@winstonsayno/mcp-gateway 3.3.0 → 3.5.0

package/dist/secrets/index.js

@@ -0,0 +1,410 @@
+/**
+ * Secrets management (3.5): upstream credentials resolved from Vault / KMS / env / files, rotated, and injected
+ * per tenant.
+ *
+ * Any server `env`, `headers`, `url` or `args` value may contain `secret://<provider>/<path>[#field]` references.
+ * They are resolved when the server connects — the registry, `GET /servers`, the audit log and config diffs only ever
+ * see the reference — and re-resolved every `secrets.rotation.intervalSeconds`; a server whose resolved credentials
+ * changed is reconnected with the new ones (token rotation without a restart).
+ *
+ * `servers[].inject` adds per-tenant / per-client credentials to each call, after plugins, policy and capture (so
+ * they never reach the request log or the replay debugger): into a tool argument or into `_meta`. `{tenant}` and
+ * `{client}` in the reference are replaced with the caller's first tenant / client id.
+ *
+ * Providers:
+ *  - `vault`: HashiCorp Vault KV v2 (`GET {address}/v1/{mount}/data/{path}`), token or AppRole auth.
+ *  - `aws-kms`: AWS KMS `Decrypt` (SigV4) of a base64 ciphertext; the reference path is the ciphertext.
+ *  - `gcp-kms`: Google Cloud KMS `decrypt` with an access token; path is `<cryptoKey>:<base64 ciphertext>`.
+ *  - `env`: environment variable; `file`: a file (trimmed), relative to the config directory.
+ *
+ * @module secrets
+ */
+import { createHash, createHmac } from 'crypto';
+import { readFile } from 'fs/promises';
+import { isAbsolute, resolve as resolvePath } from 'path';
+import { logger } from '../utils/logger.js';
+export const SECRET_REF = /secret:\/\/([A-Za-z0-9_-]+)\/([^\s"'#]+)(?:#([A-Za-z0-9_.-]+))?/g;
+export function parseSecretRef(s) {
+    const m = /^secret:\/\/([A-Za-z0-9_-]+)\/([^\s"'#]+)(?:#([A-Za-z0-9_.-]+))?$/.exec(s);
+    return m ? { provider: m[1], path: m[2], ...(m[3] ? { field: m[3] } : {}) } : undefined;
+}
+export const hasSecretRef = (s) => new RegExp(SECRET_REF.source).test(s);
+/** HashiCorp Vault KV v2. */
+export class VaultProvider {
+    id;
+    cfg;
+    fetchFn;
+    type = 'vault';
+    token;
+    constructor(id, cfg, fetchFn = fetch) {
+        this.id = id;
+        this.cfg = cfg;
+        this.fetchFn = fetchFn;
+        this.token = cfg.token;
+    }
+    base() {
+        return (this.cfg.address ?? '').replace(/\/+$/, '');
+    }
+    async login() {
+        if (this.token)
+            return this.token;
+        if (!this.cfg.roleId || !this.cfg.secretId)
+            throw new Error(`Vault provider "${this.id}" needs token or roleId + secretId`);
+        const r = await this.fetchFn(`${this.base()}/v1/auth/approle/login`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', ...(this.cfg.namespace ? { 'X-Vault-Namespace': this.cfg.namespace } : {}) },
+            body: JSON.stringify({ role_id: this.cfg.roleId, secret_id: this.cfg.secretId }),
+        });
+        if (!r.ok)
+            throw new Error(`Vault AppRole login failed: HTTP ${r.status}`);
+        const body = (await r.json());
+        if (!body.auth?.client_token)
+            throw new Error('Vault AppRole login returned no token');
+        this.token = body.auth.client_token;
+        return this.token;
+    }
+    async read(path) {
+        const mount = this.cfg.mount ?? 'secret';
+        const get = async () => this.fetchFn(`${this.base()}/v1/${mount}/data/${path.replace(/^\/+/, '')}`, {
+            headers: { 'X-Vault-Token': await this.login(), ...(this.cfg.namespace ? { 'X-Vault-Namespace': this.cfg.namespace } : {}) },
+        });
+        let r = await get();
+        if (r.status === 403 && !this.cfg.token && this.cfg.roleId) {
+            this.token = undefined; // expired AppRole token: log in again once
+            r = await get();
+        }
+        if (r.status === 404)
+            throw new Error(`Vault: no secret at ${mount}/${path}`);
+        if (!r.ok)
+            throw new Error(`Vault read ${mount}/${path} failed: HTTP ${r.status}`);
+        const body = (await r.json());
+        return body.data?.data ?? {};
+    }
+}
+const sha256hex = (s) => createHash('sha256').update(s).digest('hex');
+const hmac = (k, s) => createHmac('sha256', k).update(s).digest();
