@synap-core/cli 1.11.0 → 1.13.0

package/dist/lib/batch-approval.d.ts

@@ -0,0 +1,85 @@
+/**
+ * One-click approval for the agent keys `synap init` mints (V1 D5).
+ *
+ * Codex and Cursor each mint their agent key with `requireApproval`, and
+ * `provisionAgentKey` used to open one review page per key and block on it.
+ * Connecting both meant two pages and two clicks, one after the other.
+ *
+ * Now `init` mints every key that needs approval FIRST (deferred), opens ONE
+ * page (`/approve-agents?keys=…` on the pod admin, backed by
+ * `POST /api/hub/setup/agent/pending/approve-batch`), and polls every key
+ * until the person approves them together. The approved keys are then handed
+ * to the installers through `takePreApprovedKey`, so each installer's own
+ * `provisionAgentKey` call returns the key the person already approved instead
+ * of minting a second one.
+ *
+ * A pod older than the batch door has no `/approve-agents` page: `init`
+ * probes the batch lookup door first and, when it is missing, opens each
+ * key's own review page instead (every pod version serves those).
+ */
+import type { TargetName } from "./targets.js";
+/** How a target's installer mints its agent key — ONE table, read by both. */
+export interface KeyMintSpec {
+    agentType: string;
+    idempotent: boolean;
+}
+/**
+ * The targets whose installer mints an agent key that needs the person's
+ * approval. Claude Code mints without approval, so it is not here. The installers read their spec from this table
+ * (`installCodex` / `installCursor`), so the pre-mint cannot ask for a key the
+ * installer would not have asked for.
+ */
+export declare const TARGET_KEY_MINT: Partial<Record<TargetName, KeyMintSpec>>;
+export interface ReadyAgentKey {
+    hubApiKey: string;
+    agentUserId: string;
+}
+/** Take (once) the key already minted — and approved — for `agentType`. */
+export declare function takePreApprovedKey(agentType: string): ReadyAgentKey | undefined;
+/**
+ * Hand an installer a key that is already approved — the device flow returns
+ * one per agent the person approved with the computer (`device-connect.ts`).
+ * The installer's own `provisionAgentKey` call then takes it instead of minting,
+ * and `approveAgentKeysAtOnce` asks for nothing more for that agent.
+ */
+export declare function presetApprovedKey(agentType: string, key: ReadyAgentKey): void;
+/** The ONE review page for several pending keys, on the same origin as a single key's review URL. */
+export declare function batchReviewUrl(reviewUrl: string, keyIds: readonly string[]): string;
+/**
+ * Does this pod serve the batch approval page? Its lookup door answers 401/400
+ * without a signed-in session; a pod older than it answers 404. Unreachable
+ * reads as "no": the per-key pages work on every pod.
+ */
+export declare function podSupportsBatchApproval(podUrl: string): Promise<boolean>;
+/** One pending key, as the wait sees it. */
+export interface PendingKeyWait {
+    podUrl: string;
+    pendingKey: string;
+    pendingToken: string;
+    humanApiKey: string;
+}
+export interface BatchApprovalDeps {
+    provision?: typeof import("./targets.js").provisionAgentKey;
+    /**
+     * Wait for one pending key to go live. Default `waitForKeyLive`: it asks
+     * about the pending key WITH the pending key (`/auth/key-state`), so the
+     * wait still sees the approval when the person's own key is the one that
+     * approval just replaced (2026-10-12). Older pods: the per-key pending door.
+     */
+    wait?: (p: PendingKeyWait) => Promise<import("./key-approval.js").KeyWaitOutcome>;
+    openUrl?: (url: string) => void;
+    supportsBatch?: (podUrl: string) => Promise<boolean>;
+}
+export interface BatchApprovalResult {
+    /** Targets the person did not approve (rejected, timed out, or the mint failed). */
+    notApproved: TargetName[];
+    /** Why, per target, for the one warning line `init` prints. */
+    reasons: Partial<Record<TargetName, string>>;
+}
+/**
+ * Mint every approval-gated key for `targets`, open one page, wait for all.
+ * Returns the targets the person did NOT approve (rejected, timed out, or
+ * failed to mint): `init` skips those instead of asking again, and prints
+ * one line for each.
