing 'schedule' field for periodic event in ${filename}`);\n        }\n        if (!data.timezone) {\n          throw new Error(`Missing 'timezone' field for periodic event in ${filename}`);\n        }\n        return {\n          type: \"periodic\",\n          platform,\n          conversationId,\n          conversationKind,\n          userId,\n          text: data.text,\n          schedule: data.schedule,\n          timezone: data.timezone,\n        };\n\n      default:\n        throw new Error(`Unknown event type '${data.type}' in ${filename}`);\n    }\n  }\n\n  private resolvePlatform(platformValue: unknown, filename: string): string {\n    const availablePlatforms = Object.keys(this.botsByPlatform);\n\n    if (typeof platformValue === \"string\" && platformValue.trim().length > 0) {\n      const platform = platformValue.trim().toLowerCase();\n      if (!this.botsByPlatform[platform]) {\n        throw new Error(\n          `Unknown platform '${platformValue}' in ${filename}. Expected one of: ${availablePlatforms.join(\", \")}`,\n        );\n      }\n      return platform;\n    }\n\n    if (availablePlatforms.length === 1) {\n      return availablePlatforms[0];\n    }\n\n    throw new Error(\n      `Missing required field 'platform' in ${filename}. Available platforms: ${availablePlatforms.join(\", \")}`,\n    );\n  }\n\n  private resolveConversationKind(\n    platform: string,\n    conversationId: string,\n    conversationKindValue: unknown,\n  ): ConversationKind {\n    if (conversationKindValue === \"direct\" || conversationKindValue === \"shared\") {\n      return conversationKindValue;\n    }\n\n    if (platform === \"slack\") {\n      return conversationId.startsWith(\"D\") ? \"direct\" : \"shared\";\n    }\n\n    if (platform === \"telegram\") {\n      return conversationId.startsWith(\"-\") ? \"shared\" : \"direct\";\n    }\n\n    return \"shared\";\n  }\n\n  private handleImmediate(filename: string, event: ImmediateEvent): void {\n    const filePath = join(this.eventsDir, filename);\n\n    // Check if stale (created before harness started)\n    try {\n      const stat = statSync(filePath);\n      if (stat.mtimeMs < this.startTime) {\n        log.logInfo(`Stale immediate event, deleting: ${filename}`);\n        this.deleteFile(filename);\n        return;\n      }\n    } catch {\n      // File may have been deleted\n      return;\n    }\n\n    log.logInfo(`Executing immediate event: ${filename}`);\n    this.execute(filename, event);\n  }\n\n  private handleOneShot(filename: string, event: OneShotEvent): void {\n    const atTime = new Date(event.at).getTime();\n    const now = Date.now();\n\n    if (atTime <= now) {\n      // Past - delete without executing\n      log.logInfo(`One-shot event in the past, deleting: ${filename}`);\n      this.deleteFile(filename);\n      return;\n    }\n\n    const delay = atTime - now;\n    log.logInfo(`Scheduling one-shot event: ${filename} in ${Math.round(delay / 1000)}s`);\n\n    const timer = setTimeout(() => {\n      this.timers.delete(filename);\n      log.logInfo(`Executing one-shot event: ${filename}`);\n      this.execute(filename, event);\n    }, delay);\n\n    this.timers.set(filename, timer);\n  }\n\n  private handlePeriodic(filename: string, event: PeriodicEvent): void {\n    try {\n      const cron = new Cron(event.schedule, { timezone: event.timezone }, () => {\n        log.logInfo(`Executing periodic event: ${filename}`);\n        this.execute(filename, event, false); // Don't delete periodic events\n      });\n\n      this.crons.set(filename, cron);\n\n      const next = cron.nextRun();\n      log.logInfo(\n        `Scheduled periodic event: ${filename}, next run: ${next?.toISOString() ?? \"unknown\"}`,\n      );\n    } catch (err) {\n      log.logWarning(`Invalid cron schedule for ${filename}: ${event.schedule}`, String(err));\n      this.deleteFile(filename);\n    }\n  }\n\n  private execute(filename: string, event: MamaEvent, deleteAfter: boolean = true): void {\n    // Format the message\n    let scheduleInfo: string;\n    switch (event.type) {\n      case \"immediate\":\n        scheduleInfo = \"immediate\";\n        break;\n      case \"one-shot\":\n        scheduleInfo = event.at;\n        break;\n      case \"periodic\":\n        scheduleInfo = event.schedule;\n        break;\n    }\n\n    const message = `[EVENT:${filename}:${event.type}:${scheduleInfo}] ${event.text}`;\n    const bot = this.botsByPlatform[event.platform];\n\n    if (!bot) {\n      log.logWarning(`No bot configured for event platform '${event.platform}'`, filename);\n      if (deleteAfter) {\n        this.deleteFile(filename);\n      }\n      return;\n    }\n\n    // Create synthetic BotEvent. Keep a stable conversation session key so recurring\n    // reminders share context, but use a unique synthetic message id because\n    // some adapters treat ts/message id as a reply target.\n    const syntheticEvent: BotEvent = {\n      type: \"mention\",\n      conversationId: event.conversationId,\n      conversationKind: event.conversationKind,\n      user: event.userId ?? \"EVENT\",\n      text: message,\n      ts: `event:${filename}`,\n      sessionKey: event.conversationId,\n    };\n\n    // Enqueue for processing\n    const enqueued = bot.enqueueEvent(syntheticEvent);\n\n    if (enqueued && deleteAfter) {\n      // Delete file after successful enqueue (immediate and one-shot)\n      this.deleteFile(filename);\n    } else if (!enqueued) {\n      log.logWarning(`Event queue full, discarded: ${filename}`);\n      // Still delete immediate/one-shot even if discarded\n      if (deleteAfter) {\n        this.deleteFile(filename);\n      }\n    }\n  }\n\n  private deleteFile(filename: string): void {\n    const filePath = join(this.eventsDir, filename);\n    try {\n      unlinkSync(filePath);\n    } catch (err) {\n      // ENOENT is fine (file already deleted), other errors are warnings\n      if (err instanceof Error && \"code\" in err && err.code !== \"ENOENT\") {\n        log.logWarning(`Failed to delete event file: ${filename}`, String(err));\n      }\n    }\n    this.knownFiles.delete(filename);\n  }\n\n  private sleep(ms: number): Promise<void> {\n    return new Promise((resolve) => setTimeout(resolve, ms));\n  }\n}\n\n/**\n * Create an events watcher for all configured platforms.\n */\nexport function createEventsWatcher(\n  workspaceDir: string,\n  botsByPlatform: Record<string, Bot>,\n): EventsWatcher {\n  const eventsDir = join(workspaceDir, \"events\");\n  return new EventsWatcher(eventsDir, botsByPlatform);\n}\n"]}

package/dist/execution-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execution-resolver.d.ts","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAkB,KAAK,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,YAAY,CAAC;AAG9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,WAAW,CAAC;IAJtB,YACU,UAAU,EAAE,aAAa,EACzB,YAAY,EAAE,YAAY,EAC1B,YAAY,CAAC,EAAE,gBAAgB,YAAA,EAC/B,WAAW,CAAC,EAAE,sBAAsB,YAAA,EAC1C;IAEJ,OAAO,IAAI,IAAI,CAGd;IAEK,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoBtD;IAED,OAAO,CAAC,cAAc;IAuBtB,OAAO,CAAC,aAAa;CAUtB","sourcesContent":["import { existsSync } from \"fs\";\nimport type { UserBindingStore } from \"./bindings.js\";\nimport { DockerContainerManager, type ContainerMount } from \"./provisioner.js\";\nimport { createExecutor, type Executor, type SandboxConfig } from \"./sandbox.js\";\nimport type { ResolvedVault, VaultManager } from \"./vault.js\";\nimport { ensureSandboxVaultEntry, resolveActorVaultKey } from \"./vault-routing.js\";\n\nexport interface ActorContext {\n  platform: string;\n  userId: string;\n}\n\nexport class ActorExecutionResolver {\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: VaultManager,\n    private bindingStore?: UserBindingStore,\n    private provisioner?: DockerContainerManager,\n  ) {}\n\n  refresh(): void {\n    this.vaultManager.reload();\n    this.bindingStore?.reload();\n  }\n\n  async resolve(context: ActorContext): Promise<Executor> {\n    const vaultKey = resolveActorVaultKey(\n      this.baseConfig,\n      this.vaultManager,\n      this.bindingStore,\n      context.platform,\n      context.userId,\n    );\n    ensureSandboxVaultEntry(\n      this.baseConfig,\n      this.vaultManager,\n      context.platform,\n      context.userId,\n      vaultKey,\n    );\n    const vault = this.vaultManager.resolve(vaultKey);\n\n    const config = this.vaultManager.getSandboxConfig(vaultKey, this.baseConfig);\n    const env = vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n    return createExecutor(config, env, this.getEnsureReady(vaultKey, config, vault));\n  }\n\n  private getEnsureReady(\n    vaultKey: string,\n    config: SandboxConfig,\n    vault?: ResolvedVault,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"image\" || config.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = config.container || DockerContainerManager.containerName(vaultKey);\n      const actual = await this.provisioner?.provision(vaultKey, {\n        containerName: expected,\n        mounts: vault ? this.resolveMounts(vault) : [],\n      });\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for vault \"${vaultKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(vault: ResolvedVault): ContainerMount[] {\n    // Last-write-wins by target so stale legacy entries don't fail container\n    // startup with duplicate bind mounts pointing at the same path.\n    const mountsByTarget = new Map<string, ContainerMount>();\n    for (const mount of vault.mounts) {\n      if (!existsSync(mount.source)) continue;\n      mountsByTarget.set(mount.target, { source: mount.source, target: mount.target });\n    }\n    return [...mountsByTarget.values()];\n  }\n}\n"]}
+{"version":3,"file":"execution-resolver.d.ts","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAkB,KAAK,QAAQ,EAAE,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACjF,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,YAAY,CAAC;AAG9D,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,sBAAsB;IAE/B,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,YAAY;IACpB,OAAO,CAAC,YAAY,CAAC;IACrB,OAAO,CAAC,WAAW,CAAC;IAJtB,YACU,UAAU,EAAE,aAAa,EACzB,YAAY,EAAE,YAAY,EAC1B,YAAY,CAAC,EAAE,gBAAgB,YAAA,EAC/B,WAAW,CAAC,EAAE,sBAAsB,YAAA,EAC1C;IAEJ,OAAO,IAAI,IAAI,CAGd;IAEK,OAAO,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqBtD;IAED,OAAO,CAAC,cAAc;IAuBtB,OAAO,CAAC,aAAa;CAQtB","sourcesContent":["import { existsSync } from \"fs\";\nimport type { UserBindingStore } from \"./bindings.js\";\nimport { DockerContainerManager, type ContainerMount } from \"./provisioner.js\";\nimport { createExecutor, type Executor, type SandboxConfig } from \"./sandbox.js\";\nimport type { ResolvedVault, VaultManager } from \"./vault.js\";\nimport { ensureSandboxVaultEntry, resolveActorVaultKey } from \"./vault-routing.js\";\n\nexport interface ActorContext {\n  platform: string;\n  userId: string;\n}\n\nexport class ActorExecutionResolver {\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: VaultManager,\n    private bindingStore?: UserBindingStore,\n    private provisioner?: DockerContainerManager,\n  ) {}\n\n  refresh(): void {\n    this.vaultManager.reload();\n    this.bindingStore?.reload();\n  }\n\n  async resolve(context: ActorContext): Promise<Executor> {\n    const vaultKey = resolveActorVaultKey(\n      this.baseConfig,\n      this.vaultManager,\n      this.bindingStore,\n      context.platform,\n      context.userId,\n    );\n    ensureSandboxVaultEntry(\n      this.baseConfig,\n      this.vaultManager,\n      context.platform,\n      context.userId,\n      vaultKey,\n    );\n\n    const vault = this.vaultManager.resolve(vaultKey);\n    const config = this.vaultManager.getSandboxConfig(vaultKey, this.baseConfig);\n    const env =\n      config.type !== \"host\" && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n    return createExecutor(config, env, this.getEnsureReady(vaultKey, config, vault));\n  }\n\n  private getEnsureReady(\n    vaultKey: string,\n    config: SandboxConfig,\n    vault?: ResolvedVault,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"image\" || config.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = config.container || DockerContainerManager.containerName(vaultKey);\n      const actual = await this.provisioner?.provision(vaultKey, {\n        containerName: expected,\n        mounts: vault ? this.resolveMounts(vault) : [],\n      });\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for vault \"${vaultKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(vault: ResolvedVault): ContainerMount[] {\n    const mountsByTarget = new Map<string, ContainerMount>();\n    for (const mount of vault.mounts) {\n      if (!existsSync(mount.source)) continue;\n      mountsByTarget.set(mount.target, { source: mount.source, target: mount.target });\n    }\n    return [...mountsByTarget.values()];\n  }\n}\n"]}

package/dist/execution-resolver.js

@@ -18,7 +18,7 @@ export class ActorExecutionResolver {
         ensureSandboxVaultEntry(this.baseConfig, this.vaultManager, context.platform, context.userId, vaultKey);
         const vault = this.vaultManager.resolve(vaultKey);
         const config = this.vaultManager.getSandboxConfig(vaultKey, this.baseConfig);
-        const env = vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;
+        const env = config.type !== "host" && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;
         return createExecutor(config, env, this.getEnsureReady(vaultKey, config, vault));
     }
     getEnsureReady(vaultKey, config, vault) {
@@ -37,8 +37,6 @@ export class ActorExecutionResolver {
         };
     }
     resolveMounts(vault) {
-        // Last-write-wins by target so stale legacy entries don't fail container
-        // startup with duplicate bind mounts pointing at the same path.
