@cybedefend/vibedefend 1.5.0 → 1.7.0

package/README.md

@@ -27,7 +27,19 @@ The installer is fully interactive, and signs you in **first**:
 3. **Organization check** — if your account doesn't belong to an
    organization yet, the dashboard on-boarding page opens and the installer
    waits while you create or join one (Ctrl-C to skip and finish later).
-4. **Pick which agents to wire** (auto-detected), confirm. That's it.
+4. **Pick which agents to wire** (auto-detected), confirm.
+5. **MCP proxy** — put the VibeDefend proxy in front of your other MCP
+   servers (yes by default), so each tool is checked against your
+   organization policy before your agent calls it. CybeDefend's own MCP
+   server is never wrapped. The proxy also reports to your organization the
+   MCP servers it sees and the calls it refused, asked about, warned on or
+   whose result it flagged (never their arguments or results), and it
+   applies your organization's blocks within 15 minutes; this needs the
+   CybeDefend gateway of 2026-10-28.
+6. **MCP sign-ins** — the sign-ins Claude Code or Codex already hold for
+   those servers are taken over on their own. Your browser opens only for the
+   servers left without one, if you say yes (or later:
+   `vibedefend connect --all`).
 
 Run through `npx` (or `pnpm dlx` / `yarn dlx`), the installer first installs
 the CLI globally (`npm install -g @cybedefend/vibedefend`), so the
@@ -125,12 +137,18 @@ For any other repo (no remote, a mirror, a monorepo subfolder, an
 unimported project…), link it once:
 
 ```bash
-vibedefend link                       # interactive: auto-detect, or pick org → project
+vibedefend link                       # interactive: auto-detect, pick org → project, or create one
 vibedefend link --project <uuid>      # non-interactive, if you know the project UUID
 # or without a global install:
 npx -y @cybedefend/vibedefend@latest link --project <PROJECT_ID>
 ```
 
+No project yet? `link` offers to create one (team managers and organization
+administrators can). When `origin` is a github.com / gitlab.com repository
+that the organization's GitHub App / GitLab integration can see, the new
+project is linked to it and its first scan starts; otherwise start a first
+scan from the dashboard.
+
 `link` writes a `.cybedefend/config.json` next to your code:
 
 ```json
@@ -141,6 +159,16 @@ That file is now **optional** for GitHub/GitLab-linked projects, but it
 remains a supported override everywhere — when present, it always wins over
 git-origin auto-resolution (as does the `CYBEDEFEND_PROJECT_ID` env var).
 
+The project is read from the directory your agent works in, as its client
+reports it (Cursor: the workspace root). When the agent writes a file of
+another repository, such as another git worktree or clone, the rules for that
+file come from that repository's project, or from the agent's project when
+that repository has none. Action Guards always use the agent's directory.
+
+`link` also adds `.cybedefend/` to the directory's `.gitignore` (idempotent):
+the link describes *your* checkout, not the code. Remove the line if your team
+prefers to share it — the hooks read the file either way.
+
 **Folders that are not CybeDefend projects.** The hooks are installed for
 every folder your agent opens. When a session starts in a folder with no
 `.cybedefend/config.json` and no project linked to its GitHub/GitLab `origin`
@@ -164,6 +192,47 @@ You can grab the UUID from the project page on the EU dashboard
 ([eu.cybedefend.com](https://eu.cybedefend.com)) or the US dashboard
 ([us.cybedefend.com](https://us.cybedefend.com)).
 
+## Where VibeDefend is active
+
+The hooks are wired **globally** (one `~/.claude/settings.json`, one
+`~/.codex/hooks.json`, …), so the question is which repos they act on. The
+installer asks:
+
+| Mode | Behaviour |
+|---|---|
+| `auto` (default) | Every repo that resolves to a CybeDefend project — via `.cybedefend/config.json`, `CYBEDEFEND_PROJECT_ID`, or git-origin auto-discovery. |
+| `opt-in` | Only repos you linked explicitly (`vibedefend link`) or run with `CYBEDEFEND_PROJECT_ID`. No origin lookup: in every other repo the session shows the one-line notice above, then every hook stays off. |
+
+The choice lives in `~/.cybedefend/runtime-config.json` (`hooks.activation`);
+re-run `vibedefend install` to change it, or override it per shell with
+`CYBEDEFEND_ACTIVATION=auto|opt-in`. `vibedefend status` shows the effective mode.
+
+## Action Guards — how commands are read
+
+The guard evaluates a Bash command **by shell position**, not by substring
+(BACK-174): a heredoc written to a file, a URL query string (`&su=…`), quoted
+data (`echo "a && su"`) or code handed to a non-shell interpreter
+(`python3 -c "…"`) can no longer trip a rule meant for a command word, while
+`su -`, `…; su -`, `bash -c "…; su -"` and `curl … | bash` on any line of a
+shell heredoc are still blocked.
