@provos/ironcurtain 0.12.0 → 0.13.0

package/dist/docker/docker-resource-lifecycle.js

@@ -0,0 +1,454 @@
+/**
+ * Crash-safe ownership, reconciliation, and IPv4 allocation for Docker
+ * resources created by IronCurtain.
+ *
+ * Docker intentionally outlives its CLI clients. A killed IronCurtain process
+ * therefore leaves containers and networks behind unless a later process can
+ * prove ownership and reclaim them. Labels plus a host-side owner lease provide
+ * that proof without confusing a concurrently-starting empty network for an
+ * orphan.
+ */
+import { createHash, randomUUID } from 'node:crypto';
+import { execFileSync } from 'node:child_process';
+import { closeSync, mkdirSync, openSync, readFileSync, rmSync, unlinkSync, writeFileSync } from 'node:fs';
+import { networkInterfaces, platform } from 'node:os';
+import { resolve } from 'node:path';
+import { getIronCurtainHome } from '../config/paths.js';
+import * as logger from '../logger.js';
+import { isExecError } from '../utils/exec-error.js';
+export const IRONCURTAIN_MANAGED_LABEL = 'ironcurtain.managed';
+export const IRONCURTAIN_OWNER_PID_LABEL = 'ironcurtain.owner-pid';
+export const IRONCURTAIN_OWNER_TOKEN_LABEL = 'ironcurtain.owner-token';
+export const IRONCURTAIN_CREATED_AT_LABEL = 'ironcurtain.created-at';
+export const IRONCURTAIN_RESOURCE_SCHEMA_LABEL = 'ironcurtain.resource-schema';
+const IRONCURTAIN_BUNDLE_LABEL = 'ironcurtain.bundle';
+const RESOURCE_SCHEMA = '2';
+// Current bundle slugs are 12 hex digits; pre-identity-refactor names used a
+// raw UUID substring and therefore contain a hyphen after eight digits.
+const LEGACY_NETWORK_RE = /^ironcurtain-(?:[a-f0-9]{12}|[a-f0-9]{8}-[a-f0-9]{3})$/;
+const LEGACY_EMPTY_NETWORK_GRACE_MS = 2 * 60_000;
+const ownerLeases = new Map();
+let exitHookInstalled = false;
+let cachedBootId;
+function currentBootId() {
+    if (cachedBootId)
+        return cachedBootId;
+    try {
+        if (platform() === 'linux') {
+            cachedBootId = readFileSync('/proc/sys/kernel/random/boot_id', 'utf8').trim();
+        }
+        else if (platform() === 'darwin') {
+            const bootTime = execFileSync('sysctl', ['-n', 'kern.boottime'], {
+                encoding: 'utf8',
+                timeout: 1_000,
+                stdio: ['ignore', 'pipe', 'ignore'],
+            });
+            const match = bootTime.match(/sec\s*=\s*(\d+),\s*usec\s*=\s*(\d+)/);
+            if (match)
+                cachedBootId = `darwin:${match[1]}.${match[2]}`;
+        }
+    }
+    catch {
+        // Process start time remains sufficient to distinguish recycled PIDs.
+    }
+    cachedBootId ||= `${platform()}:unknown-boot`;
+    return cachedBootId;
+}
+function defaultProcessIdentity(pid) {
+    try {
+        const startedAt = execFileSync('ps', ['-o', 'lstart=', '-p', String(pid)], {
+            encoding: 'utf8',
+            timeout: 1_000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+            env: { ...process.env, LC_ALL: 'C', TZ: 'UTC' },
+        }).trim();
+        if (!startedAt)
+            return undefined;
+        return { bootId: currentBootId(), startedAt };
+    }
+    catch {
+        return undefined;
+    }
+}
+function leaseRoot() {
+    return resolve(getIronCurtainHome(), 'run', 'docker-owners');
+}
+function installExitHook() {
+    if (exitHookInstalled)
+        return;
+    exitHookInstalled = true;
+    process.once('exit', () => {
+        for (const lease of ownerLeases.values()) {
+            try {
+                unlinkSync(lease.path);
+            }
+            catch {
+                // A crash reconciler may already have removed it.