+ */
+export declare function approveAgentKeysAtOnce(podUrl: string, humanApiKey: string, targets: readonly TargetName[], deps?: BatchApprovalDeps): Promise<BatchApprovalResult>;

package/dist/lib/batch-approval.js

@@ -0,0 +1,170 @@
+/**
+ * One-click approval for the agent keys `synap init` mints (V1 D5).
+ *
+ * Codex and Cursor each mint their agent key with `requireApproval`, and
+ * `provisionAgentKey` used to open one review page per key and block on it.
+ * Connecting both meant two pages and two clicks, one after the other.
+ *
+ * Now `init` mints every key that needs approval FIRST (deferred), opens ONE
+ * page (`/approve-agents?keys=…` on the pod admin, backed by
+ * `POST /api/hub/setup/agent/pending/approve-batch`), and polls every key
+ * until the person approves them together. The approved keys are then handed
+ * to the installers through `takePreApprovedKey`, so each installer's own
+ * `provisionAgentKey` call returns the key the person already approved instead
+ * of minting a second one.
+ *
+ * A pod older than the batch door has no `/approve-agents` page: `init`
+ * probes the batch lookup door first and, when it is missing, opens each
+ * key's own review page instead (every pod version serves those).
+ */
+import chalk from "chalk";
+import { log } from "../utils/logger.js";
+import { openPodPage } from "./safe-open.js";
+/**
+ * The targets whose installer mints an agent key that needs the person's
+ * approval. Claude Code mints without approval, so it is not here. The installers read their spec from this table
+ * (`installCodex` / `installCursor`), so the pre-mint cannot ask for a key the
+ * installer would not have asked for.
+ */
+export const TARGET_KEY_MINT = {
+    codex: { agentType: "codex", idempotent: true },
+    cursor: { agentType: "cursor", idempotent: true },
+};
+const ready = new Map();
+/** Take (once) the key already minted — and approved — for `agentType`. */
+export function takePreApprovedKey(agentType) {
+    const key = ready.get(agentType);
+    ready.delete(agentType);
+    return key;
+}
+/**
+ * Hand an installer a key that is already approved — the device flow returns
+ * one per agent the person approved with the computer (`device-connect.ts`).
+ * The installer's own `provisionAgentKey` call then takes it instead of minting,
+ * and `approveAgentKeysAtOnce` asks for nothing more for that agent.
+ */
+export function presetApprovedKey(agentType, key) {
+    ready.set(agentType, key);
+}
+/** The ONE review page for several pending keys, on the same origin as a single key's review URL. */
+export function batchReviewUrl(reviewUrl, keyIds) {
+    const origin = new URL(reviewUrl).origin;
+    return `${origin}/approve-agents?keys=${keyIds.map(encodeURIComponent).join(",")}`;
+}
+/**
+ * Does this pod serve the batch approval page? Its lookup door answers 401/400
+ * without a signed-in session; a pod older than it answers 404. Unreachable
+ * reads as "no": the per-key pages work on every pod.
+ */
+export async function podSupportsBatchApproval(podUrl) {
+    const res = await fetch(`${podUrl.replace(/\/$/, "")}/api/hub/setup/agent/pending/lookup`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ keyIds: [] }),
+        signal: AbortSignal.timeout(10_000),
+    }).catch(() => null);
+    return res !== null && res.status !== 404;
+}
+/**
+ * Mint every approval-gated key for `targets`, open one page, wait for all.
+ * Returns the targets the person did NOT approve (rejected, timed out, or
+ * failed to mint): `init` skips those instead of asking again, and prints
+ * one line for each.
+ */
+export async function approveAgentKeysAtOnce(podUrl, humanApiKey, targets, deps = {}) {
+    const provision = deps.provision ?? (await import("./targets.js")).provisionAgentKey;
+    const wait = deps.wait ?? (await import("./key-approval.js")).waitForKeyLive;
+    const openUrl = deps.openUrl ?? (await import("./targets.js")).openBrowserUrl;
+    const supportsBatch = deps.supportsBatch ?? podSupportsBatchApproval;
+    const podBase = podUrl.replace(/\/$/, "");
+    const pending = [];
+    const notApproved = [];
+    const reasons = {};
+    for (const target of targets) {
+        const spec = TARGET_KEY_MINT[target];
+        if (!spec)
+            continue;
+        // Approved already (with the computer, in the device flow): nothing to ask.
