@dzhechkov/harness-core 0.3.23 → 0.3.24

package/dist/mcp-scan.d.ts

@@ -0,0 +1,75 @@
+/**
+ * `dz mcp-scan` — "npm audit for agent tools".
+ *
+ * A deterministic, static (no-execution) security scan of a project's agent
+ * permission surface. It reads Claude-Code-style `.claude/settings*.json`
+ * permission grants and MCP server declarations (`.mcp.json`, `.vscode/mcp.json`)
+ * and emits a three-tier verdict (`clean` / `medium` / `high`) with findings.
+ *
+ * The rule set is adapted from the MetaHarness `threat-model` skill
+ * (ruvnet/agent-harness-generator) and mapped onto the Claude Code permission
+ * grammar. See `docs/research/metaharness-analysis.md` §1.
+ *
+ * Semantics (verified against the MetaHarness rules + Claude Code merge model):
+ *  - settings.json and settings.local.json are evaluated as a MERGED surface
+ *    (union of allow, union of deny); deny wins over allow.
+ *  - findings are reported per CAPABILITY (one shell / network / write finding
+ *    with a count + examples), not per individual grant.
+ *  - secrets-reachability requires MCP to be active (per MetaHarness).
+ *  - `low`-severity findings are informational and do NOT change the verdict.
+ *
+ * Verdict (highest non-low severity wins):
+ *  - `high`   (exit 2): shell granted · default-deny off · secrets reachable ·
+ *                       hardcoded secret in MCP env · all-MCP-servers enabled ·
+ *                       MCP server runs an interpreter / package-runner
+ *  - `medium` (exit 1): network granted · file-write granted · remote MCP server
+ *  - `clean`  (exit 0): no high/medium findings (low/info may still be present)
+ *
+ * @packageDocumentation
+ */
+import { type CapabilityClass } from './capability-vocab.js';
+/** Re-exported for back-compat (was historically exported from this module). */
+export { parseGrant } from './capability-vocab.js';
+/** Severity of a single finding. `low` is informational (verdict-neutral). */
+export type McpSeverity = 'high' | 'medium' | 'low';
+/** The capability class a finding concerns. */
+export type McpCapability = CapabilityClass;
+/** A single static-scan finding. */
+export interface McpFinding {
+    /** Stable rule id, e.g. `MS-SHELL-GRANT`. */
+    readonly id: string;
+    readonly severity: McpSeverity;
+    readonly capability: McpCapability;
+    /** Relative path / source the finding came from. */
+    readonly source: string;
+    /** Human-readable explanation. */
+    readonly detail: string;
+    /** The grant / value (or aggregated count + examples) that triggered the rule. */
+    readonly evidence: string;
+}
+/** The overall verdict. `clean` when there are zero high/medium findings. */
+export type McpVerdict = 'clean' | 'medium' | 'high';
+/** Result of {@link scanMcp}. */
+export interface McpScanReport {
+    readonly verdict: McpVerdict;
+    /** Process exit code: clean=0, medium=1, high=2. */
+    readonly exitCode: 0 | 1 | 2;
+    readonly findings: readonly McpFinding[];
+    /** Relative paths actually read during the scan. */
+    readonly scanned: readonly string[];
+    /** Derived capability flags (for badges / `--json`). */
+    readonly capabilities: {
+        readonly shell: boolean;
+        readonly network: boolean;
+        readonly fileWrite: boolean;
+        readonly secretsReachable: boolean;
+        /** Scoped to the `.claude/settings*.json` surface. */
+        readonly defaultDeny: boolean;
+    };
+}
+/**
+ * Statically scan a project/pack root for an unsafe agent permission surface.
+ * Deterministic and read-only — never executes anything it finds.
+ */
+export declare function scanMcp(rootDir: string): McpScanReport;
+//# sourceMappingURL=mcp-scan.d.ts.map

package/dist/mcp-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-scan.d.ts","sourceRoot":"","sources":["../src/mcp-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAKH,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAE/B,gFAAgF;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEpD,+CAA+C;AAC/C,MAAM,MAAM,aAAa,GAAG,eAAe,CAAC;AAE5C,oCAAoC;AACpC,MAAM,WAAW,UAAU;IACzB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,oDAAoD;IACpD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,6EAA6E;AAC7E,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAErD,iCAAiC;AACjC,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B,oDAAoD;IACpD,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;IACzC,oDAAoD;IACpD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,wDAAwD;IACxD,QAAQ,CAAC,YAAY,EAAE;QACrB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;QAC5B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;QACnC,sDAAsD;QACtD,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;KAC/B,CAAC;CACH;AAqPD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CA2JtD"}

package/dist/mcp-scan.js

@@ -0,0 +1,383 @@
+/**
+ * `dz mcp-scan` — "npm audit for agent tools".
