@interlok/cli 0.0.0-stage → 1.3.1

package/dist/index.js

@@ -0,0 +1,241 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { appendFile, writeFile } from "node:fs/promises";
+import { scan } from "./scan.js";
+import { verifyFile } from "./verify.js";
+import { verifyProofBundle } from "./proof-verify.js";
+import { readFile } from "node:fs/promises";
+import { coverageOf, enumerate, findInventory, scanVerdict, unlistedServers } from "./inventory.js";
+import { coverageLine } from "./classify.js";
+import { gateCommand } from "./gate.js";
+import { proxyCommand } from "./proxy.js";
+import { approvalsMcpCommand } from "./approvals-mcp.js";
+import { hookCommand } from "./hook.js";
+const [command, ...args] = process.argv.slice(2);
+/** `--name value` or `--name=value`. */
+const value = (name) => {
+    const eq = args.find((a) => a.startsWith(`${name}=`));
+    if (eq)
+        return eq.slice(name.length + 1);
+    const i = args.indexOf(name);
+    return i >= 0 && !args[i + 1]?.startsWith("--") ? args[i + 1] : undefined;
+};
+const has = (name) => args.includes(name) || args.some((a) => a.startsWith(`${name}=`));
+const api = (process.env.INTERLOK_URL ??
+    process.env.INTERLOK_API_URL ??
+    value("--url") ??
+    "https://interlok.io").replace(/\/$/, "");
+const key = process.env.INTERLOK_API_KEY ?? value("--api-key");
+const headers = () => ({ authorization: `Bearer ${key}`, "content-type": "application/json" });
+const gh = process.env;
+/** Exit codes: 1 usage or error · 2 critical finding · 3 verification failed · 4 a --fail-on tripped · 5 coverage below --min-coverage. */
+async function main() {
+    if (command === "scan") {
+        const target = args.find((a, i) => !a.startsWith("-") &&
+            !["--url", "--api-key", "--format", "--min-coverage"].includes(args[i - 1])) ?? ".";
+        const findings = await scan(target);
+        const found = await findInventory(target);
+        const files = found.files;
+        let inventory = found.inventory;
+        if (has("--enumerate"))
+            inventory = await enumerate(inventory);
+        const coverage = coverageOf(inventory);
+        const verdict = scanVerdict(coverage, inventory, coverageLine(coverage, "guarded"), {
+            filesFound: files.length > 0,
+            enumerated: has("--enumerate"),
+        });
+        if (value("--format") === "cef" || has("--format=cef")) {
+            findings.forEach((f) => console.log(`CEF:0|Interlok|CLI|1|${f.code}|${f.message}|${f.severity === "critical" ? 10 : 6}|file=${f.file}`));
+        }
+        else {
+            console.log(JSON.stringify({
+                target,
+                inventory_files: files,
+                servers: inventory.servers.length,
+                servers_without_tools: unlistedServers(inventory),
+                coverage,
+                findings,
+                critical: findings.filter((f) => f.severity === "critical").length,
+            }, null, 2));
+        }
+        console.error(`coverage  ${verdict.text}`);
+        if (has("--publish")) {
+            if (!api || !key)
+                throw new Error("--publish needs INTERLOK_URL and INTERLOK_API_KEY");
+            const s = await fetch(`${api}/api/v1/posture/scan`, {
+                method: "POST",
+                headers: headers(),
+                body: JSON.stringify({ input: inventory, source: has("--ci") ? "ci" : "cli", sync: true }),
+            });
+            if (!s.ok)
+                throw new Error(`scan upload failed (${s.status})`);
+            const { scan_id } = (await s.json());
+            const p = await fetch(`${api}/api/v1/public-reports`, {
+                method: "POST",
+                headers: headers(),
+                body: JSON.stringify({ kind: "posture", scan_id }),
+            });
+            if (!p.ok)
+                throw new Error(`publish failed (${p.status})`);
+            const pub = (await p.json());
+            console.error(`published ${pub.url}\nbadge     ${pub.markdown}`);
+        }
+        if (has("--ci") && findings.some((f) => f.severity === "critical"))
+            process.exitCode = 2;
+        const min = value("--min-coverage");
+        if (min !== undefined) {
+            const pct = coverage.rungs.guarded?.pct ?? null;
+            // A CI gate must not pass on servers it could not see.
