@openreef/cli 0.1.1 → 0.3.0

package/dist/core/config-patcher.js

@@ -0,0 +1,156 @@
+import { readFile, writeFile, rename } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import JSON5 from 'json5';
+import { resolveConfigPath, resolveWorkspacePath } from './openclaw-paths.js';
+export async function readConfig(configPath, env) {
+    const path = configPath ?? resolveConfigPath(env);
+    let raw;
+    try {
+        raw = await readFile(path, 'utf-8');
+    }
+    catch {
+        // Config doesn't exist yet — start with empty
+        return { config: { agents: { list: [] }, bindings: [] }, raw: '', path };
+    }
+    // Warn about $include and ${VAR} references
+    if (raw.includes('$include') || /\$\{[^}]+\}/.test(raw)) {
+        console.warn('Config uses $include or ${VAR}. OpenReef patches raw config, which may differ from effective runtime config. Proceeding.');
+    }
+    const config = JSON5.parse(raw);
+    return { config, raw, path };
+}
+export async function writeConfig(configPath, config, options) {
+    const tmpPath = configPath + '.tmp';
+    const bakPath = configPath + '.bak';
+    const json = JSON.stringify(config, null, 2) + '\n';
+    await writeFile(tmpPath, json, 'utf-8');
+    // Backup original if exists
+    if (existsSync(configPath)) {
+        const existing = await readFile(configPath, 'utf-8');
+        let isAlreadyJson = false;
+        try {
+            JSON.parse(existing);
+            isAlreadyJson = true;
+        }
+        catch {
+            // Not valid JSON — was JSON5 with comments/trailing commas
+        }
+        await rename(configPath, bakPath);
+        if (!options?.silent && !isAlreadyJson) {
+            console.log(`Config rewritten as JSON — comments from original JSON5 removed. Backup: ${bakPath}`);
+        }
+    }
+    await rename(tmpPath, configPath);
+}
+function ensureAgentsList(config) {
+    if (!config.agents)
+        config.agents = {};
+    const agents = config.agents;
+    if (!Array.isArray(agents.list))
+        agents.list = [];
+    return agents.list;
+}
+function ensureBindings(config) {
+    if (!Array.isArray(config.bindings))
+        config.bindings = [];
+    return config.bindings;
+}
+export function addAgentEntry(config, agent, env) {
+    const list = ensureAgentsList(config);
+    // Idempotent: skip if agent with same id exists
+    if (list.some((a) => a.id === agent.id)) {
+        return config;
+    }
+    const entry = {
+        id: agent.id,
+    };
+    if (agent.name)
+        entry.name = agent.name;
+    entry.workspace = agent.workspace ?? resolveWorkspacePath(agent.id, env);
+    if (agent.model)
+        entry.model = agent.model;
+    if (agent.skills)
+        entry.skills = agent.skills;
+    if (agent.identity)
+        entry.identity = agent.identity;
+    if (agent.sandbox)
+        entry.sandbox = agent.sandbox;
+    if (agent.tools)
+        entry.tools = agent.tools;
+    list.push(entry);
+    return config;
+}
+export function removeAgentEntry(config, agentId) {
+    const agents = config.agents;
+    if (!agents || !Array.isArray(agents.list))
+        return config;
+    agents.list = agents.list.filter((a) => a.id !== agentId);
+    return config;
+}
+export function addBinding(config, binding) {
+    const bindings = ensureBindings(config);
+    if (bindings.some((b) => bindingsEqual(b, binding))) {
+        return config;
+    }
+    bindings.push(binding);
+    return config;
+}
+export function removeBinding(config, binding) {
+    if (!Array.isArray(config.bindings))
+        return config;
+    config.bindings = config.bindings.filter((b) => !bindingsEqual(b, binding));
+    return config;
+}
+export function setAgentToAgent(config, namespace) {
+    if (!config.tools)
+        config.tools = {};
+    const tools = config.tools;
+    if (!tools.agentToAgent)
+        tools.agentToAgent = {};
+    const a2a = tools.agentToAgent;
+    a2a.enabled = true;
+    if (!Array.isArray(a2a.allow))
+        a2a.allow = [];
+    const allow = a2a.allow;
+    const pattern = `${namespace}-*`;
+    if (!allow.includes(pattern)) {
+        allow.push(pattern);
+    }
+    return config;
+}
+export function removeAgentToAgent(config, namespace, otherFormationsInNamespace, wasEnabled) {
+    const tools = config.tools;
+    if (!tools?.agentToAgent)
+        return config;
+    const a2a = tools.agentToAgent;
+    if (!otherFormationsInNamespace) {
+        const pattern = `${namespace}-*`;
+        if (Array.isArray(a2a.allow)) {
+            a2a.allow = a2a.allow.filter((p) => p !== pattern);
+        }
+    }
+    // Only disable if we originally enabled it
+    if (wasEnabled === false && !otherFormationsInNamespace) {
+        a2a.enabled = false;
+    }
+    return config;
+}
+export function bindingsEqual(a, b) {
+    return canonicalJson(a) === canonicalJson(b);
+}
+function canonicalJson(obj) {
+    if (obj === null || obj === undefined)
+        return JSON.stringify(obj);
+    if (typeof obj !== 'object')
+        return JSON.stringify(obj);
+    if (Array.isArray(obj)) {
+        return '[' + obj.map(canonicalJson).join(',') + ']';
+    }
+    const sorted = Object.keys(obj)
+        .sort()
+        .map((k) => JSON.stringify(k) +
+        ':' +
+        canonicalJson(obj[k]));
+    return '{' + sorted.join(',') + '}';
+}
+//# sourceMappingURL=config-patcher.js.map

