@integsec/agentic-pentest-proxy 0.2.9 → 0.3.1

package/dist/src/gateway/runtime.d.ts

@@ -0,0 +1,21 @@
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import type { AuditEntry } from "../types.js";
+import { GatewayStore } from "./state.js";
+export declare class GatewayRuntime {
+    readonly store: GatewayStore;
+    private readonly hosted;
+    private readonly requiredAuditSink?;
+    private readonly isActorAllowed?;
+    private clients;
+    private pending;
+    private proxies;
+    private proxyScope?;
+    constructor(store: GatewayStore, hosted: boolean, requiredAuditSink?: ((entry: AuditEntry) => Promise<void>) | undefined, isActorAllowed?: ((email?: string) => boolean) | undefined);
+    sync(): Promise<void>;
+    private scopeProxy;
+    private clientFor;
+    private available;
+    createServer(actor?: string, email?: string): Server;
+    close(): Promise<void>;
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/src/gateway/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../../src/gateway/runtime.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAInE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAiE,MAAM,YAAY,CAAC;AAIzG,qBAAa,cAAc;IAMb,QAAQ,CAAC,KAAK,EAAE,YAAY;IAAE,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAW,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IAAwC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC;IALvL,OAAO,CAAC,OAAO,CAA4D;IAC3E,OAAO,CAAC,OAAO,CAAsC;IACrD,OAAO,CAAC,OAAO,CAA4C;IAC3D,OAAO,CAAC,UAAU,CAAC,CAAc;gBAEZ,KAAK,EAAE,YAAY,EAAmB,MAAM,EAAE,OAAO,EAAmB,iBAAiB,CAAC,GAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,aAAA,EAAmB,cAAc,CAAC,GAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,OAAO,aAAA;IAE9M,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAa3B,OAAO,CAAC,UAAU;YAcJ,SAAS;IA2BvB,OAAO,CAAC,SAAS;IAOjB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAmE9C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAI7B"}

package/dist/src/gateway/runtime.js

@@ -0,0 +1,175 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { SSEClientTransport } from "@modelcontextprotocol/sdk/client/sse.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+import { ScopeEnforcementProxy } from "../proxy.js";
+import { loadConfig } from "../config.js";
+import { activeScope, permitsUpstream } from "./state.js";
+const toolError = (message) => ({ content: [{ type: "text", text: message }], isError: true });
+export class GatewayRuntime {
+    store;
+    hosted;
+    requiredAuditSink;
+    isActorAllowed;
+    clients = new Map();
+    pending = new Map();
+    proxies = new Map();
+    proxyScope;
+    constructor(store, hosted, requiredAuditSink, isActorAllowed) {
+        this.store = store;
+        this.hosted = hosted;
+        this.requiredAuditSink = requiredAuditSink;
+        this.isActorAllowed = isActorAllowed;
+    }
+    async sync() {
+        const state = this.store.snapshot();
+        for (const [id, cached] of this.clients) {
+            const current = state.upstreams.find((item) => item.id === id);
+            if (!current || !current.enabled || JSON.stringify(current) !== cached.signature) {
+                this.clients.delete(id);
+                await cached.client.close().catch(() => undefined);
+            }
+        }
+        this.proxies.clear();
+        this.proxyScope = undefined;
+    }
+    scopeProxy(scope, serverName) {
+        if (this.proxyScope?.id !== scope.id || this.proxyScope.updatedAt !== scope.updatedAt) {
+            this.proxies.clear();
+            this.proxyScope = scope;
+        }
+        let proxy = this.proxies.get(serverName);
+        if (!proxy) {
+            proxy = new ScopeEnforcementProxy(scope.manifest, loadConfig(), this.requiredAuditSink);
+            proxy.setServerName(serverName);
+            this.proxies.set(serverName, proxy);
+        }
+        return proxy;
+    }
+    async clientFor(upstream) {
+        const signature = JSON.stringify(upstream);
+        const cached = this.clients.get(upstream.id);
+        if (cached?.signature === signature)
+            return cached.client;
+        const inFlight = this.pending.get(upstream.id);
+        if (inFlight)
+            return inFlight;
+        const connection = (async () => {
+            if (cached)
+                await cached.client.close().catch(() => undefined);
+            const client = new Client({ name: "agentic-pentest-gateway", version: "0.3.1" });
+            const transport = upstream.transport === "stdio"
+                ? new StdioClientTransport({ command: upstream.command, args: upstream.args, stderr: "pipe" })
+                : upstream.transport === "sse"
+                    ? new SSEClientTransport(new URL(upstream.url))
+                    : new StreamableHTTPClientTransport(new URL(upstream.url));
+            try {
+                await client.connect(transport, { timeout: 10_000 });
+            }
+            catch (error) {
+                await client.close().catch(() => undefined);
+                throw error;
+            }
+            this.clients.set(upstream.id, { client, signature });
+            return client;
+        })();
+        this.pending.set(upstream.id, connection);
+        try {
+            return await connection;
+        }
+        finally {
+            this.pending.delete(upstream.id);
