@mecha.im/cli 0.3.4

package/dist/shared/totp.js

@@ -0,0 +1,75 @@
+import { createHmac, randomBytes } from "node:crypto";
+// RFC 6238 TOTP — HMAC-SHA1, 6 digits, 30-second step
+const DIGITS = 6;
+const STEP = 30;
+const WINDOW = 1; // ±1 window tolerance
+const BASE32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+export function generateSecret() {
+    const bytes = randomBytes(20);
+    return base32Encode(bytes);
+}
+export function base32Encode(buf) {
+    let bits = 0;
+    let value = 0;
+    let out = "";
+    for (const byte of buf) {
+        value = (value << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            bits -= 5;
+            out += BASE32[(value >>> bits) & 0x1f];
+        }
+    }
+    if (bits > 0) {
+        out += BASE32[(value << (5 - bits)) & 0x1f];
+    }
+    return out;
+}
+export function base32Decode(encoded) {
+    const cleaned = encoded.replace(/[\s=]/g, "").toUpperCase();
+    let bits = 0;
+    let value = 0;
+    const bytes = [];
+    for (const ch of cleaned) {
+        const idx = BASE32.indexOf(ch);
+        if (idx === -1)
+            throw new Error(`Invalid base32 character: ${ch}`);
+        value = (value << 5) | idx;
+        bits += 5;
+        if (bits >= 8) {
+            bits -= 8;
+            bytes.push((value >>> bits) & 0xff);
+        }
+    }
+    return Buffer.from(bytes);
+}
+function hotp(secret, counter) {
+    const buf = Buffer.alloc(8);
+    buf.writeBigUInt64BE(counter);
+    const hmac = createHmac("sha1", secret).update(buf).digest();
+    const offset = hmac[hmac.length - 1] & 0x0f;
+    const code = ((hmac[offset] & 0x7f) << 24) |
+        ((hmac[offset + 1] & 0xff) << 16) |
+        ((hmac[offset + 2] & 0xff) << 8) |
+        (hmac[offset + 3] & 0xff);
+    return String(code % 10 ** DIGITS).padStart(DIGITS, "0");
+}
+export function generateTOTP(secretBase32, time) {
+    const secret = base32Decode(secretBase32);
+    const counter = BigInt(Math.floor((time ?? Date.now() / 1000) / STEP));
+    return hotp(secret, counter);
+}
+export function verifyTOTP(secretBase32, code, time) {
+    const secret = base32Decode(secretBase32);
+    const now = time ?? Date.now() / 1000;
+    const counter = Math.floor(now / STEP);
+    for (let i = -WINDOW; i <= WINDOW; i++) {
+        if (hotp(secret, BigInt(counter + i)) === code)
+            return true;
+    }
+    return false;
+}
+export function totpUri(secret, issuer, account) {
+    return `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(account)}?secret=${secret}&issuer=${encodeURIComponent(issuer)}&algorithm=SHA1&digits=${DIGITS}&period=${STEP}`;
+}
+//# sourceMappingURL=totp.js.map

package/dist/shared/totp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"totp.js","sourceRoot":"","sources":["../../shared/totp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,sDAAsD;AAEtD,MAAM,MAAM,GAAG,CAAC,CAAC;AACjB,MAAM,IAAI,GAAG,EAAE,CAAC;AAChB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,sBAAsB;AAExC,MAAM,MAAM,GAAG,kCAAkC,CAAC;AAElD,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;QAC5B,IAAI,IAAI,CAAC,CAAC;QACV,OAAO,IAAI,IAAI,CAAC,EAAE,CAAC;YACjB,IAAI,IAAI,CAAC,CAAC;YACV,GAAG,IAAI,MAAM,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,GAAG,IAAI,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;QACnE,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC;QAC3B,IAAI,IAAI,CAAC,CAAC;QACV,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;YACd,IAAI,IAAI,CAAC,CAAC;YACV,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,IAAI,CAAC,MAAc,EAAE,OAAe;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC;IAC7C,MAAM,IAAI,GACR,CAAC,CAAC,IAAI,CAAC,MAAM,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,GAAG,IAAI,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,IAAI,GAAG,EAAE,IAAI,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,YAAoB,EAAE,IAAa;IAC9D,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,YAAoB,EAAE,IAAY,EAAE,IAAa;IAC1E,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAc,EAAE,MAAc,EAAE,OAAe;IACrE,OAAO,kBAAkB,kBAAkB,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,WAAW,MAAM,WAAW,kBAAkB,CAAC,MAAM,CAAC,0BAA0B,MAAM,WAAW,IAAI,EAAE,CAAC;AAC5L,CAAC"}