package/dist/core/config-patcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-patcher.js","sourceRoot":"","sources":["../../src/core/config-patcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAqB9E,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,UAAmB,EACnB,GAAuB;IAEvB,MAAM,IAAI,GAAG,UAAU,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;QAC9C,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IAED,4CAA4C;IAC5C,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,OAAO,CAAC,IAAI,CACV,0HAA0H,CAC3H,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,UAAkB,EAClB,MAA+B,EAC/B,OAA8B;IAE9B,MAAM,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IACpC,MAAM,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAEpD,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAExC,4BAA4B;IAC5B,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACrB,aAAa,GAAG,IAAI,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;QAED,MAAM,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CACT,4EAA4E,OAAO,EAAE,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CACvB,MAA+B;IAE/B,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAiC,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;IAClD,OAAO,MAAM,CAAC,IAAiC,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;IAC1D,OAAO,MAAM,CAAC,QAAqB,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAA+B,EAC/B,KAAiB,EACjB,GAAuB;IAEvB,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEtC,gDAAgD;IAChD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAA6B,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QACrE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAA4B;QACrC,EAAE,EAAE,KAAK,CAAC,EAAE;KACb,CAAC;IACF,IAAI,KAAK,CAAC,IAAI;QAAE,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,KAAK;QAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC3C,IAAI,KAAK,CAAC,MAAM;QAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9C,IAAI,KAAK,CAAC,QAAQ;QAAE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO;QAAE,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IACjD,IAAI,KAAK,CAAC,KAAK;QAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAE3C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,MAA+B,EAC/B,OAAe;IAEf,MAAM,MAAM,GAAG,MAAM,CAAC,MAA6C,CAAC;IACpE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC1D,MAAM,CAAC,IAAI,GAAI,MAAM,CAAC,IAAkC,CAAC,MAAM,CAC7D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CACxB,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAA+B,EAC/B,OAAwB;IAExB,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACxC,IACE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAoB,EAAE,OAAO,CAAC,CAAC,EAClE,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAA+B,EAC/B,OAAwB;IAExB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC;IACnD,MAAM,CAAC,QAAQ,GAAI,MAAM,CAAC,QAA8B,CAAC,MAAM,CAC7D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAClC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,MAA+B,EAC/B,SAAiB;IAEjB,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAgC,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,KAAK,CAAC,YAAY,GAAG,EAAE,CAAC;IACjD,MAAM,GAAG,GAAG,KAAK,CAAC,YAAuC,CAAC;IAE1D,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAEnB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAiB,CAAC;IACpC,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,CAAC;IACjC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAA+B,EAC/B,SAAiB,EACjB,0BAAmC,EACnC,UAAoB;IAEpB,MAAM,KAAK,GAAG,MAAM,CAAC,KAA4C,CAAC;IAClE,IAAI,CAAC,KAAK,EAAE,YAAY;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,GAAG,GAAG,KAAK,CAAC,YAAuC,CAAC;IAE1D,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,CAAC;QACjC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,KAAK,GAAI,GAAG,CAAC,KAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,2CAA2C;IAC3C,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,0BAA0B,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAkB,EAAE,CAAkB;IAClE,OAAO,aAAa,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAClE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAA8B,CAAC;SACvD,IAAI,EAAE;SACN,GAAG,CACF,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACjB,GAAG;QACH,aAAa,CAAE,GAA+B,CAAC,CAAC,CAAC,CAAC,CACrD,CAAC;IACJ,OAAO,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AACtC,CAAC"}

