frely-cli 0.7.1 → 0.8.4

package/dist/agent/agent-service.js

@@ -0,0 +1,348 @@
+/**
+ * AgentService: orchestrates agent tasks end-to-end — validation, worktrees,
+ * the agent host process, events, budget, and the merge workflow. This is the
+ * single implementation behind the GUI, the device relay (`method: "agent"`),
+ * and the `frely app` CLI.
+ */
+import { randomBytes } from "node:crypto";
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { FairRwScheduler } from "../runtime/scheduler.js";
+import { AgentToolExecutor, toolKindFromMethod } from "./tool-executor.js";
+import { AGENT_DEFAULT_MAX_COST_USD, AGENT_MAX_COST_USD_LIMIT, AGENT_DEFAULT_MAX_CONCURRENT_TASKS, AGENT_START_RATE_LIMIT_PER_MINUTE, AGENT_TASK_MAX_GOAL_BYTES, AgentStoreError, agentConfigPath, isTerminalStatus, nextRuntimeStatus, TaskStore, } from "./task-store.js";
+import { newTaskId } from "./protocol.js";
+import { branchNameForTask, createTaskWorktree, mergeTaskBranch, removeTaskWorktree, taskDiff, WorktreeError } from "./worktrees.js";
+export class AgentServiceError extends Error {
+    code;
+    constructor(code, message) {
+        super(message ?? code);
+        this.code = code;
+        this.name = "AgentServiceError";
+    }
+}
+export const DEFAULT_AGENT_CONFIG = {
+    schemaVersion: 1,
+    remoteControlEnabled: false,
+    defaultMaxCostUsd: AGENT_DEFAULT_MAX_COST_USD,
+    maxCostUsdLimit: AGENT_MAX_COST_USD_LIMIT,
+    maxConcurrentTasks: AGENT_DEFAULT_MAX_CONCURRENT_TASKS,
+};
+export async function loadAgentConfig(env = process.env) {
+    try {
+        const raw = JSON.parse(await readFile(agentConfigPath(env), "utf8"));
+        return {
+            schemaVersion: 1,
+            remoteControlEnabled: raw.remoteControlEnabled === true,
+            defaultMaxCostUsd: boundedCost(raw.defaultMaxCostUsd, AGENT_DEFAULT_MAX_COST_USD),
+            maxCostUsdLimit: boundedCost(raw.maxCostUsdLimit, AGENT_MAX_COST_USD_LIMIT),
+            maxConcurrentTasks: boundedConcurrency(raw.maxConcurrentTasks),
+        };
+    }
+    catch {
+        return { ...DEFAULT_AGENT_CONFIG };
+    }
+}
+export async function saveAgentConfig(config, env = process.env) {
+    const path = agentConfigPath(env);
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const tmp = `${path}.${randomBytes(8).toString("hex")}.tmp`;
+    await writeFile(tmp, `${JSON.stringify(config, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    await rename(tmp, path);
+}
+function boundedCost(value, fallback) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0 && value <= AGENT_MAX_COST_USD_LIMIT ? value : fallback;
+}
+function boundedConcurrency(value) {
+    return typeof value === "number" && Number.isSafeInteger(value) && value >= 1 && value <= 4 ? value : AGENT_DEFAULT_MAX_CONCURRENT_TASKS;
+}
+export class AgentService {
+    deps;
+    executors = new Map();
+    scheduler = new FairRwScheduler(4);
+    credentialsSent = false;
+    budgetCancels = new Set();
+    _supervisor = null;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    supervisor() {
+        this._supervisor ??= this.deps.resolveSupervisor();
+        return this._supervisor;
+    }
+    async startTask(input) {
+        const goal = typeof input.goal === "string" ? input.goal.trim() : "";
+        if (goal.length === 0 || Buffer.byteLength(goal) > AGENT_TASK_MAX_GOAL_BYTES)
+            throw new AgentServiceError("invalid_args", "goal must be 1..65536 bytes.");
+        if (typeof input.workspace !== "string" || input.workspace.length === 0)
+            throw new AgentServiceError("invalid_args", "workspace is required.");
+        const config = (await this.deps.config?.()) ?? DEFAULT_AGENT_CONFIG;
+        if (input.source.kind !== "gui" && !config.remoteControlEnabled)
+            throw new AgentServiceError("remote_control_disabled", "Run `frely app remote enable` first.");
+        const maxCostUsd = boundedCost(input.maxCostUsd ?? config.defaultMaxCostUsd, config.defaultMaxCostUsd);
+        const tasks = await this.deps.store.list();
+        const now = Date.now();
+        const active = tasks.filter((task) => !isTerminalStatus(task.status));
+        if (active.length >= config.maxConcurrentTasks)
+            throw new AgentServiceError("too_many_tasks");
+        const recentStarts = tasks.filter((task) => now - Date.parse(task.createdAt) < 60_000).length;
+        if (recentStarts >= AGENT_START_RATE_LIMIT_PER_MINUTE)
+            throw new AgentServiceError("rate_limited");
+        let worktree;
+        const taskId = newTaskId();
+        try {
+            worktree = await createTaskWorktree(taskId, input.workspace);
+        }
+        catch (error) {
+            if (error instanceof WorktreeError) {
+                if (error.code === "not_a_git_repo")
+                    throw new AgentServiceError("workspace_not_git_repo");
+                if (error.code === "dirty_workspace")
+                    throw new AgentServiceError("workspace_dirty");
+            }
+            throw error;
+        }
+        const id = taskId;
+        const record = {
+            id,
+            source: input.source,
+            workspace: input.workspace,
+            worktreePath: worktree.path,
+            branch: worktree.branch,
+            baseBranch: worktree.baseBranch,
+            baseCommit: worktree.baseCommit,
