@securitychecks/mcp 0.1.1 → 0.2.2

package/LICENSE

@@ -1,87 +1,190 @@
-SecurityChecks Proprietary License
-
-Copyright (c) 2024-2026 SecurityChecks. All rights reserved.
-
-TERMS AND CONDITIONS
-
-1. DEFINITIONS
-
-"Software" means the SecurityChecks CLI, collector, MCP server, and all
-associated documentation, source code, and compiled binaries.
-
-"License Key" means a valid subscription key obtained from SecurityChecks.
-
-"Free Tier" means usage of the Software without a License Key, subject to
-the limitations described in Section 3.
-
-2. GRANT OF LICENSE
-
-Subject to the terms of this License, SecurityChecks grants you a limited,
-non-exclusive, non-transferable license to:
-
-a) Install and use the Software for your internal business purposes
-b) Make copies of the Software for backup purposes only
-c) Use the Software in continuous integration/continuous deployment pipelines
-
-3. FREE TIER LIMITATIONS
-
-Without a valid License Key, you may use the Software subject to:
-
-a) Maximum of 10 scans per calendar month
-b) Basic finding output only (no SARIF export)
-c) No access to calibration API features
-d) No access to Pro patterns
-e) Community support only
-
-4. RESTRICTIONS
-
-You may NOT:
-
-a) Distribute, sublicense, lease, rent, or lend the Software to third parties
-b) Modify, adapt, translate, reverse engineer, decompile, or disassemble the Software
-c) Remove or alter any proprietary notices, labels, or marks on the Software
-d) Use the Software to create a competing product or service
-e) Share or publish License Keys
-f) Circumvent any license enforcement mechanisms
-g) Use the Software for illegal purposes
-
-5. INTELLECTUAL PROPERTY
-
-The Software and all copies thereof are proprietary to SecurityChecks and
-title thereto remains exclusively with SecurityChecks. All rights in the
-Software not specifically granted in this License are reserved to SecurityChecks.
-
-6. DISCLAIMER OF WARRANTY
-
-THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT.
-
-7. LIMITATION OF LIABILITY
-
-IN NO EVENT SHALL SECURITYCHECKS BE LIABLE FOR ANY INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR IN CONNECTION
-WITH THIS LICENSE OR THE USE OF THE SOFTWARE.
-
-8. TERMINATION
-
-This License is effective until terminated. SecurityChecks may terminate
-this License immediately if you breach any term. Upon termination, you must
-destroy all copies of the Software in your possession.
-
-9. GOVERNING LAW
-
-This License shall be governed by and construed in accordance with the laws
-of the State of Delaware, United States, without regard to its conflict of
-law provisions.
-
-10. ENTIRE AGREEMENT
-
-This License constitutes the entire agreement between you and SecurityChecks
-regarding the Software and supersedes all prior agreements and understandings.
-
----
-
-For licensing inquiries: licensing@securitychecks.ai
-For support: support@securitychecks.ai
-Website: https://securitychecks.ai
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2024-2026 SecurityChecks
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -148,4 +148,4 @@ For teams with compliance requirements:
 
 ## License
 
-Proprietary. See [LICENSE](../../LICENSE) for details.
+Apache-2.0. See [LICENSE](../LICENSE) for details.

package/dist/index.js

@@ -3,7 +3,7 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 import { getInvariantById, ALL_INVARIANTS } from '@securitychecks/collector';
-import { generateTestSkeleton, getStaffQuestion, audit } from '@securitychecks/cli';
+import { generateTestSkeleton, getStaffQuestion, audit, computeReadinessScore } from '@securitychecks/cli';
 import path from 'path';
 import fs from 'fs';
 import { execSync } from 'child_process';
@@ -127,7 +127,7 @@ async function handleFeedbackTool(args, options) {
     });
     writeFileSync(feedbackFile, JSON.stringify(feedbackData, null, 2));
     try {
-      const clientVersion = "0.1.1";
+      const clientVersion = "0.2.2";
       const endpoint = "https://api.securitychecks.ai/v1/feedback";
       const controller = new AbortController();
       const timeoutId = setTimeout(() => controller.abort(), 3e3);
@@ -177,7 +177,7 @@ async function handleFeedbackTool(args, options) {
 }
 
 // src/index.ts
-var version = "0.1.1";
+var version = "0.2.2";
 var server = new Server(
   {
     name: "scheck",
@@ -379,6 +379,7 @@ server.setRequestHandler(
           const findings = result.results.flatMap((r) => r.findings);
           const truncated = findings.length > maxFindings;
           const findingsToReturn = truncated ? findings.slice(0, maxFindings) : findings;
+          const readiness = computeReadinessScore(result.summary);
           const summary = {
             total_checks: result.summary.total,
             passed: result.summary.passed,
@@ -386,7 +387,15 @@ server.setRequestHandler(
             findings_count: findings.length,
             by_severity: result.summary.byPriority,
             truncated,
-            max_findings: maxFindings
+            max_findings: maxFindings,
+            readiness_score: {
+              score: readiness.score,
+              grade: readiness.grade,
+              total: readiness.total,
+              passed: readiness.passed,
+              failed: readiness.failed,
+              hasP0: readiness.hasP0
+            }
           };
           const formattedFindings = findingsToReturn.map((f) => ({
             invariant_id: f.invariantId,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/safety.ts","../src/feedback.ts","../src/index.ts"],"names":["path"],"mappings":";;;;;;;;;;AASO,SAAS,wBAAA,CACd,KACA,GAAA,EACU;AACV,EAAA,MAAM,GAAA,GACJ,IAAI,0BAA0B,CAAA,IAC9B,IAAI,mBAAmB,CAAA,IACvB,IAAI,sBAAsB,CAAA;AAE5B,EAAA,MAAM,KAAA,GAAA,CAAS,OAAO,EAAA,EACnB,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CACnB,MAAA,CAAO,OAAO,CAAA,CACd,GAAA,CAAI,CAAC,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,CAAC,CAAC,CAAA;AAElC,EAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,OAAO,KAAA;AAE7B,EAAA,MAAM,OAAA,GAAU,WAAW,GAAG,CAAA;AAC9B,EAAA,IAAI,OAAA,EAAS,OAAO,CAAC,OAAO,CAAA;AAE5B,EAAA,MAAM,IAAI,KAAA;AAAA,IACR;AAAA,GAEF;AACF;AAEA,SAAS,WAAW,GAAA,EAA4B;AAC9C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,SAAS,+BAAA,EAAiC;AAAA,MACpD,GAAA;AAAA,MACA,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,QAAQ,CAAA;AAAA,MAClC,QAAA,EAAU;AAAA,KACX,EAAE,IAAA,EAAK;AACR,IAAA,OAAO,GAAA,CAAI,MAAA,GAAS,CAAA,GAAI,GAAA,GAAM,IAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,YAAA,CAAa,eAAuB,IAAA,EAAuB;AAClE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,aAAa,CAAA;AAElD,EAAA,OAAO,QAAA,KAAa,EAAA,IAAO,CAAC,QAAA,CAAS,UAAA,CAAW,IAAI,CAAA,IAAK,CAAC,IAAA,CAAK,UAAA,CAAW,QAAQ,CAAA;AACpF;AAEO,SAAS,4BAAA,CACd,eACA,OAAA,EACQ;AACR,EAAA,MAAM,EAAE,GAAA,EAAK,YAAA,EAAa,GAAI,OAAA;AAC9B,EAAA,MAAM,QAAS,aAAA,IAAiB,aAAA,CAAc,MAAK,CAAE,MAAA,GAAS,IAC1D,aAAA,GACA,GAAA;AAEJ,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AAExC,EAAA,IAAI,CAAC,EAAA,CAAG,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,QAAQ,CAAA,CAAE,CAAA;AAAA,EAC3D;AAGA,EAAA,MAAM,YAAA,GAAe,EAAA,CAAG,YAAA,CAAa,QAAQ,CAAA;AAC7C,EAAA,MAAM,gBAAA,GAAmB,YAAA,CAAa,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,CAAG,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,CAAC,CAAC,CAAC,CAAA;AAEtF,EAAA,MAAM,OAAA,GAAU,iBAAiB,IAAA,CAAK,CAAC,SAAS,YAAA,CAAa,YAAA,EAAc,IAAI,CAAC,CAAA;AAEhF,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,SAAA,GAAY,gBAAA,CAAiB,IAAA,CAAK,IAAI,CAAA;AAC5C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mDAAA,EAAsD,YAAY,CAAA,iBAAA,EAAoB,SAAS,CAAA,kEAAA;AAAA,KAEjG;AAAA,EACF;AAEA,EAAA,OAAO,YAAA;AACT;AAIO,SAAS,oBAAA,CACd,UACA,cAAA,EACkB;AAClB,EAAA,IAAI,gBAAgB,OAAO,QAAA;AAC3B,EAAA,OAAO,QAAA,CAAS,GAAA,CAAI,CAAC,EAAE,IAAA,EAAM,MAAK,MAAO,EAAE,IAAA,EAAM,IAAA,EAAK,CAAE,CAAA;AAC1D;;;AC7EA,eAAsB,kBAAA,CACpB,MACA,OAAA,EAKwB;AACxB,EAAA,MAAM,cAAc,IAAA,EAAM,YAAA;AAC1B,EAAA,MAAM,UAAU,IAAA,EAAM,OAAA;AACtB,EAAA,MAAM,SAAS,IAAA,EAAM,MAAA;AAErB,EAAA,IAAI,CAAC,WAAA,IAAe,CAAC,OAAA,EAAS;AAC5B,IAAA,OAAO;AAAA,MACL,OAAA,EAAS;AAAA,QACP;AAAA,UACE,IAAA,EAAM,MAAA;AAAA,UACN,IAAA,EAAM;AAAA;AACR,OACF;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,CAAC,eAAA,EAAiB,gBAAgB,CAAA,CAAE,QAAA,CAAS,OAAO,CAAA,EAAG;AAC1D,IAAA,OAAO;AAAA,MACL,OAAA,EAAS;AAAA,QACP;AAAA,UACE,IAAA,EAAM,MAAA;AAAA,UACN,IAAA,EAAM,oEAAoE,OAAO,CAAA,CAAA;AAAA;AACnF,OACF;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,eAAe,YAAA,EAAc,UAAA,EAAY,WAAW,SAAA,EAAU,GAAI,MAAM,OAAO,IAAI,CAAA;AAC3F,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,OAAO,MAAM,CAAA;AACpC,IAAA,MAAM,GAAA,GAAM,OAAA,EAAS,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAI;AACxC,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,GAAA,EAAK,SAAS,CAAA;AACvC,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,WAAA,EAAa,eAAe,CAAA;AACtD,IAAA,MAAM,GAAA,GAAM,OAAA,EAAS,GAAA,KAAQ,0BAAU,IAAA,EAAK,CAAA;AAE5C,IAAA,IAAI,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG;AAC5B,MAAA,SAAA,CAAU,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAAA,IAC5C,CAAA,MAAO;AACL,MAAA,MAAM,EAAA,GAAK,UAAU,WAAW,CAAA;AAEhC,MAAA,IAAI,EAAA,CAAG,gBAAe,EAAG;AACvB,QAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,MACpE;AACA,MAAA,IAAI,CAAC,EAAA,CAAG,WAAA,EAAY,EAAG;AACrB,QAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,MAC1E;AAAA,IACF;AAEA,IAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,MAAA,MAAM,EAAA,GAAK,UAAU,YAAY,CAAA;AACjC,MAAA,IAAI,EAAA,CAAG,gBAAe,EAAG;AACvB,QAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,MAC1E;AACA,MAAA,IAAI,CAAC,EAAA,CAAG,MAAA,EAAO,EAAG;AAChB,QAAA,MAAM,IAAI,MAAM,yDAAyD,CAAA;AAAA,MAC3E;AAAA,IACF;AAEA,IAAA,IAAI,eAKC,EAAC;AACN,IAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,MAAA,IAAI;AACF,QAAA,YAAA,GAAe,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,YAAA,EAAc,OAAO,CAAC,CAAA;AAAA,MAC/D,CAAA,CAAA,MAAQ;AACN,QAAA,YAAA,GAAe,EAAC;AAAA,MAClB;AAAA,IACF;AAEA,IAAA,YAAA,CAAa,IAAA,CAAK;AAAA,MAChB,WAAA;AAAA,MACA,OAAA;AAAA,MACA,MAAA;AAAA,MACA,SAAA,EAAW,GAAA,EAAI,CAAE,WAAA;AAAY,KAC9B,CAAA;AAED,IAAA,aAAA,CAAc,cAAc,IAAA,CAAK,SAAA,CAAU,YAAA,EAAc,IAAA,EAAM,CAAC,CAAC,CAAA;AAEjE,IAAA,IAAI;AACF,MAAA,MAAM,aAAA,GAAgB,OAAA;AACtB,MAAA,MAAM,QAAA,GAAW,2CAAA;AACjB,MAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,MAAA,MAAM,YAAY,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,GAAI,CAAA;AAC3D,MAAA,MAAM,UAAU,OAAA,EAAS,OAAA,KAAY,OAAO,KAAA,KAAU,aAAa,KAAA,GAAQ,KAAA,CAAA,CAAA;AAC3E,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAA,CAAQ,QAAA,EAAU;AAAA,UAChB,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,UAC9C,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,aAAa,OAAA,EAAS,MAAA,EAAQ,eAAe,CAAA;AAAA,UACpE,QAAQ,UAAA,CAAW;AAAA,SACpB,CAAA,CACE,KAAA,CAAM,MAAM;AAAA,QAAC,CAAC,CAAA,CACd,OAAA,CAAQ,MAAM,YAAA,CAAa,SAAS,CAAC,CAAA;AAAA,MAC1C,CAAA,MAAO;AACL,QAAA,YAAA,CAAa,SAAS,CAAA;AAAA,MACxB;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS;AAAA,QACP;AAAA,UACE,IAAA,EAAM,MAAA;AAAA,UACN,MAAM,IAAA,CAAK,SAAA;AAAA,YACT;AAAA,cACE,QAAA,EAAU,IAAA;AAAA,cACV,WAAA;AAAA,cACA,OAAA;AAAA,cACA,QAAQ,MAAA,IAAU,IAAA;AAAA,cAClB,aAAA,EAAe;AAAA,aACjB;AAAA,YACA,IAAA;AAAA,YACA;AAAA;AACF;AACF;AACF,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAO;AAAA,MACL,OAAA,EAAS;AAAA,QACP;AAAA,UACE,IAAA,EAAM,MAAA;AAAA,UACN,IAAA,EAAM,6BAA6B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA;AAC3F,OACF;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;;;AC7HA,IAAM,OAAA,GAAU,OAAA;AAEhB,IAAM,SAAS,IAAI,MAAA;AAAA,EACjB;AAAA,IACE,IAAA,EAAM,QAAA;AAAA,IACN;AAAA,GACF;AAAA,EACA;AAAA,IACE,YAAA,EAAc;AAAA,MACZ,OAAO;AAAC;AACV;AAEJ,CAAA;AAEA,IAAM,aAAA,GAAgB,CAAC,QAAQ,CAAA;AAQ/B,IAAM,SAAA,GAAuB;AAAA,EAC3B;AAAA,IACE,MAAA,EAAQ,KAAA;AAAA,IACR,WAAA,EACE,0JAAA;AAAA,IAEF,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,IAAA,EAAM;AAAA,UACJ,IAAA,EAAM,QAAA;AAAA,UACN,WAAA,EAAa;AAAA,SACf;AAAA,QACA,eAAA,EAAiB;AAAA,UACf,IAAA,EAAM,SAAA;AAAA,UACN,WAAA,EACE;AAAA,SACJ;AAAA,QACA,YAAA,EAAc;AAAA,UACZ,IAAA,EAAM,SAAA;AAAA,UACN,OAAA,EAAS,CAAA;AAAA,UACT,OAAA,EAAS,GAAA;AAAA,UACT,WAAA,EAAa;AAAA,SACf;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,IAAA,EAAM,OAAA;AAAA,UACN,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,UACxB,WAAA,EAAa;AAAA,SACf;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,IAAA,EAAM,OAAA;AAAA,UACN,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,UACxB,WAAA,EAAa;AAAA;AACf;AACF;AACF,GACF;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,eAAA;AAAA,IACR,WAAA,EACE,iGAAA;AAAA,IACF,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,QAAA,EAAU;AAAA,UACR,IAAA,EAAM,QAAA;AAAA,UACN,IAAA,EAAM,CAAC,IAAA,EAAM,IAAA,EAAM,IAAI,CAAA;AAAA,UACvB,WAAA,EAAa;AAAA,SACf;AAAA,QACA,eAAA,EAAiB;AAAA,UACf,IAAA,EAAM,SAAA;AAAA,UACN,WAAA,EACE;AAAA,SACJ;AAAA,QACA,YAAA,EAAc;AAAA,UACZ,IAAA,EAAM,SAAA;AAAA,UACN,OAAA,EAAS,CAAA;AAAA,UACT,OAAA,EAAS,GAAA;AAAA,UACT,WAAA,EAAa;AAAA;AACf;AACF;AACF,GACF;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,SAAA;AAAA,IACR,WAAA,EACE,4GAAA;AAAA,IACF,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,YAAA,EAAc;AAAA,UACZ,IAAA,EAAM,QAAA;AAAA,UACN,WAAA,EAAa;AAAA;AACf,OACF;AAAA,MACA,QAAA,EAAU,CAAC,cAAc;AAAA;AAC3B,GACF;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,iBAAA;AAAA,IACR,WAAA,EACE,sGAAA;AAAA,IACF,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,QAAA,EAAU;AAAA,UACR,IAAA,EAAM,QAAA;AAAA,UACN,WAAA,EAAa;AAAA,SACf;AAAA,QACA,QAAA,EAAU;AAAA,UACR,IAAA,EAAM,QAAA;AAAA,UACN,IAAA,EAAM,CAAC,IAAA,EAAM,IAAA,EAAM,IAAI,CAAA;AAAA,UACvB,WAAA,EAAa;AAAA;AACf;AACF;AACF,GACF;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,eAAA;AAAA,IACR,WAAA,EACE,uGAAA;AAAA,IACF,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,YAAA,EAAc;AAAA,UACZ,IAAA,EAAM,QAAA;AAAA,UACN,WAAA,EAAa;AAAA,SACf;AAAA,QACA,SAAA,EAAW;AAAA,UACT,IAAA,EAAM,QAAA;AAAA,UACN,IAAA,EAAM,CAAC,MAAA,EAAQ,QAAA,EAAU,YAAY,CAAA;AAAA,UACrC,WAAA,EAAa;AAAA,SACf;AAAA,QACA,OAAA,EAAS;AAAA,UACP,IAAA,EAAM,QAAA;AAAA,UACN,WAAA,EACE;AAAA;AACJ,OACF;AAAA,MACA,QAAA,EAAU,CAAC,cAAc;AAAA;AAC3B,GACF;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,UAAA;AAAA,IACR,WAAA,EACE,qFAAA;AAAA,IACF,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,YAAA,EAAc;AAAA,UACZ,IAAA,EAAM,QAAA;AAAA,UACN,WAAA,EAAa;AAAA,SACf;AAAA,QACA,OAAA,EAAS;AAAA,UACP,IAAA,EAAM,QAAA;AAAA,UACN,IAAA,EAAM,CAAC,eAAA,EAAiB,gBAAgB,CAAA;AAAA,UACxC,WAAA,EAAa;AAAA,SACf;AAAA,QACA,MAAA,EAAQ;AAAA,UACN,IAAA,EAAM,QAAA;AAAA,UACN,IAAA,EAAM;AAAA,YACJ,gBAAA;AAAA,YACA,iBAAA;AAAA,YACA,gBAAA;AAAA,YACA,kBAAA;AAAA,YACA;AAAA,WACF;AAAA,UACA,WAAA,EAAa;AAAA;AACf,OACF;AAAA,MACA,QAAA,EAAU,CAAC,cAAA,EAAgB,SAAS;AAAA;AACtC;AAEJ,CAAA;AAGA,MAAA,CAAO,iBAAA,CAAkB,wBAAwB,YAAY;AAC3D,EAAA,OAAO;AAAA,IACL,OAAO,aAAA,CAAc,OAAA;AAAA,MAAQ,CAAC,MAAA,KAC5B,SAAA,CAAU,GAAA,CAAI,CAAC,GAAA,MAAS;AAAA,QACtB,IAAA,EAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,IAAI,MAAM,CAAA,CAAA;AAAA,QAC7B,aAAa,GAAA,CAAI,WAAA;AAAA,QACjB,aAAa,GAAA,CAAI;AAAA,OACnB,CAAE;AAAA;AACJ,GACF;AACF,CAAC,CAAA;AAGD,IAAI,eAAA,GAAsC,IAAA;AAG1C,MAAA,CAAO,iBAAA;AAAA,EACL,qBAAA;AAAA,EACA,OAAO,OAAA,KAAqE;AAC5E,IAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,KAAS,OAAA,CAAQ,MAAA;AAC1C,IAAA,MAAM,IAAA,GAAO,kBAAkB,IAAI,CAAA;AACnC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,CAAA,cAAA,EAAiB,IAAI,CAAA,CAAA,EAAI,CAAA;AAAA,QACzD,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,QAAQ,IAAA;AAAM,MACZ,KAAK,KAAA,EAAO;AACV,QAAA,MAAMA,KAAAA,GAAQ,IAAA,GAAO,MAAM,CAAA,IAAgB,QAAQ,GAAA,EAAI;AACvD,QAAA,MAAM,IAAA,GAAO,OAAO,MAAM,CAAA;AAC1B,QAAA,MAAM,IAAA,GAAO,OAAO,MAAM,CAAA;AAC1B,QAAA,MAAM,cAAA,GAAiB,IAAA,GAAO,iBAAiB,CAAA,KAAM,IAAA;AACrD,QAAA,MAAM,cACJ,OAAO,IAAA,GAAO,cAAc,CAAA,KAAM,WAC9B,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,GAAA,EAAK,IAAA,CAAK,cAAc,CAAW,CAAC,CAAA,GACzD,GAAA;AAEN,QAAA,IAAI;AACF,UAAA,MAAM,eAAe,wBAAA,CAAyB,OAAA,CAAQ,GAAA,EAAK,OAAA,CAAQ,KAAK,CAAA;AACxE,UAAA,MAAM,UAAA,GAAa,6BAA6BA,KAAAA,EAAM;AAAA,YACpD,GAAA,EAAK,QAAQ,GAAA,EAAI;AAAA,YACjB;AAAA,WACD,CAAA;AAED,UAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM;AAAA,YACzB,UAAA;AAAA,YACA,IAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,eAAA,GAAkB,MAAA;AAGlB,UAAA,MAAM,WAAsB,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAC,CAAA,KAAM,EAAE,QAAQ,CAAA;AACpE,UAAA,MAAM,SAAA,GAAY,SAAS,MAAA,GAAS,WAAA;AACpC,UAAA,MAAM,mBAAmB,SAAA,GAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,WAAW,CAAA,GAAI,QAAA;AACtE,UAAA,MAAM,OAAA,GAAU;AAAA,YACd,YAAA,EAAc,OAAO,OAAA,CAAQ,KAAA;AAAA,YAC7B,MAAA,EAAQ,OAAO,OAAA,CAAQ,MAAA;AAAA,YACvB,MAAA,EAAQ,OAAO,OAAA,CAAQ,MAAA;AAAA,YACvB,gBAAgB,QAAA,CAAS,MAAA;AAAA,YACzB,WAAA,EAAa,OAAO,OAAA,CAAQ,UAAA;AAAA,YAC5B,SAAA;AAAA,YACA,YAAA,EAAc;AAAA,WAChB;AAEA,UAAA,MAAM,iBAAA,GAAoB,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAA,MAAgB;AAAA,YAC9D,cAAc,CAAA,CAAE,WAAA;AAAA,YAChB,UAAU,CAAA,CAAE,QAAA;AAAA,YACZ,SAAS,CAAA,CAAE,OAAA;AAAA,YACX,QAAA,EAAU,oBAAA,CAAqB,CAAA,CAAE,QAAA,EAA8B,cAAc,CAAA;AAAA,YAC7E,gBAAgB,CAAA,CAAE,aAAA;AAAA,YAClB,gBAAgB,CAAA,CAAE,aAAA;AAAA,YAClB,mBAAA,EAAqB,gBAAA,CAAiB,CAAA,CAAE,WAAW;AAAA,WACrD,CAAE,CAAA;AAEF,UAAA,OAAO;AAAA,YACL,OAAA,EAAS;AAAA,cACP;AAAA,gBACE,IAAA,EAAM,MAAA;AAAA,gBACN,MAAM,IAAA,CAAK,SAAA;AAAA,kBACT;AAAA,oBACE,OAAA;AAAA,oBACA,QAAA,EAAU;AAAA,mBACZ;AAAA,kBACA,IAAA;AAAA,kBACA;AAAA;AACF;AACF;AACF,WACF;AAAA,QACF,SAAS,KAAA,EAAO;AACd,UAAA,OAAO;AAAA,YACL,OAAA,EAAS;AAAA,cACP;AAAA,gBACE,IAAA,EAAM,MAAA;AAAA,gBACN,IAAA,EAAM,kBAAkB,KAAK;AAAA;AAC/B,aACF;AAAA,YACA,OAAA,EAAS;AAAA,WACX;AAAA,QACF;AAAA,MACF;AAAA,MAEA,KAAK,eAAA,EAAiB;AACpB,QAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,UAAA,OAAO;AAAA,YACL,OAAA,EAAS;AAAA,cACP;AAAA,gBACE,IAAA,EAAM,MAAA;AAAA,gBACN,IAAA,EAAM;AAAA;AACR;AACF,WACF;AAAA,QACF;AAEA,QAAA,MAAM,QAAA,GAAW,OAAO,UAAU,CAAA;AAClC,QAAA,MAAM,cAAA,GAAiB,IAAA,GAAO,iBAAiB,CAAA,KAAM,IAAA;AACrD,QAAA,MAAM,cACJ,OAAO,IAAA,GAAO,cAAc,CAAA,KAAM,WAC9B,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,GAAA,EAAK,IAAA,CAAK,cAAc,CAAW,CAAC,CAAA,GACzD,GAAA;AACN,QAAA,IAAI,WAAsB,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAC,CAAA,KAAM,EAAE,QAAQ,CAAA;AAE3E,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA,QAAA,GAAW,SAAS,MAAA,CAAO,CAAC,CAAA,KAAe,CAAA,CAAE,aAAa,QAAQ,CAAA;AAAA,QACpE;AAEA,QAAA,MAAM,SAAA,GAAY,SAAS,MAAA,GAAS,WAAA;AACpC,QAAA,MAAM,mBAAmB,SAAA,GAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,WAAW,CAAA,GAAI,QAAA;AAEtE,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,MAAM,IAAA,CAAK,SAAA;AAAA,gBACT;AAAA,kBACE,QAAA,EAAU,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAA,MAAgB;AAAA,oBAC9C,cAAc,CAAA,CAAE,WAAA;AAAA,oBAChB,UAAU,CAAA,CAAE,QAAA;AAAA,oBACZ,SAAS,CAAA,CAAE,OAAA;AAAA,oBACX,QAAA,EAAU,oBAAA,CAAqB,CAAA,CAAE,QAAA,EAA8B,cAAc;AAAA,mBAC/E,CAAE,CAAA;AAAA,kBACF,IAAA,EAAM;AAAA,oBACJ,OAAO,QAAA,CAAS,MAAA;AAAA,oBAChB,SAAA;AAAA,oBACA,YAAA,EAAc;AAAA;AAChB,iBACF;AAAA,gBACA,IAAA;AAAA,gBACA;AAAA;AACF;AACF;AACF,SACF;AAAA,MACF;AAAA,MAEA,KAAK,SAAA,EAAW;AACd,QAAA,MAAM,WAAA,GAAc,OAAO,cAAc,CAAA;AACzC,QAAA,MAAM,SAAA,GAAY,iBAAiB,WAAW,CAAA;AAE9C,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,OAAO;AAAA,YACL,OAAA,EAAS;AAAA,cACP;AAAA,gBACE,IAAA,EAAM,MAAA;AAAA,gBACN,IAAA,EAAM,oBAAoB,WAAW,CAAA,uDAAA;AAAA;AACvC;AACF,WACF;AAAA,QACF;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,MAAM,IAAA,CAAK,SAAA;AAAA,gBACT;AAAA,kBACE,IAAI,SAAA,CAAU,EAAA;AAAA,kBACd,MAAM,SAAA,CAAU,IAAA;AAAA,kBAChB,UAAU,SAAA,CAAU,QAAA;AAAA,kBACpB,UAAU,SAAA,CAAU,QAAA;AAAA,kBACpB,aAAa,SAAA,CAAU,WAAA;AAAA,kBACvB,gBAAgB,SAAA,CAAU,aAAA;AAAA,kBAC1B,mBAAA,EAAqB,gBAAA,CAAiB,SAAA,CAAU,EAAE;AAAA,iBACpD;AAAA,gBACA,IAAA;AAAA,gBACA;AAAA;AACF;AACF;AACF,SACF;AAAA,MACF;AAAA,MAEA,KAAK,iBAAA,EAAmB;AACtB,QAAA,MAAM,QAAA,GAAW,OAAO,UAAU,CAAA;AAClC,QAAA,MAAM,QAAA,GAAW,OAAO,UAAU,CAAA;AAElC,QAAA,IAAI,UAAA,GAAa,cAAA;AAEjB,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA,UAAA,GAAa,WAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,QAAQ,CAAA;AAAA,QAC/D;AACA,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA,UAAA,GAAa,WAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,QAAQ,CAAA;AAAA,QAC/D;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,MAAM,IAAA,CAAK,SAAA;AAAA,gBACT,UAAA,CAAW,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,kBACrB,IAAI,CAAA,CAAE,EAAA;AAAA,kBACN,MAAM,CAAA,CAAE,IAAA;AAAA,kBACR,UAAU,CAAA,CAAE,QAAA;AAAA,kBACZ,UAAU,CAAA,CAAE;AAAA,iBACd,CAAE,CAAA;AAAA,gBACF,IAAA;AAAA,gBACA;AAAA;AACF;AACF;AACF,SACF;AAAA,MACF;AAAA,MAEA,KAAK,eAAA,EAAiB;AACpB,QAAA,MAAM,WAAA,GAAc,OAAO,cAAc,CAAA;AACzC,QAAA,MAAM,SAAA,GAAa,IAAA,GAAO,WAAW,CAAA,IAAgB,QAAA;AACrD,QAAA,MAAM,OAAA,GAAU,OAAO,SAAS,CAAA;AAEhC,QAAA,MAAM,SAAA,GAAY,iBAAiB,WAAW,CAAA;AAC9C,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,OAAO;AAAA,YACL,OAAA,EAAS;AAAA,cACP;AAAA,gBACE,IAAA,EAAM,MAAA;AAAA,gBACN,IAAA,EAAM,sBAAsB,WAAW,CAAA;AAAA;AACzC;AACF,WACF;AAAA,QACF;AAEA,QAAA,MAAM,IAAA,GAAO,oBAAA,CAAqB,SAAA,EAAW,SAAA,EAAW,OAAO,CAAA;AAE/D,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,IAAA,EAAM;AAAA;AACR;AACF,SACF;AAAA,MACF;AAAA,MAEA,KAAK,UAAA,EAAY;AACf,QAAA,OAAO,mBAAmB,IAA2C,CAAA;AAAA,MACvE;AAAA;AACF,EACA;AACF,CAAA;AAEA,SAAS,kBAAkB,IAAA,EAAiC;AAC1D,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,UAAA,EAAY,EAAE,CAAA;AAC1C,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAgB;AAAA,IAClC,KAAA;AAAA,IACA,eAAA;AAAA,IACA,SAAA;AAAA,IACA,iBAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,GAAI,MAAA,GAAS,IAAA;AACxC;AAEA,SAAS,kBAAkB,KAAA,EAAwB;AACjD,EAAA,MAAM,UAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAErE,EAAA,IAAI,qEAAA,CAAsE,IAAA,CAAK,OAAO,CAAA,EAAG;AACvF,IAAA,OAAO;AAAA,MACL,+EAAA;AAAA,MACA,EAAA;AAAA,MACA,MAAA;AAAA,MACA,kEAAA;AAAA,MACA,kFAAA;AAAA,MACA,EAAA;AAAA,MACA,wBAAA;AAAA,MACA,GAAA;AAAA,MACA,mBAAA;AAAA,MACA,iBAAA;AAAA,MACA,gCAAA;AAAA,MACA,kDAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA;AAAA,KACF,CAAE,KAAK,IAAI,CAAA;AAAA,EACb;AAEA,EAAA,OAAO,wBAAwB,OAAO,CAAA,CAAA;AACxC;AAGA,eAAe,IAAA,GAAO;AACpB,EAAA,MAAM,SAAA,GAAY,IAAI,oBAAA,EAAqB;AAC3C,EAAA,MAAM,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC9B,EAAA,OAAA,CAAQ,MAAM,qDAAqD,CAAA;AACrE;AAEA,IAAA,EAAK,CAAE,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA","file":"index.js","sourcesContent":["import path from 'node:path';\nimport fs from 'node:fs';\nimport { execSync } from 'node:child_process';\n\nexport type McpSafetyOptions = {\n  cwd: string;\n  allowedRoots: string[];\n};\n\nexport function parseAllowedRootsFromEnv(\n  env: Record<string, string | undefined>,\n  cwd: string\n): string[] {\n  const raw =\n    env['SCHECK_MCP_ALLOWED_ROOTS'] ??