@cybedefend/vibedefend 1.1.1

package/dist/hooks/runtime/guard-rules-cache.js

@@ -0,0 +1,217 @@
+/**
+ * ETag-aware cache for Action Guard effective rules.
+ *
+ * Rules are fetched from the gateway endpoint
+ *   GET /project/<id>/action-guards/effective-rules
+ * and cached to `~/.cybedefend/guards-cache.json` with a 60-second TTL.
+ *
+ * On each invocation:
+ *   1. Read the cache file.
+ *   2. If fresh (age < staleSec), return cached rules immediately.
+ *   3. If stale, re-fetch with `If-None-Match: <etag>`.
+ *   4. On 304 Not Modified, touch the cache (extend TTL) and return
+ *      cached rules.
+ *   5. On 200, persist new rules + new ETag.
+ *
+ * Fail-closed semantics:
+ *   - If the fetch fails AND there are no cached rules (cold start or
+ *     cache for a different project), `refreshIfStale` returns
+ *     `{ kind: 'unavailable', reason: '...' }`. Callers MUST block the
+ *     tool call rather than silently allow everything.
+ *   - If the fetch fails but cached rules are present (rolling session
+ *     with a transient auth/network hiccup), the cache returns
+ *     `{ kind: 'rules', rules: [...] }` and emits a stderr warning so
+ *     the operator is aware of the degraded state.
+ *   - Cache read/write failures are still swallowed — I/O errors must
+ *     never interrupt legitimate work.
+ */
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+export const DEFAULT_CACHE_FILE = join(homedir(), '.cybedefend', 'guards-cache.json');
+export const DEFAULT_STALE_SEC = 60;
+// ─── Category-id → evaluator category string ─────────────────────────────────
+const CATEGORY_ID_MAP = {
+    'gc-filesystem': 'filesystem',
+    'gc-shell': 'shell',
+    'gc-network': 'network',
+    'gc-git': 'git',
+    'gc-process': 'process',
+};
+/**
+ * Transform a raw snake_case rule object returned by the gateway API
+ * into the camelCase `Rule` shape expected by the bundled guards-evaluator.
+ *
+ * The API returns fields like `file_path_globs`, `category_id`,
+ * `default_action`, etc. The evaluator's `Rule` interface uses `filePathGlobs`,
+ * `category`, etc. Passing the raw payload straight to `evaluate()` makes every
+ * matcher field resolve to `undefined`, so nothing ever matches and the verdict
+ * is always `allow`.
+ *
+ * Mirrors mcp-service's `snakeToCamelRule` in
+ * `mcp-service/src/modules/gateway-client/gateway-client.service.ts`.
+ */
+export function snakeToCamelRule(raw) {
+    const rawCategoryId = raw['category_id'];
+    const category = rawCategoryId
+        ? (CATEGORY_ID_MAP[rawCategoryId] ?? rawCategoryId)
+        : raw['category'];
+    return {
+        id: raw['id'],
+        category: category,
+        ...(rawCategoryId ? { categoryId: rawCategoryId } : {}),
+        builtinKey: (raw['builtin_key'] ?? raw['builtinKey']),
+        name: raw['name'],
+        description: raw['description'],
+        severity: raw['severity'],
+        action: raw['action'],
+        subcategory: raw['subcategory'],
+        active: raw['active'],
+        version: raw['version'],
+        tags: raw['tags'],
+        isBuiltin: (raw['is_builtin'] ?? raw['isBuiltin']),
+        toolMatch: (raw['tool_match'] ?? raw['toolMatch']),
+        filePathGlobs: (raw['file_path_globs'] ?? raw['filePathGlobs']),
+        filePathExcludes: (raw['file_path_excludes'] ?? raw['filePathExcludes']),
+        commandRegex: (raw['command_regex'] ?? raw['commandRegex']),
+        commandArgGlobs: (raw['command_arg_globs'] ?? raw['commandArgGlobs']),
+        envNameGlobs: (raw['env_name_globs'] ?? raw['envNameGlobs']),
+        httpHostGlobs: (raw['http_host_globs'] ?? raw['httpHostGlobs']),
+        httpHostExcludes: (raw['http_host_excludes'] ?? raw['httpHostExcludes']),
+        httpMethod: (raw['http_method'] ?? raw['httpMethod']),
+        httpPathGlobs: (raw['http_path_globs'] ?? raw['httpPathGlobs']),
+        gitRemoteGlobs: (raw['git_remote_globs'] ?? raw['gitRemoteGlobs']),
+        gitBranchGlobs: (raw['git_branch_globs'] ?? raw['gitBranchGlobs']),
+        gitSubcommand: (raw['git_subcommand'] ?? raw['gitSubcommand']),
+        denyMessage: (raw['deny_message'] ?? raw['denyMessage']),
+        warnMessage: (raw['warn_message'] ?? raw['warnMessage']),
+        defaultAction: (raw['default_action'] ?? raw['defaultAction']),
+    };
+}
+/**
+ * Create an injectable guard rules cache (testable via custom cacheFile and fetchFn).
