@vinkius-core/mcp-fusion 2.7.0 → 2.8.0

package/dist/introspection/EntitlementScanner.js

@@ -0,0 +1,244 @@
+/**
+ * Entitlement detection patterns.
+ *
+ * Conservative: may over-report (false positives in comments/strings)
+ * but never under-report. This is intentional — security analysis
+ * should err on the side of caution.
+ */
+const PATTERNS = [
+    // ── Filesystem ──
+    { category: 'filesystem', identifier: 'fs', regex: /(?:require\s*\(\s*['"]|import\s*\(\s*['"]|from\s+['"])(?:node:)?fs(?:\/promises)?['"]/g },
+    { category: 'filesystem', identifier: 'fs.*', regex: /\bfs\.\w+(?:Sync)?\s*\(/g },
+    { category: 'filesystem', identifier: 'readFile', regex: /\breadFile(?:Sync)?\s*\(/g },
+    { category: 'filesystem', identifier: 'writeFile', regex: /\bwriteFile(?:Sync)?\s*\(/g },
+    { category: 'filesystem', identifier: 'appendFile', regex: /\bappendFile(?:Sync)?\s*\(/g },
+    { category: 'filesystem', identifier: 'unlink', regex: /\bunlink(?:Sync)?\s*\(/g },
+    { category: 'filesystem', identifier: 'rmdir', regex: /\brmdir(?:Sync)?\s*\(/g },
+    { category: 'filesystem', identifier: 'mkdir', regex: /\bmkdir(?:Sync)?\s*\(/g },
+    { category: 'filesystem', identifier: 'rename', regex: /\brename(?:Sync)?\s*\(/g },
+    { category: 'filesystem', identifier: 'copyFile', regex: /\bcopyFile(?:Sync)?\s*\(/g },
+    { category: 'filesystem', identifier: 'createReadStream', regex: /\bcreateReadStream\s*\(/g },
+    { category: 'filesystem', identifier: 'createWriteStream', regex: /\bcreateWriteStream\s*\(/g },
+    // ── Network ──
+    { category: 'network', identifier: 'fetch', regex: /\bfetch\s*\(/g },
+    { category: 'network', identifier: 'http', regex: /(?:require\s*\(\s*['"]|import\s*\(\s*['"]|from\s+['"])(?:node:)?https?['"]/g },
+    { category: 'network', identifier: 'axios', regex: /(?:require\s*\(\s*['"]|import\s*\(\s*['"]|from\s+['"])axios['"]/g },
+    { category: 'network', identifier: 'got', regex: /(?:require\s*\(\s*['"]|import\s*\(\s*['"]|from\s+['"])got['"]/g },
+    { category: 'network', identifier: 'node-fetch', regex: /(?:require\s*\(\s*['"]|import\s*\(\s*['"]|from\s+['"])node-fetch['"]/g },
+    { category: 'network', identifier: 'XMLHttpRequest', regex: /\bnew\s+XMLHttpRequest\s*\(/g },
+    { category: 'network', identifier: 'WebSocket', regex: /\bnew\s+WebSocket\s*\(/g },
+    { category: 'network', identifier: 'net', regex: /(?:require\s*\(\s*['"]|import\s*\(\s*['"]|from\s+['"])(?:node:)?net['"]/g },
+    { category: 'network', identifier: 'dgram', regex: /(?:require\s*\(\s*['"]|import\s*\(\s*['"]|from\s+['"])(?:node:)?dgram['"]/g },
+    { category: 'network', identifier: 'undici', regex: /(?:require\s*\(\s*['"]|import\s*\(\s*['"]|from\s+['"])undici['"]/g },
+    // ── Subprocess ──
+    { category: 'subprocess', identifier: 'child_process', regex: /(?:require\s*\(\s*['"]|import\s*\(\s*['"]|from\s+['"])(?:node:)?child_process['"]/g },
+    { category: 'subprocess', identifier: 'exec', regex: /\bexec(?:Sync|File|FileSync)?\s*\(/g },
+    { category: 'subprocess', identifier: 'spawn', regex: /\bspawn(?:Sync)?\s*\(/g },
+    { category: 'subprocess', identifier: 'fork', regex: /\bfork\s*\(/g },
+    { category: 'subprocess', identifier: 'worker_threads', regex: /(?:require\s*\(\s*['"]|import\s*\(\s*['"]|from\s+['"])(?:node:)?worker_threads['"]/g },
+    { category: 'subprocess', identifier: 'cluster', regex: /(?:require\s*\(\s*['"]|import\s*\(\s*['"]|from\s+['"])(?:node:)?cluster['"]/g },
+    { category: 'subprocess', identifier: 'Deno.run', regex: /\bDeno\.run\s*\(/g },
+    { category: 'subprocess', identifier: 'Bun.spawn', regex: /\bBun\.spawn\s*\(/g },
+    // ── Crypto ──
+    { category: 'crypto', identifier: 'crypto', regex: /(?:require\s*\(\s*['"]|import\s*\(\s*['"]|from\s+['"])(?:node:)?crypto['"]/g },
+    { category: 'crypto', identifier: 'createSign', regex: /\bcreateSign\s*\(/g },
+    { category: 'crypto', identifier: 'createVerify', regex: /\bcreateVerify\s*\(/g },
+    { category: 'crypto', identifier: 'createCipher', regex: /\bcreateCipher(?:iv)?\s*\(/g },
+    { category: 'crypto', identifier: 'createDecipher', regex: /\bcreateDecipher(?:iv)?\s*\(/g },
+    { category: 'crypto', identifier: 'privateEncrypt', regex: /\bprivateEncrypt\s*\(/g },
+    { category: 'crypto', identifier: 'privateDecrypt', regex: /\bprivateDecrypt\s*\(/g },
+];
+// ============================================================================
