@geminixiang/mikan 1.0.0-beta.84 → 1.0.0-beta.86

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport type { RunEventPublisher, SubagentRunStatus } from \"./harness/types.js\";\nimport type { MikanModels } from \"./harness/models.js\";\nimport type { McpServerConfig } from \"./harness/types.js\";\nimport type { EventScheduleSink } from \"./events/index.js\";\nimport type { Office } from \"./office/types.js\";\nimport type { DockerContainerManager } from \"./sandbox/provisioner.js\";\nimport type { DockerExecFile, SandboxConfig } from \"./sandbox/types.js\";\nimport type { ChatHistorySync } from \"./sessions/chat-history-sync.js\";\nimport type { ResolvedSessionScope } from \"./sessions/types.js\";\nimport type { PlatformToolPackFactory } from \"./harness/tools/types.js\";\nimport type { VaultManager } from \"./vault/types.js\";\n\nexport type ConversationKind = \"direct\" | \"shared\";\n\nexport type PlatformName = \"slack\" | \"discord\" | \"telegram\" | \"github\";\n\nexport interface OfficeAddress {\n  readonly platform: PlatformName;\n  readonly conversationId: string;\n}\n\nexport type OfficeKey = string & { readonly __brand: \"OfficeKey\" };\n\nexport type OfficeMigrationStatus = \"needs-owner\" | \"prepared\" | \"moving\" | \"committed\" | \"failed\";\n\nexport interface OfficeMigrationRecord {\n  readonly rawConversationId: string;\n  readonly sourceDir: string;\n  readonly workspaceRoot: string;\n  readonly ownerPlatform?: PlatformName;\n  readonly targetDir?: string;\n  readonly status: OfficeMigrationStatus;\n  readonly error?: string;\n  readonly updatedAt: string;\n}\n\nexport interface OfficeRecord {\n  readonly platform: PlatformName;\n  readonly conversationId: string;\n  readonly recordedAt: string;\n}\n\nexport interface OfficeRegistryState {\n  readonly version: 1;\n  readonly enabledPlatforms: readonly PlatformName[];\n  readonly offices: readonly OfficeRecord[];\n  readonly migrations: readonly OfficeMigrationRecord[];\n}\n\nexport interface OfficeMigrationPreparation {\n  readonly rawConversationId: string;\n  readonly sourceDir: string;\n  readonly workspaceRoot: string;\n  readonly ownerPlatform?: PlatformName;\n}\n\nexport type PlatformTrustModel = \"membership\" | \"open-trigger\";\n\nexport interface ConversationMessage {\n  id: string;\n  address: OfficeAddress;\n  sessionKey: string;\n  conversationKind: ConversationKind;\n  userId: string;\n  userName?: string;\n  text: string;\n  attachments?: { name: string; localPath: string }[];\n  threadTs?: string;\n}\n\nexport interface ChatToolResult {\n  toolName: string;\n  label?: string;\n  args?: Record<string, unknown>;\n  result: string;\n  isError: boolean;\n  durationMs: number;\n}\n\nexport type SubagentProgressStatus = SubagentRunStatus | \"pending\" | \"running\" | \"skipped\";\n\nexport interface SubagentProgressNode {\n  id: string;\n  label: string;\n  status: SubagentProgressStatus;\n  profile?: string;\n  turns?: number;\n  toolCalls?: number;\n  toolCallCounts?: Record<string, number>;\n  tokens?: number;\n  costUsd?: number;\n  durationMs?: number;\n  activity?: string;\n  reason?: string;\n  cleanupPending?: boolean;\n}\n\nexport interface SubagentProgressSnapshot {\n  mode: \"single\" | \"parallel\" | \"dag\";\n  nodes: SubagentProgressNode[];\n}\n\nexport interface TaskStatus {\n  sessionKey: string;\n  threadTs: string;\n  acknowledgement: string;\n  status:\n    | \"running\"\n    | \"stopping\"\n    | \"completed\"\n    | \"aborted\"\n    | \"failed\"\n    | \"declined\"\n    | \"queued\"\n    | \"unknown\";\n  currentTool?: string;\n  observedAt: string;\n  endedAt?: string;\n}\n\nexport interface ConversationResponder {\n  startTask?(message: string, task: string): Promise<string>;\n  notifyCompletion?(): Promise<void>;\n  getTaskStatus?(sessionKey?: string): Promise<TaskStatus[]>;\n  respond(text: string): Promise<void>;\n  appendResponseDelta?(delta: string): Promise<void>;\n  finishResponse?(finalText?: string): Promise<void>;\n  replaceResponse(text: string, options?: { createOverflowLink?: () => string }): Promise<void>;\n  replaceSubagentProgress?(progress: SubagentProgressSnapshot, finalText?: string): Promise<void>;\n  respondAsRole?(profile: string, text: string): Promise<void>;\n  respondDiagnostic(text: string, options?: { style?: \"muted\" | \"error\" }): Promise<void>;\n  respondToolResult(result: ChatToolResult): Promise<void>;\n  setTyping(isTyping: boolean): Promise<void>;\n  setWorking(working: boolean): Promise<void>;\n  uploadFile(filePath: string, title?: string): Promise<void>;\n  react?(emoji: string): Promise<void>;\n  deleteResponse(): Promise<void>;\n}\n\nexport interface MessagingInfo {\n  name: string;\n  workspaceId?: string;\n  formattingGuide: string;\n  channels: { id: string; name: string }[];\n  users: { id: string; userName: string; displayName: string }[];\n  trustModel?: PlatformTrustModel;\n  diagnostics?: {\n    showUsageSummary?: boolean;\n  };\n}\n\nexport interface ConversationEvent {\n  type: string;\n  address: OfficeAddress;\n  vaultConversationId?: string;\n  conversationKind: ConversationKind;\n  ts: string;\n  thread_ts?: string;\n  user: string;\n  text: string;\n  attachments?: { name: string; localPath: string }[];\n  sessionKey?: string;\n}\n\nexport interface MessagingBot {\n  start(): Promise<void>;\n  stop(): Promise<void>;\n  postMessage(channel: string, text: string): Promise<string>;\n  updateMessage(channel: string, ts: string, text: string): Promise<void>;\n  addReaction?(channel: string, messageTs: string, emoji: string): Promise<void>;\n  uploadFile?(channel: string, filePath: string, title?: string): Promise<void>;\n  postInThread?(channel: string, threadTs: string, text: string): Promise<string>;\n  openDirectConversation?(userId: string): Promise<string>;\n  fetchHistory?(\n    channel: string,\n    options?: PlatformHistoryOptions,\n  ): Promise<PlatformHistoryMessage[]>;\n  listUsers?(): Promise<PlatformUserInfo[]>;\n  logBotResponse?(channel: string, text: string, ts: string, threadTs?: string): void;\n  enqueueEvent(event: ConversationEvent): boolean;\n  getMessagingInfo(): MessagingInfo;\n  postPrivate?(conversationId: string, userId: string, text: string): Promise<void>;\n  postPrivateDiagnostic?(\n    conversationId: string,\n    userId: string,\n    text: string,\n    options?: { style?: \"muted\" | \"error\" },\n  ): Promise<void>;\n}\n\nexport interface PlatformHistoryOptions {\n  oldest?: string;\n  limit?: number;\n  threadTs?: string;\n}\n\nexport interface PlatformHistoryMessage {\n  ts: string;\n  threadTs?: string;\n  userId?: string;\n  userName?: string;\n  text: string;\n  isBot: boolean;\n}\n\nexport interface PlatformUserInfo {\n  id: string;\n  userName: string;\n  displayName: string;\n  isBot: boolean;\n}\n\nexport interface ConversationContext {\n  address: OfficeAddress;\n  message: ConversationMessage;\n  responder: ConversationResponder;\n  platform: MessagingInfo;\n}\n\nexport interface RunningSession {\n  address: OfficeAddress;\n  sessionKey: string;\n  startedAt: number;\n  lastActivityAt?: number;\n  currentTool?: string;\n  stopping?: boolean;\n}\n\nexport interface HandleNewCommandOptions {\n  bot: MessagingBot;\n  message: ConversationMessage;\n}\n\nexport interface MessagingEventHandler {\n  isRunning(address: OfficeAddress, sessionKey: string): boolean;\n  getRunningSessions(): RunningSession[];\n  handleEvent(\n    event: ConversationEvent,\n    bot: MessagingBot,\n    context: ConversationContext,\n  ): Promise<void>;\n  handleStop(\n    address: OfficeAddress,\n    sessionKey: string,\n    bot: MessagingBot,\n    replyThreadTs?: string,\n  ): Promise<void>;\n  steer?(message: ConversationMessage): Promise<boolean>;\n  forceStop(address: OfficeAddress, sessionKey: string): void;\n  handleNewCommand(options: HandleNewCommandOptions): Promise<void>;\n}\n\nexport interface PiAgentWrapper {\n  steer?(message: ConversationMessage): Promise<boolean>;\n  syncChatHistory(currentMessageId?: string): Promise<void>;\n  run(\n    message: ConversationMessage,\n    responder: ConversationResponder,\n    platform: MessagingInfo,\n  ): Promise<{ stopReason: string; errorMessage?: string; finalText?: string }>;\n  abort(): void;\n  getCurrentStep(): { toolName?: string; label?: string } | undefined;\n  dispose(): Promise<void>;\n}\n\nexport type WorkspaceVisibility = \"public\" | \"private\";\n\nexport interface SandboxSettings {\n  cpus?: string;\n  memory?: string;\n  boost?: { cpus?: string; memory?: string };\n  defaultSharedVault?: string;\n}\n\nexport interface AgentConfig {\n  provider: string;\n  model: string;\n  thinkingLevel: ThinkingLevel;\n  sentryDsn?: string;\n  sandbox?: SandboxSettings;\n  slack?: {\n    replyMode?: \"top-level\" | \"thread\";\n  };\n  mcpServers?: Record<string, McpServerConfig>;\n}\n\nexport interface ConversationLogMessage {\n  date?: string;\n  ts?: string;\n  threadTs?: string;\n  user?: string;\n  userName?: string;\n  text?: string;\n  isMessagingBot?: boolean;\n}\n\nexport interface ActorContext {\n  address: OfficeAddress;\n  userId: string;\n  trustModel?: PlatformTrustModel;\n}\n\nexport interface LogContext {\n  conversationId: string;\n  userName?: string;\n  conversationName?: string;\n  sessionId?: string;\n}\n\ntype PortalView = \"admin\" | \"session\" | \"vault\";\n\nexport interface PortalShellOptions {\n  activeView: PortalView;\n  pageTitle: string;\n  identity?: {\n    primary: string;\n    secondary?: string;\n  };\n  conversationSwitcher?: {\n    currentId: string;\n    options?: Array<{ id: string; label: string; running?: boolean }>;\n  };\n  navLinks?: Partial<Record<PortalView, string>>;\n  body: string;\n  extraStyles?: string;\n  inlineScript?: string;\n  extraHead?: string;\n  bodyAttributes?: Record<string, string>;\n}\n\nexport type ContainerBindTranslator = (bindSpec: string) => string;\n\nexport interface ContainerMount {\n  source: string;\n  target: string;\n  readOnly?: boolean;\n}\n\nexport interface ResourceLimits {\n  cpus?: string;\n  memory?: string;\n}\n\nexport interface SandboxLimitStatus {\n  limits?: ResourceLimits;\n  boosted: boolean;\n}\n\nexport interface SandboxResourceController {\n  boost(key: string): Promise<SandboxLimitStatus>;\n  setLimits(key: string, limits: ResourceLimits): Promise<SandboxLimitStatus>;\n  getLimitStatus(key: string): SandboxLimitStatus;\n  getDefaultLimits(): ResourceLimits | undefined;\n  getBoostLimits(): ResourceLimits | undefined;\n}\n\nexport interface ProvisionOptions {\n  containerName?: string;\n  mounts?: ContainerMount[];\n  conversationId?: string;\n}\n\nexport interface ManagedContainerInventoryEntry {\n  containerName: string;\n  containerKey?: string;\n  running: boolean;\n  homeVolume: boolean;\n  imageStale: boolean;\n}\n\nexport type HomeVolumeMigrationOutcome = \"migrated\" | \"already-migrated\" | \"missing\";\n\nexport interface DockerContainerManagerOptions {\n  limits?: ResourceLimits;\n  boostLimits?: ResourceLimits;\n  execFileImpl?: DockerExecFile;\n}\n\nexport interface ExecutionPlan {\n  credentialKey: string;\n  resourceKey: string;\n  sandboxConfig: SandboxConfig;\n  env?: Record<string, string>;\n  mounts: ContainerMount[];\n}\n\nexport interface Attachment {\n  original: string;\n  localPath: string;\n}\n\ninterface EnvVarSpec {\n  name: string;\n  required?: boolean;\n  secret?: boolean;\n  deploy?: boolean;\n  doc: string;\n}\n\nexport interface OnboardLlmChoice {\n  provider: string;\n  model: string;\n}\n\nexport interface EnvGroup {\n  key: string;\n  title: string;\n  kind: \"platform\" | \"feature\";\n  vars: EnvVarSpec[];\n  anyOf?: readonly string[];\n  doc?: string;\n}\n\nexport interface RunnerCacheControl {\n  switchConversationModel(address: OfficeAddress, provider: string, model: string): boolean;\n  refreshConversationEnvironment(address: OfficeAddress): boolean;\n}\n\nexport interface GlobalRunnerCacheControl {\n  refreshAllConversations(): { busy: OfficeAddress[] };\n}\n\nexport type SettingsApplyResult =\n  | { ok: true; runtimeSwitched: boolean | null }\n  | { ok: false; reason: \"busy\" };\n\nexport interface CreateRunnerOptions {\n  sandboxConfig: SandboxConfig;\n  sessionKey: string;\n  office: Office;\n  trustModel: PlatformTrustModel;\n  platformWorkspaceId?: string;\n  openConnector?: McpServerConfig;\n  eventScheduler?: EventScheduleSink;\n  sessionScope: ResolvedSessionScope;\n  chatHistory: ChatHistorySync;\n  signal?: AbortSignal;\n  vaultManager?: VaultManager;\n  provisioner?: DockerContainerManager;\n  resourceController?: SandboxResourceController;\n  sessionView?: {\n    tokenStore: SessionViewTokenStoreLike;\n    portalBaseUrl?: string;\n  };\n  platformToolPackFactories?: readonly PlatformToolPackFactory[];\n  models?: MikanModels;\n  runEvents?: RunEventPublisher;\n}\n\nexport interface SessionViewTokenCreateOptions {\n  platform: PlatformName;\n  platformUserId: string;\n  conversationId: string;\n  sessionKey: string;\n  sessionFile: string;\n  platformUserName?: string;\n}\n\nexport interface SessionViewTokenStoreLike {\n  create(options: SessionViewTokenCreateOptions): { token: string };\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"","sourcesContent":["import type { ThinkingLevel } from \"@earendil-works/pi-agent-core\";\nimport type { RunEventPublisher, SubagentRunStatus } from \"./harness/types.js\";\nimport type { MikanModels } from \"./harness/models.js\";\nimport type { McpServerConfig } from \"./harness/types.js\";\nimport type { EventScheduleSink } from \"./events/index.js\";\nimport type { Office } from \"./office/types.js\";\nimport type { DockerContainerManager } from \"./sandbox/provisioner.js\";\nimport type { DockerExecFile, SandboxConfig } from \"./sandbox/types.js\";\nimport type { ChatHistorySync } from \"./sessions/chat-history-sync.js\";\nimport type { ResolvedSessionScope } from \"./sessions/types.js\";\nimport type { PlatformToolPackFactory } from \"./harness/tools/types.js\";\nimport type { VaultManager } from \"./vault/types.js\";\n\nexport type ConversationKind = \"direct\" | \"shared\";\n\nexport type PlatformName = \"slack\" | \"discord\" | \"telegram\" | \"github\";\n\nexport interface OfficeAddress {\n  readonly platform: PlatformName;\n  readonly conversationId: string;\n}\n\nexport type OfficeKey = string & { readonly __brand: \"OfficeKey\" };\n\nexport interface OfficeRecord {\n  readonly platform: PlatformName;\n  readonly conversationId: string;\n  readonly recordedAt: string;\n}\n\nexport interface OfficeRegistryState {\n  readonly version: 1;\n  readonly offices: readonly OfficeRecord[];\n}\n\nexport type PlatformTrustModel = \"membership\" | \"open-trigger\";\n\nexport interface ConversationMessage {\n  id: string;\n  address: OfficeAddress;\n  sessionKey: string;\n  conversationKind: ConversationKind;\n  userId: string;\n  userName?: string;\n  text: string;\n  attachments?: { name: string; localPath: string }[];\n  threadTs?: string;\n}\n\nexport interface ChatToolResult {\n  toolName: string;\n  label?: string;\n  args?: Record<string, unknown>;\n  result: string;\n  isError: boolean;\n  durationMs: number;\n}\n\nexport type SubagentProgressStatus = SubagentRunStatus | \"pending\" | \"running\" | \"skipped\";\n\nexport interface SubagentProgressNode {\n  id: string;\n  label: string;\n  status: SubagentProgressStatus;\n  profile?: string;\n  turns?: number;\n  toolCalls?: number;\n  toolCallCounts?: Record<string, number>;\n  tokens?: number;\n  costUsd?: number;\n  durationMs?: number;\n  activity?: string;\n  reason?: string;\n  cleanupPending?: boolean;\n}\n\nexport interface SubagentProgressSnapshot {\n  mode: \"single\" | \"parallel\" | \"dag\";\n  nodes: SubagentProgressNode[];\n}\n\nexport interface TaskStatus {\n  sessionKey: string;\n  threadTs: string;\n  acknowledgement: string;\n  status:\n    | \"running\"\n    | \"stopping\"\n    | \"completed\"\n    | \"aborted\"\n    | \"failed\"\n    | \"declined\"\n    | \"queued\"\n    | \"unknown\";\n  currentTool?: string;\n  observedAt: string;\n  endedAt?: string;\n}\n\nexport interface ConversationResponder {\n  startTask?(message: string, task: string): Promise<string>;\n  notifyCompletion?(): Promise<void>;\n  getTaskStatus?(sessionKey?: string): Promise<TaskStatus[]>;\n  respond(text: string): Promise<void>;\n  appendResponseDelta?(delta: string): Promise<void>;\n  finishResponse?(finalText?: string): Promise<void>;\n  replaceResponse(text: string, options?: { createOverflowLink?: () => string }): Promise<void>;\n  replaceSubagentProgress?(progress: SubagentProgressSnapshot, finalText?: string): Promise<void>;\n  respondAsRole?(profile: string, text: string): Promise<void>;\n  respondDiagnostic(text: string, options?: { style?: \"muted\" | \"error\" }): Promise<void>;\n  respondToolResult(result: ChatToolResult): Promise<void>;\n  setTyping(isTyping: boolean): Promise<void>;\n  setWorking(working: boolean): Promise<void>;\n  uploadFile(filePath: string, title?: string): Promise<void>;\n  react?(emoji: string): Promise<void>;\n  deleteResponse(): Promise<void>;\n}\n\nexport interface MessagingInfo {\n  name: string;\n  workspaceId?: string;\n  formattingGuide: string;\n  channels: { id: string; name: string }[];\n  users: { id: string; userName: string; displayName: string }[];\n  trustModel?: PlatformTrustModel;\n  diagnostics?: {\n    showUsageSummary?: boolean;\n  };\n}\n\nexport interface ConversationEvent {\n  type: string;\n  address: OfficeAddress;\n  vaultConversationId?: string;\n  conversationKind: ConversationKind;\n  ts: string;\n  thread_ts?: string;\n  user: string;\n  text: string;\n  attachments?: { name: string; localPath: string }[];\n  sessionKey?: string;\n}\n\nexport interface MessagingBot {\n  start(): Promise<void>;\n  stop(): Promise<void>;\n  postMessage(channel: string, text: string): Promise<string>;\n  updateMessage(channel: string, ts: string, text: string): Promise<void>;\n  addReaction?(channel: string, messageTs: string, emoji: string): Promise<void>;\n  uploadFile?(channel: string, filePath: string, title?: string): Promise<void>;\n  postInThread?(channel: string, threadTs: string, text: string): Promise<string>;\n  openDirectConversation?(userId: string): Promise<string>;\n  fetchHistory?(\n    channel: string,\n    options?: PlatformHistoryOptions,\n  ): Promise<PlatformHistoryMessage[]>;\n  listUsers?(): Promise<PlatformUserInfo[]>;\n  logBotResponse?(channel: string, text: string, ts: string, threadTs?: string): void;\n  enqueueEvent(event: ConversationEvent): boolean;\n  getMessagingInfo(): MessagingInfo;\n  postPrivate?(conversationId: string, userId: string, text: string): Promise<void>;\n  postPrivateDiagnostic?(\n    conversationId: string,\n    userId: string,\n    text: string,\n    options?: { style?: \"muted\" | \"error\" },\n  ): Promise<void>;\n}\n\nexport interface PlatformHistoryOptions {\n  oldest?: string;\n  limit?: number;\n  threadTs?: string;\n}\n\nexport interface PlatformHistoryMessage {\n  ts: string;\n  threadTs?: string;\n  userId?: string;\n  userName?: string;\n  text: string;\n  isBot: boolean;\n}\n\nexport interface PlatformUserInfo {\n  id: string;\n  userName: string;\n  displayName: string;\n  isBot: boolean;\n}\n\nexport interface ConversationContext {\n  address: OfficeAddress;\n  message: ConversationMessage;\n  responder: ConversationResponder;\n  platform: MessagingInfo;\n}\n\nexport interface RunningSession {\n  address: OfficeAddress;\n  sessionKey: string;\n  startedAt: number;\n  lastActivityAt?: number;\n  currentTool?: string;\n  stopping?: boolean;\n}\n\nexport interface HandleNewCommandOptions {\n  bot: MessagingBot;\n  message: ConversationMessage;\n}\n\nexport interface MessagingEventHandler {\n  isRunning(address: OfficeAddress, sessionKey: string): boolean;\n  getRunningSessions(): RunningSession[];\n  handleEvent(\n    event: ConversationEvent,\n    bot: MessagingBot,\n    context: ConversationContext,\n  ): Promise<void>;\n  handleStop(\n    address: OfficeAddress,\n    sessionKey: string,\n    bot: MessagingBot,\n    replyThreadTs?: string,\n  ): Promise<void>;\n  steer?(message: ConversationMessage): Promise<boolean>;\n  forceStop(address: OfficeAddress, sessionKey: string): void;\n  handleNewCommand(options: HandleNewCommandOptions): Promise<void>;\n}\n\nexport interface PiAgentWrapper {\n  steer?(message: ConversationMessage): Promise<boolean>;\n  syncChatHistory(currentMessageId?: string): Promise<void>;\n  run(\n    message: ConversationMessage,\n    responder: ConversationResponder,\n    platform: MessagingInfo,\n  ): Promise<{ stopReason: string; errorMessage?: string; finalText?: string }>;\n  abort(): void;\n  getCurrentStep(): { toolName?: string; label?: string } | undefined;\n  dispose(): Promise<void>;\n}\n\nexport type WorkspaceVisibility = \"public\" | \"private\";\n\nexport interface SandboxSettings {\n  cpus?: string;\n  memory?: string;\n  boost?: { cpus?: string; memory?: string };\n  defaultSharedVault?: string;\n}\n\nexport interface AgentConfig {\n  provider: string;\n  model: string;\n  thinkingLevel: ThinkingLevel;\n  sentryDsn?: string;\n  sandbox?: SandboxSettings;\n  slack?: {\n    replyMode?: \"top-level\" | \"thread\";\n  };\n  mcpServers?: Record<string, McpServerConfig>;\n}\n\nexport interface ConversationLogMessage {\n  date?: string;\n  ts?: string;\n  threadTs?: string;\n  user?: string;\n  userName?: string;\n  text?: string;\n  isMessagingBot?: boolean;\n}\n\nexport interface ActorContext {\n  address: OfficeAddress;\n  userId: string;\n  trustModel?: PlatformTrustModel;\n}\n\nexport interface LogContext {\n  conversationId: string;\n  userName?: string;\n  conversationName?: string;\n  sessionId?: string;\n}\n\ntype PortalView = \"admin\" | \"session\" | \"vault\";\n\nexport interface PortalShellOptions {\n  activeView: PortalView;\n  pageTitle: string;\n  identity?: {\n    primary: string;\n    secondary?: string;\n  };\n  conversationSwitcher?: {\n    currentId: string;\n    options?: Array<{ id: string; label: string; running?: boolean }>;\n  };\n  navLinks?: Partial<Record<PortalView, string>>;\n  body: string;\n  extraStyles?: string;\n  inlineScript?: string;\n  extraHead?: string;\n  bodyAttributes?: Record<string, string>;\n}\n\nexport interface ContainerMount {\n  source: string;\n  target: string;\n  readOnly?: boolean;\n}\n\nexport interface ResourceLimits {\n  cpus?: string;\n  memory?: string;\n}\n\nexport interface SandboxLimitStatus {\n  limits?: ResourceLimits;\n  boosted: boolean;\n}\n\nexport interface SandboxResourceController {\n  boost(key: string): Promise<SandboxLimitStatus>;\n  setLimits(key: string, limits: ResourceLimits): Promise<SandboxLimitStatus>;\n  getLimitStatus(key: string): SandboxLimitStatus;\n  getDefaultLimits(): ResourceLimits | undefined;\n  getBoostLimits(): ResourceLimits | undefined;\n}\n\nexport interface ProvisionOptions {\n  containerName?: string;\n  mounts?: ContainerMount[];\n  conversationId?: string;\n}\n\nexport interface DockerContainerManagerOptions {\n  limits?: ResourceLimits;\n  boostLimits?: ResourceLimits;\n  execFileImpl?: DockerExecFile;\n}\n\nexport interface ExecutionPlan {\n  credentialKey: string;\n  resourceKey: string;\n  sandboxConfig: SandboxConfig;\n  env?: Record<string, string>;\n  mounts: ContainerMount[];\n}\n\nexport interface Attachment {\n  original: string;\n  localPath: string;\n}\n\ninterface EnvVarSpec {\n  name: string;\n  required?: boolean;\n  secret?: boolean;\n  deploy?: boolean;\n  doc: string;\n}\n\nexport interface OnboardLlmChoice {\n  provider: string;\n  model: string;\n}\n\nexport interface EnvGroup {\n  key: string;\n  title: string;\n  kind: \"platform\" | \"feature\";\n  vars: EnvVarSpec[];\n  doc?: string;\n}\n\nexport interface RunnerCacheControl {\n  switchConversationModel(address: OfficeAddress, provider: string, model: string): boolean;\n  refreshConversationEnvironment(address: OfficeAddress): boolean;\n}\n\nexport interface GlobalRunnerCacheControl {\n  refreshAllConversations(): { busy: OfficeAddress[] };\n}\n\nexport type SettingsApplyResult =\n  | { ok: true; runtimeSwitched: boolean | null }\n  | { ok: false; reason: \"busy\" };\n\nexport interface CreateRunnerOptions {\n  sandboxConfig: SandboxConfig;\n  sessionKey: string;\n  office: Office;\n  trustModel: PlatformTrustModel;\n  platformWorkspaceId?: string;\n  openConnector?: McpServerConfig;\n  eventScheduler?: EventScheduleSink;\n  sessionScope: ResolvedSessionScope;\n  chatHistory: ChatHistorySync;\n  signal?: AbortSignal;\n  vaultManager?: VaultManager;\n  provisioner?: DockerContainerManager;\n  resourceController?: SandboxResourceController;\n  sessionView?: {\n    tokenStore: SessionViewTokenStoreLike;\n    portalBaseUrl?: string;\n  };\n  platformToolPackFactories?: readonly PlatformToolPackFactory[];\n  models?: MikanModels;\n  runEvents?: RunEventPublisher;\n}\n\nexport interface SessionViewTokenCreateOptions {\n  platform: PlatformName;\n  platformUserId: string;\n  conversationId: string;\n  sessionKey: string;\n  sessionFile: string;\n  platformUserName?: string;\n}\n\nexport interface SessionViewTokenStoreLike {\n  create(options: SessionViewTokenCreateOptions): { token: string };\n}\n"]}