+            }
+        }
+    });
+}
+function ownerLeaseKey(root, bundleId) {
+    return `${root}\0${bundleId}`;
+}
+function getOwnerLease(bundleId) {
+    const root = leaseRoot();
+    const key = ownerLeaseKey(root, bundleId);
+    const existing = ownerLeases.get(key);
+    if (existing)
+        return existing;
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    const token = randomUUID();
+    const path = resolve(root, `${token}.json`);
+    const identity = defaultProcessIdentity(process.pid);
+    if (!identity)
+        throw new Error(`Unable to determine the identity of owner process ${process.pid}`);
+    const lease = { token, pid: process.pid, identity, path };
+    writeFileSync(path, JSON.stringify({ token, pid: process.pid, identity, bundleId, createdAt: new Date().toISOString() }), { mode: 0o600, flag: 'wx' });
+    ownerLeases.set(key, lease);
+    installExitHook();
+    return lease;
+}
+/** Labels stamped on every managed container and network. */
+export function managedResourceLabels(bundleId) {
+    const lease = getOwnerLease(bundleId);
+    return {
+        [IRONCURTAIN_MANAGED_LABEL]: 'true',
+        [IRONCURTAIN_BUNDLE_LABEL]: bundleId,
+        [IRONCURTAIN_OWNER_PID_LABEL]: String(lease.pid),
+        [IRONCURTAIN_OWNER_TOKEN_LABEL]: lease.token,
+        [IRONCURTAIN_CREATED_AT_LABEL]: new Date().toISOString(),
+        [IRONCURTAIN_RESOURCE_SCHEMA_LABEL]: RESOURCE_SCHEMA,
+    };
+}
+/** Marks a completed/failed bundle as no longer live so same-process GC can reclaim a failed teardown. */
+export function releaseManagedResourceLease(bundleId) {
+    const root = leaseRoot();
+    const key = ownerLeaseKey(root, bundleId);
+    const lease = ownerLeases.get(key);
+    if (!lease)
+        return;
+    ownerLeases.delete(key);
+    try {
+        unlinkSync(lease.path);
+    }
+    catch {
+        // Already reclaimed or removed during shutdown.
+    }
+}
+function defaultPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === 'EPERM';
+    }
+}
+function ownerIsAlive(labels, pidAlive, processIdentity, root = leaseRoot()) {
+    const pid = Number(labels[IRONCURTAIN_OWNER_PID_LABEL]);
+    const token = labels[IRONCURTAIN_OWNER_TOKEN_LABEL];
+    if (!Number.isSafeInteger(pid) || pid <= 0 || !token || !pidAlive(pid))
+        return false;
+    try {
+        const lease = JSON.parse(readFileSync(resolve(root, `${token}.json`), 'utf8'));
+        if (lease.token !== token ||
+            lease.pid !== pid ||
+            typeof lease.identity?.bootId !== 'string' ||
+            typeof lease.identity.startedAt !== 'string') {
+            return false;
+        }
+        const currentIdentity = processIdentity(pid);
+        return (currentIdentity !== undefined &&
+            currentIdentity.bootId === lease.identity.bootId &&
+            currentIdentity.startedAt === lease.identity.startedAt);
+    }
+    catch {
+        return false;
+    }
+}
+function resourceAgeMs(created, now) {
+    const timestamp = Date.parse(created);
+    return Number.isFinite(timestamp) ? Math.max(0, now.getTime() - timestamp) : Number.POSITIVE_INFINITY;
+}
+async function withReconcileLock(fn, processIdentity) {
+    const root = leaseRoot();
+    mkdirSync(root, { recursive: true, mode: 0o700 });
+    const lockPath = resolve(root, 'reconcile.lock');
+    let fd;
+    try {
+        try {
+            fd = openSync(lockPath, 'wx', 0o600);
+            writeFileSync(fd, JSON.stringify({ pid: process.pid, identity: processIdentity(process.pid) }));
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            try {
+                const owner = JSON.parse(readFileSync(lockPath, 'utf8'));
+                const currentIdentity = typeof owner.pid === 'number' ? processIdentity(owner.pid) : undefined;
+                if (typeof owner.pid === 'number' &&
+                    defaultPidAlive(owner.pid) &&
+                    currentIdentity !== undefined &&
+                    owner.identity !== undefined &&
+                    currentIdentity.bootId === owner.identity.bootId &&
+                    currentIdentity.startedAt === owner.identity.startedAt) {
+                    return undefined;
+                }
+            }
+            catch {
+                // Invalid/stale lock: replace it below.
