frely-cli 0.22.0 → 0.23.1

package/dist/skill/cloud-item.d.ts

@@ -1,4 +1,5 @@
 import { type SkillHost, type SkillScope } from "./managed.js";
+import { type SealedLease } from "./sealed.js";
 import { type InstallRecord } from "./registry.js";
 export declare const CLOUD_SKILL_ID: RegExp;
 /** Calls one Frely Cloud tool and returns its JSON result; a tool failure throws CloudToolError. */
@@ -15,6 +16,7 @@ interface ItemFile {
     readonly path: string;
     readonly contentBase64: string;
     readonly isScript: boolean;
+    readonly sealed?: true;
 }
 export interface CloudItemInstallResult {
     readonly id: string;
@@ -25,6 +27,8 @@ export interface CloudItemInstallResult {
     readonly files: number;
     readonly premium: "installed" | "pass_required" | "none";
     readonly hasScripts: boolean;
+    /** Paid scripts saved encrypted; they run through `frely item run` inside the command sandbox. */
+    readonly sealedScripts: number;
     /** True for a Skill without a passing Frely scan: its files must be read before it is used. */
     readonly needsReview: boolean;
     /** True when Frely's automated scan passed for exactly this version, so the item is already marked reviewed. */
@@ -45,7 +49,18 @@ export declare function installCloudItem(input: {
     readonly dir?: string;
     readonly cwd?: string;
     readonly home?: string;
+    readonly env?: NodeJS.ProcessEnv;
 }): Promise<CloudItemInstallResult>;
+export declare const SEALED_DIR = ".frely-sealed";
+export declare const SEALED_LEASE_FILE = ".frely-sealed/lease.json";
+export declare const sealedFilePath: (path: string) => string;
+export interface SealedLeaseRecord {
+    readonly skillId: string;
+    readonly version: number;
+    readonly lease: SealedLease;
+}
+/** Replaces the folder's lease; the lease is not part of the recorded file list, so a renewal never counts as an edit. */
+export declare function writeLease(folder: string, record: SealedLeaseRecord): Promise<void>;
 /** Remembers that the installed files of this version were reviewed, or reports whether they were. */
 export declare function trustCloudItem(folder: string, options?: {
     readonly check?: boolean;

