@integsec/agentic-pentest-proxy 0.2.9 → 0.3.0

package/dist/src/gateway/runtime.js

@@ -0,0 +1,167 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { ScopeEnforcementProxy } from "../proxy.js";
+import { loadConfig } from "../config.js";
+import { activeScope, permitsUpstream } from "./state.js";
+const toolError = (message) => ({ content: [{ type: "text", text: message }], isError: true });
+export class GatewayRuntime {
+    store;
+    hosted;
+    requiredAuditSink;
+    clients = new Map();
+    pending = new Map();
+    proxies = new Map();
+    proxyScope;
+    constructor(store, hosted, requiredAuditSink) {
+        this.store = store;
+        this.hosted = hosted;
+        this.requiredAuditSink = requiredAuditSink;
+    }
+    async sync() {
+        const state = this.store.snapshot();
+        for (const [id, cached] of this.clients) {
+            const current = state.upstreams.find((item) => item.id === id);
+            if (!current || !current.enabled || JSON.stringify(current) !== cached.signature) {
+                this.clients.delete(id);
+                await cached.client.close().catch(() => undefined);
+            }
+        }
+        this.proxies.clear();
+        this.proxyScope = undefined;
+    }
+    scopeProxy(scope, serverName) {
+        if (this.proxyScope?.id !== scope.id || this.proxyScope.updatedAt !== scope.updatedAt) {
+            this.proxies.clear();
+            this.proxyScope = scope;
+        }
+        let proxy = this.proxies.get(serverName);
+        if (!proxy) {
+            proxy = new ScopeEnforcementProxy(scope.manifest, loadConfig(), this.requiredAuditSink);
+            proxy.setServerName(serverName);
+            this.proxies.set(serverName, proxy);
+        }
+        return proxy;
+    }
+    async clientFor(upstream) {
+        const signature = JSON.stringify(upstream);
+        const cached = this.clients.get(upstream.id);
+        if (cached?.signature === signature)
+            return cached.client;
+        const inFlight = this.pending.get(upstream.id);
+        if (inFlight)
+            return inFlight;
+        const connection = (async () => {
+            if (cached)
+                await cached.client.close().catch(() => undefined);
+            const client = new Client({ name: "agentic-pentest-gateway", version: "0.3.0" });
+            const transport = upstream.transport === "stdio"
+                ? new StdioClientTransport({ command: upstream.command, args: upstream.args, stderr: "pipe" })
+                : upstream.transport === "sse"
+                    ? new SSEClientTransport(new URL(upstream.url))
+                    : new StreamableHTTPClientTransport(new URL(upstream.url));
+            try {
+                await client.connect(transport, { timeout: 10_000 });
+            }
+            catch (error) {
+                await client.close().catch(() => undefined);
+                throw error;
+            }
+            this.clients.set(upstream.id, { client, signature });
+            return client;
+        })();
+        this.pending.set(upstream.id, connection);
+        try {
+            return await connection;
+        }
+        finally {
+            this.pending.delete(upstream.id);
+        }
+    }
+    available(scope) {
+        return this.store.snapshot().upstreams.filter((upstream) => {
+            if (this.hosted && upstream.transport === "stdio")
+                return false;
+            return permitsUpstream(scope, upstream);
+        });
+    }
+    createServer(actor) {
+        const server = new Server({ name: "agentic-pentest-gateway", version: "0.3.0" }, { capabilities: { tools: { listChanged: true } } });
+        server.setRequestHandler(ListToolsRequestSchema, async () => {
+            const scope = activeScope(this.store.snapshot());
+            if (!scope)
+                return { tools: [] };
+            const groups = await Promise.all(this.available(scope).map(async (upstream) => {
+                const tools = [];
+                try {
+                    const client = await this.clientFor(upstream);
+                    let cursor;
+                    do {
+                        const page = await client.listTools(cursor ? { cursor } : undefined, { timeout: 10_000 });
+                        for (const tool of page.tools)
+                            tools.push({
+                                name: `${upstream.name}__${tool.name}`,
+                                description: tool.description,
+                                inputSchema: tool.inputSchema,
+                            });
+                        cursor = page.nextCursor;
+                    } while (cursor);
+                }
+                catch (error) {
+                    console.error(`[gateway] ${upstream.name} tool discovery failed:`, error);
+                }
+                return tools;
+            }));
+            return { tools: groups.flat() };
