@auth51/mcp-proxy 0.1.0

package/dist/policy.js

@@ -0,0 +1,139 @@
+import { readFileSync } from "node:fs";
+/**
+ * The default policy if none is supplied. It is deliberately conservative for the
+ * coding-agent use case: allow by default, but block the classes of action that
+ * caused the real-world incidents (prod data destruction, recursive deletes,
+ * credential exfiltration, unscoped privilege escalation).
+ */
+export const DEFAULT_POLICY = {
+    version: "1",
+    default: "allow",
+    rules: [
+        {
+            id: "destructive-sql",
+            description: "Destructive SQL (DROP/TRUNCATE/DELETE-without-WHERE) requires explicit human approval.",
+            tool: "*",
+            denyArgsMatch: [
+                "(?i)\\bdrop\\s+(table|database|schema)\\b",
+                "(?i)\\btruncate\\s+table\\b",
+                "(?i)\\bdelete\\s+from\\b(?![\\s\\S]*\\bwhere\\b)",
+            ],
+        },
+        {
+            id: "recursive-delete",
+            description: "Recursive / forced filesystem deletion is blocked.",
+            tool: "*",
+            denyArgsMatch: ["\\brm\\s+-[a-z]*r[a-z]*f\\b", "\\brm\\s+-[a-z]*f[a-z]*r\\b"],
+        },
+        {
+            id: "destructive-tool-name",
+            description: "Tools whose name implies irreversible destruction are blocked by least-privilege default.",
+            toolMatch: "(?i)(drop|truncate|destroy|wipe|purge)_?(database|table|all|backups?)",
+        },
+        {
+            id: "secret-exfiltration",
+            description: "Reading well-known secret material is blocked.",
+            tool: "*",
+            denyArgsMatch: [
+                "(?i)/\\.aws/credentials",
+                "(?i)/\\.ssh/id_(rsa|ed25519)",
+                // .env optionally followed by a suffix (.local), but terminated by any
+                // non-alphanumeric (quote/slash/end) so it fires on JSON-embedded paths
+                // like "project/.env" without matching ".environment"/".envrc".
+                "(?i)\\.env([^a-z0-9]|$)",
+            ],
+        },
+    ],
+};
+function globToRegExp(glob) {
+    // Minimal glob: escape regex specials, then turn \* into .*
+    const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+    return new RegExp(`^${escaped}$`);
+}
+/**
+ * Compile a pattern that may carry a leading inline-flag group like `(?i)` or
+ * `(?is)`. JavaScript's RegExp does NOT support inline flags, so we translate
+ * them to real RegExp flags. Returns null on an invalid pattern.
+ */
+function compileRegExp(pattern) {
+    try {
+        const m = pattern.match(/^\(\?([a-z]+)\)/);
+        if (m) {
+            const flags = m[1].replace(/[^gimsuy]/g, "");
+            return new RegExp(pattern.slice(m[0].length), flags);
+        }
+        return new RegExp(pattern);
+    }
+    catch {
+        return null;
+    }
+}
+function ruleMatchesTool(rule, tool) {
+    if (rule.toolMatch) {
+        const re = compileRegExp(rule.toolMatch);
+        if (re && re.test(tool))
+            return true;
+    }
+    if (rule.tool) {
+        return globToRegExp(rule.tool).test(tool);
+    }
+    // A rule with neither tool nor toolMatch applies to every tool.
+    return !rule.toolMatch;
+}
+function argsTrigger(rule, argsText) {
+    if (!rule.denyArgsMatch || rule.denyArgsMatch.length === 0)
+        return true; // no arg constraint → fires on tool match alone
+    for (const pat of rule.denyArgsMatch) {
+        const re = compileRegExp(pat);
+        if (re && re.test(argsText))
+            return true;
+    }
+    return false;
+}
+export class PolicyEngine {
+    policy;
+    constructor(policy) {
+        this.policy = policy;
+    }
+    static load(path) {
+        if (!path)
+            return new PolicyEngine(DEFAULT_POLICY);
+        try {
+            const raw = readFileSync(path, "utf8");
+            const parsed = JSON.parse(raw);
+            if (!parsed.rules || !parsed.default || !parsed.version) {
+                throw new Error("policy missing required fields (version, default, rules)");
+            }
+            return new PolicyEngine(parsed);
+        }
+        catch (err) {
+            throw new Error(`auth51: failed to load policy from ${path}: ${err.message}`);
+        }
+    }
+    evaluate(call) {
+        for (const rule of this.policy.rules) {
+            if (!ruleMatchesTool(rule, call.tool))
+                continue;
+            const hasArgConstraint = !!rule.denyArgsMatch && rule.denyArgsMatch.length > 0;
+            const fires = hasArgConstraint ? argsTrigger(rule, call.argsText) : true;
+            if (!fires)
+                continue;
+            const action = rule.action ?? "deny";
+            // An explicit allow-rule short-circuits to allow.
