@provos/ironcurtain 0.11.0 → 0.12.0

package/dist/daemon-client/daemon-client.js

@@ -0,0 +1,324 @@
+/**
+ * A thin, generic JSON-RPC-over-WebSocket client for the IronCurtain daemon.
+ *
+ * This is the single reusable transport for talking to the daemon's web-UI
+ * WebSocket surface (`ws://{host}:{port}/ws?token=`). It is workflow-agnostic:
+ * it sends arbitrary `MethodName` requests and optionally subscribes to push
+ * event frames. Workflow-specific knowledge lives in the calling CLI command.
+ *
+ * Layering: this module is a LEAF. Its only runtime dependencies are `ws`,
+ * node builtins, `src/config/paths.ts` (for discovery), and
+ * `src/web-ui/ws-utils.ts`. It imports the wire-contract types from
+ * `web-ui-types.ts` as **type-only** imports, which creates no runtime edge.
+ *
+ * Contract recap (see the {@link DaemonClient} interface for the full list):
+ *  - RPC-level errors resolve as `{ ok:false, ... }` — callers branch on the
+ *    discriminant rather than try/catch.
+ *  - Transport failures (socket closed, connect/request timeout) reject.
+ *  - `onClose()` fires at most once for an *involuntary* disconnect (remote or
+ *    network close, or a post-handshake error). A deliberate `close()` does NOT
+ *    fire it — that is how listeners distinguish "the daemon went away" from
+ *    "we tore down on purpose".
+ */
+import { readFileSync } from 'node:fs';
+import { WebSocket } from 'ws';
+import { getWebUiStatePath } from '../config/paths.js';
+import { wsDataToString } from '../web-ui/ws-utils.js';
+/**
+ * Signals that no daemon is running with `--web-ui` (no discoverable endpoint).
+ * Carries a `code` discriminant so cross-module catchers branch on a string
+ * rather than `instanceof` (per CLAUDE.md module-layering guidance).
+ */
+export class DaemonNotRunningError extends Error {
+    code = 'DAEMON_NOT_RUNNING';
+    constructor(message = 'No IronCurtain daemon with web UI is running') {
+        super(message);
+        this.name = 'DaemonNotRunningError';
+    }
+}
+// ---------------------------------------------------------------------------
+// Discovery
+// ---------------------------------------------------------------------------
+const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
+const DEFAULT_CONNECT_TIMEOUT_MS = 10_000;
+/**
+ * Reads daemon connection info from the well-known state file
+ * (`getWebUiStatePath()` → `~/.ironcurtain/web-ui.json`).
+ *
+ * Returns `undefined` when the file is absent or unparseable — i.e. when no
+ * daemon is running with `--web-ui`. Callers distinguish "no daemon" from other
+ * failures by this `undefined` return, never by catching.
+ */
+export function discoverDaemon() {
+    let raw;
+    try {
+        raw = readFileSync(getWebUiStatePath(), 'utf-8');
+    }
+    catch {
+        return undefined;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (!isDaemonEndpoint(parsed))
+        return undefined;
+    return { host: parsed.host, port: parsed.port, token: parsed.token };
+}
+/** Structural guard for a discovered endpoint (rejects garbage state files). */
+function isDaemonEndpoint(value) {
+    if (value === null || typeof value !== 'object')
+        return false;
+    const v = value;
+    return (typeof v.host === 'string' &&
+        v.host.length > 0 &&
+        typeof v.port === 'number' &&
+        Number.isInteger(v.port) &&
+        v.port > 0 &&
+        v.port <= 65535 &&
+        typeof v.token === 'string' &&
+        v.token.length > 0);
+}
+// ---------------------------------------------------------------------------
+// Construction
+// ---------------------------------------------------------------------------
+/**
+ * Constructs (but does not connect) a {@link DaemonClient}.
+ *
+ * Throws {@link DaemonNotRunningError} when no `endpoint` is supplied and
+ * discovery fails — the single typed signal an agent uses to decide whether to
+ * start a daemon.
