@sulthonzh/mcp-audit 1.1.0

package/dist/scanners/config-scanner.js

@@ -0,0 +1,399 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanConfig = scanConfig;
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const path_1 = __importDefault(require("path"));
+const js_yaml_1 = __importDefault(require("js-yaml"));
+const logger_1 = require("../utils/logger");
+const STANDARD_CONFIG_PATHS = [
+    'claude_desktop_config.json',
+    '.cursor/mcp.json',
+    '.vscode/mcp.json',
+    'mcp.json',
+    '~/.config/claude/claude_desktop_config.json',
+    '~/.cursor/mcp.json',
+];
+// Known dangerous argument patterns
+const DANGEROUS_ARGS = [
+    { pattern: /--allow-all/i, title: 'Allow-All Flag', severity: 'high' },
+    { pattern: /--no-sandbox/i, title: 'Sandbox Disabled', severity: 'high' },
+    { pattern: /--privileged/i, title: 'Privileged Mode', severity: 'high' },
+    { pattern: /eval/i, title: 'Code Evaluation', severity: 'high' },
+    { pattern: /exec/i, title: 'Code Execution', severity: 'medium' },
+    { pattern: /\$\(/i, title: 'Command Substitution', severity: 'high' },
+    { pattern: /\|\|/i, title: 'Shell Pipe Chain', severity: 'medium' },
+    { pattern: /&&/i, title: 'Shell Command Chain', severity: 'medium' },
+    { pattern: /\.\.\/\.\.\//i, title: 'Path Traversal', severity: 'high' },
+];
+// Known safe MCP server packages
+const KNOWN_SAFE_PACKAGES = new Set([
+    '@modelcontextprotocol/server-filesystem',
+    '@modelcontextprotocol/server-github',
+    '@modelcontextprotocol/server-postgres',
+    '@modelcontextprotocol/server-brave-search',
+    '@modelcontextprotocol/server-puppeteer',
+    '@modelcontextprotocol/server-memory',
+    '@modelcontextprotocol/server-fetch',
+]);
+async function scanConfig(config, verbose = false) {
+    logger_1.logger.info('Starting MCP configuration scan...');
+    const result = {
+        configFiles: [],
+        issues: [],
+        permissions: {
+            fileAccess: [],
+            networkAccess: false,
+            environmentVariables: {},
+        },
+        score: 100,
+    };
+    // Find and analyze MCP config files
+    for (const configPath of STANDARD_CONFIG_PATHS) {
+        const fullPath = expandPath(configPath);
+        if (fs_extra_1.default.existsSync(fullPath)) {
+            result.configFiles.push(fullPath);
+            await analyzeConfigFile(fullPath, result);
+        }
+    }
+    // Calculate security score
+    calculateSecurityScore(result);
+    const securityResult = {
+        scanType: 'config',
+        timestamp: new Date().toISOString(),
+        target: 'local configuration',
+        issues: result.issues,
+        score: result.score,
+        summary: {
+            configFilesFound: result.configFiles.length,
+            highRiskIssues: result.issues.filter((i) => i.type === 'high').length,
+            mediumRiskIssues: result.issues.filter((i) => i.type === 'medium').length,
+            lowRiskIssues: result.issues.filter((i) => i.type === 'low').length,
+        },
+    };
+    if (verbose) {
+        logger_1.logger.debug('Detailed scan results:', result);
+    }
+    return securityResult;
+}
+async function analyzeConfigFile(configPath, result) {
+    try {
+        const content = await fs_extra_1.default.readFile(configPath, 'utf8');
+        let config;
+        if (configPath.endsWith('.json')) {
+            config = JSON.parse(content);
+        }
+        else if (configPath.endsWith('.yaml') || configPath.endsWith('.yml')) {
+            config = js_yaml_1.default.load(content);
+        }
+        else {
+            logger_1.logger.warn(`Unsupported config file format: ${configPath}`);
+            return;
+        }
+        analyzeServers(config, result, configPath);
+        // Check file permissions
+        checkFilePermissions(configPath, result);
+    }
+    catch (error) {
+        logger_1.logger.error(`Error analyzing config file ${configPath}:`, error);
+        result.issues.push({
+            type: 'high',
+            category: 'config',
+            title: 'Invalid Configuration',
+            description: `Could not parse MCP configuration file: ${configPath}`,
+            recommendation: 'Check file syntax and ensure it contains valid JSON/YAML',
