xaq-cli 0.0.0 → 0.1.0-nightly.71

package/dist/errors-FbMS3QBo.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+//#region server/util/errors.ts
+/** Throw from anywhere in request handling; the API layer turns it into an ApiError response. */
+var HttpError = class extends Error {
+	status;
+	code;
+	hint;
+	constructor(status, code, message, hint) {
+		super(message);
+		this.status = status;
+		this.code = code;
+		this.hint = hint;
+	}
+	toJSON() {
+		return { error: {
+			code: this.code,
+			message: this.message,
+			...this.hint ? { hint: this.hint } : {}
+		} };
+	}
+};
+const badRequest = (message, hint) => new HttpError(400, "bad_request", message, hint);
+const notFound = (what) => new HttpError(404, "not_found", `${what} not found`);
+const conflict = (message, hint) => new HttpError(409, "conflict", message, hint);
+/** Thrown by policy checks. `reason` is the guardrail name recorded in the audit log. */
+var PolicyDenied = class extends Error {
+	reason;
+	constructor(reason, message) {
+		super(message);
+		this.reason = reason;
+	}
+};
+function errorMessage(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+export { errorMessage as a, conflict as i, PolicyDenied as n, notFound as o, badRequest as r, HttpError as t };
+
+//# sourceMappingURL=errors-FbMS3QBo.js.map

package/dist/errors-FbMS3QBo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-FbMS3QBo.js","names":[],"sources":["../server/util/errors.ts"],"sourcesContent":["import type { ApiError } from \"../../shared/types.ts\";\n\n/** Throw from anywhere in request handling; the API layer turns it into an ApiError response. */\nexport class HttpError extends Error {\n  constructor(\n    readonly status: number,\n    readonly code: string,\n    message: string,\n    readonly hint?: string,\n  ) {\n    super(message);\n  }\n\n  toJSON(): ApiError {\n    return { error: { code: this.code, message: this.message, ...(this.hint ? { hint: this.hint } : {}) } };\n  }\n}\n\nexport const badRequest = (message: string, hint?: string) => new HttpError(400, \"bad_request\", message, hint);\nexport const notFound = (what: string) => new HttpError(404, \"not_found\", `${what} not found`);\nexport const conflict = (message: string, hint?: string) => new HttpError(409, \"conflict\", message, hint);\n\n/** Thrown by policy checks. `reason` is the guardrail name recorded in the audit log. */\nexport class PolicyDenied extends Error {\n  constructor(\n    readonly reason: string,\n    message: string,\n  ) {\n    super(message);\n  }\n}\n\nexport function errorMessage(err: unknown): string {\n  return err instanceof Error ? err.message : String(err);\n}\n"],"mappings":";;;AAGA,IAAa,YAAb,cAA+B,MAAM;CAExB;CACA;CAEA;CAJX,YACE,QACA,MACA,SACA,MACA;EACA,MAAM,OAAO;EALJ,KAAA,SAAA;EACA,KAAA,OAAA;EAEA,KAAA,OAAA;CAGX;CAEA,SAAmB;EACjB,OAAO,EAAE,OAAO;GAAE,MAAM,KAAK;GAAM,SAAS,KAAK;GAAS,GAAI,KAAK,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;EAAG,EAAE;CACxG;AACF;AAEA,MAAa,cAAc,SAAiB,SAAkB,IAAI,UAAU,KAAK,eAAe,SAAS,IAAI;AAC7G,MAAa,YAAY,SAAiB,IAAI,UAAU,KAAK,aAAa,GAAG,KAAK,WAAW;AAC7F,MAAa,YAAY,SAAiB,SAAkB,IAAI,UAAU,KAAK,YAAY,SAAS,IAAI;;AAGxG,IAAa,eAAb,cAAkC,MAAM;CAE3B;CADX,YACE,QACA,SACA;EACA,MAAM,OAAO;EAHJ,KAAA,SAAA;CAIX;AACF;AAEA,SAAgB,aAAa,KAAsB;CACjD,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AACxD"}

package/dist/filter-Ck6OMxvu.js

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+import { _ as isConnectionEventType, v as isEventType } from "./types-BhJDbSzE.js";
+import { z } from "zod";
+import { RE2JS } from "re2js";
+//#region server/util/glob.ts
+/**
+* Case-insensitive address globs used by grant allowlists (`allowTo`) and webhook filters
+* (`from`, `to`). `*` matches any run of characters, everything else is literal:
+* "*@example.com", "billing@*", "alice@example.com".
