xaq-cli 0.1.0-nightly.73 → 0.1.0-nightly.75

package/dist/cli.js

@@ -59,7 +59,7 @@ const SERVER_GROUP = "Run xaq:";
 const AGENT_GROUP = "On an agent's machine:";
 withServerOptions(program.command("start", { isDefault: true }).description("run xaq in this terminal and print the setup link (the default command)").summary("run it in this terminal (the default command)").helpGroup(SERVER_GROUP)).option("--no-open", "don't open a browser on first run").option("--dev", "development: API only, the console runs on Vite (:5173)").allowExcessArguments().action(async (o, cmd) => {
 	if (cmd.args.length) throw new Error(unknownCommand(cmd.args[0]));
-	const { runForeground } = await import("./server-BlOM8g-z.js");
+	const { runForeground } = await import("./server-W9kGk9Jl.js");
 	await runForeground({
 		...configInput(o),
 		dev: !!o.dev,
@@ -140,7 +140,7 @@ program.command("reset-password").description("forgot the console password? Remo
 });
 const { registerListenCommands } = await import("./commands-tyhvFqiJ.js");
 registerListenCommands(program);
-const { registerConnectionsCommands } = await import("./commands-BXSQe3Za.js");
+const { registerConnectionsCommands } = await import("./commands-DsKEU8Pe.js");
 registerConnectionsCommands(program);
 const AGENT_SUMMARIES = {
 	connect: "pair an agent; you approve it in the console",

package/dist/{commands-BXSQe3Za.js → commands-DsKEU8Pe.js}

@@ -50,23 +50,23 @@ Examples:
   ${NPX} connections add notion
   ${NPX} connections add https://mcp.example.com/mcp --access read
   ${NPX} connections add http://127.0.0.1:8787/mcp      # asks before allowing a server on this machine`).action(async (target, o) => {
-		const { addConnection } = await import("./manage-DoXqvjnU.js");
+		const { addConnection } = await import("./manage-Dx5Ok81O.js");
 		process.exitCode = await withApi(o, (deps) => addConnection(target, o, deps));
 	});
 	dataOption(connections.command("list").description("list connections with their status and access")).action(async (o) => {
-		const { listConnections } = await import("./manage-DoXqvjnU.js");
+		const { listConnections } = await import("./manage-Dx5Ok81O.js");
 		process.exitCode = await withApi(o, (deps) => listConnections(deps));
 	});
 	dataOption(connections.command("reconnect").description("sign in again (OAuth) or replace the key (header)").argument("<name>", "the connection's name")).option("--paste", "paste the address the browser lands on (automatic over SSH)").option("--header <name>", "header connections: the header's name (default: asks, Authorization)").action(async (slug, o) => {
-		const { reconnectConnection } = await import("./manage-DoXqvjnU.js");
+		const { reconnectConnection } = await import("./manage-Dx5Ok81O.js");
 		process.exitCode = await withApi(o, (deps) => reconnectConnection(slug, o, deps));
 	});
 	dataOption(connections.command("disable").description("turn a connection off at once (the kill switch); turn it back on in the console").argument("<name>", "the connection's name")).option("-y, --yes", "don't ask").action(async (slug, o) => {
-		const { disableConnection } = await import("./manage-DoXqvjnU.js");
+		const { disableConnection } = await import("./manage-Dx5Ok81O.js");
 		process.exitCode = await withApi(o, (deps) => disableConnection(slug, deps));
 	});
 	dataOption(connections.command("remove").description("remove a connection and delete its credentials").argument("<name>", "the connection's name")).option("-y, --yes", "don't ask").action(async (slug, o) => {
-		const { removeConnection } = await import("./manage-DoXqvjnU.js");
+		const { removeConnection } = await import("./manage-Dx5Ok81O.js");
 		process.exitCode = await withApi(o, (deps) => removeConnection(slug, deps));
 	});
 	dataOption(program.command("import", { hidden: false }).description("move an agent tool's MCP servers into xaq: one connection each, credentials moved into xaq").summary("import MCP servers from Hermes, Claude Code, Cursor or Codex").helpGroup(GROUP).requiredOption("--from <client>", "hermes, claude-code, cursor or codex")).option("--dry-run", "print exactly what would be created and changed, and change nothing").option("--access <level>", "for every imported connection: full, ask (the default) or read").option("--agent <name>", "an agent that gets them (repeatable; default: all agents; \"all\")", collect).option("--profile <name>", "the agent profile setup-mcp uses for the single xaq entry (default \"default\")").option("--allow-private <origin>", "allow this exact scheme://host:port on this machine or a private network without asking (repeatable; --yes never does)", collect).option("-y, --yes", "answer yes to the confirmations (scripts); never to a private-network allow or a project's .mcp.json servers").addHelpText("after", `
@@ -81,7 +81,7 @@ with the single xaq entry, after a timestamped backup. The entry keeps the name
 Examples:
   ${NPX} import --from hermes --dry-run
   ${NPX} import --from hermes`).action(async (o) => {
-		const { runImport } = await import("./import-D0af7Fv-.js");
+		const { runImport } = await import("./import-CjXjx6hA.js");
 		const self = await selfOrigins(dataDirOf(o));
 		if (o.dryRun) {
 			const { TerminalPrompter } = await import("./prompt-CKMQx_MJ.js");
@@ -109,4 +109,4 @@ Examples:
 //#endregion
 export { registerConnectionsCommands };
 
-//# sourceMappingURL=commands-BXSQe3Za.js.map
+//# sourceMappingURL=commands-DsKEU8Pe.js.map

package/dist/{commands-BXSQe3Za.js.map → commands-DsKEU8Pe.js.map}

@@ -1 +1 @@
-{"version":3,"file":"commands-BXSQe3Za.js","names":[],"sources":["../server/connections-cli/commands.ts"],"sourcesContent":["import type { Command } from \"commander\";\nimport { NPX } from \"../listen/version.ts\";\nimport { LEGACY_PRODUCT } from \"../brand.ts\";\nimport { resolveDataDir } from \"../config.ts\";\n\n/**\n * `connections …` and `import --from …`: run on the daemon's machine, talking to its admin API through the\n * one-time local admin session (admin.ts). Listed in --help since the console (#65) shipped; while the daemon's\n * `brokerUpstreams` setting is off they say so (CONNECTIONS_VISIBLE).\n */\nexport const CONNECTIONS_VISIBLE = true;\nconst GROUP = \"MCP connections (on xaq's machine):\";\n\nconst collect = (value: string, previous: string[] | undefined) => [...(previous ?? []), value];\n// --data, else XAQ_DATA (AGENTINBOX_DATA), else ~/.xaq or an existing pre-rename ~/.agentinbox (config.ts; rename-xaq: keep).\nconst dataDirOf = (o: { data?: string }) => resolveDataDir(o.data, { quiet: true });\nconst dataOption = (cmd: Command) => cmd.option(\"-d, --data <dir>\", `xaq's data directory (default ~/.xaq, or an existing ~/.${LEGACY_PRODUCT}; env XAQ_DATA)`);\n\nasync function withApi<T>(o: { data?: string; yes?: boolean }, run: (deps: { api: import(\"./api.ts\").ConnectionsApi; prompter: import(\"./prompt.ts\").Prompter }) => Promise<T>): Promise<T> {\n  const { CLEANUP_SIGNALS, openAdminChannel } = await import(\"./admin.ts\");\n  const { ConnectionsApi } = await import(\"./api.ts\");\n  const { TerminalPrompter } = await import(\"./prompt.ts\");\n  const channel = openAdminChannel({ dataDir: dataDirOf(o) });\n  const handlers = CLEANUP_SIGNALS.map((sig) => {\n    const h = () => {\n      channel.close();\n      process.exit(sig === \"SIGINT\" ? 130 : 128 + (sig === \"SIGTERM\" ? 15 : 1));\n    };\n    process.once(sig, h);\n    return [sig, h] as const;\n  });\n  try {\n    return await run({ api: new ConnectionsApi(channel), prompter: new TerminalPrompter(!!o.yes) });\n  } finally {\n    for (const [sig, h] of handlers) process.removeListener(sig, h);\n    channel.close();\n  }\n}\n\n/** This xaq's own MCP origins, so `import` never imports its own entry. */\nasync function selfOrigins(dataDir: string): Promise<string[]> {\n  const { runningInstance } = await import(\"../instance.ts\");\n  const { daemonOrigin } = await import(\"./admin.ts\");\n  const running = runningInstance(dataDir);\n  if (!running) return [];\n  return [daemonOrigin(running), `http://localhost:${running.port}`, `http://127.0.0.1:${running.port}`, `http://[::1]:${running.port}`];\n}\n\nexport function registerConnectionsCommands(program: Command): void {\n  const connections = program\n    .command(\"connections\", { hidden: !CONNECTIONS_VISIBLE })\n    .description(\"the MCP servers xaq connects agents to (Notion, WHOOP, any MCP URL); run on xaq's machine\")\n    .summary(\"add, list, reconnect or remove connected MCP servers\")\n    .helpGroup(GROUP);\n\n  dataOption(\n    connections\n      .command(\"add\")\n      .description(\"connect an integration (notion, whoop) or any MCP server URL, interactively\")\n      .argument(\"<integration-or-url>\", \"notion, whoop, or an MCP server URL such as https://mcp.example.com/mcp\"),\n  )\n    .option(\"--slug <name>\", \"its name: agents see its tools as <name>__<tool>\")\n    .option(\"--access <level>\", \"full, ask (ask before risky actions; the default) or read\")\n    .option(\"--agent <name>\", 'an agent that gets it (repeatable; default: all agents; \"all\")', collect)\n    .option(\"--header <name>\", \"header for a server that wants a static key (default Authorization)\")\n    .option(\"--paste\", \"paste the address the browser lands on after signing in, instead of waiting for the redirect (automatic over SSH)\")\n    .option(\"--allow-private <origin>\", \"allow this exact scheme://host:port on this machine or a private network without asking (--yes never does)\")\n    .option(\"-y, --yes\", \"answer yes to confirmations and take the defaults (never to a private-network allow)\")\n    .addHelpText(\n      \"after\",\n      `\nExamples:\n  ${NPX} connections add notion\n  ${NPX} connections add https://mcp.example.com/mcp --access read\n  ${NPX} connections add http://127.0.0.1:8787/mcp      # asks before allowing a server on this machine`,\n    )\n    .action(async (target: string, o: import(\"./manage.ts\").AddFlags & { data?: string }) => {\n      const { addConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => addConnection(target, o, deps));\n    });\n\n  dataOption(connections.command(\"list\").description(\"list connections with their status and access\")).action(async (o: { data?: string }) => {\n    const { listConnections } = await import(\"./manage.ts\");\n    process.exitCode = await withApi(o, (deps) => listConnections(deps));\n  });\n\n  dataOption(connections.command(\"reconnect\").description(\"sign in again (OAuth) or replace the key (header)\").argument(\"<name>\", \"the connection's name\"))\n    .option(\"--paste\", \"paste the address the browser lands on (automatic over SSH)\")\n    .option(\"--header <name>\", \"header connections: the header's name (default: asks, Authorization)\")\n    .action(async (slug: string, o: { data?: string; paste?: boolean; header?: string }) => {\n      const { reconnectConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => reconnectConnection(slug, o, deps));\n    });\n\n  dataOption(connections.command(\"disable\").description(\"turn a connection off at once (the kill switch); turn it back on in the console\").argument(\"<name>\", \"the connection's name\"))\n    .option(\"-y, --yes\", \"don't ask\")\n    .action(async (slug: string, o: { data?: string; yes?: boolean }) => {\n      const { disableConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => disableConnection(slug, deps));\n    });\n\n  dataOption(connections.command(\"remove\").description(\"remove a connection and delete its credentials\").argument(\"<name>\", \"the connection's name\"))\n    .option(\"-y, --yes\", \"don't ask\")\n    .action(async (slug: string, o: { data?: string; yes?: boolean }) => {\n      const { removeConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => removeConnection(slug, deps));\n    });\n\n  dataOption(\n    program\n      .command(\"import\", { hidden: !CONNECTIONS_VISIBLE })\n      .description(\"move an agent tool's MCP servers into xaq: one connection each, credentials moved into xaq\")\n      .summary(\"import MCP servers from Hermes, Claude Code, Cursor or Codex\")\n      .helpGroup(GROUP)\n      .requiredOption(\"--from <client>\", \"hermes, claude-code, cursor or codex\"),\n  )\n    .option(\"--dry-run\", \"print exactly what would be created and changed, and change nothing\")\n    .option(\"--access <level>\", \"for every imported connection: full, ask (the default) or read\")\n    .option(\"--agent <name>\", 'an agent that gets them (repeatable; default: all agents; \"all\")', collect)\n    .option(\"--profile <name>\", \"the agent profile setup-mcp uses for the single xaq entry (default \\\"default\\\")\")\n    .option(\"--allow-private <origin>\", \"allow this exact scheme://host:port on this machine or a private network without asking (repeatable; --yes never does)\", collect)\n    .option(\"-y, --yes\", \"answer yes to the confirmations (scripts); never to a private-network allow or a project's .mcp.json servers\")\n    .addHelpText(\n      \"after\",\n      `\nReads: hermes ~/.hermes/config.yaml mcp_servers (+ ~/.hermes/.env) · claude-code ~/.claude.json and ./.mcp.json ·\ncursor ~/.cursor/mcp.json · codex ~/.codex/config.toml. Static headers move into xaq (encrypted); OAuth\nservers are created needing Connect (their tokens stay in the client); local (stdio) servers aren't supported yet\nand stay where they are. Servers on this machine or a private network are created only after you confirm the exact\nhost:port. Then it offers setup-mcp --tool <client>, which replaces the entries that now work through xaq\nwith the single xaq entry, after a timestamped backup. The entry keeps the name the profile already uses (\"xaq\", or\n\"${LEGACY_PRODUCT}\" for a profile set up before the rename), so Hermes routes and cron jobs confined to it keep working.\n\nExamples:\n  ${NPX} import --from hermes --dry-run\n  ${NPX} import --from hermes`,\n    )\n    .action(async (o: import(\"./import.ts\").ImportFlags & { data?: string }) => {\n      const { runImport } = await import(\"./import.ts\");\n      const self = await selfOrigins(dataDirOf(o));\n      if (o.dryRun) {\n        // Read-only: the admin channel (when the daemon runs) only lists existing connections.\n        const { TerminalPrompter } = await import(\"./prompt.ts\");\n        const { openAdminChannel } = await import(\"./admin.ts\");\n        const { ConnectionsApi } = await import(\"./api.ts\");\n        let channel: import(\"./admin.ts\").AdminChannel | null = null;\n        try {\n          process.exitCode = await runImport(o, {\n            prompter: new TerminalPrompter(!!o.yes),\n            openApi: () => new ConnectionsApi((channel = openAdminChannel({ dataDir: dataDirOf(o) }))),\n            selfOrigins: self,\n          });\n        } finally {\n          (channel as import(\"./admin.ts\").AdminChannel | null)?.close();\n        }\n        return;\n      }\n      process.exitCode = await withApi(o, (deps) => runImport(o, { prompter: deps.prompter, openApi: () => deps.api, selfOrigins: self }));\n    });\n}\n"],"mappings":";;;;;AAWA,MAAM,QAAQ;AAEd,MAAM,WAAW,OAAe,aAAmC,CAAC,GAAI,YAAY,CAAC,GAAI,KAAK;AAE9F,MAAM,aAAa,MAAyB,eAAe,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC;AAClF,MAAM,cAAc,QAAiB,IAAI,OAAO,oBAAoB,2DAA2D,eAAe,gBAAgB;AAE9J,eAAe,QAAW,GAAqC,KAA6H;CAC1L,MAAM,EAAE,iBAAiB,qBAAqB,MAAM,OAAO;CAC3D,MAAM,EAAE,mBAAmB,MAAM,OAAO;CACxC,MAAM,EAAE,qBAAqB,MAAM,OAAO;CAC1C,MAAM,UAAU,iBAAiB,EAAE,SAAS,UAAU,CAAC,EAAE,CAAC;CAC1D,MAAM,WAAW,gBAAgB,KAAK,QAAQ;EAC5C,MAAM,UAAU;GACd,QAAQ,MAAM;GACd,QAAQ,KAAK,QAAQ,WAAW,MAAM,OAAO,QAAQ,YAAY,KAAK,EAAE;EAC1E;EACA,QAAQ,KAAK,KAAK,CAAC;EACnB,OAAO,CAAC,KAAK,CAAC;CAChB,CAAC;CACD,IAAI;EACF,OAAO,MAAM,IAAI;GAAE,KAAK,IAAI,eAAe,OAAO;GAAG,UAAU,IAAI,iBAAiB,CAAC,CAAC,EAAE,GAAG;EAAE,CAAC;CAChG,UAAU;EACR,KAAK,MAAM,CAAC,KAAK,MAAM,UAAU,QAAQ,eAAe,KAAK,CAAC;EAC9D,QAAQ,MAAM;CAChB;AACF;;AAGA,eAAe,YAAY,SAAoC;CAC7D,MAAM,EAAE,oBAAoB,MAAM,OAAO;CACzC,MAAM,EAAE,iBAAiB,MAAM,OAAO;CACtC,MAAM,UAAU,gBAAgB,OAAO;CACvC,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,OAAO;EAAC,aAAa,OAAO;EAAG,oBAAoB,QAAQ;EAAQ,oBAAoB,QAAQ;EAAQ,gBAAgB,QAAQ;CAAM;AACvI;AAEA,SAAgB,4BAA4B,SAAwB;CAClE,MAAM,cAAc,QACjB,QAAQ,eAAe,EAAE,QAAQ,MAAqB,CAAC,CAAC,CACxD,YAAY,2FAA2F,CAAC,CACxG,QAAQ,sDAAsD,CAAC,CAC/D,UAAU,KAAK;CAElB,WACE,YACG,QAAQ,KAAK,CAAC,CACd,YAAY,6EAA6E,CAAC,CAC1F,SAAS,wBAAwB,yEAAyE,CAC/G,CAAC,CACE,OAAO,iBAAiB,kDAAkD,CAAC,CAC3E,OAAO,oBAAoB,2DAA2D,CAAC,CACvF,OAAO,kBAAkB,oEAAkE,OAAO,CAAC,CACnG,OAAO,mBAAmB,qEAAqE,CAAC,CAChG,OAAO,WAAW,mHAAmH,CAAC,CACtI,OAAO,4BAA4B,4GAA4G,CAAC,CAChJ,OAAO,aAAa,sFAAsF,CAAC,CAC3G,YACC,SACA;;IAEF,IAAI;IACJ,IAAI;IACJ,IAAI,gGACJ,CAAC,CACA,OAAO,OAAO,QAAgB,MAA0D;EACvF,MAAM,EAAE,kBAAkB,MAAM,OAAO;EACvC,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,cAAc,QAAQ,GAAG,IAAI,CAAC;CAC9E,CAAC;CAEH,WAAW,YAAY,QAAQ,MAAM,CAAC,CAAC,YAAY,+CAA+C,CAAC,CAAC,CAAC,OAAO,OAAO,MAAyB;EAC1I,MAAM,EAAE,oBAAoB,MAAM,OAAO;EACzC,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,gBAAgB,IAAI,CAAC;CACrE,CAAC;CAED,WAAW,YAAY,QAAQ,WAAW,CAAC,CAAC,YAAY,mDAAmD,CAAC,CAAC,SAAS,UAAU,uBAAuB,CAAC,CAAC,CACtJ,OAAO,WAAW,6DAA6D,CAAC,CAChF,OAAO,mBAAmB,sEAAsE,CAAC,CACjG,OAAO,OAAO,MAAc,MAA2D;EACtF,MAAM,EAAE,wBAAwB,MAAM,OAAO;EAC7C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,oBAAoB,MAAM,GAAG,IAAI,CAAC;CAClF,CAAC;CAEH,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,YAAY,iFAAiF,CAAC,CAAC,SAAS,UAAU,uBAAuB,CAAC,CAAC,CAClL,OAAO,aAAa,WAAW,CAAC,CAChC,OAAO,OAAO,MAAc,MAAwC;EACnE,MAAM,EAAE,sBAAsB,MAAM,OAAO;EAC3C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,kBAAkB,MAAM,IAAI,CAAC;CAC7E,CAAC;CAEH,WAAW,YAAY,QAAQ,QAAQ,CAAC,CAAC,YAAY,gDAAgD,CAAC,CAAC,SAAS,UAAU,uBAAuB,CAAC,CAAC,CAChJ,OAAO,aAAa,WAAW,CAAC,CAChC,OAAO,OAAO,MAAc,MAAwC;EACnE,MAAM,EAAE,qBAAqB,MAAM,OAAO;EAC1C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,iBAAiB,MAAM,IAAI,CAAC;CAC5E,CAAC;CAEH,WACE,QACG,QAAQ,UAAU,EAAE,QAAQ,MAAqB,CAAC,CAAC,CACnD,YAAY,4FAA4F,CAAC,CACzG,QAAQ,8DAA8D,CAAC,CACvE,UAAU,KAAK,CAAC,CAChB,eAAe,mBAAmB,sCAAsC,CAC7E,CAAC,CACE,OAAO,aAAa,qEAAqE,CAAC,CAC1F,OAAO,oBAAoB,gEAAgE,CAAC,CAC5F,OAAO,kBAAkB,sEAAoE,OAAO,CAAC,CACrG,OAAO,oBAAoB,iFAAiF,CAAC,CAC7G,OAAO,4BAA4B,0HAA0H,OAAO,CAAC,CACrK,OAAO,aAAa,8GAA8G,CAAC,CACnI,YACC,SACA;;;;;;;GAOH,eAAe;;;IAGd,IAAI;IACJ,IAAI,sBACJ,CAAC,CACA,OAAO,OAAO,MAA6D;EAC1E,MAAM,EAAE,cAAc,MAAM,OAAO;EACnC,MAAM,OAAO,MAAM,YAAY,UAAU,CAAC,CAAC;EAC3C,IAAI,EAAE,QAAQ;GAEZ,MAAM,EAAE,qBAAqB,MAAM,OAAO;GAC1C,MAAM,EAAE,qBAAqB,MAAM,OAAO;GAC1C,MAAM,EAAE,mBAAmB,MAAM,OAAO;GACxC,IAAI,UAAoD;GACxD,IAAI;IACF,QAAQ,WAAW,MAAM,UAAU,GAAG;KACpC,UAAU,IAAI,iBAAiB,CAAC,CAAC,EAAE,GAAG;KACtC,eAAe,IAAI,eAAgB,UAAU,iBAAiB,EAAE,SAAS,UAAU,CAAC,EAAE,CAAC,CAAE;KACzF,aAAa;IACf,CAAC;GACH,UAAU;IACR,SAAuD,MAAM;GAC/D;GACA;EACF;EACA,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,UAAU,GAAG;GAAE,UAAU,KAAK;GAAU,eAAe,KAAK;GAAK,aAAa;EAAK,CAAC,CAAC;CACrI,CAAC;AACL"}
+{"version":3,"file":"commands-DsKEU8Pe.js","names":[],"sources":["../server/connections-cli/commands.ts"],"sourcesContent":["import type { Command } from \"commander\";\nimport { NPX } from \"../listen/version.ts\";\nimport { LEGACY_PRODUCT } from \"../brand.ts\";\nimport { resolveDataDir } from \"../config.ts\";\n\n/**\n * `connections …` and `import --from …`: run on the daemon's machine, talking to its admin API through the\n * one-time local admin session (admin.ts). Listed in --help since the console (#65) shipped; while the daemon's\n * `brokerUpstreams` setting is off they say so (CONNECTIONS_VISIBLE).\n */\nexport const CONNECTIONS_VISIBLE = true;\nconst GROUP = \"MCP connections (on xaq's machine):\";\n\nconst collect = (value: string, previous: string[] | undefined) => [...(previous ?? []), value];\n// --data, else XAQ_DATA (AGENTINBOX_DATA), else ~/.xaq or an existing pre-rename ~/.agentinbox (config.ts; rename-xaq: keep).\nconst dataDirOf = (o: { data?: string }) => resolveDataDir(o.data, { quiet: true });\nconst dataOption = (cmd: Command) => cmd.option(\"-d, --data <dir>\", `xaq's data directory (default ~/.xaq, or an existing ~/.${LEGACY_PRODUCT}; env XAQ_DATA)`);\n\nasync function withApi<T>(o: { data?: string; yes?: boolean }, run: (deps: { api: import(\"./api.ts\").ConnectionsApi; prompter: import(\"./prompt.ts\").Prompter }) => Promise<T>): Promise<T> {\n  const { CLEANUP_SIGNALS, openAdminChannel } = await import(\"./admin.ts\");\n  const { ConnectionsApi } = await import(\"./api.ts\");\n  const { TerminalPrompter } = await import(\"./prompt.ts\");\n  const channel = openAdminChannel({ dataDir: dataDirOf(o) });\n  const handlers = CLEANUP_SIGNALS.map((sig) => {\n    const h = () => {\n      channel.close();\n      process.exit(sig === \"SIGINT\" ? 130 : 128 + (sig === \"SIGTERM\" ? 15 : 1));\n    };\n    process.once(sig, h);\n    return [sig, h] as const;\n  });\n  try {\n    return await run({ api: new ConnectionsApi(channel), prompter: new TerminalPrompter(!!o.yes) });\n  } finally {\n    for (const [sig, h] of handlers) process.removeListener(sig, h);\n    channel.close();\n  }\n}\n\n/** This xaq's own MCP origins, so `import` never imports its own entry. */\nasync function selfOrigins(dataDir: string): Promise<string[]> {\n  const { runningInstance } = await import(\"../instance.ts\");\n  const { daemonOrigin } = await import(\"./admin.ts\");\n  const running = runningInstance(dataDir);\n  if (!running) return [];\n  return [daemonOrigin(running), `http://localhost:${running.port}`, `http://127.0.0.1:${running.port}`, `http://[::1]:${running.port}`];\n}\n\nexport function registerConnectionsCommands(program: Command): void {\n  const connections = program\n    .command(\"connections\", { hidden: !CONNECTIONS_VISIBLE })\n    .description(\"the MCP servers xaq connects agents to (Notion, WHOOP, any MCP URL); run on xaq's machine\")\n    .summary(\"add, list, reconnect or remove connected MCP servers\")\n    .helpGroup(GROUP);\n\n  dataOption(\n    connections\n      .command(\"add\")\n      .description(\"connect an integration (notion, whoop) or any MCP server URL, interactively\")\n      .argument(\"<integration-or-url>\", \"notion, whoop, or an MCP server URL such as https://mcp.example.com/mcp\"),\n  )\n    .option(\"--slug <name>\", \"its name: agents see its tools as <name>__<tool>\")\n    .option(\"--access <level>\", \"full, ask (ask before risky actions; the default) or read\")\n    .option(\"--agent <name>\", 'an agent that gets it (repeatable; default: all agents; \"all\")', collect)\n    .option(\"--header <name>\", \"header for a server that wants a static key (default Authorization)\")\n    .option(\"--paste\", \"paste the address the browser lands on after signing in, instead of waiting for the redirect (automatic over SSH)\")\n    .option(\"--allow-private <origin>\", \"allow this exact scheme://host:port on this machine or a private network without asking (--yes never does)\")\n    .option(\"-y, --yes\", \"answer yes to confirmations and take the defaults (never to a private-network allow)\")\n    .addHelpText(\n      \"after\",\n      `\nExamples:\n  ${NPX} connections add notion\n  ${NPX} connections add https://mcp.example.com/mcp --access read\n  ${NPX} connections add http://127.0.0.1:8787/mcp      # asks before allowing a server on this machine`,\n    )\n    .action(async (target: string, o: import(\"./manage.ts\").AddFlags & { data?: string }) => {\n      const { addConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => addConnection(target, o, deps));\n    });\n\n  dataOption(connections.command(\"list\").description(\"list connections with their status and access\")).action(async (o: { data?: string }) => {\n    const { listConnections } = await import(\"./manage.ts\");\n    process.exitCode = await withApi(o, (deps) => listConnections(deps));\n  });\n\n  dataOption(connections.command(\"reconnect\").description(\"sign in again (OAuth) or replace the key (header)\").argument(\"<name>\", \"the connection's name\"))\n    .option(\"--paste\", \"paste the address the browser lands on (automatic over SSH)\")\n    .option(\"--header <name>\", \"header connections: the header's name (default: asks, Authorization)\")\n    .action(async (slug: string, o: { data?: string; paste?: boolean; header?: string }) => {\n      const { reconnectConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => reconnectConnection(slug, o, deps));\n    });\n\n  dataOption(connections.command(\"disable\").description(\"turn a connection off at once (the kill switch); turn it back on in the console\").argument(\"<name>\", \"the connection's name\"))\n    .option(\"-y, --yes\", \"don't ask\")\n    .action(async (slug: string, o: { data?: string; yes?: boolean }) => {\n      const { disableConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => disableConnection(slug, deps));\n    });\n\n  dataOption(connections.command(\"remove\").description(\"remove a connection and delete its credentials\").argument(\"<name>\", \"the connection's name\"))\n    .option(\"-y, --yes\", \"don't ask\")\n    .action(async (slug: string, o: { data?: string; yes?: boolean }) => {\n      const { removeConnection } = await import(\"./manage.ts\");\n      process.exitCode = await withApi(o, (deps) => removeConnection(slug, deps));\n    });\n\n  dataOption(\n    program\n      .command(\"import\", { hidden: !CONNECTIONS_VISIBLE })\n      .description(\"move an agent tool's MCP servers into xaq: one connection each, credentials moved into xaq\")\n      .summary(\"import MCP servers from Hermes, Claude Code, Cursor or Codex\")\n      .helpGroup(GROUP)\n      .requiredOption(\"--from <client>\", \"hermes, claude-code, cursor or codex\"),\n  )\n    .option(\"--dry-run\", \"print exactly what would be created and changed, and change nothing\")\n    .option(\"--access <level>\", \"for every imported connection: full, ask (the default) or read\")\n    .option(\"--agent <name>\", 'an agent that gets them (repeatable; default: all agents; \"all\")', collect)\n    .option(\"--profile <name>\", \"the agent profile setup-mcp uses for the single xaq entry (default \\\"default\\\")\")\n    .option(\"--allow-private <origin>\", \"allow this exact scheme://host:port on this machine or a private network without asking (repeatable; --yes never does)\", collect)\n    .option(\"-y, --yes\", \"answer yes to the confirmations (scripts); never to a private-network allow or a project's .mcp.json servers\")\n    .addHelpText(\n      \"after\",\n      `\nReads: hermes ~/.hermes/config.yaml mcp_servers (+ ~/.hermes/.env) · claude-code ~/.claude.json and ./.mcp.json ·\ncursor ~/.cursor/mcp.json · codex ~/.codex/config.toml. Static headers move into xaq (encrypted); OAuth\nservers are created needing Connect (their tokens stay in the client); local (stdio) servers aren't supported yet\nand stay where they are. Servers on this machine or a private network are created only after you confirm the exact\nhost:port. Then it offers setup-mcp --tool <client>, which replaces the entries that now work through xaq\nwith the single xaq entry, after a timestamped backup. The entry keeps the name the profile already uses (\"xaq\", or\n\"${LEGACY_PRODUCT}\" for a profile set up before the rename), so Hermes routes and cron jobs confined to it keep working.\n\nExamples:\n  ${NPX} import --from hermes --dry-run\n  ${NPX} import --from hermes`,\n    )\n    .action(async (o: import(\"./import.ts\").ImportFlags & { data?: string }) => {\n      const { runImport } = await import(\"./import.ts\");\n      const self = await selfOrigins(dataDirOf(o));\n      if (o.dryRun) {\n        // Read-only: the admin channel (when the daemon runs) only lists existing connections.\n        const { TerminalPrompter } = await import(\"./prompt.ts\");\n        const { openAdminChannel } = await import(\"./admin.ts\");\n        const { ConnectionsApi } = await import(\"./api.ts\");\n        let channel: import(\"./admin.ts\").AdminChannel | null = null;\n        try {\n          process.exitCode = await runImport(o, {\n            prompter: new TerminalPrompter(!!o.yes),\n            openApi: () => new ConnectionsApi((channel = openAdminChannel({ dataDir: dataDirOf(o) }))),\n            selfOrigins: self,\n          });\n        } finally {\n          (channel as import(\"./admin.ts\").AdminChannel | null)?.close();\n        }\n        return;\n      }\n      process.exitCode = await withApi(o, (deps) => runImport(o, { prompter: deps.prompter, openApi: () => deps.api, selfOrigins: self }));\n    });\n}\n"],"mappings":";;;;;AAWA,MAAM,QAAQ;AAEd,MAAM,WAAW,OAAe,aAAmC,CAAC,GAAI,YAAY,CAAC,GAAI,KAAK;AAE9F,MAAM,aAAa,MAAyB,eAAe,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC;AAClF,MAAM,cAAc,QAAiB,IAAI,OAAO,oBAAoB,2DAA2D,eAAe,gBAAgB;AAE9J,eAAe,QAAW,GAAqC,KAA6H;CAC1L,MAAM,EAAE,iBAAiB,qBAAqB,MAAM,OAAO;CAC3D,MAAM,EAAE,mBAAmB,MAAM,OAAO;CACxC,MAAM,EAAE,qBAAqB,MAAM,OAAO;CAC1C,MAAM,UAAU,iBAAiB,EAAE,SAAS,UAAU,CAAC,EAAE,CAAC;CAC1D,MAAM,WAAW,gBAAgB,KAAK,QAAQ;EAC5C,MAAM,UAAU;GACd,QAAQ,MAAM;GACd,QAAQ,KAAK,QAAQ,WAAW,MAAM,OAAO,QAAQ,YAAY,KAAK,EAAE;EAC1E;EACA,QAAQ,KAAK,KAAK,CAAC;EACnB,OAAO,CAAC,KAAK,CAAC;CAChB,CAAC;CACD,IAAI;EACF,OAAO,MAAM,IAAI;GAAE,KAAK,IAAI,eAAe,OAAO;GAAG,UAAU,IAAI,iBAAiB,CAAC,CAAC,EAAE,GAAG;EAAE,CAAC;CAChG,UAAU;EACR,KAAK,MAAM,CAAC,KAAK,MAAM,UAAU,QAAQ,eAAe,KAAK,CAAC;EAC9D,QAAQ,MAAM;CAChB;AACF;;AAGA,eAAe,YAAY,SAAoC;CAC7D,MAAM,EAAE,oBAAoB,MAAM,OAAO;CACzC,MAAM,EAAE,iBAAiB,MAAM,OAAO;CACtC,MAAM,UAAU,gBAAgB,OAAO;CACvC,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,OAAO;EAAC,aAAa,OAAO;EAAG,oBAAoB,QAAQ;EAAQ,oBAAoB,QAAQ;EAAQ,gBAAgB,QAAQ;CAAM;AACvI;AAEA,SAAgB,4BAA4B,SAAwB;CAClE,MAAM,cAAc,QACjB,QAAQ,eAAe,EAAE,QAAQ,MAAqB,CAAC,CAAC,CACxD,YAAY,2FAA2F,CAAC,CACxG,QAAQ,sDAAsD,CAAC,CAC/D,UAAU,KAAK;CAElB,WACE,YACG,QAAQ,KAAK,CAAC,CACd,YAAY,6EAA6E,CAAC,CAC1F,SAAS,wBAAwB,yEAAyE,CAC/G,CAAC,CACE,OAAO,iBAAiB,kDAAkD,CAAC,CAC3E,OAAO,oBAAoB,2DAA2D,CAAC,CACvF,OAAO,kBAAkB,oEAAkE,OAAO,CAAC,CACnG,OAAO,mBAAmB,qEAAqE,CAAC,CAChG,OAAO,WAAW,mHAAmH,CAAC,CACtI,OAAO,4BAA4B,4GAA4G,CAAC,CAChJ,OAAO,aAAa,sFAAsF,CAAC,CAC3G,YACC,SACA;;IAEF,IAAI;IACJ,IAAI;IACJ,IAAI,gGACJ,CAAC,CACA,OAAO,OAAO,QAAgB,MAA0D;EACvF,MAAM,EAAE,kBAAkB,MAAM,OAAO;EACvC,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,cAAc,QAAQ,GAAG,IAAI,CAAC;CAC9E,CAAC;CAEH,WAAW,YAAY,QAAQ,MAAM,CAAC,CAAC,YAAY,+CAA+C,CAAC,CAAC,CAAC,OAAO,OAAO,MAAyB;EAC1I,MAAM,EAAE,oBAAoB,MAAM,OAAO;EACzC,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,gBAAgB,IAAI,CAAC;CACrE,CAAC;CAED,WAAW,YAAY,QAAQ,WAAW,CAAC,CAAC,YAAY,mDAAmD,CAAC,CAAC,SAAS,UAAU,uBAAuB,CAAC,CAAC,CACtJ,OAAO,WAAW,6DAA6D,CAAC,CAChF,OAAO,mBAAmB,sEAAsE,CAAC,CACjG,OAAO,OAAO,MAAc,MAA2D;EACtF,MAAM,EAAE,wBAAwB,MAAM,OAAO;EAC7C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,oBAAoB,MAAM,GAAG,IAAI,CAAC;CAClF,CAAC;CAEH,WAAW,YAAY,QAAQ,SAAS,CAAC,CAAC,YAAY,iFAAiF,CAAC,CAAC,SAAS,UAAU,uBAAuB,CAAC,CAAC,CAClL,OAAO,aAAa,WAAW,CAAC,CAChC,OAAO,OAAO,MAAc,MAAwC;EACnE,MAAM,EAAE,sBAAsB,MAAM,OAAO;EAC3C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,kBAAkB,MAAM,IAAI,CAAC;CAC7E,CAAC;CAEH,WAAW,YAAY,QAAQ,QAAQ,CAAC,CAAC,YAAY,gDAAgD,CAAC,CAAC,SAAS,UAAU,uBAAuB,CAAC,CAAC,CAChJ,OAAO,aAAa,WAAW,CAAC,CAChC,OAAO,OAAO,MAAc,MAAwC;EACnE,MAAM,EAAE,qBAAqB,MAAM,OAAO;EAC1C,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,iBAAiB,MAAM,IAAI,CAAC;CAC5E,CAAC;CAEH,WACE,QACG,QAAQ,UAAU,EAAE,QAAQ,MAAqB,CAAC,CAAC,CACnD,YAAY,4FAA4F,CAAC,CACzG,QAAQ,8DAA8D,CAAC,CACvE,UAAU,KAAK,CAAC,CAChB,eAAe,mBAAmB,sCAAsC,CAC7E,CAAC,CACE,OAAO,aAAa,qEAAqE,CAAC,CAC1F,OAAO,oBAAoB,gEAAgE,CAAC,CAC5F,OAAO,kBAAkB,sEAAoE,OAAO,CAAC,CACrG,OAAO,oBAAoB,iFAAiF,CAAC,CAC7G,OAAO,4BAA4B,0HAA0H,OAAO,CAAC,CACrK,OAAO,aAAa,8GAA8G,CAAC,CACnI,YACC,SACA;;;;;;;GAOH,eAAe;;;IAGd,IAAI;IACJ,IAAI,sBACJ,CAAC,CACA,OAAO,OAAO,MAA6D;EAC1E,MAAM,EAAE,cAAc,MAAM,OAAO;EACnC,MAAM,OAAO,MAAM,YAAY,UAAU,CAAC,CAAC;EAC3C,IAAI,EAAE,QAAQ;GAEZ,MAAM,EAAE,qBAAqB,MAAM,OAAO;GAC1C,MAAM,EAAE,qBAAqB,MAAM,OAAO;GAC1C,MAAM,EAAE,mBAAmB,MAAM,OAAO;GACxC,IAAI,UAAoD;GACxD,IAAI;IACF,QAAQ,WAAW,MAAM,UAAU,GAAG;KACpC,UAAU,IAAI,iBAAiB,CAAC,CAAC,EAAE,GAAG;KACtC,eAAe,IAAI,eAAgB,UAAU,iBAAiB,EAAE,SAAS,UAAU,CAAC,EAAE,CAAC,CAAE;KACzF,aAAa;IACf,CAAC;GACH,UAAU;IACR,SAAuD,MAAM;GAC/D;GACA;EACF;EACA,QAAQ,WAAW,MAAM,QAAQ,IAAI,SAAS,UAAU,GAAG;GAAE,UAAU,KAAK;GAAU,eAAe,KAAK;GAAK,aAAa;EAAK,CAAC,CAAC;CACrI,CAAC;AACL"}

