@cybedefend/vibedefend 1.5.0 → 1.7.0

package/dist/mcp/report/reporter.js

@@ -0,0 +1,443 @@
+// ─── The call reporter: what the proxy decided, batched off the hot path ─────
+//
+// `event()` is called from the forwarding loop: it is synchronous, bounded and
+// never throws. Everything else runs on timers that never keep the process
+// alive. The first send goes FIRST_SEND_DELAY_MS after something happened,
+// then at most one send per MIN_SEND_INTERVAL_MS. A send appends its reports
+// to the on-disk buffer first and posts from there, so a backend that is down
+// or refusing loses nothing and the buffer's holds decide when it is asked
+// again: what a flush leaves (refused, timed out, held, or skipped because
+// another proxy held the flush lock) re-arms the one send timer for when it is
+// due, never sooner than MIN_SEND_INTERVAL_MS after the last send.
+//
+// A report carries the server's identity (D2), the inventory snapshot (D8)
+// and the coalesced events (D5), copied field by field: an input object is
+// never spread into a body, because the gateway strips unknown keys rather
+// than refusing them, and what it strips has already left the machine.
+import { readClientInfo } from '../proxy/intercept.js';
+import { EventCoalescer } from './coalesce.js';
+import { FIRST_SEND_DELAY_MS, INVENTORY_REFRESH_MS, MIN_SEND_INTERVAL_MS, REPORT_MAX_EVENTS, REPORT_MAX_TOOL_COUNT, } from './constants.js';
+import { reportProblems } from './validate.js';
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** A send that failed before its flush said anything: tried again like a lost lock. */
+const FLUSH_UNKNOWN = { ran: false, retryAt: null };
+export class McpReporter {
+    opts;
+    now;
+    firstDelayMs;
+    minIntervalMs;
+    refreshMs;
+    setTimeoutFn;
+    clearTimeoutFn;
+    coalescer;
+    /** Cleaned like a `clientInfo` name. */
+    fallbackClientName;
+    client;
+    /**
+     * Who the agent is is known: a clientInfo arrived, or `initialize` was answered
+     * (`start`). Until then the project is not resolved: a send carries none.
+     */
+    clientSettled = false;
+    listDecided = false;
+    lastSnapshotJson;
+    lastInventoryAt = 0;
+    lastSendAt;
+    /** Learnt from the last backend context: the backend and organisation `stop()` appends under. */
+    destination;
+    projectPromise;
+    projectIdKnown;
+    /** The one send timer, and when it fires: an earlier need moves it, a later one leaves it. */
+    sendTimer;
+    sendTimerAt;
+    refreshTimer;
+    running = false;
+    scheduleAfterRun = false;
+    stopped = false;
+    constructor(opts) {
+        this.opts = opts;
+        this.now = opts.now ?? Date.now;
+        this.firstDelayMs = opts.firstDelayMs ?? FIRST_SEND_DELAY_MS;
+        this.minIntervalMs = opts.minIntervalMs ?? MIN_SEND_INTERVAL_MS;
+        this.refreshMs = opts.refreshMs ?? INVENTORY_REFRESH_MS;
+        this.setTimeoutFn = opts.setTimeoutFn ?? setTimeout;
+        this.clearTimeoutFn = opts.clearTimeoutFn ?? clearTimeout;
+        this.coalescer = new EventCoalescer({ now: this.now });
+        this.fallbackClientName =
+            opts.fallbackClientName === undefined
+                ? undefined
+                : readClientInfo({ clientInfo: { name: opts.fallbackClientName } })?.name;
+    }
+    // ── The hot path ─────────────────────────────────────────────────────────
+    event(input) {
+        try {
+            if (this.stopped)
+                return;
+            this.coalescer.add(input);
+            this.schedule();
+        }
+        catch {
+            // A report is never worth a call.
+        }
+    }
+    noteClient(client) {
+        if (client === undefined)
+            return;
+        try {
+            const cleaned = readClientInfo({ clientInfo: client });
+            if (cleaned) {
+                this.client = cleaned;
+                this.clientSettled = true;
+            }
+        }
+        catch {
+            // Ignored: the fallback name is used.
