@provos/ironcurtain 0.11.0 → 0.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (472) hide show
  1. package/README.md +23 -19
  2. package/dist/cli-help.d.ts +12 -0
  3. package/dist/cli-help.js +21 -0
  4. package/dist/cli-help.js.map +1 -1
  5. package/dist/cli.js +14 -6
  6. package/dist/cli.js.map +1 -1
  7. package/dist/config/agent-model-guard.d.ts +14 -0
  8. package/dist/config/agent-model-guard.js +24 -0
  9. package/dist/config/agent-model-guard.js.map +1 -0
  10. package/dist/config/config-command.d.ts +33 -1
  11. package/dist/config/config-command.js +723 -11
  12. package/dist/config/config-command.js.map +1 -1
  13. package/dist/config/first-start.js +2 -8
  14. package/dist/config/first-start.js.map +1 -1
  15. package/dist/config/model-provider.d.ts +9 -0
  16. package/dist/config/model-provider.js +13 -0
  17. package/dist/config/model-provider.js.map +1 -1
  18. package/dist/config/openrouter-catalog.d.ts +46 -0
  19. package/dist/config/openrouter-catalog.js +111 -0
  20. package/dist/config/openrouter-catalog.js.map +1 -0
  21. package/dist/config/openrouter-models-fallback.d.ts +15 -0
  22. package/dist/config/openrouter-models-fallback.js +49 -0
  23. package/dist/config/openrouter-models-fallback.js.map +1 -0
  24. package/dist/config/paths.d.ts +48 -6
  25. package/dist/config/paths.js +63 -8
  26. package/dist/config/paths.js.map +1 -1
  27. package/dist/config/types.d.ts +8 -0
  28. package/dist/config/user-config.d.ts +179 -6
  29. package/dist/config/user-config.js +282 -5
  30. package/dist/config/user-config.js.map +1 -1
  31. package/dist/daemon/daemon-command.js +14 -5
  32. package/dist/daemon/daemon-command.js.map +1 -1
  33. package/dist/daemon/ironcurtain-daemon.d.ts +18 -0
  34. package/dist/daemon/ironcurtain-daemon.js +28 -1
  35. package/dist/daemon/ironcurtain-daemon.js.map +1 -1
  36. package/dist/daemon-client/daemon-client.d.ts +123 -0
  37. package/dist/daemon-client/daemon-client.js +324 -0
  38. package/dist/daemon-client/daemon-client.js.map +1 -0
  39. package/dist/docker/adapters/claude-code.js +109 -1
  40. package/dist/docker/adapters/claude-code.js.map +1 -1
  41. package/dist/docker/adapters/codex.d.ts +18 -0
  42. package/dist/docker/adapters/codex.js +376 -0
  43. package/dist/docker/adapters/codex.js.map +1 -0
  44. package/dist/docker/adapters/goose.js +38 -2
  45. package/dist/docker/adapters/goose.js.map +1 -1
  46. package/dist/docker/agent-adapter.d.ts +34 -6
  47. package/dist/docker/agent-adapter.js +2 -0
  48. package/dist/docker/agent-adapter.js.map +1 -1
  49. package/dist/docker/agent-registry.js +5 -0
  50. package/dist/docker/agent-registry.js.map +1 -1
  51. package/dist/docker/apple-container-manager.d.ts +49 -0
  52. package/dist/docker/apple-container-manager.js +486 -0
  53. package/dist/docker/apple-container-manager.js.map +1 -0
  54. package/dist/docker/ca.js +9 -2
  55. package/dist/docker/ca.js.map +1 -1
  56. package/dist/docker/code-mode-proxy.d.ts +11 -0
  57. package/dist/docker/code-mode-proxy.js +3 -1
  58. package/dist/docker/code-mode-proxy.js.map +1 -1
  59. package/dist/docker/container-lifecycle.d.ts +2 -2
  60. package/dist/docker/container-lifecycle.js +9 -0
  61. package/dist/docker/container-lifecycle.js.map +1 -1
  62. package/dist/docker/container-runtime.d.ts +29 -0
  63. package/dist/docker/container-runtime.js +76 -0
  64. package/dist/docker/container-runtime.js.map +1 -0
  65. package/dist/docker/docker-agent-session.d.ts +31 -0
  66. package/dist/docker/docker-agent-session.js +97 -7
  67. package/dist/docker/docker-agent-session.js.map +1 -1
  68. package/dist/docker/docker-infrastructure.d.ts +232 -15
  69. package/dist/docker/docker-infrastructure.js +762 -118
  70. package/dist/docker/docker-infrastructure.js.map +1 -1
  71. package/dist/docker/docker-manager.d.ts +25 -5
  72. package/dist/docker/docker-manager.js +388 -21
  73. package/dist/docker/docker-manager.js.map +1 -1
  74. package/dist/docker/docker-probe.d.ts +45 -0
  75. package/dist/docker/docker-probe.js +86 -0
  76. package/dist/docker/docker-probe.js.map +1 -0
  77. package/dist/docker/docker-progress-sink.d.ts +1 -1
  78. package/dist/docker/docker-resource-lifecycle.d.ts +71 -0
  79. package/dist/docker/docker-resource-lifecycle.js +454 -0
  80. package/dist/docker/docker-resource-lifecycle.js.map +1 -0
  81. package/dist/docker/gc-command.d.ts +2 -0
  82. package/dist/docker/gc-command.js +37 -0
  83. package/dist/docker/gc-command.js.map +1 -0
  84. package/dist/docker/mitm-proxy.d.ts +58 -5
  85. package/dist/docker/mitm-proxy.js +338 -26
  86. package/dist/docker/mitm-proxy.js.map +1 -1
  87. package/dist/docker/network-topology.d.ts +88 -0
  88. package/dist/docker/network-topology.js +167 -0
  89. package/dist/docker/network-topology.js.map +1 -0
  90. package/dist/docker/oauth-credentials.d.ts +13 -0
  91. package/dist/docker/oauth-credentials.js +125 -0
  92. package/dist/docker/oauth-credentials.js.map +1 -1
  93. package/dist/docker/openrouter.d.ts +107 -0
  94. package/dist/docker/openrouter.js +236 -0
  95. package/dist/docker/openrouter.js.map +1 -0
  96. package/dist/docker/orientation.js +1 -1
  97. package/dist/docker/orientation.js.map +1 -1
  98. package/dist/docker/package-types.d.ts +1 -1
  99. package/dist/docker/platform.d.ts +3 -1
  100. package/dist/docker/platform.js +3 -1
  101. package/dist/docker/platform.js.map +1 -1
  102. package/dist/docker/provider-config.d.ts +35 -1
  103. package/dist/docker/provider-config.js +93 -3
  104. package/dist/docker/provider-config.js.map +1 -1
  105. package/dist/docker/provision-lock.d.ts +46 -0
  106. package/dist/docker/provision-lock.js +152 -0
  107. package/dist/docker/provision-lock.js.map +1 -0
  108. package/dist/docker/pty-session.d.ts +22 -0
  109. package/dist/docker/pty-session.js +238 -84
  110. package/dist/docker/pty-session.js.map +1 -1
  111. package/dist/docker/pty-types.d.ts +15 -0
  112. package/dist/docker/pty-types.js +8 -0
  113. package/dist/docker/pty-types.js.map +1 -1
  114. package/dist/docker/registry-proxy.d.ts +46 -0
  115. package/dist/docker/registry-proxy.js +255 -1
  116. package/dist/docker/registry-proxy.js.map +1 -1
  117. package/dist/docker/resource-limits.d.ts +14 -5
  118. package/dist/docker/resource-limits.js +11 -8
  119. package/dist/docker/resource-limits.js.map +1 -1
  120. package/dist/docker/sse-extractor.js +55 -5
  121. package/dist/docker/sse-extractor.js.map +1 -1
  122. package/dist/docker/stream-delay.d.ts +86 -0
  123. package/dist/docker/stream-delay.js +218 -0
  124. package/dist/docker/stream-delay.js.map +1 -0
  125. package/dist/docker/token-stream-types.d.ts +15 -0
  126. package/dist/docker/trajectory-capture.d.ts +79 -0
  127. package/dist/docker/trajectory-capture.js +521 -0
  128. package/dist/docker/trajectory-capture.js.map +1 -0
  129. package/dist/docker/trajectory-reassembler.d.ts +286 -0
  130. package/dist/docker/trajectory-reassembler.js +1010 -0
  131. package/dist/docker/trajectory-reassembler.js.map +1 -0
  132. package/dist/docker/trajectory-tap.d.ts +100 -0
  133. package/dist/docker/trajectory-tap.js +410 -0
  134. package/dist/docker/trajectory-tap.js.map +1 -0
  135. package/dist/docker/trajectory-types.d.ts +187 -0
  136. package/dist/docker/trajectory-types.js +43 -0
  137. package/dist/docker/trajectory-types.js.map +1 -0
  138. package/dist/docker/types.d.ts +116 -12
  139. package/dist/doctor/checks.d.ts +39 -6