package/dist/{import-D0af7Fv-.js → import-CjXjx6hA.js}

@@ -5,7 +5,7 @@ import { a as mcpServerName, n as loadProfile, r as profileExists } from "./prof
 import "./recipes-D_quZbpA.js";
 import { i as safeText } from "./ui-B8Sd4Y7Y.js";
 import { _ as readTomlMcpServers, a as cursorConfigFile, c as mcpTarget, g as UNREADABLE$1, h as readTopMap, i as codexConfigFile, m as readMcpServers, n as claudeConfigFile, p as UNREADABLE, s as hermesHome, u as setupMcp } from "./mcpsetup-DjMhHnJo.js";
-import { _ as chooseAccess, a as isWorking, d as waitWorking, f as reconnectHint, g as agentsLabel, h as accessLabel, m as checkTarget, p as slugify, v as chooseAgents, y as parseAccess } from "./manage-Bo6COB4p.js";
+import { _ as chooseAccess, a as isWorking, d as waitWorking, f as reconnectHint, g as agentsLabel, h as accessLabel, m as checkTarget, p as slugify, v as chooseAgents, y as parseAccess } from "./manage-BlGiqPRV.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import pc from "picocolors";
@@ -907,4 +907,4 @@ async function offerSetup(deps, api, client, who, working, pending, code) {
 //#endregion
 export { runImport };
 
-//# sourceMappingURL=import-D0af7Fv-.js.map
+//# sourceMappingURL=import-CjXjx6hA.js.map

