@aimarket/warden 0.8.2 → 0.13.0

package/dist/scan-lock.js

@@ -0,0 +1,113 @@
+import { readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { mkdir, rename, unlink, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { pinToolsHash, serverIdentityHash } from './pinning.js';
+import { displaySafe } from './sanitize.js';
+/**
+ * `warden.lock.json` — reviewed tool definitions committed next to the MCP config.
+ *
+ * The lock is the pull-request form of a pin. Whoever adds or changes a server
+ * runs `scan --update-lock`; the diff of this file is what reviewers read — the
+ * tool descriptions that will reach the model, not just the command line. CI then
+ * runs `scan --lock` and fails when the config starts a server the lock does not
+ * know, starts it differently, or the server now advertises different tools.
+ *
+ * Stored entries are ordinary {@link PinnedServer} records (plus the MTL/1 digest
+ * HISTOR keys tool sets by), so the same {@link PinningGate} decides drift for
+ * `wrap` and for `scan`.
+ */
+export const LOCK_VERSION = 1;
+export class LockStore {
+    entries;
+    constructor(entries = {}) { this.entries = new Map(Object.entries(entries)); }
+    async getPin(id) { return this.entries.get(id); }
+    async putPin() { }
+}
+function validEntry(id, e) {
+    if (!e || typeof e !== 'object' || Array.isArray(e))
+        return false;
+    const p = e;
+    return p.serverId === id && typeof p.toolsHash === 'string' && /^(?:rfc8785:)?[a-f0-9]{64}$/.test(p.toolsHash) &&
+        typeof p.approvedAt === 'string' && Array.isArray(p.toolNames) && p.toolNames.every(n => typeof n === 'string') &&
+        (p.approvalMode === undefined || ['operator', 'automatic'].includes(p.approvalMode)) &&
+        (p.identityHash === undefined || /^[a-f0-9]{64}$/.test(p.identityHash)) &&
+        (p.tools === undefined || Array.isArray(p.tools));
+}
+/** Read a lock. A missing file is an empty lock; a malformed one is an error, never "empty". */
+export async function readLock(path) {
+    if (!existsSync(path))
+        return undefined;
+    let raw;
+    try {
+        raw = JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch (err) {
+        throw new Error(`${path}: not JSON (${err instanceof Error ? err.message : String(err)})`);
+    }
+    const lock = raw;
+    if (!lock || typeof lock !== 'object' || lock.lockfileVersion !== LOCK_VERSION || !lock.servers || typeof lock.servers !== 'object' || Array.isArray(lock.servers)) {
+        throw new Error(`${path}: not a WARDEN lock file (lockfileVersion ${LOCK_VERSION})`);
+    }
+    for (const [id, entry] of Object.entries(lock.servers)) {
+        if (!validEntry(id, entry))
+            throw new Error(`${path}: entry ${displaySafe(JSON.stringify(id), 140)} is malformed; refusing to read the lock as partly empty`);
+    }
+    return lock;
+}
+/** Recursively sort object keys so the committed file diffs line by line, not reorder by reorder. */
+export function sortKeys(value) {
+    if (Array.isArray(value))
+        return value.map(sortKeys);
+    if (value && typeof value === 'object') {
+        const out = {};
+        for (const key of Object.keys(value).sort())
+            out[key] = sortKeys(value[key]);
+        return out;
+    }
+    return value;
+}
+export function lockEntryFor(server, tools, mtlDigest, previous, now) {
+    const toolsHash = pinToolsHash(tools), identityHash = serverIdentityHash(server);
+    const unchanged = previous && previous.toolsHash === toolsHash && previous.identityHash === identityHash;
+    const sorted = [...tools].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+    return {
+        serverId: server.id,
+        toolsHash, toolsHashVersion: 2, identityHash, approvalMode: "operator",
+        // An unchanged entry keeps its date, so re-running --update-lock produces no diff.
+        approvedAt: unchanged ? previous.approvedAt : now,
+        toolNames: sorted.map(t => t.name),
+        tools: structuredClone(sorted),
+        ...(mtlDigest ? { mtlDigest } : {}),
+    };
+}
+export async function writeLock(path, lock) {
+    const text = JSON.stringify(sortKeys(lock), null, 2) + '\n';
+    // Pretty, sorted and atomic: the lock is read in a diff, and a failed write keeps the old one.
