@provos/ironcurtain 0.10.0 → 0.12.0

package/dist/config/paths.js

@@ -1,9 +1,34 @@
 import { createHash } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { dirname, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { SESSION_STATE_FILENAME } from '../docker/pty-types.js';
+import { JOB_ID_PATTERN } from '../types/slug.js';
+/**
+ * Short slug length used in file/directory names that must fit under
+ * `sockaddr_un.sun_path` (macOS ~104 bytes, Linux ~108 bytes). 12 hex
+ * chars give 16^12 ≈ 2.8e14 combinations, so collisions in the
+ * host-wide `~/.ironcurtain/run/<slug>/` namespace are astronomical —
+ * important because bundle teardown runs `rmSync(runtimeRoot)` and a
+ * collision would wipe another live bundle's sockets. The full UUID
+ * remains the authoritative identity in Docker labels and directory
+ * paths; only socket-adjacent names use the short form. The new
+ * `~/.ironcurtain/run/<12chars>/sockets/<name>.sock` layout has ample
+ * sun_path budget for the longer slug on both macOS (104) and Linux
+ * (108).
+ */
+const BUNDLE_SLUG_LEN = 12;
+/**
+ * Derives the short slug from a `BundleId`. Strips hyphens first so the
+ * resulting `BUNDLE_SLUG_LEN` characters are all hex — a raw
+ * `substring(0, 12)` on a canonical UUID would include the hyphen at
+ * position 8 and yield only 11 hex digits of entropy (16^11 ≈ 1.8e13).
+ * 12 hex digits give 16^12 ≈ 2.8e14, matching the collision-space math
+ * the layout depends on.
+ */
+function toBundleSlug(bundleId) {
+    return bundleId.replace(/-/g, '').substring(0, BUNDLE_SLUG_LEN);
+}
 const __dirname = dirname(fileURLToPath(import.meta.url));
 /**
  * Returns the IronCurtain home directory.
@@ -19,12 +44,37 @@ export function getSessionsDir() {
     return resolve(getIronCurtainHome(), 'sessions');
 }
 /**
- * Validates that a session ID contains only safe characters
- * (alphanumeric, hyphens, underscores) to prevent path traversal.
+ * Characters permitted in any identifier that gets embedded in a
+ * filesystem path by this module (session IDs, workflow IDs, persona
+ * slugs, daemon log names). Rejects path separators, glob
+ * metacharacters, NUL bytes, and everything else that could escape the
+ * target directory.
+ */
+const PATH_SAFE_SLUG_RE = /^[a-zA-Z0-9_-]+$/;
+function assertPathSafeSlug(kind, value) {
+    if (!PATH_SAFE_SLUG_RE.test(value)) {
+        throw new Error(`Invalid ${kind}: ${value}`);
+    }
+}
+/**
+ * Filenames shared across session-scoped and workflow-state-scoped
+ * layouts. Centralized so the "single source of truth" for how session
+ * artifacts are named does not drift between helpers and call sites.
+ */
+export const SESSION_LOG_FILENAME = 'session.log';
+export const SESSION_METADATA_FILENAME = 'session-metadata.json';
+export const SESSION_STATE_FILENAME = 'session-state.json';
+/**
+ * Validates a workflow state slug of the form `{stateId}.{visitCount}`
+ * (e.g., `fetch.1`, `plan.2`). Accepts dot-separated segments where
+ * each segment satisfies `PATH_SAFE_SLUG_RE`. Empty segments — produced
+ * by `..`, leading or trailing dots — fail the per-segment check.