+ */
+export function makeGuardRulesCache(opts) {
+    const cacheFile = opts.cacheFile ?? DEFAULT_CACHE_FILE;
+    const staleSec = opts.staleSec ?? DEFAULT_STALE_SEC;
+    const fetchFn = opts.fetchFn;
+    async function refreshIfStale(ctx) {
+        const entry = readCache(ctx.projectId);
+        const ageSec = entry
+            ? (Date.now() - entry.fetchedAt) / 1000
+            : Infinity;
+        if (entry && ageSec < staleSec) {
+            // Cache is fresh — return immediately
+            return { kind: 'rules', rules: entry.rules };
+        }
+        // Fetch (with ETag for conditional request if we have one)
+        try {
+            const result = await fetchFn({
+                ...ctx,
+                etag: entry?.etag ?? null,
+            });
+            if (result.notModified && entry) {
+                // 304 — touch the TTL and return original rules
+                writeCache({
+                    ...entry,
+                    fetchedAt: Date.now(),
+                });
+                return { kind: 'rules', rules: entry.rules };
+            }
+            // 200 — persist fresh rules (transform snake_case → camelCase)
+            const transformedRules = result.rules.map((r) => snakeToCamelRule(r));
+            const fresh = {
+                projectId: ctx.projectId,
+                rules: transformedRules,
+                etag: result.etag,
+                fetchedAt: Date.now(),
+            };
+            writeCache(fresh);
+            return { kind: 'rules', rules: fresh.rules };
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            if (entry?.rules?.length) {
+                // We have something to work with — use cached rules and emit a warning
+                // so the operator is aware that there is an auth/network issue brewing.
+                const ageSec = Math.round((Date.now() - entry.fetchedAt) / 1000);
+                process.stderr.write(`[VibeDefend] Action Guards: rule refresh failed (${msg}). ` +
+                    `Using cached rules (age=${ageSec}s).\n`);
+                return { kind: 'rules', rules: entry.rules };
+            }
+            // Cold start with no cached rules — fail-closed.
+            return {
+                kind: 'unavailable',
+                reason: `fetch failed and no cached rules available: ${msg}`,
+            };
+        }
+    }
+    function readCache(projectId) {
+        if (!existsSync(cacheFile))
+            return null;
+        try {
+            const raw = readFileSync(cacheFile, 'utf8');
+            const data = JSON.parse(raw);
+            // Validate that the cached entry is for this project
+            if (data.projectId !== projectId)
+                return null;
+            return data;
+        }
+        catch {
+            return null;
+        }
+    }
+    function writeCache(entry) {
+        try {
+            ensureDirFor(cacheFile);
+            writeFileSync(cacheFile, JSON.stringify(entry), 'utf8');
+        }
+        catch {
+            // Best-effort — silent failure
+        }
+    }
+    return { refreshIfStale };
+}
+function ensureDirFor(filePath) {
+    const dir = dirname(filePath);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+}
+// ─── Gateway fetch implementation (used by the hook runner) ──────────────────
+const DEFAULT_TIMEOUT_MS = 8_000;
+/**
+ * Fetch effective action guard rules from the gateway.