+    await mkdir(dirname(path), { recursive: true });
+    const temp = `${path}.${process.pid}.tmp`;
+    try {
+        await writeFile(temp, text, { mode: 0o644 });
+        await rename(temp, path);
+    }
+    finally {
+        await unlink(temp).catch(() => { });
+    }
+}
+/** What changed between the reviewed tools and the ones served now, tool by tool. */
+export function diffTools(before, after) {
+    const old = new Map((before ?? []).map(t => [t.name, t])), now = new Map(after.map(t => [t.name, t]));
+    const names = [...new Set([...old.keys(), ...now.keys()])].sort();
+    const changes = [];
+    for (const name of names) {
+        const a = old.get(name), b = now.get(name);
+        if (!a && b)
+            changes.push({ tool: name, kind: 'added', after: b });
+        else if (a && !b)
+            changes.push({ tool: name, kind: 'removed', before: a });
+        else if (a && b && pinToolsHash([a]) !== pinToolsHash([b]))
+            changes.push({ tool: name, kind: 'changed', before: a, after: b });
+    }
+    return changes;
+}
+//# sourceMappingURL=scan-lock.js.map

package/dist/scan-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-lock.js","sourceRoot":"","sources":["../src/scan-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAc9B,MAAM,OAAO,SAAS;IACX,OAAO,CAAyB;IACzC,YAAY,UAAqC,EAAE,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,KAAK,CAAC,MAAM,CAAC,EAAU,IAAuC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,KAAK,CAAC,MAAM,KAAsE,CAAC;CACpF;AAED,SAAS,UAAU,CAAC,EAAU,EAAE,CAAU;IACxC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,CAAC,GAAG,CAAc,CAAC;IACzB,OAAO,CAAC,CAAC,QAAQ,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAC/G,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAY;IACzC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IACvD,OAAO,GAAG,EAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,eAAe,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,GAAe,CAAC;IAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,KAAK,YAAY,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACnK,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6CAA6C,YAAY,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,WAAW,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,0DAA0D,CAAC,CAAC;IAChK,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC,IAAI,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;QACrI,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAoB,EAAE,KAAgB,EAAE,SAA6B,EAAE,QAA+B,EAAE,GAAW;IAC9I,MAAM,SAAS,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACjF,MAAM,SAAS,GAAG,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,IAAI,QAAQ,CAAC,YAAY,KAAK,YAAY,CAAC;IACzG,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,SAAS,EAAE,gBAAgB,EAAE,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU;QACtE,mFAAmF;QACnF,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG;QACjD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAClC,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC;QAC9B,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,IAAc;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;IAC5D,+FAA+F;IAC/F,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IAC1C,IAAI,CAAC;QAAC,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;YACvE,CAAC;QAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAAC,CAAC;AACjD,CAAC;AAID,qFAAqF;AACrF,MAAM,UAAU,SAAS,CAAC,MAAsC,EAAE,KAAyB;IACzF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAClE,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;aAC9D,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;aACtE,IAAI,CAAC,IAAI,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IACjI,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/scan-report.d.ts

@@ -0,0 +1,21 @@
+import type { ScanReport } from './scan.js';
+/** Short, fixed descriptions; the finding message carries the specifics. */
+export declare const CODE_TEXT: Record<string, string>;
+/** JSON report without the raw tool definitions (they are in the lock when they matter). */
+export declare function toJson(report: ScanReport): string;
+/** The terminal table. Every untrusted string goes through displaySafe. */
+export declare function toTable(report: ScanReport, cwd: string, color: boolean): string;
+/**
+ * SARIF for GitHub code scanning. Advisory findings are left out on purpose: the
+ * Security tab is for things that block, and TOOL_DEF_UNPINNED alone would put a
+ * result on every server in every repository.