  */
-function validateSessionId(sessionId) {
-    if (!/^[a-zA-Z0-9_-]+$/.test(sessionId)) {
-        throw new Error(`Invalid session ID: ${sessionId}`);
+function assertStateSlug(value) {
+    if (value.length === 0)
+        throw new Error(`Invalid state slug: ${value}`);
+    for (const segment of value.split('.')) {
+        assertPathSafeSlug('state slug segment', segment);
     }
 }
 /**
@@ -32,7 +82,7 @@ function validateSessionId(sessionId) {
  *   {home}/sessions/{sessionId}/
  */
 export function getSessionDir(sessionId) {
-    validateSessionId(sessionId);
+    assertPathSafeSlug('session ID', sessionId);
     return resolve(getSessionsDir(), sessionId);
 }
 /**
@@ -54,7 +104,7 @@ export function getSessionEscalationDir(sessionId) {
  *   {home}/sessions/{sessionId}/session-metadata.json
  */
 export function getSessionMetadataPath(sessionId) {
-    return resolve(getSessionDir(sessionId), 'session-metadata.json');
+    return resolve(getSessionDir(sessionId), SESSION_METADATA_FILENAME);
 }
 /**
  * Returns the audit log path for a given session:
@@ -75,7 +125,7 @@ export function getSessionInteractionLogPath(sessionId) {
  *   {home}/sessions/{sessionId}/session.log
  */
 export function getSessionLogPath(sessionId) {
-    return resolve(getSessionDir(sessionId), 'session.log');
+    return resolve(getSessionDir(sessionId), SESSION_LOG_FILENAME);
 }
 /**
  * Returns the LLM interaction log path for a given session:
@@ -84,6 +134,32 @@ export function getSessionLogPath(sessionId) {
 export function getSessionLlmLogPath(sessionId) {
     return resolve(getSessionDir(sessionId), 'llm-interactions.jsonl');
 }
+/**
+ * Returns the trajectory-capture directory for a single-session
+ * standalone run:
+ *   {home}/sessions/{sessionId}/captures/
+ *
+ * Holds `{sessionId}.jsonl` and `manifest.jsonl` per
+ * docs/designs/mitm-token-trajectory-capture.md §7.
+ */
+export function getSessionCapturesDir(sessionId) {
+    return resolve(getSessionDir(sessionId), 'captures');
+}
+/**
+ * Returns the JSONL file path for a single session's captured
+ * exchanges within `capturesDir`. Filename is `{sessionId}.jsonl`.
+ */
+export function getSessionCaptureFile(capturesDir, sessionId) {
+    assertPathSafeSlug('session ID', sessionId);
+    return resolve(capturesDir, `${sessionId}.jsonl`);
+}
+/**
+ * Returns the manifest path within a captures directory:
+ *   {capturesDir}/manifest.jsonl
+ */
+export function getCaptureManifestFile(capturesDir) {
+    return resolve(capturesDir, 'manifest.jsonl');
+}
 /**
  * Returns the auto-approver LLM interaction log path for a given session:
  *   {home}/sessions/{sessionId}/auto-approve-llm.jsonl
@@ -142,9 +218,7 @@ export function getLogsDir() {
  * E.g., getDaemonLogPath('signal-bot') → {home}/logs/signal-bot.log
  */
 export function getDaemonLogPath(name) {
-    if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
-        throw new Error(`Invalid daemon log name: ${name}`);
-    }
+    assertPathSafeSlug('daemon log name', name);
     return resolve(getLogsDir(), `${name}.log`);
 }
 /**
@@ -238,6 +312,24 @@ export function computeConstitutionHash(basePath) {
     const text = loadConstitutionText(basePath);
     return createHash('sha256').update(text).digest('hex');
 }
+/**
+ * Returns the user workflows directory: {home}/workflows/
+ * Users can place custom workflow definitions here.
+ */
+export function getUserWorkflowsDir() {
+    return resolve(getIronCurtainHome(), 'workflows');
+}
+/**
+ * Returns the user-global skills directory: {home}/skills/
+ *
+ * Skills placed here are layered into every Docker session regardless
+ * of workflow or persona. See `src/skills/discovery.ts` for the
+ * resolution order (user-global → persona → workflow, last-wins on
+ * collision) and `docs/designs/skills-capability.md` for the format.
+ */
+export function getUserSkillsDir() {
+    return resolve(getIronCurtainHome(), 'skills');
+}
 // ---------------------------------------------------------------------------
 // OAuth paths
 // ---------------------------------------------------------------------------
@@ -285,6 +377,16 @@ export function getOAuthCredentialsPath(providerId) {
 export function getDaemonSocketPath() {
     return resolve(getIronCurtainHome(), 'daemon.sock');
 }
+/**
+ * Returns the web UI state file path: {home}/web-ui.json
+ *
+ * The daemon writes connection info (port + auth token) here on startup
+ * so CLI commands (e.g., `observe`) can connect to the WebSocket server.
+ * The file is removed on daemon shutdown.