package/dist/shared/validation.d.ts

@@ -0,0 +1,7 @@
+export declare const NAME_PATTERN: RegExp;
+export declare const NAME_MAX_LENGTH = 32;
+export declare function isValidName(input: string): boolean;
+export declare function assertValidName(input: string): void;
+export declare function parsePort(raw: string): number | undefined;
+export declare function isValidUrl(input: string): boolean;
+//# sourceMappingURL=validation.d.ts.map

package/dist/shared/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../shared/validation.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,QAAoC,CAAC;AAC9D,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAGlD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAInD;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKzD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAOjD"}

package/dist/shared/validation.js

@@ -0,0 +1,30 @@
+export const NAME_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+export const NAME_MAX_LENGTH = 32;
+export function isValidName(input) {
+    if (input.length === 0 || input.length > NAME_MAX_LENGTH)
+        return false;
+    return NAME_PATTERN.test(input);
+}
+export function assertValidName(input) {
+    if (!isValidName(input)) {
+        throw new Error(`Invalid name: "${input}" (must be lowercase, alphanumeric, hyphens, 1-32 chars)`);
+    }
+}
+export function parsePort(raw) {
+    if (!/^\d+$/.test(raw))
+        return undefined;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < 1 || n > 65535)
+        return undefined;
+    return n;
+}
+export function isValidUrl(input) {
+    try {
+        const url = new URL(input);
+        return url.protocol === "http:" || url.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=validation.js.map

package/dist/shared/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../shared/validation.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG,iCAAiC,CAAC;AAC9D,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,0DAA0D,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK;QAAE,OAAO,SAAS,CAAC;IACjE,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/auth.d.ts

@@ -0,0 +1,48 @@
+import { z } from "zod";
+export declare const credentialTypes: readonly ["api_key", "oauth_token", "bot_token", "secret", "tailscale"];
+declare const credentialSchema: z.ZodObject<{
+    name: z.ZodString;
+    type: z.ZodEnum<{
+        secret: "secret";
+        api_key: "api_key";
+        oauth_token: "oauth_token";
+        bot_token: "bot_token";
+        tailscale: "tailscale";
+    }>;
+    env: z.ZodString;
+    key: z.ZodString;
+    account: z.ZodOptional<z.ZodString>;
+    created_at: z.ZodOptional<z.ZodString>;
+    meta: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export type Credential = z.infer<typeof credentialSchema>;
+export type CredentialType = Credential["type"];
+export declare function loadCredentials(): Credential[];
+export declare function getCredential(name: string): Credential;
+export declare function listCredentials(): Credential[];
+export declare function addCredential(cred: Credential): void;
+export declare function removeCredential(name: string): boolean;
+export declare function detectCredentialType(key: string): {
+    type: CredentialType;
+    env: string;
+};
+export interface ResolvedAuth {
+    key: string;
+    env: string;
+    source: string;
+}
+/**
+ * Resolve auth credentials for a Claude bot.
+ * Priority: explicit profile → default_auth setting → env vars.
+ */
+export declare function resolveAuth(profileName?: string): ResolvedAuth;
+/**
+ * Get all credentials that should be passed through to bot containers.
+ * Returns credentials matching the given env var names.
+ */
+export declare function getPassthroughCredentials(envNames: string[]): Array<{
+    env: string;
+    key: string;
+}>;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/src/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,eAAO,MAAM,eAAe,yEAA0E,CAAC;AAEvG,QAAA,MAAM,gBAAgB;;;;;;;;;;;;;;iBAQpB,CAAC;AAMH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;AAUhD,wBAAgB,eAAe,IAAI,UAAU,EAAE,CAgB9C;AAWD,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAKtD;AAED,wBAAgB,eAAe,IAAI,UAAU,EAAE,CAE9C;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI,CAUpD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOtD;AAID,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CASvF;AAID,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,CAkC9D;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAUjG"}