+
+Scripts the agent writes in its **own harness scratchpad** —
+`/tmp/claude-<uid>/…`, `/private/tmp/claude-<uid>/…` and the Codex / Cursor /
+Windsurf / Copilot equivalents — are not "executed from /tmp". Add your own
+prefixes with `CYBEDEFEND_SCRATCH_DIRS` (`PATH`-style list).
+
+Tool calls the guard cannot map to a file, command or URL are **allowed
+fail-open**. Tools that carry no target by construction (`ToolSearch`, todo
+lists, sub-agents, the `mcp__cybedefend__*` tools) pass silently; anything
+else is counted in `~/.cybedefend/guards-unmapped-tools.json`, announced once
+per session on stderr, and listed by `vibedefend status`. Set
+`CYBEDEFEND_GUARDS_STRICT=1` to block those instead.
+
+Rule regexes run on RE2 (linear time, no ReDoS): the engine is bundled into
+the hook runner and `re2.wasm` ships next to it for every install shape. If a
+hook ever reports `RE2 engine unavailable`, run `vibedefend doctor` — it
+restores the missing binary.
+
 ## Updating
 
 At install you're asked **"Enable automatic background updates? (recommended)"**.

package/dist/api/gateway-request.js

@@ -0,0 +1,49 @@
+function errorMessage(body) {
+    if (!body || typeof body !== 'object')
+        return undefined;
+    const m = body.message;
+    if (typeof m === 'string' && m)
+        return m;
+    if (Array.isArray(m) && m.length > 0)
+        return m.map(String).join('; ');
+    return undefined;
+}
+export async function requestGateway(url, req, deps, defaultTimeoutMs) {
+    const f = deps.fetchImpl ?? globalThis.fetch;
+    const headers = {
+        Authorization: `Bearer ${req.token}`,
+    };
+    if (req.body !== undefined)
+        headers['Content-Type'] = 'application/json';
+    let res;
+    try {
+        res = await f(url, {
+            method: req.method,
+            headers,
+            body: req.body === undefined ? undefined : JSON.stringify(req.body),
+            signal: AbortSignal.timeout(deps.timeoutMs ?? defaultTimeoutMs),
+        });
+    }
+    catch (e) {
+        return {
+            ok: false,
+            status: null,
+            message: e instanceof Error ? e.message : String(e),
+        };
+    }
+    let body = null;
+    try {
+        body = await res.json();
+    }
+    catch {
+        body = null;
+    }
+    if (res.ok)
+        return { ok: true, status: res.status, body };
+    return {
+        ok: false,
+        status: res.status,
+        message: errorMessage(body) ?? `HTTP ${res.status}`,
+    };
+}
+//# sourceMappingURL=gateway-request.js.map

package/dist/api/gateway-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-request.js","sourceRoot":"","sources":["../../src/api/gateway-request.ts"],"names":[],"mappings":"AAeA,SAAS,YAAY,CAAC,IAAa;IACjC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,CAAC,GAAI,IAAgC,CAAC,OAAO,CAAC;IACpD,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,GAA8D,EAC9D,IAAqB,EACrB,gBAAwB;IAExB,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,OAAO,GAA2B;QACtC,aAAa,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE;KACrC,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IAEzE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACjB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO;YACP,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YACnE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,gBAAgB,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,GAAY,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAC1D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE;KACpD,CAAC;AACJ,CAAC"}

package/dist/api/projects.js

@@ -7,7 +7,12 @@
  * network throw, non-2xx, or malformed JSON — so hook callers stay
  * fail-open. `null` NEVER means "no results"; it means "could not tell".
  * An empty result is an empty array.
+ *
+ * The writes (`createProject`, BACK-230) are the exception: they go through
+ * `requestGateway`, which keeps the HTTP status so the caller can tell a
+ * 403, a 409 and a 429 apart.
  */
+import { requestGateway } from './gateway-request.js';
 const RESOLVE_TIMEOUT_MS = 4_000;
 const LIST_TIMEOUT_MS = 10_000;
 /** Unwrap a gateway `{success,data,message}` envelope to its `data`, else the root. */
@@ -155,4 +160,66 @@ export async function listProjects(apiBase, token, orgId, search, deps = {}) {
         };
     });
 }
+const WRITE_TIMEOUT_MS = 30_000;
+/**
+ * GET {apiBase}/organization/:id/teams
+ *
+ * Returns `[{id, name}]` for the teams of the org the caller can see, or
+ * `null` on any error. BACK-230.