+ */
+export function getWebUiStatePath() {
+    return resolve(getIronCurtainHome(), 'web-ui.json');
+}
 // ---------------------------------------------------------------------------
 // Job paths (cron mode)
 // ---------------------------------------------------------------------------
@@ -294,7 +396,6 @@ export function getDaemonSocketPath() {
 export function getJobsDir() {
     return resolve(getIronCurtainHome(), 'jobs');
 }
-import { JOB_ID_PATTERN } from '../cron/types.js';
 /**
  * Validates that a job ID contains only safe characters.
  */
@@ -331,4 +432,252 @@ export function getJobWorkspaceDir(jobId) {
 export function getJobRunsDir(jobId) {
     return resolve(getJobDir(jobId), 'runs');
 }
+// ---------------------------------------------------------------------------
+// Workflow run paths
+// ---------------------------------------------------------------------------
+/**
+ * Returns the workflow runs base directory: {home}/workflow-runs/
+ */
+export function getWorkflowRunsDir() {
+    return resolve(getIronCurtainHome(), 'workflow-runs');
+}
+/**
+ * Returns the directory for a specific workflow run:
+ * {home}/workflow-runs/{workflowId}/
+ */
+export function getWorkflowRunDir(workflowId) {
+    assertPathSafeSlug('workflow ID', workflowId);
+    return resolve(getWorkflowRunsDir(), workflowId);
+}
+/**
+ * Returns the containers root for a workflow run:
+ *   {home}/workflow-runs/{workflowId}/containers/
+ *
+ * Each bundle (one Docker container + its MITM/Code-Mode proxies, CA,
+ * fake keys, audit log, and per-state artifacts) lives under
+ * `containers/<bundleId>/`. A single-scope workflow has one entry; a
+ * bifurcated workflow with distinct `containerScope` values has one
+ * entry per distinct scope.
+ */
+export function getWorkflowContainersDir(workflowId) {
+    return resolve(getWorkflowRunDir(workflowId), 'containers');
+}
+/**
+ * Returns the outer directory for a single bundle within a workflow run:
+ *   {home}/workflow-runs/{workflowId}/containers/{bundleId}/
+ *
+ * Contains the bundle's audit log, its inner `bundle/` directory with
+ * sockets/CA/fake keys/orientation, and the per-state `states/` tree.
+ */
+export function getBundleDir(workflowId, bundleId) {
+    assertPathSafeSlug('bundle ID', bundleId);
+    return resolve(getWorkflowContainersDir(workflowId), bundleId);
+}
+/**
+ * Returns the inner bundle artifact directory:
+ *   {home}/workflow-runs/{workflowId}/containers/{bundleId}/bundle/
+ *
+ * Holds the bundle-scoped files that `DockerInfrastructure` manages:
+ * MCP/MITM sockets, CA cert, fake keys, orientation scripts, and the
+ * effective system prompt. Bind-mounted into the Docker container for
+ * the UDS endpoints.
+ */
+export function getBundleBundleDir(workflowId, bundleId) {
+    return resolve(getBundleDir(workflowId, bundleId), 'bundle');
+}
+/**
+ * Returns the per-bundle audit log path:
+ *   {home}/workflow-runs/{workflowId}/containers/{bundleId}/audit.jsonl
+ *
+ * One audit file per bundle (coordinator). Each entry is tagged with
+ * the active `persona` so consumers can reconstruct per-persona /
+ * per-re-entry slices by scanning.
+ */
+export function getBundleAuditLogPath(workflowId, bundleId) {
+    return resolve(getBundleDir(workflowId, bundleId), 'audit.jsonl');
+}
+/**
+ * Returns the trajectory-capture directory for a workflow bundle:
+ *   {home}/workflow-runs/{workflowId}/containers/{bundleId}/captures/
+ *
+ * Sits alongside the bundle's audit log; holds one `{sessionId}.jsonl`
+ * per state visit plus a shared `manifest.jsonl`. See
+ * docs/designs/mitm-token-trajectory-capture.md §7.
+ */
+export function getBundleCapturesDir(workflowId, bundleId) {
+    return resolve(getBundleDir(workflowId, bundleId), 'captures');
+}
+/**
+ * Returns the per-bundle states root:
+ *   {home}/workflow-runs/{workflowId}/containers/{bundleId}/states/
+ *
+ * Each agent state invocation (including re-entries) that borrows this
+ * bundle gets its own subdirectory keyed by `{stateId}.{N}`.