package/dist/{import-D0af7Fv-.js.map → import-CjXjx6hA.js.map}

@@ -1 +1 @@
-{"version":3,"file":"import-D0af7Fv-.js","names":["YAML_UNREADABLE","TOML_UNREADABLE"],"sources":["../server/connections-cli/routes.ts","../server/connections-cli/clients.ts","../server/connections-cli/import.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { hermesHome } from \"../listen/mcpsetup.ts\";\nimport type { ImportClient } from \"./clients.ts\";\nimport { readTopMap, UNREADABLE, type YamlValue } from \"./yaml.ts\";\n\n/**\n * Places in a client's config that confine something to the xaq MCP server alone: Hermes platform toolsets,\n * webhook routes (`toolsets: [\"mcp-<server>\", …]`) and cron jobs (`enabled_toolsets: [\"<server>\"]`). Once the\n * imported servers are served through xaq, each of these also sees their tools, so `import` warns before\n * replacing anything (docs/listen.md: an email-triggered route confined to xaq).\n */\nexport function confinedRoutes(client: ImportClient, serverName: string, env: NodeJS.ProcessEnv = process.env): string[] {\n  if (client !== \"hermes\") return [];\n  const home = hermesHome(env);\n  const names = new Set([serverName, `mcp-${serverName}`]);\n  const confines = (v: unknown) => Array.isArray(v) && v.some((x) => typeof x === \"string\" && names.has(x));\n  const out: string[] = [];\n  const read = (file: string): unknown => {\n    try {\n      return existsSync(file) ? JSON.parse(readFileSync(file, \"utf8\").replace(/^/, \"\")) : null;\n    } catch {\n      return null;\n    }\n  };\n  try {\n    const config = join(home, \"config.yaml\");\n    if (existsSync(config)) {\n      const yaml = readFileSync(config, \"utf8\");\n      const platforms = readTopMap(yaml, \"platform_toolsets\") ?? {};\n      for (const [platform, toolsets] of Object.entries(platforms)) if (confines(toolsets)) out.push(`platform_toolsets.${platform} (config.yaml)`);\n      // Static webhook routes: platforms.webhook.extra.routes, a map of name → route or a list of routes.\n      const get = (v: YamlValue | undefined, k: string): YamlValue | undefined => (v && typeof v === \"object\" && !Array.isArray(v) ? (v as Record<string, YamlValue>)[k] : undefined);\n      const routes = get(get(get(readTopMap(yaml, \"platforms\") ?? undefined, \"webhook\"), \"extra\"), \"routes\");\n      if (routes === UNREADABLE || (Array.isArray(routes) && routes.some((r) => r === UNREADABLE))) {\n        out.push(\"webhook routes in config.yaml (platforms.webhook.extra.routes: couldn't be read, so check their toolsets)\");\n      } else if (Array.isArray(routes)) {\n        routes.forEach((r, i) => {\n          if (confines(get(r, \"toolsets\"))) out.push(`webhook route ${String(get(r, \"name\") ?? `#${i + 1}`)} (config.yaml)`);\n        });\n      } else if (routes && typeof routes === \"object\") {\n        for (const [name, r] of Object.entries(routes as Record<string, YamlValue>)) if (confines(get(r, \"toolsets\"))) out.push(`webhook route ${name} (config.yaml)`);\n      }\n    }\n  } catch {\n    // Unreadable: nothing to warn about from it.\n  }\n  const subs = read(join(home, \"webhook_subscriptions.json\"));\n  if (subs && typeof subs === \"object\" && !Array.isArray(subs)) {\n    for (const [route, r] of Object.entries(subs as Record<string, { toolsets?: unknown }>)) if (confines(r?.toolsets)) out.push(`webhook route ${route}`);\n  }\n  const cron = read(join(home, \"cron\", \"jobs.json\"));\n  const jobs = (Array.isArray(cron) ? cron : ((cron as { jobs?: unknown } | null)?.jobs ?? [])) as { id?: unknown; name?: unknown; enabled_toolsets?: unknown }[];\n  if (Array.isArray(jobs)) for (const j of jobs) if (confines(j?.enabled_toolsets)) out.push(`cron job ${String(j.name ?? j.id ?? \"?\")}`);\n  return out;\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { claudeConfigFile, codexConfigFile, cursorConfigFile, hermesHome } from \"../listen/mcpsetup.ts\";\nimport { readTomlMcpServers, type TomlTable, UNREADABLE as TOML_UNREADABLE } from \"./toml.ts\";\nimport { readMcpServers, UNREADABLE as YAML_UNREADABLE, type YamlMap } from \"./yaml.ts\";\n\n/** Reads the MCP servers an agent's own tool is configured with (for `import --from`). */\n\nexport const IMPORT_CLIENTS = [\"hermes\", \"claude-code\", \"cursor\", \"codex\"] as const;\nexport type ImportClient = (typeof IMPORT_CLIENTS)[number];\n\nexport const CLIENT_LABELS: Record<ImportClient, string> = { hermes: \"Hermes\", \"claude-code\": \"Claude Code\", cursor: \"Cursor\", codex: \"Codex\" };\n\nexport interface ClientEntry {\n  name: string;\n  /** The file it's defined in. */\n  file: string;\n  /** Claude Code: which scope (user: ~/.claude.json; local: its projects[cwd]; project: ./.mcp.json). */\n  scope?: \"user\" | \"local\" | \"project\";\n  /** Claude Code local/project scope: the project directory (where `claude mcp remove` must run). */\n  projectDir?: string;\n  transport: \"http\" | \"sse\" | \"stdio\";\n  url?: string;\n  /** Static headers, with ${VAR} references resolved. Secret: never printed. */\n  headers: Record<string, string>;\n  /** Names of environment variables the headers came from (for the \"you can remove it from .env\" note). */\n  headerVars: string[];\n  /** Per header: the environment variables its value was built from (shown in the plan next to the destination). */\n  headerSources: Record<string, string[]>;\n  /**\n   * Defined in a file the project ships (Claude Code's ./.mcp.json), not by the user: anyone who can commit to the\n   * repository wrote it. Imported only when Claude Code approved it, and only after its own confirmation.\n   */\n  fromProject?: boolean;\n  /** Client-side settings the broker doesn't carry over: tool filters and timeouts. */\n  dropped?: DroppedSettings;\n  /** The client says it uses OAuth (Hermes `auth: oauth`, an oauth block). Its tokens stay in the client. */\n  oauth: boolean;\n  enabled: boolean;\n  /** Why it can't be imported as it is. */\n  problem?: string;\n  /** stdio: the command line, for the listing. */\n  command?: string;\n}\n\nexport interface DroppedSettings {\n  /** Tools the client hides from its agent (Hermes tools.exclude, Codex disabled_tools). */\n  exclude?: string[];\n  /** The only tools the client shows (Hermes tools.include, Codex enabled_tools). */\n  include?: string[];\n  /** Other settings by name, e.g. timeout, connect_timeout. */\n  settings: string[];\n}\n\nconst strings = (v: unknown) => (Array.isArray(v) ? v.filter((x): x is string => typeof x === \"string\") : undefined);\n\nfunction droppedFrom(e: Record<string, unknown>, filters: { include: unknown; exclude: unknown }, settingKeys: string[]): DroppedSettings | undefined {\n  const d: DroppedSettings = { settings: settingKeys.filter((k) => e[k] !== undefined && e[k] !== null) };\n  const inc = strings(filters.include);\n  const exc = strings(filters.exclude);\n  if (inc?.length) d.include = inc;\n  if (exc?.length) d.exclude = exc;\n  return d.include || d.exclude || d.settings.length ? d : undefined;\n}\n\nexport interface ClientConfig {\n  client: ImportClient;\n  files: string[];\n  entries: ClientEntry[];\n}\n\nexport interface ReadOptions {\n  env?: NodeJS.ProcessEnv;\n  cwd?: string;\n}\n\n/** Parses a dotenv file (KEY=VALUE, optional `export`, quotes). */\nexport function parseDotenv(text: string): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const raw of text.split(\"\\n\")) {\n    const m = /^\\s*(?:export\\s+)?([A-Za-z_][A-Za-z0-9_]*)\\s*=\\s*(.*?)\\s*$/.exec(raw);\n    if (!m) continue;\n    let v = m[2]!;\n    if ((v.startsWith('\"') && v.endsWith('\"') && v.length >= 2) || (v.startsWith(\"'\") && v.endsWith(\"'\") && v.length >= 2)) v = v.slice(1, -1);\n    else v = v.replace(/\\s+#.*$/, \"\");\n    out[m[1]!] = v;\n  }\n  return out;\n}\n\ntype Expanded = { value: string; vars: string[] } | { missing: string };\n\n/** `${VAR}` (and `${VAR:-default}`, `${env:VAR}`) from `vars`. */\nexport function expandVars(value: string, vars: Record<string, string | undefined>): Expanded {\n  const used: string[] = [];\n  let missing: string | null = null;\n  const out = value.replace(/\\$\\{(?:env:)?([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\\}/g, (_m, name: string, def: string | undefined) => {\n    const v = vars[name];\n    if (v !== undefined && v !== \"\") {\n      used.push(name);\n      return v;\n    }\n    if (def !== undefined) return def;\n    missing ??= name;\n    return \"\";\n  });\n  return missing ? { missing } : { value: out, vars: used };\n}\n\nconst isObj = (v: unknown): v is Record<string, unknown> => !!v && typeof v === \"object\" && !Array.isArray(v);\nconst readJson = (file: string): Record<string, unknown> | null => {\n  if (!existsSync(file)) return null;\n  const text = readFileSync(file, \"utf8\");\n  if (!text.trim()) return {};\n  try {\n    const doc = JSON.parse(text) as unknown;\n    if (!isObj(doc)) throw new Error(\"not an object\");\n    return doc;\n  } catch {\n    throw new Error(`${file} isn't plain JSON (comments?), so it can't be read automatically.`);\n  }\n};\n\n/** Shared by the JSON-shaped clients (Claude Code, Cursor): one `mcpServers` entry. */\nfunction jsonEntry(name: string, raw: unknown, file: string, vars: Record<string, string | undefined>, extra: Partial<ClientEntry> = {}): ClientEntry {\n  const base: ClientEntry = { name, file, transport: \"http\", headers: {}, headerVars: [], headerSources: {}, oauth: false, enabled: true, ...extra };\n  if (!isObj(raw)) return { ...base, problem: \"this entry isn't an object\" };\n  if (raw.disabled === true || raw.enabled === false) base.enabled = false;\n  const type = typeof raw.type === \"string\" ? raw.type.toLowerCase() : null;\n  if (type === \"stdio\" || (typeof raw.command === \"string\" && !raw.url)) {\n    const args = Array.isArray(raw.args) ? raw.args.map(String) : [];\n    return { ...base, transport: \"stdio\", command: [String(raw.command ?? \"\"), ...args].join(\" \").trim() };\n  }\n  if (typeof raw.url !== \"string\") return { ...base, problem: \"no url\" };\n  const url = expandVars(raw.url, vars);\n  if (\"missing\" in url) return { ...base, problem: `its url uses \\${${url.missing}}, which isn't set here` };\n  const entry: ClientEntry = { ...base, url: url.value, transport: type === \"sse\" ? \"sse\" : \"http\" };\n  if (raw.headersHelper !== undefined || raw.headers_helper !== undefined) return { ...entry, problem: \"it gets its headers from a helper command, which the broker can't run\" };\n  if (raw.oauth !== undefined || raw.auth !== undefined) entry.oauth = true;\n  return withHeaders(entry, raw.headers, vars);\n}\n\nfunction withHeaders(entry: ClientEntry, headers: unknown, vars: Record<string, string | undefined>): ClientEntry {\n  if (headers === undefined || headers === null) return entry;\n  if (!isObj(headers)) return { ...entry, problem: \"its headers can't be read\" };\n  for (const [k, v] of Object.entries(headers)) {\n    if (typeof v !== \"string\") return { ...entry, problem: `its ${k} header can't be read` };\n    const x = expandVars(v, vars);\n    if (\"missing\" in x) return { ...entry, problem: `its ${k} header uses \\${${x.missing}}, which isn't set here` };\n    entry.headers[k] = x.value;\n    entry.headerVars.push(...x.vars);\n    entry.headerSources[k] = x.vars;\n  }\n  return entry;\n}\n\n// ───────────── Hermes ─────────────\n\nexport function hermesFiles(env: NodeJS.ProcessEnv = process.env): { config: string; env: string } {\n  const home = hermesHome(env);\n  return { config: join(home, \"config.yaml\"), env: join(home, \".env\") };\n}\n\nfunction readHermes(opts: ReadOptions): ClientConfig {\n  const env = opts.env ?? process.env;\n  const files = hermesFiles(env);\n  const result: ClientConfig = { client: \"hermes\", files: [files.config], entries: [] };\n  if (!existsSync(files.config)) return result;\n  const servers = readMcpServers(readFileSync(files.config, \"utf8\"));\n  if (!servers) throw new Error(`${files.config} has an mcp_servers layout this can't read (flow style, several blocks, or tabs). Nothing was changed.`);\n  // Hermes loads ~/.hermes/.env into its environment: the secrets its ${VAR} headers name live there.\n  const vars = { ...env, ...(existsSync(files.env) ? parseDotenv(readFileSync(files.env, \"utf8\")) : {}) };\n  for (const [name, raw] of Object.entries(servers)) {\n    if (name.startsWith(\"\\u0000\")) continue;\n    const base: ClientEntry = { name, file: files.config, transport: \"http\", headers: {}, headerVars: [], headerSources: {}, oauth: false, enabled: true };\n    if (!raw || raw === YAML_UNREADABLE || typeof raw !== \"object\" || Array.isArray(raw)) {\n      result.entries.push({ ...base, problem: \"this entry can't be read\" });\n      continue;\n    }\n    const e = raw as YamlMap;\n    const unreadable = [\"url\", \"headers\", \"command\", \"auth\", \"transport\", \"enabled\"].find((k) => e[k] === YAML_UNREADABLE);\n    if (unreadable) {\n      result.entries.push({ ...base, problem: `its ${unreadable} can't be read` });\n      continue;\n    }\n    if (e.enabled === false || (typeof e.enabled === \"string\" && [\"false\", \"no\", \"off\", \"0\"].includes(e.enabled.toLowerCase()))) base.enabled = false;\n    if (typeof e.command === \"string\") {\n      const args = Array.isArray(e.args) ? e.args.filter((a) => typeof a === \"string\") : [];\n      result.entries.push({ ...base, transport: \"stdio\", command: [e.command, ...args].join(\" \") });\n      continue;\n    }\n    if (typeof e.url !== \"string\") {\n      result.entries.push({ ...base, problem: \"no url\" });\n      continue;\n    }\n    const url = expandVars(e.url, vars);\n    if (\"missing\" in url) {\n      result.entries.push({ ...base, problem: `its url uses \\${${url.missing}}, which isn't set in ${files.env}` });\n      continue;\n    }\n    const tools = isObj(e.tools) ? (e.tools as Record<string, unknown>) : {};\n    const entry: ClientEntry = {\n      ...base,\n      url: url.value,\n      transport: e.transport === \"sse\" ? \"sse\" : \"http\",\n      oauth: e.auth === \"oauth\" || isObj(e.oauth),\n      dropped: droppedFrom(e as Record<string, unknown>, { include: tools.include, exclude: tools.exclude }, [\"timeout\", \"connect_timeout\"]),\n    };\n    if (e.client_cert !== undefined || e.identity_header !== undefined) {\n      result.entries.push({ ...entry, problem: \"it uses a client certificate or identity header, which the broker doesn't support yet\" });\n      continue;\n    }\n    result.entries.push(withHeaders(entry, e.headers ?? undefined, vars));\n  }\n  return result;\n}\n\n// ───────────── Claude Code ─────────────\n\nfunction readClaude(opts: ReadOptions): ClientConfig {\n  const env = opts.env ?? process.env;\n  const cwd = opts.cwd ?? process.cwd();\n  const userFile = claudeConfigFile();\n  const projectFile = join(cwd, \".mcp.json\");\n  const result: ClientConfig = { client: \"claude-code\", files: [userFile, projectFile].filter(existsSync), entries: [] };\n  const seen = new Set<string>();\n  const add = (e: ClientEntry) => {\n    // Claude Code's precedence: local, then project, then user. A shadowed one isn't what the agent uses.\n    if (seen.has(e.name)) return;\n    seen.add(e.name);\n    result.entries.push(e);\n  };\n  const doc = readJson(userFile);\n  const proj = doc && isObj(doc.projects) && isObj(doc.projects[cwd]) ? (doc.projects[cwd] as Record<string, unknown>) : {};\n  const local = proj.mcpServers;\n  if (isObj(local)) for (const [n, raw] of Object.entries(local)) add(jsonEntry(n, raw, userFile, env, { scope: \"local\", projectDir: cwd }));\n  const project = readJson(projectFile);\n  if (project && isObj(project.mcpServers)) {\n    // ./.mcp.json comes with the repository. Claude Code itself only uses the servers the user approved for this\n    // project (kept in ~/.claude.json, which the repository can't write); a project's own .claude/settings*.json\n    // isn't trusted for this.\n    const list = (v: unknown) => (Array.isArray(v) ? v.filter((x): x is string => typeof x === \"string\") : []);\n    const enabled = new Set(list(proj.enabledMcpjsonServers));\n    const disabled = new Set(list(proj.disabledMcpjsonServers));\n    const all = proj.enableAllProjectMcpServers === true;\n    for (const [n, raw] of Object.entries(project.mcpServers)) {\n      const e = jsonEntry(n, raw, projectFile, env, { scope: \"project\", projectDir: cwd, fromProject: true });\n      const why = disabled.has(n) ? \"turned off for this project in Claude Code\" : !all && !enabled.has(n) ? \"not approved in Claude Code\" : null;\n      // An unapproved one isn't what Claude Code uses, so it doesn't shadow a user-scope server of the same name.\n      if (why) result.entries.push({ ...e, problem: why });\n      else add(e);\n    }\n  }\n  if (doc && isObj(doc.mcpServers)) for (const [n, raw] of Object.entries(doc.mcpServers)) add(jsonEntry(n, raw, userFile, env, { scope: \"user\" }));\n  return result;\n}\n\n// ───────────── Cursor ─────────────\n\nfunction readCursor(opts: ReadOptions): ClientConfig {\n  const env = opts.env ?? process.env;\n  const file = cursorConfigFile();\n  const result: ClientConfig = { client: \"cursor\", files: [file], entries: [] };\n  const doc = readJson(file);\n  if (doc && isObj(doc.mcpServers)) for (const [n, raw] of Object.entries(doc.mcpServers)) result.entries.push(jsonEntry(n, raw, file, env));\n  return result;\n}\n\n// ───────────── Codex ─────────────\n\nfunction readCodex(opts: ReadOptions): ClientConfig {\n  const env = opts.env ?? process.env;\n  const file = codexConfigFile();\n  const result: ClientConfig = { client: \"codex\", files: [file], entries: [] };\n  if (!existsSync(file)) return result;\n  for (const [name, raw] of Object.entries(readTomlMcpServers(readFileSync(file, \"utf8\")))) {\n    const base: ClientEntry = { name, file, transport: \"http\", headers: {}, headerVars: [], headerSources: {}, oauth: false, enabled: true };\n    if (raw === TOML_UNREADABLE) {\n      result.entries.push({ ...base, problem: \"this entry can't be read\" });\n      continue;\n    }\n    const e = raw as TomlTable;\n    if (e.enabled === false) base.enabled = false;\n    if (typeof e.command === \"string\") {\n      const args = Array.isArray(e.args) ? e.args.filter((a): a is string => typeof a === \"string\") : [];\n      result.entries.push({ ...base, transport: \"stdio\", command: [e.command, ...args].join(\" \") });\n      continue;\n    }\n    if (typeof e.url !== \"string\") {\n      result.entries.push({ ...base, problem: \"no url\" });\n      continue;\n    }\n    const entry: ClientEntry = {\n      ...base,\n      url: e.url,\n      oauth: isObj(e.oauth) || e.auth === \"oauth\",\n      dropped: droppedFrom(e, { include: e.enabled_tools, exclude: e.disabled_tools }, [\"tool_timeout_sec\", \"startup_timeout_sec\"]),\n    };\n    if (e.http_headers_helper !== undefined) {\n      result.entries.push({ ...entry, problem: \"it gets its headers from a helper command, which the broker can't run\" });\n      continue;\n    }\n    // Codex has no ${VAR} expansion: env_http_headers and bearer_token_env_var name variables instead.\n    const headers: Record<string, string> = {};\n    let problem: string | undefined;\n    if (e.http_headers !== undefined) {\n      if (!isObj(e.http_headers) || Object.values(e.http_headers).some((v) => typeof v !== \"string\")) problem = \"its http_headers can't be read\";\n      else {\n        Object.assign(headers, e.http_headers);\n        for (const h of Object.keys(e.http_headers)) entry.headerSources[h] = [];\n      }\n    }\n    const fromEnv: Record<string, unknown> = isObj(e.env_http_headers) ? { ...e.env_http_headers } : {};\n    if (e.bearer_token_env_var !== undefined) fromEnv.Authorization = e.bearer_token_env_var;\n    for (const [h, varName] of Object.entries(fromEnv)) {\n      if (typeof varName !== \"string\") problem ??= `its ${h} header can't be read`;\n      else if (!env[varName]) problem ??= `its ${h} header comes from $${varName}, which isn't set here`;\n      else {\n        headers[h] = h === \"Authorization\" && e.bearer_token_env_var === varName ? `Bearer ${env[varName]}` : env[varName]!;\n        entry.headerVars.push(varName);\n        entry.headerSources[h] = [varName];\n      }\n    }\n    entry.headers = headers;\n    result.entries.push(problem ? { ...entry, problem } : entry);\n  }\n  return result;\n}\n\nexport function readClientConfig(client: ImportClient, opts: ReadOptions = {}): ClientConfig {\n  switch (client) {\n    case \"hermes\":\n      return readHermes(opts);\n    case \"claude-code\":\n      return readClaude(opts);\n    case \"cursor\":\n      return readCursor(opts);\n    case \"codex\":\n      return readCodex(opts);\n  }\n}\n\nexport function parseImportClient(value: string): ImportClient {\n  const v = value.trim().toLowerCase().replace(/^claude$/, \"claude-code\");\n  if (!(IMPORT_CLIENTS as readonly string[]).includes(v)) throw new Error(`Unknown --from \"${value}\". Choose one of: ${IMPORT_CLIENTS.join(\", \")}.`);\n  return v as ImportClient;\n}\n","import pc from \"picocolors\";\nimport type { Agent } from \"../../shared/types.ts\";\nimport type { AccessLevel } from \"../broker/types.ts\";\nimport { mcpTarget, type McpSetupResult, type RemoveServer, setupMcp } from \"../listen/mcpsetup.ts\";\nimport { DEFAULT_PROFILE, profilePath } from \"../listen/paths.ts\";\nimport { loadProfile, type Profile, profileExists } from \"../listen/profile.ts\";\nimport { safeText } from \"../listen/ui.ts\";\nimport { NPX } from \"../listen/version.ts\";\nimport type { LookupFn } from \"../webhooks/ssrf.ts\";\nimport { accessLabel, agentsLabel, chooseAccess, chooseAgents, parseAccess } from \"./access.ts\";\nimport { isWorking, waitWorking } from \"./manage.ts\";\nimport { confinedRoutes } from \"./routes.ts\";\nimport { mcpServerName } from \"../listen/recipes.ts\";\nimport type { ConnectionsApi, ConnectionView } from \"./api.ts\";\nimport { CLIENT_LABELS, type ClientConfig, type ClientEntry, type ImportClient, parseImportClient, readClientConfig } from \"./clients.ts\";\nimport { checkTarget } from \"./private.ts\";\nimport type { Prompter } from \"./prompt.ts\";\nimport { reconnectHint, slugify } from \"./util.ts\";\n\n/**\n * `import --from <client>`: one connection per remote MCP server in that client's config, with its static header\n * moved into the broker. OAuth servers are created needing Connect (their tokens stay in the client); stdio ones\n * aren't supported yet (M4) and stay where they are. Nothing is written without a confirmation (or --yes), and\n * the client's config is only touched by the optional setup-mcp step at the end, which removes just the entries\n * whose connection works.\n */\n\nexport interface ImportFlags {\n  from: string;\n  dryRun?: boolean;\n  yes?: boolean;\n  access?: string;\n  agent?: string[];\n  profile?: string;\n  /** Exact `scheme://host:port` origins allowed without asking (--yes never allows one). */\n  allowPrivate?: string[];\n}\n\nexport interface ImportDeps {\n  prompter: Prompter;\n  /** Opens the admin channel (not called for --dry-run). */\n  openApi: () => ConnectionsApi;\n  lookup?: LookupFn;\n  env?: NodeJS.ProcessEnv;\n  cwd?: string;\n  /** This xaq's own MCP origins (loopback with its port), so its entry is never imported. */\n  selfOrigins?: string[];\n  /** How long to wait for a connected server's first tool sync (default 10 s), and how often to look. */\n  verifyMs?: number;\n  pollMs?: number;\n}\n\nexport type PlanItem =\n  | { action: \"self\"; entry: ClientEntry }\n  | { action: \"stdio\"; entry: ClientEntry }\n  | { action: \"skip\"; entry: ClientEntry; reason: string }\n  | { action: \"exists\"; entry: ClientEntry; connection: ConnectionView }\n  | {\n      action: \"create\";\n      entry: ClientEntry;\n      slug: string;\n      url: string;\n      /** header: moved into the broker; oauth: the client says so; none: no credential (the connect finds out). */\n      auth: { type: \"header\"; name: string; value: string } | { type: \"oauth\" } | { type: \"none\" };\n      /** The exact origin a private-target allow would cover, when the URL is on this machine or a private network. */\n      privateTarget: string | null;\n    };\n\n// Our own entry under its name, or under the one a profile from before the rename registered: never imported.\nconst SELF_NAME = /^(?:xaq|agentinbox)(?:-[a-z0-9][a-z0-9_-]*)?$/; // rename-xaq: keep\n\nfunction isSelf(e: ClientEntry, selfOrigins: string[]): boolean {\n  if (SELF_NAME.test(e.name)) return true;\n  if (Object.values(e.headers).some((v) => /^Bearer\\s+aib_/i.test(v.trim()))) return true;\n  if (!e.url) return false;\n  try {\n    const u = new URL(e.url);\n    return u.pathname.replace(/\\/+$/, \"\").endsWith(\"/mcp\") && selfOrigins.includes(u.origin);\n  } catch {\n    return false;\n  }\n}\n\nconst sameUrl = (a: string | null | undefined, b: string) => {\n  try {\n    return !!a && new URL(a).href.replace(/\\/+$/, \"\") === new URL(b).href.replace(/\\/+$/, \"\");\n  } catch {\n    return false;\n  }\n};\n\nexport async function planImport(config: ClientConfig, ctx: { existing?: ConnectionView[]; lookup?: LookupFn; selfOrigins?: string[] } = {}): Promise<PlanItem[]> {\n  const label = CLIENT_LABELS[config.client];\n  const taken = new Set((ctx.existing ?? []).map((c) => c.slug));\n  const items: PlanItem[] = [];\n  for (const entry of config.entries) {\n    if (isSelf(entry, ctx.selfOrigins ?? [])) {\n      items.push({ action: \"self\", entry });\n      continue;\n    }\n    if (entry.transport === \"stdio\") {\n      items.push({ action: \"stdio\", entry });\n      continue;\n    }\n    if (entry.problem) {\n      items.push({ action: \"skip\", entry, reason: entry.problem });\n      continue;\n    }\n    if (!entry.enabled) {\n      items.push({ action: \"skip\", entry, reason: `it's turned off in ${label}` });\n      continue;\n    }\n    let url: URL;\n    try {\n      url = new URL(entry.url!);\n      if (url.protocol !== \"http:\" && url.protocol !== \"https:\") throw new Error(\"scheme\");\n    } catch {\n      items.push({ action: \"skip\", entry, reason: \"its url isn't an http(s) URL\" });\n      continue;\n    }\n    const headerNames = Object.keys(entry.headers);\n    if (headerNames.length > 1) {\n      items.push({ action: \"skip\", entry, reason: `it sends ${headerNames.length} headers (${headerNames.join(\", \")}); a connection keeps one (not supported yet)` });\n      continue;\n    }\n    const existing = (ctx.existing ?? []).find((c) => sameUrl(c.url, url.href));\n    if (existing) {\n      items.push({ action: \"exists\", entry, connection: existing });\n      continue;\n    }\n    const target = await checkTarget(url, ctx.lookup);\n    if (target.kind === \"never\") {\n      items.push({\n        action: \"skip\",\n        entry,\n        reason:\n          target.why === \"ipv6_literal\"\n            ? `the private-network allow takes a hostname or an IPv4 address, not ${target.address}`\n            : `it's on ${target.address}, a link-local or cloud metadata address, which is never allowed`,\n      });\n      continue;\n    }\n    if (target.kind === \"public\" && url.protocol === \"http:\") {\n      items.push({ action: \"skip\", entry, reason: \"plain http to a public host isn't allowed; use its https URL\" });\n      continue;\n    }\n    let slug = slugify(entry.name);\n    for (let n = 2; taken.has(slug); n++) slug = `${slugify(entry.name).slice(0, 21)}-${n}`;\n    taken.add(slug);\n    const auth = headerNames.length\n      ? { type: \"header\" as const, name: headerNames[0]!, value: entry.headers[headerNames[0]!]! }\n      : entry.oauth\n        ? { type: \"oauth\" as const }\n        : { type: \"none\" as const };\n    items.push({ action: \"create\", entry, slug, url: entry.url!.trim(), auth, privateTarget: target.kind === \"private\" ? target.origin : null });\n  }\n  return items;\n}\n\nconst where = (e: ClientEntry) => (e.scope ? ` (${e.scope} scope)` : \"\");\nconst hostOf = (url: string) => {\n  try {\n    return new URL(url).host;\n  } catch {\n    return url;\n  }\n};\n\n/** \"its Authorization header (from $GITHUB_TOKEN) is sent to mcp.example.com\": where each secret ends up. */\nfunction headerLine(i: Extract<PlanItem, { action: \"create\" }>): string | null {\n  if (i.auth.type !== \"header\") return null;\n  const vars = i.entry.headerSources[i.auth.name] ?? [];\n  const from = vars.length ? ` (from ${vars.map((v) => `$${v}`).join(\", \")})` : \"\";\n  return `its ${i.auth.name} header${from} moves into xaq (encrypted; never shown) and is sent to ${safeText(hostOf(i.url), 120)}`;\n}\n\n/** The plan in plain words. Never prints a header value. */\nexport function renderPlan(config: ClientConfig, items: PlanItem[]): string[] {\n  const label = CLIENT_LABELS[config.client];\n  const out: string[] = [];\n  const width = Math.min(24, Math.max(4, ...items.map((i) => i.entry.name.length)));\n  const pad = (s: string) => s.padEnd(width);\n  const cont = \" \".repeat(width + 4);\n  out.push(`${label}: ${config.files.join(\", \") || \"no config file\"} lists ${items.length} MCP server${items.length === 1 ? \"\" : \"s\"}.