+        }
+    }
+    noteListDecided() {
+        this.listDecided = true;
+        this.scheduleIfInventoryDue();
+    }
+    noteServerChanged() {
+        this.scheduleIfInventoryDue();
+    }
+    // ── Lifecycle ────────────────────────────────────────────────────────────
+    /**
+     * After `initialize` was answered, with the clientInfo it carried (none:
+     * `undefined`): who the agent is is settled. Flushes what earlier processes
+     * left, learns the organization, arms the hourly refresh.
+     */
+    start(client) {
+        if (this.stopped)
+            return;
+        this.noteClient(client);
+        this.clientSettled = true;
+        this.armRefresh();
+        void this.flushOnly();
+    }
+    /** Synchronous: what is pending goes to the buffer, for the next process to send. No network. */
+    stop() {
+        if (this.stopped)
+            return;
+        this.stopped = true;
+        if (this.sendTimer !== undefined)
+            this.clearTimeoutFn(this.sendTimer);
+        if (this.refreshTimer !== undefined)
+            this.clearTimeoutFn(this.refreshTimer);
+        this.sendTimer = undefined;
+        this.sendTimerAt = undefined;
+        this.refreshTimer = undefined;
+        try {
+            if (this.destination !== undefined && this.coalescer.hasPending()) {
+                this.drainToBuffer(this.destination, false);
+            }
+        }
+        catch {
+            // Best-effort: the session is ending.
+        }
+    }
+    /** One send: the pending reports to the buffer, then the buffer to the backend. Never rejects. */
+    async sendNow() {
+        this.retryLater(await this.sendOnce());
+    }
+    /** `ctx: null` when there was no backend context to send with. Never rejects. */
+    async sendOnce() {
+        let ctx = null;
+        try {
+            ctx = await this.context();
+            if (!ctx)
+                return { ctx: null }; // No organization, no send: everything stays in memory, bounded.
+            // Resolved once, and only once the agent is known: before that the send
+            // carries no project, and the resolution waits for the agent's name.
+            if (this.projectIdKnown === undefined && this.clientSettled) {
+                this.projectIdKnown = await this.project();
+            }
+            this.drainToBuffer(ctx, true);
+            return { ctx, flushed: await this.flush(ctx) };
+        }
+        catch (error) {
+            this.opts.logger.warn('report: a send failed, the reports wait in the buffer', {
+                error: error instanceof Error ? error.name : 'unknown',
+            });
+            return { ctx, flushed: FLUSH_UNKNOWN };
+        }
+    }
+    // ── Cadence ──────────────────────────────────────────────────────────────
+    schedule() {
+        if (this.stopped)
+            return;
+        if (this.running) {
+            this.scheduleAfterRun = true;
+            return;
+        }
+        const nowMs = this.now();
+        const sinceLast = this.lastSendAt === undefined ? 0 : this.lastSendAt + this.minIntervalMs - nowMs;
+        this.armAt(nowMs + Math.max(this.firstDelayMs, sinceLast));
+    }
+    /** One timer: an earlier time moves it, a later one leaves it where it is. */
+    armAt(at) {
+        if (this.stopped)
+            return;
+        if (this.sendTimer !== undefined && this.sendTimerAt !== undefined && this.sendTimerAt <= at)
+            return;
+        if (this.sendTimer !== undefined)
+            this.clearTimeoutFn(this.sendTimer);
+        this.sendTimerAt = at;
+        this.sendTimer = this.unref(this.setTimeoutFn(() => void this.tick(), Math.max(0, at - this.now())));
+    }
+    /**
+     * After a flush, the one timer for what it left of this backend's records:
+     * when its earliest hold ends (a refusal, a timeout, a 401 backoff), at once
+     * when something is due already (appended meanwhile), and after the minimum
+     * interval when the flush did not run (another proxy held the lock) — never
+     * sooner than the minimum interval after the last send.
+     */
+    retryLater(outcome) {
+        try {
+            if (this.stopped || !outcome.ctx || !outcome.flushed)
+                return;
+            const { ctx, flushed } = outcome;
+            const nowMs = this.now();
+            let at;
+            if (!flushed.ran)
+                at = nowMs + this.minIntervalMs;
+            else if (flushed.retryAt !== null)
+                at = flushed.retryAt;
+            else
+                at = this.opts.buffer.hasDue(ctx.apiBase, ctx.token) ? nowMs : null;
+            if (at === null)
+                return;
+            const floor = this.lastSendAt === undefined ? at : this.lastSendAt + this.minIntervalMs;
+            this.armAt(Math.max(at, floor));
+        }
+        catch {
+            // Ignored: the next event or the hourly refresh sends again.
