@ironbee-ai/cli 0.14.1 → 0.16.0

package/dist/clients/codex/index.js

@@ -0,0 +1,427 @@
+"use strict";
+/**
+ * Codex CLI client adapter.
+ *
+ * Targets interactive Codex TUI (the developer-workstation surface).
+ * `codex exec` non-interactive mode is OUT OF SCOPE — hooks don't fire there
+ * per regression #24211.
+ *
+ * Install writes USER-LEVEL artifacts (`~/.codex/hooks.json`,
+ * `~/.codex/config.toml`) to bypass Codex's project-trust gate, plus
+ * PROJECT-LEVEL guidance (`AGENTS.md` block, `.agents/skills/<name>/SKILL.md`).
+ * Uninstall is symmetric — strips IronBee blocks, preserves user content.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CodexClient = void 0;
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = require("path");
+const gitignore_1 = require("../../lib/gitignore");
+const logger_1 = require("../../lib/logger");
+const output_1 = require("../../lib/output");
+const fs_prune_1 = require("../../lib/fs-prune");
+const config_1 = require("../../lib/config");
+const platform_section_1 = require("../../lib/platform-section");
+const util_1 = require("./util");
+const verify_gate_1 = require("./hooks/verify-gate");
+const activity_end_1 = require("./hooks/activity-end");
+const session_start_1 = require("./hooks/session-start");
+const activity_start_1 = require("./hooks/activity-start");
+const require_verification_1 = require("./hooks/require-verification");
+const require_verdict_1 = require("./hooks/require-verdict");
+const clear_verdict_1 = require("./hooks/clear-verdict");
+const track_action_1 = require("./hooks/track-action");
+const track_action_monitor_1 = require("./hooks/track-action-monitor");
+const track_action_pre_1 = require("./hooks/track-action-pre");
+const BROWSER_SERVER = "browser-devtools";
+const NODE_SERVER = "node-devtools";
+const BACKEND_SERVER = "backend-devtools";
+const IRONBEE_HOOK_MARKER = "ironbee";
+/**
+ * Resolve the platforms-fragments dir at runtime. Mirrors the Cursor pattern.
+ * `__dirname` is `src/clients/codex/` (or `dist/clients/codex/` after build);
+ * `..` + `client` walks back up to allow sharing across clients if ever needed.
+ */
+function platformsDirFor(client) {
+    return (0, path_1.join)(__dirname, "..", client, "platforms");
+}
+function codexColor(text) {
+    return output_1.pc.dim(text);
+}
+function isIronBeeHookGroup(group) {
+    return group.hooks.some((h) => h.command.includes(IRONBEE_HOOK_MARKER));
+}
+function isCodexHooksEmpty(config) {
+    const keys = Object.keys(config);
+    if (keys.length === 0) {
+        return true;
+    }
+    if (keys.length === 1 && keys[0] === "hooks") {
+        return Object.keys(config.hooks ?? {}).length === 0;
+    }
+    return false;
+}
+class CodexClient {
+    constructor() {
+        this.name = "codex";
+    }
+    detect(projectDir) {
+        // Pure project-presence signal — only IronBee creates this dir.
+        // Independent of `~/.codex/auth.json` so `codex logout` doesn't break detect.
+        return (0, fs_1.existsSync)((0, path_1.join)(projectDir, ".agents", "skills", "ironbee-verification"));
+    }
+    resolveProjectDir() {
+        return process.env.CODEX_PROJECT_DIR ?? process.env.IRONBEE_PROJECT_DIR ?? process.cwd();
+    }
+    install(projectDir, config) {
+        const cfg = config ?? (0, config_1.loadConfig)(projectDir);
+        const verificationEnabled = (0, config_1.getVerificationEnabled)(cfg);
+        // Clean up old artifacts first (re-install / mode-toggle safety).
+        this.cleanupArtifacts(projectDir);
+        // 1) hooks.json — user-level, merged with existing user hooks
+        const hooksPath = (0, util_1.codexHooksJsonPath)();
+        this.mergeHooksConfig(hooksPath, verificationEnabled);
+        // 2) config.toml — [features] hooks = true + [mcp_servers.*] per cycle
+        this.mergeConfigToml(projectDir, cfg, verificationEnabled);
+        // 3) Project-level guidance: AGENTS.md + skills
+        if (verificationEnabled) {
+            this.writeAgentsMdBlock(projectDir, cfg);
+            this.writeSkills(projectDir);
+            // Sync platform marker blocks in the standalone skill + command
+            // files (.agents/skills/ironbee-*/SKILL.md) to current config
+            // state. The AGENTS.md rule block is handled inline by
+            // writeAgentsMdBlock above (it lives embedded in a delimited
+            // block, not a standalone file, so PLATFORM_TARGETS doesn't
+            // cover it).
+            (0, platform_section_1.syncPlatformSectionsToConfig)(projectDir, platformsDirFor);
+        }
+        // 4) .gitignore safety — shared helper covers .ironbee/sessions/,
+        // .ironbee/otel/, .ironbee/config.local.json, .claude/settings.local.json.
+        // We deliberately do NOT gitignore .agents/skills/ironbee-* — the team
+        // should share those skills (same semantic as Claude's .claude/skills/*).