+ *
+ * Uses the existing `fetch` API. Returns the full result or throws on error
+ * (the cache layer catches and falls through to cached/empty rules).
+ */
+export async function fetchEffectiveRulesFromGateway(ctx, opts = {}) {
+    const f = opts.fetchImpl ?? globalThis.fetch;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const url = `${ctx.apiBaseResolved}/project/${encodeURIComponent(ctx.projectId)}/action-guards/effective-rules`;
+    const headers = {
+        Authorization: `Bearer ${ctx.token}`,
+    };
+    if (ctx.etag) {
+        headers['If-None-Match'] = ctx.etag;
+    }
+    const res = await f(url, {
+        method: 'GET',
+        headers,
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (res.status === 304) {
+        return { rules: [], etag: ctx.etag ?? null, notModified: true };
+    }
+    if (!res.ok) {
+        throw new Error(`HTTP ${res.status} from effective-rules endpoint`);
+    }
+    const body = (await res.json());
+    const data = body.data ?? body;
+    const rules = Array.isArray(data.rules) ? data.rules : [];
+    const etag = res.headers.get('ETag');
+    return { rules, etag, notModified: false };
+}
+//# sourceMappingURL=guard-rules-cache.js.map

package/dist/hooks/runtime/guard-rules-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-rules-cache.js","sourceRoot":"","sources":["../../../src/hooks/runtime/guard-rules-cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CACpC,OAAO,EAAE,EACT,aAAa,EACb,mBAAmB,CACpB,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAgDpC,gFAAgF;AAEhF,MAAM,eAAe,GAA2B;IAC9C,eAAe,EAAE,YAAY;IAC7B,UAAU,EAAE,OAAO;IACnB,YAAY,EAAE,SAAS;IACvB,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,SAAS;CACxB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAA4B;IAC3D,MAAM,aAAa,GAAG,GAAG,CAAC,aAAa,CAAuB,CAAC;IAC/D,MAAM,QAAQ,GAAG,aAAa;QAC5B,CAAC,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,aAAa,CAAC;QACnD,CAAC,CAAE,GAAG,CAAC,UAAU,CAAY,CAAC;IAEhC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,IAAI,CAAW;QACvB,QAAQ,EAAE,QAA4B;QACtC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,UAAU,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAuB;QAC3E,IAAI,EAAE,GAAG,CAAC,MAAM,CAAuB;QACvC,WAAW,EAAE,GAAG,CAAC,aAAa,CAAuB;QACrD,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAqB;QAC7C,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAmB;QACvC,WAAW,EAAE,GAAG,CAAC,aAAa,CAAwB;QACtD,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAwB;QAC5C,OAAO,EAAE,GAAG,CAAC,SAAS,CAAuB;QAC7C,IAAI,EAAE,GAAG,CAAC,MAAM,CAAyB;QACzC,SAAS,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAwB;QACzE,SAAS,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,CAAyB;QAC1E,aAAa,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,CAAyB;QACvF,gBAAgB,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAyB;QAChG,YAAY,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAuB;QACjF,eAAe,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAyB;QAC7F,YAAY,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAyB;QACpF,aAAa,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,CAAyB;QACvF,gBAAgB,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,kBAAkB,CAAC,CAAyB;QAChG,UAAU,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAyB;QAC7E,aAAa,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,CAAyB;QACvF,cAAc,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAyB;QAC1F,cAAc,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,gBAAgB,CAAC,CAAyB;QAC1F,aAAa,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,CAAyB;QACtF,WAAW,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAuB;QAC9E,WAAW,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,aAAa,CAAC,CAAuB;QAC9E,aAAa,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,CAAgC;KAC9F,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAA4B;IAE5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAE7B,KAAK,UAAU,cAAc,CAAC,GAI7B;QACC