+            goal,
+            model: input.model ?? null,
+            maxCostUsd,
+            status: "queued",
+            mergeStatus: "none",
+            usage: { inputTokens: 0, outputTokens: 0, costUsd: 0 },
+            error: null,
+            mergeRequest: null,
+            approval: null,
+            createdAt: new Date().toISOString(),
+            updatedAt: new Date().toISOString(),
+            settledAt: null,
+        };
+        await this.deps.store.create(record);
+        try {
+            const connection = await this.ensureHostWithCredentials();
+            this.executors.set(id, new AgentToolExecutor(worktree.path, this.scheduler));
+            await connection.request("task.start", {
+                taskId: id,
+                worktreePath: worktree.path,
+                goal,
+                model: input.model ?? null,
+                budgetUsd: maxCostUsd,
+                baseBranch: worktree.baseBranch,
+                baseCommit: worktree.baseCommit,
+            });
+        }
+        catch (error) {
+            this.executors.delete(id);
+            await this.deps.store.update(id, (task) => ({ ...task, status: "failed", error: error instanceof Error ? error.message : "task start failed", settledAt: new Date().toISOString() }));
+            await this.deps.store.appendEvent(id, { type: "status", status: "failed", detail: "Agent host unavailable." });
+            if (error instanceof AgentServiceError)
+                throw error;
+            throw new AgentServiceError("host_unavailable", error instanceof Error ? error.message : "agent host unavailable");
+        }
+        return (await this.deps.store.read(id));
+    }
+    async listTasks(workspace) {
+        const tasks = await this.deps.store.list();
+        return workspace ? tasks.filter((task) => task.workspace === workspace) : tasks;
+    }
+    async getTask(id) {
+        return this.deps.store.read(id);
+    }
+    async getEvents(id, cursor = 0) {
+        return this.deps.store.readEvents(id, cursor);
+    }
+    async sendMessage(id, message) {
+        if (typeof message !== "string" || message.length === 0 || message.length > 64 * 1024)
+            throw new AgentServiceError("invalid_args");
+        const task = await this.deps.store.read(id);
+        if (task.status !== "running" && task.status !== "waiting_input")
+            throw new AgentServiceError("invalid_state", `Cannot send a message to a ${task.status} task.`);
+        const connection = await this.supervisor().ensureHost();
+        await connection.request("task.message", { taskId: id, message });
+    }
+    async cancelTask(id) {
+        const task = await this.deps.store.read(id);
+        if (isTerminalStatus(task.status))
+            return task;
+        if (task.status === "queued" && !this.executors.has(id)) {
+            return this.settleCancelled(id, "Cancelled before start.");
+        }
+        try {
+            const connection = await this.supervisor().ensureHost();
+            await connection.request("task.cancel", { taskId: id, reason: "User requested cancellation." }, 10_000);
+        }
+        catch (error) {
+            this.debug("agent.task.cancel_failed", id, error);
+            return this.settleCancelled(id, "Cancelled (host unreachable).");
+        }
+        return this.deps.store.read(id);
+    }
+    async settleCancelled(id, detail) {
+        this.executors.delete(id);
+        const record = await this.deps.store.update(id, (task) => ({ ...task, status: "cancelled", settledAt: new Date().toISOString() }));
+        await this.deps.store.appendEvent(id, { type: "status", status: "cancelled", detail });
+        return record;
+    }
+    async getDiff(id, path) {
+        const task = await this.deps.store.read(id);
+        try {
+            return await taskDiff(id, task.workspace, path);
+        }
+        catch (error) {
+            if (error instanceof WorktreeError && error.code === "not_a_git_repo")
+                throw new AgentServiceError("workspace_not_git_repo");
+            throw new AgentServiceError("internal", error instanceof Error ? error.message : "diff failed");
+        }
+    }
+    async requestMerge(id, note) {
+        const task = await this.deps.store.read(id);
+        if (task.status !== "completed")
+            throw new AgentServiceError("invalid_state", "Only completed tasks can request a merge.");
+        if (task.mergeStatus !== "none")
+            throw new AgentServiceError("invalid_state", `Merge already ${task.mergeStatus}.`);
+        return this.deps.store.update(id, (record) => ({
+            ...record,
+            mergeStatus: "merge_requested",
+            mergeRequest: { requestedAt: new Date().toISOString(), ...(note !== undefined && note.length > 0 ? { note: note.slice(0, 2048) } : {}) },
+        }));
+    }
+    async approveMerge(id, approvedBy) {
+        const task = await this.deps.store.read(id);
+        if (task.mergeStatus !== "merge_requested")
+            throw new AgentServiceError("invalid_state", `Merge state is ${task.mergeStatus}.`);
+        const approved = await this.deps.store.update(id, (record) => ({
+            ...record,
+            mergeStatus: "approved",
+            approval: { approvedAt: new Date().toISOString(), approvedBy },