+        }
+    }
+    available(scope) {
+        return this.store.snapshot().upstreams.filter((upstream) => {
+            if (this.hosted && upstream.transport === "stdio")
+                return false;
+            return permitsUpstream(scope, upstream);
+        });
+    }
+    createServer(actor, email) {
+        const server = new Server({ name: "agentic-pentest-gateway", version: "0.3.1" }, { capabilities: { tools: { listChanged: true } } });
+        server.setRequestHandler(ListToolsRequestSchema, async () => {
+            if (this.isActorAllowed && !this.isActorAllowed(email))
+                return { tools: [] };
+            const scope = activeScope(this.store.snapshot());
+            if (!scope)
+                return { tools: [] };
+            const groups = await Promise.all(this.available(scope).map(async (upstream) => {
+                const tools = [];
+                try {
+                    const client = await this.clientFor(upstream);
+                    let cursor;
+                    do {
+                        const page = await client.listTools(cursor ? { cursor } : undefined, { timeout: 10_000 });
+                        for (const tool of page.tools)
+                            tools.push({
+                                name: `${upstream.name}__${tool.name}`,
+                                description: tool.description,
+                                inputSchema: tool.inputSchema,
+                            });
+                        cursor = page.nextCursor;
+                    } while (cursor);
+                }
+                catch (error) {
+                    console.error(`[gateway] ${upstream.name} tool discovery failed:`, error);
+                }
+                return tools;
+            }));
+            return { tools: groups.flat() };
+        });
+        server.setRequestHandler(CallToolRequestSchema, async (request) => {
+            if (this.isActorAllowed && !this.isActorAllowed(email))
+                return toolError("User access was revoked.");
+            const scope = activeScope(this.store.snapshot());
+            if (!scope)
+                return toolError("No active scope. Ask an administrator to activate one.");
+            const upstream = this.available(scope).find((item) => request.params.name.startsWith(`${item.name}__`));
+            if (!upstream)
+                return toolError("Tool server is disabled or prohibited by the active execution profile.");
+            const toolName = request.params.name.slice(upstream.name.length + 2);
+            if (!toolName)
+                return toolError("Invalid tool name.");
+            const proxy = this.scopeProxy(scope, upstream.name);
+            const decision = await proxy.handleMessage({ jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: toolName, arguments: request.params.arguments ?? {} } }, actor);
+            if (!decision.forward) {
+                const response = decision.response;
+                return toolError(response.error?.message ?? "Blocked by the active scope.");
+            }
+            try {
+                const client = await this.clientFor(upstream);
+                let cursor;
+                let found = false;
+                do {
+                    const page = await client.listTools(cursor ? { cursor } : undefined, { timeout: 10_000 });
+                    found ||= page.tools.some((tool) => tool.name === toolName);
+                    cursor = page.nextCursor;
+                } while (!found && cursor);
+                if (!found)
+                    return toolError("Tool is no longer advertised by the upstream server.");
+                const latest = this.store.snapshot();
+                const latestScope = activeScope(latest);
+                const latestUpstream = latest.upstreams.find((item) => item.id === upstream.id);
+                if (!latestScope || latestScope.id !== scope.id || latestScope.updatedAt !== scope.updatedAt || !latestUpstream || JSON.stringify(latestUpstream) !== JSON.stringify(upstream) || !this.available(latestScope).some((item) => item.id === latestUpstream.id)) {
+                    return toolError("Scope or tool configuration changed before dispatch.");
+                }
+                if (this.isActorAllowed && !this.isActorAllowed(email))
+                    return toolError("User access was revoked before dispatch.");
+                return await client.callTool({ name: toolName, arguments: request.params.arguments ?? {} }, undefined, { timeout: 300_000 });
+            }
+            catch (error) {
+                console.error(`[gateway] ${upstream.name} tool call failed:`, error);
+                return toolError("Upstream tool call failed. See gateway logs.");
+            }
+        });
+        return server;
+    }
+    async close() {
+        await Promise.all([...this.clients.values()].map(({ client }) => client.close().catch(() => undefined)));
+        this.clients.clear();
+    }
+}
+//# sourceMappingURL=runtime.js.map

