@singbox-iac/cli 0.1.6 → 0.1.7

package/dist/cli/commands/apply.js

@@ -1,4 +1,5 @@
 import { applyConfig } from "../../modules/manager/index.js";
+import { applyWithTransaction } from "../../modules/transactions/index.js";
 import { resolveBuilderConfig } from "../command-helpers.js";
 export function registerApplyCommand(program) {
     program
@@ -18,15 +19,26 @@ export function registerApplyCommand(program) {
         if (!stagingPath || !livePath) {
             throw new Error("Unable to resolve staging/live paths. Pass --input/--live-path or provide a builder config.");
         }
-        await applyConfig({
-            stagingPath,
-            livePath,
-            ...(backupPath ? { backupPath } : {}),
-            ...(options.singBoxBin ? { singBoxBinary: options.singBoxBin } : {}),
-            ...(options.reload !== undefined ? { reload: options.reload } : {}),
-            ...(builderConfig?.runtime.reload ? { runtime: builderConfig.runtime.reload } : {}),
-        });
-        process.stdout.write(`Applied config.\nSource: ${stagingPath}\nLive: ${livePath}\n${backupPath ? `Backup: ${backupPath}\n` : ""}`);
+        const transaction = builderConfig
+            ? await applyWithTransaction({
+                config: builderConfig,
+                generatedPath: stagingPath,
+                livePath,
+                backupPath: backupPath ?? builderConfig.output.backupPath,
+                verificationSummary: {},
+                apply: async () => {
+                    await applyConfig({
+                        stagingPath,
+                        livePath,
+                        ...(backupPath ? { backupPath } : {}),
+                        ...(options.singBoxBin ? { singBoxBinary: options.singBoxBin } : {}),
+                        ...(options.reload !== undefined ? { reload: options.reload } : {}),
+                        ...(builderConfig?.runtime.reload ? { runtime: builderConfig.runtime.reload } : {}),
+                    });
+                },
+            })
+            : undefined;
+        process.stdout.write(`Applied config.\nSource: ${stagingPath}\nLive: ${livePath}\n${backupPath ? `Backup: ${backupPath}\n` : ""}${transaction ? `Transaction: ${transaction.txId}\n` : ""}`);
     });
 }
 //# sourceMappingURL=apply.js.map

package/dist/cli/commands/apply.js.map

@@ -1 +1 @@
-{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../../src/cli/commands/apply.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,oBAAoB,EAAE,6BAA6B,CAAC;SAC3D,MAAM,CAAC,oBAAoB,EAAE,2BAA2B,CAAC;SACzD,MAAM,CAAC,sBAAsB,EAAE,6BAA6B,CAAC;SAC7D,MAAM,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,UAAU,EAAE,+BAA+B,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,OAA4B,EAAE,EAAE;QAC7C,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC;QACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC;QACpE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC;QAE1E,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,CAAC;YAChB,WAAW;YACX,QAAQ;YACR,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF,CAAC,CAAC;QAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4BAA4B,WAAW,WAAW,QAAQ,KACxD,UAAU,CAAC,CAAC,CAAC,WAAW,UAAU,IAAI,CAAC,CAAC,CAAC,EAC3C,EAAE,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../../src/cli/commands/apply.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,oBAAoB,EAAE,6BAA6B,CAAC;SAC3D,MAAM,CAAC,oBAAoB,EAAE,2BAA2B,CAAC;SACzD,MAAM,CAAC,sBAAsB,EAAE,6BAA6B,CAAC;SAC7D,MAAM,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,UAAU,EAAE,+BAA+B,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,OAA4B,EAAE,EAAE;QAC7C,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1D,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,IAAI,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC;QACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC;QACpE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,aAAa,EAAE,MAAM,CAAC,UAAU,CAAC;QAE1E,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,6FAA6F,CAC9F,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,aAAa;YAC/B,CAAC,CAAC,MAAM,oBAAoB,CAAC;gBACzB,MAAM,EAAE,aAAa;gBACrB,aAAa,EAAE,WAAW;gBAC1B,QAAQ;gBACR,UAAU,EAAE,UAAU,IAAI,aAAa,CAAC,MAAM,CAAC,UAAU;gBACzD,mBAAmB,EAAE,EAAE;gBACvB,KAAK,EAAE,KAAK,IAAI,EAAE;oBAChB,MAAM,WAAW,CAAC;wBAChB,WAAW;wBACX,QAAQ;wBACR,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACrC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACnE,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACpF,CAAC,CAAC;gBACL,CAAC;aACF,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QAEd,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4BAA4B,WAAW,WAAW,QAAQ,KACxD,UAAU,CAAC,CAAC,CAAC,WAAW,UAAU,IAAI,CAAC,CAAC,CAAC,EAC3C,GAAG,WAAW,CAAC,CAAC,CAAC,gBAAgB,WAAW,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/history.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerHistoryCommand(program: Command): void;

