@geminixiang/mikan 0.5.2 → 0.5.3

package/dist/web/admin/provider-models.js

@@ -48,7 +48,7 @@ async function fetchProviderModelIds(registry, provider) {
         return modelIds;
     }
     catch {
-        return new Set();
+        return undefined;
     }
 }
 async function fetchOpenAiModelIds(apiKey) {
@@ -83,7 +83,9 @@ async function fetchWithTimeout(url, init) {
     }
 }
 function modelIsListed(providerModelIds, registryModelId) {
-    return providerModelIds.size === 0 || providerModelIds.has(registryModelId);
+    return providerModelIds
+        ? providerModelIds.size === 0 || providerModelIds.has(registryModelId)
+        : false;
 }
 function hashApiKey(apiKey) {
     return createHash("sha256").update(apiKey).digest("hex").slice(0, 16);

package/dist/web/admin/provider-models.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-models.js","sourceRoot":"","sources":["../../../src/web/admin/provider-models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAUpC,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAO9B,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAoC,CAAC;AAExE,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,QAAuB,EACvB,MAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE;QACjE,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzE,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;gBAC7C,MAAM,EAAE,aAAa,CAAC,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY;aAC/E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,EAAU;IACnD,OAAO,GAAG,QAAQ,IAAI,EAAE,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAoB;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,QAAuB,EACvB,QAAgB;IAEhB,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,IAAI,GAAG,EAAU,CAAC;IAEhF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,GAAG,EAAU,CAAC;IAEtC,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;IAEpE,IAAI,CAAC;QACH,MAAM,QAAQ,GACZ,QAAQ,KAAK,QAAQ;YACnB,CAAC,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC;YACnC,CAAC,CAAC,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC3C,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;YACpC,QAAQ;SACT,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAU,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAc;IAC/C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,kCAAkC,EAAE;QAC1E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuC,CAAC;IAC3E,OAAO,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,MAAc;IAClD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,qCAAqC,EAAE;QAC7E,OAAO,EAAE;YACP,mBAAmB,EAAE,YAAY;YACjC,WAAW,EAAE,MAAM;SACpB;KACF,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuC,CAAC;IAC3E,OAAO,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAiB;IAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,gBAA6B,EAAE,eAAuB;IAC3E,OAAO,gBAAgB,CAAC,IAAI,KAAK,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import { createHash } from \"crypto\";\nimport type { Api, Model } from \"@earendil-works/pi-ai\";\nimport type { ModelRegistry } from \"@earendil-works/pi-coding-agent\";\n\ntype AdminModelStatus = \"available\" | \"unverified\";\n\ninterface AdminModelAccessStatus {\n  status: AdminModelStatus;\n}\n\nconst CACHE_TTL_MS = 5 * 60 * 1000;\nconst PROBE_TIMEOUT_MS = 3000;\n\ninterface ProviderModelsCacheEntry {\n  expiresAt: number;\n  modelIds: Set<string>;\n}\n\nconst providerModelsCache = new Map<string, ProviderModelsCacheEntry>();\n\nexport async function resolveAdminModelAccessStatuses(\n  registry: ModelRegistry,\n  models: Model<Api>[],\n): Promise<Map<string, AdminModelAccessStatus>> {\n  const result = new Map<string, AdminModelAccessStatus>();\n  const byProvider = groupModelsByProvider(models);\n\n  await Promise.all(\n    [...byProvider.entries()].map(async ([provider, providerModels]) => {\n      const providerModelIds = await fetchProviderModelIds(registry, provider);\n      for (const model of providerModels) {\n        result.set(modelKey(model.provider, model.id), {\n          status: modelIsListed(providerModelIds, model.id) ? \"available\" : \"unverified\",\n        });\n      }\n    }),\n  );\n\n  return result;\n}\n\nexport function modelKey(provider: string, id: string): string {\n  return `${provider}/${id}`;\n}\n\nfunction groupModelsByProvider(models: Model<Api>[]): Map<string, Model<Api>[]> {\n  const groups = new Map<string, Model<Api>[]>();\n  for (const model of models) {\n    const group = groups.get(model.provider) ?? [];\n    group.push(model);\n    groups.set(model.provider, group);\n  }\n  return groups;\n}\n\nasync function fetchProviderModelIds(\n  registry: ModelRegistry,\n  provider: string,\n): Promise<Set<string>> {\n  if (provider !== \"openai\" && provider !== \"anthropic\") return new Set<string>();\n\n  const apiKey = await registry.getApiKeyForProvider(provider);\n  if (!apiKey) return new Set<string>();\n\n  const cacheKey = `${provider}:${hashApiKey(apiKey)}`;\n  const cached = providerModelsCache.get(cacheKey);\n  if (cached && cached.expiresAt > Date.now()) return cached.modelIds;\n\n  try {\n    const modelIds =\n      provider === \"openai\"\n        ? await fetchOpenAiModelIds(apiKey)\n        : await fetchAnthropicModelIds(apiKey);\n    providerModelsCache.set(cacheKey, {\n      expiresAt: Date.now() + CACHE_TTL_MS,\n      modelIds,\n    });\n    return modelIds;\n  } catch {\n    return new Set<string>();\n  }\n}\n\nasync function fetchOpenAiModelIds(apiKey: string): Promise<Set<string>> {\n  const response = await fetchWithTimeout(\"https://api.openai.com/v1/models\", {\n    headers: { Authorization: `Bearer ${apiKey}` },\n  });\n  if (!response.ok) throw new Error(`OpenAI models request failed: ${response.status}`);\n  const body = (await response.json()) as { data?: Array<{ id?: unknown }> };\n  return new Set((body.data ?? []).map((model) => model.id).filter(isString));\n}\n\nasync function fetchAnthropicModelIds(apiKey: string): Promise<Set<string>> {\n  const response = await fetchWithTimeout(\"https://api.anthropic.com/v1/models\", {\n    headers: {\n      \"anthropic-version\": \"2023-06-01\",\n      \"x-api-key\": apiKey,\n    },\n  });\n  if (!response.ok) throw new Error(`Anthropic models request failed: ${response.status}`);\n  const body = (await response.json()) as { data?: Array<{ id?: unknown }> };\n  return new Set((body.data ?? []).map((model) => model.id).filter(isString));\n}\n\nasync function fetchWithTimeout(url: string, init: RequestInit): Promise<Response> {\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);\n  try {\n    return await fetch(url, { ...init, signal: controller.signal });\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\nfunction modelIsListed(providerModelIds: Set<string>, registryModelId: string): boolean {\n  return providerModelIds.size === 0 || providerModelIds.has(registryModelId);\n}\n\nfunction hashApiKey(apiKey: string): string {\n  return createHash(\"sha256\").update(apiKey).digest(\"hex\").slice(0, 16);\n}\n\nfunction isString(value: unknown): value is string {\n  return typeof value === \"string\" && value.length > 0;\n}\n"]}
+{"version":3,"file":"provider-models.js","sourceRoot":"","sources":["../../../src/web/admin/provider-models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAUpC,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAO9B,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAoC,CAAC;AAExE,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,QAAuB,EACvB,MAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkC,CAAC;IACzD,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAEjD,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,EAAE;QACjE,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACzE,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE;gBAC7C,MAAM,EAAE,aAAa,CAAC,gBAAgB,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY;aAC/E,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,EAAU;IACnD,OAAO,GAAG,QAAQ,IAAI,EAAE,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAoB;IACjD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC/C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,QAAuB,EACvB,QAAgB;IAEhB,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,WAAW;QAAE,OAAO,IAAI,GAAG,EAAU,CAAC;IAEhF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,GAAG,EAAU,CAAC;IAEtC,MAAM,QAAQ,GAAG,GAAG,QAAQ,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;IACrD,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;IAEpE,IAAI,CAAC;QACH,MAAM,QAAQ,GACZ,QAAQ,KAAK,QAAQ;YACnB,CAAC,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC;YACnC,CAAC,CAAC,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC3C,mBAAmB,CAAC,GAAG,CAAC,QAAQ,EAAE;YAChC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY;YACpC,QAAQ;SACT,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,MAAc;IAC/C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,kCAAkC,EAAE;QAC1E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuC,CAAC;IAC3E,OAAO,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,MAAc;IAClD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,qCAAqC,EAAE;QAC7E,OAAO,EAAE;YACP,mBAAmB,EAAE,YAAY;YACjC,WAAW,EAAE,MAAM;SACpB;KACF,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuC,CAAC;IAC3E,OAAO,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAiB;IAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,gBAAgB,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,gBAAyC,EACzC,eAAuB;IAEvB,OAAO,gBAAgB;QACrB,CAAC,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,eAAe,CAAC;QACtE,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC","sourcesContent":["import { createHash } from \"crypto\";\nimport type { Api, Model } from \"@earendil-works/pi-ai\";\nimport type { ModelRegistry } from \"@earendil-works/pi-coding-agent\";\n\ntype AdminModelStatus = \"available\" | \"unverified\";\n\ninterface AdminModelAccessStatus {\n  status: AdminModelStatus;\n}\n\nconst CACHE_TTL_MS = 5 * 60 * 1000;\nconst PROBE_TIMEOUT_MS = 3000;\n\ninterface ProviderModelsCacheEntry {\n  expiresAt: number;\n  modelIds: Set<string>;\n}\n\nconst providerModelsCache = new Map<string, ProviderModelsCacheEntry>();\n\nexport async function resolveAdminModelAccessStatuses(\n  registry: ModelRegistry,\n  models: Model<Api>[],\n): Promise<Map<string, AdminModelAccessStatus>> {\n  const result = new Map<string, AdminModelAccessStatus>();\n  const byProvider = groupModelsByProvider(models);\n\n  await Promise.all(\n    [...byProvider.entries()].map(async ([provider, providerModels]) => {\n      const providerModelIds = await fetchProviderModelIds(registry, provider);\n      for (const model of providerModels) {\n        result.set(modelKey(model.provider, model.id), {\n          status: modelIsListed(providerModelIds, model.id) ? \"available\" : \"unverified\",\n        });\n      }\n    }),\n  );\n\n  return result;\n}\n\nexport function modelKey(provider: string, id: string): string {\n  return `${provider}/${id}`;\n}\n\nfunction groupModelsByProvider(models: Model<Api>[]): Map<string, Model<Api>[]> {\n  const groups = new Map<string, Model<Api>[]>();\n  for (const model of models) {\n    const group = groups.get(model.provider) ?? [];\n    group.push(model);\n    groups.set(model.provider, group);\n  }\n  return groups;\n}\n\nasync function fetchProviderModelIds(\n  registry: ModelRegistry,\n  provider: string,\n): Promise<Set<string> | undefined> {\n  if (provider !== \"openai\" && provider !== \"anthropic\") return new Set<string>();\n\n  const apiKey = await registry.getApiKeyForProvider(provider);\n  if (!apiKey) return new Set<string>();\n\n  const cacheKey = `${provider}:${hashApiKey(apiKey)}`;\n  const cached = providerModelsCache.get(cacheKey);\n  if (cached && cached.expiresAt > Date.now()) return cached.modelIds;\n\n  try {\n    const modelIds =\n      provider === \"openai\"\n        ? await fetchOpenAiModelIds(apiKey)\n        : await fetchAnthropicModelIds(apiKey);\n    providerModelsCache.set(cacheKey, {\n      expiresAt: Date.now() + CACHE_TTL_MS,\n      modelIds,\n    });\n    return modelIds;\n  } catch {\n    return undefined;\n  }\n}\n\nasync function fetchOpenAiModelIds(apiKey: string): Promise<Set<string>> {\n  const response = await fetchWithTimeout(\"https://api.openai.com/v1/models\", {\n    headers: { Authorization: `Bearer ${apiKey}` },\n  });\n  if (!response.ok) throw new Error(`OpenAI models request failed: ${response.status}`);\n  const body = (await response.json()) as { data?: Array<{ id?: unknown }> };\n  return new Set((body.data ?? []).map((model) => model.id).filter(isString));\n}\n\nasync function fetchAnthropicModelIds(apiKey: string): Promise<Set<string>> {\n  const response = await fetchWithTimeout(\"https://api.anthropic.com/v1/models\", {\n    headers: {\n      \"anthropic-version\": \"2023-06-01\",\n      \"x-api-key\": apiKey,\n    },\n  });\n  if (!response.ok) throw new Error(`Anthropic models request failed: ${response.status}`);\n  const body = (await response.json()) as { data?: Array<{ id?: unknown }> };\n  return new Set((body.data ?? []).map((model) => model.id).filter(isString));\n}\n\nasync function fetchWithTimeout(url: string, init: RequestInit): Promise<Response> {\n  const controller = new AbortController();\n  const timeout = setTimeout(() => controller.abort(), PROBE_TIMEOUT_MS);\n  try {\n    return await fetch(url, { ...init, signal: controller.signal });\n  } finally {\n    clearTimeout(timeout);\n  }\n}\n\nfunction modelIsListed(\n  providerModelIds: Set<string> | undefined,\n  registryModelId: string,\n): boolean {\n  return providerModelIds\n    ? providerModelIds.size === 0 || providerModelIds.has(registryModelId)\n    : false;\n}\n\nfunction hashApiKey(apiKey: string): string {\n  return createHash(\"sha256\").update(apiKey).digest(\"hex\").slice(0, 16);\n}\n\nfunction isString(value: unknown): value is string {\n  return typeof value === \"string\" && value.length > 0;\n}\n"]}

