@atbash/cli 0.5.11 → 0.5.13

package/dist/commands/minimal-mcp-client.js

@@ -0,0 +1,391 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MinimalMcpClient = exports.SUPPORTED_PROTOCOL_VERSIONS = void 0;
+exports.defaultChildEnv = defaultChildEnv;
+exports.isLoopbackHost = isLoopbackHost;
+/**
+ * Minimal MCP client — a deliberately NARROW, fail-closed implementation of only
+ * the metadata calls Atbash needs. It is NOT a general MCP client.
+ *
+ * WHY THIS EXISTS
+ * The official @modelcontextprotocol/sdk drags a full server HTTP stack (express,
+ * cors, body-parser, express-rate-limit, …) into what is a CLIENT-ONLY CLI — ~80
+ * transitive packages for a tool whose whole pitch is supply-chain hygiene. We only
+ * ever call five metadata methods, so we own exactly that slice and nothing more.
+ *
+ * SUPPORTED (and nothing else):
+ *   - initialize + notifications/initialized (lifecycle)
+ *   - tools/list, resources/list, prompts/list (metadata only — never tools/call)
+ *   - transports: stdio (newline-delimited JSON-RPC) and Streamable HTTP (JSON or
+ *     a single SSE response), with mcp-session-id.
+ *
+ * FAIL CLOSED: unknown transport → error; a server protocol version we don't
+ * support → error; oversized/hung/malformed → error. Never executes a tool. Uses
+ * spawn(command, args, { shell: false }) — no shell. No HTTP redirects. Response
+ * size + time + buffered-bytes are all hard-capped.
+ *
+ * The official SDK is retained as a DEV dependency and used as the compatibility
+ * oracle in differential tests (test/mcp-differential.test.js) — parity is proven
+ * against it, but it is not shipped at runtime.
+ */
+const child_process_1 = require("child_process");
+/** MCP protocol versions this narrow client understands. We send the newest and
+ *  fail closed if the server insists on one outside this set. */
+exports.SUPPORTED_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26", "2024-11-05"];
+const CLIENT_PROTOCOL_VERSION = exports.SUPPORTED_PROTOCOL_VERSIONS[0];
+const CLIENT_INFO = { name: "atbash-cli-introspect", version: "1.0.0" };
+const MAX_STDIO_BUFFER = 8 * 1024 * 1024; // 8MB of unframed stdout → treat as hostile
+const MAX_HTTP_BYTES = 8 * 1024 * 1024;
+const MAX_STDERR_KEEP = 2 * 1024; // keep a little stderr for error messages only
+/**
+ * The environment a spawned MCP server gets when its config does NOT declare one.
+ * `spawn(cmd, args, { env: undefined })` inherits the ENTIRE parent environment —
+ * every API key in the operator's shell — so we never rely on that default. This
+ * allowlist mirrors the official SDK's `getDefaultEnvironment()`: enough for a
+ * normal server to start, and nothing else.
+ */
+const DEFAULT_ENV_KEYS = process.platform === "win32"
+    ? ["APPDATA", "HOMEDRIVE", "HOMEPATH", "LOCALAPPDATA", "PATH", "PROCESSOR_ARCHITECTURE", "SYSTEMDRIVE", "SYSTEMROOT", "TEMP", "USERNAME", "USERPROFILE"]
+    : ["HOME", "LOGNAME", "PATH", "SHELL", "USER"];
+/** Build the minimal child environment from an allowlist of the parent's vars. */
+function defaultChildEnv(source = process.env) {
+    const env = {};
+    for (const key of DEFAULT_ENV_KEYS) {
+        const value = source[key];
+        // A function-shaped value is a classic shell-import injection vector (Shellshock);
+        // it is never something a server legitimately needs inherited.
+        if (typeof value === "string" && !value.startsWith("()"))
+            env[key] = value;
+    }
+    return env;
+}
+/**
+ * Exact loopback test. A PREFIX match (`/^(localhost|127\.)/`) is not sufficient:
+ * `localhost.evil.example` and `127.evil.example` are ordinary public hostnames
+ * that would pass it and win an unencrypted connection.
+ */
+function isLoopbackHost(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    if (host === "localhost" || host === "::1" || host === "0:0:0:0:0:0:0:1")
+        return true;
+    // 127.0.0.0/8 — four real octets, no trailing labels.