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK;YAClB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI;YACvC,CAAC,CAAC,QAAQ,CAAC;QAEb,IAAI,KAAK,IAAI,MAAM,GAAG,QAAQ,EAAE,CAAC;YAC/B,sCAAsC;YACtC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/C,CAAC;QAED,2DAA2D;QAC3D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC;gBAC3B,GAAG,GAAG;gBACN,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,IAAI;aAC1B,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,WAAW,IAAI,KAAK,EAAE,CAAC;gBAChC,gDAAgD;gBAChD,UAAU,CAAC;oBACT,GAAG,KAAK;oBACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;iBACtB,CAAC,CAAC;gBACH,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/C,CAAC;YAED,+DAA+D;YAC/D,MAAM,gBAAgB,GAAI,MAAM,CAAC,KAAmD,CAAC,GAAG,CACtF,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAC3B,CAAC;YACF,MAAM,KAAK,GAAe;gBACxB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,KAAK,EAAE,gBAAgB;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACtB,CAAC;YACF,UAAU,CAAC,KAAK,CAAC,CAAC;YAClB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAEvD,IAAI,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACzB,uEAAuE;gBACvE,wEAAwE;gBACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;gBACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oDAAoD,GAAG,KAAK;oBAC5D,2BAA2B,MAAM,OAAO,CACzC,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/C,CAAC;YAED,iDAAiD;YACjD,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,+CAA+C,GAAG,EAAE;aAC7D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,SAAS,SAAS,CAAC,SAAiB;QAClC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAe,CAAC;YAC3C,qDAAqD;YACrD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,UAAU,CAAC,KAAiB;QACnC,IAAI,CAAC;YACH,YAAY,CAAC,SAAS,CAAC,CAAC;YACxB,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,cAAc,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,GAAa,EACb,OAAoE,EAAE;IAEtE,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,eAAe,YAAY,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,gCAAgC,CAAC;IAEhH,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE;KACrC,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,OAAO,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC;IACtC,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;QACvB,MAAM,EAAE,KAAK;QACb,OAAO;QACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,gCAAgC,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,MAAM,IAAI,GAAI,IAAI,CAAC,IAAgC,IAAI,IAAI,CAAC;IAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAErC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;AAC7C,CAAC"}

package/dist/hooks/runtime/guard-violations-buffer.js

@@ -0,0 +1,105 @@
+/**
+ * Guard violations buffer.
+ *
+ * Violations (deny/warn outcomes) are appended as JSON lines to a local
+ * buffer file (`~/.cybedefend/guards-violations-buffer.jsonl`) and flushed
+ * to the gateway on demand (typically on hook process exit via
+ * `process.on('beforeExit')`).
+ *
+ * Why JSONL + append semantics?
+ *  - Append to a file is atomic at the OS level for small writes.
+ *  - If the flush crashes mid-batch the file is left intact (preserving
+ *    violations for the next flush attempt).
+ *  - The hook NEVER blocks on the audit write — `bufferViolation` is
+ *    synchronous (sync appendFileSync with minimal data).
+ *
+ * Violation semantics:
+ *  - `deny`  → outcome = 'denied'
+ *  - `warn`  → outcome = 'warned'
+ *  - `allow` → no violation recorded
+ */
+import { appendFileSync, existsSync, readFileSync, writeFileSync, mkdirSync, } from 'node:fs';
+import { dirname } from 'node:path';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+export const DEFAULT_BUFFER_FILE = join(homedir(), '.cybedefend', 'guards-violations-buffer.jsonl');
+/**
+ * Create an injectable violations buffer (testable via custom bufferFile).
+ *
+ * Production code uses the default file under `~/.cybedefend/`.
+ * Tests inject a temp dir path to avoid touching the real FS.