+            }
+            rmSync(lockPath, { force: true });
+            fd = openSync(lockPath, 'wx', 0o600);
+            writeFileSync(fd, JSON.stringify({ pid: process.pid, identity: processIdentity(process.pid) }));
+        }
+        return await fn();
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+        if (fd !== undefined)
+            rmSync(lockPath, { force: true });
+    }
+}
+/**
+ * Reclaims resources whose owner process is gone. Unlabeled legacy networks
+ * are reclaimed only when empty and old enough; attached legacy resources are
+ * deliberately left for an explicit operator action because ownership cannot
+ * be proven safely.
+ */
+export async function reconcileIronCurtainDockerResources(docker, options = {}) {
+    const empty = {
+        removedContainers: [],
+        removedNetworks: [],
+        retainedActiveResources: 0,
+        skippedUnsafeNetworks: [],
+    };
+    if (!docker.listNetworks || !docker.listContainers)
+        return empty;
+    const identityProbe = options.processIdentity ?? defaultProcessIdentity;
+    const identityCache = new Map();
+    const processIdentity = (pid) => {
+        if (!identityCache.has(pid))
+            identityCache.set(pid, identityProbe(pid));
+        return identityCache.get(pid);
+    };
+    const result = await withReconcileLock(async () => {
+        const pidAlive = options.pidAlive ?? defaultPidAlive;
+        const now = options.now ?? new Date();
+        const removedContainers = [];
+        const removedNetworks = [];
+        const skippedUnsafeNetworks = [];
+        const deadOwnerTokens = new Set();
+        let retainedActiveResources = 0;
+        const managedContainers = await docker.listContainers?.({ labelFilter: `${IRONCURTAIN_MANAGED_LABEL}=true` });
+        for (const container of managedContainers ?? []) {
+            if (ownerIsAlive(container.labels, pidAlive, processIdentity)) {
+                retainedActiveResources++;
+                continue;
+            }
+            const ownerToken = container.labels[IRONCURTAIN_OWNER_TOKEN_LABEL];
+            if (ownerToken)
+                deadOwnerTokens.add(ownerToken);
+            logger.warn(`[docker-gc] reclaiming orphaned container ${container.name}`);
+            if (!options.dryRun) {
+                await docker.remove(container.id);
+                if (await docker.containerExists(container.id)) {
+                    logger.warn(`[docker-gc] container ${container.name} still exists after forced removal`);
+                    continue;
+                }
+            }
+            removedContainers.push(container.name);
+        }
+        const removedContainerIds = new Set((managedContainers ?? [])
+            .filter((container) => removedContainers.includes(container.name))
+            .map((container) => container.id));
+        const networks = await docker.listNetworks?.();
+        for (const network of networks ?? []) {
+            const managed = network.labels[IRONCURTAIN_MANAGED_LABEL] === 'true';
+            const legacy = !managed && LEGACY_NETWORK_RE.test(network.name);
+            if (!managed && !legacy)
+                continue;
+            if (managed && ownerIsAlive(network.labels, pidAlive, processIdentity)) {
+                retainedActiveResources++;
+                continue;
+            }
+            const ownerToken = network.labels[IRONCURTAIN_OWNER_TOKEN_LABEL];
+            if (managed && ownerToken)
+                deadOwnerTokens.add(ownerToken);
+            if (legacy) {
+                const graceMs = options.legacyGraceMs ?? LEGACY_EMPTY_NETWORK_GRACE_MS;
+                if (network.containerIds.length > 0 || resourceAgeMs(network.created, now) < graceMs) {
+                    skippedUnsafeNetworks.push(network.name);
+                    continue;
+                }
+            }
+            const survivingAttachments = network.containerIds.filter((id) => !removedContainerIds.has(id));
+            if (survivingAttachments.length > 0) {
+                logger.warn(`[docker-gc] refusing to remove ${network.name}: it has non-orphan attachments`);
+                skippedUnsafeNetworks.push(network.name);
+                continue;
+            }
+            logger.warn(`[docker-gc] reclaiming orphaned network ${network.name}`);
+            if (!options.dryRun) {
+                await docker.removeNetwork(network.name);
+                if (docker.networkExists && (await docker.networkExists(network.name))) {
+                    logger.warn(`[docker-gc] network ${network.name} still exists after removal`);
