defense-mcp-server 0.6.0

package/build/core/parsers.js

@@ -0,0 +1,479 @@
+/**
+ * Output parsing utilities for defensive security tool output.
+ * Converts raw command output into structured data for MCP responses.
+ */
+// ─── Generic Parsers ─────────────────────────────────────────────
+/**
+ * Parses key:value pair output into a Record.
+ * Lines without the separator are skipped.
+ */
+export function parseKeyValue(output, separator = ":") {
+    const result = {};
+    for (const line of output.split("\n")) {
+        const idx = line.indexOf(separator);
+        if (idx === -1)
+            continue;
+        const key = line.substring(0, idx).trim();
+        const value = line.substring(idx + separator.length).trim();
+        if (key.length > 0) {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Parses whitespace-delimited table output into an array of Records.
+ * First non-empty line is treated as the header row.
+ */
+export function parseTable(output) {
+    const lines = output
+        .split("\n")
+        .map((l) => l.trim())
+        .filter((l) => l.length > 0);
+    if (lines.length < 2)
+        return [];
+    const headers = lines[0].split(/\s+/).map((h) => h.toLowerCase());
+    const rows = [];
+    for (let i = 1; i < lines.length; i++) {
+        const values = lines[i].split(/\s+/);
+        const row = {};
+        for (let j = 0; j < headers.length; j++) {
+            // Last column gets remainder of line to handle values with spaces
+            if (j === headers.length - 1) {
+                row[headers[j]] = values.slice(j).join(" ");
+            }
+            else {
+                row[headers[j]] = values[j] ?? "";
+            }
+        }
+        rows.push(row);
+    }
+    return rows;
+}
+/**
+ * Safely parses JSON text. Returns null on parse failure.
+ */
+export function parseJsonSafe(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Formats any data into MCP text content.
+ * Objects are JSON-stringified with indentation.
+ */
+export function formatToolOutput(data) {
+    if (typeof data === "string") {
+        return { type: "text", text: data };
+    }
+    return { type: "text", text: JSON.stringify(data, null, 2) };
+}
+/**
+ * Creates a simple MCP text content object.
+ */
+export function createTextContent(text) {
+    return { type: "text", text };
+}
+/**
+ * Creates an MCP text content object with an error prefix.
+ */
+export function createErrorContent(msg) {
+    return { type: "text", text: `Error: ${msg}` };
+}
+/**
+ * Parses `iptables -L -n -v` output into structured rules.
+ */
+export function parseIptablesOutput(output) {
+    const rules = [];
+    let currentChain = "";
+    let currentPolicy = "";
+    for (const line of output.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        // Chain header: "Chain INPUT (policy ACCEPT 0 packets, 0 bytes)"
+        const chainMatch = trimmed.match(/^Chain\s+(\S+)\s+\(policy\s+(\S+).*\)/);
+        if (chainMatch) {
+            currentChain = chainMatch[1];
+            currentPolicy = chainMatch[2];
+            continue;
+        }
+        // Chain header without policy: "Chain DOCKER (1 references)"
+        const chainRefMatch = trimmed.match(/^Chain\s+(\S+)\s+\(/);
+        if (chainRefMatch) {
+            currentChain = chainRefMatch[1];
+            currentPolicy = "";
+            continue;
+        }
+        // Skip table header
+        if (trimmed.startsWith("pkts") || trimmed.startsWith("num"))
+            continue;
+        // Rule line: "pkts bytes target prot opt in out source destination extra..."
+        const parts = trimmed.split(/\s+/);
+        if (parts.length >= 9) {
+            rules.push({
+                chain: currentChain,
+                policy: currentPolicy || undefined,
+                packets: parts[0],
+                bytes: parts[1],
+                target: parts[2],
+                protocol: parts[3],
+                opt: parts[4],
+                in: parts[5],
+                out: parts[6],
+                source: parts[7],
+                destination: parts[8],
+                extra: parts.slice(9).join(" "),
+            });
+        }
+    }
+    return rules;
+}
+/**
+ * Parses `nft list ruleset` output into structured sections.
+ */
+export function parseNftOutput(output) {
+    const result = {};
+    let currentTable = "";
+    for (const line of output.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        const tableMatch = trimmed.match(/^table\s+(\S+\s+\S+)\s*\{/);
+        if (tableMatch) {
+            currentTable = tableMatch[1];
+            result[currentTable] = [];
+            continue;
+        }
+        if (currentTable && trimmed !== "}") {
+            result[currentTable]?.push(trimmed);
+        }
+        if (trimmed === "}" && currentTable) {
+            currentTable = "";
+        }
+    }
+    return result;
+}
+/**
+ * Parses `sysctl -a` output into structured entries.
