aismemory 0.5.4 → 0.6.1

package/dist/agent-key-mode.js

@@ -0,0 +1,183 @@
+/**
+ * Agent API key auth mode for the aismemory MCP client (CORBOT-B1D3244C).
+ *
+ * Unattended-machine auth: a scoped `x-agent-api-key` credential fixed to
+ * exactly one agent (AIS_AGENT_ID). No device flow, no OAuth credential
+ * file, no DID key-auth — this mode never touches ~/.aismemory/credentials.json
+ * or ~/.aismemory/keys/. It exists to kill a duplicate-agent bug: the
+ * device-flow fallback mints a fresh provisional agent whenever no cached
+ * bond is found, which silently multiplies agents in prod on unattended/CI
+ * machines that can never complete a browser bond. This mode refuses to
+ * start rather than ever falling back to that path.
+ *
+ * Server-side contract (packages/agent-identity-service/src/api/middleware/
+ * agentApiKeyAuth.ts): the key authenticates ONLY
+ * `/v1/agents/:agentId/{memory,goals,dream,full-context}`, and only when
+ * :agentId equals the key's own agent. Every other route (tenant-wide agent
+ * listing, handoff, personality, key management, ...) is 403'd server-side.
+ * This module honors that scope client-side too: tools that need an
+ * out-of-scope route return an honest error instead of making a request the
+ * server would reject anyway.
+ */
+import { AisHttpError } from './ais-http-error.js';
+import { emitTelemetry } from './telemetry.js';
+import { parseEmptyToolArgs, parseRecallArgs, parseRememberArgs, } from './tool-args.js';
+/** Thrown by loadAgentApiKeyConfig when AIS_AGENT_API_KEY is set without AIS_AGENT_ID. */
+export class AgentApiKeyConfigError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'AgentApiKeyConfigError';
+    }
+}
+/**
+ * Read agent-API-key config from the environment.
+ *
+ * Returns null when AIS_AGENT_API_KEY is unset — the caller falls through to
+ * the device-flow/DID-key path. Throws AgentApiKeyConfigError when the key
+ * is set but AIS_AGENT_ID is missing; the caller must print the message to
+ * stderr and exit nonzero, and must NEVER fall back to the device flow or
+ * create a provisional agent (that fallback is the duplicate-agent bug this
+ * mode exists to kill).
+ */
+export function loadAgentApiKeyConfig(env = process.env) {
+    const rawApiKey = env['AIS_AGENT_API_KEY'];
+    // Only a truly ABSENT variable selects the device-flow path. A present-but-
+    // empty value is a misconfiguration (e.g. a CI secret that failed to
+    // resolve) and must fail fast: silently falling through to the device flow
+    // is the exact duplicate-agent bug this mode exists to kill.
+    if (rawApiKey === undefined)
+        return null;
+    // Trim before use: CI secret injection commonly appends a trailing newline,
+    // which would land inside the x-agent-api-key header (Node rejects invalid
+    // header characters, or the server answers an opaque 401).
