@cybedefend/vibedefend 1.5.0 → 1.6.0

package/dist/mcp/verify/api.js

@@ -0,0 +1,475 @@
+/**
+ * Client for the ORG-SCOPED backend routes of the MCP verifier.
+ *
+ * The response envelopes are read from the real gateway controllers
+ * (`gateway-service/src/modules/mcp-verify/mcp-org-verify.controller.ts`,
+ * `organization/mcp-org-policy.controller.ts`), not inferred from a spec:
+ *
+ *   POST /mcp/organization/:id/servers/check -> `{ success, data: { policy, results }, message }`
+ *   POST /mcp/organization/:id/tools/verify  -> `{ success, data: { policy, verdicts }, message }`
+ *   GET  /mcp/organization/:id/policy        -> `{ success, data: { mode, strictIssuer }, message }`
+ *
+ * The organization is in the PATH, so the backend checks membership before
+ * anything else, and the organization's policy is applied SERVER-SIDE: every
+ * verdict and every result carries the `action` the client executes, and the
+ * envelope carries the `policy` it was decided under. The deprecated
+ * user-scoped routes (`/mcp/tools/verify`, `/mcp/servers/check`) are never
+ * called by this binary: they return a verdict without an action, and a
+ * client that turned a verdict into a decision by reading a mode out of its
+ * own environment is exactly what the org-scoped line removes.
+ *
+ * Invariants held by this module:
+ *  - `known: false` on a tool verdict means "not verified", never "nothing to
+ *    report". It is carried as an explicit boolean all the way to the caller.
+ *  - An `action` this binary cannot read — absent, or out of vocabulary — is
+ *    `pending`, NEVER `allow`. Nothing opens a door nobody decided to open.
+ *  - A response without a readable `policy` throws: the deprecated envelope
+ *    is not this contract, and reading it as one would decide on nothing.
+ *  - An untrusted `apiBase` is refused BEFORE any network call
+ *    (`isTrustedApiBase`, applied on the real request path of both functions).
+ *  - A `401` triggers EXACTLY one token refresh and one retry, never a loop
+ *    (`requestWithAuthRetry`).
+ *  - The backend refuses more than 500 tools / 200 servers per request
+ *    (`VerifyToolsBodyDto`, `CheckMcpServersBodyDto` on the gateway side).
+ *    This client splits into batches instead of letting the caller hit
+ *    `INVALID_ARGUMENT`, and declares the split through `onBatchSplit`.
+ *  - A response missing an expected field (`data.results`, `data.verdicts`)
+ *    throws, never a silence that would read as "empty, nothing to report".
+ *  - No token ever leaves this module inside an error message.
+ */
+import { resolveTokenWithRefresh } from '../../hooks/runtime/resolve.js';
+import { DIGEST_VERSION } from './digest.js';
+import { isContractErrorStatus } from './contract-errors.js';
+import { isPolicyMode, isServerAction } from './policy.js';
+import { isTrustedApiBase, } from '../../hooks/runtime/trusted-api-base.js';
+const DEFAULT_TIMEOUT_MS = 10_000;
+// ─── Failure taxonomy ───────────────────────────────────────────────────────
+/**
+ * Any non-2xx from the backend.
+ *
+ * Carries the STATUS and the ROUTE, because the caller's decision depends on
+ * both and re-parsing a message to recover them is how that decision starts
+ * being made on prose.
+ */
+export class McpBackendError extends Error {
+    route;
+    status;
+    constructor(route, status, message) {
+        super(message ?? `/mcp/organization/:organizationId/${route} failed with HTTP ${status}`);
+        this.route = route;
+        this.status = status;
+        this.name = 'McpBackendError';
+    }
+}
+/**
+ * The backend ANSWERED, and refused what we sent: 400, 409, 422 — and, on the
+ * org-scoped routes, 403 (not a member of that organization) and 404 (no such
+ * organization).
+ *
+ * ⚠️ This is not an outage, and the difference is the whole point. An outage
+ * is fail-open — the tool list goes through, the verdict is `pending`, the
+ * agent is told nothing, because the user can do nothing about it. A contract
+ * refusal filed the same way says "we will retry and it will work", when
+ * retrying cannot help: the request that was refused is the request we would
+ * send again.
+ *
+ * Left as `pending`, a client that has stopped verifying ANYTHING looks
+ * exactly like a client waiting on a slow backend — for as long as nobody
+ * looks.
+ */
+export class McpContractError extends McpBackendError {
+    constructor(route, status, message) {
+        super(route, status, message);
+        this.name = 'McpContractError';
+    }
+}
+/**
+ * `409 DIGEST_VERSION_UNSUPPORTED` — the backend cannot compute the digest
+ * formula this binary uses.
