@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/mcp/proxy/proxy.js

@@ -0,0 +1,520 @@
+import { encodeMessage, errorResponse, idKey, isRequest, isResponse, JSON_RPC_INTERNAL_ERROR, LineFramer, methodOf, } from './jsonrpc.js';
+import { FORWARD, passthrough, readClientInfo, } from './intercept.js';
+import { describeUpstream } from './spec.js';
+import { HttpUpstream } from './upstreamHttp.js';
+import { StdioUpstream } from './upstreamStdio.js';
+/**
+ * Protocol revisions the proxy knows how to name, newest first. Only used
+ * when the proxy has to answer `initialize` on its own; in the normal case
+ * the negotiated version is whatever the upstream picked.
+ */
+export const KNOWN_PROTOCOL_VERSIONS = [
+    '2025-11-25',
+    '2025-06-18',
+    '2025-03-26',
+    '2024-11-05',
+];
+/**
+ * Just under the one-second budget of the acceptance criterion: a timer fires
+ * at or after its delay, so a deadline set exactly on the budget answers a
+ * few milliseconds past it. Raise it with `VIBEDEFEND_MCP_INIT_DEADLINE_MS`
+ * if exact capabilities matter more than a fast handshake — an upstream
+ * launched through `npx` cold can need two or three seconds.
+ */
+export const DEFAULT_AGENT_INITIALIZE_DEADLINE_MS = 900;
+export const DEFAULT_UPSTREAM_INITIALIZE_TIMEOUT_MS = 3000;
+/**
+ * What the proxy claims when it has to answer before the upstream did.
+ *
+ * Claiming nothing would be honest and useless: the client would file the
+ * server as having no tools and never ask again. Claiming the common set
+ * costs an error on a list the upstream does not serve, and is repaired a
+ * moment later by the `list_changed` notifications sent from the real answer.
+ */
+const OPTIMISTIC_CAPABILITIES = {
+    tools: { listChanged: true },
+    prompts: { listChanged: true },
+    resources: { listChanged: true, subscribe: true },
+    logging: {},
+    completions: {},
+};
+/** A question with nobody answering is not a reason to keep the loop alive forever. */
+const DEFAULT_ASK_TIMEOUT_MS = 5 * 60 * 1000;
+export class Proxy {
+    options;
+    logger;
+    interceptor;
+    framer = new LineFramer();
+    queue = [];
+    upstream;
+    phase = 'before-initialize';
+    initializeId;
+    initializeIdKey;
+    answeredInitialize = false;
+    /** Start of the acceptance budget: when the agent's `initialize` arrived. */
+    initializeReceivedAt = 0;
+    requestedProtocolVersion;
+    agentDeadline;
+    upstreamDeadline;
+    exit;
+    exitCode = 0;
+    /** What the agent said it can do, at `initialize`. */
+    agentCapabilities = {};
+    agentClient;
+    /** Requests the PROXY sent to the agent, waiting for their answer. */
+    asks = new Map();
+    askCounter = 0;
+    agentChannel = {
+        supports: (capability) => Boolean(this.agentCapabilities[capability]),
+        request: (method, params, timeoutMs) => this.askAgent(method, params, timeoutMs),
+    };
+    constructor(options) {
+        this.options = options;
+        this.logger = options.logger;
+        this.interceptor = options.interceptor ?? passthrough;
+    }
+    /** Resolves with the process exit code once both sides are done. */
+    run() {
+        const { stdin } = this.options;
+        return new Promise((resolve) => {
+            this.exit = (code) => {
+                if (this.phase === 'closed')
+                    return;
+                this.phase = 'closed';
+                try {
+                    this.options.onExit?.();
+                }
+                catch (error) {
+                    this.logger.warn('exit task failed', { error: describeError(error) });
+                }
+                this.clearTimers();
+                this.rejectOpenAsks('the session ended');
+                this.releaseStdin();
+                void this.upstream?.close().finally(() => resolve(code));
+                if (!this.upstream)
+                    resolve(code);
+            };
+            stdin.on('data', (chunk) => this.onAgentChunk(chunk));
+            stdin.on('end', () => {
+                this.logger.info('agent closed the channel');
+                this.exit?.(this.exitCode);
+            });
+            stdin.on('error', (error) => {
+                this.logger.error('agent channel failed', { error: error.message });
+                this.exit?.(1);
+            });
+            this.logger.info('proxy started', {
+                upstream: describeUpstream(this.options.spec),
+                transport: this.options.spec.transport,
+            });
+        });
+    }
+    /** Called by the command layer on SIGINT / SIGTERM. */
+    shutdown(code = 0) {
+        this.logger.info('shutting down', { code });
+        this.exit?.(code);
+    }
+    // ── Agent side ────────────────────────────────────────────────────────────
+    onAgentChunk(chunk) {
+        const { messages, errors } = this.framer.push(chunk);
+        for (const error of errors) {
+            this.logger.warn('undecodable line from the agent', { ...error });
+        }
+        for (const message of messages)
+            void this.onAgentMessage(message);
+    }
+    async onAgentMessage(message) {
+        const method = methodOf(message);
+        this.logger.debug('agent -> upstream', { method, id: message.id });
+        // An answer to a question the proxy asked. It is ours: the upstream never
+        // saw the request and must not see the reply.
