draken 0.1.6 → 0.3.0

package/VOICE.md

@@ -0,0 +1,126 @@
+# ChatGPT voice calls
+
+**Draken has one voice engine: subscription-backed ChatGPT live voice.** It uses the pinned official Codex helper and a separate native sign-in to the same paid ChatGPT account. Microphone audio and bounded context go to OpenAI over a persistent browser audio connection.
+
+The former Whisper → pi → Kokoro engine has been removed, including its Python worker, installer, browser speech detector and execution endpoints. Old call records are still readable; they are not a second working voice option. There is no local-speech, Platform API-key or alternative-provider fallback.
+
+## Setup
+
+After [installing Draken](SETUP.md#install-and-start), run:
+
+```sh
+draken voice setup
+draken voice login          # Complete the official ChatGPT device sign-in
+draken voice status         # Local prerequisites only; not an audio test
+draken                     # Start the server if it is not already running
+```
+
+No voice-mode setting is needed. An existing `DRAKEN_VOICE_MODE=native` remains accepted so installed launchers keep working. Any other value, including `local`, fails startup rather than silently changing an old privacy choice into cloud audio. Remove obsolete local speech settings from launchers; `voice:setup` no longer exists.
+
+Setup runs npm's resolved JavaScript entry under the current Node executable, without a shell or command-shim evaluation. On Windows x64/arm64, status/login/calls launch the pinned official package's `codex.exe` directly, so the owned child is the native process rather than a `.cmd`/Node wrapper. HOME and Windows profile directories are private to the voice account. Runtime installation/version checks do not qualify sign-in, refresh, WebRTC or physical audio.
+
+The helper and its credentials live under `~/.draken/realtime/`, separate from the installed application. Provider credentials never enter the browser. Pi credentials are not copied or converted. Preserve the existing database, dashboard credentials and TLS configuration when updating an installation. No snapshot regeneration is needed to enable voice.
+
+This uses an experimental native interface, not a stable public embedding API. Successful setup or a connection handshake is not proof that an account can receive usable audio. The opt-in probe tests actual audio separately. Quota, idle accounting, coding-allowance impact and future compatibility are not established.
+
+## Chat instead
+
+For a keyboard-only conversation, choose **Chat instead** on Home or next to **Call Draken**. This is a separate `/syncs/:id/chat` surface, not a muted call. It uses the configured text model through pi and requires no microphone permission, WebRTC connection or native ChatGPT sign-in. It shows a square Draken portrait, searching/thinking status, saved messages and source links. Its model access/quota is separate from the native voice account. See [the text-chat guide](README.md#text-chat).
+
+Choosing chat while a one-click call is still preparing consumes that browser call intent; preparation can finish without opening a microphone. Returning to **Voice & call history** never automatically starts a call. Existing voice history remains preserved and separately labelled.
+
+## Start and use a call
+
+1. Open Draken on **localhost or trusted HTTPS**. Plain LAN HTTP normally cannot access the microphone.
+2. **Sync with Draken** finishes importing each discovered file's captured prefix, prepares the briefing and searchable history, then opens its call. Import errors stop preparation instead of silently freezing an old prefix. On an existing sync, **Call Draken** stays disabled until both are ready. If imported history has changed, use **Prepare history** first. An already-ready sync also offers **Refresh history** to capture later work without rebuilding its frozen briefing.
+3. Any needed history download/indexing happens on the sync page, before a call can start. Progress and **Cancel preparation** are available there; the microphone remains off. Once ready, start the call and allow microphone access. A failed or cancelled preparation does not request permission, and if the page is hidden when preparation finishes, start the call again explicitly. You can also type if microphone permission is unavailable.
+4. Speaker-safe mode pauses input during replies. Use **Stop reply** to speak, or enable **Headphone mode** to allow spoken interruption. Headphones are recommended.
+5. **Mute** releases the microphone tracks. **Stop reply** cuts playback locally and asks the provider to stop; it does not prove immediate remote cancellation. **End call** stops capture/playback and keeps the text history.
+
+Capture follows a transient browser action, never a URL flag. Reloading or opening `/syncs/:id` does not restart the microphone. Failed preparation, a hidden page, denied permission or an ended connection requires explicit recovery. There is no automatic reconnect or fallback voice engine.
+
+Reply waiting is owned by the server's identified user transcript and pending-answer events. Unkeyed WebRTC user events can arrive late and must not switch an already pending reply back to listening, erase its waiting caption, or restart a settled reply. A lookup acknowledgement such as “I’ll check what’s recorded” is not meant to end the answer. Draken keeps the question pending and can automatically resume ChatGPT speech when its context arrives; you should not need to ask “have you checked?” Quiet captions in the dragon scene show **[Thinking...]**, **[Hmmm...]** and **[Hmmmmmm...]** during a pending reply, including silence after an acknowledgement. They change every five seconds without animation. **[Checking...]** and **[Looking that up...]** are used only while the local history worker reports fresh lookup activity; these labels are not proof of a match or exhaustive search. These are visual waiting cues—not the model’s private thoughts, spoken messages, a percentage or an ETA. They are never saved in the transcript or sent to the model. The separate waiting banner and elapsed-wait timer have been removed. Stop, a newer question, interruption, or ending the call cancels the old pending continuation. There is at most one automatic completion cue per question—not a retry loop or a fabricated user message. A failed lookup must be disclosed; a failed or silent continuation produces a visible notice instead of silently retrying.
+
+Work questions use original project evidence and preserve the project across follow-ups; old conversation recall remains available when explicitly requested. History is captured at the displayed preparation cutoff, not observed live. The helper can refine a lookup or read a longer H source. Each turn allows three distinct lookups, with source packets bounded to 7,000 UTF-8 bytes (the native context envelope is bounded to 8 KiB). Supplied source IDs belong to that turn; they are not proof that each generated claim was verified. The larger text-chat reconciliation packet and bounded pi answer-repair pass do not apply to streaming native voice; this call path retains its existing lookup budget. See [MEMORY.md](MEMORY.md) for retrieval limits.
+
+One call may be active at a time, with a 30-minute limit, at most 60 user messages and a 90-second disconnect timeout. These are resource limits, not spending guarantees. A new call cannot start until helper cleanup is confirmed. The browser chooses its reservation UUID before sending creation, so End can release a reservation even if the create response is lost. If End overtakes creation, the server retains a bounded cancellation marker for five minutes; an already-created ID can never be reused. Network loss can still require the disconnect timeout or explicit End previous call.
