agentvault 1.0.1 → 1.0.5

package/CHANGELOG.md

@@ -4,6 +4,75 @@ All notable changes to AgentVault will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
+## [1.0.4] - 2026-05-24 - Security & build hygiene refresh
+
+### Security
+- **SEC-2 (HIGH):** Vault client now actually validates TLS against the
+  configured `caCertPath`. An `undici.Agent` is attached as the fetch
+  dispatcher with `ca` (and optional `rejectUnauthorized`) on every
+  request from `VaultClient`. Previously the cert was loaded and ignored.
+- **SEC-5 (HIGH):** Removed `--mnemonic`, `--private-key`, and
+  `--password` CLI options from `agentvault wallet`. Secrets are now read
+  from `AGENTVAULT_MNEMONIC`, `AGENTVAULT_PRIVATE_KEY`, and
+  `AGENTVAULT_PASSWORD` env vars, or via an interactive `inquirer`
+  password prompt for keystore decryption in TTY contexts. CLI args are
+  visible in `ps aux` and shell history and should never carry secrets.
+- **SEC-6 (MED):** Vault key-pattern matching escapes regex
+  metacharacters before expanding `*` and `?` globs. Removes ReDoS
+  exposure and stops `.` / `+` / `(` etc. in user patterns from
+  triggering unintended regex matches.
+- **SEC-10 (MED):** `encryptShare()` in both VetKeys clients now
+  generates an independent random salt for PBKDF2 instead of reusing the
+  IV. Share blob layout is now `salt(16) || iv(12 or 16) || ciphertext`.
+  Also fixed an algorithm-name bug (`aes-256-gcm` was being mangled to
+  `aes256-gcm` by `String.replace('-','')`).
+- **SEC-12 (MED):** New `sanitizePathPart()` rejects `..`, separators,
+  NUL, and out-of-alphabet input on every agent-id / wallet-id path
+  segment used by `wallet-storage.ts`.
+- **SEC-15 (MED):** `DEFAULT_WASMEDGE_OPTIONS.debug` and `.sourcemap`
+  now default to `false`. Shipped WASM no longer leaks debug symbols
+  unless `--debug` is explicitly passed.
+- **SEC-17 (MED):** New `atomicWriteFileSync()` (write→fsync→rename)
+  is used for backup envelopes, the ed25519 signing-key file, and wallet
+  files. A crash mid-write can no longer corrupt these artefacts.
+
+### Changed
+- CLI: `agentvault wallet multi-send` and `agentvault wallet
+  process-queue` are now wired up (handlers previously existed but were
+  not reachable from the dispatcher).
+- CLI help: `trace` and `profile` are labelled `[Stub]` (Phase 3 not
+  implemented / mock data) and `stats` is labelled `[Partial]` (current
+  values only; historical analysis pending).
+- Tests: `tests/cli/commands/wallet.test.ts` exercises the env-var
+  import flow instead of the now-removed CLI options.
+
+### Added
+- `src/utils/path-validation.ts` — `sanitizePathPart`, `sanitizePathParts`,
+  `atomicWriteFileSync`.
+- `tests/unit/path-validation.test.ts` — 15 cases for the new utilities.
+- `tests/vault/glob-pattern.test.ts` — 4 cases verifying SEC-6 behaviour.
+
+### Dependencies
+- Added `undici` (^7.25.0) as a direct dep for the TLS dispatcher.
+- Added `overrides` block pinning `brace-expansion`, `uuid`, `ws`, and
+  `postcss` to vulnerability-free ranges without forcing breaking
+  upgrades of `@solana/web3.js` or `ethers`.
+- `npm audit` now reports **0 vulnerabilities** (was 8 moderate).
+
+### Build
+- TypeScript: 0 errors (was 24, all in tests/`wiki.test.ts` non-null
+  narrowing and `cli/commands/wiki.ts` unused import).
+- ESLint: 0 errors (was 13, mostly `Function`-typed callback params and
+  a stray `require()`).
+- Removed `pnpm-lock.yaml`; `package-lock.json` is authoritative.
+
+### Documentation
+- `SECURITY_AUDIT_AND_COMPLETION_PLAN.md` rewritten as a living document
+  with per-finding status (FIXED / OPEN) and links to the resolving
+  commits.
+- `README.md` Known Limitations table updated to reflect that wallet
+  encryption is now real.
+
 ## [1.0.0] - 2025-02-12 - v1.0.0 Final Release
 
 ### Added

package/README.md

@@ -45,15 +45,20 @@ node dist/cli/index.js --help
 ### 1. Initialize a New Agent Project
 
 ```bash
-agentvault init my-agent
+npx agentvault@latest init my-agent --template default
+cd my-agent
 ```
 
-This creates a `.agentvault/` directory with agent configuration.
+This scaffolds a new project directory containing `agent.json`, an `index.js`
+entry point, and a `.agentvault/` directory with agent configuration. Use
+`--template minimal` for a bare scaffold. (If you installed the CLI globally
+with `npm install -g agentvault`, replace `npx agentvault@latest` with
+`agentvault` in any command.)
 
