@provos/ironcurtain 0.4.0 → 0.5.0

package/src/config/mcp-servers.json

@@ -1,10 +1,12 @@
 {
   "filesystem": {
+    "description": "Read, write, search, and manage files and directories",
     "command": "npx",
     "args": ["-y", "@modelcontextprotocol/server-filesystem", "/tmp/ironcurtain-sandbox"],
     "sandbox": false
   },
   "git": {
+    "description": "Git version control operations (commits, branches, diffs, etc.)",
     "command": "node",
     "args": ["node_modules/.bin/git-mcp-server"],
     "env": {
@@ -20,9 +22,20 @@
     }
   },
   "fetch": {
+    "description": "HTTP requests and web search",
     "command": "tsx",
     "args": ["./src/servers/fetch-server.ts"],
     "sandbox": false,
     "_comment": "sandbox: false because srt's network sandbox (seccomp/bubblewrap) blocks Unix domain sockets needed by tsx in dev mode and cannot selectively allow network while restricting filesystem. The policy engine handles URL-level security (SSRF blocking, domain allowlists) independently."
+  },
+  "github": {
+    "description": "GitHub API operations (issues, pull requests, repos, search)",
+    "command": "docker",
+    "args": [
+      "run", "-i", "--rm",
+      "-e", "GITHUB_PERSONAL_ACCESS_TOKEN",
+      "ghcr.io/github/github-mcp-server"
+    ],
+    "sandbox": false
   }
 }

package/dist/docker/managed-proxy.d.ts

@@ -1,31 +0,0 @@
-/**
- * Manages the lifecycle of an MCP proxy server process for a Docker session.
- *
- * Spawns the proxy as a child process with PROXY_SOCKET_PATH set.
- * The proxy process is the same mcp-proxy-server.ts used by the
- * built-in session, just with a UDS transport instead of stdio.
- */
-import type { ToolInfo } from './agent-adapter.js';
-export interface ManagedProxy {
-    /** Start the proxy process. Resolves when the transport is ready for connections. */
-    start(): Promise<void>;
-    /** Query available tools from the running proxy. */
-    listTools(): Promise<ToolInfo[]>;
-    /** Stop the proxy process and clean up the socket. */
-    stop(): Promise<void>;
-    /** The socket path the proxy is listening on (UDS mode). */
-    readonly socketPath: string;
-    /** The TCP port the proxy is listening on (TCP mode). Only valid after start(). */
-    readonly port: number | undefined;
-}
-export interface ManagedProxyOptions {
-    /** Absolute path for the UDS socket (used in UDS mode). */
-    readonly socketPath: string;
-    /** Environment variables to pass to the proxy process. */
-    readonly env: Record<string, string>;
-    /** Working directory for the proxy process. Defaults to process.cwd(). */
-    readonly cwd?: string;
-    /** Listen mode: 'uds' (default) or 'tcp'. TCP mode uses OS-assigned port. */
-    readonly listenMode?: 'uds' | 'tcp';
-}
-export declare function createManagedProxy(options: ManagedProxyOptions): ManagedProxy;

