@provos/ironcurtain 0.3.1 → 0.4.1

package/dist/signal/setup-signal.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Interactive Signal onboarding wizard.
+ *
+ * Implements `ironcurtain setup-signal` with two modes:
+ * - Full setup: Docker check, container start, registration,
+ *   recipient identity verification, and config save.
+ * - Re-trust (`--re-trust`): Re-verify a changed identity key without
+ *   repeating the full registration flow.
+ *
+ * Uses @clack/prompts for consistent terminal UI with other IronCurtain
+ * interactive commands (config, first-start).
+ */
+/** Validates a phone number in E.164 format. Returns error string or undefined. */
+export declare function validatePhoneNumber(value: string | undefined): string | undefined;
+/**
+ * Registers a new phone number with Signal via the signal-cli REST API.
+ * Handles the captcha and SMS verification code flow.
+ */
+export declare function registerNewNumber(baseUrl: string): Promise<string>;
+/**
+ * Sends a random challenge code to the recipient via Signal,
+ * waits for the user to type it into the terminal, then
+ * captures and returns the recipient's identity key.
+ *
+ * The identity key comes from signal-cli's identity endpoint
+ * after a successful message exchange has occurred.
+ */
+export declare function verifyRecipientIdentity(baseUrl: string, botNumber: string, recipientNumber: string): Promise<string>;
+/**
+ * Re-verifies a changed identity key without repeating full registration.
+ * Used when the transport detects an identity key change at runtime.
+ */
+export declare function runReTrust(): Promise<void>;
+/**
+ * Runs the interactive Signal setup wizard.
+ *
+ * Steps:
+ * 1. Validate Docker availability
+ * 2. Pull and start signal-cli container
+ * 3. Register new number (or reuse existing account)
+ * 4. Configure recipient number
+ * 5. Challenge-response identity verification
+ * 6. Capture and store identity key
+ * 7. Save config
+ */
+export declare function runSignalSetup(options?: {
+    reTrust?: boolean;
+}): Promise<void>;

package/dist/signal/setup-signal.js

@@ -0,0 +1,443 @@
+/**
+ * Interactive Signal onboarding wizard.
+ *
+ * Implements `ironcurtain setup-signal` with two modes:
+ * - Full setup: Docker check, container start, registration,
+ *   recipient identity verification, and config save.
+ * - Re-trust (`--re-trust`): Re-verify a changed identity key without
+ *   repeating the full registration flow.
+ *
+ * Uses @clack/prompts for consistent terminal UI with other IronCurtain
+ * interactive commands (config, first-start).
+ */
+import { randomInt } from 'node:crypto';
+import { exec as execCb } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { promisify } from 'node:util';
+import * as p from '@clack/prompts';
+import { createDockerManager } from '../docker/docker-manager.js';
+import { saveUserConfig, loadUserConfig } from '../config/user-config.js';
+import { createSignalContainerManager, } from './signal-container.js';
+import { SIGNAL_DEFAULTS, resolveSignalConfig, getSignalDataDir } from './signal-config.js';
+const execAsync = promisify(execCb);
+// ---- Cancel handling ------------------------------------------------
+/** Checks if a prompt result was cancelled and exits cleanly. */
+function handleCancel(value) {
+    if (p.isCancel(value)) {
+        p.cancel('Setup cancelled.');
+        process.exit(0);
+    }
+}
+// ---- Phone number validation ----------------------------------------
+const E164_REGEX = /^\+\d{7,15}$/;
+/** Validates a phone number in E.164 format. Returns error string or undefined. */
+export function validatePhoneNumber(value) {
+    if (!value)
+        return 'Phone number is required';
+    if (!E164_REGEX.test(value)) {
+        return 'Must be E.164 format: +<country code><number> (e.g., +15551234567)';
+    }
+    return undefined;
+}
+// ---- Docker validation ----------------------------------------------
+async function validateDocker(docker) {
+    const spinner = p.spinner();
+    spinner.start('Checking Docker...');
+    try {
+        await docker.preflight(SIGNAL_DEFAULTS.image);
+        spinner.stop('Docker is available');
+    }
+    catch {
+        // preflight checks both docker info and image -- we only need docker info here
+        try {
+            // Check if Docker daemon is reachable at all
+            await execAsync('docker info', { timeout: 10_000 });
+            spinner.stop('Docker is available');
+        }
+        catch {
+            spinner.stop('Docker is not available');
+            p.log.error('Docker is not available. Start Docker and try again.\n\n' +
+                'Install Docker: https://docs.docker.com/get-docker/');
+            process.exit(1);
+        }
+    }
+}
+// ---- Container setup ------------------------------------------------