+ */
+export function createDaemonClient(options = {}) {
+    const endpoint = options.endpoint ?? discoverDaemon();
+    if (!endpoint) {
+        throw new DaemonNotRunningError();
+    }
+    return new WebSocketDaemonClient(endpoint, {
+        requestTimeoutMs: options.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS,
+        connectTimeoutMs: options.connectTimeoutMs ?? DEFAULT_CONNECT_TIMEOUT_MS,
+    });
+}
+class WebSocketDaemonClient {
+    endpoint;
+    timeouts;
+    ws;
+    pending = new Map();
+    listeners = new Set();
+    closeListeners = new Set();
+    idCounter = 0;
+    closed = false;
+    lastError;
+    closeNotified = false;
+    constructor(endpoint, timeouts) {
+        this.endpoint = endpoint;
+        this.timeouts = timeouts;
+    }
+    connect() {
+        if (this.closed) {
+            return Promise.reject(new Error('DaemonClient is closed'));
+        }
+        if (this.ws) {
+            return Promise.reject(new Error('DaemonClient is already connected'));
+        }
+        const url = `ws://${this.endpoint.host}:${this.endpoint.port}/ws?token=${this.endpoint.token}`;
+        const ws = new WebSocket(url);
+        this.ws = ws;
+        // Permanent error-capturing listener, attached BEFORE the connect-phase
+        // handlers. `ws.close()` on a still-CONNECTING socket schedules a deferred
+        // 'error' emit; without any listener that becomes an unhandled 'error' event
+        // and crashes the process. Keeping a handler attached for the socket's whole
+        // life guarantees the deferred error always has somewhere to go, and
+        // preserves its message for the onClose info.
+        ws.on('error', (err) => {
+            this.lastError = err;
+        });
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                ws.removeListener('open', onOpen);
+                ws.removeListener('error', onError);
+                if (this.ws === ws)
+                    this.ws = undefined;
+                ws.close();
+                reject(new Error(`Timed out connecting to daemon after ${this.timeouts.connectTimeoutMs}ms`));
+            }, this.timeouts.connectTimeoutMs);
+            const onOpen = () => {
+                clearTimeout(timer);
+                ws.removeListener('error', onError);
+                this.attachSteadyStateHandlers(ws);
+                resolve();
+            };
+            const onError = (err) => {
+                clearTimeout(timer);
+                ws.removeListener('open', onOpen);
+                if (this.ws === ws)
+                    this.ws = undefined;
+                ws.close();
+                reject(err);
+            };
+            ws.once('open', onOpen);
+            ws.once('error', onError);
+        });
+    }
+    call(method, params = {}) {
+        if (this.closed) {
+            return Promise.reject(new Error('DaemonClient is closed'));
+        }
+        const ws = this.ws;
+        if (!ws || ws.readyState !== WebSocket.OPEN) {
+            return Promise.reject(new Error('DaemonClient is not connected'));
+        }
+        const id = `rpc-${++this.idCounter}`;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.pending.delete(id);
+                reject(new Error(`Request "${method}" (${id}) timed out after ${this.timeouts.requestTimeoutMs}ms`));
+            }, this.timeouts.requestTimeoutMs);
+            this.pending.set(id, {
+                resolve: resolve,
+                reject,
+                timer,
+            });
+            try {
+                ws.send(JSON.stringify({ id, method, params }));
+            }
+            catch (err) {
+                this.pending.delete(id);
+                clearTimeout(timer);
+                reject(err instanceof Error ? err : new Error(String(err)));
+            }
+        });
+    }
+    onEvent(listener) {
+        this.listeners.add(listener);
+        return () => {
+            this.listeners.delete(listener);
+        };
+    }
+    onClose(listener) {
+        this.closeListeners.add(listener);
+        return () => {
+            this.closeListeners.delete(listener);
+        };
+    }
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        this.rejectAllPending(new Error('DaemonClient closed'));
+        this.listeners.clear();
+        // Deliberate teardown: `this.closed = true` (set above) is already in place
+        // before `ws.close()` below, so the steady-state 'close' handler's
+        // `!this.closed` guard suppresses any spurious onClose. Clearing here also
+        // releases references for callers that never disconnect involuntarily.
+        this.closeListeners.clear();
+        const ws = this.ws;
+        if (!ws)
+            return;
+        if (ws.readyState === WebSocket.CLOSED)
+            return;
+        await new Promise((resolve) => {
+            ws.once('close', () => resolve());
+            ws.close();
+        });
+    }
+    // -----------------------------------------------------------------------
+    // Internals
+    // -----------------------------------------------------------------------
+    attachSteadyStateHandlers(ws) {
+        ws.on('message', (data) => this.handleMessage(data));
+        ws.on('close', (code) => this.handleClose(code));
+        // Post-handshake errors surface via the 'close' that follows; rejecting
+        // pending calls there keeps a single drain path. The permanent error-capturing
+        // listener attached in `connect()` (before this socket reached steady state)
+        // already records `this.lastError`, so its message is available for the
+        // onClose info — no second 'error' listener is needed here.