+            if (action === "allow") {
+                return { allow: true, ruleId: rule.id, reason: rule.reason ?? rule.description ?? "allowed by policy rule" };
+            }
+            return {
+                allow: false,
+                ruleId: rule.id,
+                reason: rule.reason ?? rule.description ?? `blocked by policy rule "${rule.id}"`,
+            };
+        }
+        return {
+            allow: this.policy.default === "allow",
+            ruleId: "default",
+            reason: `no rule matched; policy default is "${this.policy.default}"`,
+        };
+    }
+}
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAGvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAW;IACpC,OAAO,EAAE,GAAG;IACZ,OAAO,EAAE,OAAO;IAChB,KAAK,EAAE;QACL;YACE,EAAE,EAAE,iBAAiB;YACrB,WAAW,EACT,wFAAwF;YAC1F,IAAI,EAAE,GAAG;YACT,aAAa,EAAE;gBACb,2CAA2C;gBAC3C,6BAA6B;gBAC7B,kDAAkD;aACnD;SACF;QACD;YACE,EAAE,EAAE,kBAAkB;YACtB,WAAW,EAAE,oDAAoD;YACjE,IAAI,EAAE,GAAG;YACT,aAAa,EAAE,CAAC,6BAA6B,EAAE,6BAA6B,CAAC;SAC9E;QACD;YACE,EAAE,EAAE,uBAAuB;YAC3B,WAAW,EACT,2FAA2F;YAC7F,SAAS,EAAE,uEAAuE;SACnF;QACD;YACE,EAAE,EAAE,qBAAqB;YACzB,WAAW,EAAE,gDAAgD;YAC7D,IAAI,EAAE,GAAG;YACT,aAAa,EAAE;gBACb,yBAAyB;gBACzB,8BAA8B;gBAC9B,uEAAuE;gBACvE,wEAAwE;gBACxE,gEAAgE;gBAChE,yBAAyB;aAC1B;SACF;KACF;CACF,CAAC;AAEF,SAAS,YAAY,CAAC,IAAY;IAChC,4DAA4D;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC/E,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC3C,IAAI,CAAC,EAAE,CAAC;YACN,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;YAC7C,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,IAAgB,EAAE,IAAY;IACrD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,gEAAgE;IAChE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;AACzB,CAAC;AAED,SAAS,WAAW,CAAC,IAAgB,EAAE,QAAgB;IACrD,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,gDAAgD;IACzH,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,YAAY;IACf,MAAM,CAAS;IAEvB,YAAY,MAAc;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,IAAa;QACvB,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,YAAY,CAAC,cAAc,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACxD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAC9E,CAAC;YACD,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,IAAc;QACrB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAS;YAEhD,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/E,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACzE,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;YACrC,kDAAkD;YAClD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBACvB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,IAAI,wBAAwB,EAAE,CAAC;YAC/G,CAAC;YACD,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,WAAW,IAAI,2BAA2B,IAAI,CAAC,EAAE,GAAG;aACjF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO;YACtC,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,uCAAuC,IAAI,CAAC,MAAM,CAAC,OAAO,GAAG;SACtE,CAAC;IACJ,CAAC;CACF"}

package/dist/pop.d.ts

@@ -0,0 +1,21 @@
+interface EcJwk {
+    kty: string;
+    crv: string;
+    x: string;
+    y: string;
+}
+/** The proxy's DPoP key thumbprint (cnf.jkt) — request the Hop-B token bound to it. */
+export declare function jkt(): string;
+/** The public JWK (for tests / introspection). */
+export declare function publicJwk(): EcJwk;
+/**
+ * A DPoP proof JWT bound to this request (htm/htu), fresh (iat/jti), and — when
+ * a `token` is given — to that access token (ath). Signed ES256 with the proxy's
+ * key; header carries the public jwk (typ "dpop+jwt").
+ */
+export declare function proof(htm: string, htu: string, opts?: {
+    token?: string;
+}): string;
+/** Reset the process key (tests only). */
+export declare function _resetForTest(): void;
+export {};

package/dist/pop.js

@@ -0,0 +1,76 @@
+/**
+ * DPoP (RFC 9449) for the proxy's Hop-B downstream token — dependency-free via
+ * `node:crypto` (EC P-256 + ES256). The proxy holds one ephemeral key per
+ * process; the Hop-B RS token is bound to its thumbprint (`cnf.jkt`), and every
+ * server→RS request the proxy forwards carries a fresh proof. So a stolen RS
+ * token is inert without this key — the same sender-constraint the embed gives
+ * its downstream tokens, now on the proxy path.