package/dist/web/admin/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/web/admin/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,qBAAa,uBAAwB,SAAQ,kBAAkB,CAAC,UAAU,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,YAAY,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,UAAU,CAkBb;CACF"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/web/admin/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAI7C,qBAAa,uBAAwB,SAAQ,kBAAkB,CAAC,UAAU,CAAC;IACzE,MAAM,CAAC,IAAI,EAAE;QACX,QAAQ,EAAE,YAAY,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,GAAG,UAAU,CAUb;CACF"}

package/dist/web/admin/store.js

@@ -2,22 +2,13 @@ import { InMemoryTokenStore } from "../token-store.js";
 const TTL_MS = 30 * 60 * 1000;
 export class InMemoryAdminTokenStore extends InMemoryTokenStore {
     create(args) {
-        for (const [key, t] of this.tokens) {
-            if (t.platform === args.platform && t.platformUserId === args.platformUserId) {
-                this.tokens.delete(key);
-            }
-        }
-        const { token, expiresAt } = this.mintToken(TTL_MS);
-        const record = {
-            token,
+        this.deleteWhere((token) => token.platform === args.platform && token.platformUserId === args.platformUserId);
+        return this.createRecord(TTL_MS, {
             platform: args.platform,
             platformUserId: args.platformUserId,
             ...(args.platformUserName ? { platformUserName: args.platformUserName } : {}),
             conversationId: args.conversationId,
-            expiresAt,
-        };
-        this.tokens.set(token, record);
-        return record;
+        });
     }
 }
 //# sourceMappingURL=store.js.map

package/dist/web/admin/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/web/admin/store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAIvD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9B,MAAM,OAAO,uBAAwB,SAAQ,kBAA8B;IACzE,MAAM,CAAC,IAKN;QACC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC7E,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,MAAM,GAAe;YACzB,KAAK;YACL,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS;SACV,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;CACF","sourcesContent":["import type { PlatformName } from \"../../adapter.js\";\nimport { InMemoryTokenStore } from \"../token-store.js\";\nexport type { AdminToken } from \"./types.js\";\nimport type { AdminToken } from \"./types.js\";\n\nconst TTL_MS = 30 * 60 * 1000;\n\nexport class InMemoryAdminTokenStore extends InMemoryTokenStore<AdminToken> {\n  create(args: {\n    platform: PlatformName;\n    platformUserId: string;\n    conversationId: string;\n    platformUserName?: string;\n  }): AdminToken {\n    for (const [key, t] of this.tokens) {\n      if (t.platform === args.platform && t.platformUserId === args.platformUserId) {\n        this.tokens.delete(key);\n      }\n    }\n\n    const { token, expiresAt } = this.mintToken(TTL_MS);\n    const record: AdminToken = {\n      token,\n      platform: args.platform,\n      platformUserId: args.platformUserId,\n      ...(args.platformUserName ? { platformUserName: args.platformUserName } : {}),\n      conversationId: args.conversationId,\n      expiresAt,\n    };\n    this.tokens.set(token, record);\n    return record;\n  }\n}\n"]}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/web/admin/store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAIvD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9B,MAAM,OAAO,uBAAwB,SAAQ,kBAA8B;IACzE,MAAM,CAAC,IAKN;QACC,IAAI,CAAC,WAAW,CACd,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc,CAC5F,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YAC/B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["import type { PlatformName } from \"../../adapter.js\";\nimport { InMemoryTokenStore } from \"../token-store.js\";\nexport type { AdminToken } from \"./types.js\";\nimport type { AdminToken } from \"./types.js\";\n\nconst TTL_MS = 30 * 60 * 1000;\n\nexport class InMemoryAdminTokenStore extends InMemoryTokenStore<AdminToken> {\n  create(args: {\n    platform: PlatformName;\n    platformUserId: string;\n    conversationId: string;\n    platformUserName?: string;\n  }): AdminToken {\n    this.deleteWhere(\n      (token) => token.platform === args.platform && token.platformUserId === args.platformUserId,\n    );\n    return this.createRecord(TTL_MS, {\n      platform: args.platform,\n      platformUserId: args.platformUserId,\n      ...(args.platformUserName ? { platformUserName: args.platformUserName } : {}),\n      conversationId: args.conversationId,\n    });\n  }\n}\n"]}

package/dist/web/admin/types.d.ts

@@ -1,8 +1,10 @@
-import type { PlatformName, RunningSession } from "../../adapter.js";
+import type { MessagingBot, PlatformName, RunningSession } from "../../adapter.js";
 import type { LinkTokenStoreLike } from "../../commands/types.js";
-import type { TokenRecord } from "../types.js";
+import type { SandboxConfig } from "../../sandbox/index.js";
 import type { VaultManager } from "../../vault/index.js";
 import type { InMemorySessionViewTokenStore } from "../session-view/store.js";
+import type { TokenRecord } from "../types.js";
+import type { InMemoryAdminTokenStore } from "./store.js";
 export interface AdminRuntimeBridge {
     getRunningSessions(): RunningSession[];
     switchConversationModel(conversationId: string, provider: string, model: string): boolean;
@@ -11,12 +13,12 @@ export interface AdminServices {
     vaultManager: VaultManager;
     linkTokenStore: LinkTokenStoreLike;
     sessionViewTokenStore?: InMemorySessionViewTokenStore;
-    adminTokenStore: import("./store.js").InMemoryAdminTokenStore;
+    adminTokenStore: InMemoryAdminTokenStore;
     portalBaseUrl?: string;
     workingDir?: string;
-    sandbox?: import("../../sandbox/index.js").SandboxConfig;
+    sandbox?: SandboxConfig;
     runtime?: AdminRuntimeBridge;
-    botsByPlatform?: Partial<Record<PlatformName, import("../../adapter.js").MessagingBot>>;
+    botsByPlatform?: Partial<Record<PlatformName, MessagingBot>>;
 }
 export interface AdminToken extends TokenRecord {
     platform: PlatformName;

package/dist/web/admin/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/web/admin/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAE9E,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,IAAI,cAAc,EAAE,CAAC;IACvC,uBAAuB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC3F;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD,eAAe,EAAE,OAAO,YAAY,EAAE,uBAAuB,CAAC;IAC9D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,wBAAwB,EAAE,aAAa,CAAC;IACzD,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,kBAAkB,EAAE,YAAY,CAAC,CAAC,CAAC;CACzF;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,cAAc,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/web/admin/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACnF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAC9E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAE1D,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,IAAI,cAAc,EAAE,CAAC;IACvC,uBAAuB,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;CAC3F;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD,eAAe,EAAE,uBAAuB,CAAC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,cAAc,EAAE,MAAM,CAAC;CACxB"}

package/dist/web/admin/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/web/admin/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { PlatformName, RunningSession } from \"../../adapter.js\";\nimport type { LinkTokenStoreLike } from \"../../commands/types.js\";\nimport type { TokenRecord } from \"../types.js\";\nimport type { VaultManager } from \"../../vault/index.js\";\nimport type { InMemorySessionViewTokenStore } from \"../session-view/store.js\";\n\nexport interface AdminRuntimeBridge {\n  getRunningSessions(): RunningSession[];\n  switchConversationModel(conversationId: string, provider: string, model: string): boolean;\n}\n\nexport interface AdminServices {\n  vaultManager: VaultManager;\n  linkTokenStore: LinkTokenStoreLike;\n  sessionViewTokenStore?: InMemorySessionViewTokenStore;\n  adminTokenStore: import(\"./store.js\").InMemoryAdminTokenStore;\n  portalBaseUrl?: string;\n  workingDir?: string;\n  sandbox?: import(\"../../sandbox/index.js\").SandboxConfig;\n  runtime?: AdminRuntimeBridge;\n  botsByPlatform?: Partial<Record<PlatformName, import(\"../../adapter.js\").MessagingBot>>;\n}\n\nexport interface AdminToken extends TokenRecord {\n  platform: PlatformName;\n  platformUserId: string;\n  platformUserName?: string;\n  /** The conversation where /admin was invoked. Default scope for the 3 sub-pages. */\n  conversationId: string;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/web/admin/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { MessagingBot, PlatformName, RunningSession } from \"../../adapter.js\";\nimport type { LinkTokenStoreLike } from \"../../commands/types.js\";\nimport type { SandboxConfig } from \"../../sandbox/index.js\";\nimport type { VaultManager } from \"../../vault/index.js\";\nimport type { InMemorySessionViewTokenStore } from \"../session-view/store.js\";\nimport type { TokenRecord } from \"../types.js\";\nimport type { InMemoryAdminTokenStore } from \"./store.js\";\n\nexport interface AdminRuntimeBridge {\n  getRunningSessions(): RunningSession[];\n  switchConversationModel(conversationId: string, provider: string, model: string): boolean;\n}\n\nexport interface AdminServices {\n  vaultManager: VaultManager;\n  linkTokenStore: LinkTokenStoreLike;\n  sessionViewTokenStore?: InMemorySessionViewTokenStore;\n  adminTokenStore: InMemoryAdminTokenStore;\n  portalBaseUrl?: string;\n  workingDir?: string;\n  sandbox?: SandboxConfig;\n  runtime?: AdminRuntimeBridge;\n  botsByPlatform?: Partial<Record<PlatformName, MessagingBot>>;\n}\n\nexport interface AdminToken extends TokenRecord {\n  platform: PlatformName;\n  platformUserId: string;\n  platformUserName?: string;\n  /** The conversation where /admin was invoked. Default scope for the 3 sub-pages. */\n  conversationId: string;\n}\n"]}

