@kya-os/cli 1.7.0 → 1.8.3

package/dist/utils/agent-detector.js

@@ -0,0 +1,74 @@
+import { existsSync } from "fs";
+import { homedir as osHomedir } from "os";
+import { join } from "path";
+import { defaultWhich } from "./which.js";
+/**
+ * Detection table v1. Exported so tests enumerate every row and adding a
+ * later agent kind is a one-row addition, not a code change.
+ */
+export const AGENT_DETECTION_TABLE = [
+    { kind: "claude-code", binNames: ["claude"], homeConfigDirs: [".claude"] },
+    { kind: "codex", binNames: ["codex"], homeConfigDirs: [".codex"] },
+    { kind: "gemini-cli", binNames: ["gemini"], homeConfigDirs: [".gemini"] },
+    {
+        kind: "cursor",
+        binNames: ["cursor"],
+        homeConfigDirs: [],
+        darwinAppPaths: ["/Applications/Cursor.app"],
+    },
+    { kind: "opencode", binNames: ["opencode"], homeConfigDirs: [".opencode"] },
+    { kind: "aider", binNames: ["aider"], homeConfigDirs: [] },
+];
+function defaultDeps() {
+    return {
+        whichImpl: defaultWhich,
+        fsImpl: { existsSync },
+        homedir: osHomedir,
+        platform: process.platform,
+    };
+}
+/**
+ * Detect which agent harnesses are present. Returns only the kinds with at
+ * least one match; an empty array means nothing was detected (not an error).
+ */
+export async function detectAgents(deps = {}) {
+    const { whichImpl, fsImpl, homedir, platform } = {
+        ...defaultDeps(),
+        ...deps,
+    };
+    const home = homedir();
+    const results = [];
+    for (const row of AGENT_DETECTION_TABLE) {
+        const evidence = [];
+        let binPath;
+        let configDir;
+        for (const bin of row.binNames) {
+            const found = await whichImpl(bin);
+            if (found) {
+                binPath = found;
+                evidence.push(`\`${bin}\` on PATH`);
+                break;
+            }
+        }
+        for (const dir of row.homeConfigDirs) {
+            const full = join(home, dir);
+            if (fsImpl.existsSync(full)) {
+                configDir = full;
+                evidence.push(`${full} exists`);
+                break;
+            }
+        }
+        if (platform === "darwin") {
+            for (const appPath of row.darwinAppPaths ?? []) {
+                if (fsImpl.existsSync(appPath)) {
+                    evidence.push(`${appPath} exists`);
+                }
+            }
+        }
+        if (evidence.length > 0) {
+            results.push({ kind: row.kind, binPath, configDir, evidence });
+        }
+    }
+    return results;
+}
+//# sourceMappingURL=agent-detector.js.map

package/dist/utils/agent-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-detector.js","sourceRoot":"","sources":["../../src/utils/agent-detector.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,OAAO,IAAI,SAAS,EAAE,MAAM,IAAI,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAuC1C;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwB;IACxD,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC,SAAS,CAAC,EAAE;IAC1E,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC,QAAQ,CAAC,EAAE;IAClE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,cAAc,EAAE,CAAC,SAAS,CAAC,EAAE;IACzE;QACE,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,cAAc,EAAE,EAAE;QAClB,cAAc,EAAE,CAAC,0BAA0B,CAAC;KAC7C;IACD,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,WAAW,CAAC,EAAE;IAC3E,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE;CAC3D,CAAC;AAcF,SAAS,WAAW;IAClB,OAAO;QACL,SAAS,EAAE,YAAY;QACvB,MAAM,EAAE,EAAE,UAAU,EAAE;QACtB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAmC,EAAE;IAErC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG;QAC/C,GAAG,WAAW,EAAE;QAChB,GAAG,IAAI;KACR,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,OAAO,GAAoB,EAAE,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,OAA2B,CAAC;QAChC,IAAI,SAA6B,CAAC;QAElC,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,GAAG,KAAK,CAAC;gBAChB,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,YAAY,CAAC,CAAC;gBACpC,MAAM;YACR,CAAC;QACH,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5B,SAAS,GAAG,IAAI,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC;gBAChC,MAAM;YACR,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,KAAK,MAAM,OAAO,IAAI,GAAG,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;gBAC/C,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,SAAS,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/utils/agent-profile-stage.d.ts