package/dist/cli/commands/history.js

@@ -0,0 +1,21 @@
+import { listTransactionHistory } from "../../modules/transactions/index.js";
+import { resolveBuilderConfig } from "../command-helpers.js";
+export function registerHistoryCommand(program) {
+    program
+        .command("history")
+        .description("Show recent publish transactions.")
+        .option("-c, --config <path>", "path to builder config YAML")
+        .action(async (options) => {
+        const builderConfig = await resolveBuilderConfig(options);
+        if (!builderConfig) {
+            throw new Error("history requires a builder config.");
+        }
+        const entries = await listTransactionHistory(builderConfig);
+        const lines = [
+            `Transactions: ${entries.length}`,
+            ...entries.map((entry) => `- ${entry.txId} ${entry.status} ${entry.startedAt} ${entry.generatedPath} -> ${entry.livePath}`),
+        ];
+        process.stdout.write(`${lines.join("\n")}\n`);
+    });
+}
+//# sourceMappingURL=history.js.map

package/dist/cli/commands/history.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"history.js","sourceRoot":"","sources":["../../../src/cli/commands/history.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,KAAK,EAAE,OAAqC,EAAE,EAAE;QACtD,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG;YACZ,iBAAiB,OAAO,CAAC,MAAM,EAAE;YACjC,GAAG,OAAO,CAAC,GAAG,CACZ,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,OAAO,KAAK,CAAC,QAAQ,EAAE,CACnG;SACF,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/rollback.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function registerRollbackCommand(program: Command): void;

package/dist/cli/commands/rollback.js

@@ -0,0 +1,38 @@
+import { reloadRuntime, resolveSingBoxBinary } from "../../modules/manager/index.js";
+import { rollbackToPrevious } from "../../modules/transactions/index.js";
+import { resolveBuilderConfig } from "../command-helpers.js";
+export function registerRollbackCommand(program) {
+    program
+        .command("rollback")
+        .description("Rollback the live config to the previous published snapshot.")
+        .option("-c, --config <path>", "path to builder config YAML")
+        .option("--to <target>", 'rollback target, currently only "previous"', "previous")
+        .option("--sing-box-bin <path>", "path to sing-box binary")
+        .option("--reload", "reload sing-box after restoring the previous snapshot")
+        .action(async (options) => {
+        if (options.to !== "previous") {
+            throw new Error('Only "--to previous" is currently supported.');
+        }
+        const builderConfig = await resolveBuilderConfig(options);
+        if (!builderConfig) {
+            throw new Error("rollback requires a builder config.");
+        }
+        const afterRestore = options.reload || options.singBoxBin
+            ? async () => {
+                await resolveSingBoxBinary(options.singBoxBin);
+                if (options.reload) {
+                    await reloadRuntime({
+                        ...(options.singBoxBin ? { singBoxBinary: options.singBoxBin } : {}),
+                        runtime: builderConfig.runtime.reload,
+                    });
+                }
+            }
+            : undefined;
+        const transaction = await rollbackToPrevious({
+            config: builderConfig,
+            ...(afterRestore ? { afterRestore } : {}),
+        });
+        process.stdout.write(`Rollback complete.\nTransaction: ${transaction.txId}\nLive: ${transaction.livePath}\nSnapshot: ${transaction.snapshotPath}\n`);
+    });
+}
+//# sourceMappingURL=rollback.js.map

package/dist/cli/commands/rollback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.js","sourceRoot":"","sources":["../../../src/cli/commands/rollback.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,OAAO;SACJ,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,eAAe,EAAE,4CAA4C,EAAE,UAAU,CAAC;SACjF,MAAM,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,UAAU,EAAE,uDAAuD,CAAC;SAC3E,MAAM,CAAC,KAAK,EAAE,OAA+B,EAAE,EAAE;QAChD,IAAI,OAAO,CAAC,EAAE,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,YAAY,GAChB,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,UAAU;YAClC,CAAC,CAAC,KAAK,IAAI,EAAE;gBACT,MAAM,oBAAoB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;gBAC/C,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;oBACnB,MAAM,aAAa,CAAC;wBAClB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM;qBACtC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YACH,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC;YAC3C,MAAM,EAAE,aAAa;YACrB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAC;QAEH,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oCAAoC,WAAW,CAAC,IAAI,WAAW,WAAW,CAAC,QAAQ,eAAe,WAAW,CAAC,YAAY,IAAI,CAC/H,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/commands/verify.js

