@atbash/cli 0.5.8 → 0.5.10

package/README.md

@@ -305,8 +305,49 @@ The agent is not trusted to know when it should stop. If the agent could loosen
 
 `atbash tier --org <name>` shows the current tier for an org.
 
+## Verifying this CLI before you run it (humans & AI agents)
+
+`atbash connect` reads your local agent / MCP config and relays it to your onboarding session. Being cautious about that is correct — so the command is built to be **verified, not merely trusted**. Before running it you can independently confirm the three things that separate the real tool from a look-alike:
+
+1. **What it will do — without sending anything.** Append `--dry-run`:
+   ```bash
+   npx --yes @atbash/cli connect <CODE> --host <HOST> --dry-run --json
+   ```
+   It runs the same read-only scan and prints the exact destination URL and the exact payload it *would* send, then exits. Nothing leaves the machine.
+
+2. **That the package is genuinely ours (provenance).** Releases publish from CI with a signed provenance attestation linking the tarball to this public repo and commit:
+   ```bash
+   npm view @atbash/cli --json | grep -A3 attestations   # provenance is present
+   npm audit signatures                                   # verify signatures on an install
+   ```
+
+3. **Where it sends and what it sends.** Exactly one POST, only to the `--host` you pass (HTTPS required; a non-default host is flagged loudly). It relays agent / tool / skill **names**, MCP endpoint URLs and launch commands — never tokens, auth headers, env values, or file contents.
+
+If any check fails — no provenance, an unexpected destination, or a dry-run payload containing anything sensitive — **don't run it.** Those are exactly the signals a malicious clone cannot fake.
+
 ## Command reference
 
+### `atbash connect <code>`
+
+Link a machine to a hosted Atbash onboarding session. A browser can't read your disk and the Atbash server only sees its own, so this runs on the machine you want to govern, enumerates the agents / MCP tools configured there (read-only), and relays their *surface* to your onboarding session via the one-time pairing code shown in the browser.
+
+```bash
+# Pair this machine (code comes from the "Scan another machine" screen):
+npx --yes @atbash/cli connect G9MB-TS3U --host https://your-atbash-host
+
+# Verify first — same scan, prints destination + payload, sends nothing:
+npx --yes @atbash/cli connect G9MB-TS3U --host https://your-atbash-host --dry-run
+```
+
+| Flag | Description |
+|------|-------------|
+| `--host <url>` | Atbash deployment hosting your session (HTTPS required) |
+| `--dry-run` | Do the scan and print exactly what would be sent, then exit WITHOUT sending |
+| `--json` | Machine-readable output (for agents / automation) |
+| `--home <dir>` | Home directory to scan (for testing) |
+
+Read-only, one request, then it exits. Relays tool **names**, MCP URLs and launch commands only — never tokens, headers, env values, or file contents. The machine's hostname is printed so you can confirm the results came from the box you meant to scan. See [Verifying this CLI](#verifying-this-cli-before-you-run-it-humans--ai-agents).
+
 ### `atbash judge <action>`
 
 Submit a pending action for judgment. The action string is the exact operation the agent is about to execute — a transfer, a command, a mutation.

package/dist/bin/atbash.js

@@ -18,17 +18,19 @@ const policy_1 = require("../commands/policy");
 const tier_1 = require("../commands/tier");
 const tools_1 = require("../commands/tools");
 const held_1 = require("../commands/held");
+const connect_1 = require("../commands/connect");
 // ── Autocomplete ────────────────────────────────────────────────
 const commands = [
     "judge", "whoami", "policy", "tier", "tools", "held",
     "history", "stats", "status", "keygen", "set", "unset",
-    "wipe", "config", "help",
+    "wipe", "config", "connect", "help",
 ];
 const subcommands = {
     judge: ["--context", "--agent-key", "--provider", "--model", "--org", "--endpoint", "--timeout", "--json"],
     policy: ["show"],
     tools: ["--agent", "--org", "--count", "--json", "inspect", "count"],
     held: ["--org", "--count", "--json", "reviews"],
+    connect: ["--host", "--home"],
     set: ["agent-key", "org-name", "endpoint", "rid", "provider", "model"],
     unset: ["agent-key", "org-name", "endpoint", "rid", "provider", "model"],
     show: ["--agent-key", "--endpoint", "--json"],
@@ -81,6 +83,8 @@ program
 // Setup
 (0, keygen_1.registerKeygenCommand)(program);
 (0, config_cmd_1.registerConfigCommand)(program);
+// Onboarding
+(0, connect_1.registerConnectCommand)(program);
 async function main() {
     await program.parseAsync(process.argv);
     await (0, sdk_1.shutdownTelemetry)();

