@geminixiang/mama 0.2.0-beta.7 → 0.2.0-beta.9

package/dist/vault.js

@@ -1,7 +1,19 @@
-import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync } from "fs";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "fs";
 import { dirname, isAbsolute, join, normalize, sep } from "path";
+import { readTextFileIfExists } from "./file-guards.js";
 import { atomicWritePrivateFile } from "./fs-atomic.js";
 const PRIVATE_DIR_MODE = 0o700;
+const SHARED_VAULT_DIR = "shared";
+export function normalizeSharedVaultName(name) {
+    const trimmed = name.trim();
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(trimmed))
+        return undefined;
+    return trimmed;
+}
+export function sharedVaultKey(name) {
+    const normalized = normalizeSharedVaultName(name);
+    return normalized ? `${SHARED_VAULT_DIR}/${normalized}` : undefined;
+}
 function sanitizeCloudflareSandboxId(value) {
     return (value
         .toLowerCase()
@@ -31,7 +43,6 @@ export function parseEnvFile(content) {
         if (!key)
             continue;
         let value = trimmed.slice(eqIndex + 1);
-        // Strip matching quotes
         if ((value.startsWith('"') && value.endsWith('"')) ||
             (value.startsWith("'") && value.endsWith("'"))) {
             value = value.slice(1, -1);
@@ -43,189 +54,79 @@ export function parseEnvFile(content) {
 // ── FileVaultManager ───────────────────────────────────────────────────────────
 export class FileVaultManager {
     constructor(stateDir) {
-        this.config = null;
         this.vaultsDir = join(stateDir, "vaults");
-        this.configPath = join(this.vaultsDir, "vault.json");
-        this.reload();
-    }
-    reload() {
-        if (!existsSync(this.configPath)) {
-            this.config = null;
-            return;
-        }
-        try {
-            const raw = readFileSync(this.configPath, "utf-8");
-            const parsed = JSON.parse(raw);
-            if (!parsed ||
-                typeof parsed !== "object" ||
-                !parsed.vaults ||
-                typeof parsed.vaults !== "object") {
-                console.error(`vault: malformed vault.json — expected { vaults: { ... } }`);
-                this.config = null;
-                return;
-            }
-            this.config = parsed;
-            this.warnUnsupportedSandboxTypes();
-        }
-        catch (err) {
-            console.error(`vault: failed to read ${this.configPath}:`, err);
-            this.config = null;
-        }
-    }
-    /** Warn for legacy or insecure vault sandbox overrides that are no longer allowed. */
-    warnUnsupportedSandboxTypes() {
-        if (!this.config)
-            return;
-        for (const [key, entry] of Object.entries(this.config.vaults)) {
-            if (entry.sandbox?.type === "host") {
-                console.error(`vault: "${key}" uses sandbox.type=host, which is blocked for credential isolation. ` +
-                    "Use sandbox.type=image, sandbox.type=firecracker, or sandbox.type=cloudflare.");
-            }
-            if (entry.sandbox?.type === "container" || entry.sandbox?.type === "docker") {
-                console.error(`vault: "${key}" uses sandbox.type=${entry.sandbox.type}, which is blocked for credential isolation. ` +
-                    "Use sandbox.type=image for per-user containers, sandbox.type=firecracker, or sandbox.type=cloudflare.");
-            }
-        }
     }
     isEnabled() {
-        return this.config !== null || existsSync(this.vaultsDir);
+        return existsSync(this.vaultsDir);
     }
     hasEntry(key) {
-        return !!this.config?.vaults[key] || existsSync(join(this.vaultsDir, key));
+        return existsSync(join(this.vaultsDir, key));
+    }
+    listSharedVaults() {
+        const sharedDir = join(this.vaultsDir, SHARED_VAULT_DIR);
+        if (!existsSync(sharedDir))
+            return [];
+        return readdirSync(sharedDir, { withFileTypes: true })
+            .filter((entry) => entry.isDirectory() && normalizeSharedVaultName(entry.name) === entry.name)
+            .map((entry) => entry.name)
+            .toSorted((left, right) => left.localeCompare(right));
+    }
+    deleteSharedVault(name) {
+        const key = sharedVaultKey(name);
+        if (!key)
+            throw new Error(`vault: invalid shared login name: ${name}`);
+        const dir = join(this.vaultsDir, key);
+        const existed = existsSync(dir);
+        rmSync(dir, { recursive: true, force: true });
+        return existed;
+    }
+    copySharedVaultTo(name, targetKey) {
+        const sourceKey = sharedVaultKey(name);
+        if (!sourceKey)
+            throw new Error(`vault: invalid shared login name: ${name}`);
+        const sourceDir = join(this.vaultsDir, sourceKey);
+        if (!existsSync(sourceDir))
+            throw new Error(`vault: shared login "${name}" does not exist`);
+        const targetDir = join(this.vaultsDir, targetKey);
+        ensurePrivateDir(this.vaultsDir);
+        ensurePrivateDir(targetDir);
+        return copyVaultDir(sourceDir, targetDir);
     }
     resolve(userId) {
-        const entry = this.config?.vaults[userId];
         const dir = join(this.vaultsDir, userId);
-        if (!entry && !existsSync(dir))
+        if (!existsSync(dir))
             return undefined;
-        return this.buildResolved(userId, entry);
+        return this.buildResolved(userId);
     }
     getSandboxConfig(userId, baseConfig) {
-        const vault = this.resolve(userId);
-        if (!vault?.sandboxOverride) {
-            if (baseConfig.type === "cloudflare") {
-                return {
-                    type: "cloudflare",
-                    sandboxId: `${baseConfig.sandboxId}-${sanitizeCloudflareSandboxId(userId)}`,
-                };
-            }
-            return baseConfig;
-        }
-        const override = vault.sandboxOverride;
-        if (override.type === "image") {
-            if (baseConfig.type !== "image") {
-                if (!override.container) {
-                    if (baseConfig.type === "cloudflare") {
-                        return {
-                            type: "cloudflare",
-                            sandboxId: `${baseConfig.sandboxId}-${sanitizeCloudflareSandboxId(userId)}`,
-                        };
-                    }
-                    return baseConfig;
-                }
-                throw new Error(`vault "${userId}" sets sandbox.type=image, but base sandbox is "${baseConfig.type}". ` +
-                    "Use --sandbox=image:<image> to enable managed image containers for this vault.");
-            }
-            const container = override.container || `mama-sandbox-${userId}`;
-            return { type: "container", container };
-        }
-        if (override.type === "firecracker") {
-            if (!override.vmId)
-                return baseConfig;
-            if (baseConfig.type !== "firecracker") {
-                throw new Error(`vault "${userId}" sets sandbox.type=firecracker, but base sandbox is "${baseConfig.type}". ` +
-                    "Use --sandbox=firecracker:<vm-id>:<host-path> so /workspace stays mapped to the real workspace.");
-            }
-            return {
-                type: "firecracker",
-                vmId: override.vmId,
-                hostPath: baseConfig.hostPath,
-                sshUser: override.sshUser,
-                sshPort: override.sshPort,
-            };
-        }
-        if (override.type === "cloudflare") {
-            if (!override.sandboxId)
-                return baseConfig;
-            if (baseConfig.type !== "cloudflare") {
-                throw new Error(`vault "${userId}" sets sandbox.type=cloudflare, but base sandbox is "${baseConfig.type}". ` +
