@pleri/olam-cli 0.1.120 → 0.1.126

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,+DAA+D,CAAC;IAC7E,4EAA4E;IAC5E,0EAA0E;KACzE,MAAM,CAAC,OAAO,EAAE,6DAA6D,CAAC;KAC9E,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAE7B,gEAAgE;AAChE,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACnD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;IACxB,qEAAqE;IACrE,+EAA+E;IAC/E,iDAAiD;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACzF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK;YACtF,qEAAqE,CACxE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,sEAAsE;AACtE,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,mBAAmB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAC/D,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5B,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAE1B,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,wBAAwB;AAExB,OAAO,CAAC,KAAK,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,MAAM,CAAC;KACZ,WAAW,CAAC,+DAA+D,CAAC;IAC7E,4EAA4E;IAC5E,0EAA0E;KACzE,MAAM,CAAC,OAAO,EAAE,6DAA6D,CAAC;KAC9E,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;AAE7B,gEAAgE;AAChE,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACnD,IAAI,YAAY,KAAK,CAAC,CAAC,EAAE,CAAC;IACxB,qEAAqE;IACrE,+EAA+E;IAC/E,iDAAiD;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACzF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0DAA0D,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK;YACtF,qEAAqE,CACxE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,sEAAsE;AACtE,yEAAyE;AACzE,0EAA0E;AAC1E,wEAAwE;AACxE,mBAAmB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;AAC/D,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,eAAe,CAAC,OAAO,CAAC,CAAC;AACzB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC3B,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAC1B,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC5B,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,YAAY,CAAC,OAAO,CAAC,CAAC;AACtB,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,WAAW,CAAC,OAAO,CAAC,CAAC;AACrB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,UAAU,CAAC,OAAO,CAAC,CAAC;AACpB,cAAc,CAAC,OAAO,CAAC,CAAC;AACxB,aAAa,CAAC,OAAO,CAAC,CAAC;AACvB,gBAAgB,CAAC,OAAO,CAAC,CAAC;AAE1B,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,wBAAwB;AAExB,OAAO,CAAC,KAAK,EAAE,CAAC"}

package/dist/lib/memory-secret.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Helpers for the agent-memory bearer secret at `~/.olam/memory-secret`.
+ *
+ * Pattern mirrors `~/.olam/auth-secret`:
+ *   - 0600 mode enforced on every write
+ *   - atomic write via tmp + rename
+ *   - generated on first call to `ensureMemorySecret()`
+ *
+ * Phase C's `cloud-memory-secret` reuses the path-arg form
+ * (`ensureSecretAtPath` / `readSecretAtPath`) so local + cloud share
+ * the same code path.
+ *
+ * Plan reference: docs/plans/olam-agent-memory-distributed/phase-a-tasks.md A3
+ */
+export declare const MEMORY_SECRET_PATH: string;
+export declare const SECRET_LEN_BYTES = 32;
+/** Generate a 64-char hex secret. */
+export declare function generateSecret(): string;
+/**
+ * Write `value` to `path` atomically with mode 0600. Parent directory
+ * created with default mode if absent.
+ */
+export declare function writeSecretAtPath(path: string, value: string): void;
+/**
+ * Read `path` as a string. Returns `null` if missing. Warns to stderr
+ * if mode is not 0600 (caller decides whether to proceed).
+ */
+export declare function readSecretAtPathOrNull(path: string): string | null;
+/** Read `path` or throw if missing. */
+export declare function readSecretAtPath(path: string): string;
+/**
+ * Ensure `~/.olam/memory-secret` exists with mode 0600. Generates a
+ * fresh 64-char hex secret on first call. Idempotent.
+ */
+export declare function ensureMemorySecret(path?: string): string;
+/** Read the local-mode memory secret (no-throw shape). */
+export declare function readMemorySecretOrNull(path?: string): string | null;
+/** Read the local-mode memory secret (throw shape). */
+export declare function readMemorySecret(path?: string): string;
+/**
+ * Rotate the secret: generate fresh value, atomically replace the file,
+ * return the new value. Caller is responsible for restarting any
+ * running memory service so it picks up the new value.
+ */
+export declare function rotateMemorySecret(path?: string): string;
+/** Convenience: are we wired for local-mode memory? */
+export declare function hasMemorySecret(path?: string): boolean;
+//# sourceMappingURL=memory-secret.d.ts.map