+ */
+export function parseSysctlOutput(output) {
+    const entries = [];
+    for (const line of output.split("\n")) {
+        const idx = line.indexOf("=");
+        if (idx === -1)
+            continue;
+        const key = line.substring(0, idx).trim();
+        const value = line.substring(idx + 1).trim();
+        if (key.length > 0) {
+            entries.push({ key, value });
+        }
+    }
+    return entries;
+}
+/**
+ * Parses `ausearch` output into structured audit entries.
+ */
+export function parseAuditdOutput(output) {
+    const entries = [];
+    let current = null;
+    for (const line of output.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith("----") || trimmed.startsWith("time->"))
+            continue;
+        // type=SYSCALL msg=audit(1234567890.123:456): ...
+        const typeMatch = trimmed.match(/^type=(\S+)\s+msg=audit\(([^)]+)\):\s*(.*)/);
+        if (typeMatch) {
+            current = {
+                type: typeMatch[1],
+                timestamp: typeMatch[2],
+                fields: {},
+            };
+            // Parse key=value pairs from rest of line
+            const rest = typeMatch[3];
+            const kvRe = /(\w+)=("[^"]*"|\S+)/g;
+            let match;
+            while ((match = kvRe.exec(rest)) !== null) {
+                current.fields[match[1]] = match[2].replace(/^"|"$/g, "");
+            }
+            entries.push(current);
+        }
+    }
+    return entries;
+}
+/**
+ * Parses Lynis audit output for findings/warnings/suggestions.
+ */
+export function parseLynisOutput(output) {
+    const findings = [];
+    for (const line of output.split("\n")) {
+        const trimmed = line.trim();
+        // Warning: [TEST-ID] Description
+        const warningMatch = trimmed.match(/^\s*Warning:\s*\[(\S+)\]\s*(.*)/);
+        if (warningMatch) {
+            findings.push({
+                severity: "warning",
+                testId: warningMatch[1],
+                description: warningMatch[2],
+            });
+            continue;
+        }
+        // Suggestion: [TEST-ID] Description
+        const suggestionMatch = trimmed.match(/^\s*Suggestion:\s*\[(\S+)\]\s*(.*)/);
+        if (suggestionMatch) {
+            findings.push({
+                severity: "suggestion",
+                testId: suggestionMatch[1],
+                description: suggestionMatch[2],
+            });
+            continue;
+        }
+        // * Finding [TEST-ID]
+        const findingMatch = trimmed.match(/^\s*\*\s*Finding\s*\[(\S+)\]\s*(.*)/);
+        if (findingMatch) {
+            findings.push({
+                severity: "finding",
+                testId: findingMatch[1],
+                description: findingMatch[2],
+            });
+        }
+    }
+    return findings;
+}
+/**
+ * Parses OpenSCAP text/XML results output.
+ * Handles the common text report format.
+ */
+export function parseOscapOutput(output) {
+    const results = [];
+    // Match rule results from oscap text output
+    // Title
+    //   Rule ID: xccdf_...
+    //   Result: pass/fail/notapplicable
+    //   Severity: low/medium/high
+    let currentTitle = "";
+    let currentRule = {};
+    for (const line of output.split("\n")) {
+        const trimmed = line.trim();
+        const titleMatch = trimmed.match(/^Title\s*:\s*(.*)/);
+        if (titleMatch) {
+            currentTitle = titleMatch[1];
+            currentRule = { title: currentTitle };
+            continue;
+        }
+        const ruleMatch = trimmed.match(/^Rule\s*:\s*(.*)/);
+        if (ruleMatch) {
+            currentRule.ruleId = ruleMatch[1];
+            continue;
+        }
+        const resultMatch = trimmed.match(/^Result\s*:\s*(.*)/);
+        if (resultMatch) {
+            currentRule.result = resultMatch[1];
+            continue;
+        }
+        const sevMatch = trimmed.match(/^Severity\s*:\s*(.*)/);
+        if (sevMatch) {
+            currentRule.severity = sevMatch[1];
+            // We have all fields, push the result
+            if (currentRule.ruleId && currentRule.result) {
+                results.push({
+                    ruleId: currentRule.ruleId,
+                    result: currentRule.result,
+                    severity: currentRule.severity ?? "unknown",
+                    title: currentRule.title ?? "",
+                });
+            }
+            currentRule = {};
+        }
+    }
+    return results;
+}
+/**
+ * Parses `clamscan` output into structured results.