package/dist/core/device-identity.d.ts

@@ -0,0 +1,37 @@
+export interface DeviceIdentity {
+    deviceId: string;
+    publicKeyPem: string;
+    privateKeyPem: string;
+}
+export interface DeviceAuthEntry {
+    token: string;
+    role: string;
+    scopes: string[];
+    updatedAtMs: number;
+}
+export declare function loadOrCreateDeviceIdentity(env?: NodeJS.ProcessEnv): DeviceIdentity;
+export declare function signDevicePayload(privateKeyPem: string, payload: string): string;
+export declare function publicKeyRawBase64Url(publicKeyPem: string): string;
+export declare function buildDeviceAuthPayload(params: {
+    deviceId: string;
+    clientId: string;
+    clientMode: string;
+    role: string;
+    scopes: string[];
+    signedAtMs: number;
+    token: string | null;
+    nonce?: string;
+}): string;
+export declare function loadDeviceAuthToken(params: {
+    deviceId: string;
+    role: string;
+    env?: NodeJS.ProcessEnv;
+}): DeviceAuthEntry | null;
+export declare function storeDeviceAuthToken(params: {
+    deviceId: string;
+    role: string;
+    token: string;
+    scopes: string[];
+    env?: NodeJS.ProcessEnv;
+}): void;
+//# sourceMappingURL=device-identity.d.ts.map

package/dist/core/device-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-identity.d.ts","sourceRoot":"","sources":["../../src/core/device-identity.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAcD,wBAAgB,0BAA0B,CACxC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,GACtB,cAAc,CAkDhB;AAED,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,MAAM,CAGR;AAED,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAOlE;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAST;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,eAAe,GAAG,IAAI,CAgBzB;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG,IAAI,CAqCP"}

package/dist/core/device-identity.js

@@ -0,0 +1,135 @@
+import * as crypto from 'node:crypto';
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, } from 'node:fs';
+import { join } from 'node:path';
+import { resolveStateDir } from './openclaw-paths.js';
+/**
+ * Derive deviceId as SHA-256 hex of the raw 32-byte Ed25519 public key.
+ */
+function deriveDeviceId(publicKeyPem) {
+    const pubDer = crypto.createPublicKey(publicKeyPem).export({
+        type: 'spki',
+        format: 'der',
+    });
+    const rawPubKey = pubDer.subarray(pubDer.length - 32);
+    return crypto.createHash('sha256').update(rawPubKey).digest('hex');
+}
+export function loadOrCreateDeviceIdentity(env) {
+    const stateDir = resolveStateDir(env);
+    const identityDir = join(stateDir, 'identity');
+    const filePath = join(identityDir, 'device.json');
+    if (existsSync(filePath)) {
+        const data = JSON.parse(readFileSync(filePath, 'utf-8'));
+        // Revalidate deviceId: recompute from stored public key to detect
+        // stale entries written with old derivation (e.g., full SPKI DER hash)
+        const correctId = deriveDeviceId(data.publicKeyPem);
+        if (data.deviceId !== correctId) {
+            data.deviceId = correctId;
+            writeFileSync(filePath, JSON.stringify(data, null, 2), 'utf-8');
+            chmodSync(filePath, 0o600);
+        }
+        return {
+            deviceId: correctId,
+            publicKeyPem: data.publicKeyPem,
+            privateKeyPem: data.privateKeyPem,
+        };
+    }
+    // Generate new Ed25519 keypair
+    const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519', {
+        publicKeyEncoding: { type: 'spki', format: 'pem' },
+        privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
+    });
+    const deviceId = deriveDeviceId(publicKey);
+    const identity = {
+        deviceId,
+        publicKeyPem: publicKey,
+        privateKeyPem: privateKey,
+    };
+    mkdirSync(identityDir, { recursive: true });
+    const fileData = {
+        version: 1,
+        deviceId,
+        publicKeyPem: publicKey,
+        privateKeyPem: privateKey,
+        createdAtMs: Date.now(),
+    };
+    writeFileSync(filePath, JSON.stringify(fileData, null, 2), 'utf-8');
+    chmodSync(filePath, 0o600);
+    return identity;
+}
+export function signDevicePayload(privateKeyPem, payload) {
+    const sig = crypto.sign(null, Buffer.from(payload), privateKeyPem);
+    return sig.toString('base64url');
+}
+export function publicKeyRawBase64Url(publicKeyPem) {
+    const pubDer = crypto
+        .createPublicKey(publicKeyPem)
+        .export({ type: 'spki', format: 'der' });
+    // Ed25519 SPKI DER has 12-byte prefix before the 32-byte raw key
+    const raw = pubDer.subarray(pubDer.length - 32);
+    return Buffer.from(raw).toString('base64url');
+}
+export function buildDeviceAuthPayload(params) {
+    const scopeStr = params.scopes.join(',');
+    const tokenStr = params.token ?? '';
+    if (params.nonce) {
+        return `v2|${params.deviceId}|${params.clientId}|${params.clientMode}|${params.role}|${scopeStr}|${params.signedAtMs}|${tokenStr}|${params.nonce}`;
+    }
+    return `v1|${params.deviceId}|${params.clientId}|${params.clientMode}|${params.role}|${scopeStr}|${params.signedAtMs}|${tokenStr}`;
+}
+export function loadDeviceAuthToken(params) {
+    const stateDir = resolveStateDir(params.env);
+    const filePath = join(stateDir, 'identity', 'device-auth.json');
+    if (!existsSync(filePath))
+        return null;
+    try {
+        const data = JSON.parse(readFileSync(filePath, 'utf-8'));
+        // Verify deviceId matches — tokens issued for a different device are invalid
+        if (data.deviceId && data.deviceId !== params.deviceId)
+            return null;
+        const entry = data?.tokens?.[params.role];
+        if (!entry)
+            return null;
+        return entry;
+    }
+    catch {
+        return null;
+    }
+}
+export function storeDeviceAuthToken(params) {
+    const stateDir = resolveStateDir(params.env);
+    const identityDir = join(stateDir, 'identity');
+    const filePath = join(identityDir, 'device-auth.json');
+    let data = {
+        version: 1,
+        deviceId: params.deviceId,
+        tokens: {},
+    };
+    if (existsSync(filePath)) {
+        try {
+            const existing = JSON.parse(readFileSync(filePath, 'utf-8'));
+            // If deviceId changed, reset tokens (old tokens are invalid)
+            if (existing.deviceId === params.deviceId) {
+                data = existing;
+                // Ensure top-level fields are present
+                data.version = data.version ?? 1;
+                data.deviceId = params.deviceId;
+                if (!data.tokens)
+                    data.tokens = {};
+            }
+        }
+        catch {
+            // Corrupt file — overwrite with fresh structure
+        }
+    }
+    const tokens = data.tokens;
+    tokens[params.role] = {
+        token: params.token,
+        role: params.role,
+        scopes: params.scopes,
+        updatedAtMs: Date.now(),
+    };
+    mkdirSync(identityDir, { recursive: true });
+    writeFileSync(filePath, JSON.stringify(data, null, 2), 'utf-8');
+    chmodSync(filePath, 0o600);
+}
+//# sourceMappingURL=device-identity.js.map

