aismemory 0.8.2 → 0.8.4

package/dist/cli/owner-credentials.js

@@ -0,0 +1,387 @@
+/**
+ * `aismemory rotate-token` and `aismemory api-keys list|create|revoke`
+ * (CORBOT-C206B318) — owner-side credential management for one agent — and
+ * `aismemory agents create` (CORBOT-F8BA698D) — new agents for the owner.
+ *
+ *   aismemory agents create <name...> [--description <text>]
+ *   aismemory rotate-token [--agent <id>]
+ *   aismemory api-keys list   [--agent <id>]
+ *   aismemory api-keys create [--agent <id>] [--name <label>] [--expires-in-days <n>] [--read-only]
+ *   aismemory api-keys revoke <key id> [--agent <id>]
+ *
+ * AIS routes (packages/agent-identity-service):
+ *   POST   /v1/agents/:id/rotate-token     -> { data: { bearerToken, expiresAt } }
+ *   GET    /v1/agents/:id/api-keys         -> { data: AgentApiKeyMetadata[] }
+ *   POST   /v1/agents/:id/api-keys         -> { data: { id, key, keyPrefix, ... } } (201)
+ *   DELETE /v1/agents/:id/api-keys/:keyId  -> { data: { revoked: true } }
+ *   POST   /v1/agents                      -> { data: { id, name, claimUrl, ... } } (201)
+ *
+ * Creating an agent mints no bond (CORBOT-0D97FEEF): each new agent comes
+ * back with its own claim link, and the owner bonds each by opening it. One
+ * approval for a whole batch would change that ceremony (CORBOT-4F41A5B7).
+ *
+ * All four need the OWNER session: the service refuses an agent credential
+ * (bonded pass, agent token, agent API key, workspace key). The owner session
+ * here is the one `aismemory enable-key-auth` enrolled on this device; the
+ * short-lived owner token is fetched per run and held in memory only.
+ *
+ * Secret handling: the only secrets that are ever printed are the newly
+ * created key and the rotated token, once, on stdout, with a store-it-now note
+ * on stderr. Nothing is written to disk (the CLI authenticates with the
+ * device key, not with the token that rotate-token returns, so there is no
+ * stored credential to update). List output carries non-secret fields only.
+ * Error messages never include request bodies, headers, or the owner token.
+ */
+import { DEFAULT_AIS_URL } from '../ais-http.js';
+import { extractServerMessage } from '../ais-http-error.js';
+import { decodeEnrollmentClaims, tryKeyAuth } from '../key-auth.js';
+export class OwnerCredentialsError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'OwnerCredentialsError';
+    }
+}
+const MAX_KEY_DAYS = 90;
+const MAX_AGENTS_PER_RUN = 20;
+const ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+const USAGE = `aismemory agents / rotate-token / api-keys — create agents and manage their credentials (owner only)
+
+Usage:
+  aismemory agents create <name...> [--description <text>]
+  aismemory rotate-token [--agent <id>]
+  aismemory api-keys list [--agent <id>]
+  aismemory api-keys create [--agent <id>] [--name <label>] [--expires-in-days <n>] [--read-only]
+  aismemory api-keys revoke <key id> [--agent <id>]
+
+Options:
+  --description <text>     Description for every agent created in this run.
+  --agent <id>             The agent (default: AIS_AGENT_ID).
+  --name <label>           Label for the new key (at most 64 characters, no URLs).
+  --expires-in-days <n>    Key lifetime in days, 1-${MAX_KEY_DAYS} (default ${MAX_KEY_DAYS}).
+  --read-only              The new key may only read.
+  --help, -h               Show this message.
+
+These commands need the owner sign-in of the agent's owner: run
+\`aismemory enable-key-auth\` once on this machine. An agent credential
+(AIS_API_KEY, AIS_WORKSPACE_KEY, a run pass or an agent token) is refused by
+the service. A new key or rotated token is printed once and never again.
+agents create makes up to ${MAX_AGENTS_PER_RUN} agents owned by you and prints a claim
+link for each: open each link to bond that agent to you.