+    const apiKey = rawApiKey.trim();
+    if (apiKey === '') {
+        throw new AgentApiKeyConfigError('AIS_AGENT_API_KEY is set but empty (or whitespace-only).\n' +
+            'Refusing to start: silently falling back to the device flow could ' +
+            'create a duplicate provisional agent.\n' +
+            'Unset the variable to use the device flow, or set a real ais_ak_ key.');
+    }
+    if (!apiKey.startsWith('ais_ak_')) {
+        throw new AgentApiKeyConfigError('AIS_AGENT_API_KEY does not look like an agent API key — expected the ' +
+            'ais_ak_ prefix. Service keys and JWTs do not work here; mint an ' +
+            'agent-scoped API key for this agent and use that.');
+    }
+    const agentId = env['AIS_AGENT_ID']?.trim();
+    if (!agentId) {
+        throw new AgentApiKeyConfigError('AIS_AGENT_API_KEY is set but AIS_AGENT_ID is missing.\n' +
+            'Agent API keys are scoped to exactly one agent — set AIS_AGENT_ID to the id ' +
+            'of the agent this key belongs to (the same agent it was minted for).\n' +
+            'Refusing to start: falling back to the device flow or creating a new ' +
+            'provisional agent would silently create a duplicate agent.');
+    }
+    return { apiKey, agentId };
+}
+async function readJson(res) {
+    return res.json().catch(() => null);
+}
+export async function aisKeyPost(aisUrl, path, apiKey, body, fetchImpl = globalThis.fetch) {
+    const headers = {
+        'Content-Type': 'application/json',
+        'x-agent-api-key': apiKey,
+    };
+    let res;
+    try {
+        res = await fetchImpl(`${aisUrl}${path}`, { method: 'POST', headers, body: JSON.stringify(body) });
+    }
+    catch (err) {
+        emitTelemetry({ event: 'ais.http.failure', path, error: err instanceof Error ? err.message : String(err) });
+        throw err;
+    }
+    const data = await readJson(res);
+    if (!res.ok) {
+        emitTelemetry({ event: 'ais.http.failure', path, httpStatus: res.status, error: `HTTP ${res.status}` });
+        throw new AisHttpError(res.status, path, data);
+    }
+    return data;
+}
+export async function aisKeyGet(aisUrl, path, apiKey, fetchImpl = globalThis.fetch) {
+    let res;
+    try {
+        res = await fetchImpl(`${aisUrl}${path}`, { headers: { 'x-agent-api-key': apiKey } });
+    }
+    catch (err) {
+        emitTelemetry({ event: 'ais.http.failure', path, error: err instanceof Error ? err.message : String(err) });
+        throw err;
+    }
+    const data = await readJson(res);
+    if (!res.ok) {
+        emitTelemetry({ event: 'ais.http.failure', path, httpStatus: res.status, error: `HTTP ${res.status}` });
+        throw new AisHttpError(res.status, path, data);
+    }
+    return data;
+}
+// ── Scoped tool dispatch ─────────────────────────────────────────────────
+/** Sentinel returned for a tool name this dispatcher doesn't recognize. */
+export const UNKNOWN_TOOL_KEY_MODE = Symbol('unknown-tool-key-mode');
+/**
+ * Error for a tool whose server route falls outside the agent-API-key
+ * allowlist (memory, goals, dream, full-context). Thrown instead of ever
+ * making the doomed request — the server would 403 it anyway, but failing
+ * fast client-side keeps the error message focused on SCOPE rather than a
+ * generic 403, and avoids burning a round trip on a request known to fail.
+ */
+export class OutOfScopeToolError extends Error {
+    constructor(tool, detail) {
+        super(`${tool} is not available with agent API key auth (scoped credential) — ${detail}`);
+        this.name = 'OutOfScopeToolError';
+    }
+}
+export async function dispatchToolKeyMode(aisUrl, config, name, rawArgs, fetchImpl = globalThis.fetch) {
+    const { agentId, apiKey } = config;
+    switch (name) {
+        case 'remember': {
+            const args = parseRememberArgs(rawArgs);
+            return aisKeyPost(aisUrl, `/v1/agents/${agentId}/memory`, apiKey, {
+                content: args.content,
+                type: args.type,
+                importance: args.importance,
+            }, fetchImpl);
+        }
+        case 'recall': {
+            const args = parseRecallArgs(rawArgs);
+            const params = new URLSearchParams();
+            params.set('query', args.query);
+            if (args.limit !== undefined)
+                params.set('limit', String(args.limit));
+            if (args.type !== undefined)
+                params.set('types', args.type);
+            return aisKeyGet(aisUrl, `/v1/agents/${agentId}/memory?${params}`, apiKey, fetchImpl);
+        }
+        case 'full_context':
+            parseEmptyToolArgs(rawArgs);
+            return aisKeyGet(aisUrl, `/v1/agents/${agentId}/full-context`, apiKey, fetchImpl);
+        case 'dream':
+            parseEmptyToolArgs(rawArgs);
+            return aisKeyPost(aisUrl, `/v1/agents/${agentId}/dream`, apiKey, {}, fetchImpl);
+        case 'whoami': {
+            parseEmptyToolArgs(rawArgs);
+            // No allowed identity route exists for a scoped key: `/v1/agents/:id`
+            // has no subresource segment, so the server allowlist regex never
+            // matches it and the request would 403. Answer from AIS_AGENT_ID
+            // instead, and prove the key is still live with a cheap probe against
+            // an allowed route (a 1-result memory read) rather than faking validity.
