@mycompbox/compbox-cli 1.13.0

package/utils/loopback.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Loopback / local-endpoint detection for central-target guardrails (ENG-130).
+ *
+ * A central API URL that resolves to the local machine (localhost, 127.0.0.0/8,
+ * ::1, 0.0.0.0, *.localhost) means the CompBox MCP writes to a LOCAL dev
+ * database — valid in development, but work done against it will NOT reach the
+ * cloud central (mycompbox.web.app). `doctor`, `configure`, and `login` share
+ * this detector so the warning is worded identically everywhere and the check
+ * lives in exactly one place.
+ *
+ * This is WARN-level only: localhost is a legitimate dev target, so callers
+ * surface a notice — they never block.
+ */
+/**
+ * Shared impact sentence for loopback warnings. `doctor`'s "Central target"
+ * check and LOOPBACK_NOTICE both build on this fragment so the core wording
+ * ("work will NOT reach the cloud (mycompbox.web.app)") cannot diverge.
+ */
+export declare const LOOPBACK_IMPACT = "your work will NOT reach the cloud (mycompbox.web.app)";
+/**
+ * Shared, non-blocking notice shown by `configure` and `login` when the central
+ * URL is a local dev endpoint. Wording is kept consistent with the `doctor`
+ * "Central target" check (both derive from LOOPBACK_IMPACT) so users see the
+ * same message everywhere.
+ */
+export declare const LOOPBACK_NOTICE: string;
+/**
+ * True if `hostname` (already stripped of scheme/port) refers to the local
+ * machine. Handles IPv4 loopback (127.0.0.0/8), IPv6 loopback (::1, with or
+ * without brackets), IPv4-mapped IPv6 loopback in dotted form
+ * (`::ffff:127.0.0.1`), the unspecified 0.0.0.0 bind address, `localhost`,
+ * and RFC-6761 `*.localhost` names. Case-insensitive.
+ *
+ * Known limitation (accepted): the hex form of IPv4-mapped IPv6 loopback
+ * (`::ffff:7f00:1`) is NOT detected — it is vanishingly rare in
+ * user-supplied central URLs and this check is WARN-level only.
+ */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * True if `rawUrl` points at a local dev endpoint. Accepts a full URL
+ * (`http://localhost:3000`) or a bare host[:port] (`localhost:3000`). Returns
+ * false for empty/undefined input and for non-loopback cloud URLs.
+ */
+export declare function isLoopbackUrl(rawUrl: string | undefined): boolean;
+//# sourceMappingURL=loopback.d.ts.map

package/utils/loopback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.d.ts","sourceRoot":"","sources":["../../src/utils/loopback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;GAIG;AACH,eAAO,MAAM,eAAe,2DAC8B,CAAC;AAE3D;;;;;GAKG;AACH,eAAO,MAAM,eAAe,QAE6B,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAwB5D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAmBjE"}

package/utils/loopback.js

@@ -0,0 +1,95 @@
+/**
+ * Loopback / local-endpoint detection for central-target guardrails (ENG-130).
+ *
+ * A central API URL that resolves to the local machine (localhost, 127.0.0.0/8,
+ * ::1, 0.0.0.0, *.localhost) means the CompBox MCP writes to a LOCAL dev
+ * database — valid in development, but work done against it will NOT reach the
+ * cloud central (mycompbox.web.app). `doctor`, `configure`, and `login` share
+ * this detector so the warning is worded identically everywhere and the check
+ * lives in exactly one place.
+ *
+ * This is WARN-level only: localhost is a legitimate dev target, so callers
+ * surface a notice — they never block.
+ */
+/**
+ * Shared impact sentence for loopback warnings. `doctor`'s "Central target"
+ * check and LOOPBACK_NOTICE both build on this fragment so the core wording
+ * ("work will NOT reach the cloud (mycompbox.web.app)") cannot diverge.