+    const octets = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+    return !!octets && octets[1] === "127" && octets.slice(1).every((o) => Number(o) <= 255);
+}
+// ── stdio transport ──────────────────────────────────────────────────────────
+class StdioConnection {
+    constructor(command, args, env) {
+        this.buf = "";
+        this.pending = new Map();
+        this.nextId = 1;
+        this.stderr = "";
+        this.exited = null;
+        this.fatal = null;
+        // shell:false is load-bearing — never let a configured "command" string be
+        // interpreted by a shell. args are passed as a separate argv array.
+        // env is ALWAYS explicit: `undefined` would hand the child the whole parent
+        // environment, so an unconfigured server gets the narrow allowlist instead.
+        this.child = (0, child_process_1.spawn)(command, args, { shell: false, env: env ?? defaultChildEnv(), stdio: ["pipe", "pipe", "pipe"] });
+        this.child.stdout.setEncoding("utf8");
+        this.child.stderr.setEncoding("utf8");
+        this.child.stdout.on("data", (chunk) => this.onStdout(chunk));
+        this.child.stderr.on("data", (chunk) => { if (this.stderr.length < MAX_STDERR_KEEP)
+            this.stderr += chunk; });
+        this.child.on("error", (e) => this.failAll(new Error(`spawn failed: ${e.message}`)));
+        this.child.on("exit", (code, signal) => {
+            this.exited = { code, signal };
+            this.failAll(new Error(`server exited (code ${code ?? "null"}${signal ? `, signal ${signal}` : ""})${this.stderr ? `: ${this.stderr.trim().slice(0, 160)}` : ""}`));
+        });
+    }
+    onStdout(chunk) {
+        this.buf += chunk;
+        if (this.buf.length > MAX_STDIO_BUFFER) {
+            this.failAll(new Error("stdout exceeded buffer cap without a complete message"));
+            return;
+        }
+        // Newline-delimited JSON-RPC: parse each complete line, keep the partial tail.
+        let nl;
+        while ((nl = this.buf.indexOf("\n")) !== -1) {
+            const line = this.buf.slice(0, nl).trim();
+            this.buf = this.buf.slice(nl + 1);
+            if (!line)
+                continue;
+            let msg;
+            try {
+                msg = JSON.parse(line);
+            }
+            catch {
+                continue;
+            } // ignore non-JSON log lines
+            // Only responses carry an id we issued. Notifications (no id) are ignored.
+            if (msg.id === undefined || msg.id === null)
+                continue;
+            const id = typeof msg.id === "number" ? msg.id : Number(msg.id);
+            const waiter = this.pending.get(id);
+            if (!waiter)
+                continue;
+            this.pending.delete(id);
+            if (msg.error)
+                waiter.reject(new Error(`rpc error ${msg.error.code ?? ""}: ${msg.error.message ?? "unknown"}`.trim()));
+            else
+                waiter.resolve(msg.result);
+        }
+    }
+    failAll(e) {
+        this.fatal = this.fatal ?? e;
+        for (const { reject } of this.pending.values())
+            reject(e);
+        this.pending.clear();
+    }
+    request(method, params, timeoutMs) {
+        if (this.fatal)
+            return Promise.reject(this.fatal);
+        const id = this.nextId++;
+        const payload = JSON.stringify({ jsonrpc: "2.0", id, method, params }) + "\n";
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => { this.pending.delete(id); reject(new Error(`timed out after ${timeoutMs}ms waiting for ${method}`)); }, timeoutMs);
+            this.pending.set(id, {
+                resolve: (v) => { clearTimeout(timer); resolve(v); },
+                reject: (e) => { clearTimeout(timer); reject(e); },
+            });
+            try {
+                this.child.stdin.write(payload);
+            }
+            catch (e) {
+                clearTimeout(timer);
+                this.pending.delete(id);
+                reject(e instanceof Error ? e : new Error(String(e)));
+            }
+        });
+    }
+    notify(method, params) {
+        if (this.fatal)
+            return Promise.reject(this.fatal);
+        try {
+            this.child.stdin.write(JSON.stringify({ jsonrpc: "2.0", method, params }) + "\n");
+        }
+        catch { /* best effort */ }
+        return Promise.resolve();
+    }
+    // stdio frames carry no headers — the version negotiated at initialize governs
+    // the whole process lifetime, so there is nothing to echo per message.
