xaq-cli 0.0.0 → 0.1.0-nightly.72

package/dist/mcpsetup-DXXo2qjf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpsetup-DXXo2qjf.js","names":["UNREADABLE","escapeRe"],"sources":["../server/connections-cli/toml.ts","../server/connections-cli/yaml.ts","../server/listen/mcpsetup.ts"],"sourcesContent":["/**\n * A small TOML reader for Codex's `[mcp_servers.*]` tables, without a TOML library. It reads table headers,\n * dotted and quoted keys, basic and literal strings, numbers, booleans, single- or multi-line arrays of those,\n * and one-line inline tables. Multi-line strings, dates and arrays of tables are UNREADABLE (for their value or\n * table), so the caller can skip an entry it can't read instead of guessing.\n */\n\nexport const UNREADABLE = Symbol(\"unreadable\");\nexport type TomlValue = string | number | boolean | typeof UNREADABLE | TomlValue[] | { [key: string]: TomlValue };\nexport type TomlTable = { [key: string]: TomlValue };\n\nclass Cursor {\n  i = 0;\n  constructor(readonly s: string) {}\n  ws(): void {\n    while (this.i < this.s.length && /[ \\t]/.test(this.s[this.i]!)) this.i++;\n  }\n  /** Whitespace, newlines and comments (inside arrays). */\n  wsAll(): void {\n    for (;;) {\n      while (this.i < this.s.length && /[ \\t\\r\\n]/.test(this.s[this.i]!)) this.i++;\n      if (this.s[this.i] !== \"#\") return;\n      while (this.i < this.s.length && this.s[this.i] !== \"\\n\") this.i++;\n    }\n  }\n  peek(): string | undefined {\n    return this.s[this.i];\n  }\n  done(): boolean {\n    return this.i >= this.s.length;\n  }\n}\n\nclass Unreadable extends Error {}\n\nconst ESCAPES: Record<string, string> = { b: \"\\b\", t: \"\\t\", n: \"\\n\", f: \"\\f\", r: \"\\r\", '\"': '\"', \"\\\\\": \"\\\\\", e: \"\\x1b\" };\n\nfunction readString(c: Cursor): string {\n  const q = c.peek();\n  if (c.s.startsWith(`${q}${q}${q}`, c.i)) throw new Unreadable(\"multi-line string\");\n  c.i++;\n  let out = \"\";\n  while (!c.done()) {\n    const ch = c.s[c.i++]!;\n    if (ch === \"\\n\") break;\n    if (ch === q) return out;\n    if (q === '\"' && ch === \"\\\\\") {\n      const e = c.s[c.i++]!;\n      if (ESCAPES[e] !== undefined) out += ESCAPES[e];\n      else if (e === \"u\" || e === \"U\") {\n        const len = e === \"u\" ? 4 : 8;\n        const hex = c.s.slice(c.i, c.i + len);\n        if (!/^[0-9a-fA-F]+$/.test(hex) || hex.length !== len) throw new Unreadable(\"bad escape\");\n        out += String.fromCodePoint(Number.parseInt(hex, 16));\n        c.i += len;\n      } else throw new Unreadable(\"bad escape\");\n    } else out += ch;\n  }\n  throw new Unreadable(\"unterminated string\");\n}\n\nfunction readKey(c: Cursor): string[] {\n  const parts: string[] = [];\n  for (;;) {\n    c.ws();\n    const ch = c.peek();\n    if (ch === '\"' || ch === \"'\") parts.push(readString(c));\n    else {\n      const m = /^[A-Za-z0-9_-]+/.exec(c.s.slice(c.i));\n      if (!m) throw new Unreadable(\"bad key\");\n      parts.push(m[0]);\n      c.i += m[0].length;\n    }\n    c.ws();\n    if (c.peek() !== \".\") return parts;\n    c.i++;\n  }\n}\n\nfunction readValue(c: Cursor, multiline: boolean): TomlValue {\n  const ch = c.peek();\n  if (ch === '\"' || ch === \"'\") return readString(c);\n  if (ch === \"[\") {\n    c.i++;\n    const items: TomlValue[] = [];\n    for (;;) {\n      if (multiline) c.wsAll();\n      else c.ws();\n      if (c.peek() === \"]\") {\n        c.i++;\n        return items;\n      }\n      items.push(readValue(c, multiline));\n      if (multiline) c.wsAll();\n      else c.ws();\n      if (c.peek() === \",\") c.i++;\n      else if (c.peek() !== \"]\") throw new Unreadable(\"bad array\");\n    }\n  }\n  if (ch === \"{\") {\n    c.i++;\n    const table: TomlTable = {};\n    c.ws();\n    if (c.peek() === \"}\") {\n      c.i++;\n      return table;\n    }\n    for (;;) {\n      const key = readKey(c);\n      if (c.peek() !== \"=\") throw new Unreadable(\"bad inline table\");\n      c.i++;\n      c.ws();\n      setPath(table, key, readValue(c, false));\n      c.ws();\n      if (c.peek() === \",\") {\n        c.i++;\n        continue;\n      }\n      if (c.peek() === \"}\") {\n        c.i++;\n        return table;\n      }\n      throw new Unreadable(\"bad inline table\");\n    }\n  }\n  const m = /^[^\\s,\\]}#]+/.exec(c.s.slice(c.i));\n  if (!m) throw new Unreadable(\"missing value\");\n  c.i += m[0].length;\n  if (m[0] === \"true\") return true;\n  if (m[0] === \"false\") return false;\n  const n = m[0].replace(/_/g, \"\");\n  if (/^[-+]?(\\d+(\\.\\d+)?([eE][-+]?\\d+)?|0x[0-9a-fA-F]+|0o[0-7]+|0b[01]+)$/.test(n)) return Number(n);\n  throw new Unreadable(\"unsupported value\");\n}\n\nfunction setPath(table: TomlTable, path: string[], value: TomlValue): void {\n  let t = table;\n  for (const p of path.slice(0, -1)) {\n    const next = t[p];\n    if (next === undefined) t = t[p] = {};\n    else if (typeof next === \"object\" && !Array.isArray(next)) t = next as TomlTable;\n    else throw new Unreadable(\"key redefined\");\n  }\n  const last = path[path.length - 1]!;\n  if (Object.hasOwn(t, last)) throw new Unreadable(\"key redefined\");\n  t[last] = value;\n}\n\nfunction tableAt(root: TomlTable, path: string[]): TomlTable {\n  let t = root;\n  for (const p of path) {\n    const next = t[p];\n    if (next === undefined) t = t[p] = {};\n    else if (typeof next === \"object\" && !Array.isArray(next)) t = next as TomlTable;\n    else throw new Unreadable(\"table redefined\");\n  }\n  return t;\n}\n\n/**\n * The `mcp_servers` table of a Codex config.toml: server name → entry. A server whose table (or a value in it)\n * can't be read maps to UNREADABLE. Problems outside mcp_servers are ignored.\n */\nexport function readTomlMcpServers(toml: string): { [name: string]: TomlTable | typeof UNREADABLE } {\n  const root: TomlTable = {};\n  const bad = new Set<string>();\n  let current: string[] = [];\n  const lines = toml.replace(/^/, \"\").split(\"\\n\");\n  for (let n = 0; n < lines.length; n++) {\n    const line = lines[n]!;\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n    if (trimmed.startsWith(\"[[\")) {\n      const c = new Cursor(trimmed.slice(2));\n      try {\n        current = [\"\\u0000array\", ...readKey(c)];\n      } catch {\n        current = [\"\\u0000array\"];\n      }\n      if (current[1] === \"mcp_servers\" && current[2]) bad.add(current[2]);\n      continue;\n    }\n    if (trimmed.startsWith(\"[\")) {\n      const c = new Cursor(trimmed.slice(1));\n      try {\n        current = readKey(c);\n        if (c.peek() !== \"]\") throw new Unreadable(\"bad header\");\n        if (current[0] === \"mcp_servers\") tableAt(root, current);\n      } catch {\n        current = [\"\\u0000bad\"];\n      }\n      continue;\n    }\n    if (current[0] !== \"mcp_servers\" && !/^\\s*mcp_servers\\s*[.=]/.test(line)) continue;\n    // A value may continue over several lines (multi-line arrays): take lines until it parses.\n    let text = line;\n    let consumed = n;\n    let parsed: { key: string[]; value: TomlValue } | null = null;\n    for (;;) {\n      const c = new Cursor(text);\n      try {\n        const key = readKey(c);\n        if (c.peek() !== \"=\") throw new Unreadable(\"missing =\");\n        c.i++;\n        c.ws();\n        const value = readValue(c, true);\n        c.ws();\n        if (!c.done() && c.peek() !== \"#\") throw new Unreadable(\"trailing characters\");\n        parsed = { key, value };\n        break;\n      } catch {\n        const open = (text.match(/\\[/g) ?? []).length > (text.match(/]/g) ?? []).length;\n        if (!open || consumed + 1 >= lines.length) break;\n        text += `\\n${lines[++consumed]}`;\n      }\n    }\n    n = consumed;\n    const full = parsed ? [...current, ...parsed.key] : current;\n    const server = full[0] === \"mcp_servers\" ? full[1] : current[1];\n    if (!parsed) {\n      if (server) bad.add(server);\n      continue;\n    }\n    try {\n      setPath(root, full, parsed.value);\n    } catch {\n      if (server) bad.add(server);\n    }\n  }\n  const servers = root.mcp_servers;\n  const out: { [name: string]: TomlTable | typeof UNREADABLE } = {};\n  if (servers && typeof servers === \"object\" && !Array.isArray(servers)) {\n    for (const [name, entry] of Object.entries(servers as TomlTable)) {\n      out[name] = bad.has(name) || !entry || typeof entry !== \"object\" || Array.isArray(entry) ? UNREADABLE : (entry as TomlTable);\n    }\n  }\n  for (const name of bad) out[name] = UNREADABLE;\n  return out;\n}\n","/**\n * A small reader for the `mcp_servers:` block of a Hermes config.yaml, without a YAML library (like\n * server/listen/mcpsetup.ts). It handles the block style Hermes writes and documents: nested maps, plain and\n * quoted scalars, flow sequences of scalars (`args: [\"-y\", \"pkg\"]`) and block sequences of scalars. Anything else\n * (anchors, block scalars, flow maps, tabs) becomes UNREADABLE for that value, so the caller can skip the entry\n * that uses it instead of guessing. Only the mcp_servers block is read: the rest of the file never matters.\n */\n\nexport const UNREADABLE = Symbol(\"unreadable\");\nexport type YamlValue = string | number | boolean | null | typeof UNREADABLE | YamlValue[] | { [key: string]: YamlValue };\nexport type YamlMap = { [key: string]: YamlValue };\n\ninterface Line {\n  indent: number;\n  text: string;\n}\n\n/** The text of a line without a trailing comment (a `#` after whitespace, outside quotes). */\nexport function stripComment(line: string): string {\n  let quote: string | null = null;\n  for (let i = 0; i < line.length; i++) {\n    const ch = line[i]!;\n    if (quote) {\n      if (ch === \"\\\\\" && quote === '\"') i++;\n      else if (ch === quote) quote = null;\n    } else if (ch === '\"' || ch === \"'\") {\n      if (i === 0 || /[\\s:[{,-]/.test(line[i - 1]!)) quote = ch;\n    } else if (ch === \"#\" && (i === 0 || /\\s/.test(line[i - 1]!))) return line.slice(0, i).trimEnd();\n  }\n  return line.trimEnd();\n}\n\n/** The line range of the top-level `mcp_servers:` block, or null when there isn't exactly one. */\nexport function mcpServersBlock(yaml: string): { start: number; end: number; inline: string } | null {\n  return topBlock(yaml, \"mcp_servers\");\n}\n\nconst keyRe = (key: string) => new RegExp(`^${key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}\\\\s*:`);\n\n/** The line range of a top-level `<key>:` block, or null when there isn't exactly one. */\nexport function topBlock(yaml: string, key: string): { start: number; end: number; inline: string } | null {\n  const re = keyRe(key);\n  const lines = yaml.replace(/^/, \"\").split(\"\\n\");\n  const tops = lines.flatMap((l, i) => (re.test(l) ? [i] : []));\n  if (tops.length !== 1) return null;\n  const start = tops[0]!;\n  let end = start + 1;\n  while (end < lines.length && (lines[end]!.trim() === \"\" || /^\\s/.test(lines[end]!) || lines[end]!.startsWith(\"#\"))) end++;\n  // Trailing blank lines and column-0 comments belong to whatever comes next.\n  while (end > start + 1 && (lines[end - 1]!.trim() === \"\" || lines[end - 1]!.startsWith(\"#\"))) end--;\n  return { start, end, inline: stripComment(lines[start]!.replace(re, \"\")).trim() };\n}\n\nfunction unquote(raw: string): string | typeof UNREADABLE {\n  if (raw.startsWith('\"')) {\n    if (!raw.endsWith('\"') || raw.length < 2) return UNREADABLE;\n    try {\n      // YAML double-quoted escapes are a superset of JSON's; the common ones agree.\n      return JSON.parse(raw.replace(/\\\\\\//g, \"/\")) as string;\n    } catch {\n      return UNREADABLE;\n    }\n  }\n  if (raw.startsWith(\"'\")) {\n    if (!raw.endsWith(\"'\") || raw.length < 2) return UNREADABLE;\n    return raw.slice(1, -1).replace(/''/g, \"'\");\n  }\n  return raw;\n}\n\n/** Splits a flow sequence body on top-level commas. */\nfunction splitFlow(body: string): string[] | null {\n  const out: string[] = [];\n  let cur = \"\";\n  let quote: string | null = null;\n  for (let i = 0; i < body.length; i++) {\n    const ch = body[i]!;\n    if (quote) {\n      cur += ch;\n      if (ch === \"\\\\\" && quote === '\"') cur += body[++i] ?? \"\";\n      else if (ch === quote) quote = null;\n    } else if (ch === '\"' || ch === \"'\") {\n      quote = ch;\n      cur += ch;\n    } else if (ch === \"[\" || ch === \"{\" || ch === \"]\" || ch === \"}\") return null;\n    else if (ch === \",\") {\n      out.push(cur.trim());\n      cur = \"\";\n    } else cur += ch;\n  }\n  if (quote) return null;\n  if (cur.trim()) out.push(cur.trim());\n  return out;\n}\n\nexport function scalar(raw: string): YamlValue {\n  const v = raw.trim();\n  if (v === \"\" || v === \"~\" || v === \"null\" || v === \"Null\" || v === \"NULL\") return null;\n  if (/^[&*!|>]/.test(v) || v.startsWith(\"<<\") || v.startsWith(\"{\")) return UNREADABLE;\n  if (v.startsWith(\"[\")) {\n    if (!v.endsWith(\"]\")) return UNREADABLE;\n    const items = splitFlow(v.slice(1, -1));\n    return items ? items.map((i) => scalar(i)) : UNREADABLE;\n  }\n  if (v.startsWith('\"') || v.startsWith(\"'\")) return unquote(v);\n  if (/^(true|True|TRUE)$/.test(v)) return true;\n  if (/^(false|False|FALSE)$/.test(v)) return false;\n  if (/^[-+]?\\d+(\\.\\d+)?