@synap-core/cli 1.11.0 → 1.13.0

package/dist/lib/credential-class.js

@@ -0,0 +1,138 @@
+/**
+ * Credential class — "what is this key allowed to DO?"
+ *
+ * The ONE door for introspecting the calling key (`GET /api/hub/auth/status`)
+ * and for the single question the proposals surface needs to answer honestly:
+ * *can this credential perform a human review?*
+ *
+ * Why this exists: `synap proposals approve <id>` advertised a capability the
+ * agent key running the CLI does not have. The pod hard-rejects it with
+ * HTTP 403 "An agent credential cannot approve proposals" — see
+ * `synap-backend/.../hub-protocol/rest/_shared.ts:144-161` (`rejectAgentReviewer`).
+ * A surface that offers a verb it can never execute is the same defect class as
+ * a renderer that fails open into a plausible-looking label.
+ *
+ * ── What the server actually gates on ────────────────────────────────────────
+ * The server's predicate is `c.get("agentUserId")`, set iff the api-key row
+ * carries `linkedUserId` (hub-protocol-rest.ts:403-408) — i.e. an AGENT key
+ * whose writes are attributed to the human who created the agent.
+ * `GET /auth/status` does NOT expose `linkedUserId` or `agentUserId`
+ * (auth.ts:140-157 returns keyId/userId/userEmail/keyType/scopes/…), so the CLI
+ * CANNOT reproduce the server's predicate exactly. What it CAN see is the
+ * identity the key resolves to: an agent user is provisioned with a synthetic
+ * `agent-<type>-<short>@synap.agent` email (agent-users.ts:222,
+ * provision-agent.ts:472, intelligence.ts:1313). That domain is the proxy
+ * signal used here.
+ *
+ * Because the proxy can be wrong in the FUTURE (a human key must never be
+ * blocked), classification is deliberately three-valued and the guard is
+ * belt-and-braces:
+ *   • `agent`   — positive agent signal → refuse locally, before the network call.
+ *   • `human`   — positive human signal (`user_pat` NOT owned by an agent user) → never blocked.
+ *   • `unknown` — no signal → PROCEED, and translate the server's 403 after the
+ *                 fact (`isAgentReviewRejection`). The server stays authoritative.
+ *
+ * ── Scope: approve, not reject ───────────────────────────────────────────────
+ * `rejectAgentReviewer` is called for "approve" and "revert" ONLY. `POST
+ * /proposals/:id/reject` is INTENTIONALLY ungated (proposals.ts:437-441:
+ * "rejection only prevents a pending change from landing, so it carries no
+ * self-approval / undo risk"). So `synap proposals reject` genuinely WORKS for
+ * an agent credential and must NOT be guarded here.
+ */
+import chalk from "chalk";
+import { openAppUrl, openUrl } from "@synap-core/hub-rest-client";
+import { log } from "../utils/logger.js";
+import { hubGet, HubError } from "./hub-client.js";
+/** Introspect a key. `apiKey` overrides `cfg.apiKey` (used by `whoami` to probe both sides of a divergence). */
+export async function fetchAuthStatus(cfg, apiKey) {
+    return (await hubGet("/auth/status", {}, apiKey ? { ...cfg, apiKey } : cfg));
+}
+const agentUserIdCache = new Map();
+/**
+ * WHO this key is — the agent principal, for recognising the agent's OWN
+ * posts (a room message carries it as `routedTeammateId`). Never the acting
+ * user sent to the pod: that is `resolveUserId` (/users/me), which for an
+ * agent key answers the linked HUMAN. The id recorded with the key
+ * (`cfg.agentUserId`) wins; else the pod's key-owner answer (/auth/status),
+ * cached per key. For a person's own key both questions answer the person.
+ */
+export async function resolveAgentUserId(cfg) {
+    if (cfg.agentUserId)
+        return cfg.agentUserId;
+    const cached = agentUserIdCache.get(cfg.apiKey);
+    if (cached)
+        return cached;
+    const owner = (await fetchAuthStatus(cfg)).userId;
+    if (!owner)
+        throw new Error("The pod did not say who owns this key (GET /auth/status has no userId).");
+    agentUserIdCache.set(cfg.apiKey, owner);
+    return owner;
+}
+/** Resolve the effective identity. `apiKey` overrides `cfg.apiKey`, mirroring `fetchAuthStatus`. */
+export async function fetchEffectiveIdentity(cfg, apiKey) {
+    return (await hubGet("/users/me", {}, apiKey ? { ...cfg, apiKey } : cfg));
+}
+/** The synthetic email domain every provisioned agent user carries. */
+const AGENT_EMAIL_DOMAIN = "@synap.agent";
+export function classifyReviewer(status) {
+    if (!status)
+        return "unknown";
+    // The agent domain FIRST: the server derives the agent from the key owner's
+    // `userType === 'agent'` (access/key-identity.ts), whatever the key type, and
+    // only agent users carry the synthetic domain. The device flow mints
+    // `user_pat` keys owned by a machine agent, so keyType alone is not human.
