{"version":3,"sources":["../src/cache.ts","../src/output.ts","../src/security-state.ts","../src/cli.ts"],"names":["path","os","engineDerivePkaKeyid","engineClassifySecurityChange","engineShouldRejectForFailPolicy","fs","chalk","ERROR_MESSAGES","readFileSync","generateEd25519KeyPair","Command","AidError","ora","runCheck","verifyPka","inquirer","PROTOCOL_TOKENS","AUTH_TOKENS","buildTxtRecordVariant","validateTxtRecord","clipboardy","writeFile","fileURLToPath","realpathSync"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAUO,IAAM,oBAAA,GAAuB,CAAA;AAyBpC,SAAS,SAAA,GAAoB;AAC3B,EAAA,OAAOA,uBAAK,IAAA,CAAKC,mBAAA,CAAG,OAAA,EAAQ,EAAG,QAAQ,YAAY,CAAA;AACrD;AAIO,IAAM,cAAA,GAAiBC,wBAAA;AAE9B,SAAS,aAAa,KAAA,EAAqC;AACzD,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,UAAU,OAAO,KAAA;AAChD,EAAA,MAAM,KAAA,GAAQ,KAAA;AACd,EAAA,OACE,OAAO,KAAA,CAAM,QAAA,KAAa,QAAA,KACzB,OAAO,MAAM,GAAA,KAAQ,QAAA,IAAY,KAAA,CAAM,GAAA,KAAQ,UAC/C,OAAO,KAAA,CAAM,GAAA,KAAQ,QAAA,IAAY,MAAM,GAAA,KAAQ,IAAA,CAAA;AAEpD;AAEA,SAAS,aAAa,KAAA,EAA+B;AACnD,EAAA,MAAM,WAAA,GAAc,cAAA,CAAe,KAAA,CAAM,GAAG,CAAA;AAC5C,EAAA,OAAO;AAAA,IACL,GAAG,KAAA;AAAA,IACH,OAAA,EAAS,KAAA,CAAM,OAAA,KAAY,KAAA,CAAM,GAAA,EAAK,UAAA,CAAW,GAAG,CAAA,GAAI,MAAA,GAAS,KAAA,CAAM,GAAA,GAAM,MAAA,GAAS,IAAA,CAAA;AAAA,IACtF,WAAA,EAAa,MAAM,WAAA,IAAe,KAAA;AAAA,IAClC,KAAA,EAAO,KAAA,CAAM,KAAA,IAAS,WAAA,EAAa,KAAA,IAAS,IAAA;AAAA,IAC5C,IAAA,EAAM,KAAA,CAAM,IAAA,IAAQ,WAAA,EAAa,IAAA,IAAQ,IAAA;AAAA,IACzC,WAAA,EAAa,MAAM,WAAA,IAAe;AAAA,GACpC;AACF;AAEO,SAAS,iBAAiB,GAAA,EAA0B;AACzD,EAAA,IACE,GAAA,IACA,OAAO,GAAA,KAAQ,QAAA,IACd,GAAA,CAA4B,aAAA,KAAkB,oBAAA,IAC9C,GAAA,CAA4B,OAAA,IAC7B,OAAQ,GAAA,CAA4B,OAAA,KAAY,QAAA,EAChD;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAEA,EAAA,MAAM,UAAsC,EAAC;AAC7C,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,EAAU;AACnC,IAAA,OAAO,EAAE,aAAA,EAAe,oBAAA,EAAsB,OAAA,EAAQ;AAAA,EACxD;AAKA,EAAA,MAAM,OAAA,GAAU,GAAA;AAChB,EAAA,MAAM,MAAA,GACJ,QAAQ,OAAA,IAAW,OAAO,QAAQ,OAAA,KAAY,QAAA,GACzC,QAAQ,OAAA,GACR,GAAA;AAEP,EAAA,KAAA,MAAW,CAAC,MAAA,EAAQ,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,MAAM,CAAA,EAAG;AACpD,IAAA,IAAI,MAAA,KAAW,eAAA,IAAmB,MAAA,KAAW,SAAA,EAAW;AACxD,IAAA,IAAI,YAAA,CAAa,KAAK,CAAA,EAAG;AACvB,MAAA,OAAA,CAAQ,MAAM,CAAA,GAAI,YAAA,CAAa,KAAK,CAAA;AAAA,IACtC;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,aAAA,EAAe,oBAAA,EAAsB,OAAA,EAAQ;AACxD;AAEO,SAAS,yBAAA,CAA0B,MAAA,EAAsB,GAAA,mBAAM,IAAI,MAAK,EAAe;AAC5F,EAAA,MAAM,MAAA,GAAS,OAAO,MAAA,CAAO,MAAA;AAC7B,EAAA,MAAM,WAAA,GAAc,cAAA,CAAe,MAAA,EAAQ,GAAA,IAAO,IAAI,CAAA;AACtD,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,IAAI,WAAA,EAAY;AAAA,IAC1B,OAAA,EAAS,QAAQ,CAAA,IAAK,IAAA;AAAA,IACtB,WAAA,EAAa,MAAA,CAAO,OAAA,CAAQ,SAAA,CAAU,OAAO,gBAAA,GAAmB,KAAA;AAAA,IAChE,GAAA,EAAK,QAAQ,GAAA,IAAO,IAAA;AAAA,IACpB,KAAK,MAAA,EAAQ,CAAA,KAAM,MAAA,GAAU,MAAA,CAAO,OAAO,IAAA,GAAQ,IAAA;AAAA,IACnD,KAAA,EAAO,aAAa,KAAA,IAAS,IAAA;AAAA,IAC7B,IAAA,EAAM,aAAa,IAAA,IAAQ,IAAA;AAAA,IAC3B,WAAA,EAAa,MAAA,CAAO,GAAA,CAAI,WAAA,IAAe,IAAA;AAAA,IACvC,IAAA,EAAM,MAAA,CAAO,UAAA,EAAY,IAAA,IAAQ;AAAA,GACnC;AACF;AAMO,IAAM,sBAAA,GAAyBC,gCAAA;AAI/B,IAAM,yBAAA,GAA4BC,mCAAA;AAEzC,eAAsB,SAAA,GAAiC;AACrD,EAAA,IAAI;AACF,IAAA,MAAM,IAAI,SAAA,EAAU;AACpB,IAAA,MAAM,IAAA,GAAO,MAAMC,WAAA,CAAG,QAAA,CAAS,GAAG,MAAM,CAAA;AACxC,IAAA,OAAO,gBAAA,CAAiB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,aAAA,EAAe,oBAAA,EAAsB,OAAA,EAAS,EAAC,EAAE;AAAA,EAC5D;AACF;AAEA,eAAe,UAAU,QAAA,EAAiC;AACxD,EAAA,IAAI;AACF,IAAA,MAAMA,WAAA,CAAG,MAAML,sBAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA,EAAG,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAAA,EAC5D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,eAAsB,UAAU,KAAA,EAAkC;AAChE,EAAA,MAAM,IAAI,SAAA,EAAU;AACpB,EAAA,MAAM,UAAU,CAAC,CAAA;AACjB,EAAA,MAAM,MAAM,CAAA,GAAI,MAAA;AAChB,EAAA,MAAM,UAAU,IAAA,CAAK,SAAA,CAAU,iBAAiB,KAAK,CAAA,EAAG,MAAM,CAAC,CAAA;AAC/D,EAAA,MAAMK,YAAG,SAAA,CAAU,GAAA,EAAK,SAAS,EAAE,IAAA,EAAM,KAAO,CAAA;AAChD,EAAA,MAAMA,WAAA,CAAG,MAAA,CAAO,GAAA,EAAK,CAAC,CAAA;AACxB;;;AClJA,SAAS,8BAA8B,MAAA,EAAgC;AACrE,EAAA,MAAM,cAAwB,EAAC;AAC/B,EAAA,MAAM,EAAE,MAAA,EAAQ,MAAA,EAAQ,GAAA,EAAK,KAAI,GAAI,MAAA;AACrC,EAAA,MAAM,IAAA,GAAOC,uBAAA,CAAM,IAAA,CAAK,WAAI,CAAA;AAE5B,EAAA,IAAI,OAAO,GAAA,EAAK;AACd,IAAA,MAAM,UAAU,IAAI,WAAA,GAAc,MAAA,CAAO,MAAA,CAAO,GAAG,CAAA,CAAE,MAAA;AACrD,IAAA,IAAI,UAAU,GAAA,EAAK;AACjB,MAAA,WAAA,CAAY,IAAA;AAAA,QACV,CAAA,EAAG,IAAI,CAAA,CAAA,EAAIA,uBAAA,CAAM,KAAK,qBAAqB,CAAC,CAAA,CAAA,EAAIC,wBAAA,CAAe,mBAAmB,CAAA;AAAA,OACpF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,MAAA,CAAO,SAAS,IAAA,CAAK,CAAC,YAAY,OAAA,CAAQ,IAAA,KAAS,iBAAiB,CAAA,EAAG;AACzE,IAAA,WAAA,CAAY,IAAA;AAAA,MACV,CAAA,EAAG,IAAI,CAAA,CAAA,EAAID,uBAAA,CAAM,KAAK,wBAAwB,CAAC,CAAA,CAAA,EAAIC,wBAAA,CAAe,WAAW,CAAA;AAAA,KAC/E;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,WAAA,CAAY,IAAA,CAAK,CAAA,EAAG,IAAI,CAAA,CAAA,EAAID,uBAAA,CAAM,IAAA,CAAK,gBAAgB,CAAC,CAAA,CAAA,EAAIC,wBAAA,CAAe,aAAa,CAAA,CAAE,CAAA;AAAA,EAC5F;AAEA,EAAA,IAAI,CAAC,IAAI,OAAA,EAAS;AAChB,IAAA,WAAA,CAAY,IAAA,CAAK,CAAA,EAAG,IAAI,CAAA,CAAA,EAAID,uBAAA,CAAM,IAAA,CAAK,qBAAqB,CAAC,CAAA,CAAA,EAAIC,wBAAA,CAAe,OAAO,CAAA,CAAE,CAAA;AAAA,EAC3F;AAEA,EAAA,IAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,KAAM,MAAA,IAAU,GAAA,CAAI,WAAW,GAAA,CAAI,QAAA,IAAY,GAAA,CAAI,WAAA,KAAgB,KAAA,EAAO;AAC3F,IAAA,WAAA,CAAY,IAAA;AAAA,MACV,GAAG,IAAI,CAAA,CAAA,EAAID,uBAAA,CAAM,IAAA,CAAK,wBAAwB,CAAC,CAAA,mMAAA;AAAA,KACjD;AAAA,EACF;AAEA,EAAA,IAAI,GAAA,CAAI,WAAW,GAAA,CAAI,KAAA,IAAS,IAAI,aAAA,KAAkB,IAAA,IAAQ,GAAA,CAAI,aAAA,GAAgB,EAAA,EAAI;AACpF,IAAA,WAAA,CAAY,IAAA,CAAK,CAAA,EAAG,IAAI,CAAA,CAAA,EAAIA,uBAAA,CAAM,IAAA,CAAK,wBAAwB,CAAC,CAAA,CAAA,EAAIC,wBAAA,CAAe,SAAS,CAAA,CAAE,CAAA;AAAA,EAChG;AAEA,EAAA,IAAI,MAAA,CAAO,OAAO,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,IAAA,KAAS,uBAAuB,CAAA,EAAG;AACjE,IAAA,WAAA,CAAY,IAAA;AAAA,MACV,GAAG,IAAI,CAAA,CAAA,EAAID,uBAAA,CAAM,IAAA,CAAK,yBAAyB,CAAC,CAAA,yGAAA;AAAA,KAClD;AAAA,EACF;AAEA,EAAA,OAAO,WAAA;AACT;AAEO,SAAS,kBAAkB,MAAA,EAA8B;AAC9D,EAAA,MAAM,EAAE,QAAQ,MAAA,EAAQ,OAAA,EAAS,KAAK,MAAA,EAAQ,GAAA,EAAK,WAAU,GAAI,MAAA;AACjE,EAAA,MAAM,QAAkB,EAAC;AAEzB,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,EAAA,EAAIA,uBAAA,CAAM,KAAA,CAAM,QAAG,CAAA;AAAA,IACnB,KAAA,EAAOA,uBAAA,CAAM,GAAA,CAAI,QAAG,CAAA;AAAA,IACpB,IAAA,EAAMA,uBAAA,CAAM,MAAA,CAAO,cAAI,CAAA;AAAA,IACvB,IAAA,EAAMA,uBAAA,CAAM,IAAA,CAAK,WAAI;AAAA,GACvB;AAEA,EAAA,MAAM,cAAA,GAAiB,OAAA,CAAQ,QAAA,CAAS,OAAA,CAAQ,QAAA,CAAS,SAAS,CAAC,CAAA,EAAG,IAAA,IAAQ,CAAA,OAAA,EAAU,MAAM,CAAA,CAAA;AAG9F,EAAA,MAAM,UAAA,GAAa,QAAQ,QAAA,CAAS,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,SAAS,CAAA;AACtE,EAAA,IAAI,UAAA,EAAY;AACd,IAAA,MAAM,GAAA,GAAM,WAAW,GAAA,IAAO,KAAA;AAC9B,IAAA,MAAM,KAAA,GAAQ,IAAI,WAAA,EAAY,CAAE,OAAO,MAAA,CAAO,GAAA,IAAO,EAAE,CAAA,CAAE,MAAA;AACzD,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,SAAA,CAAU,IAAA,GAAO,eAAA,GAAkB,OAAA;AAC1D,IAAA,KAAA,CAAM,IAAA;AAAA,MACJ,CAAA,cAAA,EAAiBA,uBAAA,CAAM,IAAA,CAAK,cAAc,CAAC,CAAA,KAAA,EAAQ,KAAA,CAAM,EAAE,CAAA,OAAA,EAAU,MAAM,CAAA,MAAA,EAAS,GAAG,KAAK,KAAK,CAAA,OAAA;AAAA,KACnG;AAAA,EACF,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,IAAA,CAAK,iBAAiBA,uBAAA,CAAM,IAAA,CAAK,cAAc,CAAC,CAAA,KAAA,EAAQ,KAAA,CAAM,KAAK,CAAA,UAAA,CAAY,CAAA;AAAA,EACvF;AAGA,EAAA,IAAI,OAAO,KAAA,EAAO;AAChB,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,4BAAA,EAA+B,KAAA,CAAM,EAAE,CAAA,MAAA,CAAQ,CAAA;AAAA,EAC5D,CAAA,MAAO;AACL,IAAA,MAAM,GAAA,GAAM,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,OAAA,IAAW,mBAAA;AACzC,IAAA,KAAA,CAAM,KAAK,CAAA,4BAAA,EAA+B,KAAA,CAAM,KAAK,CAAA,CAAA,EAAI,GAAG,CAAA,CAAE,CAAA;AAAA,EAChE;AAGA,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,yBAAA,EAA4B,KAAA,CAAM,EAAE,CAAA,SAAA,CAAW,CAAA;AAAA,EAC5D,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,yBAAA,EAA4B,KAAA,CAAM,IAAI,CAAA,aAAA,CAAe,CAAA;AAAA,EAClE;AAGA,EAAA,IAAI,IAAI,OAAA,EAAS;AACf,IAAA,IAAI,IAAI,KAAA,EAAO;AACb,MAAA,MAAM,SAAS,GAAA,CAAI,aAAA;AACnB,MAAA,KAAA,CAAM,IAAA;AAAA,QACJ,CAAA,UAAA,EAAaA,uBAAA,CAAM,IAAA,CAAK,GAAA,CAAI,IAAA,IAAQ,EAAE,CAAC,CAAA,KAAA,EAAQ,KAAA,CAAM,EAAE,CAAA,gCAAA,EAAmC,MAAM,CAAA,MAAA;AAAA,OAClG;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,MAAA,GACJ,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,CAAK,UAAA,CAAW,cAAc,CAAC,CAAA,EAAG,OAAA,IAC9D,uBAAA;AACF,MAAA,KAAA,