@geminixiang/mikan 0.3.0 → 0.3.1

package/dist/commands/session-view.js

@@ -1,27 +1,14 @@
 import { resolveExistingSessionFile } from "../session-view/service.js";
 import { parseSessionViewCommand } from "../session-view/command.js";
-import { formatCommandSummary, replyDiagnosticWithContext } from "./utils.js";
+import { formatCommandSummary, replyPrivatelyWithContext } from "./utils.js";
 export class SessionViewCommandHandler {
     async tryHandle(context) {
         if (!parseSessionViewCommand(context.commandText))
             return false;
         const sendSessionViewReply = async (lines) => {
-            const text = formatCommandSummary("Session", lines);
-            if (context.privateConversation) {
-                await replyDiagnosticWithContext(context.responseCtx, text, { style: "muted" });
-                return;
-            }
-            if (context.bot.postPrivateDiagnostic) {
-                await context.bot.postPrivateDiagnostic(context.conversationId, context.platformUserId, text, {
-                    style: "muted",
-                });
-                return;
-            }
-            if (context.bot.postPrivate) {
-                await context.bot.postPrivate(context.conversationId, context.platformUserId, text);
-                return;
-            }
-            await replyDiagnosticWithContext(context.responseCtx, text, { style: "muted" });
+            await replyPrivatelyWithContext(context, formatCommandSummary("Session", lines), {
+                style: "muted",
+            });
         };
         if (!context.privateConversation && !context.bot.postPrivate) {
             await sendSessionViewReply([

package/dist/commands/session-view.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-view.js","sourceRoot":"","sources":["../../src/commands/session-view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,OAAO,yBAAyB;IACpC,KAAK,CAAC,SAAS,CAAC,OAAuB;QACrC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QAEhE,MAAM,oBAAoB,GAAG,KAAK,EAAE,KAAe,EAAiB,EAAE;YACpE,MAAM,IAAI,GAAG,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;gBAChC,MAAM,0BAA0B,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;gBACtC,MAAM,OAAO,CAAC,GAAG,CAAC,qBAAqB,CACrC,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,cAAc,EACtB,IAAI,EACJ;oBACE,KAAK,EAAE,OAAO;iBACf,CACF,CAAC;gBACF,OAAO;YACT,CAAC;YAED,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBAC5B,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;gBACpF,OAAO;YACT,CAAC;YAED,MAAM,0BAA0B,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAClF,CAAC,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAC7D,MAAM,oBAAoB,CAAC;gBACzB,4CAA4C;aAC7C,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,oBAAoB,CAAC;gBACzB,mCAAmC;gBACnC,0DAA0D;aAC3D,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,0BAA0B,CAC5C,OAAO,CAAC,QAAQ,CAAC,UAAU,EAC3B,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,UAAU,CACnB,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,oBAAoB,CAAC;gBACzB,oBAAoB;gBACpB,2BAA2B;aAC5B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG;aAC7B,eAAe,EAAE;aACjB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,YAAY,EAAE,QAAQ,IAAI,YAAY,EAAE,WAAW,CAAC;QAE7E,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,MAAM,CACzD,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,UAAU,EAClB,WAAW,EACX,gBAAgB,CACjB,CAAC;QAEF,MAAM,oBAAoB,CAAC;YACzB,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,kBAAkB,KAAK,CAAC,KAAK,EAAE;YAChE,mBAAmB;SACpB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF","sourcesContent":["import { resolveExistingSessionFile } from \"../session-view/service.js\";\nimport { parseSessionViewCommand } from \"../session-view/command.js\";\nimport type { CommandContext, CommandHandler } from \"./types.js\";\nimport { formatCommandSummary, replyDiagnosticWithContext } from \"./utils.js\";\n\nexport class SessionViewCommandHandler implements CommandHandler {\n  async tryHandle(context: CommandContext): Promise<boolean> {\n    if (!parseSessionViewCommand(context.commandText)) return false;\n\n    const sendSessionViewReply = async (lines: string[]): Promise<void> => {\n      const text = formatCommandSummary(\"Session\", lines);\n      if (context.privateConversation) {\n        await replyDiagnosticWithContext(context.responseCtx, text, { style: \"muted\" });\n        return;\n      }\n\n      if (context.bot.postPrivateDiagnostic) {\n        await context.bot.postPrivateDiagnostic(\n          context.conversationId,\n          context.platformUserId,\n          text,\n          {\n            style: \"muted\",\n          },\n        );\n        return;\n      }\n\n      if (context.bot.postPrivate) {\n        await context.bot.postPrivate(context.conversationId, context.platformUserId, text);\n        return;\n      }\n\n      await replyDiagnosticWithContext(context.responseCtx, text, { style: \"muted\" });\n    };\n\n    if (!context.privateConversation && !context.bot.postPrivate) {\n      await sendSessionViewReply([\n        \"為了保護對話內容，`/session` 目前只能在與機器人的私訊 / DM 中使用。\",\n      ]);\n      return true;\n    }\n\n    if (!context.services.portalBaseUrl) {\n      await sendSessionViewReply([\n        \"Session viewer is not configured.\",\n        \"Set `MIKAN_LINK_URL` or `MIKAN_LINK_PORT` on the server.\",\n      ]);\n      return true;\n    }\n\n    const sessionFile = resolveExistingSessionFile(\n      context.services.workingDir,\n      context.conversationId,\n      context.sessionKey,\n    );\n    if (!sessionFile) {\n      await sendSessionViewReply([\n        \"目前還沒有可查看的 session。\",\n        \"先和機器人對話一次，建立 session 後再試。\",\n      ]);\n      return true;\n    }\n\n    const platformUser = context.bot\n      .getPlatformInfo()\n      .users.find((user) => user.id === context.platformUserId);\n    const platformUserName = platformUser?.userName || platformUser?.displayName;\n\n    const token = context.services.sessionViewTokenStore.create(\n      context.platform,\n      context.platformUserId,\n      context.conversationId,\n      context.sessionKey,\n      sessionFile,\n      platformUserName,\n    );\n\n    await sendSessionViewReply([\n      `${context.services.portalBaseUrl}/session?token=${token.token}`,\n      \"Expires: 24 hours\",\n    ]);\n    return true;\n  }\n}\n"]}
+{"version":3,"file":"session-view.js","sourceRoot":"","sources":["../../src/commands/session-view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,0BAA0B,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAC;AAErE,OAAO,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE7E,MAAM,OAAO,yBAAyB;IACpC,KAAK,CAAC,SAAS,CAAC,OAAuB;QACrC,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,WAAW,CAAC;YAAE,OAAO,KAAK,CAAC;QAEhE,MAAM,oBAAoB,GAAG,KAAK,EAAE,KAAe,EAAiB,EAAE;YACpE,MAAM,yBAAyB,CAAC,OAAO,EAAE,oBAAoB,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE;gBAC/E,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAC7D,MAAM,oBAAoB,CAAC;gBACzB,4CAA4C;aAC7C,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;YACpC,MAAM,oBAAoB,CAAC;gBACzB,mCAAmC;gBACnC,0DAA0D;aAC3D,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,0BAA0B,CAC5C,OAAO,CAAC,QAAQ,CAAC,UAAU,EAC3B,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,UAAU,CACnB,CAAC;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,oBAAoB,CAAC;gBACzB,oBAAoB;gBACpB,2BAA2B;aAC5B,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG;aAC7B,eAAe,EAAE;aACjB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5D,MAAM,gBAAgB,GAAG,YAAY,EAAE,QAAQ,IAAI,YAAY,EAAE,WAAW,CAAC;QAE7E,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAC,MAAM,CACzD,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,UAAU,EAClB,WAAW,EACX,gBAAgB,CACjB,CAAC;QAEF,MAAM,oBAAoB,CAAC;YACzB,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa,kBAAkB,KAAK,CAAC,KAAK,EAAE;YAChE,mBAAmB;SACpB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;CACF","sourcesContent":["import { resolveExistingSessionFile } from \"../session-view/service.js\";\nimport { parseSessionViewCommand } from \"../session-view/command.js\";\nimport type { CommandContext, CommandHandler } from \"./types.js\";\nimport { formatCommandSummary, replyPrivatelyWithContext } from \"./utils.js\";\n\nexport class SessionViewCommandHandler implements CommandHandler {\n  async tryHandle(context: CommandContext): Promise<boolean> {\n    if (!parseSessionViewCommand(context.commandText)) return false;\n\n    const sendSessionViewReply = async (lines: string[]): Promise<void> => {\n      await replyPrivatelyWithContext(context, formatCommandSummary(\"Session\", lines), {\n        style: \"muted\",\n      });\n    };\n\n    if (!context.privateConversation && !context.bot.postPrivate) {\n      await sendSessionViewReply([\n        \"為了保護對話內容，`/session` 目前只能在與機器人的私訊 / DM 中使用。\",\n      ]);\n      return true;\n    }\n\n    if (!context.services.portalBaseUrl) {\n      await sendSessionViewReply([\n        \"Session viewer is not configured.\",\n        \"Set `MIKAN_LINK_URL` or `MIKAN_LINK_PORT` on the server.\",\n      ]);\n      return true;\n    }\n\n    const sessionFile = resolveExistingSessionFile(\n      context.services.workingDir,\n      context.conversationId,\n      context.sessionKey,\n    );\n    if (!sessionFile) {\n      await sendSessionViewReply([\n        \"目前還沒有可查看的 session。\",\n        \"先和機器人對話一次，建立 session 後再試。\",\n      ]);\n      return true;\n    }\n\n    const platformUser = context.bot\n      .getPlatformInfo()\n      .users.find((user) => user.id === context.platformUserId);\n    const platformUserName = platformUser?.userName || platformUser?.displayName;\n\n    const token = context.services.sessionViewTokenStore.create(\n      context.platform,\n      context.platformUserId,\n      context.conversationId,\n      context.sessionKey,\n      sessionFile,\n      platformUserName,\n    );\n\n    await sendSessionViewReply([\n      `${context.services.portalBaseUrl}/session?token=${token.token}`,\n      \"Expires: 24 hours\",\n    ]);\n    return true;\n  }\n}\n"]}

package/dist/commands/types.d.ts

@@ -3,7 +3,7 @@ import type { DockerContainerManager } from "../provisioner.js";
 import type { SessionRuntime } from "../runtime/session-runtime.js";
 import type { SandboxConfig } from "../sandbox/index.js";
 import type { VaultManager } from "../vault.js";
-export interface LinkTokenStoreLike {
+interface LinkTokenStoreLike {
     create(platform: PlatformName, platformUserId: string, conversationId: string, vaultId: string, providerId: string): {
         token: string;
     };
@@ -13,7 +13,7 @@ export interface SessionViewTokenStoreLike {
         token: string;
     };
 }
-export interface AdminTokenStoreLike {
+interface AdminTokenStoreLike {
     create(args: {
         platform: PlatformName;
         platformUserId: string;
@@ -49,4 +49,5 @@ export interface CommandContext {
 export interface CommandHandler {
     tryHandle(context: CommandContext): Promise<boolean>;
 }
+export {};
 //# sourceMappingURL=types.d.ts.map