package/dist/src/gateway/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../../src/gateway/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAgB,WAAW,EAAE,eAAe,EAAmC,MAAM,YAAY,CAAC;AAEzG,MAAM,SAAS,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAEhH,MAAM,OAAO,cAAc;IAMJ;IAAsC;IAAkC;IAA2E;IALhK,OAAO,GAAG,IAAI,GAAG,EAAiD,CAAC;IACnE,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC7C,OAAO,GAAG,IAAI,GAAG,EAAiC,CAAC;IACnD,UAAU,CAAe;IAEjC,YAAqB,KAAmB,EAAmB,MAAe,EAAmB,iBAAwD,EAAmB,cAA4C;QAA/L,UAAK,GAAL,KAAK,CAAc;QAAmB,WAAM,GAAN,MAAM,CAAS;QAAmB,sBAAiB,GAAjB,iBAAiB,CAAuC;QAAmB,mBAAc,GAAd,cAAc,CAA8B;IAAG,CAAC;IAExN,KAAK,CAAC,IAAI;QACR,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACxC,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;gBACjF,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACxB,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAEO,UAAU,CAAC,KAAkB,EAAE,UAAkB;QACvD,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,KAAK,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC;YACtF,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,GAAG,IAAI,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACxF,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,QAAkB;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE;YAC7B,IAAI,MAAM;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YACjF,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,KAAK,OAAO;gBAC9C,CAAC,CAAC,IAAI,oBAAoB,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;gBAC/F,CAAC,CAAC,QAAQ,CAAC,SAAS,KAAK,KAAK;oBAC5B,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAI,CAAC,CAAC;oBAChD,CAAC,CAAC,IAAI,6BAA6B,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAI,CAAC,CAAC,CAAC;YAChE,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC5C,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC;YAAC,OAAO,MAAM,UAAU,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IAChF,CAAC;IAEO,SAAS,CAAC,KAAkB;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;YACzD,IAAI,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAChE,OAAO,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,KAAc,EAAE,KAAc;QACzC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QACrI,MAAM,CAAC,iBAAiB,CAAC,sBAAsB,EAAE,KAAK,IAAI,EAAE;YAC1D,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YAC7E,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;gBAC5E,MAAM,KAAK,GAA2G,EAAE,CAAC;gBACzH,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;oBAC9C,IAAI,MAA0B,CAAC;oBAC/B,GAAG,CAAC;wBACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;wBAC1F,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;4BAAE,KAAK,CAAC,IAAI,CAAC;gCACxC,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE;gCACtC,WAAW,EAAE,IAAI,CAAC,WAAW;gCAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;6BAC9B,CAAC,CAAC;wBACH,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;oBAC3B,CAAC,QAAQ,MAAM,EAAE;gBACnB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,aAAa,QAAQ,CAAC,IAAI,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBAC5E,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC,CAAC,CAAC,CAAC;YACJ,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,iBAAiB,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAChE,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC,0BAA0B,CAAC,CAAC;YACrG,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK;gBAAE,OAAO,SAAS,CAAC,wDAAwD,CAAC,CAAC;YACvF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;YACxG,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC,wEAAwE,CAAC,CAAC;YAC1G,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACrE,IAAI,CAAC,QAAQ;gBAAE,OAAO,SAAS,CAAC,oBAAoB,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAC1K,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAA4C,CAAC;gBACvE,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,IAAI,8BAA8B,CAAC,CAAC;YAC9E,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;gBAC9C,IAAI,MAA0B,CAAC;gBAC/B,IAAI,KAAK,GAAG,KAAK,CAAC;gBAClB,GAAG,CAAC;oBACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;oBAC1F,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;oBAC5D,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;gBAC3B,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,EAAE;gBAC3B,IAAI,CAAC,KAAK;oBAAE,OAAO,SAAS,CAAC,sDAAsD,CAAC,CAAC;gBACrF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACrC,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;gBACxC,MAAM,cAAc,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAChF,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,IAAI,WAAW,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7P,OAAO,SAAS,CAAC,sDAAsD,CAAC,CAAC;gBAC3E,CAAC;gBACD,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;oBAAE,OAAO,SAAS,CAAC,0CAA0C,CAAC,CAAC;gBACrH,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/H,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,aAAa,QAAQ,CAAC,IAAI,oBAAoB,EAAE,KAAK,CAAC,CAAC;gBACrE,OAAO,SAAS,CAAC,8CAA8C,CAAC,CAAC;YACnE,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACzG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF"}

package/dist/src/gateway/server.d.ts

@@ -0,0 +1,28 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+import { GatewayRuntime } from "./runtime.js";
+import { GatewayStore } from "./state.js";
+export interface GatewayOptions {
+    host: string;
+    port: number;
+    statePath: string;
+    adminToken?: string;
+    bootstrapAdminEmails?: string[];
+    publicUrl?: string;
+    entraTenant?: string;
+    entraAudience?: string;
+    entraScope?: string;
+    authMode?: "entra" | "cloudflare";
+    cloudflareTeamDomain?: string;