`);\n  for (const i of items) {\n    const name = `  ${pad(safeText(i.entry.name, 40))}  `;\n    switch (i.action) {\n      case \"self\":\n        out.push(`${name}${pc.dim(\"skip: this is xaq itself\")}`);\n        break;\n      case \"stdio\":\n        out.push(`${name}${pc.yellow(\"not supported yet (M4)\")}: a local command (${safeText(i.entry.command ?? \"\", 60)}); it stays in ${label}`);\n        break;\n      case \"skip\":\n        out.push(`${name}${pc.yellow(\"skip\")}: ${i.reason}; it stays in ${label}`);\n        break;\n      case \"exists\":\n        if (isWorking(i.connection)) out.push(`${name}already connected: \"${i.connection.slug}\" (${i.connection.tools.total} tools)`);\n        else {\n          const why =\n            i.entry.oauth || i.connection.authType === \"oauth\" || i.connection.status === \"needs_reauth\" ? \"needs Connect\" : `${i.connection.status}, ${i.connection.tools.total} tools`;\n          out.push(`${name}already a connection: \"${i.connection.slug}\", ${why}; it stays in ${label} until it works`);\n          out.push(`${cont}${reconnectHint(i.connection)}`);\n        }\n        out.push(...droppedLines(i.entry, cont));\n        break;\n      case \"create\": {\n        out.push(`${name}${pc.green(\"create\")} connection \"${i.slug}\" → ${safeText(i.url, 120)}${where(i.entry)}`);\n        if (i.entry.fromProject) out.push(`${cont}${pc.yellow(\"from the project's .mcp.json\")}: asked separately (--yes doesn't answer it)`);\n        const h = headerLine(i);\n        if (h) out.push(`${cont}${h}`);\n        else if (i.auth.type === \"oauth\") out.push(`${cont}OAuth: created needing Connect (${label} keeps its own tokens); sign in once with the link it prints`);\n        else out.push(`${cont}no credential in ${label}: connected as it is (if it turns out to use OAuth, it needs Connect)`);\n        if (i.privateTarget) out.push(`${cont}${pc.yellow(\"private network\")}: needs the allow for exactly ${i.privateTarget}`);\n        out.push(...droppedLines(i.entry, cont));\n        break;\n      }\n    }\n  }\n  return out;\n}\n\n/** What the client did for this server that the broker doesn't: said in the plan, never silently dropped. */\nfunction droppedLines(e: ClientEntry, cont: string): string[] {\n  const d = e.dropped;\n  if (!d) return [];\n  const out: string[] = [];\n  const list = (xs: string[]) => xs.map((x) => safeText(x, 64)).join(\", \");\n  if (d.exclude) out.push(`${cont}${pc.yellow(\"not carried over\")}: its tool filter hides ${list(d.exclude)}; through xaq every tool is listed (subject to the access level)`);\n  if (d.include) out.push(`${cont}${pc.yellow(\"not carried over\")}: its tool filter shows only ${list(d.include)}; through xaq every tool is listed (subject to the access level)`);\n  if (d.settings.length) out.push(`${cont}${pc.yellow(\"not carried over\")}: ${d.settings.join(\", \")} (xaq uses its own 60 s per call)`);\n  return out;\n}\n\ntype CreateItem = Extract<PlanItem, { action: \"create\" }>;\n\ninterface Outcome {\n  item: CreateItem;\n  /** connected: works now; unverified: created, but not working (yet); authorize: needs a sign-in; failed: nothing kept. */\n  status: \"connected\" | \"unverified\" | \"authorize\" | \"failed\";\n  connection?: ConnectionView;\n  authorizeUrl?: string;\n  error?: string;\n}\n\nconst works = isWorking;\n\nfunction setupLines(r: McpSetupResult): string[] {\n  const out = [r.ok ? `${r.dryRun ? pc.cyan(\"○\") : pc.green(\"✔\")} ${r.message}` : `${pc.yellow(\"!\")} ${r.message}`];\n  for (const l of r.changes ?? []) out.push(l.startsWith(\" \") ? pc.gray(`  ${l}`) : `  - ${l}`);\n  if (r.backup) out.push(pc.gray(`  Backup: ${r.backup}`));\n  if (!r.ok) for (const l of r.manual ?? []) out.push(`    ${l}`);\n  for (const n of r.notes ?? []) out.push(pc.dim(`  ${n}`));\n  if (r.ok && r.verify?.length) out.push(`  ${r.dryRun ? \"Afterwards, check it with\" : \"Check it with\"}: ${r.verify.map((v) => pc.cyan(v)).join(\"; \")}`);\n  return out;\n}\n\nconst toRemove = (e: ClientEntry): RemoveServer => ({ name: e.name, scope: e.scope, projectDir: e.scope === \"user\" ? undefined : e.projectDir });\n\n/** The agent this machine's client uses (its xaq profile), if that agent is on this daemon. */\ninterface ClientAgent {\n  profileName: string;\n  profile: Profile | null;\n  agent: Agent | null;\n}\n\nexport async function runImport(flags: ImportFlags, deps: ImportDeps): Promise<number> {\n  const p = deps.prompter;\n  const client: ImportClient = parseImportClient(flags.from);\n  const label = CLIENT_LABELS[client];\n  const access: AccessLevel | undefined = flags.access ? parseAccess(flags.access) : undefined;\n  const config = readClientConfig(client, { env: deps.env, cwd: deps.cwd });\n  if (!config.entries.length) {\n    p.print(`${label} has no MCP servers configured (${config.files.join(\", \") || \"no config file\"}). Nothing to import.`);\n    return 0;\n  }\n  const profileName = flags.profile ?? DEFAULT_PROFILE;\n\n  if (flags.dryRun) {\n    // Existing connections from the daemon when it's reachable, so a re-run's plan is the real one.\n    let existing: ConnectionView[] | undefined;\n    try {\n      existing = await deps.openApi().list();\n    } catch {\n      existing = undefined;\n    }\n    const items = await planImport(config, { existing, lookup: deps.lookup, selfOrigins: deps.selfOrigins });\n    p.print(pc.bold(\"Dry run: nothing is created or changed.\"));\n    for (const l of renderPlan(config, items)) p.print(l);\n    const creates = items.filter((i): i is CreateItem => i.action === \"create\");\n    const priv = creates.filter((i) => i.privateTarget);\n    p.print(\"\");\n    p.print(`Would create ${creates.length} connection${creates.length === 1 ? \"\" : \"s\"} with ${access ? accessLabel(access) : \"the access you choose (default: Ask before risky actions)\"}.`);\n    if (priv.length) p.print(`Would ask before allowing ${priv.map((i) => i.privateTarget).join(\", \")} (--yes never does; --allow-private <origin> does for that origin).`);\n    if (!existing) p.print(pc.dim(\"xaq wasn't reachable, so existing connections weren't checked (the real run does: nothing is created twice).\"));\n    const removable = [\n      ...items.filter((i): i is Extract<PlanItem, { action: \"exists\" }> => i.action === \"exists\" && works(i.connection)).map((i) => toRemove(i.entry)),\n      ...creates.filter((i) => i.auth.type !== \"oauth\").map((i) => toRemove(i.entry)),\n    ];\n    p.print(\"\");\n    if (!removable.length) p.print(`${label}'s config isn't changed.`);\n    else if (!profileExists(profileName)) {\n      p.print(`Afterwards it offers to replace the imported entries in ${label} with the single xaq entry, once this machine's ${label} is paired (${NPX} connect <xaq-url> --tool ${client}).`);\n    } else {\n      p.print(`Afterwards it offers setup-mcp --tool ${client}, which would (for the entries whose connection works and that ${label}'s agent can use; OAuth ones after you Reconnect them):`);\n      const r = setupMcp(client, mcpTarget(profileName, loadProfile(profileName)), profilePath(profileName), { dryRun: true, removeServers: removable });\n      for (const l of setupLines(r)) p.print(l);\n    }\n    return 0;\n  }\n\n  const api = deps.openApi();\n  const existing = await api.list();\n  const items = await planImport(config, { existing, lookup: deps.lookup, selfOrigins: deps.selfOrigins });\n  for (const l of renderPlan(config, items)) p.print(l);\n  let creates = items.filter((i): i is CreateItem => i.action === \"create\");\n  const already = items.filter((i): i is Extract<PlanItem, { action: \"exists\" }> => i.action === \"exists\");\n  p.print(\"\");\n\n  // A project's .mcp.json was written by whoever can commit to the repository: its own confirmation, never --yes.\n  const fromProject = creates.filter((i) => i.entry.fromProject);\n  if (fromProject.length) {\n    p.print(pc.yellow(`These come from ${fromProject[0]!.entry.file}, which ships with the project (anyone who can commit to it wrote them):`));\n    for (const i of fromProject) p.print(`  ${safeText(i.entry.name, 40)} → ${safeText(i.url, 120)}${headerLine(i) ? `; ${headerLine(i)}` : \"\"}`);\n    if (!(await p.confirmExplicit(`Import ${fromProject.length === 1 ? \"it\" : `these ${fromProject.length}`} into xaq?`, \"they stay in Claude Code\"))) {\n      creates = creates.filter((i) => !i.entry.fromProject);\n    }\n  }\n\n  // The private-target allow: only a person at the terminal (or --allow-private naming the exact origin) gives it.\n  const preAllowed = new Set(flags.allowPrivate ?? []);\n  const priv = creates.filter((i) => i.privateTarget && !preAllowed.has(i.privateTarget));\n  for (const i of creates.filter((x) => x.privateTarget && preAllowed.has(x.privateTarget))) p.print(`Allowing ${i.privateTarget} (${safeText(i.entry.name, 40)}): --allow-private.`);\n  if (priv.length) {\n    p.print(pc.yellow(\"These servers are on this machine or your private network:\"));\n    for (const i of priv) p.print(`  ${i.privateTarget}  (${safeText(i.entry.name, 40)})`);\n    p.print(\n      pc.dim(\"A connection to such a server can reach other services there too. Each allow covers exactly that scheme://host:port, for that connection only.\"),\n    );\n    const names = priv.map((i) => i.entry.name).join(\", \");\n    if (!(await p.confirmExplicit(`Allow xaq to connect to ${priv.length === 1 ? \"it\" : `these ${priv.length}`}?`, `skipping ${names} (pass --allow-private <origin> to allow one)`))) {\n      creates = creates.filter((i) => !priv.includes(i));\n    }\n  }\n\n  const who = await clientAgent(api, profileName);\n  if (!creates.length) {\n    p.print(\"Nothing to create.\");\n    return offerSetup(\n      deps,\n      api,\n      client,\n      who,\n      already.filter((a) => works(a.connection)).map((a) => ({ entry: a.entry, connection: a.connection })),\n      already.filter((a) => !works(a.connection)).map((a) => a.entry.name),\n      0,\n    );\n  }\n\n  const level = await chooseAccess(p, access);\n  let agents = await chooseAgents(p, api, flags.agent);\n  if (agents !== \"all\" && who.agent && !agents.includes(who.agent.id)) {\n    p.print(pc.yellow(`${safeText(who.agent.name, 60)} (the agent ${label} on this machine uses) isn't among them, so ${label} couldn't use these through xaq.`));\n    if (await p.confirm(`Include ${safeText(who.agent.name, 60)}?`, true)) agents = [...agents, who.agent.id];\n  }\n  if (!(await p.confirm(`Create ${creates.length} connection${creates.length === 1 ? \"\" : \"s\"} (${accessLabel(level)}, ${agentsLabel(agents)})?`, true))) {\n    p.print(\"Nothing was created.\");\n    return 0;\n  }\n\n  const outcomes: Outcome[] = [];\n  for (const item of creates) {\n    let created: ConnectionView | null = null;\n    try {\n      created = await api.create({ slug: item.slug, name: item.entry.name, url: item.url, levelDefault: level, ...(agents === \"all\" ? {} : { agentIds: agents }) });\n      if (item.privateTarget) await api.allowPrivateTarget(created.id, true);\n      const r = await api.connect(created.id, item.auth.type === \"header\" ? { header: { name: item.auth.name, value: item.auth.value } } : {});\n      if (r.status === \"connected\") {\n        // \"connected\" means stored, not tested (a header connect doesn't call the server): wait for the first tool sync.\n        const after = await waitWorking(api, r.connection, { pollMs: deps.pollMs, ms: deps.verifyMs });\n        outcomes.push({ item, status: works(after) ? \"connected\" : \"unverified\", connection: after });\n      } else if (r.status === \"authorize\") outcomes.push({ item, status: \"authorize\", connection: created, authorizeUrl: r.authorizeUrl });\n      else throw new Error(r.message);\n    } catch (err) {\n      // Nothing half-made stays behind: running the import again retries it cleanly.\n      if (created) await api.remove(created.id).catch(() => {});\n      outcomes.push({ item, status: \"failed\", error: err instanceof Error ? err.message : String(err) });\n    }\n  }\n\n  p.print(\"\");\n  for (const o of outcomes) {\n    const name = safeText(o.item.entry.name, 40);\n    if (o.status === \"failed\") p.print(`${pc.red(\"✘\")} ${name}: ${safeText(o.error!, 300)} (it stays in ${label})`);\n    else if (o.status === \"connected\") p.print(`${pc.green(\"✔\")} ${name} → \"${o.connection!.slug}\", ${o.connection!.tools.total} tools`);\n    else if (o.status === \"unverified\") {\n      const c = o.connection!;\n      p.print(`${pc.yellow(\"○\")} ${name} → \"${c.slug}\": not working (${c.status}${c.statusReason ? `: ${safeText(c.statusReason, 200)}` : \"\"}, ${c.tools.total} tools), so it stays in ${label}.`);\n      p.print(`    ${reconnectHint(c)}   then run this import again.`);\n    }\n    else {\n      p.print(`${pc.yellow(\"○\")} ${name} → \"${o.connection!.slug}\": needs Connect. Sign in (link valid 15 minutes):`);\n      p.print(`    ${pc.cyan(o.authorizeUrl!)}`);\n      p.print(`    ${reconnectHint(o.connection!)}`);\n    }\n  }\n  const failed = outcomes.filter((o) => o.status === \"failed\").length;\n  const working = [\n    ...already.filter((a) => works(a.connection)).map((a) => ({ entry: a.entry, connection: a.connection })),\n    ...outcomes.filter((o) => o.status === \"connected\").map((o) => ({ entry: o.item.entry, connection: o.connection! })),\n  ];\n  const pending = [\n    ...already.filter((a) => !works(a.connection)).map((a) => a.entry.name),\n    ...outcomes.filter((o) => o.status === \"authorize\" || o.status === \"unverified\").map((o) => o.item.entry.name),\n  ];\n  return offerSetup(deps, api, client, who, working, pending, failed ? 1 : 0);\n}\n\nasync function clientAgent(api: ConnectionsApi, profileName: string): Promise<ClientAgent> {\n  if (!profileExists(profileName)) return { profileName, profile: null, agent: null };\n  const profile = loadProfile(profileName);\n  const agent = (await api.agents()).find((a) => a.id === profile.agentId && !a.disabled) ?? null;\n  return { profileName, profile, agent };\n}\n\n/**\n * Step 2: replace the entries now served by the broker with the single xaq entry (setup-mcp). Only entries\n * the client's own agent can use through xaq go: the profile's agent must be on this daemon and have a grant\n * on the connection (offered when it has none).\n */\nasync function offerSetup(\n  deps: ImportDeps,\n  api: ConnectionsApi,\n  client: ImportClient,\n  who: ClientAgent,\n  working: { entry: ClientEntry; connection: ConnectionView }[],\n  pending: string[],\n  code: number,\n): Promise<number> {\n  const p = deps.prompter;\n  const label = CLIENT_LABELS[client];\n  if (pending.length) p.print(pc.dim(`${pending.join(\", \")} stay${pending.length === 1 ? \"s\" : \"\"} in ${label} until ${pending.length === 1 ? \"it works\" : \"they work\"} through xaq (Reconnect); then run this import again to replace ${pending.length === 1 ? \"it\" : \"them\"}.`));\n  if (!working.length) return code;\n  if (!who.profile) {\n    p.print(\n      `To replace ${working.map((w) => w.entry.name).join(\", \")} in ${label} with the single xaq entry, pair it first ` +\n        `(${NPX} connect <xaq-url> --tool ${client}) and run this import again.`,\n    );\n    return code;\n  }\n  if (!who.agent) {\n    p.print(\n      pc.yellow(\n        `The agent in your \"${who.profileName}\" profile (${safeText(who.profile.agentId, 40)}) isn't an agent of this xaq (or is disabled), so ${label} ` +\n          `couldn't use these through it. Not replacing anything in ${label}. Pair it with this xaq (${NPX} connect <xaq-url> --tool ${client} --force), then run this import again.`,\n      ),\n    );\n    return code;\n  }\n  const agentName = safeText(who.agent.name, 60);\n  const usable: ClientEntry[] = [];\n  for (const w of working) {\n    if (w.entry.fromProject) {\n      // ./.mcp.json is the project's file (often committed): left for its owners to change.\n      p.print(pc.dim(`  \"${w.entry.name}\" stays in ${w.entry.file}: it ships with the project. Remove it there if the project no longer needs it.`));\n      continue;\n    }\n    const grants = await api.grants(w.connection.id);\n    if (grants.some((g) => g.agentId === who.agent!.id)) {\n      usable.push(w.entry);\n      continue;\n    }\n    if (await p.confirm(`${agentName} (the agent ${label} uses) has no access to \"${w.connection.slug}\". Give it ${accessLabel(w.connection.levelDefault)}?`, true)) {\n      await api.setGrants(w.connection.id, [...grants.map((g) => ({ agentId: g.agentId, level: g.level })), { agentId: who.agent.id, level: w.connection.levelDefault }]);\n      usable.push(w.entry);\n    } else p.print(pc.dim(`  \"${w.entry.name}\" stays in ${label}: its agent couldn't use \"${w.connection.slug}\".`));\n  }\n  if (!usable.length) return code;\n  p.print(\"\");\n  const question = `Replace ${usable.map((e) => `\"${e.name}\"`).join(\", \")} in ${label} with the single xaq entry (setup-mcp --tool ${client}, with a backup)?`;\n  const routes = confinedRoutes(client, mcpServerName(who.profileName), deps.env);\n  let ok: boolean;\n  if (routes.length) {\n    const slugs = working.filter((w) => usable.includes(w.entry)).map((w) => w.connection.slug);\n    p.print(pc.yellow(`These ${label} settings are limited to the xaq server only:`));\n    for (const r of routes) p.print(`  ${safeText(r, 120)}`);\n    p.print(\n      pc.yellow(\n        `Through xaq they now also see the tools of ${slugs.map((s) => `\"${s}\"`).join(\", \")} (as <name>__<tool>), which ${routes.length === 1 ? \"it\" : \"they\"} couldn't reach before. ` +\n          `If one is triggered by email or webhooks, those tools become reachable from that content. Give ${agentName} less access on those connections, or keep them out, if that's not what you want.`,\n      ),\n    );\n    ok = await p.confirmExplicit(question, `${label}'s config wasn't changed; decide in a terminal`);\n  } else ok = await p.confirm(question, true);\n  if (!ok) {\n    p.print(`${label}'s config wasn't changed. Run this import again any time to do it.`);\n    return code;\n  }\n  const r = setupMcp(client, mcpTarget(who.profileName, who.profile), profilePath(who.profileName), { removeServers: usable.map(toRemove) });\n  for (const l of setupLines(r)) p.print(l);\n  const vars = [...new Set(usable.flatMap((e) => ((r.removed ?? []).includes(e.name) ? e.headerVars : [])))];\n  if (r.ok && vars.length) {\n    p.print(pc.dim(`  ${vars.join(\", \")} ${vars.length === 1 ? \"is\" : \"are\"} no longer needed by the removed entries; delete ${vars.length === 1 ? \"it\" : \"them\"} from your environment${client === \"hermes\" ? \" (~/.hermes/.env)\" : \"\"} once everything works through xaq.`));\n  }\n  return r.ok ? code : 1;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAYA,SAAgB,eAAe,QAAsB,YAAoB,MAAyB,QAAQ,KAAe;CACvH,IAAI,WAAW,UAAU,OAAO,CAAC;CACjC,MAAM,OAAO,WAAW,GAAG;CAC3B,MAAM,wBAAQ,IAAI,IAAI,CAAC,YAAY,OAAO,YAAY,CAAC;CACvD,MAAM,YAAY,MAAe,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,IAAI,CAAC,CAAC;CACxG,MAAM,MAAgB,CAAC;CACvB,MAAM,QAAQ,SAA0B;EACtC,IAAI;GACF,OAAO,WAAW,IAAI,IAAI,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,IAAI;EACvF,QAAQ;GACN,OAAO;EACT;CACF;CACA,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,aAAa;EACvC,IAAI,WAAW,MAAM,GAAG;GACtB,MAAM,OAAO,aAAa,QAAQ,MAAM;GACxC,MAAM,YAAY,WAAW,MAAM,mBAAmB,KAAK,CAAC;GAC5D,KAAK,MAAM,CAAC,UAAU,aAAa,OAAO,QAAQ,SAAS,GAAG,IAAI,SAAS,QAAQ,GAAG,IAAI,KAAK,qBAAqB,SAAS,eAAe;GAE5I,MAAM,OAAO,GAA0B,MAAsC,KAAK,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,CAAC,IAAK,EAAgC,KAAK,KAAA;GACrK,MAAM,SAAS,IAAI,IAAI,IAAI,WAAW,MAAM,WAAW,KAAK,KAAA,GAAW,SAAS,GAAG,OAAO,GAAG,QAAQ;GACrG,IAAI,WAAW,cAAe,MAAM,QAAQ,MAAM,KAAK,OAAO,MAAM,MAAM,MAAM,UAAU,GACxF,IAAI,KAAK,2GAA2G;QAC/G,IAAI,MAAM,QAAQ,MAAM,GAC7B,OAAO,SAAS,GAAG,MAAM;IACvB,IAAI,SAAS,IAAI,GAAG,UAAU,CAAC,GAAG,IAAI,KAAK,iBAAiB,OAAO,IAAI,GAAG,MAAM,KAAK,IAAI,IAAI,GAAG,EAAE,eAAe;GACnH,CAAC;QACI,IAAI,UAAU,OAAO,WAAW,UAChC;SAAA,MAAM,CAAC,MAAM,MAAM,OAAO,QAAQ,MAAmC,GAAG,IAAI,SAAS,IAAI,GAAG,UAAU,CAAC,GAAG,IAAI,KAAK,iBAAiB,KAAK,eAAe;GAAA;EAEjK;CACF,QAAQ,CAER;CACA,MAAM,OAAO,KAAK,KAAK,MAAM,4BAA4B,CAAC;CAC1D,IAAI,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GACpD;OAAA,MAAM,CAAC,OAAO,MAAM,OAAO,QAAQ,IAA8C,GAAG,IAAI,SAAS,GAAG,QAAQ,GAAG,IAAI,KAAK,iBAAiB,OAAO;CAAA;CAEvJ,MAAM,OAAO,KAAK,KAAK,MAAM,QAAQ,WAAW,CAAC;CACjD,MAAM,OAAQ,MAAM,QAAQ,IAAI,IAAI,OAAS,MAAoC,QAAQ,CAAC;CAC1F,IAAI,MAAM,QAAQ,IAAI,GAAQ;OAAA,MAAM,KAAK,MAAM,IAAI,SAAS,GAAG,gBAAgB,GAAG,IAAI,KAAK,YAAY,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG;CAAA;CACtI,OAAO;AACT;;;;AC/CA,MAAa,iBAAiB;CAAC;CAAU;CAAe;CAAU;AAAO;AAGzE,MAAa,gBAA8C;CAAE,QAAQ;CAAU,eAAe;CAAe,QAAQ;CAAU,OAAO;AAAQ;AA2C9I,MAAM,WAAW,MAAgB,MAAM,QAAQ,CAAC,IAAI,EAAE,QAAQ,MAAmB,OAAO,MAAM,QAAQ,IAAI,KAAA;AAE1G,SAAS,YAAY,GAA4B,SAAiD,aAAoD;CACpJ,MAAM,IAAqB,EAAE,UAAU,YAAY,QAAQ,MAAM,EAAE,OAAO,KAAA,KAAa,EAAE,OAAO,IAAI,EAAE;CACtG,MAAM,MAAM,QAAQ,QAAQ,OAAO;CACnC,MAAM,MAAM,QAAQ,QAAQ,OAAO;CACnC,IAAI,KAAK,QAAQ,EAAE,UAAU;CAC7B,IAAI,KAAK,QAAQ,EAAE,UAAU;CAC7B,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,SAAS,IAAI,KAAA;AAC3D;;AAcA,SAAgB,YAAY,MAAsC;CAChE,MAAM,MAA8B,CAAC;CACrC,KAAK,MAAM,OAAO,KAAK,MAAM,IAAI,GAAG;EAClC,MAAM,IAAI,6DAA6D,KAAK,GAAG;EAC/E,IAAI,CAAC,GAAG;EACR,IAAI,IAAI,EAAE;EACV,IAAK,EAAE,WAAW,IAAG,KAAK,EAAE,SAAS,IAAG,KAAK,EAAE,UAAU,KAAO,EAAE,WAAW,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,UAAU,GAAI,IAAI,EAAE,MAAM,GAAG,EAAE;OACpI,IAAI,EAAE,QAAQ,WAAW,EAAE;EAChC,IAAI,EAAE,MAAO;CACf;CACA,OAAO;AACT;;AAKA,SAAgB,WAAW,OAAe,MAAoD;CAC5F,MAAM,OAAiB,CAAC;CACxB,IAAI,UAAyB;CAC7B,MAAM,MAAM,MAAM,QAAQ,2DAA2D,IAAI,MAAc,QAA4B;EACjI,MAAM,IAAI,KAAK;EACf,IAAI,MAAM,KAAA,KAAa,MAAM,IAAI;GAC/B,KAAK,KAAK,IAAI;GACd,OAAO;EACT;EACA,IAAI,QAAQ,KAAA,GAAW,OAAO;EAC9B,YAAY;EACZ,OAAO;CACT,CAAC;CACD,OAAO,UAAU,EAAE,QAAQ,IAAI;EAAE,OAAO;EAAK,MAAM;CAAK;AAC1D;AAEA,MAAM,SAAS,MAA6C,CAAC,CAAC,KAAK,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,CAAC;AAC5G,MAAM,YAAY,SAAiD;CACjE,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,MAAM,OAAO,aAAa,MAAM,MAAM;CACtC,IAAI,CAAC,KAAK,KAAK,GAAG,OAAO,CAAC;CAC1B,IAAI;EACF,MAAM,MAAM,KAAK,MAAM,IAAI;EAC3B,IAAI,CAAC,MAAM,GAAG,GAAG,MAAM,IAAI,MAAM,eAAe;EAChD,OAAO;CACT,QAAQ;EACN,MAAM,IAAI,MAAM,GAAG,KAAK,kEAAkE;CAC5F;AACF;;AAGA,SAAS,UAAU,MAAc,KAAc,MAAc,MAA0C,QAA8B,CAAC,GAAgB;CACpJ,MAAM,OAAoB;EAAE;EAAM;EAAM,WAAW;EAAQ,SAAS,CAAC;EAAG,YAAY,CAAC;EAAG,eAAe,CAAC;EAAG,OAAO;EAAO,SAAS;EAAM,GAAG;CAAM;CACjJ,IAAI,CAAC,MAAM,GAAG,GAAG,OAAO;EAAE,GAAG;EAAM,SAAS;CAA6B;CACzE,IAAI,IAAI,aAAa,QAAQ,IAAI,YAAY,OAAO,KAAK,UAAU;CACnE,MAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,KAAK,YAAY,IAAI;CACrE,IAAI,SAAS,WAAY,OAAO,IAAI,YAAY,YAAY,CAAC,IAAI,KAAM;EACrE,MAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,MAAM,IAAI,CAAC;EAC/D,OAAO;GAAE,GAAG;GAAM,WAAW;GAAS,SAAS,CAAC,OAAO,IAAI,WAAW,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK;EAAE;CACvG;CACA,IAAI,OAAO,IAAI,QAAQ,UAAU,OAAO;EAAE,GAAG;EAAM,SAAS;CAAS;CACrE,MAAM,MAAM,WAAW,IAAI,KAAK,IAAI;CACpC,IAAI,aAAa,KAAK,OAAO;EAAE,GAAG;EAAM,SAAS,mBAAmB,IAAI,QAAQ;CAAyB;CACzG,MAAM,QAAqB;EAAE,GAAG;EAAM,KAAK,IAAI;EAAO,WAAW,SAAS,QAAQ,QAAQ;CAAO;CACjG,IAAI,IAAI,kBAAkB,KAAA,KAAa,IAAI,mBAAmB,KAAA,GAAW,OAAO;EAAE,GAAG;EAAO,SAAS;CAAwE;CAC7K,IAAI,IAAI,UAAU,KAAA,KAAa,IAAI,SAAS,KAAA,GAAW,MAAM,QAAQ;CACrE,OAAO,YAAY,OAAO,IAAI,SAAS,IAAI;AAC7C;AAEA,SAAS,YAAY,OAAoB,SAAkB,MAAuD;CAChH,IAAI,YAAY,KAAA,KAAa,YAAY,MAAM,OAAO;CACtD,IAAI,CAAC,MAAM,OAAO,GAAG,OAAO;EAAE,GAAG;EAAO,SAAS;CAA4B;CAC7E,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,GAAG;EAC5C,IAAI,OAAO,MAAM,UAAU,OAAO;GAAE,GAAG;GAAO,SAAS,OAAO,EAAE;EAAuB;EACvF,MAAM,IAAI,WAAW,GAAG,IAAI;EAC5B,IAAI,aAAa,GAAG,OAAO;GAAE,GAAG;GAAO,SAAS,OAAO,EAAE,kBAAkB,EAAE,QAAQ;EAAyB;EAC9G,MAAM,QAAQ,KAAK,EAAE;EACrB,MAAM,WAAW,KAAK,GAAG,EAAE,IAAI;EAC/B,MAAM,cAAc,KAAK,EAAE;CAC7B;CACA,OAAO;AACT;AAIA,SAAgB,YAAY,MAAyB,QAAQ,KAAsC;CACjG,MAAM,OAAO,WAAW,GAAG;CAC3B,OAAO;EAAE,QAAQ,KAAK,MAAM,aAAa;EAAG,KAAK,KAAK,MAAM,MAAM;CAAE;AACtE;AAEA,SAAS,WAAW,MAAiC;CACnD,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,QAAQ,YAAY,GAAG;CAC7B,MAAM,SAAuB;EAAE,QAAQ;EAAU,OAAO,CAAC,MAAM,MAAM;EAAG,SAAS,CAAC;CAAE;CACpF,IAAI,CAAC,WAAW,MAAM,MAAM,GAAG,OAAO;CACtC,MAAM,UAAU,eAAe,aAAa,MAAM,QAAQ,MAAM,CAAC;CACjE,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,GAAG,MAAM,OAAO,uGAAuG;CAErJ,MAAM,OAAO;EAAE,GAAG;EAAK,GAAI,WAAW,MAAM,GAAG,IAAI,YAAY,aAAa,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC;CAAG;CACtG,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,OAAO,GAAG;EACjD,IAAI,KAAK,WAAW,IAAQ,GAAG;EAC/B,MAAM,OAAoB;GAAE;GAAM,MAAM,MAAM;GAAQ,WAAW;GAAQ,SAAS,CAAC;GAAG,YAAY,CAAC;GAAG,eAAe,CAAC;GAAG,OAAO;GAAO,SAAS;EAAK;EACrJ,IAAI,CAAC,OAAO,QAAQA,cAAmB,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;GACpF,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS;GAA2B,CAAC;GACpE;EACF;EACA,MAAM,IAAI;EACV,MAAM,aAAa;GAAC;GAAO;GAAW;GAAW;GAAQ;GAAa;EAAS,CAAC,CAAC,MAAM,MAAM,EAAE,OAAOA,UAAe;EACrH,IAAI,YAAY;GACd,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS,OAAO,WAAW;GAAgB,CAAC;GAC3E;EACF;EACA,IAAI,EAAE,YAAY,SAAU,OAAO,EAAE,YAAY,YAAY;GAAC;GAAS;GAAM;GAAO;EAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,YAAY,CAAC,GAAI,KAAK,UAAU;EAC5I,IAAI,OAAO,EAAE,YAAY,UAAU;GACjC,MAAM,OAAO,MAAM,QAAQ,EAAE,IAAI,IAAI,EAAE,KAAK,QAAQ,MAAM,OAAO,MAAM,QAAQ,IAAI,CAAC;GACpF,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,WAAW;IAAS,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;GAAE,CAAC;GAC5F;EACF;EACA,IAAI,OAAO,EAAE,QAAQ,UAAU;GAC7B,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS;GAAS,CAAC;GAClD;EACF;EACA,MAAM,MAAM,WAAW,EAAE,KAAK,IAAI;EAClC,IAAI,aAAa,KAAK;GACpB,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS,mBAAmB,IAAI,QAAQ,wBAAwB,MAAM;GAAM,CAAC;GAC5G;EACF;EACA,MAAM,QAAQ,MAAM,EAAE,KAAK,IAAK,EAAE,QAAoC,CAAC;EACvE,MAAM,QAAqB;GACzB,GAAG;GACH,KAAK,IAAI;GACT,WAAW,EAAE,cAAc,QAAQ,QAAQ;GAC3C,OAAO,EAAE,SAAS,WAAW,MAAM,EAAE,KAAK;GAC1C,SAAS,YAAY,GAA8B;IAAE,SAAS,MAAM;IAAS,SAAS,MAAM;GAAQ,GAAG,CAAC,WAAW,iBAAiB,CAAC;EACvI;EACA,IAAI,EAAE,gBAAgB,KAAA,KAAa,EAAE,oBAAoB,KAAA,GAAW;GAClE,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAO,SAAS;GAAwF,CAAC;GAClI;EACF;EACA,OAAO,QAAQ,KAAK,YAAY,OAAO,EAAE,WAAW,KAAA,GAAW,IAAI,CAAC;CACtE;CACA,OAAO;AACT;AAIA,SAAS,WAAW,MAAiC;CACnD,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,MAAM,KAAK,OAAO,QAAQ,IAAI;CACpC,MAAM,WAAW,iBAAiB;CAClC,MAAM,cAAc,KAAK,KAAK,WAAW;CACzC,MAAM,SAAuB;EAAE,QAAQ;EAAe,OAAO,CAAC,UAAU,WAAW,CAAC,CAAC,OAAO,UAAU;EAAG,SAAS,CAAC;CAAE;CACrH,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,OAAO,MAAmB;EAE9B,IAAI,KAAK,IAAI,EAAE,IAAI,GAAG;EACtB,KAAK,IAAI,EAAE,IAAI;EACf,OAAO,QAAQ,KAAK,CAAC;CACvB;CACA,MAAM,MAAM,SAAS,QAAQ;CAC7B,MAAM,OAAO,OAAO,MAAM,IAAI,QAAQ,KAAK,MAAM,IAAI,SAAS,IAAI,IAAK,IAAI,SAAS,OAAmC,CAAC;CACxH,MAAM,QAAQ,KAAK;CACnB,IAAI,MAAM,KAAK,GAAG,KAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,KAAK,GAAG,IAAI,UAAU,GAAG,KAAK,UAAU,KAAK;EAAE,OAAO;EAAS,YAAY;CAAI,CAAC,CAAC;CACzI,MAAM,UAAU,SAAS,WAAW;CACpC,IAAI,WAAW,MAAM,QAAQ,UAAU,GAAG;EAIxC,MAAM,QAAQ,MAAgB,MAAM,QAAQ,CAAC,IAAI,EAAE,QAAQ,MAAmB,OAAO,MAAM,QAAQ,IAAI,CAAC;EACxG,MAAM,UAAU,IAAI,IAAI,KAAK,KAAK,qBAAqB,CAAC;EACxD,MAAM,WAAW,IAAI,IAAI,KAAK,KAAK,sBAAsB,CAAC;EAC1D,MAAM,MAAM,KAAK,+BAA+B;EAChD,KAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,QAAQ,UAAU,GAAG;GACzD,MAAM,IAAI,UAAU,GAAG,KAAK,aAAa,KAAK;IAAE,OAAO;IAAW,YAAY;IAAK,aAAa;GAAK,CAAC;GACtG,MAAM,MAAM,SAAS,IAAI,CAAC,IAAI,+CAA+C,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,IAAI,gCAAgC;GAEvI,IAAI,KAAK,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAG,SAAS;GAAI,CAAC;QAC9C,IAAI,CAAC;EACZ;CACF;CACA,IAAI,OAAO,MAAM,IAAI,UAAU,GAAG,KAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,IAAI,UAAU,GAAG,IAAI,UAAU,GAAG,KAAK,UAAU,KAAK,EAAE,OAAO,OAAO,CAAC,CAAC;CAChJ,OAAO;AACT;AAIA,SAAS,WAAW,MAAiC;CACnD,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,OAAO,iBAAiB;CAC9B,MAAM,SAAuB;EAAE,QAAQ;EAAU,OAAO,CAAC,IAAI;EAAG,SAAS,CAAC;CAAE;CAC5E,MAAM,MAAM,SAAS,IAAI;CACzB,IAAI,OAAO,MAAM,IAAI,UAAU,GAAG,KAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,IAAI,UAAU,GAAG,OAAO,QAAQ,KAAK,UAAU,GAAG,KAAK,MAAM,GAAG,CAAC;CACzI,OAAO;AACT;AAIA,SAAS,UAAU,MAAiC;CAClD,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,OAAO,gBAAgB;CAC7B,MAAM,SAAuB;EAAE,QAAQ;EAAS,OAAO,CAAC,IAAI;EAAG,SAAS,CAAC;CAAE;CAC3E,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,mBAAmB,aAAa,MAAM,MAAM,CAAC,CAAC,GAAG;EACxF,MAAM,OAAoB;GAAE;GAAM;GAAM,WAAW;GAAQ,SAAS,CAAC;GAAG,YAAY,CAAC;GAAG,eAAe,CAAC;GAAG,OAAO;GAAO,SAAS;EAAK;EACvI,IAAI,QAAQC,cAAiB;GAC3B,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS;GAA2B,CAAC;GACpE;EACF;EACA,MAAM,IAAI;EACV,IAAI,EAAE,YAAY,OAAO,KAAK,UAAU;EACxC,IAAI,OAAO,EAAE,YAAY,UAAU;GACjC,MAAM,OAAO,MAAM,QAAQ,EAAE,IAAI,IAAI,EAAE,KAAK,QAAQ,MAAmB,OAAO,MAAM,QAAQ,IAAI,CAAC;GACjG,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,WAAW;IAAS,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;GAAE,CAAC;GAC5F;EACF;EACA,IAAI,OAAO,EAAE,QAAQ,UAAU;GAC7B,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS;GAAS,CAAC;GAClD;EACF;EACA,MAAM,QAAqB;GACzB,GAAG;GACH,KAAK,EAAE;GACP,OAAO,MAAM,EAAE,KAAK,KAAK,EAAE,SAAS;GACpC,SAAS,YAAY,GAAG;IAAE,SAAS,EAAE;IAAe,SAAS,EAAE;GAAe,GAAG,CAAC,oBAAoB,qBAAqB,CAAC;EAC9H;EACA,IAAI,EAAE,wBAAwB,KAAA,GAAW;GACvC,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAO,SAAS;GAAwE,CAAC;GAClH;EACF;EAEA,MAAM,UAAkC,CAAC;EACzC,IAAI;EACJ,IAAI,EAAE,iBAAiB,KAAA,GAAW;GAChC,IAAI,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,OAAO,EAAE,YAAY,CAAC,CAAC,MAAM,MAAM,OAAO,MAAM,QAAQ,GAAG,UAAU;QACrG;IACH,OAAO,OAAO,SAAS,EAAE,YAAY;IACrC,KAAK,MAAM,KAAK,OAAO,KAAK,EAAE,YAAY,GAAG,MAAM,cAAc,KAAK,CAAC;GACzE;EACF;EACA,MAAM,UAAmC,MAAM,EAAE,gBAAgB,IAAI,EAAE,GAAG,EAAE,iBAAiB,IAAI,CAAC;EAClG,IAAI,EAAE,yBAAyB,KAAA,GAAW,QAAQ,gBAAgB,EAAE;EACpE,KAAK,MAAM,CAAC,GAAG,YAAY,OAAO,QAAQ,OAAO,GAC/C,IAAI,OAAO,YAAY,UAAU,YAAY,OAAO,EAAE;OACjD,IAAI,CAAC,IAAI,UAAU,YAAY,OAAO,EAAE,sBAAsB,QAAQ;OACtE;GACH,QAAQ,KAAK,MAAM,mBAAmB,EAAE,yBAAyB,UAAU,UAAU,IAAI,aAAa,IAAI;GAC1G,MAAM,WAAW,KAAK,OAAO;GAC7B,MAAM,cAAc,KAAK,CAAC,OAAO;EACnC;EAEF,MAAM,UAAU;EAChB,OAAO,QAAQ,KAAK,UAAU;GAAE,GAAG;GAAO;EAAQ,IAAI,KAAK;CAC7D;CACA,OAAO;AACT;AAEA,SAAgB,iBAAiB,QAAsB,OAAoB,CAAC,GAAiB;CAC3F,QAAQ,QAAR;EACE,KAAK,UACH,OAAO,WAAW,IAAI;EACxB,KAAK,eACH,OAAO,WAAW,IAAI;EACxB,KAAK,UACH,OAAO,WAAW,IAAI;EACxB,KAAK,SACH,OAAO,UAAU,IAAI;CACzB;AACF;AAEA,SAAgB,kBAAkB,OAA6B;CAC7D,MAAM,IAAI,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,YAAY,aAAa;CACtE,IAAI,CAAE,eAAqC,SAAS,CAAC,GAAG,MAAM,IAAI,MAAM,mBAAmB,MAAM,oBAAoB,eAAe,KAAK,IAAI,EAAE,EAAE;CACjJ,OAAO;AACT;;;ACrRA,MAAM,YAAY;AAElB,SAAS,OAAO,GAAgB,aAAgC;CAC9D,IAAI,UAAU,KAAK,EAAE,IAAI,GAAG,OAAO;CACnC,IAAI,OAAO,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,MAAM,kBAAkB,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,OAAO;CACnF,IAAI,CAAC,EAAE,KAAK,OAAO;CACnB,IAAI;EACF,MAAM,IAAI,IAAI,IAAI,EAAE,GAAG;EACvB,OAAO,EAAE,SAAS,QAAQ,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