package/dist/commands/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/commands/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,kBAAkB;IACjC,MAAM,CACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,CACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,gBAAgB,CAAC,EAAE,MAAM,GACxB;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,YAAY,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,EAAE,yBAAyB,CAAC;IACjD,eAAe,EAAE,mBAAmB,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,GAAG,CAAC;IACT,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACxC,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD","sourcesContent":["import type { Bot, BotAdapters, PlatformName } from \"../adapter.js\";\nimport type { DockerContainerManager } from \"../provisioner.js\";\nimport type { SessionRuntime } from \"../runtime/session-runtime.js\";\nimport type { SandboxConfig } from \"../sandbox/index.js\";\nimport type { VaultManager } from \"../vault.js\";\n\nexport interface LinkTokenStoreLike {\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    vaultId: string,\n    providerId: string,\n  ): { token: string };\n}\n\nexport interface SessionViewTokenStoreLike {\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    sessionKey: string,\n    sessionFile: string,\n    platformUserName?: string,\n  ): { token: string };\n}\n\nexport interface AdminTokenStoreLike {\n  create(args: {\n    platform: PlatformName;\n    platformUserId: string;\n    conversationId: string;\n    platformUserName?: string;\n  }): { token: string };\n}\n\nexport interface CommandServices {\n  workingDir: string;\n  runtime?: SessionRuntime;\n  sandbox: SandboxConfig;\n  vaultManager: VaultManager;\n  provisioner?: DockerContainerManager;\n  linkTokenStore: LinkTokenStoreLike;\n  sessionViewTokenStore: SessionViewTokenStoreLike;\n  adminTokenStore: AdminTokenStoreLike;\n  portalBaseUrl?: string;\n}\n\nexport interface CommandContext {\n  bot: Bot;\n  responseCtx: BotAdapters[\"responseCtx\"];\n  platform: PlatformName;\n  platformUserId: string;\n  conversationId: string;\n  vaultConversationId?: string;\n  sessionKey: string;\n  commandText: string;\n  privateConversation: boolean;\n  services: CommandServices;\n}\n\nexport interface CommandHandler {\n  tryHandle(context: CommandContext): Promise<boolean>;\n}\n"]}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/commands/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACpE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,UAAU,kBAAkB;IAC1B,MAAM,CACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,CACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,gBAAgB,CAAC,EAAE,MAAM,GACxB;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtB;AAED,UAAU,mBAAmB;IAC3B,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,YAAY,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,cAAc,CAAC;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,CAAC,EAAE,sBAAsB,CAAC;IACrC,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,EAAE,yBAAyB,CAAC;IACjD,eAAe,EAAE,mBAAmB,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,GAAG,CAAC;IACT,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACxC,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,QAAQ,EAAE,eAAe,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD","sourcesContent":["import type { Bot, BotAdapters, PlatformName } from \"../adapter.js\";\nimport type { DockerContainerManager } from \"../provisioner.js\";\nimport type { SessionRuntime } from \"../runtime/session-runtime.js\";\nimport type { SandboxConfig } from \"../sandbox/index.js\";\nimport type { VaultManager } from \"../vault.js\";\n\ninterface LinkTokenStoreLike {\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    vaultId: string,\n    providerId: string,\n  ): { token: string };\n}\n\nexport interface SessionViewTokenStoreLike {\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    sessionKey: string,\n    sessionFile: string,\n    platformUserName?: string,\n  ): { token: string };\n}\n\ninterface AdminTokenStoreLike {\n  create(args: {\n    platform: PlatformName;\n    platformUserId: string;\n    conversationId: string;\n    platformUserName?: string;\n  }): { token: string };\n}\n\nexport interface CommandServices {\n  workingDir: string;\n  runtime?: SessionRuntime;\n  sandbox: SandboxConfig;\n  vaultManager: VaultManager;\n  provisioner?: DockerContainerManager;\n  linkTokenStore: LinkTokenStoreLike;\n  sessionViewTokenStore: SessionViewTokenStoreLike;\n  adminTokenStore: AdminTokenStoreLike;\n  portalBaseUrl?: string;\n}\n\nexport interface CommandContext {\n  bot: Bot;\n  responseCtx: BotAdapters[\"responseCtx\"];\n  platform: PlatformName;\n  platformUserId: string;\n  conversationId: string;\n  vaultConversationId?: string;\n  sessionKey: string;\n  commandText: string;\n  privateConversation: boolean;\n  services: CommandServices;\n}\n\nexport interface CommandHandler {\n  tryHandle(context: CommandContext): Promise<boolean>;\n}\n"]}

package/dist/commands/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/commands/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Bot, BotAdapters, PlatformName } from \"../adapter.js\";\nimport type { DockerContainerManager } from \"../provisioner.js\";\nimport type { SessionRuntime } from \"../runtime/session-runtime.js\";\nimport type { SandboxConfig } from \"../sandbox/index.js\";\nimport type { VaultManager } from \"../vault.js\";\n\nexport interface LinkTokenStoreLike {\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    vaultId: string,\n    providerId: string,\n  ): { token: string };\n}\n\nexport interface SessionViewTokenStoreLike {\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    sessionKey: string,\n    sessionFile: string,\n    platformUserName?: string,\n  ): { token: string };\n}\n\nexport interface AdminTokenStoreLike {\n  create(args: {\n    platform: PlatformName;\n    platformUserId: string;\n    conversationId: string;\n    platformUserName?: string;\n  }): { token: string };\n}\n\nexport interface CommandServices {\n  workingDir: string;\n  runtime?: SessionRuntime;\n  sandbox: SandboxConfig;\n  vaultManager: VaultManager;\n  provisioner?: DockerContainerManager;\n  linkTokenStore: LinkTokenStoreLike;\n  sessionViewTokenStore: SessionViewTokenStoreLike;\n  adminTokenStore: AdminTokenStoreLike;\n  portalBaseUrl?: string;\n}\n\nexport interface CommandContext {\n  bot: Bot;\n  responseCtx: BotAdapters[\"responseCtx\"];\n  platform: PlatformName;\n  platformUserId: string;\n  conversationId: string;\n  vaultConversationId?: string;\n  sessionKey: string;\n  commandText: string;\n  privateConversation: boolean;\n  services: CommandServices;\n}\n\nexport interface CommandHandler {\n  tryHandle(context: CommandContext): Promise<boolean>;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/commands/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { Bot, BotAdapters, PlatformName } from \"../adapter.js\";\nimport type { DockerContainerManager } from \"../provisioner.js\";\nimport type { SessionRuntime } from \"../runtime/session-runtime.js\";\nimport type { SandboxConfig } from \"../sandbox/index.js\";\nimport type { VaultManager } from \"../vault.js\";\n\ninterface LinkTokenStoreLike {\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    vaultId: string,\n    providerId: string,\n  ): { token: string };\n}\n\nexport interface SessionViewTokenStoreLike {\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    sessionKey: string,\n    sessionFile: string,\n    platformUserName?: string,\n  ): { token: string };\n}\n\ninterface AdminTokenStoreLike {\n  create(args: {\n    platform: PlatformName;\n    platformUserId: string;\n    conversationId: string;\n    platformUserName?: string;\n  }): { token: string };\n}\n\nexport interface CommandServices {\n  workingDir: string;\n  runtime?: SessionRuntime;\n  sandbox: SandboxConfig;\n  vaultManager: VaultManager;\n  provisioner?: DockerContainerManager;\n  linkTokenStore: LinkTokenStoreLike;\n  sessionViewTokenStore: SessionViewTokenStoreLike;\n  adminTokenStore: AdminTokenStoreLike;\n  portalBaseUrl?: string;\n}\n\nexport interface CommandContext {\n  bot: Bot;\n  responseCtx: BotAdapters[\"responseCtx\"];\n  platform: PlatformName;\n  platformUserId: string;\n  conversationId: string;\n  vaultConversationId?: string;\n  sessionKey: string;\n  commandText: string;\n  privateConversation: boolean;\n  services: CommandServices;\n}\n\nexport interface CommandHandler {\n  tryHandle(context: CommandContext): Promise<boolean>;\n}\n"]}

package/dist/commands/utils.d.ts

@@ -1,9 +1,11 @@
 import type { BotEvent } from "../adapter.js";
 import type { CommandContext } from "./types.js";
-export declare function replyWithContext(responseCtx: CommandContext["responseCtx"], text: string): Promise<void>;
 export declare function replyDiagnosticWithContext(responseCtx: CommandContext["responseCtx"], text: string, options?: {
     style?: "muted" | "error";
 }): Promise<void>;
+export declare function replyPrivatelyWithContext(context: CommandContext, text: string, options?: {
+    style?: "muted" | "error";
+}): Promise<void>;
 export declare function formatCommandSummary(title: string, lines: string[]): string;
 export declare function isPrivateConversation(event: BotEvent): boolean;
 //# sourceMappingURL=utils.d.ts.map

package/dist/commands/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/commands/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,cAAc,CAAC,aAAa,CAAC,EAC1C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,cAAc,CAAC,aAAa,CAAC,EAC1C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;CAAE,GACtC,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAK3E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAI9D","sourcesContent":["import type { BotEvent } from \"../adapter.js\";\nimport type { CommandContext } from \"./types.js\";\n\nexport async function replyWithContext(\n  responseCtx: CommandContext[\"responseCtx\"],\n  text: string,\n): Promise<void> {\n  await responseCtx.setTyping(false);\n  await responseCtx.setWorking(false);\n  await responseCtx.respond(text);\n}\n\nexport async function replyDiagnosticWithContext(\n  responseCtx: CommandContext[\"responseCtx\"],\n  text: string,\n  options?: { style?: \"muted\" | \"error\" },\n): Promise<void> {\n  await responseCtx.setTyping(false);\n  await responseCtx.setWorking(false);\n  await responseCtx.respondDiagnostic(text, options);\n}\n\nexport function formatCommandSummary(title: string, lines: string[]): string {\n  const nonEmpty = lines.filter((line) => line.trim().length > 0);\n  const compactLines =\n    nonEmpty.length <= 2 ? nonEmpty : [nonEmpty[0], nonEmpty.slice(1).join(\" · \")];\n  return [`_${title}_`, ...compactLines].join(\"\\n\");\n}\n\nexport function isPrivateConversation(event: BotEvent): boolean {\n  return (\n    event.conversationKind === \"direct\" || event.type === \"dm\" || event.type === \"private_command\"\n  );\n}\n"]}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/commands/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,cAAc,CAAC,aAAa,CAAC,EAC1C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;CAAE,GACtC,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAA;CAAE,GACtC,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAK3E;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAI9D","sourcesContent":["import type { BotEvent } from \"../adapter.js\";\nimport type { CommandContext } from \"./types.js\";\n\nexport async function replyDiagnosticWithContext(\n  responseCtx: CommandContext[\"responseCtx\"],\n  text: string,\n  options?: { style?: \"muted\" | \"error\" },\n): Promise<void> {\n  await responseCtx.setTyping(false);\n  await responseCtx.setWorking(false);\n  await responseCtx.respondDiagnostic(text, options);\n}\n\nexport async function replyPrivatelyWithContext(\n  context: CommandContext,\n  text: string,\n  options?: { style?: \"muted\" | \"error\" },\n): Promise<void> {\n  if (context.privateConversation) {\n    await replyDiagnosticWithContext(context.responseCtx, text, options);\n    return;\n  }\n\n  if (context.bot.postPrivateDiagnostic) {\n    await context.bot.postPrivateDiagnostic(\n      context.conversationId,\n      context.platformUserId,\n      text,\n      options,\n    );\n    return;\n  }\n\n  if (context.bot.postPrivate) {\n    await context.bot.postPrivate(context.conversationId, context.platformUserId, text);\n    return;\n  }\n\n  await replyDiagnosticWithContext(context.responseCtx, text, options);\n}\n\nexport function formatCommandSummary(title: string, lines: string[]): string {\n  const nonEmpty = lines.filter((line) => line.trim().length > 0);\n  const compactLines =\n    nonEmpty.length <= 2 ? nonEmpty : [nonEmpty[0], nonEmpty.slice(1).join(\" · \")];\n  return [`_${title}_`, ...compactLines].join(\"\\n\");\n}\n\nexport function isPrivateConversation(event: BotEvent): boolean {\n  return (\n    event.conversationKind === \"direct\" || event.type === \"dm\" || event.type === \"private_command\"\n  );\n}\n"]}

package/dist/commands/utils.js

@@ -1,13 +1,23 @@
-export async function replyWithContext(responseCtx, text) {
-    await responseCtx.setTyping(false);
-    await responseCtx.setWorking(false);
-    await responseCtx.respond(text);
-}
 export async function replyDiagnosticWithContext(responseCtx, text, options) {
     await responseCtx.setTyping(false);
     await responseCtx.setWorking(false);
     await responseCtx.respondDiagnostic(text, options);
 }
+export async function replyPrivatelyWithContext(context, text, options) {
+    if (context.privateConversation) {
+        await replyDiagnosticWithContext(context.responseCtx, text, options);
+        return;
+    }
+    if (context.bot.postPrivateDiagnostic) {
+        await context.bot.postPrivateDiagnostic(context.conversationId, context.platformUserId, text, options);
+        return;
+    }
+    if (context.bot.postPrivate) {
+        await context.bot.postPrivate(context.conversationId, context.platformUserId, text);
+        return;
+    }
+    await replyDiagnosticWithContext(context.responseCtx, text, options);
+}
 export function formatCommandSummary(title, lines) {
     const nonEmpty = lines.filter((line) => line.trim().length > 0);
     const compactLines = nonEmpty.length <= 2 ? nonEmpty : [nonEmpty[0], nonEmpty.slice(1).join(" · ")];