package/dist/lib/memory-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-secret.d.ts","sourceRoot":"","sources":["../../src/lib/memory-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAOH,eAAO,MAAM,kBAAkB,QAA4C,CAAC;AAC5E,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,qCAAqC;AACrC,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAOnE;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASlE;AAED,uCAAuC;AACvC,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAA2B,GAAG,MAAM,CAM5E;AAED,0DAA0D;AAC1D,wBAAgB,sBAAsB,CAAC,IAAI,GAAE,MAA2B,GAAG,MAAM,GAAG,IAAI,CAEvF;AAED,uDAAuD;AACvD,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,MAA2B,GAAG,MAAM,CAE1E;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,MAA2B,GAAG,MAAM,CAI5E;AAED,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,IAAI,GAAE,MAA2B,GAAG,OAAO,CAE1E"}

package/dist/lib/memory-secret.js

@@ -0,0 +1,92 @@
+/**
+ * Helpers for the agent-memory bearer secret at `~/.olam/memory-secret`.
+ *
+ * Pattern mirrors `~/.olam/auth-secret`:
+ *   - 0600 mode enforced on every write
+ *   - atomic write via tmp + rename
+ *   - generated on first call to `ensureMemorySecret()`
+ *
+ * Phase C's `cloud-memory-secret` reuses the path-arg form
+ * (`ensureSecretAtPath` / `readSecretAtPath`) so local + cloud share
+ * the same code path.
+ *
+ * Plan reference: docs/plans/olam-agent-memory-distributed/phase-a-tasks.md A3
+ */
+import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync, renameSync, unlinkSync, chmodSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { randomBytes } from 'node:crypto';
+export const MEMORY_SECRET_PATH = join(homedir(), '.olam', 'memory-secret');
+export const SECRET_LEN_BYTES = 32; // 64 hex chars
+/** Generate a 64-char hex secret. */
+export function generateSecret() {
+    return randomBytes(SECRET_LEN_BYTES).toString('hex');
+}
+/**
+ * Write `value` to `path` atomically with mode 0600. Parent directory
+ * created with default mode if absent.
+ */
+export function writeSecretAtPath(path, value) {
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.tmp.${process.pid}`;
+    writeFileSync(tmp, value, { mode: 0o600 });
+    // writeFileSync's mode is umask-respecting; chmod explicitly to be safe.
+    chmodSync(tmp, 0o600);
+    renameSync(tmp, path);
+}
+/**
+ * Read `path` as a string. Returns `null` if missing. Warns to stderr
+ * if mode is not 0600 (caller decides whether to proceed).
+ */
+export function readSecretAtPathOrNull(path) {
+    if (!existsSync(path))
+        return null;
+    const mode = statSync(path).mode & 0o777;
+    if (mode !== 0o600) {
+        process.stderr.write(`warn: ${path} has mode 0${mode.toString(8)}; expected 0600. Run 'olam memory secret rotate' to regenerate.\n`);
+    }
+    return readFileSync(path, 'utf8').trim();
+}
+/** Read `path` or throw if missing. */
+export function readSecretAtPath(path) {
+    const v = readSecretAtPathOrNull(path);
+    if (v === null) {
+        throw new Error(`Secret not found at ${path}. Run 'olam memory start' to generate it.`);
+    }
+    return v;
+}
+/**
+ * Ensure `~/.olam/memory-secret` exists with mode 0600. Generates a
+ * fresh 64-char hex secret on first call. Idempotent.
+ */
+export function ensureMemorySecret(path = MEMORY_SECRET_PATH) {
+    const existing = readSecretAtPathOrNull(path);
+    if (existing)
+        return existing;
+    const fresh = generateSecret();
+    writeSecretAtPath(path, fresh);
+    return fresh;
+}
+/** Read the local-mode memory secret (no-throw shape). */
+export function readMemorySecretOrNull(path = MEMORY_SECRET_PATH) {
+    return readSecretAtPathOrNull(path);
+}
+/** Read the local-mode memory secret (throw shape). */
+export function readMemorySecret(path = MEMORY_SECRET_PATH) {
+    return readSecretAtPath(path);
+}
+/**
+ * Rotate the secret: generate fresh value, atomically replace the file,
+ * return the new value. Caller is responsible for restarting any
+ * running memory service so it picks up the new value.
+ */
+export function rotateMemorySecret(path = MEMORY_SECRET_PATH) {
+    const fresh = generateSecret();
+    writeSecretAtPath(path, fresh);
+    return fresh;
+}
+/** Convenience: are we wired for local-mode memory? */
+export function hasMemorySecret(path = MEMORY_SECRET_PATH) {
+    return existsSync(path);
+}
+//# sourceMappingURL=memory-secret.js.map