+ */
+export async function listTeams(apiBase, token, orgId, deps = {}) {
+    const res = await requestGateway(`${apiBase}/organization/${encodeURIComponent(orgId)}/teams`, { method: 'GET', token }, deps, LIST_TIMEOUT_MS);
+    if (!res.ok)
+        return null;
+    return firstArray(res.body, 'teams')
+        .map((raw) => {
+        const t = (raw ?? {});
+        return { id: str(t.id), name: str(t.name) };
+    })
+        .filter((t) => t.id !== '');
+}
+/**
+ * POST {apiBase}/team/:teamId/project  { name, <the four AI flags on> }
+ *
+ * Every AI feature is sent on, as the dashboard's creation does: an absent
+ * one is stored false by the backend, and a project with Cybe Analysis off
+ * gets no rule proposals (BACK-250). Each one is turned off in the project
+ * settings.
+ *
+ * Keeps the HTTP status on failure: 403 (not team manager / org admin), 409
+ * (name taken in the team), 429 (plan's project limit). BACK-230.
+ */
+export async function createProject(apiBase, token, teamId, name, deps = {}) {
+    const res = await requestGateway(`${apiBase}/team/${encodeURIComponent(teamId)}/project`, {
+        method: 'POST',
+        token,
+        body: {
+            name,
+            aiMergeRequestEnabled: true,
+            improvingResultsEnabled: true,
+            sortsVulnerabilitiesEnabled: true,
+            securityChampionEnabled: true,
+        },
+    }, deps, WRITE_TIMEOUT_MS);
+    if (!res.ok)
+        return res;
+    const data = unwrap(res.body);
+    const projectId = str(data.projectId);
+    if (!projectId) {
+        return {
+            ok: false,
+            status: null,
+            message: 'The gateway answered the creation without a projectId',
+        };
+    }
+    return {
+        ok: true,
+        project: {
+            projectId,
+            organizationId: str(data.organizationId),
+            teamId: str(data.teamId) || teamId,
+            name: str(data.name) || name,
+        },
+    };
+}
 //# sourceMappingURL=projects.js.map

package/dist/api/projects.js.map

@@ -1 +1 @@
-{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../src/api/projects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAsBH,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,uFAAuF;AACvF,SAAS,MAAM,CAAC,IAAa;IAC3B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,IAA+B,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,OAAQ,IAAgC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,qEAAqE;AACrE,SAAS,UAAU,CAAC,IAAa,EAAE,GAAW;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAc,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAe,EACf,KAAa,EACb,CAAoD,EACpD,OAAwB,EAAE;IAE1B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,OAAO,0BAA0B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAEpE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACjB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAwB,EAAE;QAClD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;QACjD,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3B,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC;YACrC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;YAC/B,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YACzB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAC7B,qEAAqE;YACrE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,KAAK,KAAK;SACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,KAAa,EACb,OAAwB,EAAE;IAE1B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,GAAG,GAAG,GAAG,OAAO,gBAAgB,CAAC;IAEvC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACjB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,UAAU,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,KAAa,EACb,KAAa,EACb,MAAe,EACf,OAAwB,EAAE;IAE1B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,IAAI,GAAG,GAAG,GAAG,OAAO,qBAAqB,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC;IAC9E,IAAI,MAAM;QAAE,GAAG,IAAI,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAEpE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACjB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9C,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;QACjD,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC;YACnC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,CAAC;SACnC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../src/api/projects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAsBtD,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,uFAAuF;AACvF,SAAS,MAAM,CAAC,IAAa;IAC3B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,IAA+B,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,OAAQ,IAAgC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,qEAAqE;AACrE,SAAS,UAAU,CAAC,IAAa,EAAE,GAAW;IAC5C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAA+B,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAc,CAAC;IACxD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,OAAe,EACf,KAAa,EACb,CAAoD,EACpD,OAAwB,EAAE;IAE1B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,CAAC,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,GAAG,OAAO,0BAA0B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAEpE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACjB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAwB,EAAE;QAClD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;QACjD,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3B,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC;YACrC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC;YAC/B,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YACzB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;YAC7B,qEAAqE;YACrE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,KAAK,KAAK;SACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAe,EACf,KAAa,EACb,OAAwB,EAAE;IAE1B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,MAAM,GAAG,GAAG,GAAG,OAAO,gBAAgB,CAAC;IAEvC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACjB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,UAAU,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACnD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAe,EACf,KAAa,EACb,KAAa,EACb,MAAe,EACf,OAAwB,EAAE;IAE1B,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAC7C,IAAI,GAAG,GAAG,GAAG,OAAO,qBAAqB,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC;IAC9E,IAAI,MAAM;QAAE,GAAG,IAAI,IAAI,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAEpE,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE;YACjB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;YAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,eAAe,CAAC;SAC/D,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC9C,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;QACjD,OAAO;YACL,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC;YACnC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,CAAC;SACnC,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAQhC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAe,EACf,KAAa,EACb,KAAa,EACb,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAG,MAAM,cAAc,CAC9B,GAAG,OAAO,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAC5D,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EACxB,IAAI,EACJ,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC;SACjC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACX,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;QACjD,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9C,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAChC,CAAC;AAcD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAe,EACf,KAAa,EACb,MAAc,EACd,IAAY,EACZ,OAAwB,EAAE;IAE1B,MAAM,GAAG,GAAG,MAAM,cAAc,CAC9B,GAAG,OAAO,SAAS,kBAAkB,CAAC,MAAM,CAAC,UAAU,EACvD;QACE,MAAM,EAAE,MAAM;QACd,KAAK;QACL,IAAI,EAAE;YACJ,IAAI;YACJ,qBAAqB,EAAE,IAAI;YAC3B,uBAAuB,EAAE,IAAI;YAC7B,2BAA2B,EAAE,IAAI;YACjC,uBAAuB,EAAE,IAAI;SAC9B;KACF,EACD,IAAI,EACJ,gBAAgB,CACjB,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,uDAAuD;SACjE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE;YACP,SAAS;YACT,cAAc,EAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC;YACxC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM;YAClC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI;SAC7B;KACF,CAAC;AACJ,CAAC"}

package/dist/api/repository-link.js

@@ -0,0 +1,157 @@
+/**
+ * Link a freshly created project to its GitHub / GitLab repository through
+ * the organization's integration (BACK-230). Same outcomes and messages as
+ * mcp-service's `create_project` (`modules/discovery/repository-link.ts`).