+// Scanner
+// ============================================================================
+/**
+ * Scan source text for entitlement patterns.
+ *
+ * @param source - The source code text to scan
+ * @param fileName - File name for reporting (optional)
+ * @returns All entitlement matches found
+ */
+export function scanSource(source, fileName) {
+    const matches = [];
+    const lines = source.split('\n');
+    const lineOffsets = buildLineOffsets(source);
+    for (const pattern of PATTERNS) {
+        // Reset regex state (global flag)
+        const regex = new RegExp(pattern.regex.source, pattern.regex.flags);
+        let match;
+        while ((match = regex.exec(source)) !== null) {
+            const lineNumber = resolveLineNumber(lineOffsets, match.index);
+            const contextLine = lines[lineNumber - 1]?.trim() ?? '';
+            matches.push({
+                category: pattern.category,
+                identifier: pattern.identifier,
+                pattern: pattern.regex.source,
+                context: contextLine,
+                line: lineNumber,
+            });
+        }
+    }
+    return matches;
+}
+/**
+ * Build `HandlerEntitlements` from detected matches.
+ *
+ * @param matches - Detected entitlement matches
+ * @returns Aggregated entitlements
+ */
+export function buildEntitlements(matches) {
+    const categories = new Set(matches.map(m => m.category));
+    const raw = [...new Set(matches.map(m => m.identifier))].sort();
+    return {
+        filesystem: categories.has('filesystem'),
+        network: categories.has('network'),
+        subprocess: categories.has('subprocess'),
+        crypto: categories.has('crypto'),
+        raw,
+    };
+}
+/** Filesystem identifiers that imply write operations */
+const WRITE_OPS = /write|append|unlink|rmdir|mkdir|rename|copy|createWriteStream/i;
+/** All entitlement categories for iteration */
+const ALL_CATEGORIES = ['filesystem', 'network', 'subprocess', 'crypto'];
+/** @internal */
+const VIOLATION_RULES = [
+    // readOnly + filesystem writes → error
+    {
+        predicate: (cats, claims, allowed, matches) => !!claims.readOnly
+            && cats.has('filesystem')
+            && !allowed.has('filesystem')
+            && matches.some(m => m.category === 'filesystem' && WRITE_OPS.test(m.identifier)),
+        produce: (_cats, _claims, matches) => {
+            const writeOps = matches.filter(m => m.category === 'filesystem' && WRITE_OPS.test(m.identifier));
+            const ids = writeOps.map(m => m.identifier).join(', ');
+            return {
+                category: 'filesystem',
+                declared: 'readOnly: true',
+                detected: `Filesystem write operations: ${ids}`,
+                severity: 'error',
+                description: `Tool declares readOnly but handler uses filesystem write APIs: ${ids}`,
+            };
+        },
+    },
+    // readOnly + subprocess → error
+    {
+        predicate: (cats, claims, allowed) => !!claims.readOnly && cats.has('subprocess') && !allowed.has('subprocess'),
+        produce: () => ({
+            category: 'subprocess',
+            declared: 'readOnly: true',
+            detected: 'Subprocess APIs detected',
+            severity: 'error',
+            description: 'Tool declares readOnly but handler uses subprocess APIs',
+        }),
+    },
+    // non-destructive + subprocess → warning
+    {
+        predicate: (cats, claims, allowed) => !claims.destructive && cats.has('subprocess') && !allowed.has('subprocess'),
+        produce: () => ({
+            category: 'subprocess',
+            declared: 'destructive: false',
+            detected: 'Subprocess APIs detected',
+            severity: 'warning',
+            description: 'Tool is not marked destructive but handler uses subprocess APIs — consider marking as destructive',
+        }),
+    },
+    // readOnly + network → warning
+    {
+        predicate: (cats, claims, allowed) => !!claims.readOnly && cats.has('network') && !allowed.has('network'),
+        produce: () => ({
+            category: 'network',
+            declared: 'readOnly: true',
+            detected: 'Network APIs detected',
+            severity: 'warning',
+            description: 'Tool declares readOnly but handler makes network calls — side effects possible',
+        }),
+    },
+];
+/**
+ * Validate detected entitlements against declared claims.
+ *
+ * Uses a rule table instead of imperative branching.
+ * Each rule encodes a policy check as pure data.
+ *
+ * @param matches - Detected matches
+ * @param claims - Declared claims from action metadata
+ * @returns Violations found
+ */
+export function validateClaims(matches, claims) {
+    const categories = new Set(matches.map(m => m.category));
+    const allowed = new Set(claims.allowed ?? []);
+    return VIOLATION_RULES
+        .filter(rule => rule.predicate(categories, claims, allowed, matches))
+        .map(rule => rule.produce(categories, claims, matches));
+}
+/**
+ * Perform a complete entitlement scan and validation.
+ *
+ * @param source - Handler source code
+ * @param claims - Declared claims for validation
+ * @param fileName - Optional file name for reporting
+ * @returns Complete entitlement report
+ */
+export function scanAndValidate(source, claims = {}, fileName) {
+    const matches = scanSource(source, fileName);
+    const entitlements = buildEntitlements(matches);
+    const violations = validateClaims(matches, claims);
+    const safe = violations.every(v => v.severity !== 'error');
+    const summary = buildSummary(entitlements, violations, safe);
+    return {
+        entitlements,
+        matches,
+        violations,
+        safe,
+        summary,
+    };
+}
+// ============================================================================
+// Internals
+// ============================================================================
+/**
+ * Precompute line start offsets for O(log n) line-number resolution.
+ * @internal
+ */
+function buildLineOffsets(source) {
+    const offsets = [0]; // Line 1 starts at offset 0
+    for (let i = 0; i < source.length; i++) {
+        if (source[i] === '\n')
+            offsets.push(i + 1);
+    }
+    return offsets;
+}
+/**
+ * Binary search for the line number at a given character offset.
+ * O(log n) per lookup vs O(n) for naive iteration.
+ * @internal
+ */
+function resolveLineNumber(offsets, offset) {
+    let lo = 0;
+    let hi = offsets.length - 1;
+    while (lo < hi) {
+        const mid = (lo + hi + 1) >>> 1;
+        if (offsets[mid] <= offset)
+            lo = mid;
+        else
+            hi = mid - 1;
+    }
+    return lo + 1; // 1-based
+}
+/**
+ * Build a human-readable summary.