package/dist/bin/atbash.js.map

@@ -1 +1 @@
-{"version":3,"file":"atbash.js","sourceRoot":"","sources":["../../src/bin/atbash.ts"],"names":[],"mappings":";;;;;;AACA,yCAAoC;AACpC,wDAAgC;AAChC,qCAAgE;AAChE,6CAAyD;AACzD,+CAA2D;AAC3D,+CAA2D;AAC3D,iDAA6D;AAC7D,6CAAyD;AACzD,uDAA+D;AAC/D,+CAA2D;AAC3D,+CAA2D;AAC3D,2CAAuD;AACvD,6CAAyD;AACzD,2CAAuD;AAEvD,mEAAmE;AACnE,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACpD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO;IACtD,MAAM,EAAE,QAAQ,EAAE,MAAM;CACzB,CAAC;AAEF,MAAM,WAAW,GAA6B;IAC5C,KAAK,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAC;IAC1G,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;IACpE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;IAC/C,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;IACtE,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;IACxE,IAAI,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC;IAC7C,OAAO,EAAE,CAAC,YAAY,CAAC;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;IACvC,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC;CAC1D,CAAC;AAEF,MAAM,UAAU,GAAG,IAAA,kBAAQ,EAAC,wCAAwC,CAAC,CAAC;AACtE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3D,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,UAAU,CAAC,IAAI,EAAE,CAAC;AAElB,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;IAChD,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,IAAA,oBAAc,EAAC;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,KAAK;IACb,gBAAgB,EAAE,IAAI;CACvB,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,6EAA6E,CAAC;KAC1F,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAEnE,OAAO;AACP,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAE7B,aAAa;AACb,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAE9B,oBAAoB;AACpB,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAE7B,OAAO;AACP,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;AAChC,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B,QAAQ;AACR,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,kCAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAA,uBAAiB,GAAE,CAAC;AAC5B,CAAC;AAED,IAAI,EAAE,CAAC"}
+{"version":3,"file":"atbash.js","sourceRoot":"","sources":["../../src/bin/atbash.ts"],"names":[],"mappings":";;;;;;AACA,yCAAoC;AACpC,wDAAgC;AAChC,qCAAgE;AAChE,6CAAyD;AACzD,+CAA2D;AAC3D,+CAA2D;AAC3D,iDAA6D;AAC7D,6CAAyD;AACzD,uDAA+D;AAC/D,+CAA2D;AAC3D,+CAA2D;AAC3D,2CAAuD;AACvD,6CAAyD;AACzD,2CAAuD;AACvD,iDAA6D;AAE7D,mEAAmE;AACnE,MAAM,QAAQ,GAAG;IACf,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACpD,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO;IACtD,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM;CACpC,CAAC;AAEF,MAAM,WAAW,GAA6B;IAC5C,KAAK,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,CAAC;IAC1G,MAAM,EAAE,CAAC,MAAM,CAAC;IAChB,KAAK,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;IACpE,IAAI,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,CAAC;IAC/C,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC7B,GAAG,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;IACtE,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC;IACxE,IAAI,EAAE,CAAC,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC;IAC7C,OAAO,EAAE,CAAC,YAAY,CAAC;IACvB,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;IACvC,YAAY,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,CAAC;CAC1D,CAAC;AAEF,MAAM,UAAU,GAAG,IAAA,kBAAQ,EAAC,wCAAwC,CAAC,CAAC;AACtE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC3D,UAAU,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE;IAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAsB,EAAE,EAAE;IACzD,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,IAAI;QAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AACH,UAAU,CAAC,IAAI,EAAE,CAAC;AAElB,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;IAChD,UAAU,CAAC,kBAAkB,EAAE,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,+EAA+E;AAC/E,IAAA,oBAAc,EAAC;IACb,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,KAAK;IACb,gBAAgB,EAAE,IAAI;CACvB,CAAC,CAAC;AAEH,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,6EAA6E,CAAC;KAC1F,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AAEnE,OAAO;AACP,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAE7B,aAAa;AACb,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAE9B,oBAAoB;AACpB,IAAA,0BAAmB,EAAC,OAAO,CAAC,CAAC;AAE7B,OAAO;AACP,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;AAChC,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B,QAAQ;AACR,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,kCAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B,aAAa;AACb,IAAA,gCAAsB,EAAC,OAAO,CAAC,CAAC;AAEhC,KAAK,UAAU,IAAI;IACjB,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAA,uBAAiB,GAAE,CAAC;AAC5B,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/commands/connect.d.ts