package/dist/web/login/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/web/login/oauth.ts"],"names":[],"mappings":"AAKA,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AA4MnE,wBAAgB,gBAAgB,IAAI,YAAY,EAAE,CA8BjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAM3E;AAID,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CA+BzE"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/web/login/oauth.ts"],"names":[],"mappings":"AAKA,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAyOnE,wBAAgB,gBAAgB,IAAI,YAAY,EAAE,CA8BjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAM3E;AAID,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CA+BzE"}

package/dist/web/login/oauth.js

@@ -115,21 +115,27 @@ function parseOAuthService(value, index) {
         log.logWarning(`Skipping OAUTH_SERVICES_JSON[${index}]${labelForLog}: missing ${missing.join(", ")}`);
         return null;
     }
+    const aliases = parseStringArray(value.aliases, "aliases", index, id);
+    if (aliases === null)
+        return null;
+    const scopes = parseStringArray(value.scopes, "scopes", index, id);
+    if (scopes === null)
+        return null;
+    const authorizationParams = parseStringRecord(value.authorizationParams, "authorizationParams", index, id);
+    if (authorizationParams === null)
+        return null;
     const accessTokenEnvKeys = [];
     if (typeof value.accessTokenEnvKey === "string" && value.accessTokenEnvKey.trim()) {
         accessTokenEnvKeys.push(value.accessTokenEnvKey.trim());
     }
-    if (Array.isArray(value.additionalAccessTokenEnvKeys)) {
-        for (const key of value.additionalAccessTokenEnvKeys) {
-            if (typeof key === "string" && key.trim())
-                accessTokenEnvKeys.push(key.trim());
-        }
-    }
-    if (Array.isArray(value.accessTokenEnvKeys)) {
-        for (const key of value.accessTokenEnvKeys) {
-            if (typeof key === "string" && key.trim() && !accessTokenEnvKeys.includes(key.trim())) {
-                accessTokenEnvKeys.push(key.trim());
-            }
+    for (const field of ["additionalAccessTokenEnvKeys", "accessTokenEnvKeys"]) {
+        const keys = parseStringArray(value[field], field, index, id);
+        if (keys === null)
+            return null;
+        for (const key of keys ?? []) {
+            const trimmed = key.trim();
+            if (trimmed && !accessTokenEnvKeys.includes(trimmed))
+                accessTokenEnvKeys.push(trimmed);
         }
     }
     let fileOutput;
@@ -139,9 +145,9 @@ function parseOAuthService(value, index) {
         const relativePath = typeof fileOutputObj.relativePath === "string" ? fileOutputObj.relativePath.trim() : "";
         const targetPath = typeof fileOutputObj.targetPath === "string" ? fileOutputObj.targetPath.trim() : undefined;
         const envKey = typeof fileOutputObj.envKey === "string" ? fileOutputObj.envKey.trim() : undefined;
-        const additionalEnvKeys = Array.isArray(fileOutputObj.additionalEnvKeys)
-            ? fileOutputObj.additionalEnvKeys.filter((v) => typeof v === "string")
-            : undefined;
+        const additionalEnvKeys = parseStringArray(fileOutputObj.additionalEnvKeys, "fileOutput.additionalEnvKeys", index, id);
+        if (additionalEnvKeys === null)
+            return null;
         if (type === "authorized_user" && relativePath) {
             fileOutput = {
                 type: "authorized_user",
@@ -155,24 +161,36 @@ function parseOAuthService(value, index) {
     return {
         id: id.toLowerCase(),
         label,
-        aliases: Array.isArray(value.aliases)
-            ? value.aliases.filter((v) => typeof v === "string").map((v) => v.toLowerCase())
-            : [id.toLowerCase()],
+        aliases: aliases?.map((v) => v.toLowerCase()) ?? [id.toLowerCase()],
         authorizationUrl,
         tokenUrl,
-        scopes: Array.isArray(value.scopes)
-            ? value.scopes.filter((v) => typeof v === "string")
-            : [],
+        scopes: scopes ?? [],
         clientIdEnvKey,
         clientSecretEnvKey,
         accessTokenEnvKeys: accessTokenEnvKeys.length > 0 ? accessTokenEnvKeys : undefined,
         refreshTokenEnvKey: typeof value.refreshTokenEnvKey === "string" ? value.refreshTokenEnvKey.trim() : undefined,
-        authorizationParams: isRecord(value.authorizationParams)
-            ? Object.fromEntries(Object.entries(value.authorizationParams).filter((authorizationEntry) => typeof authorizationEntry[1] === "string"))
-            : undefined,
+        authorizationParams: authorizationParams ?? undefined,
         fileOutput,
     };
 }
+function parseStringArray(value, field, index, id) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+        log.logWarning(`Skipping OAUTH_SERVICES_JSON[${index}] (${id}): ${field} must be strings`);
+        return null;
+    }
+    return value;
+}
+function parseStringRecord(value, field, index, id) {
+    if (value === undefined)
+        return undefined;
+    if (!isRecord(value) || Object.values(value).some((entry) => typeof entry !== "string")) {
+        log.logWarning(`Skipping OAUTH_SERVICES_JSON[${index}] (${id}): ${field} must be strings`);
+        return null;
+    }
+    return value;
+}
 export function getOAuthServices() {
     const raw = readEnv("OAUTH_SERVICES_JSON");
     const builtins = getBuiltinOAuthServices();

