@synap-core/cli 1.10.0 → 1.12.2

package/dist/lib/key-doctor.js

@@ -0,0 +1,286 @@
+/**
+ * Key health for one pod: read every copy, ask the pod about each key, print
+ * one diagnosis per problem — and, with `--fix`, do the one right thing.
+ *
+ * The fix never writes a key the pod has not confirmed live (`assertKeyWritable`),
+ * and it ends with a real MCP `initialize` against `/mcp` using the key it
+ * wrote: a fix is only reported ✓ when that call succeeds AND every copy it had
+ * to rewrite was rewritten.
+ *
+ * A key is sent to this pod only when something ties it to this pod
+ * (`keysToProbe`); keys are asked about ONE AT A TIME. The pod resolves a key it
+ * does not know with a bcrypt scan of every key sharing its prefix (~12s on a
+ * 4-thread pool, measured 2026-10-12); asked all at once, four unknown keys
+ * starved each other past the timeout and read "no answer".
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import chalk from "chalk";
+import { writeFileAtomic } from "./atomic-file.js";
+import { collectKeyInventory, keysToProbe } from "./key-locations.js";
+import { diagnoseKeys } from "./key-diagnosis.js";
+import { fetchKeyState, assertKeyWritable } from "./key-state.js";
+import { machineInstanceId, thisComputerInstanceIds } from "./machine-instance.js";
+/** Per-key wait for `/auth/key-state` — an unknown key costs the pod ~12s of bcrypt. */
+export const KEY_STATE_TIMEOUT_MS = 30_000;
+async function targetLabel(surface) {
+    try {
+        const { TARGETS } = await import("./targets.js");
+        return TARGETS[surface]?.label ?? surface;
+    }
+    catch {
+        return surface;
+    }
+}
+export async function checkKeyHealth(podUrl, deps = {}) {
+    const allClients = deps.clients ?? (await import("./targets.js")).clientKeyFiles();
+    const clients = deps.surface ? allClients.filter((c) => c.surface === deps.surface) : allClients;
+    const all = collectKeyInventory({
+        home: deps.home ?? os.homedir(),
+        podUrl,
+        envKey: "envKey" in deps ? deps.envKey : process.env.SYNAP_HUB_API_KEY,
+        envPodUrl: "envPodUrl" in deps ? deps.envPodUrl : process.env.SYNAP_POD_URL,
+        clients,
+    });
+    const inventory = deps.surface
+        ? { ...all, locations: all.locations.filter((l) => l.role === "agent" && l.surface === deps.surface) }
+        : all;
+    const keys = keysToProbe(inventory.locations);
+    const probed = new Set(keys);
+    const states = new Map();
+    // One at a time — see the module doc.
+    for (const k of keys)
+        states.set(k, await fetchKeyState(podUrl, k, { fetch: deps.fetch, timeoutMs: deps.timeoutMs ?? KEY_STATE_TIMEOUT_MS }));
+    const locations = inventory.locations.filter((l) => probed.has(l.key));
+    const notSent = inventory.locations.filter((l) => !probed.has(l.key));
+    const labels = new Map();
+    for (const s of new Set(inventory.locations.map((l) => l.surface).filter((x) => !!x)))
+        labels.set(s, deps.labelOf ? deps.labelOf(s) : await targetLabel(s));
+    const envKey = locations.find((l) => l.kind === "process-env")?.key;
+    const idFor = deps.instanceIdFor ?? ((s) => machineInstanceId(s));
+    const answers = [...states.values()];
+    return {
+        podUrl,
+        locations,
+        states,
+        unchecked: inventory.unchecked,
+        notSent,
+        podDescribesKeys: answers.some((a) => !a.legacy && a.state !== "unreachable"),
+        diagnoses: diagnoseKeys({
+            locations,
+            states,
+            envKey,
+            instanceIdFor: idFor,
+            instanceIdsForAgentType: (t) => thisComputerInstanceIds(t, idFor),
+            labelOf: (s) => labels.get(s) ?? s,
+        }),
+    };
+}
+/** The problems only — `ok` diagnoses are summarised, not listed. */
+export function keyProblems(report) {
+    return report.diagnoses.filter((d) => d.code !== "ok");
+}
+/** A problem `--fix` can act on (not merely tell you a command). */
+export function isFixable(d) {
+    return d.action !== "none" && d.action !== "login" && d.action !== "edit_shell_rc";
+}
+/**
+ * The check behind every "<Agent> connected" line: read back what setup WROTE
+ * for `surface` — the same copies `synap doctor` reads — ask the pod about each
+ * key, and pass only when the doctor would say "key works". The 2026-10-15
+ * devbox printed "✓ Claude Code connected" over a key the pod held as
+ * awaiting approval; a success line now comes from this read, never from
+ * having written the file.
