agentinbox-cli 0.0.0 → 0.1.0-nightly.10

package/dist/connect-BHC2trBi.js

@@ -0,0 +1,292 @@
+#!/usr/bin/env node
+import { t as CAPABILITIES } from "./types-3eEsBFVj.js";
+import { i as safeText, n as box, r as formatDuration, t as StatusLine } from "./ui-B8Sd4Y7Y.js";
+import { d as NPX, i as saveProfile, n as loadProfile, r as profileExists, t as listProfiles } from "./profile-CgGgJ4Dm.js";
+import { C as startPairing, S as pollPairing, b as clientInfo, c as defaultConsumer, d as validConsumer, g as normalizeDaemonUrl, h as insecureBanner, m as checkTransport, y as ApiError } from "./listen-D8DkEhqM.js";
+import { f as validProfileName, s as profilePath } from "./paths-TLp8hiMt.js";
+import { s as writeClaudeMcpConfig } from "./mcpheader-D9rrI-aa.js";
+import { n as isServiceInstalled } from "./service-whbugeQp.js";
+import { i as recipe, n as TOOL_LABELS, o as shellQuote, t as TOOLS } from "./recipes-UalOc_LB.js";
+import { l as setupMcp, s as mcpTarget } from "./mcpsetup-DJ7ebFGJ.js";
+import { closeSync, constants, fchmodSync, lstatSync, openSync, writeSync } from "node:fs";
+import { hostname } from "node:os";
+import pc from "picocolors";
+//#region server/listen/connect.ts
+/** Exit codes, so scripts (and agents setting themselves up) can tell outcomes apart. */
+const CONNECT_EXIT = {
+	approved: 0,
+	error: 1,
+	denied: 2,
+	expired: 3,
+	consumed: 4,
+	cancelled: 130
+};
+function parseTool(value) {
+	if (value === void 0) return "other";
+	const v = value.trim().toLowerCase().replace(/^claude$/, "claude-code");
+	if (!TOOLS.includes(v)) throw new Error(`Unknown --tool "${value}". Choose one of: ${TOOLS.join(", ")}.`);
+	return v;
+}
+function parseCapabilities(value) {
+	if (value === void 0) return void 0;
+	const list = value.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+	const bad = list.filter((c) => !CAPABILITIES.includes(c));
+	if (bad.length) throw new Error(`Unknown capabilit${bad.length > 1 ? "ies" : "y"} ${bad.join(", ")}. Choose from: ${CAPABILITIES.join(", ")}.`);
+	return [...new Set(list)];
+}
+const shortHost = () => hostname().replace(/\.(local|lan|home)$/i, "");
+const sleep = (ms, signal) => new Promise((resolve) => {
+	const t = setTimeout(resolve, ms);
+	signal?.addEventListener("abort", () => {
+		clearTimeout(t);
+		resolve();
+	}, { once: true });
+});
+const stripAnsi = (s) => s.replace(/\x1b\[[0-9;]*m/g, "");
+/** --log target (fd), written in parallel with the console. */
+let logFd = null;
+const toLog = (s) => {
+	if (logFd !== null) writeSync(logFd, stripAnsi(s) + "\n");
+};
+const out = (s = "") => {
+	process.stdout.write(`${s}\n`);
+	toLog(s);
+};
+const err = (s = "") => {
+	process.stderr.write(`${s}\n`);
+	toLog(s);
+};
+/**
+* Opens --log safely: a new file is created 0600 with O_EXCL; an existing one (e.g. from `mktemp`) is
+* only reused if it is a regular file owned by us, opened without following symlinks. This is what
+* keeps another local user from pre-creating the log and reading the pairing as it happens.
+*/
+function openConnectLog(path) {
+	try {
+		return openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 384);
+	} catch (e) {
+		if (e.code !== "EEXIST") throw e;
+	}
+	const st = lstatSync(path);
+	const uid = process.getuid?.();
+	if (!st.isFile() || uid !== void 0 && st.uid !== uid) throw new Error(`Refusing --log ${path}: it exists and is not a regular file owned by you.`);
+	const fd = openSync(path, constants.O_WRONLY | constants.O_TRUNC | constants.O_NOFOLLOW);
+	fchmodSync(fd, 384);
+	return fd;
+}
+async function runConnect(rawUrl, flags, opts = {}) {
+	if (flags.log) logFd = openConnectLog(flags.log);
+	try {
+		return await connect(rawUrl, flags, opts);
+	} finally {
+		if (logFd !== null) closeSync(logFd);
+		logFd = null;
+	}
+}
+async function connect(rawUrl, flags, opts) {
+	const url = normalizeDaemonUrl(rawUrl);
+	const verdict = await checkTransport(url, { insecure: flags.insecure });
+	if (verdict.warning) err(insecureBanner(verdict.warning));
+	const profileName = validProfileName(flags.profile ?? "default");
+	let replacing = null;
+	if (profileExists(profileName) && flags.force) try {
+		replacing = loadProfile(profileName);
+	} catch {}
+	if (profileExists(profileName) && !flags.force) {
+		let who = "";
+		try {
+			const p = loadProfile(profileName);
+			who = ` (agent "${safeText(p.agentName)}" on ${p.url})`;
+		} catch {}
+		const others = listProfiles();
+		throw new Error(`Profile "${profileName}" already exists${who}.\n  Pair a second agent with --profile <name>${others.length > 1 ? ` (existing: ${others.join(", ")})` : ""}, or replace this one with --force.`);
+	}
+	const tool = parseTool(flags.tool);
+	const capabilities = parseCapabilities(flags.capabilities);
+	const consumer = validConsumer(flags.consumer ?? replacing?.consumer ?? defaultConsumer(profileName));
+	const name = (flags.name?.trim() || `${tool === "other" ? "Agent" : TOOL_LABELS[tool]} on ${shortHost()}`).slice(0, 80);
+	const input = {
+		name,
+		requested: {
+			...flags.account?.length ? { accounts: flags.account } : {},
+			...capabilities ? { capabilities } : {},
+			...flags.reason ? { reason: flags.reason } : {}
+		},
+		client: {
+			...clientInfo(),
+			tool
+		}
+	};
+	let start;
+	try {
+		start = await startPairing(url, input);
+	} catch (e) {
+		if (e instanceof ApiError && e.status === 404) throw new Error(`${url} doesn't support pairing (no /agent/v1/pairings). Is this an agentinbox daemon, and is it up to date?`);
+		if (e instanceof ApiError) throw new Error(`${e.message}${e.hint ? `\n  ${e.hint}` : ""}`);
+		throw e;
+	}
+	out();
+	out(box([
+		pc.bold("Approve this agent in the agentinbox console"),
+		"",
+		`Code:   ${pc.bold(pc.yellow(safeText(start.userCode, 40)))}`,
+		`Open:   ${pc.cyan(safeText(start.verificationUrl, 300))}`,
+		`Agent:  ${safeText(name)}`,
+		"",
+		pc.gray("Only approve if the console shows this exact code.")