-                    "Use --sandbox=cloudflare:<sandbox-id> to enable Cloudflare remote execution.");
-            }
+        if (baseConfig.type === "cloudflare") {
             return {
                 type: "cloudflare",
-                sandboxId: override.sandboxId,
+                sandboxId: `${baseConfig.sandboxId}-${sanitizeCloudflareSandboxId(userId)}`,
             };
         }
-        if (override.type === "host") {
-            throw new Error(`vault "${userId}" uses sandbox.type=host, which is blocked for credential isolation. ` +
-                "Use sandbox.type=image, sandbox.type=firecracker, or sandbox.type=cloudflare.");
-        }
-        if (override.type === "container" || override.type === "docker") {
-            throw new Error(`vault "${userId}" uses sandbox.type=${override.type}, which is blocked for credential isolation. ` +
-                "Use sandbox.type=image for per-user containers, sandbox.type=firecracker, or sandbox.type=cloudflare.");
-        }
-        // No type override — return base config unchanged
         return baseConfig;
     }
     list() {
+        if (!existsSync(this.vaultsDir))
+            return [];
         const keys = new Set();
-        for (const key of Object.keys(this.config?.vaults ?? {})) {
-            keys.add(key);
+        for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {
+            if (entry.isDirectory())
+                keys.add(entry.name);
         }
-        if (existsSync(this.vaultsDir)) {
-            for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {
-                if (entry.isDirectory())
-                    keys.add(entry.name);
-            }
-        }
-        return Array.from(keys, (key) => this.buildResolved(key, this.config?.vaults[key]));
-    }
-    addEntry(key, entry) {
-        const cfg = (this.config ??= { vaults: {} });
-        // Idempotent: skip if already exists
-        if (cfg.vaults[key])
-            return;
-        cfg.vaults[key] = entry;
-        this.persistConfig();
-    }
-    ensureImageSandboxEntry(key, entry) {
-        if (entry.sandbox?.type !== "image") {
-            throw new Error(`vault: ensureImageSandboxEntry requires sandbox.type=image for "${key}"`);
-        }
-        const cfg = (this.config ??= { vaults: {} });
-        const existing = cfg.vaults[key];
-        if (!existing) {
-            cfg.vaults[key] = entry;
-            this.persistConfig();
-            return;
-        }
-        let nextEntry = existing;
-        let changed = false;
-        if (!existing.platform && entry.platform) {
-            nextEntry = { ...nextEntry, platform: entry.platform };
-            changed = true;
-        }
-        const existingSandbox = existing.sandbox;
-        if (!existingSandbox?.type) {
-            nextEntry = { ...nextEntry, sandbox: entry.sandbox };
-            changed = true;
-        }
-        if (!changed)
-            return;
-        cfg.vaults[key] = nextEntry;
-        this.persistConfig();
+        return Array.from(keys, (key) => this.buildResolved(key));
     }
     upsertEnv(key, env) {
         const dir = join(this.vaultsDir, key);
         const envPath = join(dir, "env");
         ensurePrivateDir(this.vaultsDir);
         ensurePrivateDir(dir);
-        const existing = existsSync(envPath)
-            ? parseEnvFile(readFileSync(envPath, "utf-8"))
-            : {};
+        const existingContent = readTextFileIfExists(envPath);
+        const existing = existingContent ? parseEnvFile(existingContent) : {};
         const merged = { ...existing, ...env };
         const content = Object.entries(merged)
-            .sort(([left], [right]) => left.localeCompare(right))
+            .toSorted(([left], [right]) => left.localeCompare(right))
             .map(([envKey, value]) => `${envKey}=${value}`)
             .join("\n") + "\n";
         atomicWritePrivateFile(envPath, content);
@@ -245,55 +146,14 @@ export class FileVaultManager {
         atomicWritePrivateFile(filePath, content);
     }
     // ── private ────────────────────────────────────────────────────────────────
-    persistConfig() {
-        ensurePrivateDir(this.vaultsDir);
-        // Preserve concurrent external edits: pull in any entries that appear on
-        // disk but not in our in-memory view, so a background edit (e.g. another
-        // admin adding a user) is not silently dropped by the next upsert here.
-        // Individual field edits still follow last-writer-wins per key.
-        const onDisk = this.readConfigFromDisk();
-        if (onDisk && this.config) {
-            for (const [key, entry] of Object.entries(onDisk.vaults)) {
-                if (!(key in this.config.vaults)) {
-                    this.config.vaults[key] = entry;
-                }
-            }
-        }
-        atomicWritePrivateFile(this.configPath, JSON.stringify(this.config, null, 2) + "\n");
-    }
-    readConfigFromDisk() {
-        if (!existsSync(this.configPath))
-            return null;
-        try {
-            const parsed = JSON.parse(readFileSync(this.configPath, "utf-8"));
-            if (!parsed ||
-                typeof parsed !== "object" ||
-                !parsed.vaults ||
-                typeof parsed.vaults !== "object") {
-                return null;
-            }
-            return parsed;
-        }
-        catch {
-            return null;
-        }
-    }
-    buildResolved(key, entry) {
+    buildResolved(key) {
         const dir = join(this.vaultsDir, key);
-        const inferredMounts = this.inferMountsFromDir(dir);
-        const configuredMounts = (entry?.mounts ?? [])
-            .map((mount) => this.resolveMountEntry(dir, mount))
-            .filter((mount) => mount !== undefined);
-        const mountsByTarget = new Map();
-        for (const mount of inferredMounts)
-            mountsByTarget.set(mount.target, mount);
-        for (const mount of configuredMounts)
-            mountsByTarget.set(mount.target, mount);
+        const mounts = inferMountsFromDir(dir);
         let env = {};
-        const envPath = join(dir, "env");
-        if ((entry?.envFile ?? true) && existsSync(envPath)) {
+        const envContent = readTextFileIfExists(join(dir, "env"));
+        if (envContent !== undefined) {
             try {
-                env = parseEnvFile(readFileSync(envPath, "utf-8"));
+                env = parseEnvFile(envContent);
             }
             catch (err) {
                 console.error(`vault: failed to parse env file for "${key}":`, err);
@@ -301,55 +161,65 @@ export class FileVaultManager {
         }
         return {
             userId: key,
-            displayName: entry?.displayName ?? key,
+            displayName: key,
             dir,
-            mounts: [...mountsByTarget.values()],
+            mounts,
             env,
-            sandboxOverride: entry?.sandbox,
         };
     }
-    inferMountsFromDir(dir) {
-        if (!existsSync(dir)) {
-            return [];
-        }
-        const mounts = [];
-        for (const entry of readdirSync(dir, { withFileTypes: true })) {
-            if (entry.name === "env")
-                continue;
-            const source = join(dir, entry.name);
-            const target = inferredVaultTargetPath(entry.name);
-            if (!target)
-                continue;
-            mounts.push({ source, target });
-        }
-        return mounts;
-    }
-    resolveMountEntry(dir, mount) {
-        if (typeof mount === "string") {
-            const normalizedSource = normalizeVaultRelativePath(mount);
-            if (!normalizedSource)
-                return undefined;
-            return {
-                source: join(dir, normalizedSource),