+        if (isResponse(message) && this.settleAsk(message))
+            return;
+        const decision = this.interceptor.fromAgent
+            ? await this.interceptor.fromAgent(message, {
+                logger: this.logger,
+                initialized: this.phase === 'ready',
+                agent: this.agentChannel,
+                client: this.agentClient,
+            })
+            : FORWARD;
+        if (decision.action === 'drop') {
+            this.logger.info('dropped a message from the agent', { method, reason: decision.reason });
+            return;
+        }
+        if (decision.action === 'respond') {
+            this.logger.info('answered the agent locally', { method, reason: decision.reason });
+            this.toAgent(decision.message);
+            return;
+        }
+        const outgoing = decision.action === 'replace' ? decision.message : message;
+        if (isRequest(outgoing) && methodOf(outgoing) === 'initialize') {
+            await this.onAgentInitialize(outgoing);
+            return;
+        }
+        this.toUpstream(outgoing);
+    }
+    async onAgentInitialize(message) {
+        if (this.phase !== 'before-initialize') {
+            // A second `initialize` is a client bug, not something to fix silently:
+            // forward it and let the upstream answer.
+            this.logger.warn('a second initialize arrived, forwarding it as-is');
+            this.toUpstream(message);
+            return;
+        }
+        this.phase = 'initializing';
+        this.initializeReceivedAt = Date.now();
+        this.initializeId = message.id;
+        this.initializeIdKey = idKey(message.id);
+        const params = message.params;
+        this.agentClient = readClientInfo(params);
+        if (typeof params === 'object' && params !== null) {
+            const requested = params.protocolVersion;
+            if (typeof requested === 'string')
+                this.requestedProtocolVersion = requested;
+            const capabilities = params.capabilities;
+            if (typeof capabilities === 'object' && capabilities !== null) {
+                this.agentCapabilities = capabilities;
+            }
+        }
+        const started = Date.now();
+        try {
+            this.upstream = this.makeUpstream();
+            await this.upstream.start();
+            this.logger.info('upstream started', { ms: Date.now() - started });
+        }
+        catch (error) {
+            const text = error instanceof Error ? error.message : String(error);
+            this.logger.error('upstream failed to start', { error: text });
+            this.toAgent(errorResponse(message.id, JSON_RPC_INTERNAL_ERROR, text));
+            this.answeredInitialize = true;
+            this.exitCode = 1;
+            this.exit?.(1);
+            return;
+        }
+        this.agentDeadline = setTimeout(() => {
+            if (this.answeredInitialize)
+                return;
+            this.logger.warn('upstream is slow to initialize, answering the agent first', {
+                deadlineMs: this.agentDeadlineMs,
+            });
+            this.answerInitializeOptimistically();
+        }, this.agentDeadlineMs);
+        this.upstreamDeadline = setTimeout(() => {
+            if (this.phase === 'ready' || this.phase === 'closed')
+                return;
+            this.logger.error('upstream never answered initialize, releasing the queued traffic', {
+                timeoutMs: this.upstreamDeadlineMs,
+            });
+            this.becomeReady();
+        }, this.upstreamDeadlineMs);
+        this.upstream.send(message);
+    }
+    get agentDeadlineMs() {
+        return this.options.agentInitializeDeadlineMs ?? DEFAULT_AGENT_INITIALIZE_DEADLINE_MS;
+    }
+    get upstreamDeadlineMs() {
+        return this.options.upstreamInitializeTimeoutMs ?? DEFAULT_UPSTREAM_INITIALIZE_TIMEOUT_MS;
+    }
+    /**
+     * The number the acceptance criterion is about: how long the agent waited
+     * between sending `initialize` and being answered. The process boot that
+     * precedes it is paid for any stdio server, proxy or not, so it is not part
+     * of the measurement.