+        if (ready.has(spec.agentType))
+            continue;
+        try {
+            const r = await provision(podUrl, humanApiKey, spec.agentType, {
+                idempotent: spec.idempotent,
+                deferApproval: true,
+            });
+            if (r.pending) {
+                pending.push({
+                    target,
+                    agentType: spec.agentType,
+                    hubApiKey: r.hubApiKey,
+                    agentUserId: r.agentUserId,
+                    ...r.pending,
+                });
+            }
+            else {
+                // Already valid (reused) or active on mint: nothing to approve.
+                ready.set(spec.agentType, { hubApiKey: r.hubApiKey, agentUserId: r.agentUserId });
+            }
+        }
+        catch (err) {
+            notApproved.push(target);
+            reasons[target] = err instanceof Error ? err.message : String(err);
+        }
+    }
+    if (pending.length === 0)
+        return { notApproved, reasons };
+    // One key keeps its own review page (which every pod version serves); so do
+    // several on a pod that predates the batch page.
+    const batch = pending.length > 1 && (await supportsBatch(podUrl));
+    const urls = batch
+        ? [batchReviewUrl(pending[0].reviewUrl, pending.map((p) => p.pendingToken))]
+        : pending.map((p) => p.reviewUrl);
+    log.blank();
+    log.info(batch
+        ? `Approve your ${pending.length} agents in one step:`
+        : pending.length > 1
+            ? `Approve each of your ${pending.length} agents:`
+            : "Approve your agent:");
+    for (const url of urls) {
+        log.dim(url);
+        // A pod-supplied link: opened only on this pod's own / pod-admin origin.
+        openPodPage(url, podUrl, openUrl);
+    }
+    process.stdout.write(chalk.dim("  Waiting for approval"));
+    const ticker = setInterval(() => process.stdout.write(chalk.dim(".")), 2000);
+    try {
+        const outcomes = await Promise.allSettled(pending.map((p) => wait({ podUrl: podBase, pendingKey: p.hubApiKey, pendingToken: p.pendingToken, humanApiKey })));
+        process.stdout.write("\n");
+        const { clearPendingAgentKey } = await import("./pod.js");
+        outcomes.forEach((o, i) => {
+            const p = pending[i];
+            const outcome = o.status === "fulfilled" ? o.value : null;
+            if (outcome === "approved") {
+                // Live now: the recorded request is done; the installer writes the key.
+                clearPendingAgentKey(p.agentType, podUrl);
+                ready.set(p.agentType, { hubApiKey: p.hubApiKey, agentUserId: p.agentUserId });
+                return;
+            }
+            notApproved.push(p.target);
+            if (outcome === "rejected") {
+                clearPendingAgentKey(p.agentType, podUrl);
+                reasons[p.target] = "It was declined on the pod.";
+            }
+            else if (outcome === "timeout") {
+                // Still filed and recorded: the next connect resumes this request.
+                reasons[p.target] = `Nobody approved it in time — approve it at ${p.reviewUrl}, then run: synap doctor --fix`;
+            }
+            else {
+                reasons[p.target] = o.status === "rejected" && o.reason instanceof Error ? o.reason.message : String(o.status === "rejected" ? o.reason : "unknown");
+            }
+        });
+    }
+    finally {
+        clearInterval(ticker);
+    }
+    const approved = pending.length - pending.filter((p) => notApproved.includes(p.target)).length;
+    if (approved > 0)
+        log.success(`Approved ${approved} agent${approved > 1 ? "s" : ""}.`);
+    return { notApproved, reasons };
+}
+//# sourceMappingURL=batch-approval.js.map

package/dist/lib/batch-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch-approval.js","sourceRoot":"","sources":["../../src/lib/batch-approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAQ7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAA6C;IACvE,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE;IAC/C,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE;CAClD,CAAC;AAOF,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;AAE/C,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,GAAkB;IACrE,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,MAAyB;IACzE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IACzC,OAAO,GAAG,MAAM,wBAAwB,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AACrF,CAAC;AASD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,MAAc;IAC3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,qCAAqC,EAAE;QACzF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QACpC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrB,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;AAC5C,CAAC;AA8BD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,WAAmB,EACnB,OAA8B,EAC9B,OAA0B,EAAE;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,cAAc,CAAC;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC;IAC9E,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,wBAAwB,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE1C,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,MAAM,WAAW,GAAiB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAmC,EAAE,CAAC;IACnD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,4EAA4E;QAC5E,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,SAAS;QACxC,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,EAAE;gBAC7D,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,aAAa,EAAE,IAAI;aACpB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC;oBACX,MAAM;oBACN,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,SAAS,EAAE,CAAC,CAAC,SAAS;oBACtB,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,GAAG,CAAC,CAAC,OAAO;iBACb,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,gEAAgE;gBAChE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACzB,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;IAE1D,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,KAAK;QAChB,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC7E,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACpC,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,GAAG,CAAC,IAAI,CACN,KAAK;QACH,CAAC,CAAC,gBAAgB,OAAO,CAAC,MAAM,sBAAsB;QACtD,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;YAClB,CAAC,CAAC,wBAAwB,OAAO,CAAC,MAAM,UAAU;YAClD,CAAC,CAAC,qBAAqB,CAC5B,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACb,yEAAyE;QACzE,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,UAAU,CACvC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAChB,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC,CAC9F,CACF,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAC1D,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACxB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;YACtB,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YAC1D,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC3B,wEAAwE;gBACxE,oBAAoB,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC1C,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC3B,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;gBAC3B,oBAAoB,CAAC,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,6BAA6B,CAAC;YACpD,CAAC;iBAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACjC,mEAAmE;gBACnE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,8CAA8C,CAAC,CAAC,SAAS,gCAAgC,CAAC;YAChH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACvJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,aAAa,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/F,IAAI,QAAQ,GAAG,CAAC;QAAE,GAAG,CAAC,OAAO,CAAC,YAAY,QAAQ,SAAS,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACvF,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC"}

package/dist/lib/box/egress.d.ts

@@ -0,0 +1,82 @@
+/**
+ * The run box's ONE way out: an HTTP(S) proxy on the provisioner, bound to the
+ * box bridge. A box has no gateway and no resolver; everything it fetches goes
+ * through here, and here decides (runbox design C4 "Egress"):
+ *
+ *   setup phase → the package registries only (PyPI, npm)
+ *   run phase   → the hosts the script declared, nothing else
+ *
+ * A name that passes is resolved HERE, every address it resolves to is checked
+ * against internal ranges (RFC1918, loopback, link-local and cloud metadata,
+ * CGNAT = the tailnet), and the connection goes to the address that was
+ * checked, never to a second lookup — so a declared host that resolves to the
+ * pod (DNS rebinding) is refused. Every refusal is recorded for the evidence
+ * bundle. The bridge firewall is the wall; this is the policy.
+ */
+import http from "node:http";
+import net from "node:net";
+export type BoxPhase = "setup" | "run";
+/** Hosts a box may reach while it installs declared packages. */
+export declare const REGISTRY_HOSTS: readonly string[];
+/** Ports a bare allow entry opens: the web only. */
+export declare const ALLOWED_PORTS: readonly number[];
+export interface BlockedEgress {
+    host: string;
+    port: number;
+    phase: BoxPhase;
+    reason: string;
+    at: string;
+}
+/**
+ * True when a box must not connect to this address. An unparsable address is
+ * forbidden: the check fails closed.
+ */
+export declare function isForbiddenAddress(ip: string): boolean;
+/** Lower-cased, trailing dot dropped, brackets of an IPv6 literal removed. */
+export declare function normalizeHost(host: string): string;
+/**
+ * `host` matches an allow entry exactly, or a `*.example.com` entry as a
+ * strict subdomain (never the apex, never a suffix like `evilexample.com`).
+ */
+export declare function hostMatches(host: string, allow: readonly string[]): boolean;
+export interface EgressPolicy {
+    phase: BoxPhase;
+    /** The script's declared hosts (the run-phase allowlist). */
+    runHosts: readonly string[];
+}
+export type EgressDecision = {
+    allow: true;
+} | {
+    allow: false;
+    reason: string;
+};
+/**
+ * The name-level decision, before any lookup. A bare entry opens the web
+ * ports (80, 443); a `host:port` entry opens that port on that host only.
+ */
+export declare function decideByName(host: string, port: number, policy: EgressPolicy): EgressDecision;
+export type Resolver = (host: string) => Promise<string[]>;
+/**
+ * The full decision: by name, then by every resolved address. Returns the ONE
+ * address to connect to, so the connection never re-resolves.