 ### 2. Package Your Agent
 
 ```bash
-agentvault package ./my-agent
+agentvault package ./
 ```
 
 Compiles your agent to WASM and generates deployment artifacts.
@@ -136,6 +141,45 @@ agentvault fetch --canister-id <your-canister-id>
 | `profile` | Profile canister performance | Experimental |
 | `trace` | View execution traces | Experimental |
 
+### Memory, Knowledge & Identity Commands
+
+| Command | Description |
+|---------|-------------|
+| `memory` | Git-style memory repository for agent identity and versioned memory |
+| `rebase` | Fetch on-chain commits and merge with a local bundle file |
+| `wiki` | LLM-maintained knowledge base (archivist) |
+| `polytician` | Manage Polytician semantic memory integration |
+| `skills` | Manage domain-specific agent skill files |
+| `decrypt` | Decrypt agent state using a seed phrase |
+
+### Security & Secrets Commands
+
+| Command | Description |
+|---------|-------------|
+| `vault` | Manage agent secrets and API keys (HashiCorp Vault or Bitwarden) |
+| `safehouse` | Agent Safehouse secret management layer (deny-first sandboxing) |
+| `repo` | Repository security, audit, and integrity commands |
+
+### Fault Tolerance & Operations Commands
+
+| Command | Description |
+|---------|-------------|
+| `mirror` | Mirror agent state to a second ICP canister for fault tolerance |
+| `cron` | Fault-tolerance automation: daily liveness check and auto-restore |
+| `cloud-backup` | Detect available cloud storage providers on this machine |
+| `network` | Manage ICP networks |
+| `test` | Run tests against canisters |
+| `instrument` | Instrument WASM file for debugging |
+
+### Orchestration & Scaffolding Commands
+
+| Command | Description |
+|---------|-------------|
+| `orchestrate` | Orchestrate an AI-assisted development session governed by AgentVault |
+| `mcp` | Manage MCP (Model Context Protocol) server registrations |
+| `mint` | Scaffold a new Google ADK agent with on-chain canister and birthday backup |
+| `pilot` | Initialize a private ICP replica and deploy Guild canisters |
+
 ## Environment Variables
 
 ### ICP Configuration
@@ -223,11 +267,27 @@ npm run test
 | Feature | Status |
 |---------|--------|
 | Core flow (init → package → deploy → exec → fetch) | ✅ Working |
-| Wallet crypto (real elliptic curves) | ⚠️ Basic SHA-256 |
-| VetKeys threshold signatures | ⚠️ Simulated |
+| Wallet crypto (real elliptic curves) | ✅ secp256k1 / ed25519 via `@noble/curves` |
+| Wallet at-rest encryption | ✅ AES-256-GCM via `encryptWalletSecrets` |
+| Backup atomic writes | ✅ write→fsync→rename via `atomicWriteFileSync` |
+| Vault TLS CA cert | ✅ honoured via `undici.Agent` dispatcher |
+| VetKeys threshold signatures | ⚠️ Simulated (real canister integration pending) |
 | Bittensor inference | ⚠️ Requires API access |
 | Arweave archival | ⚠️ Requires wallet setup |
-| Backup/restore | ⚠️ Manifest only |
+| `trace` / `profile` CLI | ⚠️ Stub — Phase 3 not yet implemented |
+| `stats` CLI historical analysis | ⚠️ Partial — current values only |
+
+See [`SECURITY_AUDIT_AND_COMPLETION_PLAN.md`](./SECURITY_AUDIT_AND_COMPLETION_PLAN.md) for the current security posture and audit history.
+
+### Wallet secrets
+
+Mnemonics, private keys, and keystore passwords are **never** accepted as
+CLI arguments (they would leak through `ps aux` and shell history). Use:
+
+- `AGENTVAULT_MNEMONIC` env var for `wallet import`
+- `AGENTVAULT_PRIVATE_KEY` env var for `wallet import`
+- `AGENTVAULT_PASSWORD` env var or interactive `inquirer` prompt for
+  `--keystore` decryption
 
 ## Contributing
 

package/dist/cli/commands/approve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve.d.ts","sourceRoot":"","sources":["../../../cli/commands/approve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgCpC,QAAA,MAAM,UAAU,SAAyB,CAAC;AAyoB1C,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/cli/commands/approve.js