package/dist/skill/cloud-item.js

@@ -4,6 +4,7 @@ import { lstat, mkdir, open, readFile, rename, unlink } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join, posix, resolve, win32 } from "node:path";
 import { assertManagedSkillPath, managedSkillRoot } from "./managed.js";
+import { loadOrCreateDeviceSealKey, parseLease, stubFor } from "./sealed.js";
 import { filesDigest, readInstall, untouched, writeInstall } from "./registry.js";
 export const CLOUD_SKILL_ID = /^cloud_skill_[0-9a-f]{24}$/u;
 const MAX_FILES = 512;
@@ -36,10 +37,14 @@ export async function installCloudItem(input) {
         throw new CloudItemError("input_invalid", "Use the item id shown in the marketplace, for example cloud_skill_0123456789abcdef01234567.");
     const free = parseContent(await input.call("skills.install", { skillId: input.skillId, part: "free" }), input.skillId);
     let files = free.files;
+    let lease = null;
     let premium = "none";
     if (free.manifest.premiumFileCount > 0) {
         try {
-            files = [...files, ...parseContent(await input.call("skills.install", { skillId: input.skillId, part: "premium" }), input.skillId).files];
+            const device = await loadOrCreateDeviceSealKey(input.env, input.home);
+            const paid = parseContent(await input.call("skills.install", { skillId: input.skillId, part: "premium", sealTo: device.publicKey }), input.skillId);
+            files = [...files, ...paid.files];
+            lease = paid.lease;
             premium = "installed";
         }
         catch (error) {
@@ -55,16 +60,43 @@ export async function installCloudItem(input) {
     const target = manifest.kind === "skill"
         ? join(managedSkillRoot(input.host ?? "generic", input.scope ?? "global", resolve(cwd, input.scope === "project" ? input.dir ?? "." : "."), home), manifest.slug)
         : join(resolve(cwd, input.dir ?? "."), manifest.slug);
-    const written = await writeItemFolder(target, manifest.id, manifest.kind, files, home);
+    const placed = placeSealedScripts(files);
+    const written = await writeItemFolder(target, manifest.id, manifest.kind, placed.files, home);
+    if (lease !== null && placed.sealed > 0)
+        await writeLease(target, { skillId: manifest.id, version: manifest.version, lease });
     // A passing scan is bound to this version's files on the server, so the local review is already done.
     const scanned = manifest.kind === "skill" && manifest.scanned;
     if (scanned)
         await writeInstall({ ...written, trustedDigest: filesDigest(written.files) }, home);
     return Object.freeze({
         id: manifest.id, kind: manifest.kind, name: manifest.displayName, version: manifest.version,
-        path: target, files: files.length, premium, hasScripts: manifest.hasScripts, needsReview: manifest.kind === "skill" && !scanned, scanned,
+        path: target, files: files.length, premium, hasScripts: manifest.hasScripts, sealedScripts: placed.sealed, needsReview: manifest.kind === "skill" && !scanned, scanned,
     });
 }
+export const SEALED_DIR = ".frely-sealed";
+export const SEALED_LEASE_FILE = `${SEALED_DIR}/lease.json`;
+export const sealedFilePath = (path) => `${SEALED_DIR}/files/${path}.sealed`;
+/** Each sealed script becomes its ciphertext under `.frely-sealed/files/` plus a plain placeholder at its own path. */
+function placeSealedScripts(files) {
+    const placed = [];
+    let sealed = 0;
+    for (const file of files) {
+        if (file.sealed !== true) {
+            placed.push(file);
+            continue;
+        }
+        sealed += 1;
+        placed.push({ path: sealedFilePath(file.path), contentBase64: file.contentBase64, isScript: false });
+        const stub = stubFor(file.path);
+        if (stub !== undefined)
+            placed.push({ path: file.path, contentBase64: Buffer.from(stub).toString("base64"), isScript: true });
+    }
+    return { files: placed, sealed };
+}
+/** Replaces the folder's lease; the lease is not part of the recorded file list, so a renewal never counts as an edit. */
+export async function writeLease(folder, record) {
+    await atomicWrite(join(folder, SEALED_LEASE_FILE), Buffer.from(JSON.stringify({ format: 1, ...record })));
+}
 /** Remembers that the installed files of this version were reviewed, or reports whether they were. */
 export async function trustCloudItem(folder, options = {}) {
     const home = options.home ?? homedir();
@@ -90,10 +122,15 @@ function parseContent(value, skillId) {
     let total = 0;
     const files = value.files.map((raw) => {
         const file = record(raw);
-        if (!file || typeof file.path !== "string" || typeof file.contentBase64 !== "string")
+        const sealed = file?.sealed === true;
+        const content = sealed ? file?.sealedBase64 : file?.contentBase64;
+        if (!file || typeof file.path !== "string" || typeof content !== "string")
             throw new CloudItemError("item_invalid", "Frely returned an invalid item file.");
-        total += Math.floor(file.contentBase64.length * 3 / 4);
-        return { path: safeRelativePath(file.path), contentBase64: file.contentBase64, isScript: file.isScript === true };
+        total += Math.floor(content.length * 3 / 4);
+        const path = safeRelativePath(file.path);
+        if (path === SEALED_DIR || path.startsWith(`${SEALED_DIR}/`))
+            throw new CloudItemError("item_invalid", "Frely returned an unsafe file path.");
+        return { path, contentBase64: content, isScript: file.isScript === true, ...(sealed ? { sealed: true } : {}) };
     });
     if (total > MAX_TOTAL_BYTES)
         throw new CloudItemError("item_invalid", "The item is too large.");
@@ -103,6 +140,7 @@ function parseContent(value, skillId) {
             hasScripts: manifest.hasScripts === true, premiumFileCount: typeof premium?.fileCount === "number" ? premium.fileCount : 0, scanned,
         },
         files,
+        lease: parseLease(manifest.lease),
     };
 }
 /** Item paths are canonical forward-slash relative paths on every platform; `join` maps them to the OS. */

