@provos/ironcurtain 0.10.0 → 0.11.0

package/dist/config/generated/tool-annotations.json

@@ -444,10 +444,11 @@
           "comment": "Stages specified files or all changes in the repository for the next commit.",
           "args": {
             "path": [
-              "read-path"
+              "read-path",
+              "write-history"
             ],
             "files": [
-              "read-path"
+              "none"
             ],
             "update": [
               "none"
@@ -506,7 +507,7 @@
               "read-path"
             ],
             "file": [
-              "read-path"
+              "none"
             ],
             "startLine": [
               "none"
@@ -791,7 +792,8 @@
           "args": {
             "path": [
               "read-path",
-              "write-history"
+              "write-history",
+              "write-path"
             ],
             "target": [
               "branch-name"
@@ -803,7 +805,7 @@
               "none"
             ],
             "paths": [
-              "read-path"
+              "none"
             ],
             "track": [
               "none"
@@ -1144,7 +1146,7 @@
               "none"
             ],
             "filesToStage": [
-              "read-path"
+              "none"
             ],
             "forceUnsignedOnFailure": [
               "none"
@@ -1238,7 +1240,7 @@
               "none"
             ],
             "paths": [
-              "read-path"
+              "none"
             ],
             "staged": [
               "none"
@@ -1318,7 +1320,8 @@
           "comment": "Downloads objects and refs from a remote repository without merging them into the local branch.",
           "args": {
             "path": [
-              "read-path"
+              "read-path",
+              "write-history"
             ],
             "remote": [
               "git-remote-url"
@@ -1434,7 +1437,7 @@
               "branch-name"
             ],
             "filePath": [
-              "read-path"
+              "none"
             ],
             "oneline": [
               "none"
@@ -1934,39 +1937,9 @@
             "name": [
               "none"
             ],
-            "url": {
-              "default": [
-                "git-remote-url"
-              ],
-              "when": [
-                {
-                  "condition": {
-                    "arg": "mode",
-                    "in": [
-                      "list",
-                      "get-url"
-                    ]
-                  },
-                  "roles": [
-                    "none"
-                  ]
-                },
-                {
-                  "condition": {
-                    "arg": "mode",
-                    "in": [
-                      "add",
-                      "rename",
-                      "set-url",
-                      "remove"
-                    ]
-                  },
-                  "roles": [
-                    "git-remote-url"
-                  ]
-                }
-              ]
-            },
+            "url": [
+              "none"
+            ],
             "newName": [
               "none"
             ],
@@ -2039,7 +2012,7 @@
               "none"
             ],
             "paths": [
-              "read-path"
+              "none"
             ],
             "confirmed": [
               "none"
@@ -2091,9 +2064,23 @@
           "toolName": "git_set_working_dir",
           "comment": "Sets the session-level default working directory for all subsequent git operations.",
           "args": {
-            "path": [
-              "read-path"
-            ],
+            "path": {
+              "default": [
+                "read-path"
+              ],
+              "when": [
+                {
+                  "condition": {
+                    "arg": "initializeIfNotPresent",
+                    "equals": true
+                  },
+                  "roles": [
+                    "read-path",
+                    "write-path"
+                  ]
+                }
+              ]
+            },
             "validateGitRepo": [
               "none"
             ],
@@ -2152,7 +2139,7 @@
               "none"
             ],
             "filePath": [
-              "read-path"
+              "none"
             ]
           },
           "serverName": "git",

package/dist/config/index.d.ts

@@ -32,6 +32,20 @@ export declare function computeProtectedPaths(opts: {
  * (runtime) and `loadPipelineConfig()` (pipeline) use this.
  */
 export declare function resolveMcpServerPaths(mcpServers: Record<string, MCPServerConfig>): void;
+/**
+ * Rewrites the filesystem MCP server's allowed-directory arg to match
+ * `allowedDirectory`. Must be called whenever `allowedDirectory` changes
+ * (e.g. during session/workflow setup), otherwise the filesystem server
+ * spawns with a stale path and fails with ENOENT.
+ *
+ * The filesystem server's args are `["-y", "<pkg>", "<path>"]`, so the
+ * path is always the last argument. We replace it unconditionally to
+ * cover both the initial load (args contain the sentinel) and subsequent
+ * re-patches (args already contain a previous allowed directory).
+ */
+export declare function applyAllowedDirectoryToMcpArgs(mcpServers: Record<string, {
+    args: string[];
+}>, allowedDirectory: string): void;
 export declare function loadConfig(): IronCurtainConfig;
 /**
  * Extracts domain allowlists from MCP server sandbox network configurations.
