@cybedefend/vibedefend 1.5.0 → 1.6.0

package/dist/commands/mcp/proxy.js

@@ -0,0 +1,264 @@
+import { chain } from '../../mcp/proxy/intercept.js';
+import { createTokenSource } from '../../mcp/auth/tokenSource.js';
+import { connectCommandFor, createAuthInterceptor } from '../../mcp/proxy/authInterceptor.js';
+import { createAudit } from '../../mcp/proxy/audit.js';
+import { createVerifyInterceptor } from '../../mcp/proxy/verifyInterceptor.js';
+import { buildVerifier } from '../../mcp/verify/factory.js';
+import { isProxyInstalled } from '../../mcp/config/installed.js';
+import { withSyncLock } from '../../mcp/config/lock.js';
+import { checkProxyBinary } from '../../mcp/config/proxyBinary.js';
+import { applySyncPlan, planSync } from '../../mcp/config/rewrite.js';
+import { loggerFromEnv, parseLogLevel } from '../../mcp/proxy/log.js';
+import { mcpLogsDir, PROXY_ENV_PREFIX } from '../../mcp/proxy/paths.js';
+import { Proxy } from '../../mcp/proxy/proxy.js';
+import { createLogger } from '../../mcp/proxy/log.js';
+import { describeUpstream, resolveUpstreamSpec, UpstreamSpecError, } from '../../mcp/proxy/spec.js';
+import { expandedSpecOf, resolveNamedUpstream, specOf, UnknownUpstreamError, } from '../../mcp/proxy/upstreams.js';
+/** Exit code for a usage error, distinct from an upstream that died. */
+export const EXIT_USAGE = 2;
+export async function runMcpProxyCommand(options, runtime) {
+    // TWO specs, and they are not interchangeable.
+    //
+    // `spec` is what the upstream is reached with: expanded, because the child
+    // needs the value the originating client would have given it.
+    //
+    // `identitySpec` is the entry as stored: NOT expanded, because
+    // `upstreamServerId` hashes `command` + `args` (or the url), and that hash
+    // keys the verdict cache and the user's own `allow`/`deny` overrides —
+    // which `vibedefend allow|deny|status` compute from the stored entry.
+    // Deriving it from the expanded spec makes a `deny` stop applying the
+    // moment a reference appears in `args`, silently. Measured, not feared:
+    // see the conformance test that pins it.
+    let spec;
+    let identitySpec;
+    // Variable references the originating client would have resolved. Names
+    // only — these are logged, and one of them is an API key.
+    let expansion = { resolved: [], missing: [] };
+    try {
+        // `--name` is the shape `vibedefend install` writes into a client config,
+        // so it wins over anything else on the command line.
+        if (options.name) {
+            const { entry } = resolveNamedUpstream(options.name, runtime.env);
+            // Expanded HERE, at the moment of use — `upstreams.json` keeps the
+            // reference, never the value. See `expand.ts`.
+            const expanded = expandedSpecOf(entry, runtime.env);
+            spec = expanded.value;
+            identitySpec = specOf(entry);
+            expansion = { resolved: expanded.resolved, missing: expanded.missing };
+        }
+        else {
+            spec = resolveUpstreamSpec(options);
+            // Nothing was expanded, so the two are the same object.
+            identitySpec = spec;
+        }
+    }
+    catch (error) {
+        if (error instanceof UpstreamSpecError || error instanceof UnknownUpstreamError) {
+            runtime.stderr.write(`vibedefend mcp: ${error.message}\n`);
+            return EXIT_USAGE;
+        }
+        throw error;
+    }
+    const level = options.logLevel
+        ? parseLogLevel(options.logLevel)
+        : parseLogLevel(runtime.env[`${PROXY_ENV_PREFIX}LOG_LEVEL`]);
+    const logger = options.logLevel
+        ? createLogger({
+            level,
+            dir: mcpLogsDir(runtime.env),
+            base: { pid: process.pid, upstream: describeUpstream(spec) },
+            mirrorToStderr: runtime.env[`${PROXY_ENV_PREFIX}LOG_STDERR`] === '1',
+        })
+        : loggerFromEnv({ pid: process.pid, upstream: describeUpstream(spec) }, runtime.env);
+    // Names only, never values — this line is the one that would have made the
+    // signoz 401 a ten-second diagnosis instead of a dogfooding session.
+    if (expansion.resolved.length > 0 || expansion.missing.length > 0) {
+        logger.info('expanded variable references from the client entry', {
+            resolved: expansion.resolved,
+            resolvedCount: expansion.resolved.length,
+            missing: expansion.missing,
+        });
+    }
+    for (const name of expansion.missing) {
+        logger.warn('a variable referenced by this server is not set and has no default; ' +
+            'the literal text is passed through, exactly as the client would', { variable: name });
+    }
+    const proxy = new Proxy({
+        spec,
+        logger,
+        interceptor: buildInterceptor(spec, identitySpec, options.name, logger, runtime),
+        stdin: runtime.stdin,
+        stdout: runtime.stdout,
+        stderr: runtime.stderr,
+        proxyVersion: runtime.version,
+        // Only an http upstream can carry a bearer. The source reads nothing until
+        // the server answers 401, so a server that wants no token never causes a
+        // credential-store lookup at all.