+        }));
+        const outcome = await mergeTaskBranch(id, task.workspace);
+        if (outcome.status === "merged") {
+            await removeTaskWorktree(id, task.workspace).catch(() => undefined);
+            return this.deps.store.update(id, (record) => ({ ...record, mergeStatus: "merged" }));
+        }
+        return this.deps.store.update(id, (record) => ({ ...record, mergeStatus: "merge_conflict", error: outcome.detail }));
+    }
+    async discardTask(id) {
+        const task = await this.deps.store.read(id);
+        if (task.mergeStatus === "merged" || task.mergeStatus === "discarded")
+            throw new AgentServiceError("invalid_state", `Task already ${task.mergeStatus}.`);
+        await removeTaskWorktree(id, task.workspace).catch(() => undefined);
+        this.executors.delete(id);
+        return this.deps.store.update(id, (record) => ({ ...record, mergeStatus: "discarded" }));
+    }
+    async stopHost() {
+        for (const executor of this.executors.values())
+            executor.dispose();
+        this.executors.clear();
+        await this.supervisor().stop();
+    }
+    status() {
+        return { host: this.supervisor().status() };
+    }
+    // --- host wiring ---------------------------------------------------------
+    async ensureHostWithCredentials() {
+        const connection = await this.supervisor().ensureHost();
+        if (!this.credentialsSent) {
+            const credentials = this.deps.modelCredentials?.();
+            if (credentials)
+                connection.notify("model.credentials", credentials);
+            this.credentialsSent = true;
+        }
+        return connection;
+    }
+    debug(event, taskId, error) {
+        this.deps.log?.(JSON.stringify({ timestamp: new Date().toISOString(), pid: process.pid, event, taskId, ...(error ? { error: error instanceof Error ? error.message : String(error) } : {}) }));
+    }
+    eventsQueue = Promise.resolve();
+    onTaskEvent = (taskId, event) => {
+        // Hosts may burst events in a single tick (e.g. running+completed); apply them
+        // strictly in arrival order so a late non-terminal write cannot overwrite a terminal one.
+        this.eventsQueue = this.eventsQueue
+            .then(() => this.handleTaskEvent(taskId, event))
+            .catch((error) => this.debug("agent.event_apply_failed", taskId, error));
+    };
+    async handleTaskEvent(taskId, event) {
+        if (event.type === "status") {
+            const current = await this.deps.store.read(taskId).catch(() => null);
+            if (!current)
+                return;
+            const next = nextRuntimeStatus(current.status, event);
+            if (next === null) {
+                this.debug("agent.task.status_rejected", taskId);
+                return;
+            }
+            await this.deps.store.update(taskId, (task) => ({
+                ...task,
+                status: next,
+                error: next === "failed" ? event.detail ?? "Task failed." : task.error,
+                settledAt: isTerminalStatus(next) ? new Date().toISOString() : task.settledAt,
+            }));
+            if (isTerminalStatus(next)) {
+                this.executors.get(taskId)?.dispose();
+                this.executors.delete(taskId);
+                void this.supervisor().ensureHost().then((connection) => connection.request("session.dispose", { taskId }, 5_000)).catch(() => undefined);
+            }
+        }
+        if (event.type === "usage") {
+            const task = await this.deps.store.read(taskId).catch(() => null);
+            if (!task)
+                return;
+            await this.deps.store.update(taskId, (record) => ({
+                ...record,
+                usage: {
+                    inputTokens: record.usage.inputTokens + event.inputTokens,
+                    outputTokens: record.usage.outputTokens + event.outputTokens,
+                    costUsd: Math.max(record.usage.costUsd, event.costUsd),
+                },
+            }));
+            const latest = await this.deps.store.read(taskId);
+            if (latest.usage.costUsd >= latest.maxCostUsd && !isTerminalStatus(latest.status) && !this.budgetCancels.has(taskId)) {
+                this.budgetCancels.add(taskId);
+                void this.supervisor()
+                    .ensureHost()
+                    .then((connection) => connection.request("task.cancel", { taskId, reason: "Budget limit reached." }, 10_000))
+                    .catch(() => this.settleCancelled(taskId, "Budget limit reached (host unreachable)."));
+            }
+        }
+        await this.deps.store.appendEvent(taskId, event);
+    }
+    onHostLost = (error) => {
+        this.credentialsSent = false;
+        this.budgetCancels.clear();
+        void this.failRunningTasks(error).catch(() => undefined);
+    };
+    async failRunningTasks(error) {
+        const detail = error ? `Agent host exited unexpectedly: ${error.message}` : "Agent host exited unexpectedly.";
+        for (const task of await this.deps.store.list()) {
+            if (isTerminalStatus(task.status))
+                continue;
+            this.executors.delete(task.id);
+            await this.deps.store.update(task.id, (record) => ({ ...record, status: "failed", error: detail, settledAt: new Date().toISOString() }));
