@geminixiang/mikan 1.0.0-beta.7 → 1.0.0-beta.71

package/dist/env-manifest.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The daemon's environment interface, declared as data — the one inventory
+ * that startup validation, `mikan env`, `--help`, and the pm2 deploy
+ * template check all derive from. Add a var here and every derived surface
+ * picks it up; a var read anywhere else but not listed here is a bug.
+ *
+ * Names are the un-prefixed spelling; `readEnv` accepts a `MIKAN_`-prefixed
+ * alias for each. Not covered: dynamic OAuth service keys from
+ * OAUTH_SERVICES_JSON (data-driven by design) and standard proxy vars
+ * (HTTPS_PROXY/HTTP_PROXY/NO_PROXY).
+ */
+import type { EnvGroup } from "./types.js";
+export declare function readEnv(name: string): string | undefined;
+/** Read a standards-owned environment variable without mikan aliasing. */
+export declare function readStandardEnv(name: string): string | undefined;
+export declare function setEnvAliases(name: string, value: string): void;
+export type { EnvGroup } from "./types.js";
+export declare const ENV_MANIFEST: readonly EnvGroup[];
+type EnvLookup = (name: string) => string | undefined;
+/** A platform group activates when all required vars (and one anyOf) are set. */
+export declare function platformIsActive(key: string, env?: EnvLookup): boolean;
+export declare function activePlatformKeys(env?: EnvLookup): string[];
+export declare function noPlatformsMessage(): string;
+/** The `--help` environment section, derived from the platform groups. */
+export declare function envSummaryLines(): string[];
+/** Every var an operator may set; `deployOnly` filters to template-listed ones. */
+export declare function manifestVarNames(options?: {
+    deployOnly?: boolean;
+}): string[];
+/** `mikan env` output: every group and var with set/unset status. No values. */
+export declare function envReport(env?: EnvLookup): string;
+/**
+ * Externally-visible base URL of the link/OAuth server, e.g.
+ * `https://mikan.example.com` (no trailing slash). Read from `LINK_URL` or
+ * `MIKAN_LINK_URL`, the same env var the bot uses to build credential onboarding links.
+ */
+export declare function resolveLinkBaseUrl(): string | undefined;
+//# sourceMappingURL=env-manifest.d.ts.map

package/dist/env-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-manifest.d.ts","sourceRoot":"","sources":["../src/env-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAMxD;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEhE;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAG/D;AAED,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,eAAO,MAAM,YAAY,EAAE,SAAS,QAAQ,EA6K3C,CAAC;AAEF,KAAK,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;AAEtD,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,SAAmB,GAAG,OAAO,CAO/E;AAED,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,SAAmB,GAAG,MAAM,EAAE,CAIrE;AASD,wBAAgB,kBAAkB,IAAI,MAAM,CAK3C;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,IAAI,MAAM,EAAE,CAI1C;AAED,mFAAmF;AACnF,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,EAAE,CAM7E;AAED,gFAAgF;AAChF,wBAAgB,SAAS,CAAC,GAAG,GAAE,SAAmB,GAAG,MAAM,CAuB1D;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAIvD"}

package/dist/env-manifest.js

@@ -0,0 +1,260 @@
+export function readEnv(name) {
+    const raw = process.env[name]?.trim();
+    if (raw)
+        return raw;
+    const prefixed = process.env[`MIKAN_${name}`]?.trim();
+    return prefixed || undefined;
+}
+/** Read a standards-owned environment variable without mikan aliasing. */
+export function readStandardEnv(name) {
+    return process.env[name]?.trim() || undefined;
+}
+export function setEnvAliases(name, value) {
+    process.env[name] = value;
+    process.env[`MIKAN_${name}`] = value;
+}
+export const ENV_MANIFEST = [
+    {
+        key: "slack",
+        title: "Slack",
+        kind: "platform",
+        vars: [
+            {
+                name: "SLACK_APP_TOKEN",
+                required: true,
+                secret: true,
+                doc: "Socket-mode app token (xapp-…)",
+            },
+            { name: "SLACK_BOT_TOKEN", required: true, secret: true, doc: "Bot token (xoxb-…)" },
+        ],
+    },
+    {
+        key: "telegram",
+        title: "Telegram",
+        kind: "platform",
+        vars: [{ name: "TELEGRAM_BOT_TOKEN", required: true, secret: true, doc: "BotFather token" }],
+    },
+    {
+        key: "discord",
+        title: "Discord",
+        kind: "platform",
+        vars: [{ name: "DISCORD_BOT_TOKEN", required: true, secret: true, doc: "Bot token" }],
+    },
+    {
+        key: "github",
+        title: "GitHub",
+        kind: "platform",
+        doc: "Issue/PR conversations via a GitHub App (polling; optional webhook poke)",
+        vars: [
+            { name: "GITHUB_APP_ID", required: true, doc: "GitHub App id" },