         const mountsByTarget = new Map();
         for (const mount of vault.mounts) {
             if (!existsSync(mount.source))

package/dist/execution-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"execution-resolver.js","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAEhC,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAqC,MAAM,cAAc,CAAC;AAEjF,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAOnF,MAAM,OAAO,sBAAsB;IACjC,YACU,UAAyB,EACzB,YAA0B,EAC1B,YAA+B,EAC/B,WAAoC;0BAHpC,UAAU;4BACV,YAAY;4BACZ,YAAY;2BACZ,WAAW;IAClB,CAAC;IAEJ,OAAO;QACL,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,MAAM,QAAQ,GAAG,oBAAoB,CACnC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,YAAY,EACjB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,MAAM,CACf,CAAC;QACF,uBAAuB,CACrB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,EACjB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,MAAM,EACd,QAAQ,CACT,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAElD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/E,OAAO,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,CAAC;IAEO,cAAc,CACpB,QAAgB,EAChB,MAAqB,EACrB,KAAqB;QAErB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACpE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,IAAI,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE;gBACzD,aAAa,EAAE,QAAQ;gBACvB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;aAC/C,CAAC,CAAC;YACH,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,gBAAgB,QAAQ,gBAAgB,QAAQ,GAAG,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,KAAoB;QACxC,yEAAyE;QACzE,gEAAgE;QAChE,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,SAAS;YACxC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;CACF","sourcesContent":["import { existsSync } from \"fs\";\nimport type { UserBindingStore } from \"./bindings.js\";\nimport { DockerContainerManager, type ContainerMount } from \"./provisioner.js\";\nimport { createExecutor, type Executor, type SandboxConfig } from \"./sandbox.js\";\nimport type { ResolvedVault, VaultManager } from \"./vault.js\";\nimport { ensureSandboxVaultEntry, resolveActorVaultKey } from \"./vault-routing.js\";\n\nexport interface ActorContext {\n  platform: string;\n  userId: string;\n}\n\nexport class ActorExecutionResolver {\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: VaultManager,\n    private bindingStore?: UserBindingStore,\n    private provisioner?: DockerContainerManager,\n  ) {}\n\n  refresh(): void {\n    this.vaultManager.reload();\n    this.bindingStore?.reload();\n  }\n\n  async resolve(context: ActorContext): Promise<Executor> {\n    const vaultKey = resolveActorVaultKey(\n      this.baseConfig,\n      this.vaultManager,\n      this.bindingStore,\n      context.platform,\n      context.userId,\n    );\n    ensureSandboxVaultEntry(\n      this.baseConfig,\n      this.vaultManager,\n      context.platform,\n      context.userId,\n      vaultKey,\n    );\n    const vault = this.vaultManager.resolve(vaultKey);\n\n    const config = this.vaultManager.getSandboxConfig(vaultKey, this.baseConfig);\n    const env = vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n    return createExecutor(config, env, this.getEnsureReady(vaultKey, config, vault));\n  }\n\n  private getEnsureReady(\n    vaultKey: string,\n    config: SandboxConfig,\n    vault?: ResolvedVault,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"image\" || config.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = config.container || DockerContainerManager.containerName(vaultKey);\n      const actual = await this.provisioner?.provision(vaultKey, {\n        containerName: expected,\n        mounts: vault ? this.resolveMounts(vault) : [],\n      });\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for vault \"${vaultKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(vault: ResolvedVault): ContainerMount[] {\n    // Last-write-wins by target so stale legacy entries don't fail container\n    // startup with duplicate bind mounts pointing at the same path.\n    const mountsByTarget = new Map<string, ContainerMount>();\n    for (const mount of vault.mounts) {\n      if (!existsSync(mount.source)) continue;\n      mountsByTarget.set(mount.target, { source: mount.source, target: mount.target });\n    }\n    return [...mountsByTarget.values()];\n  }\n}\n"]}
+{"version":3,"file":"execution-resolver.js","sourceRoot":"","sources":["../src/execution-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAEhC,OAAO,EAAE,sBAAsB,EAAuB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,cAAc,EAAqC,MAAM,cAAc,CAAC;AAEjF,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAOnF,MAAM,OAAO,sBAAsB;IACjC,YACU,UAAyB,EACzB,YAA0B,EAC1B,YAA+B,EAC/B,WAAoC;0BAHpC,UAAU;4BACV,YAAY;4BACZ,YAAY;2BACZ,WAAW;IAClB,CAAC;IAEJ,OAAO;QACL,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,MAAM,QAAQ,GAAG,oBAAoB,CACnC,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,EACjB,IAAI,CAAC,YAAY,EACjB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,MAAM,CACf,CAAC;QACF,uBAAuB,CACrB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,YAAY,EACjB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,MAAM,EACd,QAAQ,CACT,CAAC;QAEF,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7E,MAAM,GAAG,GACP,MAAM,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,OAAO,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,CAAC;IAEO,cAAc,CACpB,QAAgB,EAChB,MAAqB,EACrB,KAAqB;QAErB,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACpE,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,KAAK,IAAI,EAAE;YAChB,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,IAAI,sBAAsB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,EAAE;gBACzD,aAAa,EAAE,QAAQ;gBACvB,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;aAC/C,CAAC,CAAC;YACH,IAAI,MAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,gBAAgB,QAAQ,gBAAgB,QAAQ,GAAG,CAC7F,CAAC;YACJ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEO,aAAa,CAAC,KAAoB;QACxC,MAAM,cAAc,GAAG,IAAI,GAAG,EAA0B,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC;gBAAE,SAAS;YACxC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,CAAC;CACF","sourcesContent":["import { existsSync } from \"fs\";\nimport type { UserBindingStore } from \"./bindings.js\";\nimport { DockerContainerManager, type ContainerMount } from \"./provisioner.js\";\nimport { createExecutor, type Executor, type SandboxConfig } from \"./sandbox.js\";\nimport type { ResolvedVault, VaultManager } from \"./vault.js\";\nimport { ensureSandboxVaultEntry, resolveActorVaultKey } from \"./vault-routing.js\";\n\nexport interface ActorContext {\n  platform: string;\n  userId: string;\n}\n\nexport class ActorExecutionResolver {\n  constructor(\n    private baseConfig: SandboxConfig,\n    private vaultManager: VaultManager,\n    private bindingStore?: UserBindingStore,\n    private provisioner?: DockerContainerManager,\n  ) {}\n\n  refresh(): void {\n    this.vaultManager.reload();\n    this.bindingStore?.reload();\n  }\n\n  async resolve(context: ActorContext): Promise<Executor> {\n    const vaultKey = resolveActorVaultKey(\n      this.baseConfig,\n      this.vaultManager,\n      this.bindingStore,\n      context.platform,\n      context.userId,\n    );\n    ensureSandboxVaultEntry(\n      this.baseConfig,\n      this.vaultManager,\n      context.platform,\n      context.userId,\n      vaultKey,\n    );\n\n    const vault = this.vaultManager.resolve(vaultKey);\n    const config = this.vaultManager.getSandboxConfig(vaultKey, this.baseConfig);\n    const env =\n      config.type !== \"host\" && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n    return createExecutor(config, env, this.getEnsureReady(vaultKey, config, vault));\n  }\n\n  private getEnsureReady(\n    vaultKey: string,\n    config: SandboxConfig,\n    vault?: ResolvedVault,\n  ): (() => Promise<void>) | undefined {\n    if (this.baseConfig.type !== \"image\" || config.type !== \"container\") {\n      return undefined;\n    }\n\n    return async () => {\n      const expected = config.container || DockerContainerManager.containerName(vaultKey);\n      const actual = await this.provisioner?.provision(vaultKey, {\n        containerName: expected,\n        mounts: vault ? this.resolveMounts(vault) : [],\n      });\n      if (actual && actual !== expected) {\n        throw new Error(\n          `Provisioner returned container \"${actual}\" for vault \"${vaultKey}\", expected \"${expected}\"`,\n        );\n      }\n    };\n  }\n\n  private resolveMounts(vault: ResolvedVault): ContainerMount[] {\n    const mountsByTarget = new Map<string, ContainerMount>();\n    for (const mount of vault.mounts) {\n      if (!existsSync(mount.source)) continue;\n      mountsByTarget.set(mount.target, { source: mount.source, target: mount.target });\n    }\n    return [...mountsByTarget.values()];\n  }\n}\n"]}

package/dist/instrument.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instrument.d.ts","sourceRoot":"","sources":["../src/instrument.ts"],"names":[],"mappings":"","sourcesContent":["import * as os from \"os\";\nimport * as Sentry from \"@sentry/node\";\nimport { resolveSentryDsnFromConfig, resolveWorkspaceDirFromArgv } from \"./config.js\";\nimport { createSentryInitOptions } from \"./sentry.js\";\n\n// Lazy initialization: resolve Sentry DSN only when Sentry is actually initialized\n// This avoids parsing CLI args and reading files on every import\nconst getSentryDsn = () => {\n  const workingDir = resolveWorkspaceDirFromArgv();\n  // stateDir defaults to ~/.mama (same as main.ts)\n  const stateDir = process.env.MAMA_STATE_DIR || os.homedir() + \"/.mama\";\n  return resolveSentryDsnFromConfig(stateDir, workingDir);\n};\n\nSentry.init(createSentryInitOptions(getSentryDsn()));\n"]}
+{"version":3,"file":"instrument.d.ts","sourceRoot":"","sources":["../src/instrument.ts"],"names":[],"mappings":"","sourcesContent":["import * as Sentry from \"@sentry/node\";\nimport {\n  resolveSentryDsn,\n  resolveStateDirFromArgv,\n  resolveWorkspaceDirFromArgv,\n} from \"./config.js\";\nimport { createSentryInitOptions } from \"./sentry.js\";\n\nprocess.env.MAMA_STATE_DIR ??= resolveStateDirFromArgv();\nconst workingDir = resolveWorkspaceDirFromArgv();\nconst sentryDsn = resolveSentryDsn(workingDir);\n\nSentry.init(createSentryInitOptions(sentryDsn));\n"]}

package/dist/instrument.js

@@ -1,14 +1,8 @@
-import * as os from "os";
 import * as Sentry from "@sentry/node";
-import { resolveSentryDsnFromConfig, resolveWorkspaceDirFromArgv } from "./config.js";
+import { resolveSentryDsn, resolveStateDirFromArgv, resolveWorkspaceDirFromArgv, } from "./config.js";
 import { createSentryInitOptions } from "./sentry.js";
-// Lazy initialization: resolve Sentry DSN only when Sentry is actually initialized
-// This avoids parsing CLI args and reading files on every import
-const getSentryDsn = () => {
-    const workingDir = resolveWorkspaceDirFromArgv();
-    // stateDir defaults to ~/.mama (same as main.ts)
-    const stateDir = process.env.MAMA_STATE_DIR || os.homedir() + "/.mama";
-    return resolveSentryDsnFromConfig(stateDir, workingDir);
-};
-Sentry.init(createSentryInitOptions(getSentryDsn()));
+process.env.MAMA_STATE_DIR ??= resolveStateDirFromArgv();
+const workingDir = resolveWorkspaceDirFromArgv();
+const sentryDsn = resolveSentryDsn(workingDir);
+Sentry.init(createSentryInitOptions(sentryDsn));
 //# sourceMappingURL=instrument.js.map

package/dist/instrument.js.map

@@ -1 +1 @@