+        auth: spec.transport === 'http'
+            ? createTokenSource(spec.url, {
+                onLookup: (outcome) => logger.info('credential lookup', { outcome }),
+            })
+            : undefined,
+        afterInitialize: runtime.env[`${PROXY_ENV_PREFIX}NO_SYNC`] === '1'
+            ? undefined
+            : () => backgroundSync(options, runtime, logger),
+        agentInitializeDeadlineMs: positiveMs(runtime.env[`${PROXY_ENV_PREFIX}INIT_DEADLINE_MS`]),
+        upstreamInitializeTimeoutMs: positiveMs(runtime.env[`${PROXY_ENV_PREFIX}UPSTREAM_INIT_TIMEOUT_MS`]),
+    });
+    const register = runtime.onSignal ?? ((handler) => {
+        process.on('SIGINT', () => handler('SIGINT'));
+        process.on('SIGTERM', () => handler('SIGTERM'));
+    });
+    register((signal) => {
+        logger.info('received a signal', { signal });
+        proxy.shutdown(0);
+    });
+    return proxy.run();
+}
+/** An override is honoured only when it is a positive number of milliseconds. */
+function positiveMs(value) {
+    if (!value)
+        return undefined;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
+/**
+ * May this proxy rewrite the clients' configs?
+ *
+ * Only when all three hold: it was spawned from a wrapped entry (`--name`,
+ * not an ad hoc `--upstream` typed by a human), the user explicitly installed
+ * the proxy (the `installed` marker), and the binary running is the one
+ * `vibedefend` resolves to on the PATH — so the entries it would write point
+ * at itself. A checkout's `node dist/index.js` fails the third, whatever the
+ * marker says: measured on 2026-09-08, it wrapped twelve real servers behind
+ * a global release that had no `mcp` command.
+ */
+function backgroundSyncPermission(options, runtime) {
+    if (!options.name)
+        return 'ad-hoc';
+    if (!isProxyInstalled(runtime.env))
+        return 'not-installed';
+    const check = checkProxyBinary({ env: runtime.env, argv1: runtime.argv1 ?? process.argv[1] });
+    if (!check.matches)
+        return check.reason ?? 'different-binary';
+    return 'granted';
+}
+/**
+ * The background `sync` the plan asks the proxy to run at startup.
+ *
+ * It exists so that a server added with `claude mcp add` mid-week ends up
+ * behind the proxy without anyone remembering a command. Three things make it
+ * safe to run from here:
+ *
+ *  - the permission above, checked first and logged when refused;
+ *  - the lock. One proxy runs per MCP server, so five of them start within
+ *    the same second and would otherwise all rewrite `~/.claude.json` at
+ *    once; whoever gets the lock does the work and the rest do nothing.
+ *  - no backup. A timestamped copy per session, per server, would fill the
+ *    user's home with files nobody asked for. The originals are in
+ *    `upstreams.json`, which is what `uninstall` restores from anyway.
+ *
+ * Every failure is logged and swallowed: an MCP session must not end because
+ * a config file could not be rewritten.
+ */
+async function backgroundSync(options, runtime, logger) {
+    const env = runtime.env;
+    const permission = backgroundSyncPermission(options, runtime);
+    if (permission !== 'granted') {
+        // An ad hoc launch is routine; the other two mean an installed proxy that
+        // cannot do its job, which somebody reading the log should see.
+        logger[permission === 'ad-hoc' ? 'debug' : 'info']('background sync skipped', {
+            reason: permission,
+        });
+        return;
+    }
+    const ran = await withSyncLock(() => {
+        const plan = planSync({ env });
+        const result = applySyncPlan(plan, { env, backup: false });
+        return { plan, result };
+    }, { env });
+    if (!ran) {
+        logger.debug('background sync skipped: another process holds the lock');
+        return;
+    }
+    const wrapped = ran.plan.changes.filter((change) => change.kind === 'wrap').length;
+    const forgotten = ran.plan.changes.filter((change) => change.kind === 'forget').length;
+    if (wrapped === 0 && forgotten === 0 && ran.result.failed.length === 0) {
+        logger.debug('background sync: nothing to do');
+        return;
+    }
+    logger.info('background sync', {
+        wrapped,
+        forgotten,
+        failed: ran.result.failed.length,
+        files: ran.result.written,
+    });
+}
+/**
+ * The interceptors, in the order they see a message.