@@ -1,7 +1,10 @@
 import { Command } from 'commander';
 import chalk from 'chalk';
 import ora from 'ora';
-import { createApprovalRequest, signApprovalRequest, rejectApprovalRequest, listApprovalRequests, listPendingApprovals, deleteApprovalRequest, isApproved, getApprovalSummary, cleanupExpiredRequests, } from '../../src/security/index.js';
+import { createApprovalRequest, signApprovalRequest, rejectApprovalRequest, listApprovalRequests, listPendingApprovals, deleteApprovalRequest, isApproved, getApprovalSummary, cleanupExpiredRequests, 
+// MFA — TOTP path
+setupMfa, issueChallenge, verifyMfaApproval, verifyBiometricApproval, validateOtpToken, unlockBranch, getMfaAuditLog, getMfaStatus, getDeviceFingerprint, registerDevice, } from '../../src/security/index.js';
+import { setupBiometricCredential, signChallenge, hasBiometricCredential, } from '../../src/security/webauthn.js';
 const approveCmd = new Command('approve');
 approveCmd
     .description('[Experimental] Manage multi-signature approval workflows')
@@ -9,11 +12,11 @@ approveCmd
     console.log(chalk.yellow('[Experimental] This feature is under active development and may change.'));
     console.log(chalk.yellow('Please specify a subcommand: create, list, sign, reject, delete, or cleanup'));
     console.log(chalk.gray(`\nExamples:
-  ${chalk.cyan('soulrecall approve create deploy <agent-name> "Description"')}${chalk.gray('  Create approval request')}
-  ${chalk.cyan('soulrecall approve list')}${chalk.gray('                     List all requests')}
-  ${chalk.cyan('soulrecall approve sign <request-id>')}${chalk.gray('             Sign a request')}
-  ${chalk.cyan('soulrecall approve reject <request-id>')}${chalk.gray('          Reject a request')}
-  ${chalk.cyan('soulrecall approve pending <signer>')}${chalk.gray('          Show pending requests')}`));
+  ${chalk.cyan('agentvault approve create deploy <agent-name> "Description"')}${chalk.gray('  Create approval request')}
+  ${chalk.cyan('agentvault approve list')}${chalk.gray('                     List all requests')}
+  ${chalk.cyan('agentvault approve sign <request-id>')}${chalk.gray('             Sign a request')}
+  ${chalk.cyan('agentvault approve reject <request-id>')}${chalk.gray('          Reject a request')}
+  ${chalk.cyan('agentvault approve pending <signer>')}${chalk.gray('          Show pending requests')}`));
 });
 approveCmd
     .command('create')
@@ -228,5 +231,358 @@ approveCmd
         process.exit(1);
     }
 });
+// ─── MFA subcommand ──────────────────────────────────────────────────────────
+const mfaCmd = new Command('mfa');
+mfaCmd.description('Multi-factor human approval (TOTP + nonce + one-time link)');
+// agentvault approve mfa setup --branch <branch-id>
+mfaCmd
+    .command('setup')
+    .description('Generate a TOTP seed for a branch — scan the QR URI once in your authenticator app')
+    .requiredOption('--branch <branch-id>', 'Branch / workflow identifier (e.g. pending-001)')
+    .action(async (options) => {
+    const spinner = ora('Generating TOTP seed…').start();
+    try {
+        const setup = setupMfa(options.branch);
+        spinner.succeed(chalk.green(`MFA seed created for branch: ${setup.branchId}`));
+        console.log(chalk.bold('\n  TOTP Secret (keep offline):'));
+        console.log(`  ${chalk.cyan(setup.totpSecretB32)}`);
+        console.log(chalk.bold('\n  Scan this URI in Authy / Google Authenticator:'));
+        console.log(`  ${chalk.yellow(setup.otpAuthUri)}`);
+        console.log(chalk.gray('\n  The secret is stored locally in ~/.agentvault/mfa/\n' +
+            '  The agent never transmits the seed — only nonces and hashes go on-chain.'));
+    }
+    catch (error) {
+        spinner.fail(chalk.red('Setup failed'));
+        console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+        process.exit(1);
+    }
+});
+// agentvault approve mfa challenge <request-id> --branch <branch-id>
+mfaCmd
+    .command('challenge')
+    .description('Issue a challenge (nonce + hash + one-time link) for a pending approval request')
+    .argument('<request-id>', 'Approval request ID')
+    .requiredOption('--branch <branch-id>', 'Branch that owns the TOTP seed')
+    .action(async (requestId, options) => {
+    const spinner = ora('Issuing MFA challenge…').start();
+    try {
+        const challenge = issueChallenge(requestId, options.branch);
+        spinner.succeed(chalk.green('Challenge issued'));
+        console.log(chalk.bold('\n  Reply with:'));
+        console.log(`  ${chalk.cyan(`APPROVE <TOTP-code> ${challenge.nonce}`)}`);
+        console.log(chalk.bold('\n  Or click the one-time link (valid 60 s):'));
+        console.log(`  ${chalk.yellow(challenge.approvalLink)}`);
+        console.log(chalk.bold('\n  Challenge hash (SHA-256):'));
+        console.log(`  ${chalk.gray(challenge.challengeHash)}`);
+        console.log(chalk.gray(`\n  Nonce: ${challenge.nonce}  |  Expires: ${challenge.expiresAt}`));
+    }
+    catch (error) {
+        spinner.fail(chalk.red('Failed to issue challenge'));
+        console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+        process.exit(1);
+    }
+});
+// agentvault approve mfa verify <request-id> <totp-code> <nonce> --branch <branch-id>
+mfaCmd
+    .command('verify')
+    .description('Verify a TOTP code + nonce reply from the approver')
+    .argument('<request-id>', 'Approval request ID')
+    .argument('<totp-code>', '6-digit TOTP code from authenticator app')
+    .argument('<nonce>', 'Nonce that was issued in the challenge (integer)')
+    .requiredOption('--branch <branch-id>', 'Branch that owns the TOTP seed')
+    .option('--fingerprint <hex>', 'Override device fingerprint (default: auto-detected)')
+    .action(async (requestId, totpCode, nonceStr, options) => {
+    const spinner = ora('Verifying MFA approval…').start();
+    try {
+        const nonce = parseInt(nonceStr, 10);
+        if (isNaN(nonce)) {
+            spinner.fail(chalk.red('Invalid nonce — must be an integer'));
+            process.exit(1);
+        }
+        const result = verifyMfaApproval({
+            requestId,
+            branchId: options.branch,
+            totpCode,
+            nonce,
+            deviceFingerprint: options.fingerprint,
+        });
+        if (result.ok) {
+            spinner.succeed(chalk.green('Approval verified'));
+            console.log(chalk.bold('\n  Audit token (forward to ICP canister):'));
+            console.log(`  ${chalk.cyan(result.auditToken)}`);
+            console.log(chalk.gray('\n  Run: agentvault approve sign <request-id> <signer> to complete the multi-sig flow.'));
+        }
+        else {
+            spinner.fail(chalk.red(`Verification failed: ${result.reason}`));
+            const hints = {
+                'invalid-totp': 'Check your authenticator app clock and try again.',
