@calltelemetry/ct-lab-mcp 0.1.0

package/dist/src/credentials/resolver.js

@@ -0,0 +1,427 @@
+/**
+ * 3-Tier Credential Resolution Hierarchy for Proxmox VE, VMware ESXi, and Appliance SSH
+ *
+ * Tier 1: Direct Environment Variables
+ * Tier 2: Doppler REST API v3
+ * Tier 3: In-Memory Mock Fallback
+ */
+import { DopplerClient } from "./doppler.js";
+import { registerSecret } from "../utils/redactor.js";
+import { logger } from "../utils/logger.js";
+export class CredentialResolver {
+    defaultLabProtectedVmids = [100, 101, 102, 104];
+    defaultMiniProtectedVmids = [];
+    defaultEsxiProtectedVms = [
+        "cucm-15",
+        "cucm-pub",
+        "cucm-sub",
+        "cube-cat8000v",
+        "runner-doks",
+        "k8s-master",
+        "esxi-template-base"
+    ];
+    /**
+     * Resolve all lab credentials through the 3-tier cascade.
+     */
+    async resolve(options = {}) {
+        const env = options.env || process.env;
+        const forceMock = options.forceMock ||
+            env.CT_LAB_MOCK_MODE === "true" ||
+            env.PROXMOX_MOCK_MODE === "true" ||
+            env.NODE_ENV === "test-mock";
+        if (forceMock) {
+            logger.info("Mock mode forced via configuration. Utilizing Tier 3 (Mock Fallback).");
+            return this.createMockResult();
+        }
+        // --- Tier 1: Direct Environment Variables ---
+        const directLab = this.extractProxmoxHostConfig("proxmox-lab", "LAB_PROXMOX_", env, 2, this.defaultLabProtectedVmids);
+        const directMini = this.extractProxmoxHostConfig("proxmox-mini", "LAB_PROXMOX_MINIS_", env, 4, this.defaultMiniProtectedVmids) ||
+            this.extractProxmoxHostConfig("proxmox-mini", "LAB_PROXMOX_MINI_", env, 4, this.defaultMiniProtectedVmids);
+        const directEsxi = this.extractEsxiHostConfig(env);
+        const directVmCreds = this.extractVmCredentials(env);
+        // If all essential direct credentials exist, return Tier 1
+        if (directLab && directMini && directEsxi) {
+            logger.info("Resolved full credentials for Proxmox and ESXi hosts from Direct Environment Variables (Tier 1).");
+            const proxmoxHosts = [directLab, directMini];
+            const esxiHosts = [directEsxi];
+            const vmCredentials = directVmCreds || this.createMockVmCredentials();
+            this.registerAllSecrets(proxmoxHosts, esxiHosts, vmCredentials);
+            return {
+                tier: "direct_env",
+                hosts: proxmoxHosts,
+                proxmoxHosts,
+                esxiHosts,
+                vmCredentials
+            };
+        }
+        // --- Tier 2: Doppler REST API v3 ---
+        const dopplerToken = options.dopplerToken || env.DOPPLER_TOKEN;
+        if (dopplerToken) {
+            try {
+                registerSecret(dopplerToken);
+                logger.info("Attempting Tier 2 credential resolution via Doppler API v3...");
+                const dopplerClient = new DopplerClient({
+                    token: dopplerToken,
+                    project: options.dopplerProject || env.DOPPLER_PROJECT,
+                    config: options.dopplerConfig || env.DOPPLER_CONFIG
+                });
+                const dopplerSecrets = await dopplerClient.downloadSecrets();
+                // Merge: Direct environment variables take precedence over Doppler
+                const mergedSecrets = { ...dopplerSecrets, ...env };
+                const dopplerLab = directLab ||
+                    this.extractProxmoxHostConfig("proxmox-lab", "LAB_PROXMOX_", mergedSecrets, 2, this.defaultLabProtectedVmids);
+                const dopplerMini = directMini ||
+                    this.extractProxmoxHostConfig("proxmox-mini", "LAB_PROXMOX_MINIS_", mergedSecrets, 4, this.defaultMiniProtectedVmids) ||
+                    this.extractProxmoxHostConfig("proxmox-mini", "LAB_PROXMOX_MINI_", mergedSecrets, 4, this.defaultMiniProtectedVmids);
+                const dopplerEsxi = directEsxi || this.extractEsxiHostConfig(mergedSecrets);
+                const dopplerVmCreds = directVmCreds || this.extractVmCredentials(mergedSecrets);
+                if (dopplerLab || dopplerMini || dopplerEsxi) {
+                    const proxmoxHosts = [];
+                    proxmoxHosts.push(dopplerLab || this.createMockProxmoxHost("proxmox-lab", 2, this.defaultLabProtectedVmids));
+                    proxmoxHosts.push(dopplerMini || this.createMockProxmoxHost("proxmox-mini", 4, this.defaultMiniProtectedVmids));
+                    const esxiHosts = [];
+                    esxiHosts.push(dopplerEsxi || this.createMockEsxiHost());
+                    const vmCredentials = dopplerVmCreds || this.createMockVmCredentials();
+                    this.registerAllSecrets(proxmoxHosts, esxiHosts, vmCredentials);
+                    logger.info(`Resolved credentials via Doppler API (Tier 2). Secrets count: ${Object.keys(dopplerSecrets).length}`);
+                    return {
+                        tier: "doppler_api",
+                        hosts: proxmoxHosts,
+                        proxmoxHosts,
+                        esxiHosts,
+                        vmCredentials,