+ *
+ * Its own class because its remedy is its own: every digest we send is
+ * unmatchable, so nothing can be verified until one side is upgraded, and the
+ * `supported` list is the only actionable thing in the whole exchange.
+ */
+export class DigestVersionUnsupportedError extends McpContractError {
+    code;
+    supported;
+    constructor(route, code, supported, message) {
+        super(route, 409, message);
+        this.code = code;
+        this.supported = supported;
+        this.name = 'DigestVersionUnsupportedError';
+    }
+}
+/** `{ error: { code, supported } }`, when the backend sent one. */
+function errorEnvelope(body) {
+    if (!body || typeof body !== 'object')
+        return {};
+    const error = body.error;
+    if (!error || typeof error !== 'object')
+        return {};
+    const shape = error;
+    return {
+        code: typeof shape.code === 'string' ? shape.code : undefined,
+        supported: Array.isArray(shape.supported)
+            ? shape.supported.filter((value) => typeof value === 'string')
+            : undefined,
+    };
+}
+/**
+ * Turns a non-2xx into the right kind of error.
+ *
+ * The body is read ONLY to name the refusal. A body that is not JSON, or that
+ * carries no `error.code`, still produces a contract error when the status
+ * says so: a server being terse does not make its refusal an outage.
+ *
+ * ⚠️ Nothing from the request — token, headers, payload — goes into the
+ * message. A contract error is precisely what ends up in a log.
+ */
+async function backendError(res, route, requestLabel) {
+    const label = `${requestLabel} failed with HTTP ${res.status}`;
+    if (!isContractErrorStatus(res.status))
+        return new McpBackendError(route, res.status, label);
+    let body;
+    try {
+        body = await res.json();
+    }
+    catch {
+        body = undefined;
+    }
+    const { code, supported } = errorEnvelope(body);
+    if (res.status === 409 && code === 'DIGEST_VERSION_UNSUPPORTED') {
+        const list = supported ?? [];
+        return new DigestVersionUnsupportedError(route, code, list, `${label}: this backend cannot compute digest version "${DIGEST_VERSION}"` +
+            (list.length > 0 ? `; it supports ${list.join(', ')}` : ''));
+    }
+    return new McpContractError(route, res.status, code ? `${label} (${code})` : label);
+}
+/**
+ * Mirrors `VerifyToolsBodyDto` (`ArrayMaxSize(500)`) on the gateway. A request
+ * over this bound is refused as `INVALID_ARGUMENT`; we split client-side.
+ */
+export const MAX_TOOLS_PER_REQUEST = 500;
+/**
+ * Mirrors `CheckMcpServersBodyDto`'s own `MAX_SERVERS_PER_REQUEST` (200), a
+ * different bound than {@link MAX_TOOLS_PER_REQUEST}.
+ */
+export const MAX_SERVERS_PER_REQUEST = 200;
+/**
+ * Gate every outbound call behind the same origin allowlist that protects the
+ * hooks (`isTrustedApiBase`, `src/hooks/runtime/trusted-api-base.ts`). Throws,
+ * never a silent `false`-shaped result: a rejected apiBase has no valid
+ * representation in any of the return types below, so failing the promise is
+ * the only way to guarantee it cannot be mistaken for "checked, nothing to
+ * report".
+ */
+/**
+ * We refused to call, and the backend has nothing to do with it.
+ *
+ * ⚠️ Its own class because the caller was filing it as "backend unreachable,
+ * fail-open" — the same words an outage produces. A user whose region is
+ * mis-declared then goes and checks their network, their VPN and the
+ * backend's health, for a local configuration problem with a one-line fix.
+ * The direction is right (fail-open either way); the DIAGNOSIS was wrong, and
+ * a wrong diagnosis costs more than a missing one.
+ */
+export class UntrustedApiBaseError extends Error {
+    apiBase;
+    constructor(apiBase) {
+        super(`refusing to call the CybeDefend gateway: the origin of "${apiBase}" is not in the ` +
+            'trusted allowlist. Declare it in ~/.cybedefend/regions.json, which is the ' +
+            'documented escape hatch for an internal or local cluster.');
+        this.apiBase = apiBase;
+        this.name = 'UntrustedApiBaseError';
+    }
+}
+function assertTrustedApiBase(apiBase, opts) {
+    if (!isTrustedApiBase(apiBase, opts.trustDeps)) {
+        throw new UntrustedApiBaseError(apiBase);
+    }
+}
+/**
+ * Run `attempt(ctx.token)`. On a `401`, ask {@link McpApiOpts.resolveTokenFn}
+ * for a fresh token and retry EXACTLY ONCE with it, never a loop. If no
+ * fresher token is available, or the retry ALSO comes back `401`, the second
+ * response (or the first, if there was no retry) is returned as-is: the
+ * caller's own `!res.ok` handling turns it into a thrown error, same as any
+ * other non-2xx status.