+            if (!verdict.measurable && inventory.servers.length) {
+                console.error(`coverage cannot be measured: ${verdict.text}`);
+                process.exitCode = 5;
+            }
+            else if (pct !== null && pct < Number(min)) {
+                console.error(`coverage ${pct}% is below --min-coverage ${min}`);
+                process.exitCode = 5;
+            }
+        }
+        return;
+    }
+    if (command === "verify") {
+        const path = args.find((a, i) => !a.startsWith("-") && !["--anchors-url", "--keys-url"].includes(args[i - 1]));
+        if (!path)
+            throw new Error("usage: interlok verify <report.json | bundle.ilproof>");
+        const raw = new Uint8Array(await readFile(path));
+        if (raw[0] === 0x50 && raw[1] === 0x4b) {
+            // A .ilproof bundle: the same seven checks the browser page runs.
+            const anchorsUrl = value("--anchors-url");
+            const keysUrl = value("--keys-url");
+            const publicAnchors = anchorsUrl
+                ? ((await (await fetch(anchorsUrl)).json()).anchors ?? null)
+                : null;
+            const kj = keysUrl ? await (await fetch(keysUrl)).json() : null;
+            const publishedKids = kj
+                ? (Array.isArray(kj) ? kj : (kj.keys ?? [])).map((k) => typeof k === "string" ? k : k.kid)
+                : null;
+            const r = await verifyProofBundle(raw, { publicAnchors, publishedKids });
+            console.log(`${r.ok ? "verified" : "verification failed"}: ${r.record_count} records · bundle ${r.bundle_id ?? "?"}`);
+            for (const c of r.checks) {
+                console.log(`  ${c.status === "pass" ? "✓" : c.status === "fail" ? "✗" : "–"} ${c.id}. ${c.name}: ${c.detail}`);
+                for (const p of c.records)
+                    console.log(`      ${p.seq !== null ? `#${p.seq} ` : ""}${p.problem}`);
+            }
+            if (!r.ok)
+                process.exitCode = 3;
+            return;
+        }
+        const result = await verifyFile(path);
+        console.log(result.ok
+            ? `verified ${result.checked} signed entr${result.checked === 1 ? "y" : "ies"} offline${result.detail ? `; ${result.detail}` : ""}`
+            : `verification failed at #${result.seq}: ${result.reason}`);
+        if (!result.ok)
+            process.exitCode = 3;
+        return;
+    }
+    if (command === "shadow") {
+        if (!key)
+            throw new Error("INTERLOK_API_KEY is required (INTERLOK_URL defaults to https://interlok.io)");
+        const sep = args.indexOf("--");
+        const childArgs = sep >= 0 ? args.slice(sep + 1) : [];
+        // In GitHub Actions these come from the environment: the commit, the branch it was built from,
+        // and, on a pull request, the branch it will merge into, which is what it is compared with.
+        const safe = (v) => (v ? v.replace(/[^\w./@+-]+/g, "_").slice(0, 200) : undefined);
+        const git_ref = safe(value("--git-ref") ?? gh.GITHUB_SHA);
+        const git_branch = safe(value("--branch") ?? (gh.GITHUB_HEAD_REF || gh.GITHUB_REF_NAME || undefined));
+        const baseline = safe(value("--baseline") ?? (gh.GITHUB_BASE_REF || undefined));
+        const start = await fetch(`${api}/api/v1/shadow/runs`, {
+            method: "POST",
+            headers: headers(),
+            body: JSON.stringify({
+                agent_name: value("--agent") ?? "cli-agent",
+                name: value("--name") ??
