@spinabot/brigade 1.11.2 → 1.13.0

package/dist/agents/tools/transcribe-audio-tool.js

@@ -0,0 +1,577 @@
+/**
+ * `transcribe_audio` tool — speech-to-text (STT), modeled on the proven
+ * `generate_speech` self-contained pattern (its mirror image: TTS out → STT in).
+ *
+ * Why this tool exists
+ * --------------------
+ * Same reasoning as `generate_speech`: without a first-class tool, "transcribe
+ * this recording" / "what does this voice note say" sends the model to raw
+ * `curl` against an STT API — the key flows through a shell, the multipart audio
+ * upload gets mangled, and the call is dropped. This tool owns the call
+ * in-process: stored auth, validated params, a parser that understands each
+ * provider's transcript shape, and a path guard so it can't read secrets.
+ *
+ * It is a READ / understand op (like `analyze_media`), NOT a billed-gating
+ * mutation: reads are not privileged, so `ownerOnly` is false. The path guard +
+ * allowed-root scoping are the real safety boundary, and they run for EVERY
+ * sender — a remote channel sender can never make Brigade transcribe a secret.
+ *
+ * Providers (auto-selected by which key is configured, preference order):
+ *   • groq       — POST /openai/v1/audio/transcriptions (whisper-large-v3-turbo)
+ *   • openai     — POST /v1/audio/transcriptions          (whisper-1)
+ *   • deepgram   — POST /v1/listen (RAW bytes, not multipart) (nova-3)
+ *   • elevenlabs — POST /v1/speech-to-text                 (scribe_v2)
+ *   • mistral    — POST /v1/audio/transcriptions          (voxtral-mini-latest)
+ *   • xai        — POST /v1/stt                            (no model id)
+ * Keys resolve through `resolveMediaProviderKey` (the same credential-store +
+ * env path the media-understanding subsystem uses), so transcription works for
+ * whichever provider the operator already configured — no bespoke auth.
+ *
+ * Flow: read audio bytes (URL → fetch; local path → guarded read) → multipart
+ * (or raw, for deepgram) POST → the transcript TEXT is returned as `content`,
+ * with `details:{ok, provider, model, transcript, chars}`.
+ */
+import fs from "node:fs";
+import fsp from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { Type } from "typebox";
+import { resolveCacheDir, resolveOsCacheDir, resolveStateDir, DEFAULT_AGENT_ID, } from "../../config/paths.js";
+import { validateOutboundMediaPath } from "../../security/media-path-guard.js";
+import { loadConfig } from "../../core/config.js";
+import { resolveMediaProviderKey } from "../media-understanding/config.js";
+import { runCommandStt } from "./media-command.js";
+import { BrigadeToolInputError, jsonResult } from "./common.js";
+/** Transcription can take a while for long recordings; bound each HTTP call. */
+const REQUEST_TIMEOUT_MS = 120_000;
+/** Per-request HTTP timeout when FETCHING a URL source's bytes. */
+const FETCH_TIMEOUT_MS = 45_000;
+/** Hard cap on audio bytes read for ANY source — providers reject huge uploads. */
+const MAX_AUDIO_BYTES = 48 * 1024 * 1024; // 48 MiB
+/** Preference order when no provider is pinned: first keyed one wins. */
+const PROVIDER_PREFERENCE = [
+    "groq",
+    "openai",
+    "deepgram",
+    "elevenlabs",
+    "mistral",
+    "xai",
+    "google",
+    "command",
+];
+/** Default model id per provider (xai's /v1/stt takes none). */
+const DEFAULT_MODEL = {
+    groq: "whisper-large-v3-turbo",
+    openai: "whisper-1",
+    deepgram: "nova-3",
+    elevenlabs: "scribe_v2",
+    mistral: "voxtral-mini-latest",
+    xai: "",
+    google: "gemini-2.5-flash",
+    command: "",
+};
+const TranscribeAudioParams = Type.Object({
+    action: Type.Optional(Type.Union([Type.Literal("transcribe"), Type.Literal("list")], {
+        description: 'Optional: "transcribe" (default) or "list" to see which STT providers are configured.',
+    })),
+    source: Type.Optional(Type.String({
+        description: "Local file PATH or http(s) URL to an audio file to transcribe (mp3/wav/m4a/ogg/flac/aac/opus/webm). Required for action=transcribe.",
+    })),
+    provider: Type.Optional(Type.Union([
+        Type.Literal("groq"),
+        Type.Literal("openai"),
+        Type.Literal("deepgram"),
+        Type.Literal("elevenlabs"),
+        Type.Literal("mistral"),
+        Type.Literal("xai"),
+        Type.Literal("google"),
+        Type.Literal("command"),
+    ], {
+        description: "Optional STT provider override. Default: the first one with a configured key (groq → openai → deepgram → elevenlabs → mistral → xai).",
+    })),
+    model: Type.Optional(Type.String({ description: "Optional model override for the chosen provider." })),
+    language: Type.Optional(Type.String({
+        description: 'Optional spoken-language hint as an ISO code (e.g. "es", "en", "fr"). Improves accuracy for non-English audio; supported by groq/openai/mistral/xai/deepgram.',
+    })),
+});
+export function makeTranscribeAudioTool(opts = {}) {
+    const agentId = opts.agentId ?? DEFAULT_AGENT_ID;
+    const fetchFn = opts.fetchFn ?? fetch;
+    const resolveKey = opts.resolveKey ?? ((p) => resolveMediaProviderKey(p, agentId));
+    const sttCommand = opts.sttCommand ?? resolveSttCommand();
+    // `command` (offline local CLI) is available iff configured; cloud providers need a key.