+	]));
+	out();
+	const ac = new AbortController();
+	const onAbort = () => ac.abort();
+	opts.signal?.addEventListener("abort", onAbort, { once: true });
+	const onSigint = () => ac.abort();
+	if (opts.handleSignals) process.on("SIGINT", onSigint);
+	const started = Date.now();
+	const expiresAt = Date.parse(start.expiresAt) || started + 6e5;
+	let interval = Math.max(1, start.interval || 5) * 1e3;
+	let note = "";
+	const status = new StatusLine(process.stderr);
+	status.start(() => `Waiting for approval · ${formatDuration(Date.now() - started)} elapsed · code expires in ${formatDuration(expiresAt - Date.now())}${note ? pc.yellow(` · ${note}`) : ""}`);
+	let result = null;
+	try {
+		while (!ac.signal.aborted) {
+			await sleep(opts.pollIntervalMs ?? interval, ac.signal);
+			if (ac.signal.aborted) break;
+			try {
+				const r = await pollPairing(url, start.deviceCode);
+				note = "";
+				if (r.status === "pending") continue;
+				if (r.status === "slow_down") {
+					interval = Math.max(interval + 1e3, (r.interval || 0) * 1e3);
+					continue;
+				}
+				result = r;
+				break;
+			} catch (e) {
+				if (e instanceof ApiError && e.status === 429) {
+					interval += 5e3;
+					note = "rate limited, slowing down";
+					continue;
+				}
+				if (e instanceof ApiError && e.status >= 400 && e.status < 500 && e.status !== 408) throw new Error(`${e.message}${e.hint ? `\n  ${e.hint}` : ""}`);
+				note = "can't reach the daemon, retrying";
+				if (Date.now() > expiresAt + 3e4) {
+					result = { status: "expired" };
+					break;
+				}
+			}
+		}
+	} finally {
+		status.stop();
+		if (opts.handleSignals) process.off("SIGINT", onSigint);
+		opts.signal?.removeEventListener("abort", onAbort);
+	}
+	if (!result) {
+		err(pc.yellow("Cancelled. Nothing was approved; the code expires on its own."));
+		return CONNECT_EXIT.cancelled;
+	}
+	switch (result.status) {
+		case "denied":
+			err(pc.red(`✖ The request was denied in the console${result.note ? `: ${safeText(result.note, 300)}` : "."}`));
+			return CONNECT_EXIT.denied;
+		case "expired":
+			err(pc.red("✖ The code expired before it was approved."));
+			err(`  Run the same command again for a fresh code, and approve it within ${formatDuration(Date.parse(start.expiresAt) - started)}.`);
+			return CONNECT_EXIT.expired;
+		case "consumed":
+			err(pc.red("✖ This pairing was already completed and its key handed out once (perhaps by an earlier run of this command)."));
+			err(`  For safety the key is never delivered twice. Start over with \`${NPX} connect\`, or rotate the agent's key in the console.`);
+			return CONNECT_EXIT.consumed;
+		case "approved": break;
+		default: throw new Error(`Unexpected pairing status ${JSON.stringify(result.status)}`);
+	}
+	const profile = {
+		...replacing ? {
+			types: replacing.types,
+			filter: replacing.filter,
+			includeBody: replacing.includeBody,
+			exec: replacing.exec,
+			forward: replacing.forward,
+			forwardSecret: replacing.forwardSecret,
+			concurrency: replacing.concurrency,
+			timeoutSeconds: replacing.timeoutSeconds,
+			maxAttempts: replacing.maxAttempts,
+			cwd: replacing.cwd
+		} : {},
+		url,
+		apiKey: result.apiKey,
+		agentId: result.agent.id,
+		agentName: result.agent.name,
+		consumer,
+		...verdict.kind === "insecure" ? { insecure: true } : {},
+		tool,
+		mcpUrl: `${url}/mcp`,
+		skillUrl: `${url}/skill.md`,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const path = saveProfile(profileName, profile);
+	writeClaudeMcpConfig(profileName, profile.mcpUrl);
+	if (typeof result.mcpUrl === "string" && result.mcpUrl !== profile.mcpUrl) err(pc.yellow(`! The daemon advertises its MCP endpoint as ${safeText(result.mcpUrl, 200)} (its "public URL" setting); using ${profile.mcpUrl}, the address you connected to. Set the public URL in the console if agents should use another address.`));
+	out(`${pc.green("✔")} Approved. Agent ${pc.bold(safeText(result.agent.name))} ${pc.gray(`(${result.agent.id})`)} is connected.`);
+	out(`  Key saved to ${pc.cyan(path)} ${pc.gray("(mode 0600; never displayed. Rotate it in the console if it leaks.)")}`);
+	if (replacing && (replacing.exec || replacing.forward)) out(`  Kept this profile's listener settings. Restart the listener to use the new key${isServiceInstalled(profileName) ? `: ${NPX} listen service install${profileName === "default" ? "" : ` --profile ${profileName}`}` : "."}`);
+	if (replacing && replacing.agentId !== profile.agentId) err(pc.yellow(`! Replaced profile "${profileName}" (agent "${safeText(replacing.agentName)}", ${replacing.agentId}). Its key still works until you rotate it or delete that agent in the console; config backups made by setup-mcp (*.agentinbox-backup-*) may contain it.`));
