@provos/ironcurtain 0.6.0 → 0.7.1

package/dist/config/generated-readonly/compiled-policy.json

@@ -0,0 +1,468 @@
+{
+  "generatedAt": "2026-03-06T22:53:18.790Z",
+  "constitutionHash": "750295d07a6b1a5dba6ab44d3fa62b2b5a3426340ada35f2cf300b04c418b49b",
+  "inputHash": "0536def5e41fbc6f740995d8e9e211b58b4cc40ea7157d053f42ab7931b6fadc-repair",
+  "rules": [
+    {
+      "name": "allow-filesystem-reads",
+      "description": "Allow reading files, listing directories, and querying metadata anywhere on the filesystem.",
+      "principle": "Broad read access: Reading files, listing directories, and querying metadata is permitted anywhere.",
+      "if": {
+        "tool": [
+          "read_file",
+          "read_text_file",
+          "read_media_file",
+          "read_multiple_files",
+          "list_directory",
+          "list_directory_with_sizes",
+          "directory_tree",
+          "search_files",
+          "get_file_info"
+        ]
+      },
+      "then": "allow",
+      "reason": "Constitution explicitly permits reading files and listing directories anywhere on the filesystem."
+    },
+    {
+      "name": "allow-list-allowed-directories",
+      "description": "Allow querying which directories the filesystem server can access.",
+      "principle": "Broad read access: Reading files, listing directories, and querying metadata is permitted anywhere.",
+      "if": {
+        "tool": [
+          "list_allowed_directories"
+        ]
+      },
+      "then": "allow",
+      "reason": "Listing allowed directories is a read-only metadata query explicitly permitted."
+    },
+    {
+      "name": "escalate-filesystem-writes",
+      "description": "Escalate any file write, edit, or create operation for human approval.",
+      "principle": "No mutations: Any operation that creates, modifies, or deletes data must be escalated for human approval.",
+      "if": {
+        "tool": [
+          "write_file",
+          "edit_file",
+          "create_directory"
+        ]
+      },
+      "then": "escalate",
+      "reason": "Constitution requires human approval before any write or create operation."
+    },
+    {
+      "name": "escalate-filesystem-move",
+      "description": "Escalate any file move/rename operation for human approval.",
+      "principle": "No mutations: Any operation that creates, modifies, or deletes data must be escalated for human approval.",
+      "if": {
+        "tool": [
+          "move_file"
+        ]
+      },
+      "then": "escalate",
+      "reason": "Move operations modify the filesystem by deleting the source and creating the destination, requiring human approval."
+    },
+    {
+      "name": "allow-git-read-only-tools",
+      "description": "Allow reading git log, status, diff, blame, show, reflog, and changelog analysis.",
+      "principle": "The agent is allowed to read git log, status, diff, and branch information.",
+      "if": {
+        "tool": [
+          "git_log",
+          "git_status",
+          "git_diff",
+          "git_blame",
+          "git_show",
+          "git_reflog",
+          "git_changelog_analyze"
+        ]
+      },
+      "then": "allow",
+      "reason": "Constitution explicitly permits reading git log, status, diff, and branch information."
+    },
+    {
+      "name": "allow-git-set-working-dir",
+      "description": "Allow setting or clearing the git working directory for navigation.",
+      "principle": "The agent is allowed to set the git working directory for navigation.",
+      "if": {
+        "tool": [
+          "git_set_working_dir",
+          "git_clear_working_dir"
+        ]
+      },
+      "then": "allow",
+      "reason": "Constitution explicitly permits setting the git working directory for navigation."
+    },
+    {
+      "name": "allow-git-wrapup-instructions",
+      "description": "Allow querying git wrap-up workflow instructions (read-only, no side effects).",
+      "principle": "Read-only exploration: The agent may only observe and query.",
+      "if": {
+        "tool": [
+          "git_wrapup_instructions"
+        ]
+      },
+      "then": "allow",
+      "reason": "git_wrapup_instructions is a read-only query with no side effects."
+    },
+    {
+      "name": "allow-git-branch-read",
+      "description": "Allow listing git branches (read-only).",
+      "principle": "The agent is allowed to read git log, status, diff, and branch information.",
+      "if": {
+        "roles": [
+          "read-path"
+        ],
+        "tool": [
+          "git_branch"
+        ]
+      },
+      "then": "allow",
+      "reason": "Constitution permits reading branch information; listing only activates read-path role."