+    const email = (status.userEmail ?? "").toLowerCase();
+    if (email.endsWith(AGENT_EMAIL_DOMAIN))
+        return "agent";
+    if (status.keyType === "user_pat")
+        return "human";
+    return "unknown";
+}
+/** Best-effort classification. A pod that is down/older must not block the command — it degrades to `unknown`. */
+export async function classifyActiveCredential(cfg) {
+    try {
+        return classifyReviewer(await fetchAuthStatus(cfg));
+    }
+    catch {
+        return "unknown";
+    }
+}
+/**
+ * Did the pod reject this call with the agent-reviewer guard?
+ *
+ * Matches `rejectAgentReviewer`'s 403 envelope (`_shared.ts:155-159`):
+ *   "An agent credential cannot approve proposals — approve is human review. …"
+ * Kept narrow (403 + the distinctive phrase) so an unrelated 403 still renders
+ * as its own error.
+ */
+export function isAgentReviewRejection(err) {
+    if (!(err instanceof HubError) || err.status !== 403)
+        return false;
+    const haystack = `${err.message} ${err.rawBody}`.toLowerCase();
+    return haystack.includes("agent credential") && haystack.includes("proposal");
+}
+/** The `synap://` deep link the desktop app registers — `synap open proposal <id>` sends exactly this (open.ts:36-38). */
+export function proposalDeepLink(id) {
+    return openAppUrl("proposal", id);
+}
+/** The pod's web review page for a bare id — the same route `bridge-setup.ts:894` and `statusline.ts:425` print. */
+export function proposalWebLink(podUrl, id) {
+    return openUrl(podUrl, id);
+}
+/**
+ * Explain why this credential cannot approve, and point at the door that works.
+ * Used both by the pre-flight guard and by the post-hoc 403 translation, so the
+ * operator sees ONE message regardless of which path caught it.
+ */
+export function renderCannotReview(id, cfg, action = "approve") {
+    log.error(`This credential cannot ${action} proposals — ${action} is human review.`);
+    log.dim("  The active key is an agent credential. The pod blocks agent self-review so an\n" +
+        "  agent cannot create-then-approve its own writes (including destructive ones).");
+    log.blank();
+    log.info("  Review it as a human instead:");
+    log.dim(`    synap open proposal ${id}        ${chalk.dim(`(${proposalDeepLink(id)})`)}`);
+    log.dim(`    ${proposalWebLink(cfg.podUrl, id)}`);
+    log.blank();
+    log.dim("  Run `synap whoami` to see which key is active.");
+}
+//# sourceMappingURL=credential-class.js.map

package/dist/lib/credential-class.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-class.js","sourceRoot":"","sources":["../../src/lib/credential-class.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAkB,MAAM,iBAAiB,CAAC;AAyCnE,gHAAgH;AAChH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAc,EAAE,MAAe;IACnE,OAAO,CAAC,MAAM,MAAM,CAAC,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAe,CAAC;AAC7F,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEnD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAc;IACrD,IAAI,GAAG,CAAC,WAAW;QAAE,OAAO,GAAG,CAAC,WAAW,CAAC;IAC5C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,KAAK,GAAG,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IACvG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAyBD,oGAAoG;AACpG,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAc,EACd,MAAe;IAEf,OAAO,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAsB,CAAC;AACjG,CAAC;AAWD,uEAAuE;AACvE,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAE1C,MAAM,UAAU,gBAAgB,CAAC,MAAqC;IACpE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,4EAA4E;IAC5E,8EAA8E;IAC9E,qEAAqE;IACrE,2EAA2E;IAC3E,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAAE,OAAO,OAAO,CAAC;IACvD,IAAI,MAAM,CAAC,OAAO,KAAK,UAAU;QAAE,OAAO,OAAO,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,kHAAkH;AAClH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAc;IAC3D,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,IAAI,CAAC,CAAC,GAAG,YAAY,QAAQ,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACnE,MAAM,QAAQ,GAAG,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAChF,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,gBAAgB,CAAC,EAAU;IACzC,OAAO,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,EAAU;IACxD,OAAO,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAU,EAAE,GAAc,EAAE,SAA+B,SAAS;IACrG,GAAG,CAAC,KAAK,CAAC,0BAA0B,MAAM,gBAAgB,MAAM,mBAAmB,CAAC,CAAC;IACrF,GAAG,CAAC,GAAG,CACL,mFAAmF;QACnF,iFAAiF,CAClF,CAAC;IACF,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,GAAG,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,WAAW,KAAK,CAAC,GAAG,CAAC,IAAI,gBAAgB,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,GAAG,CAAC,GAAG,CAAC,OAAO,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAClD,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,GAAG,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;AAC9D,CAAC"}

package/dist/lib/describe-lens.d.ts

@@ -17,6 +17,41 @@ export interface LensEntry {
     id: string;
     name?: string;
 }
+/** The rungs of the resolution ladder, highest precedence first. */
+export type LensSource = "flag" | "session" | "directory" | "env" | "global";
+/** Human wording for each rung — used verbatim in `synap lens` output. */
+export declare const LENS_SOURCE_LABEL: Record<LensSource, string>;
+/** One candidate rung. `detail` is the concrete origin (a file path, an env var name). */
+export interface LensRung {
+    source: LensSource;
+    workspaceId?: string;
+    projectId?: string;
+    focusSessionId?: string;
+    detail?: string;
+}
+export interface LensFieldProvenance {
+    id: string;
+    source: LensSource;
+    /** e.g. "/Users/x/repo/.synap/lens.json" or "SYNAP_WORKSPACE_ID". */
+    detail?: string;
+    /** "directory lens: /Users/x/repo/.synap/lens.json" — ready to print in parentheses. */
+    origin: string;
+}
+export interface LensProvenance {
+    workspace?: LensFieldProvenance;
+    project?: LensFieldProvenance;
+    session?: LensFieldProvenance;
+}
+/**
+ * Resolve each lens field to the FIRST rung that supplies it.
+ *
+ * Pure and order-driven: the caller passes rungs highest-precedence first, so
+ * this function can never disagree with the ladder in `hub-client.ts` about
+ * priority — it just reports which entry won. Rungs the caller could not
+ * evaluate (e.g. a pod-mismatched lens) are simply omitted by the caller,
+ * which is exactly how they behave in resolution.
+ */
+export declare function resolveLensProvenance(rungs: LensRung[]): LensProvenance;
 export interface ResolvedLens {
     workspace?: LensEntry;
     project?: LensEntry;

package/dist/lib/describe-lens.js

@@ -13,6 +13,46 @@
  * consumer will use neither. Callers wrap the plain names/ids this module
  * resolves in whatever presentation their surface needs.
  */
+/** Human wording for each rung — used verbatim in `synap lens` output. */
+export const LENS_SOURCE_LABEL = {
+    flag: "explicit flag",
+    session: "session lens",
+    directory: "directory lens",
+    env: "environment variable",
+    global: "global config",
+};
+/**
+ * Resolve each lens field to the FIRST rung that supplies it.
+ *
+ * Pure and order-driven: the caller passes rungs highest-precedence first, so
+ * this function can never disagree with the ladder in `hub-client.ts` about
+ * priority — it just reports which entry won. Rungs the caller could not
+ * evaluate (e.g. a pod-mismatched lens) are simply omitted by the caller,
+ * which is exactly how they behave in resolution.