@@ -0,0 +1,70 @@
+import { type AgentKind, type DetectedAgent } from "./agent-detector.js";
+import { type AgentProfile } from "./agent-profiles.js";
+import { type WriteSigningKeyResult } from "./dco/signing-key-writer.js";
+/**
+ * Orchestrates `kya-os init`'s agent-profile stage: detect harnesses,
+ * subtract ones that already have a profile, decide (via flag or prompt)
+ * which remainder to set up, register each, write its signing key, and save
+ * the profile. Every side effect (detection, the existing-profile check, the
+ * confirm prompt, registration, and the save itself) is an injectable seam
+ * so the whole stage runs in tests with zero real registration or network
+ * access -- `registerIdentity` in particular has NO default: a caller that
+ * forgets to wire it gets a type error, not an accidental real registration.
+ */
+export interface RegisteredIdentity {
+    did: string;
+    claimUrl?: string;
+    agentSlug?: string;
+    privateKey: string;
+    publicKey?: string;
+}
+/**
+ * No `slug` field: the underlying registration API (`enableMCPIdentityCLI`)
+ * has no parameter for requesting a specific slug -- it assigns one
+ * server-side from `name`. A caller-supplied slug here would be silently
+ * ignored, which is exactly the bug this type used to invite (Bugbot,
+ * PR #699): local file naming would use one slug while the registered DID
+ * used another. `runAgentProfileStage` derives the slug it actually stores
+ * under from the registration RESULT (`agentSlug`), never from a request.
+ */
+export type RegisterAgentIdentity = (input: {
+    kind: AgentKind;
+    name: string;
+}) => Promise<RegisteredIdentity>;
+export interface AgentProfileStageOptions {
+    interactive: boolean;
+    /** `--profiles <kind,kind,...>` in non-interactive mode. */
+    profilesFlag?: AgentKind[];
+    /** `--skip-profiles`. */
+    skipProfiles?: boolean;
+    /** Used to suggest `<githubLogin>-<kind>` slugs; falls back to `agent-<kind>`. */
+    githubLogin?: string;
+    /** Asked once per remaining detected agent in interactive mode. */
+    confirmImpl?: (agent: DetectedAgent) => Promise<boolean>;
+    registerIdentity: RegisterAgentIdentity;
+    detectAgentsImpl?: () => Promise<DetectedAgent[]>;
+    findProfileByKindImpl?: (kind: AgentKind) => AgentProfile | undefined;
+    saveProfileImpl?: (profile: AgentProfile) => void;
+    writeSigningKeyImpl?: (slug: string, identity: {
+        privateKey: string;
+        publicKey?: string;
+    }) => WriteSigningKeyResult;
+    now?: () => string;
+}
+export interface AgentProfileStageResult {
+    detected: DetectedAgent[];
+    createdProfiles: AgentProfile[];
+    /** Kinds that already had a profile before this run. */
+    skippedKinds: AgentKind[];
+    claimUrls: Array<{
+        kind: AgentKind;
+        slug: string;
+        claimUrl: string;
+    }>;
+    errors: Array<{
+        kind: AgentKind;
+        message: string;
+    }>;
+}
+export declare function runAgentProfileStage(options: AgentProfileStageOptions): Promise<AgentProfileStageResult>;
+//# sourceMappingURL=agent-profile-stage.d.ts.map

package/dist/utils/agent-profile-stage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profile-stage.d.ts","sourceRoot":"","sources":["../../src/utils/agent-profile-stage.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,SAAS,EACd,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,6BAA6B,CAAC;AAGrC;;;;;;;;;GASG;AAEH,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,KAAK,EAAE;IAC1C,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAElC,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,OAAO,CAAC;IACrB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3B,yBAAyB;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,gBAAgB,EAAE,qBAAqB,CAAC;IACxC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IAClD,qBAAqB,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,KAAK,YAAY,GAAG,SAAS,CAAC;IACtE,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,CAAC;IAClD,mBAAmB,CAAC,EAAE,CACpB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KACjD,qBAAqB,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,eAAe,EAAE,YAAY,EAAE,CAAC;IAChC,wDAAwD;IACxD,YAAY,EAAE,SAAS,EAAE,CAAC;IAC1B,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtE,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAkCD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,uBAAuB,CAAC,CA6HlC"}