package/dist/vault/index.d.ts

@@ -36,13 +36,6 @@ export declare const GOOGLE_VAULT_CREDENTIAL_FILES: Readonly<{
     }>;
 }>;
 export declare function defaultVaultTargetPath(relativePath: string): string;
-export declare function migrateConversationVaultKeys(options: {
-    stateDir: string;
-    offices: readonly OfficeAddress[];
-}): {
-    migrated: string[];
-    conflicts: string[];
-};
 export declare function allowsAmbientDefaultSharedVault(options: {
     trustModel?: PlatformTrustModel;
     sandboxType: SandboxConfig["type"];

package/dist/vault/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,KAAK,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQtD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIzE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED,OAAO,KAAK,EAAE,aAAa,EAAsB,YAAY,EAAE,MAAM,YAAY,CAAC;AAElF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOpE;AAoBD,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,YAAY,QAAQ,EAAE,MAAM,EAG3B;IAED,SAAS,IAAI,OAAO,CAEnB;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG7B;IAED,gBAAgB,IAAI,MAAM,EAAE,CAO3B;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQvC;IAED,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAoBhD;IAED,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAKjD;IAED,IAAI,IAAI,aAAa,EAAE,CAatB;IAED,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAexD;IAED,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAejD;IAED,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAsBxF;IAED,OAAO,CAAC,aAAa;IAiBrB,OAAO,CAAC,gBAAgB;CAGzB;AA8MD,eAAO,MAAM,6BAA6B;;;;;;;;;EASxC,CAAC;AAEH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGnE;AAsBD,wBAAgB,4BAA4B,CAAC,OAAO,EAAE;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,SAAS,aAAa,EAAE,CAAC;CACnC,GAAG;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,CA+B9C;AAED,wBAAgB,+BAA+B,CAAC,OAAO,EAAE;IACvD,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpC,GAAG,OAAO,CAIV;AAED,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA8BjD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,KAAK,EAAE,aAAa,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,6BAA6B,CAAC;IAC5C,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,EAAE,aAAa,CAAC;CACxB,GAAG,cAAc,CAWjB;AAED,eAAO,MAAM,oBAAoB,EAAE,YAiBlC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,KAAK,EAAE,aAAa,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQtD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIzE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/D;AAED,OAAO,KAAK,EAAE,aAAa,EAAsB,YAAY,EAAE,MAAM,YAAY,CAAC;AAElF,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOpE;AAoBD,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IAEzC,YAAY,QAAQ,EAAE,MAAM,EAG3B;IAED,SAAS,IAAI,OAAO,CAEnB;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAG7B;IAED,gBAAgB,IAAI,MAAM,EAAE,CAO3B;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQvC;IAED,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAoBhD;IAED,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAKjD;IAED,IAAI,IAAI,aAAa,EAAE,CAatB;IAED,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAexD;IAED,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAejD;IAED,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAsBxF;IAED,OAAO,CAAC,aAAa;IAiBrB,OAAO,CAAC,gBAAgB;CAGzB;AA8MD,eAAO,MAAM,6BAA6B;;;;;;;;;EASxC,CAAC;AAEH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGnE;AAsBD,wBAAgB,+BAA+B,CAAC,OAAO,EAAE;IACvD,UAAU,CAAC,EAAE,kBAAkB,CAAC;IAChC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACpC,GAAG,OAAO,CAIV;AAED,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AA8BjD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,KAAK,EAAE,aAAa,GAAG,SAAS,CAAC;IACjC,YAAY,EAAE,6BAA6B,CAAC;IAC5C,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,EAAE,aAAa,CAAC;CACxB,GAAG,cAAc,CAWjB;AAED,eAAO,MAAM,oBAAoB,EAAE,YAiBlC,CAAC"}

package/dist/vault/index.js

@@ -1,7 +1,5 @@
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync, } from "node:fs";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "node:fs";
 import { dirname, isAbsolute, join, normalize, sep } from "node:path";
-import { officeKey } from "../office/index.js";
-import { legacyConversationCredentialKey } from "../sandbox/identity.js";
 import { guestHomePath } from "../sandbox/layout.js";
 import { atomicWritePrivateFile, readTextFileIfExists } from "../file-guards.js";
 import { reportUserFacingError } from "../observability/index.js";
@@ -400,39 +398,6 @@ function inferredVaultTargetPath(relativePath) {
     }
     return defaultVaultTargetPath(normalized);
 }
-export function migrateConversationVaultKeys(options) {
-    const vaultsDir = join(options.stateDir, "vaults");
-    const migrated = [];
-    const conflicts = [];
-    if (!existsSync(vaultsDir))
-        return { migrated, conflicts };
-    const officesByConversationId = new Map();
-    for (const office of options.offices) {
-        const offices = officesByConversationId.get(office.conversationId) ?? [];
-        offices.push(office);
-        officesByConversationId.set(office.conversationId, offices);
-    }
-    for (const [conversationId, offices] of officesByConversationId) {
-        const legacyDir = join(vaultsDir, legacyConversationCredentialKey(conversationId));
-        if (!existsSync(legacyDir))
-            continue;
-        if (offices.length !== 1) {
-            conflicts.push(conversationId);
-            continue;
-        }
-        const office = offices[0];
-        if (!office)
-            throw new Error(`vault: missing office owner for ${conversationId}`);
-        const targetDir = join(vaultsDir, officeKey(office));
-        if (existsSync(targetDir)) {
-            conflicts.push(conversationId);
-            continue;
-        }
-        renameSync(legacyDir, targetDir);
-        migrated.push(conversationId);
-    }
-    return { migrated, conflicts };
-}
 export function allowsAmbientDefaultSharedVault(options) {
     const trustModel = options.trustModel ?? "membership";
     if (trustModel === "open-trigger")