$/.test(v)) return Number(v);\n  return v;\n}\n\n/** `key: rest` with a plain or quoted key; null when the line isn't one. */\nfunction keyValue(text: string): { key: string; rest: string } | null {\n  const m = /^(\"(?:[^\"\\\\]|\\\\.)*\"|'(?:[^']|'')*'|[^\"'#:\\s][^:]*?)\\s*:(?:\\s+(.*)|$)/.exec(text);\n  if (!m) return null;\n  const key = unquote(m[1]!);\n  if (key === UNREADABLE) return null;\n  return { key, rest: (m[2] ?? \"\").trim() };\n}\n\nfunction parseLines(lines: Line[], from: number, indent: number): { value: YamlValue; next: number } {\n  const first = lines[from];\n  if (!first || first.indent < indent) return { value: null, next: from };\n  const childIndent = first.indent;\n  if (first.text.startsWith(\"- \") || first.text === \"-\") {\n    const items: YamlValue[] = [];\n    let i = from;\n    while (i < lines.length && lines[i]!.indent === childIndent && (lines[i]!.text.startsWith(\"- \") || lines[i]!.text === \"-\")) {\n      const item = lines[i]!.text.slice(1).trim();\n      i++;\n      // A nested map or sequence inside an item is beyond this reader.\n      if (!item || keyValue(item)) {\n        items.push(UNREADABLE);\n        while (i < lines.length && lines[i]!.indent > childIndent) i++;\n      } else items.push(scalar(item));\n    }\n    return { value: items, next: i };\n  }\n  const map: YamlMap = {};\n  let i = from;\n  while (i < lines.length && lines[i]!.indent >= childIndent) {\n    const line = lines[i]!;\n    if (line.indent > childIndent) {\n      // Over-indented line (a continued plain scalar, or broken YAML): poison the previous key.\n      const keys = Object.keys(map);\n      if (keys.length) map[keys[keys.length - 1]!] = UNREADABLE;\n      i++;\n      continue;\n    }\n    const kv = keyValue(line.text);\n    i++;\n    if (!kv) {\n      map[`\\u0000line${i}`] = UNREADABLE;\n      continue;\n    }\n    if (kv.rest) {\n      map[kv.key] = Object.hasOwn(map, kv.key) ? UNREADABLE : scalar(kv.rest);\n      continue;\n    }\n    const nested = i < lines.length && (lines[i]!.indent > childIndent || (lines[i]!.indent === childIndent && lines[i]!.text.startsWith(\"- \")));\n    if (!nested) {\n      map[kv.key] = null;\n      continue;\n    }\n    const sub = parseLines(lines, i, lines[i]!.indent > childIndent ? childIndent + 1 : childIndent);\n    map[kv.key] = Object.hasOwn(map, kv.key) ? UNREADABLE : sub.value;\n    i = sub.next;\n  }\n  return { value: map, next: i };\n}\n\n/**\n * The `mcp_servers` map of a Hermes config.yaml: server name → its (partly) parsed entry. null when the file has\n * no single readable block (`{}` and an absent key give an empty map).\n */\nexport function readMcpServers(yaml: string): YamlMap | null {\n  return readTopMap(yaml, \"mcp_servers\");\n}\n\n/** A top-level block map (e.g. `platform_toolsets`), read like mcp_servers. */\nexport function readTopMap(yaml: string, key: string): YamlMap | null {\n  const block = topBlock(yaml, key);\n  if (!block) return new RegExp(keyRe(key).source, \"m\").test(yaml) ? null : {};\n  if (block.inline) return block.inline === \"{}\" || block.inline === \"null\" || block.inline === \"~\" ? {} : null;\n  const raw = yaml.replace(/^/, \"\").split(\"\\n\").slice(block.start + 1, block.end);\n  const lines: Line[] = [];\n  for (const l of raw) {\n    const text = stripComment(l);\n    if (!text.trim()) continue;\n    const ws = /^(\\s*)/.exec(text)![1]!;\n    if (ws.includes(\"\\t\")) return null;\n    lines.push({ indent: ws.length, text: text.trim() });\n  }\n  if (!lines.length) return {};\n  const { value } = parseLines(lines, 0, 1);\n  return value && typeof value === \"object\" && !Array.isArray(value) ? (value as YamlMap) : null;\n}\n\nconst escapeRe = (s: string) => s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n\n/**\n * Removes `mcp_servers.<name>` for each name, keeping everything else byte for byte. Returns null when any of\n * them isn't a plain block entry this can cut out safely (then nothing should be written).\n */\n/**\n * Cuts the named entries out of an mcp_servers block body (its lines after `mcp_servers:`), whose entries sit at\n * `indent`. Comment and blank lines met inside a cut entry are held until the next real line decides: a sibling\n * key at `indent` (or less) keeps them with what follows (unless that is cut too), a deeper line means they were\n * part of the cut entry. So a commented-out property (`#    timeout: 120`) or a note (`  # TODO`) inside an entry\n * never ends it early, and none of its lines can end up under a neighbour. null when a layout can't be cut safely.\n */\n/**\n * Whether lines use YAML anchors, aliases or merge keys (`&a`, `*a`, `<<:`) outside quotes and comments. Cutting\n * an entry could then remove an anchor a kept entry still refers to, so those blocks are never rewritten.\n */\nexport function hasAnchors(lines: string[]): boolean {\n  return lines.some((l) => {\n    const t = stripComment(l)\n      .replace(/\"(?:[^\"\\\\]|\\\\.)*\"/g, '\"\"')\n      .replace(/'(?:[^']|'')*'/g, \"''\");\n    return /(^|[\\s:[{,-])[&*][^\\s,\\]}]/.test(t) || /(^|[\\s{,-])<<\\s*:/.test(t);\n  });\n}\n\nexport function cutEntries(body: string[], indent: string, names: string[]): { kept: string[]; found: Set<string> } | null {\n  if (hasAnchors(body)) return null;\n  const isKey = (l: string, name: string) => new RegExp(`^${escapeRe(indent)}([\"']?)${escapeRe(name)}\\\\1\\\\s*:`).test(l);\n  const ind = (l: string) => /^(\\s*)/.exec(l)![1]!.length;\n  const isComment = (l: string) => l.trimStart().startsWith(\"#\");\n  const kept: string[] = [];\n  const found = new Set<string>();\n  let skipping = false;\n  let pending: string[] = [];\n  for (const l of body) {\n    const blank = !l.trim();\n    if (skipping && (blank || isComment(l))) {\n      pending.push(l);\n      continue;\n    }\n    if (blank || isComment(l)) {\n      kept.push(l);\n      continue;\n    }\n    const own = ind(l);\n    if (own < indent.length) return null;\n    if (own > indent.length) {\n      // Part of the current entry: a cut one's held comments go with it.\n      if (skipping) pending = [];\n      else kept.push(l);\n      continue;\n    }\n    // A sibling key: what was held belongs to it.\n    const hit = names.find((n) => isKey(l, n)) ?? null;\n    if (hit) {\n      if (found.has(hit)) return null;\n      found.add(hit);\n      // Only block entries: a flow-style `name: { … }` might span lines we can't see the end of.\n      if (stripComment(l).replace(/^[^:]*:/, \"\").trim()) return null;\n      // Comments right above a cut entry (at its indent or less) were about it: they go with it.\n      pending = [];\n      while (kept.length && isComment(kept[kept.length - 1]!) && ind(kept[kept.length - 1]!) <= indent.length) kept.pop();\n      skipping = true;\n      continue;\n    }\n    if (skipping) kept.push(...pending.filter((x) => !x.trim() || ind(x) <= indent.length));\n    pending = [];\n    skipping = false;\n    kept.push(l);\n  }\n  // Held lines at the end of the block were the cut entry's.\n  return { kept, found };\n}\n\n/**\n * Removes `mcp_servers.<name>` for each name, keeping everything else byte for byte. Returns null when any of\n * them isn't a plain block entry this can cut out safely (then nothing should be written).\n */\nexport function removeYamlServers(yaml: string, names: string[]): string | null {\n  if (!names.length) return yaml;\n  const block = mcpServersBlock(yaml);\n  if (!block || block.inline) return null;\n  const lines = yaml.split(\"\\n\");\n  const body = lines.slice(block.start + 1, block.end);\n  const first = body.find((l) => l.trim() && !l.trimStart().startsWith(\"#\"));\n  if (!first) return null;\n  const indent = /^(\\s*)/.exec(first)![1]!;\n  if (!indent || indent.includes(\"\\t\")) return null;\n  const cut = cutEntries(body, indent, names);\n  if (!cut || cut.found.size !== names.length) return null;\n  const { kept } = cut;\n  const hasChild = kept.some((l) => l.trim() && !l.trimStart().startsWith(\"#\"));\n  const head = hasChild ? lines[block.start]! : \"mcp_servers: {}\";\n  return [...lines.slice(0, block.start), head, ...(hasChild ? kept : kept.filter((l) => l.trim())), ...lines.slice(block.end)].join(\"\\n\");\n}\n","import { spawnSync } from \"node:child_process\";\nimport { chmodSync, existsSync, readFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { AgentTool } from \"../../shared/agent-api.ts\";\nimport { backupFile, isTooOpen, writePrivateFile } from \"./fsutil.ts\";\nimport { claudeServerEntry, helperNodeNote, helperScriptPath } from \"./mcpheader.ts\";\nimport type { Profile } from \"./profile.ts\";\nimport { DEFAULT_PROFILE } from \"./paths.ts\";\nimport { mcpServerName } from \"./recipes.ts\";\nimport { NPX } from \"./version.ts\";\nimport { safeText } from \"./ui.ts\";\nimport { isDeepStrictEqual } from \"node:util\";\nimport { readTomlMcpServers } from \"../connections-cli/toml.ts\";\nimport { cutEntries, hasAnchors, mcpServersBlock, readMcpServers, removeYamlServers } from \"../connections-cli/yaml.ts\";\n\n/**\n * `--setup-mcp`: registers the xaq MCP server in the agent's own tool without the key ever\n * being shown or pasted. Every file we modify is backed up first; the key is redacted from any\n * output we relay.\n */\n\nexport interface McpSetupResult {\n  ok: boolean;\n  /** What happened, safe to print (never contains the key). */\n  message: string;\n  backup?: string | null;\n  /** Manual steps when automatic setup isn't possible. Never contains the key. */\n  manual?: string[];\n  /** Exactly what was (or, in a dry run, would be) changed. Never contains the key. */\n  changes?: string[];\n  /** How to check it worked. */\n  verify?: string[];\n  /** Nothing was changed (--dry-run). */\n  dryRun?: boolean;\n  /** Things to know afterwards, e.g. which Node.js the setup depends on. */\n  notes?: string[];\n  /** `removeServers` entries that were taken out. */\n  removed?: string[];\n}\n\nexport interface McpSetupOptions {\n  /** Print what would change; change nothing. */\n  dryRun?: boolean;\n  /**\n   * Other entries to take out in the same write (`import --from`: servers now served through the broker). For the\n   * file-based tools it's all or nothing: if one can't be removed safely, nothing is changed.\n   */\n  removeServers?: RemoveServer[];\n}\n\nexport interface RemoveServer {\n  name: string;\n  /** Claude Code: the scope it's defined in, and for local/project scope the project directory. */\n  scope?: \"user\" | \"local\" | \"project\";\n  projectDir?: string;\n}\n\n/**\n * The safety net under every rewrite: the new file, read back with the same readers, must hold exactly the old\n * entries minus the removed ones (each unchanged, deep-equal), plus our entry as intended. Anything else means the\n * rewrite moved a line where it doesn't belong (e.g. a header under another server): refuse it. Returns the\n * problem, or null when it's right.\n */\nexport function checkRewrite(\n  before: Record<string, unknown> | null,\n  after: Record<string, unknown> | null,\n  ours: { name: string; entry: unknown },\n  removed: string[],\n): string | null {\n  if (!before || !after) return \"it can't be read back\";\n  // A value the reader couldn't read compares equal to any other unreadable one: that verifies nothing.\n  const opaque = (v: unknown): boolean => typeof v === \"symbol\" || (!!v && typeof v === \"object\" && Object.values(v as Record<string, unknown>).some(opaque));\n  const gone = new Set(removed);\n  for (const [name, entry] of Object.entries(before)) {\n    if (name === ours.name || gone.has(name)) continue;\n    if (!(name in after)) return `\"${name}\" would disappear`;\n    if (opaque(entry) || opaque(after[name])) return `\"${name}\" has a value this can't read, so the result can't be verified`;\n    if (!isDeepStrictEqual(after[name], entry)) return `\"${name}\" would change`;\n  }\n  for (const name of removed) if (name in after) return `\"${name}\" would still be there`;\n  for (const name of Object.keys(after)) if (name !== ours.name && !(name in before)) return `\"${name}\" would appear`;\n  if (!isDeepStrictEqual(after[ours.name], ours.entry)) return `\"${ours.name}\" wouldn't be exactly the new entry`;\n  return null;\n}\n\nconst refused = (file: string, why: string, manual: string[]): McpSetupResult => ({\n  ok: false,\n  message: `Not rewriting ${file}: read back, the result isn't right (${why}). Nothing was changed.`,\n  manual,\n});\n\n/** The entries to remove, never the xaq entry itself. */\nconst removals = (t: McpSetupTarget, opts: McpSetupOptions) => (opts.removeServers ?? []).filter((r) => r.name !== t.name);\nconst removedNote = (extra: RemoveServer[]) => (extra.length ? ` Removed ${extra.map((r) => `\"${r.name}\"`).join(\", \")} (now served through xaq).` : \"\");\nconst removedLine = (name: string, file: string) => `remove ${name} from ${file} (it's now served through xaq)`;\n\n/** Placeholder shown wherever the key would go in printed file contents. */\nconst KEY_SHOWN = \"<the key from your xaq profile>\";\nconst backupLine = (file: string) => (existsSync(file) ? `back up ${file} to ${file}.xaq-backup-<timestamp> (0600)` : `${file} doesn't exist yet: nothing to back up`);\nconst indent = (text: string) =>\n  text\n    .replace(/\\n$/, \"\")\n    .split(\"\\n\")\n    .map((l) => `    ${l}`);\n\nexport interface McpSetupTarget {\n  name: string;\n  url: string;\n  key: string;\n}\n\nconst redact = (s: string, key: string) => s.split(key).join(\"aib_…(redacted)\");\n\n/**\n * The MCP endpoint is always derived from the URL the user connected to (and transport-checked\n * there), never taken from the daemon: a daemon's advertised mcpUrl comes from its publicUrl setting,\n * which defaults to http://localhost:8425 and could also point the key somewhere else entirely.