+ */
+export declare function toSarif(report: ScanReport, cwd: string): object;
+/** Inline code that untrusted text cannot break out of. */
+export declare function mdCode(text: string, max?: number): string;
+/** A fenced block that untrusted text cannot close. */
+export declare function mdBlock(text: string, lang?: string): string;
+/** Line diff, small and dependency-free: common prefix/suffix, then the middle as -/+. */
+export declare function lineDiff(before: string[], after: string[]): string[];
+export declare function toMarkdown(report: ScanReport, cwd: string): string;
+//# sourceMappingURL=scan-report.d.ts.map

package/dist/scan-report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-report.d.ts","sourceRoot":"","sources":["../src/scan-report.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAoB,MAAM,WAAW,CAAC;AAK9D,4EAA4E;AAC5E,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAyB5C,CAAC;AAMF,4FAA4F;AAC5F,wBAAgB,MAAM,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAEjD;AAaD,2EAA2E;AAC3E,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAgD/E;AAsBD;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAoC/D;AAID,2DAA2D;AAC3D,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,SAAK,GAAG,MAAM,CAKrD;AAED,uDAAuD;AACvD,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,SAAK,GAAG,MAAM,CAIvD;AAYD,0FAA0F;AAC1F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAWpE;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAwDlE"}

package/dist/scan-report.js

@@ -0,0 +1,288 @@
+import { createHash } from 'node:crypto';
+import { flowSentence } from './toxic-flow.js';
+import { relative, isAbsolute, sep } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { displaySafe } from './sanitize.js';
+const SEVERITY_ORDER = ['info', 'low', 'medium', 'high', 'critical'];
+/** Short, fixed descriptions; the finding message carries the specifics. */
+export const CODE_TEXT = {
+    TOOL_DEF_INJECTION: 'Tool definition carries prompt-injection phrasing',
+    TOOL_DEF_SECRET_REQUEST: 'Tool definition asks for a private key, seed phrase or SSH key',
+    TOOL_DEF_SECRET_HARVEST: 'Tool whose stated job is to read or reveal secrets',
+    TOOL_DEF_EXFIL: 'Tool definition instructs sending data to an outside destination',
+    TOOL_DEF_HIDDEN_UNICODE: 'Invisible or bidirectional characters in a tool definition',
+    TOOL_DEF_BASE64_BLOB: 'Long base64 run in a tool definition',
+    TOOL_DEF_DATA_URL: 'data: or javascript: URL in a tool definition',
+    TOOL_DEF_CREDENTIAL_PARAM: 'Tool asks for a credential as a parameter',
+    TOOL_DEF_ENV_REFERENCE: 'Tool definition refers to environment files or variables',
+    TOOL_DEF_SECRET_EXFIL: 'A secret store and a destination named close together',
+    TOOL_DEF_IMPERATIVE: 'Prompt-shaped imperative phrasing',
+    TOOL_DEF_DRIFT: 'Tool definitions changed since they were approved',
+    TOOL_DEF_UNPINNED: 'No approved snapshot of the tool definitions yet',
+    TOOL_DEF_UNCANONICAL: 'Tool definitions have no canonical form to pin',
+    SERVER_IDENTITY_DRIFT: 'The command or URL behind an approved server changed',
+    PIN_FORMAT_UPGRADE_REQUIRED: 'Approval predates extended tool fields; re-approve',
+    SERVER_UNDECLARED: 'Server came from a catalog, not from the operator',
+    LOCK_MISSING: 'Server is not in the reviewed lock file',
+    HISTOR_UNSEEN_TOOLSET: 'HISTOR never observed the tool set this server served',
+    HISTOR_CLASSIFIER: "HISTOR's classifier reads a tool as directing the model",
+    TOOL_DEF_CLASSIFIER: 'A model reads the tool as directing the model (opt-in classifier)',
+    TOOL_DEF_CROSS_TOOL: "A tool's description directs how another tool is called",
+    HISTOR_OLDER_TOOLSET: 'This server served a tool set HISTOR saw earlier, not the current one',
+    GATE_ERROR: 'A WARDEN gate failed to complete',
+};
+function codeText(code) {
+    return CODE_TEXT[code] ?? (code.startsWith('THREAT_') ? 'Matches a known-bad record in the threat feed' : code);
+}
+/** JSON report without the raw tool definitions (they are in the lock when they matter). */
+export function toJson(report) {
+    return JSON.stringify({ ...report, servers: report.servers.map(({ tools: _tools, ...rest }) => rest) }, null, 2);
+}
+function displayPath(path, cwd) {
+    const rel = relative(cwd, path);
+    if (rel && !rel.startsWith('..') && !isAbsolute(rel))
+        return rel;
+    const home = homedir();
+    return path.startsWith(home + sep) ? '~' + path.slice(home.length) : path;