CAAM,KAAK,CAAA,cAAA,EAAiB,KAAA,CAAM,KAAK,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IACrD;AAAA,EACF,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,KAAK,CAAA,cAAA,EAAiBA,uBAAA,CAAM,IAAA,CAAK,0BAA0B,CAAC,CAAA,CAAE,CAAA;AAAA,EACtE;AAGA,EAAA,IAAI,IAAI,OAAA,EAAS;AACf,IAAA,IAAI,IAAI,QAAA,EAAU;AAChB,MAAA,MAAM,QAAA,GACJ,OAAO,MAAA,EAAQ,CAAA,KAAM,SACjB,CAAA,MAAA,EAAS,cAAA,CAAe,OAAO,MAAA,CAAO,GAAA,IAAO,IAAI,CAAA,EAAG,KAAA,IAAS,SAAS,CAAA,CAAA,GACtE,CAAA,WAAA,EAAc,IAAI,GAAA,IAAO,MAAA,CAAO,MAAA,EAAQ,GAAA,IAAO,SAAS,CAAA,CAAA;AAC9D,MAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,EAAQ,CAAA,KAAM,MAAA;AACpC,MAAA,MAAM,YAAA,GACJ,IAAI,WAAA,KAAgB,IAAA,GAChB,mBACA,MAAA,IAAU,GAAA,CAAI,WAAA,KAAgB,KAAA,GAC5B,uBAAA,GACA,EAAA;AACR,MAAA,KAAA,CAAM,IAAA;AAAA,QACJ,CAAA,wBAAA,EAA2B,MAAM,EAAE,CAAA,eAAA,EAAkB,IAAI,GAAG,CAAA,EAAA,EAAK,QAAQ,CAAA,EAAG,YAAY,CAAA,CAAA;AAAA,OAC1F;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,MAAA,GACJ,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,OAAA,CAAQ,QAAA,CAAS,KAAK,CAAC,CAAA,EAAG,OAAA,IAAW,qBAAA;AACnE,MAAA,KAAA,CAAM,KAAK,CAAA,wBAAA,EAA2B,KAAA,CAAM,KAAK,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE,CAAA;AAAA,IAC/D;AAAA,EACF,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,wBAAA,EAA2B,KAAA,CAAM,IAAI,CAAA,YAAA,CAAc,CAAA;AAAA,EAChE;AAGA,EAAA,IAAI,UAAU,OAAA,EAAS;AACrB,IAAA,MAAM,SAAS,SAAA,CAAU,MAAA;AACzB,IAAA,IAAI,MAAA,KAAW,WAAA,IAAe,MAAA,KAAW,aAAA,EAAe;AACtD,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,0BAAA,EAA6B,KAAA,CAAM,IAAI,CAAA,YAAA,CAAc,CAAA;AAAA,IAClE,CAAA,MAAA,IAAW,MAAA,KAAW,cAAA,IAAkB,MAAA,KAAW,cAAA,EAAgB;AACjE,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,0BAAA,EAA6B,KAAA,CAAM,IAAI,CAAA,iBAAA,CAAmB,CAAA;AAAA,IACvE,CAAA,MAAA,IAAW,WAAW,WAAA,EAAa;AACjC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,0BAAA,EAA6B,KAAA,CAAM,EAAE,CAAA,UAAA,CAAY,CAAA;AAAA,IAC9D,CAAA,MAAA,IAAW,WAAW,mBAAA,EAAqB;AACzC,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,0BAAA,EAA6B,KAAA,CAAM,IAAI,CAAA,iCAAA,CAAmC,CAAA;AAAA,IACvF,CAAA,MAAA,IAAW,WAAW,cAAA,EAAgB;AACpC,MAAA,KAAA,CAAM,IAAA;AAAA,QACJ,CAAA,0BAAA,EAA6B,MAAM,IAAI,CAAA,0CAAA;AAAA,OACzC;AAAA,IACF,CAAA,MAAA,IAAW,WAAW,yBAAA,EAA2B;AAC/C,MAAA,KAAA,CAAM,IAAA;AAAA,QACJ,CAAA,0BAAA,EAA6B,MAAM,IAAI,CAAA,4EAAA;AAAA,OACzC;AAAA,IACF,CAAA,MAAO;AACL,MAAA,KAAA,CAAM,IAAA;AAAA,QACJ,6BAA6B,KAAA,CAAM,EAAE,IAAI,MAAA,KAAW,YAAA,GAAe,eAAe,WAAW,CAAA;AAAA,OAC/F;AAAA,IACF;AAAA,EACF,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,KAAK,CAAA,0BAAA,EAA6BA,uBAAA,CAAM,IAAA,CAAK,SAAS,CAAC,CAAA,CAAE,CAAA;AAAA,EACjE;AAEA,EAAA,KAAA,CAAM,KAAK,mBAAmB,CAAA;AAC9B,EAAA,IAAI,MAAA,CAAO,aAAa,CAAA,EAAG;AACzB,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,CAAS,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,2BAA2B,CAAA;AACrF,IAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,MAAA,KAAA,CAAM,KAAK,CAAA,EAAG,KAAA,CAAM,IAAI,CAAA,yBAAA,EAA4B,QAAA,CAAS,MAAM,CAAA,YAAA,CAAc,CAAA;AACjF,MAAA,KAAA,MAAW,QAAQ,QAAA,EAAU;AAC3B,QAAA,KAAA,CAAM,IAAA,CAAK,CAAA,IAAA,EAAO,IAAA,CAAK,OAAO,CAAA,CAAE,CAAA;AAAA,MAClC;AAAA,IACF,CAAA,MAAO;AACL,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,EAAE,CAAA,4BAAA,CAA8B,CAAA;AAAA,IACtD;AAAA,EACF,CAAA,MAAO;AACL,IAAA,KAAA,CAAM,IAAA;AAAA,MACJ,CAAA,EAAG,KAAA,CAAM,KAAK,CAAA,OAAA,EAAU,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA,cAAA,EAAiB,MAAA,CAAO,QAAA,CAAS,MAAM,CAAA,YAAA;AAAA,KAC5F;AAAA,EACF;AAEA,EAAA,MAAM,WAAA,GAAc,8BAA8B,MAAM,CAAA;AACxD,EAAA,IAAI,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1B,IAAA,KAAA,CAAM,KAAK,2BAA2B,CAAA;AACtC,IAAA,KAAA,CAAM,IAAA,CAAK,GAAG,WAAW,CAAA;AAAA,EAC3B;AAEA,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;;;AC7KO,SAAS,kBAAA,CACd,MAAA,EACA,kBAAA,EACA,eAAA,EAC0B;AAC1B,EAAA,IAAI,CAAC,MAAA,CAAO,MAAA,CAAO,QAAQ,OAAO,EAAE,eAAe,KAAA,EAAM;AACzD,EAAA,IAAI,OAAO,QAAA,KAAa,CAAA,IAAK,MAAA,CAAO,GAAA,CAAI,aAAa,KAAA,EAAO;AAC1D,IAAA,MAAA,CAAO,UAAA,GAAa,IAAA;AACpB,IAAA,OAAO,EAAE,eAAe,KAAA,EAAM;AAAA,EAChC;AAEA,EAAA,MAAM,YAAA,GAAe,0BAA0B,MAAM,CAAA;AACrD,EAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,kBAAA,EAAoB,YAAY,CAAA;AACtE,EAAA,MAAA,CAAO,UAAU,OAAA,GAAU,IAAA;AAC3B,EAAA,MAAA,CAAO,SAAA,CAAU,WAAW,kBAAA,GACxB;AAAA,IACE,KAAK,kBAAA,CAAmB,GAAA;AAAA,IACxB,KAAK,kBAAA,CAAmB,GAAA;AAAA,IACxB,KAAA,EAAO,mBAAmB,KAAA,IAAS,IAAA;AAAA,IACnC,OAAA,EAAS,mBAAmB,OAAA,IAAW,IAAA;AAAA,IACvC,WAAA,EAAa,mBAAmB,WAAA,IAAe;AAAA,GACjD,GACA,IAAA;AACJ,EAAA,MAAA,CAAO,UAAU,MAAA,GAAS,MAAA;AAE1B,EAAA,MAAM,eAAA,GACJ;AAAA,IACE,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,aAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,IACA,YAAA,EAAc;AAAA,MACZ,IAAA,EAAM,cAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,IACA,iBAAA,EAAmB;AAAA,MACjB,IAAA,EAAM,mBAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,IACA,uBAAA,EAAyB;AAAA,MACvB,IAAA,EAAM,yBAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,IACA,SAAA,EAAW;AAAA,MACT,IAAA,EAAM,WAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACX;AAAA,IACA,YAAA,EAAc;AAAA,MACZ,IAAA,EAAM,cAAA;AAAA,MACN,OAAA,EACE;AAAA;AACJ,GACF;AACF,EAAA,MAAM,OAAA,GAAU,gBAAgB,MAAM,CAAA;AACtC,EAAA,IAAI,OAAA,EAAS;AACX,IAAA,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,IAAA,CAAK,OAAO,CAAA;AAAA,EACrC;AAEA,EAAA,IAAI,eAAA,KAAoB,MAAA,IAAU,yBAAA,CAA0B,MAAA,EAAQ,kBAAkB,CAAA,EAAG;AACvF,IAAA,MAAA,CAAO,QAAA,GAAW,IAAA;AAClB,IAAA,MAAA,CAAO,UAAA,GAAa,IAAA;AACpB,IAAA,OAAO,EAAE,eAAe,KAAA,EAAM;AAAA,EAChC;AAEA,EAAA,MAAA,CAAO,UAAA,GAAa,YAAA;AACpB,EAAA,OAAO,EAAE,eAAe,IAAA,EAAK;AAC/B;;;ACvDA,SAAS,kBAAA,GAA6B;AACpC,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,iBAAA,EAAmB,yPAAe,CAAA;AACzD,IAAA,MAAM,YAAA,GAAeE,eAAA,CAAa,MAAA,EAAQ,MAAM,CAAA;AAChD,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,YAAY,CAAA;AACnC,IAAA,OAAO,IAAI,OAAA,IAAW,OAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,OAAA;AAAA,EACT;AACF;AAMA,eAAe,eAAA,CACb,OACA,MAAA,EACqD;AAErD,EAAA,MAAM,EAAE,SAAA,EAAW,aAAA,EAAc,GAAI,MAAMC,gCAAA,EAAuB;AAGlE,EAAA,MAAM,GAAA,GAAM,UAAUT,sBAAAA,CAAK,IAAA,CAAKC,oBAAG,OAAA,EAAQ,EAAG,QAAQ,MAAM,CAAA;AAC5D,EAAA,MAAMI,YAAG,KAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,MAAM,CAAA;AACvC,EAAA,MAAM,IAAA,GAAA,CAAQ,SAAS,KAAA,IAAS,cAAA;AAChC,EAAA,MAAM,WAAA,GAAcL,sBAAAA,CAAK,IAAA,CAAK,GAAA,EAAK,IAAI,CAAA;AAGvC,EAAA,MAAMK,YAAG,SAAA,CAAU,WAAA,EAAa,eAAe,EAAE,IAAA,EAAM,KAAO,CAAA;AAE9D,EAAA,OAAO,EAAE,WAAW,WAAA,EAAY;AAClC;AAEO,SAAS,gBAAA,GAA4B;AAC1C,EAAA,MAAM,OAAA,GAAU,IAAIK,iBAAA,EAAQ;AAG5B,EAAA,OAAA,CACG,IAAA,CAAK,YAAY,CAAA,CACjB,WAAA,CAAY,+CAA+C,CAAA,CAC3D,OAAA,CAAQ,oBAAoB,CAAA;AAK/B,EAAA,SAAS,WAAA,CAAY,OAAgB,MAAA,EAAwB;AAC3D,IAAA,IAAI,iBAAiBC,YAAA,EAAU;AAC7B,MAAA,MAAM,YAAY,KAAA,CAAM,IAAA,IAAQ,IAAA,GAAOL,uBAAAA,CAAM,MAAMA,uBAAAA,CAAM,MAAA;AACzD,MAAA,OAAO;AAAA,QACLA,uBAAAA,CAAM,GAAA,CAAI,CAAA,gCAAA,EAA8B,MAAM,CAAA,CAAE,CAAA;AAAA,QAChD,EAAA;AAAA,QACA,iBAAiB,SAAA,CAAU,KAAA,CAAM,IAAI,CAAC,CAAA,EAAA,EAAK,MAAM,SAAS,CAAA,CAAA,CAAA;AAAA,QAC1D,CAAA,WAAA,EAAc,MAAM,OAAO,CAAA;AAAA,OAC7B,CAAE,KAAK,IAAI,CAAA;AAAA,IACb;AAEA,IAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,MAAA,OAAO,CAACA,uBAAAA,CAAM,GAAA,CAAI,CAAA,4BAAA,EAA0B,MAAM,CAAA,CAAE,CAAA,EAAG,EAAA,EAAI,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,IAC5F;AAEA,IAAA,OAAO,CAACA,uBAAAA,CAAM,GAAA,CAAI,CAAA,4BAAA,EAA0B,MAAM,CAAA,CAAE,CAAA,EAAG,EAAA,EAAI,CAAA,EAAA,EAAK,OAAO,KAAK,CAAC,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EAC5F;AAGA,EAAA,OAAA,CACG,OAAA,CAAQ,gBAAgB,CAAA,CACxB,WAAA,CAAY,oEAAoE,CAAA,CAChF,MAAA,CAAO,2BAAA,EAA6B,qDAAqD,CAAA,CACzF,MAAA;AAAA,IACC,yBAAA;AAAA,IACA,2EAAA;AAAA,IACA;AAAA,GACF,CACC,MAAA;AAAA,IACC,4BAAA;AAAA,IACA,gEAAA;AAAA,IACA;AAAA,GACF,CACC,OAAO,oBAAA,EAAsB,mCAAA,EAAqC,MAAM,CAAA,CACxE,MAAA,CAAO,eAAA,EAAiB,0CAA0C,CAAA,CAClE,MAAA,CAAO,2BAA2B,oCAAA,EAAsC,MAAM,EAC9E,MAAA,CAAO,wBAAA,EAA0B,oCAAoC,CAAA,CACrE,MAAA,CAAO,mBAAA,EAAqB,uCAAuC,CAAA,CACnE,MAAA,CAAO,yBAAyB,kCAAkC,CAAA,CAClE,OAAO,6BAAA,EAA+B,qCAAqC,EAC3E,MAAA,CAAO,8BAAA,EAAgC,mCAAmC,CAAA,CAC1E,MAAA,CAAO,2BAAA,EAA6B,+CAA+C,CAAA,CACnF,MAAA,CAAO,kBAAkB,mCAAA,EAAqC,KAAK,EACnE,MAAA,CAAO,0BAAA,EAA4B,iDAAA,EAAmD,KAAK,CAAA,CAC3F,MAAA;AAAA,IACC,mBAAA;AAAA,IACA,6DAAA;AAAA,IACA;AAAA,GACF,CACC,OAAO,YAAA,EAAc,2BAA2B,EAChD,MAAA,CAAO,QAAA,EAAU,8DAA8D,CAAA,CAC/E,MAAA;AAAA,IACC,OACE,QACA,OAAA,KAmBG;AAGH,MAAA,IAAI,QAAQ,OAAA,EAAS;AACnB,QAAAA