package/dist/skill/cloud-item.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-item.js","sourceRoot":"","sources":["../../src/skill/cloud-item.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAmC,MAAM,cAAc,CAAC;AACzG,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAsB,MAAM,eAAe,CAAC;AAEtG,MAAM,CAAC,MAAM,cAAc,GAAG,6BAA6B,CAAC;AAC5D,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAKxC,MAAM,OAAO,cAAe,SAAQ,KAAK;IAClB;IAArB,YAAqB,IAAY;QAC/B,KAAK,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;QADvB,SAAI,GAAJ,IAAI,CAAQ;QAE/B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IAClB;IAArB,YAAqB,IAA0F,EAAE,OAAe;QAC9H,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAsF;QAE7G,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAoBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAQtC;IACC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,6FAA6F,CAAC,CAAC;IAClL,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACvH,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,IAAI,OAAO,GAAsC,MAAM,CAAC;IACxD,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,KAAK,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;YAC1I,OAAO,GAAG,WAAW,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB;gBAAE,MAAM,KAAK,CAAC;YAC9F,OAAO,GAAG,eAAe,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACrC,yFAAyF;IACzF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,KAAK,OAAO;QACtC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC;QACjK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACvF,sGAAsG;IACtG,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC;IAC9D,IAAI,OAAO;QAAE,MAAM,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACjG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;QAC3F,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO;KACzI,CAAC,CAAC;AACL,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,UAAgE,EAAE;IACrH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,sDAAsD,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,KAAK,MAAM,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAClG,MAAM,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B,EAAE,OAAe;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC;WAChG,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,yCAAyC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;WACnG,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC1J,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,KAAK,MAAM,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,CAAC;IAC3I,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;YAAE,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,sCAAsC,CAAC,CAAC;QACvK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;IACpH,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,GAAG,eAAe;QAAE,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAChG,OAAO;QACL,QAAQ,EAAE;YACR,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAiB;YAC7H,UAAU,EAAE,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,gBAAgB,EAAE,OAAO,OAAO,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO;SACpI;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACxN,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,MAAc,EAAE,IAA2B,EAAE,KAA0B,EAAE,IAAY;IACzI,MAAM,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAAc,EAAE,EAAE,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7H,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5C,MAAM,IAAI,cAAc,CAAC,uBAAuB,EAAE,kEAAkE,MAAM,2CAA2C,CAAC,CAAC;QACzK,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnJ,IAAI,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,cAAc,CAAC,uBAAuB,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACnL,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,GAAkB,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAClG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,KAAa;IACpD,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC5H,IAAI,CAAC;QAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;YAC/C,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAC/B,IAAI,CAAC;QAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;YAClE,CAAC;QAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjG,SAAS,MAAM,CAAC,KAAc,IAAoC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1L,SAAS,QAAQ,CAAC,KAAc,IAAa,OAAQ,KAA2C,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"cloud-item.js","sourceRoot":"","sources":["../../src/skill/cloud-item.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAmC,MAAM,cAAc,CAAC;AACzG,OAAO,EAAE,yBAAyB,EAAE,UAAU,EAAE,OAAO,EAAoB,MAAM,aAAa,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAsB,MAAM,eAAe,CAAC;AAEtG,MAAM,CAAC,MAAM,cAAc,GAAG,6BAA6B,CAAC;AAC5D,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAKxC,MAAM,OAAO,cAAe,SAAQ,KAAK;IAClB;IAArB,YAAqB,IAAY;QAC/B,KAAK,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;QADvB,SAAI,GAAJ,IAAI,CAAQ;QAE/B,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,OAAO,cAAe,SAAQ,KAAK;IAClB;IAArB,YAAqB,IAA0F,EAAE,OAAe;QAC9H,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAsF;QAE7G,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAsBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAStC;IACC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,6FAA6F,CAAC,CAAC;IAClL,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACvH,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,IAAI,KAAK,GAAuB,IAAI,CAAC;IACrC,IAAI,OAAO,GAAsC,MAAM,CAAC;IACxD,IAAI,IAAI,CAAC,QAAQ,CAAC,gBAAgB,GAAG,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACtE,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACpJ,KAAK,GAAG,CAAC,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAClC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACnB,OAAO,GAAG,WAAW,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,cAAc,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB;gBAAE,MAAM,KAAK,CAAC;YAC9F,OAAO,GAAG,eAAe,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACrC,yFAAyF;IACzF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,KAAK,OAAO;QACtC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,EAAE,KAAK,CAAC,KAAK,IAAI,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC;QACjK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9F,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,UAAU,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9H,sGAAsG;IACtG,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC;IAC9D,IAAI,OAAO;QAAE,MAAM,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACjG,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;QAC3F,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO;KACvK,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,eAAe,CAAC;AAC1C,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,UAAU,aAAa,CAAC;AAC5D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,GAAG,UAAU,UAAU,IAAI,SAAS,CAAC;AAE7F,uHAAuH;AACvH,SAAS,kBAAkB,CAAC,KAA0B;IACpD,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,CAAC;QACZ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACrG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAChI,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAID,0HAA0H;AAC1H,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,MAAyB;IACxE,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5G,CAAC;AAED,sGAAsG;AACtG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,UAAgE,EAAE;IACrH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,sDAAsD,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,KAAK,MAAM,IAAI,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAClG,MAAM,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B,EAAE,OAAe;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC;WAChG,OAAO,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,yCAAyC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;WACnG,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,SAAS,EAAE,CAAC;QAC1J,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,KAAK,MAAM,IAAI,OAAO,QAAQ,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,cAAc,CAAC;IAC3I,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC;QAClE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,sCAAsC,CAAC,CAAC;QAC5J,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;YAAE,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAC;QAC9I,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1H,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,GAAG,eAAe;QAAE,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;IAChG,OAAO;QACL,QAAQ,EAAE;YACR,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAiB;YAC7H,UAAU,EAAE,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,gBAAgB,EAAE,OAAO,OAAO,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO;SACpI;QACD,KAAK;QACL,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,2GAA2G;AAC3G,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACxN,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,qCAAqC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,MAAc,EAAE,IAA2B,EAAE,KAA0B,EAAE,IAAY;IACzI,MAAM,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAAc,EAAE,EAAE,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7H,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC5C,MAAM,IAAI,cAAc,CAAC,uBAAuB,EAAE,kEAAkE,MAAM,2CAA2C,CAAC,CAAC;QACzK,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,GAAG,IAAI,QAAQ,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnJ,IAAI,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,cAAc,CAAC,uBAAuB,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACnL,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,MAAM,GAAkB,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAClG,MAAM,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,KAAa;IACpD,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC5H,IAAI,CAAC;QAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;YAC/C,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IAC/B,IAAI,CAAC;QAAC,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;YAClE,CAAC;QAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAAC,CAAC;AAC7D,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjG,SAAS,MAAM,CAAC,KAAc,IAAoC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1L,SAAS,QAAQ,CAAC,KAAc,IAAa,OAAQ,KAA2C,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC"}