+            await this.deps.store.appendEvent(task.id, { type: "status", status: "failed", detail });
+        }
+    }
+    onToolRequest = async (request, args, taskId) => {
+        const kind = toolKindFromMethod(request.method);
+        if (!kind)
+            throw new Error(`Unsupported tool method: ${request.method}`);
+        const executor = this.executors.get(taskId);
+        if (!executor) {
+            const task = await this.deps.store.read(taskId).catch(() => null);
+            if (!task)
+                throw new Error("Unknown task.");
+            throw new Error(`Task ${taskId} is ${task.status}; tools are unavailable.`);
+        }
+        const result = await executor.execute(kind, args);
+        if (!result.ok)
+            throw new Error(result.error.message);
+        return result.result;
+    };
+}
+export { TaskStore, AgentStoreError, branchNameForTask };
+//# sourceMappingURL=agent-service.js.map

package/dist/agent/agent-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-service.js","sourceRoot":"","sources":["../../src/agent/agent-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,kCAAkC,EAClC,iCAAiC,EACjC,yBAAyB,EACzB,eAAe,EAGf,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,SAAS,GAEV,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAA2B,SAAS,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAoB,eAAe,EAAE,kBAAkB,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEvJ,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACrB;IAArB,YAAqB,IAA2B,EAAE,OAAgB;QAChE,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QADJ,SAAI,GAAJ,IAAI,CAAuB;QAE9C,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAwBD,MAAM,CAAC,MAAM,oBAAoB,GAAuB;IACtD,aAAa,EAAE,CAAC;IAChB,oBAAoB,EAAE,KAAK;IAC3B,iBAAiB,EAAE,0BAA0B;IAC7C,eAAe,EAAE,wBAAwB;IACzC,kBAAkB,EAAE,kCAAkC;CACvD,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAyB,OAAO,CAAC,GAAG;IACxE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAgC,CAAC;QACpG,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,KAAK,IAAI;YACvD,iBAAiB,EAAE,WAAW,CAAC,GAAG,CAAC,iBAAiB,EAAE,0BAA0B,CAAC;YACjF,eAAe,EAAE,WAAW,CAAC,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC;YAC3E,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,kBAAkB,CAAC;SAC/D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,oBAAoB,EAAE,CAAC;IACrC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAA0B,EAAE,MAAyB,OAAO,CAAC,GAAG;IACpG,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IAC5D,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,QAAgB;IACnD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,wBAAwB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClI,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,kCAAkC,CAAC;AAC3I,CAAC;AAUD,MAAM,OAAO,YAAY;IAQJ;IAPF,SAAS,GAAG,IAAI,GAAG,EAA6B,CAAC;IACjD,SAAS,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC;IAC5C,eAAe,GAAG,KAAK,CAAC;IACxB,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,WAAW,GAA+B,IAAI,CAAC;IAEvD,YACmB,IAMhB;QANgB,SAAI,GAAJ,IAAI,CAMpB;IACA,CAAC;IAEJ,UAAU;QACR,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAqB;QACnC,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,yBAAyB;YAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,8BAA8B,CAAC,CAAC;QAC1J,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,EAAE,wBAAwB,CAAC,CAAC;QAC/I,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,oBAAoB,CAAC;QACpE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,oBAAoB;YAAE,MAAM,IAAI,iBAAiB,CAAC,yBAAyB,EAAE,sCAAsC,CAAC,CAAC;QAChK,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAEvG,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,kBAAkB;YAAE,MAAM,IAAI,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;QAC9F,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC;QAC9F,IAAI,YAAY,IAAI,iCAAiC;YAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,CAAC,CAAC;QAEnG,IAAI,QAAwD,CAAC;QAC7D,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;gBACnC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;oBAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;gBAC3F,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;oBAAE,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC;QAClB,MAAM,MAAM,GAAoB;YAC9B,EAAE;YACF,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,YAAY,EAAE,QAAQ,CAAC,IAAI;YAC3B,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,IAAI;YACJ,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;YAC1B,UAAU;YACV,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,MAAM;YACnB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;YACtD,KAAK,EAAE,IAAI;YACX,YAAY,EAAE,IAAI;YAClB,QAAQ,EAAE,IAAI;YACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,IAAI;SAChB,CAAC;QACF,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAErC,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAC;YAC1D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7E,MAAM,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE;gBACrC,MAAM,EAAE,EAAE;gBACV,YAAY,EAAE,QAAQ,CAAC,IAAI;gBAC3B,IAAI;gBACJ,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,IAAI;gBAC1B,SAAS,EAAE,UAAU;gBACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,UAAU,EAAE,QAAQ,CAAC,UAAU;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;YACtL,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC/G,IAAI,KAAK,YAAY,iBAAiB;gBAAE,MAAM,KAAK,CAAC;YACpD,MAAM,IAAI,iBAAiB,CAAC,kBAAkB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QACrH,CAAC;QACD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,SAAkB;QAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAM,GAAG,CAAC;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,OAAe;QAC3C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;YAAE,MAAM,IAAI,iBAAiB,CAAC,cAAc,CAAC,CAAC;QACnI,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,eAAe;YAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,8BAA8B,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC;QAClK,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,CAAC;QACxD,MAAM,UAAU,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,CAAC;YACxD,MAAM,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,8BAA8B,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,EAAU,EAAE,MAAc;QACtD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;QACnI,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,IAAa;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,aAAa,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB;gBAAE,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;YAC7H,MAAM,IAAI,iBAAiB,CAAC,UAAU,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,IAAa;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;QAC3H,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM;YAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,iBAAiB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QACpH,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC7C,GAAG,MAAM;YACT,WAAW,EAAE,iBAAiB;YAC9B,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SACzI,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,UAAyB;QACtD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,WAAW,KAAK,iBAAiB;YAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,kBAAkB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QAChI,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC7D,GAAG,MAAM;YACT,WAAW,EAAE,UAAU;YACvB,QAAQ,EAAE,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE;SAC/D,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACpE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,KAAK,WAAW;YAAE,MAAM,IAAI,iBAAiB,CAAC,eAAe,EAAE,gBAAgB,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QACzJ,MAAM,kBAAkB,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;YAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAED,MAAM;QACJ,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,4EAA4E;IAEpE,KAAK,CAAC,yBAAyB;QACrC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YACnD,IAAI,WAAW;gBAAE,UAAU,CAAC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;YACrE,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,KAAa,EAAE,MAAc,EAAE,KAAe;QAC1D,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACjM,CAAC;IAEO,WAAW,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAE9C,WAAW,GAAG,CAAC,MAAc,EAAE,KAAyB,EAAQ,EAAE;QACzE,+EAA+E;QAC/E,0FAA0F;QAC1F,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW;aAChC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;aAC/C,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,0BAA0B,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC;IAEM,KAAK,CAAC,eAAe,CAAC,MAAc,EAAE,KAAyB;QACrE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACrE,IAAI,CAAC,OAAO;gBAAE,OAAO;YACrB,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACtD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,IAAI,CAAC,KAAK,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;gBACjD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC9C,GAAG,IAAI;gBACP,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK;gBACtE,SAAS,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS;aAC9E,CAAC,CAAC,CAAC;YACJ,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;gBACtC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC9B,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC5I,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAClE,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAChD,GAAG,MAAM;gBACT,KAAK,EAAE;oBACL,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW;oBACzD,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY;oBAC5D,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC;iBACvD;aACF,CAAC,CAAC,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrH,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC/B,KAAK,IAAI,CAAC,UAAU,EAAE;qBACnB,UAAU,EAAE;qBACZ,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,MAAM,CAAC,CAAC;qBAC5G,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAEQ,UAAU,GAAG,CAAC,KAAa,EAAQ,EAAE;QAC5C,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC;IAEM,KAAK,CAAC,gBAAgB,CAAC,KAAa;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,mCAAmC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,iCAAiC,CAAC;QAC9G,KAAK,MAAM,IAAI,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAChD,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC/B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;YACzI,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAEQ,aAAa,GAAG,KAAK,EAAE,OAAoB,EAAE,IAA6B,EAAE,MAAc,EAAoB,EAAE;QACvH,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAClE,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,OAAO,IAAI,CAAC,MAAM,0BAA0B,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,MAAM,CAAC,MAAM,CAAC;IACvB,CAAC,CAAC;CACH;AAED,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/agent/app-install.d.ts