+                'nonce-mismatch': 'Use the nonce from the latest challenge (agentvault approve mfa challenge).',
+                'nonce-replayed': 'This nonce has already been used. Issue a new challenge.',
+                'rate-limited': 'You have exceeded 3 approvals / hour. Wait before retrying.',
+                'anomaly': 'Unknown device detected — branch auto-locked. Run: agentvault approve mfa unlock',
+                'branch-locked': 'Branch is locked. Run: agentvault approve mfa unlock --branch <id>',
+                'not-setup': 'MFA not configured. Run: agentvault approve mfa setup --branch <id>',
+            };
+            const hint = hints[result.reason];
+            if (hint)
+                console.log(chalk.yellow(`  Hint: ${hint}`));
+            process.exit(1);
+        }
+    }
+    catch (error) {
+        spinner.fail(chalk.red('Verification error'));
+        console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+        process.exit(1);
+    }
+});
+// agentvault approve mfa link-verify <token>
+mfaCmd
+    .command('link-verify')
+    .description('Validate a one-time approval link token (simulates the webapp handler)')
+    .argument('<token>', 'Hex token from the approval link URL')
+    .action(async (token) => {
+    const spinner = ora('Validating one-time token…').start();
+    try {
+        const result = validateOtpToken(token);
+        if (result.ok) {
+            spinner.succeed(chalk.green(`Token valid — request ID: ${result.requestId}`));
+            console.log(chalk.gray('  Token is now consumed and cannot be reused.'));
+        }
+        else {
+            spinner.fail(chalk.red(`Token invalid: ${result.reason}`));
+            process.exit(1);
+        }
+    }
+    catch (error) {
+        spinner.fail(chalk.red('Token validation error'));
+        console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+        process.exit(1);
+    }
+});
+// agentvault approve mfa unlock --branch <branch-id>
+mfaCmd
+    .command('unlock')
+    .description('Unlock a branch after investigating a new-device anomaly')
+    .requiredOption('--branch <branch-id>', 'Branch to unlock')
+    .requiredOption('--totp <code>', '6-digit TOTP code confirming the unlock is authorised')
+    .option('--register-device <fingerprint>', 'Register the new device fingerprint as trusted')
+    .action(async (options) => {
+    const spinner = ora('Unlocking branch…').start();
+    try {
+        const ok = unlockBranch(options.branch, options.totp, options.registerDevice);
+        if (ok) {
+            spinner.succeed(chalk.green(`Branch '${options.branch}' unlocked`));
+            if (options.registerDevice) {
+                console.log(chalk.gray(`  Device ${options.registerDevice} added to trusted list.`));
+            }
+        }
+        else {
+            spinner.fail(chalk.red('Unlock failed — TOTP code invalid or branch not found'));
+            process.exit(1);
+        }
+    }
+    catch (error) {
+        spinner.fail(chalk.red('Unlock error'));
+        console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+        process.exit(1);
+    }
+});
+// agentvault approve mfa audit --branch <branch-id>
+mfaCmd
+    .command('audit')
+    .description('Display the local MFA audit log for a branch')
+    .requiredOption('--branch <branch-id>', 'Branch to query')
+    .option('--json', 'Output raw JSON')
+    .action(async (options) => {
+    const spinner = ora('Loading audit log…').start();
+    try {
+        const entries = getMfaAuditLog(options.branch);
+        spinner.succeed(chalk.green(`${entries.length} audit entry(ies) for branch '${options.branch}'`));
+        if (entries.length === 0) {
+            console.log(chalk.gray('  No events recorded yet.'));
+            return;
+        }
+        if (options.json) {
+            console.log(JSON.stringify(entries, null, 2));
+            return;
+        }
+        for (const e of entries) {
+            const eventColor = {
+                'approved': (s) => chalk.green(s),
+                'rejected': (s) => chalk.red(s),
+                'anomaly-detected': (s) => chalk.magenta(s),
+                'branch-locked': (s) => chalk.red(s),
+                'branch-unlocked': (s) => chalk.green(s),
+                'rate-limit-exceeded': (s) => chalk.yellow(s),
+                'challenge-issued': (s) => chalk.blue(s),
+                'setup': (s) => chalk.cyan(s),
+            };
+            const colorFn = eventColor[e.event] ?? ((s) => chalk.gray(s));
+            console.log(`\n  ${chalk.bold(e.id)}`);
+            console.log(`    Event:     ${colorFn(e.event)}`);
+            console.log(`    Request:   ${e.requestId}`);
+            console.log(`    Timestamp: ${e.timestamp}`);
+            if (e.nonce !== undefined)
+                console.log(`    Nonce:     ${e.nonce}`);
+            if (e.challengeHash)
+                console.log(`    Hash:      ${chalk.gray(e.challengeHash)}`);
+            if (e.auditToken)
+                console.log(`    AuditTok:  ${chalk.cyan(e.auditToken)}`);
+            if (e.deviceFingerprint)
+                console.log(`    Device:    ${chalk.gray(e.deviceFingerprint)}`);
+            if (e.detail)
+                console.log(`    Detail:    ${chalk.gray(e.detail)}`);
+        }
+    }
+    catch (error) {
+        spinner.fail(chalk.red('Failed to load audit log'));
+        console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+        process.exit(1);
+    }
+});
+// agentvault approve mfa status --branch <branch-id>
+mfaCmd
+    .command('status')
+    .description('Show MFA posture (nonce, lock state) for a branch')
+    .requiredOption('--branch <branch-id>', 'Branch to inspect')
+    .action(async (options) => {
+    const status = getMfaStatus(options.branch);
+    if (!status.configured) {
+        console.log(chalk.yellow(`MFA not configured for branch '${options.branch}'.`));
+        console.log(chalk.gray(`  Run: agentvault approve mfa setup --branch ${options.branch}`));
+        return;
+    }
+    const lockLabel = status.locked
+        ? chalk.red('LOCKED (anomaly detected)')
+        : chalk.green('unlocked');
+    console.log(chalk.bold(`\nMFA status — ${options.branch}`));
+    console.log(`  State:         ${lockLabel}`);
+    console.log(`  Current nonce: ${status.currentNonce}`);
+    console.log(`  Used nonces:   ${status.usedNonceCount}`);
+    console.log(`  Created:       ${status.createdAt ?? 'unknown'}`);
+    console.log(`  Device:        ${chalk.gray(getDeviceFingerprint())}`);
+});
+// agentvault approve mfa device-register --signer <id> --fingerprint <hex>
+mfaCmd
+    .command('device-register')
+    .description('Manually trust a device fingerprint for a signer (after secondary confirmation)')