+`;
+function takeValue(rest, i, flag) {
+    const value = rest[i + 1];
+    if (value === undefined || value.startsWith('--')) {
+        throw new OwnerCredentialsError(`${flag} needs a value. Run aismemory ${flag === '--agent' ? 'rotate-token' : flag === '--description' ? 'agents' : 'api-keys'} --help.`);
+    }
+    return value;
+}
+function validId(value, what) {
+    if (!ID_PATTERN.test(value)) {
+        throw new OwnerCredentialsError(`${what} must contain only letters, digits, underscores or hyphens.`);
+    }
+    return value;
+}
+function parseAgentsArgs(argv) {
+    if (argv[0] !== 'create') {
+        throw new OwnerCredentialsError('Unknown agents command. Use: aismemory agents create <name...>.');
+    }
+    const names = [];
+    let description;
+    const rest = argv.slice(1);
+    for (let i = 0; i < rest.length; i++) {
+        const arg = rest[i];
+        if (arg === '--help' || arg === '-h')
+            return { kind: 'help' };
+        if (arg === '--description') {
+            description = takeValue(rest, i, arg);
+            i++;
+        }
+        else if (arg.startsWith('-')) {
+            throw new OwnerCredentialsError(`Unknown option: ${arg}. Run aismemory agents --help.`);
+        }
+        else {
+            names.push(arg.trim());
+        }
+    }
+    if (names.length === 0)
+        throw new OwnerCredentialsError('Name at least one agent: aismemory agents create <name...>.');
+    if (names.length > MAX_AGENTS_PER_RUN)
+        throw new OwnerCredentialsError(`At most ${MAX_AGENTS_PER_RUN} agents per run.`);
+    const seen = new Set();
+    for (const name of names) {
+        if (name === '')
+            throw new OwnerCredentialsError('Agent names cannot be empty.');
+        const key = name.toLowerCase();
+        if (seen.has(key))
+            throw new OwnerCredentialsError(`The name ${safeText(name)} is given twice.`);
+        seen.add(key);
+    }
+    return { kind: 'agents-create', names, ...(description === undefined ? {} : { description }) };
+}
+export function parseOwnerArgs(command, argv, env) {
+    const first = argv[0];
+    if (first === '--help' || first === '-h' || ((command === 'api-keys' || command === 'agents') && first === undefined)) {
+        return { kind: 'help' };
+    }
+    if (command === 'agents')
+        return parseAgentsArgs(argv);
+    let sub;
+    let rest;
+    if (command === 'rotate-token') {
+        sub = 'rotate';
+        rest = argv;
+    }
+    else if (first === 'list' || first === 'create' || first === 'revoke') {
+        sub = first;
+        rest = argv.slice(1);
+    }
+    else {
+        throw new OwnerCredentialsError(`Unknown api-keys command: ${String(first).startsWith('-') ? first : '(unrecognised)'}. Use list, create or revoke.`);
+    }
+    let agent;
+    let name;
+    let days;
+    let readOnly = false;
+    let keyId;
+    for (let i = 0; i < rest.length; i++) {
+        const arg = rest[i];
+        if (arg === '--help' || arg === '-h')
+            return { kind: 'help' };
+        if (arg === '--agent') {
+            agent = takeValue(rest, i, arg);
+            i++;
+        }
+        else if (sub === 'create' && arg === '--name') {
+            name = takeValue(rest, i, arg);
+            i++;
+        }
+        else if (sub === 'create' && arg === '--expires-in-days') {
+            const raw = takeValue(rest, i, arg);
+            i++;
+            days = Number(raw);
+            if (!Number.isInteger(days) || days < 1 || days > MAX_KEY_DAYS) {
+                throw new OwnerCredentialsError(`--expires-in-days must be a whole number from 1 to ${MAX_KEY_DAYS}.`);
+            }
+        }
+        else if (sub === 'create' && arg === '--read-only') {
+            readOnly = true;
+        }
+        else if (sub === 'revoke' && keyId === undefined && !arg.startsWith('-')) {
+            keyId = arg;
+        }
+        else {
+            throw new OwnerCredentialsError(`Unknown option: ${arg.startsWith('-') ? arg : '(positional argument)'}. Run aismemory ${command} --help.`);
+        }
+    }
+    const agentRaw = (agent ?? env['AIS_AGENT_ID'] ?? '').trim();
+    if (agentRaw === '')
+        throw new OwnerCredentialsError('Name the agent: pass --agent <id> or set AIS_AGENT_ID.');
+    const agentId = validId(agentRaw, 'The agent id');
+    switch (sub) {
+        case 'rotate':
+            return { kind: 'rotate', agentId };
+        case 'list':
+            return { kind: 'list', agentId };
+        case 'create':
+            return { kind: 'create', agentId, ...(name === undefined ? {} : { name }), ...(days === undefined ? {} : { expiresInDays: days }), readOnly };
+        case 'revoke':
+            if (keyId === undefined)
+                throw new OwnerCredentialsError('revoke needs the key id: aismemory api-keys revoke <key id>.');
+            return { kind: 'revoke', agentId, keyId: validId(keyId, 'The key id') };
+    }
+}
+function asRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value) ? value : {};
+}
+function str(source, key) {
+    const v = source[key];
+    return typeof v === 'string' ? v : undefined;
+}
+/** One request with the owner token. Failures name the status and the server's own message only. */
+async function ownerRequest(deps, aisUrl, token, method, path, body) {
+    const headers = { Authorization: `Bearer ${token}` };
+    if (body !== undefined)
+        headers['Content-Type'] = 'application/json';
+    let res;
+    try {
+        res = await deps.fetchImpl(`${aisUrl}${path}`, {
+            method,
+            headers,
+            ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        });
+    }
+    catch {
+        throw new OwnerCredentialsError(`Could not reach the service at ${aisUrl}. Check AIS_URL and your network.`);
+    }
+    const parsed = await res.json().catch(() => null);
+    if (!res.ok) {
+        const code = str(asRecord(asRecord(parsed)['error']), 'code');
+        if (res.status === 401) {
+            throw new OwnerCredentialsError('The service did not accept the owner sign-in (HTTP 401). Run aismemory enable-key-auth again.');
+        }
+        if (code === 'INTERACTIVE_OWNER_REQUIRED' || code === 'OWNER_SESSION_REQUIRED') {
+            throw new OwnerCredentialsError('This needs the interactive owner sign-in, not an agent or service credential (HTTP 403). Run aismemory enable-key-auth.');
+        }
+        if (code === 'OWNER_ID_MISMATCH') {
+            throw new OwnerCredentialsError('In a workspace with more than one person, an agent you create must be owned by you (HTTP 403 OWNER_ID_MISMATCH).');
+        }
+        if (code === 'OWNER_CHECK_UNAVAILABLE') {
+            throw new OwnerCredentialsError('The service could not check who may own the agent (HTTP 403 OWNER_CHECK_UNAVAILABLE). Try again later.');
+        }
+        if (res.status === 403) {
+            throw new OwnerCredentialsError('You do not own this agent (HTTP 403).');
+        }
+        const raw = extractServerMessage(parsed);
+        const detail = raw === null ? null : safeText(raw);
+        throw new OwnerCredentialsError(`The service refused the request (HTTP ${res.status})${detail === null ? '' : `: ${detail}`}.`);
+    }
+    return asRecord(parsed);
+}
+// Server text reaches the terminal: drop control characters (escape sequences) and cap the length.