+ *
+ * A deterministic, static (no-execution) security scan of a project's agent
+ * permission surface. It reads Claude-Code-style `.claude/settings*.json`
+ * permission grants and MCP server declarations (`.mcp.json`, `.vscode/mcp.json`)
+ * and emits a three-tier verdict (`clean` / `medium` / `high`) with findings.
+ *
+ * The rule set is adapted from the MetaHarness `threat-model` skill
+ * (ruvnet/agent-harness-generator) and mapped onto the Claude Code permission
+ * grammar. See `docs/research/metaharness-analysis.md` §1.
+ *
+ * Semantics (verified against the MetaHarness rules + Claude Code merge model):
+ *  - settings.json and settings.local.json are evaluated as a MERGED surface
+ *    (union of allow, union of deny); deny wins over allow.
+ *  - findings are reported per CAPABILITY (one shell / network / write finding
+ *    with a count + examples), not per individual grant.
+ *  - secrets-reachability requires MCP to be active (per MetaHarness).
+ *  - `low`-severity findings are informational and do NOT change the verdict.
+ *
+ * Verdict (highest non-low severity wins):
+ *  - `high`   (exit 2): shell granted · default-deny off · secrets reachable ·
+ *                       hardcoded secret in MCP env · all-MCP-servers enabled ·
+ *                       MCP server runs an interpreter / package-runner
+ *  - `medium` (exit 1): network granted · file-write granted · remote MCP server
+ *  - `clean`  (exit 0): no high/medium findings (low/info may still be present)
+ *
+ * @packageDocumentation
+ */
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { SHELL_TOOLS, INTERPRETER_RE, PACKAGE_RUNNERS, INLINE_CODE_ARGS, SHELL_NET_RE, SHELL_WRITE_RE, SECRET_FILE_RE, MAX_FILE_BYTES, parseGrant, isWildcard, toolKind, } from './capability-vocab.js';
+/** Re-exported for back-compat (was historically exported from this module). */
+export { parseGrant } from './capability-vocab.js';
+/** Compile a Claude arg glob (`*` wildcard) to a RegExp. */
+function globToRe(arg) {
+    const esc = arg.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*');
+    return new RegExp(`^${esc}$`);
+}
+/** True when a deny rule covers a grant (deny wins). Case-insensitive on tool. */
+function denyCovers(grant, denyList) {
+    const g = parseGrant(grant);
+    return denyList.some((d) => {
+        const dd = parseGrant(d);
+        if (dd.tool === '*')
+            return true;
+        if (dd.tool.toLowerCase() !== g.tool.toLowerCase())
+            return false;
+        if (dd.arg === null)
+            return true; // bare-tool deny covers every arg
+        if (g.arg === null)
+            return false;
+        try {
+            return globToRe(dd.arg).test(g.arg);
+        }
+        catch {
+            return dd.arg === g.arg;
+        }
+    });
+}
+/** True when the deny list actually protects secret FILE locations. */
+function denyProtectsSecrets(denyList) {
+    return denyList.some((d) => {
+        const { tool, arg } = parseGrant(d);
+        const t = tool.toLowerCase();
+        if (t !== 'read' && t !== 'glob' && t !== '*' && t !== 'bash')
+            return false;
+        return arg !== null && SECRET_FILE_RE.test(arg);
+    });
+}
+/** Heuristic: does an MCP env value look like a hardcoded secret (not a `${VAR}` ref)? */
+function looksLikeHardcodedSecret(key, value) {
+    if (typeof value !== 'string')
+        return false;
+    if (!/key|token|secret|password|api|credential|auth/i.test(key))
+        return false;
+    const v = value.trim();
+    if (v === '')
+        return false;
+    if (/^\$\{?\w+\}?$/.test(v))
+        return false; // pure ${VAR} / $VAR reference
+    if (/^(true|false|production|development|test|none|null|\d+)$/i.test(v))
+        return false;
+    return v.length >= 8;
+}
+function readJson(path) {
+    try {
+        const st = lstatSync(path);
+        if (st.isSymbolicLink() || !st.isFile() || st.size > MAX_FILE_BYTES)
+            return null;
+        return JSON.parse(readFileSync(path, 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+}
+function asStringArray(value) {
+    return Array.isArray(value) ? value.filter((x) => typeof x === 'string') : [];
+}
+function isPlainObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+// ---------------------------------------------------------------------------
+// scanners