+            evidence: error instanceof Error ? error.message : String(error),
+        });
+    }
+}
+function analyzeServers(config, result, configPath) {
+    const servers = config.servers || config.mcpServers || [];
+    if (!Array.isArray(servers) && typeof servers === 'object') {
+        Object.entries(servers).forEach(([name, server]) => {
+            analyzeServer(server, result, configPath, name);
+        });
+    }
+    else if (Array.isArray(servers)) {
+        servers.forEach((server, i) => {
+            analyzeServer(server, result, configPath, `server-${i}`);
+        });
+    }
+}
+function analyzeServer(server, result, configPath, name) {
+    const command = server.command || '';
+    const args = server.args || [];
+    const fullCommand = `${command} ${args.join(' ')}`;
+    // Check if this is a known safe package
+    const isKnownSafe = KNOWN_SAFE_PACKAGES.has(command) || args.some((a) => KNOWN_SAFE_PACKAGES.has(a));
+    // === Runtime Interpreter Detection ===
+    if (command.includes('npx') || command.includes('node')) {
+        result.issues.push({
+            type: isKnownSafe ? 'low' : 'high',
+            category: 'permissions',
+            title: isKnownSafe ? 'Standard Node.js MCP Server' : 'Unverified Node.js Server',
+            description: isKnownSafe
+                ? `Server "${name}" uses a known official MCP package: ${command}`
+                : `Server "${name}" runs via ${command} — any npm package can execute arbitrary code`,
+            recommendation: isKnownSafe
+                ? 'This is a known safe package, but still review the version'
+                : 'Verify the package source, check npm page, review recent versions for supply-chain attacks',
+            evidence: `Command: ${command}, Args: ${JSON.stringify(args)}`,
+        });
+        result.score -= isKnownSafe ? 2 : 20;
+    }
+    if (command.includes('python') || command.includes('uvx') || command.includes('pip')) {
+        result.issues.push({
+            type: isKnownSafe ? 'low' : 'high',
+            category: 'permissions',
+            title: isKnownSafe ? 'Standard Python MCP Server' : 'Unverified Python Server',
+            description: `Server "${name}" runs via ${command} — can execute arbitrary Python code`,
+            recommendation: 'Verify the package is from a trusted source and pin the version',
+            evidence: `Command: ${command}, Args: ${JSON.stringify(args)}`,
+        });
+        result.score -= isKnownSafe ? 2 : 20;
+    }
+    if (command.includes('bash') || command.includes('sh') || command.includes('zsh')) {
+        result.issues.push({
+            type: 'high',
+            category: 'injection',
+            title: 'Shell Command Execution',
+            description: `Server "${name}" directly executes shell commands — highest risk for command injection`,
+            recommendation: 'Avoid shell-based MCP servers. If needed, use with strict sandboxing',
+            evidence: `Command: ${command}, Args: ${JSON.stringify(args)}`,
+        });
+        result.score -= 30;
+    }
+    // === Dangerous Argument Patterns ===
+    for (const dangerous of DANGEROUS_ARGS) {
+        if (dangerous.pattern.test(fullCommand)) {
+            result.issues.push({
+                type: dangerous.severity,
+                category: 'injection',
+                title: dangerous.title,
+                description: `Server "${name}" has dangerous argument matching "${dangerous.pattern}"`,
+                recommendation: 'Review if this flag is necessary and what it exposes',
+                evidence: `Full command: ${fullCommand}`,
+            });
+            result.score -= dangerous.severity === 'high' ? 25 : 15;
+        }
+    }
+    // === Environment Variable Secrets ===
+    if (server.env && Object.keys(server.env).length > 0) {
+        for (const [key, value] of Object.entries(server.env)) {
+            result.permissions.environmentVariables[key] = value;
+            const sensitivePatterns = ['SECRET', 'KEY', 'PASSWORD', 'TOKEN', 'API_KEY', 'PRIVATE', 'CREDENTIAL'];
+            if (sensitivePatterns.some((p) => key.toUpperCase().includes(p))) {