\n */\nexport function mcpTarget(profileName: string, profile: Profile): McpSetupTarget & { profile: string } {\n  return { name: mcpServerName(profileName), url: `${profile.url}/mcp`, key: profile.apiKey, profile: profileName };\n}\n\nexport function setupMcp(tool: AgentTool, t: McpSetupTarget & { profile?: string }, profileFile: string, opts: McpSetupOptions = {}): McpSetupResult {\n  switch (tool) {\n    case \"claude-code\":\n      return setupClaude(t, t.profile ?? \"default\", opts);\n    case \"codex\":\n      return setupCodex(t, profileFile, opts);\n    case \"cursor\":\n      return setupCursor(t, profileFile, opts);\n    case \"hermes\":\n      return setupHermes(t, profileFile, opts);\n    default:\n      return { ok: false, message: \"No automatic MCP setup for --tool other.\", manual: manualGeneric(t, profileFile) };\n  }\n}\n\nfunction manualGeneric(t: McpSetupTarget, profileFile: string): string[] {\n  return [\n    `MCP endpoint (streamable HTTP): ${t.url}`,\n    `Header: Authorization: Bearer <key>. The key is the \"apiKey\" field in ${profileFile}; tools that run a header helper can use \\`${NPX} mcp-header\\`, which prints it as JSON to a pipe.`,\n  ];\n}\n\n// ───────────── Claude Code ─────────────\n\nexport const claudeConfigFile = () => (process.env.CLAUDE_CONFIG_DIR ? join(process.env.CLAUDE_CONFIG_DIR, \".claude.json\") : join(homedir(), \".claude.json\"));\n\nfunction setupClaude(t: McpSetupTarget, profile: string, opts: McpSetupOptions): McpSetupResult {\n  // headersHelper: Claude Code asks our helper for the header at connect time, so the key is never in\n  // argv (visible in `ps`), in ~/.claude.json, or on screen.\n  const json = JSON.stringify(claudeServerEntry(t.url, profile, { install: !opts.dryRun }));\n  const addCommand = `claude mcp add-json --scope user ${t.name} '${json.replace(/'/g, `'\"'\"'`)}'`;\n  const manual = [addCommand];\n  const file = claudeConfigFile();\n  const verify = [`claude mcp list   (shows \"${t.name}\" as connected; inside Claude Code: /mcp)`];\n  // The helper command names a node binary: say which, and how to recover when it goes away.\n  const notes = [helperNodeNote(profile, `${NPX} setup-mcp --tool claude-code${profile === DEFAULT_PROFILE ? \"\" : ` --profile ${profile}`}`)];\n  const removeArgs = removals(t, opts).map((r) => ({ r, args: [\"mcp\", \"remove\", r.name, \"--scope\", r.scope ?? \"user\"], cwd: r.projectDir }));\n  const changes = [\n    `write the header helper ${helperScriptPath()} (0600; reads the key from your profile when Claude Code connects)`,\n    backupLine(file),\n    `run: claude mcp remove ${t.name} --scope user   (drops an earlier \"${t.name}\" entry, if any)`,\n    `run: ${addCommand}`,\n    ...removeArgs.map((x) => `run: claude ${x.args.join(\" \")}${x.cwd ? `   (in ${x.cwd})` : \"\"}   (now served through xaq)`),\n    `the key stays in your xaq profile: neither the command line nor ${file} contains it`,\n  ];\n  if (opts.dryRun) return { ok: true, dryRun: true, message: `Dry run for Claude Code: nothing was changed. setup-mcp would:`, changes, verify, notes };\n  const probe = spawnSync(\"claude\", [\"--version\"], { stdio: \"ignore\" });\n  if (probe.error || probe.status !== 0) return { ok: false, message: \"The `claude` CLI was not found on PATH.\", manual };\n  const backup = backupFile(file);\n  // `add-json` refuses an existing name, so replace it. argv arrays only, and nothing secret in them.\n  spawnSync(\"claude\", [\"mcp\", \"remove\", t.name, \"--scope\", \"user\"], { stdio: \"ignore\" });\n  const r = spawnSync(\"claude\", [\"mcp\", \"add-json\", \"--scope\", \"user\", t.name, json], { encoding: \"utf8\", stdio: [\"ignore\", \"pipe\", \"pipe\"] });\n  if (r.status !== 0) {\n    const out = redact(`${r.stderr ?? \"\"}${r.stdout ?? \"\"}`, t.key).trim();\n    return { ok: false, message: `claude mcp add-json failed${out ? `: ${safeText(out, 300)}` : \"\"}`, backup, manual };\n  }\n  // Only after the broker entry is in: a failed removal leaves a duplicate, never a gap.\n  const done: string[] = [];\n  for (const x of removeArgs) {\n    const rr = spawnSync(\"claude\", x.args, { encoding: \"utf8\", stdio: [\"ignore\", \"pipe\", \"pipe\"], cwd: x.cwd });\n    if (rr.status === 0) done.push(`ran: claude ${x.args.join(\" \")}`);\n    else notes.push(`Couldn't remove \"${x.r.name}\" (${x.r.scope ?? \"user\"} scope): remove it yourself with claude ${x.args.join(\" \")}${x.cwd ? ` in ${x.cwd}` : \"\"}.`);\n  }\n  if (existsSync(file) && isTooOpen(file)) chmodSync(file, 0o600);\n  return {\n    ok: true,\n    message: `Registered MCP server \"${t.name}\" in Claude Code (user scope). The key stays in your xaq profile; Claude Code asks for it through a header helper.`,\n    backup,\n    changes: [`ran: ${addCommand}`, `${file} now lists \"${t.name}\" (user scope)`, ...done],\n    verify,\n    notes,\n    removed: removeArgs.filter((x) => done.includes(`ran: claude ${x.args.join(\" \")}`)).map((x) => x.r.name),\n  };\n}\n\n// ───────────── Codex (~/.codex/config.toml) ─────────────\n\nexport const codexConfigFile = () => join(process.env.CODEX_HOME || join(homedir(), \".codex\"), \"config.toml\");\n\nconst escapeRe = (s: string) => s.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\nconst tomlString = (s: string) => JSON.stringify(s);\n\n/** Removes `[mcp_servers.<name>]` and its sub-tables from a TOML document, or returns null if it's defined in a form we won't rewrite safely. */\nexport function removeTomlServer(toml: string, name: string): string | null {\n  const keyForms = `(?:${escapeRe(name)}|\"${escapeRe(name)}\"|'${escapeRe(name)}')`;\n  const header = new RegExp(`^\\\\s*\\\\[\\\\s*mcp_servers\\\\s*\\\\.\\\\s*${keyForms}\\\\s*(?:\\\\.[^\\\\]]*)?\\\\]\\\\s*(?:#.*)?$`);\n  const anyHeader = /^\\s*\\[/;\n  // Inline or dotted definitions (`mcp_servers = { … }`, `mcp_servers.xaq.url = …`): leave to the human.\n  if (new RegExp(`^\\\\s*mcp_servers\\\\s*(?:=|\\\\.\\\\s*${keyForms}\\\\s*[.=])`, \"m\").test(toml)) return null;\n  const out: string[] = [];\n  let skipping = false;\n  for (const line of toml.split(\"\\n\")) {\n    if (anyHeader.test(line)) skipping = header.test(line);\n    // Our own marker comment sits just above the table: drop it too, so re-running doesn't pile them up.\n    if (!skipping && line.trim() !== CODEX_MARKER && line.trim() !== LEGACY_CODEX_MARKER) out.push(line);\n  }\n  return out.join(\"\\n\").replace(/\\n{3,}/g, \"\\n\\n\");\n}\n\nconst CODEX_MARKER = \"# Added by `xaq setup-mcp`. The key is also in your xaq profile; rotate it in the console.\";\n/** The marker setup-mcp wrote before the rename: dropped too when the table is rewritten. */\nconst LEGACY_CODEX_MARKER = \"# Added by `agentinbox setup-mcp`. The key is also in your agentinbox profile; rotate it in the console.\";\n\nexport function codexBlock(t: McpSetupTarget): string {\n  return [\n    CODEX_MARKER,\n    `[mcp_servers.${t.name}]`,\n    `url = ${tomlString(t.url)}`,\n    `http_headers = { Authorization = ${tomlString(`Bearer ${t.key}`)} }`,\n    `# codex exec never prompts: approve ${t.name} tools up front (the grant's send mode still applies).`,\n    `default_tools_approval_mode = \"approve\"`,\n    \"\",\n  ].join(\"\\n\");\n}\n\nfunction setupCodex(t: McpSetupTarget, profileFile: string, opts: McpSetupOptions): McpSetupResult {\n  const file = codexConfigFile();\n  const manual = [\n    `Add to ${file}:`,\n    `  [mcp_servers.${t.name}]`,\n    `  url = \"${t.url}\"`,\n    `  http_headers = { Authorization = \"Bearer <key>\" }   # <key>: the apiKey field of ${profileFile}`,\n    `  default_tools_approval_mode = \"approve\"`,\n  ];\n  const current = existsSync(file) ? readFileSync(file, \"utf8\") : \"\";\n  const withoutOurs = removeTomlServer(current, t.name);\n  if (withoutOurs === null) return { ok: false, message: `${file} defines mcp_servers inline; not rewriting it automatically.`, manual };\n  let without = withoutOurs;\n  const extra = removals(t, opts);\n  for (const r of extra) {\n    const next = removeTomlServer(without, r.name);\n    if (next === null || next === without) return { ok: false, message: `Couldn't remove [mcp_servers.${r.name}] from ${file} safely; nothing was changed.`, manual };\n    without = next;\n  }\n  const verify = [`codex mcp list   (shows \"${t.name}\")`];\n  const replaces = withoutOurs !== current.replace(/\\n{3,}/g, \"\\n\\n\") ? `replace [mcp_servers.${t.name}] in` : `add [mcp_servers.${t.name}] to`;\n  const changes = [\n    backupLine(file),\n    ...extra.map((r) => removedLine(`[mcp_servers.${r.name}]`, file)),\n    `${replaces} ${file} (other tables are kept) and set the file to 0600, since it will hold the key:`,\n    ...indent(codexBlock({ ...t, key: KEY_SHOWN })),\n  ];\n  const base = without.replace(/\\s*$/, \"\");\n  const next = `${base ? `${base}\\n\\n` : \"\"}${codexBlock(t)}`;\n  const toTable = (x: ReturnType<typeof readTomlMcpServers>) => x as Record<string, unknown>;\n  const problem = checkRewrite(\n    toTable(readTomlMcpServers(current)),\n    toTable(readTomlMcpServers(next)),\n    { name: t.name, entry: { url: t.url, http_headers: { Authorization: `Bearer ${t.key}` }, default_tools_approval_mode: \"approve\" } },\n    extra.map((r) => r.name),\n  );\n  if (problem) return refused(file, problem, manual);\n  if (opts.dryRun) return { ok: true, dryRun: true, message: `Dry run for Codex: nothing was changed. setup-mcp would:`, changes, verify };\n  const backup = backupFile(file);\n  writePrivateFile(file, next, { privateDir: false });\n  return { ok: true, message: `Added [mcp_servers.${t.name}] to ${file} (now mode 0600: it holds the key).${removedNote(extra)}`, backup, verify, removed: extra.map((r) => r.name) };\n}\n\n// ───────────── Cursor (~/.cursor/mcp.json) ─────────────\n\nexport const cursorConfigFile = () => join(homedir(), \".cursor\", \"mcp.json\");\n\nfunction setupCursor(t: McpSetupTarget, profileFile: string, opts: McpSetupOptions): McpSetupResult {\n  const file = cursorConfigFile();\n  const manual = [\n    `Add to ${file} under \"mcpServers\":`,\n    `  \"${t.name}\": { \"url\": \"${t.url}\", \"headers\": { \"Authorization\": \"Bearer <key>\" } }   // <key>: the apiKey field of ${profileFile}`,\n  ];\n  let doc: Record<string, unknown> = {};\n  if (existsSync(file)) {\n    const text = readFileSync(file, \"utf8\");\n    if (text.trim()) {\n      try {\n        doc = JSON.parse(text) as Record<string, unknown>;\n      } catch {\n        return { ok: false, message: `${file} is not plain JSON (comments?); not rewriting it automatically.`, manual };\n      }\n      if (!doc || typeof doc !== \"object\" || Array.isArray(doc)) return { ok: false, message: `${file} is not a JSON object.`, manual };\n    }\n  }\n  const servers = doc.mcpServers && typeof doc.mcpServers === \"object\" && !Array.isArray(doc.mcpServers) ? (doc.mcpServers as Record<string, unknown>) : {};\n  const verify = [`agent mcp list   (Cursor CLI; or Cursor Settings → MCP shows \"${t.name}\")`];\n  const entry = (key: string) => ({ url: t.url, headers: { Authorization: `Bearer ${key}` } });\n  const extra = removals(t, opts);\n  const absent = extra.find((r) => !(r.name in servers));\n  if (absent) return { ok: false, message: `\"mcpServers.${absent.name}\" isn't in ${file}; nothing was changed.`, manual };\n  const changes = [\n    backupLine(file),\n    ...extra.map((r) => removedLine(`\"mcpServers.${r.name}\"`, file)),\n    `${t.name in servers ? \"replace\" : \"add\"} \"mcpServers.${t.name}\" ${t.name in servers ? \"in\" : \"to\"} ${file} (other servers are kept) and set the file to 0600, since it will hold the key:`,\n    ...indent(`\"${t.name}\": ${JSON.stringify(entry(KEY_SHOWN), null, 2)}`),\n  ];\n  if (opts.dryRun) return { ok: true, dryRun: true, message: `Dry run for Cursor: nothing was changed. setup-mcp would:`, changes, verify };\n  const before = structuredClone(servers);\n  for (const r of extra) delete servers[r.name];\n  servers[t.name] = entry(t.key);\n  doc.mcpServers = servers;\n  const reread = (JSON.parse(JSON.stringify(doc)) as { mcpServers: Record<string, unknown> }).mcpServers;\n  const problem = checkRewrite(before, reread, { name: t.name, entry: entry(t.key) }, extra.map((r) => r.name));\n  if (problem) return refused(file, problem, manual);\n  const backup = backupFile(file);\n  writePrivateFile(file, JSON.stringify(doc, null, 2) + \"\\n\", { privateDir: false });\n  return {\n    ok: true,\n    message: `Added \"${t.name}\" to ${file} (now mode 0600: it holds the key).${removedNote(extra)} Cursor may ask you to enable it once.`,\n    backup,\n    verify,\n    removed: extra.map((r) => r.name),\n  };\n}\n\n// ───────────── Hermes (~/.hermes/config.yaml + ~/.hermes/.env) ─────────────\n\n/**\n * The Hermes home a bare `hermes` uses (hermes_constants.py / hermes_cli/profiles.py): $HERMES_HOME, else\n * ~/.hermes (plus HERMES_DATA_DIR_SUFFIX), switched to profiles/<name> by the sticky `active_profile` file.