+ *
+ * A project carries no repository: the link lives on the integration's
+ * repository rows, which only the installed integration creates, and is made
+ * by that row's id. Linking starts the first scan. A row that already points
+ * at a project is never relinked — GitLab would overwrite it silently.
+ *
+ * Never rejects: the outcome is reported.
+ */
+import { requestGateway } from './gateway-request.js';
+/** The only hosts the integrations cover (GitHub App, GitLab OAuth on gitlab.com). */
+const SAAS_HOSTS = {
+    github: 'github.com',
+    gitlab: 'gitlab.com',
+};
+const LABEL = {
+    github: 'GitHub',
+    gitlab: 'GitLab',
+};
+/** The SSH-over-443 hosts of the two forges, folded onto their SaaS host. */
+const HOST_ALIASES = {
+    'ssh.github.com': 'github.com',
+    'altssh.gitlab.com': 'gitlab.com',
+};
+const LIST_TIMEOUT_MS = 10_000;
+// The link creates webhooks and queues the first scan.
+const LINK_TIMEOUT_MS = 60_000;
+function str(v) {
+    return typeof v === 'string' ? v : '';
+}
+function toRepository(raw, pathKey) {
+    const o = (raw ?? {});
+    return { id: str(o.id), path: str(o[pathKey]), projectId: str(o.projectId) };
+}
+/** GitHub: `{ repositories: [{ installationId, repository: [...] }] }`; GitLab: `{ repositories: [...] }`. */
+function readRepositories(provider, body) {
+    const list = body?.repositories;
+    if (!Array.isArray(list))
+        return [];
+    if (provider === 'gitlab') {
+        return list.map((r) => toRepository(r, 'pathWithNamespace'));
+    }
+    return list.flatMap((installation) => {
+        const repos = installation?.repository;
+        return Array.isArray(repos)
+            ? repos.map((r) => toRepository(r, 'fullName'))
+            : [];
+    });
+}
+function forbiddenOutcome(slug) {
+    return {
+        status: 'forbidden',
+        message: 'Linking needs the integration-management right on the organization ' +
+            '(organization creator, administrator or manager). Ask one of them to ' +
+            `link ${slug} to this project from the dashboard.`,
+    };
+}
+/**
+ * Find the repository in the organization's integration, without linking
+ * anything: the free row to link, or the outcome that stops the link. The
+ * create flow calls it before creating, to refuse a repository that is
+ * already linked. Never rejects.
+ */
+export async function lookupRepository(apiBase, token, organizationId, repository, deps = {}) {
+    const { provider, slug } = repository;
+    const label = LABEL[provider];
+    const org = encodeURIComponent(organizationId);
+    const raw = (repository.host || SAAS_HOSTS[provider]).trim().toLowerCase();
+    const host = HOST_ALIASES[raw] ?? raw;
+    if (host !== SAAS_HOSTS[provider]) {
+        return {
+            outcome: {
+                status: 'unsupported_host',
+                message: `${host} is not supported: the CybeDefend ${label} integration only ` +
+                    `covers ${SAAS_HOSTS[provider]}.`,
+            },
+        };
+    }
+    const listUrl = provider === 'github'
+        ? `${apiBase}/organization/${org}/github/repositories`
+        : `${apiBase}/integrations/gitlab/organization/${org}/repositories`;
+    const listed = await requestGateway(listUrl, { method: 'GET', token }, deps, LIST_TIMEOUT_MS);
+    if (!listed.ok) {
+        if (listed.status === 403)
+            return { outcome: forbiddenOutcome(slug) };
+        return {
+            outcome: {
+                status: 'failed',
+                message: `Could not list the organization's ${label} repositories (${listed.message}).`,
+            },
+        };
+    }
+    const wanted = slug.toLowerCase();
+    const matches = readRepositories(provider, listed.body).filter((r) => r.path.toLowerCase() === wanted);
+    if (matches.length === 0) {
+        return {
+            outcome: {
+                status: 'not_found',
+                message: provider === 'github'
+                    ? `${slug} is not in the organization's GitHub integration: install the ` +
+                        'CybeDefend GitHub App on its owner and give it access to this ' +
+                        'repository, then link the project from the dashboard.'
