@intutic/mcp-governance-proxy 2.0.0 → 2.2.0

package/dist/policy.js

@@ -6,10 +6,9 @@
  *
  * @module
  */
-import * as node_https from 'node:https';
-import * as node_http from 'node:http';
 import { createStderrLogger as createLogger } from './stderrLog.js';
 import { callDaemonSocket } from './daemonClient.js';
+import { HttpStatusError, httpRequest } from './httpJson.js';
 const log = createLogger('mcp-proxy-policy');
 /**
  * Is this unvalidated object actually a policy rule?
@@ -42,6 +41,67 @@ export function isSopRule(value) {
         (r['argPattern'] === undefined || typeof r['argPattern'] === 'string') &&
         (r['action'] === 'block' || r['action'] === 'warn' || r['action'] === 'require_approval'));
 }
+/**
+ * What an older control plane — one that sends no `mcpRegistry` at all —
+ * means: no registry, so nothing is refused on its account. Distinct from an
+ * UNKNOWN registry (no policy loaded yet), which the interceptor resolves
+ * through the fail-open/fail-closed setting instead.
+ */
+export const UNRESTRICTED_REGISTRY = Object.freeze({
+    defaultPolicy: 'allow',
+    approvedServers: [],
+    blockedServers: [],
+    disabledTools: {},
+});
+function stringList(value) {
+    return Array.isArray(value) ? value.filter((v) => typeof v === 'string') : [];
+}
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Parses `mcpRegistry`. Returns `undefined` for anything that is not a
+ * registry object, so the caller decides what absence means for its source.
+ */
+export function parseRegistry(value) {
+    if (!isPlainObject(value))
+        return undefined;
+    const disabledTools = {};
+    if (isPlainObject(value['disabledTools'])) {
+        for (const [server, tools] of Object.entries(value['disabledTools'])) {
+            const list = stringList(tools);
+            if (list.length > 0)
+                disabledTools[server] = list;
+        }
+    }
+    return {
+        defaultPolicy: value['defaultPolicy'] === 'deny' ? 'deny' : 'allow',
+        approvedServers: stringList(value['approvedServers']),
+        blockedServers: stringList(value['blockedServers']),
+        disabledTools,
+    };
+}
+export function parsePrincipal(value) {
+    if (!isPlainObject(value) || typeof value['memberId'] !== 'string' || !value['memberId'])
+        return undefined;
+    return {
+        memberId: value['memberId'],
+        email: typeof value['email'] === 'string' ? value['email'] : '',
+        role: typeof value['role'] === 'string' ? value['role'] : '',
+        ssoGroups: stringList(value['ssoGroups']),
+    };
+}
+export function parseSsoGroupPolicy(value) {
+    if (!isPlainObject(value))
+        return undefined;
+    return {
+        highRiskTools: stringList(value['highRiskTools']),
+        requiredGroups: stringList(value['requiredGroups']),
+        requireOboFor: stringList(value['requireOboFor']),
+    };
+}
+/** How long a proxy waits between on-demand refreshes while it has no registry. */
+const UNKNOWN_REGISTRY_RETRY_MS = 5_000;
 export class PolicyClient {
     controlPlaneUrl;
     apiKey;
@@ -100,7 +160,26 @@ export class PolicyClient {
      * above uses.
      */
     anomalyOverrides = {};
-    lastFetchAt = 0;
+    /**
+     * Registry decisions from the last policy that carried them. `undefined`
+     * until then — no policy has loaded in this process, or the only one so far
+     * was the MCP daemon's snapshot seed, which carries none. The interceptor
+     * resolves that state through the fail-open/fail-closed setting.
+     */
+    registry;
+    principal;
+    /**
+     * The workspace's `mcpProxyFailBehavior` as a fail-open flag, or
+     * `undefined` when the control plane did not send it (the workspace never
+     * chose, or no policy has loaded) — then `INTUTIC_MCP_FAIL_OPEN` decides.
