@withbuddi/buddi 0.1.0-pre.37 → 0.1.0-pre.39

package/packages/gateway/dist/web/{tailscale.js → access/tailscale.js}

@@ -52,7 +52,8 @@ import { execFile } from 'node:child_process';
 import { accessSync, constants, existsSync, statSync } from 'node:fs';
 import { request } from 'node:http';
 import { delimiter, isAbsolute, join } from 'node:path';
-import { isLoopbackAddress } from './http.js';
+import { isLoopbackAddress } from '../http.js';
+import { arrivalOf } from './arrival.js';
 /** The key this setting is stored under in `core.web_settings`. */
 export const TAILSCALE_SETTING_KEY = 'tailscale';
 /**
@@ -134,7 +135,8 @@ function header(req, name) {
  */
 export function proxiedThroughTailscale(req) {
     return (header(req, 'tailscale-user-login') !== undefined &&
-        isLoopbackAddress(req.socket.remoteAddress) &&
+        arrivalOf(req) === 'main' &&
+        isLoopbackAddress(req.socket?.remoteAddress) &&
         isTailnetAddress(forwardedAddress(req)));
 }
 /** Two logins are the same person when they differ only in case. */
@@ -230,7 +232,9 @@ export async function tailscaleIdentity(req, deps) {
         return complain(deps, 'setting-off', at);
     // The proxy is a process on this machine. A request that arrives from
     // anywhere else and spells these headers is a stranger, not Serve.
-    if (!isLoopbackAddress(req.socket.remoteAddress))
+    // Serve points at the main listener. The same headers on the ingress
+    // listener or a relay frame are not Serve's, loopback socket or not.
+    if (!isLoopbackAddress(req.socket?.remoteAddress) || arrivalOf(req) !== 'main')
         return complain(deps, 'not-this-machine', at);
     // A list, or a second header line, means a proxy that appends — not Serve,
     // which overwrites. See `forwardedAddress`.
@@ -599,4 +603,115 @@ export function toTailscaleSetting(value) {
     const login = typeof row.login === 'string' ? row.login.trim() : '';
     return { enabled: row.enabled === true && login !== '', login };
 }
+/* ------------------------------------------------------------------ *
+ * Provider 1 (specs/trusted-access.md §4)
+ * ------------------------------------------------------------------ */
+/**
+ * How long a session established through Tailscale may live however much it
+ * is used: seven days, as before the provider interface.
+ */
+export const TAILSCALE_ABSOLUTE_CAP_MS = 7 * 24 * 60 * 60_000;
+/**
+ * The command that publishes this dashboard on the tailnet, with this
+ * installation's own numbers in it: the HTTPS port of the configured public
+ * origin, and the port the gateway is actually listening on.
+ */
+export function tailscaleServeCommand(dashboardPort, publicOrigin) {
+    let https = 443;
+    if (publicOrigin) {
+        try {
+            const port = new URL(publicOrigin).port;
+            if (port !== '')
+                https = Number(port);
+        }
+        catch { /* a bad public origin names no port */ }
+    }
+    return `tailscale serve --bg --https=${https} http://127.0.0.1:${dashboardPort}`;
+}
+/**
+ * Tailscale behind the provider interface. A move, not a change: the five
+ * checks of `tailscaleIdentity` are its `identify`, the per-request whois is
+ * its `confirm`, and its requests arrive on the main listener, where
+ * `tailscale serve` has always pointed.
+ */
+export function tailscaleProvider(deps) {
+    const identify = async (req, setting, now) => {
+        let refusal;
+        const identity = await tailscaleIdentity(req, {
+            setting: async () => setting,
+            whois: deps.whois,
+            log: deps.log,
+            now: () => now,
+            onRefusal: (reason) => { refusal = reason; },
+        });
+        if (identity) {
+            return {
+                ok: true,
+                identity: {
+                    provider: 'tailscale',
+                    subject: identity.login,
+                    name: identity.name,
+                    detail: { address: identity.address, name: identity.name },
+                    bucket: `tailnet:${identity.address}`,
+                },
+            };
+        }
+        // No `Tailscale-User-Login` at all: the request claimed nothing.
+        if (refusal === undefined)
+            return null;
+        return {
+            ok: false,
+            refusal,
+            sentence: tailscaleRefusalReason(refusal),
+            kind: isUnansweredRefusal(refusal) ? 'unanswered' : isLoginRefusal(refusal) ? 'login' : 'other',
+        };
+    };
+    return {
+        id: 'tailscale',
+        title: 'Tailscale',
+        identity: 'login',
+        proxy: 'this-machine',
+        arrival: 'main',
+        settingKey: TAILSCALE_SETTING_KEY,
+        absoluteCapMs: TAILSCALE_ABSOLUTE_CAP_MS,
+        parseSetting: toTailscaleSetting,
+        enabled: (setting) => setting.enabled,
+        allowed: (setting) => setting.login,
+        async status(setting) {
+            if (!setting.enabled)
+                return { state: 'off', sentence: 'Off. Sign in from your tailnet, with the login you use for Tailscale.' };
+            const daemon = await deps.self().catch(() => ({ available: false, self: null }));
+            if (!daemon.available) {
+                return { state: 'unanswered', sentence: `On for ${setting.login}, but Tailscale is not running on this machine, so nobody can sign in this way.` };
+            }
+            return { state: 'ready', sentence: `On for ${setting.login}` };
+        },
+        setup(_setting, ctx) {
+            return {
+                steps: [{
+                        text: 'Anyone signed in to Tailscale as this login, on any device in your tailnet, is signed in to buddi. The proxy must run on this machine:',
+                        command: tailscaleServeCommand(ctx.dashboardPort(), ctx.publicOrigin()),
+                    }],
+                fields: [{ key: 'login', label: 'Tailscale login', placeholder: 'you@example.com' }],
+            };
+        },
+        // Serve points at the main listener and says so with its own header;
+        // the header only narrows which provider is asked, never grants.
+        matches: (req) => arrivalOf(req) === 'main' && req.headers['tailscale-user-login'] !== undefined,
+        identify,
+        async confirm(session, req, setting, now) {
+            const result = await identify(req, setting, now);
+            if (result?.ok && sameLogin(result.identity.subject, session.providerSubject))
+                return { answer: 'keep' };
+            // "Could not ask" is not an answer: the session stays, this request waits.
+            if (result && !result.ok && result.kind === 'unanswered')
+                return { answer: 'unanswered', refusal: result };
+            return { answer: 'end', refusal: result && !result.ok ? result : undefined };
+        },
+        clientKey(req) {
+            const tailnet = forwardedAddress(req);
+            return tailnet !== undefined && isTailnetAddress(tailnet) ? `tailnet:${tailnet}` : 'forwarded';
+        },
+    };
+}
 //# sourceMappingURL=tailscale.js.map