package/dist/docker/managed-proxy.js

@@ -1,265 +0,0 @@
-/**
- * Manages the lifecycle of an MCP proxy server process for a Docker session.
- *
- * Spawns the proxy as a child process with PROXY_SOCKET_PATH set.
- * The proxy process is the same mcp-proxy-server.ts used by the
- * built-in session, just with a UDS transport instead of stdio.
- */
-import { fork } from 'node:child_process';
-import { existsSync, readFileSync, unlinkSync } from 'node:fs';
-import { setTimeout as delay } from 'node:timers/promises';
-import { resolve, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { Client } from '@modelcontextprotocol/sdk/client/index.js';
-import { connect as netConnect } from 'node:net';
-import { ReadBuffer, serializeMessage } from '@modelcontextprotocol/sdk/shared/stdio.js';
-import { VERSION } from '../version.js';
-const __dirname = dirname(fileURLToPath(import.meta.url));
-/** Timeout for socket readiness polling. */
-const SOCKET_READY_TIMEOUT_MS = 15_000;
-const SOCKET_POLL_INTERVAL_MS = 50;
-/** Path to the mcp-proxy-server module. */
-function getProxyModulePath() {
-    // In compiled mode: dist/trusted-process/mcp-proxy-server.js
-    // In source mode: src/trusted-process/mcp-proxy-server.ts (needs tsx)
-    const compiledPath = resolve(__dirname, '..', 'trusted-process', 'mcp-proxy-server.js');
-    if (existsSync(compiledPath))
-        return compiledPath;
-    return resolve(__dirname, '..', 'trusted-process', 'mcp-proxy-server.ts');
-}
-/**
- * Creates a temporary MCP client connection via TCP.
- * Used for listTools() queries in TCP mode.
- */
-class TcpClientTransport {
-    socket = null;
-    readBuffer = new ReadBuffer();
-    host;
-    port;
-    onclose;
-    onerror;
-    onmessage;
-    constructor(host, port) {
-        this.host = host;
-        this.port = port;
-    }
-    async start() {
-        return new Promise((resolve, reject) => {
-            this.socket = netConnect({ host: this.host, port: this.port }, () => resolve());
-            this.socket.on('error', reject);
-            this.socket.on('data', (chunk) => {
-                this.readBuffer.append(chunk);
-                let message;
-                while ((message = this.readBuffer.readMessage()) !== null) {
-                    this.onmessage?.(message);
-                }
-            });
-            this.socket.on('close', () => this.onclose?.());
-        });
-    }
-    async send(message) {
-        const socket = this.socket;
-        if (!socket || socket.destroyed) {
-            throw new Error('TCP client not connected');
-        }
-        return new Promise((resolve, reject) => {
-            socket.write(serializeMessage(message), (err) => {
-                if (err)
-                    reject(err);
-                else
-                    resolve();
-            });
-        });
-    }
-    // eslint-disable-next-line @typescript-eslint/require-await -- must be async to satisfy Transport interface
-    async close() {
-        this.socket?.destroy();
-        this.socket = null;
-    }
-}
-/**
- * Creates a temporary MCP client connection to the UDS socket.
- * Used for listTools() queries.
- */
-class UdsClientTransport {
-    socket = null;
-    readBuffer = new ReadBuffer();
-    socketPath;
-    onclose;
-    onerror;
-    onmessage;
-    constructor(socketPath) {
-        this.socketPath = socketPath;
-    }
-    async start() {
-        return new Promise((resolve, reject) => {
-            this.socket = netConnect(this.socketPath, () => resolve());
-            this.socket.on('error', reject);
-            this.socket.on('data', (chunk) => {
-                this.readBuffer.append(chunk);
-                let message;
-                while ((message = this.readBuffer.readMessage()) !== null) {
-                    this.onmessage?.(message);
-                }
-            });
-            this.socket.on('close', () => this.onclose?.());
-        });
-    }
-    async send(message) {
-        const socket = this.socket;
-        if (!socket || socket.destroyed) {
-            throw new Error('UDS client not connected');
-        }
-        return new Promise((resolve, reject) => {
-            socket.write(serializeMessage(message), (err) => {
-                if (err)
-                    reject(err);
-                else
-                    resolve();
-            });
-        });
-    }
-    // eslint-disable-next-line @typescript-eslint/require-await -- must be async to satisfy Transport interface
-    async close() {
-        this.socket?.destroy();
-        this.socket = null;
-    }
-}
-export function createManagedProxy(options) {
-    let childProcess = null;
-    const useTcp = options.listenMode === 'tcp';
-    let resolvedPort;
-    // In TCP mode, the proxy writes its port to this file after binding
-    const portFilePath = resolve(dirname(options.socketPath), 'proxy-port.txt');
-    return {
-        socketPath: options.socketPath,
-        get port() {
-            return resolvedPort;
-        },
-        async start() {
-            // Remove stale port file from a prior crashed run to prevent
-            // false readiness during polling.
-            if (useTcp) {
-                try {
