@securecode-ai/mcp 0.5.5 → 0.5.6

package/dist/attack/protocolValidator.d.ts

@@ -0,0 +1,50 @@
+/**
+ * MCP-side runtime validation of API responses.
+ *
+ * The API is a trusted service we control, but the wire is untrusted: a
+ * misconfigured proxy, a response from a stale API version, or a
+ * man-in-the-middle on an unencrypted hop could deliver a malformed
+ * response that the MCP would otherwise execute as ground truth. The
+ * previous code fed `stepResp.next` directly into `executeAction`'s
+ * switch — an unknown action type fell through to a no-op, and a
+ * malformed action would either crash or silently produce bad state.
+ *
+ * This module validates the shape of:
+ *   - AgentScanStartResponse
+ *   - AgentScanStepResponse (and the embedded AgentScanAction)
+ *   - AgentScanToolResponse
+ *   - VerifyGenerateResponse (POST /verify/generate)
+ *   - VerifyAnalyzeResponse (POST /verify/analyze)
+ *
+ * On validation failure, the caller treats it as a controlled `spawn_failed`
+ * or `degraded` result rather than executing the malformed action.
+ *
+ * Validation is strict-by-default: unknown fields are ignored (forward-
+ * compatible), but required fields and type constraints are enforced.
+ * Findings are NOT validated here — the agent loop owns finding validation
+ * (validateFinish); we only validate the wire envelope and the action
+ * discriminator.
+ */
+import type { AgentScanAction, AgentScanStartResponse, AgentScanStepResponse, AgentScanToolResponse } from '../attack/agentScanProtocol';
+import type { VerifyGenerateResponse, VerifyAnalyzeResponse } from '../api/types';
+export interface ValidationOk<T> {
+    ok: true;
+    value: T;
+}
+export interface ValidationErr {
+    ok: false;
+    error: string;
+}
+export type ValidationResult<T> = ValidationOk<T> | ValidationErr;
+/**
+ * Validate an AgentScanAction. Returns the action typed, or an error.
+ * Does NOT validate finish.findings deeply — the API's parseAction +
+ * validateFinish already did that. We only check the discriminator and
+ * the primary fields the MCP executor needs.
+ */
+export declare function validateAction(raw: unknown): ValidationResult<AgentScanAction>;
+export declare function validateStartResponse(raw: unknown): ValidationResult<AgentScanStartResponse>;
+export declare function validateStepResponse(raw: unknown): ValidationResult<AgentScanStepResponse>;
+export declare function validateToolResponse(raw: unknown): ValidationResult<AgentScanToolResponse>;
+export declare function validateVerifyGenerateResponse(raw: unknown): ValidationResult<VerifyGenerateResponse>;
+export declare function validateVerifyAnalyzeResponse(raw: unknown): ValidationResult<VerifyAnalyzeResponse>;

package/dist/attack/protocolValidator.js

@@ -0,0 +1,427 @@
+"use strict";
+/**
+ * MCP-side runtime validation of API responses.
+ *
+ * The API is a trusted service we control, but the wire is untrusted: a
+ * misconfigured proxy, a response from a stale API version, or a
+ * man-in-the-middle on an unencrypted hop could deliver a malformed
+ * response that the MCP would otherwise execute as ground truth. The
+ * previous code fed `stepResp.next` directly into `executeAction`'s
+ * switch — an unknown action type fell through to a no-op, and a
+ * malformed action would either crash or silently produce bad state.
+ *
+ * This module validates the shape of:
+ *   - AgentScanStartResponse
+ *   - AgentScanStepResponse (and the embedded AgentScanAction)
+ *   - AgentScanToolResponse
+ *   - VerifyGenerateResponse (POST /verify/generate)
+ *   - VerifyAnalyzeResponse (POST /verify/analyze)
+ *
+ * On validation failure, the caller treats it as a controlled `spawn_failed`
+ * or `degraded` result rather than executing the malformed action.
+ *
+ * Validation is strict-by-default: unknown fields are ignored (forward-
+ * compatible), but required fields and type constraints are enforced.
