@intentic/machine 1.365.0 → 1.367.0

package/dist/device/egress/set-egress.js

@@ -0,0 +1,136 @@
+import { errorMessage } from "@intentic/base/errors";
+import { canonicalEgressPolicy, egressOnlyTightens, EgressStatusSchema, icEgressSetArgs, icEgressShowArgs } from "@intentic/sandbox-contract/schemas/egress";
+import { environmentKeyOf } from "@intentic/sandbox-contract/schemas/hosts";
+import { parseJsonWith } from "@intentic/base/json";
+import { machineId } from "../../machine-id.js";
+import { wslEnvironment } from "../../environments/wsl.js";
+import { audit } from "../audit.js";
+import { assertScope } from "../policy.js";
+import { findIn, fleet, icFlow, runIc } from "../tools/sandboxes.js";
+import { egressPinStore, narrowsOwnerKeys, sameOwnerKeys } from "./pins.js";
+import { EgressRefusal, looseningText, verifyEgressProof } from "./proof.js";
+export const egressStatusFrom = (stdout) => {
+    const line = stdout
+        .split(/\r?\n/)
+        .map((text) => text.trim())
+        .findLast((text) => text.startsWith("{"));
+    return line === undefined ? undefined : parseJsonWith(line, EgressStatusSchema);
+};
+const noPinSentence = (slug, opens) => `${opens[0]?.toUpperCase() ?? ""}${opens.slice(1)}, and this machine has no passkey pinned for "${slug}", so it cannot check that you asked for it. Change it on the machine itself with \`ic sandbox egress ${slug}\`, or add a passkey in Access → Sign-in, save the fence once from the editor (a change that only tightens pins your passkeys here), then make this change again.`;
+const tighten = async (ask, sandbox, seams, onLine) => {
+    await seams.apply(ask.slug, ask.policy, onLine);
+    const said = `Set the egress policy of "${ask.slug}" (${ask.policy.profile}, ${ask.policy.allow.length} exception${ask.policy.allow.length === 1 ? "" : "s"}).`;
+    seams.audit({ tool: "set-egress", ok: true, detail: `${ask.slug}: tightened to ${JSON.stringify(canonicalEgressPolicy(ask.policy))}, via ${ask.via}` });
+    if (ask.ownerKeys === undefined || ask.ownerKeys.keys.length === 0) {
+        return said;
+    }
+    let held;
+    try {
+        held = await seams.pins.read(sandbox);
+    }
+    catch (error) {
+        seams.audit({ tool: "set-egress", ok: false, detail: `${ask.slug}: passkeys not pinned, the pin store is unreadable: ${errorMessage(error)}` });
+        return said;
+    }
+    if (held !== undefined) {
+        return said;
+    }
+    await seams.pins.write({ slug: sandbox.slug, sandboxId: sandbox.sandboxId, owner: ask.ownerKeys, counters: {}, pinnedAt: seams.now(), pinnedBy: ask.via });
+    seams.audit({
+        tool: "set-egress",
+        ok: true,
+        detail: `${ask.slug}: pinned ${ask.ownerKeys.keys.length} passkey(s) for ${ask.ownerKeys.rpId} on first use, handed over by ${ask.via}: ${ask.ownerKeys.keys.map((key) => key.name ?? key.id).join(", ")}`,
+    });
+    return `${said} This machine now trusts your ${ask.ownerKeys.keys.length === 1 ? "passkey" : "passkeys"} for loosening it.`;
+};
+const loosen = async (ask, sandbox, current, seams, onLine) => {
+    const opens = looseningText(ask.slug, current.policy, ask.policy);
+    const pin = await seams.pins.read(sandbox);
+    if (pin === undefined || pin.owner.keys.length === 0) {
+        throw new EgressRefusal(noPinSentence(ask.slug, opens));
+    }
+    if (ask.proof === undefined) {
+        throw new EgressRefusal(`${opens[0]?.toUpperCase() ?? ""}${opens.slice(1)}: sign it with your passkey.`);
+    }
+    const { machineId: id, environment } = await seams.identity();
+    const verified = verifyEgressProof({
+        proof: ask.proof,
+        slug: ask.slug,
+        asked: ask.policy,
+        revision: current.revision,
+        machineId: id,
+        environment,
+        ownerKeys: ask.ownerKeys,
+        pin,
+        now: seams.now(),
+    });
+    const differs = ask.ownerKeys !== undefined && !sameOwnerKeys(ask.ownerKeys, pin.owner);
+    const moves = verified.ownerKeysSigned && differs && ask.ownerKeys !== undefined && narrowsOwnerKeys(ask.ownerKeys, pin.owner);
+    const grew = differs && !moves;
+    const owner = moves && ask.ownerKeys !== undefined ? ask.ownerKeys : pin.owner;
+    const counters = Object.fromEntries(Object.entries(pin.counters).filter(([key]) => owner.keys.some((pinned) => pinned.id === key)));
+    if (owner.keys.some((pinned) => pinned.id === verified.keyId)) {
+        counters[verified.keyId] = verified.counter;
+    }
+    const next = { ...pin, owner, counters };
+    if (moves) {
+        next.replacedAt = seams.now();
+    }
+    await seams.pins.write(next);
+    await seams.apply(ask.slug, ask.policy, onLine);
+    seams.audit({
+        tool: "set-egress",
+        ok: true,
+        detail: `${ask.slug}: loosened from revision ${current.revision} to ${JSON.stringify(canonicalEgressPolicy(ask.policy))}, signed by passkey ${verified.keyId}, via ${ask.via}${moves ? `; pin moved to ${owner.keys.length} passkey(s): ${owner.keys.map((key) => key.name ?? key.id).join(", ")}` : ""}`,
+    });
+    const pinSaid = moves
+        ? " This machine no longer trusts the passkeys you removed."
+        : grew
+            ? ` Passkeys you added since this machine pinned yours are not trusted for "${ask.slug}" here until you run \`intentic-machine egress trust ${ask.slug} --reset\` on this machine and save the fence once from the editor.`
+            : "";
+    return `Set the egress policy of "${ask.slug}" under your passkey: ${opens.replace(/^this change /u, "it ")}.${pinSaid}`;
+};
+export const setEgressWith = async (ask, seams, onLine) => {
+    try {
+        const sandbox = await seams.sandbox(ask.slug);
+        const current = await seams.status(ask.slug);
+        return egressOnlyTightens(current.policy, ask.policy)
+            ? await tighten(ask, sandbox, seams, onLine)
+            : await loosen(ask, sandbox, current, seams, onLine);
+    }
+    catch (error) {
+        seams.audit({ tool: "set-egress", ok: false, detail: `${ask.slug}: ${error instanceof EgressRefusal ? "refused" : "failed"}: ${errorMessage(error)}, via ${ask.via}` });
+        throw error;
+    }
+};
+const status = async (slug) => {
+    const run = await runIc(icEgressShowArgs(slug), () => { });
+    const read = run.code === 0 ? egressStatusFrom(run.output) : undefined;
+    if (read === undefined) {
+        throw new Error(`This machine's ic did not say what egress policy "${slug}" has, so the change was not made. Update the agent on this machine (intentic-machine upgrade), then try again.\n\n${run.output}`);
+    }
+    return read;
+};
+const apply = async (slug, policy, onLine) => {
+    const run = await icFlow(slug, icEgressSetArgs(slug, policy), onLine, { moves: false });
+    if (run.code !== 0) {
+        throw new Error(`ic did not set the egress policy of "${slug}" on this machine.\n\n${run.output}`);
+    }
+};
+const realSetEgressSeams = (pins = egressPinStore()) => ({
+    sandbox: async (slug) => {
+        const row = findIn(await fleet(), slug);
+        return { slug: row.slug, sandboxId: row.sandboxId ?? null };
+    },
+    status,
+    apply,
+    identity: async () => ({ machineId: machineId(), environment: environmentKeyOf({ wsl: await wslEnvironment() }) }),
+    pins,
+    audit: (entry) => void audit(entry),
+    now: Date.now,
+});
+export const setEgress = async (ask, scopes, onLine) => {
+    assertScope(scopes, "sandboxes");
+    return await setEgressWith(ask, realSetEgressSeams(), onLine);
+};
+//# sourceMappingURL=set-egress.js.map