+            { name: "GITHUB_INSTALLATION_ID", required: true, doc: "App installation id" },
+            {
+                name: "GITHUB_APP_PRIVATE_KEY_PATH",
+                doc: "Path to the App private key .pem (preferred; keep outside any repo)",
+            },
+            {
+                name: "GITHUB_APP_PRIVATE_KEY",
+                secret: true,
+                deploy: false,
+                doc: "App private key PEM with literal \\n newlines (fallback)",
+            },
+            {
+                name: "GITHUB_REPOS",
+                doc: "Comma-separated owner/repo allowlist (default: all installed)",
+            },
+            { name: "GITHUB_POLL_INTERVAL", doc: "Poll interval in seconds (default 60)" },
+            {
+                name: "GITHUB_WEBHOOK_SECRET",
+                secret: true,
+                doc: "Webhook secret; when set, deliveries to /github/webhook trigger an immediate poll (needs LINK_PORT)",
+            },
+        ],
+        anyOf: ["GITHUB_APP_PRIVATE_KEY", "GITHUB_APP_PRIVATE_KEY_PATH"],
+    },
+    {
+        key: "llm",
+        title: "LLM providers",
+        kind: "feature",
+        vars: [
+            { name: "ANTHROPIC_API_KEY", secret: true, doc: "Anthropic API key" },
+            { name: "OPENAI_API_KEY", secret: true, doc: "OpenAI API key" },
+            {
+                name: "OPENROUTER_API_KEY",
+                secret: true,
+                doc: "OpenRouter API key (chat models routed through OpenRouter, and harness/jev.ts's Jev client via @geminixiang/jev)",
+            },
+        ],
+    },
+    {
+        key: "link",
+        title: "Link/OAuth server",
+        kind: "feature",
+        doc: "Credential onboarding links, session view, and the Admin portal",
+        vars: [
+            { name: "LINK_URL", doc: "Externally visible base URL, e.g. https://mikan.example.com" },
+            { name: "LINK_PORT", doc: "Listen port (default 8181 when LINK_URL is set)" },
+            { name: "GITHUB_OAUTH_CLIENT_ID", doc: "GitHub OAuth app for /login linking" },
+            { name: "GITHUB_OAUTH_CLIENT_SECRET", secret: true, doc: "GitHub OAuth app secret" },
+            { name: "GOOGLE_WORKSPACE_CLI_CLIENT_ID", doc: "Google Workspace OAuth client for /login" },
+            {
+                name: "GOOGLE_WORKSPACE_CLI_CLIENT_SECRET",
+                secret: true,
+                doc: "Google Workspace OAuth secret",
+            },
+            { name: "GOOGLE_CLOUD_SDK_CLIENT_ID", doc: "Google Cloud SDK OAuth client for /login" },
+            {
+                name: "GOOGLE_CLOUD_SDK_CLIENT_SECRET",
+                secret: true,
+                doc: "Google Cloud SDK OAuth secret",
+            },
+        ],
+    },
+    {
+        key: "openconnector",
+        title: "OpenConnector",
+        kind: "feature",
+        doc: "Default open-connector MCP server and the admin token that mints per-conversation runtime tokens",
+        vars: [
+            {
+                name: "OPENCONNECTOR_ENDPOINT",
+                doc: "Default MCP endpoint used when a conversation does not declare open-connector",
+            },
+            {
+                name: "OPENCONNECTOR_ADMIN_TOKEN",
+                secret: true,
+                doc: "Host-only admin token used to mint one runtime token per conversation for the default server",
+            },
+        ],
+    },
+    {
+        key: "cloudflare",
+        title: "Cloudflare sandbox",
+        kind: "feature",
+        doc: "For --sandbox=cloudflare:<id> via the bridge worker",
+        vars: [
+            { name: "CLOUDFLARE_SANDBOX_URL", doc: "Bridge worker URL" },
+            { name: "CLOUDFLARE_SANDBOX_TOKEN", secret: true, doc: "Bridge worker auth token" },
+        ],
+    },
+    {
+        key: "observability",
+        title: "Observability",
+        kind: "feature",
+        vars: [
+            { name: "SENTRY_DSN", secret: true, doc: "Sentry DSN (settings.json sentry.dsn wins)" },
+            {
+                name: "SENTRY_ENVIRONMENT",
+                deploy: false,
+                doc: "Sentry environment tag (default production)",
+            },
+            { name: "SENTRY_ENABLED", deploy: false, doc: "Set to false to disable Sentry errors" },
+            { name: "OTEL_SDK_DISABLED", doc: "Set to true to disable OpenTelemetry" },
+            { name: "OTEL_SERVICE_NAME", doc: "OTLP service name (default mikan)" },
+            {
+                name: "OTEL_RESOURCE_ATTRIBUTES",
+                secret: true,
+                doc: "Comma-separated safe resource attrs",
+            },
+            { name: "OTEL_TRACES_EXPORTER", doc: "Trace exporter: otlp or none" },
+            { name: "OTEL_METRICS_EXPORTER", doc: "Metrics exporter: otlp or none" },
+            { name: "OTEL_EXPORTER_OTLP_ENDPOINT", secret: true, doc: "Base OTLP HTTP endpoint" },