+*
+* Case folding is ASCII-only: Unicode folding would let look-alikes such as the Kelvin sign (U+212A)
+* match "k". Domains are NFKC-normalized first (as IDNA does), local parts are compared as written.
+*/
+const asciiLower = (s) => s.replace(/[A-Z]/g, (c) => c.toLowerCase());
+function normalize(address) {
+	const s = address.trim();
+	const at = s.lastIndexOf("@");
+	if (at < 0) return asciiLower(s);
+	return asciiLower(s.slice(0, at)) + "@" + asciiLower(s.slice(at + 1).normalize("NFKC"));
+}
+function globToRegExp(glob) {
+	const body = normalize(glob).split("*").map((part) => part.replace(/[.+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+	return new RegExp(`^${body}$`, "s");
+}
+function matchesGlob(value, glob) {
+	return globToRegExp(glob).test(normalize(value));
+}
+function matchesAnyGlob(value, globs) {
+	return globs.some((g) => matchesGlob(value, g));
+}
+//#endregion
+//#region server/webhooks/regex.ts
+/**
+* Webhook subject filters run synchronously on attacker-controlled subjects during events.emit, so
+* they use RE2 (re2js): matching is linear in the input, with no catastrophic backtracking. RE2
+* syntax is JavaScript's minus lookarounds and backreferences.
+*/
+const RE2_SYNTAX_HINT = "Subject patterns use RE2 syntax, which runs in linear time: lookarounds ((?=…), (?!…), (?<=…), (?<!…)) and backreferences (\\1) aren't supported.";
+/** Compiled patterns by source; null marks a pattern RE2 rejects. Bounded so it can't grow forever. */
+const cache = /* @__PURE__ */ new Map();
+const CACHE_MAX = 1e3;
+/** RE2's reason for rejecting the pattern, or null when it compiles. */
+function subjectPatternError(pattern) {
+	try {
+		RE2JS.compile(pattern, RE2JS.CASE_INSENSITIVE);
+		return null;
+	} catch (err) {
+		return (err instanceof Error ? err.message : String(err)).replace(/^error parsing regexp: /, "");
+	}
+}
+/** Case-insensitive search. A pattern RE2 rejects (e.g. stored before this check existed) never matches. */
+function subjectMatches(pattern, subject) {
+	let re = cache.get(pattern);
+	if (re === void 0) {
+		try {
+			re = RE2JS.compile(pattern, RE2JS.CASE_INSENSITIVE);
+		} catch {
+			re = null;
+		}
+		if (cache.size >= CACHE_MAX) cache.delete(cache.keys().next().value);
+		cache.set(pattern, re);
+	}
+	return re ? re.matcher(subject).find() : false;
+}
+//#endregion
+//#region server/webhooks/filter.ts
+/** Events about the account itself rather than a message: filters only narrow them by account. */
+const ACCOUNT_EVENT_TYPES = ["account.auth_failed", "sync.gap"];
+/** Bounds glob backtracking: filters run on attacker-controlled addresses during every emit. */
+const MAX_GLOB_STARS = 8;
+const list = (max, label) => z.array(z.string().trim().min(1, `${label} entries must not be empty`).max(320)).max(max, `At most ${max} ${label} entries`).optional();
+const globList = (max, label) => list(max, label).refine((globs) => !globs?.some((g) => g.split("*").length - 1 > MAX_GLOB_STARS), `${label} patterns may use at most ${MAX_GLOB_STARS} "*"`);
+/** Strict, so a misspelled criterion is an error rather than a filter that silently matches everything. */
+const webhookFilterSchema = z.object({
+	accountIds: list(100, "account"),
+	labelIds: list(100, "label"),
+	from: globList(100, "from"),