+/** AWS Signature V4 headers for a JSON POST (exported for tests). */
+export function sigv4(opts) {
+    const u = new URL(opts.url);
+    const now = opts.now ?? new Date();
+    const amzDate = now.toISOString().replace(/[:-]|\.\d{3}/g, '');
+    const date = amzDate.slice(0, 8);
+    const headers = { ...opts.headers, host: u.host, 'x-amz-date': amzDate, ...(opts.sessionToken ? { 'x-amz-security-token': opts.sessionToken } : {}) };
+    const names = Object.keys(headers).map((h) => h.toLowerCase()).sort();
+    const lower = Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), String(v).trim()]));
+    const canonical = [opts.method, u.pathname || '/', u.search.slice(1), names.map((n) => `${n}:${lower[n]}\n`).join(''), names.join(';'), sha256hex(opts.body)].join('\n');
+    const scope = `${date}/${opts.region}/${opts.service}/aws4_request`;
+    const toSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256hex(canonical)].join('\n');
+    const kDate = hmac(`AWS4${opts.secretAccessKey}`, date);
+    const kSigning = hmac(hmac(hmac(kDate, opts.region), opts.service), 'aws4_request');
+    const signature = createHmac('sha256', kSigning).update(toSign).digest('hex');
+    return { ...headers, authorization: `AWS4-HMAC-SHA256 Credential=${opts.accessKeyId}/${scope}, SignedHeaders=${names.join(';')}, Signature=${signature}` };
+}
+/** AWS KMS Decrypt; the reference path is the base64 ciphertext blob (URL-safe base64 accepted). */
+export class AwsKmsProvider {
+    id;
+    cfg;
+    fetchFn;
+    type = 'aws-kms';
+    constructor(id, cfg, fetchFn = fetch) {
+        this.id = id;
+        this.cfg = cfg;
+        this.fetchFn = fetchFn;
+    }
+    async read(path) {
+        const region = this.cfg.region ?? process.env.AWS_REGION ?? 'us-east-1';
+        const accessKeyId = this.cfg.accessKeyId ?? process.env.AWS_ACCESS_KEY_ID;
+        const secretAccessKey = this.cfg.secretAccessKey ?? process.env.AWS_SECRET_ACCESS_KEY;
+        if (!accessKeyId || !secretAccessKey)
+            throw new Error(`aws-kms provider "${this.id}" has no credentials`);
+        const url = this.cfg.endpoint ?? `https://kms.${region}.amazonaws.com/`;
+        const body = JSON.stringify({ CiphertextBlob: path.replace(/-/g, '+').replace(/_/g, '/'), ...(this.cfg.keyId ? { KeyId: this.cfg.keyId } : {}) });
+        const headers = sigv4({
+            method: 'POST', url, body, region, service: 'kms', accessKeyId, secretAccessKey,
+            sessionToken: this.cfg.sessionToken ?? process.env.AWS_SESSION_TOKEN,
+            headers: { 'content-type': 'application/x-amz-json-1.1', 'x-amz-target': 'TrentService.Decrypt' },
+        });
+        const r = await this.fetchFn(url, { method: 'POST', headers, body });
+        if (!r.ok)
+            throw new Error(`KMS Decrypt failed: HTTP ${r.status}`);
+        const out = (await r.json());
+        if (typeof out.Plaintext !== 'string')
+            throw new Error('KMS Decrypt returned no plaintext');
+        return Buffer.from(out.Plaintext, 'base64').toString('utf8');
+    }
+}
+/** Google Cloud KMS decrypt; path `<projects/…/cryptoKeys/key>:<base64 ciphertext>`. */
+export class GcpKmsProvider {
+    id;
+    cfg;
+    fetchFn;
+    type = 'gcp-kms';
+    constructor(id, cfg, fetchFn = fetch) {
+        this.id = id;
+        this.cfg = cfg;
+        this.fetchFn = fetchFn;
+    }
+    async read(path) {
+        const i = path.lastIndexOf(':');
+        if (i <= 0)
+            throw new Error('gcp-kms reference must be <cryptoKey>:<ciphertext>');
+        const key = path.slice(0, i);
+        const ciphertext = path.slice(i + 1).replace(/-/g, '+').replace(/_/g, '/');
+        const token = this.cfg.token ?? process.env.GOOGLE_OAUTH_ACCESS_TOKEN;
+        if (!token)
+            throw new Error(`gcp-kms provider "${this.id}" needs token (or GOOGLE_OAUTH_ACCESS_TOKEN)`);
+        const base = (this.cfg.endpoint ?? 'https://cloudkms.googleapis.com').replace(/\/+$/, '');
+        const r = await this.fetchFn(`${base}/v1/${key}:decrypt`, {
+            method: 'POST',
+            headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json' },
+            body: JSON.stringify({ ciphertext }),
+        });
+        if (!r.ok)