+            { name: "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT", secret: true, doc: "OTLP traces endpoint" },
+            { name: "OTEL_EXPORTER_OTLP_METRICS_ENDPOINT", secret: true, doc: "OTLP metrics endpoint" },
+            { name: "OTEL_EXPORTER_OTLP_HEADERS", secret: true, doc: "Shared OTLP auth headers" },
+            { name: "OTEL_EXPORTER_OTLP_TRACES_HEADERS", secret: true, doc: "OTLP trace headers" },
+            { name: "OTEL_EXPORTER_OTLP_METRICS_HEADERS", secret: true, doc: "OTLP metric headers" },
+            { name: "OTEL_EXPORTER_OTLP_PROTOCOL", doc: "OTLP protocol; http/protobuf supported" },
+            { name: "OTEL_EXPORTER_OTLP_TRACES_PROTOCOL", doc: "Trace protocol override" },
+            { name: "OTEL_EXPORTER_OTLP_METRICS_PROTOCOL", doc: "Metric protocol override" },
+            { name: "OTEL_EXPORTER_OTLP_TIMEOUT", doc: "Shared OTLP timeout in milliseconds" },
+            { name: "OTEL_EXPORTER_OTLP_TRACES_TIMEOUT", doc: "Trace timeout in milliseconds" },
+            { name: "OTEL_EXPORTER_OTLP_METRICS_TIMEOUT", doc: "Metric timeout in milliseconds" },
+            { name: "OTEL_METRIC_EXPORT_INTERVAL", doc: "Metric export interval in milliseconds" },
+            { name: "OTEL_METRIC_EXPORT_TIMEOUT", doc: "Metric export timeout in milliseconds" },
+        ],
+    },
+    {
+        key: "runtime",
+        title: "Runtime",
+        kind: "feature",
+        vars: [
+            { name: "STATE_DIR", deploy: false, doc: "State dir override (same as --state-dir)" },
+            {
+                name: "HTTP_IDLE_TIMEOUT",
+                deploy: false,
+                doc: "Idle timeout in ms for outbound HTTP streams",
+            },
+        ],
+    },
+];
+/** A platform group activates when all required vars (and one anyOf) are set. */
+export function platformIsActive(key, env = readEnv) {
+    const group = ENV_MANIFEST.find((candidate) => candidate.key === key);
+    if (!group)
+        throw new Error(`Unknown env-manifest group: ${key}`);
+    const required = group.vars.filter((spec) => spec.required);
+    if (!required.every((spec) => env(spec.name)))
+        return false;
+    if (group.anyOf && !group.anyOf.some((name) => env(name)))
+        return false;
+    return true;
+}
+export function activePlatformKeys(env = readEnv) {
+    return ENV_MANIFEST.filter((group) => group.kind === "platform" && platformIsActive(group.key, env)).map((group) => group.key);
+}
+/** One line per platform group: the vars an operator must set to activate it. */
+function platformRecipe(group) {
+    const required = group.vars.filter((spec) => spec.required).map((spec) => spec.name);
+    const alternative = group.anyOf ? ` + ${group.anyOf.join(" | ")}` : "";
+    return `${group.title}: ${required.join(" + ")}${alternative}`;
+}
+export function noPlatformsMessage() {
+    const recipes = ENV_MANIFEST.filter((group) => group.kind === "platform")
+        .map((group) => `  ${platformRecipe(group)}`)
+        .join("\n");
+    return `No platform tokens found. Set one of:\n${recipes}`;
+}
+/** The `--help` environment section, derived from the platform groups. */
+export function envSummaryLines() {
+    return ENV_MANIFEST.filter((group) => group.kind === "platform").map((group) => `  ${platformRecipe(group)}`);
+}
+/** Every var an operator may set; `deployOnly` filters to template-listed ones. */
+export function manifestVarNames(options) {
+    return ENV_MANIFEST.flatMap((group) => group.vars
+        .filter((spec) => !options?.deployOnly || spec.deploy !== false)
+        .map((spec) => spec.name));
+}
+/** `mikan env` output: every group and var with set/unset status. No values. */
+export function envReport(env = readEnv) {
+    const lines = [];
+    for (const group of ENV_MANIFEST) {
+        const active = group.kind === "platform"
+            ? platformIsActive(group.key, env)
+                ? " — active"
+                : " — inactive"
+            : "";
+        lines.push(`${group.title}${active}${group.doc ? ` · ${group.doc}` : ""}`);
+        for (const spec of group.vars) {
+            const status = env(spec.name) ? "set" : "unset";
+            const marks = [spec.required ? "required" : "", spec.secret ? "secret" : ""]
+                .filter(Boolean)
+                .join(", ");
+            lines.push(`  ${spec.name.padEnd(36)} ${status.padEnd(6)}${marks ? ` [${marks}]` : ""}  ${spec.doc}`);
+        }
+        lines.push("");
+    }
+    lines.push("Each var also accepts a MIKAN_-prefixed alias (e.g. MIKAN_LINK_URL).");
+    return lines.join("\n");
+}
+/**
+ * Externally-visible base URL of the link/OAuth server, e.g.
+ * `https://mikan.example.com` (no trailing slash). Read from `LINK_URL` or
+ * `MIKAN_LINK_URL`, the same env var the bot uses to build credential onboarding links.
