@cef-ai/cli 2.6.0 → 2.7.0

package/dist/lib/vault-publish.js

@@ -0,0 +1,258 @@
+/**
+ * `cef push --vault <id> --vault-scope <scope>` — publish an agent version
+ * through vault-api instead of writing the registry DAG to DDC directly.
+ *
+ * Why a second path exists: a direct push holds a bucket-wide credential and
+ * rewrites the bucket's single `agents` CNS root, so anyone who can push can
+ * replace or drop ANY alias in it. For an organization's vault, vault-api owns
+ * that root: it checks that the caller may write the target scope, binds each
+ * alias to the scope it is first published from, serialises concurrent
+ * publishes, and writes with the owner's registry delegation. The CLI only
+ * hands it the files.
+ *
+ *   POST {vaultApi}/api/v1/vaults/{vaultId}/scopes/{scope}/agents/{alias}/versions
+ *
+ * The body is multipart/form-data and each part's form name is the file's
+ * path inside the version: `manifest.json` (required, UNSTAMPED — the server
+ * writes `bundle` and each uploaded widget's `dag`), `bundle.js` (required),
+ * `bundle.js.map`, `widgets/<id>/<file>`, `sources/<file>`. The version is the
+ * manifest's own `version` field.
+ *
+ * Authentication is one of:
+ *   - a wallet signature over a preamble `{method, path, query, timestamp,
+ *     contentSha256}`, where `contentSha256` is the SHA-256 of the ENTIRE
+ *     request body — the signature commits to the bytes without the server
+ *     buffering them to verify it; or
+ *   - a wallet-api bearer token (`Authorization: Bearer`).
+ */
+import { createHash, randomBytes } from "node:crypto";
+import { bytesToHex, encodeBase64Url } from "@cef-ai/transport";
+/**
+ * A refused or failed publish, with the server's stable code kept for callers
+ * that branch on it. `retryable` is true when the same request may simply be
+ * sent again.
+ *
+ * That is not always "nothing was written". A `NETWORK` failure can happen
+ * after vault-api received the whole body, so the publish may have committed.
+ * Re-pushing the same version is still safe: vault-api does not refuse a
+ * version it already holds, it rewrites that version's link and `latest`, and
+ * the stored pieces are content-addressed, so identical content lands on the
+ * same ids. The one visible effect is that `latest` points at this version
+ * again if a newer one was published in between.
+ */
+export class VaultPublishError extends Error {
+    status;
+    code;
+    retryable;
+    constructor(message, status, code, retryable) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.retryable = retryable;
+        this.name = "VaultPublishError";
+    }
+}
+/**
+ * Serialise parts as one multipart/form-data body.
+ *
+ * Built by hand into a single buffer rather than through `FormData` because
+ * the signature must commit to the SHA-256 of the exact bytes on the wire, and
+ * `FormData`'s encoding (boundary, part headers) is only known once fetch has
+ * produced it.
+ */
+export function buildMultipartBody(parts) {
+    const boundary = `----cef-push-${randomBytes(16).toString("hex")}`;
+    const enc = new TextEncoder();
+    const chunks = [];
+    for (const part of parts) {
+        if (/["\r\n]/.test(part.name)) {
+            throw new Error(`[cef push] file name ${JSON.stringify(part.name)} cannot be sent as a form field`);
+        }
+        // The last path segment doubles as the filename, so the part reads as a
+        // file upload to any multipart parser; the server keys on the form name.
+        const filename = part.name.split("/").pop();
+        chunks.push(enc.encode(`--${boundary}\r\n`
+            + `Content-Disposition: form-data; name="${part.name}"; filename="${filename}"\r\n`
+            + `Content-Type: ${partContentType(part.name)}\r\n\r\n`), part.bytes, enc.encode("\r\n"));
+    }
+    chunks.push(enc.encode(`--${boundary}--\r\n`));
+    return {
+        body: Buffer.concat(chunks),
+        contentType: `multipart/form-data; boundary=${boundary}`,
+    };
+}
+function partContentType(name) {
+    if (name.endsWith(".json") || name.endsWith(".map"))
+        return "application/json";
+    if (name.endsWith(".js") || name.endsWith(".mjs"))
+        return "text/javascript";
+    if (name.endsWith(".html"))
+        return "text/html";
+    if (name.endsWith(".css"))
+        return "text/css";
+    return "application/octet-stream";
+}
+/** Hex SHA-256 of the body — the value the signed preamble commits to. */
+export function bodySha256(body) {
+    return createHash("sha256").update(body).digest("hex");
+}
+/** The route's URL, each path segment escaped the way it is signed. */
+export function publishUrl(vaultApi, vaultId, scope, alias) {
+    const base = new URL(vaultApi);
+    const prefix = base.pathname.replace(/\/+$/, "");
+    const seg = encodeURIComponent;
+    base.pathname =
+        `${prefix}/api/v1/vaults/${seg(vaultId)}/scopes/${seg(scope)}/agents/${seg(alias)}/versions`;
+    base.search = "";
+    base.hash = "";
+    return base;
+}
+/**
+ * The wallet-signature headers for a publish. The preamble binds the method,
+ * the path and query exactly as sent, a timestamp inside vault-api's skew
+ * window, and the body's hash; the signature covers the preamble's raw JSON
+ * bytes, which travel base64url-encoded beside it.