+ */
+async function requestWithAuthRetry(ctx, opts, attempt) {
+    const res = await attempt(ctx.token);
+    if (res.status !== 401)
+        return res;
+    const resolveTokenFn = opts.resolveTokenFn ?? resolveTokenWithRefresh;
+    const refreshed = await resolveTokenFn(ctx.mcpName);
+    if (!refreshed)
+        return res;
+    return attempt(refreshed); // the ONE retry; its outcome is final either way
+}
+/** Split `items` into batches of at most `size`. Never yields an empty batch. */
+function chunk(items, size) {
+    if (items.length === 0)
+        return [];
+    if (items.length <= size)
+        return [items.slice()];
+    const batches = [];
+    for (let i = 0; i < items.length; i += size)
+        batches.push(items.slice(i, i + size));
+    return batches;
+}
+/**
+ * A silent split would be indistinguishable from a machine that never needed
+ * one, so the split is always declared, through `opts.onBatchSplit` rather
+ * than a direct write to `stderr`.
+ */
+function declareSplit(route, total, batches, cap, opts) {
+    opts.onBatchSplit?.(route, total, batches, cap);
+}
+async function parseJsonBody(res, label) {
+    try {
+        return await res.json();
+    }
+    catch {
+        throw new Error(`${label}: response body is not valid JSON`);
+    }
+}
+/**
+ * Unwrap the gateway's `{ success, data, message }` envelope down to `data`,
+ * and ONLY `data`. `body` and `body.data` are both rejected as insufficient.
+ */
+function unwrapEnvelope(body, label) {
+    if (!body || typeof body !== 'object') {
+        throw new Error(`${label}: response is not a JSON object`);
+    }
+    const root = body;
+    if (root.success !== true) {
+        throw new Error(`${label}: response missing \`success: true\``);
+    }
+    const data = root.data;
+    if (!data || typeof data !== 'object') {
+        throw new Error(`${label}: response missing \`data\``);
+    }
+    return data;
+}
+/** A named field that MUST be an array: `data.results` / `data.verdicts`. */
+function extractArray(data, field, label) {
+    const value = data[field];
+    if (!Array.isArray(value)) {
+        throw new Error(`${label}: response missing \`data.${field}\` array`);
+    }
+    return value;
+}
+/**
+ * `{ mode, strictIssuer }`, or a throw. Strict on purpose: a policy is what
+ * every action in the response was decided under, and a response without
+ * one is the deprecated envelope — reading it as this contract would decide
+ * on nothing. A mode out of vocabulary is refused rather than widened.
+ */
+function parseOrgPolicy(raw, label) {
+    const shape = raw && typeof raw === 'object' ? raw : undefined;
+    if (!shape || !isPolicyMode(shape.mode) || typeof shape.strictIssuer !== 'boolean') {
+        throw new Error(`${label}: response missing a readable \`policy\` ({ mode, strictIssuer })`);
+    }
+    return { mode: shape.mode, strictIssuer: shape.strictIssuer };
+}
+/**
+ * The action to execute, or `pending` when the backend sent none we can read.
+ * `pending` and not `allow`: an unreadable decision is no decision.