+function resolveContainerConfig() {
+    return {
+        image: SIGNAL_DEFAULTS.image,
+        port: SIGNAL_DEFAULTS.port,
+        dataDir: getSignalDataDir(),
+        containerName: SIGNAL_DEFAULTS.containerName,
+    };
+}
+async function startContainer(manager, containerConfig) {
+    const startSpinner = p.spinner();
+    startSpinner.start('Starting signal-cli container (pulling image if needed)...');
+    try {
+        const baseUrl = await manager.ensureRunning();
+        startSpinner.stop(`Container started on port ${containerConfig.port}`);
+        const healthSpinner = p.spinner();
+        healthSpinner.start('Waiting for signal-cli to become healthy...');
+        try {
+            await manager.waitForHealthy(baseUrl);
+            healthSpinner.stop('Health check passed');
+        }
+        catch (err) {
+            healthSpinner.stop('Health check failed');
+            p.log.error(`signal-cli container did not become healthy: ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(1);
+        }
+        return baseUrl;
+    }
+    catch (err) {
+        startSpinner.stop('Container start failed');
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes('port') && message.includes('already')) {
+            p.log.error(`Port ${containerConfig.port} is already in use.\n` +
+                'Either stop the conflicting service or configure a different port\n' +
+                'in ~/.ironcurtain/config.json under signal.container.port.');
+        }
+        else {
+            p.log.error(`Failed to start container: ${message}`);
+        }
+        process.exit(1);
+    }
+}
+// ---- Account discovery -----------------------------------------------
+async function fetchAccounts(baseUrl) {
+    try {
+        const resp = await fetch(`${baseUrl}/v1/accounts`);
+        if (!resp.ok)
+            return [];
+        const accounts = (await resp.json());
+        if (accounts.length > 0)
+            return accounts;
+    }
+    catch {
+        // Fall through to local check
+    }
+    // Fallback: in json-rpc mode, signal-cli loads accounts at startup.
+    // If registration happened after the container started, the REST API
+    // won't know about the account until a restart. Check the host data
+    // directory directly.
+    return readAccountsFromDataDir();
+}
+/**
+ * Reads accounts directly from signal-cli's accounts.json on the host.
+ * This catches accounts the REST API doesn't see (json-rpc mode startup race).
+ */
+function readAccountsFromDataDir() {
+    try {
+        const accountsPath = resolve(getSignalDataDir(), 'data', 'accounts.json');
+        const data = JSON.parse(readFileSync(accountsPath, 'utf-8'));
+        return (data.accounts ?? []).map((a) => a.number).filter((n) => !!n);
+    }
+    catch {
+        return [];
+    }
+}
+// ---- Registration flow ----------------------------------------------
+/**
+ * Registers a new phone number with Signal via the signal-cli REST API.
+ * Handles the captcha and SMS verification code flow.
+ */
+export async function registerNewNumber(baseUrl) {
+    const phoneNumber = await p.text({
+        message: 'Enter the phone number to register (with country code):',
+        placeholder: '+15551234567',
+        validate: validatePhoneNumber,
+    });
+    handleCancel(phoneNumber);
+    // Direct the user to the captcha page
+    const captchaUrl = 'https://signalcaptchas.org/registration/generate.html';
+    p.log.info('To complete registration, Signal requires a captcha.\n' +
+        'Open this URL in your browser:\n\n' +
+        `  ${captchaUrl}\n\n` +
+        'After completing the captcha, right-click the "Open Signal"\n' +
+        'button and copy the link. It will start with signalcaptcha://\n' +
+        'Paste the full link below.');
+    const captchaRaw = await p.text({
+        message: 'Paste the captcha link:',
+        validate: (v) => (v?.includes('signalcaptcha://') ? undefined : 'Must contain signalcaptcha://'),
+    });
+    handleCancel(captchaRaw);
+    // Strip the signalcaptcha:// prefix - signal-cli expects just the token
+    const captcha = captchaRaw.replace(/^signalcaptcha:\/\//, '');
+    // POST /v1/register/{number}
+    const registerSpinner = p.spinner();
+    registerSpinner.start(`Registering ${phoneNumber}...`);
+    const registerResp = await fetch(`${baseUrl}/v1/register/${encodeURIComponent(phoneNumber)}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ captcha }),
+    });
+    if (!registerResp.ok) {
+        registerSpinner.stop('Registration failed');
+        const body = await registerResp.text();
+        if (registerResp.status === 400) {
+            p.log.error(`Captcha rejected by Signal. Please try again with a new captcha.\n` + `Server response: ${body}`);
+        }
+        else {