+            await aisKeyGet(aisUrl, `/v1/agents/${agentId}/memory?limit=1`, apiKey, fetchImpl);
+            return {
+                success: true,
+                data: {
+                    agentId,
+                    authMode: 'agent-api-key',
+                    keyValid: true,
+                },
+            };
+        }
+        case 'handoff':
+            throw new OutOfScopeToolError('handoff', "the handoff route is outside the key's allowed scope (memory, goals, dream, full-context).");
+        case 'agent_load':
+            throw new OutOfScopeToolError('agent_load', 'switching agents requires a tenant-wide agent-listing route, which is outside the ' +
+                "key's allowed scope. The active agent is fixed to AIS_AGENT_ID for the life of this process.");
+        default:
+            return UNKNOWN_TOOL_KEY_MODE;
+    }
+}
+//# sourceMappingURL=agent-key-mode.js.map

package/dist/agent-key-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-key-mode.js","sourceRoot":"","sources":["../src/agent-key-mode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,iBAAiB,GAClB,MAAM,gBAAgB,CAAC;AAOxB,0FAA0F;AAC1F,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,SAAS,GAAG,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC3C,4EAA4E;IAC5E,qEAAqE;IACrE,2EAA2E;IAC3E,6DAA6D;IAC7D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAEzC,4EAA4E;IAC5E,2EAA2E;IAC3E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,sBAAsB,CAC9B,4DAA4D;YAC1D,oEAAoE;YACpE,yCAAyC;YACzC,uEAAuE,CAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,sBAAsB,CAC9B,uEAAuE;YACrE,kEAAkE;YAClE,mDAAmD,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,sBAAsB,CAC9B,yDAAyD;YACvD,8EAA8E;YAC9E,wEAAwE;YACxE,uEAAuE;YACvE,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAMD,KAAK,UAAU,QAAQ,CAAC,GAAa;IACnC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,IAAY,EACZ,MAAc,EACd,IAAa,EACb,YAAuB,UAAU,CAAC,KAAK;IAEvC,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,iBAAiB,EAAE,MAAM;KAC1B,CAAC;IACF,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxG,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAc,EACd,IAAY,EACZ,MAAc,EACd,YAAuB,UAAU,CAAC,KAAK;IAEvC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5G,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,aAAa,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxG,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAE5E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,uBAAuB,CAAC,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CAAC,GAAG,IAAI,mEAAmE,MAAM,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,MAAyB,EACzB,IAAY,EACZ,OAAgB,EAChB,YAAuB,UAAU,CAAC,KAAK;IAEvC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAEnC,QAAQ,IAAI,EAAE,CAAC;QACf,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACxC,OAAO,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,SAAS,EAAE,MAAM,EAAE;gBAChE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAChC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5D,OAAO,SAAS,CAAC,MAAM,EAAE,cAAc,OAAO,WAAW,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACxF,CAAC;QAED,KAAK,cAAc;YACjB,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,SAAS,CAAC,MAAM,EAAE,cAAc,OAAO,eAAe,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAEpF,KAAK,OAAO;YACV,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,OAAO,UAAU,CAAC,MAAM,EAAE,cAAc,OAAO,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QAElF,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAC5B,sEAAsE;YACtE,kEAAkE;YAClE,iEAAiE;YACjE,sEAAsE;YACtE,yEAAyE;YACzE,MAAM,SAAS,CAAC,MAAM,EAAE,cAAc,OAAO,iBAAiB,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;YACnF,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,OAAO;oBACP,QAAQ,EAAE,eAAe;oBACzB,QAAQ,EAAE,IAAI;iBACf;aACF,CAAC;QACJ,CAAC;QAED,KAAK,SAAS;YACZ,MAAM,IAAI,mBAAmB,CAC3B,SAAS,EACT,4FAA4F,CAC7F,CAAC;QAEJ,KAAK,YAAY;YACf,MAAM,IAAI,mBAAmB,CAC3B,YAAY,EACZ,oFAAoF;gBAClF,8FAA8F,CACjG,CAAC;QAEJ;YACE,OAAO,qBAAqB,CAAC;IAC/B,CAAC;AACH,CAAC"}