,wBAAM,KAAA,GAAQ,CAAA;AAAA,MAChB;AAEA,MAAA,MAAM,UAAUM,oBAAA,CAAI,CAAA,wBAAA,EAA2B,MAAM,CAAA,GAAA,CAAK,EAAE,KAAA,EAAM;AAElE,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,cAAA,GAAiB,MAAM,WAAU,GAAI,IAAA;AAC3D,QAAA,MAAM,kBAAA,GAAqB,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAAI,KAAA,CAAA;AAE3D,QAAA,MAAM,MAAA,GAAS,MAAMC,kBAAA,CAAS,MAAA,EAAQ;AAAA,UACpC,UAAU,OAAA,CAAQ,QAAA;AAAA,UAClB,SAAA,EAAW,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,OAAO,CAAA;AAAA,UAC1C,aAAA,EAAe,QAAQ,QAAA,KAAa,KAAA;AAAA,UACpC,kBAAA,EAAoB,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,mBAAmB,MAAM,CAAA;AAAA,UACrE,cAAc,OAAA,CAAQ,YAAA;AAAA,UACtB,cAAc,OAAA,CAAQ,MAAA;AAAA,UACtB,WAAW,OAAA,CAAQ,SAAA;AAAA,UACnB,iBAAiB,OAAA,CAAQ,eAAA;AAAA,UACzB,iBAAiB,OAAA,CAAQ,eAAA;AAAA,UACzB,GAAI,QAAQ,aAAA,GAAgB,EAAE,qBAAqB,OAAA,CAAQ,aAAA,KAAkB,EAAC;AAAA,UAC9E,aAAa,OAAA,CAAQ,WAAA;AAAA,UACrB,qBAAqB,OAAA,CAAQ,mBAAA;AAAA,UAC7B,sBAAsB,OAAA,CAAQ,oBAAA;AAAA,UAC9B,mBACE,OAAO,OAAA,CAAQ,aAAA,KAAkB,QAAA,GAAW,QAAQ,aAAA,GAAgB,IAAA;AAAA,UACtE,cAAA,EAAgB;AAAA,SACD,CAAA;AAEjB,QAAA,MAAM,gBAAgB,KAAA,GAClB,kBAAA,CAAmB,QAAQ,kBAAA,EAAoB,OAAA,CAAQ,eAAe,CAAA,GACtE,IAAA;AAEJ,QAAA,IAAI,KAAA,IAAS,aAAA,EAAe,aAAA,IAAiB,MAAA,CAAO,UAAA,EAAY;AAC9D,UAAA,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAAI,MAAA,CAAO,UAAA;AAC/B,UAAA,MAAM,UAAU,KAAK,CAAA;AAAA,QACvB;AAEA,QAAA,OAAA,CAAQ,IAAA,EAAK;AACb,QAAA,OAAA,CAAQ,GAAA,CAAI,iBAAA,CAAkB,MAAM,CAAC,CAAA;AAKrC,QAAA,OAAA,CAAQ,IAAA,CAAK,QAAQ,IAAA,GAAO,MAAA,CAAO,WAAW,MAAA,CAAO,QAAA,KAAa,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA;AAAA,MAC7E,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,IAAA,EAAK;AACb,QAAA,OAAA,CAAQ,GAAA,CAAI,WAAA,CAAY,KAAA,EAAO,MAAM,CAAC,CAAA;AAGtC,QAAA,IAAI,OAAA,CAAQ,IAAA,IAAQ,KAAA,YAAiBF,YAAA,EAAU;AAC7C,UAAA,OAAA,CAAQ,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,QACzB,CAAA,MAAO;AACL,UAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAGF,EAAA,OAAA,CACG,OAAA,CAAQ,eAAe,CAAA,CACvB,WAAA,CAAY,iEAAiE,CAAA,CAC7E,MAAA,CAAO,2BAAA,EAA6B,qDAAqD,CAAA,CACzF,MAAA,CAAO,oBAAA,EAAsB,mCAAA,EAAqC,MAAM,CAAA,CACxE,MAAA,CAAO,eAAA,EAAiB,0CAA0C,CAAA,CAClE,MAAA,CAAO,yBAAA,EAA2B,oCAAA,EAAsC,MAAM,CAAA,CAC9E,MAAA,CAAO,wBAAA,EAA0B,oCAAoC,CAAA,CACrE,OAAO,mBAAA,EAAqB,uCAAuC,CAAA,CACnE,MAAA,CAAO,uBAAA,EAAyB,kCAAkC,CAAA,CAClE,MAAA,CAAO,6BAAA,EAA+B,qCAAqC,CAAA,CAC3E,MAAA,CAAO,8BAAA,EAAgC,mCAAmC,CAAA,CAC1E,MAAA,CAAO,2BAAA,EAA6B,+CAA+C,CAAA,CACnF,MAAA,CAAO,gBAAA,EAAkB,mCAAA,EAAqC,KAAK,CAAA,CACnE,MAAA,CAAO,0BAAA,EAA4B,iDAAA,EAAmD,KAAK,CAAA,CAC3F,MAAA;AAAA,IACC,mBAAA;AAAA,IACA,6DAAA;AAAA,IACA;AAAA,GACF,CACC,OAAO,YAAA,EAAc,2BAA2B,EAChD,MAAA,CAAO,QAAA,EAAU,8DAA8D,CAAA,CAC/E,MAAA;AAAA,IACC,OACE,QACA,OAAA,KAiBG;AACH,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,cAAA,GAAiB,MAAM,WAAU,GAAI,IAAA;AAC3D,QAAA,MAAM,kBAAA,GAAqB,KAAA,GAAQ,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAAI,KAAA,CAAA;AAE3D,QAAA,MAAM,MAAA,GAAS,MAAME,kBAAA,CAAS,MAAA,EAAQ;AAAA,UACpC,UAAU,OAAA,CAAQ,QAAA;AAAA,UAClB,SAAA,EAAW,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,OAAO,CAAA;AAAA,UAC1C,aAAA,EAAe,QAAQ,QAAA,KAAa,KAAA;AAAA,UACpC,kBAAA,EAAoB,MAAA,CAAO,QAAA,CAAS,OAAA,CAAQ,mBAAmB,MAAM,CAAA;AAAA,UACrE,cAAc,OAAA,CAAQ,YAAA;AAAA,UACtB,cAAc,OAAA,CAAQ,MAAA;AAAA,UACtB,WAAW,OAAA,CAAQ,SAAA;AAAA,UACnB,iBAAiB,OAAA,CAAQ,eAAA;AAAA,UACzB,iBAAiB,OAAA,CAAQ,eAAA;AAAA,UACzB,GAAI,QAAQ,aAAA,GAAgB,EAAE,qBAAqB,OAAA,CAAQ,aAAA,KAAkB,EAAC;AAAA,UAC9E,WAAA,EAAa,QAAQ,WAAA,IAAe,KAAA;AAAA,UACpC,mBAAA,EAAqB,KAAA;AAAA;AAAA,UACrB,oBAAA,EAAsB,KAAA;AAAA,UACtB,mBACE,OAAO,OAAA,CAAQ,aAAA,KAAkB,QAAA,GAAW,QAAQ,aAAA,GAAgB,IAAA;AAAA,UACtE,cAAA,EAAgB;AAAA,SACD,CAAA;AAEjB,QAAA,MAAM,gBAAgB,KAAA,GAClB,kBAAA,CAAmB,QAAQ,kBAAA,EAAoB,OAAA,CAAQ,eAAe,CAAA,GACtE,IAAA;AAEJ,QAAA,IAAI,KAAA,IAAS,aAAA,EAAe,aAAA,IAAiB,MAAA,CAAO,UAAA,EAAY;AAC9D,UAAA,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAAI,MAAA,CAAO,UAAA;AAC/B,UAAA,MAAM,UAAU,KAAK,CAAA;AAAA,QACvB;AAEA,QAAA,OAAA,CAAQ,IAAI,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA;AAG3C,QAAA,OAAA,CAAQ,IAAA,CAAK,QAAQ,IAAA,GAAO,MAAA,CAAO,WAAW,MAAA,CAAO,QAAA,KAAa,CAAA,GAAI,CAAA,GAAI,CAAC,CAAA;AAAA,MAC7E,SAAS,KAAA,EAAO;AAEd,QAAA,IAAI,iBAAiBF,YAAA,EAAU;AAC7B,UAAA,OAAA,CAAQ,GAAA;AAAA,YACN,IAAA,CAAK,SAAA;AAAA,cACH;AAAA,gBACE,OAAA,EAAS,KAAA;AAAA,gBACT,MAAA;AAAA,gBACA,KAAA,EAAO;AAAA,kBACL,MAAM,KAAA,CAAM,IAAA;AAAA,kBACZ,WAAW,KAAA,CAAM,SAAA;AAAA,kBACjB,SAAS,KAAA,CAAM;AAAA,iBACjB;AAAA,gBACA,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,eACpC;AAAA,cACA,IAAA;AAAA,cACA;AAAA;AACF,WACF;AAEA,UAAA,OAAA,CAAQ,IAAA,CAAK,OAAA,CAAQ,IAAA,GAAO,KAAA,CAAM,OAAO,CAAC,CAAA;AAAA,QAC5C,CAAA,MAAA,IAAW,iBAAiB,KAAA,EAAO;AACjC,UAAA,OAAA,CAAQ,GAAA;AAAA,YACN,IAAA,CAAK,SAAA;AAAA,cACH;AAAA,gBACE,OAAA,EAAS,KAAA;AAAA,gBACT,MAAA;AAAA,gBACA,KAAA,EAAO;AAAA,kBACL,IAAA,EAAM,CAAA;AAAA,kBACN,SAAA,EAAW,eAAA;AAAA,kBACX,SAAS,KAAA,CAAM;AAAA,iBACjB;AAAA,gBACA,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,eACpC;AAAA,cACA,IAAA;AAAA,cACA;AAAA;AACF,WACF;AAEA,UAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,QAChB,CAAA,MAAO;AACL,UAAA,OAAA,CAAQ,GAAA;AAAA,YACN,IAAA,CAAK,SAAA;AAAA,cACH;AAAA,gBACE,OAAA,EAAS,KAAA;AAAA,gBACT,MAAA;AAAA,gBACA,KAAA,EAAO;AAAA,kBACL,IAAA,EAAM,CAAA;AAAA,kBACN,SAAA,EAAW,eAAA;AAAA,kBACX,OAAA,EAAS,OAAO,KAAK;AAAA,iBACvB;AAAA,gBACA,SAAA,EAAA,iBAAW,IAAI,IAAA,EAAK,EAAE,WAAA;AAAY,eACpC;AAAA,cACA,IAAA;AAAA,cACA;AAAA;AACF,WACF;AAEA,UAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAGF,EAAA,OAAA,CACG,OAAA,CAAQ,KAAK,CAAA,CACb,WAAA,CAAY,iBAAiB,CAAA,CAC7B,UAAA;AAAA,IACC,IAAID,iBAAA,CAAQ,UAAU,CAAA,CACnB,WAAA;AAAA,MACC;AAAA,MAED,MAAA,CAAO,gBAAA,EAAkB,6BAA6B,CAAA,CACtD,OAAO,aAAA,EAAe,kCAAkC,CAAA,CACxD,MAAA,CAAO,mBAAmB,wDAAA,EAA0D,KAAK,CAAA,CACzF,MAAA,CAAO,OAAO,IAAA,KAAmE;AAChF,MAAA,MAAM,EAAE,WAAW,WAAA,EAAY,GAAI,MAAM,eAAA,CAAgB,IAAA,CAAK,KAAA,EAAO,IAAA,CAAK,GAAG,CAAA;AAC7E,MAAA,OAAA,CAAQ,IAAI,SAAS,CAAA;AACrB,MAAA,OAAA,CAAQ,KAAA,CAAM,CAAA,qBAAA,EAAwB,WAAW,CAAA,CAAE,CAAA;AACnD,MAAA,IAAI,KAAK,YAAA,EAAc;AACrB,QAAA,OAAA,CAAQ,MAAM,uDAAuD,CAAA;AAAA,MACvE;AAAA,IACF,CAAC;AAAA,GACL,CACC,UAAA;AAAA,IACC,IAAIA,iBAAA,CAAQ,QAAQ,CAAA,CACjB,WAAA,CAAY,wCAAwC,CAAA,CACpD,cAAA,CAAe,aAAA,EAAe,8CAA8C,CAAA,CAC5E,MAAA,CAAO,CAAC,IAAA,KAA0B;AACjC,MAAA,MAAM,GAAA,GAAMI,mBAAA,CAAU,IAAA,CAAK,GAAG,CAAA;AAC9B,MAAA,IAAI,GAAA,CAAI,KAAA,EAAO,OAAA,CAAQ,GAAA,CAAI,cAAS,CAAA;AAAA,WAC/B;AACH,QAAA,OAAA,CAAQ,GAAA,CAAI,oBAAe,GAAA,CAAI,MAAA,GAAS,KAAK,GAAA,CAAI,MAAM,KAAK,EAAA,CAAG,CAAA;AAC/D,QAAA,OAAA,CAAQ,QAAA,GAAW,CAAA;AAAA,MACrB;AAAA,IACF,CAAC;AAAA,GACL;AAGF,EAAA,OAAA,CACG,OAAA,CAAQ,UAAU,CAAA,CAClB,WAAA,CAAY,wDAAwD,CAAA,CACpE,MAAA,CAAO,qBAAA,EAAuB,qCAAqC,CAAA,CACnE,MAAA,CAAO,OAAO,IAAA,KAAiC;AAC9C,IAAA,OAAA,CAAQ,GAAA,CAAIR,uBAAAA,CAAM,IAAA,CAAK,IAAA,CAAK,sBAAsB,CAAC,CAAA;AACnD,IAAA,OAAA,CAAQ,GAAA;AAAA,MACNA,uBAAAA,CAAM,KAAK,qEAAqE;AAAA,KAClF;AAEA,IAAA,MAAM,OAAA,GAAU,MAAMS,yBAAA,CAAS,MAAA,CAAkC;AAAA,MAC/D;AAAA,QACE,IAAA,EAAM,OAAA;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,OAAA,EAAS,4CAAA;AAAA,QACT,QAAA,EAAU,CAAC,KAAA,KAAmB,KAAA,GAAQ,IAAA,GAAO;AAAA,OAC/C;AAAA,MACA;AAAA,QACE,IAAA,EAAM,OAAA;AAAA,QACN,IAAA,EAAM,KAAA;AAAA,QACN,OAAA,EAAS,gDAAA;AAAA,QACT,QAAA,EAAU,CAAC,KAAA,KAAkB;AAC3B,UAAA,IAAI;AACF,YAAA,IAAI,IAAI,KAAK,CAAA;AACb,YAAA,OAAO,IAAA;AAAA,UACT,CAAA,CAAA,MAAQ;AACN,YAAA,OAAO,iEAAA;AAAA,UACT;AAAA,QACF;AAAA,OACF;AAAA,MACA;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,OAAA;AAAA,QACN,OAAA,EAAS,oCAAA;AAAA,QACT,OAAA,EAAS,MAAA,CAAO,IAAA,CAAKC,mBAAe,CAAA;AAAA,QACpC,OAAA,EAAS;AAAA,OACX;AAAA,MACA;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,MAAA;AAAA,QACN,OAAA,EAAS,4CAAA;AAAA,QACT,SAAS,CAAC,MAAA,EAAQ,GAAG,MAAA,CAAO,IAAA,CAAKC,eAAW,CAAC,CAAA;AAAA,QAC7C,MAAA,EAAQ,CAAC,GAAA,KAAiB,GAAA,KAAQ,SAAS,EAAA,GAAK;AAAA,OAClD;AAAA,MACA;AAAA,QACE,IAAA,EAAM,OAAA;AAAA,QACN,IAAA,EAAM,MAAA;AAAA,QACN,OAAA,EAAS,uCAAA;AAAA,QACT,QAAA,EAAU,CAAC,KAAA,KAAkB;AAC3B,UAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,UAAA,MAAM,aAAa,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,MAAA;AACnD,UAAA,OAAO,UAAA,IAAc,EAAA,IAAM,CAAA,eAAA,EAAkB,UAAU,CAAA,gBAAA,CAAA;AAAA,QACzD;AAAA,OACF;AAAA,MACA;AAAA,QACE,IAAA,EAAM,OAAA;AAAA,QACN,IAAA,EAAM,MAAA;AAAA,QACN,OAAA,EAAS,6BAAA;AAAA,QACT,QAAA,EAAU,CAAC,KAAA,KAAkB;AAC3B,UAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,UAAA,IAAI;AACF,YAAA,MAAM