,KAAK,YAAY,SAAS,EAAE,MAAM;CACzF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAM,WAAW,GAA8B,MAAc;CAC3D,IAAI;EACF,OAAO,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,QAAQ,EAAE;CAC1F,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAsB,WAAW,QAAsB,MAAkF,CAAC,GAAwB;CAChK,MAAM,QAAQ,cAAc,OAAO;CACnC,MAAM,QAAQ,IAAI,KAAK,IAAI,YAAY,CAAC,EAAA,CAAG,KAAK,MAAM,EAAE,IAAI,CAAC;CAC7D,MAAM,QAAoB,CAAC;CAC3B,KAAK,MAAM,SAAS,OAAO,SAAS;EAClC,IAAI,OAAO,OAAO,IAAI,eAAe,CAAC,CAAC,GAAG;GACxC,MAAM,KAAK;IAAE,QAAQ;IAAQ;GAAM,CAAC;GACpC;EACF;EACA,IAAI,MAAM,cAAc,SAAS;GAC/B,MAAM,KAAK;IAAE,QAAQ;IAAS;GAAM,CAAC;GACrC;EACF;EACA,IAAI,MAAM,SAAS;GACjB,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ,MAAM;GAAQ,CAAC;GAC3D;EACF;EACA,IAAI,CAAC,MAAM,SAAS;GAClB,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ,sBAAsB;GAAQ,CAAC;GAC3E;EACF;EACA,IAAI;EACJ,IAAI;GACF,MAAM,IAAI,IAAI,MAAM,GAAI;GACxB,IAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU,MAAM,IAAI,MAAM,QAAQ;EACrF,QAAQ;GACN,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ;GAA+B,CAAC;GAC5E;EACF;EACA,MAAM,cAAc,OAAO,KAAK,MAAM,OAAO;EAC7C,IAAI,YAAY,SAAS,GAAG;GAC1B,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ,YAAY,YAAY,OAAO,YAAY,YAAY,KAAK,IAAI,EAAE;GAA+C,CAAC;GAC9J;EACF;EACA,MAAM,YAAY,IAAI,YAAY,CAAC,EAAA,CAAG,MAAM,MAAM,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;EAC1E,IAAI,UAAU;GACZ,MAAM,KAAK;IAAE,QAAQ;IAAU;IAAO,YAAY;GAAS,CAAC;GAC5D;EACF;EACA,MAAM,SAAS,MAAM,YAAY,KAAK,IAAI,MAAM;EAChD,IAAI,OAAO,SAAS,SAAS;GAC3B,MAAM,KAAK;IACT,QAAQ;IACR;IACA,QACE,OAAO,QAAQ,iBACX,sEAAsE,OAAO,YAC7E,WAAW,OAAO,QAAQ;GAClC,CAAC;GACD;EACF;EACA,IAAI,OAAO,SAAS,YAAY,IAAI,aAAa,SAAS;GACxD,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ;GAA+D,CAAC;GAC5G;EACF;EACA,IAAI,OAAO,QAAQ,MAAM,IAAI;EAC7B,KAAK,IAAI,IAAI,GAAG,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,GAAG,QAAQ,MAAM,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,GAAG;EACpF,MAAM,IAAI,IAAI;EACd,MAAM,OAAO,YAAY,SACrB;GAAE,MAAM;GAAmB,MAAM,YAAY;GAAK,OAAO,MAAM,QAAQ,YAAY;EAAM,IACzF,MAAM,QACJ,EAAE,MAAM,QAAiB,IACzB,EAAE,MAAM,OAAgB;EAC9B,MAAM,KAAK;GAAE,QAAQ;GAAU;GAAO;GAAM,KAAK,MAAM,IAAK,KAAK;GAAG;GAAM,eAAe,OAAO,SAAS,YAAY,OAAO,SAAS;EAAK,CAAC;CAC7I;CACA,OAAO;AACT;AAEA,MAAM,SAAS,MAAoB,EAAE,QAAQ,KAAK,EAAE,MAAM,WAAW;AACrE,MAAM,UAAU,QAAgB;CAC9B,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAS,WAAW,GAA2D;CAC7E,IAAI,EAAE,KAAK,SAAS,UAAU,OAAO;CACrC,MAAM,OAAO,EAAE,MAAM,cAAc,EAAE,KAAK,SAAS,CAAC;CACpD,MAAM,OAAO,KAAK,SAAS,UAAU,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,KAAK;CAC9E,OAAO,OAAO,EAAE,KAAK,KAAK,SAAS,KAAK,0DAA0D,SAAS,OAAO,EAAE,GAAG,GAAG,GAAG;AAC/H;;AAGA,SAAgB,WAAW,QAAsB,OAA6B;CAC5E,MAAM,QAAQ,cAAc,OAAO;CACnC,MAAM,MAAgB,CAAC;CACvB,MAAM,QAAQ,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;CAChF,MAAM,OAAO,MAAc,EAAE,OAAO,KAAK;CACzC,MAAM,OAAO,IAAI,OAAO,QAAQ,CAAC;CACjC,IAAI,KAAK,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,IAAI,KAAK,iBAAiB,SAAS,MAAM,OAAO,aAAa,MAAM,WAAW,IAAI,KAAK,IAAI,EAAE;CACrI,KAAK,MAAM,KAAK,OAAO;EACrB,MAAM,OAAO,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,EAAE,CAAC,EAAE;EAClD,QAAQ,EAAE,QAAV;GACE,KAAK;IACH,IAAI,KAAK,GAAG,OAAO,GAAG,IAAI,0BAA0B,GAAG;IACvD;GACF,KAAK;IACH,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,wBAAwB,EAAE,qBAAqB,SAAS,EAAE,MAAM,WAAW,IAAI,EAAE,EAAE,iBAAiB,OAAO;IACxI;GACF,KAAK;IACH,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,MAAM,EAAE,IAAI,EAAE,OAAO,gBAAgB,OAAO;IACzE;GACF,KAAK;IACH,IAAI,UAAU,EAAE,UAAU,GAAG,IAAI,KAAK,GAAG,KAAK,sBAAsB,EAAE,WAAW,KAAK,KAAK,EAAE,WAAW,MAAM,MAAM,QAAQ;SACvH;KACH,MAAM,MACJ,EAAE,MAAM,SAAS,EAAE,WAAW,aAAa,WAAW,EAAE,WAAW,WAAW,iBAAiB,kBAAkB,GAAG,EAAE,WAAW,OAAO,IAAI,EAAE,WAAW,MAAM,MAAM;KACvK,IAAI,KAAK,GAAG,KAAK,yBAAyB,EAAE,WAAW,KAAK,KAAK,IAAI,gBAAgB,MAAM,gBAAgB;KAC3G,IAAI,KAAK,GAAG,OAAO,cAAc,EAAE,UAAU,GAAG;IAClD;IACA,IAAI,KAAK,GAAG,aAAa,EAAE,OAAO,IAAI,CAAC;IACvC;GACF,KAAK,UAAU;IACb,IAAI,KAAK,GAAG,OAAO,GAAG,MAAM,QAAQ,EAAE,eAAe,EAAE,KAAK,MAAM,SAAS,EAAE,KAAK,GAAG,IAAI,MAAM,EAAE,KAAK,GAAG;IACzG,IAAI,EAAE,MAAM,aAAa,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,8BAA8B,EAAE,6CAA6C;IACnI,MAAM,IAAI,WAAW,CAAC;IACtB,IAAI,GAAG,IAAI,KAAK,GAAG,OAAO,GAAG;SACxB,IAAI,EAAE,KAAK,SAAS,SAAS,IAAI,KAAK,GAAG,KAAK,kCAAkC,MAAM,6DAA6D;SACnJ,IAAI,KAAK,GAAG,KAAK,mBAAmB,MAAM,sEAAsE;IACrH,IAAI,EAAE,eAAe,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,iBAAiB,EAAE,gCAAgC,EAAE,eAAe;IACtH,IAAI,KAAK,GAAG,aAAa,EAAE,OAAO,IAAI,CAAC;IACvC;GACF;EACF;CACF;CACA,OAAO;AACT;;AAGA,SAAS,aAAa,GAAgB,MAAwB;CAC5D,MAAM,IAAI,EAAE;CACZ,IAAI,CAAC,GAAG,OAAO,CAAC;CAChB,MAAM,MAAgB,CAAC;CACvB,MAAM,QAAQ,OAAiB,GAAG,KAAK,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;CACvE,IAAI,EAAE,SAAS,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,kBAAkB,EAAE,0BAA0B,KAAK,EAAE,OAAO,EAAE,iEAAiE;CAC3K,IAAI,EAAE,SAAS,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,kBAAkB,EAAE,+BAA+B,KAAK,EAAE,OAAO,EAAE,iEAAiE;CAChL,IAAI,EAAE,SAAS,QAAQ,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,kBAAkB,EAAE,IAAI,EAAE,SAAS,KAAK,IAAI,EAAE,kCAAkC;CACpI,OAAO;AACT;AAaA,MAAM,QAAQ;AAEd,SAAS,WAAW,GAA6B;CAC/C,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,SAAS,GAAG,KAAK,GAAG,IAAI,GAAG,MAAM,GAAG,EAAE,GAAG,EAAE,YAAY,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,EAAE,SAAS;CAChH,KAAK,MAAM,KAAK,EAAE,WAAW,CAAC,GAAG,IAAI,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,KAAK,KAAK,GAAG,IAAI,OAAO,GAAG;CAC5F,IAAI,EAAE,QAAQ,IAAI,KAAK,GAAG,KAAK,aAAa,EAAE,QAAQ,CAAC;CACvD,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM,KAAK,EAAE,UAAU,CAAC,GAAG,IAAI,KAAK,OAAO,GAAG;CAC9D,KAAK,MAAM,KAAK,EAAE,SAAS,CAAC,GAAG,IAAI,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC;CACxD,IAAI,EAAE,MAAM,EAAE,QAAQ,QAAQ,IAAI,KAAK,KAAK,EAAE,SAAS,8BAA8B,gBAAgB,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG;CACrJ,OAAO;AACT;AAEA,MAAM,YAAY,OAAkC;CAAE,MAAM,EAAE;CAAM,OAAO,EAAE;CAAO,YAAY,EAAE,UAAU,SAAS,KAAA,IAAY,EAAE;AAAW;AAS9I,eAAsB,UAAU,OAAoB,MAAmC;CACrF,MAAM,IAAI,KAAK;CACf,MAAM,SAAuB,kBAAkB,MAAM,IAAI;CACzD,MAAM,QAAQ,cAAc;CAC5B,MAAM,SAAkC,MAAM,SAAS,YAAY,MAAM,MAAM,IAAI,KAAA;CACnF,MAAM,SAAS,iBAAiB,QAAQ;EAAE,KAAK,KAAK;EAAK,KAAK,KAAK;CAAI,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,QAAQ;EAC1B,EAAE,MAAM,GAAG,MAAM,kCAAkC,OAAO,MAAM,KAAK,IAAI,KAAK,iBAAiB,sBAAsB;EACrH,OAAO;CACT;CACA,MAAM,cAAc,MAAM,WAAA;CAE1B,IAAI,MAAM,QAAQ;EAEhB,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,KAAK,QAAQ,CAAC,CAAC,KAAK;EACvC,QAAQ;GACN,WAAW,KAAA;EACb;EACA,MAAM,QAAQ,MAAM,WAAW,QAAQ;GAAE;GAAU,QAAQ,KAAK;GAAQ,aAAa,KAAK;EAAY,CAAC;EACvG,EAAE,MAAM,GAAG,KAAK,yCAAyC,CAAC;EAC1D,KAAK,MAAM,KAAK,WAAW,QAAQ,KAAK,GAAG,EAAE,MAAM,CAAC;EACpD,MAAM,UAAU,MAAM,QAAQ,MAAuB,EAAE,WAAW,QAAQ;EAC1E,MAAM,OAAO,QAAQ,QAAQ,MAAM,EAAE,aAAa;EAClD,EAAE,MAAM,EAAE;EACV,EAAE,MAAM,gBAAgB,QAAQ,OAAO,aAAa,QAAQ,WAAW,IAAI,KAAK,IAAI,QAAQ,SAAS,YAAY,MAAM,IAAI,4DAA4D,EAAE;EACzL,IAAI,KAAK,QAAQ,EAAE,MAAM,6BAA6B,KAAK,KAAK,MAAM,EAAE,aAAa,CAAC,CAAC,KAAK,IAAI,EAAE,oEAAoE;EACtK,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,8GAA8G,CAAC;EAC7I,MAAM,YAAY,CAChB,GAAG,MAAM,QAAQ,MAAoD,EAAE,WAAW,YAAY,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,SAAS,EAAE,KAAK,CAAC,GAC/I,GAAG,QAAQ,QAAQ,MAAM,EAAE,KAAK,SAAS,OAAO,CAAC,CAAC,KAAK,MAAM,SAAS,EAAE,KAAK,CAAC,CAChF;EACA,EAAE,MAAM,EAAE;EACV,IAAI,CAAC,UAAU,QAAQ,EAAE,MAAM,GAAG,MAAM,yBAAyB;OAC5D,IAAI,CAAC,cAAc,WAAW,GACjC,EAAE,MAAM,2DAA2D,MAAM,kDAAkD,MAAM,cAAc,IAAI,4BAA4B,OAAO,GAAG;OACpL;GACL,EAAE,MAAM,yCAAyC,OAAO,iEAAiE,MAAM,wDAAwD;GACvL,MAAM,IAAI,SAAS,QAAQ,UAAU,aAAa,YAAY,WAAW,CAAC,GAAG,YAAY,WAAW,GAAG;IAAE,QAAQ;IAAM,eAAe;GAAU,CAAC;GACjJ,KAAK,MAAM,KAAK,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;EAC1C;EACA,OAAO;CACT;CAEA,MAAM,MAAM,KAAK,QAAQ;CAEzB,MAAM,QAAQ,MAAM,WAAW,QAAQ;EAAE,UAAA,MADlB,IAAI,KAAK;EACmB,QAAQ,KAAK;EAAQ,aAAa,KAAK;CAAY,CAAC;CACvG,KAAK,MAAM,KAAK,WAAW,QAAQ,KAAK,GAAG,EAAE,MAAM,CAAC;CACpD,IAAI,UAAU,MAAM,QAAQ,MAAuB,EAAE,WAAW,QAAQ;CACxE,MAAM,UAAU,MAAM,QAAQ,MAAoD,EAAE,WAAW,QAAQ;CACvG,EAAE,MAAM,EAAE;CAGV,MAAM,cAAc,QAAQ,QAAQ,MAAM,EAAE,MAAM,WAAW;CAC7D,IAAI,YAAY,QAAQ;EACtB,EAAE,MAAM,GAAG,OAAO,mBAAmB,YAAY,EAAE,CAAE,MAAM,KAAK,yEAAyE,CAAC;EAC1I,KAAK,MAAM,KAAK,aAAa,EAAE,MAAM,KAAK,SAAS,EAAE,MAAM,MAAM,EAAE,EAAE,KAAK,SAAS,EAAE,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,IAAI;EAC5I,IAAI,CAAE,MAAM,EAAE,gBAAgB,UAAU,YAAY,WAAW,IAAI,OAAO,SAAS,YAAY,SAAS,aAAa,0BAA0B,GAC7I,UAAU,QAAQ,QAAQ,MAAM,CAAC,EAAE,MAAM,WAAW;CAExD;CAGA,MAAM,aAAa,IAAI,IAAI,MAAM,gBAAgB,CAAC,CAAC;CACnD,MAAM,OAAO,QAAQ,QAAQ,MAAM,EAAE,iBAAiB,CAAC,WAAW,IAAI,EAAE,aAAa,CAAC;CACtF,KAAK,MAAM,KAAK,QAAQ,QAAQ,MAAM,EAAE,iBAAiB,WAAW,IAAI,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,YAAY,EAAE,cAAc,IAAI,SAAS,EAAE,MAAM,MAAM,EAAE,EAAE,oBAAoB;CAClL,IAAI,KAAK,QAAQ;EACf,EAAE,MAAM,GAAG,OAAO,4DAA4D,CAAC;EAC/E,KAAK,MAAM,KAAK,MAAM,EAAE,MAAM,KAAK,EAAE,cAAc,KAAK,SAAS,EAAE,MAAM,MAAM,EAAE,EAAE,EAAE;EACrF,EAAE,MACA,GAAG,IAAI,gJAAgJ,CACzJ;EACA,MAAM,QAAQ,KAAK,KAAK,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI;EACrD,IAAI,CAAE,MAAM,EAAE,gBAAgB,2BAA2B,KAAK,WAAW,IAAI,OAAO,SAAS,KAAK,SAAS,IAAI,YAAY,MAAM,8CAA8C,GAC7K,UAAU,QAAQ,QAAQ,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;CAErD;CAEA,MAAM,MAAM,MAAM,YAAY,KAAK,WAAW;CAC9C,IAAI,CAAC,QAAQ,QAAQ;EACnB,EAAE,MAAM,oBAAoB;EAC5B,OAAO,WACL,MACA,KACA,QACA,KACA,QAAQ,QAAQ,MAAM,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,OAAO;GAAE,OAAO,EAAE;GAAO,YAAY,EAAE;EAAW,EAAE,GACpG,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,MAAM,IAAI,GACnE,CACF;CACF;CAEA,MAAM,QAAQ,MAAM,aAAa,GAAG,MAAM;CAC1C,IAAI,SAAS,MAAM,aAAa,GAAG,KAAK,MAAM,KAAK;CACnD,IAAI,WAAW,SAAS,IAAI,SAAS,CAAC,OAAO,SAAS,IAAI,MAAM,EAAE,GAAG;EACnE,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,IAAI,MAAM,MAAM,EAAE,EAAE,cAAc,MAAM,8CAA8C,MAAM,iCAAiC,CAAC;EAC5J,IAAI,MAAM,EAAE,QAAQ,WAAW,SAAS,IAAI,MAAM,MAAM,EAAE,EAAE,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE;CAC1G;CACA,IAAI,CAAE,MAAM,EAAE,QAAQ,UAAU,QAAQ,OAAO,aAAa,QAAQ,WAAW,IAAI,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,IAAI,YAAY,MAAM,EAAE,KAAK,IAAI,GAAI;EACtJ,EAAE,MAAM,sBAAsB;EAC9B,OAAO;CACT;CAEA,MAAM,WAAsB,CAAC;CAC7B,KAAK,MAAM,QAAQ,SAAS;EAC1B,IAAI,UAAiC;EACrC,IAAI;GACF,UAAU,MAAM,IAAI,OAAO;IAAE,MAAM,KAAK;IAAM,MAAM,KAAK,MAAM;IAAM,KAAK,KAAK;IAAK,cAAc;IAAO,GAAI,WAAW,QAAQ,CAAC,IAAI,EAAE,UAAU,OAAO;GAAG,CAAC;GAC5J,IAAI,KAAK,eAAe,MAAM,IAAI,mBAAmB,QAAQ,IAAI,IAAI;GACrE,MAAM,IAAI,MAAM,IAAI,QAAQ,QAAQ,IAAI,KAAK,KAAK,SAAS,WAAW,EAAE,QAAQ;IAAE,MAAM,KAAK,KAAK;IAAM,OAAO,KAAK,KAAK;GAAM,EAAE,IAAI,CAAC,CAAC;GACvI,IAAI,EAAE,WAAW,aAAa;IAE5B,MAAM,QAAQ,MAAM,YAAY,KAAK,EAAE,YAAY;KAAE,QAAQ,KAAK;KAAQ,IAAI,KAAK;IAAS,CAAC;IAC7F,SAAS,KAAK;KAAE;KAAM,QAAQ,MAAM,KAAK,IAAI,cAAc;KAAc,YAAY;IAAM,CAAC;GAC9F,OAAO,IAAI,EAAE,WAAW,aAAa,SAAS,KAAK;IAAE;IAAM,QAAQ;IAAa,YAAY;IAAS,cAAc,EAAE;GAAa,CAAC;QAC9H,MAAM,IAAI,MAAM,EAAE,OAAO;EAChC,SAAS,KAAK;GAEZ,IAAI,SAAS,MAAM,IAAI,OAAO,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;GACxD,SAAS,KAAK;IAAE;IAAM,QAAQ;IAAU,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAAE,CAAC;EACnG;CACF;CAEA,EAAE,MAAM,EAAE;CACV,KAAK,MAAM,KAAK,UAAU;EACxB,MAAM,OAAO,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE;EAC3C,IAAI,EAAE,WAAW,UAAU,EAAE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE,GAAG,KAAK,IAAI,SAAS,EAAE,OAAQ,GAAG,EAAE,gBAAgB,MAAM,EAAE;OACzG,IAAI,EAAE,WAAW,aAAa,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,WAAY,KAAK,KAAK,EAAE,WAAY,MAAM,MAAM,OAAO;OAC9H,IAAI,EAAE,WAAW,cAAc;GAClC,MAAM,IAAI,EAAE;GACZ,EAAE,MAAM,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,KAAK,kBAAkB,EAAE,SAAS,EAAE,eAAe,KAAK,SAAS,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,EAAE,MAAM,MAAM,0BAA0B,MAAM,EAAE;GAC3L,EAAE,MAAM,OAAO,cAAc,CAAC,EAAE,+BAA+B;EACjE,OACK;GACH,EAAE,MAAM,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,WAAY,KAAK,mDAAmD;GAC9G,EAAE,MAAM,OAAO,GAAG,KAAK,EAAE,YAAa,GAAG;GACzC,EAAE,MAAM,OAAO,cAAc,EAAE,UAAW,GAAG;EAC/C;CACF;CACA,MAAM,SAAS,SAAS,QAAQ,MAAM,EAAE,WAAW,QAAQ,CAAC,CAAC;CAS7D,OAAO,WAAW,MAAM,KAAK,QAAQ,KAAK,CAPxC,GAAG,QAAQ,QAAQ,MAAM,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,OAAO;EAAE,OAAO,EAAE;EAAO,YAAY,EAAE;CAAW,EAAE,GACvG,GAAG,SAAS,QAAQ,MAAM,EAAE,WAAW,WAAW,CAAC,CAAC,KAAK,OAAO;EAAE,OAAO,EAAE,KAAK;EAAO,YAAY,EAAE;CAAY,EAAE,CAMrE,GAAG,CAHjD,GAAG,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,MAAM,IAAI,GACtE,GAAG,SAAS,QAAQ,MAAM,EAAE,WAAW,eAAe,EAAE,WAAW,YAAY,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,MAAM,IAAI,CAEtD,GAAG,SAAS,IAAI,CAAC;AAC5E;AAEA,eAAe,YAAY,KAAqB,aAA2C;CACzF,IAAI,CAAC,cAAc,WAAW,GAAG,OAAO;EAAE;EAAa,SAAS;EAAM,OAAO;CAAK;CAClF,MAAM,UAAU,YAAY,WAAW;CAEvC,OAAO;EAAE;EAAa;EAAS,QADhB,MAAM,IAAI,OAAO,EAAA,CAAG,MAAM,MAAM,EAAE,OAAO,QAAQ,WAAW,CAAC,EAAE,QAAQ,KAAK;CACtD;AACvC;;;;;;AAOA,eAAe,WACb,MACA,KACA,QACA,KACA,SACA,SACA,MACiB;CACjB,MAAM,IAAI,KAAK;CACf,MAAM,QAAQ,cAAc;CAC5B,IAAI,QAAQ,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,OAAO,QAAQ,WAAW,IAAI,MAAM,GAAG,MAAM,MAAM,SAAS,QAAQ,WAAW,IAAI,aAAa,YAAY,kEAAkE,QAAQ,WAAW,IAAI,OAAO,OAAO,EAAE,CAAC;CAC/Q,IAAI,CAAC,QAAQ,QAAQ,OAAO;CAC5B,IAAI,CAAC,IAAI,SAAS;EAChB,EAAE,MACA,cAAc,QAAQ,KAAK,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,MAAM,MAAM,6CAChE,IAAI,4BAA4B,OAAO,6BAC/C;EACA,OAAO;CACT;CACA,IAAI,CAAC,IAAI,OAAO;EACd,EAAE,MACA,GAAG,OACD,sBAAsB,IAAI,YAAY,aAAa,SAAS,IAAI,QAAQ,SAAS,EAAE,EAAE,oDAAoD,MAAM,4DACjF,MAAM,2BAA2B,IAAI,4BAA4B,OAAO,uCACxI,CACF;EACA,OAAO;CACT;CACA,MAAM,YAAY,SAAS,IAAI,MAAM,MAAM,EAAE;CAC7C,MAAM,SAAwB,CAAC;CAC/B,KAAK,MAAM,KAAK,SAAS;EACvB,IAAI,EAAE,MAAM,aAAa;GAEvB,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,MAAM,KAAK,aAAa,EAAE,MAAM,KAAK,gFAAgF,CAAC;GAC7I;EACF;EACA,MAAM,SAAS,MAAM,IAAI,OAAO,EAAE,WAAW,EAAE;EAC/C,IAAI,OAAO,MAAM,MAAM,EAAE,YAAY,IAAI,MAAO,EAAE,GAAG;GACnD,OAAO,KAAK,EAAE,KAAK;GACnB;EACF;EACA,IAAI,MAAM,EAAE,QAAQ,GAAG,UAAU,cAAc,MAAM,2BAA2B,EAAE,WAAW,KAAK,aAAa,YAAY,EAAE,WAAW,YAAY,EAAE,IAAI,IAAI,GAAG;GAC/J,MAAM,IAAI,UAAU,EAAE,WAAW,IAAI,CAAC,GAAG,OAAO,KAAK,OAAO;IAAE,SAAS,EAAE;IAAS,OAAO,EAAE;GAAM,EAAE,GAAG;IAAE,SAAS,IAAI,MAAM;IAAI,OAAO,EAAE,WAAW;GAAa,CAAC,CAAC;GAClK,OAAO,KAAK,EAAE,KAAK;EACrB,OAAO,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,MAAM,KAAK,aAAa,MAAM,4BAA4B,EAAE,WAAW,KAAK,GAAG,CAAC;CAChH;CACA,IAAI,CAAC,OAAO,QAAQ,OAAO;CAC3B,EAAE,MAAM,EAAE;CACV,MAAM,WAAW,WAAW,OAAO,KAAK,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,MAAM,MAAM,+CAA+C,OAAO;CAC1I,MAAM,SAAS,eAAe,QAAQ,cAAc,IAAI,WAAW,GAAG,KAAK,GAAG;CAC9E,IAAI;CACJ,IAAI,OAAO,QAAQ;EACjB,MAAM,QAAQ,QAAQ,QAAQ,MAAM,OAAO,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,WAAW,IAAI;EAC1F,EAAE,MAAM,GAAG,OAAO,SAAS,MAAM,8CAA8C,CAAC;EAChF,KAAK,MAAM,KAAK,QAAQ,EAAE,MAAM,KAAK,SAAS,GAAG,GAAG,GAAG;EACvD,EAAE,MACA,GAAG,OACD,8CAA8C,MAAM,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,8BAA8B,OAAO,WAAW,IAAI,OAAO,OAAO,yHAClD,UAAU,kFAChH,CACF;EACA,KAAK,MAAM,EAAE,gBAAgB,UAAU,GAAG,MAAM,+CAA+C;CACjG,OAAO,KAAK,MAAM,EAAE,QAAQ,UAAU,IAAI;CAC1C,IAAI,CAAC,IAAI;EACP,EAAE,MAAM,GAAG,MAAM,mEAAmE;EACpF,OAAO;CACT;CACA,MAAM,IAAI,SAAS,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,GAAG,YAAY,IAAI,WAAW,GAAG,EAAE,eAAe,OAAO,IAAI,QAAQ,EAAE,CAAC;CACzI,KAAK,MAAM,KAAK,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;CACxC,MAAM,OAAO,CAAC,GAAG,IAAI,IAAI,OAAO,SAAS,OAAQ,EAAE,WAAW,CAAC,EAAA,CAAG,SAAS,EAAE,IAAI,IAAI,EAAE,aAAa,CAAC,CAAE,CAAC,CAAC;CACzG,IAAI,EAAE,MAAM,KAAK,QACf,EAAE,MAAM,GAAG,IAAI,KAAK,KAAK,KAAK,IAAI,EAAE,GAAG,KAAK,WAAW,IAAI,OAAO,MAAM,mDAAmD,KAAK,WAAW,IAAI,OAAO,OAAO,wBAAwB,WAAW,WAAW,sBAAsB,GAAG,oCAAoC,CAAC;CAE3Q,OAAO,EAAE,KAAK,OAAO;AACvB"}
+{"version":3,"file":"import-CjXjx6hA.js","names":["YAML_UNREADABLE","TOML_UNREADABLE"],"sources":["../server/connections-cli/routes.ts","../server/connections-cli/clients.ts","../server/connections-cli/import.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { hermesHome } from \"../listen/mcpsetup.ts\";\nimport type { ImportClient } from \"./clients.ts\";\nimport { readTopMap, UNREADABLE, type YamlValue } from \"./yaml.ts\";\n\n/**\n * Places in a client's config that confine something to the xaq MCP server alone: Hermes platform toolsets,\n * webhook routes (`toolsets: [\"mcp-<server>\", …]`) and cron jobs (`enabled_toolsets: [\"<server>\"]`). Once the\n * imported servers are served through xaq, each of these also sees their tools, so `import` warns before\n * replacing anything (docs/listen.md: an email-triggered route confined to xaq).\n */\nexport function confinedRoutes(client: ImportClient, serverName: string, env: NodeJS.ProcessEnv = process.env): string[] {\n  if (client !== \"hermes\") return [];\n  const home = hermesHome(env);\n  const names = new Set([serverName, `mcp-${serverName}`]);\n  const confines = (v: unknown) => Array.isArray(v) && v.some((x) => typeof x === \"string\" && names.has(x));\n  const out: string[] = [];\n  const read = (file: string): unknown => {\n    try {\n      return existsSync(file) ? JSON.parse(readFileSync(file, \"utf8\").replace(/^/, \"\")) : null;\n    } catch {\n      return null;\n    }\n  };\n  try {\n    const config = join(home, \"config.yaml\");\n    if (existsSync(config)) {\n      const yaml = readFileSync(config, \"utf8\");\n      const platforms = readTopMap(yaml, \"platform_toolsets\") ?? {};\n      for (const [platform, toolsets] of Object.entries(platforms)) if (confines(toolsets)) out.push(`platform_toolsets.${platform} (config.yaml)`);\n      // Static webhook routes: platforms.webhook.extra.routes, a map of name → route or a list of routes.\n      const get = (v: YamlValue | undefined, k: string): YamlValue | undefined => (v && typeof v === \"object\" && !Array.isArray(v) ? (v as Record<string, YamlValue>)[k] : undefined);\n      const routes = get(get(get(readTopMap(yaml, \"platforms\") ?? undefined, \"webhook\"), \"extra\"), \"routes\");\n      if (routes === UNREADABLE || (Array.isArray(routes) && routes.some((r) => r === UNREADABLE))) {\n        out.push(\"webhook routes in config.yaml (platforms.webhook.extra.routes: couldn't be read, so check their toolsets)\");\n      } else if (Array.isArray(routes)) {\n        routes.forEach((r, i) => {\n          if (confines(get(r, \"toolsets\"))) out.push(`webhook route ${String(get(r, \"name\") ?? `#${i + 1}`)} (config.yaml)`);\n        });\n      } else if (routes && typeof routes === \"object\") {\n        for (const [name, r] of Object.entries(routes as Record<string, YamlValue>)) if (confines(get(r, \"toolsets\"))) out.push(`webhook route ${name} (config.yaml)`);\n      }\n    }\n  } catch {\n    // Unreadable: nothing to warn about from it.\n  }\n  const subs = read(join(home, \"webhook_subscriptions.json\"));\n  if (subs && typeof subs === \"object\" && !Array.isArray(subs)) {\n    for (const [route, r] of Object.entries(subs as Record<string, { toolsets?: unknown }>)) if (confines(r?.toolsets)) out.push(`webhook route ${route}`);\n  }\n  const cron = read(join(home, \"cron\", \"jobs.json\"));\n  const jobs = (Array.isArray(cron) ? cron : ((cron as { jobs?: unknown } | null)?.jobs ?? [])) as { id?: unknown; name?: unknown; enabled_toolsets?: unknown }[];\n  if (Array.isArray(jobs)) for (const j of jobs) if (confines(j?.enabled_toolsets)) out.push(`cron job ${String(j.name ?? j.id ?? \"?\")}`);\n  return out;\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { claudeConfigFile, codexConfigFile, cursorConfigFile, hermesHome } from \"../listen/mcpsetup.ts\";\nimport { readTomlMcpServers, type TomlTable, UNREADABLE as TOML_UNREADABLE } from \"./toml.ts\";\nimport { readMcpServers, UNREADABLE as YAML_UNREADABLE, type YamlMap } from \"./yaml.ts\";\n\n/** Reads the MCP servers an agent's own tool is configured with (for `import --from`). */\n\nexport const IMPORT_CLIENTS = [\"hermes\", \"claude-code\", \"cursor\", \"codex\"] as const;\nexport type ImportClient = (typeof IMPORT_CLIENTS)[number];\n\nexport const CLIENT_LABELS: Record<ImportClient, string> = { hermes: \"Hermes\", \"claude-code\": \"Claude Code\", cursor: \"Cursor\", codex: \"Codex\" };\n\nexport interface ClientEntry {\n  name: string;\n  /** The file it's defined in. */\n  file: string;\n  /** Claude Code: which scope (user: ~/.claude.json; local: its projects[cwd]; project: ./.mcp.json). */\n  scope?: \"user\" | \"local\" | \"project\";\n  /** Claude Code local/project scope: the project directory (where `claude mcp remove` must run). */\n  projectDir?: string;\n  transport: \"http\" | \"sse\" | \"stdio\";\n  url?: string;\n  /** Static headers, with ${VAR} references resolved. Secret: never printed. */\n  headers: Record<string, string>;\n  /** Names of environment variables the headers came from (for the \"you can remove it from .env\" note). */\n  headerVars: string[];\n  /** Per header: the environment variables its value was built from (shown in the plan next to the destination). */\n  headerSources: Record<string, string[]>;\n  /**\n   * Defined in a file the project ships (Claude Code's ./.mcp.json), not by the user: anyone who can commit to the\n   * repository wrote it. Imported only when Claude Code approved it, and only after its own confirmation.\n   */\n  fromProject?: boolean;\n  /** Client-side settings the broker doesn't carry over: tool filters and timeouts. */\n  dropped?: DroppedSettings;\n  /** The client says it uses OAuth (Hermes `auth: oauth`, an oauth block). Its tokens stay in the client. */\n  oauth: boolean;\n  enabled: boolean;\n  /** Why it can't be imported as it is. */\n  problem?: string;\n  /** stdio: the command line, for the listing. */\n  command?: string;\n}\n\nexport interface DroppedSettings {\n  /** Tools the client hides from its agent (Hermes tools.exclude, Codex disabled_tools). */\n  exclude?: string[];\n  /** The only tools the client shows (Hermes tools.include, Codex enabled_tools). */\n  include?: string[];\n  /** Other settings by name, e.g. timeout, connect_timeout. */\n  settings: string[];\n}\n\nconst strings = (v: unknown) => (Array.isArray(v) ? v.filter((x): x is string => typeof x === \"string\") : undefined);\n\nfunction droppedFrom(e: Record<string, unknown>, filters: { include: unknown; exclude: unknown }, settingKeys: string[]): DroppedSettings | undefined {\n  const d: DroppedSettings = { settings: settingKeys.filter((k) => e[k] !== undefined && e[k] !== null) };\n  const inc = strings(filters.include);\n  const exc = strings(filters.exclude);\n  if (inc?.length) d.include = inc;\n  if (exc?.length) d.exclude = exc;\n  return d.include || d.exclude || d.settings.length ? d : undefined;\n}\n\nexport interface ClientConfig {\n  client: ImportClient;\n  files: string[];\n  entries: ClientEntry[];\n}\n\nexport interface ReadOptions {\n  env?: NodeJS.ProcessEnv;\n  cwd?: string;\n}\n\n/** Parses a dotenv file (KEY=VALUE, optional `export`, quotes). */\nexport function parseDotenv(text: string): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const raw of text.split(\"\\n\")) {\n    const m = /^\\s*(?:export\\s+)?([A-Za-z_][A-Za-z0-9_]*)\\s*=\\s*(.*?)\\s*$/.exec(raw);\n    if (!m) continue;\n    let v = m[2]!;\n    if ((v.startsWith('\"') && v.endsWith('\"') && v.length >= 2) || (v.startsWith(\"'\") && v.endsWith(\"'\") && v.length >= 2)) v = v.slice(1, -1);\n    else v = v.replace(/\\s+#.*$/, \"\");\n    out[m[1]!] = v;\n  }\n  return out;\n}\n\ntype Expanded = { value: string; vars: string[] } | { missing: string };\n\n/** `${VAR}` (and `${VAR:-default}`, `${env:VAR}`) from `vars`. */\nexport function expandVars(value: string, vars: Record<string, string | undefined>): Expanded {\n  const used: string[] = [];\n  let missing: string | null = null;\n  const out = value.replace(/\\$\\{(?:env:)?([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\\}/g, (_m, name: string, def: string | undefined) => {\n    const v = vars[name];\n    if (v !== undefined && v !== \"\") {\n      used.push(name);\n      return v;\n    }\n    if (def !== undefined) return def;\n    missing ??= name;\n    return \"\";\n  });\n  return missing ? { missing } : { value: out, vars: used };\n}\n\nconst isObj = (v: unknown): v is Record<string, unknown> => !!v && typeof v === \"object\" && !Array.isArray(v);\nconst readJson = (file: string): Record<string, unknown> | null => {\n  if (!existsSync(file)) return null;\n  const text = readFileSync(file, \"utf8\");\n  if (!text.trim()) return {};\n  try {\n    const doc = JSON.parse(text) as unknown;\n    if (!isObj(doc)) throw new Error(\"not an object\");\n    return doc;\n  } catch {\n    throw new Error(`${file} isn't plain JSON (comments?), so it can't be read automatically.`);\n  }\n};\n\n/** Shared by the JSON-shaped clients (Claude Code, Cursor): one `mcpServers` entry. */\nfunction jsonEntry(name: string, raw: unknown, file: string, vars: Record<string, string | undefined>, extra: Partial<ClientEntry> = {}): ClientEntry {\n  const base: ClientEntry = { name, file, transport: \"http\", headers: {}, headerVars: [], headerSources: {}, oauth: false, enabled: true, ...extra };\n  if (!isObj(raw)) return { ...base, problem: \"this entry isn't an object\" };\n  if (raw.disabled === true || raw.enabled === false) base.enabled = false;\n  const type = typeof raw.type === \"string\" ? raw.type.toLowerCase() : null;\n  if (type === \"stdio\" || (typeof raw.command === \"string\" && !raw.url)) {\n    const args = Array.isArray(raw.args) ? raw.args.map(String) : [];\n    return { ...base, transport: \"stdio\", command: [String(raw.command ?? \"\"), ...args].join(\" \").trim() };\n  }\n  if (typeof raw.url !== \"string\") return { ...base, problem: \"no url\" };\n  const url = expandVars(raw.url, vars);\n  if (\"missing\" in url) return { ...base, problem: `its url uses \\${${url.missing}}, which isn't set here` };\n  const entry: ClientEntry = { ...base, url: url.value, transport: type === \"sse\" ? \"sse\" : \"http\" };\n  if (raw.headersHelper !== undefined || raw.headers_helper !== undefined) return { ...entry, problem: \"it gets its headers from a helper command, which the broker can't run\" };\n  if (raw.oauth !== undefined || raw.auth !== undefined) entry.oauth = true;\n  return withHeaders(entry, raw.headers, vars);\n}\n\nfunction withHeaders(entry: ClientEntry, headers: unknown, vars: Record<string, string | undefined>): ClientEntry {\n  if (headers === undefined || headers === null) return entry;\n  if (!isObj(headers)) return { ...entry, problem: \"its headers can't be read\" };\n  for (const [k, v] of Object.entries(headers)) {\n    if (typeof v !== \"string\") return { ...entry, problem: `its ${k} header can't be read` };\n    const x = expandVars(v, vars);\n    if (\"missing\" in x) return { ...entry, problem: `its ${k} header uses \\${${x.missing}}, which isn't set here` };\n    entry.headers[k] = x.value;\n    entry.headerVars.push(...x.vars);\n    entry.headerSources[k] = x.vars;\n  }\n  return entry;\n}\n\n// ───────────── Hermes ─────────────\n\nexport function hermesFiles(env: NodeJS.ProcessEnv = process.env): { config: string; env: string } {\n  const home = hermesHome(env);\n  return { config: join(home, \"config.yaml\"), env: join(home, \".env\") };\n}\n\nfunction readHermes(opts: ReadOptions): ClientConfig {\n  const env = opts.env ?? process.env;\n  const files = hermesFiles(env);\n  const result: ClientConfig = { client: \"hermes\", files: [files.config], entries: [] };\n  if (!existsSync(files.config)) return result;\n  const servers = readMcpServers(readFileSync(files.config, \"utf8\"));\n  if (!servers) throw new Error(`${files.config} has an mcp_servers layout this can't read (flow style, several blocks, or tabs). Nothing was changed.`);\n  // Hermes loads ~/.hermes/.env into its environment: the secrets its ${VAR} headers name live there.\n  const vars = { ...env, ...(existsSync(files.env) ? parseDotenv(readFileSync(files.env, \"utf8\")) : {}) };\n  for (const [name, raw] of Object.entries(servers)) {\n    if (name.startsWith(\"\\u0000\")) continue;\n    const base: ClientEntry = { name, file: files.config, transport: \"http\", headers: {}, headerVars: [], headerSources: {}, oauth: false, enabled: true };\n    if (!raw || raw === YAML_UNREADABLE || typeof raw !== \"object\" || Array.isArray(raw)) {\n      result.entries.push({ ...base, problem: \"this entry can't be read\" });\n      continue;\n    }\n    const e = raw as YamlMap;\n    const unreadable = [\"url\", \"headers\", \"command\", \"auth\", \"transport\", \"enabled\"].find((k) => e[k] === YAML_UNREADABLE);\n    if (unreadable) {\n      result.entries.push({ ...base, problem: `its ${unreadable} can't be read` });\n      continue;\n    }\n    if (e.enabled === false || (typeof e.enabled === \"string\" && [\"false\", \"no\", \"off\", \"0\"].includes(e.enabled.toLowerCase()))) base.enabled = false;\n    if (typeof e.command === \"string\") {\n      const args = Array.isArray(e.args) ? e.args.filter((a) => typeof a === \"string\") : [];\n      result.entries.push({ ...base, transport: \"stdio\", command: [e.command, ...args].join(\" \") });\n      continue;\n    }\n    if (typeof e.url !== \"string\") {\n      result.entries.push({ ...base, problem: \"no url\" });\n      continue;\n    }\n    const url = expandVars(e.url, vars);\n    if (\"missing\" in url) {\n      result.entries.push({ ...base, problem: `its url uses \\${${url.missing}}, which isn't set in ${files.env}` });\n      continue;\n    }\n    const tools = isObj(e.tools) ? (e.tools as Record<string, unknown>) : {};\n    const entry: ClientEntry = {\n      ...base,\n      url: url.value,\n      transport: e.transport === \"sse\" ? \"sse\" : \"http\",\n      oauth: e.auth === \"oauth\" || isObj(e.oauth),\n      dropped: droppedFrom(e as Record<string, unknown>, { include: tools.include, exclude: tools.exclude }, [\"timeout\", \"connect_timeout\"]),\n    };\n    if (e.client_cert !== undefined || e.identity_header !== undefined) {\n      result.entries.push({ ...entry, problem: \"it uses a client certificate or identity header, which the broker doesn't support yet\" });\n      continue;\n    }\n    result.entries.push(withHeaders(entry, e.headers ?? undefined, vars));\n  }\n  return result;\n}\n\n// ───────────── Claude Code ─────────────\n\nfunction readClaude(opts: ReadOptions): ClientConfig {\n  const env = opts.env ?? process.env;\n  const cwd = opts.cwd ?? process.cwd();\n  const userFile = claudeConfigFile();\n  const projectFile = join(cwd, \".mcp.json\");\n  const result: ClientConfig = { client: \"claude-code\", files: [userFile, projectFile].filter(existsSync), entries: [] };\n  const seen = new Set<string>();\n  const add = (e: ClientEntry) => {\n    // Claude Code's precedence: local, then project, then user. A shadowed one isn't what the agent uses.