package/dist/utils/agent-profile-stage.js

@@ -0,0 +1,153 @@
+import { detectAgents as defaultDetectAgents, } from "./agent-detector.js";
+import { findProfileByKind as defaultFindProfileByKind, saveProfile as defaultSaveProfile, } from "./agent-profiles.js";
+import { writeAgentSigningKey as defaultWriteAgentSigningKey, } from "./dco/signing-key-writer.js";
+import { isValidSlug } from "./dco/paths.js";
+/**
+ * Always returns a slug matching SLUG_PATTERN (packages/cli/src/utils/dco/
+ * paths.ts): sanitizes githubLogin down to the allowed charset and strips
+ * leading/trailing dashes, falling back to "agent" if that leaves nothing
+ * usable (e.g. a login that is punctuation-only). `kind` is always one of
+ * the fixed AgentKind values, already in that charset, so the result is
+ * guaranteed valid -- signingKeyPath/profilePath's own isValidSlug checks
+ * are defense-in-depth, not the only thing standing between a bad login
+ * and a thrown "Invalid agent slug" deep in the per-agent loop below.
+ */
+function suggestSlug(githubLogin, kind) {
+    const sanitizedLogin = (githubLogin || "")
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, "-")
+        .replace(/^-+|-+$/g, "");
+    const base = sanitizedLogin || "agent";
+    return `${base}-${kind}`;
+}
+async function defaultConfirm(agent) {
+    const inquirer = (await import("inquirer")).default;
+    const { answer } = await inquirer.prompt([
+        {
+            type: "confirm",
+            name: "answer",
+            message: `Set up a KYA profile for ${agent.kind}?`,
+            default: true,
+        },
+    ]);
+    return answer;
+}
+export async function runAgentProfileStage(options) {
+    const detectAgentsImpl = options.detectAgentsImpl ?? defaultDetectAgents;
+    const findProfileByKindImpl = options.findProfileByKindImpl ?? defaultFindProfileByKind;
+    const saveProfileImpl = options.saveProfileImpl ?? defaultSaveProfile;
+    const writeSigningKeyImpl = options.writeSigningKeyImpl ?? defaultWriteAgentSigningKey;
+    const now = options.now ?? (() => new Date().toISOString());
+    const detected = await detectAgentsImpl();
+    const skippedKinds = [];
+    const remaining = [];
+    for (const agent of detected) {
+        if (findProfileByKindImpl(agent.kind)) {
+            skippedKinds.push(agent.kind);
+        }
+        else {
+            remaining.push(agent);
+        }
+    }
+    const result = {
+        detected,
+        createdProfiles: [],
+        skippedKinds,
+        claimUrls: [],
+        errors: [],
+    };
+    if (remaining.length === 0 || options.skipProfiles) {
+        return result;
+    }
+    let toSetUp;
+    if (options.interactive) {
+        const confirmImpl = options.confirmImpl ?? defaultConfirm;
+        toSetUp = [];
+        for (const agent of remaining) {
+            if (await confirmImpl(agent)) {
+                toSetUp.push(agent);
+            }
+        }
+    }
+    else if (options.profilesFlag && options.profilesFlag.length > 0) {
+        const wanted = new Set(options.profilesFlag);
+        toSetUp = remaining.filter((agent) => wanted.has(agent.kind));
+    }
+    else {
+        // Bare non-TTY: default to skip. `--yes` deliberately does NOT reach
+        // here -- creating identities always needs an explicit per-agent yes or
+        // an explicit --profiles listing.
+        toSetUp = [];
+    }
+    for (const agent of toSetUp) {
+        const suggestedSlug = suggestSlug(options.githubLogin, agent.kind);
+        let registered;
+        try {
+            registered = await options.registerIdentity({
+                kind: agent.kind,
+                name: `${options.githubLogin ?? "Agent"} (${agent.kind})`,
+            });
+        }
+        catch (error) {
+            result.errors.push({
+                kind: agent.kind,
+                message: error instanceof Error ? error.message : String(error),
+            });
+            continue;
+        }
+        // The slug used for local storage must be the one the SERVER actually
+        // assigned, not the one we suggested: registration has no parameter to
+        // request a specific slug, so `registered.agentSlug` is the only value
+        // that's guaranteed to match `registered.did`. Using the suggestion
+        // instead would write the signing key and profile under a slug that
+        // disagrees with the registered identity -- a later `dco setup <slug>`
+        // would sign as the wrong agent. Only trust it once validated (it's
+        // server-controlled data about to become a path segment); an invalid
+        // or absent value falls back to our own already-valid suggestion.
+        const slug = registered.agentSlug && isValidSlug(registered.agentSlug)
+            ? registered.agentSlug
+            : suggestedSlug;
+        // Write the signing key the way `dco setup` does (the shared, tested
+        // conversion in signing-key-writer.ts) before saving the profile: a
+        // profile whose key never made it to disk would be silently unusable.
+        // A registration already happened for this agent by this point (the
+        // registerIdentity call above succeeded), so any unexpected throw here
+        // (not just writeAgentSigningKey's own returned "failed" status) is
+        // caught too -- one agent's key-write bug must not abort the rest of
+        // the batch, matching the resilience already proven for registration
+        // failures above.
+        try {
+            const keyResult = writeSigningKeyImpl(slug, {
+                privateKey: registered.privateKey,
+                publicKey: registered.publicKey,
+            });
+            if (keyResult.status === "failed") {
+                result.errors.push({ kind: agent.kind, message: keyResult.detail });
+                continue;
+            }
+            const profile = {
+                slug,
+                kind: agent.kind,
+                did: registered.did,
+                binPath: agent.binPath,
+                createdAt: now(),
+                registryUrl: `https://knowthat.ai/agents/${slug}`,
+                claimUrl: registered.claimUrl,
+                commandAllowlist: [],
+            };
+            saveProfileImpl(profile);
+            result.createdProfiles.push(profile);
+            if (registered.claimUrl) {
+                result.claimUrls.push({ kind: agent.kind, slug, claimUrl: registered.claimUrl });
+            }
+        }
+        catch (error) {
+            result.errors.push({
+                kind: agent.kind,
+                message: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=agent-profile-stage.js.map