+            throw new Error(`Cloud KMS decrypt failed: HTTP ${r.status}`);
+        const out = (await r.json());
+        if (typeof out.plaintext !== 'string')
+            throw new Error('Cloud KMS returned no plaintext');
+        return Buffer.from(out.plaintext, 'base64').toString('utf8');
+    }
+}
+export class EnvProvider {
+    id;
+    type = 'env';
+    constructor(id) {
+        this.id = id;
+    }
+    async read(path) {
+        const v = process.env[path];
+        if (v === undefined)
+            throw new Error(`Environment variable ${path} is not set`);
+        return v;
+    }
+}
+export class FileProvider {
+    id;
+    baseDir;
+    type = 'file';
+    constructor(id, baseDir) {
+        this.id = id;
+        this.baseDir = baseDir;
+    }
+    async read(path) {
+        return (await readFile(isAbsolute(path) ? path : resolvePath(this.baseDir, path), 'utf8')).trim();
+    }
+}
+export function createProvider(cfg, baseDir = process.cwd(), fetchFn) {
+    switch (cfg.type) {
+        case 'vault':
+            return new VaultProvider(cfg.id, cfg, fetchFn);
+        case 'aws-kms':
+            return new AwsKmsProvider(cfg.id, cfg, fetchFn);
+        case 'gcp-kms':
+            return new GcpKmsProvider(cfg.id, cfg, fetchFn);
+        case 'env':
+            return new EnvProvider(cfg.id);
+        case 'file':
+            return new FileProvider(cfg.id, cfg.baseDir ?? baseDir);
+    }
+}
+/** Resolves, caches and rotates secret references. Values never leave this class except into upstream configs. */
+export class SecretManager {
+    config;
+    opts;
+    providers = new Map();
+    cache = new Map();
+    rotated = new Map();
+    errors = new Map();
+    usedBy = new Map();
+    timer;
+    /** Hash of the resolved credentials per server id (rotation detection). */
+    fingerprints = new Map();
+    constructor(config, opts = {}) {
+        this.config = config;
+        this.opts = opts;
+        this.configure();
+    }
+    /** (Re)build providers from config (hot reload). */
+    configure() {
+        const next = new Map();
+        for (const p of this.config()?.providers ?? [])
+            next.set(p.id, createProvider(p, this.opts.baseDir?.() ?? process.cwd(), this.opts.fetch));
+        if (!next.has('env'))
+            next.set('env', new EnvProvider('env'));
+        this.providers = next;
+    }
+    get enabled() {
+        return (this.config()?.providers?.length ?? 0) > 0;
+    }
+    now() {
+        return this.opts.now?.() ?? Date.now();
+    }
+    ttlMs() {
+        return (this.config()?.cacheSeconds ?? 300) * 1000;
+    }
+    /** Resolve one reference (cached for `cacheSeconds`). */
+    async get(ref, opts = {}) {
+        const parsed = parseSecretRef(ref);
+        if (!parsed)
+            throw new Error(`Not a secret reference: ${ref}`);
+        if (opts.user) {
+            let s = this.usedBy.get(ref);
+            if (!s)
+                this.usedBy.set(ref, (s = new Set()));
+            s.add(opts.user);
+        }
+        const hit = this.cache.get(ref);
+        if (hit && !opts.fresh && this.now() - hit.fetchedAt < this.ttlMs())
+            return hit.value;
+        const provider = this.providers.get(parsed.provider);
+        if (!provider)
+            throw new Error(`Unknown secret provider "${parsed.provider}" in ${ref}`);
+        try {
+            const raw = await provider.read(parsed.path);
+            let value;
+            if (typeof raw === 'string') {
+                if (parsed.field) {
+                    const obj = JSON.parse(raw);
+                    value = String(obj[parsed.field] ?? '');
+                }
+                else
+                    value = raw;
+            }
+            else {
+                const v = parsed.field ? raw[parsed.field] : Object.keys(raw).length === 1 ? Object.values(raw)[0] : undefined;
+                if (v === undefined)
+                    throw new Error(`${ref}: field ${parsed.field ? `"${parsed.field}" not found` : 'required (the secret has several keys)'}`);
+                value = String(v);
+            }
+            const version = hit ? (hit.value === value ? hit.version : hit.version + 1) : 1;
+            if (hit && hit.value !== value)
