@geminixiang/mikan 1.0.0-beta.34 → 1.0.0-beta.35

package/CHANGELOG.md

@@ -9,6 +9,21 @@ any release.
 
 ## [Unreleased]
 
+## [1.0.0-beta.35]
+
+Completes the office storage migration introduced in 1.0.0-beta.34: sandbox containers now survive it with everything installed inside them intact. Upgrading directly from 1.0.0-beta.33 or earlier to this release keeps container contents; deployments that already booted 1.0.0-beta.34 had their containers recreated by that release.
+
+### Added
+
+- Preserve managed sandbox containers through the office layout migration: each container still mounting legacy paths is committed to a snapshot and re-created with translated workspace, state, and vault mounts, keeping its writable layer — software installed inside survives the upgrade.
+- Migrate containers off the boot path: on demand before a conversation's next message and via a background sweep after the platforms start, so boot stays fast and nothing blocks on the one-time cost.
+- Resume interrupted container migrations safely: the pre-removal mounts ride on the snapshot image, a crash at any point resumes without data loss, and snapshots are reclaimed once a container naturally returns to the base image.
+- Add the `MIKAN_SKIP_CONTAINER_PRESERVATION` escape hatch to fall back to plain container removal.
+
+### Tests
+
+- Cover translate, no-op, resume, orphan-resume, snapshot reclamation, and disarmed paths on a stateful docker mock, plus bind-translator unit tests; rehearsed against real docker including the crash-resume path.
+
 ## [1.0.0-beta.34]
 
 **One-way storage migration.** On first boot this release renames every conversation's workspace directory, credential vault, and host state tree to platform-scoped office keys, journaled with crash recovery. Back up the state dir and workspace before upgrading; earlier versions cannot read the migrated layout, so there is no downgrade. Managed sandbox containers for migrated conversations are recreated, which resets software installed inside them once (a preservation path is planned for a follow-up release).

package/dist/env-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-manifest.d.ts","sourceRoot":"","sources":["../src/env-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,eAAO,MAAM,YAAY,EAAE,SAAS,QAAQ,EAoJ3C,CAAC;AAEF,KAAK,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAQtD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,SAAmB,GAAG,OAAO,CAM/E;AAED,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,SAAmB,GAAG,MAAM,EAAE,CAIrE;AASD,wBAAgB,kBAAkB,IAAI,MAAM,CAK3C;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAI1C;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAM7E;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,GAAE,SAAmB,GAAG,MAAM,CAuB1D"}
+{"version":3,"file":"env-manifest.d.ts","sourceRoot":"","sources":["../src/env-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAG3C,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,eAAO,MAAM,YAAY,EAAE,SAAS,QAAQ,EAyJ3C,CAAC;AAEF,KAAK,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAQtD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,SAAmB,GAAG,OAAO,CAM/E;AAED,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,SAAmB,GAAG,MAAM,EAAE,CAIrE;AASD,wBAAgB,kBAAkB,IAAI,MAAM,CAK3C;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAI1C;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAM7E;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,GAAE,SAAmB,GAAG,MAAM,CAuB1D"}

package/dist/env-manifest.js

@@ -134,6 +134,11 @@ export const ENV_MANIFEST = [
         kind: "feature",
         vars: [
             { name: "STATE_DIR", deploy: false, doc: "State dir override (same as --state-dir)" },
+            {
+                name: "SKIP_CONTAINER_PRESERVATION",
+                deploy: false,
+                doc: "Set to 1 to skip preserving container contents through the office layout migration",
+            },
             {
                 name: "HTTP_IDLE_TIMEOUT",
                 deploy: false,

package/dist/env-manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"env-manifest.js","sourceRoot":"","sources":["../src/env-manifest.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAIzC,MAAM,CAAC,MAAM,YAAY,GAAwB;IAC/C;QACE,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,gCAAgC;aACtC;YACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,EAAE;SACrF;KACF;IACD;QACE,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;KAC7F;IACD;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;KACtF;IACD;QACE,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,+DAA+D;QACpE,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE;YAC/D,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE;YAC9E;gBACE,IAAI,EAAE,6BAA6B;gBACnC,GAAG,EAAE,qEAAqE;aAC3E;YACD;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,0DAA0D;aAChE;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,GAAG,EAAE,+DAA+D;aACrE;YACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,uCAAuC,EAAE;SAC/E;QACD,KAAK,EAAE,CAAC,wBAAwB,EAAE,6BAA6B,CAAC;KACjE;IACD;QACE,GAAG,EAAE,KAAK;QACV,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,sDAAsD;QAC3D,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,mBAAmB,EAAE;YACrE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE;SAChE;KACF;IACD;QACE,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,iEAAiE;QACtE,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,6DAA6D,EAAE;YACxF,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,iDAAiD,EAAE;YAC7E,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,qCAAqC,EAAE;YAC9E,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,yBAAyB,EAAE;YACpF,EAAE,IAAI,EAAE,gCAAgC,EAAE,GAAG,EAAE,0CAA0C,EAAE;YAC3F;gBACE,IAAI,EAAE,oCAAoC;gBAC1C,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,+BAA+B;aACrC;YACD,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,0CAA0C,EAAE;YACvF;gBACE,IAAI,EAAE,gCAAgC;gBACtC,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,+BAA+B;aACrC;SACF;KACF;IACD;QACE,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,kBAAkB;QACzB,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,oEAAoE;QACzE,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,gCAAgC;gBACtC,GAAG,EAAE,4DAA4D;aAClE;YACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,yBAAyB,EAAE;SACjE;KACF;IACD;QACE,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,qDAAqD;QAC1D,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,mBAAmB,EAAE;YAC5D,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,0BAA0B,EAAE;YACnF;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,kDAAkD;aACxD;SACF;KACF;IACD;QACE,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,sDAAsD,EAAE;YACnF;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,6CAA6C;aACnD;YACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,gCAAgC,EAAE;SACjF;KACF;IACD;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,0CAA0C,EAAE;YACrF;gBACE,IAAI,EAAE,mBAAmB;gBACzB,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,8CAA8C;aACpD;YACD;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,+CAA+C;aACrD;SACF;KACF;CACF,CAAC;AAIF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAG,GAAc,OAAO;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAG,GAAc,OAAO;IACzD,OAAO,YAAY,CAAC,MAAM,CACxB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CACzE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,KAAe;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,WAAW,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;SACtE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,0CAA0C,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,GAAG,CAClE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,CACxC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,OAAkC;IACjE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACpC,KAAK,CAAC,IAAI;SACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC;SAC/D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAC,GAAG,GAAc,OAAO;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,UAAU;YACvB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;gBAChC,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,aAAa;YACjB,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YAChD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CACR,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAC1F,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["/**\n * The daemon's environment interface, declared as data — the one inventory\n * that startup validation, `mikan env`, `--help`, and the pm2 deploy\n * template check all derive from. Add a var here and every derived surface\n * picks it up; a var read anywhere else but not listed here is a bug.\n *\n * Names are the un-prefixed spelling; `readEnv` accepts a `MIKAN_`-prefixed\n * alias for each. Not covered: dynamic OAuth service keys from\n * OAUTH_SERVICES_JSON (data-driven by design) and standard proxy vars\n * (HTTPS_PROXY/HTTP_PROXY/NO_PROXY).\n */\nimport type { EnvGroup } from \"./types.js\";\nimport { readEnv } from \"./utils/env.js\";\n\nexport type { EnvGroup } from \"./types.js\";\n\nexport const ENV_MANIFEST: readonly EnvGroup[] = [\n  {\n    key: \"slack\",\n    title: \"Slack\",\n    kind: \"platform\",\n    vars: [\n      {\n        name: \"SLACK_APP_TOKEN\",\n        required: true,\n        secret: true,\n        doc: \"Socket-mode app token (xapp-…)\",\n      },\n      { name: \"SLACK_BOT_TOKEN\", required: true, secret: true, doc: \"Bot token (xoxb-…)\" },\n    ],\n  },\n  {\n    key: \"telegram\",\n    title: \"Telegram\",\n    kind: \"platform\",\n    vars: [{ name: \"TELEGRAM_BOT_TOKEN\", required: true, secret: true, doc: \"BotFather token\" }],\n  },\n  {\n    key: \"discord\",\n    title: \"Discord\",\n    kind: \"platform\",\n    vars: [{ name: \"DISCORD_BOT_TOKEN\", required: true, secret: true, doc: \"Bot token\" }],\n  },\n  {\n    key: \"github\",\n    title: \"GitHub\",\n    kind: \"platform\",\n    doc: \"Issue/PR conversations via a GitHub App (polling, no webhook)\",\n    vars: [\n      { name: \"GITHUB_APP_ID\", required: true, doc: \"GitHub App id\" },\n      { name: \"GITHUB_INSTALLATION_ID\", required: true, doc: \"App installation id\" },\n      {\n        name: \"GITHUB_APP_PRIVATE_KEY_PATH\",\n        doc: \"Path to the App private key .pem (preferred; keep outside any repo)\",\n      },\n      {\n        name: \"GITHUB_APP_PRIVATE_KEY\",\n        secret: true,\n        deploy: false,\n        doc: \"App private key PEM with literal \\\\n newlines (fallback)\",\n      },\n      {\n        name: \"GITHUB_REPOS\",\n        doc: \"Comma-separated owner/repo allowlist (default: all installed)\",\n      },\n      { name: \"GITHUB_POLL_INTERVAL\", doc: \"Poll interval in seconds (default 60)\" },\n    ],\n    anyOf: [\"GITHUB_APP_PRIVATE_KEY\", \"GITHUB_APP_PRIVATE_KEY_PATH\"],\n  },\n  {\n    key: \"llm\",\n    title: \"LLM providers\",\n    kind: \"feature\",\n    doc: \"Provider keys can also live in <state-dir>/auth.json\",\n    vars: [\n      { name: \"ANTHROPIC_API_KEY\", secret: true, doc: \"Anthropic API key\" },\n      { name: \"OPENAI_API_KEY\", secret: true, doc: \"OpenAI API key\" },\n    ],\n  },\n  {\n    key: \"link\",\n    title: \"Link/OAuth server\",\n    kind: \"feature\",\n    doc: \"Credential onboarding links, session view, and the Admin portal\",\n    vars: [\n      { name: \"LINK_URL\", doc: \"Externally visible base URL, e.g. https://mikan.example.com\" },\n      { name: \"LINK_PORT\", doc: \"Listen port (default 8181 when LINK_URL is set)\" },\n      { name: \"GITHUB_OAUTH_CLIENT_ID\", doc: \"GitHub OAuth app for /login linking\" },\n      { name: \"GITHUB_OAUTH_CLIENT_SECRET\", secret: true, doc: \"GitHub OAuth app secret\" },\n      { name: \"GOOGLE_WORKSPACE_CLI_CLIENT_ID\", doc: \"Google Workspace OAuth client for /login\" },\n      {\n        name: \"GOOGLE_WORKSPACE_CLI_CLIENT_SECRET\",\n        secret: true,\n        doc: \"Google Workspace OAuth secret\",\n      },\n      { name: \"GOOGLE_CLOUD_SDK_CLIENT_ID\", doc: \"Google Cloud SDK OAuth client for /login\" },\n      {\n        name: \"GOOGLE_CLOUD_SDK_CLIENT_SECRET\",\n        secret: true,\n        doc: \"Google Cloud SDK OAuth secret\",\n      },\n    ],\n  },\n  {\n    key: \"cloudbuild\",\n    title: \"Cloud Build logs\",\n    kind: \"feature\",\n    doc: \"Host-side GCP credentials unlock Cloud Build logs in github_checks\",\n    vars: [\n      {\n        name: \"GOOGLE_APPLICATION_CREDENTIALS\",\n        doc: \"Path to a GCP credentials file (e.g. WIF external_account)\",\n      },\n      { name: \"GOOGLE_CLOUD_PROJECT\", doc: \"Fallback GCP project id\" },\n    ],\n  },\n  {\n    key: \"cloudflare\",\n    title: \"Cloudflare sandbox\",\n    kind: \"feature\",\n    doc: \"For --sandbox=cloudflare:<id> via the bridge worker\",\n    vars: [\n      { name: \"CLOUDFLARE_SANDBOX_URL\", doc: \"Bridge worker URL\" },\n      { name: \"CLOUDFLARE_SANDBOX_TOKEN\", secret: true, doc: \"Bridge worker auth token\" },\n      {\n        name: \"CLOUDFLARE_SANDBOX_CWD\",\n        deploy: false,\n        doc: \"Exec cwd inside the sandbox (default /workspace)\",\n      },\n    ],\n  },\n  {\n    key: \"observability\",\n    title: \"Observability\",\n    kind: \"feature\",\n    vars: [\n      { name: \"SENTRY_DSN\", doc: \"Sentry DSN (settings.json sentry.dsn wins over this)\" },\n      {\n        name: \"SENTRY_ENVIRONMENT\",\n        deploy: false,\n        doc: \"Sentry environment tag (default production)\",\n      },\n      { name: \"SENTRY_ENABLED\", deploy: false, doc: \"Set to false to disable Sentry\" },\n    ],\n  },\n  {\n    key: \"runtime\",\n    title: \"Runtime\",\n    kind: \"feature\",\n    vars: [\n      { name: \"STATE_DIR\", deploy: false, doc: \"State dir override (same as --state-dir)\" },\n      {\n        name: \"HTTP_IDLE_TIMEOUT\",\n        deploy: false,\n        doc: \"Idle timeout in ms for outbound HTTP streams\",\n      },\n      {\n        name: \"AGENT_EVENTS_TOKEN\",\n        secret: true,\n        deploy: false,\n        doc: \"Bearer token guarding the agent-events stream\",\n      },\n    ],\n  },\n];\n\ntype EnvLookup = (name: string) => string | undefined;\n\nfunction groupByKey(key: string): EnvGroup {\n  const group = ENV_MANIFEST.find((candidate) => candidate.key === key);\n  if (!group) throw new Error(`Unknown env-manifest group: ${key}`);\n  return group;\n}\n\n/** A platform group activates when all required vars (and one anyOf) are set. */\nexport function platformIsActive(key: string, env: EnvLookup = readEnv): boolean {\n  const group = groupByKey(key);\n  const required = group.vars.filter((spec) => spec.required);\n  if (!required.every((spec) => env(spec.name))) return false;\n  if (group.anyOf && !group.anyOf.some((name) => env(name))) return false;\n  return true;\n}\n\nexport function activePlatformKeys(env: EnvLookup = readEnv): string[] {\n  return ENV_MANIFEST.filter(\n    (group) => group.kind === \"platform\" && platformIsActive(group.key, env),\n  ).map((group) => group.key);\n}\n\n/** One line per platform group: the vars an operator must set to activate it. */\nfunction platformRecipe(group: EnvGroup): string {\n  const required = group.vars.filter((spec) => spec.required).map((spec) => spec.name);\n  const alternative = group.anyOf ? ` + ${group.anyOf.join(\" | \")}` : \"\";\n  return `${group.title}: ${required.join(\" + \")}${alternative}`;\n}\n\nexport function noPlatformsMessage(): string {\n  const recipes = ENV_MANIFEST.filter((group) => group.kind === \"platform\")\n    .map((group) => `  ${platformRecipe(group)}`)\n    .join(\"\\n\");\n  return `No platform tokens found. Set one of:\\n${recipes}`;\n}\n\n/** The `--help` environment section, derived from the platform groups. */\nexport function envSummaryLines(): string[] {\n  return ENV_MANIFEST.filter((group) => group.kind === \"platform\").map(\n    (group) => `  ${platformRecipe(group)}`,\n  );\n}\n\n/** Every var an operator may set; `deployOnly` filters to template-listed ones. */\nexport function manifestVarNames(options?: { deployOnly?: boolean }): string[] {\n  return ENV_MANIFEST.flatMap((group) =>\n    group.vars\n      .filter((spec) => !options?.deployOnly || spec.deploy !== false)\n      .map((spec) => spec.name),\n  );\n}\n\n/** `mikan env` output: every group and var with set/unset status. No values. */\nexport function envReport(env: EnvLookup = readEnv): string {\n  const lines: string[] = [];\n  for (const group of ENV_MANIFEST) {\n    const active =\n      group.kind === \"platform\"\n        ? platformIsActive(group.key, env)\n          ? \" — active\"\n          : \" — inactive\"\n        : \"\";\n    lines.push(`${group.title}${active}${group.doc ? ` · ${group.doc}` : \"\"}`);\n    for (const spec of group.vars) {\n      const status = env(spec.name) ? \"set\" : \"unset\";\n      const marks = [spec.required ? \"required\" : \"\", spec.secret ? \"secret\" : \"\"]\n        .filter(Boolean)\n        .join(\", \");\n      lines.push(\n        `  ${spec.name.padEnd(36)} ${status.padEnd(6)}${marks ? ` [${marks}]` : \"\"}  ${spec.doc}`,\n      );\n    }\n    lines.push(\"\");\n  }\n  lines.push(\"Each var also accepts a MIKAN_-prefixed alias (e.g. MIKAN_LINK_URL).\");\n  return lines.join(\"\\n\");\n}\n"]}
+{"version":3,"file":"env-manifest.js","sourceRoot":"","sources":["../src/env-manifest.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAIzC,MAAM,CAAC,MAAM,YAAY,GAAwB;IAC/C;QACE,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,gCAAgC;aACtC;YACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,EAAE;SACrF;KACF;IACD;QACE,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;KAC7F;IACD;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;KACtF;IACD;QACE,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,+DAA+D;QACpE,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE;YAC/D,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE;YAC9E;gBACE,IAAI,EAAE,6BAA6B;gBACnC,GAAG,EAAE,qEAAqE;aAC3E;YACD;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,0DAA0D;aAChE;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,GAAG,EAAE,+DAA+D;aACrE;YACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,uCAAuC,EAAE;SAC/E;QACD,KAAK,EAAE,CAAC,wBAAwB,EAAE,6BAA6B,CAAC;KACjE;IACD;QACE,GAAG,EAAE,KAAK;QACV,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,sDAAsD;QAC3D,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,mBAAmB,EAAE;YACrE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE;SAChE;KACF;IACD;QACE,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,iEAAiE;QACtE,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,6DAA6D,EAAE;YACxF,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,iDAAiD,EAAE;YAC7E,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,qCAAqC,EAAE;YAC9E,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,yBAAyB,EAAE;YACpF,EAAE,IAAI,EAAE,gCAAgC,EAAE,GAAG,EAAE,0CAA0C,EAAE;YAC3F;gBACE,IAAI,EAAE,oCAAoC;gBAC1C,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,+BAA+B;aACrC;YACD,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,0CAA0C,EAAE;YACvF;gBACE,IAAI,EAAE,gCAAgC;gBACtC,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,+BAA+B;aACrC;SACF;KACF;IACD;QACE,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,kBAAkB;QACzB,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,oEAAoE;QACzE,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,gCAAgC;gBACtC,GAAG,EAAE,4DAA4D;aAClE;YACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,yBAAyB,EAAE;SACjE;KACF;IACD;QACE,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,qDAAqD;QAC1D,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,mBAAmB,EAAE;YAC5D,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,0BAA0B,EAAE;YACnF;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,kDAAkD;aACxD;SACF;KACF;IACD;QACE,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,sDAAsD,EAAE;YACnF;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,6CAA6C;aACnD;YACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,gCAAgC,EAAE;SACjF;KACF;IACD;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,0CAA0C,EAAE;YACrF;gBACE,IAAI,EAAE,6BAA6B;gBACnC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,oFAAoF;aAC1F;YACD;gBACE,IAAI,EAAE,mBAAmB;gBACzB,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,8CAA8C;aACpD;YACD;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,+CAA+C;aACrD;SACF;KACF;CACF,CAAC;AAIF,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IAClE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAG,GAAc,OAAO;IACpE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAG,GAAc,OAAO;IACzD,OAAO,YAAY,CAAC,MAAM,CACxB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CACzE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,KAAe;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,WAAW,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;SACtE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,0CAA0C,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,GAAG,CAClE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,CACxC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,OAAkC;IACjE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACpC,KAAK,CAAC,IAAI;SACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC;SAC/D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAC,GAAG,GAAc,OAAO;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,UAAU;YACvB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;gBAChC,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,aAAa;YACjB,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YAChD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CACR,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAC1F,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC","sourcesContent":["/**\n * The daemon's environment interface, declared as data — the one inventory\n * that startup validation, `mikan env`, `--help`, and the pm2 deploy\n * template check all derive from. Add a var here and every derived surface\n * picks it up; a var read anywhere else but not listed here is a bug.\n *\n * Names are the un-prefixed spelling; `readEnv` accepts a `MIKAN_`-prefixed\n * alias for each. Not covered: dynamic OAuth service keys from\n * OAUTH_SERVICES_JSON (data-driven by design) and standard proxy vars\n * (HTTPS_PROXY/HTTP_PROXY/NO_PROXY).\n */\nimport type { EnvGroup } from \"./types.js\";\nimport { readEnv } from \"./utils/env.js\";\n\nexport type { EnvGroup } from \"./types.js\";\n\nexport const ENV_MANIFEST: readonly EnvGroup[] = [\n  {\n    key: \"slack\",\n    title: \"Slack\",\n    kind: \"platform\",\n    vars: [\n      {\n        name: \"SLACK_APP_TOKEN\",\n        required: true,\n        secret: true,\n        doc: \"Socket-mode app token (xapp-…)\",\n      },\n      { name: \"SLACK_BOT_TOKEN\", required: true, secret: true, doc: \"Bot token (xoxb-…)\" },\n    ],\n  },\n  {\n    key: \"telegram\",\n    title: \"Telegram\",\n    kind: \"platform\",\n    vars: [{ name: \"TELEGRAM_BOT_TOKEN\", required: true, secret: true, doc: \"BotFather token\" }],\n  },\n  {\n    key: \"discord\",\n    title: \"Discord\",\n    kind: \"platform\",\n    vars: [{ name: \"DISCORD_BOT_TOKEN\", required: true, secret: true, doc: \"Bot token\" }],\n  },\n  {\n    key: \"github\",\n    title: \"GitHub\",\n    kind: \"platform\",\n    doc: \"Issue/PR conversations via a GitHub App (polling, no webhook)\",\n    vars: [\n      { name: \"GITHUB_APP_ID\", required: true, doc: \"GitHub App id\" },\n      { name: \"GITHUB_INSTALLATION_ID\", required: true, doc: \"App installation id\" },\n      {\n        name: \"GITHUB_APP_PRIVATE_KEY_PATH\",\n        doc: \"Path to the App private key .pem (preferred; keep outside any repo)\",\n      },\n      {\n        name: \"GITHUB_APP_PRIVATE_KEY\",\n        secret: true,\n        deploy: false,\n        doc: \"App private key PEM with literal \\\\n newlines (fallback)\",\n      },\n      {\n        name: \"GITHUB_REPOS\",\n        doc: \"Comma-separated owner/repo allowlist (default: all installed)\",\n      },\n      { name: \"GITHUB_POLL_INTERVAL\", doc: \"Poll interval in seconds (default 60)\" },\n    ],\n    anyOf: [\"GITHUB_APP_PRIVATE_KEY\", \"GITHUB_APP_PRIVATE_KEY_PATH\"],\n  },\n  {\n    key: \"llm\",\n    title: \"LLM providers\",\n    kind: \"feature\",\n    doc: \"Provider keys can also live in <state-dir>/auth.json\",\n    vars: [\n      { name: \"ANTHROPIC_API_KEY\", secret: true, doc: \"Anthropic API key\" },\n      { name: \"OPENAI_API_KEY\", secret: true, doc: \"OpenAI API key\" },\n    ],\n  },\n  {\n    key: \"link\",\n    title: \"Link/OAuth server\",\n    kind: \"feature\",\n    doc: \"Credential onboarding links, session view, and the Admin portal\",\n    vars: [\n      { name: \"LINK_URL\", doc: \"Externally visible base URL, e.g. https://mikan.example.com\" },\n      { name: \"LINK_PORT\", doc: \"Listen port (default 8181 when LINK_URL is set)\" },\n      { name: \"GITHUB_OAUTH_CLIENT_ID\", doc: \"GitHub OAuth app for /login linking\" },\n      { name: \"GITHUB_OAUTH_CLIENT_SECRET\", secret: true, doc: \"GitHub OAuth app secret\" },\n      { name: \"GOOGLE_WORKSPACE_CLI_CLIENT_ID\", doc: \"Google Workspace OAuth client for /login\" },\n      {\n        name: \"GOOGLE_WORKSPACE_CLI_CLIENT_SECRET\",\n        secret: true,\n        doc: \"Google Workspace OAuth secret\",\n      },\n      { name: \"GOOGLE_CLOUD_SDK_CLIENT_ID\", doc: \"Google Cloud SDK OAuth client for /login\" },\n      {\n        name: \"GOOGLE_CLOUD_SDK_CLIENT_SECRET\",\n        secret: true,\n        doc: \"Google Cloud SDK OAuth secret\",\n      },\n    ],\n  },\n  {\n    key: \"cloudbuild\",\n    title: \"Cloud Build logs\",\n    kind: \"feature\",\n    doc: \"Host-side GCP credentials unlock Cloud Build logs in github_checks\",\n    vars: [\n      {\n        name: \"GOOGLE_APPLICATION_CREDENTIALS\",\n        doc: \"Path to a GCP credentials file (e.g. WIF external_account)\",\n      },\n      { name: \"GOOGLE_CLOUD_PROJECT\", doc: \"Fallback GCP project id\" },\n    ],\n  },\n  {\n    key: \"cloudflare\",\n    title: \"Cloudflare sandbox\",\n    kind: \"feature\",\n    doc: \"For --sandbox=cloudflare:<id> via the bridge worker\",\n    vars: [\n      { name: \"CLOUDFLARE_SANDBOX_URL\", doc: \"Bridge worker URL\" },\n      { name: \"CLOUDFLARE_SANDBOX_TOKEN\", secret: true, doc: \"Bridge worker auth token\" },\n      {\n        name: \"CLOUDFLARE_SANDBOX_CWD\",\n        deploy: false,\n        doc: \"Exec cwd inside the sandbox (default /workspace)\",\n      },\n    ],\n  },\n  {\n    key: \"observability\",\n    title: \"Observability\",\n    kind: \"feature\",\n    vars: [\n      { name: \"SENTRY_DSN\", doc: \"Sentry DSN (settings.json sentry.dsn wins over this)\" },\n      {\n        name: \"SENTRY_ENVIRONMENT\",\n        deploy: false,\n        doc: \"Sentry environment tag (default production)\",\n      },\n      { name: \"SENTRY_ENABLED\", deploy: false, doc: \"Set to false to disable Sentry\" },\n    ],\n  },\n  {\n    key: \"runtime\",\n    title: \"Runtime\",\n    kind: \"feature\",\n    vars: [\n      { name: \"STATE_DIR\", deploy: false, doc: \"State dir override (same as --state-dir)\" },\n      {\n        name: \"SKIP_CONTAINER_PRESERVATION\",\n        deploy: false,\n        doc: \"Set to 1 to skip preserving container contents through the office layout migration\",\n      },\n      {\n        name: \"HTTP_IDLE_TIMEOUT\",\n        deploy: false,\n        doc: \"Idle timeout in ms for outbound HTTP streams\",\n      },\n      {\n        name: \"AGENT_EVENTS_TOKEN\",\n        secret: true,\n        deploy: false,\n        doc: \"Bearer token guarding the agent-events stream\",\n      },\n    ],\n  },\n];\n\ntype EnvLookup = (name: string) => string | undefined;\n\nfunction groupByKey(key: string): EnvGroup {\n  const group = ENV_MANIFEST.find((candidate) => candidate.key === key);\n  if (!group) throw new Error(`Unknown env-manifest group: ${key}`);\n  return group;\n}\n\n/** A platform group activates when all required vars (and one anyOf) are set. */\nexport function platformIsActive(key: string, env: EnvLookup = readEnv): boolean {\n  const group = groupByKey(key);\n  const required = group.vars.filter((spec) => spec.required);\n  if (!required.every((spec) => env(spec.name))) return false;\n  if (group.anyOf && !group.anyOf.some((name) => env(name))) return false;\n  return true;\n}\n\nexport function activePlatformKeys(env: EnvLookup = readEnv): string[] {\n  return ENV_MANIFEST.filter(\n    (group) => group.kind === \"platform\" && platformIsActive(group.key, env),\n  ).map((group) => group.key);\n}\n\n/** One line per platform group: the vars an operator must set to activate it. */\nfunction platformRecipe(group: EnvGroup): string {\n  const required = group.vars.filter((spec) => spec.required).map((spec) => spec.name);\n  const alternative = group.anyOf ? ` + ${group.anyOf.join(\" | \")}` : \"\";\n  return `${group.title}: ${required.join(\" + \")}${alternative}`;\n}\n\nexport function noPlatformsMessage(): string {\n  const recipes = ENV_MANIFEST.filter((group) => group.kind === \"platform\")\n    .map((group) => `  ${platformRecipe(group)}`)\n    .join(\"\\n\");\n  return `No platform tokens found. Set one of:\\n${recipes}`;\n}\n\n/** The `--help` environment section, derived from the platform groups. */\nexport function envSummaryLines(): string[] {\n  return ENV_MANIFEST.filter((group) => group.kind === \"platform\").map(\n    (group) => `  ${platformRecipe(group)}`,\n  );\n}\n\n/** Every var an operator may set; `deployOnly` filters to template-listed ones. */\nexport function manifestVarNames(options?: { deployOnly?: boolean }): string[] {\n  return ENV_MANIFEST.flatMap((group) =>\n    group.vars\n      .filter((spec) => !options?.deployOnly || spec.deploy !== false)\n      .map((spec) => spec.name),\n  );\n}\n\n/** `mikan env` output: every group and var with set/unset status. No values. */\nexport function envReport(env: EnvLookup = readEnv): string {\n  const lines: string[] = [];\n  for (const group of ENV_MANIFEST) {\n    const active =\n      group.kind === \"platform\"\n        ? platformIsActive(group.key, env)\n          ? \" — active\"\n          : \" — inactive\"\n        : \"\";\n    lines.push(`${group.title}${active}${group.doc ? ` · ${group.doc}` : \"\"}`);\n    for (const spec of group.vars) {\n      const status = env(spec.name) ? \"set\" : \"unset\";\n      const marks = [spec.required ? \"required\" : \"\", spec.secret ? \"secret\" : \"\"]\n        .filter(Boolean)\n        .join(\", \");\n      lines.push(\n        `  ${spec.name.padEnd(36)} ${status.padEnd(6)}${marks ? ` [${marks}]` : \"\"}  ${spec.doc}`,\n      );\n    }\n    lines.push(\"\");\n  }\n  lines.push(\"Each var also accepts a MIKAN_-prefixed alias (e.g. MIKAN_LINK_URL).\");\n  return lines.join(\"\\n\");\n}\n"]}

