starmux 0.10.0 → 0.12.0

package/dist/src/access-dashboard.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-dashboard.js","sourceRoot":"","sources":["../../src/access-dashboard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAC,WAAW,EAAC,MAAM,qBAAqB,CAAC;AAG9D,OAAO,EAAC,iBAAiB,EAAC,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,MAAM,WAAW,GAAC,8UAA8U,CAAC;AACjW,MAAM,UAAU,GAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAC,MAAM,CAAC,MAAM,CAAC,EAAC,GAAG,iBAAiB,EAAC,yBAAyB,EAAC,iBAAiB,CAAC,yBAAyB,CAAC,GAAC,wBAAwB,UAAU,GAAG,EAAC,CAAC,CAAC;AAC9K,MAAM,CAAC,GAAC,CAAC,CAAS,EAAC,EAAE,CAAA,MAAM,CAAC,CAAC,IAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAC,CAAC,CAAA,EAAE,CAAA,CAAC,EAAC,GAAG,EAAC,OAAO,EAAC,GAAG,EAAC,MAAM,EAAC,GAAG,EAAC,MAAM,EAAC,GAAG,EAAC,QAAQ,EAAC,GAAG,EAAC,OAAO,EAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;AAC7H,MAAM,UAAU,UAAU,CAAC,KAAoD,EAAC,OAAqB;IACnG,MAAM,IAAI,GAAC,CAAC,EAAS,EAAC,MAAa,EAAC,KAAY,EAAC,EAAE,CAAA,8EAA8E,EAAE,KAAK,MAAM,iHAAiH,KAAK,kBAAkB,CAAC;IACvR,OAAO;;iBAEQ,KAAK,CAAC,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,oBAAoB,CAAA,CAAC,CAAA,KAAK,CAAC,IAAI,KAAG,OAAO,CAAA,CAAC,CAAA,OAAO,CAAA,CAAC,CAAA,iBAAiB,uHAAuH,KAAK,CAAC,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,6IAA6I,CAAA,CAAC,CAAA,iHAAiH;IACpf,OAAO,CAAA,CAAC,CAAA,4CAA4C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kIAAkI,CAAA,CAAC,CAAA,EAAE;wIACnE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,IAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,IAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,IAAE,WAAW,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAE,8CAA8C;uCAC3X,IAAI,CAAC,QAAQ,EAAC,+KAA+K,EAAC,QAAQ,CAAC;yCACrM,IAAI,CAAC,MAAM,EAAC,kOAAkO,EAAC,YAAY,CAAC;;IAEjS,KAAK,CAAC,KAAK,CAAA,CAAC,CAAA,oBAAoB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAA,CAAC,CAAA,uBAAuB;IACxT,IAAI,CAAC,iBAAiB,EAAC,4jBAA4jB,EAAC,mBAAmB,CAAC;;;oFAGxhB,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,SAAS,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,QAAQ,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAE,oDAAoD;IAClT,IAAI,CAAC,cAAc,EAAC,yDAAyD,EAAC,yBAAyB,CAAC;uCACrE,IAAI,CAAC,QAAQ,EAAC,yDAAyD,EAAC,QAAQ,CAAC;iJACyB,WAAW,kBAAkB,CAAC;AAC/K,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAC,MAAoB;IACvE,IAAG,GAAG,CAAC,OAAO,CAAC,MAAM,KAAG,SAAS,GAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAE,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAG,mCAAmC;QAAC,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;IAC9J,MAAM,IAAI,GAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAAA,IAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAE,IAAI,GAAC,CAAC,IAAE,IAAI,GAAC,IAAI;QAAC,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;IACvH,IAAI,IAAI,GAAC,EAAE,CAAC;IAAA,IAAI,KAAK,EAAC,MAAM,KAAK,IAAI,GAAG,EAAC,CAAC;QAAA,IAAI,IAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAAA,IAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAC,IAAI;YAAC,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;IAAA,CAAC;IACnH,MAAM,CAAC,GAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,KAAI,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE;QAAC,IAAG,CAAC,CAAC,IAAI,EAAC,OAAO,EAAC,MAAM,EAAC,WAAW,EAAC,MAAM,EAAC,IAAI,EAAC,QAAQ,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,KAAG,CAAC;YAAC,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;IAC9L,IAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;IAChE,IAAG,CAAC;QACF,IAAI,OAA8B,CAAC;QACnC,IAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAG,QAAQ;YAAC,OAAO,GAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAE,EAAE,EAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAE,IAAI,CAAC,CAAC;aAC7F,IAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAG,QAAQ;YAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAE,EAAE,CAAC,CAAC;aAC/D,IAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAG,MAAM,IAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAG,SAAS,IAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAG,SAAS,IAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAG,OAAO,CAAC;YAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAgC,CAAC,CAAC;aAC5K,IAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAG,cAAc;YAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAE,EAAE,CAAC,CAAC;aAC1E,IAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAG,iBAAiB,EAAC,CAAC;YACvC,MAAM,MAAM,GAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAE,MAAM,CAAC;YACxC,IAAG,CAAC,CAAC,MAAM,EAAC,qBAAqB,EAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAC,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;YAC7F,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,aAAa,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,EAAE,EAAC,QAAQ,EAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAE,EAAE;gBACxG,QAAQ,EAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAE,EAAE,EAAC,eAAe,EAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAClH,uBAAuB,EAAC,MAA2D,EAAC,CAAC,CAAC,CAAC;QAC3F,CAAC;;YACI,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;QACzB,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,IAAI,EAAC,UAAU,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAC,OAAO,CAAC,EAAC,CAAC;IACvE,CAAC;IAAA,MAAK,CAAC;QAAA,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;IAAA,CAAC;AAC9B,CAAC","sourcesContent":["import {discoverOAuth,metadataUrl} from './oauth-resource.js';\nimport type {IncomingMessage} from 'node:http';\nimport type {AccessControl} from './access-control.js';\nimport {permissionHeaders} from './permissions-dashboard.js';\nimport {createHash} from 'node:crypto';\nconst loginScript=`(()=>{const k='starmux-owner-token';const q=new URLSearchParams(location.hash.slice(1));const t=q.get('token');if(t){history.replaceState(null,'',location.pathname);sessionStorage.setItem(k,t);}const token=sessionStorage.getItem(k);if(token)for(const input of document.querySelectorAll('input[name=\"token\"]'))input.value=token;})();`;\nconst scriptHash=createHash('sha256').update(loginScript).digest('base64');\nexport const accessHeaders=Object.freeze({...permissionHeaders,'content-security-policy':permissionHeaders['content-security-policy']+`; script-src 'sha256-${scriptHash}'`});\nconst e=(s:unknown)=>String(s??'').replace(/[&<>\"']/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','\"':'&quot;',\"'\":'&#39;'}[c]!));\nexport function accessPage(state:Awaited<ReturnType<AccessControl['snapshot']>>,created?:{key:string}){\n  const form=(op:string,fields:string,label:string)=>`<form method=\"post\" action=\"/access\"><input type=\"hidden\" name=\"op\" value=\"${op}\">${fields}<label>Owner management token <input type=\"password\" name=\"token\" required autocomplete=\"off\"></label><button>${label}</button></form>`;\n  return `<!doctype html><html lang=\"en\"><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width\"><title>Gateway · Access control</title><style>body{font:16px system-ui;max-width:960px;margin:40px auto;padding:0 24px;background:#f5f7fa;color:#243249}section{background:white;border:1px solid #dae0e8;border-radius:12px;padding:24px;margin:20px 0}input,select,button{font:inherit;padding:8px;margin:8px}label{display:block}code{overflow-wrap:anywhere}td,th{text-align:left;padding:10px;border-bottom:1px solid #ddd}table{width:100%}</style><h1>Access control</h1>\n  <p><a href=\"/dashboard\">Dashboard</a> · <a href=\"/permissions\">Workspace permissions</a></p>\n  <section><h2>${state.mode==='ingress'?'Managed by ingress':state.mode==='oauth'?'OAuth':'Gateway API key'}</h2><p>Permission: Owner default. Credentials do not change workspace, tool or operating-system permissions.</p><p>${state.mode==='ingress'?'Gateway does not verify caller identity. Restrict remote access through your ingress. HTTPS encryption alone does not authenticate callers.':'Every MCP request requires an active credential. Missing, invalid, expired or revoked credentials are rejected.'}</p></section>\n  ${created?`<section><h2>Copy this key now</h2><code>${e(created.key)}</code><p>This key is shown only in this response. Keep it private; it grants the owner-approved MCP capabilities.</p></section>`:''}\n  <section><h2>Client credentials</h2><table><tr><th>Name / ID</th><th>Status / Revoked</th><th>Created / Last used / Expiry</th></tr>${state.credentials.map(c=>`<tr><td>${e(c.name)}<br><code>${e(c.id)}</code></td><td>${e(c.status)}<br>${e(c.revokedAt||'—')}</td><td>${e(c.createdAt)}<br>${e(c.lastUsedAt||'Never')}<br>${e(c.expiresAt||'No expiry')}</td></tr>`).join('')||'<tr><td colspan=\"3\">No credentials</td></tr>'}</table></section>\n  <section><h2>Create credential</h2>${form('create','<label>Name <input name=\"name\" maxlength=\"80\" required></label><label>Expiry (optional, UTC ISO 8601) <input name=\"expiresAt\" placeholder=\"2027-01-01T00:00:00.000Z\"></label>','Create')}</section>\n  <section><h2>Authentication mode</h2>${form('mode','<select name=\"mode\"><option value=\"api-key\">Require Gateway API key</option><option value=\"oauth\">Require OAuth (configure first)</option><option value=\"ingress\">Managed by ingress (no Gateway key required)</option></select>','Apply mode')}<p>Switching to ingress mode permits requests without a Gateway key. Existing owner permissions still apply.</p></section>\n  <section><h2>OAuth configuration</h2><p>Use an existing authorization server. Configuration does not enable OAuth until you change the mode above.</p>\n  ${state.oauth?`<p>Issuer: <code>${e(state.oauth.issuer)}</code><br>Resource: <code>${e(state.oauth.resource)}</code><br>Discovery: <code>${e(metadataUrl(state.oauth))}</code><br>Client: ${e(state.oauth.clientId)} · ${e(state.oauth.clientRegistration)}<br>Scope: ${e(state.oauth.scope)}</p>`:'<p>Not configured</p>'}\n  ${form('oauth-configure','<label>Issuer URL <input name=\"issuer\" type=\"url\" required></label><label>Public MCP resource URL <input name=\"resource\" type=\"url\" required></label><label>Registered client ID <input name=\"clientId\" required></label><label>Allowed owner subject IDs (comma separated) <input name=\"subjects\" required></label><label>Token endpoint authentication <select name=\"tokenAuth\"><option value=\"none\">none (public client + PKCE)</option><option value=\"client_secret_basic\">client_secret_basic</option><option value=\"client_secret_post\">client_secret_post</option></select></label>','Discover and save')}\n  <p>This form uses a predefined client and HTTPS. Client secrets stay with the authorization server and ChatGPT; do not enter them here. Advanced registration and local development are available through the CLI.</p></section>\n  <section><h2>OAuth connections</h2><p>Revocation blocks the session, including tokens refreshed from it. A new owner-approved login may establish a new session.</p>\n  <table><tr><th>Connection ID / Client</th><th>Status</th><th>Last used</th></tr>${state.oauthConnections.map(c=>`<tr><td><code>${e(c.id)}</code><br>${e(c.clientId)}</td><td>${c.revokedAt?'Revoked':'Active'}</td><td>${e(c.lastUsedAt)}</td></tr>`).join('')||'<tr><td colspan=\"3\">No OAuth connections</td></tr>'}</table>\n  ${form('oauth-revoke','<label>Connection ID <input name=\"id\" required></label>','Revoke OAuth connection')}</section>\n  <section><h2>Revoke credential</h2>${form('revoke','<label>Credential ID <input name=\"id\" required></label>','Revoke')}<p>Revocation blocks subsequent requests; it does not cancel an already executing tool.</p></section>\n  <p>Get the separate owner management token locally: <code>starmux dashboard --token</code>. Do not give this token to AI clients.</p><script>${loginScript}</script></html>`;\n}\nexport async function accessPost(req:IncomingMessage,access:AccessControl){\n  if(req.headers.origin!=='http://'+req.headers.host||(req.headers['content-type']||'').split(';')[0]!=='application/x-www-form-urlencoded')return {status:403};\n  const size=Number(req.headers['content-length']);if(!Number.isSafeInteger(size)||size<1||size>4096)return {status:413};\n  let body='';for await(const chunk of req){body+=String(chunk);if(Buffer.byteLength(body)>4096)return {status:413};}\n  const q=new URLSearchParams(body);\n  for(const key of q.keys())if(!['op','token','name','expiresAt','mode','id','issuer','resource','clientId','subjects','tokenAuth'].includes(key)||q.getAll(key).length!==1)return {status:400};\n  if(!await access.authorized(q.get('token')))return {status:403};\n  try{\n    let created:{key:string}|undefined;\n    if(q.get('op')==='create')created=await access.create(q.get('name')||'',q.get('expiresAt')||null);\n    else if(q.get('op')==='revoke')await access.revoke(q.get('id')||'');\n    else if(q.get('op')==='mode'&&(q.get('mode')==='ingress'||q.get('mode')==='api-key'||q.get('mode')==='oauth'))await access.setMode(q.get('mode') as 'ingress'|'api-key'|'oauth');\n    else if(q.get('op')==='oauth-revoke')await access.revokeOAuth(q.get('id')||'');\n    else if(q.get('op')==='oauth-configure'){\n      const method=q.get('tokenAuth')||'none';\n      if(!['none','client_secret_basic','client_secret_post'].includes(method))return {status:400};\n      await access.configureOAuth(await discoverOAuth({issuer:q.get('issuer')||'',resource:q.get('resource')||'',\n        clientId:q.get('clientId')||'',allowedSubjects:(q.get('subjects')||'').split(',').map(s=>s.trim()).filter(Boolean),\n        tokenEndpointAuthMethod:method as 'none'|'client_secret_basic'|'client_secret_post'}));\n    }\n    else return {status:400};\n    return {status:200,html:accessPage(await access.snapshot(),created)};\n  }catch{return {status:400};}\n}\n"]}
+{"version":3,"file":"access-dashboard.js","sourceRoot":"","sources":["../../src/access-dashboard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,aAAa,EAAC,WAAW,EAAC,MAAM,qBAAqB,CAAC;AAG9D,OAAO,EAAC,iBAAiB,EAAC,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,MAAM,WAAW,GAAC,8UAA8U,CAAC;AACjW,MAAM,UAAU,GAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC3E,MAAM,CAAC,MAAM,aAAa,GAAC,MAAM,CAAC,MAAM,CAAC,EAAC,GAAG,iBAAiB,EAAC,yBAAyB,EAAC,iBAAiB,CAAC,yBAAyB,CAAC,GAAC,wBAAwB,UAAU,GAAG,EAAC,CAAC,CAAC;AAC9K,MAAM,CAAC,GAAC,CAAC,CAAS,EAAC,EAAE,CAAA,MAAM,CAAC,CAAC,IAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAC,CAAC,CAAA,EAAE,CAAA,CAAC,EAAC,GAAG,EAAC,OAAO,EAAC,GAAG,EAAC,MAAM,EAAC,GAAG,EAAC,MAAM,EAAC,GAAG,EAAC,QAAQ,EAAC,GAAG,EAAC,OAAO,EAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;AAC7H,MAAM,UAAU,UAAU,CAAC,KAAoD,EAAC,OAAqB;IACnG,MAAM,IAAI,GAAC,CAAC,EAAS,EAAC,MAAa,EAAC,KAAY,EAAC,EAAE,CAAA,8EAA8E,EAAE,KAAK,MAAM,iHAAiH,KAAK,kBAAkB,CAAC;IACvR,OAAO;;iBAEQ,KAAK,CAAC,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,iCAAiC,CAAA,CAAC,CAAA,KAAK,CAAC,IAAI,KAAG,OAAO,CAAA,CAAC,CAAA,OAAO,CAAA,CAAC,CAAA,gBAAgB,uHAAuH,KAAK,CAAC,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,6FAA6F,CAAA,CAAC,CAAA,iHAAiH;;;;uCAI7a,KAAK,CAAC,IAAI,KAAG,OAAO,IAAE,KAAK,CAAC,KAAK,CAAA,CAAC,CAAA,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,2CAA2C;yCACnG,KAAK,CAAC,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,mCAAmC,CAAA,CAAC,CAAA,KAAK,CAAC,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,qEAAqE,CAAA,CAAC,CAAA,sBAAsB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,IAAE,EAAE,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,IAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,IAAE,EAAE,CAAC,EAAE;;IAE7U,OAAO,CAAA,CAAC,CAAA,4CAA4C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,kIAAkI,CAAA,CAAC,CAAA,EAAE;wIACnE,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,IAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,IAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,IAAE,WAAW,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAE,8CAA8C;uCAC3X,IAAI,CAAC,QAAQ,EAAC,+KAA+K,EAAC,QAAQ,CAAC;yCACrM,IAAI,CAAC,MAAM,EAAC,kOAAkO,EAAC,YAAY,CAAC;;IAEjS,KAAK,CAAC,KAAK,CAAA,CAAC,CAAA,oBAAoB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,+BAA+B,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAA,CAAC,CAAA,uBAAuB;IACxT,IAAI,CAAC,iBAAiB,EAAC,4jBAA4jB,EAAC,mBAAmB,CAAC;;;oFAGxhB,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,SAAS,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,QAAQ,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,IAAE,oDAAoD;IAClT,IAAI,CAAC,cAAc,EAAC,yDAAyD,EAAC,yBAAyB,CAAC;uCACrE,IAAI,CAAC,QAAQ,EAAC,yDAAyD,EAAC,QAAQ,CAAC;iJACyB,WAAW,kBAAkB,CAAC;AAC/K,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAmB,EAAC,MAAoB;IACvE,IAAG,GAAG,CAAC,OAAO,CAAC,MAAM,KAAG,SAAS,GAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAE,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAG,mCAAmC;QAAC,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;IAC9J,MAAM,IAAI,GAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAAA,IAAG,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAE,IAAI,GAAC,CAAC,IAAE,IAAI,GAAC,IAAI;QAAC,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;IACvH,IAAI,IAAI,GAAC,EAAE,CAAC;IAAA,IAAI,KAAK,EAAC,MAAM,KAAK,IAAI,GAAG,EAAC,CAAC;QAAA,IAAI,IAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAAA,IAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAC,IAAI;YAAC,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;IAAA,CAAC;IACnH,MAAM,CAAC,GAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,KAAI,MAAM,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE;QAAC,IAAG,CAAC,CAAC,IAAI,EAAC,OAAO,EAAC,MAAM,EAAC,WAAW,EAAC,MAAM,EAAC,IAAI,EAAC,QAAQ,EAAC,UAAU,EAAC,UAAU,EAAC,UAAU,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,KAAG,CAAC;YAAC,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;IAC9L,IAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;IAChE,IAAG,CAAC;QACF,IAAI,OAA8B,CAAC;QACnC,IAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAG,QAAQ;YAAC,OAAO,GAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAE,EAAE,EAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAE,IAAI,CAAC,CAAC;aAC7F,IAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAG,QAAQ;YAAC,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAE,EAAE,CAAC,CAAC;aAC/D,IAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAG,MAAM,IAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAG,SAAS,IAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAG,SAAS,IAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAG,OAAO,CAAC;YAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAgC,CAAC,CAAC;aAC5K,IAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAG,cAAc;YAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAE,EAAE,CAAC,CAAC;aAC1E,IAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAG,iBAAiB,EAAC,CAAC;YACvC,MAAM,MAAM,GAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAE,MAAM,CAAC;YACxC,IAAG,CAAC,CAAC,MAAM,EAAC,qBAAqB,EAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAC,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;YAC7F,MAAM,MAAM,CAAC,cAAc,CAAC,MAAM,aAAa,CAAC,EAAC,MAAM,EAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,EAAE,EAAC,QAAQ,EAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAE,EAAE;gBACxG,QAAQ,EAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAE,EAAE,EAAC,eAAe,EAAC,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;gBAClH,uBAAuB,EAAC,MAA2D,EAAC,CAAC,CAAC,CAAC;QAC3F,CAAC;;YACI,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;QACzB,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,IAAI,EAAC,UAAU,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAC,OAAO,CAAC,EAAC,CAAC;IACvE,CAAC;IAAA,MAAK,CAAC;QAAA,OAAO,EAAC,MAAM,EAAC,GAAG,EAAC,CAAC;IAAA,CAAC;AAC9B,CAAC","sourcesContent":["import {discoverOAuth,metadataUrl} from './oauth-resource.js';\nimport type {IncomingMessage} from 'node:http';\nimport type {AccessControl} from './access-control.js';\nimport {permissionHeaders} from './permissions-dashboard.js';\nimport {createHash} from 'node:crypto';\nconst loginScript=`(()=>{const k='starmux-owner-token';const q=new URLSearchParams(location.hash.slice(1));const t=q.get('token');if(t){history.replaceState(null,'',location.pathname);sessionStorage.setItem(k,t);}const token=sessionStorage.getItem(k);if(token)for(const input of document.querySelectorAll('input[name=\"token\"]'))input.value=token;})();`;\nconst scriptHash=createHash('sha256').update(loginScript).digest('base64');\nexport const accessHeaders=Object.freeze({...permissionHeaders,'content-security-policy':permissionHeaders['content-security-policy']+`; script-src 'sha256-${scriptHash}'`});\nconst e=(s:unknown)=>String(s??'').replace(/[&<>\"']/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','\"':'&quot;',\"'\":'&#39;'}[c]!));\nexport function accessPage(state:Awaited<ReturnType<AccessControl['snapshot']>>,created?:{key:string}){\n  const form=(op:string,fields:string,label:string)=>`<form method=\"post\" action=\"/access\"><input type=\"hidden\" name=\"op\" value=\"${op}\">${fields}<label>Owner management token <input type=\"password\" name=\"token\" required autocomplete=\"off\"></label><button>${label}</button></form>`;\n  return `<!doctype html><html lang=\"en\"><meta charset=\"utf-8\"><meta name=\"viewport\" content=\"width=device-width\"><title>Starmux · Access Control</title><style>body{font:16px system-ui;max-width:960px;margin:40px auto;padding:0 24px;background:#f5f7fa;color:#243249}section{background:white;border:1px solid #dae0e8;border-radius:12px;padding:24px;margin:20px 0}input,select,button{font:inherit;padding:8px;margin:8px}label{display:block}code{overflow-wrap:anywhere}td,th{text-align:left;padding:10px;border-bottom:1px solid #ddd}table{width:100%}</style><h1>Starmux · Access Control</h1>\n  <p><a href=\"/dashboard\">Dashboard</a> · <a href=\"/permissions\">Workspace permissions</a></p>\n  <section><h2>${state.mode==='ingress'?'None (local or ingress-managed)':state.mode==='oauth'?'OAuth':'Bearer API Key'}</h2><p>Permission: Owner default. Credentials do not change workspace, tool or operating-system permissions.</p><p>${state.mode==='ingress'?'Starmux does not verify a token. Restrict remote access through your HTTPS proxy or tunnel.':'Every MCP request requires an active credential. Missing, invalid, expired or revoked credentials are rejected.'}</p>\n  <table><tr><th>MCP Client Field</th><th>Value to Copy</th></tr>\n  <tr><td>Transport</td><td><code>Streamable HTTP</code></td></tr>\n  <tr><td>URL (Local)</td><td><code>http://127.0.0.1:&lt;PORT&gt;/mcp</code></td></tr>\n  <tr><td>URL (Remote)</td><td><code>${state.mode==='oauth'&&state.oauth?e(state.oauth.resource):'https://&lt;your-domain-or-tunnel&gt;/mcp'}</code></td></tr>\n  <tr><td>Authentication</td><td><code>${state.mode==='ingress'?'None (or optional Bearer API key)':state.mode==='api-key'?'Bearer API key — Header: Authorization: Bearer &lt;YOUR_API_KEY&gt;':`OAuth — Client ID: ${e(state.oauth?.clientId??'')} · Scope: ${e(state.oauth?.scope??'gateway:access')} · Issuer: ${e(state.oauth?.issuer??'')}`}</code></td></tr>\n  </table></section>\n  ${created?`<section><h2>Copy this key now</h2><code>${e(created.key)}</code><p>This key is shown only in this response. Keep it private; it grants the owner-approved MCP capabilities.</p></section>`:''}\n  <section><h2>Client credentials</h2><table><tr><th>Name / ID</th><th>Status / Revoked</th><th>Created / Last used / Expiry</th></tr>${state.credentials.map(c=>`<tr><td>${e(c.name)}<br><code>${e(c.id)}</code></td><td>${e(c.status)}<br>${e(c.revokedAt||'—')}</td><td>${e(c.createdAt)}<br>${e(c.lastUsedAt||'Never')}<br>${e(c.expiresAt||'No expiry')}</td></tr>`).join('')||'<tr><td colspan=\"3\">No credentials</td></tr>'}</table></section>\n  <section><h2>Create credential</h2>${form('create','<label>Name <input name=\"name\" maxlength=\"80\" required></label><label>Expiry (optional, UTC ISO 8601) <input name=\"expiresAt\" placeholder=\"2027-01-01T00:00:00.000Z\"></label>','Create')}</section>\n  <section><h2>Authentication mode</h2>${form('mode','<select name=\"mode\"><option value=\"api-key\">Require Gateway API key</option><option value=\"oauth\">Require OAuth (configure first)</option><option value=\"ingress\">Managed by ingress (no Gateway key required)</option></select>','Apply mode')}<p>Switching to ingress mode permits requests without a Gateway key. Existing owner permissions still apply.</p></section>\n  <section><h2>OAuth configuration</h2><p>Use an existing authorization server. Configuration does not enable OAuth until you change the mode above.</p>\n  ${state.oauth?`<p>Issuer: <code>${e(state.oauth.issuer)}</code><br>Resource: <code>${e(state.oauth.resource)}</code><br>Discovery: <code>${e(metadataUrl(state.oauth))}</code><br>Client: ${e(state.oauth.clientId)} · ${e(state.oauth.clientRegistration)}<br>Scope: ${e(state.oauth.scope)}</p>`:'<p>Not configured</p>'}\n  ${form('oauth-configure','<label>Issuer URL <input name=\"issuer\" type=\"url\" required></label><label>Public MCP resource URL <input name=\"resource\" type=\"url\" required></label><label>Registered client ID <input name=\"clientId\" required></label><label>Allowed owner subject IDs (comma separated) <input name=\"subjects\" required></label><label>Token endpoint authentication <select name=\"tokenAuth\"><option value=\"none\">none (public client + PKCE)</option><option value=\"client_secret_basic\">client_secret_basic</option><option value=\"client_secret_post\">client_secret_post</option></select></label>','Discover and save')}\n  <p>This form uses a predefined client and HTTPS. Client secrets stay with the authorization server and ChatGPT; do not enter them here. Advanced registration and local development are available through the CLI.</p></section>\n  <section><h2>OAuth connections</h2><p>Revocation blocks the session, including tokens refreshed from it. A new owner-approved login may establish a new session.</p>\n  <table><tr><th>Connection ID / Client</th><th>Status</th><th>Last used</th></tr>${state.oauthConnections.map(c=>`<tr><td><code>${e(c.id)}</code><br>${e(c.clientId)}</td><td>${c.revokedAt?'Revoked':'Active'}</td><td>${e(c.lastUsedAt)}</td></tr>`).join('')||'<tr><td colspan=\"3\">No OAuth connections</td></tr>'}</table>\n  ${form('oauth-revoke','<label>Connection ID <input name=\"id\" required></label>','Revoke OAuth connection')}</section>\n  <section><h2>Revoke credential</h2>${form('revoke','<label>Credential ID <input name=\"id\" required></label>','Revoke')}<p>Revocation blocks subsequent requests; it does not cancel an already executing tool.</p></section>\n  <p>Get the separate owner management token locally: <code>starmux dashboard --token</code>. Do not give this token to AI clients.</p><script>${loginScript}</script></html>`;\n}\nexport async function accessPost(req:IncomingMessage,access:AccessControl){\n  if(req.headers.origin!=='http://'+req.headers.host||(req.headers['content-type']||'').split(';')[0]!=='application/x-www-form-urlencoded')return {status:403};\n  const size=Number(req.headers['content-length']);if(!Number.isSafeInteger(size)||size<1||size>4096)return {status:413};\n  let body='';for await(const chunk of req){body+=String(chunk);if(Buffer.byteLength(body)>4096)return {status:413};}\n  const q=new URLSearchParams(body);\n  for(const key of q.keys())if(!['op','token','name','expiresAt','mode','id','issuer','resource','clientId','subjects','tokenAuth'].includes(key)||q.getAll(key).length!==1)return {status:400};\n  if(!await access.authorized(q.get('token')))return {status:403};\n  try{\n    let created:{key:string}|undefined;\n    if(q.get('op')==='create')created=await access.create(q.get('name')||'',q.get('expiresAt')||null);\n    else if(q.get('op')==='revoke')await access.revoke(q.get('id')||'');\n    else if(q.get('op')==='mode'&&(q.get('mode')==='ingress'||q.get('mode')==='api-key'||q.get('mode')==='oauth'))await access.setMode(q.get('mode') as 'ingress'|'api-key'|'oauth');\n    else if(q.get('op')==='oauth-revoke')await access.revokeOAuth(q.get('id')||'');\n    else if(q.get('op')==='oauth-configure'){\n      const method=q.get('tokenAuth')||'none';\n      if(!['none','client_secret_basic','client_secret_post'].includes(method))return {status:400};\n      await access.configureOAuth(await discoverOAuth({issuer:q.get('issuer')||'',resource:q.get('resource')||'',\n        clientId:q.get('clientId')||'',allowedSubjects:(q.get('subjects')||'').split(',').map(s=>s.trim()).filter(Boolean),\n        tokenEndpointAuthMethod:method as 'none'|'client_secret_basic'|'client_secret_post'}));\n    }\n    else return {status:400};\n    return {status:200,html:accessPage(await access.snapshot(),created)};\n  }catch{return {status:400};}\n}\n"]}

package/dist/src/cli/instances.js

@@ -120,21 +120,42 @@ export async function handle(command, args) {
         const op = positional[0] ?? 'list';
         if (op === 'list') {
             const registry = await readRegistry();
-            const instances = await Promise.all(registry.instances.filter(i => flags.has('--archived') || !i.archived).map(i => instanceStatus(i)));
+            const filtered = registry.instances.filter(i => flags.has('--archived') || !i.archived);
+            const instances = await Promise.all(filtered.map(i => instanceStatus(i)));
             if (json)
                 output({ schemaVersion: 1, defaultInstanceId: registry.defaultInstanceId, instances });
             else {
-                for (const i of instances)
-                    process.stdout.write(`${i.instanceId === registry.defaultInstanceId ? '*' : ' '} ${i.name}\t${i.phase}\t${i.configState}\t${i.port ?? '—'}\t${i.source.path}\n`);
-                if (!instances.length)
-                    process.stdout.write('No instances. Run: mac-mcp-gateway instance create default\n');
+                if (!instances.length) {
+                    process.stdout.write(registry.instances.length
+                        ? 'No active instances. Run: starmux ls --archived\nRestore an instance with: starmux config restore -i NAME\n'
+                        : 'No instances. Run: starmux up\n');
+                    return;
+                }
+                const rows = await Promise.all(instances.map(async (s, idx) => {
+                    const raw = filtered[idx];
+                    const cfg = s.active?.config ?? (await loadInstanceConfig(raw).catch(() => null))?.config;
+                    const mark = s.instanceId === registry.defaultInstanceId ? '*' : ' ';
+                    const state = s.archived ? 'archived' : s.configState === 'pending' ? `${s.phase} (pending)` : s.phase;
+                    const mode = cfg?.accessRole === 'trusted' ? 'coding' : (s.workspaceMode ?? 'read-only');
+                    const port = String(s.port ?? '—');
+                    const workspace = cfg?.projectRoot ?? s.source.path;
+                    return { mark, name: s.name, state, mode, port, workspace };
+                }));
+                const wName = Math.max(4, ...rows.map(r => r.name.length));
+                const wState = Math.max(6, ...rows.map(r => r.state.length));
+                const wMode = Math.max(4, ...rows.map(r => r.mode.length));
+                const wPort = Math.max(4, ...rows.map(r => r.port.length));
+                process.stdout.write(`  ${'NAME'.padEnd(wName)}  ${'STATUS'.padEnd(wState)}  ${'MODE'.padEnd(wMode)}  ${'PORT'.padEnd(wPort)}  WORKSPACE\n`);
+                for (const r of rows) {
+                    process.stdout.write(`${r.mark} ${r.name.padEnd(wName)}  ${r.state.padEnd(wState)}  ${r.mode.padEnd(wMode)}  ${r.port.padEnd(wPort)}  ${r.workspace}\n`);
+                }
             }
             return;
         }
         if (op === 'create') {
             const config = await wizard(flags);
             const instance = await createInstance(positional[1] ?? flags.get('--name') ?? 'default', { config });
-            output({ instance, message: 'Saved. Start with: mac-mcp-gateway run --instance ' + JSON.stringify(instance.name) });
+            output({ instance, message: 'Saved. Start with: starmux up -i ' + JSON.stringify(instance.name) });
             return;
         }
         if (op === 'import') {
@@ -157,7 +178,11 @@ export async function handle(command, args) {
             const config = { ...(await loadInstanceConfig(instance)).config, port: await suggestPort() };
             const access = await createAccessControl(instancePaths(instance).access);
             const mode = (await access.snapshot()).mode;
-            output({ instance: await createInstance(positional[2] ?? flags.get('--name') ?? instance.name + ' copy', { config, requiredAccess: instance.requiredAccess !== 'ingress' ? instance.requiredAccess : mode }), message: 'Copied settings only. Credentials and sessions were not copied.' });
+            const created = await createInstance(positional[2] ?? flags.get('--name') ?? instance.name + ' copy', { config, requiredAccess: instance.requiredAccess !== 'ingress' ? instance.requiredAccess : mode });
+            if (json)
+                output({ instance: created, message: 'Copied settings only. Credentials and sessions were not copied.' });
+            else
+                process.stdout.write(`Copied '${instance.name}' to '${created.name}' (port ${config.port}). Credentials and sessions were not copied.\n`);
             return;
         }
         await changeRegistry(async (registry) => {
@@ -185,7 +210,16 @@ export async function handle(command, args) {
             else
                 throw Error('INSTANCE_ACTION_INVALID');
         });
-        output({ result: 'OK', instanceId: instance.id });
+        if (json)
+            output({ result: 'OK', instanceId: instance.id });
+        else if (op === 'rename')
+            process.stdout.write(`Renamed '${instance.name}' to '${positional[2]}'.\n`);
+        else if (op === 'default')
+            process.stdout.write(`Default instance set to '${instance.name}'.\n`);
+        else if (op === 'archive' || op === 'remove')
+            process.stdout.write(`Archived instance '${instance.name}'.\n`);
+        else if (op === 'restore')
+            process.stdout.write(`Restored instance '${instance.name}'.\n`);
         return;
     }
     if (command === 'status' && !flags.has('--instance') && (!json || flags.has('--all')))
@@ -243,8 +277,20 @@ export async function handle(command, args) {
             return;
         }
         if (op === 'show') {
-            if (flags.has('--effective'))
-                output((await instanceStatus(instance)).active);
+            if (flags.has('--effective')) {
+                const active = (await instanceStatus(instance)).active;
+                if (json)
+                    output(active);
+                else if (!active)
+                    process.stdout.write(`Instance ${instance.name} has no active running configuration.\n`);
+                else
+                    process.stdout.write(`Instance       ${instance.name} (effective running config)\n` +
+                        `Workspace      ${active.config.projectRoot}\n` +
+                        `Port           ${active.config.port}\n` +
+                        `Mode           ${active.config.accessRole === 'trusted' ? 'Coding (read-write, shell & git)' : active.config.mode}\n` +
+                        `Git workflow   ${active.config.gitMode}\n` +
+                        `Extra MCPs     ${active.config.upstreams.length}\n`);
+            }
             else {
                 const text = await readTrusted(instance.source.path, instance.source.kind === 'managed');
                 let config = null;
@@ -255,7 +301,21 @@ export async function handle(command, args) {
                 catch (e) {
                     problem = message(e);
                 }
-                output({ instanceId: instance.id, text, config, problem, revision: sourceRevision(instance.source.path, text), source: instance.source });
+                if (json)
+                    output({ instanceId: instance.id, text, config, problem, revision: sourceRevision(instance.source.path, text), source: instance.source });