+ *
+ * Auth first: an http upstream that refuses every token gets `initialize`
+ * answered by the proxy and a tool list reduced to
+ * `vibedefend_connect_required`, and verification has nothing to say about a
+ * list the proxy wrote itself. It is wired whatever `VIBEDEFEND_MCP_NO_VERIFY`
+ * says, because it is not verification: it is section 0's rule that
+ * `initialize` is always answered.
+ */
+function buildInterceptor(spec, identitySpec, name, logger, runtime) {
+    const interceptors = [];
+    if (spec.transport === 'http') {
+        interceptors.push(createAuthInterceptor({
+            // Displayed, so the stored form: an expanded url would print the
+            // value of the reference into the agent's context.
+            serverName: name ?? describeUpstream(identitySpec),
+            connectCommand: connectCommandFor({ name, spec: identitySpec }),
+            proxyVersion: runtime.version,
+            logger,
+        }));
+    }
+    const verify = buildVerifyInterceptor(identitySpec, name, logger, runtime);
+    if (verify)
+        interceptors.push(verify);
+    if (interceptors.length === 0)
+        return undefined;
+    return interceptors.length === 1 ? interceptors[0] : chain(interceptors);
+}
+/**
+ * The verification seam, wired to the local cache and to the CybeDefend
+ * backend — through `buildVerifier`, the same wiring `vibedefend scan` uses,
+ * so what one buys the other finds.
+ *
+ * `VIBEDEFEND_MCP_NO_VERIFY=1` takes it out entirely, which is what the
+ * Phase 1 conformance suite runs with: those tests assert that the proxy is
+ * indistinguishable from the server, and a `vibedefend_alert` appended to a
+ * tool list is, correctly, a difference.
+ */
+function buildVerifyInterceptor(spec, name, logger, runtime) {
+    if (runtime.env[`${PROXY_ENV_PREFIX}NO_VERIFY`] === '1') {
+        logger.info('verification disabled by the environment');
+        return undefined;
+    }
+    // No credential means no backend call, and the cache alone decides. That
+    // is a supported state, not a degraded one: a machine with a blacklisted
+    // server in its cache still refuses it. No network here: an organization
+    // that is not persisted yet is resolved at the first verification, after
+    // `initialize` has been answered (section 0).
+    const { verifier, serverId, serverName, backend } = buildVerifier(spec, name ?? describeUpstream(spec), logger, runtime.env);
+    logger.info('verification enabled', {
+        serverId,
+        backend: backend !== null,
+        organization: backend?.organizationId ? 'persisted' : backend ? 'resolved-at-first-call' : 'none',
+    });
+    return createVerifyInterceptor({
+        verifier,
+        logger,
+        spec,
+        serverId,
+        serverName,
+        // Sizes and rule names, never arguments and never results: the plan's
+        // rule is that nothing from a `tools/call` leaves the machine, and a file
+        // quoting them would be a second copy of everything the user has done.
+        audit: createAudit({ env: runtime.env }),
+    });
+}
+//# sourceMappingURL=proxy.js.map

package/dist/commands/mcp/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../../src/commands/mcp/proxy.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,KAAK,EAAoB,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAA4B,MAAM,iCAAiC,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,aAAa,EAA8B,MAAM,wBAAwB,CAAC;AAClG,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,GAGlB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,MAAM,EACN,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AAoBtC,wEAAwE;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAE5B,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA+B,EAC/B,OAAwB;IAExB,+CAA+C;IAC/C,EAAE;IACF,2EAA2E;IAC3E,8DAA8D;IAC9D,EAAE;IACF,+DAA+D;IAC/D,2EAA2E;IAC3E,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,IAAkB,CAAC;IACvB,IAAI,YAA0B,CAAC;IAC/B,wEAAwE;IACxE,0DAA0D;IAC1D,IAAI,SAAS,GAA8C,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzF,IAAI,CAAC;QACH,0EAA0E;QAC1E,qDAAqD;QACrD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAClE,mEAAmE;YACnE,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC;YACtB,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,SAAS,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACpC,wDAAwD;YACxD,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAChF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3D,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAa,OAAO,CAAC,QAAQ;QACtC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;QACjC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,WAAW,CAAC,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ;QAC7B,CAAC,CAAC,YAAY,CAAC;YACX,KAAK;YACL,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;YAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE;YAC5D,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,YAAY,CAAC,KAAK,GAAG;SACrE,CAAC;QACJ,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAEvF,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;YAChE,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM;YACxC,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,sEAAsE;YACpE,iEAAiE,EACnE,EAAE,QAAQ,EAAE,IAAI,EAAE,CACnB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