+    }
+    handleMessage(data) {
+        let frame;
+        try {
+            frame = JSON.parse(wsDataToString(data));
+        }
+        catch {
+            return;
+        }
+        if (typeof frame.id === 'string') {
+            this.settleResponse(frame.id, frame);
+            return;
+        }
+        if (typeof frame.event === 'string') {
+            this.fanOutEvent({
+                event: frame.event,
+                payload: frame.payload,
+                seq: typeof frame.seq === 'number' ? frame.seq : 0,
+            });
+        }
+    }
+    settleResponse(id, frame) {
+        const pending = this.pending.get(id);
+        if (!pending)
+            return;
+        this.pending.delete(id);
+        clearTimeout(pending.timer);
+        pending.resolve(toRpcResult(frame));
+    }
+    fanOutEvent(event) {
+        for (const listener of this.listeners) {
+            try {
+                listener(event);
+            }
+            catch {
+                // A misbehaving listener must not break delivery to the others.
+            }
+        }
+    }
+    handleClose(code) {
+        this.rejectAllPending(new Error('Daemon connection closed'));
+        // Only fire onClose for an *involuntary* disconnect. `close()` sets
+        // `this.closed = true` before closing the socket, so a deliberate teardown
+        // is suppressed here. Fire at most once via the `closeNotified` latch.
+        if (this.closed || this.closeNotified)
+            return;
+        this.closeNotified = true;
+        const info = {
+            code,
+            reason: this.lastError?.message ?? `daemon connection closed${code !== undefined ? ` (code ${code})` : ''}`,
+            ...(this.lastError ? { error: this.lastError } : {}),
+        };
+        this.fanOutClose(info);
+    }
+    fanOutClose(info) {
+        for (const listener of this.closeListeners) {
+            try {
+                listener(info);
+            }
+            catch {
+                // A misbehaving listener must not break delivery to the others.
+            }
+        }
+    }
+    rejectAllPending(err) {
+        for (const [, pending] of this.pending) {
+            clearTimeout(pending.timer);
+            pending.reject(err);
+        }
+        this.pending.clear();
+    }
+}
+/** Maps a raw `{id,ok,...}` response frame to the {@link RpcResult} discriminant. */
+function toRpcResult(frame) {
+    if (frame.ok === true) {
+        return { ok: true, payload: frame.payload };
+    }
+    const error = frame.error;
+    return {
+        ok: false,
+        code: (typeof error?.code === 'string' ? error.code : 'INTERNAL_ERROR'),
+        message: typeof error?.message === 'string' ? error.message : 'Unknown RPC error',
+        data: error?.data,
+    };
+}
+//# sourceMappingURL=daemon-client.js.map

package/dist/daemon-client/daemon-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-client.js","sourceRoot":"","sources":["../../src/daemon-client/daemon-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AAE/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAkFvD;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,GAAG,oBAA6B,CAAC;IAE9C,YAAY,OAAO,GAAG,8CAA8C;QAClE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc;IAC5B,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,iBAAiB,EAAE,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AACvE,CAAC;AAED,gFAAgF;AAChF,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QACjB,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;QAC1B,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;QACxB,CAAC,CAAC,IAAI,GAAG,CAAC;QACV,CAAC,CAAC,IAAI,IAAI,KAAK;QACf,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAC3B,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAA+B,EAAE;IAClE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,EAAE,CAAC;IACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,qBAAqB,EAAE,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,qBAAqB,CAAC,QAAQ,EAAE;QACzC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,0BAA0B;QACxE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,0BAA0B;KACzE,CAAC,CAAC;AACL,CAAC;AAkBD,MAAM,qBAAqB;IAWN;IACA;IAXX,EAAE,CAAwB;IACjB,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IACzC,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAC;IAChD,cAAc,GAAG,IAAI,GAAG,EAAmC,CAAC;IACrE,SAAS,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,KAAK,CAAC;IACf,SAAS,CAAoB;IAC7B,aAAa,GAAG,KAAK,CAAC;IAE9B,YACmB,QAAwB,EACxB,QAA0B;QAD1B,aAAQ,GAAR,QAAQ,CAAgB;QACxB,aAAQ,GAAR,QAAQ,CAAkB;IAC1C,CAAC;IAEJ,OAAO;QACL,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,aAAa,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC/F,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QAEb,wEAAwE;QACxE,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,qEAAqE;QACrE,8CAA8C;QAC9C,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;YAC5B,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACvB,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAClC,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACpC,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE;oBAAE,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC;gBACxC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC;YAChG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YAEnC,MAAM,MAAM,GAAG,GAAS,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACpC,IAAI,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;gBACnC,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YAEF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE;gBACnC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBAClC,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE;oBAAE,IAAI,CAAC,EAAE,GAAG,SAAS,CAAC;gBACxC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC;YAEF,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACxB,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAc,MAAkB,EAAE,SAAkC,EAAE;QACxE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YAC5C,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,OAAO,IAAI,OAAO,CAAe,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,MAAM,MAAM,EAAE,qBAAqB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC;YACvG,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;YAEnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE;gBACnB,OAAO,EAAE,OAA+C;gBACxD,MAAM;gBACN,KAAK;aACN,CAAC,CAAC;YAEH,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;YAClD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,QAAkC;QACxC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,QAAyC;QAC/C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAClC,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,IAAI,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,4EAA4E;QAC5E,mEAAmE;QACnE,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;QAE5B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,EAAE;YAAE,OAAO;QAEhB,IAAI,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,MAAM;YAAE,OAAO;QAC/C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAClC,EAAE,CAAC,KAAK,EAAE,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,YAAY;IACZ,0EAA0E;IAElE,yBAAyB,CAAC,EAAa;QAC7C,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAqC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QACtF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,wEAAwE;QACxE,+EAA+E;QAC/E,6EAA6E;QAC7E,wEAAwE;QACxE,4DAA4D;IAC9D,CAAC;IAEO,aAAa,CAAC,IAAqC;QACzD,IAAI,KAA8B,CAAC;QACnC,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,CAA4B,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC,WAAW,CAAC;gBACf,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,EAAE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,EAAU,EAAE,KAA8B;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxB,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;IACtC,CAAC;IAEO,WAAW,CAAC,KAAkB;QACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,QAAQ,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,IAAa;QAC/B,IAAI,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC;QAE7D,oEAAoE;QACpE,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAE1B,MAAM,IAAI,GAAoB;YAC5B,IAAI;YACJ,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,IAAI,2BAA2B,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC3G,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAEO,WAAW,CAAC,IAAqB;QACvC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC3C,IAAI,CAAC;gBACH,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;YAClE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,gBAAgB,CAAC,GAAU;QACjC,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED,qFAAqF;AACrF,SAAS,WAAW,CAAC,KAA8B;IACjD,IAAI,KAAK,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAA0E,CAAC;IAC/F,OAAO;QACL,EAAE,EAAE,KAAK;QACT,IAAI,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAc;QACpF,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAmB;QACjF,IAAI,EAAE,KAAK,EAAE,IAAI;KAClB,CAAC;AACJ,CAAC"}

package/dist/docker/adapters/codex.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Codex CLI adapter for Docker Agent Mode.
+ *
+ * Runs OpenAI Codex CLI non-interactively through the same container,
+ * MCP proxy, and MITM fake-token path as other Docker agents. The adapter
+ * uses Codex's ChatGPT OAuth/access-token flow, not OPENAI_API_KEY.
+ */
+import type { AgentAdapter } from '../agent-adapter.js';
+export declare function createCodexAdapter(): AgentAdapter;

package/dist/docker/adapters/codex.js

@@ -0,0 +1,297 @@
+/**
+ * Codex CLI adapter for Docker Agent Mode.
+ *
+ * Runs OpenAI Codex CLI non-interactively through the same container,
+ * MCP proxy, and MITM fake-token path as other Docker agents. The adapter
+ * uses Codex's ChatGPT OAuth/access-token flow, not OPENAI_API_KEY.
+ */
+import { buildSystemPrompt } from '../../session/prompts.js';
+import { codexAuthProvider, codexChatGptProvider } from '../provider-config.js';
+import { loadCodexOAuthCredentials } from '../oauth-credentials.js';
+import { parseModelId } from '../../config/model-provider.js';
+import { buildAttributionSection, buildCheckPtySizeScript, buildNetworkSection, buildPolicySection, buildResizePtyScript, } from './shared-scripts.js';
+const CODEX_IMAGE = 'ironcurtain-codex:latest';
+const CODEX_FAKE_ID_TOKEN = 'eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.' +
+    'eyJlbWFpbCI6Imlyb25jdXJ0YWluQGV4YW1wbGUuaW52YWxpZCIsImh0dHBzOi8vYXBpLm9wZW5haS5jb20vYXV0aCI6eyJjaGF0Z3B0X3BsYW5fdHlwZSI6InBybyIsImNoYXRncHRfdXNlcl9pZCI6Imlyb25jdXJ0YWluLXVzZXIiLCJjaGF0Z3B0X2FjY291bnRfaWQiOiJpcm9uY3VydGFpbi1hY2NvdW50IiwiY2hhdGdwdF9hY2NvdW50X2lzX2ZlZHJhbXAiOmZhbHNlfX0.' +
+    'c2ln';
+function tomlString(value) {
+    return JSON.stringify(value);
+}
+function buildCodexDockerEnvironmentPrompt(context) {
+    return `## Docker Environment
+
+### Workspace (\`${context.workspaceDir}\`)
+This is your workspace inside the container. You have full access here.
+For local file operations inside ${context.workspaceDir}, use your built-in shell tools.
+
+### External Operations (MCP tools)
+Use the IronCurtain MCP server for operations that require external access:
+- Network requests (HTTP fetches, web searches, API calls)
+- Git remote operations (clone, push, pull, fetch)
+- Reading files outside ${context.workspaceDir}
+
+After cloning a repo or writing files via MCP tools, use your built-in
+tools for subsequent file operations.