+ */
+function parseAction(raw) {
+    return isServerAction(raw) ? raw : 'pending';
+}
+/** The org-scoped path of a route. The id goes in the PATH, encoded. */
+function orgRoute(ctx, suffix) {
+    return `${ctx.apiBase}/mcp/organization/${encodeURIComponent(ctx.organizationId)}/${suffix}`;
+}
+// ═══════════════════════════════════════════════════════════════════════════
+// POST /mcp/organization/:organizationId/servers/check
+// ═══════════════════════════════════════════════════════════════════════════
+const SERVERS_CHECK_LABEL = 'POST /mcp/organization/:organizationId/servers/check';
+function toMcpServerCheckInput(raw) {
+    const r = (raw ?? {});
+    return {
+        url: typeof r.url === 'string' ? r.url : undefined,
+        purl: typeof r.purl === 'string' ? r.purl : undefined,
+    };
+}
+function toAdvisory(raw) {
+    const a = (raw ?? {});
+    return {
+        id: typeof a.id === 'string' ? a.id : '',
+        category: typeof a.category === 'string' ? a.category : '',
+        severity: typeof a.severity === 'string' ? a.severity : '',
+        summary: typeof a.summary === 'string' ? a.summary : '',
+        source: typeof a.source === 'string' ? a.source : '',
+    };
+}
+function toServerCheckResult(raw) {
+    const r = (raw ?? {});
+    const advisories = Array.isArray(r.advisories) ? r.advisories : [];
+    return {
+        input: toMcpServerCheckInput(r.input),
+        advisories: advisories.map(toAdvisory),
+        mirrored: Boolean(r.mirrored),
+        action: parseAction(r.action),
+    };
+}
+async function checkMcpServersOnce(ctx, servers, opts) {
+    const f = opts.fetchImpl ?? globalThis.fetch;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const url = orgRoute(ctx, 'servers/check');
+    const attempt = (token) => f(url, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ digestVersion: DIGEST_VERSION, servers }),
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    const res = await requestWithAuthRetry(ctx, opts, attempt);
+    if (!res.ok) {
+        throw await backendError(res, 'servers/check', SERVERS_CHECK_LABEL);
+    }
+    const body = await parseJsonBody(res, SERVERS_CHECK_LABEL);
+    const data = unwrapEnvelope(body, SERVERS_CHECK_LABEL);
+    const policy = parseOrgPolicy(data.policy, SERVERS_CHECK_LABEL);
+    const results = extractArray(data, 'results', SERVERS_CHECK_LABEL);
+    return { policy, results: results.map(toServerCheckResult) };
+}
+/**
+ * Checks a list of MCP server coordinates against the backend's advisory
+ * lookup + registry mirror.
+ *
+ * The gateway refuses more than {@link MAX_SERVERS_PER_REQUEST} servers in a
+ * single request (`CheckMcpServersBodyDto`): larger inputs are split into
+ * sequential batches here and the split is declared through `onBatchSplit`.
+ */
+export async function checkMcpServers(ctx, servers, opts = {}) {
+    assertTrustedApiBase(ctx.apiBase, opts);
+    if (servers.length === 0)
+        return { policy: null, results: [] };
+    const batches = chunk(servers, MAX_SERVERS_PER_REQUEST);
+    if (batches.length > 1) {
+        declareSplit(SERVERS_CHECK_LABEL, servers.length, batches.length, MAX_SERVERS_PER_REQUEST, opts);
+    }
+    // One organization, one policy: every batch answers with the same one, and
+    // the last is as fresh as any.
+    let policy = null;
+    const results = [];
+    for (const batch of batches) {
+        const answer = await checkMcpServersOnce(ctx, batch, opts);
+        policy = answer.policy;
+        results.push(...answer.results);
+    }
+    return { policy, results };
+}
+// ═══════════════════════════════════════════════════════════════════════════
+// POST /mcp/organization/:organizationId/tools/verify
+// ═══════════════════════════════════════════════════════════════════════════
+const TOOLS_VERIFY_LABEL = 'POST /mcp/organization/:organizationId/tools/verify';
+/**
+ * CLOSED vocabulary of the tool verdicts THIS client knows how to interpret.
+ *
+ * `verdict` stays typed `string` in {@link ToolVerdict}: the backend is free
+ * to emit a value this binary does not know, and that is precisely the case
+ * that must be NAMED rather than collapsed. The list below says what this
+ * client can DO, not what the backend is allowed to say.
+ */
+export const KNOWN_TOOL_VERDICTS = ['CLEAN', 'SUSPICIOUS', 'MALICIOUS'];
+/** `true` only for a verdict this binary knows how to interpret. */
+export function isKnownToolVerdict(verdict) {
+    return KNOWN_TOOL_VERDICTS.includes(verdict);
+}
+function toToolVerdict(raw) {
+    const v = (raw ?? {});
+    return {
+        digest: typeof v.digest === 'string' ? v.digest : '',
+        known: Boolean(v.known),
+        verdict: typeof v.verdict === 'string' ? v.verdict : '',
+        category: typeof v.category === 'string' ? v.category : '',
+        severity: typeof v.severity === 'string' ? v.severity : '',
+        reason: typeof v.reason === 'string' ? v.reason : '',
+        action: parseAction(v.action),
+    };
+}
+async function verifyMcpToolsOnce(ctx, tools, opts) {
+    const f = opts.fetchImpl ?? globalThis.fetch;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const url = orgRoute(ctx, 'tools/verify');
+    const attempt = (token) => f(url, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${token}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ digestVersion: DIGEST_VERSION, tools }),
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    const res = await requestWithAuthRetry(ctx, opts, attempt);
+    if (!res.ok) {
+        throw await backendError(res, 'tools/verify', TOOLS_VERIFY_LABEL);
+    }
+    const body = await parseJsonBody(res, TOOLS_VERIFY_LABEL);
+    const data = unwrapEnvelope(body, TOOLS_VERIFY_LABEL);
+    const policy = parseOrgPolicy(data.policy, TOOLS_VERIFY_LABEL);
+    const verdicts = extractArray(data, 'verdicts', TOOLS_VERIFY_LABEL);
+    return { policy, verdicts: verdicts.map(toToolVerdict) };
+}
+/**
+ * Verifies a list of MCP tool submissions by digest, judging the ones that
+ * carry a `definition`.