-                    unlinkSync(portFilePath);
-                }
-                catch {
-                    /* file may not exist */
-                }
-            }
-            const modulePath = getProxyModulePath();
-            const isTsSource = modulePath.endsWith('.ts');
-            // Fork the proxy process with the appropriate transport env vars
-            const env = {
-                ...process.env,
-                ...options.env,
-            };
-            if (useTcp) {
-                // Ensure UDS-specific env vars do not leak from the parent environment
-                delete env.PROXY_SOCKET_PATH;
-                env.PROXY_TCP_PORT = '0'; // OS-assigned port
-                env.PROXY_PORT_FILE = portFilePath;
-            }
-            else {
-                // Ensure TCP-specific env vars do not leak from the parent environment
-                delete env.PROXY_TCP_PORT;
-                delete env.PROXY_PORT_FILE;
-                env.PROXY_SOCKET_PATH = options.socketPath;
-            }
-            const cwd = options.cwd ?? process.cwd();
-            if (isTsSource) {
-                // In development, use tsx to run TypeScript directly
-                const { spawn } = await import('node:child_process');
-                childProcess = spawn('npx', ['tsx', modulePath], {
-                    env,
-                    cwd,
-                    stdio: ['pipe', 'pipe', 'pipe'],
-                });
-            }
-            else {
-                childProcess = fork(modulePath, [], {
-                    env,
-                    cwd,
-                    stdio: ['pipe', 'pipe', 'pipe', 'ipc'],
-                });
-            }
-            // Capture stderr and exit for diagnostics
-            let proxyStderr = '';
-            let proxyExited = false;
-            let proxyExitCode = null;
-            childProcess.stderr?.on('data', (chunk) => {
-                proxyStderr += chunk.toString();
-            });
-            childProcess.on('error', (err) => {
-                console.error(`MCP proxy process error: ${err.message}`);
-            });
-            childProcess.on('exit', (code) => {
-                proxyExited = true;
-                proxyExitCode = code;
-            });
-            // Poll for readiness: port file in TCP mode, socket file in UDS mode
-            const readinessTarget = useTcp ? portFilePath : options.socketPath;
-            const start = Date.now();
-            while (!existsSync(readinessTarget)) {
-                // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- mutated by async 'exit' event handler
-                if (proxyExited) {
-                    throw new Error(`MCP proxy process exited with code ${proxyExitCode} before becoming ready.\nStderr: ${proxyStderr}`);
-                }
-                if (Date.now() - start > SOCKET_READY_TIMEOUT_MS) {
-                    throw new Error(`MCP proxy did not become ready within ${SOCKET_READY_TIMEOUT_MS}ms.\nStderr: ${proxyStderr}`);
-                }
-                await delay(SOCKET_POLL_INTERVAL_MS);
-            }
-            // In TCP mode, read the port from the file
-            if (useTcp && portFilePath) {
-                const rawPort = readFileSync(portFilePath, 'utf-8').trim();
-                const parsedPort = parseInt(rawPort, 10);
-                if (!Number.isInteger(parsedPort) || parsedPort <= 0 || parsedPort > 65535) {
-                    throw new Error(`Invalid TCP port "${rawPort}" read from ${portFilePath}.`);
-                }
-                resolvedPort = parsedPort;
-            }
-        },
-        async listTools() {
-            const transport = useTcp && resolvedPort !== undefined
-                ? new TcpClientTransport('127.0.0.1', resolvedPort)
-                : new UdsClientTransport(options.socketPath);
-            const client = new Client({ name: 'ironcurtain-tool-lister', version: VERSION }, {});
-            try {
-                await client.connect(transport);
-                const result = await client.listTools();
-                return result.tools.map((t) => ({
-                    name: t.name,
-                    description: t.description,
-                    inputSchema: t.inputSchema,
-                }));
-            }
-            finally {
-                try {
-                    await client.close();
-                }
-                catch {
-                    /* ignore cleanup errors */
-                }
-            }
-        },
-        async stop() {
-            if (childProcess) {
-                childProcess.kill('SIGTERM');
-                // Give it a moment to clean up
-                await new Promise((resolve) => {
-                    const timeout = setTimeout(() => {
-                        childProcess?.kill('SIGKILL');
-                        resolve();
-                    }, 3000);
-                    childProcess?.on('exit', () => {
-                        clearTimeout(timeout);
-                        resolve();
-                    });
-                });
-                childProcess = null;
-            }
-        },
-    };
-}
-//# sourceMappingURL=managed-proxy.js.map