+ * @internal
+ */
+function buildSummary(entitlements, violations, safe) {
+    const active = ALL_CATEGORIES.filter(c => entitlements[c]);
+    if (active.length === 0) {
+        return 'No I/O entitlements detected — handler is sandboxed.';
+    }
+    const errorCount = violations.filter(v => v.severity === 'error').length;
+    const violationSuffix = violations.length > 0
+        ? ` | ${violations.length} violation(s) (${errorCount} errors)`
+        : ' | No violations';
+    return `Entitlements: [${active.join(', ')}]${violationSuffix} | ${safe ? 'SAFE' : 'UNSAFE'}`;
+}
+//# sourceMappingURL=EntitlementScanner.js.map

package/dist/introspection/EntitlementScanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EntitlementScanner.js","sourceRoot":"","sources":["../../src/introspection/EntitlementScanner.ts"],"names":[],"mappings":"AA4GA;;;;;;GAMG;AACH,MAAM,QAAQ,GAAkC;IAC5C,mBAAmB;IACnB,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,wFAAwF,EAAE;IAC7I,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,0BAA0B,EAAE;IACjF,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,2BAA2B,EAAE;IACtF,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,4BAA4B,EAAE;IACxF,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,6BAA6B,EAAE;IAC1F,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB,EAAE;IAClF,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE;IAChF,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE;IAChF,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB,EAAE;IAClF,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,2BAA2B,EAAE;IACtF,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,kBAAkB,EAAE,KAAK,EAAE,0BAA0B,EAAE;IAC7F,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAE/F,gBAAgB;IAChB,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE;IACpE,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,6EAA6E,EAAE;IACjI,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,kEAAkE,EAAE;IACvH,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,gEAAgE,EAAE;IACnH,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,uEAAuE,EAAE;IACjI,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,8BAA8B,EAAE;IAC5F,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,EAAE;IAClF,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,0EAA0E,EAAE;IAC7H,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,4EAA4E,EAAE;IACjI,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,mEAAmE,EAAE;IAEzH,mBAAmB;IACnB,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,KAAK,EAAE,oFAAoF,EAAE;IACpJ,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,qCAAqC,EAAE;IAC5F,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,wBAAwB,EAAE;IAChF,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,EAAE;IACrE,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,qFAAqF,EAAE;IACtJ,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,8EAA8E,EAAE;IACxI,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE;IAC9E,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,EAAE;IAEhF,eAAe;IACf,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,6EAA6E,EAAE;IAClI,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,oBAAoB,EAAE;IAC7E,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,sBAAsB,EAAE;IACjF,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,KAAK,EAAE,6BAA6B,EAAE;IACxF,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,+BAA+B,EAAE;IAC5F,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,wBAAwB,EAAE;IACrF,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,gBAAgB,EAAE,KAAK,EAAE,wBAAwB,EAAE;CACxF,CAAC;AAEF,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACtB,MAAc,EACd,QAAiB;IAEjB,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,WAAW,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAE7C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC7B,kCAAkC;QAClC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,KAA6B,CAAC;QAElC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3C,MAAM,UAAU,GAAG,iBAAiB,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC/D,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAExD,OAAO,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;gBAC7B,OAAO,EAAE,WAAW;gBACpB,IAAI,EAAE,UAAU;aACnB,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC7B,OAAoC;IAEpC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEhE,OAAO;QACH,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;QACxC,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC;QACxC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC;QAChC,GAAG;KACN,CAAC;AACN,CAAC;AAED,yDAAyD;AACzD,MAAM,SAAS,GAAG,gEAAgE,CAAC;AAEnF,+CAA+C;AAC/C,MAAM,cAAc,GAAmC,CAAC,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AAWzG,gBAAgB;AAChB,MAAM,eAAe,GAA6B;IAC9C,uCAAuC;IACvC;QACI,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAC1C,CAAC,CAAC,MAAM,CAAC,QAAQ;eACd,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;eACtB,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;eAC1B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QACrF,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;YACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAClG,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,OAAO;gBACH,QAAQ,EAAE,YAAY;gBACtB,QAAQ,EAAE,gBAAgB;gBAC1B,QAAQ,EAAE,gCAAgC,GAAG,EAAE;gBAC/C,QAAQ,EAAE,OAAO;gBACjB,WAAW,EAAE,kEAAkE,GAAG,EAAE;aACvF,CAAC;QACN,CAAC;KACJ;IACD,gCAAgC;IAChC;QACI,