package/dist/web/login/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/web/login/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AAKpC,MAAM,mCAAmC,GAAG;IAC1C,uCAAuC;IACvC,0BAA0B;IAC1B,0CAA0C;IAC1C,8CAA8C;IAC9C,2CAA2C;IAC3C,sDAAsD;CACvD,CAAC;AAEF,MAAM,+BAA+B,GAAG;IACtC,QAAQ;IACR,gDAAgD;IAChD,gDAAgD;CACjD,CAAC;AAEF,0EAA0E;AAC1E,sEAAsE;AACtE,mEAAmE;AACnE,8EAA8E;AAC9E,yDAAyD;AACzD,MAAM,2BAA2B,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAE5F,SAAS,oBAAoB,CAAC,MAAc,EAAE,QAAkB;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAE1B,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;QACL;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC;YAC/C,gBAAgB,EAAE,0CAA0C;YAC5D,QAAQ,EAAE,6CAA6C;YACvD,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,EAAE,2BAA2B,CAAC;YAChF,cAAc,EAAE,wBAAwB;YACxC,kBAAkB,EAAE,4BAA4B;YAChD,kBAAkB,EAAE,CAAC,2BAA2B,EAAE,UAAU,CAAC;YAC7D,kBAAkB,EAAE,4BAA4B;SACjD;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,CAAC,sBAAsB,EAAE,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,CAAC;YACnF,gBAAgB,EAAE,8CAA8C;YAChE,QAAQ,EAAE,qCAAqC;YAC/C,MAAM,EAAE,oBAAoB,CAC1B,mCAAmC,EACnC,mCAAmC,CACpC;YACD,cAAc,EAAE,gCAAgC;YAChD,kBAAkB,EAAE,oCAAoC;YACxD,mBAAmB,EAAE;gBACnB,WAAW,EAAE,SAAS;gBACtB,sBAAsB,EAAE,MAAM;gBAC9B,MAAM,EAAE,SAAS;aAClB;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,YAAY,EAAE,UAAU;gBACxB,UAAU,EAAE,oCAAoC;aACjD;SACF;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,2BAA2B;YAClC,OAAO,EAAE,CAAC,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,CAAC;YAClF,gBAAgB,EAAE,8CAA8C;YAChE,QAAQ,EAAE,qCAAqC;YAC/C,MAAM,EAAE,oBAAoB,CAC1B,+BAA+B,EAC/B,+BAA+B,CAChC;YACD,cAAc,EAAE,4BAA4B;YAC5C,kBAAkB,EAAE,gCAAgC;YACpD,mBAAmB,EAAE;gBACnB,WAAW,EAAE,SAAS;gBACtB,sBAAsB,EAAE,MAAM;gBAC9B,MAAM,EAAE,SAAS;aAClB;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,YAAY,EAAE,iBAAiB;gBAC/B,UAAU,EAAE,2DAA2D;gBACvE,MAAM,EAAE,gCAAgC;gBACxC,iBAAiB,EAAE,CAAC,wCAAwC,CAAC;aAC9D;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,UAAU,CAAC,gCAAgC,KAAK,uBAAuB,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,gBAAgB,GACpB,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,cAAc,GAClB,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,kBAAkB,GACtB,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,OAAO,GAAG;QACd,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACtC,CAAC,UAAU,EAAE,QAAQ,CAAC;QACtB,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAClC,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;KAC3C;SACE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,UAAU,CACZ,gCAAgC,KAAK,IAAI,WAAW,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC;QAClF,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,EAAE,CAAC;QACtD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,4BAA4B,EAAE,CAAC;YACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE;gBAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;YAC3C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBACtF,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,UAAsC,CAAC;IAC3C,IAAI,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,aAAa,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,YAAY,GAChB,OAAO,aAAa,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,UAAU,GACd,OAAO,aAAa,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,MAAM,MAAM,GACV,OAAO,aAAa,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAAC;YACtE,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACnF,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,IAAI,KAAK,iBAAiB,IAAI,YAAY,EAAE,CAAC;YAC/C,UAAU,GAAG;gBACX,IAAI,EAAE,iBAAiB;gBACvB,YAAY;gBACZ,UAAU;gBACV,MAAM;gBACN,iBAAiB;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE;QACpB,KAAK;QACL,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;YACnC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7F,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QACtB,gBAAgB;QAChB,QAAQ;QACR,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;YACjC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAChE,CAAC,CAAC,EAAE;QACN,cAAc;QACd,kBAAkB;QAClB,kBAAkB,EAAE,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QAClF,kBAAkB,EAChB,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC5F,mBAAmB,EAAE,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC;YACtD,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAC9C,CAAC,kBAAkB,EAA0C,EAAE,CAC7D,OAAO,kBAAkB,CAAC,CAAC,CAAC,KAAK,QAAQ,CAC5C,CACF;YACH,CAAC,CAAC,SAAS;QACb,UAAU;KACX,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAE1B,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CACrD,MAAM,KAAK,uBAAuB;YAChC,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,MAAM,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,GAAG,CAAC,UAAU,CACZ,MAAM,KAAK,oDAAoD;YAC7D,CAAC,CAAC,kFAAkF;YACpF,CAAC,CAAC,4CAA4C,EAChD,MAAM,CACP,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM;SAClB,GAAG,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;SACpE,MAAM,CAAC,CAAC,OAAO,EAA2B,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,MAAM;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,gBAAgB,EAAE,CAAC,IAAI,CAC5B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAU,CAAC;AAExD,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAE7D,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE5C,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC;QACpC,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5F,OAAO;gBACL,MAAM,EAAE,UAAU,EAAE,EAAyD;gBAC7E,IAAI;aACL,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,SAAS,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACpD,CAAC;IAED,+EAA+E;IAC/E,gEAAgE;IAChE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAEjE,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { matchCommand } from \"../../commands/parse.js\";\nimport { readEnv } from \"../../utils/env.js\";\nimport { isRecord, parseJsonValue } from \"../../utils/file-guards.js\";\nimport * as log from \"../../log.js\";\n\nexport type { LoginCredentialKind, OAuthService, ParsedLoginCommand } from \"./types.js\";\nimport type { OAuthService, ParsedLoginCommand } from \"./types.js\";\n\nconst DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES = [\n  \"https://www.googleapis.com/auth/drive\",\n  \"https://mail.google.com/\",\n  \"https://www.googleapis.com/auth/calendar\",\n  \"https://www.googleapis.com/auth/spreadsheets\",\n  \"https://www.googleapis.com/auth/documents\",\n  \"https://www.googleapis.com/auth/chat.messages.create\",\n];\n\nconst DEFAULT_GOOGLE_CLOUD_SDK_SCOPES = [\n  \"openid\",\n  \"https://www.googleapis.com/auth/userinfo.email\",\n  \"https://www.googleapis.com/auth/cloud-platform\",\n];\n\n// Conservative default: enough for `gh` CLI repo/user/org operations, but\n// without `workflow` (can dispatch CI), `write:packages` (can publish\n// packages), or `project`. Operators who need those can opt in via\n// GITHUB_OAUTH_SCOPES (or MIKAN_GITHUB_OAUTH_SCOPES) to keep the blast radius\n// of a compromised agent host explicit and configurable.\nconst DEFAULT_GITHUB_OAUTH_SCOPES = [\"repo\", \"read:user\", \"user:email\", \"read:org\", \"gist\"];\n\nfunction resolveScopesFromEnv(envKey: string, fallback: string[]): string[] {\n  const raw = readEnv(envKey);\n  if (!raw) return fallback;\n\n  const scopes = raw\n    .split(/[\\s,]+/)\n    .map((scope) => scope.trim())\n    .filter(Boolean);\n\n  return scopes.length > 0 ? scopes : fallback;\n}\n\nfunction getBuiltinOAuthServices(): OAuthService[] {\n  return [\n    {\n      id: \"github\",\n      label: \"GitHub\",\n      aliases: [\"github\", \"github_oauth\", \"gh_oauth\"],\n      authorizationUrl: \"https://github.com/login/oauth/authorize\",\n      tokenUrl: \"https://github.com/login/oauth/access_token\",\n      scopes: resolveScopesFromEnv(\"GITHUB_OAUTH_SCOPES\", DEFAULT_GITHUB_OAUTH_SCOPES),\n      clientIdEnvKey: \"GITHUB_OAUTH_CLIENT_ID\",\n      clientSecretEnvKey: \"GITHUB_OAUTH_CLIENT_SECRET\",\n      accessTokenEnvKeys: [\"GITHUB_OAUTH_ACCESS_TOKEN\", \"GH_TOKEN\"],\n      refreshTokenEnvKey: \"GITHUB_OAUTH_REFRESH_TOKEN\",\n    },\n    {\n      id: \"google_workspace_cli\",\n      label: \"Google Workspace CLI\",\n      aliases: [\"google_workspace_cli\", \"gws\", \"googleworkspace\", \"google-workspace-cli\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveScopesFromEnv(\n        \"GOOGLE_WORKSPACE_CLI_OAUTH_SCOPES\",\n        DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES,\n      ),\n      clientIdEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gws.json\",\n        targetPath: \"/root/.config/gws/credentials.json\",\n      },\n    },\n    {\n      id: \"google_cloud_sdk\",\n      label: \"Google Cloud SDK (gcloud)\",\n      aliases: [\"google_cloud_sdk\", \"gcloud\", \"google-cloud-sdk\", \"google_cloud\", \"gcp\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveScopesFromEnv(\n        \"GOOGLE_CLOUD_SDK_OAUTH_SCOPES\",\n        DEFAULT_GOOGLE_CLOUD_SDK_SCOPES,\n      ),\n      clientIdEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gcloud-adc.json\",\n        targetPath: \"/root/.config/gcloud/application_default_credentials.json\",\n        envKey: \"GOOGLE_APPLICATION_CREDENTIALS\",\n        additionalEnvKeys: [\"CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE\"],\n      },\n    },\n  ];\n}\n\nfunction parseOAuthService(value: unknown, index: number): OAuthService | null {\n  if (!isRecord(value)) {\n    log.logWarning(`Skipping OAUTH_SERVICES_JSON[${index}]: expected an object`);\n    return null;\n  }\n\n  const id = typeof value.id === \"string\" ? value.id.trim() : \"\";\n  const label = typeof value.label === \"string\" ? value.label.trim() : \"\";\n  const authorizationUrl =\n    typeof value.authorizationUrl === \"string\" ? value.authorizationUrl.trim() : \"\";\n  const tokenUrl = typeof value.tokenUrl === \"string\" ? value.tokenUrl.trim() : \"\";\n  const clientIdEnvKey =\n    typeof value.clientIdEnvKey === \"string\" ? value.clientIdEnvKey.trim() : \"\";\n  const clientSecretEnvKey =\n    typeof value.clientSecretEnvKey === \"string\" ? value.clientSecretEnvKey.trim() : \"\";\n  const missing = [\n    [\"id\", id],\n    [\"label\", label],\n    [\"authorizationUrl\", authorizationUrl],\n    [\"tokenUrl\", tokenUrl],\n    [\"clientIdEnvKey\", clientIdEnvKey],\n    [\"clientSecretEnvKey\", clientSecretEnvKey],\n  ]\n    .filter((entry) => !entry[1])\n    .map((entry) => entry[0]);\n\n  if (missing.length > 0) {\n    const labelForLog = id ? ` (${id})` : \"\";\n    log.logWarning(\n      `Skipping OAUTH_SERVICES_JSON[${index}]${labelForLog}: missing ${missing.join(\", \")}`,\n    );\n    return null;\n  }\n\n  const accessTokenEnvKeys: string[] = [];\n  if (typeof value.accessTokenEnvKey === \"string\" && value.accessTokenEnvKey.trim()) {\n    accessTokenEnvKeys.push(value.accessTokenEnvKey.trim());\n  }\n  if (Array.isArray(value.additionalAccessTokenEnvKeys)) {\n    for (const key of value.additionalAccessTokenEnvKeys) {\n      if (typeof key === \"string\" && key.trim()) accessTokenEnvKeys.push(key.trim());\n    }\n  }\n  if (Array.isArray(value.accessTokenEnvKeys)) {\n    for (const key of value.accessTokenEnvKeys) {\n      if (typeof key === \"string\" && key.trim() && !accessTokenEnvKeys.includes(key.trim())) {\n        accessTokenEnvKeys.push(key.trim());\n      }\n    }\n  }\n\n  let fileOutput: OAuthService[\"fileOutput\"];\n  if (isRecord(value.fileOutput)) {\n    const fileOutputObj = value.fileOutput;\n    const type = typeof fileOutputObj.type === \"string\" ? fileOutputObj.type.trim() : \"\";\n    const relativePath =\n      typeof fileOutputObj.relativePath === \"string\" ? fileOutputObj.relativePath.trim() : \"\";\n    const targetPath =\n      typeof fileOutputObj.targetPath === \"string\" ? fileOutputObj.targetPath.trim() : undefined;\n    const envKey =\n      typeof fileOutputObj.envKey === \"string\" ? fileOutputObj.envKey.trim() : undefined;\n    const additionalEnvKeys = Array.isArray(fileOutputObj.additionalEnvKeys)\n      ? fileOutputObj.additionalEnvKeys.filter((v): v is string => typeof v === \"string\")\n      : undefined;\n    if (type === \"authorized_user\" && relativePath) {\n      fileOutput = {\n        type: \"authorized_user\",\n        relativePath,\n        targetPath,\n        envKey,\n        additionalEnvKeys,\n      };\n    }\n  }\n\n  return {\n    id: id.toLowerCase(),\n    label,\n    aliases: Array.isArray(value.aliases)\n      ? value.aliases.filter((v): v is string => typeof v === \"string\").map((v) => v.toLowerCase())\n      : [id.toLowerCase()],\n    authorizationUrl,\n    tokenUrl,\n    scopes: Array.isArray(value.scopes)\n      ? value.scopes.filter((v): v is string => typeof v === \"string\")\n      : [],\n    clientIdEnvKey,\n    clientSecretEnvKey,\n    accessTokenEnvKeys: accessTokenEnvKeys.length > 0 ? accessTokenEnvKeys : undefined,\n    refreshTokenEnvKey:\n      typeof value.refreshTokenEnvKey === \"string\" ? value.refreshTokenEnvKey.trim() : undefined,\n    authorizationParams: isRecord(value.authorizationParams)\n      ? Object.fromEntries(\n          Object.entries(value.authorizationParams).filter(\n            (authorizationEntry): authorizationEntry is [string, string] =>\n              typeof authorizationEntry[1] === \"string\",\n          ),\n        )\n      : undefined,\n    fileOutput,\n  };\n}\n\nexport function getOAuthServices(): OAuthService[] {\n  const raw = readEnv(\"OAUTH_SERVICES_JSON\");\n  const builtins = getBuiltinOAuthServices();\n  if (!raw) return builtins;\n\n  let parsed: unknown[];\n  try {\n    parsed = parseJsonValue(raw, Array.isArray, (detail) =>\n      detail === \"unexpected JSON shape\"\n        ? \"expected a JSON array of OAuth service definitions\"\n        : detail,\n    );\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    log.logWarning(\n      detail === \"expected a JSON array of OAuth service definitions\"\n        ? \"Ignoring OAUTH_SERVICES_JSON: expected a JSON array of OAuth service definitions\"\n        : \"Ignoring OAUTH_SERVICES_JSON: invalid JSON\",\n      detail,\n    );\n    return builtins;\n  }\n\n  const custom = parsed\n    .map((serviceValue, index) => parseOAuthService(serviceValue, index))\n    .filter((service): service is OAuthService => service !== null);\n  const byId = new Map<string, OAuthService>();\n  for (const service of builtins) byId.set(service.id, service);\n  for (const service of custom) byId.set(service.id, service);\n  return [...byId.values()];\n}\n\nexport function resolveOAuthService(input: string): OAuthService | undefined {\n  const normalized = input.trim().toLowerCase();\n  if (!normalized) return undefined;\n  return getOAuthServices().find(\n    (service) => service.id === normalized || service.aliases.includes(normalized),\n  );\n}\n\nconst LOGIN_COMMANDS = [\"/login\", \"/pi-login\"] as const;\n\nexport function parseLoginCommand(text: string): ParsedLoginCommand | null {\n  const matched = matchCommand(text, LOGIN_COMMANDS);\n  if (!matched) return null;\n\n  const [subcommand, operation, name, ...extra] = matched.args;\n\n  if (!subcommand) return { action: \"setup\" };\n\n  if (subcommand.toLowerCase() === \"shared\") {\n    const op = operation?.toLowerCase();\n    if (op === \"list\" && !name && extra.length === 0) {\n      return { action: \"shared_list\" };\n    }\n    if ((op === \"create\" || op === \"update\" || op === \"delete\") && !!name && extra.length === 0) {\n      return {\n        action: `shared_${op}` as \"shared_create\" | \"shared_update\" | \"shared_delete\",\n        name,\n      };\n    }\n    return null;\n  }\n\n  if (subcommand.toLowerCase() === \"copy\" && operation && !name && extra.length === 0) {\n    return { action: \"copy_shared\", name: operation };\n  }\n\n  // Backward-compatible: older `/pi-login gh` / `/pi-login gws` forms opened the\n  // generic login page and let the portal handle provider choice.\n  if (!operation && extra.length === 0) return { action: \"setup\" };\n\n  return null;\n}\n"]}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/web/login/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,GAAG,MAAM,cAAc,CAAC;AAKpC,MAAM,mCAAmC,GAAG;IAC1C,uCAAuC;IACvC,0BAA0B;IAC1B,0CAA0C;IAC1C,8CAA8C;IAC9C,2CAA2C;IAC3C,sDAAsD;CACvD,CAAC;AAEF,MAAM,+BAA+B,GAAG;IACtC,QAAQ;IACR,gDAAgD;IAChD,gDAAgD;CACjD,CAAC;AAEF,0EAA0E;AAC1E,sEAAsE;AACtE,mEAAmE;AACnE,8EAA8E;AAC9E,yDAAyD;AACzD,MAAM,2BAA2B,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAE5F,SAAS,oBAAoB,CAAC,MAAc,EAAE,QAAkB;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAE1B,MAAM,MAAM,GAAG,GAAG;SACf,KAAK,CAAC,QAAQ,CAAC;SACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;QACL;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC;YAC/C,gBAAgB,EAAE,0CAA0C;YAC5D,QAAQ,EAAE,6CAA6C;YACvD,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,EAAE,2BAA2B,CAAC;YAChF,cAAc,EAAE,wBAAwB;YACxC,kBAAkB,EAAE,4BAA4B;YAChD,kBAAkB,EAAE,CAAC,2BAA2B,EAAE,UAAU,CAAC;YAC7D,kBAAkB,EAAE,4BAA4B;SACjD;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,CAAC,sBAAsB,EAAE,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,CAAC;YACnF,gBAAgB,EAAE,8CAA8C;YAChE,QAAQ,EAAE,qCAAqC;YAC/C,MAAM,EAAE,oBAAoB,CAC1B,mCAAmC,EACnC,mCAAmC,CACpC;YACD,cAAc,EAAE,gCAAgC;YAChD,kBAAkB,EAAE,oCAAoC;YACxD,mBAAmB,EAAE;gBACnB,WAAW,EAAE,SAAS;gBACtB,sBAAsB,EAAE,MAAM;gBAC9B,MAAM,EAAE,SAAS;aAClB;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,YAAY,EAAE,UAAU;gBACxB,UAAU,EAAE,oCAAoC;aACjD;SACF;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,2BAA2B;YAClC,OAAO,EAAE,CAAC,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,CAAC;YAClF,gBAAgB,EAAE,8CAA8C;YAChE,QAAQ,EAAE,qCAAqC;YAC/C,MAAM,EAAE,oBAAoB,CAC1B,+BAA+B,EAC/B,+BAA+B,CAChC;YACD,cAAc,EAAE,4BAA4B;YAC5C,kBAAkB,EAAE,gCAAgC;YACpD,mBAAmB,EAAE;gBACnB,WAAW,EAAE,SAAS;gBACtB,sBAAsB,EAAE,MAAM;gBAC9B,MAAM,EAAE,SAAS;aAClB;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,YAAY,EAAE,iBAAiB;gBAC/B,UAAU,EAAE,2DAA2D;gBACvE,MAAM,EAAE,gCAAgC;gBACxC,iBAAiB,EAAE,CAAC,wCAAwC,CAAC;aAC9D;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,UAAU,CAAC,gCAAgC,KAAK,uBAAuB,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,gBAAgB,GACpB,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,cAAc,GAClB,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,kBAAkB,GACtB,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,MAAM,OAAO,GAAG;QACd,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACtC,CAAC,UAAU,EAAE,QAAQ,CAAC;QACtB,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAClC,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;KAC3C;SACE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,UAAU,CACZ,gCAAgC,KAAK,IAAI,WAAW,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,mBAAmB,GAAG,iBAAiB,CAC3C,KAAK,CAAC,mBAAmB,EACzB,qBAAqB,EACrB,KAAK,EACL,EAAE,CACH,CAAC;IACF,IAAI,mBAAmB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,kBAAkB,GAAa,EAAE,CAAC;IACxC,IAAI,OAAO,KAAK,CAAC,iBAAiB,KAAK,QAAQ,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC;QAClF,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,8BAA8B,EAAE,oBAAoB,CAAU,EAAE,CAAC;QACpF,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YAC3B,IAAI,OAAO,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,IAAI,UAAsC,CAAC;IAC3C,IAAI,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC;QACvC,MAAM,IAAI,GAAG,OAAO,aAAa,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,YAAY,GAChB,OAAO,aAAa,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,MAAM,UAAU,GACd,OAAO,aAAa,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,MAAM,MAAM,GACV,OAAO,aAAa,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACrF,MAAM,iBAAiB,GAAG,gBAAgB,CACxC,aAAa,CAAC,iBAAiB,EAC/B,8BAA8B,EAC9B,KAAK,EACL,EAAE,CACH,CAAC;QACF,IAAI,iBAAiB,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5C,IAAI,IAAI,KAAK,iBAAiB,IAAI,YAAY,EAAE,CAAC;YAC/C,UAAU,GAAG;gBACX,IAAI,EAAE,iBAAiB;gBACvB,YAAY;gBACZ,UAAU;gBACV,MAAM;gBACN,iBAAiB;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE;QACpB,KAAK;QACL,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QACnE,gBAAgB;QAChB,QAAQ;QACR,MAAM,EAAE,MAAM,IAAI,EAAE;QACpB,cAAc;QACd,kBAAkB;QAClB,kBAAkB,EAAE,kBAAkB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAAS;QAClF,kBAAkB,EAChB,OAAO,KAAK,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC5F,mBAAmB,EAAE,mBAAmB,IAAI,SAAS;QACrD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,KAAa,EACb,KAAa,EACb,EAAU;IAEV,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,UAAU,CAAC,gCAAgC,KAAK,MAAM,EAAE,MAAM,KAAK,kBAAkB,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,KAAa,EACb,KAAa,EACb,EAAU;IAEV,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,UAAU,CAAC,gCAAgC,KAAK,MAAM,EAAE,MAAM,KAAK,kBAAkB,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAA+B,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAE1B,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CACrD,MAAM,KAAK,uBAAuB;YAChC,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,MAAM,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,GAAG,CAAC,UAAU,CACZ,MAAM,KAAK,oDAAoD;YAC7D,CAAC,CAAC,kFAAkF;YACpF,CAAC,CAAC,4CAA4C,EAChD,MAAM,CACP,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM;SAClB,GAAG,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;SACpE,MAAM,CAAC,CAAC,OAAO,EAA2B,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;IAC7C,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,KAAK,MAAM,OAAO,IAAI,MAAM;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,gBAAgB,EAAE,CAAC,IAAI,CAC5B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC/E,CAAC;AACJ,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAU,CAAC;AAExD,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAE7D,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE5C,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,SAAS,EAAE,WAAW,EAAE,CAAC;QACpC,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5F,OAAO;gBACL,MAAM,EAAE,UAAU,EAAE,EAAyD;gBAC7E,IAAI;aACL,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,UAAU,CAAC,WAAW,EAAE,KAAK,MAAM,IAAI,SAAS,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACpD,CAAC;IAED,+EAA+E;IAC/E,gEAAgE;IAChE,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAEjE,OAAO,IAAI,CAAC;AACd,CAAC","sourcesContent":["import { matchCommand } from \"../../commands/parse.js\";\nimport { readEnv } from \"../../utils/env.js\";\nimport { isRecord, parseJsonValue } from \"../../utils/file-guards.js\";\nimport * as log from \"../../log.js\";\n\nexport type { LoginCredentialKind, OAuthService, ParsedLoginCommand } from \"./types.js\";\nimport type { OAuthService, ParsedLoginCommand } from \"./types.js\";\n\nconst DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES = [\n  \"https://www.googleapis.com/auth/drive\",\n  \"https://mail.google.com/\",\n  \"https://www.googleapis.com/auth/calendar\",\n  \"https://www.googleapis.com/auth/spreadsheets\",\n  \"https://www.googleapis.com/auth/documents\",\n  \"https://www.googleapis.com/auth/chat.messages.create\",\n];\n\nconst DEFAULT_GOOGLE_CLOUD_SDK_SCOPES = [\n  \"openid\",\n  \"https://www.googleapis.com/auth/userinfo.email\",\n  \"https://www.googleapis.com/auth/cloud-platform\",\n];\n\n// Conservative default: enough for `gh` CLI repo/user/org operations, but\n// without `workflow` (can dispatch CI), `write:packages` (can publish\n// packages), or `project`. Operators who need those can opt in via\n// GITHUB_OAUTH_SCOPES (or MIKAN_GITHUB_OAUTH_SCOPES) to keep the blast radius\n// of a compromised agent host explicit and configurable.