+ * Findings are NOT validated here — the agent loop owns finding validation
+ * (validateFinish); we only validate the wire envelope and the action
+ * discriminator.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateAction = validateAction;
+exports.validateStartResponse = validateStartResponse;
+exports.validateStepResponse = validateStepResponse;
+exports.validateToolResponse = validateToolResponse;
+exports.validateVerifyGenerateResponse = validateVerifyGenerateResponse;
+exports.validateVerifyAnalyzeResponse = validateVerifyAnalyzeResponse;
+function ok(value) { return { ok: true, value }; }
+function err(error) { return { ok: false, error }; }
+function isObject(x) {
+    return typeof x === 'object' && x !== null && !Array.isArray(x);
+}
+function isString(x) { return typeof x === 'string'; }
+function isNumber(x) { return typeof x === 'number' && Number.isFinite(x); }
+function isBool(x) { return typeof x === 'boolean'; }
+function isOptionalString(x) { return x === undefined || x === null || isString(x); }
+function isOptionalNumber(x) { return x === undefined || x === null || isNumber(x); }
+// ── Action validation ───────────────────────────────────────────────────────
+const VALID_ACTION_TYPES = new Set([
+    'read_file', 'search_code', 'trace_flow', 'trace_flow_cross_file',
+    'check_guard', 'check_policy', 'get_endpoints', 'list_imports',
+    'list_files', 'call_graph', 'git_blame', 'git_history', 'git_diff',
+    'check_dependencies', 'read_config', 'find_definition',
+    'find_references', 'find_tests', 'run_tests',
+    'finish', 'system_event',
+]);
+const VALID_ATTACK_TYPES = new Set([
+    'sql_injection', 'nosql_injection', 'command_injection', 'xss', 'ssrf',
+    'path_traversal', 'open_redirect', 'prototype_pollution',
+    'insecure_deserialization', 'broken_access_control',
+]);
+const VALID_SYSTEM_EVENT_TYPES = new Set(['critique', 'error', 'blocked', 'budget', 'finish_gate']);
+const VALID_SEVERITIES = new Set(['critical', 'high', 'medium', 'low']);
+/**
+ * Validate an AgentScanAction. Returns the action typed, or an error.
+ * Does NOT validate finish.findings deeply — the API's parseAction +
+ * validateFinish already did that. We only check the discriminator and
+ * the primary fields the MCP executor needs.
+ */
+function validateAction(raw) {
+    if (!isObject(raw))
+        return err('action is not an object');
+    const type = raw.type;
+    if (!isString(type) || !VALID_ACTION_TYPES.has(type)) {
+        return err(`action.type is missing or unknown: ${String(type)}`);
+    }
+    switch (type) {
+        case 'read_file': {
+            if (!isString(raw.path) || raw.path.length === 0) {
+                return err('read_file requires non-empty string "path"');
+            }
+            if (!isOptionalNumber(raw.startLine) || !isOptionalNumber(raw.endLine)) {
+                return err('read_file startLine/endLine must be numbers or null');
+            }
+            return ok(raw);
+        }
+        case 'search_code': {
+            if (!isString(raw.pattern) || raw.pattern.length === 0) {
+                return err('search_code requires non-empty string "pattern"');
+            }
+            if (!isOptionalString(raw.glob))
+                return err('search_code glob must be string or null');
+            return ok(raw);
+        }
+        case 'trace_flow': {
+            if (!isString(raw.filePath) || raw.filePath.length === 0) {
+                return err('trace_flow requires non-empty string "filePath"');
+            }
+            return ok(raw);
+        }
+        case 'trace_flow_cross_file': {
+            if (!isString(raw.filePath) || raw.filePath.length === 0) {
+                return err('trace_flow_cross_file requires non-empty string "filePath"');
+            }
+            if (!isOptionalNumber(raw.maxDepth))
+                return err('maxDepth must be a number or null');
+            return ok(raw);
+        }
+        case 'check_guard': {
+            if (!isString(raw.filePath) || raw.filePath.length === 0)
+                return err('check_guard requires "filePath"');
+            if (!isString(raw.guardName) || raw.guardName.length === 0)
+                return err('check_guard requires "guardName"');
+            if (!isString(raw.attackType) || !VALID_ATTACK_TYPES.has(raw.attackType)) {
+                return err(`check_guard attackType is not a known AttackType: ${String(raw.attackType)}`);
+            }
+            return ok(raw);
+        }
+        case 'check_policy': {
+            if (!isString(raw.filePath) || raw.filePath.length === 0)
+                return err('check_policy requires "filePath"');
+            return ok(raw);
+        }
+        case 'get_endpoints': {
+            if (!isOptionalString(raw.glob))
+                return err('get_endpoints glob must be string or null');
+            return ok(raw);
+        }
+        case 'list_imports': {
+            if (!isString(raw.filePath) || raw.filePath.length === 0)
+                return err('list_imports requires "filePath"');
+            return ok(raw);
+        }
+        case 'list_files': {