@@ -0,0 +1,27 @@
+import { Command } from "commander";
+interface DeclaredTool {
+    name: string;
+    description?: string;
+}
+type Agent = {
+    type: "declared";
+    label: string;
+    detail: string;
+    declaredTools: DeclaredTool[];
+} | {
+    type: "config";
+    label: string;
+    detail: string;
+    config: {
+        mcpServers: Record<string, unknown>;
+    };
+};
+/** One-line skill description from SKILL.md frontmatter `description:` or first heading. */
+declare function describeSkill(text: string | undefined, fallback: string): string;
+/** Walk a skills root (bounded) → declared tools. Mirrors src/lib/scan/adapters/local-skills.ts. */
+declare function enumerateSkills(root: string, maxDepth?: number, cap?: number): DeclaredTool[];
+declare function relaySafeServers(servers: Record<string, unknown>): Record<string, unknown>;
+/** Enumerate the agents/MCP tools configured on this machine. Read-only. */
+declare function discover(home: string): Agent[];
+export declare function registerConnectCommand(program: Command): void;
+export { discover, enumerateSkills, describeSkill, relaySafeServers };

package/dist/commands/connect.js

@@ -0,0 +1,427 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerConnectCommand = registerConnectCommand;
+exports.discover = discover;
+exports.enumerateSkills = enumerateSkills;
+exports.describeSkill = describeSkill;
+exports.relaySafeServers = relaySafeServers;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const chalk_1 = __importDefault(require("chalk"));
+/**
+ * `atbash connect <code>` — the local connector.
+ *
+ * A hosted Atbash onboarding page can't read your machine's filesystem, and the
+ * Atbash server only sees its own disk. This command runs on YOUR machine,
+ * enumerates the agents/MCP tools configured locally, and relays them to your
+ * onboarding session via a one-time pairing code shown in the browser.
+ *
+ * Read-only: it reads a fixed set of known agent config paths and reports the
+ * declared tool surface (server/skill NAMES) — never the secret values inside.
+ * It makes ONE outbound POST (the relay) and exits.
+ *
+ * The discovery mirrors the dashboard's src/lib/scan/discover.ts and produces
+ * the same relay-safe payload the session endpoint expects.
+ */
+/**
+ * Official Atbash deployments that legitimately serve the onboarding flow.
+ *
+ * The pairing screen builds `--host` from the page you opened, so every origin
+ * that can host onboarding must appear here. If production were missing, the real
+ * atbash.ai would be flagged "unrecognized destination" — a false alarm on the
+ * genuine article, which is worse than silence: it teaches people and agents to
+ * wave through the one warning that actually catches a swapped host.
+ *
+ * Matched on EXACT hostname, never a suffix — "atbash.ai.evil.com" must not pass.
+ * Deliberately not a *.vercel.app wildcard: that would bless anyone's preview.
+ */
+const KNOWN_HOSTS = new Set([
+    "atbash.ai",
+    "www.atbash.ai",
+    "chromia-verified-ai-dev-two.vercel.app",
+    "https://chromia-verified-ai-agent-scan.vercel.app"
+]);
+/**
+ * Used when neither --host nor ATBASH_HOST is given. Still the dev deployment,
+ * because it is the one running the current connector API; switch this to
+ * https://atbash.ai once production serves it (KNOWN_HOSTS already allows it).
+ */
+const DEFAULT_HOST = "https://chromia-verified-ai-dev-two.vercel.app";
+// ── filesystem helpers (all best-effort; never throw) ────────────────────────
+const exists = (...segs) => {
+    try {
+        return fs.existsSync(path.join(...segs));
+    }
+    catch {
+        return false;
+    }
+};
+const readJson = (...segs) => {
+    try {
+        return JSON.parse(fs.readFileSync(path.join(...segs), "utf8"));
+    }
+    catch {
+        return null;
+    }
+};
+const readText = (...segs) => {
+    try {
+        return fs.readFileSync(path.join(...segs), "utf8");
+    }
+    catch {
+        return undefined;
+    }
+};
+const listDirs = (...segs) => {
+    try {
+        return fs.readdirSync(path.join(...segs), { withFileTypes: true })
+            .filter((e) => e.isDirectory())
+            .map((e) => e.name);
+    }
+    catch {
+        return [];
+    }
+};
+/** One-line skill description from SKILL.md frontmatter `description:` or first heading. */
+function describeSkill(text, fallback) {
+    if (!text)
+        return fallback;
+    const frontmatter = (text.match(/^---\r?\n([\s\S]*?)\r?\n---/) || [])[1];
+    const field = frontmatter ? frontmatter.match(/^[ \t]*description:[ \t]*(.*)$/im) : null;
+    if (frontmatter && field) {
+        const inline = field[1].trim();
+        if (/^[>|][+-]?\d*$/.test(inline)) {
+            const lines = [];
+            for (const line of frontmatter.slice((field.index ?? 0) + field[0].length).split(/\r?\n/)) {
+                if (!line.trim()) {
+                    if (lines.length)
+                        break;
+                    continue;
+                }
+                if (!/^[ \t]/.test(line))
+                    break; // dedent ends the block scalar
+                lines.push(line.trim());
+            }
+            const folded = lines.join(" ").trim();
+            if (folded)
+                return folded;
