@provos/ironcurtain 0.3.0 → 0.4.0

package/dist/signal/signal-bot-daemon.js

@@ -0,0 +1,504 @@
+/**
+ * SignalBotDaemon - long-lived singleton managing the Signal transport.
+ *
+ * Responsibilities:
+ * - WebSocket connection to signal-cli-rest-api with reconnect + exponential backoff
+ * - Message routing: authorization, identity verification, escalation replies,
+ *   control commands, and session forwarding
+ * - Session lifecycle: creates transport+session on demand, cleans up on end
+ * - Identity verification with TTL cache (5 min), fail-closed
+ * - Escalation state with race prevention
+ * - Message sending via POST /v2/send with text_mode: "styled"
+ */
+import { createSession } from '../session/index.js';
+import { loadConfig } from '../config/index.js';
+import { loadUserConfig } from '../config/user-config.js';
+import { resolveSignalConfig } from './signal-config.js';
+import { SignalSessionTransport } from './signal-transport.js';
+import { markdownToSignal } from './markdown-to-signal.js';
+import { formatBudgetMessage, formatBudgetSummary, splitMessage, SIGNAL_MAX_MESSAGE_LENGTH } from './format.js';
+import { BudgetExhaustedError } from '../session/errors.js';
+import * as logger from '../logger.js';
+/** How often to proactively verify the recipient's identity key (ms). */
+const IDENTITY_CHECK_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
+export class SignalBotDaemon {
+    config;
+    containerManager;
+    mode;
+    // WebSocket state
+    ws = null;
+    baseUrl = '';
+    closed = false;
+    reconnectAttempts = 0;
+    static MAX_RECONNECT_DELAY_MS = 30_000;
+    static BASE_RECONNECT_DELAY_MS = 1_000;
+    // Session state - at most one active session at a time
+    activeSession = null;
+    activeTransport = null;
+    messageInFlight = false;
+    // Escalation state - owned by the daemon because the daemon routes
+    // "approve"/"deny" messages before they reach the transport.
+    pendingEscalationId = null;
+    escalationResolving = false;
+    // Identity verification state
+    identityLocked = false;
+    lastIdentityCheckMs = 0;
+    // Message deduplication for drainMissedMessages()
+    recentTimestamps = new Set();
+    // Resolves when the daemon should exit (shutdown() called)
+    exitResolve = null;
+    constructor(options) {
+        this.config = options.config;
+        this.containerManager = options.containerManager;
+        this.mode = options.mode;
+    }
+    /**
+     * Starts the daemon. Returns a promise that resolves when
+     * shutdown() is called (e.g., SIGTERM/SIGINT).
+     */
+    async start() {
+        this.baseUrl = await this.containerManager.ensureRunning();
+        await this.containerManager.waitForHealthy(this.baseUrl);
+        await this.connectWebSocket();
+        await this.sendSignalMessage('IronCurtain bot is online. Send a message to begin.');
+        // Block until shutdown
+        await new Promise((resolve) => {
+            this.exitResolve = resolve;
+        });
+    }
+    /**
+     * Initiates graceful shutdown. Ends the active session,
+     * closes the WebSocket, and unblocks start().
+     */
+    async shutdown() {
+        logger.info('[Signal Daemon] Shutting down...');
+        this.closed = true;
+        await this.sendSignalMessage('IronCurtain bot is shutting down. Goodbye.').catch(() => { });
+        await this.endCurrentSession();
+        if (this.ws) {
+            this.ws.close();
+            this.ws = null;
+        }
+        this.exitResolve?.();
+    }
+    // --- WebSocket connection ---
+    async connectWebSocket() {
+        const wsUrl = `ws://127.0.0.1:${this.config.container.port}/v1/receive/${encodeURIComponent(this.config.botNumber)}`;
+        const isReconnect = this.reconnectAttempts > 0;
+        return new Promise((resolve, reject) => {
+            const ws = new WebSocket(wsUrl);
+            ws.addEventListener('open', () => {
+                this.reconnectAttempts = 0;
+                if (isReconnect) {
+                    this.drainMissedMessages().catch((err) => {
+                        logger.info(`[Signal Daemon] Failed to drain missed messages: ${String(err)}`);
+                    });
+                }
+                resolve();
+            });
+            ws.addEventListener('message', (event) => {
+                this.handleIncomingMessage(String(event.data)).catch((err) => {
+                    logger.error(`[Signal Daemon] Error handling message: ${String(err)}`);
+                });
+            });
+            ws.addEventListener('close', () => {
+                if (!this.closed) {
+                    this.scheduleReconnect();
+                }
+            });
+            ws.addEventListener('error', () => {
+                if (this.reconnectAttempts === 0 && !this.ws) {
+                    reject(new Error('WebSocket connection failed'));
+                }
+            });
+            this.ws = ws;
+        });
+    }
+    /**
+     * Polls GET /v1/receive/{number} to drain messages missed during
+     * a WebSocket disconnect. Uses timestamp-based deduplication to
+     * avoid processing messages that the WebSocket already delivered.