+function safeText(value) {
+    const clean = value.replace(/[\u0000-\u001f\u007f-\u009f\u200b-\u200f\u202a-\u202e\u2066-\u2069\ufeff]/g, '');
+    return clean.length > 200 ? `${clean.slice(0, 200)}…` : clean;
+}
+function field(value) {
+    if (value === null || value === undefined)
+        return '-';
+    return typeof value === 'boolean' ? (value ? 'yes' : 'no') : safeText(value);
+}
+const NEVER_AGAIN = 'Store it now: it will not be shown again.';
+export async function runOwnerCommand(command, argv, deps) {
+    const action = parseOwnerArgs(command, argv, deps.env);
+    if (action.kind === 'help') {
+        deps.stdout(USAGE);
+        return;
+    }
+    const aisUrl = (deps.env['AIS_URL']?.trim() || DEFAULT_AIS_URL).replace(/\/+$/, '');
+    const session = await deps.getOwnerSession(aisUrl);
+    if (session === null) {
+        const hasAgentCredential = ['AIS_API_KEY', 'AIS_AGENT_API_KEY', 'AIS_WORKSPACE_KEY', 'AIS_RUN_PASS_FILE'].some((name) => (deps.env[name] ?? '').trim() !== '');
+        throw new OwnerCredentialsError('No owner sign-in on this machine. ' +
+            (hasAgentCredential ? 'The agent credential in your environment cannot do this. ' : '') +
+            'Run aismemory enable-key-auth once as the agent\'s owner, then try again.');
+    }
+    const token = session.token;
+    if (action.kind === 'agents-create') {
+        await createAgents(deps, aisUrl, session, action.names, action.description);
+        return;
+    }
+    const base = `/v1/agents/${encodeURIComponent(action.agentId)}`;
+    switch (action.kind) {
+        case 'rotate': {
+            const data = asRecord((await ownerRequest(deps, aisUrl, token, 'POST', `${base}/rotate-token`))['data']);
+            const bearerToken = str(data, 'bearerToken');
+            if (bearerToken === undefined)
+                throw new OwnerCredentialsError('The service reply had no token.');
+            deps.stderr(`New bearer token for agent ${action.agentId} (expires ${field(str(data, 'expiresAt'))}). ${NEVER_AGAIN} Tokens issued earlier stay valid until they expire.\n`);
+            deps.stdout(`${bearerToken}\n`);
+            return;
+        }
+        case 'list': {
+            const raw = (await ownerRequest(deps, aisUrl, token, 'GET', `${base}/api-keys`))['data'];
+            const keys = Array.isArray(raw) ? raw.map(asRecord) : [];
+            if (keys.length === 0) {
+                deps.stdout('No API keys for this agent.\n');
+                return;
+            }
+            const lines = keys.map((k) => {
+                const flags = k['readOnly'] === true ? ' read-only' : '';
+                const revoked = str(k, 'revokedAt');
+                return [
+                    field(str(k, 'id')),
+                    field(str(k, 'keyPrefix')),
+                    `name=${field(str(k, 'name'))}`,
+                    `created=${field(str(k, 'createdAt'))}`,
+                    `expires=${field(str(k, 'expiresAt'))}`,
+                    `lastUsed=${field(str(k, 'lastUsedAt'))}`,
+                    revoked === undefined ? 'active' : `revoked=${revoked}`,
+                ].join('  ') + flags;
+            });
+            deps.stdout(`${lines.join('\n')}\n`);
+            return;
+        }
+        case 'create': {
+            const body = {};
+            if (action.name !== undefined)
+                body['name'] = action.name;
+            if (action.expiresInDays !== undefined)
+                body['expiresIn'] = Math.round(action.expiresInDays * 86400);
+            if (action.readOnly)
+                body['readOnly'] = true;
+            const data = asRecord((await ownerRequest(deps, aisUrl, token, 'POST', `${base}/api-keys`, body))['data']);
+            const key = str(data, 'key');
+            if (key === undefined)
+                throw new OwnerCredentialsError('The service reply had no key. Run aismemory api-keys list and revoke any key you do not recognise.');
+            deps.stderr(`Created API key ${field(str(data, 'id'))} (expires ${field(str(data, 'expiresAt'))}). ${NEVER_AGAIN}\n`);
+            deps.stdout(`${key}\n`);
+            return;
+        }
+        case 'revoke': {
+            await ownerRequest(deps, aisUrl, token, 'DELETE', `${base}/api-keys/${encodeURIComponent(action.keyId)}`);
+            deps.stdout(`Revoked API key ${action.keyId}.\n`);
+            return;
+        }
+    }
+}
+/**
+ * One POST per name, in order, owned by the signed-in human. Stops at the
+ * first refusal so a quota or owner error is not repeated N times; agents
+ * already created are listed first so their claim links are not lost.
+ */
+async function createAgents(deps, aisUrl, session, names, description) {
+    let created = 0;
+    for (const name of names) {
+        const body = { name, ownerId: session.userId };
+        if (description !== undefined)
+            body['description'] = description;
+        let data;
+        try {
+            data = asRecord((await ownerRequest(deps, aisUrl, session.token, 'POST', '/v1/agents', body))['data']);
+        }
+        catch (err) {
+            if (created > 0)
+                deps.stderr(`Created ${created} of ${names.length} agents before this failure; open the claim links above to bond them.\n`);
+            throw new OwnerCredentialsError(`Creating ${safeText(name)}: ${err instanceof Error ? err.message : 'unknown error'}`);
+        }
+        created++;
+        if (str(data, 'claimUrl') === undefined) {
+            deps.stderr(`The service returned no claim link for ${safeText(name)}; bond it from the console.\n`);
+        }
+        deps.stdout(`${field(str(data, 'name') ?? name)}  ${field(str(data, 'id'))}  ${field(str(data, 'claimUrl'))}\n`);
+    }
+    deps.stderr(`Created ${created} agent${created === 1 ? '' : 's'}. Open each claim link to bond that agent to you; until then it cannot keep memories.\n`);
+}
+/**
+ * The user id comes from the token the service signed, not from the local key
+ * file: a copied or edited key file must not set another person as owner.