+                    (git_branch
+                        ? `${git_branch}${git_ref ? ` @ ${git_ref.slice(0, 7)}` : ""}`
+                        : "CLI shadow run"),
+                scope: [],
+                git_ref,
+                git_branch,
+                baseline,
+            }),
+        });
+        if (!start.ok)
+            throw new Error(`shadow start failed (${start.status})`);
+        const run = (await start.json());
+        let exit = 0;
+        if (childArgs.length)
+            exit = await new Promise((resolve, reject) => {
+                const p = spawn(childArgs[0], childArgs.slice(1), {
+                    stdio: "inherit",
+                    env: {
+                        ...process.env,
+                        INTERLOK_SHADOW_RUN: run.id,
+                        INTERLOK_API_URL: api,
+                        INTERLOK_API_KEY: key,
+                    },
+                });
+                p.on("error", reject);
+                p.on("exit", (c) => resolve(c ?? 1));
+            });
+        const done = await fetch(`${api}/api/v1/shadow/runs/${run.id}/finish`, {
+            method: "POST",
+            headers: headers(),
+        });
+        if (!done.ok)
+            throw new Error(`shadow finish failed (${done.status})`);
+        const reportRes = await fetch(`${api}/api/v1/shadow/runs/${run.id}/report`, {
+            headers: headers(),
+        });
+        if (!reportRes.ok)
+            throw new Error(`shadow report failed (${reportRes.status})`);
+        const report = (await reportRes.json());
+        const out = value("--out") ?? `interlok-shadow-${run.id}.json`;
+        await writeFile(out, JSON.stringify(report, null, 2));
+        console.log(`shadow ${run.id}: ${report.run.verdict} · signed report ${out}`);
+        if (report.markdown) {
+            const md = value("--markdown");
+            if (md)
+                await writeFile(md, report.markdown + "\n");
+            // Shows on the Actions run page with no token and no GitHub App.
+            if (gh.GITHUB_STEP_SUMMARY)
+                await appendFile(gh.GITHUB_STEP_SUMMARY, report.markdown + "\n");
+        }
+        // --fail-on would_hold,new_high_reach,coverage_drop (comma-separated; the old --fail-on=would_hold still works)
+        const failOn = (value("--fail-on") ?? "")
+            .split(",")
+            .map((s) => s.trim())
+            .filter(Boolean);
+        const tripped = [];
+        if (failOn.includes("would_hold") && report.events.some((e) => e.would_effect !== "allow"))
+            tripped.push("would_hold");
+        const d = report.diff;
+        if (failOn.includes("new_high_reach") &&
+            d &&
+            (d.new_high_risk_paths.length > 0 || d.reach_up.some((r) => r.to === "R2" || r.to === "R3")))
+            tripped.push("new_high_reach");
+        if (failOn.includes("coverage_drop") &&
+            d?.coverage_delta.governed &&
+            (d.coverage_delta.governed.to ?? 0) < (d.coverage_delta.governed.from ?? 0))
+            tripped.push("coverage_drop");
+        if (tripped.length) {
+            console.error(`failing on: ${tripped.join(", ")}`);
+            process.exitCode = 4;
+        }
+        else
+            process.exitCode = exit;
+        return;
+    }
+    if (command === "gate")
+        return gateCommand(args, value, has);
+    if (command === "proxy")
+        return proxyCommand(args, value, has);
+    if (command === "approvals-mcp")
+        return approvalsMcpCommand(value);
+    if (command === "hook")
+        return hookCommand(args, value, has);
+    console.error("usage: interlok <scan|shadow|proxy|gate|verify|approvals-mcp|hook>");
+    process.exitCode = 1;
+}
+main().catch((e) => {
+    console.error(e.message);
+    process.exitCode = 1;
+});

package/dist/inventory.d.ts

@@ -0,0 +1,53 @@
+import { type Coverage, type ToolAnnotations } from "./classify.js";
+/**
+ * Coverage for `interlok scan`. Reads MCP client configs (Claude, Cursor, VS Code, .mcp.json) or an
+ * inventory JSON, and grades every listed tool with the same classifier the console uses. With
+ * --enumerate it starts each server and asks it for its tools; otherwise it only reads files, and
+ * nothing leaves the machine unless --publish is passed.
+ */
+export interface InvTool {
+    name: string;
+    description?: string;
+    input_schema?: unknown;
+    annotations?: ToolAnnotations;
+    gated?: boolean;
+    write_path?: boolean;
+}
+export interface InvServer {
+    name: string;
+    command?: string;
+    args?: string[];
+    url?: string;
+    transport?: string;
+    auth?: string;
+    registered?: boolean;
+    tools?: InvTool[];
+    error?: string;
+}
+export interface Inventory {
+    servers: InvServer[];
+    [k: string]: unknown;
+}
+export declare function findInventory(target: string): Promise<{
+    files: string[];
+    inventory: Inventory;
+}>;
+/** The same normalisation the console uses: an inventory passes through; a client config is mapped. */
+export declare function toInventory(raw: any): Inventory;
+/** Servers whose tools are not listed in the inventory, so coverage cannot see them. */
+export declare function unlistedServers(inv: Inventory): string[];
+/**
+ * The one-line verdict printed after a scan. "No high-risk write paths" is only said when every
+ * server's tools were actually seen; a config that names servers without listing their tools gets
+ * told to enumerate instead of being told it is safe.