+        }
+    }
+    scheduleIfInventoryDue() {
+        try {
+            if (this.inventoryDue(this.safeSnapshot()))
+                this.schedule();
+        }
+        catch {
+            // Ignored: the hourly refresh catches up.
+        }
+    }
+    async tick() {
+        this.sendTimer = undefined;
+        this.sendTimerAt = undefined;
+        if (this.stopped)
+            return;
+        if (this.running) {
+            // A send is still on its way: this one follows it, at the usual cadence.
+            this.scheduleAfterRun = true;
+            return;
+        }
+        this.running = true;
+        this.scheduleAfterRun = false;
+        let outcome = { ctx: null };
+        try {
+            outcome = await this.sendOnce();
+            // No context this time (offline, organization not resolved yet): what
+            // is waiting is tried again at the next allowed send, not left for a
+            // trigger that may never come.
+            if (!outcome.ctx && (this.coalescer.hasPending() || this.inventoryDue(this.safeSnapshot()))) {
+                this.scheduleAfterRun = true;
+            }
+        }
+        finally {
+            // When the send ENDED: a hold the flush set runs from its own clock, so
+            // the next send is never armed a few milliseconds before it is due.
+            this.lastSendAt = this.now();
+            this.running = false;
+            if (this.scheduleAfterRun)
+                this.schedule();
+            this.retryLater(outcome);
+        }
+    }
+    armRefresh() {
+        if (this.stopped)
+            return;
+        if (this.refreshTimer !== undefined)
+            this.clearTimeoutFn(this.refreshTimer);
+        this.refreshTimer = this.unref(this.setTimeoutFn(() => {
+            this.refreshTimer = undefined;
+            this.armRefresh();
+            this.schedule();
+        }, this.refreshMs));
+    }
+    inventoryDue(snapshot) {
+        if (!this.listDecided || snapshot === null)
+            return false;
+        if (this.lastSnapshotJson === undefined)
+            return true;
+        if (JSON.stringify(snapshot) !== this.lastSnapshotJson)
+            return true;
+        return this.now() - this.lastInventoryAt >= this.refreshMs;
+    }
+    // ── Building and sending ─────────────────────────────────────────────────
+    /**
+     * Turns the pending events (and the inventory when it is due) into reports,
+     * appended to the buffer under the backend and organisation they are for.
+     * Synchronous, no network.
+     */
+    drainToBuffer(destination, withInventory) {
+        const snapshot = this.safeSnapshot();
+        if (snapshot === null)
+            return; // Nothing to say about the server yet: the events wait.
+        const nowMs = this.now();
+        const base = this.body(snapshot, new Date(nowMs).toISOString(), []);
+        const baseProblems = reportProblems(base);
+        const pending = this.coalescer.pending(Number.MAX_SAFE_INTEGER);
+        if (baseProblems.length > 0) {
+            // Field names only: never a value.
