anyray-connect 0.11.39 → 0.11.41

package/dist/util/jsonFile.js

@@ -5,8 +5,9 @@
  * always recover their pre-Anyray settings. Merges are shallow-by-section: we
  * only touch the keys we own and leave everything else intact.
  */
-import { mkdir, readFile, writeFile, access } from 'node:fs/promises';
+import { mkdir, readFile, writeFile, access, rm } from 'node:fs/promises';
 import { dirname } from 'node:path';
+const backupPath = (path) => `${path}.anyray-bak`;
 export const fileExists = async (path) => {
     try {
         await access(path);
@@ -29,13 +30,50 @@ export const readJson = async (path) => {
     }
     return parsed;
 };
-/** Write JSON with a trailing newline, creating parent dirs and a one-time backup. */
-export const writeJson = async (path, data) => {
+/**
+ * Write JSON with a trailing newline, creating parent dirs and a one-time backup.
+ *
+ * `backup: false` skips the snapshot — mirrors `writeModelsFile` in
+ * tools/copilotChat.ts. **Every revert write must pass it.** By revert time the
+ * file on disk is the Anyray-configured one, so snapshotting it would produce a
+ * file named `.anyray-bak` that actually holds Anyray's own settings; restoring
+ * that "pre-Anyray backup" would reinstall exactly what the revert removed.
+ */
+export const writeJson = async (path, data, opts = {}) => {
     await mkdir(dirname(path), { recursive: true });
-    const backup = `${path}.anyray-bak`;
-    if ((await fileExists(path)) && !(await fileExists(backup))) {
+    const backup = backupPath(path);
+    if (opts.backup !== false &&
+        (await fileExists(path)) &&
+        !(await fileExists(backup))) {
         await writeFile(backup, await readFile(path, 'utf-8'));
     }
     await writeFile(path, `${JSON.stringify(data, null, 2)}\n`);
 };
+/**
+ * The file as it stood BEFORE Anyray first touched it, or `{}` if there is no
+ * snapshot / it is unreadable.
+ *
+ * Only ever read the keys WE own out of this. The snapshot is taken once, on
+ * the first write ever, and is never refreshed — so for our own keys it is an
+ * accurate record (we are the only writer of those), but everything else in it
+ * is frozen at first-apply and the dev has moved on. That is why revert lifts
+ * single keys out of it and must never restore it wholesale.
+ */
+export const readBackup = async (path) => {
+    try {
+        return await readJson(backupPath(path));
+    }
+    catch {
+        return {};
+    }
+};
+/**
+ * Drop the snapshot. Call once a revert has taken what it needs: the snapshot
+ * exists only to serve a revert, so afterwards it is a stale copy of the dev's
+ * config lying around forever — and leaving it means a later re-apply keeps
+ * this ancient snapshot instead of taking a fresh one. Best-effort.
+ */
+export const clearBackup = async (path) => {
+    await rm(backupPath(path), { force: true }).catch(() => { });
+};
 //# sourceMappingURL=jsonFile.js.map

package/dist/util/jsonFile.js.map

@@ -1 +1 @@
-{"version":3,"file":"jsonFile.js","sourceRoot":"","sources":["../../src/util/jsonFile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,wFAAwF;AACxF,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAC3B,IAAY,EACsB,EAAE;IACpC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC,CAAC;AAEF,sFAAsF;AACtF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,IAAY,EACZ,IAA6B,EACd,EAAE;IACjB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,IAAI,aAAa,CAAC;IACpC,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC,CAAC"}
+{"version":3,"file":"jsonFile.js","sourceRoot":"","sources":["../../src/util/jsonFile.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,UAAU,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,GAAG,IAAI,aAAa,CAAC;AAElE,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC;AAEF,wFAAwF;AACxF,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAC3B,IAAY,EACsB,EAAE;IACpC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,IAAY,EACZ,IAA6B,EAC7B,OAA6B,EAAE,EAChB,EAAE;IACjB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,IACE,IAAI,CAAC,MAAM,KAAK,KAAK;QACrB,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,EAC3B,CAAC;QACD,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAC7B,IAAY,EACsB,EAAE;IACpC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;IAC/D,MAAM,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC9D,CAAC,CAAC"}

package/dist/util/persist.js

@@ -119,4 +119,65 @@ export const saveProfile = async (profile) => {
     // mode only applies on creation — tighten a pre-existing file too.
     await chmod(path, 0o600);
 };
+/**
+ * The profile fields that together let this machine mint gateway keys on its
+ * own — the minted key plus the cert that re-mints it. Everything else on the
+ * profile (gateway, name, team, synced skills, fallback) is a preference, not a
+ * credential.