package/packages/gateway/dist/web/access/tailscale.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tailscale.js","sourceRoot":"","sources":["../../../src/web/access/tailscale.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AAEtE,kFAAkF;AAClF,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAE/C,8FAA8F;AAC9F,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC,8CAA8C;AAC9C,MAAM,YAAY,GAAG,MAAM,CAAC;AA2C5B;;wEAEwE;AAExE;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAA2B;IAC1D,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,EAAE,GAAG,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,EAAE,EAAE,CAAC;QACP,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACtE,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAE,IAAI,GAAG,CAAC;IACpE,CAAC;IACD,OAAO,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,kBAAkB,CAAC;AACrE,CAAC;AAED,SAAS,SAAS,CAAC,OAA2B;IAC5C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/F,IAAI,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB;IACnD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3C,0EAA0E;IAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9C,CAAC;AAED,SAAS,MAAM,CAAC,GAAoB,EAAE,IAAY;IAChD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAoB;IAC1D,OAAO,CACL,MAAM,CAAC,GAAG,EAAE,sBAAsB,CAAC,KAAK,SAAS;QACjD,SAAS,CAAC,GAAG,CAAC,KAAK,MAAM;QACzB,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC;QAC5C,gBAAgB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CACxC,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,CAAqB,EAAE,CAAqB;IACpE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,OAAO,+BAA+B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACrD,CAAC;AA2BD,MAAM,OAAO,GAA+C;IAC1D,aAAa,EAAE,sFAAsF;IACrG,kBAAkB,EAAE,6EAA6E;IACjG,0BAA0B,EAAE,4FAA4F;IACxH,uBAAuB,EAAE,gDAAgD;IACzE,0BAA0B,EAAE,0CAA0C;IACtE,mBAAmB,EAAE,2EAA2E;IAChG,mBAAmB,EAAE,sFAAsF;IAC3G,oBAAoB,EAAE,qEAAqE;IAC3F,sBAAsB,EAAE,0DAA0D;IAClF,4BAA4B,EAAE,wEAAwE;CACvG,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAA4B,CAAC;AAEvD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAwB;IAC7D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAoC;IACtE,OAAO,MAAM,KAAK,mBAAmB,IAAI,MAAM,KAAK,oBAAoB,CAAC;AAC3E,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,cAAc,CAAC,MAAoC;IACjE,OAAO,MAAM,KAAK,mBAAmB,IAAI,MAAM,KAAK,4BAA4B,CAAC;AACnF,CAAC;AAED,SAAS,QAAQ,CAAC,IAA2B,EAAE,MAAwB,EAAE,EAAU;IACjF,IAAI,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,EAAE,GAAG,IAAI,GAAG,YAAY;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,UAAU,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM;QAAE,UAAU,CAAC,KAAK,EAAE,CAAC;IACtE,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3B,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB;IAC/B,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gBAAgB;IAC9B,OAAO,UAAU,CAAC,IAAI,CAAC;AACzB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAoB,EACpB,IAA2B;IAE3B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAClD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;IAExD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;IACzF,sEAAsE;IACtE,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAC9H,2EAA2E;IAC3E,4CAA4C;IAC5C,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,KAAK,SAAS,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;QACxF,OAAO,QAAQ,CAAC,IAAI,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;IACnF,uEAAuE;IACvE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,EAAE,CAAC;QACvE,OAAO,QAAQ,CAAC,IAAI,EAAE,0BAA0B,EAAE,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAErF;;;;;;;OAOG;IACH,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;IAE9F,IAAI,OAAgC,CAAC;IACrC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAiB,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,IAAI,EAAE,GAAG,YAAY,kBAAkB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAC;IAChE,6EAA6E;IAC7E,yEAAyE;IACzE,2EAA2E;IAC3E,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,4BAA4B,EAAE,EAAE,CAAC,CAAC;IACtG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,4BAA4B,EAAE,EAAE,CAAC,CAAC;IAC9F,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,qBAAqB,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK;QACzE,OAAO,EAAE,OAAiB;KAC3B,CAAC;AACJ,CAAC;AAED;;wEAEwE;AAExE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,0BAA0B;IAC1B,sDAAsD;CACvD,CAAC;AAEF,+DAA+D;AAC/D,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAE1C,6EAA6E;AAC7E,MAAM,UAAU,GAAG,SAAS,CAAC;AAS7B;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAqB,EAAE;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,cAAc,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,2BAA2B,EAAE,CAAC;QACpD,IAAI,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IAC3C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAKD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAC3D,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,QAAQ,CACN,MAAM,EACN,IAAI,EACJ,EAAE,OAAO,EAAE,oBAAoB,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EACzF,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAQ,KAA4B,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,KAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAChI,OAAO,CAAC;YACN,IAAI;YACJ,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;YAClE,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;SACnE,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;IAC/E,CAAC;IACD,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,yCAAyC;AAEzC,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,IAAI,GAAG,KAA2G,CAAC;IACzH,MAAM,OAAO,GAAG,IAAI,EAAE,WAAW,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,OAAO,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,OAAO,OAAO,EAAE,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChI,MAAM,QAAQ,GAAG,OAAO,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AACxF,CAAC;AAED,gFAAgF;AAChF,SAAS,MAAM,CAAC,IAAwB,EAAE,EAAW;IACnD,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAkD,CAAC;IACtE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,UAAU,CAAC,MAAc;IACvC,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAsE,CAAC;IACjG,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACpG,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,6EAA6E;IAC7E,8EAA8E;IAC9E,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS,CAAC;IACpC,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAG,IAAI,CAAC,IAAoC,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACnJ,MAAM,GAAG,GAAI,IAAI,CAAC,IAA0C,EAAE,YAAY,CAAC;IAC3E,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACrG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,qDAAqD;AAErD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,UAAU,GAAG,iBAAiB,EAAE,SAAS,GAAG,KAAK;IAC1F,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC7H,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YACxB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO;gBAAE,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,IAAI,GAAY,IAAI,CAAC;gBACzB,IAAI,CAAC;oBAAC,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAChJ,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC;QACvF,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAcD,SAAS,QAAQ,CAAC,IAAyB;IACzC,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,QAAQ,CAAC,IAAyB;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAe,EAAE,OAA4B,EAAE;IAC7E,gEAAgE;IAChE,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QACrF,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnB;;;;;eAKG;YACH,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3E,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,2BAA2B,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACjH,OAAO,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,WAAW,CAAC,OAAyD,EAAE;IACrF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,IAAI,sBAAsB,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,GAAG,EAA4D,CAAC;IAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4C,CAAC;IACrE,IAAI,MAAM,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAC1D,OAAO,KAAK,EAAE,OAAe,EAAE,EAAE;QAC/B,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC;QACrG,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM;YAAE,MAAM,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACjE,IAAI,MAAM,CAAC,IAAI,IAAI,KAAK;YAAE,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QACjB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC;aACpC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,IAAI,KAAK,CAAC,IAAI,GAAG,IAAI;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YACrC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YACrD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3C,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,cAAc,GAAG,yBAAyB,CAAC;AAEjD,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAEzC,0FAA0F;AAC1F,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C;QACE,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA4B,EAAE;IAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC7E,wEAAwE;YACxE,qDAAqD;YACrD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,OAAO;gBAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC7D,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACnE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAE,MAAM,CAAC,IAAkC,EAAE,IAAI,CAAC,EAAE,CAAC;IAChG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,MAAM,GAAG,GAAG,CAAC,KAAK,IAAI,EAAE,CAA2C,CAAC;IACpE,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC;AAED;;wEAEwE;AAExE;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAQ9D;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,aAAqB,EAAE,YAAgC;IAC3F,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC;YACxC,IAAI,IAAI,KAAK,EAAE;gBAAE,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,gCAAgC,KAAK,qBAAqB,aAAa,EAAE,CAAC;AACnF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA2B;IAC3D,MAAM,QAAQ,GAAG,KAAK,EAAE,GAAoB,EAAE,OAAyB,EAAE,GAAS,EAAwC,EAAE;QAC1H,IAAI,OAAqC,CAAC;QAC1C,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE;YAC5C,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,OAAO;YAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG;YACd,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE;oBACR,QAAQ,EAAE,WAAW;oBACrB,OAAO,EAAE,QAAQ,CAAC,KAAK;oBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE;oBAC1D,MAAM,EAAE,WAAW,QAAQ,CAAC,OAAO,EAAE;iBACtC;aACF,CAAC;QACJ,CAAC;QACD,iEAAiE;QACjE,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO;YACP,QAAQ,EAAE,sBAAsB,CAAC,OAAO,CAAC;YACzC,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;SAChG,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,cAAc;QACrB,OAAO,EAAE,MAAM;QACf,UAAU,EAAE,qBAAqB;QACjC,aAAa,EAAE,yBAAyB;QACxC,YAAY,EAAE,kBAAkB;QAChC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO;QACrC,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK;QACnC,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,uEAAuE,EAAE,CAAC;YACjI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,OAAO,CAAC,KAAK,iFAAiF,EAAE,CAAC;YACrJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,QAAQ,EAAE,GAAkB;YAChC,OAAO;gBACL,KAAK,EAAE,CAAC;wBACN,IAAI,EAAE,wIAAwI;wBAC9I,OAAO,EAAE,qBAAqB,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC;qBACxE,CAAC;gBACF,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;aACrF,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,SAAS;QAChG,QAAQ;QACR,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG;YACtC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;YACjD,IAAI,MAAM,EAAE,EAAE,IAAI,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;YACzG,2EAA2E;YAC3E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY;gBAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC3G,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QAC/E,CAAC;QACD,SAAS,CAAC,GAAG;YACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACtC,OAAO,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QACjG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/packages/gateway/dist/web/agents.d.ts