package/dist/skill/sealed-run.d.ts

@@ -0,0 +1,20 @@
+import { type CloudToolCaller } from "./cloud-item.js";
+export interface RunSealedScriptInput {
+    /** The script as the agent names it: the placeholder file, or `<item folder>/<script path>`. */
+    readonly target: string;
+    readonly args: readonly string[];
+    readonly call: CloudToolCaller;
+    readonly cwd?: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly home?: string;
+    readonly now?: () => Date;
+    /** Wraps the command for the Frely command sandbox; defaults to the same sandbox `run_command` uses. */
+    readonly sandbox?: (command: string, workspaceRoot: string) => Promise<string>;
+}
+/**
+ * Runs one sealed script of an installed item inside the Frely command sandbox and returns its exit code.
+ * The item's files are copied to a private temporary folder with every sealed script decrypted, so scripts that import
+ * or read their neighbours work; the folder is removed when the script ends. A script that cannot be run in the sandbox
+ * (no sandbox on this device) is refused, never run without it.
+ */
+export declare function runSealedScript(input: RunSealedScriptInput): Promise<number>;

package/dist/skill/sealed-run.js

@@ -0,0 +1,130 @@
+import { spawn } from "node:child_process";
+import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { homedir, tmpdir } from "node:os";
+import { dirname, join, posix, relative, resolve, sep } from "node:path";
+import { sandboxCommand } from "../runtime/sandbox.js";
+import { CloudItemError, CloudToolError, SEALED_DIR, SEALED_LEASE_FILE, sealedFilePath, writeLease } from "./cloud-item.js";
+import { readInstall } from "./registry.js";
+import { interpreterFor, loadOrCreateDeviceSealKey, openSealedFile, parseLease, unwrapLease } from "./sealed.js";
+/** A lease with less than this left is renewed before the run, when the server can be reached. */
+const RENEW_BELOW_MS = 3 * 24 * 3600 * 1000;
+const RENEW_WAIT_MS = 8000;
+const MAX_ROOT_SEARCH = 8;
+const quote = (value) => /^[\w./:@%+=,-]+$/u.test(value) ? value : `'${value.replace(/'/gu, `'\\''`)}'`;
+/**
+ * Runs one sealed script of an installed item inside the Frely command sandbox and returns its exit code.
+ * The item's files are copied to a private temporary folder with every sealed script decrypted, so scripts that import
+ * or read their neighbours work; the folder is removed when the script ends. A script that cannot be run in the sandbox
+ * (no sandbox on this device) is refused, never run without it.
+ */
+export async function runSealedScript(input) {
+    const cwd = input.cwd ?? process.cwd();
+    const now = input.now ?? (() => new Date());
+    const { root, relativePath, marker } = await locateItem(resolve(cwd, input.target), input.home ?? homedir());
+    const interpreter = interpreterFor(relativePath);
+    if (!interpreter)
+        throw new CloudItemError("input_invalid", `Frely cannot run ${relativePath}: its script type has no known interpreter.`);
+    const sealedPaths = Object.keys(marker.files).filter((path) => path.startsWith(`${SEALED_DIR}/files/`) && path.endsWith(".sealed"));
+    if (!sealedPaths.includes(sealedFilePath(relativePath)))
+        throw new CloudItemError("input_invalid", `${relativePath} is not a sealed script of this item.`);
+    const device = await loadOrCreateDeviceSealKey(input.env, input.home);
+    const record = await currentLease({ root, marker, device, call: input.call, now });
+    const versionKey = unwrapLease(device, record.lease, record.skillId, record.version);
+    const workDir = await mkdtemp(join(tmpdir(), "frely-item-run-"));
+    try {
+        await chmod(workDir, 0o700);
+        for (const path of Object.keys(marker.files)) {
+            if (path.startsWith(`${SEALED_DIR}/`))
+                continue;
+            await put(workDir, path, await readFile(join(root, ...path.split("/"))));
+        }
+        for (const sealedPath of sealedPaths) {
+            const path = sealedPath.slice(`${SEALED_DIR}/files/`.length, -".sealed".length);
+            await put(workDir, path, openSealedFile(versionKey, record.skillId, record.version, path, Buffer.from(await readFile(join(root, ...sealedPath.split("/"))))));
+        }
+        const script = join(workDir, ...relativePath.split("/"));