+}
+function findingLabel(f) {
+    return `${displaySafe(f.code, 60)}${f.tool ? `(${displaySafe(f.tool, 60)})` : ''}`;
+}
+/** The terminal table. Every untrusted string goes through displaySafe. */
+export function toTable(report, cwd, color) {
+    const c = (code, text) => color ? `\x1b[${code}m${text}\x1b[0m` : text;
+    const lines = [];
+    const r = report.ruleset;
+    lines.push(`WARDEN scan ${report.version} · ruleset ${r.version} ${r.digest.slice(0, 19)}… · block at ${report.policy.blockAtSeverity}`);
+    if (!report.sources.length)
+        lines.push('No MCP client config found. Pass a file, or run where .mcp.json lives.');
+    for (const s of report.sources)
+        lines.push(`  ${s.error ? c('31', 'unreadable') : 'read'} ${displayPath(s.path, cwd)} (${s.client}, ${s.servers} server${s.servers === 1 ? '' : 's'})${s.error ? ': ' + displaySafe(s.error, 200) : ''}`);
+    lines.push('');
+    const width = Math.min(28, Math.max(6, ...report.servers.map(s => displaySafe(s.key, 28).length)));
+    for (const s of report.servers) {
+        const mark = s.allow === false ? c('31;1', '✗ BLOCK ') : s.status === 'error' ? c('33', '! error ') : s.status === 'skipped' ? c('2', '- skip  ')
+            : s.status === 'launch-only' ? c('36', '~ launch') : c('32', '✓ allow ');
+        const name = displaySafe(s.key, 28).padEnd(width);
+        let detail;
+        if (s.status === 'skipped')
+            detail = displaySafe(s.skipped ?? '', 120);
+        else if (s.status === 'error')
+            detail = displaySafe(s.error ?? '', 200);
+        else {
+            const blockingFindings = s.findings.filter(f => !f.advisory && SEVERITY_ORDER.indexOf(f.severity) >= SEVERITY_ORDER.indexOf(report.policy.blockAtSeverity));
+            const labels = [...new Set((s.allow === false ? blockingFindings : s.findings.filter(f => !f.advisory)).map(findingLabel))];
+            const shown = labels.slice(0, 4);
+            const parts = [];
+            if (s.status === 'launch-only')
+                parts.push('not started (--no-launch): launch line vetted only');
+            if (s.toolCount !== undefined)
+                parts.push(`${s.toolCount} tool${s.toolCount === 1 ? '' : 's'}`);
+            if (s.score !== undefined && s.status === 'scanned')
+                parts.push(`score ${s.score.toFixed(2)}`);
+            if (shown.length)
+                parts.push(shown.join(' '));
+            const more = labels.length - shown.length;
+            if (more > 0)
+                parts.push(`+${more} more`);
+            if (s.lock)
+                parts.push(`lock: ${s.lock.state}`);
+            if (s.histor)
+                parts.push(`histor: ${displaySafe(s.histor.match ?? (s.histor.notSent ? 'not sent' : 'unavailable'), 40)}`);
+            if (s.classifier)
+                parts.push(s.classifier.error ? 'classifier: no answer' : `classifier: ${s.classifier.flagged} flagged`);
+            detail = parts.join(' · ');
+        }
+        lines.push(`  ${mark}  ${name}  ${c('2', s.client.padEnd(14))} ${detail}`);
+    }
+    for (const f of report.flows ?? []) {
+        lines.push('');
+        lines.push(`  ${c('33;1', '⚠ toxic flow')}  ${flowSentence(f, t => `${displaySafe(t.server, 28)}.${displaySafe(t.tool, 40)}`)}`);
+    }
+    const m = report.summary;
+    lines.push('');
+    lines.push(`${m.servers} server${m.servers === 1 ? '' : 's'}: ${m.allowed} allowed, ${m.blocked} blocked, ${m.errors} not checked, ${m.skipped} skipped${m.launchOnly ? `, ${m.launchOnly} not started` : ''}.`);
+    if (report.lock) {
+        if (report.lock.written)
+            lines.push(`Lock written: ${displayPath(report.lock.path, cwd)}. Commit it; the diff is the review.`);
+        if (report.lock.stale.length)
+            lines.push(`In the lock but not in any config: ${report.lock.stale.map(id => displaySafe(id, 60)).join(', ')}`);
+    }
+    if (m.blocked)
+        lines.push(`Details: warden-mcp scan --json, or --markdown FILE. To review a changed server: warden-mcp scan --lock warden.lock.json --update-lock.`);
+    if (report.historWatch)
+        lines.push(`Follow changes to these servers in any feed reader: ${displaySafe(report.historWatch, 2000)}`);
+    return lines.join('\n');
+}
+// ── SARIF 2.1.0 ──────────────────────────────────────────────────────────────
+const SECURITY_SEVERITY = { critical: '9.5', high: '8.0', medium: '5.5', low: '3.0', info: '1.0' };