@@ -29,6 +29,8 @@ export interface AgentEngineView {
     thinking: 'on' | 'off' | null;
     /** Idle time before a fresh conversation, as the file says it; `3h` when absent. */
     idleRollover: IdleRollover;
+    /** Where it may look (`browser:` in agent.md); `auto` when the file leaves it to the runtime. */
+    browser: 'auto' | 'own' | 'chrome' | 'apps';
     credentialKind: string;
     credentialEnv: string;
     available: boolean;

package/packages/gateway/dist/web/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/web/agents.ts"],"names":[],"mappings":"AAoBA,OAAO,EAWL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EAExB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,EAInB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC;AAI7E,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,iBAAiB,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,YAAY,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,mEAAmE;IACnE,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,eAAe,EAAE,CAKnB;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,cAAc,EAAE,CAE1E;AA8GD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,GAAG,MAAM,CAkDxF;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,EACvD,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,GAClB,iBAAiB,CAAC,eAAe,CAAC,CA8BpC;AAMD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,6EAA6E;IAC7E,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAClF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,gBAAgB,CAiBxE;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,EAC3E,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA+BjE"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/web/agents.ts"],"names":[],"mappings":"AAoBA,OAAO,EAWL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EAExB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,cAAc,EAInB,KAAK,YAAY,EAClB,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,GACrC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAAC;AAI7E,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,YAAY,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,iBAAiB,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,QAAQ,EAAE,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC;IAC9B,oFAAoF;IACpF,YAAY,EAAE,YAAY,CAAC;IAC3B,iGAAiG;IACjG,OAAO,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,mEAAmE;IACnE,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,eAAe,EAAE,CAKnB;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,cAAc,EAAE,CAE1E;AAyHD,wEAAwE;AACxE,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,GAAG,MAAM,CA0DxF;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,wEAAwE;IACxE,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,EACvD,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,WAAW,GAClB,iBAAiB,CAAC,eAAe,CAAC,CA8BpC;AAMD,0FAA0F;AAC1F,MAAM,WAAW,gBAAgB;IAC/B,gFAAgF;IAChF,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,mBAAmB,CAAC;IAC9B,6EAA6E;IAC7E,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAClF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,gBAAgB,CAiBxE;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE;IAAE,OAAO,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,EAC3E,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,gBAAgB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA+BjE"}

package/packages/gateway/dist/web/agents.js

@@ -61,6 +61,15 @@ function idleRolloverOnDisk(agent) {
         return agent.idleRollover ?? DEFAULT_IDLE_ROLLOVER;
     }
 }
+/** The agent's browser pin on disk, the file winning over the loaded catalog. */
+function browserOnDisk(agent) {
+    try {
+        return parseAgentFile(readFileSync(agent.file, 'utf8'), { file: agent.file }).frontmatter.browser ?? 'auto';
+    }
+    catch {
+        return agent.browserRoute ?? 'auto';
+    }
+}
 /** Whether the file leaves `maxTurns` to the built-in default. */
 function maxTurnsUnsetOnDisk(agent) {
     try {
@@ -78,6 +87,7 @@ function engineView(agent, env) {
             maxTurnsIsDefault: maxTurnsUnsetOnDisk(agent), defaultMaxTurns: DEFAULT_MAX_TURNS,
             thinking: thinkingOnDisk(agent),
             idleRollover: idleRolloverOnDisk(agent),
+            browser: browserOnDisk(agent),
             credentialKind: agent.provider.credential.kind, credentialEnv: agent.provider.accountId || 'No account selected',
             available: agent.available, unavailableReason: agent.unavailableReason,
             ...(agent.heldBack === undefined ? {} : { heldBack: agent.heldBack }),
@@ -128,6 +138,7 @@ function engineView(agent, env) {
         language,
         thinking: thinkingOnDisk(agent),
         idleRollover: idleRolloverOnDisk(agent),
+        browser: browserOnDisk(agent),
         credentialKind,
         credentialEnv,
         /*
@@ -184,8 +195,15 @@ export function engineChangeFromBody(body) {
         }
         change.idleRollover = body.idleRollover;
     }
+    // Where it may look: `auto` (or null) removes the key, and the runtime chooses.
+    if (body.browser !== undefined) {
+        if (body.browser !== null && !['auto', 'own', 'chrome', 'apps'].includes(body.browser)) {
+            return '`browser` must be one of: auto, own, chrome, apps, or null';
+        }
+        change.browser = body.browser === null || body.browser === 'auto' ? null : body.browser;
+    }
     if (Object.keys(change).length === 0) {
-        return 'nothing to change (send provider, model, maxTurns, language, thinking or idleRollover)';
+        return 'nothing to change (send provider, model, maxTurns, language, thinking, idleRollover or browser)';
     }
     return change;
 }

package/packages/gateway/dist/web/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/web/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,cAAc,EACd,cAAc,EACd,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,cAAc,EAQd,qBAAqB,EACrB,cAAc,EACd,cAAc,GAEf,MAAM,aAAa,CAAC;AAMrB,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC;AA8BlD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAqB,EACrB,GAAsB;IAEtB,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,GAAsB;IACtD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,4EAA4E;AAC5E,SAAS,cAAc,CAAC,KAAmB;IACzC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC7G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC;IAChC,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,KAAmB;IAC7C,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,YAAY,IAAI,qBAAqB,CAAC;IAClI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACrD,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,SAAS,mBAAmB,CAAC,KAAmB;IAC9C,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,KAAK,SAAS,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,QAAQ,KAAK,iBAAiB,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAmB,EAAE,GAAsB;IAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO;YACjD,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;YAChF,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACrG,iBAAiB,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,iBAAiB;YACjF,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC;YAC/B,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC;YACvC,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,qBAAqB;YAChH,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YACtE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,eAAe,EAAE,KAAK;SACvB,CAAC;IACF,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;IACnC,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9B,IAAI,QAAQ,GAAW,KAAK,CAAC,QAAQ,CAAC;IACtC,IAAI,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;IAClD,IAAI,cAAc,GAAW,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;IAC5D,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC;QAClG,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,eAAe;YACb,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,IAAI;gBAChC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,CAAC,KAAK;gBAClC,CAAC,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAC,KAAK,KAAK,CAAC,QAAQ;gBACzD,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC;QACnD,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC;QACpB,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QAClB,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QAChD,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC;QACvC,aAAa,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QACnC,cAAc,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,mEAAmE;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,UAAU,GAAG,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS;QACpE,CAAC,CAAE,EAAE,EAAE,EAAE,IAAI,EAAY;QACzB,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAE9B,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ;QACR,KAAK;QACL,QAAQ;QACR,iBAAiB,EAAE,mBAAmB,CAAC,KAAK,CAAC;QAC7C,eAAe,EAAE,iBAAiB;QAClC,QAAQ;QACR,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC;QAC/B,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC;QACvC,cAAc;QACd,aAAa;QACb;;;;WAIG;QACH,SAAS,EAAE,UAAU,CAAC,EAAE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QACxD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;YAC9B,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YACzE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3E,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oBAAoB,CAAC,IAA6B;IAChE,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1D,IACE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACjC,CAAE,cAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC9D,CAAC;YACD,OAAO,gCAAgC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAwB,CAAC;IAClD,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACpD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/D,OAAO,sCAAsC,CAAC;QAChD,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1D,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAC/F,OAAO,uCAAuC,CAAC;QACjD,CAAC;QACD,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAClC,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1D,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAE,SAA+B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnG,OAAO,gCAAgC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,CAAC;QACD,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAmC,CAAC;IAC7D,CAAC;IACD,2EAA2E;IAC3E,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAChF,OAAO,wCAAwC,CAAC;QAClD,CAAC;QACD,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAClC,CAAC;IAED,mDAAmD;IACnD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACrE,OAAO,oCAAoC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IAC1C,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,wFAAwF,CAAC;IAClG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAuD,EACvD,OAAe,EACf,MAAmB;IAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,OAAO,EAAE,EAAE,EAAE,CAAC;IAE5F,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,MAAM,MAAM,GAAI,IAAI,CAAC,OAAkD,CAAC,MAAM,CAAC;QAC/E,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;gBAChE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,8DAA8D,CAAC,CAAC,CAAC,YAAY;aAC7F;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,sEAAsE;YACtE,uDAAuD;YACvD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACzF,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAgBD,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,cAAc,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,OAAO;QACL,cAAc;QACd,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;QACpF,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA2E,EAC3E,OAAgB;IAEhB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,+CAA+C,EAAE,EAAE,CAAC;IACtG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5F,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,KAAK,EACH,GAAG,KAAK,CAAC,IAAI,sEAAsE;oBACnF,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE;aAC1C;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACvG,CAAC;IACA,IAAI,CAAC,OAAkD,CAAC,MAAM,EAAE,EAAE,CAAC;IACpE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YACjC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,+DAA+D;SACnF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/web/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,WAAW,EACX,cAAc,EACd,cAAc,EACd,eAAe,EACf,eAAe,EACf,sBAAsB,EACtB,cAAc,EAQd,qBAAqB,EACrB,cAAc,EACd,cAAc,GAEf,MAAM,aAAa,CAAC;AAMrB,MAAM,SAAS,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAU,CAAC;AAgClD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAqB,EACrB,GAAsB;IAEtB,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,iBAAiB,CAAC,GAAsB;IACtD,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,4EAA4E;AAC5E,SAAS,cAAc,CAAC,KAAmB;IACzC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,IAAI,IAAI,CAAC;IAC7G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC;IAChC,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB,CAAC,KAAmB;IAC7C,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,YAAY,IAAI,qBAAqB,CAAC;IAClI,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACrD,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,KAAmB;IACxC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,IAAI,MAAM,CAAC;IAC9G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,YAAY,IAAI,MAAM,CAAC;IACtC,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,SAAS,mBAAmB,CAAC,KAAmB;IAC9C,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,QAAQ,KAAK,SAAS,CAAC;IACnH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,QAAQ,KAAK,iBAAiB,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAmB,EAAE,GAAsB;IAC7D,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO;YACjD,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS;YAChF,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACrG,iBAAiB,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,eAAe,EAAE,iBAAiB;YACjF,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC;YAC/B,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC;YACvC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;YAC7B,cAAc,EAAE,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,IAAI,qBAAqB;YAChH,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YACtE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;YACrE,eAAe,EAAE,KAAK;SACvB,CAAC;IACF,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;IACnC,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACxB,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9B,IAAI,QAAQ,GAAW,KAAK,CAAC,QAAQ,CAAC;IACtC,IAAI,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;IAClD,IAAI,cAAc,GAAW,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;IAC5D,IAAI,eAAe,GAAG,KAAK,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,cAAc,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC;QAClG,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChE,eAAe;YACb,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,IAAI;gBAChC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,QAAQ,CAAC,KAAK;gBAClC,CAAC,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAC,KAAK,KAAK,CAAC,QAAQ;gBACzD,CAAC,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,KAAK,KAAK,CAAC,QAAQ,CAAC;QACnD,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC;QACpB,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QAClB,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,iBAAiB,CAAC;QAChD,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC;QACvC,aAAa,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;QACnC,cAAc,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,mEAAmE;IACrE,CAAC;IAED,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClD,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,UAAU,GAAG,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS;QACpE,CAAC,CAAE,EAAE,EAAE,EAAE,IAAI,EAAY;QACzB,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAE9B,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ;QACR,KAAK;QACL,QAAQ;QACR,iBAAiB,EAAE,mBAAmB,CAAC,KAAK,CAAC;QAC7C,eAAe,EAAE,iBAAiB;QAClC,QAAQ;QACR,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC;QAC/B,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC;QACvC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;QAC7B,cAAc;QACd,aAAa;QACb;;;;WAIG;QACH,SAAS,EAAE,UAAU,CAAC,EAAE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QACxD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS;YAC9B,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YACzE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3E,eAAe;KAChB,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,oBAAoB,CAAC,IAA6B;IAChE,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1D,IACE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACjC,CAAE,cAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC9D,CAAC;YACD,OAAO,gCAAgC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAwB,CAAC;IAClD,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACpD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/D,OAAO,sCAAsC,CAAC;QAChD,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1D,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YAC/F,OAAO,uCAAuC,CAAC;QACjD,CAAC;QACD,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAClC,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1D,IAAI,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAE,SAA+B,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACnG,OAAO,gCAAgC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,CAAC;QACD,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAmC,CAAC;IAC7D,CAAC;IACD,2EAA2E;IAC3E,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAChF,OAAO,wCAAwC,CAAC;QAClD,CAAC;QACD,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAClC,CAAC;IAED,mDAAmD;IACnD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACrE,OAAO,oCAAoC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IAC1C,CAAC;IAED,gFAAgF;IAChF,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAiB,CAAC,EAAE,CAAC;YACjG,OAAO,4DAA4D,CAAC;QACtE,CAAC;QACD,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAoC,CAAC;IACvH,CAAC;IAED,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,OAAO,iGAAiG,CAAC;IAC3G,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAuD,EACvD,OAAe,EACf,MAAmB;IAEnB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,OAAO,EAAE,EAAE,EAAE,CAAC;IAE5F,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QACrE,MAAM,MAAM,GAAI,IAAI,CAAC,OAAkD,CAAC,MAAM,CAAC;QAC/E,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC;gBAChE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,8DAA8D,CAAC,CAAC,CAAC,YAAY;aAC7F;SACF,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;YAClC,sEAAsE;YACtE,uDAAuD;YACvD,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACzF,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAClE,CAAC;IACJ,CAAC;AACH,CAAC;AAgBD,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IACpD,IAAI,cAAc,GAAkB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,cAAc,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,OAAO;QACL,cAAc;QACd,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;QACpF,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA2E,EAC3E,OAAgB;IAEhB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,+CAA+C,EAAE,EAAE,CAAC;IACtG,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,kBAAkB,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5F,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,KAAK,EACH,GAAG,KAAK,CAAC,IAAI,sEAAsE;oBACnF,GAAG,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE;aAC1C;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACvG,CAAC;IACA,IAAI,CAAC,OAAkD,CAAC,MAAM,EAAE,EAAE,CAAC;IACpE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM,EAAE,GAAG;QACX,IAAI,EAAE;YACJ,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;YACjC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,+DAA+D;SACnF;KACF,CAAC;AACJ,CAAC"}