+ */
+export const LOOPBACK_IMPACT = 'your work will NOT reach the cloud (mycompbox.web.app)';
+/**
+ * Shared, non-blocking notice shown by `configure` and `login` when the central
+ * URL is a local dev endpoint. Wording is kept consistent with the `doctor`
+ * "Central target" check (both derive from LOOPBACK_IMPACT) so users see the
+ * same message everywhere.
+ */
+export const LOOPBACK_NOTICE = `This is a LOCAL dev endpoint — ${LOOPBACK_IMPACT}. ` +
+    'Use `compbox login --url <cloud-url>` for production.';
+/**
+ * True if `hostname` (already stripped of scheme/port) refers to the local
+ * machine. Handles IPv4 loopback (127.0.0.0/8), IPv6 loopback (::1, with or
+ * without brackets), IPv4-mapped IPv6 loopback in dotted form
+ * (`::ffff:127.0.0.1`), the unspecified 0.0.0.0 bind address, `localhost`,
+ * and RFC-6761 `*.localhost` names. Case-insensitive.
+ *
+ * Known limitation (accepted): the hex form of IPv4-mapped IPv6 loopback
+ * (`::ffff:7f00:1`) is NOT detected — it is vanishingly rare in
+ * user-supplied central URLs and this check is WARN-level only.
+ */
+export function isLoopbackHostname(hostname) {
+    let host = hostname.trim().toLowerCase();
+    if (host.length === 0)
+        return false;
+    // Strip surrounding brackets from IPv6 literals (e.g. "[::1]").
+    if (host.startsWith('[') && host.endsWith(']')) {
+        host = host.slice(1, -1);
+    }
+    if (host === 'localhost' || host.endsWith('.localhost'))
+        return true;
+    if (host === '::1')
+        return true;
+    if (host === '0.0.0.0')
+        return true;
+    // IPv4-mapped IPv6 in dotted form, e.g. "::ffff:127.0.0.1" — unwrap and
+    // fall through to the IPv4 loopback-range check below.
+    if (host.startsWith('::ffff:')) {
+        host = host.slice('::ffff:'.length);
+    }
+    // IPv4 loopback range 127.0.0.0/8 (covers 127.0.0.1 and any 127.x.x.x).
+    const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+    if (m) {
+        const octets = m.slice(1).map(Number);
+        if (octets.every((o) => o >= 0 && o <= 255) && octets[0] === 127) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * True if `rawUrl` points at a local dev endpoint. Accepts a full URL
+ * (`http://localhost:3000`) or a bare host[:port] (`localhost:3000`). Returns
+ * false for empty/undefined input and for non-loopback cloud URLs.
+ */
+export function isLoopbackUrl(rawUrl) {
+    if (!rawUrl)
+        return false;
+    const trimmed = rawUrl.trim();
+    if (trimmed.length === 0)
+        return false;
+    // Try to parse as-is; if that yields no host (e.g. a bare "localhost:3000",
+    // where "localhost:" is read as a scheme), retry with an added scheme so the
+    // URL parser extracts the hostname consistently.
+    for (const candidate of [trimmed, `http://${trimmed}`]) {
+        try {
+            const { hostname } = new URL(candidate);
+            if (hostname.length > 0) {
+                return isLoopbackHostname(hostname);
+            }
+        }
+        catch {
+            // Not parseable with this candidate — try the next form.
+        }
+    }
+    return false;
+}
+//# sourceMappingURL=loopback.js.map

package/utils/loopback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopback.js","sourceRoot":"","sources":["../../src/utils/loopback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,wDAAwD,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,kCAAkC,eAAe,IAAI;IACrD,uDAAuD,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,IAAI,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,gEAAgE;IAChE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IACrE,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,wEAAwE;IACxE,uDAAuD;IACvD,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,wEAAwE;IACxE,MAAM,CAAC,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,IAAI,CAAC,EAAE,CAAC;QACN,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAA0B;IACtD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,4EAA4E;IAC5E,6EAA6E;IAC7E,iDAAiD;IACjD,KAAK,MAAM,SAAS,IAAI,CAAC,OAAO,EAAE,UAAU,OAAO,EAAE,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/utils/mailbox-client.d.ts

@@ -0,0 +1,98 @@
+/**
+ * HTTP client for the mailbox seam (ENG-E23 / ENG-122) — the daemon's view of
+ * the pull-based job queue.