+                this.rotated.set(ref, this.now());
+            this.cache.set(ref, { value, fetchedAt: this.now(), version });
+            this.errors.delete(ref);
+            return value;
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            this.errors.set(ref, msg);
+            // Keep serving the last good value while the provider is down.
+            if (hit) {
+                logger.warn(`Secret ${ref} could not be refreshed (${msg}); keeping the cached value`);
+                return hit.value;
+            }
+            throw err;
+        }
+    }
+    /** Replace every `secret://` reference inside a string. */
+    async interpolate(s, opts = {}) {
+        let src = s;
+        for (const [k, v] of Object.entries(opts.vars ?? {}))
+            src = src.split(`{${k}}`).join(v);
+        const refs = [...src.matchAll(new RegExp(SECRET_REF.source, 'g'))].map((m) => m[0]);
+        let out = src;
+        for (const ref of refs)
+            out = out.split(ref).join(await this.get(ref, opts));
+        return out;
+    }
+    /** A copy of a server config with every reference resolved (env, headers, url, args). */
+    async resolveServer(s, fresh = false) {
+        const user = `server:${s.replicaOf ?? s.id}`;
+        const map = async (rec) => rec ? Object.fromEntries(await Promise.all(Object.entries(rec).map(async ([k, v]) => [k, hasSecretRef(v) ? await this.interpolate(v, { fresh, user }) : v]))) : rec;
+        const out = {
+            ...s,
+            env: await map(s.env),
+            headers: await map(s.headers),
+            ...(s.url && hasSecretRef(s.url) ? { url: await this.interpolate(s.url, { fresh, user }) } : {}),
+            ...(s.args ? { args: await Promise.all(s.args.map((a) => (hasSecretRef(a) ? this.interpolate(a, { fresh, user }) : a))) } : {}),
+        };
+        this.fingerprints.set(s.id, fingerprint(out));
+        return out;
+    }
+    /** Whether a server config references any secret. */
+    static usesSecrets(s) {
+        const vals = [...Object.values(s.env ?? {}), ...Object.values(s.headers ?? {}), s.url ?? '', ...(s.args ?? [])];
+        return vals.some((v) => hasSecretRef(v));
+    }
+    /** Re-resolve a server's references bypassing the cache; returns the new config when its credentials changed. */
+    async rotateServer(s) {
+        const before = this.fingerprints.get(s.id);
+        const next = await this.resolveServer(s, true);
+        return before !== undefined && before !== this.fingerprints.get(s.id) ? next : undefined;
+    }
+    /** Per-call injection values for a server (`inject:`), with `{tenant}` / `{client}` filled in. */
+    async injections(s, ctx) {
+        const out = [];
+        for (const inj of s?.inject ?? []) {
+            if (inj.ref.includes('{tenant}') && !ctx.tenant) {
+                if (inj.required !== false)
+                    throw new Error(`Server "${s.id}" needs a tenant to inject ${inj.argument ?? inj.meta}`);
+                continue;
+            }
+            const vars = { tenant: ctx.tenant ?? '', client: (ctx.clientId ?? 'anonymous').replace(/[^A-Za-z0-9_.-]/g, '_') };
+            const value = await this.interpolate(inj.ref, { vars, user: `server:${s.id}` });
+            out.push({ ...(inj.argument ? { argument: inj.argument } : {}), ...(inj.meta ? { meta: inj.meta } : {}), value: inj.format ? inj.format.split('{value}').join(value) : value });
+        }
+        return out;
+    }
+    /** Start periodic rotation; `onRotated` reconnects a server whose credentials changed. */
+    startRotation(servers, onRotated) {
+        this.stopRotation();
+        const sec = this.config()?.rotation?.intervalSeconds;
+        if (!sec)
+            return;
+        this.timer = setInterval(() => void this.rotateAll(servers(), onRotated), sec * 1000);
+        this.timer.unref();
+    }
+    async rotateAll(servers, onRotated) {
+        const changed = [];
+        for (const s of servers) {
+            if (s.enabled === false || !SecretManager.usesSecrets(s))
+                continue;
+            try {
+                const next = await this.rotateServer(s);
+                if (next) {
+                    changed.push(s.id);