+            p.log.error(`Registration failed: ${registerResp.status} ${body}`);
+        }
+        throw new Error(`Registration failed: ${registerResp.status} ${body}`);
+    }
+    registerSpinner.stop('Registration request sent');
+    // SMS verification code
+    const verifyCode = await p.text({
+        message: 'Enter the verification code from SMS:',
+        validate: (v) => (v && /^\d{3}-?\d{3}$/.test(v) ? undefined : 'Enter 6-digit code (e.g., 123-456)'),
+    });
+    handleCancel(verifyCode);
+    const normalizedCode = verifyCode.replace('-', '');
+    // POST /v1/register/{number}/verify/{code}
+    const verifySpinner = p.spinner();
+    verifySpinner.start('Verifying...');
+    const verifyResp = await fetch(`${baseUrl}/v1/register/${encodeURIComponent(phoneNumber)}/verify/${normalizedCode}`, { method: 'POST' });
+    if (!verifyResp.ok) {
+        verifySpinner.stop('Verification failed');
+        const body = await verifyResp.text();
+        p.log.error(`Verification failed: ${verifyResp.status} ${body}`);
+        throw new Error(`Verification failed: ${verifyResp.status} ${body}`);
+    }
+    verifySpinner.stop('Phone number verified!');
+    return phoneNumber;
+}
+/**
+ * Sends a random challenge code to the recipient via Signal,
+ * waits for the user to type it into the terminal, then
+ * captures and returns the recipient's identity key.
+ *
+ * The identity key comes from signal-cli's identity endpoint
+ * after a successful message exchange has occurred.
+ */
+export async function verifyRecipientIdentity(baseUrl, botNumber, recipientNumber) {
+    const challengeCode = String(randomInt(100000, 999999));
+    // Send the challenge via Signal
+    p.log.info('A 6-digit challenge code has been sent to your Signal app.');
+    const sendResp = await fetch(`${baseUrl}/v2/send`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            message: `IronCurtain identity verification.\nYour challenge code is: ${challengeCode}`,
+            number: botNumber,
+            recipients: [recipientNumber],
+        }),
+    });
+    if (!sendResp.ok) {
+        throw new Error(`Failed to send challenge message: ${sendResp.status}`);
+    }
+    // Prompt user to enter the code they received
+    let attempts = 0;
+    const maxAttempts = 3;
+    while (attempts < maxAttempts) {
+        const entered = await p.text({
+            message: 'Enter the challenge code from your Signal app:',
+            validate: (v) => (v && /^\d{6}$/.test(v) ? undefined : 'Enter the 6-digit code'),
+        });
+        handleCancel(entered);
+        if (entered === challengeCode) {
+            break;
+        }
+        attempts++;
+        if (attempts >= maxAttempts) {
+            throw new Error('Challenge verification failed after 3 attempts. ' +
+                'Ensure you are reading the code from the correct Signal conversation.');
+        }
+        p.log.warn(`Incorrect code. ${maxAttempts - attempts} attempt(s) remaining.`);
+    }
+    // Capture the recipient's identity key from signal-cli
+    return fetchIdentityKey(baseUrl, botNumber, recipientNumber);
+}
+/**
+ * Fetches the recipient's identity key from signal-cli's trust store.
+ * Retries once after a short delay if the key is not yet available
+ * (signal-cli may need time to process the message exchange).
+ */
+async function fetchIdentityKey(baseUrl, botNumber, recipientNumber) {
+    const fetchKey = async () => {
+        // The per-recipient endpoint (/v1/identities/{bot}/{recipient}) is not
+        // available in all versions. Use the all-identities endpoint and filter.
+        const resp = await fetch(`${baseUrl}/v1/identities/${encodeURIComponent(botNumber)}`);
+        if (!resp.ok)
+            return null;
+        const identities = (await resp.json());
+        const match = identities.find((id) => id.number === recipientNumber);
+        if (!match)
+            return null;
+        // Fingerprint may contain spaces (e.g., "05 a1 b2 ...") - normalize to compact hex
+        return match.fingerprint.replace(/\s+/g, '');
+    };
+    let fingerprint = await fetchKey();
+    if (!fingerprint) {
+        // Retry after a short delay - signal-cli may still be processing
+        await new Promise((resolve) => setTimeout(resolve, 2000));
+        fingerprint = await fetchKey();
+    }
+    if (!fingerprint) {
+        throw new Error('Identity key could not be retrieved. ' +
+            'This may indicate signal-cli has not yet exchanged keys with the recipient.');
+    }
+    p.log.success(`Identity verified! Signal identity key recorded.\n` + `  Fingerprint: ${fingerprint.substring(0, 20)}...`);
+    return fingerprint;
+}
+// ---- Re-trust flow --------------------------------------------------
+/**
+ * Re-verifies a changed identity key without repeating full registration.