@@ -1,19 +1,25 @@
-import { buildConfigArtifact } from "../../modules/build/index.js";
-import { assertVerificationReportPassed, verifyConfigRoutes, } from "../../modules/verification/index.js";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { buildConfigArtifact, resolveEffectiveIntent } from "../../modules/build/index.js";
+import { buildDnsPlan } from "../../modules/dns-plan/index.js";
+import { buildVerificationPlan } from "../../modules/verification-plan/index.js";
+import { assertVerificationReportPassed, verifyAppPlan, verifyConfigRoutes, verifyDnsPlan, verifyEgressPlan, verifyProtocolPlan, } from "../../modules/verification/index.js";
 import { resolveBuilderConfig } from "../command-helpers.js";
 export function registerVerifyCommand(program) {
     program
         .command("verify")
         .description("Build and run closed-loop route verification with sing-box and Chrome.")
+        .argument("[mode]", "verification scope: all, route, dns, egress, app, protocol", "all")
         .option("-c, --config <path>", "path to builder config YAML")
         .option("-i, --input <path>", "path to an existing config JSON to verify")
         .option("--subscription-url <url>", "override subscription URL when rebuilding")
         .option("--subscription-file <path>", "use a local subscription file instead of fetching")
         .option("--sing-box-bin <path>", "path to sing-box binary")
         .option("--chrome-bin <path>", "path to Chrome binary")
-        .action(async (options) => {
+        .action(async (mode, options) => {
         let configPath = options.input;
         const builderConfig = await resolveBuilderConfig(options);
+        let effectiveIntent = builderConfig ? await resolveEffectiveIntent(builderConfig) : undefined;
         if (!configPath) {
             if (!builderConfig) {
                 throw new Error("Verification requires --input or a builder config.");
@@ -24,26 +30,72 @@ export function registerVerifyCommand(program) {
                 ...(options.subscriptionUrl ? { subscriptionUrl: options.subscriptionUrl } : {}),
             });
             configPath = result.outputPath;
+            effectiveIntent = result.intent;
         }
-        const report = await verifyConfigRoutes({
-            configPath,
-            ...(options.singBoxBin ? { singBoxBinary: options.singBoxBin } : {}),
-            ...(options.chromeBin ? { chromeBinary: options.chromeBin } : {}),
-            ...(builderConfig ? { configuredScenarios: builderConfig.verification.scenarios } : {}),
+        if (!builderConfig || !effectiveIntent) {
+            throw new Error("Verification requires a builder config so the verification plan can be built.");
+        }
+        const dnsPlan = buildDnsPlan({
+            config: builderConfig,
+            intent: effectiveIntent,
+            activeRuleSetTags: builderConfig.ruleSets
+                .filter((ruleSet) => existsSync(ruleSet.path))
+                .map((ruleSet) => ruleSet.tag),
+        });
+        const verificationPlan = buildVerificationPlan({
+            config: builderConfig,
+            intent: effectiveIntent,
+            dnsPlan,
         });
-        const lines = [
-            `Verified config: ${report.configPath}`,
-            `Verification config: ${report.verifyConfigPath}`,
-            `sing-box log: ${report.logPath}`,
-            "",
-            "Static checks:",
-            ...report.checks.map((check) => `- ${check.passed ? "PASS" : "FAIL"} ${check.name}: ${check.details}`),
-            "",
-            "Runtime scenarios:",
-            ...report.scenarios.map((scenario) => `- ${scenario.passed ? "PASS" : "FAIL"} ${scenario.name} -> ${scenario.expectedOutboundTag} (${scenario.inboundTag})`),
-        ];
+        const rawConfig = JSON.parse(await readFile(configPath, "utf8"));
+        const lines = [`Verified config: ${configPath}`, `Mode: ${mode}`];
+        if (mode === "all" || mode === "route") {
+            const report = await verifyConfigRoutes({
+                configPath,
+                ...(options.singBoxBin ? { singBoxBinary: options.singBoxBin } : {}),
+                ...(options.chromeBin ? { chromeBinary: options.chromeBin } : {}),
+                configuredScenarios: builderConfig.verification.scenarios,
+            });
+            lines.push("");
+            lines.push("Route checks:");
+            lines.push(...report.scenarios.map((scenario) => `- ${scenario.passed ? "PASS" : "FAIL"} ${scenario.name}: ${scenario.expectedOutboundTag} via ${scenario.inboundTag}`));
+            assertVerificationReportPassed(report);
+        }
+        if (mode === "all" || mode === "dns") {
+            lines.push("");
+            lines.push("DNS checks:");
+            lines.push(...formatDnsChecks(verifyDnsPlan(verificationPlan, dnsPlan)));
+        }
+        if (mode === "all" || mode === "app") {
+            lines.push("");
+            lines.push("App checks:");
+            lines.push(...verifyAppPlan(verificationPlan, rawConfig).map((check) => `- ${check.passed ? "PASS" : "FAIL"} ${check.app}: ${check.expectedInbound} -> ${check.expectedOutboundGroup}`));
+        }
+        if (mode === "all" || mode === "protocol") {
+            lines.push("");
+            lines.push("Protocol checks:");
+            lines.push(...formatProtocolChecks(verifyProtocolPlan(verificationPlan, rawConfig)));
+        }
+        if (mode === "all" || mode === "egress") {
+            const egressResults = await verifyEgressPlan({
+                configPath,
+                checks: verificationPlan.egressChecks,
+                ...(options.singBoxBin ? { singBoxBinary: options.singBoxBin } : {}),
+            });
+            lines.push("");
+            lines.push("Egress checks:");
+            lines.push(...formatEgressChecks(egressResults));
+        }
         process.stdout.write(`${lines.join("\n")}\n`);
-        assertVerificationReportPassed(report);
     });
 }
+function formatDnsChecks(checks) {
+    return checks.map((check) => `- ${check.passed ? "PASS" : "FAIL"} ${check.domain}: ${check.actualMode} via ${check.resolver}`);
+}
+function formatProtocolChecks(checks) {
+    return checks.map((check) => `- ${check.passed ? "PASS" : "FAIL"} ${new URL(check.target).hostname}: ${check.details}`);
+}
+function formatEgressChecks(checks) {
+    return checks.map((check) => `- ${check.passed ? "PASS" : "FAIL"} ${check.expectedOutboundGroup}: ${check.ip ?? "unknown-ip"} ${check.country ?? ""} ${check.asn ?? ""}`.trim());
+}
 //# sourceMappingURL=verify.js.map