+ */
+export function getBundleStatesDir(workflowId, bundleId) {
+    return resolve(getBundleDir(workflowId, bundleId), 'states');
+}
+/**
+ * Returns the per-invocation artifact directory for a single state:
+ *   {home}/workflow-runs/{workflowId}/containers/{bundleId}/states/{stateSlug}/
+ *
+ * Holds this invocation's `session.log` and `session-metadata.json`.
+ * `stateSlug` is `{stateId}.{N}` (e.g., `fetch.1`, `plan.2`).
+ */
+export function getInvocationDir(workflowId, bundleId, stateSlug) {
+    assertStateSlug(stateSlug);
+    return resolve(getBundleStatesDir(workflowId, bundleId), stateSlug);
+}
+/**
+ * Picks the next available `{prefix}.{N}` slug in `statesDir`, where `prefix` is
+ * `stateId` or — when a fan-out `laneId` is supplied — `{stateId}_lane_{laneId}`.
+ * Returns `{prefix}.1` when no matching dir exists; otherwise the max existing
+ * N plus 1. Used so every state entry (true logical re-visits AND resume legs of
+ * a single visit) gets its own forensic dir — `session.log` and
+ * `session-metadata.json` no longer interleave across resume attempts.
+ *
+ * The `laneId` parameter is the fix for the fan-out artifact-dir collision: N
+ * same-state lanes run concurrently and, sharing one `stateId`, the check-then-act
+ * `{stateId}.{N}` computation races and clobbers each other's diagnostics. Keying
+ * the prefix on `lane.id` gives each lane its own `{stateId}_lane_{id}.{N}`
+ * namespace so per-lane `session.log` / `session-metadata.json` never collide.
+ *
+ * `laneId`, when supplied, MUST be a non-negative integer (the orchestrator
+ * assigns it as a fan-out loop index). It is interpolated into a directory-name
+ * prefix, so this is enforced as defense-in-depth on a path component: a
+ * non-integer or negative value throws (it would indicate an internal bug). A
+ * valid `laneId` renders as `_lane_<digits>`, which is path-safe and still
+ * passes the slug check.
+ */
+export function nextStateSlug(statesDir, stateId, laneId) {
+    assertPathSafeSlug('state ID', stateId);
+    if (laneId !== undefined && (!Number.isInteger(laneId) || laneId < 0)) {
+        throw new Error(`nextStateSlug: laneId must be a non-negative integer, got ${laneId}`);
+    }
+    const prefixBase = laneId === undefined ? stateId : `${stateId}_lane_${laneId}`;
+    let max = 0;
+    if (existsSync(statesDir)) {
+        const prefix = `${prefixBase}.`;
+        for (const entry of readdirSync(statesDir, { withFileTypes: true })) {
+            if (!entry.isDirectory() || !entry.name.startsWith(prefix))
+                continue;
+            // Decimal-digit-only suffix; reject "1e6", "0x10", " 1 ", "01",
+            // etc. so a stray dir name can't inflate the next slug.
+            const suffix = entry.name.slice(prefix.length);
+            if (!DECIMAL_SUFFIX_RE.test(suffix))
+                continue;
+            const n = Number(suffix);
+            if (n > max)
+                max = n;
+        }
+    }
+    return `${prefixBase}.${max + 1}`;
+}
+const DECIMAL_SUFFIX_RE = /^(?:0|[1-9]\d*)$/;
+/**
+ * Returns the coordinator control socket path for a bundle:
+ *   {home}/run/{bundleId[0:12]}/ctrl.sock
+ *
+ * The coordinator listens on this UDS to accept policy hot-swap
+ * requests from the orchestrator. The socket sits under the bundle's
+ * per-bundle runtime root (mode `0o700`) so filesystem permissions
+ * gate access.
+ *
+ * The directory slug is truncated to 12 chars of `bundleId` so the
+ * assembled path fits under macOS `sockaddr_un.sun_path` (104 chars).
+ * 16^12 ≈ 2.8e14 combinations — collisions in the host-wide
+ * `run/<slug>/` namespace are astronomical.