+     */
+    noteInitializeAnswered(source) {
+        this.logger.info('initialize answered', {
+            ms: Date.now() - this.initializeReceivedAt,
+            source,
+        });
+    }
+    answerInitializeOptimistically() {
+        this.answeredInitialize = true;
+        const protocolVersion = this.requestedProtocolVersion &&
+            KNOWN_PROTOCOL_VERSIONS.includes(this.requestedProtocolVersion)
+            ? this.requestedProtocolVersion
+            : KNOWN_PROTOCOL_VERSIONS[0];
+        this.toAgent({
+            jsonrpc: '2.0',
+            id: this.initializeId,
+            result: {
+                protocolVersion,
+                capabilities: OPTIMISTIC_CAPABILITIES,
+                serverInfo: {
+                    name: 'vibedefend-proxy',
+                    version: this.options.proxyVersion ?? '0.0.0',
+                },
+                instructions: 'The upstream MCP server behind the VibeDefend proxy has not finished starting. ' +
+                    'Its tools, prompts and resources appear as soon as it does.',
+            },
+        });
+        this.noteInitializeAnswered('proxy');
+    }
+    // ── Upstream side ─────────────────────────────────────────────────────────
+    makeUpstream() {
+        const events = {
+            onMessage: (message) => void this.onUpstreamMessage(message),
+            onError: (error) => this.logger.error('upstream error', { error: error.message }),
+            onClose: (info) => this.onUpstreamClose(info),
+        };
+        if (this.options.createUpstream) {
+            return this.options.createUpstream(this.options.spec, events, this.logger);
+        }
+        if (this.options.spec.transport === 'http') {
+            return new HttpUpstream({
+                spec: this.options.spec,
+                events,
+                logger: this.logger,
+                auth: this.options.auth,
+            });
+        }
+        return new StdioUpstream({
+            spec: this.options.spec,
+            events,
+            logger: this.logger,
+            stderr: this.options.stderr,
+        });
+    }
+    async onUpstreamMessage(message) {
+        const method = methodOf(message);
+        this.logger.debug('upstream -> agent', { method, id: message.id });
+        const decision = this.interceptor.fromUpstream
+            ? await this.interceptor.fromUpstream(message, {
+                logger: this.logger,
+                initialized: this.phase === 'ready',
+                agent: this.agentChannel,
+                client: this.agentClient,
+            })
+            : FORWARD;
+        if (decision.action === 'drop') {
+            this.logger.info('dropped a message from the upstream', { method, reason: decision.reason });
+            return;
+        }
+        if (decision.action === 'respond') {
+            this.logger.info('answered the upstream locally', { method, reason: decision.reason });
+            this.toUpstream(decision.message);
+            return;
+        }
+        const incoming = decision.action === 'replace' ? decision.message : message;
+        if (this.phase === 'initializing' &&
+            isResponse(incoming) &&
+            idKey(incoming.id) === this.initializeIdKey) {
+            this.onUpstreamInitializeResult(incoming);
+            return;
+        }
+        this.toAgent(incoming);
+    }
+    onUpstreamInitializeResult(message) {
+        this.clearTimers();
+        if (!this.answeredInitialize) {
+            // The normal path: the upstream's own answer, forwarded untouched, so
+            // `serverInfo`, `instructions` and the negotiated version are exact.
+            this.answeredInitialize = true;
+            this.toAgent(message);
+            this.noteInitializeAnswered('upstream');
+            this.becomeReady();
+            return;
+        }
+        this.logger.warn('the upstream answered initialize after the deadline', {
+            hasError: 'error' in message,
+        });
+        this.becomeReady();
+        if ('error' in message)
+            return;
+        this.reconcileLateCapabilities(message);
+    }
+    /**
+     * Repairs an optimistic answer. The client skipped the lists it thought
+     * were empty, so it is told they changed; and anything the proxy claimed
+     * that the upstream does not have is logged, because that mismatch is the
+     * price of answering first.