+ */
+export function resolveLinkBaseUrl() {
+    const raw = readEnv("LINK_URL");
+    if (!raw)
+        return undefined;
+    return raw.replace(/\/+$/, "");
+}
+//# sourceMappingURL=env-manifest.js.map

package/dist/env-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-manifest.js","sourceRoot":"","sources":["../src/env-manifest.ts"],"names":[],"mappings":"AAaA,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC;IACtD,OAAO,QAAQ,IAAI,SAAS,CAAC;AAC/B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAa;IACvD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC1B,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC;AACvC,CAAC;AAID,MAAM,CAAC,MAAM,YAAY,GAAwB;IAC/C;QACE,GAAG,EAAE,OAAO;QACZ,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,gCAAgC;aACtC;YACD,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,EAAE;SACrF;KACF;IACD;QACE,GAAG,EAAE,UAAU;QACf,KAAK,EAAE,UAAU;QACjB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,iBAAiB,EAAE,CAAC;KAC7F;IACD;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;KACtF;IACD;QACE,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,QAAQ;QACf,IAAI,EAAE,UAAU;QAChB,GAAG,EAAE,0EAA0E;QAC/E,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,eAAe,EAAE;YAC/D,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE;YAC9E;gBACE,IAAI,EAAE,6BAA6B;gBACnC,GAAG,EAAE,qEAAqE;aAC3E;YACD;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,0DAA0D;aAChE;YACD;gBACE,IAAI,EAAE,cAAc;gBACpB,GAAG,EAAE,+DAA+D;aACrE;YACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,uCAAuC,EAAE;YAC9E;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,qGAAqG;aAC3G;SACF;QACD,KAAK,EAAE,CAAC,wBAAwB,EAAE,6BAA6B,CAAC;KACjE;IACD;QACE,GAAG,EAAE,KAAK;QACV,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,mBAAmB,EAAE;YACrE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,EAAE;YAC/D;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,kHAAkH;aACxH;SACF;KACF;IACD;QACE,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,mBAAmB;QAC1B,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,iEAAiE;QACtE,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,6DAA6D,EAAE;YACxF,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,iDAAiD,EAAE;YAC7E,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,qCAAqC,EAAE;YAC9E,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,yBAAyB,EAAE;YACpF,EAAE,IAAI,EAAE,gCAAgC,EAAE,GAAG,EAAE,0CAA0C,EAAE;YAC3F;gBACE,IAAI,EAAE,oCAAoC;gBAC1C,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,+BAA+B;aACrC;YACD,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,0CAA0C,EAAE;YACvF;gBACE,IAAI,EAAE,gCAAgC;gBACtC,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,+BAA+B;aACrC;SACF;KACF;IACD;QACE,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,kGAAkG;QACvG,IAAI,EAAE;YACJ;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,GAAG,EAAE,+EAA+E;aACrF;YACD;gBACE,IAAI,EAAE,2BAA2B;gBACjC,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,8FAA8F;aACpG;SACF;KACF;IACD;QACE,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,oBAAoB;QAC3B,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,qDAAqD;QAC1D,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,wBAAwB,EAAE,GAAG,EAAE,mBAAmB,EAAE;YAC5D,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,0BAA0B,EAAE;SACpF;KACF;IACD;QACE,GAAG,EAAE,eAAe;QACpB,KAAK,EAAE,eAAe;QACtB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,4CAA4C,EAAE;YACvF;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,6CAA6C;aACnD;YACD,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,uCAAuC,EAAE;YACvF,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,sCAAsC,EAAE;YAC1E,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,mCAAmC,EAAE;YACvE;gBACE,IAAI,EAAE,0BAA0B;gBAChC,MAAM,EAAE,IAAI;gBACZ,GAAG,EAAE,qCAAqC;aAC3C;YACD,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,EAAE,8BAA8B,EAAE;YACrE,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,gCAAgC,EAAE;YACxE,EAAE,IAAI,EAAE,6BAA6B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,yBAAyB,EAAE;YACrF,EAAE,IAAI,EAAE,oCAAoC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,sBAAsB,EAAE;YACzF,EAAE,IAAI,EAAE,qCAAqC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,uBAAuB,EAAE;YAC3F,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,0BAA0B,EAAE;YACrF,EAAE,IAAI,EAAE,mCAAmC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,oBAAoB,EAAE;YACtF,EAAE,IAAI,EAAE,oCAAoC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,qBAAqB,EAAE;YACxF,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,wCAAwC,EAAE;YACtF,EAAE,IAAI,EAAE,oCAAoC,EAAE,GAAG,EAAE,yBAAyB,EAAE;YAC9E,EAAE,IAAI,EAAE,qCAAqC,EAAE,GAAG,EAAE,0BAA0B,EAAE;YAChF,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,qCAAqC,EAAE;YAClF,EAAE,IAAI,EAAE,mCAAmC,EAAE,GAAG,EAAE,+BAA+B,EAAE;YACnF,EAAE,IAAI,EAAE,oCAAoC,EAAE,GAAG,EAAE,gCAAgC,EAAE;YACrF,EAAE,IAAI,EAAE,6BAA6B,EAAE,GAAG,EAAE,wCAAwC,EAAE;YACtF,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,EAAE,uCAAuC,EAAE;SACrF;KACF;IACD;QACE,GAAG,EAAE,SAAS;QACd,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,SAAS;QACf,IAAI,EAAE;YACJ,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,0CAA0C,EAAE;YACrF;gBACE,IAAI,EAAE,mBAAmB;gBACzB,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,8CAA8C;aACpD;SACF;KACF;CACF,CAAC;AAIF,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAG,GAAc,OAAO;IACpE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IACtE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5D,IAAI,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAG,GAAc,OAAO;IACzD,OAAO,YAAY,CAAC,MAAM,CACxB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CACzE,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,KAAe;