-{"version":3,"file":"instrument.js","sourceRoot":"","sources":["../src/instrument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,0BAA0B,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,mFAAmF;AACnF,iEAAiE;AACjE,MAAM,YAAY,GAAG,GAAG,EAAE;IACxB,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;IACjD,iDAAiD;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC;IACvE,OAAO,0BAA0B,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC,CAAC;AAEF,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC","sourcesContent":["import * as os from \"os\";\nimport * as Sentry from \"@sentry/node\";\nimport { resolveSentryDsnFromConfig, resolveWorkspaceDirFromArgv } from \"./config.js\";\nimport { createSentryInitOptions } from \"./sentry.js\";\n\n// Lazy initialization: resolve Sentry DSN only when Sentry is actually initialized\n// This avoids parsing CLI args and reading files on every import\nconst getSentryDsn = () => {\n  const workingDir = resolveWorkspaceDirFromArgv();\n  // stateDir defaults to ~/.mama (same as main.ts)\n  const stateDir = process.env.MAMA_STATE_DIR || os.homedir() + \"/.mama\";\n  return resolveSentryDsnFromConfig(stateDir, workingDir);\n};\n\nSentry.init(createSentryInitOptions(getSentryDsn()));\n"]}
+{"version":3,"file":"instrument.js","sourceRoot":"","sources":["../src/instrument.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,uBAAuB,EAAE,CAAC;AACzD,MAAM,UAAU,GAAG,2BAA2B,EAAE,CAAC;AACjD,MAAM,SAAS,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;AAE/C,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC,CAAC","sourcesContent":["import * as Sentry from \"@sentry/node\";\nimport {\n  resolveSentryDsn,\n  resolveStateDirFromArgv,\n  resolveWorkspaceDirFromArgv,\n} from \"./config.js\";\nimport { createSentryInitOptions } from \"./sentry.js\";\n\nprocess.env.MAMA_STATE_DIR ??= resolveStateDirFromArgv();\nconst workingDir = resolveWorkspaceDirFromArgv();\nconst sentryDsn = resolveSentryDsn(workingDir);\n\nSentry.init(createSentryInitOptions(sentryDsn));\n"]}

package/dist/link-server.d.ts

@@ -1,3 +1,4 @@
+import { type Server } from "http";
 import type { InMemoryLinkTokenStore } from "./link-token.js";
 import { type VaultManager } from "./vault.js";
 /** Called after a binding is written, to notify the user in chat */
@@ -12,5 +13,5 @@ export type NotifyFn = (platform: string, conversationId: string, message: strin
  *   POST /api/oauth/start     — creates provider OAuth redirect URL
  *   GET  /oauth/callback      — OAuth callback endpoint
  */
-export declare function startLinkServer(port: number, linkTokenStore: InMemoryLinkTokenStore, vaultManager: VaultManager, notify: NotifyFn): void;
+export declare function startLinkServer(port: number, linkTokenStore: InMemoryLinkTokenStore, vaultManager: VaultManager, notify: NotifyFn): Server;
 //# sourceMappingURL=link-server.d.ts.map

package/dist/link-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"link-server.d.ts","sourceRoot":"","sources":["../src/link-server.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAS9D,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAIvE,oEAAoE;AACpE,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAyBpG;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,sBAAsB,EACtC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,QAAQ,GACf,IAAI,CAiHN","sourcesContent":["import { createHash, randomBytes } from \"crypto\";\nimport { createServer, type IncomingMessage, type ServerResponse } from \"http\";\nimport { resolveLinkBaseUrl } from \"./config.js\";\nimport type { InMemoryLinkTokenStore } from \"./link-token.js\";\nimport {\n  getOAuthServices,\n  resolveOAuthService,\n  type LoginCredentialKind,\n  type OAuthService,\n} from \"./login.js\";\nimport * as log from \"./log.js\";\nimport { PRODUCT_NAME } from \"./ui-copy.js\";\nimport { defaultVaultTargetPath, type VaultManager } from \"./vault.js\";\n\n// ── Types ──────────────────────────────────────────────────────────────────────\n\n/** Called after a binding is written, to notify the user in chat */\nexport type NotifyFn = (platform: string, conversationId: string, message: string) => Promise<void>;\n\ninterface LinkCompleteBody {\n  token: string;\n  mode?: LoginCredentialKind;\n  envKey?: string;\n  credential?: string;\n}\n\ninterface OAuthStartBody {\n  token: string;\n  serviceId: string;\n}\n\ninterface PendingOAuthState {\n  linkToken: string;\n  serviceId: string;\n  codeVerifier: string;\n  expiresAt: number;\n}\n\nconst OAUTH_STATE_TTL_MS = 10 * 60 * 1000;\n\n// ── startLinkServer ────────────────────────────────────────────────────────────\n\n/**\n * Start a small HTTP server that receives credential onboarding callbacks from the web portal.\n *\n * Routes:\n *   GET  /health              — health check\n *   GET  /link?token=xxx      — credential onboarding page\n *   POST /api/link/complete   — API key completion endpoint\n *   POST /api/oauth/start     — creates provider OAuth redirect URL\n *   GET  /oauth/callback      — OAuth callback endpoint\n */\nexport function startLinkServer(\n  port: number,\n  linkTokenStore: InMemoryLinkTokenStore,\n  vaultManager: VaultManager,\n  notify: NotifyFn,\n): void {\n  const oauthStates = new Map<string, PendingOAuthState>();\n\n  const server = createServer((req: IncomingMessage, res: ServerResponse) => {\n    const url = new URL(req.url ?? \"/\", requestBaseUrl(req));\n\n    if (req.method === \"GET\" && url.pathname === \"/health\") {\n      res.writeHead(200, { \"Content-Type\": \"application/json\" });\n      res.end(JSON.stringify({ ok: true }));\n      return;\n    }\n\n    if (req.method === \"GET\" && url.pathname === \"/link\") {\n      const rawToken = url.searchParams.get(\"token\") ?? \"\";\n      const linkToken = linkTokenStore.peek(rawToken);\n\n      if (!linkToken) {\n        res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n        res.end(\n          renderErrorPage(\n            \"This link is invalid or has expired. Ask the bot for a new /login link.\",\n          ),\n        );\n        return;\n      }\n\n      const oauthServiceHint = linkToken.providerId\n        ? resolveOAuthService(linkToken.providerId)\n        : undefined;\n      const oauthServices = getOAuthServices();\n      const defaultMode: LoginCredentialKind = oauthServiceHint ? \"oauth\" : \"api_key\";\n\n      const title = oauthServiceHint ? `${oauthServiceHint.label} OAuth` : \"Store Secret\";\n      const helpText = oauthServiceHint\n        ? `Authorize ${oauthServiceHint.label} and store tokens in your vault.`\n        : \"Set any environment variable key/value pair in your vault.\";\n      const secretLabel = \"Secret value\";\n      const placeholder = \"sk-...\";\n      const initialEnvKey = \"\";\n\n      res.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n      res.end(\n        renderCredentialPage(\n          rawToken,\n          title,\n          defaultMode,\n          initialEnvKey,\n          secretLabel,\n          placeholder,\n          helpText,\n          oauthServices,\n          oauthServiceHint?.id,\n        ),\n      );\n      return;\n    }\n\n    if (req.method === \"POST\" && url.pathname === \"/api/link/complete\") {\n      if (!enforceCsrf(req, res)) return;\n      void readJsonBody(req, res, async (body) => {\n        await handleLinkComplete(body, linkTokenStore, vaultManager, notify, res);\n      });\n      return;\n    }\n\n    if (req.method === \"POST\" && url.pathname === \"/api/oauth/start\") {\n      if (!enforceCsrf(req, res)) return;\n      void readJsonBody(req, res, async (body) => {\n        await handleOAuthStart(body, req, linkTokenStore, oauthStates, res);\n      });\n      return;\n    }\n\n    if (req.method === \"GET\" && url.pathname === \"/oauth/callback\") {\n      void handleOAuthCallback(\n        url,\n        req,\n        linkTokenStore,\n        vaultManager,\n        notify,\n        oauthStates,\n        res,\n      ).catch((err: Error) => {\n        log.logWarning(\"OAuth callback failed\", err.message);\n        res.writeHead(500, { \"Content-Type\": \"text/html; charset=utf-8\" });\n        res.end(renderErrorPage(\"OAuth callback failed. Please retry /login.\"));\n      });\n      return;\n    }\n\n    res.writeHead(404);\n    res.end();\n  });\n\n  // Bind to loopback when MOM_LINK_URL is unset so the credential UI and OAuth\n  // callbacks are not exposed on public interfaces by default. Production\n  // deployments set MOM_LINK_URL and are expected to front this server with a\n  // reverse proxy, which can still reach it via 0.0.0.0.\n  const bindHost = resolveLinkBaseUrl() ? undefined : \"127.0.0.1\";\n  server.listen(port, bindHost, () => {\n    log.logInfo(`Link callback server listening on ${bindHost ?? \"0.0.0.0\"}:${port}`);\n    if (!resolveLinkBaseUrl()) {\n      log.logWarning(\n        \"MOM_LINK_URL is not set — bound to 127.0.0.1 and OAuth redirect_uri will be \" +\n          \"derived from request headers (Host / X-Forwarded-*). Set \" +\n          \"MOM_LINK_URL=https://your-host.example.com for production.\",\n      );\n    }\n  });\n\n  server.on(\"error\", (err) => {\n    log.logWarning(\"Link server error\", err.message);\n  });\n}\n\n/**\n * Resolve the externally-visible base URL of this server.\n *\n * Prefers MOM_LINK_URL (see config.ts) so the OAuth `redirect_uri` is\n * deterministic and not influenced by attacker-controlled request headers.\n * Falls back to Host / X-Forwarded-* only when no base URL is configured\n * — intended for local development.\n */\nfunction requestBaseUrl(req: IncomingMessage): string {\n  const configured = resolveLinkBaseUrl();\n  if (configured) return configured;\n\n  const protoRaw = (req.headers[\"x-forwarded-proto\"] as string | undefined)?.split(\",\")[0]?.trim();\n  const proto = protoRaw || \"http\";\n  const host =\n    ((req.headers[\"x-forwarded-host\"] as string | undefined)?.split(\",\")[0]?.trim() ??\n      req.headers.host ??\n      `localhost`) ||\n    `localhost`;\n  return `${proto}://${host}`;\n}\n\n/**\n * Block cross-site POSTs to the credential endpoints. Two defenses:\n *   1. Require Content-Type: application/json, which forces a CORS preflight\n *      for any cross-origin fetch and rules out `<form enctype=\"text/plain\">`\n *      tricks that could otherwise smuggle a JSON body.\n *   2. When MOM_LINK_URL is configured, require that the Origin (or Referer,\n *      as a fallback for browsers that strip Origin) matches that base URL.\n *      This stops an attacker-controlled page — even one that somehow stole a\n *      victim's link token — from completing the flow.\n */\nfunction enforceCsrf(req: IncomingMessage, res: ServerResponse): boolean {\n  const contentType = (req.headers[\"content-type\"] as string | undefined)\n    ?.split(\";\")[0]\n    ?.trim()\n    .toLowerCase();\n  if (contentType !== \"application/json\") {\n    res.writeHead(415, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Content-Type must be application/json\" }));\n    return false;\n  }\n\n  const configured = resolveLinkBaseUrl();\n  if (!configured) {\n    // No trusted origin to compare against in local/dev mode; the loopback\n    // bind already prevents cross-host access.\n    return true;\n  }\n\n  let configuredOrigin: string;\n  try {\n    configuredOrigin = new URL(configured).origin;\n  } catch {\n    // Misconfigured MOM_LINK_URL — fail closed.\n    res.writeHead(500, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Server misconfiguration\" }));\n    return false;\n  }\n\n  if (requestOrigin(req) !== configuredOrigin) {\n    res.writeHead(403, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Cross-origin request rejected\" }));\n    return false;\n  }\n\n  return true;\n}\n\n/** Best-effort origin of the request, derived from Origin or Referer. */\nfunction requestOrigin(req: IncomingMessage): string | undefined {\n  const origin = (req.headers.origin as string | undefined)?.trim();\n  if (origin && origin !