+     */
+    async drainMissedMessages() {
+        const url = `${this.baseUrl}/v1/receive/${encodeURIComponent(this.config.botNumber)}`;
+        try {
+            const resp = await fetch(url);
+            if (!resp.ok)
+                return;
+            const messages = (await resp.json());
+            for (const msg of messages) {
+                const data = JSON.stringify(msg);
+                await this.handleIncomingMessage(data);
+            }
+        }
+        catch {
+            // Best-effort - new messages will arrive via WS
+        }
+    }
+    scheduleReconnect() {
+        if (this.closed)
+            return;
+        this.reconnectAttempts++;
+        const delay = Math.min(SignalBotDaemon.BASE_RECONNECT_DELAY_MS * Math.pow(1.5, this.reconnectAttempts), SignalBotDaemon.MAX_RECONNECT_DELAY_MS);
+        setTimeout(() => {
+            if (!this.closed) {
+                this.connectWebSocket().catch(() => {
+                    // Retry will be scheduled by the close handler
+                });
+            }
+        }, delay);
+    }
+    // --- Message routing ---
+    async handleIncomingMessage(data) {
+        const envelope = parseSignalEnvelope(data);
+        if (!envelope)
+            return;
+        // Authorization: only accept messages from the configured user
+        if (!isAuthorizedSender(envelope, this.config.recipientNumber))
+            return;
+        // Deduplication: skip messages we've already processed
+        const ts = envelope.dataMessage?.timestamp;
+        if (ts) {
+            if (this.recentTimestamps.has(ts))
+                return;
+            this.recentTimestamps.add(ts);
+            // Prune old timestamps (keep last 5 minutes)
+            if (this.recentTimestamps.size > 500) {
+                const cutoff = Date.now() - 5 * 60 * 1000;
+                for (const t of this.recentTimestamps) {
+                    if (t < cutoff)
+                        this.recentTimestamps.delete(t);
+                }
+            }
+        }
+        // Identity verification
+        if (await this.checkIdentityChanged(envelope))
+            return;
+        const text = envelope.dataMessage?.message;
+        if (!text)
+            return;
+        // Escalation replies: approve/deny (also accept /approve, /deny)
+        if (this.handleEscalationReply(text))
+            return;
+        // Control commands: /quit, /new, /budget, /help
+        if (this.handleControlCommand(text))
+            return;
+        // Regular message -> route to session
+        await this.routeToSession(text);
+    }
+    /**
+     * Routes a user message to the active session. Creates a new
+     * session if none exists. Handles BudgetExhaustedError by ending
+     * the exhausted session and notifying the user.
+     */
+    async routeToSession(text) {
+        if (this.messageInFlight) {
+            await this.sendSignalMessage('Still processing previous message, please wait...');
+            return;
+        }
+        // Create session on demand
+        if (!this.activeSession) {
+            try {
+                await this.startNewSession();
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                await this.sendSignalMessage(`Failed to create session: ${msg}`);
+                return;
+            }
+        }
+        const session = this.activeSession;
+        if (!session)
+            return;
+        this.messageInFlight = true;
+        try {
+            const response = await session.sendMessage(text);
+            const styledText = markdownToSignal(response);
+            await this.sendSignalMessage(styledText);
+        }
+        catch (error) {
+            if (error instanceof BudgetExhaustedError) {
+                const status = session.getBudgetStatus();
+                await this.sendSignalMessage(`Session budget exhausted: ${error.message}\n` +
+                    formatBudgetSummary(status) +
+                    '\n' +
+                    'Send a new message to start a fresh session.');
+                await this.endCurrentSession();
+            }
+            else {
+                const message = error instanceof Error ? error.message : String(error);
+                await this.sendSignalMessage(`Error: ${message}`);
+            }
+        }
+        finally {
+            this.messageInFlight = false;
+        }
+    }
+    // --- Session lifecycle ---
+    /**
+     * Creates a new session with a fresh SignalSessionTransport.
+     * Follows the same pattern as index.ts: create transport,
+     * wire callbacks, create session, start transport.