@@ -0,0 +1,49 @@
+export declare const APP_INSTALL_SCHEMA_VERSION = 1;
+export declare const CAPSULE_MANIFEST_NAME = "capsule-manifest.json";
+export type AppInstall = {
+    schemaVersion: number;
+    appVersion: string;
+    capsulePath: string;
+    protocolVersion: number;
+};
+export type CapsuleManifest = {
+    schemaVersion: number;
+    capsuleKind: string;
+    sourceCommit: string;
+    target: {
+        id: string;
+        platform: string;
+        architecture: string;
+    };
+    versions: {
+        piNode: string;
+        protocol: string;
+    };
+    runtime: {
+        executable: string;
+    };
+    application: {
+        entrypoint: string;
+        agentHostEntrypoint?: string;
+        launch?: string[];
+    };
+};
+export declare class AppInstallError extends Error {
+    readonly code: "app_not_installed" | "app_manifest_invalid" | "capsule_invalid" | "capsule_platform_mismatch" | "capsule_integrity_failed";
+    constructor(code: "app_not_installed" | "app_manifest_invalid" | "capsule_invalid" | "capsule_platform_mismatch" | "capsule_integrity_failed");
+}
+export declare function appInstallPath(env?: NodeJS.ProcessEnv): string;
+export declare function readAppInstall(path?: string, env?: NodeJS.ProcessEnv): Promise<AppInstall>;
+export type CapsuleFacts = {
+    manifest: CapsuleManifest;
+    nodeExecutable: string;
+    agentHostEntrypoint: string;
+    entrypointIsAgentHost: boolean;
+};
+/** Structural capsule verification: manifest shape, platform match, entrypoints. */
+export declare function verifyCapsule(appInstall: AppInstall): Promise<CapsuleFacts>;
+/**
+ * Full integrity walk (sha256 of every payload file against the manifest).
+ * Expensive; run once per supervisor lifetime, not on every host restart.
+ */
+export declare function verifyCapsuleIntegrity(appInstall: AppInstall): Promise<void>;

package/dist/agent/app-install.js

@@ -0,0 +1,133 @@
+/**
+ * Reads `~/.config/frely/app.json` (written by the Frely App) and verifies the
+ * referenced Runtime Capsule well enough to launch its agent host entry.
+ */
+import { createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { lstat, readFile, readlink, stat } from "node:fs/promises";
+import { join, relative, resolve } from "node:path";
+export const APP_INSTALL_SCHEMA_VERSION = 1;
+export const CAPSULE_MANIFEST_NAME = "capsule-manifest.json";
+export class AppInstallError extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+        this.name = "AppInstallError";
+    }
+}
+export function appInstallPath(env = process.env) {
+    return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "frely", "app.json");
+}
+export async function readAppInstall(path, env = process.env) {
+    let raw;
+    try {
+        raw = await readFile(path ?? appInstallPath(env), "utf8");
+    }
+    catch {
+        throw new AppInstallError("app_not_installed");
+    }
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        throw new AppInstallError("app_manifest_invalid");
+    }
+    const record = value;
+    if (record.schemaVersion !== APP_INSTALL_SCHEMA_VERSION)
+        throw new AppInstallError("app_manifest_invalid");
+    if (typeof record.appVersion !== "string" || typeof record.capsulePath !== "string" || !Number.isSafeInteger(record.protocolVersion)) {
+        throw new AppInstallError("app_manifest_invalid");
+    }
+    return { schemaVersion: APP_INSTALL_SCHEMA_VERSION, appVersion: record.appVersion, capsulePath: record.capsulePath, protocolVersion: record.protocolVersion };
+}
+/** Structural capsule verification: manifest shape, platform match, entrypoints. */
+export async function verifyCapsule(appInstall) {
+    let manifestRaw;
+    try {
+        manifestRaw = await readFile(join(appInstall.capsulePath, CAPSULE_MANIFEST_NAME), "utf8");
+    }
+    catch {
+        throw new AppInstallError("capsule_invalid");
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(manifestRaw);
+    }
+    catch {
+        throw new AppInstallError("capsule_invalid");
+    }
+    if (manifest.schemaVersion !== 2 || manifest.capsuleKind !== "pi-node-runtime")
+        throw new AppInstallError("capsule_invalid");
+    if (typeof manifest.sourceCommit !== "string" || !/^[0-9a-f]{40}$/u.test(manifest.sourceCommit))
+        throw new AppInstallError("capsule_invalid");
+    const platform = process.platform === "win32" ? "win32" : process.platform === "darwin" ? "darwin" : "linux";
+    if (manifest.target.platform !== platform)
+        throw new AppInstallError("capsule_platform_mismatch");
+    const nodeExecutable = join(appInstall.capsulePath, manifest.runtime.executable);
+    if (!(await isFile(nodeExecutable)))
+        throw new AppInstallError("capsule_invalid");
+    const agentHostEntrypoint = manifest.application.agentHostEntrypoint ?? manifest.application.entrypoint;
+    const entrypointPath = join(appInstall.capsulePath, agentHostEntrypoint);
+    if (!(await isFile(entrypointPath)))
+        throw new AppInstallError("capsule_invalid");
+    return {
+        manifest,
+        nodeExecutable,
+        agentHostEntrypoint: entrypointPath,
+        entrypointIsAgentHost: manifest.application.agentHostEntrypoint !== undefined,
+    };
+}
+/**
+ * Full integrity walk (sha256 of every payload file against the manifest).