+	to: globList(100, "to"),
+	subject: z.string().max(200, "Subject pattern must be at most 200 characters").optional().superRefine((s, issues) => {
+		const error = s === void 0 ? null : subjectPatternError(s);
+		if (error) issues.addIssue({
+			code: "custom",
+			message: `Subject pattern is not a valid regular expression (${error}). ${RE2_SYNTAX_HINT}`
+		});
+	}),
+	hasAttachments: z.boolean().optional(),
+	calendarIds: list(100, "calendar")
+}).strict();
+const webhookFields = {
+	agentId: z.string().min(1, "Choose an agent"),
+	name: z.string().trim().min(1, "Name is required").max(100, "Name must be at most 100 characters"),
+	url: z.string().trim().max(2048).refine((u) => URL.canParse(u) && /^https?:$/.test(new URL(u).protocol), "URL must be a full http(s) URL, e.g. https://example.com/hooks/mail").refine((u) => !URL.canParse(u) || !new URL(u).username && !new URL(u).password, "URL must not contain credentials; verify requests with the signing secret instead"),
+	eventTypes: z.array(z.string().refine(isEventType, "Unknown event type")).min(1, "Pick at least one event type").transform((t) => t),
+	filter: webhookFilterSchema,
+	includeBody: z.boolean(),
+	enabled: z.boolean()
+};
+const webhookInputSchema = z.object({
+	...webhookFields,
+	filter: webhookFilterSchema.default({}),
+	includeBody: z.boolean().default(false),
+	enabled: z.boolean().default(true)
+});
+const webhookPatchSchema = z.object(webhookFields).partial();
+/** Drops empty lists and blank values so stored filters stay minimal. */
+function normalizeFilter(f) {
+	const out = {};
+	for (const key of [
+		"accountIds",
+		"labelIds",
+		"from",
+		"to",
+		"calendarIds"
+	]) {
+		const v = f[key]?.map((s) => s.trim()).filter(Boolean);
+		if (v?.length) out[key] = [...new Set(v)];
+	}
+	if (f.subject?.trim()) out.subject = f.subject;
+	if (typeof f.hasAttachments === "boolean") out.hasAttachments = f.hasAttachments;
+	return out;
+}
+/** Whether an event passes a webhook filter. Every set criterion must pass. */
+function matchesFilter(f, ev) {
+	if (f.accountIds?.length && !f.accountIds.includes(ev.accountId)) return false;
+	if (ACCOUNT_EVENT_TYPES.includes(ev.type)) return true;
+	if (isConnectionEventType(ev.type)) return true;
+	if (ev.calendarEvent) return matchesCalendar(f, ev.calendarEvent, ev.accountEmail);
+	const hasMessageCriteria = !!(f.labelIds?.length || f.from?.length || f.to?.length || f.subject || f.hasAttachments !== void 0);
+	const m = ev.message;
+	if (!m) return !hasMessageCriteria;
+	if (f.labelIds?.length) {
+		const labels = /* @__PURE__ */ new Set([...m.labelIds, ...ev.labelIds ?? []]);
+		if (!f.labelIds.some((l) => labels.has(l))) return false;
+	}
+	if (f.from?.length && !(m.from && matchesAnyGlob(m.from.email, f.from))) return false;
+	if (f.to?.length && ![...m.to, ...m.cc].some((a) => matchesAnyGlob(a.email, f.to))) return false;
+	if (f.subject && !subjectMatches(f.subject, m.subject.slice(0, 256))) return false;
+	if (f.hasAttachments !== void 0 && m.hasAttachments !== f.hasAttachments) return false;
+	return true;
+}
+/**
+* calendar.* events: `calendarIds` picks calendars ("primary" is the account's own), `from` matches the
+* organizer, `to` any attendee and `subject` the summary. labelIds and hasAttachments don't apply.