\nconst DEFAULT_GITHUB_OAUTH_SCOPES = [\"repo\", \"read:user\", \"user:email\", \"read:org\", \"gist\"];\n\nfunction resolveScopesFromEnv(envKey: string, fallback: string[]): string[] {\n  const raw = readEnv(envKey);\n  if (!raw) return fallback;\n\n  const scopes = raw\n    .split(/[\\s,]+/)\n    .map((scope) => scope.trim())\n    .filter(Boolean);\n\n  return scopes.length > 0 ? scopes : fallback;\n}\n\nfunction getBuiltinOAuthServices(): OAuthService[] {\n  return [\n    {\n      id: \"github\",\n      label: \"GitHub\",\n      aliases: [\"github\", \"github_oauth\", \"gh_oauth\"],\n      authorizationUrl: \"https://github.com/login/oauth/authorize\",\n      tokenUrl: \"https://github.com/login/oauth/access_token\",\n      scopes: resolveScopesFromEnv(\"GITHUB_OAUTH_SCOPES\", DEFAULT_GITHUB_OAUTH_SCOPES),\n      clientIdEnvKey: \"GITHUB_OAUTH_CLIENT_ID\",\n      clientSecretEnvKey: \"GITHUB_OAUTH_CLIENT_SECRET\",\n      accessTokenEnvKeys: [\"GITHUB_OAUTH_ACCESS_TOKEN\", \"GH_TOKEN\"],\n      refreshTokenEnvKey: \"GITHUB_OAUTH_REFRESH_TOKEN\",\n    },\n    {\n      id: \"google_workspace_cli\",\n      label: \"Google Workspace CLI\",\n      aliases: [\"google_workspace_cli\", \"gws\", \"googleworkspace\", \"google-workspace-cli\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveScopesFromEnv(\n        \"GOOGLE_WORKSPACE_CLI_OAUTH_SCOPES\",\n        DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES,\n      ),\n      clientIdEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gws.json\",\n        targetPath: \"/root/.config/gws/credentials.json\",\n      },\n    },\n    {\n      id: \"google_cloud_sdk\",\n      label: \"Google Cloud SDK (gcloud)\",\n      aliases: [\"google_cloud_sdk\", \"gcloud\", \"google-cloud-sdk\", \"google_cloud\", \"gcp\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveScopesFromEnv(\n        \"GOOGLE_CLOUD_SDK_OAUTH_SCOPES\",\n        DEFAULT_GOOGLE_CLOUD_SDK_SCOPES,\n      ),\n      clientIdEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gcloud-adc.json\",\n        targetPath: \"/root/.config/gcloud/application_default_credentials.json\",\n        envKey: \"GOOGLE_APPLICATION_CREDENTIALS\",\n        additionalEnvKeys: [\"CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE\"],\n      },\n    },\n  ];\n}\n\nfunction parseOAuthService(value: unknown, index: number): OAuthService | null {\n  if (!isRecord(value)) {\n    log.logWarning(`Skipping OAUTH_SERVICES_JSON[${index}]: expected an object`);\n    return null;\n  }\n\n  const id = typeof value.id === \"string\" ? value.id.trim() : \"\";\n  const label = typeof value.label === \"string\" ? value.label.trim() : \"\";\n  const authorizationUrl =\n    typeof value.authorizationUrl === \"string\" ? value.authorizationUrl.trim() : \"\";\n  const tokenUrl = typeof value.tokenUrl === \"string\" ? value.tokenUrl.trim() : \"\";\n  const clientIdEnvKey =\n    typeof value.clientIdEnvKey === \"string\" ? value.clientIdEnvKey.trim() : \"\";\n  const clientSecretEnvKey =\n    typeof value.clientSecretEnvKey === \"string\" ? value.clientSecretEnvKey.trim() : \"\";\n  const missing = [\n    [\"id\", id],\n    [\"label\", label],\n    [\"authorizationUrl\", authorizationUrl],\n    [\"tokenUrl\", tokenUrl],\n    [\"clientIdEnvKey\", clientIdEnvKey],\n    [\"clientSecretEnvKey\", clientSecretEnvKey],\n  ]\n    .filter((entry) => !entry[1])\n    .map((entry) => entry[0]);\n\n  if (missing.length > 0) {\n    const labelForLog = id ? ` (${id})` : \"\";\n    log.logWarning(\n      `Skipping OAUTH_SERVICES_JSON[${index}]${labelForLog}: missing ${missing.join(\", \")}`,\n    );\n    return null;\n  }\n\n  const aliases = parseStringArray(value.aliases, \"aliases\", index, id);\n  if (aliases === null) return null;\n  const scopes = parseStringArray(value.scopes, \"scopes\", index, id);\n  if (scopes === null) return null;\n  const authorizationParams = parseStringRecord(\n    value.authorizationParams,\n    \"authorizationParams\",\n    index,\n    id,\n  );\n  if (authorizationParams === null) return null;\n\n  const accessTokenEnvKeys: string[] = [];\n  if (typeof value.accessTokenEnvKey === \"string\" && value.accessTokenEnvKey.trim()) {\n    accessTokenEnvKeys.push(value.accessTokenEnvKey.trim());\n  }\n  for (const field of [\"additionalAccessTokenEnvKeys\", \"accessTokenEnvKeys\"] as const) {\n    const keys = parseStringArray(value[field], field, index, id);\n    if (keys === null) return null;\n    for (const key of keys ?? []) {\n      const trimmed = key.trim();\n      if (trimmed && !accessTokenEnvKeys.includes(trimmed)) accessTokenEnvKeys.push(trimmed);\n    }\n  }\n\n  let fileOutput: OAuthService[\"fileOutput\"];\n  if (isRecord(value.fileOutput)) {\n    const fileOutputObj = value.fileOutput;\n    const type = typeof fileOutputObj.type === \"string\" ? fileOutputObj.type.trim() : \"\";\n    const relativePath =\n      typeof fileOutputObj.relativePath === \"string\" ? fileOutputObj.relativePath.trim() : \"\";\n    const targetPath =\n      typeof fileOutputObj.targetPath === \"string\" ? fileOutputObj.targetPath.trim() : undefined;\n    const envKey =\n      typeof fileOutputObj.envKey === \"string\" ? fileOutputObj.envKey.trim() : undefined;\n    const additionalEnvKeys = parseStringArray(\n      fileOutputObj.additionalEnvKeys,\n      \"fileOutput.additionalEnvKeys\",\n      index,\n      id,\n    );\n    if (additionalEnvKeys === null) return null;\n    if (type === \"authorized_user\" && relativePath) {\n      fileOutput = {\n        type: \"authorized_user\",\n        relativePath,\n        targetPath,\n        envKey,\n        additionalEnvKeys,\n      };\n    }\n  }\n\n  return {\n    id: id.toLowerCase(),\n    label,\n    aliases: aliases?.map((v) => v.toLowerCase()) ?? [id.toLowerCase()],\n    authorizationUrl,\n    tokenUrl,\n    scopes: scopes ?? [],\n    clientIdEnvKey,\n    clientSecretEnvKey,\n    accessTokenEnvKeys: accessTokenEnvKeys.length > 0 ? accessTokenEnvKeys : undefined,\n    refreshTokenEnvKey:\n      typeof value.refreshTokenEnvKey === \"string\" ? value.refreshTokenEnvKey.trim() : undefined,\n    authorizationParams: authorizationParams ?? undefined,\n    fileOutput,\n  };\n}\n\nfunction parseStringArray(\n  value: unknown,\n  field: string,\n  index: number,\n  id: string,\n): string[] | undefined | null {\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value) || value.some((entry) => typeof entry !== \"string\")) {\n    log.logWarning(`Skipping OAUTH_SERVICES_JSON[${index}] (${id}): ${field} must be strings`);\n    return null;\n  }\n  return value;\n}\n\nfunction parseStringRecord(\n  value: unknown,\n  field: string,\n  index: number,\n  id: string,\n): Record<string, string> | undefined | null {\n  if (value === undefined) return undefined;\n  if (!isRecord(value) || Object.values(value).some((entry) => typeof entry !== \"string\")) {\n    log.logWarning(`Skipping OAUTH_SERVICES_JSON[${index}] (${id}): ${field} must be strings`);\n    return null;\n  }\n  return value as Record<string, string>;\n}\n\nexport function getOAuthServices(): OAuthService[] {\n  const raw = readEnv(\"OAUTH_SERVICES_JSON\");\n  const builtins = getBuiltinOAuthServices();\n  if (!raw) return builtins;\n\n  let parsed: unknown[];\n  try {\n    parsed = parseJsonValue(raw, Array.isArray, (detail) =>\n      detail === \"unexpected JSON shape\"\n        ? \"expected a JSON array of OAuth service definitions\"\n        : detail,\n    );\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    log.logWarning(\n      detail === \"expected a JSON array of OAuth service definitions\"\n        ? \"Ignoring OAUTH_SERVICES_JSON: expected a JSON array of OAuth service definitions\"\n        : \"Ignoring OAUTH_SERVICES_JSON: invalid JSON\",\n      detail,\n    );\n    return builtins;\n  }\n\n  const custom = parsed\n    .map((serviceValue, index) => parseOAuthService(serviceValue, index))\n    .filter((service): service is OAuthService => service !== null);\n  const byId = new Map<string, OAuthService>();\n  for (const service of builtins) byId.set(service.id, service);\n  for (const service of custom) byId.set(service.id, service);\n  return [...byId.values()];\n}\n\nexport function resolveOAuthService(input: string): OAuthService | undefined {\n  const normalized = input.trim().toLowerCase();\n  if (!normalized) return undefined;\n  return getOAuthServices().find(\n    (service) => service.id === normalized || service.aliases.includes(normalized),\n  );\n}\n\nconst LOGIN_COMMANDS = [\"/login\", \"/pi-login\"] as const;\n\nexport function parseLoginCommand(text: string): ParsedLoginCommand | null {\n  const matched = matchCommand(text, LOGIN_COMMANDS);\n  if (!matched) return null;\n\n  const [subcommand, operation, name, ...extra] = matched.args;\n\n  if (!subcommand) return { action: \"setup\" };\n\n  if (subcommand.toLowerCase() === \"shared\") {\n    const op = operation?.toLowerCase();\n    if (op === \"list\" && !name && extra.length === 0) {\n      return { action: \"shared_list\" };\n    }\n    if ((op === \"create\" || op === \"update\" || op === \"delete\") && !!name && extra.length === 0) {\n      return {\n        action: `shared_${op}` as \"shared_create\" | \"shared_update\" | \"shared_delete\",\n        name,\n      };\n    }\n    return null;\n  }\n\n  if (subcommand.toLowerCase() === \"copy\" && operation && !name && extra.length === 0) {\n    return { action: \"copy_shared\", name: operation };\n  }\n\n  // Backward-compatible: older `/pi-login gh` / `/pi-login gws` forms opened the\n  // generic login page and let the portal handle provider choice.\n  if (!operation && extra.length === 0) return { action: \"setup\" };\n\n  return null;\n}\n"]}