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC7E,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACZ,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,0BAA0B;YACpC,QAAQ,EAAE,OAAO;YACjB,WAAW,EAAE,yDAAyD;SACzE,CAAC;KACL;IACD,yCAAyC;IACzC;QACI,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CACjC,CAAC,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAC/E,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACZ,QAAQ,EAAE,YAAY;YACtB,QAAQ,EAAE,oBAAoB;YAC9B,QAAQ,EAAE,0BAA0B;YACpC,QAAQ,EAAE,SAAS;YACnB,WAAW,EAAE,mGAAmG;SACnH,CAAC;KACL;IACD,+BAA+B;IAC/B;QACI,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CACjC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;QACvE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACZ,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,gBAAgB;YAC1B,QAAQ,EAAE,uBAAuB;YACjC,QAAQ,EAAE,SAAS;YACnB,WAAW,EAAE,gFAAgF;SAChG,CAAC;KACL;CACJ,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC1B,OAAoC,EACpC,MAAyB;IAEzB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAE9C,OAAO,eAAe;SACjB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;SACpE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC3B,MAAc,EACd,SAA4B,EAAE,EAC9B,QAAiB;IAEjB,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEnD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAE7D,OAAO;QACH,YAAY;QACZ,OAAO;QACP,UAAU;QACV,IAAI;QACJ,OAAO;KACV,CAAC;AACN,CAAC;AAED,+EAA+E;AAC/E,YAAY;AACZ,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,gBAAgB,CAAC,MAAc;IACpC,MAAM,OAAO,GAAa,CAAC,CAAC,CAAC,CAAC,CAAC,4BAA4B;IAC3D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAA0B,EAAE,MAAc;IACjE,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAE,IAAI,MAAM;YAAE,EAAE,GAAG,GAAG,CAAC;;YACjC,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU;AAC7B,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CACjB,YAAiC,EACjC,UAA2C,EAC3C,IAAa;IAEb,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,sDAAsD,CAAC;IAClE,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC;QACzC,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,kBAAkB,UAAU,UAAU;QAC/D,CAAC,CAAC,kBAAkB,CAAC;IAEzB,OAAO,kBAAkB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAClG,CAAC"}

package/dist/introspection/GovernanceObserver.d.ts

@@ -0,0 +1,88 @@
+/**
+ * GovernanceObserver — Observability Bridge for Governance Operations
+ *
+ * Wraps governance operations (contract compilation, lockfile generation,
+ * integrity verification, attestation) with structured debug events and
+ * OpenTelemetry-compatible tracing spans.
+ *
+ * This module is the bridge between the governance/introspection layer
+ * and the observability layer. It is opt-in — governance operations
+ * work identically without it. When enabled, every governance operation
+ * emits a `GovernanceEvent` and/or a tracing span.
+ *
+ * **Zero overhead when disabled**: When no observer or tracer is
+ * configured, the wrapper functions are no-ops that delegate directly.
+ *
+ * @module
+ */
+import type { DebugObserverFn, GovernanceOperation } from '../observability/DebugObserver.js';
+import type { FusionTracer } from '../observability/Tracing.js';
+/**
+ * Configuration for governance observability.
+ *
+ * Pass to `createGovernanceObserver()` to enable debug events
+ * and/or tracing spans for governance operations.
+ */
+export interface GovernanceObserverConfig {
+    /** Debug event handler — receives GovernanceEvent */
+    readonly debug?: DebugObserverFn;
+    /** OpenTelemetry-compatible tracer */
+    readonly tracer?: FusionTracer;
+}
+/**
+ * A governance observer that emits debug events and tracing spans.
+ *
+ * All methods accept a callback that performs the actual work.
+ * The observer wraps the callback with timing and event emission.
+ */
+export interface GovernanceObserver {
+    /**
+     * Wrap a governance operation with observability.
+     *
+     * @param operation - Named governance operation
+     * @param label     - Human-readable label
+     * @param fn        - The actual work to perform
+     * @returns The result of `fn`
+     */
+    observe<T>(operation: GovernanceOperation, label: string, fn: () => T): T;
+    /**
+     * Wrap an async governance operation with observability.
+     *
+     * @param operation - Named governance operation
+     * @param label     - Human-readable label
+     * @param fn        - The actual async work to perform
+     * @returns The result of `fn`
+     */
+    observeAsync<T>(operation: GovernanceOperation, label: string, fn: () => Promise<T>): Promise<T>;
+}
+/**
+ * Create a governance observer that emits debug events and/or tracing
+ * spans for governance operations.
+ *
+ * @param config - Observer configuration (debug handler and/or tracer)
+ * @returns A `GovernanceObserver` instance
+ *
+ * @example
+ * ```typescript
+ * import { createGovernanceObserver } from '@vinkius-core/mcp-fusion/introspection';
+ * import { createDebugObserver } from '@vinkius-core/mcp-fusion';
+ *
+ * const observer = createGovernanceObserver({
+ *     debug: createDebugObserver(),
+ * });
+ *
+ * const contracts = observer.observe(
+ *     'contract.compile',
+ *     'Compiling 5 tool contracts',
+ *     () => compileContracts(builders),
+ * );
+ * ```
+ */
+export declare function createGovernanceObserver(config: GovernanceObserverConfig): GovernanceObserver;
+/**
+ * Create a no-op governance observer.