+    setProtocolVersion() { }
+    async close() {
+        this.failAll(new Error("connection closed"));
+        if (this.exited)
+            return;
+        try {
+            this.child.stdin.end();
+        }
+        catch { /* ignore */ }
+        this.child.kill("SIGTERM");
+        // Escalate to SIGKILL if it doesn't exit promptly, so a stuck server can't linger.
+        await new Promise((resolve) => {
+            const t = setTimeout(() => { try {
+                this.child.kill("SIGKILL");
+            }
+            catch { /* ignore */ } resolve(); }, 2000);
+            this.child.on("exit", () => { clearTimeout(t); resolve(); });
+        });
+    }
+}
+// ── Streamable HTTP transport ────────────────────────────────────────────────
+class HttpConnection {
+    constructor(url) {
+        this.url = url;
+        this.nextId = 1;
+    }
+    setProtocolVersion(version) { this.protocolVersion = version; }
+    async request(method, params, timeoutMs) {
+        const id = this.nextId++;
+        const res = await this.post({ jsonrpc: "2.0", id, method, params }, timeoutMs);
+        if (res.error)
+            throw new Error(`rpc error ${res.error.code ?? ""}: ${res.error.message ?? "unknown"}`.trim());
+        return res.result;
+    }
+    async notify(method, params) {
+        // Notifications get no response; a 202 is expected. Best-effort, short timeout.
+        try {
+            await this.post({ jsonrpc: "2.0", method, params }, 5000, true);
+        }
+        catch { /* best effort */ }
+    }
+    async post(body, timeoutMs, notification = false) {
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+        try {
+            const headers = {
+                "content-type": "application/json",
+                accept: "application/json, text/event-stream",
+            };
+            if (this.sessionId)
+                headers["mcp-session-id"] = this.sessionId;
+            // Required from MCP 2025-06-18 onward on every request AFTER initialize.
+            // Servers that enforce it reject the request outright; servers that don't
+            // silently assume 2025-03-26, which would negotiate us down.
+            if (this.protocolVersion)
+                headers["mcp-protocol-version"] = this.protocolVersion;
+            const resp = await fetch(this.url, { method: "POST", headers, body: JSON.stringify(body), signal: ctrl.signal, redirect: "error" });
+            const sid = resp.headers.get("mcp-session-id");
+            if (sid)
+                this.sessionId = sid;
+            if (notification)
+                return {}; // don't parse a 202/empty notification ack
+            if (!resp.ok)
+                throw new Error(`HTTP ${resp.status}`);
+            const ctype = resp.headers.get("content-type") ?? "";
+            if (ctype.includes("text/event-stream"))
+                return await this.readSse(resp, Number(body.id));
+            // plain application/json response
+            const text = await this.readBounded(resp);
+            return JSON.parse(text);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /** Read an SSE stream until the JSON-RPC response with our id arrives (server may
+     *  interleave notifications first). Bounded by bytes; caller bounds by time. */
+    async readSse(resp, wantId) {
+        if (!resp.body)
+            throw new Error("empty SSE body");
+        const reader = resp.body.getReader();
+        const decoder = new TextDecoder();
+        let buf = "";
+        let total = 0;
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value?.byteLength ?? 0;
+            if (total > MAX_HTTP_BYTES) {
+                try {
+                    await reader.cancel();
+                }
+                catch { /* ignore */ }
+                throw new Error("SSE stream exceeded size cap");
+            }
+            buf += decoder.decode(value, { stream: true });
+            // SSE events are separated by a blank line; each event may have data: lines.