+// ---------------------------------------------------------------------------
+function scanSettings(root, rel, acc) {
+    const abs = join(root, rel);
+    if (!existsSync(abs))
+        return;
+    const data = readJson(abs);
+    if (!isPlainObject(data))
+        return;
+    acc.scanned.push(rel);
+    acc.hasSettings = true;
+    const perms = isPlainObject(data['permissions']) ? data['permissions'] : {};
+    const allow = asStringArray(perms['allow']);
+    const deny = asStringArray(perms['deny']);
+    acc.denyRules.push(...deny);
+    if (deny.length > 0)
+        acc.hasDeny = true;
+    for (const grant of allow) {
+        const { tool, arg } = parseGrant(grant);
+        if (grant.trim() === '*' || (SHELL_TOOLS.has(tool.toLowerCase()) && arg === null)) {
+            acc.wildcardAll = true;
+        }
+        const kind = toolKind(tool);
+        switch (kind) {
+            case 'shell':
+                acc.shellGrants.push(grant);
+                if (arg !== null && SHELL_NET_RE.test(arg))
+                    acc.shellArgNetwork.push(grant);
+                if (arg !== null && SHELL_WRITE_RE.test(arg))
+                    acc.shellArgWrite.push(grant);
+                break;
+            case 'network':
+                acc.networkGrants.push(grant);
+                break;
+            case 'file-write':
+                acc.writeGrants.push(grant);
+                break;
+            case 'read':
+                acc.hasReadGrant = true;
+                break;
+            case 'mcp':
+                acc.mcpToolGrants.push(grant);
+                acc.mcpActive = true;
+                break;
+            case 'safe':
+                break;
+            default:
+                acc.unknownTools.push(grant);
+        }
+    }
+    if (data['enableAllProjectMcpServers'] === true) {
+        acc.enableAllMcp = true;
+        acc.enableAllMcpSource = rel;
+        acc.mcpActive = true;
+    }
+    if (Array.isArray(data['enabledMcpjsonServers']) && data['enabledMcpjsonServers'].length > 0) {
+        acc.mcpActive = true;
+    }
+}
+function scanMcpServers(root, rel, acc) {
+    const abs = join(root, rel);
+    if (!existsSync(abs))
+        return;
+    const data = readJson(abs);
+    if (!isPlainObject(data))
+        return;
+    acc.scanned.push(rel);
+    const merged = {};
+    if (isPlainObject(data['mcpServers']))
+        Object.assign(merged, data['mcpServers']);
+    if (isPlainObject(data['servers']))
+        Object.assign(merged, data['servers']);
+    if (Object.keys(merged).length > 0)
+        acc.mcpActive = true;
+    for (const [name, raw] of Object.entries(merged)) {
+        if (!isPlainObject(raw))
+            continue;
+        const type = typeof raw['type'] === 'string' ? raw['type'] : '';
+        const url = typeof raw['url'] === 'string' ? raw['url'] : '';
+        const command = typeof raw['command'] === 'string' ? raw['command'] : '';
+        const args = asStringArray(raw['args']);
+        const env = isPlainObject(raw['env']) ? raw['env'] : {};
+        if (type === 'sse' || type === 'http' || url !== '') {
+            acc.serverNetwork = true;
+            acc.findings.push({
+                id: 'MS-MCP-REMOTE',
+                severity: 'medium',
+                capability: 'network',
+                source: rel,
+                detail: `MCP server "${name}" is remote (${type || 'url'}) — sends data to an external endpoint.`,
+                evidence: url || type,
+            });
+        }
+        const cmdBase = basename(command).toLowerCase();
+        const isInterpreter = INTERPRETER_RE.test(cmdBase);
+        const isRunner = PACKAGE_RUNNERS.has(cmdBase);
+        const hasInlineCode = args.some((a) => INLINE_CODE_ARGS.has(a));
+        if (command !== '' && (isInterpreter || isRunner || hasInlineCode)) {
+            acc.serverShell = true;
+            const why = isRunner
+                ? `package runner "${cmdBase}" fetches and executes remote code`
+                : hasInlineCode
+                    ? `inline-code argument`
+                    : `interpreter "${cmdBase}" can run arbitrary code`;
+            acc.findings.push({
+                id: 'MS-MCP-SHELL-CMD',
+                severity: 'high',
+                capability: 'shell',
+                source: rel,
+                detail: `MCP server "${name}" launches via ${why}.`,