+ */
+export declare function decideEgress(host: string, port: number, policy: EgressPolicy, resolve?: Resolver): Promise<{
+    allow: true;
+    address: string;
+} | {
+    allow: false;
+    reason: string;
+}>;
+export interface EgressProxyOptions {
+    /** The policy for a box, by its address on the bridge; null = not a live box. */
+    policyFor: (sourceIp: string) => EgressPolicy | null;
+    onBlock: (sourceIp: string, block: BlockedEgress) => void;
+    resolve?: Resolver;
+    /** Connect to the checked address (tests replace it). */
+    connect?: (address: string, port: number) => net.Socket;
+}
+/**
+ * An HTTP proxy: CONNECT for HTTPS (a tunnel to the checked address), and
+ * absolute-form requests for plain HTTP. Anything else is refused.
+ */
+export declare function createEgressProxy(opts: EgressProxyOptions): http.Server;

package/dist/lib/box/egress.js

@@ -0,0 +1,264 @@
+/**
+ * The run box's ONE way out: an HTTP(S) proxy on the provisioner, bound to the
+ * box bridge. A box has no gateway and no resolver; everything it fetches goes
+ * through here, and here decides (runbox design C4 "Egress"):
+ *
+ *   setup phase → the package registries only (PyPI, npm)
+ *   run phase   → the hosts the script declared, nothing else
+ *
+ * A name that passes is resolved HERE, every address it resolves to is checked
+ * against internal ranges (RFC1918, loopback, link-local and cloud metadata,
+ * CGNAT = the tailnet), and the connection goes to the address that was
+ * checked, never to a second lookup — so a declared host that resolves to the
+ * pod (DNS rebinding) is refused. Every refusal is recorded for the evidence
+ * bundle. The bridge firewall is the wall; this is the policy.
+ */
+import dns from "node:dns/promises";
+import http from "node:http";
+import net from "node:net";
+/** Hosts a box may reach while it installs declared packages. */
+export const REGISTRY_HOSTS = [
+    "pypi.org",
+    "files.pythonhosted.org",
+    "registry.npmjs.org",
+];
+/** Ports a bare allow entry opens: the web only. */
+export const ALLOWED_PORTS = [80, 443];
+// ─── addresses ───────────────────────────────────────────────────────────────
+function v4ToInt(ip) {
+    return ip.split(".").reduce((acc, o) => (acc << 8) + Number(o), 0) >>> 0;
+}
+function inV4(ip, cidr) {
+    const [base, bits] = cidr.split("/");
+    const mask = Number(bits) === 0 ? 0 : (~0 << (32 - Number(bits))) >>> 0;
+    return (ip & mask) === (v4ToInt(base) & mask);
+}
+/** IPv4 ranges a box must never reach, whatever name led there. */
+const FORBIDDEN_V4 = [
+    "0.0.0.0/8", // "this network"
+    "10.0.0.0/8", // RFC1918: vmbr1 (the pod at 10.10.0.10) and the box bridge
+    "100.64.0.0/10", // CGNAT: the tailnet
+    "127.0.0.0/8", // loopback
+    "169.254.0.0/16", // link-local, incl. cloud metadata 169.254.169.254
+    "172.16.0.0/12", // RFC1918
+    "192.0.0.0/24", // IETF protocol assignments
+    "192.168.0.0/16", // RFC1918: the LAN, the Proxmox host
+    "198.18.0.0/15", // benchmarking
+    "224.0.0.0/4", // multicast
+    "240.0.0.0/4", // reserved, incl. broadcast
+];
+/** Expands a valid IPv6 literal to 8 hextets (zone id dropped, embedded v4 folded). */
+function v6Hextets(ip) {
+    let addr = ip.split("%")[0].toLowerCase();
+    const embedded = /^(.*:)(\d+\.\d+\.\d+\.\d+)$/.exec(addr);
+    if (embedded) {
+        if (!net.isIPv4(embedded[2]))
+            return null;
+        const n = v4ToInt(embedded[2]);
+        addr = `${embedded[1]}${(n >>> 16).toString(16)}:${(n & 0xffff).toString(16)}`;
+    }
+    const parts = addr.split("::");
+    if (parts.length > 2)
+        return null;
+    const left = parts[0] ? parts[0].split(":") : [];
+    const right = parts.length === 2 && parts[1] ? parts[1].split(":") : [];
+    const missing = 8 - left.length - right.length;
+    if (parts.length === 1 ? missing !== 0 : missing < 0)
+        return null;
+    const out = [...left, ...Array(missing).fill("0"), ...right].map((h) => parseInt(h, 16));
+    return out.every((h) => Number.isInteger(h) && h >= 0 && h <= 0xffff) ? out : null;
+}
+/**
+ * True when a box must not connect to this address. An unparsable address is
+ * forbidden: the check fails closed.