+ */
+export function resolveLensProvenance(rungs) {
+    const pick = (field) => {
+        for (const rung of rungs) {
+            const id = rung[field];
+            if (!id)
+                continue;
+            return {
+                id,
+                source: rung.source,
+                detail: rung.detail,
+                origin: rung.detail
+                    ? `${LENS_SOURCE_LABEL[rung.source]}: ${rung.detail}`
+                    : LENS_SOURCE_LABEL[rung.source],
+            };
+        }
+        return undefined;
+    };
+    return {
+        workspace: pick("workspaceId"),
+        project: pick("projectId"),
+        session: pick("focusSessionId"),
+    };
+}
 function describeField(entry) {
     if (!entry?.id)
         return undefined;

package/dist/lib/describe-lens.js.map

@@ -1 +1 @@
-{"version":3,"file":"describe-lens.js","sourceRoot":"","sources":["../../src/lib/describe-lens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgCH,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,CAAC,KAAK,EAAE,EAAE;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAkB;IAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC;IAEvC,MAAM,KAAK,GAA2B;QACpC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;QAC3F,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;QAC/E,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;KAChF,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC;AACzE,CAAC"}
+{"version":3,"file":"describe-lens.js","sourceRoot":"","sources":["../../src/lib/describe-lens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgBH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAA+B;IAC3D,IAAI,EAAE,eAAe;IACrB,OAAO,EAAE,cAAc;IACvB,SAAS,EAAE,gBAAgB;IAC3B,GAAG,EAAE,sBAAsB;IAC3B,MAAM,EAAE,eAAe;CACxB,CAAC;AA0BF;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAiB;IACrD,MAAM,IAAI,GAAG,CAAC,KAAqD,EAAmC,EAAE;QACtG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,OAAO;gBACL,EAAE;gBACF,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACjB,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE;oBACrD,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;aACnC,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,aAAa,CAAC;QAC9B,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC;QAC1B,OAAO,EAAE,IAAI,CAAC,gBAAgB,CAAC;KAChC,CAAC;AACJ,CAAC;AA2BD,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,CAAC,KAAK,EAAE,EAAE;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAkB;IAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC;IAEvC,MAAM,KAAK,GAA2B;QACpC,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,cAAc,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE;QAC3F,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;QAC/E,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,IAAI,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;KAChF,CAAC;IAEF,OAAO,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC;AACzE,CAAC"}

package/dist/lib/device-connect.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Connect THIS computer to a pod — the pod-side device flow (RFC 8628,
+ * MACHINE-IDENTITY-PLAN §4). The only way `synap init` and `synap login` get a
+ * credential for a pod, on self-hosted and managed pods alike.
+ *
+ *   1. POST {pod}/api/hub/setup/device        → a user code + where to enter it
+ *   2. the person opens the link on any device, signs in to the pod, approves
+ *      the computer and the agents it asked for (one decision)
+ *   3. POST {pod}/api/hub/setup/device/token  → 400 RFC 8628 errors until then,
+ *      then ONCE: the computer's key + one key per approved agent
+ *
+ * The computer gets its OWN governed principal ("devbox"); each agent is a
+ * distinct agent on that computer ("Claude Code on devbox"). Nothing here needs
+ * a Synap account session, a browser on this machine, or a loopback port.
+ */
+/**
+ * The agent types the device door accepts (`SURFACE_AGENT_TYPES`,
+ * synap-backend `routers/hub-protocol/rest/setup.ts`). A mirror: the CLI does
+ * not depend on the backend package. A type outside it would 400 the whole
+ * request, so it is filtered out before asking.
+ */
+export declare const DEVICE_AGENT_TYPES: readonly ["claude-code", "claude-desktop", "cursor", "raycast", "codex", "openwebui", "discord", "proton", "generic"];
+export type DeviceAgentType = (typeof DEVICE_AGENT_TYPES)[number];
+/** The pod's cap on agents per request (`DEVICE_MAX_AGENTS`). */
+export declare const DEVICE_MAX_AGENTS = 8;
+/** The agents of `targets` the device door can approve, deduped, capped. */
+export declare function deviceAgentsFor(targets: readonly string[]): DeviceAgentType[];
+export interface DeviceKey {
+    apiKey: string;
+    keyId: string;
+    /** ISO time the key stops working, or null when it never expires. */
+    expiresAt: string | null;
+}
+export interface DeviceGrant {
+    computer: DeviceKey & {
+        id: string;
+        name: string;
+    };
+    agents: Array<DeviceKey & {
+        agentType: string;
+        agentUserId: string;
+        name: string;
+        displayName: string;
+    }>;
+}
+export type DeviceConnectOutcome = {
+    status: "approved";
+    grant: DeviceGrant;
+} | {
+    status: "denied";
+    message: string;
+} | {
+    status: "expired";
+    message: string;
+};
+/** The pod could not start a request (an older pod has no device door: 404). */
+export declare class DeviceStartError extends Error {
+    readonly status: number | null;
+    constructor(status: number | null, message: string);
+}
+export interface DeviceConnectDeps {
+    /** Terminal QR renderer; default the one Relay pairing uses. */
+    renderQr?: (text: string) => Promise<string>;
+    /** Shared poll loop; injectable so a test can shrink the clock. */
+    poll?: typeof import("./approval-poll.js").pollForApproval;
+    /** Multiply every server interval/expiry (tests only). Default 1. */
+    timeScale?: number;
+}
+/**
+ * Ask the pod to connect this computer, show the person where to approve it,
+ * and wait — honouring the pod's `interval` and `slow_down` — until it is
+ * approved, denied, or the code expires. Throws `DeviceStartError` only when
+ * the request could not be started at all.