+        (0, gitignore_1.ensureIronBeeGitignored)(projectDir);
+        // 5) install-output checklist
+        console.log(`  ${output_1.pc.dim("→")} ${codexColor("[codex]")} hooks    ${output_1.pc.dim("→")} ${output_1.pc.dim(hooksPath)}`);
+        console.log(`  ${output_1.pc.dim("→")} ${codexColor("[codex]")} config   ${output_1.pc.dim("→")} ${output_1.pc.dim((0, util_1.codexConfigTomlPath)())}`);
+        if (verificationEnabled) {
+            console.log(`  ${output_1.pc.dim("→")} ${codexColor("[codex]")} agents   ${output_1.pc.dim("→")} ${output_1.pc.dim((0, path_1.join)(projectDir, "AGENTS.md"))}`);
+            console.log(`  ${output_1.pc.dim("→")} ${codexColor("[codex]")} skill    ${output_1.pc.dim("→")} ${output_1.pc.dim((0, path_1.join)(projectDir, ".agents", "skills", "ironbee-verification", "SKILL.md"))}`);
+            console.log(`  ${output_1.pc.dim("→")} ${codexColor("[codex]")} command  ${output_1.pc.dim("→")} ${output_1.pc.dim((0, path_1.join)(projectDir, ".agents", "skills", "ironbee-verify", "SKILL.md"))}`);
+        }
+        else {
+            console.log(`  ${output_1.pc.dim("→")} ${codexColor("[codex]")} ${output_1.pc.yellow("monitoring-only mode")} (verification.enable: false)`);
+        }
+        console.log();
+        console.log(`  ${output_1.pc.yellow("⚠")} ${output_1.pc.yellow("Codex requires one-time TUI setup:")}`);
+        console.log(`    ${output_1.pc.yellow("1.")} Run ${output_1.pc.bold("/hooks")} in a fresh Codex session to review and trust IronBee hooks`);
+        console.log(`    ${output_1.pc.yellow("2.")} Restart any open Codex sessions to pick up new hook config`);
+    }
+    uninstall(projectDir) {
+        this.cleanupArtifacts(projectDir);
+        console.log(`  ${output_1.pc.dim("→")} ${codexColor("[codex]")} removed hooks, MCP entries, AGENTS.md block, and skills`);
+    }
+    cleanupArtifacts(projectDir) {
+        // 1) strip IronBee hook entries from ~/.codex/hooks.json
+        const hooksPath = (0, util_1.codexHooksJsonPath)();
+        this.removeIronBeeHooks(hooksPath);
+        this.maybeDeleteEmptyHooks(hooksPath);
+        // 2) strip [mcp_servers.<our-names>] from ~/.codex/config.toml.
+        //    Leave [features] hooks = true untouched (generic flag).
+        this.removeIronBeeMcpServers();
+        // 3) strip AGENTS.md block; remove file if empty
+        const agentsPath = (0, path_1.join)(projectDir, "AGENTS.md");
+        if ((0, fs_1.existsSync)(agentsPath)) {
+            try {
+                const existing = (0, fs_1.readFileSync)(agentsPath, "utf-8");
+                const remaining = (0, util_1.stripAgentsMdBlock)(existing);
+                if (remaining === null) {
+                    (0, fs_1.unlinkSync)(agentsPath);
+                }
+                else if (remaining !== existing) {
+                    (0, fs_1.writeFileSync)(agentsPath, remaining);
+                }
+            }
+            catch (e) {
+                logger_1.logger.debug(`failed to strip AGENTS.md block: ${e}`);
+            }
+        }
+        // 4) remove skills + commands
+        const skillsDir = (0, path_1.join)(projectDir, ".agents", "skills");
+        this.removeDir((0, path_1.join)(skillsDir, "ironbee-verification"));
+        this.removeDir((0, path_1.join)(skillsDir, "ironbee-verify"));
+        (0, fs_prune_1.pruneEmptyDirs)((0, path_1.join)(projectDir, ".agents"));
+    }
+    async runVerifyGate(projectDir) {
+        await (0, verify_gate_1.run)(projectDir);
+    }
+    async runActivityEnd(projectDir) {
+        await (0, activity_end_1.run)(projectDir);
+    }
+    async runSessionStart(projectDir) {
+        await (0, session_start_1.run)(projectDir);
+    }
+    async runActivityStart(projectDir) {
+        await (0, activity_start_1.run)(projectDir);
+    }
+    async runRequireVerification(projectDir) {
+        await (0, require_verification_1.run)(projectDir);
+    }
+    async runRequireVerdict(projectDir) {
+        await (0, require_verdict_1.run)(projectDir);
+    }
+    async runClearVerdict(projectDir) {
+        await (0, clear_verdict_1.run)(projectDir);
+    }
+    async runTrackAction(projectDir) {
+        await (0, track_action_1.run)(projectDir);
+    }
+    async runTrackActionMonitor(projectDir) {
+        await (0, track_action_monitor_1.run)(projectDir);
+    }
+    async runTrackActionPre(projectDir) {
+        await (0, track_action_pre_1.run)(projectDir);
+    }
+    async runSessionEnd(_projectDir) {
+        // Codex has no SessionEnd hook event — `/quit` fires zero hooks.
+        // The Stop-as-checkpoint pattern in verify-gate.ts / activity-end.ts
+        // covers session_end synthesis instead. This method is a no-op
+        // because the IClient interface requires it; we never register a
+        // hook config entry for it on Codex.
+        logger_1.logger.debug(`session-end: no-op on Codex (no SessionEnd hook event)`);
+    }
+    mergeHooksConfig(hooksPath, verificationEnabled) {
+        (0, fs_1.mkdirSync)((0, path_1.join)((0, os_1.homedir)(), ".codex"), { recursive: true });
+        let config = { hooks: {} };
+        if ((0, fs_1.existsSync)(hooksPath)) {
+            try {
+                config = JSON.parse((0, fs_1.readFileSync)(hooksPath, "utf-8"));
+                if (!config.hooks) {
+                    config.hooks = {};
+                }
+            }
+            catch (e) {
+                logger_1.logger.debug(`failed to parse ${hooksPath}: ${e}`);
+                config = { hooks: {} };
+            }
+        }
+        // Strip existing IronBee entries (re-install + mode-toggle safety)
+        for (const evt of Object.keys(config.hooks)) {
+            const filtered = config.hooks[evt].filter((g) => !isIronBeeHookGroup(g));
+            if (filtered.length === 0) {
+                delete config.hooks[evt];
+            }
+            else {
+                config.hooks[evt] = filtered;
+            }
+        }
+        const addGroup = (event, matcher, command) => {
+            if (!config.hooks[event]) {
+                config.hooks[event] = [];
+            }
+            config.hooks[event].push({
+                matcher,
+                hooks: [{ type: "command", command }],
+            });
+        };
+        // SessionStart (always)
+        addGroup("SessionStart", ".*", `ironbee hook session-start --client codex`);
+        // UserPromptSubmit (always) — start activity + UPS-reconcile for interrupt detection
+        addGroup("UserPromptSubmit", ".*", `ironbee hook activity-start --client codex`);
+        // PreToolUse — timestamp stash for duration derivation (always)
+        addGroup("PreToolUse", ".*", `ironbee hook track-action-pre --client codex`);
+        if (verificationEnabled) {
+            // PreToolUse — require-verification on devtools MCP tools.
+            // Codex flattens `-` → `_` in the server segment on hook dispatch
+            // (real wire shape: `mcp__browser_devtools__bdt_*`), so the
+            // matcher accepts BOTH forms: hyphenated (defensive / future
+            // Codex versions) AND underscored (current real wire shape).