+ */
+const ENROLLMENT_KEYS = [
+    'clientKey',
+    'clientKeyExpiresAt',
+    'enrolledCert',
+    'enrolledCertExpiry',
+    'enrolledTokenHash',
+];
+/** Whether this machine still holds a credential that can mint gateway keys. */
+export const hasEnrollment = async () => {
+    const profile = await loadProfile();
+    if (ENROLLMENT_KEYS.some((key) => profile[key] !== undefined))
+        return true;
+    return (await loadDevKey()) !== undefined;
+};
+/**
+ * Drop the enrollment credential: the minted key, the cert that re-mints it,
+ * and the dev PRIVATE key.
+ *
+ * This is what makes `--revert` stick. Removing the tool config alone is not
+ * enough, because `refreshIfDue` (util/devRefresh) re-mints and then REWRITES
+ * every tool config for as long as the profile carries a gateway plus an
+ * unexpired cert. That hook is registered in the editor's own settings, so an
+ * editor that was already running when the revert ran — its hooks loaded at
+ * startup — restores everything the revert just removed, and the dev sees a
+ * revert that "did nothing". Clearing the cert makes that path report
+ * `not-enrolled` and do nothing. It also means a machine the dev disconnected
+ * stops holding a live 30-day minting credential.
+ *
+ * Non-credential prefs survive, so a later re-run still knows its gateway.
+ * Returns true when something was actually cleared.
+ */
+export const clearEnrollment = async () => {
+    const profile = await loadProfile();
+    const hadKeys = ENROLLMENT_KEYS.some((key) => profile[key] !== undefined);
+    const hadDevKey = (await loadDevKey()) !== undefined;
+    if (!hadKeys && !hadDevKey)
+        return false;
+    // Strip the cert BEFORE the private key: the cert is what `refreshIfDue`
+    // gates on, so if the second step fails we land on `not-enrolled` rather than
+    // leaving a credential that still mints.
+    if (hadKeys) {
+        const next = { ...profile };
+        for (const key of ENROLLMENT_KEYS)
+            delete next[key];
+        await saveProfile(next);
+    }
+    await clearDevKey();
+    // clearDevKey is best-effort (it swallows EPERM, EACCES, a Windows file
+    // lock). Confirm rather than assume — "removed your credential" is the one
+    // claim a dev offboarding a machine acts on, so it must not be a guess.
+    if (await loadDevKey()) {
+        throw new Error(`could not remove the dev key from ${stateDir()}`);
+    }
+    return true;
+};
 //# sourceMappingURL=persist.js.map

package/dist/util/persist.js.map

@@ -1 +1 @@
-{"version":3,"file":"persist.js","sourceRoot":"","sources":["../../src/util/persist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAqFjC,uEAAuE;AACvE,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,KAAK,IAAqB,EAAE;IAC9C,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,aAAa,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,IAAmB,EAAE;IACtD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACrC,yEAAyE;YACzE,2DAA2D;YAC3D,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,sBAAsB;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACxC,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,aAAqB,EAAiB,EAAE;IACvE,MAAM,cAAc,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,mEAAmE;IACnE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,IAAiC,EAAE;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,IAAmB,EAAE;IACnD,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,IAA4B,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtF,OAAO,MAAuB,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAEF,mGAAmG;AACnG,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAAsB,EAAiB,EAAE;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAC1C,CAAC;IACnB,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;IACjC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC3D,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,mEAAmE;IACnE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC,CAAC"}
+{"version":3,"file":"persist.js","sourceRoot":"","sources":["../../src/util/persist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAwEjC,uEAAuE;AACvE,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAEjE;;;;;;;;;;GAUG;AACH,MAAM,WAAW,GAAG,KAAK,IAAqB,EAAE;IAC9C,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,GAAG,GAAW,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,aAAa,CAAC,CAAC;AAEjE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,IAAmB,EAAE;IACtD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;IACvB,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACrC,yEAAyE;YACzE,2DAA2D;YAC3D,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7D,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,sBAAsB;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;IACD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QACxC,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,aAAqB,EAAiB,EAAE;IACvE,MAAM,cAAc,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,UAAU,EAAE,CAAC;IAC1B,MAAM,SAAS,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,mEAAmE;IACnE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