+ */
+export function parseClamavOutput(output) {
+    const results = [];
+    for (const line of output.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        // /path/to/file: OK
+        if (trimmed.endsWith(": OK")) {
+            results.push({
+                file: trimmed.slice(0, -4),
+                status: "OK",
+            });
+            continue;
+        }
+        // /path/to/file: VirusName FOUND
+        const foundMatch = trimmed.match(/^(.+?):\s+(.+?)\s+FOUND$/);
+        if (foundMatch) {
+            results.push({
+                file: foundMatch[1],
+                status: "FOUND",
+                virus: foundMatch[2],
+            });
+            continue;
+        }
+        // /path/to/file: Error message ERROR
+        const errorMatch = trimmed.match(/^(.+?):\s+.*ERROR$/);
+        if (errorMatch) {
+            results.push({
+                file: errorMatch[1],
+                status: "ERROR",
+            });
+        }
+    }
+    return results;
+}
+/**
+ * Parses `ss -tulnp` output into structured entries.
+ */
+export function parseSsOutput(output) {
+    const entries = [];
+    const lines = output.split("\n");
+    // Skip header
+    for (let i = 1; i < lines.length; i++) {
+        const line = lines[i].trim();
+        if (!line)
+            continue;
+        // ss -tulnp columns:
+        //   0: Netid  1: State  2: Recv-Q  3: Send-Q  4: Local Address:Port  5: Peer Address:Port  6+: Process
+        const parts = line.split(/\s+/);
+        if (parts.length >= 6) {
+            entries.push({
+                state: parts[1],
+                recv: parts[2],
+                send: parts[3],
+                local: parts[4],
+                peer: parts[5],
+                process: parts.slice(6).join(" "),
+            });
+        }
+    }
+    return entries;
+}
+/**
+ * Parses `fail2ban-client status` output.
+ */
+export function parseFail2banOutput(output) {
+    const jails = [];
+    let current = null;
+    for (const line of output.split("\n")) {
+        const trimmed = line.trim();
+        // Jail name from status output
+        const jailMatch = trimmed.match(/^Status for the jail:\s*(\S+)/);
+        if (jailMatch) {
+            current = { name: jailMatch[1], bannedIPs: [] };
+            continue;
+        }
+        if (!current)
+            continue;
+        const kvMatch = trimmed.match(/^\|-\s*(\S.*?):\s*(.*)/);
+        if (kvMatch) {
+            const key = kvMatch[1].trim().toLowerCase();
+            const value = kvMatch[2].trim();
+            if (key.includes("currently failed")) {
+                current.currentlyFailed = parseInt(value, 10) || 0;
+            }
+            else if (key.includes("total failed")) {
+                current.totalFailed = parseInt(value, 10) || 0;
+            }
+            else if (key.includes("currently banned")) {
+                current.currentlyBanned = parseInt(value, 10) || 0;
+            }
+            else if (key.includes("total banned")) {
+                current.totalBanned = parseInt(value, 10) || 0;
+            }
+            else if (key.includes("banned ip")) {
+                current.bannedIPs = value
+                    .split(/\s+/)
+                    .filter((ip) => ip.length > 0);
+            }
+            continue;
+        }
+        const leafMatch = trimmed.match(/^`-\s*(\S.*?):\s*(.*)/);
+        if (leafMatch) {
+            const key = leafMatch[1].trim().toLowerCase();
+            const value = leafMatch[2].trim();
+            if (key.includes("currently failed")) {
+                current.currentlyFailed = parseInt(value, 10) || 0;
+            }
+            else if (key.includes("total failed")) {
+                current.totalFailed = parseInt(value, 10) || 0;
+            }
+            else if (key.includes("currently banned")) {
+                current.currentlyBanned = parseInt(value, 10) || 0;
+            }
+            else if (key.includes("total banned")) {
+                current.totalBanned = parseInt(value, 10) || 0;
+            }
+            else if (key.includes("banned ip")) {
+                current.bannedIPs = value
+                    .split(/\s+/)
+                    .filter((ip) => ip.length > 0);
+                // Last field, push the jail
+                jails.push({
+                    name: current.name ?? "unknown",
+                    status: current.status ?? "active",
+                    currentlyFailed: current.currentlyFailed ?? 0,
+                    totalFailed: current.totalFailed ?? 0,
+                    currentlyBanned: current.currentlyBanned ?? 0,
+                    totalBanned: current.totalBanned ?? 0,
+                    bannedIPs: current.bannedIPs ?? [],
+                });
+                current = null;
+            }
+        }
+    }
+    // Push any remaining jail
+    if (current?.name) {
+        jails.push({
+            name: current.name,
+            status: current.status ?? "active",
+            currentlyFailed: current.currentlyFailed ?? 0,
+            totalFailed: current.totalFailed ?? 0,
+            currentlyBanned: current.currentlyBanned ?? 0,
+            totalBanned: current.totalBanned ?? 0,
+            bannedIPs: current.bannedIPs ?? [],
+        });
+    }
+    return jails;
+}
+/**
+ * Parses `systemctl list-units` output into structured entries.