+
+## Evidence, records and recap
+
+- Voice questions do **not** start pi, local transcription or local synthesis. The call receives a bounded briefing, saved notes and source excerpts. Explicit source/history questions can request more data from the same frozen snapshot. Calls use bounded semantic + keyword retrieval across retained older records, using the local index described in [MEMORY.md](MEMORY.md). The local model/index must be prepared before calling is enabled; first preparation may take minutes. During the call, retrieval uses that prepared cutoff and verifies original sources without building new corpus embeddings. Expand **Conversation & details** for the full transcript, sources and any later history progress. Optional **Settings → Automatically index history** prepares that same call/search history in idle batches of at least 64 changed source records; it never starts capture, calls or provider summaries. Smaller batches wait for explicit preparation, and keep Call disabled if history is not ready. This block starts collapsed for every call; its progress polling reads metadata only. Those dated excerpts also go to ChatGPT; they are not new snapshot evidence. The embedding runtime is text-only and is not a replacement speech engine.
+- The read-only lookup service is not a coding model or a general web search. Tool-execution and approval requests are denied. Calls cannot edit files, deploy work, save decisions by model instruction, finish syncs or advance coverage.
+- Speech may paraphrase. **Sources supplied** means context was given to the model, not that every spoken claim was verified. Responses are not held for whole-answer JSON validation before playback.
+- History stores ordered user/assistant messages with generated/interrupted labels. It does not invent question–answer pairs, exact played words, human hearing or agreement. Historical records from the retired engine retain their original playback reports and are labelled separately.
+- No raw microphone recording is persisted locally. Text, source references and call status are stored in the private SQLite database. There is no retention/purge UI yet.
+- Ending the call does not mark the sync reviewed. Closing the call UI requests a short text recap through pi using the sync's cheaper summary model. This is separate from live audio; a browser exit cannot guarantee the request is sent or completes. You can explicitly refresh the recap later.
+
+See [the native implementation guide](voice/realtime/README.md) for packet limits, helper restrictions, recall rules and verification details. Provider retention and exact subscription accounting are not promised by Draken.
+
+## Animated dragon
+
+The local 3D dragon follows received audio energy, not exact words or phonemes. Its drawing code cannot capture audio, call a model or change records. Silence and stopped playback close its mouth. Drawing failure leaves a still image without disabling the call.
+
+Live subtitles appear over the bottom of the call scene, labelled **You** or **Draken**. They show a bounded window of the latest transcript, not word-timed audio alignment; the complete text remains in the collapsed **Conversation & details** block. Captions also work over the static fallback image. Errors and recovery buttons remain visible outside that block. There is no animation-control overlay. The separate `/persona.html` preview uses a stored sample without microphone access, sign-in or model use. See [PERSONA.md](PERSONA.md).
+
+## LAN microphone access
+
+Use an existing **trusted HTTPS reverse proxy** preserving Host/Origin, or the built-in TLS listener. For the latter, the globally installed npm package includes a certificate helper. It requires **OpenSSL** on PATH. In Bash or PowerShell, run:
+
+```sh
+npm --prefix "$(npm root -g)/draken" run voice:tls -- --host 192.168.1.20
+```
+
+Use your actual server address. This runs the helper from the installed package; no repository clone or build is needed.
+
+This creates a private local certificate authority and a server certificate, then prints settings like:
+
+```sh
+DRAKEN_HTTPS_PORT=44433
+DRAKEN_TLS_CERT=/absolute/path/to/draken-server.crt
+DRAKEN_TLS_KEY=/absolute/path/to/draken-server.key
+DRAKEN_TLS_CA=/absolute/path/to/draken-local-root.crt
+```
+
+Export them alongside your existing authenticated LAN configuration and restart Draken while idle. `.env` is not loaded automatically. The command does not change firewall rules, install system trust, change dashboard credentials or expose Draken to the internet.
+
+### One-time browser trust
+
+In the voice card, open **First-time browser setup** and download the public certificate using your dashboard login. Compare its fingerprint with the TLS setup output. Trust **only your own** `draken-local-root.crt`:
+
+- **Windows:** open the certificate → Install Certificate → Current User → Trusted Root Certification Authorities.
+- **macOS:** import into the login keychain → open its Trust section → Always Trust.
+- **Firefox:** Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import; trust it to identify websites.
+- **Chromium/Linux:** use your browser/platform certificate manager. Firefox trust settings do not necessarily apply to Chromium.
+
+Restart the browser if needed, visit `https://your-server:44433`, sign in and allow the microphone when starting a call. HTTPS is a separate browser origin, so an HTTP login is not automatically transferred. Dismissing a certificate warning is not the supported setup.
+
+Keep both `.key` files private. The authenticated download route re-encodes only the public certificate. Rerunning TLS setup preserves the CA and reuses valid matching certificates; it renews certificates near expiry or with changed hostnames. There is no renewal daemon.
+
+### SSH alternative
+
+If you already have trusted SSH access, forward Draken to your own localhost:
+
+```sh
+ssh -N -L 40333:192.168.1.20:40333 your-user@192.168.1.20
+# Open http://localhost:40333 on the client computer.
+```
+
+The localhost browser exception permits microphone access; SSH encrypts the connection. Dashboard authentication is still required for an authenticated server.
+
+## Server settings
+
+| Variable | Purpose |
+|---|---|
+| `DRAKEN_CODEX_BIN`, `DRAKEN_CODEX_HOME` | Trusted operator/test overrides for the pinned helper and its account directory |
+| `DRAKEN_HTTPS_PORT` | Optional second listener |
+| `DRAKEN_TLS_CERT`, `DRAKEN_TLS_KEY` | Certificate and key for that listener |
+| `DRAKEN_TLS_CA` | Optional public certificate download |
+| `DRAKEN_TLS_DIR` | TLS setup output; defaults to `<data dir>/runtime/tls` |
+
+There are no per-call model selectors or API keys. Native helper version and native-auth checks still apply to operator overrides.
+
+## Verification and limits
+
+`draken voice status` checks local helper/sign-in metadata. It does not establish provider access, usable audio, microphone quality, speaker echo, Bluetooth behavior or support for every browser/device. Test those explicitly with your intended account and device.
+
+Automated checks and optional real-provider probes are documented in [CONTRIBUTING.md](CONTRIBUTING.md#voice-qualification). They are contributor tools, not installation prerequisites. Ordinary tests use temporary synthetic records and audio; real-provider probes require explicit consent and are not part of the ordinary suite.