+            // Without this, no devtools tool ever triggers the gate.
+            addGroup("PreToolUse", "^mcp__(browser|node|backend)[-_]devtools__.*", `ironbee hook require-verification --client codex`);
+            // PreToolUse — require-verdict on apply_patch
+            addGroup("PreToolUse", "^apply_patch$", `ironbee hook require-verdict --client codex`);
+            // PostToolUse — clear-verdict on apply_patch
+            addGroup("PostToolUse", "^apply_patch$", `ironbee hook clear-verdict --client codex`);
+        }
+        // PostToolUse — track every tool (mode-paired command)
+        const trackCmd = verificationEnabled
+            ? `ironbee hook track-action --client codex`
+            : `ironbee hook track-action-monitor --client codex`;
+        addGroup("PostToolUse", ".*", trackCmd);
+        // Stop — verify-gate (enabled) or activity-end (monitoring)
+        const stopCmd = verificationEnabled
+            ? `ironbee hook verify-gate --client codex`
+            : `ironbee hook activity-end --client codex`;
+        addGroup("Stop", ".*", stopCmd);
+        (0, fs_1.writeFileSync)(hooksPath, JSON.stringify(config, null, 2));
+    }
+    removeIronBeeHooks(hooksPath) {
+        if (!(0, fs_1.existsSync)(hooksPath)) {
+            return;
+        }
+        try {
+            const config = JSON.parse((0, fs_1.readFileSync)(hooksPath, "utf-8"));
+            if (!config.hooks) {
+                return;
+            }
+            for (const evt of Object.keys(config.hooks)) {
+                const filtered = config.hooks[evt].filter((g) => !isIronBeeHookGroup(g));
+                if (filtered.length === 0) {
+                    delete config.hooks[evt];
+                }
+                else {
+                    config.hooks[evt] = filtered;
+                }
+            }
+            (0, fs_1.writeFileSync)(hooksPath, JSON.stringify(config, null, 2));
+        }
+        catch (e) {
+            logger_1.logger.debug(`failed to strip IronBee hooks from ${hooksPath}: ${e}`);
+        }
+    }
+    maybeDeleteEmptyHooks(hooksPath) {
+        if (!(0, fs_1.existsSync)(hooksPath)) {
+            return;
+        }
+        try {
+            const config = JSON.parse((0, fs_1.readFileSync)(hooksPath, "utf-8"));
+            if (isCodexHooksEmpty(config)) {
+                (0, fs_1.unlinkSync)(hooksPath);
+            }
+        }
+        catch (e) {
+            logger_1.logger.debug(`failed to inspect ${hooksPath} for emptiness: ${e}`);
+        }
+    }
+    mergeConfigToml(projectDir, cfg, verificationEnabled) {
+        (0, fs_1.mkdirSync)((0, path_1.join)((0, os_1.homedir)(), ".codex"), { recursive: true });
+        let content = (0, util_1.readCodexConfigToml)();
+        // [features] hooks = true (idempotent merge)
+        content = (0, util_1.ensureFeaturesHooksTrue)(content);
+        // [mcp_servers.<name>] per cycle (verification-enabled only)
+        if (verificationEnabled) {
+            if ((0, config_1.isCycleEnabled)(cfg, "browser")) {
+                const entry = (0, config_1.getMcpServerEntry)(projectDir);
+                content = (0, util_1.upsertMcpServer)(content, BROWSER_SERVER, mcpEntryToTomlBody(entry));
+            }
+            else {
+                content = (0, util_1.removeMcpServer)(content, BROWSER_SERVER);
+            }
+            if ((0, config_1.isCycleEnabled)(cfg, "node")) {
+                const entry = (0, config_1.getNodeDevToolsMcpEntry)(projectDir);
+                content = (0, util_1.upsertMcpServer)(content, NODE_SERVER, mcpEntryToTomlBody(entry));
+            }
+            else {
+                content = (0, util_1.removeMcpServer)(content, NODE_SERVER);
+            }
+            if ((0, config_1.isCycleEnabled)(cfg, "backend")) {
+                const entry = (0, config_1.getBackendDevToolsMcpEntry)(projectDir);
+                content = (0, util_1.upsertMcpServer)(content, BACKEND_SERVER, mcpEntryToTomlBody(entry));
+            }
+            else {
+                content = (0, util_1.removeMcpServer)(content, BACKEND_SERVER);
+            }
+        }
+        else {
+            // Strip all 3 in monitoring mode
+            content = (0, util_1.removeMcpServer)(content, BROWSER_SERVER);
+            content = (0, util_1.removeMcpServer)(content, NODE_SERVER);
+            content = (0, util_1.removeMcpServer)(content, BACKEND_SERVER);
+        }
+        (0, util_1.writeCodexConfigToml)(content);
+    }
+    removeIronBeeMcpServers() {
+        let content = (0, util_1.readCodexConfigToml)();
+        if (!content) {
+            return;
+        }
+        content = (0, util_1.removeMcpServer)(content, BROWSER_SERVER);
+        content = (0, util_1.removeMcpServer)(content, NODE_SERVER);
+        content = (0, util_1.removeMcpServer)(content, BACKEND_SERVER);
+        (0, util_1.writeCodexConfigToml)(content);
+    }
+    writeAgentsMdBlock(projectDir, cfg) {
+        const agentsPath = (0, path_1.join)(projectDir, "AGENTS.md");
+        const ruleSourcePath = (0, path_1.join)(__dirname, "rules", "ironbee-verification.md");
+        let blockContent;
+        try {
+            blockContent = (0, fs_1.readFileSync)(ruleSourcePath, "utf-8");
+        }
+        catch (e) {
+            logger_1.logger.debug(`failed to read rule source ${ruleSourcePath}: ${e}`);
+            return;
+        }
+        // Splice platform fragments INLINE into the rule content (per enabled
+        // cycle) BEFORE wrapping it in the AGENTS.md ironbee block. The rule
+        // is embedded — not a standalone file — so PLATFORM_TARGETS /
+        // applyPlatformToProjectFiles can't reach it. We replicate the
+        // splice in memory: enabled cycle → load fragment; disabled cycle →
+        // replace with placeholder.