+	let mcp = null;
+	if (flags.setupMcp) {
+		mcp = setupMcp(tool, mcpTarget(profileName, profile), path);
+		printMcpResult(mcp);
+	}
+	printNextSteps(profileName, profile, tool, mcp);
+	return CONNECT_EXIT.approved;
+}
+function printMcpResult(r) {
+	if (r.ok) out(`${pc.green("✔")} ${r.message}`);
+	else err(`${pc.yellow("!")} ${r.message}`);
+	if (r.backup) out(pc.gray(`  Backup: ${r.backup}`));
+	if (!r.ok && r.manual?.length) {
+		out("  Do it by hand:");
+		for (const l of r.manual) out(`    ${l}`);
+	}
+}
+function skillCommand(tool, url) {
+	switch (tool) {
+		case "claude-code": return `${NPX} skill install --target claude --url ${url}`;
+		case "codex": return `${NPX} skill install --target codex --url ${url}`;
+		case "hermes": return `${NPX} skill install --target ~/.hermes/skills/email --url ${url}`;
+		case "cursor": return `${NPX} skill install --target agents --url ${url}`;
+		default: return `${NPX} skill print --url ${url} > SKILL.md`;
+	}
+}
+function printNextSteps(profileName, profile, tool, mcp) {
+	const p = profileName === "default" ? "" : ` --profile ${profileName}`;
+	const label = tool === "other" ? "your agent" : TOOL_LABELS[tool];
+	const r = recipe(tool, profileName);
+	const execArg = shellQuote(r.exec);
+	out();
+	out(pc.bold("Next steps"));
+	let n = 1;
+	if (mcp?.ok) out(`  ${n++}. ${label} has the agentinbox MCP tools ${pc.gray(`(restart it if it's running)`)}.`);
+	else if (tool === "other") {
+		out(`  ${n++}. Point your agent's MCP client at ${pc.cyan(profile.mcpUrl ?? `${profile.url}/mcp`)} with header Authorization: Bearer <key>`);
+		out(pc.gray(`     The key is the "apiKey" field in ${profilePath(profileName)}.`));
+	} else {
+		out(`  ${n++}. Give ${label} the agentinbox MCP tools without ever seeing the key:`);
+		out(`       ${pc.cyan(`${NPX} setup-mcp --tool ${tool}${p}`)}`);
+	}
+	out(`  ${n++}. Install the agentinbox skill so ${label} knows the rules:`);
+	out(`       ${pc.cyan(skillCommand(tool, profile.url))}`);
+	out(`  ${n++}. Wake ${label} when mail arrives. Try it in the foreground (--save keeps the command in the profile):`);
+	out(`       ${pc.cyan(`${NPX} listen${p} --save --exec ${execArg}`)}`);
+	out(`     then keep it running in the background (systemd / launchd, starts at login):`);
+	out(`       ${pc.cyan(`${NPX} listen service install${p}`)}`);
+	out(pc.gray(`     What the woken agent can use: ${r.confinement}.`));
+	for (const note of r.notes) out(pc.gray(`     ${note}`));
+	out();
+	out(pc.gray("  What this agent may do (mailboxes, capabilities, send mode) was set by whoever approved it. New grants are draft-only:"));
+	out(pc.gray("  sends become Gmail drafts until the operator changes that in the console."));
+	out();
+}
+//#endregion
+export { parseTool, printMcpResult, runConnect };
+
+//# sourceMappingURL=connect-BHC2trBi.js.map

package/dist/connect-BHC2trBi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-BHC2trBi.js","names":[],"sources":["../server/listen/connect.ts"],"sourcesContent":["import { closeSync, constants, fchmodSync, lstatSync, openSync, writeSync } from \"node:fs\";\nimport { hostname } from \"node:os\";\nimport pc from \"picocolors\";\nimport type { AgentTool, PairingPoll, PairingStart, PairingStartInput } from \"../../shared/agent-api.ts\";\nimport { CAPABILITIES, type Capability } from \"../../shared/types.ts\";\nimport { ApiError, clientInfo, pollPairing, startPairing } from \"./api.ts\";\nimport { writeClaudeMcpConfig } from \"./mcpheader.ts\";\nimport { isServiceInstalled } from \"./service.ts\";\nimport { setupMcp, mcpTarget, type McpSetupResult } from \"./mcpsetup.ts\";\nimport { defaultConsumer, validConsumer } from \"./options.ts\";\nimport { DEFAULT_PROFILE, profilePath, validProfileName } from \"./paths.ts\";\nimport { listProfiles, loadProfile, type Profile, profileExists, saveProfile } from \"./profile.ts\";\nimport { recipe, shellQuote, TOOL_LABELS, TOOLS } from \"./recipes.ts\";\nimport { checkTransport, insecureBanner, normalizeDaemonUrl } from \"./transport.ts\";\nimport { box, formatDuration, safeText, StatusLine } from \"./ui.ts\";\nimport { NPX } from \"./version.ts\";\n\nexport interface ConnectFlags {\n  name?: string;\n  tool?: string;\n  account?: string[];\n  capabilities?: string;\n  reason?: string;\n  profile?: string;\n  consumer?: string;\n  insecure?: boolean;\n  force?: boolean;\n  setupMcp?: boolean;\n  /** Also write the output (plain text) to this file: created 0600, never through a symlink or someone else's file. */\n  log?: string;\n}\n\n/** Exit codes, so scripts (and agents setting themselves up) can tell outcomes apart. */\nexport const CONNECT_EXIT = { approved: 0, error: 1, denied: 2, expired: 3, consumed: 4, cancelled: 130 } as const;\n\nexport interface ConnectOptions {\n  /** Tests: poll faster than the server's interval. */\n  pollIntervalMs?: number;\n  signal?: AbortSignal;\n  handleSignals?: boolean;\n}\n\nexport function parseTool(value: string | undefined): AgentTool {\n  if (value === undefined) return \"other\";\n  const v = value.trim().toLowerCase().replace(/^claude$/, \"claude-code\");\n  if (!