+                        dopplerSecretsCount: Object.keys(dopplerSecrets).length
+                    };
+                }
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                logger.warn(`Doppler API resolution failed: ${msg}. Falling back to partial / Tier 3.`);
+            }
+        }
+        // --- Partial Direct Env Fallback ---
+        if (directLab || directMini || directEsxi) {
+            logger.info("Engaging partial direct environment resolution with mock fallback for missing targets.");
+            const proxmoxHosts = [];
+            proxmoxHosts.push(directLab || this.createMockProxmoxHost("proxmox-lab", 2, this.defaultLabProtectedVmids));
+            proxmoxHosts.push(directMini || this.createMockProxmoxHost("proxmox-mini", 4, this.defaultMiniProtectedVmids));
+            const esxiHosts = [];
+            esxiHosts.push(directEsxi || this.createMockEsxiHost());
+            const vmCredentials = directVmCreds || this.createMockVmCredentials();
+            this.registerAllSecrets(proxmoxHosts, esxiHosts, vmCredentials);
+            return {
+                tier: "direct_env",
+                hosts: proxmoxHosts,
+                proxmoxHosts,
+                esxiHosts,
+                vmCredentials
+            };
+        }
+        // --- Tier 3: Mock Fallback Mode ---
+        logger.info("No hypervisor credentials found. Engaging Tier 3 (In-Memory Mock Fallback).");
+        return this.createMockResult();
+    }
+    /**
+     * Extract Proxmox host configuration from key-value record.
+     */
+    extractProxmoxHostConfig(id, prefix, record, maxSlots, protectedVmids) {
+        const rawUrl = record[`${prefix}URL`] || record[`${prefix}BASE_URL`];
+        const rawHost = record[`${prefix}HOST`] || record[`${prefix}IP`];
+        let baseUrl = "";
+        if (rawUrl) {
+            baseUrl = rawUrl.trim().replace(/\/+$/, "");
+            if (!baseUrl.endsWith("/api2/json")) {
+                baseUrl = `${baseUrl}/api2/json`;
+            }
+        }
+        else if (rawHost) {
+            const host = rawHost.trim();
+            const port = record[`${prefix}PORT`] || "8006";
+            const protocol = record[`${prefix}PROTOCOL`] || "https";
+            baseUrl = `${protocol}://${host}:${port}/api2/json`;
+        }
+        if (!baseUrl) {
+            return null;
+        }
+        // Check Token Auth
+        const tokenId = record[`${prefix}TOKEN_ID`] || record[`${prefix}API_TOKEN_ID`];
+        const tokenSecret = record[`${prefix}TOKEN_SECRET`] || record[`${prefix}API_TOKEN_SECRET`];
+        let auth = null;
+        if (tokenId && tokenSecret) {
+            auth = {
+                type: "token",
+                tokenId: tokenId.trim(),
+                tokenSecret: tokenSecret.trim()
+            };
+        }
+        else {
+            // Check Ticket Auth
+            const username = record[`${prefix}USERNAME`] || record[`${prefix}USER`];
+            const password = record[`${prefix}PASSWORD`] || record[`${prefix}PASS`];
+            const realm = record[`${prefix}REALM`] || "pam";
+            if (username && password) {
+                auth = {
+                    type: "ticket",
+                    username: username.trim(),
+                    password: password.trim(),
+                    realm: realm.trim()
+                };
+            }
+        }
+        if (!auth) {
+            return null;
+        }
+        const nodeName = record[`${prefix}NODE`] ||
+            record[`${prefix}NODE_NAME`] ||
+            (id === "proxmox-mini" ? "proxmox-mini" : "proxmox");
+        const allowInsecureTls = record[`${prefix}INSECURE`] !== "false" && record[`${prefix}ALLOW_INSECURE_TLS`] !== "false";
+        const sslFingerprint = record[`${prefix}FINGERPRINT`] || record[`${prefix}SSL_FINGERPRINT`];
+        const hostName = id === "proxmox-lab" ? "Proxmox Primary Lab" : "Proxmox Minis Lab";
+        // Optional user-specified protected VMIDs
+        const customProtected = record[`${prefix}PROTECTED_VMIDS`];
+        let effectiveProtected = protectedVmids;
+        if (customProtected) {
+            try {
+                const parsed = JSON.parse(customProtected);
+                if (Array.isArray(parsed)) {
+                    effectiveProtected = Array.from(new Set([...protectedVmids, ...parsed.map(Number)]));
+                }
+            }
+            catch {
+                const parsed = customProtected.split(",").map((s) => parseInt(s.trim(), 10)).filter((n) => !isNaN(n));
+                effectiveProtected = Array.from(new Set([...protectedVmids, ...parsed]));
+            }
+        }
+        return {
+            id,
+            name: hostName,
+            baseUrl,
+            nodeName,
+            auth,
+            maxSlots,
+            slotSizeMb: 8192,
+            allowInsecureTls,
+            sslFingerprint: sslFingerprint ? sslFingerprint.trim() : undefined,
+            protectedVmids: effectiveProtected,
+            isMock: false
+        };
+    }
+    /**
+     * Extract ESXi host configuration supporting GOVC_* and LAB_ESXI_* conventions.
