@geminixiang/mikan 1.0.0-beta.76 → 1.0.0-beta.78

package/dist/adapters/web/admin/types.d.ts

@@ -22,7 +22,6 @@ export interface AdminServices {
     adminTokenStore: InMemoryAdminTokenStore;
     portalBaseUrl?: string;
     workspace?: Workspace;
-    /** Office-confined event store factory; Admin never reads event files directly. */
     eventStore?: (office: Office) => EventStore;
     sandbox?: SandboxConfig;
     runtime?: AdminRuntimeBridge;
@@ -33,7 +32,6 @@ export interface EventSummary {
     size: number;
     mtimeMs: number;
     type: string | null;
-    /** Owning office, from the store — authoritative even when the payload is unparseable. */
     officePlatform: string;
     officeConversationId: string;
     platform: string | null;
@@ -47,7 +45,6 @@ export interface AdminToken extends TokenRecord {
     platform: PlatformName;
     platformUserId: string;
     platformUserName?: string;
-    /** The conversation where /admin was invoked. Default scope for the 3 sub-pages. */
     conversationId: string;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/adapters/web/admin/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/web/admin/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChG,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,IAAI,cAAc,EAAE,CAAC;IACvC,uBAAuB,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1F,8BAA8B,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;IAChE,uBAAuB,IAAI;QAAE,IAAI,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;CACtD;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD,eAAe,EAAE,uBAAuB,CAAC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,mFAAmF;IACnF,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;IAC5C,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,0FAA0F;IAC1F,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oFAAoF;IACpF,cAAc,EAAE,MAAM,CAAC;CACxB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/adapters/web/admin/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChG,OAAO,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,IAAI,cAAc,EAAE,CAAC;IACvC,uBAAuB,CAAC,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC1F,8BAA8B,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC;IAChE,uBAAuB,IAAI;QAAE,IAAI,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;CACtD;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,kBAAkB,CAAC;IACnC,qBAAqB,CAAC,EAAE,6BAA6B,CAAC;IACtD,eAAe,EAAE,uBAAuB,CAAC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,UAAU,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,UAAU,CAAC;IAC5C,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,cAAc,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,UAAW,SAAQ,WAAW;IAC7C,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;CACxB"}

package/dist/adapters/web/admin/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/adapters/web/admin/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { MessagingBot, OfficeAddress, PlatformName, RunningSession } from \"../../index.js\";\nimport type { Office, Workspace } from \"../../../office/index.js\";\nimport type { LinkTokenStoreLike } from \"../../commands/types.js\";\nimport type { SandboxConfig } from \"../../../sandbox/index.js\";\nimport type { EventStore } from \"../../../events/index.js\";\nimport type { VaultManager } from \"../../../vault/index.js\";\nimport type { InMemorySessionViewTokenStore } from \"../session-view/portal.js\";\nimport type { TokenRecord } from \"../types.js\";\nimport type { InMemoryAdminTokenStore } from \"./portal.js\";\n\nexport interface AdminRuntimeBridge {\n  getRunningSessions(): RunningSession[];\n  switchConversationModel(address: OfficeAddress, provider: string, model: string): boolean;\n  refreshConversationEnvironment(address: OfficeAddress): boolean;\n  refreshAllConversations(): { busy: OfficeAddress[] };\n}\n\nexport interface AdminServices {\n  vaultManager: VaultManager;\n  linkTokenStore: LinkTokenStoreLike;\n  sessionViewTokenStore?: InMemorySessionViewTokenStore;\n  adminTokenStore: InMemoryAdminTokenStore;\n  portalBaseUrl?: string;\n  workspace?: Workspace;\n  /** Office-confined event store factory; Admin never reads event files directly. */\n  eventStore?: (office: Office) => EventStore;\n  sandbox?: SandboxConfig;\n  runtime?: AdminRuntimeBridge;\n  botsByPlatform?: Partial<Record<PlatformName, MessagingBot>>;\n}\n\nexport interface EventSummary {\n  name: string;\n  size: number;\n  mtimeMs: number;\n  type: string | null;\n  /** Owning office, from the store — authoritative even when the payload is unparseable. */\n  officePlatform: string;\n  officeConversationId: string;\n  platform: string | null;\n  conversationId: string | null;\n  text: string | null;\n  at: string | null;\n  schedule: string | null;\n  timezone: string | null;\n}\n\nexport interface AdminToken extends TokenRecord {\n  platform: PlatformName;\n  platformUserId: string;\n  platformUserName?: string;\n  /** The conversation where /admin was invoked. Default scope for the 3 sub-pages. */\n  conversationId: string;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/adapters/web/admin/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { MessagingBot, OfficeAddress, PlatformName, RunningSession } from \"../../index.js\";\nimport type { Office, Workspace } from \"../../../office/index.js\";\nimport type { LinkTokenStoreLike } from \"../../commands/types.js\";\nimport type { SandboxConfig } from \"../../../sandbox/index.js\";\nimport type { EventStore } from \"../../../events/index.js\";\nimport type { VaultManager } from \"../../../vault/index.js\";\nimport type { InMemorySessionViewTokenStore } from \"../session-view/portal.js\";\nimport type { TokenRecord } from \"../types.js\";\nimport type { InMemoryAdminTokenStore } from \"./portal.js\";\n\nexport interface AdminRuntimeBridge {\n  getRunningSessions(): RunningSession[];\n  switchConversationModel(address: OfficeAddress, provider: string, model: string): boolean;\n  refreshConversationEnvironment(address: OfficeAddress): boolean;\n  refreshAllConversations(): { busy: OfficeAddress[] };\n}\n\nexport interface AdminServices {\n  vaultManager: VaultManager;\n  linkTokenStore: LinkTokenStoreLike;\n  sessionViewTokenStore?: InMemorySessionViewTokenStore;\n  adminTokenStore: InMemoryAdminTokenStore;\n  portalBaseUrl?: string;\n  workspace?: Workspace;\n  eventStore?: (office: Office) => EventStore;\n  sandbox?: SandboxConfig;\n  runtime?: AdminRuntimeBridge;\n  botsByPlatform?: Partial<Record<PlatformName, MessagingBot>>;\n}\n\nexport interface EventSummary {\n  name: string;\n  size: number;\n  mtimeMs: number;\n  type: string | null;\n  officePlatform: string;\n  officeConversationId: string;\n  platform: string | null;\n  conversationId: string | null;\n  text: string | null;\n  at: string | null;\n  schedule: string | null;\n  timezone: string | null;\n}\n\nexport interface AdminToken extends TokenRecord {\n  platform: PlatformName;\n  platformUserId: string;\n  platformUserName?: string;\n  conversationId: string;\n}\n"]}

package/dist/adapters/web/login/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../src/adapters/web/login/oauth.ts"],"names":[],"mappings":"AAIA,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAyO/C,wBAAgB,gBAAgB,IAAI,YAAY,EAAE,CA4BjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAM3E"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../src/adapters/web/login/oauth.ts"],"names":[],"mappings":"AAKA,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAoO/C,wBAAgB,gBAAgB,IAAI,YAAY,EAAE,CA4BjD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAM3E"}

package/dist/adapters/web/login/oauth.js

@@ -1,6 +1,7 @@
 import { readEnv } from "../../../env-manifest.js";
 import { isRecord, parseJsonValue } from "../../../file-guards.js";
 import * as log from "../../../log.js";
+import { guestHomePath } from "../../../sandbox/layout.js";
 const DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES = [
     "https://www.googleapis.com/auth/drive",
     "https://mail.google.com/",
@@ -14,11 +15,6 @@ const DEFAULT_GOOGLE_CLOUD_SDK_SCOPES = [
     "https://www.googleapis.com/auth/userinfo.email",
     "https://www.googleapis.com/auth/cloud-platform",
 ];
-// Conservative default: enough for `gh` CLI repo/user/org operations, but
-// without `workflow` (can dispatch CI), `write:packages` (can publish
-// packages), or `project`. Operators who need those can opt in via
-// GITHUB_OAUTH_SCOPES (or MIKAN_GITHUB_OAUTH_SCOPES) to keep the blast radius
-// of a compromised agent host explicit and configurable.