+ */
+export declare function scanVerdict(coverage: Coverage, inv: Inventory, line: string, opts: {
+    filesFound: boolean;
+    enumerated: boolean;
+}): {
+    text: string;
+    measurable: boolean;
+};
+export declare function coverageOf(inv: Inventory): Coverage;
+/** Start each server (or call it over HTTP) and list its tools. Opt-in: this runs the configured commands. */
+export declare function enumerate(inv: Inventory, timeoutMs?: number): Promise<Inventory>;

package/dist/inventory.js

@@ -0,0 +1,210 @@
+import { readFile } from "node:fs/promises";
+import { existsSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { spawn } from "node:child_process";
+import { classifyTool, computeCoverage } from "./classify.js";
+const CONFIG_FILES = [
+    ".mcp.json",
+    ".vscode/mcp.json",
+    ".cursor/mcp.json",
+    "interlok-inventory.json",
+];
+export async function findInventory(target) {
+    const files = !existsSync(target)
+        ? []
+        : statSync(target).isDirectory()
+            ? CONFIG_FILES.map((f) => join(target, f)).filter((f) => existsSync(f))
+            : [target];
+    const servers = [];
+    const used = [];
+    for (const f of files) {
+        let raw;
+        try {
+            raw = JSON.parse(await readFile(f, "utf8"));
+        }
+        catch {
+            continue;
+        }
+        const inv = toInventory(raw);
+        if (inv.servers.length) {
+            used.push(f);
+            servers.push(...inv.servers);
+        }
+    }
+    return { files: used, inventory: { servers } };
+}
+/** The same normalisation the console uses: an inventory passes through; a client config is mapped. */
+export function toInventory(raw) {
+    if (Array.isArray(raw?.servers) && raw.servers.some((s) => s?.name))
+        return raw;
+    const map = raw?.mcpServers ?? raw?.servers ?? raw?.mcp?.servers ?? {};
+    return {
+        servers: Object.entries(map).map(([name, v]) => ({
+            name,
+            ...(v?.url
+                ? { url: v.url, transport: v?.type === "sse" ? "sse" : "streamable-http" }
+                : { transport: "stdio" }),
+            ...(v?.command ? { command: v.command, args: v.args ?? [] } : {}),
+            registered: false,
+            auth: v?.headers?.authorization || v?.headers?.Authorization || v?.env?.API_KEY || v?.env?.TOKEN
+                ? "token"
+                : "none",
+            ...(Array.isArray(v?.tools) ? { tools: v.tools } : {}),
+        })),
+    };
+}
+/** Servers whose tools are not listed in the inventory, so coverage cannot see them. */
+export function unlistedServers(inv) {
+    return inv.servers.filter((s) => !s.tools?.length).map((s) => s.name);
+}
+/**
+ * The one-line verdict printed after a scan. "No high-risk write paths" is only said when every
+ * server's tools were actually seen; a config that names servers without listing their tools gets
+ * told to enumerate instead of being told it is safe.