+        });
+        server.setRequestHandler(CallToolRequestSchema, async (request) => {
+            const scope = activeScope(this.store.snapshot());
+            if (!scope)
+                return toolError("No active scope. Ask an administrator to activate one.");
+            const upstream = this.available(scope).find((item) => request.params.name.startsWith(`${item.name}__`));
+            if (!upstream)
+                return toolError("Tool server is disabled or prohibited by the active execution profile.");
+            const toolName = request.params.name.slice(upstream.name.length + 2);
+            if (!toolName)
+                return toolError("Invalid tool name.");
+            const proxy = this.scopeProxy(scope, upstream.name);
+            const decision = await proxy.handleMessage({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: toolName, arguments: request.params.arguments ?? {} } }, actor);
+            if (!decision.forward) {
+                const response = decision.response;
+                return toolError(response.error?.message ?? "Blocked by the active scope.");
+            }
+            try {
+                const client = await this.clientFor(upstream);
+                let cursor;
+                let found = false;
+                do {
+                    const page = await client.listTools(cursor ? { cursor } : undefined, { timeout: 10_000 });
+                    found ||= page.tools.some((tool) => tool.name === toolName);
+                    cursor = page.nextCursor;
+                } while (!found && cursor);
+                if (!found)
+                    return toolError("Tool is no longer advertised by the upstream server.");
+                const latest = this.store.snapshot();
+                const latestScope = activeScope(latest);
+                const latestUpstream = latest.upstreams.find((item) => item.id === upstream.id);
+                if (!latestScope || latestScope.id !== scope.id || latestScope.updatedAt !== scope.updatedAt || !latestUpstream || JSON.stringify(latestUpstream) !== JSON.stringify(upstream) || !this.available(latestScope).some((item) => item.id === latestUpstream.id)) {
+                    return toolError("Scope or tool configuration changed before dispatch.");
+                }
+                return await client.callTool({ name: toolName, arguments: request.params.arguments ?? {} }, undefined, { timeout: 300_000 });
+            }
+            catch (error) {
+                console.error(`[gateway] ${upstream.name} tool call failed:`, error);
+                return toolError("Upstream tool call failed. See gateway logs.");
+            }
+        });
+        return server;
+    }
+    async close() {
+        await Promise.all([...this.clients.values()].map(({ client }) => client.close().catch(() => undefined)));
+        this.clients.clear();
+    }
+}
+//# sourceMappingURL=runtime.js.map

package/dist/src/gateway/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/gateway/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAgB,WAAW,EAAE,eAAe,EAAmC,MAAM,YAAY,CAAC;AAEzG,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAEhH,MAAM,OAAO,cAAc;IAMJ;IAAsC;IAAkC;IALrF,OAAO,GAAG,IAAI,GAAG,EAAiD,CAAC;IACnE,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC7C,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;IACnD,UAAU,CAAe;IAEjC,YAAqB,KAAmB,EAAmB,MAAe,EAAmB,iBAAwD;QAAhI,UAAK,GAAL,KAAK,CAAc;QAAmB,WAAM,GAAN,MAAM,CAAS;QAAmB,sBAAiB,GAAjB,iBAAiB,CAAuC;IAAG,CAAC;IAEzJ,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;gBACjF,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAEO,UAAU,CAAC,KAAkB,EAAE,UAAkB;QACvD,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACtF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACxF,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,QAAkB;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE;YAC7B,IAAI,MAAM;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACjF,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,KAAK,OAAO;gBAC9C,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBAC/F,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK;oBAC5B,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAI,CAAC,CAAC;oBAChD,CAAC,CAAC,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAI,CAAC,CAAC,CAAC;YAChE,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC;YAAC,OAAO,MAAM,UAAU,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IAChF,CAAC;IAEO,SAAS,CAAC,KAAkB;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;YACzD,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAChE,OAAO,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,KAAc;QACzB,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACrI,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAC5E,MAAM,KAAK,GAA2G,EAAE,CAAC;gBACzH,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;oBAC9C,IAAI,MAA0B,CAAC;oBAC/B,GAAG,CAAC;wBACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