,CAAA,GAAI,IAAI,GAAA,CAAI,KAAK,CAAA;AACvB,YAAA,OAAO,CAAA,CAAE,aAAa,QAAA,IAAY,2BAAA;AAAA,UACpC,CAAA,CAAA,MAAQ;AACN,YAAA,OAAO,2BAAA;AAAA,UACT;AAAA,QACF;AAAA,OACF;AAAA,MACA;AAAA,QACE,IAAA,EAAM,OAAA;AAAA,QACN,IAAA,EAAM,KAAA;AAAA,QACN,OAAA,EAAS,wEAAA;AAAA,QACT,QAAA,EAAU,CAAC,KAAA,KAAkB;AAC3B,UAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,UAAA,OACG,IAAA,CAAK,IAAA,CAAK,KAAK,CAAA,IAAK,CAAC,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,KAAK,CAAC,CAAA,IACpD,6BAAA;AAAA,QAEJ;AAAA,OACF;AAAA,MACA;AAAA,QACE,IAAA,EAAM,SAAA;AAAA,QACN,IAAA,EAAM,QAAA;AAAA,QACN,OAAA,EAAS,6BAAA;AAAA,QACT,OAAA,EAAS;AAAA,OACX;AAAA,MACA;AAAA,QACE,IAAA,EAAM,OAAA;AAAA,QACN,IAAA,EAAM,KAAA;AAAA,QACN,OAAA,EAAS,uDAAA;AAAA,QACT,IAAA,EAAM,CAAC,CAAA,KAA4B,OAAA,CAAQ,EAAE,MAAM,CAAA;AAAA,QACnD,QAAA,EAAU,CAAC,KAAA,KAAkB;AAC3B,UAAA,IAAI,CAAC,OAAO,OAAO,kCAAA;AACnB,UAAA,MAAM,CAAA,GAAIH,oBAAU,KAAK,CAAA;AACzB,UAAA,OAAO,CAAA,CAAE,KAAA,IAAS,CAAA,CAAE,MAAA,IAAU,SAAA;AAAA,QAChC;AAAA;AACF,KACD,CAAA;AAGD,IAAA,MAAM,QAAA,GAAW,OAAA;AACjB,IAAA,MAAM,SAAA,GAAYI,+BAAA,CAAsB,QAAA,EAAU,IAAI,CAAA;AACtD,IAAA,MAAM,UAAA,GAAaC,4BAAkB,SAAS,CAAA;AAE9C,IAAA,OAAA,CAAQ,GAAA,CAAIb,uBAAAA,CAAM,KAAA,CAAM,iCAAiC,CAAC,CAAA;AAC1D,IAAA,OAAA,CAAQ,GAAA,CAAIA,uBAAAA,CAAM,IAAA,CAAK,OAAO,CAAC,CAAA;AAC/B,IAAA,OAAA,CAAQ,IAAIA,uBAAAA,CAAM,MAAA,CAAO,UAAU,QAAA,CAAS,MAAM,EAAE,CAAC,CAAA;AACrD,IAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,IAAA,OAAA,CAAQ,GAAA,CAAIA,uBAAAA,CAAM,IAAA,CAAK,OAAO,CAAC,CAAA;AAC/B,IAAA,OAAA,CAAQ,GAAA,CAAIA,uBAAAA,CAAM,MAAA,CAAO,KAAK,CAAC,CAAA;AAC/B,IAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AACd,IAAA,OAAA,CAAQ,GAAA,CAAIA,uBAAAA,CAAM,IAAA,CAAK,QAAQ,CAAC,CAAA;AAChC,IAAA,OAAA,CAAQ,GAAA,CAAIA,uBAAAA,CAAM,MAAA,CAAO,SAAS,CAAC,CAAA;AACnC,IAAA,OAAA,CAAQ,IAAI,EAAE,CAAA;AAEd,IAAA,IAAI,WAAW,OAAA,EAAS;AACtB,MAAA,IAAI;AACF,QAAA,MAAMc,2BAAA,CAAW,MAAM,SAAS,CAAA;AAChC,QAAA,OAAA,CAAQ,GAAA;AAAA,UACNd,uBAAAA,CAAM,IAAA,CAAK,KAAA,CAAM,yEAAoE;AAAA,SACvF;AAAA,MACF,CAAA,CAAA,MAAQ;AAEN,QAAA,OAAA,CAAQ,GAAA,CAAIA,uBAAAA,CAAM,GAAA,CAAI,8DAA8D,CAAC,CAAA;AAAA,MACvF;AAGA,MAAA,IAAI,KAAK,SAAA,EAAW;AAClB,QAAA,IAAI;AACF,UAAA,MAAMe,kBAAA,CAAU,IAAA,CAAK,SAAA,EAAW,SAAA,EAAW,MAAM,CAAA;AACjD,UAAA,OAAA,CAAQ,IAAIf,uBAAAA,CAAM,KAAA,CAAM,4BAAqB,IAAA,CAAK,SAAS,EAAE,CAAC,CAAA;AAAA,QAChE,SAAS,KAAA,EAAO;AACd,UAAA,IAAI,iBAAiB,KAAA,EAAO;AAC1B,YAAA,OAAA,CAAQ,IAAIA,uBAAAA,CAAM,GAAA,CAAI,yBAAyB,KAAA,CAAM,OAAO,EAAE,CAAC,CAAA;AAAA,UACjE,CAAA,MAAO;AACL,YAAA,OAAA,CAAQ,GAAA,CAAIA,wBAAM,GAAA,CAAI,CAAA,sBAAA,EAAyB,OAAO,KAAK,CAAC,EAAE,CAAC,CAAA;AAAA,UACjE;AAAA,QACF;AAAA,MACF;AAAA,IACF,CAAA,MAAO;AACL,MAAA,OAAA,CAAQ,GAAA,CAAIA,wBAAM,IAAA,CAAK,GAAA,CAAI,gCAAyB,UAAA,CAAW,KAAK,EAAE,CAAC,CAAA;AAAA,IACzE;AAAA,EACF,CAAC,CAAA;AAGH,EAAA,OAAA,CACG,QAAQ,SAAS,CAAA,CACjB,YAAY,0BAA0B,CAAA,CACtC,OAAO,YAAY;AAClB,IAAA,MAAM,UAAU,kBAAA,EAAmB;AACnC,IAAA,OAAA,CAAQ,GAAA;AAAA,MACN;AAAA,QACEA,uBAAAA,CAAM,IAAA,CAAK,YAAY,CAAA,GAAI,mCAAA;AAAA,QAC3B,CAAA,SAAA,EAAYA,uBAAAA,CAAM,KAAA,CAAM,OAAO,CAAC,CAAA,CAAA;AAAA,QAChC,CAAA,MAAA,EAASA,uBAAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,OAAO,CAAC,CAAA,CAAA;AAAA,QACpC,CAAA,UAAA,EAAaA,uBAAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAC,CAAA,CAAA;AAAA,QACzC,EAAA;AAAA,QACA,8BAAA;AAAA,QACAA,uBAAAA,CAAM,KAAK,gCAAgC;AAAA,OAC7C,CAAE,KAAK,IAAI;AAAA,KACb;AAAA,EACF,CAAC,CAAA;AAGH,EAAA,OAAO,OAAA;AACT;AAEO,SAAS,sBACd,QAAA,EACA,UAAA,GAAagB,iBAAA,CAAc,yPAAe,CAAA,EACjC;AACT,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,OAAO,KAAA;AAAA,EACT;AAEA,EAAA,MAAM,gBAAA,GAAmBtB,sBAAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AAC9C,EAAA,IAAI;AACF,IAAA,OAAOuB,eAAA,CAAa,UAAU,CAAA,KAAMA,eAAA,CAAa,gBAAgB,CAAA;AAAA,EACnE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,UAAA,KAAe,gBAAA;AAAA,EACxB;AACF;AAEA,IAAM,cAAA,GAAiB,qBAAA,CAAsB,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAC,CAAA;AAE5D,IAAI,cAAA,EAAgB;AAClB,EAAA,gBAAA,GAAmB,KAAA,EAAM;AAC3B","file":"cli.cjs","sourcesContent":["import { promises as fs } from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport type { DoctorReport } from '@agentcommunity/aid-engine';\nimport {\n  classifySecurityChange as engineClassifySecurityChange,\n  derivePkaKeyid as engineDerivePkaKeyid,\n  shouldRejectForFailPolicy as engineShouldRejectForFailPolicy,\n} from '@agentcommunity/aid-engine';\n\nexport const CACHE_SCHEMA_VERSION = 3;\n\nexport type CacheTrustSource = 'dns' | 'well-known-tls';\n\n// Re-exported from aid-engine so the doctor cache and the engine checker share a\n// single source of truth for security-change classification (no divergent copy).\nexport type { SecurityChangeStatus } from '@agentcommunity/aid-engine';\n\nexport interface CacheEntry {\n  lastSeen: string;\n  version?: string | null;\n  trustSource?: CacheTrustSource;\n  pka: string | null;\n  kid: string | null;\n  keyid?: string | null;\n  jwkX?: string | null;\n  domainBound?: boolean | null;\n  hash?: string | null;\n}\n\nexport interface CacheShape {\n  schemaVersion: typeof CACHE_SCHEMA_VERSION;\n  entries: Record<string, CacheEntry>;\n}\n\nfunction cachePath(): string {\n  return path.join(os.homedir(), '.aid', 'cache.json');\n}\n\n// Re-exported from aid-engine: the engine owns the single PKA key-identity\n// derivation, so the doctor cache and the engine checker can never diverge.\nexport const derivePkaKeyid = engineDerivePkaKeyid;\n\nfunction isCacheEntry(value: unknown): value is CacheEntry {\n  if (!value || typeof value !== 'object') return false;\n  const entry = value as Partial<CacheEntry>;\n  return (\n    typeof entry.lastSeen === 'string' &&\n    (typeof entry.pka === 'string' || entry.pka === null) &&\n    (typeof entry.kid === 'string' || entry.kid === null)\n  );\n}\n\nfunction migrateEntry(entry: CacheEntry): CacheEntry {\n  const keyMaterial = derivePkaKeyid(entry.pka);\n  return {\n    ...entry,\n    version: entry.version ?? (entry.pka?.startsWith('z') ? 'aid1' : entry.pka ? 'aid2' : null),\n    trustSource: entry.trustSource ?? 'dns',\n    keyid: entry.keyid ?? keyMaterial?.keyid ?? null,\n    jwkX: entry.jwkX ?? keyMaterial?.jwkX ?? null,\n    domainBound: entry.domainBound ?? null,\n  };\n}\n\nexport function migrateCacheFile(raw: unknown): CacheShape {\n  if (\n    raw &&\n    typeof raw === 'object' &&\n    (raw as Partial<CacheShape>).schemaVersion === CACHE_SCHEMA_VERSION &&\n    (raw as Partial<CacheShape>).entries &&\n    typeof (raw as Partial<CacheShape>).entries === 'object'\n  ) {\n    return raw as CacheShape;\n  }\n\n  const entries: Record<string, CacheEntry> = {};\n  if (!raw || typeof raw !== 'object') {\n    return { schemaVersion: CACHE_SCHEMA_VERSION, entries };\n  }\n\n  // A wrapped-but-stale file (older schemaVersion) must be migrated by descending\n  // into its nested `entries` map. Iterating the top-level object and skipping the\n  // `entries` key would silently DROP every entry on a schema bump.\n  const wrapped = raw as Partial<CacheShape>;\n  const source: Record<string, unknown> =\n    wrapped.entries && typeof wrapped.entries === 'object'\n      ? (wrapped.entries as Record<string, unknown>)\n      : (raw as Record<string, unknown>);\n\n  for (const [domain, entry] of Object.entries(source)) {\n    if (domain === 'schemaVersion' || domain === 'entries') continue;\n    if (isCacheEntry(entry)) {\n      entries[domain] = migrateEntry(entry);\n    }\n  }\n\n  return { schemaVersion: CACHE_SCHEMA_VERSION, entries };\n}\n\nexport function buildCacheEntryFromReport(report: DoctorReport, now = new Date()): CacheEntry {\n  const record = report.record.parsed;\n  const keyMaterial = derivePkaKeyid(record?.pka ?? null);\n  return {\n    lastSeen: now.toISOString(),\n    version: record?.v ?? null,\n    trustSource: report.queried.wellKnown.used ? 'well-known-tls' : 'dns',\n    pka: record?.pka ?? null,\n    kid: record?.v === 'aid1' ? (record.kid ?? null) : null,\n    keyid: keyMaterial?.keyid ?? null,\n    jwkX: keyMaterial?.jwkX ?? null,\n    domainBound: report.pka.domainBound ?? null,\n    hash: report.cacheEntry?.hash ?? null,\n  };\n}\n\n// Re-exported from aid-engine so the runtime CLI path and the engine checker use\n// the identical classification logic (including the derivePkaKeyid fallback for\n// pka-set/keyid-null entries). Eliminates the previous divergent copy that\n// false-positived key_replaced for such entries.