+    },
+    {
+      "name": "allow-git-remote-list",
+      "description": "Allow listing git remotes (read-only, no remote URL argument present).",
+      "principle": "The agent is allowed to read git log, status, diff, and branch information.",
+      "if": {
+        "roles": [
+          "read-path"
+        ],
+        "tool": [
+          "git_remote"
+        ]
+      },
+      "then": "allow",
+      "reason": "Listing remotes only activates read-path; constitution only requires approval for mutations to remote config."
+    },
+    {
+      "name": "escalate-git-remote-mutations",
+      "description": "Escalate adding, removing, or renaming git remotes (when a remote URL is provided).",
+      "principle": "The agent must ask for approval before adding, removing, or renaming git remotes.",
+      "if": {
+        "roles": [
+          "git-remote-url"
+        ],
+        "tool": [
+          "git_remote"
+        ]
+      },
+      "then": "escalate",
+      "reason": "Constitution requires human approval before modifying git remote configuration."
+    },
+    {
+      "name": "allow-git-fetch-from-github",
+      "description": "Allow git fetch from GitHub remotes.",
+      "principle": "GitHub read access: Querying GitHub repositories, issues, and pull requests is permitted for reading.",
+      "if": {
+        "tool": [
+          "git_fetch"
+        ],
+        "domains": {
+          "roles": [
+            "git-remote-url"
+          ],
+          "allowed": [
+            "github.com"
+          ]
+        }
+      },
+      "then": "allow",
+      "reason": "Constitution permits GitHub read access; git fetch downloads objects without merging."
+    },
+    {
+      "name": "allow-git-clone-from-github",
+      "description": "Allow git clone from GitHub.",
+      "principle": "GitHub read access: Querying GitHub repositories, issues, and pull requests is permitted for reading.",
+      "if": {
+        "tool": [
+          "git_clone"
+        ],
+        "domains": {
+          "roles": [
+            "git-remote-url"
+          ],
+          "allowed": [
+            "github.com"
+          ]
+        }
+      },
+      "then": "allow",
+      "reason": "Constitution permits GitHub read access; cloning from GitHub is a read operation."
+    },
+    {
+      "name": "allow-git-stash-list",
+      "description": "Allow listing git stashes (read-only stash inspection with no write-history argument active).",
+      "principle": "The agent is allowed to read git log, status, diff, and branch information.",
+      "if": {
+        "roles": [
+          "read-path"
+        ],
+        "tool": [
+          "git_stash"
+        ]
+      },
+      "then": "allow",
+      "reason": "Stash listing is read-only; constitution permits read-only git inspection."
+    },
+    {
+      "name": "escalate-git-stash-mutations",
+      "description": "Escalate git stash push/pop/apply/drop operations that modify git state.",
+      "principle": "The agent must ask for approval before modifying git state.",
+      "if": {
+        "roles": [
+          "write-history"
+        ],
+        "tool": [
+          "git_stash"
+        ]
+      },
+      "then": "escalate",
+      "reason": "Stash push/pop operations modify git state and require human approval."
+    },
+    {
+      "name": "allow-git-clean-dry-run",
+      "description": "Allow git clean in dry-run mode (preview only, read-path role only, no delete-path active).",
+      "principle": "Read-only exploration: The agent may only observe and query.",
+      "if": {
+        "roles": [
+          "read-path"
+        ],
+        "tool": [
+          "git_clean"
+        ]
+      },
+      "then": "allow",
+      "reason": "git_clean dry-run only reads the working tree without deleting anything."
+    },
+    {
+      "name": "escalate-git-clean-actual",
+      "description": "Escalate git clean when it would actually delete files (delete-path role active).",
+      "principle": "No mutations: Any operation that creates, modifies, or deletes data must be escalated for human approval.",
+      "if": {
+        "roles": [
+          "delete-path"
+        ],
+        "tool": [
+          "git_clean"
+        ]
+      },
+      "then": "escalate",
+      "reason": "git_clean deletes untracked files from the working directory and requires human approval."