package/dist/utils/agent-profile-stage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profile-stage.js","sourceRoot":"","sources":["../../src/utils/agent-profile-stage.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,IAAI,mBAAmB,GAGpC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,iBAAiB,IAAI,wBAAwB,EAC7C,WAAW,IAAI,kBAAkB,GAElC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,IAAI,2BAA2B,GAEpD,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAiE7C;;;;;;;;;GASG;AACH,SAAS,WAAW,CAAC,WAA+B,EAAE,IAAe;IACnE,MAAM,cAAc,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;SACvC,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,cAAc,IAAI,OAAO,CAAC;IACvC,OAAO,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,KAAoB;IAChD,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IACpD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACvC;YACE,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,4BAA4B,KAAK,CAAC,IAAI,GAAG;YAClD,OAAO,EAAE,IAAI;SACd;KACF,CAAC,CAAC;IACH,OAAO,MAAiB,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAiC;IAEjC,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,mBAAmB,CAAC;IACzE,MAAM,qBAAqB,GACzB,OAAO,CAAC,qBAAqB,IAAI,wBAAwB,CAAC;IAC5D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,kBAAkB,CAAC;IACtE,MAAM,mBAAmB,GACvB,OAAO,CAAC,mBAAmB,IAAI,2BAA2B,CAAC;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAE5D,MAAM,QAAQ,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAE1C,MAAM,YAAY,GAAgB,EAAE,CAAC;IACrC,MAAM,SAAS,GAAoB,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA4B;QACtC,QAAQ;QACR,eAAe,EAAE,EAAE;QACnB,YAAY;QACZ,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,EAAE;KACX,CAAC;IAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAwB,CAAC;IAC7B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC;QAC1D,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;YAC9B,IAAI,MAAM,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC7C,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;SAAM,CAAC;QACN,qEAAqE;QACrE,wEAAwE;QACxE,kCAAkC;QAClC,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,OAAO,CAAC,gBAAgB,CAAC;gBAC1C,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,KAAK,KAAK,CAAC,IAAI,GAAG;aAC1D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QAED,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,IAAI,GACR,UAAU,CAAC,SAAS,IAAI,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC;YACvD,CAAC,CAAC,UAAU,CAAC,SAAS;YACtB,CAAC,CAAC,aAAa,CAAC;QAEpB,qEAAqE;QACrE,oEAAoE;QACpE,sEAAsE;QACtE,oEAAoE;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,qEAAqE;QACrE,qEAAqE;QACrE,kBAAkB;QAClB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,EAAE;gBAC1C,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpE,SAAS;YACX,CAAC;YAED,MAAM,OAAO,GAAiB;gBAC5B,IAAI;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,EAAE,UAAU,CAAC,GAAG;gBACnB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,GAAG,EAAE;gBAChB,WAAW,EAAE,8BAA8B,IAAI,EAAE;gBACjD,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,gBAAgB,EAAE,EAAE;aACrB,CAAC;YACF,eAAe,CAAC,OAAO,CAAC,CAAC;YACzB,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBACxB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/agent-profiles.d.ts