;wBAC1F,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;4BAAE,KAAK,CAAC,IAAI,CAAC;gCACxC,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE;gCACtC,WAAW,EAAE,IAAI,CAAC,WAAW;gCAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;6BAC9B,CAAC,CAAC;wBACH,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;oBAC3B,CAAC,QAAQ,MAAM,EAAE;gBACnB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,aAAa,QAAQ,CAAC,IAAI,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAC5E,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC,wDAAwD,CAAC,CAAC;YACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;YACxG,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC,wEAAwE,CAAC,CAAC;YAC1G,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC,oBAAoB,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1K,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA4C,CAAC;gBACvE,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,8BAA8B,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAC9C,IAAI,MAA0B,CAAC;gBAC/B,IAAI,KAAK,GAAG,KAAK,CAAC;gBAClB,GAAG,CAAC;oBACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC1F,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;oBAC5D,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;gBAC3B,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,EAAE;gBAC3B,IAAI,CAAC,KAAK;oBAAE,OAAO,SAAS,CAAC,sDAAsD,CAAC,CAAC;gBACrF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrC,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAChF,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,IAAI,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7P,OAAO,SAAS,CAAC,sDAAsD,CAAC,CAAC;gBAC3E,CAAC;gBACD,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/H,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,aAAa,QAAQ,CAAC,IAAI,oBAAoB,EAAE,KAAK,CAAC,CAAC;gBACrE,OAAO,SAAS,CAAC,8CAA8C,CAAC,CAAC;YACnE,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/src/gateway/server.d.ts

@@ -0,0 +1,27 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+import { GatewayRuntime } from "./runtime.js";
+import { GatewayStore } from "./state.js";
+export interface GatewayOptions {
+    host: string;
+    port: number;
+    statePath: string;
+    adminToken: string;
+    publicUrl?: string;
+    entraTenant?: string;
+    entraAudience?: string;
+    entraScope?: string;
+    authMode?: "entra" | "cloudflare";
+    cloudflareTeamDomain?: string;
+    cloudflareAccessAud?: string;
+    internalToken?: string;
+    auditWebhookUrl?: string;
+    auditWebhookToken?: string;
+}
+export declare function createGateway(options: GatewayOptions): {
+    server: import("http").Server<typeof IncomingMessage, typeof ServerResponse>;
+    store: GatewayStore;
+    runtime: GatewayRuntime;
+    listen: () => Promise<void>;
+    close: () => Promise<void>;
+};
+//# sourceMappingURL=server.d.ts.map

package/dist/src/gateway/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/gateway/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAOpF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAA0C,MAAM,YAAY,CAAC;AAOlF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAyBD,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc;;;;;;EAgIpD"}

package/dist/src/gateway/server.js

@@ -0,0 +1,232 @@
+import { createServer } from "node:http";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { GatewayAuth } from "./auth.js";
+import { GatewayRuntime } from "./runtime.js";
+import { GatewayStore, activeScope, parseScope, parseUpstream } from "./state.js";
+const MAX_BODY = 1024 * 1024;
+const html = readFileSync(fileURLToPath(new URL("./admin.html", import.meta.url)), "utf8");
+const js = readFileSync(fileURLToPath(new URL("./admin.js", import.meta.url)), "utf8");
+function json(res, code, body) {
+    res.writeHead(code, { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff" });
+    res.end(JSON.stringify(body));
+}
+async function body(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > MAX_BODY)
+            throw new Error("Request exceeds 1 MiB");
+        chunks.push(chunk);
+    }
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function authorizedAdmin(req, token) {
+    const supplied = /^Bearer (.+)$/i.exec(req.headers.authorization ?? "")?.[1] ?? "";
+    const a = Buffer.from(supplied);
+    const b = Buffer.from(token);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+export function createGateway(options) {
+    if (options.adminToken.length < 32)
+        throw new Error("GATEWAY_ADMIN_TOKEN must be at least 32 characters");
+    if (options.host !== "127.0.0.1" && options.host !== "::1" && !options.publicUrl)
+        throw new Error("Non-loopback gateway requires GATEWAY_PUBLIC_URL and Entra configuration");
+    if (Boolean(options.auditWebhookUrl) !== Boolean(options.auditWebhookToken))
+        throw new Error("AUDIT_WEBHOOK_URL and AUDIT_WEBHOOK_TOKEN must be set together");