@@ -56,6 +70,37 @@ export declare function extractServerDomainAllowlists(mcpServers: Record<string,
  * last `ironcurtain compile-policy` run.
  */
 export declare function checkConstitutionFreshness(compiledPolicy: CompiledPolicyFile, constitutionPath: string): void;
+/**
+ * Pure diff between the configured MCP servers and the servers covered by
+ * `tool-annotations.json`. Used by both the runtime freshness check and
+ * the compile-time preventive check, which format the same drift data
+ * differently.
+ *
+ *   - `missing`: configured servers with no annotations entry (these will
+ *     silently default-deny every call via the policy engine's
+ *     structural-unknown-tool fallback).
+ *   - `orphaned`: annotated servers no longer configured (informational).
+ */
+export declare function findAnnotationServerDrift(toolAnnotations: StoredToolAnnotationsFile, mcpServers: Record<string, MCPServerConfig>): {
+    missing: string[];
+    orphaned: string[];
+};
+/**
+ * Runtime freshness check: emits stderr warnings when the on-disk
+ * tool-annotations.json no longer matches the configured MCP servers.
+ *
+ * The warning suggests re-running annotations for each specific server,
+ * not `--all`, so the user only re-classifies what actually changed.
+ */
+export declare function checkAnnotationFreshness(toolAnnotations: StoredToolAnnotationsFile, mcpServers: Record<string, MCPServerConfig>): void;
+/**
+ * Quotes a user-supplied identifier for inclusion in a stderr message or a
+ * copy-paste shell command. Escapes control characters, quotes, and
+ * backslashes via JSON string semantics, and wraps the result in double
+ * quotes. The output is both safe to print (no terminal injection) and
+ * safe to paste into bash (`--server "name"`).
+ */
+export declare function safeForDisplay(identifier: string): string;
 /**
  * Options for loading generated policy artifacts with split directories.
  * Allows policy files and tool annotations to come from different dirs.
@@ -73,3 +118,16 @@ export declare function loadGeneratedPolicy(options: PolicyLoadOptions): {
     toolAnnotations: StoredToolAnnotationsFile;
     dynamicLists: DynamicListsFile | undefined;
 };
+/**
+ * Loads only the per-persona / per-policy artifacts (compiled-policy.json
+ * and optional dynamic-lists.json). Tool annotations are deliberately not
+ * read here because they are globally-scoped: a persona directory only
+ * ships policy + lists, not annotations.
+ *
+ * Used by `ToolCallCoordinator.loadPolicy` during a hot-swap to pick up
+ * the new policy without touching the retained annotations.
+ */
+export declare function loadPersonaPolicyArtifacts(policyDir: string): {
+    compiledPolicy: CompiledPolicyFile;
+    dynamicLists: DynamicListsFile | undefined;
+};

package/dist/config/index.js

@@ -4,17 +4,22 @@ import { fileURLToPath } from 'node:url';
 import { computeConstitutionHash, getIronCurtainHome, getUserConfigPath, getUserConstitutionBasePath, getUserConstitutionPath, getUserGeneratedDir, } from './paths.js';
 import { resolveRealPath } from '../types/argument-roles.js';
 import { loadUserConfig } from './user-config.js';
-import { RESERVED_SERVER_NAMES } from '../docker/proxy-tools.js';
+import { RESERVED_SERVER_NAMES } from '../types/reserved-servers.js';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const isCompiled = __filename.endsWith('.js');
 /**
- * Returns the user-local generated dir if it contains compiled-policy.json,
- * otherwise falls back to the package-bundled generated dir.
+ * Returns the user-local generated dir if it contains the given artifact,
+ * otherwise falls back to the package-bundled dir. Used independently for
+ * `compiled-policy.json` and `tool-annotations.json` so a user who drops
+ * an updated annotations file into `~/.ironcurtain/generated/` has it
+ * picked up even without a corresponding compiled policy there (tool
+ * annotations are globally scoped — see sandbox/index.ts comment on
+ * `toolAnnotationsDir`).