  140. package/dist/doctor/checks.js +129 -25
  141. package/dist/doctor/checks.js.map +1 -1
  142. package/dist/doctor/doctor-command.js +39 -9
  143. package/dist/doctor/doctor-command.js.map +1 -1
  144. package/dist/doctor/mcp-liveness.d.ts +1 -1
  145. package/dist/doctor/mcp-liveness.js +12 -4
  146. package/dist/doctor/mcp-liveness.js.map +1 -1
  147. package/dist/escalation/escalation-watcher.js +6 -0
  148. package/dist/escalation/escalation-watcher.js.map +1 -1
  149. package/dist/{mux → escalation}/trusted-input.d.ts +7 -4
  150. package/dist/{mux → escalation}/trusted-input.js +8 -5
  151. package/dist/escalation/trusted-input.js.map +1 -0
  152. package/dist/hash.js.map +1 -1
  153. package/dist/index.js +65 -16
  154. package/dist/index.js.map +1 -1
  155. package/dist/mux/mux-app.d.ts +9 -0
  156. package/dist/mux/mux-app.js +18 -16
  157. package/dist/mux/mux-app.js.map +1 -1
  158. package/dist/mux/mux-command.js +26 -8
  159. package/dist/mux/mux-command.js.map +1 -1
  160. package/dist/mux/mux-input-handler.d.ts +26 -2
  161. package/dist/mux/mux-input-handler.js +93 -11
  162. package/dist/mux/mux-input-handler.js.map +1 -1
  163. package/dist/mux/mux-renderer.d.ts +2 -1
  164. package/dist/mux/mux-renderer.js +67 -0
  165. package/dist/mux/mux-renderer.js.map +1 -1
  166. package/dist/mux/provider-profile-snapshot.d.ts +44 -0
  167. package/dist/mux/provider-profile-snapshot.js +56 -0
  168. package/dist/mux/provider-profile-snapshot.js.map +1 -0
  169. package/dist/mux/types.d.ts +3 -2
  170. package/dist/mux/types.js +6 -2
  171. package/dist/mux/types.js.map +1 -1
  172. package/dist/observe/observe-command.js +112 -125
  173. package/dist/observe/observe-command.js.map +1 -1
  174. package/dist/persona/broad-policy-validator.d.ts +95 -0
  175. package/dist/persona/broad-policy-validator.js +171 -0
  176. package/dist/persona/broad-policy-validator.js.map +1 -0
  177. package/dist/persona/compile-persona-policy.d.ts +54 -2
  178. package/dist/persona/compile-persona-policy.js +29 -4
  179. package/dist/persona/compile-persona-policy.js.map +1 -1
  180. package/dist/persona/event-bus-progress-reporter.d.ts +57 -0
  181. package/dist/persona/event-bus-progress-reporter.js +66 -0
  182. package/dist/persona/event-bus-progress-reporter.js.map +1 -0
  183. package/dist/persona/persona-command.js +46 -76
  184. package/dist/persona/persona-command.js.map +1 -1
  185. package/dist/persona/persona-compile-orchestrator.d.ts +101 -0
  186. package/dist/persona/persona-compile-orchestrator.js +504 -0
  187. package/dist/persona/persona-compile-orchestrator.js.map +1 -0
  188. package/dist/persona/persona-service.d.ts +137 -0
  189. package/dist/persona/persona-service.js +263 -0
  190. package/dist/persona/persona-service.js.map +1 -0
  191. package/dist/persona/policy-mutation-audit.d.ts +109 -0
  192. package/dist/persona/policy-mutation-audit.js +179 -0
  193. package/dist/persona/policy-mutation-audit.js.map +1 -0
  194. package/dist/persona/rule-delta.d.ts +30 -0
  195. package/dist/persona/rule-delta.js +82 -0
  196. package/dist/persona/rule-delta.js.map +1 -0
  197. package/dist/persona/types.d.ts +12 -0
  198. package/dist/pipeline/annotate.js +10 -2
  199. package/dist/pipeline/annotate.js.map +1 -1
  200. package/dist/pipeline/compile.js +14 -2
  201. package/dist/pipeline/compile.js.map +1 -1
  202. package/dist/pipeline/constitution-compiler.js.map +1 -1
  203. package/dist/pipeline/generate-with-repair.js.map +1 -1
  204. package/dist/pipeline/pipeline-runner.d.ts +63 -4
  205. package/dist/pipeline/pipeline-runner.js +159 -50
  206. package/dist/pipeline/pipeline-runner.js.map +1 -1
  207. package/dist/pipeline/pipeline-shared.d.ts +32 -3
  208. package/dist/pipeline/pipeline-shared.js +76 -8
  209. package/dist/pipeline/pipeline-shared.js.map +1 -1
  210. package/dist/pipeline/refresh-lists.js +3 -5
  211. package/dist/pipeline/refresh-lists.js.map +1 -1
  212. package/dist/pipeline/scenario-schema-validator.js.map +1 -1
  213. package/dist/{mux → pty}/pty-bridge.d.ts +41 -3
  214. package/dist/{mux → pty}/pty-bridge.js +71 -18
  215. package/dist/pty/pty-bridge.js.map +1 -0
  216. package/dist/pty/resolve-ironcurtain-bin.d.ts +17 -0
  217. package/dist/pty/resolve-ironcurtain-bin.js +22 -0
  218. package/dist/pty/resolve-ironcurtain-bin.js.map +1 -0
  219. package/dist/sandbox/index.d.ts +19 -4
  220. package/dist/sandbox/index.js +31 -18
  221. package/dist/sandbox/index.js.map +1 -1
  222. package/dist/servers/fetch-server.js +2 -0
  223. package/dist/servers/fetch-server.js.map +1 -1
  224. package/dist/session/index.d.ts +1 -1
  225. package/dist/session/index.js +20 -2
  226. package/dist/session/index.js.map +1 -1
  227. package/dist/session/preflight.d.ts +20 -35
  228. package/dist/session/preflight.js +92 -109
  229. package/dist/session/preflight.js.map +1 -1
  230. package/dist/session/resource-budget-tracker.js +8 -0
  231. package/dist/session/resource-budget-tracker.js.map +1 -1
  232. package/dist/session/session-manager.d.ts +7 -0
  233. package/dist/session/session-manager.js.map +1 -1
  234. package/dist/session/types.d.ts +23 -0
  235. package/dist/signal/bot-command.js +6 -1
  236. package/dist/signal/bot-command.js.map +1 -1
  237. package/dist/signal/setup-signal.js +1 -1
  238. package/dist/signal/setup-signal.js.map +1 -1
  239. package/dist/signal/signal-bot-daemon.d.ts +1 -0
  240. package/dist/signal/signal-bot-daemon.js +9 -2
  241. package/dist/signal/signal-bot-daemon.js.map +1 -1
  242. package/dist/signal/signal-container.d.ts +3 -3
  243. package/dist/signal/signal-container.js +2 -2
  244. package/dist/signal/signal-container.js.map +1 -1
  245. package/dist/trusted-process/call-circuit-breaker.d.ts +6 -0
  246. package/dist/trusted-process/call-circuit-breaker.js +22 -3
  247. package/dist/trusted-process/call-circuit-breaker.js.map +1 -1
  248. package/dist/trusted-process/container-command.d.ts +35 -0
  249. package/dist/trusted-process/container-command.js +49 -0
  250. package/dist/trusted-process/container-command.js.map +1 -0
  251. package/dist/trusted-process/mcp-error-utils.js +4 -1
  252. package/dist/trusted-process/mcp-error-utils.js.map +1 -1
  253. package/dist/trusted-process/mcp-proxy-server.js +37 -3
  254. package/dist/trusted-process/mcp-proxy-server.js.map +1 -1
  255. package/dist/trusted-process/policy-engine.js +13 -2
  256. package/dist/trusted-process/policy-engine.js.map +1 -1
  257. package/dist/trusted-process/tcp-server-transport.d.ts +19 -1
  258. package/dist/trusted-process/tcp-server-transport.js +56 -10
  259. package/dist/trusted-process/tcp-server-transport.js.map +1 -1
  260. package/dist/trusted-process/tool-call-coordinator.d.ts +22 -8
  261. package/dist/trusted-process/tool-call-coordinator.js +149 -65
  262. package/dist/trusted-process/tool-call-coordinator.js.map +1 -1
  263. package/dist/trusted-process/tool-call-pipeline.d.ts +8 -0
  264. package/dist/trusted-process/tool-call-pipeline.js +68 -34
  265. package/dist/trusted-process/tool-call-pipeline.js.map +1 -1
  266. package/dist/util/atomic-write.d.ts +31 -0
  267. package/dist/util/atomic-write.js +43 -0
  268. package/dist/util/atomic-write.js.map +1 -0
  269. package/dist/utils/preflight-checks.js +1 -3
  270. package/dist/utils/preflight-checks.js.map +1 -1
  271. package/dist/utils/stdio-guard.d.ts +1 -0
  272. package/dist/utils/stdio-guard.js +27 -0