package/dist/web/login/store.d.ts

@@ -3,10 +3,6 @@ import { InMemoryTokenStore } from "../token-store.js";
 export type { LinkToken } from "./types.js";
 import type { LinkToken } from "./types.js";
 export declare class InMemoryLinkTokenStore extends InMemoryTokenStore<LinkToken> {
-    /**
-     * Create a link token for a platform user.
-     * Invalidates any existing token for the same user before creating a new one.
-     */
     create(platform: PlatformName, platformUserId: string, conversationId: string, vaultId: string, providerId: string): LinkToken;
 }
 //# sourceMappingURL=store.d.ts.map

package/dist/web/login/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/web/login/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C,qBAAa,sBAAuB,SAAQ,kBAAkB,CAAC,SAAS,CAAC;IACvE;;;OAGG;IACH,MAAM,CACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,SAAS,CAmBX;CACF"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/web/login/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAI5C,qBAAa,sBAAuB,SAAQ,kBAAkB,CAAC,SAAS,CAAC;IACvE,MAAM,CACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,SAAS,CAWX;CACF"}

package/dist/web/login/store.js

@@ -1,28 +1,15 @@
 import { InMemoryTokenStore } from "../token-store.js";
 const TTL_MS = 15 * 60 * 1000;
 export class InMemoryLinkTokenStore extends InMemoryTokenStore {
-    /**
-     * Create a link token for a platform user.
-     * Invalidates any existing token for the same user before creating a new one.
-     */
     create(platform, platformUserId, conversationId, vaultId, providerId) {
-        for (const [key, t] of this.tokens) {
-            if (t.platform === platform && t.platformUserId === platformUserId) {
-                this.tokens.delete(key);
-            }
-        }
-        const { token, expiresAt } = this.mintToken(TTL_MS);
-        const record = {
-            token,
+        this.deleteWhere((token) => token.platform === platform && token.platformUserId === platformUserId);
+        return this.createRecord(TTL_MS, {
             platform,
             platformUserId,
             vaultId,
             providerId,
             conversationId,
-            expiresAt,
-        };
-        this.tokens.set(token, record);
-        return record;
+        });
     }
 }
 //# sourceMappingURL=store.js.map

package/dist/web/login/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/web/login/store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAIvD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9B,MAAM,OAAO,sBAAuB,SAAQ,kBAA6B;IACvE;;;OAGG;IACH,MAAM,CACJ,QAAsB,EACtB,cAAsB,EACtB,cAAsB,EACtB,OAAe,EACf,UAAkB;QAElB,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,KAAK,cAAc,EAAE,CAAC;gBACnE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,MAAM,GAAc;YACxB,KAAK;YACL,QAAQ;YACR,cAAc;YACd,OAAO;YACP,UAAU;YACV,cAAc;YACd,SAAS;SACV,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;CACF","sourcesContent":["import type { PlatformName } from \"../../adapter.js\";\nimport { InMemoryTokenStore } from \"../token-store.js\";\nexport type { LinkToken } from \"./types.js\";\nimport type { LinkToken } from \"./types.js\";\n\nconst TTL_MS = 15 * 60 * 1000;\n\nexport class InMemoryLinkTokenStore extends InMemoryTokenStore<LinkToken> {\n  /**\n   * Create a link token for a platform user.\n   * Invalidates any existing token for the same user before creating a new one.\n   */\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    vaultId: string,\n    providerId: string,\n  ): LinkToken {\n    for (const [key, t] of this.tokens) {\n      if (t.platform === platform && t.platformUserId === platformUserId) {\n        this.tokens.delete(key);\n      }\n    }\n\n    const { token, expiresAt } = this.mintToken(TTL_MS);\n    const record: LinkToken = {\n      token,\n      platform,\n      platformUserId,\n      vaultId,\n      providerId,\n      conversationId,\n      expiresAt,\n    };\n    this.tokens.set(token, record);\n    return record;\n  }\n}\n"]}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/web/login/store.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAIvD,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE9B,MAAM,OAAO,sBAAuB,SAAQ,kBAA6B;IACvE,MAAM,CACJ,QAAsB,EACtB,cAAsB,EACtB,cAAsB,EACtB,OAAe,EACf,UAAkB;QAElB,IAAI,CAAC,WAAW,CACd,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,cAAc,KAAK,cAAc,CAClF,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE;YAC/B,QAAQ;YACR,cAAc;YACd,OAAO;YACP,UAAU;YACV,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF","sourcesContent":["import type { PlatformName } from \"../../adapter.js\";\nimport { InMemoryTokenStore } from \"../token-store.js\";\nexport type { LinkToken } from \"./types.js\";\nimport type { LinkToken } from \"./types.js\";\n\nconst TTL_MS = 15 * 60 * 1000;\n\nexport class InMemoryLinkTokenStore extends InMemoryTokenStore<LinkToken> {\n  create(\n    platform: PlatformName,\n    platformUserId: string,\n    conversationId: string,\n    vaultId: string,\n    providerId: string,\n  ): LinkToken {\n    this.deleteWhere(\n      (token) => token.platform === platform && token.platformUserId === platformUserId,\n    );\n    return this.createRecord(TTL_MS, {\n      platform,\n      platformUserId,\n      vaultId,\n      providerId,\n      conversationId,\n    });\n  }\n}\n"]}

package/dist/web/server.js

@@ -20,7 +20,7 @@ export function startWebServer(options) {
                 return;
             const adminOptions = options.adminOptions;
             if (adminOptions?.adminTokenStore &&
-                handleAdminRequest(req, res, url, {
+                (await handleAdminRequest(req, res, url, {
                     vaultManager: options.vaultManager,
                     linkTokenStore: options.linkTokenStore,
                     sessionViewTokenStore: options.sessionViewTokenStore,
@@ -30,7 +30,7 @@ export function startWebServer(options) {
                     runtime: adminOptions.runtime,
                     sandbox: adminOptions.sandbox,
                     botsByPlatform: adminOptions.botsByPlatform,
-                })) {
+                }))) {
                 return;
             }
             if (await handleSessionViewRequest(req, res, url, options.sessionViewTokenStore, options.sessionViewInteractive)) {