package/dist/lib/memory-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"memory-secret.js","sourceRoot":"","sources":["../../src/lib/memory-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC1H,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC,CAAC,eAAe;AAEnD,qCAAqC;AACrC,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAa;IAC3D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,yEAAyE;IACzE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACtB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACzC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS,IAAI,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,mEAAmE,CAC/G,CAAC;IACJ,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,uBAAuB,IAAI,2CAA2C,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,kBAAkB;IAClE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,sBAAsB,CAAC,OAAe,kBAAkB;IACtE,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,gBAAgB,CAAC,OAAe,kBAAkB;IAChE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,kBAAkB;IAClE,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,eAAe,CAAC,OAAe,kBAAkB;IAC/D,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/lib/world-mcp-register.d.ts

@@ -0,0 +1,98 @@
+/**
+ * In-world MCP registration helper.
+ *
+ * After `olam create` spawns a fresh world container, we register the
+ * agentmemory MCP server inside that world's claude config so the
+ * in-world claude session reaches the host-side agent-memory service
+ * without manual `claude mcp add` from the operator.
+ *
+ * Architecture:
+ *
+ *   host           docker exec               world container
+ *   ----           ----------               ---------------
+ *   olam create  ─►   docker exec     ─►    claude mcp add agentmemory
+ *                                               --scope user
+ *                                               --env AGENTMEMORY_URL=...
+ *                                               --env AGENTMEMORY_SECRET=...
+ *                                               -- agentmemory-mcp
+ *
+ * The `agentmemory-mcp` bin is pre-baked into the devbox image (B2), so
+ * there's no `npx -y` cold-start at first claude invocation (T6).
+ *
+ * Idempotency: re-running against an already-registered world is a noop.
+ * We detect via `claude mcp list` exit code + stderr signature (same
+ * "No <scope> MCP server found" pattern reused from the host-side
+ * `olam memory uninstall` helper).
+ *
+ * Graceful skip: when the world wasn't spawned with AGENTMEMORY_* env
+ * (because the host memory service was absent at spawn time per B1),
+ * we skip registration with an informative log. The world keeps working
+ * — the @agentmemory/mcp shim falls back to local InMemoryKV.
+ *
+ * Plan reference: docs/plans/olam-agent-memory-distributed/phase-b-tasks.md B3
+ */
+import { type SpawnSyncReturns } from 'node:child_process';
+/** Inject points for tests. */
+export interface DockerExecDeps {
+    /** Wrap spawnSync so tests can stub claude/docker calls. */
+    spawn: (cmd: string, args: string[], opts: {
+        encoding: 'utf8';
+        stdio: ['ignore', 'pipe', 'pipe'];
+    }) => SpawnSyncReturns<string>;
+    /** Optional logger; defaults to console.log. */
+    log?: (msg: string) => void;
+}
+export declare const DEFAULT_DOCKER_EXEC_DEPS: DockerExecDeps;
+/**
+ * Result shape — `outcome` is the load-bearing field. Callers use it to
+ * decide whether to print a success line vs. a graceful-skip notice.
+ */
+export type RegisterOutcome = {
+    outcome: 'registered';
+    scope: 'user';
+} | {
+    outcome: 'already-registered';
+    scope: 'user';
+} | {
+    outcome: 'skipped-no-env';
+    reason: string;
+} | {
+    outcome: 'failed';
+    rc: number;
+    detail: string;
+};
+export interface RegisterAgentMemoryMcpOpts {
+    /** Full container name, e.g. `olam-<world-id>-devbox`. */
+    containerName: string;
+    /** The AGENTMEMORY_URL value that was injected at world spawn (B1). */
+    agentmemoryUrl: string;
+    /** The AGENTMEMORY_SECRET value that was injected at world spawn (B1). */
+    agentmemorySecret: string;
+}
+/**
+ * Probe whether `agentmemory` is already registered inside the world's
+ * claude. Uses `claude mcp list` which prints a structured list; we
+ * just look for the name in the output. Returns:
+ *   - `'present'`   — already registered (idempotent skip path)
+ *   - `'absent'`    — not registered yet (proceed to add)
+ *   - `'unknown'`   — `claude mcp list` failed for any reason; we don't
+ *                     pretend to know the state, caller decides.
+ */
+export declare function probeMcpListed(containerName: string, deps: DockerExecDeps): 'present' | 'absent' | 'unknown';
+/**
+ * Register the agentmemory MCP server inside a world container.
+ *
+ * - Skips silently when `agentmemorySecret` is empty (the world was
+ *   spawned without B1's env injection because the host memory service
+ *   was absent at spawn time).
+ * - Skips idempotently when `claude mcp list` already shows the server.
+ * - Otherwise shells to `docker exec <world> claude mcp add agentmemory
+ *   --scope user --env ... -- agentmemory-mcp`.
+ *
+ * The bearer secret transits as an argv element of the spawned `claude`
+ * process inside the container (same shape as the host-side
+ * `olam memory install`). Documented in the operator-facing
+ * docs/architecture/agent-memory.md security model.
+ */
+export declare function registerAgentMemoryMcp(opts: RegisterAgentMemoryMcpOpts, deps?: DockerExecDeps): RegisterOutcome;
+//# sourceMappingURL=world-mcp-register.d.ts.map