+    if (options.auditWebhookUrl && (new URL(options.auditWebhookUrl).protocol !== "https:" || options.auditWebhookToken.length < 32))
+        throw new Error("Durable audit webhook requires HTTPS and a token of at least 32 characters");
+    const store = new GatewayStore(options.statePath);
+    const requiredAuditSink = options.auditWebhookUrl ? async (entry) => {
+        const response = await fetch(options.auditWebhookUrl, {
+            method: "POST", headers: { Authorization: `Bearer ${options.auditWebhookToken}`, "Content-Type": "application/json" },
+            body: JSON.stringify(entry), signal: AbortSignal.timeout(10_000), redirect: "error",
+        });
+        if (!response.ok)
+            throw new Error(`Audit webhook returned HTTP ${response.status}`);
+        await response.body?.cancel();
+    } : undefined;
+    const runtime = new GatewayRuntime(store, Boolean(options.publicUrl), requiredAuditSink);
+    const auth = new GatewayAuth(options.publicUrl, options.entraTenant, options.authMode === "cloudflare" ? options.cloudflareAccessAud : options.entraAudience, options.entraScope, options.authMode, options.cloudflareTeamDomain);
+    const server = createServer(async (req, res) => {
+        try {
+            const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+            const requestHost = new URL(`http://${req.headers.host ?? "invalid"}`).hostname;
+            const publicHost = options.publicUrl ? new URL(options.publicUrl).hostname : undefined;
+            if (requestHost !== publicHost && !["127.0.0.1", "localhost", "[::1]"].includes(requestHost)) {
+                json(res, 421, { error: "invalid host" });
+                return;
+            }
+            const pathname = url.pathname;
+            if (pathname === "/healthz") {
+                json(res, 200, { status: "ok" });
+                return;
+            }
+            if (pathname === "/__internal/state" && options.internalToken && authorizedAdmin(req, options.internalToken)) {
+                if (req.method === "GET") {
+                    json(res, 200, store.snapshot());
+                    return;
+                }
+                if (req.method === "PUT") {
+                    const state = store.replace(await body(req));
+                    await runtime.sync();
+                    json(res, 200, state);
+                    return;
+                }
+            }
+            if (pathname === "/.well-known/oauth-protected-resource" || pathname === "/.well-known/oauth-protected-resource/mcp") {
+                if (!options.publicUrl || options.authMode === "cloudflare") {
+                    json(res, 404, { error: "OAuth metadata is served by Cloudflare Access or not configured" });
+                    return;
+                }
+                json(res, 200, await auth.protectedResource());
+                return;
+            }
+            if (pathname === "/mcp") {
+                const actor = await auth.authorize(req, res);
+                if (!actor)
+                    return;
+                if (options.publicUrl && activeScope(store.snapshot())?.profile === "isolated") {
+                    json(res, 403, { error: "Isolated scopes cannot use the public MCP endpoint" });
+                    return;
+                }
+                if (req.method !== "POST") {
+                    res.writeHead(405, { Allow: "POST" });
+                    res.end();
+                    return;
+                }
+                if (Number(req.headers["content-length"] ?? 0) > MAX_BODY) {
+                    json(res, 413, { error: "Request exceeds 1 MiB" });
+                    return;
+                }
+                const parsed = await body(req);
+                const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+                const mcp = runtime.createServer(actor);
+                try {
+                    await mcp.connect(transport);
+                    await transport.handleRequest(req, res, parsed);
+                }
+                finally {
+                    await mcp.close();
+                }
+                return;
+            }
+            if (pathname === "/admin" && req.method === "GET") {
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Content-Security-Policy": "default-src 'none'; script-src 'self'; style-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'", "X-Content-Type-Options": "nosniff", "Referrer-Policy": "no-referrer" });
+                res.end(html);
+                return;
+            }
+            if (pathname === "/admin.js" && req.method === "GET") {
+                res.writeHead(200, { "Content-Type": "text/javascript; charset=utf-8", "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff" });
+                res.end(js);
+                return;
+            }
+            if (!pathname.startsWith("/api/")) {
+                json(res, 404, { error: "not found" });
+                return;
+            }
+            const origin = req.headers.origin;