package/dist/cli/commands/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/cli/commands/verify.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wEAAwE,CAAC;SACrF,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,oBAAoB,EAAE,2CAA2C,CAAC;SACzE,MAAM,CAAC,0BAA0B,EAAE,2CAA2C,CAAC;SAC/E,MAAM,CAAC,4BAA4B,EAAE,mDAAmD,CAAC;SACzF,MAAM,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,OAA6B,EAAE,EAAE;QAC9C,IAAI,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;QAC/B,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;gBACvC,MAAM,EAAE,aAAa;gBACrB,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC,CAAC;YACH,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACjC,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;YACtC,UAAU;YACV,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG;YACZ,oBAAoB,MAAM,CAAC,UAAU,EAAE;YACvC,wBAAwB,MAAM,CAAC,gBAAgB,EAAE;YACjD,iBAAiB,MAAM,CAAC,OAAO,EAAE;YACjC,EAAE;YACF,gBAAgB;YAChB,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAClB,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CACjF;YACD,EAAE;YACF,oBAAoB;YACpB,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CACrB,CAAC,QAAQ,EAAE,EAAE,CACX,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,mBAAmB,KAAK,QAAQ,CAAC,UAAU,GAAG,CACxH;SACF,CAAC;QAEF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9C,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../src/cli/commands/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAI5C,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,EAIL,8BAA8B,EAC9B,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wEAAwE,CAAC;SACrF,QAAQ,CAAC,QAAQ,EAAE,4DAA4D,EAAE,KAAK,CAAC;SACvF,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,oBAAoB,EAAE,2CAA2C,CAAC;SACzE,MAAM,CAAC,0BAA0B,EAAE,2CAA2C,CAAC;SAC/E,MAAM,CAAC,4BAA4B,EAAE,mDAAmD,CAAC;SACzF,MAAM,CAAC,uBAAuB,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAgB,EAAE,OAA6B,EAAE,EAAE;QAChE,IAAI,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC;QAC/B,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,sBAAsB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,IAAI,CAAC,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;YACxE,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;gBACvC,MAAM,EAAE,aAAa;gBACrB,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnF,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC,CAAC;YACH,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;YAC/B,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;QAClC,CAAC;QAED,IAAI,CAAC,aAAa,IAAI,CAAC,eAAe,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC;YAC3B,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,eAAe;YACvB,iBAAiB,EAAE,aAAa,CAAC,QAAQ;iBACtC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;iBAC7C,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;SACjC,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;YAC7C,MAAM,EAAE,aAAa;YACrB,MAAM,EAAE,eAAe;YACvB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAA4B,CAAC;QAE5F,MAAM,KAAK,GAAG,CAAC,oBAAoB,UAAU,EAAE,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC;QAElE,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC;gBACtC,UAAU;gBACV,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpE,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,mBAAmB,EAAE,aAAa,CAAC,YAAY,CAAC,SAAS;aAC1D,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC5B,KAAK,CAAC,IAAI,CACR,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CACrB,CAAC,QAAQ,EAAE,EAAE,CACX,KAAK,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,mBAAmB,QAAQ,QAAQ,CAAC,UAAU,EAAE,CACxH,CACF,CAAC;YACF,8BAA8B,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,aAAa,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;QAED,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1B,KAAK,CAAC,IAAI,CACR,GAAG,aAAa,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,GAAG,CAC/C,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,eAAe,OAAO,KAAK,CAAC,qBAAqB,EAAE,CACjH,CACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC;gBAC3C,UAAU;gBACV,MAAM,EAAE,gBAAgB,CAAC,YAAY;gBACrC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrE,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,aAAa,CAAC,CAAC,CAAC;QACnD,CAAC;QAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;AACP,CAAC;AAaD,SAAS,eAAe,CAAC,MAAwC;IAC/D,OAAO,MAAM,CAAC,GAAG,CACf,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,UAAU,QAAQ,KAAK,CAAC,QAAQ,EAAE,CACnG,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA6C;IACzE,OAAO,MAAM,CAAC,GAAG,CACf,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAA2C;IACrE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,KAAK,CAAC,EAAE,IAAI,YAAY,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CACnJ,CAAC;AACJ,CAAC"}