+ */
+export function isForbiddenAddress(ip) {
+    if (net.isIPv4(ip)) {
+        const n = v4ToInt(ip);
+        return FORBIDDEN_V4.some((c) => inV4(n, c));
+    }
+    if (!net.isIPv6(ip))
+        return true;
+    const h = v6Hextets(ip);
+    if (!h)
+        return true;
+    // IPv4-mapped (::ffff:a.b.c.d) and NAT64 (64:ff9b::a.b.c.d) carry a v4 address.
+    const isMapped = h.slice(0, 5).every((x) => x === 0) && h[5] === 0xffff;
+    const isNat64 = h[0] === 0x64 && h[1] === 0xff9b && h.slice(2, 6).every((x) => x === 0);
+    if (isMapped || isNat64) {
+        const v4 = `${h[6] >>> 8}.${h[6] & 0xff}.${h[7] >>> 8}.${h[7] & 0xff}`;
+        return isForbiddenAddress(v4);
+    }
+    // ::/96 holds ::, ::1 and the deprecated IPv4-compatible ::a.b.c.d: none is a public peer.
+    if (h.slice(0, 6).every((x) => x === 0))
+        return true;
+    // 6to4 (2002::/16) carries a v4 address in hextets 1-2.
+    if (h[0] === 0x2002)
+        return isForbiddenAddress(`${h[1] >>> 8}.${h[1] & 0xff}.${h[2] >>> 8}.${h[2] & 0xff}`);
+    if (h[0] === 0x2001 && h[1] === 0)
+        return true; // Teredo 2001::/32 (an obfuscated v4 inside)
+    if (h[0] === 0x2001 && h[1] === 0x0db8)
+        return true; // documentation 2001:db8::/32
+    if ((h[0] & 0xfe00) === 0xfc00)
+        return true; // fc00::/7 unique local
+    if ((h[0] & 0xffc0) === 0xfe80)
+        return true; // fe80::/10 link-local
+    if ((h[0] & 0xff00) === 0xff00)
+        return true; // multicast
+    return false;
+}
+// ─── names ───────────────────────────────────────────────────────────────────
+/** Lower-cased, trailing dot dropped, brackets of an IPv6 literal removed. */
+export function normalizeHost(host) {
+    return host.trim().toLowerCase().replace(/^\[(.*)\]$/, "$1").replace(/\.$/, "");
+}
+/**
+ * `host` matches an allow entry exactly, or a `*.example.com` entry as a
+ * strict subdomain (never the apex, never a suffix like `evilexample.com`).
+ */
+export function hostMatches(host, allow) {
+    const h = normalizeHost(host);
+    return allow.some((raw) => {
+        const a = normalizeHost(raw);
+        if (a.startsWith("*."))
+            return h.endsWith(a.slice(1)) && h.length > a.length - 1;
+        return h === a;
+    });
+}
+/** An allow entry split into its host and, when it names one, its port. */
+function splitEntry(entry) {
+    const m = /^(.*):(\d{1,5})$/.exec(entry.trim());
+    return m && !m[1].includes(":") ? { host: m[1], port: Number(m[2]) } : { host: entry, port: null };
+}
+/**
+ * The name-level decision, before any lookup. A bare entry opens the web
+ * ports (80, 443); a `host:port` entry opens that port on that host only.