\n    env['MCP_ALLOWED_ROOTS'] ??\n    env['SCHECK_ALLOWED_ROOTS'];\n\n  const roots = (raw ?? '')\n    .split(',')\n    .map((s) => s.trim())\n    .filter(Boolean)\n    .map((p) => path.resolve(cwd, p));\n\n  if (roots.length > 0) return roots;\n\n  const gitRoot = getGitRoot(cwd);\n  if (gitRoot) return [gitRoot];\n\n  throw new Error(\n    'Refusing to scan because no allowed roots are configured and no git repository was detected. ' +\n      'Run scheck-mcp from inside a git repo, or set SCHECK_MCP_ALLOWED_ROOTS (or MCP_ALLOWED_ROOTS).'\n  );\n}\n\nfunction getGitRoot(cwd: string): string | null {\n  try {\n    const out = execSync('git rev-parse --show-toplevel', {\n      cwd,\n      stdio: ['ignore', 'pipe', 'ignore'],\n      encoding: 'utf-8',\n    }).trim();\n    return out.length > 0 ? out : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction isWithinRoot(candidatePath: string, root: string): boolean {\n  const relative = path.relative(root, candidatePath);\n  // `path.relative()` returns '' when equal. Equality should be allowed.\n  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));\n}\n\nexport function resolveAndValidateTargetPath(\n  requestedPath: string | undefined,\n  options: McpSafetyOptions\n): string {\n  const { cwd, allowedRoots } = options;\n  const input = (requestedPath && requestedPath.trim().length > 0)\n    ? requestedPath\n    : cwd;\n\n  const resolved = path.resolve(cwd, input);\n\n  if (!fs.existsSync(resolved)) {\n    throw new Error(`Target path does not exist: ${resolved}`);\n  }\n\n  // Fail closed on symlink escapes: validate based on real paths, not just `path.resolve`.\n  const realResolved = fs.realpathSync(resolved);\n  const realAllowedRoots = allowedRoots.map((r) => fs.realpathSync(path.resolve(cwd, r)));\n\n  const allowed = realAllowedRoots.some((root) => isWithinRoot(realResolved, root));\n\n  if (!allowed) {\n    const rootsList = realAllowedRoots.join(', ');\n    throw new Error(\n      `Refusing to scan outside allowed roots. Requested: ${realResolved}. Allowed roots: ${rootsList}. ` +\n        `Set SCHECK_MCP_ALLOWED_ROOTS (or MCP_ALLOWED_ROOTS) to override.`\n    );\n  }\n\n  return realResolved;\n}\n\nexport type EvidenceForMcp = { file: string; line: number; context?: string };\n\nexport function formatEvidenceForMcp(\n  evidence: EvidenceForMcp[],\n  includeContext: boolean\n): EvidenceForMcp[] {\n  if (includeContext) return evidence;\n  return evidence.map(({ file, line }) => ({ file, line }));\n}\n","export type FeedbackVerdict = 'true_positive' | 'false_positive';\n\nexport interface FeedbackToolArgs {\n  invariant_id?: string;\n  verdict?: string;\n  reason?: string;\n}\n\nexport interface FeedbackToolResponse {\n  content: Array<{ type: 'text'; text: string }>;\n  isError?: boolean;\n}\n\n// Keep tool responses aligned with the MCP SDK result types.\n// (Our response object is a valid CallToolResult / CompatibilityCallToolResult.)\nexport type McpToolResult = import('@modelcontextprotocol/sdk/types.js').CompatibilityCallToolResult;\n\nexport async function handleFeedbackTool(\n  args: FeedbackToolArgs | undefined,\n  options?: {\n    cwd?: string;\n    now?: () => Date;\n    fetchFn?: typeof fetch;\n  }\n): Promise<McpToolResult> {\n  const invariantId = args?.invariant_id;\n  const verdict = args?.verdict as FeedbackVerdict | undefined;\n  const reason = args?.reason;\n\n  if (!invariantId || !verdict) {\n    return {\n      content: [\n        {\n          type: 'text',\n          text: 'Error: invariant_id and verdict are required.',\n        },\n      ],\n      isError: true,\n    };\n  }\n\n  if (!['true_positive', 'false_positive'].includes(verdict)) {\n    return {\n      content: [\n        {\n          type: 'text',\n          text: `Error: verdict must be \"true_positive\" or \"false_positive\", got \"${verdict}\"`,\n        },\n      ],\n      isError: true,\n    };\n  }\n\n  try {\n    const { writeFileSync, readFileSync, existsSync, mkdirSync, lstatSync } = await import('fs');\n    const { join } = await import('path');\n    const cwd = options?.cwd ?? process.cwd();\n    const feedbackDir = join(cwd, '.scheck');\n    const feedbackFile = join(feedbackDir, 'feedback.json');\n    const now = options?.now ?? (() => new Date());\n\n    if (!existsSync(feedbackDir)) {\n      mkdirSync(feedbackDir, { recursive: true });\n    } else {\n      const st = lstatSync(feedbackDir);\n      // Avoid writing through malicious symlinks (e.g., repo-controlled `.scheck` -> /etc).\n      if (st.isSymbolicLink()) {\n        throw new Error('Refusing to write feedback: .scheck is a symlink');\n      }\n      if (!st.isDirectory()) {\n        throw new Error('Refusing to write feedback: .scheck is not a directory');\n      }\n    }\n\n    if (existsSync(feedbackFile)) {\n      const st = lstatSync(feedbackFile);\n      if (st.isSymbolicLink()) {\n        throw new Error('Refusing to write feedback: feedback.json is a symlink');\n      }\n      if (!st.isFile()) {\n        throw new Error('Refusing to write feedback: feedback.json is not a file');\n      }\n    }\n\n    let feedbackData: Array<{\n      invariantId: string;\n      verdict: string;\n      reason?: string;\n      timestamp: string;\n    }> = [];\n    if (existsSync(feedbackFile)) {\n      try {\n        feedbackData = JSON.parse(readFileSync(feedbackFile, 'utf-8'));\n      } catch {\n        feedbackData = [];\n      }\n    }\n\n    feedbackData.push({\n      invariantId,\n      verdict,\n      reason,\n      timestamp: now().toISOString(),\n    });\n\n    writeFileSync(feedbackFile, JSON.stringify(feedbackData, null, 2));\n\n    try {\n      const clientVersion = process.env['MCP_VERSION'] ?? '0.0.0-dev';\n      const endpoint = 'https://api.securitychecks.ai/v1/feedback';\n      const controller = new AbortController();\n      const timeoutId = setTimeout(() => controller.abort(), 3000);\n      const fetchFn = options?.fetchFn ?? (typeof fetch === 'function' ? fetch : undefined);\n      if (fetchFn) {\n        fetchFn(endpoint, {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({ invariantId, verdict, reason, clientVersion }),\n          signal: controller.signal,\n        })\n          .catch(() => {})\n          .finally(() => clearTimeout(timeoutId));\n      } else {\n        clearTimeout(timeoutId);\n      }\n    } catch {\n      // Silent failure for API reporting\n    }\n\n    return {\n      content: [\n        {\n          type: 'text',\n          text: JSON.stringify(\n            {\n              recorded: true,\n              invariantId,\n              verdict,\n              reason: reason ?? null,\n              storedLocally: true,\n            },\n            null,\n            2\n          ),\n        },\n      ],\n    };\n  } catch (error) {\n    return {\n      content: [\n        {\n          type: 'text',\n          text: `Error recording feedback: ${error instanceof Error ? error.message : String(error)}`,\n        },\n      ],\n      isError: true,\n    };\n  }\n}\n","#!/usr/bin/env node\n\n/**\n * SecurityChecks MCP Server (scheck)\n *\n * Catch what Copilot misses — production-ready code review.\n * MCP server that exposes scheck tools for LLM integration.\n */\n\nimport { Server } from '@modelcontextprotocol/sdk/server/index.js';\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport {\n  CallToolRequestSchema,\n  ListToolsRequestSchema,\n} from '@modelcontextprotocol/sdk/types.js';\nimport type { CompatibilityCallToolResult, CreateTaskResult } from '@modelcontextprotocol/sdk/types.js';\nimport {\n  getInvariantById,\n  ALL_INVARIANTS,\n  type AuditResult,\n  type Finding,\n} from '@securitychecks/collector';\nimport { audit } from '@securitychecks/cli';\nimport {\n  formatEvidenceForMcp,\n  parseAllowedRootsFromEnv,\n  resolveAndValidateTargetPath,\n  type EvidenceForMcp,\n} from './safety.js';\nimport { generateTestSkeleton, getStaffQuestion } from '@securitychecks/cli';\nimport { handleFeedbackTool } from './feedback.js';\n\n// Version injected at build time via tsup define\nconst version = process.env['MCP_VERSION'] ?? '0.0.0-dev';\n\nconst server = new Server(\n  {\n    name: 'scheck',\n    version: version,\n  },\n  {\n    capabilities: {\n      tools: {},\n    },\n  }\n);\n\nconst TOOL_PREFIXES = ['scheck'] as const;\ntype ToolSuffix = 'run' | 'list_findings' | 'explain' | 'list_invariants' | 'generate_test' | 'feedback';\ntype ToolDef = {\n  suffix: ToolSuffix;\n  description: string;\n  inputSchema: unknown;\n};\n\nconst TOOL_DEFS: ToolDef[] = [\n  {\n    suffix: 'run',\n    description:\n      'Run scheck — the patterns a senior engineer would flag in review. ' +\n      'Catches webhook idempotency, auth at service layer, transaction safety, and more.',\n    inputSchema: {\n      type: 'object',\n      properties: {\n        path: {\n          type: 'string',\n          description: 'Target path to audit (default: current directory)',\n        },\n        include_context: {\n          type: 'boolean',\n          description:\n            'Include code context snippets in results (may expose source code to the assistant).',\n        },\n        max_findings: {\n          type: 'integer',\n          minimum: 1,\n          maximum: 500,\n          description: 'Limit number of findings returned (default: 200)',\n        },\n        only: {\n          type: 'array',\n          items: { type: 'string' },\n          description: 'Only run specific invariant checks by ID',\n        },\n        skip: {\n          type: 