+
+${buildNetworkSection('the IronCurtain MCP tools')}
+${buildPolicySection('MCP tool call')}
+${buildAttributionSection()}`;
+}
+function buildStartScript() {
+    return `#!/bin/bash
+if [ -n "$IRONCURTAIN_INITIAL_COLS" ] && [ -n "$IRONCURTAIN_INITIAL_ROWS" ]; then
+  stty cols "$IRONCURTAIN_INITIAL_COLS" rows "$IRONCURTAIN_INITIAL_ROWS" 2>/dev/null
+fi
+cd /workspace
+
+MODEL_ARGS=()
+if [ -n "$IRONCURTAIN_MODEL" ]; then
+  MODEL_ARGS=(--model "$IRONCURTAIN_MODEL")
+fi
+
+exec codex --ask-for-approval never --sandbox danger-full-access "\${MODEL_ARGS[@]}" --cd /workspace
+`;
+}
+export function createCodexAdapter() {
+    return {
+        id: 'codex',
+        displayName: 'Codex CLI',
+        credentialHelpText: 'No Codex OAuth credentials found. Run `codex login` on the host; OPENAI_API_KEY is not required.',
+        // eslint-disable-next-line @typescript-eslint/require-await -- interface requires Promise return
+        async getImage() {
+            return CODEX_IMAGE;
+        },
+        generateMcpConfig(socketPath) {
+            const isTcp = socketPath.includes(':');
+            const connectTarget = isTcp ? `TCP:${socketPath}` : `UNIX-CONNECT:${socketPath}`;
+            const toml = [
+                'cli_auth_credentials_store = "file"',
+                'project_doc_fallback_filenames = ["CLAUDE.md"]',
+                '',
+                '[projects."/workspace"]',
+                'trust_level = "trusted"',
+                '',
+                '[mcp_servers.ironcurtain]',
+                'command = "socat"',
+                `args = ["STDIO", ${tomlString(connectTarget)}]`,
+                'startup_timeout_sec = 20',
+                'tool_timeout_sec = 600',
+                'default_tools_approval_mode = "auto"',
+                '',
+            ].join('\n');
+            return [{ path: 'codex-config.toml', content: toml }];
+        },
+        generateOrientationFiles() {
+            return [
+                { path: 'start-codex.sh', content: buildStartScript(), mode: 0o755 },
+                { path: 'resize-pty.sh', content: buildResizePtyScript('codex'), mode: 0o755 },
+                { path: 'check-pty-size.sh', content: buildCheckPtySizeScript('codex'), mode: 0o755 },
+            ];
+        },
+        buildCommand(message, systemPrompt, options) {
+            const prompt = `${systemPrompt}\n\n---\n\nUser request:\n${message}`;
+            const cmd = ['codex', '--ask-for-approval', 'never', '--sandbox', 'danger-full-access'];
+            if (options.modelOverride) {
+                cmd.push('--model', parseModelId(options.modelOverride).modelId);
+            }
+            cmd.push('exec', '--json', '--skip-git-repo-check', '--cd', '/workspace', prompt);
+            return cmd;
+        },
+        buildSystemPrompt(context) {
+            const codeModePrompt = buildSystemPrompt(context.serverListings, context.hostSandboxDir);
+            const dockerPrompt = buildCodexDockerEnvironmentPrompt(context);
+            return `${codeModePrompt}\n${dockerPrompt}`;
+        },
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars -- authKind kept for adapter interface symmetry
+        getProviders(_authKind) {
+            return [codexChatGptProvider, codexAuthProvider];
+        },
+        buildEnv(_config, fakeKeys) {
+            const fakeToken = fakeKeys.get('chatgpt.com');
+            if (!fakeToken) {
+                throw new Error('No fake token generated for chatgpt.com — cannot configure Codex authentication');
+            }
+            return {
+                CODEX_HOME: '/home/codespace/.codex',
+                IRONCURTAIN_CODEX_ACCESS_TOKEN: fakeToken,
+                IRONCURTAIN_CODEX_ID_TOKEN: CODEX_FAKE_ID_TOKEN,
+                IRONCURTAIN_CODEX_ACCOUNT_ID: 'ironcurtain-account',
+                CODEX_CA_CERTIFICATE: '/usr/local/share/ca-certificates/ironcurtain-ca.crt',
+                SSL_CERT_FILE: '/etc/ssl/certs/ca-certificates.crt',
+                RUST_LOG: 'error',
+            };
+        },
+        /**
+         * NOTE on quota / transient-failure handling and the assumed Codex
+         * envelope schema.