package/dist/cli/doctor.d.ts

@@ -0,0 +1,57 @@
+#!/usr/bin/env node
+import { type OAuthCredentials } from '../oauth-credentials.js';
+export type CheckStatus = 'PASS' | 'WARN' | 'FAIL';
+export interface CheckResult {
+    name: string;
+    status: CheckStatus;
+    message: string;
+    hint?: string;
+}
+export interface DoctorReport {
+    aisUrl: string;
+    checks: CheckResult[];
+    problemCount: number;
+    verdict: 'pass' | 'problems';
+    exitCode: 0 | 1;
+}
+export declare function checkNodeVersion(nodeVersion?: string, minMajor?: number): CheckResult;
+export interface DnsLookupFn {
+    (hostname: string): Promise<{
+        address: string;
+        family: number;
+    }>;
+}
+export declare function checkDnsResolution(host: string, lookup?: DnsLookupFn): Promise<CheckResult>;
+export interface TlsProbeFn {
+    (host: string, port: number, timeoutMs: number): Promise<void>;
+}
+export declare function checkTlsReachability(host: string, probe?: TlsProbeFn, port?: number, timeoutMs?: number): Promise<CheckResult>;
+export type FetchFn = typeof fetch;
+export interface RestHealthResult extends CheckResult {
+    /** The `Date` response header, if present — reused by the clock-skew check. */
+    dateHeader?: string;
+}
+export declare function checkRestHealth(baseUrl: string, fetchImpl?: FetchFn): Promise<RestHealthResult>;
+export declare function checkMcpEndpoint(baseUrl: string, fetchImpl?: FetchFn): Promise<CheckResult>;
+export interface CredentialsCheckDeps {
+    load?: (home?: string) => OAuthCredentials | null;
+    now?: () => number;
+    fetchImpl?: FetchFn;
+    home?: string;
+}
+export declare function checkCredentials(baseUrl: string, deps?: CredentialsCheckDeps): Promise<CheckResult>;
+export declare function checkProxyEnv(env?: NodeJS.ProcessEnv): CheckResult;
+export declare function checkClockSkew(dateHeader: string | undefined, now?: () => number, warnThresholdMs?: number): CheckResult;
+export interface DoctorOptions {
+    aisUrl?: string;
+    env?: NodeJS.ProcessEnv;
+    nodeVersion?: string;
+    now?: () => number;
+    fetchImpl?: FetchFn;
+    dnsLookup?: DnsLookupFn;
+    tlsProbe?: TlsProbeFn;
+    loadCreds?: (home?: string) => OAuthCredentials | null;
+    home?: string;
+}
+export declare function runDoctor(options?: DoctorOptions): Promise<DoctorReport>;
+export declare function main(argv?: string[]): Promise<void>;

package/dist/cli/doctor.js

@@ -0,0 +1,332 @@
+#!/usr/bin/env node
+/**
+ * `aismemory doctor` — read-only self-diagnosis for "it doesn't work" reports.
+ *
+ * A new user whose MCP client can't reach AIS has no way to tell whether the
+ * problem is DNS, a corporate proxy, an unbonded agent, an expired token, or
+ * clock skew. This command runs a fixed set of read-only checks against the
+ * local environment and the AIS host and prints a PASS/WARN/FAIL report with
+ * a one-line remediation hint per problem — no writes to the API, no agent
+ * creation.