  273. package/dist/utils/stdio-guard.js.map +1 -0
  274. package/dist/web-ui/__tests__/config-dispatch.test.d.ts +13 -0
  275. package/dist/web-ui/__tests__/config-dispatch.test.js +383 -0
  276. package/dist/web-ui/__tests__/config-dispatch.test.js.map +1 -0
  277. package/dist/web-ui/__tests__/json-rpc-dispatch.test.js +6 -0
  278. package/dist/web-ui/__tests__/json-rpc-dispatch.test.js.map +1 -1
  279. package/dist/web-ui/conn-registry.d.ts +14 -0
  280. package/dist/web-ui/conn-registry.js +25 -0
  281. package/dist/web-ui/conn-registry.js.map +1 -0
  282. package/dist/web-ui/dispatch/config-dispatch.d.ts +15 -0
  283. package/dist/web-ui/dispatch/config-dispatch.js +277 -0
  284. package/dist/web-ui/dispatch/config-dispatch.js.map +1 -0
  285. package/dist/web-ui/dispatch/escalation-dispatch.js +11 -2
  286. package/dist/web-ui/dispatch/escalation-dispatch.js.map +1 -1
  287. package/dist/web-ui/dispatch/persona-dispatch.d.ts +46 -2
  288. package/dist/web-ui/dispatch/persona-dispatch.js +209 -56
  289. package/dist/web-ui/dispatch/persona-dispatch.js.map +1 -1
  290. package/dist/web-ui/dispatch/pty-dispatch.d.ts +15 -0
  291. package/dist/web-ui/dispatch/pty-dispatch.js +66 -0
  292. package/dist/web-ui/dispatch/pty-dispatch.js.map +1 -0
  293. package/dist/web-ui/dispatch/session-dispatch.js +89 -6
  294. package/dist/web-ui/dispatch/session-dispatch.js.map +1 -1
  295. package/dist/web-ui/dispatch/types.d.ts +35 -0
  296. package/dist/web-ui/dispatch/types.js +42 -1
  297. package/dist/web-ui/dispatch/types.js.map +1 -1
  298. package/dist/web-ui/dispatch/workflow-dispatch.js +116 -5
  299. package/dist/web-ui/dispatch/workflow-dispatch.js.map +1 -1
  300. package/dist/web-ui/json-rpc-dispatch.js +4 -1
  301. package/dist/web-ui/json-rpc-dispatch.js.map +1 -1
  302. package/dist/web-ui/pty-session-manager.d.ts +234 -0
  303. package/dist/web-ui/pty-session-manager.js +599 -0
  304. package/dist/web-ui/pty-session-manager.js.map +1 -0
  305. package/dist/web-ui/web-event-bus.d.ts +34 -1
  306. package/dist/web-ui/web-event-bus.js.map +1 -1
  307. package/dist/web-ui/web-session-transport.js.map +1 -1
  308. package/dist/web-ui/web-ui-server.d.ts +22 -0
  309. package/dist/web-ui/web-ui-server.js +41 -0
  310. package/dist/web-ui/web-ui-server.js.map +1 -1
  311. package/dist/web-ui/web-ui-types.d.ts +212 -5
  312. package/dist/web-ui/web-ui-types.js.map +1 -1
  313. package/dist/web-ui-static/assets/index-CCVI4nEK.css +1 -0
  314. package/dist/web-ui-static/assets/index-Dm012gvY.js +114 -0
  315. package/dist/web-ui-static/index.html +2 -2
  316. package/dist/workflow/cli-shared.d.ts +62 -0
  317. package/dist/workflow/cli-shared.js +117 -0
  318. package/dist/workflow/cli-shared.js.map +1 -0
  319. package/dist/workflow/cli-support.js +0 -2
  320. package/dist/workflow/cli-support.js.map +1 -1
  321. package/dist/workflow/container-snapshots.d.ts +29 -0
  322. package/dist/workflow/container-snapshots.js +137 -0
  323. package/dist/workflow/container-snapshots.js.map +1 -0
  324. package/dist/workflow/daemon-gate-commands.d.ts +21 -0
  325. package/dist/workflow/daemon-gate-commands.js +595 -0
  326. package/dist/workflow/daemon-gate-commands.js.map +1 -0
  327. package/dist/workflow/discovery.d.ts +29 -0
  328. package/dist/workflow/discovery.js +67 -7
  329. package/dist/workflow/discovery.js.map +1 -1
  330. package/dist/workflow/lane-template.d.ts +89 -0
  331. package/dist/workflow/lane-template.js +141 -0
  332. package/dist/workflow/lane-template.js.map +1 -0
  333. package/dist/workflow/lint.d.ts +7 -1
  334. package/dist/workflow/lint.js +186 -3
  335. package/dist/workflow/lint.js.map +1 -1
  336. package/dist/workflow/machine-builder.d.ts +90 -2
  337. package/dist/workflow/machine-builder.js +222 -29
  338. package/dist/workflow/machine-builder.js.map +1 -1
  339. package/dist/workflow/message-log.d.ts +15 -1
  340. package/dist/workflow/message-log.js.map +1 -1
  341. package/dist/workflow/orchestrator.d.ts +505 -1
  342. package/dist/workflow/orchestrator.js +1725 -69
  343. package/dist/workflow/orchestrator.js.map +1 -1
  344. package/dist/workflow/prompt-builder.js +2 -1
  345. package/dist/workflow/prompt-builder.js.map +1 -1
  346. package/dist/workflow/run-state-command.js +1 -1
  347. package/dist/workflow/run-state-command.js.map +1 -1
  348. package/dist/workflow/shutdown-signals.d.ts +7 -0
  349. package/dist/workflow/shutdown-signals.js +40 -0
  350. package/dist/workflow/shutdown-signals.js.map +1 -0
  351. package/dist/workflow/status-parser.js +19 -4
  352. package/dist/workflow/status-parser.js.map +1 -1
  353. package/dist/workflow/types.d.ts +123 -23
  354. package/dist/workflow/types.js +2 -0
  355. package/dist/workflow/types.js.map +1 -1
  356. package/dist/workflow/validate.d.ts +23 -1
  357. package/dist/workflow/validate.js +311 -22
  358. package/dist/workflow/validate.js.map +1 -1
  359. package/dist/workflow/workflow-command.d.ts +0 -17
  360. package/dist/workflow/workflow-command.js +118 -94
  361. package/dist/workflow/workflow-command.js.map +1 -1
  362. package/dist/workflow/workflow-discovery.d.ts +2 -0
  363. package/dist/workflow/workflow-discovery.js +22 -1
  364. package/dist/workflow/workflow-discovery.js.map +1 -1
  365. package/dist/workflow/workflow-manager.d.ts +34 -0
  366. package/dist/workflow/workflow-manager.js +52 -1
  367. package/dist/workflow/workflow-manager.js.map +1 -1
  368. package/dist/workflow/workflows/design-and-code/README.md +50 -0
  369. package/dist/workflow/workflows/deterministic-eval-smoke/scripts/format_report.js +29 -0
  370. package/dist/workflow/workflows/deterministic-eval-smoke/scripts/package.json +5 -0
  371. package/dist/workflow/workflows/deterministic-eval-smoke/scripts/requirements.txt +1 -0
  372. package/dist/workflow/workflows/deterministic-eval-smoke/scripts/run_eval.py +41 -0
  373. package/dist/workflow/workflows/deterministic-eval-smoke/workflow.yaml +57 -0
  374. package/dist/workflow/workflows/deterministic-verdict-smoke/scripts/classify.py +18 -0
  375. package/dist/workflow/workflows/deterministic-verdict-smoke/workflow.yaml +51 -0
  376. package/dist/workflow/workflows/evolve/README.md +66 -0
  377. package/dist/workflow/workflows/evolve/scripts/LICENSE +201 -0
  378. package/dist/workflow/workflows/evolve/scripts/README.md +314 -0
  379. package/dist/workflow/workflows/evolve/scripts/evolve-brief +16 -0
  380. package/dist/workflow/workflows/evolve/scripts/evolve-cognition +16 -0
  381. package/dist/workflow/workflows/evolve/scripts/evolve-db +16 -0
  382. package/dist/workflow/workflows/evolve/scripts/evolve-eval +16 -0
  383. package/dist/workflow/workflows/evolve/scripts/evolve-files +16 -0
  384. package/dist/workflow/workflows/evolve/scripts/evolve-summary +16 -0
  385. package/dist/workflow/workflows/evolve/scripts/evolve_core/__init__.py +14 -0
  386. package/dist/workflow/workflows/evolve/scripts/evolve_core/algorithms/__init__.py +17 -0
  387. package/dist/workflow/workflows/evolve/scripts/evolve_core/algorithms/base.py +21 -0
  388. package/dist/workflow/workflows/evolve/scripts/evolve_core/algorithms/factory.py +90 -0
  389. package/dist/workflow/workflows/evolve/scripts/evolve_core/algorithms/greedy.py +17 -0
  390. package/dist/workflow/workflows/evolve/scripts/evolve_core/algorithms/island.py +316 -0
  391. package/dist/workflow/workflows/evolve/scripts/evolve_core/algorithms/random.py +18 -0