+ *
+ * Two auth contexts, mirrored here as two sets of methods:
+ *   - User-auth (the `st_...` token from `compbox login`): pairMachine — a
+ *     one-time step that registers this device and mints its machine token.
+ *   - Machine-auth (the `mk_...` token minted by pairMachine): nextJob,
+ *     heartbeat, postTurn, completeJob — the daemon's own long-poll loop.
+ *
+ * Kept separate from `auth-client.ts` (user identity/pairing) and
+ * `api-client.ts` (skill-pack registry) for the same reason those are
+ * separate: distinct concerns, distinct auth contexts.
+ */
+import type { AgentRuntimeProbe } from './claude-runtime.js';
+/** A paired machine, as returned by pairMachine (token included, once). */
+export interface PairedMachine {
+    id: string;
+    name: string;
+    status: string;
+    lastSeenAt: string | null;
+    createdAt: string;
+    updatedAt: string;
+    /** Plaintext machine token (`mk_...`) — returned ONLY at pairing time. */
+    token: string;
+}
+/**
+ * An image (or other file) attached to a turn (ENG-151 read-contract). The
+ * machine `next-job` path attaches `attachments: []` (never undefined) to every
+ * turn; each entry carries a short-TTL `signedUrl` to the private bucket that
+ * the daemon fetches directly (no download endpoint, no extra auth).
+ */
+export interface MailboxAttachment {
+    id: string;
+    mimeType: string;
+    sizeBytes: number;
+    signedUrl: string;
+}
+/** A single turn in a job's conversation log. */
+export interface MailboxJobTurn {
+    id: string;
+    role: 'agent' | 'user';
+    content: string;
+    createdAt: string;
+    /**
+     * Image/file attachments on this turn (ENG-151). Present on every turn from
+     * the machine next-job path (`[]` when none); optional here so older payloads
+     * and hand-built test turns without the field still type-check.
+     */
+    attachments?: MailboxAttachment[];
+}
+/** A job as returned by next-job / post-turn / complete-job. */
+export interface MailboxJob {
+    id: string;
+    machineId: string;
+    organizationId: string;
+    /** 'epic_request' | 'start_execution' today; kept as `string` — matches the API's own Job.type typing. */
+    type: string;
+    status: 'pending' | 'claimed' | 'running' | 'awaiting_input' | 'done' | 'failed';
+    payload: unknown;
+    result: unknown;
+    createdAt: string;
+    updatedAt: string;
+    turns: MailboxJobTurn[];
+}
+/** Normalized error for mailbox request failures with a stable HTTP-ish status. */
+export declare class MailboxClientError extends Error {
+    /** HTTP status when the server responded; 0 for network-level failures. */
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+export declare class MailboxClient {
+    private readonly http;
+    readonly baseUrl: string;
+    constructor(baseUrl: string);
+    /** Register this device with central using the user's API token, returning its machine token (once). */
+    pairMachine(userToken: string, name: string): Promise<PairedMachine>;
+    /**
+     * Long-polls for the next job assigned to this machine, waiting up to
+     * `waitMs` (server clamps to its own max, currently ~25s). Returns `null`
+     * on a 204 (nothing to do — the caller should loop and poll again).
+     */
+    nextJob(machineToken: string, waitMs?: number): Promise<MailboxJob | null>;
+    /**
+     * Explicit heartbeat ping (idle-period keepalive; next-job itself also
+     * heartbeats). Optionally reports the local agent runtime status (ENG-136):
+     * when `runtime` is supplied, the POST body carries
+     * `{ agentRuntime: { status, detail, checkedAt } }` — the SOLE ingestion
+     * channel for runtime status (next-job is a GET and cannot carry it). Calling
+     * `heartbeat(token)` with no runtime is backward-compatible and sends `{}`.