+ * Expensive; run once per supervisor lifetime, not on every host restart.
+ */
+export async function verifyCapsuleIntegrity(appInstall) {
+    const manifest = JSON.parse(await readFile(join(appInstall.capsulePath, CAPSULE_MANIFEST_NAME), "utf8"));
+    const integrity = manifest.integrity;
+    if (!integrity || integrity.algorithm !== "sha256")
+        throw new AppInstallError("capsule_invalid");
+    const seen = new Set();
+    let totalSize = 0;
+    let count = 0;
+    for (const entry of integrity.files) {
+        if (typeof entry.path !== "string" || entry.path.startsWith("/") || entry.path.includes(".."))
+            throw new AppInstallError("capsule_invalid");
+        if (seen.has(entry.path))
+            throw new AppInstallError("capsule_invalid");
+        seen.add(entry.path);
+        const full = resolve(appInstall.capsulePath, entry.path);
+        if (relative(appInstall.capsulePath, full).startsWith(".."))
+            throw new AppInstallError("capsule_invalid");
+        const info = await lstat(full).catch(() => null);
+        if (!info)
+            throw new AppInstallError("capsule_integrity_failed");
+        if (entry.symlinkTarget !== undefined) {
+            if (!info.isSymbolicLink())
+                throw new AppInstallError("capsule_integrity_failed");
+            const target = await readlink(full);
+            if (target !== entry.symlinkTarget)
+                throw new AppInstallError("capsule_integrity_failed");
+            continue;
+        }
+        if (!info.isFile())
+            throw new AppInstallError("capsule_integrity_failed");
+        const hash = createHash("sha256");
+        const content = await readFile(full);
+        hash.update(content);
+        if (hash.digest("hex") !== entry.sha256)
+            throw new AppInstallError("capsule_integrity_failed");
+        if (typeof entry.bytes === "number" && entry.bytes !== content.byteLength)
+            throw new AppInstallError("capsule_integrity_failed");
+        totalSize += content.byteLength;
+        count += 1;
+    }
+    if (count !== integrity.payloadFileCount || totalSize !== integrity.payloadSize)
+        throw new AppInstallError("capsule_integrity_failed");
+}
+async function isFile(path) {
+    const info = await stat(path).catch(() => null);
+    return info !== null && info.isFile();
+}
+//# sourceMappingURL=app-install.js.map

package/dist/agent/app-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-install.js","sourceRoot":"","sources":["../../src/agent/app-install.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAC5C,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AAmB7D,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACnB;IAArB,YAAqB,IAAiI;QACpJ,KAAK,CAAC,IAAI,CAAC,CAAC;QADO,SAAI,GAAJ,IAAI,CAA6H;QAEpJ,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,MAAyB,OAAO,CAAC,GAAG;IACjE,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAa,EAAE,MAAyB,OAAO,CAAC,GAAG;IACtF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,mBAAmB,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,aAAa,KAAK,0BAA0B;QAAE,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;IAC3G,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QACrI,MAAM,IAAI,eAAe,CAAC,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,MAAM,CAAC,eAAyB,EAAE,CAAC;AAC1K,CAAC;AASD,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAAsB;IACxD,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,QAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAoB,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,QAAQ,CAAC,aAAa,KAAK,CAAC,IAAI,QAAQ,CAAC,WAAW,KAAK,iBAAiB;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAC7H,IAAI,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAC9I,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7G,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,2BAA2B,CAAC,CAAC;IAElG,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACjF,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAElF,MAAM,mBAAmB,GAAG,QAAQ,CAAC,WAAW,CAAC,mBAAmB,IAAI,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC;IACxG,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,mBAAmB,CAAC,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;IAClF,OAAO;QACL,QAAQ;QACR,cAAc;QACd,mBAAmB,EAAE,cAAc;QACnC,qBAAqB,EAAE,QAAQ,CAAC,WAAW,CAAC,mBAAmB,KAAK,SAAS;KAC9E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAAsB;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,qBAAqB,CAAC,EAAE,MAAM,CAAC,CAEtG,CAAC;IACF,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACrC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,QAAQ;QAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,EAAE,CAAC;QACpC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;QAC5I,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzD,IAAI,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,iBAAiB,CAAC,CAAC;QAC1G,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;QACjE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;YAClF,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,KAAK,CAAC,aAAa;gBAAE,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;YAC1F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;QAC/F,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,CAAC,UAAU;YAAE,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;QACjI,SAAS,IAAI,OAAO,CAAC,UAAU,CAAC;QAChC,KAAK,IAAI,CAAC,CAAC;IACb,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,CAAC,gBAAgB,IAAI,SAAS,KAAK,SAAS,CAAC,WAAW;QAAE,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;AACzI,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;AACxC,CAAC"}