+        }
+        else if (inline) {
+            return inline.replace(/^["']|["']$/g, "").trim();
+        }
+    }
+    const heading = text.split(/\r?\n/).map((l) => l.trim())
+        .find((l) => l && !l.startsWith("---") && !/^(name|description):/i.test(l));
+    return heading ? heading.replace(/^#+\s*/, "").trim() : fallback;
+}
+/** Walk a skills root (bounded) → declared tools. Mirrors src/lib/scan/adapters/local-skills.ts. */
+function enumerateSkills(root, maxDepth = 3, cap = 400) {
+    const tools = [];
+    const walk = (dir, depth, category) => {
+        if (depth > maxDepth || tools.length >= cap)
+            return;
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        if (entries.some((e) => e.isFile() && e.name === "SKILL.md")) {
+            const name = path.basename(dir);
+            tools.push({ name, description: describeSkill(readText(dir, "SKILL.md"), `${category} skill`) });
+            return; // a skill folder is a leaf
+        }
+        for (const e of entries)
+            if (e.isDirectory() && tools.length < cap)
+                walk(path.join(dir, e.name), depth + 1, path.basename(dir));
+    };
+    walk(root, 0, path.basename(root));
+    return tools;
+}
+const MCP_CONFIGS = [
+    { label: "Claude Desktop", segs: ["Library", "Application Support", "Claude", "claude_desktop_config.json"] },
+    { label: "Claude Desktop", segs: [".config", "Claude", "claude_desktop_config.json"] },
+    { label: "Cursor", segs: [".cursor", "mcp.json"] },
+    { label: "Windsurf", segs: [".codeium", "windsurf", "mcp_config.json"] },
+    { label: "VS Code (MCP)", segs: [".vscode", "mcp.json"] },
+    { label: "Gemini CLI", segs: [".gemini", "settings.json"] },
+    { label: "Continue", segs: [".continue", "config.json"] },
+];
+/**
+ * OpenAI Codex CLI stores config as TOML with [mcp_servers.<name>] tables. The
+ * header must be ONE key (bare or quoted); a dotted tail is a SUB-TABLE of that
+ * server, and `enabled = false` means declared-but-off. Keep in sync with
+ * parseCodexMcpServers in src/lib/scan/discover.ts.
+ */
+function parseCodexMcpServers(toml) {
+    const servers = {};
+    const re = /\[mcp_servers\.(?:"([^"\]]+)"|([A-Za-z0-9_-]+))\]([\s\S]*?)(?=\n\s*\[|$)/g;
+    let m;
+    while ((m = re.exec(toml))) {
+        const body = m[3];
+        if (/^\s*enabled\s*=\s*false\b/m.test(body))
+            continue; // declared but switched off
+        const url = (body.match(/^\s*url\s*=\s*"([^"]*)"/m) || [])[1];
+        const command = (body.match(/^\s*command\s*=\s*"([^"]*)"/m) || [])[1];
+        servers[m[1] || m[2]] = url ? { url } : command ? { command } : {};
+    }
+    return servers;
+}
+/**
+ * Strip a relayed mcpServers map down to the STRUCTURAL fields the hosted scanner
+ * needs to identify/reach a server (name, url, command, type, transport). Every
+ * other field — env, headers, token, apiKey, args, … — can carry live credentials
+ * or local paths and MUST NOT leave the machine. The connector relays the tool
+ * SURFACE, never secrets. (Auth'd servers simply come back "needs credentials";
+ * the hosted scanner degrades gracefully rather than us exfiltrating a token.)
+ */
+const RELAY_SAFE_SERVER_KEYS = new Set(["url", "command", "type", "transport"]);
+function relaySafeServers(servers) {
+    const out = {};
+    for (const [name, spec] of Object.entries(servers)) {
+        if (!spec || typeof spec !== "object") {
+            out[name] = {};
+            continue;
+        }
+        const safe = {};
+        for (const [k, v] of Object.entries(spec))
+            if (RELAY_SAFE_SERVER_KEYS.has(k))
+                safe[k] = v;
+        out[name] = safe;
+    }
+    return out;
+}
+/** Enumerate the agents/MCP tools configured on this machine. Read-only. */
+function discover(home) {
+    const agents = [];
+    // OpenClaw → declared tools (skills live under ~/.hermes/skills; plus extensions).
+    if (exists(home, ".openclaw", "openclaw.json")) {
+        const tools = enumerateSkills(path.join(home, ".hermes", "skills"));
+        for (const name of listDirs(home, ".openclaw", "extensions"))
+            tools.push({ name: `plugin:${name}`, description: "OpenClaw plugin / extension" });
+        agents.push({ type: "declared", label: "OpenClaw", detail: `${tools.length} skill${tools.length === 1 ? "" : "s"} / plugins`, declaredTools: tools });
+    }
+    // Hermes → declared tools (skills + agent plugins).
+    if (exists(home, ".hermes", "hermes-agent")) {
+        const tools = enumerateSkills(path.join(home, ".hermes", "skills"));
+        for (const name of listDirs(home, ".hermes", "hermes-agent", "plugins"))
+            tools.push({ name: `plugin:${name}`, description: "Hermes plugin" });
+        agents.push({ type: "declared", label: "Hermes", detail: `${tools.length} skill${tools.length === 1 ? "" : "s"} / plugins`, declaredTools: tools });
+    }
+    // MCP-config files → config (mcpServers) blobs.
+    const seen = new Set();
+    for (const { label, segs } of MCP_CONFIGS) {
+        if (seen.has(label))
+            continue;
+        const cfg = readJson(home, ...segs);
+        const servers = cfg && typeof cfg === "object" ? (cfg.mcpServers ?? cfg.servers) : undefined;