,IAAiC,EAAE;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,IAAmB,EAAE;IACnD,MAAM,EAAE,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC1D,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,IAA4B,EAAE;IAC5D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,MAAM,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtF,OAAO,MAAuB,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAEF,mGAAmG;AACnG,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAAsB,EAAiB,EAAE;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAC1C,CAAC;IACnB,MAAM,IAAI,GAAG,MAAM,WAAW,EAAE,CAAC;IACjC,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QAC3D,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,mEAAmE;IACnE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,eAAe,GAAG;IACtB,WAAW;IACX,oBAAoB;IACpB,cAAc;IACd,oBAAoB;IACpB,mBAAmB;CACX,CAAC;AAEX,gFAAgF;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,IAAsB,EAAE;IACxD,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3E,OAAO,CAAC,MAAM,UAAU,EAAE,CAAC,KAAK,SAAS,CAAC;AAC5C,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,IAAsB,EAAE;IAC1D,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,CAAC,MAAM,UAAU,EAAE,CAAC,KAAK,SAAS,CAAC;IACrD,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,yEAAyE;IACzE,8EAA8E;IAC9E,yCAAyC;IACzC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,eAAe;YAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,WAAW,EAAE,CAAC;IACpB,wEAAwE;IACxE,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,MAAM,UAAU,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/util/profile.js

@@ -43,6 +43,14 @@ export const upsertProfileBlock = async (path, lines) => {
     await writeFile(path, next);
     return path;
 };
+/**
+ * Is our managed block currently in the profile?
+ *
+ * Lets `doctor` tell "this shell exports the gateway because Anyray is
+ * installed" (fine) from "this shell exports it although the block is gone"
+ * (a stale terminal — the exports outlive the file that set them).
+ */
+export const hasProfileBlock = async (path) => (await readIfExists(path)).includes(BEGIN);
 /** Remove the managed block. Returns true if a block was present. */
 export const removeProfileBlock = async (path) => {
     const existing = await readIfExists(path);

package/dist/util/profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/util/profile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,KAAK,GAAG,0BAA0B,CAAC;AACzC,MAAM,GAAG,GAAG,0BAA0B,CAAC;AAEvC,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAW,EAAE;IAC5C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;IACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EAAE,IAAY,EAAmB,EAAE;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,GAAG,CAAC,OAAe,EAAU,EAAE;IAC7C,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAE/E,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,IAAY,EACZ,KAAe,EACE,EAAE;IACnB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC;IAC3D,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE;IACzE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/util/profile.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,KAAK,GAAG,0BAA0B,CAAC;AACzC,MAAM,GAAG,GAAG,0BAA0B,CAAC;AAEvC,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAW,EAAE;IAC5C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;IACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACzD,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAChC,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,EAAE,IAAY,EAAmB,EAAE;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAEF,6EAA6E;AAC7E,MAAM,UAAU,GAAG,CAAC,OAAe,EAAU,EAAE;IAC7C,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,aAAa,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAE/E,yFAAyF;AACzF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,IAAY,EACZ,KAAe,EACE,EAAE;IACnB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC;IAC3D,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE,CACtE,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE7C,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,IAAY,EAAoB,EAAE;IACzE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,SAAS,CAAC,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACvE,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anyray-connect",
-  "version": "0.11.39",
+  "version": "0.11.41",
   "description": "Anyray connect — points local coding tools (Claude Code, Cursor, Windsurf, SDKs) at the Anyray gateway by writing their base URL + a placeholder key. The gateway stays the brain; this is just the on-ramp.",
   "type": "module",
   "bin": {

package/dist/commands/agent.js

@@ -1,347 +0,0 @@
-/**
- * `anyray-connect agent <install|start|stop|status|uninstall>` — the
- * device-capture agent lifecycle (RFC 0002 / 0002a).
- *
- * This is Tier 2 capture: for apps `connect` can't redirect (ChatGPT desktop,
- * Claude desktop, Copilot, browsers) it installs a local intercepting proxy + a
- * device-trusted CA that MITMs ONLY the AI-domain allowlist and forwards to the
- * org gateway. Everything else is tunneled, never decrypted.