+ *
+ * Usage:
+ *   npx aismemory doctor
+ *   npx aismemory doctor --json
+ *   AIS_URL=https://other.example.com npx aismemory doctor
+ *
+ * Exit codes:
+ *   0 — no FAIL checks (WARNs are still reported but don't fail the command)
+ *   1 — at least one FAIL check
+ */
+import { lookup as dnsLookupDefault } from 'node:dns/promises';
+import { connect as tlsConnectDefault } from 'node:tls';
+import { loadOAuthCredentials, credentialsFilePath } from '../oauth-credentials.js';
+import { isCredsStale } from '../auth-staleness.js';
+/** Minimum Node major version this package requires (per @modelcontextprotocol/sdk engines). */
+const MIN_NODE_MAJOR = 18;
+const PROXY_ENV_KEYS = ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy', 'NO_PROXY', 'no_proxy'];
+const CLOCK_SKEW_WARN_MS = 5 * 60 * 1000;
+function errMsg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+// ── Individual checks ────────────────────────────────────
+export function checkNodeVersion(nodeVersion = process.version, minMajor = MIN_NODE_MAJOR) {
+    const match = /^v?(\d+)\./.exec(nodeVersion);
+    const major = match ? Number(match[1]) : NaN;
+    if (Number.isNaN(major)) {
+        return {
+            name: 'Node version',
+            status: 'WARN',
+            message: `Could not parse Node version string "${nodeVersion}".`,
+            hint: `aismemory requires Node >= ${minMajor}.`,
+        };
+    }
+    if (major < minMajor) {
+        return {
+            name: 'Node version',
+            status: 'FAIL',
+            message: `Node ${nodeVersion} is below the required minimum (>= ${minMajor}).`,
+            hint: `Upgrade Node (e.g. via nvm: "nvm install ${minMajor}") and retry.`,
+        };
+    }
+    return {
+        name: 'Node version',
+        status: 'PASS',
+        message: `Node ${nodeVersion} meets the minimum requirement (>= ${minMajor}).`,
+    };
+}
+export async function checkDnsResolution(host, lookup = dnsLookupDefault) {
+    try {
+        const { address } = await lookup(host);
+        return {
+            name: 'DNS resolution',
+            status: 'PASS',
+            message: `${host} resolves to ${address}.`,
+        };
+    }
+    catch (err) {
+        return {
+            name: 'DNS resolution',
+            status: 'FAIL',
+            message: `Could not resolve DNS for ${host}: ${errMsg(err)}.`,
+            hint: 'Check your internet connection and DNS settings (or /etc/resolv.conf).',
+        };
+    }
+}
+function defaultTlsProbe(host, port, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const socket = tlsConnectDefault({ host, port, servername: host, timeout: timeoutMs }, () => {
+            if (settled)
+                return;
+            settled = true;
+            socket.end();
+            resolve();
+        });
+        socket.on('error', (err) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(err);
+        });
+        socket.on('timeout', () => {
+            if (settled)
+                return;
+            settled = true;
+            socket.destroy();
+            reject(new Error(`connection to ${host}:${port} timed out after ${timeoutMs}ms`));
+        });
+    });
+}
+export async function checkTlsReachability(host, probe = defaultTlsProbe, port = 443, timeoutMs = 5000) {
+    try {
+        await probe(host, port, timeoutMs);
+        return {
+            name: 'TLS reachability',
+            status: 'PASS',
+            message: `${host}:${port} accepts TLS connections.`,
+        };
+    }
+    catch (err) {
+        return {
+            name: 'TLS reachability',
+            status: 'FAIL',
+            message: `Could not open a TLS connection to ${host}:${port}: ${errMsg(err)}.`,
+            hint: 'A firewall, VPN, or corporate proxy may be blocking outbound HTTPS. See the proxy check below.',
+        };
+    }
+}
+export async function checkRestHealth(baseUrl, fetchImpl = fetch) {
+    const url = `${baseUrl}/livez`;
+    try {
+        const res = await fetchImpl(url);
+        const dateHeader = res.headers.get('date') ?? undefined;
+        if (res.ok) {
+            return {
+                name: 'REST API health',
+                status: 'PASS',
+                message: `${url} responded HTTP ${res.status} (alive).`,
+                dateHeader,
+            };
+        }
+        return {
+            name: 'REST API health',
+            status: 'WARN',
+            message: `${url} responded HTTP ${res.status} — server reachable but reporting a problem.`,
+            hint: 'The AIS backend may be degraded. Check again shortly.',
+            dateHeader,
+        };
+    }
+    catch (err) {
+        return {
+            name: 'REST API health',
+            status: 'FAIL',
+            message: `Could not reach ${url}: ${errMsg(err)}.`,
+            hint: 'Check network connectivity — see the DNS/TLS checks above.',
+        };
+    }
+}
+export async function checkMcpEndpoint(baseUrl, fetchImpl = fetch) {
+    const url = `${baseUrl}/mcp`;
+    try {
+        const res = await fetchImpl(url);
+        // Any resolved HTTP response (even 401 "auth required") proves the MCP
+        // endpoint is reachable — only a network-level failure means "down".