+                else if (problem || !config)
+                    process.stdout.write(`Instance       ${instance.name}\nConfig file    ${instance.source.path}\nProblem        ${problem ?? 'Invalid configuration'}\n`);
+                else
+                    process.stdout.write(`Instance       ${instance.name}\n` +
+                        `Config file    ${instance.source.path} (${instance.source.kind})\n` +
+                        `Workspace      ${config.projectRoot}\n` +
+                        `Port           ${config.port}\n` +
+                        `Mode           ${config.accessRole === 'trusted' ? 'Coding (read-write, shell & git)' : config.mode}\n` +
+                        `Git workflow   ${config.gitMode}\n` +
+                        `Extra MCPs     ${config.upstreams.length}\n\n` +
+                        `Commands\n` +
+                        `  Edit config  starmux config edit${instance.name === 'default' ? '' : ` -i ${instance.name}`}\n` +
+                        `  Apply        starmux config apply${instance.name === 'default' ? '' : ` -i ${instance.name}`}\n`);
             }
             return;
         }
@@ -326,18 +386,31 @@ export async function handle(command, args) {
         }
         const loaded = await loadInstanceConfig(instance);
         if (op === 'validate') {
-            output({ result: 'VALID', revision: loaded.revision, source: instance.source });
+            if (json)
+                output({ result: 'VALID', revision: loaded.revision, source: instance.source });
+            else
+                process.stdout.write(`✓ Configuration is valid (${instance.source.path})\n`);
             return;
         }
         if (op === 'diff') {
             const active = (await instanceStatus(instance)).active?.config ?? null;
             const changes = Object.entries(loaded.config).filter(([key, value]) => JSON.stringify(value) !== JSON.stringify(active?.[key])).map(([field, value]) => ({ field, before: active?.[field] ?? null, after: value }));
-            output({ instanceId: instance.id, revision: loaded.revision, changes });
+            if (json)
+                output({ instanceId: instance.id, revision: loaded.revision, changes });
+            else if (!changes.length)
+                process.stdout.write('No pending configuration changes.\n');
+            else {
+                for (const c of changes)
+                    process.stdout.write(`${c.field}: ${JSON.stringify(c.before)} -> ${JSON.stringify(c.after)}\n`);
+            }
             return;
         }
         if (op === 'apply') {
             const state = await instanceRequest(instance, 'apply', flags.get('--revision') ?? loaded.revision);
-            output({ result: state ? 'APPLIED' : 'VALID_ON_NEXT_START', instanceId: instance.id, runtime: state });
+            if (json)
+                output({ result: state ? 'APPLIED' : 'VALID_ON_NEXT_START', instanceId: instance.id, runtime: state });
+            else
+                process.stdout.write(state ? `Applied configuration to '${instance.name}'.\n` : `Configuration validated; will take effect on next 'starmux up'.\n`);
             return;
         }
         if (op === 'export') {

package/dist/src/cli/instances.js.map

@@ -1 +1 @@
-{"version":3,"file":"instances.js","sourceRoot":"","sources":["../../../src/cli/instances.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,eAAe,EAAC,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAC,KAAK,EAAC,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAC,QAAQ,EAAC,SAAS,EAAC,OAAO,EAAC,EAAE,EAAC,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAC,MAAM,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,mBAAmB,EAAC,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAC,qBAAqB,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAC,eAAe,EAAC,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAC,sBAAsB,EAAC,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAC,cAAc,EAAC,eAAe,EAAC,WAAW,EAAC,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAC,aAAa,EAAC,cAAc,EAAC,gBAAgB,EAAC,cAAc,EAAC,cAAc,EAAC,cAAc,EAAC,MAAM,EAAC,WAAW,EAAC,oBAAoB,EAAC,WAAW,EAAC,aAAa,EAAC,aAAa,EAAC,kBAAkB,EAAC,WAAW,EAAC,mBAAmB,EAAC,YAAY,EAAC,WAAW,EAAC,eAAe,EAAC,kBAAkB,EAAC,WAAW,EAAC,cAAc,EAAC,QAAQ,EAAmC,MAAM,sBAAsB,CAAC;AAErY,MAAM,QAAQ,GAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,EAAC,YAAY,EAAC,6BAA6B,EAAC,wBAAwB,EAAC,WAAW,EAAC,aAAa,EAAC,uBAAuB,CAAC,CAAC,CAAC;AAC1K,SAAS,OAAO,CAAC,IAAa;IAC5B,MAAM,KAAK,GAAC,IAAI,GAAG,EAAiB,CAAC;IAAA,MAAM,UAAU,GAAU,EAAE,CAAC;IAClE,KAAI,IAAI,CAAC,GAAC,CAAC,EAAC,CAAC,GAAC,IAAI,CAAC,MAAM,EAAC,CAAC,EAAE,EAAC,CAAC;QAAA,MAAM,GAAG,GAAC,IAAI,CAAC,CAAC,CAAE,CAAC;QAAA,IAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAC,CAAC;YAAA,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAA,SAAS;QAAA,CAAC;QACzG,IAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAC,MAAM,KAAK,CAAC,oBAAoB,GAAC,GAAG,CAAC,CAAC;QACxD,IAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAC,MAAM,CAAC,CAAC;aAAK,CAAC;YAAA,IAAG,CAAC,IAAI,CAAC,CAAC,GAAC,CAAC,CAAC,IAAE,IAAI,CAAC,CAAC,GAAC,CAAC,CAAE,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,wBAAwB,GAAC,GAAG,CAAC,CAAC;YAAA,KAAK,CAAC,GAAG,CAAC,GAAG,EAAC,IAAI,CAAC,EAAE,CAAC,CAAE,CAAC,CAAC;QAAA,CAAC;IACnK,CAAC;IACD,OAAO,EAAC,KAAK,EAAC,UAAU,EAAC,CAAC;AAC5B,CAAC;AACD,MAAM,OAAO,GAAC,CAAC,KAAa,EAAC,EAAE,CAAA,KAAK,YAAY,KAAK,CAAA,CAAC,CAAA,KAAK,CAAC,OAAO,CAAA,CAAC,CAAA,eAAe,CAAC;AACpF,KAAK,UAAU,SAAS,KAAG,IAAI,IAAI,GAAC,EAAE,CAAC,CAAA,IAAI,KAAK,EAAC,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAC,CAAC;IAAA,IAAI,IAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAAA,IAAG,IAAI,CAAC,MAAM,GAAC,MAAM;QAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;AAAA,CAAC,CAAA,OAAO,IAAI,CAAC,CAAA,CAAC;AACvK,SAAS,MAAM,CAAC,KAAa,IAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC,GAAC,IAAI,CAAC,CAAC,CAAA,CAAC;AACxF,SAAS,gBAAgB,CAAC,MAAqB,EAAC,KAAwB;IACtE,IAAG,MAAM,CAAC,UAAU,KAAG,SAAS,IAAE,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC;QAAC,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACtJ,IAAG,MAAM,CAAC,UAAU,KAAG,SAAS,IAAE,OAAO,CAAC,QAAQ,KAAG,QAAQ,IAAE,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAAC,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;AAChL,CAAC;AACD,KAAK,UAAU,MAAM,CAAC,KAAwB,EAAC,OAAuB;IACpE,IAAI,OAAO,GAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAE,OAAO,EAAE,WAAW,CAAC;IAAA,IAAI,IAAI,GAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAE,OAAO,EAAE,UAAU,IAAE,YAAY,CAAC;IAChI,IAAI,IAAI,GAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,OAAO,EAAE,IAAI,IAAE,MAAM,WAAW,EAAE,CAAC,CAAC;IACzE,IAAG,CAAC,OAAO,EAAC,CAAC;QACX,IAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;YAAC,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC3F,MAAM,EAAE,GAAC,eAAe,CAAC,EAAC,KAAK,EAAC,OAAO,CAAC,KAAK,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;QACtE,IAAG,CAAC;YAAA,OAAO,GAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YAAA,IAAI,GAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC,IAAE,YAAY,CAAC;YAC3I,IAAG,IAAI,KAAG,SAAS,IAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC,CAAC,KAAG,KAAK,EAAC,CAAC;gBAChH,KAAK,CAAC,GAAG,CAAC,6BAA6B,EAAC,MAAM,CAAC,CAAC;gBAAA,IAAG,OAAO,CAAC,QAAQ,KAAG,QAAQ;oBAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAAC,MAAM,CAAC,CAAC;YAC5H,CAAC;YACD,IAAI,GAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC,IAAE,IAAI,CAAC,CAAC;QACnE,CAAC;gBAAO,CAAC;YAAA,EAAE,CAAC,KAAK,EAAE,CAAC;QAAA,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAC,oBAAoB,CAAC,KAAK,CAAC,EAAC,GAAG,OAAO,EAAC,aAAa,EAAC,CAAC,EAAC,WAAW,EAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAC,IAAI;QACxH,UAAU,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAE,UAAU,KAAG,IAAI,CAAA,CAAC,CAAA,OAAO,CAAC,IAAI,CAAA,CAAC,CAAA,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,YAAY,CAAA,CAAC,CAAA,WAAW,EAAC,UAAU,EAAC,OAAO,EAAE,UAAU,KAAG,IAAI,CAAA,CAAC,CAAA,OAAO,CAAC,UAAU,CAAA,CAAC,CAAA,IAAI,KAAG,SAAS,IAAE,OAAO,CAAC,QAAQ,KAAG,QAAQ,CAAA,CAAC,CAAA,WAAW,CAAA,CAAC,CAAA,cAAc,EAAC,UAAU,EAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAE,OAAO,EAAE,UAAU,IAAE,OAAO,EAAC,CAAC,CAAC;IAChT,gBAAgB,CAAC,MAAM,EAAC,KAAK,CAAC,CAAC;IAAA,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAa;IACtD,IAAI,OAAO,GAAC,IAAI,CAAC,CAAC,CAAC,IAAE,MAAM,CAAC;IAC5B,IAAG,OAAO,KAAG,aAAa,IAAE,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,EAAC,CAAC;QAAA,OAAO,GAAC,KAAK,CAAC;QAAA,IAAI,GAAC,CAAC,KAAK,EAAC,WAAW,EAAC,OAAO,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAAA,CAAC;IAC5I,IAAG,OAAO,KAAG,cAAc,EAAC,CAAC;QAAA,OAAO,GAAC,QAAQ,CAAC;QAAA,IAAI,GAAC,CAAC,QAAQ,EAAC,WAAW,EAAC,OAAO,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAAA,CAAC;IACpG,MAAM,SAAS,GAAC,CAAC,UAAU,EAAC,QAAQ,EAAC,KAAK,EAAC,QAAQ,EAAC,MAAM,EAAC,SAAS,EAAC,MAAM,EAAC,QAAQ,EAAC,QAAQ,EAAC,QAAQ,EAAC,aAAa,EAAC,SAAS,EAAC,OAAO,CAAC,CAAC;IACxI,IAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAC,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC;QACL,MAAM,QAAQ,GAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAAA,MAAM,QAAQ,GAAC,MAAM,YAAY,EAAE,CAAC;QAC/E,MAAM,OAAO,GAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAC,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAC,OAAO,KAAG,OAAO,IAAE,IAAI,CAAC,MAAM,KAAG,CAAC,IAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC1E,IAAG,CAAC,CAAC,UAAU,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAE,CAAC,QAAQ,IAAE,CAAC,OAAO,IAAE,CAAC,WAAW;YAAC,OAAO,KAAK,CAAC;QAC5F,2EAA2E;QAC3E,MAAM,YAAY,GAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAG,YAAY,IAAE,CAAC,IAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,KAAG,IAAI,CAAC,YAAY,GAAC,CAAC,CAAC,CAAC,IAAE,IAAI,CAAC,YAAY,GAAC,CAAC,CAAC,KAAG,MAAM,EAAC,CAAC;YAC/G,IAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,CAAC;gBAAC,MAAM,KAAK,CAAC,wEAAwE,CAAC,CAAC;YAC9H,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAAA,CAAC;IAAA,OAAM,KAAK,EAAC,CAAC;QAChD,IAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAC,MAAM,CAAC,EAAC,aAAa,EAAC,CAAC,EAAC,KAAK,EAAC,OAAO,CAAC,KAAK,CAAC,EAAC,CAAC,CAAC;;YACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAC,IAAI,CAAC,CAAC;QAAA,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAc,EAAC,IAAa;IACvD,MAAM,EAAC,KAAK,EAAC,UAAU,EAAC,GAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAAA,MAAM,IAAI,GAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,KAAK,GAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAC,YAAY,EAAC,QAAQ,EAAC,WAAW,EAAC,QAAQ,EAAC,eAAe,EAAC,cAAc,EAAC,WAAW,EAAC,kBAAkB,EAAC,YAAY,EAAC,SAAS,EAAC,QAAQ,EAAC,UAAU,EAAC,SAAS,EAAC,WAAW,EAAC,UAAU,EAAC,YAAY,EAAC,oBAAoB,EAAC,aAAa,EAAC,YAAY,EAAC,gBAAgB,EAAC,cAAc,EAAC,YAAY,EAAC,UAAU,EAAC,QAAQ,CAAC,CAAC,CAAC;IACtV,KAAI,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;QAAC,IAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,kBAAkB,GAAC,IAAI,CAAC,CAAC;IACxF,IAAG,OAAO,KAAG,UAAU,EAAC,CAAC;QACvB,MAAM,EAAE,GAAC,UAAU,CAAC,CAAC,CAAC,IAAE,MAAM,CAAC;QAC/B,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YACd,MAAM,QAAQ,GAAC,MAAM,YAAY,EAAE,CAAC;YAAA,MAAM,SAAS,GAAC,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpK,IAAG,IAAI;gBAAC,MAAM,CAAC,EAAC,aAAa,EAAC,CAAC,EAAC,iBAAiB,EAAC,QAAQ,CAAC,iBAAiB,EAAC,SAAS,EAAC,CAAC,CAAC;iBACpF,CAAC;gBAAA,KAAI,MAAM,CAAC,IAAI,SAAS;oBAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,UAAU,KAAG,QAAQ,CAAC,iBAAiB,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,IAAI,IAAE,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;gBAAA,IAAG,CAAC,SAAS,CAAC,MAAM;oBAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAAA,CAAC;YAAA,OAAO;QAC5S,CAAC;QACD,IAAG,EAAE,KAAG,QAAQ,EAAC,CAAC;YAChB,MAAM,MAAM,GAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;YAAA,MAAM,QAAQ,GAAC,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,IAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,SAAS,EAAC,EAAC,MAAM,EAAC,CAAC,CAAC;YAC7H,MAAM,CAAC,EAAC,QAAQ,EAAC,OAAO,EAAC,oDAAoD,GAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;YAAA,OAAO;QACvH,CAAC;QACD,IAAG,EAAE,KAAG,QAAQ,EAAC,CAAC;YAChB,MAAM,IAAI,GAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAA,IAAG,CAAC,IAAI;gBAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACtE,MAAM,MAAM,GAAC,MAAM,cAAc,CAAC,WAAW,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAA,gBAAgB,CAAC,MAAM,EAAC,KAAK,CAAC,CAAC;YAC3H,MAAM,CAAC,EAAC,QAAQ,EAAC,MAAM,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAC,CAAC;gBAChI,OAAO,EAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,gDAAgD,CAAA,CAAC,CAAA,+DAA+D,EAAC,CAAC,CAAC;YAAA,OAAO;QAC1J,CAAC;QACD,IAAG,EAAE,KAAG,SAAS,EAAC,CAAC;YACjB,MAAM,EAAC,aAAa,EAAC,GAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAAA,MAAM,CAAC,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,EAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAA,OAAO;QAC9J,CAAC;QACD,MAAM,QAAQ,GAAC,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,IAAE,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAC,OAAO,EAAE,EAAC,EAAE,KAAG,SAAS,CAAC,CAAC;QACtG,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YACd,MAAM,MAAM,GAAC,EAAC,GAAG,CAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAC,IAAI,EAAC,MAAM,WAAW,EAAE,EAAC,CAAC;YACvF,MAAM,MAAM,GAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;YAAA,MAAM,IAAI,GAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;YACjH,MAAM,CAAC,EAAC,QAAQ,EAAC,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,IAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,QAAQ,CAAC,IAAI,GAAC,OAAO,EAAC,EAAC,MAAM,EAAC,cAAc,EAAC,QAAQ,CAAC,cAAc,KAAG,SAAS,CAAA,CAAC,CAAA,QAAQ,CAAC,cAAc,CAAA,CAAC,CAAA,IAAI,EAAC,CAAC,EAAC,OAAO,EAAC,iEAAiE,EAAC,CAAC,CAAC;YAAA,OAAO;QAC/Q,CAAC;QACD,MAAM,cAAc,CAAC,KAAK,EAAC,QAAQ,EAAA,EAAE;YACnC,MAAM,IAAI,GAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,CAAC,EAAE,CAAE,CAAC;YAC3D,IAAG,EAAE,KAAG,QAAQ,EAAC,CAAC;gBAChB,MAAM,IAAI,GAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAAA,IAAG,CAAC,IAAI;oBAAC,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC;gBAAA,IAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,KAAG,IAAI,CAAC;oBAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAAA,IAAI,CAAC,IAAI,GAAC,IAAI,CAAC;YACjK,CAAC;iBAAK,IAAG,EAAE,KAAG,SAAS;gBAAC,QAAQ,CAAC,iBAAiB,GAAC,IAAI,CAAC,EAAE,CAAC;iBACtD,IAAG,EAAE,KAAG,SAAS,IAAE,EAAE,KAAG,QAAQ,EAAC,CAAC;gBAAA,MAAM,OAAO,GAAC,MAAM,eAAe,CAAC,QAAQ,EAAC,MAAM,CAAC,CAAC;gBAAA,IAAG,OAAO,IAAE,OAAO,CAAC,KAAK,KAAG,SAAS;oBAAC,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;gBAAA,IAAI,CAAC,QAAQ,GAAC,IAAI,CAAC;gBAAA,IAAG,QAAQ,CAAC,iBAAiB,KAAG,IAAI,CAAC,EAAE;oBAAC,QAAQ,CAAC,iBAAiB,GAAC,IAAI,CAAC;YAAA,CAAC;iBAC/P,IAAG,EAAE,KAAG,SAAS;gBAAC,IAAI,CAAC,QAAQ,GAAC,KAAK,CAAC;;gBACtC,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAAA,MAAM,CAAC,EAAC,MAAM,EAAC,IAAI,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,CAAC,CAAC;QAAA,OAAO;IACzD,CAAC;IACD,IAAG,OAAO,KAAG,QAAQ,IAAE,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAE,CAAC,CAAC,IAAI,IAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC,UAAU,EAAC,CAAC,MAAM,EAAC,GAAG,CAAC,IAAI,CAAA,CAAC,CAAA,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,EAAE,CAAC,CAAC,CAAC,CAAC;IACxI,MAAM,OAAO,GAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,QAAQ,GAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrC,IAAG,OAAO,IAAE,OAAO,KAAG,MAAM,EAAC,CAAC;QAC5B,MAAM,MAAM,GAAC,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,KAAG,OAAO,CAAC,CAAC;QAAA,IAAG,CAAC,MAAM;YAAC,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAAA,QAAQ,GAAC,MAAM,CAAC,EAAE,CAAC;IACrJ,CAAC;IACD,IAAG,OAAO,KAAG,OAAO,IAAE,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,EAAC,CAAC;QAAA,MAAM,MAAM,CAAC,UAAU,EAAC,CAAC,QAAQ,EAAC,SAAS,EAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAAA,OAAO;IAAA,CAAC;IAC9H,MAAM,QAAQ,GAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAAA,MAAM,CAAC,GAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC/E,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;QAAA,MAAM,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAA,OAAO;IAAA,CAAC;IACtE,IAAG,OAAO,KAAG,KAAK,EAAC,CAAC;QAClB,IAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAC,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAClG,MAAM,WAAW,CAAC,QAAQ,EAAC,EAAC,IAAI,EAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA,CAAC,CAAA,EAAC,YAAY,EAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,CAAC,CAAC;QAAA,OAAO;IACvI,CAAC;IACD,IAAG,OAAO,KAAG,MAAM,EAAC,CAAC;QAAA,MAAM,CAAC,EAAC,MAAM,EAAC,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAC,MAAM,CAAC,CAAC,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,iBAAiB,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,CAAC,CAAC;QAAA,OAAO;IAAA,CAAC;IAC1I,IAAG,OAAO,KAAG,SAAS,EAAC,CAAC;QAAA,MAAM,MAAM,CAAC,QAAQ,EAAC,CAAC,OAAO,EAAC,YAAY,EAAC,QAAQ,CAAC,EAAE,EAAC,GAAG,CAAC,IAAI,CAAA,CAAC,CAAA,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,EAAE,CAAC,CAAC,CAAC,CAAC;QAAA,OAAO;IAAA,CAAC;IAClH,IAAG,OAAO,KAAG,OAAO,EAAC,CAAC;QACpB,MAAM,OAAO,GAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAAA,MAAM,MAAM,GAAC,MAAM,MAAM,CAAC,KAAK,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjG,MAAM,mBAAmB,CAAC,QAAQ,EAAC,MAAM,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAAA,MAAM,CAAC,EAAC,MAAM,EAAC,OAAO,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,OAAO,EAAC,gDAAgD,EAAC,CAAC,CAAC;QAAA,OAAO;IAC9K,CAAC;IACD,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;QACrB,MAAM,EAAE,GAAC,UAAU,CAAC,CAAC,CAAC,IAAE,MAAM,CAAC;QAC/B,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YAAA,IAAG,IAAI;gBAAC,MAAM,CAAC,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,GAAG,CAAC,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,CAAC,CAAC;;gBAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAC,IAAI,CAAC,CAAC;YAAA,OAAO;QAAA,CAAC;QAClJ,IAAG,EAAE,KAAG,QAAQ,EAAC,CAAC;YAAA,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAAA,OAAO;QAAA,CAAC;QACrD,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YACd,IAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;gBAAC,MAAM,CAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