@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/commands/mcp/proxy.js

@@ -0,0 +1,320 @@
+import { chain } from '../../mcp/proxy/intercept.js';
+import { createTokenSource } from '../../mcp/auth/tokenSource.js';
+import { connectCommandFor, createAuthInterceptor } from '../../mcp/proxy/authInterceptor.js';
+import { createAudit } from '../../mcp/proxy/audit.js';
+import { createVerifyInterceptor } from '../../mcp/proxy/verifyInterceptor.js';
+import { startServerCheckTimer } from '../../mcp/proxy/serverCheckTimer.js';
+import { createSessionLifecycle } from '../../mcp/proxy/sessionLifecycle.js';
+import { makeReportBuffer } from '../../mcp/report/buffer.js';
+import { resolveReportProjectId } from '../../mcp/report/project.js';
+import { McpReporter } from '../../mcp/report/reporter.js';
+import { postMcpReport } from '../../mcp/verify/api.js';
+import { buildVerifier } from '../../mcp/verify/factory.js';
+import { reportServerIdentity } from '../../mcp/verify/identity.js';
+import { verifyTokenResolver } from '../../mcp/verify/token.js';
+import { isProxyInstalled } from '../../mcp/config/installed.js';
+import { withSyncLock } from '../../mcp/config/lock.js';
+import { checkProxyBinary } from '../../mcp/config/proxyBinary.js';
+import { applySyncPlan, planSync } from '../../mcp/config/rewrite.js';
+import { loggerFromEnv, parseLogLevel } from '../../mcp/proxy/log.js';
+import { mcpLogsDir, PROXY_ENV_PREFIX } from '../../mcp/proxy/paths.js';
+import { Proxy } from '../../mcp/proxy/proxy.js';
+import { createLogger } from '../../mcp/proxy/log.js';
+import { describeUpstream, resolveUpstreamSpec, UpstreamSpecError, } from '../../mcp/proxy/spec.js';
+import { expandedSpecOf, resolveNamedUpstream, specOf, UnknownUpstreamError, } from '../../mcp/proxy/upstreams.js';
+/** Exit code for a usage error, distinct from an upstream that died. */
+export const EXIT_USAGE = 2;
+export async function runMcpProxyCommand(options, runtime) {
+    // TWO specs, and they are not interchangeable.
+    //
+    // `spec` is what the upstream is reached with: expanded, because the child
+    // needs the value the originating client would have given it.
+    //
+    // `identitySpec` is the entry as stored: NOT expanded, because
+    // `upstreamServerId` hashes `command` + `args` (or the url), and that hash
+    // keys the verdict cache and the user's own `allow`/`deny` overrides —
+    // which `vibedefend allow|deny|status` compute from the stored entry.
+    // Deriving it from the expanded spec makes a `deny` stop applying the
+    // moment a reference appears in `args`, silently. Measured, not feared:
+    // see the conformance test that pins it.
+    let spec;
+    let identitySpec;
+    // The client whose config this server was read from; the agent's own
+    // `clientInfo` wins when it names itself.
+    let fallbackClientName;
+    // Variable references the originating client would have resolved. Names
+    // only — these are logged, and one of them is an API key.
+    let expansion = { resolved: [], missing: [] };
+    try {
+        // `--name` is the shape `vibedefend install` writes into a client config,
+        // so it wins over anything else on the command line.
+        if (options.name) {
+            const { entry } = resolveNamedUpstream(options.name, runtime.env);
+            // Expanded HERE, at the moment of use — `upstreams.json` keeps the
+            // reference, never the value. See `expand.ts`.
+            const expanded = expandedSpecOf(entry, runtime.env);
+            spec = expanded.value;
+            identitySpec = specOf(entry);
+            fallbackClientName = entry.source?.client;
+            expansion = { resolved: expanded.resolved, missing: expanded.missing };
+        }
+        else {
+            spec = resolveUpstreamSpec(options);
+            // Nothing was expanded, so the two are the same object.