package/dist/cli/index.js

@@ -8,10 +8,12 @@ import { registerBuildCommand } from "./commands/build.js";
 import { registerCheckCommand } from "./commands/check.js";
 import { registerDoctorCommand } from "./commands/doctor.js";
 import { registerGoCommand } from "./commands/go.js";
+import { registerHistoryCommand } from "./commands/history.js";
 import { registerInitCommand } from "./commands/init.js";
 import { registerProxifierCommand } from "./commands/proxifier.js";
 import { registerQuickstartCommand } from "./commands/quickstart.js";
 import { registerReloadCommand } from "./commands/reload.js";
+import { registerRollbackCommand } from "./commands/rollback.js";
 import { registerRunCommand } from "./commands/run.js";
 import { registerScheduleCommand } from "./commands/schedule.js";
 import { registerSetupCommand } from "./commands/setup.js";
@@ -44,7 +46,9 @@ export function createProgram() {
     registerBuildCommand(program);
     registerCheckCommand(program);
     registerApplyCommand(program);
+    registerHistoryCommand(program);
     registerRunCommand(program);
+    registerRollbackCommand(program);
     registerVerifyCommand(program);
     registerDoctorCommand(program);
     registerProxifierCommand(program);
@@ -63,7 +67,9 @@ function hideAdvancedCommands(program) {
         "build",
         "check",
         "apply",
+        "history",
         "run",
+        "rollback",
         "verify",
         "doctor",
         "proxifier",