+            if (origin && origin !== `http://${req.headers.host}` && origin !== options.publicUrl) {
+                json(res, 403, { error: "invalid origin" });
+                return;
+            }
+            if (options.publicUrl && options.authMode === "cloudflare" && !await auth.authorize(req, res))
+                return;
+            if (!authorizedAdmin(req, options.adminToken)) {
+                json(res, 401, { error: "admin token required" });
+                return;
+            }
+            if (pathname === "/api/state" && req.method === "GET") {
+                json(res, 200, store.snapshot());
+                return;
+            }
+            if (pathname === "/api/upstreams" && req.method === "POST") {
+                const upstream = parseUpstream(await body(req));
+                if (options.publicUrl && upstream.transport === "stdio") {
+                    json(res, 400, { error: "Hosted gateway cannot spawn local processes" });
+                    return;
+                }
+                store.update((draft) => { draft.upstreams.push(upstream); });
+                await runtime.sync();
+                json(res, 201, upstream);
+                return;
+            }
+            const upstreamMatch = /^\/api\/upstreams\/([0-9a-f-]{36})$/.exec(pathname);
+            if (upstreamMatch && req.method === "PATCH") {
+                const input = z.object({ enabled: z.boolean() }).parse(await body(req));
+                const updated = store.update((draft) => {
+                    const item = draft.upstreams.find((value) => value.id === upstreamMatch[1]);
+                    if (!item)
+                        throw new Error("Upstream not found");
+                    item.enabled = input.enabled;
+                });
+                await runtime.sync();
+                json(res, 200, updated);
+                return;
+            }
+            if (upstreamMatch && req.method === "DELETE") {
+                const updated = store.update((draft) => { draft.upstreams = draft.upstreams.filter((value) => value.id !== upstreamMatch[1]); });
+                await runtime.sync();
+                json(res, 200, updated);
+                return;
+            }
+            if (pathname === "/api/scopes" && req.method === "POST") {
+                const scope = parseScope(await body(req));
+                store.update((draft) => { draft.scopes.push(scope); });
+                json(res, 201, scope);
+                return;
+            }
+            const scopeMatch = /^\/api\/scopes\/([0-9a-f-]{36})$/.exec(pathname);
+            if (scopeMatch && req.method === "PUT") {
+                const scope = parseScope(await body(req), scopeMatch[1]);
+                const updated = store.update((draft) => {
+                    if (draft.activeScopeId === scope.id)
+                        throw new Error("Active scope cannot be edited; save a new draft");
+                    const index = draft.scopes.findIndex((item) => item.id === scope.id);
+                    if (index < 0)
+                        throw new Error("Scope not found");
+                    draft.scopes[index] = scope;
+                });
+                json(res, 200, updated);
+                return;
+            }
+            if (scopeMatch && req.method === "DELETE") {
+                const updated = store.update((draft) => {
+                    if (draft.activeScopeId === scopeMatch[1])
+                        throw new Error("Active scope cannot be deleted");
+                    draft.scopes = draft.scopes.filter((item) => item.id !== scopeMatch[1]);
+                });
+                json(res, 200, updated);
+                return;
+            }
+            const activateMatch = /^\/api\/scopes\/([0-9a-f-]{36})\/activate$/.exec(pathname);
+            if (activateMatch && req.method === "POST") {
+                const updated = store.update((draft) => {
+                    const scope = draft.scopes.find((item) => item.id === activateMatch[1]);
+                    if (!scope)
+                        throw new Error("Scope not found");
+                    if (Date.now() < Date.parse(scope.manifest.engagement_window.start) || Date.now() > Date.parse(scope.manifest.engagement_window.end))
+                        throw new Error("Scope window is not active");
+                    draft.activeScopeId = scope.id;
+                });
+                await runtime.sync();
+                json(res, 200, updated);
+                return;
+            }
+            json(res, 404, { error: "not found" });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : "Request failed";
+            json(res, error instanceof z.ZodError || error instanceof SyntaxError ? 400 : 409, { error: message });
+        }
+    });
+    return { server, store, runtime, listen: () => new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(options.port, options.host, () => { server.off("error", reject); resolve(); });