+            identitySpec = spec;
+        }
+    }
+    catch (error) {
+        if (error instanceof UpstreamSpecError || error instanceof UnknownUpstreamError) {
+            runtime.stderr.write(`vibedefend mcp: ${error.message}\n`);
+            return EXIT_USAGE;
+        }
+        throw error;
+    }
+    const level = options.logLevel
+        ? parseLogLevel(options.logLevel)
+        : parseLogLevel(runtime.env[`${PROXY_ENV_PREFIX}LOG_LEVEL`]);
+    const logger = options.logLevel
+        ? createLogger({
+            level,
+            dir: mcpLogsDir(runtime.env),
+            base: { pid: process.pid, upstream: describeUpstream(spec) },
+            mirrorToStderr: runtime.env[`${PROXY_ENV_PREFIX}LOG_STDERR`] === '1',
+        })
+        : loggerFromEnv({ pid: process.pid, upstream: describeUpstream(spec) }, runtime.env);
+    // Names only, never values — this line is the one that would have made the
+    // signoz 401 a ten-second diagnosis instead of a dogfooding session.
+    if (expansion.resolved.length > 0 || expansion.missing.length > 0) {
+        logger.info('expanded variable references from the client entry', {
+            resolved: expansion.resolved,
+            resolvedCount: expansion.resolved.length,
+            missing: expansion.missing,
+        });
+    }
+    for (const name of expansion.missing) {
+        logger.warn('a variable referenced by this server is not set and has no default; ' +
+            'the literal text is passed through, exactly as the client would', { variable: name });
+    }
+    const built = buildInterceptor(spec, identitySpec, options.name, logger, runtime, fallbackClientName);
+    const backgroundSyncOff = runtime.env[`${PROXY_ENV_PREFIX}NO_SYNC`] === '1';
+    const proxy = new Proxy({
+        spec,
+        logger,
+        interceptor: built.interceptor,
+        stdin: runtime.stdin,
+        stdout: runtime.stdout,
+        stderr: runtime.stderr,
+        proxyVersion: runtime.version,
+        // Only an http upstream can carry a bearer. The source reads nothing until
+        // the server answers 401, so a server that wants no token never causes a
+        // credential-store lookup at all.
+        auth: spec.transport === 'http'
+            ? createTokenSource(spec.url, {
+                onLookup: (outcome) => logger.info('credential lookup', { outcome }),
+            })
+            : undefined,
+        afterInitialize: backgroundSyncOff && !built.lifecycle
+            ? undefined
+            : async (client) => {
+                built.lifecycle?.start(client);
+                if (!backgroundSyncOff)
+                    await backgroundSync(options, runtime, logger);
+            },
+        onExit: built.lifecycle ? () => built.lifecycle?.stop() : undefined,
+        agentInitializeDeadlineMs: positiveMs(runtime.env[`${PROXY_ENV_PREFIX}INIT_DEADLINE_MS`]),
+        upstreamInitializeTimeoutMs: positiveMs(runtime.env[`${PROXY_ENV_PREFIX}UPSTREAM_INIT_TIMEOUT_MS`]),
+    });
+    const register = runtime.onSignal ?? ((handler) => {
+        process.on('SIGINT', () => handler('SIGINT'));
+        process.on('SIGTERM', () => handler('SIGTERM'));
+    });
+    register((signal) => {
+        logger.info('received a signal', { signal });
+        proxy.shutdown(0);
+    });
+    return proxy.run();
+}
+/** An override is honoured only when it is a positive number of milliseconds. */
+function positiveMs(value) {
+    if (!value)
+        return undefined;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+}
+/**
+ * May this proxy rewrite the clients' configs?