package/dist/src/auth.js

@@ -0,0 +1,160 @@
+import { readFileSync, existsSync, chmodSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
+import { getMechaDir, readSettings } from "./store.js";
+import { atomicWriteText } from "../shared/atomic-write.js";
+import { AuthProfileNotFoundError, AuthNotConfiguredError, InvalidNameError } from "../shared/errors.js";
+import { log } from "../shared/logger.js";
+import { isValidName } from "../shared/validation.js";
+// --- Schema ---
+export const credentialTypes = ["api_key", "oauth_token", "bot_token", "secret", "tailscale"];
+const credentialSchema = z.object({
+    name: z.string().min(1),
+    type: z.enum(credentialTypes),
+    env: z.string().min(1),
+    key: z.string().min(1),
+    account: z.string().optional(),
+    created_at: z.string().optional(),
+    meta: z.record(z.string(), z.string()).optional(),
+});
+const credentialsFileSchema = z.object({
+    credentials: z.array(credentialSchema).default([]),
+});
+// --- Paths ---
+function credentialsPath() {
+    return join(getMechaDir(), "credentials.yaml");
+}
+// --- Read / Write ---
+export function loadCredentials() {
+    const path = credentialsPath();
+    if (!existsSync(path))
+        return [];
+    try {
+        const raw = readFileSync(path, "utf-8");
+        const parsed = parseYaml(raw);
+        const result = credentialsFileSchema.safeParse(parsed);
+        if (!result.success) {
+            log.warn("credentials.yaml validation failed", { error: result.error.message });
+            return [];
+        }
+        return result.data.credentials;
+    }
+    catch (err) {
+        log.warn("Failed to read credentials.yaml", { error: err instanceof Error ? err.message : String(err) });
+        return [];
+    }
+}
+function saveCredentials(credentials) {
+    const path = credentialsPath();
+    const content = stringifyYaml({ credentials }, { lineWidth: 0 });
+    atomicWriteText(path, content);
+    try {
+        chmodSync(path, 0o600);
+    }
+    catch { /* best-effort */ }
+}
+// --- CRUD ---
+export function getCredential(name) {
+    const creds = loadCredentials();
+    const found = creds.find((c) => c.name === name);
+    if (!found)
+        throw new AuthProfileNotFoundError(name);
+    return found;
+}
+export function listCredentials() {
+    return loadCredentials();
+}
+export function addCredential(cred) {
+    if (!isValidName(cred.name))
+        throw new InvalidNameError(cred.name);
+    const creds = loadCredentials();
+    const idx = creds.findIndex((c) => c.name === cred.name);
+    if (idx >= 0) {
+        creds[idx] = cred;
+    }
+    else {
+        creds.push(cred);
+    }
+    saveCredentials(creds);
+}
+export function removeCredential(name) {
+    const creds = loadCredentials();
+    const idx = creds.findIndex((c) => c.name === name);
+    if (idx < 0)
+        return false;
+    creds.splice(idx, 1);
+    saveCredentials(creds);
+    return true;
+}
+// --- Type detection from key prefix ---
+export function detectCredentialType(key) {
+    if (key.startsWith("sk-ant-oat"))
+        return { type: "oauth_token", env: "CLAUDE_CODE_OAUTH_TOKEN" };
+    if (key.startsWith("sk-ant-api"))
+        return { type: "api_key", env: "ANTHROPIC_API_KEY" };
+    if (key.startsWith("tskey-"))
+        return { type: "tailscale", env: "MECHA_TS_AUTH_KEY" };
+    if (key.startsWith("sk-"))
+        return { type: "api_key", env: "OPENAI_API_KEY" };
+    if (key.startsWith("xai-"))
+        return { type: "api_key", env: "XAI_API_KEY" };
+    if (key.startsWith("AIzaSy"))
+        return { type: "api_key", env: "GEMINI_API_KEY" };
+    // Default: treat as generic secret
+    return { type: "secret", env: "ANTHROPIC_API_KEY" };
+}
+/**
+ * Resolve auth credentials for a Claude bot.
+ * Priority: explicit profile → default_auth setting → env vars.
+ */
+export function resolveAuth(profileName) {
+    // 1. Explicit profile name
+    if (profileName) {
+        const cred = getCredential(profileName);
+        if (cred.type !== "api_key" && cred.type !== "oauth_token") {
+            throw new AuthProfileNotFoundError(`"${profileName}" is not a Claude auth credential (type: ${cred.type})`);
+        }
+        return { key: cred.key, env: cred.env, source: `profile:${profileName}` };
+    }
+    // 2. Default auth from mecha settings
+    const settings = readSettings();
+    if (settings.default_auth) {
+        try {
+            const cred = getCredential(settings.default_auth);
+            if (cred.type === "api_key" || cred.type === "oauth_token") {
+                return { key: cred.key, env: cred.env, source: `default:${settings.default_auth}` };
+            }
+        }
+        catch (err) {
+            if (!(err instanceof AuthProfileNotFoundError))
+                throw err;
+        }
+    }
+    // 3. Environment variables
+    const oauthToken = process.env.CLAUDE_CODE_OAUTH_TOKEN;
+    if (oauthToken) {
+        return { key: oauthToken, env: "CLAUDE_CODE_OAUTH_TOKEN", source: "env:CLAUDE_CODE_OAUTH_TOKEN" };
+    }
+    const apiKey = process.env.ANTHROPIC_API_KEY;
+    if (apiKey) {
+        return { key: apiKey, env: "ANTHROPIC_API_KEY", source: "env:ANTHROPIC_API_KEY" };
+    }
+    throw new AuthNotConfiguredError();
+}
+/**
+ * Get all credentials that should be passed through to bot containers.
+ * Returns credentials matching the given env var names.
+ */
+export function getPassthroughCredentials(envNames) {
+    const creds = loadCredentials();
+    const result = [];
+    for (const envName of envNames) {
+        const cred = creds.find((c) => c.env === envName);
+        if (cred) {
+            result.push({ env: envName, key: cred.key });
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=auth.js.map