+            this.opts.logger.warn('report: the server part of a report is invalid, nothing is sent', {
+                problems: baseProblems,
+            });
+            this.coalescer.markSent(pending);
+            return;
+        }
+        const events = [];
+        for (const raw of pending) {
+            const event = copyEvent(raw);
+            if (reportProblems({ ...base, events: [event] }).length > 0) {
+                this.opts.logger.warn('report: an event the contract refuses is dropped', {
+                    kind: String(raw.kind),
+                    reason: String(raw.reason),
+                });
+                this.coalescer.markSent([raw]);
+                continue;
+            }
+            events.push(event);
+        }
+        const chunks = [];
+        for (let i = 0; i < events.length; i += REPORT_MAX_EVENTS) {
+            chunks.push(events.slice(i, i + REPORT_MAX_EVENTS));
+        }
+        if (chunks.length === 0 && withInventory && this.inventoryDue(snapshot))
+            chunks.push([]);
+        if (chunks.length === 0)
+            return;
+        for (const chunk of chunks) {
+            this.opts.buffer.append(destination.apiBase, destination.organizationId, { ...base, events: chunk });
+            this.coalescer.markSent(chunk);
+        }
+        this.lastSnapshotJson = JSON.stringify(snapshot);
+        this.lastInventoryAt = nowMs;
+        this.armRefresh();
+    }
+    body(snapshot, seenAt, events) {
+        const id = this.opts.identity;
+        const server = {
+            serverKey: id.serverKey,
+            kind: id.kind,
+            ...(id.host !== undefined ? { host: id.host } : {}),
+            ...(id.package !== undefined
+                ? {
+                    package: {
+                        ecosystem: id.package.ecosystem,
+                        name: id.package.name,
+                        ...(id.package.version !== undefined ? { version: id.package.version } : {}),
+                    },
+                }
+                : {}),
+            ...(id.label !== undefined ? { label: id.label } : {}),
+            verdict: snapshot.verdict,
+            action: snapshot.action,
+            blockedBy: snapshot.blockedBy ?? null,
+            advisoryIds: [...(snapshot.advisoryIds ?? [])],
+            // The gateway refuses a count past its bound with a 400 that would cost the
+            // whole report: a server this large is told as the largest it accepts.
+            toolCount: Math.min(snapshot.toolCount, REPORT_MAX_TOOL_COUNT),
+            flaggedToolCount: Math.min(snapshot.flaggedToolCount, REPORT_MAX_TOOL_COUNT),
+            ...(snapshot.flaggedTools !== undefined
+                ? { flaggedTools: snapshot.flaggedTools.map((t) => ({ name: t.name, digest: t.digest })) }
+                : {}),
+            seenAt,
+        };
+        const name = this.client?.name ?? this.fallbackClientName ?? 'unknown';
+        const version = this.client?.name !== undefined ? this.client.version : undefined;
+        const projectId = this.projectIdKnown;
+        return {
+            vibedefendVersion: this.opts.vibedefendVersion,
+            client: version !== undefined ? { name, version } : { name },
+            ...(typeof projectId === 'string' && UUID.test(projectId) ? { projectId } : {}),
+            server,
+            events,
+        };
+    }
+    /** Posts the records made for this context's backend, and those only. */
+    flush(ctx) {
+        return this.opts.buffer.flush(ctx.apiBase, ctx.token, (organizationId, body) => this.opts.post({
+            apiBase: ctx.apiBase,
+            token: ctx.token,
+            mcpName: ctx.mcpName,
+            organizationId,
+        }, body));
+    }
+    /** `start()`'s flush: no new report, only what is waiting. */
+    async flushOnly() {
+        try {
+            const ctx = await this.context();
+            if (!ctx)
+                return;
+            // No project lookup here: it is a request of its own, made only once
+            // there is a report to file under it.
+            this.retryLater({ ctx, flushed: await this.flush(ctx) });
+        }
+        catch {
+            // Best-effort: the next send flushes again.
+        }
+    }
+    async context() {
+        let ctx;
+        try {
+            ctx = await this.opts.backendContext();
+        }
+        catch {
+            return null;
+        }
+        if (!ctx || !ctx.organizationId)
+            return null;
+        this.destination = { apiBase: ctx.apiBase, organizationId: ctx.organizationId };
+        return ctx;
+    }
+    /** Resolved once per process, for the agent's declared name; never rejects. */
+    project() {
+        this.projectPromise ??= Promise.resolve()
+            .then(() => this.opts.projectId(this.client?.name))
+            .catch(() => null);
+        return this.projectPromise;
+    }
+    safeSnapshot() {
+        try {
+            return this.opts.snapshot();
+        }
+        catch {
+            return null;
+        }
+    }
+    unref(handle) {
+        const unref = handle?.unref;
+        if (typeof unref === 'function')
+            unref.call(handle);
+        return handle;
+    }
+}
+/** An event as it leaves the machine, field by field. */