  */
-function resolveGeneratedDir(packageGeneratedDir) {
+function resolveArtifactDir(filename, packageGeneratedDir) {
     const userDir = getUserGeneratedDir();
-    if (existsSync(resolve(userDir, 'compiled-policy.json'))) {
+    if (existsSync(resolve(userDir, filename))) {
         return userDir;
     }
     return packageGeneratedDir;
@@ -117,6 +122,26 @@ function resolveInternalServerPaths(config, packageRoot, compiled) {
         }
     }
 }
+/**
+ * Rewrites the filesystem MCP server's allowed-directory arg to match
+ * `allowedDirectory`. Must be called whenever `allowedDirectory` changes
+ * (e.g. during session/workflow setup), otherwise the filesystem server
+ * spawns with a stale path and fails with ENOENT.
+ *
+ * The filesystem server's args are `["-y", "<pkg>", "<path>"]`, so the
+ * path is always the last argument. We replace it unconditionally to
+ * cover both the initial load (args contain the sentinel) and subsequent
+ * re-patches (args already contain a previous allowed directory).
+ */
+export function applyAllowedDirectoryToMcpArgs(mcpServers, allowedDirectory) {
+    const fsServer = mcpServers['filesystem'];
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- defensive: key may not exist in external JSON
+    if (!fsServer)
+        return;
+    if (fsServer.args.length === 0)
+        return;
+    fsServer.args[fsServer.args.length - 1] = allowedDirectory;
+}
 /**
  * Translates the typed webSearch config into flat env vars for the fetch server.
  */
@@ -161,20 +186,13 @@ export function loadConfig() {
     // Sync the filesystem server's allowed directory with the configured value.
     // The mcp-servers.json ships with a default path that may differ from
     // the ALLOWED_DIRECTORY environment variable.
-    const fsServer = mcpServers['filesystem'];
-    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- defensive: key may not exist in external JSON
-    if (fsServer) {
-        const defaultDir = '/tmp/ironcurtain-sandbox';
-        const dirIndex = fsServer.args.indexOf(defaultDir);
-        if (dirIndex !== -1) {
-            fsServer.args[dirIndex] = allowedDirectory;
-        }
-    }
+    applyAllowedDirectoryToMcpArgs(mcpServers, allowedDirectory);
     // Resolve all relative paths (node_modules/ and ./src/) to absolute paths.
     resolveMcpServerPaths(mcpServers);
     const constitutionPath = resolve(__dirname, 'constitution.md');
     const packageGeneratedDir = resolve(__dirname, 'generated');
-    const generatedDir = resolveGeneratedDir(packageGeneratedDir);
+    const generatedDir = resolveArtifactDir('compiled-policy.json', packageGeneratedDir);
+    const toolAnnotationsDir = resolveArtifactDir('tool-annotations.json', packageGeneratedDir);
     const protectedPaths = computeProtectedPaths({
         constitutionPath,
         generatedDir,
@@ -209,6 +227,7 @@ export function loadConfig() {
         mcpServers,
         protectedPaths,
         generatedDir,
+        toolAnnotationsDir,
         constitutionPath,
         agentModelId: finalUserConfig.agentModelId,
         escalationTimeoutSeconds: finalUserConfig.escalationTimeoutSeconds,
@@ -258,12 +277,75 @@ export function checkConstitutionFreshness(compiledPolicy, constitutionPath) {
             'Run `ironcurtain compile-policy` to update the compiled policy.\n');
     }
 }
+/**
+ * Pure diff between the configured MCP servers and the servers covered by
+ * `tool-annotations.json`. Used by both the runtime freshness check and
+ * the compile-time preventive check, which format the same drift data
+ * differently.
+ *
+ *   - `missing`: configured servers with no annotations entry (these will
+ *     silently default-deny every call via the policy engine's
+ *     structural-unknown-tool fallback).
+ *   - `orphaned`: annotated servers no longer configured (informational).
+ */
+export function findAnnotationServerDrift(toolAnnotations, mcpServers) {
+    const configuredNames = new Set(Object.keys(mcpServers));
+    const annotatedNames = new Set(Object.keys(toolAnnotations.servers));
+    return {
+        missing: [...configuredNames].filter((name) => !annotatedNames.has(name)).sort(),
+        orphaned: [...annotatedNames].filter((name) => !configuredNames.has(name)).sort(),
+    };
+}
+/**
+ * Runtime freshness check: emits stderr warnings when the on-disk
+ * tool-annotations.json no longer matches the configured MCP servers.
+ *
+ * The warning suggests re-running annotations for each specific server,
+ * not `--all`, so the user only re-classifies what actually changed.