+                    : `${slug} is not in the organization's GitLab integration: connect GitLab ` +
+                        "from the dashboard's integrations with an account that can see this " +
+                        'repository, then link the project from the dashboard.',
+            },
+        };
+    }
+    if (matches.length > 1) {
+        return {
+            outcome: {
+                status: 'failed',
+                message: `Several ${label} repositories named ${slug} are in the integration: link the right one from the dashboard.`,
+            },
+        };
+    }
+    const [match] = matches;
+    if (match.projectId) {
+        return {
+            outcome: {
+                status: 'already_linked',
+                linkedProjectId: match.projectId,
+                message: `${slug} is already linked to project ${match.projectId} and was not ` +
+                    'relinked: use that project, or unlink it from the dashboard first.',
+            },
+        };
+    }
+    return { match };
+}
+export async function linkRepositoryToProject(apiBase, token, target, repository, deps = {}) {
+    const { provider, slug } = repository;
+    const found = await lookupRepository(apiBase, token, target.organizationId, repository, deps);
+    if ('outcome' in found)
+        return found.outcome;
+    const org = encodeURIComponent(target.organizationId);
+    const project = encodeURIComponent(target.projectId);
+    const linkUrl = provider === 'github'
+        ? `${apiBase}/organization/${org}/project/${project}/github/link`
+        : `${apiBase}/integrations/gitlab/organization/${org}/project/${project}/link`;
+    const linked = await requestGateway(linkUrl, { method: 'POST', token, body: { repositoryId: found.match.id } }, deps, LINK_TIMEOUT_MS);
+    if (!linked.ok) {
+        if (linked.status === 403)
+            return forbiddenOutcome(slug);
+        return {
+            status: 'failed',
+            message: `Could not link ${slug} (${linked.message}).`,
+        };
+    }
+    return {
+        status: 'linked',
+        message: `${slug} is linked to the project; the first scan of its default branch has started.`,
+    };
+}
+//# sourceMappingURL=repository-link.js.map

package/dist/api/repository-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-link.js","sourceRoot":"","sources":["../../src/api/repository-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAoBtD,sFAAsF;AACtF,MAAM,UAAU,GAAuC;IACrD,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,YAAY;CACrB,CAAC;AACF,MAAM,KAAK,GAAuC;IAChD,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACjB,CAAC;AACF,6EAA6E;AAC7E,MAAM,YAAY,GAA2B;IAC3C,gBAAgB,EAAE,YAAY;IAC9B,mBAAmB,EAAE,YAAY;CAClC,CAAC;AACF,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,uDAAuD;AACvD,MAAM,eAAe,GAAG,MAAM,CAAC;AAe/B,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,YAAY,CAAC,GAAY,EAAE,OAAe;IACjD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAA4B,CAAC;IACjD,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;AAC/E,CAAC;AAED,8GAA8G;AAC9G,SAAS,gBAAgB,CACvB,QAA4B,EAC5B,IAAa;IAEb,MAAM,IAAI,GAAI,IAA0C,EAAE,YAAY,CAAC;IACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,EAAE,EAAE;QACnC,MAAM,KAAK,GAAI,YAAgD,EAAE,UAAU,CAAC;QAC5E,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACzB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;YAC/C,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,OAAO,EACL,qEAAqE;YACrE,uEAAuE;YACvE,QAAQ,IAAI,sCAAsC;KACrD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,KAAa,EACb,cAAsB,EACtB,UAAyB,EACzB,OAAwB,EAAE;IAE1B,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAE/C,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;IACtC,IAAI,IAAI,KAAK,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,OAAO,EACL,GAAG,IAAI,qCAAqC,KAAK,oBAAoB;oBACrE,UAAU,UAAU,CAAC,QAAQ,CAAC,GAAG;aACpC;SACF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GACX,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,GAAG,OAAO,iBAAiB,GAAG,sBAAsB;QACtD,CAAC,CAAC,GAAG,OAAO,qCAAqC,GAAG,eAAe,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,OAAO,EACP,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EACxB,IAAI,EACJ,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,OAAO;YACL,OAAO,EAAE;gBACP,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