+                    continue;
+                }
+            }
+            removedNetworks.push(network.name);
+        }
+        if (!options.dryRun) {
+            for (const token of deadOwnerTokens)
+                rmSync(resolve(leaseRoot(), `${token}.json`), { force: true });
+        }
+        return { removedContainers, removedNetworks, retainedActiveResources, skippedUnsafeNetworks };
+    }, processIdentity);
+    return result ?? empty;
+}
+/** Startup/retry reconciliation must never become a Docker session prerequisite. */
+export async function reconcileIronCurtainDockerResourcesBestEffort(docker, context) {
+    try {
+        await reconcileIronCurtainDockerResources(docker);
+    }
+    catch (error) {
+        logger.warn(`[docker-gc] ${context} reconciliation skipped: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
+function ipv4ToNumber(address) {
+    const octets = address.split('.').map(Number);
+    if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) {
+        return undefined;
+    }
+    return (((octets[0] << 24) >>> 0) + (octets[1] << 16) + (octets[2] << 8) + octets[3]) >>> 0;
+}
+function numberToIpv4(value) {
+    return [value >>> 24, (value >>> 16) & 255, (value >>> 8) & 255, value & 255].join('.');
+}
+function parseIpv4Cidr(value) {
+    const [address, rawPrefix] = value.split('/');
+    const prefix = Number(rawPrefix);
+    const ip = ipv4ToNumber(address);
+    if (ip === undefined || !Number.isInteger(prefix) || prefix < 0 || prefix > 32)
+        return undefined;
+    const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
+    return { network: (ip & mask) >>> 0, prefix };
+}
+function cidrsOverlap(left, right) {
+    const prefix = Math.min(left.prefix, right.prefix);
+    const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
+    return (left.network & mask) === (right.network & mask);
+}
+export function hostInterfaceIpv4Cidrs() {
+    return Object.values(networkInterfaces())
+        .flatMap((entries) => entries ?? [])
+        .filter((entry) => entry.family === 'IPv4' && entry.cidr)
+        .map((entry) => entry.cidr);
+}
+const DOCKER_SUBNET_PREFIX = 29;
+const ADDRESS_POOLS = ['172.20.0.0/14', '172.24.0.0/14', '172.28.0.0/14', '10.240.0.0/12'];
+/** Returns the allocator pool containing a selected /29. */
+export function dockerAllocationPoolForSubnet(subnet) {
+    const candidate = parseIpv4Cidr(subnet);
+    if (!candidate)
+        return subnet;
+    return (ADDRESS_POOLS.find((pool) => {
+        const parsed = parseIpv4Cidr(pool);
+        return parsed !== undefined && cidrsOverlap(candidate, parsed);
+    }) ?? subnet);
+}
+export class InternalNetworkConnectivityError extends Error {
+    subnet;
+    constructor(message, subnet) {
+        super(message);
+        this.subnet = subnet;
+        this.name = 'InternalNetworkConnectivityError';
+    }
+}
+export async function withInternalNetworkAllocationRetry(options, runAttempt) {
+    const excludedSubnets = new Set();
+    let lastError;
+    for (let attempt = 1; attempt <= options.maxAttempts; attempt++) {
+        try {
+            return await runAttempt(excludedSubnets, attempt);
+        }
+        catch (error) {
+            lastError = error;
+            if (!(error instanceof InternalNetworkConnectivityError) || !error.subnet || attempt === options.maxAttempts) {
+                throw error;
+            }
+            const rejectedPool = dockerAllocationPoolForSubnet(error.subnet);
+            excludedSubnets.add(rejectedPool);
+            logger.warn(`${options.description} ${error.subnet} failed its end-to-end checks; rejecting ${rejectedPool} and ` +
+                `retrying with another allocation (${attempt}/${options.maxAttempts})`);
+            await options.reconcile?.();
+        }
+    }
+    throw lastError;
+}
+function* candidateSubnets(name) {
+    const seed = createHash('sha256').update(name).digest().readUInt32BE(0);
+    for (const poolValue of ADDRESS_POOLS) {
+        const pool = parseIpv4Cidr(poolValue);
+        if (!pool)
+            continue;
+        const count = 2 ** (DOCKER_SUBNET_PREFIX - pool.prefix);
+        const offset = seed % count;
+        const blockSize = 2 ** (32 - DOCKER_SUBNET_PREFIX);
+        for (let index = 0; index < count; index++) {
+            const block = (pool.network + ((offset + index) % count) * blockSize) >>> 0;
+            yield `${numberToIpv4(block)}/${DOCKER_SUBNET_PREFIX}`;
+        }
+    }
+}
+function allocationConflict(error) {
+    if (!isExecError(error))
+        return false;