+ *
+ * Only when all three hold: it was spawned from a wrapped entry (`--name`,
+ * not an ad hoc `--upstream` typed by a human), the user explicitly installed
+ * the proxy (the `installed` marker), and the binary running is the one
+ * `vibedefend` resolves to on the PATH — so the entries it would write point
+ * at itself. A checkout's `node dist/index.js` fails the third, whatever the
+ * marker says: measured on 2026-09-08, it wrapped twelve real servers behind
+ * a global release that had no `mcp` command.
+ */
+function backgroundSyncPermission(options, runtime) {
+    if (!options.name)
+        return 'ad-hoc';
+    if (!isProxyInstalled(runtime.env))
+        return 'not-installed';
+    const check = checkProxyBinary({ env: runtime.env, argv1: runtime.argv1 ?? process.argv[1] });
+    if (!check.matches)
+        return check.reason ?? 'different-binary';
+    return 'granted';
+}
+/**
+ * The background `sync` the plan asks the proxy to run at startup.
+ *
+ * It exists so that a server added with `claude mcp add` mid-week ends up
+ * behind the proxy without anyone remembering a command. Three things make it
+ * safe to run from here:
+ *
+ *  - the permission above, checked first and logged when refused;
+ *  - the lock. One proxy runs per MCP server, so five of them start within
+ *    the same second and would otherwise all rewrite `~/.claude.json` at
+ *    once; whoever gets the lock does the work and the rest do nothing.
+ *  - no backup. A timestamped copy per session, per server, would fill the
+ *    user's home with files nobody asked for. The originals are in
+ *    `upstreams.json`, which is what `uninstall` restores from anyway.
+ *
+ * Every failure is logged and swallowed: an MCP session must not end because
+ * a config file could not be rewritten.
+ */
+async function backgroundSync(options, runtime, logger) {
+    const env = runtime.env;
+    const permission = backgroundSyncPermission(options, runtime);
+    if (permission !== 'granted') {
+        // An ad hoc launch is routine; the other two mean an installed proxy that
+        // cannot do its job, which somebody reading the log should see.
+        logger[permission === 'ad-hoc' ? 'debug' : 'info']('background sync skipped', {
+            reason: permission,
+        });
+        return;
+    }
+    const ran = await withSyncLock(() => {
+        const plan = planSync({ env });
+        const result = applySyncPlan(plan, { env, backup: false });
+        return { plan, result };
+    }, { env });
+    if (!ran) {
+        logger.debug('background sync skipped: another process holds the lock');
+        return;
+    }
+    const wrapped = ran.plan.changes.filter((change) => change.kind === 'wrap').length;
+    const forgotten = ran.plan.changes.filter((change) => change.kind === 'forget').length;
+    if (wrapped === 0 && forgotten === 0 && ran.result.failed.length === 0) {
+        logger.debug('background sync: nothing to do');
+        return;
+    }
+    logger.info('background sync', {
+        wrapped,
+        forgotten,
+        failed: ran.result.failed.length,
+        files: ran.result.written,
+    });
+}
+/**
+ * The interceptors, in the order they see a message.
+ *
+ * Auth first: an http upstream that refuses every token gets `initialize`
+ * answered by the proxy and a tool list reduced to
+ * `vibedefend_connect_required`, and verification has nothing to say about a
+ * list the proxy wrote itself. It is wired whatever `VIBEDEFEND_MCP_NO_VERIFY`
+ * says, because it is not verification: it is section 0's rule that
+ * `initialize` is always answered.
+ */
+function buildInterceptor(spec, identitySpec, name, logger, runtime, fallbackClientName) {
+    const interceptors = [];
+    if (spec.transport === 'http') {
+        interceptors.push(createAuthInterceptor({
+            // Displayed, so the stored form: an expanded url would print the
+            // value of the reference into the agent's context.