;iBACvE,CAAC;gBACJ,MAAM,IAAI,GAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAG,SAAS,CAAC,CAAC;gBACpF,IAAI,MAAM,GAAqB,IAAI,CAAC;gBAAA,IAAI,OAAO,GAAa,IAAI,CAAC;gBACjE,IAAG,CAAC;oBAAA,MAAM,GAAC,MAAM,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAA,CAAC;gBAAA,OAAM,CAAC,EAAC,CAAC;oBAAA,OAAO,GAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAAA,CAAC;gBACjF,MAAM,CAAC,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,QAAQ,EAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAC,IAAI,CAAC,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,CAAC,CAAC;YACjI,CAAC;YAAA,OAAO;QACV,CAAC;QACD,IAAG,EAAE,KAAG,SAAS,EAAC,CAAC;YACjB,MAAM,QAAQ,GAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;YAAA,IAAG,CAAC,QAAQ;gBAAC,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACjH,MAAM,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,MAAM,GAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAC,cAAc,CAAC,CAAC;YAC9C,MAAM,cAAc,CAAC,KAAK,EAAC,QAAQ,EAAA,EAAE;gBACnC,IAAG,MAAM,MAAM,CAAC,MAAM,CAAC;oBAAC,MAAM,KAAK,CAAC,mEAAmE,CAAC,CAAC;gBACzG,MAAM,aAAa,CAAC,MAAM,EAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5D,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,CAAC,EAAE,CAAE,CAAC,MAAM,GAAC,EAAC,IAAI,EAAC,SAAS,EAAC,IAAI,EAAC,MAAM,EAAC,CAAC;YACtF,CAAC,CAAC,CAAC;YAAA,MAAM,CAAC,EAAC,MAAM,EAAC,0BAA0B,EAAC,IAAI,EAAC,MAAM,EAAC,CAAC,CAAC;YAAA,OAAO;QACpE,CAAC;QACD,IAAG,EAAE,KAAG,QAAQ,EAAC,CAAC;YAChB,MAAM,MAAM,GAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAA,MAAM,IAAI,GAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAA,IAAG,CAAC,IAAI,IAAE,CAAE,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC/I,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAC,cAAc,CAAC,CAAC;YAC7C,MAAM,QAAQ,CAAC,IAAI,GAAC,OAAO,EAAC,KAAK,IAAE,EAAE;gBACnC,MAAM,OAAO,GAAuB,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,CAA0B,CAAA,CAAC,CAAA,EAAE,CAAC;gBACvH,IAAG,MAAM,KAAG,KAAK;oBAAC,OAAO,CAAC,IAAI,CAAC,GAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAC,EAAE,CAAC,CAAC;qBACpE,IAAG,MAAM,KAAG,QAAQ;oBAAC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;;oBAAK,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBACzF,MAAM,aAAa,CAAC,IAAI,EAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;YAAA,MAAM,CAAC,EAAC,MAAM,EAAC,gBAAgB,EAAC,IAAI,EAAC,CAAC,CAAC;YAAA,OAAO;QACnD,CAAC;QACD,IAAG,EAAE,KAAG,QAAQ,IAAE,EAAE,KAAG,QAAQ,EAAC,CAAC;YAC/B,MAAM,IAAI,GAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,UAAU,CAAC,CAAC,CAAC,CAAC;YAAA,MAAM,MAAM,GAAC,EAAE,KAAG,QAAQ,CAAA,CAAC,CAAA,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC;YACjH,IAAG,EAAE,KAAG,QAAQ,IAAE,CAAC,IAAI;gBAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAC,EAAE,KAAG,QAAQ,CAAA,CAAC,CAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAC,cAAc,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,CAAC;YAChF,IAAG,EAAE,KAAG,QAAQ;gBAAC,MAAM,cAAc,CAAC,WAAW,CAAC,MAAM,WAAW,CAAC,MAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACpF,MAAM,cAAc,CAAC,KAAK,EAAC,QAAQ,EAAA,EAAE;gBACnC,IAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,CAAC,EAAE,IAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAG,MAAM,CAAC;oBAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC9G,IAAG,MAAM;oBAAC,MAAM,aAAa,CAAC,MAAM,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClD,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,CAAC,EAAE,CAAE,CAAC,MAAM,GAAC,EAAC,IAAI,EAAC,EAAE,KAAG,QAAQ,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,CAAC;YAC7G,CAAC,CAAC,CAAC;YAAA,MAAM,CAAC,EAAC,MAAM,EAAC,gBAAgB,EAAC,IAAI,EAAC,MAAM,EAAC,CAAC,CAAC;YAAA,OAAO;QAC1D,CAAC;QACD,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YACd,MAAM,IAAI,GAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,EAAC,KAAK,CAAC,CAAA,CAAC,CAAA,MAAM,SAAS,EAAE,CAAC;YAC7G,MAAM,KAAK,GAAC,MAAM,kBAAkB,CAAC,QAAQ,EAAC,IAAI,EAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAE,EAAE,CAAC,CAAC;YAAA,MAAM,CAAC,EAAC,MAAM,EAAC,OAAO,EAAC,QAAQ,EAAC,KAAK,CAAC,QAAQ,EAAC,CAAC,CAAC;YAAA,OAAO;QAC1I,CAAC;QACD,IAAG,EAAE,KAAG,OAAO,EAAC,CAAC;YACf,MAAM,KAAK,GAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAE,MAAM,SAAS,EAAE,CAA2B,CAAC;YAC1F,IAAG,KAAK,CAAC,UAAU,KAAG,SAAS,IAAE,CAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,KAAG,SAAS;gBAAC,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,GAAG,CAAC,CAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAC,GAAG,KAAK,EAAC,CAAC,CAAC,EAAC,KAAK,CAAC,CAAC;YACrN,MAAM,CAAC,EAAC,MAAM,EAAC,OAAO,EAAC,QAAQ,EAAC,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAC,KAAK,EAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAC,CAAC,CAAC;YAAA,OAAO;QAC5H,CAAC;QACD,MAAM,MAAM,GAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAG,EAAE,KAAG,UAAU,EAAC,CAAC;YAAA,MAAM,CAAC,EAAC,MAAM,EAAC,OAAO,EAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,CAAC,CAAC;YAAA,OAAO;QAAA,CAAC;QACrG,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YACd,MAAM,MAAM,GAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,IAAE,IAAI,CAAC;YACnE,MAAM,OAAO,GAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAC,KAAK,CAAC,EAAC,EAAE,CAAA,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,GAA2B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAC,KAAK,CAAC,EAAC,EAAE,CAAA,CAAC,EAAC,KAAK,EAAC,MAAM,EAAC,MAAM,EAAE,CAAC,KAA6B,CAAC,IAAE,IAAI,EAAC,KAAK,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC;YAClP,MAAM,CAAC,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,OAAO,EAAC,CAAC,CAAC;YAAA,OAAO;QAC3E,CAAC;QACD,IAAG,EAAE,KAAG,OAAO,EAAC,CAAC;YACf,MAAM,KAAK,GAAC,MAAM,eAAe,CAAC,QAAQ,EAAC,OAAO,EAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7F,MAAM,CAAC,EAAC,MAAM,EAAC,KAAK,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,qBAAqB,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,OAAO,EAAC,KAAK,EAAC,CAAC,CAAC;YAAA,OAAO;QACrG,CAAC;QACD,IAAG,EAAE,KAAG,QAAQ,EAAC,CAAC;YAChB,MAAM,IAAI,GAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAAA,MAAM,IAAI,GAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1E,IAAG,IAAI,EAAC,CAAC;gBAAA,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;gBAAA,MAAM,CAAC,EAAC,MAAM,EAAC,UAAU,EAAC,IAAI,EAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;YAAA,CAAC;;gBAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAA,OAAO;QACvK,CAAC;QACD,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YACd,MAAM,MAAM,GAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAA,IAAG,CAAC,MAAM;gBAAC,MAAM,KAAK,CAAC,kEAAkE,CAAC,CAAC;YAC/I,MAAM,IAAI,GAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAC,eAAe,CAAC,CAAC,CAAC;YAAA,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,cAAc,CAAC,CAAC;YACxH,IAAG,CAAC;gBAAA,MAAM,SAAS,CAAC,IAAI,EAAC,MAAM,CAAC,IAAI,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;gBAAA,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAC,MAAM,EAAC,EAAE,GAAC,MAAM,KAAK,GAAC,KAAK,CAAC,MAAM,EAAC,CAAC,IAAI,CAAC,EAAC,EAAC,KAAK,EAAC,SAAS,EAAC,CAAC,CAAC,CAAA,KAAK,CAAC,IAAI,CAAC,OAAO,EAAC,MAAM,CAAC,CAAC,CAAA,KAAK,CAAC,IAAI,CAAC,MAAM,EAAC,IAAI,CAAA,EAAE,CAAA,IAAI,KAAG,CAAC,CAAA,CAAC,CAAA,OAAO,EAAE,CAAA,CAAC,CAAA,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;gBACxP,MAAM,IAAI,GAAC,MAAM,QAAQ,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC;gBAAA,MAAM,kBAAkB,CAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAAA,MAAM,CAAC,EAAC,MAAM,EAAC,OAAO,EAAC,OAAO,EAAC,qCAAqC,EAAC,CAAC,CAAC;YACxK,CAAC;oBAAO,CAAC;gBAAA,MAAM,EAAE,CAAC,IAAI,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;YAAA,CAAC;YAAA,OAAO;QAC9D,CAAC;QACD,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC;IACD,IAAG,OAAO,KAAG,MAAM,EAAC,CAAC;QACnB,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAC,UAAU,CAAC,CAAC;QAAA,MAAM,KAAK,GAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/G,IAAG,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAE,EAAE,CAAC,CAAC,IAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAE,EAAE,CAAC,GAAC,CAAC,IAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAE,EAAE,CAAC,GAAC,GAAG;YAAC,MAAM,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACnL,MAAM,IAAI,GAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA,CAAC,CAAA,CAAC,MAAM,WAAW,CAAC,IAAI,EAAC,IAAI,EAAC,EAAE,GAAC,IAAI,GAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,CAAA,cAAc,CAAC;QAC9H,IAAG,IAAI;YAAC,MAAM,CAAC,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,MAAM,EAAC,IAAI,EAAC,CAAC,CAAC;;YAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAC,IAAI,CAAC,CAAC;QAAA,OAAO;IACnG,CAAC;IACD,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAC,CAAC,CAAC,MAAM,CAAC;QACzC,MAAM,KAAK,GAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,CAAC,EAAC,EAAE,CAAA,IAAI,CAAC,CAAC,CAAC,KAAG,YAAY,IAAE,IAAI,CAAC,CAAC,GAAC,CAAC,CAAC,KAAG,YAAY,IAAE,IAAI,CAAC,CAAC,CAAC,KAAG,WAAW,IAAE,IAAI,CAAC,CAAC,GAAC,CAAC,CAAC,KAAG,WAAW,CAAC,CAAC;QACjI,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACzD,IAAG,UAAU,CAAC,CAAC,CAAC,KAAG,MAAM,EAAC,CAAC;YAAA,MAAM,IAAI,GAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAA,IAAG,IAAI,KAAG,SAAS,IAAE,IAAI,KAAG,SAAS,IAAE,IAAI,KAAG,OAAO;gBAAC,MAAM,cAAc,CAAC,KAAK,EAAC,CAAC,EAAA,EAAE,GAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,CAAC,EAAE,CAAE,CAAC,cAAc,GAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC;QAAA,CAAC;QAC1M,OAAO;IACT,CAAC;IACD,IAAG,OAAO,KAAG,aAAa,EAAC,CAAC;QAC1B,MAAM,MAAM,GAAC,MAAM,qBAAqB,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,EAAC,CAAC,CAAC;QAAA,MAAM,IAAI,GAAC,MAAM,eAAe,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,IAAI,EAAC,CAAC,CAAC;QAAA,MAAM,EAAE,GAAC,UAAU,CAAC,CAAC,CAAC,IAAE,QAAQ,CAAC;QAC3I,IAAG,EAAE,KAAG,OAAO;YAAC,MAAM,CAAC,EAAC,KAAK,EAAC,MAAM,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,EAAC,CAAC,CAAC;aAC/D,IAAG,EAAE,KAAG,QAAQ;YAAC,MAAM,CAAC,EAAC,MAAM,EAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAC,MAAM,EAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAC,CAAC,CAAC;aACvF,IAAG,CAAC,cAAc,EAAC,aAAa,EAAC,gBAAgB,EAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,EAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACrJ,CAAC;YAAA,MAAM,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAC,EAAC,MAAM,EAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAC,IAAI,EAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAC,CAAC,CAAC,CAAC;QAAA,CAAC;QAAA,OAAO;IACxG,CAAC;IACD,MAAM,MAAM,GAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;QACrB,MAAM,EAAC,iBAAiB,EAAC,GAAC,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAAA,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACjG,MAAM,MAAM,GAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAC,MAAM,EAAC,MAAM,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,EAAC,WAAW,EAAC,MAAM,CAAC,WAAW;YACrH,OAAO,EAAC,0FAA0F,EAAC,CAAC,CAAC;QAAA,OAAO;IAChH,CAAC;IACD,IAAG,OAAO,KAAG,SAAS,EAAC,CAAC;QACtB,MAAM,MAAM,GAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAAA,IAAG,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI;YAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzG,MAAM,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,aAAa,CAAC,EAAC,IAAI,EAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAE,EAAC,GAAG,EAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAC,MAAM,EAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAE,IAAI,EAAC,CAAC,CAAC,CAAC;QAAA,OAAO;IACtL,CAAC;IACD,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;QACrB,MAAM,KAAK,GAAC,MAAM,eAAe,CAAC,QAAQ,EAAC,QAAQ,CAAC,CAAC;QAAA,IAAG,KAAK,EAAE,KAAK,KAAG,SAAS,IAAE,CAAC,KAAK,CAAC,IAAI;YAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAClI,MAAM,QAAQ,GAAC,oBAAoB,KAAK,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAAC,MAAM,KAAK,CAAC,QAAQ,GAAC,UAAU,EAAC,EAAC,MAAM,EAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,EAAE,CAAyB,CAAC;QAC3H,IAAG,MAAM,CAAC,UAAU,KAAG,QAAQ,CAAC,EAAE;YAAC,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACpF,MAAM,OAAO,GAAC,KAAK,EAAC,MAAa,EAAC,MAAc,EAAC,EAAE;YACjD,MAAM,KAAK,GAAC,MAAM,KAAK,CAAC,QAAQ,GAAC,MAAM,EAAC,EAAC,MAAM,EAAC,MAAM,EAAC,OAAO,EAAC,EAAC,cAAc,EAAC,kBAAkB,EAAC,MAAM,EAAC,qCAAqC,EAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA,CAAC,CAAA,EAAC,aAAa,EAAC,SAAS,GAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,EAAC,IAAI,EAAC,IAAI,CAAC,SAAS,CAAC,EAAC,OAAO,EAAC,KAAK,EAAC,EAAE,EAAC,CAAC,EAAC,MAAM,EAAC,MAAM,EAAC,CAAC,EAAC,MAAM,EAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAC,CAAC,CAAC;YACtU,IAAG,CAAC,KAAK,CAAC,EAAE;gBAAC,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,KAAG,GAAG,CAAA,CAAC,CAAA,uDAAuD,CAAA,CAAC,CAAA,yBAAyB,CAAC,CAAC;YAC/H,MAAM,IAAI,GAAC,MAAM,KAAK,CAAC,IAAI,EAAiD,CAAC;YAAA,IAAG,IAAI,CAAC,KAAK,IAAE,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAC,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAAA,OAAO,IAAI,CAAC,MAAM,CAAC;QAC7K,CAAC,CAAC;QACF,MAAM,OAAO,CAAC,YAAY,EAAC,EAAE,CAAC,CAAC;QAAA,MAAM,OAAO,CAAC,YAAY,EAAC,EAAC,IAAI,EAAC,gBAAgB,EAAC,SAAS,EAAC,EAAC,IAAI,EAAC,GAAG,EAAC,KAAK,EAAC,CAAC,EAAC,EAAC,CAAC,CAAC;QAChH,MAAM,CAAC,EAAC,MAAM,EAAC,MAAM,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,IAAI,EAAC,KAAK,CAAC,IAAI,EAAC,oBAAoB,EAAC,KAAK,EAAC,CAAC,CAAC;QAAA,OAAO;IACnG,CAAC;AACH,CAAC","sourcesContent":["import {createInterface} from 'node:readline/promises';\nimport {spawn} from 'node:child_process';\nimport {readFile,writeFile,mkdtemp,rm,realpath} from 'node:fs/promises';\nimport {tmpdir,homedir} from 'node:os';\nimport path from 'node:path';\nimport {createAccessControl} from '../access-control.js';\nimport {createWorkspaceGrants} from '../workspace-grants.js';\nimport {createDenyRules} from '../explicit-deny-rules.js';\nimport {createPrivateDirectory} from '../platform.js';\nimport {instanceStatus,instanceRequest,runInstance} from '../instance-runtime.js';\nimport {atomicPrivate,changeRegistry,configJSONSchema,sourceRevision,configTemplate,createInstance,exists,fingerprint,instanceConfigSchema,instanceEnv,instancePaths,instancesRoot,loadInstanceConfig,parseConfig,patchInstanceConfig,readRegistry,readTrusted,resolveInstance,saveInstanceConfig,suggestPort,validateConfig,withLock,type Instance,type InstanceConfig} from '../instance-store.js';\n\nconst booleans=new Set(['--json','--all','--link','--archived','--approve-trusted-developer','--approve-unrestricted','--confirm','--effective','--allow-loopback-http']);\nfunction options(args:string[]){\n  const flags=new Map<string,string>();const positional:string[]=[];\n  for(let i=0;i<args.length;i++){const arg=args[i]!;if(!arg.startsWith('--')){positional.push(arg);continue;}\n    if(flags.has(arg))throw Error('DUPLICATE_OPTION: '+arg);\n    if(booleans.has(arg))flags.set(arg,'true');else {if(!args[i+1]||args[i+1]!.startsWith('--'))throw Error('MISSING_OPTION_VALUE: '+arg);flags.set(arg,args[++i]!);}\n  }\n  return {flags,positional};\n}\nconst message=(error:unknown)=>error instanceof Error?error.message:'UNKNOWN_ERROR';\nasync function readInput(){let text='';for await(const chunk of process.stdin){text+=String(chunk);if(text.length>262144)throw Error('CONFIG_TOO_LARGE');}return text;}\nfunction output(value:unknown){process.stdout.write(JSON.stringify(value,null,2)+'\\n');}\nfunction requireApprovals(config:InstanceConfig,flags:Map<string,string>){\n  if(config.accessRole==='trusted'&&!flags.has('--approve-trusted-developer'))throw Error('TRUSTED_APPROVAL_REQUIRED: add --approve-trusted-developer');\n  if(config.accessRole==='trusted'&&process.platform!=='darwin'&&!flags.has('--approve-unrestricted'))throw Error('UNRESTRICTED_APPROVAL_REQUIRED: add --approve-unrestricted');\n}\nasync function wizard(flags:Map<string,string>,current?:InstanceConfig){\n  let project=flags.get('--project')??current?.projectRoot;let role=flags.get('--access-role')??current?.accessRole??'restricted';\n  let port=Number(flags.get('--port')??current?.port??await suggestPort());\n  if(!project){\n    if(!process.stdin.isTTY)throw Error('PROJECT_REQUIRED: use --project /absolute/directory');\n    const rl=createInterface({input:process.stdin,output:process.stderr});\n    try{project=await rl.question('Work directory: ');role=(await rl.question('Capability (restricted / trusted) [restricted]: '))||'restricted';\n      if(role==='trusted'&&(await rl.question('Enable native tools and Shell as your OS account? Type yes: '))==='yes'){\n        flags.set('--approve-trusted-developer','true');if(process.platform!=='darwin')flags.set('--approve-unrestricted','true');\n      }\n      port=Number((await rl.question(`Local port [${port}]: `))||port);\n    }finally{rl.close();}\n  }\n  const config=instanceConfigSchema.parse({...current,schemaVersion:1,projectRoot:await realpath(path.resolve(project)),port,\n    accessRole:role,mode:current?.accessRole===role?current.mode:role==='trusted'?'read-write':'read-only',writeScope:current?.accessRole===role?current.writeScope:role==='trusted'&&process.platform==='darwin'?'home-only':'unrestricted',connection:flags.get('--connection')??current?.connection??'local'});\n  requireApprovals(config,flags);return validateConfig(config);\n}\nexport async function maybeHandleInstances(argv:string[]):Promise<boolean>{\n  let command=argv[0]??'help';\n  if(command==='start-setup'&&!process.env.MAC_MCP_INTERNAL_SETUP_OWNER_PID){command='run';argv=['run','--profile','setup',...argv.slice(1)];}\n  if(command==='doctor-setup'){command='doctor';argv=['doctor','--profile','setup',...argv.slice(1)];}\n  const supported=['instance','config','run','status','stop','restart','logs','doctor','verify','access','permissions','privacy','setup'];\n  if(!supported.includes(command))return false;\n  try {\n  const explicit=argv.includes('--instance');const registry=await readRegistry();\n  const managed=registry.instances.length>0;\n  const firstWizard=command==='setup'&&argv.length===1&&process.stdin.isTTY;\n  if(!['instance','config'].includes(command)&&!explicit&&!managed&&!firstWizard)return false;\n  // A retained legacy profile remains available until the owner migrates it.\n  const profileIndex=argv.indexOf('--profile');\n  if(profileIndex>=0&&!registry.instances.some(i=>i.legacy===argv[profileIndex+1])&&argv[profileIndex+1]!