  392. package/dist/workflow/workflows/evolve/scripts/evolve_core/algorithms/ucb1.py +55 -0
  393. package/dist/workflow/workflows/evolve/scripts/evolve_core/best_snapshot.py +62 -0
  394. package/dist/workflow/workflows/evolve/scripts/evolve_core/cli.py +752 -0
  395. package/dist/workflow/workflows/evolve/scripts/evolve_core/cognition.py +127 -0
  396. package/dist/workflow/workflows/evolve/scripts/evolve_core/database.py +218 -0
  397. package/dist/workflow/workflows/evolve/scripts/evolve_core/diff.py +57 -0
  398. package/dist/workflow/workflows/evolve/scripts/evolve_core/embedding.py +84 -0
  399. package/dist/workflow/workflows/evolve/scripts/evolve_core/file_lock.py +45 -0
  400. package/dist/workflow/workflows/evolve/scripts/evolve_core/run_state.py +343 -0
  401. package/dist/workflow/workflows/evolve/scripts/evolve_core/sampling_config.py +173 -0
  402. package/dist/workflow/workflows/evolve/scripts/evolve_core/structures.py +93 -0
  403. package/dist/workflow/workflows/evolve/scripts/evolve_core/vector_index.py +191 -0
  404. package/dist/workflow/workflows/evolve/scripts/evolve_result.py +1503 -0
  405. package/dist/workflow/workflows/evolve/scripts/requirements.txt +2 -0
  406. package/dist/workflow/workflows/evolve/workflow.yaml +646 -0
  407. package/dist/workflow/workflows/test-email-summary/workflow.yaml +1 -0
  408. package/dist/workflow/workflows/vuln-discovery/README.md +54 -0
  409. package/dist/workflow/workflows/vuln-discovery/skills/harness-design-fuzzing/SKILL.md +6 -1
  410. package/dist/workflow/workflows/vuln-discovery/skills/memory-safety-c-cpp/SKILL.md +1 -0
  411. package/dist/workflow/workflows/vuln-discovery/skills/vulnerability-triage/SKILL.md +4 -0
  412. package/dist/workflow/workflows/vuln-discovery/workflow.yaml +13 -8
  413. package/docker/Dockerfile.base +22 -0
  414. package/docker/Dockerfile.base.arm64 +18 -0
  415. package/docker/Dockerfile.claude-code +3 -1
  416. package/docker/Dockerfile.codex +17 -0
  417. package/docker/Dockerfile.goose +3 -1
  418. package/docker/entrypoint-claude-code.sh +28 -45
  419. package/docker/entrypoint-codex.sh +42 -0
  420. package/docker/entrypoint-goose.sh +5 -24
  421. package/docker/entrypoint-uid-remap.sh +93 -0
  422. package/package.json +39 -30
  423. package/src/workflow/workflows/design-and-code/README.md +50 -0
  424. package/src/workflow/workflows/deterministic-eval-smoke/scripts/format_report.js +29 -0
  425. package/src/workflow/workflows/deterministic-eval-smoke/scripts/package.json +5 -0
  426. package/src/workflow/workflows/deterministic-eval-smoke/scripts/requirements.txt +1 -0
  427. package/src/workflow/workflows/deterministic-eval-smoke/scripts/run_eval.py +41 -0
  428. package/src/workflow/workflows/deterministic-eval-smoke/workflow.yaml +57 -0
  429. package/src/workflow/workflows/deterministic-verdict-smoke/scripts/classify.py +18 -0
  430. package/src/workflow/workflows/deterministic-verdict-smoke/workflow.yaml +51 -0
  431. package/src/workflow/workflows/evolve/README.md +66 -0
  432. package/src/workflow/workflows/evolve/scripts/LICENSE +201 -0
  433. package/src/workflow/workflows/evolve/scripts/README.md +314 -0
  434. package/src/workflow/workflows/evolve/scripts/evolve-brief +16 -0
  435. package/src/workflow/workflows/evolve/scripts/evolve-cognition +16 -0
  436. package/src/workflow/workflows/evolve/scripts/evolve-db +16 -0
  437. package/src/workflow/workflows/evolve/scripts/evolve-eval +16 -0
  438. package/src/workflow/workflows/evolve/scripts/evolve-files +16 -0
  439. package/src/workflow/workflows/evolve/scripts/evolve-summary +16 -0
  440. package/src/workflow/workflows/evolve/scripts/evolve_core/__init__.py +14 -0
  441. package/src/workflow/workflows/evolve/scripts/evolve_core/algorithms/__init__.py +17 -0
  442. package/src/workflow/workflows/evolve/scripts/evolve_core/algorithms/base.py +21 -0
  443. package/src/workflow/workflows/evolve/scripts/evolve_core/algorithms/factory.py +90 -0
  444. package/src/workflow/workflows/evolve/scripts/evolve_core/algorithms/greedy.py +17 -0
  445. package/src/workflow/workflows/evolve/scripts/evolve_core/algorithms/island.py +316 -0
  446. package/src/workflow/workflows/evolve/scripts/evolve_core/algorithms/random.py +18 -0
  447. package/src/workflow/workflows/evolve/scripts/evolve_core/algorithms/ucb1.py +55 -0
  448. package/src/workflow/workflows/evolve/scripts/evolve_core/best_snapshot.py +62 -0
  449. package/src/workflow/workflows/evolve/scripts/evolve_core/cli.py +752 -0
  450. package/src/workflow/workflows/evolve/scripts/evolve_core/cognition.py +127 -0
  451. package/src/workflow/workflows/evolve/scripts/evolve_core/database.py +218 -0
  452. package/src/workflow/workflows/evolve/scripts/evolve_core/diff.py +57 -0
  453. package/src/workflow/workflows/evolve/scripts/evolve_core/embedding.py +84 -0
  454. package/src/workflow/workflows/evolve/scripts/evolve_core/file_lock.py +45 -0
  455. package/src/workflow/workflows/evolve/scripts/evolve_core/run_state.py +343 -0
  456. package/src/workflow/workflows/evolve/scripts/evolve_core/sampling_config.py +173 -0
  457. package/src/workflow/workflows/evolve/scripts/evolve_core/structures.py +93 -0
  458. package/src/workflow/workflows/evolve/scripts/evolve_core/vector_index.py +191 -0
  459. package/src/workflow/workflows/evolve/scripts/evolve_result.py +1503 -0
  460. package/src/workflow/workflows/evolve/scripts/requirements.txt +2 -0
  461. package/src/workflow/workflows/evolve/workflow.yaml +646 -0
  462. package/src/workflow/workflows/test-email-summary/workflow.yaml +1 -0
  463. package/src/workflow/workflows/vuln-discovery/README.md +54 -0
  464. package/src/workflow/workflows/vuln-discovery/skills/harness-design-fuzzing/SKILL.md +6 -1
  465. package/src/workflow/workflows/vuln-discovery/skills/memory-safety-c-cpp/SKILL.md +1 -0
  466. package/src/workflow/workflows/vuln-discovery/skills/vulnerability-triage/SKILL.md +4 -0
  467. package/src/workflow/workflows/vuln-discovery/workflow.yaml +13 -8
  468. package/dist/mux/pty-bridge.js.map +0 -1
  469. package/dist/mux/trusted-input.js.map +0 -1
  470. package/dist/web-ui-static/assets/index-BFO5z1js.js +0 -76
  471. package/dist/web-ui-static/assets/index-CCUwrkIL.css +0 -1
  472. package/packages/web-ui/README.md +0 -113
@@ -0,0 +1,101 @@
1
+ /**
2
+ * src/persona/persona-compile-orchestrator.ts
3
+ *
4
+ * The long-running persona-compile orchestrator (Phase 1b, §4.3).
5
+ *
6
+ * Owns:
7
+ * - the per-persona in-memory `active` Map (live snapshot, fast UX path) and a
8
+ * bounded `recent` LRU (~50) of TERMINAL records keyed by operationId;
9
+ * - a daemon-wide concurrency gate `globalLimit = pLimit(2)` + a queue cap;
10
+ * - an O_EXCL filesystem lock per persona generated dir (cross-process
11
+ * serialization of same-persona compiles) with stale-lock reclaim;
12
+ * - credential preflight (derive the env var from the policy + prefilter model
13
+ * ids and verify it is present);
14
+ * - a wall-clock cap that fires the abort signal;
15
+ * - daemon-startup stale-lock recovery (synthetic failed events).
16
+ *
17
+ * This module is the ONLY runtime invocation site of `compilePersonaPolicy`,
18
+ * reached EXCLUSIVELY via `await import('./compile-persona-policy.js')`. It
19
+ * carries ONLY type-only pipeline imports; the value edge stays behind the
20
+ * dynamic import + the sanctioned seam. Enforced by the Phase-0 ESLint
21
+ * no-restricted-imports rule + test/pipeline-import-boundary.test.ts.