+function copyEvent(e) {
+    return {
+        eventId: e.eventId,
+        kind: e.kind,
+        reason: e.reason,
+        tool: e.tool,
+        ...(e.toolDigest !== undefined ? { toolDigest: e.toolDigest } : {}),
+        ...(e.verdict !== undefined ? { verdict: e.verdict } : {}),
+        ...(e.category !== undefined ? { category: e.category } : {}),
+        ...(e.severity !== undefined ? { severity: e.severity } : {}),
+        ...(e.rules !== undefined ? { rules: [...e.rules] } : {}),
+        count: e.count,
+        firstAt: e.firstAt,
+        lastAt: e.lastAt,
+    };
+}
+//# sourceMappingURL=reporter.js.map

package/dist/mcp/report/reporter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reporter.js","sourceRoot":"","sources":["../../../src/mcp/report/reporter.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,2EAA2E;AAC3E,+EAA+E;AAC/E,mEAAmE;AACnE,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,uEAAuE;AAEvE,OAAO,EAAE,cAAc,EAAwB,MAAM,uBAAuB,CAAC;AAM7E,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAQ/C,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAU/E,uFAAuF;AACvF,MAAM,aAAa,GAAgB,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AA0BjE,MAAM,OAAO,WAAW;IACL,IAAI,CAAqB;IACzB,GAAG,CAAe;IAClB,YAAY,CAAS;IACrB,aAAa,CAAS;IACtB,SAAS,CAAS;IAClB,YAAY,CAAoB;IAChC,cAAc,CAAsB;IACpC,SAAS,CAAiB;IAC3C,wCAAwC;IACvB,kBAAkB,CAAU;IAErC,MAAM,CAAmB;IACjC;;;OAGG;IACK,aAAa,GAAG,KAAK,CAAC;IACtB,WAAW,GAAG,KAAK,CAAC;IACpB,gBAAgB,CAAU;IAC1B,eAAe,GAAG,CAAC,CAAC;IACpB,UAAU,CAAU;IAC5B,iGAAiG;IACzF,WAAW,CAA+C;IAC1D,cAAc,CAA0B;IACxC,cAAc,CAAiB;IAEvC,8FAA8F;IACtF,SAAS,CAAe;IACxB,WAAW,CAAU;IACrB,YAAY,CAAe;IAC3B,OAAO,GAAG,KAAK,CAAC;IAChB,gBAAgB,GAAG,KAAK,CAAC;IACzB,OAAO,GAAG,KAAK,CAAC;IAExB,YAAY,IAAwB;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,mBAAmB,CAAC;QAC7D,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,oBAAoB,CAAC;QAChE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,oBAAoB,CAAC;QACxD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC;QACpD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,YAAY,CAAC;QAC1D,IAAI,CAAC,SAAS,GAAG,IAAI,cAAc,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,kBAAkB;YACrB,IAAI,CAAC,kBAAkB,KAAK,SAAS;gBACnC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,cAAc,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC;IAChF,CAAC;IAED,4EAA4E;IAE5E,KAAK,CAAC,KAAqB;QACzB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,kCAAkC;QACpC,CAAC;IACH,CAAC;IAED,UAAU,CAAC,MAAwB;QACjC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO;QACjC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,cAAc,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;YACvD,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC;gBACtB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,eAAe;QACb,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QACxB,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAChC,CAAC;IAED,iBAAiB;QACf,IAAI,CAAC,sBAAsB,EAAE,CAAC;IAChC,CAAC;IAED,4EAA4E;IAE5E;;;;OAIG;IACH,KAAK,CAAC,MAAwB;QAC5B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;IACxB,CAAC;IAED,iGAAiG;IACjG,IAAI;QACF,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5E,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC;gBAClE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzC,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,QAAQ;QACpB,IAAI,GAAG,GAAqB,IAAI,CAAC;QACjC,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,iEAAiE;YACjG,wEAAwE;YACxE,qEAAqE;YACrE,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC5D,IAAI,CAAC,cAAc,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7C,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC9B,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;gBAC7E,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aACvD,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;QACzC,CAAC;IACH,CAAC;IAED,4EAA4E;IAEpE,QAAQ;QACd,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,SAAS,GACb,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;QACnF,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,EAAU;QACtB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,IAAI,EAAE;YAAE,OAAO;QACrG,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CACzB,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CACxE,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,UAAU,CAAC,OAAoB;QACrC,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,OAAO;YAC7D,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,IAAI,EAAiB,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,GAAG;gBAAE,EAAE,GAAG,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC;iBAC7C,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;gBAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;;gBACnD,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YACzE,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO;YACxB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC;YACxF,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;IAEO,sBAAsB;QAC5B,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;gBAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;QAC7B,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,yEAAyE;YACzE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC7B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC;QAC9B,IAAI,OAAO,GAAgB,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChC,sEAAsE;YACtE,qEAAqE;YACrE,+BAA+B;YAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,CAAC;gBAC5F,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAC/B,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,wEAAwE;YACxE,oEAAoE;YACpE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,IAAI,IAAI,CAAC,gBAAgB;gBAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5E,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,KAAK,CAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE;YACrB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;YAC9B,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CACnB,CAAC;IACJ,CAAC;IAEO,YAAY,CAAC,QAAkC;QACrD,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACzD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACrD,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,gBAAgB;YAAE,OAAO,IAAI,CAAC;QACpE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,SAAS,CAAC;IAC7D,CAAC;IAED,4EAA4E;IAE5E;;;;OAIG;IACK,aAAa,CACnB,WAAwD,EACxD,aAAsB;QAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,CAAC,wDAAwD;QACvF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAChE,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,mCAAmC;YACnC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iEAAiE,EAAE;gBACvF,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAqB,EAAE,CAAC;QACpC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,cAAc,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kDAAkD,EAAE;oBACxE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;oBACtB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;iBAC3B,CAAC,CAAC;gBACH,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAED,MAAM,MAAM,GAAuB,EAAE,CAAC;QACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,iBAAiB,EAAE,CAAC;YAC1D,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,aAAa,IAAI,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACzF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEhC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,WAAW,CAAC,cAAc,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACrG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAEO,IAAI,CAAC,QAA2B,EAAE,MAAc,EAAE,MAAwB;QAChF,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC9B,MAAM,MAAM,GAAoB;YAC9B,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,EAAE,CAAC,OAAO,KAAK,SAAS;gBAC1B,CAAC,CAAC;oBACE,OAAO,EAAE;wBACP,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS;wBAC/B,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI;wBACrB,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC7E;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,SAAS,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI;YACrC,WAAW,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YAC9C,4EAA4E;YAC5E,uEAAuE;YACvE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;YAC9D,gBAAgB,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;YAC5E,GAAG,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS;gBACrC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE;gBAC1F,CAAC,CAAC,EAAE,CAAC;YACP,MAAM;SACP,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,IAAI,CAAC,kBAAkB,IAAI,SAAS,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAClF,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC;QACtC,OAAO;YACL,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,iBAAiB;YAC9C,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;YAC5D,GAAG,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,MAAM;YACN,MAAM;SACP,CAAC;IACJ,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,GAAc;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,CAC7E,IAAI,CAAC,IAAI,CAAC,IAAI,CACZ;YACE,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,cAAc;SACf,EACD,IAAI,CACL,CACF,CAAC;IACJ,CAAC;IAED,8DAA8D;IACtD,KAAK,CAAC,SAAS;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,GAAG;gBAAE,OAAO;YACjB,qEAAqE;YACrE,sCAAsC;YACtC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,4CAA4C;QAC9C,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,OAAO;QACnB,IAAI,GAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;QAChF,OAAO,GAAG,CAAC;IACb,CAAC;IAED,+EAA+E;IACvE,OAAO;QACb,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,OAAO,EAAE;aACtC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;aAClD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAmB;QAC/B,MAAM,KAAK,GAAI,MAAgD,EAAE,KAAK,CAAC;QACvE,IAAI,OAAO,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,yDAAyD;AACzD,SAAS,SAAS,CAAC,CAAiB;IAClC,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,MAAM,EAAE,CAAC,CAAC,MAAM;KACjB,CAAC;AACJ,CAAC"}

package/dist/mcp/report/types.js

@@ -0,0 +1,3 @@
+// ─── The body of a call report (contract C4) ─────────────────────────────────
+export {};
+//# sourceMappingURL=types.js.map

package/dist/mcp/report/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/mcp/report/types.ts"],"names":[],"mappings":"AAAA,gFAAgF"}

package/dist/mcp/report/validate.js

@@ -0,0 +1,179 @@
+// ─── Validation of a report body before it is sent or buffered (contract C4, C5) ──
+//
+// The gateway strips unknown keys and answers 400 on a bound it checks. A body
+// that cannot pass is not worth a request, and one that holds something outside
+// these patterns must not leave the machine. Returns every problem found;
+// an empty list means the body is valid.