+            if (!isOptionalString(raw.path))
+                return err('list_files path must be string or null');
+            if (!isOptionalString(raw.glob))
+                return err('list_files glob must be string or null');
+            return ok(raw);
+        }
+        case 'call_graph': {
+            if (!isString(raw.filePath) || raw.filePath.length === 0)
+                return err('call_graph requires "filePath"');
+            if (!isOptionalString(raw.functionName))
+                return err('call_graph functionName must be string or null');
+            return ok(raw);
+        }
+        case 'git_blame': {
+            if (!isString(raw.filePath) || raw.filePath.length === 0)
+                return err('git_blame requires "filePath"');
+            if (!isOptionalNumber(raw.startLine))
+                return err('git_blame startLine must be number or null');
+            if (!isOptionalNumber(raw.endLine))
+                return err('git_blame endLine must be number or null');
+            return ok(raw);
+        }
+        case 'git_history': {
+            if (!isOptionalString(raw.filePath))
+                return err('git_history filePath must be string or null');
+            if (!isOptionalString(raw.functionName))
+                return err('git_history functionName must be string or null');
+            if (!isOptionalNumber(raw.limit))
+                return err('git_history limit must be number or null');
+            return ok(raw);
+        }
+        case 'git_diff': {
+            if (!isString(raw.baseRef) || raw.baseRef.length === 0)
+                return err('git_diff requires non-empty "baseRef"');
+            if (!isOptionalString(raw.headRef))
+                return err('git_diff headRef must be string or null');
+            return ok(raw);
+        }
+        case 'check_dependencies':
+            return ok(raw);
+        case 'read_config': {
+            if (!isString(raw.configKind) || !['auth', 'cors', 'rate_limit', 'headers', 'env', 'all'].includes(raw.configKind)) {
+                return err('read_config requires "configKind" (auth, cors, rate_limit, headers, env, all)');
+            }
+            return ok(raw);
+        }
+        case 'find_definition': {
+            if (!isString(raw.filePath) || raw.filePath.length === 0)
+                return err('find_definition requires "filePath"');
+            if (!isString(raw.symbol) || raw.symbol.length === 0)
+                return err('find_definition requires "symbol"');
+            if (!isOptionalNumber(raw.line))
+                return err('find_definition line must be number or null');
+            return ok(raw);
+        }
+        case 'find_references': {
+            if (!isString(raw.filePath) || raw.filePath.length === 0)
+                return err('find_references requires "filePath"');
+            if (!isString(raw.symbol) || raw.symbol.length === 0)
+                return err('find_references requires "symbol"');
+            if (!isOptionalNumber(raw.line))
+                return err('find_references line must be number or null');
+            return ok(raw);
+        }
+        case 'find_tests': {
+            if (!isString(raw.filePath) || raw.filePath.length === 0)
+                return err('find_tests requires "filePath"');
+            if (!isOptionalString(raw.symbol))
+                return err('find_tests symbol must be string or null');
+            return ok(raw);
+        }
+        case 'run_tests': {
+            if (!isString(raw.mode) || (raw.mode !== 'existing' && raw.mode !== 'generated')) {
+                return err('run_tests requires "mode" (existing or generated)');
+            }
+            if (raw.mode === 'existing') {
+                if (raw.testFiles !== undefined && raw.testFiles !== null) {
+                    if (!Array.isArray(raw.testFiles))
+                        return err('run_tests testFiles must be an array');
+                }
+                if (!isOptionalString(raw.testPattern))
+                    return err('run_tests testPattern must be string or null');
+                if (!isOptionalString(raw.packageManager))
+                    return err('run_tests packageManager must be string or null');
+            }
+            else {
+                if (!isString(raw.script) || raw.script.length === 0)
+                    return err('run_tests generated mode requires "script"');
+                if (!isString(raw.runner) || raw.runner.length === 0)
+                    return err('run_tests generated mode requires "runner"');
+                if (!isOptionalString(raw.setupScript))
+                    return err('run_tests setupScript must be string or null');
+            }
+            if (!isOptionalNumber(raw.timeoutMs))
+                return err('run_tests timeoutMs must be number or null');
+            return ok(raw);
+        }
+        case 'finish': {
+            if (!Array.isArray(raw.findings))
+                return err('finish requires "findings" array');
+            // Light per-finding check: line must be a positive int, type must be non-empty, severity must be valid.