- *
- * Orchestration only — the real work lives in the modules (agentCa, agentTrust,
- * agentService, agentProxy). Best-effort + fail-open: a failed step is reported,
- * never left in a half-broken state that traps the machine offline.
- */
-import { platform } from 'node:os';
-import { loadProfile, saveProfile } from '../util/persist.js';
-import { bold, cyan, dim, fail, heading, info, ok, warn, } from '../util/log.js';
-import { caCertPath, DEFAULT_AGENT_PORT } from '../util/agentPaths.js';
-import { gatewayAllowlistHosts, AI_ALLOWLIST, } from '../util/agentAllowlist.js';
-import { ensureCa, removeCa, isOpensslAvailable } from '../util/agentCa.js';
-import { installTrust, uninstallTrust, enableSystemProxy, restoreSystemProxy, readProxyState, } from '../util/agentTrust.js';
-import { installAgentService, uninstallAgentService, probeAgentHealth, } from '../util/agentService.js';
-import { isSafeGatewayOrigin } from './agentProxy.js';
-const AGENT_HELP = `${bold('anyray-connect agent')} — capture AI usage from desktop & browser apps
-
-Installs a local intercepting proxy + a device-trusted CA that meters ONLY
-AI-provider domains (ChatGPT, Claude, Copilot, OpenAI, Anthropic) through your
-gateway. All other traffic is tunneled, never decrypted.
-
-${bold('Subcommands')}
-  install     Generate the device CA, trust it, install the proxy service, and
-              point the system proxy at it. Asks once for admin (CA trust).
-  status      Show whether the agent is running + which domains it intercepts.
-  stop        Pause: remove the system-proxy setting + the service (keeps the CA).
-  start       Resume a stopped agent.
-  uninstall   Full teardown: restore the system proxy, untrust + delete the CA,
-              remove the service.
-  repair      With sudo only: remove a legacy root-scoped install left by
-              versions 0.11.33–0.11.35. Does not install an agent.
-
-${bold('Notes')}
-  Run \`anyray-connect --enroll <link>\` (or a plain connect) FIRST so the agent
-  knows your gateway + identity. The gateway must allowlist the AI domains via
-  ANYRAY_CUSTOM_HOST_ALLOWLIST (see the agent docs).
-  Run lifecycle commands as your normal user. Use \`sudo ... agent repair\` only
-  to clean up a legacy root-scoped install.`;
-const printInterceptDomains = () => {
-    heading('Intercepted domains (only these are decrypted)');
-    for (const entry of AI_ALLOWLIST) {
-        const host = entry.suffix ? `${entry.host} (+ subdomains)` : entry.host;
-        info(`  ${cyan(host)} ${dim(`→ ${entry.app}`)}`);
-    }
-    info(dim('  Everything else is tunneled byte-for-byte, never decrypted.'));
-};
-const requireGateway = async () => {
-    const profile = await loadProfile();
-    if (!profile.gateway) {
-        fail('No gateway configured.');
-        info(dim('  Run `anyray-connect --enroll <link>` (or `anyray-connect <gateway-url>`) first,\n' +
-            '  so the agent knows where to meter and who you are.'));
-        return null;
-    }
-    // The agent forwards DECRYPTED prompts + the app's session token to the
-    // gateway — a plaintext remote gateway would leak both on the wire. Refuse it
-    // (unlike plain connect, which only warns) since a capture agent decrypts.
-    if (!isSafeGatewayOrigin(profile.gateway)) {
-        fail(`Refusing a plaintext gateway for capture: ${profile.gateway}`);
-        info(dim('  The agent forwards decrypted traffic + your session token — use an\n' +
-            '  https:// gateway (or a loopback address) so nothing crosses the network in the clear.'));
-        return null;
-    }
-    return profile.gateway;
-};
-/**
- * Install the service, point the system proxy at it, and confirm it answers.
- * The proxy is enabled ONLY once the service is installed, and reverted if the
- * daemon never comes up — so `install`/`start` can never leave the machine
- * pointed at a dead listener while reporting success (fail-open).