-                target: defaultVaultTargetPath(normalizedSource),
-            };
-        }
-        if (!mount || typeof mount !== "object")
-            return undefined;
-        const normalizedSource = normalizeVaultRelativePath(mount.source);
-        if (!normalizedSource)
-            return undefined;
-        const normalizedTarget = normalizeVaultTargetPath(mount.target);
-        return {
-            source: join(dir, normalizedSource),
-            target: normalizedTarget ?? defaultVaultTargetPath(normalizedSource),
-        };
+}
+function inferMountsFromDir(dir) {
+    if (!existsSync(dir))
+        return [];
+    const mounts = [];
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (entry.name === "env")
+            continue;
+        const source = join(dir, entry.name);
+        const target = inferredVaultTargetPath(entry.name);
+        if (!target)
+            continue;
+        mounts.push({ source, target });
     }
+    return mounts;
 }
 function ensurePrivateDir(path) {
     mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });
     chmodSync(path, PRIVATE_DIR_MODE);
 }
+function copyVaultDir(sourceDir, targetDir) {
+    let filesCopied = 0;
+    let envKeysCopied = 0;
+    for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {
+        const sourcePath = join(sourceDir, entry.name);
+        const targetPath = join(targetDir, entry.name);
+        if (entry.name === "env" && entry.isFile()) {
+            const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? "");
+            const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? "");
+            const merged = { ...targetEnv, ...sourceEnv };
+            const content = Object.entries(merged)
+                .toSorted(([left], [right]) => left.localeCompare(right))
+                .map(([envKey, value]) => `${envKey}=${value}`)
+                .join("\n") + "\n";
+            atomicWritePrivateFile(targetPath, content);
+            envKeysCopied += Object.keys(sourceEnv).length;
+            continue;
+        }
+        if (entry.isDirectory()) {
+            ensurePrivateDir(targetPath);
+            const nested = copyVaultDir(sourcePath, targetPath);
+            filesCopied += nested.filesCopied;
+            envKeysCopied += nested.envKeysCopied;
+            continue;
+        }
+        if (!entry.isFile())
+            continue;
+        copyFileSync(sourcePath, targetPath);
+        chmodSync(targetPath, 0o600);
+        filesCopied++;
+    }
+    return { filesCopied, envKeysCopied };
+}
 function normalizeVaultRelativePath(relativePath) {
     const trimmed = relativePath.trim();
     if (!trimmed || isAbsolute(trimmed))
@@ -361,13 +231,11 @@ function normalizeVaultRelativePath(relativePath) {
     return normalized;
 }
 function normalizeVaultTargetPath(targetPath) {
-    if (targetPath === undefined) {
+    if (targetPath === undefined)
         return undefined;
-    }
     const trimmed = targetPath.trim();
-    if (!trimmed || !trimmed.startsWith("/")) {
+    if (!trimmed || !trimmed.startsWith("/"))
         return undefined;
-    }
     const normalized = normalize(trimmed).split(sep).join("/");
     return normalized.startsWith("/") ? normalized : undefined;
 }

package/dist/vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAGjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAE/B,SAAS,2BAA2B,CAAC,KAAa;IAChD,OAAO,CACL,KAAK;SACF,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,SAAS,CACxC,CAAC;AACJ,CAAC;AAkFD,kFAAkF;AAElF;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE9E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAEvC,wBAAwB;QACxB,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kFAAkF;AAElF,MAAM,OAAO,gBAAgB;IAK3B,YAAY,QAAgB;QAJpB,WAAM,GAAuB,IAAI,CAAC;QAKxC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;IAChB,CAAC;IAED,MAAM;QACJ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAE/B,IACE,CAAC,MAAM;gBACP,OAAO,MAAM,KAAK,QAAQ;gBAC1B,CAAC,MAAM,CAAC,MAAM;gBACd,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EACjC,CAAC;gBACD,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;gBAC5E,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;gBACnB,OAAO;YACT,CAAC;YAED,IAAI,CAAC,MAAM,GAAG,MAAqB,CAAC;YACpC,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,UAAU,GAAG,EAAE,GAAG,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAED,sFAAsF;IAC9E,2BAA2B;QACjC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9D,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CACX,WAAW,GAAG,uEAAuE;oBACnF,+EAA+E,CAClF,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5E,OAAO,CAAC,KAAK,CACX,WAAW,GAAG,uBAAuB,KAAK,CAAC,OAAO,CAAC,IAAI,+CAA+C;oBACpG,uGAAuG,CAC1G,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACjD,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,gBAAgB,CAAC,MAAc,EAAE,UAAyB;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,CAAC;YAC5B,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACrC,OAAO;oBACL,IAAI,EAAE,YAAY;oBAClB,SAAS,EAAE,GAAG,UAAU,CAAC,SAAS,IAAI,2BAA2B,CAAC,MAAM,CAAC,EAAE;iBAC5E,CAAC;YACJ,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,eAAe,CAAC;QAEvC,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC9B,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAChC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;oBACxB,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBACrC,OAAO;4BACL,IAAI,EAAE,YAAY;4BAClB,SAAS,EAAE,GAAG,UAAU,CAAC,SAAS,IAAI,2BAA2B,CAAC,MAAM,CAAC,EAAE;yBAC5E,CAAC;oBACJ,CAAC;oBACD,OAAO,UAAU,CAAC;gBACpB,CAAC;gBACD,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,mDAAmD,UAAU,CAAC,IAAI,KAAK;oBACrF,gFAAgF,CACnF,CAAC;YACJ,CAAC;YACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,gBAAgB,MAAM,EAAE,CAAC;YACjE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,IAAI;gBAAE,OAAO,UAAU,CAAC;YACtC,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,yDAAyD,UAAU,CAAC,IAAI,KAAK;oBAC3F,iGAAiG,CACpG,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACnC,IAAI,CAAC,QAAQ,CAAC,SAAS;gBAAE,OAAO,UAAU,CAAC;YAC3C,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACrC,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,wDAAwD,UAAU,CAAC,IAAI,KAAK;oBAC1F,8EAA8E,CACjF,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,uEAAuE;gBACrF,+EAA+E,CAClF,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CACb,UAAU,MAAM,uBAAuB,QAAQ,CAAC,IAAI,+CAA+C;gBACjG,uGAAuG,CAC1G,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI;QACF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBACzE,IAAI,KAAK,CAAC,WAAW,EAAE;oBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,QAAQ,CAAC,GAAW,EAAE,KAAiB;QACrC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7C,qCAAqC;QACrC,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO;QAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,uBAAuB,CAAC,GAAW,EAAE,KAAiB;QACpD,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,mEAAmE,GAAG,GAAG,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACxB,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,SAAS,GAAG,QAAQ,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACzC,SAAS,GAAG,EAAE,GAAG,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvD,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAED,MAAM,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC;QACzC,IAAI,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;YAC3B,SAAS,GAAG,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACrD,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QAED,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;QAC5B,IAAI,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC;IAED,SAAS,CAAC,GAAW,EAAE,GAA2B;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC;YAClC,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,CAAC,CAAE,EAA6B,CAAC;QACnC,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC;QACvC,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACnB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;aAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,UAAU,CAAC,GAAW,EAAE,YAAoB,EAAE,OAAe,EAAE,UAAmB;QAChF,MAAM,cAAc,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,MAAM,YAAY,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAE3C,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,GAAG;YAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,8EAA8E;IAEtE,aAAa;QACnB,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEjC,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,gEAAgE;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACzC,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzD,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;oBACjC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAED,sBAAsB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACvF,CAAC;IAEO,kBAAkB;QACxB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAClE,IACE,CAAC,MAAM;gBACP,OAAO,MAAM,KAAK,QAAQ;gBAC1B,CAAC,MAAM,CAAC,MAAM;gBACd,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,EACjC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,MAAqB,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,GAAW,EAAE,KAAkB;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEtC,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC;aAC3C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;aAClD,MAAM,CAAC,CAAC,KAAK,EAA+B,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QACvE,MAAM,cAAc,GAAG,IAAI,GAAG,EAA8B,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,cAAc;YAAE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5E,KAAK,MAAM,KAAK,IAAI,gBAAgB;YAAE,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAE9E,IAAI,GAAG,GAA2B,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC;gBACH,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,wCAAwC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,GAAG;YACtC,GAAG;YACH,MAAM,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC;YACpC,GAAG;YACH,eAAe,EAAE,KAAK,EAAE,OAAO;SAChC,CAAC;IACJ,CAAC;IAEO,kBAAkB,CAAC,GAAW;QACpC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,MAAM,GAAyB,EAAE,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;gBAAE,SAAS;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACnD,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,iBAAiB,CACvB,GAAW,EACX,KAA+B;QAE/B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,CAAC,gBAAgB;gBAAE,OAAO,SAAS,CAAC;YACxC,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC;gBACnC,MAAM,EAAE,sBAAsB,CAAC,gBAAgB,CAAC;aACjD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClE,IAAI,CAAC,gBAAgB;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChE,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC;YACnC,MAAM,EAAE,gBAAgB,IAAI,sBAAsB,CAAC,gBAAgB,CAAC;SACrE,CAAC;IACJ,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7D,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,0BAA0B,CAAC,YAAoB;IACtD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAmB;IACnD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,OAAO,SAAS,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB;IACnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9B,OAAO,oCAAoC,CAAC;IAC9C,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync } from \"fs\";\nimport { dirname, isAbsolute, join, normalize, sep } from \"path\";\nimport type { PlatformName } from \"./adapter.js\";\nimport type { SandboxConfig } from \"./sandbox.js\";\nimport { atomicWritePrivateFile } from \"./fs-atomic.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\n\nfunction sanitizeCloudflareSandboxId(value: string): string {\n  return (\n    value\n      .toLowerCase()\n      .replace(/[^a-z0-9-]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\") || \"unknown\"\n  );\n}\n\n// ── Types ──────────────────────────────────────────────────────────────────────\n\n/** Shape of workspace/vaults/vault.json */\nexport interface VaultConfig {\n  vaults: Record<string, VaultEntry>;\n}\n\n/** Per-user vault mount entry in vault.json */\nexport interface VaultMountEntry {\n  source: string;\n  target?: string;\n}\n\n/** Per-user vault entry in vault.json */\nexport interface VaultEntry {\n  displayName: string;\n  platform?: PlatformName;\n  /** Subdirs/files in vault dir to mount into sandbox (e.g. [\".gcloud\", \".ssh\", \".kube\"]) */\n  mounts?: Array<string | VaultMountEntry>;\n  /** Whether to load env file as environment variables (default: true if env file exists) */\n  envFile?: boolean;\n  /** Per-user sandbox config override */\n  sandbox?: {\n    type?: \"image\" | \"firecracker\" | \"cloudflare\" | \"host\" | \"container\" | \"docker\";\n    container?: string;\n    image?: string;\n    vmId?: string;\n    sandboxId?: string;\n    sshUser?: string;\n    sshPort?: number;\n  };\n}\n\nexport interface ResolvedVaultMount {\n  source: string;\n  target: string;\n}\n\n/** Resolved vault ready for use at runtime */\nexport interface ResolvedVault {\n  userId: string;\n  displayName: string;\n  /** Absolute path to vault directory */\n  dir: string;\n  /** Absolute mount specs */\n  mounts: ResolvedVaultMount[];\n  /** Parsed from env file */\n  env: Record<string, string>;\n  sandboxOverride?: VaultEntry[\"sandbox\"];\n}\n\nexport interface VaultManager {\n  /** Return true when a vault entry or vault directory exists for this exact key. */\n  hasEntry(key: string): boolean;\n  /** Resolve vault for a user; returns undefined when no entry exists. */\n  resolve(userId: string): ResolvedVault | undefined;\n  /** Get sandbox config with credential injection for a user */\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig;\n  /** List all configured vaults */\n  list(): ResolvedVault[];\n  /** Re-read vault.json without restart */\n  reload(): void;\n  /** Check if vault system metadata is enabled (vault.json exists) */\n  isEnabled(): boolean;\n  /**\n   * Add a vault entry and persist to disk.\n   * No-op if the key already exists (idempotent).\n   */\n  addEntry(key: string, entry: VaultEntry): void;\n  /**\n   * Ensure a vault entry has image sandbox metadata.\n   * Creates the entry when missing and upgrades existing entries that lack sandbox.type.\n   */\n  ensureImageSandboxEntry(key: string, entry: VaultEntry): void;\n  /** Merge environment variables into vaults/<key>/env and persist them to disk. */\n  upsertEnv(key: string, env: Record<string, string>): void;\n  /** Write a private file into vaults/<key>/ and ensure it is mounted into the sandbox. */\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void;\n}\n\n// ── parseEnvFile ───────────────────────────────────────────────────────────────\n\n/**\n * Parse a KEY=VALUE env file. Supports:\n * - Lines starting with # are comments\n * - Empty lines are skipped\n * - Values can be quoted with single or double quotes (quotes are stripped)\n * - No variable expansion\n * - The value is everything after the first `=` to end of line (no inline comments)\n */\nexport function parseEnvFile(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  const lines = content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\").split(\"\\n\");\n\n  for (const line of lines) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) continue;\n\n    const key = trimmed.slice(0, eqIndex).trim();\n    if (!key) continue;\n\n    let value = trimmed.slice(eqIndex + 1);\n\n    // Strip matching quotes\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n\n    env[key] = value;\n  }\n\n  return env;\n}\n\n// ── FileVaultManager ───────────────────────────────────────────────────────────\n\nexport class FileVaultManager implements VaultManager {\n  private config: VaultConfig | null = null;\n  private readonly vaultsDir: string;\n  private readonly configPath: string;\n\n  constructor(stateDir: string) {\n    this.vaultsDir = join(stateDir, \"vaults\");\n    this.configPath = join(this.vaultsDir, \"vault.json\");\n    this.reload();\n  }\n\n  reload(): void {\n    if (!existsSync(this.configPath)) {\n      this.config = null;\n      return;\n    }\n\n    try {\n      const raw = readFileSync(this.configPath, \"utf-8\");\n      const parsed = JSON.parse(raw);\n\n      if (\n        !parsed ||\n        typeof parsed !