+                evidence: [command, ...args].join(' ').slice(0, 120),
+            });
+        }
+        for (const [k, v] of Object.entries(env)) {
+            if (looksLikeHardcodedSecret(k, v)) {
+                acc.serverSecret = true;
+                acc.findings.push({
+                    id: 'MS-SECRET-HARDCODED',
+                    severity: 'high',
+                    capability: 'secrets',
+                    source: rel,
+                    detail: `MCP server "${name}" env "${k}" appears to contain a hardcoded secret — use \${ENV_VAR} indirection instead.`,
+                    evidence: `${k}=${String(v).slice(0, 4)}…`,
+                });
+            }
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// entry point
+// ---------------------------------------------------------------------------
+function aggregate(grants, deny, id, severity, capability, label) {
+    const survivors = grants.filter((g) => !denyCovers(g, deny));
+    if (survivors.length === 0)
+        return null;
+    const examples = survivors.slice(0, 3).join(', ');
+    return {
+        id,
+        severity,
+        capability,
+        source: '.claude/settings*.json',
+        detail: `${label} via ${survivors.length} allow rule(s) not covered by a deny rule.`,
+        evidence: survivors.length > 3 ? `e.g. ${examples}, … (+${survivors.length - 3} more)` : examples,
+    };
+}
+/**
+ * Statically scan a project/pack root for an unsafe agent permission surface.
+ * Deterministic and read-only — never executes anything it finds.
+ */
+export function scanMcp(rootDir) {
+    const acc = {
+        findings: [],
+        scanned: [],
+        shellGrants: [],
+        networkGrants: [],
+        writeGrants: [],
+        shellArgNetwork: [],
+        shellArgWrite: [],
+        mcpToolGrants: [],
+        unknownTools: [],
+        denyRules: [],
+        hasReadGrant: false,
+        hasSettings: false,
+        hasDeny: false,
+        wildcardAll: false,
+        mcpActive: false,
+        enableAllMcp: false,
+        enableAllMcpSource: '.claude/settings*.json',
+        serverShell: false,
+        serverNetwork: false,
+        serverSecret: false,
+    };
+    // order is irrelevant to the result: all signals are merged before evaluation.
+    scanSettings(rootDir, join('.claude', 'settings.json'), acc);
+    scanSettings(rootDir, join('.claude', 'settings.local.json'), acc);
+    scanMcpServers(rootDir, '.mcp.json', acc);
+    scanMcpServers(rootDir, join('.vscode', 'mcp.json'), acc);
+    const deny = acc.denyRules;
+    // --- aggregated capability findings (merged surface, deny-suppressed) ---
+    const shellSurvivors = acc.shellGrants.filter((g) => !denyCovers(g, deny));
+    if (shellSurvivors.length > 0) {
+        const anyWildcard = shellSurvivors.some((g) => isWildcard(parseGrant(g).arg));
+        const examples = shellSurvivors.slice(0, 3).join(', ');
+        acc.findings.push({
+            id: anyWildcard ? 'MS-SHELL-WILDCARD' : 'MS-SHELL-GRANT',
+            severity: 'high',
+            capability: 'shell',
+            source: '.claude/settings*.json',
+            detail: anyWildcard
+                ? `Wildcard shell grant — arbitrary command execution. ${shellSurvivors.length} shell allow rule(s).`
+                : `Shell execution granted via ${shellSurvivors.length} allow rule(s).`,
+            evidence: shellSurvivors.length > 3 ? `e.g. ${examples}, … (+${shellSurvivors.length - 3} more)` : examples,
+        });
+    }
+    const netFinding = aggregate([...acc.networkGrants, ...acc.shellArgNetwork], deny, 'MS-NETWORK-GRANT', 'medium', 'network', 'Outbound network access granted');
+    if (netFinding)
+        acc.findings.push(netFinding);
+    const writeFinding = aggregate([...acc.writeGrants, ...acc.shellArgWrite], deny, 'MS-FILEWRITE-GRANT', 'medium', 'file-write', 'Filesystem write access granted');
+    if (writeFinding)
+        acc.findings.push(writeFinding);
+    // --- enable-all-mcp ---
+    if (acc.enableAllMcp) {
+        acc.findings.push({
+            id: 'MS-MCP-ALL-ENABLED',
+            severity: 'high',
+            capability: 'mcp',
+            source: acc.enableAllMcpSource,
+            detail: `enableAllProjectMcpServers: true — every project MCP server is trusted unconditionally (no per-server gate).`,