+ */
+export async function confirmSurfaceKey(podUrl, surface, deps = {}) {
+    let report;
+    try {
+        report = await checkKeyHealth(podUrl, { ...deps, surface });
+    }
+    catch (err) {
+        return { verdict: "unconfirmed", reason: `its key could not be read back (${err instanceof Error ? err.message : String(err)})` };
+    }
+    const unread = report.unchecked?.[0];
+    if (unread)
+        return { verdict: "unconfirmed", reason: `${unread.tool} — ${unread.file} ${unread.reason}` };
+    const d = report.diagnoses.find((x) => x.surface === surface);
+    if (d?.code === "ok")
+        return { verdict: "active" };
+    if (d?.code === "unverifiable")
+        return { verdict: "unconfirmed", reason: (d.key && report.states.get(d.key)?.error) || "the pod did not answer" };
+    if (d)
+        return { verdict: "not-active", title: d.title, command: d.command };
+    const { TARGETS, isTargetName } = await import("./targets.js");
+    const target = isTargetName(surface) ? TARGETS[surface] : undefined;
+    if (target && "none" in target.keyStore)
+        return { verdict: "unchecked", reason: target.keyStore.none };
+    return { verdict: "not-active", title: `${target?.label ?? surface}: no key for this pod was found where setup writes it`, command: "synap doctor" };
+}
+const plural = (n, one, many = one + "s") => `${n} ${n === 1 ? one : many}`;
+/**
+ * Print what is wrong, and what could not be checked. Working keys are one
+ * line (listed with `verbose`); an unverifiable key is "?", never ✓ or ✗.
+ */
+export function printKeyHealth(report, opts = {}) {
+    const ind = opts.indent ?? "  ";
+    const dim = (t) => console.log(chalk.dim(`${ind}${t}`));
+    const problems = keyProblems(report);
+    const ok = report.diagnoses.filter((d) => d.code === "ok");
+    const unverifiable = problems.filter((d) => d.code === "unverifiable");
+    const broken = problems.filter((d) => d.code !== "unverifiable");
+    if (opts.showOk !== false && ok.length) {
+        if (opts.verbose)
+            for (const d of ok)
+                console.log(`${ind}${chalk.green("✓")} ${d.title}`);
+        else
+            console.log(`${ind}${chalk.green("✓")} ${plural(ok.length, "agent key")} work${ok.length === 1 ? "s" : ""}: ${ok.map((d) => d.label ?? d.surface).join(", ")}`);
+    }
+    for (const d of broken) {
+        const mark = d.severity === "error" ? chalk.red("✗") : chalk.yellow("!");
+        console.log(`${ind}${mark} ${chalk.bold(d.title)}`);
+        for (const line of d.lines)
+            dim(`    ${line}`);
+        if (d.command)
+            dim(`    → ${d.command}`);
+    }
+    // Group the unverifiable by why — "no answer in 30s" four times is one line.