@@ -0,0 +1,27 @@
+import type { AgentKind } from "./agent-detector.js";
+/**
+ * Local record of a per-agent KYA identity created by `kya-os init`'s agent
+ * profile stage. Holds NO key material -- keys stay under
+ * `~/.mcpi/keys/<slug>` (see `packages/cli/src/utils/dco/paths.ts`); this
+ * store carries only the slug that locates them.
+ */
+export interface AgentProfile {
+    slug: string;
+    kind: AgentKind;
+    /** did:web:knowthat.ai:agents:<slug> */
+    did: string;
+    binPath?: string;
+    createdAt: string;
+    registryUrl: string;
+    claimUrl?: string;
+    /** Consumed by the harness wrapper; empty/absent means dispatch-disabled. */
+    commandAllowlist?: string[];
+}
+/** Absolute path to the profiles directory, e.g. ~/.mcpi/profiles. */
+export declare function profilesDir(): string;
+/** All saved profiles. An empty machine (no profiles dir yet) returns []. */
+export declare function listProfiles(): AgentProfile[];
+/** Persist a profile at 0600 inside a 0700 directory. Overwrites by slug. */
+export declare function saveProfile(profile: AgentProfile): void;
+export declare function findProfileByKind(kind: AgentKind): AgentProfile | undefined;
+//# sourceMappingURL=agent-profiles.d.ts.map

package/dist/utils/agent-profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profiles.d.ts","sourceRoot":"","sources":["../../src/utils/agent-profiles.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,wCAAwC;IACxC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,sEAAsE;AACtE,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AA+BD,6EAA6E;AAC7E,wBAAgB,YAAY,IAAI,YAAY,EAAE,CAkB7C;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAGvD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,GAAG,YAAY,GAAG,SAAS,CAE3E"}