+                const isPlaintext = typeof value === 'string' && value.length > 0 && !value.startsWith('$(');
+                result.issues.push({
+                    type: isPlaintext ? 'high' : 'medium',
+                    category: 'config',
+                    title: isPlaintext ? 'Plaintext Secret in Config' : 'Secret Reference in Config',
+                    description: isPlaintext
+                        ? `Server "${name}" has a plaintext secret in ${key} — this file may be readable by other processes`
+                        : `Server "${name}" references a secret via ${key}`,
+                    recommendation: isPlaintext
+                        ? 'Use system keychain, vault, or at minimum ensure config file has restricted permissions (chmod 600)'
+                        : 'Good practice referencing secrets, ensure the resolver is secure',
+                    evidence: `Variable: ${key}=${isPlaintext ? '[REDACTED]' : value}`,
+                });
+                result.score -= isPlaintext ? 25 : 5;
+            }
+        }
+    }
+    // === Filesystem Access Patterns ===
+    const fsPatterns = ['/home', '/etc', '/var', '/root', '/Users', '~/', '/tmp'];
+    const rootPatterns = ['/', '*', '.'];
+    const hasFsArgs = args.some((arg) => {
+        const argStr = String(arg);
+        if (fsPatterns.some((p) => argStr.includes(p)))
+            return true;
+        if (argStr === '/' || argStr === '*')
+            return true;
+        if (argStr.includes('/*'))
+            return true;
+        return false;
+    });
+    if (hasFsArgs) {
+        const isRoot = args.some((arg) => arg === '/' || arg === '*' || arg.includes('/*'));
+        result.issues.push({
+            type: isRoot ? 'high' : 'medium',
+            category: 'filesystem',
+            title: isRoot ? 'Root Filesystem Access' : 'Broad Filesystem Access',
+            description: isRoot
+                ? `Server "${name}" has access to the entire filesystem — any file can be read/written`
+                : `Server "${name}" has filesystem access that may include sensitive directories`,
+            recommendation: isRoot
+                ? 'Restrict to specific project directories only'
+                : 'Review if all directories are necessary',
+            evidence: `Args: ${args.join(', ')}`,
+        });
+        result.score -= isRoot ? 25 : 10;
+    }
+    // === Network/URL-based Servers ===
+    if (server.url) {
+        result.permissions.networkAccess = true;
+        const isLocalhost = server.url.includes('localhost') || server.url.includes('127.0.0.1');
+        const isHttps = server.url.startsWith('https://');
+        if (!isLocalhost && !isHttps) {
+            result.issues.push({
+                type: 'high',
+                category: 'network',
+                title: 'Insecure Remote Server',
+                description: `Server "${name}" connects to a remote server over plain HTTP`,
+                recommendation: 'Use HTTPS to prevent MITM attacks on MCP communication',
+                evidence: `URL: ${server.url}`,
+            });
+            result.score -= 20;
+        }
+        else if (!isLocalhost) {
+            result.issues.push({
+                type: 'low',
+                category: 'network',
+                title: 'Remote MCP Server',
+                description: `Server "${name}" connects to a remote server — your prompts and tool results travel over the network`,
+                recommendation: 'Ensure you trust the remote server operator',
+                evidence: `URL: ${server.url}`,
+            });
+            result.score -= 3;
+        }
+    }
+    // === Network Access via Command ===
+    if (command.includes('http') || command.includes('curl') || command.includes('wget') || command.includes('fetch')) {
+        result.permissions.networkAccess = true;
+        result.issues.push({
+            type: 'medium',
+            category: 'network',
+            title: 'Network Access',
+            description: `Server "${name}" has network capabilities via ${command}`,
+            recommendation: 'Ensure server origin is trusted and network usage is justified',
+            evidence: `Command: ${command}`,
+        });