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,WAAW,EAAE,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;SACtE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,0CAA0C,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,GAAG,CAClE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,cAAc,CAAC,KAAK,CAAC,EAAE,CACxC,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,gBAAgB,CAAC,OAAkC;IACjE,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACpC,KAAK,CAAC,IAAI;SACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC;SAC/D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,SAAS,CAAC,GAAG,GAAc,OAAO;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,MAAM,GACV,KAAK,CAAC,IAAI,KAAK,UAAU;YACvB,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC;gBAChC,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,aAAa;YACjB,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC;YAChD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;iBACzE,MAAM,CAAC,OAAO,CAAC;iBACf,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,KAAK,CAAC,IAAI,CACR,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,CAC1F,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,sEAAsE,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC","sourcesContent":["/**\n * The daemon's environment interface, declared as data — the one inventory\n * that startup validation, `mikan env`, `--help`, and the pm2 deploy\n * template check all derive from. Add a var here and every derived surface\n * picks it up; a var read anywhere else but not listed here is a bug.\n *\n * Names are the un-prefixed spelling; `readEnv` accepts a `MIKAN_`-prefixed\n * alias for each. Not covered: dynamic OAuth service keys from\n * OAUTH_SERVICES_JSON (data-driven by design) and standard proxy vars\n * (HTTPS_PROXY/HTTP_PROXY/NO_PROXY).\n */\nimport type { EnvGroup } from \"./types.js\";\n\nexport function readEnv(name: string): string | undefined {\n  const raw = process.env[name]?.trim();\n  if (raw) return raw;\n\n  const prefixed = process.env[`MIKAN_${name}`]?.trim();\n  return prefixed || undefined;\n}\n\n/** Read a standards-owned environment variable without mikan aliasing. */\nexport function readStandardEnv(name: string): string | undefined {\n  return process.env[name]?.trim() || undefined;\n}\n\nexport function setEnvAliases(name: string, value: string): void {\n  process.env[name] = value;\n  process.env[`MIKAN_${name}`] = value;\n}\n\nexport type { EnvGroup } from \"./types.js\";\n\nexport const ENV_MANIFEST: readonly EnvGroup[] = [\n  {\n    key: \"slack\",\n    title: \"Slack\",\n    kind: \"platform\",\n    vars: [\n      {\n        name: \"SLACK_APP_TOKEN\",\n        required: true,\n        secret: true,\n        doc: \"Socket-mode app token (xapp-…)\",\n      },\n      { name: \"SLACK_BOT_TOKEN\", required: true, secret: true, doc: \"Bot token (xoxb-…)\" },\n    ],\n  },\n  {\n    key: \"telegram\",\n    title: \"Telegram\",\n    kind: \"platform\",\n    vars: [{ name: \"TELEGRAM_BOT_TOKEN\", required: true, secret: true, doc: \"BotFather token\" }],\n  },\n  {\n    key: \"discord\",\n    title: \"Discord\",\n    kind: \"platform\",\n    vars: [{ name: \"DISCORD_BOT_TOKEN\", required: true, secret: true, doc: \"Bot token\" }],\n  },\n  {\n    key: \"github\",\n    title: \"GitHub\",\n    kind: \"platform\",\n    doc: \"Issue/PR conversations via a GitHub App (polling; optional webhook poke)\",\n    vars: [\n      { name: \"GITHUB_APP_ID\", required: true, doc: \"GitHub App id\" },\n      { name: \"GITHUB_INSTALLATION_ID\", required: true, doc: \"App installation id\" },\n      {\n        name: \"GITHUB_APP_PRIVATE_KEY_PATH\",\n        doc: \"Path to the App private key .pem (preferred; keep outside any repo)\",\n      },\n      {\n        name: \"GITHUB_APP_PRIVATE_KEY\",\n        secret: true,\n        deploy: false,\n        doc: \"App private key PEM with literal \\\\n newlines (fallback)\",\n      },\n      {\n        name: \"GITHUB_REPOS\",\n        doc: \"Comma-separated owner/repo allowlist (default: all installed)\",\n      },\n      { name: \"GITHUB_POLL_INTERVAL\", doc: \"Poll interval in seconds (default 60)\" },\n      {\n        name: \"GITHUB_WEBHOOK_SECRET\",\n        secret: true,\n        doc: \"Webhook secret; when set, deliveries to /github/webhook trigger an immediate poll (needs LINK_PORT)\",\n      },\n    ],\n    anyOf: [\"GITHUB_APP_PRIVATE_KEY\", \"GITHUB_APP_PRIVATE_KEY_PATH\"],\n  },\n  {\n    key: \"llm\",\n    title: \"LLM providers\",\n    kind: \"feature\",\n    vars: [\n      { name: \"ANTHROPIC_API_KEY\", secret: true, doc: \"Anthropic API key\" },\n      { name: \"OPENAI_API_KEY\", secret: true, doc: \"OpenAI API key\" },\n      {\n        name: \"OPENROUTER_API_KEY\",\n        secret: true,\n        doc: \"OpenRouter API key (chat models routed through OpenRouter, and harness/jev.ts's Jev client via @geminixiang/jev)\",\n      },\n    ],\n  },\n  {\n    key: \"link\",\n    title: \"Link/OAuth server\",\n    kind: \"feature\",\n    doc: \"Credential onboarding links, session view, and the Admin portal\",\n    vars: [\n      { name: \"LINK_URL\", doc: \"Externally visible base URL, e.g. https://mikan.example.com\" },\n      { name: \"LINK_PORT\", doc: \"Listen port (default 8181 when LINK_URL is set)\" },\n      { name: \"GITHUB_OAUTH_CLIENT_ID\", doc: \"GitHub OAuth app for /login linking\" },\n      { name: \"GITHUB_OAUTH_CLIENT_SECRET\", secret: true, doc: \"GitHub OAuth app secret\" },\n      { name: \"GOOGLE_WORKSPACE_CLI_CLIENT_ID\", doc: \"Google Workspace OAuth client for /login\" },\n      {\n        name: \"GOOGLE_WORKSPACE_CLI_CLIENT_SECRET\",\n        