+ * Used when the transport detects an identity key change at runtime.
+ */
+export async function runReTrust() {
+    p.intro('Signal Identity Re-verification');
+    const userConfig = loadUserConfig();
+    const signalConfig = resolveSignalConfig(userConfig);
+    if (!signalConfig) {
+        p.log.error('Signal is not configured. Run: ironcurtain setup-signal');
+        process.exit(1);
+    }
+    const { botNumber, recipientNumber, recipientIdentityKey: previousKey } = signalConfig;
+    const baseUrl = `http://127.0.0.1:${signalConfig.container.port}`;
+    p.note(`The Signal identity key for ${recipientNumber} has changed.\n` +
+        'This can happen when:\n' +
+        '  - You re-installed Signal\n' +
+        '  - You switched to a new phone\n' +
+        '  - Someone else has taken over the phone number\n\n' +
+        'To re-establish trust, a new challenge code will be sent.', 'Identity changed');
+    // Verify the container is running before attempting to send
+    const docker = createDockerManager();
+    const containerManager = createSignalContainerManager(docker, signalConfig.container);
+    if (!(await containerManager.isRunning())) {
+        const startSpinner = p.spinner();
+        startSpinner.start('Starting signal-cli container...');
+        try {
+            await containerManager.ensureRunning();
+            await containerManager.waitForHealthy(baseUrl);
+            startSpinner.stop('Container started');
+        }
+        catch (err) {
+            startSpinner.stop('Failed to start container');
+            p.log.error(`Could not start signal-cli container: ${err instanceof Error ? err.message : String(err)}`);
+            process.exit(1);
+        }
+    }
+    const newKey = await verifyRecipientIdentity(baseUrl, botNumber, recipientNumber);
+    // Save the new identity key
+    saveUserConfig({
+        signal: {
+            botNumber,
+            recipientNumber,
+            recipientIdentityKey: newKey,
+        },
+    });
+    p.note(`Previous key: ${previousKey.substring(0, 20)}...\n` + `New key:      ${newKey.substring(0, 20)}...`, 'Key updated');
+    p.outro('Transport unlocked. Sessions will now accept messages.');
+}
+// ---- Main setup wizard ----------------------------------------------
+/**
+ * Runs the interactive Signal setup wizard.
+ *
+ * Steps:
+ * 1. Validate Docker availability
+ * 2. Pull and start signal-cli container
+ * 3. Register new number (or reuse existing account)
+ * 4. Configure recipient number
+ * 5. Challenge-response identity verification
+ * 6. Capture and store identity key
+ * 7. Save config
+ */
+export async function runSignalSetup(options) {
+    if (options?.reTrust) {
+        await runReTrust();
+        return;
+    }
+    p.intro('Signal Transport Setup');
+    p.note('Signal lets you interact with IronCurtain sessions from your\n' +
+        'phone. The communication channel is end-to-end encrypted and\n' +
+        'securely paired between the bot and your phone.\n\n' +
+        "You'll need:\n" +
+        '  - Docker running on this machine\n' +
+        '  - A dedicated phone number for the bot\n' +
+        '  - Your own Signal phone number (to receive messages)', 'What is this?');
+    const cont = await p.confirm({ message: 'Continue with setup?', initialValue: true });
+    handleCancel(cont);
+    if (!cont) {
+        p.cancel('Setup cancelled.');
+        process.exit(0);
+    }
+    // Step 1: Docker check
+    const docker = createDockerManager();
+    await validateDocker(docker);
+    // Step 2: Pull image and start container
+    const containerConfig = resolveContainerConfig();
+    const manager = createSignalContainerManager(docker, containerConfig);
+    const baseUrl = await startContainer(manager, containerConfig);
+    // Step 3: Check for existing accounts, then register
+    let botNumber;
+    const existingAccounts = await fetchAccounts(baseUrl);
+    if (existingAccounts.length > 0) {
+        const useExisting = await p.select({
+            message: `Found existing account: ${existingAccounts.join(', ')}. What would you like to do?`,
+            options: [
+                { value: 'use', label: `Use ${existingAccounts[0]}`, hint: 'skip registration' },
+                { value: 'register', label: 'Register a new phone number' },
+            ],
+        });
+        handleCancel(useExisting);
+        if (useExisting === 'use') {
+            botNumber = existingAccounts[0];
+            p.log.success(`Using existing account: ${botNumber}`);
+        }
+        else {
+            botNumber = await registerNewNumber(baseUrl);
+        }
+    }
+    else {
+        botNumber = await registerNewNumber(baseUrl);
+    }
+    // In json-rpc mode, signal-cli loads accounts at startup. After registration
+    // or when the account was found only in the data directory, restart the
+    // container so the daemon picks up the account for subsequent API calls.