+    const isAvailable = (p) => p === "command" ? sttCommand.length > 0 : resolveKey(p).length > 0;
+    const readSource = opts.readSource ??
+        ((source, signal) => acquireAudio(source, {
+            fetchFn,
+            maxBytes: MAX_AUDIO_BYTES,
+            ...(opts.workspaceDir ? { workspaceDir: opts.workspaceDir } : {}),
+            ...(opts.cwd ? { cwd: opts.cwd } : {}),
+            ...(opts.ownerLocalAccess ? { ownerLocalAccess: true } : {}),
+            ...(signal ? { signal } : {}),
+        }));
+    return {
+        name: "transcribe_audio",
+        label: "Transcribe Audio",
+        displaySummary: "transcribing audio",
+        // Read / understand capability — NOT owner-only (like analyze_media). It
+        // reads an audio file/URL the operator pointed at and returns the text; it
+        // never mutates state. The path guard runs for EVERY sender regardless of
+        // owner status, which is the real safety boundary.
+        ownerOnly: false,
+        description: [
+            "Transcribe spoken audio to text (speech-to-text). USE THIS — never call an STT API with bash/curl: the key must not flow through a shell, and the multipart upload is handled here.",
+            'action="transcribe" (default): requires `source` (a local audio path or http(s) URL). Returns the transcript TEXT.',
+            "Auto-selects the first configured provider (groq → openai → deepgram → elevenlabs → mistral → xai); override with `provider`/`model`/`language`.",
+            'action="list": show which STT providers have a configured key.',
+        ].join(" "),
+        parameters: TranscribeAudioParams,
+        execute: async (_id, args, signal) => {
+            const action = args.action ?? "transcribe";
+            if (action === "list") {
+                const providers = PROVIDER_PREFERENCE.filter(isAvailable);
+                return jsonResult({
+                    action,
+                    providers,
+                    ok: true,
+                    message: providers.length > 0
+                        ? `${providers.length} STT provider(s) configured: ${providers.join(", ")}.`
+                        : "No STT provider configured. Add a Groq, OpenAI, Deepgram, ElevenLabs, Mistral, or xAI key with `brigade onboard`.",
+                });
+            }
+            const source = (args.source ?? "").trim();
+            if (!source) {
+                return fail(action, "`source` is required for action=transcribe (a local audio path or http(s) URL).");
+            }
+            // Resolve the provider: explicit override (must be keyed) else first keyed.
+            let provider;
+            if (args.provider) {
+                if (!isAvailable(args.provider)) {
+                    return fail(action, `Provider "${args.provider}" is not available (no key, or no local command configured). Add one with \`brigade onboard\`, or omit \`provider\` to auto-select.`);
+                }
+                provider = args.provider;
+            }
+            else {
+                provider = PROVIDER_PREFERENCE.find(isAvailable);
+            }
+            if (!provider) {
+                return fail(action, "No STT provider is configured. Add a Groq, OpenAI, Deepgram, ElevenLabs, Mistral, or xAI API key with `brigade onboard` (then this tool auto-selects it).");
+            }
+            const apiKey = resolveKey(provider);
+            const model = args.model?.trim() || DEFAULT_MODEL[provider];
+            // Read the audio bytes (URL fetch or guarded local read).
+            let audio;
+            try {
+                audio = await readSource(source, signal);
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                return fail(action, `Could not read the audio source: ${msg}`, { provider, model });
+            }
+            if (audio.bytes.length === 0) {
+                return fail(action, "The audio source is empty (0 bytes).", { provider, model });
+            }
+            // Transcribe via the chosen provider.