+    },
+    {
+      "name": "escalate-git-checkout",
+      "description": "Escalate git checkout operations that modify git state.",
+      "principle": "The agent must ask for approval before modifying git state (commit, checkout, merge, rebase).",
+      "if": {
+        "tool": [
+          "git_checkout"
+        ]
+      },
+      "then": "escalate",
+      "reason": "git_checkout modifies git working tree state and requires human approval."
+    },
+    {
+      "name": "escalate-git-commit",
+      "description": "Escalate git commit operations that modify git history.",
+      "principle": "The agent must ask for approval before modifying git state (commit, checkout, merge, rebase).",
+      "if": {
+        "tool": [
+          "git_commit"
+        ]
+      },
+      "then": "escalate",
+      "reason": "git_commit modifies git history and requires human approval."
+    },
+    {
+      "name": "escalate-git-merge",
+      "description": "Escalate git merge operations that modify git history.",
+      "principle": "The agent must ask for approval before modifying git state (commit, checkout, merge, rebase).",
+      "if": {
+        "tool": [
+          "git_merge"
+        ]
+      },
+      "then": "escalate",
+      "reason": "git_merge modifies git history and requires human approval."
+    },
+    {
+      "name": "escalate-git-rebase",
+      "description": "Escalate git rebase operations that modify git history.",
+      "principle": "The agent must ask for approval before modifying git state (commit, checkout, merge, rebase).",
+      "if": {
+        "tool": [
+          "git_rebase"
+        ]
+      },
+      "then": "escalate",
+      "reason": "git_rebase modifies git history and requires human approval."
+    },
+    {
+      "name": "escalate-git-reset",
+      "description": "Escalate git reset operations that modify git state.",
+      "principle": "The agent must ask for approval before modifying git state (commit, checkout, merge, rebase).",
+      "if": {
+        "tool": [
+          "git_reset"
+        ]
+      },
+      "then": "escalate",
+      "reason": "git_reset modifies git state and requires human approval."
+    },
+    {
+      "name": "escalate-git-cherry-pick",
+      "description": "Escalate git cherry-pick operations that modify git history.",
+      "principle": "The agent must ask for approval before modifying git state (commit, checkout, merge, rebase).",
+      "if": {
+        "tool": [
+          "git_cherry_pick"
+        ]
+      },
+      "then": "escalate",
+      "reason": "git_cherry_pick modifies git history and requires human approval."
+    },
+    {
+      "name": "escalate-git-pull",
+      "description": "Escalate git pull operations that modify git state.",
+      "principle": "The agent must ask for approval before modifying git state (commit, checkout, merge, rebase).",
+      "if": {
+        "tool": [
+          "git_pull"
+        ]
+      },
+      "then": "escalate",
+      "reason": "git_pull fetches and merges, modifying git state, and requires human approval."
+    },
+    {
+      "name": "escalate-git-push",
+      "description": "Escalate git push operations to GitHub for human approval.",
+      "principle": "The agent must ask for approval before any write, create, delete, or push operation.",
+      "if": {
+        "tool": [
+          "git_push"
+        ],
+        "domains": {
+          "roles": [
+            "git-remote-url"
+          ],
+          "allowed": [
+            "github.com"
+          ]
+        }
+      },
+      "then": "escalate",
+      "reason": "Constitution requires human approval before push operations even to GitHub."
+    },
+    {
+      "name": "escalate-git-add",
+      "description": "Escalate git add (staging files modifies git index state).",
+      "principle": "The agent must ask for approval before modifying git state.",
+      "if": {
+        "tool": [
+          "git_add"
+        ]
+      },
+      "then": "escalate",
+      "reason": "Staging files modifies the git index and requires human approval per the constitution."
+    },
+    {
+      "name": "escalate-git-tag",
+      "description": "Escalate git tag operations that create or delete tags.",
+      "principle": "The agent must ask for approval before modifying git state.",
+      "if": {
+        "tool": [
+          "git_tag"
+        ]
+      },
+      "then": "escalate",
+      "reason": "Creating or deleting tags modifies git state and requires human approval."