;QACtB,IAAI;QACJ,MAAM;QACN,WAAW,EAAE,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC;QAChF,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAA+B;QAC/C,YAAY,EAAE,OAAO,CAAC,OAAO;QAC7B,2EAA2E;QAC3E,yEAAyE;QACzE,kCAAkC;QAClC,IAAI,EACF,IAAI,CAAC,SAAS,KAAK,MAAM;YACvB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1B,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC;aACrE,CAAC;YACJ,CAAC,CAAC,SAAS;QACf,eAAe,EACb,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,SAAS,CAAC,KAAK,GAAG;YAC/C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC;QACpD,yBAAyB,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,kBAAkB,CAAC,CAAC;QACzF,2BAA2B,EAAE,UAAU,CACrC,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,0BAA0B,CAAC,CAC3D;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE;QAClB,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAID;;;;;;;;;;GAUG;AACH,SAAS,wBAAwB,CAC/B,OAA+B,EAC/B,OAAwB;IAExB,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IACnC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,eAAe,CAAC;IAC3D,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,cAAc,CAC3B,OAA+B,EAC/B,OAAwB,EACxB,MAAc;IAEd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,yBAAyB,EAAE;YAC5E,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACnF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACvF,IAAI,OAAO,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;QAC7B,OAAO;QACP,SAAS;QACT,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM;QAChC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;KAC1B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,IAAkB,EAClB,YAA0B,EAC1B,IAAwB,EACxB,MAAc,EACd,OAAwB;IAExB,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC9B,YAAY,CAAC,IAAI,CACf,qBAAqB,CAAC;YACpB,iEAAiE;YACjE,mDAAmD;YACnD,UAAU,EAAE,IAAI,IAAI,gBAAgB,CAAC,YAAY,CAAC;YAClD,cAAc,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YAC/D,YAAY,EAAE,OAAO,CAAC,OAAO;YAC7B,MAAM;SACP,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3E,IAAI,MAAM;QAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,OAAO,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAC3E,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAC7B,IAAkB,EAClB,IAAwB,EACxB,MAAc,EACd,OAAwB;IAExB,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,WAAW,CAAC,KAAK,GAAG,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,aAAa,CAC/D,IAAI,EACJ,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAC9B,MAAM,EACN,OAAO,CAAC,GAAG,CACZ,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;QAClC,QAAQ;QACR,OAAO,EAAE,OAAO,KAAK,IAAI;QACzB,YAAY,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM;KAClG,CAAC,CAAC;IACH,OAAO,uBAAuB,CAAC;QAC7B,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,QAAQ;QACR,UAAU;QACV,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,KAAK,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;KACzC,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/mcp/scan.js

@@ -0,0 +1,349 @@
+/**
+ * `vibedefend scan` — talk to every upstream once, with no agent in the loop.
+ *
+ * `initialize` plus `tools/list` against each server in `upstreams.json`, and
+ * a line per server. It is the command you run when something is wrong and
+ * you want to know which server it is, and it is what a CI job runs to find
+ * out whether the park changed under it.
+ *
+ * It is also the AUDIT. An agent session buys a judgement only for the tool
+ * it calls; `scan` buys one for every tool of every reachable server
+ * (`Verifier.judgeAll`), because the user who typed it asked exactly that
+ * question. The `verdict` column is the worst verdict on the server, the
+ * flagged tools are listed under it, and a `malicious` server exits
+ * non-zero. Without a credential the column reads `unverified`, which is
+ * honest: nobody could be asked. `VIBEDEFEND_MCP_NO_VERIFY=1` skips it.
+ */
+import { spawn } from 'node:child_process';
+import { probeMcpHttp } from '../../mcp/auth/probe.js';
+import { ensureMcpAccessToken } from '../../mcp/auth/store.js';
+import { createNullLogger } from '../../mcp/proxy/log.js';
+import { encodeMessage, LineFramer } from '../../mcp/proxy/jsonrpc.js';
+import { PROXY_ENV_PREFIX } from '../../mcp/proxy/paths.js';
+import { describeUpstream, upstreamEnvironment } from '../../mcp/proxy/spec.js';
+import { planSpawn } from '../../mcp/proxy/windowsCommand.js';
+import { expandedSpecOf, readUpstreams, specOf } from '../../mcp/proxy/upstreams.js';
+import { resolveBackendConfig } from '../../mcp/verify/backend.js';
+import { createJsonVerifyCache } from '../../mcp/verify/cache.js';
+import { buildVerifier } from '../../mcp/verify/factory.js';
+import { runPool } from '../../mcp/verify/pool.js';
+import { log } from '../../utils.js';
+export const EXIT_OK = 0;
+export const EXIT_PROBLEM = 1;
+export const EXIT_USAGE = 2;
+const DEFAULT_TIMEOUT_MS = 20_000;
+/** A judge takes about a second per tool; a catalogue of a hundred is a coffee. */
+const DEFAULT_VERIFY_TIMEOUT_MS = 180_000;
+/**
+ * Servers judged side by side. Probing stays sequential — a stdio server is
+ * a process, and spawning the whole park at once is the wrong kind of
+ * fast — but a judgement is a network call that waits on a backend, and
+ * four of them waiting together cost the backend nothing it does not cap.