+ */
+export function scanVerdict(coverage, inv, line, opts) {
+    if (!opts.filesFound)
+        return {
+            text: "no MCP config or inventory found; pass a file, or --enumerate to list tools",
+            measurable: false,
+        };
+    const unlisted = unlistedServers(inv);
+    const n = inv.servers.length;
+    if (!unlisted.length)
+        return { text: line, measurable: true };
+    const names = unlisted.slice(0, 5).join(", ") + (unlisted.length > 5 ? ", …" : "");
+    const hint = opts.enumerated
+        ? "they did not answer when started; check their commands and credentials"
+        : "run with --enumerate to start them and check their tools";
+    if (unlisted.length === n)
+        return {
+            text: `${n} server${n === 1 ? "" : "s"} found (${names}), tools not listed: ${hint}`,
+            measurable: false,
+        };
+    return {
+        text: `${line} · ${unlisted.length} of ${n} servers not checked (${names}): ${hint}`,
+        measurable: coverage.high_risk_write_paths > 0,
+    };
+}
+export function coverageOf(inv) {
+    const items = [];
+    for (const s of inv.servers)
+        for (const t of s.tools ?? [])
+            items.push({
+                key: `${s.name}/${t.name}`,
+                profile: classifyTool({
+                    name: t.name,
+                    description: t.description,
+                    input_schema: t.input_schema,
+                    annotations: t.annotations,
+                    write_path: t.write_path,
+                }),
+                guarded: !!t.gated,
+            });
+    return computeCoverage(items);
+}
+const INIT = {
+    jsonrpc: "2.0",
+    id: 1,
+    method: "initialize",
+    params: {
+        protocolVersion: "2025-06-18",
+        capabilities: {},
+        clientInfo: { name: "interlok-cli", version: "1.1.0" },
+    },
+};
+const LIST = { jsonrpc: "2.0", id: 2, method: "tools/list", params: {} };
+const toTool = (t) => ({
+    name: t.name,
+    description: t.description,
+    input_schema: t.inputSchema,
+    ...(t.annotations ? { annotations: t.annotations } : {}),
+});
+/** Start each server (or call it over HTTP) and list its tools. Opt-in: this runs the configured commands. */
+export async function enumerate(inv, timeoutMs = 15_000) {
+    const servers = [];
+    for (const s of inv.servers) {
+        if (s.tools?.length) {
+            servers.push(s);
+            continue;
+        }
+        try {
+            servers.push({
+                ...s,
+                tools: s.url ? await overHttp(s.url, timeoutMs) : await overStdio(s, timeoutMs),
+            });
+        }
+        catch (e) {
+            servers.push({ ...s, error: e?.message ?? String(e) });
+        }
+    }
+    return { ...inv, servers };
+}
+function overStdio(s, timeoutMs) {
+    if (!s.command)
+        return Promise.reject(new Error("no command to start"));
+    const child = spawn(s.command, s.args ?? [], {
+        stdio: ["pipe", "pipe", "pipe"],
+        env: { ...process.env, MCP_SCAN: "1" },
+    });
+    return new Promise((resolve, reject) => {
+        let buf = "";
+        const done = (fn) => {
+            clearTimeout(timer);
+            child.kill("SIGTERM");
+            fn();
+        };
+        const timer = setTimeout(() => done(() => reject(new Error(`timed out after ${timeoutMs}ms`))), timeoutMs);
+        child.on("error", (e) => done(() => reject(e)));
+        child.stdout.on("data", (chunk) => {
+            buf += chunk.toString();
+            let nl;
+            while ((nl = buf.indexOf("\n")) >= 0) {
+                const line = buf.slice(0, nl).trim();
+                buf = buf.slice(nl + 1);
+                if (!line)
+                    continue;
+                let msg;
+                try {
+                    msg = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (msg.id === 1) {
+                    child.stdin.write(JSON.stringify({ jsonrpc: "2.0", method: "notifications/initialized" }) + "\n");
+                    child.stdin.write(JSON.stringify(LIST) + "\n");
+                }
+                if (msg.id === 2) {
+                    if (msg.error)
+                        return done(() => reject(new Error(msg.error.message ?? "tools/list failed")));
+                    return done(() => resolve((msg.result?.tools ?? []).map(toTool)));
+                }
+            }
+        });
+        child.stdin.write(JSON.stringify(INIT) + "\n");
+    });
+}
+async function overHttp(url, timeoutMs) {
+    const signal = AbortSignal.timeout(timeoutMs);
+    const headers = {
+        "content-type": "application/json",
+        accept: "application/json, text/event-stream",
+    };
+    const init = await fetch(url, { method: "POST", headers, body: JSON.stringify(INIT), signal });
+    const sid = init.headers.get("mcp-session-id");
+    if (sid)
+        headers["mcp-session-id"] = sid;
+    const res = await fetch(url, { method: "POST", headers, body: JSON.stringify(LIST), signal });
+    const text = await res.text();
+    const payload = text.startsWith("event:") || text.startsWith("data:")
+        ? JSON.parse(text
+            .split("\n")
+            .filter((l) => l.startsWith("data:"))
+            .map((l) => l.slice(5).trim())
+            .join(""))
+        : JSON.parse(text);
+    if (payload.error)
+        throw new Error(payload.error.message ?? "tools/list failed");
+    return (payload.result?.tools ?? []).map(toTool);
+}

package/dist/packs.d.ts

@@ -0,0 +1,105 @@
+/**
+ * The change-control-v1 (with its model-change rules) and access-control-v1 packs: deterministic predicates over a normalized
+ * request. A request is held when any rule with `hold: true` fires or its points reach the
+ * threshold (50). Nothing here calls a model or the network, and the same input always yields the
+ * same rules, so a CI run, the console and a test agree.