+            for (let i = 0; i < raw.findings.length; i++) {
+                const f = raw.findings[i];
+                if (!isObject(f))
+                    return err(`finding[${i}] is not an object`);
+                if (!isNumber(f.line) || f.line < 1)
+                    return err(`finding[${i}].line must be a positive integer`);
+                if (!isString(f.type) || f.type.length === 0)
+                    return err(`finding[${i}].type must be a non-empty string`);
+                if (!isString(f.severity) || !VALID_SEVERITIES.has(f.severity)) {
+                    return err(`finding[${i}].severity must be one of critical|high|medium|low`);
+                }
+                if (!isNumber(f.confidence) || f.confidence < 0 || f.confidence > 100) {
+                    return err(`finding[${i}].confidence must be 0-100`);
+                }
+            }
+            if (!isString(raw.summary))
+                return err('finish requires "summary" string');
+            return ok(raw);
+        }
+        case 'system_event': {
+            if (!isString(raw.eventType) || !VALID_SYSTEM_EVENT_TYPES.has(raw.eventType)) {
+                return err(`system_event.eventType is missing or unknown: ${String(raw.eventType)}`);
+            }
+            if (!isString(raw.message) || raw.message.length === 0) {
+                return err('system_event requires non-empty "message"');
+            }
+            return ok(raw);
+        }
+        default:
+            return err(`unhandled action type: ${type}`);
+    }
+}
+// ── Start response ──────────────────────────────────────────────────────────
+function validateStartResponse(raw) {
+    if (!isObject(raw))
+        return err('start response is not an object');
+    if (!isString(raw.runId) || raw.runId.length === 0)
+        return err('start response missing runId');
+    if (!isObject(raw.budget))
+        return err('start response missing budget');
+    if (!isNumber(raw.budget.stepsRemaining))
+        return err('budget.stepsRemaining must be a number');
+    if (!isNumber(raw.budget.costSpentUsd))
+        return err('budget.costSpentUsd must be a number');
+    if (!isNumber(raw.budget.costCapUsd))
+        return err('budget.costCapUsd must be a number');
+    if (raw.budget.stepsGranted !== undefined && !isNumber(raw.budget.stepsGranted))
+        return err('budget.stepsGranted must be a number');
+    if (raw.budget.hardMaxSteps !== undefined && !isNumber(raw.budget.hardMaxSteps))
+        return err('budget.hardMaxSteps must be a number');
+    if (raw.budget.extensionsGranted !== undefined && !isNumber(raw.budget.extensionsGranted))
+        return err('budget.extensionsGranted must be a number');
+    if (!isString(raw.refundId) || raw.refundId.length === 0)
+        return err('start response missing refundId');
+    // scanCredits optional but if present must be a number
+    if (raw.scanCredits !== undefined && !isNumber(raw.scanCredits))
+        return err('scanCredits must be a number');
+    return ok(raw);
+}
+// ── Step response ───────────────────────────────────────────────────────────
+function validateStepResponse(raw) {
+    if (!isObject(raw))
+        return err('step response is not an object');
+    // next may be null or an action.
+    if (raw.next !== null && raw.next !== undefined) {
+        const actionResult = validateAction(raw.next);
+        if (!actionResult.ok)
+            return err(`step response next: ${actionResult.error}`);
+    }
+    if (!isNumber(raw.costUsd))
+        return err('step response costUsd must be a number');
+    if (!isNumber(raw.tokens))
+        return err('step response tokens must be a number');
+    if (!isBool(raw.degraded))
+        return err('step response degraded must be a boolean');
+    if (!isBool(raw.costCapped))
+        return err('step response costCapped must be a boolean');
+    if (!isNumber(raw.stepsRemaining))
+        return err('step response stepsRemaining must be a number');
+    // systemEvent optional; if present must be a valid system_event action.
+    if (raw.systemEvent !== undefined && raw.systemEvent !== null) {
+        const evResult = validateAction(raw.systemEvent);
+        if (!evResult.ok)
+            return err(`step response systemEvent: ${evResult.error}`);
+        // Additionally, systemEvent must actually be a system_event (not some other action type).
+        if (!isObject(raw.systemEvent) || raw.systemEvent.type !== 'system_event') {
+            return err('step response systemEvent must have type "system_event"');
+        }
+    }
+    return ok(raw);
+}
+// ── Tool response ────────────────────────────────────────────────────────────
+function validateToolResponse(raw) {
+    if (!isObject(raw))
+        return err('tool response is not an object');
+    if (!isString(raw.observation))
+        return err('tool response observation must be a string');
+    // Cap observation length so a compromised API can't blow out the transcript.
+    const MAX_OBS = 64 * 1024;
+    if (raw.observation.length > MAX_OBS) {
+        // Truncate rather than reject — the observation is still useful.
+        raw.observation = raw.observation.slice(0, MAX_OBS) + '… [truncated by MCP validator]';
+    }
+    return ok(raw);
+}
+// ── Verify generate response ───────────────────────────────────────────────
+//
+// POST /verify/generate returns a test script + runner for local execution.
+// The MCP feeds testScript directly into the sandbox, so a malformed response
+// can cause unsafe or broken execution. Validate before use.