== \"null\") return origin;\n\n  const referer = (req.headers.referer as string | undefined)?.trim();\n  if (!referer) return undefined;\n  try {\n    return new URL(referer).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nasync function readJsonBody(\n  req: IncomingMessage,\n  res: ServerResponse,\n  onBody: (body: string) => Promise<void>,\n): Promise<void> {\n  let body = \"\";\n  let bodyTooLarge = false;\n\n  req.on(\"data\", (chunk: Buffer) => {\n    if (bodyTooLarge) return;\n    body += chunk.toString();\n    if (body.length > 16 * 1024) {\n      bodyTooLarge = true;\n      res.writeHead(413);\n      res.end();\n      req.destroy();\n    }\n  });\n\n  req.on(\"end\", async () => {\n    if (bodyTooLarge) return;\n    await onBody(body);\n  });\n}\n\n// ── HTML helpers ───────────────────────────────────────────────────────────────\n\nfunction esc(s: string): string {\n  return s.replace(\n    /[&<>\"']/g,\n    (c) => ({ \"&\": \"&amp;\", \"<\": \"&lt;\", \">\": \"&gt;\", '\"': \"&quot;\", \"'\": \"&#39;\" })[c]!,\n  );\n}\n\nconst sharedPageStyles = `\n  :root {\n    color-scheme: light;\n    --bg: #f5f1e8;\n    --panel: rgba(255, 255, 255, 0.9);\n    --panel-border: rgba(28, 30, 33, 0.08);\n    --text: #1c1e21;\n    --muted: #5d5f64;\n    --button: #1c1e21;\n    --button-hover: #2c3035;\n    --button-disabled: #8f949b;\n    --field-border: #c9cfd6;\n    --field-focus: #1c1e21;\n    --ok-bg: #dff4e4;\n    --ok-text: #1f5b34;\n    --err-bg: #fde2e2;\n    --err-text: #8a2f2f;\n  }\n\n  * { box-sizing: border-box; }\n\n  body {\n    margin: 0;\n    min-height: 100vh;\n    padding: 32px 20px;\n    display: grid;\n    place-items: center;\n    background:\n      radial-gradient(circle at top, rgba(255, 255, 255, 0.7), transparent 45%),\n      linear-gradient(180deg, #faf7f0 0%, var(--bg) 100%);\n    color: var(--text);\n    font-family:\n      \"SF Pro Text\",\n      \"Segoe UI\",\n      system-ui,\n      sans-serif;\n  }\n\n  .shell {\n    width: min(100%, 560px);\n  }\n\n  .card {\n    padding: 28px;\n    border: 1px solid var(--panel-border);\n    border-radius: 20px;\n    background: var(--panel);\n    box-shadow: 0 18px 48px rgba(28, 30, 33, 0.08);\n    backdrop-filter: blur(8px);\n  }\n\n  .eyebrow {\n    margin: 0 0 10px;\n    color: var(--muted);\n    font-size: 0.82rem;\n    font-weight: 700;\n    letter-spacing: 0.08em;\n    text-transform: uppercase;\n  }\n\n  h1 {\n    margin: 0 0 10px;\n    font-size: clamp(1.5rem, 2vw, 1.8rem);\n    line-height: 1.15;\n    text-wrap: balance;\n  }\n\n  p {\n    margin: 0;\n    color: var(--muted);\n    font-size: 0.98rem;\n    line-height: 1.5;\n  }\n\n  .stack > * + * {\n    margin-top: 14px;\n  }\n\n  .form {\n    margin-top: 24px;\n  }\n\n  .form > * + * {\n    margin-top: 18px;\n  }\n\n  label {\n    display: block;\n    margin-bottom: 6px;\n    font-size: 0.92rem;\n    font-weight: 650;\n  }\n\n  input,\n  select,\n  button {\n    font: inherit;\n  }\n\n  input,\n  select {\n    width: 100%;\n    padding: 12px 14px;\n    border: 1px solid var(--field-border);\n    border-radius: 12px;\n    background: #fff;\n    color: var(--text);\n  }\n\n  input:focus-visible,\n  select:focus-visible,\n  button:focus-visible {\n    outline: 2px solid var(--field-focus);\n    outline-offset: 2px;\n  }\n\n  button {\n    width: 100%;\n    margin-top: 24px;\n    padding: 13px 18px;\n    border: none;\n    border-radius: 12px;\n    background: var(--button);\n    color: #fff;\n    cursor: pointer;\n    transition: background-color 160ms ease;\n  }\n\n  button:hover {\n    background: var(--button-hover);\n  }\n\n  button:disabled {\n    background: var(--button-disabled);\n    cursor: default;\n  }\n\n  .mode {\n    display: flex;\n    flex-wrap: wrap;\n    gap: 10px;\n    margin-top: 22px;\n  }\n\n  .mode label {\n    display: inline-flex;\n    align-items: center;\n    gap: 8px;\n    margin: 0;\n    padding: 10px 12px;\n    border: 1px solid var(--field-border);\n    border-radius: 999px;\n    background: rgba(255, 255, 255, 0.85);\n    font-weight: 500;\n  }\n\n  .mode input {\n    width: auto;\n    margin: 0;\n  }\n\n  .panel {\n    display: none;\n  }\n\n  .panel.active {\n    display: block;\n  }\n\n  .panel-note {\n    margin-top: 10px;\n    font-size: 0.92rem;\n  }\n\n  .result,\n  .status {\n    margin-top: 20px;\n    padding: 14px 16px;\n    border-radius: 14px;\n    font-size: 0.95rem;\n  }\n\n  .result {\n    display: none;\n  }\n\n  .result.ok,\n  .status.ok {\n    background: var(--ok-bg);\n    color: var(--ok-text);\n  }\n\n  .result.err,\n  .status.err {\n    background: var(--err-bg);\n    color: var(--err-text);\n  }\n\n  .close-note {\n    margin-top: 14px;\n    font-size: 0.92rem;\n  }\n\n  @media (max-width: 640px) {\n    body {\n      padding: 20px 14px;\n    }\n\n    .card {\n      padding: 22px;\n      border-radius: 16px;\n    }\n  }\n`;\n\nfunction renderPageDocument(title: string, body: string): string {\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n  <title>${esc(title)} — ${PRODUCT_NAME}</title>\n  <style>${sharedPageStyles}</style>\n</head>\n<body>\n  <main class=\"shell\">\n    <section class=\"card\">\n      ${body}\n    </section>\n  </main>\n</body>\n</html>`;\n}\n\nfunction renderStatusPage(\n  title: string,\n  message: string,\n  tone: \"ok\" | \"err\",\n  options?: { closeNote?: boolean },\n): string {\n  const closeNote = options?.closeNote ? '<p class=\"close-note\">You can close this tab.</p>' : \"\";\n  return renderPageDocument(\n    title,\n    `<div class=\"stack\">\n      <p class=\"eyebrow\">${PRODUCT_NAME}</p>\n      <h1>${esc(title)}</h1>\n      <div class=\"status ${tone}\">${esc(message)}</div>\n      ${closeNote}\n    </div>`,\n  );\n}\n\nfunction renderCredentialPage(\n  token: string,\n  title: string,\n  defaultMode: LoginCredentialKind,\n  initialEnvKey: string,\n  secretLabel: string,\n  placeholder: string,\n  helpText: string,\n  oauthServices: OAuthService[],\n  oauthServiceIdHint?: string,\n): string {\n  const oauthOptions = oauthServices\n    .map((service) => {\n      const selected = service.id === oauthServiceIdHint ? ' selected=\"selected\"' : \"\";\n      return `<option value=\"${esc(service.id)}\"${selected}>${esc(service.label)}</option>`;\n    })\n    .join(\"\\n\");\n\n  return renderPageDocument(\n    \"Login\",\n    `<div class=\"stack\">\n  <p class=\"eyebrow\">${PRODUCT_NAME}</p>\n  <h1>${esc(title)}</h1>\n  <p>Your personal sandbox is already provisioned automatically.</p>\n  <p>${esc(helpText)}</p>\n  <div class=\"mode\">\n    <label><input type=\"radio\" name=\"mode\" value=\"api_key\" ${defaultMode === \"api_key\" ? \"checked\" : \"\"}> API key</label>\n    <label><input type=\"radio\" name=\"mode\" value=\"oauth\" ${defaultMode === \"oauth\" ? \"checked\" : \"\"}> OAuth login</label>\n  </div>\n\n  <div class=\"form\">\n  <div id=\"api-panel\" class=\"panel\">\n    <label for=\"envKey\">Environment key</label>\n    <input id=\"envKey\" type=\"text\" name=\"envKey\" placeholder=\"OPENAI_API_KEY\" value=\"${esc(initialEnvKey)}\" autocomplete=\"off\">\n    <label for=\"credential\">${esc(secretLabel)}</label>\n    <input id=\"credential\" type=\"password\" name=\"credential\" placeholder=\"${esc(placeholder)}\" autocomplete=\"off\">\n  </div>\n\n  <div id=\"oauth-panel\" class=\"panel\">\n    <label for=\"oauthService\">OAuth service</label>\n    <select id=\"oauthService\" name=\"oauthService\">${oauthOptions}</select>\n    <p class=\"panel-note\">You'll be redirected to the selected service's authorization page.</p>\n  </div>\n\n  <button id=\"btn\" onclick=\"connect()\">Continue</button>\n  <div id=\"result\" class=\"result\" aria-live=\"polite\"></div>\n  </div>\n  <script>\n    const envKeyPattern = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\n    function selectedMode() {\n      return document.querySelector('input[name=\"mode\"]:checked').value;\n    }\n\n    function showResult(message, ok) {\n      const result = document.getElementById('result');\n      result.style.display = 'block';\n      result.className = ok ? 'result ok' : 'result err';\n      result.textContent = message;\n    }\n\n    function syncPanels() {\n      const api = document.getElementById('api-panel');\n      const oauth = document.getElementById('oauth-panel');\n      const mode = selectedMode();\n      api.className = mode === 'api_key' ? 'panel active' : 'panel';\n      oauth.className = mode === 'oauth' ? 'panel active' : 'panel';\n    }\n\n    for (const radio of document.querySelectorAll('input[name=\"mode\"]')) {\n      radio.addEventListener('change', syncPanels);\n    }\n\n    syncPanels();\n\n    async function connect() {\n      const btn = document.getElementById('btn');\n      const mode = selectedMode();\n      btn.disabled = true;\n      btn.textContent = mode === 'oauth' ? 'Redirecting…' : 'Saving…';\n\n      try {\n        if (mode === 'oauth') {\n          const serviceId = document.getElementById('oauthService').value;\n          const r = await fetch('/api/oauth/start', {\n            method: 'POST',\n            headers: { 'Content-Type': 'application/json' },\n            body: JSON.stringify({ token: '${esc(token)}', serviceId }),\n          });\n          const data = await r.json();\n          if (!r.ok) {\n            showResult('Error: ' + (data.error ?? r.status), false);\n            btn.disabled = false;\n            btn.textContent = 'Continue';\n            return;\n          }\n          window.location.href = data.redirectUrl;\n          return;\n        }\n\n        const envKey = document.getElementById('envKey').value.trim();\n        const credential = document.getElementById('credential').value.trim();\n        if (!envKeyPattern.test(envKey)) {\n          showResult('Please enter a valid environment key.', false);\n          btn.disabled = false;\n          btn.textContent = 'Continue';\n          return;\n        }\n        if (!credential) {\n          showResult('Please enter a value.', false);\n          btn.disabled = false;\n          btn.textContent = 'Continue';\n          return;\n        }\n\n        const r = await fetch('/api/link/complete', {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({ token: '${esc(token)}', mode: 'api_key', envKey, credential }),\n        });\n        const data = await r.json();\n        if (r.ok) {\n          showResult(data.message ?? 'Credential stored. You can close this tab.', true);\n          btn.style.display = 'none';\n          for (const input of document.querySelectorAll('input,select')) input.disabled = true;\n        } else {\n          showResult('Error: ' + (data.error ?? r.status), false);\n          btn.disabled = false;\n          btn.textContent = 'Continue';\n        }\n      } catch (err) {\n        showResult('Network error: ' + err.message, false);\n        btn.disabled = false;\n        btn.textContent = 'Continue';\n      }\n    }\n  </script>\n</div>`,\n  );\n}\n\nfunction renderErrorPage(message: string): string {\n  return renderStatusPage(\"Login Error\", message, \"err\");\n}\n\nfunction renderSuccessPage(message: string): string {\n  return renderStatusPage(\"Connected\", message, \"ok\", { closeNote: true });\n}\n\n// ── API-key completion ────────────────────────────────────────────────────────\n\nasync function handleLinkComplete(\n  body: string,\n  linkTokenStore: InMemoryLinkTokenStore,\n  vaultManager: VaultManager,\n  notify: NotifyFn,\n  res: ServerResponse,\n): Promise<void> {\n  let data: Partial<LinkCompleteBody>;\n  try {\n    data = JSON.parse(body) as Partial<LinkCompleteBody>;\n  } catch {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Invalid JSON\" }));\n    return;\n  }\n\n  if (!data.token) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Missing required field: token\" }));\n    return;\n  }\n\n  const envKey = data.envKey?.trim() ?? \"\";\n  const credential = data.credential?.trim() ?? \"\";\n\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(envKey)) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Invalid envKey format\" }));\n    return;\n  }\n\n  if (!credential) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Missing required field: credential\" }));\n    return;\n  }\n\n  // Atomic consume prevents two concurrent requests from both passing the\n  // validity check before either deletes the token.