xaq-cli 0.0.0 → 0.1.0-nightly.71

package/dist/import-DsN5NZT3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"import-DsN5NZT3.js","names":["YAML_UNREADABLE","TOML_UNREADABLE"],"sources":["../server/connections-cli/routes.ts","../server/connections-cli/clients.ts","../server/connections-cli/import.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { hermesHome } from \"../listen/mcpsetup.ts\";\nimport type { ImportClient } from \"./clients.ts\";\nimport { readTopMap, UNREADABLE, type YamlValue } from \"./yaml.ts\";\n\n/**\n * Places in a client's config that confine something to the xaq MCP server alone: Hermes platform toolsets,\n * webhook routes (`toolsets: [\"mcp-<server>\", …]`) and cron jobs (`enabled_toolsets: [\"<server>\"]`). Once the\n * imported servers are served through xaq, each of these also sees their tools, so `import` warns before\n * replacing anything (docs/listen.md: an email-triggered route confined to xaq).\n */\nexport function confinedRoutes(client: ImportClient, serverName: string, env: NodeJS.ProcessEnv = process.env): string[] {\n  if (client !== \"hermes\") return [];\n  const home = hermesHome(env);\n  const names = new Set([serverName, `mcp-${serverName}`]);\n  const confines = (v: unknown) => Array.isArray(v) && v.some((x) => typeof x === \"string\" && names.has(x));\n  const out: string[] = [];\n  const read = (file: string): unknown => {\n    try {\n      return existsSync(file) ? JSON.parse(readFileSync(file, \"utf8\").replace(/^/, \"\")) : null;\n    } catch {\n      return null;\n    }\n  };\n  try {\n    const config = join(home, \"config.yaml\");\n    if (existsSync(config)) {\n      const yaml = readFileSync(config, \"utf8\");\n      const platforms = readTopMap(yaml, \"platform_toolsets\") ?? {};\n      for (const [platform, toolsets] of Object.entries(platforms)) if (confines(toolsets)) out.push(`platform_toolsets.${platform} (config.yaml)`);\n      // Static webhook routes: platforms.webhook.extra.routes, a map of name → route or a list of routes.\n      const get = (v: YamlValue | undefined, k: string): YamlValue | undefined => (v && typeof v === \"object\" && !Array.isArray(v) ? (v as Record<string, YamlValue>)[k] : undefined);\n      const routes = get(get(get(readTopMap(yaml, \"platforms\") ?? undefined, \"webhook\"), \"extra\"), \"routes\");\n      if (routes === UNREADABLE || (Array.isArray(routes) && routes.some((r) => r === UNREADABLE))) {\n        out.push(\"webhook routes in config.yaml (platforms.webhook.extra.routes: couldn't be read, so check their toolsets)\");\n      } else if (Array.isArray(routes)) {\n        routes.forEach((r, i) => {\n          if (confines(get(r, \"toolsets\"))) out.push(`webhook route ${String(get(r, \"name\") ?? `#${i + 1}`)} (config.yaml)`);\n        });\n      } else if (routes && typeof routes === \"object\") {\n        for (const [name, r] of Object.entries(routes as Record<string, YamlValue>)) if (confines(get(r, \"toolsets\"))) out.push(`webhook route ${name} (config.yaml)`);\n      }\n    }\n  } catch {\n    // Unreadable: nothing to warn about from it.\n  }\n  const subs = read(join(home, \"webhook_subscriptions.json\"));\n  if (subs && typeof subs === \"object\" && !Array.isArray(subs)) {\n    for (const [route, r] of Object.entries(subs as Record<string, { toolsets?: unknown }>)) if (confines(r?.toolsets)) out.push(`webhook route ${route}`);\n  }\n  const cron = read(join(home, \"cron\", \"jobs.json\"));\n  const jobs = (Array.isArray(cron) ? cron : ((cron as { jobs?: unknown } | null)?.jobs ?? [])) as { id?: unknown; name?: unknown; enabled_toolsets?: unknown }[];\n  if (Array.isArray(jobs)) for (const j of jobs) if (confines(j?.enabled_toolsets)) out.push(`cron job ${String(j.name ?? j.id ?? \"?\")}`);\n  return out;\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { claudeConfigFile, codexConfigFile, cursorConfigFile, hermesHome } from \"../listen/mcpsetup.ts\";\nimport { readTomlMcpServers, type TomlTable, UNREADABLE as TOML_UNREADABLE } from \"./toml.ts\";\nimport { readMcpServers, UNREADABLE as YAML_UNREADABLE, type YamlMap } from \"./yaml.ts\";\n\n/** Reads the MCP servers an agent's own tool is configured with (for `import --from`). */\n\nexport const IMPORT_CLIENTS = [\"hermes\", \"claude-code\", \"cursor\", \"codex\"] as const;\nexport type ImportClient = (typeof IMPORT_CLIENTS)[number];\n\nexport const CLIENT_LABELS: Record<ImportClient, string> = { hermes: \"Hermes\", \"claude-code\": \"Claude Code\", cursor: \"Cursor\", codex: \"Codex\" };\n\nexport interface ClientEntry {\n  name: string;\n  /** The file it's defined in. */\n  file: string;\n  /** Claude Code: which scope (user: ~/.claude.json; local: its projects[cwd]; project: ./.mcp.json). */\n  scope?: \"user\" | \"local\" | \"project\";\n  /** Claude Code local/project scope: the project directory (where `claude mcp remove` must run). */\n  projectDir?: string;\n  transport: \"http\" | \"sse\" | \"stdio\";\n  url?: string;\n  /** Static headers, with ${VAR} references resolved. Secret: never printed. */\n  headers: Record<string, string>;\n  /** Names of environment variables the headers came from (for the \"you can remove it from .env\" note). */\n  headerVars: string[];\n  /** Per header: the environment variables its value was built from (shown in the plan next to the destination). */\n  headerSources: Record<string, string[]>;\n  /**\n   * Defined in a file the project ships (Claude Code's ./.mcp.json), not by the user: anyone who can commit to the\n   * repository wrote it. Imported only when Claude Code approved it, and only after its own confirmation.\n   */\n  fromProject?: boolean;\n  /** Client-side settings the broker doesn't carry over: tool filters and timeouts. */\n  dropped?: DroppedSettings;\n  /** The client says it uses OAuth (Hermes `auth: oauth`, an oauth block). Its tokens stay in the client. */\n  oauth: boolean;\n  enabled: boolean;\n  /** Why it can't be imported as it is. */\n  problem?: string;\n  /** stdio: the command line, for the listing. */\n  command?: string;\n}\n\nexport interface DroppedSettings {\n  /** Tools the client hides from its agent (Hermes tools.exclude, Codex disabled_tools). */\n  exclude?: string[];\n  /** The only tools the client shows (Hermes tools.include, Codex enabled_tools). */\n  include?: string[];\n  /** Other settings by name, e.g. timeout, connect_timeout. */\n  settings: string[];\n}\n\nconst strings = (v: unknown) => (Array.isArray(v) ? v.filter((x): x is string => typeof x === \"string\") : undefined);\n\nfunction droppedFrom(e: Record<string, unknown>, filters: { include: unknown; exclude: unknown }, settingKeys: string[]): DroppedSettings | undefined {\n  const d: DroppedSettings = { settings: settingKeys.filter((k) => e[k] !== undefined && e[k] !== null) };\n  const inc = strings(filters.include);\n  const exc = strings(filters.exclude);\n  if (inc?.length) d.include = inc;\n  if (exc?.length) d.exclude = exc;\n  return d.include || d.exclude || d.settings.length ? d : undefined;\n}\n\nexport interface ClientConfig {\n  client: ImportClient;\n  files: string[];\n  entries: ClientEntry[];\n}\n\nexport interface ReadOptions {\n  env?: NodeJS.ProcessEnv;\n  cwd?: string;\n}\n\n/** Parses a dotenv file (KEY=VALUE, optional `export`, quotes). */\nexport function parseDotenv(text: string): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const raw of text.split(\"\\n\")) {\n    const m = /^\\s*(?:export\\s+)?([A-Za-z_][A-Za-z0-9_]*)\\s*=\\s*(.*?)\\s*$/.exec(raw);\n    if (!m) continue;\n    let v = m[2]!;\n    if ((v.startsWith('\"') && v.endsWith('\"') && v.length >= 2) || (v.startsWith(\"'\") && v.endsWith(\"'\") && v.length >= 2)) v = v.slice(1, -1);\n    else v = v.replace(/\\s+#.*$/, \"\");\n    out[m[1]!] = v;\n  }\n  return out;\n}\n\ntype Expanded = { value: string; vars: string[] } | { missing: string };\n\n/** `${VAR}` (and `${VAR:-default}`, `${env:VAR}`) from `vars`. */\nexport function expandVars(value: string, vars: Record<string, string | undefined>): Expanded {\n  const used: string[] = [];\n  let missing: string | null = null;\n  const out = value.replace(/\\$\\{(?:env:)?([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\\}/g, (_m, name: string, def: string | undefined) => {\n    const v = vars[name];\n    if (v !== undefined && v !== \"\") {\n      used.push(name);\n      return v;\n    }\n    if (def !== undefined) return def;\n    missing ??= name;\n    return \"\";\n  });\n  return missing ? { missing } : { value: out, vars: used };\n}\n\nconst isObj = (v: unknown): v is Record<string, unknown> => !!v && typeof v === \"object\" && !Array.isArray(v);\nconst readJson = (file: string): Record<string, unknown> | null => {\n  if (!existsSync(file)) return null;\n  const text = readFileSync(file, \"utf8\");\n  if (!text.trim()) return {};\n  try {\n    const doc = JSON.parse(text) as unknown;\n    if (!isObj(doc)) throw new Error(\"not an object\");\n    return doc;\n  } catch {\n    throw new Error(`${file} isn't plain JSON (comments?), so it can't be read automatically.`);\n  }\n};\n\n/** Shared by the JSON-shaped clients (Claude Code, Cursor): one `mcpServers` entry. */\nfunction jsonEntry(name: string, raw: unknown, file: string, vars: Record<string, string | undefined>, extra: Partial<ClientEntry> = {}): ClientEntry {\n  const base: ClientEntry = { name, file, transport: \"http\", headers: {}, headerVars: [], headerSources: {}, oauth: false, enabled: true, ...extra };\n  if (!isObj(raw)) return { ...base, problem: \"this entry isn't an object\" };\n  if (raw.disabled === true || raw.enabled === false) base.enabled = false;\n  const type = typeof raw.type === \"string\" ? raw.type.toLowerCase() : null;\n  if (type === \"stdio\" || (typeof raw.command === \"string\" && !raw.url)) {\n    const args = Array.isArray(raw.args) ? raw.args.map(String) : [];\n    return { ...base, transport: \"stdio\", command: [String(raw.command ?? \"\"), ...args].join(\" \").trim() };\n  }\n  if (typeof raw.url !== \"string\") return { ...base, problem: \"no url\" };\n  const url = expandVars(raw.url, vars);\n  if (\"missing\" in url) return { ...base, problem: `its url uses \\${${url.missing}}, which isn't set here` };\n  const entry: ClientEntry = { ...base, url: url.value, transport: type === \"sse\" ? \"sse\" : \"http\" };\n  if (raw.headersHelper !== undefined || raw.headers_helper !== undefined) return { ...entry, problem: \"it gets its headers from a helper command, which the broker can't run\" };\n  if (raw.oauth !== undefined || raw.auth !== undefined) entry.oauth = true;\n  return withHeaders(entry, raw.headers, vars);\n}\n\nfunction withHeaders(entry: ClientEntry, headers: unknown, vars: Record<string, string | undefined>): ClientEntry {\n  if (headers === undefined || headers === null) return entry;\n  if (!isObj(headers)) return { ...entry, problem: \"its headers can't be read\" };\n  for (const [k, v] of Object.entries(headers)) {\n    if (typeof v !== \"string\") return { ...entry, problem: `its ${k} header can't be read` };\n    const x = expandVars(v, vars);\n    if (\"missing\" in x) return { ...entry, problem: `its ${k} header uses \\${${x.missing}}, which isn't set here` };\n    entry.headers[k] = x.value;\n    entry.headerVars.push(...x.vars);\n    entry.headerSources[k] = x.vars;\n  }\n  return entry;\n}\n\n// ───────────── Hermes ─────────────\n\nexport function hermesFiles(env: NodeJS.ProcessEnv = process.env): { config: string; env: string } {\n  const home = hermesHome(env);\n  return { config: join(home, \"config.yaml\"), env: join(home, \".env\") };\n}\n\nfunction readHermes(opts: ReadOptions): ClientConfig {\n  const env = opts.env ?? process.env;\n  const files = hermesFiles(env);\n  const result: ClientConfig = { client: \"hermes\", files: [files.config], entries: [] };\n  if (!existsSync(files.config)) return result;\n  const servers = readMcpServers(readFileSync(files.config, \"utf8\"));\n  if (!servers) throw new Error(`${files.config} has an mcp_servers layout this can't read (flow style, several blocks, or tabs). Nothing was changed.