package/dist/vault/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,SAAS,EACT,WAAW,EACX,UAAU,EACV,MAAM,GACP,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIlE,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAClC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AACxD,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC;AAEtE,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,gBAAgB,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAID,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAErC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,gBAAgB;IAI3B,YAAY,QAAgB;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED,SAAS;QACP,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,gBAAgB;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACnD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;aAC7F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,iBAAiB,CAAC,IAAY;QAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iBAAiB,CACf,IAAY,EACZ,SAAiB;QAEjB,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,EAAE,CAAC,CAAC;QAC1F,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,kBAAkB,CAAC,CAAC;QAE5F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,mCAAmC,CAAC,SAAS,CAAC,CAAC;QAC/C,mCAAmC,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE;YAClD,GAAG,aAAa;YAChB,GAAG,aAAa;SACjB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IACE,KAAK,CAAC,WAAW,EAAE;gBACnB,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBACpC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAC1B,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,GAAW,EAAE,GAA2B;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC;QACvC,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;aAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,YAAY,CAAC,GAAW,EAAE,MAAc;QACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,eAAe,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;aACrB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;aAC1C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU,CAAC,GAAW,EAAE,YAAoB,EAAE,OAAe,EAAE,UAAmB;QAChF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,cAAc,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC9D,IACE,CAAC,cAAc;YACf,cAAc,KAAK,yBAAyB;YAC5C,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,MAAM,YAAY,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC3C,mCAAmC,CAAC,GAAG,CAAC,CAAC;QAEzC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,GAAG;YAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAClF,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,mCAAmC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAEvF,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAErE,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,GAAG;YAChB,GAAG;YACH,MAAM;YACN,GAAG;SACJ,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IACnD,CAAC;CACF;AAED,SAAS,oBAAoB,CAC3B,GAAW,EACX,eAAuC;IAEvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,cAAc,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC;YAC/D,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;YAC7B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC;QACtC,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAC/E,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAe,EACf,WAAmB,EACnB,SAAiB,EACjB,eAAuC;IAEvC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrF,MAAM,YAAY,GAAG,GAAG,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC;YACjE,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC;YAC/B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;QACxC,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC5E,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mCAAmC,CAAC,GAAW;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAE5E,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;IAEvF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC9D,KAAK,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,cAAc,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,gBAAgB,GACpB,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,cAAc,KAAK,YAAY,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,YAAoB,EAAE,UAAmB;IAChF,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;;QACtD,OAAO,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;IACxC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAA+B;IACtE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,sBAAsB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7D,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpC,CAAC;AAOD,SAAS,YAAY,CAAC,SAAiB,EAAE,SAAiB;IACxD,MAAM,KAAK,GAAoB,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3D,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;QACxC,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,SAAiB,EAAE,KAAa;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,OAAO,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAEjE,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACrC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,UAAkB;IAC/D,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC;IAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;SAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,sBAAsB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9C,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;QAC1C,OAAO,CACL,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAC7F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAC,YAAoB;IACtD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAmB;IACnD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE3D,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,MAAM,CAAC;IACzD,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,YAAY,EAAE,UAAU;QACxB,UAAU,EAAE,aAAa,CAAC,8BAA8B,CAAC;KAC1D,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,YAAY,EAAE,iBAAiB;QAC/B,UAAU,EAAE,aAAa,CAAC,qDAAqD,CAAC;KACjF,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,OAAO,aAAa,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB;IACnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAChE,IAAI,UAAU,KAAK,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;IAC/D,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,OAAO,aAAa,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAG5C;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAE3D,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAA2B,CAAC;IACnE,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,uBAAuB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,MAAM,CAAC,cAAc,EAAE,OAAO,CAAC,IAAI,uBAAuB,EAAE,CAAC;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,+BAA+B,CAAC,cAAc,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,SAAS;QACrC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,cAAc,EAAE,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,UAAU,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAG/C;IACC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;IACtD,IAAI,UAAU,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,OAAO,CAAC,WAAW,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,KAAK,YAAY,CAAC;AACjF,CAAC;AAGD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,SAAS,qBAAqB,CAC5B,KAAgC,EAChC,WAAkC,EAClC,OAAsB;IAEtB,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,qBAAqB,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE;gBAChE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,iBAAiB;gBAC1B,SAAS,EAAE,gBAAgB;gBAC3B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE;oBACP,WAAW;oBACX,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;iBACzB;aACF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC9D,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,iBAAiB,WAAW,sCAAsC,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAElE,MAAM,GAAG,GACP,YAAY,CAAC,GAAG,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAiB;IAChD,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK;IACtB,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;IACrB,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS;IACxB,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE;IACd,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE;IAC1B,iBAAiB,EAAE,GAAG,EAAE,CAAC,KAAK;IAC9B,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAC/D,SAAS,EAAE,GAAG,EAAE;QACd,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,YAAY,EAAE,GAAG,EAAE;QACjB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,UAAU,EAAE,GAAG,EAAE;QACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;CACF,CAAC","sourcesContent":["import type { Dirent } from \"node:fs\";\nimport {\n  chmodSync,\n  copyFileSync,\n  existsSync,\n  mkdirSync,\n  readdirSync,\n  renameSync,\n  rmSync,\n} from \"node:fs\";\nimport { dirname, isAbsolute, join, normalize, sep } from \"node:path\";\nimport { officeKey } from \"../office/index.js\";\nimport { legacyConversationCredentialKey } from \"../sandbox/identity.js\";\nimport { guestHomePath } from \"../sandbox/layout.js\";\nimport type { OfficeAddress } from \"../types.js\";\nimport { atomicWritePrivateFile, readTextFileIfExists } from \"../file-guards.js\";\nimport { reportUserFacingError } from \"../observability/index.js\";\nimport type { SandboxConfig, SandboxCredentialCapabilities } from \"../sandbox/types.js\";\nimport type { PlatformTrustModel } from \"../types.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst SHARED_VAULT_DIR = \"shared\";\nconst LEGACY_MOUNT_TARGETS_FILE = \".mount-targets.json\";\nconst MOUNT_TARGETS_DIR = \"vault-mount-targets\";\nconst RESERVED_VAULT_DIRS = new Set([SHARED_VAULT_DIR, \"extensions\"]);\n\nexport function normalizeSharedVaultName(name: string): string | undefined {\n  const trimmed = name.trim();\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(trimmed)) return undefined;\n  return trimmed;\n}\n\nexport function sharedVaultKey(name: string): string | undefined {\n  const normalized = normalizeSharedVaultName(name);\n  return normalized ? `${SHARED_VAULT_DIR}/${normalized}` : undefined;\n}\n\nimport type { ResolvedVault, ResolvedVaultMount, VaultManager } from \"./types.js\";\n\nexport function parseEnvFile(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const line of content.split(/\\r\\n|\\r|\\n/)) {\n    const entry = parseEnvLine(line);\n    if (entry) env[entry[0]] = entry[1];\n  }\n  return env;\n}\n\nfunction parseEnvLine(line: string): [string, string] | undefined {\n  const trimmed = line.trim();\n  if (!trimmed || trimmed.startsWith(\"#\")) return undefined;\n\n  const eqIndex = trimmed.indexOf(\"=\");\n  if (eqIndex === -1) return undefined;\n\n  const key = trimmed.slice(0, eqIndex).trim();\n  if (!key) return undefined;\n  return [key, unquoteEnvValue(trimmed.slice(eqIndex + 1))];\n}\n\nfunction unquoteEnvValue(value: string): string {\n  const quote = value[0];\n  if ((quote === '\"' || quote === \"'\") && value.endsWith(quote)) return value.slice(1, -1);\n  return value;\n}\n\nexport class FileVaultManager implements VaultManager {\n  private readonly vaultsDir: string;\n  private readonly mountTargetsDir: string;\n\n  constructor(stateDir: string) {\n    this.vaultsDir = join(stateDir, \"vaults\");\n    this.mountTargetsDir = join(stateDir, MOUNT_TARGETS_DIR);\n  }\n\n  isEnabled(): boolean {\n    return existsSync(this.vaultsDir);\n  }\n\n  hasEntry(key: string): boolean {\n    if (!isSafeVaultKey(key)) return false;\n    return existsSync(join(this.vaultsDir, key));\n  }\n\n  listSharedVaults(): string[] {\n    const sharedDir = join(this.vaultsDir, SHARED_VAULT_DIR);\n    if (!existsSync(sharedDir)) return [];\n    return readdirSync(sharedDir, { withFileTypes: true })\n      .filter((entry) => entry.isDirectory() && normalizeSharedVaultName(entry.name) === entry.name)\n      .map((entry) => entry.name)\n      .toSorted((left, right) => left.localeCompare(right));\n  }\n\n  deleteSharedVault(name: string): boolean {\n    const key = sharedVaultKey(name);\n    if (!key) throw new Error(`vault: invalid shared login name: ${name}`);\n    const dir = join(this.vaultsDir, key);\n    const existed = existsSync(dir);\n    rmSync(dir, { recursive: true, force: true });\n    rmSync(this.mountTargetsPath(key), { force: true });\n    return existed;\n  }\n\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number } {\n    if (!isSafeVaultKey(targetKey)) throw new Error(`vault: invalid vault key: ${targetKey}`);\n    const sourceKey = sharedVaultKey(name);\n    if (!sourceKey) throw new Error(`vault: invalid shared login name: ${name}`);\n    const sourceDir = join(this.vaultsDir, sourceKey);\n    if (!existsSync(sourceDir)) throw new Error(`vault: shared login \"${name}\" does not exist`);\n\n    const targetDir = join(this.vaultsDir, targetKey);\n    assertNoLegacyMountTargetsCollision(sourceDir);\n    assertNoLegacyMountTargetsCollision(targetDir);\n    const sourceTargets = readMountTargets(this.mountTargetsPath(sourceKey));\n    const targetTargets = readMountTargets(this.mountTargetsPath(targetKey));\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(targetDir);\n    const result = copyVaultDir(sourceDir, targetDir);\n    writeMountTargets(this.mountTargetsPath(targetKey), {\n      ...targetTargets,\n      ...sourceTargets,\n    });\n    return result;\n  }\n\n  resolve(userId: string): ResolvedVault | undefined {\n    if (!isSafeVaultKey(userId)) return undefined;\n    const dir = join(this.vaultsDir, userId);\n    if (!existsSync(dir)) return undefined;\n    return this.buildResolved(userId);\n  }\n\n  list(): ResolvedVault[] {\n    if (!existsSync(this.vaultsDir)) return [];\n    const keys = new Set<string>();\n    for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {\n      if (\n        entry.isDirectory() &&\n        !RESERVED_VAULT_DIRS.has(entry.name) &&\n        isSafeVaultKey(entry.name)\n      ) {\n        keys.add(entry.name);\n      }\n    }\n    return Array.from(keys, (key) => this.buildResolved(key));\n  }\n\n  upsertEnv(key: string, env: Record<string, string>): void {\n    if (!isSafeVaultKey(key)) throw new Error(`vault: invalid vault key: ${key}`);\n    const dir = join(this.vaultsDir, key);\n    const envPath = join(dir, \"env\");\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const existingContent = readTextFileIfExists(envPath);\n    const existing = existingContent ? parseEnvFile(existingContent) : {};\n    const merged = { ...existing, ...env };\n    const content =\n      Object.entries(merged)\n        .toSorted(([left], [right]) => left.localeCompare(right))\n        .map(([envKey, value]) => `${envKey}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n  }\n\n  deleteEnvKey(key: string, envKey: string): boolean {\n    if (!isSafeVaultKey(key)) throw new Error(`vault: invalid vault key: ${key}`);\n    const envPath = join(this.vaultsDir, key, \"env\");\n    const existingContent = readTextFileIfExists(envPath);\n    if (existingContent === undefined) return false;\n    const existing = parseEnvFile(existingContent);\n    if (!