package/dist/device/egress/set-egress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-egress.js","sourceRoot":"","sources":["../../../src/device/egress/set-egress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EACH,qBAAqB,EACrB,kBAAkB,EAKlB,kBAAkB,EAAC,eAAe,EAAC,gBAAgB,EACtD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAuC,cAAc,EAAE,gBAAgB,EAAsB,aAAa,EAAE,MAAM,WAAW,CAAC;AACrI,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA6B7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAc,EAA4B,EAAE;IACzE,MAAM,IAAI,GAAG,MAAM;SACd,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACpF,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,KAAa,EAAU,EAAE,CAC1D,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,iDAAiD,IAAI,yGAAyG,IAAI,mKAAmK,CAAC;AAG3X,MAAM,OAAO,GAAG,KAAK,EAAE,GAAiB,EAAE,OAAsB,EAAE,KAAqB,EAAE,MAA8B,EAAmB,EAAE;IACxI,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,6BAA6B,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAChK,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,kBAAkB,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxJ,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,IAA2B,CAAC;IAChC,IAAI,CAAC;QACD,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAEb,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,uDAAuD,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAChJ,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3J,KAAK,CAAC,KAAK,CAAC;QACR,IAAI,EAAE,YAAY;QAClB,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,mBAAmB,GAAG,CAAC,SAAS,CAAC,IAAI,iCAAiC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAC7M,CAAC,CAAC;IACH,OAAO,GAAG,IAAI,iCAAiC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,oBAAoB,CAAC;AAChI,CAAC,CAAC;AAGF,MAAM,MAAM,GAAG,KAAK,EAChB,GAAiB,EACjB,OAAsB,EACtB,OAAqB,EACrB,KAAqB,EACrB,MAA8B,EACf,EAAE;IACjB,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,aAAa,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,aAAa,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;IAC7G,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAG,iBAAiB,CAAC;QAC/B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,MAAM;QACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,EAAE;QACb,WAAW;QACX,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG;QACH,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;KACnB,CAAC,CAAC;IAIH,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,QAAQ,CAAC,eAAe,IAAI,OAAO,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/H,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,KAAK,CAAC;IAC/B,MAAM,KAAK,GAAG,KAAK,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC/E,MAAM,QAAQ,GAA2B,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5J,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5D,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC;IAChD,CAAC;IACD,MAAM,IAAI,GAAc,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACpD,IAAI,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;IAClC,CAAC;IACD,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,KAAK,CAAC,KAAK,CAAC;QACR,IAAI,EAAE,YAAY;QAClB,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,4BAA4B,OAAO,CAAC,QAAQ,OAAO,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,uBAAuB,QAAQ,CAAC,KAAK,SAAS,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,kBAAkB,KAAK,CAAC,IAAI,CAAC,MAAM,gBAAgB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;KAC5S,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,KAAK;QACjB,CAAC,CAAC,0DAA0D;QAC5D,CAAC,CAAC,IAAI;YACJ,CAAC,CAAC,4EAA4E,GAAG,CAAC,IAAI,wDAAwD,GAAG,CAAC,IAAI,qEAAqE;YAC3N,CAAC,CAAC,EAAE,CAAC;IACX,OAAO,6BAA6B,GAAG,CAAC,IAAI,yBAAyB,KAAK,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;AAC7H,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAiB,EAAE,KAAqB,EAAE,MAA8B,EAAmB,EAAE;IAC7H,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC;YACjD,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;YAC5C,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,KAAK,KAAK,YAAY,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxK,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,MAAM,GAAG,KAAK,EAAE,IAAY,EAAyB,EAAE;IACzD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACX,qDAAqD,IAAI,sHAAsH,GAAG,CAAC,MAAM,EAAE,CAC9L,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,KAAK,EAAE,IAAY,EAAE,MAAoB,EAAE,MAA8B,EAAiB,EAAE;IACtG,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,yBAAyB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACvG,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,IAAI,GAAmB,cAAc,EAAE,EAAkB,EAAE,CAAC,CAAC;IACrF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;IAChE,CAAC;IACD,MAAM;IACN,KAAK;IAEL,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,gBAAgB,CAAC,EAAE,GAAG,EAAE,MAAM,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC;IAClH,IAAI;IACJ,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC;IACnC,GAAG,EAAE,IAAI,CAAC,GAAG;CAChB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAiB,EAAE,MAAoB,EAAE,MAA8B,EAAmB,EAAE;IACxH,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACjC,OAAO,MAAM,aAAa,CAAC,GAAG,EAAE,kBAAkB,EAAE,EAAE,MAAM,CAAC,CAAC;AAClE,CAAC,CAAC"}