+const VALID_VERIFY_RUNNERS = new Set([
+    'node', 'tsx', 'bun', 'deno', 'python', 'python3',
+    'pnpm-tsx', 'yarn-tsx',
+]);
+const MAX_TEST_SCRIPT_BYTES = 64 * 1024;
+const MAX_SETUP_SCRIPT_BYTES = 32 * 1024;
+function validateVerifyGenerateResponse(raw) {
+    if (!isObject(raw))
+        return err('verify generate response is not an object');
+    if (!isBool(raw.canTest))
+        return err('verify generate response canTest must be a boolean');
+    if (raw.canTest) {
+        if (!isString(raw.testScript) || raw.testScript.length === 0) {
+            return err('verify generate response: canTest=true requires non-empty "testScript"');
+        }
+        if (raw.testScript.length > MAX_TEST_SCRIPT_BYTES) {
+            return err(`verify generate response: testScript too large (${raw.testScript.length} > ${MAX_TEST_SCRIPT_BYTES})`);
+        }
+        if (!isString(raw.runner) || raw.runner.length === 0) {
+            return err('verify generate response: canTest=true requires "runner"');
+        }
+        if (!VALID_VERIFY_RUNNERS.has(raw.runner)) {
+            return err(`verify generate response: runner "${raw.runner}" is not supported (valid: ${[...VALID_VERIFY_RUNNERS].join(', ')})`);
+        }
+    }
+    else {
+        if (!isString(raw.skipReason) || raw.skipReason.length === 0) {
+            return err('verify generate response: canTest=false requires non-empty "skipReason"');
+        }
+    }
+    if (raw.setupScript !== undefined && raw.setupScript !== null) {
+        if (!isString(raw.setupScript))
+            return err('verify generate response: setupScript must be a string or null');
+        if (raw.setupScript.length > MAX_SETUP_SCRIPT_BYTES) {
+            return err(`verify generate response: setupScript too large (${raw.setupScript.length} > ${MAX_SETUP_SCRIPT_BYTES})`);
+        }
+    }
+    if (raw.description !== undefined && raw.description !== null) {
+        if (!isString(raw.description))
+            return err('verify generate response: description must be a string or null');
+    }
+    if (raw.scanCredits !== undefined && raw.scanCredits !== null) {
+        if (!isNumber(raw.scanCredits))
+            return err('verify generate response: scanCredits must be a number or null');
+    }
+    if (raw.costUsd !== undefined && raw.costUsd !== null) {
+        if (!isNumber(raw.costUsd))
+            return err('verify generate response: costUsd must be a number or null');
+    }
+    return ok(raw);
+}
+// ── Verify analyze response ────────────────────────────────────────────────
+//
+// POST /verify/analyze returns a verdict (PROVEN/UNPROVEN/INCONCLUSIVE),
+// a reason string, and a shouldRetry flag. The verify loop uses shouldRetry
+// to decide whether to generate another test. A malformed response can cause
+// infinite retries or a wrong verdict.
+const VALID_VERIFY_VERDICTS = new Set(['PROVEN', 'UNPROVEN', 'INCONCLUSIVE']);
+function validateVerifyAnalyzeResponse(raw) {
+    if (!isObject(raw))
+        return err('verify analyze response is not an object');
+    if (!isString(raw.verdict) || !VALID_VERIFY_VERDICTS.has(raw.verdict)) {
+        return err(`verify analyze response: verdict must be one of PROVEN|UNPROVEN|INCONCLUSIVE, got "${String(raw.verdict)}"`);
+    }
+    if (!isString(raw.reason) || raw.reason.length === 0) {
+        return err('verify analyze response: reason must be a non-empty string');
+    }
+    if (!isBool(raw.shouldRetry))
+        return err('verify analyze response: shouldRetry must be a boolean');
+    // PROVEN and UNPROVEN are definitive — retrying makes no sense.
+    if ((raw.verdict === 'PROVEN' || raw.verdict === 'UNPROVEN') && raw.shouldRetry === true) {
+        return err(`verify analyze response: verdict "${raw.verdict}" cannot have shouldRetry=true (definitive verdict)`);
+    }
+    if (raw.scanCredits !== undefined && raw.scanCredits !== null) {
+        if (!isNumber(raw.scanCredits))
+            return err('verify analyze response: scanCredits must be a number or null');
+    }
+    if (raw.costUsd !== undefined && raw.costUsd !== null) {
+        if (!isNumber(raw.costUsd))
+            return err('verify analyze response: costUsd must be a number or null');
+    }
+    return ok(raw);
+}
+//# sourceMappingURL=protocolValidator.js.map

package/dist/attack/protocolValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocolValidator.js","sourceRoot":"","sources":["../../src/attack/protocolValidator.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;AAqDH,wCA6JC;AAID,sDAcC;AAID,oDAuBC;AAID,oDAUC;AAgBD,wEA2CC;AAWD,sEAwBC;AA7VD,SAAS,EAAE,CAAI,KAAQ,IAAqB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACzE,SAAS,GAAG,CAAC,KAAa,IAAmB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AAE3E,SAAS,QAAQ,CAAC,CAAU;IACxB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU,IAAiB,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;AAC5E,SAAS,QAAQ,CAAC,CAAU,IAAiB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClG,SAAS,MAAM,CAAC,CAAU,IAAkB,OAAO,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;AAC5E,SAAS,gBAAgB,CAAC,CAAU,IAA6B,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvH,SAAS,gBAAgB,CAAC,CAAU,IAA6B,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEvH,+EAA+E;AAE/E,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IAC/B,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,uBAAuB;IACjE,aAAa,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc;IAC9D,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,UAAU;IAClE,oBAAoB,EAAE,aAAa,EAAE,iBAAiB;IACtD,iBAAiB,EAAE,YAAY,EAAE,WAAW;IAC5C,QAAQ,EAAE,cAAc;CAC3B,