@synap-core/cli 1.11.0 → 1.12.2

package/dist/lib/key-locations.js

@@ -0,0 +1,326 @@
+/**
+ * Every place on this computer that holds a Synap key for one pod.
+ *
+ * A key is not "configured" in one place. `synap connect claude-code` alone
+ * writes three copies (the CLI config, Claude Code's env, Claude Code's MCP
+ * registry); every other client `synap connect` supports keeps its own copy in
+ * its own file and format (Cursor, Codex, Windsurf, Zed, Goose, VS Code…); a
+ * shell rc may export another, and the ambient `SYNAP_HUB_API_KEY` silently
+ * beats the CLI profile. When the copies disagree, the one that wins is the one
+ * nobody looked at — so the doctor reads all of them, and says which FILE each
+ * one lives in.
+ *
+ * Two honesty rules:
+ *  - A file it cannot read or parse is reported `unchecked` ("not checked:
+ *    Zed — settings.json is not valid JSON"), never silently skipped — an
+ *    unread file is not a file with no key in it.
+ *  - `podKnown`: a key is sent to this pod (`/auth/key-state`) only when
+ *    something ties it to THIS pod — a profile / agent key recorded for this
+ *    pod URL, a client entry whose MCP URL is this pod, a shell rc / process env
+ *    that also names this pod. A key with no recorded pod (an old `agentKeys`
+ *    entry, a bare `export SYNAP_HUB_API_KEY`) may be another pod's secret, so it
+ *    is listed but never sent.
+ *
+ * Read-only. The client files to read come in as `clients` (derived from
+ * `TARGETS` by the caller); everything else is derived from `home`, so tests
+ * run on a temp HOME and never see the person's real files.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import YAML from "yaml";
+const norm = (u) => u.replace(/\/+$/, "");
+/** File text, `null` ONLY when it does not exist; any other failure is a reason. */
+function readText(file) {
+    try {
+        return { ok: true, value: fs.readFileSync(file, "utf8") };
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT" || code === "ENOTDIR")
+            return { ok: true, value: null };
+        return { ok: false, reason: `could not be read (${code ?? err.message})` };
+    }
+}
+/** Strip // and /* *\/ comments and trailing commas OUTSIDE strings (JSONC). */
+export function stripJsonc(text) {
+    let out = "";
+    let i = 0;
+    let inStr = false;
+    while (i < text.length) {
+        const c = text[i];
+        if (inStr) {
+            out += c;
+            if (c === "\\") {
+                out += text[i + 1] ?? "";
+                i += 2;
+                continue;
+            }
+            if (c === '"')
+                inStr = false;
+            i++;
+            continue;
+        }
+        if (c === '"') {
+            inStr = true;
+            out += c;
+            i++;
+        }
+        else if (c === "/" && text[i + 1] === "/") {
+            while (i < text.length && text[i] !== "\n")
+                i++;
+        }
+        else if (c === "/" && text[i + 1] === "*") {
+            const end = text.indexOf("*/", i + 2);
+            i = end < 0 ? text.length : end + 2;
+        }
+        else {
+            out += c;
+            i++;
+        }
+    }
+    return out.replace(/,(\s*[}\]])/g, "$1");
+}
+function readJsonObject(file, jsonc = false) {
+    const t = readText(file);
+    if (!t.ok || t.value === null)
+        return t;
+    try {
+        const v = JSON.parse(jsonc ? stripJsonc(t.value) : t.value);
+        if (!v || typeof v !== "object" || Array.isArray(v))
+            return { ok: false, reason: "is not a JSON object" };
+        return { ok: true, value: v };
+    }
+    catch (err) {
+        return { ok: false, reason: `is not valid JSON (${err.message})` };
+    }
+}
+/** `~/…` for display. */
+export function tildify(file, home) {
+    return file.startsWith(home + path.sep) ? `~${file.slice(home.length)}` : file;
+}
+export const SHELL_RC_FILES = [".zshrc", ".zprofile", ".zshenv", ".bashrc", ".bash_profile", ".profile", ".config/fish/config.fish"];
+const assignment = (name) => [
+    new RegExp(`^(?:export\\s+)?${name}=["']?([^"'\\s]+)["']?`),
+    new RegExp(`^set\\s+-[gx]+\\s+${name}\\s+["']?([^"'\\s]+)["']?`),
+];
+/**
+ * `SYNAP_HUB_API_KEY=…` assignments in shell rc files (export / set -x /
+ * plain), each with the `SYNAP_POD_URL` the same file sets, if any.