+ */
+export function checkAnnotationFreshness(toolAnnotations, mcpServers) {
+    const { missing, orphaned } = findAnnotationServerDrift(toolAnnotations, mcpServers);
+    if (missing.length > 0) {
+        process.stderr.write(`Warning: ${missing.length} configured MCP server(s) have no tool annotations: ${missing.map(safeForDisplay).join(', ')}. ` +
+            `Tools from these servers will be denied by the policy engine until annotated.\n`);
+        for (const name of missing) {
+            process.stderr.write(`  Run \`ironcurtain annotate-tools --server ${safeForDisplay(name)}\` to annotate this server.\n`);
+        }
+    }
+    if (orphaned.length > 0) {
+        process.stderr.write(`Note: tool-annotations.json contains server(s) no longer in mcp-servers.json: ${orphaned.map(safeForDisplay).join(', ')}.\n`);
+    }
+}
+/**
+ * Quotes a user-supplied identifier for inclusion in a stderr message or a
+ * copy-paste shell command. Escapes control characters, quotes, and
+ * backslashes via JSON string semantics, and wraps the result in double
+ * quotes. The output is both safe to print (no terminal injection) and
+ * safe to paste into bash (`--server "name"`).
+ */
+export function safeForDisplay(identifier) {
+    return JSON.stringify(identifier);
+}
 export function loadGeneratedPolicy(options) {
     const compiledPolicy = JSON.parse(readGeneratedFile(options.policyDir, 'compiled-policy.json', options.fallbackDir));
     const toolAnnotations = JSON.parse(readGeneratedFile(options.toolAnnotationsDir, 'tool-annotations.json', options.fallbackDir));
     const dynamicLists = loadOptionalGeneratedFile(options.policyDir, 'dynamic-lists.json', options.fallbackDir);
     return { compiledPolicy, toolAnnotations, dynamicLists };
 }
+/**
+ * Loads only the per-persona / per-policy artifacts (compiled-policy.json
+ * and optional dynamic-lists.json). Tool annotations are deliberately not
+ * read here because they are globally-scoped: a persona directory only
+ * ships policy + lists, not annotations.
+ *
+ * Used by `ToolCallCoordinator.loadPolicy` during a hot-swap to pick up
+ * the new policy without touching the retained annotations.
+ */
+export function loadPersonaPolicyArtifacts(policyDir) {
+    const compiledPolicy = JSON.parse(readGeneratedFile(policyDir, 'compiled-policy.json'));
+    const dynamicLists = loadOptionalGeneratedFile(policyDir, 'dynamic-lists.json');
+    return { compiledPolicy, dynamicLists };
+}
 /**
  * Loads an optional generated artifact file. Returns undefined if not found.
  */

package/dist/config/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAgC,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE9C;;;GAGG;AACH,SAAS,mBAAmB,CAAC,mBAA2B;IACtD,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAMrC;IACC,MAAM,KAAK,GAAG;QACZ,mEAAmE;QACnE,2EAA2E;QAC3E,wEAAwE;QACxE,uEAAuE;QACvE,mCAAmC;QACnC,eAAe,CAAC,kBAAkB,EAAE,CAAC;QACrC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC;QACtC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;QAClC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC;QACpC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;KACnC,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,wDAAwD;IACxD,MAAM,oBAAoB,GAAG,2BAA2B,EAAE,CAAC;IAC3D,IAAI,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;IACtD,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7C,sDAAsD;IACtD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAA2C;IAC/E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAEnD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAuB,EAAE,WAAmB,EAAE,QAAiB;IACjG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QAEhE,IAAI,QAAQ,EAAE,CAAC;YACb,oDAAoD;YACpD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC7B,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC1C,IAAI,MAAM,KAAK,CAAC,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBACpC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,yCAAyC;YACzC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,2BAA2B,CAAC,SAAkC;IACrE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEtC,KAAK,CAAC,mBAAmB,GAAG,SAAS,CAAC,QAAQ,CAAC;IAE/C,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3B,KAAK,OAAO;YACV,IAAI,SAAS,CAAC,KAAK;gBAAE,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YAClE,MAAM;QACR,KAAK,QAAQ;YACX,IAAI,SAAS,CAAC,MAAM;gBAAE,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YACrE,MAAM;QACR,KAAK,SAAS;YACZ,IAAI,SAAS,CAAC,OAAO;gBAAE,KAAK,CAAC,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;YACxE,MAAM;IACV,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IAEpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,eAAe,CAAC;IACnE,0DAA0D;IAC1D,+DAA+D;IAC/D,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAE5E,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAoC,CAAC;IAExG,gEAAgE;IAChE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,kCAAkC;gBACxD,qDAAqD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,sEAAsE;IACtE,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1C,wHAAwH;IACxH,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