+     */
+    reconcileLateCapabilities(message) {
+        const result = message.result;
+        if (typeof result !== 'object' || result === null)
+            return;
+        const capabilities = result.capabilities;
+        const actual = typeof capabilities === 'object' && capabilities !== null
+            ? capabilities
+            : {};
+        for (const area of ['tools', 'prompts', 'resources']) {
+            if (actual[area]) {
+                this.toAgent({ jsonrpc: '2.0', method: `notifications/${area}/list_changed` });
+            }
+        }
+        const missing = Object.keys(OPTIMISTIC_CAPABILITIES).filter((area) => !actual[area]);
+        if (missing.length > 0) {
+            this.logger.warn('advertised capabilities the upstream does not have', { missing });
+        }
+        const negotiated = result.protocolVersion;
+        if (typeof negotiated === 'string' && negotiated !== this.announcedProtocolVersion()) {
+            this.logger.warn('protocol version announced to the agent differs from the negotiated one', {
+                announced: this.announcedProtocolVersion(),
+                negotiated,
+            });
+        }
+    }
+    announcedProtocolVersion() {
+        return this.requestedProtocolVersion &&
+            KNOWN_PROTOCOL_VERSIONS.includes(this.requestedProtocolVersion)
+            ? this.requestedProtocolVersion
+            : KNOWN_PROTOCOL_VERSIONS[0];
+    }
+    onUpstreamClose(info) {
+        if (this.phase === 'closed')
+            return;
+        this.logger.info('upstream closed', { ...info });
+        // A server that dies mid-session ends the session: the client respawns us
+        // when it wants to try again.
+        this.exitCode = typeof info.code === 'number' && info.code !== 0 ? info.code : 0;
+        this.exit?.(this.exitCode);
+    }
+    // ── Plumbing ──────────────────────────────────────────────────────────────
+    becomeReady() {
+        if (this.phase === 'ready' || this.phase === 'closed')
+            return;
+        this.phase = 'ready';
+        this.clearTimers();
+        this.runAfterInitialize();
+        if (this.queue.length > 0) {
+            this.logger.debug('releasing queued agent messages', { count: this.queue.length });
+        }
+        while (this.queue.length > 0) {
+            const message = this.queue.shift();
+            if (message)
+                this.upstream?.send(message);
+        }
+    }
+    /**
+     * Nothing may reach the upstream before its `initialize` has been answered:
+     * the spec forbids it, and a server that receives `notifications/initialized`
+     * too early drops it.
+     */
+    toUpstream(message) {
+        if (this.phase === 'initializing') {
+            this.queue.push(message);
+            return;
+        }
+        if (!this.upstream) {
+            this.logger.warn('a message arrived before initialize, dropping it', {
+                method: methodOf(message),
+            });
+            if (isRequest(message)) {
+                this.toAgent(errorResponse(message.id, JSON_RPC_INTERNAL_ERROR, 'the upstream is not connected yet: send initialize first'));
+            }
+            return;
+        }
+        this.upstream.send(message);
+    }
+    // ── Questions the proxy asks the agent ────────────────────────────────────
+    /**
+     * Sends a request of the proxy's own to the agent, and waits for the reply.
+     *
+     * The id carries a prefix no upstream uses, so the reply cannot be mistaken
+     * for one meant for the server, and an upstream request that happens to use
+     * the same number cannot be mistaken for ours.
+     */
+    askAgent(method, params, timeoutMs = DEFAULT_ASK_TIMEOUT_MS) {
+        if (this.phase === 'closed')
+            return Promise.reject(new Error('the session ended'));
+        this.askCounter += 1;
+        const id = `vibedefend:${this.askCounter}`;
+        const key = idKey(id) ?? id;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                this.asks.delete(key);
+                reject(new Error(`no answer from the agent to ${method} within ${timeoutMs} ms`));
+            }, timeoutMs);
+            timer.unref?.();
+            this.asks.set(key, { resolve, reject, timer });
+            const message = { jsonrpc: '2.0', id, method };
+            if (params !== undefined)
+                message.params = params;
+            this.logger.debug('proxy -> agent', { method, id });
+            this.toAgent(message);
+        });
+    }
+    /** `true` when the response answered one of our own questions. */
+    settleAsk(message) {
+        const key = idKey(message.id);
+        const ask = key ? this.asks.get(key) : undefined;
+        if (!ask || !key)
+            return false;
+        this.asks.delete(key);
+        clearTimeout(ask.timer);
+        ask.resolve(message);
+        return true;
+    }
+    rejectOpenAsks(reason) {
+        for (const [, ask] of this.asks) {
+            clearTimeout(ask.timer);
+            ask.reject(new Error(reason));
+        }
+        this.asks.clear();
+    }
+    toAgent(message) {
+        try {
+            this.options.stdout.write(encodeMessage(message));
+        }
+        catch (error) {
+            this.logger.error('cannot write to the agent', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    /**
+     * Fires the post-handshake work, on the next tick and never awaited.