+ */
+export function shellRcAssignments(home) {
+    const out = [];
+    for (const rel of SHELL_RC_FILES) {
+        const file = path.join(home, rel);
+        let text;
+        try {
+            text = fs.readFileSync(file, "utf8");
+        }
+        catch {
+            continue;
+        }
+        let podUrl;
+        const keys = [];
+        text.split("\n").forEach((raw, i) => {
+            const line = raw.trim();
+            if (line.startsWith("#"))
+                return;
+            const k = assignment("SYNAP_HUB_API_KEY").map((r) => line.match(r)).find(Boolean);
+            if (k?.[1] && !k[1].startsWith("$"))
+                keys.push({ line: i + 1, key: k[1] });
+            const p = assignment("SYNAP_POD_URL").map((r) => line.match(r)).find(Boolean);
+            if (p?.[1] && !p[1].startsWith("$"))
+                podUrl = p[1];
+        });
+        for (const k of keys)
+            out.push({ file, ...k, ...(podUrl ? { podUrl } : {}) });
+    }
+    return out;
+}
+const BEARER = /(?:^|Authorization:\s*)Bearer\s+([^\s"']+)/i;
+/** An entry of any JSON client shape: `{url|uri|serverUrl, headers}`, mcp-remote `args`, Zed `command.args`. */
+function jsonEntry(name, e) {
+    if (!e || typeof e !== "object")
+        return { name };
+    const o = e;
+    const strings = [];
+    for (const k of ["url", "uri", "serverUrl"])
+        if (typeof o[k] === "string")
+            strings.push(o[k]);
+    for (const args of [o.args, o.command?.args])
+        if (Array.isArray(args))
+            strings.push(...args.filter((a) => typeof a === "string"));
+    const headers = { ...(o.headers ?? {}), ...(o.http_headers ?? {}), ...(o.requestInit?.headers ?? {}) };
+    const url = strings.find((s) => /^https?:\/\//i.test(s));
+    let key;
+    for (const [h, v] of Object.entries(headers))
+        if (/^authorization$/i.test(h) && typeof v === "string")
+            key ??= v.match(BEARER)?.[1];
+    for (const s of strings)
+        key ??= /Authorization:/i.test(s) ? s.match(BEARER)?.[1] : undefined;
+    // mcp-remote keeps the header VALUE in env (`Authorization:${SYNAP_AUTH}` +
+    // `env.SYNAP_AUTH = "Bearer <key>"`) so the key is never in argv — read it there too.
+    for (const env of [o.env, o.command?.env])
+        if (env && typeof env === "object")
+            for (const v of Object.values(env))
+                if (typeof v === "string")
+                    key ??= v.match(BEARER)?.[1];
+    return { name, url, key };
+}
+const JSON_CONTAINERS = ["mcpServers", "servers", "mcp", "context_servers"];
+function jsonEntries(obj) {
+    const out = [];
+    for (const c of JSON_CONTAINERS) {
+        const box = obj[c];
+        if (box && typeof box === "object" && !Array.isArray(box))
+            for (const [name, e] of Object.entries(box))
+                out.push({ ...jsonEntry(name, e), name: `${c}.${name}` });
+    }
+    return out;
+}
+/** `[mcp_servers.<name>]` tables (Codex, Grok): `url = "…"` + a `Bearer …` header line. */
+export function tomlEntries(text) {
+    const out = [];
+    const parts = text.split(/^\s*\[([^\]\n]+)\]\s*$/m);
+    for (let i = 1; i < parts.length; i += 2) {
+        const header = parts[i].trim();
+        if (!header.startsWith("mcp_servers."))