package/dist/main.js

@@ -31,7 +31,8 @@ import { configureGondolinRuntime, gondolinResources, reconcileGondolinRuntimes,
 import { FileVaultManager } from "./vault/index.js";
 import { runExtCommand } from "./cli/ext.js";
 import { runOfficeCommand } from "./cli/office.js";
-import { formatUnmigratedOfficesError, migrateLegacyOffices } from "./office-migration.js";
+import { buildContainerBindTranslator, formatUnmigratedOfficesError, migrateLegacyOffices, } from "./office-migration.js";
+import { OfficeRegistry } from "./office-registry.js";
 import { createConversationRuntime } from "./runtime/conversation-runtime.js";
 import { ChannelStore } from "./store.js";
 import * as Sentry from "@sentry/node";
@@ -277,10 +278,26 @@ const provisioner = sandbox.type === "image"
         boostLimits: sandboxBoostLimits,
     })
     : undefined;
-// Containers provisioned before an office migration mount the renamed legacy
-// paths; recreate them so mounts follow the office-key layout.
-if (provisioner && (officeMigration.migrated.length > 0 || officeMigration.recovered.length > 0)) {
-    await provisioner.removeContainersForConversations(new Set([...officeMigration.migrated, ...officeMigration.recovered]));
+// Containers provisioned before the office migration mount the renamed
+// legacy paths. Their writable layers (everything installed inside) are
+// preserved: each container is committed and recreated with translated
+// mounts — on demand before its next message, and via a background sweep
+// after the bots start. MIKAN_SKIP_CONTAINER_PRESERVATION=1 falls back to
+// plain removal (containers rebuild from the base image on next use).
+const registryOffices = new OfficeRegistry(stateDir).getOffices();
+if (provisioner && registryOffices.length > 0) {
+    if (readEnv("SKIP_CONTAINER_PRESERVATION") === "1") {
+        if (officeMigration.migrated.length > 0 || officeMigration.recovered.length > 0) {
+            await provisioner.removeContainersForConversations(new Set([...officeMigration.migrated, ...officeMigration.recovered]));
+        }
+    }
+    else {
+        provisioner.armContainerLayoutMigration(buildContainerBindTranslator({
+            offices: registryOffices,
+            workspaceRoot: workingDir,
+            stateDir,
+        }));
+    }
 }
 if (sandbox.type === "gondolin") {
     try {
@@ -625,4 +642,11 @@ await Promise.all(Object.values(botsByPlatform).map((bot) => bot.start().catch((
     log.logWarning("Failed to start bot", err instanceof Error ? err.message : String(err));
     process.exit(1);
 })));
+// Drain the container layout migration off the hot path; every unit is
+// idempotent, so an interrupted sweep simply resumes on the next boot.
+if (provisioner) {
+    void provisioner.sweepContainerLayoutMigration().catch((err) => {
+        log.logWarning("Container layout sweep failed", err instanceof Error ? err.message : String(err));
+    });
+}
 //# sourceMappingURL=main.js.map