+ */
+export async function signatureHeaders(signer, url, contentSha256, now) {
+    // vault-api pins wallet auth to ed25519 and answers 400 to any other type.
+    const type = signer.type;
+    if (type !== "ed25519") {
+        throw new Error(`[cef push] vault-api accepts only ed25519 signatures, not ${type}`);
+    }
+    const preamble = new TextEncoder().encode(JSON.stringify({
+        method: "POST",
+        path: url.pathname,
+        query: url.search.replace(/^\?/, ""),
+        timestamp: now.toISOString().replace(/\.\d+Z$/, "Z"),
+        contentSha256,
+    }));
+    const sig = await signer.sign(preamble);
+    return {
+        "X-Public-Key": `0x${bytesToHex(signer.publicKey)}`,
+        "X-Signature-Type": type,
+        "X-Signed-Preamble": encodeBase64Url(preamble),
+        "X-Signature": bytesToHex(sig),
+    };
+}
+/** POST the version to vault-api; the parsed 201 body, or a readable refusal. */
+export async function publishToVault(input) {
+    const url = publishUrl(input.vaultApi, input.vaultId, input.scope, input.alias);
+    const { body, contentType } = buildMultipartBody(input.parts);
+    const headers = { "Content-Type": contentType };
+    if (input.auth.kind === "bearer") {
+        headers.Authorization = `Bearer ${input.auth.token}`;
+    }
+    else {
+        Object.assign(headers, await signatureHeaders(input.auth.signer, url, bodySha256(body), (input.now ?? (() => new Date()))()));
+    }
+    const doFetch = input.fetchImpl ?? fetch;
+    let res;
+    try {
+        res = await doFetch(url, { method: "POST", headers, body });
+    }
+    catch (e) {
+        throw new VaultPublishError(`[cef push] could not reach vault-api at ${url.origin}: ${e.message}`, 0, "NETWORK", true);
+    }
+    const text = await res.text();
+    if (res.status === 201) {
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            throw new VaultPublishError(`[cef push] vault-api answered 201 but its body is not JSON — the publish may have landed; `
+                + `check the registry before re-pushing`, res.status, "BAD_RESPONSE", false);
+        }
+    }
+    throw describeRefusal(res.status, text, input);
+}
+/**
+ * vault-api's refusals carry `{error: {code, message, retryable}}`; its
+ * authentication layer answers with a bare `{message}`. Either way the person
+ * gets what went wrong and what to do about it, with the server's own words
+ * appended rather than replaced.