package/dist/device/egress/trust-command.d.ts

@@ -0,0 +1,3 @@
+import { type CommandContext } from "@stricli/core";
+export declare const egressRoutes: import("@stricli/core").RouteMap<CommandContext>;
+//# sourceMappingURL=trust-command.d.ts.map

package/dist/device/egress/trust-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-command.d.ts","sourceRoot":"","sources":["../../../src/device/egress/trust-command.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAqDnE,eAAO,MAAM,YAAY,kDAGvB,CAAC"}

package/dist/device/egress/trust-command.js

@@ -0,0 +1,45 @@
+import { buildRouteMap } from "@stricli/core";
+import { buildCommand, machineUi } from "../../cli-ui.js";
+import { egressPinStore, egressPinsPath } from "./pins.js";
+const when = (ms) => new Date(ms).toISOString();
+const pinFields = (pin) => [
+    ["sandbox", `${pin.slug}${pin.sandboxId === null ? "" : ` (id ${pin.sandboxId})`}`],
+    ["passkeys for", `${pin.owner.rpId}, from ${pin.owner.origins.join(", ")}`],
+    ...pin.owner.keys.map((key) => [key.name ?? "passkey", `${key.id}${pin.counters[key.id] === undefined ? "" : `, counter ${pin.counters[key.id]}`}`]),
+    ["pinned", `${when(pin.pinnedAt)}, handed over by ${pin.pinnedBy}`],
+    ...(pin.replacedAt === undefined ? [] : [["moved to these keys", when(pin.replacedAt)]]),
+];
+const trust = buildCommand({
+    docs: { brief: "Show the passkeys this machine trusts to loosen a sandbox's egress fence, or forget them (--reset)" },
+    parameters: {
+        positional: { kind: "tuple", parameters: [{ brief: "The sandbox, as `intentic-machine sandbox list` names it", parse: String, placeholder: "slug" }] },
+        flags: { reset: { kind: "boolean", brief: "Forget the pinned passkeys; the next change from the editor that carries them pins them again", default: false } },
+    },
+    async func(flags, slug) {
+        const ui = machineUi(this.process);
+        const store = egressPinStore();
+        if (flags.reset) {
+            ui.act(`Forgetting the passkeys pinned for ${slug}`);
+            const dropped = await store.reset(slug);
+            ui.done(dropped === 0 ? `No passkeys were pinned for ${slug}.` : `Forgot the passkeys pinned for ${slug}.`);
+            ui.later([["pin them again", "turn the fence on or save it once from the editor"]]);
+            return;
+        }
+        const pins = await store.list(slug);
+        if (pins.length === 0) {
+            ui.quiet(`No passkeys are pinned for ${slug} on this machine (${egressPinsPath}).`);
+            ui.later([["change its fence here", `ic sandbox egress ${slug}`]]);
+            return;
+        }
+        ui.report(`egress trust: ${slug}`, egressPinsPath);
+        for (const pin of pins) {
+            ui.fields(pinFields(pin));
+        }
+        ui.later([["forget them", `intentic-machine egress trust ${slug} --reset`]]);
+    },
+});
+export const egressRoutes = buildRouteMap({
+    routes: { trust },
+    docs: { brief: "The egress fence's trust on this machine: which passkeys may loosen a sandbox's fence from the editor" },
+});
+//# sourceMappingURL=trust-command.js.map

package/dist/device/egress/trust-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-command.js","sourceRoot":"","sources":["../../../src/device/egress/trust-command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAuB,MAAM,eAAe,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,EAAkB,cAAc,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAU3E,MAAM,IAAI,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AAGhE,MAAM,SAAS,GAAG,CAAC,GAAc,EAAc,EAAE,CAAC;IAC9C,CAAC,SAAS,EAAE,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC;IACnF,CAAC,cAAc,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,UAAU,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IAC3E,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAY,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9J,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,GAAG,CAAC,QAAQ,EAAE,CAAC;IACnE,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAoB,CAAC,CAAC;CAC9G,CAAC;AAEF,MAAM,KAAK,GAAG,YAAY,CAAuB;IAC7C,IAAI,EAAE,EAAE,KAAK,EAAE,oGAAoG,EAAE;IACrH,UAAU,EAAE;QACR,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,0DAA0D,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE;QACtJ,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,+FAA+F,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;KAChK;IACD,KAAK,CAAC,IAAI,CAAuB,KAAiB,EAAE,IAAY;QAC5D,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,EAAE,CAAC,GAAG,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,+BAA+B,IAAI,GAAG,CAAC,CAAC,CAAC,kCAAkC,IAAI,GAAG,CAAC,CAAC;YAC5G,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,EAAE,mDAAmD,CAAC,CAAC,CAAC,CAAC;YACpF,OAAO;QACX,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,EAAE,CAAC,KAAK,CAAC,8BAA8B,IAAI,qBAAqB,cAAc,IAAI,CAAC,CAAC;YACpF,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,uBAAuB,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACnE,OAAO;QACX,CAAC;QACD,EAAE,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;QACnD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACrB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;QACD,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,EAAE,iCAAiC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC;IACtC,MAAM,EAAE,EAAE,KAAK,EAAE;IACjB,IAAI,EAAE,EAAE,KAAK,EAAE,uGAAuG,EAAE;CAC3H,CAAC,CAAC"}