'array',\n          items: { type: 'string' },\n          description: 'Skip specific invariant checks by ID',\n        },\n      },\n    },\n  },\n  {\n    suffix: 'list_findings',\n    description:\n      'List issues a staff engineer would flag — current findings from the last run, by severity.',\n    inputSchema: {\n      type: 'object',\n      properties: {\n        severity: {\n          type: 'string',\n          enum: ['P0', 'P1', 'P2'],\n          description: 'Filter findings by severity',\n        },\n        include_context: {\n          type: 'boolean',\n          description:\n            'Include code context snippets in results (may expose source code to the assistant).',\n        },\n        max_findings: {\n          type: 'integer',\n          minimum: 1,\n          maximum: 500,\n          description: 'Limit number of findings returned (default: 200)',\n        },\n      },\n    },\n  },\n  {\n    suffix: 'explain',\n    description:\n      'What a staff engineer checks: explain why a pattern matters, real incidents it prevents, and proof needed.',\n    inputSchema: {\n      type: 'object',\n      properties: {\n        invariant_id: {\n          type: 'string',\n          description: 'The invariant ID to explain (e.g., AUTHZ.SERVICE_LAYER.ENFORCED)',\n        },\n      },\n      required: ['invariant_id'],\n    },\n  },\n  {\n    suffix: 'list_invariants',\n    description:\n      'List all patterns a staff engineer checks for — the patterns that prevent production incidents.',\n    inputSchema: {\n      type: 'object',\n      properties: {\n        category: {\n          type: 'string',\n          description: 'Filter by category (authz, revocation, webhooks, transactions, etc.)',\n        },\n        severity: {\n          type: 'string',\n          enum: ['P0', 'P1', 'P2'],\n          description: 'Filter by severity',\n        },\n      },\n    },\n  },\n  {\n    suffix: 'generate_test',\n    description:\n      'Generate test code that proves a pattern is enforced — the proof a staff engineer would ask for.',\n    inputSchema: {\n      type: 'object',\n      properties: {\n        invariant_id: {\n          type: 'string',\n          description: 'The invariant ID to generate a test for',\n        },\n        framework: {\n          type: 'string',\n          enum: ['jest', 'vitest', 'playwright'],\n          description: 'Test framework to generate code for (default: vitest)',\n        },\n        context: {\n          type: 'string',\n          description:\n            'Additional context about the specific violation to generate a more targeted test',\n        },\n      },\n      required: ['invariant_id'],\n    },\n  },\n  {\n    suffix: 'feedback',\n    description:\n      'Report whether a finding was a true positive or false positive to improve accuracy.',\n    inputSchema: {\n      type: 'object',\n      properties: {\n        invariant_id: {\n          type: 'string',\n          description: 'Invariant ID (e.g., AUTHZ.SERVICE_LAYER.ENFORCED)',\n        },\n        verdict: {\n          type: 'string',\n          enum: ['true_positive', 'false_positive'],\n          description: 'Whether the finding was a true positive or false positive',\n        },\n        reason: {\n          type: 'string',\n          enum: [\n            'not_applicable',\n            'acceptable_risk',\n            'wrong_location',\n            'outdated_pattern',\n            'missing_context',\n          ],\n          description: 'Reason for the verdict',\n        },\n      },\n      required: ['invariant_id', 'verdict'],\n    },\n  },\n];\n\n// List available tools\nserver.setRequestHandler(ListToolsRequestSchema, async () => {\n  return {\n    tools: TOOL_PREFIXES.flatMap((prefix) =>\n      TOOL_DEFS.map((def) => ({\n        name: `${prefix}_${def.suffix}`,\n        description: def.description,\n        inputSchema: def.inputSchema,\n      }))\n    ),\n  };\n});\n\n// Track last audit result for list_findings\nlet lastAuditResult: AuditResult | null = null;\n\n// Handle tool calls\nserver.setRequestHandler(\n  CallToolRequestSchema,\n  async (request): Promise<CompatibilityCallToolResult | CreateTaskResult> => {\n  const { name, arguments: args } = request.params;\n  const tool = normalizeToolName(name);\n  if (!tool) {\n    return {\n      content: [{ type: 'text', text: `Unknown tool: ${name}` }],\n      isError: true,\n    };\n  }\n\n  switch (tool) {\n    case 'run': {\n      const path = (args?.['path'] as string) || process.cwd();\n      const only = args?.['only'] as string[] | undefined;\n      const skip = args?.['skip'] as string[] | undefined;\n      const includeContext = args?.['include_context'] === true;\n      const maxFindings =\n        typeof args?.['max_findings'] === 'number'\n          ? Math.max(1, Math.min(500, args['max_findings'] as number))\n          : 200;\n\n      try {\n        const allowedRoots = parseAllowedRootsFromEnv(process.env, process.cwd());\n        const targetPath = resolveAndValidateTargetPath(path, {\n          cwd: process.cwd(),\n          allowedRoots,\n        });\n\n        const result = await audit({\n          targetPath,\n          only,\n          skip,\n        });\n\n        lastAuditResult = result;\n\n        // Format findings for LLM consumption\n        const findings: Finding[] = result.results.flatMap((r) => r.findings);\n        const truncated = findings.length > maxFindings;\n        const findingsToReturn = truncated ? findings.slice(0, maxFindings) : findings;\n        const summary = {\n          total_checks: result.summary.total,\n          passed: result.summary.passed,\n          failed: result.summary.failed,\n          findings_count: findings.length,\n          by_severity: result.summary.byPriority,\n          truncated,\n          max_findings: maxFindings,\n        };\n\n        const formattedFindings = findingsToReturn.map((f: Finding) => ({\n          invariant_id: f.invariantId,\n          severity: f.severity,\n          message: f.message,\n          evidence: formatEvidenceForMcp(f.evidence as EvidenceForMcp[], includeContext),\n          required_proof: f.requiredProof,\n          suggested_test: f.suggestedTest,\n          staff_engineer_asks: getStaffQuestion(f.invariantId),\n        }));\n\n        return {\n          content: [\n            {\n              type: 'text',\n              text: JSON.stringify(\n                {\n                  summary,\n                  findings: formattedFindings,\n                },\n                null,\n                2\n              ),\n            },\n          ],\n        };\n      } catch (error) {\n        return {\n          content: [\n            {\n              type: 'text',\n              text: formatMcpRunError(error),\n            },\n          ],\n          isError: true,\n        };\n      }\n    }\n\n    case 'list_findings': {\n      if (!lastAuditResult) {\n        return {\n          content: [\n            {\n              type: 'text',\n              text: 'No scan has been run yet. Use scheck_run first.',\n            },\n          ],\n        };\n      }\n\n      const severity = args?.['severity'] as string | undefined;\n      const includeContext = args?.['include_context'] === true;\n      const maxFindings =\n        typeof args?.['max_findings'] === 'number'\n          ? Math.max(1, Math.min(500, args['max_findings'] as number))\n          : 200;\n      let findings: Finding[] = lastAuditResult.results.flatMap((r) => r.findings);\n\n      if (severity) {\n        findings = findings.filter((f: Finding) => f.severity === severity);\n      }\n\n      const truncated = findings.length > maxFindings;\n      const findingsToReturn = truncated ? findings.slice(0, maxFindings) : findings;\n\n      return {\n        content: [\n          {\n            type: 'text',\n            text: JSON.stringify(\n              {\n                findings: findingsToReturn.map((f: Finding) => ({\n                  invariant_id: f.invariantId,\n                  severity: f.severity,\n                  message: f.message,\n                  evidence: formatEvidenceForMcp(f.evidence as EvidenceForMcp[], includeContext),\n                })),\n                meta: {\n                  total: findings.length,\n                  truncated,\n                  max_findings: maxFindings,\n                },\n              },\n              null,\n              2\n            ),\n          },\n        ],\n      };\n    }\n\n    case 'explain': {\n      const invariantId = args?.['invariant_id'] as string;\n      const invariant = getInvariantById(invariantId);\n\n      if (!invariant) {\n        return {\n          content: [\n            {\n              type: 'text',\n              text: `Unknown pattern: ${invariantId}. Use scheck_list_invariants to see available patterns.`,\n            },\n          ],\n        };\n      }\n\n      return {\n        content: [\n          {\n            type: 'text',\n            text: JSON.stringify(\n              {\n                id: invariant.id,\n                name: invariant.name,\n                severity: invariant.severity,\n                category: invariant.category,\n                description: invariant.description,\n                required_proof: invariant.requiredProof,\n                staff_engineer_asks: getStaffQuestion(invariant.id),\n              },\n              null,\n              2\n            ),\n          },\n        ],\n      };\n    }\n\n    case 'list_invariants': {\n      const category = args?.['category'] as string | undefined;\n      const severity = args?.['severity'] as string | undefined;\n\n      let invariants = ALL_INVARIANTS;\n\n      if (category) {\n        invariants = invariants.filter((i) => i.category === category);\n      }\n      if (severity) {\n        invariants = invariants.filter((i) => i.severity === severity);\n      }\n\n      return {\n        content: [\n          {\n            type: 'text',\n            text: JSON.stringify(\n              invariants.map((i) => ({\n                id: i.id,\n                name: i.name,\n                severity: i.severity,\n                category: i.category,\n              })),\n              null,\n              2\n            ),\n          },\n        ],\n      };\n    }\n\n    case 'generate_test': {\n      const invariantId = args?.['invariant_id'] as string;\n      const framework = (args?.['framework'] as string) || 'vitest';\n      const context = args?.