== \"object\" ||\n        !parsed.vaults ||\n        typeof parsed.vaults !== \"object\"\n      ) {\n        console.error(`vault: malformed vault.json — expected { vaults: { ... } }`);\n        this.config = null;\n        return;\n      }\n\n      this.config = parsed as VaultConfig;\n      this.warnUnsupportedSandboxTypes();\n    } catch (err) {\n      console.error(`vault: failed to read ${this.configPath}:`, err);\n      this.config = null;\n    }\n  }\n\n  /** Warn for legacy or insecure vault sandbox overrides that are no longer allowed. */\n  private warnUnsupportedSandboxTypes(): void {\n    if (!this.config) return;\n    for (const [key, entry] of Object.entries(this.config.vaults)) {\n      if (entry.sandbox?.type === \"host\") {\n        console.error(\n          `vault: \"${key}\" uses sandbox.type=host, which is blocked for credential isolation. ` +\n            \"Use sandbox.type=image, sandbox.type=firecracker, or sandbox.type=cloudflare.\",\n        );\n      }\n      if (entry.sandbox?.type === \"container\" || entry.sandbox?.type === \"docker\") {\n        console.error(\n          `vault: \"${key}\" uses sandbox.type=${entry.sandbox.type}, which is blocked for credential isolation. ` +\n            \"Use sandbox.type=image for per-user containers, sandbox.type=firecracker, or sandbox.type=cloudflare.\",\n        );\n      }\n    }\n  }\n\n  isEnabled(): boolean {\n    return this.config !== null || existsSync(this.vaultsDir);\n  }\n\n  hasEntry(key: string): boolean {\n    return !!this.config?.vaults[key] || existsSync(join(this.vaultsDir, key));\n  }\n\n  resolve(userId: string): ResolvedVault | undefined {\n    const entry = this.config?.vaults[userId];\n    const dir = join(this.vaultsDir, userId);\n    if (!entry && !existsSync(dir)) return undefined;\n    return this.buildResolved(userId, entry);\n  }\n\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig {\n    const vault = this.resolve(userId);\n    if (!vault?.sandboxOverride) {\n      if (baseConfig.type === \"cloudflare\") {\n        return {\n          type: \"cloudflare\",\n          sandboxId: `${baseConfig.sandboxId}-${sanitizeCloudflareSandboxId(userId)}`,\n        };\n      }\n      return baseConfig;\n    }\n\n    const override = vault.sandboxOverride;\n\n    if (override.type === \"image\") {\n      if (baseConfig.type !== \"image\") {\n        if (!override.container) {\n          if (baseConfig.type === \"cloudflare\") {\n            return {\n              type: \"cloudflare\",\n              sandboxId: `${baseConfig.sandboxId}-${sanitizeCloudflareSandboxId(userId)}`,\n            };\n          }\n          return baseConfig;\n        }\n        throw new Error(\n          `vault \"${userId}\" sets sandbox.type=image, but base sandbox is \"${baseConfig.type}\". ` +\n            \"Use --sandbox=image:<image> to enable managed image containers for this vault.\",\n        );\n      }\n      const container = override.container || `mama-sandbox-${userId}`;\n      return { type: \"container\", container };\n    }\n\n    if (override.type === \"firecracker\") {\n      if (!override.vmId) return baseConfig;\n      if (baseConfig.type !== \"firecracker\") {\n        throw new Error(\n          `vault \"${userId}\" sets sandbox.type=firecracker, but base sandbox is \"${baseConfig.type}\". ` +\n            \"Use --sandbox=firecracker:<vm-id>:<host-path> so /workspace stays mapped to the real workspace.\",\n        );\n      }\n      return {\n        type: \"firecracker\",\n        vmId: override.vmId,\n        hostPath: baseConfig.hostPath,\n        sshUser: override.sshUser,\n        sshPort: override.sshPort,\n      };\n    }\n\n    if (override.type === \"cloudflare\") {\n      if (!override.sandboxId) return baseConfig;\n      if (baseConfig.type !== \"cloudflare\") {\n        throw new Error(\n          `vault \"${userId}\" sets sandbox.type=cloudflare, but base sandbox is \"${baseConfig.type}\". ` +\n            \"Use --sandbox=cloudflare:<sandbox-id> to enable Cloudflare remote execution.\",\n        );\n      }\n      return {\n        type: \"cloudflare\",\n        sandboxId: override.sandboxId,\n      };\n    }\n\n    if (override.type === \"host\") {\n      throw new Error(\n        `vault \"${userId}\" uses sandbox.type=host, which is blocked for credential isolation. ` +\n          \"Use sandbox.type=image, sandbox.type=firecracker, or sandbox.type=cloudflare.\",\n      );\n    }\n\n    if (override.type === \"container\" || override.type === \"docker\") {\n      throw new Error(\n        `vault \"${userId}\" uses sandbox.type=${override.type}, which is blocked for credential isolation. ` +\n          \"Use sandbox.type=image for per-user containers, sandbox.type=firecracker, or sandbox.type=cloudflare.\",\n      );\n    }\n\n    // No type override — return base config unchanged\n    return baseConfig;\n  }\n\n  list(): ResolvedVault[] {\n    const keys = new Set<string>();\n    for (const key of Object.keys(this.config?.vaults ?? {})) {\n      keys.add(key);\n    }\n    if (existsSync(this.vaultsDir)) {\n      for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {\n        if (entry.isDirectory()) keys.add(entry.name);\n      }\n    }\n    return Array.from(keys, (key) => this.buildResolved(key, this.config?.vaults[key]));\n  }\n\n  addEntry(key: string, entry: VaultEntry): void {\n    const cfg = (this.config ??= { vaults: {} });\n    // Idempotent: skip if already exists\n    if (cfg.vaults[key]) return;\n    cfg.vaults[key] = entry;\n    this.persistConfig();\n  }\n\n  ensureImageSandboxEntry(key: string, entry: VaultEntry): void {\n    if (entry.sandbox?.type !== \"image\") {\n      throw new Error(`vault: ensureImageSandboxEntry requires sandbox.type=image for \"${key}\"`);\n    }\n\n    const cfg = (this.config ??= { vaults: {} });\n    const existing = cfg.vaults[key];\n    if (!existing) {\n      cfg.vaults[key] = entry;\n      this.persistConfig();\n      return;\n    }\n\n    let nextEntry = existing;\n    let changed = false;\n\n    if (!existing.platform && entry.platform) {\n      nextEntry = { ...nextEntry, platform: entry.platform };\n      changed = true;\n    }\n\n    const existingSandbox = existing.sandbox;\n    if (!existingSandbox?.type) {\n      nextEntry = { ...nextEntry, sandbox: entry.sandbox };\n      changed = true;\n    }\n\n    if (!changed) return;\n\n    cfg.vaults[key] = nextEntry;\n    this.persistConfig();\n  }\n\n  upsertEnv(key: string, env: Record<string, string>): void {\n    const dir = join(this.vaultsDir, key);\n    const envPath = join(dir, \"env\");\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const existing = existsSync(envPath)\n      ? parseEnvFile(readFileSync(envPath, \"utf-8\"))\n      : ({} as Record<string, string>);\n    const merged = { ...existing, ...env };\n    const content =\n      Object.entries(merged)\n        .sort(([left], [right]) => left.localeCompare(right))\n        .map(([envKey, value]) => `${envKey}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n  }\n\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void {\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    if (!normalizedPath || (targetPath !