package/dist/device/grant.d.ts

@@ -204,6 +204,7 @@ export declare const tolerantDeviceContract: {
             rollback: "rollback";
             "runner-remove": "runner-remove";
             "runner-up": "runner-up";
+            "set-egress": "set-egress";
             "set-shape": "set-shape";
             sleep: "sleep";
             start: "start";
@@ -223,6 +224,48 @@ export declare const tolerantDeviceContract: {
             nextRestart: "nextRestart";
             now: "now";
         }>>;
+        egress: z.ZodOptional<z.ZodObject<{
+            profile: z.ZodEnum<{
+                "internet-only": "internet-only";
+                open: "open";
+            }>;
+            allow: z.ZodArray<z.ZodObject<{
+                to: z.ZodString;
+                ports: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodInt, z.ZodString]>>>;
+                protocol: z.ZodOptional<z.ZodEnum<{
+                    tcp: "tcp";
+                    udp: "udp";
+                }>>;
+                note: z.ZodOptional<z.ZodString>;
+                from: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+        egressProof: z.ZodOptional<z.ZodObject<{
+            document: z.ZodString;
+            assertion: z.ZodObject<{
+                id: z.ZodString;
+                rawId: z.ZodString;
+                type: z.ZodLiteral<"public-key">;
+                response: z.ZodObject<{
+                    clientDataJSON: z.ZodString;
+                    authenticatorData: z.ZodString;
+                    signature: z.ZodString;
+                    userHandle: z.ZodOptional<z.ZodString>;
+                }, z.core.$strip>;
+                authenticatorAttachment: z.ZodOptional<z.ZodString>;
+                clientExtensionResults: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strip>;
+        }, z.core.$strict>>;
+        egressOwnerKeys: z.ZodOptional<z.ZodObject<{
+            rpId: z.ZodString;
+            origins: z.ZodArray<z.ZodString>;
+            keys: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                alg: z.ZodUnion<readonly [z.ZodLiteral<-7>, z.ZodLiteral<-257>, z.ZodLiteral<-8>]>;
+                jwk: z.ZodRecord<z.ZodString, z.ZodString>;
+                name: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
         resources: z.ZodOptional<z.ZodObject<{
             memoryGib: z.ZodOptional<z.ZodNullable<z.ZodInt>>;
             cpus: z.ZodOptional<z.ZodNullable<z.ZodInt>>;

package/dist/device/grant.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant.d.ts","sourceRoot":"","sources":["../../src/device/grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,iDAAiD,CAAC;AAExG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAyE,CAAC;AACvG,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM1D,MAAM,WAAW,KAAK;IAClB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,eAAO,MAAM,SAAS,UAAW,UAAU,KAAG,KAK5C,CAAC;AAIH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAGlC,CAAC"}
+{"version":3,"file":"grant.d.ts","sourceRoot":"","sources":["../../src/device/grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,iDAAiD,CAAC;AAExG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AASxB,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAyE,CAAC;AACvG,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAM1D,MAAM,WAAW,KAAK;IAClB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,eAAO,MAAM,SAAS,UAAW,UAAU,KAAG,KAK5C,CAAC;AAIH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAGlC,CAAC"}

package/dist/device/router.d.ts

@@ -673,6 +673,7 @@ export declare const createHostRouter: (runtime: HostRuntime) => {
             rollback: "rollback";
             "runner-remove": "runner-remove";
             "runner-up": "runner-up";
+            "set-egress": "set-egress";
             "set-shape": "set-shape";
             sleep: "sleep";
             start: "start";
@@ -692,6 +693,48 @@ export declare const createHostRouter: (runtime: HostRuntime) => {
             nextRestart: "nextRestart";
             now: "now";
         }>>;
+        egress: import("zod").ZodOptional<import("zod").ZodObject<{
+            profile: import("zod").ZodEnum<{
+                "internet-only": "internet-only";
+                open: "open";
+            }>;
+            allow: import("zod").ZodArray<import("zod").ZodObject<{
+                to: import("zod").ZodString;
+                ports: import("zod").ZodOptional<import("zod").ZodArray<import("zod").ZodUnion<readonly [import("zod").ZodInt, import("zod").ZodString]>>>;
+                protocol: import("zod").ZodOptional<import("zod").ZodEnum<{
+                    tcp: "tcp";
+                    udp: "udp";
+                }>>;
+                note: import("zod").ZodOptional<import("zod").ZodString>;
+                from: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strict>>;
+        }, import("zod/v4/core").$strict>>;
+        egressProof: import("zod").ZodOptional<import("zod").ZodObject<{
+            document: import("zod").ZodString;
+            assertion: import("zod").ZodObject<{
+                id: import("zod").ZodString;
+                rawId: import("zod").ZodString;
+                type: import("zod").ZodLiteral<"public-key">;
+                response: import("zod").ZodObject<{
+                    clientDataJSON: import("zod").ZodString;
+                    authenticatorData: import("zod").ZodString;
+                    signature: import("zod").ZodString;
+                    userHandle: import("zod").ZodOptional<import("zod").ZodString>;
+                }, import("zod/v4/core").$strip>;
+                authenticatorAttachment: import("zod").ZodOptional<import("zod").ZodString>;
+                clientExtensionResults: import("zod").ZodOptional<import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodUnknown>>;
+            }, import("zod/v4/core").$strip>;
+        }, import("zod/v4/core").$strict>>;
+        egressOwnerKeys: import("zod").ZodOptional<import("zod").ZodObject<{
+            rpId: import("zod").ZodString;
+            origins: import("zod").ZodArray<import("zod").ZodString>;
+            keys: import("zod").ZodArray<import("zod").ZodObject<{
+                id: import("zod").ZodString;
+                alg: import("zod").ZodUnion<readonly [import("zod").ZodLiteral<-7>, import("zod").ZodLiteral<-257>, import("zod").ZodLiteral<-8>]>;
+                jwk: import("zod").ZodRecord<import("zod").ZodString, import("zod").ZodString>;
+                name: import("zod").ZodOptional<import("zod").ZodString>;
+            }, import("zod/v4/core").$strict>>;
+        }, import("zod/v4/core").$strict>>;
         resources: import("zod").ZodOptional<import("zod").ZodObject<{
             memoryGib: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodInt>>;
             cpus: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodInt>>;