package/dist/utils/agent-profiles.js

@@ -0,0 +1,61 @@
+import { existsSync, readFileSync, readdirSync } from "fs";
+import { join, resolve } from "path";
+import { ensureSecureDir, isValidSlug, stateDir, writeSecureFile, } from "./cli-kit/index.js";
+/** Absolute path to the profiles directory, e.g. ~/.mcpi/profiles. */
+export function profilesDir() {
+    return resolve(process.env.MCPI_PROFILES_DIR || stateDir("mcpi", "profiles"));
+}
+function profilePath(slug) {
+    if (!isValidSlug(slug)) {
+        throw new Error(`Invalid agent slug "${slug}": must be lowercase letters, numbers, and dashes.`);
+    }
+    return join(profilesDir(), `${slug}.json`);
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((v) => typeof v === "string");
+}
+/** Runtime shape guard: a corrupt or hand-edited file must never crash listProfiles. */
+function isAgentProfile(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const v = value;
+    return (typeof v.slug === "string" &&
+        typeof v.kind === "string" &&
+        typeof v.did === "string" &&
+        typeof v.createdAt === "string" &&
+        typeof v.registryUrl === "string" &&
+        (v.binPath === undefined || typeof v.binPath === "string") &&
+        (v.claimUrl === undefined || typeof v.claimUrl === "string") &&
+        (v.commandAllowlist === undefined || isStringArray(v.commandAllowlist)));
+}
+/** All saved profiles. An empty machine (no profiles dir yet) returns []. */
+export function listProfiles() {
+    const dir = profilesDir();
+    if (!existsSync(dir)) {
+        return [];
+    }
+    const profiles = [];
+    for (const entry of readdirSync(dir)) {
+        if (!entry.endsWith(".json"))
+            continue;
+        try {
+            const parsed = JSON.parse(readFileSync(join(dir, entry), "utf-8"));
+            if (isAgentProfile(parsed)) {
+                profiles.push(parsed);
+            }
+        }
+        catch {
+            // Skip an unreadable/corrupt profile rather than fail the whole list.
+        }
+    }
+    return profiles;
+}
+/** Persist a profile at 0600 inside a 0700 directory. Overwrites by slug. */
+export function saveProfile(profile) {
+    ensureSecureDir(profilesDir());
+    writeSecureFile(profilePath(profile.slug), JSON.stringify(profile, null, 2) + "\n");
+}
+export function findProfileByKind(kind) {
+    return listProfiles().find((p) => p.kind === kind);
+}
+//# sourceMappingURL=agent-profiles.js.map

package/dist/utils/agent-profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-profiles.js","sourceRoot":"","sources":["../../src/utils/agent-profiles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EACL,eAAe,EACf,WAAW,EACX,QAAQ,EACR,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAsB5B,sEAAsE;AACtE,MAAM,UAAU,WAAW;IACzB,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,oDAAoD,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC3E,CAAC;AAED,wFAAwF;AACxF,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ;QACjC,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC;QAC1D,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;QAC5D,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,IAAI,aAAa,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY;IAC1B,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAC5E,IAAI,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,OAAqB;IAC/C,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/B,eAAe,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAe;IAC/C,OAAO,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACrD,CAAC"}