+ */
+export function decideByName(host, port, policy) {
+    const h = normalizeHost(host);
+    if (net.isIP(h))
+        return { allow: false, reason: "an address literal is never allowed; declare a host name" };
+    const entries = (policy.phase === "setup" ? REGISTRY_HOSTS : policy.runHosts).map(splitEntry);
+    const named = entries.filter((e) => hostMatches(h, [e.host]));
+    if (named.length === 0) {
+        return {
+            allow: false,
+            reason: policy.phase === "setup"
+                ? "only the package registries are reachable while packages install"
+                : "not a host this script declared",
+        };
+    }
+    const portOk = named.some((e) => (e.port === null ? ALLOWED_PORTS.includes(port) : e.port === port));
+    if (!portOk)
+        return { allow: false, reason: `port ${port} is not declared for this host` };
+    return { allow: true };
+}
+const systemResolver = async (host) => (await dns.lookup(host, { all: true, verbatim: true })).map((a) => a.address);
+/**
+ * The full decision: by name, then by every resolved address. Returns the ONE
+ * address to connect to, so the connection never re-resolves.
+ */
+export async function decideEgress(host, port, policy, resolve = systemResolver) {
+    const byName = decideByName(host, port, policy);
+    if (!byName.allow)
+        return byName;
+    let addresses;
+    try {
+        addresses = await resolve(normalizeHost(host));
+    }
+    catch (err) {
+        return { allow: false, reason: `could not resolve: ${err.message}` };
+    }
+    if (addresses.length === 0)
+        return { allow: false, reason: "resolved to no address" };
+    const bad = addresses.find(isForbiddenAddress);
+    if (bad)
+        return { allow: false, reason: `resolves to an internal address (${bad})` };
+    return { allow: true, address: addresses[0] };
+}
+function sourceIpOf(sock) {
+    return (sock.remoteAddress ?? "").replace(/^::ffff:/, "");
+}
+function splitHostPort(authority, defaultPort) {
+    const m = /^(\[[^\]]+\]|[^:]+)(?::(\d+))?$/.exec(authority);
+    if (!m)
+        return null;
+    return { host: m[1], port: m[2] ? Number(m[2]) : defaultPort };
+}
+/**
+ * An HTTP proxy: CONNECT for HTTPS (a tunnel to the checked address), and
+ * absolute-form requests for plain HTTP. Anything else is refused.
+ */
+export function createEgressProxy(opts) {
+    const resolve = opts.resolve ?? systemResolver;
+    const connect = opts.connect ?? ((address, port) => net.connect({ host: address, port }));
+    async function gate(sock, host, port) {
+        const src = sourceIpOf(sock);
+        const policy = opts.policyFor(src);
+        if (!policy)
+            return { status: 403, reason: "not a running box" };
+        const d = await decideEgress(host, port, policy, resolve);
+        if (!d.allow) {
+            opts.onBlock(src, { host: normalizeHost(host), port, phase: policy.phase, reason: d.reason, at: new Date().toISOString() });
+            return { status: 403, reason: d.reason };
+        }
+        return { address: d.address };
+    }
+    const server = http.createServer(async (req, res) => {
+        let target;
+        try {
+            target = new URL(req.url ?? "");
+        }
+        catch {
+            res.writeHead(400).end("absolute-form request required\n");
+            return;
+        }
+        if (target.protocol !== "http:") {
+            res.writeHead(400).end("only http:// is proxied in absolute form; use CONNECT for https\n");
+            return;
+        }
+        const port = target.port ? Number(target.port) : 80;
+        const g = await gate(req.socket, target.hostname, port);
+        if (!("address" in g)) {
+            res.writeHead(g.status, { "content-type": "text/plain" }).end(`synap box egress refused: ${g.reason}\n`);
+            return;
+        }
+        const upstream = http.request({
+            host: g.address,
+            port,
+            method: req.method,
+            path: target.pathname + target.search,
+            headers: { ...req.headers, host: target.host },
+            createConnection: () => connect(g.address, port),
+        }, (up) => {
+            res.writeHead(up.statusCode ?? 502, up.headers);
+            up.pipe(res);
+        });
+        upstream.on("error", () => res.headersSent ? res.destroy() : res.writeHead(502).end());
+        req.pipe(upstream);
+    });
+    server.on("connect", async (req, client, head) => {
+        const hp = splitHostPort(req.url ?? "", 443);
+        if (!hp) {
+            client.end("HTTP/1.1 400 Bad Request\r\n\r\n");
+            return;
+        }
+        const g = await gate(client, hp.host, hp.port);
+        if (!("address" in g)) {
+            client.end(`HTTP/1.1 ${g.status} Forbidden\r\ncontent-type: text/plain\r\n\r\nsynap box egress refused: ${g.reason}\n`);
+            return;
+        }
+        const upstream = connect(g.address, hp.port);
+        upstream.once("connect", () => {
+            client.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+            if (head.length)
+                upstream.write(head);
+            upstream.pipe(client);
+            client.pipe(upstream);
+        });
+        upstream.on("error", () => client.destroy());