\n    if (seen.has(e.name)) return;\n    seen.add(e.name);\n    result.entries.push(e);\n  };\n  const doc = readJson(userFile);\n  const proj = doc && isObj(doc.projects) && isObj(doc.projects[cwd]) ? (doc.projects[cwd] as Record<string, unknown>) : {};\n  const local = proj.mcpServers;\n  if (isObj(local)) for (const [n, raw] of Object.entries(local)) add(jsonEntry(n, raw, userFile, env, { scope: \"local\", projectDir: cwd }));\n  const project = readJson(projectFile);\n  if (project && isObj(project.mcpServers)) {\n    // ./.mcp.json comes with the repository. Claude Code itself only uses the servers the user approved for this\n    // project (kept in ~/.claude.json, which the repository can't write); a project's own .claude/settings*.json\n    // isn't trusted for this.\n    const list = (v: unknown) => (Array.isArray(v) ? v.filter((x): x is string => typeof x === \"string\") : []);\n    const enabled = new Set(list(proj.enabledMcpjsonServers));\n    const disabled = new Set(list(proj.disabledMcpjsonServers));\n    const all = proj.enableAllProjectMcpServers === true;\n    for (const [n, raw] of Object.entries(project.mcpServers)) {\n      const e = jsonEntry(n, raw, projectFile, env, { scope: \"project\", projectDir: cwd, fromProject: true });\n      const why = disabled.has(n) ? \"turned off for this project in Claude Code\" : !all && !enabled.has(n) ? \"not approved in Claude Code\" : null;\n      // An unapproved one isn't what Claude Code uses, so it doesn't shadow a user-scope server of the same name.\n      if (why) result.entries.push({ ...e, problem: why });\n      else add(e);\n    }\n  }\n  if (doc && isObj(doc.mcpServers)) for (const [n, raw] of Object.entries(doc.mcpServers)) add(jsonEntry(n, raw, userFile, env, { scope: \"user\" }));\n  return result;\n}\n\n// ───────────── Cursor ─────────────\n\nfunction readCursor(opts: ReadOptions): ClientConfig {\n  const env = opts.env ?? process.env;\n  const file = cursorConfigFile();\n  const result: ClientConfig = { client: \"cursor\", files: [file], entries: [] };\n  const doc = readJson(file);\n  if (doc && isObj(doc.mcpServers)) for (const [n, raw] of Object.entries(doc.mcpServers)) result.entries.push(jsonEntry(n, raw, file, env));\n  return result;\n}\n\n// ───────────── Codex ─────────────\n\nfunction readCodex(opts: ReadOptions): ClientConfig {\n  const env = opts.env ?? process.env;\n  const file = codexConfigFile();\n  const result: ClientConfig = { client: \"codex\", files: [file], entries: [] };\n  if (!existsSync(file)) return result;\n  for (const [name, raw] of Object.entries(readTomlMcpServers(readFileSync(file, \"utf8\")))) {\n    const base: ClientEntry = { name, file, transport: \"http\", headers: {}, headerVars: [], headerSources: {}, oauth: false, enabled: true };\n    if (raw === TOML_UNREADABLE) {\n      result.entries.push({ ...base, problem: \"this entry can't be read\" });\n      continue;\n    }\n    const e = raw as TomlTable;\n    if (e.enabled === false) base.enabled = false;\n    if (typeof e.command === \"string\") {\n      const args = Array.isArray(e.args) ? e.args.filter((a): a is string => typeof a === \"string\") : [];\n      result.entries.push({ ...base, transport: \"stdio\", command: [e.command, ...args].join(\" \") });\n      continue;\n    }\n    if (typeof e.url !== \"string\") {\n      result.entries.push({ ...base, problem: \"no url\" });\n      continue;\n    }\n    const entry: ClientEntry = {\n      ...base,\n      url: e.url,\n      oauth: isObj(e.oauth) || e.auth === \"oauth\",\n      dropped: droppedFrom(e, { include: e.enabled_tools, exclude: e.disabled_tools }, [\"tool_timeout_sec\", \"startup_timeout_sec\"]),\n    };\n    if (e.http_headers_helper !== undefined) {\n      result.entries.push({ ...entry, problem: \"it gets its headers from a helper command, which the broker can't run\" });\n      continue;\n    }\n    // Codex has no ${VAR} expansion: env_http_headers and bearer_token_env_var name variables instead.\n    const headers: Record<string, string> = {};\n    let problem: string | undefined;\n    if (e.http_headers !== undefined) {\n      if (!isObj(e.http_headers) || Object.values(e.http_headers).some((v) => typeof v !== \"string\")) problem = \"its http_headers can't be read\";\n      else {\n        Object.assign(headers, e.http_headers);\n        for (const h of Object.keys(e.http_headers)) entry.headerSources[h] = [];\n      }\n    }\n    const fromEnv: Record<string, unknown> = isObj(e.env_http_headers) ? { ...e.env_http_headers } : {};\n    if (e.bearer_token_env_var !== undefined) fromEnv.Authorization = e.bearer_token_env_var;\n    for (const [h, varName] of Object.entries(fromEnv)) {\n      if (typeof varName !== \"string\") problem ??= `its ${h} header can't be read`;\n      else if (!env[varName]) problem ??= `its ${h} header comes from $${varName}, which isn't set here`;\n      else {\n        headers[h] = h === \"Authorization\" && e.bearer_token_env_var === varName ? `Bearer ${env[varName]}` : env[varName]!;\n        entry.headerVars.push(varName);\n        entry.headerSources[h] = [varName];\n      }\n    }\n    entry.headers = headers;\n    result.entries.push(problem ? { ...entry, problem } : entry);\n  }\n  return result;\n}\n\nexport function readClientConfig(client: ImportClient, opts: ReadOptions = {}): ClientConfig {\n  switch (client) {\n    case \"hermes\":\n      return readHermes(opts);\n    case \"claude-code\":\n      return readClaude(opts);\n    case \"cursor\":\n      return readCursor(opts);\n    case \"codex\":\n      return readCodex(opts);\n  }\n}\n\nexport function parseImportClient(value: string): ImportClient {\n  const v = value.trim().toLowerCase().replace(/^claude$/, \"claude-code\");\n  if (!(IMPORT_CLIENTS as readonly string[]).includes(v)) throw new Error(`Unknown --from \"${value}\". Choose one of: ${IMPORT_CLIENTS.join(\", \")}.`);\n  return v as ImportClient;\n}\n","import pc from \"picocolors\";\nimport type { Agent } from \"../../shared/types.ts\";\nimport type { AccessLevel } from \"../broker/types.ts\";\nimport { mcpTarget, type McpSetupResult, type RemoveServer, setupMcp } from \"../listen/mcpsetup.ts\";\nimport { DEFAULT_PROFILE, profilePath } from \"../listen/paths.ts\";\nimport { loadProfile, type Profile, profileExists } from \"../listen/profile.ts\";\nimport { safeText } from \"../listen/ui.ts\";\nimport { NPX } from \"../listen/version.ts\";\nimport type { LookupFn } from \"../webhooks/ssrf.ts\";\nimport { accessLabel, agentsLabel, chooseAccess, chooseAgents, parseAccess } from \"./access.ts\";\nimport { isWorking, waitWorking } from \"./manage.ts\";\nimport { confinedRoutes } from \"./routes.ts\";\nimport { mcpServerName } from \"../listen/recipes.ts\";\nimport type { ConnectionsApi, ConnectionView } from \"./api.ts\";\nimport { CLIENT_LABELS, type ClientConfig, type ClientEntry, type ImportClient, parseImportClient, readClientConfig } from \"./clients.ts\";\nimport { checkTarget } from \"./private.ts\";\nimport type { Prompter } from \"./prompt.ts\";\nimport { reconnectHint, slugify } from \"./util.ts\";\n\n/**\n * `import --from <client>`: one connection per remote MCP server in that client's config, with its static header\n * moved into the broker. OAuth servers are created needing Connect (their tokens stay in the client); stdio ones\n * aren't supported yet (M4) and stay where they are. Nothing is written without a confirmation (or --yes), and\n * the client's config is only touched by the optional setup-mcp step at the end, which removes just the entries\n * whose connection works.\n */\n\nexport interface ImportFlags {\n  from: string;\n  dryRun?: boolean;\n  yes?: boolean;\n  access?: string;\n  agent?: string[];\n  profile?: string;\n  /** Exact `scheme://host:port` origins allowed without asking (--yes never allows one). */\n  allowPrivate?: string[];\n}\n\nexport interface ImportDeps {\n  prompter: Prompter;\n  /** Opens the admin channel (not called for --dry-run). */\n  openApi: () => ConnectionsApi;\n  lookup?: LookupFn;\n  env?: NodeJS.ProcessEnv;\n  cwd?: string;\n  /** This xaq's own MCP origins (loopback with its port), so its entry is never imported. */\n  selfOrigins?: string[];\n  /** How long to wait for a connected server's first tool sync (default 10 s), and how often to look. */\n  verifyMs?: number;\n  pollMs?: number;\n}\n\nexport type PlanItem =\n  | { action: \"self\"; entry: ClientEntry }\n  | { action: \"stdio\"; entry: ClientEntry }\n  | { action: \"skip\"; entry: ClientEntry; reason: string }\n  | { action: \"exists\"; entry: ClientEntry; connection: ConnectionView }\n  | {\n      action: \"create\";\n      entry: ClientEntry;\n      slug: string;\n      url: string;\n      /** header: moved into the broker; oauth: the client says so; none: no credential (the connect finds out). */\n      auth: { type: \"header\"; name: string; value: string } | { type: \"oauth\" } | { type: \"none\" };\n      /** The exact origin a private-target allow would cover, when the URL is on this machine or a private network. */\n      privateTarget: string | null;\n    };\n\n// Our own entry under its name, or under the one a profile from before the rename registered: never imported.\nconst SELF_NAME = /^(?:xaq|agentinbox)(?:-[a-z0-9][a-z0-9_-]*)?$/; // rename-xaq: keep\n\nfunction isSelf(e: ClientEntry, selfOrigins: string[]): boolean {\n  if (SELF_NAME.test(e.name)) return true;\n  if (Object.values(e.headers).some((v) => /^Bearer\\s+aib_/i.test(v.trim()))) return true;\n  if (!e.url) return false;\n  try {\n    const u = new URL(e.url);\n    return u.pathname.replace(/\\/+$/, \"\").endsWith(\"/mcp\") && selfOrigins.includes(u.origin);\n  } catch {\n    return false;\n  }\n}\n\nconst sameUrl = (a: string | null | undefined, b: string) => {\n  try {\n    return !!a && new URL(a).href.replace(/\\/+$/, \"\") === new URL(b).href.replace(/\\/+$/, \"\");\n  } catch {\n    return false;\n  }\n};\n\nexport async function planImport(config: ClientConfig, ctx: { existing?: ConnectionView[]; lookup?: LookupFn; selfOrigins?: string[] } = {}): Promise<PlanItem[]> {\n  const label = CLIENT_LABELS[config.client];\n  const taken = new Set((ctx.existing ?? []).map((c) => c.slug));\n  const items: PlanItem[] = [];\n  for (const entry of config.entries) {\n    if (isSelf(entry, ctx.selfOrigins ?? [])) {\n      items.push({ action: \"self\", entry });\n      continue;\n    }\n    if (entry.transport === \"stdio\") {\n      items.push({ action: \"stdio\", entry });\n      continue;\n    }\n    if (entry.problem) {\n      items.push({ action: \"skip\", entry, reason: entry.problem });\n      continue;\n    }\n    if (!entry.enabled) {\n      items.push({ action: \"skip\", entry, reason: `it's turned off in ${label}` });\n      continue;\n    }\n    let url: URL;\n    try {\n      url = new URL(entry.url!);\n      if (url.protocol !== \"http:\" && url.protocol !== \"https:\") throw new Error(\"scheme\");\n    } catch {\n      items.push({ action: \"skip\", entry, reason: \"its url isn't an http(s) URL\" });\n      continue;\n    }\n    const headerNames = Object.keys(entry.headers);\n    if (headerNames.length > 1) {\n      items.push({ action: \"skip\", entry, reason: `it sends ${headerNames.length} headers (${headerNames.join(\", \")}); a connection keeps one (not supported yet)` });\n      continue;\n    }\n    const existing = (ctx.existing ?? []).find((c) => sameUrl(c.url, url.href));\n    if (existing) {\n      items.push({ action: \"exists\", entry, connection: existing });\n      continue;\n    }\n    const target = await checkTarget(url, ctx.lookup);\n    if (target.kind === \"never\") {\n      items.push({\n        action: \"skip\",\n        entry,\n        reason:\n          target.why === \"ipv6_literal\"\n            ? `the private-network allow takes a hostname or an IPv4 address, not ${target.address}`\n            : `it's on ${target.address}, a link-local or cloud metadata address, which is never allowed`,\n      });\n      continue;\n    }\n    if (target.kind === \"public\" && url.protocol === \"http:\") {\n      items.push({ action: \"skip\", entry, reason: \"plain http to a public host isn't allowed; use its https URL\" });\n      continue;\n    }\n    let slug = slugify(entry.name);\n    for (let n = 2; taken.has(slug); n++) slug = `${slugify(entry.name).slice(0, 21)}-${n}`;\n    taken.add(slug);\n    const auth = headerNames.length\n      ? { type: \"header\" as const, name: headerNames[0]!, value: entry.headers[headerNames[0]!]! }\n      : entry.oauth\n        ? { type: \"oauth\" as const }\n        : { type: \"none\" as const };\n    items.push({ action: \"create\", entry, slug, url: entry.url!.trim(), auth, privateTarget: target.kind === \"private\" ? target.origin : null });\n  }\n  return items;\n}\n\nconst where = (e: ClientEntry) => (e.scope ? ` (${e.scope} scope)` : \"\");\nconst hostOf = (url: string) => {\n  try {\n    return new URL(url).host;\n  } catch {\n    return url;\n  }\n};\n\n/** \"its Authorization header (from $GITHUB_TOKEN) is sent to mcp.example.com\": where each secret ends up. */\nfunction headerLine(i: Extract<PlanItem, { action: \"create\" }>): string | null {\n  if (i.auth.type !== \"header\") return null;\n  const vars = i.entry.headerSources[i.auth.name] ?? [];\n  const from = vars.length ? ` (from ${vars.map((v) => `$${v}`).join(\", \")})` : \"\";\n  return `its ${i.auth.name} header${from} moves into xaq (encrypted; never shown) and is sent to ${safeText(hostOf(i.url), 120)}`;\n}\n\n/** The plan in plain words. Never prints a header value. */\nexport function renderPlan(config: ClientConfig, items: PlanItem[]): string[] {\n  const label = CLIENT_LABELS[config.client];\n  const out: string[] = [];\n  const width = Math.min(24, Math.max(4, ...items.map((i) => i.entry.name.length)));\n  const pad = (s: string) => s.padEnd(width);\n  const cont = \" \".repeat(width + 4);\n  out.push(`${label}: ${config.files.join(\", \") || \"no config file\"} lists ${items.length} MCP server${items.length === 1 ? \"\" : \"s\"}.`);\n  for (const i of items) {\n    const name = `  ${pad(safeText(i.entry.name, 40))}  `;\n    switch (i.action) {\n      case \"self\":\n        out.push(`${name}${pc.dim(\"skip: this is xaq itself\")}`);\n        break;\n      case \"stdio\":\n        out.push(`${name}${pc.yellow(\"not supported yet (M4)\")}: a local command (${safeText(i.entry.command ?? \"\", 60)}); it stays in ${label}`);\n        break;\n      case \"skip\":\n        out.push(`${name}${pc.yellow(\"skip\")}: ${i.reason}; it stays in ${label}`);\n        break;\n      case \"exists\":\n        if (isWorking(i.connection)) out.push(`${name}already connected: \"${i.connection.slug}\" (${i.connection.tools.total} tools)`);\n        else {\n          const why =\n            i.entry.oauth || i.connection.authType === \"oauth\" || i.connection.status === \"needs_reauth\" ? \"needs Connect\" : `${i.connection.status}, ${i.connection.tools.total} tools`;\n          out.push(`${name}already a connection: \"${i.connection.slug}\", ${why}; it stays in ${label} until it works`);\n          out.push(`${cont}${reconnectHint(i.connection)}`);\n        }\n        out.push(...droppedLines(i.entry, cont));\n        break;\n      case \"create\": {\n        out.push(`${name}${pc.green(\"create\")} connection \"${i.slug}\" → ${safeText(i.url, 120)}${where(i.entry)}`);\n        if (i.entry.fromProject) out.push(`${cont}${pc.yellow(\"from the project's .mcp.json\")}: asked separately (--yes doesn't answer it)`);\n        const h = headerLine(i);\n        if (h) out.push(`${cont}${h}`);\n        else if (i.auth.type === \"oauth\") out.push(`${cont}OAuth: created needing Connect (${label} keeps its own tokens); sign in once with the link it prints`);\n        else out.push(`${cont}no credential in ${label}: connected as it is (if it turns out to use OAuth, it needs Connect)`);\n        if (i.privateTarget) out.push(`${cont}${pc.yellow(\"private network\")}: needs the allow for exactly ${i.privateTarget}`);\n        out.push(...droppedLines(i.entry, cont));\n        break;\n      }\n    }\n  }\n  return out;\n}\n\n/** What the client did for this server that the broker doesn't: said in the plan, never silently dropped. */\nfunction droppedLines(e: ClientEntry, cont: string): string[] {\n  const d = e.dropped;\n  if (!d) return [];\n  const out: string[] = [];\n  const list = (xs: string[]) => xs.map((x) => safeText(x, 64)).join(\", \");\n  if (d.exclude) out.push(`${cont}${pc.yellow(\"not carried over\")}: its tool filter hides ${list(d.exclude)}; through xaq every tool is listed (subject to the access level)`);\n  if (d.include) out.push(`${cont}${pc.yellow(\"not carried over\")}: its tool filter shows only ${list(d.include)}; through xaq every tool is listed (subject to the access level)`);\n  if (d.settings.length) out.push(`${cont}${pc.yellow(\"not carried over\")}: ${d.settings.join(\", \")} (xaq uses its own 60 s per call)`);\n  return out;\n}\n\ntype CreateItem = Extract<PlanItem, { action: \"create\" }>;\n\ninterface Outcome {\n  item: CreateItem;\n  /** connected: works now; unverified: created, but not working (yet); authorize: needs a sign-in; failed: nothing kept. */\n  status: \"connected\" | \"unverified\" | \"authorize\" | \"failed\";\n  connection?: ConnectionView;\n  authorizeUrl?: string;\n  error?: string;\n}\n\nconst works = isWorking;\n\nfunction setupLines(r: McpSetupResult): string[] {\n  const out = [r.ok ? `${r.dryRun ? pc.cyan(\"○\") : pc.green(\"✔\")} ${r.message}` : `${pc.yellow(\"!\")} ${r.message}`];\n  for (const l of r.changes ?? []) out.push(l.startsWith(\" \") ? pc.gray(`  ${l}`) : `  - ${l}`);\n  if (r.backup) out.push(pc.gray(`  Backup: ${r.backup}`));\n  if (!r.ok) for (const l of r.manual ?? []) out.push(`    ${l}`);\n  for (const n of r.notes ?? []) out.push(pc.dim(`  ${n}`));\n  if (r.ok && r.verify?.length) out.push(`  ${r.dryRun ? \"Afterwards, check it with\" : \"Check it with\"}: ${r.verify.map((v) => pc.cyan(v)).join(\"; \")}`);\n  return out;\n}\n\nconst toRemove = (e: ClientEntry): RemoveServer => ({ name: e.name, scope: e.scope, projectDir: e.scope === \"user\" ? undefined : e.projectDir });\n\n/** The agent this machine's client uses (its xaq profile), if that agent is on this daemon. */\ninterface ClientAgent {\n  profileName: string;\n  profile: Profile | null;\n  agent: Agent | null;\n}\n\nexport async function runImport(flags: ImportFlags, deps: ImportDeps): Promise<number> {\n  const p = deps.prompter;\n  const client: ImportClient = parseImportClient(flags.from);\n  const label = CLIENT_LABELS[client];\n  const access: AccessLevel | undefined = flags.access ? parseAccess(flags.access) : undefined;\n  const config = readClientConfig(client, { env: deps.env, cwd: deps.cwd });\n  if (!config.entries.length) {\n    p.print(`${label} has no MCP servers configured (${config.files.join(\", \") || \"no config file\"}). Nothing to import.`);\n    return 0;\n  }\n  const profileName = flags.profile ?? DEFAULT_PROFILE;\n\n  if (flags.dryRun) {\n    // Existing connections from the daemon when it's reachable, so a re-run's plan is the real one.\n    let existing: ConnectionView[] | undefined;\n    try {\n      existing = await deps.openApi().list();\n    } catch {\n      existing = undefined;\n    }\n    const items = await planImport(config, { existing, lookup: deps.lookup, selfOrigins: deps.selfOrigins });\n    p.print(pc.bold(\"Dry run: nothing is created or changed.\"));\n    for (const l of renderPlan(config, items)) p.print(l);\n    const creates = items.filter((i): i is CreateItem => i.action === \"create\");\n    const priv = creates.filter((i) => i.privateTarget);\n    p.print(\"\");\n    p.print(`Would create ${creates.length} connection${creates.length === 1 ? \"\" : \"s\"} with ${access ? accessLabel(access) : \"the access you choose (default: Ask before risky actions)\"}.`);\n    if (priv.length) p.print(`Would ask before allowing ${priv.map((i) => i.privateTarget).join(\", \")} (--yes never does; --allow-private <origin> does for that origin).`);\n    if (!existing) p.print(pc.dim(\"xaq wasn't reachable, so existing connections weren't checked (the real run does: nothing is created twice).\"));\n    const removable = [\n      ...items.filter((i): i is Extract<PlanItem, { action: \"exists\" }> => i.action === \"exists\" && works(i.connection)).map((i) => toRemove(i.entry)),\n      ...creates.filter((i) => i.auth.type !== \"oauth\").map((i) => toRemove(i.entry)),\n    ];\n    p.print(\"\");\n    if (!removable.length) p.print(`${label}'s config isn't changed.`);\n    else if (!profileExists(profileName)) {\n      p.print(`Afterwards it offers to replace the imported entries in ${label} with the single xaq entry, once this machine's ${label} is paired (${NPX} connect <xaq-url> --tool ${client}).`);\n    } else {\n      p.print(`Afterwards it offers setup-mcp --tool ${client}, which would (for the entries whose connection works and that ${label}'s agent can use; OAuth ones after you Reconnect them):`);\n      const r = setupMcp(client, mcpTarget(profileName, loadProfile(profileName)), profilePath(profileName), { dryRun: true, removeServers: removable });\n      for (const l of setupLines(r)) p.print(l);\n    }\n    return 0;\n  }\n\n  const api = deps.openApi();\n  const existing = await api.list();\n  const items = await planImport(config, { existing, lookup: deps.lookup, selfOrigins: deps.selfOrigins });\n  for (const l of renderPlan(config, items)) p.print(l);\n  let creates = items.filter((i): i is CreateItem => i.action === \"create\");\n  const already = items.filter((i): i is Extract<PlanItem, { action: \"exists\" }> => i.action === \"exists\");\n  p.print(\"\");\n\n  // A project's .mcp.json was written by whoever can commit to the repository: its own confirmation, never --yes.\n  const fromProject = creates.filter((i) => i.entry.fromProject);\n  if (fromProject.length) {\n    p.print(pc.yellow(`These come from ${fromProject[0]!.entry.file}, which ships with the project (anyone who can commit to it wrote them):`));\n    for (const i of fromProject) p.print(`  ${safeText(i.entry.name, 40)} → ${safeText(i.url, 120)}${headerLine(i) ? `; ${headerLine(i)}` : \"\"}`);\n    if (!(await p.confirmExplicit(`Import ${fromProject.length === 1 ? \"it\" : `these ${fromProject.length}`} into xaq?`, \"they stay in Claude Code\"))) {\n      creates = creates.filter((i) => !i.entry.fromProject);\n    }\n  }\n\n  // The private-target allow: only a person at the terminal (or --allow-private naming the exact origin) gives it.\n  const preAllowed = new Set(flags.allowPrivate ?? []);\n  const priv = creates.filter((i) => i.privateTarget && !preAllowed.has(i.privateTarget));\n  for (const i of creates.filter((x) => x.privateTarget && preAllowed.has(x.privateTarget))) p.print(`Allowing ${i.privateTarget} (${safeText(i.entry.name, 40)}): --allow-private.`);\n  if (priv.length) {\n    p.print(pc.yellow(\"These servers are on this machine or your private network:\"));\n    for (const i of priv) p.print(`  ${i.privateTarget}  (${safeText(i.entry.name, 40)})`);\n    p.print(\n      pc.dim(\"A connection to such a server can reach other services there too. Each allow covers exactly that scheme://host:port, for that connection only.\"),\n    );\n    const names = priv.map((i) => i.entry.name).join(\", \");\n    if (!(await p.confirmExplicit(`Allow xaq to connect to ${priv.length === 1 ? \"it\" : `these ${priv.length}`}?`, `skipping ${names} (pass --allow-private <origin> to allow one)`))) {\n      creates = creates.filter((i) => !priv.includes(i));\n    }\n  }\n\n  const who = await clientAgent(api, profileName);\n  if (!creates.length) {\n    p.print(\"Nothing to create.\");\n    return offerSetup(\n      deps,\n      api,\n      client,\n      who,\n      already.filter((a) => works(a.connection)).map((a) => ({ entry: a.entry, connection: a.connection })),\n      already.filter((a) => !works(a.connection)).map((a) => a.entry.name),\n      0,\n    );\n  }\n\n  const level = await chooseAccess(p, access);\n  let agents = await chooseAgents(p, api, flags.agent);\n  if (agents !== \"all\" && who.agent && !agents.includes(who.agent.id)) {\n    p.print(pc.yellow(`${safeText(who.agent.name, 60)} (the agent ${label} on this machine uses) isn't among them, so ${label} couldn't use these through xaq.`));\n    if (await p.confirm(`Include ${safeText(who.agent.name, 60)}?`, true)) agents = [...agents, who.agent.id];\n  }\n  if (!(await p.confirm(`Create ${creates.length} connection${creates.length === 1 ? \"\" : \"s\"} (${accessLabel(level)}, ${agentsLabel(agents)})?`, true))) {\n    p.print(\"Nothing was created.\");\n    return 0;\n  }\n\n  const outcomes: Outcome[] = [];\n  for (const item of creates) {\n    let created: ConnectionView | null = null;\n    try {\n      created = await api.create({ slug: item.slug, name: item.entry.name, url: item.url, levelDefault: level, ...(agents === \"all\" ? {} : { agentIds: agents }) });\n      if (item.privateTarget) await api.allowPrivateTarget(created.id, true);\n      const r = await api.connect(created.id, item.auth.type === \"header\" ? { header: { name: item.auth.name, value: item.auth.value } } : {});\n      if (r.status === \"connected\") {\n        // \"connected\" means stored, not tested (a header connect doesn't call the server): wait for the first tool sync.\n        const after = await waitWorking(api, r.connection, { pollMs: deps.pollMs, ms: deps.verifyMs });\n        outcomes.push({ item, status: works(after) ? \"connected\" : \"unverified\", connection: after });\n      } else if (r.status === \"authorize\") outcomes.push({ item, status: \"authorize\", connection: created, authorizeUrl: r.authorizeUrl });\n      else throw new Error(r.message);\n    } catch (err) {\n      // Nothing half-made stays behind: running the import again retries it cleanly.\n      if (created) await api.remove(created.id).catch(() => {});\n      outcomes.push({ item, status: \"failed\", error: err instanceof Error ? err.message : String(err) });\n    }\n  }\n\n  p.print(\"\");\n  for (const o of outcomes) {\n    const name = safeText(o.item.entry.name, 40);\n    if (o.status === \"failed\") p.print(`${pc.red(\"✘\")} ${name}: ${safeText(o.error!, 300)} (it stays in ${label})`);\n    else if (o.status === \"connected\") p.print(`${pc.green(\"✔\")} ${name} → \"${o.connection!.slug}\", ${o.connection!.tools.total} tools`);\n    else if (o.status === \"unverified\") {\n      const c = o.connection!;\n      p.print(`${pc.yellow(\"○\")} ${name} → \"${c.slug}\": not working (${c.status}${c.statusReason ? `: ${safeText(c.statusReason, 200)}` : \"\"}, ${c.tools.total} tools), so it stays in ${label}.`);\n      p.print(`    ${reconnectHint(c)}   then run this import again.`);\n    }\n    else {\n      p.print(`${pc.yellow(\"○\")} ${name} → \"${o.connection!.slug}\": needs Connect. Sign in (link valid 15 minutes):`);\n      p.print(`    ${pc.cyan(o.authorizeUrl!)}`);\n      p.print(`    ${reconnectHint(o.connection!)}`);\n    }\n  }\n  const failed = outcomes.filter((o) => o.status === \"failed\").length;\n  const working = [\n    ...already.filter((a) => works(a.connection)).map((a) => ({ entry: a.entry, connection: a.connection })),\n    ...outcomes.filter((o) => o.status === \"connected\").map((o) => ({ entry: o.item.entry, connection: o.connection! })),\n  ];\n  const pending = [\n    ...already.filter((a) => !works(a.connection)).map((a) => a.entry.name),\n    ...outcomes.filter((o) => o.status === \"authorize\" || o.status === \"unverified\").map((o) => o.item.entry.name),\n  ];\n  return offerSetup(deps, api, client, who, working, pending, failed ? 1 : 0);\n}\n\nasync function clientAgent(api: ConnectionsApi, profileName: string): Promise<ClientAgent> {\n  if (!profileExists(profileName)) return { profileName, profile: null, agent: null };\n  const profile = loadProfile(profileName);\n  const agent = (await api.agents()).find((a) => a.id === profile.agentId && !a.disabled) ?? null;\n  return { profileName, profile, agent };\n}\n\n/**\n * Step 2: replace the entries now served by the broker with the single xaq entry (setup-mcp). Only entries\n * the client's own agent can use through xaq go: the profile's agent must be on this daemon and have a grant\n * on the connection (offered when it has none).\n */\nasync function offerSetup(\n  deps: ImportDeps,\n  api: ConnectionsApi,\n  client: ImportClient,\n  who: ClientAgent,\n  working: { entry: ClientEntry; connection: ConnectionView }[],\n  pending: string[],\n  code: number,\n): Promise<number> {\n  const p = deps.prompter;\n  const label = CLIENT_LABELS[client];\n  if (pending.length) p.print(pc.dim(`${pending.join(\", \")} stay${pending.length === 1 ? \"s\" : \"\"} in ${label} until ${pending.length === 1 ? \"it works\" : \"they work\"} through xaq (Reconnect); then run this import again to replace ${pending.length === 1 ? \"it\" : \"them\"}.`));\n  if (!working.length) return code;\n  if (!who.profile) {\n    p.print(\n      `To replace ${working.map((w) => w.entry.name).join(\", \")} in ${label} with the single xaq entry, pair it first ` +\n        `(${NPX} connect <xaq-url> --tool ${client}) and run this import again.`,\n    );\n    return code;\n  }\n  if (!who.agent) {\n    p.print(\n      pc.yellow(\n        `The agent in your \"${who.profileName}\" profile (${safeText(who.profile.agentId, 40)}) isn't an agent of this xaq (or is disabled), so ${label} ` +\n          `couldn't use these through it. Not replacing anything in ${label}. Pair it with this xaq (${NPX} connect <xaq-url> --tool ${client} --force), then run this import again.