secret: true,\n        doc: \"Google Workspace OAuth secret\",\n      },\n      { name: \"GOOGLE_CLOUD_SDK_CLIENT_ID\", doc: \"Google Cloud SDK OAuth client for /login\" },\n      {\n        name: \"GOOGLE_CLOUD_SDK_CLIENT_SECRET\",\n        secret: true,\n        doc: \"Google Cloud SDK OAuth secret\",\n      },\n    ],\n  },\n  {\n    key: \"openconnector\",\n    title: \"OpenConnector\",\n    kind: \"feature\",\n    doc: \"Default open-connector MCP server and the admin token that mints per-conversation runtime tokens\",\n    vars: [\n      {\n        name: \"OPENCONNECTOR_ENDPOINT\",\n        doc: \"Default MCP endpoint used when a conversation does not declare open-connector\",\n      },\n      {\n        name: \"OPENCONNECTOR_ADMIN_TOKEN\",\n        secret: true,\n        doc: \"Host-only admin token used to mint one runtime token per conversation for the default server\",\n      },\n    ],\n  },\n  {\n    key: \"cloudflare\",\n    title: \"Cloudflare sandbox\",\n    kind: \"feature\",\n    doc: \"For --sandbox=cloudflare:<id> via the bridge worker\",\n    vars: [\n      { name: \"CLOUDFLARE_SANDBOX_URL\", doc: \"Bridge worker URL\" },\n      { name: \"CLOUDFLARE_SANDBOX_TOKEN\", secret: true, doc: \"Bridge worker auth token\" },\n    ],\n  },\n  {\n    key: \"observability\",\n    title: \"Observability\",\n    kind: \"feature\",\n    vars: [\n      { name: \"SENTRY_DSN\", secret: true, doc: \"Sentry DSN (settings.json sentry.dsn wins)\" },\n      {\n        name: \"SENTRY_ENVIRONMENT\",\n        deploy: false,\n        doc: \"Sentry environment tag (default production)\",\n      },\n      { name: \"SENTRY_ENABLED\", deploy: false, doc: \"Set to false to disable Sentry errors\" },\n      { name: \"OTEL_SDK_DISABLED\", doc: \"Set to true to disable OpenTelemetry\" },\n      { name: \"OTEL_SERVICE_NAME\", doc: \"OTLP service name (default mikan)\" },\n      {\n        name: \"OTEL_RESOURCE_ATTRIBUTES\",\n        secret: true,\n        doc: \"Comma-separated safe resource attrs\",\n      },\n      { name: \"OTEL_TRACES_EXPORTER\", doc: \"Trace exporter: otlp or none\" },\n      { name: \"OTEL_METRICS_EXPORTER\", doc: \"Metrics exporter: otlp or none\" },\n      { name: \"OTEL_EXPORTER_OTLP_ENDPOINT\", secret: true, doc: \"Base OTLP HTTP endpoint\" },\n      { name: \"OTEL_EXPORTER_OTLP_TRACES_ENDPOINT\", secret: true, doc: \"OTLP traces endpoint\" },\n      { name: \"OTEL_EXPORTER_OTLP_METRICS_ENDPOINT\", secret: true, doc: \"OTLP metrics endpoint\" },\n      { name: \"OTEL_EXPORTER_OTLP_HEADERS\", secret: true, doc: \"Shared OTLP auth headers\" },\n      { name: \"OTEL_EXPORTER_OTLP_TRACES_HEADERS\", secret: true, doc: \"OTLP trace headers\" },\n      { name: \"OTEL_EXPORTER_OTLP_METRICS_HEADERS\", secret: true, doc: \"OTLP metric headers\" },\n      { name: \"OTEL_EXPORTER_OTLP_PROTOCOL\", doc: \"OTLP protocol; http/protobuf supported\" },\n      { name: \"OTEL_EXPORTER_OTLP_TRACES_PROTOCOL\", doc: \"Trace protocol override\" },\n      { name: \"OTEL_EXPORTER_OTLP_METRICS_PROTOCOL\", doc: \"Metric protocol override\" },\n      { name: \"OTEL_EXPORTER_OTLP_TIMEOUT\", doc: \"Shared OTLP timeout in milliseconds\" },\n      { name: \"OTEL_EXPORTER_OTLP_TRACES_TIMEOUT\", doc: \"Trace timeout in milliseconds\" },\n      { name: \"OTEL_EXPORTER_OTLP_METRICS_TIMEOUT\", doc: \"Metric timeout in milliseconds\" },\n      { name: \"OTEL_METRIC_EXPORT_INTERVAL\", doc: \"Metric export interval in milliseconds\" },\n      { name: \"OTEL_METRIC_EXPORT_TIMEOUT\", doc: \"Metric export timeout in milliseconds\" },\n    ],\n  },\n  {\n    key: \"runtime\",\n    title: \"Runtime\",\n    kind: \"feature\",\n    vars: [\n      { name: \"STATE_DIR\", deploy: false, doc: \"State dir override (same as --state-dir)\" },\n      {\n        name: \"HTTP_IDLE_TIMEOUT\",\n        deploy: false,\n        doc: \"Idle timeout in ms for outbound HTTP streams\",\n      },\n    ],\n  },\n];\n\ntype EnvLookup = (name: string) => string | undefined;\n\n/** A platform group activates when all required vars (and one anyOf) are set. */\nexport function platformIsActive(key: string, env: EnvLookup = readEnv): boolean {\n  const group = ENV_MANIFEST.find((candidate) => candidate.key === key);\n  if (!group) throw new Error(`Unknown env-manifest group: ${key}`);\n  const required = group.vars.filter((spec) => spec.required);\n  if (!required.every((spec) => env(spec.name))) return false;\n  if (group.anyOf && !group.anyOf.some((name) => env(name))) return false;\n  return true;\n}\n\nexport function activePlatformKeys(env: EnvLookup = readEnv): string[] {\n  return ENV_MANIFEST.filter(\n    (group) => group.kind === \"platform\" && platformIsActive(group.key, env),\n  ).map((group) => group.key);\n}\n\n/** One line per platform group: the vars an operator must set to activate it. */\nfunction platformRecipe(group: EnvGroup): string {\n  const required = group.vars.filter((spec) => spec.required).map((spec) => spec.name);\n  const alternative = group.anyOf ? ` + ${group.anyOf.join(\" | \")}` : \"\";\n  return `${group.title}: ${required.join(\" + \")}${alternative}`;\n}\n\nexport function noPlatformsMessage(): string {\n  const recipes = ENV_MANIFEST.filter((group) => group.kind === \"platform\")\n    .map((group) => `  ${platformRecipe(group)}`)\n    .join(\"\\n\");\n  return `No platform tokens found. Set one of:\\n${recipes}`;\n}\n\n/** The `--help` environment section, derived from the platform groups. */\nexport function envSummaryLines(): string[] {\n  return ENV_MANIFEST.filter((group) => group.kind === \"platform\").map(\n    (group) => `  ${platformRecipe(group)}`,\n  );\n}\n\n/** Every var an operator may set; `deployOnly` filters to template-listed ones. */\nexport function manifestVarNames(options?: { deployOnly?: boolean }): string[] {\n  return ENV_MANIFEST.flatMap((group) =>\n    group.vars\n      .filter((spec) => !options?.deployOnly || spec.deploy !== false)\n      .map((spec) => spec.name),\n  );\n}\n\n/** `mikan env` output: every group and var with set/unset status. No values. */\nexport function envReport(env: EnvLookup = readEnv): string {\n  const lines: string[] = [];\n  for (const group of ENV_MANIFEST) {\n    const active =\n      group.kind === \"platform\"\n        ? platformIsActive(group.key, env)\n          ? \" — active\"\n          : \" — inactive\"\n        : \"\";\n    lines.push(`${group.title}${active}${group.doc ? ` · ${group.doc}` : \"\"}`);\n    for (const spec of group.vars) {\n      const status = env(spec.name) ? \"set\" : \"unset\";\n      const marks = [spec.required ? \"required\" : \"\", spec.secret ? \"secret\" : \"\"]\n        .filter(Boolean)\n        .join(\", \");\n      lines.push(\n        `  ${spec.name.padEnd(36)} ${status.padEnd(6)}${marks ? ` [${marks}]` : \"\"}  ${spec.doc}`,\n      );\n    }\n    lines.push(\"\");\n  }\n  lines.push(\"Each var also accepts a MIKAN_-prefixed alias (e.g. MIKAN_LINK_URL).\");\n  return lines.join(\"\\n\");\n}\n\n/**\n * Externally-visible base URL of the link/OAuth server, e.g.\n * `https://mikan.example.com` (no trailing slash). Read from `LINK_URL` or\n * `MIKAN_LINK_URL`, the same env var the bot uses to build credential onboarding links.\n */\nexport function resolveLinkBaseUrl(): string | undefined {\n  const raw = readEnv(\"LINK_URL\");\n  if (!raw) return undefined;\n  return raw.replace(/\\/+$/, \"\");\n}\n"]}

package/dist/events/index.d.ts

@@ -0,0 +1,172 @@
+import type { OfficeAddress, OfficeKey } from "../types.js";
+export type EventPayload = EventFilePayload;
+export interface EventRecord {
+    filename: string;
+    payload: EventFilePayload;
+    size: number;
+    mtimeMs: number;
+}
+/**
+ * One office's admitted scheduled work. Every method is confined to that
+ * office: filenames of other offices read as "not found", and payloads must
+ * address the store's own office.
+ */
+export interface EventStore {
+    readonly address: OfficeAddress;
+    /** Create a new record; an existing filename is an error, never overwritten. */
+    create(filename: string, payload: EventFilePayload): Promise<{
+        path: string;
+        size: number;
+    }>;
+    /**
+     * List this office's records. Entries whose JSON cannot be parsed or fail
+     * format validation are kept with a `null` payload so operators can still
+     * surface and delete them; files that disappear mid-listing are skipped.
+     */
+    list(): Promise<Array<Omit<EventRecord, "payload"> & {
+        payload: EventFilePayload | null;
+    }>>;
+    read(filename: string): Promise<EventRecord>;
+    update(filename: string, payload: EventFilePayload): Promise<{
+        path: string;
+        size: number;
+    }>;
+    delete(filename: string): Promise<{
+        deleted: boolean;
+    }>;
+}
+/** Scheduler hooks the store calls after each admitted mutation. */
+export interface EventScheduleSink {
+    scheduleRecord(address: OfficeAddress, record: EventRecord): void;
+    cancelRecord(address: OfficeAddress, filename: string): void;
+}
+export type EventConversationKind = "direct" | "shared";
+export type EventType = "immediate" | "one-shot" | "periodic";
+interface EventPayloadBase {
+    /** Target platform; may be omitted when only one platform is running. */
+    platform?: string;
+    conversationId: string;
+    conversationKind?: EventConversationKind;
+    userId?: string;
+    /** Self-contained task text; event runs do not inherit conversation history. */
+    text: string;
+}
+export interface ImmediateEventPayload extends EventPayloadBase {
+    type: "immediate";
+}
+export interface OneShotEventPayload extends EventPayloadBase {
+    type: "one-shot";
+    /** ISO 8601 timestamp with offset. */
+    at: string;
+}
+export interface PeriodicEventPayload extends EventPayloadBase {
+    type: "periodic";
+    /** Cron expression (croner syntax). */
+    schedule: string;
+    /** IANA timezone, e.g. "Asia/Taipei". */
+    timezone: string;
+}
+/** Wire shape of one event file. */
+export type EventFilePayload = ImmediateEventPayload | OneShotEventPayload | PeriodicEventPayload;
+export interface EventPayloadInput {
+    type: EventType;
+    platform?: string;
+    conversationId: string;
+    conversationKind?: EventConversationKind;
+    userId?: string;
+    text: string;
+    at?: string;
+    schedule?: string;
+    timezone?: string;
+}
+interface ResolvedEventFields {
+    platform: string;
+    conversationKind: EventConversationKind;
+}
+export type MikanEvent = (ImmediateEventPayload & ResolvedEventFields) | (OneShotEventPayload & ResolvedEventFields) | (PeriodicEventPayload & ResolvedEventFields);
+export interface PeriodicEventInfo {
+    filename: string;
+    platform: string;
+    conversationId: string;
+    conversationKind: EventConversationKind;
+    text: string;
+    schedule: string;
+    timezone: string;
+    nextRun: string | null;
+}
+/**
+ * Single home for the scheduled-event file format (`events/*.json`, the
+ * workspace scheduling bus). Every reader and writer — the EventsWatcher
+ * scheduler and the agent `event` tool — must go
+ * through this module: one schema, one payload union, one parser, one
+ * builder. Per-type field rules (`at` for one-shot, `schedule` + `timezone`
+ * for periodic) live here and nowhere else.