['context'] as string | undefined;\n\n      const invariant = getInvariantById(invariantId);\n      if (!invariant) {\n        return {\n          content: [\n            {\n              type: 'text',\n              text: `Unknown invariant: ${invariantId}`,\n            },\n          ],\n        };\n      }\n\n      const test = generateTestSkeleton(invariant, framework, context);\n\n      return {\n        content: [\n          {\n            type: 'text',\n            text: test,\n          },\n        ],\n      };\n    }\n\n    case 'feedback': {\n      return handleFeedbackTool(args as Record<string, unknown> | undefined);\n    }\n  }\n  }\n);\n\nfunction normalizeToolName(name: string): ToolSuffix | null {\n  const suffix = name.replace(/^scheck_/, '') as ToolSuffix;\n  const allowed = new Set<ToolSuffix>([\n    'run',\n    'list_findings',\n    'explain',\n    'list_invariants',\n    'generate_test',\n    'feedback',\n  ]);\n  return allowed.has(suffix) ? suffix : null;\n}\n\nfunction formatMcpRunError(error: unknown): string {\n  const message = error instanceof Error ? error.message : String(error);\n\n  if (/no allowed roots are configured and no git repository was detected/i.test(message)) {\n    return [\n      'Refusing to scan: no git repository detected and no allowed roots configured.',\n      '',\n      'Fix:',\n      '- Start the MCP server from inside the repo you want to scan, or',\n      '- Set SCHECK_MCP_ALLOWED_ROOTS (or MCP_ALLOWED_ROOTS) in your MCP server config.',\n      '',\n      'Example (Claude Code):',\n      '{',\n      '  \"mcpServers\": {',\n      '    \"scheck\": {',\n      '      \"command\": \"scheck-mcp\",',\n      '      \"env\": { \"SCHECK_MCP_ALLOWED_ROOTS\": \".\" }',\n      '    }',\n      '  }',\n      '}',\n    ].join('\\n');\n  }\n\n  return `Error running audit: ${message}`;\n}\n\n// Start the server\nasync function main() {\n  const transport = new StdioServerTransport();\n  await server.connect(transport);\n  console.error('SecurityChecks MCP server (scheck) running on stdio');\n}\n\nmain().catch(console.error);\n"]}
+{"version":3,"sources":["../src/safety.ts","../src/feedback.ts","../src/index.ts"],"names":["path"],"mappings":";;;;;;;;;;AASO,SAAS,wBAAA,CACd,KACA,GAAA,EACU;AACV,EAAA,MAAM,GAAA,GACJ,IAAI,0BAA0B,CAAA,IAC9B,IAAI,mBAAmB,CAAA,IACvB,IAAI,sBAAsB,CAAA;AAE5B,EAAA,MAAM,KAAA,GAAA,CAAS,OAAO,EAAA,EACnB,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CACnB,MAAA,CAAO,OAAO,CAAA,CACd,GAAA,CAAI,CAAC,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,CAAC,CAAC,CAAA;AAElC,EAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,OAAO,KAAA;AAE7B,EAAA,MAAM,OAAA,GAAU,WAAW,GAAG,CAAA;AAC9B,EAAA,IAAI,OAAA,EAAS,OAAO,CAAC,OAAO,CAAA;AAE5B,EAAA,MAAM,IAAI,KAAA;AAAA,IACR;AAAA,GAEF;AACF;AAEA,SAAS,WAAW,GAAA,EAA4B;AAC9C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,SAAS,+BAAA,EAAiC;AAAA,MACpD,GAAA;AAAA,MACA,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,QAAQ,CAAA;AAAA,MAClC,QAAA,EAAU;AAAA,KACX,EAAE,IAAA,EAAK;AACR,IAAA,OAAO,GAAA,CAAI,MAAA,GAAS,CAAA,GAAI,GAAA,GAAM,IAAA;AAAA,EAChC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,YAAA,CAAa,eAAuB,IAAA,EAAuB;AAClE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,aAAa,CAAA;AAElD,EAAA,OAAO,QAAA,KAAa,EAAA,IAAO,CAAC,QAAA,CAAS,UAAA,CAAW,IAAI,CAAA,IAAK,CAAC,IAAA,CAAK,UAAA,CAAW,QAAQ,CAAA;AACpF;AAEO,SAAS,4BAAA,CACd,eACA,OAAA,EACQ;AACR,EAAA,MAAM,EAAE,GAAA,EAAK,YAAA,EAAa,GAAI,OAAA;AAC9B,EAAA,MAAM,QAAS,aAAA,IAAiB,aAAA,CAAc,MAAK,CAAE,MAAA,GAAS,IAC1D,aAAA,GACA,GAAA;AAEJ,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AAExC,EAAA,IAAI,CAAC,EAAA,CAAG,UAAA,CAAW,QAAQ,CAAA,EAAG;AAC5B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,QAAQ,CAAA,CAAE,CAAA;AAAA,EAC3D;AAGA,EAAA,MAAM,YAAA,GAAe,EAAA,CAAG,YAAA,CAAa,QAAQ,CAAA;AAC7C,EAAA,MAAM,gBAAA,GAAmB,YAAA,CAAa,GAAA,CAAI,CAAC,CAAA,KAAM,EAAA,CAAG,YAAA,CAAa,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,CAAC,CAAC,CAAC,CAAA;AAEtF,EAAA,MAAM,OAAA,GAAU,iBAAiB,IAAA,CAAK,CAAC,SAAS,YAAA,CAAa,YAAA,EAAc,IAAI,CAAC,CAAA;AAEhF,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,SAAA,GAAY,gBAAA,CAAiB,IAAA,CAAK,IAAI,CAAA;AAC5C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,mDAAA,EAAsD,YAAY,CAAA,iBAAA,EAAoB,SAAS,CAAA,kEAAA;AAAA,KAEjG;AAAA,EACF;AAEA,EAAA,OAAO,YAAA;AACT;AAIO,SAAS,oBAAA,CACd,UACA,cAAA,EACkB;AAClB,EAAA,IAAI,gBAAgB,OAAO,QAAA;AAC3B,EAAA,OAAO,QAAA,CAAS,GAAA,CAAI,CAAC,EAAE,IAAA,EAAM,MAAK,MAAO,EAAE,IAAA,EAAM,IAAA,EAAK,CAAE,CAAA;AAC1D;;;AC7EA,eAAsB,kBAAA,CACpB,MACA,OAAA,EAKwB;AACxB,EAAA,MAAM,cAAc,IAAA,EAAM,YAAA;AAC1B,EAAA,MAAM,UAAU,IAAA,EAAM,OAAA;AACtB,EAAA,MAAM,SAAS,IAAA,EAAM,MAAA;AAErB,EAAA,IAAI,CAAC,WAAA,IAAe,CAAC,OAAA,EAAS;AAC5B,IAAA,OAAO;AAAA,MACL,OAAA,EAAS;AAAA,QACP;AAAA,UACE,IAAA,EAAM,MAAA;AAAA,UACN,IAAA,EAAM;AAAA;AACR,OACF;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,CAAC,eAAA,EAAiB,gBAAgB,CAAA,CAAE,QAAA,CAAS,OAAO,CAAA,EAAG;AAC1D,IAAA,OAAO;AAAA,MACL,OAAA,EAAS;AAAA,QACP;AAAA,UACE,IAAA,EAAM,MAAA;AAAA,UACN,IAAA,EAAM,oEAAoE,OAAO,CAAA,CAAA;AAAA;AACnF,OACF;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,eAAe,YAAA,EAAc,UAAA,EAAY,WAAW,SAAA,EAAU,GAAI,MAAM,OAAO,IAAI,CAAA;AAC3F,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,OAAO,MAAM,CAAA;AACpC,IAAA,MAAM,GAAA,GAAM,OAAA,EAAS,GAAA,IAAO,OAAA,CAAQ,GAAA,EAAI;AACxC,IAAA,MAAM,WAAA,GAAc,IAAA,CAAK,GAAA,EAAK,SAAS,CAAA;AACvC,IAAA,MAAM,YAAA,GAAe,IAAA,CAAK,WAAA,EAAa,eAAe,CAAA;AACtD,IAAA,MAAM,GAAA,GAAM,OAAA,EAAS,GAAA,KAAQ,0BAAU,IAAA,EAAK,CAAA;AAE5C,IAAA,IAAI,CAAC,UAAA,CAAW,WAAW,CAAA,EAAG;AAC5B,MAAA,SAAA,CAAU,WAAA,EAAa,EAAE,SAAA,EAAW,IAAA,EAAM,CAAA;AAAA,IAC5C,CAAA,MAAO;AACL,MAAA,MAAM,EAAA,GAAK,UAAU,WAAW,CAAA;AAEhC,MAAA,IAAI,EAAA,CAAG,gBAAe,EAAG;AACvB,QAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,MACpE;AACA,MAAA,IAAI,CAAC,EAAA,CAAG,WAAA,EAAY,EAAG;AACrB,QAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,MAC1E;AAAA,IACF;AAEA,IAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,MAAA,MAAM,EAAA,GAAK,UAAU,YAAY,CAAA;AACjC,MAAA,IAAI,EAAA,CAAG,gBAAe,EAAG;AACvB,QAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,MAC1E;AACA,MAAA,IAAI,CAAC,EAAA,CAAG,MAAA,EAAO,EAAG;AAChB,QAAA,MAAM,IAAI,MAAM,yDAAyD,CAAA;AAAA,MAC3E;AAAA,IACF;AAEA,IAAA,IAAI,eAKC,EAAC;AACN,IAAA,IAAI,UAAA,CAAW,YAAY,CAAA,EAAG;AAC5B,MAAA,IAAI;AACF,QAAA,YAAA,GAAe,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,YAAA,EAAc,OAAO,CAAC,CAAA;AAAA,MAC/D,CAAA,CAAA,MAAQ;AACN,QAAA,YAAA,GAAe,EAAC;AAAA,MAClB;AAAA,IACF;AAEA,IAAA,YAAA,CAAa,IAAA,CAAK;AAAA,MAChB,WAAA;AAAA,MACA,OAAA;AAAA,MACA,MAAA;AAAA,MACA,SAAA,EAAW,GAAA,EAAI,CAAE,WAAA;AAAY,KAC9B,CAAA;AAED,IAAA,aAAA,CAAc,cAAc,IAAA,CAAK,SAAA,CAAU,YAAA,EAAc,IAAA,EAAM,CAAC,CAAC,CAAA;AAEjE,IAAA,IAAI;AACF,MAAA,MAAM,aAAA,GAAgB,OAAA;AACtB,MAAA,MAAM,QAAA,GAAW,2CAAA;AACjB,MAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,MAAA,MAAM,YAAY,UAAA,CAAW,MAAM,UAAA,CAAW,KAAA,IAAS,GAAI,CAAA;AAC3D,MAAA,MAAM,UAAU,OAAA,EAAS,OAAA,KAAY,OAAO,KAAA,KAAU,aAAa,KAAA,GAAQ,KAAA,CAAA,CAAA;AAC3E,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAA,CAAQ,QAAA,EAAU;AAAA,UAChB,MAAA,EAAQ,MAAA;AAAA,UACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,UAC9C,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,aAAa,OAAA,EAAS,MAAA,EAAQ,eAAe,CAAA;AAAA,UACpE,QAAQ,UAAA,CAAW;AAAA,SACpB,CAAA,CACE,KAAA,CAAM,MAAM;AAAA,QAAC,CAAC,CAAA,CACd,OAAA,CAAQ,MAAM,YAAA,CAAa,SAAS,CAAC,CAAA;AAAA,MAC1C,CAAA,MAAO;AACL,QAAA,YAAA,CAAa,SAAS,CAAA;AAAA,MACxB;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAEA,IAAA,OAAO;AAAA,MACL,OAAA,EAAS;AAAA,QACP;AAAA,UACE,IAAA,EAAM,MAAA;AAAA,UACN,MAAM,IAAA,CAAK,SAAA;AAAA,YACT;AAAA,cACE,QAAA,EAAU,IAAA;AAAA,cACV,WAAA;AAAA,cACA,OAAA;AAAA,cACA,QAAQ,MAAA,IAAU,IAAA;AAAA,cAClB,aAAA,EAAe;AAAA,aACjB;AAAA,YACA,IAAA;AAAA,YACA;AAAA;AACF;AACF;AACF,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAO;AAAA,MACL,OAAA,EAAS;AAAA,QACP;AAAA,UACE,IAAA,EAAM,MAAA;AAAA,UACN,IAAA,EAAM,6BAA6B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA;AAC3F,OACF;AAAA,MACA,OAAA,EAAS;AAAA,KACX;AAAA,EACF;AACF;;;AC7HA,IAAM,OAAA,GAAU,OAAA;AAEhB,IAAM,SAAS,IAAI,MAAA;AAAA,EACjB;AAAA,IACE,IAAA,EAAM,QAAA;AAAA,IACN;AAAA,GACF;AAAA,EACA;AAAA,IACE,YAAA,EAAc;AAAA,MACZ,OAAO;AAAC;AACV;AAEJ,CAAA;AAEA,IAAM,aAAA,GAAgB,CAAC,QAAQ,CAAA;AAQ/B,IAAM,SAAA,GAAuB;AAAA,EAC3B;AAAA,IACE,MAAA,EAAQ,KAAA;AAAA,IACR,WAAA,EACE,0JAAA;AAAA,IAEF,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,IAAA,EAAM;AAAA,UACJ,IAAA,EAAM,QAAA;AAAA,UACN,WAAA,EAAa;AAAA,SACf;AAAA,QACA,eAAA,EAAiB;AAAA,UACf,IAAA,EAAM,SAAA;AAAA,UACN,WAAA,EACE;AAAA,SACJ;AAAA,QACA,YAAA,EAAc;AAAA,UACZ,IAAA,EAAM,SAAA;AAAA,UACN,OAAA,EAAS,CAAA;AAAA,UACT,OAAA,EAAS,GAAA;AAAA,UACT,WAAA,EAAa;AAAA,SACf;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,IAAA,EAAM,OAAA;AAAA,UACN,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,UACxB,WAAA,EAAa;AAAA,SACf;AAAA,QACA,IAAA,EAAM;AAAA,UACJ,IAAA,EAAM,OAAA;AAAA,UACN,KAAA,EAAO,EAAE,IAAA,EAAM,QAAA,EAAS;AAAA,UACxB,WAAA,EAAa;AAAA;AACf;AACF;AACF,GACF;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,eAAA;AAAA,IACR,WAAA,EACE,iGAAA;AAAA,IACF,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,QAAA,EAAU;AAAA,UACR,IAAA,EAAM,QAAA;AAAA,UACN,IAAA,EAAM,CAAC,IAAA,EAAM,IAAA,EAAM,IAAI,CAAA;AAAA,UACvB,WAAA,EAAa;AAAA,SACf;AAAA,QACA,eAAA,EAAiB;AAAA,UACf,IAAA,EAAM,SAAA;AAAA,UACN,WAAA,EACE;AAAA,SACJ;AAAA,QACA,YAAA,EAAc;AAAA,UACZ,IAAA,EAAM,SAAA;AAAA,UACN,OAAA,EAAS,CAAA;AAAA,UACT,OAAA,EAAS,GAAA;AAAA,UACT,WAAA,EAAa;AAAA;AACf;AACF;AACF,GACF;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,SAAA;AAAA,IACR,WAAA,EACE,4GAAA;AAAA,IACF,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,YAAA,EAAc;AAAA,UACZ,IAAA,EAAM,QAAA;AAAA,UACN,WAAA,EAAa;AAAA;AACf,OACF;AAAA,MACA,QAAA,EAAU,CAAC,cAAc;AAAA;AAC3B,GACF;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,iBAAA;AAAA,IACR,WAAA,EACE,sGAAA;AAAA,IACF,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,QAAA,EAAU;AAAA,UACR,IAAA,EAAM,QAAA;AAAA,UACN,WAAA,EAAa;AAAA,SACf;AAAA,QACA,QAAA,EAAU;AAAA,UACR,IAAA,EAAM,QAAA;AAAA,UACN,IAAA,EAAM,CAAC,IAAA,EAAM,IAAA,EAAM,IAAI,CAAA;AAAA,UACvB,WAAA,EAAa;AAAA;AACf;AACF;AACF,GACF;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,eAAA;AAAA,IACR,WAAA,EACE,uGAAA;AAAA,IACF,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,YAAA,EAAc;AAAA,UACZ,IAAA,EAAM,QAAA;AAAA,UACN,WAAA,EAAa;AAAA,SACf;AAAA,QACA,SAAA,EAAW;AAAA,UACT,IAAA,EAAM,QAAA;AAAA,UACN,IAAA,EAAM,CAAC,MAAA,EAAQ,QAAA,EAAU,YAAY,CAAA;AAAA,UACrC,WAAA,EAAa;AAAA,SACf;AAAA,QACA,OAAA,EAAS;AAAA,UACP,IAAA,EAAM,QAAA;AAAA,UACN,WAAA,EACE;AAAA;AACJ,OACF;AAAA,MACA,QAAA,EAAU,CAAC,cAAc;AAAA;AAC3B,GACF;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,UAAA;AAAA,IACR,WAAA,EACE,qFAAA;AAAA,IACF,WAAA,EAAa;AAAA,MACX,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY;AAAA,QACV,YAAA,EAAc;AAAA,UACZ,IAAA,EAAM,QAAA;AAAA,UACN,WAAA,EAAa;AAAA,SACf;AAAA,QACA,OAAA,EAAS;AAAA,UACP,IAAA,EAAM,QAAA;AAAA,UACN,IAAA,EAAM,CAAC,eAAA,EAAiB,gBAAgB,CAAA;AAAA,UACxC,WAAA,EAAa;AAAA,SACf;AAAA,QACA,MAAA,EAAQ;AAAA,UACN,IAAA,EAAM,QAAA;AAAA,UACN,IAAA,EAAM;AAAA,YACJ,gBAAA;AAAA,YACA,iBAAA;AAAA,YACA,gBAAA;AAAA,YACA,kBAAA;AAAA,YACA;AAAA,WACF;AAAA,UACA,WAAA,EAAa;AAAA;AACf,OACF;AAAA,MACA,QAAA,EAAU,CAAC,cAAA,EAAgB,SAAS;AAAA;AACtC;AAEJ,CAAA;AAGA,MAAA,CAAO,iBAAA,CAAkB,wBAAwB,YAAY;AAC3D,EAAA,OAAO;AAAA,IACL,OAAO,aAAA,CAAc,OAAA;AAAA,MAAQ,CAAC,MAAA,KAC5B,SAAA,CAAU,GAAA,CAAI,CAAC,GAAA,MAAS;AAAA,QACtB,IAAA,EAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,IAAI,MAAM,CAAA,CAAA;AAAA,QAC7B,aAAa,GAAA,CAAI,WAAA;AAAA,QACjB,aAAa,GAAA,CAAI;AAAA,OACnB,CAAE;AAAA;AACJ,GACF;AACF,CAAC,CAAA;AAGD,IAAI,eAAA,GAAsC,IAAA;AAG1C,MAAA,CAAO,iBAAA;AAAA,EACL,qBAAA;AAAA,EACA,OAAO,OAAA,KAAqE;AAC5E,IAAA,MAAM,EAAE,IAAA,EAAM,SAAA,EAAW,IAAA,KAAS,OAAA,CAAQ,MAAA;AAC1C,IAAA,MAAM,IAAA,GAAO,kBAAkB,IAAI,CAAA;AACnC,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,CAAA,cAAA,EAAiB,IAAI,CAAA,CAAA,EAAI,CAAA;AAAA,QACzD,OAAA,EAAS;AAAA,OACX;AAAA,IACF;AAEA,IAAA,QAAQ,IAAA;AAAM,MACZ,KAAK,KAAA,EAAO;AACV,QAAA,MAAMA,KAAAA,GAAQ,IAAA,GAAO,MAAM,CAAA,IAAgB,QAAQ,GAAA,EAAI;AACvD,QAAA,MAAM,IAAA,GAAO,OAAO,MAAM,CAAA;AAC1B,QAAA,MAAM,IAAA,GAAO,OAAO,MAAM,CAAA;AAC1B,QAAA,MAAM,cAAA,GAAiB,IAAA,GAAO,iBAAiB,CAAA,KAAM,IAAA;AACrD,QAAA,MAAM,cACJ,OAAO,IAAA,GAAO,cAAc,CAAA,KAAM,WAC9B,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,GAAA,EAAK,IAAA,CAAK,cAAc,CAAW,CAAC,CAAA,GACzD,GAAA;AAEN,QAAA,IAAI;AACF,UAAA,MAAM,eAAe,wBAAA,CAAyB,OAAA,CAAQ,GAAA,EAAK,OAAA,CAAQ,KAAK,CAAA;AACxE,UAAA,MAAM,UAAA,GAAa,6BAA6BA,KAAAA,EAAM;AAAA,YACpD,GAAA,EAAK,QAAQ,GAAA,EAAI;AAAA,YACjB;AAAA,WACD,CAAA;AAED,UAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM;AAAA,YACzB,UAAA;AAAA,YACA,IAAA;AAAA,YACA;AAAA,WACD,CAAA;AAED,UAAA,eAAA,GAAkB,MAAA;AAGlB,UAAA,MAAM,WAAsB,MAAA,CAAO,OAAA,CAAQ,QAAQ,CAAC,CAAA,KAAM,EAAE,QAAQ,CAAA;AACpE,UAAA,MAAM,SAAA,GAAY,SAAS,MAAA,GAAS,WAAA;AACpC,UAAA,MAAM,mBAAmB,SAAA,GAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,WAAW,CAAA,GAAI,QAAA;AACtE,UAAA,MAAM,SAAA,GAAY,qBAAA,CAAsB,MAAA,CAAO,OAAO,CAAA;AACtD,UAAA,MAAM,OAAA,GAAU;AAAA,YACd,YAAA,EAAc,OAAO,OAAA,CAAQ,KAAA;AAAA,YAC7B,MAAA,EAAQ,OAAO,OAAA,CAAQ,MAAA;AAAA,YACvB,MAAA,EAAQ,OAAO,OAAA,CAAQ,MAAA;AAAA,YACvB,gBAAgB,QAAA,CAAS,MAAA;AAAA,YACzB,WAAA,EAAa,OAAO,OAAA,CAAQ,UAAA;AAAA,YAC5B,SAAA;AAAA,YACA,YAAA,EAAc,WAAA;AAAA,YACd,eAAA,EAAiB;AAAA,cACf,OAAO,SAAA,CAAU,KAAA;AAAA,cACjB,OAAO,SAAA,CAAU,KAAA;AAAA,cACjB,OAAO,SAAA,CAAU,KAAA;AAAA,cACjB,QAAQ,SAAA,CAAU,MAAA;AAAA,cAClB,QAAQ,SAAA,CAAU,MAAA;AAAA,cAClB,OAAO,SAAA,CAAU;AAAA;AACnB,WACF;AAEA,UAAA,MAAM,iBAAA,GAAoB,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAA,MAAgB;AAAA,YAC9D,cAAc,CAAA,CAAE,WAAA;AAAA,YAChB,UAAU,CAAA,CAAE,QAAA;AAAA,YACZ,SAAS,CAAA,CAAE,OAAA;AAAA,YACX,QAAA,EAAU,oBAAA,CAAqB,CAAA,CAAE,QAAA,EAA8B,cAAc,CAAA;AAAA,YAC7E,gBAAgB,CAAA,CAAE,aAAA;AAAA,YAClB,gBAAgB,CAAA,CAAE,aAAA;AAAA,YAClB,mBAAA,EAAqB,gBAAA,CAAiB,CAAA,CAAE,WAAW;AAAA,WACrD,CAAE,CAAA;AAEF,UAAA,OAAO;AAAA,YACL,OAAA,EAAS;AAAA,cACP;AAAA,gBACE,IAAA,EAAM,MAAA;AAAA,gBACN,MAAM,IAAA,CAAK,SAAA;AAAA,kBACT;AAAA,oBACE,OAAA;AAAA,oBACA,QAAA,EAAU;AAAA,mBACZ;AAAA,kBACA,IAAA;AAAA,kBACA;AAAA;AACF;AACF;AACF,WACF;AAAA,QACF,SAAS,KAAA,EAAO;AACd,UAAA,OAAO;AAAA,YACL,OAAA,EAAS;AAAA,cACP;AAAA,gBACE,IAAA,EAAM,MAAA;AAAA,gBACN,IAAA,EAAM,kBAAkB,KAAK;AAAA;AAC/B,aACF;AAAA,YACA,OAAA,EAAS;AAAA,WACX;AAAA,QACF;AAAA,MACF;AAAA,MAEA,KAAK,eAAA,EAAiB;AACpB,QAAA,IAAI,CAAC,eAAA,EAAiB;AACpB,UAAA,OAAO;AAAA,YACL,OAAA,EAAS;AAAA,cACP;AAAA,gBACE,IAAA,EAAM,MAAA;AAAA,gBACN,IAAA,EAAM;AAAA;AACR;AACF,WACF;AAAA,QACF;AAEA,QAAA,MAAM,QAAA,GAAW,OAAO,UAAU,CAAA;AAClC,QAAA,MAAM,cAAA,GAAiB,IAAA,GAAO,iBAAiB,CAAA,KAAM,IAAA;AACrD,QAAA,MAAM,cACJ,OAAO,IAAA,GAAO,cAAc,CAAA,KAAM,WAC9B,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAI,GAAA,EAAK,IAAA,CAAK,cAAc,CAAW,CAAC,CAAA,GACzD,GAAA;AACN,QAAA,IAAI,WAAsB,eAAA,CAAgB,OAAA,CAAQ,QAAQ,CAAC,CAAA,KAAM,EAAE,QAAQ,CAAA;AAE3E,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA,QAAA,GAAW,SAAS,MAAA,CAAO,CAAC,CAAA,KAAe,CAAA,CAAE,aAAa,QAAQ,CAAA;AAAA,QACpE;AAEA,QAAA,MAAM,SAAA,GAAY,SAAS,MAAA,GAAS,WAAA;AACpC,QAAA,MAAM,mBAAmB,SAAA,GAAY,QAAA,CAAS,KAAA,CAAM,CAAA,EAAG,WAAW,CAAA,GAAI,QAAA;AAEtE,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,MAAM,IAAA,CAAK,SAAA;AAAA,gBACT;AAAA,kBACE,QAAA,EAAU,gBAAA,CAAiB,GAAA,CAAI,CAAC,CAAA,MAAgB;AAAA,oBAC9C,cAAc,CAAA,CAAE,WAAA;AAAA,oBAChB,UAAU,CAAA,CAAE,QAAA;AAAA,oBACZ,SAAS,CAAA,CAAE,OAAA;AAAA,oBACX,QAAA,EAAU,oBAAA,CAAqB,CAAA,CAAE,QAAA,EAA8B,cAAc;AAAA,mBAC/E,CAAE,CAAA;AAAA,kBACF,IAAA,EAAM;AAAA,oBACJ,OAAO,QAAA,CAAS,MAAA;AAAA,oBAChB,SAAA;AAAA,oBACA,YAAA,EAAc;AAAA;AAChB,iBACF;AAAA,gBACA,IAAA;AAAA,gBACA;AAAA;AACF;AACF;AACF,SACF;AAAA,MACF;AAAA,MAEA,KAAK,SAAA,EAAW;AACd,QAAA,MAAM,WAAA,GAAc,OAAO,cAAc,CAAA;AACzC,QAAA,MAAM,SAAA,GAAY,iBAAiB,WAAW,CAAA;AAE9C,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,OAAO;AAAA,YACL,OAAA,EAAS;AAAA,cACP;AAAA,gBACE,IAAA,EAAM,MAAA;AAAA,gBACN,IAAA,EAAM,oBAAoB,WAAW,CAAA,uDAAA;AAAA;AACvC;AACF,WACF;AAAA,QACF;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,MAAM,IAAA,CAAK,SAAA;AAAA,gBACT;AAAA,kBACE,IAAI,SAAA,CAAU,EAAA;AAAA,kBACd,MAAM,SAAA,CAAU,IAAA;AAAA,kBAChB,UAAU,SAAA,CAAU,QAAA;AAAA,kBACpB,UAAU,SAAA,CAAU,QAAA;AAAA,kBACpB,aAAa,SAAA,CAAU,WAAA;AAAA,kBACvB,gBAAgB,SAAA,CAAU,aAAA;AAAA,kBAC1B,mBAAA,EAAqB,gBAAA,CAAiB,SAAA,CAAU,EAAE;AAAA,iBACpD;AAAA,gBACA,IAAA;AAAA,gBACA;AAAA;AACF;AACF;AACF,SACF;AAAA,MACF;AAAA,MAEA,KAAK,iBAAA,EAAmB;AACtB,QAAA,MAAM,QAAA,GAAW,OAAO,UAAU,CAAA;AAClC,QAAA,MAAM,QAAA,GAAW,OAAO,UAAU,CAAA;AAElC,QAAA,IAAI,UAAA,GAAa,cAAA;AAEjB,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA,UAAA,GAAa,WAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,QAAQ,CAAA;AAAA,QAC/D;AACA,QAAA,IAAI,QAAA,EAAU;AACZ,UAAA,UAAA,GAAa,WAAW,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,QAAQ,CAAA;AAAA,QAC/D;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,MAAM,IAAA,CAAK,SAAA;AAAA,gBACT,UAAA,CAAW,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,kBACrB,IAAI,CAAA,CAAE,EAAA;AAAA,kBACN,MAAM,CAAA,CAAE,IAAA;AAAA,kBACR,UAAU,CAAA,CAAE,QAAA;AAAA,kBACZ,UAAU,CAAA,CAAE;AAAA,iBACd,CAAE,CAAA;AAAA,gBACF,IAAA;AAAA,gBACA;AAAA;AACF;AACF;AACF,SACF;AAAA,MACF;AAAA,MAEA,KAAK,eAAA,EAAiB;AACpB,QAAA,MAAM,WAAA,GAAc,OAAO,cAAc,CAAA;AACzC,QAAA,MAAM,SAAA,GAAa,IAAA,GAAO,WAAW,CAAA,IAAgB,QAAA;AACrD,QAAA,MAAM,OAAA,GAAU,OAAO,SAAS,CAAA;AAEhC,QAAA,MAAM,SAAA,GAAY,iBAAiB,WAAW,CAAA;AAC9C,QAAA,IAAI,CAAC,SAAA,EAAW;AACd,UAAA,OAAO;AAAA,YACL,OAAA,EAAS;AAAA,cACP;AAAA,gBACE,IAAA,EAAM,MAAA;AAAA,gBACN,IAAA,EAAM,sBAAsB,WAAW,CAAA;AAAA;AACzC;AACF,WACF;AAAA,QACF;AAEA,QAAA,MAAM,IAAA,GAAO,oBAAA,CAAqB,SAAA,EAAW,SAAA,EAAW,OAAO,CAAA;AAE/D,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,IAAA,EAAM;AAAA;AACR;AACF,SACF;AAAA,MACF;AAAA,MAEA,KAAK,UAAA,EAAY;AACf,QAAA,OAAO,mBAAmB,IAA2C,CAAA;AAAA,MACvE;AAAA;AACF,EACA;AACF,CAAA;AAEA,SAAS,kBAAkB,IAAA,EAAiC;AAC1D,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,UAAA,EAAY,EAAE,CAAA;AAC1C,EAAA,MAAM,OAAA,uBAAc,GAAA,CAAgB;AAAA,IAClC,KAAA;AAAA,IACA,eAAA;AAAA,IACA,SAAA;AAAA,IACA,iBAAA;AAAA,IACA,eAAA;AAAA,IACA;AAAA,GACD,CAAA;AACD,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,MAAM,CAAA,GAAI,MAAA,GAAS,IAAA;AACxC;AAEA,SAAS,kBAAkB,KAAA,EAAwB;AACjD,EAAA,MAAM,UAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAErE,EAAA,IAAI,qEAAA,CAAsE,IAAA,CAAK,OAAO,CAAA,EAAG;AACvF,IAAA,OAAO;AAAA,MACL,+EAAA;AAAA,MACA,EAAA;AAAA,MACA,MAAA;AAAA,MACA,kEAAA;AAAA,MACA,kFAAA;AAAA,MACA,EAAA;AAAA,MACA,wBAAA;AAAA,MACA,GAAA;AAAA,MACA,mBAAA;AAAA,MACA,iBAAA;AAAA,MACA,gCAAA;AAAA,MACA,kDAAA;AAAA,MACA,OAAA;AAAA,MACA,KAAA;AAAA,MACA;AAAA,KACF,CAAE,KAAK,IAAI,CAAA;AAAA,EACb;AAEA,EAAA,OAAO,wBAAwB,OAAO,CAAA,CAAA;AACxC;AAGA,eAAe,IAAA,GAAO;AACpB,EAAA,MAAM,SAAA,GAAY,IAAI,oBAAA,EAAqB;AAC3C,EAAA,MAAM,MAAA,CAAO,QAAQ,SAAS,CAAA;AAC9B,EAAA,OAAA,CAAQ,MAAM,qDAAqD,CAAA;AACrE;AAEA,IAAA,EAAK,CAAE,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA","file":"index.js","sourcesContent":["import path from 'node:path';\nimport fs from 'node:fs';\nimport { execSync } from 'node:child_process';\n\nexport type McpSafetyOptions = {\n  cwd: string;\n  allowedRoots: string[];\n};\n\nexport function parseAllowedRootsFromEnv(\n  env: Record<string, string | undefined>,\n  cwd: string\n): string[] {\n  const raw =\n    env['SCHECK_MCP_ALLOWED_ROOTS'] ??\n    env['MCP_ALLOWED_ROOTS'] ??\n    env['SCHECK_ALLOWED_ROOTS'];\n\n  const roots = (raw ?? '')\n    .split(',')\n    .map((s) => s.trim())\n    .filter(Boolean)\n    .map((p) => path.resolve(cwd, p));\n\n  if (roots.length > 0) return roots;\n\n  const gitRoot = getGitRoot(cwd);\n  if (gitRoot) return [gitRoot];\n\n  throw new Error(\n    'Refusing to scan because no allowed roots are configured and no git repository was detected. ' +\n      'Run scheck-mcp from inside a git repo, or set SCHECK_MCP_ALLOWED_ROOTS (or MCP_ALLOWED_ROOTS).'\n  );\n}\n\nfunction getGitRoot(cwd: string): string | null {\n  try {\n    const out = execSync('git rev-parse --show-toplevel', {\n      cwd,\n      stdio: ['ignore', 'pipe', 'ignore'],\n      encoding: 'utf-8',\n    }).trim();\n    return out.length > 0 ? out : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction isWithinRoot(candidatePath: string, root: string): boolean {\n  const relative = path.relative(root, candidatePath);\n  // `path.relative()` returns '' when equal. Equality should be allowed.\n  return relative === '' || (!relative.startsWith('..') && !path.isAbsolute(relative));\n}\n\nexport function resolveAndValidateTargetPath(\n  requestedPath: string | undefined,\n  options: McpSafetyOptions\n): string {\n  const { cwd, allowedRoots } = options;\n  const input = (requestedPath && requestedPath.trim().length > 0)\n    ? requestedPath\n    : cwd;\n\n  const resolved = path.resolve(cwd, input);\n\n  if (!fs.existsSync(resolved)) {\n    throw new Error(`Target path does not exist: ${resolved}`);\n  }\n\n  // Fail closed on symlink escapes: validate based on real paths, not just `path.resolve`.\n  const realResolved = fs.realpathSync(resolved);\n  const realAllowedRoots = allowedRoots.map((r) => fs.realpathSync(path.resolve(cwd, r)));\n\n  const allowed = realAllowedRoots.some((root) => isWithinRoot(realResolved, root));\n\n  if (!allowed) {\n    const rootsList = realAllowedRoots.join(', ');\n    throw new Error(\n      `Refusing to scan outside allowed roots. Requested: ${realResolved}. Allowed roots: ${rootsList}. ` +\n        `Set SCHECK_MCP_ALLOWED_ROOTS (or MCP_ALLOWED_ROOTS) to override.