+        const authNote = res.status === 401 || res.status === 403 ? ' (auth required, as expected without a key)' : '';
+        return {
+            name: 'MCP HTTP endpoint',
+            status: 'PASS',
+            message: `${url} responded HTTP ${res.status}${authNote}.`,
+        };
+    }
+    catch (err) {
+        return {
+            name: 'MCP HTTP endpoint',
+            status: 'FAIL',
+            message: `Could not reach ${url}: ${errMsg(err)}.`,
+            hint: 'Check network connectivity — see the DNS/TLS checks above.',
+        };
+    }
+}
+export async function checkCredentials(baseUrl, deps = {}) {
+    const load = deps.load ?? loadOAuthCredentials;
+    const now = deps.now ?? Date.now;
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const home = deps.home;
+    const path = credentialsFilePath(home);
+    const creds = load(home);
+    if (!creds) {
+        return {
+            name: 'Credentials',
+            status: 'WARN',
+            message: `No credentials found at ${path} — this device has not bonded to an agent yet.`,
+            hint: 'Run any aismemory tool from your MCP client once and follow the printed bond URL/code (takes ~30s).',
+        };
+    }
+    if (isCredsStale(creds.expiresAt, now())) {
+        return {
+            name: 'Credentials',
+            status: 'WARN',
+            message: `Credentials at ${path} are expired or expiring within 5 minutes (expiresAt: ${creds.expiresAt}).`,
+            hint: 'No action needed — the next tool call re-authenticates automatically (silently if a device key is enrolled).',
+        };
+    }
+    try {
+        const res = await fetchImpl(`${baseUrl}/v1/agents/${creds.agentId}`, {
+            headers: { Authorization: `Bearer ${creds.token}` },
+        });
+        if (res.ok) {
+            return {
+                name: 'Credentials',
+                status: 'PASS',
+                message: `Bonded as agent ${creds.agentId}; AIS accepted the saved token.`,
+            };
+        }
+        return {
+            name: 'Credentials',
+            status: 'WARN',
+            message: `Saved credentials found, but AIS returned HTTP ${res.status} for agent ${creds.agentId}.`,
+            hint: 'The token may be revoked or the agent archived. Re-run any aismemory tool to trigger re-authentication.',
+        };
+    }
+    catch (err) {
+        return {
+            name: 'Credentials',
+            status: 'FAIL',
+            message: `Could not verify saved credentials with AIS: ${errMsg(err)}.`,
+            hint: 'Check network connectivity — see the REST API health check above.',
+        };
+    }
+}
+export function checkProxyEnv(env = process.env) {
+    const set = PROXY_ENV_KEYS.filter((key) => Boolean(env[key]));
+    if (set.length === 0) {
+        return {
+            name: 'Proxy environment',
+            status: 'PASS',
+            message: 'No HTTP(S)_PROXY / NO_PROXY environment variables set.',
+        };
+    }
+    return {
+        name: 'Proxy environment',
+        status: 'WARN',
+        message: `Proxy environment variable(s) detected: ${set.join(', ')}.`,
+        hint: 'A corporate proxy can block or MITM TLS to ais.agentsandswarms.ai. If aismemory only fails on this network, ask IT to allowlist the host or trust the proxy CA.',
+    };
+}
+export function checkClockSkew(dateHeader, now = Date.now, warnThresholdMs = CLOCK_SKEW_WARN_MS) {
+    if (!dateHeader) {
+        return {
+            name: 'Clock skew',
+            status: 'WARN',
+            message: 'No server Date header available to compare (REST API health check did not return one).',
+        };
+    }
+    const remoteMs = Date.parse(dateHeader);
+    if (Number.isNaN(remoteMs)) {
+        return {
+            name: 'Clock skew',
+            status: 'WARN',
+            message: `Could not parse the server Date header: "${dateHeader}".`,
+        };
+    }
+    const skewMs = Math.abs(now() - remoteMs);
+    const skewMinutes = (skewMs / 60000).toFixed(1);
+    if (skewMs > warnThresholdMs) {
+        return {
+            name: 'Clock skew',
+            status: 'WARN',
+            message: `Local clock differs from the AIS server by ~${skewMinutes} minutes.`,
+            hint: 'Large clock skew can invalidate OAuth tokens. Sync your system clock (e.g. enable automatic time/NTP).',