+                    logger.info(`Credentials of "${s.id}" rotated; reconnecting`);
+                    await onRotated(next);
+                }
+            }
+            catch (err) {
+                logger.warn(`Secret rotation for "${s.id}" failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        return changed;
+    }
+    stopRotation() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = undefined;
+    }
+    /** Status of every reference seen so far — never the values. */
+    status() {
+        const refs = new Set([...this.cache.keys(), ...this.errors.keys(), ...this.usedBy.keys()]);
+        return [...refs].sort().map((ref) => {
+            const p = parseSecretRef(ref);
+            const c = this.cache.get(ref);
+            const r = this.rotated.get(ref);
+            return {
+                ref,
+                provider: p.provider,
+                type: this.providers.get(p.provider)?.type ?? 'unknown',
+                version: c?.version ?? 0,
+                ...(c ? { fetchedAt: new Date(c.fetchedAt).toISOString() } : {}),
+                ...(r ? { rotatedAt: new Date(r).toISOString() } : {}),
+                ...(this.errors.has(ref) ? { error: this.errors.get(ref) } : {}),
+                usedBy: [...(this.usedBy.get(ref) ?? [])].sort(),
+            };
+        });
+    }
+    providerList() {
+        return [...this.providers.values()].map((p) => ({ id: p.id, type: p.type }));
+    }
+    /** Every resolved value (for log redaction). */
+    values() {
+        return [...this.cache.values()].map((c) => c.value).filter((v) => v.length >= 4);
+    }
+}
+function fingerprint(s) {
+    return sha256hex(JSON.stringify([s.env ?? {}, s.headers ?? {}, s.url ?? '', s.args ?? []]));
+}
+//# sourceMappingURL=index.js.map

package/dist/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,MAAM,CAAC;AAE1D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAE5C,MAAM,CAAC,MAAM,UAAU,GAAG,kEAAkE,CAAC;AAQ7F,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,MAAM,CAAC,GAAG,mEAAmE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5F,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAW1F,6BAA6B;AAC7B,MAAM,OAAO,aAAa;IAIb;IACQ;IACA;IALV,IAAI,GAAG,OAAO,CAAC;IAChB,KAAK,CAAU;IACvB,YACW,EAAU,EACF,GAAyB,EACzB,UAAmB,KAAK;QAFhC,OAAE,GAAF,EAAE,CAAQ;QACF,QAAG,GAAH,GAAG,CAAsB;QACzB,YAAO,GAAP,OAAO,CAAiB;QAEzC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IACzB,CAAC;IAEO,IAAI;QACV,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,KAAK;QACjB,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,CAAC,EAAE,oCAAoC,CAAC,CAAC;QAC5H,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,wBAAwB,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC3H,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;SACjF,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAyC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACvF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC;QACpC,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,QAAQ,CAAC;QACzC,MAAM,GAAG,GAAG,KAAK,IAAI,EAAE,CACrB,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE;YAC1E,OAAO,EAAE,EAAE,eAAe,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SAC7H,CAAC,CAAC;QACL,IAAI,CAAC,GAAG,MAAM,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAC3D,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,2CAA2C;YACnE,CAAC,GAAG,MAAM,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAkD,CAAC;QAC/E,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;IAC/B,CAAC;CACF;AAED,MAAM,SAAS,GAAG,CAAC,CAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACvF,MAAM,IAAI,GAAG,CAAC,CAAkB,EAAE,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;AAE3F,qEAAqE;AACrE,MAAM,UAAU,KAAK,CAAC,IAWrB;IACC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,MAAM,OAAO,GAA2B,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9K,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzK,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,eAAe,CAAC;IACpE,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;IACpF,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,EAAE,GAAG,OAAO,EAAE,aAAa,EAAE,+BAA+B,IAAI,CAAC,WAAW,IAAI,KAAK,mBAAmB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,SAAS,EAAE,EAAE,CAAC;AAC7J,CAAC;AAED,oGAAoG;AACpG,MAAM,OAAO,cAAc;IAGd;IACQ;IACA;IAJV,IAAI,GAAG,SAAS,CAAC;IAC1B,YACW,EAAU,EACF,GAAyB,EACzB,UAAmB,KAAK;QAFhC,OAAE,GAAF,EAAE,CAAQ;QACF,QAAG,GAAH,GAAG,CAAsB;QACzB,YAAO,GAAP,OAAO,CAAiB;IACxC,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;QACxE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC1E,MAAM,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QACtF,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC1G,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,eAAe,MAAM,iBAAiB,CAAC;QACxE,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClJ,MAAM,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,eAAe;YAC/E,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;YACpE,OAAO,EAAE,EAAE,cAAc,EAAE,4BAA4B,EAAE,cAAc,EAAE,sBAAsB,EAAE;SAClG,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAA2B,CAAC;QACvD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC5F,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,wFAAwF;AACxF,MAAM,OAAO,cAAc;IAGd;IACQ;IACA;IAJV,IAAI,GAAG,SAAS,CAAC;IAC1B,YACW,EAAU,EACF,GAAyB,EACzB,UAAmB,KAAK;QAFhC,OAAE,GAAF,EAAE,CAAQ;QACF,QAAG,GAAH,GAAG,CAAsB;QACzB,YAAO,GAAP,OAAO,CAAiB;IACxC,CAAC;IAEJ,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACtE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,CAAC,EAAE,8CAA8C,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,iCAAiC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,GAAG,UAAU,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAA2B,CAAC;QACvD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC1F,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;CACF;AAED,MAAM,OAAO,WAAW;IAED;IADZ,IAAI,GAAG,KAAK,CAAC;IACtB,YAAqB,EAAU;QAAV,OAAE,GAAF,EAAE,CAAQ;IAAG,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,aAAa,CAAC,CAAC;QAChF,OAAO,CAAC,CAAC;IACX,CAAC;CACF;AAED,MAAM,OAAO,YAAY;IAGZ;IACQ;IAHV,IAAI,GAAG,MAAM,CAAC;IACvB,YACW,EAAU,EACF,OAAe;QADvB,OAAE,GAAF,EAAE,CAAQ;QACF,YAAO,GAAP,OAAO,CAAQ;IAC/B,CAAC;IACJ,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,OAAO,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpG,CAAC;CACF;AAED,MAAM,UAAU,cAAc,CAAC,GAAyB,EAAE,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,OAAiB;IAClG,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,OAAO;YACV,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACjD,KAAK,SAAS;YACZ,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,KAAK,SAAS;YACZ,OAAO,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,KAAK,KAAK;YACR,OAAO,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,KAAK,MAAM;YACT,OAAO,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAmBD,kHAAkH;AAClH,MAAM,OAAO,aAAa;IAWd;IACS;IAXX,SAAS,GAAG,IAAI,GAAG,EAA0B,CAAC;IACrC,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IACtC,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACnC,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IACjD,KAAK,CAAkB;IAC/B,2EAA2E;IAC1D,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1D,YACU,MAAuC,EAC9B,OAAoF,EAAE;QAD/F,WAAM,GAAN,MAAM,CAAiC;QAC9B,SAAI,GAAJ,IAAI,CAAkF;QAEvG,IAAI,CAAC,SAAS,EAAE,CAAC;IACnB,CAAC;IAED,oDAAoD;IACpD,SAAS;QACP,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAC;QAC/C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,IAAI,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3I,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,IAAI,OAAO;QACT,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IAEO,GAAG;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAEO,KAAK;QACX,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC;IACrD,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,OAA2C,EAAE;QAClE,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;QAC/D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,CAAC,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,EAAE;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,MAAM,CAAC,QAAQ,QAAQ,GAAG,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,KAAa,CAAC;YAClB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;oBACjB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;oBACvD,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC1C,CAAC;;oBAAM,KAAK,GAAG,GAAG,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC/G,IAAI,CAAC,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,WAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,wCAAwC,EAAE,CAAC,CAAC;gBACjJ,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1B,+DAA+D;YAC/D,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,4BAA4B,GAAG,6BAA6B,CAAC,CAAC;gBACvF,OAAO,GAAG,CAAC,KAAK,CAAC;YACnB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,WAAW,CAAC,CAAS,EAAE,OAA0E,EAAE;QACvG,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpF,IAAI,GAAG,GAAG,GAAG,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7E,OAAO,GAAG,CAAC;IACb,CAAC;IAED,yFAAyF;IACzF,KAAK,CAAC,aAAa,CAAC,CAAkB,EAAE,KAAK,GAAG,KAAK;QACnD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,KAAK,EAAE,GAA4B,EAAE,EAAE,CACjD,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/K,MAAM,GAAG,GAAoB;YAC3B,GAAG,CAAC;YACJ,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACrB,OAAO,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;YAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChI,CAAC;QACF,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,qDAAqD;IACrD,MAAM,CAAC,WAAW,CAAC,CAAkB;QACnC,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QAChH,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,YAAY,CAAC,CAAkB;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,UAAU,CAAC,CAA8B,EAAE,GAA2C;QAC1F,MAAM,GAAG,GAA+D,EAAE,CAAC;QAC3E,KAAK,MAAM,GAAG,IAAI,CAAC,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;YAClC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChD,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK;oBAAE,MAAM,IAAI,KAAK,CAAC,WAAW,CAAE,CAAC,EAAE,8BAA8B,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtH,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,CAAC;YAClH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACjF,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAClL,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,0FAA0F;IAC1F,aAAa,CAAC,OAAgC,EAAE,SAAmD;QACjG,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,eAAe,CAAC;QACrD,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAA0B,EAAE,SAAmD;QAC7F,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;gBAAE,SAAS;YACnE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;gBACxC,IAAI,IAAI,EAAE,CAAC;oBACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACnB,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;oBAC9D,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,EAAE,aAAa,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,YAAY;QACV,IAAI,IAAI,CAAC,KAAK;YAAE,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,gEAAgE;IAChE,MAAM;QACJ,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3F,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAClC,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChC,OAAO;gBACL,GAAG;gBACH,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,SAAS;gBACvD,OAAO,EAAE,CAAC,EAAE,OAAO,IAAI,CAAC;gBACxB,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;aACjD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,YAAY;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,gDAAgD;IAChD,MAAM;QACJ,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IACnF,CAAC;CACF;AAED,SAAS,WAAW,CAAC,CAAkB;IACrC,OAAO,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9F,CAAC"}

package/dist/utils/types.d.ts

@@ -78,6 +78,10 @@ export interface McpServerConfig {
     loadBalancing?: LoadBalancingConfig;
     /** Relative weight for `strategy: weighted` (default 1). */
     weight?: number;
+    /** Relative cost per call, for `strategy: smart` (3.4). */
+    cost?: number;
+    /** Per-call credentials from `secrets:` providers, per tenant / client (3.5). */
+    inject?: SecretInjection[];
     /** Set on the internal replica servers (`<id>~<n>`): id of the logical server. */
     replicaOf?: string;
 }
@@ -91,11 +95,19 @@ export interface ReplicaConfig {
     env?: Record<string, string>;
     headers?: Record<string, string>;
     weight?: number;
+    /** Relative cost per call, for `strategy: smart` (3.4). */
+    cost?: number;
     enabled?: boolean;
 }
 export interface LoadBalancingConfig {
-    /** `round-robin` (default), `random`, `weighted`, `least-latency` or `failover` (primary first). */
-    strategy?: 'round-robin' | 'random' | 'weighted' | 'least-latency' | 'failover';
+    /** `round-robin` (default), `random`, `weighted`, `least-latency`, `failover` (primary first) or `smart` (3.4). */