`,\n      ),\n    );\n    return code;\n  }\n  const agentName = safeText(who.agent.name, 60);\n  const usable: ClientEntry[] = [];\n  for (const w of working) {\n    if (w.entry.fromProject) {\n      // ./.mcp.json is the project's file (often committed): left for its owners to change.\n      p.print(pc.dim(`  \"${w.entry.name}\" stays in ${w.entry.file}: it ships with the project. Remove it there if the project no longer needs it.`));\n      continue;\n    }\n    const grants = await api.grants(w.connection.id);\n    if (grants.some((g) => g.agentId === who.agent!.id)) {\n      usable.push(w.entry);\n      continue;\n    }\n    if (await p.confirm(`${agentName} (the agent ${label} uses) has no access to \"${w.connection.slug}\". Give it ${accessLabel(w.connection.levelDefault)}?`, true)) {\n      await api.setGrants(w.connection.id, [...grants.map((g) => ({ agentId: g.agentId, level: g.level })), { agentId: who.agent.id, level: w.connection.levelDefault }]);\n      usable.push(w.entry);\n    } else p.print(pc.dim(`  \"${w.entry.name}\" stays in ${label}: its agent couldn't use \"${w.connection.slug}\".`));\n  }\n  if (!usable.length) return code;\n  p.print(\"\");\n  const question = `Replace ${usable.map((e) => `\"${e.name}\"`).join(\", \")} in ${label} with the single xaq entry (setup-mcp --tool ${client}, with a backup)?`;\n  const routes = confinedRoutes(client, mcpServerName(who.profileName), deps.env);\n  let ok: boolean;\n  if (routes.length) {\n    const slugs = working.filter((w) => usable.includes(w.entry)).map((w) => w.connection.slug);\n    p.print(pc.yellow(`These ${label} settings are limited to the xaq server only:`));\n    for (const r of routes) p.print(`  ${safeText(r, 120)}`);\n    p.print(\n      pc.yellow(\n        `Through xaq they now also see the tools of ${slugs.map((s) => `\"${s}\"`).join(\", \")} (as <name>__<tool>), which ${routes.length === 1 ? \"it\" : \"they\"} couldn't reach before. ` +\n          `If one is triggered by email or webhooks, those tools become reachable from that content. Give ${agentName} less access on those connections, or keep them out, if that's not what you want.`,\n      ),\n    );\n    ok = await p.confirmExplicit(question, `${label}'s config wasn't changed; decide in a terminal`);\n  } else ok = await p.confirm(question, true);\n  if (!ok) {\n    p.print(`${label}'s config wasn't changed. Run this import again any time to do it.`);\n    return code;\n  }\n  const r = setupMcp(client, mcpTarget(who.profileName, who.profile), profilePath(who.profileName), { removeServers: usable.map(toRemove) });\n  for (const l of setupLines(r)) p.print(l);\n  const vars = [...new Set(usable.flatMap((e) => ((r.removed ?? []).includes(e.name) ? e.headerVars : [])))];\n  if (r.ok && vars.length) {\n    p.print(pc.dim(`  ${vars.join(\", \")} ${vars.length === 1 ? \"is\" : \"are\"} no longer needed by the removed entries; delete ${vars.length === 1 ? \"it\" : \"them\"} from your environment${client === \"hermes\" ? \" (~/.hermes/.env)\" : \"\"} once everything works through xaq.`));\n  }\n  return r.ok ? code : 1;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAYA,SAAgB,eAAe,QAAsB,YAAoB,MAAyB,QAAQ,KAAe;CACvH,IAAI,WAAW,UAAU,OAAO,CAAC;CACjC,MAAM,OAAO,WAAW,GAAG;CAC3B,MAAM,wBAAQ,IAAI,IAAI,CAAC,YAAY,OAAO,YAAY,CAAC;CACvD,MAAM,YAAY,MAAe,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,OAAO,MAAM,YAAY,MAAM,IAAI,CAAC,CAAC;CACxG,MAAM,MAAgB,CAAC;CACvB,MAAM,QAAQ,SAA0B;EACtC,IAAI;GACF,OAAO,WAAW,IAAI,IAAI,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,IAAI;EACvF,QAAQ;GACN,OAAO;EACT;CACF;CACA,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,aAAa;EACvC,IAAI,WAAW,MAAM,GAAG;GACtB,MAAM,OAAO,aAAa,QAAQ,MAAM;GACxC,MAAM,YAAY,WAAW,MAAM,mBAAmB,KAAK,CAAC;GAC5D,KAAK,MAAM,CAAC,UAAU,aAAa,OAAO,QAAQ,SAAS,GAAG,IAAI,SAAS,QAAQ,GAAG,IAAI,KAAK,qBAAqB,SAAS,eAAe;GAE5I,MAAM,OAAO,GAA0B,MAAsC,KAAK,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,CAAC,IAAK,EAAgC,KAAK,KAAA;GACrK,MAAM,SAAS,IAAI,IAAI,IAAI,WAAW,MAAM,WAAW,KAAK,KAAA,GAAW,SAAS,GAAG,OAAO,GAAG,QAAQ;GACrG,IAAI,WAAW,cAAe,MAAM,QAAQ,MAAM,KAAK,OAAO,MAAM,MAAM,MAAM,UAAU,GACxF,IAAI,KAAK,2GAA2G;QAC/G,IAAI,MAAM,QAAQ,MAAM,GAC7B,OAAO,SAAS,GAAG,MAAM;IACvB,IAAI,SAAS,IAAI,GAAG,UAAU,CAAC,GAAG,IAAI,KAAK,iBAAiB,OAAO,IAAI,GAAG,MAAM,KAAK,IAAI,IAAI,GAAG,EAAE,eAAe;GACnH,CAAC;QACI,IAAI,UAAU,OAAO,WAAW,UAChC;SAAA,MAAM,CAAC,MAAM,MAAM,OAAO,QAAQ,MAAmC,GAAG,IAAI,SAAS,IAAI,GAAG,UAAU,CAAC,GAAG,IAAI,KAAK,iBAAiB,KAAK,eAAe;GAAA;EAEjK;CACF,QAAQ,CAER;CACA,MAAM,OAAO,KAAK,KAAK,MAAM,4BAA4B,CAAC;CAC1D,IAAI,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GACpD;OAAA,MAAM,CAAC,OAAO,MAAM,OAAO,QAAQ,IAA8C,GAAG,IAAI,SAAS,GAAG,QAAQ,GAAG,IAAI,KAAK,iBAAiB,OAAO;CAAA;CAEvJ,MAAM,OAAO,KAAK,KAAK,MAAM,QAAQ,WAAW,CAAC;CACjD,MAAM,OAAQ,MAAM,QAAQ,IAAI,IAAI,OAAS,MAAoC,QAAQ,CAAC;CAC1F,IAAI,MAAM,QAAQ,IAAI,GAAQ;OAAA,MAAM,KAAK,MAAM,IAAI,SAAS,GAAG,gBAAgB,GAAG,IAAI,KAAK,YAAY,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,GAAG;CAAA;CACtI,OAAO;AACT;;;;AC/CA,MAAa,iBAAiB;CAAC;CAAU;CAAe;CAAU;AAAO;AAGzE,MAAa,gBAA8C;CAAE,QAAQ;CAAU,eAAe;CAAe,QAAQ;CAAU,OAAO;AAAQ;AA2C9I,MAAM,WAAW,MAAgB,MAAM,QAAQ,CAAC,IAAI,EAAE,QAAQ,MAAmB,OAAO,MAAM,QAAQ,IAAI,KAAA;AAE1G,SAAS,YAAY,GAA4B,SAAiD,aAAoD;CACpJ,MAAM,IAAqB,EAAE,UAAU,YAAY,QAAQ,MAAM,EAAE,OAAO,KAAA,KAAa,EAAE,OAAO,IAAI,EAAE;CACtG,MAAM,MAAM,QAAQ,QAAQ,OAAO;CACnC,MAAM,MAAM,QAAQ,QAAQ,OAAO;CACnC,IAAI,KAAK,QAAQ,EAAE,UAAU;CAC7B,IAAI,KAAK,QAAQ,EAAE,UAAU;CAC7B,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,SAAS,IAAI,KAAA;AAC3D;;AAcA,SAAgB,YAAY,MAAsC;CAChE,MAAM,MAA8B,CAAC;CACrC,KAAK,MAAM,OAAO,KAAK,MAAM,IAAI,GAAG;EAClC,MAAM,IAAI,6DAA6D,KAAK,GAAG;EAC/E,IAAI,CAAC,GAAG;EACR,IAAI,IAAI,EAAE;EACV,IAAK,EAAE,WAAW,IAAG,KAAK,EAAE,SAAS,IAAG,KAAK,EAAE,UAAU,KAAO,EAAE,WAAW,GAAG,KAAK,EAAE,SAAS,GAAG,KAAK,EAAE,UAAU,GAAI,IAAI,EAAE,MAAM,GAAG,EAAE;OACpI,IAAI,EAAE,QAAQ,WAAW,EAAE;EAChC,IAAI,EAAE,MAAO;CACf;CACA,OAAO;AACT;;AAKA,SAAgB,WAAW,OAAe,MAAoD;CAC5F,MAAM,OAAiB,CAAC;CACxB,IAAI,UAAyB;CAC7B,MAAM,MAAM,MAAM,QAAQ,2DAA2D,IAAI,MAAc,QAA4B;EACjI,MAAM,IAAI,KAAK;EACf,IAAI,MAAM,KAAA,KAAa,MAAM,IAAI;GAC/B,KAAK,KAAK,IAAI;GACd,OAAO;EACT;EACA,IAAI,QAAQ,KAAA,GAAW,OAAO;EAC9B,YAAY;EACZ,OAAO;CACT,CAAC;CACD,OAAO,UAAU,EAAE,QAAQ,IAAI;EAAE,OAAO;EAAK,MAAM;CAAK;AAC1D;AAEA,MAAM,SAAS,MAA6C,CAAC,CAAC,KAAK,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,CAAC;AAC5G,MAAM,YAAY,SAAiD;CACjE,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,MAAM,OAAO,aAAa,MAAM,MAAM;CACtC,IAAI,CAAC,KAAK,KAAK,GAAG,OAAO,CAAC;CAC1B,IAAI;EACF,MAAM,MAAM,KAAK,MAAM,IAAI;EAC3B,IAAI,CAAC,MAAM,GAAG,GAAG,MAAM,IAAI,MAAM,eAAe;EAChD,OAAO;CACT,QAAQ;EACN,MAAM,IAAI,MAAM,GAAG,KAAK,kEAAkE;CAC5F;AACF;;AAGA,SAAS,UAAU,MAAc,KAAc,MAAc,MAA0C,QAA8B,CAAC,GAAgB;CACpJ,MAAM,OAAoB;EAAE;EAAM;EAAM,WAAW;EAAQ,SAAS,CAAC;EAAG,YAAY,CAAC;EAAG,eAAe,CAAC;EAAG,OAAO;EAAO,SAAS;EAAM,GAAG;CAAM;CACjJ,IAAI,CAAC,MAAM,GAAG,GAAG,OAAO;EAAE,GAAG;EAAM,SAAS;CAA6B;CACzE,IAAI,IAAI,aAAa,QAAQ,IAAI,YAAY,OAAO,KAAK,UAAU;CACnE,MAAM,OAAO,OAAO,IAAI,SAAS,WAAW,IAAI,KAAK,YAAY,IAAI;CACrE,IAAI,SAAS,WAAY,OAAO,IAAI,YAAY,YAAY,CAAC,IAAI,KAAM;EACrE,MAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,MAAM,IAAI,CAAC;EAC/D,OAAO;GAAE,GAAG;GAAM,WAAW;GAAS,SAAS,CAAC,OAAO,IAAI,WAAW,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK;EAAE;CACvG;CACA,IAAI,OAAO,IAAI,QAAQ,UAAU,OAAO;EAAE,GAAG;EAAM,SAAS;CAAS;CACrE,MAAM,MAAM,WAAW,IAAI,KAAK,IAAI;CACpC,IAAI,aAAa,KAAK,OAAO;EAAE,GAAG;EAAM,SAAS,mBAAmB,IAAI,QAAQ;CAAyB;CACzG,MAAM,QAAqB;EAAE,GAAG;EAAM,KAAK,IAAI;EAAO,WAAW,SAAS,QAAQ,QAAQ;CAAO;CACjG,IAAI,IAAI,kBAAkB,KAAA,KAAa,IAAI,mBAAmB,KAAA,GAAW,OAAO;EAAE,GAAG;EAAO,SAAS;CAAwE;CAC7K,IAAI,IAAI,UAAU,KAAA,KAAa,IAAI,SAAS,KAAA,GAAW,MAAM,QAAQ;CACrE,OAAO,YAAY,OAAO,IAAI,SAAS,IAAI;AAC7C;AAEA,SAAS,YAAY,OAAoB,SAAkB,MAAuD;CAChH,IAAI,YAAY,KAAA,KAAa,YAAY,MAAM,OAAO;CACtD,IAAI,CAAC,MAAM,OAAO,GAAG,OAAO;EAAE,GAAG;EAAO,SAAS;CAA4B;CAC7E,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,GAAG;EAC5C,IAAI,OAAO,MAAM,UAAU,OAAO;GAAE,GAAG;GAAO,SAAS,OAAO,EAAE;EAAuB;EACvF,MAAM,IAAI,WAAW,GAAG,IAAI;EAC5B,IAAI,aAAa,GAAG,OAAO;GAAE,GAAG;GAAO,SAAS,OAAO,EAAE,kBAAkB,EAAE,QAAQ;EAAyB;EAC9G,MAAM,QAAQ,KAAK,EAAE;EACrB,MAAM,WAAW,KAAK,GAAG,EAAE,IAAI;EAC/B,MAAM,cAAc,KAAK,EAAE;CAC7B;CACA,OAAO;AACT;AAIA,SAAgB,YAAY,MAAyB,QAAQ,KAAsC;CACjG,MAAM,OAAO,WAAW,GAAG;CAC3B,OAAO;EAAE,QAAQ,KAAK,MAAM,aAAa;EAAG,KAAK,KAAK,MAAM,MAAM;CAAE;AACtE;AAEA,SAAS,WAAW,MAAiC;CACnD,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,QAAQ,YAAY,GAAG;CAC7B,MAAM,SAAuB;EAAE,QAAQ;EAAU,OAAO,CAAC,MAAM,MAAM;EAAG,SAAS,CAAC;CAAE;CACpF,IAAI,CAAC,WAAW,MAAM,MAAM,GAAG,OAAO;CACtC,MAAM,UAAU,eAAe,aAAa,MAAM,QAAQ,MAAM,CAAC;CACjE,IAAI,CAAC,SAAS,MAAM,IAAI,MAAM,GAAG,MAAM,OAAO,uGAAuG;CAErJ,MAAM,OAAO;EAAE,GAAG;EAAK,GAAI,WAAW,MAAM,GAAG,IAAI,YAAY,aAAa,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC;CAAG;CACtG,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,OAAO,GAAG;EACjD,IAAI,KAAK,WAAW,IAAQ,GAAG;EAC/B,MAAM,OAAoB;GAAE;GAAM,MAAM,MAAM;GAAQ,WAAW;GAAQ,SAAS,CAAC;GAAG,YAAY,CAAC;GAAG,eAAe,CAAC;GAAG,OAAO;GAAO,SAAS;EAAK;EACrJ,IAAI,CAAC,OAAO,QAAQA,cAAmB,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,GAAG;GACpF,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS;GAA2B,CAAC;GACpE;EACF;EACA,MAAM,IAAI;EACV,MAAM,aAAa;GAAC;GAAO;GAAW;GAAW;GAAQ;GAAa;EAAS,CAAC,CAAC,MAAM,MAAM,EAAE,OAAOA,UAAe;EACrH,IAAI,YAAY;GACd,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS,OAAO,WAAW;GAAgB,CAAC;GAC3E;EACF;EACA,IAAI,EAAE,YAAY,SAAU,OAAO,EAAE,YAAY,YAAY;GAAC;GAAS;GAAM;GAAO;EAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,YAAY,CAAC,GAAI,KAAK,UAAU;EAC5I,IAAI,OAAO,EAAE,YAAY,UAAU;GACjC,MAAM,OAAO,MAAM,QAAQ,EAAE,IAAI,IAAI,EAAE,KAAK,QAAQ,MAAM,OAAO,MAAM,QAAQ,IAAI,CAAC;GACpF,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,WAAW;IAAS,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;GAAE,CAAC;GAC5F;EACF;EACA,IAAI,OAAO,EAAE,QAAQ,UAAU;GAC7B,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS;GAAS,CAAC;GAClD;EACF;EACA,MAAM,MAAM,WAAW,EAAE,KAAK,IAAI;EAClC,IAAI,aAAa,KAAK;GACpB,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS,mBAAmB,IAAI,QAAQ,wBAAwB,MAAM;GAAM,CAAC;GAC5G;EACF;EACA,MAAM,QAAQ,MAAM,EAAE,KAAK,IAAK,EAAE,QAAoC,CAAC;EACvE,MAAM,QAAqB;GACzB,GAAG;GACH,KAAK,IAAI;GACT,WAAW,EAAE,cAAc,QAAQ,QAAQ;GAC3C,OAAO,EAAE,SAAS,WAAW,MAAM,EAAE,KAAK;GAC1C,SAAS,YAAY,GAA8B;IAAE,SAAS,MAAM;IAAS,SAAS,MAAM;GAAQ,GAAG,CAAC,WAAW,iBAAiB,CAAC;EACvI;EACA,IAAI,EAAE,gBAAgB,KAAA,KAAa,EAAE,oBAAoB,KAAA,GAAW;GAClE,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAO,SAAS;GAAwF,CAAC;GAClI;EACF;EACA,OAAO,QAAQ,KAAK,YAAY,OAAO,EAAE,WAAW,KAAA,GAAW,IAAI,CAAC;CACtE;CACA,OAAO;AACT;AAIA,SAAS,WAAW,MAAiC;CACnD,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,MAAM,KAAK,OAAO,QAAQ,IAAI;CACpC,MAAM,WAAW,iBAAiB;CAClC,MAAM,cAAc,KAAK,KAAK,WAAW;CACzC,MAAM,SAAuB;EAAE,QAAQ;EAAe,OAAO,CAAC,UAAU,WAAW,CAAC,CAAC,OAAO,UAAU;EAAG,SAAS,CAAC;CAAE;CACrH,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,OAAO,MAAmB;EAE9B,IAAI,KAAK,IAAI,EAAE,IAAI,GAAG;EACtB,KAAK,IAAI,EAAE,IAAI;EACf,OAAO,QAAQ,KAAK,CAAC;CACvB;CACA,MAAM,MAAM,SAAS,QAAQ;CAC7B,MAAM,OAAO,OAAO,MAAM,IAAI,QAAQ,KAAK,MAAM,IAAI,SAAS,IAAI,IAAK,IAAI,SAAS,OAAmC,CAAC;CACxH,MAAM,QAAQ,KAAK;CACnB,IAAI,MAAM,KAAK,GAAG,KAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,KAAK,GAAG,IAAI,UAAU,GAAG,KAAK,UAAU,KAAK;EAAE,OAAO;EAAS,YAAY;CAAI,CAAC,CAAC;CACzI,MAAM,UAAU,SAAS,WAAW;CACpC,IAAI,WAAW,MAAM,QAAQ,UAAU,GAAG;EAIxC,MAAM,QAAQ,MAAgB,MAAM,QAAQ,CAAC,IAAI,EAAE,QAAQ,MAAmB,OAAO,MAAM,QAAQ,IAAI,CAAC;EACxG,MAAM,UAAU,IAAI,IAAI,KAAK,KAAK,qBAAqB,CAAC;EACxD,MAAM,WAAW,IAAI,IAAI,KAAK,KAAK,sBAAsB,CAAC;EAC1D,MAAM,MAAM,KAAK,+BAA+B;EAChD,KAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,QAAQ,UAAU,GAAG;GACzD,MAAM,IAAI,UAAU,GAAG,KAAK,aAAa,KAAK;IAAE,OAAO;IAAW,YAAY;IAAK,aAAa;GAAK,CAAC;GACtG,MAAM,MAAM,SAAS,IAAI,CAAC,IAAI,+CAA+C,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,IAAI,gCAAgC;GAEvI,IAAI,KAAK,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAG,SAAS;GAAI,CAAC;QAC9C,IAAI,CAAC;EACZ;CACF;CACA,IAAI,OAAO,MAAM,IAAI,UAAU,GAAG,KAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,IAAI,UAAU,GAAG,IAAI,UAAU,GAAG,KAAK,UAAU,KAAK,EAAE,OAAO,OAAO,CAAC,CAAC;CAChJ,OAAO;AACT;AAIA,SAAS,WAAW,MAAiC;CACnD,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,OAAO,iBAAiB;CAC9B,MAAM,SAAuB;EAAE,QAAQ;EAAU,OAAO,CAAC,IAAI;EAAG,SAAS,CAAC;CAAE;CAC5E,MAAM,MAAM,SAAS,IAAI;CACzB,IAAI,OAAO,MAAM,IAAI,UAAU,GAAG,KAAK,MAAM,CAAC,GAAG,QAAQ,OAAO,QAAQ,IAAI,UAAU,GAAG,OAAO,QAAQ,KAAK,UAAU,GAAG,KAAK,MAAM,GAAG,CAAC;CACzI,OAAO;AACT;AAIA,SAAS,UAAU,MAAiC;CAClD,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,OAAO,gBAAgB;CAC7B,MAAM,SAAuB;EAAE,QAAQ;EAAS,OAAO,CAAC,IAAI;EAAG,SAAS,CAAC;CAAE;CAC3E,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO;CAC9B,KAAK,MAAM,CAAC,MAAM,QAAQ,OAAO,QAAQ,mBAAmB,aAAa,MAAM,MAAM,CAAC,CAAC,GAAG;EACxF,MAAM,OAAoB;GAAE;GAAM;GAAM,WAAW;GAAQ,SAAS,CAAC;GAAG,YAAY,CAAC;GAAG,eAAe,CAAC;GAAG,OAAO;GAAO,SAAS;EAAK;EACvI,IAAI,QAAQC,cAAiB;GAC3B,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS;GAA2B,CAAC;GACpE;EACF;EACA,MAAM,IAAI;EACV,IAAI,EAAE,YAAY,OAAO,KAAK,UAAU;EACxC,IAAI,OAAO,EAAE,YAAY,UAAU;GACjC,MAAM,OAAO,MAAM,QAAQ,EAAE,IAAI,IAAI,EAAE,KAAK,QAAQ,MAAmB,OAAO,MAAM,QAAQ,IAAI,CAAC;GACjG,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,WAAW;IAAS,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG;GAAE,CAAC;GAC5F;EACF;EACA,IAAI,OAAO,EAAE,QAAQ,UAAU;GAC7B,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAM,SAAS;GAAS,CAAC;GAClD;EACF;EACA,MAAM,QAAqB;GACzB,GAAG;GACH,KAAK,EAAE;GACP,OAAO,MAAM,EAAE,KAAK,KAAK,EAAE,SAAS;GACpC,SAAS,YAAY,GAAG;IAAE,SAAS,EAAE;IAAe,SAAS,EAAE;GAAe,GAAG,CAAC,oBAAoB,qBAAqB,CAAC;EAC9H;EACA,IAAI,EAAE,wBAAwB,KAAA,GAAW;GACvC,OAAO,QAAQ,KAAK;IAAE,GAAG;IAAO,SAAS;GAAwE,CAAC;GAClH;EACF;EAEA,MAAM,UAAkC,CAAC;EACzC,IAAI;EACJ,IAAI,EAAE,iBAAiB,KAAA,GAAW;GAChC,IAAI,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,OAAO,EAAE,YAAY,CAAC,CAAC,MAAM,MAAM,OAAO,MAAM,QAAQ,GAAG,UAAU;QACrG;IACH,OAAO,OAAO,SAAS,EAAE,YAAY;IACrC,KAAK,MAAM,KAAK,OAAO,KAAK,EAAE,YAAY,GAAG,MAAM,cAAc,KAAK,CAAC;GACzE;EACF;EACA,MAAM,UAAmC,MAAM,EAAE,gBAAgB,IAAI,EAAE,GAAG,EAAE,iBAAiB,IAAI,CAAC;EAClG,IAAI,EAAE,yBAAyB,KAAA,GAAW,QAAQ,gBAAgB,EAAE;EACpE,KAAK,MAAM,CAAC,GAAG,YAAY,OAAO,QAAQ,OAAO,GAC/C,IAAI,OAAO,YAAY,UAAU,YAAY,OAAO,EAAE;OACjD,IAAI,CAAC,IAAI,UAAU,YAAY,OAAO,EAAE,sBAAsB,QAAQ;OACtE;GACH,QAAQ,KAAK,MAAM,mBAAmB,EAAE,yBAAyB,UAAU,UAAU,IAAI,aAAa,IAAI;GAC1G,MAAM,WAAW,KAAK,OAAO;GAC7B,MAAM,cAAc,KAAK,CAAC,OAAO;EACnC;EAEF,MAAM,UAAU;EAChB,OAAO,QAAQ,KAAK,UAAU;GAAE,GAAG;GAAO;EAAQ,IAAI,KAAK;CAC7D;CACA,OAAO;AACT;AAEA,SAAgB,iBAAiB,QAAsB,OAAoB,CAAC,GAAiB;CAC3F,QAAQ,QAAR;EACE,KAAK,UACH,OAAO,WAAW,IAAI;EACxB,KAAK,eACH,OAAO,WAAW,IAAI;EACxB,KAAK,UACH,OAAO,WAAW,IAAI;EACxB,KAAK,SACH,OAAO,UAAU,IAAI;CACzB;AACF;AAEA,SAAgB,kBAAkB,OAA6B;CAC7D,MAAM,IAAI,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,YAAY,aAAa;CACtE,IAAI,CAAE,eAAqC,SAAS,CAAC,GAAG,MAAM,IAAI,MAAM,mBAAmB,MAAM,oBAAoB,eAAe,KAAK,IAAI,EAAE,EAAE;CACjJ,OAAO;AACT;;;ACrRA,MAAM,YAAY;AAElB,SAAS,OAAO,GAAgB,aAAgC;CAC9D,IAAI,UAAU,KAAK,EAAE,IAAI,GAAG,OAAO;CACnC,IAAI,OAAO,OAAO,EAAE,OAAO,CAAC,CAAC,MAAM,MAAM,kBAAkB,KAAK,EAAE,KAAK,CAAC,CAAC,GAAG,OAAO;CACnF,IAAI,CAAC,EAAE,KAAK,OAAO;CACnB,IAAI;EACF,MAAM,IAAI,IAAI,IAAI,EAAE,GAAG;EACvB,OAAO,EAAE,SAAS,QAAQ,QAAQ,EAAE,CAAC,CAAC,SAAS,MAAM,KAAK,YAAY,SAAS,EAAE,MAAM;CACzF,QAAQ;EACN,OAAO;CACT;AACF;AAEA,MAAM,WAAW,GAA8B,MAAc;CAC3D,IAAI;EACF,OAAO,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,QAAQ,EAAE;CAC1F,QAAQ;EACN,OAAO;CACT;AACF;AAEA,eAAsB,WAAW,QAAsB,MAAkF,CAAC,GAAwB;CAChK,MAAM,QAAQ,cAAc,OAAO;CACnC,MAAM,QAAQ,IAAI,KAAK,IAAI,YAAY,CAAC,EAAA,CAAG,KAAK,MAAM,EAAE,IAAI,CAAC;CAC7D,MAAM,QAAoB,CAAC;CAC3B,KAAK,MAAM,SAAS,OAAO,SAAS;EAClC,IAAI,OAAO,OAAO,IAAI,eAAe,CAAC,CAAC,GAAG;GACxC,MAAM,KAAK;IAAE,QAAQ;IAAQ;GAAM,CAAC;GACpC;EACF;EACA,IAAI,MAAM,cAAc,SAAS;GAC/B,MAAM,KAAK;IAAE,QAAQ;IAAS;GAAM,CAAC;GACrC;EACF;EACA,IAAI,MAAM,SAAS;GACjB,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ,MAAM;GAAQ,CAAC;GAC3D;EACF;EACA,IAAI,CAAC,MAAM,SAAS;GAClB,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ,sBAAsB;GAAQ,CAAC;GAC3E;EACF;EACA,IAAI;EACJ,IAAI;GACF,MAAM,IAAI,IAAI,MAAM,GAAI;GACxB,IAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU,MAAM,IAAI,MAAM,QAAQ;EACrF,QAAQ;GACN,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ;GAA+B,CAAC;GAC5E;EACF;EACA,MAAM,cAAc,OAAO,KAAK,MAAM,OAAO;EAC7C,IAAI,YAAY,SAAS,GAAG;GAC1B,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ,YAAY,YAAY,OAAO,YAAY,YAAY,KAAK,IAAI,EAAE;GAA+C,CAAC;GAC9J;EACF;EACA,MAAM,YAAY,IAAI,YAAY,CAAC,EAAA,CAAG,MAAM,MAAM,QAAQ,EAAE,KAAK,IAAI,IAAI,CAAC;EAC1E,IAAI,UAAU;GACZ,MAAM,KAAK;IAAE,QAAQ;IAAU;IAAO,YAAY;GAAS,CAAC;GAC5D;EACF;EACA,MAAM,SAAS,MAAM,YAAY,KAAK,IAAI,MAAM;EAChD,IAAI,OAAO,SAAS,SAAS;GAC3B,MAAM,KAAK;IACT,QAAQ;IACR;IACA,QACE,OAAO,QAAQ,iBACX,sEAAsE,OAAO,YAC7E,WAAW,OAAO,QAAQ;GAClC,CAAC;GACD;EACF;EACA,IAAI,OAAO,SAAS,YAAY,IAAI,aAAa,SAAS;GACxD,MAAM,KAAK;IAAE,QAAQ;IAAQ;IAAO,QAAQ;GAA+D,CAAC;GAC5G;EACF;EACA,IAAI,OAAO,QAAQ,MAAM,IAAI;EAC7B,KAAK,IAAI,IAAI,GAAG,MAAM,IAAI,IAAI,GAAG,KAAK,OAAO,GAAG,QAAQ,MAAM,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE,EAAE,GAAG;EACpF,MAAM,IAAI,IAAI;EACd,MAAM,OAAO,YAAY,SACrB;GAAE,MAAM;GAAmB,MAAM,YAAY;GAAK,OAAO,MAAM,QAAQ,YAAY;EAAM,IACzF,MAAM,QACJ,EAAE,MAAM,QAAiB,IACzB,EAAE,MAAM,OAAgB;EAC9B,MAAM,KAAK;GAAE,QAAQ;GAAU;GAAO;GAAM,KAAK,MAAM,IAAK,KAAK;GAAG;GAAM,eAAe,OAAO,SAAS,YAAY,OAAO,SAAS;EAAK,CAAC;CAC7I;CACA,OAAO;AACT;AAEA,MAAM,SAAS,MAAoB,EAAE,QAAQ,KAAK,EAAE,MAAM,WAAW;AACrE,MAAM,UAAU,QAAgB;CAC9B,IAAI;EACF,OAAO,IAAI,IAAI,GAAG,CAAC,CAAC;CACtB,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAS,WAAW,GAA2D;CAC7E,IAAI,EAAE,KAAK,SAAS,UAAU,OAAO;CACrC,MAAM,OAAO,EAAE,MAAM,cAAc,EAAE,KAAK,SAAS,CAAC;CACpD,MAAM,OAAO,KAAK,SAAS,UAAU,KAAK,KAAK,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,KAAK;CAC9E,OAAO,OAAO,EAAE,KAAK,KAAK,SAAS,KAAK,0DAA0D,SAAS,OAAO,EAAE,GAAG,GAAG,GAAG;AAC/H;;AAGA,SAAgB,WAAW,QAAsB,OAA6B;CAC5E,MAAM,QAAQ,cAAc,OAAO;CACnC,MAAM,MAAgB,CAAC;CACvB,MAAM,QAAQ,KAAK,IAAI,IAAI,KAAK,IAAI,GAAG,GAAG,MAAM,KAAK,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;CAChF,MAAM,OAAO,MAAc,EAAE,OAAO,KAAK;CACzC,MAAM,OAAO,IAAI,OAAO,QAAQ,CAAC;CACjC,IAAI,KAAK,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,IAAI,KAAK,iBAAiB,SAAS,MAAM,OAAO,aAAa,MAAM,WAAW,IAAI,KAAK,IAAI,EAAE;CACrI,KAAK,MAAM,KAAK,OAAO;EACrB,MAAM,OAAO,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,EAAE,CAAC,EAAE;EAClD,QAAQ,EAAE,QAAV;GACE,KAAK;IACH,IAAI,KAAK,GAAG,OAAO,GAAG,IAAI,0BAA0B,GAAG;IACvD;GACF,KAAK;IACH,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,wBAAwB,EAAE,qBAAqB,SAAS,EAAE,MAAM,WAAW,IAAI,EAAE,EAAE,iBAAiB,OAAO;IACxI;GACF,KAAK;IACH,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,MAAM,EAAE,IAAI,EAAE,OAAO,gBAAgB,OAAO;IACzE;GACF,KAAK;IACH,IAAI,UAAU,EAAE,UAAU,GAAG,IAAI,KAAK,GAAG,KAAK,sBAAsB,EAAE,WAAW,KAAK,KAAK,EAAE,WAAW,MAAM,MAAM,QAAQ;SACvH;KACH,MAAM,MACJ,EAAE,MAAM,SAAS,EAAE,WAAW,aAAa,WAAW,EAAE,WAAW,WAAW,iBAAiB,kBAAkB,GAAG,EAAE,WAAW,OAAO,IAAI,EAAE,WAAW,MAAM,MAAM;KACvK,IAAI,KAAK,GAAG,KAAK,yBAAyB,EAAE,WAAW,KAAK,KAAK,IAAI,gBAAgB,MAAM,gBAAgB;KAC3G,IAAI,KAAK,GAAG,OAAO,cAAc,EAAE,UAAU,GAAG;IAClD;IACA,IAAI,KAAK,GAAG,aAAa,EAAE,OAAO,IAAI,CAAC;IACvC;GACF,KAAK,UAAU;IACb,IAAI,KAAK,GAAG,OAAO,GAAG,MAAM,QAAQ,EAAE,eAAe,EAAE,KAAK,MAAM,SAAS,EAAE,KAAK,GAAG,IAAI,MAAM,EAAE,KAAK,GAAG;IACzG,IAAI,EAAE,MAAM,aAAa,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,8BAA8B,EAAE,6CAA6C;IACnI,MAAM,IAAI,WAAW,CAAC;IACtB,IAAI,GAAG,IAAI,KAAK,GAAG,OAAO,GAAG;SACxB,IAAI,EAAE,KAAK,SAAS,SAAS,IAAI,KAAK,GAAG,KAAK,kCAAkC,MAAM,6DAA6D;SACnJ,IAAI,KAAK,GAAG,KAAK,mBAAmB,MAAM,sEAAsE;IACrH,IAAI,EAAE,eAAe,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,iBAAiB,EAAE,gCAAgC,EAAE,eAAe;IACtH,IAAI,KAAK,GAAG,aAAa,EAAE,OAAO,IAAI,CAAC;IACvC;GACF;EACF;CACF;CACA,OAAO;AACT;;AAGA,SAAS,aAAa,GAAgB,MAAwB;CAC5D,MAAM,IAAI,EAAE;CACZ,IAAI,CAAC,GAAG,OAAO,CAAC;CAChB,MAAM,MAAgB,CAAC;CACvB,MAAM,QAAQ,OAAiB,GAAG,KAAK,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI;CACvE,IAAI,EAAE,SAAS,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,kBAAkB,EAAE,0BAA0B,KAAK,EAAE,OAAO,EAAE,iEAAiE;CAC3K,IAAI,EAAE,SAAS,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,kBAAkB,EAAE,+BAA+B,KAAK,EAAE,OAAO,EAAE,iEAAiE;CAChL,IAAI,EAAE,SAAS,QAAQ,IAAI,KAAK,GAAG,OAAO,GAAG,OAAO,kBAAkB,EAAE,IAAI,EAAE,SAAS,KAAK,IAAI,EAAE,kCAAkC;CACpI,OAAO;AACT;AAaA,MAAM,QAAQ;AAEd,SAAS,WAAW,GAA6B;CAC/C,MAAM,MAAM,CAAC,EAAE,KAAK,GAAG,EAAE,SAAS,GAAG,KAAK,GAAG,IAAI,GAAG,MAAM,GAAG,EAAE,GAAG,EAAE,YAAY,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,EAAE,SAAS;CAChH,KAAK,MAAM,KAAK,EAAE,WAAW,CAAC,GAAG,IAAI,KAAK,EAAE,WAAW,GAAG,IAAI,GAAG,KAAK,KAAK,GAAG,IAAI,OAAO,GAAG;CAC5F,IAAI,EAAE,QAAQ,IAAI,KAAK,GAAG,KAAK,aAAa,EAAE,QAAQ,CAAC;CACvD,IAAI,CAAC,EAAE,IAAI,KAAK,MAAM,KAAK,EAAE,UAAU,CAAC,GAAG,IAAI,KAAK,OAAO,GAAG;CAC9D,KAAK,MAAM,KAAK,EAAE,SAAS,CAAC,GAAG,IAAI,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC;CACxD,IAAI,EAAE,MAAM,EAAE,QAAQ,QAAQ,IAAI,KAAK,KAAK,EAAE,SAAS,8BAA8B,gBAAgB,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG;CACrJ,OAAO;AACT;AAEA,MAAM,YAAY,OAAkC;CAAE,MAAM,EAAE;CAAM,OAAO,EAAE;CAAO,YAAY,EAAE,UAAU,SAAS,KAAA,IAAY,EAAE;AAAW;AAS9I,eAAsB,UAAU,OAAoB,MAAmC;CACrF,MAAM,IAAI,KAAK;CACf,MAAM,SAAuB,kBAAkB,MAAM,IAAI;CACzD,MAAM,QAAQ,cAAc;CAC5B,MAAM,SAAkC,MAAM,SAAS,YAAY,MAAM,MAAM,IAAI,KAAA;CACnF,MAAM,SAAS,iBAAiB,QAAQ;EAAE,KAAK,KAAK;EAAK,KAAK,KAAK;CAAI,CAAC;CACxE,IAAI,CAAC,OAAO,QAAQ,QAAQ;EAC1B,EAAE,MAAM,GAAG,MAAM,kCAAkC,OAAO,MAAM,KAAK,IAAI,KAAK,iBAAiB,sBAAsB;EACrH,OAAO;CACT;CACA,MAAM,cAAc,MAAM,WAAA;CAE1B,IAAI,MAAM,QAAQ;EAEhB,IAAI;EACJ,IAAI;GACF,WAAW,MAAM,KAAK,QAAQ,CAAC,CAAC,KAAK;EACvC,QAAQ;GACN,WAAW,KAAA;EACb;EACA,MAAM,QAAQ,MAAM,WAAW,QAAQ;GAAE;GAAU,QAAQ,KAAK;GAAQ,aAAa,KAAK;EAAY,CAAC;EACvG,EAAE,MAAM,GAAG,KAAK,yCAAyC,CAAC;EAC1D,KAAK,MAAM,KAAK,WAAW,QAAQ,KAAK,GAAG,EAAE,MAAM,CAAC;EACpD,MAAM,UAAU,MAAM,QAAQ,MAAuB,EAAE,WAAW,QAAQ;EAC1E,MAAM,OAAO,QAAQ,QAAQ,MAAM,EAAE,aAAa;EAClD,EAAE,MAAM,EAAE;EACV,EAAE,MAAM,gBAAgB,QAAQ,OAAO,aAAa,QAAQ,WAAW,IAAI,KAAK,IAAI,QAAQ,SAAS,YAAY,MAAM,IAAI,4DAA4D,EAAE;EACzL,IAAI,KAAK,QAAQ,EAAE,MAAM,6BAA6B,KAAK,KAAK,MAAM,EAAE,aAAa,CAAC,CAAC,KAAK,IAAI,EAAE,oEAAoE;EACtK,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,8GAA8G,CAAC;EAC7I,MAAM,YAAY,CAChB,GAAG,MAAM,QAAQ,MAAoD,EAAE,WAAW,YAAY,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,SAAS,EAAE,KAAK,CAAC,GAC/I,GAAG,QAAQ,QAAQ,MAAM,EAAE,KAAK,SAAS,OAAO,CAAC,CAAC,KAAK,MAAM,SAAS,EAAE,KAAK,CAAC,CAChF;EACA,EAAE,MAAM,EAAE;EACV,IAAI,CAAC,UAAU,QAAQ,EAAE,MAAM,GAAG,MAAM,yBAAyB;OAC5D,IAAI,CAAC,cAAc,WAAW,GACjC,EAAE,MAAM,2DAA2D,MAAM,kDAAkD,MAAM,cAAc,IAAI,4BAA4B,OAAO,GAAG;OACpL;GACL,EAAE,MAAM,yCAAyC,OAAO,iEAAiE,MAAM,wDAAwD;GACvL,MAAM,IAAI,SAAS,QAAQ,UAAU,aAAa,YAAY,WAAW,CAAC,GAAG,YAAY,WAAW,GAAG;IAAE,QAAQ;IAAM,eAAe;GAAU,CAAC;GACjJ,KAAK,MAAM,KAAK,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;EAC1C;EACA,OAAO;CACT;CAEA,MAAM,MAAM,KAAK,QAAQ;CAEzB,MAAM,QAAQ,MAAM,WAAW,QAAQ;EAAE,UAAA,MADlB,IAAI,KAAK;EACmB,QAAQ,KAAK;EAAQ,aAAa,KAAK;CAAY,CAAC;CACvG,KAAK,MAAM,KAAK,WAAW,QAAQ,KAAK,GAAG,EAAE,MAAM,CAAC;CACpD,IAAI,UAAU,MAAM,QAAQ,MAAuB,EAAE,WAAW,QAAQ;CACxE,MAAM,UAAU,MAAM,QAAQ,MAAoD,EAAE,WAAW,QAAQ;CACvG,EAAE,MAAM,EAAE;CAGV,MAAM,cAAc,QAAQ,QAAQ,MAAM,EAAE,MAAM,WAAW;CAC7D,IAAI,YAAY,QAAQ;EACtB,EAAE,MAAM,GAAG,OAAO,mBAAmB,YAAY,EAAE,CAAE,MAAM,KAAK,yEAAyE,CAAC;EAC1I,KAAK,MAAM,KAAK,aAAa,EAAE,MAAM,KAAK,SAAS,EAAE,MAAM,MAAM,EAAE,EAAE,KAAK,SAAS,EAAE,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,IAAI;EAC5I,IAAI,CAAE,MAAM,EAAE,gBAAgB,UAAU,YAAY,WAAW,IAAI,OAAO,SAAS,YAAY,SAAS,aAAa,0BAA0B,GAC7I,UAAU,QAAQ,QAAQ,MAAM,CAAC,EAAE,MAAM,WAAW;CAExD;CAGA,MAAM,aAAa,IAAI,IAAI,MAAM,gBAAgB,CAAC,CAAC;CACnD,MAAM,OAAO,QAAQ,QAAQ,MAAM,EAAE,iBAAiB,CAAC,WAAW,IAAI,EAAE,aAAa,CAAC;CACtF,KAAK,MAAM,KAAK,QAAQ,QAAQ,MAAM,EAAE,iBAAiB,WAAW,IAAI,EAAE,aAAa,CAAC,GAAG,EAAE,MAAM,YAAY,EAAE,cAAc,IAAI,SAAS,EAAE,MAAM,MAAM,EAAE,EAAE,oBAAoB;CAClL,IAAI,KAAK,QAAQ;EACf,EAAE,MAAM,GAAG,OAAO,4DAA4D,CAAC;EAC/E,KAAK,MAAM,KAAK,MAAM,EAAE,MAAM,KAAK,EAAE,cAAc,KAAK,SAAS,EAAE,MAAM,MAAM,EAAE,EAAE,EAAE;EACrF,EAAE,MACA,GAAG,IAAI,gJAAgJ,CACzJ;EACA,MAAM,QAAQ,KAAK,KAAK,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI;EACrD,IAAI,CAAE,MAAM,EAAE,gBAAgB,2BAA2B,KAAK,WAAW,IAAI,OAAO,SAAS,KAAK,SAAS,IAAI,YAAY,MAAM,8CAA8C,GAC7K,UAAU,QAAQ,QAAQ,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC;CAErD;CAEA,MAAM,MAAM,MAAM,YAAY,KAAK,WAAW;CAC9C,IAAI,CAAC,QAAQ,QAAQ;EACnB,EAAE,MAAM,oBAAoB;EAC5B,OAAO,WACL,MACA,KACA,QACA,KACA,QAAQ,QAAQ,MAAM,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,OAAO;GAAE,OAAO,EAAE;GAAO,YAAY,EAAE;EAAW,EAAE,GACpG,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,MAAM,IAAI,GACnE,CACF;CACF;CAEA,MAAM,QAAQ,MAAM,aAAa,GAAG,MAAM;CAC1C,IAAI,SAAS,MAAM,aAAa,GAAG,KAAK,MAAM,KAAK;CACnD,IAAI,WAAW,SAAS,IAAI,SAAS,CAAC,OAAO,SAAS,IAAI,MAAM,EAAE,GAAG;EACnE,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,IAAI,MAAM,MAAM,EAAE,EAAE,cAAc,MAAM,8CAA8C,MAAM,iCAAiC,CAAC;EAC5J,IAAI,MAAM,EAAE,QAAQ,WAAW,SAAS,IAAI,MAAM,MAAM,EAAE,EAAE,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,QAAQ,IAAI,MAAM,EAAE;CAC1G;CACA,IAAI,CAAE,MAAM,EAAE,QAAQ,UAAU,QAAQ,OAAO,aAAa,QAAQ,WAAW,IAAI,KAAK,IAAI,IAAI,YAAY,KAAK,EAAE,IAAI,YAAY,MAAM,EAAE,KAAK,IAAI,GAAI;EACtJ,EAAE,MAAM,sBAAsB;EAC9B,OAAO;CACT;CAEA,MAAM,WAAsB,CAAC;CAC7B,KAAK,MAAM,QAAQ,SAAS;EAC1B,IAAI,UAAiC;EACrC,IAAI;GACF,UAAU,MAAM,IAAI,OAAO;IAAE,MAAM,KAAK;IAAM,MAAM,KAAK,MAAM;IAAM,KAAK,KAAK;IAAK,cAAc;IAAO,GAAI,WAAW,QAAQ,CAAC,IAAI,EAAE,UAAU,OAAO;GAAG,CAAC;GAC5J,IAAI,KAAK,eAAe,MAAM,IAAI,mBAAmB,QAAQ,IAAI,IAAI;GACrE,MAAM,IAAI,MAAM,IAAI,QAAQ,QAAQ,IAAI,KAAK,KAAK,SAAS,WAAW,EAAE,QAAQ;IAAE,MAAM,KAAK,KAAK;IAAM,OAAO,KAAK,KAAK;GAAM,EAAE,IAAI,CAAC,CAAC;GACvI,IAAI,EAAE,WAAW,aAAa;IAE5B,MAAM,QAAQ,MAAM,YAAY,KAAK,EAAE,YAAY;KAAE,QAAQ,KAAK;KAAQ,IAAI,KAAK;IAAS,CAAC;IAC7F,SAAS,KAAK;KAAE;KAAM,QAAQ,MAAM,KAAK,IAAI,cAAc;KAAc,YAAY;IAAM,CAAC;GAC9F,OAAO,IAAI,EAAE,WAAW,aAAa,SAAS,KAAK;IAAE;IAAM,QAAQ;IAAa,YAAY;IAAS,cAAc,EAAE;GAAa,CAAC;QAC9H,MAAM,IAAI,MAAM,EAAE,OAAO;EAChC,SAAS,KAAK;GAEZ,IAAI,SAAS,MAAM,IAAI,OAAO,QAAQ,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;GACxD,SAAS,KAAK;IAAE;IAAM,QAAQ;IAAU,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAAE,CAAC;EACnG;CACF;CAEA,EAAE,MAAM,EAAE;CACV,KAAK,MAAM,KAAK,UAAU;EACxB,MAAM,OAAO,SAAS,EAAE,KAAK,MAAM,MAAM,EAAE;EAC3C,IAAI,EAAE,WAAW,UAAU,EAAE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAE,GAAG,KAAK,IAAI,SAAS,EAAE,OAAQ,GAAG,EAAE,gBAAgB,MAAM,EAAE;OACzG,IAAI,EAAE,WAAW,aAAa,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,WAAY,KAAK,KAAK,EAAE,WAAY,MAAM,MAAM,OAAO;OAC9H,IAAI,EAAE,WAAW,cAAc;GAClC,MAAM,IAAI,EAAE;GACZ,EAAE,MAAM,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,KAAK,kBAAkB,EAAE,SAAS,EAAE,eAAe,KAAK,SAAS,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,EAAE,MAAM,MAAM,0BAA0B,MAAM,EAAE;GAC3L,EAAE,MAAM,OAAO,cAAc,CAAC,EAAE,+BAA+B;EACjE,OACK;GACH,EAAE,MAAM,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,KAAK,MAAM,EAAE,WAAY,KAAK,mDAAmD;GAC9G,EAAE,MAAM,OAAO,GAAG,KAAK,EAAE,YAAa,GAAG;GACzC,EAAE,MAAM,OAAO,cAAc,EAAE,UAAW,GAAG;EAC/C;CACF;CACA,MAAM,SAAS,SAAS,QAAQ,MAAM,EAAE,WAAW,QAAQ,CAAC,CAAC;CAS7D,OAAO,WAAW,MAAM,KAAK,QAAQ,KAAK,CAPxC,GAAG,QAAQ,QAAQ,MAAM,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,OAAO;EAAE,OAAO,EAAE;EAAO,YAAY,EAAE;CAAW,EAAE,GACvG,GAAG,SAAS,QAAQ,MAAM,EAAE,WAAW,WAAW,CAAC,CAAC,KAAK,OAAO;EAAE,OAAO,EAAE,KAAK;EAAO,YAAY,EAAE;CAAY,EAAE,CAMrE,GAAG,CAHjD,GAAG,QAAQ,QAAQ,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,MAAM,IAAI,GACtE,GAAG,SAAS,QAAQ,MAAM,EAAE,WAAW,eAAe,EAAE,WAAW,YAAY,CAAC,CAAC,KAAK,MAAM,EAAE,KAAK,MAAM,IAAI,CAEtD,GAAG,SAAS,IAAI,CAAC;AAC5E;AAEA,eAAe,YAAY,KAAqB,aAA2C;CACzF,IAAI,CAAC,cAAc,WAAW,GAAG,OAAO;EAAE;EAAa,SAAS;EAAM,OAAO;CAAK;CAClF,MAAM,UAAU,YAAY,WAAW;CAEvC,OAAO;EAAE;EAAa;EAAS,QADhB,MAAM,IAAI,OAAO,EAAA,CAAG,MAAM,MAAM,EAAE,OAAO,QAAQ,WAAW,CAAC,EAAE,QAAQ,KAAK;CACtD;AACvC;;;;;;AAOA,eAAe,WACb,MACA,KACA,QACA,KACA,SACA,SACA,MACiB;CACjB,MAAM,IAAI,KAAK;CACf,MAAM,QAAQ,cAAc;CAC5B,IAAI,QAAQ,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,OAAO,QAAQ,WAAW,IAAI,MAAM,GAAG,MAAM,MAAM,SAAS,QAAQ,WAAW,IAAI,aAAa,YAAY,kEAAkE,QAAQ,WAAW,IAAI,OAAO,OAAO,EAAE,CAAC;CAC/Q,IAAI,CAAC,QAAQ,QAAQ,OAAO;CAC5B,IAAI,CAAC,IAAI,SAAS;EAChB,EAAE,MACA,cAAc,QAAQ,KAAK,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,MAAM,MAAM,6CAChE,IAAI,4BAA4B,OAAO,6BAC/C;EACA,OAAO;CACT;CACA,IAAI,CAAC,IAAI,OAAO;EACd,EAAE,MACA,GAAG,OACD,sBAAsB,IAAI,YAAY,aAAa,SAAS,IAAI,QAAQ,SAAS,EAAE,EAAE,oDAAoD,MAAM,4DACjF,MAAM,2BAA2B,IAAI,4BAA4B,OAAO,uCACxI,CACF;EACA,OAAO;CACT;CACA,MAAM,YAAY,SAAS,IAAI,MAAM,MAAM,EAAE;CAC7C,MAAM,SAAwB,CAAC;CAC/B,KAAK,MAAM,KAAK,SAAS;EACvB,IAAI,EAAE,MAAM,aAAa;GAEvB,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,MAAM,KAAK,aAAa,EAAE,MAAM,KAAK,gFAAgF,CAAC;GAC7I;EACF;EACA,MAAM,SAAS,MAAM,IAAI,OAAO,EAAE,WAAW,EAAE;EAC/C,IAAI,OAAO,MAAM,MAAM,EAAE,YAAY,IAAI,MAAO,EAAE,GAAG;GACnD,OAAO,KAAK,EAAE,KAAK;GACnB;EACF;EACA,IAAI,MAAM,EAAE,QAAQ,GAAG,UAAU,cAAc,MAAM,2BAA2B,EAAE,WAAW,KAAK,aAAa,YAAY,EAAE,WAAW,YAAY,EAAE,IAAI,IAAI,GAAG;GAC/J,MAAM,IAAI,UAAU,EAAE,WAAW,IAAI,CAAC,GAAG,OAAO,KAAK,OAAO;IAAE,SAAS,EAAE;IAAS,OAAO,EAAE;GAAM,EAAE,GAAG;IAAE,SAAS,IAAI,MAAM;IAAI,OAAO,EAAE,WAAW;GAAa,CAAC,CAAC;GAClK,OAAO,KAAK,EAAE,KAAK;EACrB,OAAO,EAAE,MAAM,GAAG,IAAI,MAAM,EAAE,MAAM,KAAK,aAAa,MAAM,4BAA4B,EAAE,WAAW,KAAK,GAAG,CAAC;CAChH;CACA,IAAI,CAAC,OAAO,QAAQ,OAAO;CAC3B,EAAE,MAAM,EAAE;CACV,MAAM,WAAW,WAAW,OAAO,KAAK,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,MAAM,MAAM,+CAA+C,OAAO;CAC1I,MAAM,SAAS,eAAe,QAAQ,cAAc,IAAI,WAAW,GAAG,KAAK,GAAG;CAC9E,IAAI;CACJ,IAAI,OAAO,QAAQ;EACjB,MAAM,QAAQ,QAAQ,QAAQ,MAAM,OAAO,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,WAAW,IAAI;EAC1F,EAAE,MAAM,GAAG,OAAO,SAAS,MAAM,8CAA8C,CAAC;EAChF,KAAK,MAAM,KAAK,QAAQ,EAAE,MAAM,KAAK,SAAS,GAAG,GAAG,GAAG;EACvD,EAAE,MACA,GAAG,OACD,8CAA8C,MAAM,KAAK,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,8BAA8B,OAAO,WAAW,IAAI,OAAO,OAAO,yHAClD,UAAU,kFAChH,CACF;EACA,KAAK,MAAM,EAAE,gBAAgB,UAAU,GAAG,MAAM,+CAA+C;CACjG,OAAO,KAAK,MAAM,EAAE,QAAQ,UAAU,IAAI;CAC1C,IAAI,CAAC,IAAI;EACP,EAAE,MAAM,GAAG,MAAM,mEAAmE;EACpF,OAAO;CACT;CACA,MAAM,IAAI,SAAS,QAAQ,UAAU,IAAI,aAAa,IAAI,OAAO,GAAG,YAAY,IAAI,WAAW,GAAG,EAAE,eAAe,OAAO,IAAI,QAAQ,EAAE,CAAC;CACzI,KAAK,MAAM,KAAK,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC;CACxC,MAAM,OAAO,CAAC,GAAG,IAAI,IAAI,OAAO,SAAS,OAAQ,EAAE,WAAW,CAAC,EAAA,CAAG,SAAS,EAAE,IAAI,IAAI,EAAE,aAAa,CAAC,CAAE,CAAC,CAAC;CACzG,IAAI,EAAE,MAAM,KAAK,QACf,EAAE,MAAM,GAAG,IAAI,KAAK,KAAK,KAAK,IAAI,EAAE,GAAG,KAAK,WAAW,IAAI,OAAO,MAAM,mDAAmD,KAAK,WAAW,IAAI,OAAO,OAAO,wBAAwB,WAAW,WAAW,sBAAsB,GAAG,oCAAoC,CAAC;CAE3Q,OAAO,EAAE,KAAK,OAAO;AACvB"}