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;IAC/B,eAAe,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM;IACtE,gBAAgB,EAAE,eAAe,EAAE,qBAAqB;IACxD,0BAA0B,EAAE,uBAAuB;CACtD,CAAC,CAAC;AAEH,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AACpG,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAExE;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,GAAY;IACvC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC,sCAAsC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,QAAQ,IAAI,EAAE,CAAC;QACX,KAAK,WAAW,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/C,OAAO,GAAG,CAAC,4CAA4C,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACrE,OAAO,GAAG,CAAC,qDAAqD,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,yCAAyC,CAAC,CAAC;YACvF,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvD,OAAO,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,uBAAuB,CAAC,CAAC,CAAC;YAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvD,OAAO,GAAG,CAAC,4DAA4D,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACrF,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,iCAAiC,CAAC,CAAC;YACxG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,kCAAkC,CAAC,CAAC;YAC3G,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACvE,OAAO,GAAG,CAAC,qDAAqD,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,kCAAkC,CAAC,CAAC;YACzG,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,eAAe,CAAC,CAAC,CAAC;YACnB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,2CAA2C,CAAC,CAAC;YACzF,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,kCAAkC,CAAC,CAAC;YACzG,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACtF,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACtF,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,gCAAgC,CAAC,CAAC;YACvG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC;gBAAE,OAAO,GAAG,CAAC,gDAAgD,CAAC,CAAC;YACtG,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACtG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAO,GAAG,CAAC,4CAA4C,CAAC,CAAC;YAC/F,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAC3F,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,GAAG,CAAC,6CAA6C,CAAC,CAAC;YAC/F,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC;gBAAE,OAAO,GAAG,CAAC,iDAAiD,CAAC,CAAC;YACvG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,0CAA0C,CAAC,CAAC;YACzF,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YACd,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,uCAAuC,CAAC,CAAC;YAC5G,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,GAAG,CAAC,yCAAyC,CAAC,CAAC;YAC1F,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,oBAAoB;YACrB,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,KAAK,aAAa,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,EAAC,MAAM,EAAC,YAAY,EAAC,SAAS,EAAC,KAAK,EAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5G,OAAO,GAAG,CAAC,+EAA+E,CAAC,CAAC;YAChG,CAAC;YACD,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,qCAAqC,CAAC,CAAC;YAC5G,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACtG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,6CAA6C,CAAC,CAAC;YAC3F,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,qCAAqC,CAAC,CAAC;YAC5G,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,mCAAmC,CAAC,CAAC;YACtG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,6CAA6C,CAAC,CAAC;YAC3F,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,gCAAgC,CAAC,CAAC;YACvG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,GAAG,CAAC,0CAA0C,CAAC,CAAC;YAC1F,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;gBAC/E,OAAO,GAAG,CAAC,mDAAmD,CAAC,CAAC;YACpE,CAAC;YACD,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC1B,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;oBACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;wBAAE,OAAO,GAAG,CAAC,sCAAsC,CAAC,CAAC;gBAC1F,CAAC;gBACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC;oBAAE,OAAO,GAAG,CAAC,8CAA8C,CAAC,CAAC;gBACnG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,cAAc,CAAC;oBAAE,OAAO,GAAG,CAAC,iDAAiD,CAAC,CAAC;YAC7G,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,GAAG,CAAC,4CAA4C,CAAC,CAAC;gBAC/G,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,GAAG,CAAC,4CAA4C,CAAC,CAAC;gBAC/G,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC;oBAAE,OAAO,GAAG,CAAC,8CAA8C,CAAC,CAAC;YACvG,CAAC;YACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;gBAAE,OAAO,GAAG,CAAC,4CAA4C,CAAC,CAAC;YAC/F,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,OAAO,GAAG,CAAC,kCAAkC,CAAC,CAAC;YACjF,wGAAwG;YACxG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3C,MAAM,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC1B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;oBAAE,OAAO,GAAG,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;gBAC/D,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC;oBAAE,OAAO,GAAG,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC;gBACjG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,GAAG,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC;gBAC1G,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC7D,OAAO,GAAG,CAAC,WAAW,CAAC,oDAAoD,CAAC,CAAC;gBACjF,CAAC;gBACD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,GAAG,GAAG,EAAE,CAAC;oBACpE,OAAO,GAAG,CAAC,WAAW,CAAC,4BAA4B,CAAC,CAAC;gBACzD,CAAC;YACL,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,GAAG,CAAC,kCAAkC,CAAC,CAAC;YAC3E,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD,KAAK,cAAc,CAAC,CAAC,CAAC;YAClB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC3E,OAAO,GAAG,CAAC,iDAAiD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrD,OAAO,GAAG,CAAC,2CAA2C,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