 const DEFAULT_GITHUB_OAUTH_SCOPES = ["repo", "read:user", "user:email", "read:org", "gist"];
 function resolveScopesFromEnv(envKey, fallback) {
     const raw = readEnv(envKey);
@@ -58,7 +54,7 @@ function getBuiltinOAuthServices() {
             fileOutput: {
                 type: "authorized_user",
                 relativePath: "gws.json",
-                targetPath: "/root/.config/gws/credentials.json",
+                targetPath: guestHomePath(".config/gws/credentials.json"),
             },
         },
         {
@@ -78,7 +74,7 @@ function getBuiltinOAuthServices() {
             fileOutput: {
                 type: "authorized_user",
                 relativePath: "gcloud-adc.json",
-                targetPath: "/root/.config/gcloud/application_default_credentials.json",
+                targetPath: guestHomePath(".config/gcloud/application_default_credentials.json"),
                 envKey: "GOOGLE_APPLICATION_CREDENTIALS",
                 additionalEnvKeys: ["CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE"],
             },

package/dist/adapters/web/login/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../../src/adapters/web/login/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,KAAK,GAAG,MAAM,iBAAiB,CAAC;AAKvC,MAAM,mCAAmC,GAAG;IAC1C,uCAAuC;IACvC,0BAA0B;IAC1B,0CAA0C;IAC1C,8CAA8C;IAC9C,2CAA2C;IAC3C,sDAAsD;CACvD,CAAC;AAEF,MAAM,+BAA+B,GAAG;IACtC,QAAQ;IACR,gDAAgD;IAChD,gDAAgD;CACjD,CAAC;AAEF,0EAA0E;AAC1E,sEAAsE;AACtE,mEAAmE;AACnE,8EAA8E;AAC9E,yDAAyD;AACzD,MAAM,2BAA2B,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAE5F,SAAS,oBAAoB,CAAC,MAAc,EAAE,QAAkB;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAE1B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;QACL;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC;YAC/C,gBAAgB,EAAE,0CAA0C;YAC5D,QAAQ,EAAE,6CAA6C;YACvD,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,EAAE,2BAA2B,CAAC;YAChF,cAAc,EAAE,wBAAwB;YACxC,kBAAkB,EAAE,4BAA4B;YAChD,kBAAkB,EAAE,CAAC,2BAA2B,EAAE,UAAU,CAAC;YAC7D,kBAAkB,EAAE,4BAA4B;SACjD;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,CAAC,sBAAsB,EAAE,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,CAAC;YACnF,gBAAgB,EAAE,8CAA8C;YAChE,QAAQ,EAAE,qCAAqC;YAC/C,MAAM,EAAE,oBAAoB,CAC1B,mCAAmC,EACnC,mCAAmC,CACpC;YACD,cAAc,EAAE,gCAAgC;YAChD,kBAAkB,EAAE,oCAAoC;YACxD,mBAAmB,EAAE;gBACnB,WAAW,EAAE,SAAS;gBACtB,sBAAsB,EAAE,MAAM;gBAC9B,MAAM,EAAE,SAAS;aAClB;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,YAAY,EAAE,UAAU;gBACxB,UAAU,EAAE,oCAAoC;aACjD;SACF;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,2BAA2B;YAClC,OAAO,EAAE,CAAC,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,CAAC;YAClF,gBAAgB,EAAE,8CAA8C;YAChE,QAAQ,EAAE,qCAAqC;YAC/C,MAAM,EAAE,oBAAoB,CAC1B,+BAA+B,EAC/B,+BAA+B,CAChC;YACD,cAAc,EAAE,4BAA4B;YAC5C,kBAAkB,EAAE,gCAAgC;YACpD,mBAAmB,EAAE;gBACnB,WAAW,EAAE,SAAS;gBACtB,sBAAsB,EAAE,MAAM;gBAC9B,MAAM,EAAE,SAAS;aAClB;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,YAAY,EAAE,iBAAiB;gBAC/B,UAAU,EAAE,2DAA2D;gBACvE,MAAM,EAAE,gCAAgC;gBACxC,iBAAiB,EAAE,CAAC,wCAAwC,CAAC;aAC9D;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAA8B,EAC9B,KAAa,EACb,EAAU;IAEV,MAAM,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,KAAK,IAAI,CAAC,8BAA8B,EAAE,oBAAoB,CAAU,EAAE,CAAC;QACpF,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CACtB,KAAc,EACd,KAAa,EACb,EAAU;IAEV,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,iBAAiB,GAAG,gBAAgB,CACxC,KAAK,CAAC,iBAAiB,EACvB,8BAA8B,EAC9B,KAAK,EACL,EAAE,CACH,CAAC;IACF,IAAI,iBAAiB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvD,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,iBAAiB,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACvF,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,YAAY;QACZ,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QAC3C,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;QACnC,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,UAAU,CAAC,gCAAgC,KAAK,uBAAuB,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,gBAAgB,GAAG,aAAa,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACjE,MAAM,kBAAkB,GAAG,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG;QACd,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACtC,CAAC,UAAU,EAAE,QAAQ,CAAC;QACtB,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAClC,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;KAC3C;SACE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,UAAU,CACZ,gCAAgC,KAAK,IAAI,WAAW,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,mBAAmB,GAAG,iBAAiB,CAC3C,KAAK,CAAC,mBAAmB,EACzB,qBAAqB,EACrB,KAAK,EACL,EAAE,CACH,CAAC;IACF,IAAI,mBAAmB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,kBAAkB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAErC,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE;QACpB,KAAK;QACL,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QACnE,gBAAgB;QAChB,QAAQ;QACR,MAAM,EAAE,MAAM,IAAI,EAAE;QACpB,cAAc;QACd,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB,EAAE,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAC3D,mBAAmB,EAAE,mBAAmB,IAAI,SAAS;QACrD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,KAAa,EACb,KAAa,EACb,EAAU;IAEV,