package/dist/auth/middleware.d.ts

@@ -5,7 +5,7 @@ export interface AuthConfig {
     jwtSecret: string;
     tokenExpiry: string;
 }
-export interface JwtPayload {
+interface JwtPayload {
     username: string;
     iat: number;
     exp: number;
@@ -13,6 +13,7 @@ export interface JwtPayload {
 export interface AuthenticatedRequest extends Request {
     user?: JwtPayload;
 }
+export declare function isLoopbackHost(host: string): boolean;
 export declare function isNoAuthMode(): boolean;
 export declare function getAuthConfig(): AuthConfig | null;
 export declare function validateAuthConfig(): void;
@@ -20,4 +21,5 @@ export declare function isAuthEnabled(): boolean;
 export declare function authMiddleware(req: AuthenticatedRequest, res: Response, next: NextFunction): void;
 export declare function generateToken(username: string): string;
 export declare function validateCredentials(username: string, password: string): boolean;
+export {};
 //# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG1D,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACnD,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAGD,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAKD,wBAAgB,aAAa,IAAI,UAAU,GAAG,IAAI,CA6BjD;AAGD,wBAAgB,kBAAkB,IAAI,IAAI,CASzC;AAGD,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAGD,wBAAgB,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAqCjG;AAGD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAStD;AAGD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ/E"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAG1D,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,UAAU;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,oBAAqB,SAAQ,OAAO;IACnD,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAID,wBAAgB,YAAY,IAAI,OAAO,CAStC;AAKD,wBAAgB,aAAa,IAAI,UAAU,GAAG,IAAI,CA6BjD;AAGD,wBAAgB,kBAAkB,IAAI,IAAI,CASzC;AAGD,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAGD,wBAAgB,cAAc,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CA2BjG;AAGD,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAStD;AAGD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ/E"}

package/dist/auth/middleware.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isLoopbackHost = isLoopbackHost;
 exports.isNoAuthMode = isNoAuthMode;
 exports.getAuthConfig = getAuthConfig;
 exports.validateAuthConfig = validateAuthConfig;
@@ -11,15 +12,28 @@ exports.authMiddleware = authMiddleware;
 exports.generateToken = generateToken;
 exports.validateCredentials = validateCredentials;
 const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
-// Check if auth is explicitly disabled
+function isLoopbackHost(host) {
+    return ['127.0.0.1', 'localhost', '::1'].includes(host);
+}
+// A plain local launch needs no account setup. Explicit credentials keep their
+// existing meaning, and non-loopback bindings never default to anonymous access.
 function isNoAuthMode() {
-    return process.env.DRAKEN_NO_AUTH === 'true';
+    const override = process.env.DRAKEN_NO_AUTH;
+    if (override !== undefined) {
+        if (override === 'true')
+            return true;
+        if (override === 'false')
+            return false;
+        throw new Error('DRAKEN_NO_AUTH must be true or false, or unset for automatic local mode');
+    }
+    const credentialsConfigured = Boolean(process.env.DRAKEN_USERNAME || process.env.DRAKEN_PASSWORD || process.env.DRAKEN_JWT_SECRET);
+    return isLoopbackHost(process.env.DRAKEN_HOST || '127.0.0.1') && !credentialsConfigured;
 }
 // Get auth configuration from environment variables
 // Returns null only if NO_AUTH mode is enabled
 // Throws error if auth is required but not properly configured
 function getAuthConfig() {
-    // If NO_AUTH is explicitly set, disable authentication
+    // Loopback defaults to no login; an explicit override is also supported.
     if (isNoAuthMode()) {
         return null;
     }
@@ -36,7 +50,7 @@ function getAuthConfig() {
         missing.push('DRAKEN_JWT_SECRET');
     if (missing.length > 0) {
         throw new Error(`Authentication is required. Missing environment variables: ${missing.join(', ')}\n` +
-            `Set these variables or set DRAKEN_NO_AUTH=true to disable authentication.`);
+            `Set these variables for authenticated access, or use a loopback bind without credentials for local-only access.`);
     }
     return {
         username: username,
@@ -48,7 +62,7 @@ function getAuthConfig() {
 // Validate auth config on startup (call this early in server initialization)
 function validateAuthConfig() {
     if (isNoAuthMode()) {
-        console.log('Warning: Authentication is DISABLED (DRAKEN_NO_AUTH=true)');
+        console.log('Local mode: no dashboard login (loopback only).');
         return;
     }
     // This will throw if config is invalid
@@ -66,17 +80,8 @@ function authMiddleware(req, res, next) {
         return next();
     }
     const config = getAuthConfig();
-    // Get token from Authorization header or query param (for SSE endpoints)
     const authHeader = req.headers.authorization;
-    const queryToken = req.query.token;
-    let token = null;
-    if (authHeader && authHeader.startsWith('Bearer ')) {
-        token = authHeader.substring(7); // Remove 'Bearer ' prefix
-    }
-    else if (queryToken) {
-        // Allow token via query param for SSE (EventSource doesn't support headers)
-        token = queryToken;
-    }
+    const token = authHeader?.startsWith('Bearer ') ? authHeader.substring(7) : null;
     if (!token) {
         res.status(401).json({ error: 'Authentication required', code: 'NO_TOKEN' });
         return;