+ */
+import * as crypto from "node:crypto";
+let _priv = null;
+let _pubJwk = null;
+let _jkt = null;
+function b64u(buf) {
+    return buf.toString("base64url");
+}
+function ensureKey() {
+    if (_priv)
+        return;
+    const { publicKey, privateKey } = crypto.generateKeyPairSync("ec", {
+        namedCurve: "P-256",
+    });
+    _priv = privateKey;
+    const jwk = publicKey.export({ format: "jwk" });
+    _pubJwk = { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+    // RFC 7638 thumbprint: SHA-256 of the canonical JWK (members crv,kty,x,y in
+    // lexicographic order, no whitespace). Matches the verifier's _ec_jwk_thumbprint.
+    const canon = JSON.stringify({
+        crv: _pubJwk.crv, kty: _pubJwk.kty, x: _pubJwk.x, y: _pubJwk.y,
+    });
+    _jkt = b64u(crypto.createHash("sha256").update(canon).digest());
+}
+/** The proxy's DPoP key thumbprint (cnf.jkt) — request the Hop-B token bound to it. */
+export function jkt() {
+    ensureKey();
+    return _jkt;
+}
+/** The public JWK (for tests / introspection). */
+export function publicJwk() {
+    ensureKey();
+    return { ..._pubJwk };
+}
+/**
+ * A DPoP proof JWT bound to this request (htm/htu), fresh (iat/jti), and — when
+ * a `token` is given — to that access token (ath). Signed ES256 with the proxy's
+ * key; header carries the public jwk (typ "dpop+jwt").
+ */
+export function proof(htm, htu, opts) {
+    ensureKey();
+    const header = { typ: "dpop+jwt", alg: "ES256", jwk: _pubJwk };
+    const now = Math.floor(Date.now() / 1000);
+    const payload = {
+        htm: htm.toUpperCase(),
+        htu,
+        iat: now,
+        jti: crypto.randomUUID(),
+    };
+    if (opts?.token) {
+        payload.ath = b64u(crypto.createHash("sha256").update(opts.token).digest());
+    }
+    const signingInput = b64u(Buffer.from(JSON.stringify(header))) +
+        "." +
+        b64u(Buffer.from(JSON.stringify(payload)));
+    // JOSE requires the raw (r||s) signature, not DER — dsaEncoding ieee-p1363.
+    const sig = crypto.sign("sha256", Buffer.from(signingInput), {
+        key: _priv,
+        dsaEncoding: "ieee-p1363",
+    });
+    return signingInput + "." + b64u(sig);
+}
+/** Reset the process key (tests only). */
+export function _resetForTest() {
+    _priv = null;
+    _pubJwk = null;
+    _jkt = null;
+}
+//# sourceMappingURL=pop.js.map

package/dist/pop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pop.js","sourceRoot":"","sources":["../src/pop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAStC,IAAI,KAAK,GAA4B,IAAI,CAAC;AAC1C,IAAI,OAAO,GAAiB,IAAI,CAAC;AACjC,IAAI,IAAI,GAAkB,IAAI,CAAC;AAE/B,SAAS,IAAI,CAAC,GAAW;IACvB,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,SAAS;IAChB,IAAI,KAAK;QAAE,OAAO;IAClB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE;QACjE,UAAU,EAAE,OAAO;KACpB,CAAC,CAAC;IACH,KAAK,GAAG,UAAU,CAAC;IACnB,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAqB,CAAC;IACpE,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IAC7D,4EAA4E;IAC5E,kFAAkF;IAClF,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;QAC3B,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;KAC/D,CAAC,CAAC;IACH,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,GAAG;IACjB,SAAS,EAAE,CAAC;IACZ,OAAO,IAAc,CAAC;AACxB,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,SAAS;IACvB,SAAS,EAAE,CAAC;IACZ,OAAO,EAAE,GAAI,OAAiB,EAAE,CAAC;AACnC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,KAAK,CACnB,GAAW,EAAE,GAAW,EAAE,IAAyB;IAEnD,SAAS,EAAE,CAAC;IACZ,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAA4B;QACvC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE;QACtB,GAAG;QACH,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;KACzB,CAAC;IACF,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,YAAY,GAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACzC,GAAG;QACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7C,4EAA4E;IAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE;QAC3D,GAAG,EAAE,KAAyB;QAC9B,WAAW,EAAE,YAAY;KAC1B,CAAC,CAAC;IACH,OAAO,YAAY,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,aAAa;IAC3B,KAAK,GAAG,IAAI,CAAC;IACb,OAAO,GAAG,IAAI,CAAC;IACf,IAAI,GAAG,IAAI,CAAC;AACd,CAAC"}

package/dist/proxy.d.ts

@@ -0,0 +1,9 @@
+import type { ProxyOptions } from "./types.js";
+/**
+ * Reduce a canonical scope to the tool name it governs — the segment after the
+ * last colon. e.g. "mcp:tool:github:read_repo" → "read_repo",
+ * "mcp:tool:read_repo" → "read_repo". The granted surface is matched against the
+ * MCP tool name, which we assume equals that last segment.