+ */
+export function getBundleControlSocketPath(bundleId) {
+    return resolve(getBundleRuntimeRoot(bundleId), 'ctrl.sock');
+}
+// ---------------------------------------------------------------------------
+// Per-bundle UDS endpoints (MCP proxy, MITM proxy, MITM control, coordinator)
+// ---------------------------------------------------------------------------
+//
+// Every UDS file owned by a bundle lives under a single per-bundle root
+// at `~/.ironcurtain/run/<bundleId[0:12]>/`. The directory is created
+// with `0o700` (see `docker-infrastructure.ts`), inheriting the same
+// security posture as the rest of the IronCurtain home. Worst-case
+// assembled path (with a 20-char username) is about 76 bytes —
+// comfortably under macOS 104 and Linux 108 `sockaddr_un.sun_path` caps.
+//
+// Three locations per bundle:
+//   run/<bid12>/ctrl.sock             → coordinator control socket
+//   run/<bid12>/sockets/              → bind-mounted as /run/ironcurtain/
+//   run/<bid12>/host/                 → host-local only (MITM control)
+// The `sockets/` vs `host/` split keeps the bind-mounted endpoints
+// separate from host-only endpoints so `isEndpointAllowed` is not the
+// only thing standing between the container and the MITM control API.
+/**
+ * Returns the per-bundle runtime root directory:
+ *   {home}/run/{bundleId[0:12]}/
+ *
+ * Holds the coordinator control socket plus two subdirectories
+ * (`sockets/` and `host/`) so the bind-mounted UDS files can be
+ * co-located without exposing host-only sockets to the container.
+ */
+export function getBundleRuntimeRoot(bundleId) {
+    assertPathSafeSlug('bundle ID', bundleId);
+    return resolve(getIronCurtainHome(), 'run', toBundleSlug(bundleId));
+}
+/**
+ * Returns the per-bundle container-visible sockets directory:
+ *   {home}/run/{bundleId[0:12]}/sockets/
+ *
+ * Two UDS files live here:
+ *  - `proxy.sock`      (Code Mode proxy — bind-mounted into container)
+ *  - `mitm-proxy.sock` (MITM proxy      — bind-mounted into container)
+ *
+ * This directory is what `prepareDockerInfrastructure()` bind-mounts as
+ * `/run/ironcurtain/` inside the container (read-write). Only these two
+ * socket files live here — no audit logs, escalation files, or other
+ * session artifacts.
+ */
+export function getBundleSocketsDir(bundleId) {
+    return resolve(getBundleRuntimeRoot(bundleId), 'sockets');
+}
+/**
+ * Returns the per-bundle host-only directory:
+ *   {home}/run/{bundleId[0:12]}/host/
+ *
+ * Holds UDS files that must NOT be visible to the container
+ * (currently just the MITM control socket).
+ */
+export function getBundleHostOnlyDir(bundleId) {
+    return resolve(getBundleRuntimeRoot(bundleId), 'host');
+}
+/**
+ * Code Mode proxy UDS path for a bundle:
+ *   {home}/run/{bundleId[0:12]}/sockets/proxy.sock
+ *
+ * Bound by the host-side Code Mode proxy; reachable inside the
+ * container as `/run/ironcurtain/proxy.sock` via the bind mount on
+ * `getBundleSocketsDir()`.
+ */
+export function getBundleProxySocketPath(bundleId) {
+    return resolve(getBundleSocketsDir(bundleId), 'proxy.sock');
+}
+/**
+ * MITM proxy UDS path for a bundle:
+ *   {home}/run/{bundleId[0:12]}/sockets/mitm-proxy.sock
+ *
+ * Bound by the host-side MITM proxy; reachable inside the container as
+ * `/run/ironcurtain/mitm-proxy.sock` via the bind mount on
+ * `getBundleSocketsDir()`.
+ */
+export function getBundleMitmProxySocketPath(bundleId) {
+    return resolve(getBundleSocketsDir(bundleId), 'mitm-proxy.sock');
+}
+/**
+ * MITM control UDS path for a bundle:
+ *   {home}/run/{bundleId[0:12]}/host/mitm-control.sock
+ *
+ * Host-local only — lives under `host/` rather than `sockets/` so the
+ * bind mount that exposes `sockets/` at `/run/ironcurtain/` does not
+ * expose this socket to the container.