\n * Commands xaq runs get HERMES_HOME set to this, so they edit the same files.\n */\nexport function hermesHome(env: NodeJS.ProcessEnv = process.env): string {\n  const set = env.HERMES_HOME?.trim();\n  if (set) return set.replace(/^~(?=\\/|$)/, homedir());\n  const root = join(homedir(), `.hermes${env.HERMES_DATA_DIR_SUFFIX ?? \"\"}`);\n  let active = \"\";\n  try {\n    active = readFileSync(join(root, \"active_profile\"), \"utf8\").replace(/^\\uFEFF/, \"\").trim().toLowerCase();\n  } catch {\n    // No sticky profile.\n  }\n  return active && active !== \"default\" && /^[a-z0-9][a-z0-9_-]*$/.test(active) ? join(root, \"profiles\", active) : root;\n}\n\n/**\n * Whether `mcp_servers.<name>` is on in a Hermes config.yaml (\"enabled\" absent, null or not a false word\n * is on, like Hermes' mcp_server_enabled). \"unknown\" for layouts this small block-YAML reader won't judge:\n * callers that need it on treat that as not on.\n */\nexport function yamlMcpServerState(yaml: string, name: string): \"enabled\" | \"disabled\" | \"missing\" | \"unknown\" {\n  const lines = yaml.replace(/^\\uFEFF/, \"\").split(\"\\n\");\n  const tops = lines.flatMap((l, i) => (/^mcp_servers\\s*:/.test(l) ? [i] : []));\n  if (tops.length === 0) return \"missing\";\n  if (tops.length > 1) return \"unknown\";\n  const top = tops[0]!;\n  const rest = lines[top]!.replace(/^mcp_servers\\s*:/, \"\").replace(/\\s#.*$/, \"\").trim();\n  if (rest) return rest === \"{}\" || rest === \"null\" || rest === \"~\" ? \"missing\" : \"unknown\";\n  let end = top + 1;\n  while (end < lines.length && (lines[end]!.trim() === \"\" || /^\\s/.test(lines[end]!) || lines[end]!.startsWith(\"#\"))) end++;\n  const body = lines.slice(top + 1, end).filter((l) => l.trim() && !l.trimStart().startsWith(\"#\"));\n  if (!body.length) return \"missing\";\n  const indent = body[0]!.match(/^(\\s*)/)![1]!;\n  if (!indent || /\\t/.test(indent) || body.some((l) => /[&*]|<</.test(l.split(\"#\")[0]!))) return \"unknown\";\n  const key = new RegExp(`^${indent}([\"']?)${name.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}\\\\1\\\\s*:(.*)$`);\n  const starts = body.flatMap((l, i) => (key.test(l) ? [i] : []));\n  if (starts.length === 0) return \"missing\";\n  if (starts.length > 1) return \"unknown\";\n  const inline = key.exec(body[starts[0]!]!)![2]!.replace(/\\s#.*$/, \"\").trim();\n  if (inline) return \"unknown\"; // flow style ({ url: … })\n  const own: string[] = [];\n  for (const l of body.slice(starts[0]! + 1)) {\n    if (l.match(/^(\\s*)/)![1]!.length <= indent.length) break;\n    own.push(l);\n  }\n  if (!own.length) return \"unknown\";\n  const childIndent = own[0]!.match(/^(\\s*)/)![1]!.length;\n  const enabled = own.filter((l) => l.match(/^(\\s*)/)![1]!.length === childIndent && /^\\s*[\"']?enabled[\"']?\\s*:/.test(l));\n  if (enabled.length > 1) return \"unknown\";\n  if (!enabled.length) return \"enabled\";\n  const value = enabled[0]!.replace(/^\\s*[\"']?enabled[\"']?\\s*:/, \"\").replace(/\\s#.*$/, \"\").trim().replace(/^[\"']|[\"']$/g, \"\").toLowerCase();\n  return [\"false\", \"0\", \"no\", \"off\"].includes(value) ? \"disabled\" : \"enabled\";\n}\nexport const hermesEnvVar = (name: string) => name.toUpperCase().replace(/[^A-Z0-9]/g, \"_\") + \"_API_KEY\";\n\n/**\n * Inserts or replaces `mcp_servers.<name>` in a YAML document without a YAML library, handling the\n * common block-style layout. Returns null for anything unusual (flow style, anchors, odd indentation).\n */\nexport function upsertYamlServer(yaml: string, name: string, entry: string[]): string | null {\n  const lines = yaml.split(\"\\n\");\n  const top = lines.findIndex((l) => /^mcp_servers\\s*:/.test(l));\n  const block = (indent: string) => [`${indent}${name}:`, ...entry.map((e) => `${indent}${indent}${e}`)];\n  if (top < 0) {\n    const base = yaml.replace(/\\s*$/, \"\");\n    return `${base ? `${base}\\n\\n` : \"\"}mcp_servers:\\n${block(\"  \").join(\"\\n\")}\\n`;\n  }\n  const rest = lines[top]!.replace(/^mcp_servers\\s*:/, \"\").replace(/#.*$/, \"\").trim();\n  if (rest && rest !== \"{}\" && rest !== \"null\" && rest !== \"~\") return null;\n  if (rest) lines[top] = \"mcp_servers:\";\n  // The block runs until the next non-blank line at column 0.\n  let end = top + 1;\n  while (end < lines.length && (lines[end]!.trim() === \"\" || /^\\s/.test(lines[end]!))) end++;\n  const body = lines.slice(top + 1, end);\n  const firstChild = body.find((l) => l.trim() && !l.trimStart().startsWith(\"#\"));\n  const indent = firstChild ? firstChild.match(/^(\\s*)/)![1]! : \"  \";\n  if (!indent || /\\t/.test(indent)) return null;\n  // Comments inside the old entry never end it early (cutEntries), so none of its lines can land elsewhere.\n  const cut = cutEntries(body, indent, [name]);\n  if (!cut) return null;\n  const { kept } = cut;\n  const insert = block(indent);\n  return [...lines.slice(0, top + 1), ...insert, ...kept, ...lines.slice(end)].join(\"\\n\");\n}\n\nfunction upsertEnvLine(text: string, key: string, value: string): string {\n  const line = `${key}=${value}`;\n  const re = new RegExp(`^\\\\s*(?:export\\\\s+)?${escapeRe(key)}\\\\s*=.*$`, \"m\");\n  if (re.test(text)) return text.replace(re, line);\n  const base = text.replace(/\\s*$/, \"\");\n  return `${base ? `${base}\\n` : \"\"}${line}\\n`;\n}\n\nfunction setupHermes(t: McpSetupTarget, profileFile: string, opts: McpSetupOptions): McpSetupResult {\n  const home = hermesHome();\n  const configFile = join(home, \"config.yaml\");\n  const envFile = join(home, \".env\");\n  const envVar = hermesEnvVar(t.name);\n  const entry = [`url: ${JSON.stringify(t.url)}`, `headers:`, `  Authorization: \"Bearer \\${${envVar}}\"`];\n  const manual = [\n    `Add to ${configFile}:`,\n    `  mcp_servers:`,\n    `    ${t.name}:`,\n    ...entry.map((e) => `      ${e}`),\n    `and to ${envFile}:  ${envVar}=<key>   (<key>: the apiKey field of ${profileFile})`,\n    `then check it with: hermes mcp test ${t.name}`,\n  ];\n  const current = existsSync(configFile) ? readFileSync(configFile, \"utf8\") : \"\";\n  const extra = removals(t, opts);\n  const blk = mcpServersBlock(current);\n  if (blk && hasAnchors(current.split(\"\\n\").slice(blk.start + 1, blk.end))) {\n    return {\n      ok: false,\n      message: `${configFile} uses YAML anchors, aliases or merge keys (&, *, <<) under mcp_servers; not rewriting it automatically. Nothing was changed.`,\n      manual,\n    };\n  }\n  const upserted = upsertYamlServer(current, t.name, entry);\n  // Removed in the same write, before anything touches the disk: one entry we can't cut out cleanly changes nothing.\n  const next = upserted === null ? null : removeYamlServers(upserted, extra.map((r) => r.name));\n  if (upserted !== null && next === null) {\n    return { ok: false, message: `Couldn't remove ${extra.map((r) => `\"${r.name}\"`).join(\", \")} from ${configFile} safely; nothing was changed.`, manual };\n  }\n  if (next === null) return { ok: false, message: `${configFile} uses a layout we won't rewrite automatically.`, manual };\n  {\n    const ours = { url: t.url, headers: { Authorization: `Bearer \\${${envVar}}` } };\n    const problem = checkRewrite(readMcpServers(current), readMcpServers(next), { name: t.name, entry: ours }, extra.map((r) => r.name));\n    if (problem) return refused(configFile, problem, manual);\n  }\n  const verify = [`hermes mcp test ${t.name}`];\n  const changes = [\n    backupLine(configFile),\n    backupLine(envFile),\n    ...extra.map((r) => removedLine(`\"mcp_servers.${r.name}\"`, configFile)),\n    `add (or replace) \"mcp_servers.${t.name}\" in ${configFile} (0600):`,\n    ...indent([\"mcp_servers:\", `  ${t.name}:`, ...entry.map((e) => `    ${e}`)].join(\"\\n\")),\n    `set ${envVar}=${KEY_SHOWN} in ${envFile} (0600; Hermes' place for secrets)`,\n  ];\n  if (opts.dryRun) return { ok: true, dryRun: true, message: `Dry run for Hermes: nothing was changed. setup-mcp would:`, changes, verify };\n  const envCurrent = existsSync(envFile) ? readFileSync(envFile, \"utf8\") : \"\";\n  const backup = backupFile(configFile);\n  const envBackup = backupFile(envFile);\n  writePrivateFile(envFile, upsertEnvLine(envCurrent, envVar, t.key), { privateDir: false });\n  writePrivateFile(configFile, next.endsWith(\"\\n\") ? next : `${next}\\n`, { privateDir: false });\n  return {\n    ok: true,\n    message: `Added \"${t.name}\" to ${configFile}; the key is in ${envFile} as ${envVar} (0600).${removedNote(extra)}`,\n    backup: [backup, envBackup].filter(Boolean).join(\", \") || null,\n    verify,\n    removed: extra.map((r) => r.name),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAOA,MAAaA,eAAa,OAAO,YAAY;AAI7C,IAAM,SAAN,MAAa;CAEU;CADrB,IAAI;CACJ,YAAY,GAAoB;EAAX,KAAA,IAAA;CAAY;CACjC,KAAW;EACT,OAAO,KAAK,IAAI,KAAK,EAAE,UAAU,QAAQ,KAAK,KAAK,EAAE,KAAK,EAAG,GAAG,KAAK;CACvE;;CAEA,QAAc;EACZ,SAAS;GACP,OAAO,KAAK,IAAI,KAAK,EAAE,UAAU,YAAY,KAAK,KAAK,EAAE,KAAK,EAAG,GAAG,KAAK;GACzE,IAAI,KAAK,EAAE,KAAK,OAAO,KAAK;GAC5B,OAAO,KAAK,IAAI,KAAK,EAAE,UAAU,KAAK,EAAE,KAAK,OAAO,MAAM,KAAK;EACjE;CACF;CACA,OAA2B;EACzB,OAAO,KAAK,EAAE,KAAK;CACrB;CACA,OAAgB;EACd,OAAO,KAAK,KAAK,KAAK,EAAE;CAC1B;AACF;AAEA,IAAM,aAAN,cAAyB,MAAM,CAAC;AAEhC,MAAM,UAAkC;CAAE,GAAG;CAAM,GAAG;CAAM,GAAG;CAAM,GAAG;CAAM,GAAG;CAAM,MAAK;CAAK,MAAM;CAAM,GAAG;AAAO;AAEvH,SAAS,WAAW,GAAmB;CACrC,MAAM,IAAI,EAAE,KAAK;CACjB,IAAI,EAAE,EAAE,WAAW,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,GAAG,MAAM,IAAI,WAAW,mBAAmB;CACjF,EAAE;CACF,IAAI,MAAM;CACV,OAAO,CAAC,EAAE,KAAK,GAAG;EAChB,MAAM,KAAK,EAAE,EAAE,EAAE;EACjB,IAAI,OAAO,MAAM;EACjB,IAAI,OAAO,GAAG,OAAO;EACrB,IAAI,MAAM,QAAO,OAAO,MAAM;GAC5B,MAAM,IAAI,EAAE,EAAE,EAAE;GAChB,IAAI,QAAQ,OAAO,KAAA,GAAW,OAAO,QAAQ;QACxC,IAAI,MAAM,OAAO,MAAM,KAAK;IAC/B,MAAM,MAAM,MAAM,MAAM,IAAI;IAC5B,MAAM,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG;IACpC,IAAI,CAAC,iBAAiB,KAAK,GAAG,KAAK,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,YAAY;IACxF,OAAO,OAAO,cAAc,OAAO,SAAS,KAAK,EAAE,CAAC;IACpD,EAAE,KAAK;GACT,OAAO,MAAM,IAAI,WAAW,YAAY;EAC1C,OAAO,OAAO;CAChB;CACA,MAAM,IAAI,WAAW,qBAAqB;AAC5C;AAEA,SAAS,QAAQ,GAAqB;CACpC,MAAM,QAAkB,CAAC;CACzB,SAAS;EACP,EAAE,GAAG;EACL,MAAM,KAAK,EAAE,KAAK;EAClB,IAAI,OAAO,QAAO,OAAO,KAAK,MAAM,KAAK,WAAW,CAAC,CAAC;OACjD;GACH,MAAM,IAAI,kBAAkB,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;GAC/C,IAAI,CAAC,GAAG,MAAM,IAAI,WAAW,SAAS;GACtC,MAAM,KAAK,EAAE,EAAE;GACf,EAAE,KAAK,EAAE,EAAE,CAAC;EACd;EACA,EAAE,GAAG;EACL,IAAI,EAAE,KAAK,MAAM,KAAK,OAAO;EAC7B,EAAE;CACJ;AACF;AAEA,SAAS,UAAU,GAAW,WAA+B;CAC3D,MAAM,KAAK,EAAE,KAAK;CAClB,IAAI,OAAO,QAAO,OAAO,KAAK,OAAO,WAAW,CAAC;CACjD,IAAI,OAAO,KAAK;EACd,EAAE;EACF,MAAM,QAAqB,CAAC;EAC5B,SAAS;GACP,IAAI,WAAW,EAAE,MAAM;QAClB,EAAE,GAAG;GACV,IAAI,EAAE,KAAK,MAAM,KAAK;IACpB,EAAE;IACF,OAAO;GACT;GACA,MAAM,KAAK,UAAU,GAAG,SAAS,CAAC;GAClC,IAAI,WAAW,EAAE,MAAM;QAClB,EAAE,GAAG;GACV,IAAI,EAAE,KAAK,MAAM,KAAK,EAAE;QACnB,IAAI,EAAE,KAAK,MAAM,KAAK,MAAM,IAAI,WAAW,WAAW;EAC7D;CACF;CACA,IAAI,OAAO,KAAK;EACd,EAAE;EACF,MAAM,QAAmB,CAAC;EAC1B,EAAE,GAAG;EACL,IAAI,EAAE,KAAK,MAAM,KAAK;GACpB,EAAE;GACF,OAAO;EACT;EACA,SAAS;GACP,MAAM,MAAM,QAAQ,CAAC;GACrB,IAAI,EAAE,KAAK,MAAM,KAAK,MAAM,IAAI,WAAW,kBAAkB;GAC7D,EAAE;GACF,EAAE,GAAG;GACL,QAAQ,OAAO,KAAK,UAAU,GAAG,KAAK,CAAC;GACvC,EAAE,GAAG;GACL,IAAI,EAAE,KAAK,MAAM,KAAK;IACpB,EAAE;IACF;GACF;GACA,IAAI,EAAE,KAAK,MAAM,KAAK;IACpB,EAAE;IACF,OAAO;GACT;GACA,MAAM,IAAI,WAAW,kBAAkB;EACzC;CACF;CACA,MAAM,IAAI,eAAe,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;CAC5C,IAAI,CAAC,GAAG,MAAM,IAAI,WAAW,eAAe;CAC5C,EAAE,KAAK,EAAE,EAAE,CAAC;CACZ,IAAI,EAAE,OAAO,QAAQ,OAAO;CAC5B,IAAI,EAAE,OAAO,SAAS,OAAO;CAC7B,MAAM,IAAI,EAAE,EAAE,CAAC,QAAQ,MAAM,EAAE;CAC/B,IAAI,sEAAsE,KAAK,CAAC,GAAG,OAAO,OAAO,CAAC;CAClG,MAAM,IAAI,WAAW,mBAAmB;AAC1C;AAEA,SAAS,QAAQ,OAAkB,MAAgB,OAAwB;CACzE,IAAI,IAAI;CACR,KAAK,MAAM,KAAK,KAAK,MAAM,GAAG,EAAE,GAAG;EACjC,MAAM,OAAO,EAAE;EACf,IAAI,SAAS,KAAA,GAAW,IAAI,EAAE,KAAK,CAAC;OAC/B,IAAI,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG,IAAI;OAC1D,MAAM,IAAI,WAAW,eAAe;CAC3C;CACA,MAAM,OAAO,KAAK,KAAK,SAAS;CAChC,IAAI,OAAO,OAAO,GAAG,IAAI,GAAG,MAAM,IAAI,WAAW,eAAe;CAChE,EAAE,QAAQ;AACZ;AAEA,SAAS,QAAQ,MAAiB,MAA2B;CAC3D,IAAI,IAAI;CACR,KAAK,MAAM,KAAK,MAAM;EACpB,MAAM,OAAO,EAAE;EACf,IAAI,SAAS,KAAA,GAAW,IAAI,EAAE,KAAK,CAAC;OAC/B,IAAI,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG,IAAI;OAC1D,MAAM,IAAI,WAAW,iBAAiB;CAC7C;CACA,OAAO;AACT;;;;;AAMA,SAAgB,mBAAmB,MAAiE;CAClG,MAAM,OAAkB,CAAC;CACzB,MAAM,sBAAM,IAAI,IAAY;CAC5B,IAAI,UAAoB,CAAC;CACzB,MAAM,QAAQ,KAAK,QAAQ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI;CAC/C,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,MAAM,OAAO,MAAM;EACnB,MAAM,UAAU,KAAK,KAAK;EAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,GAAG;EACzC,IAAI,QAAQ,WAAW,IAAI,GAAG;GAC5B,MAAM,IAAI,IAAI,OAAO,QAAQ,MAAM,CAAC,CAAC;GACrC,IAAI;IACF,UAAU,CAAC,WAAe,GAAG,QAAQ,CAAC,CAAC;GACzC,QAAQ;IACN,UAAU,CAAC,SAAa;GAC1B;GACA,IAAI,QAAQ,OAAO,iBAAiB,QAAQ,IAAI,IAAI,IAAI,QAAQ,EAAE;GAClE;EACF;EACA,IAAI,QAAQ,WAAW,GAAG,GAAG;GAC3B,MAAM,IAAI,IAAI,OAAO,QAAQ,MAAM,CAAC,CAAC;GACrC,IAAI;IACF,UAAU,QAAQ,CAAC;IACnB,IAAI,EAAE,KAAK,MAAM,KAAK,MAAM,IAAI,WAAW,YAAY;IACvD,IAAI,QAAQ,OAAO,eAAe,QAAQ,MAAM,OAAO;GACzD,QAAQ;IACN,UAAU,CAAC,OAAW;GACxB;GACA;EACF;EACA,IAAI,QAAQ,OAAO,iBAAiB,CAAC,yBAAyB,KAAK,IAAI,GAAG;EAE1E,IAAI,OAAO;EACX,IAAI,WAAW;EACf,IAAI,SAAqD;EACzD,SAAS;GACP,MAAM,IAAI,IAAI,OAAO,IAAI;GACzB,IAAI;IACF,MAAM,MAAM,QAAQ,CAAC;IACrB,IAAI,EAAE,KAAK,MAAM,KAAK,MAAM,IAAI,WAAW,WAAW;IACtD,EAAE;IACF,EAAE,GAAG;IACL,MAAM,QAAQ,UAAU,GAAG,IAAI;IAC/B,EAAE,GAAG;IACL,IAAI,CAAC,EAAE,KAAK,KAAK,EAAE,KAAK,MAAM,KAAK,MAAM,IAAI,WAAW,qBAAqB;IAC7E,SAAS;KAAE;KAAK;IAAM;IACtB;GACF,QAAQ;IAEN,IAAI,GADU,KAAK,MAAM,KAAK,KAAK,CAAC,EAAA,CAAG,UAAU,KAAK,MAAM,IAAI,KAAK,CAAC,EAAA,CAAG,WAC5D,WAAW,KAAK,MAAM,QAAQ;IAC3C,QAAQ,KAAK,MAAM,EAAE;GACvB;EACF;EACA,IAAI;EACJ,MAAM,OAAO,SAAS,CAAC,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI;EACpD,MAAM,SAAS,KAAK,OAAO,gBAAgB,KAAK,KAAK,QAAQ;EAC7D,IAAI,CAAC,QAAQ;GACX,IAAI,QAAQ,IAAI,IAAI,MAAM;GAC1B;EACF;EACA,IAAI;GACF,QAAQ,MAAM,MAAM,OAAO,KAAK;EAClC,QAAQ;GACN,IAAI,QAAQ,IAAI,IAAI,MAAM;EAC5B;CACF;CACA,MAAM,UAAU,KAAK;CACrB,MAAM,MAAyD,CAAC;CAChE,IAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,GAClE,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAoB,GAC7D,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,IAAIA,eAAc;CAG7G,KAAK,MAAM,QAAQ,KAAK,IAAI,QAAQA;CACpC,OAAO;AACT;;;;;;;;;;ACtOA,MAAa,aAAa,OAAO,YAAY;;AAU7C,SAAgB,aAAa,MAAsB;CACjD,IAAI,QAAuB;CAC3B,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,KAAK,KAAK;EAChB,IAAI,OAAO;GACT,IAAI,OAAO,QAAQ,UAAU,MAAK;QAC7B,IAAI,OAAO,OAAO,QAAQ;EACjC,OAAO,IAAI,OAAO,QAAO,OAAO,KAC1B;OAAA,MAAM,KAAK,YAAY,KAAK,KAAK,IAAI,EAAG,GAAG,QAAQ;EAAA,OAClD,IAAI,OAAO,QAAQ,MAAM,KAAK,KAAK,KAAK,KAAK,IAAI,EAAG,IAAI,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ;CACjG;CACA,OAAO,KAAK,QAAQ;AACtB;;AAGA,SAAgB,gBAAgB,MAAqE;CACnG,OAAO,SAAS,MAAM,aAAa;AACrC;AAEA,MAAM,SAAS,QAAgB,IAAI,OAAO,IAAI,IAAI,QAAQ,uBAAuB,MAAM,EAAE,MAAM;;AAG/F,SAAgB,SAAS,MAAc,KAAoE;CACzG,MAAM,KAAK,MAAM,GAAG;CACpB,MAAM,QAAQ,KAAK,QAAQ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI;CAC/C,MAAM,OAAO,MAAM,SAAS,GAAG,MAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAE;CAC5D,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,MAAM,QAAQ,KAAK;CACnB,IAAI,MAAM,QAAQ;CAClB,OAAO,MAAM,MAAM,WAAW,MAAM,IAAI,CAAE,KAAK,MAAM,MAAM,MAAM,KAAK,MAAM,IAAK,KAAK,MAAM,IAAI,CAAE,WAAW,GAAG,IAAI;CAEpH,OAAO,MAAM,QAAQ,MAAM,MAAM,MAAM,EAAE,CAAE,KAAK,MAAM,MAAM,MAAM,MAAM,EAAE,CAAE,WAAW,GAAG,IAAI;CAC9F,OAAO;EAAE;EAAO;EAAK,QAAQ,aAAa,MAAM,MAAM,CAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK;CAAE;AAClF;AAEA,SAAS,QAAQ,KAAyC;CACxD,IAAI,IAAI,WAAW,IAAG,GAAG;EACvB,IAAI,CAAC,IAAI,SAAS,IAAG,KAAK,IAAI,SAAS,GAAG,OAAO;EACjD,IAAI;GAEF,OAAO,KAAK,MAAM,IAAI,QAAQ,SAAS,GAAG,CAAC;EAC7C,QAAQ;GACN,OAAO;EACT;CACF;CACA,IAAI,IAAI,WAAW,GAAG,GAAG;EACvB,IAAI,CAAC,IAAI,SAAS,GAAG,KAAK,IAAI,SAAS,GAAG,OAAO;EACjD,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,OAAO,GAAG;CAC5C;CACA,OAAO;AACT;;AAGA,SAAS,UAAU,MAA+B;CAChD,MAAM,MAAgB,CAAC;CACvB,IAAI,MAAM;CACV,IAAI,QAAuB;CAC3B,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,KAAK,KAAK;EAChB,IAAI,OAAO;GACT,OAAO;GACP,IAAI,OAAO,QAAQ,UAAU,MAAK,OAAO,KAAK,EAAE,MAAM;QACjD,IAAI,OAAO,OAAO,QAAQ;EACjC,OAAO,IAAI,OAAO,QAAO,OAAO,KAAK;GACnC,QAAQ;GACR,OAAO;EACT,OAAO,IAAI,OAAO,OAAO,OAAO,OAAO,OAAO,OAAO,OAAO,KAAK,OAAO;OACnE,IAAI,OAAO,KAAK;GACnB,IAAI,KAAK,IAAI,KAAK,CAAC;GACnB,MAAM;EACR,OAAO,OAAO;CAChB;CACA,IAAI,OAAO,OAAO;CAClB,IAAI,IAAI,KAAK,GAAG,IAAI,KAAK,IAAI,KAAK,CAAC;CACnC,OAAO;AACT;AAEA,SAAgB,OAAO,KAAwB;CAC7C,MAAM,IAAI,IAAI,KAAK;CACnB,IAAI,MAAM,MAAM,MAAM,OAAO,MAAM,UAAU,MAAM,UAAU,MAAM,QAAQ,OAAO;CAClF,IAAI,WAAW,KAAK,CAAC,KAAK,EAAE,WAAW,IAAI,KAAK,EAAE,WAAW,GAAG,GAAG,OAAO;CAC1E,IAAI,EAAE,WAAW,GAAG,GAAG;EACrB,IAAI,CAAC,EAAE,SAAS,GAAG,GAAG,OAAO;EAC7B,MAAM,QAAQ,UAAU,EAAE,MAAM,GAAG,EAAE,CAAC;EACtC,OAAO,QAAQ,MAAM,KAAK,MAAM,OAAO,CAAC,CAAC,IAAI;CAC/C;CACA,IAAI,EAAE,WAAW,IAAG,KAAK,EAAE,WAAW,GAAG,GAAG,OAAO,QAAQ,CAAC;CAC5D,IAAI,qBAAqB,KAAK,CAAC,GAAG,OAAO;CACzC,IAAI,wBAAwB,KAAK,CAAC,GAAG,OAAO;CAC5C,IAAI,qBAAqB,KAAK,CAAC,GAAG,OAAO,OAAO,CAAC;CACjD,OAAO;AACT;;AAGA,SAAS,SAAS,MAAoD;CACpE,MAAM,IAAI,uEAAuE,KAAK,IAAI;CAC1F,IAAI,CAAC,GAAG,OAAO;CACf,MAAM,MAAM,QAAQ,EAAE,EAAG;CACzB,IAAI,QAAQ,YAAY,OAAO;CAC/B,OAAO;EAAE;EAAK,OAAO,EAAE,MAAM,GAAA,CAAI,KAAK;CAAE;AAC1C;AAEA,SAAS,WAAW,OAAe,MAAc,QAAoD;CACnG,MAAM,QAAQ,MAAM;CACpB,IAAI,CAAC,SAAS,MAAM,SAAS,QAAQ,OAAO;EAAE,OAAO;EAAM,MAAM;CAAK;CACtE,MAAM,cAAc,MAAM;CAC1B,IAAI,MAAM,KAAK,WAAW,IAAI,KAAK,MAAM,SAAS,KAAK;EACrD,MAAM,QAAqB,CAAC;EAC5B,IAAI,IAAI;EACR,OAAO,IAAI,MAAM,UAAU,MAAM,EAAE,CAAE,WAAW,gBAAgB,MAAM,EAAE,CAAE,KAAK,WAAW,IAAI,KAAK,MAAM,EAAE,CAAE,SAAS,MAAM;GAC1H,MAAM,OAAO,MAAM,EAAE,CAAE,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK;GAC1C;GAEA,IAAI,CAAC,QAAQ,SAAS,IAAI,GAAG;IAC3B,MAAM,KAAK,UAAU;IACrB,OAAO,IAAI,MAAM,UAAU,MAAM,EAAE,CAAE,SAAS,aAAa;GAC7D,OAAO,MAAM,KAAK,OAAO,IAAI,CAAC;EAChC;EACA,OAAO;GAAE,OAAO;GAAO,MAAM;EAAE;CACjC;CACA,MAAM,MAAe,CAAC;CACtB,IAAI,IAAI;CACR,OAAO,IAAI,MAAM,UAAU,MAAM,EAAE,CAAE,UAAU,aAAa;EAC1D,MAAM,OAAO,MAAM;EACnB,IAAI,KAAK,SAAS,aAAa;GAE7B,MAAM,OAAO,OAAO,KAAK,GAAG;GAC5B,IAAI,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,MAAO;GAC/C;GACA;EACF;EACA,MAAM,KAAK,SAAS,KAAK,IAAI;EAC7B;EACA,IAAI,CAAC,IAAI;GACP,IAAI,aAAa,OAAO;GACxB;EACF;EACA,IAAI,GAAG,MAAM;GACX,IAAI,GAAG,OAAO,OAAO,OAAO,KAAK,GAAG,GAAG,IAAI,aAAa,OAAO,GAAG,IAAI;GACtE;EACF;EAEA,IAAI,EADW,IAAI,MAAM,WAAW,MAAM,EAAE,CAAE,SAAS,eAAgB,MAAM,EAAE,CAAE,WAAW,eAAe,MAAM,EAAE,CAAE,KAAK,WAAW,IAAI,KAC5H;GACX,IAAI,GAAG,OAAO;GACd;EACF;EACA,MAAM,MAAM,WAAW,OAAO,GAAG,MAAM,EAAE,CAAE,SAAS,cAAc,cAAc,IAAI,WAAW;EAC/F,IAAI,GAAG,OAAO,OAAO,OAAO,KAAK,GAAG,GAAG,IAAI,aAAa,IAAI;EAC5D,IAAI,IAAI;CACV;CACA,OAAO;EAAE,OAAO;EAAK,MAAM;CAAE;AAC/B;;;;;AAMA,SAAgB,eAAe,MAA8B;CAC3D,OAAO,WAAW,MAAM,aAAa;AACvC;;AAGA,SAAgB,WAAW,MAAc,KAA6B;CACpE,MAAM,QAAQ,SAAS,MAAM,GAAG;CAChC,IAAI,CAAC,OAAO,OAAO,IAAI,OAAO,MAAM,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC;CAC3E,IAAI,MAAM,QAAQ,OAAO,MAAM,WAAW,QAAQ,MAAM,WAAW,UAAU,MAAM,WAAW,MAAM,CAAC,IAAI;CACzG,MAAM,MAAM,KAAK,QAAQ,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;CAC/E,MAAM,QAAgB,CAAC;CACvB,KAAK,MAAM,KAAK,KAAK;EACnB,MAAM,OAAO,aAAa,CAAC;EAC3B,IAAI,CAAC,KAAK,KAAK,GAAG;EAClB,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC,CAAE;EAChC,IAAI,GAAG,SAAS,GAAI,GAAG,OAAO;EAC9B,MAAM,KAAK;GAAE,QAAQ,GAAG;GAAQ,MAAM,KAAK,KAAK;EAAE,CAAC;CACrD;CACA,IAAI,CAAC,MAAM,QAAQ,OAAO,CAAC;CAC3B,MAAM,EAAE,UAAU,WAAW,OAAO,GAAG,CAAC;CACxC,OAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAoB;AAC5F;AAEA,MAAMC,cAAY,MAAc,EAAE,QAAQ,uBAAuB,MAAM;;;;;;;;;;;;;;;;AAiBvE,SAAgB,WAAW,OAA0B;CACnD,OAAO,MAAM,MAAM,MAAM;EACvB,MAAM,IAAI,aAAa,CAAC,CAAC,CACtB,QAAQ,sBAAsB,MAAI,CAAC,CACnC,QAAQ,mBAAmB,IAAI;EAClC,OAAO,6BAA6B,KAAK,CAAC,KAAK,oBAAoB,KAAK,CAAC;CAC3E,CAAC;AACH;AAEA,SAAgB,WAAW,MAAgB,QAAgB,OAAgE;CACzH,IAAI,WAAW,IAAI,GAAG,OAAO;CAC7B,MAAM,SAAS,GAAW,SAAiB,IAAI,OAAO,IAAIA,WAAS,MAAM,EAAE,SAASA,WAAS,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC;CACpH,MAAM,OAAO,MAAc,SAAS,KAAK,CAAC,CAAC,CAAE,EAAE,CAAE;CACjD,MAAM,aAAa,MAAc,EAAE,UAAU,CAAC,CAAC,WAAW,GAAG;CAC7D,MAAM,OAAiB,CAAC;CACxB,MAAM,wBAAQ,IAAI,IAAY;CAC9B,IAAI,WAAW;CACf,IAAI,UAAoB,CAAC;CACzB,KAAK,MAAM,KAAK,MAAM;EACpB,MAAM,QAAQ,CAAC,EAAE,KAAK;EACtB,IAAI,aAAa,SAAS,UAAU,CAAC,IAAI;GACvC,QAAQ,KAAK,CAAC;GACd;EACF;EACA,IAAI,SAAS,UAAU,CAAC,GAAG;GACzB,KAAK,KAAK,CAAC;GACX;EACF;EACA,MAAM,MAAM,IAAI,CAAC;EACjB,IAAI,MAAM,OAAO,QAAQ,OAAO;EAChC,IAAI,MAAM,OAAO,QAAQ;GAEvB,IAAI,UAAU,UAAU,CAAC;QACpB,KAAK,KAAK,CAAC;GAChB;EACF;EAEA,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK;EAC9C,IAAI,KAAK;GACP,IAAI,MAAM,IAAI,GAAG,GAAG,OAAO;GAC3B,MAAM,IAAI,GAAG;GAEb,IAAI,aAAa,CAAC,CAAC,CAAC,QAAQ,WAAW,EAAE,CAAC,CAAC,KAAK,GAAG,OAAO;GAE1D,UAAU,CAAC;GACX,OAAO,KAAK,UAAU,UAAU,KAAK,KAAK,SAAS,EAAG,KAAK,IAAI,KAAK,KAAK,SAAS,EAAG,KAAK,OAAO,QAAQ,KAAK,IAAI;GAClH,WAAW;GACX;EACF;EACA,IAAI,UAAU,KAAK,KAAK,GAAG,QAAQ,QAAQ,MAAM,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,KAAK,OAAO,MAAM,CAAC;EACtF,UAAU,CAAC;EACX,WAAW;EACX,KAAK,KAAK,CAAC;CACb;CAEA,OAAO;EAAE;EAAM;CAAM;AACvB;;;;;AAMA,SAAgB,kBAAkB,MAAc,OAAgC;CAC9E,IAAI,CAAC,MAAM,QAAQ,OAAO;CAC1B,MAAM,QAAQ,gBAAgB,IAAI;CAClC,IAAI,CAAC,SAAS,MAAM,QAAQ,OAAO;CACnC,MAAM,QAAQ,KAAK,MAAM,IAAI;CAC7B,MAAM,OAAO,MAAM,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG;CACnD,MAAM,QAAQ,KAAK,MAAM,MAAM,EAAE,KAAK,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,WAAW,GAAG,CAAC;CACzE,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,SAAS,SAAS,KAAK,KAAK,CAAC,CAAE;CACrC,IAAI,CAAC,UAAU,OAAO,SAAS,GAAI,GAAG,OAAO;CAC7C,MAAM,MAAM,WAAW,MAAM,QAAQ,KAAK;CAC1C,IAAI,CAAC,OAAO,IAAI,MAAM,SAAS,MAAM,QAAQ,OAAO;CACpD,MAAM,EAAE,SAAS;CACjB,MAAM,WAAW,KAAK,MAAM,MAAM,EAAE,KAAK,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,WAAW,GAAG,CAAC;CAC5E,MAAM,OAAO,WAAW,MAAM,MAAM,SAAU;CAC9C,OAAO;EAAC,GAAG,MAAM,MAAM,GAAG,MAAM,KAAK;EAAG;EAAM,GAAI,WAAW,OAAO,KAAK,QAAQ,MAAM,EAAE,KAAK,CAAC;EAAI,GAAG,MAAM,MAAM,MAAM,GAAG;CAAC,CAAC,CAAC,KAAK,IAAI;AACzI;;;;;;;;;ACrOA,SAAgB,aACd,QACA,OACA,MACA,SACe;CACf,IAAI,CAAC,UAAU,CAAC,OAAO,OAAO;CAE9B,MAAM,UAAU,MAAwB,OAAO,MAAM,YAAa,CAAC,CAAC,KAAK,OAAO,MAAM,YAAY,OAAO,OAAO,CAA4B,CAAC,CAAC,KAAK,MAAM;CACzJ,MAAM,OAAO,IAAI,IAAI,OAAO;CAC5B,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAAG;EAClD,IAAI,SAAS,KAAK,QAAQ,KAAK,IAAI,IAAI,GAAG;EAC1C,IAAI,EAAE,QAAQ,QAAQ,OAAO,IAAI,KAAK;EACtC,IAAI,OAAO,KAAK,KAAK,OAAO,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK;EAC1D,IAAI,CAAC,kBAAkB,MAAM,OAAO,KAAK,GAAG,OAAO,IAAI,KAAK;CAC9D;CACA,KAAK,MAAM,QAAQ,SAAS,IAAI,QAAQ,OAAO,OAAO,IAAI,KAAK;CAC/D,KAAK,MAAM,QAAQ,OAAO,KAAK,KAAK,GAAG,IAAI,SAAS,KAAK,QAAQ,EAAE,QAAQ,SAAS,OAAO,IAAI,KAAK;CACpG,IAAI,CAAC,kBAAkB,MAAM,KAAK,OAAO,KAAK,KAAK,GAAG,OAAO,IAAI,KAAK,KAAK;CAC3E,OAAO;AACT;AAEA,MAAM,WAAW,MAAc,KAAa,YAAsC;CAChF,IAAI;CACJ,SAAS,iBAAiB,KAAK,uCAAuC,IAAI;CAC1E;AACF;;AAGA,MAAM,YAAY,GAAmB,UAA2B,KAAK,iBAAiB,CAAC,EAAA,CAAG,QAAQ,MAAM,EAAE,SAAS,EAAE,IAAI;AACzH,MAAM,eAAe,UAA2B,MAAM,SAAS,YAAY,MAAM,KAAK,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,8BAA8B;AACpJ,MAAM,eAAe,MAAc,SAAiB,UAAU,KAAK,QAAQ,KAAK;;AAGhF,MAAM,YAAY;AAClB,MAAM,cAAc,SAAkB,WAAW,IAAI,IAAI,WAAW,KAAK,MAAM,KAAK,kCAAkC,GAAG,KAAK;AAC9H,MAAM,UAAU,SACd,KACG,QAAQ,OAAO,EAAE,CAAC,CAClB,MAAM,IAAI,CAAC,CACX,KAAK,MAAM,OAAO,GAAG;AAQ1B,MAAM,UAAU,GAAW,QAAgB,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,iBAAiB;;;;;;AAO9E,SAAgB,UAAU,aAAqB,SAAwD;CACrG,OAAO;EAAE,MAAM,cAAc,WAAW;EAAG,KAAK,GAAG,QAAQ,IAAI;EAAO,KAAK,QAAQ;EAAQ,SAAS;CAAY;AAClH;AAEA,SAAgB,SAAS,MAAiB,GAA0C,aAAqB,OAAwB,CAAC,GAAmB;CACnJ,QAAQ,MAAR;EACE,KAAK,eACH,OAAO,YAAY,GAAG,EAAE,WAAW,WAAW,IAAI;EACpD,KAAK,SACH,OAAO,WAAW,GAAG,aAAa,IAAI;EACxC,KAAK,UACH,OAAO,YAAY,GAAG,aAAa,IAAI;EACzC,KAAK,UACH,OAAO,YAAY,GAAG,aAAa,IAAI;EACzC,SACE,OAAO;GAAE,IAAI;GAAO,SAAS;GAA4C,QAAQ,cAAc,GAAG,WAAW;EAAE;CACnH;AACF;AAEA,SAAS,cAAc,GAAmB,aAA+B;CACvE,OAAO,CACL,mCAAmC,EAAE,OACrC,yEAAyE,YAAY,6CAA6C,IAAI,kDACxI;AACF;AAIA,MAAa,yBAA0B,QAAQ,IAAI,oBAAoB,KAAK,QAAQ,IAAI,mBAAmB,cAAc,IAAI,KAAK,QAAQ,GAAG,cAAc;AAE3J,SAAS,YAAY,GAAmB,SAAiB,MAAuC;CAG9F,MAAM,OAAO,KAAK,UAAU,kBAAkB,EAAE,KAAK,SAAS,EAAE,SAAS,CAAC,KAAK,OAAO,CAAC,CAAC;CACxF,MAAM,aAAa,oCAAoC,EAAE,KAAK,IAAI,KAAK,QAAQ,MAAM,OAAO,EAAE;CAC9F,MAAM,SAAS,CAAC,UAAU;CAC1B,MAAM,OAAO,iBAAiB;CAC9B,MAAM,SAAS,CAAC,6BAA6B,EAAE,KAAK,0CAA0C;CAE9F,MAAM,QAAQ,CAAC,eAAe,SAAS,GAAG,IAAI,+BAA+B,YAAA,YAA8B,KAAK,cAAc,WAAW,CAAC;CAC1I,MAAM,aAAa,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,OAAO;EAAE;EAAG,MAAM;GAAC;GAAO;GAAU,EAAE;GAAM;GAAW,EAAE,SAAS;EAAM;EAAG,KAAK,EAAE;CAAW,EAAE;CACzI,MAAM,UAAU;EACd,2BAA2B,iBAAiB,EAAE;EAC9C,WAAW,IAAI;EACf,0BAA0B,EAAE,KAAK,qCAAqC,EAAE,KAAK;EAC7E,QAAQ;EACR,GAAG,WAAW,KAAK,MAAM,eAAe,EAAE,KAAK,KAAK,GAAG,IAAI,EAAE,MAAM,UAAU,EAAE,IAAI,KAAK,GAAG,4BAA4B;EACvH,mEAAmE,KAAK;CAC1E;CACA,IAAI,KAAK,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ;EAAM,SAAS;EAAkE;EAAS;EAAQ;CAAM;CACpJ,MAAM,QAAQ,UAAU,UAAU,CAAC,WAAW,GAAG,EAAE,OAAO,SAAS,CAAC;CACpE,IAAI,MAAM,SAAS,MAAM,WAAW,GAAG,OAAO;EAAE,IAAI;EAAO,SAAS;EAA2C;CAAO;CACtH,MAAM,SAAS,WAAW,IAAI;CAE9B,UAAU,UAAU;EAAC;EAAO;EAAU,EAAE;EAAM;EAAW;CAAM,GAAG,EAAE,OAAO,SAAS,CAAC;CACrF,MAAM,IAAI,UAAU,UAAU;EAAC;EAAO;EAAY;EAAW;EAAQ,EAAE;EAAM;CAAI,GAAG;EAAE,UAAU;EAAQ,OAAO;GAAC;GAAU;GAAQ;EAAM;CAAE,CAAC;CAC3I,IAAI,EAAE,WAAW,GAAG;EAClB,MAAM,MAAM,OAAO,GAAG,EAAE,UAAU,KAAK,EAAE,UAAU,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK;EACrE,OAAO;GAAE,IAAI;GAAO,SAAS,6BAA6B,MAAM,KAAK,SAAS,KAAK,GAAG,MAAM;GAAM;GAAQ;EAAO;CACnH;CAEA,MAAM,OAAiB,CAAC;CACxB,KAAK,MAAM,KAAK,YAEd,IADW,UAAU,UAAU,EAAE,MAAM;EAAE,UAAU;EAAQ,OAAO;GAAC;GAAU;GAAQ;EAAM;EAAG,KAAK,EAAE;CAAI,CACpG,CAAC,CAAC,WAAW,GAAG,KAAK,KAAK,eAAe,EAAE,KAAK,KAAK,GAAG,GAAG;MAC3D,MAAM,KAAK,oBAAoB,EAAE,EAAE,KAAK,KAAK,EAAE,EAAE,SAAS,OAAO,0CAA0C,EAAE,KAAK,KAAK,GAAG,IAAI,EAAE,MAAM,OAAO,EAAE,QAAQ,GAAG,EAAE;CAEnK,IAAI,WAAW,IAAI,KAAK,UAAU,IAAI,GAAG,UAAU,MAAM,GAAK;CAC9D,OAAO;EACL,IAAI;EACJ,SAAS,0BAA0B,EAAE,KAAK;EAC1C;EACA,SAAS;GAAC,QAAQ;GAAc,GAAG,KAAK,cAAc,EAAE,KAAK;GAAiB,GAAG;EAAI;EACrF;EACA;EACA,SAAS,WAAW,QAAQ,MAAM,KAAK,SAAS,eAAe,EAAE,KAAK,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,EAAE,IAAI;CACzG;AACF;AAIA,MAAa,wBAAwB,KAAK,QAAQ,IAAI,cAAc,KAAK,QAAQ,GAAG,QAAQ,GAAG,aAAa;AAE5G,MAAM,YAAY,MAAc,EAAE,QAAQ,uBAAuB,MAAM;AACvE,MAAM,cAAc,MAAc,KAAK,UAAU,CAAC;;AAGlD,SAAgB,iBAAiB,MAAc,MAA6B;CAC1E,MAAM,WAAW,MAAM,SAAS,IAAI,EAAE,IAAI,SAAS,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE;CAC7E,MAAM,SAAS,IAAI,OAAO,qCAAqC,SAAS,oCAAoC;CAC5G,MAAM,YAAY;CAElB,IAAI,IAAI,OAAO,mCAAmC,SAAS,YAAY,GAAG,CAAC,CAAC,KAAK,IAAI,GAAG,OAAO;CAC/F,MAAM,MAAgB,CAAC;CACvB,IAAI,WAAW;CACf,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,GAAG;EACnC,IAAI,UAAU,KAAK,IAAI,GAAG,WAAW,OAAO,KAAK,IAAI;EAErD,IAAI,CAAC,YAAY,KAAK,KAAK,MAAM,gBAAgB,KAAK,KAAK,MAAM,qBAAqB,IAAI,KAAK,IAAI;CACrG;CACA,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,QAAQ,WAAW,MAAM;AACjD;AAEA,MAAM,eAAe;;AAErB,MAAM,sBAAsB;AAE5B,SAAgB,WAAW,GAA2B;CACpD,OAAO;EACL;EACA,gBAAgB,EAAE,KAAK;EACvB,SAAS,WAAW,EAAE,GAAG;EACzB,oCAAoC,WAAW,UAAU,EAAE,KAAK,EAAE;EAClE,uCAAuC,EAAE,KAAK;EAC9C;EACA;CACF,CAAC,CAAC,KAAK,IAAI;AACb;AAEA,SAAS,WAAW,GAAmB,aAAqB,MAAuC;CACjG,MAAM,OAAO,gBAAgB;CAC7B,MAAM,SAAS;EACb,UAAU,KAAK;EACf,kBAAkB,EAAE,KAAK;EACzB,YAAY,EAAE,IAAI;EAClB,sFAAsF;EACtF;CACF;CACA,MAAM,UAAU,WAAW,IAAI,IAAI,aAAa,MAAM,MAAM,IAAI;CAChE,MAAM,cAAc,iBAAiB,SAAS,EAAE,IAAI;CACpD,IAAI,gBAAgB,MAAM,OAAO;EAAE,IAAI;EAAO,SAAS,GAAG,KAAK;EAA+D;CAAO;CACrI,IAAI,UAAU;CACd,MAAM,QAAQ,SAAS,GAAG,IAAI;CAC9B,KAAK,MAAM,KAAK,OAAO;EACrB,MAAM,OAAO,iBAAiB,SAAS,EAAE,IAAI;EAC7C,IAAI,SAAS,QAAQ,SAAS,SAAS,OAAO;GAAE,IAAI;GAAO,SAAS,gCAAgC,EAAE,KAAK,SAAS,KAAK;GAAgC;EAAO;EAChK,UAAU;CACZ;CACA,MAAM,SAAS,CAAC,4BAA4B,EAAE,KAAK,GAAG;CACtD,MAAM,WAAW,gBAAgB,QAAQ,QAAQ,WAAW,MAAM,IAAI,wBAAwB,EAAE,KAAK,QAAQ,oBAAoB,EAAE,KAAK;CACxI,MAAM,UAAU;EACd,WAAW,IAAI;EACf,GAAG,MAAM,KAAK,MAAM,YAAY,gBAAgB,EAAE,KAAK,IAAI,IAAI,CAAC;EAChE,GAAG,SAAS,GAAG,KAAK;EACpB,GAAG,OAAO,WAAW;GAAE,GAAG;GAAG,KAAK;EAAU,CAAC,CAAC;CAChD;CACA,MAAM,OAAO,QAAQ,QAAQ,QAAQ,EAAE;CACvC,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,KAAK,WAAW,CAAC;CACxD,MAAM,WAAW,MAA6C;CAC9D,MAAM,UAAU,aACd,QAAQ,mBAAmB,OAAO,CAAC,GACnC,QAAQ,mBAAmB,IAAI,CAAC,GAChC;EAAE,MAAM,EAAE;EAAM,OAAO;GAAE,KAAK,EAAE;GAAK,cAAc,EAAE,eAAe,UAAU,EAAE,MAAM;GAAG,6BAA6B;EAAU;CAAE,GAClI,MAAM,KAAK,MAAM,EAAE,IAAI,CACzB;CACA,IAAI,SAAS,OAAO,QAAQ,MAAM,SAAS,MAAM;CACjD,IAAI,KAAK,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ;EAAM,SAAS;EAA4D;EAAS;CAAO;CACvI,MAAM,SAAS,WAAW,IAAI;CAC9B,iBAAiB,MAAM,MAAM,EAAE,YAAY,MAAM,CAAC;CAClD,OAAO;EAAE,IAAI;EAAM,SAAS,sBAAsB,EAAE,KAAK,OAAO,KAAK,qCAAqC,YAAY,KAAK;EAAK;EAAQ;EAAQ,SAAS,MAAM,KAAK,MAAM,EAAE,IAAI;CAAE;AACpL;AAIA,MAAa,yBAAyB,KAAK,QAAQ,GAAG,WAAW,UAAU;AAE3E,SAAS,YAAY,GAAmB,aAAqB,MAAuC;CAClG,MAAM,OAAO,iBAAiB;CAC9B,MAAM,SAAS,CACb,UAAU,KAAK,uBACf,MAAM,EAAE,KAAK,eAAe,EAAE,IAAI,sFAAsF,aAC1H;CACA,IAAI,MAA+B,CAAC;CACpC,IAAI,WAAW,IAAI,GAAG;EACpB,MAAM,OAAO,aAAa,MAAM,MAAM;EACtC,IAAI,KAAK,KAAK,GAAG;GACf,IAAI;IACF,MAAM,KAAK,MAAM,IAAI;GACvB,QAAQ;IACN,OAAO;KAAE,IAAI;KAAO,SAAS,GAAG,KAAK;KAAkE;IAAO;GAChH;GACA,IAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG,OAAO;IAAE,IAAI;IAAO,SAAS,GAAG,KAAK;IAAyB;GAAO;EAClI;CACF;CACA,MAAM,UAAU,IAAI,cAAc,OAAO,IAAI,eAAe,YAAY,CAAC,MAAM,QAAQ,IAAI,UAAU,IAAK,IAAI,aAAyC,CAAC;CACxJ,MAAM,SAAS,CAAC,iEAAiE,EAAE,KAAK,GAAG;CAC3F,MAAM,SAAS,SAAiB;EAAE,KAAK,EAAE;EAAK,SAAS,EAAE,eAAe,UAAU,MAAM;CAAE;CAC1F,MAAM,QAAQ,SAAS,GAAG,IAAI;CAC9B,MAAM,SAAS,MAAM,MAAM,MAAM,EAAE,EAAE,QAAQ,QAAQ;CACrD,IAAI,QAAQ,OAAO;EAAE,IAAI;EAAO,SAAS,eAAe,OAAO,KAAK,aAAa,KAAK;EAAyB;CAAO;CACtH,MAAM,UAAU;EACd,WAAW,IAAI;EACf,GAAG,MAAM,KAAK,MAAM,YAAY,eAAe,EAAE,KAAK,IAAI,IAAI,CAAC;EAC/D,GAAG,EAAE,QAAQ,UAAU,YAAY,MAAM,eAAe,EAAE,KAAK,IAAI,EAAE,QAAQ,UAAU,OAAO,KAAK,GAAG,KAAK;EAC3G,GAAG,OAAO,IAAI,EAAE,KAAK,KAAK,KAAK,UAAU,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG;CACvE;CACA,IAAI,KAAK,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ;EAAM,SAAS;EAA6D;EAAS;CAAO;CACxI,MAAM,SAAS,gBAAgB,OAAO;CACtC,KAAK,MAAM,KAAK,OAAO,OAAO,QAAQ,EAAE;CACxC,QAAQ,EAAE,QAAQ,MAAM,EAAE,GAAG;CAC7B,IAAI,aAAa;CACjB,MAAM,SAAU,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC,CAAC,CAA6C;CAC5F,MAAM,UAAU,aAAa,QAAQ,QAAQ;EAAE,MAAM,EAAE;EAAM,OAAO,MAAM,EAAE,GAAG;CAAE,GAAG,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC;CAC5G,IAAI,SAAS,OAAO,QAAQ,MAAM,SAAS,MAAM;CACjD,MAAM,SAAS,WAAW,IAAI;CAC9B,iBAAiB,MAAM,KAAK,UAAU,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,YAAY,MAAM,CAAC;CACjF,OAAO;EACL,IAAI;EACJ,SAAS,UAAU,EAAE,KAAK,OAAO,KAAK,qCAAqC,YAAY,KAAK,EAAE;EAC9F;EACA;EACA,SAAS,MAAM,KAAK,MAAM,EAAE,IAAI;CAClC;AACF;;;;;;AASA,SAAgB,WAAW,MAAyB,QAAQ,KAAa;CACvE,MAAM,MAAM,IAAI,aAAa,KAAK;CAClC,IAAI,KAAK,OAAO,IAAI,QAAQ,cAAc,QAAQ,CAAC;CACnD,MAAM,OAAO,KAAK,QAAQ,GAAG,UAAU,IAAI,0BAA0B,IAAI;CACzE,IAAI,SAAS;CACb,IAAI;EACF,SAAS,aAAa,KAAK,MAAM,gBAAgB,GAAG,MAAM,CAAC,CAAC,QAAQ,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,YAAY;CACxG,QAAQ,CAER;CACA,OAAO,UAAU,WAAW,aAAa,wBAAwB,KAAK,MAAM,IAAI,KAAK,MAAM,YAAY,MAAM,IAAI;AACnH;;;;;;AAOA,SAAgB,mBAAmB,MAAc,MAA8D;CAC7G,MAAM,QAAQ,KAAK,QAAQ,WAAW,EAAE,CAAC,CAAC,MAAM,IAAI;CACpD,MAAM,OAAO,MAAM,SAAS,GAAG,MAAO,mBAAmB,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAE;CAC5E,IAAI,KAAK,WAAW,GAAG,OAAO;CAC9B,IAAI,KAAK,SAAS,GAAG,OAAO;CAC5B,MAAM,MAAM,KAAK;CACjB,MAAM,OAAO,MAAM,IAAI,CAAE,QAAQ,oBAAoB,EAAE,CAAC,CAAC,QAAQ,UAAU,EAAE,CAAC,CAAC,KAAK;CACpF,IAAI,MAAM,OAAO,SAAS,QAAQ,SAAS,UAAU,SAAS,MAAM,YAAY;CAChF,IAAI,MAAM,MAAM;CAChB,OAAO,MAAM,MAAM,WAAW,MAAM,IAAI,CAAE,KAAK,MAAM,MAAM,MAAM,KAAK,MAAM,IAAK,KAAK,MAAM,IAAI,CAAE,WAAW,GAAG,IAAI;CACpH,MAAM,OAAO,MAAM,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,MAAM,EAAE,KAAK,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,WAAW,GAAG,CAAC;CAC/F,IAAI,CAAC,KAAK,QAAQ,OAAO;CACzB,MAAM,SAAS,KAAK,EAAE,CAAE,MAAM,QAAQ,CAAC,CAAE;CACzC,IAAI,CAAC,UAAU,KAAK,KAAK,MAAM,KAAK,KAAK,MAAM,MAAM,UAAU,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,EAAG,CAAC,GAAG,OAAO;CAC/F,MAAM,MAAM,IAAI,OAAO,IAAI,OAAO,SAAS,KAAK,QAAQ,uBAAuB,MAAM,EAAE,cAAc;CACrG,MAAM,SAAS,KAAK,SAAS,GAAG,MAAO,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAE;CAC9D,IAAI,OAAO,WAAW,GAAG,OAAO;CAChC,IAAI,OAAO,SAAS,GAAG,OAAO;CAE9B,IADe,IAAI,KAAK,KAAK,OAAO,GAAK,CAAC,CAAE,EAAE,CAAE,QAAQ,UAAU,EAAE,CAAC,CAAC,KAC7D,GAAG,OAAO;CACnB,MAAM,MAAgB,CAAC;CACvB,KAAK,MAAM,KAAK,KAAK,MAAM,OAAO,KAAM,CAAC,GAAG;EAC1C,IAAI,EAAE,MAAM,QAAQ,CAAC,CAAE,EAAE,CAAE,UAAU,OAAO,QAAQ;EACpD,IAAI,KAAK,CAAC;CACZ;CACA,IAAI,CAAC,IAAI,QAAQ,OAAO;CACxB,MAAM,cAAc,IAAI,EAAE,CAAE,MAAM,QAAQ,CAAC,CAAE,EAAE,CAAE;CACjD,MAAM,UAAU,IAAI,QAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC,CAAE,EAAE,CAAE,WAAW,eAAe,4BAA4B,KAAK,CAAC,CAAC;CACtH,IAAI,QAAQ,SAAS,GAAG,OAAO;CAC/B,IAAI,CAAC,QAAQ,QAAQ,OAAO;CAC5B,MAAM,QAAQ,QAAQ,EAAE,CAAE,QAAQ,6BAA6B,EAAE,CAAC,CAAC,QAAQ,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,gBAAgB,EAAE,CAAC,CAAC,YAAY;CACxI,OAAO;EAAC;EAAS;EAAK;EAAM;CAAK,CAAC,CAAC,SAAS,KAAK,IAAI,aAAa;AACpE;AACA,MAAa,gBAAgB,SAAiB,KAAK,YAAY,CAAC,CAAC,QAAQ,cAAc,GAAG,IAAI;;;;;AAM9F,SAAgB,iBAAiB,MAAc,MAAc,OAAgC;CAC3F,MAAM,QAAQ,KAAK,MAAM,IAAI;CAC7B,MAAM,MAAM,MAAM,WAAW,MAAM,mBAAmB,KAAK,CAAC,CAAC;CAC7D,MAAM,SAAS,WAAmB,CAAC,GAAG,SAAS,KAAK,IAAI,GAAG,MAAM,KAAK,MAAM,GAAG,SAAS,SAAS,GAAG,CAAC;CACrG,IAAI,MAAM,GAAG;EACX,MAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE;EACpC,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,GAAG,gBAAgB,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE;CAC7E;CACA,MAAM,OAAO,MAAM,IAAI,CAAE,QAAQ,oBAAoB,EAAE,CAAC,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,KAAK;CAClF,IAAI,QAAQ,SAAS,QAAQ,SAAS,UAAU,SAAS,KAAK,OAAO;CACrE,IAAI,MAAM,MAAM,OAAO;CAEvB,IAAI,MAAM,MAAM;CAChB,OAAO,MAAM,MAAM,WAAW,MAAM,IAAI,CAAE,KAAK,MAAM,MAAM,MAAM,KAAK,MAAM,IAAK,IAAI;CACrF,MAAM,OAAO,MAAM,MAAM,MAAM,GAAG,GAAG;CACrC,MAAM,aAAa,KAAK,MAAM,MAAM,EAAE,KAAK,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC,WAAW,GAAG,CAAC;CAC9E,MAAM,SAAS,aAAa,WAAW,MAAM,QAAQ,CAAC,CAAE,KAAM;CAC9D,IAAI,CAAC,UAAU,KAAK,KAAK,MAAM,GAAG,OAAO;CAEzC,MAAM,MAAM,WAAW,MAAM,QAAQ,CAAC,IAAI,CAAC;CAC3C,IAAI,CAAC,KAAK,OAAO;CACjB,MAAM,EAAE,SAAS;CACjB,MAAM,SAAS,MAAM,MAAM;CAC3B,OAAO;EAAC,GAAG,MAAM,MAAM,GAAG,MAAM,CAAC;EAAG,GAAG;EAAQ,GAAG;EAAM,GAAG,MAAM,MAAM,GAAG;CAAC,CAAC,CAAC,KAAK,IAAI;AACxF;AAEA,SAAS,cAAc,MAAc,KAAa,OAAuB;CACvE,MAAM,OAAO,GAAG,IAAI,GAAG;CACvB,MAAM,KAAK,IAAI,OAAO,uBAAuB,SAAS,GAAG,EAAE,WAAW,GAAG;CACzE,IAAI,GAAG,KAAK,IAAI,GAAG,OAAO,KAAK,QAAQ,IAAI,IAAI;CAC/C,MAAM,OAAO,KAAK,QAAQ,QAAQ,EAAE;CACpC,OAAO,GAAG,OAAO,GAAG,KAAK,MAAM,KAAK,KAAK;AAC3C;AAEA,SAAS,YAAY,GAAmB,aAAqB,MAAuC;CAClG,MAAM,OAAO,WAAW;CACxB,MAAM,aAAa,KAAK,MAAM,aAAa;CAC3C,MAAM,UAAU,KAAK,MAAM,MAAM;CACjC,MAAM,SAAS,aAAa,EAAE,IAAI;CAClC,MAAM,QAAQ;EAAC,QAAQ,KAAK,UAAU,EAAE,GAAG;EAAK;EAAY,+BAA+B,OAAO;CAAG;CACrG,MAAM,SAAS;EACb,UAAU,WAAW;EACrB;EACA,OAAO,EAAE,KAAK;EACd,GAAG,MAAM,KAAK,MAAM,SAAS,GAAG;EAChC,UAAU,QAAQ,KAAK,OAAO,uCAAuC,YAAY;EACjF,uCAAuC,EAAE;CAC3C;CACA,MAAM,UAAU,WAAW,UAAU,IAAI,aAAa,YAAY,MAAM,IAAI;CAC5E,MAAM,QAAQ,SAAS,GAAG,IAAI;CAC9B,MAAM,MAAM,gBAAgB,OAAO;CACnC,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,QAAQ,GAAG,IAAI,GAAG,CAAC,GACrE,OAAO;EACL,IAAI;EACJ,SAAS,GAAG,WAAW;EACvB;CACF;CAEF,MAAM,WAAW,iBAAiB,SAAS,EAAE,MAAM,KAAK;CAExD,MAAM,OAAO,aAAa,OAAO,OAAO,kBAAkB,UAAU,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC;CAC5F,IAAI,aAAa,QAAQ,SAAS,MAChC,OAAO;EAAE,IAAI;EAAO,SAAS,mBAAmB,MAAM,KAAK,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,QAAQ,WAAW;EAAgC;CAAO;CAEvJ,IAAI,SAAS,MAAM,OAAO;EAAE,IAAI;EAAO,SAAS,GAAG,WAAW;EAAiD;CAAO;CACtH;EACE,MAAM,OAAO;GAAE,KAAK,EAAE;GAAK,SAAS,EAAE,eAAe,aAAa,OAAO,GAAG;EAAE;EAC9E,MAAM,UAAU,aAAa,eAAe,OAAO,GAAG,eAAe,IAAI,GAAG;GAAE,MAAM,EAAE;GAAM,OAAO;EAAK,GAAG,MAAM,KAAK,MAAM,EAAE,IAAI,CAAC;EACnI,IAAI,SAAS,OAAO,QAAQ,YAAY,SAAS,MAAM;CACzD;CACA,MAAM,SAAS,CAAC,mBAAmB,EAAE,MAAM;CAC3C,MAAM,UAAU;EACd,WAAW,UAAU;EACrB,WAAW,OAAO;EAClB,GAAG,MAAM,KAAK,MAAM,YAAY,gBAAgB,EAAE,KAAK,IAAI,UAAU,CAAC;EACtE,iCAAiC,EAAE,KAAK,OAAO,WAAW;EAC1D,GAAG,OAAO;GAAC;GAAgB,KAAK,EAAE,KAAK;GAAI,GAAG,MAAM,KAAK,MAAM,OAAO,GAAG;EAAC,CAAC,CAAC,KAAK,IAAI,CAAC;EACtF,OAAO,OAAO,GAAG,UAAU,MAAM,QAAQ;CAC3C;CACA,IAAI,KAAK,QAAQ,OAAO;EAAE,IAAI;EAAM,QAAQ;EAAM,SAAS;EAA6D;EAAS;CAAO;CACxI,MAAM,aAAa,WAAW,OAAO,IAAI,aAAa,SAAS,MAAM,IAAI;CACzE,MAAM,SAAS,WAAW,UAAU;CACpC,MAAM,YAAY,WAAW,OAAO;CACpC,iBAAiB,SAAS,cAAc,YAAY,QAAQ,EAAE,GAAG,GAAG,EAAE,YAAY,MAAM,CAAC;CACzF,iBAAiB,YAAY,KAAK,SAAS,IAAI,IAAI,OAAO,GAAG,KAAK,KAAK,EAAE,YAAY,MAAM,CAAC;CAC5F,OAAO;EACL,IAAI;EACJ,SAAS,UAAU,EAAE,KAAK,OAAO,WAAW,kBAAkB,QAAQ,MAAM,OAAO,UAAU,YAAY,KAAK;EAC9G,QAAQ,CAAC,QAAQ,SAAS,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK;EAC1D;EACA,SAAS,MAAM,KAAK,MAAM,EAAE,IAAI;CAClC;AACF"}

package/dist/node-check-CjTk6VNL.js

@@ -0,0 +1,24 @@
+#!/usr/bin/env node
+//#region server/node-check.ts
+/** The oldest Node.js xaq runs on (node:sqlite unflagged, import.meta.dirname). Keep in sync with package.json engines. */
+const MIN_NODE = "22.13.0";
+/** An explanation when `version` (e.g. process.versions.node) is too old, else null. */
+function nodeVersionError(version) {
+	const parse = (v) => v.replace(/^v/, "").split(".").map((n) => Number.parseInt(n, 10) || 0);
+	const have = parse(version);
+	const need = parse(MIN_NODE);
+	for (let i = 0; i < 3; i++) {
+		if ((have[i] ?? 0) > need[i]) return null;
+		if ((have[i] ?? 0) < need[i]) return `xaq needs Node.js 22.13 or newer (you have ${version.replace(/^v?/, "v")}). Install a current Node.js from https://nodejs.org and try again.`;
+	}
+	return null;
+}
+const problem = nodeVersionError(process.versions.node);
+if (problem) {
+	console.error(problem);
+	process.exit(1);
+}
+//#endregion
+export { nodeVersionError as n, MIN_NODE as t };
+
+//# sourceMappingURL=node-check-CjTk6VNL.js.map

package/dist/node-check-CjTk6VNL.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-check-CjTk6VNL.js","names":[],"sources":["../server/node-check.ts"],"sourcesContent":["/** The oldest Node.js xaq runs on (node:sqlite unflagged, import.meta.dirname). Keep in sync with package.json engines. */\nexport const MIN_NODE = \"22.13.0\";\n\n/** An explanation when `version` (e.g. process.versions.node) is too old, else null. */\nexport function nodeVersionError(version: string): string | null {\n  const parse = (v: string) => v.replace(/^v/, \"\").split(\".\").map((n) => Number.parseInt(n, 10) || 0);\n  const have = parse(version);\n  const need = parse(MIN_NODE);\n  for (let i = 0; i < 3; i++) {\n    if ((have[i] ?? 0) > need[i]!) return null;\n    if ((have[i] ?? 0) < need[i]!) return `xaq needs Node.js 22.13 or newer (you have ${version.replace(/^v?/, \"v\")}). Install a current Node.js from https://nodejs.org and try again.`;\n  }\n  return null;\n}\n\n// Runs on import, before anything that needs a newer Node is loaded.\nconst problem = nodeVersionError(process.versions.node);\nif (problem) {\n  console.error(problem);\n  process.exit(1);\n}\n"],"mappings":";;;AACA,MAAa,WAAW;;AAGxB,SAAgB,iBAAiB,SAAgC;CAC/D,MAAM,SAAS,MAAc,EAAE,QAAQ,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,OAAO,SAAS,GAAG,EAAE,KAAK,CAAC;CAClG,MAAM,OAAO,MAAM,OAAO;CAC1B,MAAM,OAAO,MAAM,QAAQ;CAC3B,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;EAC1B,KAAK,KAAK,MAAM,KAAK,KAAK,IAAK,OAAO;EACtC,KAAK,KAAK,MAAM,KAAK,KAAK,IAAK,OAAO,8CAA8C,QAAQ,QAAQ,OAAO,GAAG,EAAE;CAClH;CACA,OAAO;AACT;AAGA,MAAM,UAAU,iBAAiB,QAAQ,SAAS,IAAI;AACtD,IAAI,SAAS;CACX,QAAQ,MAAM,OAAO;CACrB,QAAQ,KAAK,CAAC;AAChB"}

package/dist/paths-d-C2kdjo.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { c as profilePath } from "./paths-yzOKD6ow.js";

package/dist/paths-yzOKD6ow.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import { r as pickDir, t as LEGACY_PRODUCT } from "./brand--ZB8jTn1.js";
+import { join } from "node:path";
+import { homedir } from "node:os";
+//#region server/listen/paths.ts
+/**
+* Agent-side locations (the machine running `connect` / `listen`, not the daemon). XDG on Linux and
+* macOS alike, so one set of paths works everywhere:
+*   config  $XDG_CONFIG_HOME/xaq  (~/.config/xaq)       profiles/<name>.json (0600)
+*   state   $XDG_STATE_HOME/xaq   (~/.local/state/xaq)  listen/<name>/{listen.log,dead.jsonl,status.json}
+*   data    $XDG_DATA_HOME/xaq    (~/.local/share/xaq)  app/ (stable install the services run)
+* Each one is still the pre-rename `…/agentinbox` while that exists and the `…/xaq` one doesn't: existing
+* profiles, keys, logs and the listener services' install stay where they are. Nothing is moved.