+    const byWhy = new Map();
+    for (const d of unverifiable) {
+        const why = (d.key && report.states.get(d.key)?.error) || "the pod did not answer";
+        byWhy.set(why, [...(byWhy.get(why) ?? []), d]);
+    }
+    for (const [why, ds] of byWhy) {
+        console.log(`${ind}${chalk.yellow("?")} ${plural(ds.length, "key")} not checked — ${why}: ${ds.map((d) => d.label ?? d.surface).join(", ")}`);
+        dim("    → run synap doctor again; if it repeats: synap agents list");
+    }
+    const notSent = report.notSent ?? [];
+    if (notSent.length) {
+        const keys = new Set(notSent.map((l) => l.key)).size;
+        console.log(`${ind}${chalk.yellow("?")} ${plural(keys, "key")} not checked — ${keys === 1 ? "it belongs" : "they belong"} to another pod or nothing says which${opts.verbose ? "" : " (details with -v)"}`);
+        if (opts.verbose)
+            for (const l of notSent)
+                dim(`    ${l.label}`);
+    }
+    for (const u of report.unchecked ?? [])
+        console.log(`${ind}${chalk.yellow("?")} not checked: ${u.tool} — ${u.file} ${u.reason}`);
+    if (report.locations.length === 0 && notSent.length === 0)
+        dim("No Synap key is configured for this pod on this computer.");
+    if (!report.podDescribesKeys && report.locations.length > 0)
+        dim("(This pod predates the key-state door: it can say a key fails, not why. Update the pod for precise reasons.)");
+    if (opts.fixHint && problems.some(isFixable))
+        dim(`Fix it: ${chalk.cyan("synap doctor --fix")}`);
+}
+// ─── --fix ────────────────────────────────────────────────────────────────
+/**
+ * Replace `oldKey` with `newKey` in one file, atomically, mode kept. Works for
+ * every client format (JSON, JSONC with its comments, TOML, YAML) because a key
+ * is a unique opaque token: the edit touches exactly the copies of that key and
+ * nothing else. Throws when the file no longer holds the old key.
+ */
+function replaceKeyInFile(file, oldKey, newKey) {
+    const text = fs.readFileSync(file, "utf8");
+    if (!text.includes(oldKey))
+        throw new Error("the old key is no longer in the file");
+    writeFileAtomic(file, text.split(oldKey).join(newKey));
+}
+/** The agent a key belongs to, from the pod's own status door. Throws when the pod does not say. */
+async function agentOfKey(podUrl, key, f) {
+    const res = await f(`${podUrl.replace(/\/+$/, "")}/api/hub/auth/status`, {
+        headers: { Authorization: `Bearer ${key}` },
+        signal: AbortSignal.timeout(15_000),
+    }).catch((err) => {
+        throw new Error(`could not ask the pod whose key this is (${err.message})`);
+    });
+    const userId = res.ok ? (await res.json().catch(() => ({}))).userId : undefined;
+    if (!userId)
+        throw new Error(`could not ask the pod whose key this is (HTTP ${res.status} from /auth/status)`);
+    return userId;
+}
+/**
+ * Write `key` into every rewritable copy of `surface` for this pod — ONLY after
+ * the pod confirms it is live. A copy that cannot be rewritten is reported in
+ * `failed`, never dropped.
+ */
+export async function rewriteSurfaceKey(report, surface, key, agentUserId, deps = {}) {
+    await assertKeyWritable(report.podUrl, key, deps);
+    const pod = await import("./pod.js");
+    // A blank agent id saved next to a key breaks every later lookup — ask, or stop.
+    const agentId = agentUserId || (await agentOfKey(report.podUrl, key, deps.fetch ?? fetch));
+    const configFile = path.join(deps.home ?? os.homedir(), ".synap", "config.json");
+    const mine = report.locations.filter((l) => l.surface === surface);
+    const done = mine.filter((l) => l.key === key && l.kind !== "pending").map((l) => l.label);
+    const failed = [];
+    pod.setSurfaceAgentKey(surface, { hubApiKey: key, agentUserId: agentId, podUrl: report.podUrl });
+    pod.clearPendingAgentKey(surface, report.podUrl);
+    if (!mine.some((l) => l.file === configFile && l.key === key && l.kind !== "pending"))
+        done.push(`~/.synap/config.json → agentKeysByPod.${surface}`);
+    // The CLI config is handled above; every other file gets a precise text edit.