package/packages/gateway/dist/web/api-routes.d.ts

@@ -94,11 +94,12 @@ export declare function authOf(route: ApiRoute): string;
 /** docs/api.md's body, from the table. `intro` is the hand-written opening. */
 export declare function renderApiReference(routes?: readonly ApiRoute[], intro?: string): string;
 /** The opening of docs/api.md: everything a client needs before the first route. */
-export declare const API_INTRO = "# The HTTP API\n\nEverything the dashboard does, it does through this API, so buddi works\nwithout the dashboard: a script, another program or `curl` can do what the\npage does. This page is generated from the gateway's route table\n(`packages/gateway/src/web/api-routes.ts`) by `pnpm docs:api`, and a test\nfails when a route is missing from it.\n\n## Where it is\n\nThe API is served by the gateway, on the dashboard's own address, under\n`/api`:\n\n- **This computer:** `http://127.0.0.1:4317` by default (`BUDDI_WEB_PORT`\n  changes the port; `buddi status` prints the address).\n- **Your tailnet:** the HTTPS address `tailscale serve` gives the dashboard\n  (Settings \u2192 System \u2192 Tailscale prints the command).\n\nRequests and answers are JSON (`Content-Type: application/json`), except\nwhere a route says *bytes*, *upload*, *server-sent events* or *WebSocket*. A\nJSON body is at most 64 KB. Paths ignore a trailing slash.\n\n## Authentication\n\nEvery `/api` route answers only the owner. There are two ways to be the\nowner:\n\n**An API token** \u2014 for scripts and programs. Make one in Settings \u2192 API\ntokens, or in a terminal:\n\n```sh\nbuddi api-token create \"home automation\"\n```\n\nIt is shown once. Send it on every request:\n\n```sh\nexport BUDDI_URL=http://127.0.0.1:4317 BUDDI_TOKEN=buddi_\u2026\ncurl -H \"Authorization: Bearer $BUDDI_TOKEN\" \"$BUDDI_URL/api/overview\"\n```\n\nA token acts as the owner, with no cookie, no CSRF header and no Origin\ncheck, and the lock screen does not cover it. What it cannot do is decided by\nthe route, and the table below says so per route (**Token: no**). A token\nnever:\n\n- decides an approval, or makes a change where the click is the approval\n  (approve, keep a proposal, accept a plugin's agent) \u2014 it may reject;\n- changes what an agent may do without asking (its tools, delegates, a\n  connection given out, a remembered \"always\");\n- installs or runs code buddi has not run before (plugins, upgrades, program\n  connections, the browser download);\n- changes how buddi is reached or unlocked (PIN, Tailscale, Telegram pairing,\n  the extension, other tokens) or restores a backup over everything;\n- reads or stores a secret (owner secrets, model account keys and sign-ins,\n  the backup passphrase).\n\nThose answer `403 { \"error\": \"An API token cannot \u2026\" }`. Everything a gated\ntool does still waits on its approval card, which the owner decides on the\ndashboard or Telegram. Tokens are kept hashed (SHA-256); the gateway never\nstores or logs the token itself. `buddi api-token list` and Settings show\neach one's name, last four characters and when it was last used;\n`buddi api-token revoke <id>` (or Revoke in Settings) ends it at the next\nrequest.\n\n**A dashboard session** \u2014 what the browser holds. It comes from a sign-in\nlink (`buddi dashboard`: a five-minute ticket, `?t=\u2026`, exchanged at a\npage URL and never under `/api`) or a Tailscale identity the owner allowed;\na source checkout bound to loopback also mints one for any request from this\ncomputer. The session is a cookie\n(`buddi_session_<port>`, HttpOnly, SameSite=Strict). Every request that is\nnot a GET or HEAD must also carry:\n\n- `X-Buddi-CSRF`: the `csrf` value from `GET /api/session` (also in the\n  `buddi_csrf_<port>` cookie, which must match), and\n- `Origin`: the dashboard's own origin.\n\n### A session from a script\n\nA program on the computer buddi runs on can hold a session the way\n`buddi mcp` does, which also reaches the routes a token may not: exchange\na five-minute ticket once, keep the cookies, and read the CSRF value.\n\n```sh\ncurl -s -c cookies.txt -o /dev/null \"$BUDDI_URL/?t=$(buddi dashboard --token)\"\nCSRF=$(curl -s -b cookies.txt \"$BUDDI_URL/api/session\" | sed -E 's/.*\"csrf\":\"([^\"]+)\".*/\\1/')\ncurl -b cookies.txt -H \"X-Buddi-CSRF: $CSRF\" -H \"Origin: $BUDDI_URL\" \\\n  -H \"Content-Type: application/json\" -d '{\"paused\":true}' \"$BUDDI_URL/api/pause\"\n```\n\n`buddi dashboard --token` reads the installation's own secret, so it works\nonly on that computer. A wrong or expired ticket counts as a failed sign-in.\n\n## Answers and errors\n\nA success is `200` with JSON unless the route says otherwise (`201`\ncreated, `202` accepted and still running \u2014 follow the job or stream it\nnames, `204` no body). A refusal is a status with `{ \"error\": \"<a sentence\nfor a person>\" }`, sometimes with more fields. The gate answers before any\nroute, with an empty body:\n\n| Status | Meaning |\n| --- | --- |\n| 401 | Not signed in: no session, or the token is unknown or revoked. |\n| 403 | A write without its CSRF header or Origin; or, with JSON, a route a token may not call. |\n| 404 | `{ \"error\": \"no such endpoint\" }` for a path that is not a route. |\n| 405 | A method the path does not take. |\n| 423 | `{ \"locked\": true, \u2026 }`: the dashboard session is locked (Settings \u2192 Lock screen). Tokens are not covered. |\n| 429 | Too many failed sign-ins from this address; `Retry-After` says when to try again. |\n| 503 | Tailscale could not be asked, or a part of buddi is not running in this process. |\n\n## Rate limits and lockout\n\nA request that presents a credential that is wrong \u2014 a stale session cookie,\nan expired sign-in link, an unknown or revoked API token \u2014 counts as a failed\nsign-in for its address: ten in a minute and that address is answered\n`429` until the minute is over. Each distinct wrong value counts once a\nwindow, so one forgotten client cannot lock the owner out on its own. All\ntailnet and SSH-tunnel traffic arrives from 127.0.0.1 and shares one budget.\nA request with no credential at all counts as nothing.\n\nBeyond that: at most a few open event streams per session (`429`), five\nextension pairing tries in five minutes, and plugin page writes have their\nown limit.\n\n## Streams\n\n`GET /api/chat/conversations/:id/stream` and `GET /api/chat/attention/stream`\nare server-sent events. Reconnect with `Last-Event-ID` (or `?since=`) to\nresume where you left off. A turn sent with `POST /api/chat/:agent/messages`\nis answered `202` at once; its reply arrives on the stream.\n\n## Example: talk to an agent headless\n\n```sh\n# who is there\ncurl -s -H \"Authorization: Bearer $BUDDI_TOKEN\" \"$BUDDI_URL/api/chat/agents\"\n# say something to the default assistant (its id from the list above)\ncurl -s -X POST -H \"Authorization: Bearer $BUDDI_TOKEN\" -H \"Content-Type: application/json\" \\\n  -d '{\"text\":\"What is on my calendar today?\"}' \"$BUDDI_URL/api/chat/<agent>/messages\"\n# follow the reply\ncurl -N -H \"Authorization: Bearer $BUDDI_TOKEN\" \"$BUDDI_URL/api/chat/conversations/<conversationId>/stream\"\n```\n";
+export declare const API_INTRO = "# The HTTP API\n\nEverything the dashboard does, it does through this API, so buddi works\nwithout the dashboard: a script, another program or `curl` can do what the\npage does. This page is generated from the gateway's route table\n(`packages/gateway/src/web/api-routes.ts`) by `pnpm docs:api`, and a test\nfails when a route is missing from it.\n\n## Where it is\n\nThe API is served by the gateway, on the dashboard's own address, under\n`/api`:\n\n- **This computer:** `http://127.0.0.1:4317` by default (`BUDDI_WEB_PORT`\n  changes the port; `buddi status` prints the address).\n- **Your tailnet:** the HTTPS address `tailscale serve` gives the dashboard\n  (Settings \u2192 System \u2192 Sign in from elsewhere \u2192 Tailscale prints the command).\n- **Your own domain through Cloudflare:** the public hostname of a Cloudflare\n  Tunnel with Cloudflare Access in front (Settings \u2192 System \u2192 Sign in from\n  elsewhere \u2192 Cloudflare Access walks through it).\n\nRequests and answers are JSON (`Content-Type: application/json`), except\nwhere a route says *bytes*, *upload*, *server-sent events* or *WebSocket*. A\nJSON body is at most 64 KB. Paths ignore a trailing slash.\n\n## Authentication\n\nEvery `/api` route answers only the owner. There are two ways to be the\nowner:\n\n**An API token** \u2014 for scripts and programs. Make one in Settings \u2192 API\ntokens, or in a terminal:\n\n```sh\nbuddi api-token create \"home automation\"\n```\n\nIt is shown once. Send it on every request:\n\n```sh\nexport BUDDI_URL=http://127.0.0.1:4317 BUDDI_TOKEN=buddi_\u2026\ncurl -H \"Authorization: Bearer $BUDDI_TOKEN\" \"$BUDDI_URL/api/overview\"\n```\n\nA token acts as the owner, with no cookie, no CSRF header and no Origin\ncheck, and the lock screen does not cover it. What it cannot do is decided by\nthe route, and the table below says so per route (**Token: no**). A token\nnever:\n\n- decides an approval, or makes a change where the click is the approval\n  (approve, keep a proposal, accept a plugin's agent) \u2014 it may reject;\n- changes what an agent may do without asking (its tools, delegates, a\n  connection given out, a remembered \"always\");\n- installs or runs code buddi has not run before (plugins, upgrades, program\n  connections, the browser download);\n- changes how buddi is reached or unlocked (PIN, Tailscale, Telegram pairing,\n  the extension, other tokens) or restores a backup over everything;\n- reads or stores a secret (owner secrets, model account keys and sign-ins,\n  the backup passphrase).\n\nThose answer `403 { \"error\": \"An API token cannot \u2026\" }`. Everything a gated\ntool does still waits on its approval card, which the owner decides on the\ndashboard or Telegram. Tokens are kept hashed (SHA-256); the gateway never\nstores or logs the token itself. `buddi api-token list` and Settings show\neach one's name, last four characters and when it was last used;\n`buddi api-token revoke <id>` (or Revoke in Settings) ends it at the next\nrequest.\n\n**A dashboard session** \u2014 what the browser holds. It comes from a sign-in\nlink (`buddi dashboard`: a five-minute ticket, `?t=\u2026`, exchanged at a\npage URL and never under `/api`) or an identity a trusted access provider\nverified for the person the owner allowed (Tailscale's daemon, Cloudflare\nAccess's signed JWT);\na source checkout bound to loopback also mints one for any request from this\ncomputer. The session is a cookie\n(`buddi_session_<port>`, HttpOnly, SameSite=Strict). Every request that is\nnot a GET or HEAD must also carry:\n\n- `X-Buddi-CSRF`: the `csrf` value from `GET /api/session` (also in the\n  `buddi_csrf_<port>` cookie, which must match), and\n- `Origin`: the dashboard's own origin.\n\n### A session from a script\n\nA program on the computer buddi runs on can hold a session the way\n`buddi mcp` does, which also reaches the routes a token may not: exchange\na five-minute ticket once, keep the cookies, and read the CSRF value.\n\n```sh\ncurl -s -c cookies.txt -o /dev/null \"$BUDDI_URL/?t=$(buddi dashboard --token)\"\nCSRF=$(curl -s -b cookies.txt \"$BUDDI_URL/api/session\" | sed -E 's/.*\"csrf\":\"([^\"]+)\".*/\\1/')\ncurl -b cookies.txt -H \"X-Buddi-CSRF: $CSRF\" -H \"Origin: $BUDDI_URL\" \\\n  -H \"Content-Type: application/json\" -d '{\"paused\":true}' \"$BUDDI_URL/api/pause\"\n```\n\n`buddi dashboard --token` reads the installation's own secret, so it works\nonly on that computer. A wrong or expired ticket counts as a failed sign-in.\n\n## Answers and errors\n\nA success is `200` with JSON unless the route says otherwise (`201`\ncreated, `202` accepted and still running \u2014 follow the job or stream it\nnames, `204` no body). A refusal is a status with `{ \"error\": \"<a sentence\nfor a person>\" }`, sometimes with more fields. The gate answers before any\nroute, with an empty body:\n\n| Status | Meaning |\n| --- | --- |\n| 401 | Not signed in: no session, or the token is unknown or revoked. |\n| 403 | A write without its CSRF header or Origin; or, with JSON, a route a token may not call. |\n| 404 | `{ \"error\": \"no such endpoint\" }` for a path that is not a route. |\n| 405 | A method the path does not take. |\n| 423 | `{ \"locked\": true, \u2026 }`: the dashboard session is locked (Settings \u2192 Lock screen). Tokens are not covered. |\n| 429 | Too many failed sign-ins from this address; `Retry-After` says when to try again. |\n| 503 | A sign-in provider could not be asked (Tailscale's daemon, Cloudflare's signing keys), or a part of buddi is not running in this process. |\n\n## Rate limits and lockout\n\nA request that presents a credential that is wrong \u2014 a stale session cookie,\nan expired sign-in link, an unknown or revoked API token \u2014 counts as a failed\nsign-in for its address: ten in a minute and that address is answered\n`429` until the minute is over. Each distinct wrong value counts once a\nwindow, so one forgotten client cannot lock the owner out on its own. All\ntailnet and SSH-tunnel traffic arrives from 127.0.0.1 and shares one budget.\nA request with no credential at all counts as nothing.\n\nBeyond that: at most a few open event streams per session (`429`), five\nextension pairing tries in five minutes, and plugin page writes have their\nown limit.\n\n## Streams\n\n`GET /api/chat/conversations/:id/stream` and `GET /api/chat/attention/stream`\nare server-sent events. Reconnect with `Last-Event-ID` (or `?since=`) to\nresume where you left off. A turn sent with `POST /api/chat/:agent/messages`\nis answered `202` at once; its reply arrives on the stream.\n\n## Example: talk to an agent headless\n\n```sh\n# who is there\ncurl -s -H \"Authorization: Bearer $BUDDI_TOKEN\" \"$BUDDI_URL/api/chat/agents\"\n# say something to the default assistant (its id from the list above)\ncurl -s -X POST -H \"Authorization: Bearer $BUDDI_TOKEN\" -H \"Content-Type: application/json\" \\\n  -d '{\"text\":\"What is on my calendar today?\"}' \"$BUDDI_URL/api/chat/<agent>/messages\"\n# follow the reply\ncurl -N -H \"Authorization: Bearer $BUDDI_TOKEN\" \"$BUDDI_URL/api/chat/conversations/<conversationId>/stream\"\n```\n";
 /**
  * The release each route first shipped in, from the history (the earliest
- * tag whose gateway source dispatched it). A route added since the last
- * release has no entry and reads "unreleased" until the release adds it.
+ * tag whose gateway source dispatched it). Every row has an entry: a route
+ * added for the coming release takes that release's version when it lands
+ * (the test holds both directions).
  */
 export declare const API_SINCE: Readonly<Record<string, string>>;
 //# sourceMappingURL=api-routes.d.ts.map