package/dist/commands/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/commands/utils.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAA0C,EAC1C,IAAY;IAEZ,MAAM,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAA0C,EAC1C,IAAY,EACZ,OAAuC;IAEvC,MAAM,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,WAAW,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,KAAe;IACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAChB,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,IAAI,KAAK,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAe;IACnD,OAAO,CACL,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAC/F,CAAC;AACJ,CAAC","sourcesContent":["import type { BotEvent } from \"../adapter.js\";\nimport type { CommandContext } from \"./types.js\";\n\nexport async function replyWithContext(\n  responseCtx: CommandContext[\"responseCtx\"],\n  text: string,\n): Promise<void> {\n  await responseCtx.setTyping(false);\n  await responseCtx.setWorking(false);\n  await responseCtx.respond(text);\n}\n\nexport async function replyDiagnosticWithContext(\n  responseCtx: CommandContext[\"responseCtx\"],\n  text: string,\n  options?: { style?: \"muted\" | \"error\" },\n): Promise<void> {\n  await responseCtx.setTyping(false);\n  await responseCtx.setWorking(false);\n  await responseCtx.respondDiagnostic(text, options);\n}\n\nexport function formatCommandSummary(title: string, lines: string[]): string {\n  const nonEmpty = lines.filter((line) => line.trim().length > 0);\n  const compactLines =\n    nonEmpty.length <= 2 ? nonEmpty : [nonEmpty[0], nonEmpty.slice(1).join(\" · \")];\n  return [`_${title}_`, ...compactLines].join(\"\\n\");\n}\n\nexport function isPrivateConversation(event: BotEvent): boolean {\n  return (\n    event.conversationKind === \"direct\" || event.type === \"dm\" || event.type === \"private_command\"\n  );\n}\n"]}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/commands/utils.ts"],"names":[],"mappings":"AAGA,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,WAA0C,EAC1C,IAAY,EACZ,OAAuC;IAEvC,MAAM,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,WAAW,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAuB,EACvB,IAAY,EACZ,OAAuC;IAEvC,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAChC,MAAM,0BAA0B,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACtC,MAAM,OAAO,CAAC,GAAG,CAAC,qBAAqB,CACrC,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,cAAc,EACtB,IAAI,EACJ,OAAO,CACR,CAAC;QACF,OAAO;IACT,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC5B,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,MAAM,0BAA0B,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,KAAe;IACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAChB,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,IAAI,KAAK,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAe;IACnD,OAAO,CACL,KAAK,CAAC,gBAAgB,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,CAC/F,CAAC;AACJ,CAAC","sourcesContent":["import type { BotEvent } from \"../adapter.js\";\nimport type { CommandContext } from \"./types.js\";\n\nexport async function replyDiagnosticWithContext(\n  responseCtx: CommandContext[\"responseCtx\"],\n  text: string,\n  options?: { style?: \"muted\" | \"error\" },\n): Promise<void> {\n  await responseCtx.setTyping(false);\n  await responseCtx.setWorking(false);\n  await responseCtx.respondDiagnostic(text, options);\n}\n\nexport async function replyPrivatelyWithContext(\n  context: CommandContext,\n  text: string,\n  options?: { style?: \"muted\" | \"error\" },\n): Promise<void> {\n  if (context.privateConversation) {\n    await replyDiagnosticWithContext(context.responseCtx, text, options);\n    return;\n  }\n\n  if (context.bot.postPrivateDiagnostic) {\n    await context.bot.postPrivateDiagnostic(\n      context.conversationId,\n      context.platformUserId,\n      text,\n      options,\n    );\n    return;\n  }\n\n  if (context.bot.postPrivate) {\n    await context.bot.postPrivate(context.conversationId, context.platformUserId, text);\n    return;\n  }\n\n  await replyDiagnosticWithContext(context.responseCtx, text, options);\n}\n\nexport function formatCommandSummary(title: string, lines: string[]): string {\n  const nonEmpty = lines.filter((line) => line.trim().length > 0);\n  const compactLines =\n    nonEmpty.length <= 2 ? nonEmpty : [nonEmpty[0], nonEmpty.slice(1).join(\" · \")];\n  return [`_${title}_`, ...compactLines].join(\"\\n\");\n}\n\nexport function isPrivateConversation(event: BotEvent): boolean {\n  return (\n    event.conversationKind === \"direct\" || event.type === \"dm\" || event.type === \"private_command\"\n  );\n}\n"]}

package/dist/context.d.ts

@@ -13,5 +13,4 @@ export interface ConversationLogMessage {
     text?: string;
     isBot?: boolean;
 }
-export declare function findLogMessageById(conversationDir: string, messageId: string): Promise<ConversationLogMessage | null>;
 //# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAIA;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,kBAAkB,CACtC,eAAe,EAAE,MAAM,EACvB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CA0BxC","sourcesContent":["import { join } from \"path\";\nimport { isRecord, parseJsonValue, readTextFileIfExists } from \"./file-guards.js\";\nimport * as log from \"./log.js\";\n\n/**\n * Platform conversation history entry from log.jsonl.\n *\n * log.jsonl records what happened on the chat platform. sessions/*.jsonl are\n * LLM working contexts/records derived from platform messages and agent runs.\n */\nexport interface ConversationLogMessage {\n  date?: string;\n  ts?: string;\n  threadTs?: string;\n  user?: string;\n  userName?: string;\n  text?: string;\n  isBot?: boolean;\n}\n\nexport async function findLogMessageById(\n  conversationDir: string,\n  messageId: string,\n): Promise<ConversationLogMessage | null> {\n  const logFile = join(conversationDir, \"log.jsonl\");\n  const logContent = readTextFileIfExists(logFile);\n  if (logContent === undefined) return null;\n  const logLines = logContent.trim().split(\"\\n\").filter(Boolean);\n\n  for (let i = logLines.length - 1; i >= 0; i--) {\n    try {\n      const entry = parseJsonValue(\n        logLines[i],\n        (value): value is ConversationLogMessage => isRecord(value),\n        (detail) => (detail === \"unexpected JSON shape\" ? \"expected a JSON object\" : detail),\n      );\n      if (entry.ts === messageId) {\n        return entry;\n      }\n    } catch (err) {\n      log.logWarning(\n        `Skipping malformed log entry at ${logFile}:${i + 1}`,\n        err instanceof Error ? err.message : String(err),\n      );\n      continue;\n    }\n  }\n\n  return null;\n}\n"]}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB","sourcesContent":["/**\n * Platform conversation history entry from log.jsonl.\n *\n * log.jsonl records what happened on the chat platform. sessions/*.jsonl are\n * LLM working contexts/records derived from platform messages and agent runs.\n */\nexport interface ConversationLogMessage {\n  date?: string;\n  ts?: string;\n  threadTs?: string;\n  user?: string;\n  userName?: string;\n  text?: string;\n  isBot?: boolean;\n}\n"]}

package/dist/context.js

@@ -1,24 +1,2 @@
-import { join } from "path";
-import { isRecord, parseJsonValue, readTextFileIfExists } from "./file-guards.js";
-import * as log from "./log.js";
-export async function findLogMessageById(conversationDir, messageId) {
-    const logFile = join(conversationDir, "log.jsonl");
-    const logContent = readTextFileIfExists(logFile);
-    if (logContent === undefined)
-        return null;
-    const logLines = logContent.trim().split("\n").filter(Boolean);
-    for (let i = logLines.length - 1; i >= 0; i--) {
-        try {
-            const entry = parseJsonValue(logLines[i], (value) => isRecord(value), (detail) => (detail === "unexpected JSON shape" ? "expected a JSON object" : detail));
-            if (entry.ts === messageId) {
-                return entry;
-            }
-        }
-        catch (err) {
-            log.logWarning(`Skipping malformed log entry at ${logFile}:${i + 1}`, err instanceof Error ? err.message : String(err));
-            continue;
-        }
-    }
-    return null;
-}
+export {};
 //# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAkBhC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,eAAuB,EACvB,SAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE/D,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,cAAc,CAC1B,QAAQ,CAAC,CAAC,CAAC,EACX,CAAC,KAAK,EAAmC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC3D,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,uBAAuB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM,CAAC,CACrF,CAAC;YACF,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CACZ,mCAAmC,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EACrD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;YACF,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { join } from \"path\";\nimport { isRecord, parseJsonValue, readTextFileIfExists } from \"./file-guards.js\";\nimport * as log from \"./log.js\";\n\n/**\n * Platform conversation history entry from log.jsonl.\n *\n * log.jsonl records what happened on the chat platform. sessions/*.jsonl are\n * LLM working contexts/records derived from platform messages and agent runs.\n */\nexport interface ConversationLogMessage {\n  date?: string;\n  ts?: string;\n  threadTs?: string;\n  user?: string;\n  userName?: string;\n  text?: string;\n  isBot?: boolean;\n}\n\nexport async function findLogMessageById(\n  conversationDir: string,\n  messageId: string,\n): Promise<ConversationLogMessage | null> {\n  const logFile = join(conversationDir, \"log.jsonl\");\n  const logContent = readTextFileIfExists(logFile);\n  if (logContent === undefined) return null;\n  const logLines = logContent.trim().split(\"\\n\").filter(Boolean);\n\n  for (let i = logLines.length - 1; i >= 0; i--) {\n    try {\n      const entry = parseJsonValue(\n        logLines[i],\n        (value): value is ConversationLogMessage => isRecord(value),\n        (detail) => (detail === \"unexpected JSON shape\" ? \"expected a JSON object\" : detail),\n      );\n      if (entry.ts === messageId) {\n        return entry;\n      }\n    } catch (err) {\n      log.logWarning(\n        `Skipping malformed log entry at ${logFile}:${i + 1}`,\n        err instanceof Error ? err.message : String(err),\n      );\n      continue;\n    }\n  }\n\n  return null;\n}\n"]}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"","sourcesContent":["/**\n * Platform conversation history entry from log.jsonl.\n *\n * log.jsonl records what happened on the chat platform. sessions/*.jsonl are\n * LLM working contexts/records derived from platform messages and agent runs.\n */\nexport interface ConversationLogMessage {\n  date?: string;\n  ts?: string;\n  threadTs?: string;\n  user?: string;\n  userName?: string;\n  text?: string;\n  isBot?: boolean;\n}\n"]}

package/dist/html.d.ts

@@ -0,0 +1,2 @@
+export declare function escapeHtml(value: string): string;
+//# sourceMappingURL=html.d.ts.map

package/dist/html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.d.ts","sourceRoot":"","sources":["../src/html.ts"],"names":[],"mappings":"AAAA,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKhD","sourcesContent":["export function escapeHtml(value: string): string {\n  return value.replace(\n    /[&<>\"']/g,\n    (c) => ({ \"&\": \"&amp;\", \"<\": \"&lt;\", \">\": \"&gt;\", '\"': \"&quot;\", \"'\": \"&#39;\" })[c]!,\n  );\n}\n"]}

package/dist/html.js

@@ -0,0 +1,4 @@
+export function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+}
+//# sourceMappingURL=html.js.map

package/dist/html.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"html.js","sourceRoot":"","sources":["../src/html.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAClB,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,CACrF,CAAC;AACJ,CAAC","sourcesContent":["export function escapeHtml(value: string): string {\n  return value.replace(\n    /[&<>\"']/g,\n    (c) => ({ \"&\": \"&amp;\", \"<\": \"&lt;\", \">\": \"&gt;\", '\"': \"&quot;\", \"'\": \"&#39;\" })[c]!,\n  );\n}\n"]}