+            continue;
+        const body = parts[i + 1] ?? "";
+        out.push({
+            name: `[${header}]`,
+            url: body.match(/^\s*url\s*=\s*"([^"]+)"/m)?.[1],
+            key: body.match(/Authorization\s*=\s*"Bearer\s+([^"\s]+)"/i)?.[1],
+        });
+    }
+    return out;
+}
+/** Goose `extensions:` (YAML): `uri` + `headers.Authorization`. */
+function gooseEntries(doc) {
+    const ext = doc?.extensions;
+    if (!ext || typeof ext !== "object")
+        return [];
+    return Object.entries(ext).map(([name, e]) => ({ ...jsonEntry(name, e), name: `extensions.${name}` }));
+}
+/** The entries of one client file, or why it could not be read. */
+function readClientEntries(c) {
+    if (c.format === "json" || c.format === "jsonc") {
+        const r = readJsonObject(c.file, c.format === "jsonc");
+        return r.ok ? { ok: true, value: r.value ? jsonEntries(r.value) : null } : r;
+    }
+    const t = readText(c.file);
+    if (!t.ok || t.value === null)
+        return t;
+    if (c.format === "toml")
+        return { ok: true, value: tomlEntries(t.value) };
+    try {
+        return { ok: true, value: gooseEntries(YAML.parse(t.value)) };
+    }
+    catch (err) {
+        return { ok: false, reason: `is not valid YAML (${err.message.split("\n")[0]})` };
+    }
+}
+export function collectKeyInventory(input) {
+    const { home } = input;
+    const pod = norm(input.podUrl);
+    const out = [];
+    const unchecked = [];
+    const configFile = path.join(home, ".synap", "config.json");
+    const cfgLabel = tildify(configFile, home);
+    const cfgRead = readJsonObject(configFile);
+    if (!cfgRead.ok)
+        unchecked.push({ tool: "Synap CLI", file: cfgLabel, reason: cfgRead.reason });
+    const cfg = (cfgRead.ok ? cfgRead.value : null) ?? {};
+    const onPod = (u) => !!u && norm(u) === pod;
+    const isPodMcp = (u) => !!u && (norm(u) === `${pod}/mcp` || norm(u).startsWith(`${pod}/mcp?`) || norm(u).startsWith(`${pod}/mcp/`));
+    // 1. Pod profiles (the person's / this computer's own key) for this pod.
+    const pods = (cfg.pods ?? {});
+    for (const [name, p] of Object.entries(pods)) {
+        if (onPod(p?.podUrl) && p.hubApiKey)
+            out.push({ kind: "profile", label: `${cfgLabel} → pods.${name}`, file: configFile, role: "person", key: p.hubApiKey, rewritable: false, ref: name, podKnown: true });
+    }
+    const byPod = (cfg.agentKeysByPod ?? {});
+    for (const [surface, map] of Object.entries(byPod)) {
+        const hit = map?.[pod] ?? Object.entries(map ?? {}).find(([u]) => norm(u) === pod)?.[1];
+        if (hit?.hubApiKey)
+            out.push({ kind: "agent-key-by-pod", label: `${cfgLabel} → agentKeysByPod.${surface}`, file: configFile, role: "agent", surface, key: hit.hubApiKey, agentUserId: hit.agentUserId, rewritable: true, podKnown: true });
+    }
+    const legacy = (cfg.agentKeys ?? {});
+    for (const [surface, k] of Object.entries(legacy)) {
+        if (!k?.hubApiKey)
+            continue;
+        if (k.podUrl && !onPod(k.podUrl))
+            continue;
+        // No recorded pod: it may be another pod's key — listed, never sent.
+        out.push({ kind: "agent-key", label: `${cfgLabel} → agentKeys.${surface}`, file: configFile, role: "agent", surface, key: k.hubApiKey, agentUserId: k.agentUserId, rewritable: true, podKnown: !!k.podUrl });
+    }
+    const pending = (cfg.pendingAgentKeys ?? {});
+    for (const [surface, map] of Object.entries(pending)) {
+        const hit = map?.[pod];
+        if (hit?.hubApiKey)
+            out.push({ kind: "pending", label: `${cfgLabel} → pendingAgentKeys.${surface}`, file: configFile, role: "agent", surface, key: hit.hubApiKey, agentUserId: hit.agentUserId, rewritable: true, podKnown: true });
+    }
+    // 3. Each client's own config file — one parser per format.
+    for (const c of input.clients ?? []) {
+        const shown = tildify(c.file, home);
+        if (c.format === "claude-code") {
+            // Claude Code: its env block (the ambient SYNAP_HUB_API_KEY inside every
+            // Claude session) and its MCP registry headers in ~/.claude.json.