+ */
+export function makeViolationsBuffer(opts = {}) {
+    const bufferFile = opts.bufferFile ?? DEFAULT_BUFFER_FILE;
+    function bufferViolation(ctx, v) {
+        const record = {
+            ...v,
+            projectId: ctx.projectId,
+            timestamp: new Date().toISOString(),
+        };
+        try {
+            ensureDirFor(bufferFile);
+            appendFileSync(bufferFile, JSON.stringify(record) + '\n', 'utf8');
+        }
+        catch {
+            // Best-effort — never block the hook on an I/O error.
+        }
+    }
+    async function flushViolations(ctx, postFn) {
+        if (!existsSync(bufferFile))
+            return;
+        let content;
+        try {
+            content = readFileSync(bufferFile, 'utf8').trim();
+        }
+        catch {
+            return; // can't read — skip
+        }
+        if (!content)
+            return;
+        const records = [];
+        for (const line of content.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            try {
+                records.push(JSON.parse(trimmed));
+            }
+            catch {
+                // Corrupt line — skip it
+            }
+        }
+        if (records.length === 0)
+            return;
+        const BATCH_SIZE = 100;
+        try {
+            for (let i = 0; i < records.length; i += BATCH_SIZE) {
+                const batch = records.slice(i, i + BATCH_SIZE);
+                await postFn(ctx, batch);
+            }
+            // Truncate on success
+            try {
+                writeFileSync(bufferFile, '', 'utf8');
+            }
+            catch {
+                // Best-effort truncate
+            }
+        }
+        catch {
+            // POST failed — preserve buffer for next flush attempt
+        }
+    }
+    return { bufferViolation, flushViolations };
+}
+/** Ensure the parent directory of a file exists. */
+function ensureDirFor(filePath) {
+    const dir = dirname(filePath);
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true });
+    }
+}
+// ─── Default singleton (used by the hook runner) ─────────────────────────────
+const _defaultBuffer = makeViolationsBuffer();
+export const bufferViolation = _defaultBuffer.bufferViolation.bind(_defaultBuffer);
+export const flushViolations = _defaultBuffer.flushViolations.bind(_defaultBuffer);
+//# sourceMappingURL=guard-violations-buffer.js.map

package/dist/hooks/runtime/guard-violations-buffer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-violations-buffer.js","sourceRoot":"","sources":["../../../src/hooks/runtime/guard-violations-buffer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACL,cAAc,EACd,UAAU,EACV,YAAY,EACZ,aAAa,EACb,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CACrC,OAAO,EAAE,EACT,aAAa,EACb,gCAAgC,CACjC,CAAC;AA2CF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAgC,EAAE;IAElC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAE1D,SAAS,eAAe,CAAC,GAAe,EAAE,CAAY;QACpD,MAAM,MAAM,GAAoB;YAC9B,GAAG,CAAC;YACJ,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QACF,IAAI,CAAC;YACH,YAAY,CAAC,UAAU,CAAC,CAAC;YACzB,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;IACH,CAAC;IAED,KAAK,UAAU,eAAe,CAC5B,GAAa,EACb,MAAwB;QAExB,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO;QAEpC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,oBAAoB;QAC9B,CAAC;QAED,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,MAAM,OAAO,GAAsB,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEjC,MAAM,UAAU,GAAG,GAAG,CAAC;QACvB,IAAI,CAAC;YACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC;gBAC/C,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC3B,CAAC;YACD,sBAAsB;YACtB,IAAI,CAAC;gBACH,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;IACH,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC;AAC9C,CAAC;AAED,oDAAoD;AACpD,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;AAE9C,MAAM,CAAC,MAAM,eAAe,GAC1B,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAEtD,MAAM,CAAC,MAAM,eAAe,GAC1B,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC"}

package/dist/hooks/runtime/pre-compact.js

@@ -0,0 +1,41 @@
+/**
+ * PreCompact hook — same gap-analysis nudge as Stop, but fires right
+ * before Claude Code summarises the conversation context. Catches long
+ * sessions where the user keeps replying and Stop never fires.
+ *
+ * Only Claude Code, Cursor, and VS Code Copilot expose this event;
+ * Windsurf and Codex don't have an equivalent (those clients' adapters
+ * simply don't wire this subcommand).