package/dist/login/index.d.ts

@@ -1,5 +1,5 @@
 export type LoginCredentialKind = "api_key" | "oauth";
-export interface OAuthAuthorizedUserFileOutput {
+interface OAuthAuthorizedUserFileOutput {
     type: "authorized_user";
     relativePath: string;
     targetPath?: string;
@@ -39,4 +39,5 @@ export type ParsedLoginCommand = {
 export declare function getOAuthServices(): OAuthService[];
 export declare function resolveOAuthService(input: string): OAuthService | undefined;
 export declare function parseLoginCommand(text: string): ParsedLoginCommand | null;
+export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/login/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,OAAO,CAAC;AAEtD,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,iBAAiB,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,4BAA4B,CAAC,EAAE,MAAM,EAAE,CAAC;IACxC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,UAAU,CAAC,EAAE,6BAA6B,CAAC;CAC5C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC9D;IACE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC1C,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;IAC5D,IAAI,EAAE,MAAM,CAAC;CACd,GACD;IAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACpE;IAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AA+GvF,wBAAgB,gBAAgB,IAAI,YAAY,EAAE,CAwHjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAM3E;AAID,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAgCzE","sourcesContent":["import { matchCommand } from \"../commands/parse.js\";\nimport { readEnv } from \"../env.js\";\nimport { isRecord, parseJsonValue } from \"../file-guards.js\";\nimport * as log from \"../log.js\";\n\nexport type LoginCredentialKind = \"api_key\" | \"oauth\";\n\nexport interface OAuthAuthorizedUserFileOutput {\n  type: \"authorized_user\";\n  relativePath: string;\n  targetPath?: string;\n  envKey?: string;\n  additionalEnvKeys?: string[];\n}\n\nexport interface OAuthService {\n  id: string;\n  label: string;\n  aliases: string[];\n  authorizationUrl: string;\n  tokenUrl: string;\n  scopes: string[];\n  clientIdEnvKey: string;\n  clientSecretEnvKey: string;\n  accessTokenEnvKey?: string;\n  additionalAccessTokenEnvKeys?: string[];\n  refreshTokenEnvKey?: string;\n  authorizationParams?: Record<string, string>;\n  fileOutput?: OAuthAuthorizedUserFileOutput;\n}\n\nexport type ParsedLoginCommand =\n  | { command: \"login\" | \"/login\" | \"/pi-login\"; action: \"setup\" }\n  | {\n      command: \"login\" | \"/login\" | \"/pi-login\";\n      action: \"shared_create\" | \"shared_update\" | \"shared_delete\";\n      name: string;\n    }\n  | { command: \"login\" | \"/login\" | \"/pi-login\"; action: \"shared_list\" }\n  | { command: \"login\" | \"/login\" | \"/pi-login\"; action: \"copy_shared\"; name: string };\n\nconst DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES = [\n  \"https://www.googleapis.com/auth/drive\",\n  \"https://mail.google.com/\",\n  \"https://www.googleapis.com/auth/calendar\",\n  \"https://www.googleapis.com/auth/spreadsheets\",\n  \"https://www.googleapis.com/auth/documents\",\n  \"https://www.googleapis.com/auth/chat.messages.create\",\n];\n\nconst DEFAULT_GOOGLE_CLOUD_SDK_SCOPES = [\n  \"openid\",\n  \"https://www.googleapis.com/auth/userinfo.email\",\n  \"https://www.googleapis.com/auth/cloud-platform\",\n];\n\n// Conservative default: enough for `gh` CLI repo/user/org operations, but\n// without `workflow` (can dispatch CI), `write:packages` (can publish\n// packages), or `project`. Operators who need those can opt in via\n// GITHUB_OAUTH_SCOPES (or MIKAN_GITHUB_OAUTH_SCOPES) to keep the blast radius\n// of a compromised agent host explicit and configurable.\nconst DEFAULT_GITHUB_OAUTH_SCOPES = [\"repo\", \"read:user\", \"user:email\", \"read:org\", \"gist\"];\n\nfunction resolveScopesFromEnv(envKey: string, fallback: string[]): string[] {\n  const raw = readEnv(envKey);\n  if (!raw) return fallback;\n\n  const scopes = raw\n    .split(/[\\s,]+/)\n    .map((scope) => scope.trim())\n    .filter(Boolean);\n\n  return scopes.length > 0 ? scopes : fallback;\n}\n\nfunction resolveGoogleWorkspaceCliScopes(): string[] {\n  return resolveScopesFromEnv(\n    \"GOOGLE_WORKSPACE_CLI_OAUTH_SCOPES\",\n    DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES,\n  );\n}\n\nfunction resolveGoogleCloudSdkScopes(): string[] {\n  return resolveScopesFromEnv(\"GOOGLE_CLOUD_SDK_OAUTH_SCOPES\", DEFAULT_GOOGLE_CLOUD_SDK_SCOPES);\n}\n\nfunction resolveGitHubOAuthScopes(): string[] {\n  return resolveScopesFromEnv(\"GITHUB_OAUTH_SCOPES\", DEFAULT_GITHUB_OAUTH_SCOPES);\n}\n\nfunction getBuiltinOAuthServices(): OAuthService[] {\n  return [\n    {\n      id: \"github\",\n      label: \"GitHub\",\n      aliases: [\"github\", \"github_oauth\", \"gh_oauth\"],\n      authorizationUrl: \"https://github.com/login/oauth/authorize\",\n      tokenUrl: \"https://github.com/login/oauth/access_token\",\n      scopes: resolveGitHubOAuthScopes(),\n      clientIdEnvKey: \"GITHUB_OAUTH_CLIENT_ID\",\n      clientSecretEnvKey: \"GITHUB_OAUTH_CLIENT_SECRET\",\n      accessTokenEnvKey: \"GITHUB_OAUTH_ACCESS_TOKEN\",\n      additionalAccessTokenEnvKeys: [\"GH_TOKEN\"],\n      refreshTokenEnvKey: \"GITHUB_OAUTH_REFRESH_TOKEN\",\n    },\n    {\n      id: \"google_workspace_cli\",\n      label: \"Google Workspace CLI\",\n      aliases: [\"google_workspace_cli\", \"gws\", \"googleworkspace\", \"google-workspace-cli\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveGoogleWorkspaceCliScopes(),\n      clientIdEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gws.json\",\n        targetPath: \"/root/.config/gws/credentials.json\",\n      },\n    },\n    {\n      id: \"google_cloud_sdk\",\n      label: \"Google Cloud SDK (gcloud)\",\n      aliases: [\"google_cloud_sdk\", \"gcloud\", \"google-cloud-sdk\", \"google_cloud\", \"gcp\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveGoogleCloudSdkScopes(),\n      clientIdEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gcloud-adc.json\",\n        targetPath: \"/root/.config/gcloud/application_default_credentials.json\",\n        envKey: \"GOOGLE_APPLICATION_CREDENTIALS\",\n        additionalEnvKeys: [\"CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE\"],\n      },\n    },\n  ];\n}\n\nexport function getOAuthServices(): OAuthService[] {\n  const raw = readEnv(\"OAUTH_SERVICES_JSON\");\n  const builtins = getBuiltinOAuthServices();\n  if (!raw) return builtins;\n\n  let parsed: unknown[];\n  try {\n    parsed = parseJsonValue(raw, Array.isArray, (detail) =>\n      detail === \"unexpected JSON shape\"\n        ? \"expected a JSON array of OAuth service definitions\"\n        : detail,\n    );\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    log.logWarning(\n      detail === \"expected a JSON array of OAuth service definitions\"\n        ? \"Ignoring OAUTH_SERVICES_JSON: expected a JSON array of OAuth service definitions\"\n        : \"Ignoring OAUTH_SERVICES_JSON: invalid JSON\",\n      detail,\n    );\n    return builtins;\n  }\n  try {\n    const custom = parsed\n      .map((serviceValue): OAuthService | null => {\n        if (!isRecord(serviceValue)) return null;\n        const obj = serviceValue;\n        const id = typeof obj.id === \"string\" ? obj.id.trim() : \"\";\n        const label = typeof obj.label === \"string\" ? obj.label.trim() : \"\";\n        const authorizationUrl =\n          typeof obj.authorizationUrl === \"string\" ? obj.authorizationUrl.trim() : \"\";\n        const tokenUrl = typeof obj.tokenUrl === \"string\" ? obj.tokenUrl.trim() : \"\";\n        const clientIdEnvKey =\n          typeof obj.clientIdEnvKey === \"string\" ? obj.clientIdEnvKey.trim() : \"\";\n        const clientSecretEnvKey =\n          typeof obj.clientSecretEnvKey === \"string\" ? obj.clientSecretEnvKey.trim() : \"\";\n        const accessTokenEnvKey =\n          typeof obj.accessTokenEnvKey === \"string\" ? obj.accessTokenEnvKey.trim() : undefined;\n        if (\n          !id ||\n          !label ||\n          !authorizationUrl ||\n          !tokenUrl ||\n          !clientIdEnvKey ||\n          !clientSecretEnvKey\n        ) {\n          return null;\n        }\n\n        let fileOutput: OAuthService[\"fileOutput\"];\n        if (isRecord(obj.fileOutput)) {\n          const fileOutputObj = obj.fileOutput;\n          const type = typeof fileOutputObj.type === \"string\" ? fileOutputObj.type.trim() : \"\";\n          const relativePath =\n            typeof fileOutputObj.relativePath === \"string\" ? fileOutputObj.relativePath.trim() : \"\";\n          const targetPath =\n            typeof fileOutputObj.targetPath === \"string\"\n              ? fileOutputObj.targetPath.trim()\n              : undefined;\n          const envKey =\n            typeof fileOutputObj.envKey === \"string\" ? fileOutputObj.envKey.trim() : undefined;\n          const additionalEnvKeys = Array.isArray(fileOutputObj.additionalEnvKeys)\n            ? fileOutputObj.additionalEnvKeys.filter((v): v is string => typeof v === \"string\")\n            : undefined;\n          if (type === \"authorized_user\" && relativePath) {\n            fileOutput = {\n              type: \"authorized_user\",\n              relativePath,\n              targetPath,\n              envKey,\n              additionalEnvKeys,\n            };\n          }\n        }\n\n        return {\n          id: id.toLowerCase(),\n          label,\n          aliases: Array.isArray(obj.aliases)\n            ? obj.aliases\n                .filter((v): v is string => typeof v === \"string\")\n                .map((v) => v.toLowerCase())\n            : [id.toLowerCase()],\n          authorizationUrl,\n          tokenUrl,\n          scopes: Array.isArray(obj.scopes)\n            ? obj.scopes.filter((v): v is string => typeof v === \"string\")\n            : [],\n          clientIdEnvKey,\n          clientSecretEnvKey,\n          accessTokenEnvKey,\n          additionalAccessTokenEnvKeys: Array.isArray(obj.additionalAccessTokenEnvKeys)\n            ? obj.additionalAccessTokenEnvKeys.filter((v): v is string => typeof v === \"string\")\n            : undefined,\n          refreshTokenEnvKey:\n            typeof obj.refreshTokenEnvKey === \"string\" ? obj.refreshTokenEnvKey.trim() : undefined,\n          authorizationParams: isRecord(obj.authorizationParams)\n            ? Object.fromEntries(\n                Object.entries(obj.authorizationParams).filter(\n                  (authorizationEntry): authorizationEntry is [string, string] =>\n                    typeof authorizationEntry[1] === \"string\",\n                ),\n              )\n            : undefined,\n          fileOutput,\n        };\n      })\n      .filter((service): service is OAuthService => service !== null);\n\n    const byId = new Map<string, OAuthService>();\n    for (const service of builtins) byId.set(service.id, service);\n    for (const service of custom) byId.set(service.id, service);\n    return [...byId.values()];\n  } catch (err) {\n    log.logWarning(\n      \"Failed to apply OAUTH_SERVICES_JSON overrides; using builtin OAuth services\",\n      err instanceof Error ? err.message : String(err),\n    );\n    return builtins;\n  }\n}\n\nexport function resolveOAuthService(input: string): OAuthService | undefined {\n  const normalized = input.trim().toLowerCase();\n  if (!normalized) return undefined;\n  return getOAuthServices().find(\n    (service) => service.id === normalized || service.aliases.includes(normalized),\n  );\n}\n\nconst LOGIN_COMMANDS = [\"login\", \"/login\", \"/pi-login\"] as const;\n\nexport function parseLoginCommand(text: string): ParsedLoginCommand | null {\n  const matched = matchCommand(text, LOGIN_COMMANDS);\n  if (!matched) return null;\n\n  const [subcommand, operation, name, ...extra] = matched.args;\n\n  if (!subcommand) return { command: matched.command, action: \"setup\" };\n\n  if (subcommand.toLowerCase() === \"shared\") {\n    const op = operation?.toLowerCase();\n    if (op === \"list\" && !name && extra.length === 0) {\n      return { command: matched.command, action: \"shared_list\" };\n    }\n    if ((op === \"create\" || op === \"update\" || op === \"delete\") && !!name && extra.length === 0) {\n      return {\n        command: matched.command,\n        action: `shared_${op}` as \"shared_create\" | \"shared_update\" | \"shared_delete\",\n        name,\n      };\n    }\n    return null;\n  }\n\n  if (subcommand.toLowerCase() === \"copy\" && operation && !name && extra.length === 0) {\n    return { command: matched.command, action: \"copy_shared\", name: operation };\n  }\n\n  // Backward-compatible: older `/pi-login gh` / `/pi-login gws` forms opened the\n  // generic login page and let the portal handle provider choice.