,0BAA0B,CAAC;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAElC,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;IAE9D,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,gBAAgB;QAChB,YAAY;QACZ,mBAAmB;QACnB,cAAc;QACd,YAAY;KACb,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4FAA4F;IAC5F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,OAAO,oDAAoD;gBACxF,sBAAsB,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,cAAc,GAAG,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,eAAe,GAAG,UAAU,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,aAAa,GAChB,UAAU,CAAC,iBAAwE,CAAC,KAAK,IAAI,EAAE,CAAC;QACnG,MAAM,iBAAiB,GAA2C,EAAE,CAAC;QACrE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAClE,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAClC,CAAC;QACD,iBAAiB,CAAC,KAAK,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,cAAc,EAAE,CAAC;QAClE,eAAe,GAAG,EAAE,GAAG,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,YAAY;QACZ,gBAAgB;QAChB,UAAU;QACV,cAAc;QACd,YAAY;QACZ,gBAAgB;QAChB,YAAY,EAAE,eAAe,CAAC,YAAY;QAC1C,wBAAwB,EAAE,eAAe,CAAC,wBAAwB;QAClE,UAAU,EAAE,eAAe;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAA2C;IACvF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,cAAkC,EAAE,gBAAwB;IACrG,MAAM,WAAW,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE;YACrE,mEAAmE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAeD,MAAM,UAAU,mBAAmB,CAAC,OAA0B;IAK5D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAC/B,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,EAAE,OAAO,CAAC,WAAW,CAAC,CAC5D,CAAC;IACxB,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAChC,iBAAiB,CAAC,OAAO,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,OAAO,CAAC,WAAW,CAAC,CAC/D,CAAC;IAC/B,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAE7G,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAChC,YAAoB,EACpB,QAAgB,EAChB,WAAoB;IAEpB,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAqB,CAAC;IAC5E,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAqB,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,YAAoB,EAAE,QAAgB,EAAE,WAAoB;IACrF,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,YAAoB,EAAE,QAAgB;IACpE,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,wDAAwD;IACxD,OAAO,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAgC,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAErE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE9C;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,QAAgB,EAAE,mBAA2B;IACvE,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAMrC;IACC,MAAM,KAAK,GAAG;QACZ,mEAAmE;QACnE,2EAA2E;QAC3E,wEAAwE;QACxE,uEAAuE;QACvE,mCAAmC;QACnC,eAAe,CAAC,kBAAkB,EAAE,CAAC;QACrC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC;QACtC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;QAClC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC;QACpC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;KACnC,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,wDAAwD;IACxD,MAAM,oBAAoB,GAAG,2BAA2B,EAAE,CAAC;IAC3D,IAAI,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;IACtD,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7C,sDAAsD;IACtD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAA2C;IAC/E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAEnD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAuB,EAAE,WAAmB,EAAE,QAAiB;IACjG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QAEhE,IAAI,QAAQ,EAAE,CAAC;YACb,oDAAoD;YACpD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC7B,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC1C,IAAI,MAAM,KAAK,CAAC,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBACpC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,yCAAyC;YACzC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,8BAA8B,CAC5C,UAA8C,EAC9C,gBAAwB;IAExB,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1C,wHAAwH;IACxH,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACvC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,gBAAgB,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,SAAS,2BAA2B,CAAC,SAAkC;IACrE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEtC,KAAK,CAAC,mBAAmB,GAAG,SAAS,CAAC,QAAQ,CAAC;IAE/C,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3B,KAAK,OAAO;YACV,IAAI,SAAS,CAAC,KAAK;gBAAE,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YAClE,MAAM;QACR,KAAK,QAAQ;YACX,IAAI,SAAS,CAAC,MAAM;gBAAE,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YACrE,MAAM;QACR,KAAK,SAAS;YACZ,IAAI,SAAS,CAAC,OAAO;gBAAE,KAAK,CAAC,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;YACxE,MAAM;IACV,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IAEpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,eAAe,CAAC;IACnE,0DAA0D;IAC1D,+DAA+D;IAC/D,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAE5E,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAoC,CAAC;IAExG,gEAAgE;IAChE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,IAAI,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,kCAAkC;gBACxD,qDAAqD,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