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,UAAU,CAAC,gCAAgC,KAAK,MAAM,EAAE,MAAM,KAAK,kBAAkB,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,KAAa,EACb,KAAa,EACb,EAAU;IAEV,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,UAAU,CAAC,gCAAgC,KAAK,MAAM,EAAE,MAAM,KAAK,kBAAkB,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAA+B,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAE1B,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CACrD,MAAM,KAAK,uBAAuB;YAChC,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,MAAM,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,GAAG,CAAC,UAAU,CACZ,MAAM,KAAK,oDAAoD;YAC7D,CAAC,CAAC,kFAAkF;YACpF,CAAC,CAAC,4CAA4C,EAChD,MAAM,CACP,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM;SAClB,GAAG,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;SACpE,MAAM,CAAC,CAAC,OAAO,EAA2B,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,gBAAgB,EAAE,CAAC,IAAI,CAC5B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC/E,CAAC;AACJ,CAAC","sourcesContent":["import { readEnv } from \"../../../env-manifest.js\";\nimport { isRecord, parseJsonValue } from \"../../../file-guards.js\";\nimport * as log from \"../../../log.js\";\n\nexport type { LoginCredentialKind, OAuthService } from \"./types.js\";\nimport type { OAuthService } from \"./types.js\";\n\nconst DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES = [\n  \"https://www.googleapis.com/auth/drive\",\n  \"https://mail.google.com/\",\n  \"https://www.googleapis.com/auth/calendar\",\n  \"https://www.googleapis.com/auth/spreadsheets\",\n  \"https://www.googleapis.com/auth/documents\",\n  \"https://www.googleapis.com/auth/chat.messages.create\",\n];\n\nconst DEFAULT_GOOGLE_CLOUD_SDK_SCOPES = [\n  \"openid\",\n  \"https://www.googleapis.com/auth/userinfo.email\",\n  \"https://www.googleapis.com/auth/cloud-platform\",\n];\n\n// Conservative default: enough for `gh` CLI repo/user/org operations, but\n// without `workflow` (can dispatch CI), `write:packages` (can publish\n// packages), or `project`. Operators who need those can opt in via\n// GITHUB_OAUTH_SCOPES (or MIKAN_GITHUB_OAUTH_SCOPES) to keep the blast radius\n// of a compromised agent host explicit and configurable.\nconst DEFAULT_GITHUB_OAUTH_SCOPES = [\"repo\", \"read:user\", \"user:email\", \"read:org\", \"gist\"];\n\nfunction resolveScopesFromEnv(envKey: string, fallback: string[]): string[] {\n  const raw = readEnv(envKey);\n  if (!raw) return fallback;\n\n  const scopes = raw.split(/[\\s,]+/).filter(Boolean);\n\n  return scopes.length > 0 ? scopes : fallback;\n}\n\nfunction getBuiltinOAuthServices(): OAuthService[] {\n  return [\n    {\n      id: \"github\",\n      label: \"GitHub\",\n      aliases: [\"github\", \"github_oauth\", \"gh_oauth\"],\n      authorizationUrl: \"https://github.com/login/oauth/authorize\",\n      tokenUrl: \"https://github.com/login/oauth/access_token\",\n      scopes: resolveScopesFromEnv(\"GITHUB_OAUTH_SCOPES\", DEFAULT_GITHUB_OAUTH_SCOPES),\n      clientIdEnvKey: \"GITHUB_OAUTH_CLIENT_ID\",\n      clientSecretEnvKey: \"GITHUB_OAUTH_CLIENT_SECRET\",\n      accessTokenEnvKeys: [\"GITHUB_OAUTH_ACCESS_TOKEN\", \"GH_TOKEN\"],\n      refreshTokenEnvKey: \"GITHUB_OAUTH_REFRESH_TOKEN\",\n    },\n    {\n      id: \"google_workspace_cli\",\n      label: \"Google Workspace CLI\",\n      aliases: [\"google_workspace_cli\", \"gws\", \"googleworkspace\", \"google-workspace-cli\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveScopesFromEnv(\n        \"GOOGLE_WORKSPACE_CLI_OAUTH_SCOPES\",\n        DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES,\n      ),\n      clientIdEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gws.json\",\n        targetPath: \"/root/.config/gws/credentials.json\",\n      },\n    },\n    {\n      id: \"google_cloud_sdk\",\n      label: \"Google Cloud SDK (gcloud)\",\n      aliases: [\"google_cloud_sdk\", \"gcloud\", \"google-cloud-sdk\", \"google_cloud\", \"gcp\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveScopesFromEnv(\n        \"GOOGLE_CLOUD_SDK_OAUTH_SCOPES\",\n        DEFAULT_GOOGLE_CLOUD_SDK_SCOPES,\n      ),\n      clientIdEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gcloud-adc.json\",\n        targetPath: \"/root/.config/gcloud/application_default_credentials.json\",\n        envKey: \"GOOGLE_APPLICATION_CREDENTIALS\",\n        additionalEnvKeys: [\"CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE\"],\n      },\n    },\n  ];\n}\n\nfunction trimmedString(value: unknown): string | undefined {\n  return typeof value === \"string\" ? value.trim() : undefined;\n}\n\nfunction parseAccessTokenEnvKeys(\n  value: Record<string, unknown>,\n  index: number,\n  id: string,\n): string[] | undefined | null {\n  const keys = [trimmedString(value.accessTokenEnvKey)];\n  for (const field of [\"additionalAccessTokenEnvKeys\", \"accessTokenEnvKeys\"] as const) {\n    const parsed = parseStringArray(value[field], field, index, id);\n    if (parsed === null) return null;\n    keys.push(...