+ */
+const JUDGE_CONCURRENCY = 4;
+export async function runMcpScanCommand(options, runtime) {
+    const stdout = runtime.stdout ?? process.stdout;
+    const stderr = runtime.stderr ?? process.stderr;
+    const upstreams = readUpstreams(runtime.env);
+    let entries = Object.values(upstreams.servers);
+    if (options.name) {
+        const one = upstreams.servers[options.name];
+        if (!one) {
+            stderr.write(`vibedefend scan: no upstream named "${options.name}". Known: ${Object.keys(upstreams.servers).join(', ') || '(none)'}.\n`);
+            return EXIT_USAGE;
+        }
+        entries = [one];
+    }
+    if (entries.length === 0) {
+        if (options.json)
+            stdout.write(`${JSON.stringify({ servers: [] }, null, 2)}\n`);
+        else
+            log.info('No MCP server is registered. Run `vibedefend sync` after configuring one.');
+        return EXIT_OK;
+    }
+    const prepared = await prepareRuntime(runtime, stderr);
+    // Two phases. Reach every server, one at a time; then judge the ones that
+    // answered, a few at a time. The rows stay in the order of the entries
+    // whatever finishes first.
+    const probed = [];
+    for (const entry of entries) {
+        probed.push(await probeOne(entry, options, prepared));
+    }
+    const judge = prepared.judge ?? judgeWithBackend;
+    await runPool(probed.filter((server) => server.tools !== undefined), JUDGE_CONCURRENCY, async (server) => {
+        const started = Date.now();
+        const judged = await judge(server.spec, server.tools ?? [], options, prepared, server.row.name);
+        Object.assign(server.row, judged);
+        server.row.ms += elapsed(started);
+    });
+    const rows = probed.map((server) => server.row);
+    if (options.json) {
+        stdout.write(`${JSON.stringify({ servers: rows }, null, 2)}\n`);
+    }
+    else {
+        writeTable(rows);
+    }
+    // A server that wants a login is not a failure of the scan: it is
+    // information, and `vibedefend connect` is the answer. A malicious server
+    // is, and so is one that could not be reached.
+    return rows.some((row) => row.status === 'unreachable' ||
+        row.status === 'unusable' ||
+        row.verdict === 'malicious' ||
+        row.override === 'deny')
+        ? EXIT_PROBLEM
+        : EXIT_OK;
+}
+/**
+ * Resolves what every judgement of this scan shares — backend, cache — once.
+ *
+ * Only when the real judge will run: an injected judge never touches them,
+ * and `VIBEDEFEND_MCP_NO_VERIFY=1` means nobody is asked at all.
+ */
+async function prepareRuntime(runtime, stderr) {
+    if (runtime.judge || runtime.env[`${PROXY_ENV_PREFIX}NO_VERIFY`] === '1')
+        return runtime;
+    const backend = runtime.backend !== undefined
+        ? runtime.backend
+        : await (runtime.resolveBackendConfigFn ?? resolveBackendConfig)({
+            env: runtime.env,
+            // Typed by a human: the reason nothing is verified goes to them.
+            warn: (message) => stderr.write(`vibedefend scan: ${message}\n`),
+        });
+    return {
+        ...runtime,
+        backend,
+        cache: runtime.cache ?? createJsonVerifyCache({ env: runtime.env }),
+    };
+}
+async function probeOne(entry, options, runtime) {
+    const started = Date.now();
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const base = { name: entry.name, transport: entry.transport, verdict: 'unverified' };
+    // TWO specs, as in the proxy (`runMcpProxyCommand`). The expanded one is
+    // what the server is REACHED with — a `${VAR}` in a url, a header or an
+    // argument must resolve here too, or `scan` reports a server the proxy
+    // would reach as unreachable. The stored one is what the verdict is FILED
+    // under: `upstreamServerId` hashes `command` + `args` (or the url), and
+    // that hash keys the cache and the user's `allow`/`deny`, which the proxy
+    // and `vibedefend allow` compute from the stored entry. Judging under the
+    // expanded spec would open a second cache file per server (with the
+    // resolved value in its name), bill every tool twice, and hide the
+    // override from `scan`.
+    const identitySpec = specOf(entry);
+    const failed = (status) => ({
+        row: { ...base, status, ms: elapsed(started) },
+        spec: identitySpec,
+    });
+    try {
+        if (entry.transport === 'http') {
+            const spec = expandedSpecOf(entry, runtime.env).value;
+            if (spec.transport !== 'http')
+                return failed('unusable');
+            const common = {
+                timeoutMs,
+                headers: spec.headers,
+                clientInfo: { name: 'vibedefend', version: runtime.version },
+            };
+            // Bare first. Most servers want no token, and asking the credential
+            // store for one costs a keychain round trip — and, on a locked macOS
+            // keychain, a dialog — for a lookup that was never going to find
+            // anything.