+    const restartSpinner = p.spinner();
+    restartSpinner.start('Restarting signal-cli to load account...');
+    try {
+        await docker.stop(containerConfig.containerName);
+        await docker.start(containerConfig.containerName);
+        await manager.waitForHealthy(baseUrl);
+        restartSpinner.stop('signal-cli restarted');
+    }
+    catch (err) {
+        restartSpinner.stop('Restart failed');
+        p.log.error(`Failed to restart container: ${err instanceof Error ? err.message : String(err)}`);
+        process.exit(1);
+    }
+    // Step 4: Recipient number
+    const recipientNumber = await p.text({
+        message: 'Enter YOUR Signal phone number (to receive agent messages):',
+        placeholder: '+15559876543',
+        validate: validatePhoneNumber,
+    });
+    handleCancel(recipientNumber);
+    // Step 5: Challenge-response identity verification
+    const identityKey = await verifyRecipientIdentity(baseUrl, botNumber, recipientNumber);
+    // Step 6: Save config
+    saveUserConfig({
+        signal: {
+            botNumber,
+            recipientNumber: recipientNumber,
+            recipientIdentityKey: identityKey,
+            container: {
+                image: containerConfig.image,
+                port: containerConfig.port,
+            },
+        },
+    });
+    // Summary
+    p.note(`Bot number:       ${botNumber}\n` +
+        `Your number:      ${recipientNumber}\n` +
+        `Identity key:     ${identityKey.substring(0, 20)}...\n` +
+        `Container:        ${containerConfig.containerName}\n` +
+        `API port:         ${containerConfig.port}`, 'Configuration saved');
+    p.outro('Setup complete. Run: ironcurtain bot');
+}
+//# sourceMappingURL=setup-signal.js.map

package/dist/signal/setup-signal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-signal.js","sourceRoot":"","sources":["../../src/signal/setup-signal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1E,OAAO,EACL,4BAA4B,GAG7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAG5F,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;AAEpC,wEAAwE;AAExE,iEAAiE;AACjE,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,wEAAwE;AAExE,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,0BAA0B,CAAC;IAC9C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,oEAAoE,CAAC;IAC9E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wEAAwE;AAExE,KAAK,UAAU,cAAc,CAAC,MAAqB;IACjD,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAEpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,+EAA+E;QAC/E,IAAI,CAAC;YACH,6CAA6C;YAC7C,MAAM,SAAS,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;YACxC,CAAC,CAAC,GAAG,CAAC,KAAK,CACT,0DAA0D;gBACxD,qDAAqD,CACxD,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;AACH,CAAC;AAED,wEAAwE;AAExE,SAAS,sBAAsB;IAC7B,OAAO;QACL,KAAK,EAAE,eAAe,CAAC,KAAK;QAC5B,IAAI,EAAE,eAAe,CAAC,IAAI;QAC1B,OAAO,EAAE,gBAAgB,EAAE;QAC3B,aAAa,EAAE,eAAe,CAAC,aAAa;KAC7C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAA+B,EAC/B,eAAsC;IAEtC,MAAM,YAAY,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IACjC,YAAY,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;IACjF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,aAAa,EAAE,CAAC;QAC9C,YAAY,CAAC,IAAI,CAAC,6BAA6B,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAEvE,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QAClC,aAAa,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACtC,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,gDAAgD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,YAAY,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAEjE,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,CAAC,CAAC,GAAG,CAAC,KAAK,CACT,QAAQ,eAAe,CAAC,IAAI,uBAAuB;gBACjD,qEAAqE;gBACrE,4DAA4D,CAC/D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,KAAK,UAAU,aAAa,CAAC,OAAe;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAa,CAAC;QACjD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;IAED,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,sBAAsB;IACtB,OAAO,uBAAuB,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB;IAC9B,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,OAAO,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAE1D,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wEAAwE;AAExE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe;IACrD,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;QAC/B,OAAO,EAAE,yDAAyD;QAClE,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,mBAAmB;KAC9B,CAAC,CAAC;IACH,YAAY,CAAC,WAAW,