+     */
+    heartbeat(machineToken: string, runtime?: AgentRuntimeProbe): Promise<void>;
+    /** Posts an agent turn (a question/status update) to a job's interview log. */
+    postTurn(machineToken: string, jobId: string, content: string): Promise<MailboxJob>;
+    /** Marks a claimed job done or failed, with an optional structured result. */
+    completeJob(machineToken: string, jobId: string, status: 'done' | 'failed', result?: Record<string, unknown>): Promise<MailboxJob>;
+}
+//# sourceMappingURL=mailbox-client.d.ts.map

package/utils/mailbox-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mailbox-client.d.ts","sourceRoot":"","sources":["../../src/utils/mailbox-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE7D,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,GAAG,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,EAAE,CAAC;CACnC;AAED,gEAAgE;AAChE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,0GAA0G;IAC1G,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EACF,SAAS,GACT,SAAS,GACT,SAAS,GACT,gBAAgB,GAChB,MAAM,GACN,QAAQ,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED,mFAAmF;AACnF,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,2EAA2E;IAC3E,SAAgB,MAAM,EAAE,MAAM,CAAC;gBAEnB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAK5C;AAoCD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgB;IACrC,SAAgB,OAAO,EAAE,MAAM,CAAC;gBAEpB,OAAO,EAAE,MAAM;IAoB3B,wGAAwG;IAClG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAsB1E;;;;OAIG;IACG,OAAO,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAoBhF;;;;;;;OAOG;IACG,SAAS,CACb,YAAY,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC;IAwBhB,+EAA+E;IACzE,QAAQ,CACZ,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,CAAC;IAkBtB,8EAA8E;IACxE,WAAW,CACf,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GAAG,QAAQ,EACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,UAAU,CAAC;CAiBvB"}

package/utils/mailbox-client.js

@@ -0,0 +1,178 @@
+/**
+ * HTTP client for the mailbox seam (ENG-E23 / ENG-122) — the daemon's view of
+ * the pull-based job queue.
+ *
+ * Two auth contexts, mirrored here as two sets of methods:
+ *   - User-auth (the `st_...` token from `compbox login`): pairMachine — a
+ *     one-time step that registers this device and mints its machine token.
+ *   - Machine-auth (the `mk_...` token minted by pairMachine): nextJob,
+ *     heartbeat, postTurn, completeJob — the daemon's own long-poll loop.
+ *
+ * Kept separate from `auth-client.ts` (user identity/pairing) and
+ * `api-client.ts` (skill-pack registry) for the same reason those are
+ * separate: distinct concerns, distinct auth contexts.
+ */
+import axios, { isAxiosError } from 'axios';
+/** Normalized error for mailbox request failures with a stable HTTP-ish status. */
+export class MailboxClientError extends Error {
+    /** HTTP status when the server responded; 0 for network-level failures. */
+    status;
+    constructor(message, status) {
+        super(message);
+        this.name = 'MailboxClientError';
+        this.status = status;
+    }
+}
+/** Extracts a server-provided error message from a JSON error body, if present. */
+function extractServerMessage(data) {
+    if (typeof data !== 'object' || data === null)
+        return undefined;
+    const shaped = data;
+    return shaped.error?.message ?? shaped.message;
+}
+/** Normalizes a thrown error (network failure, DNS, timeout, etc.) from axios. */
+function toMailboxError(error, fallback) {
+    if (isAxiosError(error)) {
+        const status = error.response?.status ?? 0;
+        const message = extractServerMessage(error.response?.data) ?? error.message;
+        return new MailboxClientError(message, status);
+    }
+    if (error instanceof Error) {
+        return new MailboxClientError(error.message, 0);
+    }
+    return new MailboxClientError(fallback, 0);
+}
+/**
+ * Normalizes a RESOLVED non-2xx response (the client is configured with
+ * `validateStatus: () => true`, so non-2xx never throws — it resolves like
+ * any other response). Distinct from {@link toMailboxError}, which handles
+ * actually-thrown errors (network failure, DNS, timeout).