== undefined && !normalizeVaultTargetPath(targetPath))) {\n      throw new Error(`vault: invalid relative secret file path for \"${key}\": ${relativePath}`);\n    }\n\n    const dir = join(this.vaultsDir, key);\n    const filePath = join(dir, normalizedPath);\n\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const parentDir = dirname(filePath);\n    if (parentDir !== dir) ensurePrivateDir(parentDir);\n    atomicWritePrivateFile(filePath, content);\n  }\n\n  // ── private ────────────────────────────────────────────────────────────────\n\n  private persistConfig(): void {\n    ensurePrivateDir(this.vaultsDir);\n\n    // Preserve concurrent external edits: pull in any entries that appear on\n    // disk but not in our in-memory view, so a background edit (e.g. another\n    // admin adding a user) is not silently dropped by the next upsert here.\n    // Individual field edits still follow last-writer-wins per key.\n    const onDisk = this.readConfigFromDisk();\n    if (onDisk && this.config) {\n      for (const [key, entry] of Object.entries(onDisk.vaults)) {\n        if (!(key in this.config.vaults)) {\n          this.config.vaults[key] = entry;\n        }\n      }\n    }\n\n    atomicWritePrivateFile(this.configPath, JSON.stringify(this.config, null, 2) + \"\\n\");\n  }\n\n  private readConfigFromDisk(): VaultConfig | null {\n    if (!existsSync(this.configPath)) return null;\n    try {\n      const parsed = JSON.parse(readFileSync(this.configPath, \"utf-8\"));\n      if (\n        !parsed ||\n        typeof parsed !== \"object\" ||\n        !parsed.vaults ||\n        typeof parsed.vaults !== \"object\"\n      ) {\n        return null;\n      }\n      return parsed as VaultConfig;\n    } catch {\n      return null;\n    }\n  }\n\n  private buildResolved(key: string, entry?: VaultEntry): ResolvedVault {\n    const dir = join(this.vaultsDir, key);\n\n    const inferredMounts = this.inferMountsFromDir(dir);\n    const configuredMounts = (entry?.mounts ?? [])\n      .map((mount) => this.resolveMountEntry(dir, mount))\n      .filter((mount): mount is ResolvedVaultMount => mount !== undefined);\n    const mountsByTarget = new Map<string, ResolvedVaultMount>();\n    for (const mount of inferredMounts) mountsByTarget.set(mount.target, mount);\n    for (const mount of configuredMounts) mountsByTarget.set(mount.target, mount);\n\n    let env: Record<string, string> = {};\n    const envPath = join(dir, \"env\");\n    if ((entry?.envFile ?? true) && existsSync(envPath)) {\n      try {\n        env = parseEnvFile(readFileSync(envPath, \"utf-8\"));\n      } catch (err) {\n        console.error(`vault: failed to parse env file for \"${key}\":`, err);\n      }\n    }\n\n    return {\n      userId: key,\n      displayName: entry?.displayName ?? key,\n      dir,\n      mounts: [...mountsByTarget.values()],\n      env,\n      sandboxOverride: entry?.sandbox,\n    };\n  }\n\n  private inferMountsFromDir(dir: string): ResolvedVaultMount[] {\n    if (!existsSync(dir)) {\n      return [];\n    }\n\n    const mounts: ResolvedVaultMount[] = [];\n    for (const entry of readdirSync(dir, { withFileTypes: true })) {\n      if (entry.name === \"env\") continue;\n      const source = join(dir, entry.name);\n      const target = inferredVaultTargetPath(entry.name);\n      if (!target) continue;\n      mounts.push({ source, target });\n    }\n    return mounts;\n  }\n\n  private resolveMountEntry(\n    dir: string,\n    mount: string | VaultMountEntry,\n  ): ResolvedVaultMount | undefined {\n    if (typeof mount === \"string\") {\n      const normalizedSource = normalizeVaultRelativePath(mount);\n      if (!normalizedSource) return undefined;\n      return {\n        source: join(dir, normalizedSource),\n        target: defaultVaultTargetPath(normalizedSource),\n      };\n    }\n\n    if (!mount || typeof mount !== \"object\") return undefined;\n    const normalizedSource = normalizeVaultRelativePath(mount.source);\n    if (!normalizedSource) return undefined;\n    const normalizedTarget = normalizeVaultTargetPath(mount.target);\n    return {\n      source: join(dir, normalizedSource),\n      target: normalizedTarget ?? defaultVaultTargetPath(normalizedSource),\n    };\n  }\n}\n\nfunction ensurePrivateDir(path: string): void {\n  mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });\n  chmodSync(path, PRIVATE_DIR_MODE);\n}\n\nfunction normalizeVaultRelativePath(relativePath: string): string | undefined {\n  const trimmed = relativePath.trim();\n  if (!trimmed || isAbsolute(trimmed)) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  if (!normalized || normalized === \".\" || normalized === \"..\" || normalized.startsWith(\"../\")) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction normalizeVaultTargetPath(targetPath?: string): string | undefined {\n  if (targetPath === undefined) {\n    return undefined;\n  }\n\n  const trimmed = targetPath.trim();\n  if (!trimmed || !trimmed.startsWith(\"/\")) {\n    return undefined;\n  }\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  return normalized.startsWith(\"/\") ? normalized : undefined;\n}\n\nexport function defaultVaultTargetPath(relativePath: string): string {\n  const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\\/+/, \"\");\n  return `/root/${normalized}`;\n}\n\nfunction inferredVaultTargetPath(relativePath: string): string | undefined {\n  const normalized = normalizeVaultRelativePath(relativePath);\n  if (!normalized) return undefined;\n\n  if (normalized === \"gws.json\") {\n    return \"/root/.config/gws/credentials.json\";\n  }\n  if (normalized === \".ssh\" || normalized.startsWith(\".ssh/\")) {\n    return \"/root/.ssh\";\n  }\n  if (normalized === \".kube\" || normalized.startsWith(\".kube/\")) {\n    return \"/root/.kube\";\n  }\n  if (normalized === \".config/gh\" || normalized.startsWith(\".config/gh/\")) {\n    return \"/root/.config/gh\";\n  }\n\n  return defaultVaultTargetPath(normalized);\n}\n"]}
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,gBAAgB,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAa;IAChD,OAAO,CACL,KAAK;SACF,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,SAAS,CACxC,CAAC;AACJ,CAAC;AA+CD,kFAAkF;AAElF;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE9E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAEvC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kFAAkF;AAElF,MAAM,OAAO,gBAAgB;IAG3B,YAAY,QAAgB;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,SAAS;QACP,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,gBAAgB;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACnD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;aAC7F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,iBAAiB,CAAC,IAAY;QAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iBAAiB,CACf,IAAY,EACZ,SAAiB;QAEjB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,kBAAkB,CAAC,CAAC;QAE5F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5B,OAAO,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,gBAAgB,CAAC,MAAc,EAAE,UAAyB;QACxD,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACrC,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,SAAS,EAAE,GAAG,UAAU,CAAC,SAAS,IAAI,2BAA2B,CAAC,MAAM,CAAC,EAAE;aAC5E,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,GAAW,EAAE,GAA2B;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC;QACvC,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;aAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,UAAU,CAAC,GAAW,EAAE,YAAoB,EAAE,OAAe,EAAE,UAAmB;QAChF,MAAM,cAAc,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,MAAM,YAAY,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAE3C,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,GAAG;YAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,8EAA8E;IAEtE,aAAa,CAAC,GAAW;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