\n  if (!operation && extra.length === 0) return { command: matched.command, action: \"setup\" };\n\n  return null;\n}\n"]}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAKA,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,OAAO,CAAC;AAEtD,UAAU,6BAA6B;IACrC,IAAI,EAAE,iBAAiB,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,4BAA4B,CAAC,EAAE,MAAM,EAAE,CAAC;IACxC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,UAAU,CAAC,EAAE,6BAA6B,CAAC;CAC5C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC9D;IACE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC1C,MAAM,EAAE,eAAe,GAAG,eAAe,GAAG,eAAe,CAAC;IAC5D,IAAI,EAAE,MAAM,CAAC;CACd,GACD;IAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACpE;IAAE,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,WAAW,CAAC;IAAC,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AA+GvF,wBAAgB,gBAAgB,IAAI,YAAY,EAAE,CAwHjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAM3E;AAID,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAgCzE","sourcesContent":["import { matchCommand } from \"../commands/parse.js\";\nimport { readEnv } from \"../env.js\";\nimport { isRecord, parseJsonValue } from \"../file-guards.js\";\nimport * as log from \"../log.js\";\n\nexport type LoginCredentialKind = \"api_key\" | \"oauth\";\n\ninterface OAuthAuthorizedUserFileOutput {\n  type: \"authorized_user\";\n  relativePath: string;\n  targetPath?: string;\n  envKey?: string;\n  additionalEnvKeys?: string[];\n}\n\nexport interface OAuthService {\n  id: string;\n  label: string;\n  aliases: string[];\n  authorizationUrl: string;\n  tokenUrl: string;\n  scopes: string[];\n  clientIdEnvKey: string;\n  clientSecretEnvKey: string;\n  accessTokenEnvKey?: string;\n  additionalAccessTokenEnvKeys?: string[];\n  refreshTokenEnvKey?: string;\n  authorizationParams?: Record<string, string>;\n  fileOutput?: OAuthAuthorizedUserFileOutput;\n}\n\nexport type ParsedLoginCommand =\n  | { command: \"login\" | \"/login\" | \"/pi-login\"; action: \"setup\" }\n  | {\n      command: \"login\" | \"/login\" | \"/pi-login\";\n      action: \"shared_create\" | \"shared_update\" | \"shared_delete\";\n      name: string;\n    }\n  | { command: \"login\" | \"/login\" | \"/pi-login\"; action: \"shared_list\" }\n  | { command: \"login\" | \"/login\" | \"/pi-login\"; action: \"copy_shared\"; name: string };\n\nconst DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES = [\n  \"https://www.googleapis.com/auth/drive\",\n  \"https://mail.google.com/\",\n  \"https://www.googleapis.com/auth/calendar\",\n  \"https://www.googleapis.com/auth/spreadsheets\",\n  \"https://www.googleapis.com/auth/documents\",\n  \"https://www.googleapis.com/auth/chat.messages.create\",\n];\n\nconst DEFAULT_GOOGLE_CLOUD_SDK_SCOPES = [\n  \"openid\",\n  \"https://www.googleapis.com/auth/userinfo.email\",\n  \"https://www.googleapis.com/auth/cloud-platform\",\n];\n\n// Conservative default: enough for `gh` CLI repo/user/org operations, but\n// without `workflow` (can dispatch CI), `write:packages` (can publish\n// packages), or `project`. Operators who need those can opt in via\n// GITHUB_OAUTH_SCOPES (or MIKAN_GITHUB_OAUTH_SCOPES) to keep the blast radius\n// of a compromised agent host explicit and configurable.\nconst DEFAULT_GITHUB_OAUTH_SCOPES = [\"repo\", \"read:user\", \"user:email\", \"read:org\", \"gist\"];\n\nfunction resolveScopesFromEnv(envKey: string, fallback: string[]): string[] {\n  const raw = readEnv(envKey);\n  if (!raw) return fallback;\n\n  const scopes = raw\n    .split(/[\\s,]+/)\n    .map((scope) => scope.trim())\n    .filter(Boolean);\n\n  return scopes.length > 0 ? scopes : fallback;\n}\n\nfunction resolveGoogleWorkspaceCliScopes(): string[] {\n  return resolveScopesFromEnv(\n    \"GOOGLE_WORKSPACE_CLI_OAUTH_SCOPES\",\n    DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES,\n  );\n}\n\nfunction resolveGoogleCloudSdkScopes(): string[] {\n  return resolveScopesFromEnv(\"GOOGLE_CLOUD_SDK_OAUTH_SCOPES\", DEFAULT_GOOGLE_CLOUD_SDK_SCOPES);\n}\n\nfunction resolveGitHubOAuthScopes(): string[] {\n  return resolveScopesFromEnv(\"GITHUB_OAUTH_SCOPES\", DEFAULT_GITHUB_OAUTH_SCOPES);\n}\n\nfunction getBuiltinOAuthServices(): OAuthService[] {\n  return [\n    {\n      id: \"github\",\n      label: \"GitHub\",\n      aliases: [\"github\", \"github_oauth\", \"gh_oauth\"],\n      authorizationUrl: \"https://github.com/login/oauth/authorize\",\n      tokenUrl: \"https://github.com/login/oauth/access_token\",\n      scopes: resolveGitHubOAuthScopes(),\n      clientIdEnvKey: \"GITHUB_OAUTH_CLIENT_ID\",\n      clientSecretEnvKey: \"GITHUB_OAUTH_CLIENT_SECRET\",\n      accessTokenEnvKey: \"GITHUB_OAUTH_ACCESS_TOKEN\",\n      additionalAccessTokenEnvKeys: [\"GH_TOKEN\"],\n      refreshTokenEnvKey: \"GITHUB_OAUTH_REFRESH_TOKEN\",\n    },\n    {\n      id: \"google_workspace_cli\",\n      label: \"Google Workspace CLI\",\n      aliases: [\"google_workspace_cli\", \"gws\", \"googleworkspace\", \"google-workspace-cli\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveGoogleWorkspaceCliScopes(),\n      clientIdEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gws.json\",\n        targetPath: \"/root/.config/gws/credentials.json\",\n      },\n    },\n    {\n      id: \"google_cloud_sdk\",\n      label: \"Google Cloud SDK (gcloud)\",\n      aliases: [\"google_cloud_sdk\", \"gcloud\", \"google-cloud-sdk\", \"google_cloud\", \"gcp\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveGoogleCloudSdkScopes(),\n      clientIdEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gcloud-adc.json\",\n        targetPath: \"/root/.config/gcloud/application_default_credentials.json\",\n        envKey: \"GOOGLE_APPLICATION_CREDENTIALS\",\n        additionalEnvKeys: [\"CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE\"],\n      },\n    },\n  ];\n}\n\nexport function getOAuthServices(): OAuthService[] {\n  const raw = readEnv(\"OAUTH_SERVICES_JSON\");\n  const builtins = getBuiltinOAuthServices();\n  if (!raw) return builtins;\n\n  let parsed: unknown[];\n  try {\n    parsed = parseJsonValue(raw, Array.isArray, (detail) =>\n      detail === \"unexpected JSON shape\"\n        ? \"expected a JSON array of OAuth service definitions\"\n        : detail,\n    );\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    log.logWarning(\n      detail === \"expected a JSON array of OAuth service definitions\"\n        ? \"Ignoring OAUTH_SERVICES_JSON: expected a JSON array of OAuth service definitions\"\n        : \"Ignoring OAUTH_SERVICES_JSON: invalid JSON\",\n      detail,\n    );\n    return builtins;\n  }\n  try {\n    const custom = parsed\n      .map((serviceValue): OAuthService | null => {\n        if (!isRecord(serviceValue)) return null;\n        const obj = serviceValue;\n        const id = typeof obj.id === \"string\" ? obj.id.trim() : \"\";\n        const label = typeof obj.label === \"string\" ? obj.label.trim() : \"\";\n        const authorizationUrl =\n          typeof obj.authorizationUrl === \"string\" ? obj.authorizationUrl.trim() : \"\";\n        const tokenUrl = typeof obj.tokenUrl === \"string\" ? obj.tokenUrl.trim() : \"\";\n        const clientIdEnvKey =\n          typeof obj.clientIdEnvKey === \"string\" ? obj.clientIdEnvKey.trim() : \"\";\n        const clientSecretEnvKey =\n          typeof obj.clientSecretEnvKey === \"string\" ? obj.clientSecretEnvKey.trim() : \"\";\n        const accessTokenEnvKey =\n          typeof obj.accessTokenEnvKey === \"string\" ? obj.accessTokenEnvKey.trim() : undefined;\n        if (\n          !id ||\n          !label ||\n          !authorizationUrl ||\n          !tokenUrl ||\n          !clientIdEnvKey ||\n          !clientSecretEnvKey\n        ) {\n          return null;\n        }\n\n        let fileOutput: OAuthService[\"fileOutput\"];\n        if (isRecord(obj.fileOutput)) {\n          const fileOutputObj = obj.fileOutput;\n          const type = typeof fileOutputObj.type === \"string\" ? fileOutputObj.type.trim() : \"\";\n          const relativePath =\n            typeof fileOutputObj.relativePath === \"string\" ? fileOutputObj.relativePath.trim() : \"\";\n          const targetPath =\n            typeof fileOutputObj.targetPath === \"string\"\n              ? fileOutputObj.targetPath.trim()\n              : undefined;\n          const envKey =\n            typeof fileOutputObj.envKey === \"string\" ? fileOutputObj.envKey.trim() : undefined;\n          const additionalEnvKeys = Array.isArray(fileOutputObj.additionalEnvKeys)\n            ? fileOutputObj.additionalEnvKeys.filter((v): v is string => typeof v === \"string\")\n            : undefined;\n          if (type === \"authorized_user\" && relativePath) {\n            fileOutput = {\n              type: \"authorized_user\",\n              relativePath,\n              targetPath,\n              envKey,\n              additionalEnvKeys,\n            };\n          }\n        }\n\n        return {\n          id: id.toLowerCase(),\n          label,\n          aliases: Array.isArray(obj.aliases)\n            ? obj.aliases\n                .filter((v): v is string => typeof v === \"string\")\n                .map((v) => v.toLowerCase())\n            : [id.toLowerCase()],\n          authorizationUrl,\n          tokenUrl,\n          scopes: Array.isArray(obj.scopes)\n            ? obj.scopes.filter((v): v is string => typeof v === \"string\")\n            : [],\n          clientIdEnvKey,\n          clientSecretEnvKey,\n          accessTokenEnvKey,\n          additionalAccessTokenEnvKeys: Array.isArray(obj.additionalAccessTokenEnvKeys)\n            ? obj.additionalAccessTokenEnvKeys.filter((v): v is string => typeof v === \"string\")\n            : undefined,\n          refreshTokenEnvKey:\n            typeof obj.refreshTokenEnvKey === \"string\" ? obj.refreshTokenEnvKey.trim() : undefined,\n          authorizationParams: isRecord(obj.authorizationParams)\n            ? Object.fromEntries(\n                Object.entries(obj.authorizationParams).filter(\n                  (authorizationEntry): authorizationEntry is [string, string] =>\n                    typeof authorizationEntry[1] === \"string\",\n                ),\n              )\n            : undefined,\n          fileOutput,\n        };\n      })\n      .filter((service): service is OAuthService => service !== null);\n\n    const byId = new Map<string, OAuthService>();\n    for (const service of builtins) byId.set(service.id, service);\n    for (const service of custom) byId.set(service.id, service);\n    return [...byId.values()];\n  } catch (err) {\n    log.logWarning(\n      \"Failed to apply OAUTH_SERVICES_JSON overrides; using builtin OAuth services\",\n      err instanceof Error ? err.message : String(err),\n    );\n    return builtins;\n  }\n}\n\nexport function resolveOAuthService(input: string): OAuthService | undefined {\n  const normalized = input.trim().toLowerCase();\n  if (!normalized) return undefined;\n  return getOAuthServices().find(\n    (service) => service.id === normalized || service.aliases.includes(normalized),\n  );\n}\n\nconst LOGIN_COMMANDS = [\"login\", \"/login\", \"/pi-login\"] as const;\n\nexport function parseLoginCommand(text: string): ParsedLoginCommand | null {\n  const matched = matchCommand(text, LOGIN_COMMANDS);\n  if (!matched) return null;\n\n  const [subcommand, operation, name, ...extra] = matched.args;\n\n  if (!subcommand) return { command: matched.command, action: \"setup\" };\n\n  if (subcommand.toLowerCase() === \"shared\") {\n    const op = operation?.toLowerCase();\n    if (op === \"list\" && !name && extra.length === 0) {\n      return { command: matched.command, action: \"shared_list\" };\n    }\n    if ((op === \"create\" || op === \"update\" || op === \"delete\") && !!name && extra.length === 0) {\n      return {\n        command: matched.command,\n        action: `shared_${op}` as \"shared_create\" | \"shared_update\" | \"shared_delete\",\n        name,\n      };\n    }\n    return null;\n  }\n\n  if (subcommand.toLowerCase() === \"copy\" && operation && !name && extra.length === 0) {\n    return { command: matched.command, action: \"copy_shared\", name: operation };\n  }\n\n  // Backward-compatible: older `/pi-login gh` / `/pi-login gws` forms opened the\n  // generic login page and let the portal handle provider choice.\n  if (!operation && extra.length === 0) return { command: matched.command, action: \"setup\" };\n\n  return null;\n}\n"]}