+            let probe = await probeMcpHttp(spec.url, { ...common, token: null });
+            if (probe.verdict === 'refused') {
+                // Renewed if it expired, and persisted: a token that ran out in the
+                // last hour used to send the user to `vibedefend connect --all` with
+                // the refresh token that would have fixed it sitting in the store
+                // (2026-09-16, three servers at once). A dead refresh token is erased
+                // on the way, and the row honestly reads `needs-auth`.
+                const token = await ensureMcpAccessToken(spec.url, { env: runtime.env });
+                if (token)
+                    probe = await probeMcpHttp(spec.url, { ...common, token });
+            }
+            if (probe.verdict === 'open') {
+                return {
+                    row: { ...base, status: 'ok', toolCount: probe.toolCount, ms: elapsed(started) },
+                    spec: identitySpec,
+                    tools: probe.tools ?? [],
+                };
+            }
+            if (probe.verdict === 'refused')
+                return failed('needs-auth');
+            if (probe.verdict === 'unreachable')
+                return failed('unreachable');
+            return failed('unusable');
+        }
+        const tools = await listStdioTools(entry, timeoutMs, runtime.env);
+        if (tools === null)
+            return failed('unreachable');
+        return {
+            row: { ...base, status: 'ok', toolCount: tools.length, ms: elapsed(started) },
+            spec: identitySpec,
+            tools,
+        };
+    }
+    catch {
+        return failed('unreachable');
+    }
+}
+function elapsed(started) {
+    return Date.now() - started;
+}
+/**
+ * Buys the judgement of every tool listed, and reads the verdicts back.
+ *
+ * Wired exactly like the proxy (`buildVerifier`): same cache, same identity,
+ * same name on the finding and same credential path, so what `scan` buys is
+ * what the next agent session finds, and vice versa. Without a credential
+ * nothing is asked and the row says `unverified`.
+ */
+export const judgeWithBackend = async (spec, listed, options, runtime, name) => {
+    if (runtime.env[`${PROXY_ENV_PREFIX}NO_VERIFY`] === '1')
+        return { verdict: 'unverified' };
+    const tools = listed.filter((tool) => typeof tool === 'object' && tool !== null && typeof tool.name === 'string');
+    // Resolved once by `runMcpScanCommand`; a direct caller gets it here.
+    const backend = runtime.backend !== undefined
+        ? runtime.backend
+        : await (runtime.resolveBackendConfigFn ?? resolveBackendConfig)({ env: runtime.env });
+    if (!backend)
+        return { verdict: 'unverified' };
+    const { verifier } = buildVerifier(spec, name ?? describeUpstream(spec), createNullLogger(), runtime.env, {
+        backend,
+        cache: runtime.cache,
+    });
+    try {
+        const outcome = await verifier.judgeAll(tools, {
+            timeoutMs: options.verifyTimeoutMs ?? DEFAULT_VERIFY_TIMEOUT_MS,
+        });
+        return rowFromOutcome(outcome);
+    }
+    catch {
+        return { verdict: 'unverified' };
+    }
+};
+/**
+ * The row, from the outcome — and from the DECISION, not the verdict alone.
+ *
+ * The flagged tools come from `outcome.tools`, which is scoped to the tools
+ * listed now; the cache file is never pruned and walking it would show a
+ * tool the server dropped last month. The user's override is read off the
+ * decision's rationale, the one place `vibedefend allow` / `deny` surfaces.
+ */
+export function rowFromOutcome(outcome) {
+    const flagged = [];
+    for (const tool of outcome.tools ?? []) {
+        if (tool.verdict === 'malicious' || tool.verdict === 'suspicious') {
+            flagged.push({ name: tool.name, verdict: tool.verdict, ...(tool.reason ? { reason: tool.reason } : {}) });
+        }
+    }
+    const judged = outcome.verdict === 'malicious' || outcome.verdict === 'suspicious' || outcome.verdict === 'ok'
+        ? outcome.verdict
+        : 'unverified';
+    const override = outcome.decision.rationale === 'allowed-by-user'
+        ? 'allow'
+        : outcome.decision.rationale === 'denied-by-user'
+            ? 'deny'
+            : undefined;
+    return {
+        verdict: override === 'allow' ? 'ok' : judged,
+        ...(flagged.length > 0 ? { flagged } : {}),
+        ...(override ? { override } : {}),
+    };
+}
+/**
+ * Spawns a stdio server, does the handshake, counts its tools and stops it.
+ *
+ * The proxy's own transport is not reused here: it exists to forward, and
+ * what this needs is a two-message conversation with a hard deadline and no
+ * session to keep. `null` means the server never got that far.