+    .requiredOption('--signer <id>', 'Signer identifier (device fingerprint or username)')
+    .requiredOption('--fingerprint <hex>', 'Device fingerprint to register as trusted')
+    .action(async (options) => {
+    registerDevice(options.signer, options.fingerprint);
+    console.log(chalk.green(`Device ${options.fingerprint} registered for signer ${options.signer}.`));
+});
+// ─── Biometric subcommands ────────────────────────────────────────────────────
+// Layer 2: WebAuthn / Secure Enclave fallback when TOTP is unavailable.
+// agentvault approve mfa biometric-setup [--fingerprint <hex>]
+mfaCmd
+    .command('biometric-setup')
+    .description('Enrol this device\'s biometric key (P-256 / WebAuthn).\n' +
+    'Generates a device-bound ECDSA keypair stored in ~/.agentvault/mfa/.\n' +
+    'The private key is AES-256-GCM encrypted and never leaves this machine.\n' +
+    'In a browser this maps to navigator.credentials.create() with Face ID / fingerprint.')
+    .option('--fingerprint <hex>', 'Override device fingerprint (default: auto-detected from hostname+platform+arch)')
+    .action(async (options) => {
+    const spinner = ora('Generating biometric credential…').start();
+    try {
+        const fingerprint = options.fingerprint ?? getDeviceFingerprint();
+        const setup = setupBiometricCredential(fingerprint);
+        spinner.succeed(chalk.green('Biometric credential enrolled'));
+        console.log(chalk.bold('\n  Credential ID:'));
+        console.log(`  ${chalk.cyan(setup.credentialId)}`);
+        console.log(chalk.bold('\n  Public key (SPKI, base64url) — register with ICP canister:'));
+        console.log(`  ${chalk.yellow(setup.publicKeyB64)}`);
+        console.log(chalk.bold('\n  Device fingerprint:'));
+        console.log(`  ${chalk.gray(setup.deviceFingerprint)}`);
+        console.log(chalk.gray('\n  The private key is stored encrypted in ~/.agentvault/mfa/\n' +
+            '  Send the public key to your ICP canister to enable remote verification.\n' +
+            '  Use --fingerprint to enrol on behalf of another device.'));
+    }
+    catch (error) {
+        spinner.fail(chalk.red('Biometric enrolment failed'));
+        console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+        process.exit(1);
+    }
+});
+// agentvault approve mfa biometric-verify <request-id> <nonce> --branch <branch-id>
+mfaCmd
+    .command('biometric-verify')
+    .description('Approve a pending request using the device biometric key instead of TOTP.\n' +
+    'Signs the challenge hash from issueChallenge() with the enrolled P-256 key.\n' +
+    'Use this when your TOTP app is unavailable (lost phone, etc.).')
+    .argument('<request-id>', 'Approval request ID')
+    .argument('<nonce>', 'Nonce from the challenge (integer)')
+    .requiredOption('--branch <branch-id>', 'Branch that owns the TOTP seed')
+    .option('--challenge-hash <hex>', 'SHA-256 challenge hash (from: agentvault approve mfa challenge)')
+    .option('--fingerprint <hex>', 'Override device fingerprint')
+    .action(async (requestId, nonceStr, options) => {
+    const spinner = ora('Signing with biometric key…').start();
+    try {
+        const nonce = parseInt(nonceStr, 10);
+        if (isNaN(nonce)) {
+            spinner.fail(chalk.red('Invalid nonce — must be an integer'));
+            process.exit(1);
+        }
+        const fingerprint = options.fingerprint ?? getDeviceFingerprint();
+        if (!hasBiometricCredential(fingerprint)) {
+            spinner.fail(chalk.red(`No biometric credential found for device ${fingerprint}`));
+            console.log(chalk.yellow('  Run: agentvault approve mfa biometric-setup'));
+            process.exit(1);
+        }
+        // The challenge hash is required for biometric verification — it was shown
+        // by `agentvault approve mfa challenge` and must be copy-pasted here.
+        if (!options.challengeHash) {
+            spinner.fail(chalk.red('--challenge-hash is required for biometric verification'));
+            console.log(chalk.gray('  Get it from: agentvault approve mfa challenge <request-id> --branch <branch-id>'));
+            process.exit(1);
+        }
+        const challengeHash = options.challengeHash;
+        // Sign the challenge with device key
+        const assertion = signChallenge(challengeHash, fingerprint);
+        // Verify through all MFA layers
+        const result = verifyBiometricApproval({
+            requestId,
+            branchId: options.branch,
+            challengeHash,
+            assertion,
+            nonce,
+            deviceFingerprint: fingerprint,
+        });
+        if (result.ok) {
+            spinner.succeed(chalk.green('Biometric approval verified'));
+            console.log(chalk.bold('\n  Audit token (forward to ICP canister):'));
+            console.log(`  ${chalk.cyan(result.auditToken)}`);
+            console.log(chalk.bold('\n  Assertion (credential + signature):'));
+            console.log(chalk.gray(`  credentialId:  ${assertion.credentialId}`));
+            console.log(chalk.gray(`  signCounter:   ${assertion.signCounter}`));
+            console.log(chalk.gray(`  signatureB64:  ${assertion.signatureB64.slice(0, 32)}…`));
+            console.log(chalk.gray('\n  Run: agentvault approve sign <request-id> <signer> to complete the multi-sig flow.'));
+        }
+        else {
+            spinner.fail(chalk.red(`Biometric verification failed: ${result.reason}`));
+            const hints = {
+                'biometric-not-enrolled': 'Run: agentvault approve mfa biometric-setup to enrol this device.',
+                'biometric-signature-invalid': 'Signature did not match the enrolled public key.',
+                'biometric-counter-replay': 'Sign counter did not increment — possible replay attack.',
+                'nonce-mismatch': 'Use the nonce from the latest challenge.',
+                'nonce-replayed': 'This nonce is already used. Issue a new challenge.',
+                'rate-limited': 'You have exceeded 3 approvals / hour.',
+                'anomaly': 'Unknown device — branch auto-locked. Run: agentvault approve mfa unlock',
+                'branch-locked': 'Branch is locked. Run: agentvault approve mfa unlock --branch <id>',
+                'not-setup': 'MFA not configured. Run: agentvault approve mfa setup --branch <id>',
+            };
+            const hint = hints[result.reason];
+            if (hint)
+                console.log(chalk.yellow(`  Hint: ${hint}`));
+            process.exit(1);
+        }
+    }
+    catch (error) {
+        spinner.fail(chalk.red('Biometric verification error'));
+        console.error(chalk.red(error instanceof Error ? error.message : String(error)));
+        process.exit(1);
+    }
+});
+approveCmd.addCommand(mfaCmd);
 export { approveCmd };
 //# sourceMappingURL=approve.js.map