+ *
+ * Used when observability is not configured. Zero overhead.
+ */
+export declare function createNoopObserver(): GovernanceObserver;
+//# sourceMappingURL=GovernanceObserver.d.ts.map

package/dist/introspection/GovernanceObserver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"GovernanceObserver.d.ts","sourceRoot":"","sources":["../../src/introspection/GovernanceObserver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC9F,OAAO,KAAK,EAAE,YAAY,EAAwB,MAAM,6BAA6B,CAAC;AActF;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACrC,qDAAqD;IACrD,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC;CAClC;AAMD;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IAC/B;;;;;;;OAOG;IACH,OAAO,CAAC,CAAC,EACL,SAAS,EAAE,mBAAmB,EAC9B,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,CAAC,GACZ,CAAC,CAAC;IAEL;;;;;;;OAOG;IACH,YAAY,CAAC,CAAC,EACV,SAAS,EAAE,mBAAmB,EAC9B,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,CAAC,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,wBAAwB,GAAG,kBAAkB,CAoH7F;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,kBAAkB,CAKvD"}

package/dist/introspection/GovernanceObserver.js

@@ -0,0 +1,132 @@
+import { SpanStatusCode } from '../observability/Tracing.js';
+/**
+ * Create a governance observer that emits debug events and/or tracing
+ * spans for governance operations.
+ *
+ * @param config - Observer configuration (debug handler and/or tracer)
+ * @returns A `GovernanceObserver` instance
+ *
+ * @example
+ * ```typescript
+ * import { createGovernanceObserver } from '@vinkius-core/mcp-fusion/introspection';
+ * import { createDebugObserver } from '@vinkius-core/mcp-fusion';
+ *
+ * const observer = createGovernanceObserver({
+ *     debug: createDebugObserver(),
+ * });
+ *
+ * const contracts = observer.observe(
+ *     'contract.compile',
+ *     'Compiling 5 tool contracts',
+ *     () => compileContracts(builders),
+ * );
+ * ```
+ */
+export function createGovernanceObserver(config) {
+    const { debug, tracer } = config;
+    function observe(operation, label, fn) {
+        const start = Date.now();
+        const span = tracer?.startSpan(`mcp.governance.${operation}`, {
+            attributes: {
+                'mcp.governance.operation': operation,
+                'mcp.governance.label': label,
+            },
+        });
+        try {
+            const result = fn();
+            const durationMs = Date.now() - start;
+            span?.setAttribute('mcp.governance.outcome', 'success');
+            span?.setAttribute('mcp.durationMs', durationMs);
+            span?.setStatus({ code: SpanStatusCode.OK });
+            debug?.({
+                type: 'governance',
+                operation,
+                label,
+                outcome: 'success',
+                durationMs,
+                timestamp: Date.now(),
+            });
+            return result;
+        }
+        catch (err) {
+            const durationMs = Date.now() - start;
+            const message = err instanceof Error ? err.message : String(err);
+            span?.setAttribute('mcp.governance.outcome', 'failure');
+            span?.setAttribute('mcp.durationMs', durationMs);
+            span?.setStatus({ code: SpanStatusCode.ERROR, message });
+            span?.recordException(err instanceof Error ? err : new Error(message));
+            debug?.({
+                type: 'governance',
+                operation,
+                label,
+                outcome: 'failure',
+                detail: message,
+                durationMs,
+                timestamp: Date.now(),
+            });
+            throw err;
+        }
+        finally {
+            span?.end();
+        }
+    }
+    async function observeAsync(operation, label, fn) {
+        const start = Date.now();
+        const span = tracer?.startSpan(`mcp.governance.${operation}`, {
+            attributes: {
+                'mcp.governance.operation': operation,
+                'mcp.governance.label': label,
+            },
+        });
+        try {
+            const result = await fn();
+            const durationMs = Date.now() - start;
+            span?.setAttribute('mcp.governance.outcome', 'success');
+            span?.setAttribute('mcp.durationMs', durationMs);
+            span?.setStatus({ code: SpanStatusCode.OK });
+            debug?.({
+                type: 'governance',
+                operation,
+                label,
+                outcome: 'success',
+                durationMs,
+                timestamp: Date.now(),
+            });
+            return result;
+        }
+        catch (err) {
+            const durationMs = Date.now() - start;
+            const message = err instanceof Error ? err.message : String(err);
+            span?.setAttribute('mcp.governance.outcome', 'failure');
+            span?.setAttribute('mcp.durationMs', durationMs);
+            span?.setStatus({ code: SpanStatusCode.ERROR, message });
+            span?.recordException(err instanceof Error ? err : new Error(message));
+            debug?.({
+                type: 'governance',
+                operation,
+                label,
+                outcome: 'failure',
+                detail: message,
+                durationMs,
+                timestamp: Date.now(),
+            });
+            throw err;
+        }
+        finally {
+            span?.end();
+        }
+    }
+    return { observe, observeAsync };
+}
+/**
+ * Create a no-op governance observer.