(TOOLS as readonly string[]).includes(v)) throw new Error(`Unknown --tool \"${value}\". Choose one of: ${TOOLS.join(\", \")}.`);\n  return v as AgentTool;\n}\n\nexport function parseCapabilities(value: string | undefined): Capability[] | undefined {\n  if (value === undefined) return undefined;\n  const list = value\n    .split(\",\")\n    .map((s) => s.trim().toLowerCase())\n    .filter(Boolean);\n  const bad = list.filter((c) => !(CAPABILITIES as readonly string[]).includes(c));\n  if (bad.length) throw new Error(`Unknown capabilit${bad.length > 1 ? \"ies\" : \"y\"} ${bad.join(\", \")}. Choose from: ${CAPABILITIES.join(\", \")}.`);\n  return [...new Set(list)] as Capability[];\n}\n\nconst shortHost = () => hostname().replace(/\\.(local|lan|home)$/i, \"\");\n\nconst sleep = (ms: number, signal?: AbortSignal) =>\n  new Promise<void>((resolve) => {\n    const t = setTimeout(resolve, ms);\n    signal?.addEventListener(\n      \"abort\",\n      () => {\n        clearTimeout(t);\n        resolve();\n      },\n      { once: true },\n    );\n  });\n\n// eslint-disable-next-line no-control-regex\nconst stripAnsi = (s: string) => s.replace(/\\x1b\\[[0-9;]*m/g, \"\");\n/** --log target (fd), written in parallel with the console. */\nlet logFd: number | null = null;\nconst toLog = (s: string) => {\n  if (logFd !== null) writeSync(logFd, stripAnsi(s) + \"\\n\");\n};\nconst out = (s = \"\") => {\n  process.stdout.write(`${s}\\n`);\n  toLog(s);\n};\nconst err = (s = \"\") => {\n  process.stderr.write(`${s}\\n`);\n  toLog(s);\n};\n\n/**\n * Opens --log safely: a new file is created 0600 with O_EXCL; an existing one (e.g. from `mktemp`) is\n * only reused if it is a regular file owned by us, opened without following symlinks. This is what\n * keeps another local user from pre-creating the log and reading the pairing as it happens.\n */\nexport function openConnectLog(path: string): number {\n  try {\n    return openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code !== \"EEXIST\") throw e;\n  }\n  const st = lstatSync(path);\n  const uid = process.getuid?.();\n  if (!st.isFile() || (uid !== undefined && st.uid !== uid)) throw new Error(`Refusing --log ${path}: it exists and is not a regular file owned by you.`);\n  const fd = openSync(path, constants.O_WRONLY | constants.O_TRUNC | constants.O_NOFOLLOW);\n  fchmodSync(fd, 0o600);\n  return fd;\n}\n\nexport async function runConnect(rawUrl: string, flags: ConnectFlags, opts: ConnectOptions = {}): Promise<number> {\n  if (flags.log) logFd = openConnectLog(flags.log);\n  try {\n    return await connect(rawUrl, flags, opts);\n  } finally {\n    if (logFd !== null) closeSync(logFd);\n    logFd = null;\n  }\n}\n\nasync function connect(rawUrl: string, flags: ConnectFlags, opts: ConnectOptions): Promise<number> {\n  const url = normalizeDaemonUrl(rawUrl);\n  const verdict = await checkTransport(url, { insecure: flags.insecure });\n  if (verdict.warning) err(insecureBanner(verdict.warning));\n\n  const profileName = validProfileName(flags.profile ?? DEFAULT_PROFILE);\n  let replacing: Profile | null = null;\n  if (profileExists(profileName) && flags.force) {\n    try {\n      replacing = loadProfile(profileName);\n    } catch {\n      // Unreadable: it's being replaced anyway.\n    }\n  }\n  if (profileExists(profileName) && !flags.force) {\n    let who = \"\";\n    try {\n      const p = loadProfile(profileName);\n      who = ` (agent \"${safeText(p.agentName)}\" on ${p.url})`;\n    } catch {\n      // Unreadable: still don't overwrite silently.\n    }\n    const others = listProfiles();\n    throw new Error(\n      `Profile \"${profileName}\" already exists${who}.\\n` +\n        `  Pair a second agent with --profile <name>${others.length > 1 ? ` (existing: ${others.join(\", \")})` : \"\"}, or replace this one with --force.`,\n    );\n  }\n  const tool = parseTool(flags.tool);\n  const capabilities = parseCapabilities(flags.capabilities);\n  // --force keeps the listener's consumer, so the server-side cursor carries on (no replay, no gap).