,EAAE,CAAC,GAAiC,CAAC,CAAC;QACjD,CAAC;QACD;YACI,OAAO,GAAG,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;AACL,CAAC;AAED,+EAA+E;AAE/E,SAAgB,qBAAqB,CAAC,GAAY;IAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC/F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACvE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;QAAE,OAAO,GAAG,CAAC,wCAAwC,CAAC,CAAC;IAC/F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,OAAO,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAC3F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC,oCAAoC,CAAC,CAAC;IACvF,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,OAAO,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACpI,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC;QAAE,OAAO,GAAG,CAAC,sCAAsC,CAAC,CAAC;IACpI,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAAE,OAAO,GAAG,CAAC,2CAA2C,CAAC,CAAC;IACnJ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC,iCAAiC,CAAC,CAAC;IACxG,uDAAuD;IACvD,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5G,OAAO,EAAE,CAAC,GAAwC,CAAC,CAAC;AACxD,CAAC;AAED,+EAA+E;AAE/E,SAAgB,oBAAoB,CAAC,GAAY;IAC7C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,gCAAgC,CAAC,CAAC;IACjE,iCAAiC;IACjC,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,YAAY,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,uBAAuB,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC,wCAAwC,CAAC,CAAC;IACjF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,GAAG,CAAC,uCAAuC,CAAC,CAAC;IAC/E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,GAAG,CAAC,0CAA0C,CAAC,CAAC;IAClF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,GAAG,CAAC,4CAA4C,CAAC,CAAC;IACtF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC;QAAE,OAAO,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAE/F,wEAAwE;IACxE,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC5D,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,8BAA8B,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7E,0FAA0F;QAC1F,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,WAAW,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACxE,OAAO,GAAG,CAAC,yDAAyD,CAAC,CAAC;QAC1E,CAAC;IACL,CAAC;IACD,OAAO,EAAE,CAAC,GAAuC,CAAC,CAAC;AACvD,CAAC;AAED,gFAAgF;AAEhF,SAAgB,oBAAoB,CAAC,GAAY;IAC7C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,gCAAgC,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,GAAG,CAAC,4CAA4C,CAAC,CAAC;IACzF,6EAA6E;IAC7E,MAAM,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC;IAC1B,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,OAAO,EAAE,CAAC;QACnC,iEAAiE;QAChE,GAAW,CAAC,WAAW,GAAI,GAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG,gCAAgC,CAAC;IAC7G,CAAC;IACD,OAAO,EAAE,CAAC,GAAuC,CAAC,CAAC;AACvD,CAAC;AAED,8EAA8E;AAC9E,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6DAA6D;AAE7D,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACjC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS;IACjD,UAAU,EAAE,UAAU;CACzB,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AACxC,MAAM,sBAAsB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEzC,SAAgB,8BAA8B,CAAC,GAAY;IACvD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,2CAA2C,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAE3F,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QACd,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,GAAG,CAAC,wEAAwE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;YAChD,OAAO,GAAG,CAAC,mDAAmD,GAAG,CAAC,UAAU,CAAC,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC;QACvH,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnD,OAAO,GAAG,CAAC,0DAA0D,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACxC,OAAO,GAAG,CAAC,qCAAqC,GAAG,CAAC,MAAM,8BAA8B,CAAC,GAAG,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrI,CAAC;IACL,CAAC;SAAM,CAAC;QACJ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,OAAO,GAAG,CAAC,yEAAyE,CAAC,CAAC;QAC1F,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,OAAO,GAAG,CAAC,gEAAgE,CAAC,CAAC;QAC7G,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;YAClD,OAAO,GAAG,CAAC,oDAAoD,GAAG,CAAC,WAAW,CAAC,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC;QAC1H,CAAC;IACL,CAAC;IAED,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,OAAO,GAAG,CAAC,gEAAgE,CAAC,CAAC;IACjH,CAAC;IAED,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,OAAO,GAAG,CAAC,gEAAgE,CAAC,CAAC;IACjH,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,GAAG,CAAC,4DAA4D,CAAC,CAAC;IACzG,CAAC;IAED,OAAO,EAAE,CAAC,GAAwC,CAAC,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,uCAAuC;AAEvC,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC;AAE9E,SAAgB,6BAA6B,CAAC,GAAY;IACtD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,0CAA0C,CAAC,CAAC;IAC3E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO,GAAG,CAAC,sFAAsF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,OAAO,GAAG,CAAC,4DAA4D,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO,GAAG,CAAC,wDAAwD,CAAC,CAAC;IAEnG,gEAAgE;IAChE,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,UAAU,CAAC,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACvF,OAAO,GAAG,CAAC,qCAAqC,GAAG,CAAC,OAAO,qDAAqD,CAAC,CAAC;IACtH,CAAC;IAED,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC;YAAE,OAAO,GAAG,CAAC,+DAA+D,CAAC,CAAC;IAChH,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACpD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACxG,CAAC;IAED,OAAO,EAAE,CAAC,GAAuC,CAAC,CAAC;AACvD,CAAC"}

package/dist/attack/qualityMetrics.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Scan quality metrics — tracks measurable quality indicators throughout
+ * the agent scan so the final result includes a structured quality scorecard.