(parsed ?? []).map((key) => key.trim()));\n  }\n  const unique = [...new Set(keys.filter((key): key is string => !!key))];\n  return unique.length > 0 ? unique : undefined;\n}\n\nfunction parseFileOutput(\n  value: unknown,\n  index: number,\n  id: string,\n): OAuthService[\"fileOutput\"] | null {\n  if (!isRecord(value)) return undefined;\n  const additionalEnvKeys = parseStringArray(\n    value.additionalEnvKeys,\n    \"fileOutput.additionalEnvKeys\",\n    index,\n    id,\n  );\n  if (additionalEnvKeys === null) return null;\n  const relativePath = trimmedString(value.relativePath);\n  if (trimmedString(value.type) !== \"authorized_user\" || !relativePath) return undefined;\n  return {\n    type: \"authorized_user\",\n    relativePath,\n    targetPath: trimmedString(value.targetPath),\n    envKey: trimmedString(value.envKey),\n    additionalEnvKeys,\n  };\n}\n\nfunction parseOAuthService(value: unknown, index: number): OAuthService | null {\n  if (!isRecord(value)) {\n    log.logWarning(`Skipping OAUTH_SERVICES_JSON[${index}]: expected an object`);\n    return null;\n  }\n\n  const id = trimmedString(value.id) ?? \"\";\n  const label = trimmedString(value.label) ?? \"\";\n  const authorizationUrl = trimmedString(value.authorizationUrl) ?? \"\";\n  const tokenUrl = trimmedString(value.tokenUrl) ?? \"\";\n  const clientIdEnvKey = trimmedString(value.clientIdEnvKey) ?? \"\";\n  const clientSecretEnvKey = trimmedString(value.clientSecretEnvKey) ?? \"\";\n  const missing = [\n    [\"id\", id],\n    [\"label\", label],\n    [\"authorizationUrl\", authorizationUrl],\n    [\"tokenUrl\", tokenUrl],\n    [\"clientIdEnvKey\", clientIdEnvKey],\n    [\"clientSecretEnvKey\", clientSecretEnvKey],\n  ]\n    .filter((entry) => !entry[1])\n    .map((entry) => entry[0]);\n\n  if (missing.length > 0) {\n    const labelForLog = id ? ` (${id})` : \"\";\n    log.logWarning(\n      `Skipping OAUTH_SERVICES_JSON[${index}]${labelForLog}: missing ${missing.join(\", \")}`,\n    );\n    return null;\n  }\n\n  const aliases = parseStringArray(value.aliases, \"aliases\", index, id);\n  if (aliases === null) return null;\n  const scopes = parseStringArray(value.scopes, \"scopes\", index, id);\n  if (scopes === null) return null;\n  const authorizationParams = parseStringRecord(\n    value.authorizationParams,\n    \"authorizationParams\",\n    index,\n    id,\n  );\n  if (authorizationParams === null) return null;\n\n  const accessTokenEnvKeys = parseAccessTokenEnvKeys(value, index, id);\n  if (accessTokenEnvKeys === null) return null;\n  const fileOutput = parseFileOutput(value.fileOutput, index, id);\n  if (fileOutput === null) return null;\n\n  return {\n    id: id.toLowerCase(),\n    label,\n    aliases: aliases?.map((v) => v.toLowerCase()) ?? [id.toLowerCase()],\n    authorizationUrl,\n    tokenUrl,\n    scopes: scopes ?? [],\n    clientIdEnvKey,\n    clientSecretEnvKey,\n    accessTokenEnvKeys,\n    refreshTokenEnvKey: trimmedString(value.refreshTokenEnvKey),\n    authorizationParams: authorizationParams ?? undefined,\n    fileOutput,\n  };\n}\n\nfunction parseStringArray(\n  value: unknown,\n  field: string,\n  index: number,\n  id: string,\n): string[] | undefined | null {\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value) || value.some((entry) => typeof entry !== \"string\")) {\n    log.logWarning(`Skipping OAUTH_SERVICES_JSON[${index}] (${id}): ${field} must be strings`);\n    return null;\n  }\n  return value;\n}\n\nfunction parseStringRecord(\n  value: unknown,\n  field: string,\n  index: number,\n  id: string,\n): Record<string, string> | undefined | null {\n  if (value === undefined) return undefined;\n  if (!isRecord(value) || Object.values(value).some((entry) => typeof entry !== \"string\")) {\n    log.logWarning(`Skipping OAUTH_SERVICES_JSON[${index}] (${id}): ${field} must be strings`);\n    return null;\n  }\n  return value as Record<string, string>;\n}\n\nexport function getOAuthServices(): OAuthService[] {\n  const raw = readEnv(\"OAUTH_SERVICES_JSON\");\n  const builtins = getBuiltinOAuthServices();\n  if (!raw) return builtins;\n\n  let parsed: unknown[];\n  try {\n    parsed = parseJsonValue(raw, Array.isArray, (detail) =>\n      detail === \"unexpected JSON shape\"\n        ? \"expected a JSON array of OAuth service definitions\"\n        : detail,\n    );\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    log.logWarning(\n      detail === \"expected a JSON array of OAuth service definitions\"\n        ? \"Ignoring OAUTH_SERVICES_JSON: expected a JSON array of OAuth service definitions\"\n        : \"Ignoring OAUTH_SERVICES_JSON: invalid JSON\",\n      detail,\n    );\n    return builtins;\n  }\n\n  const custom = parsed\n    .map((serviceValue, index) => parseOAuthService(serviceValue, index))\n    .filter((service): service is OAuthService => service !