+     */
+    extractEsxiHostConfig(record) {
+        // Check GOVC_URL, LAB_ESXI_URL, ESXI_URL, or host/ip
+        let rawUrl = record.GOVC_URL ||
+            record.LAB_ESXI_URL ||
+            record.ESXI_URL ||
+            record.LAB_ESXI_HOST ||
+            record.ESXI_HOST;
+        let username = record.GOVC_USERNAME ||
+            record.LAB_ESXI_USERNAME ||
+            record.ESXI_USERNAME ||
+            record.GOVC_USER ||
+            record.LAB_ESXI_USER;
+        let password = record.GOVC_PASSWORD ||
+            record.LAB_ESXI_PASSWORD ||
+            record.ESXI_PASSWORD ||
+            record.GOVC_PASS ||
+            record.LAB_ESXI_PASS;
+        // Support URL embedding credentials: https://user:pass@host/sdk
+        if (rawUrl && (!username || !password)) {
+            try {
+                const parsedUrl = new URL(rawUrl.startsWith("http") ? rawUrl : `https://${rawUrl}`);
+                if (parsedUrl.username && !username) {
+                    username = decodeURIComponent(parsedUrl.username);
+                }
+                if (parsedUrl.password && !password) {
+                    password = decodeURIComponent(parsedUrl.password);
+                }
+                if (parsedUrl.hostname) {
+                    rawUrl = `${parsedUrl.protocol}//${parsedUrl.host}`;
+                }
+            }
+            catch {
+                // Continue with rawUrl string
+            }
+        }
+        if (!rawUrl || !username || !password) {
+            return null;
+        }
+        let cleanUrl = rawUrl.trim();
+        if (!cleanUrl.startsWith("http://") && !cleanUrl.startsWith("https://")) {
+            cleanUrl = `https://${cleanUrl}`;
+        }
+        const insecureVal = record.GOVC_INSECURE ?? record.LAB_ESXI_INSECURE ?? record.ESXI_INSECURE;
+        const allowInsecureTls = insecureVal !== "false" && insecureVal !== "0";
+        const datastore = record.GOVC_DATASTORE || record.LAB_ESXI_DATASTORE || "datastore1";
+        const resourcePool = record.GOVC_RESOURCE_POOL || record.LAB_ESXI_RESOURCE_POOL;
+        const datacenter = record.GOVC_DATACENTER || record.LAB_ESXI_DATACENTER;
+        const network = record.GOVC_NETWORK || record.LAB_ESXI_NETWORK || "VM Network";
+        const customProtected = record.LAB_ESXI_PROTECTED_VMS || record.GOVC_PROTECTED_VMS;
+        let protectedVmNames = this.defaultEsxiProtectedVms;
+        if (customProtected) {
+            try {
+                const parsed = JSON.parse(customProtected);
+                if (Array.isArray(parsed)) {
+                    protectedVmNames = Array.from(new Set([...this.defaultEsxiProtectedVms, ...parsed.map(String)]));
+                }
+            }
+            catch {
+                const parsed = customProtected.split(",").map((s) => s.trim()).filter(Boolean);
+                protectedVmNames = Array.from(new Set([...this.defaultEsxiProtectedVms, ...parsed]));
+            }
+        }
+        return {
+            id: "esxi-intel-192-168-123-176",
+            name: "VMware ESXi Lab Host (192.168.123.176)",
+            url: cleanUrl,
+            username: username.trim(),
+            password: password.trim(),
+            allowInsecureTls,
+            datastore,
+            resourcePool,
+            datacenter,
+            network,
+            protectedVmNames,
+            isMock: false
+        };
+    }
+    /**
+     * Extract Appliance / VM credentials (LAB_VM_CREDENTIALS_* or LAB_VM_CREDENTIALS JSON/slug).