package/dist/device/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/device/router.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAC;AAkDpF,MAAM,WAAW,WAAW;IAExB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;IACnD,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAGxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAE7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACpC;AAmKD,eAAO,MAAM,gBAAgB,YAAa,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmFpD,CAAC"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/device/router.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAC;AAmDpF,MAAM,WAAW,WAAW;IAExB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,YAAY,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,CAAC;IACnD,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAGxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;IAE7C,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACpC;AAoLD,eAAO,MAAM,gBAAgB,YAAa,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmFpD,CAAC"}

package/dist/device/router.js

@@ -2,6 +2,7 @@ import { narrate } from "@intentic/base/async";
 import { errorMessage } from "@intentic/base/errors";
 import { implement, ORPCError } from "@orpc/server";
 import { audit } from "./audit.js";
+import { setEgress } from "./egress/set-egress.js";
 import { readGrant, tolerantDeviceContract } from "./grant.js";
 import { calling } from "./indicator.js";
 import { catchLoopback } from "./loopback-catch.js";
@@ -40,6 +41,12 @@ const FLOWS = {
         }
         return shapeSandbox(slug, shape, when, scopes, onLine);
     },
+    "set-egress": ({ slug, egress, egressProof, egressOwnerKeys }, scopes, via) => (onLine) => {
+        if (egress === undefined) {
+            throw new ORPCError("BAD_REQUEST", { message: "An egress policy is set whole: `egress` is required." });
+        }
+        return setEgress({ slug, policy: egress, proof: egressProof, ownerKeys: egressOwnerKeys, via }, scopes, onLine);
+    },
     "forget-shape": ({ slug }, scopes) => (onLine) => forgetShape(slug, scopes, onLine),
     reshape: ({ slug, resources, later }, scopes) => (onLine) => reshapeSandbox(slug, resources, scopes, onLine, { later }),
     remove: ({ slug }, scopes) => (onLine) => removeSandbox(slug, scopes, onLine),
@@ -49,11 +56,19 @@ const FLOWS = {
     "runner-up": runnerFlowFor,
     "runner-remove": runnerFlowFor,
 };
-const flowFor = (input, scopes) => input.to !== undefined && input.op !== "rollback"
-    ? () => {
-        throw new ORPCError("BAD_REQUEST", { message: `"to" names a version to go back to, which only a rollback takes, not ${input.op}.` });
+const flowFor = (input, scopes, via) => {
+    if (input.to !== undefined && input.op !== "rollback") {
+        return () => {
+            throw new ORPCError("BAD_REQUEST", { message: `"to" names a version to go back to, which only a rollback takes, not ${input.op}.` });
+        };
     }
-    : FLOWS[input.op](input, scopes);
+    if ((input.egress !== undefined || input.egressProof !== undefined || input.egressOwnerKeys !== undefined) && input.op !== "set-egress") {
+        return () => {
+            throw new ORPCError("BAD_REQUEST", { message: `An egress policy, its proof and the owner's passkeys belong to set-egress, not ${input.op}.` });
+        };
+    }
+    return FLOWS[input.op](input, scopes, via);
+};
 const deliverOverLink = async (runtime, delivery) => {
     const asked = `${delivery.remoteDir} ← ${delivery.landing.agentId}${delivery.landing.title === undefined ? "" : ` (${delivery.landing.title})`}, ${delivery.files.length} file(s)`;
     try {
@@ -119,7 +134,7 @@ export const createHostRouter = (runtime) => {
         }),
         ping: os.ping.handler(() => ({ ok: true })),
         mcp: os.mcp.handler(async ({ input }) => await calling.run(runtime, async () => await handleMcpMessage(input, runtime.scopes()))),
-        runSandboxFlow: os.runSandboxFlow.handler(({ input }) => streamFlow(flowFor(input, runtime.scopes()))),
+        runSandboxFlow: os.runSandboxFlow.handler(({ input }) => streamFlow(flowFor(input, runtime.scopes(), runtime.sandboxUrl))),
         runAgentFlow: os.runAgentFlow.handler(({ input }) => streamFlow((onLine) => runAgentOp(input.op, onLine))),
         catchLoopback: os.catchLoopback.handler(({ input, signal }) => catchLoopback(input, signal, (message) => runtime.log(`${runtime.sandboxUrl}: ${message}`))),
         deliverProject: os.deliverProject.handler(async ({ input }) => await deliverOverLink(runtime, input)),