\n  const linkToken = linkTokenStore.consume(data.token);\n  if (!linkToken) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Invalid or expired token\" }));\n    return;\n  }\n\n  try {\n    vaultManager.upsertEnv(linkToken.vaultId, { [envKey]: credential });\n  } catch (error) {\n    log.logWarning(\n      `Failed to persist ${envKey} for ${linkToken.platform}/${linkToken.platformUserId}`,\n      error instanceof Error ? error.message : String(error),\n    );\n    res.writeHead(500, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error:\n          \"Failed to store credential on server. Please fix the server issue and run /login again.\",\n      }),\n    );\n    return;\n  }\n\n  log.logInfo(\n    `Stored ${envKey} for ${linkToken.platform}/${linkToken.platformUserId} in vault:${linkToken.vaultId}`,\n  );\n\n  res.writeHead(200, { \"Content-Type\": \"application/json\" });\n  res.end(JSON.stringify({ ok: true, message: `${envKey} stored successfully in vault.` }));\n\n  notify(\n    linkToken.platform,\n    linkToken.conversationId,\n    `${envKey} stored successfully in vault \\`${linkToken.vaultId}\\`.`,\n  ).catch((err: Error) => {\n    log.logWarning(\"Failed to notify user after credential login\", err.message);\n  });\n}\n\n// ── OAuth flow ────────────────────────────────────────────────────────────────\n\nasync function handleOAuthStart(\n  body: string,\n  req: IncomingMessage,\n  linkTokenStore: InMemoryLinkTokenStore,\n  oauthStates: Map<string, PendingOAuthState>,\n  res: ServerResponse,\n): Promise<void> {\n  let data: Partial<OAuthStartBody>;\n  try {\n    data = JSON.parse(body) as Partial<OAuthStartBody>;\n  } catch {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Invalid JSON\" }));\n    return;\n  }\n\n  if (!data.token || !data.serviceId) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Missing required fields: token/serviceId\" }));\n    return;\n  }\n\n  const linkToken = linkTokenStore.peek(data.token);\n  if (!linkToken) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Invalid or expired token\" }));\n    return;\n  }\n\n  const service = resolveOAuthService(data.serviceId);\n  if (!service) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: `Unsupported OAuth service: ${data.serviceId}` }));\n    return;\n  }\n\n  const clientId = process.env[service.clientIdEnvKey];\n  const clientSecret = process.env[service.clientSecretEnvKey];\n  if (!clientId || !clientSecret) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error:\n          `OAuth service ${service.label} is not configured. ` +\n          `Missing ${service.clientIdEnvKey}/${service.clientSecretEnvKey}.`,\n      }),\n    );\n    return;\n  }\n\n  const state = randomBytes(16).toString(\"hex\");\n  const codeVerifier = randomBytes(32).toString(\"base64url\");\n  oauthStates.set(state, {\n    linkToken: data.token,\n    serviceId: service.id,\n    codeVerifier,\n    expiresAt: Date.now() + OAUTH_STATE_TTL_MS,\n  });\n\n  for (const [k, v] of oauthStates) {\n    if (Date.now() > v.expiresAt) oauthStates.delete(k);\n  }\n\n  const redirectUri = `${requestBaseUrl(req)}/oauth/callback`;\n  const authorizeUrl = new URL(service.authorizationUrl);\n  authorizeUrl.searchParams.set(\"response_type\", \"code\");\n  authorizeUrl.searchParams.set(\"client_id\", clientId);\n  authorizeUrl.searchParams.set(\"redirect_uri\", redirectUri);\n  authorizeUrl.searchParams.set(\"state\", state);\n  if (service.scopes.length > 0) {\n    authorizeUrl.searchParams.set(\"scope\", service.scopes.join(\" \"));\n  }\n  for (const [key, value] of Object.entries(service.authorizationParams ?? {})) {\n    authorizeUrl.searchParams.set(key, value);\n  }\n\n  const codeChallenge = createHash(\"sha256\").update(codeVerifier).digest(\"base64url\");\n  authorizeUrl.searchParams.set(\"code_challenge\", codeChallenge);\n  authorizeUrl.searchParams.set(\"code_challenge_method\", \"S256\");\n\n  res.writeHead(200, { \"Content-Type\": \"application/json\" });\n  res.end(JSON.stringify({ ok: true, redirectUrl: authorizeUrl.toString() }));\n}\n\nasync function handleOAuthCallback(\n  url: URL,\n  req: IncomingMessage,\n  linkTokenStore: InMemoryLinkTokenStore,\n  vaultManager: VaultManager,\n  notify: NotifyFn,\n  oauthStates: Map<string, PendingOAuthState>,\n  res: ServerResponse,\n): Promise<void> {\n  const state = url.searchParams.get(\"state\") ?? \"\";\n  const code = url.searchParams.get(\"code\") ?? \"\";\n  const error = url.searchParams.get(\"error\");\n\n  // Atomic pop: whatever path we take from here, this state is spent.\n  // Done before any `await` to close the TOCTOU window between the state\n  // lookup and the final delete.\n  const pending = oauthStates.get(state);\n  if (pending) oauthStates.delete(state);\n\n  if (error) {\n    res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(`OAuth authorization failed: ${error}`));\n    return;\n  }\n\n  if (!pending || Date.now() > pending.expiresAt) {\n    res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(\"OAuth state is invalid or expired. Please run /login again.\"));\n    return;\n  }\n\n  if (!code) {\n    res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(\"Missing OAuth authorization code.\"));\n    return;\n  }\n\n  const service = resolveOAuthService(pending.serviceId);\n  if (!service) {\n    res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(\"Unsupported OAuth service.\"));\n    return;\n  }\n\n  const clientId = process.env[service.clientIdEnvKey];\n  const clientSecret = process.env[service.clientSecretEnvKey];\n  if (!clientId || !clientSecret) {\n    res.writeHead(500, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(\"OAuth service is not configured on server.\"));\n    return;\n  }\n\n  // Atomic consume: pairs with the callback being one-shot. Two concurrent\n  // callbacks for the same state would previously both pass `peek` and both\n  // run `exchangeOAuthCode` across the await; only one reaches `consume`.\n  const linkToken = linkTokenStore.consume(pending.linkToken);\n  if (!linkToken) {\n    res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(\"Login link is invalid or expired. Please run /login again.\"));\n    return;\n  }\n\n  const redirectUri = `${requestBaseUrl(req)}/oauth/callback`;\n  const tokenResp = await exchangeOAuthCode(\n    service,\n    code,\n    clientId,\n    clientSecret,\n    redirectUri,\n    pending.codeVerifier,\n  );\n\n  const accessToken = tokenResp.access_token?.trim();\n  const refreshToken = tokenResp.refresh_token?.trim();\n\n  if (!accessToken) {\n    res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(\"OAuth token exchange did not return an access_token.\"));\n    return;\n  }\n\n  const updates: Record<string, string> = {};\n  if (service.accessTokenEnvKey) {\n    updates[service.accessTokenEnvKey] = accessToken;\n  }\n  for (const key of service.additionalAccessTokenEnvKeys ?? []) {\n    updates[key] = accessToken;\n  }\n  if (refreshToken && service.refreshTokenEnvKey) {\n    updates[service.refreshTokenEnvKey] = refreshToken;\n  }\n\n  const fileOutput = service.fileOutput;\n  let mountedPath: string | undefined;\n  if (fileOutput?.type === \"authorized_user\") {\n    if (!refreshToken) {\n      res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n      res.end(\n        renderErrorPage(\n          \"OAuth token exchange did not return a refresh_token. \" +\n            \"Retry after revoking prior consent or ensure prompt=consent is applied.\",\n        ),\n      );\n      return;\n    }\n\n    mountedPath = fileOutput.targetPath ?? defaultVaultTargetPath(fileOutput.relativePath);\n    if (fileOutput.envKey) {\n      updates[fileOutput.envKey] = mountedPath;\n    }\n  }\n\n  const storedTargets: string[] = [];\n  try {\n    if (Object.keys(updates).length > 0) {\n      vaultManager.upsertEnv(linkToken.vaultId, updates);\n      storedTargets.push(...Object.keys(updates).sort());\n    }\n    if (fileOutput?.type === \"authorized_user\" && refreshToken) {\n      vaultManager.upsertFile(\n        linkToken.vaultId,\n        fileOutput.relativePath,\n        renderAuthorizedUserCredential(clientId, clientSecret, refreshToken),\n        fileOutput.targetPath,\n      );\n      if (mountedPath) storedTargets.push(mountedPath);\n    }\n  } catch (error) {\n    log.logWarning(\n      `Failed to persist OAuth credentials for ${linkToken.platform}/${linkToken.platformUserId}`,\n      error instanceof Error ? error.message : String(error),\n    );\n    res.writeHead(500, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(\n      renderErrorPage(\n        \"OAuth tokens were received but could not be stored on the server. Fix the server issue and run /login again.\",\n      ),\n    );\n    return;\n  }\n\n  log.logInfo(\n    `Stored [${storedTargets.join(\", \")}] for ${linkToken.platform}/${linkToken.platformUserId} in vault:${linkToken.vaultId}`,\n  );\n\n  notify(\n    linkToken.platform,\n    linkToken.conversationId,\n    `${service.label} OAuth stored (${storedTargets.join(\", \")}) in vault \\`${linkToken.vaultId}\\`.`,\n  ).catch((err: Error) => {\n    log.logWarning(\"Failed to notify user after OAuth login\", err.message);\n  });\n\n  res.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n  res.end(renderSuccessPage(`${service.label} OAuth connected successfully.`));\n}\n\nasync function exchangeOAuthCode(\n  service: OAuthService,\n  code: string,\n  clientId: string,\n  clientSecret: string,\n  redirectUri: string,\n  codeVerifier: string,\n): Promise<Record<string, string>> {\n  const params = new URLSearchParams();\n  params.set(\"grant_type\", \"authorization_code\");\n  params.set(\"code\", code);\n  params.set(\"client_id\", clientId);\n  params.set(\"client_secret\", clientSecret);\n  params.set(\"redirect_uri\", redirectUri);\n  params.set(\"code_verifier\", codeVerifier);\n\n  const response = await fetch(service.tokenUrl, {\n    method: \"POST\",\n    headers: {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n      Accept: \"application/json\",\n    },\n    body: params.toString(),\n  });\n\n  const text = await response.text();\n  const contentType = response.headers.get(\"content-type\") ?? \"\";\n  let parsed: Record<string, string> = {};\n\n  if (contentType.includes(\"application/json\")) {\n    parsed = JSON.parse(text) as Record<string, string>;\n  } else {\n    const form = new URLSearchParams(text);\n    parsed = Object.fromEntries(form.entries());\n  }\n\n  if (!response.ok) {\n    const message = parsed.error_description ?? parsed.error ?? `${response.status}`;\n    throw new Error(`OAuth token exchange failed for ${service.id}: ${message}`);\n  }\n\n  return parsed;\n}\n\nfunction renderAuthorizedUserCredential(\n  clientId: string,\n  clientSecret: string,\n  refreshToken: string,\n): string {\n  return (\n    JSON.stringify(\n      {\n        client_id: clientId,\n        client_secret: clientSecret,\n        refresh_token: refreshToken,\n        type: \"authorized_user\",\n      },\n      null,\n      2,\n    ) + \"\\n\"\n  );\n}\n"]}