22
+ *
23
+ * @see docs/designs/web-ui-policy-persona-management.md §4.3, §6
24
+ */
25
+ import { type PersonaName } from './types.js';
26
+ import type { ErrorCode, PersonaCompileOperationDto } from '../web-ui/web-ui-types.js';
27
+ import type { WebEventBus } from '../web-ui/web-event-bus.js';
28
+ import type { CompilePersonaOptions } from './compile-persona-policy.js';
29
+ import type { CompiledPolicyFile } from '../pipeline/types.js';
30
+ /**
31
+ * An error carrying a typed {@link ErrorCode} so the dispatch layer can map it
32
+ * to a `ResponseFrame` error without importing this module's internals. Mirrors
33
+ * the `RpcError` shape but lives here so the orchestrator does not depend on the
34
+ * web-ui dispatch error class.
35
+ */
36
+ export declare class CompileOrchestratorError extends Error {
37
+ readonly code: ErrorCode;
38
+ readonly data?: unknown | undefined;
39
+ constructor(code: ErrorCode, message: string, data?: unknown | undefined);
40
+ }
41
+ /** Test-injectable dependency seam. */
42
+ export interface OrchestratorDeps {
43
+ /** Concrete compile implementation; defaults to the dynamic-import seam. */
44
+ readonly compileImpl?: (name: PersonaName, opts: CompilePersonaOptions) => Promise<CompiledPolicyFile>;
45
+ /** Override the wall-clock cap (ms). */
46
+ readonly wallClockCapMs?: number;
47
+ /** Override the queue cap. */
48
+ readonly queueCap?: number;
49
+ }
50
+ /**
51
+ * Encapsulates all orchestrator state. A module-level singleton is exported for
52
+ * the daemon, but tests instantiate their own to avoid cross-test bleed.
53
+ */
54
+ export declare class PersonaCompileOrchestrator {
55
+ private readonly active;
56
+ private readonly recent;
57
+ private readonly globalLimit;
58
+ /** Operations enqueued behind the global gate but not yet running. */
59
+ private queueDepth;
60
+ private readonly deps;
61
+ private readonly wallClockCapMs;
62
+ private readonly queueCap;
63
+ constructor(deps?: OrchestratorDeps);
64
+ /** Returns the live snapshot for an operation (active first, then recent). */
65
+ getCompile(operationId: string): PersonaCompileOperationDto | undefined;
66
+ /** Returns active + recent operations and the current queue depth. */
67
+ listCompiles(): {
68
+ active: PersonaCompileOperationDto[];
69
+ recent: PersonaCompileOperationDto[];
70
+ queueDepth: number;
71
+ };
72
+ /**
73
+ * Starts a streamed compile. Synchronously validates / acquires the lock /
74
+ * mints the operationId / emits `persona.compile.started`, then detaches the
75
+ * actual compile inside the global concurrency gate. Returns the ack.
76
+ *
77
+ * @throws {CompileOrchestratorError} with a typed code on a synchronous
78
+ * rejection (in-progress, queue-full, credentials-missing).
79
+ */
80
+ startCompile(name: PersonaName, actor: string, eventBus: WebEventBus): {
81
+ accepted: true;
82
+ name: PersonaName;
83
+ operationId: string;
84
+ queued?: boolean;
85
+ };
86
+ private runCompile;
87
+ /**
88
+ * Scans persona dirs for `.compile.lock` files. A stale lock (dead pid or
89
+ * past the wall-clock cap) is released and a synthetic `persona.compile.failed`
90
+ * event is emitted (operationId from the lock) so a reconnecting UI clears the
91
+ * stuck card. Live (pid-alive, within-cap) locks are left in place.
92
+ */
93
+ recoverStaleLocks(eventBus: WebEventBus): void;
94
+ private acquireLockOrThrow;
95
+ private releaseLock;
96
+ private isLockStale;
97
+ private credentialPreflight;
98
+ private pushRecent;
99
+ }
100
+ /** The daemon-wide orchestrator singleton. Tests construct their own instance. */
101
+ export declare const personaCompileOrchestrator: PersonaCompileOrchestrator;
@@ -0,0 +1,504 @@
1
+ /**
2
+ * src/persona/persona-compile-orchestrator.ts
3
+ *
4
+ * The long-running persona-compile orchestrator (Phase 1b, §4.3).
5
+ *
6
+ * Owns:
7
+ * - the per-persona in-memory `active` Map (live snapshot, fast UX path) and a
8
+ * bounded `recent` LRU (~50) of TERMINAL records keyed by operationId;
9
+ * - a daemon-wide concurrency gate `globalLimit = pLimit(2)` + a queue cap;
10
+ * - an O_EXCL filesystem lock per persona generated dir (cross-process
11
+ * serialization of same-persona compiles) with stale-lock reclaim;
12
+ * - credential preflight (derive the env var from the policy + prefilter model
13
+ * ids and verify it is present);
14
+ * - a wall-clock cap that fires the abort signal;
15
+ * - daemon-startup stale-lock recovery (synthetic failed events).
16
+ *
17
+ * This module is the ONLY runtime invocation site of `compilePersonaPolicy`,
18
+ * reached EXCLUSIVELY via `await import('./compile-persona-policy.js')`. It
19
+ * carries ONLY type-only pipeline imports; the value edge stays behind the
20
+ * dynamic import + the sanctioned seam. Enforced by the Phase-0 ESLint
21
+ * no-restricted-imports rule + test/pipeline-import-boundary.test.ts.
22
+ *
23
+ * @see docs/designs/web-ui-policy-persona-management.md §4.3, §6
24
+ */
25
+ import { randomUUID } from 'node:crypto';
26
+ import { openSync, closeSync, writeSync, readFileSync, unlinkSync, existsSync, readdirSync } from 'node:fs';
27
+ import { resolve } from 'node:path';
28
+ import pLimit from 'p-limit';
29
+ import { getPersonaGeneratedDir, getPersonaWorkspaceDir, getPersonasDir, loadPersona } from './resolve.js';
30
+ import { createPersonaName } from './types.js';
31
+ import { EventBusProgressReporter } from './event-bus-progress-reporter.js';
32
+ import { makeBroadPolicyValidator, BroadPolicyRejectedError } from './broad-policy-validator.js';
33
+ import { computeRuleDelta } from './rule-delta.js';
34
+ import { policyMutationAuditLog } from './policy-mutation-audit.js';
35
+ // NOTE: EventBusProgressReporter carries ONLY type-only pipeline imports, so a
36
+ // static VALUE import of it does not violate the import boundary (the boundary
37
+ // forbids reaching pipeline-runner.ts / pipeline-shared.ts VALUES).
38
+ import { loadUserConfig } from '../config/user-config.js';
39
+ import { parseModelId, PROVIDER_ENV_VARS, resolveApiKeyForProvider } from '../config/model-provider.js';
40
+ // ---------------------------------------------------------------------------
41
+ // Tunables
42
+ // ---------------------------------------------------------------------------
43
+ /** Daemon-wide compile concurrency. */
44
+ const GLOBAL_CONCURRENCY = 2;
45
+ /** Queue cap (number of operations waiting behind the global gate). */
46
+ const QUEUE_CAP = 10;
47
+ /** Bounded LRU size for terminal records. */
48
+ const RECENT_CAP = 50;
49
+ /** Wall-clock cap (ms) before the compile is aborted. */
50
+ const WALL_CLOCK_CAP_MS = 20 * 60 * 1000;
51
+ const LOCK_FILE = '.compile.lock';
52
+ /**
53
+ * An error carrying a typed {@link ErrorCode} so the dispatch layer can map it
54
+ * to a `ResponseFrame` error without importing this module's internals. Mirrors
55
+ * the `RpcError` shape but lives here so the orchestrator does not depend on the
56
+ * web-ui dispatch error class.
57
+ */
58
+ export class CompileOrchestratorError extends Error {
59
+ code;
60
+ data;
61
+ constructor(code, message, data) {
62
+ super(message);
63
+ this.code = code;
64
+ this.data = data;
65
+ this.name = 'CompileOrchestratorError';
66
+ }
67
+ }
68
+ /**
69
+ * Encapsulates all orchestrator state. A module-level singleton is exported for
70
+ * the daemon, but tests instantiate their own to avoid cross-test bleed.
71
+ */
72
+ export class PersonaCompileOrchestrator {
73
+ active = new Map();
74
+ recent = new Map();
75
+ globalLimit = pLimit(GLOBAL_CONCURRENCY);
76
+ /** Operations enqueued behind the global gate but not yet running. */
77
+ queueDepth = 0;
78
+ deps;
79
+ wallClockCapMs;
80
+ queueCap;
81
+ constructor(deps = {}) {
82
+ this.deps = deps;
83
+ this.wallClockCapMs = deps.wallClockCapMs ?? WALL_CLOCK_CAP_MS;
84
+ this.queueCap = deps.queueCap ?? QUEUE_CAP;
85
+ }
86
+ // -------------------------------------------------------------------------
87
+ // Read APIs (ungated)
88
+ // -------------------------------------------------------------------------
89
+ /** Returns the live snapshot for an operation (active first, then recent). */
90
+ getCompile(operationId) {
91
+ for (const rec of this.active.values()) {
92
+ if (rec.operationId === operationId)
93
+ return toDto(rec);
94
+ }
95
+ const terminal = this.recent.get(operationId);
96
+ return terminal ? toDto(terminal) : undefined;
97
+ }
98
+ /** Returns active + recent operations and the current queue depth. */
99
+ listCompiles() {
100
+ return {
101
+ active: [...this.active.values()].map(toDto),
102
+ recent: [...this.recent.values()].map(toDto),
103
+ queueDepth: this.queueDepth,
104
+ };
105
+ }
106
+ // -------------------------------------------------------------------------
107
+ // Start
108
+ // -------------------------------------------------------------------------
109
+ /**
110
+ * Starts a streamed compile. Synchronously validates / acquires the lock /
111
+ * mints the operationId / emits `persona.compile.started`, then detaches the
112
+ * actual compile inside the global concurrency gate. Returns the ack.