+            const settings = readJsonObject(c.file);
+            if (!settings.ok)
+                unchecked.push({ tool: c.tool, file: shown, reason: settings.reason });
+            const env = ((settings.ok && settings.value?.env) || {});
+            if (env.SYNAP_HUB_API_KEY && (!env.SYNAP_POD_URL || onPod(env.SYNAP_POD_URL)))
+                out.push({ kind: "claude-settings-env", label: `${shown} → env.SYNAP_HUB_API_KEY`, file: c.file, role: "agent", surface: c.surface, key: env.SYNAP_HUB_API_KEY, rewritable: true, podKnown: onPod(env.SYNAP_POD_URL) });
+            const claudeJsonFile = path.join(home, ".claude.json");
+            const claudeJson = readJsonObject(claudeJsonFile);
+            if (!claudeJson.ok)
+                unchecked.push({ tool: c.tool, file: tildify(claudeJsonFile, home), reason: claudeJson.reason });
+            const servers = ((claudeJson.ok && claudeJson.value?.mcpServers) || {});
+            for (const [name, s] of Object.entries(servers)) {
+                const e = jsonEntry(name, s);
+                if (isPodMcp(e.url) && e.key)
+                    out.push({ kind: "claude-mcp-header", label: `${tildify(claudeJsonFile, home)} → mcpServers.${name}`, file: claudeJsonFile, role: "agent", surface: c.surface, key: e.key, rewritable: true, ref: name, podKnown: true });
+            }
+            continue;
+        }
+        const r = readClientEntries(c);
+        if (!r.ok) {
+            unchecked.push({ tool: c.tool, file: shown, reason: r.reason });
+            continue;
+        }
+        for (const e of r.value ?? []) {
+            if (!isPodMcp(e.url) || !e.key)
+                continue;
+            out.push({ kind: "client-config", label: `${shown} → ${e.name}`, file: c.file, role: "agent", surface: c.surface, key: e.key, rewritable: true, ref: e.name, podKnown: true });
+        }
+    }
+    // 4. Shell rc exports, and the process environment itself. A file that pins
+    //    ANOTHER pod is that pod's business; one that pins none is unknown.
+    for (const a of shellRcAssignments(home)) {
+        if (a.podUrl && !onPod(a.podUrl))
+            continue;
+        out.push({ kind: "shell-rc", label: `${tildify(a.file, home)}:${a.line}`, file: a.file, role: "agent", key: a.key, rewritable: false, ref: String(a.line), podKnown: onPod(a.podUrl) });
+    }
+    if (input.envKey && (!input.envPodUrl || onPod(input.envPodUrl)))
+        out.push({ kind: "process-env", label: "SYNAP_HUB_API_KEY (this shell)", role: "agent", key: input.envKey, rewritable: false, podKnown: onPod(input.envPodUrl) });
+    return { locations: out, unchecked };
+}
+/** The locations only (see {@link collectKeyInventory}). */
+export function collectKeyLocations(input) {
+    return collectKeyInventory(input).locations;
+}
+/**
+ * The keys this pod may be asked about: those with at least one copy tied to
+ * this pod. Every other key stays on this computer.
+ */
+export function keysToProbe(locations) {
+    return [...new Set(locations.filter((l) => l.podKnown !== false).map((l) => l.key))];
+}
+/**
+ * Which file(s) put the process env key there — the settings env Claude Code
+ * injects, or a shell rc. Empty = set by something the doctor cannot see.