+        const command = [...interpreter, script, ...input.args].map(quote).join(" ");
+        const wrapped = await (input.sandbox ?? sandboxCommand)(command, cwd);
+        return await new Promise((done, fail) => {
+            const child = spawn(wrapped, { shell: true, cwd, stdio: "inherit", env: input.env ?? process.env });
+            child.once("error", fail);
+            child.once("close", (code, signal) => done(code ?? (signal ? 128 : 1)));
+        });
+    }
+    finally {
+        await rm(workDir, { recursive: true, force: true });
+    }
+}
+async function put(workDir, path, content) {
+    const target = join(workDir, ...path.split("/"));
+    await mkdir(dirname(target), { recursive: true, mode: 0o700 });
+    await writeFile(target, content, { mode: 0o600 });
+}
+/** The item folder a script belongs to: the nearest parent that has an install record. */
+async function locateItem(target, home) {
+    let folder = dirname(target);
+    for (let depth = 0; depth < MAX_ROOT_SEARCH; depth += 1) {
+        const marker = await readInstall(folder, home);
+        if (marker) {
+            const relativePath = relative(folder, target).split(sep).join(posix.sep);
+            if (relativePath.startsWith("..") || relativePath === "")
+                throw new CloudItemError("input_invalid", "The script is outside its item folder.");
+            return { root: folder, relativePath, marker };
+        }
+        const parent = dirname(folder);
+        if (parent === folder)
+            break;
+        folder = parent;
+    }
+    throw new CloudItemError("item_invalid", "This script is not inside an item installed by frely item install.");
+}
+/** The lease to use for this run: the stored one while it lasts, renewed when it is near its end or has ended. */
+async function currentLease(input) {
+    const stored = await readStoredLease(input.root);
+    const remaining = stored ? Date.parse(stored.lease.expiresAt) - input.now().getTime() : -1;
+    if (stored && remaining > RENEW_BELOW_MS)
+        return stored;
+    const skillId = stored?.skillId ?? input.marker.itemId;
+    try {
+        const renewed = await withTimeout(renew(input.call, skillId, input.device), stored && remaining > 0 ? RENEW_WAIT_MS : 180000);
+        await writeLease(input.root, renewed);
+        return renewed;
+    }
+    catch (error) {
+        if (error instanceof CloudToolError && error.code === "creator_pass_required") {
+            await rm(join(input.root, ...SEALED_LEASE_FILE.split("/")), { force: true });
+            throw new CloudItemError("input_invalid", "Your access to this item has ended, so its sealed scripts no longer run. Buy a pass, then run frely item install again.");
+        }
+        if (stored && remaining > 0)
+            return stored;
+        throw new CloudItemError("input_invalid", "The access lease for this item's sealed scripts has ended and could not be renewed. Connect to the internet and try again.");
+    }
+}
+async function renew(call, skillId, device) {
+    const value = await call("skills.install", { skillId, part: "premium", sealTo: device.publicKey, leaseOnly: true });
+    const manifest = value.manifest;
+    const lease = parseLease(manifest?.lease);
+    if (!lease || !Number.isSafeInteger(manifest?.version))
+        throw new CloudItemError("item_invalid", "Frely returned an invalid lease.");
+    return { skillId, version: manifest.version, lease };
+}
+async function readStoredLease(root) {
+    const raw = await readFile(join(root, ...SEALED_LEASE_FILE.split("/")), "utf8").catch(() => null);
+    if (raw === null)
+        return null;
+    try {
+        const value = JSON.parse(raw);
+        const lease = parseLease(value.lease);
+        if (value.format !== 1 || typeof value.skillId !== "string" || !Number.isSafeInteger(value.version) || !lease)
+            return null;
+        return { skillId: value.skillId, version: value.version, lease };
+    }
+    catch {
+        return null;
+    }
+}
+function withTimeout(work, ms) {
+    let timer;
+    return Promise.race([work, new Promise((_, reject) => { timer = setTimeout(() => reject(new Error("lease renewal timed out")), ms); })]).finally(() => clearTimeout(timer));
+}
+//# sourceMappingURL=sealed-run.js.map