`);\n  // Hermes loads ~/.hermes/.env into its environment: the secrets its ${VAR} headers name live there.\n  const vars = { ...env, ...(existsSync(files.env) ? parseDotenv(readFileSync(files.env, \"utf8\")) : {}) };\n  for (const [name, raw] of Object.entries(servers)) {\n    if (name.startsWith(\"\\u0000\")) continue;\n    const base: ClientEntry = { name, file: files.config, transport: \"http\", headers: {}, headerVars: [], headerSources: {}, oauth: false, enabled: true };\n    if (!raw || raw === YAML_UNREADABLE || typeof raw !== \"object\" || Array.isArray(raw)) {\n      result.entries.push({ ...base, problem: \"this entry can't be read\" });\n      continue;\n    }\n    const e = raw as YamlMap;\n    const unreadable = [\"url\", \"headers\", \"command\", \"auth\", \"transport\", \"enabled\"].find((k) => e[k] === YAML_UNREADABLE);\n    if (unreadable) {\n      result.entries.push({ ...base, problem: `its ${unreadable} can't be read` });\n      continue;\n    }\n    if (e.enabled === false || (typeof e.enabled === \"string\" && [\"false\", \"no\", \"off\", \"0\"].includes(e.enabled.toLowerCase()))) base.enabled = false;\n    if (typeof e.command === \"string\") {\n      const args = Array.isArray(e.args) ? e.args.filter((a) => typeof a === \"string\") : [];\n      result.entries.push({ ...base, transport: \"stdio\", command: [e.command, ...args].join(\" \") });\n      continue;\n    }\n    if (typeof e.url !== \"string\") {\n      result.entries.push({ ...base, problem: \"no url\" });\n      continue;\n    }\n    const url = expandVars(e.url, vars);\n    if (\"missing\" in url) {\n      result.entries.push({ ...base, problem: `its url uses \\${${url.missing}}, which isn't set in ${files.env}` });\n      continue;\n    }\n    const tools = isObj(e.tools) ? (e.tools as Record<string, unknown>) : {};\n    const entry: ClientEntry = {\n      ...base,\n      url: url.value,\n      transport: e.transport === \"sse\" ? \"sse\" : \"http\",\n      oauth: e.auth === \"oauth\" || isObj(e.oauth),\n      dropped: droppedFrom(e as Record<string, unknown>, { include: tools.include, exclude: tools.exclude }, [\"timeout\", \"connect_timeout\"]),\n    };\n    if (e.client_cert !== undefined || e.identity_header !== undefined) {\n      result.entries.push({ ...entry, problem: \"it uses a client certificate or identity header, which the broker doesn't support yet\" });\n      continue;\n    }\n    result.entries.push(withHeaders(entry, e.headers ?? undefined, vars));\n  }\n  return result;\n}\n\n// ───────────── Claude Code ─────────────\n\nfunction readClaude(opts: ReadOptions): ClientConfig {\n  const env = opts.env ?? process.env;\n  const cwd = opts.cwd ?? process.cwd();\n  const userFile = claudeConfigFile();\n  const projectFile = join(cwd, \".mcp.json\");\n  const result: ClientConfig = { client: \"claude-code\", files: [userFile, projectFile].filter(existsSync), entries: [] };\n  const seen = new Set<string>();\n  const add = (e: ClientEntry) => {\n    // Claude Code's precedence: local, then project, then user. A shadowed one isn't what the agent uses.\n    if (seen.has(e.name)) return;\n    seen.add(e.name);\n    result.entries.push(e);\n  };\n  const doc = readJson(userFile);\n  const proj = doc && isObj(doc.projects) && isObj(doc.projects[cwd]) ? (doc.projects[cwd] as Record<string, unknown>) : {};\n  const local = proj.mcpServers;\n  if (isObj(local)) for (const [n, raw] of Object.entries(local)) add(jsonEntry(n, raw, userFile, env, { scope: \"local\", projectDir: cwd }));\n  const project = readJson(projectFile);\n  if (project && isObj(project.mcpServers)) {\n    // ./.mcp.json comes with the repository. Claude Code itself only uses the servers the user approved for this\n    // project (kept in ~/.claude.json, which the repository can't write); a project's own .claude/settings*.json\n    // isn't trusted for this.\n    const list = (v: unknown) => (Array.isArray(v) ? v.filter((x): x is string => typeof x === \"string\") : []);\n    const enabled = new Set(list(proj.enabledMcpjsonServers));\n    const disabled = new Set(list(proj.disabledMcpjsonServers));\n    const all = proj.enableAllProjectMcpServers === true;\n    for (const [n, raw] of Object.entries(project.mcpServers)) {\n      const e = jsonEntry(n, raw, projectFile, env, { scope: \"project\", projectDir: cwd, fromProject: true });\n      const why = disabled.has(n) ? \"turned off for this project in Claude Code\" : !all && !enabled.has(n) ? \"not approved in Claude Code\" : null;\n      // An unapproved one isn't what Claude Code uses, so it doesn't shadow a user-scope server of the same name.\n      if (why) result.entries.push({ ...e, problem: why });\n      else add(e);\n    }\n  }\n  if (doc && isObj(doc.mcpServers)) for (const [n, raw] of Object.entries(doc.mcpServers)) add(jsonEntry(n, raw, userFile, env, { scope: \"user\" }));\n  return result;\n}\n\n// ───────────── Cursor ─────────────\n\nfunction readCursor(opts: ReadOptions): ClientConfig {\n  const env = opts.env ?? process.env;\n  const file = cursorConfigFile();\n  const result: ClientConfig = { client: \"cursor\", files: [file], entries: [] };\n  const doc = readJson(file);\n  if (doc && isObj(doc.mcpServers)) for (const [n, raw] of Object.entries(doc.mcpServers)) result.entries.push(jsonEntry(n, raw, file, env));\n  return result;\n}\n\n// ───────────── Codex ─────────────\n\nfunction readCodex(opts: ReadOptions): ClientConfig {\n  const env = opts.env ?? process.env;\n  const file = codexConfigFile();\n  const result: ClientConfig = { client: \"codex\", files: [file], entries: [] };\n  if (!existsSync(file)) return result;\n  for (const [name, raw] of Object.entries(readTomlMcpServers(readFileSync(file, \"utf8\")))) {\n    const base: ClientEntry = { name, file, transport: \"http\", headers: {}, headerVars: [], headerSources: {}, oauth: false, enabled: true };\n    if (raw === TOML_UNREADABLE) {\n      result.entries.push({ ...base, problem: \"this entry can't be read\" });\n      continue;\n    }\n    const e = raw as TomlTable;\n    if (e.enabled === false) base.enabled = false;\n    if (typeof e.command === \"string\") {\n      const args = Array.isArray(e.args) ? e.args.filter((a): a is string => typeof a === \"string\") : [];\n      result.entries.push({ ...base, transport: \"stdio\", command: [e.command, ...args].join(\" \") });\n      continue;\n    }\n    if (typeof e.url !== \"string\") {\n      result.entries.push({ ...base, problem: \"no url\" });\n      continue;\n    }\n    const entry: ClientEntry = {\n      ...base,\n      url: e.url,\n      oauth: isObj(e.oauth) || e.auth === \"oauth\",\n      dropped: droppedFrom(e, { include: e.enabled_tools, exclude: e.disabled_tools }, [\"tool_timeout_sec\", \"startup_timeout_sec\"]),\n    };\n    if (e.http_headers_helper !== undefined) {\n      result.entries.push({ ...entry, problem: \"it gets its headers from a helper command, which the broker can't run\" });\n      continue;\n    }\n    // Codex has no ${VAR} expansion: env_http_headers and bearer_token_env_var name variables instead.\n    const headers: Record<string, string> = {};\n    let problem: string | undefined;\n    if (e.http_headers !== undefined) {\n      if (!isObj(e.http_headers) || Object.values(e.http_headers).some((v) => typeof v !== \"string\")) problem = \"its http_headers can't be read\";\n      else {\n        Object.assign(headers, e.http_headers);\n        for (const h of Object.keys(e.http_headers)) entry.headerSources[h] = [];\n      }\n    }\n    const fromEnv: Record<string, unknown> = isObj(e.env_http_headers) ? { ...e.env_http_headers } : {};\n    if (e.bearer_token_env_var !== undefined) fromEnv.Authorization = e.bearer_token_env_var;\n    for (const [h, varName] of Object.entries(fromEnv)) {\n      if (typeof varName !== \"string\") problem ??= `its ${h} header can't be read`;\n      else if (!env[varName]) problem ??= `its ${h} header comes from $${varName}, which isn't set here`;\n      else {\n        headers[h] = h === \"Authorization\" && e.bearer_token_env_var === varName ? `Bearer ${env[varName]}` : env[varName]!;\n        entry.headerVars.push(varName);\n        entry.headerSources[h] = [varName];\n      }\n    }\n    entry.headers = headers;\n    result.entries.push(problem ? { ...entry, problem } : entry);\n  }\n  return result;\n}\n\nexport function readClientConfig(client: ImportClient, opts: ReadOptions = {}): ClientConfig {\n  switch (client) {\n    case \"hermes\":\n      return readHermes(opts);\n    case \"claude-code\":\n      return readClaude(opts);\n    case \"cursor\":\n      return readCursor(opts);\n    case \"codex\":\n      return readCodex(opts);\n  }\n}\n\nexport function parseImportClient(value: string): ImportClient {\n  const v = value.trim().toLowerCase().replace(/^claude$/, \"claude-code\");\n  if (!(IMPORT_CLIENTS as readonly string[]).includes(v)) throw new Error(`Unknown --from \"${value}\". Choose one of: ${IMPORT_CLIENTS.join(\", \")}.`);\n  return v as ImportClient;\n}\n","import pc from \"picocolors\";\nimport type { Agent } from \"../../shared/types.ts\";\nimport type { AccessLevel } from \"../broker/types.ts\";\nimport { mcpTarget, type McpSetupResult, type RemoveServer, setupMcp } from \"../listen/mcpsetup.ts\";\nimport { DEFAULT_PROFILE, profilePath } from \"../listen/paths.ts\";\nimport { loadProfile, type Profile, profileExists } from \"../listen/profile.ts\";\nimport { safeText } from \"../listen/ui.ts\";\nimport { NPX } from \"../listen/version.ts\";\nimport type { LookupFn } from \"../webhooks/ssrf.ts\";\nimport { accessLabel, agentsLabel, chooseAccess, chooseAgents, parseAccess } from \"./access.ts\";\nimport { isWorking, waitWorking } from \"./manage.ts\";\nimport { confinedRoutes } from \"./routes.ts\";\nimport { mcpServerName } from \"../listen/recipes.ts\";\nimport type { ConnectionsApi, ConnectionView } from \"./api.ts\";\nimport { CLIENT_LABELS, type ClientConfig, type ClientEntry, type ImportClient, parseImportClient, readClientConfig } from \"./clients.ts\";\nimport { checkTarget } from \"./private.ts\";\nimport type { Prompter } from \"./prompt.ts\";\nimport { reconnectHint, slugify } from \"./util.ts\";\n\n/**\n * `import --from <client>`: one connection per remote MCP server in that client's config, with its static header\n * moved into the broker. OAuth servers are created needing Connect (their tokens stay in the client); stdio ones\n * aren't supported yet (M4) and stay where they are. Nothing is written without a confirmation (or --yes), and\n * the client's config is only touched by the optional setup-mcp step at the end, which removes just the entries\n * whose connection works.