@geminixiang/mikan 1.0.0-beta.78 → 1.0.0-beta.79

package/dist/vault/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,KAAK,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQtD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIzE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAsB,YAAY,EAAE,MAAM,YAAY,CAAC;AAElF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOpE;AAoBD,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,YAAY,QAAQ,EAAE,MAAM,EAG3B;IAED,SAAS,IAAI,OAAO,CAEnB;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG7B;IAED,gBAAgB,IAAI,MAAM,EAAE,CAO3B;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQvC;IAED,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAoBhD;IAED,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAKjD;IAED,IAAI,IAAI,aAAa,EAAE,CAatB;IAED,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAexD;IAED,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAejD;IAED,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAsBxF;IAED,OAAO,CAAC,aAAa;IAiBrB,OAAO,CAAC,gBAAgB;CAGzB;AA8MD,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGnE;AAyBD,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;CACnC,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA+B9C;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE;IACvD,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpC,GAAG,OAAO,CAIV;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA6BjD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,KAAK,EAAE,aAAa,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,6BAA6B,CAAC;IAC5C,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,EAAE,aAAa,CAAC;CACxB,GAAG,cAAc,CAWjB;AAED,eAAO,MAAM,oBAAoB,EAAE,YAiBlC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,KAAK,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQtD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIzE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED,OAAO,KAAK,EAAE,aAAa,EAAsB,YAAY,EAAE,MAAM,YAAY,CAAC;AAElF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOpE;AAoBD,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,YAAY,QAAQ,EAAE,MAAM,EAG3B;IAED,SAAS,IAAI,OAAO,CAEnB;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG7B;IAED,gBAAgB,IAAI,MAAM,EAAE,CAO3B;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQvC;IAED,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAoBhD;IAED,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAKjD;IAED,IAAI,IAAI,aAAa,EAAE,CAatB;IAED,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAexD;IAED,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAejD;IAED,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAsBxF;IAED,OAAO,CAAC,aAAa;IAiBrB,OAAO,CAAC,gBAAgB;CAGzB;AA8MD,eAAO,MAAM,6BAA6B;;;;;;;;;EASxC,CAAC;AAEH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGnE;AAsBD,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;CACnC,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA+B9C;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE;IACvD,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpC,GAAG,OAAO,CAIV;AAED,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA8BjD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,KAAK,EAAE,aAAa,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,6BAA6B,CAAC;IAC5C,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,EAAE,aAAa,CAAC;CACxB,GAAG,cAAc,CAWjB;AAED,eAAO,MAAM,oBAAoB,EAAE,YAiBlC,CAAC"}

package/dist/vault/index.js

@@ -3,7 +3,7 @@ import { dirname, isAbsolute, join, normalize, sep } from "node:path";
 import { officeKey } from "../office/index.js";
 import { legacyConversationCredentialKey } from "../sandbox/identity.js";
 import { guestHomePath } from "../sandbox/layout.js";
-import { atomicWritePrivateFile, isRecord, readTextFileIfExists } from "../file-guards.js";
+import { atomicWritePrivateFile, readTextFileIfExists } from "../file-guards.js";
 import { reportUserFacingError } from "../observability/index.js";
 const PRIVATE_DIR_MODE = 0o700;
 const SHARED_VAULT_DIR = "shared";
@@ -367,6 +367,16 @@ function normalizeVaultTargetPath(targetPath) {
     const normalized = normalize(trimmed).split(sep).join("/");
     return normalized.startsWith("/") ? normalized : undefined;
 }
+export const GOOGLE_VAULT_CREDENTIAL_FILES = Object.freeze({
+    workspaceCli: Object.freeze({
+        relativePath: "gws.json",
+        targetPath: guestHomePath(".config/gws/credentials.json"),
+    }),
+    cloudSdk: Object.freeze({
+        relativePath: "gcloud-adc.json",
+        targetPath: guestHomePath(".config/gcloud/application_default_credentials.json"),
+    }),
+});
 export function defaultVaultTargetPath(relativePath) {
     const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\/+/, "");
     return guestHomePath(normalized);
@@ -375,11 +385,9 @@ function inferredVaultTargetPath(relativePath) {
     const normalized = normalizeVaultRelativePath(relativePath);
     if (!normalized)
         return undefined;
-    if (normalized === "gws.json") {
-        return guestHomePath(".config/gws/credentials.json");
-    }
-    if (normalized === "gcloud-adc.json") {
-        return guestHomePath(".config/gcloud/application_default_credentials.json");
+    for (const file of Object.values(GOOGLE_VAULT_CREDENTIAL_FILES)) {
+        if (normalized === file.relativePath)
+            return file.targetPath;
     }
     if (normalized === ".ssh" || normalized.startsWith(".ssh/")) {
         return guestHomePath(".ssh");
@@ -431,6 +439,7 @@ export function allowsAmbientDefaultSharedVault(options) {
         return false;
     return options.sandboxType === "image" || options.sandboxType === "cloudflare";
 }
+import { isRecord } from "../unknown-values.js";
 function resolveExistingMounts(vault, sandboxType, address) {
     const mounts = [];
     for (const mount of vault?.mounts ?? []) {
@@ -460,7 +469,7 @@ export function resolveVaultInjection(options) {
     }
     const mounts = resolveExistingMounts(vault, sandboxType, address);
     const env = capabilities.env && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;
-    return { ...(env ? { env } : {}), mounts };
+    return { env, mounts };
 }
 export const disabledVaultManager = {
     isEnabled: () => false,

package/dist/vault/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,SAAS,EACT,WAAW,EACX,UAAU,EACV,MAAM,GACP,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIlE,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAClC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AACxD,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC;AAEtE,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,gBAAgB,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAKD,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAErC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,gBAAgB;IAI3B,YAAY,QAAgB;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED,SAAS;QACP,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,gBAAgB;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACnD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;aAC7F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,iBAAiB,CAAC,IAAY;QAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iBAAiB,CACf,IAAY,EACZ,SAAiB;QAEjB,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,EAAE,CAAC,CAAC;QAC1F,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,kBAAkB,CAAC,CAAC;QAE5F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,mCAAmC,CAAC,SAAS,CAAC,CAAC;QAC/C,mCAAmC,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE;YAClD,GAAG,aAAa;YAChB,GAAG,aAAa;SACjB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IACE,KAAK,CAAC,WAAW,EAAE;gBACnB,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBACpC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAC1B,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,GAAW,EAAE,GAA2B;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC;QACvC,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;aAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,YAAY,CAAC,GAAW,EAAE,MAAc;QACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,eAAe,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;aACrB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;aAC1C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU,CAAC,GAAW,EAAE,YAAoB,EAAE,OAAe,EAAE,UAAmB;QAChF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,cAAc,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC9D,IACE,CAAC,cAAc;YACf,cAAc,KAAK,yBAAyB;YAC5C,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,MAAM,YAAY,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC3C,mCAAmC,CAAC,GAAG,CAAC,CAAC;QAEzC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,GAAG;YAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAClF,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,mCAAmC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAEvF,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAErE,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,GAAG;YAChB,GAAG;YACH,MAAM;YACN,GAAG;SACJ,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IACnD,CAAC;CACF;AAED,SAAS,oBAAoB,CAC3B,GAAW,EACX,eAAuC;IAEvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,cAAc,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC;YAC/D,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;YAC7B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC;QACtC,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAC/E,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAe,EACf,WAAmB,EACnB,SAAiB,EACjB,eAAuC;IAEvC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrF,MAAM,YAAY,GAAG,GAAG,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC;YACjE,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC;YAC/B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;QACxC,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC5E,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mCAAmC,CAAC,GAAW;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAE5E,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;IAEvF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC9D,KAAK,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,cAAc,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,gBAAgB,GACpB,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,cAAc,KAAK,YAAY,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,YAAoB,EAAE,UAAmB;IAChF,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;;QACtD,OAAO,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;IACxC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAA+B;IACtE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,sBAAsB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7D,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpC,CAAC;AAOD,SAAS,YAAY,CAAC,SAAiB,EAAE,SAAiB;IACxD,MAAM,KAAK,GAAoB,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3D,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;QACxC,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,SAAiB,EAAE,KAAa;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,OAAO,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAEjE,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACrC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,UAAkB;IAC/D,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC;IAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;SAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,sBAAsB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9C,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;QAC1C,OAAO,CACL,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAC7F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAC,YAAoB;IACtD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAmB;IACnD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE3D,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,OAAO,aAAa,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB;IACnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC,8BAA8B,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;QACrC,OAAO,aAAa,CAAC,qDAAqD,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,OAAO,aAAa,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAG5C;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAE3D,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,uBAAuB,EAAE,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,+BAA+B,CAAC,cAAc,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,cAAc,EAAE,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAG/C;IACC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;IACtD,IAAI,UAAU,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,OAAO,CAAC,WAAW,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,KAAK,YAAY,CAAC;AACjF,CAAC;AAKD,SAAS,qBAAqB,CAC5B,KAAgC,EAChC,WAAkC,EAClC,OAAsB;IAEtB,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,qBAAqB,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE;gBAChE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,iBAAiB;gBAC1B,SAAS,EAAE,gBAAgB;gBAC3B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE;oBACP,WAAW;oBACX,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;iBACzB;aACF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC9D,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,iBAAiB,WAAW,sCAAsC,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAElE,MAAM,GAAG,GACP,YAAY,CAAC,GAAG,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAiB;IAChD,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK;IACtB,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;IACrB,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS;IACxB,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE;IACd,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE;IAC1B,iBAAiB,EAAE,GAAG,EAAE,CAAC,KAAK;IAC9B,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAC/D,SAAS,EAAE,GAAG,EAAE;QACd,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,YAAY,EAAE,GAAG,EAAE;QACjB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,UAAU,EAAE,GAAG,EAAE;QACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;CACF,CAAC","sourcesContent":["import type { Dirent } from \"node:fs\";\nimport {\n  chmodSync,\n  copyFileSync,\n  existsSync,\n  mkdirSync,\n  readdirSync,\n  renameSync,\n  rmSync,\n} from \"node:fs\";\nimport { dirname, isAbsolute, join, normalize, sep } from \"node:path\";\nimport { officeKey } from \"../office/index.js\";\nimport { legacyConversationCredentialKey } from \"../sandbox/identity.js\";\nimport { guestHomePath } from \"../sandbox/layout.js\";\nimport type { OfficeAddress } from \"../types.js\";\nimport { atomicWritePrivateFile, isRecord, readTextFileIfExists } from \"../file-guards.js\";\nimport { reportUserFacingError } from \"../observability/index.js\";\nimport type { SandboxConfig, SandboxCredentialCapabilities } from \"../sandbox/types.js\";\nimport type { PlatformTrustModel } from \"../types.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst SHARED_VAULT_DIR = \"shared\";\nconst LEGACY_MOUNT_TARGETS_FILE = \".mount-targets.json\";\nconst MOUNT_TARGETS_DIR = \"vault-mount-targets\";\nconst RESERVED_VAULT_DIRS = new Set([SHARED_VAULT_DIR, \"extensions\"]);\n\nexport function normalizeSharedVaultName(name: string): string | undefined {\n  const trimmed = name.trim();\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(trimmed)) return undefined;\n  return trimmed;\n}\n\nexport function sharedVaultKey(name: string): string | undefined {\n  const normalized = normalizeSharedVaultName(name);\n  return normalized ? `${SHARED_VAULT_DIR}/${normalized}` : undefined;\n}\n\nexport type { ResolvedVault, VaultManager } from \"./types.js\";\nimport type { ResolvedVault, ResolvedVaultMount, VaultManager } from \"./types.js\";\n\nexport function parseEnvFile(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const line of content.split(/\\r\\n|\\r|\\n/)) {\n    const entry = parseEnvLine(line);\n    if (entry) env[entry[0]] = entry[1];\n  }\n  return env;\n}\n\nfunction parseEnvLine(line: string): [string, string] | undefined {\n  const trimmed = line.trim();\n  if (!trimmed || trimmed.startsWith(\"#\")) return undefined;\n\n  const eqIndex = trimmed.indexOf(\"=\");\n  if (eqIndex === -1) return undefined;\n\n  const key = trimmed.slice(0, eqIndex).trim();\n  if (!key) return undefined;\n  return [key, unquoteEnvValue(trimmed.slice(eqIndex + 1))];\n}\n\nfunction unquoteEnvValue(value: string): string {\n  const quote = value[0];\n  if ((quote === '\"' || quote === \"'\") && value.endsWith(quote)) return value.slice(1, -1);\n  return value;\n}\n\nexport class FileVaultManager implements VaultManager {\n  private readonly vaultsDir: string;\n  private readonly mountTargetsDir: string;\n\n  constructor(stateDir: string) {\n    this.vaultsDir = join(stateDir, \"vaults\");\n    this.mountTargetsDir = join(stateDir, MOUNT_TARGETS_DIR);\n  }\n\n  isEnabled(): boolean {\n    return existsSync(this.vaultsDir);\n  }\n\n  hasEntry(key: string): boolean {\n    if (!isSafeVaultKey(key)) return false;\n    return existsSync(join(this.vaultsDir, key));\n  }\n\n  listSharedVaults(): string[] {\n    const sharedDir = join(this.vaultsDir, SHARED_VAULT_DIR);\n    if (!existsSync(sharedDir)) return [];\n    return readdirSync(sharedDir, { withFileTypes: true })\n      .filter((entry) => entry.isDirectory() && normalizeSharedVaultName(entry.name) === entry.name)\n      .map((entry) => entry.name)\n      .toSorted((left, right) => left.localeCompare(right));\n  }\n\n  deleteSharedVault(name: string): boolean {\n    const key = sharedVaultKey(name);\n    if (!key) throw new Error(`vault: invalid shared login name: ${name}`);\n    const dir = join(this.vaultsDir, key);\n    const existed = existsSync(dir);\n    rmSync(dir, { recursive: true, force: true });\n    rmSync(this.mountTargetsPath(key), { force: true });\n    return existed;\n  }\n\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number } {\n    if (!isSafeVaultKey(targetKey)) throw new Error(`vault: invalid vault key: ${targetKey}`);\n    const sourceKey = sharedVaultKey(name);\n    if (!sourceKey) throw new Error(`vault: invalid shared login name: ${name}`);\n    const sourceDir = join(this.vaultsDir, sourceKey);\n    if (!existsSync(sourceDir)) throw new Error(`vault: shared login \"${name}\" does not exist`);\n\n    const targetDir = join(this.vaultsDir, targetKey);\n    assertNoLegacyMountTargetsCollision(sourceDir);\n    assertNoLegacyMountTargetsCollision(targetDir);\n    const sourceTargets = readMountTargets(this.mountTargetsPath(sourceKey));\n    const targetTargets = readMountTargets(this.mountTargetsPath(targetKey));\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(targetDir);\n    const result = copyVaultDir(sourceDir, targetDir);\n    writeMountTargets(this.mountTargetsPath(targetKey), {\n      ...targetTargets,\n      ...sourceTargets,\n    });\n    return result;\n  }\n\n  resolve(userId: string): ResolvedVault | undefined {\n    if (!isSafeVaultKey(userId)) return undefined;\n    const dir = join(this.vaultsDir, userId);\n    if (!existsSync(dir)) return undefined;\n    return this.buildResolved(userId);\n  }\n\n  list(): ResolvedVault[] {\n    if (!existsSync(this.vaultsDir)) return [];\n    const keys = new Set<string>();\n    for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {\n      if (\n        entry.isDirectory() &&\n        !RESERVED_VAULT_DIRS.has(entry.name) &&\n        isSafeVaultKey(entry.name)\n      ) {\n        keys.add(entry.name);\n      }\n    }\n    return Array.from(keys, (key) => this.buildResolved(key));\n  }\n\n  upsertEnv(key: string, env: Record<string, string>): void {\n    if (!isSafeVaultKey(key)) throw new Error(`vault: invalid vault key: ${key}`);\n    const dir = join(this.vaultsDir, key);\n    const envPath = join(dir, \"env\");\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const existingContent = readTextFileIfExists(envPath);\n    const existing = existingContent ? parseEnvFile(existingContent) : {};\n    const merged = { ...existing, ...env };\n    const content =\n      Object.entries(merged)\n        .toSorted(([left], [right]) => left.localeCompare(right))\n        .map(([envKey, value]) => `${envKey}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n  }\n\n  deleteEnvKey(key: string, envKey: string): boolean {\n    if (!isSafeVaultKey(key)) throw new Error(`vault: invalid vault key: ${key}`);\n    const envPath = join(this.vaultsDir, key, \"env\");\n    const existingContent = readTextFileIfExists(envPath);\n    if (existingContent === undefined) return false;\n    const existing = parseEnvFile(existingContent);\n    if (!(envKey in existing)) return false;\n    delete existing[envKey];\n    const content =\n      Object.entries(existing)\n        .toSorted(([left], [right]) => left.localeCompare(right))\n        .map(([name, value]) => `${name}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n    return true;\n  }\n\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void {\n    if (!isSafeVaultKey(key)) throw new Error(`vault: invalid vault key: ${key}`);\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    const normalizedTarget = normalizeVaultTargetPath(targetPath);\n    if (\n      !normalizedPath ||\n      normalizedPath === LEGACY_MOUNT_TARGETS_FILE ||\n      (targetPath !== undefined && !normalizedTarget)\n    ) {\n      throw new Error(`vault: invalid relative secret file path for \"${key}\": ${relativePath}`);\n    }\n\n    const dir = join(this.vaultsDir, key);\n    const filePath = join(dir, normalizedPath);\n    assertNoLegacyMountTargetsCollision(dir);\n\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const parentDir = dirname(filePath);\n    if (parentDir !== dir) ensurePrivateDir(parentDir);\n    atomicWritePrivateFile(filePath, content);\n    updateMountTarget(this.mountTargetsPath(key), normalizedPath, normalizedTarget);\n  }\n\n  private buildResolved(key: string): ResolvedVault {\n    const dir = join(this.vaultsDir, key);\n    assertNoLegacyMountTargetsCollision(dir);\n    const mounts = resolveMountsFromDir(dir, readMountTargets(this.mountTargetsPath(key)));\n\n    const envContent = readTextFileIfExists(join(dir, \"env\"));\n    const env = envContent === undefined ? {} : parseEnvFile(envContent);\n\n    return {\n      userId: key,\n      displayName: key,\n      dir,\n      mounts,\n      env,\n    };\n  }\n\n  private mountTargetsPath(key: string): string {\n    return join(this.mountTargetsDir, `${key}.json`);\n  }\n}\n\nfunction resolveMountsFromDir(\n  dir: string,\n  explicitTargets: Record<string, string>,\n): ResolvedVaultMount[] {\n  if (!existsSync(dir)) return [];\n\n  const mounts: ResolvedVaultMount[] = [];\n  for (const entry of readdirSync(dir, { withFileTypes: true })) {\n    if (entry.name === \"env\") continue;\n    const source = join(dir, entry.name);\n    const inferredTarget = inferredVaultTargetPath(entry.name);\n    if (!inferredTarget) continue;\n\n    const explicitTarget = Object.hasOwn(explicitTargets, entry.name)\n      ? explicitTargets[entry.name]\n      : undefined;\n    if (explicitTarget) {\n      mounts.push({ source, target: explicitTarget });\n      continue;\n    }\n\n    const nestedPrefix = `${entry.name}/`;\n    const hasExplicitDescendant = Object.keys(explicitTargets).some((relativePath) =>\n      relativePath.startsWith(nestedPrefix),\n    );\n    if (!entry.isDirectory() || !hasExplicitDescendant) {\n      mounts.push({ source, target: inferredTarget });\n      continue;\n    }\n    mounts.push(...resolveNestedMounts(dir, entry.name, inferredTarget, explicitTargets));\n  }\n  return mounts;\n}\n\nfunction resolveNestedMounts(\n  rootDir: string,\n  relativeDir: string,\n  targetDir: string,\n  explicitTargets: Record<string, string>,\n): ResolvedVaultMount[] {\n  const mounts: ResolvedVaultMount[] = [];\n  for (const entry of readdirSync(join(rootDir, relativeDir), { withFileTypes: true })) {\n    const relativePath = `${relativeDir}/${entry.name}`;\n    const source = join(rootDir, relativePath);\n    const inferredTarget = `${targetDir}/${entry.name}`;\n    const explicitTarget = Object.hasOwn(explicitTargets, relativePath)\n      ? explicitTargets[relativePath]\n      : undefined;\n    if (explicitTarget) {\n      mounts.push({ source, target: explicitTarget });\n      continue;\n    }\n\n    const nestedPrefix = `${relativePath}/`;\n    const hasExplicitDescendant = Object.keys(explicitTargets).some((candidate) =>\n      candidate.startsWith(nestedPrefix),\n    );\n    if (!entry.isDirectory() || !hasExplicitDescendant) {\n      mounts.push({ source, target: inferredTarget });\n      continue;\n    }\n    mounts.push(...resolveNestedMounts(rootDir, relativePath, inferredTarget, explicitTargets));\n  }\n  return mounts;\n}\n\nfunction assertNoLegacyMountTargetsCollision(dir: string): void {\n  const path = join(dir, LEGACY_MOUNT_TARGETS_FILE);\n  if (existsSync(path)) {\n    throw new Error(`vault: reserved mount metadata filename collision: ${path}`);\n  }\n}\n\nfunction readMountTargets(path: string): Record<string, string> {\n  const raw = readTextFileIfExists(path);\n  if (raw === undefined) return Object.create(null) as Record<string, string>;\n\n  let value: unknown;\n  try {\n    value = JSON.parse(raw);\n  } catch (error) {\n    throw new Error(`vault: invalid mount target metadata: ${path}`, { cause: error });\n  }\n  if (!isRecord(value)) throw new Error(`vault: invalid mount target metadata: ${path}`);\n\n  const targets = Object.create(null) as Record<string, string>;\n  for (const [relativePath, targetPath] of Object.entries(value)) {\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    const normalizedTarget =\n      typeof targetPath === \"string\" ? normalizeVaultTargetPath(targetPath) : undefined;\n    if (normalizedPath !== relativePath || !normalizedTarget || normalizedTarget !