package/dist/skill/sealed-run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed-run.js","sourceRoot":"","sources":["../../src/skill/sealed-run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,UAAU,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAgD,MAAM,iBAAiB,CAAC;AAC1K,OAAO,EAAE,WAAW,EAAsB,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,yBAAyB,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAsB,MAAM,aAAa,CAAC;AAErI,kGAAkG;AAClG,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC5C,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,eAAe,GAAG,CAAC,CAAC;AAe1B,MAAM,KAAK,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC;AAExH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;IAC7G,MAAM,WAAW,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,oBAAoB,YAAY,6CAA6C,CAAC,CAAC;IAC3I,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACpI,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,GAAG,YAAY,uCAAuC,CAAC,CAAC;IAE3J,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAErF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;gBAAE,SAAS;YAChD,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,UAAU,SAAS,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAChF,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChK,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,CAAC,GAAG,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7E,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACtE,OAAO,MAAM,IAAI,OAAO,CAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACpG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,OAAe,EAAE,IAAY,EAAE,OAAe;IAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACjD,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,MAAM,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACpD,CAAC;AAID,0FAA0F;AAC1F,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY;IACpD,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,eAAe,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC/C,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACzE,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,KAAK,EAAE;gBAAE,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,wCAAwC,CAAC,CAAC;YAC9I,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;QAChD,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,MAAM;YAAE,MAAM;QAC7B,MAAM,GAAG,MAAM,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,oEAAoE,CAAC,CAAC;AACjH,CAAC;AAED,kHAAkH;AAClH,KAAK,UAAU,YAAY,CAAC,KAAsG;IAChI,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3F,IAAI,MAAM,IAAI,SAAS,GAAG,cAAc;QAAE,OAAO,MAAM,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;IACvD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9H,MAAM,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,uBAAuB,EAAE,CAAC;YAC9E,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,yHAAyH,CAAC,CAAC;QACvK,CAAC;QACD,IAAI,MAAM,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;QAC3C,MAAM,IAAI,cAAc,CAAC,eAAe,EAAE,4HAA4H,CAAC,CAAC;IAC1K,CAAC;AACH,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,IAAqB,EAAE,OAAe,EAAE,MAAqB;IAChF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpH,MAAM,QAAQ,GAAG,KAAK,CAAC,QAA8D,CAAC;IACtF,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC;QAAE,MAAM,IAAI,cAAc,CAAC,cAAc,EAAE,kCAAkC,CAAC,CAAC;IACrI,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAS,CAAC,OAAiB,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY;IACzC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAClG,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgF,CAAC;QAC7G,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC3H,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAiB,EAAE,KAAK,EAAE,CAAC;IAC7E,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAI,IAAgB,EAAE,EAAU;IAClD,IAAI,KAAgD,CAAC;IACrD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;AACrL,CAAC"}

package/dist/skill/sealed.d.ts

@@ -0,0 +1,32 @@
+import { type KeyObject } from "node:crypto";
+/**
+ * Sealed scripts of a download-install item. The server encrypts every paid script with a key derived for the item
+ * version and sends that key only as a lease wrapped to this device's X25519 key, with an expiry the server signs
+ * into the wrapping. The installed folder holds ciphertext and a lease, so a copy of it opens on no other device.
+ * This does not hide a script from the agent or the user on this device; it stops copying the folder.
+ */
+export interface SealedLease {
+    readonly keyId: string;
+    readonly expiresAt: string;
+    readonly ephemeralPublicKey: string;
+    readonly nonce: string;
+    readonly wrappedKey: string;
+}
+export interface DeviceSealKey {
+    /** Raw X25519 public key, base64url: what `skills.install` takes as `sealTo`. */
+    readonly publicKey: string;
+    readonly privateKey: KeyObject;
+}
+/** This device's lease key, created on first use in the owner-only Frely config directory (which the command sandbox never opens). */
+export declare function loadOrCreateDeviceSealKey(env?: NodeJS.ProcessEnv, home?: string): Promise<DeviceSealKey>;
+/** The version key a lease carries; throws when the lease is not for this device or its expiry was changed. */
+export declare function unwrapLease(device: DeviceSealKey, lease: SealedLease, skillId: string, version: number): Buffer;
+/** Decrypts one sealed file (`nonce(12) | ciphertext | tag(16)`). */
+export declare function openSealedFile(versionKey: Buffer, skillId: string, version: number, path: string, sealed: Buffer): Buffer;
+export declare function parseLease(value: unknown): SealedLease | null;
+export declare function interpreterFor(path: string): readonly string[] | undefined;
+/**
+ * Plain placeholder written where a sealed script was, so `python scripts/run.py` keeps working unchanged: it hands over to
+ * `frely item run`, which decrypts and runs the real script in the Frely sandbox. Undefined for script types without a placeholder.
+ */
+export declare function stubFor(path: string): string | undefined;