+ */
+export declare function deviceConnect(podUrl: string, opts: {
+    agents: readonly string[];
+    clientName?: string;
+    hostname?: string;
+    platform?: string;
+}, deps?: DeviceConnectDeps): Promise<DeviceConnectOutcome>;
+/** Renew a computer key this close to (or past) its expiry. */
+export declare const COMPUTER_KEY_RENEW_DAYS = 7;
+/**
+ * True when a saved computer key expires within `COMPUTER_KEY_RENEW_DAYS`, or
+ * already has. A credential with no recorded expiry (a pasted key, an old
+ * operator key) is never "due": nothing says it expires.
+ */
+export declare function computerKeyNeedsRenewal(config: {
+    keyExpiresAt?: string | null;
+}, now?: number): boolean;
+/**
+ * Keep what the device flow returned, once, where each reader already looks:
+ *   - the computer's key → the pod profile `name` (it IS the CLI's identity
+ *     for this pod now), with its expiry so it can be renewed in time;
+ *   - each agent's key → the surface key store (`agentKeys`) AND the
+ *     pre-approved slot its installer takes from, so `synap connect`'s own
+ *     installer writes it into Claude Code / Codex / Cursor instead of minting.
+ * Fields of an existing profile (label, podId) are kept.
+ */
+export declare function saveDeviceGrant(podUrl: string, grant: DeviceGrant, profile: {
+    name: string;
+    podId?: string;
+}): Promise<import("./pod.js").LocalPodConfig>;
+/** The approved agents this CLI has an installer for, as `synap connect` targets. */
+export declare function approvedTargets(grant: DeviceGrant): Promise<import("./targets.js").TargetName[]>;
+/**
+ * Write each approved agent's own key into its client config — the same
+ * installers (`connectAgentsBatch` → `installForTarget`) `synap init` uses —
+ * for the callers that have no agents step of their own (`synap login`,
+ * reconnect, renewal).
+ */
+export declare function wireApprovedAgents(podUrl: string, computerKey: string, grant: DeviceGrant): Promise<void>;
+/**
+ * Connect this computer to `podUrl` and save the result under profile `name`:
+ * the device flow, then `saveDeviceGrant`, then the agents' configs. The agents
+ * asked for are the ones found on this machine. Returns the saved profile, or
+ * null after printing why (denied, expired, or the pod can't do it).
+ */
+export declare function connectThisComputer(podUrl: string, profile: {
+    name: string;
+    podId?: string;
+}, opts?: {
+    agents?: readonly string[];
+    wireAgents?: boolean;
+}): Promise<import("./pod.js").LocalPodConfig | null>;

package/dist/lib/device-connect.js

@@ -0,0 +1,256 @@
+/**
+ * Connect THIS computer to a pod — the pod-side device flow (RFC 8628,
+ * MACHINE-IDENTITY-PLAN §4). The only way `synap init` and `synap login` get a
+ * credential for a pod, on self-hosted and managed pods alike.
+ *
+ *   1. POST {pod}/api/hub/setup/device        → a user code + where to enter it
+ *   2. the person opens the link on any device, signs in to the pod, approves
+ *      the computer and the agents it asked for (one decision)
+ *   3. POST {pod}/api/hub/setup/device/token  → 400 RFC 8628 errors until then,
+ *      then ONCE: the computer's key + one key per approved agent
+ *
+ * The computer gets its OWN governed principal ("devbox"); each agent is a
+ * distinct agent on that computer ("Claude Code on devbox"). Nothing here needs
+ * a Synap account session, a browser on this machine, or a loopback port.
+ */
+import os from "os";
+import chalk from "chalk";
+import { log } from "../utils/logger.js";
+/**
+ * The agent types the device door accepts (`SURFACE_AGENT_TYPES`,
+ * synap-backend `routers/hub-protocol/rest/setup.ts`). A mirror: the CLI does
+ * not depend on the backend package. A type outside it would 400 the whole
+ * request, so it is filtered out before asking.
+ */
+export const DEVICE_AGENT_TYPES = [
+    "claude-code",
+    "claude-desktop",
+    "cursor",
+    "raycast",
+    "codex",
+    "openwebui",
+    "discord",
+    "proton",
+    "generic",
+];
+/** The pod's cap on agents per request (`DEVICE_MAX_AGENTS`). */
+export const DEVICE_MAX_AGENTS = 8;
+/** The agents of `targets` the device door can approve, deduped, capped. */
+export function deviceAgentsFor(targets) {
+    const ok = targets.filter((t) => DEVICE_AGENT_TYPES.includes(t));
+    return [...new Set(ok)].slice(0, DEVICE_MAX_AGENTS);
+}
+/** The pod could not start a request (an older pod has no device door: 404). */
+export class DeviceStartError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = "DeviceStartError";
+    }
+}
+const podHost = (podUrl) => {
+    try {
+        return new URL(podUrl).host;
+    }
+    catch {
+        return podUrl;
+    }
+};
+/**
+ * Ask the pod to connect this computer, show the person where to approve it,
+ * and wait — honouring the pod's `interval` and `slow_down` — until it is
+ * approved, denied, or the code expires. Throws `DeviceStartError` only when
+ * the request could not be started at all.