(envKey in existing)) return false;\n    delete existing[envKey];\n    const content =\n      Object.entries(existing)\n        .toSorted(([left], [right]) => left.localeCompare(right))\n        .map(([name, value]) => `${name}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n    return true;\n  }\n\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void {\n    if (!isSafeVaultKey(key)) throw new Error(`vault: invalid vault key: ${key}`);\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    const normalizedTarget = normalizeVaultTargetPath(targetPath);\n    if (\n      !normalizedPath ||\n      normalizedPath === LEGACY_MOUNT_TARGETS_FILE ||\n      (targetPath !== undefined && !normalizedTarget)\n    ) {\n      throw new Error(`vault: invalid relative secret file path for \"${key}\": ${relativePath}`);\n    }\n\n    const dir = join(this.vaultsDir, key);\n    const filePath = join(dir, normalizedPath);\n    assertNoLegacyMountTargetsCollision(dir);\n\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const parentDir = dirname(filePath);\n    if (parentDir !== dir) ensurePrivateDir(parentDir);\n    atomicWritePrivateFile(filePath, content);\n    updateMountTarget(this.mountTargetsPath(key), normalizedPath, normalizedTarget);\n  }\n\n  private buildResolved(key: string): ResolvedVault {\n    const dir = join(this.vaultsDir, key);\n    assertNoLegacyMountTargetsCollision(dir);\n    const mounts = resolveMountsFromDir(dir, readMountTargets(this.mountTargetsPath(key)));\n\n    const envContent = readTextFileIfExists(join(dir, \"env\"));\n    const env = envContent === undefined ? {} : parseEnvFile(envContent);\n\n    return {\n      userId: key,\n      displayName: key,\n      dir,\n      mounts,\n      env,\n    };\n  }\n\n  private mountTargetsPath(key: string): string {\n    return join(this.mountTargetsDir, `${key}.json`);\n  }\n}\n\nfunction resolveMountsFromDir(\n  dir: string,\n  explicitTargets: Record<string, string>,\n): ResolvedVaultMount[] {\n  if (!existsSync(dir)) return [];\n\n  const mounts: ResolvedVaultMount[] = [];\n  for (const entry of readdirSync(dir, { withFileTypes: true })) {\n    if (entry.name === \"env\") continue;\n    const source = join(dir, entry.name);\n    const inferredTarget = inferredVaultTargetPath(entry.name);\n    if (!inferredTarget) continue;\n\n    const explicitTarget = Object.hasOwn(explicitTargets, entry.name)\n      ? explicitTargets[entry.name]\n      : undefined;\n    if (explicitTarget) {\n      mounts.push({ source, target: explicitTarget });\n      continue;\n    }\n\n    const nestedPrefix = `${entry.name}/`;\n    const hasExplicitDescendant = Object.keys(explicitTargets).some((relativePath) =>\n      relativePath.startsWith(nestedPrefix),\n    );\n    if (!entry.isDirectory() || !hasExplicitDescendant) {\n      mounts.push({ source, target: inferredTarget });\n      continue;\n    }\n    mounts.push(...resolveNestedMounts(dir, entry.name, inferredTarget, explicitTargets));\n  }\n  return mounts;\n}\n\nfunction resolveNestedMounts(\n  rootDir: string,\n  relativeDir: string,\n  targetDir: string,\n  explicitTargets: Record<string, string>,\n): ResolvedVaultMount[] {\n  const mounts: ResolvedVaultMount[] = [];\n  for (const entry of readdirSync(join(rootDir, relativeDir), { withFileTypes: true })) {\n    const relativePath = `${relativeDir}/${entry.name}`;\n    const source = join(rootDir, relativePath);\n    const inferredTarget = `${targetDir}/${entry.name}`;\n    const explicitTarget = Object.hasOwn(explicitTargets, relativePath)\n      ? explicitTargets[relativePath]\n      : undefined;\n    if (explicitTarget) {\n      mounts.push({ source, target: explicitTarget });\n      continue;\n    }\n\n    const nestedPrefix = `${relativePath}/`;\n    const hasExplicitDescendant = Object.keys(explicitTargets).some((candidate) =>\n      candidate.startsWith(nestedPrefix),\n    );\n    if (!entry.isDirectory() || !hasExplicitDescendant) {\n      mounts.push({ source, target: inferredTarget });\n      continue;\n    }\n    mounts.push(...resolveNestedMounts(rootDir, relativePath, inferredTarget, explicitTargets));\n  }\n  return mounts;\n}\n\nfunction assertNoLegacyMountTargetsCollision(dir: string): void {\n  const path = join(dir, LEGACY_MOUNT_TARGETS_FILE);\n  if (existsSync(path)) {\n    throw new Error(`vault: reserved mount metadata filename collision: ${path}`);\n  }\n}\n\nfunction readMountTargets(path: string): Record<string, string> {\n  const raw = readTextFileIfExists(path);\n  if (raw === undefined) return Object.create(null) as Record<string, string>;\n\n  let value: unknown;\n  try {\n    value = JSON.parse(raw);\n  } catch (error) {\n    throw new Error(`vault: invalid mount target metadata: ${path}`, { cause: error });\n  }\n  if (!isRecord(value)) throw new Error(`vault: invalid mount target metadata: ${path}`);\n\n  const targets = Object.create(null) as Record<string, string>;\n  for (const [relativePath, targetPath] of Object.entries(value)) {\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    const normalizedTarget =\n      typeof targetPath === \"string\" ? normalizeVaultTargetPath(targetPath) : undefined;\n    if (normalizedPath !== relativePath || !normalizedTarget || normalizedTarget !== targetPath) {\n      throw new Error(`vault: invalid mount target metadata: ${path}`);\n    }\n    targets[relativePath] = targetPath;\n  }\n  return targets;\n}\n\nfunction updateMountTarget(path: string, relativePath: string, targetPath?: string): void {\n  const targets = readMountTargets(path);\n  if (targetPath === undefined) delete targets[relativePath];\n  else targets[relativePath] = targetPath;\n  writeMountTargets(path, targets);\n}\n\nfunction writeMountTargets(path: string, targets: Record<string, string>): void {\n  if (Object.keys(targets).length === 0) {\n    rmSync(path, { force: true });\n    return;\n  }\n  ensurePrivateDir(dirname(path));\n  atomicWritePrivateFile(path, `${JSON.stringify(targets, null, 2)}\\n`);\n}\n\nfunction ensurePrivateDir(path: string): void {\n  mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });\n  chmodSync(path, PRIVATE_DIR_MODE);\n}\n\ninterface VaultCopyCounts {\n  filesCopied: number;\n  envKeysCopied: number;\n}\n\nfunction copyVaultDir(sourceDir: string, targetDir: string): VaultCopyCounts {\n  const total: VaultCopyCounts = { filesCopied: 0, envKeysCopied: 0 };\n  for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {\n    const counts = copyVaultEntry(sourceDir, targetDir, entry);\n    total.filesCopied += counts.filesCopied;\n    total.envKeysCopied += counts.envKeysCopied;\n  }\n  return total;\n}\n\nfunction copyVaultEntry(sourceDir: string, targetDir: string, entry: Dirent): VaultCopyCounts {\n  const sourcePath = join(sourceDir, entry.name);\n  const targetPath = join(targetDir, entry.name);\n\n  if (entry.name === \"env\" && entry.isFile()) {\n    return { filesCopied: 0, envKeysCopied: mergeVaultEnvFile(sourcePath, targetPath) };\n  }\n  if (entry.isDirectory()) {\n    ensurePrivateDir(targetPath);\n    return copyVaultDir(sourcePath, targetPath);\n  }\n  if (!entry.isFile()) return { filesCopied: 0, envKeysCopied: 0 };\n\n  copyFileSync(sourcePath, targetPath);\n  chmodSync(targetPath, 0o600);\n  return { filesCopied: 1, envKeysCopied: 0 };\n}\n\nfunction mergeVaultEnvFile(sourcePath: string, targetPath: string): number {\n  const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? \"\");\n  const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? \"\");\n  const merged = { ...targetEnv, ...sourceEnv };\n  const content =\n    Object.entries(merged)\n      .toSorted(([left], [right]) => left.localeCompare(right))\n      .map(([envKey, value]) => `${envKey}=${value}`)\n      .join(\"\\n\") + \"\\n\";\n  atomicWritePrivateFile(targetPath, content);\n  return Object.keys(sourceEnv).length;\n}\n\nfunction isSafeVaultKey(key: unknown): key is string {\n  if (typeof key !== \"string\" || !key || isAbsolute(key)) return false;\n  if (/^[A-Za-z]:[\\\\/]/.test(key)) return false;\n\n  return key.split(/[\\\\/]/).every((segment) => {\n    return (\n      segment !== \"\" && segment !== \".\" && segment !== \"..\" && !hasUnsafeControlCharacter(segment)\n    );\n  });\n}\n\nfunction hasUnsafeControlCharacter(value: string): boolean {\n  return Array.from(value).some((character) => {\n    const code = character.codePointAt(0) ?? 0;\n    return (code >= 0 && code <= 31) || (code >= 127 && code <= 159);\n  });\n}\n\nfunction normalizeVaultRelativePath(relativePath: string): string | undefined {\n  const trimmed = relativePath.trim();\n  if (!trimmed || isAbsolute(trimmed)) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  if (!normalized || normalized === \".\" || normalized === \"..\" || normalized.startsWith(\"../\")) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction normalizeVaultTargetPath(targetPath?: string): string | undefined {\n  if (targetPath === undefined) return undefined;\n\n  const trimmed = targetPath.trim();\n  if (!trimmed || !trimmed.startsWith(\"/\")) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  return normalized.startsWith(\"/\") ? normalized : undefined;\n}\n\nexport const GOOGLE_VAULT_CREDENTIAL_FILES = Object.freeze({\n  workspaceCli: Object.freeze({\n    relativePath: \"gws.json\",\n    targetPath: guestHomePath(\".config/gws/credentials.json\"),\n  }),\n  cloudSdk: Object.freeze({\n    relativePath: \"gcloud-adc.json\",\n    targetPath: guestHomePath(\".config/gcloud/application_default_credentials.json\"),\n  }),\n});\n\nexport function defaultVaultTargetPath(relativePath: string): string {\n  const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\\/+/, \"\");\n  return guestHomePath(normalized);\n}\n\nfunction inferredVaultTargetPath(relativePath: string): string | undefined {\n  const normalized = normalizeVaultRelativePath(relativePath);\n  if (!normalized) return undefined;\n\n  for (const file of Object.values(GOOGLE_VAULT_CREDENTIAL_FILES)) {\n    if (normalized === file.relativePath) return file.targetPath;\n  }\n  if (normalized === \".ssh\" || normalized.startsWith(\".ssh/\")) {\n    return guestHomePath(\".ssh\");\n  }\n  if (normalized === \".kube\" || normalized.startsWith(\".kube/\")) {\n    return guestHomePath(\".kube\");\n  }\n  if (normalized === \".config/gh\" || normalized.startsWith(\".config/gh/\")) {\n    return guestHomePath(\".config/gh\");\n  }\n\n  return defaultVaultTargetPath(normalized);\n}\n\nexport function migrateConversationVaultKeys(options: {\n  stateDir: string;\n  offices: readonly OfficeAddress[];\n}): { migrated: string[]; conflicts: string[] } {\n  const vaultsDir = join(options.stateDir, \"vaults\");\n  const migrated: string[] = [];\n  const conflicts: string[] = [];\n  if (!existsSync(vaultsDir)) return { migrated, conflicts };\n\n  const officesByConversationId = new Map<string, OfficeAddress[]>();\n  for (const office of options.offices) {\n    const offices = officesByConversationId.get(office.conversationId) ?? [];\n    offices.push(office);\n    officesByConversationId.set(office.conversationId, offices);\n  }\n  for (const [conversationId, offices] of officesByConversationId) {\n    const legacyDir = join(vaultsDir, legacyConversationCredentialKey(conversationId));\n    if (!existsSync(legacyDir)) continue;\n    if (offices.length !== 1) {\n      conflicts.push(conversationId);\n      continue;\n    }\n\n    const office = offices[0];\n    if (!office) throw new Error(`vault: missing office owner for ${conversationId}`);\n    const targetDir = join(vaultsDir, officeKey(office));\n    if (existsSync(targetDir)) {\n      conflicts.push(conversationId);\n      continue;\n    }\n    renameSync(legacyDir, targetDir);\n    migrated.push(conversationId);\n  }\n  return { migrated, conflicts };\n}\n\nexport function allowsAmbientDefaultSharedVault(options: {\n  trustModel?: PlatformTrustModel;\n  sandboxType: SandboxConfig[\"type\"];\n}): boolean {\n  const trustModel = options.trustModel ?? \"membership\";\n  if (trustModel === \"open-trigger\") return false;\n  return options.sandboxType === \"image\" || options.sandboxType === \"cloudflare\";\n}\n\nimport type { VaultInjection } from \"./types.js\";\nimport { isRecord } from \"../unknown-values.js\";\n\nfunction resolveExistingMounts(\n  vault: ResolvedVault | undefined,\n  sandboxType: SandboxConfig[\"type\"],\n  address: OfficeAddress,\n): ResolvedVaultMount[] {\n  const mounts: ResolvedVaultMount[] = [];\n  for (const mount of vault?.mounts ?? []) {\n    if (!existsSync(mount.source)) {\n      reportUserFacingError(new Error(\"Vault mount source is missing\"), {\n        domain: \"sandbox\",\n        surface: \"vault_injection\",\n        operation: \"resolve_mounts\",\n        severity: \"warning\",\n        context: {\n          sandboxType,\n          conversationId: address.conversationId,\n          target: mount.target,\n          hasVault: Boolean(vault),\n        },\n      });\n      continue;\n    }\n    mounts.push({ source: mount.source, target: mount.target });\n  }\n  return mounts;\n}\n\nexport function resolveVaultInjection(options: {\n  vault: ResolvedVault | undefined;\n  capabilities: SandboxCredentialCapabilities;\n  sandboxType: SandboxConfig[\"type\"];\n  address: OfficeAddress;\n}): VaultInjection {\n  const { vault, capabilities, sandboxType, address } = options;\n  if (vault && vault.mounts.length > 0 && !capabilities.fileMounts) {\n    throw new Error(`Sandbox type \"${sandboxType}\" does not support vault file mounts`);\n  }\n\n  const mounts = resolveExistingMounts(vault, sandboxType, address);\n\n  const env =\n    capabilities.env && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n  return { env, mounts };\n}\n\nexport const disabledVaultManager: VaultManager = {\n  isEnabled: () => false,\n  hasEntry: () => false,\n  resolve: () => undefined,\n  list: () => [],\n  listSharedVaults: () => [],\n  deleteSharedVault: () => false,\n  copySharedVaultTo: () => ({ filesCopied: 0, envKeysCopied: 0 }),\n  upsertEnv: () => {\n    throw new Error(\"Vault not configured\");\n  },\n  deleteEnvKey: () => {\n    throw new Error(\"Vault not configured\");\n  },\n  upsertFile: () => {\n    throw new Error(\"Vault not configured\");\n  },\n};\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/vault/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9F,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAIlE,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAClC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AACxD,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AAChD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC,CAAC;AAEtE,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,gBAAgB,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAID,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE1D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,KAAK,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAErC,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,gBAAgB;IAI3B,YAAY,QAAgB;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC3D,CAAC;IAED,SAAS;QACP,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,gBAAgB;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACnD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;aAC7F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,iBAAiB,CAAC,IAAY;QAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iBAAiB,CACf,IAAY,EACZ,SAAiB;QAEjB,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,EAAE,CAAC,CAAC;QAC1F,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,kBAAkB,CAAC,CAAC;QAE5F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,mCAAmC,CAAC,SAAS,CAAC,CAAC;QAC/C,mCAAmC,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,MAAM,aAAa,GAAG,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;QACzE,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE;YAClD,GAAG,aAAa;YAChB,GAAG,aAAa;SACjB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IACE,KAAK,CAAC,WAAW,EAAE;gBACnB,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBACpC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAC1B,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,GAAW,EAAE,GAA2B;QAChD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC;QACvC,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;aAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,YAAY,CAAC,GAAW,EAAE,MAAc;QACtC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,eAAe,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxB,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;aACrB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;aAC1C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,UAAU,CAAC,GAAW,EAAE,YAAoB,EAAE,OAAe,EAAE,UAAmB;QAChF,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,cAAc,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAC9D,IACE,CAAC,cAAc;YACf,cAAc,KAAK,yBAAyB;YAC5C,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,EAC/C,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,MAAM,YAAY,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC3C,mCAAmC,CAAC,GAAG,CAAC,CAAC;QAEzC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,GAAG;YAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC1C,iBAAiB,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,cAAc,EAAE,gBAAgB,CAAC,CAAC;IAClF,CAAC;IAEO,aAAa,CAAC,GAAW;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,mCAAmC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAEvF,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAErE,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,GAAG;YAChB,GAAG;YACH,MAAM;YACN,GAAG;SACJ,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;IACnD,CAAC;CACF;AAED,SAAS,oBAAoB,CAC3B,GAAW,EACX,eAAuC;IAEvC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,cAAc,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,cAAc;YAAE,SAAS;QAE9B,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC;YAC/D,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;YAC7B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC;QACtC,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CAC/E,YAAY,CAAC,UAAU,CAAC,YAAY,CAAC,CACtC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAAe,EACf,WAAmB,EACnB,SAAiB,EACjB,eAAuC;IAEvC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACrF,MAAM,YAAY,GAAG,GAAG,WAAW,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC3C,MAAM,cAAc,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QACpD,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,YAAY,CAAC;YACjE,CAAC,CAAC,eAAe,CAAC,YAAY,CAAC;YAC/B,CAAC,CAAC,SAAS,CAAC;QACd,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,GAAG,YAAY,GAAG,CAAC;QACxC,MAAM,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAC5E,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CACnC,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,mCAAmC,CAAC,GAAW;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,sDAAsD,IAAI,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAE5E,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;IAEvF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAA2B,CAAC;IAC9D,KAAK,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,cAAc,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,gBAAgB,GACpB,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,IAAI,cAAc,KAAK,YAAY,IAAI,CAAC,gBAAgB,IAAI,gBAAgB,KAAK,UAAU,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;IACrC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,YAAoB,EAAE,UAAmB;IAChF,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;;QACtD,OAAO,CAAC,YAAY,CAAC,GAAG,UAAU,CAAC;IACxC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,OAA+B;IACtE,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,sBAAsB,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7D,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpC,CAAC;AAOD,SAAS,YAAY,CAAC,SAAiB,EAAE,SAAiB;IACxD,MAAM,KAAK,GAAoB,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC3D,KAAK,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;QACxC,KAAK,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC;IAC9C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB,EAAE,SAAiB,EAAE,KAAa;IACzE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAE/C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;QAC3C,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,iBAAiB,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACxB,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,OAAO,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAEjE,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACrC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7B,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB,EAAE,UAAkB;IAC/D,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC;IAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;SAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACvB,sBAAsB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;AACvC,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrE,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9C,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE;QAC1C,OAAO,CACL,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAC7F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,0BAA0B,CAAC,YAAoB;IACtD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAmB;IACnD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE3D,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAG,MAAM,CAAC,MAAM,CAAC;IACzD,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC;QAC1B,YAAY,EAAE,UAAU;QACxB,UAAU,EAAE,aAAa,CAAC,8BAA8B,CAAC;KAC1D,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,YAAY,EAAE,iBAAiB;QAC/B,UAAU,EAAE,aAAa,CAAC,qDAAqD,CAAC;KACjF,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,OAAO,aAAa,CAAC,UAAU,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB;IACnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,EAAE,CAAC;QAChE,IAAI,UAAU,KAAK,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;IAC/D,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,OAAO,aAAa,CAAC,YAAY,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,OAG/C;IACC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;IACtD,IAAI,UAAU,KAAK,cAAc;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,OAAO,CAAC,WAAW,KAAK,OAAO,IAAI,OAAO,CAAC,WAAW,KAAK,YAAY,CAAC;AACjF,CAAC;AAGD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,SAAS,qBAAqB,CAC5B,KAAgC,EAChC,WAAkC,EAClC,OAAsB;IAEtB,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,qBAAqB,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,EAAE;gBAChE,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,iBAAiB;gBAC1B,SAAS,EAAE,gBAAgB;gBAC3B,QAAQ,EAAE,SAAS;gBACnB,OAAO,EAAE;oBACP,WAAW;oBACX,cAAc,EAAE,OAAO,CAAC,cAAc;oBACtC,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC;iBACzB;aACF,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAKrC;IACC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC9D,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,iBAAiB,WAAW,sCAAsC,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAElE,MAAM,GAAG,GACP,YAAY,CAAC,GAAG,IAAI,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAiB;IAChD,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK;IACtB,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;IACrB,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS;IACxB,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE;IACd,gBAAgB,EAAE,GAAG,EAAE,CAAC,EAAE;IAC1B,iBAAiB,EAAE,GAAG,EAAE,CAAC,KAAK;IAC9B,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAC/D,SAAS,EAAE,GAAG,EAAE;QACd,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,YAAY,EAAE,GAAG,EAAE;QACjB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IACD,UAAU,EAAE,GAAG,EAAE;QACf,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;CACF,CAAC","sourcesContent":["import type { Dirent } from \"node:fs\";\nimport { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, rmSync } from \"node:fs\";\nimport { dirname, isAbsolute, join, normalize, sep } from \"node:path\";\nimport { guestHomePath } from \"../sandbox/layout.js\";\nimport type { OfficeAddress } from \"../types.js\";\nimport { atomicWritePrivateFile, readTextFileIfExists } from \"../file-guards.js\";\nimport { reportUserFacingError } from \"../observability/index.js\";\nimport type { SandboxConfig, SandboxCredentialCapabilities } from \"../sandbox/types.js\";\nimport type { PlatformTrustModel } from \"../types.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst SHARED_VAULT_DIR = \"shared\";\nconst LEGACY_MOUNT_TARGETS_FILE = \".mount-targets.json\";\nconst MOUNT_TARGETS_DIR = \"vault-mount-targets\";\nconst RESERVED_VAULT_DIRS = new Set([SHARED_VAULT_DIR, \"extensions\"]);\n\nexport function normalizeSharedVaultName(name: string): string | undefined {\n  const trimmed = name.trim();\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(trimmed)) return undefined;\n  return trimmed;\n}\n\nexport function sharedVaultKey(name: string): string | undefined {\n  const normalized = normalizeSharedVaultName(name);\n  return normalized ? `${SHARED_VAULT_DIR}/${normalized}` : undefined;\n}\n\nimport type { ResolvedVault, ResolvedVaultMount, VaultManager } from \"./types.js\";\n\nexport function parseEnvFile(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const line of content.split(/\\r\\n|\\r|\\n/)) {\n    const entry = parseEnvLine(line);\n    if (entry) env[entry[0]] = entry[1];\n  }\n  return env;\n}\n\nfunction parseEnvLine(line: string): [string, string] | undefined {\n  const trimmed = line.trim();\n  if (!trimmed || trimmed.startsWith(\"#\")) return undefined;\n\n  const eqIndex = trimmed.indexOf(\"=\");\n  if (eqIndex === -1) return undefined;\n\n  const key = trimmed.slice(0, eqIndex).trim();\n  if (!key) return undefined;\n  return [key, unquoteEnvValue(trimmed.slice(eqIndex + 1))];\n}\n\nfunction unquoteEnvValue(value: string): string {\n  const quote = value[0];\n  if ((quote === '\"' || quote === \"'\") && value.endsWith(quote)) return value.slice(1, -1);\n  return value;\n}\n\nexport class FileVaultManager implements VaultManager {\n  private readonly vaultsDir: string;\n  private readonly mountTargetsDir: string;\n\n  constructor(stateDir: string) {\n    this.vaultsDir = join(stateDir, \"vaults\");\n    this.mountTargetsDir = join(stateDir, MOUNT_TARGETS_DIR);\n  }\n\n  isEnabled(): boolean {\n    return existsSync(this.vaultsDir);\n  }\n\n  hasEntry(key: string): boolean {\n    if (!isSafeVaultKey(key)) return false;\n    return existsSync(join(this.vaultsDir, key));\n  }\n\n  listSharedVaults(): string[] {\n    const sharedDir = join(this.vaultsDir, SHARED_VAULT_DIR);\n    if (!existsSync(sharedDir)) return [];\n    return readdirSync(sharedDir, { withFileTypes: true })\n      .filter((entry) => entry.isDirectory() && normalizeSharedVaultName(entry.name) === entry.name)\n      .map((entry) => entry.name)\n      .toSorted((left, right) => left.localeCompare(right));\n  }\n\n  deleteSharedVault(name: string): boolean {\n    const key = sharedVaultKey(name);\n    if (!key) throw new Error(`vault: invalid shared login name: ${name}`);\n    const dir = join(this.vaultsDir, key);\n    const existed = existsSync(dir);\n    rmSync(dir, { recursive: true, force: true });\n    rmSync(this.mountTargetsPath(key), { force: true });\n    return existed;\n  }\n\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number } {\n    if (!isSafeVaultKey(targetKey)) throw new Error(`vault: invalid vault key: ${targetKey}`);\n    const sourceKey = sharedVaultKey(name);\n    if (!sourceKey) throw new Error(`vault: invalid shared login name: ${name}`);\n    const sourceDir = join(this.vaultsDir, sourceKey);\n    if (!existsSync(sourceDir)) throw new Error(`vault: shared login \"${name}\" does not exist`);\n\n    const targetDir = join(this.vaultsDir, targetKey);\n    assertNoLegacyMountTargetsCollision(sourceDir);\n    assertNoLegacyMountTargetsCollision(targetDir);\n    const sourceTargets = readMountTargets(this.mountTargetsPath(sourceKey));\n    const targetTargets = readMountTargets(this.mountTargetsPath(targetKey));\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(targetDir);\n    const result = copyVaultDir(sourceDir, targetDir);\n    writeMountTargets(this.mountTargetsPath(targetKey), {\n      ...targetTargets,\n      ...sourceTargets,\n    });\n    return result;\n  }\n\n  resolve(userId: string): ResolvedVault | undefined {\n    if (!isSafeVaultKey(userId)) return undefined;\n    const dir = join(this.vaultsDir, userId);\n    if (!existsSync(dir)) return undefined;\n    return this.buildResolved(userId);\n  }\n\n  list(): ResolvedVault[] {\n    if (!existsSync(this.vaultsDir)) return [];\n    const keys = new Set<string>();\n    for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {\n      if (\n        entry.isDirectory() &&\n        !RESERVED_VAULT_DIRS.has(entry.name) &&\n        isSafeVaultKey(entry.name)\n      ) {\n        keys.add(entry.name);\n      }\n    }\n    return Array.from(keys, (key) => this.buildResolved(key));\n  }\n\n  upsertEnv(key: string, env: Record<string, string>): void {\n    if (!isSafeVaultKey(key)) throw new Error(`vault: invalid vault key: ${key}`);\n    const dir = join(this.vaultsDir, key);\n    const envPath = join(dir, \"env\");\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const existingContent = readTextFileIfExists(envPath);\n    const existing = existingContent ? parseEnvFile(existingContent) : {};\n    const merged = { ...existing, ...env };\n    const content =\n      Object.entries(merged)\n        .toSorted(([left], [right]) => left.localeCompare(right))\n        .map(([envKey, value]) => `${envKey}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n  }\n\n  deleteEnvKey(key: string, envKey: string): boolean {\n    if (!isSafeVaultKey(key)) throw new Error(`vault: invalid vault key: ${key}`);\n    const envPath = join(this.vaultsDir, key, \"env\");\n    const existingContent = readTextFileIfExists(envPath);\n    if (existingContent === undefined) return false;\n    const existing = parseEnvFile(existingContent);\n    if (!