package/dist/src/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,MAAM,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACzG,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,iBAAiB;AAEjB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAU,CAAC;AAEvG,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnD,CAAC,CAAC;AAKH,gBAAgB;AAEhB,SAAS,eAAe;IACtB,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,kBAAkB,CAAC,CAAC;AACjD,CAAC;AAED,uBAAuB;AAEvB,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzG,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,WAAyB;IAChD,MAAM,IAAI,GAAG,eAAe,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,aAAa,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IACjE,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,CAAC;QAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;AAC7D,CAAC;AAED,eAAe;AAEf,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACjD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,eAAe,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAAgB;IAC5C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACb,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,eAAe,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACpD,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1B,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACrB,eAAe,CAAC,KAAK,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yCAAyC;AAEzC,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,yBAAyB,EAAE,CAAC;IACjG,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC;IACvF,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAM,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC;IACzF,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QAAS,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;IACpF,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QAAQ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;IACjF,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAM,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;IACpF,mCAAmC;IACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC;AACtD,CAAC;AAUD;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,WAAoB;IAC9C,2BAA2B;IAC3B,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3D,MAAM,IAAI,wBAAwB,CAAC,IAAI,WAAW,4CAA4C,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9G,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,WAAW,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,sCAAsC;IACtC,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAClD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC3D,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,QAAQ,CAAC,YAAY,EAAE,EAAE,CAAC;YACtF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAAE,MAAM,GAAG,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACvD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,yBAAyB,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;IACpG,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC7C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,IAAI,sBAAsB,EAAE,CAAC;AACrC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAAkB;IAC1D,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,MAAM,MAAM,GAAwC,EAAE,CAAC;IACvD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,CAAC;QAClD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/cli-output.d.ts