+ */
+function errorFromResponse(res, fallback) {
+    const message = extractServerMessage(res.data) ?? fallback;
+    return new MailboxClientError(message, res.status);
+}
+export class MailboxClient {
+    http;
+    baseUrl;
+    constructor(baseUrl) {
+        this.baseUrl = baseUrl.replace(/\/+$/, '');
+        this.http = axios.create({
+            baseURL: this.baseUrl,
+            // Generously longer than the requested long-poll window (POLL_WAIT_MS,
+            // ~15s) so a slow-but-alive next-job response is never mistaken for a
+            // network failure. Widened from 35s: on Cloud Run the overhead on a held
+            // connection occasionally pushed a 25s poll past a 35s timeout, so every
+            // idle poll errored and backed off. The margin here (client 45s vs ~15s
+            // poll) absorbs that overhead.
+            timeout: 45_000,
+            headers: { 'Content-Type': 'application/json' },
+            validateStatus: () => true,
+        });
+    }
+    // ---------------------------------------------------------------------
+    // User-auth: one-time machine pairing (called by `compbox configure`)
+    // ---------------------------------------------------------------------
+    /** Register this device with central using the user's API token, returning its machine token (once). */
+    async pairMachine(userToken, name) {
+        let res;
+        try {
+            res = await this.http.post('/api/v1/machines', { name }, { headers: { Authorization: `Bearer ${userToken}` } });
+        }
+        catch (error) {
+            throw toMailboxError(error, 'Machine pairing request failed');
+        }
+        if (res.status < 200 || res.status >= 300) {
+            throw errorFromResponse(res, 'Machine pairing failed');
+        }
+        const data = res.data;
+        return data.data;
+    }
+    // ---------------------------------------------------------------------
+    // Machine-auth: the daemon's own calls
+    // ---------------------------------------------------------------------
+    /**
+     * Long-polls for the next job assigned to this machine, waiting up to
+     * `waitMs` (server clamps to its own max, currently ~25s). Returns `null`
+     * on a 204 (nothing to do — the caller should loop and poll again).
+     */
+    async nextJob(machineToken, waitMs = 25_000) {
+        let res;
+        try {
+            res = await this.http.get('/api/v1/machines/next-job', {
+                headers: { Authorization: `Bearer ${machineToken}` },
+                params: { waitMs },
+            });
+        }
+        catch (error) {
+            throw toMailboxError(error, 'next-job request failed');
+        }
+        if (res.status === 204) {
+            return null;
+        }
+        if (res.status < 200 || res.status >= 300) {
+            throw errorFromResponse(res, 'next-job failed');
+        }
+        const data = res.data;
+        return data.data;
+    }
+    /**
+     * Explicit heartbeat ping (idle-period keepalive; next-job itself also
+     * heartbeats). Optionally reports the local agent runtime status (ENG-136):
+     * when `runtime` is supplied, the POST body carries
+     * `{ agentRuntime: { status, detail, checkedAt } }` — the SOLE ingestion
+     * channel for runtime status (next-job is a GET and cannot carry it). Calling
+     * `heartbeat(token)` with no runtime is backward-compatible and sends `{}`.