== null);\n  const byId = new Map([...builtins, ...custom].map((service) => [service.id, service]));\n  return [...byId.values()];\n}\n\nexport function resolveOAuthService(input: string): OAuthService | undefined {\n  const normalized = input.trim().toLowerCase();\n  if (!normalized) return undefined;\n  return getOAuthServices().find(\n    (service) => service.id === normalized || service.aliases.includes(normalized),\n  );\n}\n"]}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../../src/adapters/web/login/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,KAAK,GAAG,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAK3D,MAAM,mCAAmC,GAAG;IAC1C,uCAAuC;IACvC,0BAA0B;IAC1B,0CAA0C;IAC1C,8CAA8C;IAC9C,2CAA2C;IAC3C,sDAAsD;CACvD,CAAC;AAEF,MAAM,+BAA+B,GAAG;IACtC,QAAQ;IACR,gDAAgD;IAChD,gDAAgD;CACjD,CAAC;AAEF,MAAM,2BAA2B,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;AAE5F,SAAS,oBAAoB,CAAC,MAAc,EAAE,QAAkB;IAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAE1B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED,SAAS,uBAAuB;IAC9B,OAAO;QACL;YACE,EAAE,EAAE,QAAQ;YACZ,KAAK,EAAE,QAAQ;YACf,OAAO,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC;YAC/C,gBAAgB,EAAE,0CAA0C;YAC5D,QAAQ,EAAE,6CAA6C;YACvD,MAAM,EAAE,oBAAoB,CAAC,qBAAqB,EAAE,2BAA2B,CAAC;YAChF,cAAc,EAAE,wBAAwB;YACxC,kBAAkB,EAAE,4BAA4B;YAChD,kBAAkB,EAAE,CAAC,2BAA2B,EAAE,UAAU,CAAC;YAC7D,kBAAkB,EAAE,4BAA4B;SACjD;QACD;YACE,EAAE,EAAE,sBAAsB;YAC1B,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,CAAC,sBAAsB,EAAE,KAAK,EAAE,iBAAiB,EAAE,sBAAsB,CAAC;YACnF,gBAAgB,EAAE,8CAA8C;YAChE,QAAQ,EAAE,qCAAqC;YAC/C,MAAM,EAAE,oBAAoB,CAC1B,mCAAmC,EACnC,mCAAmC,CACpC;YACD,cAAc,EAAE,gCAAgC;YAChD,kBAAkB,EAAE,oCAAoC;YACxD,mBAAmB,EAAE;gBACnB,WAAW,EAAE,SAAS;gBACtB,sBAAsB,EAAE,MAAM;gBAC9B,MAAM,EAAE,SAAS;aAClB;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,YAAY,EAAE,UAAU;gBACxB,UAAU,EAAE,aAAa,CAAC,8BAA8B,CAAC;aAC1D;SACF;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,KAAK,EAAE,2BAA2B;YAClC,OAAO,EAAE,CAAC,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,KAAK,CAAC;YAClF,gBAAgB,EAAE,8CAA8C;YAChE,QAAQ,EAAE,qCAAqC;YAC/C,MAAM,EAAE,oBAAoB,CAC1B,+BAA+B,EAC/B,+BAA+B,CAChC;YACD,cAAc,EAAE,4BAA4B;YAC5C,kBAAkB,EAAE,gCAAgC;YACpD,mBAAmB,EAAE;gBACnB,WAAW,EAAE,SAAS;gBACtB,sBAAsB,EAAE,MAAM;gBAC9B,MAAM,EAAE,SAAS;aAClB;YACD,UAAU,EAAE;gBACV,IAAI,EAAE,iBAAiB;gBACvB,YAAY,EAAE,iBAAiB;gBAC/B,UAAU,EAAE,aAAa,CAAC,qDAAqD,CAAC;gBAChF,MAAM,EAAE,gCAAgC;gBACxC,iBAAiB,EAAE,CAAC,wCAAwC,CAAC;aAC9D;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAA8B,EAC9B,KAAa,EACb,EAAU;IAEV,MAAM,IAAI,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,KAAK,IAAI,CAAC,8BAA8B,EAAE,oBAAoB,CAAU,EAAE,CAAC;QACpF,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAiB,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CACtB,KAAc,EACd,KAAa,EACb,EAAU;IAEV,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvC,MAAM,iBAAiB,GAAG,gBAAgB,CACxC,KAAK,CAAC,iBAAiB,EACvB,8BAA8B,EAC9B,KAAK,EACL,EAAE,CACH,CAAC;IACF,IAAI,iBAAiB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACvD,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,iBAAiB,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACvF,OAAO;QACL,IAAI,EAAE,iBAAiB;QACvB,YAAY;QACZ,UAAU,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QAC3C,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC;QACnC,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,KAAa;IACtD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,UAAU,CAAC,gCAAgC,KAAK,uBAAuB,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,gBAAgB,GAAG,aAAa,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACjE,MAAM,kBAAkB,GAAG,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG;QACd,CAAC,IAAI,EAAE,EAAE,CAAC;QACV,CAAC,OAAO,EAAE,KAAK,CAAC;QAChB,CAAC,kBAAkB,EAAE,gBAAgB,CAAC;QACtC,CAAC,UAAU,EAAE,QAAQ,CAAC;QACtB,CAAC,gBAAgB,EAAE,cAAc,CAAC;QAClC,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;KAC3C;SACE,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAC5B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,UAAU,CACZ,gCAAgC,KAAK,IAAI,WAAW,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,mBAAmB,GAAG,iBAAiB,CAC3C,KAAK,CAAC,mBAAmB,EACzB,qBAAqB,EACrB,KAAK,EACL,EAAE,CACH,CAAC;IACF,IAAI,mBAAmB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,kBAAkB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7C,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAErC,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,WAAW,EAAE;QACpB,KAAK;QACL,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC;QACnE,gBAAgB;QAChB,QAAQ;QACR,MAAM,EAAE,MAAM,IAAI,EAAE;QACpB,cAAc;QACd,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB,EAAE,aAAa,CAAC,KAAK,CAAC,kBAAkB,CAAC;QAC3D,mBAAmB,EAAE,mBAAmB,IAAI,SAAS;QACrD,UAAU;KACX,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAc,EACd,KAAa,EACb,KAAa,EACb,EAAU;IAEV,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,UAAU,CAAC,gCAAgC,KAAK,MAAM,EAAE,MAAM,KAAK,kBAAkB,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,KAAa,EACb,KAAa,EACb,EAAU;IAEV,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;QACxF,GAAG,CAAC,UAAU,CAAC,gCAAgC,KAAK,MAAM,EAAE,MAAM,KAAK,kBAAkB,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAA+B,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAE1B,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CACrD,MAAM,KAAK,uBAAuB;YAChC,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,MAAM,CACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,GAAG,CAAC,UAAU,CACZ,MAAM,KAAK,oDAAoD;YAC7D,CAAC,CAAC,kFAAkF;YACpF,CAAC,CAAC,4CAA4C,EAChD,MAAM,CACP,CAAC;QACF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM;SAClB,GAAG,CAAC,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;SACpE,MAAM,CAAC,CAAC,OAAO,EAA2B,EAAE,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAClC,OAAO,gBAAgB,EAAE,CAAC,IAAI,CAC5B,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,UAAU,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC/E,CAAC;AACJ,CAAC","sourcesContent":["import { readEnv } from \"../../../env-manifest.js\";\nimport { isRecord, parseJsonValue } from \"../../../file-guards.js\";\nimport * as log from \"../../../log.js\";\nimport { guestHomePath } from \"../../../sandbox/layout.js\";\n\nexport type { LoginCredentialKind, OAuthService } from \"./types.js\";\nimport type { OAuthService } from \"./types.js\";\n\nconst DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES = [\n  \"https://www.googleapis.com/auth/drive\",\n  \"https://mail.google.com/\",\n  \"https://www.googleapis.com/auth/calendar\",\n  \"https://www.googleapis.com/auth/spreadsheets\",\n  \"https://www.googleapis.com/auth/documents\",\n  \"https://www.googleapis.com/auth/chat.messages.create\",\n];\n\nconst DEFAULT_GOOGLE_CLOUD_SDK_SCOPES = [\n  \"openid\",\n  \"https://www.googleapis.com/auth/userinfo.email\",\n  \"https://www.googleapis.com/auth/cloud-platform\",\n];\n\nconst DEFAULT_GITHUB_OAUTH_SCOPES = [\"repo\", \"read:user\", \"user:email\", \"read:org\", \"gist\"];\n\nfunction resolveScopesFromEnv(envKey: string, fallback: string[]): string[] {\n  const raw = readEnv(envKey);\n  if (!raw) return fallback;\n\n  const scopes = raw.split(/[\\s,]+/).filter(Boolean);\n\n  return scopes.length > 0 ? scopes : fallback;\n}\n\nfunction getBuiltinOAuthServices(): OAuthService[] {\n  return [\n    {\n      id: \"github\",\n      label: \"GitHub\",\n      aliases: [\"github\", \"github_oauth\", \"gh_oauth\"],\n      authorizationUrl: \"https://github.com/login/oauth/authorize\",\n      tokenUrl: \"https://github.com/login/oauth/access_token\",\n      scopes: resolveScopesFromEnv(\"GITHUB_OAUTH_SCOPES\", DEFAULT_GITHUB_OAUTH_SCOPES),\n      clientIdEnvKey: \"GITHUB_OAUTH_CLIENT_ID\",\n      clientSecretEnvKey: \"GITHUB_OAUTH_CLIENT_SECRET\",\n      accessTokenEnvKeys: [\"GITHUB_OAUTH_ACCESS_TOKEN\", \"GH_TOKEN\"],\n      refreshTokenEnvKey: \"GITHUB_OAUTH_REFRESH_TOKEN\",\n    },\n    {\n      id: \"google_workspace_cli\",\n      label: \"Google Workspace CLI\",\n      aliases: [\"google_workspace_cli\", \"gws\", \"googleworkspace\", \"google-workspace-cli\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveScopesFromEnv(\n        \"GOOGLE_WORKSPACE_CLI_OAUTH_SCOPES\",\n        DEFAULT_GOOGLE_WORKSPACE_CLI_SCOPES,\n      ),\n      clientIdEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_WORKSPACE_CLI_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gws.json\",\n        targetPath: guestHomePath(\".config/gws/credentials.json\"),\n      },\n    },\n    {\n      id: \"google_cloud_sdk\",\n      label: \"Google Cloud SDK (gcloud)\",\n      aliases: [\"google_cloud_sdk\", \"gcloud\", \"google-cloud-sdk\", \"google_cloud\", \"gcp\"],\n      authorizationUrl: \"https://accounts.google.com/o/oauth2/v2/auth\",\n      tokenUrl: \"https://oauth2.googleapis.com/token\",\n      scopes: resolveScopesFromEnv(\n        \"GOOGLE_CLOUD_SDK_OAUTH_SCOPES\",\n        DEFAULT_GOOGLE_CLOUD_SDK_SCOPES,\n      ),\n      clientIdEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_ID\",\n      clientSecretEnvKey: \"GOOGLE_CLOUD_SDK_CLIENT_SECRET\",\n      authorizationParams: {\n        access_type: \"offline\",\n        include_granted_scopes: \"true\",\n        prompt: \"consent\",\n      },\n      fileOutput: {\n        type: \"authorized_user\",\n        relativePath: \"gcloud-adc.json\",\n        targetPath: guestHomePath(\".config/gcloud/application_default_credentials.json\"),\n        envKey: \"GOOGLE_APPLICATION_CREDENTIALS\",\n        additionalEnvKeys: [\"CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE\"],\n      },\n    },\n  ];\n}\n\nfunction trimmedString(value: unknown): string | undefined {\n  return typeof value === \"string\" ? value.trim() : undefined;\n}\n\nfunction parseAccessTokenEnvKeys(\n  value: Record<string, unknown>,\n  index: number,\n  id: string,\n): string[] | undefined | null {\n  const keys = [trimmedString(value.accessTokenEnvKey)];\n  for (const field of [\"additionalAccessTokenEnvKeys\", \"accessTokenEnvKeys\"] as const) {\n    const parsed = parseStringArray(value[field], field, index, id);\n    if (parsed === null) return null;\n    keys.push(...(parsed ?? []).map((key) => key.trim()));\n  }\n  const unique = [...new Set(keys.filter((key): key is string => !!key))];\n  return unique.length > 0 ? unique : undefined;\n}\n\nfunction parseFileOutput(\n  value: unknown,\n  index: number,\n  id: string,\n): OAuthService[\"fileOutput\"] | null {\n  if (!isRecord(value)) return undefined;\n  const additionalEnvKeys = parseStringArray(\n    value.additionalEnvKeys,\n    \"fileOutput.additionalEnvKeys\",\n    index,\n    id,\n  );\n  if (additionalEnvKeys === null) return null;\n  const relativePath = trimmedString(value.relativePath);\n  if (trimmedString(value.type) !