(envKey in existing)) return false;\n    delete existing[envKey];\n    const content =\n      Object.entries(existing)\n        .toSorted(([left], [right]) => left.localeCompare(right))\n        .map(([name, value]) => `${name}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n    return true;\n  }\n\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void {\n    if (!isSafeVaultKey(key)) throw new Error(`vault: invalid vault key: ${key}`);\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    const normalizedTarget = normalizeVaultTargetPath(targetPath);\n    if (\n      !normalizedPath ||\n      normalizedPath === LEGACY_MOUNT_TARGETS_FILE ||\n      (targetPath !== undefined && !normalizedTarget)\n    ) {\n      throw new Error(`vault: invalid relative secret file path for \"${key}\": ${relativePath}`);\n    }\n\n    const dir = join(this.vaultsDir, key);\n    const filePath = join(dir, normalizedPath);\n    assertNoLegacyMountTargetsCollision(dir);\n\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const parentDir = dirname(filePath);\n    if (parentDir !== dir) ensurePrivateDir(parentDir);\n    atomicWritePrivateFile(filePath, content);\n    updateMountTarget(this.mountTargetsPath(key), normalizedPath, normalizedTarget);\n  }\n\n  private buildResolved(key: string): ResolvedVault {\n    const dir = join(this.vaultsDir, key);\n    assertNoLegacyMountTargetsCollision(dir);\n    const mounts = resolveMountsFromDir(dir, readMountTargets(this.mountTargetsPath(key)));\n\n    const envContent = readTextFileIfExists(join(dir, \"env\"));\n    const env = envContent === undefined ? {} : parseEnvFile(envContent);\n\n    return {\n      userId: key,\n      displayName: key,\n      dir,\n      mounts,\n      env,\n    };\n  }\n\n  private mountTargetsPath(key: string): string {\n    return join(this.mountTargetsDir, `${key}.json`);\n  }\n}\n\nfunction resolveMountsFromDir(\n  dir: string,\n  explicitTargets: Record<string, string>,\n): ResolvedVaultMount[] {\n  if (!existsSync(dir)) return [];\n\n  const mounts: ResolvedVaultMount[] = [];\n  for (const entry of readdirSync(dir, { withFileTypes: true })) {\n    if (entry.name === \"env\") continue;\n    const source = join(dir, entry.name);\n    const inferredTarget = inferredVaultTargetPath(entry.name);\n    if (!inferredTarget) continue;\n\n    const explicitTarget = Object.hasOwn(explicitTargets, entry.name)\n      ? explicitTargets[entry.name]\n      : undefined;\n    if (explicitTarget) {\n      mounts.push({ source, target: explicitTarget });\n      continue;\n    }\n\n    const nestedPrefix = `${entry.name}/`;\n    const hasExplicitDescendant = Object.keys(explicitTargets).some((relativePath) =>\n      relativePath.startsWith(nestedPrefix),\n    );\n    if (!entry.isDirectory() || !hasExplicitDescendant) {\n      mounts.push({ source, target: inferredTarget });\n      continue;\n    }\n    mounts.push(...resolveNestedMounts(dir, entry.name, inferredTarget, explicitTargets));\n  }\n  return mounts;\n}\n\nfunction resolveNestedMounts(\n  rootDir: string,\n  relativeDir: string,\n  targetDir: string,\n  explicitTargets: Record<string, string>,\n): ResolvedVaultMount[] {\n  const mounts: ResolvedVaultMount[] = [];\n  for (const entry of readdirSync(join(rootDir, relativeDir), { withFileTypes: true })) {\n    const relativePath = `${relativeDir}/${entry.name}`;\n    const source = join(rootDir, relativePath);\n    const inferredTarget = `${targetDir}/${entry.name}`;\n    const explicitTarget = Object.hasOwn(explicitTargets, relativePath)\n      ? explicitTargets[relativePath]\n      : undefined;\n    if (explicitTarget) {\n      mounts.push({ source, target: explicitTarget });\n      continue;\n    }\n\n    const nestedPrefix = `${relativePath}/`;\n    const hasExplicitDescendant = Object.keys(explicitTargets).some((candidate) =>\n      candidate.startsWith(nestedPrefix),\n    );\n    if (!entry.isDirectory() || !hasExplicitDescendant) {\n      mounts.push({ source, target: inferredTarget });\n      continue;\n    }\n    mounts.push(...resolveNestedMounts(rootDir, relativePath, inferredTarget, explicitTargets));\n  }\n  return mounts;\n}\n\nfunction assertNoLegacyMountTargetsCollision(dir: string): void {\n  const path = join(dir, LEGACY_MOUNT_TARGETS_FILE);\n  if (existsSync(path)) {\n    throw new Error(`vault: reserved mount metadata filename collision: ${path}`);\n  }\n}\n\nfunction readMountTargets(path: string): Record<string, string> {\n  const raw = readTextFileIfExists(path);\n  if (raw === undefined) return Object.create(null) as Record<string, string>;\n\n  let value: unknown;\n  try {\n    value = JSON.parse(raw);\n  } catch (error) {\n    throw new Error(`vault: invalid mount target metadata: ${path}`, { cause: error });\n  }\n  if (!isRecord(value)) throw new Error(`vault: invalid mount target metadata: ${path}`);\n\n  const targets = Object.create(null) as Record<string, string>;\n  for (const [relativePath, targetPath] of Object.entries(value)) {\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    const normalizedTarget =\n      typeof targetPath === \"string\" ? normalizeVaultTargetPath(targetPath) : undefined;\n    if (normalizedPath !== relativePath || !normalizedTarget || normalizedTarget !== targetPath) {\n      throw new Error(`vault: invalid mount target metadata: ${path}`);\n    }\n    targets[relativePath] = targetPath;\n  }\n  return targets;\n}\n\nfunction updateMountTarget(path: string, relativePath: string, targetPath?: string): void {\n  const targets = readMountTargets(path);\n  if (targetPath === undefined) delete targets[relativePath];\n  else targets[relativePath] = targetPath;\n  writeMountTargets(path, targets);\n}\n\nfunction writeMountTargets(path: string, targets: Record<string, string>): void {\n  if (Object.keys(targets).length === 0) {\n    rmSync(path, { force: true });\n    return;\n  }\n  ensurePrivateDir(dirname(path));\n  atomicWritePrivateFile(path, `${JSON.stringify(targets, null, 2)}\\n`);\n}\n\nfunction ensurePrivateDir(path: string): void {\n  mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });\n  chmodSync(path, PRIVATE_DIR_MODE);\n}\n\ninterface VaultCopyCounts {\n  filesCopied: number;\n  envKeysCopied: number;\n}\n\nfunction copyVaultDir(sourceDir: string, targetDir: string): VaultCopyCounts {\n  const total: VaultCopyCounts = { filesCopied: 0, envKeysCopied: 0 };\n  for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {\n    const counts = copyVaultEntry(sourceDir, targetDir, entry);\n    total.filesCopied += counts.filesCopied;\n    total.envKeysCopied += counts.envKeysCopied;\n  }\n  return total;\n}\n\nfunction copyVaultEntry(sourceDir: string, targetDir: string, entry: Dirent): VaultCopyCounts {\n  const sourcePath = join(sourceDir, entry.name);\n  const targetPath = join(targetDir, entry.name);\n\n  if (entry.name === \"env\" && entry.isFile()) {\n    return { filesCopied: 0, envKeysCopied: mergeVaultEnvFile(sourcePath, targetPath) };\n  }\n  if (entry.isDirectory()) {\n    ensurePrivateDir(targetPath);\n    return copyVaultDir(sourcePath, targetPath);\n  }\n  if (!entry.isFile()) return { filesCopied: 0, envKeysCopied: 0 };\n\n  copyFileSync(sourcePath, targetPath);\n  chmodSync(targetPath, 0o600);\n  return { filesCopied: 1, envKeysCopied: 0 };\n}\n\nfunction mergeVaultEnvFile(sourcePath: string, targetPath: string): number {\n  const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? \"\");\n  const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? \"\");\n  const merged = { ...targetEnv, ...sourceEnv };\n  const content =\n    Object.entries(merged)\n      .toSorted(([left], [right]) => left.localeCompare(right))\n      .map(([envKey, value]) => `${envKey}=${value}`)\n      .join(\"\\n\") + \"\\n\";\n  atomicWritePrivateFile(targetPath, content);\n  return Object.keys(sourceEnv).length;\n}\n\nfunction isSafeVaultKey(key: unknown): key is string {\n  if (typeof key !== \"string\" || !key || isAbsolute(key)) return false;\n  if (/^[A-Za-z]:[\\\\/]/.test(key)) return false;\n\n  return key.split(/[\\\\/]/).every((segment) => {\n    return (\n      segment !== \"\" && segment !== \".\" && segment !== \"..\" && !hasUnsafeControlCharacter(segment)\n    );\n  });\n}\n\nfunction hasUnsafeControlCharacter(value: string): boolean {\n  return Array.from(value).some((character) => {\n    const code = character.codePointAt(0) ?? 0;\n    return (code >= 0 && code <= 31) || (code >= 127 && code <= 159);\n  });\n}\n\nfunction normalizeVaultRelativePath(relativePath: string): string | undefined {\n  const trimmed = relativePath.trim();\n  if (!trimmed || isAbsolute(trimmed)) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  if (!normalized || normalized === \".\" || normalized === \"..\" || normalized.startsWith(\"../\")) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction normalizeVaultTargetPath(targetPath?: string): string | undefined {\n  if (targetPath === undefined) return undefined;\n\n  const trimmed = targetPath.trim();\n  if (!trimmed || !trimmed.startsWith(\"/\")) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  return normalized.startsWith(\"/\") ? normalized : undefined;\n}\n\nexport const GOOGLE_VAULT_CREDENTIAL_FILES = Object.freeze({\n  workspaceCli: Object.freeze({\n    relativePath: \"gws.json\",\n    targetPath: guestHomePath(\".config/gws/credentials.json\"),\n  }),\n  cloudSdk: Object.freeze({\n    relativePath: \"gcloud-adc.json\",\n    targetPath: guestHomePath(\".config/gcloud/application_default_credentials.json\"),\n  }),\n});\n\nexport function defaultVaultTargetPath(relativePath: string): string {\n  const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\\/+/, \"\");\n  return guestHomePath(normalized);\n}\n\nfunction inferredVaultTargetPath(relativePath: string): string | undefined {\n  const normalized = normalizeVaultRelativePath(relativePath);\n  if (!normalized) return undefined;\n\n  for (const file of Object.values(GOOGLE_VAULT_CREDENTIAL_FILES)) {\n    if (normalized === file.relativePath) return file.targetPath;\n  }\n  if (normalized === \".ssh\" || normalized.startsWith(\".ssh/\")) {\n    return guestHomePath(\".ssh\");\n  }\n  if (normalized === \".kube\" || normalized.startsWith(\".kube/\")) {\n    return guestHomePath(\".kube\");\n  }\n  if (normalized === \".config/gh\" || normalized.startsWith(\".config/gh/\")) {\n    return guestHomePath(\".config/gh\");\n  }\n\n  return defaultVaultTargetPath(normalized);\n}\n\nexport function allowsAmbientDefaultSharedVault(options: {\n  trustModel?: PlatformTrustModel;\n  sandboxType: SandboxConfig[\"type\"];\n}): boolean {\n  const trustModel = options.trustModel ?? \"membership\";\n  if (trustModel === \"open-trigger\") return false;\n  return options.sandboxType === \"image\" || options.sandboxType === \"cloudflare\";\n}\n\nimport type { VaultInjection } from \"./types.js\";\nimport { isRecord } from \"../unknown-values.js\";\n\nfunction resolveExistingMounts(\n  vault: ResolvedVault | undefined,\n  sandboxType: SandboxConfig[\"type\"],\n  address: OfficeAddress,\n): ResolvedVaultMount[] {\n  const mounts: ResolvedVaultMount[] = [];\n  for (const mount of vault?.mounts ?? []) {\n    if (!existsSync(mount.source)) {\n      reportUserFacingError(new Error(\"Vault mount source is missing\"), {\n        domain: \"sandbox\",\n        surface: \"vault_injection\",\n        operation: \"resolve_mounts\",\n        severity: \"warning\",\n        context: {\n          sandboxType,\n          conversationId: address.conversationId,\n          target: mount.target,\n          hasVault: Boolean(vault),\n        },\n      });\n      continue;\n    }\n    mounts.push({ source: mount.source, target: mount.target });\n  }\n  return mounts;\n}\n\nexport function resolveVaultInjection(options: {\n  vault: ResolvedVault | undefined;\n  capabilities: SandboxCredentialCapabilities;\n  sandboxType: SandboxConfig[\"type\"];\n  address: OfficeAddress;\n}): VaultInjection {\n  const { vault, capabilities, sandboxType, address } = options;\n  if (vault && vault.mounts.length > 0 && !capabilities.fileMounts) {\n    throw new Error(`Sandbox type \"${sandboxType}\" does not support vault file mounts`);\n  }\n\n  const mounts = resolveExistingMounts(vault, sandboxType, address);\n\n  const env =\n    capabilities.env && vault && Object.keys(vault.env).length > 0 ? vault.env : undefined;\n  return { env, mounts };\n}\n\nexport const disabledVaultManager: VaultManager = {\n  isEnabled: () => false,\n  hasEntry: () => false,\n  resolve: () => undefined,\n  list: () => [],\n  listSharedVaults: () => [],\n  deleteSharedVault: () => false,\n  copySharedVaultTo: () => ({ filesCopied: 0, envKeysCopied: 0 }),\n  upsertEnv: () => {\n    throw new Error(\"Vault not configured\");\n  },\n  deleteEnvKey: () => {\n    throw new Error(\"Vault not configured\");\n  },\n  upsertFile: () => {\n    throw new Error(\"Vault not configured\");\n  },\n};\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geminixiang/mikan",
-  "version": "1.0.0-beta.84",
+  "version": "1.0.0-beta.86",
   "description": "Self-hosted AI coding agent for organizations: every Slack channel and DM gets its own sandboxed workspace, credentials, and memory.",
   "keywords": [
     "agent",
@@ -55,6 +55,8 @@
     "fmt": "oxfmt -c .config/oxfmtrc.json",
     "fmt:check": "oxfmt -c .config/oxfmtrc.json --check",
     "knip": "knip && knip --production --dependencies",
+    "duplication": "jscpd src --format typescript --min-tokens 70 --ignore \"**/test/**,**/*.test.ts,**/content/**\"",
+    "knip:unused": "knip --production --exclude files --no-exit-code",
     "prepublishOnly": "npm run build",
     "prepare": "husky",
     "test:e2e": "vitest --run --config .config/vitest.e2e.config.ts",
@@ -67,10 +69,10 @@
   },
   "dependencies": {
     "@clack/prompts": "^1.8.1",
-    "@earendil-works/pi-agent-core": "^0.87.0",
-    "@earendil-works/pi-ai": "^0.87.0",
+    "@earendil-works/pi-agent-core": "^0.99.1",
+    "@earendil-works/pi-ai": "^0.99.1",
+    "@earendil-works/pi-mcp": "^0.99.1",
     "@geminixiang/jev": "^0.3.1",
-    "@modelcontextprotocol/sdk": "^1.30.0",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/exporter-metrics-otlp-proto": "^0.221.0",
     "@opentelemetry/exporter-trace-otlp-proto": "^0.221.0",
@@ -101,14 +103,14 @@
     "@vitest/coverage-v8": "^4.1.9",
     "astro": "^7.0.2",
     "husky": "^9.1.7",
+    "jscpd": "^5.3.3",
     "knip": "^6.20.0",
     "oxfmt": "^0.60.0",
     "oxlint": "^1.71.0",
     "remark-gfm": "^4.0.1",
     "shx": "^0.4.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.9",
-    "zod": "^4.0.0"
+    "vitest": "^4.1.9"
   },
   "overrides": {
     "@discordjs/rest": {