+     */
+    extractVmCredentials(record) {
+        // 1. Check LAB_VM_CREDENTIALS JSON string or slug
+        const rawVmCreds = record.LAB_VM_CREDENTIALS || record.VM_CREDENTIALS;
+        if (rawVmCreds) {
+            try {
+                const parsed = JSON.parse(rawVmCreds);
+                if (typeof parsed === "object" && parsed !== null) {
+                    return {
+                        username: parsed.username || parsed.user || "admin",
+                        password: parsed.password || parsed.pass,
+                        privateKey: parsed.privateKey || parsed.private_key || parsed.sshKey,
+                        passphrase: parsed.passphrase,
+                        port: parsed.port ? Number(parsed.port) : 2222
+                    };
+                }
+            }
+            catch {
+                // Check slug format user:pass or user:pass@port
+                const match = rawVmCreds.match(/^([^:]+):([^@]+)(?:@(\d+))?$/);
+                if (match) {
+                    return {
+                        username: match[1],
+                        password: match[2],
+                        port: match[3] ? parseInt(match[3], 10) : 2222
+                    };
+                }
+            }
+        }
+        // 2. Check individual environment variables
+        const username = record.LAB_VM_CREDENTIALS_USERNAME ||
+            record.LAB_VM_CREDENTIALS_USER ||
+            record.LAB_VM_USER ||
+            record.VM_USER;
+        const password = record.LAB_VM_CREDENTIALS_PASSWORD ||
+            record.LAB_VM_CREDENTIALS_PASS ||
+            record.LAB_VM_PASS ||
+            record.VM_PASS;
+        const privateKey = record.LAB_VM_CREDENTIALS_PRIVATE_KEY ||
+            record.LAB_VM_CREDENTIALS_SSH_KEY ||
+            record.LAB_VM_KEY ||
+            record.VM_SSH_KEY;
+        const passphrase = record.LAB_VM_CREDENTIALS_PASSPHRASE || record.LAB_VM_PASSPHRASE;
+        const portRaw = record.LAB_VM_CREDENTIALS_PORT ||
+            record.LAB_VM_PORT ||
+            record.VM_PORT;
+        const port = portRaw ? parseInt(portRaw, 10) : 2222;
+        if (username || password || privateKey) {
+            return {
+                username: username ? username.trim() : "admin",
+                password: password ? password.trim() : undefined,
+                privateKey: privateKey ? privateKey.trim() : undefined,
+                passphrase: passphrase ? passphrase.trim() : undefined,
+                port: isNaN(port) ? 2222 : port
+            };
+        }
+        return null;
+    }
+    createMockResult() {
+        const proxmoxHosts = [
+            this.createMockProxmoxHost("proxmox-lab", 2, this.defaultLabProtectedVmids),
+            this.createMockProxmoxHost("proxmox-mini", 4, this.defaultMiniProtectedVmids)
+        ];
+        const esxiHosts = [this.createMockEsxiHost()];
+        const vmCredentials = this.createMockVmCredentials();
+        return {
+            tier: "mock_fallback",
+            hosts: proxmoxHosts,
+            proxmoxHosts,
+            esxiHosts,
+            vmCredentials
+        };
+    }
+    createMockProxmoxHost(id, maxSlots, protectedVmids) {
+        const isLab = id === "proxmox-lab";
+        return {
+            id,
+            name: isLab ? "Proxmox Primary Lab (Mock)" : "Proxmox Minis Lab (Mock)",
+            baseUrl: isLab ? "https://192.168.123.177:8006/api2/json" : "https://192.168.123.178:8006/api2/json",
+            nodeName: isLab ? "proxmox" : "proxmox-mini",
+            auth: {
+                type: "token",
+                tokenId: `root@pam!mock_${id.replace("-", "_")}`,
+                tokenSecret: "00000000-0000-0000-0000-000000000000"
+            },
+            maxSlots,
+            slotSizeMb: 8192,
+            allowInsecureTls: true,
+            protectedVmids,
+            isMock: true
+        };
+    }
+    createMockEsxiHost() {
+        return {
+            id: "esxi-intel-192-168-123-176",
+            name: "VMware ESXi Lab Host (Mock)",
+            url: "https://192.168.123.176",
+            username: "root",
+            password: "mock-esxi-password-000",
+            allowInsecureTls: true,
+            datastore: "datastore1",
+            resourcePool: "Resources",
+            datacenter: "ha-datacenter",
+            network: "VM Network",
+            protectedVmNames: this.defaultEsxiProtectedVms,
+            isMock: true
+        };
+    }
+    createMockVmCredentials() {
+        return {
+            username: "admin",
+            password: "mock-appliance-password",