\n  const consumer = validConsumer(flags.consumer ?? replacing?.consumer ?? defaultConsumer(profileName));\n  const name = (flags.name?.trim() || `${tool === \"other\" ? \"Agent\" : TOOL_LABELS[tool]} on ${shortHost()}`).slice(0, 80);\n\n  const input: PairingStartInput = {\n    name,\n    requested: {\n      ...(flags.account?.length ? { accounts: flags.account } : {}),\n      ...(capabilities ? { capabilities } : {}),\n      ...(flags.reason ? { reason: flags.reason } : {}),\n    },\n    client: { ...clientInfo(), tool },\n  };\n\n  let start: PairingStart;\n  try {\n    start = await startPairing(url, input);\n  } catch (e) {\n    if (e instanceof ApiError && e.status === 404) {\n      throw new Error(`${url} doesn't support pairing (no /agent/v1/pairings). Is this an agentinbox daemon, and is it up to date?`);\n    }\n    if (e instanceof ApiError) throw new Error(`${e.message}${e.hint ? `\\n  ${e.hint}` : \"\"}`);\n    throw e;\n  }\n\n  out();\n  out(\n    box([\n      pc.bold(\"Approve this agent in the agentinbox console\"),\n      \"\",\n      `Code:   ${pc.bold(pc.yellow(safeText(start.userCode, 40)))}`,\n      `Open:   ${pc.cyan(safeText(start.verificationUrl, 300))}`,\n      `Agent:  ${safeText(name)}`,\n      \"\",\n      pc.gray(\"Only approve if the console shows this exact code.\"),\n    ]),\n  );\n  out();\n\n  // Ctrl-C: stop cleanly. Nothing was approved; the request just expires.\n  const ac = new AbortController();\n  const onAbort = () => ac.abort();\n  opts.signal?.addEventListener(\"abort\", onAbort, { once: true });\n  const onSigint = () => ac.abort();\n  if (opts.handleSignals) process.on(\"SIGINT\", onSigint);\n\n  const started = Date.now();\n  const expiresAt = Date.parse(start.expiresAt) || started + 10 * 60_000;\n  let interval = Math.max(1, start.interval || 5) * 1000;\n  let note = \"\";\n  const status = new StatusLine(process.stderr);\n  status.start(\n    () =>\n      `Waiting for approval · ${formatDuration(Date.now() - started)} elapsed · code expires in ${formatDuration(expiresAt - Date.now())}${note ? pc.yellow(` · ${note}`) : \"\"}`,\n  );\n\n  let result: PairingPoll | null = null;\n  try {\n    while (!ac.signal.aborted) {\n      await sleep(opts.pollIntervalMs ?? interval, ac.signal);\n      if (ac.signal.aborted) break;\n      try {\n        const r = await pollPairing(url, start.deviceCode);\n        note = \"\";\n        if (r.status === \"pending\") continue;\n        if (r.status === \"slow_down\") {\n          // The server asks for more room between polls.\n          interval = Math.max(interval + 1000, (r.interval || 0) * 1000);\n          continue;\n        }\n        result = r;\n        break;\n      } catch (e) {\n        if (e instanceof ApiError && e.status === 429) {\n          interval += 5000;\n          note = \"rate limited, slowing down\";\n          continue;\n        }\n        if (e instanceof ApiError && e.status >= 400 && e.status < 500 && e.status !== 408) {\n          throw new Error(`${e.message}${e.hint ? `\\n  ${e.hint}` : \"\"}`);\n        }\n        // Network trouble or a 5xx: keep trying until the code expires.\n        note = \"can't reach the daemon, retrying\";\n        if (Date.now() > expiresAt + 30_000) {\n          result = { status: \"expired\" };\n          break;\n        }\n      }\n    }\n  } finally {\n    status.stop();\n    if (opts.handleSignals) process.off(\"SIGINT\", onSigint);\n    opts.signal?.removeEventListener(\"abort\", onAbort);\n  }\n\n  if (!result) {\n    err(pc.yellow(\"Cancelled. Nothing was approved; the code expires on its own.\"));\n    return CONNECT_EXIT.cancelled;\n  }\n\n  switch (result.status) {\n    case \"denied\":\n      err(pc.red(`✖ The request was denied in the console${result.note ? `: ${safeText(result.note, 300)}` : \".\"}`));\n      return CONNECT_EXIT.denied;\n    case \"expired\":\n      err(pc.red(\"✖ The code expired before it was approved.\"));\n      err(`  Run the same command again for a fresh code, and approve it within ${formatDuration(Date.parse(start.expiresAt) - started)}.`);\n      return CONNECT_EXIT.expired;\n    case \"consumed\":\n      err(pc.red(\"✖ This pairing was already completed and its key handed out once (perhaps by an earlier run of this command).\"));\n      err(`  For safety the key is never delivered twice. Start over with \\`${NPX} connect\\`, or rotate the agent's key in the console.