\nexport const classifySecurityChange = engineClassifySecurityChange;\n\n// Re-exported from aid-engine so the doctor's applySecurityState and the engine\n// checker's downgrade block apply identical fail-policy rejection semantics.\nexport const shouldRejectForFailPolicy = engineShouldRejectForFailPolicy;\n\nexport async function loadCache(): Promise<CacheShape> {\n  try {\n    const p = cachePath();\n    const data = await fs.readFile(p, 'utf8');\n    return migrateCacheFile(JSON.parse(data));\n  } catch {\n    return { schemaVersion: CACHE_SCHEMA_VERSION, entries: {} };\n  }\n}\n\nasync function ensureDir(filePath: string): Promise<void> {\n  try {\n    await fs.mkdir(path.dirname(filePath), { recursive: true });\n  } catch {\n    // ignore\n  }\n}\n\nexport async function saveCache(cache: CacheShape): Promise<void> {\n  const p = cachePath();\n  await ensureDir(p);\n  const tmp = p + '.tmp';\n  const content = JSON.stringify(migrateCacheFile(cache), null, 2);\n  await fs.writeFile(tmp, content, { mode: 0o600 });\n  await fs.rename(tmp, p);\n}\n","import chalk from 'chalk';\nimport type { DoctorReport } from '@agentcommunity/aid-engine';\nimport { ERROR_MESSAGES } from '@agentcommunity/aid-engine';\nimport { derivePkaKeyid } from './cache';\n\nfunction generateActionableSuggestions(report: DoctorReport): string[] {\n  const suggestions: string[] = [];\n  const { record, dnssec, tls, pka } = report;\n  const icon = chalk.blue('💡');\n\n  if (record.raw) {\n    const byteLen = new TextEncoder().encode(record.raw).length;\n    if (byteLen > 255) {\n      suggestions.push(\n        `${icon} ${chalk.bold('Reduce record size:')} ${ERROR_MESSAGES.BYTE_LIMIT_EXCEEDED}`,\n      );\n    }\n  }\n\n  if (record.warnings.some((warning) => warning.code === 'LONG_KEY_COMPAT')) {\n    suggestions.push(\n      `${icon} ${chalk.bold('Canonicalize TXT keys:')} ${ERROR_MESSAGES.USE_ALIASES}`,\n    );\n  }\n\n  if (!dnssec.present) {\n    suggestions.push(`${icon} ${chalk.bold('Enable DNSSEC:')} ${ERROR_MESSAGES.ENABLE_DNSSEC}`);\n  }\n\n  if (!pka.present) {\n    suggestions.push(`${icon} ${chalk.bold('Add endpoint proof:')} ${ERROR_MESSAGES.ADD_PKA}`);\n  }\n\n  if (record.parsed?.v === 'aid2' && pka.present && pka.verified && pka.domainBound === false) {\n    suggestions.push(\n      `${icon} ${chalk.bold('Enable domain binding:')} Your endpoint proof is valid but not domain-bound. Configure your endpoint to cover the AID-Domain header in its HTTP Message Signature so the endpoint attests that it serves the queried domain.`,\n    );\n  }\n\n  if (tls.checked && tls.valid && tls.daysRemaining !== null && tls.daysRemaining < 21) {\n    suggestions.push(`${icon} ${chalk.bold('Renew TLS certificate:')} ${ERROR_MESSAGES.RENEW_TLS}`);\n  }\n\n  if (record.errors.some((e) => e.code === 'ERR_UNSUPPORTED_PROTO')) {\n    suggestions.push(\n      `${icon} ${chalk.bold('Check protocol support:')} The protocol in your record is not supported by this client. See the official registry for valid tokens.`,\n    );\n  }\n\n  return suggestions;\n}\n\nexport function formatCheckResult(report: DoctorReport): string {\n  const { domain, record, queried, tls, dnssec, pka, downgrade } = report;\n  const lines: string[] = [];\n\n  const icons = {\n    ok: chalk.green('✅'),\n    error: chalk.red('❌'),\n    warn: chalk.yellow('⚠️'),\n    info: chalk.blue('💡'),\n  };\n\n  const finalQueryName = queried.attempts[queried.attempts.length - 1]?.name ?? `_agent.${domain}`;\n\n  // 1. DNS\n  const dnsAttempt = queried.attempts.find((a) => a.result === 'NOERROR');\n  if (dnsAttempt) {\n    const ttl = dnsAttempt.ttl ?? 'N/A';\n    const bytes = new TextEncoder().encode(record.raw ?? '').length;\n    const source = queried.wellKnown.used ? '(.well-known)' : '(DNS)';\n    lines.push(\n      `[1/6] DNS TXT ${chalk.cyan(finalQueryName)} ... ${icons.ok} Found ${source} (TTL ${ttl}, ${bytes} bytes)`,\n    );\n  } else {\n    lines.push(`[1/6] DNS TXT ${chalk.cyan(finalQueryName)} ... ${icons.error} Not Found`);\n  }\n\n  // 2. Record Validation\n  if (record.valid) {\n    lines.push(`[2/6] Record validation ... ${icons.ok} Valid`);\n  } else {\n    const msg = record.errors[0]?.message ?? 'Invalid structure';\n    lines.push(`[2/6] Record validation ... ${icons.error} ${msg}`);\n  }\n\n  // 3. DNSSEC\n  if (dnssec.present) {\n    lines.push(`[3/6] DNSSEC (RRSIG) ... ${icons.ok} Detected`);\n  } else {\n    lines.push(`[3/6] DNSSEC (RRSIG) ... ${icons.info} Not detected`);\n  }\n\n  // 4. TLS\n  if (tls.checked) {\n    if (tls.valid) {\n      const expiry = tls.daysRemaining;\n      lines.push(\n        `[4/6] TLS ${chalk.cyan(tls.host ?? '')} ... ${icons.ok} Valid (SAN matches, expires in ${expiry} days)`,\n      );\n    } else {\n      const reason =\n        record.errors.find((e) => e.code.startsWith('ERR_SECURITY'))?.message ??\n        'TLS validation failed';\n      lines.push(`[4/6] TLS ... ${icons.error} ${reason}`);\n    }\n  } else {\n    lines.push(`[4/6] TLS ... ${chalk.gray('Skipped (local protocol)')}`);\n  }\n\n  // 5. PKA Handshake\n  if (pka.present) {\n    if (pka.verified) {\n      const keyLabel =\n        record.parsed?.v === 'aid2'\n          ? `keyid=${derivePkaKeyid(record.parsed.pka ?? null)?.keyid ?? 'unknown'}`\n          : `legacy kid=${pka.kid ?? record.parsed?.kid ?? 'unknown'}`;\n      const isAid2 = record.parsed?.v === 'aid2';\n      const bindingLabel =\n        pka.domainBound === true\n          ? ', domain-bound'\n          : isAid2 && pka.domainBound === false\n            ? ', endpoint-proof only'\n            : '';\n      lines.push(\n        `[5/6] PKA handshake ... ${icons.ok} Verified (alg=${pka.alg}, ${keyLabel}${bindingLabel})`,\n      );\n    } else {\n      const reason =\n        record.errors.find((e) => e.message.includes('PKA'))?.message ?? 'Verification failed';\n      lines.push(`[5/6] PKA handshake ... ${icons.error} ${reason}`);\n    }\n  } else {\n    lines.push(`[5/6] PKA handshake ... ${icons.info} Not present`);\n  }\n\n  // 6. Downgrade Check\n  if (downgrade.checked) {\n    const status = downgrade.status;\n    if (status === 'downgrade' || status === 'pka_removed') {\n      lines.push(`[6/6] Downgrade check ... ${icons.warn} PKA removed`);\n    } else if (status === 'key_rotation' || status === 'key_replaced') {\n      lines.push(`[6/6] Downgrade check ... ${icons.warn} PKA key replaced`);\n    } else if (status === 'pka_added') {\n      lines.push(`[6/6] Downgrade check ... ${icons.ok} PKA added`);\n    } else if (status === 'version_downgrade') {\n      lines.push(`[6/6] Downgrade check ... ${icons.warn} AID version downgrade aid2->aid1`);\n    } else if (status === 'binding_loss') {\n      lines.push(\n        `[6/6] Downgrade check ... ${icons.warn} Domain-binding lost (endpoint-proof only)`,\n      );\n    } else if (status === 'fallback_well_known_tls') {\n      lines.push(\n        `[6/6] Downgrade check ... ${icons.warn} DNS failed; using TLS-hosted fallback metadata (trustSource=well-known-tls)`,\n      );\n    } else {\n      lines.push(\n        `[6/6] Downgrade check ... ${icons.ok} ${status === 'first_seen' ? 'First seen' : 'No change'}`,\n      );\n    }\n  } else {\n    lines.push(`[6/6] Downgrade check ... ${chalk.gray('Skipped')}`);\n  }\n\n  lines.push('\\n--- Summary ---');\n  if (report.exitCode === 0) {\n    const warnings = record.warnings.filter((w) => w.code !== 'PROTOCOL_SUBDOMAIN_EXISTS');\n    if (warnings.length > 0) {\n      lines.push(`${icons.warn} Record is valid but has ${warnings.length} warning(s).`);\n      for (const warn of warnings) {\n        lines.push(`  - ${warn.message}`);\n      }\n    } else {\n      lines.push(`${icons.ok} Record is valid and secure.`);\n    }\n  } else {\n    lines.push(\n      `${icons.error} Found ${report.record.errors.length} error(s) and ${record.warnings.length} warning(s).