CAAC,CAAC;IAE1B,sCAAsC;IACtC,MAAM,UAAU,GAAG,uDAAuD,CAAC;IAC3E,CAAC,CAAC,GAAG,CAAC,IAAI,CACR,wDAAwD;QACtD,oCAAoC;QACpC,KAAK,UAAU,MAAM;QACrB,+DAA+D;QAC/D,iEAAiE;QACjE,4BAA4B,CAC/B,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;QAC9B,OAAO,EAAE,yBAAyB;QAClC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,+BAA+B,CAAC;KACjG,CAAC,CAAC;IACH,YAAY,CAAC,UAAU,CAAC,CAAC;IAEzB,wEAAwE;IACxE,MAAM,OAAO,GAAI,UAAqB,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;IAE1E,6BAA6B;IAC7B,MAAM,eAAe,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IACpC,eAAe,CAAC,KAAK,CAAC,eAAe,WAAqB,KAAK,CAAC,CAAC;IAEjE,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,gBAAgB,kBAAkB,CAAC,WAAqB,CAAC,EAAE,EAAE;QACtG,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,eAAe,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;QACvC,IAAI,YAAY,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,oEAAoE,GAAG,oBAAoB,IAAI,EAAE,CAAC,CAAC;QACjH,CAAC;aAAM,CAAC;YACN,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,wBAAwB,YAAY,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,YAAY,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,eAAe,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAElD,wBAAwB;IACxB,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;QAC9B,OAAO,EAAE,uCAAuC;QAChD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oCAAoC,CAAC;KACpG,CAAC,CAAC;IACH,YAAY,CAAC,UAAU,CAAC,CAAC;IAEzB,MAAM,cAAc,GAAI,UAAqB,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAE/D,2CAA2C;IAC3C,MAAM,aAAa,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAClC,aAAa,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAEpC,MAAM,UAAU,GAAG,MAAM,KAAK,CAC5B,GAAG,OAAO,gBAAgB,kBAAkB,CAAC,WAAqB,CAAC,WAAW,cAAc,EAAE,EAC9F,EAAE,MAAM,EAAE,MAAM,EAAE,CACnB,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QACrC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,wBAAwB,UAAU,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,wBAAwB,UAAU,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,aAAa,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAC7C,OAAO,WAAqB,CAAC;AAC/B,CAAC;AAaD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,SAAiB,EACjB,eAAuB;IAEvB,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAExD,gCAAgC;IAChC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;QACjD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,+DAA+D,aAAa,EAAE;YACvF,MAAM,EAAE,SAAS;YACjB,UAAU,EAAE,CAAC,eAAe,CAAC;SAC9B,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,8CAA8C;IAC9C,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,WAAW,GAAG,CAAC,CAAC;IAEtB,OAAO,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;YAC3B,OAAO,EAAE,gDAAgD;YACzD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC;SACjF,CAAC,CAAC;QACH,YAAY,CAAC,OAAO,CAAC,CAAC;QAEtB,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;YAC9B,MAAM;QACR,CAAC;QAED,QAAQ,EAAE,CAAC;QACX,IAAI,QAAQ,IAAI,WAAW,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,kDAAkD;gBAChD,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,WAAW,GAAG,QAAQ,wBAAwB,CAAC,CAAC;IAChF,CAAC;IAED,uDAAuD;IACvD,OAAO,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,SAAiB,EAAE,eAAuB;IACzF,MAAM,QAAQ,GAAG,KAAK,IAA4B,EAAE;QAClD,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,kBAAkB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE1B,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAqB,CAAC;QAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,mFAAmF;QACnF,OAAO,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC;IAEF,IAAI,WAAW,GAAG,MAAM,QAAQ,EAAE,CAAC;IACnC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,iEAAiE;QACjE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1D,WAAW,GAAG,MAAM,QAAQ,EAAE,CAAC;IACjC,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,uCAAuC;YACrC,6EAA6E,CAChF,CAAC;IACJ,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,OAAO,CACX,oDAAoD,GAAG,kBAAkB,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAC3G,CAAC;IAEF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,wEAAwE;AAExE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,CAAC,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAE3C,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAErD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,oBAAoB,EAAE,WAAW,EAAE,GAAG,YAAY,CAAC;IACvF,MAAM,OAAO,GAAG,oBAAoB,YAAY,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAElE,CAAC,CAAC,IAAI,CACJ,+BAA+B,eAAe,iBAAiB;QAC7D,yBAAyB;QACzB,+BAA+B;QAC/B,mCAAmC;QACnC,sDAAsD;QACtD,2DAA2D,EAC7D,kBAAkB,CACnB,CAAC;IAEF,4DAA4D;IAC5D,