+     */
+    async heartbeat(machineToken, runtime) {
+        let res;
+        try {
+            res = await this.http.post('/api/v1/machines/heartbeat', runtime
+                ? {
+                    agentRuntime: {
+                        status: runtime.status,
+                        detail: runtime.detail,
+                        checkedAt: runtime.checkedAt,
+                    },
+                }
+                : {}, { headers: { Authorization: `Bearer ${machineToken}` } });
+        }
+        catch (error) {
+            throw toMailboxError(error, 'Heartbeat request failed');
+        }
+        if (res.status < 200 || res.status >= 300) {
+            throw errorFromResponse(res, 'Heartbeat failed');
+        }
+    }
+    /** Posts an agent turn (a question/status update) to a job's interview log. */
+    async postTurn(machineToken, jobId, content) {
+        let res;
+        try {
+            res = await this.http.post(`/api/v1/jobs/${jobId}/turns`, { content }, { headers: { Authorization: `Bearer ${machineToken}` } });
+        }
+        catch (error) {
+            throw toMailboxError(error, 'post-turn request failed');
+        }
+        if (res.status < 200 || res.status >= 300) {
+            throw errorFromResponse(res, 'post-turn failed');
+        }
+        const data = res.data;
+        return data.data;
+    }
+    /** Marks a claimed job done or failed, with an optional structured result. */
+    async completeJob(machineToken, jobId, status, result) {
+        let res;
+        try {
+            res = await this.http.post(`/api/v1/jobs/${jobId}/complete`, { status, ...(result !== undefined && { result }) }, { headers: { Authorization: `Bearer ${machineToken}` } });
+        }
+        catch (error) {
+            throw toMailboxError(error, 'complete-job request failed');
+        }
+        if (res.status < 200 || res.status >= 300) {
+            throw errorFromResponse(res, 'complete-job failed');
+        }
+        const data = res.data;
+        return data.data;
+    }
+}
+//# sourceMappingURL=mailbox-client.js.map

package/utils/mailbox-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mailbox-client.js","sourceRoot":"","sources":["../../src/utils/mailbox-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,EAAsB,YAAY,EAAE,MAAM,OAAO,CAAC;AA+DhE,mFAAmF;AACnF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,2EAA2E;IAC3D,MAAM,CAAS;IAE/B,YAAY,OAAe,EAAE,MAAc;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,mFAAmF;AACnF,SAAS,oBAAoB,CAAC,IAAa;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAChE,MAAM,MAAM,GAAG,IAA0D,CAAC;IAC1E,OAAO,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;AACjD,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,KAAc,EAAE,QAAgB;IACtD,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC;QAC5E,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,IAAI,kBAAkB,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,kBAAkB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CACxB,GAAsC,EACtC,QAAgB;IAEhB,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC;IAC3D,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,OAAO,aAAa;IACP,IAAI,CAAgB;IACrB,OAAO,CAAS;IAEhC,YAAY,OAAe;QACzB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,uEAAuE;YACvE,sEAAsE;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,+BAA+B;YAC/B,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IAExE,wGAAwG;IACxG,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,IAAY;QAC/C,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CACxB,kBAAkB,EAClB,EAAE,IAAI,EAAE,EACR,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,SAAS,EAAE,EAAE,EAAE,CACtD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,cAAc,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC1C,MAAM,iBAAiB,CAAC,GAAG,EAAE,wBAAwB,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAA+B,CAAC;QACjD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,wEAAwE;IACxE,uCAAuC;IACvC,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,YAAoB,EAAE,MAAM,GAAG,MAAM;QACjD,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,2BAA2B,EAAE;gBACrD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE;gBACpD,MAAM,EAAE,EAAE,MAAM,EAAE;aACnB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,cAAc,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC1C,MAAM,iBAAiB,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAA4B,CAAC;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,SAAS,CACb,YAAoB,EACpB,OAA2B;QAE3B,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CACxB,4BAA4B,EAC5B,OAAO;gBACL,CAAC,CAAC;oBACE,YAAY,EAAE;wBACZ,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;qBAC7B;iBACF;gBACH,CAAC,CAAC,EAAE,EACN,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE,EAAE,CACzD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,cAAc,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC1C,MAAM,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,QAAQ,CACZ,YAAoB,EACpB,KAAa,EACb,OAAe;QAEf,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CACxB,gBAAgB,KAAK,QAAQ,EAC7B,EAAE,OAAO,EAAE,EACX,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE,EAAE,CACzD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,cAAc,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC1C,MAAM,iBAAiB,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAA4B,CAAC;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,WAAW,CACf,YAAoB,EACpB,KAAa,EACb,MAAyB,EACzB,MAAgC;QAEhC,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CACxB,gBAAgB,KAAK,WAAW,EAChC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,EACnD,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,YAAY,EAAE,EAAE,EAAE,CACzD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,cAAc,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YAC1C,MAAM,iBAAiB,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAA4B,CAAC;QAC9C,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;CACF"}

package/utils/mcp-config-writer.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Generate / patch a local MCP config so Claude Code points at central CompBox.