+*/
+const xdg = (envVar, fallback) => {
+	const v = process.env[envVar];
+	return v && v.startsWith("/") ? v : join(homedir(), fallback);
+};
+const named = (base) => pickDir(join(base, "xaq"), join(base, LEGACY_PRODUCT)).dir;
+const configDir = () => named(xdg("XDG_CONFIG_HOME", ".config"));
+const stateDir = () => named(xdg("XDG_STATE_HOME", ".local/state"));
+const dataDir = () => named(xdg("XDG_DATA_HOME", ".local/share"));
+const profilesDir = () => join(configDir(), "profiles");
+const profilePath = (name) => join(profilesDir(), `${name}.json`);
+const profileStateDir = (name) => join(stateDir(), "listen", name);
+const logPath = (name) => join(profileStateDir(name), "listen.log");
+/** `listen --backfill` and `--dry-run` log separately, so they can run next to the listener without both rotating one file. */
+const oneOffLogPath = (name) => join(profileStateDir(name), "one-off.log");
+const deadPath = (name) => join(profileStateDir(name), "dead.jsonl");
+const statusPath = (name) => join(profileStateDir(name), "status.json");
+/** Default working directory for --exec commands: private (0700), so no planted CLAUDE.md, .mcp.json or hooks apply. */
+const workDir = (name) => join(profileStateDir(name), "work");
+/** The listeners' stable install (shared by all profiles), staged and swapped like the daemon's `<data>/app`. */
+const listenAppDir = () => join(dataDir(), "app");
+const DEFAULT_PROFILE = "default";
+const PROFILE_RE = /^[a-z0-9][a-z0-9_-]{0,39}$/;
+/** Profile names become file names and service names, so they are kept boring. */
+function validProfileName(name) {
+	const n = name.trim().toLowerCase();
+	if (!PROFILE_RE.test(n)) throw new Error(`Invalid profile name "${name}": use 1-40 lowercase letters, digits, "-" or "_", starting with a letter or digit.`);
+	return n;
+}
+//#endregion
+export { listenAppDir as a, profilePath as c, stateDir as d, statusPath as f, deadPath as i, profileStateDir as l, workDir as m, configDir as n, logPath as o, validProfileName as p, dataDir as r, oneOffLogPath as s, DEFAULT_PROFILE as t, profilesDir as u };
+
+//# sourceMappingURL=paths-yzOKD6ow.js.map

package/dist/paths-yzOKD6ow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths-yzOKD6ow.js","names":[],"sources":["../server/listen/paths.ts"],"sourcesContent":["import { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { LEGACY_PRODUCT, pickDir, PRODUCT } from \"../brand.ts\";\n\n/**\n * Agent-side locations (the machine running `connect` / `listen`, not the daemon). XDG on Linux and\n * macOS alike, so one set of paths works everywhere:\n *   config  $XDG_CONFIG_HOME/xaq  (~/.config/xaq)       profiles/<name>.json (0600)\n *   state   $XDG_STATE_HOME/xaq   (~/.local/state/xaq)  listen/<name>/{listen.log,dead.jsonl,status.json}\n *   data    $XDG_DATA_HOME/xaq    (~/.local/share/xaq)  app/ (stable install the services run)\n * Each one is still the pre-rename `…/agentinbox` while that exists and the `…/xaq` one doesn't: existing\n * profiles, keys, logs and the listener services' install stay where they are. Nothing is moved.\n */\n\nconst xdg = (envVar: string, fallback: string) => {\n  const v = process.env[envVar];\n  // The XDG spec says relative paths are invalid and must be ignored.\n  return v && v.startsWith(\"/\") ? v : join(homedir(), fallback);\n};\n\nconst named = (base: string) => pickDir(join(base, PRODUCT), join(base, LEGACY_PRODUCT)).dir;\n\nexport const configDir = () => named(xdg(\"XDG_CONFIG_HOME\", \".config\"));\nexport const stateDir = () => named(xdg(\"XDG_STATE_HOME\", \".local/state\"));\nexport const dataDir = () => named(xdg(\"XDG_DATA_HOME\", \".local/share\"));\n\nexport const profilesDir = () => join(configDir(), \"profiles\");\nexport const profilePath = (name: string) => join(profilesDir(), `${name}.json`);\nexport const profileStateDir = (name: string) => join(stateDir(), \"listen\", name);\nexport const logPath = (name: string) => join(profileStateDir(name), \"listen.log\");\n/** `listen --backfill` and `--dry-run` log separately, so they can run next to the listener without both rotating one file. */\nexport const oneOffLogPath = (name: string) => join(profileStateDir(name), \"one-off.log\");\nexport const deadPath = (name: string) => join(profileStateDir(name), \"dead.jsonl\");\nexport const statusPath = (name: string) => join(profileStateDir(name), \"status.json\");\n/** Default working directory for --exec commands: private (0700), so no planted CLAUDE.md, .mcp.json or hooks apply. */\nexport const workDir = (name: string) => join(profileStateDir(name), \"work\");\n/** The listeners' stable install (shared by all profiles), staged and swapped like the daemon's `<data>/app`. */\nexport const listenAppDir = () => join(dataDir(), \"app\");\n\nexport const DEFAULT_PROFILE = \"default\";\nconst PROFILE_RE = /^[a-z0-9][a-z0-9_-]{0,39}$/;\n\n/** Profile names become file names and service names, so they are kept boring. */\nexport function validProfileName(name: string): string {\n  const n = name.trim().toLowerCase();\n  if (!PROFILE_RE.test(n)) {\n    throw new Error(`Invalid profile name \"${name}\": use 1-40 lowercase letters, digits, \"-\" or \"_\", starting with a letter or digit.`);\n  }\n  return n;\n}\n"],"mappings":";;;;;;;;;;;;;;AAcA,MAAM,OAAO,QAAgB,aAAqB;CAChD,MAAM,IAAI,QAAQ,IAAI;CAEtB,OAAO,KAAK,EAAE,WAAW,GAAG,IAAI,IAAI,KAAK,QAAQ,GAAG,QAAQ;AAC9D;AAEA,MAAM,SAAS,SAAiB,QAAQ,KAAK,MAAA,KAAa,GAAG,KAAK,MAAM,cAAc,CAAC,CAAC,CAAC;AAEzF,MAAa,kBAAkB,MAAM,IAAI,mBAAmB,SAAS,CAAC;AACtE,MAAa,iBAAiB,MAAM,IAAI,kBAAkB,cAAc,CAAC;AACzE,MAAa,gBAAgB,MAAM,IAAI,iBAAiB,cAAc,CAAC;AAEvE,MAAa,oBAAoB,KAAK,UAAU,GAAG,UAAU;AAC7D,MAAa,eAAe,SAAiB,KAAK,YAAY,GAAG,GAAG,KAAK,MAAM;AAC/E,MAAa,mBAAmB,SAAiB,KAAK,SAAS,GAAG,UAAU,IAAI;AAChF,MAAa,WAAW,SAAiB,KAAK,gBAAgB,IAAI,GAAG,YAAY;;AAEjF,MAAa,iBAAiB,SAAiB,KAAK,gBAAgB,IAAI,GAAG,aAAa;AACxF,MAAa,YAAY,SAAiB,KAAK,gBAAgB,IAAI,GAAG,YAAY;AAClF,MAAa,cAAc,SAAiB,KAAK,gBAAgB,IAAI,GAAG,aAAa;;AAErF,MAAa,WAAW,SAAiB,KAAK,gBAAgB,IAAI,GAAG,MAAM;;AAE3E,MAAa,qBAAqB,KAAK,QAAQ,GAAG,KAAK;AAEvD,MAAa,kBAAkB;AAC/B,MAAM,aAAa;;AAGnB,SAAgB,iBAAiB,MAAsB;CACrD,MAAM,IAAI,KAAK,KAAK,CAAC,CAAC,YAAY;CAClC,IAAI,CAAC,WAAW,KAAK,CAAC,GACpB,MAAM,IAAI,MAAM,yBAAyB,KAAK,oFAAoF;CAEpI,OAAO;AACT"}

package/dist/profile-CcMZ4hn7.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export { n as loadProfile } from "./profile-NmMKAczz.js";

package/dist/profile-NmMKAczz.js

@@ -0,0 +1,222 @@
+#!/usr/bin/env node
+import { t as LEGACY_PRODUCT } from "./brand--ZB8jTn1.js";
+import { v as isEventType } from "./types-BhJDbSzE.js";
+import { t as NPX } from "./version-BxH7OuWD.js";
+import { c as profilePath, p as validProfileName, t as DEFAULT_PROFILE, u as profilesDir } from "./paths-yzOKD6ow.js";
+import { r as webhookFilterSchema } from "./filter-Ck6OMxvu.js";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { randomBytes } from "node:crypto";
+import { z } from "zod";
+//#region server/listen/fsutil.ts
+/** Creates a directory (and parents) readable only by this user. Tightens an existing one. */
+function ensurePrivateDir(dir) {
+	mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	if (process.platform !== "win32" && (statSync(dir).mode & 63) !== 0) chmodSync(dir, 448);
+}
+/**
+* Writes a file with mode 0600 atomically (temp file + rename), so a crash never leaves a
+* half-written profile and the secret is never briefly world-readable.
+*/
+function writePrivateFile(linkOrPath, content, opts = {}) {
+	const path = resolveLink(linkOrPath);
+	if (opts.privateDir !== false) ensurePrivateDir(dirname(path));
+	else mkdirSync(dirname(path), { recursive: true });
+	const tmp = `${path}.${randomBytes(4).toString("hex")}.tmp`;
+	try {
+		writeFileSync(tmp, content, {
+			mode: 384,
+			flag: "wx"
+		});
+		chmodSync(tmp, 384);
+		renameSync(tmp, path);
+	} catch (err) {
+		rmSync(tmp, { force: true });
+		throw err;
+	}
+}
+function resolveLink(path) {
+	try {
+		return lstatSync(path).isSymbolicLink() ? realpathSync(path) : path;
+	} catch {
+		return path;
+	}
+}
+/** Copies `path` next to itself as `<path>.xaq-backup-<timestamp>` (0600). Returns the copy, or null if there was nothing to back up. */
+function backupFile(path) {
+	if (!existsSync(path)) return null;
+	const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+	const content = readFileSync(path);
+	for (let n = 0;; n++) {
+		const backup = `${path}.xaq-backup-${stamp}${n ? `-${n}` : ""}`;
+		try {
+			writeFileSync(backup, content, {
+				mode: 384,
+				flag: "wx"
+			});
+			return backup;
+		} catch (err) {
+			if (err.code !== "EEXIST" || n > 20) throw err;
+		}
+	}
+}
+/** Tightens an existing file to 0600 (files created by appendFileSync keep their first mode). */
+function tighten(path) {
+	if (process.platform !== "win32" && existsSync(path) && (statSync(path).mode & 63) !== 0) chmodSync(path, 384);
+}
+/**
+* A directory commands may run in: must exist, be owned by this user and not be writable by group or
+* others (otherwise someone else could plant agent instructions, MCP configs or hooks there).
+*/
+function assertTrustedDir(dir) {
+	let st;
+	try {
+		st = statSync(dir);
+	} catch {
+		throw new Error(`--cwd ${dir} does not exist.`);
+	}
+	if (!st.isDirectory()) throw new Error(`--cwd ${dir} is not a directory.`);
+	const uid = process.getuid?.();
+	if (uid !== void 0 && st.uid !== uid) throw new Error(`Refusing --cwd ${dir}: it belongs to another user, who could plant instructions or hooks for the agent there.`);
+	if (process.platform !== "win32" && (st.mode & 18) !== 0) throw new Error(`Refusing --cwd ${dir}: it is writable by group or others (mode ${(st.mode & 511).toString(8)}). Use a directory only you can write to.`);
+	for (let p = dirname(dir); p !== dirname(p); p = dirname(p)) try {
+		const ps = statSync(p);
+		if (process.platform !== "win32" && (ps.mode & 18) !== 0 && (ps.mode & 512) === 0) {
+			process.stderr.write(`warning: --cwd ${dir}: its parent ${p} is writable by group or others, so they could replace it.\n`);
+			break;
+		}
+	} catch {
+		break;
+	}
+	return dir;
+}
+/** True when group or others can read/write the file. */
+const isTooOpen = (path) => process.platform !== "win32" && (statSync(path).mode & 63) !== 0;
+//#endregion
+//#region server/listen/names.ts
+/**
+* The names a profile is known by in the agent's tools: its MCP server (`xaq`, or `xaq-<profile>`), which
+* is also its Hermes webhook route and, as `mcp-<server>`, the route's toolset.
+*
+* A profile made before the rename keeps `agentinbox` / `agentinbox-<profile>`: Hermes routes are confined
+* to `toolsets: ["mcp-agentinbox"]` and cron jobs to `["agentinbox"]`, saved Claude Code recipes allow
+* `mcp__agentinbox`, and the client configs register that name. Renaming any of them would quietly break
+* the others. So the name is saved in the profile (`mcpServer`): new profiles get `xaq…`, and a profile
+* without the field was made by agentinbox and keeps `agentinbox…` (written into the file the next time
+* it is saved).
+*/
+const SERVER_NAME_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+const isServerName = (s) => typeof s === "string" && SERVER_NAME_RE.test(s);
+const named = (base, profile) => profile === "default" ? base : `${base}-${profile}`;
+/** The MCP server name a new profile gets. */
+const newServerName = (profile) => named("xaq", validProfileName(profile));
+/** The name a profile from before the rename was registered under. */
+const legacyServerName = (profile) => named(LEGACY_PRODUCT, validProfileName(profile));
+/**
+* The server name saved in the profile file; for a profile file without one (made before the rename),
+* the pre-rename name; null when there is no profile file yet.
+*/
+function savedServerName(profile) {
+	const path = profilePath(validProfileName(profile));
+	if (!existsSync(path)) return null;
+	try {
+		const saved = JSON.parse(readFileSync(path, "utf8"))?.mcpServer;
+		if (isServerName(saved)) return saved;
+	} catch {}
+	return legacyServerName(profile);
+}
+/** The MCP server (and Hermes route) name for a profile: see the comment at the top. */
+const mcpServerName = (profile) => savedServerName(profile) ?? newServerName(profile);
+/**
+* The product name a profile's own texts use: "agentinbox" for a profile that kept its pre-rename names,
+* else "xaq". It names the server in the keyless Claude Code MCP config (`mcp__<it>` in the recipe) and
+* appears in the recipe prompts, so the commands saved in an old profile still match its recipes exactly.
+*/
+const profileBrand = (profile) => mcpServerName(profile) === legacyServerName(profile) ? LEGACY_PRODUCT : "xaq";
+//#endregion
+//#region server/listen/profile.ts
+const profileSchema = z.object({
+	url: z.string().refine((u) => URL.canParse(u), "url must be a full URL"),
+	apiKey: z.string().min(8),
+	agentId: z.string().min(1),
+	agentName: z.string(),
+	consumer: z.string().min(1).max(100),
+	insecure: z.boolean().optional(),
+	types: z.array(z.string().refine(isEventType)).transform((t) => t).optional(),
+	filter: webhookFilterSchema.optional(),
+	includeBody: z.boolean().optional(),
+	exec: z.string().min(1).optional(),
+	forward: z.object({
+		url: z.string(),
+		secret: z.string().startsWith("whsec_")
+	}).optional(),
+	concurrency: z.number().int().min(1).max(32).optional(),
+	timeoutSeconds: z.number().int().min(1).max(86400).optional(),
+	maxAttempts: z.number().int().min(1).max(100).optional(),
+	tool: z.enum([
+		"claude-code",
+		"codex",
+		"cursor",
+		"hermes",
+		"other"
+	]).optional(),
+	mcpUrl: z.string().optional(),
+	skillUrl: z.string().optional(),
+	forwardSecret: z.string().startsWith("whsec_").optional(),
+	cwd: z.string().startsWith("/").optional(),
+	exclude: webhookFilterSchema.pick({
+		from: true,
+		labelIds: true
+	}).optional(),
+	skipCategories: z.array(z.string().regex(/^CATEGORY_[A-Z]+$/)).max(10).optional(),
+	batchSeconds: z.number().int().min(1).max(3600).optional(),
+	mcpServer: z.string().refine(isServerName, "mcpServer must be a plain name").optional(),
+	createdAt: z.string().optional()
+}).loose();
+const profileExists = (name) => existsSync(profilePath(validProfileName(name)));
+function listProfiles() {
+	if (!existsSync(profilesDir())) return [];
+	return readdirSync(profilesDir()).filter((f) => f.endsWith(".json")).map((f) => f.slice(0, -5)).sort();
+}
+function loadProfile(name = DEFAULT_PROFILE) {
+	const n = validProfileName(name);
+	const path = profilePath(n);
+	if (!existsSync(path)) {
+		const others = listProfiles();
+		const hint = others.length ? ` Known profiles: ${others.join(", ")} (pick one with --profile).` : ` Run \`${NPX} connect <daemon-url>\` first.`;
+		throw new Error(`No xaq profile "${n}" (${path}).${hint}`);
+	}
+	if (isTooOpen(path)) {
+		chmodSync(path, 384);
+		process.stderr.write(`warning: ${path} was readable by other users; it is 0600 again. If anyone else could have read it, rotate the agent's key in the console and run \`${NPX} connect … --force\`.\n`);
+	}
+	let raw;
+	try {
+		raw = JSON.parse(readFileSync(path, "utf8"));
+	} catch (err) {
+		throw new Error(`Profile ${path} is not valid JSON (${err.message}). Fix it or run \`${NPX} connect\` again.`);
+	}
+	const parsed = profileSchema.safeParse(raw);
+	if (!parsed.success) {
+		const issue = parsed.error.issues[0];
+		throw new Error(`Profile ${path} is invalid: ${issue?.path.join(".") || "file"}: ${issue?.message}`);
+	}
+	return parsed.data;
+}
+function saveProfile(name, profile) {
+	const path = profilePath(validProfileName(name));
+	const withName = {
+		...profile,
+		mcpServer: profile.mcpServer ?? mcpServerName(name)
+	};
+	const clean = Object.fromEntries(Object.entries(withName).filter(([, v]) => v !== void 0));
+	writePrivateFile(path, JSON.stringify(clean, null, 2) + "\n");
+	return path;
+}
+//#endregion
+export { mcpServerName as a, backupFile as c, tighten as d, writePrivateFile as f, saveProfile as i, ensurePrivateDir as l, loadProfile as n, profileBrand as o, profileExists as r, assertTrustedDir as s, listProfiles as t, isTooOpen as u };
+
+//# sourceMappingURL=profile-NmMKAczz.js.map