,sEAAsE;IACtE,8CAA8C;IAC9C,8BAA8B,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;IAE7D,2EAA2E;IAC3E,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAElC,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,kBAAkB,CAAC,sBAAsB,EAAE,mBAAmB,CAAC,CAAC;IACrF,MAAM,kBAAkB,GAAG,kBAAkB,CAAC,uBAAuB,EAAE,mBAAmB,CAAC,CAAC;IAE5F,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,gBAAgB;QAChB,YAAY;QACZ,mBAAmB;QACnB,cAAc;QACd,YAAY;KACb,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4FAA4F;IAC5F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,OAAO,oDAAoD;gBACxF,sBAAsB,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,cAAc,GAAG,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,eAAe,GAAG,UAAU,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,aAAa,GAChB,UAAU,CAAC,iBAAwE,CAAC,KAAK,IAAI,EAAE,CAAC;QACnG,MAAM,iBAAiB,GAA2C,EAAE,CAAC;QACrE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAClE,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAClC,CAAC;QACD,iBAAiB,CAAC,KAAK,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,cAAc,EAAE,CAAC;QAClE,eAAe,GAAG,EAAE,GAAG,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,YAAY;QACZ,gBAAgB;QAChB,UAAU;QACV,cAAc;QACd,YAAY;QACZ,kBAAkB;QAClB,gBAAgB;QAChB,YAAY,EAAE,eAAe,CAAC,YAAY;QAC1C,wBAAwB,EAAE,eAAe,CAAC,wBAAwB;QAClE,UAAU,EAAE,eAAe;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAA2C;IACvF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,cAAkC,EAAE,gBAAwB;IACrG,MAAM,WAAW,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE;YACrE,mEAAmE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CACvC,eAA0C,EAC1C,UAA2C;IAE3C,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;QAChF,QAAQ,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE;KAClF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,eAA0C,EAC1C,UAA2C;IAE3C,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,yBAAyB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAErF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,YAAY,OAAO,CAAC,MAAM,uDAAuD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACzH,iFAAiF,CACpF,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+CAA+C,cAAc,CAAC,IAAI,CAAC,+BAA+B,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iFAAiF,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAC9H,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,UAAkB;IAC/C,OAAO,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAeD,MAAM,UAAU,mBAAmB,CAAC,OAA0B;IAK5D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAC/B,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,EAAE,OAAO,CAAC,WAAW,CAAC,CAC5D,CAAC;IACxB,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAChC,iBAAiB,CAAC,OAAO,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,OAAO,CAAC,WAAW,CAAC,CAC/D,CAAC;IAC/B,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAE7G,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CAAC,SAAiB;IAI1D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAuB,CAAC;IAC9G,MAAM,YAAY,GAAG,yBAAyB,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IAChF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAChC,YAAoB,EACpB,QAAgB,EAChB,WAAoB;IAEpB,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAqB,CAAC;IAC5E,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAqB,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,YAAoB,EAAE,QAAgB,EAAE,WAAoB;IACrF,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,YAAoB,EAAE,QAAgB;IACpE,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,wDAAwD;IACxD,OAAO,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AACzC,CAAC"}

package/dist/config/mcp-servers.json

@@ -44,10 +44,10 @@
     "args": ["-y", "@alanse/mcp-server-google-workspace@1.0.2"],
     "env": {},
     "_comment": "npm registry domains are needed for the initial npx -y install. To remove them, vendor the package as a local dependency instead.",
+    "_comment2": "On Linux, the @anthropic-ai/sandbox-runtime apply-seccomp binary is executed from node_modules inside the sandbox. Denying ~ blocks access to this binary if the project is in the home directory. We deny specific sensitive directories instead. TODO: separate development and production into different sandbox configs.",
     "sandbox": {
       "filesystem": {
-        "denyRead": ["~"],
-        "allowRead": ["/usr", "/lib", "/etc"]
+        "denyRead": ["~/.gnupg", "~/.aws", "~/.ssh"]
       },
       "network": {
         "allowedDomains": [

package/dist/config/paths.d.ts

@@ -1,3 +1,4 @@
+import type { BundleId } from '../session/types.js';
 /**
  * Returns the IronCurtain home directory.
  * Defaults to ~/.ironcurtain, overridable via IRONCURTAIN_HOME env var.
@@ -7,6 +8,14 @@ export declare function getIronCurtainHome(): string;
  * Returns the sessions base directory: {home}/sessions/
  */
 export declare function getSessionsDir(): string;
+/**
+ * Filenames shared across session-scoped and workflow-state-scoped
+ * layouts. Centralized so the "single source of truth" for how session
+ * artifacts are named does not drift between helpers and call sites.