+ */
+function describeRefusal(status, text, input) {
+    let code = "";
+    let detail = "";
+    let retryable = false;
+    try {
+        const parsed = JSON.parse(text);
+        code = parsed.error?.code ?? "";
+        detail = parsed.error?.message ?? parsed.message ?? "";
+        retryable = parsed.error?.retryable === true;
+    }
+    catch {
+        detail = text.trim().slice(0, 300);
+    }
+    const where = `scope "${input.scope}" of vault ${input.vaultId}`;
+    const said = detail ? ` (vault-api: ${code ? `${code}: ` : ""}${detail})` : code ? ` (vault-api: ${code})` : "";
+    let message;
+    switch (true) {
+        case code === "ALIAS_NOT_YOURS":
+            message =
+                `alias "${input.alias}" cannot be published from ${where}: an alias belongs to the scope it `
+                    + `was first published from, and one already in the registry that no scope has claimed can `
+                    + `be claimed only by the vault owner. Publish it from its own scope, or rename the agent.`;
+            break;
+        case code === "REGISTRY_NOT_CONFIGURED":
+            message =
+                `vault ${input.vaultId} cannot accept agent publishes yet: its owner has not recorded a `
+                    + `registry bucket and sealed a registry delegation for it (PUT /api/v1/vaults/${input.vaultId}/delegations, `
+                    + `a token signed by the bucket owner granting PUT on that bucket), or the delegation has expired. `
+                    + `Only the vault owner can do this: in ROC, "Enable agent publishing" on the organization page, or `
+                    + `\`sdk.vault.delegations.grant\` from @cef-ai/vault-sdk. Ask the owner to do that, then push again.`;
+            break;
+        case code === "REGISTRY_UNAVAILABLE":
+            retryable = true;
+            message =
+                `the registry of vault ${input.vaultId} could not be read or written right now; nothing was `
+                    + `changed. Retry the push.`;
+            break;
+        case status === 403:
+            message =
+                `you may not publish into ${where}: publishing needs write on the scope (the vault owner, or a `
+                    + `member with a member-level grant on "${input.scope}"), and the scope must exist. Ask the vault `
+                    + `owner for that grant, or check the scope name.`;
+            break;
+        case status === 401:
+            message =
+                `vault-api did not accept your credential — check the secret phrase or token, and that this machine's clock is within 5 minutes of real time.`;
+            break;
+        case code === "VAULT_NOT_FOUND":
+            message = `vault ${input.vaultId} does not exist on this vault-api.`;
+            break;
+        case status === 404:
+            message =
+                `vault-api does not serve the agent publish route here — it predates it, or it runs without `
+                    + `registry storage configured. Check --vault-api / --env.`;
+            break;
+        case status === 413:
+            message = `the version is larger than this vault-api accepts for one publish.`;
+            break;
+        case status === 400:
+            message = `vault-api refused the version as malformed.`;
+            break;
+        default:
+            message = `vault-api answered HTTP ${status}.`;
+    }
+    return new VaultPublishError(`[cef push] ${message}${said}`, status, code || `HTTP_${status}`, retryable);
+}
+/**
+ * A signer from a substrate secret phrase or URI, through the DDC SDK's
+ * `UriSigner` — the same optional dependency the direct push already loads,
+ * so this path adds no package. It signs the raw preamble bytes, which is the
+ * first form vault-api verifies. The key is always derived as ed25519, the
+ * only scheme vault-api's wallet auth accepts.
+ */
+export async function signerFromPhrase(phrase) {
+    let mod;
+    try {
+        mod = (await import("@cere-ddc-sdk/ddc-client"));
+    }
+    catch {
+        throw new Error("[cef push] signing with a secret phrase needs the optional dependency @cere-ddc-sdk/ddc-client; "
+            + "install it, or authenticate with --vault-token instead");
+    }
+    return mod.UriSigner.create(phrase, { type: "ed25519" });
+}
+//# sourceMappingURL=vault-publish.js.map