package/dist/profile-NmMKAczz.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile-NmMKAczz.js","names":[],"sources":["../server/listen/fsutil.ts","../server/listen/names.ts","../server/listen/profile.ts"],"sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from \"node:fs\";\nimport { dirname } from \"node:path\";\n\n/** Creates a directory (and parents) readable only by this user. Tightens an existing one. */\nexport function ensurePrivateDir(dir: string): void {\n  mkdirSync(dir, { recursive: true, mode: 0o700 });\n  if (process.platform !== \"win32\" && (statSync(dir).mode & 0o077) !== 0) chmodSync(dir, 0o700);\n}\n\n/**\n * Writes a file with mode 0600 atomically (temp file + rename), so a crash never leaves a\n * half-written profile and the secret is never briefly world-readable.\n */\nexport function writePrivateFile(linkOrPath: string, content: string, opts: { privateDir?: boolean } = {}): void {\n  // A symlinked config (dotfiles repos) is updated at its real location instead of being replaced by a plain file.\n  const path = resolveLink(linkOrPath);\n  if (opts.privateDir !== false) ensurePrivateDir(dirname(path));\n  else mkdirSync(dirname(path), { recursive: true });\n  const tmp = `${path}.${randomBytes(4).toString(\"hex\")}.tmp`;\n  try {\n    writeFileSync(tmp, content, { mode: 0o600, flag: \"wx\" });\n    chmodSync(tmp, 0o600);\n    renameSync(tmp, path);\n  } catch (err) {\n    rmSync(tmp, { force: true });\n    throw err;\n  }\n}\n\nfunction resolveLink(path: string): string {\n  try {\n    return lstatSync(path).isSymbolicLink() ? realpathSync(path) : path;\n  } catch {\n    return path;\n  }\n}\n\n/** Copies `path` next to itself as `<path>.xaq-backup-<timestamp>` (0600). Returns the copy, or null if there was nothing to back up. */\nexport function backupFile(path: string): string | null {\n  if (!existsSync(path)) return null;\n  const stamp = new Date().toISOString().replace(/[:.]/g, \"-\");\n  const content = readFileSync(path);\n  // Created 0600 and exclusively (never through an existing file or symlink), then filled.\n  for (let n = 0; ; n++) {\n    const backup = `${path}.xaq-backup-${stamp}${n ? `-${n}` : \"\"}`;\n    try {\n      writeFileSync(backup, content, { mode: 0o600, flag: \"wx\" });\n      return backup;\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException).code !== \"EEXIST\" || n > 20) throw err;\n    }\n  }\n}\n\n/** Tightens an existing file to 0600 (files created by appendFileSync keep their first mode). */\nexport function tighten(path: string): void {\n  if (process.platform !== \"win32\" && existsSync(path) && (statSync(path).mode & 0o077) !== 0) chmodSync(path, 0o600);\n}\n\n/**\n * A directory commands may run in: must exist, be owned by this user and not be writable by group or\n * others (otherwise someone else could plant agent instructions, MCP configs or hooks there).\n */\nexport function assertTrustedDir(dir: string): string {\n  let st;\n  try {\n    st = statSync(dir);\n  } catch {\n    throw new Error(`--cwd ${dir} does not exist.`);\n  }\n  if (!st.isDirectory()) throw new Error(`--cwd ${dir} is not a directory.`);\n  const uid = process.getuid?.();\n  if (uid !== undefined && st.uid !== uid) throw new Error(`Refusing --cwd ${dir}: it belongs to another user, who could plant instructions or hooks for the agent there.`);\n  if (process.platform !== \"win32\" && (st.mode & 0o022) !== 0) {\n    throw new Error(`Refusing --cwd ${dir}: it is writable by group or others (mode ${(st.mode & 0o777).toString(8)}). Use a directory only you can write to.`);\n  }\n  // A parent others can write to (without the sticky bit) lets them swap this directory out.\n  for (let p = dirname(dir); p !== dirname(p); p = dirname(p)) {\n    try {\n      const ps = statSync(p);\n      if (process.platform !== \"win32\" && (ps.mode & 0o022) !== 0 && (ps.mode & 0o1000) === 0) {\n        process.stderr.write(`warning: --cwd ${dir}: its parent ${p} is writable by group or others, so they could replace it.\\n`);\n        break;\n      }\n    } catch {\n      break;\n    }\n  }\n  return dir;\n}\n\n/** True when group or others can read/write the file. */\nexport const isTooOpen = (path: string) => process.platform !== \"win32\" && (statSync(path).mode & 0o077) !== 0;\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { LEGACY_PRODUCT, PRODUCT } from \"../brand.ts\";\nimport { DEFAULT_PROFILE, profilePath, validProfileName } from \"./paths.ts\";\n\n/**\n * The names a profile is known by in the agent's tools: its MCP server (`xaq`, or `xaq-<profile>`), which\n * is also its Hermes webhook route and, as `mcp-<server>`, the route's toolset.\n *\n * A profile made before the rename keeps `agentinbox` / `agentinbox-<profile>`: Hermes routes are confined\n * to `toolsets: [\"mcp-agentinbox\"]` and cron jobs to `[\"agentinbox\"]`, saved Claude Code recipes allow\n * `mcp__agentinbox`, and the client configs register that name. Renaming any of them would quietly break\n * the others. So the name is saved in the profile (`mcpServer`): new profiles get `xaq…`, and a profile\n * without the field was made by agentinbox and keeps `agentinbox…` (written into the file the next time\n * it is saved).\n */\n\nconst SERVER_NAME_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/;\nexport const isServerName = (s: unknown): s is string => typeof s === \"string\" && SERVER_NAME_RE.test(s);\n\nconst named = (base: string, profile: string) => (profile === DEFAULT_PROFILE ? base : `${base}-${profile}`);\n/** The MCP server name a new profile gets. */\nexport const newServerName = (profile: string) => named(PRODUCT, validProfileName(profile));\n/** The name a profile from before the rename was registered under. */\nexport const legacyServerName = (profile: string) => named(LEGACY_PRODUCT, validProfileName(profile));\n\n/**\n * The server name saved in the profile file; for a profile file without one (made before the rename),\n * the pre-rename name; null when there is no profile file yet.\n */\nexport function savedServerName(profile: string): string | null {\n  const path = profilePath(validProfileName(profile));\n  if (!existsSync(path)) return null;\n  try {\n    const saved = (JSON.parse(readFileSync(path, \"utf8\")) as { mcpServer?: unknown } | null)?.mcpServer;\n    if (isServerName(saved)) return saved;\n  } catch {\n    // Unreadable: loadProfile reports that properly; the name falls back like an old profile's.\n  }\n  return legacyServerName(profile);\n}\n\n/** The MCP server (and Hermes route) name for a profile: see the comment at the top. */\nexport const mcpServerName = (profile: string): string => savedServerName(profile) ?? newServerName(profile);\n\n/**\n * The product name a profile's own texts use: \"agentinbox\" for a profile that kept its pre-rename names,\n * else \"xaq\". It names the server in the keyless Claude Code MCP config (`mcp__<it>` in the recipe) and\n * appears in the recipe prompts, so the commands saved in an old profile still match its recipes exactly.\n */\nexport const profileBrand = (profile: string): string => (mcpServerName(profile) === legacyServerName(profile) ? LEGACY_PRODUCT : PRODUCT);\n","import { chmodSync, existsSync, readdirSync, readFileSync, rmSync } from \"node:fs\";\nimport { z } from \"zod\";\nimport type { AgentTool, ListenerConfig } from \"../../shared/agent-api.ts\";\nimport { type EventType, isEventType } from \"../../shared/types.ts\";\nimport { webhookFilterSchema } from \"../webhooks/filter.ts\";\nimport { isTooOpen, writePrivateFile } from \"./fsutil.ts\";\nimport { isServerName, mcpServerName } from \"./names.ts\";\nimport { DEFAULT_PROFILE, profilePath, profilesDir, validProfileName } from \"./paths.ts\";\nimport { NPX } from \"./version.ts\";\n\n/**\n * A profile file: the shared ListenerConfig plus a few agent-side extras. Holds the agent's API key,\n * so it is always 0600 inside a 0700 directory, and nothing ever prints it.\n */\nexport interface Profile extends ListenerConfig {\n  tool?: AgentTool;\n  mcpUrl?: string;\n  skillUrl?: string;\n  /** Forward-mode signing secret while no forward URL is saved (see forwardSecret()). */\n  forwardSecret?: string;\n  /** Working directory for --exec commands (default: a private dir in the state dir). */\n  cwd?: string;\n  /** Senders / labels to skip (listener-side; `--not-from`, `--not-label`). */\n  exclude?: { from?: string[]; labelIds?: string[] };\n  /** Gmail category labels to skip; absent = the default (promotions, social, forums), [] = none. */\n  skipCategories?: string[];\n  /** `--batch`: seconds to collect events into one --exec run. */\n  batchSeconds?: number;\n  /**\n   * The MCP server name (also the Hermes route) registered for this profile: `xaq[-<profile>]`, or the\n   * pre-rename `agentinbox[-<profile>]` it was set up with. Filled in on save; see names.ts. (rename-xaq: keep)\n   */\n  mcpServer?: string;\n  createdAt?: string;\n}\n\nconst TOOLS = [\"claude-code\", \"codex\", \"cursor\", \"hermes\", \"other\"] as const;\n\nconst profileSchema = z\n  .object({\n    url: z.string().refine((u) => URL.canParse(u), \"url must be a full URL\"),\n    apiKey: z.string().min(8),\n    agentId: z.string().min(1),\n    agentName: z.string(),\n    consumer: z.string().min(1).max(100),\n    insecure: z.boolean().optional(),\n    types: z\n      .array(z.string().refine(isEventType))\n      .transform((t) => t as EventType[])\n      .optional(),\n    filter: webhookFilterSchema.optional(),\n    includeBody: z.boolean().optional(),\n    exec: z.string().min(1).optional(),\n    forward: z.object({ url: z.string(), secret: z.string().startsWith(\"whsec_\") }).optional(),\n    concurrency: z.number().int().min(1).max(32).optional(),\n    timeoutSeconds: z.number().int().min(1).max(86_400).optional(),\n    maxAttempts: z.number().int().min(1).max(100).optional(),\n    tool: z.enum(TOOLS).optional(),\n    mcpUrl: z.string().optional(),\n    skillUrl: z.string().optional(),\n    forwardSecret: z.string().startsWith(\"whsec_\").optional(),\n    cwd: z.string().startsWith(\"/\").optional(),\n    exclude: webhookFilterSchema.pick({ from: true, labelIds: true }).optional(),\n    skipCategories: z.array(z.string().regex(/^CATEGORY_[A-Z]+$/)).max(10).optional(),\n    batchSeconds: z.number().int().min(1).max(3600).optional(),\n    mcpServer: z.string().refine(isServerName, \"mcpServer must be a plain name\").optional(),\n    createdAt: z.string().optional(),\n  })\n  .loose();\n\nexport const profileExists = (name: string) => existsSync(profilePath(validProfileName(name)));\n\nexport function listProfiles(): string[] {\n  if (!existsSync(profilesDir())) return [];\n  return readdirSync(profilesDir())\n    .filter((f) => f.endsWith(\".json\"))\n    .map((f) => f.slice(0, -5))\n    .sort();\n}\n\nexport function loadProfile(name: string = DEFAULT_PROFILE): Profile {\n  const n = validProfileName(name);\n  const path = profilePath(n);\n  if (!existsSync(path)) {\n    const others = listProfiles();\n    const hint = others.length ? ` Known profiles: ${others.join(\", \")} (pick one with --profile).` : ` Run \\`${NPX} connect <daemon-url>\\` first.`;\n    throw new Error(`No xaq profile \"${n}\" (${path}).${hint}`);\n  }\n  // Someone loosened the permissions: tighten them, and say the key may have been read meanwhile.\n  if (isTooOpen(path)) {\n    chmodSync(path, 0o600);\n    process.stderr.write(\n      `warning: ${path} was readable by other users; it is 0600 again. If anyone else could have read it, rotate the agent's key in the console and run \\`${NPX} connect … --force\\`.\\n`,\n    );\n  }\n  let raw: unknown;\n  try {\n    raw = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch (err) {\n    throw new Error(`Profile ${path} is not valid JSON (${(err as Error).message}). Fix it or run \\`${NPX} connect\\` again.`);\n  }\n  const parsed = profileSchema.safeParse(raw);\n  if (!parsed.success) {\n    const issue = parsed.error.issues[0];\n    throw new Error(`Profile ${path} is invalid: ${issue?.path.join(\".\") || \"file\"}: ${issue?.message}`);\n  }\n  return parsed.data as Profile;\n}\n\nexport function saveProfile(name: string, profile: Profile): string {\n  const path = profilePath(validProfileName(name));\n  // The server name is pinned on every save: a new profile gets xaq…, one from before the rename (or one\n  // replaced by `connect --force`) keeps the name its agent tools and Hermes routes already use.\n  const withName: Profile = { ...profile, mcpServer: profile.mcpServer ?? mcpServerName(name) };\n  const clean = Object.fromEntries(Object.entries(withName).filter(([, v]) => v !== undefined));\n  writePrivateFile(path, JSON.stringify(clean, null, 2) + \"\\n\");\n  return path;\n}\n\nexport function deleteProfile(name: string): void {\n  rmSync(profilePath(validProfileName(name)), { force: true });\n}\n"],"mappings":";;;;;;;;;;;;AAKA,SAAgB,iBAAiB,KAAmB;CAClD,UAAU,KAAK;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CAC/C,IAAI,QAAQ,aAAa,YAAY,SAAS,GAAG,CAAC,CAAC,OAAO,QAAW,GAAG,UAAU,KAAK,GAAK;AAC9F;;;;;AAMA,SAAgB,iBAAiB,YAAoB,SAAiB,OAAiC,CAAC,GAAS;CAE/G,MAAM,OAAO,YAAY,UAAU;CACnC,IAAI,KAAK,eAAe,OAAO,iBAAiB,QAAQ,IAAI,CAAC;MACxD,UAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CACjD,MAAM,MAAM,GAAG,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE;CACtD,IAAI;EACF,cAAc,KAAK,SAAS;GAAE,MAAM;GAAO,MAAM;EAAK,CAAC;EACvD,UAAU,KAAK,GAAK;EACpB,WAAW,KAAK,IAAI;CACtB,SAAS,KAAK;EACZ,OAAO,KAAK,EAAE,OAAO,KAAK,CAAC;EAC3B,MAAM;CACR;AACF;AAEA,SAAS,YAAY,MAAsB;CACzC,IAAI;EACF,OAAO,UAAU,IAAI,CAAC,CAAC,eAAe,IAAI,aAAa,IAAI,IAAI;CACjE,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,WAAW,MAA6B;CACtD,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,MAAM,yBAAQ,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,QAAQ,SAAS,GAAG;CAC3D,MAAM,UAAU,aAAa,IAAI;CAEjC,KAAK,IAAI,IAAI,IAAK,KAAK;EACrB,MAAM,SAAS,GAAG,KAAK,cAAc,QAAQ,IAAI,IAAI,MAAM;EAC3D,IAAI;GACF,cAAc,QAAQ,SAAS;IAAE,MAAM;IAAO,MAAM;GAAK,CAAC;GAC1D,OAAO;EACT,SAAS,KAAK;GACZ,IAAK,IAA8B,SAAS,YAAY,IAAI,IAAI,MAAM;EACxE;CACF;AACF;;AAGA,SAAgB,QAAQ,MAAoB;CAC1C,IAAI,QAAQ,aAAa,WAAW,WAAW,IAAI,MAAM,SAAS,IAAI,CAAC,CAAC,OAAO,QAAW,GAAG,UAAU,MAAM,GAAK;AACpH;;;;;AAMA,SAAgB,iBAAiB,KAAqB;CACpD,IAAI;CACJ,IAAI;EACF,KAAK,SAAS,GAAG;CACnB,QAAQ;EACN,MAAM,IAAI,MAAM,SAAS,IAAI,iBAAiB;CAChD;CACA,IAAI,CAAC,GAAG,YAAY,GAAG,MAAM,IAAI,MAAM,SAAS,IAAI,qBAAqB;CACzE,MAAM,MAAM,QAAQ,SAAS;CAC7B,IAAI,QAAQ,KAAA,KAAa,GAAG,QAAQ,KAAK,MAAM,IAAI,MAAM,kBAAkB,IAAI,yFAAyF;CACxK,IAAI,QAAQ,aAAa,YAAY,GAAG,OAAO,QAAW,GACxD,MAAM,IAAI,MAAM,kBAAkB,IAAI,6CAA6C,GAAG,OAAO,IAAA,CAAO,SAAS,CAAC,EAAE,0CAA0C;CAG5J,KAAK,IAAI,IAAI,QAAQ,GAAG,GAAG,MAAM,QAAQ,CAAC,GAAG,IAAI,QAAQ,CAAC,GACxD,IAAI;EACF,MAAM,KAAK,SAAS,CAAC;EACrB,IAAI,QAAQ,aAAa,YAAY,GAAG,OAAO,QAAW,MAAM,GAAG,OAAO,SAAY,GAAG;GACvF,QAAQ,OAAO,MAAM,kBAAkB,IAAI,eAAe,EAAE,6DAA6D;GACzH;EACF;CACF,QAAQ;EACN;CACF;CAEF,OAAO;AACT;;AAGA,MAAa,aAAa,SAAiB,QAAQ,aAAa,YAAY,SAAS,IAAI,CAAC,CAAC,OAAO,QAAW;;;;;;;;;;;;;;AC7E7G,MAAM,iBAAiB;AACvB,MAAa,gBAAgB,MAA4B,OAAO,MAAM,YAAY,eAAe,KAAK,CAAC;AAEvG,MAAM,SAAS,MAAc,YAAqB,YAAA,YAA8B,OAAO,GAAG,KAAK,GAAG;;AAElG,MAAa,iBAAiB,YAAoB,MAAA,OAAe,iBAAiB,OAAO,CAAC;;AAE1F,MAAa,oBAAoB,YAAoB,MAAM,gBAAgB,iBAAiB,OAAO,CAAC;;;;;AAMpG,SAAgB,gBAAgB,SAAgC;CAC9D,MAAM,OAAO,YAAY,iBAAiB,OAAO,CAAC;CAClD,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,IAAI;EACF,MAAM,QAAS,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC,CAAC,EAAqC;EAC1F,IAAI,aAAa,KAAK,GAAG,OAAO;CAClC,QAAQ,CAER;CACA,OAAO,iBAAiB,OAAO;AACjC;;AAGA,MAAa,iBAAiB,YAA4B,gBAAgB,OAAO,KAAK,cAAc,OAAO;;;;;;AAO3G,MAAa,gBAAgB,YAA6B,cAAc,OAAO,MAAM,iBAAiB,OAAO,IAAI,iBAAA;;;ACXjH,MAAM,gBAAgB,EACnB,OAAO;CACN,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,MAAM,IAAI,SAAS,CAAC,GAAG,wBAAwB;CACvE,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACxB,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CACzB,WAAW,EAAE,OAAO;CACpB,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;CACnC,UAAU,EAAE,QAAQ,CAAC,CAAC,SAAS;CAC/B,OAAO,EACJ,MAAM,EAAE,OAAO,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,CACrC,WAAW,MAAM,CAAgB,CAAC,CAClC,SAAS;CACZ,QAAQ,oBAAoB,SAAS;CACrC,aAAa,EAAE,QAAQ,CAAC,CAAC,SAAS;CAClC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;CACjC,SAAS,EAAE,OAAO;EAAE,KAAK,EAAE,OAAO;EAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,WAAW,QAAQ;CAAE,CAAC,CAAC,CAAC,SAAS;CACzF,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS;CACtD,gBAAgB,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAM,CAAC,CAAC,SAAS;CAC7D,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,SAAS;CACvD,MAAM,EAAE,KAAK;EArBF;EAAe;EAAS;EAAU;EAAU;CAqBtC,CAAC,CAAC,CAAC,SAAS;CAC7B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS;CAC5B,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS;CAC9B,eAAe,EAAE,OAAO,CAAC,CAAC,WAAW,QAAQ,CAAC,CAAC,SAAS;CACxD,KAAK,EAAE,OAAO,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,SAAS;CACzC,SAAS,oBAAoB,KAAK;EAAE,MAAM;EAAM,UAAU;CAAK,CAAC,CAAC,CAAC,SAAS;CAC3E,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS;CAChF,cAAc,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS;CACzD,WAAW,EAAE,OAAO,CAAC,CAAC,OAAO,cAAc,gCAAgC,CAAC,CAAC,SAAS;CACtF,WAAW,EAAE,OAAO,CAAC,CAAC,SAAS;AACjC,CAAC,CAAC,CACD,MAAM;AAET,MAAa,iBAAiB,SAAiB,WAAW,YAAY,iBAAiB,IAAI,CAAC,CAAC;AAE7F,SAAgB,eAAyB;CACvC,IAAI,CAAC,WAAW,YAAY,CAAC,GAAG,OAAO,CAAC;CACxC,OAAO,YAAY,YAAY,CAAC,CAAC,CAC9B,QAAQ,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC,CAClC,KAAK,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC,CAAC,CAC1B,KAAK;AACV;AAEA,SAAgB,YAAY,OAAe,iBAA0B;CACnE,MAAM,IAAI,iBAAiB,IAAI;CAC/B,MAAM,OAAO,YAAY,CAAC;CAC1B,IAAI,CAAC,WAAW,IAAI,GAAG;EACrB,MAAM,SAAS,aAAa;EAC5B,MAAM,OAAO,OAAO,SAAS,oBAAoB,OAAO,KAAK,IAAI,EAAE,+BAA+B,UAAU,IAAI;EAChH,MAAM,IAAI,MAAM,mBAAmB,EAAE,KAAK,KAAK,IAAI,MAAM;CAC3D;CAEA,IAAI,UAAU,IAAI,GAAG;EACnB,UAAU,MAAM,GAAK;EACrB,QAAQ,OAAO,MACb,YAAY,KAAK,qIAAqI,IAAI,wBAC5J;CACF;CACA,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;CAC7C,SAAS,KAAK;EACZ,MAAM,IAAI,MAAM,WAAW,KAAK,sBAAuB,IAAc,QAAQ,qBAAqB,IAAI,kBAAkB;CAC1H;CACA,MAAM,SAAS,cAAc,UAAU,GAAG;CAC1C,IAAI,CAAC,OAAO,SAAS;EACnB,MAAM,QAAQ,OAAO,MAAM,OAAO;EAClC,MAAM,IAAI,MAAM,WAAW,KAAK,eAAe,OAAO,KAAK,KAAK,GAAG,KAAK,OAAO,IAAI,OAAO,SAAS;CACrG;CACA,OAAO,OAAO;AAChB;AAEA,SAAgB,YAAY,MAAc,SAA0B;CAClE,MAAM,OAAO,YAAY,iBAAiB,IAAI,CAAC;CAG/C,MAAM,WAAoB;EAAE,GAAG;EAAS,WAAW,QAAQ,aAAa,cAAc,IAAI;CAAE;CAC5F,MAAM,QAAQ,OAAO,YAAY,OAAO,QAAQ,QAAQ,CAAC,CAAC,QAAQ,GAAG,OAAO,MAAM,KAAA,CAAS,CAAC;CAC5F,iBAAiB,MAAM,KAAK,UAAU,OAAO,MAAM,CAAC,IAAI,IAAI;CAC5D,OAAO;AACT"}