+     *
+     * The queued agent traffic is released in this same turn; scheduling the
+     * work rather than running it keeps a slow filesystem from sitting between
+     * the agent's `initialize` and its first real request.
+     */
+    runAfterInitialize() {
+        const task = this.options.afterInitialize;
+        if (!task)
+            return;
+        setTimeout(() => {
+            try {
+                void Promise.resolve(task(this.agentClient)).catch((error) => {
+                    this.logger.warn('post-initialize task failed', { error: describeError(error) });
+                });
+            }
+            catch (error) {
+                this.logger.warn('post-initialize task failed', { error: describeError(error) });
+            }
+        }, 0).unref?.();
+    }
+    /**
+     * Lets the process end.
+     *
+     * When the upstream dies the proxy has nothing left to do, but a listener
+     * on `process.stdin` keeps the event loop alive on its own: without this
+     * the proxy would linger until the client closed the channel, which is
+     * exactly the hung server the client is trying to detect.
+     */
+    releaseStdin() {
+        const stdin = this.options.stdin;
+        try {
+            stdin.pause();
+            stdin.unref?.();
+        }
+        catch {
+            /* nothing to release */
+        }
+    }
+    clearTimers() {
+        if (this.agentDeadline)
+            clearTimeout(this.agentDeadline);
+        if (this.upstreamDeadline)
+            clearTimeout(this.upstreamDeadline);
+        this.agentDeadline = undefined;
+        this.upstreamDeadline = undefined;
+    }
+}
+export async function runProxy(options) {
+    return new Proxy(options).run();
+}
+function describeError(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=proxy.js.map

package/dist/mcp/proxy/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../../src/mcp/proxy/proxy.ts"],"names":[],"mappings":"AAyBA,OAAO,EACL,aAAa,EACb,aAAa,EACb,KAAK,EACL,SAAS,EACT,UAAU,EACV,uBAAuB,EACvB,UAAU,EACV,QAAQ,GAET,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,OAAO,EACP,WAAW,EACX,cAAc,GAIf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAqB,MAAM,WAAW,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAqB,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,YAAY;CACJ,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oCAAoC,GAAG,GAAG,CAAC;AACxD,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,CAAC;AAE3D;;;;;;;GAOG;AACH,MAAM,uBAAuB,GAAG;IAC9B,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;IAC5B,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;IAC9B,SAAS,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;IACjD,OAAO,EAAE,EAAE;IACX,WAAW,EAAE,EAAE;CACP,CAAC;AA2CX,uFAAuF;AACvF,MAAM,sBAAsB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAQ7C,MAAM,OAAO,KAAK;IAgCa;IA/BZ,MAAM,CAAS;IACf,WAAW,CAAc;IACzB,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;IAC1B,KAAK,GAAqB,EAAE,CAAC;IAEtC,QAAQ,CAAY;IACpB,KAAK,GAAU,mBAAmB,CAAC;IAEnC,YAAY,CAAW;IACvB,eAAe,CAAU;IACzB,kBAAkB,GAAG,KAAK,CAAC;IACnC,6EAA6E;IACrE,oBAAoB,GAAG,CAAC,CAAC;IACzB,wBAAwB,CAAU;IAClC,aAAa,CAAkB;IAC/B,gBAAgB,CAAkB;IAElC,IAAI,CAA0B;IAC9B,QAAQ,GAAG,CAAC,CAAC;IAErB,sDAAsD;IAC9C,iBAAiB,GAA4B,EAAE,CAAC;IAChD,WAAW,CAAmB;IACtC,sEAAsE;IACrD,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC9C,UAAU,GAAG,CAAC,CAAC;IACN,YAAY,GAAiB;QAC5C,QAAQ,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACrE,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC;KACjF,CAAC;IAEF,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;QAChD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,WAAW,CAAC;IACxD,CAAC;IAED,oEAAoE;IACpE,GAAG;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAC/B,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACrC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE;gBACnB,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;oBAAE,OAAO;gBACpC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;gBACtB,IAAI,CAAC;oBACH,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBAC1B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,IAAI,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;gBACzC,IAAI,CAAC,YAAY,EAAE,CAAC;gBACpB,KAAK,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBACzD,IAAI,CAAC,IAAI,CAAC,QAAQ;oBAAE,OAAO,CAAC,IAAI,CAAC,CAAC;YACpC,CAAC,CAAC;YAEF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9D,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;gBAC7C,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE;gBACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBACpE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;gBAChC,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC7C,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS;aACvC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,QAAQ,CAAC,IAAI,GAAG,CAAC;QACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,6EAA6E;IAErE,YAAY,CAAC,KAAa;QAChC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,KAAK,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACpE,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAAuB;QAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAEnE,0EAA0E;QAC1E,8CAA8C;QAC9C,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,OAAO;QAE3D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS;YACzC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,OAAO,EAAE;gBACxC,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,KAAK,KAAK,OAAO;gBACnC,KAAK,EAAE,IAAI,CAAC,YAAY;gBACxB,MAAM,EAAE,IAAI,CAAC,WAAW;aACzB,CAAC;YACJ,CAAC,CAAC,OAAO,CAAC;QAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1F,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAE5E,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,YAAY,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,OAAuB;QACrD,IAAI,IAAI,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACvC,wEAAwE;YACxE,0CAA0C;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YACrE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,cAAc,CAAC;QAC5B,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC;QAC/B,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,SAAS,GAAI,MAAwC,CAAC,eAAe,CAAC;YAC5E,IAAI,OAAO,SAAS,KAAK,QAAQ;gBAAE,IAAI,CAAC,wBAAwB,GAAG,SAAS,CAAC;YAC7E,MAAM,YAAY,GAAI,MAAqC,CAAC,YAAY,CAAC;YACzE,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC9D,IAAI,CAAC,iBAAiB,GAAG,YAAuC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,uBAAuB,EAAE,IAAI,CAAC,CAAC,CAAC;YACvE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC/B,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YAClB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACf,OAAO;QACT,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YACnC,IAAI,IAAI,CAAC,kBAAkB;gBAAE,OAAO;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE;gBAC5E,UAAU,EAAE,IAAI,CAAC,eAAe;aACjC,CAAC,CAAC;YACH,IAAI,CAAC,8BAA8B,EAAE,CAAC;QACxC,CAAC,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAEzB,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE;YACtC,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO;YAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kEAAkE,EAAE;gBACpF,SAAS,EAAE,IAAI,CAAC,kBAAkB;aACnC,CAAC,CAAC;YACH,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAE5B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,OAAO,CAAC,yBAAyB,IAAI,oCAAoC,CAAC;IACxF,CAAC;IAED,IAAY,kBAAkB;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,2BAA2B,IAAI,sCAAsC,CAAC;IAC5F,CAAC;IAED;;;;;OAKG;IACK,sBAAsB,CAAC,MAA4B;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE;YACtC,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,oBAAoB;YAC1C,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAEO,8BAA8B;QACpC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,MAAM,eAAe,GACnB,IAAI,CAAC,wBAAwB;YAC5B,uBAA6C,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC;YACpF,CAAC,CAAC,IAAI,CAAC,wBAAwB;YAC/B,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC;YACX,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,IAAI,CAAC,YAAY;YACrB,MAAM,EAAE;gBACN,eAAe;gBACf,YAAY,EAAE,uBAAuB;gBACrC,UAAU,EAAE;oBACV,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO;iBAC9C;gBACD,YAAY,EACV,iFAAiF;oBACjF,6DAA6D;aAChE;SACF,CAAC,CAAC;QACH,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;IAED,6EAA6E;IAErE,YAAY;QAClB,MAAM,MAAM,GAAmB;YAC7B,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAC5D,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YACjF,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;SAC9C,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;YAC3C,OAAO,IAAI,YAAY,CAAC;gBACtB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;gBACvB,MAAM;gBACN,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;aACxB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,aAAa,CAAC;YACvB,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YACvB,MAAM;YACN,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;SAC5B,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,OAAuB;QACrD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAEnE,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY;YAC5C,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE;gBAC3C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,KAAK,KAAK,OAAO;gBACnC,KAAK,EAAE,IAAI,CAAC,YAAY;gBACxB,MAAM,EAAE,IAAI,CAAC,WAAW;aACzB,CAAC;YACJ,CAAC,CAAC,OAAO,CAAC;QAEZ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7F,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACvF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAE5E,IACE,IAAI,CAAC,KAAK,KAAK,cAAc;YAC7B,UAAU,CAAC,QAAQ,CAAC;YACpB,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,IAAI,CAAC,eAAe,EAC3C,CAAC;YACD,IAAI,CAAC,0BAA0B,CAAC,QAAQ,