+        const platformsDir = platformsDirFor("codex");
+        for (const cycle of config_1.ALL_CYCLES) {
+            const enabled = (0, config_1.isCycleEnabled)(cfg, cycle);
+            const resolver = enabled
+                ? (key) => {
+                    const fragPath = (0, path_1.join)(platformsDir, (0, platform_section_1.fragmentFilename)("rule", cycle, key));
+                    if (!(0, fs_1.existsSync)(fragPath)) {
+                        const keyDisplay = key.length > 0 ? `${cycle}:${key}` : cycle;
+                        logger_1.logger.debug(`AGENTS.md platform-section ${keyDisplay}: missing fragment ${fragPath}, using placeholder`);
+                        return null;
+                    }
+                    return (0, fs_1.readFileSync)(fragPath, "utf-8").trimEnd();
+                }
+                : null;
+            blockContent = (0, platform_section_1.applyPlatformSection)(blockContent, cycle, resolver, "AGENTS.md");
+        }
+        const existing = (0, fs_1.existsSync)(agentsPath) ? (0, fs_1.readFileSync)(agentsPath, "utf-8") : "";
+        const updated = (0, util_1.upsertAgentsMdBlock)(existing, blockContent);
+        (0, fs_1.writeFileSync)(agentsPath, updated);
+    }
+    writeSkills(projectDir) {
+        const skillsRoot = (0, path_1.join)(projectDir, ".agents", "skills");
+        const verificationSkillDir = (0, path_1.join)(skillsRoot, "ironbee-verification");
+        (0, fs_1.mkdirSync)(verificationSkillDir, { recursive: true });
+        const skillSrc = (0, path_1.join)(__dirname, "skills", "ironbee-verification.md");
+        try {
+            const content = (0, fs_1.readFileSync)(skillSrc, "utf-8");
+            (0, fs_1.writeFileSync)((0, path_1.join)(verificationSkillDir, "SKILL.md"), content);
+        }
+        catch (e) {
+            logger_1.logger.debug(`failed to copy skill ${skillSrc}: ${e}`);
+        }
+        const verifyDir = (0, path_1.join)(skillsRoot, "ironbee-verify");
+        (0, fs_1.mkdirSync)(verifyDir, { recursive: true });
+        const verifySrc = (0, path_1.join)(__dirname, "commands", "ironbee-verify", "SKILL.md");
+        try {
+            const content = (0, fs_1.readFileSync)(verifySrc, "utf-8");
+            (0, fs_1.writeFileSync)((0, path_1.join)(verifyDir, "SKILL.md"), content);
+        }
+        catch (e) {
+            logger_1.logger.debug(`failed to copy verify command ${verifySrc}: ${e}`);
+        }
+    }
+    removeDir(dir) {
+        if ((0, fs_1.existsSync)(dir)) {
+            try {
+                (0, fs_1.rmSync)(dir, { recursive: true, force: true });
+            }
+            catch (e) {
+                logger_1.logger.debug(`failed to remove ${dir}: ${e}`);
+            }
+        }
+    }
+}
+exports.CodexClient = CodexClient;
+/**
+ * Convert an MCP entry (the JSON shape used in Claude/Cursor's .mcp.json)
+ * into per-line TOML body suitable for `[mcp_servers.<name>]`. Inline tables
+ * are used for env (matches Codex's documented format).
+ */
+function mcpEntryToTomlBody(entry) {
+    const record = entry;
+    return (0, util_1.tomlBodyFromRecord)(record);
+}
+// Silence "unused import" linter — markers are exported from util but the
+// install path references them indirectly via upsertAgentsMdBlock.
+void util_1.AGENTS_MD_START_MARKER;
+void util_1.AGENTS_MD_END_MARKER;
+//# sourceMappingURL=index.js.map

package/dist/clients/codex/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/clients/codex/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;;AAEH,2BAA4F;AAC5F,2BAA6B;AAC7B,+BAA4B;AAE5B,mDAA8D;AAC9D,6CAA0C;AAC1C,6CAAsC;AACtC,iDAAoD;AACpD,6CAU0B;AAC1B,iEAKoC;AACpC,iCAagB;AAChB,qDAA+D;AAC/D,uDAAiE;AACjE,yDAAmE;AACnE,2DAAqE;AACrE,uEAAiF;AACjF,6DAAuE;AACvE,yDAAmE;AACnE,uDAAiE;AACjE,uEAAgF;AAChF,+DAAwE;AAExE,MAAM,cAAc,GAAW,kBAAkB,CAAC;AAClD,MAAM,WAAW,GAAW,eAAe,CAAC;AAC5C,MAAM,cAAc,GAAW,kBAAkB,CAAC;AAClD,MAAM,mBAAmB,GAAW,SAAS,CAAC;AAE9C;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAc;IACnC,OAAO,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;AACtD,CAAC;AAeD,SAAS,UAAU,CAAC,IAAY;IAC5B,OAAO,WAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAqB;IAC7C,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAiB,EAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC;AACrG,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAsB;IAC7C,MAAM,IAAI,GAAa,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QAC3C,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,MAAa,WAAW;IAAxB;QACoB,SAAI,GAAW,OAAO,CAAC;IA2X3C,CAAC;IAzXU,MAAM,CAAC,UAAkB;QAC5B,gEAAgE;QAChE,8EAA8E;QAC9E,OAAO,IAAA,eAAU,EAAC,IAAA,WAAI,EAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACrF,CAAC;IAEM,iBAAiB;QACpB,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC7F,CAAC;IAEM,OAAO,CAAC,UAAkB,EAAE,MAAsB;QACrD,MAAM,GAAG,GAAkB,MAAM,IAAI,IAAA,mBAAU,EAAC,UAAU,CAAC,CAAC;QAC5D,MAAM,mBAAmB,GAAY,IAAA,+BAAsB,EAAC,GAAG,CAAC,CAAC;QAEjE,kEAAkE;QAClE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAElC,8DAA8D;QAC9D,MAAM,SAAS,GAAW,IAAA,yBAAkB,GAAE,CAAC;QAC/C,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAEtD,uEAAuE;QACvE,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,GAAG,EAAE,mBAAmB,CAAC,CAAC;QAE3D,gDAAgD;QAChD,IAAI,mBAAmB,EAAE,CAAC;YACtB,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAC7B,gEAAgE;YAChE,8DAA8D;YAC9D,uDAAuD;YACvD,6DAA6D;YAC7D,4DAA4D;YAC5D,aAAa;YACb,IAAA,+CAA4B,EAAC,UAAU,EAAE,eAAe,CAAC,CAAC;QAC9D,CAAC;QAED,kEAAkE;QAClE,2EAA2E;QAC3E,uEAAuE;QACvE,0EAA0E;QAC1E,IAAA,mCAAuB,EAAC,UAAU,CAAC,CAAC;QAEpC,8BAA8B;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,aAAa,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAE,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtG,OAAO,CAAC,GAAG,CAAC,KAAK,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,aAAa,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAE,CAAC,GAAG,CAAC,IAAA,0BAAmB,GAAE,CAAC,EAAE,CAAC,CAAC;QAClH,IAAI,mBAAmB,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,KAAK,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,aAAa,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAE,CAAC,GAAG,CAAC,IAAA,WAAI,EAAC,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;YAC1H,OAAO,CAAC,GAAG,CAAC,KAAK,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,aAAa,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAE,CAAC,GAAG,CAAC,IAAA,WAAI,EAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,sBAAsB,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;YACtK,OAAO,CAAC,GAAG,CAAC,KAAK,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,aAAa,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,WAAE,CAAC,GAAG,CAAC,IAAA,WAAI,EAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;QACpK,CAAC;aAAM,CAAC;YACJ,OAAO,CAAC,GAAG,CAAC,KAAK,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,IAAI,WAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,+BAA+B,CAAC,CAAC;QAC/H,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,KAAK,WAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,WAAE,CAAC,MAAM,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,OAAO,WAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,WAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,6DAA6D,CAAC,CAAC;QAC1H,OAAO,CAAC,GAAG,CAAC,OAAO,WAAE,CAAC,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IACrG,CAAC;IAEM,SAAS,CAAC,UAAkB;QAC/B,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,KAAK,WAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,0DAA0D,CAAC,CAAC;IACrH,CAAC;IAEO,gBAAgB,CAAC,UAAkB;QACvC,yDAAyD;QACzD,MAAM,SAAS,GAAW,IAAA,yBAAkB,GAAE,CAAC;QAC/C,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAEtC,gEAAgE;QAChE,6DAA6D;QAC7D,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAE/B,iDAAiD;QACjD,MAAM,UAAU,GAAW,IAAA,WAAI,EAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACzD,IAAI,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACD,MAAM,QAAQ,GAAW,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBAC3D,MAAM,SAAS,GAAkB,IAAA,yBAAkB,EAAC,QAAQ,CAAC,CAAC;gBAC9D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBACrB,IAAA,eAAU,EAAC,UAAU,CAAC,CAAC;gBAC3B,CAAC;qBAAM,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAChC,IAAA,kBAAa,EAAC,UAAU,EAAE,SAAS,CAAC,CAAC;gBACzC,CAAC;YACL,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBAClB,eAAM,CAAC,KAAK,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAC;YAC1D,CAAC;QACL,CAAC;QAED,8BAA8B;QAC9B,MAAM,SAAS,GAAW,IAAA,WAAI,EAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,CAAC,SAAS,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAClD,IAAA,yBAAc,EAAC,IAAA,WAAI,EAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IAChD,CAAC;IAEM,KAAK,CAAC,aAAa,CAAC,UAAkB;QACzC,MAAM,IAAA,iBAAiB,EAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IACM,KAAK,CAAC,cAAc,CAAC,UAAkB;QAC1C,MAAM,IAAA,kBAAkB,EAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IACM,KAAK,CAAC,eAAe,CAAC,UAAkB;QAC3C,MAAM,IAAA,mBAAmB,EAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IACM,KAAK,CAAC,gBAAgB,CAAC,UAAkB;QAC5C,MAAM,IAAA,oBAAoB,EAAC,UAAU,CAAC,CAAC;IAC3C,CAAC;IACM,KAAK,CAAC,sBAAsB,CAAC,UAAkB;QAClD,MAAM,IAAA,0BAA0B,EAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IACM,KAAK,CAAC,iBAAiB,CAAC,UAAkB;QAC7C,MAAM,IAAA,qBAAqB,EAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IACM,KAAK,CAAC,eAAe,CAAC,UAAkB;QAC3C,MAAM,IAAA,mBAAmB,EAAC,UAAU,CAAC,CAAC;IAC1C,CAAC;IACM,KAAK,CAAC,cAAc,CAAC,UAAkB;QAC1C,MAAM,IAAA,kBAAkB,EAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IACM,KAAK,CAAC,qBAAqB,CAAC,UAAkB;QACjD,MAAM,IAAA,0BAAyB,EAAC,UAAU,CAAC,CAAC;IAChD,CAAC;IACM,KAAK,CAAC,iBAAiB,CAAC,UAAkB;QAC7C,MAAM,IAAA,sBAAqB,EAAC,UAAU,CAAC,CAAC;IAC5C,CAAC;IACM,KAAK,CAAC,aAAa,CAAC,WAAmB;QAC1C,iEAAiE;QACjE,qEAAqE;QACrE,+DAA+D;QAC/D,iEAAiE;QACjE,qCAAqC;QACrC,eAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC3E,CAAC;IAEO,gBAAgB,CAAC,SAAiB,EAAE,mBAA4B;QACpE,IAAA,cAAS,EAAC,IAAA,WAAI,EAAC,IAAA,YAAO,GAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,MAAM,GAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;QAC3C,IAAI,IAAA,eAAU,EAAC,SAAS,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,SAAS,EAAE,OAAO,CAAC,CAAmB,CAAC;gBACxE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAChB,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;gBACtB,CAAC;YACL,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBAClB,eAAM,CAAC,KAAK,CAAC,mBAAmB,SAAS,KAAK,CAAC,EAAE,CAAC,CAAC;gBACnD,MAAM,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YAC3B,CAAC;QACL,CAAC;QAED,mEAAmE;QACnE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAqB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CACvD,CAAC,CAAiB,EAAW,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACzD,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACJ,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACjC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAA8D,CACxE,KAAa,EACb,OAAe,EACf,OAAe,EACX,EAAE;YACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC7B,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;gBACrB,OAAO;gBACP,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;aACxC,CAAC,CAAC;QACP,CAAC,CAAC;QAEF,wBAAwB;QACxB,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,2CAA2C,CAAC,CAAC;QAE5E,qFAAqF;QACrF,QAAQ,CAAC,kBAAkB,EAAE,IAAI,EAAE,4CAA4C,CAAC,CAAC;QAEjF,gEAAgE;QAChE,QAAQ,CAAC,YAAY,EAAE,IAAI,EAAE,8CAA8C,CAAC,CAAC;QAE7E,IAAI,mBAAmB,EAAE,CAAC;YACtB,2DAA2D;