+         *
+         * Codex `exec --json` emits a JSONL event stream, one JSON object per
+         * line. The happy path carries `item.completed` events whose `item.type`
+         * is `agent_message` (the model's text). We CANNOT confirm Codex's exact
+         * failure-event schema from the repo, so detection is intentionally
+         * conservative and generic (see `scanCodexEvents`):
+         *
+         *   - A top-level event is treated as a failure when its `type` ends in
+         *     `.failed` (e.g. `turn.failed`) or equals `error`, OR when its
+         *     `item.type` is `error`. We pull a human-readable message from the
+         *     event's / item's `error.message`, `message`, or `text` field.
+         *   - From that failure message (plus the non-zero-exit stderr/stdout on
+         *     the error path), `withFailureSignal` does narrow, string-based
+         *     matching: a rate-limit / usage-limit / quota / HTTP-429 hit sets
+         *     `quotaExhausted` (the orchestrator pauses-and-resumes instead of
+         *     burning the run); anything else error-shaped sets a transient
+         *     `degenerate_response` failure.
+         *
+         * Detection is deliberately narrow so it cannot misfire on normal
+         * output: the happy-path return value below is byte-identical to the
+         * previous implementation (last `agent_message`, else raw stdout). See
+         * the Claude Code adapter (`adapters/claude-code.ts`) for the canonical
+         * contract and `AgentResponse.quotaExhausted` / `transientFailure` in
+         * `../agent-adapter.ts` for the interface requirement.
+         */
+        extractResponse(exitCode, stdout, stderr) {
+            const clean = stdout.trim();
+            const scan = scanCodexEvents(clean);
+            if (exitCode !== 0) {
+                const errorOutput = [clean, stderr?.trim()].filter((part) => part && part.length > 0).join('\n\n');
+                const baseText = `Codex exited with code ${exitCode}.\n\nOutput:\n${errorOutput}`;
+                // Combine any in-band failure message with the raw error output so a
+                // 429 surfaced either in-band OR only in stderr/stdout is detected.
+                const probe = [scan.errorMessage, clean, stderr].filter((p) => p && p.length > 0).join('\n');
+                return withFailureSignal({ text: baseText }, probe);
+            }
+            // Exit 0: prefer the model's final message. If none is present but the
+            // stream carried a failure event, describe the failure (and attach the
+            // structured signal) instead of dumping a raw JSONL line.
+            if (scan.finalMessage) {
+                return { text: scan.finalMessage };
+            }
+            if (scan.errorMessage) {
+                return withFailureSignal({ text: `Codex reported an error:\n\n${scan.errorMessage}` }, scan.errorMessage);
+            }
+            return { text: clean };
+        },
+        buildPtyCommand(_systemPrompt, ptySockPath, ptyPort) {
+            const listenArg = ptySockPath ? `UNIX-LISTEN:${ptySockPath},fork` : `TCP-LISTEN:${ptyPort},reuseaddr`;
+            return ['socat', listenArg, 'EXEC:/etc/ironcurtain/start-codex.sh,pty,setsid,ctty,stderr,rawer'];
+        },
+        detectCredential() {
+            const credentials = loadCodexOAuthCredentials();
+            if (!credentials)
+                return { kind: 'none' };
+            return {
+                kind: 'oauth',
+                credentials: {
+                    accessToken: credentials.accessToken,
+                    refreshToken: credentials.refreshToken,
+                    expiresAt: credentials.expiresAt,
+                },
+                source: 'file',
+            };
+        },
+        getConversationStateConfig() {
+            return {
+                hostDirName: 'codex-state',
+                containerMountPath: '/home/codespace/.codex/',
+                seed: [
+                    { path: 'sessions/', content: '' },
+                    { path: 'logs/', content: '' },
+                ],
+                resumeFlags: [],
+            };
+        },
+    };
+}
+/**
+ * Single-pass scan over the Codex `exec --json` JSONL stream.
+ *
+ * Collects the last `agent_message` text and the first detected
+ * failure/error message. Malformed/truncated lines are skipped (the JSONL
+ * stream can be truncated when a process is killed), so a valid
+ * `agent_message` on a later line is still recovered.
+ */
+function scanCodexEvents(stdout) {
+    if (stdout.length === 0)
+        return { finalMessage: null, errorMessage: null };
+    let lastAgentMessage = null;
+    let errorMessage = null;
+    for (const line of stdout.split(/\r?\n/)) {
+        if (line.trim().length === 0)
+            continue;
+        let parsed;
+        try {
+            parsed = JSON.parse(line);
+        }
+        catch {
+            continue;
+        }
+        if (!parsed || typeof parsed !== 'object')
+            continue;
+        const event = parsed;
+        const item = event.item && typeof event.item === 'object' ? event.item : undefined;
+        if (item && item.type === 'agent_message' && typeof item.text === 'string') {
+            lastAgentMessage = item.text;
+        }
+        if (errorMessage === null) {
+            errorMessage = extractCodexErrorMessage(event, item);
+        }
+    }
+    return { finalMessage: lastAgentMessage?.trim() || null, errorMessage };
+}
+/**
+ * Recognizes a Codex failure/error envelope generically (the exact schema
+ * is not confirmable from the repo): a top-level `type` ending in `.failed`
+ * or equal to `error`, or an item whose `type` is `error`. Returns a
+ * best-effort human-readable message, or null when the event is not a
+ * failure shape.