+        const count = servers && typeof servers === "object" ? Object.keys(servers).length : 0;
+        if (count > 0 && servers) {
+            seen.add(label);
+            agents.push({ type: "config", label, detail: `${count} MCP server${count === 1 ? "" : "s"}`, config: { mcpServers: relaySafeServers(servers) } });
+        }
+    }
+    // Claude Code (~/.claude.json): servers live globally AND per-project — merge both.
+    const cc = readJson(home, ".claude.json");
+    if (cc) {
+        const merged = {};
+        const collect = (o) => {
+            const s = o && typeof o === "object" ? o.mcpServers : undefined;
+            if (s && typeof s === "object")
+                for (const [k, v] of Object.entries(s))
+                    if (!(k in merged))
+                        merged[k] = v;
+        };
+        collect(cc);
+        const projects = cc.projects;
+        if (projects && typeof projects === "object")
+            for (const p of Object.values(projects))
+                collect(p);
+        const count = Object.keys(merged).length;
+        if (count > 0)
+            agents.push({ type: "config", label: "Claude Code", detail: `${count} MCP server${count === 1 ? "" : "s"}`, config: { mcpServers: relaySafeServers(merged) } });
+    }
+    // OpenAI Codex CLI (~/.codex/config.toml) — TOML, parsed separately.
+    const codexToml = readText(home, ".codex", "config.toml");
+    if (codexToml) {
+        const servers = parseCodexMcpServers(codexToml);
+        const count = Object.keys(servers).length;
+        if (count > 0)
+            agents.push({ type: "config", label: "Codex", detail: `${count} MCP server${count === 1 ? "" : "s"}`, config: { mcpServers: relaySafeServers(servers) } });
+    }
+    return agents;
+}
+function registerConnectCommand(program) {
+    program
+        .command("connect")
+        .description("Scan this machine's agents & MCP configs and relay them to an Atbash onboarding session (read-only; one request, then exits)")
+        .argument("<code>", "The pairing code from the onboarding \"Scan another machine\" screen")
+        .option("--host <url>", "Atbash deployment hosting your session")
+        .option("--home <dir>", "Home directory to scan (for testing)")
+        .option("--dry-run", "Do the read-only scan and print exactly what WOULD be sent (destination + tool names), then exit WITHOUT sending")
+        .option("--json", "Emit machine-readable JSON instead of formatted text (for agents / automation)")
+        .action(async (rawCode, opts) => {
+        const home = opts.home || os.homedir();
+        const host = (opts.host || process.env.ATBASH_HOST || DEFAULT_HOST).replace(/\/+$/, "");
+        const code = rawCode.trim().toUpperCase().replace(/[^A-Z0-9-]/g, "");
+        const machine = os.hostname();
+        const dryRun = !!opts.dryRun;
+        const asJson = !!opts.json;
+        const endpoint = `${host}/api/agent-scan/session/${encodeURIComponent(code)}`;
+        // Parsed up front so the destination verdict is available to every output
+        // path, including the JSON one an agent reads before deciding to proceed.
+        let hostUrl = null;
+        try {
+            hostUrl = new URL(host);
+        }
+        catch {
+            hostUrl = null;
+        }
+        const hostname = hostUrl ? hostUrl.hostname.toLowerCase() : "";
+        const isLoopback = /^(localhost|127\.\d+\.\d+\.\d+|\[::1\]|::1)$/.test(hostname);
+        // "Recognized" = an official Atbash deployment (or your own machine for dev).
+        const recognizedHost = KNOWN_HOSTS.has(hostname) || isLoopback;
+        // Machine-readable summary for the --json path AND for any error, so an agent
+        // gets a stable, parseable description of exactly what this command is/was doing.
+        const emitJson = (extra) => console.log(JSON.stringify({
+            tool: "@atbash/cli connect",
+            transmits: "agent/tool/skill names, MCP endpoint URLs and launch commands — never tokens, auth headers, env values, or file contents",
+            readOnly: true,
+            requests: dryRun ? 0 : 1,
+            machine, host, endpoint, code,
+            // An agent should treat `recognizedHost: false` as a reason to stop and
+            // ask, not a detail to skim past.
+            recognizedHost, knownHosts: [...KNOWN_HOSTS],
+            ...extra,
+        }, null, 2));
+        if (!code) {
+            if (asJson)
+                emitJson({ ok: false, error: "missing pairing code" });
+            else
+                console.error("\n" + chalk_1.default.bold("  Atbash connector") + "\n" + chalk_1.default.red("  Missing pairing code.") + " Open the \"Scan another machine\" screen for one.\n");
+            process.exit(1);
+        }
+        // ── destination safety ───────────────────────────────────────────────────
+        // The only place this flow could be turned against you is a swapped --host
+        // pointing the relay at someone else's server. So: refuse a channel that
+        // isn't encrypted, and make an unrecognized destination impossible to miss.
+        const httpsOk = !!hostUrl && (hostUrl.protocol === "https:" || (hostUrl.protocol === "http:" && isLoopback));
+        if (!httpsOk) {