+            port: 2222
+        };
+    }
+    registerAllSecrets(proxmoxHosts, esxiHosts, vmCreds) {
+        for (const host of proxmoxHosts) {
+            if (host.auth.type === "token") {
+                registerSecret(host.auth.tokenSecret);
+            }
+            else if (host.auth.type === "ticket") {
+                registerSecret(host.auth.password);
+            }
+        }
+        for (const esxi of esxiHosts) {
+            registerSecret(esxi.password);
+        }
+        if (vmCreds.password) {
+            registerSecret(vmCreds.password);
+        }
+        if (vmCreds.privateKey) {
+            registerSecret(vmCreds.privateKey);
+        }
+    }
+}
+export const credentialResolver = new CredentialResolver();
+//# sourceMappingURL=resolver.js.map

package/dist/src/credentials/resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolver.js","sourceRoot":"","sources":["../../../src/credentials/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAmB,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,OAAO,kBAAkB;IACZ,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAChD,yBAAyB,GAAa,EAAE,CAAC;IACzC,uBAAuB,GAAG;QACzC,SAAS;QACT,UAAU;QACV,UAAU;QACV,eAAe;QACf,aAAa;QACb,YAAY;QACZ,oBAAoB;KACrB,CAAC;IAEF;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,UAA6B,EAAE;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACvC,MAAM,SAAS,GACb,OAAO,CAAC,SAAS;YACjB,GAAG,CAAC,gBAAgB,KAAK,MAAM;YAC/B,GAAG,CAAC,iBAAiB,KAAK,MAAM;YAChC,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC;QAE/B,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;YACrF,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACjC,CAAC;QAED,+CAA+C;QAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,wBAAwB,CAAC,aAAa,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACtH,MAAM,UAAU,GACd,IAAI,CAAC,wBAAwB,CAAC,cAAc,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC;YAC3G,IAAI,CAAC,wBAAwB,CAAC,cAAc,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;QAE7G,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QAErD,2DAA2D;QAC3D,IAAI,SAAS,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;YAChH,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,aAAa,GAAG,aAAa,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACtE,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YAEhE,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,YAAY;gBACnB,YAAY;gBACZ,SAAS;gBACT,aAAa;aACd,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,GAAG,CAAC,aAAa,CAAC;QAC/D,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC;gBACH,cAAc,CAAC,YAAY,CAAC,CAAC;gBAC7B,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;gBAC7E,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC;oBACtC,KAAK,EAAE,YAAY;oBACnB,OAAO,EAAE,OAAO,CAAC,cAAc,IAAI,GAAG,CAAC,eAAe;oBACtD,MAAM,EAAE,OAAO,CAAC,aAAa,IAAI,GAAG,CAAC,cAAc;iBACpD,CAAC,CAAC;gBAEH,MAAM,cAAc,GAAG,MAAM,aAAa,CAAC,eAAe,EAAE,CAAC;gBAC7D,mEAAmE;gBACnE,MAAM,aAAa,GAAuC,EAAE,GAAG,cAAc,EAAE,GAAG,GAAG,EAAE,CAAC;gBAExF,MAAM,UAAU,GACd,SAAS;oBACT,IAAI,CAAC,wBAAwB,CAAC,aAAa,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC;gBAEhH,MAAM,WAAW,GACf,UAAU;oBACV,IAAI,CAAC,wBAAwB,CAAC,cAAc,EAAE,oBAAoB,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC;oBACrH,IAAI,CAAC,wBAAwB,CAAC,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC;gBAEvH,MAAM,WAAW,GAAG,UAAU,IAAI,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAC;gBAC5E,MAAM,cAAc,GAAG,aAAa,IAAI,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC;gBAEjF,IAAI,UAAU,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;oBAC7C,MAAM,YAAY,GAAwB,EAAE,CAAC;oBAC7C,YAAY,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,CAAC,EAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;oBAC7G,YAAY,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;oBAEhH,MAAM,SAAS,GAAqB,EAAE,CAAC;oBACvC,SAAS,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;oBAEzD,MAAM,aAAa,GAAG,cAAc,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;oBACvE,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;oBAEhE,MAAM,CAAC,IAAI,CACT,iEAAiE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,EAAE,CACtG,CAAC;oBAEF,OAAO;wBACL,IAAI,EAAE,aAAa;wBACnB,KAAK,EAAE,YAAY;wBACnB,YAAY;wBACZ,SAAS;wBACT,aAAa;wBACb,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM;qBACxD,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,MAAM,CAAC,IAAI,CAAC,kCAAkC,GAAG,qCAAqC,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,SAAS,IAAI,UAAU,IAAI,UAAU,EAAE,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,wFAAwF,CAAC,CAAC;YACtG,MAAM,YAAY,GAAwB,EAAE,CAAC;YAC7C,YAAY,