+     */
+    failOpen;
+    ssoGroupPolicy;
+    /** The first refresh `start()` kicks off, so the first tool call can wait for it. */
+    firstRefresh = null;
+    lastRefreshAttemptAt = 0;
+    /** Whether a policy that came from the control plane (directly or through the daemon's fetch) has loaded. */
+    loadedFromControlPlane = false;
     refreshTimer = null;
     constructor(controlPlaneUrl, apiKey, workspaceId, ttlMs = 60_000, mcpProxyMode = 'per-session') {
         this.controlPlaneUrl = controlPlaneUrl;
@@ -130,8 +209,9 @@ export class PolicyClient {
         }, this.ttlMs);
         // Don't block Node.js exit on this timer
         this.refreshTimer.unref();
-        // Kick off initial fetch (non-blocking — proxy starts immediately)
-        void this.refresh().catch(() => { });
+        // Kick off initial fetch (non-blocking — proxy starts immediately; the
+        // first tool call waits for it through `ready()`).
+        this.firstRefresh = this.refresh().catch(() => { });
         if (onTick)
             void Promise.resolve(onTick()).catch(() => { });
     }
@@ -142,6 +222,43 @@ export class PolicyClient {
             this.refreshTimer = null;
         }
     }
+    /**
+     * Resolves once the policy is as loaded as it is going to get for this call.
+     *
+     * The first tool call of a process can arrive before `start()`'s first
+     * fetch has answered; without this wait, a `deny` workspace's very first
+     * call would be decided against no registry at all. After that, while the
+     * registry is still unknown (control plane unreachable, or only the
+     * daemon's snapshot seed so far), a call triggers one more refresh at most
+     * every {@link UNKNOWN_REGISTRY_RETRY_MS} — so a proxy started offline
+     * picks the registry up as soon as it can, not at the next 60-second tick.
+     * Never rejects; every wait is bounded by the 5-second fetch timeout.
+     */
+    async ready() {
+        if (this.firstRefresh)
+            await this.firstRefresh;
+        if (this.registry !== undefined)
+            return;
+        if (Date.now() - this.lastRefreshAttemptAt < UNKNOWN_REGISTRY_RETRY_MS)
+            return;
+        await this.refresh().catch(() => { });
+    }
+    /** Registry decisions, or `undefined` while none has loaded (see the field). */
+    getRegistry() {
+        return this.registry;
+    }
+    /** The member this proxy's key resolves to, when the control plane said. */
+    getPrincipal() {
+        return this.principal;
+    }
+    /** The workspace's SSO group policy, when it has one. */
+    getSsoGroupPolicy() {
+        return this.ssoGroupPolicy;
+    }
+    /** The workspace's fail-open choice, or `undefined` to fall back to the local setting (see the field). */
+    getFailOpen() {
+        return this.failOpen;
+    }
     /** Return the current cached rule set. */
     getRules() {
         return this.rules;
@@ -221,6 +338,10 @@ export class PolicyClient {
                     this.anomalyOverrides[k] = v;
             }
         }
+        this.principal = parsePrincipal(source['principal']);
+        this.ssoGroupPolicy = parseSsoGroupPolicy(source['ssoGroupPolicy']);
+        const failBehavior = source['mcpProxyFailBehavior'];
+        this.failOpen = failBehavior === 'open' ? true : failBehavior === 'closed' ? false : undefined;
     }
     /** Find the first matching rule for a given tool name + serialized args. */
     matchRule(toolName, toolInputJson) {
@@ -244,6 +365,7 @@ export class PolicyClient {
     }
     /** Fetch fresh rules from the control plane. */
     async refresh() {
+        this.lastRefreshAttemptAt = Date.now();
         if (this.mcpProxyMode === 'daemon') {
             try {
                 // The socket returns whatever the daemon serialised, so the caller
@@ -268,9 +390,25 @@ export class PolicyClient {
                     if (dropped > 0) {
                         log.warn({ action: 'policy_rules_malformed', dropped, kept: this.rules.length }, 'Dropped malformed SOP rules from the daemon — they cannot be enforced');
                     }
+                    // A restarted daemon answers from the sync daemon's snapshot until
+                    // its first fetch, and the snapshot carries the rules and the server
+                    // allowlist but no tool allowlist, description overrides, DLP or
+                    // injection patterns, registry or dispositions. Absorbing that over
+                    // a policy this process already loaded would lift every restriction
+                    // the snapshot lacks — a daemon restart as a way to disarm curation.
+                    // So once a control-plane policy has loaded, a snapshot answer
+                    // updates the rules and nothing else; before that, it is the best
+                    // policy there is.