+            let sep;
+            while ((sep = buf.indexOf("\n\n")) !== -1) {
+                const event = buf.slice(0, sep);
+                buf = buf.slice(sep + 2);
+                const data = event.split(/\r?\n/).filter((l) => l.startsWith("data:")).map((l) => l.slice(5).trim()).join("");
+                if (!data)
+                    continue;
+                let msg;
+                try {
+                    msg = JSON.parse(data);
+                }
+                catch {
+                    continue;
+                }
+                if (msg.id !== undefined && msg.id !== null && Number(msg.id) === wantId) {
+                    try {
+                        await reader.cancel();
+                    }
+                    catch { /* ignore */ }
+                    return msg;
+                }
+            }
+        }
+        throw new Error("SSE stream ended before a matching response");
+    }
+    async readBounded(resp) {
+        if (!resp.body)
+            return "";
+        const reader = resp.body.getReader();
+        const decoder = new TextDecoder();
+        let out = "";
+        let total = 0;
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value?.byteLength ?? 0;
+            if (total > MAX_HTTP_BYTES) {
+                try {
+                    await reader.cancel();
+                }
+                catch { /* ignore */ }
+                throw new Error("response exceeded size cap");
+            }
+            out += decoder.decode(value, { stream: true });
+        }
+        return out;
+    }
+    /** Release the negotiated session server-side. Without this, every introspection
+     *  run leaves an orphaned session on the server until its own timeout expires. */
+    async close() {
+        if (!this.sessionId)
+            return; // no session was negotiated — nothing to release
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), 3000);
+        try {
+            const headers = { "mcp-session-id": this.sessionId };
+            if (this.protocolVersion)
+                headers["mcp-protocol-version"] = this.protocolVersion;
+            const resp = await fetch(this.url, { method: "DELETE", headers, signal: ctrl.signal, redirect: "error" });
+            // 405 is explicitly allowed by the spec for servers that don't support it.
+            await resp.body?.cancel().catch(() => { });
+        }
+        catch { /* teardown is best-effort; a failed DELETE must not fail the scan */ }
+        finally {
+            clearTimeout(timer);
+            this.sessionId = undefined;
+        }
+    }
+}
+/** The narrow client: connect (initialize handshake) then list metadata. */
+class MinimalMcpClient {
+    constructor(spec) {
+        this.connected = false;
+        if (spec.url && spec.url.trim()) {
+            let u;
+            try {
+                u = new URL(spec.url);
+            }
+            catch {
+                throw new Error("invalid server url");
+            }
+            if (u.protocol !== "https:" && !isLoopbackHost(u.hostname))
+                throw new Error("refusing non-HTTPS remote MCP endpoint");
+            this.conn = new HttpConnection(u);
+        }
+        else if (spec.command && spec.command.trim()) {
+            this.conn = new StdioConnection(spec.command, spec.args ?? [], spec.env);
+        }
+        else {
+            throw new Error("no url or command to reach the server");
+        }
+    }
+    async connect(timeoutMs) {
+        const result = (await this.conn.request("initialize", {
+            protocolVersion: CLIENT_PROTOCOL_VERSION,
+            capabilities: {},
+            clientInfo: CLIENT_INFO,
+        }, timeoutMs));
+        // Fail closed on a protocol version we don't understand.
+        const serverVersion = typeof result?.protocolVersion === "string" ? result.protocolVersion : undefined;
+        if (serverVersion && !exports.SUPPORTED_PROTOCOL_VERSIONS.includes(serverVersion)) {
+            throw new Error(`unsupported MCP protocol version: ${serverVersion}`);
+        }
+        // Lock in the negotiated version BEFORE any further traffic — the
+        // `notifications/initialized` message already has to carry it over HTTP.