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;QAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;QACjC,YAAY,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,gBAAgB,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,gBAAgB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAC/C,YAAY,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC/C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,yCAAyC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;IAElF,4BAA4B;IAC5B,cAAc,CAAC;QACb,MAAM,EAAE;YACN,SAAS;YACT,eAAe;YACf,oBAAoB,EAAE,MAAM;SAC7B;KACF,CAAC,CAAC;IAEH,CAAC,CAAC,IAAI,CACJ,iBAAiB,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,GAAG,iBAAiB,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,EACpG,aAAa,CACd,CAAC;IAEF,CAAC,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;AACpE,CAAC;AAED,wEAAwE;AAExE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA+B;IAClE,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,MAAM,UAAU,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IAED,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAElC,CAAC,CAAC,IAAI,CACJ,gEAAgE;QAC9D,gEAAgE;QAChE,qDAAqD;QACrD,gBAAgB;QAChB,sCAAsC;QACtC,4CAA4C;QAC5C,wDAAwD,EAC1D,eAAe,CAChB,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,YAAY,CAAC,IAAI,CAAC,CAAC;IACnB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,uBAAuB;IACvB,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAC;IACrC,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IAE7B,yCAAyC;IACzC,MAAM,eAAe,GAAG,sBAAsB,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAE/D,qDAAqD;IACrD,IAAI,SAAiB,CAAC;IAEtB,MAAM,gBAAgB,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC;YACjC,OAAO,EAAE,2BAA2B,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,8BAA8B;YAC7F,OAAO,EAAE;gBACP,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE;gBAChF,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,6BAA6B,EAAE;aAC5D;SACF,CAAC,CAAC;QACH,YAAY,CAAC,WAAW,CAAC,CAAC;QAE1B,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;YAC1B,SAAS,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,2BAA2B,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,SAAS,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,6EAA6E;IAC7E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,cAAc,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IACnC,cAAc,CAAC,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAClD,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QACtC,cAAc,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,cAAc,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACtC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,gCAAgC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,2BAA2B;IAC3B,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;QACnC,OAAO,EAAE,6DAA6D;QACtE,WAAW,EAAE,cAAc;QAC3B,QAAQ,EAAE,mBAAmB;KAC9B,CAAC,CAAC;IACH,YAAY,CAAC,eAAe,CAAC,CAAC;IAE9B,mDAAmD;IACnD,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,SAAS,EAAE,eAAyB,CAAC,CAAC;IAEjG,sBAAsB;IACtB,cAAc,CAAC;QACb,MAAM,EAAE;YACN,SAAS;YACT,eAAe,EAAE,eAAyB;YAC1C,oBAAoB,EAAE,WAAW;YACjC,SAAS,EAAE;gBACT,KAAK,EAAE,eAAe,CAAC,KAAK;gBAC5B,IAAI,EAAE,eAAe,CAAC,IAAI;aAC3B;SACF;KACF,CAAC,CAAC;IAEH,UAAU;IACV,CAAC,CAAC,IAAI,CACJ,qBAAqB,SAAS,IAAI;QAChC,qBAAqB,eAAyB,IAAI;QAClD,qBAAqB,WAAW,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO;QACxD,qBAAqB,eAAe,CAAC,aAAa,IAAI;QACtD,qBAAqB,eAAe,CAAC,IAAI,EAAE,EAC7C,qBAAqB,CACtB,CAAC;IAEF,CAAC,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;AAClD,CAAC"}

package/dist/signal/signal-bot-daemon.d.ts

@@ -0,0 +1,142 @@
+/**
+ * SignalBotDaemon - long-lived singleton managing the Signal transport.
+ *
+ * Responsibilities:
+ * - WebSocket connection to signal-cli-rest-api with reconnect + exponential backoff
+ * - Message routing: authorization, identity verification, escalation replies,
+ *   control commands, and session forwarding
+ * - Session lifecycle: creates transport+session on demand, cleans up on end
+ * - Identity verification with TTL cache (5 min), fail-closed
+ * - Escalation state with race prevention
+ * - Message sending via POST /v2/send with text_mode: "styled"
+ */
+import { type ResolvedSignalConfig } from './signal-config.js';
+import type { SessionMode } from '../session/types.js';
+import type { SignalContainerManager } from './signal-container.js';
+/**
+ * Signal message envelope received via WebSocket.
+ * Only the fields relevant to IronCurtain are typed here;
+ * the full envelope has many more fields (receipts, typing
+ * indicators, etc.) that we ignore.