=='auto'){\n    if(registry.instances.some(i=>i.legacy))throw Error('LEGACY_PROFILE_NOT_MIGRATED_USE_INSTANCE: select --instance explicitly');\n    return false;\n  }\n  await handle(command,argv.slice(1));}catch(error){\n    if(argv.includes('--json'))output({schemaVersion:1,error:message(error)});\n    else process.stderr.write(message(error)+'\\n');process.exitCode=1;\n  }\n  return true;\n}\nexport async function handle(command:string,args:string[]){\n  const {flags,positional}=options(args);const json=flags.has('--json');\n  const known=new Set([...booleans,'--instance','--name','--project','--port','--access-role','--connection','--profile','--app-parent-pid','--revision','--patch','--file','--output','--lines','--expires','--issuer','--resource','--resource-aliases','--client-id','--subjects','--registration','--token-auth','--callback','--target','--mode']);\n  for(const flag of flags.keys())if(!known.has(flag))throw Error('UNKNOWN_OPTION: '+flag);\n  if(command==='instance'){\n    const op=positional[0]??'list';\n    if(op==='list'){\n      const registry=await readRegistry();const instances=await Promise.all(registry.instances.filter(i=>flags.has('--archived')||!i.archived).map(i=>instanceStatus(i)));\n      if(json)output({schemaVersion:1,defaultInstanceId:registry.defaultInstanceId,instances});\n      else {for(const i of instances)process.stdout.write(`${i.instanceId===registry.defaultInstanceId?'*':' '} ${i.name}\\t${i.phase}\\t${i.configState}\\t${i.port??'—'}\\t${i.source.path}\\n`);if(!instances.length)process.stdout.write('No instances. Run: mac-mcp-gateway instance create default\\n');}return;\n    }\n    if(op==='create'){\n      const config=await wizard(flags);const instance=await createInstance(positional[1]??flags.get('--name')??'default',{config});\n      output({instance,message:'Saved. Start with: mac-mcp-gateway run --instance '+JSON.stringify(instance.name)});return;\n    }\n    if(op==='import'){\n      const file=positional[1];if(!file)throw Error('IMPORT_FILE_REQUIRED');\n      const config=await validateConfig(parseConfig(await readTrusted(path.resolve(file),false)));requireApprovals(config,flags);\n      output({instance:await createInstance(flags.get('--name')??path.basename(file,path.extname(file)),{file,link:flags.has('--link')}),\n        message:flags.has('--link')?'Bound to original file. Changes require apply.':'Imported a private copy. The original file is no longer used.'});return;\n    }\n    if(op==='migrate'){\n      const {migrateLegacy}=await import('../instance-migration.js');output(await migrateLegacy(positional[1],flags.has('--confirm'),flags.get('--name')));return;\n    }\n    const instance=await resolveInstance(positional[1]??flags.get('--instance'),homedir(),op==='restore');\n    if(op==='copy'){\n      const config={...(await loadInstanceConfig(instance)).config,port:await suggestPort()};\n      const access=await createAccessControl(instancePaths(instance).access);const mode=(await access.snapshot()).mode;\n      output({instance:await createInstance(positional[2]??flags.get('--name')??instance.name+' copy',{config,requiredAccess:instance.requiredAccess!=='ingress'?instance.requiredAccess:mode}),message:'Copied settings only. Credentials and sessions were not copied.'});return;\n    }\n    await changeRegistry(async registry=>{\n      const item=registry.instances.find(i=>i.id===instance.id)!;\n      if(op==='rename'){\n        const name=positional[2];if(!name)throw Error('NAME_REQUIRED');if(registry.instances.some(i=>i.name===name))throw Error('INSTANCE_NAME_EXISTS');item.name=name;\n      }else if(op==='default')registry.defaultInstanceId=item.id;\n      else if(op==='archive'||op==='remove'){const stopped=await instanceRequest(instance,'stop');if(stopped&&stopped.phase!=='stopped')throw Error('INSTANCE_STILL_RUNNING');item.archived=true;if(registry.defaultInstanceId===item.id)registry.defaultInstanceId=null;}\n      else if(op==='restore')item.archived=false;\n      else throw Error('INSTANCE_ACTION_INVALID');\n    });output({result:'OK',instanceId:instance.id});return;\n  }\n  if(command==='status'&&!flags.has('--instance')&&(!json||flags.has('--all')))return handle('instance',['list',...(json?['--json']:[])]);\n  const profile=flags.get('--profile');\n  let selector=flags.get('--instance');\n  if(profile&&profile!=='auto'){\n    const legacy=(await readRegistry()).instances.find(i=>i.legacy===profile);if(!legacy)throw Error('LEGACY_PROFILE_NOT_MIGRATED');selector=legacy.id;\n  }\n  if(command==='setup'&&!(await readRegistry()).instances.length){await handle('instance',['create','default',...args]);return;}\n  const instance=await resolveInstance(selector);const p=instancePaths(instance);\n  if(command==='status'){output(await instanceStatus(instance));return;}\n  if(command==='run'){\n    if(flags.has('--port'))throw Error('INSTANCE_PORT_OVERRIDE_DENIED: edit configuration and apply');\n    await runInstance(instance,{json,...(flags.has('--app-parent-pid')?{appParentPid:Number(flags.get('--app-parent-pid'))}:{})});return;\n  }\n  if(command==='stop'){output({result:(await instanceRequest(instance,'stop'))?'STOPPED':'ALREADY_STOPPED',instanceId:instance.id});return;}\n  if(command==='restart'){await handle('config',['apply','--instance',instance.id,...(json?['--json']:[])]);return;}\n  if(command==='setup'){\n    const current=await loadInstanceConfig(instance);const config=await wizard(flags,current.config);\n    await patchInstanceConfig(instance,config,current.revision);output({result:'SAVED',instanceId:instance.id,message:'Apply changes to restart the running instance.'});return;\n  }\n  if(command==='config'){\n    const op=positional[0]??'show';\n    if(op==='path'){if(json)output({instanceId:instance.id,...p,source:instance.source});else process.stdout.write(instance.source.path+'\\n');return;}\n    if(op==='schema'){output(configJSONSchema());return;}\n    if(op==='show'){\n      if(flags.has('--effective'))output((await instanceStatus(instance)).active);\n      else {\n        const text=await readTrusted(instance.source.path,instance.source.kind==='managed');\n        let config:InstanceConfig|null=null;let problem:string|null=null;\n        try{config=await validateConfig(parseConfig(text));}catch(e){problem=message(e);}\n        output({instanceId:instance.id,text,config,problem,revision:sourceRevision(instance.source.path,text),source:instance.source});\n      }return;\n    }\n    if(op==='recover'){\n      const snapshot=(await instanceStatus(instance)).active;if(!snapshot)throw Error('NO_SUCCESSFUL_CONFIG_SNAPSHOT');\n      await validateConfig(snapshot.config);\n      const target=path.join(p.root,'config.jsonc');\n      await changeRegistry(async registry=>{\n        if(await exists(target))throw Error('CONFIG_RECOVERY_WOULD_OVERWRITE: repair the existing file instead');\n        await atomicPrivate(target,configTemplate(snapshot.config));\n        registry.instances.find(i=>i.id===instance.id)!.source={kind:'managed',path:target};\n      });output({result:'RECOVERED_MANAGED_CONFIG',path:target});return;\n    }\n    if(op==='secret'){\n      const action=positional[1];const name=positional[2];if(!name||! /^[A-Za-z][A-Za-z0-9_-]{0,79}$/.test(name))throw Error('SECRET_NAME_REQUIRED');\n      const file=path.join(p.state,'secrets.json');\n      await withLock(file+'.lock',async()=>{\n        const secrets:Record<string,string>=await exists(file)?JSON.parse(await readTrusted(file)) as Record<string,string>:{};\n        if(action==='set')secrets[name]=(await readInput()).replace(/\\r?\\n$/,'');\n        else if(action==='remove')delete secrets[name];else throw Error('SECRET_ACTION_INVALID');\n        await atomicPrivate(file,JSON.stringify(secrets));\n      });output({result:'SECRET_UPDATED',name});return;\n    }\n    if(op==='relink'||op==='manage'){\n      const file=flags.get('--file')??positional[1];const loaded=op==='manage'?await loadInstanceConfig(instance):null;\n      if(op==='relink'&&!file)throw Error('CONFIG_FILE_REQUIRED');\n      const target=op==='manage'?path.join(p.root,'config.jsonc'):path.resolve(file!);\n      if(op==='relink')await validateConfig(parseConfig(await readTrusted(target,false)));\n      await changeRegistry(async registry=>{\n        if(registry.instances.some(i=>i.id!==instance.id&&i.source.path===target))throw Error('CONFIG_ALREADY_BOUND');\n        if(loaded)await atomicPrivate(target,loaded.text);\n        registry.instances.find(i=>i.id===instance.id)!.source={kind:op==='manage'?'managed':'linked',path:target};\n      });output({result:'SOURCE_UPDATED',path:target});return;\n    }\n    if(op==='save'){\n      const text=flags.get('--file')?await readTrusted(path.resolve(flags.get('--file')!),false):await readInput();\n      const saved=await saveInstanceConfig(instance,text,flags.get('--revision')??'');output({result:'SAVED',revision:saved.revision});return;\n    }\n    if(op==='patch'){\n      const patch=JSON.parse(flags.get('--patch')??await readInput()) as Record<string,unknown>;\n      if(patch.accessRole==='trusted'&&(await loadInstanceConfig(instance)).config.accessRole!=='trusted')requireApprovals(parseConfig(JSON.stringify({...((await loadInstanceConfig(instance)).config),...patch})),flags);\n      output({result:'SAVED',revision:(await patchInstanceConfig(instance,patch,flags.get('--revision')??'')).revision});return;\n    }\n    const loaded=await loadInstanceConfig(instance);\n    if(op==='validate'){output({result:'VALID',revision:loaded.revision,source:instance.source});return;}\n    if(op==='diff'){\n      const active=(await instanceStatus(instance)).active?.config??null;\n      const changes=Object.entries(loaded.config).filter(([key,value])=>JSON.stringify(value)!==JSON.stringify(active?.[key as keyof InstanceConfig])).map(([field,value])=>({field,before:active?.[field as keyof InstanceConfig]??null,after:value}));\n      output({instanceId:instance.id,revision:loaded.revision,changes});return;\n    }\n    if(op==='apply'){\n      const state=await instanceRequest(instance,'apply',flags.get('--revision')??loaded.revision);\n      output({result:state?'APPLIED':'VALID_ON_NEXT_START',instanceId:instance.id,runtime:state});return;\n    }\n    if(op==='export'){\n      const file=flags.get('--output');const text=configTemplate(loaded.config);\n      if(file){await writeFile(path.resolve(file),text,{flag:'wx',mode:0o600});output({result:'EXPORTED',file:path.resolve(file)});}else process.stdout.write(text);return;\n    }\n    if(op==='edit'){\n      const editor=process.env.VISUAL||process.env.EDITOR;if(!editor)throw Error('EDITOR_REQUIRED: set EDITOR to an executable, or use config path');\n      const temp=await mkdtemp(path.join(await realpath(tmpdir()),'gateway-edit-'));const file=path.join(temp,'config.jsonc');\n      try{await writeFile(file,loaded.text,{mode:0o600});await new Promise<void>((resolve,reject)=>{const child=spawn(editor,[file],{stdio:'inherit'});child.once('error',reject);child.once('exit',code=>code===0?resolve():reject(Error('EDITOR_FAILED')));});\n        const text=await readFile(file,'utf8');await saveInstanceConfig(instance,text,loaded.revision);output({result:'SAVED',message:'Use config diff, then config apply.'});\n      }finally{await rm(temp,{recursive:true,force:true});}return;\n    }\n    throw Error('CONFIG_ACTION_INVALID');\n  }\n  if(command==='logs'){\n    const file=path.join(p.logs,'core.log');const lines=Math.min(200,Math.max(1,Number(flags.get('--lines')??60)));\n    if(!Number.isSafeInteger(Number(flags.get('--lines')??60))||Number(flags.get('--lines')??60)<1||Number(flags.get('--lines')??60)>200)throw Error('INVALID_LINES: expected 1..200');\n    const text=await exists(file)?(await readTrusted(file,true,32*1024*1024)).split('\\n').slice(-lines).join('\\n'):'No logs yet.';\n    if(json)output({instanceId:instance.id,output:text});else process.stdout.write(text+'\\n');return;\n  }\n  if(command==='access'){\n    process.env.MAC_MCP_ACCESS_FILE=p.access;\n    const clean=args.filter((_,i)=>args[i]!=='--instance'&&args[i-1]!=='--instance'&&args[i]!=='--profile'&&args[i-1]!=='--profile');\n    await (await import('./access.js')).accessCommand(clean);\n    if(positional[0]==='mode'){const mode=positional[1];if(mode==='ingress'||mode==='api-key'||mode==='oauth')await changeRegistry(async r=>{r.instances.find(i=>i.id===instance.id)!.requiredAccess=mode;});}\n    return;\n  }\n  if(command==='permissions'){\n    const grants=await createWorkspaceGrants({file:p.grants});const deny=await createDenyRules({file:p.deny});const op=positional[0]??'status';\n    if(op==='token')output({token:await readTrusted(grants.tokenFile)});\n    else if(op==='status')output({grants:await grants.snapshot(),denied:await deny.snapshot()});\n    else if(['disable-tool','enable-tool','deny-directory','allow-directory'].includes(op))output(await deny.update(op,flags.get('--target')??positional[1]));\n    else {output(await grants.update(op,{target:flags.get('--target'),mode:flags.get('--mode')}));}return;\n  }\n  const loaded=await loadInstanceConfig(instance);\n  if(command==='doctor'){\n    const {ensureAccessReady}=await import('../instance-store.js');await ensureAccessReady(instance);\n    const status=await instanceStatus(instance);\n    output({result:'PASS',instanceId:instance.id,source:instance.source,config:loaded.config,configState:status.configState,\n      message:'Configuration and access state validated. Run verify after starting to check real tools.'});return;\n  }\n  if(command==='privacy'){\n    const status=await instanceStatus(instance);if(!status.runtime?.port)throw Error('INSTANCE_NOT_RUNNING');\n    output(await (await import('../privacy-diagnostics.js')).privacyReport({port:status.runtime.port,home:homedir(),all:flags.has('--all'),target:flags.get('--target')??null}));return;\n  }\n  if(command==='verify'){\n    const state=await instanceRequest(instance,'status');if(state?.phase!=='running'||!state.port)throw Error('INSTANCE_NOT_RUNNING');\n    const endpoint=`http://127.0.0.1:${state.port}`;\n    const health=await fetch(endpoint+'/healthz',{signal:AbortSignal.timeout(3000)}).then(r=>r.json()) as {instanceId?:string};\n    if(health.instanceId!==instance.id)throw Error('INSTANCE_HEALTH_IDENTITY_MISMATCH');\n    const request=async(method:string,params:unknown)=>{\n      const reply=await fetch(endpoint+'/mcp',{method:'POST',headers:{'content-type':'application/json',accept:'application/json, text/event-stream',...(process.env.MAC_MCP_API_KEY?{authorization:'Bearer '+process.env.MAC_MCP_API_KEY}:{})},body:JSON.stringify({jsonrpc:'2.0',id:1,method,params}),signal:AbortSignal.timeout(15000)});\n      if(!reply.ok)throw Error(reply.status===401?'VERIFICATION_CREDENTIAL_REQUIRED: set MAC_MCP_API_KEY':'MCP_VERIFICATION_FAILED');\n      const data=await reply.json() as {error?:unknown;result?:{isError?:boolean}};if(data.error||data.result?.isError)throw Error('MCP_VERIFICATION_FAILED');return data.result;\n    };\n    await request('tools/list',{});await request('tools/call',{name:'list_directory',arguments:{path:'.',depth:0}});\n    output({result:'PASS',instanceId:instance.id,port:state.port,remoteClientVerified:false});return;\n  }\n}\n"]}
+{"version":3,"file":"instances.js","sourceRoot":"","sources":["../../../src/cli/instances.