+    for (const loc of mine.filter((l) => l.rewritable && l.key !== key && l.file && l.file !== configFile)) {
+        try {
+            replaceKeyInFile(loc.file, loc.key, key);
+            done.push(loc.label);
+        }
+        catch (err) {
+            failed.push(`${loc.label}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    return { done: [...new Set(done)], failed };
+}
+/** Perform each diagnosis's one action, then verify with a real MCP initialize. */
+export async function fixKeyHealth(report, deps = {}) {
+    const outcomes = [];
+    const openUrl = deps.openUrl ?? (await import("./targets.js")).openBrowserUrl;
+    const verify = deps.verify ??
+        (async (podUrl, key) => (await import("./targets.js")).verifyMcpConnection(podUrl, key, { timeoutMs: 20_000 }));
+    const wait = deps.wait ??
+        (async (a) => (await import("./key-approval.js")).waitForKeyLive({ ...a, fetch: deps.fetch }));
+    const provision = deps.provision ??
+        (async (podUrl, mintingKey, agentType, surface) => (await import("./targets.js")).provisionAgentKey(podUrl, mintingKey, agentType, { surfaceName: surface }));
+    const mintingKey = report.locations.find((l) => l.kind === "profile" && report.states.get(l.key)?.state === "active")?.key;
+    const finish = async (d, surface, key, agentUserId) => {
+        const { done: rewritten, failed } = await rewriteSurfaceKey(report, surface, key, agentUserId, { fetch: deps.fetch });
+        const name = d.label ?? surface;
+        if (failed.length)
+            return { diagnosis: d, ok: false, message: `${name}: live key written to ${rewritten.join(", ")}, but NOT to: ${failed.join("; ")}` };
+        const v = await verify(report.podUrl, key);
+        return v.ok
+            ? { diagnosis: d, ok: true, message: `${name}: live key in ${rewritten.join(", ")} — MCP initialize OK${v.toolCount !== undefined ? ` (${v.toolCount} tools)` : ""}${rewritten.some((l) => l.includes(".claude")) ? ". Restart Claude Code to pick it up." : ""}` }
+            : { diagnosis: d, ok: false, message: `${name}: key written, but MCP verification failed: ${v.error ?? "unknown error"}` };
+    };
+    for (const d of keyProblems(report)) {
+        try {
+            if (d.action === "approve_and_wait" && d.surface && d.key) {
+                const { openAndWait } = await import("./key-approval.js");
+                const outcome = d.approvalUrl
+                    ? await openAndWait(d.label ?? d.surface, d.approvalUrl, report.podUrl, () => wait({ podUrl: report.podUrl, pendingKey: d.key }), openUrl)
+                    : await wait({ podUrl: report.podUrl, pendingKey: d.key });
+                if (outcome === "approved")
+                    outcomes.push(await finish(d, d.surface, d.key, d.agentUserId));
+                else if (outcome === "rejected")
+                    outcomes.push({ diagnosis: d, ok: false, message: `${d.label ?? d.surface}: the request was declined on the pod. Run \`synap doctor --fix\` again to ask anew.` });
+                else
+                    outcomes.push({ diagnosis: d, ok: false, message: `${d.label ?? d.surface}: still waiting for approval — nothing was changed. Approve ${d.approvalUrl ?? "it on your pod"}, then run \`synap doctor --fix\` again.` });
+            }
+            else if (d.action === "reprovision" && d.surface) {
+                if (!mintingKey) {
+                    outcomes.push({ diagnosis: d, ok: false, message: `${d.label ?? d.surface}: your CLI key for this pod does not work either — run \`synap login --reconnect\` first, then \`synap doctor --fix\`.` });
+                    continue;
+                }
+                const fresh = await provision(report.podUrl, mintingKey, d.agentType ?? d.surface, d.surface);
+                outcomes.push(await finish(d, d.surface, fresh.hubApiKey, fresh.agentUserId));
+            }
+            else if (d.action === "rewrite" && d.surface && d.key) {
+                outcomes.push(await finish(d, d.surface, d.key, d.agentUserId));
+            }
+            else if (d.action === "login" || d.action === "edit_shell_rc") {
+                outcomes.push({ diagnosis: d, ok: false, message: `${d.title}. Not something --fix can do for you — run: ${d.command}` });
+            }
+        }
+        catch (err) {
+            outcomes.push({ diagnosis: d, ok: false, message: `${d.surface ?? "key"}: ${err instanceof Error ? err.message : String(err)}` });
+        }
+    }
+    return outcomes;
+}
+//# sourceMappingURL=key-doctor.js.map