+ */
+export declare function scopeToToolName(scope: string): string;
+export declare function startProxy(opts: ProxyOptions): void;

package/dist/proxy.js

@@ -0,0 +1,337 @@
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { PolicyEngine } from "./policy.js";
+import { Auditor, nowIso } from "./audit.js";
+import { AuthorityClient } from "./authority.js";
+import { IntegrityTracker } from "./integrity.js";
+import { injectIntentMeta, extractIntent } from "./meta.js";
+import { createEgressServer, setInFlightIntent } from "./egress.js";
+/**
+ * Reduce a canonical scope to the tool name it governs — the segment after the
+ * last colon. e.g. "mcp:tool:github:read_repo" → "read_repo",
+ * "mcp:tool:read_repo" → "read_repo". The granted surface is matched against the
+ * MCP tool name, which we assume equals that last segment.
+ */
+export function scopeToToolName(scope) {
+    const i = scope.lastIndexOf(":");
+    return i >= 0 ? scope.slice(i + 1) : scope;
+}
+/** The `params._meta` object of a JSON-RPC line, if any (for the egress bridge). */
+function readIncomingMeta(line) {
+    try {
+        const msg = JSON.parse(line);
+        const m = msg?.params?._meta;
+        return m && typeof m === "object" ? m : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Read newline-delimited messages from a stream (MCP stdio framing). */
+function onLines(stream, handler) {
+    let buf = "";
+    stream.on("data", (chunk) => {
+        buf += chunk.toString("utf8");
+        let idx;
+        while ((idx = buf.indexOf("\n")) >= 0) {
+            const line = buf.slice(0, idx);
+            buf = buf.slice(idx + 1);
+            if (line.trim().length > 0)
+                handler(line);
+        }
+    });
+    stream.on("end", () => {
+        if (buf.trim().length > 0)
+            handler(buf);
+    });
+}
+/**
+ * Build an MCP tools/call result that reports the block to the agent.
+*/
+function denyResult(id, reason, ruleId) {
+    return (JSON.stringify({
+        jsonrpc: "2.0",
+        id: id ?? null,
+        result: {
+            content: [
+                {
+                    type: "text",
+                    text: `⛔ auth51 denied this action and did NOT forward it to the tool.\n` +
+                        `Reason: ${reason}\n` +
+                        `Policy rule: ${ruleId}\n\n` +
+                        `This is a destructive or out-of-scope operation that requires explicit human approval. ` +
+                        `Ask the user to confirm, or take a safer, reversible action instead.`,
+                },
+            ],
+            isError: true,
+        },
+    }) + "\n");
+}
+export function startProxy(opts) {
+    const policy = PolicyEngine.load(opts.policyPath);
+    const auditor = new Auditor(opts.auditPath);
+    const authority = opts.authority ? new AuthorityClient(opts.authority) : null;
+    // Server→RS egress governance (Hop-B). When configured (and an authority
+    // exists), start the reverse-proxy the MCP server's governed RS calls route
+    // through; each is exchanged for an RS-scoped token (DESIGN-proxy-egress-hop-b).
+    let egress = null;
+    if (authority && opts.egress) {
+        egress = createEgressServer(authority, {
+            rsId: opts.egress.rsId,
+            audience: opts.egress.audience,
+            targetBaseUrl: opts.egress.targetBaseUrl,
+            popEnabled: opts.egress.popEnabled,
+        }, (rec) => auditor.record({ ts: nowIso(), kind: "egress", ...rec }));
+        egress.server.listen(opts.egress.port ?? 0, "127.0.0.1", () => {
+            process.stderr.write(`[auth51] egress governing ${opts.egress.rsId} → ${opts.egress.targetBaseUrl} ` +
+                `on http://127.0.0.1:${egress.port()} (point the server's RS base URL here)\n`);
+        });
+        process.on("exit", () => void egress?.close());
+    }
+    // Slice 2d — the capability grant. Seed from the static CLI allowlist (Slice
+    // 1d), then refine from the authority's per-agent grant when available. A
+    // static allowlist enforces; the authority grant honours its own observe/
+    // enforce mode (observe-then-enforce rollout). Fetch is async + fail-open: a
+    // tools/list that races the fetch shows the full surface once (the authority's
+    // mint-time enforcement still blocks out-of-grant calls regardless).