+        client.on("error", () => upstream.destroy());
+    });
+    return server;
+}
+//# sourceMappingURL=egress.js.map

package/dist/lib/box/egress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress.js","sourceRoot":"","sources":["../../../src/lib/box/egress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,GAAG,MAAM,mBAAmB,CAAC;AACpC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,GAAG,MAAM,UAAU,CAAC;AAI3B,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAsB;IAC/C,UAAU;IACV,wBAAwB;IACxB,oBAAoB;CACrB,CAAC;AAEF,oDAAoD;AACpD,MAAM,CAAC,MAAM,aAAa,GAAsB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAU1D,gFAAgF;AAEhF,SAAS,OAAO,CAAC,EAAU;IACzB,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,IAAI,CAAC,EAAU,EAAE,IAAY;IACpC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACxE,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,mEAAmE;AACnE,MAAM,YAAY,GAAG;IACnB,WAAW,EAAE,iBAAiB;IAC9B,YAAY,EAAE,4DAA4D;IAC1E,eAAe,EAAE,qBAAqB;IACtC,aAAa,EAAE,WAAW;IAC1B,gBAAgB,EAAE,mDAAmD;IACrE,eAAe,EAAE,UAAU;IAC3B,cAAc,EAAE,4BAA4B;IAC5C,gBAAgB,EAAE,qCAAqC;IACvD,eAAe,EAAE,eAAe;IAChC,aAAa,EAAE,YAAY;IAC3B,aAAa,EAAE,4BAA4B;CAC5C,CAAC;AAEF,uFAAuF;AACvF,SAAS,SAAS,CAAC,EAAU;IAC3B,IAAI,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,IAAI,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;IACjF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAS,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACjG,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACrF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACtB,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,gFAAgF;IAChF,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;IACxE,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACxF,IAAI,QAAQ,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QACvE,OAAO,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,2FAA2F;IAC3F,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,wDAAwD;IACxD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5G,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,6CAA6C;IAC7F,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,8BAA8B;IACnF,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,wBAAwB;IACrE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,uBAAuB;IACpE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,YAAY;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAEhF,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAwB;IAChE,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACjF,OAAO,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,2EAA2E;AAC3E,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACrG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,MAAoB;IAC3E,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0DAA0D,EAAE,CAAC;IAC7G,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EACJ,MAAM,CAAC,KAAK,KAAK,OAAO;gBACtB,CAAC,CAAC,kEAAkE;gBACpE,CAAC,CAAC,iCAAiC;SACxC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;IACrG,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,IAAI,gCAAgC,EAAE,CAAC;IAC3F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAID,MAAM,cAAc,GAAa,KAAK,EAAE,IAAI,EAAE,EAAE,CAC9C,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;AAEhF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,IAAY,EACZ,MAAoB,EACpB,UAAoB,cAAc;IAElC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IACjC,IAAI,SAAmB,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAuB,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;IACtF,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,GAAG,GAAG,EAAE,CAAC;IACrF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAaD,SAAS,UAAU,CAAC,IAAgB;IAClC,OAAO,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB,EAAE,WAAmB;IAC3D,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC/C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAE1F,KAAK,UAAU,IAAI,CACjB,IAAgB,EAChB,IAAY,EACZ,IAAY;QAEZ,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACjE,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5H,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAChC,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAClD,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;YAC5F,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;YACzG,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B;YACE,IAAI,EAAE,CAAC,CAAC,OAAO;YACf,IAAI;YACJ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM;YACrC,OAAO,EAAE,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;YAC9C,gBAAgB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC;SACjD,EACD,CAAC,EAAE,EAAE,EAAE;YACL,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,UAAU,IAAI,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;YAChD,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CACF,CAAC;QACF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QACvF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAyB,EAAE,MAAkB,EAAE,IAAY,EAAE,EAAE;QACzF,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,2EAA2E,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;YACxH,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7C,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YAC5B,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC5D,IAAI,IAAI,CAAC,MAAM;gBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}