+ */
+function extractCodexErrorMessage(event, item) {
+    const eventType = typeof event.type === 'string' ? event.type : undefined;
+    const isEventFailure = eventType !== undefined && (eventType.endsWith('.failed') || eventType === 'error');
+    const isItemFailure = item !== undefined && item.type === 'error';
+    if (!isEventFailure && !isItemFailure)
+        return null;
+    return pickErrorMessage(event) ?? (item ? pickErrorMessage(item) : undefined) ?? eventType ?? 'unknown Codex error';
+}
+/** Pulls a message string from an `error.message` / `message` / `text` field. */
+function pickErrorMessage(obj) {
+    const nested = obj.error;
+    if (nested && typeof nested === 'object') {
+        const msg = nested.message;
+        if (typeof msg === 'string' && msg.length > 0)
+            return msg;
+    }
+    if (typeof obj.message === 'string' && obj.message.length > 0)
+        return obj.message;
+    if (typeof obj.text === 'string' && obj.text.length > 0)
+        return obj.text;
+    return undefined;
+}
+/** Narrow, case-insensitive substring matches for upstream quota/rate-limit. */
+const QUOTA_PROBE_PATTERNS = [
+    /\b429\b/,
+    /rate.?limit/i,
+    /usage.?limit/i,
+    /\bquota\b/i,
+    /too many requests/i,
+];
+/**
+ * Best-effort classification of a Codex error string into a structured
+ * signal. Quota / rate-limit / 429 hits map to `quotaExhausted`; any other
+ * non-empty error string maps to a transient `degenerate_response`.
+ * Returns the response unchanged when `probe` is empty.
+ *
+ * Detection is intentionally string-based and narrow so it cannot misfire
+ * on normal model output (only reached when a failure event was detected or
+ * the process exited non-zero).
+ */
+function withFailureSignal(response, probe) {
+    const trimmed = probe.trim();
+    if (trimmed.length === 0)
+        return response;
+    if (QUOTA_PROBE_PATTERNS.some((re) => re.test(trimmed))) {
+        return { ...response, quotaExhausted: { rawMessage: trimmed } };
+    }
+    return { ...response, transientFailure: { kind: 'degenerate_response', rawMessage: trimmed } };
+}
+//# sourceMappingURL=codex.js.map

package/dist/docker/adapters/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../src/docker/adapters/codex.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAaH,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAC/C,MAAM,mBAAmB,GACvB,sCAAsC;IACtC,8RAA8R;IAC9R,MAAM,CAAC;AAET,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,iCAAiC,CAAC,OAA2B;IACpE,OAAO;;mBAEU,OAAO,CAAC,YAAY;;mCAEJ,OAAO,CAAC,YAAY;;;;;;0BAM7B,OAAO,CAAC,YAAY;;;;;EAK5C,mBAAmB,CAAC,2BAA2B,CAAC;EAChD,kBAAkB,CAAC,eAAe,CAAC;EACnC,uBAAuB,EAAE,EAAE,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;;;;;;;;;;;;CAYR,CAAC;AACF,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,EAAE,EAAE,OAAkB;QACtB,WAAW,EAAE,WAAW;QACxB,kBAAkB,EAChB,kGAAkG;QAEpG,iGAAiG;QACjG,KAAK,CAAC,QAAQ;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,iBAAiB,CAAC,UAAkB;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACvC,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,gBAAgB,UAAU,EAAE,CAAC;YAEjF,MAAM,IAAI,GAAG;gBACX,qCAAqC;gBACrC,gDAAgD;gBAChD,EAAE;gBACF,yBAAyB;gBACzB,yBAAyB;gBACzB,EAAE;gBACF,2BAA2B;gBAC3B,mBAAmB;gBACnB,oBAAoB,UAAU,CAAC,aAAa,CAAC,GAAG;gBAChD,0BAA0B;gBAC1B,wBAAwB;gBACxB,sCAAsC;gBACtC,EAAE;aACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAEb,OAAO,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,wBAAwB;YACtB,OAAO;gBACL,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;gBACpE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;gBAC9E,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,uBAAuB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;aACtF,CAAC;QACJ,CAAC;QAED,YAAY,CACV,OAAe,EACf,YAAoB,EACpB,OAIC;YAED,MAAM,MAAM,GAAG,GAAG,YAAY,6BAA6B,OAAO,EAAE,CAAC;YACrE,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,WAAW,EAAE,oBAAoB,CAAC,CAAC;YACxF,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC1B,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,CAAC;YACnE,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,uBAAuB