== \"authorized_user\" || !relativePath) return undefined;\n  return {\n    type: \"authorized_user\",\n    relativePath,\n    targetPath: trimmedString(value.targetPath),\n    envKey: trimmedString(value.envKey),\n    additionalEnvKeys,\n  };\n}\n\nfunction parseOAuthService(value: unknown, index: number): OAuthService | null {\n  if (!isRecord(value)) {\n    log.logWarning(`Skipping OAUTH_SERVICES_JSON[${index}]: expected an object`);\n    return null;\n  }\n\n  const id = trimmedString(value.id) ?? \"\";\n  const label = trimmedString(value.label) ?? \"\";\n  const authorizationUrl = trimmedString(value.authorizationUrl) ?? \"\";\n  const tokenUrl = trimmedString(value.tokenUrl) ?? \"\";\n  const clientIdEnvKey = trimmedString(value.clientIdEnvKey) ?? \"\";\n  const clientSecretEnvKey = trimmedString(value.clientSecretEnvKey) ?? \"\";\n  const missing = [\n    [\"id\", id],\n    [\"label\", label],\n    [\"authorizationUrl\", authorizationUrl],\n    [\"tokenUrl\", tokenUrl],\n    [\"clientIdEnvKey\", clientIdEnvKey],\n    [\"clientSecretEnvKey\", clientSecretEnvKey],\n  ]\n    .filter((entry) => !entry[1])\n    .map((entry) => entry[0]);\n\n  if (missing.length > 0) {\n    const labelForLog = id ? ` (${id})` : \"\";\n    log.logWarning(\n      `Skipping OAUTH_SERVICES_JSON[${index}]${labelForLog}: missing ${missing.join(\", \")}`,\n    );\n    return null;\n  }\n\n  const aliases = parseStringArray(value.aliases, \"aliases\", index, id);\n  if (aliases === null) return null;\n  const scopes = parseStringArray(value.scopes, \"scopes\", index, id);\n  if (scopes === null) return null;\n  const authorizationParams = parseStringRecord(\n    value.authorizationParams,\n    \"authorizationParams\",\n    index,\n    id,\n  );\n  if (authorizationParams === null) return null;\n\n  const accessTokenEnvKeys = parseAccessTokenEnvKeys(value, index, id);\n  if (accessTokenEnvKeys === null) return null;\n  const fileOutput = parseFileOutput(value.fileOutput, index, id);\n  if (fileOutput === null) return null;\n\n  return {\n    id: id.toLowerCase(),\n    label,\n    aliases: aliases?.map((v) => v.toLowerCase()) ?? [id.toLowerCase()],\n    authorizationUrl,\n    tokenUrl,\n    scopes: scopes ?? [],\n    clientIdEnvKey,\n    clientSecretEnvKey,\n    accessTokenEnvKeys,\n    refreshTokenEnvKey: trimmedString(value.refreshTokenEnvKey),\n    authorizationParams: authorizationParams ?? undefined,\n    fileOutput,\n  };\n}\n\nfunction parseStringArray(\n  value: unknown,\n  field: string,\n  index: number,\n  id: string,\n): string[] | undefined | null {\n  if (value === undefined) return undefined;\n  if (!Array.isArray(value) || value.some((entry) => typeof entry !== \"string\")) {\n    log.logWarning(`Skipping OAUTH_SERVICES_JSON[${index}] (${id}): ${field} must be strings`);\n    return null;\n  }\n  return value;\n}\n\nfunction parseStringRecord(\n  value: unknown,\n  field: string,\n  index: number,\n  id: string,\n): Record<string, string> | undefined | null {\n  if (value === undefined) return undefined;\n  if (!isRecord(value) || Object.values(value).some((entry) => typeof entry !== \"string\")) {\n    log.logWarning(`Skipping OAUTH_SERVICES_JSON[${index}] (${id}): ${field} must be strings`);\n    return null;\n  }\n  return value as Record<string, string>;\n}\n\nexport function getOAuthServices(): OAuthService[] {\n  const raw = readEnv(\"OAUTH_SERVICES_JSON\");\n  const builtins = getBuiltinOAuthServices();\n  if (!raw) return builtins;\n\n  let parsed: unknown[];\n  try {\n    parsed = parseJsonValue(raw, Array.isArray, (detail) =>\n      detail === \"unexpected JSON shape\"\n        ? \"expected a JSON array of OAuth service definitions\"\n        : detail,\n    );\n  } catch (err) {\n    const detail = err instanceof Error ? err.message : String(err);\n    log.logWarning(\n      detail === \"expected a JSON array of OAuth service definitions\"\n        ? \"Ignoring OAUTH_SERVICES_JSON: expected a JSON array of OAuth service definitions\"\n        : \"Ignoring OAUTH_SERVICES_JSON: invalid JSON\",\n      detail,\n    );\n    return builtins;\n  }\n\n  const custom = parsed\n    .map((serviceValue, index) => parseOAuthService(serviceValue, index))\n    .filter((service): service is OAuthService => service !== null);\n  const byId = new Map([...builtins, ...custom].map((service) => [service.id, service]));\n  return [...byId.values()];\n}\n\nexport function resolveOAuthService(input: string): OAuthService | undefined {\n  const normalized = input.trim().toLowerCase();\n  if (!normalized) return undefined;\n  return getOAuthServices().find(\n    (service) => service.id === normalized || service.aliases.includes(normalized),\n  );\n}\n"]}

package/dist/adapters/web/login/portal.d.ts

@@ -9,15 +9,5 @@ export declare class InMemoryLinkTokenStore extends InMemoryTokenStore<LinkToken
     create(platform: PlatformName, platformUserId: string, conversationId: string, vaultId: string, providerId: string): LinkToken;
 }
 import type { NotifyFn } from "./types.js";
-/**
- * Start a small HTTP server that receives credential onboarding callbacks from the web portal.