package/dist/cli/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,aAAa,CAAC;SACnB,WAAW,CAAC,2DAA2D,CAAC;SACxE,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,OAAO,EACP;QACE,EAAE;QACF,uBAAuB;QACvB,6CAA6C;QAC7C,2BAA2B;QAC3B,sBAAsB;QACtB,EAAE;QACF,kFAAkF;KACnF,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IAEJ,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE9B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,KAAK,MAAM,WAAW,IAAI;QACxB,MAAM;QACN,OAAO;QACP,YAAY;QACZ,QAAQ;QACR,OAAO;QACP,OAAO;QACP,OAAO;QACP,KAAK;QACL,QAAQ;QACR,QAAQ;QACR,WAAW;QACX,QAAQ;QACR,UAAU;QACV,WAAW;KACZ,EAAE,CAAC;QACF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,WAAW,CAAC,CAAC;QAC/E,IAAI,OAAO,EAAE,CAAC;YACX,OAA2C,CAAC,OAAO,GAAG,IAAI,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,MAAM,aAAa,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,QAA4B;IACtF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,KAAK,QAAQ,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,IAAI,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,UAAU,aAAa;IAC3B,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAE9B,OAAO;SACJ,IAAI,CAAC,aAAa,CAAC;SACnB,WAAW,CAAC,2DAA2D,CAAC;SACxE,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,OAAO,EACP;QACE,EAAE;QACF,uBAAuB;QACvB,6CAA6C;QAC7C,2BAA2B;QAC3B,sBAAsB;QACtB,EAAE;QACF,kFAAkF;KACnF,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IAEJ,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC7B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACnC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC5B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC/B,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACjC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAClC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAE9B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB;IAC5C,KAAK,MAAM,WAAW,IAAI;QACxB,MAAM;QACN,OAAO;QACP,YAAY;QACZ,QAAQ;QACR,OAAO;QACP,OAAO;QACP,OAAO;QACP,SAAS;QACT,KAAK;QACL,UAAU;QACV,QAAQ;QACR,QAAQ;QACR,WAAW;QACX,QAAQ;QACR,UAAU;QACV,WAAW;KACZ,EAAE,CAAC;QACF,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,WAAW,CAAC,CAAC;QAC/E,IAAI,OAAO,EAAE,CAAC;YACX,OAA2C,CAAC,OAAO,GAAG,IAAI,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc;IACtC,MAAM,aAAa,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,YAAoB,EAAE,QAA4B;IACtF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,KAAK,QAAQ,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,IAAI,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC"}

package/dist/domain/dns-plan.d.ts

@@ -0,0 +1,27 @@
+export interface DnsPlanServer {
+    readonly type: "local" | "tcp";
+    readonly tag: string;
+    readonly server?: string;
+    readonly serverPort?: number;
+    readonly preferGo?: boolean;
+}
+export interface DnsPlanRule {
+    readonly match: {
+        readonly domain?: readonly string[];
+        readonly domainSuffix?: readonly string[];
+        readonly ruleSet?: readonly string[];
+    };
+    readonly resolvers: readonly string[];
+}
+export interface DNSPlan {
+    readonly mode: "real-ip" | "fake-ip";
+    readonly defaultResolvers: readonly string[];
+    readonly directResolvers: readonly string[];
+    readonly proxyResolvers: readonly string[];
+    readonly fallbackResolvers: readonly string[];
+    readonly servers: readonly DnsPlanServer[];
+    readonly nameserverPolicy: readonly DnsPlanRule[];
+    readonly fakeIpFilter: readonly string[];
+    readonly localHosts?: Record<string, string>;
+    readonly strategy: "prefer_ipv4" | "prefer_ipv6";
+}

package/dist/domain/dns-plan.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dns-plan.js.map

package/dist/domain/dns-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-plan.js","sourceRoot":"","sources":["../../src/domain/dns-plan.ts"],"names":[],"mappings":""}

package/dist/domain/intent.d.ts

@@ -0,0 +1,61 @@
+export type IntentVersion = "v1";
+export type IntentPlacement = "beforeBuiltins" | "afterBuiltins";
+export interface IntentVerifyHint {
+    readonly expectedCountry?: readonly string[];
+    readonly expectedASN?: readonly string[];
+    readonly probeUrls?: readonly string[];
+}
+export interface IntentSiteMatch {
+    readonly inbound?: readonly string[];
+    readonly protocol?: string;
+    readonly network?: "tcp" | "udp";
+    readonly port?: number;
+    readonly domain?: readonly string[];
+    readonly domainSuffix?: readonly string[];
+    readonly ruleSet?: readonly string[];
+    readonly category?: readonly string[];
+}
+export type IntentSiteAction = {
+    readonly type: "route";
+    readonly outboundGroup: string;
+} | {
+    readonly type: "reject";
+};
+export interface IntentSitePolicy {
+    readonly placement: IntentPlacement;
+    readonly name?: string;
+    readonly match: IntentSiteMatch;
+    readonly action: IntentSiteAction;
+    readonly verify?: IntentVerifyHint;
+}
+export interface IntentProcessMatch {
+    readonly bundleId?: readonly string[];
+    readonly processName?: readonly string[];
+}
+export interface IntentProcessPolicy {
+    readonly name?: string;
+    readonly match: IntentProcessMatch;
+    readonly inbound: "in-proxifier" | "in-default";
+    readonly outboundGroup: string;
+    readonly verify?: {
+        readonly expectProxyHit?: boolean;
+    };
+}
+export interface IntentLocalOverride {
+    readonly hosts?: Record<string, string>;
+    readonly dnsPolicy?: readonly {
+        readonly domainSuffix: readonly string[];
+        readonly server: readonly string[];
+    }[];
+}
+export interface IntentIR {
+    readonly version: IntentVersion;
+    readonly globals: {
+        readonly updateIntervalMinutes?: number;
+        readonly preferIPv6?: boolean;
+        readonly enableTUN?: boolean;
+    };
+    readonly sitePolicies: readonly IntentSitePolicy[];
+    readonly processPolicies: readonly IntentProcessPolicy[];
+    readonly localOverrides: IntentLocalOverride;
+}