+ */
+export async function deviceConnect(podUrl, opts, deps = {}) {
+    const base = podUrl.replace(/\/+$/, "");
+    const scale = deps.timeScale ?? 1;
+    const host = podHost(base);
+    let res;
+    try {
+        res = await fetch(`${base}/api/hub/setup/device`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                clientName: opts.clientName ?? "Synap CLI",
+                hostname: (opts.hostname ?? os.hostname()).slice(0, 253) || "computer",
+                platform: opts.platform ?? process.platform,
+                agents: deviceAgentsFor(opts.agents),
+            }),
+            signal: AbortSignal.timeout(15_000),
+        });
+    }
+    catch (err) {
+        throw new DeviceStartError(null, `Could not reach ${host}: ${err.message}`);
+    }
+    if (!res.ok) {
+        const body = (await res.json().catch(() => null));
+        throw new DeviceStartError(res.status, res.status === 404
+            ? `${host} cannot connect a computer yet (it needs an update).`
+            : `${host} could not start the request (HTTP ${res.status})${body?.error_description ? `: ${body.error_description}` : "."}`);
+    }
+    const auth = (await res.json());
+    // The instruction comes FIRST and stays on screen: on a headless box (SSH)
+    // there is no browser to open — the person uses their phone or laptop.
+    log.blank();
+    console.log(`  Open ${chalk.cyan.bold(auth.verification_uri)} on any device and enter ${chalk.bold(auth.user_code)}`);
+    if (auth.verification_uri_complete) {
+        log.dim(`Or open: ${auth.verification_uri_complete}`);
+        try {
+            const qr = await (deps.renderQr ?? (await import("./pair-link.js")).renderTerminalQr)(auth.verification_uri_complete);
+            console.log("\n" + qr);
+        }
+        catch {
+            // The link above is enough; a QR is a convenience.
+        }
+    }
+    const minutes = Math.max(1, Math.round(auth.expires_in / 60));
+    log.dim(`Waiting for you to approve this computer on ${host} (the code lasts ${minutes} min)…`);
+    const poll = deps.poll ?? (await import("./approval-poll.js")).pollForApproval;
+    let lastError;
+    try {
+        const grant = await poll({
+            url: `${base}/api/hub/setup/device/token`,
+            method: "POST",
+            body: JSON.stringify({ device_code: auth.device_code }),
+            readErrorBodies: true,
+            intervalMs: (auth.interval ?? 5) * 1000 * scale,
+            timeoutMs: auth.expires_in * 1000 * scale,
+            isApproved: (d) => typeof d.access_token === "string",
+            isRejected: (d) => {
+                const e = d.error;
+                if (e === "access_denied" || e === "expired_token" || e === "invalid_grant") {
+                    lastError = e;
+                    return true;
+                }
+                return false;
+            },
+            // RFC 8628 §3.5: slow_down adds to the interval for the rest of the wait.
+            nextIntervalMs: (d, current) => {
+                const body = d;
+                if (body.error !== "slow_down")
+                    return current;
+                return typeof body.interval === "number" ? body.interval * 1000 * scale : current + 5000 * scale;
+            },
+            onApproved: (d) => {
+                const b = d;
+                return { computer: b.computer, agents: b.agents ?? [] };
+            },
+        });
+        return { status: "approved", grant };
+    }
+    catch {
+        if (lastError === "access_denied")
+            return { status: "denied", message: `Denied on ${host}.` };
+        return { status: "expired", message: "Code expired — run again." };
+    }
+}
+/** Renew a computer key this close to (or past) its expiry. */
+export const COMPUTER_KEY_RENEW_DAYS = 7;
+/**
+ * True when a saved computer key expires within `COMPUTER_KEY_RENEW_DAYS`, or
+ * already has. A credential with no recorded expiry (a pasted key, an old
+ * operator key) is never "due": nothing says it expires.