+        this.conn.setProtocolVersion(serverVersion ?? CLIENT_PROTOCOL_VERSION);
+        await this.conn.notify("notifications/initialized", {});
+        this.connected = true;
+    }
+    async list(method, timeoutMs) {
+        if (!this.connected)
+            throw new Error("not connected");
+        return (await this.conn.request(method, {}, timeoutMs));
+    }
+    listTools(timeoutMs) { return this.list("tools/list", timeoutMs); }
+    listResources(timeoutMs) { return this.list("resources/list", timeoutMs); }
+    listPrompts(timeoutMs) { return this.list("prompts/list", timeoutMs); }
+    async close() { await this.conn.close(); }
+}
+exports.MinimalMcpClient = MinimalMcpClient;
+//# sourceMappingURL=minimal-mcp-client.js.map

package/dist/commands/minimal-mcp-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minimal-mcp-client.js","sourceRoot":"","sources":["../../src/commands/minimal-mcp-client.ts"],"names":[],"mappings":";;;AAiDA,0CASC;AAOD,wCAMC;AAvED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,iDAA2E;AAE3E;iEACiE;AACpD,QAAA,2BAA2B,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAU,CAAC;AAC/F,MAAM,uBAAuB,GAAG,mCAA2B,CAAC,CAAC,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,4CAA4C;AACtF,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACvC,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,+CAA+C;AAEjF;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;IACnD,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,EAAE,wBAAwB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC;IACxJ,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAEjD,kFAAkF;AAClF,SAAgB,eAAe,CAAC,SAA4B,OAAO,CAAC,GAAG;IACrE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,gBAAgB,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,mFAAmF;QACnF,+DAA+D;QAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAC7E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,cAAc,CAAC,QAAgB;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,iBAAiB;QAAE,OAAO,IAAI,CAAC;IACtF,sDAAsD;IACtD,MAAM,MAAM,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AAC3F,CAAC;AAeD,gFAAgF;AAChF,MAAM,eAAe;IASnB,YAAY,OAAe,EAAE,IAAc,EAAE,GAAuC;QAP5E,QAAG,GAAG,EAAE,CAAC;QACT,YAAO,GAAG,IAAI,GAAG,EAAyE,CAAC;QAC3F,WAAM,GAAG,CAAC,CAAC;QACX,WAAM,GAAG,EAAE,CAAC;QACZ,WAAM,GAA0D,IAAI,CAAC;QACrE,UAAK,GAAiB,IAAI,CAAC;QAGjC,2EAA2E;QAC3E,oEAAoE;QACpE,4EAA4E;QAC5E,4EAA4E;QAC5E,IAAI,CAAC,KAAK,GAAG,IAAA,qBAAK,EAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,IAAI,eAAe,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAmC,CAAC;QACtJ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,eAAe;YAAE,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACrH,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,uBAAuB,IAAI,IAAI,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACtK,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,QAAQ,CAAC,KAAa;QAC5B,IAAI,CAAC,GAAG,IAAI,KAAK,CAAC;QAClB,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACrI,+EAA+E;QAC/E,IAAI,EAAU,CAAC;QACf,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI;gBAAE,SAAS;YACpB,IAAI,GAAoB,CAAC;YACzB,IAAI,CAAC;gBAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAS;YAAC,CAAC,CAAC,4BAA4B;YACnG,2EAA2E;YAC3E,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI;gBAAE,SAAS;YACtD,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACpC,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,IAAI,GAAG,CAAC,KAAK;gBAAE,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;;gBAClH,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,CAAQ;QACtB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAC7B,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,CAAC,MAAc,EAAE,MAA+B,EAAE,SAAiB;QACxE,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC;QAC9E,OAAO,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,SAAS,kBAAkB,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;YACnJ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE;gBACnB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpD,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aACnD,CAAC,CAAC;YACH,IAAI,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,CAAC;QAC7J,CAAC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,MAAc,EAAE,MAA+B;QACpD,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACtH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,+EAA+E;IAC/E,uEAAuE;IACvE,kBAAkB,KAAyC,CAAC;IAE5D,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC;YAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3B,mFAAmF;QACnF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;gBAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC5G,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,cAAc;IAIlB,YAAoB,GAAQ;QAAR,QAAG,GAAH,GAAG,CAAK;QAHpB,WAAM,GAAG,CAAC,CAAC;IAGY,CAAC;IAEhC,kBAAkB,CAAC,OAAe,IAAU,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC;IAE7E,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,MAA+B,EAAE,SAAiB;QAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC;QAC/E,IAAI,GAAG,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9G,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,MAA+B;QAC1D,gFAAgF;QAChF,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IACtG,