+ */
+export function getBundleMitmControlSocketPath(bundleId) {
+    return resolve(getBundleHostOnlyDir(bundleId), 'mitm-control.sock');
+}
 //# sourceMappingURL=paths.js.map

package/dist/config/paths.js.map

@@ -1 +1 @@
-{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/config/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC7B,OAAO,OAAO,CAAC,cAAc,EAAE,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,uBAAuB,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC;AACrE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,SAAiB;IAC/D,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,cAAc,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,0BAA0B,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,aAAa,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,OAAO,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,sBAAsB,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,OAAO,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,2BAA2B,EAAE,CAAC;IACnD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,eAAuB;IAC1D,MAAM,YAAY,GAAG,2BAA2B,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC;IAC3E,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,YAAY,QAAQ,eAAe,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,MAAM,gBAAgB,GAAG,2BAA2B,EAAE,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,QAAQ,gBAAgB,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,OAAO,GAAG,IAAI,OAAO,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,OAAO,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,mBAAmB,CAAC,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,aAAa,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;GAEG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/config/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,QAA2B;IAC/C,OAAO,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D;;;GAGG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAE7C,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa;IACrD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAClD,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D;;;;;GAKG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;IACxE,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,kBAAkB,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,kBAAkB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,cAAc,EAAE,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,yBAAyB,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACtD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB,EAAE,SAAiB;IAC1E,kBAAkB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,WAAW,EAAE,GAAG,SAAS,QAAQ,CAAC,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,OAAO,OAAO,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B,CAAC,SAAiB;IAC/D,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAiB;IACpD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACnD,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,sBAAsB,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,cAAc,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,0BAA0B,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,aAAa,CAAC,CAAC;AACtD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,kBAAkB,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC,UAAU,EAAE,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,sBAAsB,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAC1D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO,OAAO,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,OAAO,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AAClD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,2BAA2B,EAAE,CAAC;IACnD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,eAAuB;IAC1D,MAAM,YAAY,GAAG,2BAA2B,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC;IAC3E,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,YAAY,QAAQ,eAAe,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAE7C,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;IAC3C,MAAM,gBAAgB,GAAG,2BAA2B,EAAE,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,QAAQ,gBAAgB,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,wBAAwB,EAAE,CAAC;IACxC,OAAO,GAAG,IAAI,OAAO,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,WAAW,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,kBAAkB,CAAC,UAAkB;IAC5C,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,OAAO,CAAC,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IACxD,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,OAAO,OAAO,CAAC,WAAW,EAAE,EAAE,GAAG,UAAU,mBAAmB,CAAC,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,aAAa,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,aAAa,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,aAAa,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,OAAO,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E;;GAEG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,eAAe,CAAC,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAAkB;IAClD,kBAAkB,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAC9C,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,UAAU,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,OAAO,OAAO,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,UAAkB,EAAE,QAAkB;IACjE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,wBAAwB,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,QAAkB;IACvE,OAAO,OAAO,CAAC,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,QAAkB;IAC1E,OAAO,OAAO,CAAC,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,QAAkB;IACzE,OAAO,OAAO,CAAC,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,QAAkB;IACvE,OAAO,OAAO,CAAC,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,QAAkB,EAAE,SAAiB;IACxF,eAAe,CAAC,SAAS,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,OAAe,EAAE,MAAe;IAC/E,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,6DAA6D,MAAM,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,SAAS,MAAM,EAAE,CAAC;IAChF,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,CAAC;QAChC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,SAAS;YACrE,gEAAgE;YAChE,wDAAwD;YACxD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG,GAAG;gBAAE,GAAG,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,UAAU,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAkB;IAC3D,OAAO,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,CAAC;AAC9D,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,qEAAqE;AACrE,mEAAmE;AACnE,+DAA+D;AAC/D,yEAAyE;AACzE,EAAE;AACF,8BAA8B;AAC9B,mEAAmE;AACnE,0EAA0E;AAC1E,uEAAuE;AACvE,mEAAmE;AACnE,sEAAsE;AACtE,sEAAsE;AAEtE;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAkB;IACpD,OAAO,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAkB;IACrD,OAAO,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAkB;IACzD,OAAO,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,QAAkB;IAC7D,OAAO,OAAO,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,iBAAiB,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAAkB;IAC/D,OAAO,OAAO,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAC,CAAC;AACtE,CAAC"}

package/dist/config/types.d.ts

@@ -1,4 +1,10 @@
 import type { ResolvedUserConfig } from './user-config.js';
+/**
+ * Auth kinds an adapter may receive. Subset of `AuthMethod['kind']` from
+ * `docker/oauth-credentials.ts` minus `'none'`: by the time an adapter is
+ * consulted, a credential has been resolved.