+ */
+async function listStdioTools(entry, timeoutMs, env) {
+    const spec = expandedSpecOf(entry, env).value;
+    if (spec.transport !== 'stdio')
+        return null;
+    void createNullLogger();
+    const plan = planSpawn(spec.command, spec.args, process.platform, env);
+    const child = spawn(plan.command, plan.args, {
+        env: upstreamEnvironment(env, spec.env),
+        cwd: spec.cwd,
+        stdio: ['pipe', 'pipe', 'ignore'],
+        windowsVerbatimArguments: plan.windowsVerbatimArguments,
+        shell: false,
+    });
+    return new Promise((resolve) => {
+        const framer = new LineFramer();
+        let settled = false;
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            try {
+                child.stdin.end();
+                child.kill();
+            }
+            catch {
+                /* already gone */
+            }
+            resolve(value);
+        };
+        const timer = setTimeout(() => finish(null), timeoutMs);
+        if (typeof timer.unref === 'function')
+            timer.unref();
+        child.once('error', () => finish(null));
+        child.once('exit', () => finish(null));
+        child.stdout?.on('data', (chunk) => {
+            for (const message of framer.push(chunk).messages) {
+                const typed = message;
+                if (typed.id === 1) {
+                    child.stdin.write(encodeMessage({ jsonrpc: '2.0', method: 'notifications/initialized' }));
+                    child.stdin.write(encodeMessage({ jsonrpc: '2.0', id: 2, method: 'tools/list' }));
+                    continue;
+                }
+                if (typed.id === 2) {
+                    const result = typed.result;
+                    finish(Array.isArray(result?.tools) ? result.tools : []);
+                }
+            }
+        });
+        child.stdin.write(encodeMessage({
+            jsonrpc: '2.0',
+            id: 1,
+            method: 'initialize',
+            params: {
+                protocolVersion: '2025-06-18',
+                capabilities: {},
+                clientInfo: { name: 'vibedefend-scan', version: '1.0.0' },
+            },
+        }));
+    });
+}
+function writeTable(rows) {
+    const width = Math.max(6, ...rows.map((row) => row.name.length));
+    log.step('MCP servers');
+    for (const row of rows) {
+        const name = row.name.padEnd(width);
+        const tools = row.toolCount === undefined ? '' : `${row.toolCount} tools`;
+        const verdict = row.status === 'ok' ? row.verdict : '';
+        const said = row.override === 'allow' ? '  [allowed by you]' : row.override === 'deny' ? '  [denied by you]' : '';
+        const line = `${name}  ${row.transport.padEnd(5)}  ${row.status.padEnd(11)}  ${tools.padEnd(9)}  ${verdict.padEnd(10)}  ${row.ms} ms${said}`;
+        if (row.verdict === 'malicious' || row.override === 'deny')
+            log.err(line);
+        else if (row.verdict === 'suspicious')
+            log.warn(line);
+        else if (row.status === 'ok')
+            log.ok(line);
+        else if (row.status === 'needs-auth')
+            log.warn(`${line}  → vibedefend connect ${row.name}`);
+        else
+            log.err(line);
+        for (const tool of row.flagged ?? []) {
+            const reason = tool.reason ? ` — ${tool.reason}` : '';
+            const detail = `    ${tool.verdict.padEnd(10)}  ${tool.name}${reason}`;
+            if (tool.verdict === 'malicious')
+                log.err(detail);
+            else
+                log.warn(detail);
+        }
+    }
+}
+//# sourceMappingURL=scan.js.map

package/dist/commands/mcp/scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.js","sourceRoot":"","sources":["../../../src/commands/mcp/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,UAAU,EAAuB,MAAM,4BAA4B,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAqB,MAAM,yBAAyB,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,mCAAmC,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAsB,MAAM,8BAA8B,CAAC;AACzG,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAoB,MAAM,2BAA2B,CAAC;AAEpF,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAEnD,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AA4FrC,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC;AACzB,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC;AAC9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAE5B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,mFAAmF;AACnF,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAC1C;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAuB,EACvB,OAAuB;IAEvB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAChD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAE7C,IAAI,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,CAAC,KAAK,CACV,uCAAuC,OAAO,CAAC,IAAI,aAAa,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,KAAK,CAC3H,CAAC;YACF,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,OAAO,CAAC,IAAI;YAAE,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;;YAC3E,GAAG,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;QAC3F,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEvD,0EAA0E;IAC1E,uEAAuE;IACvE,2BAA2B;IAC3B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,IAAI,gBAAgB,CAAC;IACjD,MAAM,OAAO,CACX,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,EACrD,iBAAiB,EACjB,KAAK,EAAE,MAAM,EAAE,EAAE;QACf,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC,CACF,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAEhD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAED,kEAAkE;IAClE,0EAA0E;IAC1E,+CAA+C;IAC/C,OAAO,IAAI,CAAC,IAAI,CACd,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,MAAM,KAAK,aAAa;QAC5B,GAAG,CAAC,MAAM,KAAK,UAAU;QACzB,GAAG,CAAC,OAAO,KAAK,WAAW;QAC3B,GAAG,CAAC,QAAQ,KAAK,MAAM,CAC1B;QACC,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,OAAO,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,OAAuB,EAAE,MAA6B;IAClF,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,WAAW,CAAC,KAAK,GAAG;QAAE,OAAO,OAAO,CAAC;IACzF,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,KAAK,SAAS;QAC3B,CAAC,CAAC,OAAO,CAAC,OAAO;QACjB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