+    const grantState = {
+        tools: opts.grant && opts.grant.length > 0 ? new Set(opts.grant) : null,
+        mode: "enforce",
+        source: "static",
+    };
+    if (authority && opts.authority?.appId && opts.authority?.agentId) {
+        void authority.fetchGrant().then((g) => {
+            if (!g)
+                return;
+            grantState.tools = new Set([...g.allowedScopes, ...g.stepUpScopes].map(scopeToToolName));
+            grantState.mode = g.mode;
+            grantState.source = `authority:v${g.version}`;
+            process.stderr.write(`[auth51] grant loaded (${grantState.source}, mode=${g.mode}): ` +
+                `${grantState.tools.size} tool(s) granted\n`);
+        });
+    }
+    // Integrity baseline lives alongside the audit log.
+    const integrityPath = opts.auditPath.replace(/[^/\\]*$/, "integrity-baseline.json");
+    const integrity = new IntegrityTracker(integrityPath);
+    // tools/list request ids awaiting a response we should inspect/filter.
+    const pendingToolsList = new Set();
+    process.stderr.write(`[auth51] guarding MCP server "${opts.serverLabel}" → ${opts.command} ${opts.commandArgs.join(" ")}\n` +
+        `[auth51] policy: ${opts.policyPath ?? "(built-in default)"} | audit: ${opts.auditPath}` +
+        (authority ? ` | authority: ${opts.authority.baseUrl}` : " | authority: (local only)") +
+        `\n`);
+    // Workflow seams (Slice 1e): one session per connection; a tamper-evident
+    // hash chain of intent-token jtis; a monotonic call index. Calls are assumed
+    // sequential (the agent waits for each tool result) — fine for v0; concurrent
+    // in-flight calls would need per-seq chaining instead of a single prevJti.
+    const sessionId = randomUUID();
+    let prevJti;
+    let seq = 0;
+    // L1 integrity: record/compare the launched-artifact fingerprint at startup.
+    const artifactDrift = integrity.checkArtifact(opts.serverLabel, opts.command, opts.commandArgs);
+    if (artifactDrift) {
+        process.stderr.write(`[auth51] INTEGRITY DRIFT: server artifact for "${opts.serverLabel}" changed since last run\n`);
+        auditor.record({
+            ts: nowIso(),
+            tool: "(integrity)",
+            args: { server: opts.serverLabel },
+            decision: "EVENT",
+            event: "INTEGRITY_DRIFT",
+            drift: [artifactDrift],
+            ruleId: "integrity-artifact",
+            reason: "launched-artifact fingerprint changed since last run",
+            sessionId,
+        });
+    }
+    const child = spawn(opts.command, opts.commandArgs, {
+        stdio: ["pipe", "pipe", "inherit"],
+    });
+    child.on("error", (err) => {
+        process.stderr.write(`[auth51] failed to start upstream MCP server: ${err.message}\n`);
+        process.exit(127);
+    });
+    child.on("exit", (code, signal) => {
+        process.exit(code ?? (signal ? 1 : 0));
+    });
+    // agent → proxy → (policy) → upstream
+    onLines(process.stdin, (line) => {
+        let msg = null;
+        try {
+            msg = JSON.parse(line);
+        }
+        catch {
+            // Not JSON we understand — stay transparent, forward as-is.
+            child.stdin.write(line + "\n");
+            return;
+        }
+        // Track tools/list requests so we can inspect (integrity) + filter (grant)
+        // the matching response coming back from the server.
+        if (msg.method === "tools/list" && msg.id != null) {
+            pendingToolsList.add(msg.id);
+        }
+        if (msg.method !== "tools/call" || !msg.params) {
+            child.stdin.write(line + "\n");
+            return;
+        }
+        const tool = String(msg.params.name ?? "");
+        const args = msg.params.arguments ?? {};
+        let argsText = "";
+        try {
+            argsText = JSON.stringify(args);
+        }
+        catch {
+            argsText = String(args);
+        }
+        const call = { tool, args, argsText };
+        const callSeq = ++seq;
+        // At Slice 1, declared-intent == observed-call (no separate intent source yet);
+        // the seam exists so the divergence signal can be computed once app-attested
+        // or richer intent arrives (§4.2).