+const LEVEL = { critical: 'error', high: 'error', medium: 'warning', low: 'note', info: 'note' };
+function lineOf(path, key) {
+    try {
+        const text = readFileSync(path, 'utf8');
+        const needle = JSON.stringify(key);
+        const at = text.indexOf(needle + ':') >= 0 ? text.indexOf(needle + ':') : text.indexOf(needle);
+        return at < 0 ? 1 : text.slice(0, at).split('\n').length;
+    }
+    catch {
+        return 1;
+    }
+}
+function artifactUri(path, cwd) {
+    const rel = relative(cwd, path);
+    if (rel && !rel.startsWith('..') && !isAbsolute(rel))
+        return { uri: rel.split(sep).join('/'), uriBaseId: '%SRCROOT%' };
+    return { uri: pathToFileURL(path).href };
+}
+/**
+ * SARIF for GitHub code scanning. Advisory findings are left out on purpose: the
+ * Security tab is for things that block, and TOOL_DEF_UNPINNED alone would put a
+ * result on every server in every repository.
+ */
+export function toSarif(report, cwd) {
+    const rules = new Map();
+    const results = [];
+    for (const s of report.servers) {
+        for (const f of s.findings) {
+            if (f.advisory)
+                continue;
+            const known = rules.get(f.code);
+            if (!known || SEVERITY_ORDER.indexOf(f.severity) > SEVERITY_ORDER.indexOf(known.severity))
+                rules.set(f.code, { severity: f.severity });
+            const fingerprint = createHash('sha256').update([s.client, s.key, f.code, f.tool ?? '', f.message].join('\u0000')).digest('hex');
+            results.push({
+                ruleId: f.code,
+                level: LEVEL[f.severity],
+                message: { text: `${displaySafe(s.key, 120)}: ${displaySafe(f.message, 1500)}` },
+                locations: [{ physicalLocation: { artifactLocation: artifactUri(s.source, cwd), region: { startLine: lineOf(s.source, s.key) } } }],
+                partialFingerprints: { 'wardenFinding/v1': fingerprint },
+                properties: { server: displaySafe(s.key, 200), client: s.client, gate: f.gate, severity: f.severity, ...(f.tool ? { tool: displaySafe(f.tool, 200) } : {}) },
+            });
+        }
+    }
+    return {
+        $schema: 'https://json.schemastore.org/sarif-2.1.0.json',
+        version: '2.1.0',
+        runs: [{
+                tool: { driver: {
+                        name: 'WARDEN', semanticVersion: report.version, informationUri: 'https://warden.modelmarket.dev/',
+                        rules: [...rules.entries()].sort(([a], [b]) => a < b ? -1 : 1).map(([id, r]) => ({
+                            id, name: id, shortDescription: { text: codeText(id) },
+                            helpUri: 'https://github.com/alexar76/warden/blob/main/docs/gates.md',
+                            defaultConfiguration: { level: LEVEL[r.severity] },
+                            properties: { tags: ['security', 'mcp', 'prompt-injection'], 'security-severity': SECURITY_SEVERITY[r.severity] },
+                        })),
+                    } },
+                results,
+                properties: { ruleset: report.ruleset, blockAtSeverity: report.policy.blockAtSeverity },
+            }],
+    };
+}
+// ── Markdown (GitHub step summary, PR comment) ───────────────────────────────
+/** Inline code that untrusted text cannot break out of. */
+export function mdCode(text, max = 80) {
+    const t = displaySafe(text, max).replace(/[\r\n]+/g, ' ').replace(/\|/g, '¦');
+    const run = Math.max(0, ...[...t.matchAll(/`+/g)].map(m => m[0].length));
+    const fence = '`'.repeat(run + 1);
+    return `${fence}${run ? ' ' : ''}${t}${run ? ' ' : ''}${fence}`;
+}
+/** A fenced block that untrusted text cannot close. */
+export function mdBlock(text, lang = '') {
+    const run = Math.max(2, ...[...text.matchAll(/`+/g)].map(m => m[0].length));
+    const fence = '`'.repeat(run + 1);
+    return `${fence}${lang}\n${text}\n${fence}`;
+}
+function toolText(t) {
+    if (!t)
+        return [];
+    const lines = [`name: ${t.name}`];
+    if (t.title)
+        lines.push(`title: ${t.title}`);
+    for (const l of String(t.description ?? '').split(/\r?\n/))
+        lines.push(`description: ${l}`);
+    lines.push(`inputSchema: ${JSON.stringify(t.inputSchema ?? {})}`);
+    for (const k of Object.keys(t).filter(k => !['name', 'title', 'description', 'inputSchema'].includes(k)).sort())
+        lines.push(`${k}: ${JSON.stringify(t[k])}`);
+    return lines.map(l => displaySafe(l, 4000));
+}
+/** Line diff, small and dependency-free: common prefix/suffix, then the middle as -/+. */