,sBAAsB,IAAI,oBAAoB,CAAC,CAAC;YAC7D,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,iEAAiE;YACjE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,IAAI,CAAC;SACjE,CAAC,CAAC;IACT,OAAO;QACL,GAAG,OAAO;QACV,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,qBAAqB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAWD,KAAK,UAAU,QAAQ,CACrB,KAAoB,EACpB,OAAuB,EACvB,OAAuB;IAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,YAAqB,EAAE,CAAC;IAE9F,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,0EAA0E;IAC1E,oEAAoE;IACpE,mEAAmE;IACnE,wBAAwB;IACxB,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAU,EAAE,CAAC,CAAC;QAC9C,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;QAC9C,IAAI,EAAE,YAAY;KACnB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YACtD,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM;gBAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG;gBACb,SAAS;gBACT,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,UAAU,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;aAC7D,CAAC;YAEF,oEAAoE;YACpE,qEAAqE;YACrE,iEAAiE;YACjE,YAAY;YACZ,IAAI,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAChC,oEAAoE;gBACpE,qEAAqE;gBACrE,kEAAkE;gBAClE,sEAAsE;gBACtE,uDAAuD;gBACvD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBACzE,IAAI,KAAK;oBAAE,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;gBAC7B,OAAO;oBACL,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;oBAChF,IAAI,EAAE,YAAY;oBAClB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;iBACzB,CAAC;YACJ,CAAC;YACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,OAAO,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7D,IAAI,KAAK,CAAC,OAAO,KAAK,aAAa;gBAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;YAClE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAClE,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;QACjD,OAAO;YACL,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC7E,IAAI,EAAE,YAAY;YAClB,KAAK;SACN,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAY,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;IACtF,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,WAAW,CAAC,KAAK,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC1F,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CACzB,CAAC,IAAI,EAAsB,EAAE,CAC3B,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,OAAQ,IAA2B,CAAC,IAAI,KAAK,QAAQ,CACrG,CAAC;IACF,sEAAsE;IACtE,MAAM,OAAO,GACX,OAAO,CAAC,OAAO,KAAK,SAAS;QAC3B,CAAC,CAAC,OAAO,CAAC,OAAO;QACjB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,sBAAsB,IAAI,oBAAoB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAE/C,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE;QACxG,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE;YAC7C,SAAS,EAAE,OAAO,CAAC,eAAe,IAAI,yBAAyB;SAChE,CAAC,CAAC;QACH,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IACnC,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,OAA4B;IACzD,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW,IAAI,IAAI,CAAC,OAAO,KAAK,YAAY,EAAE,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GACV,OAAO,CAAC,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,OAAO,KAAK,YAAY,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAC7F,CAAC,CAAC,OAAO,CAAC,OAAO;QACjB,CAAC,CAAC,YAAY,CAAC;IACnB,MAAM,QAAQ,GACZ,OAAO,CAAC,QAAQ,CAAC,SAAS,KAAK,iBAAiB;QAC9C,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,KAAK,gBAAgB;YAC/C,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,SAAS,CAAC;IAClB,OAAO;QACL,OAAO,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAC7C,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAC3B,KAAoB,EACpB,SAAiB,EACjB,GAAsB;IAEtB,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC;IAC9C,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC5C,KAAK,gBAAgB,EAAE,CAAC;IAExB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;QAC3C,GAAG,EAAE,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;QACvC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;QACjC,wBAAwB,EAAE,IAAI,CAAC,wBAAwB;QACvD,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAChC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,KAAuB,EAAQ,EAAE;YAC/C,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,CAAC;gBACH,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;gBAClB,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;QACxD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAErD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAEvC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,OAAyB,CAAC;gBACxC,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;oBACnB,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC;oBAC1F,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;oBAClF,SAAS;gBACX,CAAC;gBACD,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;oBACnB,MAAM,MAAM,GAAG,KAAK,CAAC,MAA2C,CAAC;oBACjE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,KAAK,CAAC,KAAK,CACf,aAAa,CAAC;YACZ,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,CAAC;YACL,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE;gBACN,eAAe,EAAE,YAAY;gBAC7B,YAAY,EAAE,EAAE;gBAChB,UAAU,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE;aAC1D;SACF,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,IAAe;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,SAAS,QAAQ,CAAC;QAC1E,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;QAClH,MAAM,IAAI,GAAG,GAAG,IAAI,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,GAAG,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC;QAC7I,IAAI,GAAG,CAAC,OAAO,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aACrE,IAAI,GAAG,CAAC,OAAO,KAAK,YAAY;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aACjD,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI;YAAE,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;aACtC,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,0BAA0B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;;YACvF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YACrC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,GAAG,MAAM,EAAE,CAAC;YACvE,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW;gBAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;;gBAC7C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC"}