+import { HOST_PATTERN, LABEL_PATTERN, NPM_NAME_PATTERN, PACKAGE_VERSION_PATTERN, PYPI_NAME_PATTERN, REPORT_MAX_EVENT_COUNT, REPORT_MAX_EVENTS, REPORT_MAX_TOOL_COUNT, SERVER_KEY_PATTERN, VIBEDEFEND_VERSION_PATTERN, } from './constants.js';
+const UUID_V4 = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const TOOL = /^[A-Za-z0-9._/-]{1,128}$/;
+const DIGEST = /^d1:[0-9a-f]{64}$/;
+const RULE = /^[a-z0-9._-]{1,64}$/;
+const ADVISORY_ID = /^[A-Za-z0-9._:-]{1,64}$/;
+const CATEGORY = /^[a-z0-9_-]{1,64}$/;
+const SEVERITY = /^[a-z]{1,16}$/;
+const ISO_8601 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?(?:Z|[+-]\d{2}:\d{2})$/;
+const SERVER_KINDS = ['remote', 'package', 'local'];
+const VERDICTS = ['malicious', 'suspicious', 'clean', 'unverified'];
+const ACTIONS = ['allow', 'ask', 'warn', 'block', 'pending'];
+const BLOCKED_BY = ['verdict', 'advisory', 'organization'];
+/** C5: the reasons each kind of event may carry. */
+const REASONS = {
+    refused: ['verdict', 'advisory', 'organization', 'declined', 'unanswered'],
+    accepted: ['asked'],
+    warned: ['warn_mode', 'cannot_ask'],
+    injection: ['withheld', 'framed'],
+};
+const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const isStr = (v, re) => typeof v === 'string' && re.test(v);
+const isTime = (v) => typeof v === 'string' && ISO_8601.test(v) && Number.isFinite(Date.parse(v));
+const isCount = (v, min, max) => typeof v === 'number' && Number.isInteger(v) && v >= min && v <= max;
+export function reportProblems(body) {
+    const problems = [];
+    const bad = (msg) => {
+        problems.push(msg);
+    };
+    if (!isObj(body))
+        return ['body is not an object'];
+    if (!isStr(body.vibedefendVersion, VIBEDEFEND_VERSION_PATTERN) ||
+        body.vibedefendVersion.length > 32) {
+        bad('vibedefendVersion');
+    }
+    const client = body.client;
+    if (!isObj(client))
+        bad('client');
+    else {
+        if (typeof client.name !== 'string' || client.name === '' || client.name.length > 128) {
+            bad('client.name');
+        }
+        if (client.version !== undefined &&
+            (typeof client.version !== 'string' || client.version.length > 128)) {
+            bad('client.version');
+        }
+    }
+    if (body.projectId !== undefined && !isStr(body.projectId, UUID))
+        bad('projectId');
+    const server = body.server;
+    if (!isObj(server))
+        bad('server');
+    else
+        checkServer(server, bad);
+    const events = body.events;
+    if (!Array.isArray(events))
+        bad('events');
+    else {
+        if (events.length > REPORT_MAX_EVENTS)
+            bad(`events: more than ${REPORT_MAX_EVENTS}`);
+        events.forEach((e, i) => checkEvent(e, i, bad));
+    }
+    return problems;
+}
+function checkServer(s, bad) {
+    if (!isStr(s.serverKey, SERVER_KEY_PATTERN))
+        bad('server.serverKey');
+    if (typeof s.kind !== 'string' || !SERVER_KINDS.includes(s.kind))
+        bad('server.kind');
+    if (s.label !== undefined && !isStr(s.label, LABEL_PATTERN))
+        bad('server.label');
+    if (typeof s.verdict !== 'string' || !VERDICTS.includes(s.verdict))
+        bad('server.verdict');
+    if (typeof s.action !== 'string' || !ACTIONS.includes(s.action))
+        bad('server.action');
+    if (s.blockedBy !== null && s.blockedBy !== undefined) {
+        if (typeof s.blockedBy !== 'string' || !BLOCKED_BY.includes(s.blockedBy)) {
+            bad('server.blockedBy');
+        }
+    }
+    if (!Array.isArray(s.advisoryIds) || s.advisoryIds.length > 10)
+        bad('server.advisoryIds');
+    else if (!s.advisoryIds.every((id) => isStr(id, ADVISORY_ID)))
+        bad('server.advisoryIds[]');
+    if (!isCount(s.toolCount, 0, REPORT_MAX_TOOL_COUNT))
+        bad('server.toolCount');
+    if (!isCount(s.flaggedToolCount, 0, REPORT_MAX_TOOL_COUNT))
+        bad('server.flaggedToolCount');
+    if (!isTime(s.seenAt))
+        bad('server.seenAt');
+    if (s.flaggedTools !== undefined) {
+        if (!Array.isArray(s.flaggedTools) || s.flaggedTools.length > 20)
+            bad('server.flaggedTools');
+        else {
+            for (const t of s.flaggedTools) {
+                if (!isObj(t) || !isStr(t.name, TOOL) || !isStr(t.digest, DIGEST)) {
+                    bad('server.flaggedTools[]');
+                    break;
+                }
+            }
+        }
+    }
+    // kind decides which identity field is required.