+     */
+    async startNewSession() {
+        const transport = new SignalSessionTransport(this);
+        this.activeTransport = transport;
+        const config = loadConfig();
+        const session = await createSession({
+            config,
+            mode: this.mode,
+            onEscalation: transport.createEscalationHandler(),
+            onEscalationExpired: transport.createEscalationExpiredHandler(),
+            onDiagnostic: transport.createDiagnosticHandler(),
+        });
+        this.activeSession = session;
+        // Start the transport in the background. When it resolves
+        // (session closed/budget exhausted), clean up.
+        transport
+            .run(session)
+            .then(() => {
+            // Transport exited - session is done
+            if (this.activeTransport === transport) {
+                this.activeSession = null;
+                this.activeTransport = null;
+            }
+        })
+            .catch((err) => {
+            logger.error(`[Signal Daemon] Transport error: ${String(err)}`);
+        });
+        await this.sendSignalMessage('Started a new session.');
+    }
+    /**
+     * Ends the current session and cleans up. Awaits session.close()
+     * to ensure resources are released (sandbox, MCP connections, etc.).
+     * Guarded against re-entrance.
+     */
+    async endCurrentSession() {
+        if (!this.activeSession)
+            return;
+        const session = this.activeSession;
+        const transport = this.activeTransport;
+        this.activeSession = null;
+        this.activeTransport = null;
+        this.pendingEscalationId = null;
+        this.escalationResolving = false;
+        // Close transport first (resolves run() promise), then session
+        transport?.close();
+        await session.close();
+    }
+    // --- Escalation handling ---
+    /**
+     * Checks if the message is an escalation reply.
+     * Accepts: approve, deny, /approve, /deny (case-insensitive).
+     *
+     * Race condition prevention: escalationResolving flag prevents
+     * concurrent replies. pendingEscalationId is cleared in .finally()
+     * after async resolution completes, not before.
+     */
+    handleEscalationReply(text) {
+        if (!this.pendingEscalationId || !this.activeSession)
+            return false;
+        const normalized = text.trim().toLowerCase();
+        const isApprove = normalized === 'approve' || normalized === '/approve';
+        const isDeny = normalized === 'deny' || normalized === '/deny';
+        if (!isApprove && !isDeny)
+            return false;
+        if (this.escalationResolving) {
+            this.sendSignalMessage('Escalation is being resolved, please wait...').catch(() => { });
+            return true;
+        }
+        const decision = isApprove ? 'approved' : 'denied';
+        const escalationId = this.pendingEscalationId;
+        this.escalationResolving = true;
+        this.activeSession
+            .resolveEscalation(escalationId, decision)
+            .then(() => {
+            return this.sendSignalMessage(`Escalation ${decision}.`);
+        })
+            .catch((err) => {
+            const msg = err instanceof Error ? err.message : String(err);
+            this.sendSignalMessage(`Escalation error: ${msg}`).catch(() => { });
+        })
+            .finally(() => {
+            this.escalationResolving = false;
+            if (this.pendingEscalationId === escalationId) {
+                this.pendingEscalationId = null;
+            }
+        });
+        return true;
+    }
+    /** Called by SignalSessionTransport when the session surfaces an escalation. */
+    setPendingEscalation(escalationId) {
+        this.pendingEscalationId = escalationId;
+    }
+    /** Called by SignalSessionTransport when an escalation expires. */
+    clearPendingEscalation() {
+        this.pendingEscalationId = null;
+    }
+    // --- Control commands ---
+    handleControlCommand(text) {
+        const trimmed = text.trim().toLowerCase();
+        switch (trimmed) {
+            case '/quit':
+            case '/exit':
+            case '/new':
+                this.endCurrentSession()
+                    .then(() => {
+                    this.sendSignalMessage('Session ended. Send a message to start a new one.').catch(() => { });
+                })
+                    .catch(() => { });
+                return true;
+            case '/budget': {
+                if (!this.activeSession) {
+                    this.sendSignalMessage('No active session.').catch(() => { });
+                    return true;
+                }
+                const status = this.activeSession.getBudgetStatus();
+                this.sendSignalMessage(formatBudgetMessage(status)).catch(() => { });
+                return true;
+            }
+            case '/help':
+                this.sendSignalMessage('Commands:\n' +
+                    '  /quit or /new - end current session\n' +
+                    '  /budget - show resource usage\n' +
+                    '  /help - show this message\n' +
+                    '  approve or /approve - approve pending escalation\n' +
+                    '  deny or /deny - deny pending escalation').catch(() => { });
+                return true;
+            default:
+                return false;
+        }
+    }
+    // --- Identity verification ---
+    /**
+     * Checks whether the sender's Signal identity key has changed.