+ */
+export function envKeySetBy(locations, envKey) {
+    return locations.filter((l) => (l.kind === "claude-settings-env" || l.kind === "shell-rc") && l.key === envKey);
+}
+//# sourceMappingURL=key-locations.js.map

package/dist/lib/key-locations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-locations.js","sourceRoot":"","sources":["../../src/lib/key-locations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,MAAM,CAAC;AAgExB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAIlD,oFAAoF;AACpF,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;QACjD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,IAAI,IAAK,GAAa,CAAC,OAAO,GAAG,EAAE,CAAC;IACxF,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,IAAI,CAAC,CAAC;YACT,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACf,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACzB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,GAAG,KAAK,CAAC;YAC7B,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,KAAK,GAAG,IAAI,CAAC;YACb,GAAG,IAAI,CAAC,CAAC;YACT,CAAC,EAAE,CAAC;QACN,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;QAClD,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACtC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,CAAC,CAAC;YACT,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAK,GAAG,KAAK;IACjD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,CAAkC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAY,CAAC;QACvE,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QAC1G,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAA4B,EAAE,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAuB,GAAa,CAAC,OAAO,GAAG,EAAE,CAAC;IAChF,CAAC;AACH,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,IAAY;IAChD,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE,0BAA0B,CAAC,CAAC;AAErI,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,mBAAmB,IAAI,wBAAwB,CAAC;IAC3D,IAAI,MAAM,CAAC,qBAAqB,IAAI,2BAA2B,CAAC;CACjE,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,GAAG,GAAwE,EAAE,CAAC;IACpF,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAClC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,MAA0B,CAAC;QAC/B,MAAM,IAAI,GAAyC,EAAE,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YAClC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,OAAO;YACjC,MAAM,CAAC,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClF,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9E,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAE7D,gHAAgH;AAChH,SAAS,SAAS,CAAC,IAAY,EAAE,CAAU;IACzC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,CAAC,GAAG,CAAwB,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC;QAAE,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;QAAE,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IACxJ,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,OAAO,IAAI,EAAE,CAAC,EAA6B,CAAC;IAClI,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,GAAuB,CAAC;IAC5B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpI,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,GAAG,KAAK,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,4EAA4E;IAC5E,sFAAsF;IACtF,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;QACvC,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAChC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAA8B,CAAC;gBAAE,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3H,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,EAAE,iBAAiB,CAAC,CAAC;AAE5E,SAAS,WAAW,CAAC,GAA4B;IAC/C,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACvD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;IACtI,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC;YAAE,SAAS;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,IAAI,MAAM,GAAG;YACnB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,EAAE,CAAC,CAAC,CAAC;YAChD,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,SAAS,YAAY,CAAC,GAAY;IAChC,MAAM,GAAG,GAAI,GAAkC,EAAE,UAAU,CAAC;IAC5D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IAC/C,OAAO,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AACpI,CAAC;AAED,mEAAmE;AACnE,SAAS,iBAAiB,CAAC,CAAgB;IACzC,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,CAAqB,CAAC;IAC5D,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC1E,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAChE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAuB,GAAa,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC/F,CAAC;AACH,CAAC;AAcD,MAAM,UAAU,mBAAmB,CAAC,KAAmB;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;IACrD,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC;IAE7I,yEAAyE;IACzE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4D,CAAC;IACzF,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS;YACjC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,QAAQ,WAAW,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACzK,CAAC;IAID,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAA2C,CAAC;IACnF,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,GAAG,EAAE,SAAS;YAChB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,QAAQ,qBAAqB,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3N,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAA2B,CAAC;IAC/D,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,CAAC,EAAE,SAAS;YAAE,SAAS;QAC5B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QAC3C,qEAAqE;QACrE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,QAAQ,gBAAgB,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/M,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAA2C,CAAC;IACvF,KAAK,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,GAAG,EAAE,SAAS;YAChB,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,QAAQ,uBAAuB,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACpN,CAAC;IAED,4DAA4D;IAC5D,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YAC/B,yEAAyE;YACzE,kEAAkE;YAClE,MAAM,QAAQ,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;YACnF,IAAI,GAAG,CAAC,iBAAiB,IAAI,CAAC,CAAC,GAAG,CAAC,aAAa,IAAI,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC3E,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,GAAG,KAAK,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,iBAAiB,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAC1N,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;YACvD,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,CAAC,CAAC;YAClD,IAAI,CAAC,UAAU,CAAC,EAAE;gBAAE,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;YACrH,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,EAAE,CAA4B,CAAC;YACnG,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC7B,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG;oBAC1B,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,iBAAiB,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9N,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAChE,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;gBAAE,SAAS;YACzC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACjL,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,wEAAwE;IACxE,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1L,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9D,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,gCAAgC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAEpK,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC;AACvC,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,KAAmB;IACrD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,SAAwB;IAClD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,SAAwB,EAAE,MAAc;IAClE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,qBAAqB,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;AAClH,CAAC"}

package/dist/lib/key-source.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Which path supplied the winning API key — report-only mirror of
+ * `resolveHubConfig`'s ladder (hub-client.ts). Does NOT resolve the key itself;
+ * callers still go through `resolveHubConfig`. This module answers "why did we
+ * get THIS key" so doctor/whoami can name the source without re-deriving
+ * precedence (and without diverging from it).