+*/
+function matchesCalendar(f, e, accountEmail) {
+	if (f.calendarIds?.length) {
+		const cal = e.calendarId.toLowerCase();
+		if (!f.calendarIds.some((id) => (id === "primary" ? accountEmail : id).toLowerCase() === cal)) return false;
+	}
+	if (f.from?.length && !(e.organizer && matchesAnyGlob(e.organizer.email, f.from))) return false;
+	if (f.to?.length && !e.attendees.some((a) => matchesAnyGlob(a.email, f.to))) return false;
+	if (f.subject && !subjectMatches(f.subject, e.summary.slice(0, 256))) return false;
+	return true;
+}
+//#endregion
+export { webhookPatchSchema as a, matchesGlob as c, webhookInputSchema as i, normalizeFilter as n, subjectPatternError as o, webhookFilterSchema as r, matchesAnyGlob as s, matchesFilter as t };
+
+//# sourceMappingURL=filter-Ck6OMxvu.js.map

package/dist/filter-Ck6OMxvu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter-Ck6OMxvu.js","names":[],"sources":["../server/util/glob.ts","../server/webhooks/regex.ts","../server/webhooks/filter.ts"],"sourcesContent":["/**\n * Case-insensitive address globs used by grant allowlists (`allowTo`) and webhook filters\n * (`from`, `to`). `*` matches any run of characters, everything else is literal:\n * \"*@example.com\", \"billing@*\", \"alice@example.com\".\n *\n * Case folding is ASCII-only: Unicode folding would let look-alikes such as the Kelvin sign (U+212A)\n * match \"k\". Domains are NFKC-normalized first (as IDNA does), local parts are compared as written.\n */\nconst asciiLower = (s: string) => s.replace(/[A-Z]/g, (c) => c.toLowerCase());\n\nfunction normalize(address: string): string {\n  const s = address.trim();\n  const at = s.lastIndexOf(\"@\");\n  if (at < 0) return asciiLower(s);\n  return asciiLower(s.slice(0, at)) + \"@\" + asciiLower(s.slice(at + 1).normalize(\"NFKC\"));\n}\n\nexport function globToRegExp(glob: string): RegExp {\n  const body = normalize(glob)\n    .split(\"*\")\n    .map((part) => part.replace(/[.+?^${}()|[\\]\\\\]/g, \"\\\\$&\"))\n    .join(\".*\");\n  return new RegExp(`^${body}$`, \"s\");\n}\n\nexport function matchesGlob(value: string, glob: string): boolean {\n  return globToRegExp(glob).test(normalize(value));\n}\n\nexport function matchesAnyGlob(value: string, globs: readonly string[]): boolean {\n  return globs.some((g) => matchesGlob(value, g));\n}\n","import { RE2JS } from \"re2js\";\n\n/**\n * Webhook subject filters run synchronously on attacker-controlled subjects during events.emit, so\n * they use RE2 (re2js): matching is linear in the input, with no catastrophic backtracking. RE2\n * syntax is JavaScript's minus lookarounds and backreferences.\n */\n\nexport const RE2_SYNTAX_HINT =\n  \"Subject patterns use RE2 syntax, which runs in linear time: lookarounds ((?=…), (?!…), (?<=…), (?<!…)) and backreferences (\\\\1) aren't supported.