package/dist/lib/key-doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-doctor.js","sourceRoot":"","sources":["../../src/lib/key-doctor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAgE,MAAM,oBAAoB,CAAC;AACpI,OAAO,EAAE,YAAY,EAAkB,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiC,MAAM,gBAAgB,CAAC;AACjG,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEnF,wFAAwF;AACxF,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAgC3C,KAAK,UAAU,WAAW,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACjD,OAAQ,OAA8C,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,OAAO,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,OAAsB,EAAE;IAC3E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IACnF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACjG,MAAM,GAAG,GAAG,mBAAmB,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE;QAC/B,MAAM;QACN,MAAM,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB;QACtE,SAAS,EAAE,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa;QAC3E,OAAO;KACR,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO;QAC5B,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,EAAE;QACtG,CAAC,CAAC,GAAG,CAAC;IACR,MAAM,IAAI,GAAG,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC3C,sCAAsC;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,oBAAoB,EAAE,CAAC,CAAC,CAAC;IAC9I,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChG,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,EAAE,GAAG,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,OAAO;QACL,MAAM;QACN,SAAS;QACT,MAAM;QACN,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,OAAO;QACP,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,aAAa,CAAC;QAC7E,SAAS,EAAE,YAAY,CAAC;YACtB,SAAS;YACT,MAAM;YACN,MAAM;YACN,aAAa,EAAE,KAAK;YACpB,uBAAuB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,CAAC,EAAE,KAAK,CAAC;YACjE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;SACnC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,WAAW,CAAC,MAAuB;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACzD,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,CAAY;IACpC,OAAO,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,CAAC;AACrF,CAAC;AAkBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,OAAe,EAAE,OAAsB,EAAE;IAC/F,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,mCAAmC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;IACpI,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;IAC1G,MAAM,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACnD,IAAI,CAAC,EAAE,IAAI,KAAK,cAAc;QAC5B,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,wBAAwB,EAAE,CAAC;IACpH,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5E,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,IAAI,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvG,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,KAAK,IAAI,OAAO,uDAAuD,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AACvJ,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,GAAW,EAAE,IAAI,GAAG,GAAG,GAAG,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAE5F;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAAuB,EAAE,OAAoF,EAAE;IAC5I,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3D,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,OAAO;YAAE,KAAK,MAAM,CAAC,IAAI,EAAE;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;;YACrF,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACvK,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpD,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK;YAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,OAAO;YAAE,GAAG,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,6EAA6E;IAC7E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,IAAI,wBAAwB,CAAC;QACnF,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,kBAAkB,GAAG,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9I,GAAG,CAAC,gEAAgE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,kBAAkB,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,wCAAwC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAC5M,IAAI,IAAI,CAAC,OAAO;YAAE,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACjI,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,GAAG,CAAC,2DAA2D,CAAC,CAAC;IAC5H,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC;QACzD,GAAG,CAAC,8GAA8G,CAAC,CAAC;IACtH,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,GAAG,CAAC,WAAW,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;AACnG,CAAC;AAED,6EAA6E;AAE7E;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAc,EAAE,MAAc;IACpE,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACpF,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AACzD,CAAC;AASD,oGAAoG;AACpG,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,GAAW,EAAE,CAAY;IACjE,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,sBAAsB,EAAE;QACvE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;QAC3C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA6C,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAyB,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,CAAC,MAAM,qBAAqB,CAAC,CAAC;IAC/G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAuB,EACvB,OAAe,EACf,GAAW,EACX,WAA+B,EAC/B,OAA6C,EAAE;IAE/C,MAAM,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACrC,iFAAiF;IACjF,MAAM,OAAO,GAAG,WAAW,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,GAAG,CAAC,kBAAkB,CAAC,OAAyC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACnI,GAAG,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,yCAAyC,OAAO,EAAE,CAAC,CAAC;IACrJ,8EAA8E;IAC9E,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;QACvG,IAAI,CAAC;YACH,gBAAgB,CAAC,GAAG,CAAC,IAAK,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC;AAkBD,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAuB,EAAE,OAAgB,EAAE;IAC5E,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;IAC9E,MAAM,MAAM,GACV,IAAI,CAAC,MAAM;QACX,CAAC,KAAK,EAAE,MAAc,EAAE,GAAW,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAClI,MAAM,IAAI,GACR,IAAI,CAAC,IAAI;QACT,CAAC,KAAK,EAAE,CAAyC,EAAE,EAAE,CAAC,CAAC,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACzI,MAAM,SAAS,GACb,IAAI,CAAC,SAAS;QACd,CAAC,KAAK,EAAE,MAAc,EAAE,UAAkB,EAAE,SAAiB,EAAE,OAAe,EAAE,EAAE,CAChF,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAE/G,MAAM,UAAU,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,QAAQ,CAAC,EAAE,GAAG,CAAC;IAE3H,MAAM,MAAM,GAAG,KAAK,EAAE,CAAY,EAAE,OAAe,EAAE,GAAW,EAAE,WAAoB,EAAuB,EAAE;QAC7G,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACtH,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC;QAChC,IAAI,MAAM,CAAC,MAAM;YACf,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,yBAAyB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACxI,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC,EAAE;YACT,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,iBAAiB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YACnQ,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,+CAA+C,CAAC,CAAC,KAAK,IAAI,eAAe,EAAE,EAAE,CAAC;IAC/H,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,KAAK,kBAAkB,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC1D,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;gBAC1D,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW;oBAC3B,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,GAAI,EAAE,CAAC,EAAE,OAAO,CAAC;oBAC3I,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC7D,IAAI,OAAO,KAAK,UAAU;oBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;qBACvF,IAAI,OAAO,KAAK,UAAU;oBAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,sFAAsF,EAAE,CAAC,CAAC;;oBAEnK,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,+DAA+D,CAAC,CAAC,WAAW,IAAI,gBAAgB,0CAA0C,EAAE,CAAC,CAAC;YAC3N,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBACnD,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,wHAAwH,EAAE,CAAC,CAAC;oBACrM,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;gBAC9F,QAAQ,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAChF,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;gBACxD,QAAQ,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YAClE,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;gBAChE,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,KAAK,+CAA+C,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC5H,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,IAAI,KAAK,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACpI,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/lib/key-locations.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Every place on this computer that holds a Synap key for one pod.
+ *
+ * A key is not "configured" in one place. `synap connect claude-code` alone
+ * writes three copies (the CLI config, Claude Code's env, Claude Code's MCP
+ * registry); every other client `synap connect` supports keeps its own copy in
+ * its own file and format (Cursor, Codex, Windsurf, Zed, Goose, VS Code…); a
+ * shell rc may export another, and the ambient `SYNAP_HUB_API_KEY` silently
+ * beats the CLI profile. When the copies disagree, the one that wins is the one
+ * nobody looked at — so the doctor reads all of them, and says which FILE each
+ * one lives in.
+ *
+ * Two honesty rules:
+ *  - A file it cannot read or parse is reported `unchecked` ("not checked:
+ *    Zed — settings.json is not valid JSON"), never silently skipped — an
+ *    unread file is not a file with no key in it.
+ *  - `podKnown`: a key is sent to this pod (`/auth/key-state`) only when
+ *    something ties it to THIS pod — a profile / agent key recorded for this
+ *    pod URL, a client entry whose MCP URL is this pod, a shell rc / process env
+ *    that also names this pod. A key with no recorded pod (an old `agentKeys`
+ *    entry, a bare `export SYNAP_HUB_API_KEY`) may be another pod's secret, so it
+ *    is listed but never sent.
+ *
+ * Read-only. The client files to read come in as `clients` (derived from
+ * `TARGETS` by the caller); everything else is derived from `home`, so tests
+ * run on a temp HOME and never see the person's real files.