YAC3D,kEAAkE;YAClE,4DAA4D;YAC5D,6DAA6D;YAC7D,6DAA6D;YAC7D,yDAAyD;YACzD,QAAQ,CACJ,YAAY,EACZ,8CAA8C,EAC9C,kDAAkD,CACrD,CAAC;YACF,8CAA8C;YAC9C,QAAQ,CAAC,YAAY,EAAE,eAAe,EAAE,6CAA6C,CAAC,CAAC;YACvF,6CAA6C;YAC7C,QAAQ,CAAC,aAAa,EAAE,eAAe,EAAE,2CAA2C,CAAC,CAAC;QAC1F,CAAC;QAED,uDAAuD;QACvD,MAAM,QAAQ,GAAW,mBAAmB;YACxC,CAAC,CAAC,0CAA0C;YAC5C,CAAC,CAAC,kDAAkD,CAAC;QACzD,QAAQ,CAAC,aAAa,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QAExC,4DAA4D;QAC5D,MAAM,OAAO,GAAW,mBAAmB;YACvC,CAAC,CAAC,yCAAyC;YAC3C,CAAC,CAAC,0CAA0C,CAAC;QACjD,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAEhC,IAAA,kBAAa,EAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IAEO,kBAAkB,CAAC,SAAiB;QACxC,IAAI,CAAC,IAAA,eAAU,EAAC,SAAS,CAAC,EAAE,CAAC;YACzB,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAmB,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,SAAS,EAAE,OAAO,CAAC,CAAmB,CAAC;YAC9F,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAChB,OAAO;YACX,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,MAAM,QAAQ,GAAqB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CACvD,CAAC,CAAiB,EAAW,EAAE,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CACzD,CAAC;gBACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxB,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC7B,CAAC;qBAAM,CAAC;oBACJ,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;gBACjC,CAAC;YACL,CAAC;YACD,IAAA,kBAAa,EAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YAClB,eAAM,CAAC,KAAK,CAAC,sCAAsC,SAAS,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1E,CAAC;IACL,CAAC;IAEO,qBAAqB,CAAC,SAAiB;QAC3C,IAAI,CAAC,IAAA,eAAU,EAAC,SAAS,CAAC,EAAE,CAAC;YACzB,OAAO;QACX,CAAC;QACD,IAAI,CAAC;YACD,MAAM,MAAM,GAAmB,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,SAAS,EAAE,OAAO,CAAC,CAAmB,CAAC;YAC9F,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5B,IAAA,eAAU,EAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACL,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YAClB,eAAM,CAAC,KAAK,CAAC,qBAAqB,SAAS,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACL,CAAC;IAEO,eAAe,CAAC,UAAkB,EAAE,GAAkB,EAAE,mBAA4B;QACxF,IAAA,cAAS,EAAC,IAAA,WAAI,EAAC,IAAA,YAAO,GAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,OAAO,GAAW,IAAA,0BAAmB,GAAE,CAAC;QAE5C,6CAA6C;QAC7C,OAAO,GAAG,IAAA,8BAAuB,EAAC,OAAO,CAAC,CAAC;QAE3C,6DAA6D;QAC7D,IAAI,mBAAmB,EAAE,CAAC;YACtB,IAAI,IAAA,uBAAc,EAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;gBACjC,MAAM,KAAK,GAA6B,IAAA,0BAAiB,EAAC,UAAU,CAAC,CAAC;gBACtE,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,EAAE,cAAc,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;YAClF,CAAC;iBAAM,CAAC;gBACJ,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACvD,CAAC;YACD,IAAI,IAAA,uBAAc,EAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAA6B,IAAA,gCAAuB,EAAC,UAAU,CAAC,CAAC;gBAC5E,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,EAAE,WAAW,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/E,CAAC;iBAAM,CAAC;gBACJ,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACpD,CAAC;YACD,IAAI,IAAA,uBAAc,EAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC;gBACjC,MAAM,KAAK,GAA6B,IAAA,mCAA0B,EAAC,UAAU,CAAC,CAAC;gBAC/E,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,EAAE,cAAc,EAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;YAClF,CAAC;iBAAM,CAAC;gBACJ,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACvD,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,iCAAiC;YACjC,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YACnD,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAChD,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACvD,CAAC;QAED,IAAA,2BAAoB,EAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAEO,uBAAuB;QAC3B,IAAI,OAAO,GAAW,IAAA,0BAAmB,GAAE,CAAC;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,OAAO;QACX,CAAC;QACD,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACnD,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAChD,OAAO,GAAG,IAAA,sBAAe,EAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACnD,IAAA,2BAAoB,EAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAEO,kBAAkB,CAAC,UAAkB,EAAE,GAAkB;QAC7D,MAAM,UAAU,GAAW,IAAA,WAAI,EAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QACzD,MAAM,cAAc,GAAW,IAAA,WAAI,EAAC,SAAS,EAAE,OAAO,EAAE,yBAAyB,CAAC,CAAC;QACnF,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACD,YAAY,GAAG,IAAA,iBAAY,EAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YAClB,eAAM,CAAC,KAAK,CAAC,8BAA8B,cAAc,KAAK,CAAC,EAAE,CAAC,CAAC;YACnE,OAAO;QACX,CAAC;QAED,sEAAsE;QACtE,qEAAqE;QACrE,8DAA8D;QAC9D,+DAA+D;QAC/D,oEAAoE;QACpE,4BAA4B;QAC5B,MAAM,YAAY,GAAW,eAAe,CAAC,OAAO,CAAC,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,mBAAU,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAY,IAAA,uBAAc,EAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAwB,OAAO;gBACzC,CAAC,CAAC,CAAC,GAAW,EAAiB,EAAE;oBAC7B,MAAM,QAAQ,GAAW,IAAA,WAAI,EAAC,YAAY,EAAE,IAAA,mCAAgB,EAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;oBAClF,IAAI,CAAC,IAAA,eAAU,EAAC,QAAQ,CAAC,EAAE,CAAC;wBACxB,MAAM,UAAU,GAAW,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;wBACtE,eAAM,CAAC,KAAK,CAAC,8BAA8B,UAAU,sBAAsB,QAAQ,qBAAqB,CAAC,CAAC;wBAC1G,OAAO,IAAI,CAAC;oBAChB,CAAC;oBACD,OAAO,IAAA,iBAAY,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;gBACrD,CAAC;gBACD,CAAC,CAAC,IAAI,CAAC;YACX,YAAY,GAAG,IAAA,uCAAoB,EAAC,YAAY,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,QAAQ,GAAW,IAAA,eAAU,EAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAA,iBAAY,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,MAAM,OAAO,GAAW,IAAA,0BAAmB,EAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACpE,IAAA,kBAAa,EAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAEO,WAAW,CAAC,UAAkB;QAClC,MAAM,UAAU,GAAW,IAAA,WAAI,EAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjE,MAAM,oBAAoB,GAAW,IAAA,WAAI,EAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;QAC9E,IAAA,cAAS,EAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAW,IAAA,WAAI,EAAC,SAAS,EAAE,QAAQ,EAAE,yBAAyB,CAAC,CAAC;QAC9E,IAAI,CAAC;YACD,MAAM,OAAO,GAAW,IAAA,iBAAY,EAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxD,IAAA,kBAAa,EAAC,IAAA,WAAI,EAAC,oBAAoB,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YAClB,eAAM,CAAC,KAAK,CAAC,wBAAwB,QAAQ,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,SAAS,GAAW,IAAA,WAAI,EAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC7D,IAAA,cAAS,EAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAW,IAAA,WAAI,EAAC,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QACpF,IAAI,CAAC;YACD,MAAM,OAAO,GAAW,IAAA,iBAAY,EAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YACzD,IAAA,kBAAa,EAAC,IAAA,WAAI,EAAC,SAAS,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YAClB,eAAM,CAAC,KAAK,CAAC,iCAAiC,SAAS,KAAK,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,GAAW;QACzB,IAAI,IAAA,eAAU,EAAC,GAAG,CAAC,EAAE,CAAC;YAClB,IAAI,CAAC;gBACD,IAAA,WAAM,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,CAAU,EAAE,CAAC;gBAClB,eAAM,CAAC,KAAK,CAAC,oBAAoB,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;YAClD,CAAC;QACL,CAAC;IACL,CAAC;CACJ;AA5XD,kCA4XC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAA+B;IACvD,MAAM,MAAM,GAA4B,KAA2C,CAAC;IACpF,OAAO,IAAA,yBAAkB,EAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,0EAA0E;AAC1E,mEAAmE;AACnE,KAAK,6BAAsB,CAAC;AAC5B,KAAK,2BAAoB,CAAC"}

package/dist/clients/codex/platforms/command-verify.backend.md

@@ -0,0 +1,108 @@
+<!-- Backend protocol verification is ENABLED for this project. -->
+
+## Backend Mode (when `backend.verifyPatterns` matches an edited file)
+
+If the project has the backend protocol cycle enabled (`ironbee backend enable` once at setup) and your edits touch matching paths (e.g. `server/**`, `api/**`, `routes/**`, `controllers/**`), the Stop hook also enforces a Backend cycle. The same `verification-start` covers every active cycle; one platform-agnostic verdict covers them all.
+
+This cycle is **runtime- and language-agnostic** — it works for Node, Java, Python, Go, Rust, Ruby, .NET, PHP, Elixir, Kotlin, Scala. The agent makes real protocol calls (HTTP / gRPC / GraphQL / WebSocket) against the running service, inspects logs, OR reads database state; it never attaches to a process.
+
+### Mode behavior (backend cycle)
+- **default** (no arg or `default`): exercise the endpoints your diff touched via ONE of the three evidence paths (protocol-call, log evidence, or DB evidence — see below). Map each changed file → the route(s) / handler(s) / RPC method(s) / table(s) it exposes, then either call them yourself and chain follow-ups to verify side effects, OR set up log capture, OR inspect database state directly.
+- **full**: cover every endpoint reachable from files matching `backend.verifyPatterns`, not just the changed files. Cover the success path, at least one error path, and any auth-gated variant for each. For schema / migration changes, verify every affected table.
+- `visual` / `functional`: browser-only modes; this cycle behaves as `default` when they are passed.
+
+### Steps (additive to the browser flow above)
+
+The cycle is satisfied by ANY ONE of three evidence paths: protocol-call (you drive the request), log-evidence (something else drives it; you read the logs), or DB-evidence (you inspect database state). Pick whichever fits the task — multiple can be combined.
+
+1. **Confirm the backend service is running** (the user's dev server / Docker compose / k8s port-forward / …). Don't start the service yourself — ask the user if it's not obvious.
+2. **Identify the affected layer** — wire endpoint, log output, and/or database state. Map your code change to its observable side(s).
+3. **Exercise ONE or more evidence paths**:
+
+   **Path A — Protocol-call (you drive the request):**
+   - `mcp__backend-devtools__bedt_request_http` — HTTP/1.1 + HTTP/2 (ALPN auto-negotiates).
+   - `mcp__backend-devtools__bedt_request_grpc` — unary + 3 streaming modes; `.proto` text or descriptor.
+   - `mcp__backend-devtools__bedt_request_graphql` — query/mutation/persisted query.
+   - `mcp__backend-devtools__bedt_request_websocket-open` then `bedt_request_websocket-send` / `bedt_request_websocket-receive` / `bedt_request_websocket-close` for stateful WS sessions.
+   - `mcp__backend-devtools__bedt_request_replay` — re-issue a captured curl command or HAR entry.
+   - **Inspect the response** — `status`, body, headers, `traceId`. **4xx/5xx and gRPC non-OK are normal results, not transport errors.** Decide PASS/FAIL based on what the test actually requires.
+
+   **Path B — Log evidence (an external driver hits the endpoint; you read the logs):**
+   - `mcp__backend-devtools__bedt_log_register-source` — register the running service's log destination (`type: "file"` + `path`, `type: "docker"` + `container`, or `type: "kubernetes"` + `pod`).
+   - `mcp__backend-devtools__bedt_log_read` / `bedt_log_read-multi` — point-in-time read with filters (`tail`, `since`/`until`, `pattern`, `level`, `parseJson` + `jsonFilter`, `contextBefore`/`contextAfter`, `select`, `coalesce`).
+   - `mcp__backend-devtools__bedt_log_follow` + `bedt_log_get-followed` (and `bedt_log_stop-follow`) — streaming follow when you need to capture lines that emit AFTER you trigger.
+   - **Verify the lines match the expectation** — error gone, expected line present, trace-id chained through, no unexpected ERROR-level entries.