+{"version":3,"file":"link-server.d.ts","sourceRoot":"","sources":["../src/link-server.ts"],"names":[],"mappings":"AACA,OAAO,EAAsC,KAAK,MAAM,EAAuB,MAAM,MAAM,CAAC;AAE5F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAS9D,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAIvE,oEAAoE;AACpE,MAAM,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAyBpG;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,sBAAsB,EACtC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,QAAQ,GACf,MAAM,CAqHR","sourcesContent":["import { createHash, randomBytes } from \"crypto\";\nimport { createServer, type IncomingMessage, type Server, type ServerResponse } from \"http\";\nimport { resolveLinkBaseUrl } from \"./config.js\";\nimport type { InMemoryLinkTokenStore } from \"./link-token.js\";\nimport {\n  getOAuthServices,\n  resolveOAuthService,\n  type LoginCredentialKind,\n  type OAuthService,\n} from \"./login.js\";\nimport * as log from \"./log.js\";\nimport { PRODUCT_NAME } from \"./ui-copy.js\";\nimport { defaultVaultTargetPath, type VaultManager } from \"./vault.js\";\n\n// ── Types ──────────────────────────────────────────────────────────────────────\n\n/** Called after a binding is written, to notify the user in chat */\nexport type NotifyFn = (platform: string, conversationId: string, message: string) => Promise<void>;\n\ninterface LinkCompleteBody {\n  token: string;\n  mode?: LoginCredentialKind;\n  envKey?: string;\n  credential?: string;\n}\n\ninterface OAuthStartBody {\n  token: string;\n  serviceId: string;\n}\n\ninterface PendingOAuthState {\n  linkToken: string;\n  serviceId: string;\n  codeVerifier: string;\n  expiresAt: number;\n}\n\nconst OAUTH_STATE_TTL_MS = 10 * 60 * 1000;\n\n// ── startLinkServer ────────────────────────────────────────────────────────────\n\n/**\n * Start a small HTTP server that receives credential onboarding callbacks from the web portal.\n *\n * Routes:\n *   GET  /health              — health check\n *   GET  /link?token=xxx      — credential onboarding page\n *   POST /api/link/complete   — API key completion endpoint\n *   POST /api/oauth/start     — creates provider OAuth redirect URL\n *   GET  /oauth/callback      — OAuth callback endpoint\n */\nexport function startLinkServer(\n  port: number,\n  linkTokenStore: InMemoryLinkTokenStore,\n  vaultManager: VaultManager,\n  notify: NotifyFn,\n): Server {\n  const oauthStates = new Map<string, PendingOAuthState>();\n\n  const server = createServer((req: IncomingMessage, res: ServerResponse) => {\n    const url = new URL(req.url ?? \"/\", requestBaseUrl(req));\n\n    if (req.method === \"GET\" && url.pathname === \"/health\") {\n      res.writeHead(200, { \"Content-Type\": \"application/json\" });\n      res.end(JSON.stringify({ ok: true }));\n      return;\n    }\n\n    if (req.method === \"GET\" && url.pathname === \"/link\") {\n      const rawToken = url.searchParams.get(\"token\") ?? \"\";\n      const linkToken = linkTokenStore.peek(rawToken);\n\n      if (!linkToken) {\n        res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n        res.end(\n          renderErrorPage(\n            \"This link is invalid or has expired. Ask the bot for a new /login link.\",\n          ),\n        );\n        return;\n      }\n\n      const oauthServiceHint = linkToken.providerId\n        ? resolveOAuthService(linkToken.providerId)\n        : undefined;\n      const oauthServices = getOAuthServices();\n      const defaultMode: LoginCredentialKind = oauthServiceHint ? \"oauth\" : \"api_key\";\n      const existingSecrets = describeVaultSecrets(vaultManager, linkToken.vaultId);\n\n      const title = oauthServiceHint ? `${oauthServiceHint.label} OAuth` : \"Store Secret\";\n      const helpText = oauthServiceHint\n        ? `Authorize ${oauthServiceHint.label} and store tokens in your vault.`\n        : \"Set any environment variable key/value pair in your vault.\";\n      const secretLabel = \"Secret value\";\n      const placeholder = \"sk-...\";\n      const initialEnvKey = \"\";\n\n      res.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n      res.end(\n        renderCredentialPage(\n          rawToken,\n          title,\n          defaultMode,\n          initialEnvKey,\n          secretLabel,\n          placeholder,\n          helpText,\n          oauthServices,\n          oauthServiceHint?.id,\n          existingSecrets,\n        ),\n      );\n      return;\n    }\n\n    if (req.method === \"POST\" && url.pathname === \"/api/link/complete\") {\n      if (!enforceCsrf(req, res)) return;\n      void readJsonBody(req, res, async (body) => {\n        await handleLinkComplete(body, linkTokenStore, vaultManager, notify, res);\n      });\n      return;\n    }\n\n    if (req.method === \"POST\" && url.pathname === \"/api/oauth/start\") {\n      if (!enforceCsrf(req, res)) return;\n      void readJsonBody(req, res, async (body) => {\n        await handleOAuthStart(body, req, linkTokenStore, oauthStates, res);\n      });\n      return;\n    }\n\n    if (req.method === \"GET\" && url.pathname === \"/oauth/callback\") {\n      void handleOAuthCallback(\n        url,\n        req,\n        linkTokenStore,\n        vaultManager,\n        notify,\n        oauthStates,\n        res,\n      ).catch((err: Error) => {\n        log.logWarning(\"OAuth callback failed\", err.message);\n        res.writeHead(500, { \"Content-Type\": \"text/html; charset=utf-8\" });\n        res.end(renderErrorPage(\"OAuth callback failed. Please retry /login.\"));\n      });\n      return;\n    }\n\n    res.writeHead(404);\n    res.end();\n  });\n\n  // Bind to loopback when MOM_LINK_URL is unset so the credential UI and OAuth\n  // callbacks are not exposed on public interfaces by default. Production\n  // deployments set MOM_LINK_URL and are expected to front this server with a\n  // reverse proxy, which can still reach it via 0.0.0.0.\n  const bindHost = resolveLinkBaseUrl() ? undefined : \"127.0.0.1\";\n  server.listen(port, bindHost, () => {\n    log.logInfo(`Link callback server listening on ${bindHost ?? \"0.0.0.0\"}:${port}`);\n    if (!resolveLinkBaseUrl()) {\n      log.logWarning(\n        \"MOM_LINK_URL is not set — bound to 127.0.0.1 and OAuth redirect_uri will be \" +\n          \"derived from request headers (Host / X-Forwarded-*). Set \" +\n          \"MOM_LINK_URL=https://your-host.example.com for production.\",\n      );\n    }\n  });\n\n  server.on(\"error\", (err) => {\n    log.logWarning(\"Link server error\", err.message);\n  });\n\n  return server;\n}\n\n/**\n * Resolve the externally-visible base URL of this server.\n *\n * Prefers MOM_LINK_URL (see config.ts) so the OAuth `redirect_uri` is\n * deterministic and not influenced by attacker-controlled request headers.\n * Falls back to Host / X-Forwarded-* only when no base URL is configured\n * — intended for local development.\n */\nfunction requestBaseUrl(req: IncomingMessage): string {\n  const configured = resolveLinkBaseUrl();\n  if (configured) return configured;\n\n  const protoRaw = (req.headers[\"x-forwarded-proto\"] as string | undefined)?.split(\",\")[0]?.trim();\n  const proto = protoRaw || \"http\";\n  const host =\n    ((req.headers[\"x-forwarded-host\"] as string | undefined)?.split(\",\")[0]?.trim() ??\n      req.headers.host ??\n      `localhost`) ||\n    `localhost`;\n  return `${proto}://${host}`;\n}\n\n/**\n * Block cross-site POSTs to the credential endpoints. Two defenses:\n *   1. Require Content-Type: application/json, which forces a CORS preflight\n *      for any cross-origin fetch and rules out `<form enctype=\"text/plain\">`\n *      tricks that could otherwise smuggle a JSON body.\n *   2. When MOM_LINK_URL is configured, require that the Origin (or Referer,\n *      as a fallback for browsers that strip Origin) matches that base URL.\n *      This stops an attacker-controlled page — even one that somehow stole a\n *      victim's link token — from completing the flow.\n */\nfunction enforceCsrf(req: IncomingMessage, res: ServerResponse): boolean {\n  const contentType = (req.headers[\"content-type\"] as string | undefined)\n    ?.split(\";\")[0]\n    ?.trim()\n    .toLowerCase();\n  if (contentType !== \"application/json\") {\n    res.writeHead(415, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Content-Type must be application/json\" }));\n    return false;\n  }\n\n  const configured = resolveLinkBaseUrl();\n  if (!configured) {\n    // No trusted origin to compare against in local/dev mode; the loopback\n    // bind already prevents cross-host access.\n    return true;\n  }\n\n  let configuredOrigin: string;\n  try {\n    configuredOrigin = new URL(configured).origin;\n  } catch {\n    // Misconfigured MOM_LINK_URL — fail closed.\n    res.writeHead(500, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Server misconfiguration\" }));\n    return false;\n  }\n\n  if (requestOrigin(req) !== configuredOrigin) {\n    res.writeHead(403, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Cross-origin request rejected\" }));\n    return false;\n  }\n\n  return true;\n}\n\n/** Best-effort origin of the request, derived from Origin or Referer. */\nfunction requestOrigin(req: IncomingMessage): string | undefined {\n  const origin = (req.headers.origin as string | undefined)?.trim();\n  if (origin && origin !== \"null\") return origin;\n\n  const referer = (req.headers.referer as string | undefined)?.trim();\n  if (!referer) return undefined;\n  try {\n    return new URL(referer).origin;\n  } catch {\n    return undefined;\n  }\n}\n\nasync function readJsonBody(\n  req: IncomingMessage,\n  res: ServerResponse,\n  onBody: (body: string) => Promise<void>,\n): Promise<void> {\n  let body = \"\";\n  let bodyTooLarge = false;\n\n  req.on(\"data\", (chunk: Buffer) => {\n    if (bodyTooLarge) return;\n    body += chunk.toString();\n    if (body.length > 16 * 1024) {\n      bodyTooLarge = true;\n      res.writeHead(413);\n      res.end();\n      req.destroy();\n    }\n  });\n\n  req.on(\"end\", async () => {\n    if (bodyTooLarge) return;\n    await onBody(body);\n  });\n}\n\n// ── HTML helpers ───────────────────────────────────────────────────────────────\n\nfunction esc(s: string): string {\n  return s.replace(\n    /[&<>\"']/g,\n    (c) => ({ \"&\": \"&amp;\", \"<\": \"&lt;\", \">\": \"&gt;\", '\"': \"&quot;\", \"'\": \"&#39;\" })[c]!,\n  );\n}\n\nconst sharedPageStyles = `\n  :root {\n    color-scheme: light;\n    --bg: #f5f1e8;\n    --panel: rgba(255, 255, 255, 0.9);\n    --panel-border: rgba(28, 30, 33, 0.08);\n    --text: #1c1e21;\n    --muted: #5d5f64;\n    --button: #1c1e21;\n    --button-hover: #2c3035;\n    --button-disabled: #8f949b;\n    --field-border: #c9cfd6;\n    --field-focus: #1c1e21;\n    --ok-bg: #dff4e4;\n    --ok-text: #1f5b34;\n    --err-bg: #fde2e2;\n    --err-text: #8a2f2f;\n  }\n\n  * { box-sizing: border-box; }\n\n  body {\n    margin: 0;\n    min-height: 100vh;\n    padding: 32px 20px;\n    display: grid;\n    place-items: center;\n    background:\n      radial-gradient(circle at top, rgba(255, 255, 255, 0.7), transparent 45%),\n      linear-gradient(180deg, #faf7f0 0%, var(--bg) 100%);\n    color: var(--text);\n    font-family:\n      \"SF Pro Text\",\n      \"Segoe UI\",\n      system-ui,\n      sans-serif;\n  }\n\n  .shell {\n    width: min(100%, 560px);\n  }\n\n  .card {\n    padding: 28px;\n    border: 1px solid var(--panel-border);\n    border-radius: 20px;\n    background: var(--panel);\n    box-shadow: 0 18px 48px rgba(28, 30, 33, 0.08);\n    backdrop-filter: blur(8px);\n  }\n\n  .eyebrow {\n    margin: 0 0 10px;\n    color: var(--muted);\n    