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAA6B,EAAE,SAAiB,EAAE,YAAY,GAAG,KAAK;QACvF,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B;gBACtC,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,qCAAqC;aAC9C,CAAC;YACF,IAAI,IAAI,CAAC,SAAS;gBAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC;YAC/D,yEAAyE;YACzE,0EAA0E;YAC1E,6DAA6D;YAC7D,IAAI,IAAI,CAAC,eAAe;gBAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;YACjF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACpI,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC/C,IAAI,GAAG;gBAAE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;YAC9B,IAAI,YAAY;gBAAE,OAAO,EAAE,CAAC,CAAC,2CAA2C;YACxE,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACrD,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC;gBAAE,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1F,kCAAkC;YAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED;oFACgF;IACxE,KAAK,CAAC,OAAO,CAAC,IAAc,EAAE,MAAc;QAClD,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAClD,MAAM,MAAM,GAAI,IAAI,CAAC,IAAmC,CAAC,SAAS,EAAE,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAAC,CAAC;YACtI,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/C,6EAA6E;YAC7E,IAAI,GAAW,CAAC;YAChB,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAChC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBACzB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC9G,IAAI,CAAC,IAAI;oBAAE,SAAS;gBACpB,IAAI,GAAoB,CAAC;gBACzB,IAAI,CAAC;oBAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACtE,IAAI,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC;oBAAC,IAAI,CAAC;wBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;oBAAC,OAAO,GAAG,CAAC;gBAAC,CAAC;YACjJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,IAAc;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAI,IAAI,CAAC,IAAmC,CAAC,SAAS,EAAE,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,KAAK,IAAI,KAAK,EAAE,UAAU,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAAC,CAAC;YACpI,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;sFACkF;IAClF,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,iDAAiD;QAC9E,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B,EAAE,gBAAgB,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;YAC7E,IAAI,IAAI,CAAC,eAAe;gBAAE,OAAO,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;YACjF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1G,2EAA2E;YAC3E,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAgB,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAC,qEAAqE,CAAC,CAAC;gBAAS,CAAC;YACzF,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,CAAC;IACH,CAAC;CACF;AAID,4EAA4E;AAC5E,MAAa,gBAAgB;IAG3B,YAAY,IAAuF;QAD3F,cAAS,GAAG,KAAK,CAAC;QAExB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YAChC,IAAI,CAAM,CAAC;YACX,IAAI,CAAC;gBAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAAC,CAAC;YAC/E,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACtH,IAAI,CAAC,IAAI,GAAG,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC,IAAI,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE;YACpD,eAAe,EAAE,uBAAuB;YACxC,YAAY,EAAE,EAAE;YAChB,UAAU,EAAE,WAAW;SACxB,EAAE,SAAS,CAAC,CAA8C,CAAC;QAC5D,yDAAyD;QACzD,MAAM,aAAa,GAAG,OAAO,MAAM,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,IAAI,aAAa,IAAI,CAAE,mCAAiD,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YACjG,MAAM,IAAI,KAAK,CAAC,qCAAqC,aAAa,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,kEAAkE;QAClE,yEAAyE;QACzE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,aAAa,IAAI,uBAAuB,CAAC,CAAC;QACvE,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,2BAA2B,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,SAAiB;QAClD,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;QACtD,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,EAAE,SAAS,CAAC,CAAsB,CAAC;IAC/E,CAAC;IACD,SAAS,CAAC,SAAiB,IAAgC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACvG,aAAa,CAAC,SAAiB,IAAgC,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/G,WAAW,CAAC,SAAiB,IAAgC,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IAE3G,KAAK,CAAC,KAAK,KAAoB,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;CAC1D;AA3CD,4CA2CC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/cli",
-  "version": "0.5.11",
+  "version": "0.5.13",
   "description": "Atbash CLI — control boundary before the last irreversible step in an agent workflow",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://atbash.ai",
@@ -24,18 +24,24 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsc",
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc",
+    "test": "node -r ts-node/register --test test/*.test.js",
     "dev": "ts-node src/bin/atbash.ts",
     "release": "npm version patch --no-git-tag-version && npm run build && npx npm@10 publish --access public"
   },
   "dependencies": {
-    "@atbash/sdk": "^0.5.8",
+    "@atbash/sdk": "^0.6.2",
+    "@iarna/toml": "2.2.5",
     "chalk": "^4.1.2",
     "commander": "^12.0.0",
+    "jsonc-parser": "3.3.1",
     "omelette": "^0.4.17",
-    "ora": "^5.4.1"
+    "ora": "^5.4.1",
+    "yaml": "2.9.0"
   },
   "devDependencies": {
+    "@modelcontextprotocol/sdk": "1.30.0",
     "@types/node": "^20.0.0",
     "ts-node": "^10.9.2",
     "typescript": "^5.4.0"