\n */\n\nexport interface ImportFlags {\n  from: string;\n  dryRun?: boolean;\n  yes?: boolean;\n  access?: string;\n  agent?: string[];\n  profile?: string;\n  /** Exact `scheme://host:port` origins allowed without asking (--yes never allows one). */\n  allowPrivate?: string[];\n}\n\nexport interface ImportDeps {\n  prompter: Prompter;\n  /** Opens the admin channel (not called for --dry-run). */\n  openApi: () => ConnectionsApi;\n  lookup?: LookupFn;\n  env?: NodeJS.ProcessEnv;\n  cwd?: string;\n  /** This xaq's own MCP origins (loopback with its port), so its entry is never imported. */\n  selfOrigins?: string[];\n  /** How long to wait for a connected server's first tool sync (default 10 s), and how often to look. */\n  verifyMs?: number;\n  pollMs?: number;\n}\n\nexport type PlanItem =\n  | { action: \"self\"; entry: ClientEntry }\n  | { action: \"stdio\"; entry: ClientEntry }\n  | { action: \"skip\"; entry: ClientEntry; reason: string }\n  | { action: \"exists\"; entry: ClientEntry; connection: ConnectionView }\n  | {\n      action: \"create\";\n      entry: ClientEntry;\n      slug: string;\n      url: string;\n      /** header: moved into the broker; oauth: the client says so; none: no credential (the connect finds out). */\n      auth: { type: \"header\"; name: string; value: string } | { type: \"oauth\" } | { type: \"none\" };\n      /** The exact origin a private-target allow would cover, when the URL is on this machine or a private network. */\n      privateTarget: string | null;\n    };\n\n// Our own entry under its name, or under the one a profile from before the rename registered: never imported.\nconst SELF_NAME = /^(?:xaq|agentinbox)(?:-[a-z0-9][a-z0-9_-]*)?$/; // rename-xaq: keep\n\nfunction isSelf(e: ClientEntry, selfOrigins: string[]): boolean {\n  if (SELF_NAME.test(e.name)) return true;\n  if (Object.values(e.headers).some((v) => /^Bearer\\s+aib_/i.test(v.trim()))) return true;\n  if (!e.url) return false;\n  try {\n    const u = new URL(e.url);\n    return u.pathname.replace(/\\/+$/, \"\").endsWith(\"/mcp\") && selfOrigins.includes(u.origin);\n  } catch {\n    return false;\n  }\n}\n\nconst sameUrl = (a: string | null | undefined, b: string) => {\n  try {\n    return !!a && new URL(a).href.replace(/\\/+$/, \"\") === new URL(b).href.replace(/\\/+$/, \"\");\n  } catch {\n    return false;\n  }\n};\n\nexport async function planImport(config: ClientConfig, ctx: { existing?: ConnectionView[]; lookup?: LookupFn; selfOrigins?: string[] } = {}): Promise<PlanItem[]> {\n  const label = CLIENT_LABELS[config.client];\n  const taken = new Set((ctx.existing ?? []).map((c) => c.slug));\n  const items: PlanItem[] = [];\n  for (const entry of config.entries) {\n    if (isSelf(entry, ctx.selfOrigins ?? [])) {\n      items.push({ action: \"self\", entry });\n      continue;\n    }\n    if (entry.transport === \"stdio\") {\n      items.push({ action: \"stdio\", entry });\n      continue;\n    }\n    if (entry.problem) {\n      items.push({ action: \"skip\", entry, reason: entry.problem });\n      continue;\n    }\n    if (!entry.enabled) {\n      items.push({ action: \"skip\", entry, reason: `it's turned off in ${label}` });\n      continue;\n    }\n    let url: URL;\n    try {\n      url = new URL(entry.url!);\n      if (url.protocol !== \"http:\" && url.protocol !== \"https:\") throw new Error(\"scheme\");\n    } catch {\n      items.push({ action: \"skip\", entry, reason: \"its url isn't an http(s) URL\" });\n      continue;\n    }\n    const headerNames = Object.keys(entry.headers);\n    if (headerNames.length > 1) {\n      items.push({ action: \"skip\", entry, reason: `it sends ${headerNames.length} headers (${headerNames.join(\", \")}); a connection keeps one (not supported yet)` });\n      continue;\n    }\n    const existing = (ctx.existing ?? []).find((c) => sameUrl(c.url, url.href));\n    if (existing) {\n      items.push({ action: \"exists\", entry, connection: existing });\n      continue;\n    }\n    const target = await checkTarget(url, ctx.lookup);\n    if (target.kind === \"never\") {\n      items.push({\n        action: \"skip\",\n        entry,\n        reason:\n          target.why === \"ipv6_literal\"\n            ? `the private-network allow takes a hostname or an IPv4 address, not ${target.address}`\n            : `it's on ${target.address}, a link-local or cloud metadata address, which is never allowed`,\n      });\n      continue;\n    }\n    if (target.kind === \"public\" && url.protocol === \"http:\") {\n      items.push({ action: \"skip\", entry, reason: \"plain http to a public host isn't allowed; use its https URL\" });\n      continue;\n    }\n    let slug = slugify(entry.name);\n    for (let n = 2; taken.has(slug); n++) slug = `${slugify(entry.name).slice(0, 21)}-${n}`;\n    taken.add(slug);\n    const auth = headerNames.length\n      ? { type: \"header\" as const, name: headerNames[0]!, value: entry.headers[headerNames[0]!]! }\n      : entry.oauth\n        ? { type: \"oauth\" as const }\n        : { type: \"none\" as const };\n    items.push({ action: \"create\", entry, slug, url: entry.url!.trim(), auth, privateTarget: target.kind === \"private\" ? target.origin : null });\n  }\n  return items;\n}\n\nconst where = (e: ClientEntry) => (e.scope ? ` (${e.scope} scope)` : \"\");\nconst hostOf = (url: string) => {\n  try {\n    return new URL(url).host;\n  } catch {\n    return url;\n  }\n};\n\n/** \"its Authorization header (from $GITHUB_TOKEN) is sent to mcp.example.com\": where each secret ends up. */\nfunction headerLine(i: Extract<PlanItem, { action: \"create\" }>): string | null {\n  if (i.auth.type !== \"header\") return null;\n  const vars = i.entry.headerSources[i.auth.name] ?? [];\n  const from = vars.length ? ` (from ${vars.map((v) => `$${v}`).join(\", \")})` : \"\";\n  return `its ${i.auth.name} header${from} moves into xaq (encrypted; never shown) and is sent to ${safeText(hostOf(i.url), 120)}`;\n}\n\n/** The plan in plain words. Never prints a header value. */\nexport function renderPlan(config: ClientConfig, items: PlanItem[]): string[] {\n  const label = CLIENT_LABELS[config.client];\n  const out: string[] = [];\n  const width = Math.min(24, Math.max(4, ...items.map((i) => i.entry.name.length)));\n  const pad = (s: string) => s.padEnd(width);\n  const cont = \" \".repeat(width + 4);\n  out.push(`${label}: ${config.files.join(\", \") || \"no config file\"} lists ${items.length} MCP server${items.length === 1 ? \"\" : \"s\"}.`);\n  for (const i of items) {\n    const name = `  ${pad(safeText(i.entry.name, 40))}  `;\n    switch (i.action) {\n      case \"self\":\n        out.push(`${name}${pc.dim(\"skip: this is xaq itself\")}`);\n        break;\n      case \"stdio\":\n        out.push(`${name}${pc.yellow(\"not supported yet (M4)\")}: a local command (${safeText(i.entry.command ?? \"\", 60)}); it stays in ${label}`);\n        break;\n      case \"skip\":\n        out.push(`${name}${pc.yellow(\"skip\")}: ${i.reason}; it stays in ${label}`);\n        break;\n      case \"exists\":\n        if (isWorking(i.connection)) out.push(`${name}already connected: \"${i.connection.slug}\" (${i.connection.tools.total} tools)`);\n        else {\n          const why =\n            i.entry.oauth || i.connection.authType === \"oauth\" || i.connection.status === \"needs_reauth\" ? \"needs Connect\" : `${i.connection.status}, ${i.connection.tools.total} tools`;\n          out.push(`${name}already a connection: \"${i.connection.slug}\", ${why}; it stays in ${label} until it works`);\n          out.push(`${cont}${reconnectHint(i.connection)}`);\n        }\n        out.push(...droppedLines(i.entry, cont));\n        break;\n      case \"create\": {\n        out.push(`${name}${pc.green(\"create\")} connection \"${i.slug}\" → ${safeText(i.url, 120)}${where(i.entry)}`);\n        if (i.entry.fromProject) out.push(`${cont}${pc.yellow(\"from the project's .mcp.json\")}: asked separately (--yes doesn't answer it)`);\n        const h = headerLine(i);\n        if (h) out.push(`${cont}${h}`);\n        else if (i.auth.type === \"oauth\") out.push(`${cont}OAuth: created needing Connect (${label} keeps its own tokens); sign in once with the link it prints`);\n        else out.push(`${cont}no credential in ${label}: connected as it is (if it turns out to use OAuth, it needs Connect)`);\n        if (i.privateTarget) out.push(`${cont}${pc.yellow(\"private network\")}: needs the allow for exactly ${i.privateTarget}`);\n        out.push(...droppedLines(i.entry, cont));\n        break;\n      }\n    }\n  }\n  return out;\n}\n\n/** What the client did for this server that the broker doesn't: said in the plan, never silently dropped. */\nfunction droppedLines(e: ClientEntry, cont: string): string[] {\n  const d = e.dropped;\n  if (!d) return [];\n  const out: string[] = [];\n  const list = (xs: string[]) => xs.map((x) => safeText(x, 64)).join(\", \");\n  if (d.exclude) out.push(`${cont}${pc.yellow(\"not carried over\")}: its tool filter hides ${list(d.exclude)}; through xaq every tool is listed (subject to the access level)`);\n  if (d.include) out.push(`${cont}${pc.yellow(\"not carried over\")}: its tool filter shows only ${list(d.include)}; through xaq every tool is listed (subject to the access level)`);\n  if (d.settings.length) out.push(`${cont}${pc.yellow(\"not carried over\")}: ${d.settings.join(\", \")} (xaq uses its own 60 s per call)`);\n  return out;\n}\n\ntype CreateItem = Extract<PlanItem, { action: \"create\" }>;\n\ninterface Outcome {\n  item: CreateItem;\n  /** connected: works now; unverified: created, but not working (yet); authorize: needs a sign-in; failed: nothing kept. */\n  status: \"connected\" | \"unverified\" | \"authorize\" | \"failed\";\n  connection?: ConnectionView;\n  authorizeUrl?: string;\n  error?: string;\n}\n\nconst works = isWorking;\n\nfunction setupLines(r: McpSetupResult): string[] {\n  const out = [r.ok ? `${r.dryRun ? pc.cyan(\"○\") : pc.green(\"✔\")} ${r.message}` : `${pc.yellow(\"!\")} ${r.message}`];\n  for (const l of r.changes ?? []) out.push(l.startsWith(\" \") ? pc.gray(`  ${l}`) : `  - ${l}`);\n  if (r.backup) out.push(pc.gray(`  Backup: ${r.backup}`));\n  if (!r.ok) for (const l of r.manual ?? []) out.push(`    ${l}`);\n  for (const n of r.notes ?? []) out.push(pc.dim(`  ${n}`));\n  if (r.ok && r.verify?.length) out.push(`  ${r.dryRun ? \"Afterwards, check it with\" : \"Check it with\"}: ${r.verify.map((v) => pc.cyan(v)).join(\"; \")}`);\n  return out;\n}\n\nconst toRemove = (e: ClientEntry): RemoveServer => ({ name: e.name, scope: e.scope, projectDir: e.scope === \"user\" ? undefined : e.projectDir });\n\n/** The agent this machine's client uses (its xaq profile), if that agent is on this daemon. */\ninterface ClientAgent {\n  profileName: string;\n  profile: Profile | null;\n  agent: Agent | null;\n}\n\nexport async function runImport(flags: ImportFlags, deps: ImportDeps): Promise<number> {\n  const p = deps.prompter;\n  const client: ImportClient = parseImportClient(flags.from);\n  const label = CLIENT_LABELS[client];\n  const access: AccessLevel | undefined = flags.access ? parseAccess(flags.access) : undefined;\n  const config = readClientConfig(client, { env: deps.env, cwd: deps.cwd });\n  if (!config.entries.length) {\n    p.print(`${label} has no MCP servers configured (${config.files.join(\", \") || \"no config file\"}). Nothing to import.`);\n    return 0;\n  }\n  const profileName = flags.profile ?? DEFAULT_PROFILE;\n\n  if (flags.dryRun) {\n    // Existing connections from the daemon when it's reachable, so a re-run's plan is the real one.\n    let existing: ConnectionView[] | undefined;\n    try {\n      existing = await deps.openApi().list();\n    } catch {\n      existing = undefined;\n    }\n    const items = await planImport(config, { existing, lookup: deps.lookup, selfOrigins: deps.selfOrigins });\n    p.print(pc.bold(\"Dry run: nothing is created or changed.\"));\n    for (const l of renderPlan(config, items)) p.print(l);\n    const creates = items.filter((i): i is CreateItem => i.action === \"create\");\n    const priv = creates.filter((i) => i.privateTarget);\n    p.print(\"\");\n    p.print(`Would create ${creates.length} connection${creates.length === 1 ? \"\" : \"s\"} with ${access ? accessLabel(access) : \"the access you choose (default: Ask before risky actions)\"}.`);\n    if (priv.length) p.print(`Would ask before allowing ${priv.map((i) => i.privateTarget).join(\", \")} (--yes never does; --allow-private <origin> does for that origin).