package/dist/web/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/web/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,MAAM,CAAC;AAE5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,kBAAkB,EAA2B,MAAM,mBAAmB,CAAC;AAEhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,OAAO,EACL,wBAAwB,GAEzB,MAAM,0BAA0B,CAAC;AAmBlC,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,YAAY,GAAG,yBAAyB,CAC5C,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;YAEzD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACvD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YAED,IAAI,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAO;YAEpD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;YAC1C,IACE,YAAY,EAAE,eAAe;gBAC7B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;oBAChC,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;oBACpD,eAAe,EAAE,YAAY,CAAC,eAAe;oBAC7C,aAAa,EAAE,kBAAkB,EAAE,IAAI,SAAS;oBAChD,UAAU,EAAE,YAAY,CAAC,UAAU;oBACnC,OAAO,EAAE,YAAY,CAAC,OAAO;oBAC7B,OAAO,EAAE,YAAY,CAAC,OAAO;oBAC7B,cAAc,EAAE,YAAY,CAAC,cAAc;iBAC5C,CAAC,EACF,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IACE,MAAM,wBAAwB,CAC5B,GAAG,EACH,GAAG,EACH,GAAG,EACH,OAAO,CAAC,qBAAqB,EAC7B,OAAO,CAAC,sBAAsB,CAC/B,EACD,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAO;YAExC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,0BAA0B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7F,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IAChE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;QACzC,GAAG,CAAC,OAAO,CAAC,2BAA2B,QAAQ,IAAI,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC1B,GAAG,CAAC,UAAU,CACZ,gFAAgF;gBAC9E,2DAA2D;gBAC3D,8DAA8D,CACjE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,GAAG,CAAC,UAAU,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { createServer, type IncomingMessage, type Server, type ServerResponse } from \"http\";\nimport type { MessagingBot, PlatformName } from \"../adapter.js\";\nimport { resolveLinkBaseUrl } from \"../config.js\";\nimport * as log from \"../log.js\";\nimport type { SandboxConfig } from \"../sandbox/index.js\";\nimport type { VaultManager } from \"../vault/index.js\";\nimport { handleAdminRequest, type AdminRuntimeBridge } from \"./admin/portal.js\";\nimport type { InMemoryAdminTokenStore } from \"./admin/store.js\";\nimport { handleAgentEventsRequest } from \"./agent-events/portal.js\";\nimport { createLoginRequestHandler } from \"./login/portal.js\";\nimport { requestBaseUrl } from \"./request.js\";\nimport type { InMemoryLinkTokenStore } from \"./login/store.js\";\nimport type { NotifyFn } from \"./login/types.js\";\nimport {\n  handleSessionViewRequest,\n  type SessionViewInteractiveOptions,\n} from \"./session-view/portal.js\";\nimport type { InMemorySessionViewTokenStore } from \"./session-view/store.js\";\n\ninterface StartWebServerOptions {\n  port: number;\n  linkTokenStore: InMemoryLinkTokenStore;\n  vaultManager: VaultManager;\n  notify: NotifyFn;\n  sessionViewTokenStore?: InMemorySessionViewTokenStore;\n  sessionViewInteractive?: SessionViewInteractiveOptions;\n  adminOptions?: {\n    adminTokenStore: InMemoryAdminTokenStore;\n    workingDir?: string;\n    runtime?: AdminRuntimeBridge;\n    sandbox?: SandboxConfig;\n    botsByPlatform?: Partial<Record<PlatformName, MessagingBot>>;\n  };\n}\n\nexport function startWebServer(options: StartWebServerOptions): Server {\n  const loginHandler = createLoginRequestHandler(\n    options.linkTokenStore,\n    options.vaultManager,\n    options.notify,\n  );\n\n  const server = createServer(async (req: IncomingMessage, res: ServerResponse) => {\n    try {\n      const url = new URL(req.url ?? \"/\", requestBaseUrl(req));\n\n      if (req.method === \"GET\" && url.pathname === \"/health\") {\n        res.writeHead(200, { \"Content-Type\": \"application/json\" });\n        res.end(JSON.stringify({ ok: true }));\n        return;\n      }\n\n      if (handleAgentEventsRequest(req, res, url)) return;\n\n      const adminOptions = options.adminOptions;\n      if (\n        adminOptions?.adminTokenStore &&\n        handleAdminRequest(req, res, url, {\n          vaultManager: options.vaultManager,\n          linkTokenStore: options.linkTokenStore,\n          sessionViewTokenStore: options.sessionViewTokenStore,\n          adminTokenStore: adminOptions.adminTokenStore,\n          portalBaseUrl: resolveLinkBaseUrl() ?? undefined,\n          workingDir: adminOptions.workingDir,\n          runtime: adminOptions.runtime,\n          sandbox: adminOptions.sandbox,\n          botsByPlatform: adminOptions.botsByPlatform,\n        })\n      ) {\n        return;\n      }\n\n      if (\n        await handleSessionViewRequest(\n          req,\n          res,\n          url,\n          options.sessionViewTokenStore,\n          options.sessionViewInteractive,\n        )\n      ) {\n        return;\n      }\n\n      if (loginHandler(req, res, url)) return;\n\n      res.writeHead(404);\n      res.end();\n    } catch (err) {\n      log.logWarning(\"Web server request error\", err instanceof Error ? err.message : String(err));\n      if (!res.headersSent) {\n        res.writeHead(500, { \"Content-Type\": \"application/json\" });\n      }\n      res.end(JSON.stringify({ error: \"Internal server error\" }));\n    }\n  });\n\n  const bindHost = resolveLinkBaseUrl() ? undefined : \"127.0.0.1\";\n  server.listen(options.port, bindHost, () => {\n    log.logInfo(`Web server listening on ${bindHost ?? \"0.0.0.0\"}:${options.port}`);\n    if (!resolveLinkBaseUrl()) {\n      log.logWarning(\n        \"MIKAN_LINK_URL is not set — bound to 127.0.0.1 and OAuth redirect_uri will be \" +\n          \"derived from request headers (Host / X-Forwarded-*). Set \" +\n          \"MIKAN_LINK_URL=https://your-host.example.com for production.\",\n      );\n    }\n  });\n\n  server.on(\"error\", (err) => {\n    log.logWarning(\"Web server error\", err.message);\n  });\n\n  return server;\n}\n"]}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/web/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,MAAM,CAAC;AAE5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,kBAAkB,EAA2B,MAAM,mBAAmB,CAAC;AAEhF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAG9C,OAAO,EACL,wBAAwB,GAEzB,MAAM,0BAA0B,CAAC;AAmBlC,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,MAAM,YAAY,GAAG,yBAAyB,CAC5C,OAAO,CAAC,cAAc,EACtB,OAAO,CAAC,YAAY,EACpB,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAC9E,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;YAEzD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACvD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YAED,IAAI,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAO;YAEpD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;YAC1C,IACE,YAAY,EAAE,eAAe;gBAC7B,CAAC,MAAM,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;oBACvC,YAAY,EAAE,OAAO,CAAC,YAAY;oBAClC,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;oBACpD,eAAe,EAAE,YAAY,CAAC,eAAe;oBAC7C,aAAa,EAAE,kBAAkB,EAAE,IAAI,SAAS;oBAChD,UAAU,EAAE,YAAY,CAAC,UAAU;oBACnC,OAAO,EAAE,YAAY,CAAC,OAAO;oBAC7B,OAAO,EAAE,YAAY,CAAC,OAAO;oBAC7B,cAAc,EAAE,YAAY,CAAC,cAAc;iBAC5C,CAAC,CAAC,EACH,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IACE,MAAM,wBAAwB,CAC5B,GAAG,EACH,GAAG,EACH,GAAG,EACH,OAAO,CAAC,qBAAqB,EAC7B,OAAO,CAAC,sBAAsB,CAC/B,EACD,CAAC;gBACD,OAAO;YACT,CAAC;YAED,IAAI,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAO;YAExC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,UAAU,CAAC,0BAA0B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7F,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IAChE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE;QACzC,GAAG,CAAC,OAAO,CAAC,2BAA2B,QAAQ,IAAI,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC1B,GAAG,CAAC,UAAU,CACZ,gFAAgF;gBAC9E,2DAA2D;gBAC3D,8DAA8D,CACjE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,GAAG,CAAC,UAAU,CAAC,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { createServer, type IncomingMessage, type Server, type ServerResponse } from \"http\";\nimport type { MessagingBot, PlatformName } from \"../adapter.js\";\nimport { resolveLinkBaseUrl } from \"../config.js\";\nimport * as log from \"../log.js\";\nimport type { SandboxConfig } from \"../sandbox/index.js\";\nimport type { VaultManager } from \"../vault/index.js\";\nimport { handleAdminRequest, type AdminRuntimeBridge } from \"./admin/portal.js\";\nimport type { InMemoryAdminTokenStore } from \"./admin/store.js\";\nimport { handleAgentEventsRequest } from \"./agent-events/portal.js\";\nimport { createLoginRequestHandler } from \"./login/portal.js\";\nimport { requestBaseUrl } from \"./request.js\";\nimport type { InMemoryLinkTokenStore } from \"./login/store.js\";\nimport type { NotifyFn } from \"./login/types.js\";\nimport {\n  handleSessionViewRequest,\n  type SessionViewInteractiveOptions,\n} from \"./session-view/portal.js\";\nimport type { InMemorySessionViewTokenStore } from \"./session-view/store.js\";\n\ninterface StartWebServerOptions {\n  port: number;\n  linkTokenStore: InMemoryLinkTokenStore;\n  vaultManager: VaultManager;\n  notify: NotifyFn;\n  sessionViewTokenStore?: InMemorySessionViewTokenStore;\n  sessionViewInteractive?: SessionViewInteractiveOptions;\n  adminOptions?: {\n    adminTokenStore: InMemoryAdminTokenStore;\n    workingDir?: string;\n    runtime?: AdminRuntimeBridge;\n    sandbox?: SandboxConfig;\n    botsByPlatform?: Partial<Record<PlatformName, MessagingBot>>;\n  };\n}\n\nexport function startWebServer(options: StartWebServerOptions): Server {\n  const loginHandler = createLoginRequestHandler(\n    options.linkTokenStore,\n    options.vaultManager,\n    options.notify,\n  );\n\n  const server = createServer(async (req: IncomingMessage, res: ServerResponse) => {\n    try {\n      const url = new URL(req.url ?? \"/\", requestBaseUrl(req));\n\n      if (req.method === \"GET\" && url.pathname === \"/health\") {\n        res.writeHead(200, { \"Content-Type\": \"application/json\" });\n        res.end(JSON.stringify({ ok: true }));\n        return;\n      }\n\n      if (handleAgentEventsRequest(req, res, url)) return;\n\n      const adminOptions = options.adminOptions;\n      if (\n        adminOptions?.adminTokenStore &&\n        (await handleAdminRequest(req, res, url, {\n          vaultManager: options.vaultManager,\n          linkTokenStore: options.linkTokenStore,\n          sessionViewTokenStore: options.sessionViewTokenStore,\n          adminTokenStore: adminOptions.adminTokenStore,\n          portalBaseUrl: resolveLinkBaseUrl() ?? undefined,\n          workingDir: adminOptions.workingDir,\n          runtime: adminOptions.runtime,\n          sandbox: adminOptions.sandbox,\n          botsByPlatform: adminOptions.botsByPlatform,\n        }))\n      ) {\n        return;\n      }\n\n      if (\n        await handleSessionViewRequest(\n          req,\n          res,\n          url,\n          options.sessionViewTokenStore,\n          options.sessionViewInteractive,\n        )\n      ) {\n        return;\n      }\n\n      if (loginHandler(req, res, url)) return;\n\n      res.writeHead(404);\n      res.end();\n    } catch (err) {\n      log.logWarning(\"Web server request error\", err instanceof Error ? err.message : String(err));\n      if (!res.headersSent) {\n        res.writeHead(500, { \"Content-Type\": \"application/json\" });\n      }\n      res.end(JSON.stringify({ error: \"Internal server error\" }));\n    }\n  });\n\n  const bindHost = resolveLinkBaseUrl() ? undefined : \"127.0.0.1\";\n  server.listen(options.port, bindHost, () => {\n    log.logInfo(`Web server listening on ${bindHost ?? \"0.0.0.0\"}:${options.port}`);\n    if (!resolveLinkBaseUrl()) {\n      log.logWarning(\n        \"MIKAN_LINK_URL is not set — bound to 127.0.0.1 and OAuth redirect_uri will be \" +\n          \"derived from request headers (Host / X-Forwarded-*). Set \" +\n          \"MIKAN_LINK_URL=https://your-host.example.com for production.\",\n      );\n    }\n  });\n\n  server.on(\"error\", (err) => {\n    log.logWarning(\"Web server error\", err.message);\n  });\n\n  return server;\n}\n"]}

package/dist/web/session-view/portal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../src/web/session-view/portal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAmB5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AA4DhE,YAAY,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAEhE,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,qBAAqB,CAAC,EAAE,6BAA6B,EACrD,WAAW,CAAC,EAAE,6BAA6B,GAC1C,OAAO,CAAC,OAAO,CAAC,CA2GlB;AAmID,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB,CA8BA"}
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../src/web/session-view/portal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,MAAM,CAAC;AAoB5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AA4DhE,YAAY,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAEhE,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,GAAG,EACR,qBAAqB,CAAC,EAAE,6BAA6B,EACrD,WAAW,CAAC,EAAE,6BAA6B,GAC1C,OAAO,CAAC,OAAO,CAAC,CA2GlB;AAmID,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB,CA8BA"}

package/dist/web/session-view/portal.js

@@ -1,5 +1,6 @@
 import { basename } from "path";
 import MarkdownIt from "markdown-it";
+import { readRawBody } from "../../utils/http-body.js";
 import { escapeHtml } from "../../utils/html.js";
 import * as log from "../../log.js";
 import { renderPortalShell } from "../../portal-shell.js";
@@ -426,9 +427,12 @@ async function handleSessionMessageRequest(req, res, sessionViewTokenStore, inte
         json(res, 503, { ok: false, error: "Session chat is not configured." });
         return;
     }
+    const rawBody = await readRawBody(req, res, 1024 * 1024);
+    if (rawBody === null)
+        return;
     let body;
     try {
-        body = JSON.parse(await readRequestBody(req));
+        body = JSON.parse(rawBody);
     }
     catch {
         json(res, 400, { ok: false, error: "Invalid request body." });
@@ -596,21 +600,6 @@ function createSessionViewResponseContext(publish) {
         },
     };
 }
-function readRequestBody(req) {
-    return new Promise((resolve, reject) => {
-        let data = "";
-        req.setEncoding("utf8");
-        req.on("data", (chunk) => {
-            data += chunk;
-            if (data.length > 1024 * 1024) {
-                reject(new Error("Request body too large"));
-                req.destroy();
-            }
-        });
-        req.on("end", () => resolve(data));
-        req.on("error", reject);
-    });
-}
 function json(res, status, body) {
     res.writeHead(status, {
         "Content-Type": "application/json; charset=utf-8",