package/dist/lib/world-mcp-register.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"world-mcp-register.d.ts","sourceRoot":"","sources":["../../src/lib/world-mcp-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtE,+BAA+B;AAC/B,MAAM,WAAW,cAAc;IAC7B,4DAA4D;IAC5D,KAAK,EAAE,CACL,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,KAC1D,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC9B,gDAAgD;IAChD,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,eAAO,MAAM,wBAAwB,EAAE,cAGtC,CAAC;AAKF;;;GAGG;AACH,MAAM,MAAM,eAAe,GACvB;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,OAAO,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,OAAO,EAAE,gBAAgB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,OAAO,EAAE,QAAQ,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,uEAAuE;IACvE,cAAc,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,cAAc,GACnB,SAAS,GAAG,QAAQ,GAAG,SAAS,CAYlC;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,0BAA0B,EAChC,IAAI,GAAE,cAAyC,GAC9C,eAAe,CAoDjB"}

package/dist/lib/world-mcp-register.js

@@ -0,0 +1,117 @@
+/**
+ * In-world MCP registration helper.
+ *
+ * After `olam create` spawns a fresh world container, we register the
+ * agentmemory MCP server inside that world's claude config so the
+ * in-world claude session reaches the host-side agent-memory service
+ * without manual `claude mcp add` from the operator.
+ *
+ * Architecture:
+ *
+ *   host           docker exec               world container
+ *   ----           ----------               ---------------
+ *   olam create  ─►   docker exec     ─►    claude mcp add agentmemory
+ *                                               --scope user
+ *                                               --env AGENTMEMORY_URL=...
+ *                                               --env AGENTMEMORY_SECRET=...
+ *                                               -- agentmemory-mcp
+ *
+ * The `agentmemory-mcp` bin is pre-baked into the devbox image (B2), so
+ * there's no `npx -y` cold-start at first claude invocation (T6).
+ *
+ * Idempotency: re-running against an already-registered world is a noop.
+ * We detect via `claude mcp list` exit code + stderr signature (same
+ * "No <scope> MCP server found" pattern reused from the host-side
+ * `olam memory uninstall` helper).
+ *
+ * Graceful skip: when the world wasn't spawned with AGENTMEMORY_* env
+ * (because the host memory service was absent at spawn time per B1),
+ * we skip registration with an informative log. The world keeps working
+ * — the @agentmemory/mcp shim falls back to local InMemoryKV.
+ *
+ * Plan reference: docs/plans/olam-agent-memory-distributed/phase-b-tasks.md B3
+ */
+import { spawnSync } from 'node:child_process';
+export const DEFAULT_DOCKER_EXEC_DEPS = {
+    spawn: spawnSync,
+    log: (msg) => console.log(msg),
+};
+const MCP_NAME = 'agentmemory';
+const MCP_BIN = 'agentmemory-mcp';
+/**
+ * Probe whether `agentmemory` is already registered inside the world's
+ * claude. Uses `claude mcp list` which prints a structured list; we
+ * just look for the name in the output. Returns:
+ *   - `'present'`   — already registered (idempotent skip path)
+ *   - `'absent'`    — not registered yet (proceed to add)
+ *   - `'unknown'`   — `claude mcp list` failed for any reason; we don't
+ *                     pretend to know the state, caller decides.
+ */
+export function probeMcpListed(containerName, deps) {
+    const result = deps.spawn('docker', ['exec', containerName, 'claude', 'mcp', 'list'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+    if (result.status !== 0)
+        return 'unknown';
+    const combined = `${result.stdout ?? ''}\n${result.stderr ?? ''}`;
+    // `claude mcp list` prints one row per registered server. Match on
+    // the name at the start of a line to avoid false positives from
+    // descriptive prose.
+    return new RegExp(`^\\s*${MCP_NAME}\\b`, 'm').test(combined) ? 'present' : 'absent';
+}
+/**
+ * Register the agentmemory MCP server inside a world container.
+ *
+ * - Skips silently when `agentmemorySecret` is empty (the world was
+ *   spawned without B1's env injection because the host memory service
+ *   was absent at spawn time).
+ * - Skips idempotently when `claude mcp list` already shows the server.
+ * - Otherwise shells to `docker exec <world> claude mcp add agentmemory
+ *   --scope user --env ... -- agentmemory-mcp`.
+ *
+ * The bearer secret transits as an argv element of the spawned `claude`
+ * process inside the container (same shape as the host-side
+ * `olam memory install`). Documented in the operator-facing
+ * docs/architecture/agent-memory.md security model.
+ */
+export function registerAgentMemoryMcp(opts, deps = DEFAULT_DOCKER_EXEC_DEPS) {
+    if (!opts.agentmemorySecret || opts.agentmemorySecret.length === 0) {
+        return {
+            outcome: 'skipped-no-env',
+            reason: 'world has no AGENTMEMORY_SECRET (memory service was absent or --skip-memory active at spawn time)',
+        };
+    }
+    const probe = probeMcpListed(opts.containerName, deps);
+    if (probe === 'present') {
+        return { outcome: 'already-registered', scope: 'user' };
+    }
+    const args = [
+        'exec',
+        opts.containerName,
+        'claude',
+        'mcp',
+        'add',
+        MCP_NAME,
+        '--scope',
+        'user',
+        '--env',
+        `AGENTMEMORY_URL=${opts.agentmemoryUrl}`,
+        '--env',
+        `AGENTMEMORY_SECRET=${opts.agentmemorySecret}`,
+        '--',
+        MCP_BIN,
+    ];
+    // Log without leaking the secret. Same redaction pattern as
+    // packages/cli/src/commands/memory/install.ts.
+    const redacted = args.map((a) => a.startsWith('AGENTMEMORY_SECRET=') ? 'AGENTMEMORY_SECRET=<redacted>' : a);
+    deps.log?.(`Wiring agent-memory MCP in ${opts.containerName}: docker ${redacted.join(' ')}`);
+    const result = deps.spawn('docker', args, {
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    if (result.status === 0) {
+        return { outcome: 'registered', scope: 'user' };
+    }
+    // Defensive redaction of any echo-back of the env value.
+    const detail = (result.stderr?.trim() || result.stdout?.trim() || '(no output)').replace(/AGENTMEMORY_SECRET=\S+/g, 'AGENTMEMORY_SECRET=<redacted>');
+    return { outcome: 'failed', rc: result.status ?? 1, detail };
+}
+//# sourceMappingURL=world-mcp-register.js.map