+    strategy?: 'round-robin' | 'random' | 'weighted' | 'least-latency' | 'failover' | 'smart';
+    /** `smart` only: weights of the score terms (defaults latency 1, errorRate 1, cost 0). */
+    score?: {
+        latency?: number;
+        errorRate?: number;
+        cost?: number;
+    };
     /** Failure kinds retried on the next member (default `[not-connected]`; `timeout` / `error` may re-run a tool). */
     failoverOn?: Array<'not-connected' | 'timeout' | 'error'>;
     /** Extra attempts per call (default: members - 1). */
@@ -180,6 +192,10 @@ export interface GatewayConfig {
     cache?: CacheConfig;
     /** Request capture + replay / debugger (3.2). Off by default. */
     replay?: ReplayConfig;
+    /** Secret providers (Vault / KMS / env / file) and rotation (3.5). */
+    secrets?: SecretsConfig;
+    /** Traffic splits: canary / A-B across servers (3.4). */
+    routing?: RoutingConfig;
     /** Plugins (hooks: onRequest, onToolCall before policy, onResponse after the output filter). */
     plugins?: PluginConfig[];
     /** OpenAI-compatible tools proxy (`/openai/v1/tools`, `/tool_calls`, `/chat/completions`). */
@@ -435,6 +451,81 @@ export interface McpEndpointConfig {
     passthrough?: McpPassthroughConfig;
 }
 /** Which upstream→client requests are relayed to the downstream client that made the call (3.1). */
+/** Secrets management (3.5). */
+export interface SecretsConfig {
+    providers?: SecretProviderConfig[];
+    /** How long a resolved value is cached (default 300 s). */
+    cacheSeconds?: number;
+    /** Re-resolve server credentials periodically and reconnect servers whose credentials changed. */
+    rotation?: {
+        intervalSeconds?: number;
+    };
+}
+export interface SecretProviderConfig {
+    /** Referenced as `secret://<id>/...`. */
+    id: string;
+    type: 'vault' | 'aws-kms' | 'gcp-kms' | 'env' | 'file';
+    /** vault: server address. */
+    address?: string;
+    /** vault: token; gcp-kms: OAuth access token. */
+    token?: string;
+    /** vault: AppRole login (instead of token). */
+    roleId?: string;
+    secretId?: string;
+    /** vault: KV v2 mount (default `secret`). */
+    mount?: string;
+    namespace?: string;
+    /** aws-kms. */
+    region?: string;
+    keyId?: string;
+    accessKeyId?: string;
+    secretAccessKey?: string;
+    sessionToken?: string;
+    /** aws-kms / gcp-kms: API endpoint override. */
+    endpoint?: string;
+    /** file: base directory (default: the config directory). */
+    baseDir?: string;
+}
+/** One per-call credential injected into a server's calls (3.5). */
+export interface SecretInjection {
+    /** `secret://…` reference; `{tenant}` / `{client}` are replaced per call. */
+    ref: string;
+    /** Tool argument to set (tools only). */
+    argument?: string;
+    /** `_meta` key to set. */
+    meta?: string;
+    /** e.g. `Bearer {value}`. */
+    format?: string;
+    /** Refuse the call when `{tenant}` is used and the caller has no tenant (default true). */
+    required?: boolean;
+}
+/** Smart routing (3.4). */
+export interface RoutingConfig {
+    splits?: TrafficSplitConfig[];
+}
+/** One traffic split: calls for `server` (optionally only `tools`) spread over `variants` by weight. */
+export interface TrafficSplitConfig {
+    name: string;
+    /** Server id the clients call. */
+    server: string;
+    /** Tool globs the split applies to (default: every tool). */
+    tools?: string[];
+    /** `client` (default): a client always gets the same variant; `none`: per call. */
+    sticky?: 'client' | 'none';
+    enabled?: boolean;
+    variants: Array<{
+        /** Server id that serves this share (the baseline is usually `server` itself). */
+        server: string;
+        weight: number;
+        label?: string;
+        /** Automatic rollback of this variant (weight 0) when a limit is crossed after `minCalls` (default 20). */
+        guard?: {
+            maxErrorRate?: number;
+            maxLatencyMs?: number;
+            minCalls?: number;
+        };
+    }>;
+}
 /** Request capture for the replay debugger (3.2). */
 export interface ReplayConfig {
     /** Keep redacted arguments / results of recent calls in memory and allow replays (default false). */