+ */
+export function parseSystemctlOutput(output) {
+    const units = [];
+    const lines = output.split("\n");
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        // Skip header lines and legend
+        if (trimmed.startsWith("UNIT") ||
+            trimmed.startsWith("LOAD") ||
+            trimmed.startsWith("To show") ||
+            trimmed.includes("loaded units listed") ||
+            trimmed.startsWith("LEGEND")) {
+            continue;
+        }
+        // "● unit.service  loaded  active  running  Description text"
+        // or "unit.service  loaded  active  running  Description text"
+        const cleanLine = trimmed.replace(/^[●○]\s*/, "");
+        const parts = cleanLine.split(/\s+/);
+        if (parts.length >= 4) {
+            units.push({
+                unit: parts[0],
+                load: parts[1],
+                active: parts[2],
+                sub: parts[3],
+                description: parts.slice(4).join(" "),
+            });
+        }
+    }
+    return units;
+}

package/build/core/policy-engine.d.ts

@@ -0,0 +1,170 @@
+/**
+ * Severity levels for policy rules, aligned with common security frameworks.
+ */
+export type PolicySeverity = "critical" | "high" | "medium" | "low" | "info";
+/**
+ * A single compliance policy rule defining a check and optional remediation.
+ */
+export interface PolicyRule {
+    /** Unique rule identifier (e.g., "CIS-1.1.1") */
+    id: string;
+    /** Human-readable title */
+    title: string;
+    /** Detailed description of what this rule checks */
+    description: string;
+    /** Severity of non-compliance */
+    severity: PolicySeverity;
+    /** Category (e.g., "filesystem", "network", "authentication") */
+    category: string;
+    /** Command to run to check compliance (array: [command, ...args]) */
+    check: string[];
+    /** Expected output pattern (regex string or exact match) */
+    expectedOutput?: string;
+    /** Command to remediate non-compliance (array: [command, ...args]) */
+    remediation?: string[];
+    /** Reference IDs (e.g., CIS benchmark, NIST control IDs) */
+    references?: string[];
+}
+/**
+ * Result of evaluating a single policy rule.
+ */
+export interface PolicyResult {
+    /** The rule that was evaluated */
+    rule: PolicyRule;
+    /** Whether the system passed this check */
+    passed: boolean;
+    /** Actual output from the check command */
+    actual: string;
+    /** Human-readable result message */
+    message: string;
+}
+/**
+ * A collection of policy rules forming a compliance policy set.
+ */
+export interface PolicySet {
+    /** Policy set name (e.g., "CIS Level 1 - Server") */
+    name: string;
+    /** Version of this policy set */
+    version: string;
+    /** Description of the policy set */
+    description: string;
+    /** Array of policy rules */
+    rules: PolicyRule[];
+}
+/**
+ * Summary of a policy evaluation.
+ */
+export interface PolicyEvaluationSummary {
+    /** Policy set that was evaluated */
+    policyName: string;
+    /** Total number of rules */
+    totalRules: number;
+    /** Number of rules that passed */
+    passed: number;
+    /** Number of rules that failed */
+    failed: number;
+    /** Number of rules with errors */
+    errors: number;
+    /** Compliance percentage (0-100) */
+    compliancePercent: number;
+    /** Individual rule results */
+    results: PolicyResult[];
+}
+/**
+ * Validates a policy rule's check (or remediation) command array.
+ *
+ * Security controls:
+ * 1. Command (check[0]) must be in the security allowlist
+ * 2. Shell interpreters are explicitly blocked (even if allowlisted)
+ * 3. Arguments are checked for null bytes and control characters
+ *
+ * Note: Shell metacharacters (|, &, $, etc.) in arguments are NOT blocked
+ * because policy rules use execFile (no shell), making these characters
+ * harmless literal values. Policy rules legitimately need regex
+ * metacharacters as arguments to grep/awk/sed.