,qCAAqC,KAAK,kBAAkB,MAAM,CAAC,OAAO,IAAI;aACxF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAC5D,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CACvC,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE;gBACP,MAAM,EAAE,WAAW;gBACnB,OAAO,EACL,QAAQ,KAAK,QAAQ;oBACnB,CAAC,CAAC,GAAG,IAAI,gEAAgE;wBACvE,gEAAgE;wBAChE,uDAAuD;oBACzD,CAAC,CAAC,GAAG,IAAI,mEAAmE;wBAC1E,sEAAsE;wBACtE,uDAAuD;aAC9D;SACF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,OAAO,EAAE;gBACP,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,WAAW,KAAK,uBAAuB,IAAI,iEAAiE;aACtH;SACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC;IACxB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE;gBACP,MAAM,EAAE,gBAAgB;gBACxB,eAAe,EAAE,KAAK,CAAC,SAAS;gBAChC,OAAO,EACL,GAAG,IAAI,iCAAiC,KAAK,CAAC,SAAS,eAAe;oBACtE,oEAAoE;aACvE;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,KAAa,EACb,MAAqD,EACrD,UAAyB,EACzB,OAAwB,EAAE;IAE1B,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,OAAO,EACP,KAAK,EACL,MAAM,CAAC,cAAc,EACrB,UAAU,EACV,IAAI,CACL,CAAC;IACF,IAAI,SAAS,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAE7C,MAAM,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,OAAO,GACX,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,GAAG,OAAO,iBAAiB,GAAG,YAAY,OAAO,cAAc;QACjE,CAAC,CAAC,GAAG,OAAO,qCAAqC,GAAG,YAAY,OAAO,OAAO,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,OAAO,EACP,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EACjE,IAAI,EACJ,eAAe,CAChB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,kBAAkB,IAAI,KAAK,MAAM,CAAC,OAAO,IAAI;SACvD,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,GAAG,IAAI,8EAA8E;KAC/F,CAAC;AACJ,CAAC"}

package/dist/auth/auth-store.js

@@ -30,13 +30,28 @@ function accountFor(mcpName) {
 // ─── Public API ───────────────────────────────────────────────────────────────
 /** Persist an auth bundle for the given MCP name. */
 export function storeAuth(mcpName, auth) {
-    const blob = JSON.stringify(auth);
     if (process.platform === 'darwin') {
-        storeMacOSKeychain(mcpName, blob);
-    }
-    else {
-        storeFileFallback(blob);
+        try {
+            storeMacOSKeychain(mcpName, JSON.stringify(auth));
+        }
+        catch {
+            // NEVER pass execFileSync's error on: its message carries the command
+            // line, and so ANY secret in it. That is how BACK-181 leaked (the token
+            // bundle printed in clear, then pasted by the user). Swallow it and fall
+            // back to the 0600 file, as `loadAuth` does: a HOME without a keychain
+            // (CI, managed accounts, E2E harnesses) must be able to sign in instead
+            // of failing hard. The message is reworded with no data in it.
+            process.stderr.write('vibedefend: macOS keychain unavailable, credentials stored in ~/.cybedefend/auth.json (mode 0600).\n');
+            storeFileFallback(mcpName, auth);
+            return;
+        }
+        // The keychain holds the bundle now: drop the plaintext copy a failed
+        // write may have left in the file (an older refresh token, readable on
+        // disk until the next logout otherwise).
+        removeFileFallback(mcpName, auth);
+        return;
     }
+    storeFileFallback(mcpName, auth);
 }
 /**
  * Load the stored auth bundle for the given MCP name.
@@ -50,7 +65,7 @@ export function loadAuth(mcpName) {
     // File fallback — also checked on Linux/Windows and as fallback on macOS
     // when the keychain entry is absent.
     if (!blob)
-        blob = readFileFallback();
+        blob = readFileFallback(mcpName);
     if (!blob)
         return null;
     try {
@@ -87,15 +102,7 @@ export function clearAuth(mcpName) {
         }
     }
     // Also clear the file fallback (it may hold an older copy on non-macOS).
-    const filePath = fileFallbackPath();
-    if (existsSync(filePath)) {
-        try {
-            writeFileSync(filePath, '', { mode: 0o600 });
-        }
-        catch {
-            // Best-effort.
-        }
-    }
+    removeFileFallback(mcpName);
 }
 // ─── macOS Keychain helpers ───────────────────────────────────────────────────
 function storeMacOSKeychain(mcpName, blob) {
@@ -111,6 +118,18 @@ function storeMacOSKeychain(mcpName, blob) {
     catch {
         // Not found — that is fine.