`);\n    if (!existing) p.print(pc.dim(\"xaq wasn't reachable, so existing connections weren't checked (the real run does: nothing is created twice).\"));\n    const removable = [\n      ...items.filter((i): i is Extract<PlanItem, { action: \"exists\" }> => i.action === \"exists\" && works(i.connection)).map((i) => toRemove(i.entry)),\n      ...creates.filter((i) => i.auth.type !== \"oauth\").map((i) => toRemove(i.entry)),\n    ];\n    p.print(\"\");\n    if (!removable.length) p.print(`${label}'s config isn't changed.`);\n    else if (!profileExists(profileName)) {\n      p.print(`Afterwards it offers to replace the imported entries in ${label} with the single xaq entry, once this machine's ${label} is paired (${NPX} connect <xaq-url> --tool ${client}).`);\n    } else {\n      p.print(`Afterwards it offers setup-mcp --tool ${client}, which would (for the entries whose connection works and that ${label}'s agent can use; OAuth ones after you Reconnect them):`);\n      const r = setupMcp(client, mcpTarget(profileName, loadProfile(profileName)), profilePath(profileName), { dryRun: true, removeServers: removable });\n      for (const l of setupLines(r)) p.print(l);\n    }\n    return 0;\n  }\n\n  const api = deps.openApi();\n  const existing = await api.list();\n  const items = await planImport(config, { existing, lookup: deps.lookup, selfOrigins: deps.selfOrigins });\n  for (const l of renderPlan(config, items)) p.print(l);\n  let creates = items.filter((i): i is CreateItem => i.action === \"create\");\n  const already = items.filter((i): i is Extract<PlanItem, { action: \"exists\" }> => i.action === \"exists\");\n  p.print(\"\");\n\n  // A project's .mcp.json was written by whoever can commit to the repository: its own confirmation, never --yes.\n  const fromProject = creates.filter((i) => i.entry.fromProject);\n  if (fromProject.length) {\n    p.print(pc.yellow(`These come from ${fromProject[0]!.entry.file}, which ships with the project (anyone who can commit to it wrote them):`));\n    for (const i of fromProject) p.print(`  ${safeText(i.entry.name, 40)} → ${safeText(i.url, 120)}${headerLine(i) ? `; ${headerLine(i)}` : \"\"}`);\n    if (!(await p.confirmExplicit(`Import ${fromProject.length === 1 ? \"it\" : `these ${fromProject.length}`} into xaq?`, \"they stay in Claude Code\"))) {\n      creates = creates.filter((i) => !i.entry.fromProject);\n    }\n  }\n\n  // The private-target allow: only a person at the terminal (or --allow-private naming the exact origin) gives it.\n  const preAllowed = new Set(flags.allowPrivate ?? []);\n  const priv = creates.filter((i) => i.privateTarget && !preAllowed.has(i.privateTarget));\n  for (const i of creates.filter((x) => x.privateTarget && preAllowed.has(x.privateTarget))) p.print(`Allowing ${i.privateTarget} (${safeText(i.entry.name, 40)}): --allow-private.`);\n  if (priv.length) {\n    p.print(pc.yellow(\"These servers are on this machine or your private network:\"));\n    for (const i of priv) p.print(`  ${i.privateTarget}  (${safeText(i.entry.name, 40)})`);\n    p.print(\n      pc.dim(\"A connection to such a server can reach other services there too. Each allow covers exactly that scheme://host:port, for that connection only.\"),\n    );\n    const names = priv.map((i) => i.entry.name).join(\", \");\n    if (!(await p.confirmExplicit(`Allow xaq to connect to ${priv.length === 1 ? \"it\" : `these ${priv.length}`}?`, `skipping ${names} (pass --allow-private <origin> to allow one)`))) {\n      creates = creates.filter((i) => !priv.includes(i));\n    }\n  }\n\n  const who = await clientAgent(api, profileName);\n  if (!creates.length) {\n    p.print(\"Nothing to create.\");\n    return offerSetup(\n      deps,\n      api,\n      client,\n      who,\n      already.filter((a) => works(a.connection)).map((a) => ({ entry: a.entry, connection: a.connection })),\n      already.filter((a) => !works(a.connection)).map((a) => a.entry.name),\n      0,\n    );\n  }\n\n  const level = await chooseAccess(p, access);\n  let agents = await chooseAgents(p, api, flags.agent);\n  if (agents !== \"all\" && who.agent && !agents.includes(who.agent.id)) {\n    p.print(pc.yellow(`${safeText(who.agent.name, 60)} (the agent ${label} on this machine uses) isn't among them, so ${label} couldn't use these through xaq.`));\n    if (await p.confirm(`Include ${safeText(who.agent.name, 60)}?`, true)) agents = [...agents, who.agent.id];\n  }\n  if (!(await p.confirm(`Create ${creates.length} connection${creates.length === 1 ? \"\" : \"s\"} (${accessLabel(level)}, ${agentsLabel(agents)})?`, true))) {\n    p.print(\"Nothing was created.\");\n    return 0;\n  }\n\n  const outcomes: Outcome[] = [];\n  for (const item of creates) {\n    let created: ConnectionView | null = null;\n    try {\n      created = await api.create({ slug: item.slug, name: item.entry.name, url: item.url, levelDefault: level, ...(agents === \"all\" ? {} : { agentIds: agents }) });\n      if (item.privateTarget) await api.allowPrivateTarget(created.id, true);\n      const r = await api.connect(created.id, item.auth.type === \"header\" ? { header: { name: item.auth.name, value: item.auth.value } } : {});\n      if (r.status === \"connected\") {\n        // \"connected\" means stored, not tested (a header connect doesn't call the server): wait for the first tool sync.\n        const after = await waitWorking(api, r.connection, { pollMs: deps.pollMs, ms: deps.verifyMs });\n        outcomes.push({ item, status: works(after) ? \"connected\" : \"unverified\", connection: after });\n      } else if (r.status === \"authorize\") outcomes.push({ item, status: \"authorize\", connection: created, authorizeUrl: r.authorizeUrl });\n      else throw new Error(r.message);\n    } catch (err) {\n      // Nothing half-made stays behind: running the import again retries it cleanly.\n      if (created) await api.remove(created.id).catch(() => {});\n      outcomes.push({ item, status: \"failed\", error: err instanceof Error ? err.message : String(err) });\n    }\n  }\n\n  p.print(\"\");\n  for (const o of outcomes) {\n    const name = safeText(o.item.entry.name, 40);\n    if (o.status === \"failed\") p.print(`${pc.red(\"✘\")} ${name}: ${safeText(o.error!, 300)} (it stays in ${label})`);\n    else if (o.status === \"connected\") p.print(`${pc.green(\"✔\")} ${name} → \"${o.connection!.slug}\", ${o.connection!.tools.total} tools`);\n    else if (o.status === \"unverified\") {\n      const c = o.connection!;\n      p.print(`${pc.yellow(\"○\")} ${name} → \"${c.slug}\": not working (${c.status}${c.statusReason ? `: ${safeText(c.statusReason, 200)}` : \"\"}, ${c.tools.total} tools), so it stays in ${label}.`);\n      p.print(`    ${reconnectHint(c)}   then run this import again.`);\n    }\n    else {\n      p.print(`${pc.yellow(\"○\")} ${name} → \"${o.connection!.slug}\": needs Connect. Sign in (link valid 15 minutes):`);\n      p.print(`    ${pc.cyan(o.authorizeUrl!)}`);\n      p.print(`    ${reconnectHint(o.connection!)}`);\n    }\n  }\n  const failed = outcomes.filter((o) => o.status === \"failed\").length;\n  const working = [\n    ...already.filter((a) => works(a.connection)).map((a) => ({ entry: a.entry, connection: a.connection })),\n    ...outcomes.filter((o) => o.status === \"connected\").map((o) => ({ entry: o.item.entry, connection: o.connection! })),\n  ];\n  const pending = [\n    ...already.filter((a) => !works(a.connection)).map((a) => a.entry.name),\n    ...outcomes.filter((o) => o.status === \"authorize\" || o.status === \"unverified\").map((o) => o.item.entry.name),\n  ];\n  return offerSetup(deps, api, client, who, working, pending, failed ? 1 : 0);\n}\n\nasync function clientAgent(api: ConnectionsApi, profileName: string): Promise<ClientAgent> {\n  if (!profileExists(profileName)) return { profileName, profile: null, agent: null };\n  const profile = loadProfile(profileName);\n  const agent = (await api.agents()).find((a) => a.id === profile.agentId && !a.disabled) ?? null;\n  return { profileName, profile, agent };\n}\n\n/**\n * Step 2: replace the entries now served by the broker with the single xaq entry (setup-mcp). Only entries\n * the client's own agent can use through xaq go: the profile's agent must be on this daemon and have a grant\n * on the connection (offered when it has none).\n */\nasync function offerSetup(\n  deps: ImportDeps,\n  api: ConnectionsApi,\n  client: ImportClient,\n  who: ClientAgent,\n  working: { entry: ClientEntry; connection: ConnectionView }[],\n  pending: string[],\n  code: number,\n): Promise<number> {\n  const p = deps.prompter;\n  const label = CLIENT_LABELS[client];\n  if (pending.length) p.print(pc.dim(`${pending.join(\", \")} stay${pending.length === 1 ? \"s\" : \"\"} in ${label} until ${pending.length === 1 ? \"it works\" : \"they work\"} through xaq (Reconnect); then run this import again to replace ${pending.length === 1 ? \"it\" : \"them\"}.`));\n  if (!working.length) return code;\n  if (!who.profile) {\n    p.print(\n      `To replace ${working.map((w) => w.entry.name).join(\", \")} in ${label} with the single xaq entry, pair it first ` +\n        `(${NPX} connect <xaq-url> --tool ${client}) and run this import again.`,\n    );\n    return code;\n  }\n  if (!who.agent) {\n    p.print(\n      pc.yellow(\n        `The agent in your \"${who.profileName}\" profile (${safeText(who.profile.agentId, 40)}) isn't an agent of this xaq (or is disabled), so ${label} ` +\n          `couldn't use these through it. Not replacing anything in ${label}. Pair it with this xaq (${NPX} connect <xaq-url> --tool ${client} --force), then run this import again.`,\n      ),\n    );\n    return code;\n  }\n  const agentName = safeText(who.agent.name, 60);\n  const usable: ClientEntry[] = [];\n  for (const w of working) {\n    if (w.entry.fromProject) {\n      // ./.mcp.json is the project's file (often committed): left for its owners to change.\n      p.print(pc.dim(`  \"${w.entry.name}\" stays in ${w.entry.file}: it ships with the project. Remove it there if the project no longer needs it.`));\n      continue;\n    }\n    const grants = await api.grants(w.connection.id);\n    if (grants.some((g) => g.agentId === who.agent!.id)) {\n      usable.push(w.entry);\n      continue;\n    }\n    if (await p.confirm(`${agentName} (the agent ${label} uses) has no access to \"${w.connection.slug}\". Give it ${accessLabel(w.connection.levelDefault)}?`, true)) {\n      await api.setGrants(w.connection.id, [...grants.map((g) => ({ agentId: g.agentId, level: g.level })), { agentId: who.agent.id, level: w.connection.levelDefault }]);\n      usable.push(w.entry);\n    } else p.print(pc.dim(`  \"${w.entry.name}\" stays in ${label}: its agent couldn't use \"${w.connection.slug}\".`));\n  }\n  if (!usable.length) return code;\n  p.print(\"\");\n  const question = `Replace ${usable.map((e) => `\"${e.name}\"`).join(\", \")} in ${label} with the single xaq entry (setup-mcp --tool ${client}, with a backup)?`;\n  const routes = confinedRoutes(client, mcpServerName(who.profileName), deps.env);\n  let ok: boolean;\n  if (routes.length) {\n    const slugs = working.filter((w) => usable.includes(w.entry)).map((w) => w.connection.slug);\n    p.print(pc.yellow(`These ${label} settings are limited to the xaq server only:`));\n    for (const r of routes) p.print(`  ${safeText(r, 120)}`);\n    p.print(\n      pc.yellow(\n        `Through xaq they now also see the tools of ${slugs.map((s) => `\"${s}\"`).join(\", \")} (as <name>__<tool>), which ${routes.length === 1 ? \"it\" : \"they\"} couldn't reach before. ` +\n          `If one is triggered by email or webhooks, those tools become reachable from that content. Give ${agentName} less access on those connections, or keep them out, if that's not what you want.