+                    if (policy.fromSnapshot && this.loadedFromControlPlane) {
+                        log.info({ action: 'policy_snapshot_rules_only', ruleCount: this.rules.length }, 'Daemon answered from its snapshot; kept the loaded curation');
+                        return;
+                    }
                     this.dlpPatterns = (policy.dlpPatterns ?? []).filter((p) => typeof p === 'string');
                     this.absorbCuration(policy);
-                    this.lastFetchAt = Date.now();
+                    if (policy.mcpRegistry)
+                        this.registry = policy.mcpRegistry;
+                    if (!policy.fromSnapshot)
+                        this.loadedFromControlPlane = true;
                     log.info({ action: 'policy_refreshed_from_daemon', ruleCount: this.rules.length }, 'SOP rules refreshed from daemon');
                     return;
                 }
@@ -284,7 +422,19 @@ export class PolicyClient {
         }
         const url = `${this.controlPlaneUrl}/api/v1/sop/rules?workspaceId=${encodeURIComponent(this.workspaceId)}&active=true`;
         log.debug({ action: 'policy_refresh', url }, 'Fetching SOP rules from control plane');
-        const body = await httpGet(url, this.apiKey);
+        let body;
+        try {
+            body = await httpRequest('GET', url, this.apiKey);
+        }
+        catch (err) {
+            // The control plane refused this proxy's key: revoked, or its member
+            // deactivated or offboarded. Every other rule stays as loaded, but the
+            // member's SSO groups were vouched for by that key, so the proxy stops
+            // knowing them — a high-risk tool is refused until a key works again.
+            if (err instanceof HttpStatusError && (err.status === 401 || err.status === 403))
+                this.principal = undefined;
+            throw err;
+        }
         const parsed = JSON.parse(body);
         const rules = Array.isArray(parsed.rules) ? parsed.rules : [];
         this.rules = rules;
@@ -293,39 +443,10 @@ export class PolicyClient {
             ? dlp.filter((p) => typeof p === 'string')
             : [];
         this.absorbCuration(parsed);
-        this.lastFetchAt = Date.now();
+        // A control plane that sends no registry has none: unrestricted, not unknown.
+        this.registry = parseRegistry(parsed['mcpRegistry']) ?? UNRESTRICTED_REGISTRY;
+        this.loadedFromControlPlane = true;
         log.info({ action: 'policy_refreshed', ruleCount: rules.length }, 'SOP rules refreshed');
     }
 }
-/** Minimal HTTP/HTTPS GET helper (avoids fetch / node-fetch dep). */
-function httpGet(url, apiKey) {
-    return new Promise((resolve, reject) => {
-        const parsed = new URL(url);
-        const lib = parsed.protocol === 'https:' ? node_https : node_http;
-        const req = lib.get(url, {
-            headers: {
-                Authorization: `Bearer ${apiKey}`,
-                Accept: 'application/json',
-            },
-            timeout: 5000,
-        }, (res) => {
-            const chunks = [];
-            res.on('data', (c) => chunks.push(c));
-            res.on('end', () => {
-                const body = Buffer.concat(chunks).toString('utf-8');
-                if ((res.statusCode ?? 0) >= 400) {
-                    reject(new Error(`HTTP ${res.statusCode ?? 'unknown'}: ${body}`));
-                }
-                else {
-                    resolve(body);
-                }
-            });
-        });
-        req.on('error', reject);
-        req.on('timeout', () => {
-            req.destroy();
-            reject(new Error('Policy fetch timed out'));
-        });
-    });
-}
 //# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAGpD,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAc5C;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ;QACpC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAC/B,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC;QACtE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,kBAAkB,CAAC,CAC1F,CAAA;AACH,CAAC;AAMD,MAAM,OAAO,YAAY;IAyDJ;IACA;IACA;IACA;IACA;IA5DX,KAAK,GAAc,EAAE,CAAA;IAC7B;;;;;OAKG;IACK,WAAW,GAAa,EAAE,CAAA;IAClC,gGAAgG;IACxF,iBAAiB,GAAa,EAAE,CAAA;IACxC;;;;;;OAMG;IACK,YAAY,GAAa,EAAE,CAAA;IACnC,2EAA2E;IACnE,wBAAwB,GAA2B,EAAE,CAAA;IAC7D;;;;;;OAMG;IACK,cAAc,GAAa,EAAE,CAAA;IACrC;;;;;;;OAOG;IACK,eAAe,CAA8B;IACrD;;;;OAIG;IACK,WAAW,CAAwC;IAC3D;;;;;;;OAOG;IACK,gBAAgB,GAAuD,EAAE,CAAA;IACzE,WAAW,GAAG,CAAC,CAAA;IACf,YAAY,GAA0B,IAAI,CAAA;IAElD,YACmB,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,QAAgB,MAAM,EACtB,eAAuB,aAAa;QAJpC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,gBAAW,GAAX,WAAW,CAAQ;QACnB,UAAK,GAAL,KAAK,CAAiB;QACtB,iBAAY,GAAZ,YAAY,CAAwB;IACpD,CAAC;IAEJ;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAmC;QACvC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,yCAAyC;YAC3C,CAAC,CAAC,CAAA;YACF,IAAI,MAAM;gBAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5D,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACd,yCAAyC;QACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAA;QAEzB,mEAAmE;QACnE,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QACnC,IAAI,MAAM;YAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,yCAAyC;IACzC,IAAI;QACF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,oEAAoE;IACpE,gGAAgG;IAChG,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAA;IAC/B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,6DAA6D;IAC7D,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,mEAAmE;IACnE,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED,8DAA8D;IAC9D,2BAA2B;QACzB,OAAO,IAAI,CAAC,wBAAwB,CAAA;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED,yFAAyF;IACzF,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAA;IAC9B,CAAC;IAED,uEAAuE;IAC/D,cAAc,CAAC,MAA+B;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACnE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC3D,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,SAAS,GAAG,MAAM,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC,6BAA6B,CAAC,CAAA;QAC7F,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAA;QAClC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;gBAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjE,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC9E,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YACjD,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAClE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,iBAAiB,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACxD,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACvD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACrE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,eAAe,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAA;QACpD,IAAI,CAAC,eAAe;YAClB,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;QACzF,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC5C,IAAI,CAAC,WAAW;YACd,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;QACxG,MAAM,gBAAgB,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACtD,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAA;QAC1B,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1G,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAA2C,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK;oBAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjG,CAAC;QACH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,SAAS,CAAC,QAAgB,EAAE,aAAqB;QAC/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;gBAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,SAAQ;gBACvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;oBAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;wBAAE,SAAQ;gBAC7C,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,OAAO;QACX,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,mEAAmE;gBACnE,0EAA0E;gBAC1E,yEAAyE;gBACzE,uDAAuD;gBACvD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAwB,YAAY,EAAE;oBACzE,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAA;gBACF,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;oBACxC,qEAAqE;oBACrE,uEAAuE;oBACvE,mEAAmE;oBACnE,MAAM,QAAQ,GAAc,EAAE,CAAA;oBAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;wBACnC,IAAI,SAAS,CAAC,SAAS,CAAC;4BAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBACpD,CAAC;oBACD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAA;oBACrB,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;oBACnD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;wBAChB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EACtE,uEAAuE,CACxE,CAAA;oBACH,CAAC;oBACD,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAA;oBACD,IAAI,CAAC,cAAc,CAAC,MAA4C,CAAC,CAAA;oBACjE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;oBAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;oBACrH,OAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN;oBACE,MAAM,EAAE,sBAAsB;oBAC9B,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACtD,EACD,oEAAoE,CACrE,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,iCAAiC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAA;QACtH,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAA;QAErF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+C,CAAA;QAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;QACjC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACvD,CAAC,CAAC,EAAE,CAAA;QACN,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;IAC1F,CAAC;CACF;AAED,qEAAqE;AACrE,SAAS,OAAO,CAAC,GAAW,EAAE,MAAc;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;QACjE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CACjB,GAAG,EACH;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,EAAE;gBACjC,MAAM,EAAE,kBAAkB;aAC3B;YACD,OAAO,EAAE,IAAI;SACd,EACD,CAAC,GAAG,EAAE,EAAE;YACN,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YAC7C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBACpD,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;oBACjC,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,UAAU,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;gBACnE,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,CAAA;gBACf,CAAC;YACH,CAAC,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,EAAE,CAAA;YACb,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAA;QAC7C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAG5D,MAAM,GAAG,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAA;AAc5C;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,MAAM,CAAC,GAAG,KAAgC,CAAA;IAC1C,OAAO,CACL,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ;QACpC,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ;QAC/B,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC;QACtE,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,kBAAkB,CAAC,CAC1F,CAAA;AACH,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,MAAM,CAAC,MAAM,CAAC;IACpE,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,EAAE;IACnB,cAAc,EAAE,EAAE;IAClB,aAAa,EAAE,EAAE;CAClB,CAAsB,CAAA;AAqBvB,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC5F,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3C,MAAM,aAAa,GAA6B,EAAE,CAAA;IAClD,IAAI,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAA;YAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;QACnD,CAAC;IACH,CAAC;IACD,OAAO;QACL,aAAa,EAAE,KAAK,CAAC,eAAe,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;QACnE,eAAe,EAAE,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACrD,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnD,aAAa;KACd,CAAA;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1G,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC;QAC3B,KAAK,EAAE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;QAC/D,IAAI,EAAE,OAAO,KAAK,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE;QAC5D,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;KAC1C,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAA;IAC3C,OAAO;QACL,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACjD,cAAc,EAAE,UAAU,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACnD,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;KAClD,CAAA;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,yBAAyB,GAAG,KAAK,CAAA;AAEvC,MAAM,OAAO,YAAY;IA4EJ;IACA;IACA;IACA;IACA;IA/EX,KAAK,GAAc,EAAE,CAAA;IAC7B;;;;;OAKG;IACK,WAAW,GAAa,EAAE,CAAA;IAClC,gGAAgG;IACxF,iBAAiB,GAAa,EAAE,CAAA;IACxC;;;;;;OAMG;IACK,YAAY,GAAa,EAAE,CAAA;IACnC,2EAA2E;IACnE,wBAAwB,GAA2B,EAAE,CAAA;IAC7D;;;;;;OAMG;IACK,cAAc,GAAa,EAAE,CAAA;IACrC;;;;;;;OAOG;IACK,eAAe,CAA8B;IACrD;;;;OAIG;IACK,WAAW,CAAwC;IAC3D;;;;;;;OAOG;IACK,gBAAgB,GAAuD,EAAE,CAAA;IACjF;;;;;OAKG;IACK,QAAQ,CAA+B;IACvC,SAAS,CAA0B;IAC3C;;;;OAIG;IACK,QAAQ,CAAqB;IAC7B,cAAc,CAA4B;IAClD,qFAAqF;IAC7E,YAAY,GAAyB,IAAI,CAAA;IACzC,oBAAoB,GAAG,CAAC,CAAA;IAChC,6GAA6G;IACrG,sBAAsB,GAAG,KAAK,CAAA;IAC9B,YAAY,GAA0B,IAAI,CAAA;IAElD,YACmB,eAAuB,EACvB,MAAc,EACd,WAAmB,EACnB,QAAgB,MAAM,EACtB,eAAuB,aAAa;QAJpC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,gBAAW,GAAX,WAAW,CAAQ;QACnB,UAAK,GAAL,KAAK,CAAiB;QACtB,iBAAY,GAAZ,YAAY,CAAwB;IACpD,CAAC;IAEJ;;;;;;;;;;OAUG;IACH,KAAK,CAAC,MAAmC;QACvC,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC7B,yCAAyC;YAC3C,CAAC,CAAC,CAAA;YACF,IAAI,MAAM;gBAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5D,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACd,yCAAyC;QACzC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAA;QAEzB,uEAAuE;QACvE,mDAAmD;QACnD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAClD,IAAI,MAAM;YAAE,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5D,CAAC;IAED,yCAAyC;IACzC,IAAI;QACF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;YAChC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAA;QAC1B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,YAAY,CAAA;QAC9C,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAM;QACvC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,oBAAoB,GAAG,yBAAyB;YAAE,OAAM;QAC9E,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IACtC,CAAC;IAED,gFAAgF;IAChF,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,4EAA4E;IAC5E,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAA;IACvB,CAAC;IAED,yDAAyD;IACzD,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED,0GAA0G;IAC1G,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAA;IACtB,CAAC;IAED,0CAA0C;IAC1C,QAAQ;QACN,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,oEAAoE;IACpE,gGAAgG;IAChG,oBAAoB;QAClB,OAAO,IAAI,CAAC,iBAAiB,CAAA;IAC/B,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,6DAA6D;IAC7D,eAAe;QACb,OAAO,IAAI,CAAC,YAAY,CAAA;IAC1B,CAAC;IAED,mEAAmE;IACnE,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED,8DAA8D;IAC9D,2BAA2B;QACzB,OAAO,IAAI,CAAC,wBAAwB,CAAA;IACtC,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB;QAChB,OAAO,IAAI,CAAC,eAAe,CAAA;IAC7B,CAAC;IAED,yFAAyF;IACzF,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAA;IACzB,CAAC;IAED,8EAA8E;IAC9E,mBAAmB;QACjB,OAAO,IAAI,CAAC,gBAAgB,CAAA;IAC9B,CAAC;IAED,uEAAuE;IAC/D,cAAc,CAAC,MAA+B;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAA;QACnE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACxC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAC3D,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,SAAS,GAAG,MAAM,CAAC,0BAA0B,CAAC,IAAI,MAAM,CAAC,6BAA6B,CAAC,CAAA;QAC7F,IAAI,CAAC,wBAAwB,GAAG,EAAE,CAAA;QAClC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACrF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;gBAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ;oBAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjE,CAAC;QACH,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,mBAAmB,CAAC,CAAA;QAC9E,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC;YACjD,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YAClE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,iBAAiB,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACxD,IAAI,CAAC,iBAAiB,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACvD,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACrE,CAAC,CAAC,EAAE,CAAA;QACN,MAAM,eAAe,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAA;QACpD,IAAI,CAAC,eAAe;YAClB,eAAe,KAAK,MAAM,IAAI,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAA;QACzF,MAAM,WAAW,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAA;QAC5C,IAAI,CAAC,WAAW;YACd,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,MAAM,IAAI,WAAW,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAA;QACxG,MAAM,gBAAgB,GAAG,MAAM,CAAC,qBAAqB,CAAC,CAAA;QACtD,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAA;QAC1B,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC1G,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,gBAA2C,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,KAAK;oBAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;YACjG,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAA;QACpD,IAAI,CAAC,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAA;QACnE,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAA;QACnD,IAAI,CAAC,QAAQ,GAAG,YAAY,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAChG,CAAC;IAED,4EAA4E;IAC5E,SAAS,CAAC,QAAgB,EAAE,aAAqB;QAC/C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;gBAC9C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC;oBAAE,SAAQ;gBACvC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpB,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;oBAC5C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC;wBAAE,SAAQ;gBAC7C,CAAC;gBACD,OAAO,IAAI,CAAA;YACb,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtC,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,mEAAmE;gBACnE,0EAA0E;gBAC1E,yEAAyE;gBACzE,uDAAuD;gBACvD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAwB,YAAY,EAAE;oBACzE,WAAW,EAAE,IAAI,CAAC,WAAW;iBAC9B,CAAC,CAAA;gBACF,IAAI,MAAM,EAAE,CAAC;oBACX,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAA;oBACxC,qEAAqE;oBACrE,uEAAuE;oBACvE,mEAAmE;oBACnE,MAAM,QAAQ,GAAc,EAAE,CAAA;oBAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;wBACnC,IAAI,SAAS,CAAC,SAAS,CAAC;4BAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;oBACpD,CAAC;oBACD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAA;oBACrB,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAA;oBACnD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;wBAChB,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EACtE,uEAAuE,CACxE,CAAA;oBACH,CAAC;oBACD,mEAAmE;oBACnE,qEAAqE;oBACrE,iEAAiE;oBACjE,oEAAoE;oBACpE,oEAAoE;oBACpE,qEAAqE;oBACrE,+DAA+D;oBAC/D,kEAAkE;oBAClE,mBAAmB;oBACnB,IAAI,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;wBACvD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,4BAA4B,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,6DAA6D,CAAC,CAAA;wBAC/I,OAAM;oBACR,CAAC;oBACD,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAC1C,CAAA;oBACD,IAAI,CAAC,cAAc,CAAC,MAA4C,CAAC,CAAA;oBACjE,IAAI,MAAM,CAAC,WAAW;wBAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAA;oBAC1D,IAAI,CAAC,MAAM,CAAC,YAAY;wBAAE,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAA;oBAC5D,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAA;oBACrH,OAAM;gBACR,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CACN;oBACE,MAAM,EAAE,sBAAsB;oBAC9B,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACtD,EACD,oEAAoE,CACrE,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,iCAAiC,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAA;QACtH,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,EAAE,EAAE,uCAAuC,CAAC,CAAA;QAErF,IAAI,IAAY,CAAA;QAChB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,IAAI,GAAG,YAAY,eAAe,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC;gBAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;YAC5G,MAAM,GAAG,CAAA;QACX,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA+C,CAAA;QAC7E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QAC7D,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAA;QACjC,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YACnC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;YACvD,CAAC,CAAC,EAAE,CAAA;QACN,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;QAC3B,8EAA8E;QAC9E,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,IAAI,qBAAqB,CAAA;QAC7E,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAA;QAClC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAA;IAC1F,CAAC;CACF"}

package/dist/proxy.d.ts

@@ -29,6 +29,7 @@
 import type { ProxyConfig } from './config.js';
 import { ToolCallInterceptor } from './interceptor.js';
 import { type InjectionSource } from './injection.js';
+import { type AnomalyFinding } from './anomaly/index.js';
 import { SessionState } from './session.js';
 /** What the harness asked for under a given request id, awaiting its response. */
 export interface PendingRequest {
@@ -55,6 +56,8 @@ export interface ServerLineOutcome {
      * other line.