+        const declaredIntent = { tool, args, provenance: "llm-declared" };
+        const observedCall = { tool, args };
+        let decision = policy.evaluate(call);
+        // Grant check (Slice 2d): a tool outside the capability grant is denied,
+        // independent of the declarative policy. In observe mode we log the would-be
+        // denial but let the call through (observe-then-enforce, DESIGN §2.3).
+        if (grantState.tools && !grantState.tools.has(tool)) {
+            if (grantState.mode === "enforce") {
+                decision = {
+                    allow: false,
+                    ruleId: "grant",
+                    reason: `tool "${tool}" is not in this agent's capability grant (${grantState.source})`,
+                };
+            }
+            else {
+                process.stderr.write(`[auth51] grant[observe] ${tool} is out-of-grant (${grantState.source}) — would deny in enforce\n`);
+            }
+        }
+        if (!decision.allow) {
+            auditor.record({
+                ts: nowIso(),
+                tool,
+                args,
+                decision: "DENY",
+                ruleId: decision.ruleId,
+                reason: decision.reason,
+                agent: opts.agent,
+                sessionId,
+                seq: callSeq,
+                prevJti,
+                declaredIntent,
+                observedCall,
+            });
+            process.stderr.write(`[auth51] DENY ${tool} — ${decision.reason} (rule: ${decision.ruleId})\n`);
+            process.stdout.write(denyResult(msg.id, decision.reason, decision.ruleId));
+            return;
+        }
+        // ALLOW. When an authority is configured, mint the intent token and ride it
+        // INSIDE the JSON-RPC call under _meta ("io.auth51/intent") BEFORE
+        // forwarding — binding it to this exact tool + args and carrying it to the
+        // server (Hop A). Without an authority we forward unchanged (local policy is
+        // still enforced); a mint failure is fail-open (forward unchanged). The mint
+        // round-trip runs off the reader via this async task, and per-call ordering
+        // (mint → inject → forward) is preserved.
+        void (async () => {
+            const chainedFrom = prevJti; // the token this step links to
+            const chain = { session_id: sessionId, prev_jti: chainedFrom, seq: callSeq };
+            let intentJti;
+            let outLine = line;
+            // Case E: a token an upstream embed already put in _meta.
+            let inFlightToken = extractIntent(readIncomingMeta(line));
+            if (authority) {
+                const minted = await authority.mintIntent({
+                    scope: `mcp:tool:${tool}`,
+                    workflowId: sessionId,
+                    workflowStep: { action: tool, declared_intent: declaredIntent, seq: callSeq },
+                    delegationContext: chain,
+                });
+                if (minted) {
+                    intentJti = minted.jti;
+                    prevJti = minted.jti; // extend the chain
+                    // Hop A: the token now rides in the call's _meta to the server.
+                    outLine = injectIntentMeta(line, minted.token, chain);
+                    inFlightToken = minted.token; // what we actually forwarded in _meta
+                }
+            }
+            // Ingress→egress bridge (single-flight): record THIS tool call's intent
+            // token so the egress reverse-proxy can exchange it at the server→RS
+            // boundary (Hop B). Null ⇒ the egress mints its own (Case T). One in-flight
+            // call at a time for a stdio server, so a single slot is correct.
+            setInFlightIntent(inFlightToken);
+            child.stdin.write(outLine + "\n");
+            auditor.record({
+                ts: nowIso(),
+                tool,
+                args,
+                decision: "ALLOW",
+                ruleId: decision.ruleId,
+                reason: decision.reason,
+                agent: opts.agent,
+                intentJti,
+                sessionId,
+                seq: callSeq,
+                prevJti: chainedFrom,
+                declaredIntent,
+                observedCall,
+            });
+        })();
+    });
+    // upstream → proxy → agent. Pure passthrough EXCEPT tools/list responses,
+    // which we inspect (L0 integrity) and filter (capability grant).
+    onLines(child.stdout, (line) => {
+        let out = line;
+        try {
+            const msg = JSON.parse(line);
+            const id = msg.id;
+            if (id != null &&
+                pendingToolsList.has(id) &&
+                msg.result &&
+                Array.isArray(msg.result.tools)) {
+                pendingToolsList.delete(id);
+                const tools = msg.result.tools;
+                // 1c — L0 integrity: fingerprint + drift detection.
+                const drift = integrity.checkTools(opts.serverLabel, tools);
+                if (drift.length > 0) {
+                    for (const d of drift) {
+                        process.stderr.write(`[auth51] INTEGRITY DRIFT ${opts.serverLabel}/${d.tool}: ${d.kind}\n`);
+                    }
+                    auditor.record({
+                        ts: nowIso(),
+                        tool: "(integrity)",
+                        args: { server: opts.serverLabel },
+                        decision: "EVENT",
+                        event: "INTEGRITY_DRIFT",
+                        drift,
+                        ruleId: "integrity-tools",
+                        reason: `${drift.length} tool fingerprint change(s) on tools/list`,
+                        sessionId,
+                    });
+                }
+                // 2d — capability grant: filter the surface the agent's model can see.