+export function lineDiff(before, after) {
+    let start = 0;
+    while (start < before.length && start < after.length && before[start] === after[start])
+        start++;
+    let endA = before.length, endB = after.length;
+    while (endA > start && endB > start && before[endA - 1] === after[endB - 1]) {
+        endA--;
+        endB--;
+    }
+    return [
+        ...before.slice(Math.max(0, start - 1), start).map(l => '  ' + l),
+        ...before.slice(start, endA).map(l => '- ' + l),
+        ...after.slice(start, endB).map(l => '+ ' + l),
+        ...after.slice(endB, endB + 1).map(l => '  ' + l),
+    ];
+}
+export function toMarkdown(report, cwd) {
+    const m = report.summary;
+    const out = [];
+    out.push(`## WARDEN · MCP server scan`);
+    out.push('');
+    out.push(`${m.blocked ? '❌' : '✅'} **${m.blocked} blocked**, ${m.allowed} allowed, ${m.errors} not checked, ${m.skipped} skipped${m.launchOnly ? `, ${m.launchOnly} not started` : ''} · ruleset ${mdCode(report.ruleset.version)} · block at ${mdCode(report.policy.blockAtSeverity)}`);
+    out.push('');
+    if (!report.servers.length) {
+        out.push('No MCP servers found in the scanned config files.');
+        return out.join('\n') + '\n';
+    }
+    out.push('| | Server | Config | Tools | Findings | Lock |');
+    out.push('|---|---|---|---|---|---|');
+    for (const s of report.servers) {
+        const mark = s.allow === false ? '❌' : s.status === 'error' ? '⚠️' : s.status === 'skipped' ? '➖' : s.status === 'launch-only' ? '🔸' : '✅';
+        const findings = s.status === 'error' ? `not checked: ${mdCode(s.error ?? '', 100)}`
+            : s.status === 'skipped' ? mdCode(s.skipped ?? '', 80)
+                : [...new Set(s.findings.filter(f => !f.advisory).map(f => f.code + (f.tool ? `(${f.tool})` : '')))].slice(0, 5).map(l => mdCode(l, 70)).join(' ') || (s.status === 'launch-only' ? 'launch line only (not started)' : '—');
+        out.push(`| ${mark} | ${mdCode(s.key, 50)} | ${mdCode(displayPath(s.source, cwd), 60)} | ${s.toolCount ?? '—'} | ${findings} | ${s.lock ? mdCode(s.lock.state) : '—'} |`);
+    }
+    const blocked = report.servers.filter(s => s.allow === false);
+    for (const s of blocked) {
+        out.push('');
+        out.push(`<details><summary>❌ ${mdCode(s.key, 60)} — why it was blocked</summary>`);
+        out.push('');
+        out.push(mdBlock(s.findings.filter(f => !f.advisory).map(f => `[${f.severity}] ${f.code}${f.tool ? ` (${f.tool})` : ''}: ${f.message}`).map(l => displaySafe(l, 1500)).join('\n')));
+        out.push('');
+        out.push('</details>');
+    }
+    const changed = report.servers.filter(s => s.lock?.changes?.length);
+    for (const s of changed) {
+        out.push('');
+        out.push(`<details${s.lock.state === 'drift' || s.lock.state === 'missing' ? ' open' : ''}><summary>${s.lock.state === 'missing' ? 'New server' : 'Changed tool definitions'}: ${mdCode(s.key, 60)} (${s.lock.changes.length} tool${s.lock.changes.length === 1 ? '' : 's'})</summary>`);
+        out.push('');
+        const diff = [];
+        for (const ch of s.lock.changes.slice(0, 40)) {
+            diff.push(`@@ ${ch.kind} ${displaySafe(ch.tool, 120)} @@`);
+            diff.push(...lineDiff(toolText(ch.before), toolText(ch.after)));
+        }
+        if (s.lock.changes.length > 40)
+            diff.push(`… ${s.lock.changes.length - 40} more tools`);
+        out.push(mdBlock(diff.join('\n').slice(0, 60_000), 'diff'));
+        out.push('');
+        out.push('</details>');
+    }
+    if (report.lock?.stale.length) {
+        out.push('');
+        out.push(`In the lock but no longer in any config: ${report.lock.stale.map(id => mdCode(id, 60)).join(', ')}`);
+    }
+    for (const f of report.flows ?? []) {
+        out.push('');
+        out.push(`⚠️ **Toxic flow** (advisory): ${flowSentence(f, t => mdCode(`${t.server}.${t.tool}`, 70))}`);
+    }
+    if (report.historWatch) {
+        out.push('');
+        out.push(`[Follow changes to these servers](${report.historWatch}) (HISTOR feed)`);
+    }
+    out.push('');
+    out.push(`<sub>@aimarket/warden ${displaySafe(report.version, 20)} · ${mdCode(report.ruleset.digest, 60)} · tool descriptions are shown as code; they are untrusted text from the servers.</sub>`);
+    return out.join('\n') + '\n';
+}
+//# sourceMappingURL=scan-report.js.map