package/dist/auth/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":";;;;;AAqBA,oCAEC;AAKD,sCA6BC;AAGD,gDASC;AAGD,sCAEC;AAGD,wCAqCC;AAGD,sCASC;AAGD,kDAQC;AAxID,gEAA+B;AAmB/B,uCAAuC;AACvC,SAAgB,YAAY;IAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;AAC/C,CAAC;AAED,oDAAoD;AACpD,+CAA+C;AAC/C,+DAA+D;AAC/D,SAAgB,aAAa;IAC3B,uDAAuD;IACvD,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAEhD,8CAA8C;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAElD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,8DAA8D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACpF,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAS;QACnB,QAAQ,EAAE,QAAS;QACnB,SAAS,EAAE,SAAU;QACrB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI;KACrD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAgB,kBAAkB;IAChC,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,uCAAuC;IACvC,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,oCAAoC,MAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,qCAAqC;AACrC,SAAgB,aAAa;IAC3B,OAAO,CAAC,YAAY,EAAE,CAAC;AACzB,CAAC;AAED,4BAA4B;AAC5B,SAAgB,cAAc,CAAC,GAAyB,EAAE,GAAa,EAAE,IAAkB;IACzF,sCAAsC;IACtC,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAE/B,yEAAyE;IACzE,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,KAA2B,CAAC;IAEzD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAEhC,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnD,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;IAC7D,CAAC;SAAM,IAAI,UAAU,EAAE,CAAC;QACtB,4EAA4E;QAC5E,KAAK,GAAG,UAAU,CAAC;IACrB,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAO,CAAC,SAAS,CAAe,CAAC;QACnE,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAG,CAAC,iBAAiB,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;AACH,CAAC;AAED,qBAAqB;AACrB,SAAgB,aAAa,CAAC,QAAgB;IAC5C,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,sBAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE;QAC9C,SAAS,EAAE,MAAM,CAAC,WAA2C;KAC9D,CAAC,CAAC;AACL,CAAC;AAED,uBAAuB;AACvB,SAAgB,mBAAmB,CAAC,QAAgB,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oDAAoD;IACpD,OAAO,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC;AACtE,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":";;;;;AAoBA,wCAEC;AAID,oCASC;AAKD,sCA6BC;AAGD,gDASC;AAGD,sCAEC;AAGD,wCA2BC;AAGD,sCASC;AAGD,kDAQC;AA1ID,gEAA+B;AAmB/B,SAAgB,cAAc,CAAC,IAAY;IACzC,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,+EAA+E;AAC/E,iFAAiF;AACjF,SAAgB,YAAY;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,QAAQ,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,QAAQ,KAAK,OAAO;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnI,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,CAAC,qBAAqB,CAAC;AAC1F,CAAC;AAED,oDAAoD;AACpD,+CAA+C;AAC/C,+DAA+D;AAC/D,SAAgB,aAAa;IAC3B,yEAAyE;IACzE,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAEhD,8CAA8C;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAElD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,8DAA8D,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACpF,iHAAiH,CAClH,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,QAAS;QACnB,QAAQ,EAAE,QAAS;QACnB,SAAS,EAAE,SAAU;QACrB,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI;KACrD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAgB,kBAAkB;IAChC,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;QAC/D,OAAO;IACT,CAAC;IAED,uCAAuC;IACvC,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,OAAO,CAAC,GAAG,CAAC,oCAAoC,MAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,qCAAqC;AACrC,SAAgB,aAAa;IAC3B,OAAO,CAAC,YAAY,EAAE,CAAC;AACzB,CAAC;AAED,4BAA4B;AAC5B,SAAgB,cAAc,CAAC,GAAyB,EAAE,GAAa,EAAE,IAAkB;IACzF,sCAAsC;IACtC,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAE/B,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7C,MAAM,KAAK,GAAG,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjF,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAO,CAAC,SAAS,CAAe,CAAC;QACnE,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC;QACnB,IAAI,EAAE,CAAC;IACT,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,sBAAG,CAAC,iBAAiB,EAAE,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1E,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC;AACH,CAAC;AAED,qBAAqB;AACrB,SAAgB,aAAa,CAAC,QAAgB;IAC5C,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,sBAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE;QAC9C,SAAS,EAAE,MAAM,CAAC,WAA2C;KAC9D,CAAC,CAAC;AACL,CAAC;AAED,uBAAuB;AACvB,SAAgB,mBAAmB,CAAC,QAAgB,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,aAAa,EAAE,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,KAAK,CAAC;IACf,CAAC;IAED,oDAAoD;IACpD,OAAO,QAAQ,KAAK,MAAM,CAAC,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC;AACtE,CAAC"}