`,\n    );\n  }\n\n  const suggestions = generateActionableSuggestions(report);\n  if (suggestions.length > 0) {\n    lines.push('\\n--- Recommendations ---');\n    lines.push(...suggestions);\n  }\n\n  return lines.join('\\n');\n}\n","import type { DoctorReport } from '@agentcommunity/aid-engine';\nimport {\n  buildCacheEntryFromReport,\n  classifySecurityChange,\n  shouldRejectForFailPolicy,\n  type CacheEntry,\n  type SecurityChangeStatus,\n} from './cache';\n\ntype DowngradePolicy = 'off' | 'warn' | 'fail';\n\ninterface ApplySecurityStateResult {\n  shouldPersist: boolean;\n}\n\nexport function applySecurityState(\n  report: DoctorReport,\n  previousCacheEntry: CacheEntry | undefined,\n  downgradePolicy?: DowngradePolicy,\n): ApplySecurityStateResult {\n  if (!report.record.parsed) return { shouldPersist: false };\n  if (report.exitCode !== 0 || report.pka.verified === false) {\n    report.cacheEntry = null;\n    return { shouldPersist: false };\n  }\n\n  const currentEntry = buildCacheEntryFromReport(report);\n  const status = classifySecurityChange(previousCacheEntry, currentEntry);\n  report.downgrade.checked = true;\n  report.downgrade.previous = previousCacheEntry\n    ? {\n        pka: previousCacheEntry.pka,\n        kid: previousCacheEntry.kid,\n        keyid: previousCacheEntry.keyid ?? null,\n        version: previousCacheEntry.version ?? null,\n        trustSource: previousCacheEntry.trustSource ?? 'dns',\n      }\n    : null;\n  report.downgrade.status = status;\n\n  const warningByStatus: Partial<Record<SecurityChangeStatus, { code: string; message: string }>> =\n    {\n      pka_removed: {\n        code: 'PKA_REMOVED',\n        message: 'Previously present PKA was removed.',\n      },\n      key_replaced: {\n        code: 'KEY_REPLACED',\n        message: 'Previously observed PKA key was replaced.',\n      },\n      version_downgrade: {\n        code: 'VERSION_DOWNGRADE',\n        message: 'Previously observed aid2 record is now aid1.',\n      },\n      fallback_well_known_tls: {\n        code: 'FALLBACK_WELL_KNOWN_TLS',\n        message: 'DNS failed and .well-known supplied TLS-hosted metadata.',\n      },\n      pka_added: {\n        code: 'PKA_ADDED',\n        message: 'PKA endpoint proof was added since the previous check.',\n      },\n      binding_loss: {\n        code: 'BINDING_LOSS',\n        message:\n          'Domain-binding proof was present in the previous check but is now absent (endpoint-proof only).',\n      },\n    };\n  const warning = warningByStatus[status];\n  if (warning) {\n    report.record.warnings.push(warning);\n  }\n\n  if (downgradePolicy === 'fail' && shouldRejectForFailPolicy(status, previousCacheEntry)) {\n    report.exitCode = 1003;\n    report.cacheEntry = null;\n    return { shouldPersist: false };\n  }\n\n  report.cacheEntry = currentEntry;\n  return { shouldPersist: true };\n}\n","#!/usr/bin/env node\n\nimport { Command } from 'commander';\nimport { writeFile } from 'fs/promises';\nimport { promises as fs, readFileSync, realpathSync } from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport { fileURLToPath } from 'node:url';\nimport { AidError, PROTOCOL_TOKENS, AUTH_TOKENS } from '@agentcommunity/aid';\nimport {\n  runCheck,\n  validateTxtRecord,\n  buildTxtRecordVariant,\n  verifyPka,\n  generateEd25519KeyPair,\n  type AidGeneratorData,\n  type CheckOptions,\n} from '@agentcommunity/aid-engine';\nimport chalk from 'chalk';\nimport ora from 'ora';\nimport inquirer from 'inquirer';\nimport clipboardy from 'clipboardy';\nimport { formatCheckResult } from './output';\nimport { loadCache, saveCache } from './cache';\nimport { applySecurityState } from './security-state';\n\nfunction readPackageVersion(): string {\n  try {\n    const pkgUrl = new URL('../package.json', import.meta.url);\n    const fileContents = readFileSync(pkgUrl, 'utf8');\n    const pkg = JSON.parse(fileContents) as { version?: string };\n    return pkg.version ?? '0.0.0';\n  } catch {\n    return '0.0.0';\n  }\n}\n\n/**\n * CLI-specific function that generates Ed25519 keys and saves them to disk.\n * Uses the pure generateEd25519KeyPair from aid-engine.\n */\nasync function generateEd25519(\n  label?: string,\n  outDir?: string,\n): Promise<{ publicKey: string; privatePath: string }> {\n  // Generate the key pair using the pure function from aid-engine\n  const { publicKey, privateKeyPem } = await generateEd25519KeyPair();\n\n  // Handle filesystem operations in the CLI layer\n  const dir = outDir || path.join(os.homedir(), '.aid', 'keys');\n  await fs.mkdir(dir, { recursive: true });\n  const name = (label || 'key') + '-ed25519.key';\n  const privatePath = path.join(dir, name);\n\n  // Write the private key to disk\n  await fs.writeFile(privatePath, privateKeyPem, { mode: 0o600 });\n\n  return { publicKey, privatePath };\n}\n\nexport function createCliProgram(): Command {\n  const program = new Command();\n\n  // Package info\n  program\n    .name('aid-doctor')\n    .description('CLI tool for Agent Identity & Discovery (AID)')\n    .version(readPackageVersion());\n\n  /**\n   * Format an error for human-readable output\n   */\n  function formatError(error: unknown, domain: string): string {\n    if (error instanceof AidError) {\n      const codeColor = error.code >= 1003 ? chalk.red : chalk.yellow;\n      return [\n        chalk.red(`❌ AID Discovery Failed for ${domain}`),\n        '',\n        `  Error Code: ${codeColor(error.code)} (${error.errorCode})`,\n        `  Message: ${error.message}`,\n      ].join('\\n');\n    }\n\n    if (error instanceof Error) {\n      return [chalk.red(`❌ Unexpected Error for ${domain}`), '', `  ${error.message}`].join('\\n');\n    }\n\n    return [chalk.red(`❌ Unexpected Error for ${domain}`), '', `  ${String(error)}`].join('\\n');\n  }\n\n  // Check command - human-readable report\n  program\n    .command('check <domain>')\n    .description('Check a domain for AID records and display a human-readable report')\n    .option('-p, --protocol <protocol>', 'Diagnostics hint only; base-first remains canonical')\n    .option(\n      '--probe-proto-subdomain',\n      'If base TXT is missing and --protocol set, probe _agent._<proto>.<domain>',\n      false,\n    )\n    .option(\n      '--probe-proto-even-if-base',\n      'Probe proto subdomain even when base exists (diagnostics only)',\n      false,\n    )\n    .option('-t, --timeout <ms>', 'DNS query timeout in milliseconds', '5000')\n    .option('--no-fallback', 'Disable .well-known fallback on DNS miss')\n    .option('--fallback-timeout <ms>', 'Timeout for .well-known fetch (ms)', '2000')\n    .option('--security-mode <mode>', 'Security preset: balanced | strict')\n    .option('--dnssec <policy>', 'DNSSEC policy: off | prefer | require')\n    .option('--pka-policy <policy>', 'PKA policy: if-present | require')\n    .option('--downgrade-policy <policy>', 'Downgrade policy: off | warn | fail')\n    .option('--well-known-policy <policy>', 'Well-known policy: auto | disable')\n    .option('--domain-binding <policy>', 'Domain binding policy: off | prefer | require')\n    .option('--show-details', 'Show TLS/DNSSEC/PKA short details', false)\n    .option('--dump-well-known [path]', 'On fallback failure, print or save body snippet', false)\n    .option(\n      '--check-downgrade',\n      'Consult cache and warn when pka has been removed or changed',\n      false,\n    )\n    .option('--no-color', 'Disable ANSI color output')\n    .option('--code', 'Exit with the specific error code on failure (for scripting)')\n    .action(\n      async (\n        domain: string,\n        options: {\n          protocol?: string;\n          probeProtoSubdomain?: boolean;\n          probeProtoEvenIfBase?: boolean;\n          timeout: string;\n          fallback?: boolean;\n          fallbackTimeout?: string;\n          securityMode?: 'balanced' | 'strict';\n          dnssec?: 'off' | 'prefer' | 'require';\n          pkaPolicy?: 'if-present' | 'require';\n          downgradePolicy?: 'off' | 'warn' | 'fail';\n          wellKnownPolicy?: 'auto' | 'disable';\n          domainBinding?: 'off' | 'prefer' | 'require';\n          showDetails?: boolean;\n          dumpWellKnown?: string | boolean;\n          checkDowngrade?: boolean;\n          noColor?: boolean;\n          code?: boolean;\n        },\n      ) => {\n        // Chalk handles --no-color via environment variables or its own detection.