+ */
+export declare const SESSION_LOG_FILENAME = "session.log";
+export declare const SESSION_METADATA_FILENAME = "session-metadata.json";
+export declare const SESSION_STATE_FILENAME = "session-state.json";
 /**
  * Returns the session directory for a given session ID:
  *   {home}/sessions/{sessionId}/
@@ -143,6 +152,20 @@ export declare function loadConstitutionText(packageBasePath: string): string;
  * Loads the combined constitution and returns its SHA-256 hex digest.
  */
 export declare function computeConstitutionHash(basePath: string): string;
+/**
+ * Returns the user workflows directory: {home}/workflows/
+ * Users can place custom workflow definitions here.
+ */
+export declare function getUserWorkflowsDir(): string;
+/**
+ * Returns the user-global skills directory: {home}/skills/
+ *
+ * Skills placed here are layered into every Docker session regardless
+ * of workflow or persona. See `src/skills/discovery.ts` for the
+ * resolution order (user-global → persona → workflow, last-wins on
+ * collision) and `docs/designs/skills-capability.md` for the format.
+ */
+export declare function getUserSkillsDir(): string;
 /**
  * Returns the OAuth directory: {home}/oauth/
  * Stores provider credentials and token files.
@@ -165,6 +188,14 @@ export declare function getOAuthCredentialsPath(providerId: string): string;
  * can communicate with a running daemon (e.g., add-job, run-job).
  */
 export declare function getDaemonSocketPath(): string;
+/**
+ * Returns the web UI state file path: {home}/web-ui.json
+ *
+ * The daemon writes connection info (port + auth token) here on startup
+ * so CLI commands (e.g., `observe`) can connect to the WebSocket server.
+ * The file is removed on daemon shutdown.
+ */
+export declare function getWebUiStatePath(): string;
 /**
  * Returns the jobs base directory: {home}/jobs/
  */
@@ -188,3 +219,147 @@ export declare function getJobWorkspaceDir(jobId: string): string;
  * {home}/jobs/{jobId}/runs/
  */
 export declare function getJobRunsDir(jobId: string): string;
+/**
+ * Returns the workflow runs base directory: {home}/workflow-runs/
+ */
+export declare function getWorkflowRunsDir(): string;
+/**
+ * Returns the directory for a specific workflow run:
+ * {home}/workflow-runs/{workflowId}/
+ */
+export declare function getWorkflowRunDir(workflowId: string): string;
+/**
+ * Returns the containers root for a workflow run:
+ *   {home}/workflow-runs/{workflowId}/containers/
+ *
+ * Each bundle (one Docker container + its MITM/Code-Mode proxies, CA,
+ * fake keys, audit log, and per-state artifacts) lives under
+ * `containers/<bundleId>/`. A single-scope workflow has one entry; a
+ * bifurcated workflow with distinct `containerScope` values has one
+ * entry per distinct scope.
+ */
+export declare function getWorkflowContainersDir(workflowId: string): string;
+/**
+ * Returns the outer directory for a single bundle within a workflow run:
+ *   {home}/workflow-runs/{workflowId}/containers/{bundleId}/
+ *
+ * Contains the bundle's audit log, its inner `bundle/` directory with
+ * sockets/CA/fake keys/orientation, and the per-state `states/` tree.
+ */
+export declare function getBundleDir(workflowId: string, bundleId: BundleId): string;
+/**
+ * Returns the inner bundle artifact directory:
+ *   {home}/workflow-runs/{workflowId}/containers/{bundleId}/bundle/
+ *
+ * Holds the bundle-scoped files that `DockerInfrastructure` manages:
+ * MCP/MITM sockets, CA cert, fake keys, orientation scripts, and the
+ * effective system prompt. Bind-mounted into the Docker container for
+ * the UDS endpoints.
+ */
+export declare function getBundleBundleDir(workflowId: string, bundleId: BundleId): string;
+/**
+ * Returns the per-bundle audit log path:
+ *   {home}/workflow-runs/{workflowId}/containers/{bundleId}/audit.jsonl
+ *
+ * One audit file per bundle (coordinator). Each entry is tagged with
+ * the active `persona` so consumers can reconstruct per-persona /
+ * per-re-entry slices by scanning.
+ */
+export declare function getBundleAuditLogPath(workflowId: string, bundleId: BundleId): string;
+/**
+ * Returns the per-bundle states root:
+ *   {home}/workflow-runs/{workflowId}/containers/{bundleId}/states/
+ *
+ * Each agent state invocation (including re-entries) that borrows this
+ * bundle gets its own subdirectory keyed by `{stateId}.{N}`.