+ *
+ * The claude-code surface-over-env preference also lives here so hub-client and
+ * whoami cannot drift on that rule.
+ */
+/** Rungs of the key ladder, highest precedence first — matches resolveHubConfig steps. */
+export type KeySource = "flag" | "agent" | "env-surface" | "env" | "profile";
+export interface KeySourceInfo {
+    source: KeySource;
+    /** Concrete origin: env var name, agent name, profile name, "--pod", etc. */
+    detail?: string;
+}
+/** Human wording for each key source — used verbatim in doctor/whoami. */
+export declare const KEY_SOURCE_LABEL: Record<KeySource, string>;
+/** Ready-to-print origin, parallel to `LensFieldProvenance.origin`. */
+export declare function formatKeySource(info: KeySourceInfo): string;
+/**
+ * Prefer the claude-code surface key when it is pinned to the same pod and
+ * differs from the ambient env key. Pure — no stderr, no IO. Callers that need
+ * the swap warning (hub-client) write it themselves when `usedSurface` is true.
+ *
+ * Mirrors hub-client resolveHubConfig step 3 surface guard exactly.
+ */
+export declare function preferClaudeCodeSurfaceKey(input: {
+    envPod: string;
+    envKey: string;
+    envUser: string;
+    surface: {
+        podUrl?: string;
+        hubApiKey: string;
+        agentUserId?: string;
+    } | null | undefined;
+}): {
+    apiKey: string;
+    userId: string;
+    usedSurface: boolean;
+};
+/**
+ * Classify the winning key path given pre-read inputs. Pure and order-driven —
+ * first match wins, same ladder as `resolveHubConfig` steps 0–4.
+ */
+export declare function classifyKeySource(input: {
+    podOverride?: boolean;
+    /** Explicit command flags supplied both podUrl and apiKey. */
+    flagApiKey?: boolean;
+    agentName?: string | null;
+    envPod?: string;
+    envKey?: string;
+    envUser?: string;
+    /** True when preferClaudeCodeSurfaceKey would swap in the surface key. */
+    surfacePrefersOverEnv?: boolean;
+    profileName?: string | null;
+}): KeySourceInfo;
+/**
+ * Report which path would supply the API key for this invocation.
+ * Reads the same doors as resolveHubConfig; never returns the secret.
+ */
+export declare function resolveKeySource(opts?: {
+    podUrl?: string;
+    apiKey?: string;
+}): KeySourceInfo;

package/dist/lib/key-source.js

@@ -0,0 +1,106 @@
+/**
+ * Which path supplied the winning API key — report-only mirror of
+ * `resolveHubConfig`'s ladder (hub-client.ts). Does NOT resolve the key itself;
+ * callers still go through `resolveHubConfig`. This module answers "why did we
+ * get THIS key" so doctor/whoami can name the source without re-deriving
+ * precedence (and without diverging from it).
+ *
+ * The claude-code surface-over-env preference also lives here so hub-client and
+ * whoami cannot drift on that rule.
+ */
+import { getActivePodConfig, getPodOverride, getSurfaceAgentKey, listPodProfiles } from "./pod.js";
+import { resolveAgentOverride } from "./agents-config.js";
+/** Human wording for each key source — used verbatim in doctor/whoami. */
+export const KEY_SOURCE_LABEL = {
+    flag: "explicit flag",
+    agent: "agent override",
+    "env-surface": "claude-code surface key",
+    env: "environment variable",
+    profile: "pod profile",
+};
+/** Ready-to-print origin, parallel to `LensFieldProvenance.origin`. */
+export function formatKeySource(info) {
+    return info.detail
+        ? `${KEY_SOURCE_LABEL[info.source]}: ${info.detail}`
+        : KEY_SOURCE_LABEL[info.source];
+}
+/**
+ * Prefer the claude-code surface key when it is pinned to the same pod and
+ * differs from the ambient env key. Pure — no stderr, no IO. Callers that need
+ * the swap warning (hub-client) write it themselves when `usedSurface` is true.