package/dist/domain/intent.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=intent.js.map

package/dist/domain/intent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intent.js","sourceRoot":"","sources":["../../src/domain/intent.ts"],"names":[],"mappings":""}

package/dist/domain/transaction.d.ts

@@ -0,0 +1,12 @@
+export interface ApplyTransaction {
+    readonly txId: string;
+    readonly generatedPath: string;
+    readonly livePath: string;
+    readonly backupPath: string;
+    readonly snapshotPath?: string;
+    readonly startedAt: string;
+    readonly completedAt?: string;
+    readonly status: "pending" | "applied" | "rolled-back" | "failed";
+    readonly verificationSummary: Record<string, unknown>;
+    readonly error?: string;
+}

package/dist/domain/transaction.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=transaction.js.map

package/dist/domain/transaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction.js","sourceRoot":"","sources":["../../src/domain/transaction.ts"],"names":[],"mappings":""}

package/dist/domain/verification-plan.d.ts

@@ -0,0 +1,34 @@
+export interface VerificationPlan {
+    readonly dnsChecks: readonly {
+        readonly domain: string;
+        readonly expectedMode: "fake-ip" | "real-ip";
+        readonly expectedResolver?: string;
+    }[];
+    readonly routeChecks: readonly {
+        readonly id: string;
+        readonly name: string;
+        readonly target: string;
+        readonly inbound: "in-mixed" | "in-proxifier";
+        readonly expectedOutboundGroup: string;
+        readonly expectedRuleHint?: string;
+    }[];
+    readonly egressChecks: readonly {
+        readonly id: string;
+        readonly target: string;
+        readonly inbound: "in-mixed" | "in-proxifier";
+        readonly expectedOutboundGroup: string;
+        readonly expectedCountry?: readonly string[];
+        readonly expectedASN?: readonly string[];
+    }[];
+    readonly appChecks: readonly {
+        readonly id: string;
+        readonly app: string;
+        readonly expectedInbound: "in-proxifier" | "in-default";
+        readonly expectedOutboundGroup: string;
+    }[];
+    readonly protocolChecks: readonly {
+        readonly id: string;
+        readonly target: string;
+        readonly expectTCPOnly?: boolean;
+    }[];
+}

package/dist/domain/verification-plan.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=verification-plan.js.map

package/dist/domain/verification-plan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-plan.js","sourceRoot":"","sources":["../../src/domain/verification-plan.ts"],"names":[],"mappings":""}

package/dist/modules/authoring/index.d.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import type { BuilderConfig } from "../../config/schema.js";
+import type { IntentIR } from "../../domain/intent.js";
 import { type NaturalLanguagePlan } from "../natural-language/index.js";
 declare const providerSchema: z.ZodEnum<["deterministic", "auto", "claude", "exec"]>;
 export type AuthoringProvider = z.infer<typeof providerSchema>;
@@ -27,6 +28,7 @@ export interface GenerateAuthoringPlanInput {
 }
 export interface GenerateAuthoringPlanResult {
     readonly plan: NaturalLanguagePlan;
+    readonly intent: IntentIR;
     readonly providerRequested: AuthoringProvider;
     readonly providerUsed: Exclude<AuthoringProvider, "auto">;
 }