package/dist/main.js.map

@@ -1 +1 @@
-{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AAEA,OAAO,+BAA+B,CAAC;AAEvC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,MAAM,CAAC;AASjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAEtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,iBAAiB,IAAI,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,kBAAkB,EAClB,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAiB,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,4BAA4B,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC3F,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAEvC,SAAS,UAAU;IACjB,2DAA2D;IAC3D,MAAM,aAAa,GAAG;QACpB,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC;QACjE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC;QACvE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC;KACxC,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,oBAAoB,CAC9B,OAAO,EACP,CAAC,KAAK,EAAkC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC1D,GAAG,EAAE,CAAC,+CAA+C,CACtD,CAAC;QACF,IAAI,OAAO,GAAG,EAAE,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AACnD,MAAM,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AACnD,MAAM,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACzD,MAAM,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACvD,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAC/C,MAAM,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACjE,MAAM,2BAA2B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AAC3E,MAAM,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACjE,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAC7C,MAAM,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAC7D,MAAM,8BAA8B,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAAC;AACjF,MAAM,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAC7D,yEAAyE;AACzE,kEAAkE;AAClE,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;AAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAC3C,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAEjG,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,oCAAoC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,sBAAsB,IAAI,gCAAgC,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CACX,sBAAsB,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;YACxF,kEAAkE;YAClE,wBAAwB,IAAI,EAAE,CACjC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,KAAK,CACX,sBAAsB,IAAI,oBAAoB,IAAI,CAAC,GAAG,gCAAgC,IAAI,IAAI;YAC5F,+EAA+E,CAClF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC;YACxC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;QAChD,OAAO,CAAC,KAAK,CAAC,4BAA4B,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,IAAc,CAAC;AACnB,IAAI,CAAC;IACH,IAAI,GAAG,WAAW,EAAE,CAAC;AACvB,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,0EAA0E;AAC1E,qDAAqD;AACrD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,mEAAmE;AACnE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,yEAAyE;AACzE,4EAA4E;AAC5E,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAC/E,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;AAE3C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,wBAAwB;AACxB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACrC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,8BAA8B,YAAY,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CACT,4DAA4D,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAC5F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,sCAAsC;AACtC,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;IACrD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;AAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;AAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;AACnC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AACrC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAC/B,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC7B,eAAe,CAAC,UAAU,CAAC,CAAC;AAC9B,CAAC;AACD,IAAI,CAAC;IACH,8BAA8B,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,wEAAwE;AACxE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC3C,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;AACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;AAC/C,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AAE7C,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;IAC3D,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,yCAAyC;AACzC,MAAM,gBAAgB,GAAmB;IACvC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,OAAO,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,UAAU,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,SAAS,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;CAC5C,CAAC;AACF,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAC5B,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AACL,IACE,eAAe,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;IAClC,eAAe,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;IACjC,eAAe,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;IACzC,eAAe,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAC5C,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAChF,OAAO,CAAC,GAAG,CACT,8BAA8B,eAAe,CAAC,QAAQ,CAAC,MAAM,UAAU;QACrE,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,aAAa,CACnD,CAAC;AACJ,CAAC;AACD,IAAI,eAAe,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,yCAAyC,eAAe,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;AACpG,CAAC;AACD,IAAI,eAAe,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACjD,OAAO,CAAC,GAAG,CACT,8CAA8C,eAAe,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAC1F,CAAC;AACJ,CAAC;AAED,IAAI,CAAC;IACH,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACpD,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;IAC7B,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,IAAI,KAAK,WAAW;QAC1B,CAAC,CAAC,iDAAiD;QACnD,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO;YACtB,OAAO,CAAC,IAAI,KAAK,UAAU;YAC3B,OAAO,CAAC,IAAI,KAAK,aAAa;YAC9B,OAAO,CAAC,IAAI,KAAK,YAAY;YAC/B,CAAC,CAAC,wEAAwE;YAC1E,CAAC,CAAC,8DAA8D,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;IAC1B,IAAI,CAAC;QACH,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AACL,MAAM,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC;AAC9C,MAAM,aAAa,GACjB,eAAe,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM;IAC9C,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;IAClE,CAAC,CAAC,SAAS,CAAC;AAChB,MAAM,kBAAkB,GACtB,eAAe,EAAE,KAAK,EAAE,IAAI,IAAI,eAAe,EAAE,KAAK,EAAE,MAAM;IAC5D,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;IAChF,CAAC,CAAC,SAAS,CAAC;AAEhB,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,KAAK,OAAO;IACtB,CAAC,CAAC,IAAI,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE;QACxC,MAAM,EAAE,aAAa;QACrB,WAAW,EAAE,kBAAkB;KAChC,CAAC;IACJ,CAAC,CAAC,SAAS,CAAC;AAChB,6EAA6E;AAC7E,+DAA+D;AAC/D,IAAI,WAAW,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;IACjG,MAAM,WAAW,CAAC,gCAAgC,CAChD,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC;AACD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,wBAAwB,CAAC;YACvB,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,kBAAkB;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AACD,MAAM,kBAAkB,GACtB,OAAO,CAAC,IAAI,KAAK,OAAO;IACtB,CAAC,CAAC,WAAW;IACb,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;QAC3B,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,SAAS,CAAC;AAElB,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;IAC5D,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5C,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5C,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,sBAAsB,EAAE,CAAC;AACpD,MAAM,qBAAqB,GAAG,IAAI,6BAA6B,EAAE,CAAC;AAClE,MAAM,eAAe,GAAG,IAAI,uBAAuB,EAAE,CAAC;AACtD,WAAW,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AACjE,WAAW,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AACxE,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAElE,SAAS,aAAa;IACpB,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,SAAS;QAAE,OAAO,oBAAoB,SAAS,EAAE,CAAC;IACtD,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,sDAAsD;AACtD,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD,IAAI,WAAW,EAAE,CAAC;IAChB,MAAM,WAAW,CAAC,SAAS,EAAE,CAAC;IAC9B,MAAM,WAAW,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC;IAC5D,WAAW,CACT,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAC3D,+BAA+B,CAChC,CAAC,KAAK,EAAE,CAAC;AACZ,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;IAChC,MAAM,yBAAyB,EAAE,CAAC;IAClC,WAAW,CACT,GAAG,EAAE,CAAC,KAAK,mBAAmB,CAAC,+BAA+B,CAAC,EAC/D,+BAA+B,CAChC,CAAC,KAAK,EAAE,CAAC;AACZ,CAAC;AACD,MAAM,cAAc,GAAiC,EAAE,CAAC;AAExD;;;GAGG;AACH,SAAS,kBAAkB,CAAC,EAAU,EAAE,QAA4B;IAClE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,QAAQ;YACN,CAAC,CAAC,GAAG,EAAE,uBAAuB,QAAQ,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG;YACxF,CAAC,CAAC,GAAG,EAAE,gCAAgC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAI,EAAE,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,MAAM,gBAAgB,GAAqB,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;IAClF,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAC,OAAO,CAAC,sBAAsB,GAAG,IAAI,cAAc,KAAK,IAAI,CAAC,MAAM,SAAS,CAAC,CAAC;AACpF,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,eAAe,GAAoB,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;IAC5F,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,8BAA8B,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACxD,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,gBAAgB,GAAqB,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;IAC7F,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,GAAG,CAAC,OAAO,CAAC,YAAY,QAAQ,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,uEAAuE;AACvE,SAAS,gBAAgB,CAAC,EAAU;IAClC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAwC,CAAC;IACpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,eAAe,CAAC,EAAU;IACjC,MAAM,GAAG,GAAG,cAAc,CAAC,KAA2C,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,gBAAgB,GAAqB;IACzC,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACtD,IAAI,QAAQ,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,8BAA8B,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ;YACzB,CAAC,CAAC,MAAM,GAAG,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;YAC9F,CAAC,CAAC,MAAM,GAAG,CAAC,iBAAiB,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9E,OAAO,EAAE,EAAE,EAAE,CAAC;IAChB,CAAC;IACD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACnE,IAAI,QAAQ,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,8BAA8B,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC,mBAAmB,CACnD,cAAc,EACd,SAAS,EACT,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,MAAM,CACf,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAS,8BAA8B;IACrC,MAAM,SAAS,GAA8B,EAAE,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,gBAAgB,GAAqB;YACzC,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;gBAC/D,MAAM,GAAG,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;gBAC9C,MAAM,EAAE,GAAG,QAAQ;oBACjB,CAAC,CAAC,MAAM,GAAG,CAAC,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC;oBACtE,CAAC,CAAC,MAAM,GAAG,CAAC,iBAAiB,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC9D,GAAG,CAAC,cAAc,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC/D,OAAO,EAAE,EAAE,EAAE,CAAC;YAChB,CAAC;YACD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;gBACrE,MAAM,GAAG,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;gBAC9C,MAAM,GAAG,CAAC,mBAAmB,CAAC,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAChE,GAAG,CAAC,cAAc,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjE,CAAC;YACD,mBAAmB,EAAE,CAAC,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CACpD,eAAe,CAAC,gBAAgB,CAAC,CAAC,mBAAmB,CAAC,cAAc,EAAE,EAAE,EAAE,QAAQ,CAAC;SACtF,CAAC;QACF,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,iBAAiB,GAAsB;QAC3C,eAAe,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CAC3C,gBAAgB,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,cAAc,EAAE,OAAO,CAAC;QAC5E,SAAS,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CACpC,gBAAgB,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC;QACzE,SAAS,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,CACnC,gBAAgB,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC;QACxE,WAAW,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CACvC,gBAAgB,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC;QAC5E,mBAAmB,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CACvD,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAC7D,cAAc,EACd,SAAS,EACT,IAAI,CACL;QACH,QAAQ,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CACnC,gBAAgB,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QACtE,UAAU,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CACtC,gBAAgB,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC;QACzE,WAAW,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CACvC,gBAAgB,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC;KAC5E,CAAC;IACF,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,GAAG,yBAAyB,CAAC;IACxC,UAAU;IACV,OAAO;IACP,YAAY;IACZ,WAAW;IACX,kBAAkB;IAClB,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,aAAa,EAAE,aAAa,EAAE;IAC9B,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,yBAAyB,EAAE,8BAA8B,EAAE;CAC5D,CAAC,CAAC;AAEH,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,KAAK,MAAM;IACrB,CAAC,CAAC,MAAM;IACR,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;QAC5B,CAAC,CAAC,aAAa,OAAO,CAAC,SAAS,EAAE;QAClC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO;YACxB,CAAC,CAAC,SAAS,OAAO,CAAC,KAAK,EAAE;YAC1B,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;gBAC3B,CAAC,CAAC,YAAY,OAAO,CAAC,OAAO,EAAE;gBAC/B,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa;oBAC9B,CAAC,CAAC,eAAe,OAAO,CAAC,IAAI,EAAE;oBAC/B,CAAC,CAAC,cAAc,OAAO,CAAC,SAAS,EAAE,CAAC;AAChD,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AACxC,wBAAwB,EAAE,CAAC;AAE3B;;;;GAIG;AACH,SAAS,wBAAwB;IAC/B,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACzB,GAAG,CAAC,OAAO,CACT,iCAAiC,iBAAiB,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CACnG,CAAC;IAEF,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAW,CAAC,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,iBAAiB,QAAQ,gBAAgB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,CAAC,iBAAiB,QAAQ,+BAA+B,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,iBAAiB,QAAQ,kDAAkD,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,EAAE,CAAC;IAC3C,GAAG,CAAC,OAAO,CACT,UAAU,CAAC,UAAU,CAAC;QACpB,CAAC,CAAC,wBAAwB,UAAU,EAAE;QACtC,CAAC,CAAC,8BAA8B,UAAU,6BAA6B,CAC1E,CAAC;AACJ,CAAC;AAED,IAAI,QAAQ,EAAE,CAAC;IACb,MAAM,sBAAsB,GAAG,eAAe,CAAC;IAC/C,MAAM,aAAa,GAAG,eAAe,CAAC;IACtC,IAAI,CAAC,sBAAsB,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,YAAY,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACvF,MAAM,iBAAiB,GAAG,IAAI,sBAAsB,CAAC,OAAO,EAAE;QAC5D,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,sBAAsB;QAChC,UAAU;QACV,KAAK,EAAE,WAAW;KACnB,CAAC,CAAC;IACH,cAAc,CAAC,KAAK,GAAG,iBAAiB,CAAC;IACzC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AACjC,CAAC;AACD,IAAI,WAAW,EAAE,CAAC;IAChB,MAAM,aAAa,GAAG,kBAAkB,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,CAAC,OAAO,EAAE;QAC7D,KAAK,EAAE,aAAa;QACpB,UAAU;KACX,CAAC,CAAC;IACH,cAAc,CAAC,QAAQ,GAAG,oBAAoB,CAAC;IAC/C,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACpC,CAAC;AACD,IAAI,UAAU,EAAE,CAAC;IACf,MAAM,YAAY,GAAG,iBAAiB,CAAC;IACvC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,CAAC,OAAO,EAAE;QAC3D,KAAK,EAAE,YAAY;QACnB,UAAU;KACX,CAAC,CAAC;IACH,cAAc,CAAC,OAAO,GAAG,mBAAmB,CAAC;IAC7C,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACnC,CAAC;AACD,IAAI,SAAS,EAAE,CAAC;IACd,IAAI,CAAC,aAAa,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,2BAA2B;QAClD,CAAC,CAAC,YAAY,CAAC,2BAA2B,EAAE,OAAO,CAAC;QACpD,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5F,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,OAAO,EAAE;QACzD,KAAK,EAAE,aAAa;QACpB,UAAU,EAAE,gBAAgB;QAC5B,cAAc,EAAE,sBAAsB;QACtC,KAAK,EAAE,YAAY;YACjB,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;iBACpB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBAC1B,MAAM,CAAC,OAAO,CAAC;YACpB,CAAC,CAAC,EAAE;QACN,cAAc,EACZ,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,IAAI;QACN,UAAU;QACV,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QACjD,sEAAsE;QACtE,oEAAoE;QACpE,sDAAsD;QACtD,UAAU,EAAE,8BAA8B;YACxC,CAAC,CAAC;gBACE,aAAa,EAAE,IAAI,gBAAgB,CAAC;oBAClC,eAAe,EAAE,8BAA8B;iBAChD,CAAC;gBACF,eAAe,EAAE,oBAAoB;aACtC;YACH,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IACH,cAAc,CAAC,MAAM,GAAG,kBAAkB,CAAC;IAC3C,GAAG,CAAC,OAAO,CACT,mBAAmB,8BAA8B,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,EAAE,CACzF,CAAC;AACJ,CAAC;AAED,IAAI,SAAS,EAAE,CAAC;IACd,cAAc,CAAC;QACb,IAAI,EAAE,SAAS;QACf,cAAc;QACd,YAAY;QACZ,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE;YAClD,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,GAAG;gBAAE,MAAM,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,qBAAqB;QACrB,sBAAsB,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;QACnD,YAAY,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE;KACzF,CAAC,CAAC;AACL,CAAC;AAED,sDAAsD;AACtD,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;AACpF,MAAM,iBAAiB,GAAG,cAAc,CAAC,KAA2C,CAAC;AACrF,IAAI,iBAAiB,EAAE,CAAC;IACtB,iBAAiB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;AACpD,CAAC;AACD,aAAa,CAAC,KAAK,EAAE,CAAC;AAEtB,kBAAkB;AAClB,KAAK,UAAU,QAAQ;IACrB,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IACzB,aAAa,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,uBAAuB,EAAE,CAAC;IAChC,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAEhC,iBAAiB;AACjB,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACxB,GAAG,CAAC,UAAU,CAAC,qBAAqB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CACH,CACF,CAAC","sourcesContent":["#!