package/packages/gateway/dist/web/api-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-routes.d.ts","sourceRoot":"","sources":["../../src/web/api-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEpE,gDAAgD;AAChD,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExE,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,SAAS,CAAC;IAClB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,yDAAyD;IACzD,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,qGAAqG;AACrG,eAAO,MAAM,cAAc;;;;;;;;CAQjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,cAAc,CAAC;AAEvD,6CAA6C;AAC7C,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;CAuBZ,CAAC;AACX,MAAM,MAAM,OAAO,GAAG,MAAM,OAAO,SAAS,CAAC;AAK7C,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EA6yBzC,CAAC;AAYF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CASpF;AAMD,wBAAgB,MAAM,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAI9C;AAkDD,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,GAAE,SAAS,QAAQ,EAAe,EAAE,KAAK,GAAE,MAAkB,GAAG,MAAM,CAuC9G;AAED,oFAAoF;AACpF,eAAO,MAAM,SAAS,gmNA+IrB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6StD,CAAC"}
+{"version":3,"file":"api-routes.d.ts","sourceRoot":"","sources":["../../src/web/api-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEpE,gDAAgD;AAChD,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExE,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,SAAS,CAAC;IAClB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,IAAI,CAAC;IACnB,yDAAyD;IACzD,SAAS,CAAC,EAAE,IAAI,CAAC;CAClB;AAED,qGAAqG;AACrG,eAAO,MAAM,cAAc;;;;;;;;CAQjB,CAAC;AACX,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,cAAc,CAAC;AAEvD,6CAA6C;AAC7C,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;CAuBZ,CAAC;AACX,MAAM,MAAM,OAAO,GAAG,MAAM,OAAO,SAAS,CAAC;AAK7C,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAi3BzC,CAAC;AAYF;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS,CASpF;AAMD,wBAAgB,MAAM,CAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAI9C;AAkDD,+EAA+E;AAC/E,wBAAgB,kBAAkB,CAAC,MAAM,GAAE,SAAS,QAAQ,EAAe,EAAE,KAAK,GAAE,MAAkB,GAAG,MAAM,CAuC9G;AAED,oFAAoF;AACpF,eAAO,MAAM,SAAS,q/NAoJrB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA0TtD,CAAC"}