package/dist/modules/authoring/index.js

@@ -4,6 +4,7 @@ import { access, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import path from "node:path";
 import { z } from "zod";
+import { intentFromNaturalLanguagePlan } from "../intent/index.js";
 import { generateRulesFromPrompt, } from "../natural-language/index.js";
 import { mergeRuleTemplates } from "../rule-templates/index.js";
 const providerSchema = z.enum(["deterministic", "auto", "claude", "exec"]);
@@ -90,27 +91,33 @@ export async function generateAuthoringPlan(input) {
     const timeoutMs = input.timeoutMs ?? input.config?.authoring.timeoutMs ?? defaultTimeoutMs;
     const runner = input.runner ?? runAuthoringCommand;
     if (providerRequested === "deterministic") {
+        const plan = generateRulesFromPrompt(input.prompt);
         return {
             providerRequested,
             providerUsed: "deterministic",
-            plan: generateRulesFromPrompt(input.prompt),
+            plan,
+            intent: intentFromNaturalLanguagePlan(plan),
         };
     }
     if (providerRequested === "claude") {
+        const plan = await generateWithClaude(input.prompt, input.config, timeoutMs, runner);
         return {
             providerRequested,
             providerUsed: "claude",
-            plan: await generateWithClaude(input.prompt, input.config, timeoutMs, runner),
+            plan,
+            intent: intentFromNaturalLanguagePlan(plan),
         };
     }
     if (providerRequested === "exec") {
+        const plan = await generateWithExec(input.prompt, input.config, {
+            command: input.execCommand ?? input.config?.authoring.exec?.command,
+            args: input.execArgs ?? input.config?.authoring.exec?.args,
+        }, timeoutMs, runner);
         return {
             providerRequested,
             providerUsed: "exec",
-            plan: await generateWithExec(input.prompt, input.config, {
-                command: input.execCommand ?? input.config?.authoring.exec?.command,
-                args: input.execArgs ?? input.config?.authoring.exec?.args,
-            }, timeoutMs, runner),
+            plan,
+            intent: intentFromNaturalLanguagePlan(plan),
         };
     }
     return generateWithAuto(input.prompt, input.config, input.execCommand, input.execArgs, timeoutMs, runner);
@@ -156,13 +163,15 @@ export async function detectLocalAiClis() {
 async function generateWithAuto(prompt, config, execCommand, execArgs, timeoutMs, runner) {
     if (execCommand || config?.authoring.exec?.command) {
         try {
+            const plan = await generateWithExec(prompt, config, {
+                command: execCommand ?? config?.authoring.exec?.command,
+                args: execArgs ?? config?.authoring.exec?.args,
+            }, timeoutMs, runner);
             return {
                 providerRequested: "auto",
                 providerUsed: "exec",
-                plan: await generateWithExec(prompt, config, {
-                    command: execCommand ?? config?.authoring.exec?.command,
-                    args: execArgs ?? config?.authoring.exec?.args,
-                }, timeoutMs, runner),
+                plan,
+                intent: intentFromNaturalLanguagePlan(plan),
             };
         }
         catch (error) {
@@ -172,22 +181,26 @@ async function generateWithAuto(prompt, config, execCommand, execArgs, timeoutMs
     const claudePath = await resolveExecutable("claude");
     if (claudePath) {
         try {
+            const plan = await generateWithClaude(prompt, config, timeoutMs, runner, claudePath);
             return {
                 providerRequested: "auto",
                 providerUsed: "claude",
-                plan: await generateWithClaude(prompt, config, timeoutMs, runner, claudePath),
+                plan,
+                intent: intentFromNaturalLanguagePlan(plan),
             };
         }
         catch (error) {
             return fallbackDeterministic(prompt, "claude", error instanceof Error ? error.message : String(error));
         }
     }
+    const plan = appendNotes(generateRulesFromPrompt(prompt), [
+        "Auto authoring fell back to the built-in deterministic parser because no supported local AI CLI was available.",
+    ]);
     return {
         providerRequested: "auto",
         providerUsed: "deterministic",
-        plan: appendNotes(generateRulesFromPrompt(prompt), [
-            "Auto authoring fell back to the built-in deterministic parser because no supported local AI CLI was available.",
-        ]),
+        plan,
+        intent: intentFromNaturalLanguagePlan(plan),
     };
 }
 async function generateWithClaude(prompt, config, timeoutMs, runner, explicitCommand) {
@@ -414,12 +427,14 @@ function buildPortableExecPrompt(config, prompt) {
     ].join("\n");
 }
 function fallbackDeterministic(prompt, providerUsed, reason) {
+    const plan = appendNotes(generateRulesFromPrompt(prompt), [
+        `Auto authoring fell back from ${providerUsed} to the deterministic parser: ${reason}`,
+    ]);
     return {
         providerRequested: "auto",
         providerUsed: "deterministic",
-        plan: appendNotes(generateRulesFromPrompt(prompt), [
-            `Auto authoring fell back from ${providerUsed} to the deterministic parser: ${reason}`,
-        ]),
+        plan,
+        intent: intentFromNaturalLanguagePlan(plan),
     };
 }
 function appendNotes(plan, extraNotes) {