font-size: 0.82rem;\n    font-weight: 700;\n    letter-spacing: 0.08em;\n    text-transform: uppercase;\n  }\n\n  h1 {\n    margin: 0 0 10px;\n    font-size: clamp(1.5rem, 2vw, 1.8rem);\n    line-height: 1.15;\n    text-wrap: balance;\n  }\n\n  p {\n    margin: 0;\n    color: var(--muted);\n    font-size: 0.98rem;\n    line-height: 1.5;\n  }\n\n  .stack > * + * {\n    margin-top: 14px;\n  }\n\n  .form {\n    margin-top: 24px;\n  }\n\n  .form > * + * {\n    margin-top: 18px;\n  }\n\n  label {\n    display: block;\n    margin-bottom: 6px;\n    font-size: 0.92rem;\n    font-weight: 650;\n  }\n\n  input,\n  select,\n  button {\n    font: inherit;\n  }\n\n  input,\n  select {\n    width: 100%;\n    padding: 12px 14px;\n    border: 1px solid var(--field-border);\n    border-radius: 12px;\n    background: #fff;\n    color: var(--text);\n  }\n\n  input:focus-visible,\n  select:focus-visible,\n  button:focus-visible {\n    outline: 2px solid var(--field-focus);\n    outline-offset: 2px;\n  }\n\n  button {\n    width: 100%;\n    margin-top: 24px;\n    padding: 13px 18px;\n    border: none;\n    border-radius: 12px;\n    background: var(--button);\n    color: #fff;\n    cursor: pointer;\n    transition: background-color 160ms ease;\n  }\n\n  button:hover {\n    background: var(--button-hover);\n  }\n\n  button:disabled {\n    background: var(--button-disabled);\n    cursor: default;\n  }\n\n  .mode {\n    display: flex;\n    flex-wrap: wrap;\n    gap: 10px;\n    margin-top: 22px;\n  }\n\n  .mode label {\n    display: inline-flex;\n    align-items: center;\n    gap: 8px;\n    margin: 0;\n    padding: 10px 12px;\n    border: 1px solid var(--field-border);\n    border-radius: 999px;\n    background: rgba(255, 255, 255, 0.85);\n    font-weight: 500;\n  }\n\n  .mode input {\n    width: auto;\n    margin: 0;\n  }\n\n  .panel {\n    display: none;\n  }\n\n  .panel.active {\n    display: block;\n  }\n\n  .panel-note {\n    margin-top: 10px;\n    font-size: 0.92rem;\n  }\n\n  .result,\n  .status {\n    margin-top: 20px;\n    padding: 14px 16px;\n    border-radius: 14px;\n    font-size: 0.95rem;\n  }\n\n  .result {\n    display: none;\n  }\n\n  .result.ok,\n  .status.ok {\n    background: var(--ok-bg);\n    color: var(--ok-text);\n  }\n\n  .result.err,\n  .status.err {\n    background: var(--err-bg);\n    color: var(--err-text);\n  }\n\n  .secrets-summary {\n    margin-top: 18px;\n    padding: 14px 16px;\n    border: 1px solid var(--panel-border);\n    border-radius: 14px;\n    background: rgba(255, 255, 255, 0.72);\n  }\n\n  .secrets-summary h2 {\n    margin: 0 0 8px;\n    font-size: 0.98rem;\n  }\n\n  .secrets-summary p {\n    font-size: 0.92rem;\n  }\n\n  .secrets-summary ul {\n    margin: 10px 0 0;\n    padding-left: 18px;\n    color: var(--text);\n  }\n\n  .secrets-summary li + li {\n    margin-top: 6px;\n  }\n\n  .close-note {\n    margin-top: 14px;\n    font-size: 0.92rem;\n  }\n\n  @media (max-width: 640px) {\n    body {\n      padding: 20px 14px;\n    }\n\n    .card {\n      padding: 22px;\n      border-radius: 16px;\n    }\n  }\n`;\n\nfunction renderPageDocument(title: string, body: string): string {\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\">\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n  <title>${esc(title)} — ${PRODUCT_NAME}</title>\n  <style>${sharedPageStyles}</style>\n</head>\n<body>\n  <main class=\"shell\">\n    <section class=\"card\">\n      ${body}\n    </section>\n  </main>\n</body>\n</html>`;\n}\n\nfunction renderStatusPage(\n  title: string,\n  message: string,\n  tone: \"ok\" | \"err\",\n  options?: { closeNote?: boolean },\n): string {\n  const closeNote = options?.closeNote ? '<p class=\"close-note\">You can close this tab.</p>' : \"\";\n  return renderPageDocument(\n    title,\n    `<div class=\"stack\">\n      <p class=\"eyebrow\">${PRODUCT_NAME}</p>\n      <h1>${esc(title)}</h1>\n      <div class=\"status ${tone}\">${esc(message)}</div>\n      ${closeNote}\n    </div>`,\n  );\n}\n\ninterface ExistingSecretsSummary {\n  envKeys: string[];\n  mountTargets: string[];\n}\n\nfunction describeVaultSecrets(vaultManager: VaultManager, vaultId: string): ExistingSecretsSummary {\n  const vault = vaultManager.resolve(vaultId);\n  if (!vault) {\n    return { envKeys: [], mountTargets: [] };\n  }\n\n  return {\n    envKeys: Object.keys(vault.env).sort((left, right) => left.localeCompare(right)),\n    mountTargets: [...new Set(vault.mounts.map((mount) => mount.target))].sort((left, right) =>\n      left.localeCompare(right),\n    ),\n  };\n}\n\nfunction renderSecretsSummary(summary: ExistingSecretsSummary): string {\n  if (summary.envKeys.length === 0 && summary.mountTargets.length === 0) {\n    return `\n  <section class=\"secrets-summary\">\n    <h2>Currently stored</h2>\n    <p>No secrets are stored in this vault yet.</p>\n  </section>`;\n  }\n\n  const envItems = summary.envKeys.map((envKey) => `<li><code>${esc(envKey)}</code></li>`).join(\"\");\n  const mountItems = summary.mountTargets\n    .map((target) => `<li><code>${esc(target)}</code></li>`)\n    .join(\"\");\n\n  return `\n  <section class=\"secrets-summary\">\n    <h2>Currently stored</h2>\n    <p>Only secret names and mounted paths are shown here. Secret values are never displayed.</p>\n    ${summary.envKeys.length > 0 ? `<p><strong>Environment keys</strong></p><ul>${envItems}</ul>` : \"\"}\n    ${summary.mountTargets.length > 0 ? `<p><strong>Mounted secret files</strong></p><ul>${mountItems}</ul>` : \"\"}\n  </section>`;\n}\n\nfunction renderCredentialPage(\n  token: string,\n  title: string,\n  defaultMode: LoginCredentialKind,\n  initialEnvKey: string,\n  secretLabel: string,\n  placeholder: string,\n  helpText: string,\n  oauthServices: OAuthService[],\n  oauthServiceIdHint: string | undefined,\n  existingSecrets: ExistingSecretsSummary,\n): string {\n  const oauthOptions = oauthServices\n    .map((service) => {\n      const selected = service.id === oauthServiceIdHint ? ' selected=\"selected\"' : \"\";\n      return `<option value=\"${esc(service.id)}\"${selected}>${esc(service.label)}</option>`;\n    })\n    .join(\"\\n\");\n\n  return renderPageDocument(\n    \"Login\",\n    `<div class=\"stack\">\n  <p class=\"eyebrow\">${PRODUCT_NAME}</p>\n  <h1>${esc(title)}</h1>\n  <p>Your personal sandbox is already provisioned automatically.</p>\n  <p>${esc(helpText)}</p>\n  ${renderSecretsSummary(existingSecrets)}\n  <div class=\"mode\">\n    <label><input type=\"radio\" name=\"mode\" value=\"api_key\" ${defaultMode === \"api_key\" ? \"checked\" : \"\"}> API key</label>\n    <label><input type=\"radio\" name=\"mode\" value=\"oauth\" ${defaultMode === \"oauth\" ? \"checked\" : \"\"}> OAuth login</label>\n  </div>\n\n  <div class=\"form\">\n  <div id=\"api-panel\" class=\"panel\">\n    <label for=\"envKey\">Environment key</label>\n    <input id=\"envKey\" type=\"text\" name=\"envKey\" placeholder=\"OPENAI_API_KEY\" value=\"${esc(initialEnvKey)}\" autocomplete=\"off\">\n    <label for=\"credential\">${esc(secretLabel)}</label>\n    <input id=\"credential\" type=\"password\" name=\"credential\" placeholder=\"${esc(placeholder)}\" autocomplete=\"off\">\n  </div>\n\n  <div id=\"oauth-panel\" class=\"panel\">\n    <label for=\"oauthService\">OAuth service</label>\n    <select id=\"oauthService\" name=\"oauthService\">${oauthOptions}</select>\n    <p class=\"panel-note\">You'll be redirected to the selected service's authorization page.</p>\n  </div>\n\n  <button id=\"btn\" onclick=\"connect()\">Continue</button>\n  <div id=\"result\" class=\"result\" aria-live=\"polite\"></div>\n  </div>\n  <script>\n    const envKeyPattern = /^[A-Za-z_][A-Za-z0-9_]*$/;\n\n    function selectedMode() {\n      return document.querySelector('input[name=\"mode\"]:checked').value;\n    }\n\n    function showResult(message, ok) {\n      const result = document.getElementById('result');\n      result.style.display = 'block';\n      result.className = ok ? 'result ok' : 'result err';\n      result.textContent = message;\n    }\n\n    function syncPanels() {\n      const api = document.getElementById('api-panel');\n      const oauth = document.getElementById('oauth-panel');\n      const mode = selectedMode();\n      api.className = mode === 'api_key' ? 'panel active' : 'panel';\n      oauth.className = mode === 'oauth' ? 'panel active' : 'panel';\n    }\n\n    for (const radio of document.querySelectorAll('input[name=\"mode\"]')) {\n      radio.addEventListener('change', syncPanels);\n    }\n\n    syncPanels();\n\n    async function connect() {\n      const btn = document.getElementById('btn');\n      const mode = selectedMode();\n      btn.disabled = true;\n      btn.textContent = mode === 'oauth' ? 'Redirecting…' : 'Saving…';\n\n      try {\n        if (mode === 'oauth') {\n          const serviceId = document.getElementById('oauthService').value;\n          const r = await fetch('/api/oauth/start', {\n            method: 'POST',\n            headers: { 'Content-Type': 'application/json' },\n            body: JSON.stringify({ token: '${esc(token)}', serviceId }),\n          });\n          const data = await r.json();\n          if (!r.ok) {\n            showResult('Error: ' + (data.error ?? r.status), false);\n            btn.disabled = false;\n            btn.textContent = 'Continue';\n            return;\n          }\n          window.location.href = data.redirectUrl;\n          return;\n        }\n\n        const envKey = document.getElementById('envKey').value.trim();\n        const credential = document.getElementById('credential').value.trim();\n        if (!envKeyPattern.test(envKey)) {\n          showResult('Please enter a valid environment key.', false);\n          btn.disabled = false;\n          btn.textContent = 'Continue';\n          return;\n        }\n        if (!credential) {\n          showResult('Please enter a value.', false);\n          btn.disabled = false;\n          btn.textContent = 'Continue';\n          return;\n        }\n\n        const r = await fetch('/api/link/complete', {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({ token: '${esc(token)}', mode: 'api_key', envKey, credential }),\n        });\n        const data = await r.json();\n        if (r.ok) {\n          showResult(data.message ?? 'Credential stored. You can close this tab.', true);\n          btn.style.display = 'none';\n          for (const input of document.querySelectorAll('input,select')) input.disabled = true;\n        } else {\n          showResult('Error: ' + (data.error ?? r.status), false);\n          btn.disabled = false;\n          btn.textContent = 'Continue';\n        }\n      } catch (err) {\n        showResult('Network error: ' + err.message, false);\n        btn.disabled = false;\n        btn.textContent = 'Continue';\n      }\n    }\n  </script>\n</div>`,\n  );\n}\n\nfunction renderErrorPage(message: string): string {\n  return renderStatusPage(\"Login Error\", message, \"err\");\n}\n\nfunction renderSuccessPage(message: string): string {\n  return renderStatusPage(\"Connected\", message, \"ok\", { closeNote: true });\n}\n\n// ── API-key completion ────────────────────────────────────────────────────────\n\nasync function handleLinkComplete(\n  body: string,\n  linkTokenStore: InMemoryLinkTokenStore,\n  vaultManager: VaultManager,\n  notify: NotifyFn,\n  res: ServerResponse,\n): Promise<void> {\n  let data: Partial<LinkCompleteBody>;\n  try {\n    data = JSON.parse(body) as Partial<LinkCompleteBody>;\n  } catch {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Invalid JSON\" }));\n    return;\n  }\n\n  if (!data.token) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Missing required field: token\" }));\n    return;\n  }\n\n  const envKey = data.envKey?.trim() ?? \"\";\n  const credential = data.credential?.trim() ?? \"\";\n\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(envKey)) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Invalid envKey format\" }));\n    return;\n  }\n\n  if (!credential) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Missing required field: credential\" }));\n    return;\n  }\n\n  // Atomic consume prevents two concurrent requests from both passing the\n  // validity check before either deletes the token.