package/dist/skill/sealed.js

@@ -0,0 +1,82 @@
+import { createDecipheriv, createPrivateKey, createPublicKey, diffieHellman, generateKeyPairSync, hkdfSync } from "node:crypto";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { ensureCredentialDirectory, readPrivateFile, writePrivateFile } from "../credential-file.js";
+const WRAP_INFO = Buffer.from("frely.cloud-skill.seal.wrap.v1");
+const FILE_INFO = "frely.cloud-skill.seal.file.v1|";
+const KEY_FILE = "sealed-device-key-v1.json";
+const keyFilePath = (env, home) => join(resolve(env.XDG_CONFIG_HOME || join(home, ".config")), "frely", KEY_FILE);
+/** This device's lease key, created on first use in the owner-only Frely config directory (which the command sandbox never opens). */
+export async function loadOrCreateDeviceSealKey(env = process.env, home = homedir()) {
+    const path = keyFilePath(env, home);
+    const existing = await readPrivateFile(path);
+    if (existing !== null) {
+        const stored = JSON.parse(existing);
+        if (stored.version !== 1 || typeof stored.privateKeyPem !== "string")
+            throw new Error("The sealed-item key file is invalid.");
+        return fromPrivate(createPrivateKey(stored.privateKeyPem));
+    }
+    const pair = generateKeyPairSync("x25519");
+    await ensureCredentialDirectory(dirname(path), true);
+    await writePrivateFile(path, JSON.stringify({ version: 1, privateKeyPem: pair.privateKey.export({ type: "pkcs8", format: "pem" }).toString() }) + "\n");
+    return fromPrivate(pair.privateKey);
+}
+function fromPrivate(privateKey) {
+    return { privateKey, publicKey: String(createPublicKey(privateKey).export({ format: "jwk" }).x) };
+}
+/** The version key a lease carries; throws when the lease is not for this device or its expiry was changed. */
+export function unwrapLease(device, lease, skillId, version) {
+    const shared = diffieHellman({ privateKey: device.privateKey, publicKey: createPublicKey({ key: { kty: "OKP", crv: "X25519", x: lease.ephemeralPublicKey }, format: "jwk" }) });
+    const salt = Buffer.concat([Buffer.from(lease.ephemeralPublicKey, "base64url"), Buffer.from(device.publicKey, "base64url")]);
+    const wrapKey = Buffer.from(hkdfSync("sha256", shared, salt, WRAP_INFO, 32));
+    const body = Buffer.from(lease.wrappedKey, "base64url");
+    const decipher = createDecipheriv("aes-256-gcm", wrapKey, Buffer.from(lease.nonce, "base64url"));
+    decipher.setAAD(Buffer.from(`${lease.keyId}|${skillId}|${version}|${lease.expiresAt}`));
+    decipher.setAuthTag(body.subarray(body.length - 16));
+    return Buffer.concat([decipher.update(body.subarray(0, body.length - 16)), decipher.final()]);
+}
+/** Decrypts one sealed file (`nonce(12) | ciphertext | tag(16)`). */
+export function openSealedFile(versionKey, skillId, version, path, sealed) {
+    const fileKey = Buffer.from(hkdfSync("sha256", versionKey, Buffer.alloc(0), Buffer.from(FILE_INFO + path), 32));
+    const decipher = createDecipheriv("aes-256-gcm", fileKey, sealed.subarray(0, 12));
+    decipher.setAAD(Buffer.from(`${skillId}|${version}|${path}`));
+    decipher.setAuthTag(sealed.subarray(sealed.length - 16));
+    return Buffer.concat([decipher.update(sealed.subarray(12, sealed.length - 16)), decipher.final()]);
+}
+export function parseLease(value) {
+    const record = value !== null && typeof value === "object" ? value : null;
+    if (!record)
+        return null;
+    const { keyId, expiresAt, ephemeralPublicKey, nonce, wrappedKey } = record;
+    if (![keyId, expiresAt, ephemeralPublicKey, nonce, wrappedKey].every((field) => typeof field === "string" && field.length > 0 && field.length < 512) || Number.isNaN(Date.parse(expiresAt)))
+        return null;
+    return { keyId, expiresAt, ephemeralPublicKey, nonce, wrappedKey };
+}
+const PYTHON = process.platform === "win32" ? "python" : "python3";
+const INTERPRETERS = {
+    ".py": [PYTHON], ".sh": ["bash"], ".bash": ["bash"], ".js": ["node"], ".cjs": ["node"], ".mjs": ["node"], ".rb": ["ruby"], ".pl": ["perl"],
+};
+export function interpreterFor(path) {
+    return INTERPRETERS[path.slice(path.lastIndexOf(".")).toLowerCase()];
+}
+/**
+ * Plain placeholder written where a sealed script was, so `python scripts/run.py` keeps working unchanged: it hands over to
+ * `frely item run`, which decrypts and runs the real script in the Frely sandbox. Undefined for script types without a placeholder.
+ */
+export function stubFor(path) {
+    const extension = path.slice(path.lastIndexOf(".")).toLowerCase();
+    if (extension === ".py")
+        return 'import os, sys\nos.execvp("frely", ["frely", "item", "run", os.path.abspath(__file__), *sys.argv[1:]])\n';
+    if (extension === ".sh" || extension === ".bash")
+        return 'exec frely item run "$0" "$@"\n';
+    if (extension === ".js" || extension === ".cjs")
+        return 'const r = require("node:child_process").spawnSync("frely", ["item", "run", __filename, ...process.argv.slice(2)], { stdio: "inherit" });\nprocess.exit(r.status ?? 1);\n';
+    if (extension === ".mjs")
+        return 'import { spawnSync } from "node:child_process";\nimport { fileURLToPath } from "node:url";\nconst r = spawnSync("frely", ["item", "run", fileURLToPath(import.meta.url), ...process.argv.slice(2)], { stdio: "inherit" });\nprocess.exit(r.status ?? 1);\n';
+    if (extension === ".rb")
+        return 'exec("frely", "item", "run", File.expand_path(__FILE__), *ARGV)\n';
+    if (extension === ".pl")
+        return 'exec("frely", "item", "run", $0, @ARGV) or die "frely: $!";\n';
+    return undefined;
+}
+//# sourceMappingURL=sealed.js.map