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YAClF,OAAO,GAAG,CAAC;QACb,CAAC;QAED,iBAAiB,CAAC,OAA2B;YAC3C,MAAM,cAAc,GAAG,iBAAiB,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;YACzF,MAAM,YAAY,GAAG,iCAAiC,CAAC,OAAO,CAAC,CAAC;YAChE,OAAO,GAAG,cAAc,KAAK,YAAY,EAAE,CAAC;QAC9C,CAAC;QAED,6GAA6G;QAC7G,YAAY,CAAC,SAA0B;YACrC,OAAO,CAAC,oBAAoB,EAAE,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAED,QAAQ,CAAC,OAA0B,EAAE,QAAqC;YACxE,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC9C,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;YACrG,CAAC;YAED,OAAO;gBACL,UAAU,EAAE,wBAAwB;gBACpC,8BAA8B,EAAE,SAAS;gBACzC,0BAA0B,EAAE,mBAAmB;gBAC/C,4BAA4B,EAAE,qBAAqB;gBACnD,oBAAoB,EAAE,qDAAqD;gBAC3E,aAAa,EAAE,oCAAoC;gBACnD,QAAQ,EAAE,OAAO;aAClB,CAAC;QACJ,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;WA2BG;QACH,eAAe,CAAC,QAAgB,EAAE,MAAc,EAAE,MAAe;YAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;YAEpC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnG,MAAM,QAAQ,GAAG,0BAA0B,QAAQ,iBAAiB,WAAW,EAAE,CAAC;gBAClF,qEAAqE;gBACrE,oEAAoE;gBACpE,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7F,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;YACtD,CAAC;YAED,uEAAuE;YACvE,uEAAuE;YACvE,0DAA0D;YAC1D,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,CAAC;YACD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,OAAO,iBAAiB,CAAC,EAAE,IAAI,EAAE,+BAA+B,IAAI,CAAC,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC5G,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACzB,CAAC;QAED,eAAe,CACb,aAAqB,EACrB,WAA+B,EAC/B,OAA2B;YAE3B,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,eAAe,WAAW,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,YAAY,CAAC;YACtG,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,mEAAmE,CAAC,CAAC;QACnG,CAAC;QAED,gBAAgB;YACd,MAAM,WAAW,GAAG,yBAAyB,EAAE,CAAC;YAChD,IAAI,CAAC,WAAW;gBAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC1C,OAAO;gBACL,IAAI,EAAE,OAAO;gBACb,WAAW,EAAE;oBACX,WAAW,EAAE,WAAW,CAAC,WAAW;oBACpC,YAAY,EAAE,WAAW,CAAC,YAAY;oBACtC,SAAS,EAAE,WAAW,CAAC,SAAS;iBACjC;gBACD,MAAM,EAAE,MAAM;aACf,CAAC;QACJ,CAAC;QAED,0BAA0B;YACxB,OAAO;gBACL,WAAW,EAAE,aAAa;gBAC1B,kBAAkB,EAAE,yBAAyB;gBAC7C,IAAI,EAAE;oBACJ,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE;oBAClC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;iBAC/B;gBACD,WAAW,EAAE,EAAE;aAChB,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAaD;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAE3E,IAAI,gBAAgB,GAAkB,IAAI,CAAC;IAC3C,IAAI,YAAY,GAAkB,IAAI,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACvC,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,SAAS;QACpD,MAAM,KAAK,GAAG,MAAiC,CAAC;QAEhD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAK,CAAC,IAAgC,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhH,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3E,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC;QAC/B,CAAC;QAED,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,YAAY,GAAG,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,YAAY,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,wBAAwB,CAC/B,KAA8B,EAC9B,IAAyC;IAEzC,MAAM,SAAS,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,cAAc,GAAG,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,KAAK,OAAO,CAAC,CAAC;IAC3G,MAAM,aAAa,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC;IAClE,IAAI,CAAC,cAAc,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEnD,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,qBAAqB,CAAC;AACtH,CAAC;AAED,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,GAA4B;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC;IACzB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,GAAG,GAAI,MAAkC,CAAC,OAAO,CAAC;QACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IAClF,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IACzE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,MAAM,oBAAoB,GAAsB;IAC9C,SAAS;IACT,cAAc;IACd,eAAe;IACf,YAAY;IACZ,oBAAoB;CACrB,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAS,iBAAiB,CAAC,QAAuB,EAAE,KAAa;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1C,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;AACjG,CAAC"}