`,\n      ),\n    );\n    ok = await p.confirmExplicit(question, `${label}'s config wasn't changed; decide in a terminal`);\n  } else ok = await p.confirm(question, true);\n  if (!ok) {\n    p.print(`${label}'s config wasn't changed. Run this import again any time to do it.`);\n    return code;\n  }\n  const r = setupMcp(client, mcpTarget(who.profileName, who.profile), profilePath(who.profileName), { removeServers: usable.map(toRemove) });\n  for (const l of setupLines(r)) p.print(l);\n  const vars = [...new Set(usable.flatMap((e) => ((r.removed ?? []).includes(e.name) ? e.headerVars : [])))];\n  if (r.ok && vars.length) {\n    p.print(pc.dim(`  ${vars.join(\", \")} ${vars.length === 1 ? \"is\" : \"are\"} no longer needed by the removed entries; delete ${vars.length === 1 ? \"it\" : \"them\"} from your environment${client === \"hermes\" ? \" (~/.hermes/.env)\" : \"\"} once everything works through xaq.`));\n  }\n  return r.ok ? code : 1;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAYA,SAAgB,eAAe,QAAsB,YAAoB,MAAyB,QAAQ,KAAe;CACvH,IAAI,WAAW,UAAU,OAAO,CAAC;CACjC,MAAM,OAAO,WAAW,GAAG;CAC3B,MAAM,wBAAQ,IAAI,IAAI,CAAC,YAAY,OAAO,YAAY,CAAC;CACvD,MAAM,YAAY,MAAe,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,IAAI,CAAC,CAAC;CACxG,MAAM,MAAgB,CAAC;CACvB,MAAM,QAAQ,SAA0B;EACtC,IAAI;GACF,OAAO,WAAW,IAAI,IAAI,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,IAAI;EACvF,QAAQ;GACN,OAAO;EACT;CACF;CACA,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,aAAa;EACvC,IAAI,WAAW,MAAM,GAAG;GACtB,MAAM,OAAO,aAAa,QAAQ,MAAM;GACxC,MAAM,YAAY,WAAW,MAAM,mBAAmB,KAAK,CAAC;GAC5D,KAAK,MAAM,CAAC,UAAU,aAAa,OAAO,QAAQ,SAAS,GAAG,IAAI,SAAS,QAAQ,GAAG,IAAI,KAAK,qBAAqB,SAAS,eAAe;GAE5I,MAAM,OAAO,GAA0B,MAAsC,KAAK,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,CAAC,IAAK,EAAgC,KAAK,KAAA;GACrK,MAAM,SAAS,IAAI,IAAI,IAAI,WAAW,MAAM,WAAW,KAAK,KAAA,GAAW,SAAS,GAAG,OAAO,GAAG,QAAQ;GACrG,IAAI,WAAW,cAAe,MAAM,QAAQ,MAAM,KAAK,OAAO,MAAM,MAAM,MAAM,UAAU,GACxF,IAAI,KAAK,2GAA2G;QAC/G,IAAI,MAAM,QAAQ,MAAM,GAC7B,OAAO,SAAS,GAAG,MAAM;IACvB,IAAI,SAAS,IAAI,GAAG,UAAU,CAAC,GAAG,IAAI,KAAK,iBAAiB,OAAO,IAAI,GAAG,MAAM,KAAK,IAAI,IAAI,GAAG,EAAE,eAAe;GACnH,CAAC;QACI,IAAI,UAAU,OAAO,WAAW,UAChC;SAAA,MAAM,CAAC,MAAM,MAAM,OAAO,QAAQ,MAAmC,GAAG,IAAI,SAAS,IAAI,GAAG,UAAU,CAAC,GAAG,IAAI,KAAK,iBAAiB,KAAK,eAAe;GAAA;EAEjK;CACF,QAAQ,CAER;CACA,MAAM,OAAO,KAAK,KAAK,MAAM,4BAA4B,CAAC;CAC1D,IAAI,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GACpD;OAAA,MAAM,CAAC,OAAO,MAAM,OAAO,QAAQ,IAA8C,GAAG,IAAI,SAAS,GAAG,QAAQ,GAAG,IAAI,KAAK,iBAAiB,OAAO;CAAA;CAEvJ,MAAM,OAAO,KAAK,KAAK,MAAM,QAAQ,WAAW,CAAC;CACjD,MAAM,OAAQ,MAAM,QAAQ,IAAI,IAAI,OAAS,MAAoC,QAAQ,CAAC;CAC1F,IAAI,MAAM,QAAQ,IAAI,GAAQ;OAAA,MAAM,KAAK,MAAM,IAAI,SAAS,GAAG,gBAAgB,GAAG,IAAI,KAAK,YAAY,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG;CAAA;CACtI,OAAO;AACT;;;;AC/CA,MAAa,iBAAiB;CAAC;CAAU;CAAe;CAAU;AAAO;AAGzE,MAAa,gBAA8C;CAAE,QAAQ;CAAU,eAAe;CAAe,QAAQ;CAAU,OAAO;AAAQ;AA2C9I,MAAM,WAAW,MAAgB,MAAM,QAAQ,CAAC,IAAI,EAAE,QAAQ,MAAmB,OAAO,MAAM,QAAQ,IAAI,KAAA;AAE1G,SAAS,YAAY,GAA4B,SAAiD,aAAoD;CACpJ,MAAM,IAAqB,EAAE,UAAU,YAAY,QAAQ,MAAM,EAAE,OAAO,KAAA,KAAa,EAAE,OAAO,IAAI,EAAE;CACtG,MAAM,MAAM,QAAQ,QAAQ,OAAO;CACnC,MAAM,MAAM,QAAQ,QAAQ,OAAO;CACnC,IAAI,KAAK,QAAQ,EAAE,UAAU;CAC7B,IAAI,KAAK,QAAQ,EAAE,UAAU;CAC7B,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,SAAS,IAAI,KAAA;AAC3D;;AAcA,SAAgB,YAAY,MAAsC;CAChE,MAAM,MAA8B,CAAC;CACrC,KAAK,MAAM,OAAO,KAAK,MAAM,IAAI,GAAG;EAClC,MAAM,IAAI,6DAA6D,KAAK,GAAG;EAC/E,IAAI,CAAC,GAAG;EACR,IAAI,IAAI,EAAE;EACV,IAAK,EAAE,WAAW,IAAG,KAAK,EAAE,SAAS,IAAG,KAAK,EAAE,UAAU,KAAO,EAAE,WAAW,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,UAAU,GAAI,IAAI,EAAE,MAAM,GAAG,EAAE;OACpI,IAAI,EAAE,QAAQ,WAAW,EAAE;EAChC,IAAI,EAAE,MAAO;CACf;CACA,OAAO;AACT;;AAKA,SAAgB,WAAW,OAAe,MAAoD;CAC5F,MAAM,OAAiB,CAAC;CACxB,IAAI,UAAyB;CAC7B,MAAM,MAAM,MAAM,QAAQ,2DAA2D,IAAI,MAAc,QAA4B;EACjI,MAAM,IAAI,KAAK;EACf,IAAI,MAAM,KAAA,KAAa,MAAM,IAAI;GAC/B,KAAK,KAAK,IAAI;GACd,OAAO;EACT;EACA,IAAI,QAAQ,KAAA,GAAW,OAAO;EAC9B,YAAY;EACZ,OAAO;CACT,CAAC;CACD,OAAO,UAAU,EAAE,QAAQ,IAAI;EAAE,OAAO;EAAK,MAAM;CAAK;AAC1D;AAEA,MAAM,SAAS,MAA6C,CAAC,CAAC,KAAK,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,CAAC;AAC5G,MAAM,YAAY,SAAiD;CACjE,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,MAAM,OAAO,aAAa,MAAM,MAAM;CACtC,IAAI,CAAC,KAAK,KAAK,GAAG,OAAO,CAAC;CAC1B,IAAI;EACF,MAAM,MAAM,KAAK,MAAM,IAAI;EAC3B,IAAI,CAAC,MAAM,GAAG,GAAG,MAAM,IAAI,MAAM,eAAe;EAChD,OAAO;CACT,QAAQ;EACN,MAAM,IAAI,MAAM,GAAG,KAAK,kEAAkE;CAC5F;AACF;;AAGA,SAAS,UAAU,MAAc,KAAc,MAAc,MAA0C,QAA8B,CAAC,GAAgB;CACpJ,MAAM,OAAoB;EAAE;EAAM;EAAM,WAAW;EAAQ,SAAS,CAAC;EAAG,YAAY,CAAC;EAAG,eAAe,CAAC;EAAG,OAAO;EAAO,SAAS;EAAM,GAAG;CAAM;CACjJ,IAAI,CAAC,MAAM,GAAG,GAAG,OAAO;EAAE,GAAG;EAAM,SAAS;CAA6B;CACzE,IAAI,IAAI,aAAa,QAAQ,IAAI,YAAY,OAAO,KAAK,UAAU;CACnE,MAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,KAAK,YAAY,IAAI;CACrE,IAAI,SAAS,WAAY,OAAO,IAAI,YAAY,YAAY,CAAC,IAAI,KAAM;EACrE,MAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,MAAM,IAAI,CAAC;EAC/D,OAAO;GAAE,GAAG;GAAM,WAAW;GAAS,SAAS,CAAC,OAAO,IAAI,WAAW,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK;EAAE;CACvG;CACA,IAAI,OAAO,IAAI,QAAQ,UAAU,OAAO;EAAE,GAAG;EAAM,SAAS;CAAS;CACrE,MAAM,MAAM,WAAW,IAAI,KAAK,IAAI;CACpC,IAAI,aAAa,KAAK,OAAO;EAAE,GAAG;EAAM,SAAS,mBAAmB,IAAI,QAAQ;CAAyB;CACzG,MAAM,QAAqB;EAAE,GAAG;EAAM,KAAK,IAAI;EAAO,WAAW,SAAS,QAAQ,QAAQ;CAAO;CACjG,IAAI,IAAI,kBAAkB,KAAA,KAAa,IAAI,mBAAmB,KAAA,GAAW,OAAO;EAAE,GAAG;EAAO,SAAS;CAAwE;CAC7K,IAAI,IAAI,UAAU,KAAA,KAAa,IAAI,SAAS,KAAA,GAAW,MAAM,QAAQ;CACrE,OAAO,YAAY,OAAO,IAAI,SAAS,IAAI;AAC7C;AAEA,SAAS,YAAY,OAAoB,SAAkB,MAAuD;CAChH,IAAI,YAAY,KAAA,KAAa,YAAY,MAAM,OAAO;CACtD,IAAI,CAAC,MAAM,OAAO,GAAG,OAAO;EAAE,GAAG;EAAO,SAAS;CAA4B;CAC7E,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,GAAG;EAC5C,IAAI,OAAO,MAAM,UAAU,OAAO;GAAE,GAAG;GAAO,SAAS,OAAO,EAAE;EAAuB;EACvF,MAAM,IAAI,WAAW,GAAG,IAAI;EAC5B,IAAI,aAAa,GAAG,OAAO;GAAE,GAAG;GAAO,SAAS,OAAO,EAAE,kBAAkB,EAAE,QAAQ;EAAyB;EAC9G,MAAM,QAAQ,KAAK,EAAE;EACrB,MAAM,WAAW,KAAK,GAAG,EAAE,IAAI;EAC/B,MAAM,cAAc,KAAK,EAAE;CAC7B;CACA,OAAO;AACT;AAIA,SAAgB,YAAY,MAAyB,QAAQ,KAAsC;CACjG,MAAM,OAAO,WAAW,GAAG;CAC3B,OAAO;EAAE,QAAQ,KAAK,MAAM,aAAa;EAAG,KAAK,KAAK,MAAM,MAAM;CAAE;AACtE;AAEA,SAAS,WAAW,MAAiC;CACnD,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,QAAQ,YAAY,GAAG;CAC7B,MAAM,SAAuB;EAAE,QAAQ;EAAU,OAAO,CAAC,MAAM,MAAM;EAAG,SAAS,CAAC;CAAE;CACpF,IAAI,CAAC,WAAW,MAAM,MAAM,GAAG,OAAO;CACtC,MAAM,UAAU,eAAe,aAAa,MAAM,QAAQ,MAAM,CAAC;CACjE,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,GAAG,MAAM,OAAO,uGAAuG;CAErJ,MAAM,OAAO;EAAE,GAAG;EAAK,GAAI,WAAW,MAAM,GAAG,IAAI,YAAY,aAAa,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC;CAAG;CACtG,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,OAAO,GAAG;EACjD,IAAI,KAAK,WAAW,IAAQ,GAAG;EAC/B,MAAM,OAAoB;GAAE;GAAM,MAAM,MAAM;GAAQ,WAAW;GAAQ,SAAS,CAAC;GAAG,YAAY,CAAC;GAAG,eAAe,CAAC;GAAG,OAAO;GAAO,SAAS;EAAK;EACrJ,IAAI,CAAC,OAAO,QAAQA,cAAmB,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;GACpF,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS;GAA2B,CAAC;GACpE;EACF;EACA,MAAM,IAAI;EACV,MAAM,aAAa;GAAC;GAAO;GAAW;GAAW;GAAQ;GAAa;EAAS,CAAC,CAAC,MAAM,MAAM,EAAE,OAAOA,UAAe;EACrH,IAAI,YAAY;GACd,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS,OAAO,WAAW;GAAgB,CAAC;GAC3E;EACF;EACA,IAAI,EAAE,YAAY,SAAU,OAAO,EAAE,YAAY,YAAY;GAAC;GAAS;GAAM;GAAO;EAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,YAAY,CAAC,GAAI,KAAK,UAAU;EAC5I,IAAI,OAAO,EAAE,YAAY,UAAU;GACjC,MAAM,OAAO,MAAM,QAAQ,EAAE,IAAI,IAAI,EAAE,KAAK,QAAQ,MAAM,OAAO,MAAM,QAAQ,IAAI,CAAC;GACpF,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,WAAW;IAAS,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;GAAE,CAAC;GAC5F;EACF;EACA,IAAI,OAAO,EAAE,QAAQ,UAAU;GAC7B,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS;GAAS,CAAC;GAClD;EACF;EACA,MAAM,MAAM,WAAW,EAAE,KAAK,IAAI;EAClC,IAAI,aAAa,KAAK;GACpB,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS,mBAAmB,IAAI,QAAQ,wBAAwB,MAAM;GAAM,CAAC;GAC5G;EACF;EACA,MAAM,QAAQ,MAAM,EAAE,KAAK,IAAK,EAAE,QAAoC,CAAC;EACvE,MAAM,QAAqB;GACzB,GAAG;GACH,KAAK,IAAI;GACT,WAAW,EAAE,cAAc,QAAQ,QAAQ;GAC3C,OAAO,EAAE,SAAS,WAAW,MAAM,EAAE,KAAK;GAC1C,SAAS,YAAY,GAA8B;IAAE,SAAS,MAAM;IAAS,SAAS,MAAM;GAAQ,GAAG,CAAC,WAAW,iBAAiB,CAAC;EACvI;EACA,IAAI,EAAE,gBAAgB,KAAA,KAAa,EAAE,oBAAoB,KAAA,GAAW;GAClE,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAO,SAAS;GAAwF,CAAC;GAClI;EACF;EACA,OAAO,QAAQ,KAAK,YAAY,OAAO,EAAE,WAAW,KAAA,GAAW,IAAI,CAAC;CACtE;CACA,OAAO;AACT;AAIA,SAAS,WAAW,MAAiC;CACnD,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,MAAM,KAAK,OAAO,QAAQ,IAAI;CACpC,MAAM,WAAW,iBAAiB;CAClC,MAAM,cAAc,KAAK,KAAK,WAAW;CACzC,MAAM,SAAuB;EAAE,QAAQ;EAAe,OAAO,CAAC,UAAU,WAAW,CAAC,CAAC,OAAO,UAAU;EAAG,SAAS,CAAC;CAAE;CACrH,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,OAAO,MAAmB;EAE9B,IAAI,KAAK,IAAI,EAAE,IAAI,GAAG;EACtB,KAAK,IAAI,EAAE,IAAI;EACf,OAAO,QAAQ,KAAK,CAAC;CACvB;CACA,MAAM,MAAM,SAAS,QAAQ;CAC7B,MAAM,OAAO,OAAO,MAAM,IAAI,QAAQ,KAAK,MAAM,IAAI,SAAS,IAAI,IAAK,IAAI,SAAS,OAAmC,CAAC;CACxH,MAAM,QAAQ,KAAK;CACnB,IAAI,MAAM,KAAK,GAAG,KAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,KAAK,GAAG,IAAI,UAAU,GAAG,KAAK,UAAU,KAAK;EAAE,OAAO;EAAS,YAAY;CAAI,CAAC,CAAC;CACzI,MAAM,UAAU,SAAS,WAAW;CACpC,IAAI,WAAW,MAAM,QAAQ,UAAU,GAAG;EAIxC,MAAM,QAAQ,MAAgB,MAAM,QAAQ,CAAC,IAAI,EAAE,QAAQ,MAAmB,OAAO,MAAM,QAAQ,IAAI,CAAC;EACxG,MAAM,UAAU,IAAI,IAAI,KAAK,KAAK,qBAAqB,CAAC;EACxD,MAAM,WAAW,IAAI,IAAI,KAAK,KAAK,sBAAsB,CAAC;EAC1D,MAAM,MAAM,KAAK,+BAA+B;EAChD,KAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,QAAQ,UAAU,GAAG;GACzD,MAAM,IAAI,UAAU,GAAG,KAAK,aAAa,KAAK;IAAE,OAAO;IAAW,YAAY;IAAK,aAAa;GAAK,CAAC;GACtG,MAAM,MAAM,SAAS,IAAI,CAAC,IAAI,+CAA+C,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,IAAI,gCAAgC;GAEvI,IAAI,KAAK,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAG,SAAS;GAAI,CAAC;QAC9C,IAAI,CAAC;EACZ;CACF;CACA,IAAI,OAAO,MAAM,IAAI,UAAU,GAAG,KAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,IAAI,UAAU,GAAG,IAAI,UAAU,GAAG,KAAK,UAAU,KAAK,EAAE,OAAO,OAAO,CAAC,CAAC;CAChJ,OAAO;AACT;AAIA,SAAS,WAAW,MAAiC;CACnD,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,OAAO,iBAAiB;CAC9B,MAAM,SAAuB;EAAE,QAAQ;EAAU,OAAO,CAAC,IAAI;EAAG,SAAS,CAAC;CAAE;CAC5E,MAAM,MAAM,SAAS,IAAI;CACzB,IAAI,OAAO,MAAM,IAAI,UAAU,GAAG,KAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,IAAI,UAAU,GAAG,OAAO,QAAQ,KAAK,UAAU,GAAG,KAAK,MAAM,GAAG,CAAC;CACzI,OAAO;AACT;AAIA,SAAS,UAAU,MAAiC;CAClD,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,OAAO,gBAAgB;CAC7B,MAAM,SAAuB;EAAE,QAAQ;EAAS,OAAO,CAAC,IAAI;EAAG,SAAS,CAAC;CAAE;CAC3E,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,mBAAmB,aAAa,MAAM,MAAM,CAAC,CAAC,GAAG;EACxF,MAAM,OAAoB;GAAE;GAAM;GAAM,WAAW;GAAQ,SAAS,CAAC;GAAG,YAAY,CAAC;GAAG,eAAe,CAAC;GAAG,OAAO;GAAO,SAAS;EAAK;EACvI,IAAI,QAAQC,cAAiB;GAC3B,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS;GAA2B,CAAC;GACpE;EACF;EACA,MAAM,IAAI;EACV,IAAI,EAAE,YAAY,OAAO,KAAK,UAAU;EACxC,IAAI,OAAO,EAAE,YAAY,UAAU;GACjC,MAAM,OAAO,MAAM,QAAQ,EAAE,IAAI,IAAI,EAAE,KAAK,QAAQ,MAAmB,OAAO,MAAM,QAAQ,IAAI,CAAC;GACjG,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,WAAW;IAAS,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;GAAE,CAAC;GAC5F;EACF;EACA,IAAI,OAAO,EAAE,QAAQ,UAAU;GAC7B,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS;GAAS,CAAC;GAClD;EACF;EACA,MAAM,QAAqB;GACzB,GAAG;GACH,KAAK,EAAE;GACP,OAAO,MAAM,EAAE,KAAK,KAAK,EAAE,SAAS;GACpC,SAAS,YAAY,GAAG;IAAE,SAAS,EAAE;IAAe,SAAS,EAAE;GAAe,GAAG,CAAC,oBAAoB,qBAAqB,CAAC;EAC9H;EACA,IAAI,EAAE,wBAAwB,KAAA,GAAW;GACvC,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAO,SAAS;GAAwE,CAAC;GAClH;EACF;EAEA,MAAM,UAAkC,CAAC;EACzC,IAAI;EACJ,IAAI,EAAE,iBAAiB,KAAA,GAAW;GAChC,IAAI,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,OAAO,EAAE,YAAY,CAAC,CAAC,MAAM,MAAM,OAAO,MAAM,QAAQ,GAAG,UAAU;QACrG;IACH,OAAO,OAAO,SAAS,EAAE,YAAY;IACrC,KAAK,MAAM,KAAK,OAAO,KAAK,EAAE,YAAY,GAAG,MAAM,cAAc,KAAK,CAAC;GACzE;EACF;EACA,MAAM,UAAmC,MAAM,EAAE,gBAAgB,IAAI,EAAE,GAAG,EAAE,iBAAiB,IAAI,CAAC;EAClG,IAAI,EAAE,yBAAyB,KAAA,GAAW,QAAQ,gBAAgB,EAAE;EACpE,KAAK,MAAM,CAAC,GAAG,YAAY,OAAO,QAAQ,OAAO,GAC/C,IAAI,OAAO,YAAY,UAAU,YAAY,OAAO,EAAE;OACjD,IAAI,CAAC,IAAI,UAAU,YAAY,OAAO,EAAE,sBAAsB,QAAQ;OACtE;GACH,QAAQ,KAAK,MAAM,mBAAmB,EAAE,yBAAyB,UAAU,UAAU,IAAI,aAAa,IAAI;GAC1G,MAAM,WAAW,KAAK,OAAO;GAC7B,MAAM,cAAc,KAAK,CAAC,OAAO;EACnC;EAEF,MAAM,UAAU;EAChB,OAAO,QAAQ,KAAK,UAAU;GAAE,GAAG;GAAO;EAAQ,IAAI,KAAK;CAC7D;CACA,OAAO;AACT;AAEA,SAAgB,iBAAiB,QAAsB,OAAoB,CAAC,GAAiB;CAC3F,QAAQ,QAAR;EACE,KAAK,UACH,OAAO,WAAW,IAAI;EACxB,KAAK,eACH,OAAO,WAAW,IAAI;EACxB,KAAK,UACH,OAAO,WAAW,IAAI;EACxB,KAAK,SACH,OAAO,UAAU,IAAI;CACzB;AACF;AAEA,SAAgB,kBAAkB,OAA6B;CAC7D,MAAM,IAAI,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,YAAY,aAAa;CACtE,IAAI,CAAE,eAAqC,SAAS,CAAC,GAAG,MAAM,IAAI,MAAM,mBAAmB,MAAM,oBAAoB,eAAe,KAAK,IAAI,EAAE,EAAE;CACjJ,OAAO;AACT;;;ACrRA,MAAM,YAAY;AAElB,SAAS,OAAO,GAAgB,aAAgC;CAC9D,IAAI,UAAU,KAAK,EAAE,IAAI,GAAG,OAAO;CACnC,IAAI,OAAO,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,MAAM,kBAAkB,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,OAAO;CACnF,IAAI,CAAC,EAAE,KAAK,OAAO;CACnB,IAAI;EACF,MAAM,IAAI,IAAI,IAAI,EAAE,GAAG;EACvB,OAAO,EAAE,SAAS,QAAQ,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,KAAK,YAAY,SAAS,EAAE,MAAM;CACzF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAM,WAAW,GAA8B,MAAc;CAC3D,IAAI;EACF,OAAO,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,QAAQ,EAAE;CAC1F,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAsB,WAAW,QAAsB,MAAkF,CAAC,GAAwB;CAChK,MAAM,QAAQ,cAAc,OAAO;CACnC,MAAM,QAAQ,IAAI,KAAK,IAAI,YAAY,CAAC,EAAA,CAAG,KAAK,MAAM,EAAE,IAAI,CAAC;CAC7D,MAAM,QAAoB,CAAC;CAC3B,KAAK,MAAM,SAAS,OAAO,SAAS;EAClC,IAAI,OAAO,OAAO,IAAI,eAAe,CAAC,CAAC,GAAG;GACxC,MAAM,KAAK;IAAE,QAAQ;IAAQ;GAAM,CAAC;GACpC;EACF;EACA,IAAI,MAAM,cAAc,SAAS;GAC/B,MAAM,KAAK;IAAE,QAAQ;IAAS;GAAM,CAAC;GACrC;EACF;EACA,IAAI,MAAM,SAAS;GACjB,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ,MAAM;GAAQ,CAAC;GAC3D;EACF;EACA,IAAI,CAAC,MAAM,SAAS;GAClB,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ,sBAAsB;GAAQ,CAAC;GAC3E;EACF;EACA,IAAI;EACJ,IAAI;GACF,MAAM,IAAI,IAAI,MAAM,GAAI;GACxB,IAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU,MAAM,IAAI,MAAM,QAAQ;EACrF,QAAQ;GACN,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ;GAA+B,CAAC;GAC5E;EACF;EACA,MAAM,cAAc,OAAO,KAAK,MAAM,OAAO;EAC7C,IAAI,YAAY,SAAS,GAAG;GAC1B,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ,YAAY,YAAY,OAAO,YAAY,YAAY,KAAK,IAAI,EAAE;GAA+C,CAAC;GAC9J;EACF;EACA,MAAM,YAAY,IAAI,YAAY,CAAC,EAAA,CAAG,MAAM,MAAM,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;EAC1E,IAAI,UAAU;GACZ,MAAM,KAAK;IAAE,QAAQ;IAAU;IAAO,YAAY;GAAS,CAAC;GAC5D;EACF;EACA,MAAM,SAAS,MAAM,YAAY,KAAK,IAAI,MAAM;EAChD,IAAI,OAAO,SAAS,SAAS;GAC3B,MAAM,KAAK;IACT,QAAQ;IACR;IACA,QACE,OAAO,QAAQ,iBACX,sEAAsE,OAAO,YAC7E,WAAW,OAAO,QAAQ;GAClC,CAAC;GACD;EACF;EACA,IAAI,OAAO,SAAS,YAAY,IAAI,aAAa,SAAS;GACxD,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ;GAA+D,CAAC;GAC5G;EACF;EACA,IAAI,OAAO,QAAQ,MAAM,IAAI;EAC7B,KAAK,IAAI,IAAI,GAAG,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,GAAG,QAAQ,MAAM,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,GAAG;EACpF,MAAM,IAAI,IAAI;EACd,MAAM,OAAO,YAAY,SACrB;GAAE,MAAM;GAAmB,MAAM,YAAY;GAAK,OAAO,MAAM,QAAQ,YAAY;EAAM,IACzF,MAAM,QACJ,EAAE,MAAM,QAAiB,IACzB,EAAE,MAAM,OAAgB;EAC9B,MAAM,KAAK;GAAE,QAAQ;GAAU;GAAO;GAAM,KAAK,MAAM,IAAK,KAAK;GAAG;GAAM,eAAe,OAAO,SAAS,YAAY,OAAO,SAAS;EAAK,CAAC;CAC7I;CACA,OAAO;AACT;AAEA,MAAM,SAAS,MAAoB,EAAE,QAAQ,KAAK,EAAE,MAAM,WAAW;AACrE,MAAM,UAAU,QAAgB;CAC9B,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAS,WAAW,GAA2D;CAC7E,IAAI,EAAE,KAAK,SAAS,UAAU,OAAO;CACrC,MAAM,OAAO,EAAE,MAAM,cAAc,EAAE,KAAK,SAAS,CAAC;CACpD,MAAM,OAAO,KAAK,SAAS,UAAU,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,KAAK;CAC9E,OAAO,OAAO,EAAE,KAAK,KAAK,SAAS,KAAK,0DAA0D,SAAS,OAAO,EAAE,GAAG,GAAG,GAAG;AAC/H;;AAGA,SAAgB,WAAW,QAAsB,OAA6B;CAC5E,MAAM,QAAQ,cAAc,OAAO;CACnC,MAAM,MAAgB,CAAC;CACvB,MAAM,QAAQ,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;CAChF,MAAM,OAAO,MAAc,EAAE,OAAO,KAAK;CACzC,MAAM,OAAO,IAAI,OAAO,QAAQ,CAAC;CACjC,IAAI,KAAK,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,IAAI,KAAK,iBAAiB,SAAS,MAAM,OAAO,aAAa,MAAM,WAAW,IAAI,KAAK,IAAI,EAAE;CACrI,KAAK,MAAM,KAAK,OAAO;EACrB,MAAM,OAAO,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,EAAE,CAAC,EAAE;EAClD,QAAQ,EAAE,QAAV;GACE,KAAK;IACH,IAAI,KAAK,GAAG,OAAO,GAAG,IAAI,0BAA0B,GAAG;IACvD;GACF,KAAK;IACH,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,wBAAwB,EAAE,qBAAqB,SAAS,EAAE,MAAM,WAAW,IAAI,EAAE,EAAE,iBAAiB,OAAO;IACxI;GACF,KAAK;IACH,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,MAAM,EAAE,IAAI,EAAE,OAAO,gBAAgB,OAAO;IACzE;GACF,KAAK;IACH,IAAI,UAAU,EAAE,UAAU,GAAG,IAAI,KAAK,GAAG,KAAK,sBAAsB,EAAE,WAAW,KAAK,KAAK,EAAE,WAAW,MAAM,MAAM,QAAQ;SACvH;KACH,MAAM,MACJ,EAAE,MAAM,SAAS,EAAE,WAAW,aAAa,WAAW,EAAE,WAAW,WAAW,iBAAiB,kBAAkB,GAAG,EAAE,WAAW,OAAO,IAAI,EAAE,WAAW,MAAM,MAAM;KACvK,IAAI,KAAK,GAAG,KAAK,yBAAyB,EAAE,WAAW,KAAK,KAAK,IAAI,gBAAgB,MAAM,gBAAgB;KAC3G,IAAI,KAAK,GAAG,OAAO,cAAc,EAAE,UAAU,GAAG;IAClD;IACA,IAAI,KAAK,GAAG,aAAa,EAAE,OAAO,IAAI,CAAC;IACvC;GACF,KAAK,UAAU;IACb,IAAI,KAAK,GAAG,OAAO,GAAG,MAAM,QAAQ,EAAE,eAAe,EAAE,KAAK,MAAM,SAAS,EAAE,KAAK,GAAG,IAAI,MAAM,EAAE,KAAK,GAAG;IACzG,IAAI,EAAE,MAAM,aAAa,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,8BAA8B,EAAE,6CAA6C;IACnI,MAAM,IAAI,WAAW,CAAC;IACtB,IAAI,GAAG,IAAI,KAAK,GAAG,OAAO,GAAG;SACxB,IAAI,EAAE,KAAK,SAAS,SAAS,IAAI,KAAK,GAAG,KAAK,kCAAkC,MAAM,6DAA6D;SACnJ,IAAI,KAAK,GAAG,KAAK,mBAAmB,MAAM,sEAAsE;IACrH,IAAI,EAAE,eAAe,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,iBAAiB,EAAE,gCAAgC,EAAE,eAAe;IACtH,IAAI,KAAK,GAAG,aAAa,EAAE,OAAO,IAAI,CAAC;IACvC;GACF;EACF;CACF;CACA,OAAO;AACT;;AAGA,SAAS,aAAa,GAAgB,MAAwB;CAC5D,MAAM,IAAI,EAAE;CACZ,IAAI,CAAC,GAAG,OAAO,CAAC;CAChB,MAAM,MAAgB,CAAC;CACvB,MAAM,QAAQ,OAAiB,GAAG,KAAK,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;CACvE,IAAI,EAAE,SAAS,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,kBAAkB,EAAE,0BAA0B,KAAK,EAAE,OAAO,EAAE,iEAAiE;CAC3K,IAAI,EAAE,SAAS,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,kBAAkB,EAAE,+BAA+B,KAAK,EAAE,OAAO,EAAE,iEAAiE;CAChL,IAAI,EAAE,SAAS,QAAQ,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,kBAAkB,EAAE,IAAI,EAAE,SAAS,KAAK,IAAI,EAAE,kCAAkC;CACpI,OAAO;AACT;AAaA,MAAM,QAAQ;AAEd,SAAS,WAAW,GAA6B;CAC/C,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,SAAS,GAAG,KAAK,GAAG,IAAI,GAAG,MAAM,GAAG,EAAE,GAAG,EAAE,YAAY,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,EAAE,SAAS;CAChH,KAAK,MAAM,KAAK,EAAE,WAAW,CAAC,GAAG,IAAI,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,KAAK,KAAK,GAAG,IAAI,OAAO,GAAG;CAC5F,IAAI,EAAE,QAAQ,IAAI,KAAK,GAAG,KAAK,aAAa,EAAE,QAAQ,CAAC;CACvD,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM,KAAK,EAAE,UAAU,CAAC,GAAG,IAAI,KAAK,OAAO,GAAG;CAC9D,KAAK,MAAM,KAAK,EAAE,SAAS,CAAC,GAAG,IAAI,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC;CACxD,IAAI,EAAE,MAAM,EAAE,QAAQ,QAAQ,IAAI,KAAK,KAAK,EAAE,SAAS,8BAA8B,gBAAgB,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG;CACrJ,OAAO;AACT;AAEA,MAAM,YAAY,OAAkC;CAAE,MAAM,EAAE;CAAM,OAAO,EAAE;CAAO,YAAY,EAAE,UAAU,SAAS,KAAA,IAAY,EAAE;AAAW;AAS9I,eAAsB,UAAU,OAAoB,MAAmC;CACrF,MAAM,IAAI,KAAK;CACf,MAAM,SAAuB,kBAAkB,MAAM,IAAI;CACzD,MAAM,QAAQ,cAAc;CAC5B,MAAM,SAAkC,MAAM,SAAS,YAAY,MAAM,MAAM,IAAI,KAAA;CACnF,MAAM,SAAS,iBAAiB,QAAQ;EAAE,KAAK,KAAK;EAAK,KAAK,KAAK;CAAI,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,QAAQ;EAC1B,EAAE,MAAM,GAAG,MAAM,kCAAkC,OAAO,MAAM,KAAK,IAAI,KAAK,iBAAiB,sBAAsB;EACrH,OAAO;CACT;CACA,MAAM,cAAc,MAAM,WAAA;CAE1B,IAAI,MAAM,QAAQ;EAEhB,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,KAAK,QAAQ,CAAC,CAAC,KAAK;EACvC,QAAQ;GACN,WAAW,KAAA;EACb;EACA,MAAM,QAAQ,MAAM,WAAW,QAAQ;GAAE;GAAU,QAAQ,KAAK;GAAQ,aAAa,KAAK;EAAY,CAAC;EACvG,EAAE,MAAM,GAAG,KAAK,yCAAyC,CAAC;EAC1D,KAAK,MAAM,KAAK,WAAW,QAAQ,KAAK,GAAG,EAAE,MAAM,CAAC;EACpD,MAAM,UAAU,MAAM,QAAQ,MAAuB,EAAE,WAAW,QAAQ;EAC1E,MAAM,OAAO,QAAQ,QAAQ,MAAM,EAAE,aAAa;EAClD,EAAE,MAAM,EAAE;EACV,EAAE,MAAM,gBAAgB,QAAQ,OAAO,aAAa,QAAQ,WAAW,IAAI,KAAK,IAAI,QAAQ,SAAS,YAAY,MAAM,IAAI,4DAA4D,EAAE;EACzL,IAAI,KAAK,QAAQ,EAAE,MAAM,6BAA6B,KAAK,KAAK,MAAM,EAAE,aAAa,CAAC,CAAC,KAAK,IAAI,EAAE,oEAAoE;EACtK,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,8GAA8G,CAAC;EAC7I,MAAM,YAAY,CAChB,GAAG,MAAM,QAAQ,MAAoD,EAAE,WAAW,YAAY,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,SAAS,EAAE,KAAK,CAAC,GAC/I,GAAG,QAAQ,QAAQ,MAAM,EAAE,KAAK,SAAS,OAAO,CAAC,CAAC,KAAK,MAAM,SAAS,EAAE,KAAK,CAAC,CAChF;EACA,EAAE,MAAM,EAAE;EACV,IAAI,CAAC,UAAU,QAAQ,EAAE,MAAM,GAAG,MAAM,yBAAyB;OAC5D,IAAI,CAAC,cAAc,WAAW,GACjC,EAAE,MAAM,2DAA2D,MAAM,kDAAkD,MAAM,cAAc,IAAI,4BAA4B,OAAO,GAAG;OACpL;GACL,EAAE,MAAM,yCAAyC,OAAO,iEAAiE,MAAM,wDAAwD;GACvL,MAAM,IAAI,SAAS,QAAQ,UAAU,aAAa,YAAY,WAAW,CAAC,GAAG,YAAY,WAAW,GAAG;IAAE,QAAQ;IAAM,eAAe;GAAU,CAAC;GACjJ,KAAK,MAAM,KAAK,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;EAC1C;EACA,OAAO;CACT;CAEA,MAAM,MAAM,KAAK,QAAQ;CAEzB,MAAM,QAAQ,MAAM,WAAW,QAAQ;EAAE,UAAA,MADlB,IAAI,KAAK;EACmB,QAAQ,KAAK;EAAQ,aAAa,KAAK;CAAY,CAAC;CACvG,KAAK,MAAM,KAAK,WAAW,QAAQ,KAAK,GAAG,EAAE,MAAM,CAAC;CACpD,IAAI,UAAU,MAAM,QAAQ,MAAuB,EAAE,WAAW,QAAQ;CACxE,MAAM,UAAU,MAAM,QAAQ,MAAoD,EAAE,WAAW,QAAQ;CACvG,EAAE,MAAM,EAAE;CAGV,MAAM,cAAc,QAAQ,QAAQ,MAAM,EAAE,MAAM,WAAW;CAC7D,IAAI,YAAY,QAAQ;EACtB,EAAE,MAAM,GAAG,OAAO,mBAAmB,YAAY,EAAE,CAAE,MAAM,KAAK,yEAAyE,CAAC;EAC1I,KAAK,MAAM,KAAK,aAAa,EAAE,MAAM,KAAK,SAAS,EAAE,MAAM,MAAM,EAAE,EAAE,KAAK,SAAS,EAAE,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,IAAI;EAC5I,IAAI,CAAE,MAAM,EAAE,gBAAgB,UAAU,YAAY,WAAW,IAAI,OAAO,SAAS,YAAY,SAAS,aAAa,0BAA0B,GAC7I,UAAU,QAAQ,QAAQ,MAAM,CAAC,EAAE,MAAM,WAAW;CAExD;CAGA,MAAM,aAAa,IAAI,IAAI,MAAM,gBAAgB,CAAC,CAAC;CACnD,MAAM,OAAO,QAAQ,QAAQ,MAAM,EAAE,iBAAiB,CAAC,WAAW,IAAI,EAAE,aAAa,CAAC;CACtF,KAAK,MAAM,KAAK,QAAQ,QAAQ,MAAM,EAAE,iBAAiB,WAAW,IAAI,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,YAAY,EAAE,cAAc,IAAI,SAAS,EAAE,MAAM,MAAM,EAAE,EAAE,oBAAoB;CAClL,IAAI,KAAK,QAAQ;EACf,EAAE,MAAM,GAAG,OAAO,4DAA4D,CAAC;EAC/E,KAAK,MAAM,KAAK,MAAM,EAAE,MAAM,KAAK,EAAE,cAAc,KAAK,SAAS,EAAE,MAAM,MAAM,EAAE,EAAE,EAAE;EACrF,EAAE,MACA,GAAG,IAAI,gJAAgJ,CACzJ;EACA,MAAM,QAAQ,KAAK,KAAK,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI;EACrD,IAAI,CAAE,MAAM,EAAE,gBAAgB,2BAA2B,KAAK,WAAW,IAAI,OAAO,SAAS,KAAK,SAAS,IAAI,YAAY,MAAM,8CAA8C,GAC7K,UAAU,QAAQ,QAAQ,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;CAErD;CAEA,MAAM,MAAM,MAAM,YAAY,KAAK,WAAW;CAC9C,IAAI,CAAC,QAAQ,QAAQ;EACnB,EAAE,MAAM,oBAAoB;EAC5B,OAAO,WACL,MACA,KACA,QACA,KACA,QAAQ,QAAQ,MAAM,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,OAAO;GAAE,OAAO,EAAE;GAAO,YAAY,EAAE;EAAW,EAAE,GACpG,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,MAAM,IAAI,GACnE,CACF;CACF;CAEA,MAAM,QAAQ,MAAM,aAAa,GAAG,MAAM;CAC1C,IAAI,SAAS,MAAM,aAAa,GAAG,KAAK,MAAM,KAAK;CACnD,IAAI,WAAW,SAAS,IAAI,SAAS,CAAC,OAAO,SAAS,IAAI,MAAM,EAAE,GAAG;EACnE,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,IAAI,MAAM,MAAM,EAAE,EAAE,cAAc,MAAM,8CAA8C,MAAM,iCAAiC,CAAC;EAC5J,IAAI,MAAM,EAAE,QAAQ,WAAW,SAAS,IAAI,MAAM,MAAM,EAAE,EAAE,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE;CAC1G;CACA,IAAI,CAAE,MAAM,EAAE,QAAQ,UAAU,QAAQ,OAAO,aAAa,QAAQ,WAAW,IAAI,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,IAAI,YAAY,MAAM,EAAE,KAAK,IAAI,GAAI;EACtJ,EAAE,MAAM,sBAAsB;EAC9B,OAAO;CACT;CAEA,MAAM,WAAsB,CAAC;CAC7B,KAAK,MAAM,QAAQ,SAAS;EAC1B,IAAI,UAAiC;EACrC,IAAI;GACF,UAAU,MAAM,IAAI,OAAO;IAAE,MAAM,KAAK;IAAM,MAAM,KAAK,MAAM;IAAM,KAAK,KAAK;IAAK,cAAc;IAAO,GAAI,WAAW,QAAQ,CAAC,IAAI,EAAE,UAAU,OAAO;GAAG,CAAC;GAC5J,IAAI,KAAK,eAAe,MAAM,IAAI,mBAAmB,QAAQ,IAAI,IAAI;GACrE,MAAM,IAAI,MAAM,IAAI,QAAQ,QAAQ,IAAI,KAAK,KAAK,SAAS,WAAW,EAAE,QAAQ;IAAE,MAAM,KAAK,KAAK;IAAM,OAAO,KAAK,KAAK;GAAM,EAAE,IAAI,CAAC,CAAC;GACvI,IAAI,EAAE,WAAW,aAAa;IAE5B,MAAM,QAAQ,MAAM,YAAY,KAAK,EAAE,YAAY;KAAE,QAAQ,KAAK;KAAQ,IAAI,KAAK;IAAS,CAAC;IAC7F,SAAS,KAAK;KAAE;KAAM,QAAQ,MAAM,KAAK,IAAI,cAAc;KAAc,YAAY;IAAM,CAAC;GAC9F,OAAO,IAAI,EAAE,WAAW,aAAa,SAAS,KAAK;IAAE;IAAM,QAAQ;IAAa,YAAY;IAAS,cAAc,EAAE;GAAa,CAAC;QAC9H,MAAM,IAAI,MAAM,EAAE,OAAO;EAChC,SAAS,KAAK;GAEZ,IAAI,SAAS,MAAM,IAAI,OAAO,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;GACxD,SAAS,KAAK;IAAE;IAAM,QAAQ;IAAU,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAAE,CAAC;EACnG;CACF;CAEA,EAAE,MAAM,EAAE;CACV,KAAK,MAAM,KAAK,UAAU;EACxB,MAAM,OAAO,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE;EAC3C,IAAI,EAAE,WAAW,UAAU,EAAE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE,GAAG,KAAK,IAAI,SAAS,EAAE,OAAQ,GAAG,EAAE,gBAAgB,MAAM,EAAE;OACzG,IAAI,EAAE,WAAW,aAAa,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,WAAY,KAAK,KAAK,EAAE,WAAY,MAAM,MAAM,OAAO;OAC9H,IAAI,EAAE,WAAW,cAAc;GAClC,MAAM,IAAI,EAAE;GACZ,EAAE,MAAM,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,KAAK,kBAAkB,EAAE,SAAS,EAAE,eAAe,KAAK,SAAS,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,EAAE,MAAM,MAAM,0BAA0B,MAAM,EAAE;GAC3L,EAAE,MAAM,OAAO,cAAc,CAAC,EAAE,+BAA+B;EACjE,OACK;GACH,EAAE,MAAM,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,WAAY,KAAK,mDAAmD;GAC9G,EAAE,MAAM,OAAO,GAAG,KAAK,EAAE,YAAa,GAAG;GACzC,EAAE,MAAM,OAAO,cAAc,EAAE,UAAW,GAAG;EAC/C;CACF;CACA,MAAM,SAAS,SAAS,QAAQ,MAAM,EAAE,WAAW,QAAQ,CAAC,CAAC;CAS7D,OAAO,WAAW,MAAM,KAAK,QAAQ,KAAK,CAPxC,GAAG,QAAQ,QAAQ,MAAM,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,OAAO;EAAE,OAAO,EAAE;EAAO,YAAY,EAAE;CAAW,EAAE,GACvG,GAAG,SAAS,QAAQ,MAAM,EAAE,WAAW,WAAW,CAAC,CAAC,KAAK,OAAO;EAAE,OAAO,EAAE,KAAK;EAAO,YAAY,EAAE;CAAY,EAAE,CAMrE,GAAG,CAHjD,GAAG,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,MAAM,IAAI,GACtE,GAAG,SAAS,QAAQ,MAAM,EAAE,WAAW,eAAe,EAAE,WAAW,YAAY,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,MAAM,IAAI,CAEtD,GAAG,SAAS,IAAI,CAAC;AAC5E;AAEA,eAAe,YAAY,KAAqB,aAA2C;CACzF,IAAI,CAAC,cAAc,WAAW,GAAG,OAAO;EAAE;EAAa,SAAS;EAAM,OAAO;CAAK;CAClF,MAAM,UAAU,YAAY,WAAW;CAEvC,OAAO;EAAE;EAAa;EAAS,QADhB,MAAM,IAAI,OAAO,EAAA,CAAG,MAAM,MAAM,EAAE,OAAO,QAAQ,WAAW,CAAC,EAAE,QAAQ,KAAK;CACtD;AACvC;;;;;;AAOA,eAAe,WACb,MACA,KACA,QACA,KACA,SACA,SACA,MACiB;CACjB,MAAM,IAAI,KAAK;CACf,MAAM,QAAQ,cAAc;CAC5B,IAAI,QAAQ,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,OAAO,QAAQ,WAAW,IAAI,MAAM,GAAG,MAAM,MAAM,SAAS,QAAQ,WAAW,IAAI,aAAa,YAAY,kEAAkE,QAAQ,WAAW,IAAI,OAAO,OAAO,EAAE,CAAC;CAC/Q,IAAI,CAAC,QAAQ,QAAQ,OAAO;CAC5B,IAAI,CAAC,IAAI,SAAS;EAChB,EAAE,MACA,cAAc,QAAQ,KAAK,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,MAAM,MAAM,6CAChE,IAAI,4BAA4B,OAAO,6BAC/C;EACA,OAAO;CACT;CACA,IAAI,CAAC,IAAI,OAAO;EACd,EAAE,MACA,GAAG,OACD,sBAAsB,IAAI,YAAY,aAAa,SAAS,IAAI,QAAQ,SAAS,EAAE,EAAE,oDAAoD,MAAM,4DACjF,MAAM,2BAA2B,IAAI,4BAA4B,OAAO,uCACxI,CACF;EACA,OAAO;CACT;CACA,MAAM,YAAY,SAAS,IAAI,MAAM,MAAM,EAAE;CAC7C,MAAM,SAAwB,CAAC;CAC/B,KAAK,MAAM,KAAK,SAAS;EACvB,IAAI,EAAE,MAAM,aAAa;GAEvB,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,MAAM,KAAK,aAAa,EAAE,MAAM,KAAK,gFAAgF,CAAC;GAC7I;EACF;EACA,MAAM,SAAS,MAAM,IAAI,OAAO,EAAE,WAAW,EAAE;EAC/C,IAAI,OAAO,MAAM,MAAM,EAAE,YAAY,IAAI,MAAO,EAAE,GAAG;GACnD,OAAO,KAAK,EAAE,KAAK;GACnB;EACF;EACA,IAAI,MAAM,EAAE,QAAQ,GAAG,UAAU,cAAc,MAAM,2BAA2B,EAAE,WAAW,KAAK,aAAa,YAAY,EAAE,WAAW,YAAY,EAAE,IAAI,IAAI,GAAG;GAC/J,MAAM,IAAI,UAAU,EAAE,WAAW,IAAI,CAAC,GAAG,OAAO,KAAK,OAAO;IAAE,SAAS,EAAE;IAAS,OAAO,EAAE;GAAM,EAAE,GAAG;IAAE,SAAS,IAAI,MAAM;IAAI,OAAO,EAAE,WAAW;GAAa,CAAC,CAAC;GAClK,OAAO,KAAK,EAAE,KAAK;EACrB,OAAO,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,MAAM,KAAK,aAAa,MAAM,4BAA4B,EAAE,WAAW,KAAK,GAAG,CAAC;CAChH;CACA,IAAI,CAAC,OAAO,QAAQ,OAAO;CAC3B,EAAE,MAAM,EAAE;CACV,MAAM,WAAW,WAAW,OAAO,KAAK,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,MAAM,MAAM,+CAA+C,OAAO;CAC1I,MAAM,SAAS,eAAe,QAAQ,cAAc,IAAI,WAAW,GAAG,KAAK,GAAG;CAC9E,IAAI;CACJ,IAAI,OAAO,QAAQ;EACjB,MAAM,QAAQ,QAAQ,QAAQ,MAAM,OAAO,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,WAAW,IAAI;EAC1F,EAAE,MAAM,GAAG,OAAO,SAAS,MAAM,8CAA8C,CAAC;EAChF,KAAK,MAAM,KAAK,QAAQ,EAAE,MAAM,KAAK,SAAS,GAAG,GAAG,GAAG;EACvD,EAAE,MACA,GAAG,OACD,8CAA8C,MAAM,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,8BAA8B,OAAO,WAAW,IAAI,OAAO,OAAO,yHAClD,UAAU,kFAChH,CACF;EACA,KAAK,MAAM,EAAE,gBAAgB,UAAU,GAAG,MAAM,+CAA+C;CACjG,OAAO,KAAK,MAAM,EAAE,QAAQ,UAAU,IAAI;CAC1C,IAAI,CAAC,IAAI;EACP,EAAE,MAAM,GAAG,MAAM,mEAAmE;EACpF,OAAO;CACT;CACA,MAAM,IAAI,SAAS,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,GAAG,YAAY,IAAI,WAAW,GAAG,EAAE,eAAe,OAAO,IAAI,QAAQ,EAAE,CAAC;CACzI,KAAK,MAAM,KAAK,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;CACxC,MAAM,OAAO,CAAC,GAAG,IAAI,IAAI,OAAO,SAAS,OAAQ,EAAE,WAAW,CAAC,EAAA,CAAG,SAAS,EAAE,IAAI,IAAI,EAAE,aAAa,CAAC,CAAE,CAAC,CAAC;CACzG,IAAI,EAAE,MAAM,KAAK,QACf,EAAE,MAAM,GAAG,IAAI,KAAK,KAAK,KAAK,IAAI,EAAE,GAAG,KAAK,WAAW,IAAI,OAAO,MAAM,mDAAmD,KAAK,WAAW,IAAI,OAAO,OAAO,wBAAwB,WAAW,WAAW,sBAAsB,GAAG,oCAAoC,CAAC;CAE3Q,OAAO,EAAE,KAAK,OAAO;AACvB"}

package/dist/instance-CwWbFbJ8.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { c as runningInstance } from "./instance-Dj9TpJB2.js";

package/dist/instance-Dj9TpJB2.js

@@ -0,0 +1,195 @@
+#!/usr/bin/env node
+import { i as underService, n as envVar } from "./brand--ZB8jTn1.js";
+import { t as Crypto } from "./crypto-fv2fj3S8.js";
+import { n as dataFiles, r as defaultDataDir } from "./config-C9XmYZWO.js";
+import { f as NPM_PACKAGE } from "./types-BhJDbSzE.js";
+import { existsSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+import { execFileSync } from "node:child_process";
+//#region server/instance.ts
+/**
+* How to run this CLI in printed hints: `npx xaq-cli` when run through npx (and in service logs, read
+* by someone who most likely installed that way: the service's own copy isn't on their PATH), else the
+* installed `xaq`.
+*/
+function cliCommand(args) {
+	return `${process.env.npm_command === "exec" || /[\\/]_npx[\\/]/.test(process.argv[1] ?? "") || underService() ? `npx ${NPM_PACKAGE}` : "xaq"} ${args}`;
+}
+/**
+* `service install` with the flags this run used, so the service gets the same data and address.
+* Printed by the startup banner and shown in the console (SystemInfo.serviceCommand).
+*/
+function serviceInstallCommand(config) {
+	const flags = [];
+	if (resolve(config.dataDir) !== defaultDataDir()) flags.push(`--data ${quoteArg(config.dataDir)}`);
+	if (config.host !== "0.0.0.0") flags.push(`--host ${quoteArg(config.host)}`);
+	if (config.port !== 8425) flags.push(`--port ${config.port}`);
+	return cliCommand(["service install", ...flags].join(" "));
+}
+const quoteArg = (s) => /^[\w@%+=:,./-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\''`)}'`;
+/** `reset-password`, with `--data <dir>` when the data directory isn't the default one. */
+function resetPasswordCommand(dataDir) {
+	return cliCommand(resolve(dataDir) !== defaultDataDir() ? `reset-password --data ${quoteArg(dataDir)}` : "reset-password");
+}
+/** `<data>/xaq.lock` (`agentinbox.lock` in a data directory from before the rename: see dataFiles). */
+const lockPath = (dataDir) => dataFiles(dataDir).lock;
+/** Data dirs locked by this process: a lock naming our own pid is live only if it's in here. */
+const heldByUs = /* @__PURE__ */ new Set();
+function bootId() {
+	try {
+		return readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim() || null;
+	} catch {
+		return null;
+	}
+}
+/** Process start time: /proc (Linux, in clock ticks since boot) or `ps` elsewhere; null if unknown. */
+function processStartTime(pid) {
+	try {
+		const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+		return stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19] ?? null;
+	} catch {}
+	if (process.platform === "linux" || process.platform === "win32") return null;
+	try {
+		return execFileSync("ps", [
+			"-o",
+			"lstart=",
+			"-p",
+			String(pid)
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim() || null;
+	} catch {
+		return null;
+	}
+}
+function isAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (err) {
+		return err.code === "EPERM";
+	}
+}
+/**
+* Whether the process a lock names is still the one that wrote it. Our own pid is live only if we
+* hold the lock (in containers every start is pid 1); otherwise the pid must exist, on the same
+* boot, with the same start time (when both are known).
+*/
+function isLive(info, dataDir) {
+	if (info.pid === process.pid) return heldByUs.has(dataDir);
+	if (!isAlive(info.pid)) return false;
+	const boot = bootId();
+	if (info.bootId && boot && info.bootId !== boot) return false;
+	if (info.processStart) {
+		const start = processStartTime(info.pid);
+		if (start && start !== info.processStart) return false;
+	}
+	return true;
+}
+function readLock(dataDir) {
+	try {
+		const info = JSON.parse(readFileSync(lockPath(dataDir), "utf8"));
+		return Number.isInteger(info.pid) && info.pid > 0 ? info : null;
+	} catch {
+		return null;
+	}
+}
+/** The running instance for this data directory, if any. */
+function runningInstance(dataDir) {
+	const info = readLock(dataDir);
+	return info && isLive(info, dataDir) ? info : null;
+}
+/**
+* Takes `<data>/xaq.lock`. Two processes on one data directory would both run ingest and
+* deliver every webhook twice, even on different ports. A lock whose process is gone (dead,
+* rebooted, or its pid reused by something else) is replaced.
+*/
+function acquireInstanceLock(config) {
+	const dataDir = config.dataDir;
+	const file = lockPath(dataDir);
+	const info = {
+		pid: process.pid,
+		host: config.host,
+		port: config.port,
+		startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+		bootId: bootId(),
+		processStart: processStartTime(process.pid),
+		service: underService()
+	};
+	for (let attempt = 0;; attempt++) try {
+		writeFileSync(file, JSON.stringify(info), {
+			flag: "wx",
+			mode: 384
+		});
+		break;
+	} catch (err) {
+		if (err.code !== "EEXIST" || attempt > 0) throw err;
+		const other = runningInstance(dataDir);
+		if (other) {
+			const where = `(pid ${other.pid}${other.port ? `, port ${other.port}` : ""})`;
+			throw new Error(other.service ? `xaq is already running as a background service with the data directory ${dataDir} ${where}. Use that one, stop it (\`${cliCommand("service uninstall")}\` keeps your data), or use another --data directory.` : `xaq is already running with the data directory ${dataDir} ${where}. Stop it first, or use another --data directory. If no such process exists, delete ${file}.` + (existsSync(join(dataDir, "setup-token")) ? ` Lost its setup link? \`${resetPasswordCommand(dataDir)}\` prints it again.` : ""));
+		}
+		rmSync(file, { force: true });
+	}
+	heldByUs.add(dataDir);
+	const ours = () => {
+		const current = readLock(dataDir);
+		return current?.pid === process.pid && current.startedAt === info.startedAt;
+	};
+	return {
+		update(port) {
+			info.port = port;
+			if (ours()) writeFileSync(file, JSON.stringify(info), { mode: 384 });
+		},
+		release() {
+			if (ours()) rmSync(file, { force: true });
+			heldByUs.delete(dataDir);
+		}
+	};
+}
+/** One ciphertext from the database, or null when nothing encrypted is stored. */
+function sampleCiphertext(dbPath) {
+	if (!existsSync(dbPath)) return null;
+	const db = new DatabaseSync(dbPath);
+	try {
+		for (const sql of [
+			"SELECT refresh_token_enc AS v FROM accounts WHERE refresh_token_enc LIKE 'v1:%' LIMIT 1",
+			"SELECT secret_enc AS v FROM webhooks WHERE secret_enc LIKE 'v1:%' LIMIT 1",
+			"SELECT json_extract(value, '$.clientSecretEnc') AS v FROM settings WHERE key = 'google.client'"
+		]) try {
+			const v = db.prepare(sql).get()?.v;
+			if (typeof v === "string" && v.startsWith("v1:")) return v;
+		} catch {}
+		return null;
+	} finally {
+		db.close();
+	}
+}
+/**
+* Refuses to start with a master key that can't read the stored secrets: a missing master.key would
+* otherwise be regenerated, silently making every refresh token and webhook secret unreadable.
+* `envKey` overrides XAQ_MASTER_KEY (or AGENTINBOX_MASTER_KEY; used by `service install` to check the key it will install).