+ *
+ * Claude Code (and compatible MCP hosts) read a JSON file with an `mcpServers`
+ * map: `{ "mcpServers": { "<name>": { command, args, env } } }`. This writer
+ * inserts/updates ONLY the CompBox server entry, preserving every other server
+ * entry and every unrelated top-level key. Existing configuration for other
+ * tools is never clobbered.
+ *
+ * The CompBox entry prefers the brew-installed MCP server bundle when present
+ * (`node <prefix>/opt/compbox/libexec/compbox-mcp.cjs`, installed by the
+ * Homebrew formula — see deploy/homebrew-tap/compbox.rb), and falls back to
+ * launching the published package via `npx` on first use. Either way the
+ * per-employee token and central base URL are supplied through its `env`.
+ */
+/** Default Claude Code project-level MCP config file name. */
+export declare const DEFAULT_MCP_CONFIG_FILENAME = ".mcp.json";
+/** Default server key used for the CompBox MCP entry. */
+export declare const DEFAULT_SERVER_KEY = "compbox";
+/** The published MCP server package launched by the generated entry. */
+export declare const MCP_SERVER_PACKAGE = "@mycompbox/compbox-mcp";
+/**
+ * Locate the brew-installed MCP server bundle, if any.
+ *
+ * Candidate prefixes, in order: an explicit `opts.prefix` (e.g. from
+ * `brew --prefix`), `$HOMEBREW_PREFIX`, `/opt/homebrew` (Apple Silicon
+ * default), `/usr/local` (Intel default). Each is checked for the formula's
+ * keg-relative bundle path `opt/compbox/libexec/compbox-mcp.cjs`.
+ *
+ * `opts.exists` is injectable so tests never need a real brew install.
+ */
+export declare function resolveInstalledMcpBundle(opts?: {
+    prefix?: string;
+    exists?: (p: string) => boolean;
+}): string | undefined;
+/** A single MCP server definition. */
+export interface McpServerEntry {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+}
+/** Parameters describing the CompBox MCP server entry to write. */
+export interface McpServerSpec {
+    /** Central CompBox API base URL. */
+    apiBaseUrl: string;
+    /** Per-employee CompBox API token (`st_...`). */
+    apiToken: string;
+    /** Key under `mcpServers` to write. Defaults to `compbox`. */
+    serverKey?: string;
+    /** Override the launch command (default: auto-detected, see below). */
+    command?: string;
+    /** Override the launch args (default: auto-detected, see below). */
+    args?: string[];
+    /**
+     * Injectable installed-bundle resolver (defaults to
+     * {@link resolveInstalledMcpBundle}). Lets tests and `configure` control
+     * launch-mode detection without touching the real filesystem.
+     */
+    resolveInstalledBundle?: () => string | undefined;
+}
+/** Outcome of a patch operation. */
+export interface PatchResult {
+    /** True if the config file did not previously exist. */
+    fileCreated: boolean;
+    /** True if the CompBox server entry was newly added (vs. updated). */
+    entryCreated: boolean;
+    /** Keys of other MCP servers left untouched. */
+    preservedServers: string[];
+    /** Absolute path written. */
+    configPath: string;
+    /**
+     * The exact CompBox server entry that was written — lets callers (e.g.
+     * `configure`) report which launch mode was chosen (`node <bundle>` vs
+     * `npx -y <package>`) without re-running detection.
+     */
+    entry: McpServerEntry;
+}
+/** Default absolute path to the project MCP config in the given directory. */
+export declare function defaultMcpConfigPath(projectRoot?: string): string;
+/**
+ * Build the CompBox MCP server entry from a spec. Exposed for testing and reuse.