+ *
+ * The gateway refuses more than {@link MAX_TOOLS_PER_REQUEST} tools in a
+ * single request (`VerifyToolsBodyDto`, `ArrayMaxSize(500)`): larger inputs
+ * are split into sequential batches here and the split is declared through
+ * `onBatchSplit`.
+ */
+export async function verifyMcpTools(ctx, submissions, opts = {}) {
+    assertTrustedApiBase(ctx.apiBase, opts);
+    if (submissions.length === 0)
+        return { policy: null, verdicts: [] };
+    const batches = chunk(submissions, MAX_TOOLS_PER_REQUEST);
+    if (batches.length > 1) {
+        declareSplit(TOOLS_VERIFY_LABEL, submissions.length, batches.length, MAX_TOOLS_PER_REQUEST, opts);
+    }
+    let policy = null;
+    const verdicts = [];
+    for (const batch of batches) {
+        const answer = await verifyMcpToolsOnce(ctx, batch, opts);
+        policy = answer.policy;
+        verdicts.push(...answer.verdicts);
+    }
+    return { policy, verdicts };
+}
+// ═══════════════════════════════════════════════════════════════════════════
+// GET /mcp/organization/:organizationId/policy
+// ═══════════════════════════════════════════════════════════════════════════
+const POLICY_LABEL = 'GET /mcp/organization/:organizationId/policy';
+/**
+ * Reads the organization's policy on its own.
+ *
+ * Not needed to APPLY it — every verify/check response already carries the
+ * policy its actions were decided under — but it is how the policy is shown
+ * (`vibedefend status`, `vibedefend org`), how `connect` learns
+ * `strictIssuer` before any OAuth discovery, and how a verifier refreshes
+ * what it knows before a decision that only the cache will answer.
+ */
+export async function getOrgPolicy(ctx, opts = {}) {
+    assertTrustedApiBase(ctx.apiBase, opts);
+    const f = opts.fetchImpl ?? globalThis.fetch;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const url = orgRoute(ctx, 'policy');
+    const attempt = (token) => f(url, {
+        method: 'GET',
+        headers: { Authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    const res = await requestWithAuthRetry(ctx, opts, attempt);
+    if (!res.ok) {
+        throw await backendError(res, 'policy', POLICY_LABEL);
+    }
+    const body = await parseJsonBody(res, POLICY_LABEL);
+    return parseOrgPolicy(unwrapEnvelope(body, POLICY_LABEL), POLICY_LABEL);
+}
+//# sourceMappingURL=api.js.map

package/dist/mcp/verify/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../../../src/mcp/verify/api.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAsB,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAqC,MAAM,aAAa,CAAC;AAC9F,OAAO,EACL,gBAAgB,GAEjB,MAAM,yCAAyC,CAAC;AAEjD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAE7B;IACA;IAFX,YACW,KAAoB,EACpB,MAAc,EACvB,OAAgB;QAEhB,KAAK,CAAC,OAAO,IAAI,qCAAqC,KAAK,qBAAqB,MAAM,EAAE,CAAC,CAAC;QAJjF,UAAK,GAAL,KAAK,CAAe;QACpB,WAAM,GAAN,MAAM,CAAQ;QAIvB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IACnD,YAAY,KAAoB,EAAE,MAAc,EAAE,OAAgB;QAChE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,6BAA8B,SAAQ,gBAAgB;IAGtD;IACA;IAHX,YACE,KAAoB,EACX,IAAY,EACZ,SAAmB,EAC5B,OAAgB;QAEhB,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAJlB,SAAI,GAAJ,IAAI,CAAQ;QACZ,cAAS,GAAT,SAAS,CAAU;QAI5B,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAED,mEAAmE;AACnE,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,KAAK,GAAI,IAA4B,CAAC,KAAK,CAAC;IAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,KAAgD,CAAC;IAC/D,OAAO;QACL,IAAI,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC7D,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;YACvC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAC/E,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,YAAY,CAAC,GAAa,EAAE,KAAoB,EAAE,YAAoB;IACnF,MAAM,KAAK,GAAG,GAAG,YAAY,qBAAqB,GAAG,CAAC,MAAM,EAAE,CAAC;IAC/D,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAE7F,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,4BAA4B,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,SAAS,IAAI,EAAE,CAAC;QAC7B,OAAO,IAAI,6BAA6B,CACtC,KAAK,EACL,IAAI,EACJ,IAAI,EACJ,GAAG,KAAK,iDAAiD,cAAc,GAAG;YACxE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAEzC;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AA8C3C;;;;;;;GAOG;AACH;;;;;;;;;GASG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACzB;IAArB,YAAqB,OAAe;QAClC,KAAK,CACH,2DAA2D,OAAO,kBAAkB;YAClF,4EAA4E;YAC5E,2DAA2D,CAC9D,CAAC;QALiB,YAAO,GAAP,OAAO,CAAQ;QAMlC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,SAAS,oBAAoB,CAAC,OAAe,EAAE,IAAgB;IAC7D,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB,CACjC,GAAyC,EACzC,IAAgB,EAChB,OAA6C;IAE7C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IAEnC,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,uBAAuB,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,SAAS;QAAE,OAAO,GAAG,CAAC;IAE3B,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,iDAAiD;AAC9E,CAAC;AAED,iFAAiF;AACjF,SAAS,KAAK,CAAI,KAAmB,EAAE,IAAY;IACjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI;QAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,OAAO,GAAU,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,IAAI;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACpF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa,EAAE,OAAe,EAAE,GAAW,EAAE,IAAgB;IAChG,IAAI,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAa,EAAE,KAAa;IACvD,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mCAAmC,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAa,EAAE,KAAa;IAClD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,iCAAiC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,IAA+B,CAAC;IAC7C,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CAAC,IAA6B,EAAE,KAAa,EAAE,KAAa;IAC/E,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,6BAA6B,KAAK,UAAU,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAY,EAAE,KAAa;IACjD,MAAM,KAAK,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAE,GAA+B,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,mEAAmE,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAY;IAC/B,OAAO,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,wEAAwE;AACxE,SAAS,QAAQ,CAAC,GAAkD,EAAE,MAAc;IAClF,OAAO,GAAG,GAAG,CAAC,OAAO,qBAAqB,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,MAAM,EAAE,CAAC;AAC/F,CAAC;AAED,8EAA8E;AAC9E,uDAAuD;AACvD,8EAA8E;AAE9E,MAAM,mBAAmB,GAAG,sDAAsD,CAAC;AAsCnF,SAAS,qBAAqB,CAAC,GAAY;IACzC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IACjD,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;QAClD,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IACjD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QACxC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAC1D,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAC1D,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACvD,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;KACrD,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IACjD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO;QACL,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC;QACrC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;QACtC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7B,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,GAAc,EACd,OAAuC,EACvC,IAAgB;IAEhB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAE3C,MAAM,OAAO,GAAG,CAAC,KAAa,EAAqB,EAAE,CACnD,CAAC,CAAC,GAAG,EAAE;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;QAChE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IAEL,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,YAAY,CAAC,GAAG,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACnE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAc,EACd,OAAuC,EACvC,OAAmB,EAAE;IAErB,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAE/D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,YAAY,CAAC,mBAAmB,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,uBAAuB,EAAE,IAAI,CAAC,CAAC;IACnG,CAAC;IAED,2EAA2E;IAC3E,+BAA+B;IAC/B,IAAI,MAAM,GAAqB,IAAI,CAAC;IACpC,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAE9E,MAAM,kBAAkB,GAAG,qDAAqD,CAAC;AAqBjF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,WAAW,CAAU,CAAC;AAGjF,oEAAoE;AACpE,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAQ,mBAAyC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC;AAyBD,SAAS,aAAa,CAAC,GAAY;IACjC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IACjD,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACpD,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QACvB,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACvD,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAC1D,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAC1D,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACpD,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,GAAc,EACd,KAAwC,EACxC,IAAgB;IAEhB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAE1C,MAAM,OAAO,GAAG,CAAC,KAAa,EAAqB,EAAE,CACnD,CAAC,CAAC,GAAG,EAAE;QACL,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;QAC9D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IAEL,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,EAAE,kBAAkB,CAAC,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAC3D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAc,EACd,WAA8C,EAC9C,OAAmB,EAAE;IAErB,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAEpE,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,YAAY,CAAC,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,qBAAqB,EAAE,IAAI,CAAC,CAAC;IACpG,CAAC;IAED,IAAI,MAAM,GAAqB,IAAI,CAAC;IACpC,MAAM,QAAQ,GAAkB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QAC1D,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAE9E,MAAM,YAAY,GAAG,8CAA8C,CAAC;AAEpE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAc,EAAE,OAAmB,EAAE;IACtE,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACvD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEpC,MAAM,OAAO,GAAG,CAAC,KAAa,EAAqB,EAAE,CACnD,CAAC,CAAC,GAAG,EAAE;QACL,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;KACvC,CAAC,CAAC;IAEL,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACpD,OAAO,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,YAAY,CAAC,CAAC;AAC1E,CAAC"}

package/dist/mcp/verify/backend.js

@@ -0,0 +1,143 @@
+/**
+ * Which CybeDefend backend this machine talks to, with what — and AS WHICH
+ * ORGANIZATION.