,GAAG,GAA2B,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,wCAAwC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;YACtE,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,GAAG;YAChB,GAAG;YACH,MAAM;YACN,GAAG;SACJ,CAAC;IACJ,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7D,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CACnB,SAAiB,EACjB,SAAiB;IAKjB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC;YAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;iBACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;iBACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;iBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACvB,sBAAsB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC5C,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;YAC/C,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YACpD,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;YAClC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC;YACtC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACrC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7B,WAAW,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,0BAA0B,CAAC,YAAoB;IACtD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAmB;IACnD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE3D,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,OAAO,SAAS,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB;IACnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9B,OAAO,oCAAoC,CAAC;IAC9C,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, rmSync } from \"fs\";\nimport { dirname, isAbsolute, join, normalize, sep } from \"path\";\nimport { readTextFileIfExists } from \"./file-guards.js\";\nimport type { SandboxConfig } from \"./sandbox.js\";\nimport { atomicWritePrivateFile } from \"./fs-atomic.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst SHARED_VAULT_DIR = \"shared\";\n\nexport function normalizeSharedVaultName(name: string): string | undefined {\n  const trimmed = name.trim();\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(trimmed)) return undefined;\n  return trimmed;\n}\n\nexport function sharedVaultKey(name: string): string | undefined {\n  const normalized = normalizeSharedVaultName(name);\n  return normalized ? `${SHARED_VAULT_DIR}/${normalized}` : undefined;\n}\n\nfunction sanitizeCloudflareSandboxId(value: string): string {\n  return (\n    value\n      .toLowerCase()\n      .replace(/[^a-z0-9-]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\") || \"unknown\"\n  );\n}\n\n// ── Types ──────────────────────────────────────────────────────────────────────\n\nexport interface ResolvedVaultMount {\n  source: string;\n  target: string;\n}\n\n/** Resolved vault ready for use at runtime */\nexport interface ResolvedVault {\n  userId: string;\n  displayName: string;\n  /** Absolute path to vault directory */\n  dir: string;\n  /** Absolute mount specs */\n  mounts: ResolvedVaultMount[];\n  /** Parsed from env file */\n  env: Record<string, string>;\n}\n\nexport interface VaultManager {\n  /** Return true when a vault directory exists for this exact key. */\n  hasEntry(key: string): boolean;\n  /** Resolve vault for a user; returns undefined when no directory exists. */\n  resolve(userId: string): ResolvedVault | undefined;\n  /** Get sandbox config with credential injection for a user */\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig;\n  /** List all vaults discovered under vaults/. */\n  list(): ResolvedVault[];\n  /** Check if the vaults directory exists. */\n  isEnabled(): boolean;\n  /** Merge environment variables into vaults/<key>/env and persist them to disk. */\n  upsertEnv(key: string, env: Record<string, string>): void;\n  /** Write a private file into vaults/<key>/ and ensure it is mounted into the sandbox. */\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void;\n  /** List named shared login profiles under vaults/shared/. */\n  listSharedVaults(): string[];\n  /** Delete a shared login profile's directory. Returns true when it existed. */\n  deleteSharedVault(name: string): boolean;\n  /** Copy a shared login profile's files into another vault directory. */\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number };\n}\n\n// ── parseEnvFile ───────────────────────────────────────────────────────────────\n\n/**\n * Parse a KEY=VALUE env file. Supports:\n * - Lines starting with # are comments\n * - Empty lines are skipped\n * - Values can be quoted with single or double quotes (quotes are stripped)\n * - No variable expansion\n * - The value is everything after the first `=` to end of line (no inline comments)\n */\nexport function parseEnvFile(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  const lines = content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\").split(\"\\n\");\n\n  for (const line of lines) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) continue;\n\n    const key = trimmed.slice(0, eqIndex).trim();\n    if (!key) continue;\n\n    let value = trimmed.slice(eqIndex + 1);\n\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n\n    env[key] = value;\n  }\n\n  return env;\n}\n\n// ── FileVaultManager ───────────────────────────────────────────────────────────\n\nexport class FileVaultManager implements VaultManager {\n  private readonly vaultsDir: string;\n\n  constructor(stateDir: string) {\n    this.vaultsDir = join(stateDir, \"vaults\");\n  }\n\n  isEnabled(): boolean {\n    return existsSync(this.vaultsDir);\n  }\n\n  hasEntry(key: string): boolean {\n    return existsSync(join(this.vaultsDir, key));\n  }\n\n  listSharedVaults(): string[] {\n    const sharedDir = join(this.vaultsDir, SHARED_VAULT_DIR);\n    if (!existsSync(sharedDir)) return [];\n    return readdirSync(sharedDir, { withFileTypes: true })\n      .filter((entry) => entry.isDirectory() && normalizeSharedVaultName(entry.name) === entry.name)\n      .map((entry) => entry.name)\n      .toSorted((left, right) => left.localeCompare(right));\n  }\n\n  deleteSharedVault(name: string): boolean {\n    const key = sharedVaultKey(name);\n    if (!key) throw new Error(`vault: invalid shared login name: ${name}`);\n    const dir = join(this.vaultsDir, key);\n    const existed = existsSync(dir);\n    rmSync(dir, { recursive: true, force: true });\n    return existed;\n  }\n\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number } {\n    const sourceKey = sharedVaultKey(name);\n    if (!sourceKey) throw new Error(`vault: invalid shared login name: ${name}`);\n    const sourceDir = join(this.vaultsDir, sourceKey);\n    if (!existsSync(sourceDir)) throw new Error(`vault: shared login \"${name}\" does not exist`);\n\n    const targetDir = join(this.vaultsDir, targetKey);\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(targetDir);\n    return copyVaultDir(sourceDir, targetDir);\n  }\n\n  resolve(userId: string): ResolvedVault | undefined {\n    const dir = join(this.vaultsDir, userId);\n    if (!existsSync(dir)) return undefined;\n    return this.buildResolved(userId);\n  }\n\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig {\n    if (baseConfig.type === \"cloudflare\") {\n      return {\n        type: \"cloudflare\",\n        sandboxId: `${baseConfig.sandboxId}-${sanitizeCloudflareSandboxId(userId)}`,\n      };\n    }\n    return baseConfig;\n  }\n\n  list(): ResolvedVault[] {\n    if (!existsSync(this.vaultsDir)) return [];\n    const keys = new Set<string>();\n    for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {\n      if (entry.isDirectory()) keys.add(entry.name);\n    }\n    return Array.from(keys, (key) => this.buildResolved(key));\n  }\n\n  upsertEnv(key: string, env: Record<string, string>): void {\n    const dir = join(this.vaultsDir, key);\n    const envPath = join(dir, \"env\");\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const existingContent = readTextFileIfExists(envPath);\n    const existing = existingContent ? parseEnvFile(existingContent) : {};\n    const merged = { ...existing, ...env };\n    const content =\n      Object.entries(merged)\n        .toSorted(([left], [right]) => left.localeCompare(right))\n        .map(([envKey, value]) => `${envKey}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n  }\n\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void {\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    if (!normalizedPath || (targetPath !