+            let transcript;
+            try {
+                transcript =
+                    provider === "command"
+                        ? runCommandStt(sttCommand, {
+                            audioBytes: audio.bytes,
+                            audioExt: audio.extension,
+                            ...(args.language ? { language: args.language.trim() } : {}),
+                        }, opts.commandRunner ? { runFn: opts.commandRunner } : {})
+                        : await transcribe({
+                            provider,
+                            fetchFn,
+                            apiKey,
+                            model,
+                            audio,
+                            ...(args.language ? { language: args.language.trim() } : {}),
+                            ...(signal ? { signal } : {}),
+                        });
+            }
+            catch (err) {
+                return fail(action, `Transcription via ${provider} failed: ${err instanceof Error ? err.message : String(err)}`, {
+                    provider,
+                    model,
+                });
+            }
+            const text = transcript.trim();
+            if (!text) {
+                return fail(action, `${provider} returned an empty transcript (no speech detected?).`, { provider, model });
+            }
+            return {
+                content: [{ type: "text", text }],
+                details: {
+                    action,
+                    provider,
+                    model,
+                    transcript: text,
+                    chars: text.length,
+                    ok: true,
+                },
+            };
+        },
+    };
+}
+/* ───────────────────────── provider plumbing ───────────────────────── */
+async function transcribe(params) {
+    switch (params.provider) {
+        case "groq":
+            return transcribeOpenAICompatible(params, "https://api.groq.com/openai/v1/audio/transcriptions");
+        case "openai":
+            return transcribeOpenAICompatible(params, "https://api.openai.com/v1/audio/transcriptions");
+        case "mistral":
+            return transcribeOpenAICompatible(params, "https://api.mistral.ai/v1/audio/transcriptions");
+        case "xai":
+            return transcribeXai(params);
+        case "elevenlabs":
+            return transcribeElevenLabs(params);
+        case "deepgram":
+            return transcribeDeepgram(params);
+        case "google":
+            return transcribeGoogle(params);
+    }
+}
+/**
+ * Google Gemini — audio understanding via `generateContent`: the audio rides as
+ * inline base64 plus a "transcribe verbatim" instruction; the transcript is the
+ * joined text parts of the first candidate.
+ */
+async function transcribeGoogle(p) {
+    const instruction = p.language
+        ? `Transcribe this audio verbatim (language: ${p.language}). Return ONLY the transcript text.`
+        : "Transcribe this audio verbatim. Return ONLY the transcript text.";
+    const url = `https://generativelanguage.googleapis.com/v1beta/models/${encodeURIComponent(p.model)}:generateContent?key=${encodeURIComponent(p.apiKey)}`;
+    const res = await p.fetchFn(url, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            contents: [
+                {
+                    parts: [
+                        { inline_data: { mime_type: p.audio.mime, data: p.audio.bytes.toString("base64") } },
+                        { text: instruction },
+                    ],
+                },
+            ],
+        }),
+        signal: withTimeout(p.signal, REQUEST_TIMEOUT_MS),
+    });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status} ${(await safeText(res)).slice(0, 200)}`);
+    const body = (await res.json());
+    return (body.candidates?.[0]?.content?.parts ?? [])
+        .map((x) => x.text ?? "")
+        .join("")
+        .trim();
+}
+/**
+ * groq / openai / mistral share the OpenAI-style multipart transcription shape:
+ * `FormData{ file, model, response_format:"json", language? }`, Bearer auth,
+ * response `{text}`.
+ */
+async function transcribeOpenAICompatible(p, url) {
+    const fd = new FormData();
+    fd.append("file", new Blob([p.audio.bytes], { type: p.audio.mime }), `audio.${p.audio.extension}`);
+    fd.append("model", p.model);
+    fd.append("response_format", "json");
+    if (p.language)
+        fd.append("language", p.language);
+    const res = await p.fetchFn(url, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${p.apiKey}` },
+        body: fd,
+        signal: withTimeout(p.signal, REQUEST_TIMEOUT_MS),
+    });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status} ${(await safeText(res)).slice(0, 200)}`);
+    const body = (await res.json());
+    return body.text ?? "";
+}
+/** xAI `/v1/stt` — multipart `{ file, language? }`, Bearer; response `{text}`. */
+async function transcribeXai(p) {
+    const fd = new FormData();
+    fd.append("file", new Blob([p.audio.bytes], { type: p.audio.mime }), `audio.${p.audio.extension}`);
+    if (p.language)
+        fd.append("language", p.language);
+    const res = await p.fetchFn("https://api.x.ai/v1/stt", {
+        method: "POST",
+        headers: { Authorization: `Bearer ${p.apiKey}` },
+        body: fd,
+        signal: withTimeout(p.signal, REQUEST_TIMEOUT_MS),
+    });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status} ${(await safeText(res)).slice(0, 200)}`);
+    const body = (await res.json());
+    return body.text ?? "";
+}
+/** ElevenLabs `/v1/speech-to-text` — multipart `{ file, model_id }`, `xi-api-key`; response `{text}`. */
+async function transcribeElevenLabs(p) {
+    const fd = new FormData();
+    fd.append("file", new Blob([p.audio.bytes], { type: p.audio.mime }), `audio.${p.audio.extension}`);
+    fd.append("model_id", p.model);
+    const res = await p.fetchFn("https://api.elevenlabs.io/v1/speech-to-text", {
+        method: "POST",
+        headers: { "xi-api-key": p.apiKey },
+        body: fd,
+        signal: withTimeout(p.signal, REQUEST_TIMEOUT_MS),
+    });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status} ${(await safeText(res)).slice(0, 200)}`);
+    const body = (await res.json());
+    return body.text ?? "";
+}
+/**
+ * Deepgram `/v1/listen` — RAW audio bytes (NOT multipart) as the body, with
+ * `Authorization: Token <key>` + `Content-Type: <mime>`. Transcript lives at
+ * `results.channels[0].alternatives[0].transcript`.