@@ -0,0 +1,14 @@
+/**
+ * CLI output utilities: color, spinners, status formatting.
+ * Respects NO_COLOR env var and --no-color flag.
+ */
+import pc from "picocolors";
+export { pc };
+export declare function statusColor(status: string): string;
+export declare function botName(name: string): string;
+export declare function success(msg: string): string;
+export declare function error(msg: string): string;
+export declare function hint(msg: string): string;
+export declare function dim(msg: string): string;
+export declare function withSpinner<T>(label: string, fn: () => Promise<T>): Promise<T>;
+//# sourceMappingURL=cli-output.d.ts.map

package/dist/src/cli-output.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-output.d.ts","sourceRoot":"","sources":["../../src/cli-output.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,YAAY,CAAC;AAG5B,OAAO,EAAE,EAAE,EAAE,CAAC;AAEd,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CASlD;AAED,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzC;AAED,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAExC;AAED,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvC;AAED,wBAAsB,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAYpF"}

package/dist/src/cli-output.js

@@ -0,0 +1,47 @@
+/**
+ * CLI output utilities: color, spinners, status formatting.
+ * Respects NO_COLOR env var and --no-color flag.
+ */
+import pc from "picocolors";
+// Re-export picocolors so all CLI code imports from one place
+export { pc };
+export function statusColor(status) {
+    switch (status) {
+        case "running": return pc.green(status);
+        case "exited":
+        case "stopped": return pc.yellow(status);
+        case "error":
+        case "dead": return pc.red(status);
+        default: return pc.dim(status);
+    }
+}
+export function botName(name) {
+    return pc.cyan(name);
+}
+export function success(msg) {
+    return pc.green("✓") + " " + msg;
+}
+export function error(msg) {
+    return pc.red("✗") + " " + msg;
+}
+export function hint(msg) {
+    return pc.dim("  Hint: " + msg);
+}
+export function dim(msg) {
+    return pc.dim(msg);
+}
+export async function withSpinner(label, fn) {
+    // Dynamic import to handle ESM ora
+    const { default: ora } = await import("ora");
+    const spinner = ora(label).start();
+    try {
+        const result = await fn();
+        spinner.succeed();
+        return result;
+    }
+    catch (err) {
+        spinner.fail();
+        throw err;
+    }
+}
+//# sourceMappingURL=cli-output.js.map

package/dist/src/cli-output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-output.js","sourceRoot":"","sources":["../../src/cli-output.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,YAAY,CAAC;AAE5B,8DAA8D;AAC9D,OAAO,EAAE,EAAE,EAAE,CAAC;AAEd,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,KAAK,CAAC,GAAW;IAC/B,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,GAAW;IAC9B,OAAO,EAAE,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,GAAW;IAC7B,OAAO,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAI,KAAa,EAAE,EAAoB;IACtE,mCAAmC;IACnC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;QAC1B,OAAO,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/src/cli-utils.d.ts

@@ -0,0 +1,15 @@
+import type { BotInfo } from "./docker.types.js";
+export declare function formatUptime(startedAtIso: string | undefined): string;
+export declare function readCostsToday(botPath: string | undefined): string;
+export declare function requireValidName(name: string): asserts name is string;
+export declare function escapeAttr(s: string): string;
+export declare function collectAttachments(paths: string[]): string;
+/** Print a formatted table with header, separator, and rows */
+export declare function printTable(header: string[], rows: string[][]): void;
+/** Set up Headscale container and save settings */
+export declare function setupHeadscale(settings: Record<string, unknown>): Promise<void>;
+/** Fetch remote bots from Headscale and merge with local list */
+export declare function fetchRemoteBots(localBots: BotInfo[], headscaleUrl: string, headscaleApiKey: string): Promise<BotInfo[]>;
+/** Read an SSE stream from a bot prompt response and print to stdout. Returns true on success. */
+export declare function readPromptSSE(reader: ReadableStreamDefaultReader<Uint8Array>): Promise<boolean>;
+//# sourceMappingURL=cli-utils.d.ts.map

package/dist/src/cli-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-utils.d.ts","sourceRoot":"","sources":["../../src/cli-utils.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAGjD,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAYrE;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAalE;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,IAAI,MAAM,CAKrE;AAED,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAoD1D;AAID,+DAA+D;AAC/D,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,IAAI,CASnE;AAED,mDAAmD;AACnD,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CrF;AAED,iEAAiE;AACjE,wBAAsB,eAAe,CACnC,SAAS,EAAE,OAAO,EAAE,EACpB,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,OAAO,EAAE,CAAC,CA2BpB;AAED,kGAAkG;AAClG,wBAAsB,aAAa,CAAC,MAAM,EAAE,2BAA2B,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAsCrG"}