+ *
+ * Mirrors hub-client resolveHubConfig step 3 surface guard exactly.
+ */
+export function preferClaudeCodeSurfaceKey(input) {
+    const s = input.surface;
+    // Trailing-slash-tolerant: surface keys and env pods are often saved with
+    // slightly different URL shapes after multi-pod connect.
+    const norm = (u) => u.replace(/\/+$/, "");
+    if (s &&
+        s.podUrl &&
+        norm(s.podUrl) === norm(input.envPod) &&
+        s.hubApiKey &&
+        s.hubApiKey !== input.envKey) {
+        return {
+            apiKey: s.hubApiKey,
+            userId: s.agentUserId || input.envUser,
+            usedSurface: true,
+        };
+    }
+    return { apiKey: input.envKey, userId: input.envUser, usedSurface: false };
+}
+/**
+ * Classify the winning key path given pre-read inputs. Pure and order-driven —
+ * first match wins, same ladder as `resolveHubConfig` steps 0–4.
+ */
+export function classifyKeySource(input) {
+    if (input.podOverride)
+        return { source: "flag", detail: "--pod" };
+    if (input.flagApiKey)
+        return { source: "flag" };
+    if (input.agentName)
+        return { source: "agent", detail: input.agentName };
+    if (input.envPod && input.envKey && input.envUser) {
+        if (input.surfacePrefersOverEnv) {
+            return { source: "env-surface", detail: "claude-code" };
+        }
+        return { source: "env", detail: "SYNAP_HUB_API_KEY" };
+    }
+    return {
+        source: "profile",
+        detail: input.profileName ?? undefined,
+    };
+}
+/**
+ * Report which path would supply the API key for this invocation.
+ * Reads the same doors as resolveHubConfig; never returns the secret.
+ */
+export function resolveKeySource(opts) {
+    const envPod = process.env.SYNAP_POD_URL;
+    const envKey = process.env.SYNAP_HUB_API_KEY;
+    const envUser = process.env.SYNAP_USER_ID;
+    // Pod-qualified lookup so a surface key for another pod never shadows env.
+    const surface = getSurfaceAgentKey("claude-code", envPod);
+    const surfacePrefersOverEnv = Boolean(envPod &&
+        envKey &&
+        envUser &&
+        preferClaudeCodeSurfaceKey({
+            envPod,
+            envKey,
+            envUser,
+            surface,
+        }).usedSurface);
+    const activeName = listPodProfiles().find((p) => p.active)?.name ?? null;
+    return classifyKeySource({
+        podOverride: Boolean(getPodOverride()),
+        flagApiKey: Boolean(opts?.podUrl && opts?.apiKey),
+        agentName: resolveAgentOverride() ? process.env.SYNAP_AGENT ?? null : null,
+        envPod,
+        envKey,
+        envUser,
+        surfacePrefersOverEnv,
+        // Only meaningful when the profile rung wins; still pass for completeness.