+            const msg = `refusing to send over a non-HTTPS host (${host}) — the relay must travel encrypted`;
+            if (asJson)
+                emitJson({ ok: false, error: msg });
+            else
+                console.error("\n" + chalk_1.default.red(`  ✗ ${msg}.`) + chalk_1.default.dim(" Use an https:// host (localhost may use http).\n"));
+            process.exit(1);
+        }
+        const agents = discover(home);
+        const payload = { agents, machine };
+        // ── machine-readable path (agents / automation) ──────────────────────────
+        if (asJson) {
+            if (dryRun) {
+                emitJson({ ok: true, dryRun: true, sent: false, agentCount: agents.length, payload });
+                return;
+            }
+            try {
+                const res = await fetch(endpoint, { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify(payload) });
+                const data = (await res.json().catch(() => ({})));
+                emitJson({ ok: res.ok, sent: res.ok, status: res.status, received: data.received, agentCount: agents.length, error: res.ok ? undefined : (data.error || res.statusText) });
+                process.exit(res.ok ? 0 : 1);
+            }
+            catch (err) {
+                emitJson({ ok: false, sent: false, error: err instanceof Error ? err.message : String(err) });
+                process.exit(1);
+            }
+        }
+        // ── human-readable path ──────────────────────────────────────────────────
+        console.log("\n" + chalk_1.default.bold("  Atbash connector") + (dryRun ? chalk_1.default.dim("  (dry run — nothing will be sent)") : ""));
+        // Capability disclosure: state plainly what runs, so a person OR an agent
+        // reviewing this command can confirm nothing hidden is happening.
+        console.log(chalk_1.default.dim("  Reads (read-only): known agent/MCP config files under your home dir — OpenClaw, Hermes,"));
+        console.log(chalk_1.default.dim("    Claude Desktop/Code, Cursor, Windsurf, VS Code, Gemini, Continue, Codex."));
+        console.log(chalk_1.default.dim("    Relays names, MCP URLs and launch commands only — never tokens, headers, env values or file contents."));
+        console.log(chalk_1.default.dim(`  Sends: ${dryRun ? "nothing (dry run)" : "one POST to the destination below, then exits"}.`));
+        // Machine identity is stated loudly on purpose: if this ran somewhere other
+        // than the computer you mean to govern (an AI-assistant sandbox, a VM, a
+        // remote box), the results are from THAT machine — not yours.
+        console.log(`  ${chalk_1.default.bold("Machine")}  : ${chalk_1.default.bold.cyan(machine)}  ${chalk_1.default.yellow("← results below come from THIS machine")}`);
+        console.log(`  ${chalk_1.default.bold("Sends to")} : ${chalk_1.default.cyan(endpoint)}${recognizedHost ? chalk_1.default.dim(isLoopback ? "  (local development host)" : "  (recognized Atbash host)") : chalk_1.default.yellow("  ← UNRECOGNIZED host, not an official Atbash deployment — only proceed if you trust it")}`);
+        console.log(chalk_1.default.dim(`  Code     : ${code}\n`));
+        if (agents.length === 0) {
+            console.log("  No local agents found (looked for OpenClaw, Hermes, and MCP configs).");
+            if (!dryRun)
+                console.log("  Relaying an empty result so the browser stops waiting.");
+            console.log("");
+        }
+        else {
+            console.log("  Found:");
+            for (const a of agents)
+                console.log(`    ${chalk_1.default.green("•")} ${a.label} ${chalk_1.default.dim("— " + a.detail)}`);
+            console.log("");
+        }
+        console.log(chalk_1.default.yellow(`  ⚠ These results are from ${chalk_1.default.bold(machine)}.`) + chalk_1.default.dim(" If that isn't the computer you want to govern, run this command there instead.\n"));
+        if (dryRun) {
+            console.log(chalk_1.default.bold("  Dry run — the exact JSON that WOULD be sent:"));
+            console.log(chalk_1.default.dim(JSON.stringify(payload, null, 2).split("\n").map((l) => "    " + l).join("\n")));
+            console.log("\n" + chalk_1.default.green("  ✓ Nothing was sent.") + chalk_1.default.dim(" Re-run without --dry-run to relay.\n"));
+            return;
+        }
+        try {
+            const res = await fetch(endpoint, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify(payload),
+            });
+            const data = (await res.json().catch(() => ({})));
+            if (!res.ok) {
+                console.error(chalk_1.default.red(`  Relay failed (${res.status}): ${data.error || res.statusText}`));
+                console.error(chalk_1.default.dim("  The code may be wrong or expired — re-open the screen for a fresh one.\n"));
+                process.exit(1);
+            }
+            console.log(chalk_1.default.green(`  ✓ Relayed ${data.received ?? agents.length} agent(s) from ${chalk_1.default.bold(machine)}.`) + " Switch back to the browser — it should show this machine now.\n");
+        }
+        catch (err) {
+            console.error(chalk_1.default.red(`  Could not reach ${host}: ${err instanceof Error ? err.message : String(err)}\n`));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=connect.js.map