`\n    );\n  }\n\n  return realResolved;\n}\n\nexport type EvidenceForMcp = { file: string; line: number; context?: string };\n\nexport function formatEvidenceForMcp(\n  evidence: EvidenceForMcp[],\n  includeContext: boolean\n): EvidenceForMcp[] {\n  if (includeContext) return evidence;\n  return evidence.map(({ file, line }) => ({ file, line }));\n}\n","export type FeedbackVerdict = 'true_positive' | 'false_positive';\n\nexport interface FeedbackToolArgs {\n  invariant_id?: string;\n  verdict?: string;\n  reason?: string;\n}\n\nexport interface FeedbackToolResponse {\n  content: Array<{ type: 'text'; text: string }>;\n  isError?: boolean;\n}\n\n// Keep tool responses aligned with the MCP SDK result types.\n// (Our response object is a valid CallToolResult / CompatibilityCallToolResult.)\nexport type McpToolResult = import('@modelcontextprotocol/sdk/types.js').CompatibilityCallToolResult;\n\nexport async function handleFeedbackTool(\n  args: FeedbackToolArgs | undefined,\n  options?: {\n    cwd?: string;\n    now?: () => Date;\n    fetchFn?: typeof fetch;\n  }\n): Promise<McpToolResult> {\n  const invariantId = args?.invariant_id;\n  const verdict = args?.verdict as FeedbackVerdict | undefined;\n  const reason = args?.reason;\n\n  if (!invariantId || !verdict) {\n    return {\n      content: [\n        {\n          type: 'text',\n          text: 'Error: invariant_id and verdict are required.',\n        },\n      ],\n      isError: true,\n    };\n  }\n\n  if (!['true_positive', 'false_positive'].includes(verdict)) {\n    return {\n      content: [\n        {\n          type: 'text',\n          text: `Error: verdict must be \"true_positive\" or \"false_positive\", got \"${verdict}\"`,\n        },\n      ],\n      isError: true,\n    };\n  }\n\n  try {\n    const { writeFileSync, readFileSync, existsSync, mkdirSync, lstatSync } = await import('fs');\n    const { join } = await import('path');\n    const cwd = options?.cwd ?? process.cwd();\n    const feedbackDir = join(cwd, '.scheck');\n    const feedbackFile = join(feedbackDir, 'feedback.json');\n    const now = options?.now ?? (() => new Date());\n\n    if (!existsSync(feedbackDir)) {\n      mkdirSync(feedbackDir, { recursive: true });\n    } else {\n      const st = lstatSync(feedbackDir);\n      // Avoid writing through malicious symlinks (e.g., repo-controlled `.scheck` -> /etc).\n      if (st.isSymbolicLink()) {\n        throw new Error('Refusing to write feedback: .scheck is a symlink');\n      }\n      if (!st.isDirectory()) {\n        throw new Error('Refusing to write feedback: .scheck is not a directory');\n      }\n    }\n\n    if (existsSync(feedbackFile)) {\n      const st = lstatSync(feedbackFile);\n      if (st.isSymbolicLink()) {\n        throw new Error('Refusing to write feedback: feedback.json is a symlink');\n      }\n      if (!st.isFile()) {\n        throw new Error('Refusing to write feedback: feedback.json is not a file');\n      }\n    }\n\n    let feedbackData: Array<{\n      invariantId: string;\n      verdict: string;\n      reason?: string;\n      timestamp: string;\n    }> = [];\n    if (existsSync(feedbackFile)) {\n      try {\n        feedbackData = JSON.parse(readFileSync(feedbackFile, 'utf-8'));\n      } catch {\n        feedbackData = [];\n      }\n    }\n\n    feedbackData.push({\n      invariantId,\n      verdict,\n      reason,\n      timestamp: now().toISOString(),\n    });\n\n    writeFileSync(feedbackFile, JSON.stringify(feedbackData, null, 2));\n\n    try {\n      const clientVersion = process.env['MCP_VERSION'] ?? '0.0.0-dev';\n      const endpoint = 'https://api.securitychecks.ai/v1/feedback';\n      const controller = new AbortController();\n      const timeoutId = setTimeout(() => controller.abort(), 3000);\n      const fetchFn = options?.fetchFn ?? (typeof fetch === 'function' ? fetch : undefined);\n      if (fetchFn) {\n        fetchFn(endpoint, {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({ invariantId, verdict, reason, clientVersion }),\n          signal: controller.signal,\n        })\n          .catch(() => {})\n          .finally(() => clearTimeout(timeoutId));\n      } else {\n        clearTimeout(timeoutId);\n      }\n    } catch {\n      // Silent failure for API reporting\n    }\n\n    return {\n      content: [\n        {\n          type: 'text',\n          text: JSON.stringify(\n            {\n              recorded: true,\n              invariantId,\n              verdict,\n              reason: reason ?? null,\n              storedLocally: true,\n            },\n            null,\n            2\n          ),\n        },\n      ],\n    };\n  } catch (error) {\n    return {\n      content: [\n        {\n          type: 'text',\n          text: `Error recording feedback: ${error instanceof Error ? error.message : String(error)}`,\n        },\n      ],\n      isError: true,\n    };\n  }\n}\n","#!/usr/bin/env node\n\n/**\n * SecurityChecks MCP Server (scheck)\n *\n * Catch what Copilot misses — production-ready code review.\n * MCP server that exposes scheck tools for LLM integration.\n */\n\nimport { Server } from '@modelcontextprotocol/sdk/server/index.js';\nimport { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';\nimport {\n  CallToolRequestSchema,\n  ListToolsRequestSchema,\n} from '@modelcontextprotocol/sdk/types.js';\nimport type { CompatibilityCallToolResult, CreateTaskResult } from '@modelcontextprotocol/sdk/types.js';\nimport {\n  getInvariantById,\n  ALL_INVARIANTS,\n  type AuditResult,\n  type Finding,\n} from '@securitychecks/collector';\nimport { audit, computeReadinessScore } from '@securitychecks/cli';\nimport {\n  formatEvidenceForMcp,\n  parseAllowedRootsFromEnv,\n  resolveAndValidateTargetPath,\n  type EvidenceForMcp,\n} from './safety.js';\nimport { generateTestSkeleton, getStaffQuestion } from '@securitychecks/cli';\nimport { handleFeedbackTool } from './feedback.js';\n\n// Version injected at build time via tsup define\nconst version = process.env['MCP_VERSION'] ?? '0.0.0-dev';\n\nconst server = new Server(\n  {\n    name: 'scheck',\n    version: version,\n  },\n  {\n    capabilities: {\n      tools: {},\n    },\n  }\n);\n\nconst TOOL_PREFIXES = ['scheck'] as const;\ntype ToolSuffix = 'run' | 'list_findings' | 'explain' | 'list_invariants' | 'generate_test' | 'feedback';\ntype ToolDef = {\n  suffix: ToolSuffix;\n  description: string;\n  inputSchema: unknown;\n};\n\nconst TOOL_DEFS: ToolDef[] = [\n  {\n    suffix: 'run',\n    description:\n      'Run scheck — the patterns a senior engineer would flag in review. ' +\n      'Catches webhook idempotency, auth at service layer, transaction safety, and more.',\n    inputSchema: {\n      type: 'object',\n      properties: {\n        path: {\n          type: 'string',\n          description: 'Target path to audit (default: current directory)',\n        },\n        include_context: {\n          type: 'boolean',\n          description:\n            'Include code context snippets in results (may expose source code to the assistant).',\n        },\n        max_findings: {\n          type: 'integer',\n          minimum: 1,\n          maximum: 500,\n          description: 'Limit number of findings returned (default: 200)',\n        },\n        only: {\n          type: 'array',\n          items: { type: 'string' },\n          description: 'Only run specific invariant checks by ID',\n        },\n        skip: {\n          type: 'array',\n          items: { type: 'string' },\n          description: 'Skip specific invariant checks by ID',\n        },\n      },\n    },\n  },\n  {\n    suffix: 'list_findings',\n    description:\n      'List issues a staff engineer would flag — current findings from the last run, by severity.',\n    inputSchema: {\n      type: 'object',\n      properties: {\n        severity: {\n          type: 'string',\n          enum: ['P0', 'P1', 'P2'],\n          description: 'Filter findings by severity',\n        },\n        include_context: {\n          type: 'boolean',\n          description:\n            'Include code context snippets in results (may expose source code to the assistant).',\n        },\n        max_findings: {\n          type: 'integer',\n          minimum: 1,\n          maximum: 500,\n          description: 'Limit number of findings returned (default: 200)',\n        },\n      },\n    },\n  },\n  {\n    suffix: 'explain',\n    description:\n      'What a staff engineer checks: explain why a pattern matters, real incidents it prevents, and proof needed.',\n    inputSchema: {\n      type: 'object',\n      properties: {\n        invariant_id: {\n          type: 'string',\n          description: 'The invariant ID to explain (e.g., AUTHZ.SERVICE_LAYER.ENFORCED)',\n        },\n      },\n      required: ['invariant_id'],\n    },\n  },\n  {\n    suffix: 'list_invariants',\n    description:\n      'List all patterns a staff engineer checks for — the patterns that prevent production incidents.',\n    inputSchema: {\n      type: 'object',\n      properties: {\n        category: {\n          type: 'string',\n          description: 'Filter by category (authz, revocation, webhooks, transactions, etc.)',\n        },\n        severity: {\n          type: 'string',\n          enum: ['P0', 'P1', 'P2'],\n          description: 'Filter by severity',\n        },\n      },\n    },\n  },\n  {\n    suffix: 'generate_test',\n    description:\n      'Generate test code that proves a pattern is enforced — the proof a staff engineer would ask for.',\n    inputSchema: {\n      type: 'object',\n      properties: {\n        invariant_id: {\n          type: 'string',\n          description: 'The invariant ID to generate a test for',\n        },\n        framework: {\n          type: 'string',\n          enum: ['jest', 'vitest', 'playwright'],\n          description: 'Test framework to generate code for (default: vitest)',\n        },\n        context: {\n          type: 'string',\n          description:\n            'Additional context about the specific violation to generate a more targeted test',\n        },\n      },\n      required: ['invariant_id'],\n    },\n  },\n  {\n    suffix: 'feedback',\n    description:\n      'Report whether a finding was a true positive or false positive to improve accuracy.',\n    inputSchema: {\n      type: 'object',\n      properties: {\n        invariant_id: {\n          type: 'string',\n          description: 'Invariant ID (e.g., AUTHZ.SERVICE_LAYER.ENFORCED)',\n        },\n        verdict: {\n          type: 'string',\n          enum: ['true_positive', 'false_positive'],\n          description: 'Whether the finding was a true positive or false positive',\n        },\n        reason: {\n          type: 'string',\n          enum: [\n            'not_applicable',\n            'acceptable_risk',\n            'wrong_location',\n            'outdated_pattern',\n            'missing_context',\n          ],\n          description: 'Reason for the verdict',\n        },\n      },\n      required: ['invariant_id', 'verdict'],\n    },\n  },\n];\n\n// List available tools\nserver.setRequestHandler(ListToolsRequestSchema, async () => {\n  return {\n    tools: TOOL_PREFIXES.flatMap((prefix) =>\n      TOOL_DEFS.map((def) => ({\n        name: `${prefix}_${def.suffix}`,\n        description: def.description,\n        inputSchema: def.inputSchema,\n      }))\n    ),\n  };\n});\n\n// Track last audit result for list_findings\nlet lastAuditResult: AuditResult | null = null;\n\n// Handle tool calls\nserver.setRequestHandler(\n  CallToolRequestSchema,\n  async (request): Promise<CompatibilityCallToolResult | CreateTaskResult> => {\n  const { name, arguments: args } = request.params;\n  const tool = normalizeToolName(name);\n  if (!tool) {\n    return {\n      content: [{ type: 'text', text: `Unknown tool: ${name}` }],\n      isError: true,\n    };\n  }\n\n  switch (tool) {\n    case 'run': {\n      const path = (args?.