113
+ *
114
+ * @throws {CompileOrchestratorError} with a typed code on a synchronous
115
+ * rejection (in-progress, queue-full, credentials-missing).
116
+ */
117
+ startCompile(name, actor, eventBus) {
118
+ // 1) Same-persona dedup via the live `active` Map (fast path). The op is
119
+ // only here while genuinely active; the active->recent transition is a
120
+ // single synchronous critical section so a just-settled op is not here.
121
+ const live = this.active.get(name);
122
+ if (live) {
123
+ throw new CompileOrchestratorError('COMPILE_IN_PROGRESS', `A compile for persona "${name}" is already running.`, {
124
+ operationId: live.operationId,
125
+ });
126
+ }
127
+ // 2) O_EXCL FS lock (cross-process correctness). Stale locks are reclaimed.
128
+ const operationId = randomUUID();
129
+ const startedAt = new Date().toISOString();
130
+ this.acquireLockOrThrow(name, operationId, startedAt);
131
+ // 3) Credential preflight (both models). Runs AFTER the dispatch gate, so a
132
+ // read-only client never reaches here. On miss, release the lock.
133
+ try {
134
+ this.credentialPreflight();
135
+ }
136
+ catch (err) {
137
+ this.releaseLock(name);
138
+ throw err;
139
+ }
140
+ // 4) Queue cap: if the global gate is saturated and the queue would exceed
141
+ // the cap, reject. Otherwise enqueue.
142
+ const willQueue = this.globalLimit.activeCount >= GLOBAL_CONCURRENCY;
143
+ if (willQueue && this.queueDepth >= this.queueCap) {
144
+ this.releaseLock(name);
145
+ throw new CompileOrchestratorError('COMPILE_QUEUE_FULL', 'Too many persona compiles are queued.');
146
+ }
147
+ // 5) Insert active record, emit started.
148
+ const record = {
149
+ operationId,
150
+ name,
151
+ phase: 'started',
152
+ startedAt,
153
+ actor,
154
+ };
155
+ this.active.set(name, record);
156
+ eventBus.emit('persona.compile.started', { name, operationId, actor });
157
+ // 6) Detach the compile inside the global gate. Track queue depth around the
158
+ // gate so listCompiles reports waiting operations.
159
+ if (willQueue) {
160
+ this.queueDepth += 1;
161
+ record.queuePosition = this.queueDepth;
162
+ }
163
+ void this.globalLimit(async () => {
164
+ if (willQueue)
165
+ this.queueDepth = Math.max(0, this.queueDepth - 1);
166
+ record.queuePosition = undefined;
167
+ await this.runCompile(record, eventBus);
168
+ });
169
+ return { accepted: true, name, operationId, ...(willQueue ? { queued: true } : {}) };
170
+ }
171
+ // -------------------------------------------------------------------------
172
+ // Detached compile body
173
+ // -------------------------------------------------------------------------
174
+ async runCompile(record, eventBus) {
175
+ const { name, operationId } = record;
176
+ const abort = new AbortController();
177
+ const timer = setTimeout(() => abort.abort(new Error('wall-clock cap exceeded')), this.wallClockCapMs);
178
+ // Don't keep the process alive solely for the cap timer.
179
+ if (typeof timer.unref === 'function')
180
+ timer.unref();
181
+ record.phase = 'running';
182
+ try {
183
+ // Persona-bound inputs for the broad-policy validator + ruleDelta. The
184
+ // workspace dir is the containment authority for path checks; the opt-in
185
+ // flag is read from persona.json (NEVER inferred from the constitution).
186
+ const workspaceDir = getPersonaWorkspaceDir(name);
187
+ let allowBroadPolicy = false;
188
+ try {
189
+ allowBroadPolicy = loadPersona(name).allowBroadPolicy ?? false;
190
+ }
191
+ catch {
192
+ // Persona missing/unreadable — leave allowBroadPolicy false (most
193
+ // restrictive). The compile itself will fail downstream with a clearer
194
+ // error if the persona truly does not exist.
195
+ }
196
+ const validateCompiled = makeBroadPolicyValidator(workspaceDir, allowBroadPolicy);
197
+ const previousPolicy = readPreviousCompiledPolicy(name);
198
+ const compileImpl = this.deps.compileImpl ?? defaultCompileImpl;
199
+ const reporterFactory = (serverName) => {
200
+ const ctx = {
201
+ operationId,
202
+ personaName: name,
203
+ serverName,
204
+ emit: (p) => eventBus.emit('persona.compile.progress', p),
205
+ snapshotUpdate: (snapshot) => {
206
+ record.serverProgress = {
207
+ server: snapshot.serverName,
208
+ compilationPhase: snapshot.compilationPhase,
209
+ ...(snapshot.detail ? { detail: snapshot.detail } : {}),
210
+ };
211
+ },
212
+ };
213
+ return new EventBusProgressReporter(ctx);
214
+ };
215
+ const policy = await compileImpl(name, {
216
+ reporterFactory,
217
+ signal: abort.signal,
218
+ quiet: true,
219
+ operationId,
220
+ allowMcpLists: false,
221
+ validateCompiled,
222
+ });
223
+ // ruleDelta is omitted on the first compile (no previous policy to diff).
224
+ const ruleDelta = previousPolicy ? computeRuleDelta(previousPolicy, policy, workspaceDir) : undefined;
225
+ record.result = {
226
+ success: true,
227
+ ruleCount: policy.rules.length,
228
+ ...(ruleDelta ? { ruleDelta } : {}),
229
+ };
230
+ // Audit the successful compile at the service layer (covers WS/CLI/cron).
231
+ policyMutationAuditLog.append(record.actor, 'compilePersonaPolicy', name, {
232
+ constitutionHash: policy.constitutionHash,
233
+ ruleCountDelta: policy.rules.length - (previousPolicy?.rules.length ?? 0),
234
+ broadened: !!ruleDelta && (ruleDelta.broadenedDomains.length > 0 || ruleDelta.outOfWorkspacePaths.length > 0),
235
+ operationId,
236
+ });
237
+ }
238
+ catch (err) {
239
+ record.error = classifyError(err);
240
+ }
241
+ finally {
242
+ clearTimeout(timer);
243
+ // ONE synchronous critical section: move active->recent, release lock.
244
+ // No `await` between these ops so getCompile/listCompiles always find the
245
+ // op in exactly one place.
246
+ record.endedAt = new Date().toISOString();
247
+ record.phase = record.error ? 'failed' : 'done';
248
+ this.active.delete(name);
249
+ this.releaseLock(name);
250
+ this.pushRecent(record);
251
+ if (record.error) {
252
+ eventBus.emit('persona.compile.failed', {
253
+ name,
254
+ operationId,
255
+ code: record.error.code,
256
+ error: record.error.message,
257
+ });
258
+ }
259
+ else if (record.result) {
260
+ eventBus.emit('persona.compile.done', { name, operationId, result: record.result });
261
+ }
262
+ }
263
+ }
264
+ // -------------------------------------------------------------------------
265
+ // Startup recovery
266
+ // -------------------------------------------------------------------------
267
+ /**
268
+ * Scans persona dirs for `.compile.lock` files. A stale lock (dead pid or
269
+ * past the wall-clock cap) is released and a synthetic `persona.compile.failed`
270
+ * event is emitted (operationId from the lock) so a reconnecting UI clears the
271
+ * stuck card. Live (pid-alive, within-cap) locks are left in place.
272
+ */
273
+ recoverStaleLocks(eventBus) {
274
+ const personasDir = getPersonasDir();
275
+ if (!existsSync(personasDir))
276
+ return;
277
+ let entries;
278
+ try {
279
+ entries = readdirSync(personasDir);
280
+ }
281
+ catch {
282
+ return;
283
+ }
284
+ for (const entry of entries) {
285
+ let name;
286
+ try {
287
+ name = createPersonaName(entry);
288
+ }
289
+ catch {
290
+ continue; // tmp dirs / trash / invalid slugs
291
+ }
292
+ const lockPath = resolve(getPersonaGeneratedDir(name), LOCK_FILE);
293
+ if (!existsSync(lockPath))
294
+ continue;
295
+ const content = readLockFile(lockPath);
296
+ if (!content) {
297
+ // Unparseable lock — treat as stale and remove.