/usr/bin/env node\n\nimport \"./observability/instrument.js\";\n\nimport { join } from \"path\";\nimport { mkdirSync, statSync, writeFileSync } from \"fs\";\nimport { fileURLToPath } from \"url\";\nimport { dirname, join as pathJoin } from \"path\";\nimport type {\n  MessagingBot,\n  PlatformBlockKit,\n  PlatformName,\n  PlatformNotifier,\n  PlatformReactor,\n  PlatformUploader,\n} from \"./adapter.js\";\nimport { DiscordMessagingBot } from \"./adapters/discord/bot.js\";\nimport { GithubMessagingBot } from \"./adapters/github/bot.js\";\nimport { createGithubToolPack } from \"./adapters/github/tool-pack.js\";\nimport type { PlatformGithubOps } from \"./adapters/github/types.js\";\nimport { GcpTokenProvider } from \"./adapters/github/gcp-auth.js\";\nimport { TelegramMessagingBot } from \"./adapters/telegram/bot.js\";\nimport { SlackMessagingBot as SlackMessagingBotClass } from \"./adapters/slack/bot.js\";\nimport { createSlackToolPack } from \"./adapters/slack/tool-pack.js\";\nimport type { PlatformSlackOps } from \"./adapters/slack/types.js\";\nimport type { PlatformToolPackFactory } from \"./tools/types.js\";\nimport { downloadChannel } from \"./cli/download.js\";\nimport { EventsWatcher } from \"./events.js\";\nimport * as log from \"./log.js\";\nimport { startWebServer } from \"./web/server.js\";\nimport { InMemoryAdminTokenStore } from \"./web/admin/store.js\";\nimport { InMemoryLinkTokenStore } from \"./web/login/store.js\";\nimport { InMemorySessionViewTokenStore } from \"./web/session-view/store.js\";\nimport { DockerContainerManager } from \"./provisioner.js\";\nimport {\n  assertStateDirOutsideWorkspace,\n  createGlobalSettingsFile,\n  loadGlobalSettings,\n  MissingGlobalSettingsError,\n  resolveLinkBaseUrl,\n} from \"./config.js\";\nimport {\n  configureHttpDispatcher,\n  defaultAuthPath,\n  defaultModelsJsonPath,\n  parseHttpIdleTimeoutMs,\n} from \"./harness/index.js\";\nimport { existsSync, readFileSync } from \"fs\";\nimport { readEnv, setEnvAliases } from \"./utils/env.js\";\nimport { ensureDirExists, isRecord, readJsonFileIfExists } from \"./utils/file-guards.js\";\nimport { SandboxError, validateSandbox } from \"./sandbox/index.js\";\nimport { helpText, resolveBoot, type BootPlan } from \"./cli/boot.js\";\nimport { envReport, noPlatformsMessage, platformIsActive } from \"./env-manifest.js\";\nimport {\n  configureGondolinRuntime,\n  gondolinResources,\n  reconcileGondolinRuntimes,\n  stopAllGondolinRuntimes,\n  stopIdleGondolinVms,\n} from \"./sandbox/gondolin.js\";\nimport { FileVaultManager } from \"./vault/index.js\";\nimport { runExtCommand } from \"./cli/ext.js\";\nimport { runOfficeCommand } from \"./cli/office.js\";\nimport { formatUnmigratedOfficesError, migrateLegacyOffices } from \"./office-migration.js\";\nimport { createConversationRuntime } from \"./runtime/conversation-runtime.js\";\nimport { ChannelStore } from \"./store.js\";\nimport * as Sentry from \"@sentry/node\";\n\nfunction getVersion(): string {\n  // Try to find package.json in the dist directory or parent\n  const possiblePaths = [\n    pathJoin(dirname(fileURLToPath(import.meta.url)), \"package.json\"),\n    pathJoin(dirname(fileURLToPath(import.meta.url)), \"..\", \"package.json\"),\n    pathJoin(process.cwd(), \"package.json\"),\n  ];\n\n  for (const pkgPath of possiblePaths) {\n    const pkg = readJsonFileIfExists(\n      pkgPath,\n      (value): value is { version?: unknown } => isRecord(value),\n      () => \"Ignoring package.json while resolving version\",\n    );\n    if (typeof pkg?.version === \"string\" && pkg.version) return pkg.version;\n  }\n  return \"unknown\";\n}\n\nconst SLACK_APP_TOKEN = readEnv(\"SLACK_APP_TOKEN\");\nconst SLACK_BOT_TOKEN = readEnv(\"SLACK_BOT_TOKEN\");\nconst TELEGRAM_BOT_TOKEN = readEnv(\"TELEGRAM_BOT_TOKEN\");\nconst DISCORD_BOT_TOKEN = readEnv(\"DISCORD_BOT_TOKEN\");\nconst GITHUB_APP_ID = readEnv(\"GITHUB_APP_ID\");\nconst GITHUB_APP_PRIVATE_KEY = readEnv(\"GITHUB_APP_PRIVATE_KEY\");\nconst GITHUB_APP_PRIVATE_KEY_PATH = readEnv(\"GITHUB_APP_PRIVATE_KEY_PATH\");\nconst GITHUB_INSTALLATION_ID = readEnv(\"GITHUB_INSTALLATION_ID\");\nconst GITHUB_REPOS = readEnv(\"GITHUB_REPOS\");\nconst GITHUB_POLL_INTERVAL = readEnv(\"GITHUB_POLL_INTERVAL\");\nconst GOOGLE_APPLICATION_CREDENTIALS = readEnv(\"GOOGLE_APPLICATION_CREDENTIALS\");\nconst GOOGLE_CLOUD_PROJECT = readEnv(\"GOOGLE_CLOUD_PROJECT\");\n// Externally-visible base URL of the link/OAuth server; the env read and\n// trailing-slash normalization live in config.resolveLinkBaseUrl.\nconst LINK_BASE_URL = resolveLinkBaseUrl();\nconst LINK_PORT_RAW = readEnv(\"LINK_PORT\");\nconst LINK_PORT = LINK_PORT_RAW ? parseInt(LINK_PORT_RAW, 10) : LINK_BASE_URL ? 8181 : undefined;\n\nconst WORLD_WRITABLE_MODE = 0o002;\n\nfunction ensureSecureStateDir(path: string): void {\n  let stat;\n  try {\n    stat = statSync(path);\n  } catch (err) {\n    const code = (err as NodeJS.ErrnoException).code;\n    if (code === \"ENOENT\") {\n      mkdirSync(path, { recursive: true, mode: 0o700 });\n      return;\n    }\n    console.error(`Error: cannot access --state-dir ${path}: ${(err as Error).message}`);\n    process.exit(1);\n  }\n\n  if (!stat.isDirectory()) {\n    console.error(`Error: --state-dir ${path} exists but is not a directory`);\n    process.exit(1);\n  }\n\n  if (stat.mode & WORLD_WRITABLE_MODE) {\n    console.error(\n      `Error: --state-dir ${path} is world-writable (mode ${(stat.mode & 0o777).toString(8)}). ` +\n        `Credentials stored there would be exposed to other local users. ` +\n        `Fix with: chmod 0700 ${path}`,\n    );\n    process.exit(1);\n  }\n\n  const euid = typeof process.geteuid === \"function\" ? process.geteuid() : undefined;\n  if (euid !== undefined && stat.uid !== euid) {\n    console.error(\n      `Error: --state-dir ${path} is owned by uid ${stat.uid} but mikan is running as uid ${euid}. ` +\n        `Run mikan as the directory owner or point --state-dir at a directory you own.`,\n    );\n    process.exit(1);\n  }\n}\n\nfunction handleStartupError(error: unknown): never {\n  if (error instanceof SandboxError) {\n    for (const line of error.formatForCli()) {\n      console.error(line);\n    }\n    process.exit(1);\n  }\n  if (error instanceof MissingGlobalSettingsError) {\n    console.error(`Missing global settings: ${error.settingsPath}`);\n    console.error(\"\");\n    console.error(\"Run onboarding to create it:\");\n    console.error(`  mikan --onboard --state-dir ${stateDir}`);\n    console.error(\"\");\n    console.error(\"Then review the generated settings.json and start mikan again.\");\n    process.exit(1);\n  }\n  if (error instanceof Error) {\n    console.error(`Error: ${error.message}`);\n    process.exit(1);\n  }\n  console.error(String(error));\n  process.exit(1);\n}\n\nlet plan: BootPlan;\ntry {\n  plan = resolveBoot();\n} catch (error) {\n  handleStartupError(error);\n}\n\n// `mikan ext …` manages extensions and exits; handle it before the normal\n// bot-mode startup (which requires platform tokens).\nif (plan.mode === \"ext\") {\n  const code = await runExtCommand(plan.extArgs ?? []);\n  process.exit(code);\n}\n\n// `mikan office …` inspects/claims conversation offices and exits.\nif (plan.mode === \"office\") {\n  process.exit(runOfficeCommand(plan.officeArgs ?? []));\n}\n\n// Global fetch: proxy support (HTTP_PROXY/HTTPS_PROXY/NO_PROXY) and idle\n// timeouts so a stalled LLM stream errors out instead of hanging a session.\nconst httpIdleTimeoutMs = parseHttpIdleTimeoutMs(readEnv(\"HTTP_IDLE_TIMEOUT\"));\nconfigureHttpDispatcher(httpIdleTimeoutMs);\n\nif (plan.mode === \"help\") {\n  console.log(helpText());\n  process.exit(0);\n}\n\nif (plan.mode === \"env\") {\n  console.log(envReport());\n  process.exit(0);\n}\n\nif (plan.mode === \"version\") {\n  console.log(getVersion());\n  process.exit(0);\n}\n\n// Handle --onboard mode\nif (plan.mode === \"onboard\") {\n  const stateDir = plan.stateDir;\n  setEnvAliases(\"STATE_DIR\", stateDir);\n  ensureSecureStateDir(stateDir);\n  try {\n    const settingsPath = createGlobalSettingsFile(stateDir);\n    console.log(`Created global settings at ${settingsPath}`);\n    console.log(\n      `Review the file, then start mikan (workspace defaults to ${join(stateDir, \"workspace\")}).`,\n    );\n    process.exit(0);\n  } catch (err) {\n    console.error(err instanceof Error ? err.message : String(err));\n    process.exit(1);\n  }\n}\n\n// Handle --download mode (Slack only)\nif (plan.mode === \"download\" && plan.downloadChannel) {\n  if (!SLACK_BOT_TOKEN) {\n    console.error(\"Missing env: SLACK_BOT_TOKEN\");\n    process.exit(1);\n  }\n  await downloadChannel(plan.downloadChannel, SLACK_BOT_TOKEN);\n  process.exit(0);\n}\n\n// Normal bot mode - working dir is optional and defaults under the state dir\nconst sandbox = plan.sandbox;\nconst stateDir = plan.stateDir;\nconst workingDir = plan.workingDir;\nsetEnvAliases(\"STATE_DIR\", stateDir);\nensureSecureStateDir(stateDir);\nif (!plan.workingDirExplicit) {\n  ensureDirExists(workingDir);\n}\ntry {\n  assertStateDirOutsideWorkspace(stateDir, workingDir, sandbox.type);\n} catch (error) {\n  handleStartupError(error);\n}\n\n// Validate platform tokens — activation rules live in the env manifest.\nconst hasSlack = platformIsActive(\"slack\");\nconst hasTelegram = platformIsActive(\"telegram\");\nconst hasDiscord = platformIsActive(\"discord\");\nconst hasGithub = platformIsActive(\"github\");\n\nif (!hasSlack && !hasTelegram && !hasDiscord && !hasGithub) {\n  console.error(noPlatformsMessage());\n  process.exit(1);\n}\n\n// Move legacy raw-id conversation directories to the office-key layout before\n// anything touches the workspace. Runs every boot; a completed migration is a\n// no-op. Unowned or failed offices are fatal: after the layout flip a legacy\n// directory is invisible to the runtime, and booting anyway would present\n// those conversations as silently empty.\nconst enabledPlatforms: PlatformName[] = [\n  ...(hasSlack ? ([\"slack\"] as const) : []),\n  ...(hasTelegram ? ([\"telegram\"] as const) : []),\n  ...(hasDiscord ? ([\"discord\"] as const) : []),\n  ...(hasGithub ? ([\"github\"] as const) : []),\n];\nconst officeMigration = (() => {\n  try {\n    return migrateLegacyOffices({ workspaceRoot: workingDir, stateDir, enabledPlatforms });\n  } catch (error) {\n    handleStartupError(error);\n  }\n})();\nif (\n  officeMigration.unowned.length > 0 ||\n  officeMigration.failed.length > 0 ||\n  officeMigration.vaultConflicts.length > 0 ||\n  officeMigration.stateDirConflicts.length > 0\n) {\n  console.error(formatUnmigratedOfficesError(officeMigration));\n  process.exit(1);\n}\nif (officeMigration.migrated.length > 0 || officeMigration.recovered.length > 0) {\n  console.log(\n    `  Office layout migration: ${officeMigration.migrated.length} moved, ` +\n      `${officeMigration.recovered.length} recovered.`,\n  );\n}\nif (officeMigration.vaultKeysMigrated.length > 0) {\n  console.log(`  Vault keys migrated to office keys: ${officeMigration.vaultKeysMigrated.length}.`);\n}\nif (officeMigration.stateDirsMigrated.length > 0) {\n  console.log(\n    `  Host state dirs migrated to office keys: ${officeMigration.stateDirsMigrated.length}.`,\n  );\n}\n\ntry {\n  await validateSandbox(sandbox);\n} catch (error) {\n  handleStartupError(error);\n}\n\nconst vaultManager = new FileVaultManager(stateDir);\nif (vaultManager.isEnabled()) {\n  console.log(\n    sandbox.type === \"container\"\n      ? \"  Vault system enabled. Container vault active.\"\n      : sandbox.type === \"image\" ||\n          sandbox.type === \"gondolin\" ||\n          sandbox.type === \"firecracker\" ||\n          sandbox.type === \"cloudflare\"\n        ? \"  Vault system enabled. Conversation-scoped credential routing active.\"\n        : \"  Vault system enabled. Host mode will not inject vault env.\",\n  );\n}\n\nconst startupConfig = (() => {\n  try {\n    return loadGlobalSettings();\n  } catch (error) {\n    handleStartupError(error);\n  }\n})();\nconst sandboxSettings = startupConfig.sandbox;\nconst sandboxLimits =\n  sandboxSettings?.cpus || sandboxSettings?.memory\n    ? { cpus: sandboxSettings?.cpus, memory: sandboxSettings?.memory }\n    : undefined;\nconst sandboxBoostLimits =\n  sandboxSettings?.boost?.cpus || sandboxSettings?.boost?.memory\n    ? { cpus: sandboxSettings?.boost?.cpus, memory: sandboxSettings?.boost?.memory }\n    : undefined;\n\nconst provisioner =\n  sandbox.type === \"image\"\n    ? new DockerContainerManager(sandbox.image, {\n        limits: sandboxLimits,\n        boostLimits: sandboxBoostLimits,\n      })\n    : undefined;\n// Containers provisioned before an office migration mount the renamed legacy\n// paths; recreate them so mounts follow the office-key layout.\nif (provisioner && (officeMigration.migrated.length > 0 || officeMigration.recovered.length > 0)) {\n  await provisioner.removeContainersForConversations(\n    new Set([...officeMigration.migrated, ...officeMigration.recovered]),\n  );\n}\nif (sandbox.type === \"gondolin\") {\n  try {\n    configureGondolinRuntime({\n      limits: sandboxLimits,\n      boostLimits: sandboxBoostLimits,\n    });\n  } catch (error) {\n    handleStartupError(error);\n  }\n}\nconst resourceController =\n  sandbox.type === \"image\"\n    ? provisioner\n    : sandbox.type === \"gondolin\"\n      ? gondolinResources\n      : undefined;\n\nif (sandbox.type === \"image\" || sandbox.type === \"gondolin\") {\n  ensureDirExists(join(workingDir, \"skills\"));\n  ensureDirExists(join(workingDir, \"events\"));\n  ensureDirExists(join(workingDir, \"agents\"));\n  try {\n    writeFileSync(join(workingDir, \"MEMORY.md\"), \"\", { flag: \"wx\" });\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"EEXIST\") throw err;\n  }\n}\n\nconst linkTokenStore = new InMemoryLinkTokenStore();\nconst sessionViewTokenStore = new InMemorySessionViewTokenStore();\nconst adminTokenStore = new InMemoryAdminTokenStore();\nsetInterval(() => linkTokenStore.purge(), 5 * 60 * 1000).unref();\nsetInterval(() => sessionViewTokenStore.purge(), 5 * 60 * 1000).unref();\nsetInterval(() => adminTokenStore.purge(), 5 * 60 * 1000).unref();\n\nfunction portalBaseUrl(): string | undefined {\n  if (LINK_BASE_URL) return LINK_BASE_URL;\n  if (LINK_PORT) return `http://localhost:${LINK_PORT}`;\n  return undefined;\n}\n/** Idle timeout for managed sandboxes (10 minutes) */\nconst MANAGED_SANDBOX_IDLE_TIMEOUT_MS = 10 * 60 * 1000;\n\nif (provisioner) {\n  await provisioner.reconcile();\n  await provisioner.stopIdle(MANAGED_SANDBOX_IDLE_TIMEOUT_MS);\n  setInterval(\n    () => provisioner.stopIdle(MANAGED_SANDBOX_IDLE_TIMEOUT_MS),\n    MANAGED_SANDBOX_IDLE_TIMEOUT_MS,\n  ).unref();\n}\n\nif (sandbox.type === \"gondolin\") {\n  await reconcileGondolinRuntimes();\n  setInterval(\n    () => void stopIdleGondolinVms(MANAGED_SANDBOX_IDLE_TIMEOUT_MS),\n    MANAGED_SANDBOX_IDLE_TIMEOUT_MS,\n  ).unref();\n}\nconst botsByPlatform: Record<string, MessagingBot> = {};\n\n/**\n * Resolve which platform bot to use: an explicit platform, or the sole\n * running one. Mirrors event-file platform resolution.\n */\nfunction resolvePlatformBot(op: string, platform: string | undefined): [string, MessagingBot] {\n  const available = Object.keys(botsByPlatform);\n  const key = platform?.trim().toLowerCase() || (available.length === 1 ? available[0] : undefined);\n  const bot = key ? botsByPlatform[key] : undefined;\n  if (!bot) {\n    throw new Error(\n      platform\n        ? `${op}: unknown platform '${platform}' (available: ${available.join(\", \") || \"none\"})`\n        : `${op}: multiple platforms active (${available.join(\", \")}); specify platform`,\n    );\n  }\n  return [key!, bot];\n}\n\n/** Extension `api.notify` backend: post into a conversation without a run. */\nconst platformNotifier: PlatformNotifier = async (conversationId, text, platform) => {\n  const [key, bot] = resolvePlatformBot(\"notify\", platform);\n  await bot.postMessage(conversationId, text);\n  log.logInfo(`[notify] posted to ${key}/${conversationId} (${text.length} chars)`);\n};\n\n/** Extension `api.react` backend: add a reaction to a message. */\nconst platformReactor: PlatformReactor = async (conversationId, messageTs, emoji, platform) => {\n  const [key, bot] = resolvePlatformBot(\"react\", platform);\n  if (!bot.addReaction) {\n    throw new Error(`react: platform '${key}' does not support reactions`);\n  }\n  await bot.addReaction(conversationId, messageTs, emoji);\n  log.logInfo(`[react] :${emoji}: on ${key}/${conversationId}`);\n};\n\n/** Extension `api.uploadFile` backend: send a host file into a conversation. */\nconst platformUploader: PlatformUploader = async (conversationId, filePath, title, platform) => {\n  const [key, bot] = resolvePlatformBot(\"upload\", platform);\n  if (!bot.uploadFile) {\n    throw new Error(`upload: platform '${key}' does not support file uploads`);\n  }\n  await bot.uploadFile(conversationId, filePath, title);\n  log.logInfo(`[upload] ${filePath} to ${key}/${conversationId}`);\n};\n\n/** github_* tool backends: PR push/create and CI checks, host-side. */\nfunction requireGithubBot(op: string): GithubMessagingBot {\n  const bot = botsByPlatform.github as GithubMessagingBot | undefined;\n  if (!bot) {\n    throw new Error(`${op}: the GitHub platform is not running`);\n  }\n  return bot;\n}\n\n/** slack_* tool backends: Block Kit posting/updating, host-side. */\nfunction requireSlackBot(op: string): SlackMessagingBotClass {\n  const bot = botsByPlatform.slack as SlackMessagingBotClass | undefined;\n  if (!bot) {\n    throw new Error(`${op}: the Slack platform is not running`);\n  }\n  return bot;\n}\n\n/** Extension `api.blockkit` backend: interactive Block Kit, Slack-only today. */\nconst platformBlockKit: PlatformBlockKit = {\n  postBlocks: async (conversationId, message, platform) => {\n    if (platform && platform !== \"slack\") {\n      throw new Error(`blockkit: platform '${platform}' does not support Block Kit`);\n    }\n    const bot = requireSlackBot(\"blockkit\");\n    const ts = message.threadTs\n      ? await bot.postInThreadBlocks(conversationId, message.threadTs, message.text, message.blocks)\n      : await bot.postMessageBlocks(conversationId, message.text, message.blocks);\n    return { ts };\n  },\n  updateBlocks: async (conversationId, messageTs, message, platform) => {\n    if (platform && platform !== \"slack\") {\n      throw new Error(`blockkit: platform '${platform}' does not support Block Kit`);\n    }\n    await requireSlackBot(\"blockkit\").updateMessageBlocks(\n      conversationId,\n      messageTs,\n      message.text,\n      message.blocks,\n    );\n  },\n};\n\n/**\n * Platform capability pack factories — only when the corresponding bot is\n * configured. Factories, not instances: each runner materializes its own\n * pack so per-run bind state never crosses conversations.