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,eAAe,EAAC,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAC,KAAK,EAAC,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAC,QAAQ,EAAC,SAAS,EAAC,OAAO,EAAC,EAAE,EAAC,QAAQ,EAAC,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAC,MAAM,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,mBAAmB,EAAC,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAC,qBAAqB,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAC,eAAe,EAAC,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAC,sBAAsB,EAAC,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAC,cAAc,EAAC,eAAe,EAAC,WAAW,EAAC,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAC,aAAa,EAAC,cAAc,EAAC,gBAAgB,EAAC,cAAc,EAAC,cAAc,EAAC,cAAc,EAAC,MAAM,EAAC,WAAW,EAAC,oBAAoB,EAAC,WAAW,EAAC,aAAa,EAAC,aAAa,EAAC,kBAAkB,EAAC,WAAW,EAAC,mBAAmB,EAAC,YAAY,EAAC,WAAW,EAAC,eAAe,EAAC,kBAAkB,EAAC,WAAW,EAAC,cAAc,EAAC,QAAQ,EAAmC,MAAM,sBAAsB,CAAC;AAErY,MAAM,QAAQ,GAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAC,OAAO,EAAC,QAAQ,EAAC,YAAY,EAAC,6BAA6B,EAAC,wBAAwB,EAAC,WAAW,EAAC,aAAa,EAAC,uBAAuB,CAAC,CAAC,CAAC;AAC1K,SAAS,OAAO,CAAC,IAAa;IAC5B,MAAM,KAAK,GAAC,IAAI,GAAG,EAAiB,CAAC;IAAA,MAAM,UAAU,GAAU,EAAE,CAAC;IAClE,KAAI,IAAI,CAAC,GAAC,CAAC,EAAC,CAAC,GAAC,IAAI,CAAC,MAAM,EAAC,CAAC,EAAE,EAAC,CAAC;QAAA,MAAM,GAAG,GAAC,IAAI,CAAC,CAAC,CAAE,CAAC;QAAA,IAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAC,CAAC;YAAA,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAA,SAAS;QAAA,CAAC;QACzG,IAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YAAC,MAAM,KAAK,CAAC,oBAAoB,GAAC,GAAG,CAAC,CAAC;QACxD,IAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAC,MAAM,CAAC,CAAC;aAAK,CAAC;YAAA,IAAG,CAAC,IAAI,CAAC,CAAC,GAAC,CAAC,CAAC,IAAE,IAAI,CAAC,CAAC,GAAC,CAAC,CAAE,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,wBAAwB,GAAC,GAAG,CAAC,CAAC;YAAA,KAAK,CAAC,GAAG,CAAC,GAAG,EAAC,IAAI,CAAC,EAAE,CAAC,CAAE,CAAC,CAAC;QAAA,CAAC;IACnK,CAAC;IACD,OAAO,EAAC,KAAK,EAAC,UAAU,EAAC,CAAC;AAC5B,CAAC;AACD,MAAM,OAAO,GAAC,CAAC,KAAa,EAAC,EAAE,CAAA,KAAK,YAAY,KAAK,CAAA,CAAC,CAAA,KAAK,CAAC,OAAO,CAAA,CAAC,CAAA,eAAe,CAAC;AACpF,KAAK,UAAU,SAAS,KAAG,IAAI,IAAI,GAAC,EAAE,CAAC,CAAA,IAAI,KAAK,EAAC,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAC,CAAC;IAAA,IAAI,IAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAAA,IAAG,IAAI,CAAC,MAAM,GAAC,MAAM;QAAC,MAAM,KAAK,CAAC,kBAAkB,CAAC,CAAC;AAAA,CAAC,CAAA,OAAO,IAAI,CAAC,CAAA,CAAC;AACvK,SAAS,MAAM,CAAC,KAAa,IAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC,GAAC,IAAI,CAAC,CAAC,CAAA,CAAC;AACxF,SAAS,gBAAgB,CAAC,MAAqB,EAAC,KAAwB;IACtE,IAAG,MAAM,CAAC,UAAU,KAAG,SAAS,IAAE,CAAC,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC;QAAC,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACtJ,IAAG,MAAM,CAAC,UAAU,KAAG,SAAS,IAAE,OAAO,CAAC,QAAQ,KAAG,QAAQ,IAAE,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAAC,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;AAChL,CAAC;AACD,KAAK,UAAU,MAAM,CAAC,KAAwB,EAAC,OAAuB;IACpE,IAAI,OAAO,GAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAE,OAAO,EAAE,WAAW,CAAC;IAAA,IAAI,IAAI,GAAC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,IAAE,OAAO,EAAE,UAAU,IAAE,YAAY,CAAC;IAChI,IAAI,IAAI,GAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,OAAO,EAAE,IAAI,IAAE,MAAM,WAAW,EAAE,CAAC,CAAC;IACzE,IAAG,CAAC,OAAO,EAAC,CAAC;QACX,IAAG,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;YAAC,MAAM,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC3F,MAAM,EAAE,GAAC,eAAe,CAAC,EAAC,KAAK,EAAC,OAAO,CAAC,KAAK,EAAC,MAAM,EAAC,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC;QACtE,IAAG,CAAC;YAAA,OAAO,GAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;YAAA,IAAI,GAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,kDAAkD,CAAC,CAAC,IAAE,YAAY,CAAC;YAC3I,IAAG,IAAI,KAAG,SAAS,IAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC,CAAC,KAAG,KAAK,EAAC,CAAC;gBAChH,KAAK,CAAC,GAAG,CAAC,6BAA6B,EAAC,MAAM,CAAC,CAAC;gBAAA,IAAG,OAAO,CAAC,QAAQ,KAAG,QAAQ;oBAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,EAAC,MAAM,CAAC,CAAC;YAC5H,CAAC;YACD,IAAI,GAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC,IAAE,IAAI,CAAC,CAAC;QACnE,CAAC;gBAAO,CAAC;YAAA,EAAE,CAAC,KAAK,EAAE,CAAC;QAAA,CAAC;IACvB,CAAC;IACD,MAAM,MAAM,GAAC,oBAAoB,CAAC,KAAK,CAAC,EAAC,GAAG,OAAO,EAAC,aAAa,EAAC,CAAC,EAAC,WAAW,EAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAC,IAAI;QACxH,UAAU,EAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAE,UAAU,KAAG,IAAI,CAAA,CAAC,CAAA,OAAO,CAAC,IAAI,CAAA,CAAC,CAAA,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,YAAY,CAAA,CAAC,CAAA,WAAW,EAAC,UAAU,EAAC,OAAO,EAAE,UAAU,KAAG,IAAI,CAAA,CAAC,CAAA,OAAO,CAAC,UAAU,CAAA,CAAC,CAAA,IAAI,KAAG,SAAS,IAAE,OAAO,CAAC,QAAQ,KAAG,QAAQ,CAAA,CAAC,CAAA,WAAW,CAAA,CAAC,CAAA,cAAc,EAAC,UAAU,EAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,IAAE,OAAO,EAAE,UAAU,IAAE,OAAO,EAAC,CAAC,CAAC;IAChT,gBAAgB,CAAC,MAAM,EAAC,KAAK,CAAC,CAAC;IAAA,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC;AAC/D,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAa;IACtD,IAAI,OAAO,GAAC,IAAI,CAAC,CAAC,CAAC,IAAE,MAAM,CAAC;IAC5B,IAAG,OAAO,KAAG,aAAa,IAAE,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,EAAC,CAAC;QAAA,OAAO,GAAC,KAAK,CAAC;QAAA,IAAI,GAAC,CAAC,KAAK,EAAC,WAAW,EAAC,OAAO,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAAA,CAAC;IAC5I,IAAG,OAAO,KAAG,cAAc,EAAC,CAAC;QAAA,OAAO,GAAC,QAAQ,CAAC;QAAA,IAAI,GAAC,CAAC,QAAQ,EAAC,WAAW,EAAC,OAAO,EAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAAA,CAAC;IACpG,MAAM,SAAS,GAAC,CAAC,UAAU,EAAC,QAAQ,EAAC,KAAK,EAAC,QAAQ,EAAC,MAAM,EAAC,SAAS,EAAC,MAAM,EAAC,QAAQ,EAAC,QAAQ,EAAC,QAAQ,EAAC,aAAa,EAAC,SAAS,EAAC,OAAO,CAAC,CAAC;IACxI,IAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAC,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC;QACL,MAAM,QAAQ,GAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAAA,MAAM,QAAQ,GAAC,MAAM,YAAY,EAAE,CAAC;QAC/E,MAAM,OAAO,GAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAC,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAC,OAAO,KAAG,OAAO,IAAE,IAAI,CAAC,MAAM,KAAG,CAAC,IAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAC1E,IAAG,CAAC,CAAC,UAAU,EAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAE,CAAC,QAAQ,IAAE,CAAC,OAAO,IAAE,CAAC,WAAW;YAAC,OAAO,KAAK,CAAC;QAC5F,2EAA2E;QAC3E,MAAM,YAAY,GAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAG,YAAY,IAAE,CAAC,IAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,KAAG,IAAI,CAAC,YAAY,GAAC,CAAC,CAAC,CAAC,IAAE,IAAI,CAAC,YAAY,GAAC,CAAC,CAAC,KAAG,MAAM,EAAC,CAAC;YAC/G,IAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,CAAC;gBAAC,MAAM,KAAK,CAAC,wEAAwE,CAAC,CAAC;YAC9H,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,MAAM,CAAC,OAAO,EAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAAA,CAAC;IAAA,OAAM,KAAK,EAAC,CAAC;QAChD,IAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAC,MAAM,CAAC,EAAC,aAAa,EAAC,CAAC,EAAC,KAAK,EAAC,OAAO,CAAC,KAAK,CAAC,EAAC,CAAC,CAAC;;YACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAC,IAAI,CAAC,CAAC;QAAA,OAAO,CAAC,QAAQ,GAAC,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAc,EAAC,IAAa;IACvD,MAAM,EAAC,KAAK,EAAC,UAAU,EAAC,GAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAAA,MAAM,IAAI,GAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,KAAK,GAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,EAAC,YAAY,EAAC,QAAQ,EAAC,WAAW,EAAC,QAAQ,EAAC,eAAe,EAAC,cAAc,EAAC,WAAW,EAAC,kBAAkB,EAAC,YAAY,EAAC,SAAS,EAAC,QAAQ,EAAC,UAAU,EAAC,SAAS,EAAC,WAAW,EAAC,UAAU,EAAC,YAAY,EAAC,oBAAoB,EAAC,aAAa,EAAC,YAAY,EAAC,gBAAgB,EAAC,cAAc,EAAC,YAAY,EAAC,UAAU,EAAC,QAAQ,CAAC,CAAC,CAAC;IACtV,KAAI,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;QAAC,IAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAC,MAAM,KAAK,CAAC,kBAAkB,GAAC,IAAI,CAAC,CAAC;IACxF,IAAG,OAAO,KAAG,UAAU,EAAC,CAAC;QACvB,MAAM,EAAE,GAAC,UAAU,CAAC,CAAC,CAAC,IAAE,MAAM,CAAC;QAC/B,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YACd,MAAM,QAAQ,GAAC,MAAM,YAAY,EAAE,CAAC;YAAA,MAAM,QAAQ,GAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA,EAAE,CAAA,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACtH,MAAM,SAAS,GAAC,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,IAAG,IAAI;gBAAC,MAAM,CAAC,EAAC,aAAa,EAAC,CAAC,EAAC,iBAAiB,EAAC,QAAQ,CAAC,iBAAiB,EAAC,SAAS,EAAC,CAAC,CAAC;iBACpF,CAAC;gBACJ,IAAG,CAAC,SAAS,CAAC,MAAM,EAAC,CAAC;oBACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM;wBAC5C,CAAC,CAAA,6GAA6G;wBAC9G,CAAC,CAAA,iCAAiC,CAAC,CAAC;oBACtC,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAC,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAC,CAAC,EAAC,GAAG,EAAC,EAAE;oBACvD,MAAM,GAAG,GAAC,QAAQ,CAAC,GAAG,CAAE,CAAC;oBACzB,MAAM,GAAG,GAAC,CAAC,CAAC,MAAM,EAAE,MAAM,IAAE,CAAC,MAAM,kBAAkB,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAE,EAAE,CAAA,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC;oBACpF,MAAM,IAAI,GAAC,CAAC,CAAC,UAAU,KAAG,QAAQ,CAAC,iBAAiB,CAAA,CAAC,CAAA,GAAG,CAAA,CAAC,CAAA,GAAG,CAAC;oBAC7D,MAAM,KAAK,GAAC,CAAC,CAAC,QAAQ,CAAA,CAAC,CAAA,UAAU,CAAA,CAAC,CAAA,CAAC,CAAC,WAAW,KAAG,SAAS,CAAA,CAAC,CAAA,GAAG,CAAC,CAAC,KAAK,YAAY,CAAA,CAAC,CAAA,CAAC,CAAC,KAAK,CAAC;oBAC3F,MAAM,IAAI,GAAC,GAAG,EAAE,UAAU,KAAG,SAAS,CAAA,CAAC,CAAA,QAAQ,CAAA,CAAC,CAAA,CAAC,CAAC,CAAC,aAAa,IAAE,WAAW,CAAC,CAAC;oBAC/E,MAAM,IAAI,GAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAE,GAAG,CAAC,CAAC;oBAC/B,MAAM,SAAS,GAAC,GAAG,EAAE,WAAW,IAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;oBAChD,OAAO,EAAC,IAAI,EAAC,IAAI,EAAC,CAAC,CAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,IAAI,EAAC,SAAS,EAAC,CAAC;gBACtD,CAAC,CAAC,CAAC,CAAC;gBACJ,MAAM,KAAK,GAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtD,MAAM,MAAM,GAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBACxD,MAAM,KAAK,GAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtD,MAAM,KAAK,GAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBAC7I,KAAI,MAAM,CAAC,IAAI,IAAI,EAAC,CAAC;oBACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC;gBAC3J,CAAC;YACH,CAAC;YAAA,OAAO;QACV,CAAC;QACD,IAAG,EAAE,KAAG,QAAQ,EAAC,CAAC;YAChB,MAAM,MAAM,GAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;YAAA,MAAM,QAAQ,GAAC,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,IAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,SAAS,EAAC,EAAC,MAAM,EAAC,CAAC,CAAC;YAC7H,MAAM,CAAC,EAAC,QAAQ,EAAC,OAAO,EAAC,mCAAmC,GAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;YAAA,OAAO;QACtG,CAAC;QACD,IAAG,EAAE,KAAG,QAAQ,EAAC,CAAC;YAChB,MAAM,IAAI,GAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAA,IAAG,CAAC,IAAI;gBAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACtE,MAAM,MAAM,GAAC,MAAM,cAAc,CAAC,WAAW,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAA,gBAAgB,CAAC,MAAM,EAAC,KAAK,CAAC,CAAC;YAC3H,MAAM,CAAC,EAAC,QAAQ,EAAC,MAAM,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAC,CAAC;gBAChI,OAAO,EAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,gDAAgD,CAAA,CAAC,CAAA,+DAA+D,EAAC,CAAC,CAAC;YAAA,OAAO;QAC1J,CAAC;QACD,IAAG,EAAE,KAAG,SAAS,EAAC,CAAC;YACjB,MAAM,EAAC,aAAa,EAAC,GAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YAAA,MAAM,CAAC,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,EAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAA,OAAO;QAC9J,CAAC;QACD,MAAM,QAAQ,GAAC,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,IAAE,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,EAAC,OAAO,EAAE,EAAC,EAAE,KAAG,SAAS,CAAC,CAAC;QACtG,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YACd,MAAM,MAAM,GAAC,EAAC,GAAG,CAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAC,IAAI,EAAC,MAAM,WAAW,EAAE,EAAC,CAAC;YACvF,MAAM,MAAM,GAAC,MAAM,mBAAmB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;YAAA,MAAM,IAAI,GAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC;YACjH,MAAM,OAAO,GAAC,MAAM,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,IAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,QAAQ,CAAC,IAAI,GAAC,OAAO,EAAC,EAAC,MAAM,EAAC,cAAc,EAAC,QAAQ,CAAC,cAAc,KAAG,SAAS,CAAA,CAAC,CAAA,QAAQ,CAAC,cAAc,CAAA,CAAC,CAAA,IAAI,EAAC,CAAC,CAAC;YACvL,IAAG,IAAI;gBAAC,MAAM,CAAC,EAAC,QAAQ,EAAC,OAAO,EAAC,OAAO,EAAC,iEAAiE,EAAC,CAAC,CAAC;;gBACxG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,QAAQ,CAAC,IAAI,SAAS,OAAO,CAAC,IAAI,WAAW,MAAM,CAAC,IAAI,gDAAgD,CAAC,CAAC;YAC/I,OAAO;QACT,CAAC;QACD,MAAM,cAAc,CAAC,KAAK,EAAC,QAAQ,EAAA,EAAE;YACnC,MAAM,IAAI,GAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,CAAC,EAAE,CAAE,CAAC;YAC3D,IAAG,EAAE,KAAG,QAAQ,EAAC,CAAC;gBAChB,MAAM,IAAI,GAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAAA,IAAG,CAAC,IAAI;oBAAC,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC;gBAAA,IAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,KAAG,IAAI,CAAC;oBAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAAA,IAAI,CAAC,IAAI,GAAC,IAAI,CAAC;YACjK,CAAC;iBAAK,IAAG,EAAE,KAAG,SAAS;gBAAC,QAAQ,CAAC,iBAAiB,GAAC,IAAI,CAAC,EAAE,CAAC;iBACtD,IAAG,EAAE,KAAG,SAAS,IAAE,EAAE,KAAG,QAAQ,EAAC,CAAC;gBAAA,MAAM,OAAO,GAAC,MAAM,eAAe,CAAC,QAAQ,EAAC,MAAM,CAAC,CAAC;gBAAA,IAAG,OAAO,IAAE,OAAO,CAAC,KAAK,KAAG,SAAS;oBAAC,MAAM,KAAK,CAAC,wBAAwB,CAAC,CAAC;gBAAA,IAAI,CAAC,QAAQ,GAAC,IAAI,CAAC;gBAAA,IAAG,QAAQ,CAAC,iBAAiB,KAAG,IAAI,CAAC,EAAE;oBAAC,QAAQ,CAAC,iBAAiB,GAAC,IAAI,CAAC;YAAA,CAAC;iBAC/P,IAAG,EAAE,KAAG,SAAS;gBAAC,IAAI,CAAC,QAAQ,GAAC,KAAK,CAAC;;gBACtC,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QACH,IAAG,IAAI;YAAC,MAAM,CAAC,EAAC,MAAM,EAAC,IAAI,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,CAAC,CAAC;aAChD,IAAG,EAAE,KAAG,QAAQ;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,QAAQ,CAAC,IAAI,SAAS,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;aAC7F,IAAG,EAAE,KAAG,SAAS;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC;aACxF,IAAG,EAAE,KAAG,SAAS,IAAE,EAAE,KAAG,QAAQ;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC;aACjG,IAAG,EAAE,KAAG,SAAS;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IACD,IAAG,OAAO,KAAG,QAAQ,IAAE,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAE,CAAC,CAAC,IAAI,IAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC,UAAU,EAAC,CAAC,MAAM,EAAC,GAAG,CAAC,IAAI,CAAA,CAAC,CAAA,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,EAAE,CAAC,CAAC,CAAC,CAAC;IACxI,MAAM,OAAO,GAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,QAAQ,GAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACrC,IAAG,OAAO,IAAE,OAAO,KAAG,MAAM,EAAC,CAAC;QAC5B,MAAM,MAAM,GAAC,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,MAAM,KAAG,OAAO,CAAC,CAAC;QAAA,IAAG,CAAC,MAAM;YAAC,MAAM,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAAA,QAAQ,GAAC,MAAM,CAAC,EAAE,CAAC;IACrJ,CAAC;IACD,IAAG,OAAO,KAAG,OAAO,IAAE,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC,SAAS,CAAC,MAAM,EAAC,CAAC;QAAA,MAAM,MAAM,CAAC,UAAU,EAAC,CAAC,QAAQ,EAAC,SAAS,EAAC,GAAG,IAAI,CAAC,CAAC,CAAC;QAAA,OAAO;IAAA,CAAC;IAC9H,MAAM,QAAQ,GAAC,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAC;IAAA,MAAM,CAAC,GAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC/E,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;QAAA,MAAM,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAA,OAAO;IAAA,CAAC;IACtE,IAAG,OAAO,KAAG,KAAK,EAAC,CAAC;QAClB,IAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAC,MAAM,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAClG,MAAM,WAAW,CAAC,QAAQ,EAAC,EAAC,IAAI,EAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA,CAAC,CAAA,EAAC,YAAY,EAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,CAAC,CAAC;QAAA,OAAO;IACvI,CAAC;IACD,IAAG,OAAO,KAAG,MAAM,EAAC,CAAC;QAAA,MAAM,CAAC,EAAC,MAAM,EAAC,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAC,MAAM,CAAC,CAAC,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,iBAAiB,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,CAAC,CAAC;QAAA,OAAO;IAAA,CAAC;IAC1I,IAAG,OAAO,KAAG,SAAS,EAAC,CAAC;QAAA,MAAM,MAAM,CAAC,QAAQ,EAAC,CAAC,OAAO,EAAC,YAAY,EAAC,QAAQ,CAAC,EAAE,EAAC,GAAG,CAAC,IAAI,CAAA,CAAC,CAAA,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,EAAE,CAAC,CAAC,CAAC,CAAC;QAAA,OAAO;IAAA,CAAC;IAClH,IAAG,OAAO,KAAG,OAAO,EAAC,CAAC;QACpB,MAAM,OAAO,GAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAAA,MAAM,MAAM,GAAC,MAAM,MAAM,CAAC,KAAK,EAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACjG,MAAM,mBAAmB,CAAC,QAAQ,EAAC,MAAM,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAAA,MAAM,CAAC,EAAC,MAAM,EAAC,OAAO,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,OAAO,EAAC,gDAAgD,EAAC,CAAC,CAAC;QAAA,OAAO;IAC9K,CAAC;IACD,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;QACrB,MAAM,EAAE,GAAC,UAAU,CAAC,CAAC,CAAC,IAAE,MAAM,CAAC;QAC/B,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YAAA,IAAG,IAAI;gBAAC,MAAM,CAAC,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,GAAG,CAAC,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,CAAC,CAAC;;gBAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,GAAC,IAAI,CAAC,CAAC;YAAA,OAAO;QAAA,CAAC;QAClJ,IAAG,EAAE,KAAG,QAAQ,EAAC,CAAC;YAAA,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAAA,OAAO;QAAA,CAAC;QACrD,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YACd,IAAG,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAC,CAAC;gBAC3B,MAAM,MAAM,GAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;gBACrD,IAAG,IAAI;oBAAC,MAAM,CAAC,MAAM,CAAC,CAAC;qBAClB,IAAG,CAAC,MAAM;oBAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,QAAQ,CAAC,IAAI,yCAAyC,CAAC,CAAC;;oBACpG,OAAO,CAAC,MAAM,CAAC,KAAK,CACvB,kBAAkB,QAAQ,CAAC,IAAI,+BAA+B;wBAC9D,kBAAkB,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI;wBAC/C,kBAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI;wBACxC,kBAAkB,MAAM,CAAC,MAAM,CAAC,UAAU,KAAG,SAAS,CAAA,CAAC,CAAA,kCAAkC,CAAA,CAAC,CAAA,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI;wBAChH,kBAAkB,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI;wBAC3C,kBAAkB,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,CACrD,CAAC;YACJ,CAAC;iBAAI,CAAC;gBACJ,MAAM,IAAI,GAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAG,SAAS,CAAC,CAAC;gBACpF,IAAI,MAAM,GAAqB,IAAI,CAAC;gBAAA,IAAI,OAAO,GAAa,IAAI,CAAC;gBACjE,IAAG,CAAC;oBAAA,MAAM,GAAC,MAAM,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAA,CAAC;gBAAA,OAAM,CAAC,EAAC,CAAC;oBAAA,OAAO,GAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAAA,CAAC;gBACjF,IAAG,IAAI;oBAAC,MAAM,CAAC,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,IAAI,EAAC,MAAM,EAAC,OAAO,EAAC,QAAQ,EAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAC,IAAI,CAAC,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,CAAC,CAAC;qBAClI,IAAG,OAAO,IAAE,CAAC,MAAM;oBAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,QAAQ,CAAC,IAAI,oBAAoB,QAAQ,CAAC,MAAM,CAAC,IAAI,oBAAoB,OAAO,IAAE,uBAAuB,IAAI,CAAC,CAAC;;oBAC1K,OAAO,CAAC,MAAM,CAAC,KAAK,CACvB,kBAAkB,QAAQ,CAAC,IAAI,IAAI;wBACnC,kBAAkB,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK;wBACpE,kBAAkB,MAAM,CAAC,WAAW,IAAI;wBACxC,kBAAkB,MAAM,CAAC,IAAI,IAAI;wBACjC,kBAAkB,MAAM,CAAC,UAAU,KAAG,SAAS,CAAA,CAAC,CAAA,kCAAkC,CAAA,CAAC,CAAA,MAAM,CAAC,IAAI,IAAI;wBAClG,kBAAkB,MAAM,CAAC,OAAO,IAAI;wBACpC,kBAAkB,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM;wBAC/C,YAAY;wBACZ,qCAAqC,QAAQ,CAAC,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI;wBAC5F,sCAAsC,QAAQ,CAAC,IAAI,KAAG,SAAS,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAC9F,CAAC;YACJ,CAAC;YAAA,OAAO;QACV,CAAC;QACD,IAAG,EAAE,KAAG,SAAS,EAAC,CAAC;YACjB,MAAM,QAAQ,GAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;YAAA,IAAG,CAAC,QAAQ;gBAAC,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACjH,MAAM,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,MAAM,GAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAC,cAAc,CAAC,CAAC;YAC9C,MAAM,cAAc,CAAC,KAAK,EAAC,QAAQ,EAAA,EAAE;gBACnC,IAAG,MAAM,MAAM,CAAC,MAAM,CAAC;oBAAC,MAAM,KAAK,CAAC,mEAAmE,CAAC,CAAC;gBACzG,MAAM,aAAa,CAAC,MAAM,EAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5D,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,CAAC,EAAE,CAAE,CAAC,MAAM,GAAC,EAAC,IAAI,EAAC,SAAS,EAAC,IAAI,EAAC,MAAM,EAAC,CAAC;YACtF,CAAC,CAAC,CAAC;YAAA,MAAM,CAAC,EAAC,MAAM,EAAC,0BAA0B,EAAC,IAAI,EAAC,MAAM,EAAC,CAAC,CAAC;YAAA,OAAO;QACpE,CAAC;QACD,IAAG,EAAE,KAAG,QAAQ,EAAC,CAAC;YAChB,MAAM,MAAM,GAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAA,MAAM,IAAI,GAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAA,IAAG,CAAC,IAAI,IAAE,CAAE,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC/I,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAC,cAAc,CAAC,CAAC;YAC7C,MAAM,QAAQ,CAAC,IAAI,GAAC,OAAO,EAAC,KAAK,IAAE,EAAE;gBACnC,MAAM,OAAO,GAAuB,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,KAAK,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,CAA0B,CAAA,CAAC,CAAA,EAAE,CAAC;gBACvH,IAAG,MAAM,KAAG,KAAK;oBAAC,OAAO,CAAC,IAAI,CAAC,GAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAC,EAAE,CAAC,CAAC;qBACpE,IAAG,MAAM,KAAG,QAAQ;oBAAC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;;oBAAK,