+    if (s.kind === 'remote') {
+        if (!isStr(s.host, HOST_PATTERN))
+            bad('server.host (required for remote)');
+    }
+    else if (s.host !== undefined && !isStr(s.host, HOST_PATTERN)) {
+        bad('server.host');
+    }
+    if (s.kind === 'package') {
+        const p = s.package;
+        if (!isObj(p))
+            bad('server.package (required for package)');
+        else {
+            if (p.ecosystem !== 'npm' && p.ecosystem !== 'pypi')
+                bad('server.package.ecosystem');
+            else if (!isStr(p.name, p.ecosystem === 'npm' ? NPM_NAME_PATTERN : PYPI_NAME_PATTERN)) {
+                bad('server.package.name');
+            }
+            if (p.version !== undefined && !isStr(p.version, PACKAGE_VERSION_PATTERN)) {
+                bad('server.package.version');
+            }
+        }
+    }
+    if (s.kind === 'local' && !isStr(s.label, LABEL_PATTERN)) {
+        bad('server.label (required for local)');
+    }
+}
+function checkEvent(e, i, bad) {
+    const at = `events[${i}]`;
+    if (!isObj(e))
+        return bad(at);
+    if (!isStr(e.eventId, UUID_V4))
+        bad(`${at}.eventId`);
+    const reasons = typeof e.kind === 'string' ? REASONS[e.kind] : undefined;
+    if (!reasons)
+        bad(`${at}.kind`);
+    else if (typeof e.reason !== 'string' || !reasons.includes(e.reason)) {
+        bad(`${at}.reason (${String(e.kind)})`);
+    }
+    if (!isStr(e.tool, TOOL))
+        bad(`${at}.tool`);
+    if (e.toolDigest !== undefined && !isStr(e.toolDigest, DIGEST))
+        bad(`${at}.toolDigest`);
+    if (e.verdict !== undefined && (typeof e.verdict !== 'string' || !VERDICTS.includes(e.verdict))) {
+        bad(`${at}.verdict`);
+    }
+    if (e.category !== undefined && !isStr(e.category, CATEGORY))
+        bad(`${at}.category`);
+    if (e.severity !== undefined && !isStr(e.severity, SEVERITY))
+        bad(`${at}.severity`);
+    if (e.rules !== undefined) {
+        if (!Array.isArray(e.rules) || e.rules.length > 5 || !e.rules.every((r) => isStr(r, RULE))) {
+            bad(`${at}.rules`);
+        }
+    }
+    if (!isCount(e.count, 1, REPORT_MAX_EVENT_COUNT))
+        bad(`${at}.count`);
+    const firstOk = isTime(e.firstAt);
+    const lastOk = isTime(e.lastAt);
+    if (!firstOk)
+        bad(`${at}.firstAt`);
+    if (!lastOk)
+        bad(`${at}.lastAt`);
+    else if (firstOk && Date.parse(e.lastAt) < Date.parse(e.firstAt)) {
+        // An event never ends before it starts, judged on the instants. One defect
+        // is named once: an instant that is not an instant is left to its own check.
+        bad(`${at}.lastAt (earlier than firstAt)`);
+    }
+}
+//# sourceMappingURL=validate.js.map