+ */
+export type DockerAuthKind = 'oauth' | 'apikey';
 /**
  * Network access configuration for a sandboxed MCP server.
  *
@@ -105,7 +111,7 @@ export interface IronCurtainConfig {
      * Adapters use this to choose between OAuth and API key env vars.
      */
     dockerAuth?: {
-        readonly kind: 'oauth' | 'apikey';
+        readonly kind: DockerAuthKind;
     };
     /**
      * Whether this is a PTY session. When true, the proxy requires

package/dist/config/user-config.d.ts

@@ -31,9 +31,32 @@ export declare const USER_CONFIG_DEFAULTS: {
     readonly auditRedaction: {
         readonly enabled: true;
     };
+    readonly preferredMode: "docker";
+    readonly dockerResources: {
+        /** Memory ceiling in MB; null means "do not pass --memory". */
+        readonly memoryMb: 8192;
+        /** CPU ceiling (fractional ok); null means "do not pass --cpus". */
+        readonly cpus: 4;
+    };
+    readonly snapshot: {
+        readonly enabled: true;
+        readonly maxAgeDays: 7;
+        readonly sweepIntervalHours: 24;
+    };
 };
 export declare const ESCALATION_TIMEOUT_MIN = 30;
 export declare const ESCALATION_TIMEOUT_MAX = 600;
+/**
+ * Strict model ID validator for `~/.ironcurtain/config.json`. A colon-prefixed
+ * value must name a known provider; bare names are accepted.
+ */
+export declare const qualifiedModelId: z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>;
+/**
+ * Looser model ID validator for workflow YAML. Additionally accepts
+ * Ollama-style "name:tag" identifiers (e.g. `glm-5.1:cloud`) reached via
+ * an upstream gateway like ANTHROPIC_BASE_URL.
+ */
+export declare const looseModelId: z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>;
 export declare const WEB_SEARCH_PROVIDERS: readonly ["brave", "tavily", "serpapi"];
 export type WebSearchProvider = (typeof WEB_SEARCH_PROVIDERS)[number];
 /** Human-readable labels for web search providers. */
@@ -48,12 +71,24 @@ export declare const WEB_SEARCH_PROVIDER_URLS: Readonly<Record<WebSearchProvider
 export declare const GOOSE_PROVIDERS: readonly ["anthropic", "openai", "google"];
 /** Goose provider — structurally identical to ProviderId from model-provider.ts. */
 export type GooseProvider = (typeof GOOSE_PROVIDERS)[number];
-export declare const DOCKER_AGENTS: readonly ["claude-code", "goose"];
+export declare const DOCKER_AGENTS: readonly ["claude-code", "goose", "codex"];
 export type DockerAgent = (typeof DOCKER_AGENTS)[number];
+export declare const SESSION_MODES: readonly ["docker", "builtin"];
+export type SessionModeKind = (typeof SESSION_MODES)[number];
+/**
+ * Container runtime backend for Docker Agent Mode sessions. 'auto'
+ * prefers the Apple container runtime when its preflight passes
+ * (Apple silicon, macOS 26+, container CLI >= 1.0 with services
+ * running) and falls back to Docker otherwise. The
+ * IRONCURTAIN_CONTAINER_RUNTIME env var overrides this setting.
+ * See docs/designs/apple-container-runtime.md.