\n  const linkToken = linkTokenStore.consume(data.token);\n  if (!linkToken) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Invalid or expired token\" }));\n    return;\n  }\n\n  try {\n    vaultManager.upsertEnv(linkToken.vaultId, { [envKey]: credential });\n  } catch (error) {\n    log.logWarning(\n      `Failed to persist ${envKey} for ${linkToken.platform}/${linkToken.platformUserId}`,\n      error instanceof Error ? error.message : String(error),\n    );\n    res.writeHead(500, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error:\n          \"Failed to store credential on server. Please fix the server issue and run /login again.\",\n      }),\n    );\n    return;\n  }\n\n  log.logInfo(\n    `Stored ${envKey} for ${linkToken.platform}/${linkToken.platformUserId} in vault:${linkToken.vaultId}`,\n  );\n\n  res.writeHead(200, { \"Content-Type\": \"application/json\" });\n  res.end(JSON.stringify({ ok: true, message: `${envKey} stored successfully in vault.` }));\n\n  notify(\n    linkToken.platform,\n    linkToken.conversationId,\n    `${envKey} stored successfully in vault \\`${linkToken.vaultId}\\`.`,\n  ).catch((err: Error) => {\n    log.logWarning(\"Failed to notify user after credential login\", err.message);\n  });\n}\n\n// ── OAuth flow ────────────────────────────────────────────────────────────────\n\nasync function handleOAuthStart(\n  body: string,\n  req: IncomingMessage,\n  linkTokenStore: InMemoryLinkTokenStore,\n  oauthStates: Map<string, PendingOAuthState>,\n  res: ServerResponse,\n): Promise<void> {\n  let data: Partial<OAuthStartBody>;\n  try {\n    data = JSON.parse(body) as Partial<OAuthStartBody>;\n  } catch {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Invalid JSON\" }));\n    return;\n  }\n\n  if (!data.token || !data.serviceId) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Missing required fields: token/serviceId\" }));\n    return;\n  }\n\n  const linkToken = linkTokenStore.peek(data.token);\n  if (!linkToken) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Invalid or expired token\" }));\n    return;\n  }\n\n  const service = resolveOAuthService(data.serviceId);\n  if (!service) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: `Unsupported OAuth service: ${data.serviceId}` }));\n    return;\n  }\n\n  const clientId = process.env[service.clientIdEnvKey];\n  const clientSecret = process.env[service.clientSecretEnvKey];\n  if (!clientId || !clientSecret) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(\n      JSON.stringify({\n        error:\n          `OAuth service ${service.label} is not configured. ` +\n          `Missing ${service.clientIdEnvKey}/${service.clientSecretEnvKey}.`,\n      }),\n    );\n    return;\n  }\n\n  const state = randomBytes(16).toString(\"hex\");\n  const codeVerifier = randomBytes(32).toString(\"base64url\");\n  oauthStates.set(state, {\n    linkToken: data.token,\n    serviceId: service.id,\n    codeVerifier,\n    expiresAt: Date.now() + OAUTH_STATE_TTL_MS,\n  });\n\n  for (const [k, v] of oauthStates) {\n    if (Date.now() > v.expiresAt) oauthStates.delete(k);\n  }\n\n  const redirectUri = `${requestBaseUrl(req)}/oauth/callback`;\n  const authorizeUrl = new URL(service.authorizationUrl);\n  authorizeUrl.searchParams.set(\"response_type\", \"code\");\n  authorizeUrl.searchParams.set(\"client_id\", clientId);\n  authorizeUrl.searchParams.set(\"redirect_uri\", redirectUri);\n  authorizeUrl.searchParams.set(\"state\", state);\n  if (service.scopes.length > 0) {\n    authorizeUrl.searchParams.set(\"scope\", service.scopes.join(\" \"));\n  }\n  for (const [key, value] of Object.entries(service.authorizationParams ?? {})) {\n    authorizeUrl.searchParams.set(key, value);\n  }\n\n  const codeChallenge = createHash(\"sha256\").update(codeVerifier).digest(\"base64url\");\n  authorizeUrl.searchParams.set(\"code_challenge\", codeChallenge);\n  authorizeUrl.searchParams.set(\"code_challenge_method\", \"S256\");\n\n  res.writeHead(200, { \"Content-Type\": \"application/json\" });\n  res.end(JSON.stringify({ ok: true, redirectUrl: authorizeUrl.toString() }));\n}\n\nasync function handleOAuthCallback(\n  url: URL,\n  req: IncomingMessage,\n  linkTokenStore: InMemoryLinkTokenStore,\n  vaultManager: VaultManager,\n  notify: NotifyFn,\n  oauthStates: Map<string, PendingOAuthState>,\n  res: ServerResponse,\n): Promise<void> {\n  const state = url.searchParams.get(\"state\") ?? \"\";\n  const code = url.searchParams.get(\"code\") ?? \"\";\n  const error = url.searchParams.get(\"error\");\n\n  // Atomic pop: whatever path we take from here, this state is spent.\n  // Done before any `await` to close the TOCTOU window between the state\n  // lookup and the final delete.\n  const pending = oauthStates.get(state);\n  if (pending) oauthStates.delete(state);\n\n  if (error) {\n    res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(`OAuth authorization failed: ${error}`));\n    return;\n  }\n\n  if (!pending || Date.now() > pending.expiresAt) {\n    res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(\"OAuth state is invalid or expired. Please run /login again.\"));\n    return;\n  }\n\n  if (!code) {\n    res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(\"Missing OAuth authorization code.\"));\n    return;\n  }\n\n  const service = resolveOAuthService(pending.serviceId);\n  if (!service) {\n    res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(\"Unsupported OAuth service.\"));\n    return;\n  }\n\n  const clientId = process.env[service.clientIdEnvKey];\n  const clientSecret = process.env[service.clientSecretEnvKey];\n  if (!clientId || !clientSecret) {\n    res.writeHead(500, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(\"OAuth service is not configured on server.\"));\n    return;\n  }\n\n  // Atomic consume: pairs with the callback being one-shot. Two concurrent\n  // callbacks for the same state would previously both pass `peek` and both\n  // run `exchangeOAuthCode` across the await; only one reaches `consume`.\n  const linkToken = linkTokenStore.consume(pending.linkToken);\n  if (!linkToken) {\n    res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(\"Login link is invalid or expired. Please run /login again.\"));\n    return;\n  }\n\n  const redirectUri = `${requestBaseUrl(req)}/oauth/callback`;\n  const tokenResp = await exchangeOAuthCode(\n    service,\n    code,\n    clientId,\n    clientSecret,\n    redirectUri,\n    pending.codeVerifier,\n  );\n\n  const accessToken = tokenResp.access_token?.trim();\n  const refreshToken = tokenResp.refresh_token?.trim();\n\n  if (!accessToken) {\n    res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(renderErrorPage(\"OAuth token exchange did not return an access_token.\"));\n    return;\n  }\n\n  const updates: Record<string, string> = {};\n  if (service.accessTokenEnvKey) {\n    updates[service.accessTokenEnvKey] = accessToken;\n  }\n  for (const key of service.additionalAccessTokenEnvKeys ?? []) {\n    updates[key] = accessToken;\n  }\n  if (refreshToken && service.refreshTokenEnvKey) {\n    updates[service.refreshTokenEnvKey] = refreshToken;\n  }\n\n  const fileOutput = service.fileOutput;\n  let mountedPath: string | undefined;\n  if (fileOutput?.type === \"authorized_user\") {\n    if (!refreshToken) {\n      res.writeHead(400, { \"Content-Type\": \"text/html; charset=utf-8\" });\n      res.end(\n        renderErrorPage(\n          \"OAuth token exchange did not return a refresh_token. \" +\n            \"Retry after revoking prior consent or ensure prompt=consent is applied.\",\n        ),\n      );\n      return;\n    }\n\n    mountedPath = fileOutput.targetPath ?? defaultVaultTargetPath(fileOutput.relativePath);\n    if (fileOutput.envKey) {\n      updates[fileOutput.envKey] = mountedPath;\n    }\n  }\n\n  const storedTargets: string[] = [];\n  try {\n    if (Object.keys(updates).length > 0) {\n      vaultManager.upsertEnv(linkToken.vaultId, updates);\n      storedTargets.push(...Object.keys(updates).sort());\n    }\n    if (fileOutput?.type === \"authorized_user\" && refreshToken) {\n      vaultManager.upsertFile(\n        linkToken.vaultId,\n        fileOutput.relativePath,\n        renderAuthorizedUserCredential(clientId, clientSecret, refreshToken),\n        fileOutput.targetPath,\n      );\n      if (mountedPath) storedTargets.push(mountedPath);\n    }\n  } catch (error) {\n    log.logWarning(\n      `Failed to persist OAuth credentials for ${linkToken.platform}/${linkToken.platformUserId}`,\n      error instanceof Error ? error.message : String(error),\n    );\n    res.writeHead(500, { \"Content-Type\": \"text/html; charset=utf-8\" });\n    res.end(\n      renderErrorPage(\n        \"OAuth tokens were received but could not be stored on the server. Fix the server issue and run /login again.\",\n      ),\n    );\n    return;\n  }\n\n  log.logInfo(\n    `Stored [${storedTargets.join(\", \")}] for ${linkToken.platform}/${linkToken.platformUserId} in vault:${linkToken.vaultId}`,\n  );\n\n  notify(\n    linkToken.platform,\n    linkToken.conversationId,\n    `${service.label} OAuth stored (${storedTargets.join(\", \")}) in vault \\`${linkToken.vaultId}\\`.`,\n  ).catch((err: Error) => {\n    log.logWarning(\"Failed to notify user after OAuth login\", err.message);\n  });\n\n  res.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\" });\n  res.end(renderSuccessPage(`${service.label} OAuth connected successfully.`));\n}\n\nasync function exchangeOAuthCode(\n  service: OAuthService,\n  code: string,\n  clientId: string,\n  clientSecret: string,\n  redirectUri: string,\n  codeVerifier: string,\n): Promise<Record<string, string>> {\n  const params = new URLSearchParams();\n  params.set(\"grant_type\", \"authorization_code\");\n  params.set(\"code\", code);\n  params.set(\"client_id\", clientId);\n  params.set(\"client_secret\", clientSecret);\n  params.set(\"redirect_uri\", redirectUri);\n  params.set(\"code_verifier\", codeVerifier);\n\n  const response = await fetch(service.tokenUrl, {\n    method: \"POST\",\n    headers: {\n      \"Content-Type\": \"application/x-www-form-urlencoded\",\n      Accept: \"application/json\",\n    },\n    body: params.toString(),\n  });\n\n  const text = await response.text();\n  const contentType = response.headers.get(\"content-type\") ?? \"\";\n  let parsed: Record<string, string> = {};\n\n  if (contentType.includes(\"application/json\")) {\n    parsed = JSON.parse(text) as Record<string, string>;\n  } else {\n    const form = new URLSearchParams(text);\n    parsed = Object.fromEntries(form.entries());\n  }\n\n  if (!response.ok) {\n    const message = parsed.error_description ?? parsed.error ?? `${response.status}`;\n    throw new Error(`OAuth token exchange failed for ${service.id}: ${message}`);\n  }\n\n  return parsed;\n}\n\nfunction renderAuthorizedUserCredential(\n  clientId: string,\n  clientSecret: string,\n  refreshToken: string,\n): string {\n  return (\n    JSON.stringify(\n      {\n        client_id: clientId,\n        client_secret: clientSecret,\n        refresh_token: refreshToken,\n        type: \"authorized_user\",\n      },\n      null,\n      2,\n    ) + \"\\n\"\n  );\n}\n"]}