+                // Enforce mode strips ungranted tools; observe mode logs what it *would*
+                // strip but leaves the surface intact (observe-then-enforce, §2.3).
+                if (grantState.tools) {
+                    const granted = grantState.tools;
+                    const kept = tools.filter((t) => granted.has(t.name));
+                    if (kept.length !== tools.length) {
+                        if (grantState.mode === "enforce") {
+                            msg.result.tools = kept;
+                            out = JSON.stringify(msg);
+                            process.stderr.write(`[auth51] grant filter (${grantState.source}): exposing ${kept.length}/${tools.length} tools to the agent\n`);
+                        }
+                        else {
+                            process.stderr.write(`[auth51] grant[observe] (${grantState.source}): would expose ${kept.length}/${tools.length} tools (not filtering)\n`);
+                        }
+                    }
+                }
+            }
+        }
+        catch {
+            /* not JSON / not a tools/list response → passthrough unchanged */
+        }
+        process.stdout.write(out + "\n");
+    });
+    process.stdin.on("end", () => {
+        child.stdin.end();
+    });
+}
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAuB,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAqB,MAAM,aAAa,CAAC;AAsBvF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7C,CAAC;AAED,oFAAoF;AACpF,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqC,CAAC;QACjE,MAAM,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC;QAC7B,OAAO,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,OAAO,CAAC,MAAgB,EAAE,OAA+B;IAChE,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QAClC,GAAG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,GAAW,CAAC;QAChB,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/B,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QACpB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;EAEE;AACF,SAAS,UAAU,CAAC,EAAiB,EAAE,MAAc,EAAE,MAAc;IACnE,OAAO,CACL,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,EAAE,IAAI,IAAI;QACd,MAAM,EAAE;YACN,OAAO,EAAE;gBACP;oBACE,IAAI,EAAE,MAAM;oBACZ,IAAI,EACF,mEAAmE;wBACnE,WAAW,MAAM,IAAI;wBACrB,gBAAgB,MAAM,MAAM;wBAC5B,yFAAyF;wBACzF,sEAAsE;iBACzE;aACF;YACD,OAAO,EAAE,IAAI;SACd;KACF,CAAC,GAAG,IAAI,CACV,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAkB;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9E,yEAAyE;IACzE,4EAA4E;IAC5E,iFAAiF;IACjF,IAAI,MAAM,GAAwB,IAAI,CAAC;IACvC,IAAI,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,GAAG,kBAAkB,CACzB,SAAS,EACT;YACE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACxC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;SACnC,EACD,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,GAAG,EAAW,CAAC,CAC3E,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,6BAA6B,IAAI,CAAC,MAAO,CAAC,IAAI,MAAM,IAAI,CAAC,MAAO,CAAC,aAAa,GAAG;gBACjF,uBAAuB,MAAO,CAAC,IAAI,EAAE,0CAA0C,CAChF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,0EAA0E;IAC1E,6EAA6E;IAC7E,+EAA+E;IAC/E,qEAAqE;IACrE,MAAM,UAAU,GAAe;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;QACvE,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,QAAQ;KACjB,CAAC;IACF,IAAI,SAAS,IAAI,IAAI,CAAC,SAAS,EAAE,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;QAClE,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACrC,IAAI,CAAC,CAAC;gBAAE,OAAO;YACf,UAAU,CAAC,KAAK,GAAG,IAAI,GAAG,CACxB,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAC7D,CAAC;YACF,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;YACzB,UAAU,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC,OAAO,EAAE,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,UAAU,CAAC,MAAM,UAAU,CAAC,CAAC,IAAI,KAAK;gBAChE,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,oBAAoB,CAC7C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oDAAoD;IACpD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,IAAI,gBAAgB,CAAC,aAAa,CAAC,CAAC;IACtD,uEAAuE;IACvE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,iCAAiC,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;QACtG,oBAAoB,IAAI,CAAC,UAAU,IAAI,oBAAoB,aAAa,IAAI,CAAC,SAAS,EAAE;QACxF,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,SAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAAC;QACvF,IAAI,CACL,CAAC;IAEF,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;IAC/B,IAAI,OAA2B,CAAC;IAChC,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,6EAA6E;IAC7E,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAChG,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kDAAkD,IAAI,CAAC,WAAW,4BAA4B,CAC/F,CAAC;QACF,OAAO,CAAC,MAAM,CAAC;YACb,EAAE,EAAE,MAAM,EAAE;YACZ,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE;YAClC,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,iBAAiB;YACxB,KAAK,EAAE,CAAC,aAAa,CAAC;YACtB,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,sDAAsD;YAC9D,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE;QAClD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;KACnC,