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;gBACzF,MAAM,aAAa,CAAC,IAAI,EAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACpD,CAAC,CAAC,CAAC;YAAA,MAAM,CAAC,EAAC,MAAM,EAAC,gBAAgB,EAAC,IAAI,EAAC,CAAC,CAAC;YAAA,OAAO;QACnD,CAAC;QACD,IAAG,EAAE,KAAG,QAAQ,IAAE,EAAE,KAAG,QAAQ,EAAC,CAAC;YAC/B,MAAM,IAAI,GAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAE,UAAU,CAAC,CAAC,CAAC,CAAC;YAAA,MAAM,MAAM,GAAC,EAAE,KAAG,QAAQ,CAAA,CAAC,CAAA,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC;YACjH,IAAG,EAAE,KAAG,QAAQ,IAAE,CAAC,IAAI;gBAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAC,EAAE,KAAG,QAAQ,CAAA,CAAC,CAAA,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAC,cAAc,CAAC,CAAA,CAAC,CAAA,IAAI,CAAC,OAAO,CAAC,IAAK,CAAC,CAAC;YAChF,IAAG,EAAE,KAAG,QAAQ;gBAAC,MAAM,cAAc,CAAC,WAAW,CAAC,MAAM,WAAW,CAAC,MAAM,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACpF,MAAM,cAAc,CAAC,KAAK,EAAC,QAAQ,EAAA,EAAE;gBACnC,IAAG,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,CAAC,EAAE,IAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAG,MAAM,CAAC;oBAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC9G,IAAG,MAAM;oBAAC,MAAM,aAAa,CAAC,MAAM,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBAClD,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,CAAC,EAAE,CAAE,CAAC,MAAM,GAAC,EAAC,IAAI,EAAC,EAAE,KAAG,QAAQ,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,QAAQ,EAAC,IAAI,EAAC,MAAM,EAAC,CAAC;YAC7G,CAAC,CAAC,CAAC;YAAA,MAAM,CAAC,EAAC,MAAM,EAAC,gBAAgB,EAAC,IAAI,EAAC,MAAM,EAAC,CAAC,CAAC;YAAA,OAAO;QAC1D,CAAC;QACD,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YACd,MAAM,IAAI,GAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA,CAAC,CAAA,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,EAAC,KAAK,CAAC,CAAA,CAAC,CAAA,MAAM,SAAS,EAAE,CAAC;YAC7G,MAAM,KAAK,GAAC,MAAM,kBAAkB,CAAC,QAAQ,EAAC,IAAI,EAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAE,EAAE,CAAC,CAAC;YAAA,MAAM,CAAC,EAAC,MAAM,EAAC,OAAO,EAAC,QAAQ,EAAC,KAAK,CAAC,QAAQ,EAAC,CAAC,CAAC;YAAA,OAAO;QAC1I,CAAC;QACD,IAAG,EAAE,KAAG,OAAO,EAAC,CAAC;YACf,MAAM,KAAK,GAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAE,MAAM,SAAS,EAAE,CAA2B,CAAC;YAC1F,IAAG,KAAK,CAAC,UAAU,KAAG,SAAS,IAAE,CAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,KAAG,SAAS;gBAAC,gBAAgB,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,GAAG,CAAC,CAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAC,GAAG,KAAK,EAAC,CAAC,CAAC,EAAC,KAAK,CAAC,CAAC;YACrN,MAAM,CAAC,EAAC,MAAM,EAAC,OAAO,EAAC,QAAQ,EAAC,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAC,KAAK,EAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAC,CAAC,CAAC;YAAA,OAAO;QAC5H,CAAC;QACD,MAAM,MAAM,GAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAG,EAAE,KAAG,UAAU,EAAC,CAAC;YAClB,IAAG,IAAI;gBAAC,MAAM,CAAC,EAAC,MAAM,EAAC,OAAO,EAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,CAAC,CAAC;;gBAC5E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YACd,MAAM,MAAM,GAAC,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,IAAE,IAAI,CAAC;YACnE,MAAM,OAAO,GAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAC,KAAK,CAAC,EAAC,EAAE,CAAA,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,GAA2B,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAC,KAAK,CAAC,EAAC,EAAE,CAAA,CAAC,EAAC,KAAK,EAAC,MAAM,EAAC,MAAM,EAAE,CAAC,KAA6B,CAAC,IAAE,IAAI,EAAC,KAAK,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC;YAClP,IAAG,IAAI;gBAAC,MAAM,CAAC,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,QAAQ,EAAC,MAAM,CAAC,QAAQ,EAAC,OAAO,EAAC,CAAC,CAAC;iBACrE,IAAG,CAAC,OAAO,CAAC,MAAM;gBAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;iBAChF,CAAC;gBACH,KAAI,MAAM,CAAC,IAAI,OAAO;oBAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzH,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAG,EAAE,KAAG,OAAO,EAAC,CAAC;YACf,MAAM,KAAK,GAAC,MAAM,eAAe,CAAC,QAAQ,EAAC,OAAO,EAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,IAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7F,IAAG,IAAI;gBAAC,MAAM,CAAC,EAAC,MAAM,EAAC,KAAK,CAAA,CAAC,CAAA,SAAS,CAAA,CAAC,CAAA,qBAAqB,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,OAAO,EAAC,KAAK,EAAC,CAAC,CAAC;;gBAC/F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAA,CAAC,CAAA,6BAA6B,QAAQ,CAAC,IAAI,MAAM,CAAA,CAAC,CAAA,mEAAmE,CAAC,CAAC;YACtJ,OAAO;QACT,CAAC;QACD,IAAG,EAAE,KAAG,QAAQ,EAAC,CAAC;YAChB,MAAM,IAAI,GAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAAA,MAAM,IAAI,GAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1E,IAAG,IAAI,EAAC,CAAC;gBAAA,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,IAAI,EAAC,EAAC,IAAI,EAAC,IAAI,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;gBAAA,MAAM,CAAC,EAAC,MAAM,EAAC,UAAU,EAAC,IAAI,EAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC;YAAA,CAAC;;gBAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAA,OAAO;QACvK,CAAC;QACD,IAAG,EAAE,KAAG,MAAM,EAAC,CAAC;YACd,MAAM,MAAM,GAAC,OAAO,CAAC,GAAG,CAAC,MAAM,IAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;YAAA,IAAG,CAAC,MAAM;gBAAC,MAAM,KAAK,CAAC,kEAAkE,CAAC,CAAC;YAC/I,MAAM,IAAI,GAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAC,eAAe,CAAC,CAAC,CAAC;YAAA,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,cAAc,CAAC,CAAC;YACxH,IAAG,CAAC;gBAAA,MAAM,SAAS,CAAC,IAAI,EAAC,MAAM,CAAC,IAAI,EAAC,EAAC,IAAI,EAAC,KAAK,EAAC,CAAC,CAAC;gBAAA,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAC,MAAM,EAAC,EAAE,GAAC,MAAM,KAAK,GAAC,KAAK,CAAC,MAAM,EAAC,CAAC,IAAI,CAAC,EAAC,EAAC,KAAK,EAAC,SAAS,EAAC,CAAC,CAAC,CAAA,KAAK,CAAC,IAAI,CAAC,OAAO,EAAC,MAAM,CAAC,CAAC,CAAA,KAAK,CAAC,IAAI,CAAC,MAAM,EAAC,IAAI,CAAA,EAAE,CAAA,IAAI,KAAG,CAAC,CAAA,CAAC,CAAA,OAAO,EAAE,CAAA,CAAC,CAAA,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC;gBACxP,MAAM,IAAI,GAAC,MAAM,QAAQ,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC;gBAAA,MAAM,kBAAkB,CAAC,QAAQ,EAAC,IAAI,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAAA,MAAM,CAAC,EAAC,MAAM,EAAC,OAAO,EAAC,OAAO,EAAC,qCAAqC,EAAC,CAAC,CAAC;YACxK,CAAC;oBAAO,CAAC;gBAAA,MAAM,EAAE,CAAC,IAAI,EAAC,EAAC,SAAS,EAAC,IAAI,EAAC,KAAK,EAAC,IAAI,EAAC,CAAC,CAAC;YAAA,CAAC;YAAA,OAAO;QAC9D,CAAC;QACD,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvC,CAAC;IACD,IAAG,OAAO,KAAG,MAAM,EAAC,CAAC;QACnB,MAAM,IAAI,GAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAC,UAAU,CAAC,CAAC;QAAA,MAAM,KAAK,GAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/G,IAAG,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAE,EAAE,CAAC,CAAC,IAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAE,EAAE,CAAC,GAAC,CAAC,IAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAE,EAAE,CAAC,GAAC,GAAG;YAAC,MAAM,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACnL,MAAM,IAAI,GAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAA,CAAC,CAAA,CAAC,MAAM,WAAW,CAAC,IAAI,EAAC,IAAI,EAAC,EAAE,GAAC,IAAI,GAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA,CAAC,CAAA,cAAc,CAAC;QAC9H,IAAG,IAAI;YAAC,MAAM,CAAC,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,MAAM,EAAC,IAAI,EAAC,CAAC,CAAC;;YAAK,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAC,IAAI,CAAC,CAAC;QAAA,OAAO;IACnG,CAAC;IACD,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAC,CAAC,CAAC,MAAM,CAAC;QACzC,MAAM,KAAK,GAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,CAAC,EAAC,EAAE,CAAA,IAAI,CAAC,CAAC,CAAC,KAAG,YAAY,IAAE,IAAI,CAAC,CAAC,GAAC,CAAC,CAAC,KAAG,YAAY,IAAE,IAAI,CAAC,CAAC,CAAC,KAAG,WAAW,IAAE,IAAI,CAAC,CAAC,GAAC,CAAC,CAAC,KAAG,WAAW,CAAC,CAAC;QACjI,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACzD,IAAG,UAAU,CAAC,CAAC,CAAC,KAAG,MAAM,EAAC,CAAC;YAAA,MAAM,IAAI,GAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAA,IAAG,IAAI,KAAG,SAAS,IAAE,IAAI,KAAG,SAAS,IAAE,IAAI,KAAG,OAAO;gBAAC,MAAM,cAAc,CAAC,KAAK,EAAC,CAAC,EAAA,EAAE,GAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,QAAQ,CAAC,EAAE,CAAE,CAAC,cAAc,GAAC,IAAI,CAAC,CAAA,CAAC,CAAC,CAAC;QAAA,CAAC;QAC1M,OAAO;IACT,CAAC;IACD,IAAG,OAAO,KAAG,aAAa,EAAC,CAAC;QAC1B,MAAM,MAAM,GAAC,MAAM,qBAAqB,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,MAAM,EAAC,CAAC,CAAC;QAAA,MAAM,IAAI,GAAC,MAAM,eAAe,CAAC,EAAC,IAAI,EAAC,CAAC,CAAC,IAAI,EAAC,CAAC,CAAC;QAAA,MAAM,EAAE,GAAC,UAAU,CAAC,CAAC,CAAC,IAAE,QAAQ,CAAC;QAC3I,IAAG,EAAE,KAAG,OAAO;YAAC,MAAM,CAAC,EAAC,KAAK,EAAC,MAAM,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,EAAC,CAAC,CAAC;aAC/D,IAAG,EAAE,KAAG,QAAQ;YAAC,MAAM,CAAC,EAAC,MAAM,EAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAC,MAAM,EAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,EAAC,CAAC,CAAC;aACvF,IAAG,CAAC,cAAc,EAAC,aAAa,EAAC,gBAAgB,EAAC,iBAAiB,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,EAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACrJ,CAAC;YAAA,MAAM,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,EAAC,EAAC,MAAM,EAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAC,IAAI,EAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAC,CAAC,CAAC,CAAC;QAAA,CAAC;QAAA,OAAO;IACxG,CAAC;IACD,MAAM,MAAM,GAAC,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;QACrB,MAAM,EAAC,iBAAiB,EAAC,GAAC,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAAA,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACjG,MAAM,MAAM,GAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAC,MAAM,EAAC,MAAM,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,MAAM,EAAC,QAAQ,CAAC,MAAM,EAAC,MAAM,EAAC,MAAM,CAAC,MAAM,EAAC,WAAW,EAAC,MAAM,CAAC,WAAW;YACrH,OAAO,EAAC,0FAA0F,EAAC,CAAC,CAAC;QAAA,OAAO;IAChH,CAAC;IACD,IAAG,OAAO,KAAG,SAAS,EAAC,CAAC;QACtB,MAAM,MAAM,GAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAAA,IAAG,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI;YAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACzG,MAAM,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,aAAa,CAAC,EAAC,IAAI,EAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAC,IAAI,EAAC,OAAO,EAAE,EAAC,GAAG,EAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAC,MAAM,EAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAE,IAAI,EAAC,CAAC,CAAC,CAAC;QAAA,OAAO;IACtL,CAAC;IACD,IAAG,OAAO,KAAG,QAAQ,EAAC,CAAC;QACrB,MAAM,KAAK,GAAC,MAAM,eAAe,CAAC,QAAQ,EAAC,QAAQ,CAAC,CAAC;QAAA,IAAG,KAAK,EAAE,KAAK,KAAG,SAAS,IAAE,CAAC,KAAK,CAAC,IAAI;YAAC,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAClI,MAAM,QAAQ,GAAC,oBAAoB,KAAK,CAAC,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAAC,MAAM,KAAK,CAAC,QAAQ,GAAC,UAAU,EAAC,EAAC,MAAM,EAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,EAAE,CAAyB,CAAC;QAC3H,IAAG,MAAM,CAAC,UAAU,KAAG,QAAQ,CAAC,EAAE;YAAC,MAAM,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACpF,MAAM,OAAO,GAAC,KAAK,EAAC,MAAa,EAAC,MAAc,EAAC,EAAE;YACjD,MAAM,KAAK,GAAC,MAAM,KAAK,CAAC,QAAQ,GAAC,MAAM,EAAC,EAAC,MAAM,EAAC,MAAM,EAAC,OAAO,EAAC,EAAC,cAAc,EAAC,kBAAkB,EAAC,MAAM,EAAC,qCAAqC,EAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAA,CAAC,CAAA,EAAC,aAAa,EAAC,SAAS,GAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAC,CAAA,CAAC,CAAA,EAAE,CAAC,EAAC,EAAC,IAAI,EAAC,IAAI,CAAC,SAAS,CAAC,EAAC,OAAO,EAAC,KAAK,EAAC,EAAE,EAAC,CAAC,EAAC,MAAM,EAAC,MAAM,EAAC,CAAC,EAAC,MAAM,EAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAC,CAAC,CAAC;YACtU,IAAG,CAAC,KAAK,CAAC,EAAE;gBAAC,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,KAAG,GAAG,CAAA,CAAC,CAAA,uDAAuD,CAAA,CAAC,CAAA,yBAAyB,CAAC,CAAC;YAC/H,MAAM,IAAI,GAAC,MAAM,KAAK,CAAC,IAAI,EAAiD,CAAC;YAAA,IAAG,IAAI,CAAC,KAAK,IAAE,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAC,MAAM,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAAA,OAAO,IAAI,CAAC,MAAM,CAAC;QAC7K,CAAC,CAAC;QACF,MAAM,OAAO,CAAC,YAAY,EAAC,EAAE,CAAC,CAAC;QAAA,MAAM,OAAO,CAAC,YAAY,EAAC,EAAC,IAAI,EAAC,gBAAgB,EAAC,SAAS,EAAC,EAAC,IAAI,EAAC,GAAG,EAAC,KAAK,EAAC,CAAC,EAAC,EAAC,CAAC,CAAC;QAChH,MAAM,CAAC,EAAC,MAAM,EAAC,MAAM,EAAC,UAAU,EAAC,QAAQ,CAAC,EAAE,EAAC,IAAI,EAAC,KAAK,CAAC,IAAI,EAAC,oBAAoB,EAAC,KAAK,EAAC,CAAC,CAAC;QAAA,OAAO;IACnG,CAAC;AACH,CAAC","sourcesContent":["import {createInterface} from 'node:readline/promises';\nimport {spawn} from 'node:child_process';\nimport {readFile,writeFile,mkdtemp,rm,realpath} from 'node:fs/promises';\nimport {tmpdir,homedir} from 'node:os';\nimport path from 'node:path';\nimport {createAccessControl} from '../access-control.js';\nimport {createWorkspaceGrants} from '../workspace-grants.js';\nimport {createDenyRules} from '../explicit-deny-rules.js';\nimport {createPrivateDirectory} from '../platform.js';\nimport {instanceStatus,instanceRequest,runInstance} from '../instance-runtime.js';\nimport {atomicPrivate,changeRegistry,configJSONSchema,sourceRevision,configTemplate,createInstance,exists,fingerprint,instanceConfigSchema,instanceEnv,instancePaths,instancesRoot,loadInstanceConfig,parseConfig,patchInstanceConfig,readRegistry,readTrusted,resolveInstance,saveInstanceConfig,suggestPort,validateConfig,withLock,type Instance,type InstanceConfig} from '../instance-store.js';\n\nconst booleans=new Set(['--json','--all','--link','--archived','--approve-trusted-developer','--approve-unrestricted','--confirm','--effective','--allow-loopback-http']);\nfunction options(args:string[]){\n  const flags=new Map<string,string>();const positional:string[]=[];\n  for(let i=0;i<args.length;i++){const arg=args[i]!;if(!arg.startsWith('--')){positional.push(arg);continue;}\n    if(flags.has(arg))throw Error('DUPLICATE_OPTION: '+arg);\n    if(booleans.has(arg))flags.set(arg,'true');else {if(!args[i+1]||args[i+1]!.startsWith('--'))throw Error('MISSING_OPTION_VALUE: '+arg);flags.set(arg,args[++i]!);}\n  }\n  return {flags,positional};\n}\nconst message=(error:unknown)=>error instanceof Error?error.message:'UNKNOWN_ERROR';\nasync function readInput(){let text='';for await(const chunk of process.stdin){text+=String(chunk);if(text.length>262144)throw Error('CONFIG_TOO_LARGE');}return text;}\nfunction output(value:unknown){process.stdout.write(JSON.stringify(value,null,2)+'\\n');}\nfunction requireApprovals(config:InstanceConfig,flags:Map<string,string>){\n  if(config.accessRole==='trusted'&&!flags.has('--approve-trusted-developer'))throw Error('TRUSTED_APPROVAL_REQUIRED: add --approve-trusted-developer');\n  if(config.accessRole==='trusted'&&process.platform!=='darwin'&&!flags.has('--approve-unrestricted'))throw Error('UNRESTRICTED_APPROVAL_REQUIRED: add --approve-unrestricted');\n}\nasync function wizard(flags:Map<string,string>,current?:InstanceConfig){\n  let project=flags.get('--project')??current?.projectRoot;let role=flags.get('--access-role')??current?.accessRole??'restricted';\n  let port=Number(flags.get('--port')??current?.port??await suggestPort());\n  if(!project){\n    if(!process.stdin.isTTY)throw Error('PROJECT_REQUIRED: use --project /absolute/directory');\n    const rl=createInterface({input:process.stdin,output:process.stderr});\n    try{project=await rl.question('Work directory: ');role=(await rl.question('Capability (restricted / trusted) [restricted]: '))||'restricted';\n      if(role==='trusted'&&(await rl.question('Enable native tools and Shell as your OS account? Type yes: '))==='yes'){\n        flags.set('--approve-trusted-developer','true');if(process.platform!=='darwin')flags.set('--approve-unrestricted','true');\n      }\n      port=Number((await rl.question(`Local port [${port}]: `))||port);\n    }finally{rl.close();}\n  }\n  const config=instanceConfigSchema.parse({...current,schemaVersion:1,projectRoot:await realpath(path.resolve(project)),port,\n    accessRole:role,mode:current?.accessRole===role?current.mode:role==='trusted'?'read-write':'read-only',writeScope:current?.accessRole===role?current.writeScope:role==='trusted'&&process.platform==='darwin'?'home-only':'unrestricted',connection:flags.get('--connection')??current?.connection??'local'});\n  requireApprovals(config,flags);return validateConfig(config);\n}\nexport async function maybeHandleInstances(argv:string[]):Promise<boolean>{\n  let command=argv[0]??'help';\n  if(command==='start-setup'&&!process.env.MAC_MCP_INTERNAL_SETUP_OWNER_PID){command='run';argv=['run','--profile','setup',...argv.slice(1)];}\n  if(command==='doctor-setup'){command='doctor';argv=['doctor','--profile','setup',...argv.slice(1)];}\n  const supported=['instance','config','run','status','stop','restart','logs','doctor','verify','access','permissions','privacy','setup'];\n  if(!supported.includes(command))return false;\n  try {\n  const explicit=argv.includes('--instance');const registry=await readRegistry();\n  const managed=registry.instances.length>0;\n  const firstWizard=command==='setup'&&argv.length===1&&process.stdin.isTTY;\n  if(!['instance','config'].includes(command)&&!explicit&&!managed&&!firstWizard)return false;\n  // A retained legacy profile remains available until the owner migrates it.\n  const profileIndex=argv.indexOf('--profile');\n  if(profileIndex>=0&&!registry.instances.some(i=>i.legacy===argv[profileIndex+1])&&argv[profileIndex+1]!=='auto'){\n    if(registry.instances.some(i=>i.legacy))throw Error('LEGACY_PROFILE_NOT_MIGRATED_USE_INSTANCE: select --instance explicitly');\n    return false;\n  }\n  await handle(command,argv.slice(1));}catch(error){\n    if(argv.includes('--json'))output({schemaVersion:1,error:message(error)});\n    else process.stderr.write(message(error)+'\\n');process.exitCode=1;\n  }\n  return true;\n}\nexport async function handle(command:string,args:string[]){\n  const {flags,positional}=options(args);const json=flags.has('--json');\n  const known=new Set([...booleans,'--instance','--name','--project','--port','--access-role','--connection','--profile','--app-parent-pid','--revision','--patch','--file','--output','--lines','--expires','--issuer','--resource','--resource-aliases','--client-id','--subjects','--registration','--token-auth','--callback','--target','--mode']);\n  for(const flag of flags.keys())if(!known.has(flag))throw Error('UNKNOWN_OPTION: '+flag);\n  if(command==='instance'){\n    const op=positional[0]??'list';\n    if(op==='list'){\n      const registry=await readRegistry();const filtered=registry.instances.filter(i=>flags.has('--archived')||!i.archived);\n      const instances=await Promise.all(filtered.map(i=>instanceStatus(i)));\n      if(json)output({schemaVersion:1,defaultInstanceId:registry.defaultInstanceId,instances});\n      else {\n        if(!instances.length){\n          process.stdout.write(registry.instances.length\n            ?'No active instances. Run: starmux ls --archived\\nRestore an instance with: starmux config restore -i NAME\\n'\n            :'No instances. Run: starmux up\\n');\n          return;\n        }\n        const rows=await Promise.all(instances.map(async(s,idx)=>{\n          const raw=filtered[idx]!;\n          const cfg=s.active?.config??