== targetPath) {\n      throw new Error(`vault: invalid mount target metadata: ${path}`);\n    }\n    targets[relativePath] = targetPath;\n  }\n  return targets;\n}\n\nfunction updateMountTarget(path: string, relativePath: string, targetPath?: string): void {\n  const targets = readMountTargets(path);\n  if (targetPath === undefined) delete targets[relativePath];\n  else targets[relativePath] = targetPath;\n  writeMountTargets(path, targets);\n}\n\nfunction writeMountTargets(path: string, targets: Record<string, string>): void {\n  if (Object.keys(targets).length === 0) {\n    rmSync(path, { force: true });\n    return;\n  }\n  ensurePrivateDir(dirname(path));\n  atomicWritePrivateFile(path, `${JSON.stringify(targets, null, 2)}\\n`);\n}\n\nfunction ensurePrivateDir(path: string): void {\n  mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });\n  chmodSync(path, PRIVATE_DIR_MODE);\n}\n\ninterface VaultCopyCounts {\n  filesCopied: number;\n  envKeysCopied: number;\n}\n\nfunction copyVaultDir(sourceDir: string, targetDir: string): VaultCopyCounts {\n  const total: VaultCopyCounts = { filesCopied: 0, envKeysCopied: 0 };\n  for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {\n    const counts = copyVaultEntry(sourceDir, targetDir, entry);\n    total.filesCopied += counts.filesCopied;\n    total.envKeysCopied += counts.envKeysCopied;\n  }\n  return total;\n}\n\nfunction copyVaultEntry(sourceDir: string, targetDir: string, entry: Dirent): VaultCopyCounts {\n  const sourcePath = join(sourceDir, entry.name);\n  const targetPath = join(targetDir, entry.name);\n\n  if (entry.name === \"env\" && entry.isFile()) {\n    return { filesCopied: 0, envKeysCopied: mergeVaultEnvFile(sourcePath, targetPath) };\n  }\n  if (entry.isDirectory()) {\n    ensurePrivateDir(targetPath);\n    return copyVaultDir(sourcePath, targetPath);\n  }\n  if (!entry.isFile()) return { filesCopied: 0, envKeysCopied: 0 };\n\n  copyFileSync(sourcePath, targetPath);\n  chmodSync(targetPath, 0o600);\n  return { filesCopied: 1, envKeysCopied: 0 };\n}\n\nfunction mergeVaultEnvFile(sourcePath: string, targetPath: string): number {\n  const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? \"\");\n  const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? \"\");\n  const merged = { ...targetEnv, ...sourceEnv };\n  const content =\n    Object.entries(merged)\n      .toSorted(([left], [right]) => left.localeCompare(right))\n      .map(([envKey, value]) => `${envKey}=${value}`)\n      .join(\"\\n\") + \"\\n\";\n  atomicWritePrivateFile(targetPath, content);\n  return Object.keys(sourceEnv).length;\n}\n\nfunction isSafeVaultKey(key: unknown): key is string {\n  if (typeof key !== \"string\" || !key || isAbsolute(key)) return false;\n  if (/^[A-Za-z]:[\\\\/]/.test(key)) return false;\n\n  return key.split(/[\\\\/]/).every((segment) => {\n    return (\n      segment !== \"\" && segment !== \".\" && segment !== \"..\" && !hasUnsafeControlCharacter(segment)\n    );\n  });\n}\n\nfunction hasUnsafeControlCharacter(value: string): boolean {\n  return Array.from(value).some((character) => {\n    const code = character.codePointAt(0) ?? 0;\n    return (code >= 0 && code <= 31) || (code >= 127 && code <= 159);\n  });\n}\n\nfunction normalizeVaultRelativePath(relativePath: string): string | undefined {\n  const trimmed = relativePath.trim();\n  if (!trimmed || isAbsolute(trimmed)) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  if (!normalized || normalized === \".\" || normalized === \"..\" || normalized.startsWith(\"../\")) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction normalizeVaultTargetPath(targetPath?: string): string | undefined {\n  if (targetPath === undefined) return undefined;\n\n  const trimmed = targetPath.trim();\n  if (!trimmed || !trimmed.startsWith(\"/\")) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  return normalized.startsWith(\"/\") ? normalized : undefined;\n}\n\nexport function defaultVaultTargetPath(relativePath: string): string {\n  const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\\/+/, \"\");\n  return guestHomePath(normalized);\n}\n\nfunction inferredVaultTargetPath(relativePath: string): string | undefined {\n  const normalized = normalizeVaultRelativePath(relativePath);\n  if (!normalized) return undefined;\n\n  if (normalized === \"gws.json\") {\n    return guestHomePath(\".config/gws/credentials.json\");\n  }\n  if (normalized === \"gcloud-adc.json\") {\n    return guestHomePath(\".config/gcloud/application_default_credentials.json\");\n  }\n  if (normalized === \".ssh\" || normalized.startsWith(\".ssh/\")) {\n    return guestHomePath(\".ssh\");\n  }\n  if (normalized === \".kube\" || normalized.startsWith(\".kube/\")) {\n    return guestHomePath(\".kube\");\n  }\n  if (normalized === \".config/gh\" || normalized.startsWith(\".config/gh/\")) {\n    return guestHomePath(\".config/gh\");\n  }\n\n  return defaultVaultTargetPath(normalized);\n}\n\nexport function migrateConversationVaultKeys(options: {\n  stateDir: string;\n  offices: readonly OfficeAddress[];\n}): { migrated: string[]; conflicts: string[] } {\n  const vaultsDir = join(options.stateDir, \"vaults\");\n  const migrated: string[] = [];\n  const conflicts: string[] = [];\n  if (!existsSync(vaultsDir)) return { migrated, conflicts };\n\n  const officesByConversationId = new Map<string, OfficeAddress[]>();\n  for (const office of options.offices) {\n    const offices = officesByConversationId.get(office.conversationId) ?? [];\n    offices.push(office);\n    officesByConversationId.set(office.conversationId, offices);\n  }\n  for (const [conversationId, offices] of officesByConversationId) {\n    const legacyDir = join(vaultsDir, legacyConversationCredentialKey(conversationId));\n    if (!existsSync(legacyDir)) continue;\n    if (offices.length !== 1) {\n      conflicts.push(conversationId);\n      continue;\n    }\n\n    const office = offices[0];\n    if (!office) throw new Error(`vault: missing office owner for ${conversationId}`);\n    const targetDir = join(vaultsDir, officeKey(office));\n    if (existsSync(targetDir)) {\n      conflicts.push(conversationId);\n      continue;\n    }\n    renameSync(legacyDir, targetDir);\n    migrated.push(conversationId);\n  }\n  return { migrated, conflicts };\n}\n\nexport function allowsAmbientDefaultSharedVault(options: {\n  trustModel?: PlatformTrustModel;\n  sandboxType: SandboxConfig[\"type\"];\n}): boolean {\n  const trustModel = options.trustModel ?? \"membership\";\n  if (trustModel === \"open-trigger\") return false;\n  return options.sandboxType === \"image\" || options.sandboxType === \"cloudflare\";\n}\n\nexport type { VaultInjection } from \"./types.js\";\nimport type { VaultInjection } from \"./types.js\";\n\nfunction resolveExistingMounts(\n  vault: ResolvedVault | undefined,\n  sandboxType: SandboxConfig[\"type\"],\n  address: OfficeAddress,\n): ResolvedVaultMount[] {\n  const mounts: ResolvedVaultMount[] = [];\n  for (const mount of vault?.mounts ?? []) {\n    if (!existsSync(mount.source)) {\n      reportUserFacingError(new Error(\"Vault mount source is missing\"), {\n        domain: \"sandbox\",\n        surface: \"vault_injection\",\n        operation: \"resolve_mounts\",\n        severity: \"warning\",\n        context: {\n          sandboxType,\n          conversationId: address.conversationId,\n          target: mount.target,\n          hasVault: Boolean(vault),\n        },\n      });\n      continue;\n    }\n    mounts.push({ source: mount.source, target: mount.target });\n  }\n  return mounts;\n}\n\nexport function resolveVaultInjection(options: {\n  vault: ResolvedVault | undefined;\n  capabilities: SandboxCredentialCapabilities;\n  sandboxType: SandboxConfig[\"type\"];\n  address: OfficeAddress;\n}): VaultInjection {\n  const { vault, capabilities, sandboxType, address } = options;\n  if (vault && vault.mounts.length > 0 && !capabilities.fileMounts) {\n    throw new Error(`Sandbox type \"${sandboxType}\" does not support vault file mounts`);\n  }\n\n  const mounts = resolveExistingMounts(vault, sandboxType, address);\n\n  const env =\n    capabilities.env && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n  return { ...(env ? { env } : {}), mounts };\n}\n\nexport const disabledVaultManager: VaultManager = {\n  isEnabled: () => false,\n  hasEntry: () => false,\n  resolve: () => undefined,\n  list: () => [],\n  listSharedVaults: () => [],\n  deleteSharedVault: () => false,\n  copySharedVaultTo: () => ({ filesCopied: 0, envKeysCopied: 0 }),\n  upsertEnv: () => {\n    throw new Error(\"Vault not configured\");\n  },\n  deleteEnvKey: () => {\n    throw new Error(\"Vault not configured\");\n  },\n  upsertFile: () => {\n    throw new Error(\"Vault not configured\");\n  },\n};\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,SAAS,EACT,WAAW,EACX,UAAU,EACV,MAAM,GACP,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIlE,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAClC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AACxD,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC;AAEtE,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,gBAAgB,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAID,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAErC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,gBAAgB;IAI3B,YAAY,QAAgB;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED,SAAS;QACP,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,gBAAgB;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACnD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;aAC7F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,iBAAiB,CAAC,IAAY;QAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iBAAiB,CACf,IAAY,EACZ,SAAiB;QAEjB,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,EAAE,CAAC,CAAC;QAC1F,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,kBAAkB,CAAC,CAAC;QAE5F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,mCAAmC,CAAC,SAAS,CAAC,CAAC;QAC/C,mCAAmC,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE;YAClD,GAAG,aAAa;YAChB,GAAG,aAAa;SACjB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IACE,KAAK,CAAC,WAAW,EAAE;gBACnB,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBACpC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAC1B,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,GAAW,EAAE,GAA2B;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC;QACvC,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;aAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,YAAY,CAAC,GAAW,EAAE,MAAc;QACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,eAAe,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;aACrB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;aAC1C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU,CAAC,GAAW,EAAE,YAAoB,EAAE,OAAe,EAAE,UAAmB;QAChF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,cAAc,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC9D,IACE,CAAC,cAAc;YACf,cAAc,KAAK,yBAAyB;YAC5C,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,MAAM,YAAY,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC3C,mCAAmC,CAAC,GAAG,CAAC,CAAC;QAEzC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,GAAG;YAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAClF,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,mCAAmC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAEvF,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAErE,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,GAAG;YAChB,GAAG;YACH,MAAM;YACN,GAAG;SACJ,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IACnD,CAAC;CACF;AAED,SAAS,oBAAoB,CAC3B,GAAW,EACX,eAAuC;IAEvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,cAAc,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC;YAC/D,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;YAC7B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC;QACtC,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAC/E,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAe,EACf,WAAmB,EACnB,SAAiB,EACjB,eAAuC;IAEvC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrF,MAAM,YAAY,GAAG,GAAG,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC;YACjE,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC;YAC/B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;QACxC,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC5E,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mCAAmC,CAAC,GAAW;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAE5E,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;IAEvF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC9D,KAAK,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,cAAc,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,gBAAgB,GACpB,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,cAAc,KAAK,YAAY,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,YAAoB,EAAE,UAAmB;IAChF,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;;QACtD,OAAO,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;IACxC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAA+B;IACtE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,sBAAsB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7D,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpC,CAAC;AAOD,SAAS,YAAY,CAAC,SAAiB,EAAE,SAAiB;IACxD,MAAM,KAAK,GAAoB,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3D,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;QACxC,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,SAAiB,EAAE,KAAa;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,OAAO,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAEjE,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACrC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,UAAkB;IAC/D,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC;IAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;SAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,sBAAsB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9C,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;QAC1C,OAAO,CACL,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAC7F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAC,YAAoB;IACtD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAmB;IACnD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE3D,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,MAAM,CAAC;IACzD,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,YAAY,EAAE,UAAU;QACxB,UAAU,EAAE,aAAa,CAAC,8BAA8B,CAAC;KAC1D,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,YAAY,EAAE,iBAAiB;QAC/B,UAAU,EAAE,aAAa,CAAC,qDAAqD,CAAC;KACjF,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,OAAO,aAAa,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB;IACnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAChE,IAAI,UAAU,KAAK,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;IAC/D,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,OAAO,aAAa,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAG5C;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAE3D,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,uBAAuB,EAAE,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,+BAA+B,CAAC,cAAc,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,cAAc,EAAE,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAG/C;IACC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;IACtD,IAAI,UAAU,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,OAAO,CAAC,WAAW,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,KAAK,YAAY,CAAC;AACjF,CAAC;AAGD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,SAAS,qBAAqB,CAC5B,KAAgC,EAChC,WAAkC,EAClC,OAAsB;IAEtB,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,qBAAqB,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE;gBAChE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,iBAAiB;gBAC1B,SAAS,EAAE,gBAAgB;gBAC3B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE;oBACP,WAAW;oBACX,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;iBACzB;aACF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC9D,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,iBAAiB,WAAW,sCAAsC,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAElE,MAAM,GAAG,GACP,YAAY,CAAC,GAAG,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAiB;IAChD,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK;IACtB,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;IACrB,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS;IACxB,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE;IACd,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE;IAC1B,iBAAiB,EAAE,GAAG,EAAE,CAAC,KAAK;IAC9B,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAC/D,SAAS,EAAE,GAAG,EAAE;QACd,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,YAAY,EAAE,GAAG,EAAE;QACjB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,UAAU,EAAE,GAAG,EAAE;QACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;CACF,CAAC","sourcesContent":["import type { Dirent } from \"node:fs\";\nimport {\n  chmodSync,\n  copyFileSync,\n  existsSync,\n  mkdirSync,\n  readdirSync,\n  renameSync,\n  rmSync,\n} from \"node:fs\";\nimport { dirname, isAbsolute, join, normalize, sep } from \"node:path\";\nimport { officeKey } from \"../office/index.js\";\nimport { legacyConversationCredentialKey } from \"../sandbox/identity.js\";\nimport { guestHomePath } from \"../sandbox/layout.js\";\nimport type { OfficeAddress } from \"../types.js\";\nimport { atomicWritePrivateFile, readTextFileIfExists } from \"../file-guards.js\";\nimport { reportUserFacingError } from \"../observability/index.js\";\nimport type { SandboxConfig, SandboxCredentialCapabilities } from \"../sandbox/types.js\";\nimport type { PlatformTrustModel } from \"../types.