package/dist/cli/commands/approve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve.js","sourceRoot":"","sources":["../../../cli/commands/approve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,UAAU,EACV,kBAAkB,EAClB,sBAAsB;AAEtB,kBAAkB;AAClB,QAAQ,EACR,cAAc,EACd,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,YAAY,EACZ,cAAc,EACd,YAAY,EACZ,oBAAoB,EACpB,cAAc,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,GACvB,MAAM,gCAAgC,CAAC;AAExC,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,SAAS,CAAC,CAAC;AAE1C,UAAU;KACP,WAAW,CAAC,0DAA0D,CAAC;KACvE,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,yEAAyE,CAAC,CAAC,CAAC;IACrG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,6EAA6E,CAAC,CAAC,CAAC;IACzG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;IACvB,KAAK,CAAC,IAAI,CAAC,6DAA6D,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC;IACnH,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC;IAC5F,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC;IAC9F,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC;IAC/F,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxG,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,+BAA+B,CAAC;KAC5C,QAAQ,CAAC,QAAQ,EAAE,kEAAkE,CAAC;KACtF,QAAQ,CAAC,cAAc,EAAE,YAAY,CAAC;KACtC,QAAQ,CAAC,eAAe,EAAE,2BAA2B,CAAC;KACtD,MAAM,CAAC,sBAAsB,EAAE,eAAe,EAAE,OAAO,CAAC;KACxD,MAAM,CAAC,mBAAmB,EAAE,wCAAwC,EAAE,UAAU,CAAC;KACjF,MAAM,CAAC,qBAAqB,EAAE,8BAA8B,CAAC;KAC7D,MAAM,CAAC,gBAAgB,EAAE,kCAAkC,EAAE,UAAU,CAAC;KACxE,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,EAAE,GAAG,CAAC;KAC7D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE;IACtD,MAAM,OAAO,GAAG,GAAG,CAAC,8BAA8B,CAAC,CAAC,KAAK,EAAE,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAmB;YAC7B,MAAM,EAAE,OAAO,CAAC,MAAa;YAC7B,iBAAiB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;YAChF,iBAAiB,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;SAClG,CAAC;QAEF,MAAM,OAAO,GAAG,qBAAqB,CACnC,IAAW,EACX,SAAS,EACT,WAAW,EACX,OAAO,CAAC,UAAU,EAClB,MAAM,CACP,CAAC;QAEF,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,6BAA6B,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,SAAS,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,wBAAwB,CAAC;KACrC,MAAM,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;KAChD,MAAM,CAAC,mBAAmB,EAAE,wDAAwD,CAAC;KACrF,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,MAAM,OAAO,GAAG,GAAG,CAAC,8BAA8B,CAAC,CAAC,KAAK,EAAE,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAa,CAAC,CAAC;QAE5E,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,QAAQ,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC;QAEpE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG;gBAClB,OAAO,EAAE,KAAK,CAAC,MAAM;gBACrB,QAAQ,EAAE,KAAK,CAAC,KAAK;gBACrB,QAAQ,EAAE,KAAK,CAAC,GAAG;gBACnB,OAAO,EAAE,KAAK,CAAC,IAAI;aACpB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC;YAE5B,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;YAEpE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,aAAa,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;YAChE,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YAEjD,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC7B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;oBAChC,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;oBACvE,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;wBAChB,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;oBAClD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,0BAA0B,CAAC;KACvC,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;KAC9C,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;KACnC,MAAM,CAAC,kBAAkB,EAAE,sBAAsB,CAAC;KAClD,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,SAAS,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAExE,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YACvC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,qBAAqB,MAAM,EAAE,CAAC,CAAC,CAAC;YAC5D,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;YAC3D,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;gBAC9C,IAAI,OAAO,EAAE,CAAC;oBACZ,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAChF,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,4BAA4B,CAAC;KACzC,QAAQ,CAAC,cAAc,EAAE,sBAAsB,CAAC;KAChD,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;KACnC,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;KAC7C,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,qBAAqB,SAAS,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAEzE,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,MAAM,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,qCAAqC,CAAC;KAClD,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;KACnC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;IACvB,MAAM,OAAO,GAAG,GAAG,CAAC,iCAAiC,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAE1E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAE9C,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,QAAQ,CAAC,MAAM,qBAAqB,CAAC,CAAC,CAAC;QAE5E,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,4BAA4B,CAAC;KACzC,QAAQ,CAAC,cAAc,EAAE,sBAAsB,CAAC;KAChD,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE;IAC1B,MAAM,OAAO,GAAG,GAAG,CAAC,oBAAoB,SAAS,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;IAEhE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAEjD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,UAAU;KACP,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,2BAA2B,CAAC;KACxC,MAAM,CAAC,KAAK,IAAI,EAAE;IACjB,MAAM,OAAO,GAAG,GAAG,CAAC,iCAAiC,CAAC,CAAC,KAAK,EAAE,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,sBAAsB,EAAE,CAAC;QAEzC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,OAAO,qBAAqB,CAAC,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACzE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,gFAAgF;AAEhF,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;AAClC,MAAM,CAAC,WAAW,CAAC,4DAA4D,CAAC,CAAC;AAEjF,oDAAoD;AACpD,MAAM;KACH,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,oFAAoF,CAAC;KACjG,cAAc,CAAC,sBAAsB,EAAE,iDAAiD,CAAC;KACzF,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,MAAM,OAAO,GAAG,GAAG,CAAC,uBAAuB,CAAC,CAAC,KAAK,EAAE,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,gCAAgC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAE/E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAEpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAEnD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,0DAA0D;YACxD,4EAA4E,CAC/E,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,qEAAqE;AACrE,MAAM;KACH,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,iFAAiF,CAAC;KAC9F,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;KAC/C,cAAc,CAAC,sBAAsB,EAAE,gCAAgC,CAAC;KACxE,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;IACnC,MAAM,OAAO,GAAG,GAAG,CAAC,wBAAwB,CAAC,CAAC,KAAK,EAAE,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAEjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,uBAAuB,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAEzE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAEzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;QAExD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,SAAS,CAAC,KAAK,iBAAiB,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,sFAAsF;AACtF,MAAM;KACH,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,oDAAoD,CAAC;KACjE,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;KAC/C,QAAQ,CAAC,aAAa,EAAE,0CAA0C,CAAC;KACnE,QAAQ,CAAC,SAAS,EAAE,kDAAkD,CAAC;KACvE,cAAc,CAAC,sBAAsB,EAAE,gCAAgC,CAAC;KACxE,MAAM,CAAC,qBAAqB,EAAE,sDAAsD,CAAC;KACrF,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;IACvD,MAAM,OAAO,GAAG,GAAG,CAAC,yBAAyB,CAAC,CAAC,KAAK,EAAE,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,iBAAiB,CAAC;YAC/B,SAAS;YACT,QAAQ,EAAE,OAAO,CAAC,MAAM;YACxB,QAAQ;YACR,KAAK;YACL,iBAAiB,EAAE,OAAO,CAAC,WAAW;SACvC,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CAAC,wFAAwF,CAAC,CACrG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAEjE,MAAM,KAAK,GAA2B;gBACpC,cAAc,EAAE,mDAAmD;gBACnE,gBAAgB,EAAE,6EAA6E;gBAC/F,gBAAgB,EAAE,0DAA0D;gBAC5E,cAAc,EAAE,6DAA6D;gBAC7E,SAAS,EAAE,kFAAkF;gBAC7F,eAAe,EAAE,oEAAoE;gBACrF,WAAW,EAAE,qEAAqE;aACnF,CAAC;YAEF,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,6CAA6C;AAC7C,MAAM;KACH,OAAO,CAAC,aAAa,CAAC;KACtB,WAAW,CAAC,wEAAwE,CAAC;KACrF,QAAQ,CAAC,SAAS,EAAE,sCAAsC,CAAC;KAC3D,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;IACtB,MAAM,OAAO,GAAG,GAAG,CAAC,4BAA4B,CAAC,CAAC,KAAK,EAAE,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,6BAA6B,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC9E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,qDAAqD;AACrD,MAAM;KACH,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,0DAA0D,CAAC;KACvE,cAAc,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;KAC1D,cAAc,CAAC,eAAe,EAAE,uDAAuD,CAAC;KACxF,MAAM,CAAC,iCAAiC,EAAE,gDAAgD,CAAC;KAC3F,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,MAAM,OAAO,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC9E,IAAI,EAAE,EAAE,CAAC;YACP,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC;YACpE,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,cAAc,yBAAyB,CAAC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,oDAAoD;AACpD,MAAM;KACH,OAAO,CAAC,OAAO,CAAC;KAChB,WAAW,CAAC,8CAA8C,CAAC;KAC3D,cAAc,CAAC,sBAAsB,EAAE,iBAAiB,CAAC;KACzD,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC;KACnC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,MAAM,OAAO,GAAG,GAAG,CAAC,oBAAoB,CAAC,CAAC,KAAK,EAAE,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,iCAAiC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAElG,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;YACrD,OAAO;QACT,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,UAAU,GAA0C;gBACxD,UAAU,EAAW,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1C,UAAU,EAAW,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxC,kBAAkB,EAAG,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC5C,eAAe,EAAM,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxC,iBAAiB,EAAI,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1C,qBAAqB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7C,kBAAkB,EAAG,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzC,OAAO,EAAc,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;aAC1C,CAAC;YAEF,MAAM,OAAO,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAEtE,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,CAAC,aAAa;gBAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAClF,IAAI,CAAC,CAAC,UAAU;gBAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,CAAC,iBAAiB;gBAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YAC1F,IAAI,CAAC,CAAC,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,qDAAqD;AACrD,MAAM;KACH,OAAO,CAAC,QAAQ,CAAC;KACjB,WAAW,CAAC,mDAAmD,CAAC;KAChE,cAAc,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;KAC3D,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5C,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gDAAgD,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC1F,OAAO;IACT,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM;QAC7B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,2BAA2B,CAAC;QACxC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAE5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC,CAAC,CAAC;AAEL,2EAA2E;AAC3E,MAAM;KACH,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,iFAAiF,CAAC;KAC9F,cAAc,CAAC,eAAe,EAAE,oDAAoD,CAAC;KACrF,cAAc,CAAC,qBAAqB,EAAE,2CAA2C,CAAC;KAClF,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,cAAc,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,OAAO,CAAC,WAAW,0BAA0B,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrG,CAAC,CAAC,CAAC;AAEL,iFAAiF;AACjF,wEAAwE;AAExE,+DAA+D;AAC/D,MAAM;KACH,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CACV,0DAA0D;IAC1D,wEAAwE;IACxE,2EAA2E;IAC3E,sFAAsF,CACvF;KACA,MAAM,CACL,qBAAqB,EACrB,kFAAkF,CACnF;KACA,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACxB,MAAM,OAAO,GAAG,GAAG,CAAC,kCAAkC,CAAC,CAAC,KAAK,EAAE,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;QAEpD,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC,CAAC;QAC1F,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,iEAAiE;YACjE,6EAA6E;YAC7E,2DAA2D,CAC5D,CACF,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,oFAAoF;AACpF,MAAM;KACH,OAAO,CAAC,kBAAkB,CAAC;KAC3B,WAAW,CACV,6EAA6E;IAC7E,+EAA+E;IAC/E,gEAAgE,CACjE;KACA,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;KAC/C,QAAQ,CAAC,SAAS,EAAE,oCAAoC,CAAC;KACzD,cAAc,CAAC,sBAAsB,EAAE,gCAAgC,CAAC;KACxE,MAAM,CAAC,wBAAwB,EAAE,iEAAiE,CAAC;KACnG,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;KAC5D,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,6BAA6B,CAAC,CAAC,KAAK,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oBAAoB,EAAE,CAAC;QAElE,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,4CAA4C,WAAW,EAAE,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CAAC,+CAA+C,CAAC,CAC9D,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,2EAA2E;QAC3E,sEAAsE;QACtE,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC,CAAC;YAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,aAAuB,CAAC;QAEtD,qCAAqC;QACrC,MAAM,SAAS,GAAG,aAAa,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QAE5D,gCAAgC;QAChC,MAAM,MAAM,GAAG,uBAAuB,CAAC;YACrC,SAAS;YACT,QAAQ,EAAE,OAAO,CAAC,MAAM;YACxB,aAAa;YACb,SAAS;YACT,KAAK;YACL,iBAAiB,EAAE,WAAW;SAC/B,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;YAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACpF,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CAAC,wFAAwF,CAAC,CACrG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kCAAkC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAE3E,MAAM,KAAK,GAA2B;gBACpC,wBAAwB,EAAE,mEAAmE;gBAC7F,6BAA6B,EAAE,kDAAkD;gBACjF,0BAA0B,EAAE,0DAA0D;gBACtF,gBAAgB,EAAE,0CAA0C;gBAC5D,gBAAgB,EAAE,oDAAoD;gBACtE,cAAc,EAAE,uCAAuC;gBACvD,SAAS,EAAE,yEAAyE;gBACpF,eAAe,EAAE,oEAAoE;gBACrF,WAAW,EAAE,qEAAqE;aACnF,CAAC;YAEF,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAClC,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AAE9B,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/cli/commands/archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.d.ts","sourceRoot":"","sources":["../../../cli/commands/archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAapC,QAAA,MAAM,UAAU,SAAyB,CAAC;AA6M1C,OAAO,EAAE,UAAU,EAAE,CAAC"}