+    cloudflareAccessAud?: string;
+    internalToken?: string;
+    auditWebhookUrl?: string;
+    auditWebhookToken?: string;
+}
+export declare function createGateway(options: GatewayOptions): {
+    server: import("http").Server<typeof IncomingMessage, typeof ServerResponse>;
+    store: GatewayStore;
+    runtime: GatewayRuntime;
+    listen: () => Promise<void>;
+    close: () => Promise<void>;
+};
+//# sourceMappingURL=server.d.ts.map

package/dist/src/gateway/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/gateway/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,WAAW,CAAC;AAOpF,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAqD,MAAM,YAAY,CAAC;AAO7F,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,GAAG,YAAY,CAAC;IAClC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AA0BD,wBAAgB,aAAa,CAAC,OAAO,EAAE,cAAc;;;;;;EAwLpD"}

package/dist/src/gateway/server.js

@@ -0,0 +1,316 @@
+import { createServer } from "node:http";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { timingSafeEqual } from "node:crypto";
+import { z } from "zod";
+import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
+import { GatewayAuth } from "./auth.js";
+import { GatewayRuntime } from "./runtime.js";
+import { GatewayStore, activeScope, parseScope, parseUpstream, parseUser } from "./state.js";
+const MAX_BODY = 1024 * 1024;
+const html = readFileSync(fileURLToPath(new URL("./admin.html", import.meta.url)), "utf8");
+const js = readFileSync(fileURLToPath(new URL("./admin.js", import.meta.url)), "utf8");
+function json(res, code, body) {
+    res.writeHead(code, { "Content-Type": "application/json; charset=utf-8", "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff" });
+    res.end(JSON.stringify(body));
+}
+async function body(req) {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of req) {
+        size += chunk.length;
+        if (size > MAX_BODY)
+            throw new Error("Request exceeds 1 MiB");
+        chunks.push(chunk);
+    }
+    return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+}
+function authorizedAdmin(req, token) {
+    if (!token)
+        return false;
+    const supplied = /^Bearer (.+)$/i.exec(req.headers.authorization ?? "")?.[1] ?? "";
+    const a = Buffer.from(supplied);
+    const b = Buffer.from(token);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+export function createGateway(options) {
+    const accessMode = Boolean(options.publicUrl && options.authMode === "cloudflare");
+    if (!accessMode && (options.adminToken?.length ?? 0) < 32)
+        throw new Error("GATEWAY_ADMIN_TOKEN must be at least 32 characters");
+    if (accessMode && !options.bootstrapAdminEmails?.length)
+        throw new Error("Cloudflare mode requires at least one GATEWAY_BOOTSTRAP_ADMIN_EMAILS entry");
+    if (options.host !== "127.0.0.1" && options.host !== "::1" && !options.publicUrl)
+        throw new Error("Non-loopback gateway requires GATEWAY_PUBLIC_URL and authentication configuration");
+    if (Boolean(options.auditWebhookUrl) !== Boolean(options.auditWebhookToken))
+        throw new Error("AUDIT_WEBHOOK_URL and AUDIT_WEBHOOK_TOKEN must be set together");
+    if (options.auditWebhookUrl && (new URL(options.auditWebhookUrl).protocol !== "https:" || options.auditWebhookToken.length < 32))
+        throw new Error("Durable audit webhook requires HTTPS and a token of at least 32 characters");
+    const store = new GatewayStore(options.statePath, options.bootstrapAdminEmails);
+    const requiredAuditSink = options.auditWebhookUrl ? async (entry) => {
+        const response = await fetch(options.auditWebhookUrl, {
+            method: "POST", headers: { Authorization: `Bearer ${options.auditWebhookToken}`, "Content-Type": "application/json" },
+            body: JSON.stringify(entry), signal: AbortSignal.timeout(10_000), redirect: "error",
+        });
+        if (!response.ok)
+            throw new Error(`Audit webhook returned HTTP ${response.status}`);
+        await response.body?.cancel();
+    } : undefined;
+    const isAllowed = (email) => Boolean(email && store.snapshot().users.some((user) => user.email === email));
+    const runtime = new GatewayRuntime(store, Boolean(options.publicUrl), requiredAuditSink, accessMode ? isAllowed : undefined);
+    const auth = new GatewayAuth(options.publicUrl, options.entraTenant, options.authMode === "cloudflare" ? options.cloudflareAccessAud : options.entraAudience, options.entraScope, options.authMode, options.cloudflareTeamDomain);
+    const authenticate = async (req, res) => {
+        const identity = await auth.authorize(req, res);
+        if (!identity)
+            return false;
+        if (!accessMode)
+            return { identity, role: undefined };
+        const user = store.snapshot().users.find((item) => item.email === identity.email);
+        if (!user) {
+            json(res, 403, { error: "User is not allowed by the gateway" });
+            return false;
+        }
+        return { identity, role: user.role };
+    };
+    const server = createServer(async (req, res) => {
+        try {
+            const url = new URL(req.url ?? "/", `http://${req.headers.host ?? "localhost"}`);
+            const requestHost = new URL(`http://${req.headers.host ?? "invalid"}`).hostname;
+            const publicHost = options.publicUrl ? new URL(options.publicUrl).hostname : undefined;