== undefined && !normalizeVaultTargetPath(targetPath))) {\n      throw new Error(`vault: invalid relative secret file path for \"${key}\": ${relativePath}`);\n    }\n\n    const dir = join(this.vaultsDir, key);\n    const filePath = join(dir, normalizedPath);\n\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const parentDir = dirname(filePath);\n    if (parentDir !== dir) ensurePrivateDir(parentDir);\n    atomicWritePrivateFile(filePath, content);\n  }\n\n  // ── private ────────────────────────────────────────────────────────────────\n\n  private buildResolved(key: string): ResolvedVault {\n    const dir = join(this.vaultsDir, key);\n    const mounts = inferMountsFromDir(dir);\n\n    let env: Record<string, string> = {};\n    const envContent = readTextFileIfExists(join(dir, \"env\"));\n    if (envContent !== undefined) {\n      try {\n        env = parseEnvFile(envContent);\n      } catch (err) {\n        console.error(`vault: failed to parse env file for \"${key}\":`, err);\n      }\n    }\n\n    return {\n      userId: key,\n      displayName: key,\n      dir,\n      mounts,\n      env,\n    };\n  }\n}\n\nfunction inferMountsFromDir(dir: string): ResolvedVaultMount[] {\n  if (!existsSync(dir)) return [];\n\n  const mounts: ResolvedVaultMount[] = [];\n  for (const entry of readdirSync(dir, { withFileTypes: true })) {\n    if (entry.name === \"env\") continue;\n    const source = join(dir, entry.name);\n    const target = inferredVaultTargetPath(entry.name);\n    if (!target) continue;\n    mounts.push({ source, target });\n  }\n  return mounts;\n}\n\nfunction ensurePrivateDir(path: string): void {\n  mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });\n  chmodSync(path, PRIVATE_DIR_MODE);\n}\n\nfunction copyVaultDir(\n  sourceDir: string,\n  targetDir: string,\n): {\n  filesCopied: number;\n  envKeysCopied: number;\n} {\n  let filesCopied = 0;\n  let envKeysCopied = 0;\n\n  for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {\n    const sourcePath = join(sourceDir, entry.name);\n    const targetPath = join(targetDir, entry.name);\n\n    if (entry.name === \"env\" && entry.isFile()) {\n      const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? \"\");\n      const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? \"\");\n      const merged = { ...targetEnv, ...sourceEnv };\n      const content =\n        Object.entries(merged)\n          .toSorted(([left], [right]) => left.localeCompare(right))\n          .map(([envKey, value]) => `${envKey}=${value}`)\n          .join(\"\\n\") + \"\\n\";\n      atomicWritePrivateFile(targetPath, content);\n      envKeysCopied += Object.keys(sourceEnv).length;\n      continue;\n    }\n\n    if (entry.isDirectory()) {\n      ensurePrivateDir(targetPath);\n      const nested = copyVaultDir(sourcePath, targetPath);\n      filesCopied += nested.filesCopied;\n      envKeysCopied += nested.envKeysCopied;\n      continue;\n    }\n\n    if (!entry.isFile()) continue;\n    copyFileSync(sourcePath, targetPath);\n    chmodSync(targetPath, 0o600);\n    filesCopied++;\n  }\n\n  return { filesCopied, envKeysCopied };\n}\n\nfunction normalizeVaultRelativePath(relativePath: string): string | undefined {\n  const trimmed = relativePath.trim();\n  if (!trimmed || isAbsolute(trimmed)) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  if (!normalized || normalized === \".\" || normalized === \"..\" || normalized.startsWith(\"../\")) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction normalizeVaultTargetPath(targetPath?: string): string | undefined {\n  if (targetPath === undefined) return undefined;\n\n  const trimmed = targetPath.trim();\n  if (!trimmed || !trimmed.startsWith(\"/\")) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  return normalized.startsWith(\"/\") ? normalized : undefined;\n}\n\nexport function defaultVaultTargetPath(relativePath: string): string {\n  const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\\/+/, \"\");\n  return `/root/${normalized}`;\n}\n\nfunction inferredVaultTargetPath(relativePath: string): string | undefined {\n  const normalized = normalizeVaultRelativePath(relativePath);\n  if (!normalized) return undefined;\n\n  if (normalized === \"gws.json\") {\n    return \"/root/.config/gws/credentials.json\";\n  }\n  if (normalized === \".ssh\" || normalized.startsWith(\".ssh/\")) {\n    return \"/root/.ssh\";\n  }\n  if (normalized === \".kube\" || normalized.startsWith(\".kube/\")) {\n    return \"/root/.kube\";\n  }\n  if (normalized === \".config/gh\" || normalized.startsWith(\".config/gh/\")) {\n    return \"/root/.config/gh\";\n  }\n\n  return defaultVaultTargetPath(normalized);\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geminixiang/mama",
-  "version": "0.2.0-beta.7",
+  "version": "0.2.0-beta.9",
   "description": "Multi-Agent Mischief Assistant for Slack, Telegram, and Discord",
   "keywords": [
     "agent",
@@ -52,10 +52,12 @@
     "diff": "^8.0.4",
     "discord.js": "^14.26.2",
     "grammy": "^1.42.0",
+    "markdown-it": "^14.1.1",
     "pino": "^10.3.1"
   },
   "devDependencies": {
     "@types/diff": "^8.0.0",
+    "@types/markdown-it": "^14.1.2",
     "@types/node": "^25.5.0",
     "@typescript/native-preview": "7.0.0-dev.20260328.1",
     "husky": "^9.1.7",

package/dist/bindings.d.ts

@@ -1,45 +0,0 @@
-import type { PlatformName } from "./adapter.js";
-export interface UserBinding {
-    platform: PlatformName;
-    platformUserId: string;
-    /** Internal identity (matches vault key in vault.json, or a backend user ID) */
-    internalUserId: string;
-    /** Key in vault.json that holds this user's credentials */
-    vaultId: string;
-    /** Optional future field for explicit execution target override */
-    executionTargetId?: string;
-    status: "pending" | "active" | "revoked";
-    createdAt: string;
-    updatedAt: string;
-}
-export interface BindingsConfig {
-    bindings: UserBinding[];
-}
-export interface UserBindingStore {
-    /** Resolve active binding for a platform user; returns undefined if not found or revoked */
-    resolve(platform: string, platformUserId: string): UserBinding | undefined;
-    /** List all bindings */
-    list(): UserBinding[];
-    /** Upsert a binding (insert or update by platform + platformUserId) */
-    upsert(binding: UserBinding): void;
-    /** Revoke a binding by setting status to "revoked" */
-    revoke(platform: string, platformUserId: string): void;
-    /** Re-read bindings.json from disk */
-    reload(): void;
-    /** Whether bindings.json exists and was loaded successfully */
-    isEnabled(): boolean;
-}
-/** File-backed binding store. Reads and writes `vaults/bindings.json`. */
-export declare class FileUserBindingStore implements UserBindingStore {
-    private config;
-    private readonly configPath;
-    constructor(stateDir: string);
-    reload(): void;
-    isEnabled(): boolean;
-    resolve(platform: string, platformUserId: string): UserBinding | undefined;
-    list(): UserBinding[];
-    upsert(binding: UserBinding): void;
-    revoke(platform: string, platformUserId: string): void;
-    private persist;
-}
-//# sourceMappingURL=bindings.d.ts.map