package/dist/adapters/github/repo.d.ts

@@ -1,8 +0,0 @@
-import type { Office } from "../../office/types.js";
-import type { CloneRepoOptions, PushBranchOptions, SyncRepoOptions, SyncRepoResult } from "./types.js";
-export declare const GITHUB_PUSH_BRANCH_PATTERN: RegExp;
-export declare function conversationRepoDir(office: Office): string;
-export declare function cloneRepo(options: CloneRepoOptions): Promise<void>;
-export declare function syncRepo(options: SyncRepoOptions): Promise<SyncRepoResult>;
-export declare function pushBranch(options: PushBranchOptions): Promise<void>;
-//# sourceMappingURL=repo.d.ts.map

package/dist/adapters/github/repo.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../../src/adapters/github/repo.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAEpD,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACf,MAAM,YAAY,CAAC;AAMpB,eAAO,MAAM,0BAA0B,QAAwC,CAAC;AAEhF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE1D;AAyBD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBxE;AAED,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAuChF;AAED,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa1E"}

package/dist/adapters/github/repo.js

@@ -1,92 +0,0 @@
-import { execFile } from "node:child_process";
-import { join } from "node:path";
-import { promisify } from "node:util";
-const execFileAsync = promisify(execFile);
-const GIT_TIMEOUT_MS = 120_000;
-export const GITHUB_PUSH_BRANCH_PATTERN = /^pi\/[A-Za-z0-9._][A-Za-z0-9._/-]*$/;
-export function conversationRepoDir(office) {
-    return join(office.dir, "repo");
-}
-function gitAuthArgs(token) {
-    const basic = Buffer.from(`x-access-token:${token}`).toString("base64");
-    return ["-c", `http.extraheader=Authorization: basic ${basic}`];
-}
-async function git(args, token) {
-    const { stdout } = await execFileAsync("git", [...(token ? gitAuthArgs(token) : []), ...args], {
-        timeout: GIT_TIMEOUT_MS,
-        env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
-    });
-    return stdout;
-}
-function isSafeBranchName(name) {
-    return (name.length > 0 && !name.startsWith("-") && !name.includes("..") && !/[\s~^:?*[\\]/.test(name));
-}
-function prCheckoutName(prNumber, prHeadBranch) {
-    return prHeadBranch && isSafeBranchName(prHeadBranch) ? prHeadBranch : `pr-${prNumber}`;
-}
-export async function cloneRepo(options) {
-    await git(["clone", "--depth", "50", options.url, options.dir], options.token);
-    await git(["-C", options.dir, "config", "user.name", options.botLogin]);
-    await git(["-C", options.dir, "config", "user.email", options.botEmail]);
-    if (options.prNumber !== undefined) {
-        await git(["-C", options.dir, "fetch", "--depth", "50", "origin", `pull/${options.prNumber}/head`], options.token);
-        await git([
-            "-C",
-            options.dir,
-            "checkout",
-            "-B",
-            prCheckoutName(options.prNumber, options.prHeadBranch),
-            "FETCH_HEAD",
-        ]);
-    }
-}
-export async function syncRepo(options) {
-    const { dir, token } = options;
-    let refspec;
-    let target;
-    if (options.branch) {
-        refspec = options.branch;
-        target = options.branch;
-    }
-    else if (options.prNumber !== undefined) {
-        refspec = `pull/${options.prNumber}/head`;
-        target = prCheckoutName(options.prNumber, options.prHeadBranch);
-    }
-    else if (options.defaultBranch) {
-        refspec = options.defaultBranch;
-        target = options.defaultBranch;
-    }
-    else {
-        throw new Error("syncRepo needs a branch, a PR number, or the default branch");
-    }
-    await git(["-C", dir, "fetch", "--depth", "50", "origin", refspec], token);
-    const fetchedSha = (await git(["-C", dir, "rev-parse", "FETCH_HEAD"])).trim();
-    const dirty = (await git(["-C", dir, "status", "--porcelain"])).trim().length > 0;
-    const currentBranch = (await git(["-C", dir, "rev-parse", "--abbrev-ref", "HEAD"])).trim();
-    const legacyPrBranch = options.prNumber !== undefined ? `pr-${options.prNumber}` : undefined;
-    const onTarget = currentBranch === target || (legacyPrBranch !== undefined && currentBranch === legacyPrBranch);
-    let localCommits = 0;
-    if (onTarget) {
-        const botEmail = (await git(["-C", dir, "config", "user.email"])).trim();
-        localCommits = Number((await git(["-C", dir, "rev-list", "--count", `--committer=${botEmail}`, "FETCH_HEAD..HEAD"])).trim());
-    }
-    const updatedCheckout = onTarget && !dirty && localCommits === 0;
-    if (updatedCheckout) {
-        await git(["-C", dir, "checkout", "-B", target, "FETCH_HEAD"]);
-    }
-    return { target, fetchedSha, updatedCheckout, dirty, currentBranch, localCommits };
-}
-export async function pushBranch(options) {
-    const { dir, branch, token } = options;
-    if (!GITHUB_PUSH_BRANCH_PATTERN.test(branch)) {
-        throw new Error(`Refusing to push branch '${branch}': only branches matching pi/<name> may be pushed.`);
-    }
-    try {
-        await git(["-C", dir, "rev-parse", "--verify", "--quiet", `refs/heads/${branch}`]);
-    }
-    catch {
-        throw new Error(`Branch '${branch}' does not exist in the conversation's ./repo clone.`);
-    }
-    await git(["-C", dir, "push", "origin", `refs/heads/${branch}:refs/heads/${branch}`], token);
-}
-//# sourceMappingURL=repo.js.map