+            if (requestHost !== publicHost && !["127.0.0.1", "localhost", "[::1]"].includes(requestHost)) {
+                json(res, 421, { error: "invalid host" });
+                return;
+            }
+            const pathname = url.pathname;
+            if (pathname === "/healthz") {
+                json(res, 200, { status: "ok" });
+                return;
+            }
+            if (pathname === "/__internal/state" && options.internalToken && authorizedAdmin(req, options.internalToken)) {
+                if (req.method === "GET") {
+                    json(res, 200, store.snapshot());
+                    return;
+                }
+                if (req.method === "PUT") {
+                    const state = store.replace(await body(req));
+                    await runtime.sync();
+                    json(res, 200, state);
+                    return;
+                }
+            }
+            if (pathname === "/.well-known/oauth-protected-resource" || pathname === "/.well-known/oauth-protected-resource/mcp") {
+                if (!options.publicUrl || options.authMode === "cloudflare") {
+                    json(res, 404, { error: "OAuth metadata is served by Cloudflare Access or not configured" });
+                    return;
+                }
+                json(res, 200, await auth.protectedResource());
+                return;
+            }
+            if (pathname === "/mcp") {
+                const session = await authenticate(req, res);
+                if (!session)
+                    return;
+                if (options.publicUrl && activeScope(store.snapshot())?.profile === "isolated") {
+                    json(res, 403, { error: "Isolated scopes cannot use the public MCP endpoint" });
+                    return;
+                }
+                if (req.method !== "POST") {
+                    res.writeHead(405, { Allow: "POST" });
+                    res.end();
+                    return;
+                }
+                if (Number(req.headers["content-length"] ?? 0) > MAX_BODY) {
+                    json(res, 413, { error: "Request exceeds 1 MiB" });
+                    return;
+                }
+                const parsed = await body(req);
+                const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+                const mcp = runtime.createServer(session.identity.actor, session.identity.email);
+                try {
+                    await mcp.connect(transport);
+                    await transport.handleRequest(req, res, parsed);
+                }
+                finally {
+                    await mcp.close();
+                }
+                return;
+            }
+            if (pathname === "/admin" && req.method === "GET") {
+                if (accessMode) {
+                    const session = await authenticate(req, res);
+                    if (!session)
+                        return;
+                    if (session.role !== "admin") {
+                        json(res, 403, { error: "Administrator access required" });
+                        return;
+                    }
+                }
+                res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Content-Security-Policy": "default-src 'none'; script-src 'self'; style-src 'unsafe-inline'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'", "X-Content-Type-Options": "nosniff", "Referrer-Policy": "no-referrer" });
+                res.end(html);
+                return;
+            }
+            if (pathname === "/admin.js" && req.method === "GET") {
+                if (accessMode) {
+                    const session = await authenticate(req, res);
+                    if (!session)
+                        return;
+                    if (session.role !== "admin") {
+                        json(res, 403, { error: "Administrator access required" });
+                        return;
+                    }
+                }
+                res.writeHead(200, { "Content-Type": "text/javascript; charset=utf-8", "Cache-Control": "no-store", "X-Content-Type-Options": "nosniff" });
+                res.end(js);
+                return;
+            }
+            if (!pathname.startsWith("/api/")) {
+                json(res, 404, { error: "not found" });
+                return;
+            }
+            const origin = req.headers.origin;
+            if (origin && origin !== `http://${req.headers.host}` && origin !== options.publicUrl) {
+                json(res, 403, { error: "invalid origin" });
+                return;
+            }
+            if (accessMode) {
+                const session = await authenticate(req, res);
+                if (!session)
+                    return;
+                if (session.role !== "admin") {
+                    json(res, 403, { error: "Administrator access required" });
+                    return;
+                }
+                if (pathname === "/api/session" && req.method === "GET") {
+                    json(res, 200, { mode: "access", email: session.identity.email, bootstrapAdminEmails: [...store.bootstrapAdminEmails] });
+                    return;
+                }
+            }
+            if (pathname === "/api/session" && req.method === "GET") {