+ */
+export declare function getBundleStatesDir(workflowId: string, bundleId: BundleId): string;
+/**
+ * Returns the per-invocation artifact directory for a single state:
+ *   {home}/workflow-runs/{workflowId}/containers/{bundleId}/states/{stateSlug}/
+ *
+ * Holds this invocation's `session.log` and `session-metadata.json`.
+ * `stateSlug` is `{stateId}.{N}` (e.g., `fetch.1`, `plan.2`).
+ */
+export declare function getInvocationDir(workflowId: string, bundleId: BundleId, stateSlug: string): string;
+/**
+ * Picks the next available `{stateId}.{N}` slug in `statesDir`. Returns
+ * `${stateId}.1` when no matching dir exists; otherwise the max existing
+ * N plus 1. Used so every state entry (true logical re-visits AND resume
+ * legs of a single visit) gets its own forensic dir — `session.log` and
+ * `session-metadata.json` no longer interleave across resume attempts.
+ */
+export declare function nextStateSlug(statesDir: string, stateId: string): string;
+/**
+ * Returns the coordinator control socket path for a bundle:
+ *   {home}/run/{bundleId[0:12]}/ctrl.sock
+ *
+ * The coordinator listens on this UDS to accept policy hot-swap
+ * requests from the orchestrator. The socket sits under the bundle's
+ * per-bundle runtime root (mode `0o700`) so filesystem permissions
+ * gate access.
+ *
+ * The directory slug is truncated to 12 chars of `bundleId` so the
+ * assembled path fits under macOS `sockaddr_un.sun_path` (104 chars).
+ * 16^12 ≈ 2.8e14 combinations — collisions in the host-wide
+ * `run/<slug>/` namespace are astronomical.
+ */
+export declare function getBundleControlSocketPath(bundleId: BundleId): string;
+/**
+ * Returns the per-bundle runtime root directory:
+ *   {home}/run/{bundleId[0:12]}/
+ *
+ * Holds the coordinator control socket plus two subdirectories
+ * (`sockets/` and `host/`) so the bind-mounted UDS files can be
+ * co-located without exposing host-only sockets to the container.
+ */
+export declare function getBundleRuntimeRoot(bundleId: BundleId): string;
+/**
+ * Returns the per-bundle container-visible sockets directory:
+ *   {home}/run/{bundleId[0:12]}/sockets/
+ *
+ * Two UDS files live here:
+ *  - `proxy.sock`      (Code Mode proxy — bind-mounted into container)
+ *  - `mitm-proxy.sock` (MITM proxy      — bind-mounted into container)
+ *
+ * This directory is what `prepareDockerInfrastructure()` bind-mounts as
+ * `/run/ironcurtain/` inside the container (read-write). Only these two
+ * socket files live here — no audit logs, escalation files, or other
+ * session artifacts.
+ */
+export declare function getBundleSocketsDir(bundleId: BundleId): string;
+/**
+ * Returns the per-bundle host-only directory:
+ *   {home}/run/{bundleId[0:12]}/host/
+ *
+ * Holds UDS files that must NOT be visible to the container
+ * (currently just the MITM control socket).
+ */
+export declare function getBundleHostOnlyDir(bundleId: BundleId): string;
+/**
+ * Code Mode proxy UDS path for a bundle:
+ *   {home}/run/{bundleId[0:12]}/sockets/proxy.sock
+ *
+ * Bound by the host-side Code Mode proxy; reachable inside the
+ * container as `/run/ironcurtain/proxy.sock` via the bind mount on
+ * `getBundleSocketsDir()`.
+ */
+export declare function getBundleProxySocketPath(bundleId: BundleId): string;
+/**
+ * MITM proxy UDS path for a bundle:
+ *   {home}/run/{bundleId[0:12]}/sockets/mitm-proxy.sock
+ *
+ * Bound by the host-side MITM proxy; reachable inside the container as
+ * `/run/ironcurtain/mitm-proxy.sock` via the bind mount on
+ * `getBundleSocketsDir()`.
+ */
+export declare function getBundleMitmProxySocketPath(bundleId: BundleId): string;
+/**
+ * MITM control UDS path for a bundle:
+ *   {home}/run/{bundleId[0:12]}/host/mitm-control.sock
+ *
+ * Host-local only — lives under `host/` rather than `sockets/` so the
+ * bind mount that exposes `sockets/` at `/run/ironcurtain/` does not
+ * expose this socket to the container.
+ */
+export declare function getBundleMitmControlSocketPath(bundleId: BundleId): string;