+     *
+     * Detection path 1: signal-cli flags the envelope with `untrustedIdentity`.
+     * Detection path 2: periodic proactive check via GET /v1/identities.
+     *   Cached with IDENTITY_CHECK_INTERVAL_MS TTL to avoid HTTP overhead
+     *   on every message.
+     *
+     * When locked, attempts self-healing by re-reading config from disk
+     * (handles the case where the user ran `--re-trust` externally).
+     *
+     * Returns true if the message should be rejected.
+     */
+    async checkIdentityChanged(envelope) {
+        // If locked, attempt self-healing via config reload
+        if (this.identityLocked) {
+            try {
+                const freshUserConfig = loadUserConfig();
+                const freshSignal = resolveSignalConfig(freshUserConfig);
+                if (freshSignal && freshSignal.recipientIdentityKey !== this.config.recipientIdentityKey) {
+                    logger.info('[Signal Daemon] Detected new identity key on disk. Unlocking.');
+                    this.config = freshSignal;
+                    this.identityLocked = false;
+                }
+            }
+            catch {
+                logger.error('[Signal Daemon] Failed to reload config during lock check.');
+            }
+            if (this.identityLocked)
+                return true;
+        }
+        // Detection path 1: envelope flag (real-time)
+        if (envelope.untrustedIdentity) {
+            this.lockTransport('Identity key change detected via envelope flag.');
+            return true;
+        }
+        // Detection path 2: proactive API check (periodic, TTL-cached)
+        const now = Date.now();
+        if (now - this.lastIdentityCheckMs < IDENTITY_CHECK_INTERVAL_MS) {
+            return false; // Within TTL, skip API call
+        }
+        try {
+            // Use the all-identities endpoint and filter by recipient number.
+            // The per-recipient endpoint is not available in all versions.
+            const resp = await fetch(`${this.baseUrl}/v1/identities/${encodeURIComponent(this.config.botNumber)}`);
+            if (!resp.ok) {
+                // Fail closed: treat API errors as unverifiable.
+                // Don't update lastIdentityCheckMs so the next message retries.
+                logger.error(`[Signal Daemon] Identity check API returned ${resp.status}. ` +
+                    'Rejecting message (fail-closed). Check signal-cli container health.');
+                return true;
+            }
+            const identities = (await resp.json());
+            const current = identities.find((id) => id.number === this.config.recipientNumber);
+            // Normalize fingerprint (signal-cli may return space-separated hex)
+            const currentFp = current?.fingerprint.replace(/\s+/g, '');
+            if (currentFp && currentFp !== this.config.recipientIdentityKey) {
+                this.lockTransport(`Identity key mismatch.\n` +
+                    `  Expected: ${this.config.recipientIdentityKey.substring(0, 20)}...\n` +
+                    `  Received: ${currentFp.substring(0, 20)}...`);
+                return true;
+            }
+            // Only cache success - failures will retry on the next message
+            this.lastIdentityCheckMs = now;
+        }
+        catch {
+            // Fail closed: reject message when we cannot verify identity.
+            // Don't update lastIdentityCheckMs so the next message retries.