package/dist/lib/vault-publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-publish.js","sourceRoot":"","sources":["../../src/lib/vault-publish.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAsChE;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAG/B;IACA;IACA;IAJX,YACE,OAAe,EACN,MAAc,EACd,IAAY,EACZ,SAAkB;QAE3B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QACZ,cAAS,GAAT,SAAS,CAAS;QAG3B,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAgBD;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAoB;IAIrD,MAAM,QAAQ,GAAG,gBAAgB,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QACtG,CAAC;QACD,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAG,CAAC;QAC7C,MAAM,CAAC,IAAI,CACT,GAAG,CAAC,MAAM,CACR,KAAK,QAAQ,MAAM;cACf,yCAAyC,IAAI,CAAC,IAAI,gBAAgB,QAAQ,OAAO;cACjF,iBAAiB,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAC1D,EACD,IAAI,CAAC,KAAK,EACV,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CACnB,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,QAAQ,CAAC,CAAC,CAAC;IAC/C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAC3B,WAAW,EAAE,iCAAiC,QAAQ,EAAE;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAC/E,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC5E,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,UAAU,CAAC;IAC7C,OAAO,0BAA0B,CAAC;AACpC,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,OAAe,EAAE,KAAa,EAAE,KAAa;IACxF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,kBAAkB,CAAC;IAC/B,IAAI,CAAC,QAAQ;QACX,GAAG,MAAM,kBAAkB,GAAG,CAAC,OAAO,CAAC,WAAW,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;IAC/F,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;IACf,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAA0B,EAC1B,GAAQ,EACR,aAAqB,EACrB,GAAS;IAET,2EAA2E;IAC3E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6DAA6D,IAAI,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CACvC,IAAI,CAAC,SAAS,CAAC;QACb,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,CAAC,QAAQ;QAClB,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACpC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;QACpD,aAAa;KACd,CAAC,CACH,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,OAAO;QACL,cAAc,EAAE,KAAK,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE;QACnD,kBAAkB,EAAE,IAAI;QACxB,mBAAmB,EAAE,eAAe,CAAC,QAAQ,CAAC;QAC9C,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA0B;IAC7D,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAChF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC9D,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;IACxE,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,MAAM,CACX,OAAO,EACP,MAAM,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CACtG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;IACzC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,iBAAiB,CACzB,2CAA2C,GAAG,CAAC,MAAM,KAAM,CAAW,CAAC,OAAO,EAAE,EAChF,CAAC,EACD,SAAS,EACT,IAAI,CACL,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CACzB,4FAA4F;kBACxF,sCAAsC,EAC1C,GAAG,CAAC,MAAM,EACV,cAAc,EACd,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAc,EAAE,IAAY,EAAE,KAA0B;IAC/E,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAG7B,CAAC;QACF,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QAChC,MAAM,GAAG,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QACvD,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,KAAK,CAAC,KAAK,cAAc,KAAK,CAAC,OAAO,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhH,IAAI,OAAe,CAAC;IACpB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,IAAI,KAAK,iBAAiB;YAC7B,OAAO;gBACL,UAAU,KAAK,CAAC,KAAK,8BAA8B,KAAK,qCAAqC;sBAC3F,0FAA0F;sBAC1F,yFAAyF,CAAC;YAC9F,MAAM;QACR,KAAK,IAAI,KAAK,yBAAyB;YACrC,OAAO;gBACL,SAAS,KAAK,CAAC,OAAO,mEAAmE;sBACvF,+EAA+E,KAAK,CAAC,OAAO,gBAAgB;sBAC5G,kGAAkG;sBAClG,mGAAmG;sBACnG,oGAAoG,CAAC;YACzG,MAAM;QACR,KAAK,IAAI,KAAK,sBAAsB;YAClC,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO;gBACL,yBAAyB,KAAK,CAAC,OAAO,uDAAuD;sBAC3F,0BAA0B,CAAC;YAC/B,MAAM;QACR,KAAK,MAAM,KAAK,GAAG;YACjB,OAAO;gBACL,4BAA4B,KAAK,+DAA+D;sBAC9F,wCAAwC,KAAK,CAAC,KAAK,8CAA8C;sBACjG,gDAAgD,CAAC;YACrD,MAAM;QACR,KAAK,MAAM,KAAK,GAAG;YACjB,OAAO;gBACL,8IAA8I,CAAC;YACjJ,MAAM;QACR,KAAK,IAAI,KAAK,iBAAiB;YAC7B,OAAO,GAAG,SAAS,KAAK,CAAC,OAAO,oCAAoC,CAAC;YACrE,MAAM;QACR,KAAK,MAAM,KAAK,GAAG;YACjB,OAAO;gBACL,6FAA6F;sBAC3F,yDAAyD,CAAC;YAC9D,MAAM;QACR,KAAK,MAAM,KAAK,GAAG;YACjB,OAAO,GAAG,oEAAoE,CAAC;YAC/E,MAAM;QACR,KAAK,MAAM,KAAK,GAAG;YACjB,OAAO,GAAG,6CAA6C,CAAC;YACxD,MAAM;QACR;YACE,OAAO,GAAG,2BAA2B,MAAM,GAAG,CAAC;IACnD,CAAC;IACD,OAAO,IAAI,iBAAiB,CAAC,cAAc,OAAO,GAAG,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,QAAQ,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,IAAI,GAAmG,CAAC;IACxG,IAAI,CAAC;QACH,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAA0B,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,kGAAkG;cAC9F,wDAAwD,CAC7D,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cef-ai/cli",
-  "version": "2.6.0",
+  "version": "2.7.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -20,9 +20,9 @@
     "esbuild": "^0.21.0",
     "json-schema-to-typescript": "^14.0.0",
     "typescript": "^5.4.0",
-    "@cef-ai/agent-sdk": "5.3.0",
     "@cef-ai/transport": "1.1.0",
-    "@cef-ai/widget-runtime": "2.2.0"
+    "@cef-ai/agent-sdk": "5.4.1",
+    "@cef-ai/widget-runtime": "2.2.2"
   },
   "optionalDependencies": {
     "@cere-ddc-sdk/ddc-client": "^2.16.1"