+ */
+export function ownerSessionFromCreds(creds) {
+    const signedUserId = decodeEnrollmentClaims(creds.token)?.userId;
+    if (signedUserId === undefined || signedUserId !== creds.userId) {
+        throw new OwnerCredentialsError('This device\'s key file and the owner sign-in name different users. Run aismemory enable-key-auth again.');
+    }
+    return { token: creds.token, userId: signedUserId };
+}
+async function ownerSessionFromDeviceKey(aisUrl) {
+    const creds = await tryKeyAuth({ aisUrl });
+    return creds === null ? null : ownerSessionFromCreds(creds);
+}
+/** Entry from `aismemory rotate-token|api-keys|agents ...`: one failure line, exit 1. */
+export async function runFromCli(command, argv) {
+    try {
+        await runOwnerCommand(command, argv, {
+            env: process.env,
+            fetchImpl: fetch,
+            getOwnerSession: ownerSessionFromDeviceKey,
+            stdout: (text) => { process.stdout.write(text); },
+            stderr: (text) => { process.stderr.write(text); },
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : 'unknown error';
+        process.stderr.write(`[aismemory ${command}] Failed: ${message}\n`);
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=owner-credentials.js.map

package/dist/cli/owner-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-credentials.js","sourceRoot":"","sources":["../../src/cli/owner-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AA2BpE,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,MAAM,KAAK,GAAG;;;;;;;;;;;;;qDAauC,YAAY,aAAa,YAAY;;;;;;;;4BAQ9D,kBAAkB;;CAE7C,CAAC;AAEF,SAAS,SAAS,CAAC,IAAc,EAAE,CAAS,EAAE,IAAY;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,qBAAqB,CAAC,GAAG,IAAI,iCAAiC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,UAAU,CAAC,CAAC;IAC5K,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,KAAa,EAAE,IAAY;IAC1C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,qBAAqB,CAAC,GAAG,IAAI,6DAA6D,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,IAAc;IACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,qBAAqB,CAAC,iEAAiE,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,WAA+B,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC9B,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9D,IAAI,GAAG,KAAK,eAAe,EAAE,CAAC;YAC5B,WAAW,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YACtC,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,GAAG,gCAAgC,CAAC,CAAC;QAC1F,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,qBAAqB,CAAC,6DAA6D,CAAC,CAAC;IACvH,IAAI,KAAK,CAAC,MAAM,GAAG,kBAAkB;QAAE,MAAM,IAAI,qBAAqB,CAAC,WAAW,kBAAkB,kBAAkB,CAAC,CAAC;IACxH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,EAAE;YAAE,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,qBAAqB,CAAC,YAAY,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAqB,EAAE,IAAc,EAAE,GAAsB;IAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,UAAU,IAAI,OAAO,KAAK,QAAQ,CAAC,IAAI,KAAK,KAAK,SAAS,CAAC,EAAE,CAAC;QACtH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,GAA4C,CAAC;IACjD,IAAI,IAAc,CAAC;IACnB,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;QAC/B,GAAG,GAAG,QAAQ,CAAC;QACf,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;SAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxE,GAAG,GAAG,KAAK,CAAC;QACZ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,qBAAqB,CAAC,6BAA6B,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,+BAA+B,CAAC,CAAC;IACxJ,CAAC;IAED,IAAI,KAAyB,CAAC;IAC9B,IAAI,IAAwB,CAAC;IAC7B,IAAI,IAAwB,CAAC;IAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,KAAyB,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC9B,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YAChC,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YAChD,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,mBAAmB,EAAE,CAAC;YAC3D,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;YACpC,CAAC,EAAE,CAAC;YACJ,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;gBAC/D,MAAM,IAAI,qBAAqB,CAAC,sDAAsD,YAAY,GAAG,CAAC,CAAC;YACzG,CAAC;QACH,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YACrD,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;aAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3E,KAAK,GAAG,GAAG,CAAC;QACd,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,qBAAqB,CAAC,mBAAmB,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,uBAAuB,mBAAmB,OAAO,UAAU,CAAC,CAAC;QAC9I,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,IAAI,QAAQ,KAAK,EAAE;QAAE,MAAM,IAAI,qBAAqB,CAAC,wDAAwD,CAAC,CAAC;IAC/G,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAClD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACrC,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACnC,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;QAChJ,KAAK,QAAQ;YACX,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,qBAAqB,CAAC,8DAA8D,CAAC,CAAC;YACzH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxH,CAAC;AAED,SAAS,GAAG,CAAC,MAA+B,EAAE,GAAW;IACvD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,MAAc,EACd,KAAa,EACb,MAAiC,EACjC,IAAY,EACZ,IAA8B;IAE9B,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;IAC7E,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IACrE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,IAAI,EAAE,EAAE;YAC7C,MAAM;YACN,OAAO;YACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,qBAAqB,CAAC,kCAAkC,MAAM,mCAAmC,CAAC,CAAC;IAC/G,CAAC;IACD,MAAM,MAAM,GAAY,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAY,EAAE,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,qBAAqB,CAAC,+FAA+F,CAAC,CAAC;QACnI,CAAC;QACD,IAAI,IAAI,KAAK,4BAA4B,IAAI,IAAI,KAAK,wBAAwB,EAAE,CAAC;YAC/E,MAAM,IAAI,qBAAqB,CAAC,yHAAyH,CAAC,CAAC;QAC7J,CAAC;QACD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACjC,MAAM,IAAI,qBAAqB,CAAC,kHAAkH,CAAC,CAAC;QACtJ,CAAC;QACD,IAAI,IAAI,KAAK,yBAAyB,EAAE,CAAC;YACvC,MAAM,IAAI,qBAAqB,CAAC,wGAAwG,CAAC,CAAC;QAC5I,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,MAAM,IAAI,qBAAqB,CAAC,uCAAuC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,IAAI,qBAAqB,CAAC,yCAAyC,GAAG,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,GAAG,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,mGAAmG;AACnG,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,4EAA4E,EAAE,EAAE,CAAC,CAAC;IAC9G,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAChE,CAAC;AAED,SAAS,KAAK,CAAC,KAA0C;IACvD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACtD,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,WAAW,GAAG,2CAA2C,CAAC;AAEhE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAqB,EAAE,IAAc,EAAE,IAA0B;IACrG,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,kBAAkB,GAAG,CAAC,aAAa,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,IAAI,CAC5G,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAC/C,CAAC;QACF,MAAM,IAAI,qBAAqB,CAC7B,oCAAoC;YAClC,CAAC,kBAAkB,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;QACpC,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5E,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IAEhE,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YACzG,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;YAC7C,IAAI,WAAW,KAAK,SAAS;gBAAE,MAAM,IAAI,qBAAqB,CAAC,iCAAiC,CAAC,CAAC;YAClG,IAAI,CAAC,MAAM,CAAC,8BAA8B,MAAM,CAAC,OAAO,aAAa,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,MAAM,WAAW,wDAAwD,CAAC,CAAC;YAC7K,IAAI,CAAC,MAAM,CAAC,GAAG,WAAW,IAAI,CAAC,CAAC;YAChC,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,GAAG,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACzF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzD,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;gBACpC,OAAO;oBACL,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;oBACnB,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;oBAC1B,QAAQ,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE;oBAC/B,WAAW,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE;oBACvC,WAAW,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,EAAE;oBACvC,YAAY,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE;oBACzC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE;iBACxD,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACvB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,IAAI,GAA4B,EAAE,CAAC;YACzC,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;YAC1D,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;gBAAE,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,GAAG,KAAK,CAAC,CAAC;YACrG,IAAI,MAAM,CAAC,QAAQ;gBAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;YAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3G,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAC7B,IAAI,GAAG,KAAK,SAAS;gBAAE,MAAM,IAAI,qBAAqB,CAAC,oGAAoG,CAAC,CAAC;YAC7J,IAAI,CAAC,MAAM,CAAC,mBAAmB,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,aAAa,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,MAAM,WAAW,IAAI,CAAC,CAAC;YACtH,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,aAAa,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1G,IAAI,CAAC,MAAM,CAAC,mBAAmB,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CACzB,IAA0B,EAC1B,MAAc,EACd,OAAqB,EACrB,KAAe,EACf,WAA+B;IAE/B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAA4B,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QACxE,IAAI,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,aAAa,CAAC,GAAG,WAAW,CAAC;QACjE,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,QAAQ,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACzG,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,OAAO,GAAG,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,WAAW,OAAO,OAAO,KAAK,CAAC,MAAM,yEAAyE,CAAC,CAAC;YAC7I,MAAM,IAAI,qBAAqB,CAAC,YAAY,QAAQ,CAAC,IAAI,CAAC,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QACzH,CAAC;QACD,OAAO,EAAE,CAAC;QACV,IAAI,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,0CAA0C,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,WAAW,OAAO,SAAS,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,yFAAyF,CAAC,CAAC;AAC5J,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAwC;IAC5E,MAAM,YAAY,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACjE,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QAChE,MAAM,IAAI,qBAAqB,CAAC,0GAA0G,CAAC,CAAC;IAC9I,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,MAAc;IACrD,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3C,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAAqB,EAAE,IAAc;IACpE,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE;YACnC,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,KAAK;YAChB,eAAe,EAAE,yBAAyB;YAC1C,MAAM,EAAE,CAAC,IAAY,EAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC/D,MAAM,EAAE,CAAC,IAAY,EAAQ,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;QACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,OAAO,aAAa,OAAO,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/cli/sync-memory.js

@@ -5,6 +5,7 @@ import { createInterface } from 'node:readline/promises';
 import { runIngestion } from '../pipeline/ingestion.js';
 import { loadExistingHashes } from '../pipeline/existing-hashes.js';
 import { bulkStoreViaAis, singleWriteAllViaAis } from '../pipeline/bulk-store.js';
+import { resolveSyncCreds } from '../pipeline/sync-auth.js';
 import { LocalClaudeSource } from '../sources/local-claude.js';
 import { SyncConfig } from '../config.js';
 import { TrustLedger } from '../trust-ledger.js';
@@ -101,25 +102,22 @@ async function main() {
             scopeLabel: scope.label,
             firstSyncForScope,
         });
-    const apiKey = process.env['AIS_SERVICE_KEY'] ?? process.env['AIS_API_KEY'];
-    const tenantId = process.env['AIS_TENANT_ID'];