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,CAAC,EAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;YAC5G,YAAY,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAE/G,MAAM,SAAS,GAAqB,EAAE,CAAC;YACvC,SAAS,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;YAExD,MAAM,aAAa,GAAG,aAAa,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;YACtE,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;YAEhE,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,YAAY;gBACnB,YAAY;gBACZ,SAAS;gBACT,aAAa;aACd,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,MAAM,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC,gBAAgB,EAAE,CAAC;IACjC,CAAC;IAED;;OAEG;IACK,wBAAwB,CAC9B,EAAkC,EAClC,MAAc,EACd,MAA0C,EAC1C,QAAgB,EAChB,cAAwB;QAExB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;QAEjE,IAAI,OAAO,GAAG,EAAE,CAAC;QACjB,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACpC,OAAO,GAAG,GAAG,OAAO,YAAY,CAAC;YACnC,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,MAAM,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,OAAO,CAAC;YACxD,OAAO,GAAG,GAAG,QAAQ,MAAM,IAAI,IAAI,IAAI,YAAY,CAAC;QACtD,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAED,mBAAmB;QACnB,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,CAAC;QAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,CAAC;QAE3F,IAAI,IAAI,GAAuB,IAAI,CAAC;QAEpC,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;YAC3B,IAAI,GAAG;gBACL,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;gBACvB,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE;aAChC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,oBAAoB;YACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC;YACxE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC;YACxE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,IAAI,KAAK,CAAC;YAEhD,IAAI,QAAQ,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,GAAG;oBACL,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;oBACzB,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;oBACzB,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE;iBACpB,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GACZ,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC;YACvB,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC;YAC5B,CAAC,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvD,MAAM,gBAAgB,GACpB,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,MAAM,oBAAoB,CAAC,KAAK,OAAO,CAAC;QAC/F,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,CAAC;QAE5F,MAAM,QAAQ,GAAG,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,mBAAmB,CAAC;QAEpF,0CAA0C;QAC1C,MAAM,eAAe,GAAG,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,CAAC;QAC3D,IAAI,kBAAkB,GAAG,cAAc,CAAC;QACxC,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvF,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACtG,kBAAkB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,OAAO;YACL,EAAE;YACF,IAAI,EAAE,QAAQ;YACd,OAAO;YACP,QAAQ;YACR,IAAI;YACJ,QAAQ;YACR,UAAU,EAAE,IAAI;YAChB,gBAAgB;YAChB,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;YAClE,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,qBAAqB,CAC3B,MAA0C;QAE1C,qDAAqD;QACrD,IAAI,MAAM,GACR,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,YAAY;YACnB,MAAM,CAAC,QAAQ;YACf,MAAM,CAAC,aAAa;YACpB,MAAM,CAAC,SAAS,CAAC;QAEnB,IAAI,QAAQ,GACV,MAAM,CAAC,aAAa;YACpB,MAAM,CAAC,iBAAiB;YACxB,MAAM,CAAC,aAAa;YACpB,MAAM,CAAC,SAAS;YAChB,MAAM,CAAC,aAAa,CAAC;QAEvB,IAAI,QAAQ,GACV,MAAM,CAAC,aAAa;YACpB,MAAM,CAAC,iBAAiB;YACxB,MAAM,CAAC,aAAa;YACpB,MAAM,CAAC,SAAS;YAChB,MAAM,CAAC,aAAa,CAAC;QAEvB,gEAAgE;QAChE,IAAI,MAAM,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC;gBACpF,IAAI,SAAS,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACpC,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACpD,CAAC;gBACD,IAAI,SAAS,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACpC,QAAQ,GAAG,kBAAkB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBACpD,CAAC;gBACD,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;oBACvB,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACtD,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;YAChC,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACxE,QAAQ,GAAG,WAAW,QAAQ,EAAE,CAAC;QACnC,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,aAAa,CAAC;QAC7F,MAAM,gBAAgB,GAAG,WAAW,KAAK,OAAO,IAAI,WAAW,KAAK,GAAG,CAAC;QAExE,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,kBAAkB,IAAI,YAAY,CAAC;QACrF,MAAM,YAAY,GAAG,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,sBAAsB,CAAC;QAChF,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,mBAAmB,CAAC;QACxE,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,gBAAgB,IAAI,YAAY,CAAC;QAE/E,MAAM,eAAe,GAAG,MAAM,CAAC,sBAAsB,IAAI,MAAM,CAAC,kBAAkB,CAAC;QACnF,IAAI,gBAAgB,GAAG,IAAI,CAAC,uBAAuB,CAAC;QACpD,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC1B,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,uBAAuB,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnG,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC/E,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,uBAAuB,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;QAED,OAAO;YACL,EAAE,EAAE,4BAA4B;YAChC,IAAI,EAAE,wCAAwC;YAC9C,GAAG,EAAE,QAAQ;YACb,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;YACzB,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE;YACzB,gBAAgB;YAChB,SAAS;YACT,YAAY;YACZ,UAAU;YACV,OAAO;YACP,gBAAgB;YAChB,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,oBAAoB,CAC1B,MAA0C;QAE1C,kDAAkD;QAClD,MAAM,UAAU,GAAG,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,cAAc,CAAC;QACtE,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;oBAClD,OAAO;wBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO;wBACnD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI;wBACxC,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,MAAM;wBACpE,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;qBAC/C,CAAC;gBACJ,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gDAAgD;gBAChD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBAC/D,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO;wBACL,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;wBAClB,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;wBAClB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI;qBAC/C,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;QAED,4CAA4C;QAC5C,MAAM,QAAQ,GACZ,MAAM,CAAC,2BAA2B;YAClC,MAAM,CAAC,uBAAuB;YAC9B,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,OAAO,CAAC;QAEjB,MAAM,QAAQ,GACZ,MAAM,CAAC,2BAA2B;YAClC,MAAM,CAAC,uBAAuB;YAC9B,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,OAAO,CAAC;QAEjB,MAAM,UAAU,GACd,MAAM,CAAC,8BAA8B;YACrC,MAAM,CAAC,0BAA0B;YACjC,MAAM,CAAC,UAAU;YACjB,MAAM,CAAC,UAAU,CAAC;QAEpB,MAAM,UAAU,GAAG,MAAM,CAAC,6BAA6B,IAAI,MAAM,CAAC,iBAAiB,CAAC;QAEpF,MAAM,OAAO,GACX,MAAM,CAAC,uBAAuB;YAC9B,MAAM,CAAC,WAAW;YAClB,MAAM,CAAC,OAAO,CAAC;QAEjB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEpD,IAAI,QAAQ,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;YACvC,OAAO;gBACL,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO;gBAC9C,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;gBAChD,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;gBACtD,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;gBACtD,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;aAChC,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,gBAAgB;QACtB,MAAM,YAAY,GAAG;YACnB,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,CAAC,EAAE,IAAI,CAAC,wBAAwB,CAAC;YAC3E,IAAI,CAAC,qBAAqB,CAAC,cAAc,EAAE,CAAC,EAAE,IAAI,CAAC,yBAAyB,CAAC;SAC9E,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;QAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QAErD,OAAO;YACL,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,YAAY;YACnB,YAAY;YACZ,SAAS;YACT,aAAa;SACd,CAAC;IACJ,CAAC;IAEO,qBAAqB,CAC3B,EAAkC,EAClC,QAAgB,EAChB,cAAwB;QAExB,MAAM,KAAK,GAAG,EAAE,KAAK,aAAa,CAAC;QACnC,OAAO;YACL,EAAE;YACF,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,0BAA0B;YACvE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,wCAAwC;YACpG,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc;YAC5C,IAAI,EAAE;gBACJ,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,iBAAiB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;gBAChD,WAAW,EAAE,sCAAsC;aACpD;YACD,QAAQ;YACR,UAAU,EAAE,IAAI;YAChB,gBAAgB,EAAE,IAAI;YACtB,cAAc;YACd,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IAEO,kBAAkB;QACxB,OAAO;YACL,EAAE,EAAE,4BAA4B;YAChC,IAAI,EAAE,6BAA6B;YACnC,GAAG,EAAE,yBAAyB;YAC9B,QAAQ,EAAE,MAAM;YAChB,QAAQ,EAAE,wBAAwB;YAClC,gBAAgB,EAAE,IAAI;YACtB,SAAS,EAAE,YAAY;YACvB,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,eAAe;YAC3B,OAAO,EAAE,YAAY;YACrB,gBAAgB,EAAE,IAAI,CAAC,uBAAuB;YAC9C,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IAEO,uBAAuB;QAC7B,OAAO;YACL,QAAQ,EAAE,OAAO;YACjB,QAAQ,EAAE,yBAAyB;YACnC,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAEO,kBAAkB,CACxB,YAAiC,EACjC,SAA2B,EAC3B,OAA2B;QAE3B,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC/B,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACxC,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC"}

package/dist/src/credentials/types.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Credential configuration and resolution types for Call Telemetry Lab MCP.