+    },
+    {
+      "name": "escalate-git-worktree",
+      "description": "Escalate git worktree operations that create or delete working trees.",
+      "principle": "No mutations: Any operation that creates, modifies, or deletes data must be escalated for human approval.",
+      "if": {
+        "tool": [
+          "git_worktree"
+        ]
+      },
+      "then": "escalate",
+      "reason": "git_worktree can create or delete working trees and requires human approval."
+    },
+    {
+      "name": "escalate-git-init",
+      "description": "Escalate git init that creates a new repository.",
+      "principle": "No mutations: Any operation that creates, modifies, or deletes data must be escalated for human approval.",
+      "if": {
+        "tool": [
+          "git_init"
+        ]
+      },
+      "then": "escalate",
+      "reason": "git_init creates a new git repository on disk and requires human approval."
+    },
+    {
+      "name": "allow-github-read-operations",
+      "description": "Allow read-only GitHub API operations: listing/reading issues, PRs, repos, commits, tags, releases, users, teams, and code search.",
+      "principle": "GitHub read access: Querying GitHub repositories, issues, and pull requests is permitted for reading.",
+      "if": {
+        "tool": [
+          "get_commit",
+          "get_file_contents",
+          "get_label",
+          "get_latest_release",
+          "get_me",
+          "get_release_by_tag",
+          "get_tag",
+          "get_team_members",
+          "get_teams",
+          "issue_read",
+          "list_branches",
+          "list_commits",
+          "list_issue_types",
+          "list_issues",
+          "list_pull_requests",
+          "list_releases",
+          "list_tags",
+          "pull_request_read",
+          "search_code",
+          "search_issues",
+          "search_pull_requests",
+          "search_repositories",
+          "search_users"
+        ]
+      },
+      "then": "allow",
+      "reason": "Constitution explicitly permits querying GitHub repositories, issues, and pull requests for reading."
+    },
+    {
+      "name": "escalate-github-write-operations",
+      "description": "Escalate all GitHub mutation operations for human approval.",
+      "principle": "No mutations: Any operation that creates, modifies, or deletes data must be escalated for human approval.",
+      "if": {
+        "tool": [
+          "add_comment_to_pending_review",
+          "add_issue_comment",
+          "add_reply_to_pull_request_comment",
+          "assign_copilot_to_issue",
+          "create_branch",
+          "create_or_update_file",
+          "create_pull_request",
+          "create_repository",
+          "delete_file",
+          "fork_repository",
+          "issue_write",
+          "merge_pull_request",
+          "pull_request_review_write",
+          "push_files",
+          "request_copilot_review",
+          "sub_issue_write",
+          "update_pull_request",
+          "update_pull_request_branch"
+        ]
+      },
+      "then": "escalate",
+      "reason": "Constitution requires human approval before any write, create, delete, or push operation on GitHub."
+    }
+  ]
+}

package/dist/config/index.d.ts

@@ -40,6 +40,14 @@ export declare function loadConfig(): IronCurtainConfig;
  * The `*` wildcard is preserved (not filtered) so that the untrusted domain gate fires
  * for servers with `["*"]`. The SSRF structural invariant in
  * `domainMatchesAllowlist()` prevents `*` from matching IP addresses.
+ *
+ * SECURITY NOTE: This is the primary defense against compiled "allow" rules that
+ * lack a URL/domain constraint (e.g. allow-git-push-default-remote). Such rules
+ * are intended as fallbacks for when no remote URL is supplied, but they will also
+ * fire for explicit unauthorized URLs if no structural gate catches them first.
+ * Servers without an allowedDomains entry in mcp-servers.json have no structural
+ * URL gate — compiled rules are the only defense in that case, and broad no-constraint
+ * allow rules create a gap. See the KNOWN GAP comment in policy-engine.ts.
  */
 export declare function extractServerDomainAllowlists(mcpServers: Record<string, MCPServerConfig>): Map<string, string[]>;
 /**
@@ -48,7 +56,19 @@ export declare function extractServerDomainAllowlists(mcpServers: Record<string,
  * last `ironcurtain compile-policy` run.
  */
 export declare function checkConstitutionFreshness(compiledPolicy: CompiledPolicyFile, constitutionPath: string): void;
-export declare function loadGeneratedPolicy(generatedDir: string, fallbackDir?: string): {
+/**
+ * Options for loading generated policy artifacts with split directories.