+            logger.error('[Signal Daemon] Identity check API unavailable. ' +
+                'Rejecting message (fail-closed). Check signal-cli container health.');
+            return true;
+        }
+        return false;
+    }
+    lockTransport(reason) {
+        this.identityLocked = true;
+        logger.error(`[Signal Daemon] LOCKED: ${reason}\n` +
+            `The Signal identity key for ${this.config.recipientNumber} has changed.\n` +
+            `All messages are being rejected until re-trust is completed.\n` +
+            `Run: ironcurtain setup-signal --re-trust`);
+    }
+    // --- Message sending ---
+    async sendSignalMessage(text) {
+        const chunks = splitMessage(text, SIGNAL_MAX_MESSAGE_LENGTH);
+        for (const chunk of chunks) {
+            await this.postMessage(chunk);
+        }
+    }
+    async postMessage(text) {
+        const body = {
+            message: text,
+            number: this.config.botNumber,
+            recipients: [this.config.recipientNumber],
+            text_mode: 'styled',
+        };
+        const resp = await fetch(`${this.baseUrl}/v2/send`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        });
+        if (!resp.ok) {
+            const errBody = await resp.text();
+            throw new Error(`Signal send failed: ${resp.status} ${errBody}`);
+        }
+    }
+}
+// --- Envelope parsing and authorization ---
+export function parseSignalEnvelope(data) {
+    try {
+        const parsed = JSON.parse(data);
+        if (typeof parsed !== 'object' || parsed === null)
+            return null;
+        // json-rpc mode wraps the envelope
+        const record = parsed;
+        const envelope = (record.envelope ?? parsed);
+        return envelope;
+    }
+    catch {
+        return null;
+    }
+}
+/** Normalize a phone number by stripping spaces. */
+export function normalizePhoneNumber(number) {
+    return number.replace(/\s+/g, '');
+}
+export function isAuthorizedSender(envelope, recipientNumber) {
+    const sender = envelope.sourceNumber ?? envelope.source;
+    if (!sender)
+        return false;
+    return normalizePhoneNumber(sender) === normalizePhoneNumber(recipientNumber);
+}
+//# sourceMappingURL=signal-bot-daemon.js.map

package/dist/signal/signal-bot-daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signal-bot-daemon.js","sourceRoot":"","sources":["../../src/signal/signal-bot-daemon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAA6B,MAAM,oBAAoB,CAAC;AAGpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,YAAY,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAChH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,MAAM,MAAM,cAAc,CAAC;AAEvC,yEAAyE;AACzE,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAsC9D,MAAM,OAAO,eAAe;IAClB,MAAM,CAAuB;IACpB,gBAAgB,CAAyB;IACzC,IAAI,CAAc;IAEnC,kBAAkB;IACV,EAAE,GAAqB,IAAI,CAAC;IAC5B,OAAO,GAAW,EAAE,CAAC;IACrB,MAAM,GAAG,KAAK,CAAC;IACf,iBAAiB,GAAG,CAAC,CAAC;IACtB,MAAM,CAAU,sBAAsB,GAAG,MAAM,CAAC;IAChD,MAAM,CAAU,uBAAuB,GAAG,KAAK,CAAC;IAExD,uDAAuD;IAC/C,aAAa,GAAmB,IAAI,CAAC;IACrC,eAAe,GAAkC,IAAI,CAAC;IACtD,eAAe,GAAG,KAAK,CAAC;IAEhC,mEAAmE;IACnE,6DAA6D;IACrD,mBAAmB,GAAkB,IAAI,CAAC;IAC1C,mBAAmB,GAAG,KAAK,CAAC;IAEpC,8BAA8B;IACtB,cAAc,GAAG,KAAK,CAAC;IACvB,mBAAmB,GAAG,CAAC,CAAC;IAEhC,kDAAkD;IAC1C,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE7C,2DAA2D;IACnD,WAAW,GAAwB,IAAI,CAAC;IAEhD,YAAY,OAA+B;QACzC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,CAAC;QAC3D,MAAM,IAAI,CAAC,gBAAgB,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,IAAI,CAAC,iBAAiB,CAAC,qDAAqD,CAAC,CAAC;QAEpF,uBAAuB;QACvB,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,IAAI,CAAC,iBAAiB,CAAC,4CAA4C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC3F,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,+BAA+B;IAEvB,KAAK,CAAC,gBAAgB;QAC5B,MAAM,KAAK,GAAG,kBAAkB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,eAAe,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACrH,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;QAE/C,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;YAEhC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE;gBAC/B,IAAI,CAAC,iBAAiB,GAAG,CAAC,CAAC;gBAE3B,IAAI,WAAW,EAAE,CAAC;oBAChB,IAAI,CAAC,mBAAmB,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;wBAChD,MAAM,CAAC,IAAI,CAAC,oDAAoD,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjF,CAAC,CAAC,CAAC;gBACL,CAAC;gBAED,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE;gBACvC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;oBACpE,MAAM,CAAC,KAAK,CAAC,2CAA2C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACzE,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;gBAChC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACjB,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBAC3B,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;gBAChC,IAAI,IAAI,CAAC,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBAC7C,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC;gBACnD,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACf,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,mBAAmB;QAC/B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,OAAO,eAAe,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACtF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO;YACrB,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAc,CAAC;YAClD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;YACzC,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gDAAgD;QAClD,CAAC;IACH,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAEzB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CACpB,eAAe,CAAC,uBAAuB,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,iBAAiB,CAAC,EAC/E,eAAe,CAAC,sBAAsB,CACvC,CAAC;QAEF,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;oBACjC,+CAA+C;gBACjD,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC,EAAE,KAAK,CAAC,CAAC;IACZ,CAAC;IAED,0BAA0B;IAElB,KAAK,CAAC,qBAAqB,CAAC,IAAY;QAC9C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ;YAAE,OAAO;QAEtB,+DAA+D;QAC/D,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;YAAE,OAAO;QAEvE,uDAAuD;QACvD,MAAM,EAAE,GAAG,QAAQ,CAAC,WAAW,EAAE,SAAS,CAAC;QAC3C,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,OAAO;YAC1C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9B,6CAA6C;YAC7C,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;gBACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAC1C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;oBACtC,IAAI,CAAC,GAAG,MAAM;wBAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;YAAE,OAAO;QAEtD,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,iEAAiE;QACjE,IAAI,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC;YAAE,OAAO;QAE7C,gDAAgD;QAChD,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;YAAE,OAAO;QAE5C,sCAAsC;QACtC,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,cAAc,CAAC,IAAY;QACvC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,IAAI,CAAC,iBAAiB,CAAC,mDAAmD,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,IAAI,CAAC,iBAAiB,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;gBACjE,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;QACnC,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;gBACzC,MAAM,IAAI,CAAC,iBAAiB,CAC1B,6BAA6B,KAAK,CAAC,OAAO,IAAI;oBAC5C,mBAAmB,CAAC,MAAM,CAAC;oBAC3B,IAAI;oBACJ,8CAA8C,CACjD,CAAC;gBACF,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,MAAM,IAAI,CAAC,iBAAiB,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,4BAA4B;IAE5B;;;;OAIG;IACK,KAAK,CAAC,eAAe;QAC3B,MAAM,SAAS,GAAG,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC;QAEjC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC;YAClC,MAAM;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,SAAS,CAAC,uBAAuB,EAAE;YACjD,mBAAmB,EAAE,SAAS,CAAC,8BAA8B,EAAE;YAC/D,YAAY,EAAE,SAAS,CAAC,uBAAuB,EAAE;SAClD,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC;QAE7B,0DAA0D;QAC1D,+CAA+C;QAC/C,SAAS;aACN,GAAG,CAAC,OAAO,CAAC;aACZ,IAAI,CAAC,GAAG,EAAE;YACT,qCAAqC;YACrC,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBACvC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,MAAM,CAAC,KAAK,CAAC,oCAAoC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEL,MAAM,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;IACzD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC;QACvC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAChC,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;QAEjC,+DAA+D;QAC/D,SAAS,EAAE,KAAK,EAAE,CAAC;QACnB,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,8BAA8B;IAE9B;;;;;;;OAOG;IACK,qBAAqB,CAAC,IAAY;QACxC,IAAI,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QAEnE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,UAAU,CAAC;QACxE,MAAM,MAAM,GAAG,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,OAAO,CAAC;QAC/D,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAExC,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC7B,IAAI,CAAC,iBAAiB,CAAC,8CAA8C,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACvF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAE,UAAoB,CAAC,CAAC,CAAE,QAAkB,CAAC;QACzE,MAAM,YAAY,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAC9C,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAEhC,IAAI,CAAC,aAAa;aACf,iBAAiB,CAAC,YAAY,EAAE,QAAQ,CAAC;aACzC,IAAI,CAAC,GAAG,EAAE;YACT,OAAO,IAAI,CAAC,iBAAiB,CAAC,cAAc,QAAQ,GAAG,CAAC,CAAC;QAC3D,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;YACjC,IAAI,IAAI,CAAC,mBAAmB,KAAK,YAAY,EAAE,CAAC;gBAC9C,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;YAClC,CAAC;QACH,CAAC,CAAC,CAAC;QAEL,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gFAAgF;IAChF,oBAAoB,CAAC,YAAoB;QACvC,IAAI,CAAC,mBAAmB,GAAG,YAAY,CAAC;IAC1C,CAAC;IAED,mEAAmE;IACnE,sBAAsB;QACpB,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAClC,CAAC;IAED,2BAA2B;IAEnB,oBAAoB,CAAC,IAAY;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAE1C,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,OAAO,CAAC;YACb,KAAK,OAAO,CAAC;YACb,KAAK,MAAM;gBACT,IAAI,CAAC,iBAAiB,EAAE;qBACrB,IAAI,CAAC,GAAG,EAAE;oBACT,IAAI,CAAC,iBAAiB,CAAC,mDAAmD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC9F,CAAC,CAAC;qBACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACnB,OAAO,IAAI,CAAC;YAEd,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;oBACxB,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;oBAC7D,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC;gBACpD,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