package/dist/commands/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../src/commands/connect.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6NA,wDAgIC;AAGQ,4BAAQ;AAAE,0CAAe;AAAE,sCAAa;AAAE,4CAAgB;AAhWnE,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAE7B,kDAA0B;AAE1B;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,WAAW;IACX,eAAe;IACf,wCAAwC;IACxC,mDAAmD;CACpD,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,YAAY,GAAG,gDAAgD,CAAC;AAUtE,gFAAgF;AAChF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAc,EAAW,EAAE;IAC5C,IAAI,CAAC;QAAC,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AAC3E,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAc,EAAkC,EAAE;IACrE,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC3H,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAc,EAAsB,EAAE;IACzD,IAAI,CAAC;QAAC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AACzF,CAAC,CAAC;AACF,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAc,EAAY,EAAE;IAC/C,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aAC/D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;aAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxB,CAAC,CAAC;AAEF,4FAA4F;AAC5F,SAAS,aAAa,CAAC,IAAwB,EAAE,QAAgB;IAC/D,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3B,MAAM,WAAW,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzF,IAAI,WAAW,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1F,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;oBAAC,IAAI,KAAK,CAAC,MAAM;wBAAE,MAAM;oBAAC,SAAS;gBAAC,CAAC;gBACxD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,+BAA+B;gBAChE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACrD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,oGAAoG;AACpG,SAAS,eAAe,CAAC,IAAY,EAAE,QAAQ,GAAG,CAAC,EAAE,GAAG,GAAG,GAAG;IAC5D,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,QAAgB,EAAQ,EAAE;QAClE,IAAI,KAAK,GAAG,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO;QACpD,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO;QAAC,CAAC;QACjF,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,GAAG,QAAQ,QAAQ,CAAC,EAAE,CAAC,CAAC;YACjG,OAAO,CAAC,2BAA2B;QACrC,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClI,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,WAAW,GAAwC;IACvD,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,EAAE;IAC7G,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,EAAE;IACtF,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE;IAClD,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,iBAAiB,CAAC,EAAE;IACxE,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE;IACzD,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE;IAC3D,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE;CAC1D,CAAC;AAEF;;;;;GAKG;AACH,SAAS,oBAAoB,CAAC,IAAY;IACxC,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,EAAE,GAAG,2EAA2E,CAAC;IACvF,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS,CAAC,4BAA4B;QACnF,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAChF,SAAS,gBAAgB,CAAC,OAAgC;IACxD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAAC,SAAS;QAAC,CAAC;QACpE,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAA+B,CAAC;YAAE,IAAI,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACrH,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,MAAM,GAAY,EAAE,CAAC;IAE3B,mFAAmF;IACnF,IAAI,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACjJ,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,SAAS,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACxJ,CAAC;IAED,oDAAoD;IACpD,IAAI,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpE,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,IAAI,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC;QAC9I,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,SAAS,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,YAAY,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACtJ,CAAC;IAED,gDAAgD;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAyC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtI,MAAM,KAAK,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,IAAI,KAAK,GAAG,CAAC,IAAI,OAAO,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAAC,CAAC;IACnM,CAAC;IAED,oFAAoF;IACpF,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1C,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,CAAC,CAAU,EAAQ,EAAE;YACnC,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA8B,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9F,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;oBAAE,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;wBAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5G,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,CAAC;QACZ,MAAM,QAAQ,GAAI,EAA6B,CAAC,QAAQ,CAAC;QACzD,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;QACzC,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,KAAK,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACjL,CAAC;IAED,qEAAqE;IACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC1D,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1C,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5K,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,8HAA8H,CAAC;SAC3I,QAAQ,CAAC,QAAQ,EAAE,sEAAsE,CAAC;SAC1F,MAAM,CAAC,cAAc,EAAE,wCAAwC,CAAC;SAChE,MAAM,CAAC,cAAc,EAAE,sCAAsC,CAAC;SAC9D,MAAM,CAAC,WAAW,EAAE,kHAAkH,CAAC;SACvI,MAAM,CAAC,QAAQ,EAAE,gFAAgF,CAAC;SAClG,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAAwE,EAAE,EAAE;QAC1G,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3B,MAAM,QAAQ,GAAG,GAAG,IAAI,2BAA2B,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAE9E,0EAA0E;QAC1E,0EAA0E;QAC1E,IAAI,OAAO,GAAe,IAAI,CAAC;QAC/B,IAAI,CAAC;YAAC,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;QAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,UAAU,GAAG,8CAA8C,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjF,8EAA8E;QAC9E,MAAM,cAAc,GAAG,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,UAAU,CAAC;QAE/D,8EAA8E;QAC9E,kFAAkF;QAClF,MAAM,QAAQ,GAAG,CAAC,KAA8B,EAAQ,EAAE,CACxD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YACzB,IAAI,EAAE,qBAAqB;YAC3B,SAAS,EAAE,0HAA0H;YACrI,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI;YAC7B,wEAAwE;YACxE,kCAAkC;YAClC,cAAc,EAAE,UAAU,EAAE,CAAC,GAAG,WAAW,CAAC;YAC5C,GAAG,KAAK;SACT,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAEf,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,MAAM;gBAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;;gBAC9D,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,eAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,IAAI,GAAG,eAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,sDAAsD,CAAC,CAAC;YACnK,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,4EAA4E;QAC5E,2EAA2E;QAC3E,yEAAyE;QACzE,4EAA4E;QAC5E,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC;QAC7G,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,2CAA2C,IAAI,qCAAqC,CAAC;YACjG,IAAI,MAAM;gBAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;;gBAC3C,OAAO,CAAC,KAAK,CAAC,IAAI,GAAG,eAAK,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,eAAK,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC,CAAC;YACrH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAEpC,4EAA4E;QAC5E,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,MAAM,EAAE,CAAC;gBAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC9G,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACtI,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA0C,CAAC;gBAC3F,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC3K,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,4EAA4E;QAC5E,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,eAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,eAAK,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACvH,0EAA0E;QAC1E,kEAAkE;QAClE,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,2FAA2F,CAAC,CAAC,CAAC;QACpH,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC,CAAC;QACvG,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,2GAA2G,CAAC,CAAC,CAAC;QACpI,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,+CAA+C,GAAG,CAAC,CAAC,CAAC;QACtH,4EAA4E;QAC5E,yEAAyE;QACzE,8DAA8D;QAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,eAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,eAAK,CAAC,MAAM,CAAC,wCAAwC,CAAC,EAAE,CAAC,CAAC;QACpI,OAAO,CAAC,GAAG,CAAC,KAAK,eAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,eAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,eAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,eAAK,CAAC,MAAM,CAAC,yFAAyF,CAAC,EAAE,CAAC,CAAC;QACtR,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC;QAEjD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;YACvF,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;YACrF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxB,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,eAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,eAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,MAAM,CAAC,8BAA8B,eAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAK,CAAC,GAAG,CAAC,mFAAmF,CAAC,CAAC,CAAC;QAEjL,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACvG,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,eAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,GAAG,eAAK,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC,CAAC;YAC9G,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC9B,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA0C,CAAC;YAC3F,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBAC5F,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC,CAAC;gBACvG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,eAAK,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,kBAAkB,eAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,kEAAkE,CAAC,CAAC;QACvL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,eAAK,CAAC,GAAG,CAAC,qBAAqB,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/package.json

@@ -1,13 +1,23 @@
 {
   "name": "@atbash/cli",
-  "version": "0.5.8",
+  "version": "0.5.10",
   "description": "Atbash CLI — control boundary before the last irreversible step in an agent workflow",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://atbash.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Atbash-Ai/atbash-cli.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Atbash-Ai/atbash-cli/issues"
+  },
   "bin": {
     "atbash": "dist/bin/atbash.js"
   },
   "preferGlobal": true,
+  "publishConfig": {
+    "access": "public"
+  },
   "files": [
     "dist",
     "README.md",