      */
     toolsListTools?: Array<Record<string, unknown>>;
+    /** Every tool name the upstream server declared, before curation. Set alongside `toolsListTools`. */
+    toolsListUpstreamNames?: string[];
     /** The JSON-RPC id of the `tools/list` response, needed to build a block
      *  frame in the caller if TOFU refuses it. Set alongside `toolsListTools`. */
     toolsListMsgId?: string | number | null;
@@ -90,7 +93,7 @@ export interface ServerLineOutcome {
      * any request-direction finding unconditionally, so escalating an
      * already-redacted RESPONSE protects nothing further.
      */
-    dlpEscalationReason?: string;
+    dlpEscalation?: AnomalyFinding;
     /**
      * Phase 2's `tool_poisoning` finding (anomaly/detectors.ts), set on a
      * `tools/list` response whose post-curation tool descriptions matched
@@ -98,7 +101,7 @@ export interface ServerLineOutcome {
      * `injectionFindings` on this same response type — never removes or
      * blocks a listing.
      */
-    toolPoisoningReason?: string;
+    toolPoisoning?: AnomalyFinding;
 }
 /**
  * Inspect one line of real-server output before it reaches the harness.
@@ -121,13 +124,13 @@ export interface ServerLineOutcome {
  *
  * tools/list curation (the Uber-gateway mechanism): when the workspace
  * declares an additive allowlist, tools outside it are removed from the
- * listing — an agent that never sees a tool does not hallucinate calls to
+ * listing, as are tools the registry disables on this server — an agent that never sees a tool does not hallucinate calls to
  * it, and the call-time block in the interceptor stays as the enforcement
  * backstop. Operator description overrides apply to what remains, which is
  * also the counter to a poisoned upstream description — the pin detects the
  * change; the override controls what the agent actually reads.
  */
-export declare function processServerLine(raw: string, pending: Map<string | number, PendingRequest>, allowedTools: readonly string[], overrides: Readonly<Record<string, string>>, injectionAction?: 'warn' | 'block', injectionPatterns?: readonly string[]): ServerLineOutcome;
+export declare function processServerLine(raw: string, pending: Map<string | number, PendingRequest>, allowedTools: readonly string[], overrides: Readonly<Record<string, string>>, injectionAction?: 'warn' | 'block', injectionPatterns?: readonly string[], disabledTools?: readonly string[]): ServerLineOutcome;
 /**
  * Handle one harness→upstream line — shared, byte-for-byte, between stdio
  * proxy mode (`McpGovernanceProxy.runProxy`, below) and the remote HTTP/SSE
@@ -171,6 +174,8 @@ export declare class McpGovernanceProxy {
      * runs, not a second one (see `policy.ts`'s `start(onTick)`).
      */
     private readonly wasmRunner;
+    /** Reports this proxy's server to the registry; absent for the standalone `intutic` entry, which fronts none. */
+    private readonly registryObserver;
     private realServer;
     constructor(config: ProxyConfig);
     /**
@@ -225,9 +230,9 @@ export declare class McpGovernanceProxy {
      * (tofu.ts), which does file I/O — the ONLY case this awaits before
      * writing; every other line is forwarded exactly as fast as before.