+ *
+ * Launch-target selection (when neither `command` nor `args` is explicitly
+ * overridden): prefer `node <installed bundle>` when the brew-installed
+ * compbox-mcp.cjs resolves, else fall back to `npx -y ${MCP_SERVER_PACKAGE}`
+ * (fetched from the public npm registry on first use). An explicit `command`
+ * or `args` override always wins and disables detection.
+ */
+export declare function buildCompboxServerEntry(spec: McpServerSpec): McpServerEntry;
+/** Read-only status of the CompBox MCP entry in a config file. */
+export interface McpConfigStatus {
+    /** Absolute path inspected. */
+    configPath: string;
+    /** True if the config file exists on disk. */
+    fileExists: boolean;
+    /** True if the CompBox server entry is present under `mcpServers`. */
+    entryPresent: boolean;
+    /**
+     * The central API base URL the CompBox entry is configured to write to
+     * (its `env.API_BASE_URL`), or `undefined` when the entry is absent or has no
+     * such value. Read-only; used by `doctor` to surface which central the MCP
+     * targets (ENG-130). The API token is deliberately NOT surfaced here.
+     */
+    apiBaseUrl?: string;
+    /**
+     * The entry's configured launch command (e.g. `node` or `npx`), or
+     * `undefined` when the entry is absent or malformed. Read-only; used by
+     * `doctor` to verify the launch target (ENG-141).
+     */
+    command?: string;
+    /**
+     * The entry's configured launch args (e.g. the installed bundle path for
+     * `node`, or `['-y', '@mycompbox/compbox-mcp']` for `npx`), or `undefined`
+     * when absent/malformed. Read-only; used by `doctor` (ENG-141).
+     */
+    args?: string[];
+}
+/**
+ * Inspect a config file for the CompBox MCP server entry WITHOUT modifying it.
+ *
+ * Used by `compbox doctor` to verify that `configure` already wrote the entry
+ * to the expected path. This verifies the WRITTEN config file and surfaces the
+ * configured launch target (command + args) read-only, so doctor can further
+ * check that a `node <bundle>` target actually exists on disk (the entry may
+ * instead be `npx`, which fetches the published package on first use).
+ */
+export declare function inspectMcpConfig(configPath: string, serverKey?: string): McpConfigStatus;
+/**
+ * Patch (or create) the MCP config at `configPath`, writing the CompBox server
+ * entry while preserving all other content.
+ */
+export declare function patchMcpConfig(configPath: string, spec: McpServerSpec): PatchResult;
+//# sourceMappingURL=mcp-config-writer.d.ts.map

package/utils/mcp-config-writer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-config-writer.d.ts","sourceRoot":"","sources":["../../src/utils/mcp-config-writer.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;GAcG;AAKH,8DAA8D;AAC9D,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAEvD,yDAAyD;AACzD,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,2BAA2B,CAAC;AAE3D;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,CAAC,EAAE;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;CACjC,GAAG,MAAM,GAAG,SAAS,CAerB;AAED,sCAAsC;AACtC,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CACnD;AAED,oCAAoC;AACpC,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,WAAW,EAAE,OAAO,CAAC;IACrB,sEAAsE;IACtE,YAAY,EAAE,OAAO,CAAC;IACtB,gDAAgD;IAChD,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,6BAA6B;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAAC,WAAW,GAAE,MAAsB,GAAG,MAAM,CAEhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,aAAa,GAAG,cAAc,CAmB3E;AAuBD,kEAAkE;AAClE,MAAM,WAAW,eAAe;IAC9B,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,UAAU,EAAE,OAAO,CAAC;IACpB,sEAAsE;IACtE,YAAY,EAAE,OAAO,CAAC;IACtB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,SAAS,GAAE,MAA2B,GACrC,eAAe,CA8CjB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,aAAa,GAClB,WAAW,CAkCb"}