+            evidence: 'enableAllProjectMcpServers: true',
+        });
+    }
+    // --- secrets reachability (MetaHarness: requires MCP active) ---
+    const secretsReachable = acc.mcpActive && acc.hasReadGrant && !denyProtectsSecrets(deny);
+    if (secretsReachable) {
+        acc.findings.push({
+            id: 'MS-SECRETS-REACHABLE',
+            severity: 'high',
+            capability: 'secrets',
+            source: '.claude/settings*.json',
+            detail: `MCP is active and a Read grant exists without a deny rule protecting secret files (.env, SSH keys, cloud creds) — secrets are reachable by tools.`,
+            evidence: 'allow contains Read(...) ∧ MCP active ∧ deny lacks a secret-file guard',
+        });
+    }
+    // --- default-deny posture (scoped to the settings surface) ---
+    const defaultDeny = acc.hasSettings ? acc.hasDeny && !acc.wildcardAll : true;
+    if (acc.hasSettings && !defaultDeny) {
+        acc.findings.push({
+            id: 'MS-DEFAULT-DENY-OFF',
+            severity: 'high',
+            capability: 'policy',
+            source: '.claude/settings*.json',
+            detail: acc.wildcardAll
+                ? `An allow rule grants a bare wildcard — everything is permitted (no default-deny).`
+                : `No deny rules declared — the permission surface has no guardrail (no default-deny baseline).`,
+            evidence: acc.wildcardAll ? 'allow contains "*" / "Bash(*)"' : 'permissions.deny is empty',
+        });
+    }
+    // --- informational (low) findings: verdict-neutral coverage signal ---
+    if (acc.mcpToolGrants.length > 0) {
+        acc.findings.push({
+            id: 'MS-MCP-TOOLS-ALLOWED',
+            severity: 'low',
+            capability: 'mcp',
+            source: '.claude/settings*.json',
+            detail: `${acc.mcpToolGrants.length} MCP tool(s) explicitly allowed (per-tool gate — the safe pattern).`,
+            evidence: acc.mcpToolGrants.slice(0, 3).join(', '),
+        });
+    }
+    if (acc.unknownTools.length > 0) {
+        acc.findings.push({
+            id: 'MS-UNKNOWN-TOOL',
+            severity: 'low',
+            capability: 'policy',
+            source: '.claude/settings*.json',
+            detail: `${acc.unknownTools.length} grant(s) for tools not in the recognised capability sets — coverage gap, review manually.`,
+            evidence: acc.unknownTools.slice(0, 3).join(', '),
+        });
+    }
+    // --- verdict (low is verdict-neutral) ---
+    const hasHigh = acc.findings.some((f) => f.severity === 'high');
+    const hasMedium = acc.findings.some((f) => f.severity === 'medium');
+    const verdict = hasHigh ? 'high' : hasMedium ? 'medium' : 'clean';
+    const exitCode = verdict === 'high' ? 2 : verdict === 'medium' ? 1 : 0;
+    const order = { high: 0, medium: 1, low: 2 };
+    const findings = [...acc.findings].sort((a, b) => order[a.severity] - order[b.severity] || a.id.localeCompare(b.id));
+    return {
+        verdict,
+        exitCode,
+        findings,
+        scanned: acc.scanned,
+        capabilities: {
+            shell: shellSurvivors.length > 0 || acc.serverShell,
+            network: Boolean(netFinding) || acc.serverNetwork,
+            fileWrite: Boolean(writeFinding),
+            secretsReachable: secretsReachable || acc.serverSecret,
+            defaultDeny,
+        },
+    };
+}
+//# sourceMappingURL=mcp-scan.js.map

package/dist/mcp-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-scan.js","sourceRoot":"","sources":["../src/mcp-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EACL,WAAW,EACX,cAAc,EAAE,eAAe,EAAE,gBAAgB,EACjD,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,cAAc,EAC5D,UAAU,EAAE,UAAU,EAAE,QAAQ,GAEjC,MAAM,uBAAuB,CAAC;AAE/B,gFAAgF;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AA4CnD,4DAA4D;AAC5D,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1E,OAAO,IAAI,MAAM,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,kFAAkF;AAClF,SAAS,UAAU,CAAC,KAAa,EAAE,QAAkB;IACnD,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,IAAI,EAAE,CAAC,IAAI,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACjC,IAAI,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE;YAAE,OAAO,KAAK,CAAC;QACjE,IAAI,EAAE,CAAC,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,kCAAkC;QACpE,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACjC,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,SAAS,mBAAmB,CAAC,QAAkB;IAC7C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7B,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM;YAAE,OAAO,KAAK,CAAC;QAC5E,OAAO,GAAG,KAAK,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,SAAS,wBAAwB,CAAC,GAAW,EAAE,KAAc;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,CAAC,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,+BAA+B;IAC1E,IAAI,2DAA2D,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;AACvB,CAAC;AA6BD,SAAS,QAAQ,CAAC,IAAY;IAC5B,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,cAAc;YAAE,OAAO,IAAI,CAAC;QACjF,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,SAAS,YAAY,CAAC,IAAY,EAAE,GAAW,EAAE,GAAgB;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO;IACjC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;IAEvB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC;IAExC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;QACzB,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,OAAO;gBACV,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5B,IAAI,GAAG,KAAK,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5E,IAAI,GAAG,KAAK,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5E,MAAM;YACR,KAAK,SAAS;gBACZ,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC9B,MAAM;YACR,KAAK,YAAY;gBACf,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC5B,MAAM;YACR,KAAK,MAAM;gBACT,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC;gBACxB,MAAM;YACR,KAAK,KAAK;gBACR,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC9B,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;gBACrB,MAAM;YACR,KAAK,MAAM;gBACT,MAAM;YACR;gBACE,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,4BAA4B,CAAC,KAAK,IAAI,EAAE,CAAC;QAChD,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC;QACxB,GAAG,CAAC,kBAAkB,GAAG,GAAG,CAAC;QAC7B,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;IACvB,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,IAAI,IAAI,CAAC,uBAAuB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7F,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,GAAW,EAAE,GAAgB;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO;IACjC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEtB,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IACjF,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;IAEzD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,SAAS;QAClC,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,MAAM,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,KAAK,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAG,CAAC,SAAS,CAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAExD,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,MAAM,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACpD,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC;YACzB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,eAAe;gBACnB,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,SAAS;gBACrB,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,eAAe,IAAI,gBAAgB,IAAI,IAAI,KAAK,yCAAyC;gBACjG,QAAQ,EAAE,GAAG,IAAI,IAAI;aACtB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,aAAa,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,aAAa,IAAI,QAAQ,IAAI,aAAa,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;YACvB,MAAM,GAAG,GAAG,QAAQ;gBAClB,CAAC,CAAC,mBAAmB,OAAO,oCAAoC;gBAChE,CAAC,CAAC,aAAa;oBACb,CAAC,CAAC,sBAAsB;oBACxB,CAAC,CAAC,gBAAgB,OAAO,0BAA0B,CAAC;YACxD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAChB,EAAE,EAAE,kBAAkB;gBACtB,QAAQ,EAAE,MAAM;gBAChB,UAAU,EAAE,OAAO;gBACnB,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,eAAe,IAAI,kBAAkB,GAAG,GAAG;gBACnD,QAAQ,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,IAAI,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACnC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC;gBACxB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;oBAChB,EAAE,EAAE,qBAAqB;oBACzB,QAAQ,EAAE,MAAM;oBAChB,UAAU,EAAE,SAAS;oBACrB,MAAM,EAAE,GAAG;oBACX,MAAM,EAAE,eAAe,IAAI,UAAU,CAAC,gFAAgF;oBACtH,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG;iBAC3C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,SAAS,SAAS,CAChB,MAAgB,EAChB,IAAc,EACd,EAAU,EACV,QAAqB,EACrB,UAAyB,EACzB,KAAa;IAEb,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO;QACL,EAAE;QACF,QAAQ;QACR,UAAU;QACV,MAAM,EAAE,wBAAwB;QAChC,MAAM,EAAE,GAAG,KAAK,QAAQ,SAAS,CAAC,MAAM,4CAA4C;QACpF,QAAQ,EAAE,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,QAAQ,SAAS,SAAS,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;KAClG,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,OAAe;IACrC,MAAM,GAAG,GAAgB;QACvB,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,EAAE;QACf,aAAa,EAAE,EAAE;QACjB,WAAW,EAAE,EAAE;QACf,eAAe,EAAE,EAAE;QACnB,aAAa,EAAE,EAAE;QACjB,aAAa,EAAE,EAAE;QACjB,YAAY,EAAE,EAAE;QAChB,SAAS,EAAE,EAAE;QACb,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,KAAK;QAClB,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,KAAK;QACnB,kBAAkB,EAAE,wBAAwB;QAC5C,WAAW,EAAE,KAAK;QAClB,aAAa,EAAE,KAAK;QACpB,YAAY,EAAE,KAAK;KACpB,CAAC;IAEF,+EAA+E;IAC/E,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7D,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,EAAE,GAAG,CAAC,CAAC;IACnE,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;IAC1C,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;IAE1D,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC;IAE3B,2EAA2E;IAC3E,MAAM,cAAc,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3E,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB;YACxD,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,OAAO;YACnB,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,WAAW;gBACjB,CAAC,CAAC,uDAAuD,cAAc,CAAC,MAAM,uBAAuB;gBACrG,CAAC,CAAC,+BAA+B,cAAc,CAAC,MAAM,iBAAiB;YACzE,QAAQ,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,QAAQ,SAAS,cAAc,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;SAC5G,CAAC,CAAC;IACL,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAC1B,CAAC,GAAG,GAAG,CAAC,aAAa,EAAE,GAAG,GAAG,CAAC,eAAe,CAAC,EAC9C,IAAI,EACJ,kBAAkB,EAClB,QAAQ,EACR,SAAS,EACT,iCAAiC,CAClC,CAAC;IACF,IAAI,UAAU;QAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAE9C,MAAM,YAAY,GAAG,SAAS,CAC5B,CAAC,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC,EAC1C,IAAI,EACJ,oBAAoB,EACpB,QAAQ,EACR,YAAY,EACZ,iCAAiC,CAClC,CAAC;IACF,IAAI,YAAY;QAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAElD,yBAAyB;IACzB,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QACrB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,oBAAoB;YACxB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,GAAG,CAAC,kBAAkB;YAC9B,MAAM,EAAE,8GAA8G;YACtH,QAAQ,EAAE,kCAAkC;SAC7C,CAAC,CAAC;IACL,CAAC;IAED,kEAAkE;IAClE,MAAM,gBAAgB,GAAG,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,YAAY,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACzF,IAAI,gBAAgB,EAAE,CAAC;QACrB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,sBAAsB;YAC1B,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,mJAAmJ;YAC3J,QAAQ,EAAE,wEAAwE;SACnF,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,IAAI,GAAG,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,qBAAqB;YACzB,QAAQ,EAAE,MAAM;YAChB,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,GAAG,CAAC,WAAW;gBACrB,CAAC,CAAC,mFAAmF;gBACrF,CAAC,CAAC,8FAA8F;YAClG,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,2BAA2B;SAC3F,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,sBAAsB;YAC1B,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC,MAAM,qEAAqE;YACxG,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,iBAAiB;YACrB,QAAQ,EAAE,KAAK;YACf,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,wBAAwB;YAChC,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,4FAA4F;YAC9H,QAAQ,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAClD,CAAC,CAAC;IACL,CAAC;IAED,2CAA2C;IAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;IACpE,MAAM,OAAO,GAAe,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9E,MAAM,QAAQ,GAAc,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAElF,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAW,CAAC;IACtD,MAAM,QAAQ,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CACrC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAC5E,CAAC;IAEF,OAAO;QACL,OAAO;QACP,QAAQ;QACR,QAAQ;QACR,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,YAAY,EAAE;YACZ,KAAK,EAAE,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,WAAW;YACnD,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,aAAa;YACjD,SAAS,EAAE,OAAO,CAAC,YAAY,CAAC;YAChC,gBAAgB,EAAE,gBAAgB,IAAI,GAAG,CAAC,YAAY;YACtD,WAAW;SACZ;KACF,CAAC;AACJ,CAAC"}

package/dist/reconcile.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `dz mcp-scan --reconcile` — static capability reconciliation (Phase 3).