- */
-const bringUpProxy = async (port, gateway) => {
-    heading('Proxy service');
-    const svc = await installAgentService();
-    for (const m of svc.messages)
-        info(`  ${m}`);
-    if (!svc.ok) {
-        fail('  Could not install the agent service — not enabling the system proxy.');
-        return false;
-    }
-    heading('System proxy');
-    const proxied = await enableSystemProxy(port);
-    for (const m of proxied.messages)
-        info(`  ${m}`);
-    if (!proxied.ok) {
-        warn('  System proxy setup was incomplete — reverting it so you stay online.');
-        const restored = await restoreSystemProxy(port);
-        for (const m of restored.messages)
-            info(`  ${m}`);
-        await uninstallAgentService();
-        return false;
-    }
-    heading('Health');
-    let health = null;
-    for (let i = 0; i < 15 && !health; i++) {
-        health = await probeAgentHealth(port);
-        if (!health)
-            await sleep(400);
-    }
-    if (health) {
-        ok(`  Agent running on 127.0.0.1:${port} → ${gateway}.`);
-        return true;
-    }
-    // Never leave the system proxy pointing at a daemon that won't answer.
-    warn('  Agent did not come up — reverting the system proxy so you stay online.');
-    const restored = await restoreSystemProxy(port);
-    for (const m of restored.messages)
-        info(`  ${m}`);
-    await uninstallAgentService();
-    info(dim('  Check the service logs, then re-run `anyray-connect agent install`.'));
-    return false;
-};
-const preflight = () => {
-    if (platform() !== 'darwin') {
-        fail('The device-capture agent is macOS-only in this phase.');
-        info(dim('  Windows/Linux support is planned (RFC 0002a §7). On other platforms,\n' +
-            '  use `anyray-connect` to redirect the tools that support a base URL.'));
-        return false;
-    }
-    if (!isOpensslAvailable()) {
-        fail('`openssl` was not found on PATH — it is required to mint the device CA.');
-        return false;
-    }
-    return true;
-};
-const runInstall = async () => {
-    if (!preflight())
-        return 1;
-    const gateway = await requireGateway();
-    if (!gateway)
-        return 1;
-    const profile = await loadProfile();
-    const port = profile.agentPort ?? DEFAULT_AGENT_PORT;
-    info(bold('Installing the Anyray device-capture agent'));
-    printInterceptDomains();
-    // 1. Device CA.
-    heading('Device CA');
-    try {
-        await ensureCa();
-        ok(`  CA ready (${caCertPath()}).`);
-    }
-    catch (error) {
-        fail(`  Could not create the device CA: ${msg(error)}`);
-        return 1;
-    }
-    // 2. Trust the CA (the one admin prompt).
-    heading('Trusting the CA');
-    info(dim('  macOS will ask for your password once — trusting a root CA is deliberate.'));
-    const trust = await installTrust(caCertPath());
-    for (const m of trust.messages)
-        info(`  ${m}`);
-    if (!trust.ok) {
-        warn('  CA trust did not complete — intercepted apps will reject the proxy until it does.');
-    }
-    // 3. Bring up the service + system proxy (guarded: proxy only enabled behind a
-    // healthy daemon, reverted if it never answers).
-    const up = await bringUpProxy(port, gateway);
-    if (!up)
-        return 1;
-    await saveProfile({ ...profile, agentEnabled: true, agentPort: port });
-    info('\nUninstall any time: ' + cyan('anyray-connect agent uninstall'));
-    return 0;
-};
-const runStatus = async () => {
-    const profile = await loadProfile();
-    const port = profile.agentPort ?? DEFAULT_AGENT_PORT;
-    heading('Anyray device-capture agent');
-    info(`  Gateway:  ${profile.gateway ? cyan(profile.gateway) : dim('(not configured)')}`);
-    info(`  Enabled:  ${profile.agentEnabled ? cyan('yes') : dim('no')}`);
-    const health = await probeAgentHealth(port);
-    if (health)
-        ok(`  Running on 127.0.0.1:${port}.`);
-    else
-        warn(`  Not responding on 127.0.0.1:${port}.`);
-    if (platform() === 'darwin') {
-        const proxy = readProxyState();
-        if (proxy) {
-            const on = proxy.secureEnabled || proxy.webEnabled;
-            info(`  System proxy (${proxy.service}): ${on
-                ? cyan(`${proxy.secureHost ?? proxy.webHost}:${proxy.securePort ?? proxy.webPort}`)
-                : dim('off')}`);
-        }
-    }
-    printInterceptDomains();
-    heading('Gateway requirement');
-    info(dim('  The gateway must allowlist these hosts (ANYRAY_CUSTOM_HOST_ALLOWLIST):\n' +
-        '    ' +
-        gatewayAllowlistHosts().join(',')));
-    return 0;
-};
-const runStop = async () => {
-    const profile = await loadProfile();
-    const port = profile.agentPort ?? DEFAULT_AGENT_PORT;
-    heading('Stopping the agent');
-    // Restore the system proxy FIRST so the machine is never left pointing at a
-    // dead daemon (fail-open).