package/dist/cli.js

@@ -37,125 +37,89 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-const path_1 = __importDefault(require("path"));
 const fs_1 = __importDefault(require("fs"));
-const os_1 = __importDefault(require("os"));
-const https_1 = __importDefault(require("https"));
-const pkg = JSON.parse(fs_1.default.readFileSync(path_1.default.join(__dirname, '../package.json'), 'utf-8'));
-const currentVersion = pkg.version;
-/**
- * Check for updates (non-blocking, cached for 24h)
- */
-async function checkForUpdates() {
-    const dataDir = process.env.DRAKEN_DATA_DIR || path_1.default.join(os_1.default.homedir(), '.draken');
-    const cacheFile = path_1.default.join(dataDir, '.update-check');
-    // Check cache (24 hour TTL)
-    try {
-        if (fs_1.default.existsSync(cacheFile)) {
-            const cache = JSON.parse(fs_1.default.readFileSync(cacheFile, 'utf-8'));
-            const age = Date.now() - cache.timestamp;
-            if (age < 24 * 60 * 60 * 1000) {
-                // Cache still valid
-                if (cache.latest && cache.latest !== currentVersion) {
-                    showUpdateMessage(cache.latest);
-                }
-                return;
-            }
-        }
-    }
-    catch { }
-    // Fetch latest version from npm
-    return new Promise((resolve) => {
-        const req = https_1.default.get('https://registry.npmjs.org/draken/latest', { timeout: 3000 }, (res) => {
-            let data = '';
-            res.on('data', chunk => data += chunk);
-            res.on('end', () => {
-                try {
-                    const latest = JSON.parse(data).version;
-                    // Save to cache
-                    if (!fs_1.default.existsSync(dataDir)) {
-                        fs_1.default.mkdirSync(dataDir, { recursive: true });
-                    }
-                    fs_1.default.writeFileSync(cacheFile, JSON.stringify({ latest, timestamp: Date.now() }));
-                    if (latest !== currentVersion) {
-                        showUpdateMessage(latest);
-                    }
-                }
-                catch { }
-                resolve();
-            });
-        });
-        req.on('error', () => resolve());
-        req.on('timeout', () => { req.destroy(); resolve(); });
-    });
-}
-function showUpdateMessage(latest) {
-    console.log(`\n  📦 Update available: ${currentVersion} → ${latest}`);
-    console.log(`     Run: npm i -g draken@latest\n`);
-}
-// Handle --version and --help before anything else
+const path_1 = __importDefault(require("path"));
+const server_1 = require("./server");
+const server_state_1 = require("./server-state");
+const server_status_1 = require("./server-status");
+const launcher_1 = require("./tray/launcher");
+const setup_1 = require("./pi/setup");
+const version = JSON.parse(fs_1.default.readFileSync(path_1.default.join(__dirname, '../package.json'), 'utf8')).version;
 const args = process.argv.slice(2);
-if (args.includes('--version') || args.includes('-v')) {
-    console.log(`draken v${currentVersion}`);
-    checkForUpdates().then(() => process.exit(0));
-}
-else if (args.includes('--help') || args.includes('-h')) {
-}
-else if (args.includes('--help') || args.includes('-h')) {
-    console.log(`
-  Draken v${currentVersion} - Claude Code Dashboard
-
-  Usage: draken [options]
+async function main() {
+    if (!args.length)
+        return (0, server_1.startServer)();
+    if (args.length === 1 && args[0] === 'tray')
+        return (0, launcher_1.launchTray)();
+    if (args.length === 1 && args[0] === '--tray-server' && process.send)
+        return (0, server_1.startServer)(true);
+    if (args.length === 1 && args[0] === '--tray-worker' && process.send) {
+        const { runTrayWorker } = await Promise.resolve().then(() => __importStar(require('./tray/worker')));
+        return runTrayWorker();
+    }
+    if (args.length === 1 && ['--version', '-v'].includes(args[0])) {
+        console.log(`draken ${version}`);
+        return;
+    }
+    if (args.length === 1 && ['--help', '-h'].includes(args[0])) {
+        console.log(`Draken ${version} — read-only sync across pi, Codex and Claude sessions
 
-  Options:
-    -v, --version    Show version
-    -h, --help       Show this help
+Usage:
+  draken                  Start the server in this terminal; Ctrl+C stops it
+  draken tray             Background tray companion (macOS / Windows desktop)
+  draken status           Find and check this data directory's last server
+  draken doctor           Check pi/model credential configuration, without inference
+  draken setup [--yes]     Install and select Draken's private, pinned pi runtime
+  draken login             Open pi's own /login interface for the selected runtime
+  draken voice setup       Install the pinned native voice helper
+  draken voice login       Separate official ChatGPT voice sign-in
+  draken voice status      Check native helper/sign-in metadata
 
-  Environment Variables:
-    DRAKEN_USERNAME     Username for dashboard auth
-    DRAKEN_PASSWORD     Password for dashboard auth
-    DRAKEN_JWT_SECRET   Secret for JWT tokens
-    DRAKEN_NO_AUTH      Set to 'true' to disable auth
-    DRAKEN_PORT         Server port (default: 40333)
-    DRAKEN_DATA_DIR     Data directory (default: ~/.draken)
+First use: draken setup → draken login → draken voice setup → draken voice login
+Then run draken, open its printed URL, and choose Settings → Agents & sessions.
+Existing configured pi works without a private install. No provider authentication
+is reimplemented by Draken. Installing the npm package does not start a server.
 