+ */
+export interface SignalEnvelope {
+    /** Sender's phone number or UUID. */
+    source?: string;
+    /** Sender's phone number (may differ from source in group messages). */
+    sourceNumber?: string;
+    /** Whether the sender's identity key has changed since last seen by signal-cli. */
+    untrustedIdentity?: boolean;
+    /** The actual message content, present for data messages. */
+    dataMessage?: {
+        /** Message text. */
+        message?: string;
+        /** Timestamp of the message. */
+        timestamp?: number;
+        /** Group context, if this is a group message. */
+        groupInfo?: {
+            groupId: string;
+        };
+    };
+    /** Typing indicator events - ignored. */
+    typingMessage?: unknown;
+    /** Receipt events - ignored. */
+    receiptMessage?: unknown;
+}
+export interface SignalBotDaemonOptions {
+    readonly config: ResolvedSignalConfig;
+    readonly containerManager: SignalContainerManager;
+    readonly mode: SessionMode;
+}
+export declare class SignalBotDaemon {
+    private config;
+    private readonly containerManager;
+    private readonly mode;
+    private ws;
+    private baseUrl;
+    private closed;
+    private reconnectAttempts;
+    private static readonly MAX_RECONNECT_DELAY_MS;
+    private static readonly BASE_RECONNECT_DELAY_MS;
+    private activeSession;
+    private activeTransport;
+    private messageInFlight;
+    private pendingEscalationId;
+    private escalationResolving;
+    private identityLocked;
+    private lastIdentityCheckMs;
+    private recentTimestamps;
+    private exitResolve;
+    constructor(options: SignalBotDaemonOptions);
+    /**
+     * Starts the daemon. Returns a promise that resolves when
+     * shutdown() is called (e.g., SIGTERM/SIGINT).
+     */
+    start(): Promise<void>;
+    /**
+     * Initiates graceful shutdown. Ends the active session,
+     * closes the WebSocket, and unblocks start().
+     */
+    shutdown(): Promise<void>;
+    private connectWebSocket;
+    /**
+     * Polls GET /v1/receive/{number} to drain messages missed during
+     * a WebSocket disconnect. Uses timestamp-based deduplication to
+     * avoid processing messages that the WebSocket already delivered.
+     */
+    private drainMissedMessages;
+    private scheduleReconnect;
+    private handleIncomingMessage;
+    /**
+     * Routes a user message to the active session. Creates a new
+     * session if none exists. Handles BudgetExhaustedError by ending
+     * the exhausted session and notifying the user.
+     */
+    private routeToSession;
+    /**
+     * Creates a new session with a fresh SignalSessionTransport.
+     * Follows the same pattern as index.ts: create transport,
+     * wire callbacks, create session, start transport.
+     */
+    private startNewSession;
+    /**
+     * Ends the current session and cleans up. Awaits session.close()
+     * to ensure resources are released (sandbox, MCP connections, etc.).
+     * Guarded against re-entrance.
+     */
+    endCurrentSession(): Promise<void>;
+    /**
+     * Checks if the message is an escalation reply.
+     * Accepts: approve, deny, /approve, /deny (case-insensitive).
+     *
+     * Race condition prevention: escalationResolving flag prevents
+     * concurrent replies. pendingEscalationId is cleared in .finally()
+     * after async resolution completes, not before.
+     */
+    private handleEscalationReply;
+    /** Called by SignalSessionTransport when the session surfaces an escalation. */
+    setPendingEscalation(escalationId: string): void;
+    /** Called by SignalSessionTransport when an escalation expires. */
+    clearPendingEscalation(): void;
+    private handleControlCommand;
+    /**
+     * Checks whether the sender's Signal identity key has changed.
+     *
+     * Detection path 1: signal-cli flags the envelope with `untrustedIdentity`.
+     * Detection path 2: periodic proactive check via GET /v1/identities.
+     *   Cached with IDENTITY_CHECK_INTERVAL_MS TTL to avoid HTTP overhead
+     *   on every message.
+     *
+     * When locked, attempts self-healing by re-reading config from disk
+     * (handles the case where the user ran `--re-trust` externally).
+     *
+     * Returns true if the message should be rejected.
+     */
+    checkIdentityChanged(envelope: SignalEnvelope): Promise<boolean>;
+    private lockTransport;
+    sendSignalMessage(text: string): Promise<void>;
+    private postMessage;
+}
+export declare function parseSignalEnvelope(data: string): SignalEnvelope | null;
+/** Normalize a phone number by stripping spaces. */
+export declare function normalizePhoneNumber(number: string): string;
+export declare function isAuthorizedSender(envelope: SignalEnvelope, recipientNumber: string): boolean;