-    const apiBase = process.env['AIS_DOMAIN']
-        ? `https://${process.env['AIS_DOMAIN']}`
-        : 'https://ais.agentsandswarms.ai';
+    const creds = await resolveSyncCreds(process.env);
     const bulkStore = args.dryRun
         ? async (drafts) => ({
             created: drafts.map((_, i) => ({ index: i, id: `dry-run-${i}` })),
             failed: [],
         })
         : (() => {
-            if (!apiKey || !tenantId)
-                throw new Error('AIS_API_KEY and AIS_TENANT_ID must be set');
-            const creds = { apiBase, apiKey, tenantId };
+            if (!creds) {
+                throw new Error('no AIS credential: set AIS_WORKSPACE_KEY, AIS_AGENT_API_KEY or AIS_RUN_PASS_FILE (as for the MCP server), ' +
+                    'or AIS_API_KEY and AIS_TENANT_ID');
+            }
             return args.singleWrite
                 ? (drafts) => singleWriteAllViaAis(agentId, drafts, creds)
                 : (drafts) => bulkStoreViaAis(agentId, drafts, creds);
         })();
-    const existingHashes = await loadExistingHashes(agentId, mirror, apiKey && tenantId ? { apiBase, apiKey, tenantId } : undefined);
+    const existingHashes = await loadExistingHashes(agentId, mirror, creds ?? undefined);
     const result = await runIngestion({
         adapter,
         rawSourceData,

package/dist/cli/sync-memory.js.map

@@ -1 +1 @@
-{"version":3,"file":"sync-memory.js","sourceRoot":"","sources":["../../src/cli/sync-memory.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAapE,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAY;QACpB,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,KAAK;KACnB,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAE,CAAC;QAC3B,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,EAAE,KAAK,cAAc;QAAE,OAAO,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAEjF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAE3D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEvD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK;QACtB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QACpD,CAAC,CAAC,MAAM,YAAY,CAAC;YACjB,MAAM;YACN,WAAW;YACX,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,SAAS,EACP,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK;gBACnC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;oBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mBAAmB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAChG,CAAC;oBACF,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC7E,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,CACb,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC,CAChE;6BACE,IAAI,EAAE;6BACN,WAAW,EAAE,CAAC;wBACjB,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,CAAC;4BAC1C,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;wBACJ,CAAC;wBACD,OAAO,CAAC,CAAC;oBACX,CAAC;4BAAS,CAAC;wBACT,EAAE,CAAC,KAAK,EAAE,CAAC;oBACb,CAAC;gBACH,CAAC;gBACH,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACpB,aAAa,EAAE,IAAI,CAAC,SAAS;SAC9B,CAAC,CAAC;IAEP,MAAM,QAAQ,GAAG;QACf,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,MAAM,IAAI,EAAE;QAClB,KAAK,CAAC,WAAW,IAAI,EAAE;QACvB,KAAK,CAAC,KAAK;KACZ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,KAAK,EAAE,MAAwB,EAA6B,EAAE,CAC3E,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS;QAC3B,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE;YACxB,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,UAAU,EAAE,KAAK,CAAC,KAAK;YACvB,iBAAiB;SAClB,CAAC,CAAC;IAET,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACvC,CAAC,CAAC,WAAW,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE;QACxC,CAAC,CAAC,gCAAgC,CAAC;IAErC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM;QAC3B,CAAC,CAAC,KAAK,EAAE,MAAwB,EAAE,EAAE,CAAC,CAAC;YACnC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM,EAAE,EAA6C;SACtD,CAAC;QACJ,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;YACvF,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,WAAW;gBACrB,CAAC,CAAC,CAAC,MAAwB,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;gBAC5E,CAAC,CAAC,CAAC,MAAwB,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAC7C,OAAO,EACP,MAAM,EACN,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAC/D,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,OAAO;QACP,aAAa;QACb,KAAK;QACL,OAAO;QACP,MAAM;QACN,MAAM;QACN,MAAM;QACN,cAAc;QACd,SAAS;QACT,MAAM;KACP,CAAC,CAAC;IAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC;IACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACrE,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"sync-memory.js","sourceRoot":"","sources":["../../src/cli/sync-memory.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAapE,SAAS,SAAS,CAAC,IAAc;IAC/B,MAAM,IAAI,GAAY;QACpB,MAAM,EAAE,cAAc;QACtB,MAAM,EAAE,KAAK;QACb,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,KAAK;KACnB,CAAC;IACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAE,CAAC;QAC3B,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;YACtC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;aAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;YACxC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CAAC,EAAU;IAC5B,IAAI,EAAE,KAAK,cAAc;QAAE,OAAO,IAAI,iBAAiB,EAAE,CAAC;IAC1D,MAAM,IAAI,KAAK,CAAC,mBAAmB,EAAE,yCAAyC,CAAC,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAEjF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAE3D,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEvD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK;QACtB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAqB,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;QACpD,CAAC,CAAC,MAAM,YAAY,CAAC;YACjB,MAAM;YACN,WAAW;YACX,UAAU,EAAE,IAAI;YAChB,YAAY,EAAE,IAAI;YAClB,SAAS,EACP,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK;gBACnC,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;oBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mBAAmB,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAChG,CAAC;oBACF,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC7E,IAAI,CAAC;wBACH,MAAM,MAAM,GAAG,CACb,MAAM,EAAE,CAAC,QAAQ,CAAC,4CAA4C,CAAC,CAChE;6BACE,IAAI,EAAE;6BACN,WAAW,EAAE,CAAC;wBACjB,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE,CAAC;4BAC1C,MAAM,IAAI,KAAK,CACb,kFAAkF,CACnF,CAAC;wBACJ,CAAC;wBACD,OAAO,CAAC,CAAC;oBACX,CAAC;4BAAS,CAAC;wBACT,EAAE,CAAC,KAAK,EAAE,CAAC;oBACb,CAAC;gBACH,CAAC;gBACH,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACpB,aAAa,EAAE,IAAI,CAAC,SAAS;SAC9B,CAAC,CAAC;IAEP,MAAM,QAAQ,GAAG;QACf,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,MAAM,IAAI,EAAE;QAClB,KAAK,CAAC,WAAW,IAAI,EAAE;QACvB,KAAK,CAAC,KAAK;KACZ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACZ,MAAM,iBAAiB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,KAAK,EAAE,MAAwB,EAA6B,EAAE,CAC3E,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS;QAC3B,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC;QACvB,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE;YACxB,QAAQ,EAAE,OAAO,CAAC,EAAE;YACpB,UAAU,EAAE,KAAK,CAAC,KAAK;YACvB,iBAAiB;SAClB,CAAC,CAAC;IAET,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAElD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM;QAC3B,CAAC,CAAC,KAAK,EAAE,MAAwB,EAAE,EAAE,CAAC,CAAC;YACnC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;YACjE,MAAM,EAAE,EAA6C;SACtD,CAAC;QACJ,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACb,4GAA4G;oBAC1G,kCAAkC,CACrC,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC,WAAW;gBACrB,CAAC,CAAC,CAAC,MAAwB,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;gBAC5E,CAAC,CAAC,CAAC,MAAwB,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,SAAS,CAAC,CAAC;IAErF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;QAChC,OAAO;QACP,aAAa;QACb,KAAK;QACL,OAAO;QACP,MAAM;QACN,MAAM;QACN,MAAM;QACN,cAAc;QACd,SAAS;QACT,MAAM;KACP,CAAC,CAAC;IAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC;IACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,gBAAgB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CACrE,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/cli-info.d.ts

@@ -0,0 +1,18 @@
+/**
+ * CORBOT-AF282BD7: `--help` / `--version` must print and exit before any
+ * credential or server code runs. Pure helpers so they are testable without
+ * starting the MCP server.
+ */
+/**
+ * CORBOT-73753A98: shown to a person who runs `npx aismemory` in a terminal
+ * (stdin is a TTY). MCP clients launch the server with piped stdin, so they
+ * never see this.
+ */
+export declare const HUMAN_HOWTO_TEXT: string;
+export declare const USAGE_TEXT: string;
+/**
+ * Returns the text to print for a help or version request, or null when the
+ * arguments are not one. Only the first argument counts, so subcommand flags
+ * (e.g. `aismemory sync --help`) still reach their own handlers.
+ */
+export declare function resolveInfoRequest(args: readonly string[], version: string): string | null;

package/dist/cli-info.js

@@ -0,0 +1,77 @@
+/**
+ * CORBOT-AF282BD7: `--help` / `--version` must print and exit before any
+ * credential or server code runs. Pure helpers so they are testable without
+ * starting the MCP server.
+ */
+const HUMAN_MCP_CONFIG = [
+    '  {',
+    '    "mcpServers": {',
+    '      "aismemory": {',
+    '        "command": "npx",',
+    '        "args": ["aismemory"]',
+    '      }',
+    '    }',
+    '  }',
+].join('\n');
+/**
+ * CORBOT-73753A98: shown to a person who runs `npx aismemory` in a terminal
+ * (stdin is a TTY). MCP clients launch the server with piped stdin, so they
+ * never see this.
+ */
+export const HUMAN_HOWTO_TEXT = [
+    'aismemory - persistent memory for your AI agents.',
+    '',
+    'This is an MCP server: your AI client starts it, you do not run it by hand.',
+    'Add this to your client\'s MCP server config:',
+    '',
+    HUMAN_MCP_CONFIG,
+    '',
+    'The first time your agent uses memory it will show you a bond link.',
+    'Open it and press Bond.',
+    '',
+    'Run `aismemory --help` for all commands.',
+    '',
+].join('\n');
+export const USAGE_TEXT = [
+    'aismemory - persistent memory for AI agents (MCP server)',
+    '',
+    'Usage:',
+    '  aismemory                    Start the MCP server on stdio',
+    '  aismemory install --identity <agent-id>   Write a pinned MCP config for one agent\'s session',
+    '  aismemory hooks install      Add the session-start and pre-compact hook to Claude Code',
+    '  aismemory enable-key-auth    Enroll a device key for silent sign-in',
+    '  aismemory sync               Sync memories into AIS',
+    '  aismemory pull               Pull memories from AIS to local files',
+    '  aismemory export-harness     Export lessons, rules and skills as Markdown',
+    '  aismemory doctor             Diagnose configuration and credentials',
+    '  aismemory agents create <name...>   Create agents you own; prints a claim link for each',
+    '  aismemory rotate-token       Re-issue an agent bearer token (owner)',
+    '  aismemory api-keys           List, create or revoke an agent API key (owner)',
+    '',
+    'Options:',
+    '  -h, --help                   Show this help and exit',
+    '  -v, --version                Print the version and exit',
+    '',
+    'Setup:',
+    '  Add this to your AI client\'s MCP server config:',
+    '',
+    HUMAN_MCP_CONFIG,
+    '',
+    '  The first time your agent uses memory it will show you a bond link.',
+    '  Open it and press Bond.',
+    '',
+].join('\n');
+/**
+ * Returns the text to print for a help or version request, or null when the
+ * arguments are not one. Only the first argument counts, so subcommand flags
+ * (e.g. `aismemory sync --help`) still reach their own handlers.