+ *
+ * Joins two things `dz` can read deterministically:
+ *  - the project's GRANT surface (`scanMcp` of `.claude/settings*.json` + `.mcp.json`), and
+ *  - the aggregate DECLARED capabilities of the installed skills (`.claude/skills/<id>/SKILL.md`),
+ * then REPORTS the gaps (under-grant / over-grant) and, optionally, EMITS a
+ * least-privilege advisory policy artifact for a host to consume.
+ *
+ * HONESTY: `dz` is build-time / static. It does NOT run agents and CANNOT block,
+ * time out, or rate-limit a tool call. The HOST (Claude Code enforcing
+ * settings.json allow/deny; or an MCP server consuming a policy.json) is the only
+ * thing that enforces at call time. Verbs here are REPORT / RECONCILE / EMIT /
+ * CANDIDATE — never BLOCK / DENIED / ENFORCED.
+ *
+ * @packageDocumentation
+ */
+import type { McpScanReport } from './mcp-scan.js';
+/** The honesty banner — repeated in --help, the report header, and the artifact $comment. */
+export declare const RECONCILE_BANNER: string;
+/** A reconcilable capability axis (the axes BOTH the grant surface and the manifest expose). */
+export type ReconcileAxis = 'shell' | 'network' | 'file-write';
+/** Per-axis reconciliation state. */
+export interface AxisState {
+    readonly axis: ReconcileAxis;
+    /** Project permits this capability (from scanMcp). */
+    readonly grant: boolean;
+    /** At least one installed skill declares it needs this (declared === true). */
+    readonly need: boolean;
+    /** Skills that declared need (true) — for attribution. */
+    readonly needSkills: readonly string[];
+    /** Installed skills that are SILENT on this axis (declared === undefined). */
+    readonly silentCount: number;
+}
+/** A single reconciliation finding. */
+export interface ReconcileFinding {
+    readonly id: string;
+    readonly kind: 'under-grant' | 'over-grant';
+    readonly severity: 'medium' | 'low' | 'info';
+    readonly axis: ReconcileAxis;
+    readonly detail: string;
+    readonly skills: readonly string[];
+}
+/** Aggregated declared limits across installed skills (tightest values; inert). */
+export interface LimitsRollup {
+    readonly declaredBy: number;
+    readonly toolTimeoutMs?: number;
+    readonly maxToolCallsPerTurn?: number;
+    readonly requireApprovalForDangerous?: boolean;
+}
+/** The least-privilege advisory policy artifact (only written with --emit-policy). */
+export interface PolicyArtifact {
+    readonly $comment: string;
+    readonly version: 1;
+    readonly defaultDeny: true;
+    /** axis → true ONLY where an installed skill declared need; absent otherwise. */
+    readonly allow: Partial<Record<ReconcileAxis, true>>;
+    readonly limits?: LimitsRollup;
+    readonly derivedFrom: {
+        readonly grants: Record<ReconcileAxis, boolean>;
+        readonly declaredNeed: Record<ReconcileAxis, boolean>;
+        readonly skillsByAxis: Partial<Record<ReconcileAxis, readonly string[]>>;
+    };
+}
+/** Result of {@link reconcileCapabilities}. */
+export interface ReconcileReport {
+    readonly skillsDir: string;
+    readonly installedCount: number;
+    readonly axes: readonly AxisState[];
+    readonly findings: readonly ReconcileFinding[];
+    readonly limits: LimitsRollup | null;
+    readonly policy: PolicyArtifact;
+}
+/**
+ * Statically reconcile a project's GRANT surface against the DECLARED needs of
+ * its installed skills. Pure: same inputs → same report. No execution, no writes.
+ */
+export declare function reconcileCapabilities(report: McpScanReport, skillsDir: string): ReconcileReport;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,6FAA6F;AAC7F,eAAO,MAAM,gBAAgB,QAGkD,CAAC;AAEhF,gGAAgG;AAChG,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,SAAS,GAAG,YAAY,CAAC;AAG/D,qCAAqC;AACrC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,0DAA0D;IAC1D,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,8EAA8E;IAC9E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,aAAa,GAAG,YAAY,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,mFAAmF;AACnF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,2BAA2B,CAAC,EAAE,OAAO,CAAC;CAChD;AAED,sFAAsF;AACtF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAChD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACtD,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;KAC1E,CAAC;CACH;AAED,+CAA+C;AAC/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC/C,QAAQ,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;CACjC;AAqCD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,CA6E/F"}