      *
-     * On a TOFU mismatch, honors `mcpProxyFailBehavior` via `config.failOpen` —
-     * the SAME field `interceptor.ts` already reads for its own fail-open/
-     * fail-closed branches, not a new mechanism: fail-open logs and forwards
+     * On a TOFU mismatch, honors `mcpProxyFailBehavior` via the interceptor's
+     * `failOpen` — the SAME value its own fail-open/fail-closed branches read,
+     * not a new mechanism: fail-open logs and forwards
      * the (possibly curated) tools/list response as normal; fail-closed
      * replaces it with a JSON-RPC error naming the server and the setting,
      * mirroring `buildBlockResponse`'s existing wording style.

package/dist/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEtD,OAAO,EAA4D,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAE/G,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAmD3C,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,GAAG,YAAY,GAAG,gBAAgB,CAAA;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,kFAAkF;IAClF,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD;;;;;OAKG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/C;kFAC8E;IAC9E,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACvC;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,eAAe,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAC5F;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;;OAQG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,eAAe,GAAE,MAAM,GAAG,OAAgB,EAC1C,iBAAiB,GAAE,SAAS,MAAM,EAAO,GACxC,iBAAiB,CAqLnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC/B,OAAO,CAAC,EAAE,YAAY,GACrB,IAAI,CA2DN;AAED,qBAAa,kBAAkB;IA0BjB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAzBnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,4GAA4G;IAC5G,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,OAAO,CAAC,UAAU,CAAuC;gBAE5B,MAAM,EAAE,WAAW;IA4ChD;;;;;OAKG;IACH,cAAc,IAAI,mBAAmB;IAIrC;;;;;OAKG;IACH,eAAe,IAAI,YAAY;IAI/B;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAOnB,OAAO,CAAC,SAAS,CAA8B;IAE/C;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAKvB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAQlB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAS1B;;;;OAIG;YACW,aAAa;IAuI3B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,GAC5C,OAAO,CAAC,IAAI,CAAC;IAwJhB;;;OAGG;YACW,QAAQ;CAoFvB"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAEtD,OAAO,EAA4D,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAC/G,OAAO,EAAgC,KAAK,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAwE3C,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,GAAG,YAAY,GAAG,gBAAgB,CAAA;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,IAAI,EAAE,MAAM,CAAA;IACZ,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,uDAAuD;IACvD,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,kFAAkF;IAClF,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAChD;;;;;OAKG;IACH,cAAc,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC/C,qGAAqG;IACrG,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAA;IACjC;kFAC8E;IAC9E,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IACvC;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,eAAe,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAC5F;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,cAAc,CAAA;IAC9B;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,cAAc,CAAA;CAC/B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAC3C,eAAe,GAAE,MAAM,GAAG,OAAgB,EAC1C,iBAAiB,GAAE,SAAS,MAAM,EAAO,EACzC,aAAa,GAAE,SAAS,MAAM,EAAO,GACpC,iBAAiB,CA8LnB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,EAC7C,WAAW,EAAE,mBAAmB,EAChC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC/B,OAAO,CAAC,EAAE,YAAY,GACrB,IAAI,CA6DN;AAED,qBAAa,kBAAkB;IA4BjB,OAAO,CAAC,QAAQ,CAAC,MAAM;IA3BnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAc;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD;;;;;;;;;OASG;IACH,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,4GAA4G;IAC5G,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgC;IAC7D;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAY;IACvC,iHAAiH;IACjH,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA8B;IAC/D,OAAO,CAAC,UAAU,CAAuC;gBAE5B,MAAM,EAAE,WAAW;IAkDhD;;;;;OAKG;IACH,cAAc,IAAI,mBAAmB;IAIrC;;;;;OAKG;IACH,eAAe,IAAI,YAAY;IAI/B;;;;;;OAMG;IACH,WAAW,IAAI,IAAI;IAQnB,OAAO,CAAC,SAAS,CAA8B;IAE/C;;;;;OAKG;IACH,OAAO,CAAC,eAAe;IAKvB;;;OAGG;IACH,UAAU,IAAI,IAAI;IAQlB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAS1B;;;;OAIG;YACW,aAAa;IAuI3B;;;;;;;;;;;;;;;;;;;OAmBG;IACG,gBAAgB,CACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,MAAM,EAAE,cAAc,CAAC,GAC5C,OAAO,CAAC,IAAI,CAAC;IAsLhB;;;OAGG;YACW,QAAQ;CAoFvB"}