\";\n\n/** Compiled patterns by source; null marks a pattern RE2 rejects. Bounded so it can't grow forever. */\nconst cache = new Map<string, RE2JS | null>();\nconst CACHE_MAX = 1000;\n\n/** RE2's reason for rejecting the pattern, or null when it compiles. */\nexport function subjectPatternError(pattern: string): string | null {\n  try {\n    RE2JS.compile(pattern, RE2JS.CASE_INSENSITIVE);\n    return null;\n  } catch (err) {\n    return (err instanceof Error ? err.message : String(err)).replace(/^error parsing regexp: /, \"\");\n  }\n}\n\n/** Case-insensitive search. A pattern RE2 rejects (e.g. stored before this check existed) never matches. */\nexport function subjectMatches(pattern: string, subject: string): boolean {\n  let re = cache.get(pattern);\n  if (re === undefined) {\n    try {\n      re = RE2JS.compile(pattern, RE2JS.CASE_INSENSITIVE);\n    } catch {\n      re = null;\n    }\n    if (cache.size >= CACHE_MAX) cache.delete(cache.keys().next().value!);\n    cache.set(pattern, re);\n  }\n  return re ? re.matcher(subject).find() : false;\n}\n","import { z } from \"zod\";\nimport { type CalendarEventSummary, type EventType, isConnectionEventType, isEventType, type WebhookFilter } from \"../../shared/types.ts\";\nimport type { StoredEvent } from \"../events/types.ts\";\nimport { matchesAnyGlob } from \"../util/glob.ts\";\nimport { RE2_SYNTAX_HINT, subjectMatches, subjectPatternError } from \"./regex.ts\";\n\n/** Events about the account itself rather than a message: filters only narrow them by account. */\nexport const ACCOUNT_EVENT_TYPES: readonly EventType[] = [\"account.auth_failed\", \"sync.gap\"];\n\n/** Bounds glob backtracking: filters run on attacker-controlled addresses during every emit. */\nconst MAX_GLOB_STARS = 8;\n/** Only this much of the subject is tested against the pattern (bounds matching cost). */\nexport const MAX_SUBJECT_TESTED = 256;\n\nconst list = (max: number, label: string) =>\n  z\n    .array(z.string().trim().min(1, `${label} entries must not be empty`).max(320))\n    .max(max, `At most ${max} ${label} entries`)\n    .optional();\n\nconst globList = (max: number, label: string) =>\n  list(max, label).refine((globs) => !globs?.some((g) => g.split(\"*\").length - 1 > MAX_GLOB_STARS), `${label} patterns may use at most ${MAX_GLOB_STARS} \"*\"`);\n\n/** Strict, so a misspelled criterion is an error rather than a filter that silently matches everything. */\nexport const webhookFilterSchema = z\n  .object({\n    accountIds: list(100, \"account\"),\n    labelIds: list(100, \"label\"),\n    from: globList(100, \"from\"),\n    to: globList(100, \"to\"),\n    subject: z\n      .string()\n      .max(200, \"Subject pattern must be at most 200 characters\")\n      .optional()\n      .superRefine((s, issues) => {\n        const error = s === undefined ? null : subjectPatternError(s);\n        if (error) issues.addIssue({ code: \"custom\", message: `Subject pattern is not a valid regular expression (${error}). ${RE2_SYNTAX_HINT}` });\n      }),\n    hasAttachments: z.boolean().optional(),\n    calendarIds: list(100, \"calendar\"),\n  })\n  .strict();\n\nconst webhookFields = {\n  agentId: z.string().min(1, \"Choose an agent\"),\n  name: z.string().trim().min(1, \"Name is required\").max(100, \"Name must be at most 100 characters\"),\n  url: z\n    .string()\n    .trim()\n    .max(2048)\n    .refine((u) => URL.canParse(u) && /^https?:$/.test(new URL(u).protocol), \"URL must be a full http(s) URL, e.g. https://example.com/hooks/mail\")\n    .refine((u) => !URL.canParse(u) || (!new URL(u).username && !new URL(u).password), \"URL must not contain credentials; verify requests with the signing secret instead\"),\n  eventTypes: z\n    .array(z.string().refine(isEventType, \"Unknown event type\"))\n    .min(1, \"Pick at least one event type\")\n    .transform((t) => t as EventType[]),\n  filter: webhookFilterSchema,\n  includeBody: z.boolean(),\n  enabled: z.boolean(),\n};\n\nexport const webhookInputSchema = z\n  .object({\n    ...webhookFields,\n    filter: webhookFilterSchema.default({}),\n    includeBody: z.boolean().default(false),\n    enabled: z.boolean().default(true),\n  });\n\nexport const webhookPatchSchema = z.object(webhookFields).partial();\n\n/** Drops empty lists and blank values so stored filters stay minimal. */\nexport function normalizeFilter(f: WebhookFilter): WebhookFilter {\n  const out: WebhookFilter = {};\n  const lists = [\"accountIds\", \"labelIds\", \"from\", \"to\", \"calendarIds\"] as const;\n  for (const key of lists) {\n    const v = f[key]?.map((s) => s.trim()).filter(Boolean);\n    if (v?.length) out[key] = [...new Set(v)];\n  }\n  if (f.subject?.trim()) out.subject = f.subject;\n  if (typeof f.hasAttachments === \"boolean\") out.hasAttachments = f.hasAttachments;\n  return out;\n}\n\n/** Whether an event passes a webhook filter. Every set criterion must pass. */\nexport function matchesFilter(f: WebhookFilter, ev: StoredEvent): boolean {\n  if (f.accountIds?.length && !f.accountIds.includes(ev.accountId)) return false;\n  if (ACCOUNT_EVENT_TYPES.includes(ev.type)) return true;\n  // Connection events have no account (an accountIds filter excludes them, above) and no message.\n  if (isConnectionEventType(ev.type)) return true;\n  if (ev.calendarEvent) return matchesCalendar(f, ev.calendarEvent, ev.accountEmail);\n  const hasMessageCriteria = !!(f.labelIds?.length || f.from?.length || f.to?.length || f.subject || f.hasAttachments !== undefined);\n  const m = ev.message;\n  if (!m) return !hasMessageCriteria;\n  if (f.labelIds?.length) {\n    // Label events also match on the labels that changed (a removed label is no longer on the message).\n    const labels = new Set([...m.labelIds, ...(ev.labelIds ?? [])]);\n    if (!f.labelIds.some((l) => labels.has(l))) return false;\n  }\n  if (f.from?.length && !(m.from && matchesAnyGlob(m.from.email, f.from))) return false;\n  if (f.to?.length && ![...m.to, ...m.cc].some((a) => matchesAnyGlob(a.email, f.to!))) return false;\n  if (f.subject && !subjectMatches(f.subject, m.subject.slice(0, MAX_SUBJECT_TESTED))) return false;\n  if (f.hasAttachments !