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst SHARED_VAULT_DIR = \"shared\";\nconst LEGACY_MOUNT_TARGETS_FILE = \".mount-targets.json\";\nconst MOUNT_TARGETS_DIR = \"vault-mount-targets\";\nconst RESERVED_VAULT_DIRS = new Set([SHARED_VAULT_DIR, \"extensions\"]);\n\nexport function normalizeSharedVaultName(name: string): string | undefined {\n  const trimmed = name.trim();\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(trimmed)) return undefined;\n  return trimmed;\n}\n\nexport function sharedVaultKey(name: string): string | undefined {\n  const normalized = normalizeSharedVaultName(name);\n  return normalized ? `${SHARED_VAULT_DIR}/${normalized}` : undefined;\n}\n\nimport type { ResolvedVault, ResolvedVaultMount, VaultManager } from \"./types.js\";\n\nexport function parseEnvFile(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const line of content.split(/\\r\\n|\\r|\\n/)) {\n    const entry = parseEnvLine(line);\n    if (entry) env[entry[0]] = entry[1];\n  }\n  return env;\n}\n\nfunction parseEnvLine(line: string): [string, string] | undefined {\n  const trimmed = line.trim();\n  if (!trimmed || trimmed.startsWith(\"#\")) return undefined;\n\n  const eqIndex = trimmed.indexOf(\"=\");\n  if (eqIndex === -1) return undefined;\n\n  const key = trimmed.slice(0, eqIndex).trim();\n  if (!key) return undefined;\n  return [key, unquoteEnvValue(trimmed.slice(eqIndex + 1))];\n}\n\nfunction unquoteEnvValue(value: string): string {\n  const quote = value[0];\n  if ((quote === '\"' || quote === \"'\") && value.endsWith(quote)) return value.slice(1, -1);\n  return value;\n}\n\nexport class FileVaultManager implements VaultManager {\n  private readonly vaultsDir: string;\n  private readonly mountTargetsDir: string;\n\n  constructor(stateDir: string) {\n    this.vaultsDir = join(stateDir, \"vaults\");\n    this.mountTargetsDir = join(stateDir, MOUNT_TARGETS_DIR);\n  }\n\n  isEnabled(): boolean {\n    return existsSync(this.vaultsDir);\n  }\n\n  hasEntry(key: string): boolean {\n    if (!isSafeVaultKey(key)) return false;\n    return existsSync(join(this.vaultsDir, key));\n  }\n\n  listSharedVaults(): string[] {\n    const sharedDir = join(this.vaultsDir, SHARED_VAULT_DIR);\n    if (!existsSync(sharedDir)) return [];\n    return readdirSync(sharedDir, { withFileTypes: true })\n      .filter((entry) => entry.isDirectory() && normalizeSharedVaultName(entry.name) === entry.name)\n      .map((entry) => entry.name)\n      .toSorted((left, right) => left.localeCompare(right));\n  }\n\n  deleteSharedVault(name: string): boolean {\n    const key = sharedVaultKey(name);\n    if (!key) throw new Error(`vault: invalid shared login name: ${name}`);\n    const dir = join(this.vaultsDir, key);\n    const existed = existsSync(dir);\n    rmSync(dir, { recursive: true, force: true });\n    rmSync(this.mountTargetsPath(key), { force: true });\n    return existed;\n  }\n\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number } {\n    if (!isSafeVaultKey(targetKey)) throw new Error(`vault: invalid vault key: ${targetKey}`);\n    const sourceKey = sharedVaultKey(name);\n    if (!sourceKey) throw new Error(`vault: invalid shared login name: ${name}`);\n    const sourceDir = join(this.vaultsDir, sourceKey);\n    if (!existsSync(sourceDir)) throw new Error(`vault: shared login \"${name}\" does not exist`);\n\n    const targetDir = join(this.vaultsDir, targetKey);\n    assertNoLegacyMountTargetsCollision(sourceDir);\n    assertNoLegacyMountTargetsCollision(targetDir);\n    const sourceTargets = readMountTargets(this.mountTargetsPath(sourceKey));\n    const targetTargets = readMountTargets(this.mountTargetsPath(targetKey));\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(targetDir);\n    const result = copyVaultDir(sourceDir, targetDir);\n    writeMountTargets(this.mountTargetsPath(targetKey), {\n      ...targetTargets,\n      ...sourceTargets,\n    });\n    return result;\n  }\n\n  resolve(userId: string): ResolvedVault | undefined {\n    if (!isSafeVaultKey(userId)) return undefined;\n    const dir = join(this.vaultsDir, userId);\n    if (!existsSync(dir)) return undefined;\n    return this.buildResolved(userId);\n  }\n\n  list(): ResolvedVault[] {\n    if (!existsSync(this.vaultsDir)) return [];\n    const keys = new Set<string>();\n    for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {\n      if (\n        entry.isDirectory() &&\n        !RESERVED_VAULT_DIRS.has(entry.name) &&\n        isSafeVaultKey(entry.name)\n      ) {\n        keys.add(entry.name);\n      }\n    }\n    return Array.from(keys, (key) => this.buildResolved(key));\n  }\n\n  upsertEnv(key: string, env: Record<string, string>): void {\n    if (!isSafeVaultKey(key)) throw new Error(`vault: invalid vault key: ${key}`);\n    const dir = join(this.vaultsDir, key);\n    const envPath = join(dir, \"env\");\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const existingContent = readTextFileIfExists(envPath);\n    const existing = existingContent ? parseEnvFile(existingContent) : {};\n    const merged = { ...existing, ...env };\n    const content =\n      Object.entries(merged)\n        .toSorted(([left], [right]) => left.localeCompare(right))\n        .map(([envKey, value]) => `${envKey}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n  }\n\n  deleteEnvKey(key: string, envKey: string): boolean {\n    if (!isSafeVaultKey(key)) throw new Error(`vault: invalid vault key: ${key}`);\n    const envPath = join(this.vaultsDir, key, \"env\");\n    const existingContent = readTextFileIfExists(envPath);\n    if (existingContent === undefined) return false;\n    const existing = parseEnvFile(existingContent);\n    if (!(envKey in existing)) return false;\n    delete existing[envKey];\n    const content =\n      Object.entries(existing)\n        .toSorted(([left], [right]) => left.localeCompare(right))\n        .map(([name, value]) => `${name}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n    return true;\n  }\n\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void {\n    if (!isSafeVaultKey(key)) throw new Error(`vault: invalid vault key: ${key}`);\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    const normalizedTarget = normalizeVaultTargetPath(targetPath);\n    if (\n      !normalizedPath ||\n      normalizedPath === LEGACY_MOUNT_TARGETS_FILE ||\n      (targetPath !== undefined && !normalizedTarget)\n    ) {\n      throw new Error(`vault: invalid relative secret file path for \"${key}\": ${relativePath}`);\n    }\n\n    const dir = join(this.vaultsDir, key);\n    const filePath = join(dir, normalizedPath);\n    assertNoLegacyMountTargetsCollision(dir);\n\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const parentDir = dirname(filePath);\n    if (parentDir !== dir) ensurePrivateDir(parentDir);\n    atomicWritePrivateFile(filePath, content);\n    updateMountTarget(this.mountTargetsPath(key), normalizedPath, normalizedTarget);\n  }\n\n  private buildResolved(key: string): ResolvedVault {\n    const dir = join(this.vaultsDir, key);\n    assertNoLegacyMountTargetsCollision(dir);\n    const mounts = resolveMountsFromDir(dir, readMountTargets(this.mountTargetsPath(key)));\n\n    const envContent = readTextFileIfExists(join(dir, \"env\"));\n    const env = envContent === undefined ? {} : parseEnvFile(envContent);\n\n    return {\n      userId: key,\n      displayName: key,\n      dir,\n      mounts,\n      env,\n    };\n  }\n\n  private mountTargetsPath(key: string): string {\n    return join(this.mountTargetsDir, `${key}.json`);\n  }\n}\n\nfunction resolveMountsFromDir(\n  dir: string,\n  explicitTargets: Record<string, string>,\n): ResolvedVaultMount[] {\n  if (!existsSync(dir)) return [];\n\n  const mounts: ResolvedVaultMount[] = [];\n  for (const entry of readdirSync(dir, { withFileTypes: true })) {\n    if (entry.name === \"env\") continue;\n    const source = join(dir, entry.name);\n    const inferredTarget = inferredVaultTargetPath(entry.name);\n    if (!inferredTarget) continue;\n\n    const explicitTarget = Object.hasOwn(explicitTargets, entry.name)\n      ? explicitTargets[entry.name]\n      : undefined;\n    if (explicitTarget) {\n      mounts.push({ source, target: explicitTarget });\n      continue;\n    }\n\n    const nestedPrefix = `${entry.name}/`;\n    const hasExplicitDescendant = Object.keys(explicitTargets).some((relativePath) =>\n      relativePath.startsWith(nestedPrefix),\n    );\n    if (!entry.isDirectory() || !hasExplicitDescendant) {\n      mounts.push({ source, target: inferredTarget });\n      continue;\n    }\n    mounts.push(...resolveNestedMounts(dir, entry.name, inferredTarget, explicitTargets));\n  }\n  return mounts;\n}\n\nfunction resolveNestedMounts(\n  rootDir: string,\n  relativeDir: string,\n  targetDir: string,\n  explicitTargets: Record<string, string>,\n): ResolvedVaultMount[] {\n  const mounts: ResolvedVaultMount[] = [];\n  for (const entry of readdirSync(join(rootDir, relativeDir), { withFileTypes: true })) {\n    const relativePath = `${relativeDir}/${entry.name}`;\n    const source = join(rootDir, relativePath);\n    const inferredTarget = `${targetDir}/${entry.name}`;\n    const explicitTarget = Object.hasOwn(explicitTargets, relativePath)\n      ? explicitTargets[relativePath]\n      : undefined;\n    if (explicitTarget) {\n      mounts.push({ source, target: explicitTarget });\n      continue;\n    }\n\n    const nestedPrefix = `${relativePath}/`;\n    const hasExplicitDescendant = Object.keys(explicitTargets).some((candidate) =>\n      candidate.startsWith(nestedPrefix),\n    );\n    if (!entry.isDirectory() || !hasExplicitDescendant) {\n      mounts.push({ source, target: inferredTarget });\n      continue;\n    }\n    mounts.push(...resolveNestedMounts(rootDir, relativePath, inferredTarget, explicitTargets));\n  }\n  return mounts;\n}\n\nfunction assertNoLegacyMountTargetsCollision(dir: string): void {\n  const path = join(dir, LEGACY_MOUNT_TARGETS_FILE);\n  if (existsSync(path)) {\n    throw new Error(`vault: reserved mount metadata filename collision: ${path}`);\n  }\n}\n\nfunction readMountTargets(path: string): Record<string, string> {\n  const raw = readTextFileIfExists(path);\n  if (raw === undefined) return Object.create(null) as Record<string, string>;\n\n  let value: unknown;\n  try {\n    value = JSON.parse(raw);\n  } catch (error) {\n    throw new Error(`vault: invalid mount target metadata: ${path}`, { cause: error });\n  }\n  if (!isRecord(value)) throw new Error(`vault: invalid mount target metadata: ${path}`);\n\n  const targets = Object.create(null) as Record<string, string>;\n  for (const [relativePath, targetPath] of Object.entries(value)) {\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    const normalizedTarget =\n      typeof targetPath === \"string\" ? normalizeVaultTargetPath(targetPath) : undefined;\n    if (normalizedPath !