+ *
+ * @param check The command array [command, ...args]
+ * @param label Human-readable label for error messages (e.g., "check", "remediation")
+ * @throws {Error} If validation fails
+ */
+export declare function validateRuleCheck(check: string[], label?: string): void;
+/**
+ * SECURITY (CORE-009): ReDoS (Regular Expression Denial of Service) protection.
+ *
+ * Safely tests a regex pattern against input with multiple layers of defense
+ * against catastrophic backtracking:
+ *
+ * 1. **Length limit**: Patterns longer than 200 characters are rejected to reduce
+ *    the attack surface for complex regex injection.
+ * 2. **Nested quantifier detection**: Patterns like `(a+)+`, `(a*)*`, `(a+)*`
+ *    are rejected because they cause exponential backtracking on non-matching
+ *    input. The check uses two heuristics:
+ *    - Repeated quantifiers: `a++`, `a**`, `{n,m}{` (possessive-like syntax
+ *      that JavaScript doesn't support, indicating malformed patterns)
+ *    - Group-level nesting: `([...]+)+` or `([...]*)*` where a quantified
+ *      group is itself quantified
+ * 3. **try-catch**: Invalid regex syntax is caught and reported clearly.
+ *
+ * These checks are applied to user-supplied `expectedOutput` regex patterns
+ * in policy rules before they are compiled or executed.
+ *
+ * @param pattern The regex pattern string
+ * @param input The string to test against
+ * @returns Whether the pattern matches the input
+ * @throws {Error} If the pattern is dangerous, invalid, or too long
+ */
+export declare function safeRegexTest(pattern: string, input: string): boolean;
+/**
+ * Evaluates a single policy rule by executing its check command
+ * and comparing the output against the expected pattern.
+ *
+ * Before execution, the check command is validated against the
+ * security allowlist and shell interpreters are blocked.
+ *
+ * @param rule The policy rule to evaluate
+ * @returns The evaluation result
+ */
+export declare function evaluateRule(rule: PolicyRule): Promise<PolicyResult>;
+/**
+ * Evaluates all rules in a policy set and returns a summary.
+ *
+ * @param policySet The policy set to evaluate
+ * @returns Evaluation summary with individual results
+ */
+export declare function evaluatePolicy(policySet: PolicySet): Promise<PolicyEvaluationSummary>;
+/**
+ * Loads a policy set from a JSON file with strict schema validation.
+ *
+ * Validates:
+ * 1. JSON structure via Zod schema (field types, lengths, required fields)
+ * 2. All check commands against the security allowlist
+ * 3. All remediation commands against the security allowlist
+ *
+ * @param path Absolute or relative path to the policy JSON file
+ * @returns The loaded and validated policy set
+ * @throws If the file cannot be read, parsed, or fails validation
+ */
+export declare function loadPolicy(path: string): PolicySet;
+/**
+ * Saves a policy set to a JSON file with secure permissions.
+ * Creates parent directories with owner-only permissions (0o700).
+ * Files are written with owner-only permissions (0o600).
+ *
+ * @param path Path to save the policy file
+ * @param policy The policy set to save
+ */
+export declare function savePolicy(path: string, policy: PolicySet): void;
+/**
+ * Returns a list of built-in policy file names from the policy directory.
+ * Returns empty array if the directory doesn't exist or is empty.
+ */
+export declare function getBuiltinPolicies(): string[];
+/**
+ * Built-in policy rule templates for common hardening checks.
+ * These can be used as a starting point for custom policies.
+ *
+ * SECURITY: All check commands use direct binary invocation (no shell).
+ * Shell interpreters (sh, bash, etc.) are never used in check or remediation arrays.
+ */
+export declare const BUILTIN_RULE_TEMPLATES: PolicyRule[];
+//# sourceMappingURL=policy-engine.d.ts.map

package/build/core/policy-engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-engine.d.ts","sourceRoot":"","sources":["../../src/core/policy-engine.ts"],"names":[],"mappings":"AAQA;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAE7E;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,QAAQ,EAAE,cAAc,CAAC;IACzB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,kCAAkC;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,2CAA2C;IAC3C,MAAM,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,4BAA4B;IAC5B,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,kCAAkC;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,8BAA8B;IAC9B,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB;AA4ED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,SAAU,GAAG,IAAI,CA0CxE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CA0BrE;AAID;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CA0E1E;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,SAAS,GACnB,OAAO,CAAC,uBAAuB,CAAC,CAwClC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAwBlD;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI,CAQhE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAY7C;AAED;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,EAAE,UAAU,EAwT9C,CAAC"}