,KAAK,OAAO;gBACV,IAAI,CAAC,iBAAiB,CACpB,aAAa;oBACX,yCAAyC;oBACzC,mCAAmC;oBACnC,+BAA+B;oBAC/B,sDAAsD;oBACtD,2CAA2C,CAC9C,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAClB,OAAO,IAAI,CAAC;YAEd;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAED,gCAAgC;IAEhC;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,oBAAoB,CAAC,QAAwB;QACjD,oDAAoD;QACpD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,eAAe,GAAG,cAAc,EAAE,CAAC;gBACzC,MAAM,WAAW,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;gBACzD,IAAI,WAAW,IAAI,WAAW,CAAC,oBAAoB,KAAK,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;oBACzF,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;oBAC7E,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC;oBAC1B,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC;gBAC9B,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,IAAI,CAAC,cAAc;gBAAE,OAAO,IAAI,CAAC;QACvC,CAAC;QAED,8CAA8C;QAC9C,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC/B,IAAI,CAAC,aAAa,CAAC,iDAAiD,CAAC,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,+DAA+D;QAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,mBAAmB,GAAG,0BAA0B,EAAE,CAAC;YAChE,OAAO,KAAK,CAAC,CAAC,4BAA4B;QAC5C,CAAC;QAED,IAAI,CAAC;YACH,kEAAkE;YAClE,+DAA+D;YAC/D,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,kBAAkB,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACvG,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;gBACb,iDAAiD;gBACjD,gEAAgE;gBAChE,MAAM,CAAC,KAAK,CACV,+CAA+C,IAAI,CAAC,MAAM,IAAI;oBAC5D,qEAAqE,CACxE,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAmD,CAAC;YACzF,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACnF,oEAAoE;YACpE,MAAM,SAAS,GAAG,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;gBAChE,IAAI,CAAC,aAAa,CAChB,0BAA0B;oBACxB,eAAe,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO;oBACvE,eAAe,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CACjD,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,+DAA+D;YAC/D,IAAI,CAAC,mBAAmB,GAAG,GAAG,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;YAC9D,gEAAgE;YAChE,MAAM,CAAC,KAAK,CACV,kDAAkD;gBAChD,qEAAqE,CACxE,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,aAAa,CAAC,MAAc;QAClC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,MAAM,CAAC,KAAK,CACV,2BAA2B,MAAM,IAAI;YACnC,+BAA+B,IAAI,CAAC,MAAM,CAAC,eAAe,iBAAiB;YAC3E,gEAAgE;YAChE,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IAED,0BAA0B;IAE1B,KAAK,CAAC,iBAAiB,CAAC,IAAY;QAClC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;QAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAY;QACpC,MAAM,IAAI,GAA4B;YACpC,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAC7B,UAAU,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;YACzC,SAAS,EAAE,QAAQ;SACpB,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,UAAU,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;;AAGH,6CAA6C;AAE7C,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/D,mCAAmC;QACnC,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAmB,CAAC;QAC/D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAwB,EAAE,eAAuB;IAClF,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,IAAI,QAAQ,CAAC,MAAM,CAAC;IACxD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,oBAAoB,CAAC,MAAM,CAAC,KAAK,oBAAoB,CAAC,eAAe,CAAC,CAAC;AAChF,CAAC"}

package/dist/signal/signal-config.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Signal transport configuration types and resolution.
+ *
+ * SignalConfig is the raw shape stored in config.json (all fields optional).
+ * ResolvedSignalConfig has all fields present with defaults applied.
+ * resolveSignalConfig() bridges the two, returning null when Signal
+ * is not configured (missing required fields).
+ */
+/** Signal transport configuration as stored in the config file. */
+export interface SignalConfig {
+    /** The bot's registered Signal phone number (e.g., '+15551234567'). */
+    botNumber?: string;
+    /** The user's Signal phone number to send messages to. */
+    recipientNumber?: string;
+    /**
+     * The user's Signal identity key fingerprint, captured during onboarding.
+     * Used to detect identity changes (SIM swap, number reassignment).
+     */
+    recipientIdentityKey?: string;
+    /** Container configuration overrides. */
+    container?: {
+        /** Docker image. Default: 'bbernhard/signal-cli-rest-api:latest' */
+        image?: string;
+        /** Host port for REST API. Default: 18080 */
+        port?: number;
+    };
+}
+/** Resolved Signal config with all fields present. */
+export interface ResolvedSignalConfig {
+    readonly botNumber: string;
+    readonly recipientNumber: string;
+    readonly recipientIdentityKey: string;
+    readonly container: {
+        readonly image: string;
+        readonly port: number;
+        readonly dataDir: string;
+        readonly containerName: string;
+    };
+}
+export declare const SIGNAL_DEFAULTS: {
+    readonly image: "bbernhard/signal-cli-rest-api:latest";
+    readonly port: 18080;
+    readonly containerName: "ironcurtain-signal";
+};
+/** Returns the host directory for signal-cli persistent data. */
+export declare function getSignalDataDir(): string;
+/**
+ * Minimal shape needed to resolve Signal config.