`);\n      return CONNECT_EXIT.consumed;\n    case \"approved\":\n      break;\n    default:\n      throw new Error(`Unexpected pairing status ${JSON.stringify((result as { status: unknown }).status)}`);\n  }\n\n  // --force keeps everything about the listener (targets, filters, limits, forward secret, cwd); only\n  // the pairing (daemon, key, agent) is replaced.\n  const kept: Partial<Profile> = replacing\n    ? {\n        types: replacing.types,\n        filter: replacing.filter,\n        includeBody: replacing.includeBody,\n        exec: replacing.exec,\n        forward: replacing.forward,\n        forwardSecret: replacing.forwardSecret,\n        concurrency: replacing.concurrency,\n        timeoutSeconds: replacing.timeoutSeconds,\n        maxAttempts: replacing.maxAttempts,\n        cwd: replacing.cwd,\n      }\n    : {};\n  const profile: Profile = {\n    ...kept,\n    url,\n    apiKey: result.apiKey,\n    agentId: result.agent.id,\n    agentName: result.agent.name,\n    consumer,\n    ...(verdict.kind === \"insecure\" ? { insecure: true } : {}),\n    tool,\n    // Derived from the URL the user chose and transport-checked; the daemon's advertised URLs come\n    // from its publicUrl setting and are never trusted with the key.\n    mcpUrl: `${url}/mcp`,\n    skillUrl: `${url}/skill.md`,\n    createdAt: new Date().toISOString(),\n  };\n  const path = saveProfile(profileName, profile);\n  writeClaudeMcpConfig(profileName, profile.mcpUrl!);\n  if (typeof result.mcpUrl === \"string\" && result.mcpUrl !== profile.mcpUrl) {\n    err(\n      pc.yellow(\n        `! The daemon advertises its MCP endpoint as ${safeText(result.mcpUrl, 200)} (its \"public URL\" setting); using ${profile.mcpUrl}, the address you connected to. Set the public URL in the console if agents should use another address.`,\n      ),\n    );\n  }\n\n  out(`${pc.green(\"✔\")} Approved. Agent ${pc.bold(safeText(result.agent.name))} ${pc.gray(`(${result.agent.id})`)} is connected.`);\n  out(`  Key saved to ${pc.cyan(path)} ${pc.gray(\"(mode 0600; never displayed. Rotate it in the console if it leaks.)\")}`);\n  if (replacing && (replacing.exec || replacing.forward)) {\n    out(`  Kept this profile's listener settings. Restart the listener to use the new key${isServiceInstalled(profileName) ? `: ${NPX} listen service install${profileName === DEFAULT_PROFILE ? \"\" : ` --profile ${profileName}`}` : \".\"}`);\n  }\n  if (replacing && replacing.agentId !== profile.agentId) {\n    err(\n      pc.yellow(\n        `! Replaced profile \"${profileName}\" (agent \"${safeText(replacing.agentName)}\", ${replacing.agentId}). Its key still works until you rotate it or delete that agent in the console; config backups made by setup-mcp (*.agentinbox-backup-*) may contain it.`,\n      ),\n    );\n  }\n\n  let mcp: McpSetupResult | null = null;\n  if (flags.setupMcp) {\n    mcp = setupMcp(tool, mcpTarget(profileName, profile), path);\n    printMcpResult(mcp);\n  }\n  printNextSteps(profileName, profile, tool, mcp);\n  return CONNECT_EXIT.approved;\n}\n\nexport function printMcpResult(r: McpSetupResult): void {\n  if (r.ok) out(`${pc.green(\"✔\")} ${r.message}`);\n  else err(`${pc.yellow(\"!\")} ${r.message}`);\n  if (r.backup) out(pc.gray(`  Backup: ${r.backup}`));\n  if (!r.ok && r.manual?.length) {\n    out(\"  Do it by hand:\");\n    for (const l of r.manual) out(`    ${l}`);\n  }\n}\n\nfunction skillCommand(tool: AgentTool, url: string): string {\n  switch (tool) {\n    case \"claude-code\":\n      return `${NPX} skill install --target claude --url ${url}`;\n    case \"codex\":\n      return `${NPX} skill install --target codex --url ${url}`;\n    case \"hermes\":\n      return `${NPX} skill install --target ~/.hermes/skills/email --url ${url}`;\n    case \"cursor\":\n      return `${NPX} skill install --target agents --url ${url}`;\n    default:\n      return `${NPX} skill print --url ${url} > SKILL.md`;\n  }\n}\n\nexport function printNextSteps(profileName: string, profile: Profile, tool: AgentTool, mcp: McpSetupResult | null): void {\n  const p = profileName === DEFAULT_PROFILE ? \"\" : ` --profile ${profileName}`;\n  const label = tool === \"other\" ? \"your agent\" : TOOL_LABELS[tool];\n  const r = recipe(tool, profileName);\n  const execArg = shellQuote(r.exec);\n  out();\n  out(pc.bold(\"Next steps\"));\n  let n = 1;\n  if (mcp?.ok) {\n    out(`  ${n++}. ${label} has the agentinbox MCP tools ${pc.gray(`(restart it if it's running)`)}.`);\n  } else if (tool === \"other\") {\n    out(`  ${n++}. Point your agent's MCP client at ${pc.cyan(profile.mcpUrl ?? `${profile.url}/mcp`)} with header Authorization: Bearer <key>`);\n    out(pc.gray(`     The key is the \"apiKey\" field in ${profilePath(profileName)}.