package/dist/core/device-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-identity.js","sourceRoot":"","sources":["../../src/core/device-identity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EACL,YAAY,EACZ,aAAa,EACb,SAAS,EACT,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAetD;;GAEG;AACH,SAAS,cAAc,CAAC,YAAoB;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;QACzD,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACtD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,GAAuB;IAEvB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAElD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAEzD,kEAAkE;QAClE,uEAAuE;QACvE,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;YAC1B,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAChE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;QAED,OAAO;YACL,QAAQ,EAAE,SAAS;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE;QACtE,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE;QAClD,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;KACrD,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IAE3C,MAAM,QAAQ,GAAmB;QAC/B,QAAQ;QACR,YAAY,EAAE,SAAS;QACvB,aAAa,EAAE,UAAU;KAC1B,CAAC;IAEF,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG;QACf,OAAO,EAAE,CAAC;QACV,QAAQ;QACR,YAAY,EAAE,SAAS;QACvB,aAAa,EAAE,UAAU;QACzB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;KACxB,CAAC;IACF,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACpE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAE3B,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,aAAqB,EACrB,OAAe;IAEf,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,YAAoB;IACxD,MAAM,MAAM,GAAG,MAAM;SAClB,eAAe,CAAC,YAAY,CAAC;SAC7B,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,iEAAiE;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAStC;IACC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IAEpC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,MAAM,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,IAAI,QAAQ,IAAI,MAAM,CAAC,UAAU,IAAI,QAAQ,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;IACrJ,CAAC;IAED,OAAO,MAAM,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,IAAI,QAAQ,IAAI,MAAM,CAAC,UAAU,IAAI,QAAQ,EAAE,CAAC;AACrI,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAInC;IACC,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAEhE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACzD,6EAA6E;QAC7E,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,KAAwB,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,MAMpC;IACC,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;IAEvD,IAAI,IAAI,GAA4B;QAClC,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,EAAE;KACX,CAAC;IACF,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7D,6DAA6D;YAC7D,IAAI,QAAQ,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC1C,IAAI,GAAG,QAAQ,CAAC;gBAChB,sCAAsC;gBACtC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;gBACjC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;gBAChC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;YACrC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAiC,CAAC;IACtD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG;QACpB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;KACE,CAAC;IAE5B,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAChE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/core/gateway-client.d.ts