+ *
+ * The region lives in `~/.cybedefend/runtime-config.json`, written by
+ * `vibedefend install`. A machine that has never been installed has no
+ * region, no token, and therefore no verification — which is a supported
+ * state, not a failure: the proxy still forwards everything, and the log says
+ * why nothing was verified.
+ *
+ * The organization lives in the same file (`organization`), selected at
+ * `vibedefend login`, with `vibedefend org`, or here, lazily: the verification
+ * routes are org-scoped, most accounts belong to exactly one organization,
+ * and asking those users to pick would be a prompt with one answer. An
+ * account that belongs to several must choose explicitly, and until it does
+ * there is no backend to talk to — unverified, never an allow.
+ *
+ * `VIBEDEFEND_MCP_API_BASE` overrides the region's `apiBase`. It is how the
+ * tests point the proxy at a local mock, and it goes through the same origin
+ * allowlist as everything else in `api.ts` — a URL that is not trusted is
+ * refused before any request leaves, the organization listing included.
+ */
+import { listOrganizations } from '../../api/projects.js';
+import { REGIONS } from '../../config.js';
+import { loadRuntimeConfig, saveRuntimeOrganization } from '../../hooks/runtime/config.js';
+import { isTrustedApiBase } from '../../hooks/runtime/trusted-api-base.js';
+import { PROXY_ENV_PREFIX } from '../proxy/paths.js';
+import { resolveVerifyToken } from './token.js';
+import { resolveVerifyTokenWithRefresh } from './token-refresh.js';
+/** The region the installer recorded, or the EU default. */
+export function activeRegion(deps = {}) {
+    try {
+        const runtime = (deps.loadRuntimeConfigFn ?? loadRuntimeConfig)();
+        const id = runtime?.region?.id;
+        const found = id ? REGIONS.find((region) => region.id === id) : undefined;
+        if (found)
+            return found;
+        // A custom region carries its own apiBase; it is honoured as it stands.
+        const custom = runtime?.region;
+        if (custom?.apiBase && custom.mcpName)
+            return custom;
+    }
+    catch {
+        /* no runtime config: fall through to the default */
+    }
+    return REGIONS[0];
+}
+/** The organization on file, without any network call. */
+export function persistedOrganization(deps = {}) {
+    try {
+        const runtime = (deps.loadRuntimeConfigFn ?? loadRuntimeConfig)();
+        const organization = runtime?.organization;
+        if (organization && typeof organization.id === 'string' && organization.id !== '') {
+            return { id: organization.id, name: typeof organization.name === 'string' ? organization.name : '' };
+        }
+    }
+    catch {
+        /* no runtime config, or an unreadable one */
+    }
+    return null;
+}
+/**
+ * Everything the verifier needs to reach the backend, or `null` when there is
+ * nothing to reach it with — no token, or no organization to speak for.
+ */
+export async function resolveBackendConfig(deps = {}) {
+    const env = deps.env ?? process.env;
+    const region = activeRegion(deps);
+    const apiBase = env[`${PROXY_ENV_PREFIX}API_BASE`]?.trim() || region.apiBase;
+    // Renewed if it expired: a human is waiting for this answer, and a stale
+    // token here turned a whole scan `unverified` (2026-09-16).
+    const token = await (deps.resolveTokenFn ?? resolveVerifyTokenWithRefresh)(region.mcpName, { env });
+    if (!token)
+        return null;
+    const organizationId = await resolveOrganizationId(apiBase, token, deps);
+    if (!organizationId)
+        return null;
+    return { apiBase, mcpName: region.mcpName, token, organizationId };
+}
+/**
+ * What the PROXY builds its verifier with — synchronously, and without a
+ * single network call.