\n */\nfunction buildPlatformToolPackFactories(): PlatformToolPackFactory[] {\n  const factories: PlatformToolPackFactory[] = [];\n  if (hasSlack) {\n    const platformSlackOps: PlatformSlackOps = {\n      postBlocks: async (conversationId, { text, blocks, threadTs }) => {\n        const bot = requireSlackBot(\"slack_blockkit\");\n        const ts = threadTs\n          ? await bot.postInThreadBlocks(conversationId, threadTs, text, blocks)\n          : await bot.postMessageBlocks(conversationId, text, blocks);\n        bot.logBotResponse(conversationId, text, ts, threadTs, blocks);\n        return { ts };\n      },\n      updateBlocks: async (conversationId, { ts, text, blocks, threadTs }) => {\n        const bot = requireSlackBot(\"slack_blockkit\");\n        await bot.updateMessageBlocks(conversationId, ts, text, blocks);\n        bot.logBotResponse(conversationId, text, ts, threadTs, blocks);\n      },\n      ownsBlockKitMessage: (conversationId, ts, threadTs) =>\n        requireSlackBot(\"slack_blockkit\").ownsBlockKitMessage(conversationId, ts, threadTs),\n    };\n    factories.push(() => createSlackToolPack(platformSlackOps));\n  }\n  if (!hasGithub) return factories;\n  const platformGithubOps: PlatformGithubOps = {\n    pushAndCreatePr: (conversationId, request) =>\n      requireGithubBot(\"github_pr\").ops.pushAndCreatePr(conversationId, request),\n    getChecks: (conversationId, branch) =>\n      requireGithubBot(\"github_checks\").ops.getChecks(conversationId, branch),\n    getJobLog: (conversationId, jobId) =>\n      requireGithubBot(\"github_checks\").ops.getJobLog(conversationId, jobId),\n    getBuildLog: (conversationId, buildId) =>\n      requireGithubBot(\"github_checks\").ops.getBuildLog(conversationId, buildId),\n    replyToReviewThread: (conversationId, commentId, body) =>\n      requireGithubBot(\"github_review_reply\").ops.replyToReviewThread(\n        conversationId,\n        commentId,\n        body,\n      ),\n    syncRepo: (conversationId, branch) =>\n      requireGithubBot(\"github_sync\").ops.syncRepo(conversationId, branch),\n    readGithub: (conversationId, request) =>\n      requireGithubBot(\"github_read\").ops.readGithub(conversationId, request),\n    manageIssue: (conversationId, request) =>\n      requireGithubBot(\"github_issue\").ops.manageIssue(conversationId, request),\n  };\n  factories.push(() => createGithubToolPack(platformGithubOps));\n  return factories;\n}\n\nconst handler = createConversationRuntime({\n  workingDir,\n  sandbox,\n  vaultManager,\n  provisioner,\n  resourceController,\n  linkTokenStore,\n  sessionViewTokenStore,\n  adminTokenStore,\n  portalBaseUrl: portalBaseUrl(),\n  platformNotifier,\n  platformReactor,\n  platformUploader,\n  platformBlockKit,\n  platformToolPackFactories: buildPlatformToolPackFactories(),\n});\n\nconst sandboxDesc =\n  sandbox.type === \"host\"\n    ? \"host\"\n    : sandbox.type === \"container\"\n      ? `container:${sandbox.container}`\n      : sandbox.type === \"image\"\n        ? `image:${sandbox.image}`\n        : sandbox.type === \"gondolin\"\n          ? `gondolin:${sandbox.profile}`\n          : sandbox.type === \"firecracker\"\n            ? `firecracker:${sandbox.vmId}`\n            : `cloudflare:${sandbox.sandboxId}`;\nlog.logStartup(workingDir, sandboxDesc);\nlogHarnessStartupSummary();\n\n/**\n * One-look confirmation of the harness runtime surface, aimed at upgrade\n * verification: config moved from ~/.pi to ~/.mikan with no fallback, so a\n * missing auth.json here is the first thing to check when runs fail.\n */\nfunction logHarnessStartupSummary(): void {\n  const proxy =\n    process.env.HTTPS_PROXY ??\n    process.env.https_proxy ??\n    process.env.HTTP_PROXY ??\n    process.env.http_proxy;\n  log.logInfo(\n    `HTTP dispatcher: idle timeout ${httpIdleTimeoutMs}ms${proxy ? `, proxy ${proxy}` : \", no proxy\"}`,\n  );\n\n  const authPath = defaultAuthPath();\n  if (existsSync(authPath)) {\n    try {\n      const providers = Object.keys(JSON.parse(readFileSync(authPath, \"utf-8\")) as object);\n      log.logInfo(`Harness auth: ${authPath} (providers: ${providers.join(\", \") || \"none\"})`);\n    } catch {\n      log.logWarning(`Harness auth: ${authPath} exists but is not valid JSON`);\n    }\n  } else {\n    log.logInfo(`Harness auth: ${authPath} missing — provider keys come from env vars only`);\n  }\n\n  const modelsPath = defaultModelsJsonPath();\n  log.logInfo(\n    existsSync(modelsPath)\n      ? `Harness models.json: ${modelsPath}`\n      : `Harness models.json: none (${modelsPath}) — built-in providers only`,\n  );\n}\n\nif (hasSlack) {\n  const slackMessagingBotToken = SLACK_BOT_TOKEN;\n  const slackAppToken = SLACK_APP_TOKEN;\n  if (!slackMessagingBotToken || !slackAppToken) {\n    throw new Error(\"Slack startup requires both SLACK_APP_TOKEN and SLACK_BOT_TOKEN\");\n  }\n  const sharedStore = new ChannelStore({ workingDir, botToken: slackMessagingBotToken });\n  const slackMessagingBot = new SlackMessagingBotClass(handler, {\n    appToken: slackAppToken,\n    botToken: slackMessagingBotToken,\n    workingDir,\n    store: sharedStore,\n  });\n  botsByPlatform.slack = slackMessagingBot;\n  log.logInfo(\"Platform: Slack\");\n}\nif (hasTelegram) {\n  const telegramToken = TELEGRAM_BOT_TOKEN;\n  if (!telegramToken) {\n    throw new Error(\"Telegram startup requires TELEGRAM_BOT_TOKEN\");\n  }\n  const telegramMessagingBot = new TelegramMessagingBot(handler, {\n    token: telegramToken,\n    workingDir,\n  });\n  botsByPlatform.telegram = telegramMessagingBot;\n  log.logInfo(\"Platform: Telegram\");\n}\nif (hasDiscord) {\n  const discordToken = DISCORD_BOT_TOKEN;\n  if (!discordToken) {\n    throw new Error(\"Discord startup requires DISCORD_BOT_TOKEN\");\n  }\n  const discordMessagingBot = new DiscordMessagingBot(handler, {\n    token: discordToken,\n    workingDir,\n  });\n  botsByPlatform.discord = discordMessagingBot;\n  log.logInfo(\"Platform: Discord\");\n}\nif (hasGithub) {\n  if (!GITHUB_APP_ID || !GITHUB_INSTALLATION_ID) {\n    throw new Error(\"GitHub startup requires GITHUB_APP_ID and GITHUB_INSTALLATION_ID\");\n  }\n  // Env vars flatten PEM newlines to literal `\\n`; a key file avoids that.\n  const githubPrivateKey = GITHUB_APP_PRIVATE_KEY_PATH\n    ? readFileSync(GITHUB_APP_PRIVATE_KEY_PATH, \"utf-8\")\n    : GITHUB_APP_PRIVATE_KEY?.replace(/\\\\n/g, \"\\n\");\n  if (!githubPrivateKey) {\n    throw new Error(\n      \"GitHub startup requires GITHUB_APP_PRIVATE_KEY or GITHUB_APP_PRIVATE_KEY_PATH\",\n    );\n  }\n  const pollIntervalSeconds = GITHUB_POLL_INTERVAL ? parseInt(GITHUB_POLL_INTERVAL, 10) : NaN;\n  const githubMessagingBot = new GithubMessagingBot(handler, {\n    appId: GITHUB_APP_ID,\n    privateKey: githubPrivateKey,\n    installationId: GITHUB_INSTALLATION_ID,\n    repos: GITHUB_REPOS\n      ? GITHUB_REPOS.split(\",\")\n          .map((repo) => repo.trim())\n          .filter(Boolean)\n      : [],\n    pollIntervalMs:\n      (Number.isFinite(pollIntervalSeconds) && pollIntervalSeconds > 0 ? pollIntervalSeconds : 60) *\n      1000,\n    workingDir,\n    syncStatePath: join(stateDir, \"github-sync.json\"),\n    // Host-side GCP creds (e.g. a WIF external_account file) unlock Cloud\n    // Build logs in github_checks; without them external CI degrades to\n    // guidance text. Credentials never enter the sandbox.\n    cloudBuild: GOOGLE_APPLICATION_CREDENTIALS\n      ? {\n          tokenProvider: new GcpTokenProvider({\n            credentialsPath: GOOGLE_APPLICATION_CREDENTIALS,\n          }),\n          projectFallback: GOOGLE_CLOUD_PROJECT,\n        }\n      : undefined,\n  });\n  botsByPlatform.github = githubMessagingBot;\n  log.logInfo(\n    `Platform: GitHub${GOOGLE_APPLICATION_CREDENTIALS ? \" (Cloud Build logs enabled)\" : \"\"}`,\n  );\n}\n\nif (LINK_PORT) {\n  startWebServer({\n    port: LINK_PORT,\n    linkTokenStore,\n    vaultManager,\n    notify: async (platform, conversationId, message) => {\n      const bot = botsByPlatform[platform];\n      if (bot) await bot.postMessage(conversationId, message);\n    },\n    sessionViewTokenStore,\n    sessionViewInteractive: { handler, botsByPlatform },\n    adminOptions: { adminTokenStore, workingDir, runtime: handler, sandbox, botsByPlatform },\n  });\n}\n\n// Start events watcher with explicit platform routing\nconst eventsWatcher = new EventsWatcher(join(workingDir, \"events\"), botsByPlatform);\nconst slackMessagingBot = botsByPlatform.slack as SlackMessagingBotClass | undefined;\nif (slackMessagingBot) {\n  slackMessagingBot.setEventsWatcher(eventsWatcher);\n}\neventsWatcher.start();\n\n// Handle shutdown\nasync function shutdown(): Promise<void> {\n  await handler.shutdown();\n  eventsWatcher.stop();\n  await stopAllGondolinRuntimes();\n  await Sentry.close(5000);\n  process.exit(0);\n}\n\nprocess.on(\"SIGINT\", shutdown);\nprocess.on(\"SIGTERM\", shutdown);\n\n// Start all bots\nawait Promise.all(\n  Object.values(botsByPlatform).map((bot) =>\n    bot.start().catch((err) => {\n      log.logWarning(\"Failed to start bot\", err instanceof Error ? err.message : String(err));\n      process.exit(1);\n    }),\n  ),\n);\n"]}
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";AAEA,OAAO,+BAA+B,CAAC;AAEvC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,MAAM,CAAC;AASjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAEtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,iBAAiB,IAAI,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,6BAA6B,EAAE,MAAM,6BAA6B,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EACL,8BAA8B,EAC9B,wBAAwB,EACxB,kBAAkB,EAClB,0BAA0B,EAC1B,kBAAkB,GACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAiB,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,yBAAyB,EACzB,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAEvC,SAAS,UAAU;IACjB,2DAA2D;IAC3D,MAAM,aAAa,GAAG;QACpB,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC;QACjE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC;QACvE,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC;KACxC,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,aAAa,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,oBAAoB,CAC9B,OAAO,EACP,CAAC,KAAK,EAAkC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,EAC1D,GAAG,EAAE,CAAC,+CAA+C,CACtD,CAAC;QACF,IAAI,OAAO,GAAG,EAAE,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AACnD,MAAM,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AACnD,MAAM,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACzD,MAAM,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACvD,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;AAC/C,MAAM,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACjE,MAAM,2BAA2B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAAC;AAC3E,MAAM,sBAAsB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;AACjE,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;AAC7C,MAAM,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAC7D,MAAM,8BAA8B,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAAC;AACjF,MAAM,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAC7D,yEAAyE;AACzE,kEAAkE;AAClE,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAC;AAC3C,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;AAC3C,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AAEjG,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtB,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,oCAAoC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,sBAAsB,IAAI,gCAAgC,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CACX,sBAAsB,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK;YACxF,kEAAkE;YAClE,wBAAwB,IAAI,EAAE,CACjC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,KAAK,CACX,sBAAsB,IAAI,oBAAoB,IAAI,CAAC,GAAG,gCAAgC,IAAI,IAAI;YAC5F,+EAA+E,CAClF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC;YACxC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,YAAY,0BAA0B,EAAE,CAAC;QAChD,OAAO,CAAC,KAAK,CAAC,4BAA4B,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAChF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,IAAc,CAAC;AACnB,IAAI,CAAC;IACH,IAAI,GAAG,WAAW,EAAE,CAAC;AACvB,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,0EAA0E;AAC1E,qDAAqD;AACrD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,mEAAmE;AACnE,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;IAC3B,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,yEAAyE;AACzE,4EAA4E;AAC5E,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAC/E,uBAAuB,CAAC,iBAAiB,CAAC,CAAC;AAE3C,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;IACxB,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,wBAAwB;AACxB,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACrC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,8BAA8B,YAAY,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CACT,4DAA4D,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,IAAI,CAC5F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,sCAAsC;AACtC,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;IACrD,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,eAAe,CAAC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;AAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;AAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;AACnC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;AACrC,oBAAoB,CAAC,QAAQ,CAAC,CAAC;AAC/B,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC7B,eAAe,CAAC,UAAU,CAAC,CAAC;AAC9B,CAAC;AACD,IAAI,CAAC;IACH,8BAA8B,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,wEAAwE;AACxE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC3C,MAAM,WAAW,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC;AACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;AAC/C,MAAM,SAAS,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AAE7C,IAAI,CAAC,QAAQ,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,EAAE,CAAC;IAC3D,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,yCAAyC;AACzC,MAAM,gBAAgB,GAAmB;IACvC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,OAAO,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,UAAU,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,GAAG,CAAC,UAAU,CAAC,CAAC,CAAE,CAAC,SAAS,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7C,GAAG,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAC,CAAC,CAAC,EAAE,CAAC;CAC5C,CAAC;AACF,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAC5B,IAAI,CAAC;QACH,OAAO,oBAAoB,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AACL,IACE,eAAe,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;IAClC,eAAe,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;IACjC,eAAe,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;IACzC,eAAe,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAC5C,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAChF,OAAO,CAAC,GAAG,CACT,8BAA8B,eAAe,CAAC,QAAQ,CAAC,MAAM,UAAU;QACrE,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,aAAa,CACnD,CAAC;AACJ,CAAC;AACD,IAAI,eAAe,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,yCAAyC,eAAe,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;AACpG,CAAC;AACD,IAAI,eAAe,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACjD,OAAO,CAAC,GAAG,CACT,8CAA8C,eAAe,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAC1F,CAAC;AACJ,CAAC;AAED,IAAI,CAAC;IACH,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACpD,IAAI,YAAY,CAAC,SAAS,EAAE,EAAE,CAAC;IAC7B,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,IAAI,KAAK,WAAW;QAC1B,CAAC,CAAC,iDAAiD;QACnD,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO;YACtB,OAAO,CAAC,IAAI,KAAK,UAAU;YAC3B,OAAO,CAAC,IAAI,KAAK,aAAa;YAC9B,OAAO,CAAC,IAAI,KAAK,YAAY;YAC/B,CAAC,CAAC,wEAAwE;YAC1E,CAAC,CAAC,8DAA8D,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE;IAC1B,IAAI,CAAC;QACH,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AACL,MAAM,eAAe,GAAG,aAAa,CAAC,OAAO,CAAC;AAC9C,MAAM,aAAa,GACjB,eAAe,EAAE,IAAI,IAAI,eAAe,EAAE,MAAM;IAC9C,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;IAClE,CAAC,CAAC,SAAS,CAAC;AAChB,MAAM,kBAAkB,GACtB,eAAe,EAAE,KAAK,EAAE,IAAI,IAAI,eAAe,EAAE,KAAK,EAAE,MAAM;IAC5D,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,EAAE;IAChF,CAAC,CAAC,SAAS,CAAC;AAEhB,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,KAAK,OAAO;IACtB,CAAC,CAAC,IAAI,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE;QACxC,MAAM,EAAE,aAAa;QACrB,WAAW,EAAE,kBAAkB;KAChC,CAAC;IACJ,CAAC,CAAC,SAAS,CAAC;AAChB,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,yEAAyE;AACzE,0EAA0E;AAC1E,sEAAsE;AACtE,MAAM,eAAe,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,CAAC;AAClE,IAAI,WAAW,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAC9C,IAAI,OAAO,CAAC,6BAA6B,CAAC,KAAK,GAAG,EAAE,CAAC;QACnD,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChF,MAAM,WAAW,CAAC,gCAAgC,CAChD,IAAI,GAAG,CAAC,CAAC,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC,CACrE,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,WAAW,CAAC,2BAA2B,CACrC,4BAA4B,CAAC;YAC3B,OAAO,EAAE,eAAe;YACxB,aAAa,EAAE,UAAU;YACzB,QAAQ;SACT,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AACD,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;IAChC,IAAI,CAAC;QACH,wBAAwB,CAAC;YACvB,MAAM,EAAE,aAAa;YACrB,WAAW,EAAE,kBAAkB;SAChC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AACD,MAAM,kBAAkB,GACtB,OAAO,CAAC,IAAI,KAAK,OAAO;IACtB,CAAC,CAAC,WAAW;IACb,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;QAC3B,CAAC,CAAC,iBAAiB;QACnB,CAAC,CAAC,SAAS,CAAC;AAElB,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;IAC5D,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5C,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5C,eAAe,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,sBAAsB,EAAE,CAAC;AACpD,MAAM,qBAAqB,GAAG,IAAI,6BAA6B,EAAE,CAAC;AAClE,MAAM,eAAe,GAAG,IAAI,uBAAuB,EAAE,CAAC;AACtD,WAAW,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AACjE,WAAW,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AACxE,WAAW,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;AAElE,SAAS,aAAa;IACpB,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,SAAS;QAAE,OAAO,oBAAoB,SAAS,EAAE,CAAC;IACtD,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,sDAAsD;AACtD,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD,IAAI,WAAW,EAAE,CAAC;IAChB,MAAM,WAAW,CAAC,SAAS,EAAE,CAAC;IAC9B,MAAM,WAAW,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC;IAC5D,WAAW,CACT,GAAG,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,+BAA+B,CAAC,EAC3D,+BAA+B,CAChC,CAAC,KAAK,EAAE,CAAC;AACZ,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;IAChC,MAAM,yBAAyB,EAAE,CAAC;IAClC,WAAW,CACT,GAAG,EAAE,CAAC,KAAK,mBAAmB,CAAC,+BAA+B,CAAC,EAC/D,+BAA+B,CAChC,CAAC,KAAK,EAAE,CAAC;AACZ,CAAC;AACD,MAAM,cAAc,GAAiC,EAAE,CAAC;AAExD;;;GAGG;AACH,SAAS,kBAAkB,CAAC,EAAU,EAAE,QAA4B;IAClE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,QAAQ;YACN,CAAC,CAAC,GAAG,EAAE,uBAAuB,QAAQ,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG;YACxF,CAAC,CAAC,GAAG,EAAE,gCAAgC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAI,EAAE,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,8EAA8E;AAC9E,MAAM,gBAAgB,GAAqB,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;IAClF,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC5C,GAAG,CAAC,OAAO,CAAC,sBAAsB,GAAG,IAAI,cAAc,KAAK,IAAI,CAAC,MAAM,SAAS,CAAC,CAAC;AACpF,CAAC,CAAC;AAEF,kEAAkE;AAClE,MAAM,eAAe,GAAoB,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;IAC5F,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,8BAA8B,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACxD,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC,CAAC;AAChE,CAAC,CAAC;AAEF,gFAAgF;AAChF,MAAM,gBAAgB,GAAqB,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;IAC7F,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,iCAAiC,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,GAAG,CAAC,OAAO,CAAC,YAAY,QAAQ,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,uEAAuE;AACvE,SAAS,gBAAgB,CAAC,EAAU;IAClC,MAAM,GAAG,GAAG,cAAc,CAAC,MAAwC,CAAC;IACpE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,eAAe,CAAC,EAAU;IACjC,MAAM,GAAG,GAAG,cAAc,CAAC,KAA2C,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,GAAG,EAAE,qCAAqC,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iFAAiF;AACjF,MAAM,gBAAgB,GAAqB;IACzC,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACtD,IAAI,QAAQ,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,8BAA8B,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,GAAG,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ;YACzB,CAAC,CAAC,MAAM,GAAG,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;YAC9F,CAAC,CAAC,MAAM,GAAG,CAAC,iBAAiB,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9E,OAAO,EAAE,EAAE,EAAE,CAAC;IAChB,CAAC;IACD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE;QACnE,IAAI,QAAQ,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,8BAA8B,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC,mBAAmB,CACnD,cAAc,EACd,SAAS,EACT,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,MAAM,CACf,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;;GAIG;AACH,SAAS,8BAA8B;IACrC,MAAM,SAAS,GAA8B,EAAE,CAAC;IAChD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,gBAAgB,GAAqB;YACzC,UAAU,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;gBAC/D,MAAM,GAAG,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;gBAC9C,MAAM,EAAE,GAAG,QAAQ;oBACjB,CAAC,CAAC,MAAM,GAAG,CAAC,kBAAkB,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC;oBACtE,CAAC,CAAC,MAAM,GAAG,CAAC,iBAAiB,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC9D,GAAG,CAAC,cAAc,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC/D,OAAO,EAAE,EAAE,EAAE,CAAC;YAChB,CAAC;YACD,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;gBACrE,MAAM,GAAG,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;gBAC9C,MAAM,GAAG,CAAC,mBAAmB,CAAC,cAAc,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;gBAChE,GAAG,CAAC,cAAc,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YACjE,CAAC;YACD,mBAAmB,EAAE,CAAC,cAAc,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,CACpD,eAAe,CAAC,gBAAgB,CAAC,CAAC,mBAAmB,CAAC,cAAc,EAAE,EAAE,EAAE,QAAQ,CAAC;SACtF,CAAC;QACF,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,iBAAiB,GAAsB;QAC3C,eAAe,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CAC3C,gBAAgB,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,cAAc,EAAE,OAAO,CAAC;QAC5E,SAAS,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CACpC,gBAAgB,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC;QACzE,SAAS,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,CACnC,gBAAgB,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC;QACxE,WAAW,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CACvC,gBAAgB,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC;QAC5E,mBAAmB,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CACvD,gBAAgB,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAC7D,cAAc,EACd,SAAS,EACT,IAAI,CACL;QACH,QAAQ,EAAE,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE,CACnC,gBAAgB,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;QACtE,UAAU,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CACtC,gBAAgB,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC;QACzE,WAAW,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,EAAE,CACvC,gBAAgB,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC;KAC5E,CAAC;IACF,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,GAAG,yBAAyB,CAAC;IACxC,UAAU;IACV,OAAO;IACP,YAAY;IACZ,WAAW;IACX,kBAAkB;IAClB,cAAc;IACd,qBAAqB;IACrB,eAAe;IACf,aAAa,EAAE,aAAa,EAAE;IAC9B,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,yBAAyB,EAAE,8BAA8B,EAAE;CAC5D,CAAC,CAAC;AAEH,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,KAAK,MAAM;IACrB,CAAC,CAAC,MAAM;IACR,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;QAC5B,CAAC,CAAC,aAAa,OAAO,CAAC,SAAS,EAAE;QAClC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO;YACxB,CAAC,CAAC,SAAS,OAAO,CAAC,KAAK,EAAE;YAC1B,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;gBAC3B,CAAC,CAAC,YAAY,OAAO,CAAC,OAAO,EAAE;gBAC/B,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa;oBAC9B,CAAC,CAAC,eAAe,OAAO,CAAC,IAAI,EAAE;oBAC/B,CAAC,CAAC,cAAc,OAAO,CAAC,SAAS,EAAE,CAAC;AAChD,GAAG,CAAC,UAAU,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AACxC,wBAAwB,EAAE,CAAC;AAE3B;;;;GAIG;AACH,SAAS,wBAAwB;IAC/B,MAAM,KAAK,GACT,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACzB,GAAG,CAAC,OAAO,CACT,iCAAiC,iBAAiB,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CACnG,CAAC;IAEF,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;IACnC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAW,CAAC,CAAC;YACrF,GAAG,CAAC,OAAO,CAAC,iBAAiB,QAAQ,gBAAgB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;QAC1F,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,UAAU,CAAC,iBAAiB,QAAQ,+BAA+B,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,OAAO,CAAC,iBAAiB,QAAQ,kDAAkD,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,UAAU,GAAG,qBAAqB,EAAE,CAAC;IAC3C,GAAG,CAAC,OAAO,CACT,UAAU,CAAC,UAAU,CAAC;QACpB,CAAC,CAAC,wBAAwB,UAAU,EAAE;QACtC,CAAC,CAAC,8BAA8B,UAAU,6BAA6B,CAC1E,CAAC;AACJ,CAAC;AAED,IAAI,QAAQ,EAAE,CAAC;IACb,MAAM,sBAAsB,GAAG,eAAe,CAAC;IAC/C,MAAM,aAAa,GAAG,eAAe,CAAC;IACtC,IAAI,CAAC,sBAAsB,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,YAAY,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAC,CAAC;IACvF,MAAM,iBAAiB,GAAG,IAAI,sBAAsB,CAAC,OAAO,EAAE;QAC5D,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,sBAAsB;QAChC,UAAU;QACV,KAAK,EAAE,WAAW;KACnB,CAAC,CAAC;IACH,cAAc,CAAC,KAAK,GAAG,iBAAiB,CAAC;IACzC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;AACjC,CAAC;AACD,IAAI,WAAW,EAAE,CAAC;IAChB,MAAM,aAAa,GAAG,kBAAkB,CAAC;IACzC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,CAAC,OAAO,EAAE;QAC7D,KAAK,EAAE,aAAa;QACpB,UAAU;KACX,CAAC,CAAC;IACH,cAAc,CAAC,QAAQ,GAAG,oBAAoB,CAAC;IAC/C,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACpC,CAAC;AACD,IAAI,UAAU,EAAE,CAAC;IACf,MAAM,YAAY,GAAG,iBAAiB,CAAC;IACvC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,CAAC,OAAO,EAAE;QAC3D,KAAK,EAAE,YAAY;QACnB,UAAU;KACX,CAAC,CAAC;IACH,cAAc,CAAC,OAAO,GAAG,mBAAmB,CAAC;IAC7C,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AACnC,CAAC;AACD,IAAI,SAAS,EAAE,CAAC;IACd,IAAI,CAAC,aAAa,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,yEAAyE;IACzE,MAAM,gBAAgB,GAAG,2BAA2B;QAClD,CAAC,CAAC,YAAY,CAAC,2BAA2B,EAAE,OAAO,CAAC;QACpD,CAAC,CAAC,sBAAsB,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClD,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,mBAAmB,GAAG,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5F,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,OAAO,EAAE;QACzD,KAAK,EAAE,aAAa;QACpB,UAAU,EAAE,gBAAgB;QAC5B,cAAc,EAAE,sBAAsB;QACtC,KAAK,EAAE,YAAY;YACjB,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC;iBACpB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;iBAC1B,MAAM,CAAC,OAAO,CAAC;YACpB,CAAC,CAAC,EAAE;QACN,cAAc,EACZ,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,mBAAmB,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5F,IAAI;QACN,UAAU;QACV,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC;QACjD,sEAAsE;QACtE,oEAAoE;QACpE,sDAAsD;QACtD,UAAU,EAAE,8BAA8B;YACxC,CAAC,CAAC;gBACE,aAAa,EAAE,IAAI,gBAAgB,CAAC;oBAClC,eAAe,EAAE,8BAA8B;iBAChD,CAAC;gBACF,eAAe,EAAE,oBAAoB;aACtC;YACH,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;IACH,cAAc,CAAC,MAAM,GAAG,kBAAkB,CAAC;IAC3C,GAAG,CAAC,OAAO,CACT,mBAAmB,8BAA8B,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,EAAE,CACzF,CAAC;AACJ,CAAC;AAED,IAAI,SAAS,EAAE,CAAC;IACd,cAAc,CAAC;QACb,IAAI,EAAE,SAAS;QACf,cAAc;QACd,YAAY;QACZ,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE;YAClD,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YACrC,IAAI,GAAG;gBAAE,MAAM,GAAG,CAAC,WAAW,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QACD,qBAAqB;QACrB,sBAAsB,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE;QACnD,YAAY,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE;KACzF,CAAC,CAAC;AACL,CAAC;AAED,sDAAsD;AACtD,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,cAAc,CAAC,CAAC;AACpF,MAAM,iBAAiB,GAAG,cAAc,CAAC,KAA2C,CAAC;AACrF,IAAI,iBAAiB,EAAE,CAAC;IACtB,iBAAiB,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;AACpD,CAAC;AACD,aAAa,CAAC,KAAK,EAAE,CAAC;AAEtB,kBAAkB;AAClB,KAAK,UAAU,QAAQ;IACrB,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;IACzB,aAAa,CAAC,IAAI,EAAE,CAAC;IACrB,MAAM,uBAAuB,EAAE,CAAC;IAChC,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC/B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AAEhC,iBAAiB;AACjB,MAAM,OAAO,CAAC,GAAG,CACf,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACxB,GAAG,CAAC,UAAU,CAAC,qBAAqB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CACH,CACF,CAAC;AAEF,uEAAuE;AACvE,uEAAuE;AACvE,IAAI,WAAW,EAAE,CAAC;IAChB,KAAK,WAAW,CAAC,6BAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7D,GAAG,CAAC,UAAU,CACZ,+BAA+B,EAC/B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["#!/usr/bin/env node\n\nimport \"./observability/instrument.js\";\n\nimport { join } from \"path\";\nimport { mkdirSync, statSync, writeFileSync } from \"fs\";\nimport { fileURLToPath } from \"url\";\nimport { dirname, join as pathJoin } from \"path\";\nimport type {\n  MessagingBot,\n  PlatformBlockKit,\n  PlatformName,\n  PlatformNotifier,\n  PlatformReactor,\n  PlatformUploader,\n} from \"./adapter.js\";\nimport { DiscordMessagingBot } from \"./adapters/discord/bot.js\";\nimport { GithubMessagingBot } from \"./adapters/github/bot.js\";\nimport { createGithubToolPack } from \"./adapters/github/tool-pack.js\";\nimport type { PlatformGithubOps } from \"./adapters/github/types.js\";\nimport { GcpTokenProvider } from \"./adapters/github/gcp-auth.js\";\nimport { TelegramMessagingBot } from \"./adapters/telegram/bot.js\";\nimport { SlackMessagingBot as SlackMessagingBotClass } from \"./adapters/slack/bot.js\";\nimport { createSlackToolPack } from \"./adapters/slack/tool-pack.js\";\nimport type { PlatformSlackOps } from \"./adapters/slack/types.js\";\nimport type { PlatformToolPackFactory } from \"./tools/types.js\";\nimport { downloadChannel } from \"./cli/download.js\";\nimport { EventsWatcher } from \"./events.js\";\nimport * as log from \"./log.js\";\nimport { startWebServer } from \"./web/server.js\";\nimport { InMemoryAdminTokenStore } from \"./web/admin/store.js\";\nimport { InMemoryLinkTokenStore } from \"./web/login/store.js\";\nimport { InMemorySessionViewTokenStore } from \"./web/session-view/store.js\";\nimport { DockerContainerManager } from \"./provisioner.js\";\nimport {\n  assertStateDirOutsideWorkspace,\n  createGlobalSettingsFile,\n  loadGlobalSettings,\n  MissingGlobalSettingsError,\n  resolveLinkBaseUrl,\n} from \"./config.js\";\nimport {\n  configureHttpDispatcher,\n  defaultAuthPath,\n  defaultModelsJsonPath,\n  parseHttpIdleTimeoutMs,\n} from \"./harness/index.js\";\nimport { existsSync, readFileSync } from \"fs\";\nimport { readEnv, setEnvAliases } from \"./utils/env.js\";\nimport { ensureDirExists, isRecord, readJsonFileIfExists } from \"./utils/file-guards.js\";\nimport { SandboxError, validateSandbox } from \"./sandbox/index.js\";\nimport { helpText, resolveBoot, type BootPlan } from \"./cli/boot.js\";\nimport { envReport, noPlatformsMessage, platformIsActive } from \"./env-manifest.js\";\nimport {\n  configureGondolinRuntime,\n  gondolinResources,\n  reconcileGondolinRuntimes,\n  stopAllGondolinRuntimes,\n  stopIdleGondolinVms,\n} from \"./sandbox/gondolin.js\";\nimport { FileVaultManager } from \"./vault/index.js\";\nimport { runExtCommand } from \"./cli/ext.js\";\nimport { runOfficeCommand } from \"./cli/office.js\";\nimport {\n  buildContainerBindTranslator,\n  formatUnmigratedOfficesError,\n  migrateLegacyOffices,\n} from \"./office-migration.js\";\nimport { OfficeRegistry } from \"./office-registry.js\";\nimport { createConversationRuntime } from \"./runtime/conversation-runtime.js\";\nimport { ChannelStore } from \"./store.js\";\nimport * as Sentry from \"@sentry/node\";\n\nfunction getVersion(): string {\n  // Try to find package.json in the dist directory or parent\n  const possiblePaths = [\n    pathJoin(dirname(fileURLToPath(import.meta.url)), \"package.json\"),\n    pathJoin(dirname(fileURLToPath(import.meta.url)), \"..\", \"package.json\"),\n    pathJoin(process.cwd(), \"package.json\"),\n  ];\n\n  for (const pkgPath of possiblePaths) {\n    const pkg = readJsonFileIfExists(\n      pkgPath,\n      (value): value is { version?: unknown } => isRecord(value),\n      () => \"Ignoring package.json while resolving version\",\n    );\n    if (typeof pkg?.version === \"string\" && pkg.version) return pkg.version;\n  }\n  return \"unknown\";\n}\n\nconst SLACK_APP_TOKEN = readEnv(\"SLACK_APP_TOKEN\");\nconst SLACK_BOT_TOKEN = readEnv(\"SLACK_BOT_TOKEN\");\nconst TELEGRAM_BOT_TOKEN = readEnv(\"TELEGRAM_BOT_TOKEN\");\nconst DISCORD_BOT_TOKEN = readEnv(\"DISCORD_BOT_TOKEN\");\nconst GITHUB_APP_ID = readEnv(\"GITHUB_APP_ID\");\nconst GITHUB_APP_PRIVATE_KEY = readEnv(\"GITHUB_APP_PRIVATE_KEY\");\nconst GITHUB_APP_PRIVATE_KEY_PATH = readEnv(\"GITHUB_APP_PRIVATE_KEY_PATH\");\nconst GITHUB_INSTALLATION_ID = readEnv(\"GITHUB_INSTALLATION_ID\");\nconst GITHUB_REPOS = readEnv(\"GITHUB_REPOS\");\nconst GITHUB_POLL_INTERVAL = readEnv(\"GITHUB_POLL_INTERVAL\");\nconst GOOGLE_APPLICATION_CREDENTIALS = readEnv(\"GOOGLE_APPLICATION_CREDENTIALS\");\nconst GOOGLE_CLOUD_PROJECT = readEnv(\"GOOGLE_CLOUD_PROJECT\");\n// Externally-visible base URL of the link/OAuth server; the env read and\n// trailing-slash normalization live in config.resolveLinkBaseUrl.\nconst LINK_BASE_URL = resolveLinkBaseUrl();\nconst LINK_PORT_RAW = readEnv(\"LINK_PORT\");\nconst LINK_PORT = LINK_PORT_RAW ? parseInt(LINK_PORT_RAW, 10) : LINK_BASE_URL ? 8181 : undefined;\n\nconst WORLD_WRITABLE_MODE = 0o002;\n\nfunction ensureSecureStateDir(path: string): void {\n  let stat;\n  try {\n    stat = statSync(path);\n  } catch (err) {\n    const code = (err as NodeJS.ErrnoException).code;\n    if (code === \"ENOENT\") {\n      mkdirSync(path, { recursive: true, mode: 0o700 });\n      return;\n    }\n    console.error(`Error: cannot access --state-dir ${path}: ${(err as Error).message}`);\n    process.exit(1);\n  }\n\n  if (!stat.isDirectory()) {\n    console.error(`Error: --state-dir ${path} exists but is not a directory`);\n    process.exit(1);\n  }\n\n  if (stat.mode & WORLD_WRITABLE_MODE) {\n    console.error(\n      `Error: --state-dir ${path} is world-writable (mode ${(stat.mode & 0o777).toString(8)}). ` +\n        `Credentials stored there would be exposed to other local users. ` +\n        `Fix with: chmod 0700 ${path}`,\n    );\n    process.exit(1);\n  }\n\n  const euid = typeof process.geteuid === \"function\" ? process.geteuid() : undefined;\n  if (euid !== undefined && stat.uid !== euid) {\n    console.error(\n      `Error: --state-dir ${path} is owned by uid ${stat.uid} but mikan is running as uid ${euid}. ` +\n        `Run mikan as the directory owner or point --state-dir at a directory you own.`,\n    );\n    process.exit(1);\n  }\n}\n\nfunction handleStartupError(error: unknown): never {\n  if (error instanceof SandboxError) {\n    for (const line of error.formatForCli()) {\n      console.error(line);\n    }\n    process.exit(1);\n  }\n  if (error instanceof MissingGlobalSettingsError) {\n    console.error(`Missing global settings: ${error.settingsPath}`);\n    console.error(\"\");\n    console.error(\"Run onboarding to create it:\");\n    console.error(`  mikan --onboard --state-dir ${stateDir}`);\n    console.error(\"\");\n    console.error(\"Then review the generated settings.json and start mikan again.\");\n    process.exit(1);\n  }\n  if (error instanceof Error) {\n    console.error(`Error: ${error.message}`);\n    process.exit(1);\n  }\n  console.error(String(error));\n  process.exit(1);\n}\n\nlet plan: BootPlan;\ntry {\n  plan = resolveBoot();\n} catch (error) {\n  handleStartupError(error);\n}\n\n// `mikan ext …` manages extensions and exits; handle it before the normal\n// bot-mode startup (which requires platform tokens).\nif (plan.mode === \"ext\") {\n  const code = await runExtCommand(plan.extArgs ?? []);\n  process.exit(code);\n}\n\n// `mikan office …` inspects/claims conversation offices and exits.\nif (plan.mode === \"office\") {\n  process.exit(runOfficeCommand(plan.officeArgs ?? []));\n}\n\n// Global fetch: proxy support (HTTP_PROXY/HTTPS_PROXY/NO_PROXY) and idle\n// timeouts so a stalled LLM stream errors out instead of hanging a session.\nconst httpIdleTimeoutMs = parseHttpIdleTimeoutMs(readEnv(\"HTTP_IDLE_TIMEOUT\"));\nconfigureHttpDispatcher(httpIdleTimeoutMs);\n\nif (plan.mode === \"help\") {\n  console.log(helpText());\n  process.exit(0);\n}\n\nif (plan.mode === \"env\") {\n  console.log(envReport());\n  process.exit(0);\n}\n\nif (plan.mode === \"version\") {\n  console.log(getVersion());\n  process.exit(0);\n}\n\n// Handle --onboard mode\nif (plan.mode === \"onboard\") {\n  const stateDir = plan.stateDir;\n  setEnvAliases(\"STATE_DIR\", stateDir);\n  ensureSecureStateDir(stateDir);\n  try {\n    const settingsPath = createGlobalSettingsFile(stateDir);\n    console.log(`Created global settings at ${settingsPath}`);\n    console.log(\n      `Review the file, then start mikan (workspace defaults to ${join(stateDir, \"workspace\")}).`,\n    );\n    process.exit(0);\n  } catch (err) {\n    console.error(err instanceof Error ? err.message : String(err));\n    process.exit(1);\n  }\n}\n\n// Handle --download mode (Slack only)\nif (plan.mode === \"download\" && plan.downloadChannel) {\n  if (!SLACK_BOT_TOKEN) {\n    console.error(\"Missing env: SLACK_BOT_TOKEN\");\n    process.exit(1);\n  }\n  await downloadChannel(plan.downloadChannel, SLACK_BOT_TOKEN);\n  process.exit(0);\n}\n\n// Normal bot mode - working dir is optional and defaults under the state dir\nconst sandbox = plan.sandbox;\nconst stateDir = plan.stateDir;\nconst workingDir = plan.workingDir;\nsetEnvAliases(\"STATE_DIR\", stateDir);\nensureSecureStateDir(stateDir);\nif (!plan.workingDirExplicit) {\n  ensureDirExists(workingDir);\n}\ntry {\n  assertStateDirOutsideWorkspace(stateDir, workingDir, sandbox.type);\n} catch (error) {\n  handleStartupError(error);\n}\n\n// Validate platform tokens — activation rules live in the env manifest.\nconst hasSlack = platformIsActive(\"slack\");\nconst hasTelegram = platformIsActive(\"telegram\");\nconst hasDiscord = platformIsActive(\"discord\");\nconst hasGithub = platformIsActive(\"github\");\n\nif (!hasSlack && !hasTelegram && !hasDiscord && !hasGithub) {\n  console.error(noPlatformsMessage());\n  process.exit(1);\n}\n\n// Move legacy raw-id conversation directories to the office-key layout before\n// anything touches the workspace. Runs every boot; a completed migration is a\n// no-op. Unowned or failed offices are fatal: after the layout flip a legacy\n// directory is invisible to the runtime, and booting anyway would present\n// those conversations as silently empty.\nconst enabledPlatforms: PlatformName[] = [\n  ...(hasSlack ? ([\"slack\"] as const) : []),\n  ...(hasTelegram ? ([\"telegram\"] as const) : []),\n  ...(hasDiscord ? ([\"discord\"] as const) : []),\n  ...