+                json(res, 200, { mode: "token", bootstrapAdminEmails: [] });
+                return;
+            }
+            if (!accessMode && !authorizedAdmin(req, options.adminToken)) {
+                json(res, 401, { error: "admin token required" });
+                return;
+            }
+            if (pathname === "/api/state" && req.method === "GET") {
+                json(res, 200, store.snapshot());
+                return;
+            }
+            if (accessMode && pathname === "/api/users" && req.method === "POST") {
+                const user = parseUser(await body(req));
+                store.update((draft) => { draft.users.push(user); });
+                json(res, 201, user);
+                return;
+            }
+            const userMatch = /^\/api\/users\/([0-9a-f-]{36})$/.exec(pathname);
+            if (accessMode && userMatch && req.method === "PATCH") {
+                const input = z.object({ role: z.enum(["admin", "tester"]) }).parse(await body(req));
+                const updated = store.update((draft) => {
+                    const user = draft.users.find((item) => item.id === userMatch[1]);
+                    if (!user)
+                        throw new Error("User not found");
+                    if (store.bootstrapAdminEmails.has(user.email))
+                        throw new Error("Bootstrap administrator cannot be changed");
+                    user.role = input.role;
+                });
+                json(res, 200, updated);
+                return;
+            }
+            if (accessMode && userMatch && req.method === "DELETE") {
+                const updated = store.update((draft) => {
+                    const user = draft.users.find((item) => item.id === userMatch[1]);
+                    if (!user)
+                        throw new Error("User not found");
+                    if (store.bootstrapAdminEmails.has(user.email))
+                        throw new Error("Bootstrap administrator cannot be removed");
+                    draft.users = draft.users.filter((item) => item.id !== user.id);
+                });
+                json(res, 200, updated);
+                return;
+            }
+            if (pathname === "/api/upstreams" && req.method === "POST") {
+                const upstream = parseUpstream(await body(req));
+                if (options.publicUrl && upstream.transport === "stdio") {
+                    json(res, 400, { error: "Hosted gateway cannot spawn local processes" });
+                    return;
+                }
+                store.update((draft) => { draft.upstreams.push(upstream); });
+                await runtime.sync();
+                json(res, 201, upstream);
+                return;
+            }
+            const upstreamMatch = /^\/api\/upstreams\/([0-9a-f-]{36})$/.exec(pathname);
+            if (upstreamMatch && req.method === "PATCH") {
+                const input = z.object({ enabled: z.boolean() }).parse(await body(req));
+                const updated = store.update((draft) => {
+                    const item = draft.upstreams.find((value) => value.id === upstreamMatch[1]);
+                    if (!item)
+                        throw new Error("Upstream not found");
+                    item.enabled = input.enabled;
+                });
+                await runtime.sync();
+                json(res, 200, updated);
+                return;
+            }
+            if (upstreamMatch && req.method === "DELETE") {
+                const updated = store.update((draft) => { draft.upstreams = draft.upstreams.filter((value) => value.id !== upstreamMatch[1]); });
+                await runtime.sync();
+                json(res, 200, updated);
+                return;
+            }
+            if (pathname === "/api/scopes" && req.method === "POST") {
+                const scope = parseScope(await body(req));
+                store.update((draft) => { draft.scopes.push(scope); });
+                json(res, 201, scope);
+                return;
+            }
+            const scopeMatch = /^\/api\/scopes\/([0-9a-f-]{36})$/.exec(pathname);
+            if (scopeMatch && req.method === "PUT") {
+                const scope = parseScope(await body(req), scopeMatch[1]);
+                const updated = store.update((draft) => {
+                    if (draft.activeScopeId === scope.id)
+                        throw new Error("Active scope cannot be edited; save a new draft");
+                    const index = draft.scopes.findIndex((item) => item.id === scope.id);
+                    if (index < 0)
+                        throw new Error("Scope not found");
+                    draft.scopes[index] = scope;
+                });
+                json(res, 200, updated);
+                return;
+            }
+            if (scopeMatch && req.method === "DELETE") {
+                const updated = store.update((draft) => {
+                    if (draft.activeScopeId === scopeMatch[1])
+                        throw new Error("Active scope cannot be deleted");
+                    draft.scopes = draft.scopes.filter((item) => item.id !== scopeMatch[1]);
+                });
+                json(res, 200, updated);
+                return;
+            }
+            const activateMatch = /^\/api\/scopes\/([0-9a-f-]{36})\/activate$/.exec(pathname);