+ *
+ * Section 0: nothing reaches CybeDefend before `initialize` is answered, and
+ * the verifier is wired before the proxy starts. So when no organization is
+ * persisted, the id is left to `resolveOrganizationId`, a thunk the verifier
+ * runs at its FIRST backend call — after `initialize`, on the `tools/list`
+ * path, where a network call already belongs. `scan`, `connect` and `org`
+ * are typed by a human and use `resolveBackendConfig` instead, which resolves
+ * up front.
+ */
+export function resolveBackendAccess(deps = {}) {
+    const env = deps.env ?? process.env;
+    const region = activeRegion(deps);
+    const apiBase = env[`${PROXY_ENV_PREFIX}API_BASE`]?.trim() || region.apiBase;
+    const token = resolveVerifyToken(region.mcpName, { env });
+    if (!token)
+        return null;
+    const persisted = persistedOrganization(deps);
+    return {
+        apiBase,
+        mcpName: region.mcpName,
+        token,
+        ...(persisted
+            ? { organizationId: persisted.id }
+            : { resolveOrganizationId: () => resolveOrganizationId(apiBase, token, deps) }),
+    };
+}
+/**
+ * The persisted organization, or the account's only one — persisted on the
+ * way. Several, none, or an answer that could not be obtained: `null`, with
+ * one line naming the count, and nothing else. A guess here would be a
+ * verification under the wrong organization's policy.
+ */
+export async function resolveOrganizationId(apiBase, token, deps) {
+    const persisted = persistedOrganization(deps);
+    if (persisted)
+        return persisted.id;
+    const warn = deps.warn ?? (() => undefined);
+    if (!isTrustedApiBase(apiBase)) {
+        warn('verify: apiBase is not a trusted origin — the organization was not resolved, nothing was sent');
+        return null;
+    }
+    const organizations = await (deps.listOrganizationsFn ?? listOrganizations)(apiBase, token);
+    if (organizations === null) {
+        warn('verify: could not list the organizations, no backend for this session');
+        return null;
+    }
+    if (organizations.length !== 1) {
+        warn('verify: no organization selected and the account belongs to several (or none); ' +
+            'run `vibedefend org <id>` — no backend for this session', { organizations: organizations.length });
+        return null;
+    }
+    const only = organizations[0];
+    try {
+        (deps.saveOrganizationFn ?? saveRuntimeOrganization)(only);
+    }
+    catch {
+        /* remembered for this session at least; the next one resolves it again */
+    }
+    return only.id;
+}
+//# sourceMappingURL=backend.js.map

package/dist/mcp/verify/backend.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["../../../src/mcp/verify/backend.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAqB,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,MAAM,yCAAyC,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAwB,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oBAAoB,CAAC;AA+BnE,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,OAA0B,EAAE;IACvD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,iBAAiB,CAAC,EAAE,CAAC;QAClE,MAAM,EAAE,GAAI,OAA+C,EAAE,MAAM,EAAE,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,wEAAwE;QACxE,MAAM,MAAM,GAAI,OAA4C,EAAE,MAAM,CAAC;QACrE,IAAI,MAAM,EAAE,OAAO,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,qBAAqB,CAAC,OAA0B,EAAE;IAChE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,iBAAiB,CAAC,EAAE,CAAC;QAClE,MAAM,YAAY,GAAG,OAAO,EAAE,YAAY,CAAC;QAC3C,IAAI,YAAY,IAAI,OAAO,YAAY,CAAC,EAAE,KAAK,QAAQ,IAAI,YAAY,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;YAClF,OAAO,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,YAAY,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACvG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAA0B,EAAE;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,gBAAgB,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC;IAC7E,yEAAyE;IACzE,4DAA4D;IAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,6BAA6B,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACpG,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACzE,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAA0B,EAAE;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,gBAAgB,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC;IAC7E,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO;QACL,OAAO;QACP,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK;QACL,GAAG,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,EAAE,EAAE;YAClC,CAAC,CAAC,EAAE,qBAAqB,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;KAClF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAe,EAAE,KAAa,EAAE,IAAuB;IACjG,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC,EAAE,CAAC;IAEnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,+FAA+F,CAAC,CAAC;QACtG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,IAAI,iBAAiB,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5F,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,uEAAuE,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,IAAI,CACF,iFAAiF;YAC/E,yDAAyD,EAC3D,EAAE,aAAa,EAAE,aAAa,CAAC,MAAM,EAAE,CACxC,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,CAAC,IAAI,CAAC,kBAAkB,IAAI,uBAAuB,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC"}