package/dist/adapters/github/repo.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"repo.js","sourceRoot":"","sources":["../../../src/adapters/github/repo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAQtC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,cAAc,GAAG,OAAO,CAAC;AAE/B,MAAM,CAAC,MAAM,0BAA0B,GAAG,qCAAqC,CAAC;AAEhF,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxE,OAAO,CAAC,IAAI,EAAE,yCAAyC,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,KAAc;IAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE;QAC7F,OAAO,EAAE,cAAc;QACvB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE;KAClD,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,CACL,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAC/F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB,EAAE,YAAqB;IAC7D,OAAO,YAAY,IAAI,gBAAgB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,QAAQ,EAAE,CAAC;AAC1F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAyB;IACvD,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/E,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,GAAG,CACP,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,OAAO,CAAC,QAAQ,OAAO,CAAC,EACxF,OAAO,CAAC,KAAK,CACd,CAAC;QACF,MAAM,GAAG,CAAC;YACR,IAAI;YACJ,OAAO,CAAC,GAAG;YACX,UAAU;YACV,IAAI;YACJ,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC;YACtD,YAAY;SACb,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAwB;IACrD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC/B,IAAI,OAAe,CAAC;IACpB,IAAI,MAAc,CAAC;IACnB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QACzB,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC1B,CAAC;SAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,GAAG,QAAQ,OAAO,CAAC,QAAQ,OAAO,CAAC;QAC1C,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAClE,CAAC;SAAM,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QACjC,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;QAChC,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IAC3E,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3F,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,MAAM,QAAQ,GACZ,aAAa,KAAK,MAAM,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,aAAa,KAAK,cAAc,CAAC,CAAC;IACjG,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzE,YAAY,GAAG,MAAM,CACnB,CACE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,QAAQ,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAC7F,CAAC,IAAI,EAAE,CACT,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,QAAQ,IAAI,CAAC,KAAK,IAAI,YAAY,KAAK,CAAC,CAAC;IACjE,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA0B;IACzD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACvC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,4BAA4B,MAAM,oDAAoD,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,MAAM,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,sDAAsD,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,MAAM,eAAe,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;AAC/F,CAAC","sourcesContent":["import { execFile } from \"node:child_process\";\nimport { join } from \"node:path\";\nimport type { Office } from \"../../office/types.js\";\nimport { promisify } from \"node:util\";\nimport type {\n  CloneRepoOptions,\n  PushBranchOptions,\n  SyncRepoOptions,\n  SyncRepoResult,\n} from \"./types.js\";\n\nconst execFileAsync = promisify(execFile);\n\nconst GIT_TIMEOUT_MS = 120_000;\n\nexport const GITHUB_PUSH_BRANCH_PATTERN = /^pi\\/[A-Za-z0-9._][A-Za-z0-9._/-]*$/;\n\nexport function conversationRepoDir(office: Office): string {\n  return join(office.dir, \"repo\");\n}\n\nfunction gitAuthArgs(token: string): string[] {\n  const basic = Buffer.from(`x-access-token:${token}`).toString(\"base64\");\n  return [\"-c\", `http.extraheader=Authorization: basic ${basic}`];\n}\n\nasync function git(args: string[], token?: string): Promise<string> {\n  const { stdout } = await execFileAsync(\"git\", [...(token ? gitAuthArgs(token) : []), ...args], {\n    timeout: GIT_TIMEOUT_MS,\n    env: { ...process.env, GIT_TERMINAL_PROMPT: \"0\" },\n  });\n  return stdout;\n}\n\nfunction isSafeBranchName(name: string): boolean {\n  return (\n    name.length > 0 && !name.startsWith(\"-\") && !name.includes(\"..\") && !/[\\s~^:?*[\\\\]/.test(name)\n  );\n}\n\nfunction prCheckoutName(prNumber: number, prHeadBranch?: string): string {\n  return prHeadBranch && isSafeBranchName(prHeadBranch) ? prHeadBranch : `pr-${prNumber}`;\n}\n\nexport async function cloneRepo(options: CloneRepoOptions): Promise<void> {\n  await git([\"clone\", \"--depth\", \"50\", options.url, options.dir], options.token);\n  await git([\"-C\", options.dir, \"config\", \"user.name\", options.botLogin]);\n  await git([\"-C\", options.dir, \"config\", \"user.email\", options.botEmail]);\n  if (options.prNumber !== undefined) {\n    await git(\n      [\"-C\", options.dir, \"fetch\", \"--depth\", \"50\", \"origin\", `pull/${options.prNumber}/head`],\n      options.token,\n    );\n    await git([\n      \"-C\",\n      options.dir,\n      \"checkout\",\n      \"-B\",\n      prCheckoutName(options.prNumber, options.prHeadBranch),\n      \"FETCH_HEAD\",\n    ]);\n  }\n}\n\nexport async function syncRepo(options: SyncRepoOptions): Promise<SyncRepoResult> {\n  const { dir, token } = options;\n  let refspec: string;\n  let target: string;\n  if (options.branch) {\n    refspec = options.branch;\n    target = options.branch;\n  } else if (options.prNumber !== undefined) {\n    refspec = `pull/${options.prNumber}/head`;\n    target = prCheckoutName(options.prNumber, options.prHeadBranch);\n  } else if (options.defaultBranch) {\n    refspec = options.defaultBranch;\n    target = options.defaultBranch;\n  } else {\n    throw new Error(\"syncRepo needs a branch, a PR number, or the default branch\");\n  }\n\n  await git([\"-C\", dir, \"fetch\", \"--depth\", \"50\", \"origin\", refspec], token);\n  const fetchedSha = (await git([\"-C\", dir, \"rev-parse\", \"FETCH_HEAD\"])).trim();\n  const dirty = (await git([\"-C\", dir, \"status\", \"--porcelain\"])).trim().length > 0;\n  const currentBranch = (await git([\"-C\", dir, \"rev-parse\", \"--abbrev-ref\", \"HEAD\"])).trim();\n  const legacyPrBranch = options.prNumber !== undefined ? `pr-${options.prNumber}` : undefined;\n  const onTarget =\n    currentBranch === target || (legacyPrBranch !== undefined && currentBranch === legacyPrBranch);\n  let localCommits = 0;\n  if (onTarget) {\n    const botEmail = (await git([\"-C\", dir, \"config\", \"user.email\"])).trim();\n    localCommits = Number(\n      (\n        await git([\"-C\", dir, \"rev-list\", \"--count\", `--committer=${botEmail}`, \"FETCH_HEAD..HEAD\"])\n      ).trim(),\n    );\n  }\n\n  const updatedCheckout = onTarget && !dirty && localCommits === 0;\n  if (updatedCheckout) {\n    await git([\"-C\", dir, \"checkout\", \"-B\", target, \"FETCH_HEAD\"]);\n  }\n  return { target, fetchedSha, updatedCheckout, dirty, currentBranch, localCommits };\n}\n\nexport async function pushBranch(options: PushBranchOptions): Promise<void> {\n  const { dir, branch, token } = options;\n  if (!GITHUB_PUSH_BRANCH_PATTERN.test(branch)) {\n    throw new Error(\n      `Refusing to push branch '${branch}': only branches matching pi/<name> may be pushed.`,\n    );\n  }\n  try {\n    await git([\"-C\", dir, \"rev-parse\", \"--verify\", \"--quiet\", `refs/heads/${branch}`]);\n  } catch {\n    throw new Error(`Branch '${branch}' does not exist in the conversation's ./repo clone.`);\n  }\n  await git([\"-C\", dir, \"push\", \"origin\", `refs/heads/${branch}:refs/heads/${branch}`], token);\n}\n"]}

package/dist/adapters/github/tools/sync.d.ts

@@ -1,13 +0,0 @@
-import type { AgentTool } from "@earendil-works/pi-agent-core";
-import { Type } from "typebox";
-export declare const GITHUB_SYNC_TOOL = "github_sync";
-declare const githubSyncSchema: Type.TObject<{
-    branch: Type.TOptional<Type.TString>;
-}>;
-import type { GithubSyncFn } from "../types.js";
-export declare function createGithubSyncTool(): {
-    tool: AgentTool<typeof githubSyncSchema>;
-    setGithubSyncFunction: (fn: GithubSyncFn | null) => void;
-};
-export {};
-//# sourceMappingURL=sync.d.ts.map

package/dist/adapters/github/tools/sync.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../../src/adapters/github/tools/sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAG/B,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAE9C,QAAA,MAAM,gBAAgB;;EAQpB,CAAC;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEhD,wBAAgB,oBAAoB,IAAI;IACtC,IAAI,EAAE,SAAS,CAAC,OAAO,gBAAgB,CAAC,CAAC;IACzC,qBAAqB,EAAE,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,KAAK,IAAI,CAAC;CAC1D,CAoBA"}

package/dist/adapters/github/tools/sync.js

@@ -1,29 +0,0 @@
-import { Type } from "typebox";
-import { defineHostFnTool } from "../../../harness/tools/host-fn-tool.js";
-export const GITHUB_SYNC_TOOL = "github_sync";
-const githubSyncSchema = Type.Object({
-    branch: Type.Optional(Type.String({
-        description: "Remote branch to fetch. Omit to fetch this PR's latest head (or the default " +
-            "branch in a plain-issue conversation).",
-    })),
-});
-export function createGithubSyncTool() {
-    const { tool, setFn } = defineHostFnTool({
-        name: GITHUB_SYNC_TOOL,
-        description: "Update ./repo from GitHub: fetches this PR's latest head (or the default branch, " +
-            "or a named branch) and fast-forwards the checkout when that cannot lose your work; " +
-            "otherwise it fetches to FETCH_HEAD and reports so you can merge or rebase yourself. " +
-            "Only available in GitHub conversations.",
-        parameters: githubSyncSchema,
-        unavailable: `${GITHUB_SYNC_TOOL} is only available in GitHub conversations.`,
-        run: async (syncFn, args) => {
-            const report = await syncFn(args.branch);
-            return {
-                content: [{ type: "text", text: report }],
-                details: undefined,
-            };
-        },
-    });
-    return { tool, setGithubSyncFunction: setFn };
-}
-//# sourceMappingURL=sync.js.map

package/dist/adapters/github/tools/sync.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../../../src/adapters/github/tools/sync.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAE1E,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C,MAAM,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC;IACnC,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC;QACV,WAAW,EACT,8EAA8E;YAC9E,wCAAwC;KAC3C,CAAC,CACH;CACF,CAAC,CAAC;AAIH,MAAM,UAAU,oBAAoB;IAIlC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAwC;QAC9E,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACT,mFAAmF;YACnF,qFAAqF;YACrF,sFAAsF;YACtF,yCAAyC;QAC3C,UAAU,EAAE,gBAAgB;QAC5B,WAAW,EAAE,GAAG,gBAAgB,6CAA6C;QAC7E,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzC,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;gBAClD,OAAO,EAAE,SAAS;aACnB,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;AAChD,CAAC","sourcesContent":["import type { AgentTool } from \"@earendil-works/pi-agent-core\";\nimport { Type } from \"typebox\";\nimport { defineHostFnTool } from \"../../../harness/tools/host-fn-tool.js\";\n\nexport const GITHUB_SYNC_TOOL = \"github_sync\";\n\nconst githubSyncSchema = Type.Object({\n  branch: Type.Optional(\n    Type.String({\n      description:\n        \"Remote branch to fetch. Omit to fetch this PR's latest head (or the default \" +\n        \"branch in a plain-issue conversation).\",\n    }),\n  ),\n});\n\nimport type { GithubSyncFn } from \"../types.js\";\n\nexport function createGithubSyncTool(): {\n  tool: AgentTool<typeof githubSyncSchema>;\n  setGithubSyncFunction: (fn: GithubSyncFn | null) => void;\n} {\n  const { tool, setFn } = defineHostFnTool<GithubSyncFn, typeof githubSyncSchema>({\n    name: GITHUB_SYNC_TOOL,\n    description:\n      \"Update ./repo from GitHub: fetches this PR's latest head (or the default branch, \" +\n      \"or a named branch) and fast-forwards the checkout when that cannot lose your work; \" +\n      \"otherwise it fetches to FETCH_HEAD and reports so you can merge or rebase yourself. \" +\n      \"Only available in GitHub conversations.\",\n    parameters: githubSyncSchema,\n    unavailable: `${GITHUB_SYNC_TOOL} is only available in GitHub conversations.`,\n    run: async (syncFn, args) => {\n      const report = await syncFn(args.branch);\n      return {\n        content: [{ type: \"text\" as const, text: report }],\n        details: undefined,\n      };\n    },\n  });\n\n  return { tool, setGithubSyncFunction: setFn };\n}\n"]}

package/dist/cli/sandbox.d.ts

@@ -1,3 +0,0 @@
-import { DockerContainerManager } from "../sandbox/provisioner.js";
-export declare function runSandboxCommand(argv: string[], createManager?: (image: string) => DockerContainerManager): Promise<number>;
-//# sourceMappingURL=sandbox.d.ts.map

package/dist/cli/sandbox.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/cli/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAQnE,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EAAE,EACd,aAAa,GAAE,CAAC,KAAK,EAAE,MAAM,KAAK,sBACC,GAClC,OAAO,CAAC,MAAM,CAAC,CAmCjB"}