+ */
+export type ProxmoxHostId = "proxmox-lab" | "proxmox-mini" | "proxmox-minis-lab" | string;
+export interface ProxmoxTokenAuth {
+    type: "token";
+    tokenId: string;
+    tokenSecret: string;
+}
+export interface ProxmoxTicketAuth {
+    type: "ticket";
+    username: string;
+    realm: string;
+    password: string;
+}
+export type ProxmoxAuth = ProxmoxTokenAuth | ProxmoxTicketAuth;
+export interface ProxmoxHostConfig {
+    id: string;
+    name: string;
+    baseUrl: string;
+    nodeName: string;
+    auth: ProxmoxAuth;
+    maxSlots: number;
+    slotSizeMb: number;
+    allowInsecureTls: boolean;
+    sslFingerprint?: string;
+    protectedVmids: number[];
+    isMock?: boolean;
+}
+export interface EsxiHostConfig {
+    id: string;
+    name: string;
+    url: string;
+    username: string;
+    password: string;
+    allowInsecureTls: boolean;
+    datacenter?: string;
+    datastore?: string;
+    resourcePool?: string;
+    network?: string;
+    protectedVmNames?: string[];
+    isMock?: boolean;
+}
+export interface VmCredentialConfig {
+    username: string;
+    password?: string;
+    privateKey?: string;
+    passphrase?: string;
+    port: number;
+}
+export interface DopplerConfig {
+    token?: string;
+    project?: string;
+    config?: string;
+    baseUrl?: string;
+}
+export interface ResolutionOptions {
+    env?: Record<string, string | undefined>;
+    dopplerToken?: string;
+    dopplerProject?: string;
+    dopplerConfig?: string;
+    forceMock?: boolean;
+}
+export type CredentialTier = "direct_env" | "doppler_api" | "mock_fallback";
+export interface CredentialResolutionResult {
+    tier: CredentialTier;
+    hosts: ProxmoxHostConfig[];
+    proxmoxHosts: ProxmoxHostConfig[];
+    esxiHosts: EsxiHostConfig[];
+    vmCredentials: VmCredentialConfig;
+    dopplerSecretsCount?: number;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/credentials/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/credentials/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,aAAa,GAAG,aAAa,GAAG,cAAc,GAAG,mBAAmB,GAAG,MAAM,CAAC;AAE1F,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,WAAW,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAE/D,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,aAAa,GAAG,eAAe,CAAC;AAE5E,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,cAAc,CAAC;IACrB,KAAK,EAAE,iBAAiB,EAAE,CAAC;IAC3B,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAClC,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,aAAa,EAAE,kBAAkB,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/src/credentials/types.js

@@ -0,0 +1,5 @@
+/**
+ * Credential configuration and resolution types for Call Telemetry Lab MCP.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/credentials/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/credentials/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/src/guardrails/index.d.ts

@@ -0,0 +1,3 @@
+export * from "./types.js";
+export * from "./safety.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/guardrails/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/guardrails/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/src/guardrails/index.js

@@ -0,0 +1,3 @@
+export * from "./types.js";
+export * from "./safety.js";
+//# sourceMappingURL=index.js.map

package/dist/src/guardrails/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/guardrails/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC"}

package/dist/src/guardrails/safety.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Safety Guardrails Engine
+ * Protects core infrastructure, persistent fixtures, and template VMs against disruptive or destructive operations.
+ * Enforces non-bypassable guardrails across Proxmox VE and VMware ESXi.
+ */
+import { VmTarget, VmActionType, ProtectionCheckResult, SafetyGuardrailOptions } from "./types.js";
+export * from "./types.js";
+export declare class SafetyGuardrailEngine {
+    private protectedVmIds;
+    private protectedNamePatterns;
+    private protectedTags;
+    constructor(customProtectedVmIds?: (number | string)[], options?: SafetyGuardrailOptions);
+    /**
+     * Check whether a VM is considered protected by ID, template flag, name, tag, or note.
+     */
+    isProtected(vm: VmTarget): ProtectionCheckResult;
+    /**
+     * Validates if the requested action is permitted on the target VM.
+     * Throws ProtectedVmViolationError if a destructive/disruptive action is attempted on a protected VM.
+     * This check is NON-BYPASSABLE, even if force === true.
+     */
+    validateAction(vm: VmTarget, action: VmActionType, _force?: boolean): void;
+    /**
+     * Helper to normalize tags from array or delimited string.
+     */
+    private normalizeTags;
+    /**
+     * Add additional protected VMID at runtime.
+     */
+    addProtectedVmId(vmid: number | string): void;
+    /**
+     * Get list of all explicitly protected VMIDs.
+     */
+    getProtectedVmIds(): (number | string)[];
+}
+/**
+ * Default global instance of SafetyGuardrailEngine
+ */
+export declare const defaultSafetyGuardrailEngine: SafetyGuardrailEngine;
+/**
+ * Convenience function conforming to PROJECT.md interface contract:
+ * assertActionPermitted(vm, action, force)
+ */
+export declare function assertActionPermitted(vm: VmTarget, action: VmActionType, force?: boolean, engine?: SafetyGuardrailEngine): void;
+//# sourceMappingURL=safety.d.ts.map

package/dist/src/guardrails/safety.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safety.d.ts","sourceRoot":"","sources":["../../../src/guardrails/safety.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,QAAQ,EACR,YAAY,EAEZ,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,cAAc,YAAY,CAAC;AAE3B,qBAAa,qBAAqB;IAChC,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,qBAAqB,CAAW;IACxC,OAAO,CAAC,aAAa,CAAc;gBAEvB,oBAAoB,GAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAO,EAAE,OAAO,GAAE,sBAA2B;IA2DhG;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,QAAQ,GAAG,qBAAqB;IAwFhD;;;;OAIG;IACH,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,UAAQ,GAAG,IAAI;IAmCxE;;OAEG;IACH,OAAO,CAAC,aAAa;IAWrB;;OAEG;IACH,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAI7C;;OAEG;IACH,iBAAiB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE;CAMzC;AAED;;GAEG;AACH,eAAO,MAAM,4BAA4B,uBAA8B,CAAC;AAExE;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,QAAQ,EACZ,MAAM,EAAE,YAAY,EACpB,KAAK,UAAQ,EACb,MAAM,GAAE,qBAAoD,GAC3D,IAAI,CAEN"}