package/dist/utils/checkpoint-api.d.ts

@@ -0,0 +1,86 @@
+/**
+ * HTTP client for the `kya-os checkpoint init` claim-token flow (KYA-1037).
+ *
+ * Talks to the three public Checkpoint dashboard endpoints added for this
+ * flow: register a claim token, poll its status, and exchange a claimed
+ * token for a project API key. Base URL is `CHECKPOINT_API_URL` when set,
+ * else the production dashboard origin, mirroring the `KTA_API_URL` /
+ * `KTA_BASE_URL` override pattern already used by `register.ts`/`claim.ts`
+ * for the sibling knowthat.ai claim flow.
+ */
+/**
+ * Reconstructs the claim URL from a token alone, same shape the register
+ * endpoint itself builds (`/cli/claim?token=...` off the same base). Used
+ * only as a fallback for a marker written before this CLI persisted the
+ * server-issued `claimUrl` directly; a current run always reprints the
+ * value the server returned at register time.
+ */
+export declare function buildCheckpointClaimUrl(claimToken: string): string;
+/** The configured Checkpoint origin (protocol + host), to host-match a server-returned URL before acting on it. */
+export declare function checkpointOrigin(): string;
+/**
+ * True when CHECKPOINT_API_URL resolves to plain http on a non-localhost
+ * host: the claim token, and later the minted API key, cross that
+ * connection in the clear.
+ */
+export declare function isInsecureCheckpointOrigin(): boolean;
+export interface CheckpointRegisterHints {
+    domainHint?: string;
+    repoName?: string;
+    framework?: "nextjs" | "express" | "static" | "unknown";
+}
+export interface CheckpointRegisterResult {
+    registrationId: string;
+    claimToken: string;
+    claimUrl: string;
+    /**
+     * Short human-checkable code (`XXX-XXX`) derived from the registration
+     * id. The claim URL is first-claimer-wins with nothing binding it to
+     * the person who ran `checkpoint init`: if it leaks pre-claim (echoed
+     * into CI logs, shoulder-surfed), whoever opens it first claims it into
+     * THEIR org, and the real caller's CLI would otherwise proceed to
+     * install telemetry into the attacker's project. The claim page shows
+     * the same code so the human can cross-check terminal against browser
+     * before trusting a "claimed" status.
+     */
+    confirmationCode: string;
+    expiresAt: string;
+}
+export type CheckpointClaimStatus = "pending" | "claimed" | "expired";
+export interface CheckpointExchangeResult {
+    projectId: string;
+    friendlyId: string | null;
+    organizationId: string;
+    apiKey: string;
+    dashboardUrl: string;
+}
+/** True for an http(s) URL only -- never file:, vscode:, or any other scheme an OS handler might act on unexpectedly. */
+export declare function isHttpUrl(value: string): boolean;
+export declare const CONFIRMATION_CODE_RE: RegExp;
+export declare const API_KEY_RE: RegExp;
+export declare const PROJECT_ID_RE: RegExp;
+/**
+ * True only for an http(s) URL whose origin matches the configured
+ * Checkpoint origin. A same-shape check gated ONLY the open() call in
+ * checkpoint-init.ts (Bugbot, PR #658): announceClaim, the marker, and
+ * the --json payload still trusted and displayed any http(s) URL, so a
+ * compromised or misconfigured register response could still get a
+ * cross-origin, token-bearing link printed and persisted even though it
+ * was already judged unsafe to open. Validating at the source means
+ * every consumer of a parsed CheckpointRegisterResult gets the guarantee
+ * for free.
+ */
+export declare function isTrustedClaimUrl(value: string): boolean;
+/**
+ * `POST /api/cli/register`: mints a 24h claim token for this repo. The
+ * plaintext token is returned here and persisted (alongside
+ * `registrationId`) to `.checkpoint/registration.json` (0600, gitignored)
+ * by checkpoint-init.ts: a resumed run needs the token itself, not just
+ * the id, since the token IS the exchange credential.
+ */
+export declare function registerCheckpointProject(hints: CheckpointRegisterHints, signal?: AbortSignal): Promise<CheckpointRegisterResult>;
+/** `GET /api/cli/registrations/:id/status`: the poll target while waiting for the browser claim. */
+export declare function fetchCheckpointClaimStatus(registrationId: string, signal?: AbortSignal): Promise<CheckpointClaimStatus>;
+/** `POST /api/cli/exchange`: trades a claimed token for a project API key exactly once. */
+export declare function exchangeCheckpointClaim(claimToken: string, signal?: AbortSignal): Promise<CheckpointExchangeResult>;
+//# sourceMappingURL=checkpoint-api.d.ts.map

package/dist/utils/checkpoint-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-api.d.ts","sourceRoot":"","sources":["../../src/utils/checkpoint-api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkBH;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAIlE;AAED,mHAAmH;AACnH,wBAAgB,gBAAgB,IAAI,MAAM,CAGzC;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,IAAI,OAAO,CAiBpD;AAOD,MAAM,WAAW,uBAAuB;IACtC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;CACzD;AAED,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;;;;;OASG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtE,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB;AAyBD,yHAAyH;AACzH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOhD;AAUD,eAAO,MAAM,oBAAoB,QAA8B,CAAC;AAGhE,eAAO,MAAM,UAAU,QAA8B,CAAC;AACtD,eAAO,MAAM,aAAa,QAAsB,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOxD;AAoDD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,EAC9B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAUnC;AAED,oGAAoG;AACpG,wBAAsB,0BAA0B,CAC9C,cAAc,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,qBAAqB,CAAC,CAUhC;AAED,2FAA2F;AAC3F,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAUnC"}