+ *
+ * Used when observability is not configured. Zero overhead.
+ */
+export function createNoopObserver() {
+    return {
+        observe: (_op, _label, fn) => fn(),
+        observeAsync: (_op, _label, fn) => fn(),
+    };
+}
+//# sourceMappingURL=GovernanceObserver.js.map

package/dist/introspection/GovernanceObserver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GovernanceObserver.js","sourceRoot":"","sources":["../../src/introspection/GovernanceObserver.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAkE7D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAgC;IACrE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAEjC,SAAS,OAAO,CACZ,SAA8B,EAC9B,KAAa,EACb,EAAW;QAEX,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,CAAC,kBAAkB,SAAS,EAAE,EAAE;YAC1D,UAAU,EAAE;gBACR,0BAA0B,EAAE,SAAS;gBACrC,sBAAsB,EAAE,KAAK;aAChC;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,EAAE,EAAE,CAAC;YACpB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAEtC,IAAI,EAAE,YAAY,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACxD,IAAI,EAAE,YAAY,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YAE7C,KAAK,EAAE,CAAC;gBACJ,IAAI,EAAE,YAAY;gBAClB,SAAS;gBACT,KAAK;gBACL,OAAO,EAAE,SAAS;gBAClB,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACtC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEjE,IAAI,EAAE,YAAY,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACxD,IAAI,EAAE,YAAY,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACzD,IAAI,EAAE,eAAe,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAEvE,KAAK,EAAE,CAAC;gBACJ,IAAI,EAAE,YAAY;gBAClB,SAAS;gBACT,KAAK;gBACL,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,OAAO;gBACf,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;YAEH,MAAM,GAAG,CAAC;QACd,CAAC;gBAAS,CAAC;YACP,IAAI,EAAE,GAAG,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;IAED,KAAK,UAAU,YAAY,CACvB,SAA8B,EAC9B,KAAa,EACb,EAAoB;QAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,EAAE,SAAS,CAAC,kBAAkB,SAAS,EAAE,EAAE;YAC1D,UAAU,EAAE;gBACR,0BAA0B,EAAE,SAAS;gBACrC,sBAAsB,EAAE,KAAK;aAChC;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YAEtC,IAAI,EAAE,YAAY,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACxD,IAAI,EAAE,YAAY,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YAE7C,KAAK,EAAE,CAAC;gBACJ,IAAI,EAAE,YAAY;gBAClB,SAAS;gBACT,KAAK;gBACL,OAAO,EAAE,SAAS;gBAClB,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;YACtC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAEjE,IAAI,EAAE,YAAY,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;YACxD,IAAI,EAAE,YAAY,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,EAAE,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACzD,IAAI,EAAE,eAAe,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAEvE,KAAK,EAAE,CAAC;gBACJ,IAAI,EAAE,YAAY;gBAClB,SAAS;gBACT,KAAK;gBACL,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,OAAO;gBACf,UAAU;gBACV,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;aACxB,CAAC,CAAC;YAEH,MAAM,GAAG,CAAC;QACd,CAAC;gBAAS,CAAC;YACP,IAAI,EAAE,GAAG,EAAE,CAAC;QAChB,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAC9B,OAAO;QACH,OAAO,EAAE,CAAI,GAAwB,EAAE,MAAc,EAAE,EAAW,EAAK,EAAE,CAAC,EAAE,EAAE;QAC9E,YAAY,EAAE,CAAI,GAAwB,EAAE,MAAc,EAAE,EAAoB,EAAc,EAAE,CAAC,EAAE,EAAE;KACxG,CAAC;AACN,CAAC"}