298
+ safeUnlink(lockPath);
299
+ continue;
300
+ }
301
+ if (this.isLockStale(content)) {
302
+ safeUnlink(lockPath);
303
+ eventBus.emit('persona.compile.failed', {
304
+ name,
305
+ operationId: content.operationId,
306
+ code: 'INTERNAL_ERROR',
307
+ error: 'Compile interrupted by daemon restart.',
308
+ });
309
+ }
310
+ }
311
+ }
312
+ // -------------------------------------------------------------------------
313
+ // FS lock
314
+ // -------------------------------------------------------------------------
315
+ acquireLockOrThrow(name, operationId, startedAt) {
316
+ const lockPath = resolve(getPersonaGeneratedDir(name), LOCK_FILE);
317
+ const payload = { operationId, startedAt, pid: process.pid };
318
+ try {
319
+ writeLockExclusive(lockPath, payload);
320
+ return;
321
+ }
322
+ catch (err) {
323
+ if (err.code !== 'EEXIST')
324
+ throw err;
325
+ }
326
+ // Lock exists — reclaim if stale, else COMPILE_IN_PROGRESS.
327
+ const existing = readLockFile(lockPath);
328
+ if (existing && !this.isLockStale(existing)) {
329
+ throw new CompileOrchestratorError('COMPILE_IN_PROGRESS', `A compile for persona "${name}" is already running.`, {
330
+ operationId: existing.operationId,
331
+ });
332
+ }
333
+ // Stale (or unparseable) — remove and retry once.
334
+ safeUnlink(lockPath);
335
+ writeLockExclusive(lockPath, payload);
336
+ }
337
+ releaseLock(name) {
338
+ safeUnlink(resolve(getPersonaGeneratedDir(name), LOCK_FILE));
339
+ }
340
+ isLockStale(content) {
341
+ // Dead pid => stale.
342
+ if (!isPidAlive(content.pid))
343
+ return true;
344
+ // Past the wall-clock cap => stale.
345
+ const started = Date.parse(content.startedAt);
346
+ if (Number.isNaN(started))
347
+ return true;
348
+ return Date.now() - started > this.wallClockCapMs;
349
+ }
350
+ // -------------------------------------------------------------------------
351
+ // Credential preflight
352
+ // -------------------------------------------------------------------------
353
+ credentialPreflight() {
354
+ const config = loadUserConfig({ readOnly: true });
355
+ const missing = new Set();
356
+ for (const modelId of [config.policyModelId, config.prefilterModelId]) {
357
+ const { provider } = parseModelId(modelId);
358
+ const key = resolveApiKeyForProvider(provider, config);
359
+ if (!key)
360
+ missing.add(PROVIDER_ENV_VARS[provider]);
361
+ }
362
+ if (missing.size > 0) {
363
+ throw new CompileOrchestratorError('CREDENTIALS_MISSING', `Missing credential(s) on the daemon host: ${[...missing].join(', ')}.`);
364
+ }
365
+ }
366
+ // -------------------------------------------------------------------------
367
+ // Recent LRU
368
+ // -------------------------------------------------------------------------
369
+ pushRecent(record) {
370
+ // Map preserves insertion order; delete-then-set moves to MRU.
371
+ this.recent.delete(record.operationId);
372
+ this.recent.set(record.operationId, record);
373
+ while (this.recent.size > RECENT_CAP) {
374
+ const oldest = this.recent.keys().next().value;
375
+ if (oldest === undefined)
376
+ break;
377
+ this.recent.delete(oldest);
378
+ }
379
+ }
380
+ }
381
+ // ---------------------------------------------------------------------------
382
+ // Module helpers
383
+ // ---------------------------------------------------------------------------
384
+ /**
385
+ * The default compile implementation: the dynamic-import seam to the sanctioned
386
+ * pipeline-value module. Keeping it a free function (not a static import at the
387
+ * top of the file) is what keeps the import-boundary green.
388
+ */
389
+ async function defaultCompileImpl(name, opts) {
390
+ const { compilePersonaPolicy } = await import('./compile-persona-policy.js');
391
+ return compilePersonaPolicy(name, opts);
392
+ }
393
+ function toDto(rec) {
394
+ return {
395
+ operationId: rec.operationId,
396
+ name: rec.name,
397
+ phase: rec.phase,
398
+ ...(rec.serverProgress ? { serverProgress: rec.serverProgress } : {}),
399
+ ...(rec.queuePosition !== undefined ? { queuePosition: rec.queuePosition } : {}),
400
+ startedAt: rec.startedAt,
401
+ ...(rec.endedAt ? { endedAt: rec.endedAt } : {}),
402
+ ...(rec.result ? { result: rec.result } : {}),
403
+ ...(rec.error ? { error: rec.error } : {}),
404
+ actor: rec.actor,
405
+ };
406
+ }
407
+ /**
408
+ * Classifies a thrown compile error into a typed `{ code, message }`. Credential
409
+ * / MCP-list / broad-policy / orchestrator errors carry their codes; everything
410
+ * else maps to INTERNAL_ERROR with an operator-safe message.
411
+ */
412
+ /**
413
+ * Reads the persona's previous `compiled-policy.json` for ruleDelta computation.
414
+ * Returns undefined when absent/unparseable (the first compile, or a corrupted
415
+ * prior artifact) so the caller omits the delta.
416
+ */
417
+ function readPreviousCompiledPolicy(name) {
418
+ const path = resolve(getPersonaGeneratedDir(name), 'compiled-policy.json');
419
+ if (!existsSync(path))
420
+ return undefined;
421
+ try {
422
+ return JSON.parse(readFileSync(path, 'utf-8'));
423
+ }
424
+ catch {
425
+ return undefined;
426
+ }
427
+ }
428
+ function classifyError(err) {
429
+ if (err instanceof CompileOrchestratorError) {
430
+ return { code: err.code, message: err.message };
431
+ }
432
+ // Broad-policy validator rejection (constitution-injection defense). Surfaced
433
+ // terminally as BROAD_POLICY_REJECTED on the failed event.
434
+ if (err instanceof BroadPolicyRejectedError) {
435
+ return { code: err.code, message: err.message };
436
+ }
437
+ // Discriminant string from the pipeline (McpListsDisallowedError) — detected
438
+ // without importing the thrower's module (layering rule).
439
+ const code = typeof err === 'object' && err !== null ? err.code : undefined;
440
+ if (code === 'MCP_LISTS_DISALLOWED') {
441
+ return { code: 'LIST_REQUIRES_MCP', message: 'A dynamic list requires live MCP access, which is disabled.' };
442
+ }
443
+ const message = err instanceof Error ? err.message : String(err);
444
+ // AI SDK missing-key surfaces as a LoadAPIKeyError; map to CREDENTIALS_MISSING.
445
+ if (err instanceof Error && (err.name === 'LoadAPIKeyError' || /api key/i.test(message))) {
446
+ return { code: 'CREDENTIALS_MISSING', message: 'Missing model credentials on the daemon host.' };
447
+ }
448
+ return { code: 'INTERNAL_ERROR', message: 'Persona compilation failed.' };
449
+ }
450
+ /** Writes the lock file with O_EXCL (`wx`): fails with EEXIST if it exists. */
451
+ function writeLockExclusive(lockPath, payload) {
452
+ // 'wx' => O_CREAT | O_EXCL | O_WRONLY. The generated dir already exists for
453
+ // any compiled persona; if not, createPersona made it.
454
+ const fd = openSync(lockPath, 'wx');
455
+ try {
456
+ writeSync(fd, JSON.stringify(payload));
457
+ }
458
+ finally {
459
+ closeSync(fd);
460
+ }
461
+ }
462
+ function readLockFile(lockPath) {
463
+ try {
464
+ const raw = readFileSync(lockPath, 'utf-8');
465
+ const parsed = JSON.parse(raw);
466
+ if (typeof parsed.operationId === 'string' &&
467
+ typeof parsed.pid === 'number' &&
468
+ typeof parsed.startedAt === 'string') {
469
+ return { operationId: parsed.operationId, pid: parsed.pid, startedAt: parsed.startedAt };
470
+ }
471
+ return null;
472
+ }
473
+ catch {
474
+ return null;
475
+ }
476
+ }
477
+ function safeUnlink(path) {
478
+ try {
479
+ unlinkSync(path);
480
+ }
481
+ catch (err) {
482
+ if (err.code !== 'ENOENT')
483
+ throw err;
484
+ }
485
+ }
486
+ /** True iff a process with `pid` exists (signal 0 probe). */
487
+ function isPidAlive(pid) {
488
+ if (!Number.isInteger(pid) || pid <= 0)
489
+ return false;
490
+ try {
491
+ process.kill(pid, 0);
492
+ return true;
493
+ }
494
+ catch (err) {
495
+ // ESRCH => no such process. EPERM => exists but not ours (still alive).