+ */
+import { sniff } from './sniff.js';
+import { emit } from './emit.js';
+import { loadRuntimeConfig, readStdinJson } from './config.js';
+export async function preCompactHook(deps = {}) {
+    const readStdin = deps.readStdin ?? readStdinJson;
+    const loadConfig = deps.loadConfig ?? loadRuntimeConfig;
+    const emitFn = deps.emitFn ?? emit;
+    const stdin = await readStdin();
+    const event = sniff(stdin);
+    const config = loadConfig();
+    if (!config)
+        return;
+    if (!config.hooks.enableSessionReview)
+        return;
+    if (process.env.CYBEDEFEND_DRY_RUN === '1') {
+        emitFn(`## 🛡️ CybeDefend PreCompact (dry-run, client=${event.client})\n`, event.client);
+        return;
+    }
+    const body = [
+        '## 🛡️ CybeDefend PreCompact gap analysis',
+        '',
+        'Context is about to be compacted — this session has been substantial.',
+        'Before the fine-grained tool history is summarised away, run a gap analysis:',
+        '1. Re-read the original user request (still uncompacted now).',
+        '2. List the CybeDefend rules returned during the session.',
+        '3. For uncovered concerns, ask the user via AskUserQuestion whether to propose;',
+        '   on "yes", call `cybe_rules_report_missing` with confirmed_by_user: true.',
+        '',
+    ].join('\n');
+    emitFn(body, event.client);
+}
+//# sourceMappingURL=pre-compact.js.map

package/dist/hooks/runtime/pre-compact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pre-compact.js","sourceRoot":"","sources":["../../../src/hooks/runtime/pre-compact.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAQ/D,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC;IAClD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,iBAAiB,CAAC;IACxD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IAEnC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB;QAAE,OAAO;IAE9C,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG,EAAE,CAAC;QAC3C,MAAM,CACJ,iDAAiD,KAAK,CAAC,MAAM,KAAK,EAClE,KAAK,CAAC,MAAM,CACb,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG;QACX,2CAA2C;QAC3C,EAAE;QACF,uEAAuE;QACvE,8EAA8E;QAC9E,+DAA+D;QAC/D,2DAA2D;QAC3D,iFAAiF;QACjF,6EAA6E;QAC7E,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC"}

package/dist/hooks/runtime/resolve.js

@@ -0,0 +1,206 @@
+/**
+ * Resolve the project ID + bearer token at hook-invocation time.
+ *
+ * Both are needed for every API call. Lookup order matches the bash
+ * hooks we replaced, so existing users keep the same behaviour:
+ *
+ *   projectId: $CYBEDEFEND_PROJECT_ID → .cybedefend/config.json:projectId
+ *   token:     $CYBEDEFEND_TOKEN      → OS keychain (macOS Keychain /
+ *                                       Linux libsecret) for the MCP
+ *                                       server name we were installed
+ *                                       against
+ *
+ * Windows: we shell out to PowerShell's CredentialManager via `cmdkey`
+ * in V1.1; for V1 Windows users provide $CYBEDEFEND_TOKEN explicitly.
+ * (Claude Code on Windows doesn't write to a system keychain yet anyway.)
+ */
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { getValidAccessToken, LoginRequiredError } from '../../auth/auth.js';
+export function resolveProjectId(cwd = process.cwd()) {
+    const envProjectId = process.env.CYBEDEFEND_PROJECT_ID;
+    if (envProjectId && envProjectId.length > 0) {
+        return { projectId: envProjectId, apiBase: null };
+    }
+    const configPath = `${cwd}/.cybedefend/config.json`;
+    if (existsSync(configPath)) {
+        try {
+            const raw = readFileSync(configPath, 'utf8');
+            const cfg = JSON.parse(raw);
+            return {
+                projectId: cfg.projectId ?? null,
+                apiBase: cfg.apiBase ?? null,
+            };
+        }
+        catch {
+            // Malformed JSON — silently fall through to "no projectId" so the
+            // hook early-exits without spamming the agent's context.