package/dist/scan-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-report.js","sourceRoot":"","sources":["../src/scan-report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAI5C,MAAM,cAAc,GAAe,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAEjF,4EAA4E;AAC5E,MAAM,CAAC,MAAM,SAAS,GAA2B;IAC/C,kBAAkB,EAAE,mDAAmD;IACvE,uBAAuB,EAAE,gEAAgE;IACzF,uBAAuB,EAAE,oDAAoD;IAC7E,cAAc,EAAE,kEAAkE;IAClF,uBAAuB,EAAE,4DAA4D;IACrF,oBAAoB,EAAE,sCAAsC;IAC5D,iBAAiB,EAAE,+CAA+C;IAClE,yBAAyB,EAAE,2CAA2C;IACtE,sBAAsB,EAAE,0DAA0D;IAClF,qBAAqB,EAAE,uDAAuD;IAC9E,mBAAmB,EAAE,mCAAmC;IACxD,cAAc,EAAE,mDAAmD;IACnE,iBAAiB,EAAE,kDAAkD;IACrE,oBAAoB,EAAE,gDAAgD;IACtE,qBAAqB,EAAE,sDAAsD;IAC7E,2BAA2B,EAAE,oDAAoD;IACjF,iBAAiB,EAAE,mDAAmD;IACtE,YAAY,EAAE,yCAAyC;IACvD,qBAAqB,EAAE,uDAAuD;IAC9E,iBAAiB,EAAE,yDAAyD;IAC5E,mBAAmB,EAAE,mEAAmE;IACxF,mBAAmB,EAAE,yDAAyD;IAC9E,oBAAoB,EAAE,uEAAuE;IAC7F,UAAU,EAAE,kCAAkC;CAC/C,CAAC;AAEF,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,+CAA+C,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAClH,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,MAAM,CAAC,MAAkB;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IACjE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED,SAAS,YAAY,CAAC,CAAgB;IACpC,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACrF,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,GAAW,EAAE,KAAc;IACrE,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,eAAe,MAAM,CAAC,OAAO,cAAc,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IACzI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACjH,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1O,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACnG,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC;YAC/I,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;aAClE,IAAI,CAAC,CAAC,MAAM,KAAK,OAAO;YAAE,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;aACnE,CAAC;YACJ,MAAM,gBAAgB,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;YAC5J,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAC5H,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACjC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,aAAa;gBAAE,KAAK,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;YACjG,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,QAAQ,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAChG,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC/F,IAAI,KAAK,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC1C,IAAI,IAAI,GAAG,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,CAAC,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;YAChD,IAAI,CAAC,CAAC,MAAM;gBAAE,KAAK,CAAC,IAAI,CAAC,WAAW,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;YAC1H,IAAI,CAAC,CAAC,UAAU;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC;YAC3H,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,KAAK,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACnI,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,iBAAiB,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,cAAc,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACjN,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,sCAAsC,CAAC,CAAC;QAC/H,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,sCAAsC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChJ,CAAC;IACD,IAAI,CAAC,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,yIAAyI,CAAC,CAAC;IACrK,IAAI,MAAM,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,uDAAuD,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACnI,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,gFAAgF;AAEhF,MAAM,iBAAiB,GAA6B,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7H,MAAM,KAAK,GAAmD,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAEjJ,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/F,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,CAAC,CAAC;IAAC,CAAC;AACvB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,GAAW;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAChC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACvH,OAAO,EAAE,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,MAAkB,EAAE,GAAW;IACrD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAC;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,QAAQ;gBAAE,SAAS;YACzB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvI,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjI,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM,EAAE,CAAC,CAAC,IAAI;gBACd,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACxB,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE;gBAChF,SAAS,EAAE,CAAC,EAAE,gBAAgB