\n        // commander's --no-color is a standard way to control it.\n        if (options.noColor) {\n          chalk.level = 0;\n        }\n\n        const spinner = ora(`Checking AID record for ${domain}...`).start();\n\n        try {\n          const cache = options.checkDowngrade ? await loadCache() : null;\n          const previousCacheEntry = cache ? cache.entries[domain] : undefined;\n\n          const report = await runCheck(domain, {\n            protocol: options.protocol,\n            timeoutMs: Number.parseInt(options.timeout),\n            allowFallback: options.fallback !== false,\n            wellKnownTimeoutMs: Number.parseInt(options.fallbackTimeout || '2000'),\n            securityMode: options.securityMode,\n            dnssecPolicy: options.dnssec,\n            pkaPolicy: options.pkaPolicy,\n            downgradePolicy: options.downgradePolicy,\n            wellKnownPolicy: options.wellKnownPolicy,\n            ...(options.domainBinding ? { domainBindingPolicy: options.domainBinding } : {}),\n            showDetails: options.showDetails,\n            probeProtoSubdomain: options.probeProtoSubdomain,\n            probeProtoEvenIfBase: options.probeProtoEvenIfBase,\n            dumpWellKnownPath:\n              typeof options.dumpWellKnown === 'string' ? options.dumpWellKnown : null,\n            checkDowngrade: false,\n          } as CheckOptions);\n\n          const securityState = cache\n            ? applySecurityState(report, previousCacheEntry, options.downgradePolicy)\n            : null;\n\n          if (cache && securityState?.shouldPersist && report.cacheEntry) {\n            cache.entries[domain] = report.cacheEntry;\n            await saveCache(cache);\n          }\n\n          spinner.stop();\n          console.log(formatCheckResult(report));\n\n          // Honor --code: when set, emit the granular report exit code (e.g.\n          // 1001/1003); otherwise collapse any failure to a generic exit 1 so\n          // scripts that opt out of granular codes get a stable success/failure.\n          process.exit(options.code ? report.exitCode : report.exitCode === 0 ? 0 : 1);\n        } catch (error) {\n          spinner.stop();\n          console.log(formatError(error, domain));\n\n          // Exit with error code\n          if (options.code && error instanceof AidError) {\n            process.exit(error.code);\n          } else {\n            process.exit(1);\n          }\n        }\n      },\n    );\n\n  // JSON command - machine-readable JSON output\n  program\n    .command('json <domain>')\n    .description('Check a domain for AID records and output machine-readable JSON')\n    .option('-p, --protocol <protocol>', 'Diagnostics hint only; base-first remains canonical')\n    .option('-t, --timeout <ms>', 'DNS query timeout in milliseconds', '5000')\n    .option('--no-fallback', 'Disable .well-known fallback on DNS miss')\n    .option('--fallback-timeout <ms>', 'Timeout for .well-known fetch (ms)', '2000')\n    .option('--security-mode <mode>', 'Security preset: balanced | strict')\n    .option('--dnssec <policy>', 'DNSSEC policy: off | prefer | require')\n    .option('--pka-policy <policy>', 'PKA policy: if-present | require')\n    .option('--downgrade-policy <policy>', 'Downgrade policy: off | warn | fail')\n    .option('--well-known-policy <policy>', 'Well-known policy: auto | disable')\n    .option('--domain-binding <policy>', 'Domain binding policy: off | prefer | require')\n    .option('--show-details', 'Show TLS/DNSSEC/PKA short details', false)\n    .option('--dump-well-known [path]', 'On fallback failure, print or save body snippet', false)\n    .option(\n      '--check-downgrade',\n      'Consult cache and warn when pka has been removed or changed',\n      false,\n    )\n    .option('--no-color', 'Disable ANSI color output')\n    .option('--code', 'Exit with the specific error code on failure (for scripting)')\n    .action(\n      async (\n        domain: string,\n        options: {\n          protocol?: string;\n          timeout: string;\n          fallback?: boolean;\n          fallbackTimeout?: string;\n          securityMode?: 'balanced' | 'strict';\n          dnssec?: 'off' | 'prefer' | 'require';\n          pkaPolicy?: 'if-present' | 'require';\n          downgradePolicy?: 'off' | 'warn' | 'fail';\n          wellKnownPolicy?: 'auto' | 'disable';\n          domainBinding?: 'off' | 'prefer' | 'require';\n          showDetails?: boolean;\n          dumpWellKnown?: string | boolean;\n          checkDowngrade?: boolean;\n          noColor?: boolean;\n          code?: boolean;\n        },\n      ) => {\n        try {\n          const cache = options.checkDowngrade ? await loadCache() : null;\n          const previousCacheEntry = cache ? cache.entries[domain] : undefined;\n\n          const report = await runCheck(domain, {\n            protocol: options.protocol,\n            timeoutMs: Number.parseInt(options.timeout),\n            allowFallback: options.fallback !== false,\n            wellKnownTimeoutMs: Number.parseInt(options.fallbackTimeout || '2000'),\n            securityMode: options.securityMode,\n            dnssecPolicy: options.dnssec,\n            pkaPolicy: options.pkaPolicy,\n            downgradePolicy: options.downgradePolicy,\n            wellKnownPolicy: options.wellKnownPolicy,\n            ...(options.domainBinding ? { domainBindingPolicy: options.domainBinding } : {}),\n            showDetails: options.showDetails || false,\n            probeProtoSubdomain: false, // JSON command doesn't support proto probing for now\n            probeProtoEvenIfBase: false,\n            dumpWellKnownPath:\n              typeof options.dumpWellKnown === 'string' ? options.dumpWellKnown : null,\n            checkDowngrade: false,\n          } as CheckOptions);\n\n          const securityState = cache\n            ? applySecurityState(report, previousCacheEntry, options.downgradePolicy)\n            : null;\n\n          if (cache && securityState?.shouldPersist && report.cacheEntry) {\n            cache.entries[domain] = report.cacheEntry;\n            await saveCache(cache);\n          }\n\n          console.log(JSON.stringify(report, null, 2));\n          // Honor --code on the report path too (mirrors the catch path below):\n          // granular code when --code is set, otherwise generic 0/1.\n          process.exit(options.code ? report.exitCode : report.exitCode === 0 ? 0 : 1);\n        } catch (error) {\n          // Output error result\n          if (error instanceof AidError) {\n            console.log(\n              JSON.stringify(\n                {\n                  success: false,\n                  domain,\n                  error: {\n                    code: error.code,\n                    errorCode: error.errorCode,\n                    message: error.message,\n                  },\n                  timestamp: new Date().toISOString(),\n                },\n                null,\n                2,\n              ),\n            );\n\n            process.exit(options.code ? error.code : 1);\n          } else if (error instanceof Error) {\n            console.log(\n              JSON.stringify(\n                {\n                  success: false,\n                  domain,\n                  error: {\n                    code: 1,\n                    errorCode: 'UNKNOWN_ERROR',\n                    message: error.message,\n                  },\n                  timestamp: new Date().toISOString(),\n                },\n                null,\n                2,\n              ),\n            );\n\n            process.exit(1);\n          } else {\n            console.log(\n              JSON.stringify(\n                {\n                  success: false,\n                  domain,\n                  error: {\n                    code: 1,\n                    errorCode: 'UNKNOWN_ERROR',\n                    message: String(error),\n                  },\n                  