496
+ return err.code === 'EPERM';
497
+ }
498
+ }
499
+ // ---------------------------------------------------------------------------
500
+ // Daemon singleton
501
+ // ---------------------------------------------------------------------------
502
+ /** The daemon-wide orchestrator singleton. Tests construct their own instance. */
503
+ export const personaCompileOrchestrator = new PersonaCompileOrchestrator();
504
+ //# sourceMappingURL=persona-compile-orchestrator.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"persona-compile-orchestrator.js","sourceRoot":"","sources":["../../src/persona/persona-compile-orchestrator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC5G,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3G,OAAO,EAAE,iBAAiB,EAAoB,MAAM,YAAY,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAE5E,OAAO,EAAE,wBAAwB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,+EAA+E;AAC/E,+EAA+E;AAC/E,oEAAoE;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AASxG,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,uCAAuC;AACvC,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,uEAAuE;AACvE,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,6CAA6C;AAC7C,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,yDAAyD;AACzD,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,MAAM,SAAS,GAAG,eAAe,CAAC;AASlC;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IAEtC;IAEA;IAHX,YACW,IAAe,EACxB,OAAe,EACN,IAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,SAAI,GAAJ,IAAI,CAAW;QAEf,SAAI,GAAJ,IAAI,CAAU;QAGvB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AA6BD;;;GAGG;AACH,MAAM,OAAO,0BAA0B;IACpB,MAAM,GAAG,IAAI,GAAG,EAAgC,CAAC;IACjD,MAAM,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC5C,WAAW,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC1D,sEAAsE;IAC9D,UAAU,GAAG,CAAC,CAAC;IACN,IAAI,CAAmB;IACvB,cAAc,CAAS;IACvB,QAAQ,CAAS;IAElC,YAAY,OAAyB,EAAE;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,iBAAiB,CAAC;QAC/D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,SAAS,CAAC;IAC7C,CAAC;IAED,4EAA4E;IAC5E,sBAAsB;IACtB,4EAA4E;IAE5E,8EAA8E;IAC9E,UAAU,CAAC,WAAmB;QAC5B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACvC,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW;gBAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,CAAC;IAED,sEAAsE;IACtE,YAAY;QAKV,OAAO;YACL,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;YAC5C,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;YAC5C,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,QAAQ;IACR,4EAA4E;IAE5E;;;;;;;OAOG;IACH,YAAY,CACV,IAAiB,EACjB,KAAa,EACb,QAAqB;QAErB,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,wBAAwB,CAAC,qBAAqB,EAAE,0BAA0B,IAAI,uBAAuB,EAAE;gBAC/G,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,4EAA4E;QAC5E,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3C,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;QAEtD,4EAA4E;QAC5E,qEAAqE;QACrE,IAAI,CAAC;YACH,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,2EAA2E;QAC3E,yCAAyC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,WAAW,IAAI,kBAAkB,CAAC;QACrE,IAAI,SAAS,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACvB,MAAM,IAAI,wBAAwB,CAAC,oBAAoB,EAAE,uCAAuC,CAAC,CAAC;QACpG,CAAC;QAED,yCAAyC;QACzC,MAAM,MAAM,GAAoB;YAC9B,WAAW;YACX,IAAI;YACJ,KAAK,EAAE,SAAS;YAChB,SAAS;YACT,KAAK;SACN,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9B,QAAQ,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAEvE,6EAA6E;QAC7E,sDAAsD;QACtD,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;YACrB,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC;QACzC,CAAC;QACD,KAAK,IAAI,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE;YAC/B,IAAI,SAAS;gBAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;YAClE,MAAM,CAAC,aAAa,GAAG,SAAS,CAAC;YACjC,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACvF,CAAC;IAED,4EAA4E;IAC5E,wBAAwB;IACxB,4EAA4E;IAEpE,KAAK,CAAC,UAAU,CAAC,MAAuB,EAAE,QAAqB;QACrE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACvG,yDAAyD;QACzD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAErD,MAAM,CAAC,KAAK,GAAG,SAAS,CAAC;QAEzB,IAAI,CAAC;YACH,uEAAuE;YACvE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,YAAY,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,gBAAgB,GAAG,KAAK,CAAC;YAC7B,IAAI,CAAC;gBACH,gBAAgB,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,gBAAgB,IAAI,KAAK,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;gBAClE,uEAAuE;gBACvE,6CAA6C;YAC/C,CAAC;YACD,MAAM,gBAAgB,GAAG,wBAAwB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;YAClF,MAAM,cAAc,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC;YAExD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC;YAChE,MAAM,eAAe,GAAG,CAAC,UAAkB,EAAE,EAAE;gBAC7C,MAAM,GAAG,GAAoC;oBAC3C,WAAW;oBACX,WAAW,EAAE,IAAI;oBACjB,UAAU;oBACV,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,0BAA0B,EAAE,CAAC,CAAC;oBACzD,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE;wBAC3B,MAAM,CAAC,cAAc,GAAG;4BACtB,MAAM,EAAE,QAAQ,CAAC,UAAU;4BAC3B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;4BAC3C,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACxD,CAAC;oBACJ,CAAC;iBACF,CAAC;gBACF,OAAO,IAAI,wBAAwB,CAAC,GAAG,CAAC,CAAC;YAC3C,CAAC,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE;gBACrC,eAAe;gBACf,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK,EAAE,IAAI;gBACX,WAAW;gBACX,aAAa,EAAE,KAAK;gBACpB,gBAAgB;aACjB,CAAC,CAAC;YAEH,0EAA0E;YAC1E,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtG,MAAM,CAAC,MAAM,GAAG;gBACd,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;gBAC9B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpC,CAAC;YAEF,0EAA0E;YAC1E,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,sBAAsB,EAAE,IAAI,EAAE;gBACxE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;gBACzE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,CAAC;gBAC7G,WAAW;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,uEAAuE;YACvE,0EAA0E;YAC1E,2BAA2B;YAC3B,MAAM,CAAC,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC1C,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACvB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAExB,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,QAAQ,CAAC,IAAI,CAAC,wBAAwB,EAAE;oBACtC,IAAI;oBACJ,WAAW;oBACX,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI;oBACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;iBAC5B,CAAC,CAAC;YACL,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,mBAAmB;IACnB,4EAA4E;IAE5E;;;;;OAKG;IACH,iBAAiB,CAAC,QAAqB;QACrC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,OAAO;QACrC,IAAI,OAAiB,CAAC;QACtB,IAAI,CAAC;YACH,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,IAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,CAAC,mCAAmC;YAC/C,CAAC;YACD,MAAM,QAAQ,GAAG,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;YAClE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACpC,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,gDAAgD;gBAChD,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC,wBAAwB,EAAE;oBACtC,IAAI;oBACJ,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,IAAI,EAAE,gBAAgB;oBACtB,KAAK,EAAE,wCAAwC;iBAChD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,UAAU;IACV,4EAA4E;IAEpE,kBAAkB,CAAC,IAAiB,EAAE,WAAmB,EAAE,SAAiB;QAClF,MAAM,QAAQ,GAAG,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;QAClE,MAAM,OAAO,GAAoB,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9E,IAAI,CAAC;YACH,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;QAED,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,wBAAwB,CAAC,qBAAqB,EAAE,0BAA0B,IAAI,uBAAuB,EAAE;gBAC/G,WAAW,EAAE,QAAQ,CAAC,WAAW;aAClC,CAAC,CAAC;QACL,CAAC;QACD,kDAAkD;QAClD,UAAU,CAAC,QAAQ,CAAC,CAAC;QACrB,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAEO,WAAW,CAAC,IAAiB;QACnC,UAAU,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IAC/D,CAAC;IAEO,WAAW,CAAC,OAAwB;QAC1C,qBAAqB;QACrB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,oCAAoC;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC;IACpD,CAAC;IAED,4EAA4E;IAC5E,uBAAuB;IACvB,4EAA4E;IAEpE,mBAAmB;QACzB,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACtE,MAAM,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACvD,IAAI,CAAC,GAAG;gBAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,wBAAwB,CAChC,qBAAqB,EACrB,6CAA6C,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,aAAa;IACb,4EAA4E;IAEpE,UAAU,CAAC,MAAuB;QACxC,+DAA+D;QAC/D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG,UAAU,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC/C,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM;YAChC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;CACF;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E;;;;GAIG;AACH,KAAK,UAAU,kBAAkB,CAAC,IAAiB,EAAE,IAA2B;IAC9E,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,6BAA6B,CAAC,CAAC;IAC7E,OAAO,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,KAAK,CAAC,GAAoB;IACjC,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,KAAK,EAAE,GAAG,CAAC,KAAK;KACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH;;;;GAIG;AACH,SAAS,0BAA0B,CAAC,IAAiB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC3E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAuB,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IACD,8EAA8E;IAC9E,2DAA2D;IAC3D,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IAClD,CAAC;IACD,6EAA6E;IAC7E,0DAA0D;IAC1D,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAE,GAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,6DAA6D,EAAE,CAAC;IAC/G,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,gFAAgF;IAChF,IAAI,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,iBAAiB,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACzF,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;IACnG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;AAC5E,CAAC;AAED,+EAA+E;AAC/E,SAAS,kBAAkB,CAAC,QAAgB,EAAE,OAAwB;IACpE,4EAA4E;IAC5E,uDAAuD;IACvD,MAAM,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;QAC3D,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EACpC,CAAC;YACD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,GAAG,CAAC;IAClE,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,OAAQ,GAA6B,CAAC,IAAI,KAAK,OAAO,CAAC;IACzD,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,kFAAkF;AAClF,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,0BAA0B,EAAE,CAAC"}