+ * Allows policy files and tool annotations to come from different dirs.
+ */
+export interface PolicyLoadOptions {
+    /** Directory for compiled-policy.json and dynamic-lists.json. */
+    readonly policyDir: string;
+    /** Directory for tool-annotations.json (always global). */
+    readonly toolAnnotationsDir: string;
+    /** Fallback directory for missing artifacts (package-bundled defaults). */
+    readonly fallbackDir?: string;
+}
+export declare function loadGeneratedPolicy(options: PolicyLoadOptions): {
     compiledPolicy: CompiledPolicyFile;
     toolAnnotations: ToolAnnotationsFile;
     dynamicLists: DynamicListsFile | undefined;

package/dist/config/index.js

@@ -214,6 +214,14 @@ export function loadConfig() {
  * The `*` wildcard is preserved (not filtered) so that the untrusted domain gate fires
  * for servers with `["*"]`. The SSRF structural invariant in
  * `domainMatchesAllowlist()` prevents `*` from matching IP addresses.
+ *
+ * SECURITY NOTE: This is the primary defense against compiled "allow" rules that
+ * lack a URL/domain constraint (e.g. allow-git-push-default-remote). Such rules
+ * are intended as fallbacks for when no remote URL is supplied, but they will also
+ * fire for explicit unauthorized URLs if no structural gate catches them first.
+ * Servers without an allowedDomains entry in mcp-servers.json have no structural
+ * URL gate — compiled rules are the only defense in that case, and broad no-constraint
+ * allow rules create a gap. See the KNOWN GAP comment in policy-engine.ts.
  */
 export function extractServerDomainAllowlists(mcpServers) {
     const allowlists = new Map();
@@ -242,10 +250,10 @@ export function checkConstitutionFreshness(compiledPolicy, constitutionPath) {
             'Run `ironcurtain compile-policy` to update the compiled policy.\n');
     }
 }
-export function loadGeneratedPolicy(generatedDir, fallbackDir) {
-    const compiledPolicy = JSON.parse(readGeneratedFile(generatedDir, 'compiled-policy.json', fallbackDir));
-    const toolAnnotations = JSON.parse(readGeneratedFile(generatedDir, 'tool-annotations.json', fallbackDir));
-    const dynamicLists = loadOptionalGeneratedFile(generatedDir, 'dynamic-lists.json', fallbackDir);
+export function loadGeneratedPolicy(options) {
+    const compiledPolicy = JSON.parse(readGeneratedFile(options.policyDir, 'compiled-policy.json', options.fallbackDir));
+    const toolAnnotations = JSON.parse(readGeneratedFile(options.toolAnnotationsDir, 'tool-annotations.json', options.fallbackDir));
+    const dynamicLists = loadOptionalGeneratedFile(options.policyDir, 'dynamic-lists.json', options.fallbackDir);
     return { compiledPolicy, toolAnnotations, dynamicLists };
 }
 /**

package/dist/config/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAgC,MAAM,kBAAkB,CAAC;AAEhF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE9C;;;GAGG;AACH,SAAS,mBAAmB,CAAC,mBAA2B;IACtD,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAMrC;IACC,MAAM,KAAK,GAAG;QACZ,mEAAmE;QACnE,2EAA2E;QAC3E,wEAAwE;QACxE,uEAAuE;QACvE,mCAAmC;QACnC,eAAe,CAAC,kBAAkB,EAAE,CAAC;QACrC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC;QACtC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;QAClC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC;QACpC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;KACnC,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,wDAAwD;IACxD,MAAM,oBAAoB,GAAG,2BAA2B,EAAE,CAAC;IAC3D,IAAI,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;IACtD,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7C,sDAAsD;IACtD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAA2C;IAC/E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAEnD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAuB,EAAE,WAAmB,EAAE,QAAiB;IACjG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QAEhE,IAAI,QAAQ,EAAE,CAAC;YACb,oDAAoD;YACpD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC7B,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC1C,IAAI,MAAM,KAAK,CAAC,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBACpC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,yCAAyC;YACzC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,2BAA2B,CAAC,SAAkC;IACrE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEtC,KAAK,CAAC,mBAAmB,GAAG,SAAS,CAAC,QAAQ,CAAC;IAE/C,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3B,KAAK,OAAO;YACV,IAAI,SAAS,CAAC,KAAK;gBAAE,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YAClE,MAAM;QACR,KAAK,QAAQ;YACX,IAAI,SAAS,CAAC,MAAM;gBAAE,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YACrE,MAAM;QACR,KAAK,SAAS;YACZ,IAAI,SAAS,CAAC,OAAO;gBAAE,KAAK,CAAC,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;YACxE,MAAM;IACV,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IAEpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,eAAe,CAAC;IACnE,0DAA0D;IAC1D,+DAA+D;IAC/D,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAE5E,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAoC,CAAC;IAExG,4EAA4E;IAC5E,sEAAsE;IACtE,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1C,wHAAwH;IACxH,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,0BAA0B,CAAC;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAElC,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;IAE9D,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,gBAAgB;QAChB,YAAY;QACZ,mBAAmB;QACnB,cAAc;QACd,YAAY;KACb,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4FAA4F;IAC5F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,OAAO,oDAAoD;gBACxF,sBAAsB,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,cAAc,GAAG,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,eAAe,GAAG,UAAU,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,aAAa,GAChB,UAAU,CAAC,iBAAwE,CAAC,KAAK,IAAI,EAAE,CAAC;QACnG,MAAM,iBAAiB,GAA2C,EAAE,CAAC;QACrE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAClE,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAClC,CAAC;QACD,iBAAiB,CAAC,KAAK,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,cAAc,EAAE,CAAC;QAClE,eAAe,GAAG,EAAE,GAAG,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,YAAY;QACZ,gBAAgB;QAChB,UAAU;QACV,cAAc;QACd,YAAY;QACZ,gBAAgB;QAChB,YAAY,EAAE,eAAe,CAAC,YAAY;QAC1C,wBAAwB,EAAE,eAAe,CAAC,wBAAwB;QAClE,UAAU,EAAE,eAAe;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAA2C;IACvF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,cAAkC,EAAE,gBAAwB;IACrG,MAAM,WAAW,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE;YACrE,mEAAmE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,YAAoB,EACpB,WAAoB;IAMpB,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAC/B,iBAAiB,CAAC,YAAY,EAAE,sBAAsB,EAAE,WAAW,CAAC,CAC/C,CAAC;IACxB,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAChC,iBAAiB,CAAC,YAAY,EAAE,uBAAuB,EAAE,WAAW,CAAC,CAC/C,CAAC;IACzB,MAAM,YAAY,GAAG,yBAAyB,CAAC,YAAY,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC;IAEhG,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAChC,YAAoB,EACpB,QAAgB,EAChB,WAAoB;IAEpB,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAqB,CAAC;IAC5E,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAqB,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,YAAoB,EAAE,QAAgB,EAAE,WAAoB;IACrF,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,YAAoB,EAAE,QAAgB;IACpE,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,wDAAwD;IACxD,OAAO,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,iBAAiB,EACjB,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAgC,MAAM,kBAAkB,CAAC;AAEhF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE9C;;;GAGG;AACH,SAAS,mBAAmB,CAAC,mBAA2B;IACtD,MAAM,OAAO,GAAG,mBAAmB,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAMrC;IACC,MAAM,KAAK,GAAG;QACZ,mEAAmE;QACnE,2EAA2E;QAC3E,wEAAwE;QACxE,uEAAuE;QACvE,mCAAmC;QACnC,eAAe,CAAC,kBAAkB,EAAE,CAAC;QACrC,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC;QACtC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;QAClC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC;QACpC,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC;KACnC,CAAC;IACF,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,wDAAwD;IACxD,MAAM,oBAAoB,GAAG,2BAA2B,EAAE,CAAC;IAC3D,IAAI,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;IACtD,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7C,sDAAsD;IACtD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAA2C;IAC/E,2EAA2E;IAC3E,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAEnD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/C,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