package/packages/gateway/dist/web/api-routes.js

@@ -60,7 +60,7 @@ export const API_ROUTES = [
     {
         method: 'GET', path: '/api/session', area: 'session', whileLocked: true,
         summary: 'Who is signed in, the CSRF value writes must echo, and facts every page formats with.',
-        answer: "{ csrf: string, timezone: string, timeFormat: '12h'|'24h'|null, dateFormat: 'short'|'long'|'iso'|null, host: string, port: number, platform: string, recovery: boolean, scope: 'local'|'remote', signedInThrough: 'local'|'ticket'|'tailscale'|'token', tailscaleName?: string, tailscaleLogin?: string, expiresAt: string, version: string }",
+        answer: "{ csrf: string, timezone: string, timeFormat: '12h'|'24h'|null, dateFormat: 'short'|'long'|'iso'|null, host: string, port: number, platform: string, recovery: boolean, scope: 'local'|'remote', signedInThrough: 'local'|'ticket'|'tailscale'|'cloudflare-access'|'token', provider?: 'tailscale'|'cloudflare-access', providerSubject?: string, tailscaleName?: string, tailscaleLogin?: string, expiresAt: string, version: string }",
     },
     {
         method: 'GET', path: '/api/lock', area: 'session', whileLocked: true,
@@ -115,16 +115,83 @@ export const API_ROUTES = [
         summary: 'Remove the lock screen picture (the background goes back to a built-in one).', answer: 'the lock state',
     },
     {
-        method: 'GET', path: '/api/tailscale', area: 'session',
+        method: 'GET', path: '/api/access', area: 'session',
+        summary: 'Sign in from elsewhere: every trusted access provider (Tailscale, Cloudflare Access) with its status in one line, and whether this request came through one (the block is then read-only).',
+        answer: "{ proxied: boolean, providers: [{ id: 'tailscale'|'cloudflare-access', title, identity: 'login'|'device', proxy: 'this-machine'|'elsewhere', enabled: boolean, status: { state: 'off'|'needs-setup'|'waiting'|'ready'|'unanswered', sentence } }] }",
+    },
+    {
+        method: 'GET', path: '/api/access/tailscale', area: 'session',
         summary: 'Tailscale sign-in: the stored setting, the daemon, and the command that serves this dashboard on the tailnet.',
         answer: '{ enabled: boolean, login: string, available: boolean, self: { login, name }|null, proxied: boolean, serveCommand: string }',
     },
     {
-        method: 'PUT', path: '/api/tailscale', area: 'session', localOnly: true, token: 'access',
+        method: 'PUT', path: '/api/access/tailscale', area: 'session', localOnly: true, token: 'access',
         summary: 'Turn Tailscale sign-in on or off, for one login. Every Tailscale session ends.',
         body: '{ enabled: boolean, login?: string }', answer: 'as GET',
         errors: '400 not a Tailscale login; 403 not from the computer buddi runs on',
     },
+    {
+        method: 'GET', path: '/api/access/cloudflare-access', area: 'session',
+        summary: 'Cloudflare Access sign-in: the stored fields, the status, the setup steps with the ingress port cloudflared must point at, and the last verified visit.',
+        answer: '{ enabled, teamDomain, aud, email, publicOrigin, status: { state, sentence }, ingressPort: number, listening: boolean, lastVisit: { at, email }|null, setup: { steps: [{ text, command? }], fields: [{ key, label, hint?, placeholder? }] }, proxied: boolean }',
+    },
+    {
+        method: 'PUT', path: '/api/access/cloudflare-access', area: 'session', localOnly: true, token: 'access',
+        summary: 'Save Cloudflare Access sign-in: the team domain, the application AUD tag, the one allowed email and the public address. Binds or closes the ingress listener and fetches the team\'s signing keys once; sessions it admitted end unless the same person, team and application stay on.',
+        body: '{ enabled: boolean, teamDomain: string, aud: string, email: string, publicOrigin: string }', answer: 'as GET, plus test: { ok, keys, error? } when on',
+        errors: '400 a field that is not what it should be, or a field missing to turn it on; 403 not from the computer buddi runs on',
+    },
+    {
+        method: 'POST', path: '/api/access/cloudflare-access/test', area: 'session', localOnly: true, token: 'access',
+        summary: '"Test my setup": fetch the signing keys of the team domain given (or the stored one) and say what came back. Nothing is stored.',
+        body: '{ teamDomain?: string }', answer: '{ ok: boolean, keys: number, teamDomain, sentence, listening: boolean, ingressPort: number|null }',
+        errors: '400 not a Cloudflare team domain; 403 not from the computer buddi runs on',
+    },
+    {
+        method: 'GET', path: '/api/access/cloudflare-access/setup', area: 'session', localOnly: true,
+        summary: '"Set it up for me": the run in progress (or the last one), whether a Cloudflare API token is kept, what buddi made last time, the token permissions to ask for and the ingress port. The install line in `progress.install` holds the tunnel\'s connector token.',
+        answer: "{ progress: { state: 'idle'|'running'|'waiting'|'done'|'failed'|'stopped'|'removing'|'removed', host, email, steps: [{ id, state: 'next'|'now'|'done'|'failed', text, why? }], install: { command, note }|null, error, url, removed: string[], uninstall, adoptable: boolean }, tokenStored: boolean, record: { host, email, zone, teamDomain }|null, permissions: string[], tokenUrl: string, ingressPort: number }",
+        errors: '403 not from the computer buddi runs on',
+    },
+    {
+        method: 'POST', path: '/api/access/cloudflare-access/setup', area: 'session', localOnly: true, token: 'access',
+        summary: 'Start "Set it up for me": with the API token (kept as the owner secret CLOUDFLARE_API_TOKEN; omit it to use the kept one), buddi finds the zone, creates (or reuses what it made before) the tunnel buddi-<host>, its ingress, the DNS record, the Access policy and application, fills in Cloudflare Access sign-in, shows the service install line, waits for the tunnel and runs the test. Poll GET for progress. An object of buddi\'s name that buddi did not make stops the run with `progress.adoptable`; `adopt: true` uses it anyway.',
+        body: '{ token?: string, host: string, email: string, zone?: string, adopt?: boolean }', answer: '202, as GET',
+        errors: '400 a hostname, email or token that is not one, or no token kept; 403 not from the computer buddi runs on; 409 a setup or removal already going, or the vault refused the token',
+    },
+    {
+        method: 'POST', path: '/api/access/cloudflare-access/zones', area: 'session', localOnly: true, token: 'access',
+        summary: 'Check a Cloudflare API token (omit it to use the kept one) and list the domains (zones) it can see, for the setup form\'s domain choice. The pasted token is not kept and never echoed.',
+        body: '{ token?: string }', answer: '{ zones: [{ id, name }] }',
+        errors: '400 a token Cloudflare refuses, one that cannot list domains (Zone · DNS · Edit missing), or no token kept or given; 403 not from the computer buddi runs on; 502 Cloudflare unreachable or failing',
+    },
+    {
+        method: 'POST', path: '/api/access/cloudflare-access/setup/stop', area: 'session', localOnly: true, token: 'access',
+        summary: 'Stop waiting for the tunnel. What buddi made stays; a new run picks it up.',
+        answer: 'as GET', errors: '403 not from the computer buddi runs on; 409 a removal going',
+    },
+    {
+        method: 'POST', path: '/api/access/cloudflare-access/setup/remove', area: 'session', localOnly: true, token: 'access',
+        summary: 'Remove what "Set it up for me" made — the Access application and policy, the DNS record and the tunnel, only those whose ids buddi recorded making — turn Cloudflare Access sign-in off when setup filled it in. The token stays kept (`tokenStored`) until forgotten.',
+        body: '{ token?: string, host?: string }', answer: 'as GET; progress.removed lists what went, progress.error what did not',
+        errors: '400 no token kept or given; 403 not from the computer buddi runs on; 409 a setup or removal going',
+    },
+    {
+        method: 'POST', path: '/api/access/cloudflare-access/setup/forget-token', area: 'session', localOnly: true, token: 'access',
+        summary: 'Forget the kept Cloudflare API token (drops the owner secret CLOUDFLARE_API_TOKEN). It stays valid in Cloudflare until revoked there (My Profile → API Tokens).',
+        answer: 'as GET, with tokenStored: false', errors: '403 not from the computer buddi runs on; 409 a setup or removal going, or the vault refused',
+    },
+    {
+        method: 'GET', path: '/api/tailscale', area: 'session',
+        summary: 'Alias of GET /api/access/tailscale, kept for one release.',
+        answer: '{ enabled: boolean, login: string, available: boolean, self: { login, name }|null, proxied: boolean, serveCommand: string }',
+    },
+    {
+        method: 'PUT', path: '/api/tailscale', area: 'session', localOnly: true, token: 'access',
+        summary: 'Alias of PUT /api/access/tailscale, kept for one release.',
+        body: '{ enabled: boolean, login?: string }', answer: 'as GET',
+        errors: '400 not a Tailscale login; 403 not from the computer buddi runs on',
+    },
     /* ---------------- API tokens ---------------- */
     {
         method: 'GET', path: '/api/api-tokens', area: 'tokens', token: 'access',
@@ -404,7 +471,7 @@ export const API_ROUTES = [
         summary: 'Which agents this one may hand work to.', body: '{ delegates: agent id[] }', errors: '400; 404',
     },
     {
-        method: 'POST', path: '/api/agents/:id/engine', area: 'agents', summary: 'Change engine settings (effort, context, idle rollover…).',
+        method: 'POST', path: '/api/agents/:id/engine', area: 'agents', summary: 'Change engine settings (effort, context, idle rollover, where it may look: browser auto/own/chrome/apps…).',
         body: 'engine fields; the account and model go through /account', errors: '400',
     },
     {
@@ -761,8 +828,6 @@ export const API_ROUTES = [
     },
     { method: 'POST', path: '/api/host/stop', area: 'computer', summary: 'Stop an agent’s running commands in a conversation.', body: '{ agentId: string, conversationId: string }', answer: '{ stopped }' },
     { method: 'POST', path: '/api/host/revoke', area: 'computer', summary: 'Revoke a standing host-execution permission.', body: '{ id: uuid }', answer: '{ revoked: true }', errors: '400; 404' },
-    { method: 'GET', path: '/api/host/apps', area: 'computer', summary: 'Apps installed on this computer.', answer: '{ apps }' },
-    { method: 'GET', path: '/api/host/browser-profiles', area: 'computer', summary: "A browser app's profiles.", query: 'app: string', answer: '{ profiles }' },
     { method: 'GET', path: '/api/browser', area: 'computer', summary: "The agents' browser: installed, running, its session and page.", query: 'agentId?, conversationId?' },
     {
         method: 'GET', path: '/api/browser/screenshot', area: 'computer', kind: 'bytes', summary: 'The browser’s current screen, as JPEG.',
@@ -770,13 +835,16 @@ export const API_ROUTES = [
     },
     { method: 'POST', path: '/api/browser/install', area: 'computer', token: 'code', summary: 'Download the browser agents use (about 150 MB); follow on GET /api/browser.', answer: '202', errors: '409' },
     { method: 'POST', path: '/api/browser/check', area: 'computer', summary: 'Launch the browser once to see it starts.', answer: '{ ok: boolean, message? }' },
-    { method: 'POST', path: '/api/browser/settings', area: 'computer', token: 'grants', summary: 'Change the browser control modes.', errors: '409' },
-    { method: 'POST', path: '/api/browser/permissions', area: 'computer', summary: 'Check (and optionally ask for) the operating system’s permissions.', body: '{ prompt?: boolean }', errors: '400; 409' },
-    { method: 'POST', path: '/api/browser/stop', area: 'computer', summary: 'Stop the browser session.', body: '{ sessionId?: string }' },
-    { method: 'POST', path: '/api/browser/takeover', area: 'computer', summary: 'Take over the screen from the agent.', body: '{ sessionId?: string }', answer: 'the status, with hand: boolean' },
+    { method: 'POST', path: '/api/browser/settings', area: 'computer', token: 'grants', summary: 'Change where agents may look: your Chrome on/off, your apps off/ask/on, sites that need your sign-in, the Stop\'s expiry, pages at once, show the window. A partial object.', errors: '409' },
+    { method: 'POST', path: '/api/browser/pin', area: 'computer', summary: 'Pin one conversation to a route, or clear it.', body: '{ conversationId: string, route: auto|own|chrome|apps }', errors: '400; 409' },
+    { method: 'POST', path: '/api/browser/card', area: 'computer', summary: 'Answer a browser card (Look, Keep going, Take over, Use my Chrome, Resume) without a chat message.', body: '{ conversationId: string, answer: string }', answer: '{ answered?, status }', errors: '400' },
+    { method: 'GET', path: '/api/browser/telemetry', area: 'computer', summary: 'Browser stops by cause, cards and routes over the last days.', query: 'days?: number', answer: '{ days, tasks, stops, cards, byCause, routes, stopsPerTask }' },
+    { method: 'POST', path: '/api/browser/stop', area: 'computer', summary: 'Stop one page, or with no session stop agents\' browsing (expires after the set time unless forever).', body: '{ sessionId?: string, forever?: boolean }' },
+    { method: 'POST', path: '/api/browser/takeover', area: 'computer', summary: 'Take over the screen from the agent.', body: '{ sessionId?: string }', answer: 'the status, with hand: boolean; a page in your Chrome comes to the front there instead and the status carries held: { by: "owner", where: "chrome" }' },
     { method: 'POST', path: '/api/browser/resume', area: 'computer', summary: 'Give the screen back to the agent.', body: '{ sessionId?: string }' },
     { method: 'POST', path: '/api/browser/release', area: 'computer', summary: 'Release the session.', body: '{ sessionId?: string }' },
-    { method: 'GET', path: '/api/browser/hand', area: 'computer', kind: 'socket', token: 'socket', summary: 'WebSocket: drive the taken-over screen (the CSRF value is the first frame).' },
+    { method: 'GET', path: '/api/browser/hand', area: 'computer', kind: 'socket', token: 'socket', summary: 'WebSocket: drive the taken-over screen (the CSRF value is the first frame). Also says { type: "loginSeen", id, site, username } when the owner signs in on the page they hold.' },
+    { method: 'POST', path: '/api/browser/login', area: 'computer', token: 'secret', summary: 'Answer "Save this login?" for a sign-in the owner made on a page they held: save keeps it as an owner secret, never stops asking for that site.', body: '{ id: string, decision: save|later|never }', answer: '{ outcome: saved|dismissed|never|gone, saved?: { name, site, username, savedAt } }', errors: '400; 409' },
     { method: 'GET', path: '/api/extension', area: 'computer', summary: 'The browser extension: paired or not, connected or not.' },
     { method: 'POST', path: '/api/extension/pair', area: 'computer', token: 'access', summary: 'Pair the extension with the code it shows.', body: '{ code: string }', errors: '400; 429 five tries in five minutes' },
     { method: 'DELETE', path: '/api/extension/pair', area: 'computer', summary: 'Forget the paired extension.' },
@@ -997,7 +1065,10 @@ The API is served by the gateway, on the dashboard's own address, under
 - **This computer:** \`http://127.0.0.1:4317\` by default (\`BUDDI_WEB_PORT\`
   changes the port; \`buddi status\` prints the address).
 - **Your tailnet:** the HTTPS address \`tailscale serve\` gives the dashboard
-  (Settings → System → Tailscale prints the command).
+  (Settings → System → Sign in from elsewhere → Tailscale prints the command).
+- **Your own domain through Cloudflare:** the public hostname of a Cloudflare
+  Tunnel with Cloudflare Access in front (Settings → System → Sign in from
+  elsewhere → Cloudflare Access walks through it).
 