package/dist/login/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAsCjC,MAAM,mCAAmC,GAAG;IAC1C,uCAAuC;IACvC,0BAA0B;IAC1B,0CAA0C;IAC1C,8CAA8C;IAC9C,2CAA2C;IAC3C,sDAAsD;CACvD,CAAC;AAEF,MAAM,+BAA+B,GAAG;IACtC,QAAQ;IACR,gDAAgD;IAChD,gDAAgD;CACjD,CAAC;AAEF,0EAA0E;AAC1E,sEAAsE;AACtE,mEAAmE;AACnE,8EAA8E;AAC9E,yDAAyD;AACzD,MAAM,2BAA2B,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAE5F,SAAS,oBAAoB,CAAC,MAAc,EAAE,QAAkB;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAE1B,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED,SAAS,+BAA+B;IACtC,OAAO,oBAAoB,CACzB,mCAAmC,EACnC,mCAAmC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO,oBAAoB,CAAC,+BAA+B,EAAE,+BAA+B,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,oBAAoB,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;QACL;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC;YAC/C,gBAAgB,EAAE,0CAA0C;YAC5D,QAAQ,EAAE,6CAA6C;YACvD,MAAM,EAAE,wBAAwB,EAAE;YAClC,cAAc,EAAE,wBAAwB;YACxC,kBAAkB,EAAE,4BAA4B;YAChD,iBAAiB,EAAE,2BAA2B;YAC9C,4BAA4B,EAAE,CAAC,UAAU,CAAC;YAC1C,kBAAkB,EAAE,4BAA4B;SACjD;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,CAAC,sBAAsB,EAAE,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,CAAC;YACnF,gBAAgB,EAAE,8CAA8C;YAChE,QAAQ,EAAE,qCAAqC;YAC/C,MAAM,EAAE,+BAA+B,EAAE;YACzC,cAAc,EAAE,gCAAgC;YAChD,kBAAkB,EAAE,oCAAoC;YACxD,mBAAmB,EAAE;gBACnB,WAAW,EAAE,SAAS;gBACtB,sBAAsB,EAAE,MAAM;gBAC9B,MAAM,EAAE,SAAS;aAClB;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,YAAY,EAAE,UAAU;gBACxB,UAAU,EAAE,oCAAoC;aACjD;SACF;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,2BAA2B;YAClC,OAAO,EAAE,CAAC,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,CAAC;YAClF,gBAAgB,EAAE,8CAA8C;YAChE,QAAQ,EAAE,qCAAqC;YAC/C,MAAM,EAAE,2BAA2B,EAAE;YACrC,cAAc,EAAE,4BAA4B;YAC5C,kBAAkB,EAAE,gCAAgC;YACpD,mBAAmB,EAAE;gBACnB,WAAW,EAAE,SAAS;gBACtB,sBAAsB,EAAE,MAAM;gBAC9B,MAAM,EAAE,SAAS;aAClB;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,YAAY,EAAE,iBAAiB;gBAC/B,UAAU,EAAE,2DAA2D;gBACvE,MAAM,EAAE,gCAAgC;gBACxC,iBAAiB,EAAE,CAAC,wCAAwC,CAAC;aAC9D;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAE1B,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CACrD,MAAM,KAAK,uBAAuB;YAChC,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,MAAM,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,GAAG,CAAC,UAAU,CACZ,MAAM,KAAK,oDAAoD;YAC7D,CAAC,CAAC,kFAAkF;YACpF,CAAC,CAAC,4CAA4C,EAChD,MAAM,CACP,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM;aAClB,GAAG,CAAC,CAAC,YAAY,EAAuB,EAAE;YACzC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,GAAG,GAAG,YAAY,CAAC;YACzB,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,gBAAgB,GACpB,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,cAAc,GAClB,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,kBAAkB,GACtB,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,iBAAiB,GACrB,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,IACE,CAAC,EAAE;gBACH,CAAC,KAAK;gBACN,CAAC,gBAAgB;gBACjB,CAAC,QAAQ;gBACT,CAAC,cAAc;gBACf,CAAC,kBAAkB,EACnB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,UAAsC,CAAC;YAC3C,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,MAAM,aAAa,GAAG,GAAG,CAAC,UAAU,CAAC;gBACrC,MAAM,IAAI,GAAG,OAAO,aAAa,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,MAAM,YAAY,GAChB,OAAO,aAAa,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1F,MAAM,UAAU,GACd,OAAO,aAAa,CAAC,UAAU,KAAK,QAAQ;oBAC1C,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE;oBACjC,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,MAAM,GACV,OAAO,aAAa,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrF,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC;oBACtE,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACnF,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,IAAI,KAAK,iBAAiB,IAAI,YAAY,EAAE,CAAC;oBAC/C,UAAU,GAAG;wBACX,IAAI,EAAE,iBAAiB;wBACvB,YAAY;wBACZ,UAAU;wBACV,MAAM;wBACN,iBAAiB;qBAClB,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE;gBACpB,KAAK;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;oBACjC,CAAC,CAAC,GAAG,CAAC,OAAO;yBACR,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;yBACjD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;oBAChC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBACtB,gBAAgB;gBAChB,QAAQ;gBACR,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;oBAC/B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBAC9D,CAAC,CAAC,EAAE;gBACN,cAAc;gBACd,kBAAkB;gBAClB,iBAAiB;gBACjB,4BAA4B,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;oBAC3E,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACpF,CAAC,CAAC,SAAS;gBACb,kBAAkB,EAChB,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;gBACxF,mBAAmB,EAAE,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC;oBACpD,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAC5C,CAAC,kBAAkB,EAA0C,EAAE,CAC7D,OAAO,kBAAkB,CAAC,CAAC,CAAC,KAAK,QAAQ,CAC5C,CACF;oBACH,CAAC,CAAC,SAAS;gBACb,UAAU;aACX,CAAC;QACJ,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,OAAO,EAA2B,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;QAElE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;QAC7C,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9D,KAAK,MAAM,OAAO,IAAI,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,UAAU,CACZ,6EAA6E,EAC7E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,gBAAgB,EAAE,CAAC,IAAI,CAC5B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAC;AAEjE,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAE7D,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAEtE,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC;QACpC,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5F,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,UAAU,EAAE,EAAyD;gBAC7E,IAAI;aACL,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,SAAS,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC9E,CAAC;IAED,+EAA+E;IAC/E,gEAAgE;IAChE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE3F,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { matchCommand } from \"../commands/parse.js\";\nimport { readEnv } from \"../env.js\";\nimport { isRecord, parseJsonValue } from \"../file-guards.js\";\nimport * as log from \"../log.js\";\n\nexport type LoginCredentialKind = \"api_key\" | \"oauth\";\n\nexport interface OAuthAuthorizedUserFileOutput {\n  type: \"authorized_user\";\n  relativePath: string;\n  targetPath?: string;\n  envKey?: string;\n  additionalEnvKeys?: string[];\n}\n\nexport interface OAuthService {\n  id: string;\n  label: string;\n  aliases: string[];\n  authorizationUrl: string;\n  tokenUrl: string;\n  scopes: string[];\n  clientIdEnvKey: string;\n  clientSecretEnvKey: string;\n  accessTokenEnvKey?: string;\n  additionalAccessTokenEnvKeys?: string[];\n  refreshTokenEnvKey?: string;\n  authorizationParams?: Record<string, string>;\n  fileOutput?: OAuthAuthorizedUserFileOutput;\n}\n\nexport type ParsedLoginCommand =\n  | { command: \"login\" | \"/login\" | \"/pi-login\"; action: \"setup\" }\n  | {\n      command: \"login\" | \"/login\" | \"/pi-login\";\n      action: \"shared_create\" | \"shared_update\" | \"shared_delete\";\n      name: string;\n    }\n  | { command: \"login\" | \"/login\" | \"/pi-login\"; action: \"shared_list\" }\n  | { command: \"login\" | \"/login\" | \"/pi-login\"; action: \"copy_shared\"; name: string };\n\nconst DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES = [\n  \"https://www.googleapis.com/auth/drive\",\n  \"https://mail.google.com/\",\n  \"https://www.googleapis.com/auth/calendar\",\n  \"https://www.googleapis.com/auth/spreadsheets\",\n  \"https://www.googleapis.com/auth/documents\",\n  \"https://www.googleapis.com/auth/chat.messages.create\",\n];\n\nconst DEFAULT_GOOGLE_CLOUD_SDK_SCOPES = [\n  \"openid\",\n  \"https://www.googleapis.com/auth/userinfo.email\",\n  \"https://www.googleapis.com/auth/cloud-platform\",\n];\n\n// Conservative default: enough for `gh` CLI repo/user/org operations, but\n// without `workflow` (can dispatch CI), `write:packages` (can publish\n// packages), or `project`. Operators who need those can opt in via\n// GITHUB_OAUTH_SCOPES (or MIKAN_GITHUB_OAUTH_SCOPES) to keep the blast radius\n// of a compromised agent host explicit and configurable.\nconst DEFAULT_GITHUB_OAUTH_SCOPES = [\"repo\", \"read:user\", \"user:email\", \"read:org\", \"gist\"];\n\nfunction resolveScopesFromEnv(envKey: string, fallback: string[]): string[] {\n  const raw = readEnv(envKey);\n  if (!raw) return fallback;\n\n  const scopes = raw\n    .split(/[\\s,]+/)\n    .map((scope) => scope.trim())\n    .filter(Boolean);\n\n  return scopes.length > 0 ? scopes : fallback;\n}\n\nfunction resolveGoogleWorkspaceCliScopes(): string[] {\n  return resolveScopesFromEnv(\n    \"GOOGLE_WORKSPACE_CLI_OAUTH_SCOPES\",\n    DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES,\n  );\n}\n\nfunction resolveGoogleCloudSdkScopes(): string[] {\n  return resolveScopesFromEnv(\"GOOGLE_CLOUD_SDK_OAUTH_SCOPES\", DEFAULT_GOOGLE_CLOUD_SDK_SCOPES);\n}\n\nfunction resolveGitHubOAuthScopes(): string[] {\n  return resolveScopesFromEnv(\"GITHUB_OAUTH_SCOPES\", DEFAULT_GITHUB_OAUTH_SCOPES);\n}\n\nfunction getBuiltinOAuthServices(): OAuthService[] {\n  return [\n    {\n      id: \"github\",\n      label: \"GitHub\",\n      aliases: [\"github\", \"github_oauth\", \"gh_oauth\"],\n      authorizationUrl: \"https://github.com/login/oauth/authorize\",\n      tokenUrl: \"https://github.com/login/oauth/access_token\",\n      scopes: resolveGitHubOAuthScopes(),\n      clientIdEnvKey: \"GITHUB_OAUTH_CLIENT_ID\",\n      clientSecretEnvKey: \"GITHUB_OAUTH_CLIENT_SECRET\",\n      accessTokenEnvKey: \"GITHUB_OAUTH_ACCESS_TOKEN\",\n      additionalAccessTokenEnvKeys: [\"GH_TOKEN\"],\n      refreshTokenEnvKey: \"GITHUB_OAUTH_REFRESH_TOKEN\",\n    },\n    {\n      id: \"google_workspace_cli\",\n      label: \"Google Workspace CLI\",\n      aliases: [\"google_workspace_cli\", \"gws\", \"googleworkspace\", \"google-workspace-cli\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveGoogleWorkspaceCliScopes(),\n      clientIdEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gws.json\",\n        targetPath: \"/root/.config/gws/credentials.json\",\n      },\n    },\n    {\n      id: \"google_cloud_sdk\",\n      label: \"Google Cloud SDK (gcloud)\",\n      aliases: [\"google_cloud_sdk\", \"gcloud\", \"google-cloud-sdk\", \"google_cloud\", \"gcp\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveGoogleCloudSdkScopes(),\n      clientIdEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gcloud-adc.json\",\n        targetPath: \"/root/.config/gcloud/application_default_credentials.json\",\n        envKey: \"GOOGLE_APPLICATION_CREDENTIALS\",\n        additionalEnvKeys: [\"CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE\"],\n      },\n    },\n  ];\n}\n\nexport function getOAuthServices(): OAuthService[] {\n  const raw = readEnv(\"OAUTH_SERVICES_JSON\");\n  const builtins = getBuiltinOAuthServices();\n  if (!raw) return builtins;\n\n  let parsed: unknown[];\n  try {\n    parsed = parseJsonValue(raw, Array.isArray, (detail) =>\n      detail === \"unexpected JSON shape\"\n        ? \"expected a JSON array of OAuth service definitions\"\n        : detail,\n    );\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    log.logWarning(\n      detail === \"expected a JSON array of OAuth service definitions\"\n        ? \"Ignoring OAUTH_SERVICES_JSON: expected a JSON array of OAuth service definitions\"\n        : \"Ignoring OAUTH_SERVICES_JSON: invalid JSON\",\n      detail,\n    );\n    return builtins;\n  }\n  try {\n    const custom = parsed\n      .map((serviceValue): OAuthService | null => {\n        if (!isRecord(serviceValue)) return null;\n        const obj = serviceValue;\n        const id = typeof obj.id === \"string\" ? obj.id.trim() : \"\";\n        const label = typeof obj.label === \"string\" ? obj.label.trim() : \"\";\n        const authorizationUrl =\n          typeof obj.authorizationUrl === \"string\" ? obj.authorizationUrl.trim() : \"\";\n        const tokenUrl = typeof obj.tokenUrl === \"string\" ? obj.tokenUrl.trim() : \"\";\n        const clientIdEnvKey =\n          typeof obj.clientIdEnvKey === \"string\" ? obj.clientIdEnvKey.trim() : \"\";\n        const clientSecretEnvKey =\n          typeof obj.clientSecretEnvKey === \"string\" ? obj.clientSecretEnvKey.trim() : \"\";\n        const accessTokenEnvKey =\n          typeof obj.accessTokenEnvKey === \"string\" ? obj.accessTokenEnvKey.trim() : undefined;\n        if (\n          !id ||\n          !label ||\n          !authorizationUrl ||\n          !tokenUrl ||\n          !clientIdEnvKey ||\n          !clientSecretEnvKey\n        ) {\n          return null;\n        }\n\n        let fileOutput: OAuthService[\"fileOutput\"];\n        if (isRecord(obj.fileOutput)) {\n          const fileOutputObj = obj.fileOutput;\n          const type = typeof fileOutputObj.type === \"string\" ? fileOutputObj.type.trim() : \"\";\n          const relativePath =\n            typeof fileOutputObj.relativePath === \"string\" ? fileOutputObj.relativePath.trim() : \"\";\n          const targetPath =\n            typeof fileOutputObj.targetPath === \"string\"\n              ? fileOutputObj.targetPath.trim()\n              : undefined;\n          const envKey =\n            typeof fileOutputObj.envKey === \"string\" ? fileOutputObj.envKey.trim() : undefined;\n          const additionalEnvKeys = Array.isArray(fileOutputObj.additionalEnvKeys)\n            ? fileOutputObj.additionalEnvKeys.filter((v): v is string => typeof v === \"string\")\n            : undefined;\n          if (type === \"authorized_user\" && relativePath) {\n            fileOutput = {\n              type: \"authorized_user\",\n              relativePath,\n              targetPath,\n              envKey,\n              additionalEnvKeys,\n            };\n          }\n        }\n\n        return {\n          id: id.toLowerCase(),\n          label,\n          aliases: Array.isArray(obj.aliases)\n            ? obj.aliases\n                .filter((v): v is string => typeof v === \"string\")\n                .map((v) => v.toLowerCase())\n            : [id.toLowerCase()],\n          authorizationUrl,\n          tokenUrl,\n          scopes: Array.isArray(obj.scopes)\n            ? obj.scopes.filter((v): v is string => typeof v === \"string\")\n            : [],\n          clientIdEnvKey,\n          clientSecretEnvKey,\n          accessTokenEnvKey,\n          additionalAccessTokenEnvKeys: Array.isArray(obj.additionalAccessTokenEnvKeys)\n            ? obj.additionalAccessTokenEnvKeys.filter((v): v is string => typeof v === \"string\")\n            : undefined,\n          refreshTokenEnvKey:\n            typeof obj.refreshTokenEnvKey === \"string\" ? obj.refreshTokenEnvKey.trim() : undefined,\n          authorizationParams: isRecord(obj.authorizationParams)\n            ? Object.fromEntries(\n                Object.entries(obj.authorizationParams).filter(\n                  (authorizationEntry): authorizationEntry is [string, string] =>\n                    typeof authorizationEntry[1] === \"string\",\n                ),\n              )\n            : undefined,\n          fileOutput,\n        };\n      })\n      .filter((service): service is OAuthService => service !== null);\n\n    const byId = new Map<string, OAuthService>();\n    for (const service of builtins) byId.set(service.id, service);\n    for (const service of custom) byId.set(service.id, service);\n    return [...byId.values()];\n  } catch (err) {\n    log.logWarning(\n      \"Failed to apply OAUTH_SERVICES_JSON overrides; using builtin OAuth services\",\n      err instanceof Error ? err.message : String(err),\n    );\n    return builtins;\n  }\n}\n\nexport function resolveOAuthService(input: string): OAuthService | undefined {\n  const normalized = input.trim().toLowerCase();\n  if (!normalized) return undefined;\n  return getOAuthServices().find(\n    (service) => service.id === normalized || service.aliases.includes(normalized),\n  );\n}\n\nconst LOGIN_COMMANDS = [\"login\", \"/login\", \"/pi-login\"] as const;\n\nexport function parseLoginCommand(text: string): ParsedLoginCommand | null {\n  const matched = matchCommand(text, LOGIN_COMMANDS);\n  if (!matched) return null;\n\n  const [subcommand, operation, name, ...extra] = matched.args;\n\n  if (!subcommand) return { command: matched.command, action: \"setup\" };\n\n  if (subcommand.toLowerCase() === \"shared\") {\n    const op = operation?.toLowerCase();\n    if (op === \"list\" && !name && extra.length === 0) {\n      return { command: matched.command, action: \"shared_list\" };\n    }\n    if ((op === \"create\" || op === \"update\" || op === \"delete\") && !!name && extra.length === 0) {\n      return {\n        command: matched.command,\n        action: `shared_${op}` as \"shared_create\" | \"shared_update\" | \"shared_delete\",\n        name,\n      };\n    }\n    return null;\n  }\n\n  if (subcommand.toLowerCase() === \"copy\" && operation && !name && extra.length === 0) {\n    return { command: matched.command, action: \"copy_shared\", name: operation };\n  }\n\n  // Backward-compatible: older `/pi-login gh` / `/pi-login gws` forms opened the\n  // generic login page and let the portal handle provider choice.\n  if (!operation && extra.length === 0) return { command: matched.command, action: \"setup\" };\n\n  return null;\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAsCjC,MAAM,mCAAmC,GAAG;IAC1C,uCAAuC;IACvC,0BAA0B;IAC1B,0CAA0C;IAC1C,8CAA8C;IAC9C,2CAA2C;IAC3C,sDAAsD;CACvD,CAAC;AAEF,MAAM,+BAA+B,GAAG;IACtC,QAAQ;IACR,gDAAgD;IAChD,gDAAgD;CACjD,CAAC;AAEF,0EAA0E;AAC1E,sEAAsE;AACtE,mEAAmE;AACnE,8EAA8E;AAC9E,yDAAyD;AACzD,MAAM,2BAA2B,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAE5F,SAAS,oBAAoB,CAAC,MAAc,EAAE,QAAkB;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAE1B,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED,SAAS,+BAA+B;IACtC,OAAO,oBAAoB,CACzB,mCAAmC,EACnC,mCAAmC,CACpC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO,oBAAoB,CAAC,+BAA+B,EAAE,+BAA+B,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,wBAAwB;IAC/B,OAAO,oBAAoB,CAAC,qBAAqB,EAAE,2BAA2B,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;QACL;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC;YAC/C,gBAAgB,EAAE,0CAA0C;YAC5D,QAAQ,EAAE,6CAA6C;YACvD,MAAM,EAAE,wBAAwB,EAAE;YAClC,cAAc,EAAE,wBAAwB;YACxC,kBAAkB,EAAE,4BAA4B;YAChD,iBAAiB,EAAE,2BAA2B;YAC9C,4BAA4B,EAAE,CAAC,UAAU,CAAC;YAC1C,kBAAkB,EAAE,4BAA4B;SACjD;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,CAAC,sBAAsB,EAAE,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,CAAC;YACnF,gBAAgB,EAAE,8CAA8C;YAChE,QAAQ,EAAE,qCAAqC;YAC/C,MAAM,EAAE,+BAA+B,EAAE;YACzC,cAAc,EAAE,gCAAgC;YAChD,kBAAkB,EAAE,oCAAoC;YACxD,mBAAmB,EAAE;gBACnB,WAAW,EAAE,SAAS;gBACtB,sBAAsB,EAAE,MAAM;gBAC9B,MAAM,EAAE,SAAS;aAClB;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,YAAY,EAAE,UAAU;gBACxB,UAAU,EAAE,oCAAoC;aACjD;SACF;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,2BAA2B;YAClC,OAAO,EAAE,CAAC,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,CAAC;YAClF,gBAAgB,EAAE,8CAA8C;YAChE,QAAQ,EAAE,qCAAqC;YAC/C,MAAM,EAAE,2BAA2B,EAAE;YACrC,cAAc,EAAE,4BAA4B;YAC5C,kBAAkB,EAAE,gCAAgC;YACpD,mBAAmB,EAAE;gBACnB,WAAW,EAAE,SAAS;gBACtB,sBAAsB,EAAE,MAAM;gBAC9B,MAAM,EAAE,SAAS;aAClB;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,YAAY,EAAE,iBAAiB;gBAC/B,UAAU,EAAE,2DAA2D;gBACvE,MAAM,EAAE,gCAAgC;gBACxC,iBAAiB,EAAE,CAAC,wCAAwC,CAAC;aAC9D;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAE1B,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CACrD,MAAM,KAAK,uBAAuB;YAChC,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,MAAM,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,GAAG,CAAC,UAAU,CACZ,MAAM,KAAK,oDAAoD;YAC7D,CAAC,CAAC,kFAAkF;YACpF,CAAC,CAAC,4CAA4C,EAChD,MAAM,CACP,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM;aAClB,GAAG,CAAC,CAAC,YAAY,EAAuB,EAAE;YACzC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,GAAG,GAAG,YAAY,CAAC;YACzB,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,gBAAgB,GACpB,OAAO,GAAG,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM,cAAc,GAClB,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,kBAAkB,GACtB,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,iBAAiB,GACrB,OAAO,GAAG,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,IACE,CAAC,EAAE;gBACH,CAAC,KAAK;gBACN,CAAC,gBAAgB;gBACjB,CAAC,QAAQ;gBACT,CAAC,cAAc;gBACf,CAAC,kBAAkB,EACnB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,UAAsC,CAAC;YAC3C,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC7B,MAAM,aAAa,GAAG,GAAG,CAAC,UAAU,CAAC;gBACrC,MAAM,IAAI,GAAG,OAAO,aAAa,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,MAAM,YAAY,GAChB,OAAO,aAAa,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1F,MAAM,UAAU,GACd,OAAO,aAAa,CAAC,UAAU,KAAK,QAAQ;oBAC1C,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE;oBACjC,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,MAAM,GACV,OAAO,aAAa,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrF,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC;oBACtE,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACnF,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,IAAI,KAAK,iBAAiB,IAAI,YAAY,EAAE,CAAC;oBAC/C,UAAU,GAAG;wBACX,IAAI,EAAE,iBAAiB;wBACvB,YAAY;wBACZ,UAAU;wBACV,MAAM;wBACN,iBAAiB;qBAClB,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,OAAO;gBACL,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE;gBACpB,KAAK;gBACL,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;oBACjC,CAAC,CAAC,GAAG,CAAC,OAAO;yBACR,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;yBACjD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;oBAChC,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;gBACtB,gBAAgB;gBAChB,QAAQ;gBACR,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;oBAC/B,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBAC9D,CAAC,CAAC,EAAE;gBACN,cAAc;gBACd,kBAAkB;gBAClB,iBAAiB;gBACjB,4BAA4B,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;oBAC3E,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;oBACpF,CAAC,CAAC,SAAS;gBACb,kBAAkB,EAChB,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;gBACxF,mBAAmB,EAAE,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC;oBACpD,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAC5C,CAAC,kBAAkB,EAA0C,EAAE,CAC7D,OAAO,kBAAkB,CAAC,CAAC,CAAC,KAAK,QAAQ,CAC5C,CACF;oBACH,CAAC,CAAC,SAAS;gBACb,UAAU;aACX,CAAC;QACJ,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,OAAO,EAA2B,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;QAElE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;QAC7C,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC9D,KAAK,MAAM,OAAO,IAAI,MAAM;YAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,UAAU,CACZ,6EAA6E,EAC7E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,gBAAgB,EAAE,CAAC,IAAI,CAC5B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAC;AAEjE,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAE7D,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAEtE,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC;QACpC,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5F,OAAO;gBACL,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,UAAU,EAAE,EAAyD;gBAC7E,IAAI;aACL,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,SAAS,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC9E,CAAC;IAED,+EAA+E;IAC/E,gEAAgE;IAChE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE3F,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { matchCommand } from \"../commands/parse.js\";\nimport { readEnv } from \"../env.js\";\nimport { isRecord, parseJsonValue } from \"../file-guards.js\";\nimport * as log from \"../log.js\";\n\nexport type LoginCredentialKind = \"api_key\" | \"oauth\";\n\ninterface OAuthAuthorizedUserFileOutput {\n  type: \"authorized_user\";\n  relativePath: string;\n  targetPath?: string;\n  envKey?: string;\n  additionalEnvKeys?: string[];\n}\n\nexport interface OAuthService {\n  id: string;\n  label: string;\n  aliases: string[];\n  authorizationUrl: string;\n  tokenUrl: string;\n  scopes: string[];\n  clientIdEnvKey: string;\n  clientSecretEnvKey: string;\n  accessTokenEnvKey?: string;\n  additionalAccessTokenEnvKeys?: string[];\n  refreshTokenEnvKey?: string;\n  authorizationParams?: Record<string, string>;\n  fileOutput?: OAuthAuthorizedUserFileOutput;\n}\n\nexport type ParsedLoginCommand =\n  | { command: \"login\" | \"/login\" | \"/pi-login\"; action: \"setup\" }\n  | {\n      command: \"login\" | \"/login\" | \"/pi-login\";\n      action: \"shared_create\" | \"shared_update\" | \"shared_delete\";\n      name: string;\n    }\n  | { command: \"login\" | \"/login\" | \"/pi-login\"; action: \"shared_list\" }\n  | { command: \"login\" | \"/login\" | \"/pi-login\"; action: \"copy_shared\"; name: string };\n\nconst DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES = [\n  \"https://www.googleapis.com/auth/drive\",\n  \"https://mail.google.com/\",\n  \"https://www.googleapis.com/auth/calendar\",\n  \"https://www.googleapis.com/auth/spreadsheets\",\n  \"https://www.googleapis.com/auth/documents\",\n  \"https://www.googleapis.com/auth/chat.messages.create\",\n];\n\nconst DEFAULT_GOOGLE_CLOUD_SDK_SCOPES = [\n  \"openid\",\n  \"https://www.googleapis.com/auth/userinfo.email\",\n  \"https://www.googleapis.com/auth/cloud-platform\",\n];\n\n// Conservative default: enough for `gh` CLI repo/user/org operations, but\n// without `workflow` (can dispatch CI), `write:packages` (can publish\n// packages), or `project`. Operators who need those can opt in via\n// GITHUB_OAUTH_SCOPES (or MIKAN_GITHUB_OAUTH_SCOPES) to keep the blast radius\n// of a compromised agent host explicit and configurable.\nconst DEFAULT_GITHUB_OAUTH_SCOPES = [\"repo\", \"read:user\", \"user:email\", \"read:org\", \"gist\"];\n\nfunction resolveScopesFromEnv(envKey: string, fallback: string[]): string[] {\n  const raw = readEnv(envKey);\n  if (!raw) return fallback;\n\n  const scopes = raw\n    .split(/[\\s,]+/)\n    .map((scope) => scope.trim())\n    .filter(Boolean);\n\n  return scopes.length > 0 ? scopes : fallback;\n}\n\nfunction resolveGoogleWorkspaceCliScopes(): string[] {\n  return resolveScopesFromEnv(\n    \"GOOGLE_WORKSPACE_CLI_OAUTH_SCOPES\",\n    DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES,\n  );\n}\n\nfunction resolveGoogleCloudSdkScopes(): string[] {\n  return resolveScopesFromEnv(\"GOOGLE_CLOUD_SDK_OAUTH_SCOPES\", DEFAULT_GOOGLE_CLOUD_SDK_SCOPES);\n}\n\nfunction resolveGitHubOAuthScopes(): string[] {\n  return resolveScopesFromEnv(\"GITHUB_OAUTH_SCOPES\", DEFAULT_GITHUB_OAUTH_SCOPES);\n}\n\nfunction getBuiltinOAuthServices(): OAuthService[] {\n  return [\n    {\n      id: \"github\",\n      label: \"GitHub\",\n      aliases: [\"github\", \"github_oauth\", \"gh_oauth\"],\n      authorizationUrl: \"https://github.com/login/oauth/authorize\",\n      tokenUrl: \"https://github.com/login/oauth/access_token\",\n      scopes: resolveGitHubOAuthScopes(),\n      clientIdEnvKey: \"GITHUB_OAUTH_CLIENT_ID\",\n      clientSecretEnvKey: \"GITHUB_OAUTH_CLIENT_SECRET\",\n      accessTokenEnvKey: \"GITHUB_OAUTH_ACCESS_TOKEN\",\n      additionalAccessTokenEnvKeys: [\"GH_TOKEN\"],\n      refreshTokenEnvKey: \"GITHUB_OAUTH_REFRESH_TOKEN\",\n    },\n    {\n      id: \"google_workspace_cli\",\n      label: \"Google Workspace CLI\",\n      aliases: [\"google_workspace_cli\", \"gws\", \"googleworkspace\", \"google-workspace-cli\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveGoogleWorkspaceCliScopes(),\n      clientIdEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gws.json\",\n        targetPath: \"/root/.config/gws/credentials.json\",\n      },\n    },\n    {\n      id: \"google_cloud_sdk\",\n      label: \"Google Cloud SDK (gcloud)\",\n      aliases: [\"google_cloud_sdk\", \"gcloud\", \"google-cloud-sdk\", \"google_cloud\", \"gcp\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveGoogleCloudSdkScopes(),\n      clientIdEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gcloud-adc.json\",\n        targetPath: \"/root/.config/gcloud/application_default_credentials.json\",\n        envKey: \"GOOGLE_APPLICATION_CREDENTIALS\",\n        additionalEnvKeys: [\"CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE\"],\n      },\n    },\n  ];\n}\n\nexport function getOAuthServices(): OAuthService[] {\n  const raw = readEnv(\"OAUTH_SERVICES_JSON\");\n  const builtins = getBuiltinOAuthServices();\n  if (!raw) return builtins;\n\n  let parsed: unknown[];\n  try {\n    parsed = parseJsonValue(raw, Array.isArray, (detail) =>\n      detail === \"unexpected JSON shape\"\n        ? \"expected a JSON array of OAuth service definitions\"\n        : detail,\n    );\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    log.logWarning(\n      detail === \"expected a JSON array of OAuth service definitions\"\n        ? \"Ignoring OAUTH_SERVICES_JSON: expected a JSON array of OAuth service definitions\"\n        : \"Ignoring OAUTH_SERVICES_JSON: invalid JSON\",\n      detail,\n    );\n    return builtins;\n  }\n  try {\n    const custom = parsed\n      .map((serviceValue): OAuthService | null => {\n        if (!isRecord(serviceValue)) return null;\n        const obj = serviceValue;\n        const id = typeof obj.id === \"string\" ? obj.id.trim() : \"\";\n        const label = typeof obj.label === \"string\" ? obj.label.trim() : \"\";\n        const authorizationUrl =\n          typeof obj.authorizationUrl === \"string\" ? obj.authorizationUrl.trim() : \"\";\n        const tokenUrl = typeof obj.tokenUrl === \"string\" ? obj.tokenUrl.trim() : \"\";\n        const clientIdEnvKey =\n          typeof obj.clientIdEnvKey === \"string\" ? obj.clientIdEnvKey.trim() : \"\";\n        const clientSecretEnvKey =\n          typeof obj.clientSecretEnvKey === \"string\" ? obj.clientSecretEnvKey.trim() : \"\";\n        const accessTokenEnvKey =\n          typeof obj.accessTokenEnvKey === \"string\" ? obj.accessTokenEnvKey.trim() : undefined;\n        if (\n          !id ||\n          !label ||\n          !authorizationUrl ||\n          !tokenUrl ||\n          !clientIdEnvKey ||\n          !clientSecretEnvKey\n        ) {\n          return null;\n        }\n\n        let fileOutput: OAuthService[\"fileOutput\"];\n        if (isRecord(obj.fileOutput)) {\n          const fileOutputObj = obj.fileOutput;\n          const type = typeof fileOutputObj.type === \"string\" ? fileOutputObj.type.trim() : \"\";\n          const relativePath =\n            typeof fileOutputObj.relativePath === \"string\" ? fileOutputObj.relativePath.trim() : \"\";\n          const targetPath =\n            typeof fileOutputObj.targetPath === \"string\"\n              ? fileOutputObj.targetPath.trim()\n              : undefined;\n          const envKey =\n            typeof fileOutputObj.envKey === \"string\" ? fileOutputObj.envKey.trim() : undefined;\n          const additionalEnvKeys = Array.isArray(fileOutputObj.additionalEnvKeys)\n            ? fileOutputObj.additionalEnvKeys.filter((v): v is string => typeof v === \"string\")\n            : undefined;\n          if (type === \"authorized_user\" && relativePath) {\n            fileOutput = {\n              type: \"authorized_user\",\n              relativePath,\n              targetPath,\n              envKey,\n              additionalEnvKeys,\n            };\n          }\n        }\n\n        return {\n          id: id.toLowerCase(),\n          label,\n          aliases: Array.isArray(obj.aliases)\n            ? obj.aliases\n                .filter((v): v is string => typeof v === \"string\")\n                .map((v) => v.toLowerCase())\n            : [id.toLowerCase()],\n          authorizationUrl,\n          tokenUrl,\n          scopes: Array.isArray(obj.scopes)\n            ? obj.scopes.filter((v): v is string => typeof v === \"string\")\n            : [],\n          clientIdEnvKey,\n          clientSecretEnvKey,\n          accessTokenEnvKey,\n          additionalAccessTokenEnvKeys: Array.isArray(obj.additionalAccessTokenEnvKeys)\n            ? obj.additionalAccessTokenEnvKeys.filter((v): v is string => typeof v === \"string\")\n            : undefined,\n          refreshTokenEnvKey:\n            typeof obj.refreshTokenEnvKey === \"string\" ? obj.refreshTokenEnvKey.trim() : undefined,\n          authorizationParams: isRecord(obj.authorizationParams)\n            ? Object.fromEntries(\n                Object.entries(obj.authorizationParams).filter(\n                  (authorizationEntry): authorizationEntry is [string, string] =>\n                    typeof authorizationEntry[1] === \"string\",\n                ),\n              )\n            : undefined,\n          fileOutput,\n        };\n      })\n      .filter((service): service is OAuthService => service !== null);\n\n    const byId = new Map<string, OAuthService>();\n    for (const service of builtins) byId.set(service.id, service);\n    for (const service of custom) byId.set(service.id, service);\n    return [...byId.values()];\n  } catch (err) {\n    log.logWarning(\n      \"Failed to apply OAUTH_SERVICES_JSON overrides; using builtin OAuth services\",\n      err instanceof Error ? err.message : String(err),\n    );\n    return builtins;\n  }\n}\n\nexport function resolveOAuthService(input: string): OAuthService | undefined {\n  const normalized = input.trim().toLowerCase();\n  if (!normalized) return undefined;\n  return getOAuthServices().find(\n    (service) => service.id === normalized || service.aliases.includes(normalized),\n  );\n}\n\nconst LOGIN_COMMANDS = [\"login\", \"/login\", \"/pi-login\"] as const;\n\nexport function parseLoginCommand(text: string): ParsedLoginCommand | null {\n  const matched = matchCommand(text, LOGIN_COMMANDS);\n  if (!matched) return null;\n\n  const [subcommand, operation, name, ...extra] = matched.args;\n\n  if (!subcommand) return { command: matched.command, action: \"setup\" };\n\n  if (subcommand.toLowerCase() === \"shared\") {\n    const op = operation?.toLowerCase();\n    if (op === \"list\" && !name && extra.length === 0) {\n      return { command: matched.command, action: \"shared_list\" };\n    }\n    if ((op === \"create\" || op === \"update\" || op === \"delete\") && !!name && extra.length === 0) {\n      return {\n        command: matched.command,\n        action: `shared_${op}` as \"shared_create\" | \"shared_update\" | \"shared_delete\",\n        name,\n      };\n    }\n    return null;\n  }\n\n  if (subcommand.toLowerCase() === \"copy\" && operation && !name && extra.length === 0) {\n    return { command: matched.command, action: \"copy_shared\", name: operation };\n  }\n\n  // Backward-compatible: older `/pi-login gh` / `/pi-login gws` forms opened the\n  // generic login page and let the portal handle provider choice.\n  if (!operation && extra.length === 0) return { command: matched.command, action: \"setup\" };\n\n  return null;\n}\n"]}