+        }), close: async () => { await new Promise((resolve) => server.close(() => resolve())); await runtime.close(); } };
+}
+//# sourceMappingURL=server.js.map

package/dist/src/gateway/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/gateway/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAGlF,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC3F,MAAM,EAAE,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAmBvF,SAAS,IAAI,CAAC,GAAmB,EAAE,IAAY,EAAE,IAAa;IAC5D,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,wBAAwB,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7I,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAoB;IACtC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,IAAI,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB,EAAE,KAAa;IAC1D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC1G,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,0EAA0E,CAAC,CAAC;IAC9K,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC/J,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,iBAAkB,CAAC,MAAM,GAAG,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IACjO,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,KAAiB,EAAE,EAAE;QAC9E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,eAAgB,EAAE;YACrD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,iBAAiB,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACrH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO;SACpF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,iBAAiB,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClO,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;YACjF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC;YAChF,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,IAAI,WAAW,KAAK,UAAU,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7F,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAAC,OAAO;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC9B,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC1E,IAAI,QAAQ,KAAK,mBAAmB,IAAI,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7G,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACvE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAAC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;YAClI,CAAC;YACD,IAAI,QAAQ,KAAK,uCAAuC,IAAI,QAAQ,KAAK,2CAA2C,EAAE,CAAC;gBACrH,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACtK,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;gBAAC,OAAO;YACzD,CAAC;YACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC7C,IAAI,CAAC,KAAK;oBAAE,OAAO;gBACnB,IAAI,OAAO,CAAC,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,KAAK,UAAU,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC5K,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;oBAAC,GAAG,CAAC,GAAG,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACxF,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC1H,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC/B,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;gBACvF,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACxC,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC7B,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAClD,CAAC;wBAAS,CAAC;oBACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;gBACpB,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE,yBAAyB,EAAE,mJAAmJ,EAAE,wBAAwB,EAAE,SAAS,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC;gBACvV,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO;YACxB,CAAC;YACD,IAAI,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,gCAAgC,EAAE,eAAe,EAAE,UAAU,EAAE,wBAAwB,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC3I,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAAC,OAAO;YACtB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACtF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,IAAI,MAAM,IAAI,MAAM,KAAK,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,MAAM,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/I,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,YAAY,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,OAAO;YACtG,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC7G,IAAI,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACpG,IAAI,QAAQ,KAAK,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChD,IAAI,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC9I,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7D,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAAC,OAAO;YACzD,CAAC;YACD,MAAM,aAAa,GAAG,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3E,IAAI,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5E,IAAI,CAAC,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;oBACjD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;gBAC/B,CAAC,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO;YACxD,CAAC;YACD,IAAI,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjI,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO;YACxD,CAAC;YACD,IAAI,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1C,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBAAC,OAAO;YAChC,CAAC;YACD,MAAM,UAAU,GAAG,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrE,IAAI,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrC,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;oBACzG,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;oBACrE,IAAI,KAAK,GAAG,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAClD,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;gBAC9B,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO;YAClC,CAAC;YACD,IAAI,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrC,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;oBAC7F,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1E,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO;YAClC,CAAC;YACD,MAAM,aAAa,GAAG,4CAA4C,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;oBACxE,IAAI,CAAC,KAAK;wBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAC/C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBACpL,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,EAAE,CAAC;gBACjC,CAAC,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO;YACxD,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC1E,IAAI,CAAC,GAAG,EAAE,KAAK,YAAY,CAAC,CAAC,QAAQ,IAAI,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3H,CAAC"}

package/dist/src/gateway/state.d.ts

@@ -0,0 +1,64 @@
+import { z } from "zod";
+declare const StateSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    upstreams: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        enabled: z.ZodBoolean;
+        transport: z.ZodEnum<{
+            stdio: "stdio";
+            sse: "sse";
+            http: "http";
+        }>;
+        command: z.ZodOptional<z.ZodString>;
+        args: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        url: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    scopes: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        manifest: z.ZodObject<{
+            engagement_id: z.ZodString;
+            client: z.ZodString;
+            operator: z.ZodString;
+            authorized_targets: z.ZodObject<{
+                ip_ranges: z.ZodArray<z.ZodString>;
+                domains: z.ZodArray<z.ZodString>;
+                urls: z.ZodArray<z.ZodString>;
+                cloud_accounts: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>;
+            excluded_targets: z.ZodArray<z.ZodString>;
+            authorized_techniques: z.ZodArray<z.ZodString>;
+            excluded_techniques: z.ZodArray<z.ZodString>;
+            engagement_window: z.ZodObject<{
+                start: z.ZodString;
+                end: z.ZodString;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        profile: z.ZodEnum<{
+            isolated: "isolated";
+            restricted: "restricted";
+            connected: "connected";
+        }>;
+        allowedHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        updatedAt: z.ZodString;
+    }, z.core.$strip>>;
+    activeScopeId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type GatewayState = z.infer<typeof StateSchema>;
+export type Upstream = GatewayState["upstreams"][number];
+export type ScopeRecord = GatewayState["scopes"][number];
+export type ExecutionProfile = ScopeRecord["profile"];
+export declare class GatewayStore {
+    private readonly file;
+    private state;
+    constructor(file: string);
+    snapshot(): GatewayState;
+    update(mutator: (draft: GatewayState) => void): GatewayState;
+    replace(input: unknown): GatewayState;
+}
+export declare function parseUpstream(input: unknown): Upstream;
+export declare function parseScope(input: unknown, id?: string): ScopeRecord;
+export declare function activeScope(state: GatewayState): ScopeRecord | undefined;
+export declare function permitsUpstream(scope: ScopeRecord, upstream: Upstream): boolean;
+export {};
+//# sourceMappingURL=state.d.ts.map

package/dist/src/gateway/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/gateway/state.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA8CxB,QAAA,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAYf,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACvD,MAAM,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AACzD,MAAM,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC;AACzD,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;AAEtD,qBAAa,YAAY;IAGX,OAAO,CAAC,QAAQ,CAAC,IAAI;IAFjC,OAAO,CAAC,KAAK,CAAe;gBAEC,IAAI,EAAE,MAAM;IAMzC,QAAQ,IAAI,YAAY;IAExB,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,GAAG,YAAY;IAM5D,OAAO,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY;CAStC;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAEtD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE,GAAE,MAAqB,GAAG,WAAW,CAEjF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,YAAY,GAAG,WAAW,GAAG,SAAS,CAExE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAU/E"}