-  Claude Authentication (one required):
-    ANTHROPIC_API_KEY   API key for Claude
-    - or run: claude login
+Run setup/login as the server's user with the same environment:
+DRAKEN_DATA_DIR                Private state (default: ~/.draken)
+DRAKEN_PI_BIN                  Explicit pi executable; overrides private selection
+PI_CODING_AGENT_DIR            Existing/external pi config; managed pi is isolated
+DRAKEN_PI_SUMMARY_MODEL        Summary model (default: openai/gpt-6-luna)
+DRAKEN_PI_FINAL_MODEL          Final model (default: openai/gpt-6-astra)
+DRAKEN_PI_MODEL                Legacy final-model fallback
+DRAKEN_PI_SESSIONS_DIR         Pi history source, not the summarization runtime
+DRAKEN_CODEX_SESSIONS_DIR / DRAKEN_CLAUDE_SESSIONS_DIR
+                               Optional history roots; enable in Settings
+DRAKEN_HOST / DRAKEN_PORT      Bind address/port (default: 127.0.0.1:40333)
 
-  Examples:
-    DRAKEN_NO_AUTH=true draken
-    DRAKEN_USERNAME=admin DRAKEN_PASSWORD=secret DRAKEN_JWT_SECRET=xyz draken
-`);
-    process.exit(0);
-}
-// Check for required environment variables
-const noAuth = process.env.DRAKEN_NO_AUTH === 'true';
-if (!noAuth) {
-    const required = ['DRAKEN_USERNAME', 'DRAKEN_PASSWORD', 'DRAKEN_JWT_SECRET'];
-    const missing = required.filter(key => !process.env[key]);
-    if (missing.length > 0) {
-        console.log('\n  Draken - Claude Code Dashboard\n');
-        console.log('  Authentication is required. Set these environment variables:');
-        missing.forEach(key => console.log(`    - ${key}`));
-        console.log('\n  Or disable auth for local development:');
-        console.log('    DRAKEN_NO_AUTH=true npx draken\n');
-        process.exit(1);
+Loopback needs no dashboard login. LAN bindings require authentication:
+DRAKEN_USERNAME / DRAKEN_PASSWORD / DRAKEN_JWT_SECRET; use trusted HTTPS.
+DRAKEN_NO_AUTH=false also requires dashboard login on loopback.
+Scanning works without pi; summarization needs pi and model credentials.
+Native voice has a separate account. No startup action captures audio or calls models.`);
+        return;
     }
+    if (args[0] === 'setup' && (args.length === 1 || args.length === 2 && args[1] === '--yes'))
+        return (0, setup_1.installPi)(args[1] === '--yes');
+    if (args[0] === 'login' && args.length === 1)
+        return (0, setup_1.loginPi)();
+    if (args[0] === 'doctor' && args.length === 1)
+        return (0, setup_1.doctor)();
+    if (args[0] === 'voice' && args.length === 2)
+        return (0, setup_1.voiceSetup)(args[1]);
+    if (args[0] === 'status' && args.length === 1) {
+        const target = (0, server_state_1.serverTarget)(), url = target.url;
+        try {
+            await (0, server_status_1.probeServer)(target);
+            console.log(`Draken is responding at ${url}.\nOpen ${target.open}\nThis checks connectivity${target.instance ? ' and the saved server instance' : ''}, not summary/voice readiness. Use draken doctor for pi setup.`);
+        }
+        catch {
+            console.error(`Draken was not confirmed at ${url}. It may be stopped, or the saved address belongs to an old instance. Start it with draken, or check the server log. If you use a custom data directory, set DRAKEN_DATA_DIR to the same directory.`);
+            process.exitCode = 1;
+        }
+        return;
+    }
+    throw new Error(`Unknown arguments: ${args.join(' ')}. Use draken --help.`);
 }
-// Check for Claude authentication
-const claudeConfigDir = process.env.CLAUDE_CONFIG_DIR || path_1.default.join(os_1.default.homedir(), '.claude');
-const hasOAuth = fs_1.default.existsSync(path_1.default.join(claudeConfigDir, '.credentials.json'));
-const hasApiKey = !!process.env.ANTHROPIC_API_KEY;
-if (!hasOAuth && !hasApiKey) {
-    console.log('\n  Draken - Claude Code Dashboard\n');
-    console.log('  Claude authentication required. Choose one:');
-    console.log('    1. Run: claude login');
-    console.log('    2. Set: ANTHROPIC_API_KEY=your-key\n');
-    process.exit(1);
-}
-// Check for updates in background (non-blocking)
-checkForUpdates();
-// Import and start the server
-Promise.resolve().then(() => __importStar(require('./server')));
+void main().catch(error => { console.error(error instanceof Error ? error.message : 'Draken could not complete the command.'); process.exitCode = 1; });
 //# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,gDAAwB;AACxB,4CAAoB;AACpB,4CAAoB;AACpB,kDAA0B;AAE1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1F,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC;AAEnC;;GAEG;AACH,KAAK,UAAU,eAAe;IAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,cAAI,CAAC,IAAI,CAAC,YAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAEtD,4BAA4B;IAC5B,IAAI,CAAC;QACH,IAAI,YAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;YACzC,IAAI,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;gBAC9B,oBAAoB;gBACpB,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;oBACpD,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBAClC,CAAC;gBACD,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IAEV,gCAAgC;IAChC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,eAAK,CAAC,GAAG,CAAC,0CAA0C,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3F,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC;YACvC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;oBAExC,gBAAgB;oBAChB,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC5B,YAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC7C,CAAC;oBACD,YAAE,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;oBAE/E,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;wBAC9B,iBAAiB,CAAC,MAAM,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC,CAAA,CAAC;gBACV,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACjC,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,CAAC,GAAG,CAAC,4BAA4B,cAAc,MAAM,MAAM,EAAE,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;AACpD,CAAC;AAED,mDAAmD;AACnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACtD,OAAO,CAAC,GAAG,CAAC,WAAW,cAAc,EAAE,CAAC,CAAC;IACzC,eAAe,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;KAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AAE5D,CAAC;KAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC;YACF,cAAc;;;;;;;;;;;;;;;;;;;;;;;CAuBzB,CAAC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,2CAA2C;AAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,CAAC;AACrD,IAAI,CAAC,MAAM,EAAE,CAAC;IACZ,MAAM,QAAQ,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAE1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAC9E,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,kCAAkC;AAClC,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,cAAI,CAAC,IAAI,CAAC,YAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC5F,MAAM,QAAQ,GAAG,YAAE,CAAC,UAAU,CAAC,cAAI,CAAC,IAAI,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAChF,MAAM,SAAS,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;AAElD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,iDAAiD;AACjD,eAAe,EAAE,CAAC;AAElB,8BAA8B;AAC9B,kDAAO,UAAU,IAAE"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,4CAAoB;AACpB,gDAAwB;AACxB,qCAAuC;AACvC,iDAA8C;AAC9C,mDAA8C;AAC9C,8CAA6C;AAC7C,sCAAoE;AAEpE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAE,CAAC,YAAY,CAAC,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AACrG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACnC,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAA,oBAAW,GAAE,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,IAAA,qBAAU,GAAE,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;IAC/F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACrE,MAAM,EAAE,aAAa,EAAE,GAAG,wDAAa,eAAe,GAAC,CAAC;QACxD,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAC7G,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,UAAU,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uFAkCsD,CAAC,CAAC;QACrF,OAAO;IACT,CAAC;IACD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC;QAAE,OAAO,IAAA,iBAAS,EAAC,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;IAClI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAA,eAAO,GAAE,CAAC;IAC/D,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAA,cAAM,GAAE,CAAC;IAC/D,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAA,kBAAU,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,IAAA,2BAAY,GAAE,EAAE,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,IAAA,2BAAW,EAAC,MAAM,CAAC,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,WAAW,MAAM,CAAC,IAAI,6BAA6B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,EAAE,gEAAgE,CAAC,CAAC;QACxN,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,CAAC,KAAK,CAAC,+BAA+B,GAAG,qMAAqM,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QAAC,CAAC;QACzR,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;AAC9E,CAAC;AACD,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/db/agent-migration.d.ts