+        result.score -= 10;
+    }
+    // === Transport Security ===
+    if (server.type === 'sse' || (server.url && !server.url.includes('localhost') && !server.url.includes('127.0.0.1'))) {
+        if (server.url && !server.url.startsWith('https://')) {
+            result.issues.push({
+                type: 'high',
+                category: 'transport',
+                title: 'Insecure SSE Transport',
+                description: `Server "${name}" uses SSE transport over unencrypted connection — prompts and tool results can be intercepted`,
+                recommendation: 'Use wss:// or https:// for SSE transport to protect MCP messages in transit',
+                evidence: `Transport: ${server.type || 'sse'}, URL: ${server.url}`,
+            });
+            result.score -= 20;
+        }
+        if (server.type === 'sse') {
+            result.issues.push({
+                type: 'medium',
+                category: 'transport',
+                title: 'SSE Transport Without Auth',
+                description: `Server "${name}" uses SSE transport — verify it requires authentication to prevent unauthorized tool invocation`,
+                recommendation: 'Add API key, Bearer token, or mTLS authentication to SSE endpoints',
+                evidence: `URL: ${server.url}`,
+            });
+            result.score -= 10;
+        }
+    }
+    // === Supply Chain: Version Pinning ===
+    if (command.includes('npx') || command.includes('uvx') || command.includes('pip')) {
+        const hasVersion = args.some((a) => /@\d|^\d|^v\d/.test(String(a)) || String(a).includes('==') || String(a).includes('>='));
+        if (!hasVersion) {
+            const pkgArg = args.find((a) => !a.startsWith('-'));
+            result.issues.push({
+                type: 'medium',
+                category: 'supply-chain',
+                title: 'Unpinned Package Version',
+                description: `Server "${name}" runs ${pkgArg || 'a package'} without a pinned version — a malicious update could compromise your system`,
+                recommendation: `Pin the version: npx ${pkgArg}@1.2.3 or uvx ${pkgArg}==1.2.3`,
+                evidence: `Command: ${command} ${args.join(' ')}`,
+            });
+            result.score -= 15;
+        }
+    }
+    // === Supply Chain: Local/Relative Path Execution ===
+    if (command.startsWith('.') || command.startsWith('/') || args.some((a) => String(a).startsWith('./') || String(a).startsWith('../'))) {
+        result.issues.push({
+            type: 'medium',
+            category: 'supply-chain',
+            title: 'Local Path Execution',
+            description: `Server "${name}" runs from a local path — ensure the code is from a trusted source and hasn't been tampered with`,
+            recommendation: 'Verify the source code integrity of local MCP servers',
+            evidence: `Command: ${command}, Args: ${args.join(' ')}`,
+        });
+        result.score -= 8;
+    }
+    // === Prompt Injection Risk: Auto-approve Patterns ===
+    if (args.some((a) => /--auto-?approve|--yes|-y|--no-?confirm/i.test(String(a)))) {
+        result.issues.push({
+            type: 'high',
+            category: 'permissions',
+            title: 'Auto-Approve Enabled',
+            description: `Server "${name}" has auto-approve flags — tool calls execute without user confirmation`,
+            recommendation: 'Remove auto-approve flags and review each tool call manually',
+            evidence: `Full command: ${fullCommand}`,
+        });
+        result.score -= 25;
+    }
+}
+function checkFilePermissions(configPath, result) {
+    try {
+        const stat = fs_extra_1.default.statSync(configPath);
+        const mode = stat.mode & 0o777;
+        const isWorldReadable = mode & 0o004;
+        const isGroupWritable = mode & 0o020;
+        const isWorldWritable = mode & 0o002;
+        if (isWorldWritable) {
+            result.issues.push({
+                type: 'high',
+                category: 'config',
+                title: 'World-Writable Config File',
+                description: `${configPath} is world-writable — any user on this system can modify your MCP configuration`,