package/dist/device/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/device/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAIrD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EACH,cAAc,EACd,aAAa,EACb,YAAY,EAEZ,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,WAAW,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACH,aAAa,EACb,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,UAAU,EAEV,YAAY,EACZ,WAAW,EACX,eAAe,GAClB,MAAM,sBAAsB,CAAC;AAoB9B,MAAM,UAAU,GAAG,CAAC,GAAwD,EAAkC,EAAE,CAC5G,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,EAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAOrJ,MAAM,aAAa,GACf,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,CAC5E,CAAC,MAAM,EAAE,EAAE,CACP,UAAU,CACN,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EACzC,IAAI,EACJ,SAAS,EACT,IAAI,EACJ;IACI,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;IACnD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;IAC7C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;CACxD,EACD,MAAM,EACN,MAAM,CACT,CAAC;AAIV,MAAM,WAAW,GACb,CAAC,IAAiB,EAAW,EAAE,CAC/B,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAC/B,CAAC,MAAM,EAAE,EAAE,CACP,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAI1D,MAAM,KAAK,GAAqC;IAC5C,KAAK,EACD,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,KAAK,EAAE,MAAM,EAAE,EAAE,CACb,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;IAC1D,IAAI,EACA,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,KAAK,IAAI,EAAE,CACP,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;IAEjD,KAAK,EACD,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,KAAK,IAAI,EAAE,CACP,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC;IAClD,OAAO,EACH,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,KAAK,EAAE,MAAM,EAAE,EAAE,CACb,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;IAC5D,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC;IAE/B,oBAAoB,EAChB,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,CAAC,MAAM,EAAE,EAAE,CACP,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;IACjD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC;IAC7B,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC;IAC/B,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC;IAEjC,WAAW,EACP,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAClC,CAAC,MAAM,EAAE,EAAE;QACP,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE;gBAC/B,OAAO,EAAE,wFAAwF;aACpG,CAAC,CAAC;QACP,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IACL,cAAc,EACV,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,CAAC,MAAM,EAAE,EAAE,CACP,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;IAEzC,OAAO,EACH,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CACvC,CAAC,MAAM,EAAE,EAAE,CACP,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;IAClE,MAAM,EACF,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,CAAC,MAAM,EAAE,EAAE,CACP,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;IAC3C,IAAI,EACA,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,CAAC,MAAM,EAAE,EAAE,CACP,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;IAE7C,SAAS,EACL,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,CAC7C,CAAC,MAAM,EAAE,EAAE,CACP,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC;IAEtE,MAAM,EACF,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,CAC7C,CAAC,MAAM,EAAE,EAAE,CACP,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC;IACnE,WAAW,EAAE,aAAa;IAC1B,eAAe,EAAE,aAAa;CACjC,CAAC;AAIF,MAAM,OAAO,GAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CACvC,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,UAAU;IAC7C,CAAC,CAAC,GAAG,EAAE;QACD,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,wEAAwE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACzI,CAAC;IACH,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAMzC,MAAM,eAAe,GAAG,KAAK,EAAE,OAAoB,EAAE,QAAyB,EAAkC,EAAE;IAC9G,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,SAAS,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC;IACnL,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,GAAG,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,aAAa,MAAM,CAAC,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,CAAC,MAAM,mBAAmB,MAAM,CAAC,SAAS,CAAC,MAAM,8BAA8B,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/P,KAAK,KAAK,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,eAAe,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,KAAK,KAAK,CAAC;YACP,IAAI,EAAE,gBAAgB;YACtB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,KAAK,KAAK,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE;SACzG,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,qBAAqB,KAAK,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvF,MAAM,KAAK,YAAY,eAAe;YAClC,CAAC,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACvD,CAAC,CAAC,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;AACL,CAAC,CAAC;AAOF,MAAM,iBAAiB,GAAG,CAAC,EAAqB,EAAE,OAAoB,EAAE,EAAE,CAAC,CAAC;IACxE,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACjF,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpG,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3F,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9F,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACjF,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1F,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvG,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7F,kBAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChH,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpG,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3F,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1G,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;CAC7G,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAoB,EAAE,EAAE;IACrD,MAAM,EAAE,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAE7C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,MAAM,OAAO,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;IACpF,OAAO,EAAE,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAE5E,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YACjC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;oBAC7B,OAAO,EAAE,gGAAgG;iBAC5G,CAAC,CAAC;YACP,CAAC;YACD,OAAO,MAAM,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC;QAGF,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YAC1C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7C,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,iCAAiC,MAAM,CAAC,KAAK,YAAY,MAAM,CAAC,KAAK,YAAY,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9G,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;oBACtB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC;gBACD,OAAO,CAAC,GAAG,CACP,GAAG,OAAO,CAAC,UAAU,uCAAuC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kFAAkF,CAChK,CAAC;YACN,CAAC;YAGD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC,CAAC;QACF,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAG3C,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAGjI,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAItG,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAI1G,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAC1D,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC,CAAC,CAC9F;QACD,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAIrG,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YACtD,IAAI,CAAC;gBACD,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,IAAI,SAAS,CAAC,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACrH,CAAC;QACL,CAAC,CAAC;QAEF,GAAG,iBAAiB,CAAC,EAAE,EAAE,OAAO,CAAC;QACjC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YACxD,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;gBAChF,IAAI,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;oBAC9E,KAAK,KAAK,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBAChH,CAAC;gBACD,OAAO,MAAM,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,KAAK,KAAK,CAAC;oBACP,IAAI,EAAE,eAAe;oBACrB,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,KAAK,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE;iBACvG,CAAC,CAAC;gBACH,MAAM,IAAI,SAAS,CAAC,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACrH,CAAC;QACL,CAAC,CAAC;KACL,CAAC,CAAC;AACP,CAAC,CAAC"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/device/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAIrD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACtF,OAAO,EACH,cAAc,EACd,aAAa,EACb,YAAY,EAEZ,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,WAAW,GACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACH,aAAa,EACb,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,UAAU,EAEV,YAAY,EACZ,WAAW,EACX,eAAe,GAClB,MAAM,sBAAsB,CAAC;AAoB9B,MAAM,UAAU,GAAG,CAAC,GAAwD,EAAkC,EAAE,CAC5G,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,EAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AAQrJ,MAAM,aAAa,GACf,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,CAC5E,CAAC,MAAM,EAAE,EAAE,CACP,UAAU,CACN,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EACzC,IAAI,EACJ,SAAS,EACT,IAAI,EACJ;IACI,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;IACnD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;IAC7C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;CACxD,EACD,MAAM,EACN,MAAM,CACT,CAAC;AAIV,MAAM,WAAW,GACb,CAAC,IAAiB,EAAW,EAAE,CAC/B,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAC/B,CAAC,MAAM,EAAE,EAAE,CACP,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;AAI1D,MAAM,KAAK,GAAqC;IAC5C,KAAK,EACD,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,KAAK,EAAE,MAAM,EAAE,EAAE,CACb,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;IAC1D,IAAI,EACA,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,KAAK,IAAI,EAAE,CACP,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;IAEjD,KAAK,EACD,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,KAAK,IAAI,EAAE,CACP,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC;IAClD,OAAO,EACH,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,KAAK,EAAE,MAAM,EAAE,EAAE,CACb,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;IAC5D,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC;IAE/B,oBAAoB,EAChB,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,CAAC,MAAM,EAAE,EAAE,CACP,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;IACjD,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC;IAC7B,OAAO,EAAE,WAAW,CAAC,SAAS,CAAC;IAC/B,QAAQ,EAAE,WAAW,CAAC,UAAU,CAAC;IAEjC,WAAW,EACP,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAClC,CAAC,MAAM,EAAE,EAAE;QACP,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE;gBAC/B,OAAO,EAAE,wFAAwF;aACpG,CAAC,CAAC;QACP,CAAC;QACD,OAAO,YAAY,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IAEL,YAAY,EACR,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAChE,CAAC,MAAM,EAAE,EAAE;QACP,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACpH,CAAC;IACL,cAAc,EACV,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,CAAC,MAAM,EAAE,EAAE,CACP,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;IAEzC,OAAO,EACH,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CACvC,CAAC,MAAM,EAAE,EAAE,CACP,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC;IAClE,MAAM,EACF,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,CAAC,MAAM,EAAE,EAAE,CACP,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;IAC3C,IAAI,EACA,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CACrB,CAAC,MAAM,EAAE,EAAE,CACP,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC;IAE7C,SAAS,EACL,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,CAC7C,CAAC,MAAM,EAAE,EAAE,CACP,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC;IAEtE,MAAM,EACF,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,CAC7C,CAAC,MAAM,EAAE,EAAE,CACP,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC;IACnE,WAAW,EAAE,aAAa;IAC1B,eAAe,EAAE,aAAa;CACjC,CAAC;AAIF,MAAM,OAAO,GAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;IAC5C,IAAI,KAAK,CAAC,EAAE,KAAK,SAAS,IAAI,KAAK,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;QACpD,OAAO,GAAG,EAAE;YACR,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,wEAAwE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACzI,CAAC,CAAC;IACN,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,KAAK,YAAY,EAAE,CAAC;QACtI,OAAO,GAAG,EAAE;YACR,MAAM,IAAI,SAAS,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,kFAAkF,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACnJ,CAAC,CAAC;IACN,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC,CAAC;AAMF,MAAM,eAAe,GAAG,KAAK,EAAE,OAAoB,EAAE,QAAyB,EAAkC,EAAE;IAC9G,MAAM,KAAK,GAAG,GAAG,QAAQ,CAAC,SAAS,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,QAAQ,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC;IACnL,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,GAAG,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,aAAa,MAAM,CAAC,MAAM,CAAC,MAAM,YAAY,MAAM,CAAC,OAAO,CAAC,MAAM,mBAAmB,MAAM,CAAC,SAAS,CAAC,MAAM,8BAA8B,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;QAC/P,KAAK,KAAK,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,eAAe,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,KAAK,KAAK,CAAC;YACP,IAAI,EAAE,gBAAgB;YACtB,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,KAAK,KAAK,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE;SACzG,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,qBAAqB,KAAK,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvF,MAAM,KAAK,YAAY,eAAe;YAClC,CAAC,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACvD,CAAC,CAAC,IAAI,SAAS,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;AACL,CAAC,CAAC;AAOF,MAAM,iBAAiB,GAAG,CAAC,EAAqB,EAAE,OAAoB,EAAE,EAAE,CAAC,CAAC;IACxE,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACjF,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpG,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3F,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9F,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACjF,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1F,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvG,iBAAiB,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC7F,kBAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,kBAAkB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChH,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpG,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC3F,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1G,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;CAC7G,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,OAAoB,EAAE,EAAE;IACrD,MAAM,EAAE,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;IAE7C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,MAAM,OAAO,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;IACpF,OAAO,EAAE,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAE5E,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YACjC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;gBAClC,MAAM,IAAI,SAAS,CAAC,WAAW,EAAE;oBAC7B,OAAO,EAAE,gGAAgG;iBAC5G,CAAC,CAAC;YACP,CAAC;YACD,OAAO,MAAM,aAAa,EAAE,CAAC;QACjC,CAAC,CAAC;QAGF,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YAC1C,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC7C,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,iCAAiC,MAAM,CAAC,KAAK,YAAY,MAAM,CAAC,KAAK,YAAY,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9G,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClB,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;oBACtB,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC;gBACD,OAAO,CAAC,GAAG,CACP,GAAG,OAAO,CAAC,UAAU,uCAAuC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kFAAkF,CAChK,CAAC;YACN,CAAC;YAGD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC,CAAC;QACF,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAG3C,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAGjI,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QAI1H,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAI1G,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAC1D,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC,CAAC,CAC9F;QACD,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,MAAM,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAIrG,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YACtD,IAAI,CAAC;gBACD,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,IAAI,SAAS,CAAC,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACrH,CAAC;QACL,CAAC,CAAC;QAEF,GAAG,iBAAiB,CAAC,EAAE,EAAE,OAAO,CAAC;QACjC,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YACxD,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;gBAChF,IAAI,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;oBAC9E,KAAK,KAAK,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBAChH,CAAC;gBACD,OAAO,MAAM,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,KAAK,KAAK,CAAC;oBACP,IAAI,EAAE,eAAe;oBACrB,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,KAAK,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE;iBACvG,CAAC,CAAC;gBACH,MAAM,IAAI,SAAS,CAAC,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACrH,CAAC;QACL,CAAC,CAAC;KACL,CAAC,CAAC;AACP,CAAC,CAAC"}