-    const restored = await restoreSystemProxy(port);
-    for (const m of restored.messages)
-        info(`  ${m}`);
-    if (!restored.ok) {
-        fail('  Proxy restoration was incomplete — the agent was left running for safety.');
-        return 1;
-    }
-    const svc = await uninstallAgentService();
-    for (const m of svc.messages)
-        info(`  ${m}`);
-    await saveProfile({ ...profile, agentEnabled: false });
-    ok('  Agent stopped (the device CA is kept — `agent start` to resume).');
-    return 0;
-};
-const runStart = async () => {
-    if (!preflight())
-        return 1;
-    const gateway = await requireGateway();
-    if (!gateway)
-        return 1;
-    const profile = await loadProfile();
-    const port = profile.agentPort ?? DEFAULT_AGENT_PORT;
-    heading('Starting the agent');
-    const up = await bringUpProxy(port, gateway);
-    if (!up)
-        return 1;
-    await saveProfile({ ...profile, agentEnabled: true, agentPort: port });
-    return 0;
-};
-const runUninstall = async () => {
-    const profile = await loadProfile();
-    const port = profile.agentPort ?? DEFAULT_AGENT_PORT;
-    heading('Uninstalling the agent');
-    const restored = await restoreSystemProxy(port);
-    for (const m of restored.messages)
-        info(`  ${m}`);
-    if (!restored.ok) {
-        fail('  Proxy restoration was incomplete — no agent or CA state was removed.');
-        return 1;
-    }
-    const untrust = await uninstallTrust(caCertPath());
-    for (const m of untrust.messages)
-        info(`  ${m}`);
-    const svc = await uninstallAgentService();
-    for (const m of svc.messages)
-        info(`  ${m}`);
-    await removeCa();
-    await saveProfile({ ...profile, agentEnabled: false, agentPort: undefined });
-    ok('  Removed the agent, restored the system proxy, and deleted the device CA.');
-    return 0;
-};
-const runRepair = async () => {
-    if (platform() !== 'darwin') {
-        fail('The legacy agent repair is macOS-only.');
-        return 1;
-    }
-    const profile = await loadProfile();
-    const port = profile.agentPort ?? DEFAULT_AGENT_PORT;
-    heading('Repairing a legacy root-scoped agent install');
-    const restored = await restoreSystemProxy(port);
-    for (const m of restored.messages)
-        info(`  ${m}`);
-    const untrust = await uninstallTrust(caCertPath());
-    for (const m of untrust.messages)
-        info(`  ${m}`);
-    const svc = await uninstallAgentService();
-    for (const m of svc.messages)
-        info(`  ${m}`);
-    await removeCa();
-    await saveProfile({ ...profile, agentEnabled: false, agentPort: undefined });
-    if (!restored.ok || !untrust.ok || !svc.ok) {
-        fail('  Legacy cleanup was incomplete; fix the errors above and run repair again.');
-        return 1;
-    }
-    ok('  Removed legacy root-scoped agent state and disabled stale Anyray proxies.');
-    info(dim('  Reinstall as your normal user: anyray-connect agent install'));
-    return 0;
-};
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-const msg = (error) => error instanceof Error ? error.message : String(error);
-/**
- * True when the CLI was launched via `sudo`. The capture agent is a strictly
- * PER-USER install — a LaunchAgent in the user's `gui/<uid>` domain, a CA
- * trusted in the login keychain, and the user's own network-service proxy — each
- * elevated through a macOS GUI auth prompt, never sudo. Under sudo
- * `process.getuid()` is 0 and `os.homedir()` is /var/root, so every artifact
- * would target root's domain and leave the real user session untouched: a `sudo
- * install` silently strands a stale daemon (the service lands in `gui/0`, which
- * has no Aqua session and never runs), and a `sudo stop`/`uninstall` can't
- * restore the user's proxy, trapping the machine offline. So the lifecycle
- * commands refuse every root context. `SUDO_UID` remains useful for diagnostics
- * and for identifying the legacy cleanup path.