+ */
+async function transcribeDeepgram(p) {
+    let url = "https://api.deepgram.com/v1/listen?model=nova-3&smart_format=true";
+    if (p.language)
+        url += `&language=${encodeURIComponent(p.language)}`;
+    const res = await p.fetchFn(url, {
+        method: "POST",
+        headers: { Authorization: `Token ${p.apiKey}`, "Content-Type": p.audio.mime },
+        body: new Uint8Array(p.audio.bytes),
+        signal: withTimeout(p.signal, REQUEST_TIMEOUT_MS),
+    });
+    if (!res.ok)
+        throw new Error(`HTTP ${res.status} ${(await safeText(res)).slice(0, 200)}`);
+    const body = (await res.json());
+    return body.results?.channels?.[0]?.alternatives?.[0]?.transcript ?? "";
+}
+/* ───────────────────────── source acquisition ───────────────────────── */
+/**
+ * Read the audio bytes for `source`. A URL is fetched (capped); a local path is
+ * read with the SAME safety posture as `analyze_media`:
+ *   1. media-path guard (refuse secrets / system files / credential dirs).
+ *   2. allowed-root scoping (must be under workspace / cwd / cache / temp /
+ *      state media subtree) — refuses arbitrary absolute reads outside roots.
+ * Symlinks are resolved first so a benign name can't smuggle a denied target.
+ */
+async function acquireAudio(source, opts) {
+    const isUrl = /^https?:\/\//i.test(source);
+    if (isUrl) {
+        const res = await opts.fetchFn(source, {
+            method: "GET",
+            headers: { accept: "*/*" },
+            signal: withTimeout(opts.signal, FETCH_TIMEOUT_MS),
+        });
+        if (!res.ok) {
+            throw new Error(`fetch failed: HTTP ${res.status} for ${source}`);
+        }
+        const headerMime = res.headers.get("content-type")?.split(";")[0]?.trim() || undefined;
+        const full = Buffer.from(await res.arrayBuffer());
+        const bytes = full.length > opts.maxBytes ? full.subarray(0, opts.maxBytes) : full;
+        const ext = extensionOf(source) || extFromMime(headerMime) || "mp3";
+        const mime = headerMime || audioMimeFromExt(ext);
+        return { bytes, mime, extension: ext };
+    }
+    // Local path: guard + allowed-root scoping (mirrors analyze_media).
+    const verdict = validateOutboundMediaPath(source);
+    if (!verdict.ok) {
+        throw new BrigadeToolInputError(verdict.reason ?? "refusing to read that path");
+    }
+    let resolved;
+    try {
+        resolved = fs.realpathSync(path.resolve(source));
+    }
+    catch {
+        resolved = path.resolve(source);
+    }
+    const roots = allowedLocalRoots(opts);
+    if (!isInsideAnyRoot(resolved, roots)) {
+        throw new BrigadeToolInputError("refusing to read a path outside the allowed roots (workspace / current dir / cache / temp). " +
+            "Move the file into the workspace, or pass a URL.");
+    }
+    let stat;
+    try {
+        stat = await fsp.stat(resolved);
+    }
+    catch {
+        throw new BrigadeToolInputError(`file not found: ${source}`);
+    }
+    if (!stat.isFile())
+        throw new BrigadeToolInputError(`not a file: ${source}`);
+    if (stat.size === 0)
+        throw new BrigadeToolInputError(`file is empty: ${source}`);
+    const full = await fsp.readFile(resolved);
+    const bytes = full.length > opts.maxBytes ? full.subarray(0, opts.maxBytes) : full;
+    const ext = extensionOf(source) || "mp3";
+    return { bytes, mime: audioMimeFromExt(ext), extension: ext };
+}
+/** Roots a local source path is allowed to live under (workspace, cwd, OS cache/temp, state dir). */
+function allowedLocalRoots(opts) {
+    const roots = new Set();
+    const add = (p) => {
+        if (!p)
+            return;
+        try {
+            roots.add(path.resolve(p));
+        }
+        catch {
+            /* ignore */
+        }
+    };
+    add(opts.workspaceDir);
+    add(opts.cwd);
+    add(resolveCacheDir());
+    add(process.env.TMPDIR || process.env.TEMP || process.env.TMP || "");
+    try {
+        add(os.tmpdir());
+    }
+    catch {
+        /* ignore */
+    }
+    // State-dir media subtree: where inbound attachments + generated media land
+    // in FILESYSTEM mode — allow it so the model can transcribe a file it just
+    // received.
+    try {
+        add(path.join(resolveStateDir(), "channels"));
+        add(path.join(resolveStateDir(), "cache"));
+        add(path.join(resolveStateDir(), "captures"));
+        add(path.join(resolveStateDir(), "workspace"));
+    }
+    catch {
+        /* ignore */
+    }
+    // CONVEX mode relocates inbound channel media to the OS cache dir; cover it
+    // (+ the channel subtrees) so "transcribe the voice note I just sent" works.
+    // The media-path guard still refuses secrets / system files independently.
+    try {
+        const osCache = resolveOsCacheDir();
+        add(osCache);
+        add(path.join(osCache, "channels"));
+        add(path.join(osCache, "bluebubbles"));
+    }
+    catch {
+        /* ignore */
+    }
+    // macOS Messages Attachments root — inbound iMessage media is surfaced as-is.