(await loadInstanceConfig(raw).catch(()=>null))?.config;\n          const mark=s.instanceId===registry.defaultInstanceId?'*':' ';\n          const state=s.archived?'archived':s.configState==='pending'?`${s.phase} (pending)`:s.phase;\n          const mode=cfg?.accessRole==='trusted'?'coding':(s.workspaceMode??'read-only');\n          const port=String(s.port??'—');\n          const workspace=cfg?.projectRoot??s.source.path;\n          return {mark,name:s.name,state,mode,port,workspace};\n        }));\n        const wName=Math.max(4,...rows.map(r=>r.name.length));\n        const wState=Math.max(6,...rows.map(r=>r.state.length));\n        const wMode=Math.max(4,...rows.map(r=>r.mode.length));\n        const wPort=Math.max(4,...rows.map(r=>r.port.length));\n        process.stdout.write(`  ${'NAME'.padEnd(wName)}  ${'STATUS'.padEnd(wState)}  ${'MODE'.padEnd(wMode)}  ${'PORT'.padEnd(wPort)}  WORKSPACE\\n`);\n        for(const r of rows){\n          process.stdout.write(`${r.mark} ${r.name.padEnd(wName)}  ${r.state.padEnd(wState)}  ${r.mode.padEnd(wMode)}  ${r.port.padEnd(wPort)}  ${r.workspace}\\n`);\n        }\n      }return;\n    }\n    if(op==='create'){\n      const config=await wizard(flags);const instance=await createInstance(positional[1]??flags.get('--name')??'default',{config});\n      output({instance,message:'Saved. Start with: starmux up -i '+JSON.stringify(instance.name)});return;\n    }\n    if(op==='import'){\n      const file=positional[1];if(!file)throw Error('IMPORT_FILE_REQUIRED');\n      const config=await validateConfig(parseConfig(await readTrusted(path.resolve(file),false)));requireApprovals(config,flags);\n      output({instance:await createInstance(flags.get('--name')??path.basename(file,path.extname(file)),{file,link:flags.has('--link')}),\n        message:flags.has('--link')?'Bound to original file. Changes require apply.':'Imported a private copy. The original file is no longer used.'});return;\n    }\n    if(op==='migrate'){\n      const {migrateLegacy}=await import('../instance-migration.js');output(await migrateLegacy(positional[1],flags.has('--confirm'),flags.get('--name')));return;\n    }\n    const instance=await resolveInstance(positional[1]??flags.get('--instance'),homedir(),op==='restore');\n    if(op==='copy'){\n      const config={...(await loadInstanceConfig(instance)).config,port:await suggestPort()};\n      const access=await createAccessControl(instancePaths(instance).access);const mode=(await access.snapshot()).mode;\n      const created=await createInstance(positional[2]??flags.get('--name')??instance.name+' copy',{config,requiredAccess:instance.requiredAccess!=='ingress'?instance.requiredAccess:mode});\n      if(json)output({instance:created,message:'Copied settings only. Credentials and sessions were not copied.'});\n      else process.stdout.write(`Copied '${instance.name}' to '${created.name}' (port ${config.port}). Credentials and sessions were not copied.\\n`);\n      return;\n    }\n    await changeRegistry(async registry=>{\n      const item=registry.instances.find(i=>i.id===instance.id)!;\n      if(op==='rename'){\n        const name=positional[2];if(!name)throw Error('NAME_REQUIRED');if(registry.instances.some(i=>i.name===name))throw Error('INSTANCE_NAME_EXISTS');item.name=name;\n      }else if(op==='default')registry.defaultInstanceId=item.id;\n      else if(op==='archive'||op==='remove'){const stopped=await instanceRequest(instance,'stop');if(stopped&&stopped.phase!=='stopped')throw Error('INSTANCE_STILL_RUNNING');item.archived=true;if(registry.defaultInstanceId===item.id)registry.defaultInstanceId=null;}\n      else if(op==='restore')item.archived=false;\n      else throw Error('INSTANCE_ACTION_INVALID');\n    });\n    if(json)output({result:'OK',instanceId:instance.id});\n    else if(op==='rename')process.stdout.write(`Renamed '${instance.name}' to '${positional[2]}'.\\n`);\n    else if(op==='default')process.stdout.write(`Default instance set to '${instance.name}'.\\n`);\n    else if(op==='archive'||op==='remove')process.stdout.write(`Archived instance '${instance.name}'.\\n`);\n    else if(op==='restore')process.stdout.write(`Restored instance '${instance.name}'.\\n`);\n    return;\n  }\n  if(command==='status'&&!flags.has('--instance')&&(!json||flags.has('--all')))return handle('instance',['list',...(json?['--json']:[])]);\n  const profile=flags.get('--profile');\n  let selector=flags.get('--instance');\n  if(profile&&profile!=='auto'){\n    const legacy=(await readRegistry()).instances.find(i=>i.legacy===profile);if(!legacy)throw Error('LEGACY_PROFILE_NOT_MIGRATED');selector=legacy.id;\n  }\n  if(command==='setup'&&!(await readRegistry()).instances.length){await handle('instance',['create','default',...args]);return;}\n  const instance=await resolveInstance(selector);const p=instancePaths(instance);\n  if(command==='status'){output(await instanceStatus(instance));return;}\n  if(command==='run'){\n    if(flags.has('--port'))throw Error('INSTANCE_PORT_OVERRIDE_DENIED: edit configuration and apply');\n    await runInstance(instance,{json,...(flags.has('--app-parent-pid')?{appParentPid:Number(flags.get('--app-parent-pid'))}:{})});return;\n  }\n  if(command==='stop'){output({result:(await instanceRequest(instance,'stop'))?'STOPPED':'ALREADY_STOPPED',instanceId:instance.id});return;}\n  if(command==='restart'){await handle('config',['apply','--instance',instance.id,...(json?['--json']:[])]);return;}\n  if(command==='setup'){\n    const current=await loadInstanceConfig(instance);const config=await wizard(flags,current.config);\n    await patchInstanceConfig(instance,config,current.revision);output({result:'SAVED',instanceId:instance.id,message:'Apply changes to restart the running instance.'});return;\n  }\n  if(command==='config'){\n    const op=positional[0]??'show';\n    if(op==='path'){if(json)output({instanceId:instance.id,...p,source:instance.source});else process.stdout.write(instance.source.path+'\\n');return;}\n    if(op==='schema'){output(configJSONSchema());return;}\n    if(op==='show'){\n      if(flags.has('--effective')){\n        const active=(await instanceStatus(instance)).active;\n        if(json)output(active);\n        else if(!active)process.stdout.write(`Instance ${instance.name} has no active running configuration.\\n`);\n        else process.stdout.write(\n          `Instance       ${instance.name} (effective running config)\\n`+\n          `Workspace      ${active.config.projectRoot}\\n`+\n          `Port           ${active.config.port}\\n`+\n          `Mode           ${active.config.accessRole==='trusted'?'Coding (read-write, shell & git)':active.config.mode}\\n`+\n          `Git workflow   ${active.config.gitMode}\\n`+\n          `Extra MCPs     ${active.config.upstreams.length}\\n`\n        );\n      }else{\n        const text=await readTrusted(instance.source.path,instance.source.kind==='managed');\n        let config:InstanceConfig|null=null;let problem:string|null=null;\n        try{config=await validateConfig(parseConfig(text));}catch(e){problem=message(e);}\n        if(json)output({instanceId:instance.id,text,config,problem,revision:sourceRevision(instance.source.path,text),source:instance.source});\n        else if(problem||!config)process.stdout.write(`Instance       ${instance.name}\\nConfig file    ${instance.source.path}\\nProblem        ${problem??'Invalid configuration'}\\n`);\n        else process.stdout.write(\n          `Instance       ${instance.name}\\n`+\n          `Config file    ${instance.source.path} (${instance.source.kind})\\n`+\n          `Workspace      ${config.projectRoot}\\n`+\n          `Port           ${config.port}\\n`+\n          `Mode           ${config.accessRole==='trusted'?'Coding (read-write, shell & git)':config.mode}\\n`+\n          `Git workflow   ${config.gitMode}\\n`+\n          `Extra MCPs     ${config.upstreams.length}\\n\\n`+\n          `Commands\\n`+\n          `  Edit config  starmux config edit${instance.name==='default'?'':` -i ${instance.name}`}\\n`+\n          `  Apply        starmux config apply${instance.name==='default'?'':` -i ${instance.name}`}\\n`\n        );\n      }return;\n    }\n    if(op==='recover'){\n      const snapshot=(await instanceStatus(instance)).active;if(!snapshot)throw Error('NO_SUCCESSFUL_CONFIG_SNAPSHOT');\n      await validateConfig(snapshot.config);\n      const target=path.join(p.root,'config.jsonc');\n      await changeRegistry(async registry=>{\n        if(await exists(target))throw Error('CONFIG_RECOVERY_WOULD_OVERWRITE: repair the existing file instead');\n        await atomicPrivate(target,configTemplate(snapshot.config));\n        registry.instances.find(i=>i.id===instance.id)!.source={kind:'managed',path:target};\n      });output({result:'RECOVERED_MANAGED_CONFIG',path:target});return;\n    }\n    if(op==='secret'){\n      const action=positional[1];const name=positional[2];if(!name||! /^[A-Za-z][A-Za-z0-9_-]{0,79}$/.test(name))throw Error('SECRET_NAME_REQUIRED');\n      const file=path.join(p.state,'secrets.json');\n      await withLock(file+'.lock',async()=>{\n        const secrets:Record<string,string>=await exists(file)?JSON.parse(await readTrusted(file)) as Record<string,string>:{};\n        if(action==='set')secrets[name]=(await readInput()).replace(/\\r?\\n$/,'');\n        else if(action==='remove')delete secrets[name];else throw Error('SECRET_ACTION_INVALID');\n        await atomicPrivate(file,JSON.stringify(secrets));\n      });output({result:'SECRET_UPDATED',name});return;\n    }\n    if(op==='relink'||op==='manage'){\n      const file=flags.get('--file')??positional[1];const loaded=op==='manage'?await loadInstanceConfig(instance):null;\n      if(op==='relink'&&!file)throw Error('CONFIG_FILE_REQUIRED');\n      const target=op==='manage'?path.join(p.root,'config.jsonc'):path.resolve(file!);\n      if(op==='relink')await validateConfig(parseConfig(await readTrusted(target,false)));\n      await changeRegistry(async registry=>{\n        if(registry.instances.some(i=>i.id!==instance.id&&i.source.path===target))throw Error('CONFIG_ALREADY_BOUND');\n        if(loaded)await atomicPrivate(target,loaded.text);\n        registry.instances.find(i=>i.id===instance.id)!.source={kind:op==='manage'?'managed':'linked',path:target};\n      });output({result:'SOURCE_UPDATED',path:target});return;\n    }\n    if(op==='save'){\n      const text=flags.get('--file')?await readTrusted(path.resolve(flags.get('--file')!),false):await readInput();\n      const saved=await saveInstanceConfig(instance,text,flags.get('--revision')??'');output({result:'SAVED',revision:saved.revision});return;\n    }\n    if(op==='patch'){\n      const patch=JSON.parse(flags.get('--patch')??await readInput()) as Record<string,unknown>;\n      if(patch.accessRole==='trusted'&&(await loadInstanceConfig(instance)).config.accessRole!=='trusted')requireApprovals(parseConfig(JSON.stringify({...((await loadInstanceConfig(instance)).config),...patch})),flags);\n      output({result:'SAVED',revision:(await patchInstanceConfig(instance,patch,flags.get('--revision')??'')).revision});return;\n    }\n    const loaded=await loadInstanceConfig(instance);\n    if(op==='validate'){\n      if(json)output({result:'VALID',revision:loaded.revision,source:instance.source});\n      else process.stdout.write(`✓ Configuration is valid (${instance.source.path})\\n`);\n      return;\n    }\n    if(op==='diff'){\n      const active=(await instanceStatus(instance)).active?.config??null;\n      const changes=Object.entries(loaded.config).filter(([key,value])=>JSON.stringify(value)!==JSON.stringify(active?.[key as keyof InstanceConfig])).map(([field,value])=>({field,before:active?.[field as keyof InstanceConfig]??null,after:value}));\n      if(json)output({instanceId:instance.id,revision:loaded.revision,changes});\n      else if(!changes.length)process.stdout.write('No pending configuration changes.\\n');\n      else{\n        for(const c of changes)process.stdout.write(`${c.field}: ${JSON.stringify(c.before)} -> ${JSON.stringify(c.after)}\\n`);\n      }\n      return;\n    }\n    if(op==='apply'){\n      const state=await instanceRequest(instance,'apply',flags.get('--revision')??loaded.revision);\n      if(json)output({result:state?'APPLIED':'VALID_ON_NEXT_START',instanceId:instance.id,runtime:state});\n      else process.stdout.write(state?`Applied configuration to '${instance.name}'.\\n`:`Configuration validated; will take effect on next 'starmux up'.\\n`);\n      return;\n    }\n    if(op==='export'){\n      const file=flags.get('--output');const text=configTemplate(loaded.config);\n      if(file){await writeFile(path.resolve(file),text,{flag:'wx',mode:0o600});output({result:'EXPORTED',file:path.resolve(file)});}else process.stdout.write(text);return;\n    }\n    if(op==='edit'){\n      const editor=process.env.VISUAL||process.env.EDITOR;if(!editor)throw Error('EDITOR_REQUIRED: set EDITOR to an executable, or use config path');\n      const temp=await mkdtemp(path.join(await realpath(tmpdir()),'gateway-edit-'));const file=path.join(temp,'config.jsonc');\n      try{await writeFile(file,loaded.text,{mode:0o600});await new Promise<void>((resolve,reject)=>{const child=spawn(editor,[file],{stdio:'inherit'});child.once('error',reject);child.once('exit',code=>code===0?resolve():reject(Error('EDITOR_FAILED')));});\n        const text=await readFile(file,'utf8');await saveInstanceConfig(instance,text,loaded.revision);output({result:'SAVED',message:'Use config diff, then config apply.'});\n      }finally{await rm(temp,{recursive:true,force:true});}return;\n    }\n    throw Error('CONFIG_ACTION_INVALID');\n  }\n  if(command==='logs'){\n    const file=path.join(p.logs,'core.log');const lines=Math.min(200,Math.max(1,Number(flags.get('--lines')??60)));\n    if(!Number.isSafeInteger(Number(flags.get('--lines')??60))||Number(flags.get('--lines')??60)<1||Number(flags.get('--lines')??60)>200)throw Error('INVALID_LINES: expected 1..200');\n    const text=await exists(file)?(await readTrusted(file,true,32*1024*1024)).split('\\n').slice(-lines).join('\\n'):'No logs yet.';\n    if(json)output({instanceId:instance.id,output:text});else process.stdout.write(text+'\\n');return;\n  }\n  if(command==='access'){\n    process.env.MAC_MCP_ACCESS_FILE=p.access;\n    const clean=args.filter((_,i)=>args[i]!=='--instance'&&args[i-1]!=='--instance'&&args[i]!=='--profile'&&args[i-1]!=='--profile');\n    await (await import('./access.js')).accessCommand(clean);\n    if(positional[0]==='mode'){const mode=positional[1];if(mode==='ingress'||mode==='api-key'||mode==='oauth')await changeRegistry(async r=>{r.instances.find(i=>i.id===instance.id)!.requiredAccess=mode;});}\n    return;\n  }\n  if(command==='permissions'){\n    const grants=await createWorkspaceGrants({file:p.grants});const deny=await createDenyRules({file:p.deny});const op=positional[0]??'status';\n    if(op==='token')output({token:await readTrusted(grants.tokenFile)});\n    else if(op==='status')output({grants:await grants.snapshot(),denied:await deny.snapshot()});\n    else if(['disable-tool','enable-tool','deny-directory','allow-directory'].includes(op))output(await deny.update(op,flags.get('--target')??positional[1]));\n    else {output(await grants.update(op,{target:flags.get('--target'),mode:flags.get('--mode')}));}return;\n  }\n  const loaded=await loadInstanceConfig(instance);\n  if(command==='doctor'){\n    const {ensureAccessReady}=await import('../instance-store.js');await ensureAccessReady(instance);\n    const status=await instanceStatus(instance);\n    output({result:'PASS',instanceId:instance.id,source:instance.source,config:loaded.config,configState:status.configState,\n      message:'Configuration and access state validated. Run verify after starting to check real tools.'});return;\n  }\n  if(command==='privacy'){\n    const status=await instanceStatus(instance);if(!status.runtime?.port)throw Error('INSTANCE_NOT_RUNNING');\n    output(await (await import('../privacy-diagnostics.js')).privacyReport({port:status.runtime.port,home:homedir(),all:flags.has('--all'),target:flags.get('--target')??null}));return;\n  }\n  if(command==='verify'){\n    const state=await instanceRequest(instance,'status');if(state?.phase!=='running'||!state.port)throw Error('INSTANCE_NOT_RUNNING');\n    const endpoint=`http://127.0.0.1:${state.port}`;\n    const health=await fetch(endpoint+'/healthz',{signal:AbortSignal.timeout(3000)}).then(r=>r.json()) as {instanceId?:string};\n    if(health.instanceId!==instance.id)throw Error('INSTANCE_HEALTH_IDENTITY_MISMATCH');\n    const request=async(method:string,params:unknown)=>{\n      const reply=await fetch(endpoint+'/mcp',{method:'POST',headers:{'content-type':'application/json',accept:'application/json, text/event-stream',...(process.env.MAC_MCP_API_KEY?{authorization:'Bearer '+process.env.MAC_MCP_API_KEY}:{})},body:JSON.stringify({jsonrpc:'2.0',id:1,method,params}),signal:AbortSignal.timeout(15000)});\n      if(!reply.ok)throw Error(reply.status===401?'VERIFICATION_CREDENTIAL_REQUIRED: set MAC_MCP_API_KEY':'MCP_VERIFICATION_FAILED');\n      const data=await reply.json() as {error?:unknown;result?:{isError?:boolean}};if(data.error||data.result?.isError)throw Error('MCP_VERIFICATION_FAILED');return data.result;\n    };\n    await request('tools/list',{});await request('tools/call',{name:'list_directory',arguments:{path:'.',depth:0}});\n    output({result:'PASS',instanceId:instance.id,port:state.port,remoteClientVerified:false});return;\n  }\n}\n"]}