- */
-export const isRunningUnderSudo = () => process.getuid?.() === 0 && !!process.env.SUDO_UID;
-export const isRunningAsRoot = () => process.getuid?.() === 0;
-const refuseRoot = (sub) => {
-    fail(`Run \`anyray-connect agent ${sub}\` as your normal user — not as root.`);
-    info(dim('  The capture agent is a per-user login service (a LaunchAgent, a\n' +
-        '  login-keychain CA, and your own network proxy). macOS prompts for your\n' +
-        "  password when it needs elevation; root instead puts everything in root's\n" +
-        '  domain and leaves your user session untouched.'));
-    info('  Re-run: ' + cyan(`anyray-connect agent ${sub}`));
-};
-/** Lifecycle subcommands that mutate per-user state and must never run as root. */
-const ROOT_GUARDED = new Set(['install', 'start', 'stop', 'uninstall']);
-export const shouldRefuseRootLifecycle = (sub) => ROOT_GUARDED.has(sub) && isRunningAsRoot();
-/** Entry point routed from cli.ts for the `agent` subcommand. */
-export const runAgent = async (argv) => {
-    const sub = argv[0];
-    if (sub && shouldRefuseRootLifecycle(sub)) {
-        refuseRoot(sub);
-        return 1;
-    }
-    if (sub === 'repair' && !isRunningAsRoot()) {
-        fail('`agent repair` is only for cleaning a legacy root-scoped install.');
-        info('  Use: ' + cyan('sudo anyray-connect agent repair'));
-        return 1;
-    }
-    switch (sub) {
-        case 'install':
-            return runInstall();
-        case 'status':
-            return runStatus();
-        case 'stop':
-            return runStop();
-        case 'start':
-            return runStart();
-        case 'uninstall':
-            return runUninstall();
-        case 'repair':
-            return runRepair();
-        case undefined:
-        case 'help':
-        case '--help':
-        case '-h':
-            info(AGENT_HELP);
-            return 0;
-        default:
-            fail(`unknown agent subcommand: ${sub}`);
-            info('\n' + AGENT_HELP);
-            return 1;
-    }
-};
-//# sourceMappingURL=agent.js.map

package/dist/commands/agent.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../src/commands/agent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACL,IAAI,EACJ,IAAI,EACJ,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,EAEJ,EAAE,EACF,IAAI,GACL,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,qBAAqB,EACrB,YAAY,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EACL,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,GACf,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,sBAAsB,CAAC;;;;;;EAMhD,IAAI,CAAC,aAAa,CAAC;;;;;;;;;;;EAWnB,IAAI,CAAC,OAAO,CAAC;;;;;4CAK6B,CAAC;AAE7C,MAAM,qBAAqB,GAAG,GAAS,EAAE;IACvC,OAAO,CAAC,gDAAgD,CAAC,CAAC;IAC1D,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACxE,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC,CAAC;AAC7E,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,KAAK,IAA4B,EAAE;IACxD,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC/B,IAAI,CACF,GAAG,CACD,qFAAqF;YACnF,sDAAsD,CACzD,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,6CAA6C,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,IAAI,CACF,GAAG,CACD,wEAAwE;YACtE,yFAAyF,CAC5F,CACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC;AACzB,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,YAAY,GAAG,KAAK,EACxB,IAAY,EACZ,OAAe,EACG,EAAE;IACpB,OAAO,CAAC,eAAe,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC/E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,cAAc,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC/E,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;YAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,qBAAqB,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClB,IAAI,MAAM,GAAmC,IAAI,CAAC;IAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,EAAE,CAAC,gCAAgC,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,uEAAuE;IACvE,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,qBAAqB,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC,CAAC;IACnF,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,GAAY,EAAE;IAC9B,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAC9D,IAAI,CACF,GAAG,CACD,0EAA0E;YACxE,uEAAuE,CAC1E,CACF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,IAAI,CAAC,yEAAyE,CAAC,CAAC;QAChF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,KAAK,IAAqB,EAAE;IAC7C,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAErD,IAAI,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC,CAAC;IACzD,qBAAqB,EAAE,CAAC;IAExB,gBAAgB;IAChB,OAAO,CAAC,WAAW,CAAC,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,QAAQ,EAAE,CAAC;QACjB,EAAE,CAAC,eAAe,UAAU,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,qCAAqC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0CAA0C;IAC1C,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,qFAAqF,CAAC,CAAC;IAC9F,CAAC;IAED,+EAA+E;IAC/E,iDAAiD;IACjD,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAElB,MAAM,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvE,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC,gCAAgC,CAAC,CAAC,CAAC;IACxE,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,IAAqB,EAAE;IAC5C,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACrD,OAAO,CAAC,6BAA6B,CAAC,CAAC;IACvC,IAAI,CAAC,eAAe,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,eAAe,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEtE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,MAAM;QAAE,EAAE,CAAC,0BAA0B,IAAI,GAAG,CAAC,CAAC;;QAC7C,IAAI,CAAC,iCAAiC,IAAI,GAAG,CAAC,CAAC;IAEpD,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,EAAE,GAAG,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,UAAU,CAAC;YACnD,IAAI,CACF,mBAAmB,KAAK,CAAC,OAAO,MAC9B,EAAE;gBACA,CAAC,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnF,CAAC,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,qBAAqB,EAAE,CAAC;IAExB,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC/B,IAAI,CACF,GAAG,CACD,4EAA4E;QAC1E,MAAM;QACN,qBAAqB,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CACpC,CACF,CAAC;IACF,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,KAAK,IAAqB,EAAE;IAC1C,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACrD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9B,4EAA4E;IAC5E,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,CACF,6EAA6E,CAC9E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,EAAE,CAAC,oEAAoE,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,KAAK,IAAqB,EAAE;IAC3C,IAAI,CAAC,SAAS,EAAE;QAAE,OAAO,CAAC,CAAC;IAC3B,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACrD,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IAClB,MAAM,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,KAAK,IAAqB,EAAE;IAC/C,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACrD,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,CACF,wEAAwE,CACzE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,QAAQ,EAAE,CAAC;IACjB,MAAM,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,EAAE,CAAC,4EAA4E,CAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,KAAK,IAAqB,EAAE;IAC5C,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC,wCAAwC,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACrD,OAAO,CAAC,8CAA8C,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC;IACnD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,qBAAqB,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ;QAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7C,MAAM,QAAQ,EAAE,CAAC;IACjB,MAAM,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI,CACF,6EAA6E,CAC9E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,EAAE,CACA,6EAA6E,CAC9E,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC,CAAC;IAC3E,OAAO,CAAC,CAAC;AACX,CAAC,CAAC;AAEF,MAAM,KAAK,GAAG,CAAC,EAAU,EAAiB,EAAE,CAC1C,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAExC,MAAM,GAAG,GAAG,CAAC,KAAc,EAAU,EAAE,CACrC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAY,EAAE,CAC9C,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAErD,MAAM,CAAC,MAAM,eAAe,GAAG,GAAY,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;AAEvE,MAAM,UAAU,GAAG,CAAC,GAAW,EAAQ,EAAE;IACvC,IAAI,CAAC,8BAA8B,GAAG,uCAAuC,CAAC,CAAC;IAC/E,IAAI,CACF,GAAG,CACD,qEAAqE;QACnE,4EAA4E;QAC5E,8EAA8E;QAC9E,kDAAkD,CACrD,CACF,CAAC;IACF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC,CAAC;AAEF,mFAAmF;AACnF,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;AAExE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAW,EAAW,EAAE,CAChE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,eAAe,EAAE,CAAC;AAE7C,iEAAiE;AACjE,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EAAE,IAAc,EAAmB,EAAE;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,GAAG,IAAI,yBAAyB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,UAAU,CAAC,GAAG,CAAC,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;QAC3C,IAAI,CAAC,mEAAmE,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC;QAC3D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,SAAS;YACZ,OAAO,UAAU,EAAE,CAAC;QACtB,KAAK,QAAQ;YACX,OAAO,SAAS,EAAE,CAAC;QACrB,KAAK,MAAM;YACT,OAAO,OAAO,EAAE,CAAC;QACnB,KAAK,OAAO;YACV,OAAO,QAAQ,EAAE,CAAC;QACpB,KAAK,WAAW;YACd,OAAO,YAAY,EAAE,CAAC;QACxB,KAAK,QAAQ;YACX,OAAO,SAAS,EAAE,CAAC;QACrB,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,IAAI,CAAC,UAAU,CAAC,CAAC;YACjB,OAAO,CAAC,CAAC;QACX;YACE,IAAI,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,CAAC;YACxB,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC,CAAC"}