+ */
+export declare const HOLD_THRESHOLD = 50;
+export interface PackResult {
+    hold: boolean;
+    points: number;
+    fired: Array<{
+        id: string;
+        reason: string;
+        points: number;
+        hold: boolean;
+    }>;
+}
+export interface PlanSummary {
+    add: number;
+    change: number;
+    destroy: number;
+    replace: number;
+    resource_types: string[];
+    /** Resource addresses, used for IAM / network / data-store detection. */
+    addresses?: string[];
+    /** Security-group or firewall rules that open the world. */
+    open_cidrs?: string[];
+}
+/**
+ * A model promotion: what a production AI system will run after this change. Swapping a provider,
+ * a model, its weights, its quantization or its prompt template changes behaviour as surely as a
+ * code deploy, and usually without a diff anyone reads.
+ */
+export declare const MODEL_CHANGE_KINDS: readonly ["model", "provider", "weights", "fine_tune", "quantization", "prompt_template", "decoding", "alias"];
+export type ModelChangeKind = (typeof MODEL_CHANGE_KINDS)[number];
+export interface ModelChange {
+    provider_from?: string | null;
+    provider_to?: string | null;
+    model_from?: string | null;
+    model_to: string;
+    /** sha256 of weights or image, when the platform can state one. */
+    digest_from?: string | null;
+    digest_to?: string | null;
+    changes: ModelChangeKind[];
+    /** The evaluation run gating this promotion, if any. */
+    eval?: {
+        suite?: string | null;
+        passed?: boolean | null;
+        regressions?: number | null;
+    } | null;
+    /** Data classes the model will serve (e.g. cui, phi, pii, credit). */
+    classification?: string[];
+}
+export interface ChangeContext {
+    action: "deploy" | "terraform.apply" | "model.promote" | "pr.merge";
+    environment?: string | null;
+    repo?: string | null;
+    pr_number?: number | null;
+    requester?: string | null;
+    /** Kind of the PR author and every commit author: human | agent | bot. */
+    author_kinds: string[];
+    pr_approved_by_human?: boolean | null;
+    changed_paths?: string[];
+    files_changed?: number | null;
+    migration_globs?: string[];
+    plan?: PlanSummary | null;
+    model?: ModelChange | null;
+    /** Org settings the connector carries. */
+    freeze_active?: boolean;
+    in_change_window?: boolean | null;
+    production_tags?: string[];
+}
+export declare function evaluateChange(c: ChangeContext, overrides?: {
+    agent_author_points?: number | null;
+}): PackResult;
+export interface AccessContext {
+    requester_kind: "human" | "agent" | "service_account";
+    requester_has_owner?: boolean | null;
+    resource_system: string;
+    resource_id: string;
+    sensitivity: "low" | "medium" | "high";
+    role: string;
+    is_production?: boolean | null;
+    duration_requested_s: number;
+    ticket_ref?: string | null;
+    /** Elevations by the same requester on the same resource in the past 7 days. */
+    recent_elevations?: number;
+    hour_local?: number | null;
+    business_hours?: [number, number];
+}
+export declare const MAX_DURATION_S: Record<AccessContext["sensitivity"], number>;
+export declare function evaluateAccess(c: AccessContext): PackResult & {
+    deny: boolean;
+    cap_s: number;
+};
+/** `terraform show -json` → the summary the CLI sends. Runs in CI; the full plan never leaves it. */
+export declare function summarizePlan(plan: any): PlanSummary;
+/** CLI exit codes for the gate step. */
+export declare const EXIT: {
+    readonly ok: 0;
+    readonly rejected: 10;
+    readonly expired: 11;
+    readonly unreachable: 12;
+    readonly config: 13;
+};