+ * Accepts both UserConfig (partial signal) and ResolvedUserConfig
+ * (where signal is ResolvedSignalConfig | null).
+ */
+interface HasSignalConfig {
+    signal?: SignalConfig | ResolvedSignalConfig | null | undefined;
+}
+/**
+ * Resolves Signal config from user config, applying defaults.
+ * Returns null when Signal is not configured (missing required fields).
+ *
+ * Accepts both raw UserConfig (from Zod parse) and ResolvedUserConfig
+ * (from loadUserConfig). When the input is already resolved, returns
+ * it directly.
+ */
+export declare function resolveSignalConfig(config: HasSignalConfig): ResolvedSignalConfig | null;
+export {};

package/dist/signal/signal-config.js

@@ -0,0 +1,53 @@
+/**
+ * Signal transport configuration types and resolution.
+ *
+ * SignalConfig is the raw shape stored in config.json (all fields optional).
+ * ResolvedSignalConfig has all fields present with defaults applied.
+ * resolveSignalConfig() bridges the two, returning null when Signal
+ * is not configured (missing required fields).
+ */
+import { resolve } from 'node:path';
+import { getIronCurtainHome } from '../config/paths.js';
+export const SIGNAL_DEFAULTS = {
+    image: 'bbernhard/signal-cli-rest-api:latest',
+    port: 18080,
+    containerName: 'ironcurtain-signal',
+};
+/** Returns the host directory for signal-cli persistent data. */
+export function getSignalDataDir() {
+    return resolve(getIronCurtainHome(), 'signal-data');
+}
+/**
+ * Resolves Signal config from user config, applying defaults.
+ * Returns null when Signal is not configured (missing required fields).
+ *
+ * Accepts both raw UserConfig (from Zod parse) and ResolvedUserConfig
+ * (from loadUserConfig). When the input is already resolved, returns
+ * it directly.
+ */
+export function resolveSignalConfig(config) {
+    const signal = config.signal;
+    if (!signal)
+        return null;
+    // If already resolved (has container.dataDir), return as-is
+    if ('container' in signal && signal.container && 'dataDir' in signal.container) {
+        return signal;
+    }
+    // Raw config - resolve with defaults
+    const raw = signal;
+    if (!raw.botNumber || !raw.recipientNumber || !raw.recipientIdentityKey) {
+        return null;
+    }
+    return {
+        botNumber: raw.botNumber,
+        recipientNumber: raw.recipientNumber,
+        recipientIdentityKey: raw.recipientIdentityKey,
+        container: {
+            image: raw.container?.image ?? SIGNAL_DEFAULTS.image,
+            port: raw.container?.port ?? SIGNAL_DEFAULTS.port,
+            dataDir: getSignalDataDir(),
+            containerName: SIGNAL_DEFAULTS.containerName,
+        },
+    };
+}
+//# sourceMappingURL=signal-config.js.map

package/dist/signal/signal-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signal-config.js","sourceRoot":"","sources":["../../src/signal/signal-config.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAkCxD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,KAAK,EAAE,sCAAsC;IAC7C,IAAI,EAAE,KAAK;IACX,aAAa,EAAE,oBAAoB;CAC3B,CAAC;AAEX,iEAAiE;AACjE,MAAM,UAAU,gBAAgB;IAC9B,OAAO,OAAO,CAAC,kBAAkB,EAAE,EAAE,aAAa,CAAC,CAAC;AACtD,CAAC;AAWD;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAuB;IACzD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,4DAA4D;IAC5D,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAC/E,OAAO,MAA8B,CAAC;IACxC,CAAC;IAED,qCAAqC;IACrC,MAAM,GAAG,GAAG,MAAsB,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;QAC9C,SAAS,EAAE;YACT,KAAK,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,IAAI,eAAe,CAAC,KAAK;YACpD,IAAI,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,IAAI,eAAe,CAAC,IAAI;YACjD,OAAO,EAAE,gBAAgB,EAAE;YAC3B,aAAa,EAAE,eAAe,CAAC,aAAa;SAC7C;KACF,CAAC;AACJ,CAAC"}