+            serverName: name ?? describeUpstream(identitySpec),
+            connectCommand: connectCommandFor({ name, spec: identitySpec }),
+            proxyVersion: runtime.version,
+            logger,
+        }));
+    }
+    const verify = buildVerifyInterceptor(identitySpec, name, logger, runtime, fallbackClientName);
+    if (verify)
+        interceptors.push(verify.interceptor);
+    const lifecycle = verify?.lifecycle;
+    if (interceptors.length === 0)
+        return { lifecycle };
+    return {
+        interceptor: interceptors.length === 1 ? interceptors[0] : chain(interceptors),
+        lifecycle,
+    };
+}
+/**
+ * The verification seam, wired to the local cache and to the CybeDefend
+ * backend — through `buildVerifier`, the same wiring `vibedefend scan` uses,
+ * so what one buys the other finds.
+ *
+ * `VIBEDEFEND_MCP_NO_VERIFY=1` takes it out entirely, which is what the
+ * Phase 1 conformance suite runs with: those tests assert that the proxy is
+ * indistinguishable from the server, and a `vibedefend_alert` appended to a
+ * tool list is, correctly, a difference.
+ */
+function buildVerifyInterceptor(spec, name, logger, runtime, fallbackClientName) {
+    if (runtime.env[`${PROXY_ENV_PREFIX}NO_VERIFY`] === '1') {
+        logger.info('verification disabled by the environment');
+        return undefined;
+    }
+    // No credential means no backend call, and the cache alone decides. That
+    // is a supported state, not a degraded one: a machine with a blacklisted
+    // server in its cache still refuses it. No network here: an organization
+    // that is not persisted yet is resolved at the first verification, after
+    // `initialize` has been answered (section 0).
+    const { verifier, serverId, serverName, backend } = buildVerifier(spec, name ?? describeUpstream(spec), logger, runtime.env);
+    logger.info('verification enabled', {
+        serverId,
+        backend: backend !== null,
+        organization: backend?.organizationId ? 'persisted' : backend ? 'resolved-at-first-call' : 'none',
+    });
+    const env = runtime.env;
+    // What a report says of this server: a host, a package or a label, and a
+    // key. A URL that does not canonicalise gives no identity and no report.
+    const identity = reportServerIdentity(spec, name);
+    const reporter = identity
+        ? new McpReporter({
+            identity,
+            vibedefendVersion: runtime.version,
+            fallbackClientName,
+            snapshot: () => verifier.inventorySnapshot(),
+            backendContext: () => verifier.backendContext(),
+            projectId: (clientName) => resolveReportProjectId({ env, clientName }),
+            buffer: makeReportBuffer({ env }),
+            post: (ctx, body) => postMcpReport(ctx, body, { resolveTokenFn: verifyTokenResolver({ env }) }),
+            logger,
+            firstDelayMs: positiveMs(env[`${PROXY_ENV_PREFIX}REPORT_DELAY_MS`]),
+            minIntervalMs: positiveMs(env[`${PROXY_ENV_PREFIX}REPORT_MIN_INTERVAL_MS`]),
+        })
+        : undefined;
+    const verify = createVerifyInterceptor({
+        verifier,
+        logger,
+        spec,
+        serverId,
+        serverName,
+        // Sizes and rule names, never arguments and never results: the plan's
+        // rule is that nothing from a `tools/call` leaves the machine, and a file
+        // quoting them would be a second copy of everything the user has done.