+                recommendation: 'Run: chmod 600 <config-file> to restrict access',
+                evidence: `File mode: ${mode.toString(8)}`,
+            });
+            result.score -= 20;
+        }
+        else if (isGroupWritable) {
+            result.issues.push({
+                type: 'medium',
+                category: 'config',
+                title: 'Group-Writable Config File',
+                description: `${configPath} is group-writable — group members can modify your MCP configuration`,
+                recommendation: 'Run: chmod 600 <config-file> for stricter access',
+                evidence: `File mode: ${mode.toString(8)}`,
+            });
+            result.score -= 10;
+        }
+        if (isWorldReadable) {
+            // Only flag if config contains secrets
+            const hasSecrets = result.issues.some((i) => i.title.includes('Plaintext Secret'));
+            if (hasSecrets) {
+                result.issues.push({
+                    type: 'medium',
+                    category: 'config',
+                    title: 'World-Readable Config With Secrets',
+                    description: `${configPath} is world-readable and contains secrets — other users can read your API keys`,
+                    recommendation: 'Run: chmod 600 <config-file>',
+                    evidence: `File mode: ${mode.toString(8)}`,
+                });
+                result.score -= 15;
+            }
+        }
+    }
+    catch {
+        // Permission check is best-effort, skip on error
+    }
+}
+function calculateSecurityScore(result) {
+    result.score = Math.max(0, Math.min(100, result.score));
+}
+function expandPath(p) {
+    if (p.startsWith('~/')) {
+        return path_1.default.join(process.env.HOME || '', p.slice(2));
+    }
+    return p;
+}
+//# sourceMappingURL=config-scanner.js.map

package/dist/scanners/config-scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-scanner.js","sourceRoot":"","sources":["../../src/scanners/config-scanner.ts"],"names":[],"mappings":";;;;;AAyEA,gCA8CC;AAvHD,wDAA0B;AAC1B,gDAAwB;AACxB,sDAA2B;AAE3B,4CAAyC;AAoCzC,MAAM,qBAAqB,GAAG;IAC5B,4BAA4B;IAC5B,kBAAkB;IAClB,kBAAkB;IAClB,UAAU;IACV,6CAA6C;IAC7C,oBAAoB;CACrB,CAAC;AAEF,oCAAoC;AACpC,MAAM,cAAc,GAAG;IACrB,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAe,EAAE;IAC/E,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAe,EAAE;IAClF,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAe,EAAE;IACjF,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAe,EAAE;IACzE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,QAAiB,EAAE;IAC1E,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,QAAQ,EAAE,MAAe,EAAE;IAC9E,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,QAAiB,EAAE;IAC5E,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,QAAiB,EAAE;IAC7E,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAe,EAAE;CACjF,CAAC;AAEF,iCAAiC;AACjC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,yCAAyC;IACzC,qCAAqC;IACrC,uCAAuC;IACvC,2CAA2C;IAC3C,wCAAwC;IACxC,qCAAqC;IACrC,oCAAoC;CACrC,CAAC,CAAC;AAEI,KAAK,UAAU,UAAU,CAAC,MAAW,EAAE,OAAO,GAAG,KAAK;IAC3D,eAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAElD,MAAM,MAAM,GAAqB;QAC/B,WAAW,EAAE,EAAE;QACf,MAAM,EAAE,EAAE;QACV,WAAW,EAAE;YACX,UAAU,EAAE,EAAE;YACd,aAAa,EAAE,KAAK;YACpB,oBAAoB,EAAE,EAAE;SACzB;QACD,KAAK,EAAE,GAAG;KACX,CAAC;IAEF,oCAAoC;IACpC,KAAK,MAAM,UAAU,IAAI,qBAAqB,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QAExC,IAAI,kBAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClC,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,cAAc,GAAmB;QACrC,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE;YACP,gBAAgB,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;YAC3C,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,MAAM;YACrE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM;YACzE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,MAAM;SACpE;KACF,CAAC;IAEF,IAAI,OAAO,EAAE,CAAC;QACZ,eAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,cAAc,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,UAAkB,EAAE,MAAwB;IAC3E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,kBAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACtD,IAAI,MAAiB,CAAC;QAEtB,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;aAAM,IAAI,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACvE,MAAM,GAAG,iBAAI,CAAC,IAAI,CAAC,OAAO,CAAc,CAAC;QAC3C,CAAC;aAAM,CAAC;YACN,eAAM,CAAC,IAAI,CAAC,mCAAmC,UAAU,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAE3C,yBAAyB;QACzB,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,eAAM,CAAC,KAAK,CAAC,+BAA+B,UAAU,GAAG,EAAE,KAAK,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,QAAQ;YAClB,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,2CAA2C,UAAU,EAAE;YACpE,cAAc,EAAE,0DAA0D;YAC1E,QAAQ,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB,EAAE,MAAwB,EAAE,UAAkB;IACrF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC;IAE1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;YACjD,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;YAC5B,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAiB,EAAE,MAAwB,EAAE,UAAkB,EAAE,IAAY;IAClG,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAEnD,wCAAwC;IACxC,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAErG,wCAAwC;IACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YAClC,QAAQ,EAAE,aAAa;YACvB,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,2BAA2B;YAChF,WAAW,EAAE,WAAW;gBACtB,CAAC,CAAC,WAAW,IAAI,wCAAwC,OAAO,EAAE;gBAClE,CAAC,CAAC,WAAW,IAAI,cAAc,OAAO,+CAA+C;YACvF,cAAc,EAAE,WAAW;gBACzB,CAAC,CAAC,4DAA4D;gBAC9D,CAAC,CAAC,4FAA4F;YAChG,QAAQ,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;SAC/D,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YAClC,QAAQ,EAAE,aAAa;YACvB,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,0BAA0B;YAC9E,WAAW,EAAE,WAAW,IAAI,cAAc,OAAO,sCAAsC;YACvF,cAAc,EAAE,iEAAiE;YACjF,QAAQ,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;SAC/D,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,WAAW;YACrB,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,WAAW,IAAI,yEAAyE;YACrG,cAAc,EAAE,sEAAsE;YACtF,QAAQ,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;SAC/D,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,sCAAsC;IACtC,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;QACvC,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,SAAS,CAAC,QAAQ;gBACxB,QAAQ,EAAE,WAAW;gBACrB,KAAK,EAAE,SAAS,CAAC,KAAK;gBACtB,WAAW,EAAE,WAAW,IAAI,sCAAsC,SAAS,CAAC,OAAO,GAAG;gBACtF,cAAc,EAAE,sDAAsD;gBACtE,QAAQ,EAAE,iBAAiB,WAAW,EAAE;aACzC,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,IAAI,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAErD,MAAM,iBAAiB,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;YACrG,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC7F,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;oBACrC,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,4BAA4B;oBAChF,WAAW,EAAE,WAAW;wBACtB,CAAC,CAAC,WAAW,IAAI,+BAA+B,GAAG,iDAAiD;wBACpG,CAAC,CAAC,WAAW,IAAI,6BAA6B,GAAG,EAAE;oBACrD,cAAc,EAAE,WAAW;wBACzB,CAAC,CAAC,qGAAqG;wBACvG,CAAC,CAAC,kEAAkE;oBACtE,QAAQ,EAAE,aAAa,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,EAAE;iBACnE,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9E,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5D,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACpF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YAChC,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,yBAAyB;YACpE,WAAW,EAAE,MAAM;gBACjB,CAAC,CAAC,WAAW,IAAI,sEAAsE;gBACvF,CAAC,CAAC,WAAW,IAAI,gEAAgE;YACnF,cAAc,EAAE,MAAM;gBACpB,CAAC,CAAC,+CAA+C;gBACjD,CAAC,CAAC,yCAAyC;YAC7C,QAAQ,EAAE,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,oCAAoC;IACpC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,CAAC,WAAW,CAAC,aAAa,GAAG,IAAI,CAAC;QACxC,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzF,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QAElD,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC;YAC7B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,SAAS;gBACnB,KAAK,EAAE,wBAAwB;gBAC/B,WAAW,EAAE,WAAW,IAAI,+CAA+C;gBAC3E,cAAc,EAAE,wDAAwD;gBACxE,QAAQ,EAAE,QAAQ,MAAM,CAAC,GAAG,EAAE;aAC/B,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACrB,CAAC;aAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,SAAS;gBACnB,KAAK,EAAE,mBAAmB;gBAC1B,WAAW,EAAE,WAAW,IAAI,uFAAuF;gBACnH,cAAc,EAAE,6CAA6C;gBAC7D,QAAQ,EAAE,QAAQ,MAAM,CAAC,GAAG,EAAE;aAC/B,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAClH,MAAM,CAAC,WAAW,CAAC,aAAa,GAAG,IAAI,