+    try {
+        add(path.join(os.homedir(), "Library", "Messages", "Attachments"));
+    }
+    catch {
+        /* ignore */
+    }
+    // OWNER local turns only: widen to the operator's home (Downloads/Desktop/…)
+    // so a user-typed absolute path resolves. A remote sender threads
+    // ownerLocalAccess:false → this stays off. The path guard still refuses
+    // secrets / credential dirs / system files even for the owner.
+    if (opts.ownerLocalAccess) {
+        try {
+            add(os.homedir());
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    return [...roots].filter((r) => r.length > 0);
+}
+/** True when `resolved` is inside one of `roots` (path.relative containment, no `..`). */
+function isInsideAnyRoot(resolved, roots) {
+    for (const root of roots) {
+        const rel = path.relative(root, resolved);
+        if (rel === "" || (!rel.startsWith("..") && !path.isAbsolute(rel)))
+            return true;
+    }
+    return false;
+}
+/* ───────────────────────── helpers ───────────────────────── */
+/** The local-STT command template (env override, then config), or "" if unset. */
+function resolveSttCommand() {
+    const env = process.env.BRIGADE_STT_COMMAND?.trim();
+    if (env)
+        return env;
+    try {
+        const cfg = loadConfig();
+        const c = cfg.tools?.transcription?.command;
+        if (typeof c === "string" && c.trim())
+            return c.trim();
+    }
+    catch {
+        /* default below */
+    }
+    return "";
+}
+/** Pull a lowercase extension (no dot) from a path or URL pathname. */
+export function extensionOf(source) {
+    let p = source;
+    try {
+        if (/^https?:\/\//i.test(source))
+            p = new URL(source).pathname;
+    }
+    catch {
+        /* not a URL — treat as a path */
+    }
+    return path.extname(p).toLowerCase().replace(/^\./, "");
+}
+/** Audio mime from extension — used when a local audio file has no declared MIME. */
+function audioMimeFromExt(ext) {
+    switch (ext) {
+        case "wav":
+            return "audio/wav";
+        case "m4a":
+            return "audio/mp4";
+        case "mp4":
+            return "audio/mp4";
+        case "aac":
+            return "audio/aac";
+        case "flac":
+            return "audio/flac";
+        case "oga":
+        case "ogg":
+            return "audio/ogg";
+        case "opus":
+            return "audio/opus";
+        case "webm":
+            return "audio/webm";
+        default:
+            return "audio/mpeg";
+    }
+}
+/** Best-effort extension from a content-type (when a URL has no file extension). */
+function extFromMime(mime) {
+    if (!mime)
+        return undefined;
+    const m = mime.toLowerCase();
+    if (m.includes("wav"))
+        return "wav";
+    if (m.includes("mp4") || m.includes("m4a"))
+        return "m4a";
+    if (m.includes("aac"))
+        return "aac";
+    if (m.includes("flac"))
+        return "flac";
+    if (m.includes("ogg"))
+        return "ogg";
+    if (m.includes("opus"))
+        return "opus";
+    if (m.includes("webm"))
+        return "webm";
+    if (m.includes("mpeg") || m.includes("mp3"))
+        return "mp3";
+    return undefined;
+}
+function fail(action, message, extra = {}) {
+    return jsonResult({ action, ok: false, message, ...extra });
+}
+async function safeText(res) {
+    try {
+        return await res.text();
+    }
+    catch {
+        return "";
+    }
+}
+/** Compose the caller's signal with a hard per-request timeout. */
+function withTimeout(signal, ms) {
+    const timeoutSignal = AbortSignal.timeout(ms);
+    if (!signal)
+        return timeoutSignal;
+    return AbortSignal.any([signal, timeoutSignal]);
+}
+//# sourceMappingURL=transcribe-audio-tool.js.map

package/dist/agents/tools/transcribe-audio-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transcribe-audio-tool.js","sourceRoot":"","sources":["../../../src/agents/tools/transcribe-audio-tool.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACnC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,OAAO,EACN,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,gBAAgB,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAsB,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGhE,gFAAgF;AAChF,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,mEAAmE;AACnE,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,mFAAmF;AACnF,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,SAAS;AAInD,yEAAyE;AACzE,MAAM,mBAAmB,GAA2B;IACnD,MAAM;IACN,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,SAAS;IACT,KAAK;IACL,QAAQ;IACR,SAAS;CACT,CAAC;AAEF,gEAAgE;AAChE,MAAM,aAAa,GAAyC;IAC3D,IAAI,EAAE,wBAAwB;IAC9B,MAAM,EAAE,WAAW;IACnB,QAAQ,EAAE,QAAQ;IAClB,UAAU,EAAE,WAAW;IACvB,OAAO,EAAE,qBAAqB;IAC9B,GAAG,EAAE,EAAE;IACP,MAAM,EAAE,kBAAkB;IAC1B,OAAO,EAAE,EAAE;CACX,CAAC;AAEF,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE;QAC9D,WAAW,EACV,uFAAuF;KACxF,CAAC,CACF;IACD,MAAM,EAAE,IAAI,CAAC,QAAQ,CACpB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EACV,qIAAqI;KACtI,CAAC,CACF;IACD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,KAAK,CACT;QACC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;QACpB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;QACxB,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;QACnB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;KACvB,EACD;QACC,WAAW,EACV,uIAAuI;KACxI,CACD,CACD;IACD,KAAK,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC,CAChF;IACD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC;QACX,WAAW,EACV,+JAA+J;KAChK,CAAC,CACF;CACD,CAAC,CAAC;AAoDH,MAAM,UAAU,uBAAuB,CACtC,OAAuC,EAAE;IAEzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,gBAAgB,CAAC;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,CAAuB,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACzG,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,EAAE,CAAC;IAC1D,yFAAyF;IACzF,MAAM,WAAW,GAAG,CAAC,CAAuB,EAAW,EAAE,CACxD,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACpE,MAAM,UAAU,GACf,IAAI,CAAC,UAAU;QACf,CAAC,CAAC,MAAc,EAAE,MAAoB,EAAE,EAAE,CACzC,YAAY,CAAC,MAAM,EAAE;YACpB,OAAO;YACP,QAAQ,EAAE,eAAe;YACzB,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7B,CAAC,CAAC,CAAC;IAEN,OAAO;QACN,IAAI,EAAE,kBAAkB;QACxB,KAAK,EAAE,kBAAkB;QACzB,cAAc,EAAE,oBAAoB;QACpC,yEAAyE;QACzE,2EAA2E;QAC3E,0EAA0E;QAC1E,mDAAmD;QACnD,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE;YACZ,qLAAqL;YACrL,oHAAoH;YACpH,kJAAkJ;YAClJ,gEAAgE;SAChE,CAAC,IAAI,CAAC,GAAG,CAAC;QACX,UAAU,EAAE,qBAAqB;QACjC,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAoD,EAAE;YACtF,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC;YAE3C,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC1D,OAAO,UAAU,CAAC;oBACjB,MAAM;oBACN,SAAS;oBACT,EAAE,EAAE,IAAI;oBACR,OAAO,EACN,SAAS,CAAC,MAAM,GAAG,CAAC;wBACnB,CAAC,CAAC,GAAG,SAAS,CAAC,MAAM,gCAAgC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;wBAC5E,CAAC,CAAC,mHAAmH;iBACtF,CAA4C,CAAC;YAChF,CAAC;YAED,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,MAAM,EAAE,iFAAiF,CAAC,CAAC;YACxG,CAAC;YAED,4EAA4E;YAC5E,IAAI,QAA0C,CAAC;YAC/C,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACjC,OAAO,IAAI,CACV,MAAM,EACN,aAAa,IAAI,CAAC,QAAQ,qIAAqI,CAC/J,CAAC;gBACH,CAAC;gBACD,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACP,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClD,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,OAAO,IAAI,CACV,MAAM,EACN,2JAA2J,CAC3J,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;YAE5D,0DAA0D;YAC1D,IAAI,KAAuB,CAAC;YAC5B,IAAI,CAAC;gBACJ,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,OAAO,IAAI,CAAC,MAAM,EAAE,oCAAoC,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,MAAM,EAAE,sCAAsC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAClF,CAAC;YAED,sCAAsC;YACtC,IAAI,UAAkB,CAAC;YACvB,IAAI,CAAC;gBACJ,UAAU;oBACT,QAAQ,KAAK,SAAS;wBACrB,CAAC,CAAC,aAAa,CACb,UAAU,EACV;4BACC,UAAU,EAAE,KAAK,CAAC,KAAK;4BACvB,QAAQ,EAAE,KAAK,CAAC,SAAS;4BACzB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC5D,EACD,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CACvD;wBACF,CAAC,CAAC,MAAM,UAAU,CAAC;4BACjB,QAAQ;4BACR,OAAO;4BACP,MAAM;4BACN,KAAK;4BACL,KAAK;4BACL,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC5D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC7B,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,OAAO,IAAI,CAAC,MAAM,EAAE,qBAAqB,QAAQ,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;oBAChH,QAAQ;oBACR,KAAK;iBACL,CAAC,CAAC;YACJ,CAAC;YAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,QAAQ,sDAAsD,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC7G,CAAC;YAED,OAAO;gBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACjC,OAAO,EAAE;oBACR,MAAM;oBACN,QAAQ;oBACR,KAAK;oBACL,UAAU,EAAE,IAAI;oBAChB,KAAK,EAAE,IAAI,CAAC,MAAM;oBAClB,EAAE,EAAE,IAAI;iBACR;aACD,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC;AAED,2EAA2E;AAE3E,KAAK,UAAU,UAAU,CAAC,MAUzB;IACA,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzB,KAAK,MAAM;YACV,OAAO,0BAA0B,CAAC,MAAM,EAAE,qDAAqD,CAAC,CAAC;QAClG,KAAK,QAAQ;YACZ,OAAO,0BAA0B,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;QAC7F,KAAK,SAAS;YACb,OAAO,0BAA0B,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;QAC7F,KAAK,KAAK;YACT,OAAO,aAAa,CAAC,MAAM,CAAC,CAAC;QAC9B,KAAK,YAAY;YAChB,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACrC,KAAK,UAAU;YACd,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACnC,KAAK,QAAQ;YACZ,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,CAO/B;IACA,MAAM,WAAW,GAAG,CAAC,CAAC,QAAQ;QAC7B,CAAC,CAAC,6CAA6C,CAAC,CAAC,QAAQ,qCAAqC;QAC9F,CAAC,CAAC,kEAAkE,CAAC;IACtE,MAAM,GAAG,GAAG,2DAA2D,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,wBAAwB,kBAAkB,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IACzJ,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,QAAQ,EAAE;gBACT;oBACC,KAAK,EAAE;wBACN,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE;wBACpF,EAAE,IAAI,EAAE,WAAW,EAAE;qBACrB;iBACD;aACD;SACD,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;SACjD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;SACxB,IAAI,CAAC,EAAE,CAAC;SACR,IAAI,EAAE,CAAC;AACV,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,0BAA0B,CACxC,CAOC,EACD,GAAW;IAEX,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC1B,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACnG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5B,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,QAAQ;QAAE,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE;QAChD,IAAI,EAAE,EAAE;QACR,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;IACrD,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,aAAa,CAAC,CAM5B;IACA,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC1B,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,QAAQ;QAAE,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,yBAAyB,EAAE;QACtD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE;QAChD,IAAI,EAAE,EAAE;QACR,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;IACrD,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,yGAAyG;AACzG,KAAK,UAAU,oBAAoB,CAAC,CAMnC;IACA,MAAM,EAAE,GAAG,IAAI,QAAQ,EAAE,CAAC;IAC1B,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;IACnG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,6CAA6C,EAAE;QAC1E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACnC,IAAI,EAAE,EAAE;QACR,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;IACrD,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAAC,CAMjC;IACA,IAAI,GAAG,GAAG,mEAAmE,CAAC;IAC9E,IAAI,CAAC,CAAC,QAAQ;QAAE,GAAG,IAAI,aAAa,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;QAC7E,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;QACnC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC;KACjD,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;IACF,OAAO,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;AACzE,CAAC;AAED,4EAA4E;AAE5E;;;;;;;GAOG;AACH,KAAK,UAAU,YAAY,CAC1B,MAAc,EACd,IAOC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YACtC,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;YAC1B,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC;SAClD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,QAAQ,MAAM,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnF,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC;QACpE,MAAM,IAAI,GAAG,UAAU,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACjD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;IACxC,CAAC;IAED,oEAAoE;IACpE,MAAM,OAAO,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,MAAM,IAAI,4BAA4B,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACJ,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACR,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,qBAAqB,CAC9B,8FAA8F;YAC7F,kDAAkD,CACnD,CAAC;IACH,CAAC;IACD,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACJ,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,MAAM,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,MAAM,IAAI,qBAAqB,CAAC,eAAe,MAAM,EAAE,CAAC,CAAC;IAC7E,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnF,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;IACzC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AAC/D,CAAC;AAED,qGAAqG;AACrG,SAAS,iBAAiB,CAAC,IAAyE;IACnG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,CAAU,EAAE,EAAE;QAC1B,IAAI,CAAC,CAAC;YAAE,OAAO;QACf,IAAI,CAAC;YACJ,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACR,YAAY;QACb,CAAC;IACF,CAAC,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACvB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC;IACvB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC;QACJ,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACR,YAAY;IACb,CAAC;IACD,4EAA4E;IAC5E,2EAA2E;IAC3E,YAAY;IACZ,IAAI,CAAC;QACJ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;QAC9C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACR,YAAY;IACb,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,2EAA2E;IAC3E,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;QACpC,GAAG,CAAC,OAAO,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACR,YAAY;IACb,CAAC;IACD,8EAA8E;IAC9E,IAAI,CAAC;QACJ,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACR,YAAY;IACb,CAAC;IACD,6EAA6E;IAC7E,kEAAkE;IAClE,wEAAwE;IACxE,+DAA+D;IAC/D,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3B,IAAI,CAAC;YACJ,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACR,YAAY;QACb,CAAC;IACF,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,0FAA0F;AAC1F,SAAS,eAAe,CAAC,QAAgB,EAAE,KAAe;IACzD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,iEAAiE;AAEjE,kFAAkF;AAClF,SAAS,iBAAiB;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,UAAU,EAA2D,CAAC;QAClF,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,OAAO,CAAC;QAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE;YAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACR,mBAAmB;IACpB,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,WAAW,CAAC,MAAc;IACzC,IAAI,CAAC,GAAG,MAAM,CAAC;IACf,IAAI,CAAC;QACJ,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACR,iCAAiC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACzD,CAAC;AAED,qFAAqF;AACrF,SAAS,gBAAgB,CAAC,GAAW;IACpC,QAAQ,GAAG,EAAE,CAAC;QACb,KAAK,KAAK;YACT,OAAO,WAAW,CAAC;QACpB,KAAK,KAAK;YACT,OAAO,WAAW,CAAC;QACpB,KAAK,KAAK;YACT,OAAO,WAAW,CAAC;QACpB,KAAK,KAAK;YACT,OAAO,WAAW,CAAC;QACpB,KAAK,MAAM;YACV,OAAO,YAAY,CAAC;QACrB,KAAK,KAAK,CAAC;QACX,KAAK,KAAK;YACT,OAAO,WAAW,CAAC;QACpB,KAAK,MAAM;YACV,OAAO,YAAY,CAAC;QACrB,KAAK,MAAM;YACV,OAAO,YAAY,CAAC;QACrB;YACC,OAAO,YAAY,CAAC;IACtB,CAAC;AACF,CAAC;AAED,oFAAoF;AACpF,SAAS,WAAW,CAAC,IAAwB;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,IAAI,CACZ,MAA6B,EAC7B,OAAe,EACf,QAAyC,EAAE;IAE3C,OAAO,UAAU,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,EAAmC,CAA4C,CAAC;AACzI,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAa;IACpC,IAAI,CAAC;QACJ,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC;AAED,mEAAmE;AACnE,SAAS,WAAW,CAAC,MAA+B,EAAE,EAAU;IAC/D,MAAM,aAAa,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,CAAC;IAClC,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;AACjD,CAAC"}

package/dist/buildstamp.json

@@ -1 +1 @@
-{"builtAt":1782428527977,"head":"aa8d55f00e6b2c9ae3d0a02767f5c27c2f92c370","version":"1.11.2"}
+{"builtAt":1782487324269,"head":"ab1a71d75d3e570070899e5e4d4552506ad4cd4b","version":"1.13.0"}

package/dist/cli/commands/connect.d.ts

@@ -28,6 +28,12 @@ export interface ConnectCommandOptions {
     port?: number;
     /** Per-request timeout (ms). Default: 60_000 */
     requestTimeoutMs?: number;
+    /**
+     * Token for an authenticated gateway. Falls back to `BRIGADE_GATEWAY_TOKEN`
+     * then the local `gateway.auth` config when omitted; undefined for an
+     * unauthenticated gateway (the default), in which case no auth is sent.
+     */
+    token?: string;
     /**
      * Bind the TUI to this agent id at startup — equivalent to opening the
      * TUI and immediately running `/agent <id>`, but without the manual step.

package/dist/cli/commands/connect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EAMN,GAAG,EACH,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAoBpD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,WAAW,EAAE,OAAO,GAAG,IAAI,CAejF;AAED,MAAM,WAAW,qBAAqB;IACrC,uCAAuC;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC7B,iFAAiF;IACjF,KAAK,IAAI,OAAO,CAAC;IACjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACtC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAGT;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,aAAa,CAAC,CAiHhG;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAClC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,aAAa,EACrB,cAAc,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,aAAa,CAAC,CA+sExB"}
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,EAMN,GAAG,EACH,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAsBpD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,WAAW,EAAE,OAAO,GAAG,IAAI,CAejF;AAED,MAAM,WAAW,qBAAqB;IACrC,uCAAuC;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC7B,iFAAiF;IACjF,KAAK,IAAI,OAAO,CAAC;IACjB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CACtC,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,WAAW,EAAE,MAAM,GAAG,SAAS,GAC7B,OAAO,CAGT;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,GAAE,qBAA0B,GAAG,OAAO,CAAC,aAAa,CAAC,CAsHhG;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAClC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,aAAa,EACrB,cAAc,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,aAAa,CAAC,CA+sExB"}

package/dist/cli/commands/connect.js

@@ -34,6 +34,8 @@ import { markTuiActive, restoreTerminal } from "../../ui/terminal-cleanup.js";
 import { brand, editorTheme, markdownTheme } from "../../ui/theme.js";
 import { summarizeToolResult } from "../../ui/tool-result.js";
 import { BrigadeClient } from "../../tui/client.js";
+import { loadConfig } from "../../core/config.js";
+import { resolveClientToken } from "../../core/gateway-auth.js";
 import { ApprovalPrompt } from "../../tui/approval-prompt.js";
 import { computeExplain, filterGraphToSubtree, formatExplain, parseOrgSlash, renderDepartmentsOnly, } from "./org-slash.js";
 import { renderPrideChartWithPins, BRIGADE_FOOTER_RULE, } from "../../agents/org/pride-template.js";
@@ -115,9 +117,14 @@ export async function runConnectCommand(opts = {}) {
         process.exit(130);
     };
     process.once("SIGINT", onSigint);
+    // Resolve the gateway token (flag → BRIGADE_GATEWAY_TOKEN → local config).
+    // Undefined when the gateway is unauthenticated — the client then sends no
+    // auth header and connects exactly as before.
+    const token = resolveClientToken(loadConfig().gateway?.auth, { override: opts.token });
     const client = new BrigadeClient({
         url,
         requestTimeoutMs: opts.requestTimeoutMs ?? 60_000,
+        ...(token ? { token } : {}),
     });
     try {
         await client.connect();