,EAAE,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC;gBACnI,mBAAmB,EAAE,EAAE,kBAAkB,EAAE,WAAW,EAAE;gBACxD,UAAU,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aAC7J,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,OAAO;QAChB,IAAI,EAAE,CAAC;gBACL,IAAI,EAAE,EAAE,MAAM,EAAE;wBACd,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,iCAAiC;wBAClG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;4BAC/E,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE;4BACtD,OAAO,EAAE,4DAA4D;4BACrE,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;4BAClD,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,kBAAkB,CAAC,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;yBAClH,CAAC,CAAC;qBACJ,EAAE;gBACH,OAAO;gBACP,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE;aACxF,CAAC;KACH,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,2DAA2D;AAC3D,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,GAAG,GAAG,EAAE;IAC3C,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,GAAG,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;AAClE,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,IAAI,GAAG,EAAE;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAClC,OAAO,GAAG,KAAK,GAAG,IAAI,KAAK,IAAI,KAAK,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,CAAsB;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,IAAI,CAAC,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;IAC5F,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7J,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,QAAQ,CAAC,MAAgB,EAAE,KAAe;IACxD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,CAAC;IAChG,IAAI,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9C,OAAO,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;QAAC,IAAI,EAAE,CAAC;QAAC,IAAI,EAAE,CAAC;IAAC,CAAC;IAChG,OAAO;QACL,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;QACjE,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;QAC/C,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9C,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;KAClD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAAkB,EAAE,GAAW;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACxC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,eAAe,CAAC,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,iBAAiB,CAAC,CAAC,OAAO,WAAW,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACzR,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAAC,GAAG,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;QAAC,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAAC,CAAC;IAC5H,GAAG,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAC5D,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5I,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE;YAClF,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,EAAE,CAAC;gBACtD,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9N,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,MAAM,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,SAAS,IAAI,GAAG,MAAM,QAAQ,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5K,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IAC9D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iCAAiC,CAAC,CAAC;QACpF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpL,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACpE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAK,CAAC,KAAK,KAAK,OAAO,IAAI,CAAC,CAAC,IAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,IAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,0BAA0B,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAK,CAAC,OAAQ,CAAC,MAAM,QAAQ,CAAC,CAAC,IAAK,CAAC,OAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC;QAChS,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,IAAI,GAAa,EAAE,CAAC;QAC1B,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,IAAK,CAAC,OAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,CAAC,IAAK,CAAC,OAAQ,CAAC,MAAM,GAAG,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAK,CAAC,OAAQ,CAAC,MAAM,GAAG,EAAE,aAAa,CAAC,CAAC;QAC5F,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACzB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,4CAA4C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,iCAAiC,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,qCAAqC,MAAM,CAAC,WAAW,iBAAiB,CAAC,CAAC;IACrF,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,yBAAyB,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,yFAAyF,CAAC,CAAC;IACnM,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAC/B,CAAC"}