package/dist/agent/app-key.d.ts

@@ -0,0 +1,14 @@
+export declare const DEFAULT_LIFETIME_USD = 50;
+export declare const MAX_LIFETIME_USD = 500;
+export declare class AppKeyError extends Error {
+    readonly code: string;
+    readonly status: number;
+    constructor(code: string, status: number, message: string);
+}
+export interface ProvisionedAppKey {
+    keyId: string;
+    rawKey: string;
+    name: string;
+    lifetimeUsd: number | null;
+}
+export declare function provisionAgentKey(lifetimeUsd?: number): Promise<ProvisionedAppKey>;

package/dist/agent/app-key.js

@@ -0,0 +1,46 @@
+/**
+ * `frely app key`: provision a device-scoped Frely API key for agent tasks
+ * (plan frely-app-agent-toolset §9.3). The key is shown once and never stored
+ * by the CLI; it is bound to a device the caller owns and capped at a
+ * lifetime spend limit enforced by the relay backend.
+ */
+import { requireLogin } from "../auth.js";
+import { ensureDevice, relayFetch } from "../device/control.js";
+const ENDPOINT = "/api/user/device-relay/agent-key";
+export const DEFAULT_LIFETIME_USD = 50;
+export const MAX_LIFETIME_USD = 500;
+export class AppKeyError extends Error {
+    code;
+    status;
+    constructor(code, status, message) {
+        super(message);
+        this.code = code;
+        this.status = status;
+        this.name = "AppKeyError";
+    }
+}
+export async function provisionAgentKey(lifetimeUsd = DEFAULT_LIFETIME_USD) {
+    if (!Number.isFinite(lifetimeUsd) || lifetimeUsd <= 0 || lifetimeUsd > MAX_LIFETIME_USD) {
+        throw new Error(`--lifetime-usd must be a positive amount of at most ${MAX_LIFETIME_USD}.`);
+    }
+    const auth = await requireLogin();
+    const device = await ensureDevice();
+    const response = await relayFetch(auth.config.relayUrl, auth.credential, ENDPOINT, {
+        method: "POST",
+        body: JSON.stringify({ deviceId: device.deviceId, lifetimeUsd }),
+    });
+    if (!response.ok) {
+        const body = await response.json().catch(() => null);
+        throw new AppKeyError(body?.error?.code ?? "agent_key_failed", response.status, body?.error?.message ?? `Agent key provisioning failed (${response.status}).`);
+    }
+    const created = await response.json();
+    if (typeof created.apiKey?.id !== "string" || typeof created.rawKey !== "string" || created.rawKey.length === 0)
+        throw new AppKeyError("agent_key_invalid", response.status, "Agent key response was invalid.");
+    return {
+        keyId: created.apiKey.id,
+        rawKey: created.rawKey,
+        name: created.apiKey.name ?? `frely-app ${device.deviceId.slice(-8)}`,
+        lifetimeUsd: created.limits?.lifetimeAmount ?? null,
+    };
+}
+//# sourceMappingURL=app-key.js.map

package/dist/agent/app-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-key.js","sourceRoot":"","sources":["../../src/agent/app-key.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEhE,MAAM,QAAQ,GAAG,kCAAkC,CAAC;AACpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAEpC,MAAM,OAAO,WAAY,SAAQ,KAAK;IACf;IAAuB;IAA5C,YAAqB,IAAY,EAAW,MAAc,EAAE,OAAe;QACzE,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAQ;QAExD,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC;IAC5B,CAAC;CACF;AASD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,cAAsB,oBAAoB;IAChF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,WAAW,GAAG,gBAAgB,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,uDAAuD,gBAAgB,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE;QACjF,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;KACjE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAA2D,CAAC;QAC/G,MAAM,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,kBAAkB,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,kCAAkC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;IACjK,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAA+G,CAAC;IACnJ,IAAI,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC,CAAC;IAChN,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,aAAa,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;QACrE,WAAW,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,IAAI,IAAI;KACpD,CAAC;AACJ,CAAC"}