package/dist/{manage-Bo6COB4p.js → manage-BlGiqPRV.js}

@@ -442,7 +442,6 @@ async function listConnections(deps) {
 		if (c.privateTarget) notes.push("private network");
 		const d = c.expiresInDays;
 		if (d !== null && d <= 7) notes.push(d <= 0 ? "expires today: Reconnect" : `expires in ${d} day${d === 1 ? "" : "s"}`);
-		if (c.tools.held) notes.push(`${c.tools.held} held`);
 		if (c.status === "needs_reauth") notes.push("Reconnect");
 		p.print(`${c.slug.padEnd(w)}  ${status}  ${accessLabel(c.levelDefault).padEnd(24)}  ${String(c.tools.total).padEnd(5)}  ${safeText(c.url ?? c.kind, 80)}${notes.length ? pc.yellow(`  (${notes.join(", ")})`) : ""}`);
 	}
@@ -474,4 +473,4 @@ async function removeConnection(slug, deps) {
 //#endregion
 export { chooseAccess as _, isWorking as a, removeConnection as c, waitWorking as d, reconnectHint as f, agentsLabel as g, accessLabel as h, disableConnection as i, renderStep as l, checkTarget as m, authorize as n, listConnections as o, slugify as p, connectNow as r, reconnectConnection as s, addConnection as t, slugFromUrl as u, chooseAgents as v, parseAccess as y };
 
-//# sourceMappingURL=manage-Bo6COB4p.js.map
+//# sourceMappingURL=manage-BlGiqPRV.js.map