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAEO,0BAA0B,CAAC,OAAuB;QACxD,IAAI,CAAC,WAAW,EAAE,CAAC;QAEnB,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,sEAAsE;YACtE,qEAAqE;YACrE,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACtB,IAAI,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAC;YACxC,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qDAAqD,EAAE;YACtE,QAAQ,EAAE,OAAO,IAAI,OAAO;SAC7B,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,OAAO,IAAI,OAAO;YAAE,OAAO;QAC/B,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;OAKG;IACK,yBAAyB,CAAC,OAAuB;QACvD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO;QAC1D,MAAM,YAAY,GAAI,MAAqC,CAAC,YAAY,CAAC;QACzE,MAAM,MAAM,GACV,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI;YACvD,CAAC,CAAE,YAAwC;YAC3C,CAAC,CAAC,EAAE,CAAC;QAET,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAU,EAAE,CAAC;YAC9D,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjB,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,IAAI,eAAe,EAAE,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,UAAU,GAAI,MAAwC,CAAC,eAAe,CAAC;QAC7E,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,CAAC,wBAAwB,EAAE,EAAE,CAAC;YACrF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yEAAyE,EAAE;gBAC1F,SAAS,EAAE,IAAI,CAAC,wBAAwB,EAAE;gBAC1C,UAAU;aACX,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,wBAAwB;QAC9B,OAAO,IAAI,CAAC,wBAAwB;YACjC,uBAA6C,CAAC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,CAAC;YACtF,CAAC,CAAC,IAAI,CAAC,wBAAwB;YAC/B,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IAEO,eAAe,CAAC,IAAuB;QAC7C,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO;QACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;QACjD,0EAA0E;QAC1E,8BAA8B;QAC9B,IAAI,CAAC,QAAQ,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED,6EAA6E;IAErE,WAAW;QACjB,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO;QAC9D,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;QACrB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACnC,IAAI,OAAO;gBAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,OAAuB;QACxC,IAAI,IAAI,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACzB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;gBACnE,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC;aAC1B,CAAC,CAAC;YACH,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,OAAO,CACV,aAAa,CACX,OAAO,CAAC,EAAE,EACV,uBAAuB,EACvB,0DAA0D,CAC3D,CACF,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,6EAA6E;IAE7E;;;;;;OAMG;IACK,QAAQ,CAAC,MAAc,EAAE,MAAe,EAAE,SAAS,GAAG,sBAAsB;QAClF,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;QACrB,MAAM,EAAE,GAAG,cAAc,IAAI,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACtB,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,MAAM,WAAW,SAAS,KAAK,CAAC,CAAC,CAAC;YACpF,CAAC,EAAE,SAAS,CAAC,CAAC;YACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC;YAC/D,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAC1D,SAAS,CAAC,OAAuB;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtB,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxB,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,cAAc,CAAC,MAAc;QACnC,KAAK,MAAM,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;IAEO,OAAO,CAAC,OAAuB;QACrC,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC7C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC;gBACH,KAAK,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBACpE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACnF,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;;OAOG;IACK,YAAY;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAA0C,CAAC;QACtE,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAEO,WAAW;QACjB,IAAI,IAAI,CAAC,aAAa;YAAE,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,gBAAgB;YAAE,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/D,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;QAC/B,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;CACF;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAqB;IAClD,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/mcp/proxy/serverCheckTimer.js

@@ -0,0 +1,75 @@
+/**
+ * The server check, for the whole life of the proxy.
+ *
+ * A block or an unblock decided by the organization must reach a session
+ * already open, not wait for the agent to list its tools again. So the
+ * proxy asks `servers/check` once at start, then every
+ * `SERVER_CHECK_INTERVAL_MS`, and tells `onChange` when the organization
+ * block appeared or went away.
+ *
+ * Off the hot path by construction: the timer never delays a message between
+ * the agent and the server, never keeps the process alive (`unref()`), runs
+ * one check at a time (a check still running skips the next tick), and never
+ * throws. A check that fails changes nothing: the verifier keeps a known
+ * block and never invents one.