(hasGithub ? ([\"github\"] as const) : []),\n];\nconst officeMigration = (() => {\n  try {\n    return migrateLegacyOffices({ workspaceRoot: workingDir, stateDir, enabledPlatforms });\n  } catch (error) {\n    handleStartupError(error);\n  }\n})();\nif (\n  officeMigration.unowned.length > 0 ||\n  officeMigration.failed.length > 0 ||\n  officeMigration.vaultConflicts.length > 0 ||\n  officeMigration.stateDirConflicts.length > 0\n) {\n  console.error(formatUnmigratedOfficesError(officeMigration));\n  process.exit(1);\n}\nif (officeMigration.migrated.length > 0 || officeMigration.recovered.length > 0) {\n  console.log(\n    `  Office layout migration: ${officeMigration.migrated.length} moved, ` +\n      `${officeMigration.recovered.length} recovered.`,\n  );\n}\nif (officeMigration.vaultKeysMigrated.length > 0) {\n  console.log(`  Vault keys migrated to office keys: ${officeMigration.vaultKeysMigrated.length}.`);\n}\nif (officeMigration.stateDirsMigrated.length > 0) {\n  console.log(\n    `  Host state dirs migrated to office keys: ${officeMigration.stateDirsMigrated.length}.`,\n  );\n}\n\ntry {\n  await validateSandbox(sandbox);\n} catch (error) {\n  handleStartupError(error);\n}\n\nconst vaultManager = new FileVaultManager(stateDir);\nif (vaultManager.isEnabled()) {\n  console.log(\n    sandbox.type === \"container\"\n      ? \"  Vault system enabled. Container vault active.\"\n      : sandbox.type === \"image\" ||\n          sandbox.type === \"gondolin\" ||\n          sandbox.type === \"firecracker\" ||\n          sandbox.type === \"cloudflare\"\n        ? \"  Vault system enabled. Conversation-scoped credential routing active.\"\n        : \"  Vault system enabled. Host mode will not inject vault env.\",\n  );\n}\n\nconst startupConfig = (() => {\n  try {\n    return loadGlobalSettings();\n  } catch (error) {\n    handleStartupError(error);\n  }\n})();\nconst sandboxSettings = startupConfig.sandbox;\nconst sandboxLimits =\n  sandboxSettings?.cpus || sandboxSettings?.memory\n    ? { cpus: sandboxSettings?.cpus, memory: sandboxSettings?.memory }\n    : undefined;\nconst sandboxBoostLimits =\n  sandboxSettings?.boost?.cpus || sandboxSettings?.boost?.memory\n    ? { cpus: sandboxSettings?.boost?.cpus, memory: sandboxSettings?.boost?.memory }\n    : undefined;\n\nconst provisioner =\n  sandbox.type === \"image\"\n    ? new DockerContainerManager(sandbox.image, {\n        limits: sandboxLimits,\n        boostLimits: sandboxBoostLimits,\n      })\n    : undefined;\n// Containers provisioned before the office migration mount the renamed\n// legacy paths. Their writable layers (everything installed inside) are\n// preserved: each container is committed and recreated with translated\n// mounts — on demand before its next message, and via a background sweep\n// after the bots start. MIKAN_SKIP_CONTAINER_PRESERVATION=1 falls back to\n// plain removal (containers rebuild from the base image on next use).\nconst registryOffices = new OfficeRegistry(stateDir).getOffices();\nif (provisioner && registryOffices.length > 0) {\n  if (readEnv(\"SKIP_CONTAINER_PRESERVATION\") === \"1\") {\n    if (officeMigration.migrated.length > 0 || officeMigration.recovered.length > 0) {\n      await provisioner.removeContainersForConversations(\n        new Set([...officeMigration.migrated, ...officeMigration.recovered]),\n      );\n    }\n  } else {\n    provisioner.armContainerLayoutMigration(\n      buildContainerBindTranslator({\n        offices: registryOffices,\n        workspaceRoot: workingDir,\n        stateDir,\n      }),\n    );\n  }\n}\nif (sandbox.type === \"gondolin\") {\n  try {\n    configureGondolinRuntime({\n      limits: sandboxLimits,\n      boostLimits: sandboxBoostLimits,\n    });\n  } catch (error) {\n    handleStartupError(error);\n  }\n}\nconst resourceController =\n  sandbox.type === \"image\"\n    ? provisioner\n    : sandbox.type === \"gondolin\"\n      ? gondolinResources\n      : undefined;\n\nif (sandbox.type === \"image\" || sandbox.type === \"gondolin\") {\n  ensureDirExists(join(workingDir, \"skills\"));\n  ensureDirExists(join(workingDir, \"events\"));\n  ensureDirExists(join(workingDir, \"agents\"));\n  try {\n    writeFileSync(join(workingDir, \"MEMORY.md\"), \"\", { flag: \"wx\" });\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code !== \"EEXIST\") throw err;\n  }\n}\n\nconst linkTokenStore = new InMemoryLinkTokenStore();\nconst sessionViewTokenStore = new InMemorySessionViewTokenStore();\nconst adminTokenStore = new InMemoryAdminTokenStore();\nsetInterval(() => linkTokenStore.purge(), 5 * 60 * 1000).unref();\nsetInterval(() => sessionViewTokenStore.purge(), 5 * 60 * 1000).unref();\nsetInterval(() => adminTokenStore.purge(), 5 * 60 * 1000).unref();\n\nfunction portalBaseUrl(): string | undefined {\n  if (LINK_BASE_URL) return LINK_BASE_URL;\n  if (LINK_PORT) return `http://localhost:${LINK_PORT}`;\n  return undefined;\n}\n/** Idle timeout for managed sandboxes (10 minutes) */\nconst MANAGED_SANDBOX_IDLE_TIMEOUT_MS = 10 * 60 * 1000;\n\nif (provisioner) {\n  await provisioner.reconcile();\n  await provisioner.stopIdle(MANAGED_SANDBOX_IDLE_TIMEOUT_MS);\n  setInterval(\n    () => provisioner.stopIdle(MANAGED_SANDBOX_IDLE_TIMEOUT_MS),\n    MANAGED_SANDBOX_IDLE_TIMEOUT_MS,\n  ).unref();\n}\n\nif (sandbox.type === \"gondolin\") {\n  await reconcileGondolinRuntimes();\n  setInterval(\n    () => void stopIdleGondolinVms(MANAGED_SANDBOX_IDLE_TIMEOUT_MS),\n    MANAGED_SANDBOX_IDLE_TIMEOUT_MS,\n  ).unref();\n}\nconst botsByPlatform: Record<string, MessagingBot> = {};\n\n/**\n * Resolve which platform bot to use: an explicit platform, or the sole\n * running one. Mirrors event-file platform resolution.\n */\nfunction resolvePlatformBot(op: string, platform: string | undefined): [string, MessagingBot] {\n  const available = Object.keys(botsByPlatform);\n  const key = platform?.trim().toLowerCase() || (available.length === 1 ? available[0] : undefined);\n  const bot = key ? botsByPlatform[key] : undefined;\n  if (!bot) {\n    throw new Error(\n      platform\n        ? `${op}: unknown platform '${platform}' (available: ${available.join(\", \") || \"none\"})`\n        : `${op}: multiple platforms active (${available.join(\", \")}); specify platform`,\n    );\n  }\n  return [key!, bot];\n}\n\n/** Extension `api.notify` backend: post into a conversation without a run. */\nconst platformNotifier: PlatformNotifier = async (conversationId, text, platform) => {\n  const [key, bot] = resolvePlatformBot(\"notify\", platform);\n  await bot.postMessage(conversationId, text);\n  log.logInfo(`[notify] posted to ${key}/${conversationId} (${text.length} chars)`);\n};\n\n/** Extension `api.react` backend: add a reaction to a message. */\nconst platformReactor: PlatformReactor = async (conversationId, messageTs, emoji, platform) => {\n  const [key, bot] = resolvePlatformBot(\"react\", platform);\n  if (!bot.addReaction) {\n    throw new Error(`react: platform '${key}' does not support reactions`);\n  }\n  await bot.addReaction(conversationId, messageTs, emoji);\n  log.logInfo(`[react] :${emoji}: on ${key}/${conversationId}`);\n};\n\n/** Extension `api.uploadFile` backend: send a host file into a conversation. */\nconst platformUploader: PlatformUploader = async (conversationId, filePath, title, platform) => {\n  const [key, bot] = resolvePlatformBot(\"upload\", platform);\n  if (!bot.uploadFile) {\n    throw new Error(`upload: platform '${key}' does not support file uploads`);\n  }\n  await bot.uploadFile(conversationId, filePath, title);\n  log.logInfo(`[upload] ${filePath} to ${key}/${conversationId}`);\n};\n\n/** github_* tool backends: PR push/create and CI checks, host-side. */\nfunction requireGithubBot(op: string): GithubMessagingBot {\n  const bot = botsByPlatform.github as GithubMessagingBot | undefined;\n  if (!bot) {\n    throw new Error(`${op}: the GitHub platform is not running`);\n  }\n  return bot;\n}\n\n/** slack_* tool backends: Block Kit posting/updating, host-side. */\nfunction requireSlackBot(op: string): SlackMessagingBotClass {\n  const bot = botsByPlatform.slack as SlackMessagingBotClass | undefined;\n  if (!bot) {\n    throw new Error(`${op}: the Slack platform is not running`);\n  }\n  return bot;\n}\n\n/** Extension `api.blockkit` backend: interactive Block Kit, Slack-only today. */\nconst platformBlockKit: PlatformBlockKit = {\n  postBlocks: async (conversationId, message, platform) => {\n    if (platform && platform !== \"slack\") {\n      throw new Error(`blockkit: platform '${platform}' does not support Block Kit`);\n    }\n    const bot = requireSlackBot(\"blockkit\");\n    const ts = message.threadTs\n      ? await bot.postInThreadBlocks(conversationId, message.threadTs, message.text, message.blocks)\n      : await bot.postMessageBlocks(conversationId, message.text, message.blocks);\n    return { ts };\n  },\n  updateBlocks: async (conversationId, messageTs, message, platform) => {\n    if (platform && platform !== \"slack\") {\n      throw new Error(`blockkit: platform '${platform}' does not support Block Kit`);\n    }\n    await requireSlackBot(\"blockkit\").updateMessageBlocks(\n      conversationId,\n      messageTs,\n      message.text,\n      message.blocks,\n    );\n  },\n};\n\n/**\n * Platform capability pack factories — only when the corresponding bot is\n * configured. Factories, not instances: each runner materializes its own\n * pack so per-run bind state never crosses conversations.\n */\nfunction buildPlatformToolPackFactories(): PlatformToolPackFactory[] {\n  const factories: PlatformToolPackFactory[] = [];\n  if (hasSlack) {\n    const platformSlackOps: PlatformSlackOps = {\n      postBlocks: async (conversationId, { text, blocks, threadTs }) => {\n        const bot = requireSlackBot(\"slack_blockkit\");\n        const ts = threadTs\n          ? await bot.postInThreadBlocks(conversationId, threadTs, text, blocks)\n          : await bot.postMessageBlocks(conversationId, text, blocks);\n        bot.logBotResponse(conversationId, text, ts, threadTs, blocks);\n        return { ts };\n      },\n      updateBlocks: async (conversationId, { ts, text, blocks, threadTs }) => {\n        const bot = requireSlackBot(\"slack_blockkit\");\n        await bot.updateMessageBlocks(conversationId, ts, text, blocks);\n        bot.logBotResponse(conversationId, text, ts, threadTs, blocks);\n      },\n      ownsBlockKitMessage: (conversationId, ts, threadTs) =>\n        requireSlackBot(\"slack_blockkit\").ownsBlockKitMessage(conversationId, ts, threadTs),\n    };\n    factories.push(() => createSlackToolPack(platformSlackOps));\n  }\n  if (!hasGithub) return factories;\n  const platformGithubOps: PlatformGithubOps = {\n    pushAndCreatePr: (conversationId, request) =>\n      requireGithubBot(\"github_pr\").ops.pushAndCreatePr(conversationId, request),\n    getChecks: (conversationId, branch) =>\n      requireGithubBot(\"github_checks\").ops.getChecks(conversationId, branch),\n    getJobLog: (conversationId, jobId) =>\n      requireGithubBot(\"github_checks\").ops.getJobLog(conversationId, jobId),\n    getBuildLog: (conversationId, buildId) =>\n      requireGithubBot(\"github_checks\").ops.getBuildLog(conversationId, buildId),\n    replyToReviewThread: (conversationId, commentId, body) =>\n      requireGithubBot(\"github_review_reply\").ops.replyToReviewThread(\n        conversationId,\n        commentId,\n        body,\n      ),\n    syncRepo: (conversationId, branch) =>\n      requireGithubBot(\"github_sync\").ops.syncRepo(conversationId, branch),\n    readGithub: (conversationId, request) =>\n      requireGithubBot(\"github_read\").ops.readGithub(conversationId, request),\n    manageIssue: (conversationId, request) =>\n      requireGithubBot(\"github_issue\").ops.manageIssue(conversationId, request),\n  };\n  factories.push(() => createGithubToolPack(platformGithubOps));\n  return factories;\n}\n\nconst handler = createConversationRuntime({\n  workingDir,\n  sandbox,\n  vaultManager,\n  provisioner,\n  resourceController,\n  linkTokenStore,\n  sessionViewTokenStore,\n  adminTokenStore,\n  portalBaseUrl: portalBaseUrl(),\n  platformNotifier,\n  platformReactor,\n  platformUploader,\n  platformBlockKit,\n  platformToolPackFactories: buildPlatformToolPackFactories(),\n});\n\nconst sandboxDesc =\n  sandbox.type === \"host\"\n    ? \"host\"\n    : sandbox.type === \"container\"\n      ? `container:${sandbox.container}`\n      : sandbox.type === \"image\"\n        ? `image:${sandbox.image}`\n        : sandbox.type === \"gondolin\"\n          ? `gondolin:${sandbox.profile}`\n          : sandbox.type === \"firecracker\"\n            ? `firecracker:${sandbox.vmId}`\n            : `cloudflare:${sandbox.sandboxId}`;\nlog.logStartup(workingDir, sandboxDesc);\nlogHarnessStartupSummary();\n\n/**\n * One-look confirmation of the harness runtime surface, aimed at upgrade\n * verification: config moved from ~/.pi to ~/.mikan with no fallback, so a\n * missing auth.json here is the first thing to check when runs fail.\n */\nfunction logHarnessStartupSummary(): void {\n  const proxy =\n    process.env.HTTPS_PROXY ??\n    process.env.https_proxy ??\n    process.env.HTTP_PROXY ??\n    process.env.http_proxy;\n  log.logInfo(\n    `HTTP dispatcher: idle timeout ${httpIdleTimeoutMs}ms${proxy ? `, proxy ${proxy}` : \", no proxy\"}`,\n  );\n\n  const authPath = defaultAuthPath();\n  if (existsSync(authPath)) {\n    try {\n      const providers = Object.keys(JSON.parse(readFileSync(authPath, \"utf-8\")) as object);\n      log.logInfo(`Harness auth: ${authPath} (providers: ${providers.join(\", \") || \"none\"})`);\n    } catch {\n      log.logWarning(`Harness auth: ${authPath} exists but is not valid JSON`);\n    }\n  } else {\n    log.logInfo(`Harness auth: ${authPath} missing — provider keys come from env vars only`);\n  }\n\n  const modelsPath = defaultModelsJsonPath();\n  log.logInfo(\n    existsSync(modelsPath)\n      ? `Harness models.json: ${modelsPath}`\n      : `Harness models.json: none (${modelsPath}) — built-in providers only`,\n  );\n}\n\nif (hasSlack) {\n  const slackMessagingBotToken = SLACK_BOT_TOKEN;\n  const slackAppToken = SLACK_APP_TOKEN;\n  if (!slackMessagingBotToken || !slackAppToken) {\n    throw new Error(\"Slack startup requires both SLACK_APP_TOKEN and SLACK_BOT_TOKEN\");\n  }\n  const sharedStore = new ChannelStore({ workingDir, botToken: slackMessagingBotToken });\n  const slackMessagingBot = new SlackMessagingBotClass(handler, {\n    appToken: slackAppToken,\n    botToken: slackMessagingBotToken,\n    workingDir,\n    store: sharedStore,\n  });\n  botsByPlatform.slack = slackMessagingBot;\n  log.logInfo(\"Platform: Slack\");\n}\nif (hasTelegram) {\n  const telegramToken = TELEGRAM_BOT_TOKEN;\n  if (!telegramToken) {\n    throw new Error(\"Telegram startup requires TELEGRAM_BOT_TOKEN\");\n  }\n  const telegramMessagingBot = new TelegramMessagingBot(handler, {\n    token: telegramToken,\n    workingDir,\n  });\n  botsByPlatform.telegram = telegramMessagingBot;\n  log.logInfo(\"Platform: Telegram\");\n}\nif (hasDiscord) {\n  const discordToken = DISCORD_BOT_TOKEN;\n  if (!discordToken) {\n    throw new Error(\"Discord startup requires DISCORD_BOT_TOKEN\");\n  }\n  const discordMessagingBot = new DiscordMessagingBot(handler, {\n    token: discordToken,\n    workingDir,\n  });\n  botsByPlatform.discord = discordMessagingBot;\n  log.logInfo(\"Platform: Discord\");\n}\nif (hasGithub) {\n  if (!GITHUB_APP_ID || !GITHUB_INSTALLATION_ID) {\n    throw new Error(\"GitHub startup requires GITHUB_APP_ID and GITHUB_INSTALLATION_ID\");\n  }\n  // Env vars flatten PEM newlines to literal `\\n`; a key file avoids that.\n  const githubPrivateKey = GITHUB_APP_PRIVATE_KEY_PATH\n    ? readFileSync(GITHUB_APP_PRIVATE_KEY_PATH, \"utf-8\")\n    : GITHUB_APP_PRIVATE_KEY?.replace(/\\\\n/g, \"\\n\");\n  if (!githubPrivateKey) {\n    throw new Error(\n      \"GitHub startup requires GITHUB_APP_PRIVATE_KEY or GITHUB_APP_PRIVATE_KEY_PATH\",\n    );\n  }\n  const pollIntervalSeconds = GITHUB_POLL_INTERVAL ? parseInt(GITHUB_POLL_INTERVAL, 10) : NaN;\n  const githubMessagingBot = new GithubMessagingBot(handler, {\n    appId: GITHUB_APP_ID,\n    privateKey: githubPrivateKey,\n    installationId: GITHUB_INSTALLATION_ID,\n    repos: GITHUB_REPOS\n      ? GITHUB_REPOS.split(\",\")\n          .map((repo) => repo.trim())\n          .filter(Boolean)\n      : [],\n    pollIntervalMs:\n      (Number.isFinite(pollIntervalSeconds) && pollIntervalSeconds > 0 ? pollIntervalSeconds : 60) *\n      1000,\n    workingDir,\n    syncStatePath: join(stateDir, \"github-sync.json\"),\n    // Host-side GCP creds (e.g. a WIF external_account file) unlock Cloud\n    // Build logs in github_checks; without them external CI degrades to\n    // guidance text. Credentials never enter the sandbox.\n    cloudBuild: GOOGLE_APPLICATION_CREDENTIALS\n      ? {\n          tokenProvider: new GcpTokenProvider({\n            credentialsPath: GOOGLE_APPLICATION_CREDENTIALS,\n          }),\n          projectFallback: GOOGLE_CLOUD_PROJECT,\n        }\n      : undefined,\n  });\n  botsByPlatform.github = githubMessagingBot;\n  log.logInfo(\n    `Platform: GitHub${GOOGLE_APPLICATION_CREDENTIALS ? \" (Cloud Build logs enabled)\" : \"\"}`,\n  );\n}\n\nif (LINK_PORT) {\n  startWebServer({\n    port: LINK_PORT,\n    linkTokenStore,\n    vaultManager,\n    notify: async (platform, conversationId, message) => {\n      const bot = botsByPlatform[platform];\n      if (bot) await bot.postMessage(conversationId, message);\n    },\n    sessionViewTokenStore,\n    sessionViewInteractive: { handler, botsByPlatform },\n    adminOptions: { adminTokenStore, workingDir, runtime: handler, sandbox, botsByPlatform },\n  });\n}\n\n// Start events watcher with explicit platform routing\nconst eventsWatcher = new EventsWatcher(join(workingDir, \"events\"), botsByPlatform);\nconst slackMessagingBot = botsByPlatform.slack as SlackMessagingBotClass | undefined;\nif (slackMessagingBot) {\n  slackMessagingBot.setEventsWatcher(eventsWatcher);\n}\neventsWatcher.start();\n\n// Handle shutdown\nasync function shutdown(): Promise<void> {\n  await handler.shutdown();\n  eventsWatcher.stop();\n  await stopAllGondolinRuntimes();\n  await Sentry.close(5000);\n  process.exit(0);\n}\n\nprocess.on(\"SIGINT\", shutdown);\nprocess.on(\"SIGTERM\", shutdown);\n\n// Start all bots\nawait Promise.all(\n  Object.values(botsByPlatform).map((bot) =>\n    bot.start().catch((err) => {\n      log.logWarning(\"Failed to start bot\", err instanceof Error ? err.message : String(err));\n      process.exit(1);\n    }),\n  ),\n);\n\n// Drain the container layout migration off the hot path; every unit is\n// idempotent, so an interrupted sweep simply resumes on the next boot.\nif (provisioner) {\n  void provisioner.sweepContainerLayoutMigration().catch((err) => {\n    log.logWarning(\n      \"Container layout sweep failed\",\n      err instanceof Error ? err.message : String(err),\n    );\n  });\n}\n"]}