+            if (activateMatch && req.method === "POST") {
+                const updated = store.update((draft) => {
+                    const scope = draft.scopes.find((item) => item.id === activateMatch[1]);
+                    if (!scope)
+                        throw new Error("Scope not found");
+                    if (Date.now() < Date.parse(scope.manifest.engagement_window.start) || Date.now() > Date.parse(scope.manifest.engagement_window.end))
+                        throw new Error("Scope window is not active");
+                    draft.activeScopeId = scope.id;
+                });
+                await runtime.sync();
+                json(res, 200, updated);
+                return;
+            }
+            json(res, 404, { error: "not found" });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : "Request failed";
+            json(res, error instanceof z.ZodError || error instanceof SyntaxError ? 400 : 409, { error: message });
+        }
+    });
+    return { server, store, runtime, listen: () => new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(options.port, options.host, () => { server.off("error", reject); resolve(); });
+        }), close: async () => { await new Promise((resolve) => server.close(() => resolve())); await runtime.close(); } };
+}
+//# sourceMappingURL=server.js.map

package/dist/src/gateway/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/gateway/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAG7F,MAAM,QAAQ,GAAG,IAAI,GAAG,IAAI,CAAC;AAC7B,MAAM,IAAI,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAC3F,MAAM,EAAE,GAAG,YAAY,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAoBvF,SAAS,IAAI,CAAC,GAAmB,EAAE,IAAY,EAAE,IAAa;IAC5D,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,eAAe,EAAE,UAAU,EAAE,wBAAwB,EAAE,SAAS,EAAE,CAAC,CAAC;IAC7I,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAoB;IACtC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QAC9B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;QACrB,IAAI,IAAI,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,eAAe,CAAC,GAAoB,EAAE,KAAyB;IACtE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,OAAuB;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACjI,IAAI,UAAU,IAAI,CAAC,OAAO,CAAC,oBAAoB,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IACvJ,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvL,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IAC/J,IAAI,OAAO,CAAC,eAAe,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,iBAAkB,CAAC,MAAM,GAAG,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IACjO,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAChF,MAAM,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,EAAE,KAAiB,EAAE,EAAE;QAC9E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,eAAgB,EAAE;YACrD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,iBAAiB,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACrH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,OAAO;SACpF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC;IACpH,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC7H,MAAM,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClO,MAAM,YAAY,GAAG,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5B,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,CAAC,CAAC;QAClF,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QAC7F,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;YACjF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC;YAChF,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,IAAI,WAAW,KAAK,UAAU,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7F,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBAAC,OAAO;YACpD,CAAC;YACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC9B,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC1E,IAAI,QAAQ,KAAK,mBAAmB,IAAI,OAAO,CAAC,aAAa,IAAI,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC7G,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACvE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBAAC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;YAClI,CAAC;YACD,IAAI,QAAQ,KAAK,uCAAuC,IAAI,QAAQ,KAAK,2CAA2C,EAAE,CAAC;gBACrH,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACtK,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC;gBAAC,OAAO;YACzD,CAAC;YACD,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC7C,IAAI,CAAC,OAAO;oBAAE,OAAO;gBACrB,IAAI,OAAO,CAAC,SAAS,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,EAAE,OAAO,KAAK,UAAU,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,oDAAoD,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC5K,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;oBAAC,GAAG,CAAC,GAAG,EAAE,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACxF,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC1H,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC/B,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;gBACvF,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBACjF,IAAI,CAAC;oBACH,MAAM,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;oBAC7B,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAClD,CAAC;wBAAS,CAAC;oBACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;gBACpB,CAAC;gBACD,OAAO;YACT,CAAC;YACD,IAAI,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAClD,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC7C,IAAI,CAAC,OAAO;wBAAE,OAAO;oBACrB,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;gBACvG,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE,yBAAyB,EAAE,mJAAmJ,EAAE,wBAAwB,EAAE,SAAS,EAAE,iBAAiB,EAAE,aAAa,EAAE,CAAC,CAAC;gBACvV,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO;YACxB,CAAC;YACD,IAAI,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACrD,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC7C,IAAI,CAAC,OAAO;wBAAE,OAAO;oBACrB,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;wBAAC,OAAO;oBAAC,CAAC;gBACvG,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,gCAAgC,EAAE,eAAe,EAAE,UAAU,EAAE,wBAAwB,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC3I,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAAC,OAAO;YACtB,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACtF,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,IAAI,MAAM,IAAI,MAAM,KAAK,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,MAAM,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/I,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC7C,IAAI,CAAC,OAAO;oBAAE,OAAO;gBACrB,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACrG,IAAI,QAAQ,KAAK,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;oBACxD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,EAAE,CAAC,GAAG,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;oBAAC,OAAO;gBACnI,CAAC;YACH,CAAC;YACD,IAAI,QAAQ,KAAK,cAAc,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACxD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,CAAC,CAAC;gBAAC,OAAO;YACtE,CAAC;YACD,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC5H,IAAI,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACpG,IAAI,UAAU,IAAI,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACrE,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;gBAAC,OAAO;YAC/B,CAAC;YACD,MAAM,SAAS,GAAG,iCAAiC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACnE,IAAI,UAAU,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACtD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBACrF,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClE,IAAI,CAAC,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBAC7C,IAAI,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;oBAC7G,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;gBACzB,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO;YAClC,CAAC;YACD,IAAI,UAAU,IAAI,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;oBAClE,IAAI,CAAC,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;oBAC7C,IAAI,KAAK,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;oBAC7G,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClE,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO;YAClC,CAAC;YACD,IAAI,QAAQ,KAAK,gBAAgB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3D,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAChD,IAAI,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,6CAA6C,EAAE,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAC9I,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7D,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAAC,OAAO;YACzD,CAAC;YACD,MAAM,aAAa,GAAG,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC3E,IAAI,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxE,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrC,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC5E,IAAI,CAAC,IAAI;wBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;oBACjD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;gBAC/B,CAAC,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO;YACxD,CAAC;YACD,IAAI,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjI,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO;YACxD,CAAC;YACD,IAAI,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACxD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC1C,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;gBAAC,OAAO;YAChC,CAAC;YACD,MAAM,UAAU,GAAG,kCAAkC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrE,IAAI,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrC,IAAI,KAAK,CAAC,aAAa,KAAK,KAAK,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;oBACzG,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;oBACrE,IAAI,KAAK,GAAG,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAClD,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;gBAC9B,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO;YAClC,CAAC;YACD,IAAI,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrC,IAAI,KAAK,CAAC,aAAa,KAAK,UAAU,CAAC,CAAC,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;oBAC7F,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1E,CAAC,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO;YAClC,CAAC;YACD,MAAM,aAAa,GAAG,4CAA4C,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;oBACrC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;oBACxE,IAAI,CAAC,KAAK;wBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;oBAC/C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;oBACpL,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,EAAE,CAAC;gBACjC,CAAC,CAAC,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;gBAAC,OAAO;YACxD,CAAC;YACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC;YAC1E,IAAI,CAAC,GAAG,EAAE,KAAK,YAAY,CAAC,CAAC,QAAQ,IAAI,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACnF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3H,CAAC"}