package/dist/keyring/commands.d.ts

@@ -4,6 +4,10 @@ import { type CommandContext } from "@stricli/core";
 export declare const REMEMBERED_WARNING = "a remembered answer can be collected by any program of yours while it lasts, the agent's commands included";
 export declare const entryItem: (entry: EntryInfo) => Item;
 export declare const keyringCommands: {
+    start: import("@stricli/core").Command<CommandContext>;
+    upgrade: import("@stricli/core").Command<CommandContext>;
+    reset: import("@stricli/core").Command<CommandContext>;
+    uninstall: import("@stricli/core").Command<CommandContext>;
     setup: import("@stricli/core").Command<CommandContext>;
     status: import("@stricli/core").Command<CommandContext>;
     unlock: import("@stricli/core").Command<CommandContext>;
@@ -18,7 +22,5 @@ export declare const keyringCommands: {
     askpass: import("@stricli/core").RouteMap<CommandContext>;
     sync: import("@stricli/core").RouteMap<CommandContext>;
     app: import("@stricli/core").RouteMap<CommandContext>;
-    upgrade: import("@stricli/core").Command<CommandContext>;
-    uninstall: import("@stricli/core").Command<CommandContext>;
 };
 //# sourceMappingURL=commands.d.ts.map

package/dist/keyring/commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/keyring/commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,SAAS,EAA+F,MAAM,mBAAmB,CAAC;AAC5J,OAAO,KAAK,EAAiB,IAAI,EAAM,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAoC,KAAK,cAAc,EAAgB,MAAM,eAAe,CAAC;AAyMpG,eAAO,MAAM,kBAAkB,+GAA+G,CAAC;AAM/I,eAAO,MAAM,SAAS,UAAW,SAAS,KAAG,IAW3C,CAAC;AAgWH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;CAqB3B,CAAC"}
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/keyring/commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,SAAS,EAA+F,MAAM,mBAAmB,CAAC;AAC5J,OAAO,KAAK,EAAiB,IAAI,EAAM,MAAM,uBAAuB,CAAC;AAGrE,OAAO,EAAoC,KAAK,cAAc,EAAgB,MAAM,eAAe,CAAC;AAoMpG,eAAO,MAAM,kBAAkB,+GAA+G,CAAC;AAM/I,eAAO,MAAM,SAAS,UAAW,SAAS,KAAG,IAW3C,CAAC;AAgTH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;CAoB3B,CAAC"}

package/dist/keyring/commands.js

@@ -7,15 +7,13 @@ import { readLinks } from "../device/config.js";
 import { MACHINE_VERSION } from "../version.js";
 import { keyringAnswer } from "./answer.js";
 import { askpassStatus, installAskpass, uninstallAskpass } from "./askpass.js";
+import { json, lifecycleCommands } from "./lifecycle-commands.js";
 import { addPlan, backendConfig, editPatch, editTakesValue, entryName, KeyringCliError, shareTarget, unshareTarget, } from "./flags.js";
 import { readConfirmed, readStdin } from "./secret-input.js";
 import { clock, keyringLine, keyringStatusLine, readAskpassAnswer, readKeyringStatus, supportOf } from "./keyring-status.js";
-import { ensureService, installKeyring, keyringState, uninstallKeyring, upgradeKeyring } from "./service.js";
+import { ensureService, installKeyring, keyringState } from "./service.js";
 import { appCommands } from "./app-commands.js";
-import { uninstallGitHelper } from "./git-helper.js";
-import { uninstallNativeHost } from "./native-host-install.js";
 const pipe = () => ({ address: keyringPaths().address });
-const json = { kind: "boolean", brief: "Print one JSON line, `ok` first (what the desktop app reads)", default: false };
 const NAME = { brief: "The entry's name, as `{{secret:NAME}}` spells it", parse: String, placeholder: "NAME" };
 const prompted = async (ui, read) => {
     ui.suspend();
@@ -332,31 +330,6 @@ const syncStatus = buildCommand({
         });
     },
 });
-const stepLine = (cli) => (step) => {
-    cli.process.stderr.write(`intentic-step ${JSON.stringify({ step })}\n`);
-};
-const upgrade = buildCommand({
-    docs: { brief: "Move the keyring to this agent's release, once the running keyring has asked you" },
-    parameters: { flags: { json } },
-    async func(flags) {
-        await keyringAnswer(this, flags.json, { doing: `Updating the keyring to ${MACHINE_VERSION}`, failed: "The keyring was not updated." }, async (ui) => await upgradeKeyring(MACHINE_VERSION, ui.note, flags.json ? stepLine(this) : undefined), (result, ui) => ui.done(result.upgraded ? `Updated the keyring from ${result.from} to ${result.to}.` : `The keyring is already on ${result.to}. Nothing to do.`));
-    },
-});
-const uninstall = buildCommand({
-    docs: { brief: "Remove the keyring from this computer, keeping its vault" },
-    parameters: { flags: { json } },
-    async func(flags) {
-        await keyringAnswer(this, flags.json, { doing: "Removing the keyring", failed: "The keyring was not removed." }, async (ui) => {
-            await uninstallAskpass();
-            await uninstallGitHelper();
-            await uninstallNativeHost();
-            return { ok: true, ...(await uninstallKeyring(ui.note)) };
-        }, (result, ui) => {
-            ui.note(`The vault stays in ${result.vault}: set Passwords up again and the same recovery key opens it.`);
-            ui.done("Removed the keyring from this computer.");
-        });
-    },
-});
 export const keyringCommands = {
     setup,
     status,
@@ -375,7 +348,6 @@ export const keyringCommands = {
     }),
     sync: buildRouteMap({ routes: { status: syncStatus }, docs: { brief: "The keyring's sync with your other computers" } }),
     app: appCommands,
-    upgrade,
-    uninstall,
+    ...lifecycleCommands,
 };
 //# sourceMappingURL=commands.js.map