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iDAAiD,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,sCAAsC;IACtC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;QAC9B,IAAI,GAAG,GAAmB,IAAI,CAAC;QAC/B,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;YAC5D,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,qDAAqD;QACrD,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,CAAC;YAClD,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAC/C,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;QACxC,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,GAAa,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAChD,MAAM,OAAO,GAAG,EAAE,GAAG,CAAC;QACtB,gFAAgF;QAChF,6EAA6E;QAC7E,mCAAmC;QACnC,MAAM,cAAc,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,cAAuB,EAAE,CAAC;QAC3E,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAEpC,IAAI,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACrC,yEAAyE;QACzE,6EAA6E;QAC7E,uEAAuE;QACvE,IAAI,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAClC,QAAQ,GAAG;oBACT,KAAK,EAAE,KAAK;oBACZ,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,SAAS,IAAI,8CAA8C,UAAU,CAAC,MAAM,GAAG;iBACxF,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,2BAA2B,IAAI,qBAAqB,UAAU,CAAC,MAAM,6BAA6B,CACnG,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO,CAAC,MAAM,CAAC;gBACb,EAAE,EAAE,MAAM,EAAE;gBACZ,IAAI;gBACJ,IAAI;gBACJ,QAAQ,EAAE,MAAM;gBAChB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS;gBACT,GAAG,EAAE,OAAO;gBACZ,OAAO;gBACP,cAAc;gBACd,YAAY;aACb,CAAC,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,IAAI,MAAM,QAAQ,CAAC,MAAM,WAAW,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC;YAChG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QAED,4EAA4E;QAC5E,mEAAmE;QACnE,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,4EAA4E;QAC5E,0CAA0C;QAC1C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,+BAA+B;YAC5D,MAAM,KAAK,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC7E,IAAI,SAA6B,CAAC;YAClC,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,0DAA0D;YAC1D,IAAI,aAAa,GAAkB,aAAa,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;YACzE,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC;oBACxC,KAAK,EAAE,YAAY,IAAI,EAAE;oBACzB,UAAU,EAAE,SAAS;oBACrB,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE;oBAC7E,iBAAiB,EAAE,KAAK;iBACzB,CAAC,CAAC;gBACH,IAAI,MAAM,EAAE,CAAC;oBACX,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC;oBACvB,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,mBAAmB;oBACzC,gEAAgE;oBAChE,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;oBACtD,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,sCAAsC;gBACtE,CAAC;YACH,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,4EAA4E;YAC5E,kEAAkE;YAClE,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACjC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC;gBACb,EAAE,EAAE,MAAM,EAAE;gBACZ,IAAI;gBACJ,IAAI;gBACJ,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,SAAS;gBACT,SAAS;gBACT,GAAG,EAAE,OAAO;gBACZ,OAAO,EAAE,WAAW;gBACpB,cAAc;gBACd,YAAY;aACb,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,iEAAiE;IACjE,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC7B,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;YACxC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;YAClB,IACE,EAAE,IAAI,IAAI;gBACV,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,GAAG,CAAC,MAAM;gBACV,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAC/B,CAAC;gBACD,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAyB,CAAC;gBAEnD,oDAAoD;gBACpD,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;gBAC5D,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;wBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4BAA4B,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CACtE,CAAC;oBACJ,CAAC;oBACD,OAAO,CAAC,MAAM,CAAC;wBACb,EAAE,EAAE,MAAM,EAAE;wBACZ,IAAI,EAAE,aAAa;wBACnB,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE;wBAClC,QAAQ,EAAE,OAAO;wBACjB,KAAK,EAAE,iBAAiB;wBACxB,KAAK;wBACL,MAAM,EAAE,iBAAiB;wBACzB,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,2CAA2C;wBAClE,SAAS;qBACV,CAAC,CAAC;gBACL,CAAC;gBAED,uEAAuE;gBACvE,yEAAyE;gBACzE,oEAAoE;gBACpE,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;oBACrB,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC;oBACjC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;oBACtD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;wBACjC,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;4BAClC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;4BACxB,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;4BAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,UAAU,CAAC,MAAM,eAAe,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,uBAAuB,CAC7G,CAAC;wBACJ,CAAC;6BAAM,CAAC;4BACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,4BAA4B,UAAU,CAAC,MAAM,mBAAmB,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,0BAA0B,CACtH,CAAC;wBACJ,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;QACpE,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;QAC3B,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC"}