`));\n  } else {\n    out(`  ${n++}. Give ${label} the agentinbox MCP tools without ever seeing the key:`);\n    out(`       ${pc.cyan(`${NPX} setup-mcp --tool ${tool}${p}`)}`);\n  }\n  out(`  ${n++}. Install the agentinbox skill so ${label} knows the rules:`);\n  out(`       ${pc.cyan(skillCommand(tool, profile.url))}`);\n  out(`  ${n++}. Wake ${label} when mail arrives. Try it in the foreground (--save keeps the command in the profile):`);\n  out(`       ${pc.cyan(`${NPX} listen${p} --save --exec ${execArg}`)}`);\n  out(`     then keep it running in the background (systemd / launchd, starts at login):`);\n  out(`       ${pc.cyan(`${NPX} listen service install${p}`)}`);\n  out(pc.gray(`     What the woken agent can use: ${r.confinement}.`));\n  for (const note of r.notes) out(pc.gray(`     ${note}`));\n  out();\n  out(pc.gray(\"  What this agent may do (mailboxes, capabilities, send mode) was set by whoever approved it. New grants are draft-only:\"));\n  out(pc.gray(\"  sends become Gmail drafts until the operator changes that in the console.\"));\n  out();\n}\n"],"mappings":";;;;;;;;;;;;;;;AAiCA,MAAa,eAAe;CAAE,UAAU;CAAG,OAAO;CAAG,QAAQ;CAAG,SAAS;CAAG,UAAU;CAAG,WAAW;AAAI;AASxG,SAAgB,UAAU,OAAsC;CAC9D,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,MAAM,IAAI,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,YAAY,aAAa;CACtE,IAAI,CAAE,MAA4B,SAAS,CAAC,GAAG,MAAM,IAAI,MAAM,mBAAmB,MAAM,oBAAoB,MAAM,KAAK,IAAI,EAAE,EAAE;CAC/H,OAAO;AACT;AAEA,SAAgB,kBAAkB,OAAqD;CACrF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAM,OAAO,MACV,MAAM,GAAG,CAAC,CACV,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAClC,OAAO,OAAO;CACjB,MAAM,MAAM,KAAK,QAAQ,MAAM,CAAE,aAAmC,SAAS,CAAC,CAAC;CAC/E,IAAI,IAAI,QAAQ,MAAM,IAAI,MAAM,oBAAoB,IAAI,SAAS,IAAI,QAAQ,IAAI,GAAG,IAAI,KAAK,IAAI,EAAE,iBAAiB,aAAa,KAAK,IAAI,EAAE,EAAE;CAC9I,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC;AAC1B;AAEA,MAAM,kBAAkB,SAAS,CAAC,CAAC,QAAQ,wBAAwB,EAAE;AAErE,MAAM,SAAS,IAAY,WACzB,IAAI,SAAe,YAAY;CAC7B,MAAM,IAAI,WAAW,SAAS,EAAE;CAChC,QAAQ,iBACN,eACM;EACJ,aAAa,CAAC;EACd,QAAQ;CACV,GACA,EAAE,MAAM,KAAK,CACf;AACF,CAAC;AAGH,MAAM,aAAa,MAAc,EAAE,QAAQ,mBAAmB,EAAE;;AAEhE,IAAI,QAAuB;AAC3B,MAAM,SAAS,MAAc;CAC3B,IAAI,UAAU,MAAM,UAAU,OAAO,UAAU,CAAC,IAAI,IAAI;AAC1D;AACA,MAAM,OAAO,IAAI,OAAO;CACtB,QAAQ,OAAO,MAAM,GAAG,EAAE,GAAG;CAC7B,MAAM,CAAC;AACT;AACA,MAAM,OAAO,IAAI,OAAO;CACtB,QAAQ,OAAO,MAAM,GAAG,EAAE,GAAG;CAC7B,MAAM,CAAC;AACT;;;;;;AAOA,SAAgB,eAAe,MAAsB;CACnD,IAAI;EACF,OAAO,SAAS,MAAM,UAAU,WAAW,UAAU,UAAU,UAAU,SAAS,UAAU,YAAY,GAAK;CAC/G,SAAS,GAAG;EACV,IAAK,EAA4B,SAAS,UAAU,MAAM;CAC5D;CACA,MAAM,KAAK,UAAU,IAAI;CACzB,MAAM,MAAM,QAAQ,SAAS;CAC7B,IAAI,CAAC,GAAG,OAAO,KAAM,QAAQ,KAAA,KAAa,GAAG,QAAQ,KAAM,MAAM,IAAI,MAAM,kBAAkB,KAAK,oDAAoD;CACtJ,MAAM,KAAK,SAAS,MAAM,UAAU,WAAW,UAAU,UAAU,UAAU,UAAU;CACvF,WAAW,IAAI,GAAK;CACpB,OAAO;AACT;AAEA,eAAsB,WAAW,QAAgB,OAAqB,OAAuB,CAAC,GAAoB;CAChH,IAAI,MAAM,KAAK,QAAQ,eAAe,MAAM,GAAG;CAC/C,IAAI;EACF,OAAO,MAAM,QAAQ,QAAQ,OAAO,IAAI;CAC1C,UAAU;EACR,IAAI,UAAU,MAAM,UAAU,KAAK;EACnC,QAAQ;CACV;AACF;AAEA,eAAe,QAAQ,QAAgB,OAAqB,MAAuC;CACjG,MAAM,MAAM,mBAAmB,MAAM;CACrC,MAAM,UAAU,MAAM,eAAe,KAAK,EAAE,UAAU,MAAM,SAAS,CAAC;CACtE,IAAI,QAAQ,SAAS,IAAI,eAAe,QAAQ,OAAO,CAAC;CAExD,MAAM,cAAc,iBAAiB,MAAM,WAAA,SAA0B;CACrE,IAAI,YAA4B;CAChC,IAAI,cAAc,WAAW,KAAK,MAAM,OACtC,IAAI;EACF,YAAY,YAAY,WAAW;CACrC,QAAQ,CAER;CAEF,IAAI,cAAc,WAAW,KAAK,CAAC,MAAM,OAAO;EAC9C,IAAI,MAAM;EACV,IAAI;GACF,MAAM,IAAI,YAAY,WAAW;GACjC,MAAM,YAAY,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI;EACvD,QAAQ,CAER;EACA,MAAM,SAAS,aAAa;EAC5B,MAAM,IAAI,MACR,YAAY,YAAY,kBAAkB,IAAI,gDACE,OAAO,SAAS,IAAI,eAAe,OAAO,KAAK,IAAI,EAAE,KAAK,GAAG,oCAC/G;CACF;CACA,MAAM,OAAO,UAAU,MAAM,IAAI;CACjC,MAAM,eAAe,kBAAkB,MAAM,YAAY;CAEzD,MAAM,WAAW,cAAc,MAAM,YAAY,WAAW,YAAY,gBAAgB,WAAW,CAAC;CACpG,MAAM,QAAQ,MAAM,MAAM,KAAK,KAAK,GAAG,SAAS,UAAU,UAAU,YAAY,MAAM,MAAM,UAAU,IAAA,CAAK,MAAM,GAAG,EAAE;CAEtH,MAAM,QAA2B;EAC/B;EACA,WAAW;GACT,GAAI,MAAM,SAAS,SAAS,EAAE,UAAU,MAAM,QAAQ,IAAI,CAAC;GAC3D,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;GACvC,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EACjD;EACA,QAAQ;GAAE,GAAG,WAAW;GAAG;EAAK;CAClC;CAEA,IAAI;CACJ,IAAI;EACF,QAAQ,MAAM,aAAa,KAAK,KAAK;CACvC,SAAS,GAAG;EACV,IAAI,aAAa,YAAY,EAAE,WAAW,KACxC,MAAM,IAAI,MAAM,GAAG,IAAI,sGAAsG;EAE/H,IAAI,aAAa,UAAU,MAAM,IAAI,MAAM,GAAG,EAAE,UAAU,EAAE,OAAO,OAAO,EAAE,SAAS,IAAI;EACzF,MAAM;CACR;CAEA,IAAI;CACJ,IACE,IAAI;EACF,GAAG,KAAK,8CAA8C;EACtD;EACA,WAAW,GAAG,KAAK,GAAG,OAAO,SAAS,MAAM,UAAU,EAAE,CAAC,CAAC;EAC1D,WAAW,GAAG,KAAK,SAAS,MAAM,iBAAiB,GAAG,CAAC;EACvD,WAAW,SAAS,IAAI;EACxB;EACA,GAAG,KAAK,oDAAoD;CAC9D,CAAC,CACH;CACA,IAAI;CAGJ,MAAM,KAAK,IAAI,gBAAgB;CAC/B,MAAM,gBAAgB,GAAG,MAAM;CAC/B,KAAK,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CAC9D,MAAM,iBAAiB,GAAG,MAAM;CAChC,IAAI,KAAK,eAAe,QAAQ,GAAG,UAAU,QAAQ;CAErD,MAAM,UAAU,KAAK,IAAI;CACzB,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,KAAK,UAAU;CAC3D,IAAI,WAAW,KAAK,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI;CAClD,IAAI,OAAO;CACX,MAAM,SAAS,IAAI,WAAW,QAAQ,MAAM;CAC5C,OAAO,YAEH,0BAA0B,eAAe,KAAK,IAAI,IAAI,OAAO,EAAE,6BAA6B,eAAe,YAAY,KAAK,IAAI,CAAC,IAAI,OAAO,GAAG,OAAO,MAAM,MAAM,IAAI,IAC1K;CAEA,IAAI,SAA6B;CACjC,IAAI;EACF,OAAO,CAAC,GAAG,OAAO,SAAS;GACzB,MAAM,MAAM,KAAK,kBAAkB,UAAU,GAAG,MAAM;GACtD,IAAI,GAAG,OAAO,SAAS;GACvB,IAAI;IACF,MAAM,IAAI,MAAM,YAAY,KAAK,MAAM,UAAU;IACjD,OAAO;IACP,IAAI,EAAE,WAAW,WAAW;IAC5B,IAAI,EAAE,WAAW,aAAa;KAE5B,WAAW,KAAK,IAAI,WAAW,MAAO,EAAE,YAAY,KAAK,GAAI;KAC7D;IACF;IACA,SAAS;IACT;GACF,SAAS,GAAG;IACV,IAAI,aAAa,YAAY,EAAE,WAAW,KAAK;KAC7C,YAAY;KACZ,OAAO;KACP;IACF;IACA,IAAI,aAAa,YAAY,EAAE,UAAU,OAAO,EAAE,SAAS,OAAO,EAAE,WAAW,KAC7E,MAAM,IAAI,MAAM,GAAG,EAAE,UAAU,EAAE,OAAO,OAAO,EAAE,SAAS,IAAI;IAGhE,OAAO;IACP,IAAI,KAAK,IAAI,IAAI,YAAY,KAAQ;KACnC,SAAS,EAAE,QAAQ,UAAU;KAC7B;IACF;GACF;EACF;CACF,UAAU;EACR,OAAO,KAAK;EACZ,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,QAAQ;EACtD,KAAK,QAAQ,oBAAoB,SAAS,OAAO;CACnD;CAEA,IAAI,CAAC,QAAQ;EACX,IAAI,GAAG,OAAO,+DAA+D,CAAC;EAC9E,OAAO,aAAa;CACtB;CAEA,QAAQ,OAAO,QAAf;EACE,KAAK;GACH,IAAI,GAAG,IAAI,0CAA0C,OAAO,OAAO,KAAK,SAAS,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC;GAC7G,OAAO,aAAa;EACtB,KAAK;GACH,IAAI,GAAG,IAAI,4CAA4C,CAAC;GACxD,IAAI,wEAAwE,eAAe,KAAK,MAAM,MAAM,SAAS,IAAI,OAAO,EAAE,EAAE;GACpI,OAAO,aAAa;EACtB,KAAK;GACH,IAAI,GAAG,IAAI,+GAA+G,CAAC;GAC3H,IAAI,oEAAoE,IAAI,sDAAsD;GAClI,OAAO,aAAa;EACtB,KAAK,YACH;EACF,SACE,MAAM,IAAI,MAAM,6BAA6B,KAAK,UAAW,OAA+B,MAAM,GAAG;CACzG;CAkBA,MAAM,UAAmB;EACvB,GAf6B,YAC3B;GACE,OAAO,UAAU;GACjB,QAAQ,UAAU;GAClB,aAAa,UAAU;GACvB,MAAM,UAAU;GAChB,SAAS,UAAU;GACnB,eAAe,UAAU;GACzB,aAAa,UAAU;GACvB,gBAAgB,UAAU;GAC1B,aAAa,UAAU;GACvB,KAAK,UAAU;EACjB,IACA,CAAC;EAGH;EACA,QAAQ,OAAO;EACf,SAAS,OAAO,MAAM;EACtB,WAAW,OAAO,MAAM;EACxB;EACA,GAAI,QAAQ,SAAS,aAAa,EAAE,UAAU,KAAK,IAAI,CAAC;EACxD;EAGA,QAAQ,GAAG,IAAI;EACf,UAAU,GAAG,IAAI;EACjB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CACpC;CACA,MAAM,OAAO,YAAY,aAAa,OAAO;CAC7C,qBAAqB,aAAa,QAAQ,MAAO;CACjD,IAAI,OAAO,OAAO,WAAW,YAAY,OAAO,WAAW,QAAQ,QACjE,IACE,GAAG,OACD,+CAA+C,SAAS,OAAO,QAAQ,GAAG,EAAE,qCAAqC,QAAQ,OAAO,wGAClI,CACF;CAGF,IAAI,GAAG,GAAG,MAAM,GAAG,EAAE,mBAAmB,GAAG,KAAK,SAAS,OAAO,MAAM,IAAI,CAAC,EAAE,GAAG,GAAG,KAAK,IAAI,OAAO,MAAM,GAAG,EAAE,EAAE,eAAe;CAC/H,IAAI,kBAAkB,GAAG,KAAK,IAAI,EAAE,GAAG,GAAG,KAAK,qEAAqE,GAAG;CACvH,IAAI,cAAc,UAAU,QAAQ,UAAU,UAC5C,IAAI,mFAAmF,mBAAmB,WAAW,IAAI,KAAK,IAAI,yBAAyB,gBAAA,YAAkC,KAAK,cAAc,kBAAkB,KAAK;CAEzO,IAAI,aAAa,UAAU,YAAY,QAAQ,SAC7C,IACE,GAAG,OACD,uBAAuB,YAAY,YAAY,SAAS,UAAU,SAAS,EAAE,KAAK,UAAU,QAAQ,yJACtG,CACF;CAGF,IAAI,MAA6B;CACjC,IAAI,MAAM,UAAU;EAClB,MAAM,SAAS,MAAM,UAAU,aAAa,OAAO,GAAG,IAAI;EAC1D,eAAe,GAAG;CACpB;CACA,eAAe,aAAa,SAAS,MAAM,GAAG;CAC9C,OAAO,aAAa;AACtB;AAEA,SAAgB,eAAe,GAAyB;CACtD,IAAI,EAAE,IAAI,IAAI,GAAG,GAAG,MAAM,GAAG,EAAE,GAAG,EAAE,SAAS;MACxC,IAAI,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,EAAE,SAAS;CACzC,IAAI,EAAE,QAAQ,IAAI,GAAG,KAAK,aAAa,EAAE,QAAQ,CAAC;CAClD,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,QAAQ;EAC7B,IAAI,kBAAkB;EACtB,KAAK,MAAM,KAAK,EAAE,QAAQ,IAAI,OAAO,GAAG;CAC1C;AACF;AAEA,SAAS,aAAa,MAAiB,KAAqB;CAC1D,QAAQ,MAAR;EACE,KAAK,eACH,OAAO,GAAG,IAAI,uCAAuC;EACvD,KAAK,SACH,OAAO,GAAG,IAAI,sCAAsC;EACtD,KAAK,UACH,OAAO,GAAG,IAAI,uDAAuD;EACvE,KAAK,UACH,OAAO,GAAG,IAAI,uCAAuC;EACvD,SACE,OAAO,GAAG,IAAI,qBAAqB,IAAI;CAC3C;AACF;AAEA,SAAgB,eAAe,aAAqB,SAAkB,MAAiB,KAAkC;CACvH,MAAM,IAAI,gBAAA,YAAkC,KAAK,cAAc;CAC/D,MAAM,QAAQ,SAAS,UAAU,eAAe,YAAY;CAC5D,MAAM,IAAI,OAAO,MAAM,WAAW;CAClC,MAAM,UAAU,WAAW,EAAE,IAAI;CACjC,IAAI;CACJ,IAAI,GAAG,KAAK,YAAY,CAAC;CACzB,IAAI,IAAI;CACR,IAAI,KAAK,IACP,IAAI,KAAK,IAAI,IAAI,MAAM,gCAAgC,GAAG,KAAK,8BAA8B,EAAE,EAAE;MAC5F,IAAI,SAAS,SAAS;EAC3B,IAAI,KAAK,IAAI,qCAAqC,GAAG,KAAK,QAAQ,UAAU,GAAG,QAAQ,IAAI,KAAK,EAAE,yCAAyC;EAC3I,IAAI,GAAG,KAAK,yCAAyC,YAAY,WAAW,EAAE,EAAE,CAAC;CACnF,OAAO;EACL,IAAI,KAAK,IAAI,SAAS,MAAM,uDAAuD;EACnF,IAAI,UAAU,GAAG,KAAK,GAAG,IAAI,oBAAoB,OAAO,GAAG,GAAG;CAChE;CACA,IAAI,KAAK,IAAI,oCAAoC,MAAM,kBAAkB;CACzE,IAAI,UAAU,GAAG,KAAK,aAAa,MAAM,QAAQ,GAAG,CAAC,GAAG;CACxD,IAAI,KAAK,IAAI,SAAS,MAAM,wFAAwF;CACpH,IAAI,UAAU,GAAG,KAAK,GAAG,IAAI,SAAS,EAAE,iBAAiB,SAAS,GAAG;CACrE,IAAI,mFAAmF;CACvF,IAAI,UAAU,GAAG,KAAK,GAAG,IAAI,yBAAyB,GAAG,GAAG;CAC5D,IAAI,GAAG,KAAK,sCAAsC,EAAE,YAAY,EAAE,CAAC;CACnE,KAAK,MAAM,QAAQ,EAAE,OAAO,IAAI,GAAG,KAAK,QAAQ,MAAM,CAAC;CACvD,IAAI;CACJ,IAAI,GAAG,KAAK,0HAA0H,CAAC;CACvI,IAAI,GAAG,KAAK,6EAA6E,CAAC;CAC1F,IAAI;AACN"}