package/dist/docker/managed-proxy.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"managed-proxy.js","sourceRoot":"","sources":["../../src/docker/managed-proxy.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAqB,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC;AAIzF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D,4CAA4C;AAC5C,MAAM,uBAAuB,GAAG,MAAM,CAAC;AACvC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,2CAA2C;AAC3C,SAAS,kBAAkB;IACzB,6DAA6D;IAC7D,sEAAsE;IACtE,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;IACxF,IAAI,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IAClD,OAAO,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;AAC5E,CAAC;AAiCD;;;GAGG;AACH,MAAM,kBAAkB;IACd,MAAM,GAAyC,IAAI,CAAC;IACpD,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IACrB,IAAI,CAAS;IACb,IAAI,CAAS;IAE9B,OAAO,CAAc;IACrB,OAAO,CAA0B;IACjC,SAAS,CAAqC;IAE9C,YAAY,IAAY,EAAE,IAAY;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9B,IAAI,OAA8B,CAAC;gBACnC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC1D,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAuB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9C,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4GAA4G;IAC5G,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,kBAAkB;IACd,MAAM,GAAyC,IAAI,CAAC;IACpD,UAAU,GAAG,IAAI,UAAU,EAAE,CAAC;IACrB,UAAU,CAAS;IAEpC,OAAO,CAAc;IACrB,OAAO,CAA0B;IACjC,SAAS,CAAqC;IAE9C,YAAY,UAAkB;QAC5B,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC9B,IAAI,OAA8B,CAAC;gBACnC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;oBAC1D,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAAuB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC9C,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,4GAA4G;IAC5G,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,IAAI,YAAY,GAAwB,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC;IAC5C,IAAI,YAAgC,CAAC;IAErC,oEAAoE;IACpE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAE5E,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAE9B,IAAI,IAAI;YACN,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,KAAK,CAAC,KAAK;YACT,6DAA6D;YAC7D,kCAAkC;YAClC,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,UAAU,CAAC,YAAY,CAAC,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,wBAAwB;gBAC1B,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,kBAAkB,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAE9C,iEAAiE;YACjE,MAAM,GAAG,GAA2B;gBAClC,GAAI,OAAO,CAAC,GAA8B;gBAC1C,GAAG,OAAO,CAAC,GAAG;aACf,CAAC;YAEF,IAAI,MAAM,EAAE,CAAC;gBACX,uEAAuE;gBACvE,OAAO,GAAG,CAAC,iBAAiB,CAAC;gBAC7B,GAAG,CAAC,cAAc,GAAG,GAAG,CAAC,CAAC,mBAAmB;gBAC7C,GAAG,CAAC,eAAe,GAAG,YAAY,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,uEAAuE;gBACvE,OAAO,GAAG,CAAC,cAAc,CAAC;gBAC1B,OAAO,GAAG,CAAC,eAAe,CAAC;gBAC3B,GAAG,CAAC,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC;YAC7C,CAAC;YAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAEzC,IAAI,UAAU,EAAE,CAAC;gBACf,qDAAqD;gBACrD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBACrD,YAAY,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE;oBAC/C,GAAG;oBACH,GAAG;oBACH,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,EAAE;oBAClC,GAAG;oBACH,GAAG;oBACH,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;iBACvC,CAAC,CAAC;YACL,CAAC;YAED,0CAA0C;YAC1C,IAAI,WAAW,GAAG,EAAE,CAAC;YACrB,IAAI,WAAW,GAAG,KAAK,CAAC;YACxB,IAAI,aAAa,GAAkB,IAAI,CAAC;YAExC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAChD,WAAW,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YAClC,CAAC,CAAC,CAAC;YAEH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBAC/B,OAAO,CAAC,KAAK,CAAC,4BAA4B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3D,CAAC,CAAC,CAAC;YAEH,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC/B,WAAW,GAAG,IAAI,CAAC;gBACnB,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC,CAAC,CAAC;YAEH,qEAAqE;YACrE,MAAM,eAAe,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;YACnE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;gBACpC,gHAAgH;gBAChH,IAAI,WAAW,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CACb,sCAAsC,aAAa,oCAAoC,WAAW,EAAE,CACrG,CAAC;gBACJ,CAAC;gBACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,GAAG,uBAAuB,EAAE,CAAC;oBACjD,MAAM,IAAI,KAAK,CACb,yCAAyC,uBAAuB,gBAAgB,WAAW,EAAE,CAC9F,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC,uBAAuB,CAAC,CAAC;YACvC,CAAC;YAED,2CAA2C;YAC3C,IAAI,MAAM,IAAI,YAAY,EAAE,CAAC;gBAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU,GAAG,KAAK,EAAE,CAAC;oBAC3E,MAAM,IAAI,KAAK,CAAC,qBAAqB,OAAO,eAAe,YAAY,GAAG,CAAC,CAAC;gBAC9E,CAAC;gBACD,YAAY,GAAG,UAAU,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,SAAS;YACb,MAAM,SAAS,GACb,MAAM,IAAI,YAAY,KAAK,SAAS;gBAClC,CAAC,CAAC,IAAI,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC;gBACnD,CAAC,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACjD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;YAErF,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxC,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC9B,IAAI,EAAE,CAAC,CAAC,IAAI;oBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,WAAW,EAAE,CAAC,CAAC,WAAsC;iBACtD,CAAC,CAAC,CAAC;YACN,CAAC;oBAAS,CAAC;gBACT,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACvB,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,KAAK,CAAC,IAAI;YACR,IAAI,YAAY,EAAE,CAAC;gBACjB,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC7B,+BAA+B;gBAC/B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAClC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;wBAC9B,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;wBAC9B,OAAO,EAAE,CAAC;oBACZ,CAAC,EAAE,IAAI,CAAC,CAAC;oBACT,YAAY,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;wBAC5B,YAAY,CAAC,OAAO,CAAC,CAAC;wBACtB,OAAO,EAAE,CAAC;oBACZ,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}