+ */
+export function resolveInfoRequest(args, version) {
+    const first = args[0];
+    if (first === '--help' || first === '-h')
+        return USAGE_TEXT;
+    if (first === '--version' || first === '-v')
+        return `${version}\n`;
+    return null;
+}
+//# sourceMappingURL=cli-info.js.map

package/dist/cli-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-info.js","sourceRoot":"","sources":["../src/cli-info.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,gBAAgB,GAAG;IACvB,KAAK;IACL,qBAAqB;IACrB,sBAAsB;IACtB,2BAA2B;IAC3B,+BAA+B;IAC/B,SAAS;IACT,OAAO;IACP,KAAK;CACN,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mDAAmD;IACnD,EAAE;IACF,6EAA6E;IAC7E,+CAA+C;IAC/C,EAAE;IACF,gBAAgB;IAChB,EAAE;IACF,qEAAqE;IACrE,yBAAyB;IACzB,EAAE;IACF,0CAA0C;IAC1C,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,0DAA0D;IAC1D,EAAE;IACF,QAAQ;IACR,8DAA8D;IAC9D,gGAAgG;IAChG,0FAA0F;IAC1F,uEAAuE;IACvE,uDAAuD;IACvD,sEAAsE;IACtE,6EAA6E;IAC7E,uEAAuE;IACvE,2FAA2F;IAC3F,uEAAuE;IACvE,gFAAgF;IAChF,EAAE;IACF,UAAU;IACV,wDAAwD;IACxD,2DAA2D;IAC3D,EAAE;IACF,QAAQ;IACR,oDAAoD;IACpD,EAAE;IACF,gBAAgB;IAChB,EAAE;IACF,uEAAuE;IACvE,2BAA2B;IAC3B,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAuB,EAAE,OAAe;IACzE,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IAC5D,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,GAAG,OAAO,IAAI,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/credential-expiry.d.ts

@@ -0,0 +1,10 @@
+export interface CredentialExpiryWarning {
+    expiresAt: string;
+    severity: 'warning' | 'urgent';
+}
+/** Latest captured expiry metadata, also available when a tool rebuilds its result. */
+export declare function getCredentialExpiryWarning(): CredentialExpiryWarning | undefined;
+/** Shared across auth modes: one warning, then one urgent escalation per expiry per process. */
+export declare function captureCredentialExpiry(res: Response): CredentialExpiryWarning | undefined;
+/** Preserve response bodies; add metadata only to object results near expiry. */
+export declare function withCredentialExpiry(data: unknown, warning: CredentialExpiryWarning | undefined): unknown;

package/dist/credential-expiry.js

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+const credentialExpiryTimestamp = z.iso.datetime({ offset: true });
+const warnedExpiryLevels = new Map();
+let latestWarning;
+/** Latest captured expiry metadata, also available when a tool rebuilds its result. */
+export function getCredentialExpiryWarning() {
+    return latestWarning === undefined ? undefined : { ...latestWarning };
+}
+/** Shared across auth modes: one warning, then one urgent escalation per expiry per process. */
+export function captureCredentialExpiry(res) {
+    latestWarning = undefined;
+    const parsed = credentialExpiryTimestamp.safeParse(res.headers.get('AIS-Credential-Expires-At'));
+    if (!parsed.success)
+        return undefined;
+    const expiresAtMs = Date.parse(parsed.data);
+    const serverTimeMs = Date.parse(res.headers.get('Date') ?? '');
+    const nowMs = Number.isFinite(serverTimeMs) ? serverTimeMs : Date.now();
+    const remainingMs = expiresAtMs - nowMs;
+    if (remainingMs <= 0 || remainingMs > 24 * 60 * 60 * 1000)
+        return undefined;
+    const level = remainingMs <= 60 * 60 * 1000 ? 2 : 1;
+    const warning = {
+        expiresAt: parsed.data,
+        severity: level === 2 ? 'urgent' : 'warning',
+    };
+    latestWarning = { ...warning };
+    if (level > (warnedExpiryLevels.get(expiresAtMs) ?? 0)) {
+        warnedExpiryLevels.set(expiresAtMs, level);
+        process.stderr.write(level === 2
+            ? '[aismemory] URGENT: AIS credential expires within 1 hour. Renew it now.\n'
+            : '[aismemory] WARNING: AIS credential expires within 24 hours. Renew it soon.\n');
+    }
+    return warning;
+}
+/** Preserve response bodies; add metadata only to object results near expiry. */
+export function withCredentialExpiry(data, warning) {
+    return warning && typeof data === 'object' && data !== null && !Array.isArray(data) && !('credentialExpiry' in data)
+        ? { ...data, credentialExpiry: warning }
+        : data;
+}
+//# sourceMappingURL=credential-expiry.js.map

package/dist/credential-expiry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-expiry.js","sourceRoot":"","sources":["../src/credential-expiry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,MAAM,yBAAyB,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACnE,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;AACrD,IAAI,aAAkD,CAAC;AAEvD,uFAAuF;AACvF,MAAM,UAAU,0BAA0B;IACxC,OAAO,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,aAAa,EAAE,CAAC;AACxE,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,uBAAuB,CAAC,GAAa;IACnD,aAAa,GAAG,SAAS,CAAC;IAC1B,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACxE,MAAM,WAAW,GAAG,WAAW,GAAG,KAAK,CAAC;IACxC,IAAI,WAAW,IAAI,CAAC,IAAI,WAAW,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,KAAK,GAAG,WAAW,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAA4B;QACvC,SAAS,EAAE,MAAM,CAAC,IAAI;QACtB,QAAQ,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;KAC7C,CAAC;IACF,aAAa,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACvD,kBAAkB,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;YAC9B,CAAC,CAAC,2EAA2E;YAC7E,CAAC,CAAC,+EAA+E,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,oBAAoB,CAAC,IAAa,EAAE,OAA4C;IAC9F,OAAO,OAAO,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,kBAAkB,IAAI,IAAI,CAAC;QAClH,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE;QACxC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC"}