     }
+    // KNOWN RESIDUE (BACK-181): the blob is passed as the `-w` argument, so any
+    // local process can read it in `ps` for the duration of the call. There is no
+    // safe way to take it out of argv here: the stdin prompt of `security -w`
+    // reads the password through readpassphrase(), capped at PASS_MAX = 128
+    // bytes, and it silently TRUNCATES a real bundle (a JWT access token alone is
+    // longer than 128), which breaks the storage. The batch mode `security -i`
+    // would avoid argv but would need the blob re-encoded (base64), and the item
+    // is shared with the Codex reader (`resolveTokenCodexMacOS`), which expects
+    // raw JSON: changing it would break that compatibility. The argv window is
+    // short and local; the leaks that mattered (error message, hard failure) are
+    // closed in `storeAuth`. Taking the secret out of argv is still open (see the
+    // ticket).
     execFileSync('security', [
         'add-generic-password',
         '-s', KEYCHAIN_SERVICE,
@@ -136,15 +155,43 @@ function readMacOSKeychain(mcpName) {
         return null;
     }
 }
-// ─── File fallback (Linux / Windows) ─────────────────────────────────────────
 function fileFallbackPath() {
     return join(homedir(), '.cybedefend', 'auth.json');
 }
-function storeFileFallback(blob) {
+function readFallbackFile() {
+    const p = fileFallbackPath();
+    if (!existsSync(p))
+        return { kind: 'none' };
+    let content;
+    try {
+        content = readFileSync(p, 'utf8');
+    }
+    catch {
+        return { kind: 'none' };
+    }
+    if (content.trim().length === 0)
+        return { kind: 'none' };
+    try {
+        const parsed = JSON.parse(content);
+        if (parsed !== null &&
+            typeof parsed === 'object' &&
+            parsed.version === 2 &&
+            parsed.bundles !== null &&
+            typeof parsed.bundles === 'object') {
+            return { kind: 'per-region', bundles: parsed.bundles };
+        }
+    }
+    catch {
+        // Not JSON: `loadAuth` rejects it below, as before.
+    }
+    return { kind: 'legacy', blob: content };
+}
+function writeFallbackFile(bundles) {
     const dir = join(homedir(), '.cybedefend');
     mkdirSync(dir, { recursive: true });
     const p = fileFallbackPath();
-    writeFileSync(p, blob, { mode: 0o600 });
+    const content = Object.keys(bundles).length === 0 ? '' : JSON.stringify({ version: 2, bundles });
+    writeFileSync(p, content, { mode: 0o600 });
     try {
         // Belt-and-suspenders: explicitly chmod after write (some umask configs
         // ignore the mode option on writeFileSync).
@@ -154,16 +201,51 @@ function storeFileFallback(blob) {
         // Non-fatal on Windows (no POSIX perms).
     }
 }
-function readFileFallback() {
-    const p = fileFallbackPath();
-    if (!existsSync(p))
-        return null;
+function storeFileFallback(mcpName, auth) {
+    const current = readFallbackFile();
+    // A legacy bare bundle is replaced: it was this machine's previous sign-in,
+    // and nothing says which region it belonged to.
+    const bundles = current.kind === 'per-region' ? { ...current.bundles } : {};
+    bundles[mcpName] = auth;
+    writeFallbackFile(bundles);
+}
+function readFileFallback(mcpName) {
+    const current = readFallbackFile();
+    if (current.kind === 'per-region') {
+        const bundle = current.bundles[mcpName];
+        return bundle === undefined ? null : JSON.stringify(bundle);
+    }
+    return current.kind === 'legacy' ? current.blob : null;
+}
+/**
+ * Remove `mcpName`'s bundle from the file. A legacy bare bundle is removed by
+ * a sign-out (no `replacedBy`), or when it is the same sign-in the keychain
+ * now holds (same Logto app and resource). Best-effort: never throws.
+ */
+function removeFileFallback(mcpName, replacedBy) {
     try {
-        const content = readFileSync(p, 'utf8');
-        return content || null;
+        const current = readFallbackFile();
+        if (current.kind === 'per-region') {
+            if (!(mcpName in current.bundles))
+                return;
+            const rest = { ...current.bundles };
+            delete rest[mcpName];
+            writeFallbackFile(rest);
+            return;
+        }
+        if (current.kind !== 'legacy')
+            return;
+        if (replacedBy !== undefined) {
+            const legacy = JSON.parse(current.blob);
+            if (legacy.cliAppId !== replacedBy.cliAppId ||
+                legacy.logtoResource !== replacedBy.logtoResource) {
+                return;
+            }
+        }
+        writeFallbackFile({});
     }
     catch {
-        return null;
+        // Best-effort: a stale copy is better than a failed sign-in or sign-out.