+ */
+import { SERVER_CHECK_INTERVAL_MS } from '../report/constants.js';
+export function startServerCheckTimer(opts) {
+    const { verifier, logger } = opts;
+    const setIntervalFn = opts.setIntervalFn ?? setInterval;
+    const clearIntervalFn = opts.clearIntervalFn ?? clearInterval;
+    let running;
+    let stopped = false;
+    async function check() {
+        let state;
+        try {
+            state = await verifier.checkServer();
+        }
+        catch (error) {
+            logger.warn('verify: the periodic server check failed, nothing changed', { error: describe(error) });
+            return;
+        }
+        if (stopped || (state !== 'blocked' && state !== 'unblocked'))
+            return;
+        logger.info('verify: the organization block of this server changed', { state });
+        try {
+            const result = opts.onChange?.(state);
+            if (result instanceof Promise) {
+                result.catch((error) => {
+                    logger.warn('verify: refreshing the server gate failed', { error: describe(error) });
+                });
+            }
+        }
+        catch (error) {
+            logger.warn('verify: refreshing the server gate failed', { error: describe(error) });
+        }
+    }
+    function tick() {
+        if (running)
+            return running;
+        running = check().finally(() => {
+            running = undefined;
+        });
+        return running;
+    }
+    void tick();
+    const handle = setIntervalFn(() => {
+        if (running)
+            return;
+        void tick();
+    }, opts.intervalMs ?? SERVER_CHECK_INTERVAL_MS);
+    const unref = handle?.unref;
+    if (typeof unref === 'function')
+        unref.call(handle);
+    return {
+        stop() {
+            stopped = true;
+            clearIntervalFn(handle);
+        },
+        tick,
+    };
+}
+function describe(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=serverCheckTimer.js.map

package/dist/mcp/proxy/serverCheckTimer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverCheckTimer.js","sourceRoot":"","sources":["../../../src/mcp/proxy/serverCheckTimer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAWlE,MAAM,UAAU,qBAAqB,CAAC,IAOrC;IACC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,WAAW,CAAC;IACxD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,IAAI,aAAa,CAAC;IAC9D,IAAI,OAAkC,CAAC;IACvC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,UAAU,KAAK;QAClB,IAAI,KAAmD,CAAC;QACxD,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,2DAA2D,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACrG,OAAO;QACT,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,WAAW,CAAC;YAAE,OAAO;QACtE,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC;YACH,MAAM,MAAM,GAAY,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,MAAM,YAAY,OAAO,EAAE,CAAC;gBAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBAC9B,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBACvF,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,SAAS,IAAI;QACX,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,OAAO,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7B,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,IAAI,EAAE,CAAC;IACZ,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE;QAChC,IAAI,OAAO;YAAE,OAAO;QACpB,KAAK,IAAI,EAAE,CAAC;IACd,CAAC,EAAE,IAAI,CAAC,UAAU,IAAI,wBAAwB,CAAC,CAAC;IAChD,MAAM,KAAK,GAAI,MAAgD,EAAE,KAAK,CAAC;IACvE,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpD,OAAO;QACL,IAAI;YACF,OAAO,GAAG,IAAI,CAAC;YACf,eAAe,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI;KACL,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/mcp/proxy/sessionLifecycle.js

@@ -0,0 +1,29 @@
+export function createSessionLifecycle(deps) {
+    let timer;
+    let stopped = false;
+    function onChange() {
+        try {
+            void deps.refreshServerGate().catch(() => undefined);
+        }
+        catch {
+            // The gate stays as it was; the next check tries again.
+        }
+        deps.reporter?.noteServerChanged();
+    }
+    return {
+        start(client) {
+            if (stopped || timer)
+                return;
+            deps.reporter?.start(client);
+            timer = deps.startTimer(onChange);
+        },
+        stop() {
+            if (stopped)
+                return;
+            stopped = true;
+            timer?.stop();
+            deps.reporter?.stop();
+        },
+    };
+}
+//# sourceMappingURL=sessionLifecycle.js.map

package/dist/mcp/proxy/sessionLifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionLifecycle.js","sourceRoot":"","sources":["../../../src/mcp/proxy/sessionLifecycle.ts"],"names":[],"mappings":"AA6BA,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,IAAI,KAAmC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,SAAS,QAAQ;QACf,IAAI,CAAC;YACH,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QACD,IAAI,CAAC,QAAQ,EAAE,iBAAiB,EAAE,CAAC;IACrC,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM;YACV,IAAI,OAAO,IAAI,KAAK;gBAAE,OAAO;YAC7B,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7B,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACpC,CAAC;QACD,IAAI;YACF,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,EAAE,IAAI,EAAE,CAAC;YACd,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}