['path'] as string) || process.cwd();\n      const only = args?.['only'] as string[] | undefined;\n      const skip = args?.['skip'] as string[] | undefined;\n      const includeContext = args?.['include_context'] === true;\n      const maxFindings =\n        typeof args?.['max_findings'] === 'number'\n          ? Math.max(1, Math.min(500, args['max_findings'] as number))\n          : 200;\n\n      try {\n        const allowedRoots = parseAllowedRootsFromEnv(process.env, process.cwd());\n        const targetPath = resolveAndValidateTargetPath(path, {\n          cwd: process.cwd(),\n          allowedRoots,\n        });\n\n        const result = await audit({\n          targetPath,\n          only,\n          skip,\n        });\n\n        lastAuditResult = result;\n\n        // Format findings for LLM consumption\n        const findings: Finding[] = result.results.flatMap((r) => r.findings);\n        const truncated = findings.length > maxFindings;\n        const findingsToReturn = truncated ? findings.slice(0, maxFindings) : findings;\n        const readiness = computeReadinessScore(result.summary);\n        const summary = {\n          total_checks: result.summary.total,\n          passed: result.summary.passed,\n          failed: result.summary.failed,\n          findings_count: findings.length,\n          by_severity: result.summary.byPriority,\n          truncated,\n          max_findings: maxFindings,\n          readiness_score: {\n            score: readiness.score,\n            grade: readiness.grade,\n            total: readiness.total,\n            passed: readiness.passed,\n            failed: readiness.failed,\n            hasP0: readiness.hasP0,\n          },\n        };\n\n        const formattedFindings = findingsToReturn.map((f: Finding) => ({\n          invariant_id: f.invariantId,\n          severity: f.severity,\n          message: f.message,\n          evidence: formatEvidenceForMcp(f.evidence as EvidenceForMcp[], includeContext),\n          required_proof: f.requiredProof,\n          suggested_test: f.suggestedTest,\n          staff_engineer_asks: getStaffQuestion(f.invariantId),\n        }));\n\n        return {\n          content: [\n            {\n              type: 'text',\n              text: JSON.stringify(\n                {\n                  summary,\n                  findings: formattedFindings,\n                },\n                null,\n                2\n              ),\n            },\n          ],\n        };\n      } catch (error) {\n        return {\n          content: [\n            {\n              type: 'text',\n              text: formatMcpRunError(error),\n            },\n          ],\n          isError: true,\n        };\n      }\n    }\n\n    case 'list_findings': {\n      if (!lastAuditResult) {\n        return {\n          content: [\n            {\n              type: 'text',\n              text: 'No scan has been run yet. Use scheck_run first.',\n            },\n          ],\n        };\n      }\n\n      const severity = args?.['severity'] as string | undefined;\n      const includeContext = args?.['include_context'] === true;\n      const maxFindings =\n        typeof args?.['max_findings'] === 'number'\n          ? Math.max(1, Math.min(500, args['max_findings'] as number))\n          : 200;\n      let findings: Finding[] = lastAuditResult.results.flatMap((r) => r.findings);\n\n      if (severity) {\n        findings = findings.filter((f: Finding) => f.severity === severity);\n      }\n\n      const truncated = findings.length > maxFindings;\n      const findingsToReturn = truncated ? findings.slice(0, maxFindings) : findings;\n\n      return {\n        content: [\n          {\n            type: 'text',\n            text: JSON.stringify(\n              {\n                findings: findingsToReturn.map((f: Finding) => ({\n                  invariant_id: f.invariantId,\n                  severity: f.severity,\n                  message: f.message,\n                  evidence: formatEvidenceForMcp(f.evidence as EvidenceForMcp[], includeContext),\n                })),\n                meta: {\n                  total: findings.length,\n                  truncated,\n                  max_findings: maxFindings,\n                },\n              },\n              null,\n              2\n            ),\n          },\n        ],\n      };\n    }\n\n    case 'explain': {\n      const invariantId = args?.['invariant_id'] as string;\n      const invariant = getInvariantById(invariantId);\n\n      if (!invariant) {\n        return {\n          content: [\n            {\n              type: 'text',\n              text: `Unknown pattern: ${invariantId}. Use scheck_list_invariants to see available patterns.`,\n            },\n          ],\n        };\n      }\n\n      return {\n        content: [\n          {\n            type: 'text',\n            text: JSON.stringify(\n              {\n                id: invariant.id,\n                name: invariant.name,\n                severity: invariant.severity,\n                category: invariant.category,\n                description: invariant.description,\n                required_proof: invariant.requiredProof,\n                staff_engineer_asks: getStaffQuestion(invariant.id),\n              },\n              null,\n              2\n            ),\n          },\n        ],\n      };\n    }\n\n    case 'list_invariants': {\n      const category = args?.['category'] as string | undefined;\n      const severity = args?.['severity'] as string | undefined;\n\n      let invariants = ALL_INVARIANTS;\n\n      if (category) {\n        invariants = invariants.filter((i) => i.category === category);\n      }\n      if (severity) {\n        invariants = invariants.filter((i) => i.severity === severity);\n      }\n\n      return {\n        content: [\n          {\n            type: 'text',\n            text: JSON.stringify(\n              invariants.map((i) => ({\n                id: i.id,\n                name: i.name,\n                severity: i.severity,\n                category: i.category,\n              })),\n              null,\n              2\n            ),\n          },\n        ],\n      };\n    }\n\n    case 'generate_test': {\n      const invariantId = args?.['invariant_id'] as string;\n      const framework = (args?.['framework'] as string) || 'vitest';\n      const context = args?.['context'] as string | undefined;\n\n      const invariant = getInvariantById(invariantId);\n      if (!invariant) {\n        return {\n          content: [\n            {\n              type: 'text',\n              text: `Unknown invariant: ${invariantId}`,\n            },\n          ],\n        };\n      }\n\n      const test = generateTestSkeleton(invariant, framework, context);\n\n      return {\n        content: [\n          {\n            type: 'text',\n            text: test,\n          },\n        ],\n      };\n    }\n\n    case 'feedback': {\n      return handleFeedbackTool(args as Record<string, unknown> | undefined);\n    }\n  }\n  }\n);\n\nfunction normalizeToolName(name: string): ToolSuffix | null {\n  const suffix = name.replace(/^scheck_/, '') as ToolSuffix;\n  const allowed = new Set<ToolSuffix>([\n    'run',\n    'list_findings',\n    'explain',\n    'list_invariants',\n    'generate_test',\n    'feedback',\n  ]);\n  return allowed.has(suffix) ? suffix : null;\n}\n\nfunction formatMcpRunError(error: unknown): string {\n  const message = error instanceof Error ? error.message : String(error);\n\n  if (/no allowed roots are configured and no git repository was detected/i.test(message)) {\n    return [\n      'Refusing to scan: no git repository detected and no allowed roots configured.',\n      '',\n      'Fix:',\n      '- Start the MCP server from inside the repo you want to scan, or',\n      '- Set SCHECK_MCP_ALLOWED_ROOTS (or MCP_ALLOWED_ROOTS) in your MCP server config.',\n      '',\n      'Example (Claude Code):',\n      '{',\n      '  \"mcpServers\": {',\n      '    \"scheck\": {',\n      '      \"command\": \"scheck-mcp\",',\n      '      \"env\": { \"SCHECK_MCP_ALLOWED_ROOTS\": \".\" }',\n      '    }',\n      '  }',\n      '}',\n    ].join('\\n');\n  }\n\n  return `Error running audit: ${message}`;\n}\n\n// Start the server\nasync function main() {\n  const transport = new StdioServerTransport();\n  await server.connect(transport);\n  console.error('SecurityChecks MCP server (scheck) running on stdio');\n}\n\nmain().catch(console.error);\n"]}

package/package.json

@@ -1,14 +1,14 @@
 {
   "name": "@securitychecks/mcp",
-  "version": "0.1.1",
+  "version": "0.2.2",
   "description": "MCP server for SecurityChecks - expose scheck tools to AI assistants",
   "type": "module",
-  "license": "SEE LICENSE IN LICENSE",
+  "license": "Apache-2.0",
   "author": "SecurityChecks <hello@securitychecks.ai>",
   "homepage": "https://securitychecks.ai",
   "repository": {
     "type": "git",
-    "url": "https://github.com/securitychecks/securitychecks.ai"
+    "url": "https://github.com/securitychecks/securitychecks"
   },
   "keywords": [
     "scheck",
@@ -28,12 +28,13 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "LICENSE"
   ],
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.26.0",
-    "@securitychecks/cli": "0.1.1",
-    "@securitychecks/collector": "0.1.1"
+    "@securitychecks/cli": "0.2.2",
+    "@securitychecks/collector": "0.2.2"
   },
   "devDependencies": {
     "@types/node": "^25.1.0",