+        profileName: activeName ?? (getActivePodConfig() ? "default" : null),
+    });
+}
+//# sourceMappingURL=key-source.js.map

package/dist/lib/key-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-source.js","sourceRoot":"","sources":["../../src/lib/key-source.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AACnG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAW1D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,gBAAgB,GAA8B;IACzD,IAAI,EAAE,eAAe;IACrB,KAAK,EAAE,gBAAgB;IACvB,aAAa,EAAE,yBAAyB;IACxC,GAAG,EAAE,sBAAsB;IAC3B,OAAO,EAAE,aAAa;CACvB,CAAC;AAEF,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAAC,IAAmB;IACjD,OAAO,IAAI,CAAC,MAAM;QAChB,CAAC,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE;QACpD,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAK1C;IACC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IACxB,0EAA0E;IAC1E,yDAAyD;IACzD,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,IACE,CAAC;QACD,CAAC,CAAC,MAAM;QACR,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,MAAM,EAC5B,CAAC;QACD,OAAO;YACL,MAAM,EAAE,CAAC,CAAC,SAAS;YACnB,MAAM,EAAE,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO;YACtC,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAWjC;IACC,IAAI,KAAK,CAAC,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAClE,IAAI,KAAK,CAAC,UAAU;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAChD,IAAI,KAAK,CAAC,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;IACzE,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;YAChC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACxD,CAAC;IACD,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,KAAK,CAAC,WAAW,IAAI,SAAS;KACvC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA2C;IAC1E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC1C,2EAA2E;IAC3E,MAAM,OAAO,GAAG,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC1D,MAAM,qBAAqB,GAAG,OAAO,CACnC,MAAM;QACJ,MAAM;QACN,OAAO;QACP,0BAA0B,CAAC;YACzB,MAAM;YACN,MAAM;YACN,OAAO;YACP,OAAO;SACR,CAAC,CAAC,WAAW,CACjB,CAAC;IACF,MAAM,UAAU,GAAG,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IAEzE,OAAO,iBAAiB,CAAC;QACvB,WAAW,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;QACtC,UAAU,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,CAAC;QACjD,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI;QAC1E,MAAM;QACN,MAAM;QACN,OAAO;QACP,qBAAqB;QACrB,2EAA2E;QAC3E,WAAW,EAAE,UAAU,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;KACrE,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/key-state.d.ts

@@ -0,0 +1,70 @@
+/**
+ * What the pod says about ONE key — asked by its holder.
+ *
+ * `GET /api/hub/auth/key-state` answers for a key whether or not it
+ * authenticates: active, awaiting approval (+ the approval page), revoked (+
+ * why, and when/where a replacing connection was made), expired, or unknown.
+ * A pod older than that door answers 404; we then fall back to `/auth/status`,
+ * which can only say "works" or "does not work" — reported as `inactive`, never
+ * guessed into "revoked" (that guess is what sent the 2026-10-12 incident down
+ * the wrong path: the key was only awaiting approval).
+ *
+ * Also the ONE write gate: a key is persisted into a config only when the pod
+ * has not positively said it is unusable (`writeGate`).
+ */
+export type KeyStateName = "active" | "awaiting_approval" | "revoked" | "expired" | "unknown"
+/** Older pod: the key does not authenticate, and the pod cannot say why. */
+ | "inactive"
+/** The pod could not be asked (network, 5xx). Not evidence either way. */
+ | "unreachable";
+export interface KeyState {
+    state: KeyStateName;
+    keyIdPrefix?: string;
+    keyId?: string;
+    agentType?: string | null;
+    instanceId?: string | null;
+    /** The computer's name this key was made on; null = unlabelled (older CLI). */
+    instanceLabel?: string | null;
+    createdAt?: string;
+    expiresAt?: string | null;
+    approvalUrl?: string;
+    revokedAt?: string | null;
+    revokedReason?: string | null;
+    replacedBy?: {
+        createdAt: string;
+        instanceId: string | null;
+        instanceLabel?: string | null;
+    } | null;
+    /** True when the answer came from the `/auth/status` fallback (older pod). */
+    legacy?: boolean;
+    /** `unreachable`, or the HTTP refusal behind an `inactive`. */
+    error?: string;
+}
+export type FetchLike = (url: string, init?: RequestInit) => Promise<Response>;
+/** Ask the pod about `key`. Never throws. */
+export declare function fetchKeyState(podUrl: string, key: string, deps?: {
+    fetch?: FetchLike;
+    timeoutMs?: number;
+}): Promise<KeyState>;
+export type WriteGate = {
+    allow: true;
+    warning?: string;
+} | {
+    allow: false;
+    reason: string;
+};
+/**
+ * May this key be written into a config? Only a POSITIVE "unusable" refuses:
+ * pending, revoked, expired, unknown to the pod, or (older pod) rejected. An
+ * unreachable pod is not evidence — it allows, with a warning.
+ */
+export declare function writeGate(s: KeyState): WriteGate;
+/** Thrown when a caller tries to persist a key the pod says is unusable. */
+export declare class KeyNotLiveError extends Error {
+    readonly keyState: KeyState;
+    constructor(keyState: KeyState, reason: string);
+}
+/** Ask the pod, then refuse (throw) unless the key may be written. */
+export declare function assertKeyWritable(podUrl: string, key: string, deps?: {
+    fetch?: FetchLike;
+}): Promise<KeyState>;