package/dist/skill/sealed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sealed.js","sourceRoot":"","sources":["../../src/skill/sealed.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,mBAAmB,EAAE,QAAQ,EAAkB,MAAM,aAAa,CAAC;AAChJ,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAuBrG,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;AAChE,MAAM,SAAS,GAAG,iCAAiC,CAAC;AACpD,MAAM,QAAQ,GAAG,2BAA2B,CAAC;AAE7C,MAAM,WAAW,GAAG,CAAC,GAAsB,EAAE,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAErJ,sIAAsI;AACtI,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,EAAE;IACpG,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAmD,CAAC;QACtF,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC9H,OAAO,WAAW,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACxJ,OAAO,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,UAAqB;IACxC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpG,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,WAAW,CAAC,MAAqB,EAAE,KAAkB,EAAE,OAAe,EAAE,OAAe;IACrG,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAChL,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;IAC7H,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IACjG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,IAAI,OAAO,IAAI,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACxF,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,OAAe,EAAE,OAAe,EAAE,IAAY,EAAE,MAAc;IAC/G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAClF,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9D,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrG,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IAC3E,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAmB,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACnN,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,kBAAkB,EAAE,KAAK,EAAE,UAAU,EAAiB,CAAC;AACpF,CAAC;AAED,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACnE,MAAM,YAAY,GAAgD;IAChE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC;CAC3I,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACvE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,0GAA0G,CAAC;IAC3I,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,OAAO;QAAE,OAAO,iCAAiC,CAAC;IAC3F,IAAI,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,0KAA0K,CAAC;IACnO,IAAI,SAAS,KAAK,MAAM;QAAE,OAAO,4PAA4P,CAAC;IAC9R,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,mEAAmE,CAAC;IACpG,IAAI,SAAS,KAAK,KAAK;QAAE,OAAO,+DAA+D,CAAC;IAChG,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frely-cli",
-  "version": "0.22.0",
+  "version": "0.23.1",
   "description": "Frely CLI — FrelyMCP gives ChatGPT, Claude, Codex and other MCP clients access to your computer",
   "license": "Apache-2.0",
   "repository": {