package/dist/office-migration.d.ts

@@ -1,3 +1,4 @@
+import type { OfficeRecord } from "./types.js";
 import type { PlatformName } from "./types.js";
 export interface OfficeMigrationRunSummary {
     /** Raw ids whose directories moved to the office-key layout this run. */
@@ -35,4 +36,9 @@ export declare function migrateLegacyOffices(options: {
 }): OfficeMigrationRunSummary;
 /** Operator-facing boot failure for offices the engine may not move itself. */
 export declare function formatUnmigratedOfficesError(summary: OfficeMigrationRunSummary): string;
+export declare function buildContainerBindTranslator(options: {
+    offices: readonly OfficeRecord[];
+    workspaceRoot: string;
+    stateDir: string;
+}): (bindSpec: string) => string;
 //# sourceMappingURL=office-migration.d.ts.map

package/dist/office-migration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"office-migration.d.ts","sourceRoot":"","sources":["../src/office-migration.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAyB,YAAY,EAAE,MAAM,YAAY,CAAC;AAQtE,MAAM,WAAW,yBAAyB;IACxC,yEAAyE;IACzE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iEAAiE;IACjE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,gFAAgF;IAChF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wEAAwE;IACxE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,gFAAgF;IAChF,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,SAAS,YAAY,EAAE,CAAC;CAC3C,GAAG,yBAAyB,CAqC5B;AA4JD,+EAA+E;AAC/E,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAsCvF"}
+{"version":3,"file":"office-migration.d.ts","sourceRoot":"","sources":["../src/office-migration.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/C,OAAO,KAAK,EAAyB,YAAY,EAAE,MAAM,YAAY,CAAC;AAQtE,MAAM,WAAW,yBAAyB;IACxC,yEAAyE;IACzE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,uEAAuE;IACvE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,iEAAiE;IACjE,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yEAAyE;IACzE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,gFAAgF;IAChF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,wEAAwE;IACxE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,gFAAgF;IAChF,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,SAAS,YAAY,EAAE,CAAC;CAC3C,GAAG,yBAAyB,CAqC5B;AA4JD,+EAA+E;AAC/E,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,yBAAyB,GAAG,MAAM,CAsCvF;AAkBD,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,CA2B/B"}

package/dist/office-migration.js

@@ -1,7 +1,8 @@
 import { existsSync, lstatSync, readdirSync, renameSync } from "node:fs";
 import { join } from "node:path";
 import * as log from "./log.js";
-import { isOfficeKey, officeStateDir } from "./office-address.js";
+import { isOfficeKey, officeKey, officeStateDir } from "./office-address.js";
+import { legacyConversationCredentialKey } from "./sandbox/identity.js";
 import { OfficeRegistry } from "./office-registry.js";
 import { migrateConversationVaultKeys } from "./vault/index.js";
 /**
@@ -210,4 +211,49 @@ export function formatUnmigratedOfficesError(summary) {
     }
     return lines.join("\n");
 }
+/**
+ * Bind-spec translator for the container layout migration: rewrites every
+ * host path the office migration renamed — workspace dirs, per-conversation
+ * state trees, conversation vaults — and the guest workspace segment, using
+ * the registry's office inventory as the raw-id ↔ office mapping. Specs that
+ * reference none of the renamed paths come back unchanged, which is also how
+ * an already-migrated container is recognized.
+ */
+function replacePrefix(path, pairs) {
+    for (const [oldPrefix, newPrefix] of pairs) {
+        if (path === oldPrefix)
+            return newPrefix;
+        if (path.startsWith(`${oldPrefix}/`))
+            return newPrefix + path.slice(oldPrefix.length);
+    }
+    return path;
+}
+export function buildContainerBindTranslator(options) {
+    const hostPairs = [];
+    const guestPairs = [];
+    for (const office of options.offices) {
+        const key = officeKey(office);
+        const rawId = office.conversationId;
+        hostPairs.push([join(options.workspaceRoot, rawId), join(options.workspaceRoot, key)]);
+        hostPairs.push([
+            join(options.stateDir, "conversations", rawId),
+            officeStateDir(options.stateDir, office),
+        ]);
+        hostPairs.push([
+            join(options.stateDir, "vaults", legacyConversationCredentialKey(rawId)),
+            join(options.stateDir, "vaults", key),
+        ]);
+        guestPairs.push([`/workspace/${rawId}`, `/workspace/${key}`]);
+    }
+    return (bindSpec) => {
+        const readOnly = bindSpec.endsWith(":ro");
+        const spec = readOnly ? bindSpec.slice(0, -3) : bindSpec;
+        const separator = spec.indexOf(":");
+        if (separator === -1)
+            return bindSpec;
+        const source = replacePrefix(spec.slice(0, separator), hostPairs);
+        const target = replacePrefix(spec.slice(separator + 1), guestPairs);
+        return `${source}:${target}${readOnly ? ":ro" : ""}`;
+    };
+}
 //# sourceMappingURL=office-migration.js.map