timestamp: new Date().toISOString(),\n                },\n                null,\n                2,\n              ),\n            );\n\n            process.exit(1);\n          }\n        }\n      },\n    );\n\n  // PKA helpers\n  program\n    .command('pka')\n    .description('PKA key helpers')\n    .addCommand(\n      new Command('generate')\n        .description(\n          'Generate a new Ed25519 keypair and print the AID v2 public key (base64url JWK x); private key saved to ~/.aid/keys',\n        )\n        .option('--label <name>', 'Key label (filename prefix)')\n        .option('--out <dir>', 'Output directory for private key')\n        .option('--print-private', 'Also print private key PEM to stdout (not recommended)', false)\n        .action(async (opts: { label?: string; out?: string; printPrivate?: boolean }) => {\n          const { publicKey, privatePath } = await generateEd25519(opts.label, opts.out);\n          console.log(publicKey);\n          console.error(`Saved private key to ${privatePath}`);\n          if (opts.printPrivate) {\n            console.error('Printing private key was requested; handle with care.');\n          }\n        }),\n    )\n    .addCommand(\n      new Command('verify')\n        .description('Verify an AID v2 PKA public key string')\n        .requiredOption('--key <pka>', 'base64url JWK x for a raw Ed25519 public key')\n        .action((opts: { key: string }) => {\n          const res = verifyPka(opts.key);\n          if (res.valid) console.log('✅ valid');\n          else {\n            console.log('❌ invalid' + (res.reason ? `: ${res.reason}` : ''));\n            process.exitCode = 1;\n          }\n        }),\n    );\n\n  // Generator command\n  program\n    .command('generate')\n    .description('Run an interactive prompt to generate a new AID record')\n    .option('--save-draft <path>', 'Save the generated record to a file')\n    .action(async (opts: { saveDraft?: string }) => {\n      console.log(chalk.bold.cyan('AID Record Generator'));\n      console.log(\n        chalk.gray('This tool will guide you through creating a valid DNS TXT record.\\n'),\n      );\n\n      const answers = await inquirer.prompt<Partial<AidGeneratorData>>([\n        {\n          type: 'input',\n          name: 'domain',\n          message: 'What is the primary domain for your agent?',\n          validate: (input: string) => (input ? true : 'Domain cannot be empty.'),\n        },\n        {\n          type: 'input',\n          name: 'uri',\n          message: \"What is the full URI of your agent's endpoint?\",\n          validate: (input: string) => {\n            try {\n              new URL(input);\n              return true;\n            } catch {\n              return 'Please enter a valid URI (e.g., https://api.example.com/agent).';\n            }\n          },\n        },\n        {\n          type: 'list',\n          name: 'proto',\n          message: 'Select the communication protocol:',\n          choices: Object.keys(PROTOCOL_TOKENS),\n          default: 'mcp',\n        },\n        {\n          type: 'list',\n          name: 'auth',\n          message: 'Select the authentication method (if any):',\n          choices: ['none', ...Object.keys(AUTH_TOKENS)],\n          filter: (val: string) => (val === 'none' ? '' : val),\n        },\n        {\n          type: 'input',\n          name: 'desc',\n          message: 'Enter a short description (optional):',\n          validate: (input: string) => {\n            if (!input) return true; // Optional field\n            const byteLength = new TextEncoder().encode(input).length;\n            return byteLength <= 60 || `Description is ${byteLength} bytes (max 60).`;\n          },\n        },\n        {\n          type: 'input',\n          name: 'docs',\n          message: 'Docs URL (https, optional):',\n          validate: (input: string) => {\n            if (!input) return true;\n            try {\n              const u = new URL(input);\n              return u.protocol === 'https:' || 'Docs must be https:// URL';\n            } catch {\n              return 'Docs must be https:// URL';\n            }\n          },\n        },\n        {\n          type: 'input',\n          name: 'dep',\n          message: 'Deprecation date (ISO 8601 UTC, e.g., 2026-01-01T00:00:00Z, optional):',\n          validate: (input: string) => {\n            if (!input) return true;\n            return (\n              (/Z$/.test(input) && !Number.isNaN(Date.parse(input))) ||\n              'Must be ISO 8601 UTC with Z'\n            );\n          },\n        },\n        {\n          type: 'confirm',\n          name: 'addPka',\n          message: 'Add PKA endpoint proof now?',\n          default: false,\n        },\n        {\n          type: 'input',\n          name: 'pka',\n          message: 'PKA public key (base64url JWK x for Ed25519, AID v2):',\n          when: (a: { addPka?: boolean }) => Boolean(a.addPka),\n          validate: (input: string) => {\n            if (!input) return 'PKA key required when adding PKA';\n            const r = verifyPka(input);\n            return r.valid || r.reason || 'Invalid';\n          },\n        },\n      ]);\n\n      // We cast here because inquirer provides a partial object based on answers\n      const formData = answers as AidGeneratorData;\n      const txtRecord = buildTxtRecordVariant(formData, true);\n      const validation = validateTxtRecord(txtRecord);\n\n      console.log(chalk.green('\\n--- Generation Complete ---\\n'));\n      console.log(chalk.bold('Host:'));\n      console.log(chalk.yellow(`_agent.${formData.domain}`));\n      console.log('');\n      console.log(chalk.bold('Type:'));\n      console.log(chalk.yellow('TXT'));\n      console.log('');\n      console.log(chalk.bold('Value:'));\n      console.log(chalk.yellow(txtRecord));\n      console.log('');\n\n      if (validation.isValid) {\n        try {\n          await clipboardy.write(txtRecord);\n          console.log(\n            chalk.bold.green('✅ Success! The TXT record value has been copied to your clipboard.'),\n          );\n        } catch {\n          // The error object is not needed, so we use an optional catch binding.\n          console.log(chalk.red('Could not copy to clipboard. Please copy the value manually.'));\n        }\n\n        // Save draft if requested\n        if (opts.saveDraft) {\n          try {\n            await writeFile(opts.saveDraft, txtRecord, 'utf8');\n            console.log(chalk.green(`💾 Draft saved to ${opts.saveDraft}`));\n          } catch (error) {\n            if (error instanceof Error) {\n              console.log(chalk.red(`Could not save draft: ${error.message}`));\n            } else {\n              console.log(chalk.red(`Could not save draft: ${String(error)}`));\n            }\n          }\n        }\n      } else {\n        console.log(chalk.bold.red(`🔥 Validation Failed: ${validation.error}`));\n      }\n    });\n\n  // Version command with additional info\n  program\n    .command('version')\n    .description('Show version information')\n    .action(async () => {\n      const version = readPackageVersion();\n      console.log(\n        [\n          chalk.bold('aid-doctor') + ' - Agent Identity & Discovery CLI',\n          `Version: ${chalk.green(version)}`,\n          `Node: ${chalk.gray(process.version)}`,\n          `Platform: ${chalk.gray(process.platform)}`,\n          '',\n          'For more information, visit:',\n          chalk.blue('https://aid.agentcommunity.org'),\n        ].join('\\n'),\n      );\n    });\n\n  // Parse command line arguments\n  return program;\n}\n\nexport function isDirectCliInvocation(\n  argvPath: string | undefined,\n  modulePath = fileURLToPath(import.meta.url),\n): boolean {\n  if (!argvPath) {\n    return false;\n  }\n\n  const resolvedArgvPath = path.resolve(argvPath);\n  try {\n    return realpathSync(modulePath) === realpathSync(resolvedArgvPath);\n  } catch {\n    return modulePath === resolvedArgvPath;\n  }\n}\n\nconst isDirectCliRun = isDirectCliInvocation(process.argv[1]);\n\nif (isDirectCliRun) {\n  createCliProgram().parse();\n}\n"]}