@@ -0,0 +1,7 @@
+import type Database from 'better-sqlite3';
+/** Runs inside initSchema's transaction, before any generic schema statements.
+ * ALTER TABLE preserves row IDs, foreign keys and AUTOINCREMENT high-water marks.
+ * There are deliberately no writable pi_* aliases or copied session tables. */
+export declare function renameAgentTables(db: Database.Database): void;
+export declare function migrateAgents(db: Database.Database): void;
+//# sourceMappingURL=agent-migration.d.ts.map

package/dist/db/agent-migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-migration.d.ts","sourceRoot":"","sources":["../../src/db/agent-migration.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAE3C;;+EAE+E;AAC/E,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAM7D;AACD,wBAAgB,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,IAAI,CAezD"}

package/dist/db/agent-migration.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renameAgentTables = renameAgentTables;
+exports.migrateAgents = migrateAgents;
+/** Runs inside initSchema's transaction, before any generic schema statements.
+ * ALTER TABLE preserves row IDs, foreign keys and AUTOINCREMENT high-water marks.
+ * There are deliberately no writable pi_* aliases or copied session tables. */
+function renameAgentTables(db) {
+    const has = (name) => Boolean(db.prepare("SELECT 1 FROM sqlite_schema WHERE type='table' AND name=?").get(name));
+    if (has('pi_sessions') || has('pi_entries')) {
+        if (!has('pi_sessions') || !has('pi_entries') || has('agent_sessions') || has('agent_entries'))
+            throw new Error('Ambiguous agent schema; existing data was not changed');
+        db.exec('ALTER TABLE pi_sessions RENAME TO agent_sessions; ALTER TABLE pi_entries RENAME TO agent_entries; DROP INDEX IF EXISTS pi_entries_pending; DROP INDEX IF EXISTS pi_entries_event');
+    }
+}
+function migrateAgents(db) {
+    const marker = db.prepare("SELECT value FROM sync_settings WHERE key='source_schema'").get()?.value;
+    if (marker && marker !== 'agents-v1')
+        throw new Error('Unknown agent source schema; existing data was not changed');
+    db.exec(`CREATE TABLE IF NOT EXISTS agent_sources(id TEXT PRIMARY KEY, enabled INTEGER NOT NULL CHECK(enabled IN (0,1)));
+    INSERT OR IGNORE INTO agent_sources VALUES('pi',1),('codex',0),('claude',0);`);
+    const columns = new Set(db.pragma('table_info(agent_sessions)').map(row => row.name));
+    if (!columns.has('agent'))
+        db.exec("ALTER TABLE agent_sessions ADD COLUMN agent TEXT NOT NULL DEFAULT 'pi'");
+    if (!columns.has('external_id')) {
+        db.exec('ALTER TABLE agent_sessions ADD COLUMN external_id TEXT');
+        db.exec('UPDATE agent_sessions SET external_id=id');
+    }
+    db.exec('CREATE UNIQUE INDEX IF NOT EXISTS agent_sessions_identity ON agent_sessions(agent,external_id)');
+    if (!db.pragma('table_info(agent_entries)').some(row => row.name === 'parser_version'))
+        db.exec('ALTER TABLE agent_entries ADD COLUMN parser_version INTEGER NOT NULL DEFAULT 1');
+    db.prepare("INSERT OR IGNORE INTO sync_settings VALUES('source_schema','agents-v1')").run();
+    if (db.pragma('foreign_key_check').length)
+        throw new Error('Agent migration failed foreign-key verification');
+}
+//# sourceMappingURL=agent-migration.js.map