package/dist/cli/commands/archive.js

@@ -9,11 +9,11 @@ archiveCmd
     console.log(chalk.yellow('[Experimental] This feature is under active development and may change.'));
     console.log(chalk.yellow('Please specify a subcommand: prepare, list, delete, verify, or stats'));
     console.log(chalk.gray(`\nExamples:
-  ${chalk.cyan('soulrecall archive prepare <agent-name> <version>')}${chalk.gray('    Prepare agent data for archival')}
-  ${chalk.cyan('soulrecall archive list')}${chalk.gray('                 List all archives')}
-  ${chalk.cyan('soulrecall archive stats <agent-name>')}${chalk.gray('     Get archive statistics')}
-  ${chalk.cyan('soulrecall archive delete <archive-id>')}${chalk.gray('      Delete an archive')}
-  ${chalk.cyan('soulrecall archive verify <archive-id>')}${chalk.gray('       Verify archive integrity')}`));
+  ${chalk.cyan('agentvault archive prepare <agent-name> <version>')}${chalk.gray('    Prepare agent data for archival')}
+  ${chalk.cyan('agentvault archive list')}${chalk.gray('                 List all archives')}
+  ${chalk.cyan('agentvault archive stats <agent-name>')}${chalk.gray('     Get archive statistics')}
+  ${chalk.cyan('agentvault archive delete <archive-id>')}${chalk.gray('      Delete an archive')}
+  ${chalk.cyan('agentvault archive verify <archive-id>')}${chalk.gray('       Verify archive integrity')}`));
 });
 archiveCmd
     .command('prepare')