+        }
+    }
+    return { projectId: null, apiBase: null };
+}
+/**
+ * Resolve the bearer token. Returns null if not found.
+ *
+ * macOS: Claude Code stores MCP OAuth tokens in the Keychain under the
+ * service name "Claude Code-credentials". We shell out to `security`
+ * (ships with macOS, no install) to extract the JSON blob, then parse
+ * for the entry whose `serverName` matches our MCP name.
+ *
+ * macOS (Codex): Codex stores MCP OAuth tokens in the Keychain under
+ * the service name "Codex MCP Credentials". The account is
+ * "<mcpName>|<hash>" and the password is a JSON blob with an
+ * `access_token` field. We try this keychain after the Claude Code one.
+ *
+ * Linux: `secret-tool lookup service Claude-Code account <mcpName>`
+ * (requires libsecret-tools; ships with most desktop distros).
+ *
+ * Windows: env var only for V1. Future improvement: `cmdkey /list` →
+ * parse, or via a small PowerShell snippet.
+ */
+export function resolveToken(mcpName) {
+    const envToken = process.env.CYBEDEFEND_TOKEN;
+    if (envToken && envToken.length > 0)
+        return envToken;
+    if (process.platform === 'darwin') {
+        return resolveTokenMacOS(mcpName) ?? resolveTokenCodexMacOS(mcpName);
+    }
+    if (process.platform === 'linux')
+        return resolveTokenLinux(mcpName);
+    return null;
+}
+function resolveTokenMacOS(mcpName) {
+    let blob;
+    try {
+        blob = execFileSync('security', ['find-generic-password', '-s', 'Claude Code-credentials', '-w'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 2000,
+        }).trim();
+    }
+    catch {
+        return null;
+    }
+    try {
+        const data = JSON.parse(blob);
+        const oauth = data.mcpOAuth ?? {};
+        for (const entry of Object.values(oauth)) {
+            if (entry?.serverName === mcpName && entry.accessToken) {
+                return entry.accessToken;
+            }
+        }
+    }
+    catch {
+        // Blob isn't JSON — Claude Code stores raw token for some setups.
+        // Use it as-is.
+        return blob || null;
+    }
+    return null;
+}
+/**
+ * Codex stores MCP OAuth tokens in the macOS Keychain under service
+ * "Codex MCP Credentials". The account is "<mcpName>|<hash>" — we use
+ * a prefix match on the service and iterate all matching entries via
+ * `security find-generic-password -s "Codex MCP Credentials"`.
+ *
+ * The password blob is a JSON object with an `access_token` field (the
+ * same structure Codex writes when `codex mcp login <name>` completes).
+ * Fall back to returning the raw blob as a token if JSON parsing fails
+ * (some Codex versions write the raw token string directly).
+ */
+function resolveTokenCodexMacOS(mcpName) {
+    // `security find-generic-password` with `-s` returns the FIRST matching
+    // entry. We use `-a <account-prefix>` to narrow to our MCP name, but the
+    // account has a `|<hash>` suffix we don't know. Instead we enumerate all
+    // entries for the Codex service and filter by mcpName prefix.
+    let blob;
+    try {
+        blob = execFileSync('security', ['find-generic-password', '-s', 'Codex MCP Credentials', '-a', mcpName, '-w'], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 2000,
+        }).trim();
+    }
+    catch {
+        // Exact account match failed (account has a hash suffix). Try without
+        // the -a filter and scan all entries for this service by iterating.
+        // `security find-generic-password` without `-a` returns the first entry;
+        // to iterate all we'd need `security dump-keychain` (requires trust), so
+        // we try the service-only lookup and accept the first entry returned.
+        try {
+            blob = execFileSync('security', ['find-generic-password', '-s', 'Codex MCP Credentials', '-w'], {
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'ignore'],
+                timeout: 2000,
+            }).trim();
+        }
+        catch {
+            return null;
+        }
+    }
+    if (!blob)
+        return null;
+    try {
+        const data = JSON.parse(blob);
+        return data.access_token ?? data.accessToken ?? data.token ?? null;
+    }
+    catch {
+        // Raw token string stored directly.