+        audit: createAudit({ env }),
+        report: reporter,
+    });
+    return {
+        interceptor: verify,
+        lifecycle: createSessionLifecycle({
+            reporter,
+            refreshServerGate: () => verify.refreshServerGate(),
+            startTimer: (onChange) => startServerCheckTimer({
+                verifier,
+                logger,
+                intervalMs: positiveMs(env[`${PROXY_ENV_PREFIX}SERVER_CHECK_INTERVAL_MS`]),
+                onChange,
+            }),
+        }),
+    };
+}
+//# sourceMappingURL=proxy.js.map

package/dist/commands/mcp/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../../src/commands/mcp/proxy.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,KAAK,EAAoB,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAyB,MAAM,qCAAqC,CAAC;AACpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAA4B,MAAM,iCAAiC,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,aAAa,EAA8B,MAAM,wBAAwB,CAAC;AAClG,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACxE,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,GAGlB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,MAAM,EACN,oBAAoB,GACrB,MAAM,8BAA8B,CAAC;AAoBtC,wEAAwE;AACxE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC;AAE5B,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA+B,EAC/B,OAAwB;IAExB,+CAA+C;IAC/C,EAAE;IACF,2EAA2E;IAC3E,8DAA8D;IAC9D,EAAE;IACF,+DAA+D;IAC/D,2EAA2E;IAC3E,uEAAuE;IACvE,sEAAsE;IACtE,sEAAsE;IACtE,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,IAAkB,CAAC;IACvB,IAAI,YAA0B,CAAC;IAC/B,qEAAqE;IACrE,0CAA0C;IAC1C,IAAI,kBAAsC,CAAC;IAC3C,wEAAwE;IACxE,0DAA0D;IAC1D,IAAI,SAAS,GAA8C,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzF,IAAI,CAAC;QACH,0EAA0E;QAC1E,qDAAqD;QACrD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,EAAE,KAAK,EAAE,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAClE,mEAAmE;YACnE,+CAA+C;YAC/C,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC;YACtB,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,kBAAkB,GAAG,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC;YAC1C,SAAS,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACpC,wDAAwD;YACxD,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB,IAAI,KAAK,YAAY,oBAAoB,EAAE,CAAC;YAChF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;YAC3D,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAa,OAAO,CAAC,QAAQ;QACtC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;QACjC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,WAAW,CAAC,CAAC,CAAC;IAE/D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ;QAC7B,CAAC,CAAC,YAAY,CAAC;YACX,KAAK;YACL,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC;YAC5B,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE;YAC5D,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,YAAY,CAAC,KAAK,GAAG;SACrE,CAAC;QACJ,CAAC,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAEvF,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,IAAI,CAAC,oDAAoD,EAAE;YAChE,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,aAAa,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM;YACxC,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,CAAC,IAAI,CACT,sEAAsE;YACpE,iEAAiE,EACnE,EAAE,QAAQ,EAAE,IAAI,EAAE,CACnB,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;IACtG,MAAM,iBAAiB,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,SAAS,CAAC,KAAK,GAAG,CAAC;IAC5E,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;QACtB,IAAI;QACJ,MAAM;QACN,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,OAAO,CAAC,MAA+B;QAC/C,YAAY,EAAE,OAAO,CAAC,OAAO;QAC7B,2EAA2E;QAC3E,yEAAyE;QACzE,kCAAkC;QAClC,IAAI,EACF,IAAI,CAAC,SAAS,KAAK,MAAM;YACvB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC1B,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,CAAC;aACrE,CAAC;YACJ,CAAC,CAAC,SAAS;QACf,eAAe,EACb,iBAAiB,IAAI,CAAC,KAAK,CAAC,SAAS;YACnC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACf,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC/B,IAAI,CAAC,iBAAiB;oBAAE,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YACzE,CAAC;QACP,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QACnE,yBAAyB,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,kBAAkB,CAAC,CAAC;QACzF,2BAA2B,EAAE,UAAU,CACrC,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