+ *
+ * Metrics are tracked locally in the MCP loop and included in the scan
+ * result/audit. They are NOT sent to the API — they are for the MCP and
+ * the caller to evaluate scan quality.
+ */
+export interface ScanQualityMetrics {
+    reads: {
+        total: number;
+        successful: number;
+        duplicate: number;
+        highOverlap: number;
+        partialNew: number;
+        newCoverage: number;
+        blocked: number;
+        truncated: number;
+        invalid: number;
+    };
+    coverage: {
+        totalLines: number;
+        coveredLines: number;
+        coveragePercentage: number;
+        uncoveredRangeCount: number;
+        largestUncoveredRange: {
+            start: number;
+            end: number;
+        } | null;
+    };
+    tools: {
+        totalActions: number;
+        analysisToolCount: number;
+        distinctToolsUsed: string[];
+        readCount: number;
+        searchCount: number;
+        traceFlowCount: number;
+        checkGuardCount: number;
+        checkPolicyCount: number;
+        getEndpointsCount: number;
+        readConfigCount: number;
+        findTestsCount: number;
+        callGraphCount: number;
+    };
+    candidates: {
+        total: number;
+        discovered: number;
+        investigating: number;
+        supported: number;
+        verified: number;
+        unproven: number;
+        inconclusive: number;
+        rejected: number;
+        merged: number;
+        blocked: number;
+    };
+    finish: {
+        attempts: number;
+        rejections: number;
+        forcedTermination: boolean;
+        terminationReason: string;
+        critiqueFired: number;
+        finishGateFired: number;
+    };
+    output: {
+        malformedOutputCount: number;
+        sanitizedFindings: number;
+        downgradedFindings: number;
+    };
+    proof: {
+        requiredEvidenceChainRate: number;
+        rootCauseCorrelationRate: number;
+        resolvedArchitectureRiskRate: number;
+        structuredCrossFileFlowRate: number;
+        highPriorityGapCount: number;
+        unsupportedFindingCount: number;
+    };
+    budget: {
+        stepsUsed: number;
+        stepsGranted: number;
+        extensionsGranted: number;
+        costSpentUsd: number;
+        costCapUsd: number;
+        wallClockMs: number;
+        elapsedMs: number;
+    };
+}
+export declare function createQualityMetrics(): ScanQualityMetrics;
+export declare class QualityMetricsTracker {
+    private metrics;
+    constructor();
+    recordRead(classification: string, truncated: boolean): void;
+    recordToolUse(toolType: string): void;
+    recordCoverage(totalLines: number, coveredLines: number, uncoveredRangeCount: number, largestUncovered: {
+        start: number;
+        end: number;
+    } | null): void;
+    recordCandidateSnapshot(snapshot: {
+        total: number;
+        discovered: number;
+        investigating: number;
+        supported: number;
+        verified: number;
+        unproven: number;
+        inconclusive: number;
+        rejected: number;
+        merged: number;
+        blocked: number;
+    }): void;
+    recordFinishAttempt(): void;
+    recordFinishRejection(): void;
+    recordCritique(): void;
+    recordFinishGate(): void;
+    recordForcedTermination(reason: string): void;
+    recordTermination(reason: string): void;
+    recordMalformedOutput(): void;
+    recordSanitizedFinding(): void;
+    recordDowngradedFinding(): void;
+    recordBudget(stepsUsed: number, stepsGranted: number, extensionsGranted: number, costSpentUsd: number, costCapUsd: number, wallClockMs: number, elapsedMs: number): void;
+    recordProofMetrics(input: {
+        totalFindings: number;
+        supportedFindings: number;
+        totalRisks: number;
+        resolvedRisks: number;
+        structuredFlows: number;
+        totalFlows: number;
+        highPriorityGaps: number;
+        unsupportedFindings: number;
+        rootCauseGroups: number;
+        totalCandidates: number;
+    }): void;
+    getMetrics(): ScanQualityMetrics;
+}