     }
 }
 //# sourceMappingURL=auth-store.js.map

package/dist/auth/auth-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../../src/auth/auth-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,UAAU,EACV,YAAY,EACZ,aAAa,EACb,SAAS,EACT,SAAS,GACV,MAAM,SAAS,CAAC;AA0BjB,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAEjD,6CAA6C;AAC7C,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,GAAG,OAAO,aAAa,CAAC;AACjC,CAAC;AAED,iFAAiF;AAEjF,qDAAqD;AACrD,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,IAAgB;IACzD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAE/B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,CAAC,IAAI;QAAE,IAAI,GAAG,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;QACvD,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,+EAA+E;QAC/E,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YACpC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YACxC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,EACxC,CAAC;YACD,OAAO,MAAoB,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,YAAY,CACV,UAAU,EACV;gBACE,yBAAyB;gBACzB,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;aAC1B,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,SAAS,kBAAkB,CAAC,OAAe,EAAE,IAAY;IACvD,wEAAwE;IACxE,0BAA0B;IAC1B,IAAI,CAAC;QACH,YAAY,CACV,UAAU,EACV;YACE,yBAAyB;YACzB,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;SAC1B,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;IAED,YAAY,CACV,UAAU,EACV;QACE,sBAAsB;QACtB,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;QACzB,IAAI,EAAE,IAAI;KACX,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,UAAU,EACV;YACE,uBAAuB;YACvB,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;YACzB,IAAI;SACL,EACD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;IAC3C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,wEAAwE;QACxE,4CAA4C;QAC5C,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACxC,OAAO,OAAO,IAAI,IAAI,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"auth-store.js","sourceRoot":"","sources":["../../src/auth/auth-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,UAAU,EACV,YAAY,EACZ,aAAa,EACb,SAAS,EACT,SAAS,GACV,MAAM,SAAS,CAAC;AA0BjB,gFAAgF;AAEhF,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AAEjD,6CAA6C;AAC7C,SAAS,UAAU,CAAC,OAAe;IACjC,OAAO,GAAG,OAAO,aAAa,CAAC;AACjC,CAAC;AAED,iFAAiF;AAEjF,qDAAqD;AACrD,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,IAAgB;IACzD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,wEAAwE;YACxE,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,+DAA+D;YAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sGAAsG,CACvG,CAAC;YACF,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,sEAAsE;QACtE,uEAAuE;QACvE,yCAAyC;QACzC,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,IAAI,IAAI,GAAkB,IAAI,CAAC;IAE/B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,yEAAyE;IACzE,qCAAqC;IACrC,IAAI,CAAC,IAAI;QAAE,IAAI,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;QACvD,yEAAyE;QACzE,oEAAoE;QACpE,yEAAyE;QACzE,+EAA+E;QAC/E,IACE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;YACtC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;YACpC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YACxC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,EACxC,CAAC;YACD,OAAO,MAAoB,CAAC;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,YAAY,CACV,UAAU,EACV;gBACE,yBAAyB;gBACzB,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;aAC1B,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,iFAAiF;AAEjF,SAAS,kBAAkB,CAAC,OAAe,EAAE,IAAY;IACvD,wEAAwE;IACxE,0BAA0B;IAC1B,IAAI,CAAC;QACH,YAAY,CACV,UAAU,EACV;YACE,yBAAyB;YACzB,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;SAC1B,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,wEAAwE;IACxE,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,6EAA6E;IAC7E,8EAA8E;IAC9E,WAAW;IACX,YAAY,CACV,UAAU,EACV;QACE,sBAAsB;QACtB,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;QACzB,IAAI,EAAE,IAAI;KACX,EACD,EAAE,KAAK,EAAE,QAAQ,EAAE,CACpB,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CACtB,UAAU,EACV;YACE,uBAAuB;YACvB,IAAI,EAAE,gBAAgB;YACtB,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC;YACzB,IAAI;SACL,EACD;YACE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;YACnC,OAAO,EAAE,IAAI;SACd,CACF,CAAC;QACF,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAgBD,SAAS,gBAAgB;IACvB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC5C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA6C,CAAC;QAC/E,IACE,MAAM,KAAK,IAAI;YACf,OAAO,MAAM,KAAK,QAAQ;YAC1B,MAAM,CAAC,OAAO,KAAK,CAAC;YACpB,MAAM,CAAC,OAAO,KAAK,IAAI;YACvB,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAClC,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,OAAkC,EAAE,CAAC;QACpF,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgC;IACzD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;IAC3C,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC7B,MAAM,OAAO,GACX,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACnF,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,wEAAwE;QACxE,4CAA4C;QAC5C,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe,EAAE,IAAgB;IAC1D,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,4EAA4E;IAC5E,gDAAgD;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACxB,iBAAiB,CAAC,OAAO,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,OAAe,EAAE,UAAuB;IAClE,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;gBAAE,OAAO;YAC1C,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,iBAAiB,CAAC,IAAI,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QACtC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAwB,CAAC;YAC/D,IACE,MAAM,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ;gBACvC,MAAM,CAAC,aAAa,KAAK,UAAU,CAAC,aAAa,EACjD,CAAC;gBACD,OAAO;YACT,CAAC;QACH,CAAC;QACD,iBAAiB,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;AACH,CAAC"}