== undefined && m.hasAttachments !== f.hasAttachments) return false;\n  return true;\n}\n\n/**\n * calendar.* events: `calendarIds` picks calendars (\"primary\" is the account's own), `from` matches the\n * organizer, `to` any attendee and `subject` the summary. labelIds and hasAttachments don't apply.\n */\nfunction matchesCalendar(f: WebhookFilter, e: CalendarEventSummary, accountEmail: string): boolean {\n  if (f.calendarIds?.length) {\n    const cal = e.calendarId.toLowerCase();\n    if (!f.calendarIds.some((id) => (id === \"primary\" ? accountEmail : id).toLowerCase() === cal)) return false;\n  }\n  if (f.from?.length && !(e.organizer && matchesAnyGlob(e.organizer.email, f.from))) return false;\n  if (f.to?.length && !e.attendees.some((a) => matchesAnyGlob(a.email, f.to!))) return false;\n  if (f.subject && !subjectMatches(f.subject, e.summary.slice(0, MAX_SUBJECT_TESTED))) return false;\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;AAQA,MAAM,cAAc,MAAc,EAAE,QAAQ,WAAW,MAAM,EAAE,YAAY,CAAC;AAE5E,SAAS,UAAU,SAAyB;CAC1C,MAAM,IAAI,QAAQ,KAAK;CACvB,MAAM,KAAK,EAAE,YAAY,GAAG;CAC5B,IAAI,KAAK,GAAG,OAAO,WAAW,CAAC;CAC/B,OAAO,WAAW,EAAE,MAAM,GAAG,EAAE,CAAC,IAAI,MAAM,WAAW,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC;AACxF;AAEA,SAAgB,aAAa,MAAsB;CACjD,MAAM,OAAO,UAAU,IAAI,CAAC,CACzB,MAAM,GAAG,CAAC,CACV,KAAK,SAAS,KAAK,QAAQ,sBAAsB,MAAM,CAAC,CAAC,CACzD,KAAK,IAAI;CACZ,OAAO,IAAI,OAAO,IAAI,KAAK,IAAI,GAAG;AACpC;AAEA,SAAgB,YAAY,OAAe,MAAuB;CAChE,OAAO,aAAa,IAAI,CAAC,CAAC,KAAK,UAAU,KAAK,CAAC;AACjD;AAEA,SAAgB,eAAe,OAAe,OAAmC;CAC/E,OAAO,MAAM,MAAM,MAAM,YAAY,OAAO,CAAC,CAAC;AAChD;;;;;;;;ACvBA,MAAa,kBACX;;AAGF,MAAM,wBAAQ,IAAI,IAA0B;AAC5C,MAAM,YAAY;;AAGlB,SAAgB,oBAAoB,SAAgC;CAClE,IAAI;EACF,MAAM,QAAQ,SAAS,MAAM,gBAAgB;EAC7C,OAAO;CACT,SAAS,KAAK;EACZ,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAA,CAAG,QAAQ,2BAA2B,EAAE;CACjG;AACF;;AAGA,SAAgB,eAAe,SAAiB,SAA0B;CACxE,IAAI,KAAK,MAAM,IAAI,OAAO;CAC1B,IAAI,OAAO,KAAA,GAAW;EACpB,IAAI;GACF,KAAK,MAAM,QAAQ,SAAS,MAAM,gBAAgB;EACpD,QAAQ;GACN,KAAK;EACP;EACA,IAAI,MAAM,QAAQ,WAAW,MAAM,OAAO,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAM;EACpE,MAAM,IAAI,SAAS,EAAE;CACvB;CACA,OAAO,KAAK,GAAG,QAAQ,OAAO,CAAC,CAAC,KAAK,IAAI;AAC3C;;;;AC/BA,MAAa,sBAA4C,CAAC,uBAAuB,UAAU;;AAG3F,MAAM,iBAAiB;AAIvB,MAAM,QAAQ,KAAa,UACzB,EACG,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,MAAM,2BAA2B,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAC9E,IAAI,KAAK,WAAW,IAAI,GAAG,MAAM,SAAS,CAAC,CAC3C,SAAS;AAEd,MAAM,YAAY,KAAa,UAC7B,KAAK,KAAK,KAAK,CAAC,CAAC,QAAQ,UAAU,CAAC,OAAO,MAAM,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,cAAc,GAAG,GAAG,MAAM,4BAA4B,eAAe,KAAK;;AAG7J,MAAa,sBAAsB,EAChC,OAAO;CACN,YAAY,KAAK,KAAK,SAAS;CAC/B,UAAU,KAAK,KAAK,OAAO;CAC3B,MAAM,SAAS,KAAK,MAAM;CAC1B,IAAI,SAAS,KAAK,IAAI;CACtB,SAAS,EACN,OAAO,CAAC,CACR,IAAI,KAAK,gDAAgD,CAAC,CAC1D,SAAS,CAAC,CACV,aAAa,GAAG,WAAW;EAC1B,MAAM,QAAQ,MAAM,KAAA,IAAY,OAAO,oBAAoB,CAAC;EAC5D,IAAI,OAAO,OAAO,SAAS;GAAE,MAAM;GAAU,SAAS,sDAAsD,MAAM,KAAK;EAAkB,CAAC;CAC5I,CAAC;CACH,gBAAgB,EAAE,QAAQ,CAAC,CAAC,SAAS;CACrC,aAAa,KAAK,KAAK,UAAU;AACnC,CAAC,CAAC,CACD,OAAO;AAEV,MAAM,gBAAgB;CACpB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,GAAG,iBAAiB;CAC5C,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,kBAAkB,CAAC,CAAC,IAAI,KAAK,qCAAqC;CACjG,KAAK,EACF,OAAO,CAAC,CACR,KAAK,CAAC,CACN,IAAI,IAAI,CAAC,CACT,QAAQ,MAAM,IAAI,SAAS,CAAC,KAAK,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,GAAG,qEAAqE,CAAC,CAC9I,QAAQ,MAAM,CAAC,IAAI,SAAS,CAAC,KAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAW,mFAAmF;CACxK,YAAY,EACT,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO,aAAa,oBAAoB,CAAC,CAAC,CAC3D,IAAI,GAAG,8BAA8B,CAAC,CACtC,WAAW,MAAM,CAAgB;CACpC,QAAQ;CACR,aAAa,EAAE,QAAQ;CACvB,SAAS,EAAE,QAAQ;AACrB;AAEA,MAAa,qBAAqB,EAC/B,OAAO;CACN,GAAG;CACH,QAAQ,oBAAoB,QAAQ,CAAC,CAAC;CACtC,aAAa,EAAE,QAAQ,CAAC,CAAC,QAAQ,KAAK;CACtC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,IAAI;AACnC,CAAC;AAEH,MAAa,qBAAqB,EAAE,OAAO,aAAa,CAAC,CAAC,QAAQ;;AAGlE,SAAgB,gBAAgB,GAAiC;CAC/D,MAAM,MAAqB,CAAC;CAE5B,KAAK,MAAM,OAAO;EADH;EAAc;EAAY;EAAQ;EAAM;CACjC,GAAG;EACvB,MAAM,IAAI,EAAE,IAAI,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO;EACrD,IAAI,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;CAC1C;CACA,IAAI,EAAE,SAAS,KAAK,GAAG,IAAI,UAAU,EAAE;CACvC,IAAI,OAAO,EAAE,mBAAmB,WAAW,IAAI,iBAAiB,EAAE;CAClE,OAAO;AACT;;AAGA,SAAgB,cAAc,GAAkB,IAA0B;CACxE,IAAI,EAAE,YAAY,UAAU,CAAC,EAAE,WAAW,SAAS,GAAG,SAAS,GAAG,OAAO;CACzE,IAAI,oBAAoB,SAAS,GAAG,IAAI,GAAG,OAAO;CAElD,IAAI,sBAAsB,GAAG,IAAI,GAAG,OAAO;CAC3C,IAAI,GAAG,eAAe,OAAO,gBAAgB,GAAG,GAAG,eAAe,GAAG,YAAY;CACjF,MAAM,qBAAqB,CAAC,EAAE,EAAE,UAAU,UAAU,EAAE,MAAM,UAAU,EAAE,IAAI,UAAU,EAAE,WAAW,EAAE,mBAAmB,KAAA;CACxH,MAAM,IAAI,GAAG;CACb,IAAI,CAAC,GAAG,OAAO,CAAC;CAChB,IAAI,EAAE,UAAU,QAAQ;EAEtB,MAAM,yBAAS,IAAI,IAAI,CAAC,GAAG,EAAE,UAAU,GAAI,GAAG,YAAY,CAAC,CAAE,CAAC;EAC9D,IAAI,CAAC,EAAE,SAAS,MAAM,MAAM,OAAO,IAAI,CAAC,CAAC,GAAG,OAAO;CACrD;CACA,IAAI,EAAE,MAAM,UAAU,EAAE,EAAE,QAAQ,eAAe,EAAE,KAAK,OAAO,EAAE,IAAI,IAAI,OAAO;CAChF,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,eAAe,EAAE,OAAO,EAAE,EAAG,CAAC,GAAG,OAAO;CAC5F,IAAI,EAAE,WAAW,CAAC,eAAe,EAAE,SAAS,EAAE,QAAQ,MAAM,GAAA,GAAqB,CAAC,GAAG,OAAO;CAC5F,IAAI,EAAE,mBAAmB,KAAA,KAAa,EAAE,mBAAmB,EAAE,gBAAgB,OAAO;CACpF,OAAO;AACT;;;;;AAMA,SAAS,gBAAgB,GAAkB,GAAyB,cAA+B;CACjG,IAAI,EAAE,aAAa,QAAQ;EACzB,MAAM,MAAM,EAAE,WAAW,YAAY;EACrC,IAAI,CAAC,EAAE,YAAY,MAAM,QAAQ,OAAO,YAAY,eAAe,GAAA,CAAI,YAAY,MAAM,GAAG,GAAG,OAAO;CACxG;CACA,IAAI,EAAE,MAAM,UAAU,EAAE,EAAE,aAAa,eAAe,EAAE,UAAU,OAAO,EAAE,IAAI,IAAI,OAAO;CAC1F,IAAI,EAAE,IAAI,UAAU,CAAC,EAAE,UAAU,MAAM,MAAM,eAAe,EAAE,OAAO,EAAE,EAAG,CAAC,GAAG,OAAO;CACrF,IAAI,EAAE,WAAW,CAAC,eAAe,EAAE,SAAS,EAAE,QAAQ,MAAM,GAAA,GAAqB,CAAC,GAAG,OAAO;CAC5F,OAAO;AACT"}

package/dist/hermes-CKyzt1mH.js

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+import "./mcpsetup-DXXo2qjf.js";
+export { a as hermesSubscribe } from "./hermes-DHnDTYJp.js";