+ */
+export function computerKeyNeedsRenewal(config, now = Date.now()) {
+    if (!config.keyExpiresAt)
+        return false;
+    const at = Date.parse(config.keyExpiresAt);
+    if (Number.isNaN(at))
+        return false;
+    return at - now < COMPUTER_KEY_RENEW_DAYS * 24 * 60 * 60 * 1000;
+}
+/**
+ * Keep what the device flow returned, once, where each reader already looks:
+ *   - the computer's key → the pod profile `name` (it IS the CLI's identity
+ *     for this pod now), with its expiry so it can be renewed in time;
+ *   - each agent's key → the surface key store (`agentKeys`) AND the
+ *     pre-approved slot its installer takes from, so `synap connect`'s own
+ *     installer writes it into Claude Code / Codex / Cursor instead of minting.
+ * Fields of an existing profile (label, podId) are kept.
+ */
+export async function saveDeviceGrant(podUrl, grant, profile) {
+    const pod = await import("./pod.js");
+    const { presetApprovedKey } = await import("./batch-approval.js");
+    const prior = pod.listPodProfiles().find((p) => p.name === profile.name)?.config;
+    const podId = profile.podId ?? prior?.podId;
+    const config = {
+        ...prior,
+        podUrl,
+        ...(podId ? { podId } : {}),
+        workspaceId: prior?.workspaceId ?? "",
+        agentUserId: grant.computer.id,
+        hubApiKey: grant.computer.apiKey,
+        credential: "computer",
+        computerName: grant.computer.name,
+        savedAt: new Date().toISOString(),
+    };
+    if (grant.computer.expiresAt)
+        config.keyExpiresAt = grant.computer.expiresAt;
+    else
+        delete config.keyExpiresAt;
+    pod.addPodProfile(profile.name, config);
+    for (const a of grant.agents) {
+        if (pod.SURFACE_NAMES.includes(a.agentType)) {
+            pod.setSurfaceAgentKey(a.agentType, {
+                hubApiKey: a.apiKey,
+                agentUserId: a.agentUserId,
+                podUrl,
+            });
+        }
+        presetApprovedKey(a.agentType, { hubApiKey: a.apiKey, agentUserId: a.agentUserId });
+    }
+    return config;
+}
+/** The approved agents this CLI has an installer for, as `synap connect` targets. */
+export async function approvedTargets(grant) {
+    const { isTargetName } = await import("./targets.js");
+    return grant.agents.map((a) => a.agentType).filter(isTargetName);
+}
+/**
+ * Write each approved agent's own key into its client config — the same
+ * installers (`connectAgentsBatch` → `installForTarget`) `synap init` uses —
+ * for the callers that have no agents step of their own (`synap login`,
+ * reconnect, renewal).
+ */
+export async function wireApprovedAgents(podUrl, computerKey, grant) {
+    const targets = await approvedTargets(grant);
+    if (targets.length === 0)
+        return;
+    const { connectAgentsBatch } = await import("./agent-door.js");
+    await connectAgentsBatch({ podUrl, apiKey: computerKey }, targets, {});
+}
+/**
+ * Connect this computer to `podUrl` and save the result under profile `name`:
+ * the device flow, then `saveDeviceGrant`, then the agents' configs. The agents
+ * asked for are the ones found on this machine. Returns the saved profile, or
+ * null after printing why (denied, expired, or the pod can't do it).