+
+   **Path C — DB evidence (you inspect database state directly):**
+   - `mcp__backend-devtools__bedt_db_connect` — open a named connection (`type: "postgres" | "mysql" | "sqlite"`, prefer `connectionStringEnv` over inline `connectionString`, default `allowWrites: false`).
+   - `mcp__backend-devtools__bedt_db_list-tables` / `bedt_db_describe-table` — discover schema; great for migration verification.
+   - `mcp__backend-devtools__bedt_db_query` — run a read query (parametrized; readonly mode is enforced server-side).
+   - `mcp__backend-devtools__bedt_db_snapshot` (+ `bedt_db_diff`) — pre/post state diff so you can prove a code path changed exactly the rows it should have.
+   - `mcp__backend-devtools__bedt_db_watch-changes` + `bedt_db_get-changes` — streaming change capture for verifying writes triggered by a protocol call or external driver.
+   - `mcp__backend-devtools__bedt_db_transaction-begin/-commit/-rollback` — scope seed data to one test so it doesn't leak.
+   - `bedt_db_disconnect` to clean up (optional — session teardown handles it).
+4. **Chain follow-ups across paths** — protocol-call → DB read to verify writes landed, protocol-call → log read to verify trace-id chained, etc. Use `bedt_request_set-default-headers` for auth tokens (host-scoped), `bedt_request_set-cookies` for session state on Path A.
+5. **Trace correlation (optional, `o11y_*` primitives):** IronBee already pins the verification cycle's traceId on every backend tool call via `_metadata.traceId` (outranks any session pin), so the orchestrator's correlation root is authoritative. Use `bedt_o11y_get-trace-context` to read it, then pass it to `bedt_log_read { pattern: "<traceId>" }` to slice logs for one flow. `bedt_o11y_new-trace-id` / `bedt_o11y_set-trace-context` are available when you want to anchor a flow under an explicit id (e.g. integration-test runs).
+6. **Submit verdict** including the fields matching the path(s) you exercised. If browser and/or node cycles are also active, include their fields in the SAME verdict — do not submit two verdicts.
+
+### Verdict (platform-agnostic)
+
+The verdict shape is the same regardless of which evidence path (protocol-call / log / db) you took — `status` + `checks` (+ `issues` / `fixes` as needed):
+
+```json
+{
+  "session_id": "...",
+  "status": "pass",
+  "checks": ["POST /api/orders returned 201 with order id", "GET /api/orders/:id reflects new order"]
+}
+```
+
+The gate requires that AT LEAST one evidence path was actually exercised in your tool calls — `bedt_request_*` for protocol-call, `bedt_log_register-source` + `bedt_log_read*` / `_follow` for log-evidence, or `bedt_db_connect` + a read/diff/snapshot/get-changes for DB-evidence. If none were used, the gate will reject.
+
+For a multi-cycle pass (browser + backend, or browser + node + backend), every active cycle's pass criteria must hold.
+
+---
+
+## Default Mode (backend cycle)
+
+Focus on the endpoints you changed — not every endpoint in the service.
+
+### 1. Study the changes
+1. Run `git diff --name-only` and `git diff --name-only HEAD~1`
+2. **Ignore `.ironbee/`, `.claude/`, `.cursor/`** — tool config, not application code
+3. **Read the full diff** for route / handler / controller / service files in scope — note the wire-level address (HTTP method+path, gRPC service+method, GraphQL operation, WebSocket path), request shape, response shape, side effects (DB writes, downstream calls, queue puts)
+4. Before opening the request or log tools, you should be able to answer: what endpoints did I touch? What does each return on the happy path? What does each return on the error path? What side effects need verification? Which side (request or log) is easier to drive for this task?
+
+### 2. Verify against the running service
+Pick the evidence path(s) that fit the task:
+
+**Protocol-call path** (you drive the request):
+- **Call each changed endpoint** with the matching tool — `mcp__backend-devtools__bedt_request_http` / `bedt_request_grpc` / `bedt_request_graphql` / `bedt_request_websocket-open`
+- **Cross-reference the response against the diff** — status, body shape, headers, gRPC status code
+- **Chain a follow-up call** to verify side effects (POST then GET, set then list, mutation then query, …)
+- **Test one error path** per new branch — invalid body, missing field, missing auth, 404 path
+- **Capture `traceId`** when available — useful for joining with downstream cycle evidence
+
+**Log-evidence path** (an external driver hits it; you read the logs):
+- **Register the service's log source** with `mcp__backend-devtools__bedt_log_register-source` (file / docker / kubernetes)
+- **Read or follow** with `bedt_log_read` / `bedt_log_read-multi` (point-in-time, filter by `pattern` / `level` / `since-until` / `jsonFilter`) or `bedt_log_follow` (streaming for after-the-trigger capture)
+- **Correlate with `traceId`** — use `pattern: "<traceId>"` to pull only the lines for one request
+- **Verify the expected line is present** AND **no unexpected ERROR-level entries appeared** for the touched route(s)
+
+**DB-evidence path** (you inspect database state directly):
+- **Open a named, readonly connection** with `mcp__backend-devtools__bedt_db_connect` — prefer `connectionStringEnv` so the secret never flows through the agent context.
+- **Discover schema** via `bedt_db_list-tables` + `bedt_db_describe-table` for migrations / column additions.
+- **Run targeted reads** via `bedt_db_query` for row-count, content, and constraint checks; `bedt_db_snapshot` + `bedt_db_diff` for pre/post state proofs; `bedt_db_watch-changes` + `bedt_db_get-changes` for streaming change capture during a triggered call.
+- **Disconnect** when done (`bedt_db_disconnect`) — optional; the session tears connections down at end.
+
+---
+
+## Full Mode (`/ironbee-verify full`, backend cycle)
+
+Exercise every endpoint / log source / DB table reachable from files matching `backend.verifyPatterns`, not just the changed files. Do NOT run `git diff` or scope to recent changes.
+
+- Hit every route / RPC method / GraphQL operation / WebSocket lifecycle in scope (protocol-call) OR cover them via the log feed when an external driver / test suite drives them (log evidence) OR via direct DB inspection for schema / migration coverage (DB evidence)
+- Cover the success path AND at least one error path for each
+- Cover any auth-gated variant (unauthenticated, wrong role) where authentication is present
+- For migrations: verify every affected table's schema (`bedt_db_describe-table`) + sample row count before / after
+- Any unexpected error response, unexpected ERROR-level log line, or unexpected schema drift during the run is a fail, regardless of when it was introduced