+ */
+export declare const CONTAINER_RUNTIMES: readonly ["auto", "docker", "apple-container"];
+export type ContainerRuntimeSetting = (typeof CONTAINER_RUNTIMES)[number];
 export declare const userConfigSchema: z.ZodObject<{
-    agentModelId: z.ZodOptional<z.ZodString>;
-    policyModelId: z.ZodOptional<z.ZodString>;
-    prefilterModelId: z.ZodOptional<z.ZodString>;
+    agentModelId: z.ZodOptional<z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>>;
+    policyModelId: z.ZodOptional<z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>>;
+    prefilterModelId: z.ZodOptional<z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>>;
     anthropicApiKey: z.ZodOptional<z.ZodString>;
     googleApiKey: z.ZodOptional<z.ZodString>;
     openaiApiKey: z.ZodOptional<z.ZodString>;
@@ -72,11 +107,11 @@ export declare const userConfigSchema: z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
         thresholdTokens: z.ZodOptional<z.ZodNumber>;
         keepRecentMessages: z.ZodOptional<z.ZodNumber>;
-        summaryModelId: z.ZodOptional<z.ZodString>;
+        summaryModelId: z.ZodOptional<z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>>;
     }, z.core.$strip>>;
     autoApprove: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
-        modelId: z.ZodOptional<z.ZodString>;
+        modelId: z.ZodOptional<z.ZodType<string, unknown, z.core.$ZodTypeInternals<string, unknown>>>;
     }, z.core.$strip>>;
     auditRedaction: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -123,6 +158,16 @@ export declare const userConfigSchema: z.ZodObject<{
     preferredDockerAgent: z.ZodOptional<z.ZodEnum<{
         "claude-code": "claude-code";
         goose: "goose";
+        codex: "codex";
+    }>>;
+    preferredMode: z.ZodOptional<z.ZodEnum<{
+        docker: "docker";
+        builtin: "builtin";
+    }>>;
+    containerRuntime: z.ZodOptional<z.ZodEnum<{
+        docker: "docker";
+        auto: "auto";
+        "apple-container": "apple-container";
     }>>;
     packageInstall: z.ZodOptional<z.ZodObject<{
         enabled: z.ZodOptional<z.ZodBoolean>;
@@ -130,6 +175,18 @@ export declare const userConfigSchema: z.ZodObject<{
         allowedPackages: z.ZodOptional<z.ZodArray<z.ZodString>>;
         deniedPackages: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strip>>;
+    dockerResources: z.ZodOptional<z.ZodObject<{
+        memoryMb: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        cpus: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    }, z.core.$strip>>;
+    capture: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    snapshot: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        maxAgeDays: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        sweepIntervalHours: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 /** Parsed config from ~/.ironcurtain/config.json. All fields optional. */
 export type UserConfig = z.infer<typeof userConfigSchema>;
@@ -171,6 +228,27 @@ export interface ResolvedPackageInstallConfig {
     readonly allowedPackages: readonly string[];
     readonly deniedPackages: readonly string[];
 }
+/**
+ * Resolved Docker container resource ceilings.
+ *
+ * `null` is a deliberate "no limit" signal: callers must omit the
+ * corresponding `--memory` / `--cpus` flag, matching the existing pattern
+ * in `docker-manager.ts:buildCreateArgs()`.
+ *
+ * These are the user-configured ceilings BEFORE clamping. The runtime
+ * clamp (`clampDockerResources()` in `src/docker/resource-limits.ts`) lowers
+ * either value to fit the host's actual capacity; nulls pass through
+ * unchanged.
+ */
+export interface ResolvedDockerResourcesConfig {
+    readonly memoryMb: number | null;
+    readonly cpus: number | null;
+}
+export interface ResolvedSnapshotConfig {
+    readonly enabled: boolean;
+    readonly maxAgeDays: number | null;
+    readonly sweepIntervalHours: number;
+}
 /** Resolved web search config with all fields present. */
 export interface ResolvedWebSearchConfig {
     readonly provider: WebSearchProvider | null;
@@ -211,8 +289,25 @@ export interface ResolvedUserConfig {
     readonly gooseModel: string;
     /** Preferred Docker agent for auto-detection. */
     readonly preferredDockerAgent: DockerAgent;
+    /** Preferred session mode: 'docker' (default) or 'builtin'. */
+    readonly preferredMode: SessionModeKind;
+    /** Container runtime backend: 'auto' (default), 'docker', or 'apple-container'. */
+    readonly containerRuntime: ContainerRuntimeSetting;
     /** Package installation proxy configuration. */
     readonly packageInstall: ResolvedPackageInstallConfig;
+    /** Docker container resource ceilings (pre-clamp). */
+    readonly dockerResources: ResolvedDockerResourcesConfig;
+    /** Workflow container snapshot retention and global enablement. */
+    readonly snapshot: ResolvedSnapshotConfig;
+    /**
+     * Trajectory-capture config. Optional — absent from
+     * USER_CONFIG_DEFAULTS so the `?? false` at the session-factory
+     * resolution point is authoritative. See
+     * docs/designs/mitm-token-trajectory-capture.md §10.
+     */
+    readonly capture?: {
+        readonly enabled: boolean;
+    };
 }
 /**
  * Loads user configuration from ~/.ironcurtain/config.json.