- *
- * Routes:
- *   GET  /health              — health check
- *   GET  /link?token=xxx      — credential onboarding page
- *   POST /api/link/complete   — API key completion endpoint
- *   POST /api/oauth/start     — creates provider OAuth redirect URL
- *   GET  /oauth/callback      — OAuth callback endpoint
- */
 export declare function createLoginRequestHandler(linkTokenStore: InMemoryLinkTokenStore, vaultManager: VaultManager, notify: NotifyFn): (req: IncomingMessage, res: ServerResponse, url: URL) => boolean;
 //# sourceMappingURL=portal.d.ts.map

package/dist/adapters/web/login/portal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../../src/adapters/web/login/portal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAU5C,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAIpF,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,qBAAa,sBAAuB,SAAQ,kBAAkB,CAAC,SAAS,CAAC;IACvE,MAAM,CACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,SAAS,CAWX;CACF;AACD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAyN3C;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,sBAAsB,EACtC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,QAAQ,GACf,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAqGlE"}
+{"version":3,"file":"portal.d.ts","sourceRoot":"","sources":["../../../../src/adapters/web/login/portal.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAU5C,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEpF,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,qBAAa,sBAAuB,SAAQ,kBAAkB,CAAC,SAAS,CAAC;IACvE,MAAM,CACJ,QAAQ,EAAE,YAAY,EACtB,cAAc,EAAE,MAAM,EACtB,cAAc,EAAE,MAAM,EACtB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,MAAM,GACjB,SAAS,CAWX;CACF;AACD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAuN3C,wBAAgB,yBAAyB,CACvC,cAAc,EAAE,sBAAsB,EACtC,YAAY,EAAE,YAAY,EAC1B,MAAM,EAAE,QAAQ,GACf,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,KAAK,OAAO,CAqGlE"}

package/dist/adapters/web/login/portal.js

@@ -188,17 +188,6 @@ const SECRET_PRESETS = [
         ],
     },
 ];
-// ── request handler ───────────────────────────────────────────────────────────
-/**
- * Start a small HTTP server that receives credential onboarding callbacks from the web portal.
- *
- * Routes:
- *   GET  /health              — health check
- *   GET  /link?token=xxx      — credential onboarding page
- *   POST /api/link/complete   — API key completion endpoint
- *   POST /api/oauth/start     — creates provider OAuth redirect URL
- *   GET  /oauth/callback      — OAuth callback endpoint
- */
 export function createLoginRequestHandler(linkTokenStore, vaultManager, notify) {
     const oauthStates = new Map();
     return (req, res, url) => {
@@ -279,16 +268,6 @@ export function createLoginRequestHandler(linkTokenStore, vaultManager, notify)
         return false;
     };
 }
-/**
- * Block cross-site POSTs to the credential endpoints. Two defenses:
- *   1. Require Content-Type: application/json, which forces a CORS preflight
- *      for any cross-origin fetch and rules out `<form enctype="text/plain">`
- *      tricks that could otherwise smuggle a JSON body.
- *   2. When MIKAN_LINK_URL is configured, require that the Origin (or Referer,
- *      as a fallback for browsers that strip Origin) matches that base URL.
- *      This stops an attacker-controlled page — even one that somehow stole a
- *      victim's link token — from completing the flow.
- */
 function enforceCsrf(req, res) {
     const contentType = req.headers["content-type"]
         ?.split(";")[0]
@@ -301,8 +280,6 @@ function enforceCsrf(req, res) {
     }
     const configured = resolveLinkBaseUrl();
     if (!configured) {
-        // No trusted origin to compare against in local/dev mode; the loopback
-        // bind already prevents cross-host access.
         return true;
     }
     let configuredOrigin;
@@ -310,7 +287,6 @@ function enforceCsrf(req, res) {
         configuredOrigin = new URL(configured).origin;
     }
     catch {
-        // Misconfigured MIKAN_LINK_URL — fail closed.
         res.writeHead(500, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "Server misconfiguration" }));
         return false;
@@ -322,7 +298,6 @@ function enforceCsrf(req, res) {
     }
     return true;
 }
-/** Best-effort origin of the request, derived from Origin or Referer. */
 function requestOrigin(req) {
     const origin = req.headers.origin?.trim();
     if (origin && origin !== "null")
@@ -337,12 +312,9 @@ function requestOrigin(req) {
         return undefined;
     }
 }
-// ── HTML helpers ───────────────────────────────────────────────────────────────
 const esc = escapeHtml;
 const loginViewStyles = `
-  /* Login portal inherits all base chrome from the shared shell.
-     This module only adds preset cards, service logos, help popovers,
-     and the mode toggle. */
+
 
   p { margin: 0; color: var(--muted); font-size: 0.92rem; line-height: 1.55; }
 
@@ -1036,7 +1008,6 @@ function renderSentryCliConfig(updates) {
     }
     return lines.join("\n");
 }
-// ── API-key completion ────────────────────────────────────────────────────────
 async function handleLinkComplete(data, linkTokenStore, vaultManager, notify, res) {
     if (!data.token) {
         res.writeHead(400, { "Content-Type": "application/json" });
@@ -1050,8 +1021,6 @@ async function handleLinkComplete(data, linkTokenStore, vaultManager, notify, re
         return;
     }
     const envKeys = Object.keys(updates).toSorted((left, right) => left.localeCompare(right));
-    // Atomic consume prevents two concurrent requests from both passing the
-    // validity check before either deletes the token.
     const linkToken = linkTokenStore.consume(data.token);
     if (!linkToken) {
         res.writeHead(400, { "Content-Type": "application/json" });
@@ -1063,8 +1032,9 @@ async function handleLinkComplete(data, linkTokenStore, vaultManager, notify, re
     try {
         vaultManager.upsertEnv(linkToken.vaultId, updates);
         if (sentryCliConfig) {
-            vaultManager.upsertFile(linkToken.vaultId, ".sentryclirc", sentryCliConfig, "/root/.sentryclirc");
-            fileTargets.push("/root/.sentryclirc");
+            const target = defaultVaultTargetPath(".sentryclirc");
+            vaultManager.upsertFile(linkToken.vaultId, ".sentryclirc", sentryCliConfig, target);
+            fileTargets.push(target);
         }
     }
     catch (persistError) {
@@ -1111,7 +1081,6 @@ async function handleLinkComplete(data, linkTokenStore, vaultManager, notify, re
         });
     });
 }
-// ── OAuth flow ────────────────────────────────────────────────────────────────
 async function handleOAuthStart(data, req, linkTokenStore, oauthStates, res) {
     if (!data.token || !data.serviceId) {
         res.writeHead(400, { "Content-Type": "application/json" });
@@ -1175,7 +1144,6 @@ function resolveOAuthCallback(options) {
     const state = url.searchParams.get("state") ?? "";
     const code = url.searchParams.get("code") ?? "";
     const oauthError = url.searchParams.get("error");
-    // Atomic pop: whatever path we take from here, this state is spent.
     const pending = oauthStates.get(state);
     if (pending)
         oauthStates.delete(state);
@@ -1207,7 +1175,6 @@ function resolveOAuthCallback(options) {
         res.end(renderErrorPage("OAuth service is not configured on server."));
         return undefined;
     }
-    // Atomic consume keeps the callback one-shot across the token exchange await.
     const linkToken = linkTokenStore.consume(pending.linkToken);
     if (!linkToken) {
         res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" });