+ */
+/** Typebox union for the `type` field, shared by the file schema and the event tool's parameters. */
+export declare const EventTypeSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"immediate">, import("@sinclair/typebox").TLiteral<"one-shot">, import("@sinclair/typebox").TLiteral<"periodic">]>;
+/** True for a complete ISO 8601 timestamp that carries an explicit UTC offset. */
+/**
+ * Validate an untrusted event filename: a bare `*.json` basename with no
+ * path traversal. Every surface that touches the events bus by filename
+ * (the event tool's store, the admin portal's file endpoints) validates
+ * through this single rule.
+ */
+export declare function validateEventFilename(filename: string): string;
+/**
+ * Parse and validate one event file's content into the canonical payload.
+ * `filename` appears in error messages. Throws on malformed JSON, wrong
+ * field types, and missing required fields (common and per-type).
+ */
+export declare function parseEventPayload(content: string, filename: string): EventFilePayload;
+/**
+ * Validate and assemble a new event payload for writing. Owns the per-type
+ * field rules; write-side *policy* beyond the format (e.g. the event tool's
+ * requirement that `at` lies in the future) stays with the writer.
+ */
+export declare function buildEventPayload(input: EventPayloadInput): EventFilePayload;
+import type { Office, Workspace } from "../office/index.js";
+/** Host-only per-office events directory: `<office state dir>/events`. */
+export declare function officeEventsDir(office: Office): string;
+export declare class OfficeEventStore implements EventStore {
+    private readonly office;
+    private readonly scheduler?;
+    readonly address: OfficeAddress;
+    private readonly eventsDir;
+    constructor(office: Office, scheduler?: EventScheduleSink | undefined);
+    create(filename: string, payload: EventPayload): Promise<{
+        path: string;
+        size: number;
+    }>;
+    list(): Promise<Array<Omit<EventRecord, "payload"> & {
+        payload: EventPayload | null;
+    }>>;
+    read(filename: string): Promise<EventRecord>;
+    update(filename: string, payload: EventPayload): Promise<{
+        path: string;
+        size: number;
+    }>;
+    delete(filename: string): Promise<{
+        deleted: boolean;
+    }>;
+    private assertOwnPayload;
+    private writeRecord;
+}
+export interface LegacyEventMigrationReport {
+    migrated: {
+        filename: string;
+        key: OfficeKey;
+    }[];
+    skipped: {
+        filename: string;
+        reason: string;
+    }[];
+}
+/**
+ * One-time move of legacy `<workspace>/events/*.json` records into the owning
+ * office's host-only state. Only records with an explicit platform matching a
+ * registered office move; everything else stays for an operator to inspect.
+ * Run with the daemon stopped.
+ */
+export declare function migrateLegacyWorkspaceEvents(workspace: Workspace): LegacyEventMigrationReport;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/events/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/events/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE5D,MAAM,MAAM,YAAY,GAAG,gBAAgB,CAAC;AAE5C,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,gFAAgF;IAChF,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7F;;;;OAIG;IACH,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG;QAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7F,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACzD;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;IAClE,YAAY,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9D;AAED,MAAM,MAAM,qBAAqB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,UAAU,GAAG,UAAU,CAAC;AAE9D,UAAU,gBAAgB;IACxB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,IAAI,EAAE,WAAW,CAAC;CACnB;AAED,MAAM,WAAW,mBAAoB,SAAQ,gBAAgB;IAC3D,IAAI,EAAE,UAAU,CAAC;IACjB,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,IAAI,EAAE,UAAU,CAAC;IACjB,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,oCAAoC;AACpC,MAAM,MAAM,gBAAgB,GAAG,qBAAqB,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;AAElG,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAID,UAAU,mBAAmB;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,qBAAqB,CAAC;CACzC;AAED,MAAM,MAAM,UAAU,GAClB,CAAC,qBAAqB,GAAG,mBAAmB,CAAC,GAC7C,CAAC,mBAAmB,GAAG,mBAAmB,CAAC,GAC3C,CAAC,oBAAoB,GAAG,mBAAmB,CAAC,CAAC;AAEjD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAKD;;;;;;;GAOG;AAEH,qGAAqG;AACrG,eAAO,MAAM,eAAe,6LAI1B,CAAC;AAiCH,kFAAkF;AAClF;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAY9D;AAkCD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAoDrF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,iBAAiB,GAAG,gBAAgB,CAgC5E;AAMD,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAG5D,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,qBAAa,gBAAiB,YAAW,UAAU;IAK/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAL7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;IAChC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YACmB,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,iBAAiB,YAAA,EAI/C;IAEK,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAQ7F;IAEK,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,GAAG;QAAE,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC,CA2B5F;IAEK,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAajD;IAEK,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAO7F;IAEK,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAU5D;IAED,OAAO,CAAC,gBAAgB;YASV,WAAW;CAgB1B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,SAAS,CAAA;KAAE,EAAE,CAAC;IACjD,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjD;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,SAAS,GAAG,0BAA0B,CAwD7F"}