package/dist/lib/world-mcp-register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"world-mcp-register.js","sourceRoot":"","sources":["../../src/lib/world-mcp-register.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,SAAS,EAAyB,MAAM,oBAAoB,CAAC;AActE,MAAM,CAAC,MAAM,wBAAwB,GAAmB;IACtD,KAAK,EAAE,SAAS;IAChB,GAAG,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;CAC/B,CAAC;AAEF,MAAM,QAAQ,GAAG,aAAa,CAAC;AAC/B,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAqBlC;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAC5B,aAAqB,EACrB,IAAoB;IAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,QAAQ,EACR,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,EAChD,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACxD,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,QAAQ,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,KAAK,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IAClE,mEAAmE;IACnE,gEAAgE;IAChE,qBAAqB;IACrB,OAAO,IAAI,MAAM,CAAC,QAAQ,QAAQ,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAgC,EAChC,OAAuB,wBAAwB;IAE/C,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,MAAM,EACJ,mGAAmG;SACtG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,IAAI,GAAG;QACX,MAAM;QACN,IAAI,CAAC,aAAa;QAClB,QAAQ;QACR,KAAK;QACL,KAAK;QACL,QAAQ;QACR,SAAS;QACT,MAAM;QACN,OAAO;QACP,mBAAmB,IAAI,CAAC,cAAc,EAAE;QACxC,OAAO;QACP,sBAAsB,IAAI,CAAC,iBAAiB,EAAE;QAC9C,IAAI;QACJ,OAAO;KACR,CAAC;IACF,4DAA4D;IAC5D,+CAA+C;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9B,CAAC,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,CAAC,CAC1E,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,CAAC,8BAA8B,IAAI,CAAC,aAAa,YAAY,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAE7F,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;QACxC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClD,CAAC;IAED,yDAAyD;IACzD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,CAAC,OAAO,CACtF,yBAAyB,EACzB,+BAA+B,CAChC,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;AAC/D,CAAC"}