package/dist/db/agent-migration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-migration.js","sourceRoot":"","sources":["../../src/db/agent-migration.ts"],"names":[],"mappings":";;AAKA,8CAMC;AACD,sCAeC;AAzBD;;+EAE+E;AAC/E,SAAgB,iBAAiB,CAAC,EAAqB;IACrD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACzH,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACzK,EAAE,CAAC,IAAI,CAAC,kLAAkL,CAAC,CAAC;IAC9L,CAAC;AACH,CAAC;AACD,SAAgB,aAAa,CAAC,EAAqB;IACjD,MAAM,MAAM,GAAI,EAAE,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAC,GAAG,EAAU,EAAE,KAAK,CAAC;IAC7G,IAAI,MAAM,IAAI,MAAM,KAAK,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACpH,EAAE,CAAC,IAAI,CAAC;iFACuE,CAAC,CAAC;IACjF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAE,EAAE,CAAC,MAAM,CAAC,4BAA4B,CAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3G,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,EAAE,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IAC7G,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAChC,EAAE,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAClE,EAAE,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACtD,CAAC;IACD,EAAE,CAAC,IAAI,CAAC,gGAAgG,CAAC,CAAC;IAC1G,IAAI,CAAE,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,gBAAgB,CAAC;QAAE,EAAE,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IACvM,EAAE,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC5F,IAAK,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAe,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;AAC/H,CAAC"}

package/dist/db/evidence.d.ts

@@ -0,0 +1,37 @@
+import type Database from 'better-sqlite3';
+import type { Evidence } from '../types';
+import { type NormalizationVersion } from '../sync/normalize';
+import { type RecordPointer, type NormalizationCache } from '../sync/jsonl';
+import { type RootInput, type SourceIdentity } from '../sources/registry';
+export interface FrozenPointer {
+    version: 1 | 2;
+    source?: SourceIdentity;
+    original: RecordPointer;
+    normalization: NormalizationVersion;
+    edit?: RecordPointer & {
+        entry_id: string;
+        event_key: string;
+        normalization: NormalizationVersion;
+    };
+    clip?: {
+        limit: number;
+        normalization: NormalizationVersion;
+    };
+    text_hash: string;
+    legacy_edit_match?: true;
+}
+export declare const recordPointer: (row: RecordPointer) => RecordPointer;
+export declare function encodeEvidence(item: Evidence, pointer: FrozenPointer): string;
+/** Frozen membership, attribution and projection; original bytes stay in pi.
+ * Share one reader per snapshot/request rather than reopening a file per item. */
+export declare class EvidenceReader {
+    private db;
+    private reader;
+    private paths;
+    constructor(db: Database.Database, root?: RootInput, cache?: NormalizationCache);
+    project(item: Evidence, pointer: FrozenPointer): string;
+    read(value: string | Record<string, any>, tolerateUnavailable?: boolean): Evidence;
+    freeze(item: Evidence): string;
+    close(): void;
+}
+//# sourceMappingURL=evidence.d.ts.map

package/dist/db/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/db/evidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAgC,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAgB,KAAK,aAAa,EAAE,KAAK,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAA4C,KAAK,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAGpH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,QAAQ,EAAE,aAAa,CAAC;IACxB,aAAa,EAAE,oBAAoB,CAAC;IACpC,IAAI,CAAC,EAAE,aAAa,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,oBAAoB,CAAA;KAAE,CAAC;IACpG,IAAI,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,oBAAoB,CAAA;KAAE,CAAC;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,IAAI,CAAC;CAC1B;AAGD,eAAO,MAAM,aAAa,GAAI,KAAK,aAAa,KAAG,aAAqH,CAAC;AACzK,wBAAgB,cAAc,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAG7E;AAED;kFACkF;AAClF,qBAAa,cAAc;IAGb,OAAO,CAAC,EAAE;IAFtB,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,KAAK,CAAyC;gBAClC,EAAE,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,GAAE,SAA4B,EAAE,KAAK,CAAC,EAAE,kBAAkB;IACzG,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM;IA2BvD,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,mBAAmB,UAAQ,GAAG,QAAQ;IAYhF,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,MAAM;IAkB9B,KAAK;CACN"}