+        };
+    }
+    return {
+        name: 'Clock skew',
+        status: 'PASS',
+        message: `Local clock is within ${skewMinutes} min of the AIS server.`,
+    };
+}
+export async function runDoctor(options = {}) {
+    const env = options.env ?? process.env;
+    const aisUrl = options.aisUrl ?? env['AIS_URL'] ?? 'https://ais.agentsandswarms.ai';
+    const host = new URL(aisUrl).hostname;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const now = options.now ?? Date.now;
+    const checks = [];
+    checks.push(checkNodeVersion(options.nodeVersion));
+    checks.push(await checkDnsResolution(host, options.dnsLookup));
+    checks.push(await checkTlsReachability(host, options.tlsProbe));
+    const health = await checkRestHealth(aisUrl, fetchImpl);
+    checks.push(health);
+    checks.push(await checkMcpEndpoint(aisUrl, fetchImpl));
+    checks.push(await checkCredentials(aisUrl, {
+        fetchImpl,
+        load: options.loadCreds,
+        home: options.home,
+        now,
+    }));
+    checks.push(checkProxyEnv(env));
+    checks.push(checkClockSkew(health.dateHeader, now));
+    const problemCount = checks.filter((c) => c.status !== 'PASS').length;
+    const hasFail = checks.some((c) => c.status === 'FAIL');
+    return {
+        aisUrl,
+        checks,
+        problemCount,
+        verdict: problemCount === 0 ? 'pass' : 'problems',
+        exitCode: hasFail ? 1 : 0,
+    };
+}
+// ── CLI formatting + entrypoint ──────────────────────────
+function formatText(report) {
+    const lines = [];
+    lines.push(`aismemory doctor — ${report.aisUrl}`);
+    lines.push('');
+    for (const c of report.checks) {
+        lines.push(`[${c.status}] ${c.name}: ${c.message}`);
+        if (c.hint && c.status !== 'PASS') {
+            lines.push(`       hint: ${c.hint}`);
+        }
+    }
+    lines.push('');
+    lines.push(report.problemCount === 0
+        ? 'doctor: all checks passed'
+        : `doctor: ${report.problemCount} problem(s) found`);
+    return lines.join('\n');
+}
+export async function main(argv = process.argv.slice(2)) {
+    const json = argv.includes('--json');
+    const report = await runDoctor();
+    if (json) {
+        process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    }
+    else {
+        process.stdout.write(`${formatText(report)}\n`);
+    }
+    process.exit(report.exitCode);
+}
+main().catch((err) => {
+    process.stderr.write(`[aismemory doctor] Fatal: ${errMsg(err)}\n`);
+    process.exit(1);
+});
+//# sourceMappingURL=doctor.js.map

package/dist/cli/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../src/cli/doctor.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAkB,MAAM,UAAU,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAyB,MAAM,yBAAyB,CAAC;AAC3G,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAqBpD,gGAAgG;AAChG,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AAE1G,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,4DAA4D;AAE5D,MAAM,UAAU,gBAAgB,CAC9B,cAAsB,OAAO,CAAC,OAAO,EACrC,WAAmB,cAAc;IAEjC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7C,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wCAAwC,WAAW,IAAI;YAChE,IAAI,EAAE,8BAA8B,QAAQ,GAAG;SAChD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,QAAQ,WAAW,sCAAsC,QAAQ,IAAI;YAC9E,IAAI,EAAE,4CAA4C,QAAQ,eAAe;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,cAAc;QACpB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,QAAQ,WAAW,sCAAsC,QAAQ,IAAI;KAC/E,CAAC;AACJ,CAAC;AAMD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAY,EACZ,SAAsB,gBAAgB;IAEtC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,IAAI,gBAAgB,OAAO,GAAG;SAC3C,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,6BAA6B,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG;YAC7D,IAAI,EAAE,wEAAwE;SAC/E,CAAC;IACJ,CAAC;AACH,CAAC;AAMD,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,SAAiB;IACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAc,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE;YACrG,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,IAAI,IAAI,IAAI,oBAAoB,SAAS,IAAI,CAAC,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAY,EACZ,QAAoB,eAAe,EACnC,IAAI,GAAG,GAAG,EACV,SAAS,GAAG,IAAI;IAEhB,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACnC,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,IAAI,IAAI,IAAI,2BAA2B;SACpD,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sCAAsC,IAAI,IAAI,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG;YAC9E,IAAI,EAAE,gGAAgG;SACvG,CAAC;IACJ,CAAC;AACH,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,YAAqB,KAAK;IAC/E,MAAM,GAAG,GAAG,GAAG,OAAO,QAAQ,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QACxD,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,GAAG,GAAG,mBAAmB,GAAG,CAAC,MAAM,WAAW;gBACvD,UAAU;aACX,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,GAAG,mBAAmB,GAAG,CAAC,MAAM,8CAA8C;YAC1F,IAAI,EAAE,uDAAuD;YAC7D,UAAU;SACX,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mBAAmB,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG;YAClD,IAAI,EAAE,4DAA4D;SACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,YAAqB,KAAK;IAChF,MAAM,GAAG,GAAG,GAAG,OAAO,MAAM,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;QACjC,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,6CAA6C,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/G,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,GAAG,mBAAmB,GAAG,CAAC,MAAM,GAAG,QAAQ,GAAG;SAC3D,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,mBAAmB,GAAG,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG;YAClD,IAAI,EAAE,4DAA4D;SACnE,CAAC;IACJ,CAAC;AACH,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAA6B,EAAE;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,oBAAoB,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAEvC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2BAA2B,IAAI,gDAAgD;YACxF,IAAI,EAAE,qGAAqG;SAC5G,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kBAAkB,IAAI,yDAAyD,KAAK,CAAC,SAAS,IAAI;YAC3G,IAAI,EAAE,8GAA8G;SACrH,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,OAAO,cAAc,KAAK,CAAC,OAAO,EAAE,EAAE;YACnE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE;SACpD,CAAC,CAAC;QACH,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,mBAAmB,KAAK,CAAC,OAAO,iCAAiC;aAC3E,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kDAAkD,GAAG,CAAC,MAAM,cAAc,KAAK,CAAC,OAAO,GAAG;YACnG,IAAI,EAAE,yGAAyG;SAChH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,gDAAgD,MAAM,CAAC,GAAG,CAAC,GAAG;YACvE,IAAI,EAAE,mEAAmE;SAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wDAAwD;SAClE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,mBAAmB;QACzB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,2CAA2C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACrE,IAAI,EAAE,iKAAiK;KACxK,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,UAA8B,EAC9B,MAAoB,IAAI,CAAC,GAAG,EAC5B,kBAA0B,kBAAkB;IAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wFAAwF;SAClG,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,4CAA4C,UAAU,IAAI;SACpE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,MAAM,GAAG,eAAe,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,+CAA+C,WAAW,WAAW;YAC9E,IAAI,EAAE,wGAAwG;SAC/G,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,yBAAyB,WAAW,yBAAyB;KACvE,CAAC;AACJ,CAAC;AAgBD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAyB,EAAE;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,gCAAgC,CAAC;IACpF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;IACtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAEpC,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,IAAI,CAAC,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,IAAI,CAAC,MAAM,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEhE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpB,MAAM,CAAC,IAAI,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;IACvD,MAAM,CAAC,IAAI,CACT,MAAM,gBAAgB,CAAC,MAAM,EAAE;QAC7B,SAAS;QACT,IAAI,EAAE,OAAO,CAAC,SAAS;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG;KACJ,CAAC,CACH,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAEpD,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACtE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAExD,OAAO;QACL,MAAM;QACN,MAAM;QACN,YAAY;QACZ,OAAO,EAAE,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU;QACjD,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,4DAA4D;AAE5D,SAAS,UAAU,CAAC,MAAoB;IACtC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,YAAY,KAAK,CAAC;QACvB,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,WAAW,MAAM,CAAC,YAAY,mBAAmB,CACtD,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}