+    return /overlap|address pool|fully subnetted|pool.*exhaust|no available network/i.test(error.stderr);
+}
+/** Allocates a small internal subnet while never falling back into 192.168/16. */
+export async function createIronCurtainInternalNetwork(docker, name, bundleId, options = {}) {
+    const networks = (await docker.listNetworks?.()) ?? [];
+    const sameNamedNetwork = networks.find((network) => network.name === name);
+    if (sameNamedNetwork) {
+        throw new Error(`Docker network ${name} already exists (${sameNamedNetwork.subnets.join(', ') || 'unknown subnet'}). ` +
+            `Refusing to reuse it because its requested ownership/subnet cannot be verified.`);
+    }
+    const occupied = [
+        ...networks.flatMap((network) => network.subnets),
+        ...(options.hostCidrs ?? hostInterfaceIpv4Cidrs()),
+    ]
+        .map(parseIpv4Cidr)
+        .filter((cidr) => cidr !== undefined);
+    const excluded = [...(options.excludedSubnets ?? [])]
+        .map(parseIpv4Cidr)
+        .filter((cidr) => cidr !== undefined);
+    let lastConflict;
+    for (const subnet of candidateSubnets(name)) {
+        const candidate = parseIpv4Cidr(subnet);
+        if (!candidate ||
+            excluded.some((cidr) => cidrsOverlap(candidate, cidr)) ||
+            occupied.some((cidr) => cidrsOverlap(candidate, cidr))) {
+            continue;
+        }
+        try {
+            await docker.createNetwork(name, {
+                internal: true,
+                subnet,
+                labels: managedResourceLabels(bundleId),
+            });
+            return { name, subnet };
+        }
+        catch (error) {
+            if (!allocationConflict(error))
+                throw error;
+            lastConflict = error;
+            occupied.push(candidate);
+        }
+    }
+    throw new Error(`No collision-free IronCurtain Docker subnet is available for ${name}. ` +
+        `Reconciled the managed resources and searched /29 networks outside 192.168.0.0/16.`, { cause: lastConflict });
+}
+//# sourceMappingURL=docker-resource-lifecycle.js.map

package/dist/docker/docker-resource-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-resource-lifecycle.js","sourceRoot":"","sources":["../../src/docker/docker-resource-lifecycle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC1G,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAIrD,MAAM,CAAC,MAAM,yBAAyB,GAAG,qBAAqB,CAAC;AAC/D,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AACnE,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AACvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,wBAAwB,CAAC;AACrE,MAAM,CAAC,MAAM,iCAAiC,GAAG,6BAA6B,CAAC;AAC/E,MAAM,wBAAwB,GAAG,oBAAoB,CAAC;AACtD,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,6EAA6E;AAC7E,wEAAwE;AACxE,MAAM,iBAAiB,GAAG,wDAAwD,CAAC;AACnF,MAAM,6BAA6B,GAAG,CAAC,GAAG,MAAM,CAAC;AAgBjD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAsB,CAAC;AAClD,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B,IAAI,YAAgC,CAAC;AAErC,SAAS,aAAa;IACpB,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,CAAC;QACH,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;YAC3B,YAAY,GAAG,YAAY,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAChF,CAAC;aAAM,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE;gBAC/D,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACpE,IAAI,KAAK;gBAAE,YAAY,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,YAAY,KAAK,GAAG,QAAQ,EAAE,eAAe,CAAC;IAC9C,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE;YACzE,QAAQ,EAAE,MAAM;YAChB,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE;SAChD,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACjC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,iBAAiB;QAAE,OAAO;IAC9B,iBAAiB,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;QACxB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC;gBACH,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,QAAgB;IACnD,OAAO,GAAG,IAAI,KAAK,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1D,aAAa,CACX,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,EACpG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAC5B,CAAC;IACF,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5B,eAAe,EAAE,CAAC;IAClB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,qBAAqB,CAAC,QAA2B;IAC/D,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO;QACL,CAAC,yBAAyB,CAAC,EAAE,MAAM;QACnC,CAAC,wBAAwB,CAAC,EAAE,QAAQ;QACpC,CAAC,2BAA2B,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC;QAChD,CAAC,6BAA6B,CAAC,EAAE,KAAK,CAAC,KAAK;QAC5C,CAAC,4BAA4B,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACxD,CAAC,iCAAiC,CAAC,EAAE,eAAe;KACrD,CAAC;AACJ,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,2BAA2B,CAAC,QAA2B;IACrE,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,GAAW;IAClC,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,MAAwC,EACxC,QAAkC,EAClC,eAA6D,EAC7D,IAAI,GAAG,SAAS,EAAE;IAElB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,KAAK,OAAO,CAAC,EAAE,MAAM,CAAC,CAI5E,CAAC;QACF,IACE,KAAK,CAAC,KAAK,KAAK,KAAK;YACrB,KAAK,CAAC,GAAG,KAAK,GAAG;YACjB,OAAO,KAAK,CAAC,QAAQ,EAAE,MAAM,KAAK,QAAQ;YAC1C,OAAO,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,QAAQ,EAC5C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,eAAe,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO,CACL,eAAe,KAAK,SAAS;YAC7B,eAAe,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;YAChD,eAAe,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,CACvD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAiBD,SAAS,aAAa,CAAC,OAAe,EAAE,GAAS;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC;AACxG,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,EAAoB,EACpB,eAA6D;IAE7D,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACjD,IAAI,EAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACrC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAClG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAGtD,CAAC;gBACF,MAAM,eAAe,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC/F,IACE,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;oBAC7B,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC;oBAC1B,eAAe,KAAK,SAAS;oBAC7B,KAAK,CAAC,QAAQ,KAAK,SAAS;oBAC5B,eAAe,CAAC,MAAM,KAAK,KAAK,CAAC,QAAQ,CAAC,MAAM;oBAChD,eAAe,CAAC,SAAS,KAAK,KAAK,CAAC,QAAQ,CAAC,SAAS,EACtD,CAAC;oBACD,OAAO,SAAS,CAAC;gBACnB,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,wCAAwC;YAC1C,CAAC;YACD,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAClC,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACrC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAwB,EACxB,UAA4B,EAAE;IAE9B,MAAM,KAAK,GAAoB;QAC7B,iBAAiB,EAAE,EAAE;QACrB,eAAe,EAAE,EAAE;QACnB,uBAAuB,EAAE,CAAC;QAC1B,qBAAqB,EAAE,EAAE;KAC1B,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,cAAc;QAAE,OAAO,KAAK,CAAC;IAEjE,MAAM,aAAa,GAAG,OAAO,CAAC,eAAe,IAAI,sBAAsB,CAAC;IACxE,MAAM,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAC;IACrE,MAAM,eAAe,GAAG,CAAC,GAAW,EAA+B,EAAE;QACnE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,OAAO,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,KAAK,IAA8B,EAAE;QAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,eAAe,CAAC;QACrD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACtC,MAAM,iBAAiB,GAAa,EAAE,CAAC;QACvC,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,MAAM,qBAAqB,GAAa,EAAE,CAAC;QAC3C,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;QAC1C,IAAI,uBAAuB,GAAG,CAAC,CAAC;QAEhC,MAAM,iBAAiB,GAAG,MAAM,MAAM,CAAC,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,yBAAyB,OAAO,EAAE,CAAC,CAAC;QAC9G,KAAK,MAAM,SAAS,IAAI,iBAAiB,IAAI,EAAE,EAAE,CAAC;YAChD,IAAI,YAAY,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC;gBAC9D,uBAAuB,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;YACnE,IAAI,UAAU;gBAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,6CAA6C,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAClC,IAAI,MAAM,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC/C,MAAM,CAAC,IAAI,CAAC,yBAAyB,SAAS,CAAC,IAAI,oCAAoC,CAAC,CAAC;oBACzF,SAAS;gBACX,CAAC;YACH,CAAC;YACD,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,CAAC,iBAAiB,IAAI,EAAE,CAAC;aACtB,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;aACjE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CACpC,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC;QAC/C,KAAK,MAAM,OAAO,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,KAAK,MAAM,CAAC;YACrE,MAAM,MAAM,GAAG,CAAC,OAAO,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAChE,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;gBAAE,SAAS;YAElC,IAAI,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,EAAE,CAAC;gBACvE,uBAAuB,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC;YACjE,IAAI,OAAO,IAAI,UAAU;gBAAE,eAAe,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC3D,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,IAAI,6BAA6B,CAAC;gBACvE,IAAI,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,OAAO,EAAE,CAAC;oBACrF,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;oBACzC,SAAS;gBACX,CAAC;YACH,CAAC;YAED,MAAM,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/F,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,IAAI,CAAC,kCAAkC,OAAO,CAAC,IAAI,iCAAiC,CAAC,CAAC;gBAC7F,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACzC,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,2CAA2C,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACpB,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;oBACvE,MAAM,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,IAAI,6BAA6B,CAAC,CAAC;oBAC9E,SAAS;gBACX,CAAC;YACH,CAAC;YACD,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,MAAM,KAAK,IAAI,eAAe;gBAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,GAAG,KAAK,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,CAAC;IAChG,CAAC,EAAE,eAAe,CAAC,CAAC;IACpB,OAAO,MAAM,IAAI,KAAK,CAAC;AACzB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,6CAA6C,CACjE,MAAwB,EACxB,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,mCAAmC,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CACT,eAAe,OAAO,4BAA4B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;AACH,CAAC;AAOD,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;QACxG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC9F,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,GAAG,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IACjG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,IAAc,EAAE,KAAe;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IACpE,OAAO,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;SACtC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC;SACnC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC;SACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAc,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAChC,MAAM,aAAa,GAAG,CAAC,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,CAAU,CAAC;AAEpG,4DAA4D;AAC5D,MAAM,UAAU,6BAA6B,CAAC,MAAc;IAC1D,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC;IAC9B,OAAO,CACL,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACnC,OAAO,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACjE,CAAC,CAAC,IAAI,MAAM,CACb,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gCAAiC,SAAQ,KAAK;IAG9C;IAFX,YACE,OAAe,EACN,MAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,WAAM,GAAN,MAAM,CAAS;QAGxB,IAAI,CAAC,IAAI,GAAG,kCAAkC,CAAC;IACjD,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,OAIC,EACD,UAAiF;IAEjF,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,OAAO,MAAM,UAAU,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC,CAAC,KAAK,YAAY,gCAAgC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;gBAC7G,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,YAAY,GAAG,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACjE,eAAe,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAClC,MAAM,CAAC,IAAI,CACT,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC,MAAM,4CAA4C,YAAY,OAAO;gBACnG,qCAAqC,OAAO,IAAI,OAAO,CAAC,WAAW,GAAG,CACzE,CAAC;YACF,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,MAAM,SAAS,CAAC;AAClB,CAAC;AAED,QAAQ,CAAC,CAAC,gBAAgB,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACxE,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,GAAG,KAAK,CAAC;QAC5B,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,oBAAoB,CAAC,CAAC;QACnD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;YAC5E,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,0EAA0E,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACvG,CAAC;AAOD,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,MAAwB,EACxB,IAAY,EACZ,QAA2B,EAC3B,UAGI,EAAE;IAEN,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC3E,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,kBAAkB,IAAI,oBAAoB,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,KAAK;YACpG,iFAAiF,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG;QACf,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAA0B,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;QACpE,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,sBAAsB,EAAE,CAAC;KACnD;SACE,GAAG,CAAC,aAAa,CAAC;SAClB,MAAM,CAAC,CAAC,IAAI,EAAoB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;SAClD,GAAG,CAAC,aAAa,CAAC;SAClB,MAAM,CAAC,CAAC,IAAI,EAAoB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAE1D,IAAI,YAAqB,CAAC;IAC1B,KAAK,MAAM,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACxC,IACE,CAAC,SAAS;YACV,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACtD,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,EACtD,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE;gBAC/B,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,MAAM,EAAE,qBAAqB,CAAC,QAAQ,CAAC;aACxC,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;YAC5C,YAAY,GAAG,KAAK,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,gEAAgE,IAAI,IAAI;QACtE,oFAAoF,EACtF,EAAE,KAAK,EAAE,YAAY,EAAE,CACxB,CAAC;AACJ,CAAC"}

package/dist/docker/gc-command.d.ts

@@ -0,0 +1,2 @@