,0BAA0B,CAAC,CAC3D;KACF,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,CAAC,MAAM,EAAE,EAAE;QAClB,MAAM,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7C,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC;AACrB,CAAC;AAED,iFAAiF;AACjF,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAID;;;;;;;;;;GAUG;AACH,SAAS,wBAAwB,CAC/B,OAA+B,EAC/B,OAAwB;IAExB,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IACnC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,eAAe,CAAC;IAC3D,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,cAAc,CAC3B,OAA+B,EAC/B,OAAwB,EACxB,MAAc;IAEd,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,MAAM,UAAU,GAAG,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,0EAA0E;QAC1E,gEAAgE;QAChE,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,yBAAyB,EAAE;YAC5E,MAAM,EAAE,UAAU;SACnB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;QAClC,MAAM,IAAI,GAAG,QAAQ,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAEZ,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACnF,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACvF,IAAI,OAAO,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC/C,OAAO;IACT,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE;QAC7B,OAAO;QACP,SAAS;QACT,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM;QAChC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO;KAC1B,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CACvB,IAAkB,EAClB,YAA0B,EAC1B,IAAwB,EACxB,MAAc,EACd,OAAwB,EACxB,kBAA2B;IAE3B,MAAM,YAAY,GAAkB,EAAE,CAAC;IACvC,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC9B,YAAY,CAAC,IAAI,CACf,qBAAqB,CAAC;YACpB,iEAAiE;YACjE,mDAAmD;YACnD,UAAU,EAAE,IAAI,IAAI,gBAAgB,CAAC,YAAY,CAAC;YAClD,cAAc,EAAE,iBAAiB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;YAC/D,YAAY,EAAE,OAAO,CAAC,OAAO;YAC7B,MAAM;SACP,CAAC,CACH,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;IAC/F,IAAI,MAAM;QAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAC;IACpC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACpD,OAAO;QACL,WAAW,EAAE,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;QAC9E,SAAS;KACV,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAC7B,IAAkB,EAClB,IAAwB,EACxB,MAAc,EACd,OAAwB,EACxB,kBAA2B;IAE3B,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,gBAAgB,WAAW,CAAC,KAAK,GAAG,EAAE,CAAC;QACxD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,yEAAyE;IACzE,8CAA8C;IAC9C,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,aAAa,CAC/D,IAAI,EACJ,IAAI,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAC9B,MAAM,EACN,OAAO,CAAC,GAAG,CACZ,CAAC;IAEF,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE;QAClC,QAAQ;QACR,OAAO,EAAE,OAAO,KAAK,IAAI;QACzB,YAAY,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,MAAM;KAClG,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;IACxB,yEAAyE;IACzE,yEAAyE;IACzE,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,QAAQ;QACvB,CAAC,CAAC,IAAI,WAAW,CAAC;YACd,QAAQ;YACR,iBAAiB,EAAE,OAAO,CAAC,OAAO;YAClC,kBAAkB;YAClB,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,iBAAiB,EAAE;YAC5C,cAAc,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE;YAC/C,SAAS,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,sBAAsB,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;YACtE,MAAM,EAAE,gBAAgB,CAAC,EAAE,GAAG,EAAE,CAAC;YACjC,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,mBAAmB,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/F,MAAM;YACN,YAAY,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,gBAAgB,iBAAiB,CAAC,CAAC;YACnE,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,gBAAgB,wBAAwB,CAAC,CAAC;SAC5E,CAAC;QACJ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,MAAM,GAAG,uBAAuB,CAAC;QACrC,QAAQ;QACR,MAAM;QACN,IAAI;QACJ,QAAQ;QACR,UAAU;QACV,sEAAsE;QACtE,0EAA0E;QAC1E,uEAAuE;QACvE,KAAK,EAAE,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC;QAC3B,MAAM,EAAE,QAAQ;KACjB,CAAC,CAAC;IAEH,OAAO;QACL,WAAW,EAAE,MAAM;QACnB,SAAS,EAAE,sBAAsB,CAAC;YAChC,QAAQ;YACR,iBAAiB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,iBAAiB,EAAE;YACnD,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE,CACvB,qBAAqB,CAAC;gBACpB,QAAQ;gBACR,MAAM;gBACN,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,gBAAgB,0BAA0B,CAAC,CAAC;gBAC1E,QAAQ;aACT,CAAC;SACL,CAAC;KACH,CAAC;AACJ,CAAC"}