+        return blob || null;
+    }
+}
+function resolveTokenLinux(mcpName) {
+    try {
+        const token = execFileSync('secret-tool', ['lookup', 'service', 'Claude-Code', 'account', mcpName], {
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 2000,
+        }).trim();
+        return token.length > 0 ? token : null;
+    }
+    catch {
+        return null;
+    }
+}
+// ─── Async token resolution with transparent refresh ─────────────────────────
+/**
+ * Async variant of `resolveToken` that transparently refreshes the access_token
+ * when near expiry using the stored refresh_token.
+ *
+ * Falls back to the synchronous `resolveToken` path (legacy keychain lookup) if
+ * the new OAuth store has no entry for this MCP name — this ensures backward
+ * compatibility during the migration period.
+ *
+ * Returns null when:
+ *   - No credentials of any kind are stored (CYBEDEFEND_TOKEN env, keychain,
+ *     or OAuth store), OR
+ *   - The refresh_token was rejected by Logto (LoginRequiredError) — in this
+ *     case local credentials are already cleared; the caller should trigger
+ *     the UNVERIFIED banner.
+ *
+ * Never throws — all errors are converted to null so hook callers remain
+ * fail-open.
+ */
+export async function resolveTokenWithRefresh(mcpName) {
+    // 1. Env var takes highest precedence (CI / scripted use).
+    const envToken = process.env.CYBEDEFEND_TOKEN;
+    if (envToken && envToken.length > 0)
+        return envToken;
+    // 2. Try the new OAuth-store path (includes transparent refresh).
+    try {
+        const token = await getValidAccessToken(mcpName);
+        if (token)
+            return token;
+    }
+    catch (e) {
+        if (e instanceof LoginRequiredError) {
+            // Refresh token rejected — caller triggers UNVERIFIED banner.
+            return null;
+        }
+        // Transient error (network/DNS) — fall through to the legacy path below
+        // so a stale-but-unexpired legacy token can still be used.
+    }
+    // 3. Fall back to the synchronous legacy keychain lookup (pre-PKCE tokens).
+    return resolveToken(mcpName);
+}
+//# sourceMappingURL=resolve.js.map

package/dist/hooks/runtime/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/hooks/runtime/resolve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAQ7E,MAAM,UAAU,gBAAgB,CAAC,MAAc,OAAO,CAAC,GAAG,EAAE;IAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACvD,IAAI,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,GAAG,0BAA0B,CAAC;IACpD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAGzB,CAAC;YACF,OAAO;gBACL,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI;gBAChC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;aAC7B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,yDAAyD;QAC3D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,iBAAiB,CAAC,OAAO,CAAC,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CACjB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,CAAC,EAChE;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAE3B,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,KAAK,EAAE,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;gBACvD,OAAO,KAAK,CAAC,WAAW,CAAC;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,gBAAgB;QAChB,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,sBAAsB,CAAC,OAAe;IAC7C,wEAAwE;IACxE,yEAAyE;IACzE,yEAAyE;IACzE,8DAA8D;IAC9D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CACjB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAC7E;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,oEAAoE;QACpE,yEAAyE;QACzE,yEAAyE;QACzE,sEAAsE;QACtE,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CACjB,UAAU,EACV,CAAC,uBAAuB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,CAAC,EAC9D;gBACE,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;gBACnC,OAAO,EAAE,IAAI;aACd,CACF,CAAC,IAAI,EAAE,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAI3B,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;QACpC,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CACxB,aAAa,EACb,CAAC,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,EACxD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC,IAAI,EAAE,CAAC;QACT,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe;IAEf,2DAA2D;IAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAErD,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,kBAAkB,EAAE,CAAC;YACpC,8DAA8D;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,wEAAwE;QACxE,2DAA2D;IAC7D,CAAC;IAED,4EAA4E;IAC5E,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC"}