 Requests and answers are JSON (\`Content-Type: application/json\`), except
 where a route says *bytes*, *upload*, *server-sent events* or *WebSocket*. A
@@ -1048,7 +1119,9 @@ request.
 
 **A dashboard session** — what the browser holds. It comes from a sign-in
 link (\`buddi dashboard\`: a five-minute ticket, \`?t=…\`, exchanged at a
-page URL and never under \`/api\`) or a Tailscale identity the owner allowed;
+page URL and never under \`/api\`) or an identity a trusted access provider
+verified for the person the owner allowed (Tailscale's daemon, Cloudflare
+Access's signed JWT);
 a source checkout bound to loopback also mints one for any request from this
 computer. The session is a cookie
 (\`buddi_session_<port>\`, HttpOnly, SameSite=Strict). Every request that is
@@ -1090,7 +1163,7 @@ route, with an empty body:
 | 405 | A method the path does not take. |
 | 423 | \`{ "locked": true, … }\`: the dashboard session is locked (Settings → Lock screen). Tokens are not covered. |
 | 429 | Too many failed sign-ins from this address; \`Retry-After\` says when to try again. |
-| 503 | Tailscale could not be asked, or a part of buddi is not running in this process. |
+| 503 | A sign-in provider could not be asked (Tailscale's daemon, Cloudflare's signing keys), or a part of buddi is not running in this process. |
 
 ## Rate limits and lockout
 
@@ -1127,10 +1200,27 @@ curl -N -H "Authorization: Bearer $BUDDI_TOKEN" "$BUDDI_URL/api/chat/conversatio
 `;
 /**
  * The release each route first shipped in, from the history (the earliest
- * tag whose gateway source dispatched it). A route added since the last
- * release has no entry and reads "unreleased" until the release adds it.
+ * tag whose gateway source dispatched it). Every row has an entry: a route
+ * added for the coming release takes that release's version when it lands
+ * (the test holds both directions).
  */
 export const API_SINCE = {
+    'GET /api/access': '0.1.0-pre.38',
+    'GET /api/access/tailscale': '0.1.0-pre.38',
+    'PUT /api/access/tailscale': '0.1.0-pre.38',
+    'GET /api/access/cloudflare-access': '0.1.0-pre.38',
+    'PUT /api/access/cloudflare-access': '0.1.0-pre.38',
+    'POST /api/access/cloudflare-access/test': '0.1.0-pre.38',
+    'GET /api/access/cloudflare-access/setup': '0.1.0-pre.38',
+    'POST /api/access/cloudflare-access/setup': '0.1.0-pre.38',
+    'POST /api/access/cloudflare-access/setup/stop': '0.1.0-pre.38',
+    'POST /api/access/cloudflare-access/setup/remove': '0.1.0-pre.38',
+    'POST /api/access/cloudflare-access/setup/forget-token': '0.1.0-pre.39',
+    'POST /api/access/cloudflare-access/zones': '0.1.0-pre.38',
+    'POST /api/browser/login': '0.1.0-pre.39',
+    'POST /api/browser/pin': '0.1.0-pre.38',
+    'POST /api/browser/card': '0.1.0-pre.38',
+    'GET /api/browser/telemetry': '0.1.0-pre.38',
     'POST /api/quiet': '0.1.0-pre.37',
     'POST /api/skills/bundles': '0.1.0-pre.37',
     'GET /api/skills/bundles/:staged/file': '0.1.0-pre.37',
@@ -1372,14 +1462,11 @@ export const API_SINCE = {
     'GET /api/host': '0.1.0-pre.15',
     'POST /api/host/stop': '0.1.0-pre.15',
     'POST /api/host/revoke': '0.1.0-pre.15',
-    'GET /api/host/apps': '0.1.0-pre.15',
-    'GET /api/host/browser-profiles': '0.1.0-pre.15',
     'GET /api/browser': '0.1.0-pre.15',
     'GET /api/browser/screenshot': '0.1.0-pre.15',
     'POST /api/browser/install': '0.1.0-pre.15',
     'POST /api/browser/check': '0.1.0-pre.15',
     'POST /api/browser/settings': '0.1.0-pre.15',
-    'POST /api/browser/permissions': '0.1.0-pre.15',
     'POST /api/browser/stop': '0.1.0-pre.15',
     'POST /api/browser/takeover': '0.1.0-pre.15',
     'POST /api/browser/resume': '0.1.0-pre.15',