YAC/C,MAAM,CAAC,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,0BAA0B,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAuB,EAAE,WAAmB,EAAE,QAAiB;IACjG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QAEhE,IAAI,QAAQ,EAAE,CAAC;YACb,oDAAoD;YACpD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAChF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBAC7B,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;gBAC1C,IAAI,MAAM,KAAK,CAAC,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACnD,CAAC;iBAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;gBACpC,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC;YAC1B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,yCAAyC;YACzC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,2BAA2B,CAAC,SAAkC;IACrE,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,IAAI,CAAC,SAAS,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEtC,KAAK,CAAC,mBAAmB,GAAG,SAAS,CAAC,QAAQ,CAAC;IAE/C,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3B,KAAK,OAAO;YACV,IAAI,SAAS,CAAC,KAAK;gBAAE,KAAK,CAAC,aAAa,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC;YAClE,MAAM;QACR,KAAK,QAAQ;YACX,IAAI,SAAS,CAAC,MAAM;gBAAE,KAAK,CAAC,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YACrE,MAAM;QACR,KAAK,SAAS;YACZ,IAAI,SAAS,CAAC,OAAO;gBAAE,KAAK,CAAC,eAAe,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;YACxE,MAAM;IACV,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IAEpC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,eAAe,CAAC;IACnE,0DAA0D;IAC1D,+DAA+D;IAC/D,wEAAwE;IACxE,MAAM,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,iBAAiB,CAAC;IAE5E,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAoC,CAAC;IAExG,4EAA4E;IAC5E,sEAAsE;IACtE,8CAA8C;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1C,wHAAwH;IACxH,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,0BAA0B,CAAC;QAC9C,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACnD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,gBAAgB,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAElC,MAAM,gBAAgB,GAAG,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAC/D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,mBAAmB,CAAC,mBAAmB,CAAC,CAAC;IAE9D,MAAM,cAAc,GAAG,qBAAqB,CAAC;QAC3C,gBAAgB;QAChB,YAAY;QACZ,mBAAmB;QACnB,cAAc;QACd,YAAY;KACb,CAAC,CAAC;IAEH,6EAA6E;IAC7E,4FAA4F;IAC5F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+BAA+B,OAAO,oDAAoD;gBACxF,sBAAsB,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,MAAM,cAAc,GAAG,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzE,IAAI,eAAe,GAAG,UAAU,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,aAAa,GAChB,UAAU,CAAC,iBAAwE,CAAC,KAAK,IAAI,EAAE,CAAC;QACnG,MAAM,iBAAiB,GAA2C,EAAE,CAAC;QACrE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAClE,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAClC,CAAC;QACD,iBAAiB,CAAC,KAAK,GAAG,EAAE,GAAG,aAAa,EAAE,GAAG,cAAc,EAAE,CAAC;QAClE,eAAe,GAAG,EAAE,GAAG,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,CAAC;IAC5E,CAAC;IAED,OAAO;QACL,YAAY;QACZ,gBAAgB;QAChB,UAAU;QACV,cAAc;QACd,YAAY;QACZ,gBAAgB;QAChB,YAAY,EAAE,eAAe,CAAC,YAAY;QAC1C,wBAAwB,EAAE,eAAe,CAAC,wBAAwB;QAClE,UAAU,EAAE,eAAe;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,6BAA6B,CAAC,UAA2C;IACvF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAC/C,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,SAAS;QACtD,IAAI,OAAO,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,cAAkC,EAAE,gBAAwB;IACrG,MAAM,WAAW,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;IAC9D,IAAI,WAAW,KAAK,cAAc,CAAC,gBAAgB,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,uEAAuE;YACrE,mEAAmE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAeD,MAAM,UAAU,mBAAmB,CAAC,OAA0B;IAK5D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAC/B,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,sBAAsB,EAAE,OAAO,CAAC,WAAW,CAAC,CAC5D,CAAC;IACxB,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAChC,iBAAiB,CAAC,OAAO,CAAC,kBAAkB,EAAE,uBAAuB,EAAE,OAAO,CAAC,WAAW,CAAC,CACrE,CAAC;IACzB,MAAM,YAAY,GAAG,yBAAyB,CAAC,OAAO,CAAC,SAAS,EAAE,oBAAoB,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAE7G,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,YAAY,EAAE,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAChC,YAAoB,EACpB,QAAgB,EAChB,WAAoB;IAEpB,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAqB,CAAC;IAC5E,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAqB,CAAC;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,YAAoB,EAAE,QAAgB,EAAE,WAAoB;IACrF,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,OAAO,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAAC,YAAoB,EAAE,QAAgB;IACpE,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,wDAAwD;IACxD,OAAO,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AACzC,CAAC"}