@@ -0,0 +1,98 @@
+export interface CronSchedule {
+    kind: 'cron' | 'every' | 'at';
+    expr?: string;
+    tz?: string;
+    everyMs?: number;
+    at?: string;
+}
+export interface CronPayload {
+    kind: 'agentTurn' | 'systemEvent';
+    message?: string;
+    text?: string;
+    model?: string;
+}
+export interface CronDelivery {
+    channel?: string;
+}
+export interface CronAddParams {
+    name: string;
+    schedule: CronSchedule;
+    sessionTarget: 'main' | 'isolated';
+    wakeMode: 'next-heartbeat' | 'now';
+    payload: CronPayload;
+    agentId?: string;
+    description?: string;
+    enabled?: boolean;
+    deleteAfterRun?: boolean;
+    delivery?: CronDelivery;
+}
+export interface CronJobPatch {
+    name?: string;
+    schedule?: CronSchedule;
+    sessionTarget?: 'main' | 'isolated';
+    wakeMode?: 'next-heartbeat' | 'now';
+    payload?: CronPayload;
+    agentId?: string;
+    description?: string;
+    enabled?: boolean;
+    delivery?: CronDelivery;
+}
+export interface CronJob {
+    id: string;
+    name: string;
+    schedule: CronSchedule;
+    sessionTarget: string;
+    wakeMode: string;
+    payload: CronPayload;
+    agentId?: string;
+    enabled: boolean;
+    state: string;
+    createdAtMs: number;
+    updatedAtMs: number;
+}
+export interface GatewayClientOptions {
+    url: string;
+    token?: string;
+    password?: string;
+    timeoutMs?: number;
+    env?: NodeJS.ProcessEnv;
+    /** Skip loading stored device auth token. Set true for remote URL overrides. */
+    skipStoredAuth?: boolean;
+}
+/**
+ * Resolve Gateway auth credentials from multiple sources.
+ * If gatewayUrl is explicitly provided (override), ONLY explicit --gateway-token
+ * or --gateway-password satisfy auth — env/config fallbacks are NOT accepted.
+ * For local (non-overridden) URLs: explicit CLI → env vars → config file values.
+ */
+export declare function resolveGatewayAuth(opts: {
+    gatewayUrl?: string;
+    gatewayToken?: string;
+    gatewayPassword?: string;
+    config?: Record<string, unknown>;
+    env?: NodeJS.ProcessEnv;
+}): {
+    token?: string;
+    password?: string;
+    skipStoredAuth?: boolean;
+};
+export declare class GatewayClient {
+    private ws;
+    private pending;
+    private connected;
+    private options;
+    private timeoutMs;
+    constructor(options: GatewayClientOptions);
+    connect(): Promise<void>;
+    call<T>(method: string, params?: unknown): Promise<T>;
+    close(): void;
+    cronAdd(params: CronAddParams): Promise<{
+        id: string;
+    }>;
+    cronRemove(id: string): Promise<void>;
+    cronUpdate(id: string, patch: CronJobPatch): Promise<void>;
+    cronList(options?: {
+        includeDisabled?: boolean;
+    }): Promise<CronJob[]>;
+}
+//# sourceMappingURL=gateway-client.d.ts.map

package/dist/core/gateway-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-client.d.ts","sourceRoot":"","sources":["../../src/core/gateway-client.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,WAAW,GAAG,aAAa,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC;IACvB,aAAa,EAAE,MAAM,GAAG,UAAU,CAAC;IACnC,QAAQ,EAAE,gBAAgB,GAAG,KAAK,CAAC;IACnC,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IACpC,QAAQ,CAAC,EAAE,gBAAgB,GAAG,KAAK,CAAC;IACpC,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,YAAY,CAAC;CACzB;AAED,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,gFAAgF;IAChF,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,CAkClE;AAQD,qBAAa,aAAa;IACxB,OAAO,CAAC,EAAE,CAA0B;IACpC,OAAO,CAAC,OAAO,CAAqC;IACpD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,SAAS,CAAS;gBAEd,OAAO,EAAE,oBAAoB;IAKnC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IA8KxB,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAwB3D,KAAK,IAAI,IAAI;IAQP,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;IAIvD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D,QAAQ,CAAC,OAAO,CAAC,EAAE;QACvB,eAAe,CAAC,EAAE,OAAO,CAAC;KAC3B,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAOvB"}