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,SAAS;YACnB,KAAK,EAAE,gBAAgB;YACvB,WAAW,EAAE,WAAW,IAAI,kCAAkC,OAAO,EAAE;YACvE,cAAc,EAAE,gEAAgE;YAChF,QAAQ,EAAE,YAAY,OAAO,EAAE;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IACrB,CAAC;IAED,6BAA6B;IAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QACpH,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,WAAW;gBACrB,KAAK,EAAE,wBAAwB;gBAC/B,WAAW,EAAE,WAAW,IAAI,gGAAgG;gBAC5H,cAAc,EAAE,6EAA6E;gBAC7F,QAAQ,EAAE,cAAc,MAAM,CAAC,IAAI,IAAI,KAAK,UAAU,MAAM,CAAC,GAAG,EAAE;aACnE,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,WAAW;gBACrB,KAAK,EAAE,4BAA4B;gBACnC,WAAW,EAAE,WAAW,IAAI,kGAAkG;gBAC9H,cAAc,EAAE,oEAAoE;gBACpF,QAAQ,EAAE,QAAQ,MAAM,CAAC,GAAG,EAAE;aAC/B,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAClF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5H,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,cAAc;gBACxB,KAAK,EAAE,0BAA0B;gBACjC,WAAW,EAAE,WAAW,IAAI,UAAU,MAAM,IAAI,WAAW,6EAA6E;gBACxI,cAAc,EAAE,wBAAwB,MAAM,iBAAiB,MAAM,SAAS;gBAC9E,QAAQ,EAAE,YAAY,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;aAClD,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACtI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,QAAQ;YACd,QAAQ,EAAE,cAAc;YACxB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,WAAW,IAAI,mGAAmG;YAC/H,cAAc,EAAE,uDAAuD;YACvE,QAAQ,EAAE,YAAY,OAAO,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;SACzD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,uDAAuD;IACvD,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yCAAyC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACjB,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,aAAa;YACvB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,WAAW,IAAI,yEAAyE;YACrG,cAAc,EAAE,8DAA8D;YAC9E,QAAQ,EAAE,iBAAiB,WAAW,EAAE;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB,EAAE,MAAwB;IACxE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,kBAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,MAAM,eAAe,GAAG,IAAI,GAAG,KAAK,CAAC;QACrC,MAAM,eAAe,GAAG,IAAI,GAAG,KAAK,CAAC;QACrC,MAAM,eAAe,GAAG,IAAI,GAAG,KAAK,CAAC;QAErC,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,4BAA4B;gBACnC,WAAW,EAAE,GAAG,UAAU,gFAAgF;gBAC1G,cAAc,EAAE,iDAAiD;gBACjE,QAAQ,EAAE,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;aAC3C,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACrB,CAAC;aAAM,IAAI,eAAe,EAAE,CAAC;YAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,IAAI,EAAE,QAAQ;gBACd,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,4BAA4B;gBACnC,WAAW,EAAE,GAAG,UAAU,sEAAsE;gBAChG,cAAc,EAAE,kDAAkD;gBAClE,QAAQ,EAAE,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;aAC3C,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACrB,CAAC;QAED,IAAI,eAAe,EAAE,CAAC;YACpB,uCAAuC;YACvC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACnF,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;oBACjB,IAAI,EAAE,QAAQ;oBACd,QAAQ,EAAE,QAAQ;oBAClB,KAAK,EAAE,oCAAoC;oBAC3C,WAAW,EAAE,GAAG,UAAU,8EAA8E;oBACxG,cAAc,EAAE,8BAA8B;oBAC9C,QAAQ,EAAE,cAAc,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;iBAC3C,CAAC,CAAC;gBACH,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iDAAiD;IACnD,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,MAAwB;IACtD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,OAAO,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/scanners/docker-scanner.d.ts

@@ -0,0 +1,13 @@
+import { SecurityResult } from '../types/security-result';
+/**
+ * Docker/Container security scanner for MCP servers.
+ *
+ * Checks Dockerfiles, docker-compose files, and container configs
+ * for common security misconfigurations.
+ */
+interface DockerScanOptions {
+    strict?: boolean;
+}
+export declare function scanDocker(targetPath: string, options?: DockerScanOptions): Promise<SecurityResult>;
+export {};
+//# sourceMappingURL=docker-scanner.d.ts.map

package/dist/scanners/docker-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-scanner.d.ts","sourceRoot":"","sources":["../../src/scanners/docker-scanner.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAiB,MAAM,0BAA0B,CAAC;AAEzE;;;;;GAKG;AAEH,UAAU,iBAAiB;IACzB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAID,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAkE7G"}