package/dist/config/mcp-servers.json

@@ -12,14 +12,8 @@
     "env": {
       "MCP_TRANSPORT_TYPE": "stdio"
     },
-    "sandbox": {
-      "filesystem": {
-        "denyRead": ["~/.gnupg", "~/.aws"]
-      },
-      "network": {
-        "allowedDomains": ["github.com", "*.github.com", "gitlab.com", "*.gitlab.com"]
-      }
-    }
+    "sandbox": false,
+    "_comment": "sandbox: false because @anthropic-ai/sandbox-runtime always runs with --unshare-net (network namespace isolation). On Linux there is no way to selectively allow network access — the SOCKS proxy + GIT_SSH_COMMAND workaround is only implemented on macOS. With sandboxing enabled, git push/fetch/clone over SSH fail with DNS resolution errors. The intended config once upstream supports selective network on Linux: { \"filesystem\": { \"denyRead\": [\"~/.gnupg\", \"~/.aws\"] }, \"network\": { \"allowedDomains\": [\"github.com\", \"*.github.com\", \"gitlab.com\", \"*.gitlab.com\"] } }"
   },
   "fetch": {
     "description": "HTTP requests and web search",

package/dist/config/paths.d.ts

@@ -22,6 +22,11 @@ export declare function getSessionSandboxDir(sessionId: string): string;
  *   {home}/sessions/{sessionId}/escalations/
  */
 export declare function getSessionEscalationDir(sessionId: string): string;
+/**
+ * Returns the session metadata path for a given session:
+ *   {home}/sessions/{sessionId}/session-metadata.json
+ */
+export declare function getSessionMetadataPath(sessionId: string): string;
 /**
  * Returns the audit log path for a given session:
  *   {home}/sessions/{sessionId}/audit.jsonl
@@ -104,6 +109,18 @@ export declare function getBaseUserConstitutionPath(): string;
  * to the package-bundled defaults in dist/config/generated/.
  */
 export declare function getUserGeneratedDir(): string;
+/**
+ * Returns the package-bundled read-only policy directory.
+ * Contains compiled-policy.json derived from constitution-readonly.md.
+ * This is always the package version -- not user-local.
+ */
+export declare function getReadOnlyPolicyDir(): string;
+/**
+ * Returns the package-bundled config directory.
+ * Used to validate that a policyDir is within a trusted location
+ * (either the user's IronCurtain home or the package config dir).
+ */
+export declare function getPackageConfigDir(): string;
 /**
  * Loads the combined constitution text (base + optional user constitution).
  * If ~/.ironcurtain/constitution.md exists, it replaces the package-bundled base.
@@ -115,3 +132,33 @@ export declare function loadConstitutionText(packageBasePath: string): string;
  * Loads the combined constitution and returns its SHA-256 hex digest.
  */
 export declare function computeConstitutionHash(basePath: string): string;
+/**
+ * Returns the daemon control socket path: {home}/daemon.sock
+ *
+ * The daemon listens on this Unix domain socket so CLI commands
+ * can communicate with a running daemon (e.g., add-job, run-job).
+ */
+export declare function getDaemonSocketPath(): string;
+/**
+ * Returns the jobs base directory: {home}/jobs/
+ */
+export declare function getJobsDir(): string;
+/**
+ * Returns the directory for a specific job: {home}/jobs/{jobId}/
+ */
+export declare function getJobDir(jobId: string): string;
+/**
+ * Returns the generated artifacts directory for a job:
+ * {home}/jobs/{jobId}/generated/
+ */
+export declare function getJobGeneratedDir(jobId: string): string;
+/**
+ * Returns the workspace directory for a job:
+ * {home}/jobs/{jobId}/workspace/
+ */
+export declare function getJobWorkspaceDir(jobId: string): string;
+/**
+ * Returns the runs directory for a job:
+ * {home}/jobs/{jobId}/runs/
+ */
+export declare function getJobRunsDir(jobId: string): string;