+/** Explicit operator surface for inspecting or applying the startup reconciler. */
+export declare function runDockerGcCommand(args: readonly string[]): Promise<void>;

package/dist/docker/gc-command.js

@@ -0,0 +1,37 @@
+import { parseArgs } from 'node:util';
+import { createDockerManager } from './docker-manager.js';
+import { reconcileIronCurtainDockerResources } from './docker-resource-lifecycle.js';
+/** Explicit operator surface for inspecting or applying the startup reconciler. */
+export async function runDockerGcCommand(args) {
+    const { values } = parseArgs({
+        args: [...args],
+        options: {
+            'dry-run': { type: 'boolean' },
+            force: { type: 'boolean' },
+            help: { type: 'boolean', short: 'h' },
+        },
+        strict: true,
+    });
+    if (values.help) {
+        process.stdout.write('Usage: ironcurtain gc [--dry-run | --force]\n\n' +
+            'Lists crash-orphaned IronCurtain Docker resources by default.\n' +
+            'Use --force to remove resources whose owner process is no longer alive.\n');
+        return;
+    }
+    if (values.force && values['dry-run'])
+        throw new Error('Choose either --dry-run or --force, not both');
+    const apply = values.force === true;
+    const result = await reconcileIronCurtainDockerResources(createDockerManager(), { dryRun: !apply });
+    const verb = apply ? 'Reclaimed' : 'Would reclaim';
+    process.stdout.write(`${verb} ${result.removedContainers.length} container(s) and ${result.removedNetworks.length} network(s).\n`);
+    for (const name of result.removedContainers)
+        process.stdout.write(`  container ${name}\n`);
+    for (const name of result.removedNetworks)
+        process.stdout.write(`  network   ${name}\n`);
+    if (result.skippedUnsafeNetworks.length > 0) {
+        process.stdout.write(`Skipped ${result.skippedUnsafeNetworks.length} legacy/attached network(s) with uncertain ownership.\n`);
+    }
+    if (!apply)
+        process.stdout.write('Re-run with --force to apply this plan.\n');
+}
+//# sourceMappingURL=gc-command.js.map

package/dist/docker/gc-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gc-command.js","sourceRoot":"","sources":["../../src/docker/gc-command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,gCAAgC,CAAC;AAErF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAuB;IAC9D,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;QAC3B,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;QACf,OAAO,EAAE;YACP,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;YAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACtC;QACD,MAAM,EAAE,IAAI;KACb,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iDAAiD;YAC/C,iEAAiE;YACjE,2EAA2E,CAC9E,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAEvG,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,mCAAmC,CAAC,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IACpG,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;IACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,IAAI,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,qBAAqB,MAAM,CAAC,eAAe,CAAC,MAAM,gBAAgB,CAC7G,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,iBAAiB;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC;IAC3F,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,eAAe;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,WAAW,MAAM,CAAC,qBAAqB,CAAC,MAAM,yDAAyD,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;AAChF,CAAC"}

package/dist/docker/mitm-proxy.d.ts

@@ -238,11 +238,13 @@ export interface BoundedJsonResponseCapture {
  */
 export declare function createBoundedJsonResponseCapture(maxBytes?: number): BoundedJsonResponseCapture;
 /**
- * Maps a target hostname to the SSE provider for token stream parsing.
- * Only Anthropic and OpenAI hosts are recognized; everything else
- * falls back to 'unknown'.
+ * Maps a target hostname (and, for OpenRouter, request path) to the SSE
+ * provider for token stream parsing. Anthropic and OpenAI hosts classify by
+ * host alone; `openrouter.ai` serves three wire formats depending on path, so
+ * `/api/v1/messages` (the Anthropic skin) is 'anthropic' and every other path
+ * is 'openai'. Everything else falls back to 'unknown'.
  */
-export declare function resolveSseProvider(hostname: string): SseProvider;
+export declare function resolveSseProvider(hostname: string, path?: string): SseProvider;
 export declare function extractToolResults(parsed: Record<string, unknown>, sessionId: import('../session/types.js').SessionId): void;
 /**
  * Extract token stream events from a non-streaming JSON response body.