+ */
+export async function connectThisComputer(podUrl, profile, opts = {}) {
+    let agents = opts.agents;
+    if (!agents) {
+        const { detectAgents } = await import("./agent-detect.js");
+        agents = detectAgents()
+            .filter((r) => r.found)
+            .map((r) => r.target);
+    }
+    let outcome;
+    try {
+        outcome = await deviceConnect(podUrl, { agents });
+    }
+    catch (err) {
+        log.error(err instanceof Error ? err.message : String(err));
+        return null;
+    }
+    if (outcome.status !== "approved") {
+        log.error(outcome.message);
+        return null;
+    }
+    const config = await saveDeviceGrant(podUrl, outcome.grant, profile);
+    log.success(`${outcome.grant.computer.name} connected to ${podHost(podUrl)}`);
+    if (opts.wireAgents !== false)
+        await wireApprovedAgents(podUrl, config.hubApiKey, outcome.grant);
+    return config;
+}
+//# sourceMappingURL=device-connect.js.map

package/dist/lib/device-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-connect.js","sourceRoot":"","sources":["../../src/lib/device-connect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,aAAa;IACb,gBAAgB;IAChB,QAAQ;IACR,SAAS;IACT,OAAO;IACP,WAAW;IACX,SAAS;IACT,QAAQ;IACR,SAAS;CACD,CAAC;AAGX,iEAAiE;AACjE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAEnC,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,OAA0B;IACxD,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAwB,EAAE,CACnD,kBAAwC,CAAC,QAAQ,CAAC,CAAC,CAAC,CACtD,CAAC;IACF,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;AACtD,CAAC;AAmBD,gFAAgF;AAChF,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IADX,YACW,MAAqB,EAC9B,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAe;QAI9B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAoBD,MAAM,OAAO,GAAG,CAAC,MAAc,EAAU,EAAE;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,IAA8F,EAC9F,OAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3B,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,uBAAuB,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,WAAW;gBAC1C,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,UAAU;gBACtE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;gBAC3C,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;aACrC,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CAAC,IAAI,EAAE,mBAAmB,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAA0C,CAAC;QAC3F,MAAM,IAAI,gBAAgB,CACxB,GAAG,CAAC,MAAM,EACV,GAAG,CAAC,MAAM,KAAK,GAAG;YAChB,CAAC,CAAC,GAAG,IAAI,sDAAsD;YAC/D,CAAC,CAAC,GAAG,IAAI,sCAAsC,GAAG,CAAC,MAAM,IAAI,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAC/H,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC;IAEvD,2EAA2E;IAC3E,uEAAuE;IACvE,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,OAAO,CAAC,GAAG,CACT,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,4BAA4B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CACzG,CAAC;IACF,IAAI,IAAI,CAAC,yBAAyB,EAAE,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,yBAAyB,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CACnF,IAAI,CAAC,yBAAyB,CAC/B,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;QACrD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,CAAC,+CAA+C,IAAI,oBAAoB,OAAO,QAAQ,CAAC,CAAC;IAEhG,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,eAAe,CAAC;IAC/E,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAc;YACpC,GAAG,EAAE,GAAG,IAAI,6BAA6B;YACzC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YACvD,eAAe,EAAE,IAAI;YACrB,UAAU,EAAE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,KAAK;YAC/C,SAAS,EAAE,IAAI,CAAC,UAAU,GAAG,IAAI,GAAG,KAAK;YACzC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAQ,CAAgC,CAAC,YAAY,KAAK,QAAQ;YACrF,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChB,MAAM,CAAC,GAAI,CAAwB,CAAC,KAAK,CAAC;gBAC1C,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,KAAK,eAAe,EAAE,CAAC;oBAC5E,SAAS,GAAG,CAAC,CAAC;oBACd,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;YACD,0EAA0E;YAC1E,cAAc,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE;gBAC7B,MAAM,IAAI,GAAG,CAA0C,CAAC;gBACxD,IAAI,IAAI,CAAC,KAAK,KAAK,WAAW;oBAAE,OAAO,OAAO,CAAC;gBAC/C,OAAO,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,GAAG,KAAK,CAAC;YACnG,CAAC;YACD,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE;gBAChB,MAAM,CAAC,GAAG,CAA0E,CAAC;gBACrF,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;YAC1D,CAAC;SACF,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,SAAS,KAAK,eAAe;YAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,IAAI,GAAG,EAAE,CAAC;QAC9F,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IACrE,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAwC,EACxC,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,IAAI,CAAC,MAAM,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,EAAE,GAAG,GAAG,GAAG,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,KAAkB,EAClB,OAAyC;IAEzC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACjF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,KAAK,CAAC;IAC5C,MAAM,MAAM,GAAsC;QAChD,GAAG,KAAK;QACR,MAAM;QACN,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,WAAW,EAAE,KAAK,EAAE,WAAW,IAAI,EAAE;QACrC,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE;QAC9B,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM;QAChC,UAAU,EAAE,UAAU;QACtB,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;QACjC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC;IACF,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS;QAAE,MAAM,CAAC,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;;QACxE,OAAO,MAAM,CAAC,YAAY,CAAC;IAChC,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAExC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7B,IAAK,GAAG,CAAC,aAAmC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,SAA2C,EAAE;gBACpE,SAAS,EAAE,CAAC,CAAC,MAAM;gBACnB,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,iBAAiB,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAkB;IACtD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,WAAmB,EACnB,KAAkB;IAElB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC/D,MAAM,kBAAkB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,OAAyC,EACzC,OAA6D,EAAE;IAE/D,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC3D,MAAM,GAAG,YAAY,EAAE;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;aACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,OAA6B,CAAC;IAClC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAClC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACrE,GAAG,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,iBAAiB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK;QAAE,MAAM,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACjG,OAAO,MAAM,CAAC;AAChB,CAAC"}