== relativePath || !normalizedTarget || normalizedTarget !== targetPath) {\n      throw new Error(`vault: invalid mount target metadata: ${path}`);\n    }\n    targets[relativePath] = targetPath;\n  }\n  return targets;\n}\n\nfunction updateMountTarget(path: string, relativePath: string, targetPath?: string): void {\n  const targets = readMountTargets(path);\n  if (targetPath === undefined) delete targets[relativePath];\n  else targets[relativePath] = targetPath;\n  writeMountTargets(path, targets);\n}\n\nfunction writeMountTargets(path: string, targets: Record<string, string>): void {\n  if (Object.keys(targets).length === 0) {\n    rmSync(path, { force: true });\n    return;\n  }\n  ensurePrivateDir(dirname(path));\n  atomicWritePrivateFile(path, `${JSON.stringify(targets, null, 2)}\\n`);\n}\n\nfunction ensurePrivateDir(path: string): void {\n  mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });\n  chmodSync(path, PRIVATE_DIR_MODE);\n}\n\ninterface VaultCopyCounts {\n  filesCopied: number;\n  envKeysCopied: number;\n}\n\nfunction copyVaultDir(sourceDir: string, targetDir: string): VaultCopyCounts {\n  const total: VaultCopyCounts = { filesCopied: 0, envKeysCopied: 0 };\n  for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {\n    const counts = copyVaultEntry(sourceDir, targetDir, entry);\n    total.filesCopied += counts.filesCopied;\n    total.envKeysCopied += counts.envKeysCopied;\n  }\n  return total;\n}\n\nfunction copyVaultEntry(sourceDir: string, targetDir: string, entry: Dirent): VaultCopyCounts {\n  const sourcePath = join(sourceDir, entry.name);\n  const targetPath = join(targetDir, entry.name);\n\n  if (entry.name === \"env\" && entry.isFile()) {\n    return { filesCopied: 0, envKeysCopied: mergeVaultEnvFile(sourcePath, targetPath) };\n  }\n  if (entry.isDirectory()) {\n    ensurePrivateDir(targetPath);\n    return copyVaultDir(sourcePath, targetPath);\n  }\n  if (!entry.isFile()) return { filesCopied: 0, envKeysCopied: 0 };\n\n  copyFileSync(sourcePath, targetPath);\n  chmodSync(targetPath, 0o600);\n  return { filesCopied: 1, envKeysCopied: 0 };\n}\n\nfunction mergeVaultEnvFile(sourcePath: string, targetPath: string): number {\n  const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? \"\");\n  const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? \"\");\n  const merged = { ...targetEnv, ...sourceEnv };\n  const content =\n    Object.entries(merged)\n      .toSorted(([left], [right]) => left.localeCompare(right))\n      .map(([envKey, value]) => `${envKey}=${value}`)\n      .join(\"\\n\") + \"\\n\";\n  atomicWritePrivateFile(targetPath, content);\n  return Object.keys(sourceEnv).length;\n}\n\nfunction isSafeVaultKey(key: unknown): key is string {\n  if (typeof key !== \"string\" || !key || isAbsolute(key)) return false;\n  if (/^[A-Za-z]:[\\\\/]/.test(key)) return false;\n\n  return key.split(/[\\\\/]/).every((segment) => {\n    return (\n      segment !== \"\" && segment !== \".\" && segment !== \"..\" && !hasUnsafeControlCharacter(segment)\n    );\n  });\n}\n\nfunction hasUnsafeControlCharacter(value: string): boolean {\n  return Array.from(value).some((character) => {\n    const code = character.codePointAt(0) ?? 0;\n    return (code >= 0 && code <= 31) || (code >= 127 && code <= 159);\n  });\n}\n\nfunction normalizeVaultRelativePath(relativePath: string): string | undefined {\n  const trimmed = relativePath.trim();\n  if (!trimmed || isAbsolute(trimmed)) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  if (!normalized || normalized === \".\" || normalized === \"..\" || normalized.startsWith(\"../\")) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction normalizeVaultTargetPath(targetPath?: string): string | undefined {\n  if (targetPath === undefined) return undefined;\n\n  const trimmed = targetPath.trim();\n  if (!trimmed || !trimmed.startsWith(\"/\")) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  return normalized.startsWith(\"/\") ? normalized : undefined;\n}\n\nexport const GOOGLE_VAULT_CREDENTIAL_FILES = Object.freeze({\n  workspaceCli: Object.freeze({\n    relativePath: \"gws.json\",\n    targetPath: guestHomePath(\".config/gws/credentials.json\"),\n  }),\n  cloudSdk: Object.freeze({\n    relativePath: \"gcloud-adc.json\",\n    targetPath: guestHomePath(\".config/gcloud/application_default_credentials.json\"),\n  }),\n});\n\nexport function defaultVaultTargetPath(relativePath: string): string {\n  const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\\/+/, \"\");\n  return guestHomePath(normalized);\n}\n\nfunction inferredVaultTargetPath(relativePath: string): string | undefined {\n  const normalized = normalizeVaultRelativePath(relativePath);\n  if (!normalized) return undefined;\n\n  for (const file of Object.values(GOOGLE_VAULT_CREDENTIAL_FILES)) {\n    if (normalized === file.relativePath) return file.targetPath;\n  }\n  if (normalized === \".ssh\" || normalized.startsWith(\".ssh/\")) {\n    return guestHomePath(\".ssh\");\n  }\n  if (normalized === \".kube\" || normalized.startsWith(\".kube/\")) {\n    return guestHomePath(\".kube\");\n  }\n  if (normalized === \".config/gh\" || normalized.startsWith(\".config/gh/\")) {\n    return guestHomePath(\".config/gh\");\n  }\n\n  return defaultVaultTargetPath(normalized);\n}\n\nexport function migrateConversationVaultKeys(options: {\n  stateDir: string;\n  offices: readonly OfficeAddress[];\n}): { migrated: string[]; conflicts: string[] } {\n  const vaultsDir = join(options.stateDir, \"vaults\");\n  const migrated: string[] = [];\n  const conflicts: string[] = [];\n  if (!existsSync(vaultsDir)) return { migrated, conflicts };\n\n  const officesByConversationId = new Map<string, OfficeAddress[]>();\n  for (const office of options.offices) {\n    const offices = officesByConversationId.get(office.conversationId) ?? [];\n    offices.push(office);\n    officesByConversationId.set(office.conversationId, offices);\n  }\n  for (const [conversationId, offices] of officesByConversationId) {\n    const legacyDir = join(vaultsDir, legacyConversationCredentialKey(conversationId));\n    if (!existsSync(legacyDir)) continue;\n    if (offices.length !== 1) {\n      conflicts.push(conversationId);\n      continue;\n    }\n\n    const office = offices[0];\n    if (!office) throw new Error(`vault: missing office owner for ${conversationId}`);\n    const targetDir = join(vaultsDir, officeKey(office));\n    if (existsSync(targetDir)) {\n      conflicts.push(conversationId);\n      continue;\n    }\n    renameSync(legacyDir, targetDir);\n    migrated.push(conversationId);\n  }\n  return { migrated, conflicts };\n}\n\nexport function allowsAmbientDefaultSharedVault(options: {\n  trustModel?: PlatformTrustModel;\n  sandboxType: SandboxConfig[\"type\"];\n}): boolean {\n  const trustModel = options.trustModel ?? \"membership\";\n  if (trustModel === \"open-trigger\") return false;\n  return options.sandboxType === \"image\" || options.sandboxType === \"cloudflare\";\n}\n\nimport type { VaultInjection } from \"./types.js\";\nimport { isRecord } from \"../unknown-values.js\";\n\nfunction resolveExistingMounts(\n  vault: ResolvedVault | undefined,\n  sandboxType: SandboxConfig[\"type\"],\n  address: OfficeAddress,\n): ResolvedVaultMount[] {\n  const mounts: ResolvedVaultMount[] = [];\n  for (const mount of vault?.mounts ?? []) {\n    if (!existsSync(mount.source)) {\n      reportUserFacingError(new Error(\"Vault mount source is missing\"), {\n        domain: \"sandbox\",\n        surface: \"vault_injection\",\n        operation: \"resolve_mounts\",\n        severity: \"warning\",\n        context: {\n          sandboxType,\n          conversationId: address.conversationId,\n          target: mount.target,\n          hasVault: Boolean(vault),\n        },\n      });\n      continue;\n    }\n    mounts.push({ source: mount.source, target: mount.target });\n  }\n  return mounts;\n}\n\nexport function resolveVaultInjection(options: {\n  vault: ResolvedVault | undefined;\n  capabilities: SandboxCredentialCapabilities;\n  sandboxType: SandboxConfig[\"type\"];\n  address: OfficeAddress;\n}): VaultInjection {\n  const { vault, capabilities, sandboxType, address } = options;\n  if (vault && vault.mounts.length > 0 && !capabilities.fileMounts) {\n    throw new Error(`Sandbox type \"${sandboxType}\" does not support vault file mounts`);\n  }\n\n  const mounts = resolveExistingMounts(vault, sandboxType, address);\n\n  const env =\n    capabilities.env && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n  return { env, mounts };\n}\n\nexport const disabledVaultManager: VaultManager = {\n  isEnabled: () => false,\n  hasEntry: () => false,\n  resolve: () => undefined,\n  list: () => [],\n  listSharedVaults: () => [],\n  deleteSharedVault: () => false,\n  copySharedVaultTo: () => ({ filesCopied: 0, envKeysCopied: 0 }),\n  upsertEnv: () => {\n    throw new Error(\"Vault not configured\");\n  },\n  deleteEnvKey: () => {\n    throw new Error(\"Vault not configured\");\n  },\n  upsertFile: () => {\n    throw new Error(\"Vault not configured\");\n  },\n};\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geminixiang/mikan",
-  "version": "1.0.0-beta.78",
+  "version": "1.0.0-beta.79",
   "description": "Self-hosted AI coding agent for organizations: every Slack channel and DM gets its own sandboxed workspace, credentials, and memory.",
   "keywords": [
     "agent",
@@ -46,6 +46,7 @@
     "build": "npm run clean && tsgo -p src/tsconfig.build.json && shx chmod +x dist/main.js",
     "dev": "tsgo -p src/tsconfig.build.json --watch --preserveWatchOutput",
     "test": "vitest --run --config .config/vitest.config.ts",
+    "typecheck": "tsgo -p .config/tsconfig.typecheck.json",
     "test:coverage": "vitest --run --coverage --config .config/vitest.config.ts",
     "test:coverage:check": "npm run test:coverage",
     "test:office:docker": "node scripts/verify-office-docker.mjs",
@@ -78,7 +79,6 @@
     "@opentelemetry/sdk-trace-node": "^2.10.0",
     "@sentry/node": "^10.60.0",
     "@sentry/opentelemetry": "^10.68.0",
-    "@sinclair/typebox": "^0.34.49",
     "@slack/socket-mode": "^2.0.7",
     "@slack/web-api": "^8.0.0",
     "chalk": "^5.6.2",
@@ -87,6 +87,7 @@
     "discord.js": "^14.26.4",
     "grammy": "^1.44.0",
     "markdown-it": "^14.2.0",
+    "typebox": "1.3.27",
     "undici": "^8.5.0"
   },
   "devDependencies": {

package/dist/adapters/index.d.ts

@@ -1,11 +0,0 @@
-import type { ConversationEvent, ConversationMessage, OfficeAddress, PlatformName } from "../types.js";
-export type { MessagingBot, ConversationContext, ConversationEvent, MessagingEventHandler, HandleNewCommandOptions, ConversationMessage, ConversationResponder, ChatToolResult, ConversationKind, MessagingInfo, OfficeAddress, OfficeKey, PlatformHistoryMessage, PlatformHistoryOptions, PlatformName, PlatformUserInfo, RunningSession, SubagentProgressSnapshot, } from "../types.js";
-interface ConversationIdentityInput {
-    platform: PlatformName;
-    conversationId: string;
-    address?: OfficeAddress;
-}
-type CanonicalConversation<T, Shape> = Omit<T, keyof ConversationIdentityInput> & Shape;
-export declare function createConversationEvent<T extends Omit<ConversationEvent, "address">>(input: T & ConversationIdentityInput): CanonicalConversation<T, ConversationEvent>;
-export declare function createConversationMessage<T extends Omit<ConversationMessage, "address">>(input: T & ConversationIdentityInput): CanonicalConversation<T, ConversationMessage>;
-//# sourceMappingURL=index.d.ts.map

package/dist/adapters/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,YAAY,EACb,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,SAAS,EACT,sBAAsB,EACtB,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,EAChB,cAAc,EACd,wBAAwB,GACzB,MAAM,aAAa,CAAC;AAErB,UAAU,yBAAyB;IACjC,QAAQ,EAAE,YAAY,CAAC;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAYD,KAAK,qBAAqB,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,MAAM,yBAAyB,CAAC,GAAG,KAAK,CAAC;AAExF,wBAAgB,uBAAuB,CAAC,CAAC,SAAS,IAAI,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAClF,KAAK,EAAE,CAAC,GAAG,yBAAyB,GACnC,qBAAqB,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAS7C;AAED,wBAAgB,yBAAyB,CAAC,CAAC,SAAS,IAAI,CAAC,mBAAmB,EAAE,SAAS,CAAC,EACtF,KAAK,EAAE,CAAC,GAAG,yBAAyB,GACnC,qBAAqB,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAS/C"}

package/dist/adapters/index.js

@@ -1,19 +0,0 @@
-import { createOfficeAddress, sameOffice } from "../office/index.js";
-function resolveConversationAddress(input) {
-    const address = createOfficeAddress(input.platform, input.conversationId);
-    if (input.address && !sameOffice(address, input.address)) {
-        throw new Error(`Conversation address mismatch for ${JSON.stringify(input.conversationId)} on ${input.platform}`);
-    }
-    return address;
-}
-export function createConversationEvent(input) {
-    const address = resolveConversationAddress(input);
-    const { platform: _platform, conversationId: _conversationId, address: _suppliedAddress, ...event } = input;
-    return { ...event, address };
-}
-export function createConversationMessage(input) {
-    const address = resolveConversationAddress(input);
-    const { platform: _platform, conversationId: _conversationId, address: _suppliedAddress, ...message } = input;
-    return { ...message, address };
-}
-//# sourceMappingURL=index.js.map

package/dist/adapters/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/adapters/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAmCrE,SAAS,0BAA0B,CAAC,KAAgC;IAClE,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1E,IAAI,KAAK,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,KAAK,CAAC,QAAQ,EAAE,CACjG,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAID,MAAM,UAAU,uBAAuB,CACrC,KAAoC;IAEpC,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,EACJ,QAAQ,EAAE,SAAS,EACnB,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,gBAAgB,EACzB,GAAG,KAAK,EACT,GAAG,KAAK,CAAC;IACV,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAiD,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAAoC;IAEpC,MAAM,OAAO,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAClD,MAAM,EACJ,QAAQ,EAAE,SAAS,EACnB,cAAc,EAAE,eAAe,EAC/B,OAAO,EAAE,gBAAgB,EACzB,GAAG,OAAO,EACX,GAAG,KAAK,CAAC;IACV,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAmD,CAAC;AAClF,CAAC","sourcesContent":["import { createOfficeAddress, sameOffice } from \"../office/index.js\";\nimport type {\n  ConversationEvent,\n  ConversationMessage,\n  OfficeAddress,\n  PlatformName,\n} from \"../types.js\";\n\nexport type {\n  MessagingBot,\n  ConversationContext,\n  ConversationEvent,\n  MessagingEventHandler,\n  HandleNewCommandOptions,\n  ConversationMessage,\n  ConversationResponder,\n  ChatToolResult,\n  ConversationKind,\n  MessagingInfo,\n  OfficeAddress,\n  OfficeKey,\n  PlatformHistoryMessage,\n  PlatformHistoryOptions,\n  PlatformName,\n  PlatformUserInfo,\n  RunningSession,\n  SubagentProgressSnapshot,\n} from \"../types.js\";\n\ninterface ConversationIdentityInput {\n  platform: PlatformName;\n  conversationId: string;\n  address?: OfficeAddress;\n}\n\nfunction resolveConversationAddress(input: ConversationIdentityInput): OfficeAddress {\n  const address = createOfficeAddress(input.platform, input.conversationId);\n  if (input.address && !sameOffice(address, input.address)) {\n    throw new Error(\n      `Conversation address mismatch for ${JSON.stringify(input.conversationId)} on ${input.platform}`,\n    );\n  }\n  return address;\n}\n\ntype CanonicalConversation<T, Shape> = Omit<T, keyof ConversationIdentityInput> & Shape;\n\nexport function createConversationEvent<T extends Omit<ConversationEvent, \"address\">>(\n  input: T & ConversationIdentityInput,\n): CanonicalConversation<T, ConversationEvent> {\n  const address = resolveConversationAddress(input);\n  const {\n    platform: _platform,\n    conversationId: _conversationId,\n    address: _suppliedAddress,\n    ...event\n  } = input;\n  return { ...event, address } as CanonicalConversation<T, ConversationEvent>;\n}\n\nexport function createConversationMessage<T extends Omit<ConversationMessage, \"address\">>(\n  input: T & ConversationIdentityInput,\n): CanonicalConversation<T, ConversationMessage> {\n  const address = resolveConversationAddress(input);\n  const {\n    platform: _platform,\n    conversationId: _conversationId,\n    address: _suppliedAddress,\n    ...message\n  } = input;\n  return { ...message, address } as CanonicalConversation<T, ConversationMessage>;\n}\n"]}