+*/
+function assertMasterKeyUsable(config, envKey = envVar("MASTER_KEY")) {
+	const sample = sampleCiphertext(config.dbPath);
+	if (!sample) return;
+	let raw = envKey || null;
+	const source = raw ? "XAQ_MASTER_KEY" : config.masterKeyPath;
+	if (!raw && existsSync(config.masterKeyPath)) raw = readFileSync(config.masterKeyPath, "utf8").trim();
+	if (!raw) throw new Error(`${config.dbPath} holds encrypted secrets, but there is no master key: ${config.masterKeyPath} is missing and XAQ_MASTER_KEY is not set. Restore master.key from your backup (or set XAQ_MASTER_KEY to the key used before). xaq won't create a new key, because the stored Google tokens and secrets could never be read again.`);
+	try {
+		new Crypto(Buffer.from(raw, "base64")).decrypt(sample);
+	} catch {
+		throw new Error(`The master key from ${source} can't decrypt the secrets stored in ${config.dbPath}. Use the key this data directory was created with (master.key from your backup, or the previous XAQ_MASTER_KEY or AGENTINBOX_MASTER_KEY).`);
+	}
+}
+//#endregion
+export { lockPath as a, runningInstance as c, cliCommand as i, serviceInstallCommand as l, assertMasterKeyUsable as n, processStartTime as o, bootId as r, resetPasswordCommand as s, acquireInstanceLock as t };
+
+//# sourceMappingURL=instance-Dj9TpJB2.js.map

package/dist/instance-Dj9TpJB2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance-Dj9TpJB2.js","names":[],"sources":["../server/instance.ts"],"sourcesContent":["import { execFileSync } from \"node:child_process\";\nimport { existsSync, readFileSync, rmSync, writeFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { DatabaseSync } from \"node:sqlite\";\nimport { CLI_NAME, NPM_PACKAGE } from \"../shared/types.ts\";\nimport { envVar, underService } from \"./brand.ts\";\nimport { type Config, dataFiles, DEFAULT_PORT, defaultDataDir } from \"./config.ts\";\nimport { Crypto } from \"./crypto.ts\";\n\n/**\n * How to run this CLI in printed hints: `npx xaq-cli` when run through npx (and in service logs, read\n * by someone who most likely installed that way: the service's own copy isn't on their PATH), else the\n * installed `xaq`.\n */\nexport function cliCommand(args: string): string {\n  const viaNpx = process.env.npm_command === \"exec\" || /[\\\\/]_npx[\\\\/]/.test(process.argv[1] ?? \"\") || underService();\n  return `${viaNpx ? `npx ${NPM_PACKAGE}` : CLI_NAME} ${args}`;\n}\n\n/**\n * `service install` with the flags this run used, so the service gets the same data and address.\n * Printed by the startup banner and shown in the console (SystemInfo.serviceCommand).\n */\nexport function serviceInstallCommand(config: Pick<Config, \"dataDir\" | \"host\" | \"port\">): string {\n  const flags: string[] = [];\n  if (resolve(config.dataDir) !== defaultDataDir()) flags.push(`--data ${quoteArg(config.dataDir)}`);\n  if (config.host !== \"0.0.0.0\") flags.push(`--host ${quoteArg(config.host)}`);\n  if (config.port !== DEFAULT_PORT) flags.push(`--port ${config.port}`);\n  return cliCommand([\"service install\", ...flags].join(\" \"));\n}\n\nconst quoteArg = (s: string) => (/^[\\w@%+=:,./-]+$/.test(s) ? s : `'${s.replace(/'/g, `'\\\\''`)}'`);\n\n/** `reset-password`, with `--data <dir>` when the data directory isn't the default one. */\nexport function resetPasswordCommand(dataDir: string): string {\n  const custom = resolve(dataDir) !== defaultDataDir();\n  return cliCommand(custom ? `reset-password --data ${quoteArg(dataDir)}` : \"reset-password\");\n}\n\n// ───────────── Single instance per data directory ─────────────\n\nexport interface InstanceInfo {\n  pid: number;\n  host: string;\n  port: number;\n  startedAt: string;\n  /** Kernel boot id (Linux), so a lock from before a reboot is never mistaken for a live one. */\n  bootId?: string | null;\n  /** The process's own start time as the OS reports it, so a reused pid doesn't look alive. */\n  processStart?: string | null;\n  /** Started by the background service (XAQ_SERVICE=1). */\n  service?: boolean;\n}\n\n/** `<data>/xaq.lock` (`agentinbox.lock` in a data directory from before the rename: see dataFiles). */\nexport const lockPath = (dataDir: string) => dataFiles(dataDir).lock;\n\n/** Data dirs locked by this process: a lock naming our own pid is live only if it's in here. */\nconst heldByUs = new Set<string>();\n\nexport function bootId(): string | null {\n  try {\n    return readFileSync(\"/proc/sys/kernel/random/boot_id\", \"utf8\").trim() || null;\n  } catch {\n    return null;\n  }\n}\n\n/** Process start time: /proc (Linux, in clock ticks since boot) or `ps` elsewhere; null if unknown. */\nexport function processStartTime(pid: number): string | null {\n  try {\n    const stat = readFileSync(`/proc/${pid}/stat`, \"utf8\");\n    // Fields after the parenthesized command name; starttime is field 22, i.e. index 19 here.\n    return stat.slice(stat.lastIndexOf(\")\") + 2).split(\" \")[19] ?? null;\n  } catch {\n    // No /proc (macOS) or no such process.\n  }\n  if (process.platform === \"linux\" || process.platform === \"win32\") return null;\n  try {\n    return execFileSync(\"ps\", [\"-o\", \"lstart=\", \"-p\", String(pid)], { encoding: \"utf8\", stdio: [\"ignore\", \"pipe\", \"ignore\"] }).trim() || null;\n  } catch {\n    return null;\n  }\n}\n\nfunction isAlive(pid: number): boolean {\n  try {\n    process.kill(pid, 0);\n    return true;\n  } catch (err) {\n    return (err as NodeJS.ErrnoException).code === \"EPERM\";\n  }\n}\n\n/**\n * Whether the process a lock names is still the one that wrote it. Our own pid is live only if we\n * hold the lock (in containers every start is pid 1); otherwise the pid must exist, on the same\n * boot, with the same start time (when both are known).\n */\nfunction isLive(info: InstanceInfo, dataDir: string): boolean {\n  if (info.pid === process.pid) return heldByUs.has(dataDir);\n  if (!isAlive(info.pid)) return false;\n  const boot = bootId();\n  if (info.bootId && boot && info.bootId !== boot) return false;\n  if (info.processStart) {\n    const start = processStartTime(info.pid);\n    if (start && start !== info.processStart) return false;\n  }\n  return true;\n}\n\nfunction readLock(dataDir: string): InstanceInfo | null {\n  try {\n    const info = JSON.parse(readFileSync(lockPath(dataDir), \"utf8\")) as InstanceInfo;\n    return Number.isInteger(info.pid) && info.pid > 0 ? info : null;\n  } catch {\n    return null;\n  }\n}\n\n/** The running instance for this data directory, if any. */\nexport function runningInstance(dataDir: string): InstanceInfo | null {\n  const info = readLock(dataDir);\n  return info && isLive(info, dataDir) ? info : null;\n}\n\nexport interface InstanceLock {\n  /** Records the bound port (for `reset-password` and error messages). */\n  update(port: number): void;\n  release(): void;\n}\n\n/**\n * Takes `<data>/xaq.lock`. Two processes on one data directory would both run ingest and\n * deliver every webhook twice, even on different ports. A lock whose process is gone (dead,\n * rebooted, or its pid reused by something else) is replaced.\n */\nexport function acquireInstanceLock(config: Pick<Config, \"dataDir\" | \"host\" | \"port\">): InstanceLock {\n  const dataDir = config.dataDir;\n  const file = lockPath(dataDir);\n  const info: InstanceInfo = {\n    pid: process.pid,\n    host: config.host,\n    port: config.port,\n    startedAt: new Date().toISOString(),\n    bootId: bootId(),\n    processStart: processStartTime(process.pid),\n    service: underService(),\n  };\n  for (let attempt = 0; ; attempt++) {\n    try {\n      writeFileSync(file, JSON.stringify(info), { flag: \"wx\", mode: 0o600 });\n      break;\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"EEXIST\" || attempt > 0) throw err;\n      const other = runningInstance(dataDir);\n      if (other) {\n        const where = `(pid ${other.pid}${other.port ? `, port ${other.port}` : \"\"})`;\n        throw new Error(\n          other.service\n            ? `xaq is already running as a background service with the data directory ${dataDir} ${where}. ` +\n                `Use that one, stop it (\\`${cliCommand(\"service uninstall\")}\\` keeps your data), or use another --data directory.`\n            : `xaq is already running with the data directory ${dataDir} ${where}. ` +\n                `Stop it first, or use another --data directory. If no such process exists, delete ${file}.` +\n                (existsSync(join(dataDir, \"setup-token\")) ? ` Lost its setup link? \\`${resetPasswordCommand(dataDir)}\\` prints it again.` : \"\"),\n        );\n      }\n      rmSync(file, { force: true });\n    }\n  }\n  heldByUs.add(dataDir);\n  const ours = () => {\n    const current = readLock(dataDir);\n    return current?.pid === process.pid && current.startedAt === info.startedAt;\n  };\n  return {\n    update(port) {\n      info.port = port;\n      if (ours()) writeFileSync(file, JSON.stringify(info), { mode: 0o600 });\n    },\n    release() {\n      if (ours()) rmSync(file, { force: true });\n      heldByUs.delete(dataDir);\n    },\n  };\n}\n\n// ───────────── Master key guard ─────────────\n\n/** One ciphertext from the database, or null when nothing encrypted is stored. */\nfunction sampleCiphertext(dbPath: string): string | null {\n  if (!existsSync(dbPath)) return null;\n  const db = new DatabaseSync(dbPath);\n  try {\n    const queries = [\n      \"SELECT refresh_token_enc AS v FROM accounts WHERE refresh_token_enc LIKE 'v1:%' LIMIT 1\",\n      \"SELECT secret_enc AS v FROM webhooks WHERE secret_enc LIKE 'v1:%' LIMIT 1\",\n      \"SELECT json_extract(value, '$.clientSecretEnc') AS v FROM settings WHERE key = 'google.client'\",\n    ];\n    for (const sql of queries) {\n      try {\n        const v = (db.prepare(sql).get() as { v?: unknown } | undefined)?.v;\n        if (typeof v === \"string\" && v.startsWith(\"v1:\")) return v;\n      } catch {\n        // Table not created yet.\n      }\n    }\n    return null;\n  } finally {\n    db.close();\n  }\n}\n\n/**\n * Refuses to start with a master key that can't read the stored secrets: a missing master.key would\n * otherwise be regenerated, silently making every refresh token and webhook secret unreadable.\n * `envKey` overrides XAQ_MASTER_KEY (or AGENTINBOX_MASTER_KEY; used by `service install` to check the key it will install).\n */\nexport function assertMasterKeyUsable(config: Pick<Config, \"dbPath\" | \"masterKeyPath\">, envKey = envVar(\"MASTER_KEY\")): void {\n  const sample = sampleCiphertext(config.dbPath);\n  if (!sample) return;\n  let raw: string | null = envKey || null;\n  const source = raw ? \"XAQ_MASTER_KEY\" : config.masterKeyPath;\n  if (!raw && existsSync(config.masterKeyPath)) raw = readFileSync(config.masterKeyPath, \"utf8\").trim();\n  if (!raw) {\n    throw new Error(\n      `${config.dbPath} holds encrypted secrets, but there is no master key: ${config.masterKeyPath} is missing and XAQ_MASTER_KEY is not set. ` +\n        \"Restore master.key from your backup (or set XAQ_MASTER_KEY to the key used before). \" +\n        \"xaq won't create a new key, because the stored Google tokens and secrets could never be read again.\",\n    );\n  }\n  try {\n    new Crypto(Buffer.from(raw, \"base64\")).decrypt(sample);\n  } catch {\n    throw new Error(\n      `The master key from ${source} can't decrypt the secrets stored in ${config.dbPath}. ` +\n        \"Use the key this data directory was created with (master.key from your backup, or the previous XAQ_MASTER_KEY or AGENTINBOX_MASTER_KEY).\",\n    );\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAcA,SAAgB,WAAW,MAAsB;CAE/C,OAAO,GADQ,QAAQ,IAAI,gBAAgB,UAAU,iBAAiB,KAAK,QAAQ,KAAK,MAAM,EAAE,KAAK,aAAa,IAC/F,OAAO,gBAAA,MAAyB,GAAG;AACxD;;;;;AAMA,SAAgB,sBAAsB,QAA2D;CAC/F,MAAM,QAAkB,CAAC;CACzB,IAAI,QAAQ,OAAO,OAAO,MAAM,eAAe,GAAG,MAAM,KAAK,UAAU,SAAS,OAAO,OAAO,GAAG;CACjG,IAAI,OAAO,SAAS,WAAW,MAAM,KAAK,UAAU,SAAS,OAAO,IAAI,GAAG;CAC3E,IAAI,OAAO,SAAA,MAAuB,MAAM,KAAK,UAAU,OAAO,MAAM;CACpE,OAAO,WAAW,CAAC,mBAAmB,GAAG,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC;AAC3D;AAEA,MAAM,YAAY,MAAe,mBAAmB,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,QAAQ,MAAM,OAAO,EAAE;;AAG/F,SAAgB,qBAAqB,SAAyB;CAE5D,OAAO,WADQ,QAAQ,OAAO,MAAM,eAAe,IACxB,yBAAyB,SAAS,OAAO,MAAM,gBAAgB;AAC5F;;AAkBA,MAAa,YAAY,YAAoB,UAAU,OAAO,CAAC,CAAC;;AAGhE,MAAM,2BAAW,IAAI,IAAY;AAEjC,SAAgB,SAAwB;CACtC,IAAI;EACF,OAAO,aAAa,mCAAmC,MAAM,CAAC,CAAC,KAAK,KAAK;CAC3E,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,iBAAiB,KAA4B;CAC3D,IAAI;EACF,MAAM,OAAO,aAAa,SAAS,IAAI,QAAQ,MAAM;EAErD,OAAO,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO;CACjE,QAAQ,CAER;CACA,IAAI,QAAQ,aAAa,WAAW,QAAQ,aAAa,SAAS,OAAO;CACzE,IAAI;EACF,OAAO,aAAa,MAAM;GAAC;GAAM;GAAW;GAAM,OAAO,GAAG;EAAC,GAAG;GAAE,UAAU;GAAQ,OAAO;IAAC;IAAU;IAAQ;GAAQ;EAAE,CAAC,CAAC,CAAC,KAAK,KAAK;CACvI,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,QAAQ,KAAsB;CACrC,IAAI;EACF,QAAQ,KAAK,KAAK,CAAC;EACnB,OAAO;CACT,SAAS,KAAK;EACZ,OAAQ,IAA8B,SAAS;CACjD;AACF;;;;;;AAOA,SAAS,OAAO,MAAoB,SAA0B;CAC5D,IAAI,KAAK,QAAQ,QAAQ,KAAK,OAAO,SAAS,IAAI,OAAO;CACzD,IAAI,CAAC,QAAQ,KAAK,GAAG,GAAG,OAAO;CAC/B,MAAM,OAAO,OAAO;CACpB,IAAI,KAAK,UAAU,QAAQ,KAAK,WAAW,MAAM,OAAO;CACxD,IAAI,KAAK,cAAc;EACrB,MAAM,QAAQ,iBAAiB,KAAK,GAAG;EACvC,IAAI,SAAS,UAAU,KAAK,cAAc,OAAO;CACnD;CACA,OAAO;AACT;AAEA,SAAS,SAAS,SAAsC;CACtD,IAAI;EACF,MAAM,OAAO,KAAK,MAAM,aAAa,SAAS,OAAO,GAAG,MAAM,CAAC;EAC/D,OAAO,OAAO,UAAU,KAAK,GAAG,KAAK,KAAK,MAAM,IAAI,OAAO;CAC7D,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,gBAAgB,SAAsC;CACpE,MAAM,OAAO,SAAS,OAAO;CAC7B,OAAO,QAAQ,OAAO,MAAM,OAAO,IAAI,OAAO;AAChD;;;;;;AAaA,SAAgB,oBAAoB,QAAiE;CACnG,MAAM,UAAU,OAAO;CACvB,MAAM,OAAO,SAAS,OAAO;CAC7B,MAAM,OAAqB;EACzB,KAAK,QAAQ;EACb,MAAM,OAAO;EACb,MAAM,OAAO;EACb,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC,QAAQ,OAAO;EACf,cAAc,iBAAiB,QAAQ,GAAG;EAC1C,SAAS,aAAa;CACxB;CACA,KAAK,IAAI,UAAU,IAAK,WACtB,IAAI;EACF,cAAc,MAAM,KAAK,UAAU,IAAI,GAAG;GAAE,MAAM;GAAM,MAAM;EAAM,CAAC;EACrE;CACF,SAAS,KAAK;EACZ,IAAK,IAA8B,SAAS,YAAY,UAAU,GAAG,MAAM;EAC3E,MAAM,QAAQ,gBAAgB,OAAO;EACrC,IAAI,OAAO;GACT,MAAM,QAAQ,QAAQ,MAAM,MAAM,MAAM,OAAO,UAAU,MAAM,SAAS,GAAG;GAC3E,MAAM,IAAI,MACR,MAAM,UACF,0EAA0E,QAAQ,GAAG,MAAM,6BAC7D,WAAW,mBAAmB,EAAE,yDAC9D,kDAAkD,QAAQ,GAAG,MAAM,sFACoB,KAAK,MACzF,WAAW,KAAK,SAAS,aAAa,CAAC,IAAI,2BAA2B,qBAAqB,OAAO,EAAE,uBAAuB,GACpI;EACF;EACA,OAAO,MAAM,EAAE,OAAO,KAAK,CAAC;CAC9B;CAEF,SAAS,IAAI,OAAO;CACpB,MAAM,aAAa;EACjB,MAAM,UAAU,SAAS,OAAO;EAChC,OAAO,SAAS,QAAQ,QAAQ,OAAO,QAAQ,cAAc,KAAK;CACpE;CACA,OAAO;EACL,OAAO,MAAM;GACX,KAAK,OAAO;GACZ,IAAI,KAAK,GAAG,cAAc,MAAM,KAAK,UAAU,IAAI,GAAG,EAAE,MAAM,IAAM,CAAC;EACvE;EACA,UAAU;GACR,IAAI,KAAK,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,CAAC;GACxC,SAAS,OAAO,OAAO;EACzB;CACF;AACF;;AAKA,SAAS,iBAAiB,QAA+B;CACvD,IAAI,CAAC,WAAW,MAAM,GAAG,OAAO;CAChC,MAAM,KAAK,IAAI,aAAa,MAAM;CAClC,IAAI;EAMF,KAAK,MAAM,OAAO;GAJhB;GACA;GACA;EAEsB,GACtB,IAAI;GACF,MAAM,IAAK,GAAG,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,EAAkC;GAClE,IAAI,OAAO,MAAM,YAAY,EAAE,WAAW,KAAK,GAAG,OAAO;EAC3D,QAAQ,CAER;EAEF,OAAO;CACT,UAAU;EACR,GAAG,MAAM;CACX;AACF;;;;;;AAOA,SAAgB,sBAAsB,QAAkD,SAAS,OAAO,YAAY,GAAS;CAC3H,MAAM,SAAS,iBAAiB,OAAO,MAAM;CAC7C,IAAI,CAAC,QAAQ;CACb,IAAI,MAAqB,UAAU;CACnC,MAAM,SAAS,MAAM,mBAAmB,OAAO;CAC/C,IAAI,CAAC,OAAO,WAAW,OAAO,aAAa,GAAG,MAAM,aAAa,OAAO,eAAe,MAAM,CAAC,CAAC,KAAK;CACpG,IAAI,CAAC,KACH,MAAM,IAAI,MACR,GAAG,OAAO,OAAO,wDAAwD,OAAO,cAAc,mOAGhG;CAEF,IAAI;EACF,IAAI,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,MAAM;CACvD,QAAQ;EACN,MAAM,IAAI,MACR,uBAAuB,OAAO,uCAAuC,OAAO,OAAO,2IAErF;CACF;AACF"}