+ */
+export type KeyRole = "person" | "agent";
+export type KeyLocationKind = "profile" | "agent-key-by-pod" | "agent-key" | "pending" | "claude-settings-env" | "claude-mcp-header"
+/** An MCP entry in another client's own config file (Cursor, Codex, Zed…). */
+ | "client-config" | "shell-rc" | "process-env";
+/** How a client's config file stores its MCP servers (one parser each). */
+export type KeyFileFormat = "claude-code" | "json" | "jsonc" | "toml" | "yaml-goose";
+/** One client config file to read, for one agent surface. */
+export interface ClientKeyFile {
+    surface: string;
+    /** The tool's name, for "not checked: <tool>". */
+    tool: string;
+    file: string;
+    format: KeyFileFormat;
+}
+export interface KeyLocation {
+    kind: KeyLocationKind;
+    /** Human, ready to print: file + field. */
+    label: string;
+    /** The file it lives in (absent for the process environment). */
+    file?: string;
+    role: KeyRole;
+    /** Agent surface the key belongs to (claude-code, codex, …). */
+    surface?: string;
+    key: string;
+    /** Stored agent id, when the location records one. */
+    agentUserId?: string;
+    /** The doctor may rewrite this copy itself (shell rc files it never edits). */
+    rewritable: boolean;
+    /** Profile name, MCP server name, or line number — whatever names it inside the file. */
+    ref?: string;
+    /**
+     * Something ties this copy to THIS pod. Default true; false = the key may be
+     * another pod's, so it is never sent to this one (see the module doc).
+     */
+    podKnown?: boolean;
+}
+/** A place the doctor looked at and could NOT read — reported, never silently ✓. */
+export interface UncheckedLocation {
+    /** The tool or store: "Zed", "~/.synap/config.json". */
+    tool: string;
+    file: string;
+    reason: string;
+}
+export interface KeyInventory {
+    locations: KeyLocation[];
+    unchecked: UncheckedLocation[];
+}
+/** Strip // and /* *\/ comments and trailing commas OUTSIDE strings (JSONC). */
+export declare function stripJsonc(text: string): string;
+/** `~/…` for display. */
+export declare function tildify(file: string, home: string): string;
+export declare const SHELL_RC_FILES: string[];
+/**
+ * `SYNAP_HUB_API_KEY=…` assignments in shell rc files (export / set -x /
+ * plain), each with the `SYNAP_POD_URL` the same file sets, if any.
+ */
+export declare function shellRcAssignments(home: string): Array<{
+    file: string;
+    line: number;
+    key: string;
+    podUrl?: string;
+}>;
+/** One MCP entry found in a client file: its name, MCP URL and Bearer key. */
+interface McpEntry {
+    name: string;
+    url?: string;
+    key?: string;
+}
+/** `[mcp_servers.<name>]` tables (Codex, Grok): `url = "…"` + a `Bearer …` header line. */
+export declare function tomlEntries(text: string): McpEntry[];
+export interface CollectInput {
+    home: string;
+    podUrl: string;
+    /** `process.env.SYNAP_HUB_API_KEY` as this process sees it. */
+    envKey?: string;
+    envPodUrl?: string;
+    /** Client config files to read (derived from `TARGETS` — `clientKeyFiles()`). */
+    clients?: ClientKeyFile[];
+}
+export declare function collectKeyInventory(input: CollectInput): KeyInventory;
+/** The locations only (see {@link collectKeyInventory}). */
+export declare function collectKeyLocations(input: CollectInput): KeyLocation[];
+/**
+ * The keys this pod may be asked about: those with at least one copy tied to
+ * this pod. Every other key stays on this computer.
+ */
+export declare function keysToProbe(locations: KeyLocation[]): string[];
+/**
+ * Which file(s) put the process env key there — the settings env Claude Code
+ * injects, or a shell rc. Empty = set by something the doctor cannot see.
+ */
+export declare function envKeySetBy(locations: KeyLocation[], envKey: string): KeyLocation[];
+export {};